The cluster database now runs on power-loss-protected storage

The instability that forced this migration forward was the cluster database stalling on slow disks.

Its members now run on the only enterprise drives in the estate that survive a sudden power cut without losing buffered writes. Write buffering was enabled on the controller — previously every write went straight to the platter — and memory reclamation was turned off for these machines, because taking memory back from a latency-sensitive database is exactly the wrong thing to do under pressure.

All five control-plane machines are now sized identically. A cluster database runs at the speed of its slowest member, and uneven members make leadership flap between them.