Safety

qfence makes one promise: at most one site owns an availability plan at any time. A site becomes the owner only through the raft quorum, which a majority of voters must agree to; each new owner gets a higher generation, which every fence and every command carries, so a stale command is refused; and the site being given up is fenced, its fence proven, before the new owner is promoted. When qfence cannot prove what it needs, it stops and says why: the plan is BLOCKED, and nothing is promoted.

• What the tests prove lists every split-brain, chaos and acceptance scenario, the test that covers each, and what is not yet covered. It is the project’s own record, SAFETY.md, and changes with the tests.
• Known limitations are the ones to read before you deploy qfence for real.

Nothing that affects this promise is ever paid for. Fencing, quorum, the witness and everything else that keeps two sites from both owning a plan are in this open-source core, complete and free, for as long as the project lasts (spec §56). What is paid for is convenience on top of it:

• A witness run for you. It is an ordinary raft voter, like the self-hosted witness, which does the same job free.
• A hosted control and observability plane, a dashboard across deployments that orchestrators can send their audit records and events to. It is never on the path that decides a failover: an orchestrator cut off from it fails over exactly as before. Critical Acceptance Test 9 checks that in every build (spec §58).

To see the evidence for yourself, run the whole suite from a clone:

go test ./... -race

It forms real three-voter raft clusters, partitions them, and checks that no partition ever ends with two owners. Each test named in What the tests prove can be run on its own with go test ./<package>/... -run <TestName> -v.