What's changed

Daemon memory controls: -mem-limit (soft heap ceiling) + -debug-addr (pprof) — The MATURING field cohort OOM-crash-loops on 2 GB nodes, and it is NOT the PoR proof map (#464 shipped without moving it; the crash-looping nodes hold ~no chunks). Local + in-process probes show no leak — the signature is a large-but-bounded working set colliding with Go's default 2×-heap GC target on a small box. -mem-limit <size> (e.g. 1500M) sets runtime/debug.SetMemoryLimit so the GC reclaims before the kernel OOM-kills (equivalent to GOMEMLIMIT; the flag wins) — a memory-bounded head, not a hard cap. -debug-addr <addr> serves Go pprof (heap/goroutine) + dumps a heap profile to <store>/heap-<pid>.pprof on SIGUSR1, so the true consensus-node footprint can finally be ATTRIBUTED (the daemon had no heap profiling, which is why the wrong structure was first blamed). Both off by default. integration/cloudtest gains DEBUG_PROFILE=1/MEM_LIMIT= knobs and a ./cloudtest.sh heap <node> capture. Deliberation: docs/thinking/2026-08-17-oom-not-the-proof-map-attribution.md.

#184 adversarial drills made DRIVABLE on the wire under the objective BFT model — equivocation (slash-on-detection) and partition-heal (stall-then-catch-up) — Both marquee attacks GAPped on every field sheet because the drills imported legacy-mode (-objective=false, quorum 1) assumptions that objective 3-of-4 correctly forbids. Fixed per three PE rulings, mechanism proven at the code level first (core/node/modelcheck_184_equivocation_objective_test.go, failing-first). Equivocation: a fork can never be COMMITTED onto a target under a BFT quorum (2-attestation single-target commit is quorum-short; a minority fork is an I1 violation), so the crime is signing two conflicting blocks at one height, not committing two forks. New PlaceConflictingSigned adversary primitive: a consensus-set validator participates honestly (its era-2 (round, prepare) signature lands on-chain), then SERVES a conflicting signed block at that slot (crafted GetChain/head-probe response); an honest peer fetches it on sync and FindEquivocations slashes the same-slot cross-fork prepare pair unaided, pre-Reconcile, never adopting the quorum-short loser. It runs on its OWN dedicated ephemeral net (e2e/equivocation_test.go, objective 4-anchor, over real TCP; netem via integration/adversarial) — the one destructive drill (a proven double-sign is a permanent F2 eviction) is isolated from the shared sheet, whose mid-sheet eviction would pin the commit requirement at 3-of-4 against 3 live anchors (zero fault tolerance). Partition-heal: a severed sub-quorum minority cannot commit, so on heal it CATCHES UP (a forward sync, dropped=0), it does not reorg — a droppable reorg would require a minority to commit a conflicting fork (the I1 violation model B forbids; the absence of a reorg line IS the safety property). The drill (integration/cloudtest + e2e/partition_test.go) severs the minority from the whole > ⅔ majority, drives the majority to commit a heavier chain, asserts the minority STALLED (anti-vacuity), then reconverges to the majority head (height + hash) on heal. Deliberation + the three rulings: docs/thinking/2026-08-17-drill-drivability.md.

Publish client: the accept→commit poll re-derived for the #451 round durations (180s→360s) and made self-healing — the poll loop now RE-SUBMITS the entry every 30s — Run 82bcd2b-39478's durability-turnover GAP ("accepted but not committed within 3m0s") was honestly unpinned between discovery (#351) and a #441 mature-quorum residual. The pin, per the PE work order, came from two new deterministic model-check oracles over the 12-member mature fixture (core/node/modelcheck_441_publish_bound_test.go): (A) under steady renewal contention with delivery intact, an accepted entry rides the VERY NEXT committed block — three consecutive publishes — refuting the fold-starvation residual at the model tier; (B) with the fire-and-forget submit burst dropped, the entry strands in the accepting validator's mempool for a MEASURED designee-rotation wait (8 chain heights in the oracle schedule ≈ tens of minutes at the field's 220s/height escape bound) — unreachable by any single-shot poll. So the failure class is CLIENT-side liveness, not a consensus defect: publishPollTimeout was still the genesis-era 180s, BELOW the in-spec per-height worst case the #451 synchronizer durations imply (H_ESCAPE 220s; the harness's own re-derived PUBLISH_RETRY_S is 360s — same derivation, now one number), and the certified #441 design's drop-recovery lever ("the client's retry loop re-sends") never fired inside the window because the client submitted once and only polled. The re-submit is a mempool-dedup no-op on the happy path and the recovery lever on the lossy one (failing-first regression: a stranded entry that only a re-submission lands). Harness: a failed ft_publish now captures the VALIDATOR journals with the GAP verdict (82bcd2b's capture had only client-side nodes — the accept→commit window was unattributable, #7's capture-first rule), and the verdict text decomposes by the captured error instead of the #351-or-#441 disjunction. M1 note: the 360s bound shrinks by shrinking round durations (batching, #299), never by the client under-reporting them.

