* Each master synchronously replicates to a '''hot standby''' in the same DC, to guard against individual machine failure.
** This may not be necessary, depending on instance reliability and our uptime requirements.
* Each master asynchronously replicates to a '''warm standby''' in a separate DC, to guard against whole-DC failure.
** Or maybe to multiple independent DCs. Same same.
** The warm standby should probably be a synchronous replication pair. Because symmetry. And failover.
* All sharding logic and management lives in a stand-alone proxy process, so that it's transparent to the application.