Multi-Region Database Failover: What Actually Breaks in Production

Every vendor's marketing page makes multi-region failover sound like flipping a switch: primary goes down, replica takes over, traffic reroutes, nobody notices. I've been through four real failovers now — two planned, two not — and none of them matched that description. The gap between "we have a replica in another region" and "we can actually fail over without losing data or serving stale reads" is where most of the real engineering work lives.

This post covers the failure modes that don't show up until you're already in an incident, and the design decisions that determine whether failover is a non-event or a multi-hour outage.