Leader Failover States — Election, Split Brain, Old Leader Returns Diagram

What Failover Really Means

The leader stops responding and a follower is promoted to take its place
Election timeout triggers a candidate to request votes; the majority makes the decision
A node that loses an election simply returns to being a follower — the cheap way out of a race
Consensus algorithms make this whole dance safe; hand-rolled elections have lost real data

The Danger Window

A crashed node and a slow or partitioned node look exactly the same from outside
The old leader may still accept writes that the new leader knows nothing about
The only safe response to an uncertain old leader is to fence it: epoch numbers, leases, or a lock service
During failover some writes can be lost or clients can see errors — the guarantee is only as strong as the fencing

Before You Automate

Failover is rare in practice, so the recovery path is tested the least and fails the most
A wrongly timed failover of a node that is merely slow can turn a hiccup into an outage
Replication lag means a promoted replica can silently discard recent writes unless synchronous commit is used
Split brain is not an edge case: it is what happens when two nodes both believe they lead