anchor.diff:  orchestrate_failover(Nodes) ->
       ale:info(?USER_LOGGER, "Starting failing over ~p", [Nodes]),
       master_activity_events:note_failover(Nodes),
  -    failover(Nodes),
  -    ale:info(?USER_LOGGER, "Failed over ~p: ok", [Nodes]),
  +
  +    ErrorNodes = failover(Nodes),
  +
  +    case ErrorNodes of
  +        [] ->
  +            ns_cluster:counter_inc(failover_complete),
  +            ale:info(?USER_LOGGER, "Failed over ~p: ok", [Nodes]);
  +        _ ->
  +            ns_cluster:counter_inc(failover_incomplete),
  +            ale:error(?USER_LOGGER,
  +                      "Failover couldn't "
  +                      "complete on some nodes:~n~p", [ErrorNodes])
  +    end,
  +
       ns_cluster:counter_inc(failover),
  +    deactivate_nodes(Nodes),
  +
  +    ok.
  +
  +deactivate_nodes([]) ->
  +    ok;
  +deactivate_nodes(Nodes) ->
  +    ale:info(?USER_LOGGER, "Deactivating failed over nodes ~p", [Nodes]),
       ns_cluster_membership:deactivate(Nodes),
   
       OtherNodes = ns_node_disco:nodes_wanted() -- Nodes,
       LiveNodes  = leader_utils:live_nodes(OtherNodes),
   
  -    ns_config_rep:ensure_config_seen_by_nodes(LiveNodes),
  -
  -    ok.
  +    ns_config_rep:ensure_config_seen_by_nodes(LiveNodes).
   
   %% @doc Fail one or more nodes. Doesn't eject the node from the cluster. Takes
   %% effect immediately.
   failover(Nodes) ->
  -    ok = failover_buckets(Nodes),
  -    ok = failover_services(Nodes).
  +    lists:umerge([failover_buckets(Nodes),
  +                  failover_services(Nodes)]).
   
   failover_buckets(Nodes) ->
       Results = lists:flatmap(fun ({Bucket, BucketConfig}) ->
                                       failover_bucket(Bucket, BucketConfig, Nodes)
                               end, ns_bucket:get_buckets()),
       failover_buckets_handle_failover_vbuckets(Results),
  -    ok.
  +    failover_handle_results(Results).
   
   failover_buckets_handle_failover_vbuckets(Results) ->
       FailoverVBuckets =
  
positive.code:         ok ->
              ?log_debug("Failed over service ~p on nodes ~p successfully",
                         [Service, Nodes]);
          Error ->
              ?log_error("Failed to failover service ~p on nodes ~p: ~p",
                         [Service, Nodes, Error])
      end.
  
  get_failover_vbuckets(Config, Node) ->
      ns_config:search(Config, {node, Node, failover_vbuckets}, []).
  
negative.code:     KVs = [{{node, N, failover_vbuckets}, VBs} || {N, VBs} <- FailoverVBuckets],
      ns_config:set(KVs).
  
  failover_handle_results(Results) ->
      NodeStatuses =
          misc:groupby_map(fun (Result) ->
                                   Node   = proplists:get_value(node, Result),
                                   Status = proplists:get_value(status, Result),
  
                                   {Node, Status}
                           end, Results),
  
      lists:filtermap(fun ({Node, Statuses}) ->
                              NonOKs = [S || S <- Statuses, S =/= ok],
  
                              case NonOKs of
                                  [] ->
                                      false;
                                  _ ->
                                      {true, Node}
                              end
                      end, NodeStatuses).
  
  failover_bucket(Bucket, BucketConfig, Nodes) ->
      master_activity_events:note_bucket_failover_started(Bucket, Nodes),
  
  