fix: make journal stream initialization fail closed

[feichai0017]

What changed

Holt 0.9.0 could persist the first journal anchor slot, fail while writing the second slot, and then accept ordinary writes. A later reopen treated the stream as initialized even though those mutations had no recovery envelope.

This change fences ordinary writes before the first anchor slot can become durable. An interrupted initialization remains incomplete and accepts only an exact retry with the same genesis anchor. State reads, scans, and attached writes fail until the retry repairs both slots. Open, replay, and recovery scans reject an ordinary logical record after an initialized attached-stream anchor.

Attached submission now carries encoder-sealed bytes and its owned envelope into group commit. The commit path no longer decodes and copies the record before queueing it. Replay and recovery scans still decode records and verify CRCs. The branch also adds a permanent journal-path benchmark and prepares version 0.9.1.

Test plan

• cargo fmt --all -- --check
• cargo build --workspace --all-targets --all-features --locked
• cargo test --workspace --all-features --lib --tests --examples --locked
• cargo test --workspace --all-features --doc --locked
• workspace, benchmark, and soak-tool clippy checks with warnings denied
• rustdoc with warnings denied
• 512-case codec and workspace property tests
• four public examples and short normal / db-normal soak runs
• cargo publish --dry-run --locked

Regression tests cover failures before zero or one durable anchor slots, same-genesis repair, different-genesis rejection, and a checkpoint during incomplete initialization. They also cover mixed Insert and Batch records across open, replay, streaming validation, and recovery scans. Codec tests compare sealed records with the generic encoder and exercise varied payloads and operations.

The local host lacks rustup/nightly, cargo-deny, cargo-llvm-cov, and the Linux io_uring environment. GitHub Actions remains responsible for those platform, fuzz, coverage, and dependency-policy gates.

Compatibility and recovery boundary

Holt 0.9.1 keeps the format-4 WAL, public journal API, record bytes, CRC replay checks, and checkpoint protocol. Existing 0.9.0 stores need no format migration.

If Holt 0.9.0 returned an initialization error and then accepted ordinary writes, 0.9.1 rejects mixed records that remain in the WAL. If 0.9.0 checkpointed those writes, the WAL suffix is gone. Holt cannot detect or reconstruct that recovery gap. Rebuild such a store from authoritative application state before using the attached stream.

Performance evidence

A controlled same-host A/B found no measurable ordinary-write regression from the atomic fence. Median latency changed by -1.26% for puts and -0.12% for the mixed workload. Both confidence intervals crossed zero.

Removing the submission-time decode reduced median sync: false attached-commit latency by 12.81% with 128-byte payloads and 27.50% with 4 KiB payloads. Median sync: true latency changed by -0.17%, where forced sync dominates.

A fresh run of the permanent async benchmark measured ordinary commits at 758.92 to 827.72 ns. Attached commits measured 838.19 to 855.25 ns at 128 bytes and 1.8607 to 1.9227 us at 4 KiB.

Related

Follow-up to #51. This maintainer-directed Holt 0.9.1 hotfix has no linked issue.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.