Plan: chain-v2 external anchor authority — enumerable transparency frontier, signed manifests, verifier confirmation (#1278, epic &73)

Epic: &73
Issue: #1278 (critical, w5) — blocked by #1246 (Done); blocks #1279, #1280
Branches: this docs MR, then feature/1278-store-hardening → -anchor-crates → -anchor-substrate → -anchor-emitter → -anchor-confirm
Discipline: local cargo xtask validate before each MR’s first push; every MR dormant-safe; Relates to #1278 on MR-1..4, Closes #1278 on MR-5 (the >1-MR justification is the five independently-reviewable subsystems: store primitives, pure crates, substrate, the new deployable, the confirmer).

The purpose of an external authority is to be a root of trust the local-DB attacker cannot roll back. The rejected v1 failed this: every decision (which object to read, which anchor is newest, what time it is) came from mutable local rows, so a coherent local-snapshot rollback made the verifier fetch an old, valid, Object-Locked object and never look for the newer ones. This plan makes the authority itself the high-water mark, discovered by enumeration, never inferred from local state.

Every D-section below serves D0.

New primitives on Store (crates/canopy-store/src/store.rs); the deprecated put stays for the #435 upload seam — put_create is a DISTINCT integrity seam for machine-generated canonical evidence (codec-validated; magic-byte sniffing would reject JSON), documented as such.

Devstack (MR-1): a named Garage data volume (survives container recreation — today Postgres persists but Garage does not, so a recreate can keep confirmed rows while deleting their objects); chain-anchor key generation + mount wiring for the emitter (the manual generator rejects that name today, xtask/src/cmd/gen_signing_keys.rs; the auto-generator omits it); xtask Garage provisioning (idempotent, via the admin API :3903: bucket canopy-chain-anchors, writer/reader/enumerator key pairs); a recreate-and-boot E2E proving the authority survives.

Empirical gates (MR-1, documented in-test + local-dev.adoc): Garage v2.2.0 (a) conditional-write (put_create twice → AlreadyExists?), (b) versioning, (c) list, (d) whether object_store 0.13.2 exposes per-object Object-Lock retain-until on put_opts. Outcomes pin D10’s enforcement mechanism and whether the devstack anchor store is Garage-s3 or the Local backend (native PutMode::Create) with Garage reachability-only. No fake attestation either way.

Crate placement (a rejection finding — canopy-chain is charter-pure "bytes-only, no async, no db, no signing", crates/canopy-chain/src/lib.rs:3-14). The split:

The concrete StoreAnchorAuthority maps AnchorObjectKey::object_path → Store::put_create/get_version/ list_prefix, PutReceipt → AnchorReceipt, StoreError → AuthorityError (incl. VersionGone → VersionGone); store()/get() set the metadata-first size cap (D1). AnchorReceipt = { authority_id, external_ref, version_id, etag, authority_time } (the version_or_etag/stored_at collapse removed). The DTOs AnchorSubmission/AnchorReceipt MOVE from canopy-chain to canopy-anchor-authority (they are I/O contracts, not pure bytes); the substrate plan’s "DTOs in canopy-chain" note is superseded (recorded in the CHANGELOG Changed). The trait is &dyn-safe so #1280 reuses it.

Envelope codec (canopy-chain src/anchor.rs, ANCHOR_ENVELOPE_VERSION=1): encode_anchor_envelope(manifest_bytes, jws) → Result<Vec<u8>> builds {"anchor_envelope_version":1,"jws":…,"manifest":<value>}, canonical_bytes, and enforces the post-condition that re-extracting + re-canonicalizing the manifest reproduces the input bytes; decode_anchor_envelope(bytes, max_len) → Result<(Vec<u8>, String)> strict 3-key decode + version pin
full re-encode byte-equality + size cap. Proptest (parser/serializer rule) + a frozen KAT.

DDL follows the substrate discipline (DO/EXECUTE format() with SET search_path = <schema>, pg_temp; create-then-transfer to canopy_chain_owner_security; REVOKE PUBLIC; overload rule = DROP before any signature change). Timestamp AFTER 20261015000000 (security) / AFTER 20261010000000 (tanf/medicaid — their fti_preimage_id postdates the substrate); crates/canopy-test-lib/src/db.rs is re-touched so sqlx::migrate! re-embeds.

