We are using patroni to set up 1 primary and 5 slaves, and using ANY 2 (*) to commit a transaction if any 2 standbys receive the WAL. If there is a network partitioning between the primary and the slave, then commit will hang from user perspective, but the commit is actually done locally, just waiting for remote ack which is not possible because of network split. And if patroni promotes a slave to primary, then we will lost data. Do you think of a different design: first wait for remote ACK, and then commit locally, this will only failed if local commit failed, but local commit fail is much rarer than network partitioning in a cloud env: it will only fail when IO issue or disk is full. So I am thinking of the possibility of switch the order: first wait for remote ACK, and then commit locally.
