[beinan]

Summary

GroupLog currently retains its entire committed prefix. Add a local checkpoint boundary that persists a bounded application descriptor, retained term ranges and logical prefix compaction in one synced engine batch. Reopen preserves HardState, the boundary term and the committed/uncommitted suffix; uncertain writes fence every group sharing the engine.

The caller must validate and durably store the application snapshot before installing its descriptor. This storage API does not supply payload packs, remote snapshot installation, physical reclamation or Lance publication. The replication Node does not invoke it yet.

Refs #378.

Testing

• 33 focused Rust tests passed, including real child-process SIGKILL, invalid/corrupt checkpoint recovery and injected sync failure; optional-feature Clippy passed.
• Workspace formatting, Clippy and 605 Rust tests passed. Python: 229 passed, 2 optional skips, 1 existing xfail, with the public HTTP server built and CI mode enabled; Ruff and Pyright passed.
• Spelling and workspace packaging checks passed. The initial local helper stopped because the new environment lacked test extras; after installing the declared extras, its remaining Python checks passed on unchanged source.

These tests establish retained-storage process recovery, not power-loss durability or throughput.