What's changed

C3 / R2.2 re-ruling fold-in: the reconstruction gate is now VALUE-shaped (blind PE re-ruling at 81d39c0, MERGEABLE-WITH-ONE-CHANGE). The gate's docstring claimed "a future edit that republishes the same information under a different name must redden here"; its solver decoded exactly two JSON keys by NAME. The PE republished the identical Gini on the same unauthenticated document under workConcentration, changed nothing else, and recovered the secret 987654321 exactly — while the R2.2 suite stayed ok and the document still said countersWithheld:true. That is the third instance in this repo of a privacy gate keyed on a field name or a fixture value rather than on the property, so the rule is now stated where it belongs: a gate against a RECONSTRUCTION cannot read key names. The solve walks every numeric leaf of the served JSON at any depth and tries the recovery against each, reading no key at all — not even the sample size, because the ADVERSARY KNOWS n, having planted n−1 of the terms itself. Three evasions are encoded as their own arms rather than trusted to prose: the RENAME (the shape that slipped), SELF-EXCLUSION (the previous round's hand-run H2 measurement, promoted to a permanent arm so "dropping self is not a fix" survives without re-running it), and the WHOLE GET SURFACE, since a value moves to another route as easily as another key and the two existing whole-surface scans cannot see this one — they match integer equality against fixture constants and a Gini is a fraction. What that last arm does NOT cover is written down beside it, because overclaiming coverage is the mistake being corrected. R-C3-KNOWNPEERS-SIZE-OPEN — pinned, not withheld. The withhold drops sample.size calling it "half of the equation", and that half is already open two routes over as /api/status's network.KnownPeers. Pinned on the shape of the attack rather than the sensitivity of the number: size alone is not an equation, the only party who could use n already knows it, and /api/status publishes a peer count openly by design — a second withhold beside it would be a withhold in name only. The honest invariant is the PAIR, so the gate asserts both halves and reddens if a withheld document ever regains its sample block. R-C3-SERVEGINI-STEERABLE — the sentence was wrong, the discriminator is not. serveGiniScope claimed excluding a peer "UNDERSTATES inequality, which is the safe direction"; true of the exclusion rule alone, FALSE of the composite under an adversary, because a peer reporting ONLY repairs is admitted as reporting and lands a zero in the SERVE series — 20 free identities moved a perfectly even network from 0.0000 to 0.8696, reproduced exactly and now encoded as a test so the disclosure and the behaviour cannot drift apart. Both scope strings now say Sybil-settable IN EITHER DIRECTION, and repairGiniScope gains the caveat its sibling carried plus a note that it is the more sensitive of the two. The discriminator stays PER-PEER: per-series membership would close that one lever and cost the repair alarm outright (repair concentrated on one of six capable nodes becomes a one-element series, falls under the floor and renders "sample too small", so the capture case reads as no-data), and it buys nothing real because a sybil can declare any positive servedBytes and steer the same number just as freely. The lever is not the discriminator, it is that every term is self-reported. R-C3-WIRE-SINGLE-WRITER — taken. The M-1 gate is a composition across two packages and its joint is that nothing else produces the wire value; a future toWire deriving the field from elsewhere would break it with BOTH halves still green. The new source gate enumerates every production assignment to either field as an EXACT SOURCE LINE — counts per file would let one assignment be swapped for another silently — and lists the two EconomySelf local-exact reads too, so the set is the whole truth rather than a filtered view. Four controlled reverts run RED: the rename (K1), the withheld document regaining its sample block (K2), a second production writer (K3), and gossipWithheld → false re-run (H1). Deliberation: docs/thinking/2026-09-09-c3-review-foldin.md §9.

C3 / R2.2 review fold-in: -privacy now governs the WIRE as well as the HTTP surface (blind PE ruling RULING-c3-r22-observability-f03ab50-2026-09-09, blind red-team REDTEAM-c3-gossip-disclosure-f03ab50-2026-09-09, research certification C3-GOSSIP-DISCLOSURE-vs-D-UI-PRIVACY-FLAG-2026-09-09). OWNER RATIFICATION REQUIRED BEFORE MERGE — the certification GATES the gossip half and drafts the sentence in its §7. The break. /api/economy/concentration shipped OPEN on the argument that self's own bytes being one term inside the sample made the aggregate safe. That argument was FALSE and two blind seats refuted it with working solves: minGossipSample bounds the sample SIZE, not the number of terms the READER does not already know, and identity is free — so an adversary furnishes n−1 of the n terms with sybils gossiping chosen values and the published (Gini, size) is one equation in one unknown. The red-team recovered a planted 7,777,777 exactly through the real Node.EconomySample; the PE recovered 987,654,321 with error 0. The recovered quantity is bit-identical to the counter -privacy (the compiled default) nils for that very reader. Three amplifications decided the shape: the recovered term NEED NOT BE SELF (any open-route node is an oracle for its PEERS' withheld counters, so "drop self" is not a fix), the counters are MONOTONE so re-solving yields an activity timeline, and repairGini fingerprints the load-bearing repairers. The fix. Both gossip-estimated routes honour the SAME privacy clause as the rest of the read surface — auth.privacy && !auth.token, byte for byte readerView's predicate — under the same countersWithheld marker, because this is the same covered set one derivation removed. Still open, each for a stated reason: the published bands and the target ratio (constants), the committed-global C2 block (chain-derived, unforgeable via gossip), and estimatedNodes (the SAME number /api/status publishes in network, pinned by a gate so the claim cannot rot). The gossip half is built to the certification's alternative A: Config.PublishWorkCounters gates the stamp and THE ZERO VALUE IS THE WITHHOLDING ONE, so a caller that forgets the field leaks nothing; cmd/silt sets it from -privacy, now parsed before the node config. This matters more than the HTTP half — -ui is empty by default, so a hobbyist daemon with no HTTP surface at all was publishing to every DHT peer, the exact node D-UI-PRIVACY-FLAG was ratified to protect, and D-STATUS-SNAPSHOT-INTERVAL ratified the 5 s snapshot as a SECURITY parameter precisely because "the poll rate is the reader's choice, so that was never a bound". M-2 needed more care than dropping zeros: both wire fields are omitempty, so a withholding peer and an idle peer are the same bytes and counting the absence as zero drives the serve Gini toward 1.0 (a false total-capture reading on the shipped default) — but a blanket zero-drop would have destroyed the alarm, collapsing "repair concentrated on one of six capable nodes" to a one-element series. THE DISCRIMINATOR IS THE PAIR, NOT THE FIELD: a peer that serves but never repaired emits key 29 and not key 30, so it is a REPORTING peer and its repair zero is a real measurement; only the all-zero peer is ambiguous and only it is excluded. Each series now carries its own size against its own floor with its population named on the wire. Three more blockers closed. B1: the pooled flow row differenced two whole-sample totals while each object row differenced from its FIRST APPEARANCE, so a root cared for mid-window put its whole pre-window inflow into one window (measured: pooled net 5000 while every row it summed reported 0) and, because pooled steps drive Draining, an entry MASKED a real drain and a departure LATCHED a false one; pooled is now derived from the object rows, so a pooled figure that is not their sum is impossible by construction rather than by a second guard. B2: credit.Gini returns 0 both for a measured equality and for a zero sum, and eight peers reporting nothing published 0.0000 · gossip-estimated over 8 nodes — giniValue now carries known, and render.js's gossipCell takes the whole block rather than a bare number because a value of 0 is falsy and the old signature could not express the one case that must not render. B4: the counters were labelled "lifetime" but D-FP2-SCOPE keeps the ledger ephemeral through the RC, so they reset at every restart and a concentration measure over them partly reflects uptime; the epoch caveat now RIDES the number, on the wire and in the panel. Also recorded: the reset HURTS rather than helps — it hands an observer a known zero baseline, removing the differencing step, and via omitempty makes every restart an unforgeable beacon. Simplicity ruling taken: economyGNet (a type documented as never constructed) deleted, and the ring's two per-sample maps merged into one. Ten controlled reverts run RED (G1, E2, E3, H1, M1a, M2a, M3a, J1, J2) — plus H2, which is GREEN on purpose: dropping self from the sample does NOT redden the reconstruction gate, which is the measurement behind "the recovered term need not be self". The gate asserts the RECOVERY fails, not that a named field is absent, and lifts the red-team's solver rather than reimplementing it, with two positive controls (tokened, and -privacy=off) that must still recover the secret. Deliberation: docs/thinking/2026-09-09-c3-review-foldin.md.

The full economy-observability set (Lane C3, R2.2; Economist advisory ADVISORY-boulder2-telemetry-spec-R2.4-checklist-and-RC-scope-2026-09-07 §2, 16 of its 17 rows — row 3, the prepay/skim split, shipped with C4). Four new read-only GET routes on apiRoutes, two new gossip fields, one new non-registering ledger read, and a dashboard page. The honesty rule the whole set turns on: every field carries a knowability tier, and a number we do not have has exactly three legitimate renderings — absent with a named reason, "sample too small", "not yet measurable". A zero is none of them. GET /api/economy/flows and GET /api/economy/g difference a bounded ring of escrow snapshots (depth 24, one sample per 6 min — the advisory's measured epoch rounded up) appended from the status snapshot that already recomputes, so no timer, no goroutine, and all three documents difference ONE reading of the ledger. Before two samples exist the pooled row is ABSENT with windowNotYetMeasured, never a 0 net: a zero on a draining node is the silent-loss shape. credit.G returns 0 for both "cost did not move" and "cannot be computed", so each row carries known and, when false, the reason. Row 5 (network aggregate g) is UNBUILDABLE and ships as a named absence rather than a substitute: g needs credits-paid-per-repair, gossip carries repairs-done (the denominator) and row 10 forbids a third gossip field, so networkNotKnowable carries that derivation on the wire. Rows 8-9 add EXACTLY TWO gossip fields — ports.Message.ServedBytes / RepairsDone, CBOR slots 29/30, omitempty, additive (an old decoder skips them). They ride WITH the capacity pledge and are filed under the existing CapTotal > 0 condition, so the work sample IS the capacity sample and every member is classifiable; the bound is the existing peerCaps / evictPeerInfoIfFull / maxPeerInfo, two int64s per existing entry and no new peer-keyed map. Both are node-wide with no object axis and no fetcher axis, so neither carries the (fetcher × object) join Don't #3 forbids. Row 10 adds no third field: the tier class is DERIVED from the gossiped CapTotal against bands published on the wire with their source — pony < 16 GiB, horse to < 1 TiB, archival above, read off the Economist tier table's "16+ GB disk" and "TBs". A presentation band over a self-reported number: not a role, not a security parameter, and a node can lie into any band for a wrong dashboard. GET /api/economy/concentration carries the advisory §2.1 correction: the design doc's own network-wide repair-Gini gate is VACUOUS, and the build measures it rather than quoting it — on the healthy vision shape (60 ponies at zero repairs, 6 horses repairing evenly) the network-wide repair Gini is 0.9091 while the repair-capable subset's is 0.0000, so a threshold that passes one fails the other on the same healthy network. The repair series is therefore scoped to the horse+archival subset, carries that scope on the wire, and still reddens on total capture (0.8571). Serve-work stays over the whole sample. C2 rides beside them as committed-global, absent-with-a-reason without a chain, and publishes weightUniformity because HHI, Gini and TopShare are all blind to an equal-bond split. minGossipSample = 3 is derived, and is a privacy floor as much as an honesty one: at n=1 a Gini is 0 by construction and at n=2 it INVERTS to the ratio of two named peers' counters, so below 3 no estimate is published at all — which is what lets concentration and network stay open on the unauthenticated wire while flows and g are token-gated in full, pooled row included (on a one-object node the pooled delta IS that object's delta — the mistake selfFunding shipped with). credit.Ledger.WorkSample is a NON-registering read, classified neutral: ServedBytes/RepairsDone go through acct → Register, which creates an account and, on a faucet-configured ledger, increments grantsPending — so stamping gossip through them would mint an account as a side effect of sending a FindNode. Panels 1-4 ship as cmd/silt/ui/economy.html over pure render.js functions, so the honesty rules are testable and a withheld block cannot abort the page: horizon renders "not yet measurable" and never "perpetual" and never green; cost is an operator query parameter and never persisted; the wash panel says "suspected" and never claims a finding. The whole-surface route constant moved 7 → 11 with each route's examination written beside it, and because both existing scans pin ONE instant (so the ring holds one sample and the gated routes are vacuous there), TestR22FlowsAndGAreTokenGatedAcrossAMeasuredWindow drives a real four-sample window before walking the untokened surface. Thirteen controlled reverts run RED, including the one that matters — leaving the pooled row open while withholding only the array — and one vacuous gate was caught in the act: an omitempty assertion comparing frame LENGTHS stayed green under the revert that deletes omitempty, and was replaced by an exact scan for keys 29/30 in the raw CBOR map. Deliberation: docs/thinking/2026-09-08-c3-r22-observability-build.md.

R2.7 blocking telemetry — the affordability floor (Lane C4, Economist advisory ADVISORY-boulder2-telemetry-spec-R2.4-checklist-and-RC-scope-2026-09-07 §1.3). spendRefusedInsufficientCredit (every refusal) and spendRefusersDistinct (identities refused at least once) on credit.Ledger. The ledger has THREE spend gates and all three refusal DECISIONS are counted: ChargePublish and FundEscrow count at their own refusal branch, and CanPublish — which is a PREDICATE and must not count, because sim/economy.go calls it for display and a counter that moves when a dashboard reads it is worse than a missing one — is counted at the one place that turns its false into a refusal, registry.Gated.Publish, through the exported Ledger.NoteSpendRefused reached by an optional interface so ports.CreditLedger stays the consensus-relevant surface. Missing that third decision made the floor under-read beneath a HARD canary abort (ROADMAP C6 aborts on any rise in spendRefusersDistinct), and sim/economy.go grades FreeloadersRejected off exactly those refusals — so the floor would have read zero beside a non-zero rejection count in the tier R2.7's adversarial workload runs in. Distinct identities are counted the way grantDenied already does: ONE BOOL on the account, never a side set, so it cannot become a grow-only map. Every other counter in the ledger measures a flow that happened; this is the only one that measures the flow that was REFUSED at the affordability floor, which is build-immutable #4's exact failure mode and the failure R2.7 is most likely to miss — an economy reads solvent when nobody can afford to transact. Surfaced in the faucet block on GET /api/status beside grantsDenied. It ships on BOTH branches of that block, configured faucet or not: these are refusals for want of CREDIT, not for want of a token, and dropping them on the unconfigured branch would be a silent loss (Don't #4) on exactly the default posture. spendRefusalNote ships beside the numbers so no reader can quote them without the caveat — this is a FLOOR detector: a non-zero value proves honest demand is being refused somewhere and can abort a canary; a zero value certifies NOTHING, because an adversary inflates the number at will with underfunded identities. Gates, each run RED under a controlled revert: TestSpendRefusalsCountDistinctIdentitiesNotRetries (five retries by one identity count five and one; a later success decrements neither), TestAffordabilityFloorReachesTheStatusSurface (the wire half, on the unconfigured-faucet branch) and TestGatedPublishRefusalMovesTheAffordabilityFloor (the third gate, with an arm asserting that three pure CanPublish READS move nothing).

R2.7 blocking telemetry, detector A4 — escrow laundering by self-repair (Lane C4, Economist advisory ADVISORY-boulder2-telemetry-spec-R2.4-checklist-and-RC-scope-2026-09-07 §1.2). The advisory's bountyPaidToEscrowFunder is DEGENERATE — every credit entering an escrow on a silt ledger is placed there by that node itself, so "the payee also funded this escrow" reduces to "the payee is this node" — and it is replaced by three parts, none of which needs a (fetcher × object) join (that join is the access record Don't #3 forbids). A4-1: objectEscrow.funded splits into fundedPrepay (FundEscrow) and fundedSkim (RecordServeToObject, SettleDelivery); reverseLane claws back the SKIM leg only, because a reversal only ever undoes a serve's own auto-skim. The published funded is now DERIVED from the two legs rather than a third accumulator, and its value does not move. The wash loop's recoverable money is the skim, so without this split "escrow recovered by self-repair" has no denominator and the S5 qualifier cannot be evaluated at all. A4-2: Stats.BountyPaidToSelf and Stats.BountyCreditsPaidToSelf on the NODE (the ledger does not know its own id), fired in settleRepairVerdict where the bounty pays and both n.id and claim.Holder are in hand. claim.Holder is attacker-declared on an inbound MsgRepairClaim and nothing refuses a claim naming the judge itself, so this is reachable; an honest judge never pays itself, so any non-zero value is the self-dealing shape. A4-3: BountyToPriorFetcher on credit.Ledger — bounties released to a repairer with fetchedBytes > 0 at payment time, read off account state that already exists, adding no map. It is a SHAPE, not a detection: a repairer may legitimately have fetched survivor shards from this judge, so it ships with its honest limit on the wire and is never a slashing or disbursement input. Surfaces: A4-1 on durability.objects[] (fundedPrepay / fundedSkim) and on /api/economy/self as prepayIn / autoSkimIn beside the combined skimIn, both already token-gated; A4-2 on the stats block; A4-3 on economyRevenue, which is REBUILT rather than passed through in withheldEconomySelf — the allow-list sits at the economySelf field level, so a field added inside economyRevenue would otherwise ship open, and a bounty-out figure on a one-root node is that root's withheld objects[].bountyOut. Gates, each run RED under a controlled revert: TestEscrowFundedSplitsPrepayFromSkim, TestBountyPaidToSelfCountsTheJudgeAsHolder (its third-party arm is the ablation), TestBountyToAPriorFetcherIsFlaggedNotBlocked (both payments settle identically — flagged is never blocked), and TestR27A4PriorFetcherCreditsAreTokenGatedOnTheWholeSurface, the wire gate on the token gate itself: a fixture that pays a real bounty to a prior fetcher, a TOKENED positive control first, then the untokened 0 / 0 plus the named withhold, then a scan of every number in every untokened GET body on the real apiRoutes table. It is a SIBLING of the existing whole-surface F2 scan rather than an edit to it: that scan's strength is that at paid == 0 the per-object reserve, net and skimIn are all aliases of funded, so four aliases ride one scan — and paying a bounty in its fixture would destroy three of the four. The two share one r29aWholeSurfaceGETRoutes constant, so adding a GET route reddens both until it has been examined against each scan's property.

R2.7 blocking telemetry, detector A2 — supersede suppression (Lane C4, Economist advisory ADVISORY-boulder2-telemetry-spec-R2.4-checklist-and-RC-scope-2026-09-07 §1.1). Three node-wide int64 counters on credit.Ledger — serveBytesObjectAware (RecordServeToObject), serveBytesWitnessed (SettleDelivery, on the clamped ack, before the full/partial branch) and serveBytesLaneEvicted (laneFor, the FIFO confiscation at the maxProvisional cap) — plus the live-lane sum taken on the walk ServeMintStats already makes. They satisfy an exact conservation identity, objectAware == witnessed + laneEvicted + inFlight, and that identity is the test. servedBytesUnwitnessed, servedBytesUnwitnessable and receiptCoverage are DERIVED at the read and stored nowhere: a second accumulator for a residual invites drift between two write paths. Coverage's denominator is object-aware bytes, never total served bytes, so a node serving manifest chunks (no root, never witnessable) is not penalised. The Economist's spec named a fourth counter, serveBytesSupersededFlat, on the flat leg's supersede block and said in the same sentence that it "is deleted with the leg" — Lane C1 deleted the leg, so the identity has three terminal terms and no permanently-zero counter ships. All seven fields ride the existing serveMintWithheld + countersWithheld markers on GET /api/status; no new marker, no new withhold clause, and no identity or object axis anywhere (Don't #3). Gates: TestServedByteSplitIsExactAcrossEveryTerminalState, TestEvictedLaneBytesAreCountedForfeitedNotWitnessed, TestSuppressionShowsAsCoverageBelowOne (the RED-first proof that the two arms do not read the same), each run RED under a controlled revert of its increment site. serveMint.laneOn ships beside the coverage figure: a zero coverage means one of THREE things, and the third is the DEFAULT posture — a node that does not run -accept-delivery-receipts never calls SettleDelivery, so it prints receiptCoverage: 0 beside a large serveBytesObjectAware while behaving perfectly. ROADMAP C6 makes coverage below 0.75 a machine-read canary abort and the RC ships default-OFF, so without the lane state every honest RC-default node would trip it. Same shape and same reason as economySelfFunding.bountyOn for -economy; gated by TestCoverageZeroIsDistinguishableFromTheLaneBeingOff, whose two arms differ only in the lane flag. Coverage is documented as a LOWER BOUND, not a rate: in-flight and evicted bytes sit in the denominator and never the numerator, so the honest reading is the band [witnessed, witnessed+inFlight] / objectAware — both ends published — and an abort belongs on the upper end. The formula is deliberately not re-based on terminal bytes only, because a single re-based number would hide the band's width from the grader whose rule is the band. TestServedByteSplitIsExactAcrossEveryTerminalState now also drives the PLAIN path, which is the clause that justifies the object-aware denominator and had no test: a manifest serve must move servedBytesUnwitnessable and leave a fully-witnessed node's coverage at exactly 1.0 — under a denominator of total served bytes it falls to 0.727 on a node doing honest work.

Cloud field test: the R2.9 paid delivery lane is on the graded sheet (flow_delivery_lane, rows 13-delivery-lane / 13b-delivery-settlement). topology.py arms -accept-delivery-receipts -delivery-idle-window 90s -grant-capacity 64 -grant-per-hour 64 on the boot validator (the token issuer; the faucet bucket sits 5× below the daemon's derived capacity cap, not at 78 % of it); the flow publishes from fetch-1, fetches back, and presents swarm receipt against the boot validator and against a lane-off store. It is ERA-AWARE and honest: on every real network until the R3.4 stamp raise era-4 is dark, so no E→key binding can commit and the positive settlement has no live seam — row 13 grades the lane's field contract (armed by the unit's argv + announced by the boot banner read over the WHOLE journal; the client refused at the withdrawal naming the committed binding, nothing spent, the server's debug.log carrying no banked line after the flow's baseline; the lane-off server answering with the NOT-banked marker; the two refusals never conflated), and row 13b is a SKIP behind that era probe (the RC gate stays reachable) that grades the wire settlement at the stamp raise with no harness change (delivery receipt banked + the idle delivery session closed, both debug.log lines — n.logf output never reaches journald). Substrate noise GAPs, never FAILs; the client call is retried before it is classified. Blind PE ruling silt-reviews/principle-engineer/RULING-cloudtest-delivery-lane-flow-34114c4-2026-09-07.md (BLOCK on the first cut: the banner read through the 800-line journal window and every server-side marker read from the wrong surface) folded in full. LOCAL proof: the new e2e TestPaidDeliveryLaneArmsInTheHarnessPosture (the harness's exact objective-path argv, epoch clock DERIVED, the real CLI, the refusal named, nothing banked) plus TestPaidDeliveryLaneRefusesWithoutACommittedKeyBinding, TestDeliveryReceiptRefusedWhenLaneOff, TestPaidDeliverySessionEndToEnd, and a LOCAL=1 docker drive of the flow. Owner ask 2026-09-07: "create the necessary cloud tests before the next billable run".

R2.9 node half — the paid DELIVERY SESSION (core/node/deliverysession.go, core/demand/session.go; G-R212-8 certification 2026-09-06 §3.1, built under G-6 as ratified with the burn-vs-refund seam isolated). A durable fetcher opens one session per server with ONE demand-domain anchor (the demand token it bought there, now spent into the shared paid-serial guard at OPEN — MsgDeliveryOpen), tops it up with fresh anchors (MsgDeliveryFund), and settles INCREMENTALLY with cumulative-count receipts (receipt v3, MsgDeliverySettle: a lower or replayed count pays 0 by arithmetic; settle-once is REFUTED). The session spans objects (per-object lane reversal and skim stay the ledger's), holds no object-keyed collection (Don't #3), and closes on exhaustion or on IDLENESS measured from its last settlement on the node's injected clock (coarse stamp; wall time in production — R-SESSION-WALLCLOCK-STEP; lazy sweep on activity plus SweepDeliverySessions on the daemon's ticker); the byte ceiling and k_max = 1 are DERIVED from the face. -delivery-idle-window is REFUSE-UNTIL-SET (the block interval T_b is unmeasured); the daemon prints the S5 affordability line (B-11) and refuses a priced lane whose 64 GiB pin does not fit in WHOLE faces (G-λ-8-2: 9 of 10 today). Witnessed demand on this lane is DENOMINATED IN SETTLED INCREMENTS (Bank.Witness, WitnessedIncrements; the P3b distinct-bonded-fetcher count is its own surface; the v2 token counter is never shared) — the certified restatement P-SESSION of D-DEMAND's token-level property, whose ratification is the owner's. silt swarm receipt drives the session flow (-increments); the sim positive arm settles two objects on one session; e2e TestPaidDeliverySessionEndToEnd runs the real withdrawal, open, settle and idle close over TCP. The v2 flat receipt path (MsgDeliveryReceipt) stays callable until its retirement PR (B-9). Gates G-λ-8-1/2/3/4/5/7/9, B-7, B-8, B-13 (reap forfeiture), G-DEM-1…8 (TestAckReversalUsesTheBudgetCappedCount closes R-ACK-USES-UNTRUSTED-COUNT); eight node ablations run RED. OPEN: G-λ-8-10 (a zero-settle session spends no face — lift (b) is the G-6 owner call, lift (a) is refuted by G-λ-8-9), the idle-window VALUE, the flat-path retirement. The blind PE's blocker — under settle-monotone the payer chooses the delta and a per-settlement skim floor ⌊value/8⌋ let a face settled in deltas ≤ 7 fund the object escrow with NOTHING while the serve-time skim was clawed back (net −21 at 64 MiB) — is closed as certified (silt-reviews/research/research-outcome/R2.9-settlement-skim-under-fetcher-chosen-deltas-RESEARCH-CERTIFICATION-2026-09-06.md): the skim floors on the SESSION's cumulative settled value, ⌊(prior+value)/8⌋ − ⌊prior/8⌋, with prior the session's own counter passed to SettleDelivery; no remainder is stored; the ratified 1/8 does not move (the G-λ-7 discipline applied to the witnessed leg). Gates G-SKIM-1…6 (TestSkimIsExactOverTheSessionNotPerSettlement, TestSettlementSkimNeverExceedsItsOwnValue, TestSessionSkimIsPartitionIndependent, TestWashPayerPaysTheSkimAtEveryGranularity, TestWitnessingNeverDefundsTheEscrow, TestSkimAggregatesExactlyAcrossObjectsInOneSession), all RED under the per-settlement floor.

R3.4 input — the IssuerKeys-carrier block fraction, measured (2026-09-06; core/node/r34_issuer_key_carrier_fraction_test.go, a logged measurement, not a gate). The floor box marks any block carrying a demand-issuer key registration Indeterminate, so the accept-flip's witness coverage depends on how many blocks carry one. From a cold key schedule over 2V round-robin blocks: before R2.11 every validator carried its own key on its own turn (V carriers, 50 % of blocks at V = 2, 4, 8); after R2.11 the first proposer carries every pending key at once (ONE carrier: 25 % / 12 % / 6 %). R2.11 lowers the Indeterminate fraction. One cold turn; the harness has no epoch turns.

