chainlesschain 0.166.129 → 0.166.131

package/src/lib/context-memory-kernel/segmented-memory-port.js

@@ -40,6 +40,16 @@ import {
   queryDigest,
   selectQueryRows,
 } from "./memory-query-index.js";
+import {
+  checkMemoryQueryAborted,
+  createMemoryQueryCheckpoint,
+} from "./memory-query-control.js";
+import { MemoryShardSnapshots } from "./memory-shard-snapshots.js";
+import {
+  createQueryBundlePlan,
+  readQueryBundle,
+  writeQueryBundle,
+} from "./memory-query-bundle.js";
 
 export const SEGMENTED_STORE_SCHEMA =
   "chainlesschain.cli-context-memory-store/v2";
@@ -103,6 +113,7 @@ function regular(file) {
 }
 function directories(directory) {
   let current = resolve(directory);
+  const requested = current;
   while (true) {
     const stat = lstatSync(current);
     // macOS exposes its system temporary tree through the root-owned /var
@@ -115,28 +126,27 @@ function directories(directory) {
       realpathSync(current) === `/private${current}`;
     if (!systemAlias && (!stat.isDirectory() || stat.isSymbolicLink()))
       throw corruptStore(current, "authority directory is unsafe");
-    if (process.platform === "win32") {
-      // Some Windows runtime adapters report an ordinary directory for a
-      // junction whose target cannot be decoded in their DOS namespace. Keep
-      // the lstat guard and independently reject a different native canonical
-      // coordinate before mkdir or lock acquisition. This is an additional
-      // consistency check, not a proof against every reparse tag or a race.
-      let canonical;
-      try {
-        canonical = realpathSync.native(current);
-      } catch {
-        throw corruptStore(current, "authority directory cannot be resolved");
-      }
-      if (
-        typeof canonical !== "string" ||
-        resolve(canonical).toLowerCase() !== current.toLowerCase()
-      )
-        throw corruptStore(current, "authority directory resolves elsewhere");
-    }
     const parent = dirname(current);
     if (parent === current) break;
     current = parent;
   }
+  if (process.platform === "win32") {
+    // Native resolution of the whole path follows redirects in every ancestor.
+    // Retain lstat on every ancestor, including adapters that misclassify a
+    // junction; avoid re-resolving all the same prefixes per shard. This is a
+    // consistency check, not a proof against every reparse tag or a race.
+    let canonical;
+    try {
+      canonical = realpathSync.native(requested);
+    } catch {
+      throw corruptStore(requested, "authority directory cannot be resolved");
+    }
+    if (
+      typeof canonical !== "string" ||
+      resolve(canonical).toLowerCase() !== requested.toLowerCase()
+    )
+      throw corruptStore(requested, "authority directory resolves elsewhere");
+  }
 }
 function identity(directory) {
   const stat = lstatSync(directory);
@@ -166,11 +176,15 @@ function ensureSafeDirectory(directory) {
  * authority. Audit events are retained, not truncated to buy record capacity.
  */
 export class SegmentedMemoryPort extends DurableJsonMemoryPort {
+  #shardSnapshots;
+
   constructor({
     maxTotalBytes = DEFAULT_MAX_TOTAL_BYTES,
     maxEvents = DEFAULT_SEGMENTED_MAX_EVENTS,
     readOnly = false,
     queryIndexCacheMode = "validate-disk",
+    queryIndexLayout = "bundle",
+    decodedShardCacheBytes,
     ...options
   } = {}) {
     super({ ...options, maxEvents });
@@ -181,12 +195,17 @@ export class SegmentedMemoryPort extends DurableJsonMemoryPort {
     if (!["validate-disk", "verified-memory"].includes(queryIndexCacheMode))
       throw new TypeError("Unknown query index cache mode");
     this.queryIndexCacheMode = queryIndexCacheMode;
+    if (!["bundle", "individual"].includes(queryIndexLayout))
+      throw new TypeError("Unknown query index layout");
+    this.queryIndexLayout = queryIndexLayout;
     this.filePath = resolve(this.filePath);
     this.shardDirectory = `${this.filePath}.shards`;
     this._queryIndexes = new Map();
+    this.#shardSnapshots = new MemoryShardSnapshots(decodedShardCacheBytes);
   }
 
