[beinan]

Summary

A local WAL sync alone cannot justify an ingestion ACK. Add an optional, transport-independent raft-rs append driver over the shared durable log: persist Ready entries/HardState and LightReady commit updates before returning committed completions. Exact latest retries pass through consensus again and return the original accepted index. Leadership loss reports unresolved requests as unknown; index-plus-term matching prevents a replaced suffix from completing another request.

Input bodies remain shared Bytes in Raft entries. Immutable layout/application-policy binding protects recovery. Accepted metadata, producer tracking and pending proposals have explicit limits; groups can move to independent workers sharing one engine's sync/failure fence. Accepted-record pages capture their cursor with their contents so a subsequent publisher cannot skip intervening appends by reading status separately.

This increment retains the full log and static membership. Authenticated transport, bounded disk use/reclamation, producer lifecycle, snapshots/replica replacement and Lance publication integration remain separate work. It does not enable production ingestion or establish a throughput result. See docs/design/replicated-wal-append.md for the API and durability boundaries.

Refs #378

Testing

• Real Rust peer processes and raft-engine files over TCP: majority ACK with one follower, leader loss, exact retry, isolated old leader, conflicting uncommitted suffix, two groups and full process restart with complete payload comparison.
• Injected file-sync failure prevents follower response/leader ACK and fences the shared engine. Unit coverage also checks shared body ownership, retry/sequence rules, capacity, immutable binding and captured page progress.
• Final optional-feature validation: Clippy on Rust 1.99; 28 active tests on Rust 1.96.1; formatting and spelling checks. The child fixture and manual storage fixture are intentionally ignored except when invoked by their process tests.
• Repository check script passed: workspace Rust fmt/Clippy/tests, Python tests (229 passed, 2 skipped, 1 xfailed), ruff and pyright. The final changes affected only the optional replication feature, its fixture and documentation; those were validated again with the focused checks above.