What's changed

chain-status counted a field that a format era retired, so its prune observable was structurally zero on every v5 chain (2026-09-13; one cmd/silt diagnostic command and its tests — no consensus rule, no format surface, no genesis move, no economic mechanism, no security parameter; no harness script is touched). The graded run 869ad9a-deep failed row 12b-deep-prune with a uniform zero across all four validators (0pruned on val-a…val-d) on a chain of 1 x v2 + 137 x v5. The prune was not the defect; the counter was. cmd/silt/chainstatus.go counted Block.IsPruned, which is b.Pruned != Hash{}, and (d-3) retired Pruned for v5 — a pruned v5 block's preimage folds AnswerDigest in place of Answer, so the pruned body still reproduces its own hash and Prune sets no token. The harness assertion pruned: N >= 1 therefore could not pass on a v5 chain whatever the node did. The (d-3) sweep was partial by exactly one site, and it is measured, not assumed: the four other non-test readers were checked and are sound — validate_v5_quorum, the floor-box door and NewBox were re-keyed to HeavyProofsShed with the reason in-source; Prune's own idempotence keys on it too; PruneBelowHorizon's skip is IsPruned || !hasHeavyBondProof, whose second arm carries v5; and Block.Hash and CheckEquivocation read IsPruned correctly, because they ask the IDENTITY question, not the bond-possession one. The predicate chosen, and why it is not the other two: HeavyProofsShed — it is exactly "this block committed space-time proofs it no longer carries", it is a superset of IsPruned on every era (it returns true immediately when IsPruned does) and on v1/v2/v4 the two are IDENTICAL rather than merely nested, since validateD3Digests refuses a pre-v5 AnswerDigest outright — so v5 is the one era where the two numbers can differ, and therefore the only era on which the second line's predicate can be gated at all, and it needs no change outside cmd/silt. hasHeavyBondProof was rejected on both counts: negated it is true of any block that never held a proof — genesis and every entry-only block — so it would over-count wildly, and it is unexported. Both numbers are now reported, because silently repurposing a published observable is the same class of error as the one being fixed: the pruned: line carries the sound count and a second of those: line carries the identity count, narrated so that its 0 on a v5 chain reads as EXPECTED rather than as "nothing was pruned" — the identity count is still a real diagnostic, since a block whose body cannot reproduce its hash is refused as equivocation evidence (ErrPrunedEvidence) and is the R-CARRIER-PRUNED-HASH surface. Driven RED first, and the existing test explains why it was blind: TestChainStatusReportsPrunedBlocks was GREEN throughout because its fixture is a v1 chain, where Prune does set Pruned — a fixture posture, not a predicate. The new TestChainStatusPrunedCountIsSoundOnAV5Chain fails on the shipped counter (pruned: 0 beside head version: v5) and passes after, with rig-error arms pinning that the fixture is genuinely post-(d-3). The second line is a scrape hazard, so it is gated rather than argued: the same test runs the harness's own expression pruned:[[:space:]][0-9]+ over the real output and asserts exactly one match; relabelling the new line also pruned: drives it RED with the measured got 2: ["pruned: 1" "pruned: 0"] — the harness keeps the LAST match, so the collision would have handed the gate 0 again. 12b-deep-prune is now informative but not yet self-settling: the fix removes the structural zero, so a future 0 means the prune genuinely did not engage — but chain-status reports no horizon and no count of registrations below it, and the 869ad9a-deep chain.cbor was destroyed at teardown before it could be read, so the evidence-capture gap is filed as R-GRADED-RUN-CHAIN-EVIDENCE-UNCAPTURED rather than treated as closed. Recorded, not fixed: answerDigestOf's doc comment claims it returns "the zero hash"* for a nil answer; it returns sha256(""). The code that depends on it is correct (HeavyProofsShed compares against answerDigestOf(nil), not against a zero hash) — only the sentence is false, and it lives in core/chain, outside this PR's scope. Filed as R-ANSWERDIGEST-DOC-FALSE in the ROADMAP residual register, not here — scripts/check_residual_register.py reads ROADMAP.md only, so a residual recorded in CHANGELOG prose is invisible to the lint that exists to stop exactly that, and a row is warranted rather than a shrug because this PR is what made answerDigestOf(nil) load-bearing for an operator-facing observable.

A shipped positive control asserted that paying for a shard that was never missing is correct behaviour (ROADMAP row F8 under the ratified D-RTRC3-INTENT-STANDS-2026-09-12 and D-BOUNTY-PAYS-FOR-REPAIR-2026-09-12; tests only — the production diff is EMPTY, no behaviour, no format, no ledger motion, no consensus rule, no economic mechanism). TestRedteamRepair_HonestClaimIsPaid staged a shard with stageShardOn — fetch the live shard from its own providers, re-place a copy on a fresh holder — and asserted BountiesReleased == 1. That is RT-RC-3's arrangement exactly, and under the ratified intent it must pay nothing, so a test named for the red team certified the finding the red team made, green the whole time. The three §11 controls were re-derived as ONE unit, because they are one: the two negative controls, TestRedteamRepair_GarbageClaimIsSlashed and TestRedteamRepair_ComputeButDontStoreIsDenied, rest on the positive control's non-vacuity — stated in that control's own doc comment — so correcting it alone would have gutted both in the same commit. No test was deleted and no test was renamed. The positive control now stages a REAL loss: loseStripePosition destroys stripe 0's first parity position across the whole swarm (measured: 3 holders at the fixture's Replication = 3), rebuildLostShard reconstructs it from the survivors on the paramedic's own path — fetchStripeByColumn, erasure.ReconstructStripe, the hash check against the manifest-committed id, placeAt, and repairStripeFetch's heldBefore cleanup — and the judge pays for that repair. Both negative controls now sit on that same loss and differ from the positive one in exactly ONE input — the claimed id for the slash, the holder's liar-ness for the deny — because legs that can only fail together are one leg wearing two names. The loss is asserted as a DIFFERENTIAL, not as an absence: shardIsReachable runs the production probeShard, which confirms every provider with a HasChunk round-trip and therefore sees through the stale provider record dropHosted deliberately leaves behind, and the helper requires YES before and NO after — an unreachable reading alone is equally consistent with a probe that never worked. Four ablations, each diff-verified and restored byte-identically, and the two negative controls redden on SEPARATE arms: making the judge trust claim.ShardID reddens the slash control alone; forcing the holder challenge to pass reddens the deny control alone; forcing it to fail reddens the positive control; and making the loss helper drop nothing reddens all three on the loss premise, which is that arm's teeth. ⚠ IT ASSERTS ONE HALF OF THE INTENT AND SAYS SO IN THE FILE. A real repair IS paid — the half the judge delivers today. The half that a no-loss claim must pay NOTHING is still broken, still pinned by TestRTRC3_ClaimWithNoLossIsPaid_PINNED_DEFECT, and its closer is the loss witness, GATED behind R-PROBE-FALSE-NEGATIVE-RATE: a repair erases its own evidence (T-LOSS-IS-A-TRANSIENT), so these helpers stage the loss for the fixture, never for the judge, and nothing here may be cited as "the bounty now pays for repair". The pin did NOT redden, which is the evidence that nothing behind that gate was built. Three comments that asserted the contradiction was unresolved decayed with the change and were corrected in the same pass — RT-RC-3's file header, the pin's own header, and rtRC3Pin's failure text, which told a future reader that the shipped control "will have gone RED in the same run" and that the two must be re-decided together; it now says the pin can be retired alone, and it QUALIFIES what a simultaneous RED there means instead of predicting it. The unqualified form was wrong in a case that is measurable today: rebuildLostShard places through placeAt, which sends MsgStoreChunk and announces nothing to the nodes near the column key, so a loss witness shaped as a RESTORATION DIFFERENTIAL would redden that control for a reason that is not payment at all — after the rebuild the position is not discoverable under colKey(root, pos) and lives on ONE node, down from three (measured 2026-09-13). The message now names the fixture case first, says the list is not exhaustive, and points at placeAt. stageShardOn survives — a re-driven census over every call site's enclosing function puts it at six test functions across three files, RT-RC-3 plus five others — and its doc now names it a no-loss stage. THE CALL SITE IS GATED, and the gate is driven RED three ways. TestRedteamRepair_ControlsStageTheLossAtTheirCallSites parses this file and asserts that every test delivering a repair claim also calls loseStripePosition — a CLOSED COMPLEMENT rather than a hand-written list of three, so a fourth control cannot quietly escape it, and file-scoped because the no-loss arrangement is the whole subject of RT-RC-3 and the judge fixtures beside it. Swapping the deny control's two lines back to the single pre-PR stageShardOn call reddens that gate and nothing else — the control itself passes either way, which is the measurement that justifies building the gate at all. Its two vacuity anchors were ablated separately: renaming the helper fires the re-derive anchor before the offender arm, and narrowing the walk to one control fires the floor. ⚠ A SOURCE GATE PROVES THE CALL IS WRITTEN, NEVER THAT IT RUNS, and it cannot see the helper's body. Reducing loseStripePosition to t.Helper leaves all three controls PASSING: nothing on judgeRepairClaim's path reads whether the position was ever lost, so no control can detect its own premise collapsing. The loss is enforced by four t.Fatalf lines and by nothing else, and that dependency is now stated in the helper's own doc comment instead of left for a reader to find.

Six stale copies of the repair-bounty formula lived in core/node, and the one the judge executes was the worst of them (2026-09-12; comments only — no production behaviour, no format, no ledger motion, no consensus rule, no economic mechanism; this sweep PRESUMES the F1 re-pricing of PR #848 and is written to be true on BOTH sides of it, so its correctness does not depend on merge order). core/credit owns the repair price; core/node restated it, and the restatement went stale twice in six days — at G-R212-7, when the base moved into the witnessed delivery price, and again at F1 (D-BOUNTY-PRICE-F1-2026-09-12), when k came out of the byte quantity. The six hits sit in five comment blocks: settleRepairVerdict's "ONE division" comment (⌊c·k·shardBytes·(lost+1)/(U/p)⌋ — the division the judge actually executes, and the site the blind PE named the worst of them), handleRepairClaim's shard-size comment, the protocol-price comment above credit.RepairBountyBase, Config.RepairEconomy's doc and the Stats.BountyBaseZero doc. Each now names the SYMBOL that derives the price — credit.RepairBountyCoeffNum/credit.RepairBountyCoeffDen and credit.RepairBountyBase — instead of re-deriving it, so a third re-price cannot falsify them; the G-BT-2 shape those comments exist to record (the single division LAST, never floor-then-multiply) is kept in full, and Config.RepairEconomy loses the pre-F1 claim that the bounty is "the witnessed fetch price of the survivors", which is the sentence the F1 derivation refuted. The sweep found two live sites the core/node census missed — core/node/redteam_repair_claim_test.go and sim/repair_bounty_test.go, neither of which any open PR touches. The redteam fixture comment also carried a number wrong for the geometry it describes: it said a 512 KiB frame's base "is 2", and measured off the stores that fixture populates every chunk of the object is a 524,304-byte shard, which prices at 20 on the pre-F1 basis and at 2 only after F1 — wrong by a factor of k. No assertion in that file reads the base, so the property it actually needs — non-zero — replaces the number rather than tracking the re-price. core/node/g_lambda8_test.go's package doc carries the same stale formula and is deliberately NOT corrected here: PR #848 already edits that file, and a deferred sweep must not fight an open PR.

The repair judge fetched a whole stripe to refute a claim its own manifest already refuted, could never judge a short final stripe, and paid a replayed claim twice (D-BOUNTY-REPAIR-BUILT-2026-09-12 under the ratified D-BOUNTY-REPAIR-MECHANISM-GATED-2026-09-12; three fixes and nothing else — the research gate is discharged for those three items and for no other part of that path). (A) The claimed position is now screened against the manifest before any survivor fetch. storedShards already built a ref for the claimed position carrying its manifest-committed id; judgeRepairClaim excluded it from the survivor set and never compared it to claim.ShardID. A position the manifest does not list for the stripe — out of range, negative, or implicit-zero padding — now DENIES with its own journal reason, at zero network cost. ★ A well-formed position whose committed id disagrees with claim.ShardID SLASHES, and that is the load-bearing half: the claim was already slashable through the recompute leg, so a screen that merely denied would have landed looking like a validation while silently retiring an existing punishment. Measured on the branch: a wrong-id claim at a listed position cost 14 survivor shards before and 0 after, and an out-of-range position cost 15 shards over 61 store writes — the four-round deferral ladder, because the retry predicate is cerr != nil and cannot tell "too few survivors" (transient) from "target out of range" (never heals) — and now costs 0 over 0. (B) repairproof.VerifyByRecompute counts the implicit-zero padding of a short final stripe, and nothing else changes. storedShards emits realData + (n−k) refs for such a stripe, the judge excludes the claimed position, so at most realData + (n−k) − 1 survivors can ever be supplied — judgeable therefore required realData ≥ 2k − n + 1, which is 5 at the shipped k=10/n=16, so every object of four chunks or fewer was entirely unjudgeable: the paramedic repaired it and no judge could ever judge it. At the default 256 KiB chunk size that is every object of at most 1 MiB. The judge's recoverability predicate is now exactly erasure.ReconstructStripe's, minus the target. ⚠ TWO PLACEMENTS WERE REFUTED AND NEITHER WAS BUILT: deleting the present pre-check routes a short-survivor transient into Decide(false, …), which bond-slashes an honest paramedic, so the ErrUnrecoverable / (false, nil) split survives the fix and carries its own gate; and erasure.ReconstructStripe is already correct and sits on the genesis path, so it is untouched. (C) Node-side (root, stripe, pos) dedup, written on PAID. credit.Ledger keys its escrow on the root alone — (root, repairer, amount) is PayBounty's parameter list, not its key — and carries no per-position state anywhere, so the record is new state on the Node and ports.CreditLedger does not move. ⚠ WRITTEN ON PAID, NEVER ON JUDGED: an empty escrow, a BountyBaseZero geometry and a deferred re-judgment all reach "judged" without paying, and a judged set is also a poisoning surface — emitRepairClaim binds an empty reply callback, so an attacker that gets a position judged first could make the honest one-shot claim for it refusable forever. It is keyed on the position and never on claim.ShardID, because two positions can carry byte-identical shards and content addressing collapses them to one id — confirmed in the shipped fixture, not hypothetically: its final stripe has positions 12 and 14 sharing an id (R-SHARDID-ALIASES-POSITION). THE PINS FLIPPED, WHICH IS WHAT PINS ARE FOR. TestRTRC2_ReplayedClaimPaysAgain_PINNED_DEFECT and RT-RC-1's out-of-range arm both reddened on the fix and were replaced by positive assertions of the rules that reddened them (TestRTRC2_ReplayedClaimForAPaidPositionDrawsNothing, rtRC1OutOfRangeRefused), with their teeth arms re-driven. No test was deleted. RT-RC-1 arms (a) and (b) are untouched and still pinned; RT-RC-3 is untouched and did NOT redden, which is the evidence that nothing behind the GATED loss witness was built. ⚠ A PREMISE THE CERTIFICATION AND THE FIXTURE BOTH CARRIED IS REFUTED BY MEASUREMENT: newRepairAdv does not stage "exactly one full k=10 stripe" — splitFile reserves chunk.HeaderSize bytes in every frame, so 10·(512<<10) bytes yield ELEVEN chunks over TWO stripes, and stripe 1 was already short (realData = 1, 7 stored refs). The conclusion the premise supported survives, because every pre-existing repair-claim test claims stripe 0 — but the predicted "one-line geometry change in the harness" was unnecessary and the wired gate claims the short stripe that was already there (R-CERT-FIXTURE-STRIPE-COUNT). A second measured correction: RT-RC-1's in-range pin counts distinct chunks written, which is 14 survivor shards plus the manifest chunk and not 15 shards — two off-by-ones cancel, the ratified assertion is left alone, and the sentence that named it is corrected (R-RTRC1-COUNTS-CHUNKS-NOT-SHARDS). Every gate was driven RED before the fix and each fix was ablated back out one at a time, four ablations, every one diff-verified against the original. The control leg for direction D is not red on the defect and says so in its own doc comment: TestRepairJudge_DeniedPositionStaysPayable is green before and after, and goes RED when the record is moved to the top of settleRepairVerdict — driven, with RT-RC-2 staying green under that same ablation, so the two discriminate. CORRECTION, measured in blind review: one control was not enough, and the coarse ablation proved the wrong thing. Moving the record from the paid > 0 arm up to just after the dedup check — record on RELEASE, the realistic mis-placement and the one the field comment argues against — leaves the entire core/node package green, that control included, because a retrievability deny is already refused upstream at the pre-existing if !d.Release return. TestRepairJudge_ReleaseThatPaidNothingStaysPayable is the arm that pins the record at paid > 0: it judges an honest claim against an empty escrow (both legs verify, the verdict releases, PayBounty pays nothing), re-endows the object and re-claims the same position, and asserts it pays with BountyDuplicatePosition still 0. Driven RED under that ablation — the only test in the package that reddens — and it carries a funded-escrow witness arm so a claim that died at a deny could not pass for one refused at PayBounty. ★ NOBODY MAY WRITE THAT THIS IS SOLVED: the bounty is now correctly METERED and remains MIS-ATTRIBUTABLE. RT-RC-3 is open, the loss witness stays GATED behind R-PROBE-FALSE-NEGATIVE-RATE, and R-BOUNTY-METERS-BUT-DOES-NOT-ATTRIBUTE is held in tension. The γ→1/N firewall holds: PayBounty stays neutral, Reputation reads neither escrow nor bounty, and the new state is a node-local set plus a counter that feeds no standing. Two claims this change made about itself were corrected rather than defended. R-DEDUP-NOT-PERSISTED said a restarted judge "denies rather than double-pays" — false: credit.Ledger.RecordServeToObject skims into the object's escrow on every serve, so the escrow refills from ordinary traffic while the paid set does not, and the restart window reopens with the first skim. It is inert today only because -economy is default OFF, which is the weaker reason and the one now written down, in the row and in Node.bountyPaid's doc. And the judge's package comment still called a recompute disagreement a self-attributing lie; after the screen that case has no reachable instance, because correctnessOK is a function of the manifest alone over the claimant's whole input set — the screen is now the only live route to the slash, and a false recompute is a publisher fault. Filed, not fixed here: settleRepairVerdict still runs SlashFalseRepair before the !cfg.RepairEconomy return, and the screen adds a second, zero-network entry into it, so economy-OFF bond-slashing got cheaper to trigger — self-slash only, since the target is the TLS-authenticated sender (R-SLASH-RUNS-BEFORE-THE-ECONOMY-GATE).

A ratified ledger entry said the repair judge fetches k survivors; it fetches n−1, and on an out-of-range position it fetches all n (D-REPAIR-CLAIM-GATES-PINNED-2026-09-12 RECORD CORRECTION; comments and records only — no production behaviour, no format, no ledger motion). The RT-RC-1 pin exists to hold an unbudgeted survivor-fetch amplification on handleRepairClaim, and the entry that ratified it described that amplification as “a stream of k-survivor stripe fetches on the judge”. Confirmed false at source, independently, by a Researcher certification and a blind principal-engineer verification: judgeRepairClaim builds survivorRefs as the complement of one position — every ref of the stripe whose pos is not claim.ShardPos — and fetchSurvivors hands the whole slice to fetchStripeByColumn, which walks it to the end with no early exit once k are in hand. storedShards lists n refs for a full stripe, so the count is n−1 = 15 at the shipped k=10/n=16, not 10. Nothing validates claim.ShardPos before the loop, so an out-of-range position excludes nothing and the judge fetches all n = 16 — one MORE than an honest claim before VerifyByRecompute rejects it. The error was easy to make because repairproof.VerifyByRecompute genuinely REQUIRES k and ErrUnrecoverable is worded in k: the requirement is k, the fetch is simply not budgeted to it, and that gap is the whole of RT-RC-1. The same false word was in an in-code comment on the judge path — the CORRECTNESS leg comment inside judgeRepairClaim and the CORRECTNESS bullet of core/node/repairclaim.go's package header — which is the live defect class this repo keeps re-learning (silt-a-claim-about-a-gate-is-itself-a-claim); both are corrected here, and both now state the out-of-range case explicitly. The severity sentence is corrected too, in one direction only: repairproof.RepairClaim carries five cbor fields and no signature, and settleRepairVerdict pays PayBounty(claim.Root, claim.Holder, bounty) — a field of the message, not the transport identity — so the escrow drain is DIRECTED, the claimant naming the account it drains into. The “not a mint” half STANDS and is not disturbed: PayBounty is neutral and Reputation reads neither escrow nor bounty, so the γ→1/N firewall holds. Nor is the drain a payment to an arbitrary account — the named holder must still answer an identity-bound Shacham–Waters challenge. The three pins, the PINNED_DEFECT posture and the refusal of skip-until-fixed all stand exactly as ratified; a larger number does not re-price the fix. ROADMAP row F7 carried the same two sentences and is corrected beside them, superseded text left visible.

RATIFIED — silt's front door, its threat model and its public website claimed a bond term in fork choice (D-FORKCHOICE-CLAIM-2026-09-12; published-claim text and one test gate — no consensus rule, no format, no economic mechanism, no security parameter). The certification found the PROPERTY SOUND and the DOCUMENTATION false — no consensus defect was found and none is fixed here. The owner ratified the FULL scope on 2026-09-12: README, threat catalog, risk register, the quorum-chains math doc and both public website pages, with docs/threat-model.md travelling with them. The M0 composition part in README.md said objective on-chain-bond fork-choice so partitions heal to the heavier-standing chain. Fork choice ranks on height then head hash and reads nothing else (core/chain heavier); with the finality gate on, Reconcile admits only forks containing the committed head, so a sub-quorum partition commits nothing, stalls and CATCHES UP. The replacement is the research-certified sentence from README-BOND-FORKCHOICE-literal-claim-and-equivalence-RESEARCH-CERTIFICATION-2026-09-12 §7. It is used VERBATIM at the ONE site that states the M0 composition — the enumerated list in README.md — and pinned there by TestO3T_CertifiedForkChoiceSentenceIsPresent — the positive half a ban set does not have. A ban asserts only that the retired wording is gone; delete the replacement outright and every banning gate stays green, because nothing required it to be there. Both directions now hold, the way the claims-ledger gate already did for its row. docs/threat-catalog.md, docs/risk-register.md, docs/math/08-quorum-chains.md, docs/threat-model.md, website/index.html and website/docs.html move with it, each stating its own NARROWER property in its own terms rather than taking the sentence — a verbatim paste is ungrammatical in the six mechanism-name slots and would create a second face of a published claim at every one of them. Two structural holes in the gate are closed here, not merely disclosed. A third retired phrase, on-chain-bond fork-choice, was found by CENSUS rather than by the gate — it is a different literal from the two already banned — 13 live sites at 75c0f89 in this gate's walk, 13 of 13 the retired claim; it joins the ban set. That figure is re-driven and it names its tree, because the census first booked here read 7 live sites with a 1 harness + 6 published split, and all of it was wrong: 7 is the count on the harness half's tree rather than at base, SIX base hits were harness text rather than one, and the split omitted README.md:43 — the front-door site, and the whole reason the positive pin exists. And the blanket website/ directory skip is replaced by a by-NAME skip of the three pages that actually have a generator (buildlog.html, changelog.html, roadmap.html): index.html, docs.html and node.html are hand-maintained, the skip's stated reason was false for them, and two of them carried the retired claim on silt's public pages behind a skip that said they could not. They are now walked (.html admitted; 164 → 173 tracked files, zero new false positives, measured), and website/index.html becomes a fifth anti-vacuity ANCHOR so that a return of the blanket skip fails a build instead of going quiet: ablated, dropping website/ leaves 170 files — the count floor GREEN — and only the anchor goes RED. The harness half of this work landed separately, ahead of this, because every heavier-bonded hit was harness text needing no ratification.

