The question I design to: if this system fails at 2 AM, can someone who isn't me fix it? Not the senior engineer who built it, whoever is on call, with the docs, at the worst possible hour.
That constraint rules out the clever stuff. No undocumented failover, no tribal-knowledge deploys, no 'SSH in and restart the thing.' If recovery needs you, the system isn't done.
The 2 AM test produces boring systems: clear runbooks, obvious failure modes, and a restore path that works without the author. That's not a limitation, it's the design goal.
