You Don't Have Failover Until You've Killed a Server on Purpose

Every architecture diagram I have ever seen promises resilience. Redundant instances, a standby...