Geo-replication and active-active

Why can local writes and one global order not coexist across an ocean?

Three constraints converge here, and only one of them is technical.

• Physics gives the 70–150 ms cross-continental RTT, capping serial writes to one key at about 10 per second if the serialization point is on the far side.
• Economics adds a metered per-GB charge on every cross-region byte. In the placement objective this is simply a second term.
• Law adds data residency (rules that some data must stay in some country). This is an organizational constraint that behaves exactly like a hard placement constraint and cannot be traded against latency at any price. It is the first constraint here that engineering cannot negotiate at all.

From those the whole design space follows. If you want local-latency writes, the serialization point must be near the writer. There are only two ways to arrange that:

1. Partition ownership geographically: this row's home is the EU, that row's home is us-east.
2. Abandon single ownership and accept concurrent versions.

There is no third option. That is why almost every successful "active-active" deployment is, on inspection, active-active across the key space and single-master within each key. Systems that are genuinely symmetric per key have paid in the currency of consistency models, with last-write-wins or CRDTs, and the bill is exactness, not latency.

If instead you want a single global order, geography is on the critical path and the only remaining lever is quorum geometry. With three regions and majority commit, every write waits for the second-nearest region. The placement of the third replica sets your write latency, and the placement of the leader sets which region is the second-nearest.

The classic mistake is to place replicas for maximal failure independence and then to discover that maximal independence is also maximal distance. It is the same tension as rack awareness, at planetary scale and with a much steeper cost curve.

Finally, the topology chooses your recovery point objective (RPO) before any failure occurs. RPO is the amount of data you can lose in a disaster. Synchronous cross-region replication means RPO zero and geography in the write path. Asynchronous replication means local writes and an RPO equal to the replication lag at the moment of the loss. The failover procedure itself is a recovery topic. What matters here is that the number is fixed by the topology, not by the failover, and a system advertising async geo-replication has already decided how much data it is willing to lose.

Compression: local writes and one global order cannot coexist across an ocean, so you either partition ownership by geography or manufacture conflicts, and with majority quorums the second-nearest region sets your commit latency.