A recovery plan needs more than a second copy of the database. Someone must decide who may write, what data might be missing, and which user operations remain safe. These tasks combine regional recovery with payment uncertainty and service objectives on fresh workloads.
Use a measurable denominator for an error budget. Keep the user-visible symptom separate from the machine signal that helps explain it. During failover, a routing change can't prove the previous writer stopped; storage needs a fence. For an external payment, a missing response can't prove nothing happened. Apply the recovery policy at the boundary where the uncertainty lives, then use metrics and durable records to make that uncertainty visible rather than silently declaring success.