anUnwrittenMediumReopensEmpty

The decode-of-absence half, which none of the four properties above can reach: reopening a medium nothing was ever written to must yield the same empty state newStorage promises, not a fabricated one.

Every property above writes a value first, so all of them are blind to an adapter whose decoder invents state from nothing — the SELECT … LIMIT 1 over an empty table that returns a default row, the JSON store whose missing document decodes to SnapshotMeta(0, 0), the key-value read that maps a missing key to 0. Each of those is the sentinel confusion leaderForTermBeforeAnySave_isNull and snapshotAtZeroBaseline_roundTrips guard on the write path, arriving through the one door only a restart opens. A node that starts believing it established a leader, or holds a snapshot at index 0 with an empty config, adopts the wrong membership baseline on its very first read.

Measured: green under every mutation that LOSES state — including the one that returns a fresh empty storage — and red under the one that FABRICATES it. That is the split it exists for, and it is worth stating both halves rather than only the flattering one. A reopen rigged to resurrect a cleared vote (storage.votedFor() ?: NodeId("node-a"), the shape of an adapter whose UPDATE … SET voted_for = NULL is written as an INSERT that omits the column) reds exactly one assertion here and one in termAndVoteSurviveAReopen, and nothing else in the suite. Every property above writes a value first, so none of them can be handed an empty medium to decode — this is the only place that door is opened.