The extra
promise.

Every customer can hold an authentic digital entitlement while the issuer has promised more than it can deliver. A credible scarcity claim needs evidence about the other outstanding promises, and a rule connecting that evidence to what the service will honour.

Suppose a computing provider offers 100 identical, exclusive execution slots for the same hour. Each purchase guarantees one slot. It issues 110 distinct signed reservations, without cancellations or additional capacity. Every signature verifies. Each reservation is presented only once. The problem appears when all 110 customers ask for the performance they bought.

The earlier article, Private proof, scarce access, introduced the need to constrain issuance. This hypothetical example develops the supply question across the issuer’s complete set of commitments. The customer needs to know both what her entitlement permits and whether the issuer has created incompatible claims against the same resource. Public research on tamper-evident records, privacy-preserving accounting and institutional commitment helps specify what evidence could answer that question.

Count the obligation that remains

A supply limit needs a unit and a period. In the example, the relevant unit is one exclusive execution slot in a specified hour. A reservation for tomorrow, a place in a queue and a best-efforts request belong to different commitments. Combining them under a single token count would conceal the condition the customer cares about.

The count must also follow the entitlement through its life. If 100 reservations are issued, 20 are validly cancelled and 20 new reservations are sold, there have been 120 issuance events but only 100 outstanding reservations. A transfer between customers should preserve that outstanding total. A replacement credential should preserve the underlying claim while making the superseded credential ineffective.

For this arrangement, I would reconcile the opening obligations, new obligations and valid releases for each resource and time period. The rules must define when a release takes effect and how disputed cancellations are treated. A convenient total computed from incomplete events cannot establish the commercial promise.

Give the history a checkable form

Crosby and Wallach’s Efficient Data Structures for Tamper-Evident Logging studies an untrusted logger challenged by auditors. Its tree-based construction supports compact proofs that a recorded event remains present and that a later history agrees with an earlier commitment. These are specified properties of a recorded history, under the paper’s cryptographic and auditing assumptions.

Applied to the reservation example, a customer could retain evidence connecting her purchase to a particular published history. An auditor could check the history’s continuity and reconstruct the outstanding total from the disclosed events and rules. The application still needs its own event format, authorisation checks and accounting logic. A log entry saying that a cancellation occurred is evidence of a recorded assertion; determining whether the cancellation validly released the obligation requires the corresponding authority.

The distinction matters commercially. An issuer might produce a perfectly consistent history containing 110 reservations. The history has made the excess visible. Preventing that excess, allocating the resulting shortfall and compensating affected customers remain separate responsibilities.

See what transparency has already exposed

There is public operational evidence that logging can make issuer mistakes visible. In September 2015, Google reported discovering an unauthorised Thawte-branded Extended Validation precertificate for its domains through Certificate Transparency logs. Google said the issuance arose during an internal testing process and that it updated Chrome’s revocation metadata.

That is a documented detection episode in certificate infrastructure. It establishes neither the effectiveness of every transparency deployment nor the reliability of the proposed reservation market. Its relevance is concrete: an organisation outside the issuer could observe an issuance it had not authorised and respond.

The later RFC 9162 specifies Certificate Transparency version 2 as an Experimental protocol. It distinguishes a signed promise of future inclusion from a proof that an entry is included, requires each log to commit to a Maximum Merge Delay, and assigns monitoring and auditing roles. It also identifies inconsistent views served to different parties as a threat; cross-client comparison mechanisms are outside its specification. The 2015 episode predates this version.

Close the gap around the record

Now suppose the provider logs 100 reservations and issues ten more through an administrator’s exception route. All customers whose purchases appear in the log can obtain valid inclusion proofs. The missing customers are the very people that those proofs do not describe. Checking one included purchase cannot discover an obligation that never entered the record.

For the proposed service, I would make the connection between issuance and acceptance explicit. Each route that can create an enforceable service claim should leave evidence in the same accounting arrangement, or in another arrangement whose totals are reconciled with it. That includes direct sales, reseller allocations, replacements and administrative exceptions. Customers need a usable route to challenge an omitted claim.