R2.11 — a peer-submit path for a demand-issuer key registration (2026-09-05; closes residual R0.4b-11). A validator that never wins a proposal slot can now get its per-epoch demand-issuer key committed: MsgSubmitIssuerKeyReg (APPENDED to the kind table, never inserted — MsgKind is positional) carries one self-signed IssuerKeyReg to peers every sync sweep while uncommitted; the receiver's arrival gate refuses, loudly and in order, a rate-exceeded sender, a slashed sender, a payload with ≠ 1 reg, a relayed reg (issuer ≠ sender), a bad signature, an out-of-window epoch, an already-committed binding and an UNBONDED issuer (the clause that bounds distinct senders); a queued reg is one slot per (issuer, epoch), latest wins; the next proposer folds it into its v5 block after its own, DROPPING (never deferring) one that is stale, slashed or no longer admissible; the drain driver arms on a FOLDABLE registration so an idle chain carries it. No validity rule moves, so an attester's acceptance is untouched and a mixed-version swarm cannot fork on it. Five TestR211* gates including the end-to-end property (the attest-only node's key commits on both replicas without it ever proposing) and the message-kind number pins. Blind PE code review (MERGE-AFTER) folded in: the arrival-gate fixture was vacuous and is rewritten against a bonded issuer; the staggered-takeover branch now counts issuer-key work (a dead designee no longer stalls a foldable key); the peer queue is pruned every sync sweep; stats.DrainProposalsArmed is a new node-wide counter on GET /api/status (validator-role observability: how often the drain driver armed a proposal; withheld with the other counters under -privacy). Not yet measured: the carrier-block fraction the R3.4 accept-flip needs (the floor box stalls on any IssuerKeys-carrying block). Deliberation: docs/thinking/2026-09-05-r2.11-issuer-key-peer-submit.md.

R2.12 — the faucet rate limit (2026-09-05; owner calls of 2026-09-03 stand; blind PE design ruling STOP → reconciled with the Economist's derivation, then built). Three daemon flags. With -grant-capacity and -grant-per-hour both set, a fresh identity's 500,000 starter grant is applied at its first SPEND (CanPublish / ChargePublish / FundEscrow) only if a continuously-accruing token bucket on the node's own monotonic clock admits; otherwise it stays grant-pending and retries at its next spend — never permanently denied. Non-spend paths (a fetcher credited bytes, a bounty-paid repairer, a bond-challenged peer) take no token, so the bond-audit sweep cannot drain the bucket; the node's own account is granted unmetered. Unset, the faucet is UNLIMITED, byte-for-byte the pre-R2.12 behaviour — there is no shipped default, because the refill interval's epoch-equivalent depends on a block cadence that is demand-driven and only bracketed (40–170 s on cloudtest). -grant-deny-floor selects what an empty bucket hands out: nothing (deny) or N credits once (degrade; the PE recommends one fee). A start-up assertion refuses a capacity whose worst-case paid-serial guard occupancy capacity × (grant/fee) × (W+1) exceeds a quarter of the derived cap, tying four constants in three packages. Telemetry (faucet on GET /api/status: capacity, rate, level, grantsIssued, grantsDegraded, grantsPending) is withheld with the other counters under -privacy; it is NOT the R2.9a arrival series. R2.12 bounds the RATE of fresh grants, never their total — a soft, disclosed deterrent for the unbuilt structural cost of identity. Researcher-certified the same day: the rate is a SECURITY PARAMETER (build-immutable #4 on both sides), so no default ships and none is recommended; the deny floor is an ADVANCE topped up to the full grant, never a settlement; the daemon refuses -accept-delivery-receipts / -accept-relay-payments with the faucet unconfigured; grantsDenied counts distinct refused identities. Fifteen TestR212* gates. Deliberation: docs/thinking/2026-09-05-r2.12-faucet-rate-limit.md.

-privacy on the UI server (D-UI-PRIVACY-FLAG, owner-ratified 2026-09-05; blind PE design review RULING-UI-PRIVACY-FLAG-design-2026-09-05.md folded in). on (the compiled default, every build): the node-wide serve counters — the whole stats block and durability.balance on GET /api/status; revenue, margin and wash on GET /api/economy/self — are withheld from a reader that presents no API token, ABSENT with the sibling marker countersWithheld: true, never a zero; the library's link field (a permanent retrieve-and-decrypt capability) is withheld from a reader that did not present the token in the Authorization header, with linksWithheld: true (live on silt client, which holds the linkbook). The operator's tokened reads are unchanged. off: publish them to any admitted reader, and the node is labelled PRE-RELEASE on its dashboard and observatory and via privacy.{mode,default} on every status response. Any other value refuses to start. Every withhold on the three documents composes in one place (readerView, economyView, libraryView, one readerAuth), each privacy withhold an allow-list. The pages' render logic moved to ui/render.js and a node-run gate proves a withheld document never aborts a render. release.yml asserts the compiled default on the built linux artifact. Compatibility: an OLDER observatory page pointed at a NEW -privacy=on daemon aborts its render (the old inline stats dereference) — upgrade the observing daemon. Blind PE code review (MERGE-AFTER) folded in: the library page renders "link withheld" instead of a get button with an undefined link; a bad -privacy value refuses even with no -ui; the pointer-sharing hazard on the cached document is gated. Deliberation: docs/thinking/2026-09-05-ui-privacy-flag.md.

R2.9a — G-BB-12′ / G-BB-13′ Part A: the B_bootstrap block is served to the OPERATOR and to nobody else (2026-09-05; owner-ratified "refuse at startup", D-R2.9a-RUN-CALLS item 4; mechanism ruled by the blind PE, RULING-R2.9a-G-BB-12-design-2026-09-05.md). Two startup refusals in a tagged daemon: -bbootstrap with a non-loopback -ui bind, and -bbootstrap with a <store>/ui-token readable beyond its owner (a 0644 token would hand every local user the operator predicate). At serve time the block goes only to a request carrying the token in the Authorization HEADER — never ?token=, which lands in logs — and every other reader (a reverse proxy forwarding a loopback Host, a co-tenant, the observatory or any localhost origin) gets the sibling marker bBootstrapWithheld: true and no block, so the three wire states stay distinct key sets. All withholds on GET /api/status now compose in ONE function, uiServer.readerView (the F2 per-object detail today; D-UI-PRIVACY-FLAG's counters when built). Default build untouched: the off twins refuse and withhold nothing. Blind PE code review (MERGE-AFTER) folded in: a second untokened test helper had let a REQUIRED anchor's positive control pass on the marker ("bBootstrap" is a substring of "bBootstrapWithheld") — it reads as the operator and asserts the quoted block key; and the token-file check now also requires the file to be OWNED by the daemon's user (a pre-planted 0600 token from another user was measured adopted and served). Ten tagged gates (TestR29aG12*), all in the CI anchor list. Deliberation: docs/thinking/2026-09-05-r29a-g12-reader-is-operator.md.

R2.9 ledger half — byte-denominated per-increment delivery settlement on the credit ledger (core/credit/deliveryanchor.go; D-R2.9-DIRECTION, built at the ratified price (U, p) = (262,144 B, 1 credit)). SpendDeliveryAnchors spends verified demand-domain anchors into the shared paid-serial guard at session OPEN, all-or-nothing, and returns the session budget (Σ face); a top-up is the same call with fresh anchors. SettleDelivery(server, fetcher, root, count, budget) pays min(count·p, budget) less the durability skim into the server's balance, routes the skim to the object's escrow, BURNS the remainder, and reverses the provisional self-mint PER INCREMENT (the acknowledged bytes leave the lane's accumulator; the un-acknowledged tail keeps its bytes as the bilateral fallback) — the flat whole-lane supersede left a server strictly worse off than suppression on every partial acknowledgement. At 64 MiB a server that banks the receipt now ends +75 credits ahead of one that suppresses it (R-FLAT-FEE closed structurally). The paid-serial guard's cap derivation is re-based from a per-block serve COUNT to BYTES PER ANCHOR for both populations (12.21 GiB per delivery anchor, 24.4 GiB per relay anchor) against a one-hour block-interval bound at 125 MiB/s — the φ = 1 corner, which the G-R212-8 certification (T-QUANT) shows is NOT the binding bound under spend-at-open; the 65,536 floor is retained and the binding session-count bound stays the R2.12 start-up assertion against the runtime faucet capacity (blind PE item 1). The "256 serves per block" unit is retired. The guard's refusals and live entries are now split per lane (GuardFullRefusalsByLane, LivePaidSerialsByLane, the 2026-09-04 cert §4.4 ruling). DeliverySettlementStats (settlements, settled, sessions closed, burned, increments) is the telemetry for the anchor-quantization residual; the remainder is accounted ONCE at CloseDeliverySession, never per settlement, because the G-R212-8 certification replaces settle-once with settle-monotone (a session settles in deltas and spans objects). Gates TestDeliveryAcceptStrictlyDominatesSuppressionAtEverySize (B-1), TestProvisionalLaneEqualsCreditedBalanceAndReversesPerIncrement (B-2), TestDeliverySettlementIsBoundedByAnchorFaceOnThePayingLedger (B-3), TestDeliveryFundTopUpSpendsFreshAnchorsOnce (B-3b), TestPaidSerialCapDominatesBothPopulations (B-4, unit half; the field half — per-lane guardFullRefusals == 0 on a graded run, T_b and the resident cost measured — is owed to the Tester), TestDeliveryRemainderIsNeverRoutedToEscrow (B-6), TestPaidSerialCapLiteralsMatchTheirSources, TestRemainderIsAccountedOnceAtCloseNotPerSettlement (G-λ-8-6), and the Invariant-A press (B-14); six ablations run RED (the blind PE ran ten). Blind PE MERGE-AFTER (silt-reviews/principle-engineer/RULING-R2.9-ledger-half-45178ff-2026-09-06.md) folded in: the cap text re-stated as the φ = 1 corner, the settlement godoc re-stated as settle-monotone, per-lane guard counters, the payout in WHOLE increments (min(count, ⌊budget/p⌋)·p, exact at any p), the text mismatches. The NODE half (session open, receipt v3 with a cumulative count, the idle reaper, the fetch-path integration, the e2e) is GATED on an owner call: the certification refutes the composed 64 GiB pin claim under G-6 (remainder burned) and names the refund direction — see docs/thinking/2026-09-06-r2.9-delivery-settlement-quantization.md.

Floor box — the STRUCTURE round, Round 1A (R-STRUCTURE-REDERIVATION, owner-ratified 2026-09-03; call 16 main-only). ONE accept composition over a three-valued StateView: ValidateProposalV5 (P1…P13) and ValidateCommitV5 (= the proposal then C1…C5), dispatched from BOTH ValidateProposal and ValidateCommit on version — chain.go changes by exactly two dispatch hunks and one comment; era-1/era-2 legs untouched. StateView is sealed; HeadRef carries {Hash, NextHeight, ProposerID, StateRoot, LogRoot, Empty}; P13 is two conjuncts (StateRoot; LogRoot equality at k = 0, a named STALL at k ≥ 1 until tagRevLogSize); the legacy leg is a real leg (Rep on the view); the box owns a byte budget whose zero value stalls (UnlimitedBudget for the live view only); eight of nine box doors unexported and the package surface inventoried by AST with reasons; the recompute screens a slashed author; the witness parent-proposer slot deleted (the id is HeadRef.ProposerID). Gates, every one RED under a named ablation: the stage-cover gate (fixture non-vacuity, derived call cover, three-body digest, reverse cover), G-D13 per-row node-body digests (28), the nine-regime v4/v5 PARITY ORACLE (verdict + sentinel parity per mirrored stage), honest twins on all 26 gates, the two-sided pruned-carrier gate, the m = 1 right-spine control. Blind PE ruling (a 245-case differential against the pre-change node, 13 ablations): /Users/andrewedmond/Claude/claude/silt-reviews/principle-engineer/RULING-floorbox-structure-round-1a-869399e-2026-09-08.md; Researcher CERTIFIED: /Users/andrewedmond/Claude/claude/silt-reviews/research/research-outcome/FLOORBOX-STRUCTURE-ROUND-1A-COMPOSED-DIFF-869399e-RESEARCH-CERTIFICATION-2026-09-08.md. Build record: docs/thinking/2026-09-07-floorbox-structure-round-1a-build.md. Round 1B (the box-entry closers) follows.

Floor-box Resolve-path scheduling oracle (Boulder 1, R1.5 — model-check tier, test-only) (core/chain/modelcheck_floorbox_schedule_oracle_v5_test.go, core/chain/modelcheck_floorbox_schedule_oracle_tests_v5_test.go, 2026-09-02). The consensus model-check had ZERO coverage of the floor-box Resolve path because WitnessValidateV5 short-circuits at the never-Accept STOP boundary (floorbox_v5.go:244) before the recompute. This oracle exercises the recompute DIRECTLY (RecomputeStateRootEntriesRevocations), pre-flip. Two additions: (1) a box-as-I1-participant scheduling oracle — an adversarial scheduler delivers honest and forged witnesses to disjoint boxes under adversarial delivery order, asserting I1 (no two honest boxes Accept conflicting roots at one height) and I5 (an honest box is never wrongly refused); (2) a multi-block Resolve schedule asserting each box's verdict is stable under reorder (Resolve is pure over prevStateRoot + block) and that a forged witness at height h does not poison prevStateRoot for h+1 (I3-adjacent). Drives two known compound-shape breaks RED as documented-open gates: (a) the class-P activation-lock LockedIn.OldValue tally-suppression wrong-accept (rotate_v5.go:442,:450,:458 × scalarFoldOp:473), and (b) the RegVersion in-block cross-check gap (apply's tally reads the just-written in-block regVersion at chain.go:3444 while the box anchors regVersion against pre-state, absent for a fresh in-block bond). Changes no production consensus path; the box still never-Accepts.

Economy observability MVP — the four local-exact SELF panels (Boulder 2, R2.1 slice 6a) (GET /api/economy/self in cmd/silt/ui.go; per-node repair counter in core/credit, 2026-09-01). An operator now reads their OWN economy health from ONE node — no aggregator, no gossip, no network estimation — every field read from this node's own Ledger/care state and stamped local-exact. Ships cert-free and economy-OFF (the auto-skim still fills escrows with the economy off, so the accounting is real; bountyOn reports whether repair actually disburses). Four panels: (1) my-solvency — per cared object a funded-horizon cliff flag (a measurable, finite horizon inside a 30-day warning window; a not-yet-measurable object renders finite=false, NEVER faked as perpetual); (2) am-I-profitable — revenue split into serve vs bounty, margin = balance − an OPTIONAL operator-supplied ?cost=N (never a persisted flag; absent, margin is flagged not-given, so it is never asserted as fact); (3) is-durability-self-funding — pooled + per-object skim-in (funded) vs bounty-out (paid) with the drain signal net<0; (4) wash self-check — a serve/fetch symmetry SHAPE self-check conjoined with non-positive balance, labeled "suspected" NEVER "detected" (authenticity is not-knowable — Douceur — so it is never a slashing input). Adds the one new state the design flagged: a per-node RepairsDone/BountyEarned counter incremented in PayBounty (the per-object repairs count cannot attribute work to a node) — pure observability, classified neutral by the Invariant-A guard (it feeds no standing/conservation/disbursement rule). Extends the existing /api/status durability block with finite/cliff. Every check is ablation-proven: the repair counter, the wash conjunction's balance clause, and the pooled net each redden when their logic is inverted. Deliberation: docs/thinking/2026-09-01-economy-observability-design.md.

v5 trustless floor box — three pre-Accept hardening ablations for the era-4 v5 recompute (7a/7e/7f) (core/statehash/fold_test.go, core/chain/floorbox_recompute_stateroot_bondreg_v5_test.go, core/chain/floorbox_recompute_stateroot_ttl_v5_test.go, 2026-08-31). Test-only; the box STILL never-Accepts, no apply/consensus change. Each is red-before-green (inject the defect, watch the REAL code path stall, restore). 7a — a DIRECT adversarial ablation for the R-fold's delete off-path siblings. MEASURED against pokt-network/smt@v1.0.0: a delete-sibling's authenticity rides its DIGEST (proof-anchored to the verified SideNodes), NOT its preimage content — parseTrieNode stamps a resolved node with the lookup-key digest and digestNode returns that CACHED digest without re-hashing, so corrupting a sibling PREIMAGE is a ~13% no-op while corrupting its DIGEST un-seeds the honest referenced node and stalls ~96%. The ablation corrupts the digest and requires the real fold to go RED; the delete cross-product byte-exact pin stays load-bearing. 7e — class-B bonded-but-NOT-qualified: a fresh reg with MinBondBytes <= Size < MinBond writes bonded/bondDomain but does NOT enter qualified (a previously untested delta branch); a positive test reproduces it byte-exact vs real apply + StateRootForVersion(5), and an ablation that forges the qualification stalls. 7f — class-T multi-block contiguity: the dueBucket[b.Height] scope-gate is sound only under chain height-contiguity (apply's sweep is >); a multi-block schedule of consecutive sweep heights firing distinct buckets is reproduced byte-exact, and an ablation that SKIPS a height (so apply's > vacuums a bucket the == gate never witnesses) stalls — so a future contiguity break reddens.

v5 trustless floor box — Path-1 state-root recompute P1-e, CLASSES A (attestations → validatorsSeen) and P (epoch rotation → epochSet + boundary scalars): the LAST two Path-1 classes (core/chain/floorbox_recompute_stateroot_atts_v5.go, core/chain/floorbox_recompute_stateroot_rotate_v5.go, core/chain/floorbox_recompute_stateroot_v5.go, docs/thinking/2026-08-31-floorbox-recompute-AP-options.md, 2026-08-31). Completes the O(payload) + O(registry-per-digest) state-root recompute: E/R/S/B/T/A/P is now the full apply transition set. The exact write-sets were MEASURED off real apply + stateRootLeavesV5 (not guessed). Class A screens each non-proposer attester from OWN cfg over per-attester point witnesses (slashed F2 gate, then FROZEN epochSet[id] membership in a mature epoch — R-A-membership-source, NOT live bonded — else pre-maturity bonded>=MinBond || launchAnchor), derives the validatorsSeen||id ADDs, and reconstructs validatorsSeenRoot. Legacy mode (rep(id), not a committed leaf) STALLS (R-A-legacy; a v5 block is objective by construction). Class P reproduces EVERY rotateEpoch write (R-P-boundary-scalars): epochStart (always), matureEpoch, the epochSet freeze (per-member leaves + epochSetRoot), and the three activation-tally lock-in scalars (gateLockedIn/gateHeight, era3/era4). The freeze SOURCE is the POST-apply qualified set — the box replays this block's B/T/S qualified deltas in apply ORDER on the anchored pre-qualified set, THEN freezes (R-P-sameblock-order; a stale pre-delta freeze is the I3 hazard, fold-caught). The three tallies compute 3ready > 2total from per-member regVersion WITNESSES over the frozen set with OWN-cfg thresholds (3/4/5) + activation guards (R-P-tally-regversion). The #535 recovery boundary (liveQualifiedSet re-base) is NOT reconstructed from committed state — it STALLS (R-P-recovery, the ratified trust-the-directive carve-out C-2). The scope gate widens so A and P blocks are IN scope; E/R/S/B/T/A/P is now the complete set (no out-of-scope class remains). Box STILL never-Accepts (R-scope). No apply/consensus change. COST is HONEST: A is O(payload) screen + O(|validatorsSeen|) digest; P is O(|qualified|) freeze + tallies — both O(registry), riding R-membership (OPEN, for the #657 accept-flip). Ships with R3 execution-derived ablations against real apply + StateRootForVersion(5), each watched RED before green: (A) forged qualification screen, legacy-mode, omitted validatorsSeenRoot, proposer-only no-write, byte-exact digest; (P) steady-state + bond-reg-compound agreement, stale (pre-delta) freeze, short qualified-set witness, live-tally forged regVersion, forged freeze weight, missing epochStart scalar, #535-recovery stall. Cert: floorbox-recompute-classA-classP-wholeset-RESEARCH-CERTIFICATION-2026-08-31.

v5 trustless floor box — Path-1 state-root recompute P1-a, the O(payload) HYBRID: fold only the CHANGED paths (classes E + R), flat in total state (core/statehash/fold.go, core/chain/floorbox_recompute_stateroot_v5.go, docs/thinking/2026-08-31-floorbox-recompute-Rfold-options.md, 2026-08-31). Reproduces validateEra3Roots' StateRoot equality TRUSTLESSLY at O(payload) cost, superseding the O(whole-state) P1-a (which witnessed the entire pre-state). The CERTIFIED hybrid: (1) DERIVE the E/R write-set from the block payload itself (the box runs the generator, not the prover, so the changed-key set is complete by construction); (2) WITNESS each changed leaf's pre-state proof against prevStateRoot; (3) FOLD only the changed paths to compute the post-state root; (4) require the computed root == b.StateRoot. The R-fold primitive (statehash.FoldChangedPaths) DELEGATES all tree surgery to the audited pokt-network/smt@v1.0.0 — it reconstructs a partial trie over the changed paths and replays the library's own Update/Delete, so the prior naive fold's 36%-wrong-root trap (hand-rolling add-displacement, the three delete sibling-promotion cases, extension split/absorb) does not recur. Pinned BYTE-EXACT against statehash.Root over a randomized structural cross-product: 18,000 trials across 3 seeds, 0 failures (add-disjoint / add-displacing / overwrite / delete leaf-promote / extension-absorb / inner-fold / shared-prefix interactions / extension present-absent), each structural rule ablated red-before-green. The scope gate is RE-ANCHORED off the whole-bondRegHeight scan onto the O(1) dueBucket[h] non-membership accelerator (or the O(payload) claim would be false). Cost proven FLAT: the same small E/R block against a 100-entry vs a 10,000-entry pre-state uses 3 changed-leaf witnesses at both sizes (payload-fixed) and 28 → 53 sidenodes (log N, not 100×). The box STILL never-Accepts (WitnessValidateV5 not flipped — research cert R-scope). Additive: NO consensus rule, validity predicate, or apply change. Ablations ship red-before-green: tampered StateRoot, un-named extra committed write (the cert's wrong-accept), forged / omitted changed-leaf proof, out-of-scope class, non-absent dueBucket TTL witness — plus the R3 execution-derived drift guard against real apply + StateRootForVersion(5), watched red on a mis-derived write-set. Certs: floorbox-recompute-P1a-Opayload-multileaf-RESEARCH-CERTIFICATION-2026-08-31, RULING-floorbox-recompute-P1a-Opayload-multileaf-2026-08-31.

v5 trustless floor box — Path-1 state-root recompute P1-b, CLASS S (slashes): the changed-whole-set-digest write-set primitive, the first delta-derivable digest class (core/chain/floorbox_recompute_stateroot_slash_v5.go, core/chain/floorbox_recompute_stateroot_v5.go, docs/thinking/2026-08-31-floorbox-recompute-P1b-S-digest-writeset-options.md, 2026-08-31). Widens the O(payload) state-root recompute to reproduce validateEra3Roots' StateRoot equality for a block that carries on-chain equivocation slashes. A slash of culprit changes THREE whole-set DIGEST scalars (slashedRoot/bondedRoot/qualifiedRoot) — each an MTH over the whole post-state id-set — on top of three per-member leaves. The certified changed-digest primitive reconstructs each: (1) anchor the witnessed PRE-set id-list against the pre-digest committed under prevStateRoot (NOT StateRoot — that is circular; the FoldOp's OldValue = nodeSetMTH(preIDs) is verified against prevStateRoot by FoldChangedPaths); (2) apply the payload-DERIVED membership delta (slashed ADD culprit, bonded DELETE, qualified DELETE — the qualified delete derived from the anchored pre-set, C-1, NOT trusted from a witness scalar); (3) NewValue = nodeSetMTH(postIDs); (4) fold the digest scalar as one changed leaf, require postRoot == b.StateRoot. Reuses FoldChangedPaths/nodeSetMTH; no apply/consensus change. The scope gate widens so S blocks are IN scope; A/B/T/P/M stay out-of-scope-stalling (a slash block that also carries a bond reg / non-proposer att / firing TTL / boundary stalls). Box STILL never-Accepts (R-scope). COST is HONEST: NOT O(payload) — reconstructing a digest is a whole-list MTH fold with no incremental update, so class S is O(payload leaves) + O(|keyspace|) per touched digest ≈ O(registry) per digest, riding directly on R-membership (OPEN, for the #657 accept-flip). Ships with R3 execution-derived ablations against real apply + StateRootForVersion(5), each watched RED before green: forged qualified-screen pre-set, slash-doesn't-delete-bonded, wrong culprit, omitted touched-digest reconstruction, the circular StateRoot-anchor swap, and a byte-exact digest check. Certs: floorbox-Rboundary-writeset-digest-reconstruction-RESEARCH-CERTIFICATION-2026-08-31, RULING-floorbox-recompute-P1b-SA-digest-scope-2026-08-31.

v5 trustless floor box — Path-1 state-root recompute P1-c + P1-d, CLASSES T (TTL sweep) and B (bond registrations): two more delta-derivable digest classes on the changed-digest primitive (core/chain/floorbox_recompute_stateroot_ttl_v5.go, core/chain/floorbox_recompute_stateroot_bondreg_v5.go, core/chain/floorbox_recompute_stateroot_v5.go, docs/thinking/2026-08-31-floorbox-recompute-BT-options.md, 2026-08-31). Widens the O(payload) state-root recompute to reproduce validateEra3Roots' StateRoot equality for a TTL-expiry block and a bond-registration block, reusing the P1-b changed-digest primitive. The exact write-sets were MEASURED off real apply + stateRootLeavesV5 (not guessed). Class T derives the expired set from the dueBucket[b.Height] accelerator (the O(1)/O(bucket) witness, NOT a whole bondRegHeight scan): each expired id deletes bonded/bondRegHeight/regVersion/qualified leaves and the whole bucket empties, changing bondedRoot/qualifiedRoot. The bucket MTH is anchored via the CRUX closure — the box reconstructs dueBucketMTH(members) and the scope gate requires it PROVE PRESENT against prevStateRoot, so a forged/short expired set stalls. Class B reproduces apply's bond-reg loop exactly: canonicalBondRegs same-id canonicalization, the MinBond/malformed/slashed screens from OWN cfg, the per-root PROOF-BEATS-DECLARATION displacement (the displaced squatter is read from committed bondRootOwner[Root], an id NOT in the payload — the R-B-displacement residual, fold-caught), and the dueBucketMoveOnReg old-bucket delete + new-bucket insert (each an MTH leaf reconstructed from its witnessed pre-set). A pure same-id renew touches NO whole-set digest (the id-set is unchanged). The scope gate widens so B and T blocks are IN scope; the epoch-boundary (P) check moves FIRST so a boundary stalls as a scope stall regardless of TTL; A/P/M stay out-of-scope-stalling. Box STILL never-Accepts (R-scope). No apply/consensus change. COST is HONEST: NOT O(payload) — reconstructing bondedRoot/ qualifiedRoot is a whole-list MTH fold, so B and T are O(payload) + O(|bonded|) + O(|qualified|) + O(|touched buckets|) ≈ O(registry) per touched digest, riding R-membership (OPEN, for the #657 accept-flip). Ships with R3 execution-derived ablations against real apply + StateRootForVersion(5), each watched RED before green: (T) forged expired set, bonded-not-deleted, omitted digest, out-of-scope compound, byte-exact digest; (B) fresh/renew/displacement agreement, displacement-not-applied, forged screen, boundary-out-of-scope. Cert: floorbox-Rboundary-writeset-digest-reconstruction-RESEARCH-CERTIFICATION-2026-08-31.

