That's true. The protocol aware recovery paper [1] talked about the challenges of disentangling corruption in the middle of the log vs uncommitted data at the e

That's true. The protocol aware recovery paper [1] talked about the challenges of disentangling corruption in the middle of the log vs uncommitted data at the end of the log. This is an issue in other log-based systems as well. The OP made it sound like an oversight rather than an implication of assuming that the filesystem won't return corrupt data that was successfully written and fsync'ed. Sqlite is pretty upfront about the tradeoffs: https://www.sqlite.org/howtocorrupt.html#_failure_to_sync https://www.sqlite.org/howtocorrupt.html#_failure_to_sync 1: https://blog.acolyer.org/2018/02/27/protocol-aware-recovery-for-consensus-based-storage/ https://blog.acolyer.org/2018/02/27/protocol-aware-recovery-...