Research note / Cycle 009
Before the acknowledgement leaves
A power-loss state machine distinguishes a flushed checkpoint from a queued write without drawing again.
R2 passes through four steps
Aletheia’s acquisition harness must preserve the symbol assigned to a request when an acknowledgement disappears. The checkpoint comparison showed that two lists could share the same missing tail. Ibarra now specifies an order: draw once, flush the local commit, flush the witness commit, then send the acknowledgement. Okafor tests cuts between those steps.
The authored R2 draw is symbol-5. The model stores that request and symbol locally and in a witness, then makes records unreadable during an outage according to explicit power-domain assumptions. Its recovery reviewer sees only readable flushed copies and the supplied authority state. Flushed bytes remain in modeled storage through the outage; physical durability is not established. All nine cases retain exactly one draw; none invokes a replacement acquisition.
A different supply is only part of the answer
When the witness has flushed and its modeled supply is distinct, local power loss leaves R2 available at the witness. Recovery holds reconciliation before the local record can be restored. Witness loss leaves the local draw intact but holds witness agreement. A cut after the local write and before the witness flush produces that same incomplete state.
A shared-supply outage makes both flushed copies unreadable. With the local supply down and the witness write only queued, neither readable durable copy is available either. Both cases remain unresolved without another draw. The latter failure survives a separate-supply label: there was no durable witness record for that supply to preserve.
A recovered symbol still has a source
Matching commits do not override withdrawn or disputed permission; both authority cases hold. The hidden upstream-copy case also remains beside the favorable committed pair. Their reviewer inputs are identical, while the authored history differs on whether the symbol was independently acquired. Durability is not source independence.
This is a software state machine with explicit flush and power assumptions, not a physical storage test. It identifies the interval a prototype must preserve but establishes no actual supply separation, independent tap or authority service. There is no participant, implant or neural measurement. The next design must expose durable witness completion before acknowledgement and retain the unresolved interval through restart.
Results at a glance
| Case | Recovery decision | Draw count |
|---|---|---|
| committed_pair | replay_existing_model | 1 |
| local_loss_after_witness | recover_from_witness_hold_reconciliation | 1 |
| witness_loss | retain_local_hold_witness | 1 |
| cut_before_witness | retain_local_hold_witness | 1 |
| shared_supply_loss | hold_unresolved_no_redraw | 1 |
| queued_witness_loss | hold_unresolved_no_redraw | 1 |
| withdrawn_permission | hold_authority | 1 |
| disputed_permission | hold_authority | 1 |
| hidden_upstream_copy | replay_existing_model | 1 |