Nockchain evidence

Source-level PMA durability

Nockchain PMA Source Trace

Rust source anchors for PMA metadata trailers, dynamic growth recovery, verified snapshots, SQLite event-log replay, and the receipt-safe fields Nocksperimental can publish without redistributing raw state.

Commit
33ba97b1e206
Anchors
6
Flow Steps
5
Crates
nockvm, nockapp

Durability Flow

metadata-trailer-read

Read PMA metadata trailer

PMA trailer data proves pmaMetadataVersion, data words, alloc words, and file byte length.

sourceAnchorIds

pma-metadata-trailer

receiptFields

pmaMetadataVersion, pmaDataWords, pmaAllocWords

journal-recovery

Recover interrupted growth or migration

PMA open can recover from growth and migration journals before the file is mapped for use.

sourceAnchorIds

pma-open-growth-recovery

receiptFields

pmaReservedWords, pmaGrowthJournalRecovered, pmaMigrationJournalRecovered

source-pma-sync

Sync source PMA before snapshot

create_ready_snapshot calls pma.sync_used_data, pma.sync_trailer, and snapshot_source_pma_fdatasync.

sourceAnchorIds

snapshot-create-ready

receiptFields

snapshotKind, snapshotEventNum, eventBoundary

snapshot-copy-verify

Copy and verify snapshot

The snapshot copy is replaced atomically, hashed by used prefix, written to a manifest, and checked by verify_snapshot before trust.

sourceAnchorIds

snapshot-create-ready, snapshot-verify-ready

receiptFields

snapshotManifestPath, snapshotUsedBlake3, snapshotVerifyMode

event-log-replay

Replay events after boundary

EventLog::replay_events_after returns contiguous jobs after the snapshot event boundary and rejects event sequence gaps.

sourceAnchorIds

event-log-replay-boundary, kernel-event-log-restore

receiptFields

eventLogMaxEventNum, eventReplayStart, eventReplayGapDetected

Snapshot Verification

A snapshot is receipt-worthy only after manifest, PMA metadata, used-prefix hash, root/cold-offset checks, and ready snapshot event-log metadata agree.

manifest-pma-words-match
manifest-alloc-words-match
used-blake3-prefix-match
kernel-root-raw-valid
cold-offset-valid
event-log-ready-snapshot-record
symbol

Pma::read_file_metadata

symbol

Pma::open_with_min

symbol

verify_snapshot

symbol

create_ready_snapshot

symbol

EventLog::replay_events_after

symbol

snapshot_source_pma_fdatasync

Source Anchors

pma-metadata-trailer

file

crates/nockvm/rust/nockvm/src/pma.rs

symbols

Pma, Pma::read_file_metadata, read_file_metadata_from_reader, metadata_from_v2_trailer, metadata_from_legacy_trailer

lineRange

418-583

Reads and validates PMA file metadata from the v2 or legacy trailer before any snapshot or state artifact can be trusted.

The reader rejects too-small files, mismatched data_words, bad PMA magic, unsupported versions, and alloc offsets that exceed data words.

pma-open-growth-recovery

file

crates/nockvm/rust/nockvm/src/pma.rs

symbols

Pma::open, Pma::open_with_min, open_with_min_inner, recover_metadata_from_growth_journal, recover_metadata_from_migration_journal

lineRange

585-760

Opens an existing PMA without shrinking it, preserves or raises its virtual reservation, migrates legacy metadata, and recovers from growth or migration journals.

Open preserves existing reservations, refuses invalid metadata, migrates v1 trailers, and clears growth/migration journals after successful open.

snapshot-verify-ready

file

crates/nockapp/src/snapshot.rs

symbols

verify_snapshot, SnapshotManifest::read_from_path, Pma::read_file_metadata, PmaDirectReader::from_path

lineRange

291-417

Verifies snapshot manifests against PMA metadata, used-prefix hash, kernel root, cold offset, and optional full structure checks.

Verification fails on pma_words mismatch, alloc_words mismatch, used_blake3 mismatch, invalid kernel root, invalid cold offset, or structure validation failure.

snapshot-create-ready

file

crates/nockapp/src/snapshot.rs

symbols

create_ready_snapshot, pma.sync_used_data, pma.sync_trailer, snapshot_source_pma_fdatasync, event_log.insert_ready_snapshot

lineRange

540-637

Creates a ready snapshot by syncing the source PMA, copying it through a temporary path, hashing the used prefix, writing the manifest, verifying it, and inserting the ready snapshot record.

The source PMA is fdatasynced before copy, the copied snapshot is verified before trust, and the event log records the active ready snapshot metadata.

event-log-replay-boundary

file

crates/nockapp/src/event_log.rs

symbols

EventLog::open, append_event, quick_check, insert_ready_snapshot, replay_events_after

lineRange

261-414

Persists accepted events in SQLite, records ready snapshots, and replays only contiguous event numbers after a snapshot boundary.

Replay detects sequence gaps, quick_check validates SQLite health, and ready snapshots carry event_num, alloc_words, kernel_root_raw, cold_offset, and used_blake3.

kernel-event-log-restore

file

crates/nockapp/src/kernel/form.rs

symbols

SerfThread::new_with_event_log, EventLog::open, PmaPersistMetadata::new, replay_event_jobs

lineRange

780-1085

Wires restored snapshot metadata and event-log replay into kernel startup so a hot state can resume from a verified boundary.

Snapshot manifest metadata is synthesized into PMA metadata, EventLog opens before Serf startup, and replay jobs are sent through the Serf replay action.

Event Log Contract

Nocksperimental should record event-log identity and replay boundary metadata, but never store the raw SQLite database or sidecars.

sqliteFile

event-log.sqlite3

sqliteFile

event-log.sqlite3-wal

sqliteFile

event-log.sqlite3-shm

replayGuard

contiguous-event-num-sequence

replayGuard

sqlite-pragma-quick-check

replayGuard

active-snapshot-id-meta

Receipt Contract

pmaMetadataVersion
pmaDataWords
pmaAllocWords
pmaReservedWords
snapshotManifestPath
snapshotUsedBlake3
eventLogMaxEventNum
eventBoundary
stateJamFingerprint
nockchainCommit
nockchainBuild
highlightedField

pmaMetadataVersion

highlightedField

snapshotUsedBlake3

highlightedField

eventLogMaxEventNum

Operator Guards

stop-node-before-copying-state
record-producing-build-and-event-boundary
never-publish-raw-pma-or-event-log
verify-snapshot-before-trusting-state-jam
forbiddenField

rawPmaSlab

forbiddenField

rawSnapshotPma

forbiddenField

rawEventLogSqlite

forbiddenField

rawStateJam

forbiddenField

walletSeedPhrase

highlightedForbidden

rawPmaSlab

highlightedForbidden

rawEventLogSqlite