What's changed

Bond-reg drain staleness (factor ii of the MATURING cadence wall): accept a reg over the last K committed heads — A bond registration is signed over BondRegNonce(prev) and was validated only against the current head, so the instant the head advanced a reg in flight went stale and was refused. Over a real WAN (a proposer proposes on head-advance before the resubmission arrives) this starved the drain — blocks committed empty below the #286 byte cap and maturity never reached bar-2 in-window (the instrumented run measured the goroutine ≤7% busy, so it was never CPU; this staleness race was the cause). validateBondRegs/ValidateBondReg now accept a reg whose proof validates against any of the last BondRegHeadWindow committed heads (default 8, deterministic walk), removing the one-head brittleness while keeping freshness bounded (K ≪ BondTTLBlocks, and continuous bond-audit re-challenges possession — so a released-and-replayed old reg still decays out; pinned by a beyond-window-rejected test). Paired with a durable pending queue — the proposer now keeps valid regs that didn't fit the byte cap instead of wiping the whole pending set and relying on a re-broadcast. Failing-first + the #406 model-check tier (I1–I5) green. The K-vs-anti-release bound is a C1 parameter flagged for a research security-check.

#424 — bond-audit answer path was a remote-triggered CPU-DoS; add a per-challenger rate-limit — Answering a bond challenge forces a fresh sequential VDF-eval (an unpredictable nonce, so it can't be precomputed) on the node's single event-loop goroutine, and answerBondChallenge served one on every incoming MsgBondChallenge with no per-challenger limit — so one peer flooding challenges could pin a validator's thread and starve its token-issue/commit/sync handlers (red-team seam #7). allowBondChallenge now caps evals served to a single challenger per BondAuditInterval window (bondChallengeBurst=8), refusing the excess before the costly eval so a flood gains no amplification. The cap is per-challenger (not global) so a flooder cannot starve honest challengers of their own budget; honest cadence is one challenge per peer per window, well under the cap. This also caps the O(n) audit fan-out that is a suspect for the MATURING single-goroutine saturation wall (PR #423 instrumentation will name the dominant term). The exact cap borders the audit path — flagged in #424 for a research/PE confirm.

cloudtest: the C2 no-capture flow's PASS verdict crashed on an unbound variable (P1 run b525b0b-87478), dropping an otherwise-green result — scenarios.sh:832 wrote the no-quiet-capture PASS with ($h1→$h2) — an UNBRACED $h1 immediately before the multibyte →. macOS /bin/bash 3.2.57 under set -u absorbs a byte of the multibyte char into the identifier (parsing h1<0xe2>), which is unbound → the record crashed BEFORE writing, so the C2 drill — which behaviorally passed (sybils couldn't advance with anchors down; a driven block committed + synced when they returned) — recorded no verdict and dropped out of results.jsonl. Root-caused by reproducing the exact bash: h1�: unbound variable on bash 3.2. Fix: brace the vars (${h1}→${h2}); swept + fixed the one other instance (${cp}… at the WS cold-sync line). Regression guard integration/cloudtest/check_shell_multibyte.sh (a STATIC lint — the bug is bash-3.2-specific, so a Linux/bash-5 runtime test can't catch it) is wired into CI. Harness-only; no product change (the C2 property held on WAN).

#402 — the launch anchor gate is now a DERIVED strict anchor majority ⌊A/2⌋+1, structural in objective mode (research-certified consensus fix; encoding B) — Closes the launch face of the intersecting-quorum invariant (I1). Two parts: (1) anchor-only launch proposing — during the young window only anchors propose; a bonded sybil drains via MsgSubmitBondReg (submit-don't-propose, #397), removing the sybil-proposed fork at its source. (2) The commit gate now requires a strict anchor majority ⌊A/2⌋+1 (=3 of 4) counting the proposer-if-anchor, derived from len(Anchors) in objective mode independent of the -anchor-quorum knob — so a missing/low config can never disable quorum intersection. Attribution correction that drove the structural choice: the field run (4faaee8-22913) left -anchor-quorum unset (flag default 0 → gate inert), so the fork needed no free anchor — a two-sybil-signature quorum committed it. The consult's proposed AnchorQuorum=⌈A/2⌉ (=2) was insufficient: a both-sybil-proposed 2-2 anchor split satisfies it and the finality gate then cements a permanent conflicting-finalization partition. Legacy (non-objective) mode is unchanged (configured AnchorQuorum capture-prevention floor, no finality gate). Fault tolerance is the same 3-of-4 (1-fault-tolerant), now uniform and intersecting. Failing-first repros in core/chain/fork_anchor_gate_402_test.go (the 2-2 split; sybil-can't-propose; derived-ignores-config; 3-of-4 liveness); seam-7 equivocation test re-expressed at A=3 to keep its lone-culprit property under the majority rule. Certification: silt-reviews/.../fork-anchor-gate-402-RESEARCH-CERTIFICATION-2026-08-14.md; deliberation: docs/thinking/2026-08-14-402-anchor-gate-encoding-and-derived-threshold.md. Invariants: I1 (launch intersection), I3 (set = membership).

cloudtest flow 5: the C2 resume clincher now DRIVES a block after restoring the anchors instead of waiting for a spontaneous one — Three runs GAPed "chain did NOT resume within 180s" after the anchors returned. Attributed from the captured journals (run 9b2198e-67673, the #396 evidence harness): the restored anchors were fully healthy — bootstrapped in seconds, standing back, bond challenges passing — but the chain is reactive (B6): every due renewal was drained into blocks before the stop, and renewal-due is HEIGHT-based so a frozen chain mints no new ones — the restored network was legitimately QUIESCENT, and the clincher's wait mis-graded healthy idleness as a liveness gap. (The pre-#397 drain over-proposed own renewals — an accidental heartbeat that masked this.) The clincher now restores the anchors and then drives a publish until it commits and the Sybil syncs it (the same drive-then-verify pattern as flow 10's B2 drills), turning the verdict into a driven verification. Harness-only; no product change.

#397 — an honest proposer can no longer be slashed for a protocol-manufactured double-sign (research-certified consensus signing fix + the certified race closures) — The first evidence-instrumented field run (b88245d-3496) wedged at a 2-2 fork at height 6 with BOTH racing anchors permanently slashed as equivocators: proposeBlock signed a proposal without recording it in the never-sign-twice ledger (only attestations were recorded), so when two renewal-clock-aligned anchors proposed the same height, each found an empty ledger and honestly attested the competitor's block — signing two different blocks at one height; the cross-fork scan then correctly slashed both honest anchors on both branches and the anchor-quorum chain died (publishes failed with validators 4/4 reachable; restarting the anchors could not undo the committed slash). Research certification (silt-reviews/…/honest-proposer-cross-attest-RESEARCH-CERTIFICATION-2026-08-14.md) established the launch finality quorum was already intersecting (support-3-of-4; the double-commit was the bug-manufactured >f break, not a quorum-design flaw) and certified this fix set, all shipped here: (Q1) a proposal now enters the same never-sign-twice ledger as an attestation at sign time — (Q1b) replaced by a persisted monotonic {height, hash} watermark fsync'd BEFORE any consensus signature is released (adapters/markstore, the Tendermint priv_validator_state pattern; wired refuse-to-start in the daemon), so a crash/restart can no longer wipe the mark and let a validator contradict a signature it already shipped — permanent slashing (Q3, unchanged) is sound only with this; (Q2b) the two certified liveness race-closures: the drain takeover fallback now readmits one proposer per sweep by rank (was: every eligible proposer at once after 3 idle sweeps), and a non-designated proposer whose only pending work is its own due renewal submits it (SubmitBondRenewal, already broadcast every sweep) instead of proposing — removing the genesis-aligned renewal-clock collision that drove the field race; (Q4) two detection bugs: the local ledger slash is now idempotent-once per culprit (it re-applied and re-logged every ~2s reconcile sweep for as long as the fork stayed live) and a pending on-chain slash record now requeues until a commit confirms it (the requeue list was built but never appended to, so a slash whose carrier proposal failed to gather quorum was silently dropped). Failing-first regressions at unit + sim tiers: proposer-refuses-competitor, restarted-validator-refuses (crash variant), slash-idempotency, slash-requeue, submit-don't-propose, staggered takeover; the sim training-wheels test's doomed no-anchor attempt now uses an expendable proposer, mirroring its throwaway-attester convention (its old shape had the proposer double-signing height 1 — the exact #397 hazard).

Mature-phase quorum is now WEIGHT-counted — closing a cheap-member stall/capture seam at the handoff (B2, research-certified consensus change) — The research certification of the token-gather consult (Item B2) refused to confirm the drafted mature-phase residual and instead found a real break: post-handoff, commit quorum was sized by member count (bftThreshold(len(epochSet)), ValidateCommit counting distinct attesters) while epoch admission is deliberately unfiltered (#357 Condition A seats every qualified bond). Every MinBond identity riding an honest handoff therefore weighed one head: 8 cheap members among 4 honest validators made the mature phase born unable to commit (stall at 8×MinBond, nothing slashable — the cohort just declines to attest), and 9 made a cohort-only commit valid with zero honest attestation (capture at 9×MinBond, persisting into full maturity) — a C1-discount + C2-quiet-capture break, caught by the PE addendum + research escalation rather than the external red team. The fix adopts the settled pattern (B8 — Tendermint voting power, Casper FFG ⅔-of-stake): a mature-epoch commit's coalition (proposer + distinct qualified attesters) must now carry strictly >⅔ of the frozen epoch's bonded weight (requireEpochWeightQuorum; new ErrNoQuorumWeight), replacing the head-count escalation (RequiredQuorum keeps only the Config.Quorum count floor there). Quorum weight and fork-choice weight are now the same frozen quantity (epochSet). The §3 finality gate stays engaged under the weight rule (finalityQuorumActive: two >⅔-weight coalitions intersect in >⅓ weight, hence honest bond), and the proposer's gather asks the chain "is this support enough" (SupportMeetsQuorum) instead of counting heads. Launch phase is UNTOUCHED (fixed anchor set; the §2 repro stays green). Failing-first drills verified red against the head-counted code (capture committed, honest 97% weight coalition refused "3 qualified, need 8"): core/chain/quorum_weight_test.go — cohort-only capture refused ErrNoQuorumWeight; honest weight commits through a declining cohort; strict-⅔ boundary; plus the epoch Condition-A suites re-expressed in weight (frozen denominator across mid-epoch join and slash). The E4 owned-residual (bonded-minority stall) is now priced truthfully — its ⅓/⅔ claims were only true under weight counting, which research held it on. The §4 maturing-topology field flow gains the stall + capture drills as its sharpest red-team target (seam #8).

#303 — test-honesty audit: closed the 7 still-live positive-control gaps / confounds before the blind field test — Most of the 27 audited items were already fixed (PRs #304–312, #339); this closes the 7 that were still live, all in the integration harnesses (shell/compose only — no product code, go test ./... unaffected). Each fix makes the test FAIL if the property it claims to check is actually broken: the upgrade #69 finding is now gated on real reload evidence (reloaded storage proofs count + V1-had-no-persisted-proofs) so a HEAD-reload regression or mesh/decode confound can no longer masquerade as the ancient-V1 format boundary; consensus P2 replaces a vacuous "no reorg" grep (which passes trivially when the local fork is already heavier) with a real positive control (valA's own committed head byte-unchanged) plus an honest SCOPE note that inbound-fork receipt is not CLI-observable; cloudtest chaos-reprovide and restart-standing are scoped to the post-crash/post-restart boot via a new waitfor_since (--since @t0) so a stale pre-crash log line can't satisfy them; bond PHASE 2 gates the low-bond reject on an honest node first ACCEPTING a well-bonded proposal (-goodpropose), so a reject-everything node can't false-pass; retrieval adds a baseline cold-fetch positive control so a seed/registry saturation isn't misattributed to the #43 routing finding. Every newly-asserted string was grep-verified as real product output.

