---
id: "bug-1095"
status: "fixed"
status_updated: "2026-09-24"
status_note: ""
component: "lib"
severity: "unknown"
timestamp: "2026-06-24"
last_seen: "2026-09-19T09:00:00Z"
occurrences: 3
files: ["src/lib/raft/raft.c"]
tags: ["raft", "vote-reply", "idempotency", "election-safety", "split-brain", "conformance", "needs-library-fix", "bug-851-family", "dedup", "stale-buglog-entry"]
related: ["bug-1096", "bug-851"]
fix_commits: ["b5b7e01"]
legacy: true
gitea_issue: 29
gitea_synced_status: "fixed"
---

# bug-1095: Election Safety violation (two leaders at same term) surfaced by raft-sim-conformance step driver…

## Description
Election Safety violation (two leaders at same term) surfaced by raft-sim-conformance step driver (task 4.2): a duplicated VOTE_RSP grant double-counts a single peer's vote

## Environment
_Not recorded (migrated from buglog.json)._

## Reproduction
_Not recorded (migrated from buglog.json)._

## Root cause
raft_on_vote_reply tallies grants with a COUNTER (s->votes_granted++) and explicitly ignores from_idx ((void)from_idx;), so DuplicateMessage of one peer's grant counts that peer twice and a candidate reaches quorum with a single real vote. Diverges from raft.tla where votesGranted is a SET (idempotent). Proven: 3-node, single peer grant duplicated -> candidate becomes LEADER with votes_granted=2.

## Fix
FIXED (verified 2026-07-18 by validate-impl for raft-sim-conformance): src/lib/raft/raft.c raft_on_vote_reply now has a per-peer vote_replies[from_idx] idempotency guard (dedupes a DuplicateMessage grant) plus a term < s->term DropStaleResponse guard, landed together with bug-1096 in commit b5b7e01 (fix(raft): vote-reply per-peer dedup + stale-term drop). This buglog entry was stale (said NOT FIXED) even though the fix has been live since 2026-06-24 per tasks.md raft-sim-conformance Implementation Notes and bug-1096.fix; corrected here for consistency.

## Verification
_Not recorded (migrated from buglog.json)._

## References
- Related: bug-1096, bug-851
- Gitea: #29