Module prefix 

Frozen prefix assembly: four segments, assembled once at Run start, never reassembled within the Run. Volatile types (TimeMs, usage, signals) have no conversion into FrozenSegment — the absence of those impls is the isolation guarantee (15.3-4).

Modules

warmth

One session’s keep-warm account: the last real request each prefix carried, and the renewal sent for it when kernel::keep_warm says it is due (crates/runtime/spec/Prefix.lean §8-4-2).

Structs

BreakpointPlan

The breakpoints one request carries: every segment edge but the last, and the tail of the conversation when there is one.

FrozenPrefix

The assembled prefix: city, building, resident, run — in that order, enforced at the only constructor.

FrozenSegment

One frozen segment: static bytes from frozen sources, hashed at construction. The sole constructor takes bytes, not values — there is deliberately no From<TimeMs> or any other volatile conversion.

PrefixPlan

The four source lists plus caps: everything build_prefix needs.

SegmentCaps

Per-slot byte budgets in bytes, converted from a token budget at BYTES_PER_TOKEN and divided across PREFIX_SLOTS. Callers derive them from config; the default splits the startup budget.

SegmentSource

One document a segment was assembled from, as the assembler saw it.

SourceDoc

One prefix source document: address plus its frozen bytes, None when missing or unreadable (the skip itself is accounted).

Enums

Breakpoint

One explicit prompt-cache breakpoint a request carries.

SegmentSlot

The four slots in stability order; the order is the cache economics. Exactly four — deliberately exhaustive.

Functions

build_prefix

Builds the four segments from source documents: UTF-8 only, per-slot caps with explicit truncation markers, cross-slot dedup by address (first slot wins), skips accounted in the notes. The notes travel inside the returned prefix and surface in prompt_assembled — they are what makes the prefix offline-rebuildable (A15, C16).

verified_system_hashes

The same assertion over the copy of the segments a request carries: four cache-marked system blocks, hashed and compared against the hashes the run froze. The request is what the provider reads, so this is the check that the wire form and the record agree.