Upload 2 files

RECOVERY.md

@@ -0,0 +1,39 @@
+# Verified backup and recovery
+
+Run from the package directory on Linux, with cryptography installed:
+
+```sh
+python3 bkillings_backup.py backup /var/lib/bkillings/chain.sqlite /safe/location/backup.sqlite > /safe/location/checkpoint.json
+python3 bkillings_backup.py restore /safe/location/backup.sqlite /safe/location/restored.sqlite --checkpoint /safe/location/checkpoint.json
+```
+
+Check the command exit status before treating a backup as successful. Use unique
+filenames; the tool refuses to overwrite existing destinations. Do not redirect
+output onto an existing trusted checkpoint file. Keep the checkpoint in an
+independent trusted location: a checkpoint stored beside a backup is not evidence
+against an attacker who can replace both. It records height, block hash, and
+state/nonce commitment. It is not a Bitcoin anchor or a signed certificate.
+
+The tool uses SQLite's online backup API, verifies SQLite and chain integrity,
+compares the supplied checkpoint on restoration, and publishes a standalone
+mode-0600 database only after verification. Missing or empty source databases
+are rejected rather than initialized. Linux hard-link and directory-fsync
+semantics are required. A filesystem error after publication can leave the
+output present even if the command reports failure; inspect before retrying.
+
+Restore into a new path first. Stop the service before switching its configured
+database path. Check readiness and the expected height/commitment after starting.
+Never replace a live SQLite database or copy just its main file while WAL is active.
+
+Verified September 26, 2026: 26 unittest tests pass, including four new backup
+checks: live-WAL snapshot and restore followed by continued writes; checkpoint
+mismatch refusal; missing/empty input refusal; existing destination preservation.
+The HTTP process restart test also passes. Original pytest baseline tests,
+physical power loss, systemd installation, remote deployment, and off-host
+recovery remain unverified.
+
+Deployment access checked: Hugging Face account BKillings authenticates. The
+current connected credential grants read-repos and jobs but not repository
+write, so it cannot upload this package to a Space. No cloud resources were
+created or changed. Hosting, persistent storage, and remote service checks
+remain outstanding. Existing protocol limitations in PILOT.md still apply.

STORAGE.md

@@ -0,0 +1,28 @@
+# BKILLINGS durable runtime v3
+
+This package adds SQLite storage to the locally tested runtime adapter. It is not deployed.
+
+## Use
+
+Install dependencies from requirements.txt. From the extracted bkillings directory:
+
+```python
+from bkillings_store import BKillingsStore
+from deepcore_blockchain import Transaction
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+
+# Demo key only; production key custody must be configured independently.
+key = Ed25519PrivateKey.generate()
+with BKillingsStore("bkillings.sqlite") as store:
+    tx = Transaction.sign(key, 1, "OBSERVATION", {"value": 10})
+    store.add_block([tx])
+    print(store.snapshot().verified_commitment())
+```
+
+Reopen the same database to recover the chain. Each operation reloads verified state under a SQLite transaction. Writes use BEGIN IMMEDIATE, WAL, and synchronous=FULL. Use one connection per thread or process; separate writers serialize through SQLite. Keep the database on a local filesystem with correct SQLite locking and sync semantics. Back up with SQLite's backup API; do not copy only the main file while WAL is active.
+
+Verification on this turn: 21 unittest tests passed (7 mathematical, 8 runtime integration, 6 storage). The six storage checks cover restart equality, invalid-batch rollback, separate-writer reload, injected SQL failure, stored-commitment tampering, and subprocess termination before commit. The prior turn reported 24 additional baseline tests passing; they were not rerun here because pytest was unavailable.
+
+Run the current suite with `python -m unittest -v test_math test_integration test_store`. Run all tests, including the original baseline, with `python -m pytest -q` when pytest is installed.
+
+Limits: process-exit testing does not establish power-loss durability on every storage device. Stored hashes detect inconsistent edits, not an attacker rewriting all data and hashes or truncating a valid suffix. An empty database initializes genesis; external trusted checkpoints and backups are required to detect deletion or rollback. Full-prefix replay during loading is expensive (quadratic verification work); this is a small-chain prototype. It has no distributed consensus, signer service, persistent key custody, authenticated API, or Bitcoin broadcaster. Existing network-binding and clock-dependent replay limitations remain. No repository, deployment, or live chain was changed.