From 90a920b68fb3a20abd1a54ecfbfdd908b288e81f Mon Sep 17 00:00:00 2001 From: igneum-labs <337424239+igneum-labs@users.noreply.github.com> Date: Tue, 6 Oct 2026 23:19:06 +0000 Subject: [PATCH] finality-leave plan: the once-set digest rule of the 0.3.17 rebase, and the testnet genesis table (leave on from genesis, the project lead's decision) Co-Authored-By: Claude Fable 5.1 --- docs/plans/finality-leave.md | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/docs/plans/finality-leave.md b/docs/plans/finality-leave.md index 4931932b..6c39ad33 100644 --- a/docs/plans/finality-leave.md +++ b/docs/plans/finality-leave.md @@ -11,7 +11,7 @@ branch `finality-pause-node` on 4c6b129d (release 0.3.14's node), worktree | Piece | Where | What | |---|---|---| | The leave item | `consensus/core/src/finality.rs` | `Leave { daa, pubkey, signature }` (152 bytes) signed under `DST_LEAVE` over `"igneum-leave-v1/" || chain_id || 0 || daa_le`; `FinalityItem::Leave` tag 4; `FinalityGossip::Leave`; `FinalityParams::leave_delay` (serde default 3,600; mainnet and devnet 3,600) | -| The switch | `consensus/core/src/config/params.rs` | `finality_leave_activation_daa` on `Params` and `OverrideParams` (never on mainnet, devnet, simnet; 0 on the testnet, which is born on every switch), in the digest with `leave_delay` | +| The switch | `consensus/core/src/config/params.rs` | `finality_leave_activation_daa` on `Params` and `OverrideParams` (never on mainnet, devnet, simnet; 0 on the testnet, which is born on every switch), in the digest with `leave_delay` ONLY ONCE SET (the 0.3.15 rule for new fields, applied at the 0.3.17 rebase: the binary rollout leaves the devnet digest at c562d70e...; the digest moves when the override file sets the switch) | | The rule | `consensus/src/processes/finality.rs` | `leaves_at` (like `bans_at`: a key has left at C when a block in C's past carries its leave and `daa(e) + leave_delay <= daa(C) < daa(e) + window`); `voters_at` applies leaves with the bans (the sliding table); `frozen_floor` subtracts the keys that left at C from the frozen table's denominator and their signatures from its numerator (Q5); `ingest_leave` (one record per key, carriers dated), `submit_leave`, carriage in `template_section` LAST and only once the rule is active; persisted state layout 3 (`leaves`), layouts 2 and 1 read and upgraded | | p2p | `protocol/flows/src/v10/finality.rs`, `flow_context.rs`, `v17/`, `service.rs` | `KIND_LEAVE = 3`; protocol version 17; `broadcast_finality_leave` to peers at 17 or later only (an older relay flow returns a protocol error on an unknown kind and drops the peer); every peer still reads leaves from blocks | | RPC | `rpc/*` | `submitFinalityLeave` (hex of the wire bytes; `accepted`, `reason`), op 157, proto ids 1129 and 1130 | @@ -46,6 +46,18 @@ who buys keys to make them leave is worse off than one who signs with them (w + The harness case is designed here and not yet run: it needs 0.3.16 binaries on the harness host (the box builds Linux binaries; the Mac's harness runs macOS ones), so it is the first thing the Devnet 2 crossing does. +## 3a. The testnet genesis (the project lead's decision, 6 October 2026 night: "leave on from genesis") + +| Field | igneum-testnet-1 genesis value | Why | +|---|---|---| +| `finality_leave_activation_daa` | `0` | the testnet is born on every switch (`TESTNET_PARAMS`, `consensus/core/src/config/params.rs`); a chain with no pre-switch history has nothing to protect, and W7 is a launch requirement (a 30-day pause on a silent departure is the alternative) | +| `finality.leave_delay` | `3600` | one hour of DAA, the merge-depth bound; the same value on every network | + +Both go into the testnet's genesis table in `docs/plans/testnet-go.md` beside `finality_v3_activation_daa: 0`, in the +0.3.17 object. The testnet digest moves with them (the field enters the digest once set, and on the testnet it is set +from genesis), which is fine before go: nothing mines until the go checklist passes. On the live devnet the switch stays +at never until the 95 percent signal; the fast-time profile keeps never. + ## 4. What it does not do, stated A crash, a power cut or a region going dark still age out over the window under Q5 (two hours on the devnet, 30 days on