Use: failover group + health dimensions + resource epoch.
- Detect unsafe primary (auth failure, sustained errors — not a single blip)
- Acquire failover authority (capability / quorum as required)
- Activate standby
- Verify standby health
- Advance resource epoch so stale callers are rejected
- Journal the decision
Failback is a separate controlled workflow — never automatic by default.