Gaudi compute nodes themselves hold no persistent state worth backing up — if one dies, we just reprovision it (see Bringing a New Node Online). What does need protecting is the management layer:
| Scenario | How fast we're back | Data lost |
|---|---|---|
| Management-plane failover (one management node dies) | Under 5 minutes | None |
| Management-plane restore from backup | Under 4 hours | Up to 24 hours |
| Full cluster has to be rebuilt from scratch | 24–72 hours | None (nodes are stateless) |
Cluster configuration lives in version control (config-as-code), and the management database is snapshotted daily to object storage. We test failover twice a year and a full restore-from-backup once a year to make sure these numbers hold up in practice, not just on paper.