-  _locked(operation) {
+  _locked(operation, options = {}) {
+    checkMemoryQueryAborted(options.signal);
     ensureSafeDirectory(dirname(this.filePath));
     directories(dirname(this.filePath));
     return super._locked(() => {
@@ -197,31 +216,34 @@ export class SegmentedMemoryPort extends DurableJsonMemoryPort {
         : null;
       if (existsSync(this.filePath)) regular(this.filePath);
       return operation();
-    });
+    }, options);
   }
 
   _checkDirectories() {
-    directories(dirname(this.filePath));
+    // The shard path traversal already checks the authority parent and every
+    // ancestor, including native Windows resolution. Keep the separate identity
+    // comparisons below without traversing the same ancestry twice per read.
     directories(this.shardDirectory);
+    const parentIdentity = identity(dirname(this.filePath));
+    const shardStat = lstatSync(this.shardDirectory);
+    const shardIdentity = `${shardStat.dev}:${shardStat.ino}`;
     if (
-      identity(dirname(this.filePath)) !== this._parentIdentity ||
-      (this._shardIdentity !== null &&
-        identity(this.shardDirectory) !== this._shardIdentity)
+      parentIdentity !== this._parentIdentity ||
+      (this._shardIdentity !== null && shardIdentity !== this._shardIdentity)
     ) {
       throw corruptStore(
         this.filePath,
         "authority directory was replaced during an operation",
       );
     }
-    this._shardIdentity = identity(this.shardDirectory);
-    if (
-      process.platform !== "win32" &&
-      lstatSync(this.shardDirectory).mode & 0o077
-    )
+    if (process.platform !== "win32" && shardStat.mode & 0o077)
       throw corruptStore(
         this.shardDirectory,
         "shard directory must be private",
       );
+    // Publish precisely the identity we compared. A second lstat here could
+    // silently adopt a replacement between comparison and baseline update.
+    this._shardIdentity = shardIdentity;
   }
 
   _shardPath(bucket, descriptor) {
@@ -238,6 +260,44 @@ export class SegmentedMemoryPort extends DurableJsonMemoryPort {
     );
   }
 
+  _queryBundlePlan(manifest) {
+    if (
+      this.queryIndexLayout !== "bundle" ||
+      manifest.schema !== SEGMENTED_STORE_SCHEMA ||
+      !manifest.digest
+    )
+      return null;
+    const compatibilityBytes = Object.values(manifest.shards).reduce(
+      (sum, entry) => sum + (entry.queryBytes || 0),
+      0,
+    );
+    // The bundle is an additional derived copy. Preserve the existing total
+    // capacity instead of making a query fail merely because it cannot fit.
+    const available =
+      this.maxTotalBytes - manifest.totalBytes - compatibilityBytes;
+    if (!Number.isSafeInteger(available) || available <= 0) return null;
+    const plan = createQueryBundlePlan(manifest, {
+      maxFrameBytes: this.maxStoreBytes,
+      maxBundleBytes: available,
+    });
+    if (!plan) return null;
+    const file = join(this.shardDirectory, plan.name);
+    const normalize = (value) =>
+      process.platform === "win32"
+        ? resolve(value).toLowerCase()
+        : resolve(value);
+    const authorityPaths = [
+      this.filePath,
+      ...Object.entries(manifest.shards).flatMap(([bucket, entry]) => [
+        this._shardPath(bucket, entry),
+        ...(entry.queryDigest ? [this._queryIndexPath(bucket, entry)] : []),
+      ]),
+    ];
+    if (authorityPaths.some((path) => normalize(path) === normalize(file)))
+      throw corruptStore(file, "query bundle path collides with authority");
+    return { ...plan, file };
+  }
+
   _validateManifest(input) {
     const invalid = () => {
       throw corruptStore(this.filePath, "segmented manifest is invalid");
@@ -308,7 +368,10 @@ export class SegmentedMemoryPort extends DurableJsonMemoryPort {
   }
 
