This flow mirrors the cross-region failover trace. The stages show how a circuit breaker (detailed in the circuit breaker article) drives the failover decision, and how routing updates (related to the load balancing article) shift traffic to the backup region.
Stage-by-stage execution walkthrough
This request flow decomposes Multi-Region Active-Passive Architecture into 5 sequential stages so you can trace where latency accumulates, which state transitions are irreversible, and where production failure modes occur.
Stage 1: Primary region serves traffic
All user traffic goes to the primary region. Health checks pass and the circuit breaker is closed. During this transition, the runtime enforces strict state invariants before handing control to the next stage: inputs are validated at the boundary, state mutations are ordered deterministically, and latency/resource costs are bounded so downstream consumers never observe a torn or partially initialized state.
Stage 2: Health monitoring detects failure
Health checks start failing. The failure rate crosses the circuit breaker threshold. The circuit breaker trips to open. During this transition, the runtime enforces strict state invariants before handing control to the next stage: inputs are validated at the boundary, state mutations are ordered deterministically, and latency/resource costs are bounded so downstream consumers never observe a torn or partially initialized state.
Stage 3: Failover controller promotes backup
The failover controller promotes the passive region: read replicas become writable, capacity is scaled, and replication lag is checked against the acceptable data-loss window. During this transition, the runtime enforces strict state invariants before handing control to the next stage: inputs are validated at the boundary, state mutations are ordered deterministically, and latency/resource costs are bounded so downstream consumers never observe a torn or partially initialized state.
Stage 4: Routing updates point to backup
DNS records and load balancer target groups are updated to route traffic to the backup region. Requests begin shifting over. During this transition, the runtime enforces strict state invariants before handing control to the next stage: inputs are validated at the boundary, state mutations are ordered deterministically, and latency/resource costs are bounded so downstream consumers never observe a torn or partially initialized state.
Stage 5: Backup region serves traffic
The backup region takes over all user traffic. The circuit breaker for the backup is closed. The primary region is in recovery mode. During this transition, the runtime enforces strict state invariants before handing control to the next stage: inputs are validated at the boundary, state mutations are ordered deterministically, and latency/resource costs are bounded so downstream consumers never observe a torn or partially initialized state.
Production invariants and failure modes
The system is stable on the backup region and the primary region has either recovered or been decommissioned. When debugging or capacity-planning this flow in production, instrument each stage boundary separately (measuring both p50 median and p99.9 tail latency), verify what happens when an intermediate stage times out or drops packets, and ensure retry or fallback paths preserve end-to-end idempotency.