Durability

You choose how much a crash can lose. Redis RDB and AOF files are not readable. The formats are Ruvio's own: WAL magic RUVWAL01, snapshot magic RUVSNP01.

Profiles

Profile	What a crash can lose
`memory`	The whole dataset. This is the default. No WAL.
`snapshot`	Writes since the last completed checkpoint.
`everysec`	About one sync interval. The client is acknowledged after the append, and the file is synced on `sync_interval_ms` (default 1000).
`always`	The record is synced before it is applied and before the reply.

Validate, record, apply, reply

If the log cannot accept the record, the in-memory value stays as it was. Further mutations on that shard return MISCONF. WAL-backed profiles take an exclusive lock on <data_dir>/LOCK before they listen.

On disk

LOCK — one owner of the directory.
CURRENT — the published checkpoint generation.
CLOCK — the last-seen clock floor.
checkpoints/<generation>/ — shard snapshots and a manifest. Digests are BLAKE3.
wal/shard-NNNN/ — per-shard segments. Records carry CRC32C.

ruvio-ctl check and inspect read those files without taking LOCK and without truncating a torn tail. ruvio-ctl backup locks the source and copies CURRENT, CLOCK, checkpoints/, and wal/. restore refuses a destination that already has those files unless --force is set.

Checkpoints

SAVE and BGSAVE publish a checkpoint on the shard worker, write CLOCK, then delete WAL segments covered by that checkpoint. BGSAVE does not fork. It does the same in-process work and replies Background saving started after the work completes.

snapshot_interval_ms schedules a checkpoint after that interval when at least snapshot_min_mutations mutating commands have run. 0 mutations means any mutation. snapshot_interval_ms = 0 disables the scheduler. SAVE still works. Recovery uses max(CLOCK, checkpoint.created_at) so TTLs do not look expired if the wall clock moves backwards.

Hot keys in the checkpoint

A matching hot_keys glob is a process-wide string, not a shard key. SAVE writes that partition into the same checkpoint (shard id equals the shard count). Recovery loads it. Enable the prefix on empty data. Existing shard keys are not migrated.