Write-ahead log replication

Design a write-ahead-log shipping and replication system that keeps a hot standby (and cross-region replicas) in sync with a primary database for high durability and fast failover. The primary commits thousands of transactions/sec; you must bound data loss on primary failure (a target RPO) and bound failover time (RTO), and support point-in-time recovery. How do you ship the log, apply it on replicas, and fail over safely?