Background

At step down we assert that stable equals the step-down timestamp when one was set. That confirms the application moved the boundary, but not that the step-down checkpoint completed on it. The completed checkpoint timestamp is tracked separately, in conn->disaggregated_storage.last_checkpoint_timestamp.

If that value lags the step-down timestamp, the data between the last completed checkpoint and the boundary lives only on the outgoing node. The next leader picks up an older checkpoint and nothing reports the gap.

Proposal

Add a WT_ASSERT_ALWAYS beside the existing stable check in __disagg_step_down_int, under the same step-down timestamp condition, requiring the last completed checkpoint timestamp to equal the step-down timestamp. A mismatch is a protocol violation, the same way a stable mismatch is already treated as fatal.

This is the timestamp-space counterpart of WT-18276, which covers the same boundary in schema-epoch space.