improve failover/recovery docs

Cross-link between them, and clarify that degradation can be caused by
deliberately killing a node.