checkpoint: bug-851 root cause + raft TLA+ conformance spec family

Investigation & fixes (failover committed-job loss):
- root-cause bug-851 on an owned 3-node cluster: chaotic failover causes
  silent committed-prefix divergence (WAL hdr.term always 0; two leaders
  per term; no (term,lsn) reconcile). Evidence in repro-851/ + INVESTIGATION.
- live-validated fixes 848/849/850 (recovery-on-promotion, advertise real
  applied_lsn, persist-layer contiguity guard); add waldump WAL inspector.

Specs (strict raft.tla conformance — library owns the log):
- TLA-gap-analysis.md: impl vs raft/raft.tla, gaps G1-G6.
- raft-log-replication, raft-commit-safety, raft-sim-conformance: extend
  src/lib/raft to own log/commit/verification via callbacks (specs generated,
  cross-spec review passed).
- ha-term-safety: controller-side adapter + config marker (R1-R7); design done.
- config-upgrade-snapshot: R8 descoped here (deps entity-bearing-snapshots, bug-857).
- roadmap + buglog (851/854/857) + .wolf knowledge updated.

src/controller/ha.h

@@ -793,6 +793,21 @@ void ha_vote_self_freshness(ha_state_t *ha,
  */
 uint64_t ha_candidate_advertise_lsn(persist_t *p);
 
+/* ha_sync_applied_lsn_from_recovery (bug-848) — after local WAL recovery on
+ * (re)start, set ha->applied_lsn to the position the member actually recovered
+ * (persist_durable_floor(p)), instead of the ha_init default of 0.
+ *
+ * Why: a restarted standby advertises ha->applied_lsn to the primary in its
+ * state report; the primary then streams the catch-up range [applied_lsn+1 ..
+ * committed].  If a node that already holds [1..N] on disk reports 0, the
+ * primary re-streams the WHOLE log and the receiver O_TRUNC-overwrites already-
+ * consistent records (instead of Raft incremental catch-up of only the missing
+ * suffix).  This mirrors the value the election/PreVote path already trusts
+ * (ha_candidate_advertise_lsn == persist_durable_floor), so the catch-up and
+ * vote-freshness advertisements finally agree.  NULL-safe; never lowers an
+ * already-higher applied_lsn (monotonic). */
+void ha_sync_applied_lsn_from_recovery(ha_state_t *ha, persist_t *p);
+
 /*
  * ha_elect_evaluate_and_signal: evaluate accumulated ha_elect_ctx_t votes.
  * Sets ctx->result (1=primary, 0=standby) and posts ctx->done semaphore.