v5 trustless floor box — recompute increment 4: the QUALIFIED-COUNT predicate reproduced from witnesses (the slashed-over-bonded whole-set read) (core/chain/floorbox_recompute_qualifiedCount_v5.go, docs/thinking/2026-08-31-floorbox-recompute-increment4-qualified-slashed-options.md, 2026-08-31). Reproduces qualifiedCount (the distinct-qualified validator COUNT N that sizes the count-quorum floor, chain.go:1479) TRUSTLESSLY, from the committed StateRoot + witnesses alone, replicating increments 1-3's C-1 pattern over the WHOLE bonded map. This closes the slashed-over-bonded quorum-stack whole-set read the #664 enumeration named as the keyspace the earlier hand-lists OMITTED. Additive: NO consensus rule, validity predicate, or apply change — a full node still counts bonded[id] >= MinBond && !slashed[id] from its own maps; this is a SEPARATE root-only path. The four-part proof: (1) SET-COMPLETENESS over bonded — reconstruct nodeSetMTH(whole-bonded id-list) and require it equals the committed bondedRoot digest (reuses the root increment 3 already reads); (2) PER-MEMBER BONDED WEIGHT (C-1) — Resolve each bonded weight leaf (the >= MinBond screen operand), so a forged weight fails ⇒ stall; (3) PER-MEMBER SLASHED BIT (C-1) — Resolve each slashed[id] present/absent, so a prover can neither drop a slash (inflate N) nor inject one (deflate N); (4) OWN CONFIG (C-6) — MinBond read from own cfg, never the witness. The box STILL never-Accepts (WitnessValidateV5 not flipped, the #657 accept flip waits). Six hard ablations ship red-before-green (each injected into production and watched to flip the verdict): forged bonded weight (_ForgedBondedWeightRejects, N inflated to 4), dropped slash (_DroppedSlashRejects, N inflated to 4), injected slash (_InjectedSlashRejects, N deflated to 2), omitted/injected member (completeness, _{Omitted,Injected}MemberRejects), and config-from-witness MinBond (C-6, failing-first, _MinBondFromConfig, N inflated to 4). Equivalence to the full node's qualifiedCount is asserted by test across the >= MinBond and slashed screens. TWO STOP-AND-REPORT findings correct the task's premise: (a) qualified is an APPLY-channel whole-set read (the rotateEpoch freeze epochSet := clone(qualified)), NOT a quorum-stack fold — its only validity gate is the Path-1 state-root recompute (validateEra3Roots→postApplyRoots→apply), a large separate piece that warrants its own increment, so qualifiedRoot STAYS inert; (b) slashedRoot the DIGEST has no whole-set reader (qualifiedCount reads slashed[id] per-member over the bonded domain, anchored on bondedRoot), so it too STAYS inert — no producer change, no digest-root exclusion removed, TestInertDigestRootsAwaitRecompute unchanged (still skips both roots). NOT a consensus-rule change; the box never-Accepts.

v5 trustless floor box — recompute increment 3: the DE-MATURE SUPER-QUORUM predicate reproduced from witnesses (core/chain/floorbox_recompute_dematureQuorum_v5.go, docs/thinking/2026-08-31-floorbox-recompute-increment3-dematureQuorum-options.md, 2026-08-31). Reproduces requireDeMatureSuperQuorum (the F-1 de-mature super-quorum over the WHOLE bonded map, chain.go:2947) TRUSTLESSLY, from the committed StateRoot + witnesses alone, replicating increments 1/2's structure over a DIFFERENT keyspace: the whole bonded id-list (the R-membership budget path), rather than the frozen epochSet. Additive: NO consensus rule, validity predicate, or apply change — a full node still folds Σ bonded from its own map; this is a SEPARATE root-only path. The three-part proof: (1) SET-COMPLETENESS — reconstruct nodeSetMTH(whole-bonded id-list) and require it equals the committed bondedRoot digest (F1's inert root now READ); (2) PER-MEMBER WEIGHT (C-1) — Resolve each member's bonded weight leaf against the committed root, so a forged weight fails verification ⇒ stall; (3) THRESHOLD (C-6) — the ⅔ ratio is the fixed consensus constant, never read from the witness. The de-mature predicate fires only when !matureNow, so the recompute GATES on the REPRODUCED maturity state (reuses increment 2's RecomputeMatureNow): it folds the super-quorum only in the reproduced !matureNow state and is a no-op (met=true, matching the full node's skip) when mature. requireDeMatureSuperQuorum consults no epoch set, so the #535 recovery boundary does not change this fold (no boundary carve-out for this predicate). The box STILL never-Accepts (WitnessValidateV5 not flipped, the #657 accept flip waits). The producer (readset_v5.go) now emits the bondedRoot completeness leaf + per-member whole-bonded weight reads; the drift guard's bondedRoot inert-exclusion is REMOVED with a real red-on-drop ablation (TestBondedRootReadReddensOnDrop), and the two still-inert digest roots (qualifiedRoot, slashedRoot) keep their exclusion. Three hard ablations ship red-before-green: forged bonded weight (C-1, TestRecomputeDeMatureSuperQuorum_ForgedBondedWeightRejects), omitted/injected member (completeness, TestRecomputeDeMatureSuperQuorum_{Omitted,Injected}MemberRejects), and config-from-witness threshold (C-6, failing-first, TestRecomputeDeMatureSuperQuorum_ThresholdFromConstant). Equivalence to the full node's de-mature verdict is asserted by test for both a coalition that meets and one that misses the ⅔ super-quorum, plus the maturity-gate no-op. NOT a consensus-rule change. PARTIAL GATE (flagged for the #657 accept-flip assembler): the full-node caller gate is everMature && objective && !matureNow (chain.go:2827), but this recompute reproduces ONLY !matureNow. The everMature/objective conditions are DEFERRED to the accept-flip assembler (#657), which MUST re-add them before flipping to Accept — else the reachable !everMature && !matureNow state (a young chain below the bar, which a full node does NOT gate on the de-mature predicate) would wrongly fold the de-mature bar. The everMature witness (tagEverMature) is already in the v5 read-set. Also fixed a pre-existing decoration in TestWitnessReadSetV5BoundednessAblation: it asserted on raw len(readset), which already scales with the registry via the legitimate cert-blessed frozen-set weight reads, so neutering its injected bondRegHeight scan left it GREEN (the check did not depend on its defect). It now asserts on sizeExcludingFrozenSet (the same exclusion TestWitnessReadSetV5BoundedNotRegistrySized uses), so the injected scan is the only thing that can diverge it (red-before-green restored). (Both per PE ruling RULING-floorbox-recompute-increment3-dematureQuorum-2026-08-31.)

v5 trustless floor box — recompute increment 2: the MATURITY-LATCH predicate reproduced from witnesses (the C-6 teeth) (core/chain/floorbox_recompute_maturity_v5.go, docs/thinking/2026-08-31-floorbox-recompute-increment2-maturity-latch-options.md, 2026-08-31). Reproduces matureNow (the maturity-latch metric via C2Metric, chain.go:2178) TRUSTLESSLY, from the committed StateRoot + witnesses alone, replicating increment 1's structure. matureNow gates the de-mature super-quorum (everMature && objective && !matureNow, chain.go:2827) and is the FIRST predicate whose fold READS GENESIS CONFIG (MinBond / Anchors / OperatorMargin / MatureValidators), so it is where the C-6 obligation finally has TEETH (increment 1's predicate read only the fixed ⅔ constant). Additive: NO consensus rule, validity predicate, or apply change — a full node still folds C2Metric from its own maps; this is a SEPARATE root-only path. The three-part proof: (1) SET-COMPLETENESS — reconstruct nodeSetMTH(validatorsSeen id-list) and require it equals the committed validatorsSeenRoot digest (F1's inert root now READ); (2) PER-MEMBER VALUES (C-1) — Resolve each member's slashed / bonded / bondDomain leaf against the committed root, so a forged weight or domain fails verification ⇒ stall; (3) GENESIS CONFIG (C-6) — MinBond / Anchors / OperatorMargin / MatureValidators read from OWN cfg, never the witness. The box STILL never-Accepts (WitnessValidateV5 not flipped, the #657 accept flip waits). The producer (readset_v5.go) now emits the validatorsSeenRoot completeness leaf + per-member slashed/bonded/bondDomain reads; the drift guard's validatorsSeenRoot inert-exclusion is REMOVED with a real red-on-drop ablation (TestValidatorsSeenRootReadReddensOnDrop), and the three still-inert digest roots keep their exclusion. Six hard ablations ship red-before-green: forged bonded weight (C-1), forged bondDomain (C-1), forged slashed bit (C-1, TestRecomputeMatureNow_ForgedSlashedRejects), omitted/injected member (completeness), and the mandatory config-from-witness (C-6, TestRecomputeMatureNow_ConfigFromOwnConfig). Equivalence to the full node's matureNow is now asserted by test on the SLASHED-SKIP fold path (a fixture seats a committed slashed member) and the UNSET-DOMAIN zeroDomainWeights fold path (a mixed set/unset-domain fixture), closing the two coverage gaps the blind PE review flagged (both branches were previously exercised only in their always-false direction). NOT a consensus-rule change.

v5 trustless floor box — recompute increment 1: one weighted predicate reproduced from witnesses (the C-1 pattern) (core/chain/floorbox_recompute_v5.go, core/statehash/prover.go, docs/thinking/2026-08-31-floorbox-recompute-increment1-options.md, 2026-08-31). Reproduces requireEpochWeightQuorum (the mature-phase >⅔ frozen-WEIGHT super-quorum, Σ epochSet) TRUSTLESSLY, from the committed StateRoot + witnesses alone, proving the C-1 weight-composition pattern the v5-wholeset-digest-root cert names as the load-bearing gap. Additive: NO consensus rule, validity predicate, or apply change — a full node still folds the quorum from its own epochSet; this is a SEPARATE root-only path (the floorbox_v5.go posture). The recompute is the three-part proof the cert requires: (1) SET-COMPLETENESS — reconstruct nodeSetMTH(id-list) and require it equals the committed epochSetRoot digest (F1's inert root now READ), so an omitted/injected member ⇒ a different MTH ⇒ stall; (2) PER-MEMBER WEIGHT (C-1) — Resolve each epochSet[id] weight leaf against the committed root, so a forged weight fails verification ⇒ stall (the digest bound membership; the tally was forgeable without this); (3) GENESIS CONFIG (C-6) — the fold reads own consensus params, never a witnessed threshold. The box STILL never-Accepts: WitnessValidateV5 is NOT flipped to Accept (the #657 accept flip waits until ALL predicates are reproduced). The producer (readset_v5.go) now emits the epochSetRoot completeness leaf + the per-member epochSet weight reads; the drift guard's epochSetRoot inert-exclusion is REMOVED with a real red-on-drop ablation (TestEpochSetRootReadReddensOnDrop), and the four still-inert digest roots keep their exclusion with a skip-guarded remove-on-recompute placeholder (TestInertDigestRootsAwaitRecompute). Three hard ablations ship red-before-green: forged-weight (C-1), omitted/injected member (completeness), config-from-witness (C-6). core/statehash.Prover is the provider-side complement to Resolve (builds the SMT inclusion/non-inclusion proofs a box verifies). NOT a consensus-rule change.

v5 floor box — the QUORUM-STACK whole-set read enumeration + blind-spot closure (core/chain/readset_v5_quorum_wholeset_test.go, docs/thinking/2026-08-31-Rboundary-mechanical-wholeset-enumeration-options.md, 2026-08-31). Test-infra + enumeration only; NO consensus rule, validity predicate, or apply change, and NO committed digest-root leaf added (that is the gated format change). The merged execution-derived read-set guard (readset_v5_drift_test.go) derives ground truth from apply(b) + a validity source that runs validateTakedowns + per-entry ValidateEntry — it NEVER runs the QUORUM STACK, so it was structurally blind to every committed map the stack reads AS A WHOLE SET (a SUM/COUNT over the entire map). That blind spot is the root cause of three hand-enumeration misses this session. This increment fixes it by EXECUTION-DERIVATION, not hand-listing: an untouched-member perturbation oracle runs the FULL contract (collectQuorumSigs + requireQuorumStack, plus the apply channel) over poised worlds and flags a keyspace as whole-set iff perturbing a member the block does NOT touch flips the accept/reject verdict or the recomputed root. The EXHAUSTIVE full-contract whole-set-read set is {bonded, epochSet, qualified, slashed, validatorsSeen}: the quorum-stack folds are {bonded, epochSet, slashed, validatorsSeen} (slashed via qualifiedCount's !slashed[id] fold — the keyspace the ≥4 starting list OMITS; validatorsSeen via the de-mature gate's matureNow → MatureCoefficient fold), and qualified is an APPLY-channel whole-set read (the boundary freeze), not a quorum-stack fold (the ≥4 list's mis-attribution). The blind-spot-closed red→green ablation runs per keyspace: the PRE-extension guard is GREEN (blind), the EXTENDED guard is RED (the per-key producer omits the whole-map completeness read), and a positive control (augmenting the producer with the completeness leaf → GREEN) proves the RED is the missing whole-map read, not a tautology.

v5 state root — the five whole-set DIGEST-root leaves, increment F1 (format-only) (core/chain/statehash.go, core/chain/modelcheck_stateroot_digestroots_test.go, docs/thinking/2026-08-31-v5-five-digest-roots-F1-options.md, 2026-08-31). Additive, v5-ONLY, INERT. Adds bondedRoot, epochSetRoot, qualifiedRoot, slashedRoot, validatorsSeenRoot — one scalar leaf each whose value is the RFC-6962 MTH over the CANONICAL sorted id-list of that keyspace's member set (membership-only; weights stay in the per-member leaves). They commit SET COMPLETENESS for the five whole-set committed reads so a root-only floor box can reconstruct-and-compare, closing the gap that an SMT inclusion proof certifies only the members you were given. Certified 2026-08-31 (v5-wholeset-digest-root-addition-RESEARCH-CERTIFICATION, PE cross-check RULING-v5-wholeset-digest-root-cert-crosscheck). Emitted by stateRootLeavesV5 ONLY, after the untouched era-3 leaves, so a v4/era-3 root stays BYTE-IDENTICAL (immutable #632). C-4 always-emit: an empty keyspace commits translog.MTH(nil), the fixed empty-MTH constant, with NO absent-vs-empty shortcut. C-7 prefix-safe: each tag is \x00-terminated and collision-free under Key = tag||rawKey, bound to a dedicated emit guard (stateRootDigestTagsV5). NOTHING reads the roots this increment — no validity predicate, no recompute; F3 wires the root-only recompute (with the C-1 per-member value proofs and C-6 genesis config). Ablated red-before-green: v4 byte-identical (a digest root emitted into the era-3 path reddens the immutable gate); each root load-bearing (add/drop a member moves its root); empty keyspace commits the empty-MTH constant; the emit guard forces all five tags. Reconciled the R3 execution-derived read-set completeness guard and the quorum-stack whole-set enumeration (#664) with the new digest-root leaves (core/chain/readset_v5_drift_test.go, core/chain/readset_v5_quorum_wholeset_test.go): the five digest roots are DERIVED output commitments the box recomputes, not witnessed reads, so the ground-truth derivation excludes them from the write-diff and the cross-leaf perturbation (isDigestRootLeaf) — the leaf-set analogue of the existing validateEra3Roots root-recompute exclusion. Without the exclusion, perturbing any member of the five keyspaces flips that keyspace's digest root and the guard falsely reports every member as read, and the apply-channel enumeration mis-attributes quorum-stack folds (e.g. slashed) to the apply channel. Pure reconciliation: no guard-model change — the ablations still redden on a dropped per-member read (the member's own leaf, not its digest root, carries that signal), and the TestGroundTruthPerturbationCovers keyspace-coverage invariant keeps its teeth (the digest-root exemption is narrow and asserts each digest-root leaf is present).

consensus model-check — the unified step-oracle assertInvariants(replicas) (#406) (core/node/modelcheck_unified_oracle_test.go, docs/thinking/2026-08-30-406-consensus-modelcheck-harness-options.md, 2026-08-30). Test-infra only; no consensus rule, validity predicate, or apply change. The existing per-invariant oracles each drive their own scenario and assert their own invariant; the spec (docs/design/consensus-model-check.md) also calls for a single cross-cutting oracle "called each step" — absent until now (grep assertInvariants returned nothing). This adds assertInvariants(replicas) plus a deterministic stepDriver that delivers one message at a time over the real mature 4+4 node world (matureWorld) and asserts the oracle after EVERY delivery. Covers the two invariants expressible as pure functions of observable cross-replica state: I1 (no two replicas finalize different block hashes at one height, via FinalizedHeight+Blocks) and I5 (no honest replica slashed, via OnSlash). Ablated to the hard bar: the oracle goes RED on an injected I1 disagreement and an injected I5 honest-slash, GREEN once removed; the honest 3-round schedule stays GREEN over 126 deliveries to finalized height 11 with all 8 replicas agreeing. I2/I3/I4 stay owned by their dedicated exhaustive oracles — this monitor does not reimplement them. Also trues up the oracle-coverage maps in both core/node/modelcheck_unified_oracle_test.go and core/chain/modelcheck_test.go: the docstrings now cite the sibling per-invariant oracles by their real repo-root paths (the I1/I3/I5-enumeration oracles are core/chain files, not in-package), and the stale "NOT YET BUILT" list in core/chain/modelcheck_test.go is corrected — those I1-mature/I3/I5/I2 oracles are now built (per PE ruling RULING-406-unified-modelcheck-oracle-2026-08-30.md).

era-4 (v5) trustless floor-box validation — lane-1 Part B increment B1 (the SOUND, ADDITIVE slice: the #535 cold-auditor recovery-boundary policy + the additive entry point; the accept-core recompute is research-gated and NOT built) (core/chain/floorbox_v5.go, core/chain/floorbox_v5_test.go, docs/thinking/2026-08-30-lane1-partB-witness-validation-options.md, 2026-08-30). Chain.WitnessValidateV5(block, parentStateRoot, recoveryDirective) is the ADDITIVE floor-box validation MODE — a SEPARATE path a root-only client calls instead of holding the tree. It changes NO full-node accept path: apply, validateEra3Roots, postApplyRoots, every validity predicate, and I1–I5 are untouched.

• Ships the RATIFIED #535 policy (decisions.md 2026-08-30 item 3): the recovery directive is sourced ONLY from the box's own local -ws-checkpoint-class config (RecoveryDirective), NEVER the proposer or the block. A directive PRESENT for an ambiguous recovery boundary ⇒ proceed to trustless validation; ABSENT (cold-auditor default) ⇒ a LOUD IndeterminateTrustlessly (do NOT accept, never trust the proposer); LiveFollower is an OPT-IN flip. RecoveryBoundaryDecision is the standalone, unit-tested policy; isAmbiguousRecoveryBoundary mirrors the full-node effectiveEpochSet recovery-branch gate exactly (chain.go:1466-1468). The #535 residual is NOT claimed closed — closure is gated on the #603 bonded/epochSet keystone probes (noted in-code).
• The accept-core recompute is ROUTED TO THE RESEARCH GATE, not guessed. The bounded witnessable recompute that would decide Accept/Reject does not yet exist (PE ruling silt-reviews/principle-engineer/RULING-lane1-partA-readset-v5-producer-2026-08-30.md, premise 1: "a DIFFERENT, bounded witnessable recompute that does not yet exist in the tree (Part B)"). Building it soundly is blocked on two verified obstructions: apply() iterates WHOLE committed maps (the bondRegHeight TTL sweep, chain.go:3272) the BOUNDED read-set does not witness in full, so a witness-seeded-clone replay computes the WRONG write-set; and some read-set leaves are DIGESTS (dueBucket[h] is an MTH over its id set, statehash.go:224), not the typed data apply iterates. A correct bounded recompute is a NEW, soundness-critical, consensus-equivalent computation — a research-gated surface. This increment REFUSES to guess it: WitnessValidateV5 NEVER returns Accept (proven by TestWitnessValidateV5_NeverAcceptsWhileRecomputeGated); the safe-default IndeterminateTrustlessly (ErrRecomputeGated) holds until a certified recompute lands, at which point its verdict slots into the marked seam.
• Every proof case is ABLATED (defect injected, watched red): the cold-auditor stall, the directive-present proceed, the live-follower opt-in, the non-boundary non-ambiguity, the epoch-boundary gate match, the v5-only version gate, and the never-Accept safety invariant. go test ./core/... ./internal/... green; new tests green under -race.
• B1/B2 boundary: B1 = validate a witness bundle in hand (pure-core, witnesses fed in tests) + the #535 policy. B2 (later) = any-of-N witness delivery / networking / daemon mode, and the gated accept-core recompute.

era-4 (v5) witness read-set PRODUCER — lane-1 Part A, REBUILT against the AMENDED cert (the COMPLETE read-set + an execution-derived completeness guard) (core/chain/readset_v5.go, core/chain/readset_v5_drift_test.go, docs/thinking/2026-08-30-lane1-partA-readset-producer-options.md, 2026-08-30). Chain.WitnessReadSetV5(block) emits, for a v5 block, the WITNESS read-set as a []statehash.ReadEntry: the committed-state keys the v5 witnessable recompute reads to trustlessly re-derive the post-state root. Now the COMPLETE 23-keyspace read-set per the amended cert (silt-reviews/research/research-outcome/era4-witness-floor-box-readset-v5-AMENDED-RESEARCH-CERTIFICATION-2026-08-30.md, PE ruling silt-reviews/principle-engineer/RULING-lane1-partA-readset-v5-producer-2026-08-30.md).

• The completeness gap, closed. The prior build (dbeccf1, SHIP-WITH-FIXES) omitted the attestation-loop reads (per attester: slashed[id] + the qualification-set membership + the validatorsSeen[id] write-target), the maturity-latch reads (everMature + the Mature()→C2Metric inputs over validatorsSeen, each member's bonded/bondDomain/slashed), and the committed scalar leaves (epochStart/ era4LockedIn/era4Height/matureEpoch/gateLockedIn/gateHeight/era3LockedIn/ era3Height). Those leaves are consensus-load-bearing (validatorsSeen/everMature → maturity → anchor gating, F-1); a floor box witnessing only the prior subset could be made to accept a forged block on any of them. The rebuilt producer emits all of them, payload-driven and O(payload) for ordinary/TTL, O(RegCap) at a boundary.
• The execution-derived completeness guard (replaces the hand-written mirror). TestWitnessReadSetV5ExecutionDerivedGuard derives the "expected" read-set from the RECORDED leaf-touch of the REAL v5 recompute (postApplyRoots/stateRootLeavesV5 on a cloneForDryRun clone), by two ground-truth sources — a pre/post leaf write-diff and a leaf-sensitivity perturbation (a leaf whose pre-state perturbation changes some OTHER committed leaf is one the recompute reads) — and asserts the producer COVERS (⊇) it. It is NOT a second hand-written table (the prior guard was, so both sides shared the same blind spot and stayed green over the gap — the session-7 "green while covering nothing" scar). Corpus adds an attested block (real b.Atts), a maturity-latch transition (everMature false→true), and a standalone slash at a non-boundary height; the vacuity guard requires attested/maturity-latch/slash coverage.
• Regression-proven RED on the escaped defects. Dropping the attestation-loop reads reddens the guard on validatorsSeen (the exact prior-build gap); dropping the slash-path qualified[culprit] read reddens on qualified (TestWitnessReadSetV5DriftGuardAblation). The certified boundedness ablation stays: an injected O(registry) bondRegHeight scan scales the read-set with the registry and TestWitnessReadSetV5BoundedNotRegistrySized / ...BoundednessAblation redden.
• Boundary bound relabelled O(RegCap). The three activation tallies read regVersion + weight over the WHOLE frozen set, so the boundary READ-set is O(frozen-set) = O(RegCap) (not O(boundary-delta), which is the WRITE-set); box-fits at RegCap=256 unchanged. The certified hazard is still obeyed — the producer targets the BOUNDED witnessable recompute, never apply()'s O(registry) literal reads; the TTL completeness collapses to one dueBucket[h] leaf. Scope: the read-set PRODUCER + guard/corpus only — NOT the #535 boundary policy and NOT wiring IngestBlockWitnesses into acceptance (both Part B); no consensus rule or validity predicate changed, no production hook (the guard's leaf-perturbation setter is test-only).
• The VALIDITY-READ guard gap, closed (test-only follow-on, PR #656) (core/chain/readset_v5_drift_test.go, docs/thinking/2026-08-30-lane1-partA-validity-read-guard-gap.md, 2026-08-30). Blind review found the guard's ground truth was apply()-shaped (write-diff ∪ apply-recompute perturbation), but a floor box needs validity ∪ apply-recompute. spent[serial] (chain.go:2617) and revoked[root] (chain.go:2643) are read ONLY in the validity predicate, never in apply(), so both guard sources were structurally blind to them — dropping either from the producer stayed GREEN (21 of 23 keyspaces reddened on drop; two did not). Fix: a THIRD execution-derived ground-truth source, the VALIDITY-READ perturbation — for each committed leaf, perturb its pre-state and run the REAL validity read-predicates (validateTakedowns → revoked/byRoot; per-entry ValidateEntry → spent/byRoot); a leaf whose perturbation FLIPS the accept/reject verdict is a validity read. It excludes validateEra3Roots (the root recompute would flip every leaf; that channel is Source 1's write-diff), mirroring Source 2's own-key exclusion — so it isolates the pure validity-gate reads. A dedicated validity corpus (buildV5ValidityReadCorpus) carries a token spend and a revoke→unrevoke so the reads fire; the maintenance corpus is untouched. TestWitnessReadSetV5AllKeyspacesRedOnDrop is the completeness proof: drop EACH of the 23 committed keyspaces one at a time and all 23 redden (spent/revoked now included). TestWitnessReadSetV5ValidityReadsCovered is the coverage half. The producer's certified read-set is UNCHANGED (spent/revoked stay emitted); no consensus/validity/statehash production change (the perturbation is test-only).

PoD §7.3 transport BATCH 3 — the daemon control-frame binding: the paid relay pump now runs on a LIVE node, failing-first (docs/decisions.md, adapters/relay/wire.go, adapters/relay/server.go, adapters/relay/client.go, core/node/relayrole.go, core/node/relaytransport.go, cmd/silt/daemon.go, 2026-08-30). Binds the Batch-2 paid pump to the live daemon so a paid relay session runs end-to-end: open → paid connect → pay-as-you-go → settle. Policy: D-POD-RELAY-COEXIST — paid relay is ADDITIVE (Option B, RATIFIED 2026-08-30); free swarm relay is UNCHANGED and shares the same transport caps (docs/thinking/2026-08-30-pod-7.3-batch3-daemon-binding-design.md; cert silt-reviews/research/research-outcome/PoD-7.3-free-vs-paid-relay-coexistence-RESEARCH-CERTIFICATION-2026-08-30.md).

• The paid marker. One optional Paid uint64 field on the relay ctrl connect frame carrying the node's session handle (omitempty; zero = free, byte-for-byte today's path). A nonzero marker routes the connect to the paid splice; an old client (no field) decodes to free.
• The adapter/node seam. The daemon installs a PaidResolver on the relay Server (SetPaidResolver → Node.ResolveRelayAuthorizer) resolving (fetcher, handle) to the node-owned authorizer via the SAME ephID-ownership check handleRelayPay enforces, and a PaidSettler firing settle-at-close from the live pump's return. The verifier + M0 guards stay in core/node; the adapter stays a dumb byte pump. The resolver is called OFF the node loop and marshals the lookup onto it (clock.AfterFunc(0)), so the loop-only session table keeps its single-threaded invariant — -race clean across the seam.
• Refuse-never-downgrade (certified residual #2). A paid connect whose handle does not resolve to a live, owned session is REFUSED, never spliced free — a free downgrade would hand a non-payer an unfunded, uncapped forward. Failing-first.
• Reaper teardown. sweepRelaySeen now calls sess.closeSession() on each reaped session so a reaped session's now-live pump drains and exits (no leaked goroutine); single-settle is preserved (the reaper's delete makes a later pump-completion settle a no-op). Closes the Batch-2 TODO(Batch-3), failing-first.
• e2e proof. e2e/relay_paid_test.go: three real nodes over real TCP with the seam wired, asserting forward integrity, the live pay-gate, conserved settle with Reputation() unchanged (Invariant-A firewall), free relay still working with payments on (the Option-B witness), and the M0 settlement-log audit.

