fix: remove side effects from pre-vote processing

src/ra_server.erl

@@ -1108,7 +1108,7 @@ handle_candidate(#request_vote_rpc{}, State = #{current_term := Term}) ->
     Reply = #request_vote_result{term = Term, vote_granted = false},
     {candidate, State, [{reply, Reply}]};
 handle_candidate(#pre_vote_rpc{} = PreVote, State) ->
-    %% unlike request_vote_rpc, a candidate cannot simply reject 
+    %% unlike request_vote_rpc, a candidate cannot simply reject
     %% a pre_vote_rpc that does not have a higher term
     %% (see https://github.com/rabbitmq/ra/issues/439 for the detail)
     process_pre_vote(candidate, PreVote, State);
@@ -2889,6 +2889,8 @@ process_pre_vote(FsmState, #pre_vote_rpc{term = Term, candidate_id = Cand,
                                effective_machine_version = EffMacVer},
                    current_term := CurTerm} = State0)
   when Term >= CurTerm  ->
+    %% Pre-vote must not set voted_for (per Raft thesis Section 9.6),
+    %% but should still update current_term to retain the highest known term.
     State = update_term(Term, State0),
     LastIdxTerm = last_idx_term(State),
     case is_candidate_log_up_to_date(LLIdx, LLTerm, LastIdxTerm) of
@@ -2905,7 +2907,7 @@ process_pre_vote(FsmState, #pre_vote_rpc{term = Term, candidate_id = Cand,
                    " for term ~b previous term ~b",
                    [log_id(State0), Cand, TheirMacVer, OurMacVer, EffMacVer,
                     {LLIdx, LLTerm}, Term, CurTerm]),
-            {FsmState, State#{voted_for => Cand},
+            {FsmState, State,
              [{reply, pre_vote_result(Term, Token, true)}]};
         true ->
             ?DEBUG("~ts: declining pre-vote for ~tw their machine version ~b"

test/ra_server_SUITE.erl

@@ -38,6 +38,7 @@ all() ->
      append_entries_reply_no_success_from_unknown_peer,
      follower_request_vote,
      follower_pre_vote,
+     pre_vote_does_not_set_voted_for,
      pre_vote_receives_pre_vote,
      await_condition_receives_pre_vote,
      request_vote_rpc_with_lower_term,
@@ -1564,6 +1565,7 @@ follower_pre_vote(_Config) ->
     % when candidate last log entry has a lower term
     % the current server is a better candidate and thus
     % requests that an election timeout is started
+    % pre-vote should update the receiver's term to the highest known
     {follower, #{current_term := 6},
      [start_election_timeout]} =
     ra_server:handle_follower(Msg#pre_vote_rpc{last_log_term = 4,
@@ -1583,6 +1585,38 @@ follower_pre_vote(_Config) ->
 
     ok.
 
+pre_vote_does_not_set_voted_for(_Config) ->
+    %% Per Raft thesis Section 9.6, a pre-vote grant must not set
+    %% voted_for. Setting voted_for would block a subsequent real vote
+    %% from a different candidate at the same term.
+    N3 = ?N3,
+    State0 = base_state(3, ?FUNCTION_NAME),
+    Token = make_ref(),
+    Term = 5,
+    Msg = #pre_vote_rpc{candidate_id = ?N2, term = Term,
+                        last_log_index = 3, last_log_term = 5,
+                        machine_version = 0, token = Token},
+
+    %% grant pre-vote to N2
+    {follower, State1,
+     [{reply, #pre_vote_result{term = Term, token = Token,
+                               vote_granted = true}}]} =
+        ra_server:handle_follower(Msg, State0),
+
+    %% voted_for must not be set after pre-vote grant
+    ?assertNot(maps:is_key(voted_for, State1)),
+
+    %% a subsequent real vote from N3 must still succeed —
+    %% the pre-vote grant to N2 must not block it
+    RealVote = #request_vote_rpc{candidate_id = ?N3, term = Term,
+                                 last_log_index = 3, last_log_term = 5},
+    {follower, #{voted_for := N3},
+     [{reply, #request_vote_result{term = Term,
+                                   vote_granted = true}}]} =
+        ra_server:handle_follower(RealVote, State1),
+
+    ok.
+
 pre_vote_receives_pre_vote(_Config) ->
     State = base_state(3, ?FUNCTION_NAME),
     Term = 5,