> What do you do when one CPU says there was a bit flip and the other one doesn't?

Reset and erase processor internal state that was corrupted. Startup times are typically one of the metrics controlled for in these systems.

Dual-redundant gets you error detection without correction whereas triple-redundant with majority voting can get you error detection with correction in the case that one fails. The error detection with dual-redundancy only works if one fails. If both fail and both fail in the same way you won't be able to detect it, but you basically accept the risk that it's an improbable event. The "correction" in the dual-redundant case is typically reset into some known state rather than trying to correct and continue operation.