[beinan]

A process can exit between the legacy merge's delete, append, and WAL-drain commits. These subprocess tests terminate at both durable write boundaries, then reopen the same shard and recover without appending new data. They check updated and untouched contents, pending-generation drain, physical fragment row counts, and repeated recovery.

Fault hooks exist only in unit-test builds. This is stacked on the explicit WAL replay change in #387; it does not qualify concurrent legacy writers, uncertain object-store acknowledgements, or production process retirement.

Validation: 2 crash-boundary tests passed; the subprocess helper is ignored in the parent suite and invoked explicitly by each test. git diff --check passed.