HRBSFA01 q& *BlindCellAtomicCommittedPutSpendSnapshotV1�3*BlindCellAtomicCommittedPutSpendSnapshotV1��BlindCellAtomicCommittedPutSpendSnapshotV1 {
version: u8 = 1
transactionId: 32 nonzero bytes
spendTag: 32 nonzero bytes
requestCommitment: 32 nonzero bytes
requestFingerprint: 32 nonzero bytes
storageSlot: 32 nonzero bytes
allocationEpoch: u32
sizeClass: u8[1..5]
leaseClass: u8[1..4]
declaredBlobHash: 32 nonzero bytes
createPublicKey: 32 nonzero bytes
renewPublicKey: 32 nonzero bytes
dropPublicKey: 32 nonzero bytes
allocationCommitment: 32 nonzero bytes
profileId: u16[1..65535]
preparedAdmissionBytes:bounded canonical BlindPreparedAdmissionStoreV1 bytes[1..17408]
resultBindingBytes: canonical profile-1 result-binding bytes[1..1024]
declaredBytes: u32
resultIdentity: 32 nonzero bytes
committedEpoch: u32
resultCell: BlindCellHistoricalResultSnapshotV1
} #BlindCellHistoricalResultSnapshotV1 BlindPreparedAdmissionStoreV1 &BlindCellChargedReadPinEntrySnapshotV1��&BlindCellChargedReadPinEntrySnapshotV1��BlindCellChargedReadPinEntrySnapshotV1 {
storageSlot: 32 nonzero bytes
present: u8[0..1]
sizeClass: u8[0..5]
allocationEpoch: u32
leaseClass: u8[0..4]
leaseEpoch: u32
stateRevision: u64
policyRevision: u64
cellBlobHash: 32 bytes
allocationCommitment: 32 bytes
// absent entries require the exact all-zero state after storageSlot
} #BlindCellChargedReadRetrySnapshotV1��#BlindCellChargedReadRetrySnapshotV1�@BlindCellChargedReadRetrySnapshotV1 {
version: u8 = 1
lifecycleState: u8[1..3] // 1 pinned, 2 finalized, 3 expired
operationId: u8 in {2 GET,5 PROVE,6 BATCH_GET}
transactionId: 32 nonzero bytes
spendTag: 32 nonzero bytes
requestCommitment: 32 nonzero bytes
requestFingerprint: 32 nonzero bytes
preparedAdmissionBytes:optional bounded canonical BlindPreparedAdmissionStoreV1 bytes[1..17408]
resultBindingBytes: optional canonical profile-1 result-binding bytes[1..1024]
receiptEpoch: optional u32
retryExpiresUnixMillis:u64 nonzero
entries: optional array[1..64] of BlindCellChargedReadPinEntrySnapshotV1
resultCommitment: optional 32 nonzero bytes
committedEpoch: u32
terminalEpoch: optional u32
} &BlindCellChargedReadPinEntrySnapshotV1 BlindPreparedAdmissionStoreV1 $BlindCellCommittedPutSpendSnapshotV1��$BlindCellCommittedPutSpendSnapshotV1�&BlindCellCommittedPutSpendSnapshotV1 {
version: u8 = 1
transactionId: 32 nonzero bytes
spendTag: 32 nonzero bytes
requestCommitment: 32 nonzero bytes
requestFingerprint: 32 nonzero bytes
storageSlot: 32 nonzero bytes
allocationEpoch: u32
sizeClass: u8[1..5]
leaseClass: u8[1..4]
declaredBlobHash: 32 nonzero bytes
createPublicKey: 32 nonzero bytes
renewPublicKey: 32 nonzero bytes
dropPublicKey: 32 nonzero bytes
allocationCommitment: 32 nonzero bytes
profileId: u16[1..65535]
preparedAdmissionBytes:bounded canonical BlindPreparedAdmissionStoreV1 bytes[1..17408]
resultBindingBytes: optional canonical profile-1 result-binding bytes[1..1024]
declaredBytes: u32
deadlineUnixMillis: u64 nonzero
remainingAttempts: u8[0..1]
reservedEpoch: u32
resultIdentity: 32 nonzero bytes
committedEpoch: u32
resultCell: BlindCellHistoricalResultSnapshotV1
} #BlindCellHistoricalResultSnapshotV1 BlindPreparedAdmissionStoreV1 &BlindCellCommittedRenewSpendSnapshotV1�@&BlindCellCommittedRenewSpendSnapshotV1��BlindCellCommittedRenewSpendSnapshotV1 {
version: u8 = 1
transactionId: 32 nonzero bytes
spendTag: 32 nonzero bytes
requestCommitment: 32 nonzero bytes
requestFingerprint: 32 nonzero bytes
storageSlot: 32 nonzero bytes
expectedStateRevision: u64
expectedLeaseEpoch: u32
requestedLeaseClass: u8[1..4]
profileId: u16[1..65535]
preparedAdmissionBytes:bounded canonical BlindPreparedAdmissionStoreV1 bytes[1..17408]
resultBindingBytes: optional canonical profile-1 result-binding bytes[1..1024]
resultIdentity: 32 nonzero bytes
committedEpoch: u32
resultCell: BlindCellHistoricalResultSnapshotV1
} #BlindCellHistoricalResultSnapshotV1 BlindPreparedAdmissionStoreV1 BlindCellControlGlobalSnapshotV1�� BlindCellControlGlobalSnapshotV1��BlindCellControlGlobalSnapshotV1 {
version: u8 = 1
epochFloor: u32
clockUnsafe: u8[0..1]
recoveryGap: u8[0..1]
storedBytes: u64
stagingBytes: u64
controlBytes: u64
tombstoneBytes: u64
reservedCells: u64
cellCount: u64
spendCount: u64
commitmentCount: u64
requestResultCount: u64
chargedReadPinnedCount:u64
chargedReadFinalizedCount:u64
chargedReadExpiredCount:u64
chargedReadPinnedEntryCount:u64
profileStagingCount: u32
integrityEvidenceCount:u32
controlRecordAccountingBytes:u16 = 512
tombstoneRecordAccountingBytes:u16 = 512
} #BlindCellHistoricalResultSnapshotV1��#BlindCellHistoricalResultSnapshotV1��BlindCellHistoricalResultSnapshotV1 {
storageSlot: 32 nonzero bytes
allocationEpoch: u32
sizeClass: u8[1..5]
leaseClass: u8[1..4]
leaseEpoch: u32
stateRevision: u64
policyRevision: u64
cellBlobHash: 32 nonzero bytes
allocationCommitment: 32 nonzero bytes
objectState: u8[1..2]
policyState: u8[1..2]
} $BlindCellIntegrityEvidenceSnapshotV1�$BlindCellIntegrityEvidenceSnapshotV1�BlindCellIntegrityEvidenceSnapshotV1 {
version: u8 = 1
reason: u8[1..3]
detectedEpoch: u32