   _loadManifest() {
-    if (!existsSync(this.filePath)) return blankManifest();
+    if (!existsSync(this.filePath)) {
+      this.#shardSnapshots.observe(null);
+      return blankManifest();
+    }
     regular(this.filePath);
     // v1 can be larger than a manifest; preserve its existing read boundary.
     let input;
@@ -324,6 +387,7 @@ export class SegmentedMemoryPort extends DurableJsonMemoryPort {
       throw corruptStore(this.filePath, "authority cannot be parsed", cause);
     }
     if (input?.schema === STORE_SCHEMA) {
+      this.#shardSnapshots.observe(null);
       if (bytes.length > this.maxStoreBytes)
         throw corruptStore(
           this.filePath,
@@ -337,6 +401,7 @@ export class SegmentedMemoryPort extends DurableJsonMemoryPort {
     if (bytes.length > MANIFEST_LIMIT)
       throw corruptStore(this.filePath, "manifest is too large");
     this._checkDirectories();
+    this.#shardSnapshots.observe(this._snapshotGeneration(manifest));
     if (!this.readOnly) this._collect(manifest);
     return manifest;
   }
@@ -399,6 +464,26 @@ export class SegmentedMemoryPort extends DurableJsonMemoryPort {
     return state;
   }
 
+  _snapshotGeneration(manifest) {
+    return manifest.digest
+      ? JSON.stringify([
+          this.filePath,
+          this._parentIdentity,
+          this._shardIdentity,
+          manifest.digest,
+        ])
+      : null;
+  }
+
+  _queryShardSnapshot(manifest, bucket, bytes) {
+    return this.#shardSnapshots.read(
+      this._snapshotGeneration(manifest),
+      bucket,
+      bytes,
+      () => this._decodeShard(manifest, bucket, bytes),
+    );
+  }
+
   _collect(manifest) {
     this._checkDirectories();
     const live = new Set(
@@ -409,6 +494,8 @@ export class SegmentedMemoryPort extends DurableJsonMemoryPort {
           : []),
       ]),
     );
+    const bundle = this._queryBundlePlan(manifest);
+    if (bundle) live.add(bundle.name);
     // All readers hold the same authority lock. No reader can still be using
     // a superseded shard here. Unknown files are never treated as our garbage.
     const directory = opendirSync(this.shardDirectory);
@@ -449,6 +536,7 @@ export class SegmentedMemoryPort extends DurableJsonMemoryPort {
     ensureSafeDirectory(this.shardDirectory);
     this._checkDirectories();
     this._collect(manifest);
+    const previousBundle = this._queryBundlePlan(manifest);
     const next = cloneCanonical(manifest);
     const pending = [];
     let pendingBytes = manifest.totalBytes;
@@ -504,6 +592,19 @@ export class SegmentedMemoryPort extends DurableJsonMemoryPort {
     );
     next.digest = manifestDigest(next);
     this._validateManifest(next);
+    this._queryBundlePlan(next);
+    if (
+      previousBundle &&
+      pending.some(
+        ({ file }) =>
+          resolve(file).toLowerCase() ===
+          resolve(previousBundle.file).toLowerCase(),
+      )
+    )
+      throw corruptStore(
+        previousBundle.file,
+        "new query index path collides with the existing bundle",
+      );
     const serialized = `${JSON.stringify(next)}\n`;
     if (Buffer.byteLength(serialized) > MANIFEST_LIMIT)
       throw limit("manifest exceeds byte limit");
@@ -546,6 +647,7 @@ export class SegmentedMemoryPort extends DurableJsonMemoryPort {
       if (existsSync(this.filePath)) regular(this.filePath);
       renameSync(temporary, this.filePath);
       published = true;
+      this.#shardSnapshots.observe(this._snapshotGeneration(next));
       syncDirectory(dirname(this.filePath));
       directorySynced = true;
       this._collect(next);
@@ -658,7 +760,7 @@ export class SegmentedMemoryPort extends DurableJsonMemoryPort {
     );
   }
 
