membership: Always preserve logical clocks, even when rejoining

[ieQu1]

No description provided.

[Copilot]

Pull request overview

This PR aims to strengthen membership correctness by ensuring per-site logical clocks are preserved across cluster wipe/rejoin scenarios, and adjusts test/trace properties and comments to reflect and validate the intended behavior.

Changes:

• Prevent deletion of logical clocks during classy_membership:wipe/3 to preserve per-site command ordering across rejoin.
• Refactor the vote trace property to explicitly detect unmatched “established” events while tolerating unmatched “outcome received” effects (retries).
• Minor comment/documentation updates in membership and node handling code.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
src/classy_membership.erl	Stops deleting logical clocks on wipe; refactors persisted key/value record tags; adds explanatory invariants and notes.
src/classy_vote.erl	Updates trace property to validate participant outcome reception with explicit unmatched-cause detection.
src/classy_node.erl	Clarifies a note in the “kicked remotely” branch (comment-only change).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (5)

src/test/classy_test_fuzzer.erl:226

• Using a fixed timer:sleep(100) here makes the fuzzer timing-dependent and can add flakiness/slowdowns under load. Prefer waiting for a specific readiness signal (e.g., an emitted event that indicates the post-sync re-init completed) rather than an arbitrary sleep.

  %% TODO: currently sites can find out that they'd been kicked out
  %% remotely after the sync. This sleep accounts for such situations,
  %% letting sites re-init themselves before further commands are sent
  %% there.
  timer:sleep(100),

src/classy_vote.erl:503

• When Res is empty, this returns false without any assertion context, making failures harder to diagnose. Since the function already uses ?assertMatch/2, consider asserting the non-emptiness too and returning true on success.

  length(Res) > 0.

src/classy_membership.erl:783

• Minor grammar: "There's no workaround this either" reads incorrectly; it should be "There's no workaround for this either".

                %% the cluster. There's no workaround this either: one

src/classy_membership.erl:158

• The type name pk_last() no longer matches the record tag #kl{...}. To keep documentation/types understandable (and preserve any existing external type references), consider introducing a new type name matching kl and aliasing pk_last() to it.

-type pk_last() :: #kl{c :: classy:cluster_id(), l :: classy:site(), k :: key()}.

src/classy_membership.erl:165

• Similarly, pv_last() now describes #vl{...}. Consider introducing a matching type name and keeping pv_last() as an alias for clarity/backwards compatibility.

-type pv_last() :: #vl{op :: op(), toi :: clock()}.