Failure class
A partition leaves two nodes both acting as primary — writes diverge.
2 incidents on record
A day of stale, read-only metadata; webhooks and Pages builds frozen; manual write reconciliation afterward.
Automated failover that reacts faster than your network heals can manufacture split-brain. Tune failover to application topology, not just node liveness.
Notification dispatch was completely down for 18 minutes after two of PagerDuty's three datacenters failed simultaneously; the events-ingestion API stayed up throughout.
Redundancy plans must verify physical and network independence between supposedly separate failure domains, not just assume it from provider region boundaries.