1. The blockchain always picks the longest chain signed by valid witnesses that doesn't have timestamps in the future.
When does the client choose a blockchain? Is it always evaluating all possible valid chains? Or rather is it always evaluating all possible valid chains other than ones that would cause it to reorganize from its current chain in a way such that the fork point of the change is older than 1000 blocks? I guess I need to explain that better (see the scenario I describe below).
2. The blockchain maintains an "UNDO" history for the last 1000 blocks which means that if there is a fork it must be resolved within 1000 blocks or manual intervention will be required via a checkpoint. With 1 second blocks this is about 16 minutes *IF* one block was produced every second, but if that were the case there couldn't be a fork. So if w assume "worst case" a 50/50 split in the network, then it would take 32 minutes of un-interrupted hard-forking before manual intervention would be required.
Let's say Alice has the following blockchain stored locally: B1, B2, ..., B1500.
The real consensus blockchain at time T is: B1, B2, ..., B3168.
There is a fake blockchain floating around in the network which first appeared at time T and looks like this: B1, B2, ..., B2000, B2001', B2002', ..., B3200'.
The common fork point between this fake blockchain and the real consensus chain is B2000. After this point this blockchain diverges form the real blockchain. The witnesses (which I will call "fake witnesses" from this point forward) at the time of B2000 continue to be active in the fake blockchain whereas they were all voted out in the real chain and replaced by new witnesses (which I will call "real witnesses" from this point forward) at block B2100 (start of new maintenance interval). Let's assume all the significant votes that caused the "fake witnesses" to be replaced by the "real witnesses" appeared between blocks B2001 and B2099.
This fake blockchain is a valid chain signed by witnesses according to the rules of the protocol following that chain. At time T it is longer than the real blockchain by about 32 blocks because the "fake witnesses" were able to have 100% witness participation while the "real witnesses" were only able to maintain 99% witness participation over the last 1000 blocks. Therefore, by the longest chain rule, people should prefer the fake chain over the real chain, but because the fork point is more than 1000 blocks old at the time T when the fake blockchain appeared on the network, none of the nodes online at that time would be tricked onto that fake chain (am I correct in this understanding?).
Now right around this time (a little bit after time T), Alice connects with the network and starts syncing. She can see there are two blockchains that build off the chain she currently has stored locally and both seem to follow the protocol rules. Does she pick the real chain (B1, B2, ..., B3168), the fake chain (B1, B2, ..., B2000, B2001', B2002', ..., B3200'), does she get stuck at block B2000, or something else entirely? Is the outcome dependent on which blocks she receives first. In other words, what if she gets the blocks from the fake blockchain well before the blocks from the real one. Can she sync to the present timestamp and have her local blockchain become the fake chain, and then later when she gets the blocks from the real chain she rejects them because the fork point is more than 1000 blocks old from her new current head block? And similarly, if she got the blocks from the real blockchain well before the fake one, would she instead sync to the real blockchain and reject the fake one?