#456 concurrent gather: prepares and precommits are broadcast-and-collected — a dead epoch member no longer taxes every proposal its full retry timeout — The two-phase gather asked attesters strictly sequentially, so each unreachable member's full transport retry budget (~34s at field config) sat on the critical path before the next attester was even asked: with a third of the epoch silent, every proposal paid ~270s (the B2 drill's twice-field-reproduced stall — runs ce15a80/1eded27 — after the #453 synchronizer was confirmed working via the catch-up telemetry). Per the research certification (456-gather-serialization): BFT tolerates f faults BY CONSTRUCTION — a correct protocol never waits for the faulty — and broadcast-and-collect-until-quorum is the universal shape; the sequential chain inverted it into f×timeout on every proposal. Both phases now send to every attester at once and complete on the SAME quorum predicate ValidateCommit demands (SupportMeetsQuorum: count + anchor majority + frozen weight); assembled certificates are copied at capture so a late reply can never mutate them. No certified property is order-sensitive (one gatherer per proposal; the QC is carried in the block, never re-derived) — #432/#402/#397/#389 untouched, the full oracle set green. Per-peer patient retry (network-durability §2) is kept; only its SERIALIZATION across peers — the flat-aggregate anti-pattern one level up — is removed: patient AND concurrent. Failing-first via the model-check's first COARSELY-TIMED oracle (the sim clock as the cost model, the certification's method fix): dead-first ask order, RED sequential (4.02s simulated = 4 dead × timeout × 2 phases), GREEN concurrent (0 simulated).

syncTargets returns a deterministic (ID-sorted) list — a B2-determinism leak caught by the #451 fixture flaking under -count=10 — The list that drives gather ask-order, round-change broadcast order, and (in the model-check) the entire schedule was returned in raw map-iteration order: every gather's QC composition was a per-call dice-roll, flaking the #451 freeze-frame fixture 2-in-10 (the sybil author's prepare-QC landed on order-lucky subsets) and adding silent run-to-run variance to every field gather. ID-sort is safe here — ask order is not an inclusion-fairness surface (any assembled quorum is valid), unlike the reg/entry queues which stay FIFO per #448/#441; EligibleProposers already sorts for the same reason. The #451 oracles now pass 10× under the race detector.

#451 view synchronizer: increasing round duration + responsive catch-up — round-based liveness gets its missing second half — The clean re-run's B2 stall drill re-proposed a carried lock across rounds 4–15 for 370 s with 8 of 12 members live holding >99% of the weight: silt had #432's locking (safety under round disagreement) but no SYNCHRONIZER (convergence into a shared round) — a fixed roundAdvanceSweeps let independently-skewed sweep timers smear the members across rounds forever, and a round-change recorded at a receiver never pulled it forward. Per the research certification (451-view-synchronization, adopting Tendermint/PBFT whole): (a) round duration now grows dur(r)=dur(r−1)+r·k in deterministic sweep counts — after GST the round eventually outlasts any timer skew or adversarial round-change smearing (red-team seam #7, closed as a bounded residual), the load-bearing guarantee; (b) a straggler JUMPS to the smallest round proven ahead by f+1 anchors (launch) / >⅓ frozen weight (mature) of recorded round-changes, or by a valid higher-round new-view certificate — catch-up at message speed. Neither ingredient changes which value a node may sign: locking, the proposer-prepare rule, and the #402 arithmetic are untouched (the I1/S1/S2 oracle set stays green). Failing-first per the certification's merge gate: the staggered-sweep oracle (pre-GST chaos — skewed sweeps, per-target prepare delivery, driver-fired request timeouts scattering the sign marks; post-GST — the certified convergence bound) is RED against locking-without-a-synchronizer and GREEN with both ingredients. Method fix recorded in the model-check canon: per-node round-advance skew is a first-class adversarial schedule dimension.

