Quorum and regions

The rule that decides when an incident exists: regions vote, a quorum confirms, and everything below quorum stays visible without paging anyone.

The regions

Six probe regions, one per inhabited continent: na-ewr, sa-gru, eu-fra, af-jnb, as-sgp, oce-syd. Free plans probe from 2 regions, Pulse from 3, Sentinel and up from all six. The network page covers the fleet architecture.

Two thresholds before an alert

1. Within a region, 75% of the region’s probe nodes must agree before the region votes. A single node disagreeing with its neighbors is recorded as drift, not as an outage.
2. Across regions, an incident opens when a quorum of regions confirms the failure: two regions by default. Recovery has its own quorum, and results older than the freshness window do not count.

The incident’s start time is the quorum confirmation, to the second, and the recovery boundary is the confirmed recovery. Those are the exact window boundaries your availability record uses. Nothing is rounded, nothing is backdated.

Below quorum: forming and watchlist

• A forming incident (first region failing, quorum not yet reached) is visible in the product with the first failing region named, and sends exactly one quiet notification per episode.
• Sub-quorum divergences (one region drifting, one IP family failing, one node disagreeing) land on a watchlist. An entry must survive a full check interval before it is reported at all; you investigate on your schedule, not at 3 a.m.

Why a rule and not a model

There is nothing to tune and nothing to second-guess. The same rule that keeps a flaky transit route from paging you is the rule that defines your SLA window boundaries later. One mechanism, both halves of the promise.