Split-brain, and the check that refuses to promote

A manual failover, and a guard against the case where the old primary is still writing.

# before promoting, from the standby
lag=$(mysql -h "$PRIMARY" -N -e 
  'SELECT TIMESTAMPDIFF(SECOND, MAX(beat), NOW()) FROM heartbeat' 
  2>/dev/null) || lag=unreachable

if [ "$lag" != unreachable ]; then
  echo "the primary is REACHABLE and $lag seconds behind."
  echo "this is not a failover. investigate."
  exit 1
fi

Refusing to promote while the old primary answers is the check that prevents two writable databases, and it means a network partition between the standby and the primary produces a refusal rather than a split brain. That is the correct failure — a failover that will not proceed is recoverable and two primaries are not.