-  _readQueryIndex(manifest, bucket) {
+  _readQueryIndex(manifest, bucket, validatedFrame) {
     const descriptor = manifest.shards[bucket];
     const binding = JSON.stringify([
       manifest.digest,
@@ -673,14 +775,46 @@ export class SegmentedMemoryPort extends DurableJsonMemoryPort {
     // decision based on filesystem timestamps. Re-read and verify the current
     // manifest on every operation; any generation/authority change invalidates
     // this binding. Selected authority shards are still read and verified.
-    // Disk repair remains eager in validate-disk mode; verified-memory repairs
-    // a derived index on the next cache miss, rather than every warm query.
+    // validate-disk verifies the bytes of the active layout on every query.
+    // With a valid bundle, individual indexes are compatibility copies and
+    // are repaired when rebuilding the bundle. verified-memory remains opt-in.
     if (
+      validatedFrame === undefined &&
       this.queryIndexCacheMode === "verified-memory" &&
       descriptor.queryDigest &&
       cached?.binding === binding
     )
       return cached.index;
+    const bytes =
+      validatedFrame === undefined
+        ? this._readQueryIndexBytes(manifest, bucket)
+        : validatedFrame;
+    // Bytes cross only the internal loader boundary: readQueryBundle hashes
+    // every on-disk frame before this callback; _readQueryIndexBytes validates
+    // or reproduces individual/read-only/rebuild frames. Do not hash the same
+    // frame twice. The compiled graph owns no Buffer views, so borrowed frame
+    // storage can be reused as soon as this synchronous decoder returns.
+    const digest = descriptor.queryDigest || queryDigest(bytes);
+    if (descriptor.queryDigest && bytes.length !== descriptor.queryBytes)
+      throw corruptStore(this.filePath, "query index frame changed");
+    if (cached?.digest === digest && cached.binding === binding)
+      return cached.index;
+    let index;
+    try {
+      index = compileQueryIndex(bytes, descriptor);
+    } catch (cause) {
+      throw corruptStore(
+        this.filePath,
+        "query index structure is invalid",
+        cause,
+      );
+    }
+    this._queryIndexes.set(bucket, { digest, binding, index });
+    return index;
+  }
+
+  _readQueryIndexBytes(manifest, bucket) {
+    const descriptor = manifest.shards[bucket];
     let bytes;
     if (descriptor.queryDigest) {
       const file = this._queryIndexPath(bucket, descriptor);
@@ -729,100 +863,158 @@ export class SegmentedMemoryPort extends DurableJsonMemoryPort {
     } else {
       bytes = encodeQueryIndex(this._readShard(manifest, bucket));
     }
-    const digest = descriptor.queryDigest || queryDigest(bytes);
-    if (cached?.digest === digest && cached.binding === binding)
-      return cached.index;
-    let index;
+    return bytes;
+  }
+
+  async _readQueryBundleIndexes(manifest, checkpoint) {
+    if (this.queryIndexCacheMode === "verified-memory") return null;
+    const plan = this._queryBundlePlan(manifest);
+    if (!plan) return null;
+    const indexes = new Map();
+    const onFrame = (bucket, bytes) => {
+      indexes.set(bucket, this._readQueryIndex(manifest, bucket, bytes));
+    };
+    this._checkDirectories();
     try {
-      index = compileQueryIndex(bytes, descriptor);
-    } catch (cause) {
-      throw corruptStore(
-        this.filePath,
-        "query index structure is invalid",
-        cause,
-      );
+      await readQueryBundle(plan.file, plan, {
+        checkpoint,
+        onFrame,
+        reuseFrameBuffer: true,
+      });
+      return indexes;
+    } catch (error) {
+      if (
+        error.code !== "ENOENT" &&
+        error.code !== "CONTEXT_MEMORY_QUERY_BUNDLE_CORRUPT"
+      )
+        throw error;
+    } finally {
+      // Even an empty result must reject ancestor/directory redirection. On a
+      // content error, do this before deciding that rebuilding is safe.
+      this._checkDirectories();
     }
-    this._queryIndexes.set(bucket, { digest, binding, index });
-    return index;
+    await checkpoint(true);
+    indexes.clear();
+    if (this.readOnly) {
+      // A shadow query may validate the compatibility indexes in memory but
+      // never creates or repairs a bundle on disk.
+      for (const { bucket } of plan.frames) {
+        await checkpoint();
+        onFrame(bucket, this._readQueryIndexBytes(manifest, bucket));
+      }
+      return indexes;
+    }
+    await writeQueryBundle(plan.file, plan, {
+      checkpoint,
+      getFrame: (bucket) => {
+        const bytes = this._readQueryIndexBytes(manifest, bucket);
+        onFrame(bucket, bytes);
+        return bytes;
+      },
+      checkDirectories: () => this._checkDirectories(),
+    });
+    return indexes;
   }
 