The consensus harness said the healed set converges on whichever fork carries more bond, and the gate written to police that wording could not see a third of the files carrying it (2026-09-12; harness text, Go comments — one of them a production doc comment — and one test gate; no consensus rule, no format, no economic mechanism, no security parameter). Fork choice ranks on height then head hash and reads nothing else (core/chain heavier, pinned by TestO3T_HeavierReadsOnlyHeightAndHeadHash; O3 Direction T, owner-ratified 2026-09-03), so there is no bond or weight term for a fork to win on; with the finality gate on, Reconcile admits only forks containing the committed head, so a sub-quorum partition commits nothing, stalls and CATCHES UP. integration/consensus/ (README.md, run.sh, docker-compose.yml), integration/README.md and integration/run-all.sh are corrected, and with them eleven Go comment sites across five files plus three test failure strings — counted off the diff at this head, not carried forward (the entry first said six Go comments, which was neither measured nor true after the .go repairs below were added). A second phrase carries the same defect and was found by census while severing this work: run.sh:5 named the keystone under test as an objective on-chain-bond fork-choice, which locates the objectivity in the ranking rather than in who may participate — corrected here. Re-driven at this head: SEVEN live sites remain, all ratification-gated, so they travel with the published-claim half — README.md:43, website/index.html:173, website/docs.html:34, and docs/threat-model.md ×4. Seven is the count over the whole shipped tree; this change's own gate walk skips website/, so the gate itself sees five. Both are stated because a census that does not name its tree is not re-drivable. This entry previously said four remaining, in docs/threat-model.md, and named core/chain/redteam_consensus_test.go:132 among them. That figure was never measured, and :132 carried a different literal ((heavier-bond) fork) in a file this change repairs — the on-chain-bond fork-choice hit in that file was :11, and both are gone at this head. A false census in the published record is exactly the defect this entry exists to close, so it is corrected here rather than quietly. This is the harness half, severed on the ratification line. Every live hit of heavier-bonded is inside integration/consensus/; the M0-composition family (README.md, docs/threat-catalog.md, docs/risk-register.md, docs/math/08-quorum-chains.md and the public website) states a research-certified PUBLISHED CLAIM, and its correction is held for owner ratification rather than bundled here. The gate is TestO3T_NoRetiredForkChoiceClaimInShippedText, and three of its own weaknesses were measured and fixed before it landed: its walk admitted .md/.sh only — the same file-type list the repair was drawn from, so it was structurally incapable of finding what the repair missed, and integration/consensus/docker-compose.yml:20 carried a banned literal while the gate's census called the set closed at 7 of 7; it is 8, measured, and the eighth is the site the severed gate goes RED on today. .yml/.yaml are admitted (137 -> 164 tracked files walked, zero new false positives, measured). The gate matched per line, which an ordinary soft line wrap defeats — a blind reviewer restored the retired claim verbatim with a newline in the middle of it and every canon-text gate in that file stayed green — so matching now runs over a whitespace-flattened form of each file, driven RED end-to-end by planting a wrapped phrase in a real walked file and GREEN by the same match per-line. A second arm asserts the gate bodies actually CALL the flattened path, because the helper's own test stays green if a future edit stops calling it. The anti-vacuity file-count comment claimed 153 measured at 75c0f89; the measured value was 137, a false number inside the message the next reader reads. The file count was then measured to be the wrong instrument entirely, and is demoted: the floor was files < 100 against 164 walked, so dropping the whole of docs/ leaves 121 and the gate stays green — with every ratification-gated site outside the front page gone from the walk, and neither named-file leg under docs/. Raising the floor does not fix that; any value tight enough to notice one directory goes false-RED on ordinary file churn. The count is kept only as a total-collapse tripwire and says so, and the binding leg is now a set of four ANCHOR files — one per walked area that holds the policed population (README.md, integration/run-all.sh, docs/threat-model.md) and one per admitted extension (integration/consensus/docker-compose.yml for .yml, the very file the old filter could not reach). An anchor carries no number: a named path is in the walk or it is not. Each is driven RED by removal. And the residual is now in the gate's source rather than implied: a PARAPHRASE ("the chain carrying the most bonded standing") states the claim and the gate is silent, which no lexical rule closes — widening the literal set is what this gate's own admission bar rejects, since heavier chain false-flags 3 of its 5 hits (re-driven: 5 hits at 75c0f89 in this gate's walk, 2 of them the claim; the figure previously booked here, 5 of 7, reproduces in no scope). The gate covers a vocabulary and a re-wrap of it, never "the claim". The website/ skip is likewise corrected rather than trusted: only buildlog.html, changelog.html and roadmap.html have a generator, so the stated reason ("GENERATED from the .md sources") is false for index.html, docs.html and node.html, which are hand-maintained — and two of them carry the retired claim on silt's public pages today. That repair travels with the ratification-gated half. The .go population is separated from the claim that it is repaired, which the gate used to assert wholesale: core/node/partition.go (production source, SetBlockedPeers' doc comment) and sim/reorg_test.go are repaired here, and what is NOT repaired is now named with its reason — cmd/silt/daemon.go:1299's operator narration is read by three greps in integration/consensus/run.sh, so editing it would fail a Docker-gated harness open that nobody has re-run at this commit; daemon.go:154 scopes itself to LEGACY mode and is accurate; and TestPartitionHealsToHeavierFork's NAME is cited from docs/test-topologies.md and stays a residual. No .go file is gated by anything, and the gate now says so.

The operator playbooks tested a stale binary, and four dead premises that had been swept out of the docs were still live in the code (2026-09-12; text, one shell guard and one lint predicate — no consensus rule, no format, no economic mechanism, no security parameter). All five examples/.sh gated the build on [ -x ./silt ] alone, so any ./silt lying in the repo root was used as-is: the binary in the working tree was built 2026-09-10 01:02, before 26b2f69 (#818, the M1 genesis move) landed 2026-09-11 14:05, so every playbook was exercising a binary that mints a different genesis hash from the source beside it. The guard is deleted at all five sites — Go's build cache makes a no-op rebuild cheap, so the condition bought nothing and cost correctness. The four premises: (1) the idle window was still called REFUSE-UNTIL-SET, which owner call 4 of D-TRUE-UP-CALLS-2026-09-07 released on its own conditional — the shipped default is 24m (D-C2-IDLE-WINDOW-VALUE). A blind review found the first pass had swept one clause of one file, so the premise was re-measured across the tree and repaired at six sites, not one: core/node/deliverysession.go C9 and the EnableDeliverySessions doc label, core/node/c2_idle_window_gates_test.go, e2e/f8_epoch_precondition_test.go and integration/cloudtest/topology.py. The sixth is a DELETION — errDeliveryIdleUnset announced "idle window unset — refuse-until-set"* to an operator and had zero references anywhere in the tree; an unreferenced package-level const does not fail to build, which is how a retired premise outlives every caller that could say it. The topology comment additionally named a window (90s) that is not in the launch line beside it and that the daemon would now refuse, being below the derived floor (430 s × 4/3 ≈ 573 s); (2) the same clause called the session remainder a BURN and an open owner call, when D-R2.9-NODE-HALF-CALLS call 1 (amended 1′) ratified a REFUND and core/credit/deliveryanchor.go CloseDeliverySession books it as a deposit — the burn survives only at the pending-table cap and for a fetcher with no account; (3) "era-4 is dark" survived in operator-facing STRINGS after PR #826 swept only comments — at four sites, not the two first named (core/node/deliverysession.go, core/node/relayrole.go ×2 including one missed comment, cmd/silt/daemon.go ×2: the -accept-relay-payments help and the boot banner) — void because -era4-activation-height defaults to 1, so v5 is live from height 1 and the real gate is a committed IssuerKeyReg on an objective, bonded, epoch-enabled validator; (4) docs/design/m0.md §9's "zero non-test callers" for translog.VerifyInclusion/VerifyConsistency is false — core/chain/stateview_proven_v5.go calls both — and the sentence is corrected while the conclusion it supports stands, because those callers sit inside the ratified-inert floor box.

The operator was told the chain "reorged onto a heavier fork" — an event the shipped rules cannot produce (2026-09-12; narration only). heavier ranks on Height then head hash and has no weight or bond term (O3 Direction T, owner-ratified 2026-09-03), and with the finality gate on — every objective && ByzantineQuorum posture — Reconcile admits only forks containing the committed head, so dropped > 0 is structurally impossible. The line now names what it actually means: a competing fork was adopted and dropped committed blocks, which can only happen with the gate OFF (a non-objective chain, or the -byzantine-quorum=false opt-out). Source: research certification README-BOND-FORKCHOICE-literal-claim-and-equivalence-…-2026-09-12, finding R-6. The published fork-choice CLAIM itself is a separate, owner-held change. Three harness log-matches were coupled to the old literal and move with it (integration/consensus/run.sh P2's negative grep, P3's await alternation, and the reporting extractor, plus the line list in integration/cloudtest/HANDOFF.md) — string parity only, no assertion changed. P2's negative arm carries a standing caveat it already had: with the gate on it cannot go red for the reason it was written, which belongs to the claim PR. The string is now REGISTERED in cmd/silt/observable_contract.go. Nothing fired on the rename: the old literal was never an entry and no registered marker is a substring of it, so the S5 registry — the mechanism whose whole purpose is to move the RENAME half of scar-observable-log-contract to the unit tier — could not see the rename that happened under it. Its Asserter is deliberately empty: the three readers live in a Docker tier that appears nowhere in ci.yml, and naming a runtime gate that does not run would be worse than naming none.

Nine Go citations pointed at an archived doc's old path. docs/design/m0-hardening-strategy.md moved to archive/design-history/; nine sites still cited the dead path, including the failure message Invariant A prints (core/credit/invariant_a_test.go), which handed a reader a destination that does not exist at the moment they most needed it (simplicity rule 4). All nine repointed; §2 and §4 resolve in the archived copy.

A memory-index link differing only in CASE read as present. index_integrity in scripts/check_agent_memory_link.py tested (seat / target).exists, which is case-INSENSITIVE on APFS — the volume the seats and the PreToolUse/Stop hooks run on (measured: (seat / "Real.md").exists is True when the file is real.md). So one typo gave two wrong answers: the link never dangled, while the real file was reported an ORPHAN because the orphan direction compares link strings. The test is now case-exact os.listdir membership per path component. The test is now case-exact os.listdir membership per path component. The first version of that fix over-reached and was caught by blind review before merge: it returned False on any .. component and justified it as "unreachable", which is measurably false — researcher/MEMORY.md cites ../tester/era4-regcap-measurement-2026-08-29.md, a file that exists — so index_integrity went from (8 indexes, 0 dangling, 0 orphans) on the real store to 1 dangling, and that false positive would have been stamped into every Stop/SessionStart autosave subject as DEGRADED: 1 dangling link(s), burying the next real one. .. is now RESOLVED against the store, case-exactness kept per component, floored at the store root. The over-action control failed to catch it because it only tested a same-directory, correctly-cased link while claiming to catch "a fix that rejected every nested or unusual link"; a cross-seat arm now covers the over-action that actually shipped, with four legs ablated independently — the resolving link, the missing one, a wrong-cased SEAT component, and a link climbing above the store root whose target EXISTS on disk so the leg fails on the missing floor and not on mere absence. scripts/check_memory_index.py states the same rule for the same construct; the two checks read one store and may not disagree about it.

The reachability gate now watches the era-4/v5 freeze-manifest mechanisms, and its substantiality test is the compiler's verdict rather than a proxy for it (scar:mechanism-shipped-inert-2026-09-10; gate and docs only — no Go source, no behaviour, no format change). scripts/reachability_lanes.txt held three lanes, all of them paid-lane client entry points, so the gate built after owner call F shipped inert did not watch the class of surface F was. The 22 manifest items are resolved as a MAPPING: six name a mechanism that lives in production Go (items 1, 3, 6, 10, 19, 20) and all six now carry lane records — nine records, since items 3, 19 and 20 each have two independently droppable halves — anchored on a new posture section in docs/release-checklist.md. The other sixteen are dropped, refuted, declined, owed with nothing in the tree, or delivered as tests. All nine are PRESENT in the linked ./cmd/silt; the gate is green at 15 records and goes RED (exit 1) when the sole production call site of CheckConsensusParams is removed, which is the original failure exactly. The substantiality test changed because the old one refused the truth: requiring a callback closure in the body refuses seven of the nine records (validateD3Digests cost 1010, StartupEraLines 906, chainstore.Recover 802, printEraObservable 721, genesis.Build 421, CheckConsensusParams 278, setD3Digests 172, against a budget of 80 — driven by running the retired rule itself), and the .funcN presence witness reported (*Chain).stateRootLeavesV5 — live, linked, closure inlined into its own parent — as hollowed. The gate now reads go build -gcflags=-m=2 per lane package and requires cannot inline. It is a TRADE, not a strengthening, and the boundary is written down as measured: the inline verdict catches a hollowing that collapses the body's cost (a hollowed setD3Digests draws can inline and the record is REFUSED) and MISSES one that does not — gut v5ValidateSlashes, keep one used closure, and at cost 263 this gate runs green while the retired witness goes red on the same binary. Neither test dominates; scripts/check_reachability.py carries the two-way table. Item 19's daemon record moved from the one-line cmd/silt.eraStartupLines wrapper (cost 120, a margin made of two call charges) to the reducer core/chain.StartupEraLines (cost 906), whose only production caller is that wrapper — identical reachability signal, no arithmetic accident. Reachability is necessary and never sufficient: do not book a manifest item as BUILT on the strength of a green reachability run — the sentence has seven standing homes, including the line the gate PRINTS on every green run. The gate's CI job is not a required status check, so its red is advisory at the merge boundary; the checklist says so where it cites the gate, and making it required is an owner act. New residual R-INGEST-WITNESSES-INERT: core/statehash.IngestBlockWitnesses, the R3 witness-bound gate, is non-inlinable at cost 478, has zero non-test callers and is ABSENT from ./cmd/silt — the founding scar outside the lane set. Nothing is wired to make a gate green.

Freeze manifest item 17 — R-E2E-ERA4-FIXTURE's POSTURE half lands as a two-armed gate, and the reason its OS-process half stays owed is MEASURED rather than argued (R-E2E-ERA4-FIXTURE, owner call 14; tests and comments only — no behaviour, no format, no validity change). THE OBSERVATION FIRST, because it is what the item was worth. TestPaidDeliveryLaneRefusesWithoutACommittedKeyBinding asserts a refusal "without a committed key binding", and the refusal is NOT attributable to that cause: silt swarm receipt resolves keys on the ephemeral node joinSwarm builds, which never calls EnableChain — the daemon's is the only EnableChain call site outside tests in cmd/ — so pinDemandIssuerKey returns false at its FIRST guard, n.chain == nil, before the committed-binding check runs. ABLATION, diffed against the pristine file before either run and confirmed by === RUN plus exit code: deleting the commitment check from pinDemandIssuerKey AND from DemandIssuerKeyset's Retain leaves both that test and TestPaidDeliveryLaneArmsInTheHarnessPosture GREEN, exit 0. A refusal that survives the deletion of its own named cause gates the refusal strings, not the predicate. THE POSTURE GATE, both arms on one fixture. TestIssuerKeyBindingResolvesInTheObjectiveBondedEpochPosture (core/node/issuerkey_epoch_posture_test.go) drives a chain that is objective (MinBond > 0 with a wired bond verifier), bonded (the issuer's BondReg must COMMIT before IssuerKeyRegAdmissible lets the registration ride), epoch-enabled (EpochBlocks = 4, crossed by real blocks) and era-4 — the binding for epoch 1 commits in a v5 block at height 4, block epoch 1, through the real proposer fold and the real validateIssuerKeys, never the genesis door. On that one fixture: ACCEPT (committed binding, served key matches) pins 1; REFUSE-A (an issuer that committed nothing) pins 0; REFUSE-M (an off-commitment key after a first-write-wins rotation) pins 0 — with a CHAIN under the fetcher in all three arms, asserted, because without it every count is 0 for an unrelated reason. Each refusal clause has its own arm, proven one condition at a time: dropping the whole commitment check reddens REFUSE-A (exit 1); dropping ONLY the fingerprint equality and keeping presence reddens REFUSE-M (exit 1) while REFUSE-A stays green. WHY THIS POSTURE DID NOT ALREADY EXIST, read one fixture at a time because each is missing a different leg: newIssuerKeyFixture, sim issuerKeyGenesis and e2e anchorChainFor are all chain.Config{Quorum: 1} genesis-only with EpochBlocks 0, so the binding goes through validateGenesisIssuerKeys and every pin lives at epoch 0; c3Chain does set EpochBlocks but is legacy by its own words, so objective is false, epochsEnabled is false and validateIssuerKeys' bonded clause is inert. era4AnchorNet now delegates to the new era4EpochNet(t, n, epochBlocks) with 0, so the C2 wedge fixture is byte-identical and no second harness was added. THE ITEM'S FORMAT-HALF PREMISE IS CORRECTED BY MEASUREMENT, not rewritten. The record reads that the activation default left era-4 "exercised on the EXISTING fixtures". It does so only on fixtures that COMMIT ABOVE GENESIS: on a committing topology (the TestBondEarnedStandingCommitsOverTCP argv, stores kept) silt chain-status reports head version: v5 and era-4 (v5): ACTIVE — first v5 block at height 1; on the paid-lane fixture's exact argv it reports no chain yet (0 blocks), the daemon's own banner reports head v2 at height 0 and era-4 (v5): DARK, and nothing era-4 is exercised there at all. WHAT STAYS OWED, and it is not a fixture problem: the OS-process POSITIVE arm. No shipped process is both chain-bearing and a paid-lane fetcher — silt client has no chain either, and swarm receipt is the only production caller of FetchDemandIssuerKeys / AcquireDemandTokenInWindow / OpenDeliverySessionRemote / SubmitDeliverySettle. The D3 architecture's answer is a durable parent resolving the key and handing the pair down (ResolvedDemandIssuerKey → AcquireDemandTokenWithCredit), which the CLI does not use. Wiring one is a production change on the client posture, so it is left to the open owner call and NOT designed around here.

Freeze manifest item 11 — the FDH domain set is gated pairwise prefix-free, derived from source, and the mechanism the item was written with is CORRECTED by measurement (R0.4b-FDH, crypto advisory C-8, PE re-audit item 11; tests only — no behaviour, no format, no validity change, and no domain constant's value is touched). fullDomainHashD hashes domain ‖ ctr(4B BE) ‖ msg with the domain BARE — no length prefix, no separator — so the concatenation is injective in (domain, msg) only while no domain prefixes another. C-8 proposed the RFC 9380 §5.3 DST length prefix; that rewrites every token's bytes and the publish and credit domains are byte-frozen against chain replay, so it was DECLINED at the era-4 freeze in favour of a gate, and the gate did not exist. THE SET IS FOUR AND THE WALK CONFIRMS IT: fdhDomain, creditDomain, demandDomain, relayAnchorDomain, all in core/blindtoken/blindtoken.go, and "silt/blind" matches no other string literal in the tree — the other Domain constants (core/bond, core/link, core/manifest, core/demand, core/node, core/chain) are different constructions under different keys and are not in this set. All six unordered pairs differ at byte index 10, matching the advisory's own reading. The gate is over the SET, not a list of pairs: TestFDHDomainSetIsPairwisePrefixFree (core/blindtoken/fdh_domain_prefix_free_test.go) walks every non-test .go file in the package with go/ast and selects domain constants by name suffix OR value prefix, so a fifth domain is covered the day it is declared. Two companions hold the walk honest: TestFDHDomainSetSourceWalkFindsTheRealDeclarations resolves the walk's output against the constants the compiler resolves, because a source walk that matches nothing passes every pairwise check; and TestFDHDomainArgumentStaysInsideThisPackage holds the completeness precondition — every function taking a domain string is unexported, so no caller outside the package can drive the FDH with a domain the walk never saw. A Domain constant that is not a plain string literal is refused rather than skipped. WHAT WAS ALREADY THERE, AND WHY IT WAS NOT ENOUGH: TestRelayAnchorDomainIsPinnedByteExactly checks three hand-listed pairs for EQUALITY. Distinctness is not prefix-freeness, and that is measured rather than argued — under a fifth domain that prefixes fdhDomain, the new gate goes RED and both pre-existing distinctness assertions stay GREEN. THE CORRECTION, driven. The usual justification for prefix-freeness — a message under the longer domain reparses under the shorter one, so a harvested signature crosses lanes — is FALSE for this construction, and the gate's own text no longer says it is. TestAPrefixPairFailsToCollideOnlyBecauseTheCounterVaries measures a crafted prefix pair colliding on SHA-256 block 0 and NOT on block 1: ctr sits between the domain and the message and changes per block, and MinModulusBits = 2048 forces nine blocks, so the single-block case that would make the shift work cannot arise. A prefix violation is therefore a structural defect, not a live forgery — and the rescue lives in fullDomainHashD's field order, which no separation argument anywhere rests on and no review approved as one. Gating the structure rather than the accident is the proof-versus-structure canon applied. NOT duplicated: the field order is already pinned byte-exactly three times (TestPublishAndCreditFDHAreUnchanged, TestDemandFDHInputBindsTheEpochByteExactly, TestRelayAnchorDomainIsPinnedByteExactly) — verified by moving the counter and watching all three redden while all five new tests stayed green, which is why no fourth pin was added. TestEveryOrderedDomainPairRefusesTheOthersSignature adds the runtime half over the same derived set: a real blind withdrawal under each domain, verifying under its own and no other, with the positive control asserted so the refusals are not vacuous. Five ablation legs, every patched file diffed against its pristine copy before either run was believed, by exit code: the fifth prefixing domain (1), a domain hidden from the walk as a constant expression (2), an exported wrapper leaking the domain argument (3), blindD/verifyD ignoring their domain argument (4), and the counter-move control (5). R0.4b-FDH stays open as the versioned fix; this closes only the gate the freeze substituted for it.

R-membership G-3 is KEPT BUT RESCOPED, and the record that called it the residual's closer is corrected in place (scope ruling silt-agent-memory/researcher/reviews/research-outcome/2026-09-11-G3-witness-id-list-size-gate-SCOPE-RULING.md; records only — no code, no behaviour, no format). Five rows across ROADMAP.md and docs/decisions.md carried the claim that the witness id-list size gate closes R-membership. It does not: the gate caps what ONE BOX accepts as a witness and bounds neither len(c.slashed) nor len(c.validatorsSeen), which (Chain).apply writes and which the gate has no contact with. R-membership's closer is therefore UNNAMED, and the record says so rather than naming a substitute — under simplicity rule 4 a residual with no named closer is a disclosure rather than a row, and that demotion is the owner's call, so the register row stands. The D-MEMBERSHIP-KEEP-FIVE-2026-09-11 keep-five ruling is UNTOUCHED: it rests on a Tester ablation of what the leaves DO, and only the over-claiming closing bullet moves; every superseded sentence is left visible. The gate itself is kept, off the RC critical path — not a FORMAT item and not a stamp-raise item either, but box-local admission on a door that returns no verdict, with its deadline whichever of the accept flip (R1.8 / #657) or the witness-transport merge lands first. Its half A (the ungated O(N) fold over w.PreIDs in anchoredPreSet / digestFoldOp) is held in tension rather than closed — (Box).Validate's first statement is the BG-3 budget check and recomputeStateRootEntriesRevocations has exactly one non-test caller, that door, but that is a single-caller property of an unexported function that no gate pins. Its half B (the allocation before any measurement) shares ONE instrument with R-R3-GOB-ALLOC-AMPLIFICATION's decoder limit; that row now says so, so the two are one build. The R-membership row also contradicted itself — tag Lane D1 against a body saying it is out of the D1 train — and the record says it was contradictory rather than silently picking one: the tag moved to Lane TAIL (POST-RC). G-3 denotes at least six distinct gates in this repo, one of them in the same file as the BG-3 budget leg that refutes this one, so the plan now cites it as R-membership G-3 everywhere.