C2 field flow reported a FALSE capture — a lagging Sybil catching up read as an "advance"; the property itself HELD — The SYBILS=8 run FAILed 5-sybil-no-capture ("the Sybil cohort advanced the chain 26→37 with all anchors down"). Root-caused: NOT a capture. The flow anchored its "ceiling" to sybil-1's own head (h0), and under the run's load (see the participating-Sybil slowness, #382) sybil-1 lagged ~11 blocks behind the true committed tip; when the anchors stopped, sybil-1 caught up via normal SyncChain to the anchors' already-committed blocks (26→37) and the flow misread that as a Sybil advance — the same catch-up false-positive class the local harness already fixed, never ported to the cloud flow. Chain-level proof the property holds in this exact topology: core/chain/TestC2SingleDomainSybilsDoNotMature — 8 equal single-domain bonds cap NakamotoBonds at 3 (< MatureValidators 4) regardless of domain or margin, so the network cannot mature, the launch-anchor gate cannot shed, and a no-anchor Sybil quorum is refused with ErrAnchorRequired (verified). Fix: the flow now (a) anchors the ceiling to the true committed tip read from the anchors before stopping them (a catch-up caps at that tip, so it can't be misread as an advance), and (b) requires a fresh Sybil committed block log for a CAPTURE verdict (a catch-up logs chain reconciled, never committed block) — a height rise past the ceiling with no fresh Sybil commit is now correctly classed as catch-up (GAP: property held, drivability masked by lag), not a FAIL.

#338 cloud follow-up — the Sybil cohort ran a divergent quorum FLOOR that stranded it at genesis, so the C2 capture drill still could not be driven — The SYBILS=8 field run confirmed the drain + static-tier sync fix works (base validators reached tip 8, up from 3; every product corner green), but 5-sybil-no-capture still GAPed with the same signature ("sybil-1 never synced a committed chain, head 0"). Root cause, reproduced deterministically in-process (TestDivergentQuorumFloorStrandsSyncingNode338): the harness gave the Sybils -quorum 5 (a "self-majority"), while the anchors commit blocks at quorum 2. Config.Quorum is a hard FLOOR on ValidateCommit (max(Quorum, bftThreshold)), so when a Sybil re-validates the anchors' honestly-committed 2-attestation blocks inside Reconcile under its own floor of 5, every block fails ErrNoQuorum, the whole fork is rejected, and the Sybil is stranded at genesis — regardless of correct transport, static peers, and sync targets. In OBJECTIVE mode the "self-majority capture" is sized by bftThreshold over committed bond, not a config knob, so the fix is a uniform quorum floor across the objective swarm (topology.py: the Sybil role now runs the network -quorum, not n_syb//2+1). This both lets the Sybils sync (capture precondition met) and makes their capture attempt reach the real anchor gate (ErrAnchorRequired) rather than dying on a quorum count. The objective-mode quorum-floor footgun (a per-node floor above the network's bftThreshold silently breaks replica sync — arguably objective mode should ignore the local floor when validating committed blocks) is filed separately as a consensus-rule question, not changed here.

#338 — an idle young objective network never drained its deferred bond registrations; a non-attester validator had no path to the committed chain — Two structural gaps behind the local nakamoto 0 bonds state and the SYBILS=8 field GAP ("sybil-1 never synced a committed chain — anchors hadn't banked the Sybil bonds; capture precondition unmet"). (1) Reactive bond-registration drain. Pending registrations (#336-deferred off the lean genesis, peer-submitted via the H2 renewal path) were only ever folded into publish/revocation proposals — on a young network with no content traffic nothing proposed, so no validator (anchors included) ever earned committed standing and maturity was unreachable. Now a proposer-eligible validator holding pending registrations (or whose own is due) proposes a BondRegs-only block on the chain-sync sweep — reactive (B6: fires on pending state, quiesces empty), budget-bounded (#286 L2b), guarded by never-sign-twice-at-a-height (the failing-first repro caught two anchors drain-racing one height, cross-attesting, and equivocation-slashing EACH OTHER into a wedged chain) and a deterministic designated proposer per height derived from committed state (chain.EligibleProposers, ids[height % n], absent-proposer fallback after 3 sweeps). (2) The configured persistent-peer tier is now a chain-sync target (syncTargets): a validator whose attester seed holds no chain-carrying peer (the cloud sybil cohort — attesters are only other sybils) and whose bond gossip hasn't warmed otherwise had NO path to sync or submit (configure-not-discover, network-durability.md §8); the cloudtest sybil role now configures -persistent-peers over the validator set. The local integration/sybil harness graduates from its scoped-down standing-gate form to the REAL C2 property: it now asserts the autonomous drain commits, the sybil syncs, a bonded sybil publishes through its own registry with the anchors present (positive control), and the capture attempt without anchors is refused by the anchor co-sign gate on a genuinely-bonded Sybil set — previously cloud-scoped, now local. Failing-first regressions at the node tier (TestIdleYoungNetworkDrainsPendingBondRegs338, TestSyncTargetsIncludeStaticPeers338).

Field-test harness: the 8-takedown probe tested the wrong surface; the equivocation drill's refusals were silent — Two test-harness observability fixes from the M0-candidate field run's GAPs. (1) flow_takedown GAP'd on every run (denied= served=1) because its denial leg ran swarm get ON store-1 and grepped for a refusal — but swarm get is a short-lived CLIENT node that never consults the daemon's denylist and fetches from any other holder, so the grep could never match (audit-#303 class). The denial leg now asserts the surface -denylist actually gates: the daemon's own enforcement narration ("denylist: N root(s) denied…"), with the no-global-switch leg (store-2 serves bit-perfect) unchanged. (2) The -equivocate drill's retry loop swallowed every refusal, hiding a real wedge (#345 family, caught while certifying under netem): after a PARTIAL placement (X committed on the first target while the second hadn't yet qualified the adversary), every later attempt rebuilds the same adversarial entry root, which the first target refuses forever (root already registered) — the drill starves permanently and bimodally under WAN-ish delay. Each refused attempt is now narrated so a wedge is distinguishable from warm-up; the drill-design fix (atomic or resumable placement) is tracked separately.

#357 §3 — the quorum-finality gate: a super-quorum-committed objective block is irreversible (research-certified, owner D-1) — Completes the ratified bond-weighted BFT model (research certification 2026-08-13). §1+§2 stopped the oscillation; §3 adds the safety guarantee: Reconcile refuses any fork that would revert our committed head (ErrPreFinalityReorg), so heaviest-weight fork-choice only ever adjudicates among DESCENDANTS of the finalized head — "reorg to height 0" is structurally impossible, and under a >⅓ partition a node STALLS rather than reorg committed history (owner decision D-1; the storage plane keeps serving throughout, D-2, so durability is unaffected). Finality is quorum-INTERSECTION, never bare depth (a depth cap lets two partitions finalize conflicting blocks — worse than a reorg), so the gate is gated on a real super-quorum: it engages only when RequiredQuorum ≥ bftThreshold (always true with ByzantineQuorum, the untrusted default). A trusted weak config (Quorum=1) has no quorum intersection — a lone equivocator can split the honest set onto two committed forks — so it keeps heaviest-chain reorg and its equivocation slash heals by adopting the heavier fork (this is why the Quorum=1 live-tip equivocation-slash path is unaffected). Realized on the existing WS-checkpoint machinery (a rolling finalized floor). The red-team fork-choice tests that encoded the old Nakamoto healing are rewritten to the BFT model: F6 now proves convergence by CATCH-UP (a behind replica adopts a longer chain that EXTENDS its finalized prefix; a conflicting heal required equivocation, which B slashes); F7 proves a cross-height double-backer is neutralized by FINALITY (the finalized fork stands, the conflicting heavier fork is refused). Ramp repro extended to assert the gate. Full go test ./... + -race (chain/node) green. Staged next (mature-phase machinery, research Conditions A+B): epoch-snapshot the mature validator set + a finalized young→mature handoff; the drain-window sim (repro-ladder step 2) and a BFT e2e partition-heal rewrite (supermajority commits / minority catches up).

Fork-choice oscillation during the anchor→bonded ramp — §1 convergent weight + §2 stable quorum (#357) — The blind multi-region field run committed blocks then reorged them back to height 0; the local consensus sim passed (it only ever tested the mature regime). Research root-caused it (silt-reviews/research/.../357-...-RESEARCH-RESPONSE.md) and the owner ratified the bond-weighted BFT model (B). Two of the three ranked defects are fixed here (the third, the finality floor, is a staged follow-up): §1 — during bootstrap anchors are attesterQualified but contribute bonded[id]=0, so every fork's Weight was ≈0 and heavier fell through to its height-blind head-hash tiebreak — a genesis fork whose hash sorted lower thus displaced a committed chain. Fixed by (1a) crediting a qualified launch anchor a fixed bootstrap weight (Config.AnchorWeight, default MinBond) so an anchor-attested chain carries real, height-growing weight from block 1, and (1b) making the tiebreak height-aware (equal weight ⇒ the taller chain wins; head-hash only breaks a weight+height tie). Both are C1/C2-neutral: the weight is the sanctioned immutable-#3 training-wheels trust, vanishes at maturity (launchAnchor ⇒ false once everMature), and the mature-regime quantity (summed committed bond) is unchanged. §2 — RequiredQuorum was sized against the live-moving qualifiedCount, so it shifted block-to-block as registrations drained in and no fork held a quorum of a consistent set. Fixed by sizing against a stable validator set (validatorSetSize): the fixed anchor set during the young window (seeded at genesis — bftThreshold(4)=2), transitioning to the committed bonded set at maturity. Deterministic bootstrap-ramp repro (core/chain TestForkChoiceRampCommittedChainOutweighsGenesis357, research Ask 4) that FAILS before §1 (Weight==0) and passes after; full go test ./... + -race on chain/node green. Staged follow-up (owner review): §3, the rolling BFT finality floor (refuse to reorg below a quorum-committed block), completes model B but rewrites objective fork-choice semantics (Nakamoto-heal → BFT-final) and the red-team tests that encode the old model — held for review.

Canonical issuer-set discovery falls through an un-synced validator (#351, P0-2 residual) — A chainless publisher (silt swarm add) picks its publish-token signers by a canonical, ledger-ranked ordering it fetches from a validator, so the signer subset isn't a per-publisher quasi-identifier (R-3 / seam-4). It asked only validators[0], so a single un-synced or transiently-unreachable validator — e.g. one that just restarted mid-run (#351) — dropped the publisher into the -peers fallback, which narrows the publisher anonymity set. Added Node.FetchCanonicalIssuersFromAny, which tries each validator in order until one serves the set (cmd/silt/swarm.go now uses it). The canonical ranking is deterministic — every chain-holder computes the same bond-ranked order — so asking a different validator returns the same answer: pure liveness/anonymity robustness, no change to selection, consensus, or the privacy claim. Regression: core/node TestFetchCanonicalIssuers_ReturnsLedgerRankedSet now also asserts FromAny skips a chainless validator and returns the chain-holder's ranked set. Scope (V4): this closes the canonical-set half of #351 only; the token-acquisition-after-restart path (reaching enough signers for the token-quorum when one is down) is a privacy-sensitive residual that needs a deterministic repro to pin the failing stage — tracked, not addressed here.

Provider-record lifecycle — age out departed holders so the repair/fetch loop stops re-dialing corpses (#277, P0-1) — The principal-engineer substrate plan (P0-1) targets the dominant durability/retrieval wound: the #277 dial-storm. Attribution first (build-immutable #6), which corrected the audit's hypothesis: the DHT walk is already deadUntil-gated (PR #355) and signed provider records are already expiry-filtered on read (acceptedProviderIDs→Verify). The genuine residuals were three: (1) a confirmed-dead holder's provider record is never removed, so deadUntil only rate-limits the re-dial to one full RequestTimeout per HolderCooldown (30s) forever — the persistent dial-storm floor; (2) the re-serve path (MsgGetProviders) handed out stale records with a raw Get, propagating the corpse to whoever asked; (3) the announce/re-announce path was the last provider-record consumer not gated on deadUntil. The loop drowns in dials to departed holders because their records outlive them in every consumer; fixed by giving the store a lifecycle and gating the last consumer. Adds dht.Providers.Live (filter expired on read — used by the re-serve path), Evict (per-RepairInterval age-out sweep in repairTick), and RemoveIfNotSole (prune a confirmed-dead holder from every key with a live alternative, called when retries exhaust and the peer is negative-cached) — the last keeps a SOLE holder's record so its content stays discoverable and re-probeable (#69/#226) rather than orphaned. Also gates the announce path on deadUntil. M1 baseline instrumented now (the efficiency gate starts in P0): two gauges, Stats.HolderDialsSkipped (dials avoided by the negative cache — the dials-per-fetch/repair bound) and Stats.DeadProviderRecordsPruned (records aged out). Failing-first regressions: core/dht unit tests for Live/Evict/RemoveIfNotSole (incl. the sole-holder-kept case), and core/node TestConfirmedDeadHolderPrunedFromReplicatedKeptForSole (verified fail-before / pass-after). Full go test ./... + -race on core/node/core/dht green.