Keystone leave-one-out coverage for the era-4 (v5) qualified and dueBucket committed fields (core/chain/modelcheck_snapshot_equivalence_test.go, docs/thinking/2026-08-30-keystone-era4-loo-qualified-duebucket.md, 2026-08-30). Both fields were deferred by probeUncovered to 4c/4d because in 4b no v5 verdict read them; the committed-root predicate (4c #640) and activation (4d #641) landed, so a snapshot leave-one-out now flips a real validity verdict. v5RootWorld + qualifiedRootProbe/dueBucketRootProbe drive validateEra3Roots against a v5 block whose forged StateRoot omits the field's leaves: a full snapshot rejects it (ErrEra3StateRootMismatch), a snapshot that lost the field recomputes the same field-less root and wrongly ACCEPTS it (a claim-succeeded wrong-accept, not a panic). A vacuity guard reddens if the field's leaves do not move the root. Removed both fields from probeUncovered; no existing oracle weakened. Oracle/test coverage only — no consensus rule, validity predicate, or committed format changed.

Keystone leave-one-out — discharge all three shadowedProbes entries as in-scope fixture work; the debt list is now EMPTY (model-check/unit tier; no consensus rule touched — the probes OBSERVE existing predicates, move no rule). A blind PE ruling (RULING-bondregheight-probe-neuter-guard-2026-08-28, Q4) overrode the prior "research-gated" routing on the bondRootOwner/bondRootProven split: the coupling was a property of how the launch-world probes were built (both asked via c.bonded[claimant] in richHistory, where dropping EITHER field admits the challenger), not of the fields. The fix uses the field asymmetry: bondRootProven feeds ONE predicate (displacement, chain.go:2845), bondRootOwner feeds TWO (displacement AND restoresHeldStanding, chain.go:3054). bondRootProven gets provenDisplaceWorld — a PROVEN owner holds a root, a PROVEN challenger claims it; dropping bondRootProven ALONE (owner held constant) flips the displacement verdict proven-owner-held→displaced-the-proven-owner. bondRootOwner gets restoreOwnerWorld — a LAPSED frozen-epoch member re-proving its OWN root within R is EXEMPTED by restoresHeldStanding (which reads bondRootOwner, never bondRootProven); dropping bondRootOwner ALONE flips accept→ErrRegGate, while dropping bondRootProven in that world does nothing (uncoupled). The two shadowed launch probes are REMOVED; the mis-tagged revoking an unknown root probe (its verdict did not depend on the carried byRoot set) is REMOVED, byRoot still covered by dup-publish. Both new probes survive their own neuter — TestLeaveOneOutProvesEachFieldLoadBearing REDs naming the exact field, and TestNeuteringAnyProbeBreaksCompleteness is GREEN with shadowedProbes EMPTY. The displacement predicate, restoresHeldStanding, and the #506 R-rule are only OBSERVED; per-world genesis config selects the regime. Deliberation: docs/thinking/2026-08-28-keystone-shadowedprobes-discharge.md.

Keystone leave-one-out — fix a shared-block SHADOWING decoration probe + add a structural neuter meta-guard (model-check/unit tier; no consensus rule touched). A blind review found bondRegHeightProbe (core/chain/modelcheck_snapshot_equivalence_test.go) was DECORATION in the running oracle: it shared its within-R re-reg block with lockedInProbe in the gate-lock world (gate armed by gateLockedIn), so the leave-one-out loop — which breaks on the first flipping probe — let lockedInProbe catch the bondRegHeight ablation first and bondRegHeightProbe never ran. Neuter it and the oracle stayed green: a probe that proved nothing. Part 1: give bondRegHeight its own sole-discriminator world bondRegHeightWorld, where the #506 gate is armed by cfg.RegGateActivationHeight > 0 (chain.go:3027) instead of gateLockedIn, so gateLockedIn/gateHeight are unset and bondRegHeight is the ONLY committed-field discriminator. A within-R re-reg past the activation boundary is ErrRegGate-rejected with the field, accepted without it; neutering the probe now turns TestLeaveOneOutProvesEachFieldLoadBearing RED (changed NO verdict in any world). RegGateActivationHeight is per-world genesis config selecting the regime (the certified pre-latch trusted-fleet mode, chain.go:201); the R-rule is untouched. Part 2: TestNeuteringAnyProbeBreaksCompleteness neuters EACH probe in turn (forces its ask constant, keeps its detect tag) and asserts the completeness guard goes RED — every probe must be the SOLE catcher of at least one field. buildLeaveOneOutWorlds/leaveOneOutFlipped are extracted so the guard and the oracle share one code path; neutering is non-destructive (fresh probe copies per iteration). Running the guard honestly surfaced three PRE-EXISTING shadowed probes (byRoot double-coverage; the bondRootOwner/bondRootProven displacement coupling, chain.go:2839) — quarantined in a declared, shrink-only shadowedProbes debt list with routing notes (the bond-root split is research-gated), not suppressed. Deliberation: docs/thinking/2026-08-28-keystone-bondregheight-sole-discriminator.md.

Keystone weight-bytes — the bonded sibling probe (#603 era-3 freeze gate) (model-check/unit tier; no consensus rule touched — the probe READS the weight predicate, moves no threshold). TestBondedWeightBytesAreLoadBearing (core/chain/modelcheck_snapshot_equivalence_test.go) proves the committed per-member live bonded WEIGHT bytes — not merely membership — flip a de-maturation verdict through requireDeMatureSuperQuorum (chain.go:2591), the sibling of the epochSet probe (TestEpochWeightBytesAreLoadBearing, #606) named owed by the blind PE ruling RULING-603-weight-bytes-discharge-2026-08-28. bondedWeightBytesWorld latches everMature, then realizes UNEQUAL live weights plus one SHARED declared domain so !matureNow holds INDEPENDENT of the weight flatten (via NakamotoDomains=1, so the path-entry gate cannot masquerade as the weight rule). Membership held byte-identical, weights flattened to a constant: full (true weights, coalition 10 MiB of 12, need ≥8) → accept; ablated (flattened) → ErrDeMatureQuorum (2 MiB of 4, need ≥2), seen=1 clearing the Quorum=1 count floor. Non-vacuous by both ablations: no-flatten → accepts (ErrDeMatureQuorum assertion RED); empty membership → rejects via ErrNoQuorum (the assertion correctly refuses the membership-omission). Deliberation: docs/thinking/2026-08-28-keystone-bonded-weight-bytes-probe.md.

Keystone leave-one-out — the latch/gate/domain tranche proven load-bearing (model-check/unit tier; no consensus rule touched — probes a threshold, moves none). TestLeaveOneOutProvesEachFieldLoadBearing (core/chain/modelcheck_snapshot_equivalence_test.go) now covers six more committed fields, each moved out of probeUncovered with a real verdict-flipping probe on the world where the field is load-bearing:

• everMature — the de-mature bar (requireQuorumStack, chain.go:2471). deMatureWorld latches maturity while decentralized, then live weight concentrates (whale) so !matureNow(); a sub-⅔ real-bond coalition that clears the count floor must be refused. Full → ErrDeMatureQuorum (5 MiB of 105, need ≥70); everMature-dropped → accept (bar skipped).
• matureEpoch — the frozen-weight quorum (chain.go:2457). matureEpochWorld freezes unequal weights (silent whales) and narrows live bonded to the two coalition members; a below-⅔ commit that clears the count floor (bftThreshold(2)=1) must be refused. Full → ErrNoQuorumWeight (2 MiB of 23, need >15); matureEpoch-dropped → accept (weight rule skipped, qualification leaves the frozen branch).
• gateLockedIn — the #506 R-rule (regGateActive, chain.go:3030). gateWorld locks the gate at a boundary; a within-R re-reg PAST H_act must be refused. Full → ErrRegGate; gateLockedIn-dropped → accept (gate never armed).
• gateHeight — same predicate, OPPOSITE direction: a within-R re-reg BELOW H_act must be accepted. Full → accept; gateHeight-dropped (H_act collapses to 0) → ErrRegGate (gate active early).
• regVersion — read at exactly ONE verdict-relevant site, the rotateEpoch #506 lock-in tally (chain.go:3007), so a mutating probe APPLIES the boundary block, trips the maturity latch, and runs the tally. Full (⅔-ready) locks the gate → a within-R reg is ErrRegGate; regVersion-dropped tallies zero ready weight → gate never locks → accept.
• bondDomain — overturns the prior "metric, not a validity predicate" excuse. bondDomain feeds matureNow() via the A-axis Nakamoto coefficient (C2Metric → MatureCoefficient), and matureNow() gates the maturity latch (chain.go:2893) and thereby the launch-anchor shed. domainWorld merges all bonds into ONE declared domain so the network stays immature and an anchor-only commit is accepted; a mutating probe applies a block. bondDomain-dropped counts the bonds as independent → the coefficient rises → the latch trips → the anchors shed → the same commit is REJECTED (0 qualified via the anchor-shed). Full → accept; dropped → reject. Each probe was ablation-proven: its defect was injected and watched go RED with the named error, and the oracle's "changed NO verdict in any world" guard was confirmed to FIRE end-to-end when a probe's discriminator is neutralized (a green with no demonstrated red is decoration). STOP boundaries held: every flip changes which identities are ADMITTED (qualification) or whether a reg is a valid PAYLOAD — never the weight-sum seam (chain.go:2450-2456), the epochSet freeze / rotateEpoch (I3), the ⌈A/2⌉ threshold, or #603's weight discriminator. Deliberation: docs/thinking/2026-08-28-keystone-leaveoneout-latch-gate-domain.md.

Keystone leave-one-out — the last two committed fields closed; probeUncovered is now EMPTY (model-check/unit tier; no consensus rule touched — probes a threshold, moves none). TestLeaveOneOutProvesEachFieldLoadBearing (core/chain/modelcheck_snapshot_equivalence_test.go) now covers every committed field:

• bondRegHeight — the #506 min-interval R-rule (chain.go:1497), which reads c.bondRegHeight[id] and fires only when present. gateWorld (the #623 gate-active world) carries bondRegHeight[x]=1; a within-R re-reg PAST H_act must be refused. Full → ErrRegGate ("re-registered 4 blocks after its last reg, R=10"); bondRegHeight- dropped → the rule never fires → accept (a reg-flood identity admitted). The prior "no gate-active world" reason was STALE. (A third probe on gateProbes' past block.)
• validatorsSeen — overturns the prior "legacy mode only" reason, which was WRONG. C2Metric enumerates validatorsSeen in the OBJECTIVE regime (chain.go:1978) → MatureCoefficient → matureNow() (objective branch, chain.go:1867) → the maturity latch (chain.go:2893) → the launch-anchor shed — the same verdict path bondDomain rides. validatorsSeenWorld holds four anchors plus six equal real bonds each in a DISTINCT declared domain, all seen; a mutating probe applies a block. Full → validatorsSeen enumerates six participants → coefficient 3 ≥ MatureValidators 2 → matures → sheds the anchors → an anchor-only commit is ErrNoQuorum ("0 qualified, need 4"). validatorsSeen-dropped → the C2Metric loop sees zero participants → coefficient 0 → immature → anchors held → accept. Both ablation-proven: the defect was injected and watched go RED with the named error (ErrRegGate / ErrNoQuorum), flip reject→accept in each case. STOP boundaries held — bondRegHeight flips a VALIDITY verdict, validatorsSeen a QUALIFICATION verdict; neither touches the weight-sum seam (chain.go:2450-2456), the epochSet freeze / rotateEpoch (I3), the ⌈A/2⌉ threshold, or #603. probeUncovered is now EMPTY: every committed field has a leave-one-out probe with a demonstrated ablation RED. Deliberation: docs/thinking/2026-08-28-keystone-leaveoneout-bondregheight-validatorsseen.md.

Named the genesis same-root premise (residual R-G) — no genesis validity change. PR #618's seenRoot per-root distinct-ID dedup lives in validateBondRegs, which AppendGenesis (chain.go) does NOT run — it goes straight to apply. Genesis apply IS order-dependent for two distinct-ID unproven same-root regs (confirmed by execution: slice [A,B]→owner=A, [B,A]→owner=B). It is safe TODAY only by an EXTERNAL invariant, not by the guard: the production genesis is a byte-identical shared constant carrying NO BondRegs (genesis.Build, core/genesis/genesis.go), so there is no per-node slice order to diverge on. The era-3 SMT freeze's unconditional order-independence claim silently leans on this premise. This change NAMES it as a pinned, executable fact so it cannot break silently: a named anchor at AppendGenesis plus two guard tests — TestGenesisSameRootApplyIsOrderDependent (core/chain, pins the un-guarded order-dependence; flips RED if genesis is made order-independent) and TestProductionGenesisCarriesNoBondRegs (core/genesis, pins byte-identity + zero BondRegs; flips RED if the production genesis ever carries BondRegs or goes per-node). Both ablations verified. No change to genesis validity rules — this is the record-it half of the PE's "close it OR record it," inside the already- certified envelope. Making genesis order-independent by rejection would be a consensus-rule change to genesis validity (research-gated); see docs/thinking/2026-08-28-genesis-sameroot-residual.md option (b). PE ruling RULING-618-updated-sameroot-dedup-fix-2026-08-28 (/Users/andrewedmond/Claude/claude/silt-reviews/principle-engineer/RULING-618-updated-sameroot-dedup-fix-2026-08-28.md), residual R-G.

Order-independence coverage for the mature-epoch family — the orderVacuous debt, next increment. The order-independence model-check oracle (modelcheck_order_independence_test.go) declared the mature-epoch family (everMature, matureEpoch, epochSet) as orderVacuous: the launch-anchor twoOrderings world never matures (MatureValidators=99), so those fields were compared over ∅ and their order-independence was unproven. A new matureOrderings fixture brings an ANCHORLESS objective world (epochs on, MatureValidators=2) to maturity over two OPPOSITE-order histories: a bonded non-quorum victim is slashed at height 1 in one ordering and height 3 in the other, so the (bonded, slashed) maps are built by two genuinely different histories (per the #618 lesson that a commutative fixture is a decoration). Both freeze the SAME four-member epochSet at the height-4 boundary (liveQualifiedSet excludes the slashed victim), and both latch everMature / set matureEpoch. All three fields are non-empty and byte-identical across the two slash orderings. epochSet is order-INVARIANT BY CONSTRUCTION: rotateEpoch runs LAST in apply on the final post-block state, so the freeze is a deterministic read of the bonded/slashed maps whose own order-independence #617/#618 cover. This fixture therefore CONFIRMS invariance; it does not discover-or-refute a fork the way #618 did, because no admissible slash ordering in this world lets the intermediate bonded=5 state reach the freeze. Un-stressed residual, on the record: the latch/handoff HEIGHT dimensions are NOT varied — all validators bond at genesis, so the latch trips at the same height in both orderings; acceptable because everMature/matureEpoch are one-way final-state bools that cannot flip, but they are the honest residual (the consensus- correctness trip-wire did not trip; no rule touched). TestCommittedSetFieldsAreOrderIndependent now pairs each committed field with its populating world (the union-of-worlds pattern the snapshot oracle already uses); a dedicated TestMatureEpochFamilyIsOrderIndependent asserts the latch/handoff/freeze ACTUALLY FIRED (coverage is not vacuous) and the two orderings reached identical state. Three ablations verified RED-then-GREEN (drop a governor from one frozen epochSet; flip matureEpoch/everMature in one chain — each names the field). Three fields removed from orderVacuous. Two-list union: epochSet already had a leave-one-out snapshot probe (#604), so it now clears BOTH oracle lists (freeze-ready); everMature/matureEpoch clear the order-independence list only and remain probeUncovered-owed. The #506-gate family (gateLockedIn, gateHeight) is left for the next increment. Deliberation: docs/thinking/2026-08-28-orderVacuous-mature-epoch.md. Test/fixture only; no consensus rule changed.

Order-independence coverage for the bond-registration family — the #617 debt, first increment. PR #617 declared six committed bond-registration fields (bonded, bondRootOwner, bondRootProven, bondRegHeight, regVersion, bondDomain) as orderVacuous: the order-independence model-check oracle compared them over ∅ in every ordering, so their order-independence was unproven. The twoOrderings fixture now commits a height-5 bond block whose BondReg slice order flips between the two orderings — including a G3 proof-beats-declaration displacement of a genesis squatter (chain.go:2780-2794), the one bond rule whose intra-block order could genuinely matter. All six fields are non-empty in both orderings and byte-identical across them for this DISJOINT-ROOT construction: G3/bond-root ownership is order-independent for admissible blocks (the consensus-correctness trip-wire did not trip). A dedicated TestBondRegG3DisplacementIsOrderIndependent asserts the displacement actually FIRED (coverage is not vacuous) and both orderings reached identical bond-root state. Scope correction (certified 2026-08-28, see the CONSENSUS-RULE entry under Changed): this disjoint-root fixture does NOT cover two distinct-ID proven claims on the SAME root in one block — that case IS order-dependent in apply and is now rejected at the validity layer. The order-independence claim holds for every ADMISSIBLE block precisely because that collision can no longer be admitted. Six fields removed from orderVacuous. For the two-list union rule, a covering leave-one-out probe was added for bondRootProven (a proven owner must not be displaced by a later proven claim; a snapshot that lost the field wrongly allows it) and it was removed from probeUncovered. Fields now clearing BOTH oracle lists: bonded, bondRootOwner, bondRootProven. Fields clearing the order-independence list only (their snapshot-equivalence coverage is #506-gated or metric-only, tracked in probeUncovered): bondRegHeight, regVersion, bondDomain. The mature-epoch and #506-gate orderVacuous families are left for later increments. Test/fixture only; no consensus rule changed.

Fixed a state-aliasing hazard in the snapshot-equivalence oracle's snapshotBoot. snapshotBoot carried committed maps into a replica by REFERENCE, so a mutating leave-one-out probe (one that calls apply) wrote through the shared map header into src and every sibling replica. The leave-one-out loop ablates one field at a time off the same src, so a mutating probe on the k-th ablation silently poisoned the (k+1)-th — this masked bondRootProven's verdict flip entirely (the bondRootOwner F1 probe displaced src's shared bonded/owner maps before bondRootProven was ever ablated, so its ablation saw already-corrupted state and changed no verdict). snapshotBoot now deep-copies carried maps/slices so each replica owns its state. Test-only.

Order-independence + leave-one-out coverage for the spent and slashed SMT leaves, and a permanent vacuous-∅ guard. The keystone order-independence oracle reported "16/16 committedSet fields identical" while its fixture left spent and slashed empty, so two of the sixteen comparisons were DeepEqual(∅, ∅) — vacuous (PE ruling silt-reviews/.../RULING-keystone-spent-slashed-classification-2026-08-28.md). twoOrderings now commits two blind-signed publish-token spends and two committed equivocation slashes across two opposite orderings, so both fields are NON-EMPTY and byte-identical across order. A new fixture-side guard fails the order-independence test if any committedSet field it compares is empty in both orderings and not declared in orderVacuous (a shrinking debt with reasons), so "all N identical" can never again read as coverage over an empty map. The snapshot-equivalence / leave-one-out oracle gains spent and slashed probes (each flips a real verdict on omission), and both leave probeUncovered. A new TestBondedOrderFreeUnderSlashInteraction traces the PE's flagged residual — apply's delete(c.bonded, culprit) paired with slashed[culprit]=true — and proves bonded byte-identical across two opposite slash orderings. Test-only; no consensus rule moved. Each new probe was ablated (injected order-dependence → RED, reverted → green).

The O(depth) CI gate — a standing pass/fail check for the memory-accumulation subset of the depth-war class. The lineage #528/#535/#549/#555/#556/ #558/#560/#561/#562/#563/#572 is one class: per-height cost that grows with chain depth. A unit test at a fixed height is always green for such a bug (canonical #555: AllEntries built an O(n) slice per block — green in every constant-height test, catastrophic at real depth). sim/TestPerHeightCostLinear turns the standing memory-growth diagnostic into an assertion: it drives the mature-epoch consensus network up a height ladder and fails if baseline-subtracted HeapObjects grows super-linearly. Scope: this gate is MEMORY-only (baseline-subtracted HeapObjects). It catches the allocation-shaped depth blow-ups (#555 AllEntries), the OOM-producing subset that crash-looped the field cohort. It does NOT catch a CPU-time O(depth) scan that allocates little (e.g. #528's per-height CPU burn); that dimension needs its own noise study and is tracked as a follow-on. The gate that protects main on each PR is the SHORT ladder — every PR and push runs go test -short (ci.yml:44) and go test -race -short (ci.yml:65), which drive the 250→500→1000 ladder, still spanning two doublings. The wide 500→1000→2000 ladder runs on release.yml only. The bound is a two-stage doubling test — growth(2H)/growth(H) < 2.6 (measured linear baseline 1.998; a super-linear O(n²) regression ≈ 4.0; 2.6 sits 30% above baseline and 35% below the defect signal). HeapObjects is deterministic across runs (seeded sim + forced GC), so the gate does not flake on legitimate linear growth or GC noise; HeapInuse is logged but not asserted on (its arena-granular steps are too noisy). Proven failing-first: a synthetic O(n)-per-block accumulator (SILT_ODEPTH_INJECT=1) drives both doublings red (ratios 3.03/3.36). Runs in the default go test job, ~6s to h=2000, no new CI job. Shares the drive-and-measure helper with the OOM diagnostic so the measurement has one source of truth. Derivation and false-positive analysis: docs/thinking/2026-08-27-o-depth-ci-gate.md.

The coexistence balloon — the instrument that makes the floor-box RSS measurement mean something. The node-store profile (docs/thinking/2026-08-27-disk-backed-mapstore-options.md) recorded bbolt at 1M keys as heap 305 MB / RSS 1328 MB, but on an otherwise-idle box — so the 1328 MB over-counts the coexistence risk by exactly its kernel-evictable page cache, and the #600 question (does the cache shed toward the ~305 MB unevictable floor under a ~1 GB daemon's pressure, or does the box OOM?) went untested. This adds an env-gated (SILT_COEXIST_BALLOON_MB) memory balloon to internal/smtspike/TestStoreProfile: it allocates that many MiB of anonymous RAM, writes every page to fault it fully resident, and pins a live reference for the whole scale loop, so on a no-swap box the balloon genuinely competes for physical RAM against bbolt's page cache. Every rssMB row is then measured under that pressure and labelled rssMB(UNDER-PRESSURE). Unset/0 preserves the prior behavior byte-for-byte (rssMB(no-pressure)). TestBalloonResident proves the balloon pins real RSS: cross-platform via touched-page count + checksum, and on the Linux floor box via the residentMB jump (a malloc'd-but-untouched buffer creates no pressure and is caught RED). Pure test/measurement harness — no consensus, economic, or security code. See docs/thinking/2026-08-27-coexistence-balloon.md.

λ_H arrival-rate instrumentation — the one measurement the CT-1 conditional theorem is owed. The C-1 lift to CERTIFIED-CONDITIONAL (silt-reviews/.../C1-maturity-before-capture-CONDITIONAL-THEOREM-LIFT-2026-08-27.md) proves maturity precedes capture under an honest-arrival floor λ_H > 0 (measured), an adversary budget W_A (declared), and P2 (M_req > W_A/(2·w_min)). §6 names exactly one input silt did not hold in code: the live honest-arrival rate at launch, plus a floor-exit alarm. This ships both. λ_H is defined as the operator/domain-distinct bonded-arrival rate per block-height — the arrival COUNT A(t) is the SAME shed metric min(NakamotoOperators, NakamotoDomains), exposed as the pure getter chain.MatureCoefficient so the floor and the shed cannot count different quantities (the theorem binds T_mature ≤ M_req/λ_H). The daemon's commit observer trails A(t) over a configurable window (-lambda-h-window, default 20 heights) and narrates λ_H = ΔA/Δheight to the log beside the C2 concentration line. -lambda-h-floor (distinct arrivals/height; default 0 = disabled, so sims and existing deployments are unaffected) sets the certified floor: when the measured rate falls below it while the network is still young (pre-maturity latch — after the one-way EverMature latch the floor is moot, P4), a LOUD λ_H FLOOR-EXIT marker surfaces that the launch has left CT-1's hypothesis H and maturity-precedes-capture is no longer proven. OBSERVABILITY ONLY: it reads the committed C2 metric and narrates — it changes no validity predicate, no consensus rule (I1–I5), no security parameter. It parameterizes the certification, not the code (cert §6). Design: docs/thinking/2026-08-27-lambda-h-arrival-rate-instrumentation.md.

Keystone weight-discriminator probe — the committed per-member WEIGHT bytes of epochSet proven load-bearing (closes issue #603, the era-3 format-freeze gate). The membership probes prove epochSet MEMBERSHIP is load-bearing but would still pass if the field stored membership with all weights set to a constant, because omission empties frozen membership and rejects via the COUNT floor (ErrNoQuorum) — the ⅔-weight predicate never fires. TestEpochWeight BytesAreLoadBearing closes that gap. It builds a mature-epoch world with UNEQUAL frozen weights and a block whose support coalition (proposer + one attester, concentrated real weight) clears the count floor (Quorum: 1, seen=1) but whose verdict is carried by requireEpochWeightQuorum. Full case (true weights): the coalition holds 10 of 12 MiB → 3·10 > 2·12 → ACCEPT. Ablated case: membership held fixed, weights FLATTENED to a constant → support/total collapses to 2/4 = ½ < ⅔ for any constant → REJECT with ErrNoQuorumWeight, the weight predicate as the discriminator — not ErrNoQuorum. The rules are used as written (chain.go:2443-2464); no summation, freeze timing, or boundary was moved. Ablation-proven (the session scar): injecting no-blinding makes the ablated case ACCEPT (RED), and injecting the membership ablation (empty epochSet) flips via ErrNoQuorum: 0 qualified with seen=0 (RED) — so the probe rejects a membership-flip masquerading as a weight-flip. This is the load-bearing weight claim the era-3 committed-root format may now freeze on. Certified by C-7 (../silt-reviews/research/research-outcome/C7-witness-based-floor-box-validation-RESEARCH-CERTIFICATION-2026-08-27.md, the witness path needs per-field load-bearing state) and by the blind PE ruling's fix 2 (../silt-reviews/principle-engineer/RULING-keystone-probes-bonded-epochset-2026-08-27.md). Deliberation: docs/thinking/2026-08-27-keystone-weight-discriminator-probe.md.

Keystone leave-one-out — bonded and epochSet MEMBERSHIP proven load-bearing (PE-gated on the era-3 format freeze). The snapshot-boot-equivalence oracle's sharp half now probes two more committed fields out of probeUncovered and into probes (coverage 3/16 → 5/16): omitting bonded from the snapshot rejects a commit its bonded quorum should accept, and omitting epochSet rejects a mature-epoch commit its frozen membership should accept. Both flips run the real qualification+quorum predicate (collectQuorumSigs → requireQuorumStack), using the rules as written — no rule was tuned. The flip in each case is carried by membership (qualification), NOT the ⅔-weight predicate: omitting bonded disqualifies the attesters in the objective regime, and omitting epochSet empties the frozen set so its members fail membership. In both cases the verified RED is ErrNoQuorum (the count floor); requireEpochWeightQuorum never fires (with epochSet empty its total <= 0 branch short-circuits). Because bonded gates a verdict only where qualification reads the live bonded map (a non-epoch objective regime) and epochSet only governs a mature epoch, the two are load-bearing in mutually exclusive regimes, so the leave-one-out harness now ablates each field on the world where it flips. Ablation-proven: the leave-one-out goes RED ("changed NO verdict") when the probe is made field-blind, and each rejection is the frozen-set/bonded qualification error, not an unrelated panic. Owed (issue #603, era-3 format-freeze gate): these probes prove MEMBERSHIP is load-bearing, not the committed per-member WEIGHT bytes — a leave-one-out that flips via requireEpochWeightQuorum specifically (a coalition clearing the count floor but below ⅔ of frozen weight → ErrNoQuorumWeight) is still owed before the era-3 format freezes. Do not freeze era-3 on the weight claim until #603 lands. Blind-PE-reviewed (../silt-reviews/principle-engineer/RULING-keystone-probes-bonded-epochset-2026-08-27.md), Tester-confirmed injected RED. Deliberation: docs/thinking/2026-08-27-keystone-probes-bonded-epochset.md.