Bond-reg queue goes FIFO-by-arrival — the ID-sort starvation behind the confirm run's 22-minute maturity stall — Run 54003f7-91159's latch missed its computed bound because the 3rd maturer's first-time registration sat in the designees' queues for 22 minutes: the reg fold sorted pending regs by validator ID, and with the byte budget admitting ~one plot-sized reg per block, ID order is a strict priority — the highest-ID submitter loses to ANY lower-ID renewal, every block, for as long as renewal traffic flows (the census: 49 ahead-skew refusals were the visible symptom; the queue acceptance was fine, the fold order was the starvation). This is the exact class the #441 certification closed for entries with FIFO (Addition 2: no fees ⇒ no priority order that can defer indefinitely), still live on the reg side — #429 had named it ("ID-sorted packing makes order seed-luck"). The queue is now FIFO by arrival with replace-in-place renewal updates (a resubmission refreshes bytes but keeps its position: renewing cannot queue-jump, waiting cannot lose seniority), and an over-budget reg keeps its seniority for the next block instead of being dropped. Proposer-side inclusion policy only — no validity or quorum rule changes (block-byte determinism needs only the single designee's own order). Failing-first: TestBondRegFIFONoIDSortStarvation (RED under the ID-sort — the high-ID first-timer never banks across four one-reg blocks — GREEN under FIFO).

#441 publish starvation FIXED: entries are mempool content the designee's block carries — the certified operation-liveness mechanism — The first mature-regime field run committed ZERO publish entries post-latch across 33+ heights while the chain stayed live on drain blocks, and the first launch soak stalled a publish-contended height 361s past the computed escape bound: one root, the #432 round machinery's new-view seat AND its escape arming belonged exclusively to the bond-reg drain path, so an entry proposal could win no round of any height. Per the research certification (441-publish-starvation, 2026-08-16, direction A): a publish now SUBMITS its entry (MsgSubmitEntry, the MsgSubmitBondReg mirror — validate-on-arrival with synchronous refusal reasons, FIFO mempool dedup'd by root) and polls for finality; the single (h, r) designee's block folds pending entries under a byte budget SEPARATE from the reg budget (-max-entry-bytes-per-block — neither stream can starve the other), and pending entries arm the round escape alongside regs. Entries are content, never a competing value: locks/POL, the proposer-prepare rule, and the #402 arithmetic are untouched, and a forced (lock-carrying) re-proposal never folds. The born-RED starvation oracle plus five certification siblings (launch-face entry-only arming, adversarial-designee drop within the O(f+1) fairness bound — an owned residual, no permanent minority censorship — FIFO no-internal-starvation, entry-flood-vs-renewal budget isolation, and S1-with-entries lock-never-displaced) are all RED under the recorded fold+arming revert and GREEN with the fix. Bonus, pinned by the certification §7 discriminator: drain-alone commits at r0, so the field's every-height r1 escape (~95–155s/height) was entry contention — the fix recovers the r0 happy path. Legacy (-objective=false) deployments keep the direct propose path (no rounds machinery exists there to drive a mempool, and no drain contention either). I4's full statement is now operation-liveness — no legitimately submitted operation is permanently starved — recorded in the invariant map.

BlockVersion (the mint era) flips to 2 — the era-2 follow-through promised by the #432 change — The rounds era shipped with the propose path explicitly stamping BlockVersionRounds, deferring the const flip as behavior-neutral test churn. Landed: production minting is byte-identical (the propose path already stamped v2; no non-test site builds genesis from the const), the att/bond-reg wire wrappers now carry version 2 (accepted by every era-2-capable binary — a pre-#432 binary cannot participate in an era-2 network regardless), and the 63 test files that hand-build era-1 blocks now declare Version: 1 explicitly — the honest form, since they exercise the still-supported era-1 validation rules rather than tracking the mint const. Full suite + race green.

Node-level mature-epoch model-check fixture + the dynamic mature S1/S2 oracles — Closes the #432 certification's named residual (1): the S1/S2 merge-gate oracles ran the round machinery over the real node loop only in the launch regime. matureWorld (core/node) now drives a real 8-node network — 4 launch anchors + 4 bonded 64 MiB distinct-domain maturers, the field re-split shape — to a governed mature epoch entirely over held delivery (drain banks the maturers, they qualify by attesting, the everMature latch trips, the epoch boundary freezes the maturer snapshot), verifies the premise first (latch on every replica, anchors shed from eligibility, an anchors-only proposal REFUSED in the governed epoch, a 3-of-4 weight-quorum commit tracked everywhere), and then runs the certification schedules dynamically: S1 (a delayed >⅔-weight round-0 quorum must be carried forward by the lock rule) and S2 (a Byzantine maturer's weight-short forged lock must die at round-change verification) — both anti-vacuity-pinned (CommitRound == 1) and both RED under the recorded lock-free revert. This world is also the deterministic home for the open mature-regime r0-contention observation from run 09fbe60-84613.