evidenceHash: 32 nonzero bytes
} !BlindCellProfileStagingSnapshotV1�!BlindCellProfileStagingSnapshotV1�BlindCellProfileStagingSnapshotV1 {
version: u8 = 1
profileId: u16[1..65535]
stagingBytes: u64 nonzero
}
BlindCellRecordSnapshotV1��BlindCellRecordSnapshotV1�`BlindCellRecordSnapshotV1 {
version: u8 = 1
storageSlot: 32 nonzero bytes
allocationEpoch: u32
allocationLeaseClass: u8[1..4]
sizeClass: u8[1..5]
leaseClass: u8[1..4]
leaseEpoch: u32
stateRevision: u64
policyRevision: u64
cellBlobHash: 32 nonzero bytes
blobVirtualBucket: u16
blobObjectId: 32 nonzero bytes
createPublicKey: 32 nonzero bytes
renewPublicKey: 32 nonzero bytes
dropPublicKey: 32 nonzero bytes
allocationCommitment: 32 nonzero bytes
objectState: u8[1..2]
policyState: u8[1..2]
tombstoneReason: optional u8[1..2]
terminalEpoch: optional u32
createSpendTag: 32 nonzero bytes
resultIdentity: 32 nonzero bytes
createdEpoch: u32
} BlindCellRequestResultSnapshotV1� BlindCellRequestResultSnapshotV1��BlindCellRequestResultSnapshotV1 {
version: u8 = 1
transactionId: 32 nonzero bytes
requestCommitment: 32 nonzero bytes
requestFingerprint: 32 nonzero bytes
storageSlot: 32 nonzero bytes
resultBindingBytes: optional canonical profile-1 result-binding bytes[1..1024]
resultIdentity: 32 nonzero bytes
committedEpoch: u32
resultCell: BlindCellHistoricalResultSnapshotV1
} #BlindCellHistoricalResultSnapshotV1 BlindCellReservedSpendSnapshotV1�� BlindCellReservedSpendSnapshotV1��BlindCellReservedSpendSnapshotV1 {
version: u8 = 1
transactionId: 32 nonzero bytes
spendTag: 32 nonzero bytes
requestCommitment: 32 nonzero bytes
requestFingerprint: 32 nonzero bytes
storageSlot: 32 nonzero bytes
allocationEpoch: u32
sizeClass: u8[1..5]
leaseClass: u8[1..4]
declaredBlobHash: 32 nonzero bytes
createPublicKey: 32 nonzero bytes
renewPublicKey: 32 nonzero bytes
dropPublicKey: 32 nonzero bytes
allocationCommitment: 32 nonzero bytes
profileId: u16[1..65535]
preparedAdmissionBytes:bounded canonical BlindPreparedAdmissionStoreV1 bytes[1..17408]
resultBindingBytes: optional canonical profile-1 result-binding bytes[1..1024]
declaredBytes: u32
deadlineUnixMillis: u64 nonzero
remainingAttempts: u8[0..2]
reservedEpoch: u32
} BlindPreparedAdmissionStoreV1
BlindCellTerminalSpendSnapshotV1�# BlindCellTerminalSpendSnapshotV1��BlindCellTerminalSpendSnapshotV1 {
version: u8 = 1
transactionId: 32 nonzero bytes
spendTag: 32 nonzero bytes
requestCommitment: 32 nonzero bytes
requestFingerprint: 32 nonzero bytes
storageSlot: 32 nonzero bytes
allocationEpoch: u32
sizeClass: u8[1..5]
leaseClass: u8[1..4]
declaredBlobHash: 32 nonzero bytes
createPublicKey: 32 nonzero bytes
renewPublicKey: 32 nonzero bytes
dropPublicKey: 32 nonzero bytes
allocationCommitment: 32 nonzero bytes
profileId: u16[1..65535]
preparedAdmissionBytes:bounded canonical BlindPreparedAdmissionStoreV1 bytes[1..17408]
resultBindingBytes: optional canonical profile-1 result-binding bytes[1..1024]
declaredBytes: u32
deadlineUnixMillis: u64 nonzero
remainingAttempts: u8[0..2]
reservedEpoch: u32
terminalReason: u8[1..3]
terminalEpoch: u32
} BlindPreparedAdmissionStoreV1 BlindControlStateSnapshotV1�$BlindControlStateSnapshotV1�BlindControlStateSnapshotV1 { // canonical external control snapshot
version: u8 = 1
relayPublicKey: 32 bytes
storeId: 32 bytes
durabilityContinuityHash:32 bytes
walSequence: u64
walHash: 32 bytes
entries: sorted array[0..16777216] of {
entryKind: u8[1..8],
key: bounded bytes[1..256],
value: bounded bytes[0..65535]
}
} BlindCoreControlGlobalSnapshotV1�� BlindCoreControlGlobalSnapshotV1��BlindCoreControlGlobalSnapshotV1 {
version: u8 = 1
epochFloor: u32
clockUnsafe: u8[0..1]
recordCount: u64
reservedCount: u64
liveCount: u64
terminalCount: u64
spendIndexCount: u64
logicalIndexCount: u64
channelIndexCount: u64
resultCount: u64
snapshotRecordBytes: u64
} 'BlindCoreOpenReplicationRetrySnapshotV1�'BlindCoreOpenReplicationRetrySnapshotV1��BlindCoreOpenReplicationRetrySnapshotV1 {
version: u8 = 1
lifecycleState: u8[1..3] // 1 RESERVED, 2 LIVE, 3 TERMINAL
logicalRetryKey: 32 nonzero bytes
spendTag: bounded bytes[1..128], nonzero
requestCommitment: 32 nonzero bytes
wireProfileHash: 32 nonzero bytes
sessionClass: u8[1..3]
clientNonce: 32 bytes
parentSessionId: bounded bytes[1..256], nonzero
controlChannelId: u64 nonzero
parentChannelBinding: 32 nonzero bytes
streamId: u64 nonzero
maxSessionBytes: u64 // exact session-class tuple
idleMillis: u32 // exact session-class tuple
lifetimeMillis: u32 // exact session-class tuple
openedAtEpoch: u32
recordVirtualBucket: u16 // virtualBucketDerivationV1(CORE, logicalRetryKey)
resultBytes: optional canonical signed open-result bytes[1..16384]
terminalReason: optional canonical printable ASCII bytes[1..64]
} BlindExternalAckFloorV1��BlindExternalAckFloorV1��BlindExternalAckFloorV1 { // external control-journal witness, not client wire
version: u8 = 1
relayPublicKey: 32 bytes
storeId: 32 bytes
externalJournalId: 32 random nonzero bytes
durabilityContinuityHash:32 bytes
floorRevision: u64
previousFloorHash: optional 32 bytes
writerEpoch: u64
writerFenceTokenHash: 32 bytes
