The torn-shutdown regression test documents that SIGKILL during an in-place batch may lose rows or produce phantom rows that still validate. Signal-level crashes are now contained, but row fidelity is explicitly an ignored test and recovery is described as rebuild or snapshot restore. Before 1.0, choose and publish the durability contract. Option A is crash-atomic batches through a journal, shadow pages, or another recoverable format, with the ignored consistent-prefix test enabled. Option B is to state prominently that persistence is best-effort rather than a durable database, define the exact guarantees of wait_for_ops, provide a supported corruption/rebuild path, and ensure every load either yields a valid declared state or a typed corruption error. This is distinct from #36, which covers graceful task lifecycle and surfaced runtime failures rather than process death.
The torn-shutdown regression test documents that SIGKILL during an in-place batch may lose rows or produce phantom rows that still validate. Signal-level crashes are now contained, but row fidelity is explicitly an ignored test and recovery is described as rebuild or snapshot restore. Before 1.0, choose and publish the durability contract. Option A is crash-atomic batches through a journal, shadow pages, or another recoverable format, with the ignored consistent-prefix test enabled. Option B is to state prominently that persistence is best-effort rather than a durable database, define the exact guarantees of wait_for_ops, provide a supported corruption/rebuild path, and ensure every load either yields a valid declared state or a typed corruption error. This is distinct from #36, which covers graceful task lifecycle and surfaced runtime failures rather than process death.