   async _indexedRecords(
     options = {},
     { limit: count = Infinity, cursor = null } = {},
   ) {
+    const { signal } = options;
+    const checkpoint = createMemoryQueryCheckpoint(signal);
+    checkMemoryQueryAborted(signal);
     const query = normalizeListQuery(options);
-    const captured = await this._locked(() => {
-      const manifest = this._ensureQueryIndexes(this._loadManifest());
-      const binding = listCursorBinding(
-        this.filePath,
-        manifest.digest || queryDigest(JSON.stringify(manifest)),
-        query,
-      );
-      const after = decodeListCursor(cursor, binding);
-      if (manifest.schema === STORE_SCHEMA) {
-        const matches = Object.values(manifest.records)
-          .filter(
-            (row) =>
-              matchesListQuery(row, query) &&
-              (!after || compareMemoryRows(row, after) > 0),
-          )
-          .sort(compareMemoryRows);
-        const records = matches.slice(0, count);
+    const captured = await this._locked(
+      async () => {
+        const manifest = this._ensureQueryIndexes(this._loadManifest());
+        const binding = listCursorBinding(
+          this.filePath,
+          manifest.digest || queryDigest(JSON.stringify(manifest)),
+          query,
+        );
+        const after = decodeListCursor(cursor, binding);
+        if (manifest.schema === STORE_SCHEMA) {
+          const matches = Object.values(manifest.records)
+            .filter(
+              (row) =>
+                matchesListQuery(row, query) &&
+                (!after || compareMemoryRows(row, after) > 0),
+            )
+            .sort(compareMemoryRows);
+          const records = matches.slice(0, count);
+          return {
+            legacy: records,
+            storeRevision: manifest.storeRevision,
+            nextCursor:
+              matches.length > count
+                ? encodeListCursor(binding, records.at(-1))
+                : null,
+          };
+        }
+        // Merge each sorted posting lazily. Only the requested page is captured;
+        // every candidate has already passed scope, sink and lifecycle filters.
+        const bundleIndexes = await this._readQueryBundleIndexes(
+          manifest,
+          checkpoint,
+        );
+        const heads = [];
+        for (const bucket of Object.keys(manifest.shards)) {
+          await checkpoint();
+          const iterator = selectQueryRows(
+            bundleIndexes
+              ? bundleIndexes.get(bucket)
+              : this._readQueryIndex(manifest, bucket),
+            query,
+            after,
+          );
+          const next = iterator.next();
+          if (!next.done) heads.push({ bucket, iterator, row: next.value });
+        }
+        const selected = [];
+        for (const row of mergeQueryRows(heads)) {
+          selected.push(row);
+          if (selected.length > count) break;
+          if (selected.length % 256 === 0) await checkpoint();
+        }
+        const more = selected.length > count;
+        if (more) selected.pop();
+        const shards = new Map();
+        for (const { bucket } of selected) {
+          if (!shards.has(bucket)) {
+            await checkpoint();
+            shards.set(bucket, this._readShardBytes(manifest, bucket));
+          }
+        }
         return {
-          legacy: records,
+          manifest,
+          selected,
+          shards,
           storeRevision: manifest.storeRevision,
-          nextCursor:
-            matches.length > count
-              ? encodeListCursor(binding, records.at(-1))
-              : null,
+          nextCursor: more
+            ? encodeListCursor(binding, selected.at(-1).row)
+            : null,
         };
-      }
-      // Merge each sorted posting lazily. Only the requested page is captured;
-      // every candidate has already passed scope, sink and lifecycle filters.
-      const heads = [];
-      for (const bucket of Object.keys(manifest.shards)) {
-        const iterator = selectQueryRows(
-          this._readQueryIndex(manifest, bucket),
-          query,
-          after,
-        );
-        const next = iterator.next();
-        if (!next.done) heads.push({ bucket, iterator, row: next.value });
-      }
-      const selected = [];
-      for (const row of mergeQueryRows(heads)) {
-        selected.push(row);
-        if (selected.length > count) break;
-      }
-      const more = selected.length > count;
-      if (more) selected.pop();
-      const shards = new Map();
-      for (const { bucket } of selected)
-        if (!shards.has(bucket))
-          shards.set(bucket, this._readShardBytes(manifest, bucket));
-      return {
-        manifest,
-        selected,
-        shards,
-        storeRevision: manifest.storeRevision,
-        nextCursor: more
-          ? encodeListCursor(binding, selected.at(-1).row)
-          : null,
-      };
-    });
+      },
+      { signal },
+    );
+    await checkpoint(true);
     if (captured.legacy)
       return {
         records: captured.legacy,
         nextCursor: captured.nextCursor,
         storeRevision: captured.storeRevision,
       };
-    const decoded = new Map(
-      [...captured.shards].map(([bucket, bytes]) => [
+    const decoded = new Map();
+    for (const [bucket, bytes] of captured.shards) {
+      await checkpoint();
+      decoded.set(
         bucket,
-        this._decodeShard(captured.manifest, bucket, bytes),
-      ]),
-    );
-    const records = captured.selected.map(({ bucket, row }) => {
+        this._queryShardSnapshot(captured.manifest, bucket, bytes),
+      );
+    }
+    const records = [];
+    for (const { bucket, row } of captured.selected) {
+      if (records.length % 256 === 0) await checkpoint();
       const record = own(decoded.get(bucket).records, row.memoryId);
       if (
         !record ||
@@ -833,8 +1025,11 @@ export class SegmentedMemoryPort extends DurableJsonMemoryPort {
           this.filePath,
           "query index result disagrees with authority",
         );
-      return record;
-    });
+      // The cached graph is host-owned. A caller may edit its returned record
+      // without changing another query's verified snapshot.
+      records.push(cloneCanonical(record));
+    }
+    await checkpoint(true);
     return {
       records,
       nextCursor: captured.nextCursor,
@@ -857,7 +1052,8 @@ export class SegmentedMemoryPort extends DurableJsonMemoryPort {
     });
   }
 
