1. Background Context
A fresh filesystem writer must continue a contiguous committed WAL without reusing an occupied unreconciled tail.
2. Observed
An empty predecessor advances the successor start from LSN 0 to LSN 1. Fresh takeover also succeeds with an uncommitted frame occupying LSN 0.
2b. Expected
Reuse an empty epoch's unused start only after clean-tail recovery; retain distinct linked writer identities. Refuse unreconciled tails before altering the epoch ledger.
2c. Reproduction
Docker regressions on main 2d79ecc: overlap/takeover test fails expected LSN 0 versus actual 1; unreconciled-tail takeover test fails expected refusal versus successful admission. Compilation and setup succeeded.
2d. Blast radius
Filesystem hosts restarted after an empty epoch or uncommitted write. Population and introduction date unmeasured. Committed predecessor positions must continue strictly after their final LSN.
2e. Hypothesis
Successor derivation increments even unused start positions and does not validate tail posture.
2f. Diagnosis
acquire_fresh_writer_epoch increments final_lsn.or_else(started_at_lsn) and admits before clean-tail validation. Shared request validation also rejects equality for empty predecessors.
3. Prerequisites
None; independently mergeable. Land after #772 in the agreed sequence.
4. Scope
In: empty-epoch continuity, clean-tail admission guard, overflow refusal, deterministic recovery regressions, WAL documentation.
Out: observation envelopes, retained strands, process-descriptor lease redesign (#718), new WAL format or durability promises.
5. Why now
Extract correctness prerequisites from #716/#727 before their feature scopes.
6. Risks
Takeover now refuses dirty tails until writable recovery reconciles them. No new power-loss guarantee.
7. Definition of Done
Both witnessed failures become green; full relevant WAL hardening suite passes in Docker; current-head reviews and required CI pass; main remains independently working.
8. Stakeholders
Echo filesystem WAL host operators and recovery consumers.
9. Related Issues
PRs #716, #727 and #772; #718 remains separate.
1. Background Context
A fresh filesystem writer must continue a contiguous committed WAL without reusing an occupied unreconciled tail.
2. Observed
An empty predecessor advances the successor start from LSN 0 to LSN 1. Fresh takeover also succeeds with an uncommitted frame occupying LSN 0.
2b. Expected
Reuse an empty epoch's unused start only after clean-tail recovery; retain distinct linked writer identities. Refuse unreconciled tails before altering the epoch ledger.
2c. Reproduction
Docker regressions on main 2d79ecc: overlap/takeover test fails expected LSN 0 versus actual 1; unreconciled-tail takeover test fails expected refusal versus successful admission. Compilation and setup succeeded.
2d. Blast radius
Filesystem hosts restarted after an empty epoch or uncommitted write. Population and introduction date unmeasured. Committed predecessor positions must continue strictly after their final LSN.
2e. Hypothesis
Successor derivation increments even unused start positions and does not validate tail posture.
2f. Diagnosis
acquire_fresh_writer_epochincrementsfinal_lsn.or_else(started_at_lsn)and admits before clean-tail validation. Shared request validation also rejects equality for empty predecessors.3. Prerequisites
None; independently mergeable. Land after #772 in the agreed sequence.
4. Scope
In: empty-epoch continuity, clean-tail admission guard, overflow refusal, deterministic recovery regressions, WAL documentation.
Out: observation envelopes, retained strands, process-descriptor lease redesign (#718), new WAL format or durability promises.
5. Why now
Extract correctness prerequisites from #716/#727 before their feature scopes.
6. Risks
Takeover now refuses dirty tails until writable recovery reconciles them. No new power-loss guarantee.
7. Definition of Done
Both witnessed failures become green; full relevant WAL hardening suite passes in Docker; current-head reviews and required CI pass; main remains independently working.
8. Stakeholders
Echo filesystem WAL host operators and recovery consumers.
9. Related Issues
PRs #716, #727 and #772; #718 remains separate.