Durable watermarks and crash recovery

Durable watermarks and crash recovery A lifecycle diagram generated by Archify. 01 / Forward durability 02 / Completion and recovery 03 / Recovery outcomes Executed · Finalized block applied · Forward durability Executed Finalized block applied WAL synced · Append + sync · Forward durability WAL synced Append + sync Durable height · Publish height fence · Forward durability Durable height Publish height fence QMDB flushed · State persistence · Forward durability QMDB flushed State persistence Marker durable · Known keys + applied · Forward durability Marker durable Known keys + applied WAL rotated · After applied marker · Completion and recovery WAL rotated After applied marker Root ACK · Writer completion · Completion and recovery Root ACK Writer completion Validate restart · Before any mutation · Completion and recovery Validate restart Before any mutation Replay suffix · Strict local sequence · Recovery outcomes Replay suffix Strict local sequence Peer sync · Missing finalized suffix · Recovery outcomes Peer sync Missing finalized suffix Shared halt · No root ACK · Recovery outcomes Shared halt No root ACK then writer failure valid missing locally invalid Legend start active state decision terminal success failure / exit external

Ordered durability

  • • Sync WAL before publishing the durable height.
  • • Flush QMDB and persist known keys / applied marker before WAL rotation.
  • • Writer or post-commit failure sets the shared halt and withholds the root ACK.

Validate before mutation

  • • Check strict height, active/old WAL, applied marker and snapshot.
  • • Reject WAL gaps and records above the durable height.
  • • Recovery must establish a consistent replay boundary first.

Recover authenticated history

  • • Peers can supply the finalized suffix missing locally.
  • • A snapshot checksum detects corruption; it does not authenticate consensus.
  • • Finalization, execution and durable acknowledgement are separate milestones.