Ballot tabulation mirrors across election sites must never display conflicting totals to the public. Under a network partition, which consistency stance is most appropriate?

Election ballot tabulation mirrors must not show conflicting public totals across sites, so under a network partition the correct stance is to prefer consistency: withhold or block divergent answers rather than publish disagreeing counts. Civic trust in election reporting depends on one coherent total, not on whichever replica answered first. Serving whatever local replica is reachable even when sites disagree maximizes availability at the expense of contradictory public numbers—an unacceptable outcome for tabulation displays. Randomly picking a site total to avoid waiting injects nondeterminism into a process that must be auditable and identical. Disabling integrity checks to publish the fastest partial count accelerates the wrong metric and can broadcast incomplete tallies as if final. Exam caveat: the same city may choose availability for 311 status and consistency for ballots; CAP answers are workload-specific, not one global municipal switch. Operational check: partition two election mirrors in a dry-run environment and verify public endpoints either agree or refuse to display conflicting totals until reconciliation completes. In production terms for consistency-first election tabulation mirrors, assign an owning team, wire a dashboard that shows the pattern is healthy under peak civic load, and require a staging drill that rehearses failure and recovery before resident impact. Revisit the choice when traffic shape, retention, or integrity needs change, and keep a named rollback owner on the change record. Re-test both the happy path and the failure path for consistency-first election tabulation mirrors after material dependency upgrades so regressions are caught before the next public release.