externalLeaseRevision: u64
walSequence: u64
walHash: 32 bytes
descriptorSequence: u64
descriptorHash: 32 bytes
witnessedUnixMillis: u64
witnessPublicKey: 32-byte Ed25519 public key
signature: 64-byte Ed25519 signature
} BlindExternalControlCheckpointV1�r BlindExternalControlCheckpointV1�JBlindExternalControlCheckpointV1 { // witness-signed prune/restore anchor
version: u8 = 1
relayPublicKey: 32 bytes
storeId: 32 bytes
externalJournalId: 32 random nonzero bytes
durabilityContinuityHash:32 bytes
checkpointRevision: u64
previousCheckpointHash:optional 32 bytes
baseFloorRevision: u64
baseFloorHash: 32 bytes
writerEpoch: u64
writerFenceTokenHash: 32 bytes
externalLeaseRevision: u64
walSequence: u64
walHash: 32 bytes
descriptorSequence: u64
descriptorHash: 32 bytes
snapshotByteLength: u64
snapshotHash: 32 bytes
oldestRetainedFloorRevision:u64
createdUnixMillis: u64
witnessPublicKey: 32-byte Ed25519 public key
signature: 64-byte Ed25519 signature
} "BlindInboxCommittedSpendSnapshotV1��"BlindInboxCommittedSpendSnapshotV1��BlindInboxCommittedSpendSnapshotV1 {
// committed charged-operation fields; remainingAttempts is 0..1
version: u8 = 1
transactionId: 32 nonzero bytes
spendTag: 32 nonzero bytes
requestCommitment: 32 nonzero bytes
requestFingerprint: 32 nonzero bytes
physicalTopic: 32 nonzero bytes
operation: u8 in {1,2,4,5,6}
profileId: u16[1..65535]
frameClass: u8[0..3]
frameHash: optional 32 nonzero bytes
requestedLeaseClass: u8[0..4]
declaredBytes: u32
deadlineUnixMillis: u64 nonzero
remainingAttempts: u8[0..1]
reservedEpoch: u32
resultIdentity: 32 nonzero bytes
resultRevision: u64
committedEpoch: u32
resultLeaseClass: optional u8[1..4] // present exactly for CREATE/RENEW
resultLeaseEpoch: optional u32 // present exactly for CREATE/RENEW
resultBindingBytes: canonical profile-1 result-binding bytes[1..1024]
clientNonce: 32 nonzero bytes
retentionClassAtAppend:optional u8[1..4] // present exactly for APPEND
appendLeaseEpoch: optional u32 // present exactly for APPEND
expiresAtEpoch: optional u32 // present exactly for APPEND
ackSignature: optional 64 nonzero bytes // finalized APPEND ACK
resultCommitment: optional 32 nonzero bytes // present for APPEND/READ/WATCH
retryState: u8[0..3] // zero exactly outside READ/WATCH
} !BlindInboxControlGlobalSnapshotV1�#!BlindInboxControlGlobalSnapshotV1��BlindInboxControlGlobalSnapshotV1 {
version: u8 = 1
epochFloor: u32
clockUnsafe: u8[0..1]
recoveryGap: u8[0..1]
storedFrameBytes: u64
stagingFrameBytes: u64
controlBytes: u64
tombstoneBytes: u64
frameIndexBytes: u64
reservedFrames: u64
inboxCount: u64
frameCount: u64
spendCount: u64
commitmentCount: u64
requestResultCount: u64
retryRecordCount: u64
retryFramePinCount: u64
profileStagingCount: u32
integrityEvidenceCount:u32
controlRecordAccountingBytes:u16 = 512
tombstoneRecordAccountingBytes:u16 = 512
frameIndexAccountingBytes:u16 = 256
retryRecordAccountingBytes:u16 = 256
} &BlindInboxExpiredAppendSpendSnapshotV1�&BlindInboxExpiredAppendSpendSnapshotV1��BlindInboxExpiredAppendSpendSnapshotV1 {
version: u8 = 1
transactionId: 32 nonzero bytes
spendTag: 32 nonzero bytes
requestCommitment: 32 nonzero bytes
requestFingerprint: 32 nonzero bytes
physicalTopic: 32 nonzero bytes
profileId: u16[1..65535]
frameClass: u8[1..3]
frameHash: 32 nonzero bytes
declaredBytes: u32 // exact frame-class bytes
deadlineUnixMillis: u64 nonzero
remainingAttempts: u8[0..1]
reservedEpoch: u32
resultIdentity: 32 nonzero bytes
appendRevision: u64 nonzero
storedAtEpoch: u32
retentionClassAtAppend:u8[1..4]
appendLeaseEpoch: u32
expiresAtEpoch: u32
expiredEpoch: u32
clientNonce: 32 nonzero bytes
resultBindingBytes: canonical profile-1 result-binding bytes[1..1024]
ackSignature: 64 nonzero bytes
resultCommitment: 32 nonzero bytes
} BlindInboxFrameSnapshotV1�BlindInboxFrameSnapshotV1��BlindInboxFrameSnapshotV1 {
version: u8 = 1
physicalTopic: 32 nonzero bytes
appendRevision: u64 nonzero
frameHash: 32 nonzero bytes
frameClass: u8[1..3]
frameVirtualBucket: u16
frameObjectId: 32 nonzero bytes
appendLeaseEpoch: u32
storedAtEpoch: u32
expiresAtEpoch: u32
spendTag: 32 nonzero bytes
requestCommitment: 32 nonzero bytes
resultIdentity: 32 nonzero bytes
} %BlindInboxIntegrityEvidenceSnapshotV1�%BlindInboxIntegrityEvidenceSnapshotV1�BlindInboxIntegrityEvidenceSnapshotV1 {
version: u8 = 1
reason: u8[1..3]
detectedEpoch: u32
evidenceHash: 32 nonzero bytes
} "BlindInboxProfileStagingSnapshotV1�"BlindInboxProfileStagingSnapshotV1�BlindInboxProfileStagingSnapshotV1 {
version: u8 = 1
profileId: u16[1..65535]
stagingFrameBytes: u64 nonzero
} BlindInboxRecordSnapshotV1��BlindInboxRecordSnapshotV1��BlindInboxRecordSnapshotV1 {
version: u8 = 1
physicalTopic: 32 nonzero bytes
metadataVirtualBucket: u16
allocationEpoch: u32
allocationLeaseClass: u8[1..4]
frameClassBits: u8[1..7]
appendAuthMode: u8[0..1]
appendPublicKey: optional 32 nonzero bytes
createPublicKey: 32 nonzero bytes
renewPublicKey: 32 nonzero bytes
closePublicKey: 32 nonzero bytes
retentionClass: u8[1..4]
leaseClass: u8[1..4]
leaseEpoch: u32
stateRevision: u64
policyRevision: u64
