Startup Recovery Practice

Loading both is harmless because key operations are idempotent, so configuration merely picks the faster file.

The file with the newer modification time should always win, and configuration simply records that automatic choice.

Configuration defines the source of truth and precedence; loading both arbitrarily can replay stale or duplicate state.

RDB and AOF describe two different keyspaces, so recovery must always load both of them, ordered by size.

Both paths replay commands, with RDB being simply a compressed encoding of the same command log.

RDB reconstructs state by deserializing saved objects, while AOF reconstructs state by executing stored mutations in order.

Both paths deserialize objects, with AOF differing only by storing its objects incrementally over time.

AOF deserializes objects while RDB executes mutations, which is why loading an RDB file is slower, since it goes through the ordinary command execution path.

Normal clients must wait or receive a loading error because the in-memory keyspace and metadata are not coherent yet.

Clients may safely read but not write during loading, because reads cannot observe an incoherent keyspace.

Clients should be served directly from the data files on disk while memory fills up in the background.

The loading error exists only to trigger client-side failover, since a single node could safely serve early while the rest of the dataset streams in behind them.

It loads normally and expires on first access, exactly like any other key expiring at runtime, preserving the lazy-deletion semantics used at runtime.

It loads with its TTL restarted from boot, granting the key one more full lifetime.

Recovery aborts with an error, since an expired key in a data file is a sign of file corruption.

The key should be filtered out during recovery because its absolute expiration time is already in the past.

AOF replay is internal recovery work, so it should apply mutations without sending live-client network replies or triggering external effects.

Replay must send replies, because monitoring tools rely on them to verify each replayed command succeeded.

Replies during replay are harmless since no clients are connected; the rule exists purely for code symmetry.

Replay avoids replies only as a speed optimization, and with fast disks it would be acceptable to send them.