anchor.diff:                                                                 ?RETURN2(true))
               end;
           Else ->
  -            ?RETURN2(Else)
  +            if HasInner1 and (not HasInner2) ->
  +                    %% OK, imagine that we used to be flapping but now we've
  +                    %% stopped flapping.
  +                    %%
  +                    %% P1 = outer = upi=[a,d,e],repairing=[]  epoch 870
  +                    %%      inner = upi=[a,e,d],repairing=[]  epoch 605
  +                    %% to
  +                    %% P2 = outer = upi=[a,e,d],repairing=[]  epoch 875
  +                    %%      inner = undefined
  +                    %%
  +                    %% Everyone is using the inner projection [a,e,d],[],
  +                    %% everyone thinks that that is OK. It has been in use
  +                    %% for a while now.
  +                    %%
  +                    %% Now there's a new epoch, e875 that is saying that we
  +                    %% should transition from inner e605 [a,e,d],[] -> outer
  +                    %% e875 [a,e,d],[] This is SAFE!  The UPI is the *same*.
  +                    %%
  +                    %% Verify this Inner1->P2 transition, including SI epoch
  +                    ?RETURN2(
  +                       projection_transition_is_sane_final_review(P1, P2,
  +                           projection_transition_is_sane_with_si_epoch(
  +                            Inner1, P2, RelativeToServer, RetrospectiveP)));
  +               true ->
  +                    ?RETURN2(Else)
  +            end
       end.
   
   projection_transition_is_sane_final_review(
  
positive.code:     #projection_v1{author_server=Author_latest} = P_latest,
      {Epoch_latest,_} = EpochID_latest = machi_projection:get_epoch_id(P_latest),
      Trigger = if CMode == cp_mode, EpochID_latest /= EpochID_current ->
                      ?REACT({a29, ?LINE,
                              [{epoch_id_latest,EpochID_latest},
                               {epoch_id_current,EpochID_current}]}),
                        true;
                   true ->
                        ?REACT({a29, ?LINE, []}),
                        false
                end,
      if Trigger ->
              ?REACT({a29, ?LINE,
                      [{old_current, machi_projection:make_summary(P_current)}]}),
              if Epoch_latest >= Epoch_current orelse Epoch_latest == 0 orelse
                 P_current#projection_v1.upi == [] ->
                      ok;                                 % sanity check
  
negative.code:     %% We won't check the checksum of P1, but we will of P2.
      P2 = machi_projection:update_checksum(P2),
  
      %% CP mode extra sanity checks
      if CMode1 == cp_mode ->
              Majority = full_majority_size(All_list2),
              if length(UPI_list2) == 0 ->
                      ok;                         % none projection
                 length(UPI_list2) >= Majority ->
                      %% We have at least one non-witness
                      true = (length(UPI_list2 -- Witness_list2) > 0);
                 true ->
                      error({majority_not_met, UPI_list2})
              end;
         CMode1 == ap_mode ->
              ok
      end,
  
      %% Hooray, all basic properties of the projection's elements are
      %% not obviously bad.  Now let's check if the UPI+Repairing->UPI
      %% transition is good.
  