appendRevision: u64
createCommitment: 32 nonzero bytes
objectState: u8[1..2]
policyState: u8[1..2]
tombstoneReason: optional u8[1..2]
terminalEpoch: optional u32
createSpendTag: 32 nonzero bytes
createRequestCommitment:32 nonzero bytes
resultIdentity: 32 nonzero bytes
createdEpoch: u32
} !BlindInboxRequestResultSnapshotV1�
!BlindInboxRequestResultSnapshotV1��BlindInboxRequestResultSnapshotV1 {
version: u8 = 1
transactionId: 32 nonzero bytes
requestCommitment: 32 nonzero bytes
physicalTopic: 32 nonzero bytes
resultIdentity: 32 nonzero bytes
resultRevision: u64 nonzero
committedEpoch: u32
resultBindingBytes: canonical profile-1 result-binding bytes[1..1024]
clientNonce: 32 nonzero bytes
resultLeaseClass: u8 = 0
resultLeaseEpoch: u32
} !BlindInboxReservedSpendSnapshotV1�?!BlindInboxReservedSpendSnapshotV1�BlindInboxReservedSpendSnapshotV1 {
version: u8 = 1
transactionId: 32 nonzero bytes
spendTag: 32 nonzero bytes
requestCommitment: 32 nonzero bytes
requestFingerprint: 32 nonzero bytes
physicalTopic: 32 nonzero bytes
operation: u8 in {1 CREATE,2 RENEW,4 APPEND,5 READ,6 WATCH}
profileId: u16[1..65535]
frameClass: u8[0..3] // nonzero exactly for APPEND
frameHash: optional 32 nonzero bytes // present exactly for APPEND
requestedLeaseClass: u8[0..4] // nonzero exactly for CREATE/RENEW
declaredBytes: u32 // exact frame-class bytes for APPEND, otherwise zero
deadlineUnixMillis: u64 nonzero
remainingAttempts: u8[0..2]
reservedEpoch: u32
} !BlindInboxRetryFramePinSnapshotV1�!BlindInboxRetryFramePinSnapshotV1�BlindInboxRetryFramePinSnapshotV1 {
version: u8 = 1
spendTag: 32 nonzero bytes
physicalTopic: 32 nonzero bytes
appendRevision: u64 nonzero
frameHash: 32 nonzero bytes
} !BlindInboxRetryMaterialSnapshotV1�!BlindInboxRetryMaterialSnapshotV1�BlindInboxRetryMaterialSnapshotV1 {
version: u8 = 1
spendTag: 32 nonzero bytes
entriesCommitment: 32 nonzero bytes
nextCursor: optional bounded bytes[1..128]
} BlindInboxRetryReconstructionV1�� BlindInboxRetryReconstructionV1�[BlindInboxRetryReconstructionV1 { // exactly 50 bytes; fits the generic 256-byte retry-record cap
version: u8 = 1
firstAppendRevision: u64 // zero exactly for an empty page
lastAppendRevision: u64 // zero exactly for an empty page
entryCount: u8[0..64]
nextCursorHash: 32 bytes // zero means absent
} !BlindInboxTerminalSpendSnapshotV1��!BlindInboxTerminalSpendSnapshotV1��BlindInboxTerminalSpendSnapshotV1 {
// terminal charged-operation fields
version: u8 = 1
transactionId: 32 nonzero bytes
spendTag: 32 nonzero bytes
requestCommitment: 32 nonzero bytes
requestFingerprint: 32 nonzero bytes
physicalTopic: 32 nonzero bytes
operation: u8 in {1,2,4,5,6}
profileId: u16[1..65535]
frameClass: u8[0..3]
frameHash: optional 32 nonzero bytes
requestedLeaseClass: u8[0..4]
declaredBytes: u32
deadlineUnixMillis: u64 nonzero
remainingAttempts: u8[0..2]
reservedEpoch: u32
terminalReason: u8[1..3]
terminalEpoch: u32
} BlindLocalCheckpointV1�BlindLocalCheckpointV1��BlindLocalCheckpointV1 { // canonical header; snapshot bytes are a separate hashed file
magic: exact ASCII "HRBCKP01"
checkpointVersion: u16 = 1
relayPublicKey: 32 bytes
storeId: 32 random nonzero bytes
durabilityProfileId: u8
durabilityContinuityHash:32 bytes
durabilityProfileHash: 32 bytes
formatMajor: u16
formatMinor: u16
storeFormatHash: 32 bytes
specHash: 32 bytes
abiHash: 32 bytes
mapGeneration: u64 nonzero
bucketMapHash: 32 bytes
writerEpoch: u64 nonzero
writerFenceTokenHash: 32 bytes
checkpointRevision: u64 nonzero
previousCheckpointHash:optional 32 bytes // absent exactly at revision 1
coveredWalSequence: u64 nonzero
coveredWalHash: 32 bytes
epochFloor: u32
descriptorSequenceFloor:u64
descriptorHashFloor: 32 bytes
snapshotByteLength: u64 nonzero
snapshotHash: 32 bytes
} ! BlindPreparedAdmissionStoreV1�� BlindPreparedAdmissionStoreV1��BlindPreparedAdmissionStoreV1 { // INTERNAL_STORE; admission-sensitive at rest
version: u8 = 1
spendTag: 32 nonzero bytes
requestCommitment: 32 nonzero bytes
profileId: u16[1..65535]
schemeId: u16[1..65535]
parameterHash: 32 nonzero bytes
resourceClass: u16
leaseClass: u8
costUnits: u64
walCommitRecord: bounded bytes[1..16384]
} " BlindPutAtomicCommittedStoreV1�K BlindPutAtomicCommittedStoreV1�BlindPutAtomicCommittedStoreV1 { // INTERNAL_STORE; Cell WAL recordType 17 payload
version: u8 = 1
spendTag: 32 nonzero bytes
requestCommitment: 32 nonzero bytes
requestFingerprint: 32 nonzero bytes
storageSlot: 32 nonzero bytes
allocationEpoch: u32
sizeClass: u8[1..5]
leaseClass: u8[1..4]
declaredBlobHash: 32 nonzero bytes
createPublicKey: 32 nonzero bytes
renewPublicKey: 32 nonzero bytes
dropPublicKey: 32 nonzero bytes
allocationCommitment: 32 nonzero bytes
profileId: u16[1..65535]
preparedAdmissionBytes:bounded canonical BlindPreparedAdmissionStoreV1 bytes[1..17408]
resultBindingBytes: canonical profile-1 result-binding bytes[1..1024]
declaredBytes: u32
blobObjectId: 32 nonzero bytes
leaseEpoch: u32
stateRevision: u64 = 0
policyRevision: u64 = 0
resultIdentity: 32 nonzero bytes
committedEpoch: u32