Provider diversity sweep honors the dead-peer negative cache — closes the last ungated resolve leg (#277) — The deadUntil negative cache that stops silt re-dialing a just-timed-out peer was consulted on the DHT distance walk (node.go), the fetch path (file.go), and the repair probe (repair.go) — but not on the domain-diversity sweep (sweepProviders, dht_diversity.go), the second leg resolveProviders runs whenever DHTDomainCap > 0. Since the daemon and client both set DHTDomainCap = 2, the sweep runs on every provider resolution, so under churn a departed holder still in the routing table was re-dialed at a full RequestTimeout on every resolve — a contributor to the #277 repair/retrieval dial-storm (a caretaker sweeping a churny swarm "drowns" and never finishes a sweep). Fixed by gating deadUntil in sweepProviders exactly as the other three paths do (a sweep is breadth discovery, so a cooled peer is simply skipped — no sole-holder concern like the fetch path's #69 anyLive guard). Surfaced by the 2026-08-12 blind field test, which also exposed a unit-test blind spot: the existing dead-cache tests set DHTDomainCap = 0, isolating away the exact leg the daemon always runs — so a new failing-first regression (TestProviderDiversitySweepSkipsCooledPeer) engages DHTDomainCap = 2 (FAILs "got 1 dials, want 0" before, passes after). Closes one named, verified leak on the resolve side; not the whole #277 envelope. Follow-up: gating the sweep would have blacklisted a recovered holder still inside the 30 s cooldown (breaking #69 cross-NAT restart survival — the deadUntil cache was only cleared on a successful bootstrap dial). So a message is now proof of life: receiving any message from a non-ephemeral peer clears its deadUntil entry, cleanly separating a departed holder (sends nothing → stays gated, dial-storm fix intact) from a recovered one (restart + reprovide, or a NATed peer now reachable via the relay → un-gated at once). Guarded by TestInboundMessageClearsDeadCache and a green RESTART=1 integration/nat.

Equivocation red-team drill double-signs at the live tip, not a stale height 1 (#345) — The 184-equivocation field-test drill FAILed on the #286 GCP re-cert ("no slash line within 120s"), while the same property passes in-process (#204). Root cause: Node.Equivocate (the -equivocate red-team harness) hardcoded the double-sign at height 1. On a fresh chain that is the live tip and slashing fires; but the cloud drill runs after the warm-up has committed several blocks, so a height-1 double-sign is stale — an honest target refuses to attest a proposal that is not at head+1 (ValidateProposal), so proposeAndCommitTo fails, the conflicting forks are never placed, they never enter fork reconciliation, and nothing is slashed (the adversary never even logged "equivocation complete"). Fixed to double-sign at the current uncommitted tip via chain.Head — backward- compatible on a fresh chain (tip = genesis ⇒ height 1, so the in-process slash test is unchanged) and live on an advanced chain. Also pointed the cloud drill at the direct detector (val-b, which holds fork X and catches the double-sign the instant it syncs val-c's heavier fork) instead of val-a, which only sees the slash after on-chain propagation. Guard: TestEquivocateAtLiveTipSlashesOnAdvancedChain345 advances past height 1, runs the real Equivocate path, and asserts the culprit is detected + evicted — it FAILS on the old height-1 code ("target refused the proposal at height 1"). This is a red-team harness fix; the product's equivocation detection + on-chain eviction was already correct.

Distribute/repair proofs are O(log n) too — same cached Merkle tree (#340) — The sibling of the bond fix, on the storage plane: distributeFrom (file.go) and repairStripe (repair.go) build a Merkle inclusion proof per shard so hosts can answer storage challenges — each via the standalone manifest.Prove, which is O(n) (it rehashes subtrees). Proving S shards over an n-leaf manifest was therefore O(S·n) ≈ O(n²) on the node loop — for a large file (thousands of leaves) that is seconds of on-loop proof work during distribution or a repair sweep, exactly the kind of loop stall the bond compute layer exposed (#286). Fixed by building one manifest.Tree per distribution/repair and drawing every per-shard proof from it (O(log n) each); it also replaces the redundant m.Root (a second full O(n) MerkleRoot) with tree.Root. Proofs are byte-identical (TestTreeMatchesStandaloneProve), so the storage-proof and PoR-tag paths are unchanged — verified by the full node suite (distribute + proof-verify + repair) staying green under -race.

Bond proof answers are O(log n) again — cached Merkle tree (#286 compute layer, #340) — The confirming 3-region GCP run reopened #286: after the network layers (L1/L2a/L2b) genesis still wedged at height 0 because bond proof-of-space-time compute saturated the single consensus loop (B2) — decisive proof: bond 64M→2M dropped CPU ~90%→~3% and genesis committed instantly. A pprof isolation pass (build-immutable #6, root-cause before you patch) found that the per-challenge answer also scaled with plot size, contradicting the assumed size-independence — and pinned why: manifest.Prove was O(n), not O(log n), because auditPath recomputes merkleTreeHash over half the leaves on every call, and AnswerSpaceTime draws O(k) proofs, so each answer cost O(k·n) and grew with the bond. On a 64 MiB plot one answer took ~743 ms (and RegisterBondReg rebuilt proofs on every propose retry). Fixed with a precomputed manifest.Tree cached on the bond Commitment (built once in Seal/Reconstruct), so each inclusion proof reads cached subtree hashes in O(log n): the same construction, byte-identical root and proofs (guarded by TestTreeMatchesStandaloneProve across every leaf count) — no proof-param change, C1-neutral. Measured effect: a 64 MiB answer drops 743 ms → ~8 ms (~95×) and is now flat across plot sizes. This removes the recurring per-audit-epoch scaling; the remaining Ω(size) on-loop cost is the one-time Seal at onboarding, moved off-loop next (research Option A, #340).

Genesis commits small — bond registrations spread across blocks (#286 Layer 2b) — A real 3-region GCP cert run (with the #331 persistent-peers fix + #327/#332 -log debug) proved address convergence was fixed but genesis still didn't commit, and pinned the true final blocker: gather: starting height=1 bytes=7866154 regs=5 — the proposer piled every founding validator's ~1.5 MB space-time bond registration into the single genesis block (~8 MB), which the quorum gather can't move + re-verify over a WAN before the round churns, and because it never commits the validators re-submit forever (308×), pinning the block huge. Root cause and fix confirmed by research against the code: the founding set are anchors (chain.launchAnchor), so genesis quorum bootstraps from anchor eligibility at zero committed bond (qualifiedCount=0 keeps RequiredQuorum=Quorum) — the block does not need the bonds in it. Fixed with a byte budget, Config.MaxBondRegBytesPerBlock (flag -max-bondreg-bytes-per-block, default ~2 MiB): the proposer embeds bond registrations per block up to that byte budget (chainrole.go), so genesis commits small on the anchor bootstrap and the deferred registrations drain over the next blocks — each validator still gains real bonded weight and the set reaches MatureValidators. A byte budget, not a count, is the right lever because the blocker is size, not number: at genesis one full ~1.5 MB proof fits per block, but small steady-state renewals pack many per block — so an attest-only validator's renewals are never starved under a tight TTL (a count cap lapsed them; sim/bond_renewal proved it). Anchors grant eligibility, never fork-choice weight, so nothing is fabricated. Reproduced deterministically in-process (no WAN needed) and guarded by TestGenesisBondRegsSpreadAcrossBlocks286L2b (4 anchor validators, quorum-2: genesis commits with one ~1.5 MB reg and all four bonds drain by block 4). The structural close remains #299 (succinct + aggregated bond proof).

Registry client rides out transient loss on its reads (#329, durable-WAN audit) — The HTTP registry client's idempotent GET reads (Lookup, /publish-status, All) were single-shot: a single dropped packet or a transient 5xx failed a swarm get / root resolution outright. This was the one client path NOT behind the consensus layer's retry — the lone true violation of build-immutable #5 found in the durable-WAN audit (#329). Fixed with a bounded exponential-backoff retry (3 attempts, 200 ms base) on those GETs — ride out transient loss instead of deciding on a single sample (docs/network-durability.md §1 "modest initial + retry", §2). A definitive 4xx (e.g. a 404 not-found) is returned at once, never retried; POST /publish is deliberately NOT retried here (its commit durability comes from the async 202 + poll). Guarded by TestClientGetRetry_RecoversTransient / _BoundedGivesUp / _NoRetryOn404.

Publish no longer dies on a flat wall-clock deadline — async accept + poll (#286 Layer 1) — The binding failure in the quorum-2 genesis stall was on the HTTP publish path, not the validator↔validator RPC path #318 tuned: silt swarm add held the HTTP connection open for the whole consensus gather under three stacked flat deadlines (10 s http.Client.Timeout, 30 s server WriteTimeout, 30 s chainhost loop timeout), any of which guillotined the one-time ~1.5 MB genesis gather over a real WAN before quorum could form — a flat transport deadline is a category error (build-immutable #5; docs/network-durability.md). Fixed by making publish asynchronous: chainhost.PublishAsync runs the LOCAL validation synchronously — so every refusal (no publish token when required, a durable Publisher identity the refuse-to-surveil chain rejects, a double-spent token, a duplicate root) still surfaces at once — then kicks off the commit gather in the background and replies 202 Accepted; the client polls a new GET /publish-status until the entry commits or the gather reaches a terminal no-quorum. No connection is held open for the gather (no flat guillotine on the commit, no slowloris — #48), yet Publish still BLOCKS the caller until commit so sequencing (double-spend replay, dup) is preserved exactly as the sync path. /publish-status exposes the gather's terminal outcome, so a not-yet-committable publish (no quorum before mutual standing is earned) fast-fails instead of polling out the budget — preserving the publish-retry-until-standing semantics the bond earned-standing and on-chain revocation e2e flows depend on. Guarded by TestAsyncPublish_AcceptThenPollCommits / _RefusalIsSynchronous / _TerminalFailureFastFails and the full e2e suite over real TCP. This removes the Layer-1 transport guillotines; the deeper WAN-only genesis gather (Layer 2) is still open pending a -log debug cloud run (#327) and the structural ~1.5 MB → succinct bond proof (#299).

Objective chain wedged after the first bond, cross-region (#313) — Found on the GCP cert field test: a 3-region objective validator set committed block 1, then every publish hung and the chain stalled at height 1. Root cause: F6 "proposing IS registering" re-embedded the proposer's full space-time bond proof in EVERY block (and the H2 non-proposer path re-submitted it every sweep). Once a validator's bond sealed, each subsequent block carried the ~1.5 MB proof (#299); over real cross-region links attestation could not carry the bloated block in time, so the proposer's quorum gather stalled and the chain wedged. Re-registering an already-committed bond bought nothing — the latest registration already stands. Fixed with Chain.BondRenewalDue(id): the proposer attaches (and a peer submits) a bond registration ONLY when not-yet-bonded or past the TTL renewal point (half the TTL, leaving margin), so ordinary blocks stay lean while the release-and-coast defense (RT-2/G4: a released plot still decays out on the TTL cadence) is preserved. Also lowers the per-block bandwidth residual (#299) and the participation floor (build-immutable #4). Reproduced and guarded in-process at the exact cert parameters (4 objective validators, quorum 2, Byzantine-ON, no genesis bonds): TestWedge313_ObjectiveByzantineMultiBlock (exactly one registration block, not every block) and TestWedge313_RenewalStillHappensUnderTTL (renewals still fire on the TTL cadence).

