igneum/docs/plans/fee-switch-devnet.md

The devnet fee switch: calibrated v1 behind fees_v1_activation_daa, runbook (5 October 2026)

Owner's decision: "2 execute". The adopted fee table (spec 05 section 5.11: B_p 120,000 pgas, S_p 30,000, intrinsic 300, modexp 10 + 1 per 10 bytes, floors 100 gwei per gas and 10,000 gwei per pgas) goes live on the devnet at a DAA score H, by the height switch the 0.3.6 node fork carries (docs/plans/release-0.3.6.md section 5). Prepared by the consensus and execution engineer on branch fee-switch (worktree igneum-wt-feeswitch). Steps 1 to 3 below are done; step 4 (the publish) waits for Igneum Miner 0.3.9, which must carry the new prover tools on the Mac. Nothing was published, no node was restarted, no override file was changed.

1. What changed, and what did not

Side	Change	Where
Prover (changed)	igneum-prove-core mirrors the node's fees.rs: PgasTable, FeeParams (PROTOTYPE, CALIBRATED_V1), FeeSchedule { base, v1_activation_daa } with at(daa). The shard input carries the schedule (ShardInput.fees) and the block's DAA score (FixtureEnv.daa_score); execute_range reads the set at that score, raises the carried base fees to its floors (as the node's execute_segment does), and meters with its intrinsic, B_p and modexp entry. One pinned guest serves before and after H	proving/igneum-prove/core/src/{config,pgas,executor,shard,fixture}.rs
Prover (changed)	The exporter reads the schedule from the dump (feesV1ActivationDaa, fees) and each segment's daaScore, replays the whole chain with the switch applied per segment (every state root must equal the node's on both sides), and cuts at the set's S_p at the block	proving/igneum-prove/export/src/main.rs, tools/prove-fixtures/{gen.mjs,net.sh}
Prover (changed)	The host prints and records the set, refuses a fixture whose consensus plan was cut at the wrong S_p, and tests fixtures on both sides of the switch: fees-switch-prototype (block 51, DAA 187, one 7.5 M shard) and fees-v1-shards2, fees-v1-shards3 (blocks 351 and 355, DAA 1,105 and 1,117, 30,000-pgas shards), all from ONE private simnet chain with the switch at DAA 800, replayed from genesis across the switch with every state root equal to the node's (docs/bench-log.md, 5 October 2026, "the prover carries both fee tables")	proving/igneum-prove/host/src/main.rs, proving/fixtures/
Prover (unchanged)	The 328-byte public values (ShardOutput). The switch is NOT a field of the statement. Reason: the node recomputes the statement natively (igneum/exec/src/proving.rs::statement_bytes) and a vetoed record pays nothing, so the layout is consensus (payouts land in state). A new layout would need its own digest-bearing switch and would fork any 0.3.8 node after it. What pins the schedule instead: a shard metered under another table has another pgas_used, another post-root (the floors change what is burned) and so another statement, and the node vetoes it (spec 7.2 item 5). A light verifier that needs the schedule in the statement is a follow-up (design 2.1 removes the duplicate executor)
Node (unchanged)	Fork 2b6d23ef already reads the switch everywhere (fee_params_at(daa), the digest rule, the daemon's print). Confirmed on this Mac: cargo test --release -p igneum-exec 11 passed, 0 failed, among them the_fee_switch_meters_by_the_block_daa_score (15:32:27Z to 15:36:30Z, 4 min 03 s wall, target vendor/igneum-node/target-036)
Guest	Re-pinned: new program ids (section 3)	proving/igneum-prove/elf/

2. The new pin (shard program id)

proving/igneum-prove/pin-guests.sh on this Mac, pinned 2026-10-05T16:20:38Z (SP1 crate 6.8.1, circuit v6.1.0):

