The domain of the Great Yan Empire was guarded by five mighty mountain fortresses. In addition to the imperial citadel stationed in the central Guanzhong plains, four regional bastion cities stood sentinel to the east, south, west, and north, collectively known as the “Five Anchors of Granite.”

For more than a century since the dynasty’s founding, imperial decrees flowed without obstruction, and the realm flourished in disciplined tranquility, all owing to an ancestral statute instituted by the First Emperor: the “Law of the Golden Dawn Bell.”

At daybreak each morning, the Bell and Drum Pavilion at the imperial center struck the ten-thousand-pound Coiled Dragon Bell. Three resonant, earth-shaking chimes echoed across the clouds, and the Ministry of Timetables immediately dispatched four contingents of courier riders, carrying cinnabar-lacquered brass tubes, speeding toward the four regional bastions. Within each brass tube lay a red-clay-sealed pine tally stamped with the Prime Minister’s personal seal, inscribed with the current imperial reign era and the day’s heavenly stems and earthly branches.

According to the First Emperor’s charter, affairs of state did not require the unanimous assent of all five bastions. So long as any three garrisons received the sealed tallies on schedule each day, the central decree commanded sovereign legitimacy. Merchants passed through frontier gates, paying duties upon verified seals; granaries unlocked their reserves for relief; and merchant guilds redeemed bills of exchange. Over a hundred winters, even if a torrential downpour claimed the mounts of one courier route in the mire, the remaining three bastions and the capital remained in mutual chime, and the foundations of the realm stayed as unyielding as iron.

Only the solitary outpost perched upon the northern rim—the “Summit of Black Glaciers”—hung isolated upon a sheer cliff of ten thousand fathoms.

There, freezing gales howled year-round, and heavy frost clouds hung low. General Murong, who commanded the garrison, led only a few hundred hardened veterans. Whenever winter descended, the wooden plank roads pinned to the vertical cliffs froze under three feet of solid glaze; courier riders often braved days of lethal peril merely to ascend the peak. Yet no matter how savage the tempest, Murong climbed the beacon ramparts each dawn, craning his neck toward the southern sea of clouds, waiting for the rider from the capital.

That year, just after the frost fell, an unprecedented century-blizzard engulfed the northern wastes.

Winds whipped up snowdrifts the size of millstones, snapping the cliffside plank bridges in twain overnight. For three months the gale raged without respite; snow accumulated fathoms deep, wild fowl vanished from the skies, and carrier falcons plummeted with frozen wings into the abyss. The narrow gullet leading up to the Summit of Black Glaciers was completely transformed into a blinding, frozen desert.

Atop the isolated pinnacle, General Murong and his men sank into tomb-like silence.

Ten days passed; no courier arrived from the south. Thirty days passed; across the mist-shrouded horizon, not a single rider galloped through the snow.

By the winter solstice, Murong sat alone within his frozen stone quarters, his face grim as tempered iron. According to the ancient ancestral codex, the Canon of Celestial Tallies: “Should thirty sunrises elapse without hearing the golden bell of the capital or receiving the imperial tally, it must be presumed that catastrophe has befallen the throne and the realm hangs in mortal peril. The commanding general of the frontier shall not wait idly as heaven falls into chaos; he shall forthwith initiate the ‘Restoration of the Epoch,’ advancing the local calendar by one cycle, carving his own reign title to govern in proxy.”

Murong took a long, resolute breath. Drawing a red-hot iron chisel from the brazier, he carved forcefully upon a polished slab of jujube wood: “By Mandate of Heaven, First Year of the Great Frost.”

He affixed the wooden tablet to the fortress gate. Yet beneath the precipice, only the furious gales howled; none responded.

Another three months went by. Spring thaw failed to arrive, and ice remained locked across a thousand ravines. Murong drew his chisel once more, planed the tablet clean, and etched with gritted teeth: “Second Year of the Great Frost.”

One year, two years, three years…

Through the protracted polar night and biting frost of the solitary peak, the old general’s discipline crystallized into an unshakeable obsession. He became thoroughly convinced that the four southern fortresses had been reduced to ashes in a great civil war, and that within the four seas, only his icy summit retained loyal soldiers of the empire. With every emptying of the hourglass, with every turn of the biting winter, he stubbornly wielded his iron chisel, bumping the reign title ever higher:

“Third Year of the Great Frost,” “Fourth Year of the Great Frost”… all the way to the “Tenth Year of the Great Frost!”

