E.g. some periodic replication + external down detector + a break-before make failover that brings up the cold, accepting any unreplicated state will be trashed and rendering the hot inactive until manual reactivation
[0]: https://twitter.com/HNStatus
[1]: Last tweet since before today's incident was 2 years ago, 4 years ago since the one before that.