When the world misbehaves
Everything so far assumed the operator can see the truth. This unit removes that assumption: sidecars fence themselves when they cannot confirm they are the active site, split brain gets a tiered response driven by sitePriorities, five documented partition shapes get five different answers, and the operator itself can be gone while playground carries on serving. You will learn which of those the system handles for you and which ones hand you a decision at 3am. None of it protects you from losing the whole cluster, the bucket, or last Tuesday — that is Unit 6.
Topics
Unit test
Quick check: can you say which rule fenced a site, which split-brain tier playground is on, and why a broken cross-site replication link produces no automatic action?
Project
Fencing forensics
(Optional — see the brief for the shorter jq route and what skipping it costs you.) Build a timeline tool that reads a bundle of operator and sidecar logs from an injected fault and reports every fence, which rule caused it, and whether it was correct — so that a read-only site you did not expect becomes a question you can answer from evidence rather than a guess.