Reads — ReadIndex and lease

1# NAIVE: leader serves reads from local state with no quorum check.
2def on_client_read(key) (leader):
3    return state_machine.get(key)
4 
5# BUG: a partitioned old leader still believes it leads.
6# Its election timeout hasn't fired yet, so it has no way to
7# know a new leader has already been elected and committed
8# a newer write. Stale read served. Linearizability broken.

1def on_client_read(key) (leader):
2    # precondition: leader must have committed an entry of its
3    # CURRENT term (the no-op-on-election). Otherwise commitIndex
4    # may be stale and ReadIndex would under-report.
5    if not has_committed_entry_in_current_term():
6        return defer  # buffered in pendingReadIndexMessages
7    read_index = commit_index           # 1. snapshot barrier
8    acks = { self }                     # 2. confirm leadership
9    for peer in cluster_minus_self:
10        send AppendEntries(heartbeat) -> peer
11    wait until |acks| >= majority
12    wait until last_applied >= read_index   # 3. apply barrier
13    return state_machine.get(key)           # 4. serve locally

1# Lease refresh: at every successful heartbeat-round ack.
2def on_heartbeat_round_acked() (leader):
3    lease_expires_at = monotonic_now()
4                       + election_timeout
5                       - clock_skew_bound
6 
7def on_client_read(key) (leader):
8    if monotonic_now() < lease_expires_at:
9        return state_machine.get(key)   # zero RPCs
10    else:
11        return read_index_serve(key)    # fall back
12 
13# ASSUMPTION: clock skew is bounded. A GC pause, fsync stall,
14# or VM steal can let one replica's monotonic clock outrun
15# another's — a new leader is elected BEFORE the old leader's
16# lease expires from its own perspective, and a stale read
17# sneaks through. CockroachDB ties leases to Raft leadership
18# specifically to bound this risk.