Drain-curve observability: commit lines carry the bond-reg count, and a refused renewal submit is attributable to WAN head-skew instead of reading as forgery — The committed-block lines (daemon banner and the node's structured block committed) printed entries and attestations but NOT how many bond registrations the block banked, so a field journal could not answer the drain curve's decisive question — which blocks carried which regs (the interrupted confirm run 09fbe60-84613 was misread as "blocks committing empty" while regs were in fact landing). All three commit lines now print the reg count. And the census of that run's 54 bond-reg submit REFUSED lines — every one a bare "signature" error across ≥7 honest validators — is the AHEAD-skew face of the #427 K-head window: a renewal is signed over the submitter's head, a receiver accepts only nonces of its own last-K COMMITTED heads, so a reg arriving ahead of the receiver's commit fails every window nonce and heals on the next resubmit sweep. The refusal line now logs the receiver's next height, the submit side logs the height it signed over (bond renewal submitted), and TestBondRegAheadOfReceiverWindow_refusedThenHeals pins the mechanism — refused while the receiver trails, the same bytes validate once it commits the head — so the field signature-refusal census reads as commit-propagation skew, not attack.

#432 rounds + locking: the two-phase (prepare→precommit) gather with a lock-carrying view-change — the I4 liveness escape, research-certified, era-gated as block version 2 — The #397 height-only never-sign-twice watermark made a crossed 2-2 proposer race a PERMANENT stall of a connected, all-honest launch network (the field wedge in runs 9c3777d/8ae8326; TestModelCheck_I4_WedgedHeightMustRecover, born RED). Per the research certification (432-rounds-locking-liveness, 2026-08-15): consensus signatures are now (height, ROUND, phase)-scoped; a commit carries TWO quorum certificates at one round (the prepare-QC that justified precommitting, and the precommit certificate), each held to the full commit threshold in both regimes (launch strict anchor majority / mature >⅔ frozen weight — the POL threshold IS the commit threshold); validators LOCK on the highest-round prepare-QC (durable, mark-before-sign, restart-rehydrated); round advance is a deterministic sweep count (never wall-clock), and the view-change quorum carries the highest lock forward, forcing the next proposer to re-propose any potentially-committed value. Equivocation is round-scoped (same-(h, r, phase) double-sign slashes; a POL-justified cross-round re-sign is honest), and a committed era-2 block REQUIRES its author's round-scoped prepare — the structural ProposerSig's era-2 analogue, which is what keeps a double-proposal attributable (I5) while staying count-neutral in every quorum (#402 arithmetic untouched, tested byte-identical). Merge-gate oracles per the certification: S1 (delayed lower-round quorum) and S2 (equivocate-then-misreport, forged-lock injection) both RED against a recorded lock-free revert and GREEN with the prepare phase, plus per-(h, r, phase) restart I2 and §5.3 lock re-presentation. Era 1 blocks keep validating under era-1 rules — committed history is never re-interpreted.

Never refuse silently: the two consensus refusal sites that hid the #432 wedge now log their reason — A peer-submitted bond registration that fails validation was dropped on arrival with no line (MsgSubmitBondReg receipt), and a drain proposal blocked at the proposer's own #397 sign watermark returned silently — so the #432 wedged-height liveness defect (chain stalled, cohort regs arriving-verifying-vanishing) was mis-attributed across three field runs (discovery/#351, CPU, staleness). The receipt path now logs bond-reg submit REFUSED with the exact ValidateBondRegErr reason (decode failures too), and the drain logs bond-reg drain BLOCKED at own sign watermark — at most once per 30s sweep, only while pending work is actually blocked, which is precisely the #432 wedge signature. One field observation now names this class (B5; build-immutable #7's instrument-first). The wedge itself is #432 (rounds+locking, research certification in progress) — this ships the observability ahead of the rule change because it is not one.