The disk-backed node-store spike — a batching bbolt MapStore, proven correct locally before any billable run (PE-ordered). PR #596 disqualified the in-memory SMT backend by kernel OOM, so the keystone needs a disk-backed store, and the certification's owed boot-rebuild measurement cannot re-run until one exists. internal/smtspike/ now carries boltStore — a batching kvstore.MapStore over bbolt, test-only, importable by nothing. The load-bearing design point is write batching: the SMT calls Set once per dirty node during Commit, so a naive one-transaction-per-Set adapter would fsync per node and make the measurement meaningless; instead Set buffers and Flush commits a whole block in one transaction. Correctness is proven before cost (the local-proof-before-billable rule): the disk-backed trie produces byte-identical roots to the in-memory reference across every block, survives close+reopen while still serving membership proofs, and handles the delete/tombstone path. The measurement harness (SILT_STORE_PROFILE=1) reports RSS, not just Go heap — bbolt is mmap'd, so its residency lives in the page cache outside the Go heap, which is exactly the OOM-relevant number the earlier heap-only draft would have missed. New evidence surfaced for the backend decision: the LSM candidate (pebble) pulls in 127 modules vs bbolt's ~1, so the recommended sequence is bbolt-alone on the floor box first, adding the LSM only if bbolt's write cost proves binding — evidence-driven rather than prior-driven. The floor-box run itself is billable and awaits explicit authorization. The floor-box run is now DONE (both backends, 1M keys, fair SSD box, no OOM): the unevictable Go heap ties at ~305 MB, so both fit the box; pebble is smaller on disk (234 vs 418 MB) and lower RSS, but that RSS gap is mostly kernel-evictable page cache, not the must-hold floor. Builder recommendation is bbolt — pebble's 127-module supply-chain surface outweighs its evictable-memory edge once heap and cache are separated — and Q6 resolves to persist (reopen is 7 ms vs an 18-min rebuild). The one owed follow-up is a memory-pressure coexistence test against a ~1 GB daemon. Reasoning: docs/thinking/2026-08-27-disk-backed-mapstore-options.md.

The hexagonal guard now walks TRANSITIVE imports — and it found the gap was already live (PE-ruled). internal/depcheck inspected direct imports only, which was honest while core/ imported nothing third-party. The keystone node-store decision makes that untrue, so the PE ruled the gap closed in the same change that opens it: a third-party package reaching the filesystem, clock, network or ambient randomness could otherwise enter core without tripping the guard, because the forbidden import sits one hop away — green check, vanished property. The new guard walks the module-aware closure (go list -deps) and checks third-party purity, deliberately skipping stdlib (fmt imports os by design; flagging stdlib would make it unrunnable). It fired immediately on four pre-existing effects, so this was never hypothetical. Each is now a reviewed, falsifiable claim rather than a blanket pass — most usefully: cbor's math/rand is verified unreachable in silt's configuration (its only use is SortFastShuffle in encodeStruct, and silt encodes with CanonicalEncOptions), so the entry doubles as a tripwire — switching encode modes would make block encoding nondeterministic and break consensus. The cpuid/os entry records the assumption it rests on out loud: the SIMD and generic Reed-Solomon paths must produce identical bytes, or erasure output would vary by host. Proven by ablation: an unlisted third-party effect fails the build. This is a ratchet, not a proof — it establishes that the next effect cannot arrive silently, which is the property that was missing.

Both certifications landed — canon amended, and the order-varying oracle that enforces the refinement. Research answered both open consults. #597 (revLog): the conflict was a category error, not a contradiction — the SMT choice stands, and revLog gets its own append-only root rather than becoming an SMT leaf. Canon's "one root over all committed state" is refined to one history-independent SMT over set-valued validity state PLUS a separate RFC-6962 root for any committed ordered log (the Ethereum shape: stateRoot + receiptsRoot + txRoot); the snapshot carries the full revLog entry list, preserving H9 proofs for snapshot-booted nodes at the cost of the smallest forever term. epochStart is reclassified as an observable — reorg-swapped but under no committed root. Relay (knob 2): amended from "dispute-only quorum-TTP" to no TTP at all — the relay leg is self-enforcing, so there is no adjudicable dispute; a quorum-TTP could not remedy the one-increment stiff anyway, because forwarding is unprovable by any mechanism. PayWord chains, ~1–64 KiB increments pinned by a floor-box measurement, relay credit = operator balance (no new keystone field), one Invariant-A firewall regime. The feared privacy vector (a public dispute naming a fetcher key) dissolves with the dispute itself. The classification now carries a three-way taxonomy (committedSet / committedLog / observable), and core/chain/modelcheck_order_independence_test.go enforces the certification's Q4 mandate that the oracle vary append order: classification alone cannot catch a purely order-derived value. Two histories reaching the same final state agree on all 16 set-valued fields and produce different log roots — the certified resolution, asserted. Proven by ablation: reclassifying revLog as set-valued makes the oracle name it, i.e. it reproduces #597 mechanically.

The era-boundary Reload oracle — the keystone's RED home #3, shipped ahead of era-3. The certification requires this test to land before the change it governs, and forbids the shape of the mistake: extend the shared era-aware verification path (verifyAtt) — never fork a parallel era-3 path, and a failed replay must be a loud rebuild, never a genesis fallback. Era-3 blocks are not minted yet, so core/chain/reload_era3_boundary_test.go pins the two properties era-3 will need, in a form that extends by one block when it arrives: (1) a history spanning an era boundary replays through the single verifyAtt dispatcher — a forked path works fine on a single-era history and breaks exactly at a boundary, which is what every real chain is at an activation height; (2) a block from a future era — precisely what era-3 activation creates for every un-upgraded node — is rejected loudly and reports the honest count of what it restored, so no caller can mistake a truncated replay for a complete one. That second property is #558 carried forward: the damage there was never the rejection, it was the silent fallback that discarded finalized history while reporting health. Both are proven RED by ablation (drop the PhaseLegacy branch → (1) fails; make the default branch accept unknown eras → (2) fails), and a positive control asserts the rejection names a signature/attestation failure so it cannot pass because the forged block was malformed for an unrelated reason.

The incremental-cost oracle — the keystone's RED home #2. The certification's Q4 gate: count actual hash computes per block; RED = O(state), GREEN = O(changed·log n) with an explicit budget — guarding the #555 scar (Hash re-marshaling the world on the hot path), which would surface not as a correctness failure but as a node quietly falling over on the floor box. internal/smtspike/incremental_cost_test.go counts digests, not wall-clock: shared cloud hardware carries ~2× timing variance, so a time budget would be either too loose to catch a regression or flaky enough to get disabled, whereas a digest count is exact and identical on a laptop and a 1 vCPU box. Measured: applying 64 changed keys costs 544 / 780 / 978 digests at 1k / 10k / 100k state — 1.80× growth for 100× the state, and 6.78× for 8× the changed keys, so cost tracks changed and not state size. budgetK is set from measurement (0.85–1.61 digests per changed key per log₂n, so 3 gives ~1.9× headroom) rather than guessed, and the budget constrains the shape, not just the constant. The RED case is demonstrated rather than asserted: a full-tree recompute costs 44,733 digests, 18× over budget — and that test fails if the budget is ever loosened enough to admit it, so the constant cannot be quietly inflated to hide a regression.

Snapshot-boot equivalence — the keystone's RED home #1, both halves. Part 2 is the differential oracle (core/chain/modelcheck_snapshot_equivalence_test.go): a validator booted from committed state alone — never having replayed the history — must reach the same verdicts as one that replayed, which is the property the whole keystone rests on. The snapshot-booted replica is built by reflection over the classification, and one detail falls out for free: blocks is classified input rather than committed, so "copy every committed field" yields a replica with no history by construction. The leave-one-out half is the sharp one — omitting a committed field must change a verdict, and the passing output is evidence rather than an assertion: dropping byRoot turns dup-publish from reject into accept; dropping revoked breaks un-revocation; dropping bondRootOwner turns a second identity's claim on an already-owned bond root from claim-blocked into claim-succeeded — one plot backing two identities, a direct C1 no-discount break. The oracle also corrected its own probes: it first flagged three fields as not load-bearing, and attribution showed the probes were wrong — F1 dedup lives in apply, not in a validate predicate, and bondRegHeight's min-interval is gated behind regGateActive (#506). Probe coverage is 3 of 18 committed fields; the rest are declared in probeUncovered with what each would need, and the test fails if a committed field is neither probed nor declared, so the debt cannot grow silently. Consensus engine untouched; I1–I5 untouched.

State-field completeness ratchet — the keystone's RED home #1, part 1. The state-root certification makes one obligation load-bearing: the field enumeration must be proven complete by an oracle, not by inspection, because inspection already missed fields. The tempting test — capture the listed fields, restore, compare — is inspection wearing a test costume: it can only test the list it was handed, so field #17 lands green and silent (the #558 class). Instead core/chain/modelcheck_state_completeness_test.go cross-binds three enumerations by reflecting over the live Chain struct: the classification of every field, the populate helper, and adopt — product code on the reorg path. A new field fails classification; once classified it fails populate; then it fails adopt. Proven failing-first by three ablations (add an unclassified field / drop a field from adopt / drop one from populate), each RED then reverted. It found a live disagreement: Chain has 25 fields, the certification enumerates 16, and adopt already copies 19 — the extra revLog and epochStart are written from block history but absent from the certified set. revLog is the sharp one: it is a history-dependent append-only transparency log backing the H9 non-globality proofs, so a snapshot-booted node cannot rebuild it from set-valued state — which the certification's history-independence argument for choosing the SMT does not address. Consensus engine untouched; I1–I5 untouched (the tests only read state). Reasoning, findings and the still-owed differential half: docs/thinking/2026-08-27-snapshot-boot-equivalence-oracle-design.md.

The keystone SMT spike — pokt-network/smt proven, not just read. The state-root library recommendation rested on quoted source rather than executed code, and was explicitly void if a spike disagreed. internal/smtspike/ is that spike, and it agrees. The assertion the gate turned on — an absence proof for a PRESENT key must FAIL — holds against all three adversary shapes, and the test fails if the library's "non-membership proof on related leaf" guard never fires, so the branch the soundness rests on is exercised rather than assumed. Measured cost is stable across 1k–1M keys: 2.24 nodes and 218 stored bytes per key, ~900-byte proofs, and applying 100 changed keys costs 2.37 → 3.01 → 3.80 ms across 1k → 100k state — 1.27× per 10× of state against the 1.25–1.33× log n predicts, so the certified O(changed·log n) shape holds and the #555 O(state) scar does not return. Measured on a real 1 vCPU / 2 GB floor box (dedicated e2-custom-1-2048, no swap), which confirmed the laptop projection to the digit: 751.6 MB heap at 1M vs 751.7 MB on the M4. The finding: the in-memory backend is disqualified. Residency is 752 B/key — 3.4× the 218 B stored payload — and the floor box OOM-killed the trie at 2M entries (anon-rss 1.68 GiB); even 1M would not fit alongside the flixz daemon's 1060 MB. The library is adopted, the reference in-memory backend is rejected: the trie needs a disk-backed MapStore (five methods), which is the only configuration that survives build-immutable #8. Boot rebuild measured at ~22 s per 1M, a lower bound pending the real disk store. The dependency adds zero new indirect dependencies and no product package imports it. Reasoning and numbers: docs/thinking/2026-08-26-keystone-smt-spike-results.md.

PoD neutral lane runs in a real daemon — -accept-delivery-receipts + silt swarm receipt. This closes the e2e-tier gap #590 reported honestly: the lane was built and proven at unit and sim tiers, but no daemon ran it. Now both halves exist. Server: a validator started with -accept-delivery-receipts banks receipts against its own token-issuer key (the bilateral issuer==server shape the certification's settlement answer covers) and settles the conserved delivery credit. Fetcher: silt swarm receipt <root> -peers ID@ADDR blind-withdraws a retrieval token, signs the delivery receipt, and submits it — the fetcher half of the lane, which the CLI previously had no surface for. The e2e asserts the full path over real TCP and goes past "banked" to assert the settled credit is non-zero, so a lane that banked a neutral observable while paying nothing would fail rather than pass quietly. The lane is off by default; a daemon without the flag refuses the receipt and the client reports the refusal instead of a success it did not get. Delivery credit remains balance-only and can never reach standing.

D-TIERING mode flags — -archive and -serve-content (the near-term build-gated items of the tier model). -archive is a genuinely new capability: an archival node retains every block's heavy space-time bond proof to genesis instead of shedding it below the rolling retention horizon, so it can serve the deep history a pruning swarm has already dropped — the answer a node stranded past the prune horizon needs (ErrNeedCheckpoint, #559's true-loss residual). It is retention-only, never validity: the trust floor and retention horizon are untouched, pinned by a test asserting an archival and a pruning chain agree on both, so the tiers cannot fork against each other. Costs O(all history) resident payload — off by default, and build-immutable #8 forbids it on the 1 vCPU / 2 GB box, which is the reason the tier model exists. -serve-content is the positive spelling of the content axis (default ON), so an edge profile composes as -serve-content -archive=false -validator=false rather than as a double negative; the legacy -freeload is unchanged and remains its inverse. A contradictory pair (-freeload -serve-content=true) is refused loudly rather than silently resolved (S3). The announced line carries BOTH spellings (serve-content: OFF (freeload: ON)) because freeload: ON is a stable marker the e2e harness and operator tooling grep — an announced line is an observable contract (S5), and the first cut of this change broke TestFreeloadRoleSeparation by renaming it.

D-POD-KNOBS — the three Phase-4 economy/state knobs, DECIDED (owner ratification of the PE recommendations). (1) The delivery-credit skim routes to the object's durability escrow, not burn — the deciding reason is a cross-tier funding loop (edge delivery skim funds that content's durability on the persistent tier); conservation carries soundness independently, so the skim stays a deterrent knob and must not be raised for anti-wash reasons. (2) Relay compensation resolves disputes through a dispute-only quorum-TTP, under the load-bearing scope condition that a dispute adjudicates the payment chain only, never transit — which is what keeps the resolution signature-verifiable and keeps the verifiable-escrow unknown confined to strong-form PoD. (3) A bond root's ownership record follows current possession (TTL-lapse), required so the keystone's committed state stays bounded; lifetime provenance survives in the archival tier's chain history. Recorded in docs/decisions.md; (1) is shipped, (2) lands with relay compensation after its consult certifies the scope condition, (3) freezes into the keystone field set (live ledger behavior unchanged for now).

Owner-knob guards + the relay dispute gate answered (per silt-reviews/principle-engineer/RULING-PoD-keystone-owner-knobs-2026-08-26.md, which concurs on all three knobs) — two regression locks the PE prescribed. TestPaidBountyIsNotRecoverableBySupersede: escrow skim-routing is sound because the supersede reversal floors at the remaining reserve, so a bounty already paid for real repair work is never clawed back — if that floor regressed, escrow would begin minting recoverable balance and burn-routing would become the correct choice instead. TestRootOwnerFeedsOnlyTheDedup: rootOwner feeds the F1 dedup and nothing else (both slash paths dock by identity regardless of root ownership), which is the property that makes the keystone's TTL-lapse option safe; the companion anti-griefing property is already pinned by core/bond TestRedteamG2_PlotBoundToClaimedIdentity. Recorded with them: the relay-dispute gate is signature-verifiable — the certification forbids adjudicating transit (no transit proof exists), so the only adjudicable quantity is the self-verifying payment chain, and the quorum-TTP direction does not reactivate the verifiable-escrow unknown so long as relay disputes stay scoped to payment. Builder evidence, routed to the relay consult; the three knobs remain the owner's calls.

PoD neutral lane BUILT — the witnessed delivery credit, conserved (Phase 4 §7.1) (per the certified docs/design/pod.md) — a banked delivery receipt now settles a conserved balance credit: the fetcher's withdrawal fee, less the 1/8 durability skim routed to the object's escrow (Ledger.RedeemDeliveryCredit, wired in handleDeliveryReceipt). The certified supersede rule ships with it: every object-aware serve's self-credit is tracked provisionally per (requester, root) and a witnessed receipt REVERSES it before paying — a delivery is never paid twice (the banned subsidy). The receipt itself sheds its PoR leg (certification Q2: a public-seed proof deters no collusion and cost 128 SW samples/delivery on the floor box) — the neutral receipt is token + fetcher signature + the (serial‖object‖server) binding, domain-bumped to v2. Firewall pinned at both tiers: the Invariant-A guard classifies the new press neutral, a dedicated heavy-deliverer test asserts Reputation unchanged, and the sim closes the bilateral loop over the wire (pair net = exactly −skim; wash is a strict loss). Skim routing defaults to escrow pending the owner-knobs PE consult.

PHASE 3 BANKED — the deep-heights exit gate is MET (run fe2376a-deep: 30 pass / 1 gap / 0 fail) — 12-deep-heights drove h78→h132 (target 128) at ~48 s/height, the #549 Q4 barrier stabilized in 215 s, the retention prune engaged on every validator at depth and the pruned chain converged (12b/12c), worst RSS 0.65 GiB, zero OOM, and the S7 economy closed on the wire for the third consecutive sheet. Field-confirms and closes the entire depth-stall lineage (#549, #560, #561, #572, #573); #183's close condition is met (issue held open by owner directive). ROADMAP updated: Phase 3 ✅, the publish-bound re-derivation carried as the owed gate clause, Phase 4 (PoD spec-first) is the next phase. Evidence: integration/cloudtest/report-fe2376a-deep.md (artifacts PR #585).

#572: save-side regime line — restore/save PAIRS make the next under-latch self-locating — every chain persist (commit / catch-up / takedown) now prints the same regime snapshot as the restore line plus the head it went down with (chain: saved N block(s) [why] head=H:hash (everMature=… …)). Paired with the restore-time line, one diff decides the remaining #572 premises: last-save ≠ restore ⇒ store/replay layer; equal-but-wedged ⇒ downstream of restore; the head hash pins content. The legacy restored N block(s) from disk prefix is preserved (integration/consensus greps it).

#572 round 3: chain replay proven pure; the divergence hunt moves to the daemon layer, instrumented — the write-site audit (every latch/regime map writes only in apply/adopt) plus a full FIELD-SHAPE oracle (TestLatchReplayFieldShape_572: organic 12-seat gather, renewal treadmill at the R-rule-legal cadence, TTL lapse + re-entry, latch + handoff + three rotations, wire-faithful Reload) are both GREEN — replaying identical blocks provably reproduces the latch at chain level. So 474718e-deep's under-latch must arise outside pure replay: the daemon now prints the full regime state at every restore (everMature/matureEpoch/seen/bonded/epochStart/epochSet via chain.Regime), so the next occurrence names the map that failed to rebuild. Also: ValidateProposal's objective rejection now names the ACTUAL disqualifying branch (slashed / not in the frozen epoch set / not a launch anchor / under-bonded) — the field's misleading "bonded 1048576, needs 1048576" was a frozen-set refusal wearing a bond-size costume. The #563 memory bench now skips under -race (shadow memory + pool suppression inflate the live-heap peak ~10×; the budget is only meaningful uninstrumented).

#572 round 2: latch-replay determinism oracle — the 474718e-deep diagnostic named the stall branch (val-d refused every mature commit with ErrAnchorRequired need=3 at h32 after a drill restart restored the 32 blocks that had latched everMature live at ~h14): replay of a latch-producing history did not reproduce the latch. TestLatchSurvivesReplay_572 asserts latch-replay determinism (wire-faithful roundtrip + fresh Reload); GREEN on matureWorld12's shape, which bounds the remaining search to the field's latch dynamics (validatorsSeen/C2 accumulation under the renewal/TTL cadence). Full attribution on issue #572.

#572 sync-stall repro guards + per-sweep catch-up diagnostic — the 027c354-deep val-c stall (100+ min of no-progress sweeps) was unattributable because every failure branch of the SyncChain walk logs at debug or below. The deterministic repro (core/node/syncstall_572_test.go, exact 12-seat topology, epoch rotation in the gap) EXONERATED the leading suspects: a healed behind seat catches up in one sweep, and the field's chain-behind-ahead-mark shape (chain h24 / mark h33 — the markstore is atomic, chain.cbor save cadence lagged) neither blocks adoption nor moves the I2 mark. Both stay as regression guards. Since the mechanism is still unnamed, SyncChain now emits ONE warn when a sweep ends with zero adopted blocks while demonstrably behind — our-next, max-peer-head, probe/window/append/reconcile counters, last branch error — so the next occurrence carries its mechanism (RED-proven oracle: TestSyncStall_572_NoProgressSweepWarns). No behavior change on any sync path. Record: docs/thinking/2026-08-26-572-sync-stall-attribution.md.

#570 archival-format golden-fixture suite — committed chains every future HEAD must replay — four write-once serialized fixtures (core/chain/testdata/archival/: era-1, era-2, era-2-pruned, mixed era-1→era-2, the exact bytes chainstore.Save persists) replayed at HEAD against pinned head-hash and derived-state constants. Asserts the property no HEAD-minted test can: bytes written by an older binary must replay today — the #558 class (era-2 replay silently falling to genesis from #432 until last week) is now caught locally, RED-proven by reinstating the #558 bare-hash verification (era-2/pruned/mixed fail at block 1; era-1 stays green). Head-hash pins also catch silent hash-computation changes over committed bytes. Era-3 (the D-TIERING state root) must ADD a fixture here — this suite is its standing RED home (consult Q5). Record: docs/thinking/2026-08-25-570-archival-fixture-suite.md.

#549 in-process repro of the DEEP-run h68 stall — the field cause is not synchronizer logic — core/node/modelcheck_549_scatter_test.go models the field's distinguishing dimension (sybils active in the frozen set inflating the low-round round-change head-count while the heavy validator weight is mass-scattered across rounds). It is GREEN even under 50% sustained round-change loss (commits at round 2): because RoundCatchupMet is weight-based, sybil head-count cannot dilute convergence, so the h68 stall is not a synchronizer-logic defect but a real-WAN wall-clock timer-skew + scale dimension the untimed model cannot reproduce. Feeds the research consult (silt-reviews/research/549-h68-view-synchronization-stall-CONSULT.md); a RED here would be the home for any logic fix.

#183 red-team coverage caveats C-1 + C-2 closed — I5/I2 exhaustive oracles + disk-backed I2 durability — The external red-team verdict (M0 HOLDS) noted two harness assurance gaps, not protocol defects; both are now closed. C-1: the I5 and I2 oracles, previously covered by scenario tests, are promoted into the exhaustive-enumeration tier — core/chain/modelcheck_i5_accountable_test.go drives the real VerifyEquivocation over the full 2^4×2^4×2 space of same-height signature schedules (honest-never-slashed AND completeness, both directions), sweeps fork-choice determinism over all 24 permutations of a fork set (up from 3 hand-picked orders), and pins the bare-ProposerSig-is-not-a-vote exemption; core/node/modelcheck_i2_exhaustive_test.go drives the real signAllowedAt watermark against a mark reloaded across a restart over every (signed slot)×(competitor slot) pair in the {height,round,phase,hash} space. C-2: the I2 fsync-before-the-wire durability, previously verified only by inspection (all restart tests used markstore.NewMem), now has a disk-backed home — adapters/markstore/markstore_test.go (the first tests for that package: Save/Load survives a fresh-instance restart, atomic overwrite leaves no torn file, missing-vs-corrupt is start-vs-refuse) and core/node/i2_disk_durability_183_test.go (a real Disk-backed node refuses a same-slot competitor across restart; recordSign withholds the signature when the store cannot persist the mark — the fail-safe against an honest self-slash). All RED-proven against reverted mechanisms.

#535 fix (3): the operator-directed weak-subjectivity liveness-floor escape — The remaining layer of the certified recovery stack, built per the ratified design (PR #544). Config.LivenessRecoveryHeight (daemon -liveness-recovery-height, 0 = off) names ONE epoch-boundary height at which mature-epoch validation re-bases proposer/attester qualification and the >⅔ weight quorum against the LIVE qualified bonded set instead of the frozen epochSet — a single effectiveEpochSet(h) consulted by all three predicates (and the gather's SupportMeetsQuorum/solicitation, now height-threaded), so the set a quorum is sized over and the set it is filled from can never differ (the #402 law). After the recovered boundary commits, the normal rotation freezes the same live set and the chain resumes. NEVER automatic: a genuine >⅓-of-frozen-weight loss is outside the BFT liveness model (automatic re-basing was refuted — fix (2)), so a bled boundary stalls by default and the trust moves to a HUMAN who confirms the loss is a real outage and coordinates the SAME height on every honest node — the WSCheckpoint trust class, with the wrongly-invoked-recovery fork as the documented residual. Operator visibility (S5): Chain.BoundaryLivenessFloorLost diagnoses the wedge (live-bonded frozen weight ≤ ⅔ bar), the round-change path logs stalled-at-boundary naming the recovery, and chain-status flags a next-height-is-a-boundary head. Model-check (core/chain/modelcheck_535_fix3_recovery_test.go, RED-proven against the pre-fix rule): recovery-when-invoked commits the wedge topology and resumes; off/wrong/ non-boundary directives still stall (ErrNoQuorumWeight); replicas replaying the same directive reach the identical head. Detail: docs/thinking/2026-08-24-535-fix3-built.md.

#535 fix (2) refuted by the proof-first model-check — the recovery stack is (4) + (3) — The certification adopted boundary-local quorum re-basing (old∩next) conditional on a model-checked #402 handoff-intersection proof for a bled set. core/chain/modelcheck_535_fix2_rebasing_test.go discharges that obligation and finds the naive form unsafe: a boundary block finalizes a fork iff Byzantine weight exceeds ⅓ of the re-based total, and excluding possibly-honest lapsed weight raises that fraction — at the field numbers, 171 MiB Byzantine is safe against the full 516 MiB frozen set but breaks I1 over the re-based 324 MiB. This is the same fault-tolerance wall that sank fix (1). Automatic denominator re-basing is not safely realizable; the certification pre-ruled the fallback (fix (3), the operator-signaled weak-subjectivity escape, is the guaranteed-safe recovery). The model-check stands as the permanent evidence + regression (it asserts the shipped no-re-basing behavior — a bled boundary STALLS rather than forks — is the safe one). Detail: docs/thinking/2026-08-24-535-fix2-refuted-stack-is-4-plus-3.md.

#535 deterministic repro: the epoch-boundary liveness cliff (consensus model-check) — core/chain/modelcheck_535_boundary_wedge_test.go pins the mechanism the first Phase 3 deep field run (45da13c-17686) wedged on: the mature-epoch finality quorum needs signers holding > ⅔ of the FROZEN epoch weight, but a member that lapses or goes offline mid-epoch keeps its frozen weight in the denominator for the whole epoch — so once > ⅓ of frozen weight cannot sign, no block reaches the super-quorum, INCLUDING the boundary block whose commit is the only event that rotates the snapshot to a lighter set (a permanent stall that cannot self-heal; #506's R-gate compounds the non-recovery). The repro reproduces the field arithmetic exactly (a 9-of-12 live coalition at 324 MiB refused; a 10-of-12 control at 388 MiB commits). This is a consensus-rule question (whether the frozen denominator should exclude provably-lapsed members) — research-gated, consult filed at silt-reviews/research/535-epoch-boundary-liveness-cliff-CONSULT.md; no unilateral fix. Attribution: docs/thinking/2026-08-23-535-boundary-wedge-attribution.md.

