feat: attach recovery envelopes to atomic DB WAL batches

[feichai0017]

What changed

NoKV needs each canonical recovery record to share the commit boundary of the metadata mutation it describes. This PR adds an attached recovery stream to DB. One opaque envelope and its guarded multi-tree batch share one CRC-covered WAL record.

The file-backed stream stores its checkpoint floor in the format-4 WAL header. Retained WAL records define the current tail. A checkpoint mirrors the anchor before truncating the retained suffix. Memory databases provide the same ordering and paging only during the current process. After stream initialization, Holt rejects ordinary logical writes and requires attached batches.

The branch also fixes routed-compaction accounting for reachable EmptyRoot nodes and prepares Holt 0.9.0.

Compatibility

• Durability::Wal { sync: true } puts each acknowledged attached batch on a forced sync boundary. sync: false does not provide per-acknowledgement power-loss durability.
• A checkpoint advances the local retention floor. Scans from an older cursor return Error::JournalPositionExpired.
• Writable open upgrades a header-only format-3 WAL. Holt replays a nonempty format-3 WAL only in read-only mode and rejects writable open before changing store files.
• Downgrade from format 4 requires DB::export_checkpoint() and DB::install_checkpoint() into a fresh 0.8.x store.
• The attached recovery stream is local. It is not a shared log, replication stream, or unbounded change feed.

Test plan

• cargo build --workspace --all-targets --all-features --locked
• cargo test --workspace --all-features --lib --tests --examples --locked
• cargo test --workspace --all-features --doc --locked
• workspace and soak-tool format and clippy checks
• rustdoc with warnings denied
• all four documented examples
• normal and DB-normal soak smoke runs
• 512-case property tests
• cargo publish --dry-run --locked --allow-dirty

Regression tests cover crash replay without a checkpoint, dual anchor-slot corruption, interrupted checkpoint retry, legacy WAL migration, and read-only export. They also cover stream fencing, concurrent anchors, checkpoint lock ordering, bounded paging, oversized records, and reachable-empty-root compaction.

The local host lacks rustup/nightly and cargo-llvm-cov. GitHub Actions runs the fuzz smoke and 88% coverage gates.

A downstream NoKV capacity oracle ran two 500-publish batches against the attached stream. The second batch did not raise Holt's slot high-water mark. Its logical store growth was 0.055 MiB per publish.

Related

This implements the checkpoint-bounded recovery suffix under ROADMAP P1. Live subscription and shared retention remain separate work.

NoKV adoption and existing-store migration remain downstream work.

This maintainer-directed Holt 0.9.0 storage work has no linked issue.

After merge, tag the exact merged main commit as v0.9.0. The release workflow publishes the crate and creates the GitHub release.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.