Add an admin checkpoint of loaded sessions (MN-REQ-06.15)

[chouswei]

Summary

MN-REQ-06.15 (ServeCheckpoint, verify MN-VER-06-S13) adds an admin-only checkpoint of every loaded session. A backup of saved files misses sessions that never called session_save. This copy is taken from RAM, without draining the serve and without refusing new opens. Patch-level c on 0.19. No version bump and no release.

Design

• CLI memnet admin checkpoint and serve envelope {checkpoint: true, admin_token}. Both use MEMNET_ADMIN_TOKEN the same way as upgrade-prepare and usage-report (unset admin_unconfigured, mismatch admin_denied). Not an agent MCP tool.
• Each loaded session is locked only while snapshot_text serialises a consistent copy. Other sessions keep serving. The serve does not enter quiesce.
• The bytes are written atomically (temp file, fsync, rename) to $MEMNET_STATE_DIR/checkpoint/<session>.snap. The previous snap for that session is overwritten. Snaps for sessions that are no longer loaded, and older snaps for sessions skipped this run, are removed so the directory matches the manifest.
• checkpoint-manifest.json reuses the upgrade manifest row (session, rows, edges, checksum, house, clocks) and adds the serve version, snapshot format version, and a timestamp.
• An unsaveable session is named (snapshot_unsaveable and the reason) and skipped. Other sessions are still written. Exit code is non-zero when any session was skipped. Stdout is @STAT: checkpoint|ok|<n>|skipped|<m>|bytes|<b>.
• TTL, session id, ACL, and live state are not changed. A checkpoint does not retire or load anything.
• memnet admin checkpoint-verify <dir> loads every snap in that directory into a throwaway in-process store (not the live registry) and checks row counts, edge counts, and checksums. Stdout is @STAT: checkpoint_verify|ok|<n>|failed|<m>.

Tests

• A checkpoint during concurrent mutates on other sessions is consistent and does not block those mutates or a new open.
• An unsaveable session is skipped, named with snapshot_unsaveable, and its previous snap is removed.
• An atomic write that fails before rename leaves the previous complete file and no temp file.
• A checkpoint file for a closed session is removed on the next run.
• checkpoint-verify passes on a good directory and fails on a corrupt or missing snap, without registering sessions.
• The admin token is required on the CLI and on the serve wire op.

Backup script

Hourly, then restic to R2 when the checkpoint exits 0:

memnet admin checkpoint \
  --token "$MEMNET_ADMIN_TOKEN" \
  --state-dir "$MEMNET_STATE_DIR"
restic backup "$MEMNET_STATE_DIR/checkpoint"

Weekly, on a restic-restored copy (not the live state directory):

restic restore latest --target "$RESTORE_DIR"
memnet admin checkpoint-verify \
  --token "$MEMNET_ADMIN_TOKEN" \
  "$RESTORE_DIR$MEMNET_STATE_DIR/checkpoint"

RESTIC_REPOSITORY is an R2 S3 URL. AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY come from the job environment. Do not commit them. Teach: docs/operations/backup.md.