If three downstairs have all faulted, the upstairs can't self recover

[leftwo]

After the upstairs is active, if all three downstairs go to faulted, we have no path back to a working upstairs.
The current path back to working requires having a good downstairs to LiveRepair from.

In this situation, we need to revert back to reconciliation and use that to return ourselves to service.

If you have an instance in this state, stopping it, then starting it will cause it to create a new propolis instance and that will go through reconciliation.