Size-aware consensus transport deadline (network durability) — The per-attempt DHT/ consensus RPC deadline (Config.RequestSizeFloorBytesPerSec, default 256 KB/s) now scales with the OUTBOUND payload: a request gains len(payload)/floor of transfer headroom (capped 30 s), so a large one-time block (a validator's ~1.5 MB bond registration) gets WAN margin while lean blocks are unaffected and holder-fetch dials keep their tighter, non-extended deadline (#277). A textbook-correct application of the #289 tenet (transport deadlines must be generous; security lives in the proof, not the clock — docs/network-durability.md). Guards: TestRequestTimeoutFor_SizeAware286 + TestRequestTimeoutFor_ExtensionOptOut286. This is a genuine durability improvement — but it does NOT fix #286 (see Known issues); the GCP re-run proved it tuned a non-binding path.

Holder-fetch dials fail fast again — no retry/backoff regression on the dial-storm — Follow-up to the adverse-network hardening above. That change applied the new 5 s timeout + retries to every RPC, including speculative holder-fetch dials (MsgFetchChunk/MsgHasChunk), so a fetch from a dead holder cost up to (retries+1)·5 s ≈ 20 s (was ~½ s) — deepening the dead-holder dial-storm (#277) exactly where content lives on churning holders. Fixed: holder-fetch RPCs are not retried (the fetch loop already retries at a higher level via FetchAttempts and skips known-dead holders via deadUntil) and use a tighter -holder-dial-timeout (default 2 s) so a dead holder fails fast, while mesh/ consensus RPCs keep the generous timeout + retries needed to ride out jitter. Restores the pre-hardening fetch responsiveness without giving up the jitter durability.

Consensus now bootstraps under a jittery network (adverse-network durability) — New integration/flakynet harness (4 objective validators behind tc netem) reproduced a real durability collapse the clean local tests never showed: under a mild, realistic 80 ms ± 20 ms jitter the network committed in 6 s on a clean link but never committed jittered (the root of the flaky-GCP #286 symptom). Three causes, fixed: (1) RequestTimeout was 500 ms — LAN-tight for a global P2P RPC (TCP connect + query routinely exceeds it on a jittery path); the daemon default is now 5 s (-request-timeout). (2) A single timed-out RPC evicted the peer from the routing table (table.Remove), so one slow/dropped packet tore a good peer out of everyone's mesh; timed-out RPCs are now retried with exponential backoff (-request-retries, default 3; -request-backoff 250 ms) and the peer is only given up after retries are exhausted. (3) A BondChallenge reply carries a large, slow space-time proof; under adversity these time out in droves and (2) then evicted the peer — starving consensus of the very standing it was establishing. A bond-challenge timeout now never evicts from routing (it is a standing signal, not a reachability one — standing lapses and re-audits on its own). DefaultConfig keeps RequestRetries=0 so the deterministic sim/tests are unchanged; the daemon opts in. KNOWN HARDER GAP (filed): jitter + packet loss still does not reliably bootstrap — loss on the large proof/chunk replies plus the C1 reply-latency gate (-bond-answer-latency) reading network latency as a short-storage cheat; the latter is a security tradeoff needing a deliberate call.

A node that joins before its bootstrap peer is listening now recovers on its own — Field-test finding #281, found on the first real 13-node cross-region GCP run. silt's Kademlia join (Node.Bootstrap) was one-shot: on a multi-node cold start with no ordering guarantee, three validators started their FIND_NODE before the boot validator's listener was up, landed with an empty routing table, and — with no re-bootstrap — never tried again, even though the target became reachable seconds later. The network never meshed, the chain stayed at height 0, and every publish timed out (reachability was fine; consensus never formed). Added a periodic self-heal (core/node/bootstrap.go, StartBootstrapRetry): while Table.Size == 0, re-run the join against the original -bootstrap seeds every BootstrapRetryInterval (new -bootstrap-retry flag, default 15s; 0 disables). The retry first clears the seeds from the deadUntil negative cache (their failed initial dial had marked them dead for HolderCooldown), so it re-dials immediately instead of waiting out the cooldown; it is a no-op once any peer is in the table. Recovery logs re-bootstrapped: recovered from an empty routing table (N table entries). Covered by unit tests (simnet Kill/Restart race) and a real-process e2e (TestBootstrapRetryRecoversColdStartRace).

A sparse cold-start mesh now converges (periodic bucket refresh) — follow-up to #281. Recovering an EMPTY routing table is necessary but not sufficient: a node can re-bootstrap to just one or two peers and stall there, and the seedless boot validator (no -bootstrap) never re-looks-up at all — so it stays stuck at the single entry an incoming dial gave it and can't discover the rest of the validator set. The bootstrap-retry loop now also does a Kademlia self-lookup while the table is below BootstrapWellConnected (default 8), which discovers more peers and converges the mesh. This reaches the boot node too — it queries the peers that dialed IN. Covered by a simnet convergence unit test (a boot-like node with one entry converges via refresh). NOTE: this fixes the DHT-mesh convergence; a separate consensus-bootstrap gap remains where a fully-simultaneous cold start of an objective validator set does not establish anchor standing even once connectivity is fine (filed separately).

Repair no longer starves on stale records to dead holders — Field-test finding F2 (integration/churn/): the repair fetch loop (fetchStripeByColumn → fetchFrom) dials providers serially, each dead holder costing a full RequestTimeout, and a single timeout re-sweeps the whole provider list up to FetchAttempts times — with nothing skipping a holder we just failed to reach (n.reachable was write-only). Routing-table eviction doesn't remove the provider record other nodes still hold, so the next lookup resurfaces the same corpse and re-dials it at full timeout every sweep; under churn one stripe could exceed RepairInterval on timeouts alone. Added a failed-holder negative cache: a request timeout stamps deadUntil[peer] = now + HolderCooldown (30s), and the fetch/repair dial path skips a holder still in cooldown — but only when a live alternative exists (anyLive), so the cache can never be the reason a fetch fails (a sole provider that timed out transiently and has since re-announced is still dialed, preserving cross-NAT reprovide, #69). Stamped centrally (so NetGet benefits too) but consulted only in the fetch path, leaving consensus/DHT re-probes untouched; the map is bounded (maxDeadHolders). Regressions in fetch_deadcache_test.go.

The dead-holder negative cache now also covers the repair PROBE path and the DHT walk — Follow-on to the fetch-path fix above, which stamped deadUntil centrally but consulted it only in the fetch dial path, leaving the two other places a repair sweep dials stale records exposed: (1) the dispersion audit's probeShard MsgHasChunk loop and (2) the provider-discovery DHT walk (walk.step, MsgGetProviders), which a caretaker runs for every key it cares about. Under churn a caretaker with many stale routing/provider records to docker killed holders spent a full RequestTimeout per dead record, so a single sweep never completed — the caretaker never registered the loss and never repaired (surfaced by integration/churn/, which stalls on small swarms; the true degradation happens at GCP scale where k=10 actually strands stripes). Both paths now skip a holder still in cooldown — the walk fails it in the Kademlia lookup without a dial, the probe skips it — each only when a live alternative exists (anyLive), so a sole transiently-timed-out holder that has since recovered is still dialed (#69 preserved). Regressions in repair_deadcache_test.go (walk-skips, walk-without-cooldown control, probe-skips). A dial-storm reduction — necessary but, as the next entry found, not the whole churn story.

Repair-under-churn now actually completes: parallel shard probing + a visible sweep (#235) — The integration/churn field test stalled: a caretaker killed holders never repaired. Root cause, found by instrumenting the sweep: repairRootWithLayout probed every shard strictly serially (probeNext(i+1) inside each probe's callback), so once holders die each dead-holder dial costs a full RequestTimeout in series — a large file's sweep can't finish within a RepairInterval, the caretaker never reaches repairStripes, and nothing is ever repaired. The healthy first sweep completed only because every dial returned in ~ms. Two fixes: (1) the probe phase now fans out with bounded concurrency (repairProbeConcurrency), so dead-holder timeouts overlap and a sweep completes in seconds under churn (safe on the single-threaded event loop — probe callbacks mutate sweep state on the loop, the same model as the DHT walk's in-flight fan-out); (2) the sweep is no longer silent — it logs repair sweep complete with the reachable-shard count, and its previously-invisible no-op early-returns (registry lookup failed, manifest not yet reassembled, layout not loadable) now log why, so a caretaker that can't sweep is diagnosable instead of looking identical to a healthy one (#235). With this, the caretaker reconstructs stranded stripes from parity and re-scatters, and integration/churn passes honestly (reachable drops after a kill → stripe repaired → bit-perfect re-fetch).

silt swarm add -replication N — Expose the placement replication factor (previously a compiled-in 3) as a publisher flag; parity across holders backstops copies, so even 1 is viable. Lets a small-swarm test strand a column with a single kill, which makes caretaker repair deterministically reproducible on a laptop: integration/churn now runs at REPLICATION=1 as a fast, deterministic gate and documents REPLICATION=3 HOLDERS>=50 on the GCP harness as the faithful, shipped-default variant.

Acceptance-pass documentation gaps — From the fresh-operator acceptance pass (all nine flows worked; these were doc/test issues, not broken capabilities):

• docs/user-seam.md Role 4 "become a validator" walkthrough errored as written — the default objective fork-choice path needs -anchors to bootstrap a young network's on-chain bonded weight, which the walkthrough omitted (bonded 0, needs …). It now passes -objective=false to match the cited test TestBondEarnedStandingCommitsOverTCP, with a note on the objective/anchor launch path.
• README.md said the default add mode was "convergent"; the default is -mode private (H6). Fixed.
• examples/flow8-takedown.sh published with the (now private) default, giving two different roots so the takedown test denied one root and confirmed an unrelated one still served. It now publishes -mode convergent so both operators hold the same root, actually demonstrating per-operator takedown of a shared root.

Prepaid publish credits were silently dropped over real TCP (#179) — tcpnet's hand-rolled wire codec (toWire/fromWire) never mapped the Credit field of a MsgTokenRequest, so the F4/D3 fee decoupling (paying for a token with a prepaid blind credit instead of charging the durable identity) only ever worked in the in-process sim — over real sockets the credit vanished and the issuer fell back to charging the requester. Added Credit to the wire struct + toWire/fromWire, with a TestCreditSurvivesWire round-trip guard (the exact #65-class silent-drop bug wire_por_test.go warns about). This repairs the publish-token credit path (F4) as well as enabling D3 below.

H6 (privacy, Memo 02): default publish is private — no existence oracle for guessable content — convergent encryption derives the key from the plaintext, so the content address is a deterministic function of the plaintext: anyone who GUESSES it can compute the root and look it up to confirm you stored it (the confirmation attack), and it shipped as the DEFAULT. H6 flips the default publish mode to private (a random per-file key) across every publish path — silt add, swarm add, and the web UI — so identical content encrypts differently each time and can't be probed for; convergent is now explicit opt-in and prints a confirmation-attack warning. Regression: core/pipeline/redteam_h6_test.go — the attacker computes the convergent root of a guessed plaintext; under convergent a registry probe HITS (the oracle, documented), under the private default it MISSES, and two private uploads of identical content don't even collide. The Memo 02 "Proof-of-Ownership" idea was deliberately not added: a PoW-to-serve gate contradicts silt's capability model (the link/manifest IS the read capability) and possession is already gated by store-time hash verification + PoR audits, so private-by- default is the substantive fix (reasoning recorded in the strategy doc §7 H6).

H5-B (DHT eclipse, Memo 08): failure-domain diversity — a single-domain key-surround can't suppress discovery — H5-A stopped provider records being forged; this stops them being suppressed. An adversary that grinds the NodeIDs closest to a content key (a ~$4 /24 key-surround) could hold every slot a lookup converges on and simply return nothing. Fix, reusing the gossiped failure-domain (Domain) signal as the diversity dimension: (1) the routing table caps same-domain peers per bucket (dht.Table.SetDiversity), so a one-domain Sybil cluster can't fill the buckets near a key and evict honest peers; (2) provider records are announced to a domain-spread near set, not just the NodeID-closest (announceTargets/diverseNear), so honest nodes in other domains hold the record; (3) after the distance walk converges onto the surrounding NodeIDs, resolution sweeps that domain-spread set (sweepProviders), so the honest holders are actually queried. DHTDomainCap gates it (0 = off); default -dht-domain-cap 2 for the daemon and the ephemeral fetcher. Regression: core/node/redteam_h5b_test.go — an adversary grinds the 10 closest NodeIDs to a key (one domain, suppressing); with diversity OFF the key is undiscoverable, with it ON discovery succeeds through honest other-domain nodes; plus unit tests for the domain-spread near set and the per-bucket routing cap. Residual: Domain is self-reported — binding it to the transport-observed /24 (or per-AS) is the full-strength hardening. Real-TCP e2e green; this completes surface S5 (with H5-A).