The DEEP=1 exit-gate flow + chain-status prune visibility (ROADMAP Phase 3) — flow_deep_heights (opt-in DEEP=1, DEEP_TARGET=128 default) drives the chain past the maturing drills to depth with three graded rows: the honest ceiling reaches the target inside a wall bound with the #525 freeze early-exit (a crawl/stall at depth is itself the Phase 3 finding, reported with measured cadence); the retention prune is confirmed ENGAGED on every validator from real persisted state; and the flow-5 convergence probe re-runs on the pruned chain (the slice-5 suffix-sync-around-the-gap property at depth, on the #528 suffix-append path). Supporting product change: silt chain-status now prints the payload-stripped block count, so an operator (and the harness) confirms the prune from chain.cbor rather than a debug log line. Per-height bounds reuse the #451/#525 topology-aware arithmetic (610 s at 12 seats, verified against flow 10's certified value). Design deliberation: docs/thinking/2026-08-23-deep-heights-exit-gate-design.md.

#299 measured: the 1.5 MB bond answer is a parameter question, not an encoding one — Committed measurements (core/bond/answer_size_measure_test.go, verify_cpu_measure_test.go) decompose the answer: label-open blocks are 1264 KiB of the 1513 KiB total (64 opens x 5 x 4 KiB raw plot bytes); cross-open duplicate leaves are 0.9% at 64 MiB (the issue's dedup interim is refuted at scale); the Merkle multiproof union floor saves ~6% of the total; verify CPU is 1.8 ms/answer (batch verification not a cost center). The 10x levers (DefaultLabelSamples, BlockSize) are soundness parameters -> research consult filed (silt-reviews/research/299-label-samples-answer-size-CONSULT.md); Phase 3's multiproof/batch-verify tiers are deliberately NOT built on this evidence. Deliberation: docs/thinking/2026-08-23-299-answer-size-evidence.md.

The #506 version gate: the per-identity reg-inclusion rate bound ships as a validity rule behind a BFT-native activation — The #503-certified R-rule is now enforceable: past the activation boundary, a bond registration is a valid block payload only if its identity is unslashed (R∞ — the Defect-A commit path closed structurally, beyond the #508 proposer filter) and its last committed reg is ≥ R blocks old (R = max(TTL/4, K+2), derived; first registrations exempt; one identity cannot register twice in one block; ValidateBondRegErr pre-filters submissions so an honest proposer never mints a block its own rule rejects). Activation follows the research certification (BIP9 schema re-based on silt's primitives): each bond reg carries a signed readiness byte (BondReg.Version, conditionally signed like Domain, hash-committed, prune-surviving — deliberately NOT on the attestation, which Block.Hash does not commit and any re-serving peer could strip); at each mature epoch boundary the frozen set's rule-aware WEIGHT (never heads — a cheap-bond cohort cannot fake-signal an activation) is tallied against the same >⅔ super-quorum finality uses; the first boundary that clears it locks in one-way and enforcement begins at the NEXT boundary (H_act, chain-derived, replay-identical on every replica, reorg-immune per #357 finality). Monotonic: a later ready-weight collapse stalls, never forks. The trusted pre-latch fleet declares the boundary as genesis config instead (Config.RegGateActivationHeight). Deliberate deviation from the certification's packaging: no v3 block tag is minted — versionSupported on pre-gate binaries is an exact set, so a v3-tagged block would hard-fork them at decode; enforcement is height-keyed (the certification's own Q2 form) and BlockVersionRegGate serves as the readiness threshold. Stated residual: if the fleet never crosses ⅔ ready weight the rule never activates and the #503 interim remains the fallback — there is no safe force-activation. Regressions (core/chain/reggate_506_test.go, ablation-verified RED three ways): the three-clause R-rule at a pre-latch boundary, weight-not-heads lock-in, boundary-exact enforcement (storm accepted at H_act, refused at H_act+1), signature-binding of the signal, prune survival, replay-derived H_act, monotonicity. Build record + deviations: docs/thinking/2026-08-22-506-reg-gate-build.md.

Chunk write-path debug narration (chunk stored / chunk pulled / place attempt) — the #497 records-vs-bytes attribution instrument — Every path that writes chunk bytes into a node's store now names itself at -log debug: the MsgStoreChunk receiver logs chunk stored (chunk, sender, placement key, lease), a fetch-pull logs chunk pulled (chunk, provider — these copies mint NO provider record, the exact records-vs-bytes signature), and the placement client logs each place attempt outcome (a delivered-but-unacked store would be a silent extra copy; SILT_SWARM_DEBUG=1 narrates the swarm add/get ephemeral client to stderr). With it a disk census is attributable line-for-line to its writers — the instrument that attributed #497 in one LOCAL run: the publish is clean (30 files for 30 acks, records==bytes) and the "extra copies" are the repair sweep's transient survivor fetches plus retained NetGet pulls, none of which announce. The economy drill's premise is fixed on the same evidence: the pay window now covers the MEASURED repair cycle (sweep duration under dead holders is ~3-4 min — -repair-interval 2s bounds only the idle gap between sweeps), sized by ECONOMY_REPAIR_WINDOW_S (default 600s) with one journal-driven grace extension (ECONOMY_REPAIR_GRACE_S, default 300s) when the cycle is visibly in flight at expiry, and every verdict carries the post-kill sweep/repair evidence — a premise defeat (dead shards still "reachable") is now named as such instead of GAPing as a timing miss. Trail: docs/thinking/2026-08-21-497-records-vs-bytes-attribution.md.

Cloudtest harness: contained equivocation island (runs every sheet), seeded flow randomization, LOCAL/cloud state separation, empty-response honesty, idempotent economy retry — A batch of harness-trust fixes, several provoked by a real self-inflicted incident this session (a LOCAL verification clobbered a live cloud run's shared nodes.json — see below). Design: docs/thinking/2026-08-20-equivocation-island-design.md + the local-first doc.

• Equivocation island (flow_equivocation_island, 184-equivocation-island): the one destructive drill (a proven double-sign is a permanent F2 eviction) now runs on EVERY sheet, in a fully-contained separate consensus universe — 4 island anchors naming only each other, own genesis, NO external IP (Cloud NAT egress → zero IN_USE_ADDRESSES quota). Its slash consumes only the island's fault tolerance, never the main sheet's (the PE 2026-08-17 zero-FT-tail objection made structurally impossible), so it closes the skip-is-a-blind-spot gap the ruling left. LOCAL-verified green (real slash on the wire, height 1); terraform validated.
• Seeded flow randomization (RANDOMIZE=1 default, SEED= to replay): the order-independent flows run in a seeded-shuffled order so no flow can free-ride on state a fixed predecessor left behind (the hidden coupling that shared FT_LAST_LINK hid). takedown and restart-content now self-publish (like chaos/durability already did), so they're truly order-independent. Fixed points pinned: warm-up first, destructive flows (soak/maturing) last. First fully-green LOCAL sheet (20/0/0) ran on a random order that placed takedown and restart-content BEFORE publish-fetch — the proof.
• LOCAL/cloud state-file separation: LOCAL writes nodes.local.json/topology.local.json (never the cloud's nodes.json/topology.json), so a LOCAL run can NEVER corrupt a live cloud run's node map. Verified: a LOCAL sheet leaves a planted cloud sentinel untouched. This is the root-cause fix for the incident where LOCAL island verifications overwrote a running cloud sheet's map, breaking its ssh_node on zone=local and masking the real verdicts.
• Empty-response honesty: an ssh_node that returns NOTHING (node unreachable / wrong map) is now flagged LOUDLY as a PLUMBING failure and scored GAP, in both ft_publish and the economy flow — instead of an empty parenthetical that read as benign latency (which masked the clobber for a whole cloud run).
• Idempotent economy retry: the economy setup publish generates its payload ONCE before the retry loop (mirroring ft_publish), so a retry re-publishes the SAME root and picks up an entry that committed server-side after the client's fixed 10s registry timeout gave up (#441). The fixed 10s httpregistry client timeout itself is an owned product finding (build-immutable #5), proposed not shipped — see the thinking doc. LOCAL_PROOF parity is linted; the sever race and chaos premise-grading are fixed; re-drive loop (TEARDOWN=0 / FLOWS=) + dual commit stamp; nightly netem CI** (2026-08-20) — The local-first package (design + attributions: docs/thinking/2026-08-20-harness-local-first.md). Motivation: 20 archived cloud runs, zero fully green, with the recurring red concentrated in harness-quality rows — and the 1,600-line graded drive logic never executed anywhere but against billable VMs.
• LOCAL=1 backend: one container per topology node (shims provide the systemctl/journalctl/sudo surface; binary + shims COPIED, never bind-mounted — a host edit of a mounted shim tears the container's view, which LOCAL's own first run caught), same static IPs on a docker bridge, ssh_node → docker exec. The SAME scenarios.sh executes: first full local SMOKE sheet graded 10 pass / 1 gap / 0 fail in ~8 min for $0, RSS telemetry included.
• 184-partition sever race attributed + fixed: the sever was already correctly widened to all validator-role peers; the surviving GAP class was the BASELINE being read before the sever relaunch lands (seconds) on a chain committing drain blocks continuously — val-c "advanced during the partition" by committing in the unsevered window (run 2323b09: h27→h29). The flow now confirms the post-restart PARTITION banner, then baselines.
• chaos-fetch / durability-turnover premise classifier (roadmap 2a): a fetch failing with root not in registry means the publish premise broke upstream (#441-family) — now GAP (UNTESTED), never FAIL; real mismatches still FAIL. Run B's two chaos FAILs were this shape.
• Per-flow # LOCAL_PROOF: annotations + check_local_proofs.sh in CI: every graded flow names the local test that proves the same property, or an explicit n/a — <WAN-only reason>; the n/a set (2 flows) IS the owned cloud-only residue. Extends the #490 per-run gate per-flow.
• Re-drive loop: TEARDOWN=0 keeps the fleet standing; FLOWS="…" ./cloudtest.sh run re-runs a named subset; reports stamp product AND harness commits so a harness-only re-drive is attributable. Convergence aid only — a grade stays one clean uninterrupted sheet.
• Nightly netem workflow (.github/workflows/nightly-netem.yml): the adversarial + flakynet tiers get a standing gate — merge CI is clean-network and the GCP fabric is cleaner than the adverse internet these suites inject (build-immutable #5).
• The economy wire grade now covers S7's FULL sentence — prepay → SKIM → bounty + the g sample (owner-directed, same day): flow 11b-economy-skim arms one shard-holder as a zero-prepay caretaker (the skim lands on the SERVING holder's per-node ledger, and the UI surfaces only cared roots), drives fetches that must route through it (replication 1 → sole holder of its column), and asserts funded > 0 — pure skim, unmistakable. First wire PASS: funded=98310 with zero prepay (previously the skim leg was sim-only). Flow 11c-economy-horizon records the payer's reserve/horizonSec/cost-per-repair as an observational row per graded run — the S7 g instrumentation trail ("the one number to instrument"), a series no single run can grade.
• e2e/anchorstop_test.go (TestAnchorStopHaltsBondedNonAnchors) — the local twin of the cloud 5-sybil-no-capture flow: 3 anchors + 2 bonded non-anchor validators; baseline commits; ALL anchors killed → the bonded survivors commit nothing (the launch anchor gate, #402); anchors restart → the chain resumes. Green in ~60 s. (Its own failing first cut re-proved the #402 arithmetic: with A=2, -quorum 2 leaves one counting non-proposer attester and the baseline can never commit.) The maturing-latch e2e twin is the named residual (needs a >⅔-weight maturer regime design — docs/thinking/2026-08-20-harness-local-first.md).

The LOCAL proof of the full S7 economy loop (e2e/economy_repair_test.go) + -repair-interval — TestRepairBountyPaysOnTheWire runs the whole Phase 2 Slice 4 integration on real daemons over real TCP: publish erasure-coded (one k=10/n=16 stripe at the cloud's 256 KiB chunk) → swarm holders → kill the holders of 3 columns (> RepairSlack) → a caretaker reconstructs from parity → a peer caretaker-judge verifies both legs and the bounty draws the object's escrow (paid > 0) → the file still fetches bit-perfect. This is the enforced RUN_LOCAL_PROOF for the confirming ECONOMY=1 cloud run (the integration run 2323b09-20931 GAPed on was never proven locally — build-immutable #7). Building it found three latent cloud-scenario defects that would have GAPed the re-run even with the publish fix (#489): the scenario armed ONE caretaker, but the paramedic never judges its own claim and credit is per-node-local, so paid lands on the OTHER caretaker's ledger; it funded 2,000,000 against the 500,000 starter grant (FundEscrow refuses); and its relaunched caretaker had no -registry, which silently disabled the care loop entirely. flow_economy_repair now arms two caretakers (the judge is the relay — outside the killable role set), funds both within grant, and polls both. New daemon flag -repair-interval (default 60 s, unchanged) mirrors -bond-audit so a local swarm's repair sweep — and this proof — fires in seconds. Design + the run-1 attribution honesty note + the one-shot-claim residual: docs/thinking/2026-08-20-economy-local-loop-design.md.

silt swarm holders <link>: object shard placement made observable — Prints, per erasure column, the NodeIDs that claim to hold that column's shards (their DHT provider records under colKey). An operator uses it to see where an object lives; a test harness uses it to force a controlled reconstruction — killing every holder of more than RepairSlack columns drops that many shards from every stripe, so the caretaker must rebuild from parity (the deterministic trigger the cloud economy grade needs, which the sim had via KillColumns but the cloud lacked). New read-only node accessor ColumnHolders (resolves each column's providers via the same DHT walk NetGet uses; plants and stores nothing); uncoded objects report their per-chunk holders under uncoded. Tested over real TCP (e2e/holders_test.go — 16 columns, 48 holder entries resolved).

§0.1 repair-path memory footprint measured locally (core/erasure/reconstruct_mem_test.go) — The research cert's §0.1 gate ("measure repair RAM at production chunk size before the economy-ON grade") is a single-node property, so it is measured locally for $0 rather than with a billable cloud run (build-immutables #6/#7: reproduce locally first; the cloud harness publishes at the 64 KiB sim size and would hide the spike ~1000× anyway). Result: reconstructing one DefaultParams (k=10, n=16) stripe holds 1.0 MiB resident at 64 KiB vs 1.0 GiB at the 64 MiB production minimum. On a 2 GB floor box that leaves ~1 GB, and the daemon baseline is 0.5–1.25 GiB (measured in field run 6a38d7b-42691) — so production-scale repair + baseline can exceed 2 GB → OOM. Consequence: the economy-ON field grade (Slice 4) must run on a larger box or land a streaming/column-wise decode mitigation first (build-immutable #8). Plan: docs/thinking/2026-08-19-cloudtest-harness-improvement-plan.md.

-economy: the S7 repair-bounty payout enable — the keystone (Phase 2, Slice 1) — Turns the half-open economy fully on: an opt-in -economy flag (default OFF) under which a verified repair PAYS for a rebuilt shard from the object's own escrow. Per the PE ruling + research certification:

• Protocol price, never an operator amount (an operator-set base is a lottery, not a price — it undefines S7's equilibrium and opens a censorship-via-underfunding lever), and relative to the erasure geometry: base = c × (k × shardBytes) (credit.RepairBountyBase), so re-tuning Evolving-tier erasure params re-prices repair automatically. c = 1 is research-certified (decode <0.1% of the fetch cost so no upward pressure; g-neutral; smallest floor-honest value; self-funds hot data, cold stays prepay-dependent per D-S7). Config RepairBountyBase int64 (absolute, test-only) → RepairEconomy bool; the settle path threads the repaired shard's byte size and is a true no-op when off.
• Payee: (a-domain-fresh) — the paramedic that reconstructs a shard KEEPS it (becoming the paid holder) iff its own failure domain is unused by the stripe, funding the node that bore the reconstruction cost + the ~640 MiB–1 GiB RAM peak WITHOUT reducing failure-domain diversity (node.selfHoldEligible/hostShardLocally); else it places remote exactly as before. Chosen over paying the cheap holder (mis-attributes the price) and over unconstrained self-hold (trades away S2 dispersal).
• Invariant A holds — the bounty moves balance only, never standing — asserted by the failing-first merge gate (core/node: release-pays-holder-never-standing, economy-OFF-is-a-true-no-op, default-OFF), plus the S2-safety gate (selfHoldEligible: self-hold only when the economy is on and the domain is fresh).
• Owned residual: the reconstruction step is unfunded in the non-fresh-domain fraction (fork (c) split-pay is the evidence-gated fast-follow); and the repair-path RAM at production chunk size must be measured before the economy-ON field grade (build-immutable #8 — the 64 KiB sim hides the spike ~1000×). Rulings + cert: docs/thinking/2026-08-19-phase2-economy-on-deliberation.md.

POST /api/fund: the durability endowment path (Phase 2, Slice 3) — A publisher/operator can now prepay an object's repair reserve from the daemon's own earned credit balance, so content outlives churn before it is popular enough to self-fund via the serve auto-skim. Wires the built-but-uncallable FundDurability to a token-gated endpoint that accepts a silt:/siltcare: link or a bare root hash plus an amount (credits), and returns the object's new reserve and the node's remaining balance. Status contract: 200 endowed, 402 insufficient credit (a client-correctable condition, not a server fault), 400 bad input, 401 without the bearer token. Standing is untouched — the credits come from serving and fund durability only (Invariant A). Tests: cmd/silt/fund_test.go (parse link/hash, endow-debits-balance, 402/400/401). Decision- independent of the pending RepairBountyBase ruling that gates Slice 1 (the payout enable). Deliberation: docs/thinking/2026-08-19-phase2-economy-on-deliberation.md.

Durability telemetry: the S7 repair economy made observable on /api/status (Phase 2, Slice 2) — The economy runs half-open on a live daemon today: the serve auto-skim (1/8) already fills each object's durability escrow (node.go records RecordServeToObject), but the funded reserve, lifetime skim/pay, the funded horizon, and whether bounties actually disburse were invisible (credit.G/Horizon were computed only for a local repair decision, never surfaced). /api/status now carries a durability block: the node's credit balance (what serving earned), a bountyOn flag (whether RepairBountyBase > 0 so verified repairs actually pay — false by default, the half-open state named honestly), and per cared object its reserve / lifetime funded / paid / repair-count / projected funded-horizon seconds. New node accessors CreditBalance, CaredDurability, RepairBountyEnabled (loop-owned, read-only). Standing is never in this block — Invariant A holds (credits fund durability, never consensus weight). This is the prerequisite for watching g once the economy is switched on (Slice 1). Tests: core/node/durability_telemetry_test.go. Deliberation + the full Phase 2 slicing (and the one open decision — is RepairBountyBase a protocol constant or an operator flag?): docs/thinking/2026-08-19-phase2-economy-on-deliberation.md.

RSS/memory-envelope telemetry in integration/cloudtest (Phase 1.3, evidence hygiene) — The field harness detected memory only as a binary crash signal (scan_node_liveness greps journals for OOM-kill / Go-fatal) plus an on-demand heap profile; there was no continuous RSS series, so the MATURING OOM "return-to-2GB" headline rested on the absence of a crash, not a measured ceiling (the fresh-eyes audit's finding — no committed RSS artifact backed the claim). Now every run samples each node's cgroup memory (systemctl … MemoryCurrent — the exact quantity GOMEMLIMIT and the OOM-killer act against) every MEM_SAMPLE_INTERVAL (default 30 s) into a rss-<RUN_ID>.jsonl, and scan_node_memory records an infra-node-memory finding with per-node peak / final RSS. Strictly additive and failure-tolerant (a missed read never affects a verdict); purely observational (S5 — it reports the envelope, the crash verdict stays with infra-node-liveness). The series is git-ignored by default and force-committed for any run cited as evidence, matching the console-log convention. Sampler + summary logic unit-verified locally; the artifact itself lands on the next real run. Design: docs/thinking/2026-08-19-cloudtest-rss-telemetry.md.

The MsgSubmitBondReg CPU gate — per-sender submit budget + sender binding (Phase 1.2, the pre-#183 DoS floor) — The bond-renewal submit path had no rate limit: every well-formed, self-signed registration forces up to one VerifySpaceTime on the node's single loop (measured ~2–3 ms valid / ~0.5 ms garbage-until-reject at the field config on an M4 core — core/bond/ verifycost_bench_test.go, the new sizing benchmark), so one authenticated identity holding a pipe could keep the loop at a permanent duty cycle for free — the #424 bond-challenge CPU-DoS, one message kind over. Two cheap gates now run first: (a) allowBondSubmit — submits examined per sender per ChainSyncInterval window (burst 8; honest cadence is one submit per sweep while BondRenewalDue, so the budget clears honest traffic with wide headroom), charged BEFORE decode so a refusal costs a map lookup and a flooder gains no amplification; (b) sender binding — a submit is always the sender's OWN renewal (SubmitBondRenewal self-submits), so a reg whose ValidatorID differs from the authenticated transport sender is refused before any signature/proof work, closing the third-party replay hole (queue dedup sat AFTER the expensive verify, so replaying one captured valid ~1.5 MB reg re-paid full verification per message). Refusals are logged, never silent (B5); a refused honest submit heals by the existing resubmit-next-sweep retry, the same recovery as a WAN-skew refusal. Failing-first regressions: core/node/bondsubmit_gate_test.go (flood bounded to the budget, second sender not starved, budget refills on window turnover, third-party relay refused pre-crypto). Deliberation: docs/thinking/2026-08-19-bondreg-submit-cpu-gate.md — which also records the verify-cost measurement correcting E5's drain folklore (the ~100 ms figure was the prover; the verify is ms-scale by design), making the E5 drain-rate measurement rider the next step.

-allow-web-origin: opt-in browser transport onto the network — An off-by-default, exact-match CORS + Private Network Access allowance so a hosted resolver page can draw content from a viewer's LOCAL silt node (a cross-origin HTTPS→localhost request the browser otherwise blocks). Secure by default (empty list ⇒ localhost-only); the operator opts a specific origin in. One browser-facing transport; more are expected.

The MATURING OOM return-to-2GB: rolling retention horizon, payload-selective pruning, and suffix-sync (H2 slices 1–5 — now ENABLED) — A validator's chain grows O(all history) in the ~1.5 MB space-time bond proof (BondReg.Answer) carried by every registration, OOMing a 2 GB box (build-immutable #8, the hobbyist floor). The fix bounds the RESIDENT heavy payload to a recent finalized window. Slice 1: RetentionHorizon = finalizedHead − 2·BondTTL, epoch-floored (research-certified safetyDepth). Slice 2: Opt-1 pruned-block representation (Block.Prune drops the heavy Answer, keeps header + consensus sigs, stores the pre-prune hash so a pruned block still hash-links and stays valid late-reveal slashing evidence). Slice 3 (this change): the Q2 gate — a pruned (Answer-less) block is trusted, and its space-time re-verify skipped, ONLY strictly below the node's OWN finalized/checkpoint anchor (trustFloor); at/above it is rejected (ErrPrunedAboveHorizon), and a pruned block still carrying an Answer is rejected (ErrMalformedPruned). During a Reconcile replay the floor is pinned to the RECEIVER's anchor (threaded into the throwaway replica), never the peer's fork — so a peer cannot skip verification to forge standing (a C1/M0 no-discount break). The Reload/own-disk path needs no gate change (it never re-verifies bonds; the stored hash covers the sig). Consensus-invariants: preserves I5 (a pruned block is still slashable), reads I3/I4's finalized anchor; no quorum-sizing/signing/fork-choice change. Slice 4: pruneBelowHorizon — the actual in-place shed of BondReg.Answer from finalized blocks strictly below the prune floor (max(2·BondTTL, BondRegHeadWindow+margin) below the finalized head, epoch-aligned; 0 without finality or with a degenerate BondTTL, the PE-acked over-prune guard). Because the durable store and serve path both read c.blocks, one in-place shed bounds resident, on-disk, AND served heavy payload. Still DORMANT — no production path calls it: enabling it changes how nodes sync (mesh catch-up is a full-genesis Reconcile, which the Q2 gate rejects against a pruned peer), so the PE gated enablement on the safe sync redirect. Slice 5 (this change) is that redirect, which enables the prune: mesh catch-up now suffix-syncs from a node's OWN finalized head ({Height: FinalizedHeight} instead of {Height:0}), prepending its own verified prefix so the existing genesis-rooted Reconcile (with its slice-3 trustFloorOverride pinned to the node's own anchor) accepts its own pruned history but never trusts a peer-served head — the C1/long-range guard the PE ruled (peer-served-head trust rejected as a Sybil break). A node behind by less than the weak-subjectivity window catches up around the pruned gap; a deep-cold node beyond it gets ErrNeedCheckpoint (obtain a recent -ws-checkpoint out-of-band or use an archive node) — surfaced, never silent (I4/S5). pruneBelowHorizon is wired into the commit path, so a validator sheds heavy proofs below its floor as finality advances — the line that returns the MATURING box to 2 GB. Consensus-invariants: I4 (catch-up-or-signal, both asserted), I3 (trusted set from the node's own finalized snapshot), I1/I5 preserved (no quorum re-sizing; equivocation still caught in the suffix, at/above the finalized head where forks can exist). Ablation-verified load-bearing; full core suite green. Plans + rulings: slice3, slice4, slice5.

Daemon memory controls: -mem-limit (soft heap ceiling) + -debug-addr (pprof) — The MATURING field cohort OOM-crash-loops on 2 GB nodes, and it is NOT the PoR proof map (#464 shipped without moving it; the crash-looping nodes hold ~no chunks). Local + in-process probes show no leak — the signature is a large-but-bounded working set colliding with Go's default 2×-heap GC target on a small box. -mem-limit <size> (e.g. 1500M) sets runtime/debug.SetMemoryLimit so the GC reclaims before the kernel OOM-kills (equivalent to GOMEMLIMIT; the flag wins) — a memory-bounded head, not a hard cap. -debug-addr <addr> serves Go pprof (heap/goroutine) + dumps a heap profile to <store>/heap-<pid>.pprof on SIGUSR1, so the true consensus-node footprint can finally be ATTRIBUTED (the daemon had no heap profiling, which is why the wrong structure was first blamed). Both off by default. integration/cloudtest gains DEBUG_PROFILE=1/MEM_LIMIT= knobs and a ./cloudtest.sh heap <node> capture. Deliberation: docs/thinking/2026-08-17-oom-not-the-proof-map-attribution.md.

#184 adversarial drills made DRIVABLE on the wire under the objective BFT model — equivocation (slash-on-detection) and partition-heal (stall-then-catch-up) — Both marquee attacks GAPped on every field sheet because the drills imported legacy-mode (-objective=false, quorum 1) assumptions that objective 3-of-4 correctly forbids. Fixed per three PE rulings, mechanism proven at the code level first (core/node/modelcheck_184_equivocation_objective_test.go, failing-first). Equivocation: a fork can never be COMMITTED onto a target under a BFT quorum (2-attestation single-target commit is quorum-short; a minority fork is an I1 violation), so the crime is signing two conflicting blocks at one height, not committing two forks. New PlaceConflictingSigned adversary primitive: a consensus-set validator participates honestly (its era-2 (round, prepare) signature lands on-chain), then SERVES a conflicting signed block at that slot (crafted GetChain/head-probe response); an honest peer fetches it on sync and FindEquivocations slashes the same-slot cross-fork prepare pair unaided, pre-Reconcile, never adopting the quorum-short loser. It runs on its OWN dedicated ephemeral net (e2e/equivocation_test.go, objective 4-anchor, over real TCP; netem via integration/adversarial) — the one destructive drill (a proven double-sign is a permanent F2 eviction) is isolated from the shared sheet, whose mid-sheet eviction would pin the commit requirement at 3-of-4 against 3 live anchors (zero fault tolerance). Partition-heal: a severed sub-quorum minority cannot commit, so on heal it CATCHES UP (a forward sync, dropped=0), it does not reorg — a droppable reorg would require a minority to commit a conflicting fork (the I1 violation model B forbids; the absence of a reorg line IS the safety property). The drill (integration/cloudtest + e2e/partition_test.go) severs the minority from the whole > ⅔ majority, drives the majority to commit a heavier chain, asserts the minority STALLED (anti-vacuity), then reconverges to the majority head (height + hash) on heal. Deliberation + the three rulings: docs/thinking/2026-08-17-drill-drivability.md.