} BlindPreparedAdmissionStoreV1 #BlindStoreManifestV1�"BlindStoreManifestV1�BlindStoreManifestV1 { // internal, never served to clients
magic: exact ASCII "HRBLIND1"
manifestVersion: u16 = 1
storeId: 32 random nonzero bytes
relayPublicKey: 32 bytes
durabilityProfileId: u8
durabilityContinuityHash:32 bytes
durabilityProfileHash: 32 bytes
formatMajor: u16
formatMinor: u16
storeFormatHash: 32 bytes
specHash: 32 bytes
abiHash: 32 bytes
mapGeneration: u64
bucketMapHash: 32 bytes
checkpointWalSequence: u64
checkpointHash: 32 bytes
epochFloor: u32
writerEpoch: u64
writerFenceTokenHash: 32 bytes
externalLeaseRevision: u64 // zero for durability profile 1
externalJournalId: 32 bytes // zero for profile 1; nonzero for 2
externalWitnessPublicKey:32 bytes // zero for profile 1
restoreEvidenceFeedId: 32 bytes // nonzero only for profile-2 feed-bound/backed
lastAckWalSequence: u64 // zero for profile 1
lastAckWalHash: 32 bytes // zero for profile 1
externalCheckpointRevision:u64 // zero for profile 1
externalCheckpointHash:32 bytes // zero for profile 1
descriptorSequenceFloor:u64
descriptorHashFloor: 32 bytes
migrationState: u8 // 0 stable, 1 prepared, 2 copying, 3 verifying, 4 switching
sourceFormatMajor: u16
targetFormatMajor: u16
migrationCursorHash: 32 bytes
previousManifestHash: optional 32 bytes
manifestRevision: u64
mac: 32 bytes
} $BlindWalHeaderV2�1BlindWalHeaderV2�BlindWalHeaderV2 { // exact 192-byte prefix of each complete WAL frame
0: magic: 4 bytes = ASCII "HRWL"
4: walVersion: u8 = 2
5: recordType: u8[1..255]
6: totalLength: u32 = 224 + payloadLength
10: walSequence: u64[1..2^64-1]
18: transactionId: 32 nonzero bytes
50: virtualBucket: u16
52: mapGeneration: u64[1..2^64-1]
60: writerFenceTokenHash: 32 nonzero bytes
92: payloadLength: u32
96: previousWalHash: 32 bytes
128: durabilityContinuityHash: 32 nonzero bytes
160: payloadHash: 32 bytes = BLAKE2b-256(payload)
192: payload: payloadLength bytes
192 + payloadLength: checksum: 32 bytes
} % CellRecordV1�� CellRecordV1��CellRecordV1 {
version: u8 = 1
slot: 32 bytes pseudorandom/self-certifying
allocationEpoch: u32
sizeClass: u8
leaseClass: u8
leaseEpoch: u32
stateRevision: u64
policyRevision: u64
cellBlobHash: 32 bytes
cellBlob: exact total bytes required by sizeClass
createPublicKey: 32 random bytes
renewPublicKey: 32 random bytes
dropPublicKey: 32 random bytes
allocationCommitment: 32 bytes
} &ChargedUnaryRetryV1��ChargedUnaryRetryV1��ChargedUnaryRetryV1 {
version: u8 = 1
spendTag: 32 bytes
requestCommitment:32 bytes
familyId: u8
operationId: u8
locatorCommitment:32 bytes
sourceRevision: u64
sourceCommitment: 32 bytes
resultCommitment: 32 bytes
reconstruction: bounded canonical bytes[0..96]
retryExpiresMinute:u64 // relay wall-minute deadline, never an app timestamp
retryState: u8 // 1 replayable, 2 visibility-revoked, 3 terminal
} < artifact.encoding magic[8]=ASCII(HRBSFA01) || authorityVersion:u16be=1 || formatMajor:u16be=1 || formatMinor:u16be=2 || schemaCatalogLength:u64be || exact schemaCatalog bytes || entryCount:u16be || sorted entries(nameLength:u16be || printable ASCII name || valueLength:u32be || printable ASCII value) artifact.hash-recipe �storeFormatHash=BLAKE2B256(ASCII(hiverelay.blind.store-format-hash.v1) || U64BE(len(exact complete authority artifact)) || exact complete authority artifact) artifact.schema-catalog-binding �schemaCatalog bytes are the exact complete generated INTERNAL_STORE schema catalog; names, canonical schema bytes, order, length, and every byte are inside the storeFormatHash preimage binding.runtime-root vruntime-binding.v1 is exactly 213 bytes: ASCII(HRBRT001)||relayPublicKey32||storeId32||durabilityContinuityHash32||durabilityProfileId:u8||formatMajor:u16be||formatMinor:u16be||storeFormatHash32||mapGeneration:u64be||writerFenceTokenHash32||HMAC-SHA256(K_store_manifest, every preceding byte); a preexisting byte mismatch or unbound nonempty root fails before store mutation binding.runtime-verification �before store-root binding or engine open, require signed build.storeFormatHash=signed durability.storeFormatHash, verify the exact bundled authority artifact reproduces from its embedded generated INTERNAL_STORE catalog and frozen rules, require its version/format/hash equal the signed durability tuple, and pass only the resulting unforgeable local verifier authority into the storage engine %control-snapshot.cell-authority-scope Cell reconstruction is recovery-only and deterministically rederives every blobVirtualBucket from serviceTag and primaryLocator; it never authorizes checkpoint publication and remains a separately composed fragment from Inbox, Core, descriptor/identity floors, and daemon-global state $control-snapshot.cell-entry-keyspace !sort by (entryKind,key); key=U8(FAMILY.CELL=2)||U8(subtype)||identity; kind1 subtypes 1=committed-put/spendTag32,2=committed-renew/spendTag32,3=terminal-put/spendTag32,4=drop-result/requestCommitment32,5=atomic-committed-put/spendTag32; kind2 subtype1=reserved-put/spendTag32; kind3 subtype1=cell/storageSlot32; kind6 subtype1=global/no identity,2=profile-staging/profileId:u16be,3=integrity/evidenceHash32; kind8 