Guest	Program id	ELF
shard (igneum-prove-program)	0x2b1a81cb413236cf063077b46ed3111628f6c41036bcf6e23ee4cbbf5679ef7a	2,832,504 bytes, sha256 0x150f4c05a2951fc5...
aggregator (igneum-prove-aggregator, embeds the shard key)	0x474678f35f7545db28055d5e5bbc308231d84a5a072202087a2a8d5b09123896	319,744 bytes

The 0.3.8 ids, running on the Mac and PC 2 today: shard 0x0dfade071ffc05a50be5f7e6640fb12638bac0ea63697ec252863f55658be16a, aggregator 0x135e67e742fbbcc8303676765266f25a6520ab36299820280125541051fb6c62. A verifier on one id rejects proofs made under the other (program id 0x... IS NOT OURS), so every prover and verifier moves together (section 5, steps 2 to 5). tools/ci/pinned-guests-check.sh passes on the new elf/.

3. H and the digest

Measured block rate: DAA 111,230 at 15:23Z and 112,227 at 15:40:13Z (igneum_getProvingStatus.tipDaa of the Mac app node), 997 blocks in 1,033 s = 0.965 blocks/s, about 3,470 an hour, 83,300 a day.

H = 210,000. From 15:40Z that is 97,773 blocks, 28.1 h at the measured rate, so the devnet reaches H around 19:50Z on 6 October 2026. The 24-hour rule at the moment of the publish: H - tipDaa >= 86,400, which holds for a publish before about 19:50Z on 5 October. If the publish is later than that, H moves to the next round thousand above tipDaa + 86,400 and the digest is re-read (one 20-second scratch node, the command below; nothing else changes).

The digest with the override {"difficulty_v2_activation_daa":33000,"proving_v0_activation_daa":84100,"fees_v1_activation_daa":210000}, read on the 2b6d23ef node (vendor/igneum-node/target-036/release/igneumd --devnet --override-params-file=<file> --appdir=<scratch> --rpclisten=127.0.0.1:60985 --listen=127.0.0.1:60986 --nodnsseed --nologfiles --yes, 20 s, 15:41:27Z to 15:41:50Z, then killed):

Calibrated v1 fees from the override file: chain blocks metered with the adopted table, budgets and floors from DAA score 210000
Proving v0 from the override file: provers paid from DAA score 84100
Difficulty rule v2 from the override file: active from DAA score 33000
Fees on igneum-devnet: pgas table v0, B_p 30000000 pgas, S_p 7500000 pgas, floors 1000000000 wei per gas and 1000000000 wei per pgas; calibrated v1 from DAA score 210000
Consensus params digest: ab8847da538dead1dc10e046dfaadab3c1c35928e3748810c4e050d4a886087a (exchanged in the p2p handshake; a peer with another digest is refused)
igneumd/2.1.0-2b6d23ef

The live digest today (no fee switch) is f10a4eab4b1f4f341d54b0b0221161d1122fac302bca90d6b61d14939b69fbd6 (release-0.3.6.md 8g). A node with the switch and a node without it never handshake, which is why section 5 moves every node in one sweep.

4. What every machine runs today, and what it must run before H

Node	Binary today	Reads the switch	Before the override is published
App nodes (Mac d937c69d, PC 1 ae432dc7, PC 2 1ccfe586, PC 37ba0461, Sam's Mac 3a9bf309)	0.3.8 app, node 2b6d23ef (PC 37ba0461 and Sam's Mac were on 0.3.7 and 0.3.5 at the 0.3.8 cut, release-0.3.8.md 9)	yes on 2b6d23ef	every app on 0.3.9 (section 5 step 3); a 0.3.5 node refuses an override file with fees_v1_activation_daa (OverrideParams is deny_unknown_fields) and dies at start
Node 1 and the observer (hand nodes on this Mac)	vendor/igneum-node/target-release/release/igneumd = fork 20139145 (their logs: igneumd/2.1.0-20139145, no Fees on line)	NO	move to vendor/igneum-node/target-036/release/igneumd (2b6d23ef, sha256 64138a17..., release-0.3.6.md 8e) with the restart script of section 5
The seed (188.245.5.161, unit igneumd-v4)	/opt/igneum/v4/bin/igneumd sha c98a23da (the 0.3.5 build, journal: igneumd/2.1.0-20139145)	NO	move to the Linux cross-build of 2b6d23ef, igneum-wt-ship036/infra/cross/out/igneumd (sha256 c24fd2c5e8c4f976e2b3abc55873bca29ae6b97b47046c946f779d3a04947025, 48,733,480 bytes, release-0.3.6.md 8e) with the restart script of section 5
Provers (the Mac app's host, PC 2's /opt/igneum host)	shard program id 0x0dfade07... (0.3.8 pin)		the new pin (section 2) on both, by the 0.3.8 order: provers off, pool empty, install, --mode id equal, provers on