Publish client: the accept→commit poll re-derived for the #451 round durations (180s→360s) and made self-healing — the poll loop now RE-SUBMITS the entry every 30s — Run 82bcd2b-39478's durability-turnover GAP ("accepted but not committed within 3m0s") was honestly unpinned between discovery (#351) and a #441 mature-quorum residual. The pin, per the PE work order, came from two new deterministic model-check oracles over the 12-member mature fixture (core/node/modelcheck_441_publish_bound_test.go): (A) under steady renewal contention with delivery intact, an accepted entry rides the VERY NEXT committed block — three consecutive publishes — refuting the fold-starvation residual at the model tier; (B) with the fire-and-forget submit burst dropped, the entry strands in the accepting validator's mempool for a MEASURED designee-rotation wait (8 chain heights in the oracle schedule ≈ tens of minutes at the field's 220s/height escape bound) — unreachable by any single-shot poll. So the failure class is CLIENT-side liveness, not a consensus defect: publishPollTimeout was still the genesis-era 180s, BELOW the in-spec per-height worst case the #451 synchronizer durations imply (H_ESCAPE 220s; the harness's own re-derived PUBLISH_RETRY_S is 360s — same derivation, now one number), and the certified #441 design's drop-recovery lever ("the client's retry loop re-sends") never fired inside the window because the client submitted once and only polled. The re-submit is a mempool-dedup no-op on the happy path and the recovery lever on the lossy one (failing-first regression: a stranded entry that only a re-submission lands). Harness: a failed ft_publish now captures the VALIDATOR journals with the GAP verdict (82bcd2b's capture had only client-side nodes — the accept→commit window was unattributable, #7's capture-first rule), and the verdict text decomposes by the captured error instead of the #351-or-#441 disjunction. M1 note: the 360s bound shrinks by shrinking round durations (batching, #299), never by the client under-reporting them.

#456 concurrent gather: prepares and precommits are broadcast-and-collected — a dead epoch member no longer taxes every proposal its full retry timeout — The two-phase gather asked attesters strictly sequentially, so each unreachable member's full transport retry budget (~34s at field config) sat on the critical path before the next attester was even asked: with a third of the epoch silent, every proposal paid ~270s (the B2 drill's twice-field-reproduced stall — runs ce15a80/1eded27 — after the #453 synchronizer was confirmed working via the catch-up telemetry). Per the research certification (456-gather-serialization): BFT tolerates f faults BY CONSTRUCTION — a correct protocol never waits for the faulty — and broadcast-and-collect-until-quorum is the universal shape; the sequential chain inverted it into f×timeout on every proposal. Both phases now send to every attester at once and complete on the SAME quorum predicate ValidateCommit demands (SupportMeetsQuorum: count + anchor majority + frozen weight); assembled certificates are copied at capture so a late reply can never mutate them. No certified property is order-sensitive (one gatherer per proposal; the QC is carried in the block, never re-derived) — #432/#402/#397/#389 untouched, the full oracle set green. Per-peer patient retry (network-durability §2) is kept; only its SERIALIZATION across peers — the flat-aggregate anti-pattern one level up — is removed: patient AND concurrent. Failing-first via the model-check's first COARSELY-TIMED oracle (the sim clock as the cost model, the certification's method fix): dead-first ask order, RED sequential (4.02s simulated = 4 dead × timeout × 2 phases), GREEN concurrent (0 simulated).

syncTargets returns a deterministic (ID-sorted) list — a B2-determinism leak caught by the #451 fixture flaking under -count=10 — The list that drives gather ask-order, round-change broadcast order, and (in the model-check) the entire schedule was returned in raw map-iteration order: every gather's QC composition was a per-call dice-roll, flaking the #451 freeze-frame fixture 2-in-10 (the sybil author's prepare-QC landed on order-lucky subsets) and adding silent run-to-run variance to every field gather. ID-sort is safe here — ask order is not an inclusion-fairness surface (any assembled quorum is valid), unlike the reg/entry queues which stay FIFO per #448/#441; EligibleProposers already sorts for the same reason. The #451 oracles now pass 10× under the race detector.

#451 view synchronizer: increasing round duration + responsive catch-up — round-based liveness gets its missing second half — The clean re-run's B2 stall drill re-proposed a carried lock across rounds 4–15 for 370 s with 8 of 12 members live holding >99% of the weight: silt had #432's locking (safety under round disagreement) but no SYNCHRONIZER (convergence into a shared round) — a fixed roundAdvanceSweeps let independently-skewed sweep timers smear the members across rounds forever, and a round-change recorded at a receiver never pulled it forward. Per the research certification (451-view-synchronization, adopting Tendermint/PBFT whole): (a) round duration now grows dur(r)=dur(r−1)+r·k in deterministic sweep counts — after GST the round eventually outlasts any timer skew or adversarial round-change smearing (red-team seam #7, closed as a bounded residual), the load-bearing guarantee; (b) a straggler JUMPS to the smallest round proven ahead by f+1 anchors (launch) / >⅓ frozen weight (mature) of recorded round-changes, or by a valid higher-round new-view certificate — catch-up at message speed. Neither ingredient changes which value a node may sign: locking, the proposer-prepare rule, and the #402 arithmetic are untouched (the I1/S1/S2 oracle set stays green). Failing-first per the certification's merge gate: the staggered-sweep oracle (pre-GST chaos — skewed sweeps, per-target prepare delivery, driver-fired request timeouts scattering the sign marks; post-GST — the certified convergence bound) is RED against locking-without-a-synchronizer and GREEN with both ingredients. Method fix recorded in the model-check canon: per-node round-advance skew is a first-class adversarial schedule dimension.

Bond-reg queue goes FIFO-by-arrival — the ID-sort starvation behind the confirm run's 22-minute maturity stall — Run 54003f7-91159's latch missed its computed bound because the 3rd maturer's first-time registration sat in the designees' queues for 22 minutes: the reg fold sorted pending regs by validator ID, and with the byte budget admitting ~one plot-sized reg per block, ID order is a strict priority — the highest-ID submitter loses to ANY lower-ID renewal, every block, for as long as renewal traffic flows (the census: 49 ahead-skew refusals were the visible symptom; the queue acceptance was fine, the fold order was the starvation). This is the exact class the #441 certification closed for entries with FIFO (Addition 2: no fees ⇒ no priority order that can defer indefinitely), still live on the reg side — #429 had named it ("ID-sorted packing makes order seed-luck"). The queue is now FIFO by arrival with replace-in-place renewal updates (a resubmission refreshes bytes but keeps its position: renewing cannot queue-jump, waiting cannot lose seniority), and an over-budget reg keeps its seniority for the next block instead of being dropped. Proposer-side inclusion policy only — no validity or quorum rule changes (block-byte determinism needs only the single designee's own order). Failing-first: TestBondRegFIFONoIDSortStarvation (RED under the ID-sort — the high-ID first-timer never banks across four one-reg blocks — GREEN under FIFO).

#441 publish starvation FIXED: entries are mempool content the designee's block carries — the certified operation-liveness mechanism — The first mature-regime field run committed ZERO publish entries post-latch across 33+ heights while the chain stayed live on drain blocks, and the first launch soak stalled a publish-contended height 361s past the computed escape bound: one root, the #432 round machinery's new-view seat AND its escape arming belonged exclusively to the bond-reg drain path, so an entry proposal could win no round of any height. Per the research certification (441-publish-starvation, 2026-08-16, direction A): a publish now SUBMITS its entry (MsgSubmitEntry, the MsgSubmitBondReg mirror — validate-on-arrival with synchronous refusal reasons, FIFO mempool dedup'd by root) and polls for finality; the single (h, r) designee's block folds pending entries under a byte budget SEPARATE from the reg budget (-max-entry-bytes-per-block — neither stream can starve the other), and pending entries arm the round escape alongside regs. Entries are content, never a competing value: locks/POL, the proposer-prepare rule, and the #402 arithmetic are untouched, and a forced (lock-carrying) re-proposal never folds. The born-RED starvation oracle plus five certification siblings (launch-face entry-only arming, adversarial-designee drop within the O(f+1) fairness bound — an owned residual, no permanent minority censorship — FIFO no-internal-starvation, entry-flood-vs-renewal budget isolation, and S1-with-entries lock-never-displaced) are all RED under the recorded fold+arming revert and GREEN with the fix. Bonus, pinned by the certification §7 discriminator: drain-alone commits at r0, so the field's every-height r1 escape (~95–155s/height) was entry contention — the fix recovers the r0 happy path. Legacy (-objective=false) deployments keep the direct propose path (no rounds machinery exists there to drive a mempool, and no drain contention either). I4's full statement is now operation-liveness — no legitimately submitted operation is permanently starved — recorded in the invariant map.

BlockVersion (the mint era) flips to 2 — the era-2 follow-through promised by the #432 change — The rounds era shipped with the propose path explicitly stamping BlockVersionRounds, deferring the const flip as behavior-neutral test churn. Landed: production minting is byte-identical (the propose path already stamped v2; no non-test site builds genesis from the const), the att/bond-reg wire wrappers now carry version 2 (accepted by every era-2-capable binary — a pre-#432 binary cannot participate in an era-2 network regardless), and the 63 test files that hand-build era-1 blocks now declare Version: 1 explicitly — the honest form, since they exercise the still-supported era-1 validation rules rather than tracking the mint const. Full suite + race green.

Node-level mature-epoch model-check fixture + the dynamic mature S1/S2 oracles — Closes the #432 certification's named residual (1): the S1/S2 merge-gate oracles ran the round machinery over the real node loop only in the launch regime. matureWorld (core/node) now drives a real 8-node network — 4 launch anchors + 4 bonded 64 MiB distinct-domain maturers, the field re-split shape — to a governed mature epoch entirely over held delivery (drain banks the maturers, they qualify by attesting, the everMature latch trips, the epoch boundary freezes the maturer snapshot), verifies the premise first (latch on every replica, anchors shed from eligibility, an anchors-only proposal REFUSED in the governed epoch, a 3-of-4 weight-quorum commit tracked everywhere), and then runs the certification schedules dynamically: S1 (a delayed >⅔-weight round-0 quorum must be carried forward by the lock rule) and S2 (a Byzantine maturer's weight-short forged lock must die at round-change verification) — both anti-vacuity-pinned (CommitRound == 1) and both RED under the recorded lock-free revert. This world is also the deterministic home for the open mature-regime r0-contention observation from run 09fbe60-84613.

Drain-curve observability: commit lines carry the bond-reg count, and a refused renewal submit is attributable to WAN head-skew instead of reading as forgery — The committed-block lines (daemon banner and the node's structured block committed) printed entries and attestations but NOT how many bond registrations the block banked, so a field journal could not answer the drain curve's decisive question — which blocks carried which regs (the interrupted confirm run 09fbe60-84613 was misread as "blocks committing empty" while regs were in fact landing). All three commit lines now print the reg count. And the census of that run's 54 bond-reg submit REFUSED lines — every one a bare "signature" error across ≥7 honest validators — is the AHEAD-skew face of the #427 K-head window: a renewal is signed over the submitter's head, a receiver accepts only nonces of its own last-K COMMITTED heads, so a reg arriving ahead of the receiver's commit fails every window nonce and heals on the next resubmit sweep. The refusal line now logs the receiver's next height, the submit side logs the height it signed over (bond renewal submitted), and TestBondRegAheadOfReceiverWindow_refusedThenHeals pins the mechanism — refused while the receiver trails, the same bytes validate once it commits the head — so the field signature-refusal census reads as commit-propagation skew, not attack.

#432 rounds + locking: the two-phase (prepare→precommit) gather with a lock-carrying view-change — the I4 liveness escape, research-certified, era-gated as block version 2 — The #397 height-only never-sign-twice watermark made a crossed 2-2 proposer race a PERMANENT stall of a connected, all-honest launch network (the field wedge in runs 9c3777d/8ae8326; TestModelCheck_I4_WedgedHeightMustRecover, born RED). Per the research certification (432-rounds-locking-liveness, 2026-08-15): consensus signatures are now (height, ROUND, phase)-scoped; a commit carries TWO quorum certificates at one round (the prepare-QC that justified precommitting, and the precommit certificate), each held to the full commit threshold in both regimes (launch strict anchor majority / mature >⅔ frozen weight — the POL threshold IS the commit threshold); validators LOCK on the highest-round prepare-QC (durable, mark-before-sign, restart-rehydrated); round advance is a deterministic sweep count (never wall-clock), and the view-change quorum carries the highest lock forward, forcing the next proposer to re-propose any potentially-committed value. Equivocation is round-scoped (same-(h, r, phase) double-sign slashes; a POL-justified cross-round re-sign is honest), and a committed era-2 block REQUIRES its author's round-scoped prepare — the structural ProposerSig's era-2 analogue, which is what keeps a double-proposal attributable (I5) while staying count-neutral in every quorum (#402 arithmetic untouched, tested byte-identical). Merge-gate oracles per the certification: S1 (delayed lower-round quorum) and S2 (equivocate-then-misreport, forged-lock injection) both RED against a recorded lock-free revert and GREEN with the prepare phase, plus per-(h, r, phase) restart I2 and §5.3 lock re-presentation. Era 1 blocks keep validating under era-1 rules — committed history is never re-interpreted.

Never refuse silently: the two consensus refusal sites that hid the #432 wedge now log their reason — A peer-submitted bond registration that fails validation was dropped on arrival with no line (MsgSubmitBondReg receipt), and a drain proposal blocked at the proposer's own #397 sign watermark returned silently — so the #432 wedged-height liveness defect (chain stalled, cohort regs arriving-verifying-vanishing) was mis-attributed across three field runs (discovery/#351, CPU, staleness). The receipt path now logs bond-reg submit REFUSED with the exact ValidateBondRegErr reason (decode failures too), and the drain logs bond-reg drain BLOCKED at own sign watermark — at most once per 30s sweep, only while pending work is actually blocked, which is precisely the #432 wedge signature. One field observation now names this class (B5; build-immutable #7's instrument-first). The wedge itself is #432 (rounds+locking, research certification in progress) — this ships the observability ahead of the rule change because it is not one.

MATURING topology re-split: 4 honest maturers + 4 Sybils, with COMPUTED harness windows (per the PE concurrence on the latch-premise finding) — The MATURING=1 SYBILS=8 field topology re-splits its 8 cohort slots into 4 honest maturers (non-anchor validators, full 64M bond, UNSET -domain — each an independent address-diversity group) + 4 single-domain MinBond Sybils, making the drill the on-the-wire confirmation of the I3 oracle's certified shape: the bar-2 latch is now REACHABLE (min(NakamotoOperators, NakamotoDomains) = 2 at full drain) while the cheap cohort alone still cannot mature the network — both pinned deterministically by TestMaturingResplitTopologyLatchReachable. MATURING=0 topologies (the P1 launch gate) are byte-identical. The harness windows are now computed bounds, not arbitrary wall-clocks (PE cadence ruling §4): the latch window derives from worst-case drain order (ID-sorted packing ⇒ 9 reg-blocks × 64s worst-case block time + a submission leg ≈ 630s), the publish window from the per-leg retry budget (8s × 4 attempts + backoff ≈ 34s/leg × the fresh-publisher leg census ≈ 240s) — and a latch miss inside the computed bound with the maturer cohort live now records FAIL (a finding), never a re-graded GAP (maturers down ⇒ honest GAP, preemption-shaped). The flow also records the drain curve (val-a's per-commit C2 lines: 64MiB jumps = maturer bonds) so the bound is checked against the real drain order, and the B2 capture drill now stops the maturers with the anchors (leaving honest weight up would fake a capture). Also fixes a second latent premise bug the finding exposed: the cohort-seated gate required participants ≥ 4+n_syb (=12) but the C2 participant count is NON-anchor bonds only (max 8 here) — now n_mat + n_syb.

MATURING-drill premise repro: the 10-maturing-handoff latch is unreachable in the field topology as parameterized — TestMaturingFieldTopologyLatchUnreachable (core/chain) constructs the exact MATURING=1 SYBILS=8 parameterization at FULL drain — every bond banked, every participant generously granted attester status — and measures min(NakamotoOperators=3, NakamotoDomains=1) = 1 < 2, so Mature is false no matter how many regs commit: C2Metric excludes anchors by design (counting the scaffolding's own bonds to shed the scaffolding would be circular, immutable #3) and the topology's 4 validators are all anchors, while the only non-anchor cohort — the 8 single--domain Sybils — aggregates to ONE address-diversity group, which is the certified C2 discount doing its job. The two field GAPs ("latch never tripped in 420s") therefore had two stacked causes: the bond-reg drain staleness race (fixed) and this premise defect — the drill asked the maturity metric to be tripped by exactly the cohort it exists to refuse. Core behavior is correct and now pinned; the fix is a harness topology re-split (honest non-anchor distinct-domain maturers, the I3 oracle's certified shape), routed through a PE concurrence note before the re-run. Found on a laptop while deriving the principled maturity bound — before the billable run, not after.

-loop-budget — emit the event-loop goroutine-budget decomposition at INFO for a diagnostic run — The per-window per-handler breakdown (from the eventloop instrumentation) is debug-gated by default so it's silent at steady state; -loop-budget raises just that summary to INFO so a load/diagnostic run captures the full per-handler CPU breakdown without the -log debug firehose — which, logged synchronously on the loop goroutine, would itself skew the very measurement. Slow-task, queue-wait, and hang lines are always-on regardless. The cloudtest harness threads it via LOOP_BUDGET=1.

Event-loop latency instrumentation — name the slow (or hung) handler from real load (Andrew's timing-for-evidence idea) — The single event-loop goroutine (adapters/eventloop) is the one serialization point, so it is the one place to see where the node's thread actually goes. Each task now carries a label (inbound deliveries by msg.Kind; timers/commit/api by a constant) and the loop optionally reports: slow tasks (SlowThreshold/OnSlow — a single task blocking the thread), a hang watchdog (HangThreshold/OnHang — a task still in-flight past a deadline, reported once with an all-goroutine stack dump of exactly where it is stuck), queue-wait (QueueWaitThreshold/ OnQueueWait — the causal signal: a task that executes fast can still blow a downstream deadline by waiting behind a saturated thread, so this ties saturation to the 8s request-timeout that execution-time alone would miss), and a per-window budget summary (SummaryEvery/OnSummary — count/total/max execution AND queue-wait per label = the goroutine-budget decomposition, cause and effect in one window, so the dominant handler is named from real execution, not a reconstruction; the summary is debug-gated, slow/hang/queue-wait are always-on). Adapter-only, zero-value = off (the sim's own scheduler is untouched); wired in the daemon via the existing logger. This is the observability the starved MATURING field run lacked (its per-issuer gather legs were debug-gated).

#406 — consensus model-check, tier 2: the I5/#397 honest-never-slashed oracle — Over the real node loop + held-delivery: two proposers cross-attest-race one height in a WEAK config where both forks can commit (objective, no anchors, ByzantineQuorum off, Quorum 1, N=4 → no finality gate, no anchor gate — the pre-#402 baseline), and no honest validator is slashed: the #397 propose-time never-sign-twice watermark makes each proposer refuse the rival, so no honest node double-signs. Proven failing-first by controlled revert (removing the propose-time recordSign lets each proposer cross-attest → both forks commit → sync slashes both honest proposers via OnSlash — RED; with the watermark — GREEN). Resolves the deferral from the substrate PR: #402's I1 shields the both-commit fork in the normal objective tree, so the weak config is what makes it reachable. core/node/modelcheck_tier2_test.go. Test-only. With this + the #357 launch replay, the launch tier now has all four scars (#357/B2/#397/#402) failing-first — the P1-run gate criterion.

#406 — consensus model-check, tier 1: the #357 launch replay (no reorg of a finalized block + fork-choice determinism) — core/chain/modelcheck_i5_357_test.go asserts the invariant that closes #357: over adversarial competing forks (bare-genesis, shorter, equal-height, and even taller conflicting), a super-quorum-finalized launch block is never reorged (D-1), and fork-choice is order-independent (reconciling the same fork set in any order yields the same head — a pure function, never the height-blind hash tiebreak that dropped committed blocks to height 0). Proven failing-first by a controlled revert: forcing finalityQuorumActive false (the pre-#357 no-gate state) lets a taller fork reorg the finalized chain — RED; with the shipped gate — GREEN. Also asserts the #357 weight face (a committed anchor-attested chain carries nonzero fork-choice weight). Test-only.

#406 — consensus model-check, tier 2: the I2-across-restart oracle — On the held-delivery substrate: a validator signs a block at height h through a REAL gather, then "crashes and restarts" (a fresh Node+chain on the same endpoint), and must refuse a competitor at h — the never-sign-twice watermark must survive restart (#397 Q1b; Tendermint priv_validator_state). Failing-first by construction: the identical scenario run with a NON-persisted mark (the pre-#397 crash-wipe) attests the competitor, so the in-test control proves the persistence is load-bearing and the assertion is not vacuous. core/node/modelcheck_tier2_test.go. Test-only.

#406 — consensus model-check, tier 2: the simnet held-delivery substrate (adversarial delivery over the REAL node loop) — adapters/simnet gains a test-only held-delivery mode (EnableHeldDelivery + Pending/Deliver/DropPending): Send parks each message so a driver fires them in an order IT chooses — the "adversarial delivery scheduler" the design specifies — off by default so every existing sim/e2e path is untouched, conformance-tested (adapters/simnet/helddelivery_test.go). core/node/modelcheck_tier2_test.go proves the substrate drives the real loop: a real proposer gathers a real quorum and commits + broadcasts to every replica entirely over driver-controlled delivery (no clock advance; request timeouts sit on the clock, which the driver never advances, so a gather completes purely by delivered replies). The adversarial invariant oracles that build on it (I2-across-restart; the genuine I5/#397 catch) are the documented next increment — the first I5 draft was withheld because it could not be shown failing-first: #402's I1 structurally prevents the both-commit fork the #397 slash needs, so the #397 fix is shielded by a different fix in the current codebase, and a genuine I5 catch needs a pre-#402 baseline (docs/thinking/2026-08-15-406-tier2-substrate-and-the-i5-honesty-catch.md). The only production code is the adapters/simnet held-delivery mode, which is inert unless EnableHeldDelivery is called (no existing path calls it), so all shipping behavior is unchanged.

#406 — consensus model-check, tier 1: the I3 mature weight-quorum oracle (the B2 catch) — core/chain/modelcheck_i3_test.go drives the REAL Chain to a mature epoch whose frozen epochSet holds the B2 imbalance — 3 real validators (distinct domains, 20 MiB) + 8 sybils (one shared domain, 2 MiB) — and asserts I3: a coalition finalizes IFF it carries a >⅔ WEIGHT super-majority, never a head-count one. The 8-sybil cohort is a head-count quorum (7 non-proposer attesters = bftThreshold(11)) but a weight minority (16 ≪ ⅔·76), so it is refused. Exhaustive over the finality-relevant space by equivalence class (finality is a pure function of proposer-type + #honest/#sybil attesters, so ~72 representatives cover all 2^10·11 cases). The setup is verified first (TestModelCheck_I3_SetupReachesMatureWeightedEpoch asserts the mature-epoch state + exact frozen weights before any oracle trusts it — the anti-#303 discipline; it caught a real proposer-never-seen setup bug during the build). Proven failing-first by a controlled revert of requireEpochWeightQuorum to head-counting → RED. Test-only; no production change.

#406 — consensus model-check, tier 1: the exhaustive I1 launch oracle — The first rung of the deterministic adversarial consensus harness (docs/design/consensus-model-check.md): core/chain/modelcheck_test.go drives the REAL Chain finality predicate over an exhaustive enumeration of adversarial anchor coalitions (N∈{3,4,5} launch regime, +8 sybils) and asserts I1 — no two disjoint anchor coalitions may both finalize a block at one height (the invariant all four scars #357/B2/#397/#402 violated at their core). Proven failing-first: reverting the launch rule to the pre-#402 AnchorQuorum=1 makes it go RED ("disjoint coalitions [0] and [1] both finalize" — the exact #402 defect) in milliseconds on a laptop, GREEN under the derived ⌊A/2⌋+1. This is the cheapest-tier catch the testing-tiers assessment calls for; it begins the gate that ends "discover a consensus invariant by billable field run" (D-CONSENSUS). WIP — the mature/I3/I5 oracles and the simnet tier-2 (I2-restart) layer are the documented next steps; scope is stated honestly in the file header (S5). Test-only; no production change.

#402 — chain-tier repro attributing the launch anchor-gate fork (the field "CAPTURE" was a fork, not a Sybil capture) — Field run 4faaee8-22913 graded a flow-5 "CAPTURE"; the captured evidence + core/chain/fork_anchor_gate_402_test.go show it was a fork. The wheels-engaged commit gate requires only AnchorQuorum=1 distinct anchor attester, and the honest side commits at the bare count quorum (proposer + 2), leaving one free anchor; a Sybil-proposed competitor attested by that one free anchor passes the gate — while a zero-anchor Sybil quorum is still refused (ErrAnchorRequired), so C2 holds (no quiet capture). The residual is a launch-phase fork-creation / liveness vector. A second test shows AnchorQuorum=2 closes the same fork (the honest commit then holds 2 non-proposer anchors, leaving <2 free), naming the fix direction AnchorQuorum ≥ ⌈#anchors/2⌉ and its cost (launch commits need 3-of-4 anchors up). The fix is a consensus-rule change, routed to research (docs/reviews/fork-anchor-gate-402-RESEARCH-CONSULT-2026-08-14.md); tests-only here, no product change.

cloudtest: a scenario-level FAIL/GAP now captures its evidence before teardown (build-immutable #7) — Run beb3628-95860 (the P1 all-corners run) ended with two FAILs (9-cross-nat, chaos-reprovide) and a new sybil-resume GAP that were unattributable: journals were only captured for nodes that never came ready, the scenario console died with the terminal, ft_publish's per-call gap signal was lost in its command-substitution subshell (so 9-cross-nat graded FAIL where the honest verdict may have been a #351 GAP, with no recorded error), and the next run overwrites results.jsonl/report.md. Now: record snapshots the flow's involved nodes' service state + journal + debug.log into flow-evidence-<run>.log the moment a non-green verdict lands (nodes stashed by require_nodes/require_live or explicit flow_evidence_nodes); ft_publish hands its gap signal and last captured error across the subshell boundary by file, so publish_verdict grades honestly and the report names the mechanism; 9-cross-nat attributes WHICH leg died (publish vs fetch); the scenario console is tee'd to console-<run>.log; and each run's results.jsonl + report.md are archived under archive/ so a regression is distinguishable from a never-passed flow. Harness-only; no product change.

#390 — the cross-NAT restart re-fetch (integration/nat, #69 phase) no longer flakes on a loaded CI runner — The RESTART=1 cross-NAT job REDed bimodally (~1-in-4, on docs-only commits too) at "content undiscoverable after restart". Attributed: reprovide-after-restart is a real, working product path (proofs persist to the proof store, reload on restart — reloaded storage proofs count=N — and AnnounceHeld re-plants provider records after re-bootstrap), but the harness waited for it with a fixed sleep 6 and then re-fetched ONCE. That is the magic-constant anti-pattern (build-immutable #5: wait for the condition, never a constant): under a loaded runner the re-announce + DHT propagation sometimes took longer than 6s, so the single re-fetch found no provider and false-FAILed. Fixed harness-side by confirming the reload then RETRYING the re-fetch on a ~60s bounded deadline — a genuine reprovide gap still fails after it (never masks a real #69 break; it only rides out a slow re-announce), the same "retry, don't guess a timeout" discipline the product uses. No product change. Green 5/5 locally (was ~1-in-4).

