Summary

  • LACNIC implemented LAC-2024-4 to publish a historical log of micro-assignments, recoveries and returns from its critical-infrastructure IPv4 reserve, partly to make possible fake-IXP abuse easier to detect.
  • The independently archived 16 June snapshot is valuable but its eight columns describe registration state. There is no event ID, event class, previous state, reason class, rule version or correction link.
  • Keep the snapshot. Add a small, versioned transition stream so that return, recovery, quarantine and correction do not have to be guessed from differences between separately preserved copies.

The blank row does not tell a story

The public file begins with a compact header:

rir|pais|tipo|recurso|cantidad|fecha|estado|orgid

It is a practical inventory. A row for issued space can carry country, address, quantity, date, assigned or allocated state and an organization identifier. A row for unused space can carry an address, a quantity of 256 and the state reserved, leaving the date and organization field blank.

Put one issued row beside one reserved row. The first tells a reader what the registry currently associates with the interval. The second says only that the interval is reserved now. It does not say whether that /24-equivalent has always been untouched, was returned voluntarily, was recovered after a policy process, entered quarantine, left an older aggregation or was corrected after a data error.

Those are possibilities, not allegations about the adjacent row. Nothing in a blank holder field proves that a resource moved at all. The point is narrower: the row has no place to state which event, if any, produced the current state.

That distinction matters because LACNIC did not commission only a remaining-stock table. A 7 March 2026 Common Crawl capture of LAC-2024-4 preserves the proposal independently of the registry's live interface. It records implementation on 25 April 2025 and names three activities: micro-assignments, recoveries and returns. Its rationale came from concern that a fake IXP might get through request controls and receive scarce addresses. WHOIS already exposed registration information, the authors said; a consolidated historical log would make the reserve easier to scrutinize.

The proposal is careful evidence of a threat model, not an incident report. It does not establish that a fake exchange obtained space. It establishes why event history mattered to the authors.

The policy contains verbs; the file contains states

The archived proposal is enough to establish the semantic test. Its operative sentence requires a public log detailing micro-assignments, recoveries and returns from the special pool. It does not prescribe a row schema, event vocabulary, stable identifier, timestamp rule, correction chain or integrity method. Those omissions do not prove a defective implementation. They show that an implementation must choose whether its public object represents current state, transitions or both.

These verbs are not synonyms.

A voluntary return says something about who initiated the movement. A recovery says something about registry action. Quarantine says the resource is not yet equivalent to freely reusable stock. A correction says the public representation changed without necessarily changing control. An assignment creates a holder relation. Each event can lead eventually to a state named reserved, but the route matters for audit, appeal, capacity accounting and correction.

The independently archived 16 June file has eight useful columns and none for that route. Common Crawl's frozen copy contains 423 data rows: 39 assigned, two allocated and 382 reserved. It has no event_id, event_type, previous_status, effective_at, observed_at, reason_class, policy_version, quarantine_until, decision_reference or correction_reference. No native row labels a return or recovery.

This does not make the file false. It makes it a snapshot.

A difference is not an event

A later observer can preserve another copy and compare it with the 16 June capture. That is valuable. It can reveal that the public representation changed, but the comparison remains an analytical act performed outside the publisher's schema.

Let S_t(p) mean the state shown for interval p in the snapshot observed at time t. The analyst can compute a difference:

Δ(p,t1,t2) = S_t2(p) - S_t1(p).

Suppose the result looks like assigned → reserved. The calculation shows a change between two public files. It does not tell the analyst whether LACNIC asserts a voluntary return, a recovery, quarantine entry, correction or changed aggregation. An OrgID change may reflect a registry-record update, not address movement. A disappearing row may reflect a split or merge in representation.

Diffs are observations made by readers. Events are assertions made by the publisher responsible for the ledger. Mixing the two transfers semantic control to whoever builds the scraper.

The distinction is already standardized elsewhere without making that other system a rule for LACNIC. RFC 8182 gives RPKI publication a snapshot and serialised deltas under a session identity. It demonstrates a general point: current state and a declared change record are different objects. This article does not propose copying RRDP or claim that its security model fits the reserve. It uses the contrast only to show that a diff made by a reader is not the same thing as an event asserted by a publisher.