Yet south of the mountains, beneath the blanket of clouds, what was the true state of the realm?

There had been no warfare, nor had the dynasty fallen. That historic blizzard had merely severed the extreme, localized high-altitude pass of the northern peak; across the central plains and the eastern, southern, and western garrisons, the seasons progressed in peaceful succession, and harvests were bountiful. The Golden Dawn Bell of the imperial citadel chimed faithfully every morning. The Prime Minister and the civil and military ministers sat within the Hall of Imperial Governance, reviewing the thousands of memorials submitted by the three active bastions. The Prime Minister’s tallies arrived on time each day; merchants thronged the high roads, and commoners lived in peace. In the eyes of all, the empire was operating smoothly in the heart of a golden age.

Until the late spring of the fourth year, when a blazing sun finally dissolved the mountain glaciers.

The ancient northern trail broke free from the ice. Clad in heavy iron armor, General Murong led his remaining hundred frostbitten warriors galloping down the thawing mountain pass. From the old general’s waist hung a heavy iron seal, and tall white banners fluttered beside their steeds, bearing four jagged characters written in thick black ink: “Tenth Year of the Great Frost!”

The battered cavalry galloped through the capital gates, riding straight up to the marble balustrades of the imperial audience hall.

The old warrior dismounted, held aloft the wooden tablet inscribed with “Tenth Year of the Great Frost,” and bellowed into the hall: “The frontier outpost has bled and stood sentinel for ten harsh years without word from the capital! Now, obeying the First Emperor’s sacred statute, we inaugurate a new era under the Tenth Year of the Great Frost. We bid the court to submit to the mandate of heaven!”

At these words, absolute silence fell upon the imperial court. The gathered ministers looked at one another in sheer bewilderment, while the Prime Minister’s face drained of all color.

Why? Because upon the first scroll of the Canon of Celestial Tallies, the First Emperor had set down an inviolable supreme statute in indelible ink:

“Throughout all bastions of the realm, whenever an envoy arrives bearing a ‘higher reign year,’ regardless of circumstance or origin, the sitting ruler and Prime Minister must immediately surrender the seal of office, step down from the dais, and suspend all state governance to await a general election of the throne. Whosoever disobeys shall be deemed an usurper against heaven, and all under the sky shall unite to strike them down.”

The original wisdom behind this statute had been noble: to prevent corrupt usurpers from clinging to the central throne, the moment any corner of the empire produced a newly verified sovereign era, the old regime was mandated to step down without resistance.

Yet at this moment, catastrophe struck.

The “Tenth Year of the Great Frost” arbitrarily towered over all active records of the reigning government. In accordance with ancestral law, the Prime Minister sighed deeply, tremblingly unfastened the golden seal from his waist, placed it upon the imperial desk, and bowed low as he stepped into the side corridor.

The administrative machinery of the empire ground to an instant halt.

The six ministries locked their official seals; merchant banks shuttered their teller windows; tens of thousands of trade caravans queuing outside the gates were stranded at the moat, their transit permits voided on the spot. All commerce and tax collection across the Great Yan Empire ceased dead in its tracks at high noon.

With the government paralyzed, a general election was convened on the spot to choose the new leader of the realm.

The council of ministers brought forth the iron chests carried by General Murong, prying open the seals in public to inspect the archives, ledgers, and deeds he had accumulated over the past ten years of frontier rule.

Yet when the lids were thrown open, the entire hall gasped in disbelief.

Inside the iron chests lay nothing but dried mountain straw and stacks of completely blank white vellum scrolls! Across those three secluded years, General Murong had collected not a single copper in revenue, sheltered not a single refugee, and remained utterly ignorant of troop movements beyond the wall. His administrative ledgers remained frozen on the very day the mountain pass had been snowed in four years prior!

The court erupted in fury. By the rules of imperial election, any general whose archives were obsolete could never obtain the confirmatory votes of the other regional commanders. Murong could not ascend the throne; he was scarcely even qualified to stand as a candidate.

Yet the Prime Minister had already abdicated, and the imperial seal was locked away. To resolve the vacuum, the four regional garrisons were forced to convene emergency conclaves to elect a new administration, wasting days in frantic message relays while merchant losses mounted into mountains of silver.

The scholars and generals of the court beat their breasts in lament: a hermit isolated upon a frozen rock, who had merely advanced his own abacus inside an ice cave, had paralyzed the entire prosperous empire through a single sheet of empty paper!

This unprovoked disaster came to be recorded in history as the “Turmoil of the Frost Ridge.”

