Two regions, one serving. Crash the active one and every request fails until failover lands.
Measured as shipped: p99 95ms, 0% of requests failing, 198/s answered.