The RESYNC logic can fail, causing a transition to the OPERATOR state. We have analyzed this failure mode. It appears when the quorum leader does not have a live HALog file open and the service in RESYNC is at the same commit point as the quorum leader. The service in RESYNC then requests the HALog file for commitCounter+1, which would be the live HALog. Since that live HALog file is missing, the service transitions to the OPERATOR state. Note that new writes on the leader would cause the live HALog file to spring into existence, at which point at attempt to RESYNC would succeed.