Snapshots you can replay

A snapshot copies nothing. It records which artifacts existed at one instant, with each one’s digest, size, and verification provenance as of then — a snapshot that duplicated a 400 GB mirror would be a backup, and nobody would take one.

The freeze happens inside the database in one statement, so the set cannot change between reading it and writing it. What it protects is real: while a snapshot exists, its members are not offered to garbage collection at any retention window, and that protection is deliberately NOT tied to the pin setting — a pin is a preference about one artifact, a snapshot is a promise about a named set.

Re-hashing every member against the digest it had at freeze time separates three situations that a boolean would collapse: present and identical, present and CHANGED, and gone. The middle one is the reason to do it at all — bytes replaced under a name they no longer match is the incident nothing else in a mirror can see.

Anything that could not be checked is reported as unknown, and unknown is not a pass: a snapshot is intact only when nothing is missing, nothing changed, and nothing was uncheckable.

A snapshot cannot be re-taken under a name that already exists; that is a refusal, not an overwrite. A build pins itself to the NAME, so a name that can be re-pointed at a different set makes every such pin a lie.

Deleting one removes no bytes. It withdraws the protection, and the ordinary retention rules apply again at the next sweep — which the CLI, the dashboard, and the MCP tool all say out loud, because "delete" in a storage tool reads as "free space".

Protection from collection was only half of it. Nothing stopped repull — which re-downloads an artifact from upstream — from overwriting a snapshot member with whatever upstream serves TODAY. That is precisely the difference a snapshot verify exists to detect, performed by us, on purpose, and reported as success.

So a repull of a snapshot member is refused with a 409 naming the snapshot that protects it, and the refusal is audited. There is deliberately no force flag: the way to repull a frozen artifact is to delete the snapshot first, which is an explicit act that leaves a record, rather than a flag somebody adds to get past an error.

It is enforced in the server, which is the part worth copying. The same rule had existed as a deny list in the MCP server, where it protected exactly one caller — the one that read the list. Moving it into the server covers the CLI, the REST API, the MCP tools, and whatever client gets written next, none of which had to be told.