H5-A (DHT eclipse, Memo 08): self-certifying provider records — records can't be silently forged — DHT provider records were unsigned NodeIDs: a node holding the k-closest slots to a content key could fabricate provider records for identities that never announced, or inject fake providers into the records it re-serves on lookup (the forgery half of the ~$4 key-surround). Fix: ports.ProviderRecord is a signed "I hold content under key K" claim bound to the provider's identity (sha256(pubkey) == ID) and the key, with an optional expiry. A node signs its own announcements with its identity key (SetSigner), the store path (acceptAnnounce) rejects any record that isn't a valid self-announce for the queried key, MsgGetProvidersReply re-serves the signed records, and a fetcher (acceptedProviderIDs) drops any record not signed-for-this-key-and-fresh — so a forged, mis-signed, expired, or cross-key-replayed record is silently discarded, while a fetcher still hash-verifies chunk bytes on receipt. RequireSignedProviders is on by default for the daemon (-signed-providers); unsigned legacy records still flow when it's off (sim/trusted). Wire: new ProviderRecord type + Provider/ProviderRecs message fields, mirrored in the tcpnet CBOR frame. Regressions: core/node/redteam_h5_test.go (a signed record binds to identity+key; a third-party or mis-signed announce is rejected at the store; a fetcher drops injected forged / cross-key records; unsigned records flow only in non-strict mode), real-TCP e2e green under strict signing. Follow-up (H5-B): the suppression half of key-surround (prefix-diversity routing + disjoint-path/wide- region announce, so a key stays discoverable when one /24 owns the k-closest NodeIDs).

H4 (consensus safety, Memo 05): Byzantine quorum sizing + Nakamoto-coefficient shed metric — consensus safety rested on a FIXED quorum (default 3) and a training-wheels shed triggered by a HEAD-COUNT of distinct validators. Both are Sybil- fragile: a fixed 3 among 30 validators no longer guarantees two quorums share an honest node (quorum-intersection safety is lost as the set grows), and one operator spinning up many keys could trip the head-count maturity, then capture consensus once the anchors shed. Fix, per Memo 05 (safety is quorum arithmetic at the Byzantine threshold, not reputation weight): (1) Config.ByzantineQuorum sizes a commit's support set (proposer + attesters) at a supermajority n−f of the qualified bonded set (f = ⌊(n−1)/3⌋), so any two quorums intersect in ≥ f+1 ≥ 1 honest validator; the proposer gathers max(floor, RequiredQuorum) and ValidateCommit enforces it. (2) Mature now measures the Nakamoto coefficient over the participating non-anchor bonded set (validatorsSeen ∩ current bond) — the min number of bond-distinct operators needed to reach ⅓ of the weight — which is participation-gated (no fake-genesis decentralization), weight-aware (a set dominated by one bond has coefficient 1 → stays immature no matter how many satellite keys), and revertible (a lapsed bond drops out → the wheels re-engage, the post-shed escape hatch). Both default-on for the untrusted objective posture (effectiveByzantineQuorum, -byzantine-quorum). Regressions: core/chain/h4_consensus_test.go (TestBFTQuorumIntersectionAboveFaultBound proves two quorums always intersect above the fault bound for every set size; TestByzantineQuorumScalesWithValidatorSet + TestFixedQuorumUnsafeWithoutByzantineSizing; TestMaturityNakamotoResistsOneOperator shows one operator's many keys can't trip the wheels), cmd/silt/invariant_b_test.go (S4 default-on). Residual (documented): an operator that splits stake into many EQUAL bonds still inflates the coefficient — stake concentration is invisible on-chain — but it pays the full cost-to-corrupt and the Byzantine quorum bounds it to ≤ ⅓ of weight.

H2 / RT-2 (Sybil, High): bond standing decays across time by default — release-and- coast denied — the blind red team broke the Sybil corner (over the G2 fix) through the time axis: a validator registered a genuine bond once, released the plot, and kept voting forever off that single one-time proof, because the bond TTL (BondTTLBlocks) shipped off by default — the third "fixed but off by default" instance. It could not simply be flipped on: renewal happened only when a validator proposed, so an attest-only validator would never renew and would lapse, costing the quorum its weight (a liveness trap). Fix: a non-proposer renewal path — node.SubmitBondRenewal broadcasts a fresh self-signed BondReg (new MsgSubmitBondReg); a receiver re-verifies it for the current head (chain.ValidateBondReg) and queues it (pendingBondRegs); the next proposer folds the queued peer regs (deterministically ordered, head-filtered so one stale reg can't poison the block) into its block, mirroring pendingSlashes. The chain-sync sweep drives renewal, so an attest-only validator renews without ever proposing. Only then is the TTL made safe-by-default on the untrusted objective posture (effectiveBondTTL, mirroring the anti-release floor; explicit -bond-ttl 0 is the trusted opt-out). Regressions: sim TestObjectiveBondRenewalSustainsAttestOnlyValidator (attest-only validator sustains standing across many TTL windows via the wire renewal path while a released validator is pruned — no liveness regression), core/node/redteam_rt2_test.go (TTL off ⇒ coast survives, the vuln; TTL on ⇒ released plot decays out), cmd/silt/invariant_b_test.go (the untrusted default turns the TTL on).

H3 (Sybil, systemic): Invariant-A/B guardrails so a standing press or an off-by-default mechanism cannot ship unaudited — the strategy doc's two meta-patterns ("we fix instances, not classes" and "fixed but off by default") each bit us three-plus times (F1→G2→RT-1; F6→F4→G4→RT-2). Turned both classes into compile-and-test obligations: core/credit/invariant_a_test.go enumerates every standing-granting press (a reflection guard forces each *Ledger method to be classified mints/reduces/neutral; a behavioral guard proves no non-mints press lifts a bondless identity; the sole mints press — the bond — is asserted identity-bound + deduped + bond-gated), and cmd/silt/invariant_b_test.go builds the default untrusted-validator config and asserts it denies the attack per mechanism (S1 anti-release floor on, S3 bond-TTL on). A new press that skips classification or a mechanism that ships off-by-default now fails loudly.

H1 / RT-1 (Sybil, Critical): PoR audits no longer mint consensus standing — a disk-less relay farm earns nothing — a fresh blind red-team broke the Sybil corner (over the G2 fix) via the proof-of-retrievability audit press: credit.Reputation added auditsPassed·25 with no bond gate, and the PoR proof was a pure function of (chunkID, challenge, data) — not bound to the prover, and challenged with a shared, publicly-derivable seed. So a data-less identity could relay an honest holder's aggregated (μ, σ), pass, and reach propose/attest eligibility (100 rep) with zero storage — the code's own "a liar without the bytes cannot answer" comment was false (relay doesn't need the bytes, only a holder that has them). Fix (architectural, per docs/design/m0-hardening-strategy.md Invariant A + research memo 03: plain PoR over shared content is not Sybil- resistant): PoR audits grant no Sybil-resistant standing — removed the mint, so standing rests on the identity-bound storage bond alone; audits now fund only the balance economy and remain a negative integrity signal (a failed audit still subtracts, and can never be Sybil-amplified). Defense-in-depth: the challenge is now identity-bound (porProverSeed = H(base‖proverID)), so a relayed proof for one identity fails another's verify. Regressions: core/credit/redteam_rt1_test.go (audit passes grant 0 standing without a bond; an Invariant-A property test that no press mints standing without a bond; failed audits still penalize), core/node/redteam_rt1_test.go (relayed proof denied), sim/por_standing_test.go (holder passing audits over the wire earns 0 standing without a bond). Standing-granting sims/tests updated to earn standing via the bond press. Residual (tracked): a colluding bonded holder can still recompute a proof per Sybil to farm balance (not standing) — closing that needs sealed real-content replicas (backlog H7). Honest status: built + covered, awaiting external re-verification (B8).

G2 (Sybil, Critical): the storage bond is now a VERIFIED proof-of-space — prefix plots can no longer back N standings from one disk — the fix-verification red-team broke the Sybil corner a second time, over the F1 fix code, with prefix plots: plotBlock/parentIndices keyed only on (secret, i) and never on the total block count n, so blocks 0..m-1 of an n-block plot were byte-identical to a standalone m-block plot with its OWN distinct Merkle root — and VerifySpaceTime only checked Merkle inclusion, never recomputed a label. Per-root dedup (F1) keys on equal roots, so it was structurally unable to catch a family of distinct prefix roots: the scheme was proof-of-STORAGE, not proof-of-SPACE, and one physical plot backed ~N standings (marginal cost of one more Sybil ≈ one 4 KiB block). The fix (a graph-labeling proof-of-space over silt's existing DRSample graph — DFKP CRYPTO'15 / ABH CCS'17, adopted not invented) seals the plot from a public, identity- and size-bound seed H("silt/bond/plot/v3" ‖ pk ‖ n) folded into both the labels and the parent draws, and adds a labeling-consistency challenge: the answer opens k challenged nodes with their predecessor and DRSample parents (Merkle- proven), and the verifier recomputes each label from the opened parent bytes under H(pk, n) and requires a match. Because the seed is public the verifier can do this without holding the plot, so identity and size become checked properties of the plot, not claimed ones: a prefix, a foreign-identity plot, or arbitrary committed bytes all fail the recompute. N standings now require N plots. k is a per-network knob (-bond-label-k, Config.BondLabelSamples, default 64; soundness error ≤ (1-ε)^k against an ε-short prover); leaving it unset resolves to 64 inside core/bond, so the check is never silently disabled. The seed and the labeling check ship together (a public seed without the check would regress griefing), and G3's "proof beats declaration" rule is load-bearing for the public seed's griefing-safety. Plot format v2 → v3 — a one-time fleet re-plot; the disk version guard forces it so a restart never reloads an insecure v2 plot. Regressions: core/bond/redteam_g2_test.go (a prefix passes possession but fails the labeling check; a plot for one key fails under another; arbitrary bytes fail; a prefix family forges zero standings; k unset still denies), sim/bond_sybil_g2_test.go (a Sybil pointing at another node's plot earns no standing over the live-audit wire), adapters/diskplot (a v2 file loads as absent → re-plot), and the objective/audit e2e paths carry the ~1.5 MB label proof over TCP and on-chain. Design: docs/design/m0-sybil-rebind.md. Honest status: built + covered across all three tiers, awaiting external red-team re-verification — not self-certified held (immutable B8: the tight ε→k constant and the on-chain proof-size / asymmetric-k mitigation are the carried open risks in the design note §8).

Retest G4-residual: the anti-release floor is now ON BY DEFAULT for an untrusted validator — #163 shipped the floor + re-challenge mechanism but defaulted both knobs to 0, and the daemon did not auto-enable them on the earned-standing M0 path (unlike -objective, which is auto-on when -min-rep > 0). So a stock, doc-following open validator still admitted a sub-floor, releasable bond to full objective standing — fixed but off by default is not fixed. The anti-release floor now gets the same treatment -objective has: it defaults to a derived 1 GiB for an untrusted validator (-validator + -min-rep > 0 + objective), the value the flag's own arithmetic implies (~270 MB/s plot throughput × the ~2 s challenge window ≈ 540 MiB, with ~2× margin). The daemon fails closed if -bond is under the floor — an actionable refusal beats running a validator that silently earns nothing — and an operator can still opt out explicitly with -min-bond-floor 0 for a trusted/demo swarm. A non-validator is unaffected. Regression: cmd/silt/bondfloor_default_test.go (the derived floor exists, exceeds what re-plots inside a challenge window, denies the default 64M bond, and an explicit choice — including 0 — always wins). Docs + the local walkthroughs opt out explicitly and now document the floor. Known gap, deliberately NOT defaulted on: -bond-ttl (the objective re-challenge cadence) stays off, because bond renewal currently happens only when a validator proposes (chainrole.go), and proposing is event-driven — an attest-only validator would never renew and would lapse, costing the quorum its standing. Defaulting the TTL on requires a renewal path for non-proposers first; tracked as follow-up.

