See PHI2004.
A production instance had a second node enrolled in its cluster service, with the writable property on its bindings set to false. This did not appear to prevent it from receiving writes.
The service definition appears to have synchronized from admin correctly, which suggests this is a real issue in the clustering behavior.