meta: an uninitialized membership is readable, not a storage error (scenario 10)

[allamiro]

Stacked on #251 (which is stacked on #250). Bases retarget automatically as each merges.

vtopctl meta status against a freshly started metadata node fails with:

when Write Logs: joint membership with 0 configs cannot be stored in MetaMembership

A storage write error, reported by a read, on the first command an operator runs. Bootstrap hits the same fault — the co-located scenario (#215) has been unable to init since it landed.

Zero configs is not corruption

It is exactly how openraft represents a node that has never been initialized. A fresh node's startup state carries Membership { configs: [], nodes: {} }:

membership_state: MembershipState { committed: EffectiveMembership {
  log_id: None, membership: Membership { configs: [], nodes: {} }, voter_ids: {} }, ... }

membership_to_meta rejected that, and the converter runs on the metrics and status paths as well as the log-append path — so every read of an uninitialized node became an error. It now maps zero configs to an empty MetaMembership, which describes the state truthfully.

Whether an empty membership may be persisted is a different question with a different answer, so it is now asked at the write boundary: entry_to_meta refuses a membership log entry with no voters. A committed entry naming no voters describes a cluster in which no quorum can ever form, and replaying it would strand the group. Openraft does not produce one — if that changes, this fails loudly rather than writing it.

The misleading label is part of the bug

sto_err_logs labelled every failure from this converter when Write Logs, including failures from paths that never write a log. That is why the symptom pointed at the storage layer, where nothing was wrong. Genuinely impossible config counts still error, now reported as a read fault.

A second defect the first one masked

init read the membership back from the metrics watch channel, which openraft publishes to asynchronously. A read taken the instant initialize returns can still observe the pre-init state, so a successful bootstrap could answer voters: [].

The race is wide open on a single-member group, which needs no peer round trip to initialize — which is why the co-located scenario, the only one that bootstraps one member, is the only one that hit it. init now waits (bounded, 2s) for a membership with voters, and on expiry returns what it last saw rather than inventing an error for an operation that already succeeded.

Verification

Scenario 10 passes. It now asserts on the reported voter rather than the exit code, which is what makes the second fix testable — an exit code alone passes on voters: []. Mutation-checked: reverting init to the immediate read fails the scenario.

Three unit tests cover the converter:

• an uninitialized membership reads as empty rather than erroring
• an empty membership is refused at the log write boundary
• an impossible config count is reported as a read fault, not a write

Why this was invisible

The live-chaos harness never runs in CI, so scenario 10 has been red on main since #237 without signal. Wiring it in is the next change; this PR and #251 are the two failures that had to be fixed before that suite could be enabled without turning main red.

---

Summary by cubic

Fixes false storage errors on fresh metadata nodes by treating zero-config memberships as readable and only rejecting them when writing to the log. Also makes init return the actual voter by waiting briefly for metrics, fixing scenario 10.

• Bug Fixes
  • Read path: membership_to_meta maps zero configs to an empty MetaMembership; impossible config counts are reported as READ faults.
  • Write path: entry_to_meta refuses to persist membership entries with no voters.
  • Admin init: waits up to 2s for a published membership with voters; on timeout, returns the last seen state.
  • Tests/scripts: scenario 10 now asserts the reported voter; unit tests added for uninitialized reads, write refusal, and READ labeling.

^{Written for commit f6ba1ba. Summary will update on new commits.}

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[cubic-dev-ai]

No issues found across 3 files

_{Re-trigger cubic}