An existing cross-Region application has a read replica but recovery fails because clients continue writing to the old primary. What must be added to the recovery design?

1. Only add more read replicas without changing writer control.
2. Allow both independent primaries to accept conflicting writes indefinitely.
3. Coordinate promotion, writer fencing, traffic cutover, and controlled failback.
4. Assume DNS TTL zero guarantees every client instantly abandons existing connections.