If we're not going to return a standard error code on the basis of one event going bad (which seems simpler, though I admit it might make recovery harder), we need to at least return an error-code event. Otherwise we might have a corrupted primary and never notice if we're not watching the log — which is especially rude if we have the right events on the other replicas.