termAndVoteSurviveAReopen

The §5.1/§5.2 pair, on the far side of a restart — the property RaftStorage exists for.

saveTermAndVotedFor_persistsBoth proves the two are visible together; it cannot prove either was written anywhere, because it reads them back off the object that took the write. A node that comes back having forgotten a vote it cast votes twice in one term, which is the §5.2 Election Safety violation the whole interface is arranged around. A node that comes back having forgotten only the term is worse still: it re-enters an election at a term it already resolved.

The second arm is the shape a durable adapter gets wrong in the other direction. A cleared vote must come back cleared, not resurrected from the row that preceded it — the UPDATE … SET voted_for = NULL an adapter writes as an INSERT that simply omits the column, or the key-value store whose remove is a no-op on a missing key. That costs liveness rather than safety (the node believes it already voted this term and refuses everyone), but it is indistinguishable from a wedge at the cluster level and unattributable without this.

The knob here is the term value, and a small literal would switch this property's sharpest detection off. A restart is the only path in this suite that crosses an encode/decode boundary, which is exactly where a term column too narrow to hold a Long bites — so the term is written at MAX_PLAUSIBLE - 1, the value snapshotMeta_roundTripsAtPlausibilityCeiling explains needs 60 mantissa bits and therefore survives neither a 32-bit column nor a Double. 7L would be round-tripped correctly by both.