Refusing every unlogged credential at the execution boundary could limit which claims receive service. It would still leave a customer harmed if the provider had accepted payment and promised performance through an unlogged route. A technical rejection cannot settle that dispute. The sales process, customer evidence and remedy must therefore be tested alongside the admission check.

Timing creates another exposure. If a design lets a newly issued reservation circulate before its inclusion is verified, the provider must specify who carries the risk during that interval. Waiting for verification may delay the sale. Proceeding immediately may enlarge the set of commitments awaiting independent inspection. The appropriate choice depends on the promised service and the consequences of a failure.

Make aggregate scrutiny compatible with privacy

Publishing a readable list of every reservation could reveal customers’ projects and operating patterns. The evidence needed to check an aggregate constraint may be narrower than the information in each commercial relationship.

Provisions, by Dagher and colleagues, develops privacy-preserving proofs comparing a Bitcoin exchange’s assets and customer liabilities. The authors give a construction and prototype evaluation. Their stated limitations include customers checking their own inclusion and the inability of a proof to guarantee future honest conduct. This is research about a specified financial-accounting problem, with assumptions and implementation constraints. Any implementation would need a construction-specific security review; a prototype alone cannot settle that question.

For a reservation service, it suggests a direction to investigate: allow customers to verify their own claims while disclosing less about other customers. It does not supply a ready-made proof of computing capacity. Hardware availability, competing uses and the validity of a release require evidence appropriate to those facts. A private arithmetic check is useful only when its inputs represent the obligations and resources being compared.

Identify who can redefine the promise

My paper, Beyond ‘permissionless’: governance, commitment, and rule change in public blockchains, examines the exposure created when participants make system-specific investments while other actors retain authority to revise the rules. Its eight-system institutional comparison motivates a commitment argument. Publication does not make that argument correct by itself; the reasoning and case evidence must bear the claim. The study does not estimate the effect of transparency on reservation markets.

Applying that question here means examining who can increase the cap, alter the definition of a slot, recognise an exceptional claim or replace the auditing arrangement. A provider could preserve every historical entry while changing the promise made to existing customers. Recording the change would make it visible without deciding whether it was permitted.

There are legitimate reasons to change a service. Additional capacity may support more reservations; a failure may require a revised schedule. The relevant commitment should describe the authority, notice, customer choices and remedies for those changes. Rigidity has costs too. The research question is which constraints make the particular exchange dependable, and what those constraints cost.

Evaluate the market, including the cost of checking

The possible applications extend to reserved cloud capacity, limited software seats, venue admission and prepaid service allowances. Each has a different reason for limiting supply. A firm guarantee against a fixed resource differs from disclosed overbooking based on expected non-use. Either arrangement needs terms that let customers understand what happens when demand exceeds available performance.

An auditable issuance history could help a purchaser assess that exposure or help a reseller reconcile the inventory it is authorised to sell. Those are potential benefits. They should be compared with the cost of producing evidence, checking it, protecting commercial information and resolving exceptions. Monitoring also needs someone willing and able to do it. A public record that no relevant party examines supplies a weaker commercial safeguard than its mere availability suggests.

A useful evaluation would compare the proposed design with an ordinary access-controlled booking database and independent reconciliation. Both should face the same service guarantee, workload and failure scenarios. The comparison should include omitted sales, two inconsistent histories, false cancellations, duplicated replacement claims, delayed evidence and an authorised capacity increase.

I would measure excess outstanding commitments detected before the service deadline, valid customer claims wrongly excluded, detection and repair time, service actually delivered, information disclosed and total operating cost. A second test should remove capacity after a clean audit. That distinguishes an accurate account of yesterday’s promises from the ability to perform tomorrow’s service.

The result sought is a defensible connection between the right a customer holds, the other claims that compete with it and the resources and institutions standing behind it. The technical ingredients are public; this commercial application and evaluation remain proposed. Following the extra promise from sale to remedy makes the scarcity claim specific enough to test.