A replica promoted during a drill, on purpose

A failover procedure written in 2023 and executed for the first time on a Saturday in January.

the runbook said seven steps. the drill found nine.

  step 3.5   the application's write host is in a
             config file baked into the image, not an
             environment variable. a promotion needs a
             deploy.
  step 6.5   the monitoring exporter connects with a
             user that has REPLICATION CLIENT on the
             old primary only.

time to serve traffic from the replica: 22 minutes.
the runbook estimated eight.

A runbook that has never been executed is a hypothesis, and the two missing steps were both configuration that lived in a place nobody thought of as part of the database topology. Twenty-two minutes against an estimate of eight is the number that matters for the recovery objective, and it is now the number in the document.