Append-only attempts (the recovery-overwrites-evidence fix). Mutable per-anchor generation/ref columns would let failed(token_g0) → rotate → submitted(g1) erase the planted g0 object before the verifier sees it. Instead:

chain_anchors gains current_attempt_id UUID REFERENCES chain_anchor_attempts(id) (the confirmed/latest attempt pointer). The confirmed/failed ⇒ outcome and production ⇒ version_id invariants are enforced IN the SECURITY DEFINER chain_anchor_transition_emit/_confirm bodies (which already lock and read both rows) — NOT as table CHECKs, because a CHECK cannot reference another table and "production" is not row data (a rejection finding). The single-table CHECK that DOES hold: `outcome’s closed set (above). No nullable/COALESCE "maybe-stamped" columns — every attempt is a full row.

chain_anchor_heads gains recovery_token UUID NOT NULL DEFAULT gen_random_uuid() — the current key namespace (unpredictable; a leaked writer cannot preplant the next integer key).

No new checkpoint columns. Read-time status-age keeps using the LANDED path — chain_anchor_trusted_v → chain_anchors.created_at (read_trusted_manifest, status.rs:441-459), unchanged — and is honestly labelled BEST-EFFORT liveness (D0.3/D8): a live-restamped authority_observed_at on the family checkpoint row was considered and REJECTED because the family row is CHECK-forbidden from carrying cursors/stamps (Amendment 9’s family-shape invariant) and the verify role cannot write checkpoints except via chain_checkpoint_advance — adding a stamp there would fight the substrate for a signal that is best-effort by construction (no read-time local signal defeats the privileged rollback; the enumeration latch does). The anti-rollback guarantee is entirely the confirmer’s external-ahead-of-local enumeration
the independent auditor (D0).

Recovery rotation replaces the naive "generation bump":

chain_anchor_recovery_journal carries UNIQUE (operation_id) — replay is schema-enforced, not merely lock-ordering discipline (a concurrency test asserts two same-operation_id rotations produce exactly one journal row).

A stale old-token store result arriving after rotation cannot mutate the anchor row: its attempt carries the old token; the head’s current token is the new one; the burned (old_token, seq) object is still discoverable via its attempt row (the evidence survives). Precondition (runbook, not machine-checkable): the compromised writer credential is rotated FIRST — a token rotation alone does not contain a leaked writer.

Emit reshape — chain_anchor_transition_emit grows p_recovery_token, p_external_authority, p_external_version_id, p_external_etag, p_authority_time, p_attempt_outcome, p_anchor_seq (the denormalized value, validated against the locked anchor row), and p_require_version boolean (the emitter derives it from CANOPY_ENV — a SECURITY DEFINER fn cannot read the env, and "production" is not row data). It INSERTs a new chain_anchor_attempts row + advances current_attempt_id on EVERY store-attempt transition — → failed (divergence) included — enforcing IN THE BODY: p_attempt_outcome IN ('stored','adopted') AND p_require_version ⇒ p_external_version_id NOT NULL (rejects a version-less production store); the confirmed/failed ⇒ outcome half is genuine row data. Per-attempt exact assignment, no COALESCE.

Confirm CAS reshape — chain_anchor_transition_confirm grows (p_lease_token, p_expected_predecessor_id, p_expected_predecessor_hash, p_checked_fingerprint). TWO fence arms (the confirmed-immutable rule holds in both):

Incident kind — anchor_integrity (23rd) joins the chain_incidents kind CHECK; latched family-global (epoch NULL, shard NULL — dedups via NULLS NOT DISTINCT), so a per-epoch family run cannot clear it. VerifyReject::AnchorIntegrity{anchor_seq, recovery_token, external_ref, version_id, kid, phase, expected, got} (canopy-common); evidence carries anchor_seq (NEVER top-level seq — the _app projection reads evidence→>'seq' as an event position; position_seq stays NULL for this kind).

Grants — scoped PER DATABASE (a rejection finding: signing_key_history, chain_anchor_attempts, and the recovery journal exist ONLY in canopy-security; anchors are security-only; a literal all-three twin would fail relation does not exist). These are TABLE privileges, not role memberships, so none collide with the hardening membership reconcile.

Grant-negative (PUBLIC-probe) tests both directions in each DB.