The two restart scripts now live in the repository, infra/devnet/restart-hand-nodes.sh and infra/devnet/restart-seed.sh, and take the override object as their one argument (the scratchpad forms of 5 October took only the proving height and hard-coded the rest; both pointed at the 20139145 binaries). Each refuses a binary that is not 2b6d23ef and ends by printing the new pids with their start times and the fee and digest lines.

5. The rollout, in order

Everything before step 6 can run as soon as 0.3.9 is published; step 6 is the point of no return; H is at least 24 h after step 6.

Step	What	Check
1	Ship 0.3.9 with the new prover tools in the DMG (igneum-prove-host built from this branch's elf/) and igneum-prove-wsl2.zip from this branch (SKIP_GATE=1 proving/windows-wsl2/make-package.sh), node 2b6d23ef unchanged. The manifest's consensus.override is CARRIED OVER unchanged at this step (no fees_v1_activation_daa yet): --activation-height 84100 --deadline-note "proving v0" as 0.3.8 did	the live manifest's consensus object identical to 0.3.8's; --mode id on the DMG's host prints the section 2 shard id
2	Provers off: Mac (the app's prove setting) and PC 2 (job prove-off-pc2-039: POST <app.url>/api/prove {"on":false})	igneum_getProvingStatus on the Mac app node: pool pending 0, no new records for 10 min (the 0.3.8 watch treated a connection error as "not empty" and said nothing: this watch prints every error line)
3	Every app to 0.3.9: update-now job to all; wait for every app to log update to 0.3.9 complete and its node to report a DAA score (node tools/console.mjs machines)	Machines card: all on 0.3.9, node 2b6d23ef; PC 37ba0461 and Sam's Mac may lag, see section 7
4	PC 2's WSL tools: fetch-prove-039 then rebuild-prover-pc2-039 as 0.3.8 7a did (rsync of the package, every source re-stamped, cargo build --release -p igneum-prove-export -p igneum-prove-host --features igneum-prove-host/cuda, install into /opt/igneum)	/opt/igneum/igneum-prove-host --mode id prints the section 2 shard id, equal to the Mac's installed /Applications/Igneum Miner.app/Contents/Resources/bin/igneum-prove-host --mode id
5	Provers on: Mac setting on, PC 2 job prove-on-pc2-039	the Mac node logs VERIFIED in for a PC 2 record under the new id; the live page shows a paid shard
6	Publish the switch, every node at once, in this order (release-0.3.6.md section 7, "Operational lessons"): (a) packaging/ota/publish-manifest.sh --version 0.3.9 --override '{"difficulty_v2_activation_daa":33000,"proving_v0_activation_daa":84100,"fees_v1_activation_daa":210000}' --activation-height 210000 --deadline-note "fees v1" --notes "<the 0.3.9 note>" --deploy (the Mac and Windows entries are carried over from the folder's 0.3.9 manifest; the override object is the whole set of switches, not only the new one); (b) update-now job to every app: the apps re-read the manifest and restart their node at a safe moment with the new override; wait until every app node logs Calibrated v1 fees from the override file: ... from DAA score 210000; (c) infra/devnet/restart-hand-nodes.sh '<the same object>'; (d) infra/devnet/restart-seed.sh '<the same object>'	every node prints digest ab8847da538dead1dc10e046dfaadab3c1c35928e3748810c4e050d4a886087a; the peer lists stay full (a node with the old digest is refused by the new ones and shows as a dropped peer)
7	Before H: the digest sweep. On every app node's log and the two hand nodes' .out files and the seed's journal: one digest. The console's Machines card: every node's DAA score within a few blocks of the others (an isolated node falls behind at once, as the early-restarted hand node did on 5 October)	one digest, one height
8	At H (about 19:50Z, 6 October): the first chain block at or above 210,000 meters with v1 and its base fees jump to the floors	igneum_getBudgets returns provingGasLimit 120000 and the two base fees 100 gwei and 10,000 gwei; eth_getBlockByNumber of the switch block shows provingBaseFeePerGas 0x9184e72a000; the first shard proven after H verifies and pays (its plan is 30,000-pgas shards)

