Single global applied-index file vs per-database snapshot installs — applied-index/data skew on a multi-DB state machine #4824

Affected version: 26.6.1
Component: ArcadeStateMachine (.raft/applied-index) vs SnapshotInstaller.atomicSwap
Severity: MEDIUM

Summary

The persisted applied index is a single scalar at
<SERVER_DATABASE_DIRECTORY>/.raft/applied-index for a state machine that
multiplexes all databases. A per-database snapshot install jumps that DB's on-disk
state without a corresponding meaning for the global counter, so the persisted
value can't be trusted per-database.

Code

ArcadeStateMachine.java:1134-1142 (global file), :189-225 (reinitialize restore);
SnapshotInstaller.java:530-571 (per-DB swap, never touches applied-index).

Impact

Recovery decisions in reinitialize (e.g. snapshotIndex > persistedApplied + tolerance → download) are computed against a value that mixes databases. Mostly
latent thanks to engine-level page-version guards, but a genuine bookkeeping
defect.

Suggested fix

Rely solely on Ratis' snapshot index, or make applied-index tracking
per-database-aware.