Why the log was enough
The situation
A fee collection database loses power. When it comes back the log shows:
14:00 CHECKPOINT { active: none }
14:05 T1 START
14:07 T1 UPDATE fees.paid 1200 -> 1500
14:11 T1 COMMIT
14:15 T2 START
14:18 T2 UPDATE fees.paid 1500 -> 1800
14:20 T3 START
14:24 T3 UPDATE seats.free 40 -> 39
14:29 T3 COMMIT
14:32 (power lost)
The log is on disk and complete up to 14:32. The data pages may or may not have been written; the buffer manager was free to write them at any time.
T2 never committed.
Recovery reconstructs T1's update even if the data page never reached disk. Which rule makes that possible?