Module checkpoint 

Projection snapshots: the recovery shortcut, never the truth.

A checkpoint is the projection tables, canonicalized, hashed, and stored as one encrypted blob at one global_sequence. It is EVIDENCE, not a restore point: this schema’s born_initial and no_truncate guards mean projection rows can only ever be produced by replaying the log, so what a checkpoint buys is the ability to check that result, not to skip it (see crate::recover). The worst a missing or corrupt one costs is a comparison — which is why an append is allowed to take one and none of the contract depends on it existing.

Two things make the hash mean anything.

Records are re-serialized through the CONTRACT type, never passed through. to_jsonb returns keys in whatever order the row’s physical layout gives, and that layout is a property of one database’s history — add a column and it moves. Deserializing each row into its ProjectionRecord and serializing that back means the bytes are determined by the type declaration instead, so two kernels serving the same log agree, and so does the same kernel after a VACUUM FULL.

The visit order is a written-down constant, not a catalog query. The hash depends on which table comes first, so that has to be something a reader can see and a diff can show changing.

The records blob’s plaintext IS the canonical bytes, so projection_hash and the blob’s own content address are the same digest. That is stated as an invariant and asserted, not left as a coincidence for someone to discover while debugging a restore.

Constants

RECORDS_MEDIA_TYPE

What the records blob is: one canonical record per line.

Functions

canonical_records

The canonical bytes of every projection row: one record per line, each one having made the round trip through its contract type.

checkpoints

Every checkpoint, newest first — the order the recovery ladder walks.

derived_records

The subset a replay can rebuild — what a checkpoint actually hashes.

projection_hash

The digest the checkpoint records, over exactly the bytes it stores.

read_query

The paged read for one projection and the column it pages by, or None if the kind has no table — which cannot happen while [every_projection_is_visited_exactly_once_in_a_written_down_order] passes, and is returned rather than panicked because this is reached from a client request.

snapshot

Snapshot the projections as conn’s transaction will leave them, store the records, and record the checkpoint.