A NEW service (services/canopy-anchor-emitter/, its own binary/Dockerfile/CI/compose entry) — the process-level arm split (a compromise of this process holds the signing key + writer creds but CANNOT confirm; a compromise of canopy-security’s confirmer holds reader creds but no signing key/writer creds). It loads rulesets/{jurisdiction}/jurisdiction.toml at boot (D10 retention), registers the anchor public key (boot barrier, D3), and runs one task per family (audit via the security DB; fti-tanf/fti-medicaid via their DBs — X10 per-family dormancy on flag+URL). All functions ≤40 lines (decompose like host.rs).

Divergence ALWAYS reaches the verifier: the failed row’s current_attempt records the canonical key, and D6’s failed-anchor evidence path fetches it and latches. Failed rows retry oldest-first on the EMIT INTERVAL (capped backoff), not the tick — one bounded probe per interval, not log spam.

Runs in family_confirm_step, inserted in the family pass BEFORE family_manifest_step (a just-confirmed anchor becomes the trusted ref the same pass). Holds ONLY the reader authority (get/list) + the verify pools — no signing key, no writer creds. ConfirmDeps = None (reader store unconfigured) ⇒ dormant, but an explicit CHAIN_ANCHOR_CONFIRM_ENABLED=true with no reader creds is a STARTUP error (no silent disable).

Engine seam (a rejection finding — the named seam did not match the check). Today fetch_and_check_anchor is PRIVATE, takes only the security pool, and does steps 1–3 (row metadata / topology / constants); the tip-prefix check is check_tip_prefixes (needs the chain pool), composed only by manifest_check. So MR-5 adds a PUBLIC check_anchor_by_id(security, chain, scope, family, id) = fetch_and_check_anchor (id-selected, expected_state='submitted') plus check_tip_prefixes — the both-pools, tip-prefix-inclusive check the confirm walk calls; manifest_check keeps its LatestConfirmed fetch BYTE-IDENTICAL (the 24-test engine suite stays pinned to it), refactored to share the selector AnchorSelector{ LatestConfirmed | ById(id, expected_state) }. check_continuity(chain, scope, prev.tips) is EXPLICIT new MR-5 engine work (reuse cursor_hash_at — assert the current chain hash at each prev tip seq equals prev.tips[shard].last_hash, same epoch/topology), NOT part of check_anchor_by_id. The confirm walk composes: linkage → check_continuity → check_anchor_by_id → external evidence → CAS.

Confirm wiring + the missing types (a rejection finding). VerifierPools (chain_verify/mod.rs, today {chain, security}) gains confirm: Option<ConfirmDeps>; spawn_family_task’s signature and `verifier_pass → leased_pass → scheduled_pass thread it to family_confirm_step. None ⇒ confirm dormant (anchors age to stale, never a crash); CHAIN_ANCHOR_CONFIRM_ENABLED=true with no reader creds is a STARTUP error (D11). The types ConfirmDeps + AnchorKeyStore are CONFIRMER-only and live in canopy-security (it holds sqlx + canopy-signing; reader: Arc<dyn ExternalAnchorAuthority> is the only authority-crate type they reference) — the authority crate stays DB/key-free:

Genesis confirmation is a one-shot CUTOVER step, not the steady family pass (a rejection finding). The steady family_confirm_step runs inside the leased family pass, which verifier_pass reaches only for an active topology (host.rs:104 returns idle on NotActive, and fetch_topology maps installing → NotActive with no scope). But Amendment 6 requires the genesis anchor VERIFIER-CONFIRMED before chain_epoch_activate, i.e. while the epoch is still installing. Reworking the whole verifier host to run its family pass during installing is invasive and wrong; instead genesis confirmation is a dedicated confirm_genesis(security, chain, reader, keys, scope) entry point that reads chain_topology/ chain_sources DIRECTLY (like the emitter’s read_topology_any_state — a new crates/canopy-common/src/chain_append.rs helper, added to Files Touched), runs the SAME confirm ladder (linkage/continuity/check_anchor_by_id/external-evidence) against the installing-epoch genesis anchor, and calls chain_anchor_transition_confirm’s genesis fence arm (D4: `p_lease_token=NULL, structurally fenced on the epoch being installing) — NOT the family-lease arm, because no family pass/lease/checkpoint row exists during installing (the earlier "runs the SAME confirm and calls confirm" glossed this; the fence source is now explicit). It is invoked as an explicit step of the #1279 cutover sequence (which is already a coordinated operation: quiesce → genesis → notarize → CONFIRM GENESIS → activate → reopen) — genesis confirmation belongs there, before activation. This is not a "manual verify" in the deprecated sense; it is a bounded cutover step. The earlier "genesis-confirm now in-process, no manual path" framing is corrected: steady-state periodic_tip confirmation is in-process (the family pass); genesis confirmation is the cutover’s own step.

