Note
pd_lsn vs record LSN
Every WAL record has an address in the log stream: its record LSN. Every 8 KB data page also carries an LSN in its header, pd_lsn: the page LSN, which is the address just past the most recent WAL record already applied to that page.
The rule that makes crash recovery idempotent: when replaying a record for a page, PostgreSQL applies it only if pd_lsn is older than the record’s LSN. If the page already shows a newer LSN, that change reached disk before the crash and is skipped.
Related: full-page-writes-and-torn-pages (once written).