Pure primary-failover policy for active segments: when an active segment's primary (the head of its replica_set) is no longer alive, a live replica must take over so writes can continue.

plan/2 returns the :set_segment_replicas commands that promote a live replica to primary by moving it to the head of the segment's replica set. The dead broker stays in the set as a follower that simply will not ack (the quorum comes from the live replicas); once the segment seals, Malachi.Cluster.SelfHealing replaces it. No data moves: the live replicas already hold the segment.

Only active segments are considered: sealed segments are immutable, and their reads are restored by SelfHealing (whose placement already yields a live primary). The commands are applied through the control plane, where Malachi.Broker.apply_heal/2 also updates the active-segment cache so the next produce routes to the new primary.