subtype1=charged-read-retry/spendTag32; unknown, duplicate, non-Cell, unsorted, missing-global, or orphan-index entries fail closed $control-snapshot.cell-reconstruction Gdecode every Cell value canonically and reconstruct spends, derived commitment/charged-expiry indexes, request results, cells, epoch/clock/recovery-gap state, integrity evidence, per-profile staging, and exact byte/count accounting; canonically decode prepared admission and historical result bindings, bind profile-1 relay/store continuity, rederive request fingerprints, verify historical result cells against retained authoritative Cell state, and preserve charged GET/PROVE/BATCH pinned/finalized/expired lifecycle, exact source entries, result commitment, 15-minute retry deadline, and control cost; active charged cost is exact READ_PIN_COMMITTED payload bytes plus the fixed finalization record while expired charged spends remain exactly one 512-byte control tombstone; verify self-certifying slots, allocation commitments including immutable allocationLeaseClass, deterministic virtual buckets, floors, state-machine invariants, tombstoneBytes=(cells+reserved)*512, and exact global counts; in-flight reservations are ineligible and active pins are never pruned by snapshot construction "control-snapshot.cell-value-codecs _kind1/subtype1=BlindCellCommittedPutSpendSnapshotV1;1/2=BlindCellCommittedRenewSpendSnapshotV1;1/3=BlindCellTerminalSpendSnapshotV1;1/4=BlindCellRequestResultSnapshotV1;1/5=BlindCellAtomicCommittedPutSpendSnapshotV1;2/1=BlindCellReservedSpendSnapshotV1;3/1=BlindCellRecordSnapshotV1;6/1=BlindCellControlGlobalSnapshotV1;6/2=BlindCellProfileStagingSnapshotV1;6/3=BlindCellIntegrityEvidenceSnapshotV1;8/1=BlindCellChargedReadRetrySnapshotV1 containing BlindCellChargedReadPinEntrySnapshotV1; mutation result records contain BlindCellHistoricalResultSnapshotV1 and canonical BlindPreparedAdmissionStoreV1 bytes %control-snapshot.core-authority-scope rCore reconstruction is recovery-only and covers only the reserved CORE.OPEN_REPLICATION retry/lifecycle codec; it deterministically rederives virtual buckets, never authorizes publication, and explicitly excludes CORE.MIRROR/PROVE body state, upstream child recreation, ticket resurrection, stream-engine restore, descriptor/global composition, and WAL-barrier authority $control-snapshot.core-entry-keyspace ]sort by (entryKind,key); key=U8(FAMILY.CORE=4)||U8(subtype)||identity; kind5 subtype1=open-retry/logicalRetryKey32; kind6 subtype1=global/no identity; the retry value carries lifecycleState 1=RESERVED,2=LIVE,3=TERMINAL; unknown, duplicate, non-Core, unsorted, missing-global, colliding spend/logical/channel/stream, or miscounted entries fail closed $control-snapshot.core-reconstruction �decode every Core value canonically and reconstruct the retained logical, spend, and authenticated parent/control-channel indexes; rederive logicalRetryKey, requestCommitment, deterministic virtual bucket, class limits, canonical result/request tuple, relay/store/durability binding, result signature, opened-at epoch floor, lifecycle/result presence, terminal reason presence, unique stream IDs, exact state/index/result counts, and snapshotRecordBytes "control-snapshot.core-value-codecs kind5/subtype1=BlindCoreOpenReplicationRetrySnapshotV1 keyed by logicalRetryKey32;kind6/subtype1=BlindCoreControlGlobalSnapshotV1; RESERVED/LIVE require a canonical signed CoreOpenReplicationResultV1, while TERMINAL may omit a result only when failure preceded result construction &control-snapshot.inbox-authority-scope uInbox reconstruction is recovery-only and deterministically rederives every metadata/frame virtual bucket from serviceTag and primaryLocator; it proves the complete bounded Inbox control fragment, never authorizes checkpoint publication, and requires separate frame-body availability/hash, WAL-engine restore, Cell/Core/descriptor, and daemon-global composition authorities %control-snapshot.inbox-entry-keyspace hsort by (entryKind,key); key=U8(FAMILY.INBOX=3)||U8(subtype)||identity; kind1 subtypes 1=committed/spendTag32,2=terminal/spendTag32,3=close-result/requestCommitment32,4=expired-append/spendTag32; kind2 subtype1=reserved/spendTag32; kind4 subtype1=inbox/physicalTopic32,2=frame/physicalTopic32||appendRevision:u64be; kind6 subtype1=global/no identity,2=profile-staging/profileId:u16be,3=integrity/evidenceHash32; kind8 subtype1=retry/spendTag32,2=retry-frame-pin/spendTag32||appendRevision:u64be,3=retry-material/spendTag32; unknown, duplicate, non-Inbox, unsorted, missing-global, or orphan-index entries fail closed %control-snapshot.inbox-reconstruction �decode every Inbox value canonically and reconstruct spends, derived commitment index, close results, inboxes, immutable frame references, charged retry records/exact frame pins/exact retry material, epoch/clock/recovery-gap state, integrity evidence, per-profile staging, and byte/count accounting; every committed spend retains canonical resultBindingBytes and clientNonce and binds profile-1 relay/store