# K1661–K1665 three-record journal wire format

The version 1 fixture is exactly 128 bytes: a 32-byte header followed by three
32-byte metadata records. Little-endian fields encode magic `TKJNL001`, version,
header and total length, nonzero transaction sequence, record count and flags.
IEEE CRC-32 covers the complete packet with the checksum field treated as zero.
Each record has a kind, 16-byte payload length, ordered index, target block and
16 payload bytes. Inode, bitmap and directory kinds must be unique, target blocks
must be distinct and within the declared capacity, and input must have exact size.

Tests use independently encoded Python struct/zlib fixtures. Malformed record
fixtures have valid recomputed checksums so structural guards are exercised.
Truncation, unsupported version, checksum corruption and stale sequence are
explicit errors. An omitted-checksum-guard mutant must fail the negative test.

The guest probe will decode a real read-only virtio fixture sector and inject
truncation, unsupported version and checksum corruption into those read bytes.
This validates a bounded decoder, not the live mount path, a transaction writer,
journal replay, durable ordering or power-loss recovery. Product release and
production-write acceptance remain open.