crates/astrid-storage/src/volume/hosted/mod.rs:209

• Root updates always start with copy 0, even when recovery left copy 0 as the only valid authority (for example, a crash after the first root write during generation-0 conversion). Rewriting that sole copy first reintroduces a window where a torn write leaves neither copy recoverable. Write the slot opposite state.root_slot first, sync it, then update the selected slot.

        if state.generation > 0 {
            recover::write_root_pointer(
                &mut state.file,
                state.generation,
                state.root_base,
                state.durable_len,
                false,

crates/astrid-storage/src/volume/hosted/reclaim.rs:334

• When the source is generation 0, finish_image puts the staged replacement's fully valid footer at physical EOF before any root exists. recover_container then takes the generation-0 EOF-footer fallback and admits this replacement at the ReplacementDurable crash cut, so the old generation is not kept current until the root flip as required. The staged image needs an encoding/location that cannot be selected by generation-0 EOF recovery before publication.

    let replacement_end = finish_image(&mut replacement)?;
    run_stage(&volume.path, ReclaimStage::ReplacementDurable)?;

crates/astrid-storage/src/volume/hosted/reclaim.rs:330

• The first replacement starts at the current EOF, which can be below ROOT_BYTES for a small generation-0 container (an empty volume is only 8 bytes). Publishing the fixed slots at bytes 8–135 then overwrites the just-synced replacement commit/image before pointing at it, making the intermediate root unrecoverable. Reserve the complete fixed-root area before choosing the replacement start and handle inputs too small to relocate safely.

    let mut replacement = build_image(
        &mut state,
        physical_len,
        replacement_generation,
        super::ROOT_BYTES as u64,

crates/astrid-storage/src/volume/hosted/reclaim.rs:368

• This bound check happens only after build_image and finish_image have written the final image. Because candidate_base is also where the currently selected replacement begins, an image that does not fit has already overwritten that selected generation before this error is returned; an already-compact or empty volume can therefore be left corrupt. Preflight the complete encoded size or enforce the bound before every record/footer write so crossing it cannot mutate the selected image.

    let final_end = finish_image(&mut finalized)?;
    if final_end > candidate_base {
        return Err(io::Error::other("volume reclaim did not shrink the image"));

crates/astrid-storage/src/volume/hosted/reclaim.rs:340

• This publishes ROOT_BYTES as the replacement's canonical base even though the replacement was built at replacement_base. Besides writing incorrect on-media metadata, repeat reclaims misclassify this first flip as FinalRootPublished because its generation is greater than 1. Publish the actual replacement base here.

        replacement_generation,
        super::ROOT_BYTES as u64,
        replacement_end