TRANSACTIONAL TRUST · VERIFIED #033

The checkpoint survived. Then recovery moved it backward.

Verified #032 made authority-head history monotonic. #033 attacks that memory itself: after the verifier reached generation 9, restoring an older checkpoint snapshot to generation 7 made an untouched authentic H7 look current again to a local-only verifier.

DURABLE CHECKPOINT ≠ ROLLBACK-RESISTANT CHECKPOINT.

The restore

baseline:
local checkpoint = 7
capture snapshot S7

history advances:
local checkpoint = 9
witness W9 = authenticated generation 9

restore S7:
local checkpoint = 7
witness W9 remains = 9

Unsafe: local-only anti-rollback

H7 authentic = true
H7 generation = 7
local checkpoint = 7
regional generation = 7

7 >= 7
→ proof_authorized_with_current_head
→ adoption rows = 1
→ HTTP 200
→ effect_count = 1

The local anti-rollback algorithm is internally correct. Its trusted input was rolled back.

Safe: independent recovery witness

local checkpoint = 7
W9 authentic = true
W9 generation = 9
W9 head_digest = digest(H9)

7 < 9
→ checkpoint_storage_rollback_detected
→ adoption rows = 0
→ effects = 0

Before any authority head can authorize consequence, the verifier first checks whether its own recovered trust state has moved backward relative to authenticated history outside the restored state domain.

Reconstruct, then verify

checkpoint reconstruction:
7 → 9
reason = checkpoint_reconstructed_from_witness

replay H7:
7 < 9
→ authority_head_rollback_detected
→ adoption rows = 0
→ effects = 0

The two guards address different failures: storage rollback is repaired first; head rollback is rejected second.

Fresh-current control

H9 authentic = true
checkpoint = 9
region-B = R2 / generation 9 / ACTIVE

→ adoption rows = 1
→ HTTP 200
→ effect_count = 1
→ output = 30

I91–I94

• I91 — Durable checkpoint ≠ rollback-resistant checkpoint.
• I92 — Verifier state recovery must not move trust history backward.
• I93 — A local checkpoint below an authenticated independent high-watermark is storage-rollback evidence.
• I94 — After checkpoint rollback, reconstruct trust state from independent evidence before authorizing consequence.

Evidence

GitHub Actions run: 31613901719
Job: 94171789427
Benchmark SHA:
87a6016e4f09748eab2586c00dc4309bf5f65cc4
Artifact ID: 9148374663
Artifact digest:
sha256:2e2c598472898952094c0f14e0238d436ed019c0f5fed457fb190fa12ea9771b
Score: 10/10

Boundary

The restore is an explicit benchmark rollback of one verifier-local PostgreSQL checkpoint row; it is not a test of PostgreSQL backup tooling. The witness is a deterministic HMAC fixture with a separate test key. Production witness rollback, equivocation, quorum and bootstrap trust remain open verification surfaces.