In the aftermath, the imperial court reformed the laws, convening master scholars and grand astronomers to officially institute a lifesaving amendment into the Canon of Celestial Tallies—the “Policy of Pre-Inquiry.”

The new decree was proclaimed across the five fortresses:

Henceforth, should any isolated garrison commander find communication severed and wish to inaugurate a new reign era, he is strictly forbidden from carving higher year-tablets in isolation!

The commander must first dispatch a lone light scout bearing a white feather to conduct a “preliminary inquiry” among neighboring garrisons:

Upon arriving outside a neighboring fortress, the scout must inquire into two matters: First, “Within the past thirty sunrises, has your post heard the daily dawn bell from the imperial capital?” Second, “How do our frontier ledgers compare against the records upon your desks?”

If the garrison commander across the moat replies: “The dawn bell of the capital tolls without fail, the cinnabar seals upon our desks are fresh, and the mandate of heaven remains unbroken. How dare you stir up sedition?”—the scout must immediately withdraw his white feather, return to the peak, and keep the garrison calm, forbidden from advancing the calendar by even a single stroke!

Only when a true majority among the regional bastions responds that “the capital bell has indeed fallen silent and the center has fallen,” and only when the scout’s archives are proven to be as complete and up-to-date as their own, is the frontier commander permitted to officially carve a new reign tablet, march to the capital, and trigger an election.

From that day forth, even if the icy pinnacle were locked away by blizzards for ten years or a century, no isolated hermit playing with empty reign titles could ever again disrupt the peace of the realm beneath the clouds.

—By now you have probably recognized it: this is the essential safety extension in the Raft consensus protocol—the Pre-Vote Protocol and the defense against Disruptive Servers.

What it is

In the standard Raft consensus protocol (Diego Ongaro & John Ousterhout, 2014), Terms act as logical clocks used to detect and discard stale information.

Standard Raft enforces a foundational invariant hardcoded into every node’s event loop:

“If an RPC request or response contains term $T > currentTerm$: set $currentTerm = T$, and convert to follower.”

This rule was originally designed to ensure that whenever a new Leader is elected, any lingering zombie leader from an older term steps down immediately upon hearing from the new regime, preventing split-brain scenarios.

However, in real-world asynchronous cloud networks, this elegant mathematical rule introduces a fatal vulnerability known as the Disruptive Server Problem:

1. Transient Partition and Term Inflation: Consider a 5-node Raft cluster ${N_1, N_2, N_3, N_4, N_5}$, where $N_1$ is the healthy Leader at term 1. Node $N_5$ becomes temporarily partitioned from the other 4 nodes due to a top-of-rack switch reboot, asymmetric packet loss, or a prolonged GC pause. $N_5$ stops receiving periodic heartbeats (AppendEntries) from $N_1$. Its local electionTimeout expires. $N_5$ increments its term from 1 to 2, transitions to Candidate, and broadcasts RequestVote. Because it is isolated, $N_5$ receives no replies. The timeout fires again, and $N_5$ increments its term to 3, 4, 5… eventually inflating to term 100 while completely cut off.
2. The Disruptive Rejoin: When the network heals and $N_5$ reconnects, disaster strikes. $N_5$ broadcasts RequestVote carrying its inflated term of 100. When Leader $N_1$ (still operating peacefully at term 1) receives this message, because $100 > 1$, $N_1$ must immediately step down and revert to Follower status! The cluster loses its active Leader. All ongoing client write operations stall and time out, inducing severe latency spikes and service unavailability.
3. The Absurd Outcome: Once $N_1$ steps down, the cluster begins a new election. Can $N_5$ become the new Leader? Absolutely not! In Raft, the Leader Completeness invariant dictates that voters only grant votes if the candidate’s log is at least as up-to-date as their own (lastLogTerm and lastLogIndex). Having been partitioned, $N_5$’s log is hopelessly stale. It cannot gather a majority quorum of votes. The outcome is profoundly disruptive: an obsolete node with zero chance of winning has needlessly unseated a perfectly healthy leader, forcing the cluster into an unnecessary election cycle simply because its term counter kept ticking in isolation!

