fix(raftengine): PR783 r3 claude — reorder scanner guards to honor empty-range contract

Claude r3 on PR #783 flagged a contract violation in
HasEncryptionRelevantEntryInRange's guard ordering:

The EncryptionRelevantScanner interface (audit.go) requires the
empty-range case (startExclusive >= endInclusive) to return
(false, nil) UNCONDITIONALLY. The previous implementation
checked s.storage == nil FIRST, so a nil-storage scanner called
with an empty range would return the nil-storage error instead
of the contract-required (false, nil).

GuardSidecarBehindRaftLog in audit.go pre-filters the empty-gap
case (`if sidecarAppliedIdx >= engineAppliedIdx { return nil }`)
so this branch is unreachable in production today. But future
callers (6C-2d main.go phase, 6D capability fan-out) might
defensively call scan with a same-index range on a maybe-nil
engine. Pinning the order now avoids reintroducing the surprise
later.

Fix: reorder so empty-range short-circuits before nil-storage.
New TestEncryptionScanner_NilStorageEmptyRange pins the order
against regressions; the existing
TestEncryptionScanner_NilStorageError still passes because it
uses a non-empty range (0, 5), so the empty-range short-circuit
doesn't fire first.

## Verification

- go test -race -timeout=60s ./internal/raftengine/etcd/... — PASS
- golangci-lint run ./internal/raftengine/etcd/... — 0 issues

Author: bootjp

internal/raftengine/etcd/encryption_scanner.go

@@ -55,12 +55,22 @@ type encryptionScanner struct {
 // caller precomputes the non-empty-gap branch and only calls scan
 // when there's a range to inspect, but the defensive guard stays.
 func (s *encryptionScanner) HasEncryptionRelevantEntryInRange(startExclusive, endInclusive uint64) (bool, error) {
-	if s.storage == nil {
-		return false, errors.New("encryption scanner: storage is nil (engine not opened?)")
-	}
+	// The EncryptionRelevantScanner contract (audit.go) requires
+	// the empty-range case to return (false, nil) UNCONDITIONALLY
+	// — including on nil-storage receivers. Reorder the guards so
+	// an empty range short-circuits before any state-dependent
+	// failure path. GuardSidecarBehindRaftLog pre-filters the
+	// empty-gap case in production, so this is contract conformance
+	// rather than a reachable bug; pinning the order keeps any
+	// future caller (6C-2d, capability fan-out) from triggering
+	// the surprising "empty range on nil scanner returns error"
+	// path.
 	if startExclusive >= endInclusive {
 		return false, nil
 	}
+	if s.storage == nil {
+		return false, errors.New("encryption scanner: storage is nil (engine not opened?)")
+	}
 	// MemoryStorage.Entries(lo, hi, ...) returns indices [lo, hi).
 	// We want (startExclusive, endInclusive] = [startExclusive+1,
 	// endInclusive+1). Guard against uint64 wraparound at

internal/raftengine/etcd/encryption_scanner_test.go

@@ -238,12 +238,32 @@ func TestEncryptionScanner_CompactedRange(t *testing.T) {
 // TestEncryptionScanner_NilStorageError verifies the defensive
 // nil-storage check. A zero-value encryptionScanner (or one
 // constructed before the engine is opened) must fail closed
-// rather than nil-deref.
+// rather than nil-deref. The range is non-empty so the
+// empty-range short-circuit doesn't fire first.
 func TestEncryptionScanner_NilStorageError(t *testing.T) {
 	var s encryptionScanner
 	_, err := s.HasEncryptionRelevantEntryInRange(0, 5)
 	if err == nil {
-		t.Fatal("nil-storage scanner must return an error")
+		t.Fatal("nil-storage scanner must return an error on a non-empty range")
+	}
+}
+
+// TestEncryptionScanner_NilStorageEmptyRange pins the
+// EncryptionRelevantScanner contract: empty range MUST return
+// (false, nil) UNCONDITIONALLY — including on a nil-storage
+// scanner. The guard order in HasEncryptionRelevantEntryInRange
+// is empty-range-first, then nil-storage, so this test pins the
+// ordering against future regressions where someone reorders the
+// guards and reintroduces the contract violation claude flagged
+// on PR #783 r3.
+func TestEncryptionScanner_NilStorageEmptyRange(t *testing.T) {
+	var s encryptionScanner
+	hit, err := s.HasEncryptionRelevantEntryInRange(5, 5)
+	if err != nil {
+		t.Fatalf("nil-storage scanner with empty range MUST return (false, nil) per contract; got err=%v", err)
+	}
+	if hit {
+		t.Fatalf("empty range must report no hit; got hit=%v", hit)
 	}
 }