1 files changed, 13 insertions, 9 deletions
diff --git a/tvix/proto/castore.proto b/tvix/proto/castore.proto
index aa3c9b37bcbe..89cfb82e48fe 100644
--- a/tvix/proto/castore.proto
+++ b/tvix/proto/castore.proto
@@ -24,13 +24,17 @@ message DirectoryNode {
     // The (base)name of the directory
     string name = 1;
     // The blake3 hash of a Directory message, serialized in protobuf canonical form.
-    bytes ref = 2;
-    // Number of child elements in the Directory referred to by ref.
-    // Calculated by summing up the numbers of `directories`, `files` and `symlinks`,
-    // and for each directory, its size field. Used for inode number calculation
-    // TODO(flokli): These numbers can't really be verified until you know the whole graph.
-    //               Is this a problem? Should we instead only have this field
-    //               in our local representation?
+    bytes digest = 2;
+    // Number of child elements in the Directory referred to by `digest`.
+    // Calculated by summing up the numbers of `directories`, `files` and
+    // `symlinks`, and for each directory, its size field. Used for inode
+    // number calculation.
+    // This field is precisely as verifiable as any other Merkle tree edge.
+    // Resolve `digest`, and you can compute it incrementally. Resolve the
+    // entire tree, and you can fully compute it from scratch.
+    // A credulous implementation won't reject an excessive size, but this is
+    // harmless: you'll have some ordinals without nodes. Undersizing is
+    // obvious and easy to reject: you won't have an ordinal for some nodes.
     uint32 size = 3;
 }
 
@@ -38,8 +42,8 @@ message DirectoryNode {
 message FileNode {
     // The (base)name of the file
     string name = 1;
-    // The blake3 hash of the file contents
-    bytes ref = 2;
+    // The blake3 digest of the file contents
+    bytes digest = 2;
     // The file content size
     uint32 size = 3;
     // Whether the file is executable