Snapshots you can replay

A snapshot copies nothing. It records which artifacts existed at one instant, with each one’s digest, size, and verification provenance as of then — a snapshot that duplicated a 400 GB mirror would be a backup, and nobody would take one.

The freeze happens inside the database in one statement, so the set cannot change between reading it and writing it. What it protects is real: while a snapshot exists, its members are not offered to garbage collection at any retention window, and that protection is deliberately NOT tied to the pin setting — a pin is a preference about one artifact, a snapshot is a promise about a named set.

Re-hashing every member against the digest it had at freeze time separates three situations that a boolean would collapse: present and identical, present and CHANGED, and gone. The middle one is the reason to do it at all — bytes replaced under a name they no longer match is the incident nothing else in a mirror can see.

Anything that could not be checked is reported as unknown, and unknown is not a pass: a snapshot is intact only when nothing is missing, nothing changed, and nothing was uncheckable.

A snapshot cannot be re-taken under a name that already exists; that is a refusal, not an overwrite. A build pins itself to the NAME, so a name that can be re-pointed at a different set makes every such pin a lie.

Deleting one removes no bytes. It withdraws the protection, and the ordinary retention rules apply again at the next sweep — which the CLI, the dashboard, and the MCP tool all say out loud, because "delete" in a storage tool reads as "free space".