checkpoint

Writes a consistent copy of this store into target, which must be empty or absent.

val info = store.checkpoint(Path.of("backup", "2026-08-10"))
DocumentStore.open(info.directory).use { copy -> /* every commit up to info.sequence */}

Safe to call while writing. The store is flushed, a snapshot is pinned, and the copy is taken of what that snapshot sees — so the result holds exactly the acknowledged prefix as of CheckpointInfo.sequence, which is the store's own guarantee asserted against a second directory rather than against a reopen. Writes that arrive during the call are simply above that sequence and are not in the copy.

The segments are hard-linked where the filesystem allows it, so a checkpoint of a large store costs a directory entry per file rather than its bytes. That also means the copy shares blocks with the source: it is a consistent view, and moving it off the machine — which is what makes it a backup — is the caller's next step, not this one's. CheckpointInfo.hardLinked says which happened.

Sidecars travel with their segments, including kinds this module knows nothing about: any file named after a live segment's number is copied, so a checkpoint's .cat, .idx, .pst and .col files are read by the copy rather than rebuilt. What it does not carry is the index registry, which is IndexCatalog's file and is copied by Rabosh.checkpoint; a checkpoint taken through this method opens with its sidecars intact and no index defined.

No log is copied. The flush is what makes that correct: every commit at or below the sequence is already in a segment, so the checkpoint opens the way a cleanly closed store does.

A failure part-way leaves target holding whatever had been written — there is no attempt to unwind, because the checkpoint is not valid until CURRENT names its manifest and until then the directory does not open as a store at all. The source is never modified, which is the property the fault-injection suite asserts at every step.

Throws