Okay, convinced. Please add a note to the docs (if not already there) that downing might be required even when the failure happens late during a graceful exit, just so people are not surprised (“it should have been obvious to the cluster … ”).