What is the meaning of the ViewChangeProof event?

I’m troubleshooting failures arising from long-lived network partitions, and occasionally see ViewChangeProof mesages in the log.

My first pass through the ElectionsService source code hasn’t helped me understand. I simply don’t know enough about the detailed workings of the election protocol.

Can someone explain what the ViewChangeProof messages mean? Failing that, is there a whitepaper or academic reference that describes the election algorithm?

Thanks,

Sam