Log-only-the-oplog becomes crash-safe: replay-on-open recovery lands
Summary: Log-only-the-oplog becomes crash-safe: replay-on-open recovery lands (v0.6.0b6).
The SECANTUS_DATA_NONLOGGED mode — the mongod storage architecture, where
only the oplog is WAL-journaled and the data tables are checkpoint-durable —
graduates from a measure-only benchmark probe to a recoverable
configuration. A periodic stable checkpoint (60s cadence, the mongod
default; SECANTUS_CHECKPOINT_SECONDS overrides) anchors a marker in the
always-logged oplog-meta table, the oplog prune never touches entries above
the marker (they are the recovery source), and Storage::open replays the
oplog above the marker through the ordinary write paths — idempotently, so
the deliberately conservative marker can never double-apply work. A clean
close anchors a final checkpoint even under the fast-storage test
environment, whose skip-the-close-checkpoint optimisation would otherwise
lose unlogged tables' data with no crash involved.
The contract is proven by a hard-kill harness
(tests/test_crash_recovery.py): a writer subprocess is SIGKILLed
mid-load and every acknowledged write must be present after the reopen —
including with no checkpoint ever taken, where the entire dataset comes
back from oplog replay alone. Durability matches the logged default at
each sync_on_commit setting: with per-commit fsync every acknowledged
write survives a hard kill; without it, a hard crash can lose the unsynced
WAL tail — in either mode, exactly as before.
The default is unchanged, and deliberately so: with the durability anchoring live, the mode's own measurements moved. A single writer gains ~5%, and a workload whose oplog stays under the retention cap keeps the probe-era headroom (~122k docs/s at eight writers measured with anchoring idle) — but a sustained eight-writer load at cap pressure pays the periodic checkpoint of a hot, unlogged working set and lands at roughly half the logged default's throughput. Finding 14 records the decomposition; the default flip stays parked until the checkpoint cost is tamed. The mode is correct and recoverable today; choose it for read-heavy, single-writer, or bounded workloads.