[aruintelligence]

Summary

• New opt-in anchored authority stores use checkpoint protocol 2. The external checkpoint commits to a canonical digest of all grant, issuer-epoch, operation, and spent-claim decision records, in addition to the existing sequence and transition head.
• Compute the expected post-write digest before the external compare-and-swap, verify the written files before advancing the local checkpoint, and check the committed state on restart and before authority operations. Unexpected or partial files fail closed.
• Preserve protocol-1 checkpoint stores without a silent upgrade; they retain whole-directory rollback detection only. Document the scan cost, excluded clock/outcome records, and independent-anchor limits.

Evidence

• Child-process tests selectively remove a revocation epoch or spent marker while both checkpoint copies still agree. A fresh worker refuses before the simulated provider callback.
• Grant-value changes and operation loss are detected. A legacy protocol-1 store remains usable.
• npm test: 1,006 passed
• npm run check:links: 411 Markdown files passed
• git diff --check: passed

This is a one-machine pilot, not an independently controlled production anchor. Restoring both the authority and anchor together can still replay a claim; no live provider acceptance is asserted.