A proposed architecture is more reliable in theory and substantially more complex to operate. How should that be evaluated?

The central point

Compare operated reliability, not designed reliability.

A multi-region active-active architecture is more available in theory and introduces bidirectional replication, conflict resolution, split-brain risk, a more complex failover path and a much larger operational surface. Each of those is a new failure mode, and the aggregate frequently makes the system less reliable in practice than a simpler design operated well.

Complexity has a reliability cost, and it is systematically omitted from these comparisons because it does not appear in an availability calculation.

How to evaluate

1. Enumerate the new failure modes the complexity introduces, not just the ones it removes. A control plane that can push a bad configuration everywhere is a new correlated failure domain.

2. Ask whether the team can operate it. A design requiring expertise the team does not have will be operated badly, and badly-operated redundancy is worse than none because it creates confidence.

3. Check whether the failure being protected against is the one that actually occurs. Most serious incidents come from change — a deploy, a configuration push, a dependency change — against which instance and region redundancy provide no protection at all, because identical replicas share code and configuration.

4. Quantify the exposure. What does an hour of unavailability cost this specific system, multiplied by the realistic probability? Compare against the ongoing cost and risk of the complexity.

What frequently delivers more reliability for less complexity

• Staged rollout with blast-radius limits, which addresses the actual dominant cause of outages.
• Rollback faster than rollout, independent of whatever broke.
• Capacity headroom sized for N-1, which is what makes redundancy work at all.
• Cell isolation, bounding blast radius without bidirectional replication.
• Rehearsed degradation, converting an uncontrolled failure into a designed one.

Each is simpler than multi-region writable and addresses failure modes that are more likely.

The judgement

Reliability comes from simplicity plus rehearsed recovery at least as often as from redundancy. An architecture whose failure path has never been exercised is not more reliable regardless of its topology — and active-active's genuine advantage is precisely that its failover path is the normal path, exercised constantly.