The h43 round-ladder model-check now covers its regime: RED without the #772 fix, GREEN with it (2026-09-11; test only — no behaviour, no format, no validity change). TestModelCheck_H43_RoundLadderDesyncMustStillConverge (core/node/modelcheck_h43_round_ladder_desync_test.go) is the recorded deterministic home for run c450985-deep's height-43 liveness stall, and it did not reproduce it: EXIT 0 at c4da469 where the fix is present, and EXIT 0 at 8b467e1 — its own commit, where the whole fix is absent, since the #772 merge is not an ancestor of it and the four symbols it added to core/node/rounds.go (maybeProposeAtRound, acceptRoundCert, broadcastRoundCert, forwardPendingWorkToDesignee) are absent there. It was also EXIT 0 under a direct ablation of the arming rule at the IDENTICAL virtual time, which is the sharpest statement of the gap: the rule never bound on its schedule. THE CAUSE: the test drove matureWorld12's refill, which installs a pending bond-reg on EVERY node, and re-drove it every 64 scheduler steps. The pre-fix maybeAdvanceRound armed the round clock on LOCAL mempool content alone and zeroed rs.Sweeps on every momentarily-empty sweep, so uniform pending work satisfies that guard at every seat at once — the arming term is never consulted and the ladders cannot desynchronize. THE REPAIR: pending work is made NON-UNIFORM, which is the field's actual condition (three of thirteen seats held entries while ten sat at r0). The schedule burns round 0 at every seat with the #451 freeze-frame (the r0 designee proposes with its precommit replies held, so every live member locks and consumes its (h, r0, prepare) slot), kills that designee for the whole budget, and re-installs the work on a two-anchor minority asserted against the live chain to sit below chain.RoundCatchupMet — so the responsive catch-up path cannot rescue the workless majority either. Delivery is one message at a time in FIFO order with the oracle sampled between every delivery, so nothing turns on message ordering and the sampler cannot miss the instant a round-change quorum forms. THE ORACLE HAS TWO ARMS, because a liveness property is green under a defect whose whole symptom is that nothing happens. BOUND: the height commits within the PUBLISHED claim for #772 — ≤ f′+1 rounds, sweepsForRound(0) + sweepsForRound(1) + 1 = 6 sweeps = 180 s, the 190 s at f = 1, N = 12 — not a threshold fitted to the measured gap. MECHANISM (the control): some live member must accumulate a round-change set meeting chain.SupportMeetsQuorum at a round ≥ 1. The control is load-bearing because the pre-fix tree DOES still commit the height, via the #338 staggered-takeover rank walk whose bound is (N+2)·ChainSyncInterval — so both trees commit this height at CommitRound 1 and the committed block cannot tell them apart. MEASURED, each run confirmed by === RUN rather than by exit code: c4da469 EXIT 0, commits in 2 of 6 budgeted sweeps with the quorum at round 1 carrying all 11 live seats, bit-identical across -count=3; 8b467e1 EXIT 1, no quorum at any round, 9 of 11 seats pinned at r0 while 2 climb to r2; c4da469 with the arming rule ablated (diffed against the original before the run) EXIT 1 with the same signature. The stall is NOT reachable at HEAD — the fix holds. Freeze-manifest item 15's leg (i) is discharged; the graded field run is what remains.

Freeze-manifest item 14 is booked SETTLED-GREEN from the artifact, and item 15's two contradicting closers are named and ordered (2026-09-11; record only — no behaviour, no format, no validity change). (1) Item 14 R-CARRIER-MODELCHECK — SETTLED-GREEN at c4da469. The six carrier-seating model-checks were run INDIVIDUALLY, not as one package sweep, and each was confirmed to have executed by its own === RUN line rather than by the exit code — go test -run exits 0 on a name that does not exist, so an exit code alone would book GREEN on a deleted test. 6/6 EXIT 0: core/chain TestModelCheck_CarrierSeating_AgreementOverCarrierVariation, …_ScreenReadsTheParentPostState, …_EraSeamV4ParentV5Child, …_SetupIsNonUniform, and core/node TestModelCheck_CarrierAgreement_HonestReplicasSeatTheSameSet, …_ControlADivergentScreenFallsBehind. The RED side is measured, not assumed: two ablations of the product reducer in an isolated tree, each diffed against its original before the run, drove the set RED as predicted. One coverage limit is recorded as a scope fact rather than buried — oracleSeats calls the same parent.attesterQualified(id) the replica path calls, so the differential is independent on the reducer but not on that screen predicate. (2) Item 15 R-H43-ROUND-LADDER-DESYNC had TWO closers in one file, naming two different tiers. The Lane-D2 row gave the closer as running the model-check; the register row gave it as the next graded field run. docs/build-process.md's consensus-correctness discipline makes those SEQUENTIAL rather than alternative — a field run confirms a model-check, it never discovers one — so both rows now carry the same ordering, and both say plainly that they disagreed. The record does not silently pick one.

Three decayed reason strings are re-derived against source, and a new gate makes a reason string that names a symbol resolve to that symbol (2026-09-11; record and gates only — no behaviour, no format, no validity change). (1) stateClass["tokenQuorum"] said "set by SetTokenQuorum" (core/chain/modelcheck_state_completeness_test.go). That symbol exists nowhere in the repo and never did — the sole hit in the tree was the sentence itself. The setter is RequireTokens (core/chain/chain.go). Every reason string in that table was re-derived, not sampled: all 22 other named symbols resolve, and four more claims were wrong — trustFloorOverride cited chain.go:3120 (revlog leaf bytes) and retention.go:136 (a doc comment) when the real sites are Reconcile's pin and trustFloor's read; the adopt failure text cited chain.go:3172 when adopt is at :4733; revLog cited translog.go:54/:106 when the symbols are translog.Log.Root / translog.MTH; and epochStart's "its only reader is Regime" was falsified by the very promotion the same sentence describes (the commitment path reads it too). The load-bearing half of that last one — no quorum or validity predicate reads it — was re-verified and HOLDS. (2) The injected class doc asserted its members are "identical on every replica by configuration". That premise is false for three of its five members and unconditionally true for none. rep is local and divergent by design, and said so in its own row. cfg is MIXED: 16 of the 21 chain.Config fields are genesis-covered via ConsensusParams, five are per-node by ratified design, and WSCheckpoint must differ per node. issuerKey is wired to (node.Node).IssuerKeyOf, which answers from the peer-populated peerIssuerKeys cache that ValidateEntry reads on the block-validity path — recorded, NOT fixed; that divergence is research-gated and owner-ratified work and this change does not touch what any node accepts. The class now claims only what it can deliver: injected means injected, and a uniformity claim belongs on the row with its mechanism named. (3) WSCheckpoint's "it narrows what THIS node accepts; it must never widen it" is MEASURED FALSE. Driven against the real predicate: unset leaves trustFloor at 0 and validateBondRegs refuses a heavy-proofs-shed block at height 50 with ErrPrunedAboveHorizon; a checkpoint at height 100 raises the floor to 100 and the same block is ACCEPTED. It widens, and the widening is the mechanism — trusting pruned history below your own anchor is what the anchor is for. The exclusion is unchanged and was never resting on that clause: it must vary per node because a checkpoint every operator took from the same place is not an independent anchor, and a shared pin would let one party widen every node at once. Now covered by a driven test (TestWSCheckpointWidensThePrunedTrustFloor, ablations W0–W4 by exit code) instead of prose. readIn stays nil deliberately — no regime drives a proofs-shed block, so the field is honestly UNPROVEN there, and naming a regime to move it out of UNPROVEN is the dead-probe failure. (4) Two record contradictions in the config-gate area are closed. The gate printed UNBOUND consensus-critical (3): [Anchors MinBond MinBondBytes] for three fields genesis-covered since owner call F, and configDecls[].binding said "NOTHING BINDS IT" while configMemberships[].carriedAs named a real ConsensusParams member in the same file. Both cannot be true; the membership table was right. Every carried consensus-critical row now names the genesis bind and its hole* (a pre-bind genesis carries nil Params), so R-CONSENSUS-CONFIG-UNBOUND stays open for the reason that is actually open. The unbound-detection mechanism is unchanged and still reports a NEW unbound field the moment one appears. (5) THE STRUCTURAL PIECE — TestStateClassReasonSymbolsResolve. The failure class is prose that describes code, drifts, and stays green because nothing reads it; scripts/check_cited_tests.py already enforces it for test citations in prose FILES, but these reasons are Go string literals in a _test.go and no lint could see them. The gate parses the package's own non-test sources with go/ast and resolves every backticked token in a stateClass reason against what those sources DECLARE — not a grep, because a grep for a stale symbol matches the sentence that invented it. Scope is deliberately narrow so it stays green permanently: backticked bare identifiers, in one table, against package chain; prose is never checked and a package-qualified name is a stated false-red that fails loudly with its own message. It is not cross-bound to configDecls — that table's justifications are not yet fully re-derived, and gating on un-re-derived prose launders a stale claim into a merge blocker. Ablations A0–A4 by exit code, every patched file diffed against its pristine copy before either run was believed.

Manifest item 8 (R-CARRIER-BYTES) is DECLINED for the RC and disclosed, and the bonded arm of the prepare-QC flood becomes a register row (D-CARRIER-BYTES-DECLINED-2026-09-11, owner-ratified; bookkeeping only — no behaviour and no format changes). (1) R-CARRIER-BYTES — declined, not deferred. Owner call 3 of the freeze-manifest re-audit is answered: the per-block ceiling on Block.LastCommit is not built before the RC, the exposure rides into the B8 engagement as manifest item 22, and the register row stays open because the rule is still wanted at the stamp raise. What is accepted: validateCarrier (core/chain/carrier.go) enforces phase, verifyAtt over b.Prev and per-id distinctness and has no count cap, no byte cap and no qualification screen — verified at HEAD — so a LastCommit may carry any number of entries the transport frame allows (~1.3M in 132 MiB), each costing one ed25519.Verify on every replica that validates or reloads the block, permanently, because the field sits in both bodyHash preimage literals (read and confirmed: each unsigned literal names LastCommit; neither names Atts). Declined because the value turns on a pony-class honest-maximum measurement that does not exist, and a cap below the honest floor is a publish-path liveness wedge — worse than no cap. It costs no era: a narrowing validity rule, outside the four doors, so its deadline is the stamp raise. Written as declined rather than deferred because the item was deleted twice on wrong grounds and a third disappearance was the live risk. #824 restored the row, so all six production citations resolve to a destination that exists — checked individually, not sampled. Two text-only residues are recorded and deliberately not repaired here: three citations name "Boulder 1 carry-list" while the row is homed to Lane D2, and ErrWitnessBudgetExceeded says the ceiling "is not built yet", a future tense this decline falsifies. (2) R-CARRIER-QC-BURST-VALUE — a new row for the arm #823 left open. #823 closed the MsgPrepareQC flood for an unbonded sender; a sender already in the governing set passes that screen, so a bonded validator can still flood. The obvious statement of the failure mode is FALSE and the row says so: the attacker does not replay its own bonded signature. (Chain).collectQuorumSigs sets seen[id] at the bottom of its loop, after the qualification test, so the if seen[id] short-circuit fires only for ids that already qualified — repeats of a qualified id are deduplicated before verifyAtt and buy exactly ONE verify, while repeats of an unqualified id are never deduplicated and each pays a full verifyAtt. The bond buys passage through the screen, not the payload; the flood entries are signed by an identity in no governing set, costing one offline ed25519.Sign and no bond. Driven by core/node TestQC_BurstValue_DedupIsAsymmetricAcrossQualification (a corrupt entry placed last, so ErrBadSignature is a positive observation that the loop walked to it) and TestQC_BurstValue_TheSenderScreenAdmitsAQualifiedFlooder; moving seen[id] = true above the qualification test reddens the first, verified by ablation with the patched file diffed against its original before the run. What fires first, checked rather than assumed: the sign-mark watermark (Node).signAllowedAt runs after VerifyPrepareQC, so it does not protect — the CPU is spent before any watermark is consulted. Cost to the attacker: one bond and nothing else — the refusal is a ports.MsgPrecommitReply OK=false that only gets logged, nothing is slashable, and a padded list is not equivocation. No new prefix: R-CARRIER-QC-LEGACY-UNCAPPED gets no row, being already disclosed in docs/design/m0.md §10.1 with no closer. Register 33 → 34.

The MsgPrepareQC arm served an unbonded stranger a validator's full signature-verification budget — the sender screen and the producer screen close it (R-CARRIER-ATTS-PREPAREQC steps 0 and 1, research verdict GATED, owner-ratified). (Node).handleChain's ports.MsgPrepareQC arm passed the sender's env.QC from cbor.Unmarshal straight into (Chain).VerifyPrepareQC → (Chain).collectQuorumSigs, one ed25519.Verify per entry, with no length check, no sender screen and no rate gate between them. collectQuorumSigs sets seen[id] only for QUALIFIED ids, so byte-identical entries are never deduplicated: one offline ed25519.Sign over a block the attacker chooses itself, replayed to the CBOR decoder's 131,072-element ceiling, bought 131,072 verifications — 4.19–6.89 s of one core for 13.1 MiB of wire, ~3.8–6.3 cores at 100 Mbit/s, from any peer, at line rate, with no bond, no keypair farm and nothing persisted. Step 0, the sender screen: n.chain.Objective && !n.chain.AttesterEligibleAt(from, n.roundsFor.Height) refuses before the decode — a map lookup — reducing the attacker set from any peer to a bonded, slashable validator. It is the predicate (Node).broadcastRoundCert already applies on the send side and the same screen-first shape as G-H43-12 on the MsgRoundCert arm. It refuses nothing honest: an honest prepare-QC comes from the block's author, who already passed this receiver's stronger proposerQualifiedAt test at the prepare phase, and on a forced re-proposal the sender is the round's designee, drawn from EligibleProposers by construction. The refusal is free to the sender — checked before wiring it, because the PE ruling on MsgChallenge found the analogous screen there would defund honest holders: ports.MsgPrecommitReply{OK:false} is consumed only by gatherPrecommits's case !resp.OK: arm, which logs, and credit.RecordAudit has exactly one non-test caller (por.go's gradeAnswers); no standing, credit or reputation moves. Step 1, the producer screen: (Node).gatherTwoPhase now filters its solicitation set through AttesterEligibleAt(v, b.Height). One commit discharges G-QC-1 and R-CB-ATTS-UNBOUNDED's G-ATTS-1 — the same defect one closure apart. On the client-publish path attesters was chainhost.Host.Attesters, the -attesters flag UNFILTERED, and every peer in it replies (the MsgProposeBlock arm attests for anyone whose block passes ValidateProposal, with no test of the replier's own qualification), so the shipped honest maximum for len(env.QC) was 2 + |-attesters| — a consensus-adjacent quantity that is a function of LOCAL CONFIG, not of the chain (the #380 class, canon rule 8), which blocked any bound over committed quantities. Honest-safety is an identity, not an estimate: the predicate, the height and the node are the same ones the gather's own stop condition uses, so a peer removed here could never have moved supportMet. RED FIRST, driven: G-QC-0 saw an identity with no anchor seat and no bond spend a validator's whole verify budget and adopt the lock; G-QC-1 saw a prepare-QC of 9 entries against a ceiling of 6 (3 after). Three ablations, each diff-verified before the run: an over-broad screen reds G-QC-0's control arm, G-QC-1 and G-QC-4; disabling the producer screen restores the 9; removing the Objective guard reds the legacy probe alone. (Chain).GoverningSetCap's doc is repaired in the same commit — it asserted "every round path gates on Objective" and "no round machinery runs there", both FALSE (gatherTwoPhase has no Objective guard and proposeBlock stamps BlockVersionRounds unconditionally), which is exactly why both screens need a guard they would not otherwise need. GoverningSetCap is 0 in a trusted/demo posture; neither screen reads it — they read the predicate the cap is an upper bound of — and R-CARRIER-QC-LEGACY-UNCAPPED is now a driven probe rather than a sentence (simplicity rule 7). TWO CORRECTIONS TO THE CERTIFICATION, driven not argued. (1) The +2's derivation names the wrong two entries: it says the gatherer's own prepare and the carried author self-prepare are both proposer-skipped, but on a forced re-proposal the gatherer is not the author, so its seed IS counted; the two actually exempt are the carried author self-prepare and the live author's own reply. The count is still ≤ 2 (carried lifts at most one, break on first match; the author answers at most one solicitation), so +2 stands — and G-QC-2 now asserts the exempt count, which is what the bound is made of. (2) §4.1's "1 + 1 + 3 = 5 > 4" over-counts: driven, the 4-anchor launch network produces 4, exactly GoverningSetCap, because finishPrep closes on the first reply satisfying supportMet. The raw cap has zero slack rather than being one short — sharper, same conclusion. NOT A FORMAT ITEM: wire admission and a producer screen, no block field, no cbor key, no committed leaf, no validity rule. DELIBERATELY NOT SHIPPED: the paired allowWindowed rate budget, because its burst is a security parameter the same certification marks UNSETTLED (R-CARRIER-QC-BURST-VALUE / G-QC-6, owner: tester, closer: a measured cadence probe) and roundCertBurst's derivation provably does not transfer — ProposeEntry has no in-flight latch, so one publisher legitimately emits many prepare-QCs per window. A bonded validator can therefore still flood; the unbonded flood is closed. Also owed and named: the cap inside VerifyPrepareQC plus adoptLock normalization (step 2, ≥ one deployment window after step 1, §8), G-QC-2's refuse arm, G-QC-3, and G-QC-5 / R-CARRIER-QC-NESTED-ROUNDCHANGE, which the certification routes AHEAD of the cap. Deliberation: docs/thinking/2026-09-11-prepareqc-sender-and-producer-screens.md.

The keyless encryption-mode oracle is CLOSED — manifest.secretsPlainLen pads the inner secrets box, and the two other remedies on the table are DECLINED on the record (D-MODE-ORACLE-2026-09-11, owner-ratified in full on the research certification 2026-09-11-privacy-property-measured-part0-corner-entry-filesize-and-mode-oracle-cert, which routed from the R-SUBFRAME-SIZE-ORACLE red-team pass; threat-catalog F8, new). manifest.secretsPart.Mode sits in the inner secrets box precisely so a care-link holder cannot read it — but secretsPart carried 34 bytes of ChunkSecrets per data chunk in convergent mode against one flat 34-byte FileKey in private mode, crypto.SealBox expands by a constant 16-byte tag, and ManifestFrameSize frames a single-chunk manifest at its TRUE length, so the frame length published the sealed field: 341 B private against 345 B convergent at FileSize = 1, widening 34 B per data chunk to 898 vs 621 at 2 MiB. A peer with no keys, no care link, no bond and no token read Entry.ManifestChunks off the unauthenticated MsgGetChain, fetched that one chunk over the unauthenticated MsgFetchChunk, and recovered the publisher's own secret/not-secret classification of every root on the chain. No disclosure covered it. It is not a size leak and not a traffic observation — it is a sealed field read by an unauthenticated stranger, and by cmd/silt/main.go's own framing (private is the default, convergent carries a loud warning) that field is the publisher's statement about whether the content needed protecting. The fix: the secrets plaintext is zero-padded to a length that is a function of the public data-shard count alone before sealing. The zeros ride inside the AEAD, so they are authenticated rather than malleable, and OpenFull refuses a trailer that is not zero-filled, so one manifest still has exactly one sealed encoding. Settled corner, named per simplicity rule 1: length-hiding authenticated encryption (Paterson–Ristenpart–Shrimpton, ASIACRYPT 2011), in the shape TLS 1.3 deploys it (RFC 8446 §5.4). Cost ≈0.013 % of object bytes — a 2 MiB private object's manifest goes 621 → 902 B. secretsPlainLen(nChunks int) int takes the public count and nothing else, and that signature IS the structure: it cannot be made to read Mode, FileKey or ChunkSecrets without changing it, so the edit that would reintroduce the oracle cannot be a quiet one. RED FIRST, which is the certification's own gate condition: TestRT_SFO_1_ModeIsNotRecoverableFromManifestFrameLength was seen failing on the pre-fix tree with "At FileSize=1 the manifest frames at convergent=345 private=341 (delta 4)". #817's defect PIN is retired and converted to the straight assertion, exactly as the pin's own failure text instructed — the fix turned it RED, which is the pin working as designed; its teeth are kept, re-pointed at the new predicate, and now hard-code the pre-fix 345/341 so the demonstrated RED survives the fix permanently, with a ONE-BYTE arm because a classifier needs one bit and a gate with slack does not hold the property. The geometry pin is INVERTED (it used to assert the length sets stay disjoint across a seven-point (k,n) grid, which is what made the oracle survive an unknown -erasure; it now asserts they collide pointwise, which is strictly stronger than set equality). The framing ablation is KEPT and re-titled, because it records the weaker remedy AS weaker. core/manifest adds the care-link holder's vantage (TestSealedSecretsLengthIsModeIndependent — the frame remedy never reached it), the driven bound on the arithmetic (TestSecretsPlainLenBoundsEveryEncoding, sweeping every canonical-CBOR width boundary), and the canonicality refusal. Ablation run and reverted: deriving the pad target from len(m.ChunkSecrets) — a secret — instead of len(m.Chunks) reddens both packages' gates at a one-byte separation. TWO THINGS THAT DO NOT FIX THIS, recorded so they are not re-proposed: removing or moving the Mode field (Validate already makes ChunkSecrets/FileKey the real discriminator, so it takes 3 of the 4 delta bytes at one chunk and zero of the 34·(chunks−1) that dominate at scale) and re-padding the manifest FRAME (it lifts the oracle only while both modes fit one frame — beyond that len(Entry.ManifestChunks) separates them on-chain with no fetch at all). THE GENESIS HASH MOVES, AND IT IS NOT A FORMAT CHANGE — paramless e44344ea…72c0 → fdfb676c…eb58, params-carrying b862f16b…3b57 → af49c742…95c8. The root does not move (31768fb4…7dd1), because the padding is inside the manifest blob and the root does not cover it. No block field, no cbor key, no committed leaf, no validity rule: a genesis re-mint and a format change are different quantities with different prices, and this is the first. Era 4 is open, there is no live network and the freeze is at the RC, so this is a second, deliberate re-seed after M1 — the graded re-run set is paid twice, knowingly, for the one finding outside every existing disclosure. THE DECLINED REMEDIES, ratified as declined: a FileSize ladder (no settled corner — BitTorrent publishes length, IPFS UnixFS publishes filesize — so it is novel under simplicity rule 1, and it is outside M0 because T-DONT3 does not fire: the field describes the OBJECT, not a fetch; correction of record from the certification, bucketing the value is a validity rule and only dropping the field moves preimage bytes — two quantities, two prices) and re-padding the data frame (declined priced, not on principle: it reverts a measured 250× storage win, 1,048 B → 262,160 B per shard on a 1 KB object, to close a noisy channel against a vantage the tenets already disclaim).

Three published privacy sentences were REFUTED as text and are replaced; correcting them is NOT recorded as a mitigation (same certification). docs/threat-catalog.md F3(a) claimed "before, padding blurred it to 'somewhere in one chunk'" — false: a holder persists StorageProof.Root with the chunk and a caretaker holds the root by construction, so both read the exact size off ports.Entry.FileSize regardless of framing. What R-SHORT-FINAL-STRIPE did change is narrower and real — a sub-frame object's stored shard is now L + 24 instead of chunkSize + 16, which makes the length legible to a party measuring byte counts without the root, such as a splicing relay; for that observer the chain's exact-length column is the lookup table, not a duplicate. The disclosure defect that mattered: the old text named anonymity-set size as the bound and never said the set is routinely ONE. A bound with no floor reads to a user as a promise of some set. The replacement cites the STRUCTURAL bound, not the corpus number: an exact int64 over L ∈ [1, 262135] partitions the sub-frame class into ≈18 bits, giving 99.3 % expected singletons at n = 1,779 under uniformity; the measured 79.6 % is lower because real lengths cluster, and its population is now NAMED — a software repository's length distribution, not a publish population, and therefore a friendlier corpus than uniform. docs/math/02-convergent-encryption.md's "no confirmation surface" is corrected to the honest scope: -mode private defeats confirmation-of-content, does not deliver unobservability, and silt claims it nowhere. NO TENET EDIT — docs/TENETS.md immutable #4 and D-PRIV survive these measurements intact and are, in the certification's words, among the few sentences in this area that are exactly right; a documentation correction does not become a tenet amendment.