Why the order: a 0.3.5 node refuses the override file (dies), a node restarted early with the switch is refused by every peer (isolated), and a prover on the old pin is rejected by a verifier on the new one (and the reverse). So: tools first with provers off, then every node in one sweep, then H a day later.

6. Commands for the release engineer

# 0.3.9 ship (release engineer): this branch merged, then as 0.3.8 did, override carried over unchanged
node tools/ship-app.mjs 0.3.9 --node vendor/igneum-node-036 --branch release-0.3.9 --dl-both \
  --activation-height 84100 --deadline-note "proving v0" --notes "The prover mirrors the fee switch (new pinned guest); node 2b6d23ef unchanged" --from ci

# step 6a, the switch (ONLY after steps 2 to 5 are checked)
packaging/ota/publish-manifest.sh --version 0.3.9 \
  --override '{"difficulty_v2_activation_daa":33000,"proving_v0_activation_daa":84100,"fees_v1_activation_daa":210000}' \
  --activation-height 210000 --deadline-note "fees v1" --notes "Calibrated v1 fees from DAA score 210000" --deploy
# step 6b: the update-now job to every app, then wait for the "Calibrated v1 fees" line on every app node
# step 6c and 6d
infra/devnet/restart-hand-nodes.sh '{"difficulty_v2_activation_daa":33000,"proving_v0_activation_daa":84100,"fees_v1_activation_daa":210000}'
infra/devnet/restart-seed.sh      '{"difficulty_v2_activation_daa":33000,"proving_v0_activation_daa":84100,"fees_v1_activation_daa":210000}'

# re-reading the digest for another H (20 s)
printf '{"difficulty_v2_activation_daa":33000,"proving_v0_activation_daa":84100,"fees_v1_activation_daa":H}\n' > /tmp/ov-H.json
vendor/igneum-node/target-036/release/igneumd --devnet --override-params-file=/tmp/ov-H.json --appdir=/tmp/digest-H \
  --rpclisten=127.0.0.1:60985 --listen=127.0.0.1:60986 --nodnsseed --nologfiles --yes   # 20 s, then Ctrl-C; read "Consensus params digest"

7. Open

Item	State
PC 37ba0461 and Sam's Mac	silent at the 0.3.8 cut; they take 0.3.9 on their next check. A node that has not restarted with the switch by H is refused by every peer from its next restart; it is not a fork, it is an isolated node until its override file is updated (the app writes the manifest's object on its next update cycle)
The statement does not name the schedule	section 1; the native veto pins it. Follow-up: a statement v2 with the switch and the DAA score, behind its own digest-bearing switch, when a light verifier needs it
The export RPC carries no daaScore and no switch	igneum_exportSegments writes neither; gen.mjs adds them from eth_getBlockByNumber and the environment. Follow-up on the fork: write daaScore per segment and feesV1ActivationDaa at the top level, so a dump is self-describing
The prototype-side fixtures at S_p 7.5 M	unchanged and still valid: a fixture without fees is the devnet schedule (prototype, never)