continuity; CREATE/RENEW retain their exact result lease class and epoch, and CLOSE retains its exact binding, nonce, zero result lease class, and resulting lease epoch; finalized APPEND reconstructs and verifies the exact Ed25519-signed InboxAppendAckV1 and result commitment; live APPEND requires its exact frame, while expired APPEND kind1/subtype4 requires frame absence, preserves self-contained retention/lease/expiry facts plus exact signed ACK authority, and remains one 512-byte anti-replay control record; charged READ/WATCH reconstruct exact entriesCommitment, optional nextCursor, pinned entry identities, result binding, clientNonce, and committed epoch; verify self-certifying topics, immutable allocationLeaseClass/create commitment, deterministic virtual buckets, frame class/retention/lease, cross-record result identities, retry source commitments, floors, state-machine invariants, and exact global counts; provisional/in-flight reservations are ineligible; live frame body bytes remain external and separately verified #control-snapshot.inbox-value-codecs kind1/subtype1=BlindInboxCommittedSpendSnapshotV1;1/2=BlindInboxTerminalSpendSnapshotV1;1/3=BlindInboxRequestResultSnapshotV1;1/4=BlindInboxExpiredAppendSpendSnapshotV1;2/1=BlindInboxReservedSpendSnapshotV1;4/1=BlindInboxRecordSnapshotV1;4/2=BlindInboxFrameSnapshotV1;6/1=BlindInboxControlGlobalSnapshotV1;6/2=BlindInboxProfileStagingSnapshotV1;6/3=BlindInboxIntegrityEvidenceSnapshotV1;8/1=ChargedUnaryRetryV1 with BlindInboxRetryReconstructionV1;8/2=BlindInboxRetryFramePinSnapshotV1;8/3=BlindInboxRetryMaterialSnapshotV1 +control-snapshot.prepared-admission-at-rest �BlindPreparedAdmissionStoreV1 preserves the exact bounded admission walCommitRecord already durably committed by the engine so checkpoint recovery can rederive fingerprints and cannot recharge or substitute authority; it contains no application plaintext or capability private key, but operators MUST treat checkpoint/control files as admission-sensitive at-rest data with the same mode-0600, mode-0700-root, backup-encryption, access-control, and secure-retirement requirements as the WAL hash.checkpoint �BLAKE2B256(ASCII(hiverelay.blind.local-checkpoint-hash.v1) || U64BE(len(canonical BlindLocalCheckpointV1)) || canonical BlindLocalCheckpointV1) hash.control-snapshot �BLAKE2B256(ASCII(hiverelay.blind.control-snapshot.v1) || U64BE(len(canonical BlindControlStateSnapshotV1)) || canonical BlindControlStateSnapshotV1)
hash.manifest �BLAKE2B256(ASCII(hiverelay.blind.store-manifest-hash.v1) || U64BE(len(canonical complete BlindStoreManifestV1)) || canonical complete BlindStoreManifestV1) hash.manifest-mac �keyed-BLAKE2B256(K_store_manifest, ASCII(hiverelay.blind.store-manifest-mac.v1) || U64BE(len(canonical BlindStoreManifestV1 fields before mac)) || canonical BlindStoreManifestV1 fields before mac) hash.wal-checksum gBLAKE2B256(ASCII(hiverelay.blind.wal-frame-checksum.v1) || complete WAL frame bytes [0,totalLength-32)) hash.wal-frame cBLAKE2B256(ASCII(hiverelay.blind.wal-frame-hash.v1) || exact complete WAL frame including checksum) hash.wal-payload BLAKE2B256(exact payload bytes) layout.checkpoint-final control/checkpoint-<hash32>.v1 layout.checkpoint-temp -control/.checkpoint-<hash32>.v1.<nonce16>.tmp layout.control-directory control layout.genesis-intent-final control/genesis-intent.v1 layout.genesis-intent-temp (control/.genesis-intent.v1.<nonce16>.tmp layout.manifest-a-final control/manifest-a.v1 layout.manifest-a-temp $control/.manifest-a.v1.<nonce16>.tmp layout.manifest-b-final control/manifest-b.v1 layout.manifest-b-temp $control/.manifest-b.v1.<nonce16>.tmp layout.placeholder-grammar m<hash32> is exactly 64 lowercase ASCII hex characters; <nonce16> is exactly 32 lowercase ASCII hex characters layout.runtime-binding-final runtime-binding.v1 layout.snapshot-final control/snapshot-<hash32>.v1 layout.snapshot-temp +control/.snapshot-<hash32>.v1.<nonce16>.tmp layout.wal-final control/wal.v2 layout.wal-temp 2NONE; WAL frames append in place to control/wal.v2 layout.writer-lock-final control/writer.lock.v1 layout.writer-lock-temp fNONE; the canonical writer-lock inode is opened and exclusively locked for the complete writer session publication.checkpoint snapshot: CREATE_EXCL temp -> write exact bytes -> fsync temp -> reopen and stream-verify canonical bytes, hash, bindings, and branded semantic reconstruction -> atomic rename-no-replace final -> fsync control directory -> verify final is the same opened inode; checkpoint header: write/fsync/canonical-verify then same no-replace sequence; only then advance both manifest slots by linked CAS; an existing final is accepted only after exact-byte verification and the unused temp is then unlinked and the directory fsynced publication.genesis �profile-1 empty genesis only: classify and stably recheck one canonical daemon-owned mode-0700 empty root; create/fsync control and writer lock under the exclusive store-session lease; install the exact authenticated genesis intent by CREATE_EXCL temp, write, fsync, atomic