TestMeasure_501_SweepDurationUnderDeadHolders's decay bound tested its sampling, not its claim (found by this change, corrected here). Bound 2 drove six 35s-gap sweeps and asserted indices 4 and 5 each cost ≤ 10 s, under a comment claiming the re-discovery tax "must go quiet within a few rounds and STAY quiet". Those are not the same statement: the loud/quiet PHASE is set by which nodes hold which shards, and the placement key moves whenever an object's chunk IDs move — which the padding above does. Driving the unchanged pre-fix tree to 18 rounds puts the loud sweeps at indices 2 and 8, so the old window closed two rounds before the second one and its green was the sampling. The bound now drives 18 rounds and asserts the two things the comment claims: the last six consecutive rounds are quiet, and the loud count in the second half is strictly below the first half — a decay statement that does not depend on where the cycle's phase lands. Verified green on both trees. The decay itself is real and unchanged: the quiet runs double, 1 → 3 → 7 on the padded tree and 2 → 5 → 9+ on the unpadded one.

Two era-4 gates demanded opposite verdicts on identical bytes, and the one that won was slashing the honest (certification §1.7, previously derived from source and marked UNSETTLED pending execution — executed, and it is real). AttPhase returns the step unchanged for a sub-era-4 block, so AttestAt never reads the chain id: the era-2-form precommit is bit-identical under two different chain ids, driven. G-PRE-7's fourth subtest demanded CONVICT on a mixed-form pair containing exactly such a leg, titled "a v2-form and a v5-form signature at ONE slot DO convict" and calling the refusal an "ACCOUNTABILITY REGRESSION" — so it required an I5 violation as correct behaviour, and the reachable instance of that verdict is an attacker pairing a leg harvested from network Y with the victim's honest precommit on network X. One honest act on each network; a conviction and permanent eviction on one of them. The #397 shape, where the penalty hits the honest. The rule is NOT changed here — the closer is the era-floor evidence refusal at validateSlashes, FindEquivocations and slashEquivocators in one commit, which is a consensus-rule change and research-gated. Subtest 4 is re-authored instead: it drives the chain-blindness, records the open face with a trip that goes RED the day the floor lands, and machine-checks its scope by reading (*Chain).MintVersion off a separately-built chain rather than off its own subject. G-PRE-6's pre-era-4 arm gains the same floor witness and stops calling itself "the ablation" — it is a LIVE residual, not a re-enacted one, and it now proves the height it claims to describe is in the interval it claims. Eight ablations, one of which found the first version of the chain-blindness assertion vacuous (it could be ablated into a self-comparison and stayed green); the fixed version derives both legs from a scope list asserted distinct. A simpler closure — dropping canonicalStep from consensusSigScopes, which is strictly narrowing — was considered, declined as a second mechanism competing with the certified one, and surfaced to the planner rather than taken.

Three repo lints no longer walk into other checkouts of this repo (scar:lint-walks-into-another-checkout-2026-09-11). check_short_dark_tests.py, check_source_gates.py and check_conflict_markers.py walked from the repo root with rglob, so on a machine that keeps agent worktrees under .claude/worktrees/ they judged a dozen other branches' files against this branch's workflows and allowlists. Measured on a clean main with twelve worktrees live: check_short_dark_tests.py exited 1 with 610 problems, 610 of 610 from worktrees and zero from this tree; check_source_gates.py exited 1 with 3 problems, all 3 from worktrees; check_conflict_markers.py scanned 19,016 files to reach the 1,814 that are actually ours. A CI checkout has no worktrees, so all three stayed green in CI and the whole cost was local — and a lint that reports 610 false problems is a lint nobody runs, which is the "a green nobody can read is not a gate" shape these lints exist to prevent, pointed at themselves. The three now share scripts/repo_walk.py, which prunes any directory below the root that carries a .git entry — a file for a worktree, a directory for a nested clone. The rule is the marker git writes, not the path this harness happens to use, so a checkout dropped anywhere is excluded and the next lint written cannot reopen the hole by forgetting one directory name. After: all three exit 0, and a violation planted in the real tree is still caught by each (1, 3 and 2 findings respectively) while the same violation inside a nested checkout is ignored. Because CI can never observe the defect, repo_walk.py --self-test manufactures a nested worktree, a nested clone and a .git-less lookalike in a temp directory and asserts both directions, including that an own file is still yielded; it runs as its own CI step.

nightly-netem had never once worked — red on its first cron run and 19 of its first 21 — because it mounted the host module cache :ro over the container's writable /go/pkg/mod, and then reported the resulting compile failure as "a property did NOT hold" (scar:scheduled-workflow-never-observed-green-2026-09-11). Driven both ways locally: an empty :ro cache gives 72 read-only file system errors, FAIL github.com/nerolabs/silt/e2e [setup failed], exit 1 — the CI signature exactly; dropping :ro on the same cache dir gives 0 errors and exit 0. Thirteen nights of a package that failed to COMPILE, with zero drills run, read as a durability finding. integration/adversarial/netem-run.sh now separates setup (exit 4), harness (3) and unearned-verdict (5) from a real property verdict, and refuses to certify a go test exit 0 that ran fewer than all named drills; the scheduled matrix gains the loss and reorder arms build-immutable #5 names but that never ran; and scripts/check_scheduled_workflow_proof.py refuses a changed scheduled workflow whose green workflow_dispatch run cannot be verified through the GitHub API.

Five asserting tests were running in NO CI job, and a lint now stops a sixth from going dark (scar:short-run-is-zero-execution-2026-09-10, count 2). Every go test invocation in .github/workflows/ci.yml passed -short except the two that run ./e2e. Fifteen-odd tests t.Skip under -short, and go test reports a skip as a pass — so the required job went green having executed none of them. Driven with the required job's exact shape: --- SKIP: TestSlashesBytesCapWorstCaseCost, --- SKIP: TestReconcileMemoryBounded_563, PASS, SHORT_EXIT=0. A green check containing zero execution. Instance 1 of this scar was a seat choosing -short by hand and recorded the owed gate — "CI must fail any artifact whose only suite evidence is a -short run" — which was never encoded; instance 2 is the workflow itself, so it recurred on every push. The five that assert now run unshortened in the required Go — vet, fmt, test job, by name and with a no---- SKIP assertion (the idiom the two R2.9a anchor steps already use, because a -run filter matching nothing still exits 0): TestRNestGate_SelfArmorMeasurement (the nested-evidence fixed point), TestReconcileMemoryBounded_563 (the #563 field-confirmed OOM budget), TestSlashesBytesCapWorstCaseCost (the derivation witness for the frozen SlashesBytesCap), TestGateC3_1_ServeGiniHonestNullIsMixDependentNotSampleSizeDependent, and TestReconstructMemoryFootprint_SimVsProd. Measured cost 36.9 s of test time on a throttled 2-core box, dominated by the nest-gate harness at 29.8 s. Not the race job: TestReconcileMemoryBounded_563 self-skips under -race too. And scripts/check_short_dark_tests.py closes the general case, so a seventh test cannot go dark silently. The naive predicate — "is the name mentioned in a workflow?" — reports 51 and is wrong: the whole e2e package self-skips and is named nowhere, because the e2e job runs it by package without -short. The unit is the INVOCATION: a test is dark iff it self-skips and every merge-gating go test covering its package passes -short. That gives 13 on the tree before this change, 8 after. Two scoping calls are load-bearing and stated in the script: release.yml runs go test ./... unshortened but triggers on a version TAG, so it cannot gate a PR and does not count; and step name: lines are labels, not commands — - name: go test ./e2e would otherwise have granted false coverage, which is this same defect one level up. The eight remaining are baselined with written reasons in scripts/short_dark_tests_allowlist.txt; an unreasoned row FAILS, a row naming a cover test that does not exist or is itself dark FAILS, and a row for a test that is no longer dark FAILS as stale.

SlashesBytesCap keeps its value and loses its route: a configuration can no longer defeat slash evidence (D-SLASHCAP-ROUTE; owner call 2026-09-09, "CLOSE THE ROUTE. Not a re-ratification."; gates G-SLASHCAP-1..4). The constant is unchanged at 16 MiB. What changed is that its derivation is now true by CONSTRUCTION. The cap is a consensus validity rule every validator enforces (core/chain/validate_v5_predicates.go), and its invariant cap ≥ 2 × (honest block) + overhead was computed from the DEFAULTS of -max-bondreg-bytes-per-block and -max-entry-bytes-per-block — two flags that are proposer-side only (every non-test read is core/node/chainrole.go foldPendingBondRegs and core/node/entrypool.go foldPendingEntries) and whose help documented 0 = unbounded. Nothing held the running configuration to the derivation, so an operator could raise its own bond-reg budget past ~7.9 MiB and thereby make its OWN equivocation unprovable: an evidence proof carries two FULL block bodies since F2-EVIDENCE-RECOMPUTE, so the pair exceeds the cap, the cap rejects it before CheckEquivocation ever runs, and the double-signer keeps its seat. Slashing defeated by making the evidence too big; accountability is a Part-0 corner. core/node.CheckSlashEvidenceHeadroom now expresses the invariant on the values IN FORCE and cmd/silt refuses to start on a violation, naming the rule, the flag, the admissible ceiling and what is lost. 0 and negative budgets are refused rather than clamped (the proposer's guard is budget > 0, so both read as unbounded), because clamping would silently re-interpret an explicit operator request. Nothing in-tree set either flag, so no topology changes. CORRECTED BEFORE MERGE by the blind PE review of this very change: the first draft of this entry and of the code comment claimed the derivation was now "bound by construction". It is not, and it cannot be. Equivocation carries two FULL Blocks and a Block carries its own Slashes, bounded only by the cap being defended, so cap ≥ 2 × body + overhead has no positive solution at any cap — a fixed point, not a tuning error. Measured on signature-valid fixtures at the SHIPPED defaults, with no coalition and no misconfiguration: a block committing two ordinary 4.14 MiB proofs is valid, and a LEGITIMATE proof about that block is 17,373,935 B, 596 KB over cap. So the cap has a THIRD face, R-NESTED-EVIDENCE-OVERCAP, and it is the only one reachable on the honest path. What this change buys, stated exactly: it closes the OPERATOR MISCONFIGURATION route and makes the configurable half of the derivation true instead of assumed — necessary, not sufficient. The close for the rest is research-gated and in flight. The owner's framing remains the durable lesson: this is the #380 class — a consensus quantity that is a function of LOCAL CONFIG rather than of the chain, the second instance inside one week after RequiredQuorum returned the local cfg.Quorum — "two instances of one class isn't a coincidence, it's an unguarded seam." Timing: a VALIDITY rule (freeze manifest item 10), so the deadline was the stamp raise rather than the freeze, and not deferrable past it, because RAISING a cap later is a WIDENING rule change and sits outside the narrowing exemption. Scope, so it is not over-read: this closes the CONFIGURATION route only. The cap's disclosed second face — a ≥⅓ coalition making every evidence pair over-cap with its own valid renewals — is untouched and no admissible cap value closes it; only the v5 two-level block hash (d-3) removes it. The single-reg overflow (core/node/chainrole.go embeds the first fresh reg unconditionally, and silt has no per-reg byte cap) is FILED as R-BONDREG-SINGLE-OVERSIZE rather than folded in — it needs a validity rule of its own.

Consensus — the local -quorum floor is out of the objective-mode validity rule (#380 direction (1), Lane A2; I1, ratified D-CONSENSUS-ARMING (20); research certification CONSENSUS-380-quorum-floor-direction-1-PREDICATE-AND-CERTIFICATION-2026-09-08.md). Chain.RequiredQuorum is now DERIVED in objective mode with Byzantine sizing: bftThreshold(N) in the launch window / epochs-off (the max with Config.Quorum is gone), and 0 in a mature epoch (the >⅔ frozen-weight rule is the whole bar, B2); the trusted opt-out (-byzantine-quorum=false) and legacy regimes read Config.Quorum unchanged. Config.Quorum survives as the proposer-side gather target only. Closes the #338 sync-strand (a node with a raised local floor refused the swarm's honestly-committed blocks forever) and the dead new-view round of a higher-floor designee (R-380-LIVENESS-FACE). Same commit, per the certification's merge conditions: validateStructural's Reload count leg tracks RequiredQuorum so a replay accepts what the commit path accepted (M-380-1); newViewFor refuses an EMPTY round-change set so floor 0 never validates a zero-envelope certificate (M-380-2); the v5 mirror v5RequiredQuorum returns the node's value per regime and RequiredQuorum is pinned by G-D13 through a compositionHelpers row (M-380-3); the v4/v5 parity oracle gains the mature-epoch whale regime. Gates: G-H43-8 arms 8a–8e (core/node/bondreg_drain338_test.go, core/node/modelcheck_h43_8_quorum_floor_test.go, core/chain/quorum_floor_380_gate_test.go, core/node/modelcheck_h43_8e_gather_control_test.go) and core/node/newview_empty_380_test.go, all RED-first. The proposer-side gather target is path-independent: gatherTwoPhase — the one choke point all four proposal paths share (client publish, the bond-reg drain, the h43 new-view re-proposal's fresh leg AND its forced leg, the re-proposal of a locked value) — raises the gather target to max(Config.Quorum, RequiredQuorum) (PE ruling C1; research certification §6.12 G-380-A for the forced leg, which never reached the earlier proposeBlockAt raise; arm 8e drives all four). Rollout order: upgrade FIRST. The change only ADDS accepts, so an upgraded node accepts every block a trailing node produces; a trailing node with -quorum above bftThreshold(N) still validates at the old max(Quorum, bft) and would refuse a block gathered below it — hence the gather target keeps Config.Quorum, and mixed fleets must keep -quorum uniform until every node is upgraded. Owner's call, unchanged here: the shipped default -quorum 3 caps a default 4-validator swarm's gather at f = 0 (certification §4.5).

The paid-serial guard's durable record carries its LANE (R-GUARD-RESTORE-LANE-UNKNOWN). The guard holds two populations on one map — delivery anchors and relay anchors — and the on-disk record carried neither, so LoadPaidSerials rebuilt every restored entry as a delivery entry: LivePaidSerialsByLane and RestoredGuardEntries conflated the two after every restart (measured by the blind PE, 2026-09-07: lanes (2, 1) before a restart, (3, 0) after). ports.PaidSerial gains a Relay flag, adapters/guardstore bumps its on-disk format to version 2 (an 8-byte magic + version header, a 74-byte record with the lane byte last), and RestoredGuardEntries now counts DELIVERY-lane entries only — the honest upper bound on deposits a restart lost, since a relay anchor keeps its burn and never had a deposit. Compatibility — read this before clearing a guard file. A store written by a pre-bump build that holds at least one record is a refuse-to-start error (guardstore.ErrLegacyFormat) naming the file, not a silent migration: a version-1 record has no lane, and the only guess available is the very mis-count this closes. A 0-byte pre-bump file (a node that armed a paid lane and never paid) is upgraded in place, not refused — it holds no record, so there is nothing to mis-frame. The daemon opens this adapter on two files, and their remedies are opposite:

• <store>/paidserials.log — stop the daemon, remove the file, restart. Through the RC the credit ledger is ephemeral (D-FP2-SCOPE): balances reset at the same restart, so the guard protects payouts whose credits no longer exist and clearing it costs nothing.
• <store>/creditspent.log — do NOT clear this file on its own. The publish issuer key persists, so every credit it signed stays spendable and an empty guard re-opens each held credit for a second spend. Rotate the publish key AND clear creditspent.log together, in one stop (R-CREDITSPENT-UNBOUNDED, owner call 6, D-TRUE-UP-CALLS-2026-09-07). The refusal never rewrites the file, so that remedy stays available. guardstore.ErrLegacyFormat therefore states the condition and names no remedy; cmd/silt attaches the per-file remedy at each open site. Gates: TestRestoredGuardEntriesKeepTheirLane (core/credit, the mixed-population restart), TestRecordCarriesTheLane, TestPreLaneFormatIsRefusedNotSilentlyReframed, TestFreshStoreWritesItsHeader, TestEmptyPreBumpStoreUpgradesButAWrittenOneRefuses (adapters/guardstore), TestGuardStoreRemedyTextIsSafePerStore, TestDaemonPairsEachGuardStoreWithItsOwnRemedy (cmd/silt); seven controlled reverts, seven RED.

Crash-safety — a torn chain.cbor no longer restarts the validator from genesis (#558, Lane B8, scope call S3). chainstore.Save now writes a temp file, fsyncs it, renames it over chain.cbor and fsyncs the directory (the markstore pattern), so a power loss or OOM-kill mid-write cannot leave a truncated store. At boot the daemon replays through chainstore.Recover: a replay that would DISCARD finalized history — a torn file, or a block failing structural verification — REFUSES TO START (exit 3) and names the loss, the kept prefix and the recovery (-ws-checkpoint below the prune horizon); the new -accept-chain-loss flag is the operator's explicit way past, keeping the longest valid prefix and first MOVING the original, untouched, to chain.cbor.rejected-<unix> (a rejected file may be byte-perfect and merely unreadable by this binary — a downgrade, the #572 no-verifier guard — so acceptance never destroys it). Before this the failure was printed and the node continued — from genesis when nothing decoded — and re-entered consensus holding its frozen-epoch seat with a history it did not have (the a434494-deep shape: an INTACT file an era-2 replay bug rejected, restarted at genesis; the replay bug itself was fixed earlier under #558). Gates: RED under the always-accept ablation — adapters/chainstore TestRecoverRefusesATornTail, TestRecoverRefusesACorruptSuffixKeepsPrefixOnlyWhenAccepted and the daemon-level e2e TestDaemonRefusesToStartOnAnUnreplayableChain (exit 3, file untouched); RED under the drop-the-move ablation — TestRecoverAcceptedLossPreservesTheOriginal and TestDaemonAcceptedChainLossPreservesTheOriginal (the preserved copy holds the original bytes). TestSaveLeavesNoTempAndDecodes is a shape pin only; the fsync has no runtime oracle. The two e2e gates skip under -short, and the multi-process e2e CI job is NOT a required check — making it required is an admin action owed (PE re-ruling residual). Blind PE ruling: /Users/andrewedmond/.claude/silt-agent-memory/principal-engineer/reviews/RULING-b8-558-chainstore-refuse-to-start-2026-09-07.md. Note for the owner: the rule refuses on ANY structural-verification failure at replay, not only a torn tail — a strictly larger surface than S3's sentence (kept, per the PE: a stale-prefix restart holding a frozen seat is a safety problem, #560); the reload path is now start-blocking, which matters at the Lane D stamp raise.

statehash.Root refuses an empty leaf value (G-R31-5, owner-ratified 2026-09-06). The SMT library treats an empty update as a delete, so an empty value would have silently dropped its key from the state root. Every committed field encodes non-empty, so no honest root changes. EmptyValueError; gate TestRootRejectsEmptyLeafValue. R3.1 closes as an owned residual.

-grant-deny-floor defaults to an ADVANCE of one publish fee (R2.12, owner-ratified 2026-09-06). The default -1 resolves to the ledger's fee; 0 opts into deny; the sentinel is inert while the faucet is unconfigured. grantDenyFloorOneFee; gate TestR212FaucetFlagsRefuseHalfAndUnsafeConfigurations.

NetGet pulls parity per STRIPE, in deficit order, instead of every parity column of the whole object. One withheld data chunk used to make the fetcher pull all N−K parity columns of the entire file — a 1.6× draw on a single missing shard (R-PARITY-AMPLIFICATION). The fallback is now a deficit walk: per stripe, shards missing = real data shards − present; each parity column is consulted in turn for the stripes still in deficit and the walk stops at the first column that clears them — typically one lookup, and never more parity than the damage (a short final stripe counts its real shards, never K). The dead parityForMissing helper is removed. Not a closure claim: a provider that returns a CORRUPT shard has already transferred the bytes before they are verified, so the 64 GiB grant/r pin's worst case is unchanged. Presence in the deficit is READ-AND-VERIFIED (the disk store's existence check is a stat; its read verifies), so a bit-rotten local shard counts as missing and is routed around — at a measured cost of two reads and three hashes over the data per retrieval instead of one and one (~46 ms per 64 MiB chunk vs 2.5 µs; ~21 s at a 30 GB object), taken for correctness with the pay-on-failure redesign filed as R-PS-PRESENCE-COST. Gates TestPS* (G-PS-1…6, G-PS-8) on the 80 KiB / 4 KiB rig; new counters stats.ParityColumnLookups, stats.ParityShardsPulled. Deliberation: docs/thinking/2026-09-06-parity-fetch-per-stripe.md.

R3.1 — two latent defects on the floor box's state-root fold surface, closed behind gates (2026-09-06; Researcher certification R3.1-SMT-domain-separation-disjoint-preimage-RESEARCH-CERTIFICATION-2026-09-06.md). (1) FoldChangedPaths seeded the SMT library's node store with witness-supplied (Digest, Preimage) delete siblings without checking that the digest is the hash of the preimage; the library dispatches node type on the first byte and trusts the lookup key as the digest, so a forged node cost zero hash work (the audit's Issue #2 arriving on the verify side). Every sibling is now bound by the library's own rule — SHA-256 for leaf/inner preimages, the expansion root for an extension preimage — and the fold stalls with ErrFoldSiblingUnbound otherwise. (2) A proof whose NonMembershipLeafData does not begin with the leaf prefix made the library PANIC in checkPrefix (no recover in core/): a 33-byte remote crash; and — found by the blind PE code review — an empty SiblingData, or a 0x02 SiblingData shorter than 35 bytes, panicked the library's unbounded hashPreimage slicing (a 154-byte crash through IngestBlockWitnesses). Resolve, FoldChangedPaths and IngestBlockWitnesses now refuse exactly the library's panic set before VerifyProof (measured: zero over-refusals). Both defects were latent — the floor box never Accepts yet. New gates: TestR31UnboundDeleteSiblingStallsTheFold, TestR31ForgedExtensionSiblingDoesNotBind, TestR31MalformedLeafPrefixIsRefusedNotPanicked and TestR31MalformedSiblingDataIsRefusedNotPanicked (their controls capture the raw library panics), plus the scope pins TestR31NoSumTrieAndEverySMTUsesSHA256, TestR31SMTModuleIsPinnedToTheCertifiedVersion, TestR31EveryStateHashTagEndsInExactlyOneNUL. Record: docs/design/state-root-domain-separation.md.

The repair-bounty geometry: a shard is a WHOLE ciphertext chunk, so the shipped 64 KiB default pays a base of 2 credits, not zero. The G-R212-7 build stated shard = chunk/k and placed the publish warning's threshold at 262,144 B (it fired 10× too eagerly, and its blind PE filed R-DEFAULT-CHUNK-BOUNTY-ZERO on the same model); the Economist's default-chunk advisory caught it and it is verified at the erasure stage and the judge. credit.MinBountyChunkBytes (262,144) is replaced by MinBountyStripeBytes (the stripe must reach one credit of fetch) and MinBountyChunkBytesFor(k, crypto.Overhead) ≈ 26,199 B at k = 10; silt add / swarm publish warn only below THAT, by the judge's own arithmetic; the judge's fix text derives the same number; crypto.Overhead (the 16-byte tag) is pinned against a real encryption. What the default actually does is a 20 % integer-truncation under-pay (R-BOUNTY-TRUNCATION, exact 2.5006 → 2). Gates TestFormerDefaultChunkPaysZeroAndTheThresholdIsOneShard (this gate shipped under a name asserting the 2 and was renamed with the F1 re-pricing, D-BOUNTY-PRICE-F1-2026-09-12: on the payee-shard basis the 64 KiB former default pays ZERO and MinBountyChunkBytesFor is 262,128 B, not 26,199 — the geometry correction recorded above still holds and only the coefficient basis moved; MinBountyStripeBytes is likewise renamed MinBountyShardBytes at the same value), TestCiphertextOverheadIsTheTag; the G-λ-8 warning gate re-expressed on the real geometry.

