High availability
Active/standby, two nodes, heartbeat plus fencing — no election. Session, NAT-block and accounting state replicate to the standby. Failover is manual in v1.0.
The model
A link and heartbeat drive a role state machine, and the standby carries replicated session, NAT-block and accounting state so a failover does not restart every subscriber session from discovery. Because there is no election, split-brain is handled by fencing rather than quorum.
Upgrade procedure
Upgrade the standby first, fail over to it, then upgrade the former active. Configuration format compatibility is maintained across the patch line, and the candidate model means the whole change set can be validated with commit check before it is applied.