Methods and apparatus for obtaining consistency of redundant data after a failover event. In one aspect, a redundant data storage system has a first data storage facility that initially acts as a primary facility for storage requests and a second data storage facility that initially acts as a secondary facility for the storage requests. The second data storage facility is conditioned to assume the role of the primary facility in response to a failover event. The first data storage facility is conditioned to assume the role of the secondary facility, which includes sending a copy of data committed at the second data storage facility to the first data storage facility. The copy of data includes a version of data committed at the second storage facility.