TTP EXTENSION · RECOVERY CURRENTNESS

Checkpoint Rollback Resistance Rule

A checkpoint can be durable and still come from the past. After verifier recovery, local trust history must be reconciled against an authenticated monotonic reference outside the restored state domain before it can authorize consequence.

DURABLE CHECKPOINT ≠ ROLLBACK-RESISTANT CHECKPOINT.

Decision rule

RECOVER / START VERIFIER
        ↓
READ LOCAL CHECKPOINT G_local
        ↓
RESOLVE AUTHENTICATED INDEPENDENT CHECKPOINT G_ext
        ↓
VERIFY WITNESS AUTHENTICITY + SCOPE + HEAD BINDING
        ↓
G_local >= G_ext ?
  ├─ no → checkpoint_storage_rollback_detected → HOLD
  │          ↓
  │      reconstruct / reconcile trusted history
  │          ↓
  │      persist monotonic checkpoint
  └─ yes
        ↓
RECEIVE + AUTHENTICATE AUTHORITY HEAD H
        ↓
H.generation >= trusted checkpoint ?
  ├─ no → authority_head_rollback_detected → HOLD
  └─ yes
        ↓
VERIFY AUTHORITY VIEW / RULE / PROOF / SCOPE
        ↓
CURRENT OWNER ADOPTS
        ↓
FENCED COMMIT
        ↓
PROVE RECOVERY → STORAGE CURRENTNESS → HEAD CURRENTNESS → PROOF → EFFECT

Why durability is not enough

Durability says state survives ordinary failure. It does not say a restore, snapshot rewind, replica rollback or administrative recovery cannot replace current state with an older durable state.

I91–I94

• I91 — Durable checkpoint ≠ rollback-resistant checkpoint.
• I92 — Verifier state recovery must not move trust history backward.
• I93 — A local checkpoint below an authenticated independent high-watermark is storage-rollback evidence.
• I94 — After checkpoint rollback, reconstruct trust state from independent evidence before authorizing consequence.

Recovery evidence

Preserve restored checkpoint identity, recovery/snapshot identity when available, independent witness/checkpoint identity, authentication and scope results, head/log binding, rollback comparison, reconstruction action, reconstructed checkpoint and the subsequent authority-head/currentness decision.

Composition with authority-head anti-rollback

CHECKPOINT STORAGE CURRENTNESS
        ↓
AUTHORITY HEAD AUTHENTICITY
        ↓
AUTHORITY HEAD ANTI-ROLLBACK
        ↓
AUTHORITY VIEW CURRENTNESS
        ↓
PROOF AUTHORITY / APPLICABILITY
        ↓
CONSEQUENCE

A perfect authority-head anti-rollback comparison is unsafe if the high-watermark supplied to it was itself restored from the past.

Boundary

Verified #033 uses an explicit PostgreSQL row restore and a deterministic HMAC witness fixture. Production systems may use independent witnesses, transparency logs, quorum checkpoints, secure hardware monotonic counters, append-only storage or other mechanisms. Witness rollback and equivocation are separate problems.