Isn't it bad design in the first place if you require "right order" of boot up? What if some, but not all, servers crash and reboot? How do you ensure the correct order in that case?
We’ve also noticed that, in practice, for many data-critical production systems, many of our customers prefer to manually control the boot process to confirm data integrity.
The scenario of partial crashes is interesting. I need to think about how to handle that a bit more. Thanks for the feedback!