Recovery eras

Continuity follows a relationship through the rotations a DID's own key signs. When that key leaks, or two of the peer's devices rotate apart, another signature from the same key cannot settle which successor is right. This page explains a proposed second level of authority, a recovery key named in the DID document, and the rule continuity would use to apply it.

Research. This rule is a design under study and is not in @estoc/continuity. The figures run a sketch written for this page. It covers the peer's side: rotations, recoveries and endings the peer signs, seen from DIDs of yours that stay put. Your own rotations follow the same rules and are described in prose.

If pairs, heads and confirmation are new, the continuity page introduces them. Here your DIDs are L and M, and the peer's are letters from A.

Two levels of authority

The level comes from the key that verified the signature, not from what the message says about itself. Each pairwise relationship is recovered on its own, and the recovering side can start from any DID it held in that relationship.

The era in the document

A did:peer:4 document carries the recovery key next to an era:

{
  "recovery": {
    "publicKeyMultibase": "z6Mk…",
    "era": "7f3a…"
  }
}

• A first-order rotation binds only if the successor's document has the same recovery key and the same era as the issuer's.
• A recovery binds only if the issuer's recovery key signed it and the successor's era differs from the issuer's. The recovery key itself may stay or change.
• A proof that fails to bind is not a fact. The continuity model reads no documents and no era values.

The era is an opaque random value. A wallet creates one with the first DID of a relationship, copies it on every first-order rotation and draws a new one at each recovery. It lives in the document because a did:peer:4 identifier is a hash of its document: the DID fixes the era, and a different era means a different DID. It is not a counter, since the rule only asks whether two eras are equal, and a number would invite ordering and last-writer-wins.

Eras

Inside one relationship, the peer DIDs that first-order claims connect form an era. Here A rotated to B, and B to C, with the everyday key, so A, B and C are one era. A recovery's successor starts an era of its own.

A recovery supersedes every first-order claim from its era and adds a derived link from each pair of that era to the successor. Whichever pair of the old era you ask from, the head moves to the new one.

• first-order rotation
• recovery
• derived from a recovery
• superseded, kept as history
• in conflict
• a box: one era, with the value its documents carry

Switch on r, a recovery A ⇒ D. f1 and f2 stay in history as superseded, and C(L,B) and C(L,C) reach C(L,D) along derived links.

Settling a fork

A's everyday key signed two successors, B and C. Two devices may have rotated apart, or someone else may hold the key. The first-order rule reports competing changes and picks neither, as continuity does today.

Switch on r. Both branches start in A's era, so the recovery supersedes both, the conflict is gone and every pair leads to C(L,D). Settling a fork like this is what the second level is for.

Recoveries in order, and in competition

D ⇒ F starts from D's era, which A ⇒ D opened, so it follows A ⇒ D instead of competing with it. The order between eras comes only from recoveries. Eras form a tree, with no clock and no counter.

Switch on r3, a second recovery from A's era, to G. Two recoveries from one era with different successors are a fork one level up. The model reports it and picks neither, and the pairs downstream are blocked with it.

This is the limit the second level keeps. A fork of the recovery key cannot be settled from the evidence. A third level would move the limit up once more; whichever level is the top, its own fork stays open.

What an old key can still do

A recovery revokes nothing. The retired everyday key can still sign, and its letters still arrive. The rule decides what they are worth.

• Switch on o1, a plain letter from B. It sits in history and confirms nothing: every head stays the same, and the confirmation for C(L,B) counts r, sent from D, but not o1.
• Switch on t: someone with B's key rotates B to T and copies the old era into T's document. It binds, since the eras match, and lands in the old era. With r on it is superseded at once and C(L,T) leads to C(L,D). With r off T simply takes over, which is the case recovery exists for.
• To reach the new era, T's document would have to carry D's era, and then B → T fails to bind because B carries the old one. Only D's own key can extend D's era.
• Switch on o2: B writes to M, a DID of yours in another relationship. No claim relates C(M,B) to C(L,B), so the letter confirms there as usual. A recovery supersedes pairs, not DIDs.

Why binding compares the era

After A ⇒ D, a first-order D → E and a recovery E ⇒ F, a first-order A → E arrives late, signed with A's retired key and sent from E. Your peer's other device might have sent it, or someone holding both retired keys. A and E carry different eras, so binding rejects it.

Untick Binding compares era. x becomes a fact and joins A, D and E into one era. A ⇒ D now lands inside its own predecessor's era, and E ⇒ F competes with it. The model does not throw. It reports a conflict, so every replica stops at the same answer instead of failing on the same fact.

A relationship is a component

The figures group pairs by relationship, and the rule derives that grouping from the claims too. Each claim covers a rectangle of pairs, its local DIDs by its peer DIDs, and rectangles that share a local DID and a peer DID merge. The result is what one relationship means for recovery.

• A plain letter covers no rectangle, so writing a letter with an old key cannot widen what a recovery reaches.
• If your entry DID opens private branches toward two peers, no claim relates the branches. They are two components, and a recovery in one leaves the other alone.
• Your own rotations widen the rectangle across your DIDs. Each of them waits for the peer to write to the address you left, and a letter on a superseded pair does not count: the recovered successor did not inherit what the old DID knew about your addresses.
• Components, eras, supersession and the conflicts between recoveries are computed from the facts before any link is confirmed, so recovery and confirmation do not wait on each other.

What the rule promises

• Old letters do nothing. A plain letter from an old era is not a claim, adds no link, and confirms nothing on a superseded pair.
• Old keys add no recovery. A first-order claim signed with an old era's key brings no new second-order authority. Every supersession and derived link it causes belongs to a recovery that was already there; at most it widens that recovery's reach, and only where the eras on both ends match.
• Conflicts follow the facts. Replicas holding the same facts report the same conflicts, whatever order the facts arrived in.

What it leaves as it was: there is no revocation, so a retired key can still sign; a fork of the recovery key stays unsettled; and once the current recovery key leaks, no signature tells its owner from a thief.

Sandbox

Select a pair, then add facts at it. A rotation with the everyday key copies the era into the successor's document, and a recovery draws a new one. The scenario menu holds the cases above and a few more, such as a later first-order claim that reveals two recoveries from one era. The facts live in the page address, so a link reproduces what you see.