`StoreEngine::checkpoint` was the frozen D0 signature that returned
NotImplemented. It now checkpoints every shard on its own writer thread and
returns a lease that really pins.
The ordering inside it is the correctness. The checkpoint format carries
catalog, refs and receipts and no object index, and advancing
committed_shard_sequence stops recovery replaying the frames it covers — so
entries that live only in the root's delta layers describe objects that are on
disk, named by a segment, and unreachable at the next open. Every layer through
the committed sequence is sealed into a run the checkpoint's own manifest names
and discarded from the root before the sequence moves; coverage short of that
is refused rather than partially applied.
CheckpointLease holds the exact Arc<RetainedGeneration> each shard published,
which pins segment and checkpoint descriptors and index-run mappings. Counting
retained generations cannot stand in for that: two later checkpoints prune the
generation the lease names.
The group boundary is structural rather than a lock. The checkpoint travels the
same channel as submissions and the writer loop publishes any open group before
running one, so it cannot advance past sequenced-but-unfenced frames.
Four edge cases, each tested: an empty shard is skipped rather than
checkpointed at sequence 0; a repeat with no new work reuses instead of
renaming onto its own name; a finalized but unreferenced checkpoint left by a
crash is validated through recovery's reader and adopted rather than wedging
the shard on a permanent EEXIST; and a journal holding no frame seals nothing.
store-bench found that last one by calling the entry point that had always
refused. It now earns index_maintenance from a measurement as well —
index_maintenance().unsealed_delta_layers where it recorded None for "no such
reading exists", which is the interface request its own guard had written down.
Acceptance: write below seal pressure, checkpoint, reopen, resolve every object
with the replay delta excluded as the answer. Both named mutations fail it on
reachability rather than bookkeeping.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XKzM69CHmBuDcA3qN1jFdh
Levi Neuwirth
5462952691