Appended to family_census_step (same cadence stamp). Combines local integrity + the external frontier:

The landed hardening reconcile raises on BOTH a non-test_% member of canopy_chain_anchor_emitter (:66-75) AND the role itself having LOGIN (:47-55), and re-runs every replay — so neither a member-carrier nor a migration-flipped LOGIN works. The verify side proves the only viable model: canopy_security_verify is flipped LOGIN operationally at #1279 (never in the migration set), so every replay runs with it NOLOGIN and the reconcile passes. The emitter follows this exactly: canopy_chain_anchor_emitter is the login identity, flipped LOGIN+password by #1279’s operational credential-activation step, and stays NOLOGIN in all migration runs. Tested (review S’s "test with the role already LOGIN"): apply the full migration set (role NOLOGIN → reconcile green), then operationally ALTER ROLE … LOGIN, then prove the emitter connects + emits + is refused confirm; and document the cutover invariant — the substrate/hardening migrations are not re-applied against a cluster whose carriers are LOGIN (uniform for verify/incident-admin/emitter; a #1279-wide property, recorded on #1279, tested here). Grants added in D4.

Per ADR-006, the federal floor is a jurisdiction-overridable input, not a source constant; per C7, retention is per-jurisdiction, per-family. #1278 INTRODUCES the chain-retention ruleset key (which #1208/#1247 reuse — one source of truth): a [chain.retention] table in rulesets/{jurisdiction}/jurisdiction.toml with per-family *_retention_years values + a sibling citations.toml entry (ADR-011), bounded below by the family’s federal floor (Pub 1075 §4 5y for FTI; the applicable floor for audit) — the emitter’s boot load rejects a value below the floor.

Enforcement mechanism is pinned by MR-1’s empirical gate (D1): if object_store 0.13.2 exposes per-object Object-Lock retain-until on put_opts, the emitter sets each object’s retain-until from the ruleset value at store time (application-controlled); otherwise the retain-until is a BUCKET DEFAULT set at provisioning from the same ruleset value (documented in the provisioning-requirements runbook, D13) — the ruleset is the single source either way, and the object time ≥ retention is the immutability window that makes "external ahead of local" durable evidence. Object Lock ENABLEMENT (bucket-level) is provisioning (D13); the retention VALUE is ruleset policy (this section).

The parsed chain_anchor namespace + its ObjectStoreConfig derivation live in the shared canopy-anchor-authority crate (D2), env-prefix PARAMETERIZED — so the emitter deployable and canopy-security’s confirmer each construct their own view without either depending on the other’s service lib (a rejection finding: "one struct at SecurityConfig reused by the emitter" would make the emitter compile-depend on canopy-security, undoing the arm split). Validated to capability-specific matrices — every violation a STARTUP error, never a clamp:

Knobs (all CANOPY_ANCHOR_EMITTER… on the emitter deployable / CANOPY_SECURITY… for the confirmer side): CHAIN_ANCHOR_EMIT_ENABLED (false) · CHAIN_ANCHOR_CONFIRM_ENABLED (false) · TICK_MS 15000 (250..=60000) · FIRST_TICK_DELAY_SECS 30 (0..=3600) · EMIT_INTERVAL_SECS 3600 (60..=604800) · SUBMIT_BATCH 4 · CONFIRM_BATCH 4 · STORE_TIMEOUT_MS 10000 (1000..=120000) · ANCHOR_DATABASE_URL (+TANF/MEDICAID per-family, RedactedUrl, lazy) · STORE_{BACKEND s3|local(dev-only via CANOPY_ENV), BUCKET, S3_ENDPOINT, S3_REGION, WRITER_ACCESS_KEY/SECRET, READER_ACCESS_KEY/SECRET, ENUMERATOR_*, ALLOW_HTTP (dev-only), KEY_PREFIX (grammar/length), MAX_OBJECT_BYTES} · AUTHORITY_ID (nonempty ≤128) · EXPECTED_AWS_ACCOUNT_OWNER · SIGNING_KEY (canopy-secrets; .keys/chain-anchor-private.pem dev fallback) · CHAIN_MANIFEST_MAX_LAG 1000000 (≥1, documented SLO derivation) · existing CHAIN_MANIFEST_MAX_AGE_SECS → 21600 with the ≥ 3× emit interval rule.

