117
failover
A named promotion when the primary dies. If you have never run it, you do not have it.
What is failover?
Failover moves work from a dead primary to a standby. Automatic failover is fast and can be wrong (split brain: two primaries). Manual failover is slower and safer. Both need a fence so the old primary cannot keep writing.
Why does failover matter when vibe coding?
Models set `replica: true` and stop. Nobody has promoted it. Split brain is how you get two histories. Say who promotes, and how the old leader is fenced.
How do you do failover?
Write the steps: detect, fence, promote, repoint clients. Run them on a schedule against a staging pair. Prefer a short outage to two writers.
How do you ask a model for failover?
Document failover for (store). Detect failure, fence the old primary so it cannot write, promote the standby, repoint clients. Do not allow two primaries. Do not claim automatic failover you have not run.
What goes wrong with failover?
Clients with the old primary’s address cached forever. Failover includes discovery, not only the database command.