R2.9a — the four-residuals review fold-in (blind PE, 2026-09-05): the structural gate is a closed tick set, not a name match; two open gates are put back in the owner block; two stale claims are corrected; G-BB-29 is applied. (1) TestR29aBondChallengeStampsNoFirstTouch matched field names containing firstseen; the reviewer re-added the deleted stamp as bondSeenTick with the identical unset-guarded write and core/credit, the CI anchor step and every other gate stayed green. The gate now asserts the account type's set of tick-typed fields (uint64, ports.Time, ports.Duration) is CLOSED, exactly {firstFetchTick, lastBondTick}, and both are present, so a tick under any name fails with that name in the message (bondSeenTick uint64, bondSeenAt ports.Time and a whitelist drift each RED). (2) ROADMAP item 12 filed G-BB-13′ under "ratified, no longer owed"; it is OPEN for tagged builds and moot only for the default build, and every B_bootstrap run is a tagged run. It is restored as open, and G-BB-12′ (the code, not a handoff note, establishes the reader is the operator) is added as required-before-any-run and UNBUILT: the only host check reads the client-controlled Host header and the token gate covers mutating methods only. (3) The tagged bbootstrap CI job is REQUIRED since 2026-09-05 (the main ruleset's fifth context, added sixteen seconds after PR #736 merged), not advisory as ROADMAP said; it is the only check that sees a flag reintroduced under a non-literal name. (4) core/node/bondaudit.go's +1 said "so the first tick is never 0 (unset)"; the unset guard was the deleted firstSeenTick write (its only consumer since the bond ledger's first commit), and nothing reads a zero lastBondTick specially — the comment now says the +1 serves no reader and stays because moving the tick touches retention. (5) G-BB-29 from the DONT3 certification — the D-BB-BUILD-TAG reason text and core/credit/bbootstrap.go's header narrowed from "recording is the break" to "recording SURPLUS is the break" (T-DONT3 prong (a)), because the generalised rule condemned delivery.go's D-S7 provKey — is applied as an appended correction. Also: a stale "(residual R-BB-BOND-STAMP-TUPLE)" in a core/node failure message now says the residual is closed, and the 134× line names the 64 MiB chunk as the pipeline.go COMMENT's stated floor (the code constant is 64 KiB for the sim).

R2.9a — the F2 gate on the status surface did not close F2: the pooled selfFunding sum and an uncached sibling endpoint republished the withheld counter at the reader's own rate. Both are closed, the ratified snapshot bound is corrected to say which endpoints it covers, and the one-cache/two-views separation gets the gate it never had. A blind principal-engineer review of the branch measured this on two live daemons: the tokened durability.objects[0].funded and the untokened selfFunding.skimIn on /api/economy/self were the same number (skimIn is Σ objects[].funded, and a node caretaking one object — every node from its first published object to its second — has one term); /api/roots named the root unauthenticated; and /api/economy/self recomputed per request, so polling it at 250 ms across one real fetch recovered a 16,388-credit step, 131,104 bytes of a named root, at 330 ms resolution instead of the 5 s the cache was certified to bound. The gate written to prove the leak closed asserted the leaked number was PRESENT: selfFunding.skimIn == 1024 in a one-object fixture whose sibling assertion said 1024 must be withheld, commented "names no root" — false in the presence of /api/roots. The fixes. (1) /api/economy/self is served from the SAME snapshot as /api/status: one document, taken in one loop pass, recomputed at most once per T, invalidated together after a token-gated mutation, carrying the same snapshotTakenAtUnix / snapshotAgeSec / snapshotIntervalSec stamps. Not a second cache (that doubles the recompute a flood can drive) and not a second interval (two documents on different clocks can be diffed against each other). (2) selfFunding. is token-gated with objects[], and the withholding is an ALLOW-LIST: withheldEconomySelf constructs the open document from named fields, the shape withheldDurability already had, so a field added to the SELF document later ships withheld until someone decides otherwise. objectsWithheld becomes detailWithheld — one flag for one rule, the durability block's name. (3) The false gate now asserts the property: selfFunding ABSENT untokened, present with the number tokened. (4) A WHOLE-SURFACE gate walks the real route table — apiRoutes, which serve registers, with an exact GET-route count so a new route fails until it has been examined — and asserts that for a node with one cared object no unauthenticated response on any route carries objects[0].funded under any name: every number in every body is scanned, no field name is grepped, and a positive control first proves the number IS on both tokened documents. (5) The copy at apiStatus gets its gate: the review replaced out.Durability = … with doc.Durability = … and the suite stayed green in both builds while one anonymous GET stripped the operator's own solvency panel for the rest of the interval; the gate reads tokened, untokened, tokened inside one interval on BOTH documents and requires the third read byte-identical to the first. What is open, by decision and not by omission. The node-wide aggregates — durability.balance, stats.BytesServed, revenue. — stay unauthenticated on both documents: the cross-origin observatory (cmd/silt/ui/observatory.html) reads stats.BytesServed with no token by design, and no cross-origin consumer reads selfFunding.* or /api/economy/self at all (the observatory reads /api/status, /api/roots, /api/registry; nothing under -allow-web-origin reads the SELF document; cloudtest and the e2e tier read /api/status with the token), so the gate breaks no dashboard. On a node holding one root those totals are that root's counters (R-BB-SIBLING-AGGREGATES): now rate-bounded to ⌊uptime/T⌋, not closed, and the whole-surface gate logs the 8x and 7x aliases so the residual is measured rather than assumed. Gating them breaks the observatory's bytes-served panel; that trade is the owner's. The ratified text. D-STATUS-SNAPSHOT-INTERVAL claimed ⌊uptime/T⌋ for "an observer" while the sibling was uncached; the entry keeps its ratified text and carries an appended dated correction naming exactly the two endpoints the bound covers, and the same sentence is corrected at cmd/silt/ui.go (statusSnapshotInterval) and in the core/credit/bbootstrap.go disclosure. Gates, each with a controlled-revert ablation recorded RED: TestR29aF2EconomySelfWithholdsPerObjectDetailWithoutAToken (re-pointed), TestR29aF2NoUnauthenticatedResponseOnTheWholeSurfaceCarriesTheWithheldCounter, TestR29aOneCacheTwoViewsAnAnonymousReadDoesNotStripTheOperatorsView, TestR29aEconomySelfIsServedFromTheStatusSnapshot (cmd/silt, untagged, run in both builds), and a live-daemon arm in TestEconomyEndToEndOnLiveDaemon (e2e), the tier the review found it at. TestEconomySelfIsReadOnlyAndLocalExact now makes the untokened request its comment described. Source: /Users/andrewedmond/.claude/silt-agent-memory/principal-engineer/reviews/2026-09-05-RULING-r2.9a-status-surface-cache-stamp-and-f2-gate.md.

R2.9a — four residuals closed: the dead bond-path first-seen stamp is deleted (G-BB-28, R-BB-BOND-STAMP-TUPLE CLOSED), the untagged R2.9a gates are name-anchored in CI, the texts that put grant/r on M0's Sybil corner are corrected (G-BB-22), and the owner-decisions block is trued up. (1) RecordBondChallenge wrote account.firstSeenTick from the wall clock and nothing read it in any build: DecayStale reads lastBondTick, Reputation reads neither, the census reads firstFetchTick. A retained when no decided function needs is SURPLUS under T-DONT3 prong (a) (D-DONT3-READING), so the write and the field are gone; lastBondTick, DecayStale and BondMaxAge are untouched. TestR29aBondChallengeStillStampsFirstSeenTick, whose doc block called the write "something else's mechanism" (there was none), is INVERTED as TestR29aBondChallengeStampsNoFirstTouch and reads the account type by reflection, asserting its set of tick-typed fields (uint64, ports.Time, ports.Duration) is exactly {firstFetchTick, lastBondTick}, so a tick added under any name reddens it (a bondSeenTick and a bondSeenAt ports.Time both measured RED; a when declared as a bare int64 is not seen); new TestR29aRetentionReadsLastBondTickInNanoseconds is the ablation that proves the deletion surgical — lastBondTick still advances, a bond lapses one nanosecond past BondMaxAge = 300 * ports.Second, and a counter-valued tick never lapses, which is why lastBondTick must not be re-denominated. Controlled reverts: restoring the field and write, deleting the lastBondTick write, storing seconds, and disabling DecayStale are each RED. TestR29aBondAuditStampsAWallClockNanosecondNotACounter stays green unchanged (it observes the auditor's tick, not the stored field). (2) The default-build go CI job now asserts eighteen named untagged R2.9a gates PASSED and nothing skipped, the same treatment the tagged job already had: those tests carry the load for keeping the instrument out of a default build, and a rename or deletion was visible to no job (renaming one gate and skipping another each fail the step). (3) core/credit/bbootstrap.go (two sites) and the histogram doc block now in cmd/silt/bbootstrap.go say where a wrong grant/r lands: build-immutable #4 from below, Don't #7 / T-AR / build-immutable #8 from above — never M0's Sybil corner, because the grant mints balance and standing is bond-only (Invariant A). The same claim in ROADMAP item 12 (G-BB-9's "viewers-only ⇒ Sybil-dearer") and two lines of the dated 2026-09-04 PACE record carry dated corrections. (4) ROADMAP owner-decisions item 12 is rewritten to what is open: q and P (W is WITHDRAWN — a pure viewer has no income path, so the decision quantity is the cumulative per-server draw and W is not a parameter of it), the byte-axis bin count (G-BB-23, the only lever on a scale-invariant exposure), R-BB-SIBLING-AGGREGATES, the untokened /api/library link key (flagged, pre-existing), and the 134×-short provisional grant/r; the 5-second interval, the build tag and the three-prong reading are marked ratified. Sources: /Users/andrewedmond/.claude/silt-agent-memory/researcher/reviews/research-outcome/R2.9a-DONT3-READING-AND-BOND-STAMP-TUPLE-RESEARCH-CERTIFICATION-2026-09-05.md (Q2, G-BB-28) and /Users/andrewedmond/.claude/silt-agent-memory/researcher/reviews/research-outcome/R2.9a-instrument-necessity-geometry-bound-and-tail-merging-RESEARCH-CERTIFICATION-2026-09-05.md (Q1, G-BB-22, G-BB-23). PACE record: docs/thinking/2026-09-05-r29a-residuals.md.

R2.13 R-COMPACT-ORPHAN — a failed re-open inside the paid-serial guard store's Compact left the append handle on an unlinked inode. adapters/guardstore Disk.Compact renamed the temp file onto the live path and only then re-opened its append handle; if that open failed, Compact returned the error but d.f still pointed at the inode the rename had just unlinked. Write and fsync through that handle succeed, so every later Append returned nil for a record no Load could ever see, and the sole caller (core/credit sweepExpiredSerials) discarded the error unconditionally. Direction: an OVER-pay, once per epoch since C-7 moved compaction onto the band advance; latent today only because the ledger resets at the same restart (MEDIUM, PE ruling). Fix: open-before-rename — the new append handle is opened on the temp file BEFORE os.Rename, so a failure leaves the store unchanged with the old handle valid and nothing fallible runs between the rename and the handle swap. Backstop: a sticky guardstore.ErrStoreBroken, keyed on the ONE reachability signal (after the swap the handle's inode must be the inode at the path, os.SameFile) and checked first by Append and Compact, so a broken store fails loudly and never returns nil for a record Load cannot see; a retired handle's Close failure is NOT a broken store (PE ruling RULING-R2.13-compact-orphan-11396f1-2026-09-03.md finding 1: keying on it refused every payout on a healthy store). Port contract: ports.PaidSerialStore.Compact now carries the handle clause (after a failed Compact the store MUST either remain appendable-and-reachable or MUST fail every subsequent Append; it MUST NOT return nil from an Append a later Load cannot see). Ledger: the sweep no longer discards the Compact error; it is recorded (Ledger.CompactFailures, LastCompactError) and never refuses a payout by itself — the two error classes stay split, a broken store is observed through Append failing and the existing ReasonGuardStore path (blanket fail-closed at the sweep was REFUSED by the ruling as a self-inflicted liveness break). Gates (G-CO-1 RED-first with controlled revert; G-CO-2 green by design; G-CO-3 a regression pin whose RED→GREEN came from the store double honouring the port clause, not from source; the backstop pins are positive tests): TestG_CO1_PostRenameOpenFailureOrphansTheAppendHandle, TestG_CO2_BenignCompactionFailureDoesNotRefusePayouts (anti-over-correction, stays green), TestG_CO3_BrokenStoreMustBeObservableByTheLedger, TestR213_BackstopFiresWhenTheHandleDoesNotReachThePath (+ TestR213_RetiredHandleCloseFailureDoesNotBreakTheStore), TestR213_PreRenameOpenFailureLeavesTheStoreHealthy, TestR213_BenignCompactionFailureIsRecordedNotDiscarded. Also corrects the ROADMAP FP-1 parenthetical (the mirror crash window is not a pure under-pay, does not self-heal, and has a shipped gate — ruling §4). Ruling: /Users/andrewedmond/.claude/silt-agent-memory/principal-engineer/reviews/RULING-ledger-durability-family-FP2-R2.13-R2.10-2026-09-03.md §1 / §6. Deliberation: docs/thinking/2026-09-03-r2.13-compact-orphan-design.md.

R0.4b C3 merge-prep — Tester defect F6, the LANE OFF gate's missing teeth, the G-E comment gate, and crypto-specialist advisory items C-1 … C-8. Inputs: the Tester's 271ab81 verification, the delta certification R0.4b-C3-271ab81-G3-G4-GD-DELTA-CERTIFICATION-2026-09-03, and ADVISORY-R0.4b-C3-blind-RSA-epoch-binding-2026-09-03. Full item-by-item write-up with root causes, gates and measurements: docs/thinking/2026-09-02-r0.4b-c3-close-design.md §10.

• F6 (defect, permanent liveness cliff) — an EARLIER rotation pruned a LATER rotation's already-staged pre-published key. EpochStore.ensureBand pruned on the caller's own band (e > cur+w). The daemon launches each epoch turn as a bare go rotateDemandKeys(cur), so turns complete out of order; a turn for an earlier cur deleted keys a later turn had generated AND handed to install(...), which stages their fingerprints on chain. applyIssuerKeys is first-write-wins, so once the staged fingerprint commits the regenerated key can never be registered — the demand lane is dead for that epoch, for that issuer, permanently, and nothing detects it. Measured with no concurrency: RotateWindow(11) then RotateWindow(10) loses epoch 15. Fix: the retained band's UPPER EDGE is max(genTo, highest epoch on disk) — monotone, so no rotation can shrink another's pre-publication; bounded, because the only writer above the edge is the generation loop, which stops at cur+w. Gates: TestRTC3_AnEarlierRotationDoesNotPruneALaterRotationsPrePublishedKey (deterministic, RED with LOST=[15]) and TestRTC3_EpochStoreRotationsNeverLoseAnInstalledKey (the daemon's four overlapping turns ×80, RED with LOST=[17]). The adopted gate's if e < 9 || e > 14 { continue } filter is REMOVED — its rationale had the direction backwards and it carved out the only epoch ever lost. A false comment in cmd/silt/daemon.go ("one rotation is in flight at a time") is corrected: bumping demandEpoch prevents a duplicate rotation for the SAME epoch and nothing else.
• The LANE OFF gate had no teeth; it now has a runtime twin. The Tester reintroduced the F7 daemon-death with every asserted string intact, using a different early return: source gate GREEN, go vet clean. New e2e/laneoff_corrupt_store_test.go TestDaemonSurvivesACorruptDemandKeyStore drives a real silt daemon over real TCP with a corrupt demandkeys.cbor and asserts the process survives (registry, peer and bootstrap lines all print), the lane never arms, both operator lines are exact and name the store path, and the file is byte-unchanged. Ablation: reinstating the F7 death reddens it while the source gate stays green.
• Third-time rule closed as a LINT. scripts/check_source_gates.py, run by the Website — changelog + links job in .github/workflows/ci.yml (the claim was FALSE when first written — see the G-F entry below — and is true as of this round): any _test.go reading a non-testdata .go file is a SOURCE gate; its failure messages must begin SOURCE GATE: and describe what was checked, and it must name a RUNTIME GATE: or declare the behaviour UNGATED:. Three sites brought into compliance. Recorded as rule 8 in docs/build-process.md.
• C-1 (RFC 9474 §4.4 Finalize, the advisory's top item) — the unblind step now VERIFIES. A malicious issuer could return a garbage blind signature: the fetcher paid the withdrawal fee, fetched, signed a receipt, and the server's Bank.Redeem then refused it — so handleDeliveryReceipt never called the ledger and the serve's eager unwitnessed self-mint was NEVER REVERSED. An issuer handing out duds drove its whole cohort onto the self-mint path at no cost to itself and with no detection. Unblind / UnblindCredit / UnblindDemand verify under the domain (and for demand under (key_E, E)) before returning; the refusal is legible at the client.
• C-2 — the issuer's private-key operation is blinded and verified after signing. SignBlinded was a bare Exp(b, D, N) on attacker-chosen input over the network, which is the Brumley–Boneh remote-timing setting; client-side blinding does not help the issuer, which is why Go's own crypto/rsa blinds every private-key op. Now: random blinding (rng INJECTED — crypto/rand is banned in core) plus s^e == b mod N before release, the Boneh–DeMillo–Lipton countermeasure. Wire format unchanged — the blinding cancels, and the gate asserts byte-equality with the plain modexp, which is what keeps the A2 retry-dedup honest.
• C-3 — ValidatePub gains hardness checks, split from the hot path. The advisory's spike showed four moduli passing the shape-only bound set, two of them universal forgery by any observer (a single 2048-bit prime; 122 seventeen-bit primes), plus p² and e = 3. Added: the FIPS 186-5 exponent floor e > 2^16; no prime factor below SmallFactorBound = 2^20 (one gcd against a lazily-built primorial); not a perfect power; not prime. All four shapes now REFUSED. The hardness half runs only at ADMISSION (ParsePub, demand.Keyset.Put); the cheap validateShape stays the last line before every modexp. Measured on Apple M4: admission 3.43 ms (budget 5 ms, at most W+1 = 5 pins per issuer per window), one-time primorial build ~42 ms (prewarmed off the loop at daemon boot), verify 19.4 µs. Leaving the hardness checks on the modexp path would have been a ~180x CPU amplifier on the single-threaded node loop — a new DoS bought while closing a forgery. Honest residual, stated: the bound is a BAR, not a proof; blindness against a malicious issuer is bounded by key-correctness assumptions, not proven, and the on-chain commitment bounds EQUIVOCATION, not soundness.
• C-5 — RSA representatives are canonical, and that closes an issuance-dedup bypass. SignBlinded opened with b.Mod(b, N), so blinded, blinded + N and any zero-padded spelling signed identically — while demandDedupKey is keyed on the RAW blinded bytes, so a re-encoding was a fresh cache key for an issuance already settled and the requester was charged twice for one signature. Now RFC 8017 §5.2.2 range plus minimal encoding, applied to the blinded value at the signer and to the signature at verify; Issuer.Issue checks the input BEFORE the charge, so a refused spelling cannot take the fee.
• C-6 — the RFC 9474 §4.2 is_coprime(m, n) check is present (a shared factor with a deliberately smooth modulus is a linkability tag the issuer can compute).
• C-7 — expired guard entries are retired on the epoch-band advance, not only at the cap. Both credit.paidSerial and demand.Bank.spent swept only at the 65,536 cap, so on any node below it — every node most of the time — expired entries were retained ON DISK indefinitely, past the W-epoch window that is their whole justification. Soundness is unaffected (refuse-not-evict is unchanged) and the new trigger is CHEAPER: O(cap) per epoch instead of O(cap) per refused redeem. Prior art: Brands' epoch-partitioned spent list.
• C-4 / C-8 — NOT built, recorded as ROADMAP Rocks with their reasons. R0.4b-PoP: no proof-of-possession of the RSA key in validateIssuerKeys, so a bonded issuer can register another issuer's fingerprint (Duplicate-Signature Key Selection). Latent, not live — one configured issuer, per-node ledgers — and the close is a validity-rule change, so it is research-gated and owner-ratified before the stamp raise. R0.4b-FDH: length-prefixing the FDH domain tag and widening the reduction slack both alter the FDH output, and the publish and credit domains are byte-frozen against chain replay. The two code comments claiming RFC 9578 fidelity are corrected: RFC 9578 signs SHA256(SPKI); silt signs an epoch index, which identifies neither issuer nor key.
• G-E (delta-cert, comment-only) — the G-4 ordering invariant is restated correctly. "A witnessed receipt reverses the self-mint exactly once" is false on a re-served lane; what is bounded is the LANE INSTANCE. Also corrected everywhere: "the 64 MiB production chunk" is the tree's stated MINIMUM production chunk, and the number that matters is that the break-even is B = 50,000 bytes against a SHIPPED default chunk of 65,536 — the lever was live at the default configuration, not only at an aspirational size.
• FP-2, measured, NOT fixed. The other half of the supersede/append crash window: when the guard append LANDS and the pay is lost, re-presenting the receipt returns serial-already-paid above the supersede, so the server keeps the full +58,720,256 self-mint at a 64 MiB chunk with no witnessed reversal and no conserved payout, and the receipt is burnt (Σ unmoved; no double-pay). Vacuous on the shipped in-memory ledger; live the moment the ledger is persisted, because there are then two durable stores and no shared transaction. Not fixed because neither candidate direction is ledger-local: a write-ahead needs a cross-store transaction, and pay-then-append needs a guard-record wire change plus moving ReasonAlreadyPaid below the supersede — an economic-mechanism change. Recorded as a second precondition on the FP-2 flip, gated by TestFP2_CrashBetweenTheGuardAppendAndThePayBurnsTheReceipt.

R0.4b C3 certification fold-in — three merge-blocking gates closed (G-8, the dark paid lane, is the owner's call and is NOT closed here): the research certification R0.4b-C3-composed-close-bc062d0-RESEARCH-CERTIFICATION-2026-09-03 returned GATED.

• G-3 — a torn tail was not realigned, so the next append LOST an acknowledged paid serial. guardstore.Open used O_APPEND with no size check. Load drops a trailing partial record, which is sound only while it stays the tail: O_APPEND writes at the file's unaligned size, so the next append shifted every record boundary after it and the following Load spliced the orphan fragment onto the head of the real record. A plausible spliced length byte (~1 in 8) makes that a SILENT wrong load with a paid serial no longer guarded — the F2 double-pay through the adapter written to close F2. Open now truncates back to the last complete record boundary and fsyncs before any append handle exists; dropping the fragment is safe because Append had not returned, so nothing was paid against it. Gated by TestTornTailIsRealignedBeforeTheNextAppend (RED before the fix and under ablation).
• G-4 — every guard refusal returned BEFORE the supersede, so a refusing server kept the unfunded self-mint. RecordServeToObject self-credits 0.875xB; the conserved leg pays a flat fee - skim = 43,750. Above 50,000 bytes refusing therefore beat being paid, and at the tree's stated MINIMUM production chunk of 64 MiB it beat it by 1,342x (+58,676,506), and by +13,594 at the SHIPPED 64 KiB default — a profitable, OPERATOR-TRIGGERABLE supersede-disable on Boulder 0's conservation rule, since an operator can fill its own guard with junk serials at a net cost of zero. The refusals now run BELOW the supersede, under one stated invariant: a witnessed receipt reverses the self-mint exactly once, whether or not it is paid. serial-already-paid deliberately stays ABOVE it — the guard's own record is what bounds double-reversal on a re-served lane — and an unwitnessed receipt never reaches the ledger at all, so the self-mint survives until a valid receipt arrives. The root cause (a flat fee against a byte-proportional mint, residual R-FLAT-FEE) is a D-POD-KNOBS re-pricing needing its own certification and is NOT closed here. Gated by core/credit/r04b_c3_g4_supersede_test.go (server nets 0 on a refusal at 1 kB / 64 kB / 64 MiB; the 1,342x arithmetic pinned; one receipt reverses once) and core/node.TestG4_UnwitnessedReceiptLeavesTheSelfMintAlone.
• G-D — three false code-doc claims on money/consensus surfaces corrected (behaviour unchanged): issuerKeyCommit is pruned only on a REGISTRATION-CARRYING apply, not every apply; epochWatermark is an honest-skew correctness device, NOT the "purely subtractive" Byzantine defence its comment claimed (one caller-supplied 2^62 denies the ledger forever); and the paid-serial store is appended before the ledger PAYS, not before it moves any credit — the supersede's subtractive reversal runs first.
• Flip preconditions recorded (no build owed yet). FP-2/F8: the ledger must OWN a chain-anchored epoch before any shared-ledger, third-operator-settlement or persisted-ledger deployment; a clamp is not a close, and the faucet rate limiter must not be keyed on the watermark. FP-1: demand.Bank.spent must be persisted before witnessed demand confers any value — the Tester's scar criterion is NARROWED (a guard needs memory as durable as the thing it guards), not waived, and re-arms in full the moment Bank.Demand / Node.WitnessedDemand acquires a non-observability consumer.

