@kbon there's nothing invalid about having multiple shadow CIBs. It works with the pacemaker tools and it works in the current code. This PR breaks it, and doesn't document the new behavior, which is not only backwards-incompatible, but potentially destructive, and definitely surprising.

Besides that issue, it looks like this PR introduces a significant change in semantics: cs_shadow must be explicitly notified if one wants the shadow to be committed. I think maybe that's better, but it is an incompatible change, and the documentation has not been updated.