The Stone That Remembers
The Burin post ended by naming its own gap: the seal binds ground to mark, but it does not stop the sealer from telling two different stories to two different people. This note is about how that gap gets closed. The fix turns out to be surprisingly small — one integer and a chain of hashes — and the interesting part is what it deliberately refuses to become.
Here is the attack in concrete terms. A witness — a survey org, a monitoring station, eventually a satellite — publishes signed coverage roots. To you it signs a root that says its land ends at the creek; to your neighbor, one that says it runs past it. Both roots are honestly computed from real (different) inputs, both signatures verify, and each of you walks away satisfied. Determinism doesn’t help here: the seals are perfectly formed. They just describe two incompatible stories, one for each audience.
A lie, or a Tuesday?
The subtle problem is that when you and your neighbor compare notes and find two different roots signed by the same key, you haven’t necessarily caught anything. Coverage changes. Surveys extend. A different root on Tuesday than on Monday is normal operation, and an accusation that can’t distinguish updates from fraud is useless — arguably worse than useless, since it can be aimed at honest witnesses.
The fix is one field. A witness doesn’t sign free-floating roots; it signs a numbered sequence — one attestation per epoch, each carrying the hash of the previous one. That single change makes the ambiguity decidable. Two attestations at different epochs: an update, always legitimate. Two at the same epoch with different contents: a fork, always fraud. There is no third case to argue about.
root ············ signed ············root ············ signed ············What I like most about this construction is what the proof consists of: the witness’s own two signatures, side by side. Nobody investigated anything. Verifying the proof means checking two signatures — the whole thing is 438 bytes, small enough for one satellite burst or a slip of paper — and any verifier, offline, reaches the same verdict. The system never has to ask who you trust. It asks whether two signatures verify over conflicting messages, and that question answers itself.
The append-only chain
For the epoch to mean anything, history has to be immutable — the witness can’t quietly renumber the past. That’s what the hash chain provides: each attestation commits to the previous one, so the log has a fixed order and no room for retroactive edits. This is an old instinct made cheap. Kassite Babylon recorded land grants on kudurru, boundary stones placed in temples, in public, specifically so a grant couldn’t be re-remembered later. The stone didn’t enforce anything; it just made revision conspicuous. A hash chain does the same job, except that revision isn’t just conspicuous — it’s provable, because the broken links can be shown to anyone.
Time gets handled by the same trick, and this part is genuinely neat: no trusted clock is needed anywhere. Each attestation may carry an issued_at timestamp, with one rule — it has to run forward with the epochs. A witness that signs epoch 5 with an earlier timestamp than epoch 4 has contradicted itself: its own ordering says later, its own clock says earlier. We never need to know what time it actually was. The two signed statements are the whole proof.
That’s the full fraud taxonomy: telling two stories in one epoch (equivocation), running the clock backwards (backdating), and — for witnesses that have declared their coverage append-only — un-covering ground a prior root attested. Each fraud names the specific rule it breaks, each proof verifies offline, and the first two cost exactly two signature checks. None of this is invented from scratch. Certificate Transparency showed that an append-only log plus gossip can hold certificate authorities accountable without replacing them; Roughtime showed chained receipts prove ordering without a master clock; PeerReview showed tamper-evident logs give Byzantine accountability without Byzantine agreement. Burin’s contribution is compressing that lineage into something a field device can carry and a paper card can verify.
A memory, not an authority
It’s worth being precise about what this log does not do, because the restraint is the design. It doesn’t decide who owns the field. It doesn’t rank claims, license surveyors, or hold a master map. It records what each witness said, in what order, and it makes any contradiction portable: a fraud proof travels by radio, gossip, or hand, and each verifier that sees one revokes that witness locally, on evidence. No committee convenes; no global revocation list exists (maintaining one would require exactly the consensus this system avoids). It is not a blockchain — nothing votes, and nothing charges you to remember. The phrase we use in the model is a memory, not an authority, and it turns out a memory is all that two mutually distrustful parties actually need from the outside world.
One limit, stated because it’s structural: this catches every lie told, and cannot prove what silence hides. A withheld attestation is indistinguishable from a network partition — that’s a boundary shared by every consensus-free design, and the honest response is mitigation, not denial: witnesses heartbeat every epoch, so silence at least becomes conspicuous, and gossip makes suppression expensive. The next post puts numbers on exactly how expensive.
The seal made a mark no one can forge. The chain makes a history no one can rewrite. Together they mean a witness can lie to you exactly once — and hands you the evidence itself.