To cure this vulnerability, Diego Ongaro introduced the Pre-Vote extension in Chapter 9.6 of his Stanford doctoral dissertation, Consensus: Bridging Theory and Practice:

Before entering a real election, a node enters an exploratory PreCandidate state:

• Step 1: The Pre-Vote Exploration When a node’s electionTimeout fires, it does not increment its currentTerm. Instead, it transitions to PreCandidate and sends speculative PreVote RPCs carrying an anticipated term of $currentTerm + 1$.
• Step 2: Dual-Gate Voter Verification A recipient node grants a PreVote only if two conditions are met simultaneously:
  1. Log Up-To-Date Criterion: The candidate’s log is at least as up-to-date as the voter’s own log;
  2. Active Leader Lease / Heartbeat Criterion: The voter has not received a heartbeat from a valid Leader within its minimum election timeout (minElectionTimeout).
• Step 3: Promotion on Demand If a healthy Leader is still sending regular heartbeats, majority followers will reject the PreVote. $N_5$ fails to collect a majority of Pre-Votes, and its currentTerm never increments! It remains harmless until normal heartbeats from the Leader bring it back in sync. Only if a majority of nodes agree that the Leader has truly vanished and the candidate’s log is sufficiently fresh does the node actually increment its currentTerm, transition to Candidate, and initiate a genuine RequestVote election.

Why it matters

In modern cloud environments, networks are fraught with transient anomalies, noisy neighbors, and garbage collection hiccups:

• Preventing Single-Node Glitches from Triggering Cluster Outages: In Kubernetes, etcd, and distributed databases, container restarts, VM live migrations, or brief packet loss are routine occurrences. Without Pre-Vote, any transient hiccup on a single node causes that node to re-enter the cluster with an inflated term, immediately deposing the active Leader and triggering cascading write failures across all connected applications.
• The Standard Baseline in Production Systems:
  • etcd and Kubernetes: etcd introduced Pre-Vote as an experimental flag and made it the default in version 3.4 (--experimental-enable-prevote=true). This dramatically stabilized large-scale Kubernetes control planes by immunizing them against flaky worker or master nodes.
  • Distributed NewSQL (TiKV and CockroachDB): In Multi-Raft architectures managing hundreds of thousands of Raft ranges across physical machines, a single flapped network interface without Pre-Vote would trigger rolling elections across thousands of regions simultaneously, sparking a cluster-wide death spiral.
  • HashiCorp Consul, Apache Ratis, and SOFAJRaft: All implement Pre-Vote as a fundamental stability prerequisite.
• Synergy with CheckQuorum: Pre-Vote solves the problem of “outlying partitioned nodes disrupting a healthy center”; Raft’s complementary CheckQuorum mechanism solves the inverse problem—“a partitioned leader unaware it has lost its majority” (forcing an isolated leader to step down if it cannot reach a majority within an election timeout). Together, they fortify Raft into a production-grade consensus engine resilient against asynchronous network chaos.

Metaphor mapping

• The Summit of Black Glaciers and General Murong’s isolated veterans → A partitioned, lagging, or GC-stalled node (Partitioned / Flapping Node)
• The prosperous trade across the capital and remaining regional fortresses → A healthy majority quorum maintaining consensus (Healthy Majority Quorum)
• The morning chime of the Coiled Dragon Bell and daily sealed tallies → Periodic heartbeats sent by the active Leader (Heartbeats / AppendEntries RPC)
• The thirty-day hourglass rule upon the snowy peak → The local election timeout timer (Election Timeout)
• Murong carving higher reign titles onto jujube wood (Year 1 through 10) → Monotonically incrementing the term counter in isolation (Incrementing Term)
• Galloping into the capital under the banner of “Tenth Year of the Great Frost” → Rejoining the cluster with an inflated term (Disruptive Server with High Term)
• The ancestral statute forcing the Prime Minister to surrender the seal upon seeing a higher reign year → Raft’s core invariant: step down to Follower whenever $T > currentTerm$ (Step down on Term > currentTerm)
• The paralysis of commerce and state affairs upon the Prime Minister’s abdication → Service write outage caused by premature leader deposition (Leader Deposition & Write Outage)
• The discovery that Murong’s chests contained blank ledgers, disqualifying him from ruling → An isolated node failing the Leader Completeness log check (Cannot win election due to Stale Log)
• The Policy of Pre-Inquiry (sending a scout with a white feather to check the capital’s status) → The Pre-Vote exploratory phase (Pre-Vote Phase / PreCandidate State)
• The regional commander rejecting the scout because the capital bell chimes faithfully → Followers rejecting Pre-Vote due to active Leader lease (Reject PreVote under Active Leader Lease)
• The scout returning empty-handed, forbidding any change to the reign calendar → Suppressing term inflation and safeguarding cluster stability (Suppress Term Bump & Preserve Stability)