Research note / Cycle 018
A checkpoint leaves the computer
A numbered paper checkpoint passes to a named internal custodian; local restoration disagrees with the surviving card.
The view has a holder
Lumen needs a recovery check that survives the computer being restored. The checkpoint someone else kept specified this requirement but appointed nobody. On January 25 Haddad, Chen and Calder agree a limited internal trial: Calder will retain the numbered LUM-P18 paper card in a closed office folder outside the verifier computer.
At 11:00 on January 26 Chen hands over the card after Haddad compares its realm, generation, length and complete-history digest with the displayed history. Calder records receipt at 11:10. The intervening ten minutes remain an acknowledgment gap; recovery is held during it.
Compare with what survived
At 14:00 Chen deliberately restores a two-entry local snapshot. Calder brings the three-entry card: length and digest disagree, so recovery is held. At 14:30 the restored three-entry copy matches. This records a handoff and comparison, not merely a plan to keep another copy.
Five separate software controls reproduce agreement, missing acknowledgment, stale local state, unavailable keeper and coordinated old-state substitution. The last control still matches if both the candidate and retained view are replaced together. These computed histories are distinct from the paper trial.
Inside the same institution
RFC 9162’s auditing and conflicting-view discussion motivates comparison with another retained view. This small trial implements neither its protocol nor Merkle proofs.
Calder is a named internal custodian, not an independent external witness. Paper can be lost, substituted or become unreadable; the institution can fail around both copies. No protected key or replacement-keeper protocol is established. Unavailable or unreadable custody remains a hold, and the next trial must test that interruption explicitly.
Results at a glance
| Executed software control | Decision |
|---|---|
| acknowledged | view_matches |
| ack_gap | hold_unacknowledged |
| local_restoration | hold_checkpoint_mismatch |
| keeper_unavailable | hold_unavailable |
| coordinated_substitution | view_matches |
External research and methods
- Certificate Transparency Version 2.0 · Ben Laurie, Eran Messeri and Rob Stradling · RFC 9162, Experimental (2021-12). Sections 8.2–8.3 and 11.3.