Currently, any cluster operation which sets read-only=1, will disable read-only if a later stage fails. It seems the errors from Connector/C are not exactly correct, as the server may perform the operation anyways. In this case, monitor thinks that the operation failed and sets read-only=0, leading to a slave without read-only. This can be confusing for users. It seems MariaDB Backup has something to do with this as it also messes with the SQL-threads. Will need further investigation, but making the rejoin etc code smarter is probably a good step. Maybe, when getting an error the code should wait a second, reconnect, check status and try again.