#378 — the -equivocate red-team drill is now deterministically drivable under WAN delay (the local adversarial gate's entry criterion for the external red team) — The netem adversarial gate (integration/adversarial, delay 80ms 20ms) REDed BIMODALLY on TestEquivocatorSlashedOverTCP — the drill that proves a double-sign is caught and slashed over real TCP (#184 accountability). The property itself always held (the slash fired); the drill driver wedged, so a required gate flapped ~1-in-4 — corrosive (it trains "re-run until green"). Root-caused to THREE distinct placement wedges under warm-up jitter, each closed and each guarded failing-first: (1) ErrDupRoot re-placement — the old driver rebuilt the conflicting blocks at the LIVE head every retry, so once a leg committed and the culprit synced it back (head advanced), later attempts re-proposed the same deterministic root at a new height and were refused forever; fixed by PINNING the fork base + blocks on the first attempt and LATCHING each placed leg (the #345 live-tip win is preserved — the base is the tip AT PIN TIME). (2) Attested-but-not- committed — a target attests on the proposer's standing but commits on its OWN attestation's qualification, which warms up later, so a leg could attest yet ack the commit not-OK; latching on the round-trip alone then stranded the next block chasing an uncommitted parent. Fixed by latching a leg only on a CONFIRMED commit (proposeAndCommitTo now reports committed) and retrying an attested-but-uncommitted one. (3) Detection disqualifies the proposer mid-drill (found via wire diagnostics) — the moment an honest node holds BOTH forks it slashes the culprit, removing it from that node's qualified-proposer set, so any REMAINING placement there is refused "not yet standing" forever (the property firing wedged the drill). Fixed by placing the COMPLETE heavier fork [Y,Z] FIRST and the conflicting X LAST, so no honest node can see both forks until every leg is down; the slash then propagates asynchronously (the detector reconciles the heavier fork), which is the property under test. Harness-only (core/node/adversary.go); no honest consensus path changes. Regressions: two failing-first unit repros (equivocation_resumable_test.go for the pin, equivocation_uncommitted_test.go for the commit-confirmed latch — both red-verified against the old code) plus the netem gate itself, now 10/10 consecutive PASS under the exact bimodal-RED condition (was ~1-in-4 FAIL). This clears the external red team's entry criterion.

MATURING cloud topology + field flow 10: the handoff/post-shed regime is now field-exercisable (§4 of the PE ruling; gates the external red team) — The base cloud topology never matures BY DESIGN (4 equal validator bonds → Nakamoto coefficient 2 < -mature-validators 4), so every prior field run exercised only the YOUNG anchor-gated regime — while the red team's sharpest target (brief seam #8) is the handoff and what follows. MATURING=1 SYBILS=8 ./cloudtest.sh now runs the topology that hands off on the wire: the maturity bar is set to the coefficient the 4 distinct-operator validators actually reach (2, at an explicit -operator-margin 1 — deliberate and disclosed, uniform across every consensus role) and the Sybil cohort bonds the MINIMUM (1M vs the validators' 64M) so the B2 drills price per-head cheapness the way the research certification does. The new flow_maturing_handoff (flow 10) grades, outcome-first: (10) the everMature latch trips on the wire (wheels shed permanently), commits cross the epoch boundary into the governed mature snapshot, and no anchor-required refusal appears post-shed; (10a) the B2 stall drill — the cheap cohort declines to attest (stopped) and the honest >⅔-weight coalition must still commit (head-counted quorum left this exact network born-unable-to-commit); (10b) the B2 capture drill — the cohort alone must not advance past the honest ceiling (ceiling read from the honest validators before stopping them, the #383 catch-up lesson; a real capture also requires a fresh cohort commit log; the frozen-weight super-majority refusal corroborates), with the clincher that the chain resumes when honest weight returns; (10c) WS cold-sync under the latch — a validator restarts pinned to a peer-published checkpoint: H:HASH, catches up, and comes back with the wheels STILL shed (a restart must never re-arm the anchors, F-1). Preconditions grade as honest GAPs (latch never tripped, cohort never banked), never fake passes; flow 5 (anchor-gate no-capture) self-skips under MATURING=1 since its premise — a network that never sheds — is deliberately absent. Runs LAST (it stops validators). Both topology modes dry-run-validated; the base topology is unchanged byte-for-byte with MATURING unset.

Parallel publish-token gather — transport concurrent, signer selection unchanged (research-stamped) — The flagship privacy flow (a fresh ephemeral client acquiring a -token-quorum k blind-signed publish token) was failing over real WAN under load: every leg was sequential — issuer-key fetches, per-issuer credit mints, canonical-set discovery, and the k blind-sign round-trips — ~2·V+k WAN round-trips end to end (ft_publish FAILED after 120s in both SYBILS=8 runs). All four legs now overlap, collapsing the gather to ~3 round-trip times. The privacy boundary is unchanged and research-certified (token-gather-privacy-and-fault-tolerance- RESEARCH-CERTIFICATION-2026-08-13.md, Item A1): requests fire concurrently at the fixed network-canonical top-k signers and wait for that exact set — acceptance is a function of canonical rank + liveness, with per-issuer failures falling forward in canonical order, never first-k-of-N-to-reply (the forbidden variant that would stamp the publisher's network position into the token's revealed signer set, re-opening R-3); token Sigs are assembled in canonical order so the token cannot leak the arrival permutation structurally. Canonical-set discovery (FetchCanonicalIssuersFromAny) races all validators for a deterministic answer (privacy-neutral: who answers first changes nothing about what is answered). Issuance is now idempotent under transport retries (certification Item A2): a retry re-presents the SAME blinded serial (deterministic RSA-FDH ⇒ identical signature) and the issuer dedups both the signature and the charge/credit-spend keyed on the blinded-serial hash within the transport retry window — before this, a lost reply double-charged the legacy fee and was refused as a credit double-spend on the prepaid-credit path, failing the whole gather. Instrumented per-leg (token gather leg debug logs with per-issuer elapsed). Failing-first regressions at unit (issuer dedup: single charge, identical sig, credit-retry accepted, TTL-bounded) and sim tier (canonical set accepted under heavy reply-order jitter across seeds; canonical fall-forward past a dead signer; round-trips proven to overlap on the virtual clock; 25% loss ridden out at exactly k fees). The named prediction for the next field run: ft_publish and the ~6 cascading flows flip to PASS, and 6-fault-tolerance recovers (research Item B1's conditional close — if it does not, the latency attribution reopens).

Attribution repro for the SYBILS=8 6-fault-tolerance GAP: quorum sizing is correct; the GAP is gather-latency under load, not a consensus bug — core/chain/TestFaultToleranceBranch_SybilBondsDoNotInflateLaunchQuorum reproduces the exact committed state (4 anchors + 8 banked single-domain sybil bonds, pre-maturity, objective, epochs on) and names the branch behind the field GAP: validatorSetSize=4 (the launch anchor branch fires — NOT the qualifiedCount=12 fall-through), RequiredQuorum=2, and a 3-of-4 anchor commit with one validator down passes in-process. So banked sybil bonds do not inflate the launch quorum, and the cloud GAP is a gather-latency effect under the 8-sybil load — not a quorum-sizing bug, no consensus rule change. Test-only; routed to research for concurrence (archive/reviews/token-gather-privacy-and-fault-tolerance-RESEARCH-CONSULT-2026-08-13.md).

#357 Conditions A+B — the mature phase epoch-snapshots its validator set, and the young→mature handoff lands at a finalized boundary (research-certified) — Completes the #357 arc: the research certification conditioned its C1/C2 soundness ruling on two pieces of mature-phase machinery, both now built. Condition A — finality is quorum-INTERSECTION safety, which only holds when every super-quorum is taken over the SAME set; recomputing validatorSetSize/qualification live from the churning bond ledger (joins, renewals, TTL expiry) could let two conflicting commits each "finalize" against two different sets. Post-handoff consensus (quorum size N, attester/proposer qualification, attester fork-choice weight) now reads a per-epoch FROZEN snapshot of the committed bonded set (Config.EpochBlocks), rotated only at epoch-boundary blocks — each itself super-quorum-final under the §3 gate. Churn integrates at the next rotation (bounded by one epoch); the one live mid-epoch disqualification is a proven slash, which is shrink-only against a frozen N (can only raise the effective bar). Condition B — the anchor→bond weight-meaning transition is now the FIRST mature rotation: after the everMature latch trips mid-epoch, the anchors keep governing (eligibility, weight, anchor sign-off) for at most one more epoch until the finalized boundary sheds them, so bond-weighted fork-choice is rooted at an immutable base and can never reach back across the boundary. One-way both ways (F-1: neither the latch nor the handoff ever re-arms). Daemon: -epoch-blocks (consensus-critical, set identically across the swarm), safe-by-default for an untrusted objective validator (DerivedEpochBlocks 8 — ≤ ¼ of the derived bond TTL, so a mid-epoch-lapsed bond's vote outlives its TTL by at most an epoch); explicit 0 opts a trusted/demo swarm out (pre-epoch live recompute, unchanged). Failing-first regressions at the chain tier: mid-epoch join/TTL-expiry cannot move N, RequiredQuorum, or qualification; the handoff waits for the boundary (anchor sign-off still required between latch and boundary); a mid-epoch slash disqualifies immediately with N frozen; plus the certification's repro-ladder step-2 drain-window ordering test (a lagging replica converges by catch-up; a conflicting, heavier drain ordering is refused without dropping committed height; weight strictly monotone across the drain). Full go test ./... + -race (chain/node/sim) green.

Regression guard for the #288 evict-on-one-miss anti-pattern (P0-4) — core/node TestLivePeerIsRetriedNotEvictedOnOneMiss locks the build-immutable #5 rule that a live peer must be retried, not evicted, on a single slow/dropped packet: a dead peer given RequestRetries=2 must be dialed 3 times (initial + 2 retries) before eviction, so re-introducing evict-on-the-first-miss (the shape that starved consensus under loss) turns this test red. Counting dials over a run-to-completion is timing-independent, so it can't flake. The internal/wanguard scope note now records that retry/evict are guarded by routing + this behavior test (they are semantic policy, not an AST-lintable construct). No product behavior change.

Handshake attribution instrumentation (#286 Layer 2 Q3) — To attribute the cross-region inbound err=EOF before tuning any deadline (the research team's "instrument first" discipline), tcpnet now logs, on every failing handshake, the numbers that separate the candidate causes: the inbound side logs the concurrent in-flight handshake count (the hub-stampede gauge) and the elapsed time before failure; the dialer side logs the dial budget and the elapsed spent. On the next run, a clustered EOF with high concurrency and elapsed ≈ the dialer budget attributes it to the hub-stampede / dialer-deadline variant (which the -persistent-peers fix independently relieves by spreading load and letting the proposer dial out); an instant failure points instead at a pin-rejection / teardown. Logging-only; docs/network-durability.md §8.

-persistent-peers: a static, never-evicted consensus-peer tier (#286 Layer 2, dominant fix) — The blind field tester root-caused the cross-region genesis stall (with the #327 -log debug): it is a mesh address-convergence bug, not a timeout. A proposer had send with no known address for the other validators, so it could not initiate the attestation gather → no quorum → no genesis. Cause: at genesis there is no chain (no discoverable validator registry), all validators bootstrapped to ONE seed, and silt's routing table holds bare NodeIDs (addresses live in the transport layer, learned only from inbound frames/gossip) — so hub-and-spoke never converges addresses across a fresh WAN, and the proposer cannot dial out. Fix (research-directed, docs/network-durability.md §8; the settled BFT/PoS practice — Tendermint persistent_peers, Ethereum static peers, libp2p peerstore): configure the validator/anchor set as -persistent-peers ID@HOST:PORT,… in every validator. Those peers are AddPeer'd at boot (their address is known up front, no dependence on inbound learning) and marked a never-evicted tier — a transient WAN miss is a retry, never an eviction, so a proposer can't lose an attester mid-formation and stall quorum (Q4). The cloudtest/awstest topologies now pass the whole validator set as persistent-peers. Guarded by TestStaticPeerSurvivesReachabilityEviction286 (a static peer survives retry-exhaustion eviction; a normal discovered peer does not). WAN-certified on the next GCP run.

Gather-path debug logging for the #286 Layer-2 root-cause — The consensus propose→gather→attest path previously logged ONLY on a successful commit ("block committed"), so a quorum-2 genesis gather that starts and never completes over the WAN (the #286 Layer-2 blocker) was invisible — a silent ValidateProposal reject of the ~1.5 MB first block looked identical to "never received". Added -log debug lines on both sides (core/node/chainrole.go): the PROPOSER logs gather: starting (with block SIZE), each gather: requesting attestation, each collected/refused/ failed reply, and gather: NO QUORUM; the ATTESTER logs receive → REJECTED (ValidateProposal) with the reason / REFUSED (already attested) / ATTESTED. So the next multi-region GCP run with -log debug shows exactly where the round stalls. Debug-level only — no info-level noise, no behaviour change (all consensus tests unchanged).

silt daemon -goodpropose <peerID> — a POSITIVE CONTROL for the -forge-block/-lowbond-propose rejections — The integration/redteam forged-block and low-bond scenarios asserted only that H3 replied OK:false, but a validator replies OK:false for many unrelated reasons (chain role disabled, ErrWrongParent, already-attested), so a target that refuses every proposal would false-pass both — "reject the good one too" is indistinguishable from "reject the bad one" (audit #303). New test-harness flag -goodpropose <peerID> (sibling to -forge-block/-lowbond-propose), backed by core/node.ProposeGoodBlock, sends a well-formed, properly-bonded proposal and asserts the target ACCEPTS it — logging goodpropose proposal ACCEPTED by <id> on attest, goodpropose proposal UNEXPECTEDLY REJECTED by <id> otherwise (it retries until its bond earns standing). The redteam harness now gates SCENARIO 2 & 3 on this positive control, so a rejection is attributed to the real defence, not a dead/wedged target. (#303)

PoR audit seam on silt daemon — -liar + -audit make the verify-without-fetch catch+slash wire-driveable — The silt sim run audit headline (a verify-WITHOUT-fetch PoR challenge catches a storage node that kept its proof tags but dropped the bytes, and slashes its standing) existed only in-process: Node.SetLiar and Node.Audit were unit/sim-tested, but nothing in cmd/silt toggled the liar or invoked the sweep, so over the wire a liar was caught only indirectly (it answers MsgHasChunk=false once its bytes are gone). Two new flags (siblings to the consensus red-team flags -equivocate/-forge-block/-lowbond-propose): -liar (keep the tags, advertise as a provider, drop the bytes, prove over data it no longer holds) and -audit <interval> (a -care-ing caretaker runs Node.Audit on every cared root — challenge each shard's providers, grade the proofs against the care-link key with no ground-truth fetch, and slash the liar). integration/audit now gates the literal claim over the wire (honest holders pass, the liar is caught and slashed) and demonstrates why it is needed — the liar's MsgHasChunk lie fools the availability probe but not the audit. (#232)

swarm add token-replay seam (-save-token / -use-token) drives the double-spend rejection over the wire — The publish-token double-spend guard (core/chain ErrTokenSpent + the online issuer's spent-set) was real and unit-tested but had no CLI/wire seam: every swarm add -token-quorum N minted a fresh random serial, so two publishes never collided. swarm add now takes -save-token <file> (write the acquired token, CBOR) and -use-token <file> (publish carrying that saved token instead of minting a fresh one). Re-presenting the same token for a second file re-uses its already-committed serial, which the registry's pre-check refuses with the exact ErrTokenSpent reason and never commits. integration/economy now gates the double-spend over the wire (a fresh-token control still commits) and ties its unlinkability assertion to the tokened entry's own zero-NodeID Publisher. (#233)

Cloud variants of the field-test series in integration/cloudtest — Four new GCP scenarios carry the local suites' properties onto real VMs / real regions, mapped onto the existing 13-node topology with no topology change: flow_publisher_unlinkability (privacy #3 — a durable-Publisher publish is refused by the default chain over the real wire), flow_durability_turnover (durability #2 — content survives a permanent storage-node departure, fetched bit-perfect from a survivor), flow_chaos_crash (chaos #7 — a SIGKILLed storage node re-announces its chunks (#69) via Restart=on-failure and content stays fetchable), and flow_web_ui_guard (client/UI #4 — the #89 web-UI guard holds on a real VM: no-token→401, DNS-rebinding→403, read→200). Wired into run_all_scenarios; shell/topology dry-validated (no billable run). C2-Sybil (#5) has no cloud flow yet — it needs non-anchor Sybil validator VMs (a topology.py addition) so the Sybils' bonds bank over a longer cloud run and the pure ErrAnchorRequired gate + ≥8-bond atomization note become assertable; recorded as a skip until then.

New field test: chaos / crash-recovery (integration/chaos) — Tests whether the system survives hard crashes: a SIGKILL (abrupt process death, no graceful shutdown), then a restart of the same node — same identity, same IP, same on-disk store (docker start on an un-removed container, unlike durability's docker rm). WAVE 1 (default, the gate): SIGKILL every holder, restart, and assert each re-bootstraps AND logs re-announced N held chunks (#69) so content stays discoverable, then a fresh client cold-fetches it back bit-perfect — with no crash-loop. Validated locally (PASS: 6/6 holders re-announced, bit-perfect after a full holder crash). WAVE 2 (opt-in, WAVES=2): also SIGKILLs the sole seed/registry/bootstrap; this surfaces a discoverability gap — the content stays on disk but a fresh client can't rediscover the providers in the window, and a single holder re-announce doesn't restore it — recorded honestly as an observation to root-cause (entangled with the single-bootstrap SPOF a real deployment avoids; retest with a redundant-bootstrap topology + on the cloud test), not a verified product defect, which is why it is off by default. Wired into run-all.sh (gate tier).

New field test: C2 "no quiet capture" under a Sybil validator set (integration/sybil) — Tests the M0 systemic C2 claim cynically, as an OUTCOME: can a bonded Sybil validator set — many identities, real bonds, its own quorum — quietly capture a young objective network? Two honest anchors (a1 proposer, a2 co-signer, since one anchor can't co-sign its own block under -anchor-quorum 1) plus a Sybil set. C2-a: with the anchors present the chain commits a real block and the daemon prints wheels engaged (young network — anchor quorum still required) — the chain is live and the training wheels are on. C2-b: stop both anchors and the Sybil set (s1 proposes, s2 attests) cannot advance the chain — no new block; the test reports which training-wheels layer refused it (locally the standing gate — a young Sybil set can't even earn committed bonded standing without an anchor-proposed block; behind it the anchor co-sign gate, ErrAnchorRequired). A chain advancing for the Sybils would be a hard FAIL. C2-c (bonus): with ≥8 committed equal bonds the C2 metric's atomization note fires (an equal-bond split reads as a fingerprint, not real decentralization). Honest scope (immutable #5): on one host the Sybils' bonds don't reliably bank on-chain, so the standing gate usually fires first (itself a faithful no-capture outcome); the pure anchor-co-sign gate with pre-banked bonds and the ≥8-bond atomization signal are exercised at scale on the cloud test. Validated locally (PASS). Wired into run-all.sh (gate tier).

New field test: the client / web-UI path under an adversary (integration/client) — Tests the path a real user takes — run a daemon, open its web UI, drop a file in, get a link, someone fetches it back — over the daemon's HTTP API, not the silt swarm CLI; and the path a real attacker takes against that same local API. A ui node (storage + its own registry + -ui) plus N holders; the test drives the UI with curl from inside the operator's container (the realistic browser-on-the-same-box model, and the only way the guard's local-Host rule is met). U1–U3: POST /api/publish (multipart + the bearer token grabbed from the daemon's own ui: …?token= line) scatters the file, /api/roots reflects it, and GET /api/fetch?link=… returns the bytes bit-perfect — the real end-to-end round-trip over HTTP. U4–U8 attack the guard (#89): a no-token and a wrong-token POST are refused 401, a DNS-rebinding request (non-local Host) and a cross-origin drive-by (evil Origin) are refused 403, and a token-free localhost read still returns 200 (ergonomics preserved). Every assertion is a real HTTP status code / real SHA-256, never an echoed string; any failure is a hard FAIL (the user path and the local-security guard are both load-bearing). Validated locally (PASS, all eight). Wired into run-all.sh (gate tier).

New field test: publisher unlinkability under an adversary (integration/privacy) — Tests immutable #4 (refuse-to-surveil) cynically, as an OUTCOME: can an adversary get the network to record who published a given file? A silt registry entry may carry a durable Publisher NodeID — a permanent file→publisher link on the append-only chain (the #14/F1 privacy corner) — and the M0 default refuses it. Two real silt -validator daemons form a committing chain; the test asserts on real chain-status commit counts and the validator's rejection line, never an echoed string. P0 (positive control) shows a chain run with -allow-publisher=true commits a Publisher entry — so the refusal below is real policy, not a broken publish. P1 shows the default chain commits a normal unlinkable publish and fetches it back bit-perfect (privacy isn't a broken product). P2 (the crux) shows the same default chain refuses an -allow-publisher publish — the real error surfaces over the wire (chain: entry carries a durable Publisher (records permanent linkage; publish unlinkably…)) and no new block commits. P3 shows a -token-quorum publish commits with a blind validator credential and no Publisher — authorized yet unlinkable (the F1 fix). A privacy regression (the default chain committing a Publisher entry, or the private path failing) is a hard FAIL; the metadata-correlation layer is a stated M0 tradeoff, not covered. Validated locally (PASS, all four). Wired into run-all.sh (gate tier).

New field test: durability under permanent holder loss (integration/durability) — Tests the core promise cynically — does content outlive the nodes that held it? A seed + 16 holders + caretaker swarm publishes a file at replication=1 (every column single-copy, the honest stress), then permanently kills holders one at a time and never replaces them so the pool shrinks onto ever-fewer survivors. Crucially it kills without re-scaling: an earlier rm -f+--scale design let Docker recycle a dead holder's IP to a fresh empty identity, and the caretaker dialing old-NodeID@that-IP hit a TLS-pin impostor — a Docker artifact (real infra doesn't recycle IPs in seconds) that masqueraded as "content lost." Shrinking the swarm removes the artifact and isolates the real mechanic: reconstruct-from-parity (k=10 of n=16) + re-scatter onto survivors. It reads two separate oracles — the caretaker's repair below k log (authoritative, unrecoverable content loss) for durability, and a warm-peer swarm get (every survivor handed as a direct peer) for retrieval, so a discovery flake is never miscounted as loss. Finding: durability held — across 10 permanent departures (16→6 holders) no stripe ever fell below k and the caretaker performed 13 reconstructions, so the bytes provably survived — but a fresh client's end-to-end retrieval stayed bit-perfect only down to ~11 survivors, then degraded (the #43 retrieval surface under permanent loss: durable is not the same as retrievable). Exits 0 as a FINDING (EXPECT=pass to hard-fail; MIN_SURVIVORS=11 for the retrieval-healthy clean PASS). True membership rotation (fresh VMs = fresh IPs) is the cloud test's job. Wired into run-all.sh (slow tier).

New field test: retrieval / discoverability at scale (integration/retrieval) — Measures the most basic user promise — can I get my content back? — on a real multi-holder swarm as short-lived publisher/fetcher identities churn the DHT (#43/#60). It publishes files, optionally pollutes routing with throwaway ephemeral publishes, then measures the bit-perfect cold-fetch success rate from fresh ephemeral clients and gates it on a floor. Validated locally, it cleanly isolates the cause: raw scale (24 holders, no churn) fetches 100%, but adding 40 churning ephemeral identities drops cold discovery to 85% — a real, honest reproduction of the #43 ephemeral-identity routing degradation (POLLUTERS=0 vs POLLUTERS=40). A sub-floor rate is a FINDING (exits 0 like upgrade reproducing #237; EXPECT=pass flips it to a hard fail), never a faked green. Wired into run-all.sh (slow tier).

Blind-session ease: an "LLM instructions" README section + interactive GCP setup — The field-test scripts stay simple and emit clean per-test output; the dated silt_local_fieldtest_<date>.md / silt_cloud_fieldtest_<date>.md roll-ups + per-test detail reports are written by the operating agent, guided by a new "For an LLM/agent operator" section in integration/README.md (plus a Quick-start). ./integration/cloudtest/cloudtest.sh setup is now an interactive step — it asks for the GCP project, walks the user through gcloud auth (login + the application-default creds Terraform needs), enables the required APIs, and writes config.env — so spinning up the cloud test needs no hand-editing.

integration/run-all.sh + shared integration/lib.sh — the clone-and-run field-test experience — One driver runs the local Docker suites in sequence (each owns its topology, so they run one at a time), captures each suite's real RESULT: line + duration, and writes a shareable consolidated report.md plus a terminal summary; exit 0 iff every suite that ran is PASS or a deliberately-reproduced FINDING. Runs the fast gate set by default (FULL=1 adds the slow soak/upgrade suites; SUITES="…" picks a subset). lib.sh factors the shared shell — RESULT classification, timing, prereq checks — that each suite otherwise re-implements; the suites still stand alone. Suite → M0-claim mapping lives in the driver's catalog.

Registry economics — -freeload role separation for the daemon (#47) — A daemon can now be started with -freeload to serve the registry / relay / routing role while refusing to store or serve content — so a public-infrastructure operator can run a rendezvous registry without being conscripted into hosting arbitrary content (the conflation that caps how many public registries the network can attract, which bootstrap/NAT-traversal depend on). The mechanism (node.SetFreeload, honored by the serve paths) already existed and was sim-only; this exposes it on the real daemon and announces the role. The node still carries DHT routing. (The leaner -registry-only mode — no storage node constructed at all — is the follow-up.) Covered by a real-TCP e2e; whole suite green with -race.

H9 takedown transparency — the CT-style append-only log (#180) — New core/translog: an RFC 6962 (Certificate Transparency) append-only Merkle log — adopted, not invented (B8) — for honored revocations. It offers the two proofs that make a takedown auditable and non-silent: inclusion ("revocation R is entry i of the log at size N") so a specific takedown is provably recorded, and consistency ("the log at size M is a prefix of size N") so an operator can't quietly rewrite history — a dropped or back-dated revocation breaks the consistency proof. Exhaustively tested: prover-generated inclusion paths (every leaf × every size) and consistency proofs (every prefix pair) cross-check against the recomputed roots, and a tampered history fails. This is the M0-honest core of pluralistic takedown; the ZK non-globality predicate + PIR-routed probes on top are post-M0. Wired into the chain: every honored revocation/un-revocation is appended to the log in Chain.apply (a deterministic function of the committed blocks, rebuilt identically on replay), and the chain exposes RevocationLogRoot + inclusion/consistency proofs + the exported RevocationLeaf so an auditor can reconstruct a leaf from public block data — so silt can now prove a takedown was recorded and that its takedown history was never silently rewritten. Whole suite green with -race.

D-DEMAND — the delivery receipt goes live on the wire (#181) — The core/demand primitive is now a real node capability. A fetcher AcquireDemandToken blind-withdraws a retrieval token from an issuer over the existing token-request wire (no new issuance path — the blind signature is domain-agnostic), then SubmitDeliveryReceipt sends the server a MsgDeliveryReceipt (the token + a PoR-bound, signed ack over the received bytes). The server verifies it against the issuer key it trusts and banks it into a neutral witnessed-demand observable (Node.WitnessedDemand) — never wired to consensus standing, so a forged or self-dealt receipt buys zero standing (the γ→1/N firewall). Only receipts naming this server are banked; replays (double-spent serial) and forged/mis-issued tokens are rejected over the wire. Integration sim covers the honest flow + both rejections. Whole suite green with -race. (Fee-burn cost-to-wash is P3; fetcher-unlinkability needs D3.)