Fail closed if the initial or extended recovery marker cannot be written, retain exact terminal outcomes after catastrophic start failures, and localize the resulting user-visible errors.
Fail closed if the initial or extended recovery marker cannot be written, retain exact terminal outcomes after catastrophic start failures, and localize the resulting user-visible errors.