Pain point: When a node is isolated by a network partition, its election timer keeps firing and drives it to repeatedly increment currentTerm and start elections. Since it's isolated, every one of these elections is guaranteed to fail — but the term keeps climbing for as long as the partition lasts, often ending up far ahead of the rest of the cluster's actual progress. The moment the partition heals and the node reconnects, it shows up carrying this inflated term. Per the protocol's "step down on seeing a higher term" rule, this forces a perfectly healthy, actively-serving leader to abdicate, triggering an unnecessary re-election and a brief window of write unavailability — even though nothing was actually wrong with the leader. The isolated node itself usually can't win the resulting election anyway, since its log fell behind during the outage, so the entire disruption is pure loss for the cluster with no compensating benefit.
Proposed solution: Before actually incrementing currentTerm and starting a real election, first send a non-binding "trial" round that asks peers "would you vote for me if I started an election right now?" without advancing the sender's own term. A peer only answers "yes" if it genuinely believes the current leader is gone (e.g., it hasn't heard a valid heartbeat within its own election timeout). Only after receiving a majority of positive trial responses does the node actually increment its term and enter a real election; a majority of "no" responses means peers are hearing a healthy leader, so the node abandons the attempt and its term stays untouched. This keeps an isolated node's term pinned at its pre-partition value for the duration of the outage, so reconnecting after the partition heals no longer triggers the higher-term step-down rule against a healthy leader.
Pain point: When a node is isolated by a network partition, its election timer keeps firing and drives it to repeatedly increment
currentTermand start elections. Since it's isolated, every one of these elections is guaranteed to fail — but the term keeps climbing for as long as the partition lasts, often ending up far ahead of the rest of the cluster's actual progress. The moment the partition heals and the node reconnects, it shows up carrying this inflated term. Per the protocol's "step down on seeing a higher term" rule, this forces a perfectly healthy, actively-serving leader to abdicate, triggering an unnecessary re-election and a brief window of write unavailability — even though nothing was actually wrong with the leader. The isolated node itself usually can't win the resulting election anyway, since its log fell behind during the outage, so the entire disruption is pure loss for the cluster with no compensating benefit.Proposed solution: Before actually incrementing
currentTermand starting a real election, first send a non-binding "trial" round that asks peers "would you vote for me if I started an election right now?" without advancing the sender's own term. A peer only answers "yes" if it genuinely believes the current leader is gone (e.g., it hasn't heard a valid heartbeat within its own election timeout). Only after receiving a majority of positive trial responses does the node actually increment its term and enter a real election; a majority of "no" responses means peers are hearing a healthy leader, so the node abandons the attempt and its term stays untouched. This keeps an isolated node's term pinned at its pre-partition value for the duration of the outage, so reconnecting after the partition heals no longer triggers the higher-term step-down rule against a healthy leader.