…esolves xtdb#5975)
The mechanism, and the loss it opens at stream open, are on xtdb#5975.
- **The spec gains a line on `SoleConfirmer` rather than a new obligation.** "At most one party confirms a given slot" already covers this; what it did not say is that a driver advancing the flush position on its own schedule counts as a party. A second invariant naming the driver case would oblige the same thing twice, and a reader checking coverage would count it twice.
- **No regression test comes with it.** Reproducing the loss needs a keepalive to land between stream open and the first data message, on a source resuming with an un-blocked range behind it; that timing is not constructible from the client. What is testable is the other direction, and `slot advances before the first block is cut` still passes with automatic flush off — so the quiet advance is `confirm()`'s alone, and no guarantee was resting on the driver.
Refs xtdb#5975
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Resolves #5974 and #5975.
slot is confirmed only as far as the last durable block failed twice on main in one day with a green run between them, leaving the Integration Test job intermittently red for every branch rebasing onto it. #5975 was found while investigating that, in the same keepalive path.