mint failure isolation is a smart call. degraded mode with auto-recovery is the kind of hardening that makes cashu actually deployable in the field. how are you handling mint selection when the primary is down?