Loss stops the estate serving, or risks losing data that cannot be reconstructed. Everything else waits while this is being fixed.

The estate keeps serving without it, but a major capability or the ability to recover is gone. A tier-1 outage that lasts is how a tier-0 outage becomes unrecoverable.

Loss is visible and annoying; nothing else is at risk. Fix it in hours, during waking ones.

Loss is accepted by policy. No objective, no page, no incident priority above P4.

Everything else is clustered or active/passive. A service appears here only if someone accepted the exposure in writing, with a date to look at it again.

A failover target only counts if it is in another domain. These are the boundaries every redundancy claim on this page is measured against.

• § Accepted risk: The class requires redundancy and there is none. vin
  VIN / VPS is single-node but tier-0 requires a redundancy model.
  Accepted by homelab-operator, review 2027-02-15: VIN is the only public-ingress node in the estate. A second edge means a second VPS bill and DNS-level failover; the fleet's cost policy is zero new recurring spend. A 15 minute rebuild from the crown-jewels backup is the accepted answer.
• § Accepted risk: The class requires redundancy and there is none. caddy
  Caddy (reverse proxy) is single-node but tier-0 requires a redundancy model.
  Accepted by homelab-operator, review 2027-02-15: Inherited from VIN being the only public-ingress node. A second proxy would need a second public node and DNS failover. The Caddyfile is managed configuration restored from the crown-jewels tier in minutes.
• § Accepted risk: The class requires redundancy and there is none. redis
  Redis (cache / queue) is single-node but tier-0 requires a redundancy model.
  Accepted by homelab-operator, review 2026-11-15: Contents are rebuildable and a restart is seconds. A Sentinel cluster needs a third voting domain this estate does not have, and would introduce split-brain risk to buy availability for data we are willing to lose. The exposure is the auth coupling below, not the data.
• § Accepted risk: The class requires redundancy and there is none. jarvisos-auth
  JarvisOS Auth (SSO) is single-node but tier-0 requires a redundancy model.
  Accepted by homelab-operator, review 2027-02-15: Inherited from VIN being the only public-ingress node; a standby would have nowhere independent to run. Restored in minutes from configuration, and the recovery console is deliberately reachable without it.
• § Accepted risk: The class requires redundancy and there is none. wireguard-tunnel
  WireGuard (Home1 <-> VIN) is single-node but tier-0 requires a redundancy model.
  Accepted by homelab-operator, review 2027-02-15: One WAN path per side. A second path means a second circuit or an LTE failover device — recurring cost against a fleet policy of none. Mitigation is detection, not redundancy: the handshake probe exists so a partition is not misdiagnosed as a dead node.
• § Accepted risk: The class requires redundancy and there is none. isp-uplink
  ISP Uplink is single-node but tier-0 requires a redundancy model.
  Accepted by homelab-operator, review 2027-02-15: One circuit, no second uplink. A backup uplink is recurring cost against a zero-new-spend policy, and the estate is designed so that the edge node keeps serving during a home outage.

• i Note: An accepted risk no longer matches any finding. vps1
  An accepted risk for "single-node-unaccepted" no longer matches any finding; it can be removed.

• RTO is measured from fault detection to service restored, for a fault in the component itself. The worst case including dependency recovery is derived, not declared: see achievableRtoMinutes on the availability page.
• RPO applies to the data a service owns. A service whose durable state lives elsewhere records that in stateHeldIn and carries only a configuration RPO.
• Availability targets are stated over a rolling 30 days and are aspirations, not contracts: nothing here measures uptime yet. The honest figure is the incident log.
• This estate has two independent compute domains. Majority quorum needs three, so every stateful failover is manual and fenced by hand. That is a deliberate choice, not an oversight: automatic promotion across two sites turns a partition into split-brain.

Source: config/service-classes.json · machine-readable at /api/v1/availability · narrative in docs/HA-CLASSIFICATION.md.