Checkpoint commit and atomic promotion

Assign a unique generation and attempt identity before writing. Store new payload under immutable names or enforce a create-only policy so a retry cannot overwrite an older committed tensor. Writer acknowledgments must refer to that exact attempt and logical cut. Once required writes satisfy the backend contract, assemble a complete manifest binding their identities. An abandoned attempt may leave orphaned objects, but readers must not infer commitment from their presence. Garbage collection can reclaim them later under the same publication and reader-protection rules used for retained generations.

A discovery pointer such as latest is an optimization for finding a generation, not a replacement for its complete manifest. Resolve it to one immutable committed description, then validate that description. When a coordinator crashes after commitment but before pointer promotion, the old pointer can remain usable and the new generation can be discovered through an explicit repair path. When it crashes after a successful pointer update but before recording the response locally, retry must recognize the already performed transition rather than publish unrelated or incomplete state.

A filesystem namespace operation and persistence across power loss are different properties. Linux fsync documentation explicitly distinguishes flushing a file from ensuring its directory entry is persisted; the directory can need its own synchronization. The application must use a procedure supported by its filesystem and storage stack, check errors, and test crash behavior. A successful write into page cache, a closed file, or a barrier among workers should not be reinterpreted as proof of durable complete-generation publication on every backend.

Object stores require their own protocol rather than a filesystem rename assumption. Amazon S3 conditional writes can enforce create-only object names or compare an existing object version through an ETag condition. These operations apply to the specified object, not a transaction over every shard and manifest. A latest-pointer compare-and-set can prevent an observed concurrent overwrite, but still needs generation-order policy, retry handling, and immutable referenced data. An ETag used as a concurrency token is not a universal payload checksum or an authentication proof.

Test failure after each shard write, after manifest creation, during metadata synchronization, immediately before pointer update, and after the update but before acknowledgment. Readers should select a complete allowed generation or fail explicitly, never combine pieces from adjacent attempts. Concurrent coordinators need fencing or a conditional protocol so an older late writer cannot move latest backward unnoticed. If explicit rollback to an older generation is allowed, record it as a policy decision rather than treating generation order as an accidental timestamp comparison.

The Markov instrument offers only an abstract contrast between a monotone state and a reversible bit. Reset, set both p=1 and q=0, predict state-one probability one after one transition and thereafter, then Step twice. Separately Reset, set both p=1 and q=1, predict state-one probability zero after two transitions, then Step twice. The second chain alternates, so reaching state one once is not permanent. This probability model has no storage transaction, crash recovery, or consensus; an actual committed generation needs a protocol, not this animation.