Research note / Cycle 017
The checkpoint someone else kept
A toy retained checkpoint rejects local rollback only while its witness view survives; signatures do not establish common history or independent custody.
Retain a view beyond the restoration
Lumen needs a recovery history that cannot be made old simply by restoring the verifier and its generation store together. Which side of the commit? established an application interruption boundary, while retaining common snapshot rollback. Haddad and Chen now test the missing comparison: a checkpoint kept outside that modeled restore set.
The toy receipt binds a realm, complete-history length and SHA-256 digest, with an HMAC using public fixture data. A second retained view must match before recovery proceeds. These are ordinary local files representing an assumed custody separation, not a deployed witness or protected key.
The witness can disagree or be absent
A surviving generation-2 checkpoint rejects restoration of the local pair to generation 1. Missing witness, missing receipt, forged receipt, changed local entry and unacknowledged newer checkpoint all hold. Two validly signed views of length 2 can still disagree on their contents; comparing the retained digest catches that split view.
Restoring the witness together with every other modeled domain still matches the old checkpoint. The model therefore moves the boundary rather than abolishing it. Matching a retained view is not permission to consume another issuer decision, and the fixture does not re-execute one.
Custody has to be enacted
RFC 9162 supplies a new external connection through its auditing and conflicting-log-view discussion. This small full-history toy implements neither Certificate Transparency nor Merkle proofs. SQLite’s refreshed atomic-commit explanation continues to bound the earlier local restart result.
The team drafts an acknowledgment/custody procedure: select a keeper and medium outside the restore set, record an actual transfer and hold when acknowledgment is absent or conflicting. No keeper is appointed and no independent transfer occurs this cycle. Availability, witness replacement and all-domain rollback remain open.
Results at a glance
| Retained-history model | Local length | Decision |
|---|---|---|
| current_checkpoint | 2 | checkpoint_matches_retained_witness |
| local_pair_restored_witness_survives | 1 | hold_witness_checkpoint_mismatch |
| witness_unavailable | 2 | hold_witness_unavailable |
| receipt_missing | 2 | hold_receipt_missing |
| forged_receipt | 2 | hold_receipt_authentication |
| modified_local_entry | 2 | hold_local_history_mismatch |
| signed_split_view | 2 | hold_witness_checkpoint_mismatch |
| witness_acknowledgment_not_yet_retained | 2 | hold_witness_checkpoint_mismatch |
| all_domains_restored | 1 | checkpoint_matches_retained_witness |
External research and methods
- Atomic Commit In SQLite · SQLite project · Online rollback-journal explanation (Living documentation; retrieved 2026-10-26). Introduction, hardware assumptions and rollback-mode boundary.
- Certificate Transparency Version 2.0 · Ben Laurie, Eran Messeri and Rob Stradling · RFC 9162, Experimental (2021-12). Sections 8.2–8.3 and 11.3.