The switcher script is run on an independent server. Been thinking of ways to add even more redundancy by protecting that as well. A second failover monitor. Haven't seen much need for that level of redundancy tho. Gotta be a point of diminishing returns.