You Are Because We Ate: A Byzantine Threat Model of the Communal Refrigerator and a Restorative-Justice Protocol for Recovering Stolen Lunches

You labelled the sandwich. You wrote your name on the bag. It is gone anyway. We argue that the disappearing office lunch is not a failure of manners or memory but a security problem, and that treating it as one explains everything you have ever felt standing in front of a shared fridge. We model the communal refrigerator as a distributed system with an untrusted, shared store and at least one Byzantine participant—a coworker who may break the rules for their own benefit while denying it convincingly. Our central result is an impossibility theorem: because a name on a container is a claim and not a proof, no protocol can both correctly identify the thief and never falsely accuse the innocent. Formally, when a label can always be peeled or forged (binding strength $\beta <1$) and the thief always has an excuse (deniability $d>0$), the chance of a just verdict is bounded by $$\mathrm{Pr}[\text{just verdict}]\le \beta +(1-\beta )(1-d)<1.$$ Catching the culprit is therefore not merely hard; it is impossible without accusing someone innocent. Guided by the Southern African ethic of ubuntu—“I am because we are”—we abandon blame altogether and specify RAITH, a restorative protocol that makes the victim whole from a communal buffer and issues zero accusations. Across a 14-week study of 37 real office fridges it cut total lunch loss by 19% while raising measured team trust. One cannot out-secure the lunch thief, we conclude; one can only remove the reward.