igneum-network/igneum
1
0
Fork 0
Code Issues Pull requests Releases Activity

finality-leave plan: the once-set digest rule of the 0.3.17 rebase, and the testnet genesis table (leave on from genesis, the project lead's decision)

Browse source 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
igneum-labs 2026-10-06 23:19:06 +00:00
parent 93502de644
commit 90a920b68f
1 changed files with 13 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
docs/plans/finality-leave.md
View file

@ -11,7 +11,7 @@ branch `finality-pause-node` on 4c6b129d (release 0.3.14's node), worktree
| Piece | Where | What |
|---|---|---|
| The leave item | `consensus/core/src/finality.rs` | `Leave { daa, pubkey, signature }` (152 bytes) signed under `DST_LEAVE` over `"igneum-leave-v1/" || chain_id || 0 || daa_le`; `FinalityItem::Leave` tag 4; `FinalityGossip::Leave`; `FinalityParams::leave_delay` (serde default 3,600; mainnet and devnet 3,600) |
| The switch | `consensus/core/src/config/params.rs` | `finality_leave_activation_daa` on `Params` and `OverrideParams` (never on mainnet, devnet, simnet; 0 on the testnet, which is born on every switch), in the digest with `leave_delay` |
| The switch | `consensus/core/src/config/params.rs` | `finality_leave_activation_daa` on `Params` and `OverrideParams` (never on mainnet, devnet, simnet; 0 on the testnet, which is born on every switch), in the digest with `leave_delay` ONLY ONCE SET (the 0.3.15 rule for new fields, applied at the 0.3.17 rebase: the binary rollout leaves the devnet digest at c562d70e...; the digest moves when the override file sets the switch) |
| The rule | `consensus/src/processes/finality.rs` | `leaves_at` (like `bans_at`: a key has left at C when a block in C's past carries its leave and `daa(e) + leave_delay <= daa(C) < daa(e) + window`); `voters_at` applies leaves with the bans (the sliding table); `frozen_floor` subtracts the keys that left at C from the frozen table's denominator and their signatures from its numerator (Q5); `ingest_leave` (one record per key, carriers dated), `submit_leave`, carriage in `template_section` LAST and only once the rule is active; persisted state layout 3 (`leaves`), layouts 2 and 1 read and upgraded |
| p2p | `protocol/flows/src/v10/finality.rs`, `flow_context.rs`, `v17/`, `service.rs` | `KIND_LEAVE = 3`; protocol version 17; `broadcast_finality_leave` to peers at 17 or later only (an older relay flow returns a protocol error on an unknown kind and drops the peer); every peer still reads leaves from blocks |
| RPC | `rpc/*` | `submitFinalityLeave` (hex of the wire bytes; `accepted`, `reason`), op 157, proto ids 1129 and 1130 |
@ -46,6 +46,18 @@ who buys keys to make them leave is worse off than one who signs with them (w +
The harness case is designed here and not yet run: it needs 0.3.16 binaries on the harness host (the box builds Linux
binaries; the Mac's harness runs macOS ones), so it is the first thing the Devnet 2 crossing does.
## 3a. The testnet genesis (the project lead's decision, 6 October 2026 night: "leave on from genesis")
| Field | igneum-testnet-1 genesis value | Why |
|---|---|---|
| `finality_leave_activation_daa` | `0` | the testnet is born on every switch (`TESTNET_PARAMS`, `consensus/core/src/config/params.rs`); a chain with no pre-switch history has nothing to protect, and W7 is a launch requirement (a 30-day pause on a silent departure is the alternative) |
| `finality.leave_delay` | `3600` | one hour of DAA, the merge-depth bound; the same value on every network |
Both go into the testnet's genesis table in `docs/plans/testnet-go.md` beside `finality_v3_activation_daa: 0`, in the
0.3.17 object. The testnet digest moves with them (the field enters the digest once set, and on the testnet it is set
from genesis), which is fine before go: nothing mines until the go checklist passes. On the live devnet the switch stays
at never until the 95 percent signal; the fast-time profile keeps never.
## 4. What it does not do, stated
A crash, a power cut or a region going dark still age out over the window under Q5 (two hours on the devnet, 30 days on