Testnet go checklist: the late-join gate fails on the serve path (A's archive holds the proof, A never delivers it), facts to the node lane

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs/plans/testnet-go.md

@@ -113,7 +113,7 @@ Mac: 27 passed (the crate is not in the PC build inputs). The packager's self-te
 | 8 | The site's buttons: the download section points at 0.4.0, `site/wallet.html` carries `https://rpc.testnet.igneum.network` and chain id 4462 in place of the placeholder, the terms card (`#testnet-terms`) stays; `node site/build.mjs`, push to master (Vercel deploys) | the site agent | NOT DONE: the placeholder is still in `site/wallet.html` |
 | 9 | Announcement text | the project lead | PLACEHOLDER: "Igneum testnet-1 is open. Coins here have no value. Resets are announced seven days ahead. Download: igneum.network. RPC: rpc.testnet.igneum.network, chain id 4462." (the project lead's words replace this) |
 | 9a | The seeds' cut-over to the re-cut genesis (the runbook below): the re-cut binary on the three seeds, each data directory wiped (the 5 October chain at height 0 has nothing to keep), the digest line read back on each, the mesh re-formed | the infrastructure engineer, on the project lead's go | NOT DONE: binaries built, nothing deployed; the seeds hold the 5 October chain |
-| 9b | Proof retention: every node keeps proofs for the pruning window and the carried-proof rule applies only above the pruning point, so a node joining after the pool's horizon syncs from the pruning point (the coordinator's direction, 7 October 2026, 10:0x UK). Node side done: dc141409 (the rule, the IBD fetch and the relay retry apply from `proving_consensus_verify_daa` only) and aea0ca5c (`ProofArchive`: one file per proof under the exec db's `proofs/`, kept for the pruning window, served when the pool no longer holds the entry), both on `testnet-genesis-2-node`. The gate: `infra/fast-time/tn-late-join.mjs --join-after 700 --prover "node infra/fast-time/tn-prover-loop.mjs ..."` (a fresh node joins after the pool's 600-block window has passed, every proof it asks for from A's archive; the known-failed side is a binary before aea0ca5c, which stalls on "proofs this peer did not deliver in 20 s") | the node lane (done), then this lane | GATE IN PROGRESS: both forms (the archive binaries 57ad7dc2... as the pass side, the pre-archive binaries 8a6f1f56... as the known-failed side) ran on igneum-build-1 from 10:38 UK with a CPU prover beside node A (20 and 18 proofs carried and verified by the pool in under 2 s each, A's archive holding one file per proof on the pass side and none on the other) to 3,373 blocks of the 4,600 the pruning point needs, then were stopped at 11:34 UK under the shift's rule (no miner on any Hetzner box); they re-run on a one-shot pod the fleet lane rents |
+| 9b | Proof retention: every node keeps proofs for the pruning window and the carried-proof rule applies only above the pruning point, so a node joining after the pool's horizon syncs from the pruning point (the coordinator's direction, 7 October 2026, 10:0x UK). Node side done: dc141409 (the rule, the IBD fetch and the relay retry apply from `proving_consensus_verify_daa` only) and aea0ca5c (`ProofArchive`: one file per proof under the exec db's `proofs/`, kept for the pruning window, served when the pool no longer holds the entry), both on `testnet-genesis-2-node`. The gate: `infra/fast-time/tn-late-join.mjs --join-after 700 --prover "node infra/fast-time/tn-prover-loop.mjs ..."` (a fresh node joins after the pool's 600-block window has passed, every proof it asks for from A's archive; the known-failed side is a binary before aea0ca5c, which stalls on "proofs this peer did not deliver in 20 s") | the node lane (done), then this lane | GATE FAILED on the serve path, 14:12 UK, 7 October 2026 (pod os-latejoin-ylp1, RunPod 3070, the archive binaries 57ad7dc2...): node A mined 6,297 DAA with a CPU prover beside it (37 records accepted and verified, 34 proofs in A's archive, one file per carrying DAA, the pool's window long past), B joined fresh through the headers proof (4,617 headers) and stalled at chain block f4f918f7 (DAA 1,828, above A's pruning point at DAA 1,679): "carries 1 proof records whose proofs this peer did not deliver in 20 s", six times, while A's archive holds the file for DAA 1,828 and A logs no serve line: the serve flow does not read the archive. Facts to the node lane 14:2x UK; the pod stays up for the re-run on the fix (row to 16:40 UK). The forms' first attempt on build-1 (10:38 to 11:34 UK) was stopped under the no-mining rule; the second on the pod ran both at once and the 24 GB cap killed every compressed proof; the third ran the pass form alone (one CPU prover fits; 7 of 36 proofs still died at the cap as the exporter's input grew with the chain) |
 | 9e | The proving pin: `TESTNET_PARAMS` pins the shard and aggregator ids of `proving/igneum-prove/elf/manifest.json` as master holds it (shard `0x2b1a81cb...`, pinned 2026-10-05T16:20:38Z). The fin-proof lane's worktree carries a re-pin (shard `0x39db9d96...`, pinned 2026-10-07T08:03:43Z, not on master). If that re-pin merges before the go, the two ids and the digest move once more (one `print_testnet_object` run, this lane's) | whoever merges the re-pin tells this lane | OPEN |
 | 9f | A pre-existing red, not the object's: `processes::pruning_proof::igneum_m20_tests::witnesses_are_checked_in_epoch_order_under_their_own_seeds` fails under `--features igneum-pow` on the untouched `release-0.3.18-node` e69e8a39 (08:52 UK, box load under 10) and on the decimals base eec34ac3 (that lane's record); no lane's suite compiles the feature-gated test. Owner: the m20 tests' lane | the consensus engineer | OPEN, recorded |
 | 9c | Mission item 8: the genesis forward-compatibility fields (the sig_scheme byte, the W5 key-succession item, the cache rung on the ladder), lane `genesis-forward`; the hash and digest above move once more when they land | lane `genesis-forward`, then this lane re-cuts | NOT DONE |