Retest G4 (Sybil/time, High): the objective validator set now enforces an anti-release floor and re-challenges bonds on a cadence — the fresh pass found the "time" half of proof-of-space-TIME was not enforced on the OBJECTIVE fork-choice path: c.bonded was set once at registration on a one-time proof and never decayed or re-challenged, and chain.Config had no anti-release floor at all (only MinBond). So (a) a sub-floor bond — small enough to release and re-plot inside a challenge window — earned full objective standing, and (c) a validator could prove once, RELEASE its plot, and keep voting forever with zero resident storage (the node-side floor + live re-challenge lived only in the credit ledger the objective set never reads). Two additive, deterministic knobs close it: Config.MinBondBytes (an objective anti-release floor — a bond below it earns no standing, rejected on the normal path and uncredited at genesis) and Config.BondTTLBlocks (objective standing LAPSES this many blocks after a validator's latest registration unless it renews with a FRESH space-time proof — height-driven, so every replica decays in lockstep). A validator that releases its plot cannot answer the fresh challenge to renew, so its vote decays to nothing. The daemon wires both: the existing -min-bond-floor now also feeds the chain floor, and a new -bond-ttl sets the cadence. Both default to 0 (off), so legacy/sim configs are unchanged. Regressions: core/chain/redteam_verify_objective-antirelease_g4_test.go (sub-floor bonds earn zero standing / are rejected; standing decays without renewal and persists with it) and core/node/redteam_verify_objective-antirelease_g4_test.go (through the real bond.VerifySpaceTime: a validator that stops renewing lapses; a continuously-renewing one keeps standing).

Retest G3 (Accountability, High regression): a genesis bond-squat can no longer lock out an honest validator — the fresh pass found the F1 per-root dedup (#158) became a griefing lever when combined with the pre-existing unvalidated genesis BondRegs: a malicious genesis pre-squats an honest validator's real plot root under an attacker key (no space-time proof — genesis regs are declared), so when the true holder later registers that root on the normal path with a REAL, verifier-accepted proof, apply's first-owner dedup sees the root already claimed and drops the honest credit — the holder earns 0, the squatter keeps unbacked standing. Fix: proof beats declaration. apply now tracks whether a root's owner claimed it with a verified proof (a height>0 registration, gated by validateBondRegs) or a mere declared genesis reg (bondRootProven); a verified registration DISPLACES an unproven declared claim (stripping the squatter's standing), while every other collision still earns nothing — so once proven, first-proven-owner wins and F1 is preserved. Regressions: core/chain/redteam_verify_genesis-bondsquat_g3_test.go (inverted PoC: V's proof displaces the squat; a second identity still can't share the proven root) and core/node/redteam_verify_genesis-bondsquat_g3_test.go (a real live bond registration displaces a genesis squat through the objective space-time verifier).

Retest G1 (Accountability, Critical regression): a genesis block can no longer carry an equivocation Slash — the fix-verification red-team's fresh pass over the F1/F2 code found that #158's on-chain Block.Slashes reopened, for a stronger lever, exactly the door #159 (F3) closed for Revocations. AppendGenesis skips validateSlashes, and apply unconditionally evicts every Slashes culprit (slashed[id]=true, dropped from bonded, barred from re-earning, carried through adopt), so a genesis carrying an unverified Slash was a proof-free, pre-emptive, identity-level kill switch — a fortiori what immutable #5 forbids. A slash is only meaningful against equivocation within a chain's own history, of which a genesis has none, so AppendGenesis now rejects any genesis carrying Slashes (ErrGenesisTakedown), symmetric with the F3 guard; a slash must go through the normal path where validateSlashes → VerifyEquivocation gates it on a real double-sign proof. Regressions: core/chain/redteam_verify_genesis-slash_g1_test.go (genesis slash denied, victim keeps standing, normal-path slash still fires on a real proof) and core/node/redteam_verify_genesis-slash_g1_test.go (a node in objective mode never establishes a genesis that evicts an honest bonded validator).

Blind red-team F4 (integrity, S1): the auditor no longer trusts a prover's self-reported PoR block count on the file's last shard — the audit graded every leaf but the last against a block count it recomputed itself, while the LAST leaf took a lenient "tail" branch that accepted any 1..wantFull. Since porChallenge clamps the sample space to the prover's reported count, a liar holding only block 0 of an N-block shard could report PorBlocks=1, be challenged on block 0 alone, and pass — earning rent while holding ~1/N of the shard, with no slash and no repair. The premise behind the leniency was wrong: chunk.Split zero-pads the last frame up to ChunkSize (the true length rides in the frame header) and erasure pads short stripes, so every stored shard is full-size on the wire — there is no short tail to accommodate. The auditor now demands the same recomputed full block count for every leaf, so a prover can never shrink its own challenge. Regressions: core/node/redteam_verify_liar-por_0_test.go (inverted PoC — the shrink liar's grading predicate now fails, an honest holder still passes) and sim/audit_tailshrink_test.go (integration: a shrink liar on a single-chunk file's sole — previously lenient — leaf is slashed into debt while honest holders pass).

Blind red-team F3 (Accountability): genesis can no longer pre-emptively revoke a never-published root — AppendGenesis calls apply directly and skips validateTakedowns, so a genesis block could carry Revocations naming a root never published — a pre-emptive takedown, exactly what immutable #5 forbids ("a takedown is never pre-emptive"), honored forever by any node running -honor-chain-revocations. AppendGenesis now rejects any genesis carrying Revocations or Unrevocations (ErrGenesisTakedown): a genesis seeds entries and declared launch bonds only; a takedown must go through the governed normal path where ErrRevokeUnknownRoot enforces that the root already exists. Regression core/chain/redteam_verify_censor_0_test.go (inverted PoC: genesis takedown rejected; the normal-path existence guard still fires).

Blind red-team F1 (Sybil, Critical) + F2 (equivocation slash inert): the objective validator set now honors the two defenses it was bypassing — a second, blind red-team pass (ae005e9) found that promoting objective on-chain-bond fork-choice to the M0 default (#154) made it authoritative for standing, but it skipped two defenses that lived only in the non-authoritative core/credit reputation ledger. Both are now carried into core/chain. F1 — per-root bond dedup: the objective set never checked that a bond Root was unclaimed, and the space-time proof is not identity-bound, so N cheap identities could register the same plot's root+answer and each earn full MinBond fork-choice weight — one 4 MiB disk buying a whole write quorum. apply/validateBondRegs now enforce a bondRootOwner map (a root credits AT MOST ONE identity, the first to claim it; the owner may renew), so N Sybils cost N independent bonds again. F2 — on-chain equivocation slash: SlashEquivocation only mutated the reputation ledger, which objective mode never reads, so a proven double-signer kept full eligibility and weight. Slashing is now an on-chain record (Block.Slashes, a self-verifying equivocation proof) that on commit evicts the culprit from c.bonded and bars it from re-earning standing — applied in lockstep on every replica; a forged slash is rejected (ErrBadSlash), so forged-slash griefing stays denied. The node records detected equivocations on-chain in the next block it proposes. Regressions: core/chain/redteam_verify_* (shared-root denied, slash evicts, forged slash rejected) and core/node/objective_slash_test.go (over the loop: a node detects, records, and every replica evicts).

Consensus (red-team F7): cross-height double-backing resolved — by F6 plus sound same-height slashing, without slashing honest reorg-followers — the report's F7 (sign fork A@1, sit out B@1, sign B@2 — never the same height on both, evading the same-height equivocation slash) is now resolved, and the resolution is the honest one rather than a wrong slashing rule. Worked through precisely and locked in core/chain/redteam_f7_test.go: (1) same-height double-signing is still slashed (FindEquivocations, the distinguishable misbehavior); (2) cross-height double-backing is provably indistinguishable from an honest reorg-follow from the blocks alone (a validator that attested A@1 then followed a heavier fork to attest B@2 produced identical evidence), so any rule slashing "signed two incompatible forks" would slash honest validators — a regression — and detection correctly does not flag it (the guard test); (3) objective fork-choice (F6) neutralizes it anyway — the double-backer cannot make both histories stand, the heavier-bond fork wins on every replica. The pre-F6 design had planned Casper-FFG surround-vote slashing; the analysis shows it is unnecessary here (F6 neutralizes) and, for this exact pattern, ineffective (the spans do not surround), so a finality gadget is not added for M0. docs/design/m0-consensus.md §2b carries the reasoning.

Consensus (F6): the objective-fork-choice cold-start — an anchor-bootstrapped validator set that builds itself from real bonds — objective mode had a chicken-and-egg: a validator must be bonded ON CHAIN to propose/attest, but the first block that records bonds must itself be proposed and attested. It is now solved with the existing training-wheels anchors: in objective mode a declared anchor is eligible to propose/attest while the network is immature (Chain.launchAnchor), so the declared launch set commits the early blocks; validators register their real bonds live as they propose (Node.RegisterBondReg, attached by proposeBlock; Chain.Objective / NewBondReg / BondRegNonce are the seam); and the anchor eligibility sheds mechanically at maturity (Mature). It grants eligibility, never fork-choice weight — weight is always summed real bond, so a declared anchor can never outweigh a proven one, and a network that never decentralizes simply keeps its training wheels. Coverage: unit (core/chain/objective_coldstart_test.go — an anchor bootstraps an empty objective set then sheds at maturity) and integration (sim/objective_coldstart_test.go — an anchor-only network with a separate empty ledger per node bootstraps consensus, and proposers become really bonded on-chain by self-registration, agreed across replicas). Residual: the daemon -objective flag wiring + an e2e run over real daemons. See docs/design/m0-consensus.md.

Test coverage backfill (build-immutable): the Accountability fix (F5) now has the integration tier — the F5 fix (on-chain revocation is existence-checked, per-operator opt-in, reversible) had unit + node-white-box coverage; this adds the integration tier over the full node loop (sim/revocation_test.go): a bonded quorum publishes a root, then commits an on-chain revocation of it over the wire, and — the load-bearing property — the takedown is honored per operator: a subscribing node (SetHonorChainRevocations) denies the root while a node on the identical chain that did not subscribe does not (never a global switch); and a quorum cannot revoke a root the chain never committed (ErrRevokeUnknownRoot). Adds Node.WouldDeny — operator-facing observability for the effective, per-operator takedown decision. e2e is explicitly deferred: the daemon does not yet expose chain-revocation proposing (no revoke command / auto-propose) or the honor-subscription flag, so the full quorum-revocation-honoring flow is not drivable end-to-end; it lands when those daemon features do. A stated tier choice, not a silent gap.

Test coverage backfill (build-immutable): the Privacy fixes (F4) now have the integration tier — the fee-decoupling and canonical-issuer-set fixes shipped unit-only; this adds the outcome-driven integration tier. Fee decoupling (sim/credit_fee_test.go): a publisher mints prepaid credits over the real node loop (charged in bulk at mint), then publishes by SPENDING a credit over the wire — and its durable standing key balance is unchanged by the publish (the ledger-level link severed end-to-end), the token verifies, and re-spending a credit over the wire is refused (double-spend). Canonical issuer set (core/node/objectivechain_test.go): two nodes on the same objective genesis surface the IDENTICAL deterministic on-chain-bonded issuer set, and a node with no chain surfaces none. e2e for the transport-layer parts (relay + ephemeral + epoch) lands with those parts, which are not yet built.

Test coverage backfill (build-immutable): the Sybil fix (F1/F2) now has the integration tier it was missing — the shipped Sybil fix carried only its unit tier (the red-team PoC inverted in core/bond); the build-immutable rule (V5) requires unit + integration + e2e. Added the integration tier: sim/bond_release_test.go drives the property through the live audit wire (gossip → MsgBondChallenge → answer → VerifySpaceTime → ledger) — a validator that pledges a bond, advertises it, then RELEASES the resident bytes (holding at most the 32-byte leaves, the attacker that frees the space to save disk) FAILS the live audit and earns ZERO standing, while an honest full-plot validator earns it. A bond.Commitment.ReleaseBlocks / Node.ReleaseBond adversary seam (cf. SetLiar for PoR) models the release. e2e is already covered by e2e/TestBondEarnedStandingCommitsOverTCP (two real daemons proving bonds to each other over real TCP, exercising the fixed read-bound-seed protocol); the released/leaves-only adversary is proven at unit+integration rather than e2e because forcing it end-to-end would mean shipping attack behavior in the production binary — an explicit, stated tier choice, not a silent gap.

