# K1681–K1685 idempotent three-record replay

The fixed fixture has three old home sectors and three expected new images
derived from a validated 128-byte journal. A complete matching commit permits
replay. Every home must match either its complete old image or its complete new
image before any write is issued. Replay writes only old homes, then flushes.
A second mount of the resulting disk issues no writes or flushes.

An absent final commit keeps the old homes unchanged. New homes without a
commit, a malformed nonempty commit, or an unknown home image cause refusal
before I/O. An I/O failure makes that recovery object terminal. Retrying needs
a fresh recovery object and fresh disk observations.

Commit validation covers the marker, sequence and journal CRC. The inherited
data-digest field is opaque to this metadata replay experiment; no file-data
integrity or complete data/metadata allocation layout is established here.

The host test covers all eight old/new home combinations, absence of a commit,
corrupt home and commit bytes, four I/O failure boundaries and both persistence
endpoints. The guest gate must independently observe writes and flushes, bind
whole-disk before/after bytes, and use a separate QEMU process for the second
replay. Missing-commit refusal also needs real guest evidence.

This is a fixed development fixture with known old images. General mount,
arbitrary torn-sector repair, concurrent replay, physical power loss and product
acceptance remain open.