R0.4b C3 re-break round — ten confirmed red-team breaks closed (DO NOT MERGE unratified; F1 is a consensus-rule change awaiting certification): a second blind pass on the C3 close (RED-TEAM-R0.4b-C3-close-RE-BREAK-2026-09-03) confirmed ten breaks and two refutations. The (b1) epoch binding held under every attack; the breaks were in the machinery around it. Every probe ships as a regression gate (rt_r04b_c3_*), run RED against the pre-fix build first.

• F1 (CRITICAL, latent) — the floor box and the full node disagreed about the same block at every epoch turn. applyIssuerKeys pruned issuerKeyCommit by BLOCK HEIGHT on every v5 apply, so a block carrying ZERO registrations deleted committed leaves; the box's scope gate stalls only on len(b.IssuerKeys) > 0 and its O(payload) fold has no op for the prune. Both directions were measured: the box AGREED with a forged root a full node rejects, and read an HONEST zero-registration block as a forged root. Safe today only because WitnessValidateV5 never Accepts — a wrong-Accept the moment R1.8 flips it. Closed at the source: the prune is now PAYLOAD-DRIVEN, running only inside the registration-carrying branch, so "no registrations ⇒ no issuerKeyCommit write" is a property of apply() instead of an assumption of the box. The keyspace stays bounded — every ADD is in-band by validity, so pruning at each add re-establishes the 2W+2-bucket bound on every block that can grow it. Reproducing the prune in the fold is NOT available: core/statehash has point membership/non-membership only, and issuerKeyCommit carries no set-completeness digest (unlike dueBucket's MTH), so a witness-supplied member list would be omission-forgeable. Gated by rt_r04b_c3_split_test.go, which drives the scenario through the box recompute, the live validateEra3Roots, and WitnessValidateV5 cold-auditor and live-follower, and asserts the tiers never disagree.
• F2 — a restart evicted every guarded token and the same wire receipt paid twice. Both serial guards were process memory with no persistence and no restore — the one eviction mode the design forbids, performed by every node at every boot. New ports.PaidSerialStore + adapters/guardstore: an append-only log of fixed-width records, fsync per append, atomic temp+fsync+rename+dir-fsync on compaction. The ledger persists the entry BEFORE any credit moves (the SignMarkStore ordering), a redeem before the load completes is refused (paid-serial-guard-unloaded) rather than paid, and a store that cannot write refuses the payout (paid-serial-store-write-failed).
• F3 — "evicted ⇒ expired" was false in-process. The guard was keyed by the serial alone while its expiry epoch was the FIRST redeem's — the MINIMUM over the tokens sharing a serial, both of which the withdrawer picks. Both guards are now keyed by the TOKEN (uint64BE(issueEpoch) ‖ serial), so an entry is removed only once ITS OWN issue epoch is outside the band.
• F4 — a committed RSA key was never validated. The commitment attests 32 bytes, which binds WHICH BYTES an issuer serves and nothing about whether they are a key: N = 0 panicked every verifier inside big.Int.Mod (a bonded Byzantine issuer crashing every fetcher that transacted with it), N = 1 verified every (serial, sig) pair, E = 1 made the signature the message. New blindtoken.ValidatePub (N odd, positive, 2048–8192 bits; E odd, > 1, ≤ 2^32−1) is enforced at ParsePub, at Keyset.Put, and before every modexp.
• F5 — demand.Bank.spent was unbounded, and no guard bounded the serial's SIZE. spent is now capped and expiry-swept (refuse, never evict, at the cap); demand/credited are capped by object count; and the serial, the token signature and the receipt's ed25519 fields are bounded at the wire decode and again at Bank.Redeem, so no attacker-chosen byte count on a 132 MiB frame can become a long-lived map key.
• F6 — EpochStore had no lock while the daemon launched every epoch turn as a bare goroutine, so two overlapping rotations lost a key whose fingerprint was already staged for commitment — and, because registration is first-write-wins, that epoch's lane is dead forever. Serialized behind a mutex spanning the whole load→generate→save cycle. -race cannot see this class (each goroutine loads its own map), so the gate asserts the outcome.
• F7 — one corrupt byte in a demand key file bricked the whole validator. The daemon now reads the store before arming the lane and degrades to LANE-OFF, loudly; chain, storage and serving continue, and the file is never rewritten or regenerated.
• F9 — gate F never failed on the stamp. Clause (c) was a t.Logf, suppressed under a plain go test, so raising the mint stamp passed a fully green tree. It is a hard failure now, with a teeth-proof for the tripwire itself, plus a driven gate for the Era4ActivationHeight route to v5 that bypasses the readiness tally entirely.
• F8 (open, deliberately) — the monotone epoch watermark is a one-call permanent denial. One unvalidated currentEpoch = 2^62 refuses every subsequent honest redeem for the ledger's life. Bounding it is a mechanism choice about what the ledger may trust of a redeemer's clock, at a boundary that is not authenticated at all — routed to the Researcher with the question of whether R0.4b-5 buys anything in its own threat model. Unreachable on the shipped per-node topology.
• F10 (disclosed) — cap griefing costs only the skim, which lands in the escrow of the griefer's own root. Quantified and pinned so the disclosure cannot go stale; production grant = 0 remains the close.

Floor-box wrong-accept on the LastCommit carrier — the box now runs the SAME validity rule the full node runs (one function, three callers): the trustless floor box reproduced applyCarrier's TRANSITION (class A derived its write-set straight off b.LastCommit[i].AttesterID) but never validateCarrier's VALIDITY rule, which was wired only onto the node's two disk-write paths. So a v5 block whose carrier named the PUBLIC keys of real qualified validators with 64 zero bytes for a signature — no key material — was rejected by every full node (ErrCarrierBadSignature) and AGREED with by the box, against the attacker's own apply-computed root. Escalation: validatorsSeen is the sole input to C2Metric → MatureCoefficient → matureNow → the one-way everMature latch and to the box's own RecomputeMatureNow, so the same forged carrier flipped the maturity latch — the MEASURED decentralization quantity the maturity shed gates on. Inert today (WitnessValidateV5 never returns Accept), so this was an R1.8 accept-flip entry blocker, not a live exposure. Fixed at the root, per the PE structure ruling: assembleStateRootRecomputeOps now calls the shared validateCarrier(&b) unconditionally before any class dispatches, and validateCarrier lost its *Chain receiver so the COMPILER (not the AST allowlist pin, whose glob is holed) forbids a live-state read on that path. apply was deliberately NOT made to verify. An invalid carrier is a STALL (ErrRecomputeCarrierInvalid); never-Accept is unchanged. Also corrected: the class-A "No wrong-accept" doc claim (true of the SCREEN, false of the INPUT) and the backwards pruned-block hash claim at Hash — a pruned block's Pruned field is a linkage token, not a content commitment, so no consensus decision may depend on re-reading a pruned block's body (Hash/Prune unchanged; the property is documented, and the follow-ups are filed as Rocks under Boulder 1). Six class-A test fixtures that minted an invalid HEIGHT-1 carrier block were repaired to height 2. Gates: core/chain/redteam_carrier_boxsplit_gate_test.go — five gates, each run on the warm AND cold box tiers, oracled on the full node's accept path (ValidateCommit, never a single predicate) and asserting the implication box agrees ⇒ node accepts, never the biconditional; all RED at 3bd13e2, GREEN after. (core/chain/carrier.go, core/chain/chain.go, core/chain/floorbox_recompute_stateroot_v5.go, core/chain/floorbox_recompute_stateroot_atts_v5.go; red-team RED-TEAM-lastcommit-carrier-3bd13e2-2026-09-03.md; PE ruling RULING-floorbox-predicate-rederivation-structure-2026-09-03.md; design record docs/thinking/2026-09-03-lastcommit-carrier-round-A-design.md addendum.)

LastCommit attestation carrier — the R-BOX-ATTESTS fix, era-4 (v5) only (owner call O1, ratified 2026-09-03; the frozen era-3 format and transition are untouched): apply wrote validatorsSeen from b.Atts, but Hash excludes Atts and the committed-root predicate re-runs the real apply over the ATTACHED certificate. A proposer populates its roots BEFORE it gathers precommits, so ANY certificate that would seat a new attester made the recomputed root differ from the signed one and every replica — including the proposer's own — rejected that block ("commit rejected by own replica"). Two HIGH consequences: the decentralization MEASUREMENT froze (only blocks seating nobody could commit, so validatorsSeen was constant from the first root-checked block, permanently ceilinging MatureCoefficient and reading zero arrivals forever), and the chain stalled intermittently for any round whose first-to-quorum prefix carried a qualified never-seen attester (connected, all-honest, unbounded in expectation). The fix moves the seating input into HASH-COVERED content: a v5 block carries LastCommit []Attestation (additive cbor key 18, omitempty, folded into Hash) republishing the PARENT's precommits, and the v5 transition seats each carried signer that is not the parent's proposer and is attesterQualified against the child's pre-state — folded BEFORE the block's bond registrations, TTL expiries and slashes (structurally pinned). A v5 block's own Atts now write nothing. Validity: every entry verifies over b.Prev at PhasePrecommit at its own round (deliberately NOT bound to CommitRound, which Hash does not cover); distinct ids; a sub-v5 block carrying the field is invalid; height 1's carrier is empty BY RULE and a genesis LastCommit is refused BY RULE (genesis Atts are filtered by D-GENESIS-ATTS-SEATING, ratified and built the next day — see the entry above) (previously a convention, not a rule). The floor-box class-A recompute and the v5 read-set model are re-pointed to the carrier, with the parent-proposer exclusion anchored by the parent's own proposer signature over the hash-covered b.Prev. Disclosed: the seat lands ONE BLOCK LATE (monotone, benign); a proposer can DELAY a seating by omitting a signer but can never FORGE one (downward-only, unenforceable by rule). Every carrier-free block hashes BYTE-IDENTICALLY to pre-carrier code (drift guard), so the era-3 freeze (#632) is untouched, the readiness stamp is NOT raised in this round, and fork-choice weight (owner call O3) is deliberately untouched. Gates G1-G6b, G8, G9 of the converged verdict ship with it, each driven RED first. (core/chain/carrier.go, core/chain/chain.go, core/node/chainrole.go, core/chain/floorbox_recompute_stateroot_atts_v5.go, core/chain/readset_v5.go; docs/thinking/2026-09-03-lastcommit-carrier-round-A-design.md)

LastCommit carrier — research-certification merge gates closed (test, comments and ROADMAP only; NO design change, no rule change, and the box still never-Accepts): the build certification (LASTCOMMIT-CARRIER-round-A-...-2026-09-03) returned GATED on three items. (1) Gate G2's GREEN assertion was under-specified — it asserted only validatorsSeen != 0, which the three pre-existing anchors already satisfy, so a regression that silently dropped a signer from the carrier passed. Each arm now pins the EXACT carrier membership and seated count (the fifth node FIRST: 4 carried, 3 seated, the fifth included; LAST: 3 carried, 2 seated, the fifth structurally NOT seated because its reply landed after the first-to-quorum prefix closed). Ablation: under-carrying one genuine signer is now RED and was green before. (2) The R-CARRIER-PARENTPROPOSER residual text was one-sided. Dropping the forger's OWN seat is bounded, but the ADD direction is NOT bounded by key ownership — a freshly minted keypair verifies against b.Prev, matches no carrier entry, so nothing is skipped and the parent's TRUE proposer self-seats (one id per block, wrong-accept direction). The claim that a verifying witness never falls through to "no exclusion" is WITHDRAWN. Inert today; filed as an R1.8 flip precondition with its certified fix direction (a tagLastProposer committed scalar, owed BEFORE the era-4 freeze). (3) The claim that carrier bytes are bounded by R-membership is WITHDRAWN — qualification is applied only at the transition, so any fresh keypair passes validateCarrier and ~1.3M entries fit maxFrame; filed as R-CARRIER-BYTES on the stamp-raise carry-list with its two candidate bounds, both of which are v5 validity-rule changes needing certification. Also corrected: a producer comment that claimed HeadCarrier carries "everything you hold" when it carries the parent's first-to-quorum prefix, and a stale cited test name in ValidateProposal. (core/node/lastcommit_carrier_node_test.go, core/chain/carrier.go, core/chain/chain.go, core/chain/readset_v5.go, core/chain/floorbox_recompute_stateroot_v5.go, core/chain/floorbox_recompute_stateroot_atts_v5.go, core/node/chainrole.go, ROADMAP.md)

Three false claims corrected against the shipped tree (PE H-4, §4, §6). docs/thinking/2026-09-02-r0.4b-c3-close-design.md §7 said "no consensus-validity change" when the change adds a validity predicate on both receive paths, a genesis door, a relaxed empty-block rule and a changed Block.Hash preimage; §9/F10 stated production grant = 0 as a close when the shipped daemon grants 500,000 and it is an open owner call. Both are retracted in place. R-COMPACT-ORPHAN's description is corrected to the measured behaviour — the store SILENTLY REPORTS DURABILITY IT DOES NOT HAVE (Append returns nil after a failed post-rename re-open, and Load then sees nothing) — and ReasonGuardUnloaded is annotated at its declaration as unreachable on the shipped daemon, so the record stops counting it as an operator signal. The R-FLAT-FEE comment in core/credit/delivery.go now names the ACCUMULATED LANE rather than a chunk size: trackProvisional accumulates and the serve call site fires per chunk, so every object above 50 KB is already past break-even.

R0.4b C3 close — the issue epoch is now inside the blind-signed message, and the demand lane is a scheduled, separately-keyed lane (DO NOT MERGE unratified; gates the R0.4b merge): a blind red-team pass on the R0.4b build confirmed six breaks, and the converged research verdict (R0.4b-red-team-reconciliation-CONVERGED-RESEARCH-VERDICT-2026-09-02) withdrew the prior "pump closed for every K" claim. The pump re-opened whenever ONE RSA key was bound to more than one epoch — which an ordinary RESTART does, since the persisted key was re-registered for the new boot epoch. VerifyInWindow returned the NEWEST held epoch that verified, so an epoch-0 token was re-dated to epoch 3; the credit guard swept its epoch-0 entry at E + W while the token still verified, and a second server on the same ledger collected a second full payout per serial. Fixed:

• (b1) The issue epoch is bound into the demand FDH input — H(domain ‖ ctr ‖ epoch(8B BE) ‖ serial) under a new silt/blinddemand/fdh/v2 domain, restoring RFC 9578's token_key_id-in-the-signed-message schema the first import dropped. A signature verifies under exactly the pair (key_E, E), so issuedEpoch(token) is a PURE FUNCTION OF THE TOKEN for any key schedule — the coupling condition "evicted ⇒ expired ⇒ un-redeemable" needs. Token{Serial,Sig} and receiptMsg stay byte-identical (no new receipt quasi-identifier; the epoch is a consensus epoch index, certified Q1-neutral), and the only wire change is that the request NAMES E in the existing Message.Height. The publish and credit FDH domains are unchanged byte-for-byte — committed publish tokens re-verify on every replay. The proposed distinctness VALIDITY RULE was REFUTED and is not built: the committed band is pruned, so it would lengthen the pump's period to 2W+1 rather than close it, and remembering every fingerprint forever is unbounded committed state.
• The publish key never enters the demand keyset, and rotation is SCHEDULED. The daemon installed the persisted publish key as key_{boot} once; from boot+1 the demand lane refused to issue and from boot+W+1 the bank rejected everything, while the fee-charging withdrawal path kept charging. New diskissuer.EpochStore persists a per-epoch band (one CBOR file, atomic rewrite, [cur−W, cur+W] retained, [cur, cur+W] pre-published) and the daemon rotates it off the node loop on every epoch turn.
• A stale key registration no longer mutes the proposer forever. A reg that missed its own epoch rode pendingIssuerKeys indefinitely and failed the node's OWN local pre-check with ErrIssuerKeyEpoch on every later proposal — a permanent, restart-only mute triggered by an ordinary missed epoch. The proposer fold now DROPS it (policy, never validity) and the schedule re-stages; SetDemandIssuerKey refuses to stage a backdated reg and prunes the queue, which also closes an unbounded-growth path.
• The pin FOLLOWS the chain. "Once pinned, never re-pointed" was the wrong invariant for a CACHE of a committed binding: after a reorg the redeemer kept verifying against the abandoned fork's key_E and refused the canonical one for W+1 epochs. Held keys are re-validated against the current commitment on every keyset read and re-pointed on mismatch.
• Every shipped withdrawal path is on the pinned lane. swarm receipt uses FetchDemandIssuerKeys + AcquireDemandTokenInWindow; the D3 client (WithdrawDemandTokenPrivately) carries a (key, epoch) its DURABLE parent resolved against the committed binding and refuses a reply naming another epoch. The unpinned AcquireDemandToken is deleted. A per-cohort key is a DENIAL again, not an accepted tagged token.
• Rollout rule encoded (TestReadinessStampImpliesIssuerKeyCoverage): a binary may stamp readiness v5 only if Block.Hash covers cbor 17 and stateRootTagsV5 includes issuerKeyCommit. The stamp is NOT raised here. Design: docs/thinking/2026-09-02-r0.4b-c3-close-design.md.

Floor-box class-A screen no longer reads LIVE box state — Direction A, an R1.8 flip precondition (Boulder 1; recompute-side only, no committed/wire format change, never-Accept unchanged): the class-A attestation screen picked its qualification branch from c.matureEpoch (core/chain/floorbox_recompute_stateroot_atts_v5.go) and its anchor eligibility from c.launchAnchor → c.handedOff (core/chain/chain.go) — box-own fields written ONLY by apply→rotateEpoch and adopt. The recompute's deployment target "holds NO registry and replays NO apply", so on a COLD box those fields are never set and the mature-epoch branch is unreachable: every mature-epoch block was screened under the PRE-maturity rule. Both failure directions were live with every witness proof passing — a mid-epoch joiner (bonded ≥ MinBond, ∉ the frozen epochSet, the I3 identity) folded into an attacker's committed root (wrong-accept, and the class-M poisoning entry), and the same attestation inside an HONEST block stalling the box (false stall). The fix Resolves the already-committed tagMatureEpoch leaf present against prevStateRoot, UNCONDITIONALLY, before the branch — homed on the class-M carrier StateRootMaturityWitness (required every block) rather than the boundary-only rotate witness — and evaluates the launch-anchor rule through ONE shared predicate launchAnchorGiven(id, handedOff) that the live node and the box both call (the #402 non-fork rule). apply's attestation loop runs BEFORE rotateEpoch (rotate-LAST, #620/PR #703), so the committed PRE-value is exactly the oracle, including on the handoff block itself. Adds the certified matureEpoch ⇒ everMature pre-state cross-check and a LOUD entry assertion that the injected bond verifier is wired (ErrRecomputeBoxWiring) so the #572 replay shape fails at the box entry, not as a fold mismatch. Stall-adding only; the one-way latch WRITE, the #402 tally arithmetic, and every committed format are untouched. Research cert: floorbox-R-FOLD-LIVE-STATE-READS-RESEARCH-CERTIFICATION-2026-09-02.md. Design: docs/thinking/2026-09-02-floorbox-fold-live-state-reads-fix-design.md.

Floor-box class-P scalar-anchoring — Direction A + B (Boulder 1; cert-touching, re-opens R1.4; box still never-Accepts, blind re-cert + blind Tester run pending): closes the confirmed class-P recompute wrong-accept (×4) and the fresh-in-block-bond false-stall the R1.6/R1.5 OPEN-BREAK gates drove. Root cause: scalarFoldOp (core/chain/floorbox_recompute_stateroot_rotate_v5.go) verifies a scalar's pre-state proof ONLY on emit; on the suppression path (OldValue==newValue) the pre-value is never fold-verified, so a forged OldValue that suppresses the emit (or gates a branch) is never checked and the box agrees with a lock-free / latch-free committed root. Direction A adds an unconditional pre-state Resolve(...).IsProvenPresent anchor (anchorRotateScalar) BEFORE the emit/branch decision for the seven suppressible scalars (MatureEpoch + the three lock-in bools and their ridden height scalars) and — cross-class — everMature (floorbox_recompute_stateroot_maturitylatch_v5.go); every scalar leaf is committed unconditionally, so a forged value fails IsProvenPresent ⇒ NoWitness ⇒ STALL (stall-adding only; the box never gains an Accept path). Direction B surfaces regVerWrites (the fold-anchored post-write regVersion) from class B and adds the in-block RegVersion cross-check anchorRotateMember lacked, mirroring the existing Weight in-block treatment — so a boundary block carrying a decisive fresh bond now agrees with apply instead of under-counting and stalling. The #402 tally arithmetic (3ready > 2total) and every committed v5 format field are UNTOUCHED. The R1.6 TestOpenBreak_LockedInOldValuePredicate and R1.5 TestScheduleOracle_OpenBreak_A/_B gates are flipped from assert-wrong-accept to assert-stall; new suppress-path gates cover MatureEpoch and everMature; a split coverage walk (scalarSuppressObligations, R-COVERAGE-SCALAR-SPLIT) classifies every scalar emit-anchored vs suppress-anchored so a future suppressible scalar cannot be wholesale-classified "anchored"; and the two R-ROTATE drift-guard brittleness riders are folded in (allowlist the sanctioned idQualifies predicate; assert rotate-is-last-in-gate-body, not exactly-one-statement). Box still never-Accepts (TestWitnessValidateV5_NeverAccepts green). Design: docs/thinking/2026-09-02-floorbox-classP-scalar-anchoring-design.md.

A4 provisional-eviction money-pump — close the double-pay at FIFO eviction (Boulder 0, R0.4a; economic-mechanism change, B3 conservation — Researcher re-cert pending): an object-aware serve eagerly self-mints bytes − skim to the server and routes skim to the object's escrow, tracking the lane as provisional so a later witnessed receipt supersedes it (RedeemDeliveryCredit reverses the mint, then pays the conserved fee − skim). When the bounded provisional map (maxProvisional, build-immutable #8) FIFO-evicted the oldest lane, it forgot the lane but LEFT the mint on the server's balance; a receipt redeemed after eviction then paid the conserved leg on top — one delivery paid twice, a network-minted per-receipt subsidy (the banned dual). Fix (the (b)-minimal claw-back, core/credit/delivery.go): eviction now REVERSES the evicted lane's self-mint before forgetting it, via the same floored reversal the redeem uses (reverseProvisional, shared verbatim so the escrow floor is identical at both sites — a repair bounty paid between serve and eviction is never clawed back). An evicted lane is thereby left in the same accounting state as "never served", so an evicted-then-redeemed lane equals a never-existed redeem: conserved leg only, mints nothing. The give is the unwitnessed bilateral fallback — an evicted, never-redeemed serve loses its self-record (an under-pay at the >maxProvisional tail, never an over-pay, never a denial). New gate core/credit/money_pump_test.go TestA4MoneyPumpConservation pins the closed-system invariant Σbalances + Σescrow == grant + legitimate transfers (RED at delta=+1024 before, GREEN after); TestProvisionalCapIsBoundedAndDeterministic flipped from encoding the buggy rule (c) to the correct rule (b); new TestPaidBountyIsNotRecoverableByEviction guards the escrow floor at the new reversal site. Design: docs/thinking/2026-09-01-a4-provisional-eviction-fix-design.md.