Access keys/secrets use secret wrappers with redacted Debug/serialize (coding-conventions:304). bucket/prefix/authority_id are IMMUTABLE once anchors exist — a persistent authority-registry row (in canopy_security) rejects a silent trust-domain swap at boot.

At the emitter task’s first pass when CANOPY_ENV != development (fail-closed), under the reserved disjoint {prefix}/_probe/ namespace (never a burnable anchor key; stable canary key, lifecycle-bounded):

Probe failure ⇒ the emitter goes dormant on capped backoff + error! (anchoring fails closed) WITHOUT killing the process. Control-plane facts (Object Lock retention/legal-hold, versioning, the bucket policy, split IAM) are NOT reachable through object_store’s data plane — they are provisioning-time operator attestation (D13). No fake attestation.

Ratified: #1278 does NOT ship production IaC or perform account/bucket/credential provisioning. #1278 delivers: the code (works against any S3-compatible authority), the config surface (D11), the behavioral attestation harness (D12, runnable against a real account as the #1279 go/no-go evidence), the Garage devstack, and a security-operations.adoc provisioning-requirements runbook enumerating what production MUST provide — bucket + versioning + Object Lock compliance mode + the retention default (from D10’s ruleset value) + the bucket policy (require s3:if-none-match; deny DeleteObject/ DeleteObjectVersion/unconditional overwrite; grant reader GetObject+GetObjectVersion+prefix-scoped ListBucket) + split writer/reader/enumerator IAM + the production signing-key generation ceremony. The actual account/credential provisioning is recorded as a deployment concern on the tracker (a separate ops issue linked from #1278), not silently deferred into #1279.

Amendment 10 ratifies (discharging Amendment 6’s delegation): the authority selection (S3-compatible object store over canopy-store/object_store; production = AWS S3, versioning, Object Lock compliance
retention, split IAM, the conditional-write-required + delete-denied policy; Garage devstack functional-not-adversarial); the ENUMERABLE transparency frontier + authority-derived time as the rollback-defeating root of trust; the RFC 7638 kid identity + ANCHOR_SIGNING_VERSION→2 + kid retirement as a signing_key_history.registered_at window checked against the object’s authority time; the unpredictable-recovery-token key layout + envelope v1; monotonic replay protection (enumeration + conditional create + version-pinned reads + confirm-time byte equality); the ordered/linked/fenced/version-pinned confirm contract + failed-anchor evidence path; the anchor census; the anchor_integrity kind + family-global scope + the family-run ok resolution gate; the coverage-lag input + max-age tightening; per-jurisdiction ruleset retention (ADR-006); the separate-emitter-deployable arm split; and the honest attestation split (behavioral probes vs provisioning attestation). It also records that #1280/#1208/#1247 own their own confirm-check arms.

MR-1 (canopy-store): put_create_returns_split_receipt; put_create_conflict_is_already_exists; get_version_pins_the_recorded_version; get_version_detects_new_current_version_and_delete_marker; get_capped_rejects_oversized_metadata_first + …streaming_cap; list_prefix_enumerates; from_config_omits_empty_endpoint_for_native_aws; permission_denied_maps_typed; devstack: garage_conditional_create_probe, garage_versioning_probe, garage_list_probe, object_lock_retain_until_support_probe, provisioned_split_key_roundtrip_reader_write_denied, recreate_and_boot_preserves_the_authority.

MR-2 (crates): p256_jwk_thumbprint_matches_rfc7638_kat (+ leading-zero coords, PEM-norm, wrong-curve/malformed refusal); anchor_kid_is_prefixed_thumbprint; anchor_vectors_regenerate_at_v2; anchor_vectors_kid_is_the_real_derivation; verify_anchor_jws_strict_negatives; object_path_zero_pads_lexicographic (1 vs 2 vs 10 vs 2^53-1); envelope_round_trips_canonically; envelope_rejects_noncanonical/foreign-keys/unknown-version/oversized; envelope_preserves_manifest_bytes_exactly; proptest_envelope_decode_encode_identity; canopy-anchor-authority: store_authority_maps_store_errors_to_authority_errors, store_authority_get_by_version_and_version_gone, store_authority_list_enumerates, chain_anchor_config_parses_under_two_env_prefixes (no canopy-security dep).

