A fault model is not a flag

The issue described in the source is that a consensus tool has a fault model that is not a flag. The tool supports two algorithms: Byzantine-fault-tolerant (BFT) with a 2/3 weighted quorum, and Multi-Paxos with a crash-fault simple majority over an acceptor set. The problem arose when a fault introduced a missing flag, causing the per-invocation flag to be treated independently from the per-topic durable state.

This led to situations where a minority of nodes could announce consensus at 100% confidence, and a new node could choose itself as leader in a cluster with five known members. The contradiction between the BFT and Multi-Paxos results was not caught by the tool's error handling, as each algorithm read its own keys and wrote its own keys back without detecting the inconsistency.

The issue was that both algorithms were operating on the same durable state without proper coordination, leading to a split-brain scenario where both algorithms held the same state but with different values. The fix involved recording the algorithm that wrote the state, and refusing to run when there was a mismatch. This ensured that the tool would refuse to run when a topic was alternately run under incompatible fault models, preventing the observed failures.