A4 follow-on — provOrder desync fix (Boulder 0; conservation-shape-neutral, red-team 2026-09-01): the A4 fix leaned on provOrder, the FIFO order slice, which RedeemDeliveryCredit never kept in sync — it deleted the redeemed lane from the provisional map but left the key in provOrder. On the redeem-heavy path (map stays small, eviction loop never fires) the slice grew one entry per witnessed delivery, forever: unbounded state on the floor box (build-immutable #8, HIGH), an attacker-buildable single-serve stall on the serialized consensus loop when the dead prefix is finally scanned (MEDIUM-HIGH), and a stale front entry that reversed a LIVE re-served lane's mint before any redeem (MEDIUM, grief). Not a mint — the red-team's conservation fuzz refuted the double-pay. Fix (core/credit/delivery.go, credit.go): provOrder becomes []provKey with a companion provIndex position map; a redeem tombstones the lane's slot in O(1) (no slice scan), eviction skips tombstones and pops the oldest live lane, and an amortized-O(1) compactProvOrder caps the slice at 2maxProvisional. Conservation is untouched — no change to what is minted or reversed, only WHEN/HOW the order-slice key is removed; the conserved-lane key shape is unchanged, so the R0.4 conservation cert stays valid (the provKey-server shape change, RT-DELIV-3, is routed separately as cert-gated). New gates core/credit/delivery_provorder_test.go TestProvOrderStaysBoundedAcrossRedeems / TestRedeemDoesNotLeaveDuplicateOrderEntry (RED at 9d50437, GREEN after); TestA4MoneyPumpConservation and TestProvisionalCapIsBoundedAndDeterministic stay GREEN. Design: docs/thinking/2026-09-01-provorder-desync-fix-design.md.

provOrder eviction front-drop desync — the cursor fix (Boulder 0, 2026-09-01; conservation-shape-neutral): the Tester's compaction fuzz (TestCompactionTombstoneFuzz/eviction-dominant, seed 0xdeadbeef0002) failed deterministically at step 13154 (full ops, not -short). The eviction loop dropped the FIFO front by re-slicing (provOrder = provOrder[1:]), which shifts every surviving entry down one physical position but left provIndex holding the STALE positions. removeFromProvOrder then tombstoned the WRONG live slot, compaction dropped a live lane's order entry, and a ghost index entry could reverse a live re-served lane's self-mint (grief, not a mint). A real product defect the R0.4/R0.4a fixes left on the eviction side — it fires only when the eviction loop runs repeatedly (poolSize > maxProvisional), which the -short path never reaches. Fix (core/credit/delivery.go, credit.go): a logical head cursor provHead replaces the front re-slice — eviction advances the cursor and nils the dropped slot, so provIndex holds ABSOLUTE positions a front-drop never invalidates. Amortized O(1) per op, no survivor-index rewrite (the RT-DELIV-1b stall is not reintroduced — the product path drives 100K/150K full ops in ~145 ms under -race); compactProvOrder resets the cursor on rebuild and still caps the slice at 2*maxProvisional (build-immutable #8). Conservation is untouched — no change to reverseProvisional, the fee/skim arithmetic, the terminal-reversal sites, or the provKey shape (RT-DELIV-3 stays separately cert-gated), so the R0.4 conservation cert holds. Also fixed a harness gap the desync had masked: the fuzz's redeem-branch fallback-serve did not predict its eviction, so expectedTotal under-counted — the identical prediction block from the other serve branches was added (test-only, no product accounting change). All three fuzz scenarios GREEN at full op counts; TestA4MoneyPumpConservation and the prior Boulder-0 gates stay GREEN. Ablation reddens the fuzz at step 13154 again. Design: docs/thinking/2026-09-01-provorder-eviction-cursor-fix-design.md.

v5 trustless floor box — R1.2 witness-soundness fix: re-anchor every class-P/A/B screen predicate against prevStateRoot (still NEVER-ACCEPT) (core/chain/floorbox_recompute_stateroot_atts_v5.go, ..._rotate_v5.go, ..._bondreg_v5.go; gates + coverage meta in core/chain/floorbox_recompute_adversarialroot_v5_test.go). The recompute classes P (rotation), A (attestations→validatorsSeen), and B (bond regs) read per-member VALUES and SCREEN PREDICATES from the untrusted witness structs and used them as fold NewValues or branch predicates WITHOUT resolving them against prevStateRoot — a wrong-accept-by-recompute the existing ablations were blind to (they forged against an honest committed root; the attack moves the committed root to match). The fix threads prevStateRoot into the screen/tally/write-set functions and requires each untrusted read to statehash.Resolve present/absent against prevStateRoot before it is trusted (NoWitness⇒stall, never a false read — C-7 §104): class A anchors Slashed/InEpochSet/ BondedSize/BondedPresent AT SOURCE in attesterQualifiedFromScreen (which reaches class M — a forged screen can no longer inflate validatorsSeenRoot, PE ruling Q2); class P anchors the frozen Weight (against qualified||id, or the class-B qualWrites for an in-block bond) and RegVersion/RegVersionKnown (against regVersion||id) WITHOUT touching the 3ready>2total tally arithmetic (the #402 non-fork rule, TestActivationQuorumNonFork stays green); class B anchors PriorOwner/Claimed/PriorProven (against bondRootOwner||root / bondRootProven||root). The box STILL never-Accepts — the fix ADDS stall paths only; the STOP boundary and TestWitnessValidateV5_NeverAcceptsWhileRecomputeGated are unchanged. Proven by the 11 adversarial- committed-root gates (RED-on-main → green-after, each ablated red-then-green — every anchor is load-bearing) plus a reflection-pinned coverage meta-assertion over the three witness carrier structs (with a teeth companion). Design: docs/thinking/2026-09-01-floorbox-witness-soundness-fix-design.md + ...-BUILD.md; PE pins: silt-agent-memory/principal-engineer/reviews/RULING-floorbox-R1.2-invariant-pins-2026-09-01.md.

v5 trustless floor box — close the last Path-1 completeness gap: the OFF-boundary everMature maturity latch (class M), + a permanent emission-keyed leaf-diff guard (core/chain/floorbox_recompute_stateroot_maturitylatch_v5.go, core/chain/floorbox_recompute_stateroot_v5.go, core/chain/floorbox_recompute_stateroot_rotate_v5.go, docs/thinking/2026-08-31-floorbox-classM-everMature-offboundary.md, 2026-08-31). apply latches everMature false→true at the TOP of EVERY block where !everMature && Mature (chain.go:3303-3305), BEFORE the boundary gate. #678 reproduced that leaf write ONLY inside class P (boundary-gated), so the GENERIC off-boundary maturity crossing (h % EpochBlocks != 0) had no reproducer ⇒ the recompute folded no tagEverMature op ⇒ recomputed root != committed StateRoot ⇒ STALL. SAFE (never a wrong-accept — the box still never-Accepts) but a LIVENESS gap fatal to the #657 accept-flip: off-boundary is the generic crossing ((EpochBlocks-1)/EpochBlocks). Fix: a boundary-independent class-M reproducer in the recompute entry, the SINGLE OWNER of the tagEverMature write. It fires on ANY block whose latch flips, REUSING RecomputeMatureNow (#668, not a rebuild) over the committed post-apply state, and threads the post-latch everMature into class P for its freeze gate (P's tagEverMature emission REMOVED — no double-emit at a boundary-coincident crossing). NO apply/consensus change; the box STILL never-Accepts. PERMANENT GUARD (the real deliverable — end the one-at-a-time discovery of unreproduced writes): an emission-keyed differential leaf-diff test that, on a real apply over a dry-run clone, diffs stateRootLeavesV5 PRE vs POST and asserts the committed-leaf key-diff equals the recompute's folded key-set — keyed on the LIVE marshaller output, so a FUTURE committed tag is caught with zero guard edits. Driven by a reachability generator whose schedule INCLUDES an off-boundary maturity crossing; ABLATED RED against the pre-fix recompute (class M removed) reddening naming exactly everMature, then GREEN with the fix. Plus the two #678 Tester-flagged coverage tests via the real entry on BOTH off- and on-boundary crossings: (b) an omitted tagEverMature write stalls; (c) a forged maturity screen (per-member bonded/slashed) stalls. #678's thinking-doc trued up (the everMature LATCH is any-height; the epoch FREEZE handoff is boundary-only — the two are separable). FOLLOW-UP (PE write-obligation ledger acceptance bar): the leaf-diff generator now drives ALL 28 committed-leaf tags through the diff assertion — E/R/A/P/M plus class-S (slash), class-B (bond-reg, incl. displacement) and class-T (TTL sweep), which the first cut left un-driven (16 of 28). A SELF-CHECKING coverage meta-assertion (TestLeafDiffGuardCoversEveryEmittableTag) asserts the UNION of tags the scenarios exercise EQUALS the FULL emittable tag set of the live stateRootLeavesV5 marshaller (derived from populateCommitted, itself reflection-pinned) — so a FUTURE format tag with no scenario reddens THIS test by name, closing the generator's own blind spot permanently. Its teeth are demonstrated (TestLeafDiffCoverageMetaHasTeeth: drop a scenario ⇒ the comparison names the uncovered tags), and the diff-minus-fold NAMING path is exercised per-class for S/B/T via real recompute ops with one emission dropped (TestLeafDiffNamingPathPerClassSBT, red-before-green). Test-only; no apply / class-M / consensus change; the box still never-Accepts.

v5 trustless floor box — close the class-P young→mature HANDOFF-boundary completeness gap (core/chain/floorbox_recompute_stateroot_rotate_v5.go, core/chain/floorbox_recompute_stateroot_v5.go, docs/thinking/2026-08-31-floorbox-handoff-boundary-completeness.md, 2026-08-31). apply latches everMature (the maturity latch, class M) BEFORE rotateEpoch (chain.go:3303-3316), so on the ONE boundary that flips everMature false→true — the young→mature handoff — real apply freezes the epochSet but the class-P recompute read the PRE-latch everMature and took the !everMature early-return, freezing NOTHING ⇒ recomputed root != committed StateRoot ⇒ STALL. SAFE (fold-caught, never a wrong-accept) but a LIVENESS gap: every real objective chain crosses the handoff exactly once, so the box could never validate that block. Every class-P positive test used MatureValidators=0 (mature-from-genesis), so the path was unexercised. The fix consumes the POST-latch value: post_everMature = pre_everMature || matureNow(thisBlock), computed by REUSING the existing maturity recompute (RecomputeMatureNow, #668) over the committed post-apply state, and gates the freeze on it. Because everMature is a committed v5 leaf (statehash.go:196), the box also reconstructs the everMature false→true WRITE on the handoff (there is no separate class-M recompute; P is the boundary class). Same class as R-P-sameblock-order, but for the everMature scalar. O(registry)-honest; NO apply/consensus change; the box STILL never-Accepts. Regression: a handoff-boundary POSITIVE test (young at genesis, matures at the boundary) that AGREES with real apply + StateRootForVersion(5) and FAILS against the pre-fix code, plus a pre-everMature ablation (RED). Test cleanups (blind Tester on #677): renamed the mislabeled ...AblationFlippedTally to ...AblationForgedFreezeWeight (it forges a freeze weight, not a tally; the load-bearing tally test is ...AblationLiveTallyForgedRegVersion); added a standalone epochSetRoot byte-exact check analogous to class A's ...AttDigestByteExact.

PoD §7.3 BATCH 3 review fold-in — the paid e2e made -race clean and CI-caught (e2e/relay_paid_test.go, .github/workflows/ci.yml, 2026-08-30). Two follow-ups from the Batch-3 reviews, no guard weakened.

• Resolver stopped-loop hardening — DEFERRED (gate #651). The off-loop ResolveRelayAuthorizer marshals the session lookup onto the node loop and blocks on the reply — safe today because the production loop never stops (PE-verified). A future graceful-shutdown (loop.Stop() while the relay Server still accepts) would leak one blocked resolver goroutine per paid connect. The naive fix (time.After in a select) violates build-immutable #5 (no time in core) and a Clock-based timeout is loop-bound (dropped when the loop stops), so bounding this read needs a port/placement decision. Reverted to the PE-SHIP'd bare marshal-and-read (86990af) and tracked as gate #651; whoever adds graceful shutdown owns bounding it.
• e2e harness data race (Tester, failing-first). TestPaidRelaySessionEndToEnd polled ledger.Balance / ledger.Reputation directly from the test goroutine while the event loop wrote the same field at settle (RedeemRelayCredit). The Ledger is loop-only by design (no mutex). Both reads are now MARSHALED onto the relay node's loop and returned over a cap-1 reply channel. TEST-ONLY — the production Ledger stays mutex-free (loop-only invariant not weakened). The race is now real under -race (was: test read vs core/credit/relay.go:73 write) and passes with the fix.
• CI now runs the in-process paid-relay e2e under -race. The -race job uses -short, which the e2e skips; the plain e2e job ran without -race. So the harness race would have shipped green. The e2e job gains a dedicated -race step pinning TestPaidRelaySessionEndToEnd, with a === RUN assertion so a stale -run filter (which go test treats as a silent 0-exit "no tests to run") fails the step loudly.

PoD §7.3 transport BATCH 2 — the wire protocol (step 3) + the paid forwarding pump (step 4), failing-first, the live-networking batch (ports/net.go, ports/ports.go, core/relaypay/wire.go, core/node/relaytransport.go, core/node/relayrole.go, core/node/node.go, adapters/relay/paid.go, 2026-08-30). Wires the Batch-1 machinery to live transport: a fetcher opens a paid relay session over the wire, pays increments, and the relay settles at close. REUSES the Batch-1 S-clamp, M0 guards, and epoch-tied eviction — they are not re-implemented. See docs/thinking/2026-08-30-pod-7.3-transport-design.md §1, §2, §6, §7.

• The wire protocol (step 3). Three request/reply kinds on the existing ports.Message dispatch, mirroring the delivery-receipt lane: MsgRelayOpen (fetcher commits chain root + funding + S), MsgRelayPay (a preimage reveal that authorizes the next increment(s)), and their acks. Settlement is LOCAL at close — NO wire message (the fetcher already paid at blind withdrawal; the relay redeems its highest preimage via RedeemRelayCredit). handleRelayOpen routes through OpenRelaySession, so the Batch-1 S-clamp / M0 guards / eviction all fire on the live path; handleRelayPay drives the carried-S Verifier (bounded advance). Sender side: OpenRelaySessionRemote + SubmitRelayPay. A live session table on the relay keyed by handle; single settlement at close via SettleRelaySession (the verifier's monotonic count is the accumulator). RedeemRelayCredit is now on the ports.CreditLedger interface.
• The paid forwarding pump (step 4). adapters/relay/paid.go: a payment-gated long-stream pump (paidPump / paidSession / Server.SplicePaid) that forwards the paid direction up to the node-owned authorizer's ceiling (raised on each verified pay), pay-as-you-go — if the fetcher stops revealing, the relay stops forwarding and the stiff is bounded to ONE increment. THE SPLICE-EOF GOTCHA: the existing splice closes BOTH conns on the first EOF (swarm exchanges are short-lived); a paid ≤1 GiB session is not. The paid pump does NOT tear down the paid forward stream on a reverse-direction EOF — the forward stream ends on its OWN completion, never on the reverse direction closing. The verifier and M0 guards stay in core/node (the tested layer); the adapter is a dumb byte pump that only knows how many bytes it is cleared to forward (design §2 Option A).
• Failing-first tests (each RED before its code, verified by ablation): adapters/relay/paid_test.go — TestPaidPumpForwardsOnlyAuthorizedBytes (pay-then-forward gate; RED when the gate is removed), TestPaidPumpSurvivesReverseEOF (RED against the naive both-close-on-EOF splice), TestSplicePaidFullSessionOverTCP (a real paid session over TCP, reverse-EOF mid-stream, settlement basis exact). core/node/relaytransport_test.go — TestRelayFullSessionConservedSettlement (open → pay N → settle redeems exactly N × increment, conserved; RED on a double-settle), TestRelaySettlementLogCarriesNoDurableField (the M0 residual: the settlement log line carries no durable/cross-session-stable field; RED when a field leaks), TestRelayWireGuardsFireOnLivePath (the Batch-1 M0 guards + the #644 clamp fire when driven through MsgRelayOpen; RED when the wire bypasses OpenRelaySession).
• Residual for the reviewer. The daemon control-frame binding — carrying a "paid" marker on the relay adapter's connect/accept frames and handing the node-owned Authorizer into SplicePaid on the live TCP path — is the remaining integration seam. The pump primitive and the wire lane are proven in isolation and over TCP; wiring the two across the daemon's adapter/node boundary is the follow-on.

PoD §7.3 transport BATCH 1 — carry S (#644 DoS clamp) + epoch-tied seen-map eviction (#645), failing-first, pure core (no wire) (core/relaypay/payword.go, core/node/relayrole.go, core/node/node.go, core/chain/chain.go, 2026-08-30). Closes gate issues #644 and #645, the two transport IOUs the PE ruling required BEFORE any wire. No wire protocol and no forwarding loop (steps 3–4 of the decomposition are untouched). See docs/thinking/2026-08-30-pod-7.3-transport-design.md §3–§5, §7.

• #644 — carry S, clamp the walk. relaypay.NewVerifier(root, S) now carries the committed chain length S. AdvanceTo REJECTS claimedCount > S before the hash walk, bounding the worst case from the ~5M-hash spin the PE measured to at most S hashes. OpenRelaySession clamps the accepted S <= relaypay.MaxChainLength = MaxSessionBytes / RelayIncrementBytes = 262,144, derived RELAY-SIDE from the relay's own config and the protocol increment — never trusted from the fetcher. Verifier.Advance rejects a reveal once count == S (a fetcher revealing the raw tip would otherwise push count to S+1, an unfunded increment past the committed budget). count is the monotonic single-settlement accumulator: count increment <= S increment <= the fetcher's paid-in blind credit. Failing-first tests: TestAdvanceToClampsToChainLength (a per-Verifier walkSteps field proves the walk stays <= S; RED shows 5,000,000 steps unclamped), TestOpenRelaySessionClampsChainLength, TestRelaySessionPayCannotExceedChainLength.
• #645 — epoch-tied eviction with a monotonic floor. relaySeenEph/relaySeenRoot now tag each admitted ephemeral identity / chain root with its admit-EPOCH and are swept lazily on OpenRelaySession. Eviction is epoch-TTL (retention = current + previous epoch), NOT raw FIFO — a re-admitted root would be a guard-(ii) longitudinal regression. The eviction floor is MONOTONIC: it never lowers on a reorg (epochStart is reorg-swapped), so a backward epoch move cannot un-evict. The epoch is read from the chain (Chain.EpochBlocks(), a new read-only getter; head height / EpochBlocks). Failing-first TestRelaySeenMapEvictsOnEpoch ablates all three properties to RED: unbounded growth (no sweep), too-eager eviction (previous-epoch reuse slips through), and a lowered floor on reorg.

PoD §7.3 relay compensation — the certified PayWord mechanism, failing-first (core/relaypay/payword.go, core/credit/relay.go, core/node/relayrole.go, cmd/silt/daemon.go, 2026-08-30). A relay/gateway forwards content-blind bytes and cannot sign a completed-delivery receipt, so it is paid as-it-goes by a sender-funded PayWord hash chain (docs/design/pod.md §7.3, certified 2026-08-30): the fetcher commits a chain root once, reveals one preimage per forwarded increment, and the relay verifies each with one SHA-256 (H(x_k) = x_{k-1}) and redeems the highest into its operator BALANCE. New core/relaypay primitive (chain build + relay-side incremental verify, SHA-256 only, no new dependency). RedeemRelayCredit is the conserved-transfer sibling of RedeemDeliveryCredit: it moves balance only, drawn from the fetcher's already-paid blind credit, never mints, never touches Reputation — classified neutral in the Invariant-A reflection guard (the γ→1/N firewall; a PayWord chain is fundable with zero object bytes by design). Two M0 access-privacy guards (immutable Don't-#3) are enforced by construction in OpenRelaySession and ship failing-first: (i) a chain funded by a DURABLE-account credit is REJECTED (funding must be an ephemeral blind credit, client.WithdrawDemandTokenPrivately); (ii) a reused ephemeral identity or chain root across sessions is REJECTED (no longitudinal linkage). Consumer gate --accept-relay-payments mirrors --accept-delivery-receipts, OFF by default. The increment size B is a single named constant relaypay.RelayIncrementBytes = 4096 (4 KiB), derived analytically from the floor-box-equivalent measurement (build-immutable #8, no billable run): the binding constraint is the chain-state memory bound — 1 GiB max object / 4 KiB = 262,144 increments, chain state 8 MB (MB-scale, fetcher-side); verify overhead (order ~100 ns SHA-256 on arm64) is slack at any real relay speed. BenchmarkPayWordVerify times the real Verifier.Advance. See docs/thinking/2026-08-30-pod-7.3-relay-compensation-design.md §5.

PoD §7.3 relay compensation — blind-review fixes (PE SHIP-WITH-FIX + Tester PROMOTED) (core/relaypay/payword.go, core/credit/relay.go, core/credit/relay_test.go, 2026-08-30). RedeemRelayCredit now takes the fetcher's paid-in budget as a REQUIRED parameter and REJECTS any chainValue > budget (the conservation cap — bakes the B3-close bound into the settlement contract so a future transport caller cannot over-redeem past what the fetcher funded; ships failing-first as TestRelayRedeemCannotExceedPaidInBudget, RED without the cap). Corrected the false safety comment on Verifier.AdvanceTo — the walk is NOT bounded (it runs claimedCount - count unbounded hashes before rejecting; the caller MUST bound it), and the 8 MB chain state is FETCHER-side, not the relay's (the relay holds one 32-B preimage). The AdvanceTo S-clamp (gate #644) and the relaySeenEph/relaySeenRoot epoch-tied eviction (gate #645) are tracked as blockers for the transport increment, not fixed here. TestRelayCreditNeverTouchesStanding now iterates past bondUnit (65,537 > 64<<10) so a sub-threshold per-call standing leak cannot hide. Verify-cost figure corrected to order ~100 ns on arm64 (measured ~110–270 ns/op on M4; the B-derivation conclusion is unchanged — constraint (a) is still slack by ~100×).

PoD §7.3 transport BATCH 2 — bound the live relay-session table (leak fix, failing-first) (core/node/relayrole.go, core/node/relaytransport_test.go, core/node/relayrole_test.go, 2026-08-30). Closes the MEDIUM the blind PE ruling surfaced (RULING-pod-7.3-transport-batch2-2026-08-30.md): handleRelayOpen inserted a relaySessions entry on every guard-passing MsgRelayOpen, but the only removal (SettleRelaySession) is not wired on the live path, so the daemon flag --accept-relay-payments grew the table without bound from cheap fresh-identity opens. Two bounds, mirroring the #645 seen-map fix: (1) an epoch/TTL SWEEP — each session is stamped with its admit epoch and reaped by sweepRelaySeen on the SAME monotonic floor as the seen maps once it ages past the retention window; (2) a hard per-node CAP (relayMaxLiveSessions = 4096, tunable) — an open past the ceiling is refused (OK=false), bounding growth BETWEEN sweeps. TestRelayOpenFloodStaysBounded is RED under either ablation (cap removed → table exceeds 4096; sweep removed → stale sessions survive the epoch advance); TestRelaySettledSessionRemovedPromptly pins prompt removal on settlement. No Batch-1/Batch-2 guard, M0 guard, or conservation cap was weakened. TODO(Batch-3): when the daemon control-frame binding wires SplicePaid, the session sweep must tear down a reaped session's pump.

era-4 increment 4d — height-gated activation + mint-flip to v5 (the go-live gate) (core/chain/chain.go, core/chain/era3validity.go, core/chain/statehash.go, core/node/chainrole.go, core/chain/modelcheck_era4_activation_test.go, 2026-08-29). Flips MINTING to BlockVersionWitnessable (v5) at/above the era-4 activation height, the exact mirror of era-3 step 2c one era up: an era4LockedIn/era4Height activation latch (the era-3 tally reused with the readiness bar at regVersion >= 5), an era4Active height gate, a MintVersion extension (v5 at/above H_era4), PopulateEra4Roots, and a validateEra4Version version-boundary rule enforced on EVERY disk-write path (commit + own-disk Reload). The two activation scalars are committed as V5-ONLY leaves (tagEra4LockedIn/tagEra4Height in stateRootLeavesV5), so the frozen era-3 (v4) root stays byte-identical (#632). era-4 layers on era-3 (a v5 block commits a superset of the v4 leaves): New PANICS if a genesis-declared Era4ActivationHeight is set below Era3ActivationHeight. The mainnet activation height is a consensus value the HUMAN ratifies — Era4ActivationHeight ships with NO default; the post-latch readiness tally derives H_era4 from committed history. Does NOT re-touch the v5 predicate, RegCap, or the maintenance spine (4c/4b own those). Every activation gate ships with a demonstrated RED (the six ablations in the approach doc). See docs/thinking/2026-08-29-era4-4d-activation-mintflip-approach.md.

