If your secondary is doing work, then you'll get a performance degradation from losing the primary anyway. The difference here is that once the slave's warmed

If your secondary is doing work, then you'll get a performance degradation from losing the primary anyway. The difference here is that once the slave's warmed up you're back to full speed, whereas with a hot-spare-being-read-from the performance degradation lasts until you bring the other box back. Any such corruption is effectively a buggy update - normal replication will propagate a buggy write just as happily, and even if it crashed the node entirely there's a good chance your application's retry logic will re-run the write against the slave in a moment.