Both instances can communicate with the PostgreSQL database, even at the same time, and upgrades would just happen to one, so if / when there are issues, there'

Both instances can communicate with the PostgreSQL database, even at the same time, and upgrades would just happen to one, so if / when there are issues, there'd still always be at least one working. End users generally wouldn't have any involvement in choosing instances. Since the instances themselves don't store your account data, you'd be able to post regardless of which instance it is.