Machine-Checked Dual-Write Recovery from a Commit Log
Two reachable post-crash states are constructed with the same durable source-side state and different sink acceptance records and it is shown how bounded deduplication state and truncated source history limit the lifetime of the guarantee.