We are the development and operations team of Alibaba Cloud’s messaging middleware, running thousands of tenant-isolated, stateful clusters in production. Through years of handling real incidents such as node crashes, I/O stalls, and network partitions, we observed a practical “trilemma” in stateful disaster recovery: low cost, high steady-state performance, and fast failover are hard to achieve at the same time, echoing well-known engineering trade-offs in distributed systems and SRE practice. This paper presents a production-grade, second-level failover mechanism for cloud-deployed stateful services, aiming to balance the three under realistic engineering constraints. Our design keeps the steady-state data path unchanged by continuing to use the local file system and cloud block storage. During failover, we enforce protocol-level fencing to enable fast and safe takeover: leveraging disk Multi-Attach and NVMe Persistent Reservation, the new node can preempt immediately to prevent split-brain without waiting for the detach/attach workflow. We further introduce decentralized lease probing and a least-privilege, node-side agent that performs preemption, mounting, and switchover orchestration on the critical recovery path. Experiments using Apache RocketMQ as a representative workload show that, without reserving extra physical replicas and without introducing additional write amplification, our approach achieves end-to-end failover in seconds while keeping steady-state throughput and latency close to a native single-replica deployment. The system has completed tens of thousands of disaster-recovery drills and is now running in production.