Checksummed write-ahead log and atomic checkpoint storage.
Recovery ignores WAL records already represented by the checkpoint. An incomplete final version-two WAL record is truncated to the last checksummed record. Complete records and ambiguous version-one tails that fail validation cause recovery to fail without modifying the WAL. Records are local trusted state: after their size and checksum are verified, ETF terms are decoded and their WAL or checkpoint structure is validated before use. Startup fsyncs every newly created directory entry and the WAL entry before the adapter can acknowledge replicated writes. WAL records and checkpoints use the same fixed 256 MiB maximum ETF payload size for both writes and recovery.