# K1686–K1690 interruption during recovery

Local tests must classify each of the three metadata writes and the final
flush, interrupt a fresh replay again, then complete recovery from another
fresh object. Both persistence endpoints are exercised after each interruption:
all unflushed writes lost, or all completed writes retained. A final replay
must make no writes. Reusing a terminal recovery object must be rejected.

The real guest gate requires disposable qcow2 images and separate QEMU
processes. An initial producer is interrupted after
its commit flush; a fresh process is interrupted at each of the four replay
write/flush boundaries; another process recovers; a final process verifies
idempotency. Guest boundary gates must prevent execution from passing the
selected interruption point before the host stops its owned process.

Each RAM/boot profile uses one producer and four branches of interruption,
recovery and final verification: 13 processes, or 78 across six profiles.
Interrupted guests do not claim allocator rollback. Their owned QEMU processes
must terminate; completed recovery and verification guests must return their
frames. Metadata replay retains the bounded scope and opaque file-data digest
described in `TURKFS_RECOVERY_REPLAY_CONTRACT.md`.

Independent QEMU device traces, real DMA completions, whole-disk snapshots,
source/Image hashes, distinct boot and process identities and completed child
cleanup must bind the chain. Forged reuse of a prior process identity must
fail the evidence checker. An in-memory test alone cannot prove cache or
process replacement.

An emulator process interruption is not physical device power loss. Host page
cache may survive it. Arbitrary torn sectors, general filesystem mounts,
physical durability and product acceptance remain open.