SweepGuard

What a Checkpointer.sweep must not take from a thread, asked once per page before the page changes: for each thread of threads that something outside the store still depends on, the RunIds whose newest checkpoint on that thread must be kept. A thread in the answer - with an empty set or not - keeps its tombstone; for each RunId in its set, the newest checkpoint that run committed is kept, whatever the retention policy, while everything else of the thread is pruned as usual (Stage 5, rule 4: a run queue's open entry names the thread and each attempt's RunId, and the newest checkpoint of each is the evidence that the entry's input was admitted). A thread missing from the answer has nothing protected.

A Left ends the sweep's call with that error, changing nothing of the page. The guard is called outside the store's transactions and locks, so it may read another store, such as a run queue in the same database; it is called with at most SweepPolicy.batchSize threads.