Storage contract calibration

Each record occupies 8 + key length + value length bytes. Empty bytes is a put, None is a delete, and last complete record wins. A cut before a delete completes leaves the older put visible; a cut at its exact end makes the key absent. These results describe replayability, not client acknowledgment.

A complete checksum mismatch is rejected even at EOF. A missing checksum byte returns the preceding valid prefix and a tail. Invalid complete headers fail before accepting a body. A plausible corrupted length may resemble an incomplete append; the declared format does not detect all corruption. Appending without resolving the tail violates the continuation contract.

Full-history compaction can drop deleted keys only under the stated no-snapshot/no-excluded-history assumption. Newest-run-only compaction cannot use that rule when older values survive elsewhere. Removing empty values is a different error. State equality and byte idempotence are useful checks but do not certify historical visibility or crash-safe publication.

Passing evidence includes a stale-offset counterexample, rebuilt index and explicit publication stages. “Rename is atomic, therefore nothing can be lost” is insufficient without persistence assumptions. The supplied file reopen is ordinary serialization evidence only. A strong answer identifies what process-failure experiments cannot reveal about machine failure and separately measures bytes read, rewritten and simultaneously retained.

After 48 hours, change key lengths, the last operation and the compaction input set. A memorized sample or copied reference without independent explanation remains below level 2. Keep unresolved platform guarantees explicit rather than converting them into unsupported claims.