KV disk-offload is still default-on: the 2026-07-10 opt-in decision was never executed

[TinDang97]

What this is

A decision recorded on 2026-07-10 — flip KV disk-offload from default-on to
opt-in — was never carried out. Surfaced while writing the #656 cold-tier
observability tests: a test that omitted --disk-offload got a server with
the tier on, which is what made its premise fail.

Filing it so it lives in the tracker rather than only in a working note.
I am not proposing to flip anything here; a durability default is a call for
a human to make deliberately.

Verified state (2026-08-22, against HEAD)

src/config.rs:438
    #[arg(long = "disk-offload", default_value = "enable")]
    pub disk_offload: String,

docs/configuration.md:153
    | `--disk-offload` | `enable` | Enable disk offload (RAM → mmap → NVMe) |

Code and docs agree with each other — both still say enable. The only
loom models in the tree are tests/loom_response_slot.rs and
tests/loom_wal_sync_agent.rs; neither covers the offload reconciliation
invariant. There is no proptest dependency.

So all three steps of the original plan are outstanding:

1. flip the --disk-offload default "enable" → "disable"
2. add a property/loom-style test proving the hot/cold/WAL reconciliation
   invariant (no DEL-resurrection, no expired-cold leak) — not just the
   existing example-based crash tests
3. update CHANGELOG + docs/configuration.md

The original reasoning, restated

Disk-offload is a two-source-of-truth durability path. WAL/AOF is the hot
tier's authority; the cold .mpf KvLeafPage DataFiles plus the manifest are
independently self-durable and recovered on their own (see
tests/crash_recovery_disk_offload_no_aof.rs). This is not a double-write
conflict with the WAL — the risk is reconciliation. Recovery order is
Phase 3 (rebuild cold_index from the manifest) then Phase 4 (WAL replay on
top, hot shadowing cold).

Every bug found in that seam so far has been silent data-loss class, and
every one was caught by soak or adversarial review rather than by a proof:

• DEL/FLUSH resurrection + expired-cold leak (PR fix(storage): cold-tier correctness + reliability (DEL/FLUSH resurrection, expired-read leak, crash durability, orphan sweep, liveness) #212)
• BITOP/COPY/DEL/UNLINK resurrection (PR perf(persistence): local-leg group commit + BITOP/COPY/DEL/UNLINK coordinator leg durability #213)
• spill completion resurrecting a DEL'd key (dbsize_offload_logical: load-fragile, and restart can resurrect evicted keys (recovered > live) #459)

Default-on plus that history is the combination the decision was reacting to.
It also sits oddly against the deliberately conservative vector-COLD posture,
where DiskANN COLD ships as a stub valve by default with the real engine gated.

Note on step 2

Step 2 is the one with standalone value regardless of what happens to the
default. Every bug above was found by example; none of them by a proof that
the reconciliation invariant holds. A property test would be worth having even
if the default never moves.

Related

#656 (cold-tier observability — how this surfaced), #212, #213, #459.