hmmm, I think they might be using a quorum-based 3PC variant. Reading <https://github.blog/engineering/infrastructure/building-resi...> does make it seem like they only need a majority to commit instead of all nodes.

Ah, and then it looks like the losing nodes get marked unhealthy:

In essence, every write operation goes through a voting protocol, and any replicas on the losing side of the vote are marked as unhealthy—unavailable for reads or writes—until they can be repaired. Repairs are automatic and quick. Because a majority agreed either to accept or to roll back the update, there are still at least two replicas available to continue accepting both reads and writes while the unhealthy replica is repaired.

But not sure how unhealthy nodes are discovered. Maybe the coordinator marks them, and if the coordinator crashes it allows stale reads and detects invalid writes?