And the backup is field-tested to fall over within a few hours of the primary ;-)

<https://news.ycombinator.com/item?id=32048148>

<https://news.ycombinator.com/item?id=32031243>

(AFAIK that specific failure mode has in fact been addressed.)