i'm confused how this changes behavior... it seems like the new else case is effectively the same as the old else case... safe_pos will remain at the start of the earliest in-flight flush.  i.e., you could assert(safe_pos == *pending_safe.begin() in the else block..