Consensus (red-team F6): objective fork-choice is now wired into the node, with integration + unit coverage — the F6 objective-weight mechanism (on-chain BondRegs) previously existed only in core/chain behind a verifier a caller had to supply. A node now wires it in one call: Node.EnableObjectiveChain injects the real space-time bond verifier (bond.VerifySpaceTime, the same check the audit loop runs), and Node.RegisterBondReg mints a signed registration from the node's held bond for live entry into the objective set (chain.NewBondReg / exported chain.BondRegNonce; EnableBond now records the identity signer so a bonded node can register before it joins consensus). Coverage now spans all three tiers per the build-immutable rule: unit — a live registration round-trips through the real verifier and a tampered space-time proof is rejected (core/node/objectivechain_test.go); integration — the red-team's non-healing-partition scenario inverted, with a separate empty ledger per node (so the local reputation view is useless, unlike sim/reorg_test.go's shared ledger): the partition still commits and heals to the heavier-bond fork on every replica (sim/objective_consensus_test.go). Residual: turning objective mode on by default in the daemon (a genesis/anchor-seeded validator cold-start plus a live-registration submission path), and an e2e multi-process run, remain; see docs/design/m0-consensus.md.

Privacy (red-team F4 §2c): a canonical, on-chain issuer set so the validator subset a publisher asks leaks nothing — a publisher previously acquired publish tokens from whatever validator subset its -peers gave it, so a colluding issuer minority could narrow the anonymity set by which validators a given publish asked. Chain.CanonicalIssuers (and Node.CanonicalIssuers) now derives a deterministic issuer set from the on-chain bond (the same objective bonded map that heals fork-choice, F6): bonded validators ordered by size then NodeID, identical on every replica. Every publisher asks the same validators, so the subset choice carries no signal. Regression (core/chain/redteam_consensus_test.go) proves two maximally-divergent replicas produce the identical ordered set. This is one of the three network-layer parts of D3; the transport parts (routing issuance over the content-blind relay from an ephemeral identity, epoch batching) are still pending, so IP+timing correlation remains until they land. See docs/design/m0-privacy-issuance.md.

Privacy corner (red-team F4): the per-publish fee no longer links a publish to its standing key — token issuance de-anonymized the publisher two independent ways: over a non-anonymous transport (IP+timing) and via ChargePublish(from), a per-request debit of the durable standing account. This lands the fee decoupling — prepaid publish credits (online Chaumian e-cash, Chaum 1982). A credit is a blind signature under the issuer's key but in a separate FDH domain (blindtoken.BlindCredit/VerifyCredit), so a credit can never be presented as a publish token or vice versa even under one key. The fee is charged in bulk at mint (a normal, charged token request blinded in the credit domain); at publish the requester spends a credit (Message.Credit, verified and marked spent in an online double-spend set) and the issuer does not charge the durable identity — severing the ledger-level link. The change is purely additive: a request with a credit spends it (no debit), a request with none takes the legacy charged path, so existing token flows are unchanged (whole suite + vet + -race green). New helpers Node.AcquireCredits (bulk mint) and Node.AcquireTokenWithCredits (spend). Regressions in core/node/redteam_privacy_test.go show a mint charging once, a publish charging nothing more, a spent credit refused (double-spend), a forged credit refused, and the credit/token domains proven non-interchangeable. Residual (honest): the network-layer link — routing issuance over the content-blind relay from an ephemeral identity, epoch batching, and a canonical validator set — is not yet built, so a colluding issuer minority can still correlate by IP+timing; the privacy corner does not fully hold until that lands. See docs/design/m0-privacy-issuance.md.

Consensus corner (red-team F6): fork-choice is now objective — honest replicas stop diverging — fork-choice weight, the quorum count, and proposer/attester eligibility used the local reputation view (c.rep(id)), so two honest validators that had audited different peers computed different weights and forked permanently (the partition never healed). Fork-choice is now driven by on-chain PoST-bond registrations (Block.BondRegs): a validator records its bonded size with a fresh space-time proof any replica re-verifies (SetBondVerifier), bound to the block's parent so it can't be replayed to another height/fork and signed so it can't be claimed by a non-holder. Weight becomes the summed on-chain bond of a block's distinct attesters — a quantity every replica recomputes identically from the chain — so divergent local views can no longer disagree on which fork is heavier, and a lighter fork reorgs onto the heavier one on every honest node. The mechanism is additive and opt-in (Config.MinBond > 0): the field is omitempty so a block with no registrations hashes exactly as before (no BlockVersion bump), and the default path is unchanged — the legacy reputation-gated behavior and every existing test/sim are untouched. Regressions in core/chain/redteam_consensus_test.go show two maximally-divergent replicas computing the same weight, a partition healing to the heavier-bond fork, and a forged registration (bad proof or bad signature) denied. Residual (honest): the objective-mode wiring in the node/daemon (validators emitting registrations, a genesis-seeded validator cold-start, enabling MinBond in production) is a follow-up, and F7 — cross-height double-backing evading the same-height-only equivocation slash — is not yet fixed (it needs Casper-FFG-style surround-vote slashing that spares honest reorg-followers). See docs/design/m0-consensus.md.

Sybil corner (red-team F1/F2/F3): the PoST bond now binds the bytes it charges for, and the VDF is bound to a plot read — the external M0 red-team broke the Sybil corner three ways; the first two are now fixed at the mechanism level (core/bond), per docs/design/m0-sybil-bond.md. (F1) plotBlock derived each 4 KiB block from only the 32-byte leaves of its predecessor and parents, so a prover could store just the leaves (1/128 of the bond) and recompute any probed block on demand. Each block now depends on the full bytes of its predecessor and its parents, selected over a proven depth-robust graph (DRSample, Alwen–Blocki–Harsha CCS'17) instead of the old flat-uniform parents — so reconstructing a block requires the parents' bytes recursively and the pebbling cost is Ω(n); the rational strategy is to store the S bytes, and the charged size equals the resident footprint. Verify never recomputes a block, so it stays O(log n). (F2) AnswerSpaceTime seeded the VDF from the public challengeSeed(root, nonce), so a zero-resident prover ran the VDF and then re-derived the sampled blocks — releasing the space forfeited nothing. The VDF is now seeded from a plot block read before the VDF (seedIndex → challengeSeedST): the answer carries that block plus its inclusion proof, the verifier recomputes the seed index and checks the proof, so a prover that released the space cannot produce the seed without the Ω(n) recompute. (F3) root-owner dedup is documented as only a same-root tiebreak; Sybil cost now lives in the byte-bound proof, and distinct identities still produce distinct plots. The plot on-disk format (adapters/diskplot) bumps to version 2 so a restart re-plots rather than reloading the old, insecure labeling (one-time re-plot on upgrade). The red-team PoCs are adopted inverted as regressions (core/bond/redteam_sybil_test.go), and BenchmarkSeal records the plot/re-plot constant (~270 MB/s) behind the "re-plot ≫ epoch" tuning. Residual (honest): the structural anti-release binding is in; the quantitative floor — a minimum bond size and BondVDFDelay such that even the smallest allowed bond cannot re-plot within one challenge window — is a deployment-tuning follow-up, and consensus fork-choice weight (F6) still depends on this bond being real. See the design doc's open-risks section.

Accountability corner (red-team F5): on-chain revocation is no longer a global switch — the external M0 red-team broke the accountability tenet three ways through the chain's takedown path: a quorum could revoke a root it never published (no ownership or existence check); the takedown was honored by every chain-follower with no opt-out — a global switch the tenets say cannot exist; and it was irreversible. All three are fixed. (1) ValidateProposal and the commit path now reject a block whose Revocations name a root never committed on this chain (ErrRevokeUnknownRoot) — a quorum cannot censor content that isn't on the ledger, nor a competitor's unpublished hash. (2) Honoring on-chain revocations is now a per-operator subscription — ReplicaRegistry.HonorRevocations and node.SetHonorChainRevocations, both default off — so following the chain never silently imposes someone else's takedowns; the effect is "proportional to who trusts you" (TENETS §9), the same voluntary stance as the operator-local denylist, never a universal switch. (3) Added an un-revoke record (Block.Unrevocations, quorum-gated and committed in the block hash) so a takedown is reversible by the same governance that imposed it, not a permanent asymmetry. The red-teamer's own PoC now fails at its ownership check; adopted inverted as core/chain/redteam_f5_accountability_test.go and core/node/redteam_f5_subscription_test.go (unit + node-integration; the operator-local takedown sim remains the e2e). Traces to immutable #5, Don't #2, S4. The other red-team breaks (Sybil bond F1/F2, privacy issuance F4, subjective fork-choice F6, cross-height equivocation F7) remain open — see the M0 status note below — this fix closes the accountability corner only.

Doc-truth reconciliation + a token round-trip playbook (acceptance round 3) — the third acceptance re-run PASSED again (all 9 flows, all 8 tenets, zero code defects); its findings were stale docs and one discoverability gap, several making the product look worse than it is. (F1) risk-register.md row 14 claimed a default publish still writes a permanent Publisher→root map — but the chain default now REJECTS Publisher entries (-allow-publisher=false), so a default publish records no author; updated to CLOSED-by-default, with blind tokens as the additional opt-in for full unlinkability. (F2) threat-catalog.md F1 still said "the RSA issuer key is in-RAM (persistence is a follow-up)"; it persists now (#126, adapters/diskissuer) — corrected. (F3) the website said publishing is "cryptographically unlinkable" as an unqualified property; qualified to "names no author by default — with opt-in blind tokens, cryptographically unlinkable," matching the honest in-repo docs. (F4) the headline walkthrough (local-test-network.md) never reached the trust-plane flows 4–7; added a "Tier 4 — become a validator" section pointing at examples/ and user-seam.md §Role 4. (F5, doc-note only per decision) documented that a denied root reads to a fetcher as ordinary data-loss (compliant nodes answer "not found" rather than advertising a refusal — deliberate; the fetcher retrieves from another operator). (F6) the F7 sub-claim "the tokens it issued stay valid across a restart" had no operator-level repro; added examples/flow-tokens-issuer-restart.sh — validators require blind tokens, a tokened publish commits (no Publisher), the issuer is restarted (its issuer.key reloads byte-identical, no re-mint), and a token issued by the restarted issuer still commits (peers accept it), with a token-less-publish-refused negative control. Also made silt chain-status's hint line un-ambiguous to grep. No mechanism changed. Traces to S5.

Docs & UX polish (acceptance re-run new-F3/F4/F5/F6) — four minor/cosmetic gaps the passing re-run surfaced, each a small correctness or clarity fix, no mechanism change. (F3) the Tier-1 "erasure by hand" walkthrough listed objects as flat under .silt/objects/ and told you to rm .silt/objects/<a-few> — but objects nest one level under a 2-hex prefix (.silt/objects/<xx>/<hash>), so that command targets a whole prefix directory, and it could delete the single-copy manifest chunk and brick get; rewritten to use silt info … -shards to pick real data/parity shard hashes, delete them by their true path, and warn the manifest is single-copy on one node (README.md, docs/local-test-network.md). (F4) silt daemon -h described -registry as http://host:port — the exact form the key-pinning contract refuses; the flag help now reads ID@https://host:port (key-pinned — copy the daemon's 'registry:' line verbatim). (F5) the website's feature list didn't mention NAT traversal (thoroughly documented in the repo but invisible to a site visitor); added a "Reaches across NATs" card. (F6) silt get <siltcare:…> refused with link: not a silt:v1: link, which reads like a typo rather than an intentional capability boundary; link.Parse now recognises a care link and says so, and silt get points to silt info / silt daemon -care and the full link (unit test pins the clearer error). Traces to S5. See the M0 acceptance re-run report.