-  async query(request) {
+  async query(request, { signal } = {}) {
+    checkMemoryQueryAborted(signal);
     if (request?.scopeAdmissions || request?.sink) {
       // Do not push recall's limit before lexical/semantic ranking in the
       // kernel. Push only gates that cannot discard an admissible result.
@@ -866,42 +1062,55 @@ export class SegmentedMemoryPort extends DurableJsonMemoryPort {
           scopeAdmissions: request.scopeAdmissions,
           sink: request.sink,
           states: ["active", "reinforced"],
+          signal,
         })
       ).records;
     }
-    const snapshot = await this._locked(() => {
-      const manifest = this._loadManifest();
-      if (manifest.schema === STORE_SCHEMA) return { legacy: manifest };
-      let capturedBytes = 0;
-      const shards = Object.keys(manifest.shards).map((bucket) => {
-        const bytes = this._readShardBytes(manifest, bucket);
-        capturedBytes += bytes.length;
-        if (
-          capturedBytes > manifest.totalBytes ||
-          capturedBytes > this.maxTotalBytes
-        )
-          throw limit("snapshot exceeds aggregate byte limit");
-        return [bucket, bytes];
-      });
-      if (capturedBytes !== manifest.totalBytes)
-        throw corruptStore(
-          this.filePath,
-          "snapshot byte count does not match manifest",
-        );
-      return { manifest, shards };
-    });
+    const checkpoint = createMemoryQueryCheckpoint(signal);
+    const snapshot = await this._locked(
+      async () => {
+        const manifest = this._loadManifest();
+        if (manifest.schema === STORE_SCHEMA) return { legacy: manifest };
+        let capturedBytes = 0;
+        const shards = [];
+        for (const bucket of Object.keys(manifest.shards)) {
+          await checkpoint();
+          const bytes = this._readShardBytes(manifest, bucket);
+          capturedBytes += bytes.length;
+          if (
+            capturedBytes > manifest.totalBytes ||
+            capturedBytes > this.maxTotalBytes
+          )
+            throw limit("snapshot exceeds aggregate byte limit");
+          shards.push([bucket, bytes]);
+        }
+        if (capturedBytes !== manifest.totalBytes)
+          throw corruptStore(
+            this.filePath,
+            "snapshot byte count does not match manifest",
+          );
+        return { manifest, shards };
+      },
+      { signal },
+    );
+    await checkpoint(true);
     if (snapshot.legacy) return Object.values(snapshot.legacy.records);
     // The lock protects capture of every byte in one manifest generation.
     // Expensive validation uses owned buffers after releasing the lock, so GC
     // and other readers/writers need not wait for whole-store JSON validation.
-    return snapshot.shards.flatMap(([bucket, bytes]) =>
-      Object.values(
+    const records = [];
+    for (const [bucket, bytes] of snapshot.shards) {
+      await checkpoint();
+      for (const record of Object.values(
         this._decodeShard(snapshot.manifest, bucket, bytes).records,
-      ),
-    );
+      ))
+        records.push(record);
+    }
+    await checkpoint(true);
+    return records;
   }
-  async getRevision() {
-    return this._locked(() => this._loadManifest().storeRevision);
+  async getRevision({ signal } = {}) {
+    return this._locked(() => this._loadManifest().storeRevision, { signal });
   }
   async exportSnapshot() {
     return this._locked(() => {