Nockchain Runtime Safety Trace

nockstack-frame-bounds

Classifies whether a pointer belongs to the current NockStack frame before preserving or copying runtime structures.

The check rejects null pointers, debug-asserts arena bounds, derives the pointer word offset, and compares it with the current and previous frame offsets.

nockstack-frame-lifecycle

Pushes and pops frame metadata while preserving returned nouns into the previous frame.

Frame push bounds-checks the requested words, saves previous frame/stack/alloc pointers, and frame_pop refuses null saved pointers before restoring offsets.

interpreter-stack-frame-preserve

Wraps jet work in a stack frame and preserves return value plus cache/cold/warm nouns before popping.

The interpreter pushes a frame, runs the closure, preserves runtime state into the stack, then pops the frame.

cue-stack-deserialization

Deserializes jam/cue data through an explicit stack of destination pointers and backreference entries.

Cue uses stack.with_frame, a HAMT backreference map, next-bit tag dispatch, and deterministic failure when a backreference cannot resolve.

rub-backref-bounds

Bounds the atom and backreference decoding path that malformed jam/cue payloads exercise.

Atom decode uses get_size and bounded bit slices; backrefs over 64 bits return a nondeterministic failure instead of producing an unchecked offset.

jam-traversal-bounds

Serializes nouns with an iterative traversal, backreference map, and retry-on-growth atom buffer.

Jam pushes nouns onto the NockStack instead of recursing, doubles output atoms when needed, and preserves the normalized result before popping the frame.

noun-space-provenance

Separates stack, PMA pointer, and PMA offset nouns while giving handles a scope tied to a specific NounSpace.

NounSpace records stack/PMA arenas, stack epoch snapshots, PMA bounds, and a branded handle API that prevents handles from escaping the intended scope.

hamt-fixed-depth-preserve

Preserves HAMT structures with a fixed-depth traversal stack matching the bounded key layout.

HAMT preserve copies in-frame stems/leaves into the previous frame and uses fixed arrays sized for maximum depth rather than unbounded recursion.

pma-direct-reader-bounds

Reads PMA words and noun structures directly from disk while enforcing alloc-word and indirect-atom bounds.

read_u64 rejects offsets past alloc_words, read_cell rejects cells that would cross the limit, and indirect_atom_words rejects forwarding pointers, zero-length atoms, overflow, and end offsets past alloc_words.