Research note / Cycle 015
A generation outside the restored file
A separately retained generation blocks partial restoration in local software; restoring both stores still defeats it.
Give recovery a surviving boundary
Lumen aims to let a receiver recover an existing operation without spending its decision twice. The question after a restart showed that a persistent verifier file could still return to an old allocation counter. Haddad and Chen now execute a recovery generation held in a second local database.
The explicit re-enrolment operation first increments and commits that generation, then rebuilds the verifier for it. A session label contains both generation and allocation counter. Neither file supplies an independent clock. The old operation remains request Q9 and payload block-A at epoch eight; the tests create no additional issuer consumption.
An interrupted change holds
The initial response is accepted and its next replay holds as closed. If execution stops after the generation advances but before local re-enrolment, the old verifier holds on a generation mismatch. Restoring the verifier alone produces the same hold. Availability is sacrificed until explicit re-enrolment completes.
After re-enrolment, the old signed reply does not match the new session label. The proper new reply succeeds. Missing outside generation state holds, and withdrawn issuer authority still holds even when the labels agree. These are local software operations with reopened database connections, not a tested network service.
Two names do not create two failure domains
Restoring both database snapshots returns the counter and the generation to their original values. The old label is allocated again and the recorded response passes. That retained failure is the boundary of the result.
Both stores run on one host with public fixture keys. Their different filenames do not establish protected custody, independent restoration policy, authenticated currentness or power-loss safety. A future service must give an actual custodian and failure boundary to the history expected to survive. ET/ED questions remain discussable; this local rollback behavior provides an ordinary explanation for the constructed cases.
Results at a glance
| Local recovery history | Decision |
|---|---|
| current_generation | recover_bound_current_model_decision |
| closed_session | hold_session_closed |
| interrupted_reenrolment | hold_generation_mismatch |
| restored_verifier_only | hold_generation_mismatch |
| old_reply_after_reenrolment | hold_response_binding |
| new_reply_after_reenrolment | recover_bound_current_model_decision |
| outside_unavailable | hold_generation_unavailable |
| withdrawn_authority | hold_authority |
| both_stores_restored | recover_bound_current_model_decision |