Operations

High availability — honest posture

What we deliver today, what is planned, and what is not yet shipped. This page is deliberately conservative so production customers can plan against reality — not a roadmap deck.

Today

Managed cloud runs a single writer per graph. Reads attach to immutable published state without blocking writes. Recovery from a single-instance restart is automatic and zero-loss. Vertical scale and managed backup are the current availability substrate.

Delivered today

What you get on the current release

Vertical scale on r7g up through r7g.2xlarge. Per-graph resource caps, bounded working-set memory, per-graph observability.
Managed backup with point-in-time restore. Backups are portable, integrity-verified, and can be restored to any recorded moment. See backup + restore.
Automatic single-instance recovery. Zero-loss restart. No operator step for ordinary restarts.
Snapshot-isolated reads. Readers attach to immutable published state; write traffic never blocks a read.

Not yet shipped

What the current binary does not do

Multi-node write replication. There is one writer per graph. There is no synchronous quorum, no leader election, no automatic write failover.
Read replicas / horizontal read scale-out. Read throughput is bounded by the single instance. There is no reader pool consuming a shared log.
Cross-region failover with sub-second RTO. Cross-region deployments are single-region-primary today. There is no automatic geographic failover.
Zero-downtime writer deploys. Writer deploys accept a brief write interruption bounded by the recovery window. Read traffic against the last published snapshot continues.

Availability numbers you can plan against

Concrete numbers for the current single-writer release. These are the SLO shape managed cloud plans against; contractual SLA language is negotiated per customer.

Managed cloud target

99.5% monthly

Single-writer availability target. Contractual SLA figure is set per customer in the production contract.

Recovery time (restart)

Bounded & automatic

Automatic on ordinary restart. The recovery window scales with recent write volume, not with total data volume, and is published on the operator surface.

Recovery point (restart)

Zero data loss

Every acknowledged write is durable before the client sees the acknowledgement, and recovers on restart.

What we can offer under contract today

The single-writer footprint supports several deployment shapes that improve availability without waiting for multi-node write replication. These are negotiated as part of onboarding:

Warm-standby with managed backup restore. A second instance in a separate availability zone stays ready to be promoted from the most recent point-in-time backup. Recovery time is bounded by restore + replay to the target moment.
Isolated per-tenant writers. Independent tenants map to independent single-writer instances. A single failing tenant does not affect the availability of other tenants.
Instance-size headroom. The r7g family gives per-graph memory + IOPS headroom that keeps single-writer throughput above practical read pressure for the graph shapes we see today.

What is planned

Two work streams are active. Both are documented publicly as engineering roadmap items, and both are ahead of any commitment to a specific release date.

Roadmap — near-term

Reader-pool port

Horizontal read scale-out. A pool of read-only instances tracking the same published state the writer produces.

Target: Q3 / Q4. The primary-replica substrate needed for this landed in an earlier release; the port to the current engine is the remaining work.
Consistency: read-your-writes on the writer, bounded-staleness on the pool. Applications that need strict read-after-write pin to the writer; queries that tolerate bounded staleness route to the pool.

Roadmap — scaling substrate

Storage scaling roadmap

Bounded per-graph lifecycle for durable state and cached derived state. Ships first so the reader-pool port lands on a scaled substrate.

Governed retention policy. Every retained artifact has a customer-configurable window with a typed refuse-if-exceeded contract — a query naming an out-of-window moment refuses cleanly rather than silently returning empty.
Prerequisite for the second large-graph tenant. Documented publicly so customers running toward multi-tenant scale can plan against the substrate that will host them.

What is not on the near-term roadmap

Called out explicitly so nothing on this page is aspirational:

Synchronous quorum-replicated writes with automatic leader election.
Multi-region active-active writes.
Cross-region failover with sub-second recovery-time objective.

These are on the longer engineering horizon. When they move into an active work stream, they will appear here first — not on a marketing page.

Enterprise conversations

If your production shape needs a specific availability posture — warm-standby, tenant isolation, custom recovery-time targets, or an early read-pool preview — talk to us. We publish this page in its honest shape precisely so those conversations start from reality.

Talk to us about a production deployment

Custom deployment reviews, availability targets, and roadmap alignment.

Contact enterprise

Backup + restore — the single-instance disaster-recovery substrate this release relies on.
Operations — general operator surface (liveness, deploys, rollback, incident response).
Design principles — the capability guarantees that hold regardless of topology.