TLA+ Caught a Silent Data Divergence Bug in Postgres's pg_rewind
multigres.com