MR-3 (substrate): emit_reshape_writes_an_attempt_row_including_on_failed; confirmed_requires_confirmed_attempt_and_prod_version; attempts_are_append_only; recovery_rotate_is_idempotent_by_operation_id; recovery_rotate_fences_on_expected_token; stale_old_token_store_cannot_mutate_after_rotate; recovery_journal_records_actor_reason_incident; anchor_integrity_is_family_global_and_dedups; anchor_integrity_evidence_has_anchor_seq_not_seq (position_seq NULL); confirm_cas_refuses_stale_lease_and_mismatched_fingerprint; emitter_reads_topology_epochs_sources_heads_in_all_three_dbs
emitter_cannot_read_preimage_views (ADR-004); emitter_and_verify_can_read_signing_key_history; signing_key_registration_select_and_compare_rejects_kid_mismatch; retired_kid_refuses_new_anchor_but_verifies_old (registered_at window vs object authority time); genesis_kid_resolves_for_the_genesis_object (first key covers the seq-1 genesis, cross-family); migration_set_replays_green_twice_with_emitter_nologin; emitter_role_login_connect_emit_refuse_confirm; retention_ruleset_key_below_floor_is_rejected.

MR-4 (emitter): emitter_dormant_by_default; emitter_config_capability_matrix_and_redaction; emitter_emits_periodic_tip_after_interval + …skips_recent + …skips_when_installing; cross_replica_emission_race_yields_one; emitter_submits_and_records_full_attempt; crash_replay_adopts_stored_evidence_semantically (kid-rotation-across-crash ADOPTS, no false breach); divergent_object_marks_failed_and_records_attempt; transient_outage_leaves_pending_retry_on_interval; store_timeout_bounded; permission_denied_reattests; sign_failure_leaves_pending; fti_slot_mismatch_refuses; genesis_pickup_via_real_xtask; attestation: conditional_create_enforced, unconditional_overwrite_denied_original_stays_current, writer_delete_denied, reader_write_denied, probe_failure_is_dormant_not_fatal; anchor_key_boot_barrier_blocks_task_start_until_registered.

MR-5 (confirmer/status): confirm_happy_path_advances_trusted_ref_same_pass; confirm_ordered_walk_stops_at_oldest_unresolved; confirm_linkage_and_continuity_enforced (old-prefix rewrite with advanced tip caught); confirm_cas_refuses_lost_lease; confirm_noncanonical_external_ref_or_authority_refuses; confirm_version_pinned_read_detects_new_version_delete_marker_identical_bytes; external_ahead_of_local_latches_rollback (the real anti-rollback defense); local_authority_time_rewrite_is_latched (the D6 step-A discrepancy latch); status_age_from_created_at_is_best_effort_liveness (honest — not claimed to defeat a frozen-confirmer attacker); confirm_genesis_during_installing_before_activation (the one-shot cutover step, genesis fence arm); kid_window_by_registered_at_vs_object_time_refuses_out_of_window; failed_anchor_divergent_object_latches_without_emitter; failed_anchor_error_outcome_missing_object_does_not_latch; unknown_kind_confirm_defers_without_latch; census_detects_local_rewrite/linkage/head_tamper/bad_jws/external_rewrite; census_full_walk_is_bounded_by_anchor_count_no_cursor; census_rejects_oversized_object_metadata_first; coverage_lag_degrades_to_stale_reason_16_while_fresh_frozen_anchors_exist; idle_chain_equal_tips_confirms_clean; manifest_max_age_default_21600_and_relationship_enforced; family_run_ok_gated_on_external_arm_cannot_clear_dormant; anchor_integrity_resolves_only_via_manual_ok_family_run_with_external_checks; status_wire_shape_unchanged_except_additive_reason (insta snapshots green); engine_manifest_check_byte_identical_after_selector_refactor (24-test suite green); arm_split_confirmer_holds_no_signing_key_or_writer_creds; dormant_confirmer_no_activity.