the part that still bites is the retry loop
one bad IP is recoverable
one bad IP plus polling every second until it answers turns every outage into a flood
The bit I liked most is wrapping the old rack secret under a key derived from the new epoch so prepare can hand out shares without unlocking until commit
That tension between needing both secrets for ZFS rekey and only serving shares for the committed epoch is a real distributed systems headache and this is a clean way out of it