rename-no-replace, and control-directory fsync; create/fsync blobs and staging; append/fsync exactly one intent-bound WAL sequence-1 frame; require exactly three sorted kind6/subtype1 family-global Cell, Inbox, and Core snapshot entries accepted by the separately branded empty-genesis semantic verifier; publish immutable revision-1 snapshot/checkpoint with no predecessor; initialize both manifest slots to exact authenticated bytes; validate the resulting manifest/checkpoint/snapshot/WAL through validation-only joint recovery while retaining the writer lock; only then unlink/fsync the intent and return the transferred writer lease publication.manifest �advance inactive/opposite slot first and the other slot second; for each: CREATE_EXCL temp -> write exact canonical bytes -> fsync temp -> atomic rename-replace target slot -> fsync control directory -> reopen and verify exact bytes plus MAC publication.no-overwrite �checkpoint and snapshot finals are immutable and content-addressed: an existing target is accepted only after exact-byte equality and is never replaced; manifest slots intentionally use rename-replace; WAL is append-only publication.wal �append one exact complete frame at current EOF -> fsync control/wal.v2 -> advance the in-memory WAL anchor -> only then apply, expose visibility, sign, or acknowledge the transition recovery.checkpoint-selection ,only the checkpoint hash and WAL sequence in the selected manifest are current; validate that named header, its adjacent predecessor chain to revision 1, its named snapshot, and every binding/hash before mutation; unreferenced finals are never selected; a missing or conflicting artifact fails closed recovery.genesis �a genesis-incomplete root is resumable only while the exclusive writer lock is held and control/genesis-intent.v1 exactly equals ASCII(HRBGI001)||U16BE(1)||commitment32||keyed-BLAKE2B256(K_store_manifest,ASCII(hiverelay.blind.profile1-genesis-intent-mac.v1)||U64BE(len(prefix))||prefix), where commitment32=BLAKE2B256(ASCII(hiverelay.blind.profile1-genesis-intent.v1)||U64BE(len(canonical manifest-revision-0 template||genesis record))||canonical manifest-revision-0 template||U8(recordType)||U16BE(virtualBucket)||U32BE(payload length)||payload); every existing WAL, snapshot, checkpoint, manifest, directory, and recognized temporary must be the exact intent-derived byte/state transition; WAL/data without the intent, a different intent, extra final, conflicting temp, unsupported root entry, or nonempty semantic fragment fails as legacy-ambiguous; only exact matching checkpoint/snapshot orphan temps may be removed after validation and directory fsync recovery.manifest-selection MAC/check both slots; zero valid slots fails; one valid slot is selected and needs repair; equal revisions require byte-identical hashes and bytes; unequal revisions require exactly high=low+1 and high.previousManifestHash=hash(low); every other fork or gap fails closed recovery.temp-selection �temporary files are never recovery candidates; validation-only startup never deletes them; a writer may remove recognized manifest temps only after complete validation; checkpoint/snapshot crash-orphan temp reclamation is unsupported retention.checkpoint bretain every immutable checkpoint final indefinitely; checkpoint garbage collection is unsupported retention.manifest �retain exactly two mutable final slots; a completed advance leaves both at the same revision, while a crash may leave one exact adjacent predecessor; recognized manifest temps are bounded and post-validation cleanup only retention.snapshot �retain every immutable snapshot final indefinitely; snapshot garbage collection is part of unsupported checkpoint garbage collection
retention.wal gretain every complete WAL v2 frame from sequence 1; WAL pruning and segment replacement are unsupported retention.writer-lock �retain the canonical writer-lock file; hold its exclusive OS/filesystem lock from pre-mutation validation until every store component closes, releasing it last unsupported.checkpoint-gc oUNSUPPORTED; no checkpoint, snapshot, or crash-orphan checkpoint-temp final reclamation algorithm is authorized unsupported.migration �UNSUPPORTED; no online or offline format migration executor is authorized; unknown/mismatched format major, format hash, WAL v1, or provisional layout fails closed unsupported.wal-pruning `UNSUPPORTED; no frame, prefix, segment, or whole-WAL pruning/replacement algorithm is authorized wal.cell.put-atomic-committed 6Cell recordType=17 payload is canonical BlindPutAtomicCommittedStoreV1 with required canonical profile-1 resultBindingBytes; the BlindWalHeaderV2 exclusively binds transactionId, virtualBucket, mapGeneration, and writerFenceTokenHash; one frame reconstructs the complete committed spend, commitment index, Cell record, exact result, and derived stored/control/tombstone accounting with no reservation deadline, attempt, reserved-epoch, or caller-supplied accounting fields; Cell record types 1..16 and checkpoint subtypes 1..4 remain byte-for-byte legacy authorities