The snapshot already earns its keep

The state file should not be discarded. A 16 July Common Crawl capture of the IPv4 exhaustion page independently preserves the registry's account that the ordinary pool was exhausted in August 2020 and that recovered or returned space and the critical-infrastructure reserve remain distinct moving parts. That is a party statement preserved by an outside archive, not an independent audit of every address.

The frozen 16 June file does a concrete job. It lets a reader reproduce a holder-and-stock view without relying on today's moving alias. The 423-row count and the three visible state labels can be checked against the same bytes by another reader.

That observation layer supports real analysis. A 17 June Common Crawl capture of a 2026 article on IPv6-only IXPs preserves the author's statement that on 9 May the file showed 390 of 512 /24 blocks still reserved: 99,840 addresses, about 76% of the pool. The author used the snapshot as a dated stock measure and concluded there was no immediate exhaustion crisis.

The June archive later contains 382 reserved rows, not the blog's 390 from May. That comparison does not prove eight assignments or any particular event: aggregation and representation may differ. Its value is methodological. A snapshot answers the stock question well. The event question needs another artifact.

A thin transition receipt

The repair can remain smaller than the case file. Publish a current snapshot for fast lookup and a separate append-only stream for public transitions. One event needs these fields:

  1. Stable event ID. A durable identity that readers can cite.
  2. Event-schema version. The rules for interpreting the row.
  3. Resource identity. Address family and exact interval.
  4. Previous state. The prior public state and snapshot identity.
  5. New state. The resulting public state and snapshot identity.
  6. Event class. Assignment, voluntary return, recovery, quarantine entry, quarantine exit, reassignment or correction.
  7. Effective time. Timestamp and timezone for the asserted transition.
  8. Publication time. When the event became observable.
  9. Applicable rule. Policy Manual version and section.
  10. Implementation identity. Proposal or implementation-profile version.
  11. Registry scope. LACNIC, NIC.br or NIC México.
  12. Public holder reference. Organization identity where disclosure is already authorized.
  13. Purpose class. A bounded category such as IXP or other defined critical infrastructure, not an application dump.
  14. Reason class. A privacy-safe code and public decision link where one exists.
  15. Quarantine state. Applicable clock or next-eligible state.
  16. Correction chain. Superseded event, correction, appeal or rollback reference.

This is not a demand to publish fraud signals, contracts, topology, private utilization evidence, legal advice or staff work papers. Nor is it a claim that LACNIC lacks these records internally. It is a minimum public bridge between the verbs in policy and the states in the file.

RFC 3339 supplies an interoperable timestamp profile; RFC 5848 shows how ordered log messages can be chained for integrity; and the W3C PROV data model separates entities, activities and agents. None governs LACNIC's reserve. Together they show that time, order, provenance and correction can be represented without publishing an applicant's private file.

The design boundary follows HENG.LU Note 64. Minimum does not mean vague. A common layer should specify only what uniqueness, interoperability, shared safety and security require, but it should specify those few objects deterministically. Stable identities, transition rules, versions, correction links and portable audit artifacts fit that test. Business plans and discretionary merit evidence do not.

A registry can describe the transition it asserts without ruling on the public worth of the organization. That is the difference between making the ledger replayable and making the ledger a throne.

Sources

Evidence limits

Verified: the independently preserved proposal names assignments, recoveries and returns; the independently preserved 16 June header does not contain an event class; and the preserved 2026 analysis used the file for dated stock accounting.

Inference: snapshot differences cannot authoritatively distinguish event meaning without publisher-defined semantics.

Recommendation: retain the snapshot and add a versioned transition stream, data dictionary, integrity metadata and test vectors.

Unknown: whether a complete internal event ledger exists, whether any fake IXP ever received space, which public rows—if any—represent returns or recoveries, why the public schema was chosen, whether the schema changed after 16 June, and the exact current pool balance.