I would love to see an engineering document from the BU that explains (with some diagrams) how this concept is designed to work, taking into account the various failure components (PAN node failure, inter-PAN link failure, etc.)
In my view, health checking with a two node setup (both of whom are candidates) can get tricky, because when there is a split brain scenario, then either node can promote itself to be the primary (imagine that Node A doesn't hear from Node B - then it thinks, I am the master - and vice versa). This would arise if both nodes were actually perfectly healthy, but the network link between them gets cut - then they run blind.
A third node provides a concept where we can observe the situation from an outsider's view to determine who is alive or not. This is why we would nominate a MnT node to be a health checker.
One might argue that failover can and does work with two nodes (e.g. HSRP/VRRP etc) and if one were to place priority values then one doesn't need an external health checker. Would be good to hear from the BU :-)
