The artifact

What lands in the quarterly capacity plan

Not an alert. A recommendation with the arithmetic attached, written so a platform lead can put it in front of whoever controls the spend and defend every number in it.

Capacity review · tail risk4 services under-provisioned90 d of hourly peaks · GPD, threshold q0.8
Recommendation

Provision checkout-api for 2.94s, the modelled worst hour in 365 days, rather than 1.02s, its p99.9 over the last 90 days. That is 79 replicas against 28 today. The fitted shape parameter is 0.41, which puts this service in the class with no finite upper bound: the worst hour observed so far is not evidence of a ceiling.

service            checkout-api  (owner: Payments)
samples            2,160 hourly peaks over 90 days
fit                GPD, threshold 244ms, 432 exceedances
                   xi = 0.415   beta = 52.9

current target     1.02s   (p99.9 of the window)
  modelled recurrence of that level    every 23.1 days
  in flight at 3,200 rps            3,254 requests
  replicas at 120/replica            28

recommended target 2.94s   (1 in 365 days)
  in flight at 3,200 rps            9,422 requests
  replicas at 120/replica            79
  delta                                +51 replicas

for reference      1 in 1,000 days = 4.41s (118 replicas)
Fleet
ServiceξTarget todayRecommendedReplicasAction
checkout-api0.411.02s2.94s2879Add 51. Exceeds current target every 23 d.
ledger-write0.33707ms1.39s1121Add 10. Exceeds current target every 41 d.
search-suggest0.17471ms720ms1320Add 7. Exceeds current target every 41 d.
auth-token0.01185ms225ms56Add 1. Exceeds current target every 45 d.
asset-edge-0.26115ms122ms44No change. Bounded tail, already covered.

Total fleet change: +69 replicas across 4 of 5 services. Two services need nothing, which is the half of the recommendation that saves money.

What this does not decide

It does not tell you which horizon to plan for. A 1-in-365-day target is a business choice about how often you are willing to shed load, and it belongs to whoever owns the SLO, not to the model. It also assumes exceedances are independent. Real incidents cluster, so a fit run on undeclustered data will read heavier than the truth. The exceedance count and threshold are printed above so that assumption is visible rather than buried.