we could .recover here to make sure a write doesn't drop the downstream.

Is that the right thing or let it fail, and see the restarts in nimbus?