Gate 4 (#52, acceptance F1): a restarted validator rejoins the chain instead of being stranded at its pre-restart height (D2) — the M0 acceptance field test found the one blocker: kill a validator, let the network commit a block without it, restart it on the same -store, and it never caught up — it sat at its old height forever while the live set advanced, so over time the validator set could only shrink. Two compounding causes, both rooted in the same mistake — treating reputation (a live, local, NON-persisted view, re-earned by bond audits) as if it were a property of a persisted block. (1) Reloading our own chain re-ran every block — including the genesis — through the full commit gate (chainstore.Replay called chain.Append), so at boot, before any bond audit had run, the empty reputation view failed the very first block: reputation below threshold: proposer <genesis-id> has 0, needs 100. The genesis is designed to bypass that gate (AppendGenesis); replaying it through the gate cannot work. (2) Catching up on missed blocks fired SyncChain exactly once, at boot, gated on -attesters, and BEFORE StartBondAudit — so it ran against an empty reputation view (adopting nothing, since it can't yet tell which fork carries real standing) and then never retried. The in-process consensus sim hid both because it PRE-POPULATES reputation before the latecomer syncs. The fix draws the trust boundary at whose disk it is. Our OWN committed history is reloaded by Chain.Reload, which re-verifies each block's cryptographic integrity — hash ancestry, the proposer signature, and a quorum of distinct verifying non-proposer attester signatures (so bit-rot, truncation, or tampering is still caught, B7) — but NOT the time-varying reputation gate, which a validator already satisfied when it committed the block live; genesis reloads via AppendGenesis as it always should have. A PEER's fork is a different trust class and still goes through Reconcile with full reputation re-validation. Catch-up is now a periodic, retrying StartChainSync loop (ChainSyncInterval, default 30s), UNGATED on -attesters (it targets the explicit set plus every validator learned from a gossiped bond, so a node restarted with only -bootstrap still rejoins), and the daemon runs it AFTER StartBondAudit so peer standing is being re-earned — a later sweep, once audits land, adopts the missed blocks and persists them. Tested (V5): unit — replaying our own [genesis, block1] with an EMPTY ledger now rejoins at height, while a tampered block is still rejected (ErrBadSignature); node — a restarted validator adopts NOTHING while its standing view is empty and catches up the instant bond audits restore peer standing, and syncTargets includes a bond-learned validator with no -attesters given. Honestly labelled: fork-choice weight is still the locally-qualified reputation view (fully-objective, partition-independent on-chain PoST-bond weight remains the recorded D2 hardening), and a bespoke multi-daemon restart harness is deferred to the acceptance re-run — the field test roadmap #52 exists to prove. Traces to M0, B7, D2, #52. See docs/design/gate4-m0-mechanism.md §3e.

Gate 4 (acceptance F2/F7): the trust plane narrates itself — an operator can SEE standing, bond reload, and caretaker sweeps (S5) — the M0 mechanisms worked but ran silent, so the acceptance operator had to read source to confirm the earned-standing and self-heal claims. Four honest-observability fixes, all at -log info: (standing) a validator now narrates its own consensus standing every bond-audit sweep and the verdict of every peer bond challenge (standing, bond challenge), so the earned-standing mechanism the whole of M0 rests on is visible rising and decaying rather than inferred from a diffed chain.cbor; (bond reload) a restart that RELOADS its plot now says reloaded the … bond (no re-plot) instead of the identical sealed … wording a first-time plot uses — the "no re-plot" guarantee held, but the log had actively suggested the expensive path ran (EnableBond now reports reloaded-vs-sealed); (caretaker) the repair sweep logs stripe degraded, within repair slack — watching when it sees a loss that parity/replication still covers, so an operator who kills a holder sees the caretaker NOTICE rather than apparent silence — repair fires (stripe repaired) only once losses exceed the slack, which with the default replication takes more than "a couple" of deaths, and repair below k already marks the can't-yet-reconstruct case; (default on) a validator with no -log flag now defaults to -log info — the M0 stakes mean the normal path should narrate itself in the field, not stay dark until someone knows to ask (non-validators are unchanged: logging stays off). The flagship self-heal walkthrough (docs/local-test-network.md) is rewritten to set honest expectations (why killing "a couple" of holders correctly heals nothing visible, how to actually strand a stripe, and silt sim run churn for the dense version). A read-only Reputation accessor was added to the CreditLedger port for the narration. No mechanism changed — this is pure observability. Traces to M0, S5 (honest observability), B5. See the M0 acceptance report.

Docs (acceptance F4/F5/F6/F8): the getting-started guides match reality — the acceptance operator hit four first-five-minutes doc snags, none breaking the product but each eroding "every step works / every counter reproduces": (F4) three guides (README.md, docs/local-test-network.md, docs/v1-test.md) said add "prints the root hash" / a "64-char hex string" then told you to get <root> — but add prints a full silt: link and get/info/swarm get need that whole link, so a literal newcomer hit an error; every such placeholder is now <silt-link> with the output described as a link (the top-level silt usage block was already correct). (F5) the quoted sim run economy -seed 21 figures were stale — refreshed to the actual deterministic output (Gini 0.00 → 0.63, top earner ~1.25 MB, freeloader ~444 KB, 20/36 second-round publishes ok). (F6) the silt sim run usage error listed only scatter and the top-level usage omitted half the scenarios — both now list all eight (scatter, churn, economy, audit, capacity, consensus, bondstanding, takedown), including the previously undocumented bondstanding. (F8) the user-seam.md store-layout table listed chain/ (a directory); the committed history is a single chain.cbor file. Traces to S5 (honest observability extends to the docs). See the M0 acceptance report.

Gates 1–3 completeness audit: closed missing regressions in the floors — a pre-Gate-4 audit verified the landed floors (Gate 1), register-after-distribute (Gate 2, #65), and NAT traversal (Gate 3, #27/#111) are whole at all three test tiers, and fixed the coverage gaps it found. The register-after-distribute failure outcome had no regression: the one sim test touching an unplaceable scatter used the old Add (publish-up-front) path, so it couldn't catch a dangling entry. The gate is now a single tested helper, pipeline.RegisterAfterDistribute (publish iff the scatter confirmed), that both the swarm add and daemon-UI publish paths call instead of hand-rolling "publish iff derr == nil" — covered by a pipeline unit test (both branches) and a sim test that drives the real node.Distribute failure and asserts the registry is left empty (S5). The relay's per-target session cap (PerPeerSessions, the #65 knob) gained an isolation test proving one target's fan-out can't be throttled by — or monopolise beyond its slot — another's; previously only the global MaxSessions branch was exercised. The default -dns-seed is documented as a deliberate empty (neutral infrastructure, community-run seeds — #27 Part A), not an unfinished hole.

Transport frame cap was smaller than the minimum production chunk — a whole chunk rides in one length-prefixed frame, but the inbound read loop's cap was 32 MiB while the minimum production chunk is 64 MiB, so every production-sized chunk was dropped on receipt; the swarm could only move sim-sized (64 KiB) chunks. The cap is now derived from the manifest chunk-size ceiling plus envelope overhead (maxFrame = manifest.MaxChunkSize + frameOverhead), so the wire can always carry a chunk the manifest layer accepts and the two limits can't drift. Send now also rejects an over-cap frame with an explicit error instead of emitting one the peer silently drops (S1/S3). Traces to S1/S3 and anti-persona #14. Closes #104.

The daemon no longer silently drops config fields (#71): cmd/silt built node.Config field-by-field, so any field added to DefaultConfig defaulted to its zero value in the real binary — how the #65 fetch-retry shipped inert and demand-responsive dispersion was off in the daemon while the roadmap listed it as done. The daemon and the ephemeral swarm add/get client now start from node.DefaultConfig and override only what genuinely differs (the daemon's 2s RequestTimeout), so new fields are inherited by default.

A restarted daemon's content stays discoverable (#69, found in the #65 field test): provider records live only in peers' memory and die with the process, so a daemon re-announces everything on its disk at startup (AnnounceHeld) — but a coded shard must be announced under its column key hash(root‖column), where readers look, and that key is derived from the shard's storage proof. Proofs were kept only in memory, so after a restart the re-announce fell back to the bare chunk id and a disk full of intact content was invisible until it happened to be re-hosted. Storage proofs are now persisted alongside the chunks (adapters/diskproofs) and reloaded on startup, so the re-announce lands on the right key again — and the node can still answer storage-audit challenges after a restart. The integration/nat harness gained a RESTART=1 scenario that restarts the whole swarm and re-fetches to prove it.

Fetches survive a saturated relay (#65): once the public rendezvous node hits its capacity cap, every byte to a NATed provider funnels through the relay, whose per-peer splice slots saturate under concurrent fan-out and return "relay at capacity" — and the fetch path had no retry, so a transiently-refused chunk was reported unreachable (the tail-of-sweep fetch failures seen from a second network). A chunk fetch now re-sweeps its providers with a backoff when every provider failed transiently (a timeout or relay refusal, not a clean "don't have it") — the freed slots make the retry succeed — the fetch-side analogue of the #63 placement retry (FetchAttempts/FetchBackoff, default 3× / 200 ms). A clean miss (nobody has the chunk) still returns after a single pass. The relay's concurrency defaults are also raised from 64/8 to 128/16 (global/per-peer): splices are short-lived, so this is realistic headroom for a rendezvous node while staying a bounded, operator-tunable cost (each splice is still byte-capped). Remaining, tracked in #65: register-after- distribute (a loud placement failure still leaves a dangling registry entry), and hole-punching (the structural fix that moves bulk bytes off the relay entirely).

Publish no longer returns a link for a file the swarm can't rebuild (#64, the data-shard twin of #60): placement verified that manifest chunks landed durably, but data and parity shards were placed optimistically — a column that no node accepted was ignored, so under load a stripe could silently erode below its erasure threshold k and the publish still returned a valid-looking link (in the field, f123 came back stripe 0: only 9 of 16 shards, need k=10, unrecoverable). Distribute now tracks per-shard placement and, before returning a link, verifies every stripe kept enough placed shards to reconstruct (accounting for the known-zero padding of a short final stripe); a column that lands nowhere is retried with a fresh lookup (as manifest chunks already were), and if a stripe still can't be made recoverable the publisher fails loudly instead of handing back an unrebuildable link. The same check closes the identical silent-loss on uncoded files (which carry no parity, so every chunk is required). Extends tenet B7 — trust but verify; no optimistic operations from the manifest path to all of publish.

Publish no longer returns a link for content it never stored (#60, found in the 300-file scaling re-test): under load, once the network passed its capacity cap, a manifest chunk could be placed on no node (all candidates full or unreachable) yet publish still registered the root and returned a valid-looking link — ~14% of files were stranded behind dangling links (fetch failed with "manifest chunks unreachable"). A manifest chunk that lands nowhere is now retried with a fresh lookup (these misses are usually transient — a relay hiccup once the nearest nodes cap out and load shifts onto NATed hosts), so publishes that used to strand now succeed; if it still can't be placed after several tries the publisher fails loudly instead of handing back an unretrievable link. This makes publish honor the new tenet B7 — trust but verify; no optimistic operations.

Ghost routing entries no longer break discovery at scale (found in the 300-file scaling test, #43): every swarm add/swarm get ran as a short-lived client with a fresh identity, and nodes both routed to those clients and persisted them to peers.json — so a busy node's routing table filled with dead entries (in the test: 327 entries, 2 live, ~75% query timeouts), which broke provider discovery and made most fetches fail. Fixed at both ends: nodes persist only peers they have actually reached, and a short-lived client stamps its messages so peers never route to it.

Re-publishing identical content is idempotent (#46): a failed publish could leave a root registered but return no link, and a retry then hit "root already published with different entry" — because idempotency compared the whole entry, including the per-invocation publisher identity. It now dedups on content, so a retry (or a second person adding the same file) succeeds instead of colliding.

NATed peers can actually converse (found in the first real cross-network test, #27): the transport dialed a fresh connection per message, so a reply required dialing into the requester — impossible behind NAT, and bootstrap came back with zero table entries. Replies (and all traffic) now ride the live connection the peer opened, and dialed connections are kept and reused. Two corollaries: a wildcard bind (0.0.0.0/[::]) is never stamped on outgoing messages (it used to poison peers' address books with an undialable address — a new -advertise HOST:PORT flag lets a public box say what to gossip), and a daemon that registers with a relay now re-bootstraps through it, since its first join attempt may have been unanswerable. The reachability dial-back deliberately never reuses a connection — its meaning is "a fresh inbound dial landed" — so AutoNAT stays honest.

Relay-form addresses survive -bootstrap, DNS seeds, and peers.json — peer strings split on the first @, not the last, so ID@relay:RID@host:port parses instead of being silently dropped.