Hardened the era-3 freeze guard TestEra3RootByteIdenticalWithV5KeyspacesPresent (core/chain/modelcheck_stateroot_determinism_test.go, 2026-08-29). The withoutV5 baseline now zeroes the era-4 latch scalars (era4LockedIn/era4Height) too. Before this, populateCommitted set those scalars in BOTH baselines, so an era-4 scalar leaked into the v4 (era-3) marshaller under a FRESH UNREGISTERED tag appeared identically in both and CANCELLED — the guard stayed green on a real leak (the disjointness guard catches only registered-tag reuse). With the scalars zeroed, an unregistered-tag leak now diverges the two v4 roots and reddens the guard, closing the coverage gap against the era-3 byte-identical FREEZE (#632).

era-4 increment 4c — the v5 validity predicate + RegCap + version-widen (PREDICATE-FIRST) (core/chain/chain.go, core/chain/modelcheck_era4_regcap_test.go, 2026-08-29). Widens versionSupported to <= BlockVersionWitnessable (v5) so a v5 block DECODES, atomically with the era-4 validity rules — closing the era-3 interim window (a version decode-accepted before its validity rule existed). Two enforced rules: (1) the RegCap = 256 per-block TOTAL BondReg count validity rule (fresh AND renewal, counted AFTER canonicalBondRegs) — a v5 block with more than 256 registrations is INVALID, which bounds any single TTL due-bucket's inflow to a registry-INDEPENDENT constant (the O(registry) TTL-firing witness read-set era-4 exists to remove; Research CERTIFIED the total-count rule and the value 256 for it). (2) the v5 committed-root predicate, which needs NO new code: validateEra3Roots recomputes via StateRootForVersion(b.Version), so a v5 block flows through it on EVERY disk-write path (commit path via ValidateProposal, own-disk Reload via appendStructural) the instant the ceiling widens. v5-GATED: v4 (era-3) stays byte- and behaviour-identical — RegCap does not apply to v4 and the frozen era-3 format (#632) is untouched. Does NOT mint v5 (BlockVersion / MintVersion stay v4), add an activation height (4d), or touch MaxBondRegBytesPerBlock (proposer policy) or the 4b spine. Records the re-derivation gate: RegCap is a function of all SEVEN determinants (B, k, Samples, BlockSize, BondVDFDelay, MinBond, proof scheme), re-derived at the next BlockVersion mint. Ships the RegCap regression suite (over-cap reject for all-fresh / all-renewal / mixed; at-ceiling accept; count-after-canonical-fold; v4-unaffected) and the v5 Reload wrong-root rejection — each demonstrated RED before green. See docs/thinking/2026-08-29-era4-4c-v5-predicate-regcap-approach.md.

era-4 4c test hardening — pin the ratified RegCap value from BOTH sides (core/chain/modelcheck_era4_regcap_test.go, core/chain/modelcheck_era3_schema_test.go, 2026-08-29, test/comment-only). Replaces the self-referential fixture sizes (derived from the RegCap constant, so a wrong cap moved both sides together and stayed green) with the LITERAL ratified value: the at-ceiling accept test pins 256, and the three over-cap reject tests (all-fresh / all-renewal / mixed) pin 257. The value is now pinned against a too-LOW mistake (const RegCap = 255 reddens the at-ceiling test) AND a too-HIGH mistake (const RegCap = 257 reddens the over-cap tests), both demonstrated. Also fixes a dangling comment reference to a non-existent TestV5DecodesAndIsAccepted.

era-4 increment 4b — the maintenance spine (v5-gated, inert on the live chain) (core/chain/chain.go, core/chain/statehash.go, core/chain/era3validity.go, core/translog/translog.go, 2026-08-29). Adds the two live-maintained derived committed maps qualified (E-2, the boundary-computation accelerator) and the due-height index dueBucket (T-3), and promotes epochStart to committed (O-1). Wires the five qualified maintenance hooks at the bonded/slashed mutation sites, the due-bucket insert/move/delete at the TTL machinery, and the boundary copy epochSet := qualified (rotate-LAST; the #535 recovery boundary freezes from the liveQualifiedSet recompute, the Q5 coupling). Commits all three under the state root as v5-ONLY leaves via an era-gated marshaller (stateRootLeavesV5 / StateRootForVersion), so a v4 block's committed root stays byte-identical to era-3 (the era-3 freeze is preserved). The due-bucket value is an RFC-6962 MTH over the CANONICAL (sorted-ascending / dedup / unpadded) id list, reusing translog.MTH. Does NOT widen versionSupported, add the v5 predicate or the RegCap rule (4c), or activate (4d) — inert on the live v4 chain. Ships two drift guards (the qualified per-site guard reddens on the displacement site specifically; the T-3 dual-source guard reddens on a missed renew old-bucket delete), the byte-identical era-3 replay guard, the rotate-LAST stale-capture ordering ablation, and the Q5 recovery-agreement guard — each demonstrated RED before green. Does NOT touch MaxBondRegBytesPerBlock (proposer policy). See docs/thinking/2026-08-29-era4-4b-maintenance-spine-approach.md.

era-4 increment 4a — schema + classification (inert) (core/chain/chain.go, core/chain/statehash.go, 2026-08-29). The first code increment of the ratified era-4 build. Mints BlockVersionWitnessable = 5 and defines the three era-4 field tags tagDueBucket, tagQualified, tagEpochStart reserving their on-wire byte layout. INERT on the live v4 chain: the tags carry no leaves and are NOT yet in stateRootTags or classified, so no v4 block's committed state root changes (the era-3 byte-identical/coverage guards stay green). Does NOT widen versionSupported (held to 4c, predicate-first), add maintenance maps (4b), add the v5 predicate (4c), or activate (4d). See docs/thinking/2026-08-29-era4-build-decomposition-options.md, increment 4a.

witness floor-box validation — R3 DoS bound (byte caps + shape gate) (core/statehash/witness_bound.go, 2026-08-29). The pre-verify resource gate that guards the R4 accessor. At witness ingest, before any proof is parsed or verified, three gates decide which witnesses are admissible: (1) a per-proof byte cap S_proof_max = 16 KiB, enforced on the ENCODED size BEFORE unmarshal (a byte cap, not a side-node count — the pokt library leaves NonMembershipLeafData byte-unbounded, so a count cap ships and lies); (2) a per-block byte ceiling C_block = len(read-set) · S_proof_max, derived per block from the exact read-set (not a flat constant — it scales with the block, needs no per-block transition cap, and is not a consensus change); (3) a shape gate — the witness bundle must carry a proof for EXACTLY the block's read-set (no unread key, no duplicate, no missing read key). The safety-critical wiring: EVERY rejection — over per-proof cap, over per-block ceiling, shape mismatch, malformed/unparseable — resolves to the R4 accessor's NoWitness outcome, NEVER ProvenAbsent. A rejected witness read as a proven exclusion is the one banned move of C-7 (§104); the ingest builds only NoWitness Results on rejection, and ProvenAbsent is reachable only through the R4 Resolve admit branch. Security parameters (S_proof_max = 16 KiB, the C_block derivation) certified by witness-floor-box-dos-bound-RESEARCH-CERTIFICATION-2026-08-29 and ratified by Andrew; mechanism by RULING-witness-floor-box-mechanism-2026-08-29 (R3). Ablation tests (core/statehash/witness_bound_test.go) each watched RED-then-GREEN, including the conflation guard (an over-budget/malformed/shape-violating witness for an ABSENCE-query key must resolve to NoWitness, never ProvenAbsent). Scope: the byte caps + shape gate only; D-2 on-demand delivery and the A-serve slow-loris read deadline (a TIME attack the byte ceiling does not close) are increment 3. No consensus-rule (I1–I5) or frozen era-3 format change — a validation-layer bound (precedent: MaxBondRegBytesPerBlock is proposer-policy-only).

witness floor-box R3 — Kind/Value disagreement + a weak gate-1 test (core/statehash/witness_bound.go, core/statehash/witness_bound_test.go, 2026-08-29). Two follow-up fixes on the R3 DoS bound. (1) Safety (blind PE review): a ReadEntry{Kind: QueryPresent, Value: nil} (or empty Value) silently resolved to ProvenAbsent — Resolve routes a length-0 value to the non-membership branch, so a presence query with no value verified against an absence proof read as a proven absence (Kind and Value disagree, Value won; the same class as the R4 empty-value finding). IngestBlockWitnesses now rejects a QueryPresent entry with an empty Value to NoWitness before Resolve — Kind is authoritative; a presence query with no value is never a proven absence. New ablation TestPresenceQueryEmptyValueNeverProvenAbsent (watched RED-then-GREEN). (2) Coverage (both Testers): the per-proof-cap ablation TestOverProofCapRejectedPreParse did NOT go RED when only gate 1 (the per-proof cap) was disabled — its single-key fixture (C_block = 1·S_proof_max) was then caught by gate 2 (the per-block ceiling), so the test stayed green and its name lied. It now uses a two-key read-set (C_block = 2·S_proof_max) with a small honest second proof, so the over-cap blob stays under the block ceiling and ONLY gate 1 can catch it — a genuine gate-1 discriminator (goes RED when gate 1 alone is removed). No consensus-rule (I1–I5) or frozen era-3 format change.

witness floor-box validation — R4-a three-valued accessor spine (core/statehash/witness.go, 2026-08-29). The safety spine of the semi-stateless floor box: an accessor that resolves a committed-set key against the committed StateRoot with a supplied SMT witness into one of THREE outcomes — ProvenPresent(value) (verified membership), ProvenAbsent (verified non-membership), or NoWitness (no proof, or a proof that failed to verify). The hard construction invariant: ProvenAbsent is constructible ONLY from a verified non-membership proof — the Result.outcome field is unexported and has exactly one ProvenAbsent construction site, guarded by the verified non-membership branch. NoWitness is the zero value, so the safe state is the default: every non-verified path (missing witness, failed verify, and — in later increments — an R3 over-budget or D-2 failed-fetch verdict) resolves to NoWitness, which the caller MUST treat as stall, never absent. This makes the one banned move of the C-7 certification (§104: "no witness supplied → accept") a type-level impossibility, not a code-review catch. Certified by C-7 and RULING-witness-floor-box-mechanism-2026-08-29 (R4). Ablation tests (core/statehash/witness_test.go) each watched RED-then-GREEN: a missing witness never yields ProvenAbsent; a wrong-root/tampered/membership-as-absence proof never yields ProvenAbsent; verified proofs classify correctly (not a vacuous all-NoWitness accessor); an empty-but-non-nil []byte{} value query against a valid absence proof resolves to ProvenAbsent, NEVER ProvenPresent (the MIRROR of the banned move: the pokt library selects membership vs non-membership on bytes.Equal(value, defaultEmptyValue) with defaultEmptyValue == nil, so Resolve keys on len(value) == 0 to match it and an empty value can never read present); and a source-scan asserts exactly one construction site EACH for ProvenAbsent and ProvenPresent, so a second (banned or mirror-banned) one REDs before it can ship. This increment builds ONLY the accessor; the R3 per-block byte ceiling and D-2 on-demand delivery are separate increments that feed its NoWitness arm. No consensus-rule (I1–I5) or frozen era-3 format change — a validation-layer accessor.

era-3 version-boundary rule enforced on the own-disk Reload path (step 2c defense-in-depth symmetry). Closes the asymmetry a blind PE ruled (RULING-era3-step2c-activation-mint-flip-2026-08-29): 2b duplicated the era-3 ROOT check onto appendStructural (the Reload/own-disk path), but the 2c VERSION-boundary rule (ErrEra3VersionRequired — a v2 block at/above H_era3 is invalid) lived only on the commit path (ValidateProposal/ValidateCommit). The rule is extracted into a named validateEra3Version and now run on BOTH consensus-entry paths, BEFORE apply (a rejected block is never left applied — the longest-valid-prefix contract). Not exploitable today (a valid quorum-signed v2 block cannot commit at/above H_era3), but a future disk-write path (fast-sync/import) is where the gap could turn into a hole. The write-set guard TestEveryDiskWritePathRunsTheEra3RootCheck now requires every disk-write path to run BOTH the root check AND the version rule — a path enforcing only the root check REDs (a v2 block carries no roots, so the root check alone is era-gated off for it). New model-check tests (TestReloadRejectsV2AtEra3Boundary with the signature-valid-cause ablation, TestReloadV2BoundaryRuleDoesNotOverReject). No change to the activation condition, mint-flip, weight tally, epochSet freeze, ⌈A/2⌉, or value encoding. I5 preserved (validateEra3Version is a pure header check against committed state).

era-3 committed state-root activation + mint-flip to v4 (build step 2c, the FINAL step of the certified sequence). Height-gates the era-3 (v4) committed state-root format on a frozen-epoch-weight supermajority signalling regVersion >= 4 (BlockVersionStateRoot), the #506 lock-in machinery reused one readiness level up (research cert era3-committed-state-root-format-RESEARCH-CERTIFICATION-2026-08-28 Q5/Q7). New Config.Era3ActivationHeight (the pre-latch trusted-fleet override, mirroring RegGateActivationHeight) and derived committed state era3LockedIn/ era3Height: rotateEpoch tallies era-3-aware frozen weight and locks in one-way at the same >⅔ super-quorum, enforcing from the NEXT boundary (H_era3). New Chain.era3Active(h), Chain.MintVersion(h), and Chain.PopulateEra3Roots(b). At/above H_era3 the propose path (core/node/chainrole.go) mints v4 with the committed roots populated over the block's post-apply state; below it mints v2, UNCHANGED. ValidateProposal rejects a sub-v4 block at/above H_era3 (ErrEra3VersionRequired), and the 2b root predicate rejects a wrong-rooted v4 block — so once era-3 activates, a block must be v4 AND carry valid roots. Activation is derived from committed history and keys on finalized epoch boundaries (#357 Condition A), so it is replay-identical and reorg-stable. era3LockedIn/era3Height are committedSet (under the state root), carried in adopt/cloneForDryRun and exercised by the completeness, order-independence (new era3SwingOrderings same-id two-version swing), and leave-one-out (new era3World/era3Probes) oracles. New model-check tests (modelcheck_era3_activation_test.go) assert the mint-flip, the boundary rejection, the weight-counted readiness gate, monotonicity, and reorg-stability, each with a demonstrated ablation RED. Invariants: I1/I2/I4 untouched; I3 relied on (the rule change integrates only at a finalized boundary, by weight); I5 preserved (pure functions of committed state).

era-3 committed state-root SCHEMA + HASH (build step 2a of the certified sequence) (2026-08-29; format ratified, mint-v4 correction ratified, this step is model-check-tier only). Commits the two roots INTO the block schema so attesters sign them, and makes a v4 block decodable — WITHOUT flipping what nodes mint. New Block fields StateRoot and LogRoot (*ports.Hash, cbor tags 15/16, omitempty), both folded into the Hash unsigned body (unlike Atts/PrepareQC/CommitRound/Pruned, which are excluded) so a forged root cannot ride a valid signature. New BlockVersionStateRoot = 4; versionSupported widened to <= 4 so a v4 block DECODES and is accepted (research cert Q7 mint-v4 requirement — a v4 block must not be silently mis-validated under era-2 rules); a version beyond 4 is still refused loudly with ErrBlockVersion. THE LOAD-BEARING COMPAT DECISION: an era-2 block hashes and validates BYTE-IDENTICALLY after this change (committed history is never re-interpreted). The roots are POINTERS because omitempty does NOT omit a zero fixed-size array — a plain ports.Hash would emit 32 zero bytes for every era-2 block and change its hash; the byte-identity oracle caught exactly that. A nil pointer is omitted (era-2 unchanged); a set pointer is emitted (era-3 always carries a definite, non-zero root — the empty-log root is sha256("") and the empty-state root is the SMT over the four always-present scalar leaves, both fixed non-zero constants). New modelcheck_era3_schema_test.go: a golden-hash byte-identity oracle (a v2 block hashes to its pre-2a value, verified against origin/main), a tamper oracle (a modified StateRoot/LogRoot fails the signature check), a decode oracle (v4 accepted, v5 rejected), and a population oracle (a v4 block carries the chain's StateRoot/LogRoot) — each with its defect injected and watched go RED. STOP boundary honored: no validity predicate rejects on a root mismatch (step 2b), no mint-version flip and no activation height (step 2c) — production minting stays BlockVersionRounds, so no v4 block is minted before its predicate exists. Compat deliberation in docs/thinking/2026-08-29-era3-step2a-commit-roots-schema.md.

era-3 committed state-root VALIDITY PREDICATE (build step 2b of the certified sequence) (2026-08-29; format ratified). Closes the 2a→2b window: 2a made a v4 block decodable and signed the roots, but NO predicate read them, so a v4 block validated on its era-2 merits alone. This step adds the v4-gated validity predicate (core/chain/era3validity.go, validateEra3Roots), hooked into ValidateProposal (the one root-check site — an honest attester runs it before signing, and ValidateCommit invokes it first, so both consensus-entry paths carry the check). For a v4 block it enforces: (1) both roots present — a nil StateRoot/LogRoot is rejected explicitly with ErrEra3RootMissing (the check 2a's omitempty schema deferred here, per the 2a ruling); (2) the committed StateRoot equals the SMT recomputed over the POST-APPLY committedSet (ErrEra3StateRootMismatch); (3) the committed LogRoot equals the POST-APPLY RFC-6962 revocation-log root (ErrEra3LogRootMismatch). Because the StateRoot leaves encode the bonded/epochSet WEIGHTS summed in the three super-quorum finality predicates, a wrong-value leaf is a consensus SAFETY attack, not a read bug — enforcing root == recompute makes the value encoding load-bearing, relying on the step-1 determinism oracle for cross-node byte-identity. The post-apply recompute runs on a throwaway clone (cloneForDryRun + the real apply), so live chain state is never mutated during validation; the clone uses the one authoritative state-transition function, so a value-encoding or apply bug surfaces identically on the proposer's and validator's side. New translog.Log.Clone deep-copies the transparency log for the dry run. ERA-GATING: the predicate fires ONLY for Version >= BlockVersionStateRoot (v4); a v2/v3 block validates under era-2 rules UNCHANGED (additive, strict-superset rejection). New modelcheck_era3_validity_test.go: accept (roots = independent post-apply recompute), wrong-StateRoot/wrong-LogRoot reject, nil-root reject, the v2-unaffected era-gate, the commit-path carry-through, and a drift guard (TestDryRunCloneCopiesEveryAppliedField, the #558 class — the clone must copy every history-derived field, distinct-backed) — each with its defect injected and watched go RED. Invariants: preserves I1–I5, alters none; it ADDS a v4-gated validity rejection and is a pure function of (block, committed state), so every honest replica computes the same verdict (I5). STOP boundary honored: no mint-version flip and no activation height (step 2c) — the predicate is inert in production until 2c because no v4 block is minted yet, but it is correct now so 2c cannot land before it. Deliberation in docs/thinking/2026-08-29-era3-step2b-validity-predicate.md.

era-3 committed-root check on the OWN-DISK Reload path (A-bare — closes the 2b reload gap) (2026-08-29; blind-PE ruled, no research gate). 2b enforced validateEra3Roots on the commit paths but the Reload→appendStructural own-disk replay path SKIPPED it, so a v4 block with a WRONG StateRoot re-signed with the proposer key was accepted at load. 2b's Decision-1 argument — "the signature covers the root, so validateStructural's signature verify rejects a bad root" — was WRONG: integrity ≠ root-correctness; a signature over a wrong root is still a valid signature. appendStructural now calls validateEra3Roots(&b) — the SAME clone-recompute predicate the commit path uses — BEFORE c.apply(b), so a rejection never leaves a bad block applied (preserving Reload's load-bearing "keep the longest VALID prefix" contract the daemon relies on). Reuses the SAME named errors (ErrEra3RootMissing/ErrEra3StateRootMismatch/ErrEra3LogRootMismatch) so proposer, validator, and reload agree or all fail; a v2/v3 block skips it (era-gated), UNCHANGED. New regression + guard in core/chain/reload_era3_boundary_test.go: TestReloadRejectsResignedWrongStateRootV4 (RED on a0f8839: Reload ACCEPTS the re-signed wrong-root block; GREEN with ErrEra3StateRootMismatch), an ABLATION subtest proving validateStructural accepts the re-signed block so the reject is the ROOT check not the signature, the LogRoot sibling, and a STRUCTURAL write-set guard (TestEveryDiskWritePathRunsTheEra3RootCheck) that enumerates every c.apply(b) caller and fails a FUTURE unguarded disk-write path (fast-sync/import) rather than a hand-maintained list. Invariants: preserves I1–I5, alters none — it extends an existing v4-gated validity rejection to a second disk-write path. Residual (named as a reopening item): A-bare re-validates each v4 root on boot at O(state)/block ⇒ O(depth²) over a full Reload — the hold-the-tree bridge until the incremental-SMT / ports.NodeStore keystone-store workstream (#600) makes StateRoot linear on every path, at which point the SAME call site becomes O(depth) with no change. Correction + reopening item recorded in docs/thinking/2026-08-29-era3-step2b-validity-predicate.md (Decision 1); PE ruling RULING-era3-reload-root-check-2026-08-29.md.

era-3 committed state-root computation (build step 1 of the certified sequence) (2026-08-28; format ratified, this step is model-check-tier only). Computes the two era-3 roots and proves the per-field value encoding deterministic BEFORE the root becomes a signed block field. New core/statehash package: the pokt-network/smt v1.0.0 keystone promoted from internal/smtspike into product code, with the pinned canonical value encoders (8-byte big-endian for the int64/uint64 weights and heights, raw 32 bytes for identity values, one byte for bools/regVersion) — widths and endianness are CONSENSUS PARAMETERS (research cert Q6). New core/chain/statehash.go marshals the 16 committedSet fields into field-tagged, canonically-encoded leaves and computes StateRoot; LogRoot reuses the existing RFC-6962 RevocationLogRoot. New determinism oracle (modelcheck_stateroot_determinism_test.go, research cert residual R2): same logical committedSet ⇒ byte-identical leaves ⇒ identical root, order- and node-independent, with a wrong-value ablation (perturb a value-carrying field → root changes) and two coverage guards: a tag-list guard binding the committed tags to the live keystone classification, and an EMIT guard that populates every committedSet field and asserts stateRootLeaves actually emits a leaf for each — so dropping a leaf loop of ANY class (including a Class-A loop like spent) turns the suite RED instead of silently dropping the field from the root (PE coverage-gap finding, proven by ablation). The order-independence and snapshot-equivalence oracles now assert ROOT equality, closing the gap between "the 16 fields are equal" and "the computed StateRoot is equal." STOP boundary honored: no Block field, no Hash change, no validity predicate, no BlockVersion/versionSupported change — those are later certified steps. Decision + freeze conditions recorded in docs/decisions.md; encoding deliberation in docs/thinking/2026-08-28-era3-state-root-value-encoding.md.

e2e flake (#583, third occurrence): derive the anchor-stop resume-observation window from the non-anchor catch-up cadence (test-harness only; the daemon and every consensus path untouched). TestAnchorStopHaltsBondedNonAnchors failed on CI a third time (val3 never observed a committed block after the anchors resumed, 76 s on CI vs 46 s local). Mechanism: after the driven publish commits on the resumed anchors, a bonded non-anchor that missed the live commit round heals on its next chainSyncTick, which reschedules every ChainSyncInterval (= 30 s) at an ARBITRARY phase. The old fixed 30 s observation window equalled EXACTLY one interval, so it caught ZERO catch-up sweeps in the worst phase — the same zero-overlap-margin defect #549-Q3 fixed. Derived the window per the #549-Q3 discipline: resumeObserveSweeps × ChainSyncInterval where 2 sweeps guarantee one fires regardless of phase and the 3rd is the measured ~30 s CI/local load stretch → 90 s. The window stays a POLL, so a genuine non-anchor halt still fails fast (proven RED by injection). An init guard fails the e2e package if the window is ever lowered below the two-sweep phase floor, so a fourth silent reroll is impossible. Derivation: docs/thinking/2026-08-28-583-anchorstop-resume-window.md. Measured 16/16 green locally (+13/13 in a prior run cut short by the default go-test timeout).