Module checkpoint 

The optional CHECKPOINT record: a bounded, advisory per-op output table.

A checkpoint is a self-describing, little-endian, versioned payload written with crate::container::record::FLAG_OPTIONAL into a seekable descriptor (one that also carries an OBSERVATION_INDEX and a seek DIRECTORY, which locates it). It records, for every reconstruction op, that op’s absolute output start offset and length — a random-access boundary table a planner can consume to select an op window without reading the OBSERVATION_INDEX record.

checkpoint_v1 :=
    version:u8 = 1
    kind:u8 = 1                # OP_BOUNDARIES
    reserved:u16 = 0
    entry_count:u32 LE
    source_len:u64 LE
    graph_crc32c:u32 LE        # CRC-32C of the GRAPH record payload
    entry[entry_count]: out_start:u64 LE | out_len:u64 LE

The checkpoint is advisory, never authority (mirroring the DIRECTORY/OBSERVATION_INDEX discipline of ADR-0019). [Self::validate] re-derives every length from the authoritative reconstruction program with crate::dra::Program::analyze_ops and rejects any contradiction, so a checkpoint can never change a served byte. A lying, corrupt, oversized, or out-of-closure checkpoint is rejected: the full parser fails closed, and the seek reader ignores it and falls back to the Phase-8 index lane.

Unknown version, kind, or a non-zero reserved field fail closed. All arithmetic is checked.

Structs

CheckpointEntry

One op’s absolute output boundary: where the op’s output begins and how many bytes it produces.

CheckpointTable

A decoded CHECKPOINT record payload.

Constants

CHECKPOINT_ENTRY_LEN

Encoded size of one boundary entry: out_start u64 | out_len u64.

CHECKPOINT_HEADER_LEN

Encoded size of the fixed checkpoint header.

CHECKPOINT_KIND_OP_BOUNDARIES

Checkpoint kind: a per-op output boundary table.

CHECKPOINT_KNOWN_KINDS

The only checkpoint kind this build understands; any other kind fails closed.

CHECKPOINT_VERSION

Wire version of the checkpoint payload implemented by this build.