MATURING topology re-split: 4 honest maturers + 4 Sybils, with COMPUTED harness windows (per the PE concurrence on the latch-premise finding) — The MATURING=1 SYBILS=8 field topology re-splits its 8 cohort slots into 4 honest maturers (non-anchor validators, full 64M bond, UNSET -domain — each an independent address-diversity group) + 4 single-domain MinBond Sybils, making the drill the on-the-wire confirmation of the I3 oracle's certified shape: the bar-2 latch is now REACHABLE (min(NakamotoOperators, NakamotoDomains) = 2 at full drain) while the cheap cohort alone still cannot mature the network — both pinned deterministically by TestMaturingResplitTopologyLatchReachable. MATURING=0 topologies (the P1 launch gate) are byte-identical. The harness windows are now computed bounds, not arbitrary wall-clocks (PE cadence ruling §4): the latch window derives from worst-case drain order (ID-sorted packing ⇒ 9 reg-blocks × 64s worst-case block time + a submission leg ≈ 630s), the publish window from the per-leg retry budget (8s × 4 attempts + backoff ≈ 34s/leg × the fresh-publisher leg census ≈ 240s) — and a latch miss inside the computed bound with the maturer cohort live now records FAIL (a finding), never a re-graded GAP (maturers down ⇒ honest GAP, preemption-shaped). The flow also records the drain curve (val-a's per-commit C2 lines: 64MiB jumps = maturer bonds) so the bound is checked against the real drain order, and the B2 capture drill now stops the maturers with the anchors (leaving honest weight up would fake a capture). Also fixes a second latent premise bug the finding exposed: the cohort-seated gate required participants ≥ 4+n_syb (=12) but the C2 participant count is NON-anchor bonds only (max 8 here) — now n_mat + n_syb.

MATURING-drill premise repro: the 10-maturing-handoff latch is unreachable in the field topology as parameterized — TestMaturingFieldTopologyLatchUnreachable (core/chain) constructs the exact MATURING=1 SYBILS=8 parameterization at FULL drain — every bond banked, every participant generously granted attester status — and measures min(NakamotoOperators=3, NakamotoDomains=1) = 1 < 2, so Mature is false no matter how many regs commit: C2Metric excludes anchors by design (counting the scaffolding's own bonds to shed the scaffolding would be circular, immutable #3) and the topology's 4 validators are all anchors, while the only non-anchor cohort — the 8 single--domain Sybils — aggregates to ONE address-diversity group, which is the certified C2 discount doing its job. The two field GAPs ("latch never tripped in 420s") therefore had two stacked causes: the bond-reg drain staleness race (fixed) and this premise defect — the drill asked the maturity metric to be tripped by exactly the cohort it exists to refuse. Core behavior is correct and now pinned; the fix is a harness topology re-split (honest non-anchor distinct-domain maturers, the I3 oracle's certified shape), routed through a PE concurrence note before the re-run. Found on a laptop while deriving the principled maturity bound — before the billable run, not after.

-loop-budget — emit the event-loop goroutine-budget decomposition at INFO for a diagnostic run — The per-window per-handler breakdown (from the eventloop instrumentation) is debug-gated by default so it's silent at steady state; -loop-budget raises just that summary to INFO so a load/diagnostic run captures the full per-handler CPU breakdown without the -log debug firehose — which, logged synchronously on the loop goroutine, would itself skew the very measurement. Slow-task, queue-wait, and hang lines are always-on regardless. The cloudtest harness threads it via LOOP_BUDGET=1.

Event-loop latency instrumentation — name the slow (or hung) handler from real load (Andrew's timing-for-evidence idea) — The single event-loop goroutine (adapters/eventloop) is the one serialization point, so it is the one place to see where the node's thread actually goes. Each task now carries a label (inbound deliveries by msg.Kind; timers/commit/api by a constant) and the loop optionally reports: slow tasks (SlowThreshold/OnSlow — a single task blocking the thread), a hang watchdog (HangThreshold/OnHang — a task still in-flight past a deadline, reported once with an all-goroutine stack dump of exactly where it is stuck), queue-wait (QueueWaitThreshold/ OnQueueWait — the causal signal: a task that executes fast can still blow a downstream deadline by waiting behind a saturated thread, so this ties saturation to the 8s request-timeout that execution-time alone would miss), and a per-window budget summary (SummaryEvery/OnSummary — count/total/max execution AND queue-wait per label = the goroutine-budget decomposition, cause and effect in one window, so the dominant handler is named from real execution, not a reconstruction; the summary is debug-gated, slow/hang/queue-wait are always-on). Adapter-only, zero-value = off (the sim's own scheduler is untouched); wired in the daemon via the existing logger. This is the observability the starved MATURING field run lacked (its per-issuer gather legs were debug-gated).

#406 — consensus model-check, tier 2: the I5/#397 honest-never-slashed oracle — Over the real node loop + held-delivery: two proposers cross-attest-race one height in a WEAK config where both forks can commit (objective, no anchors, ByzantineQuorum off, Quorum 1, N=4 → no finality gate, no anchor gate — the pre-#402 baseline), and no honest validator is slashed: the #397 propose-time never-sign-twice watermark makes each proposer refuse the rival, so no honest node double-signs. Proven failing-first by controlled revert (removing the propose-time recordSign lets each proposer cross-attest → both forks commit → sync slashes both honest proposers via OnSlash — RED; with the watermark — GREEN). Resolves the deferral from the substrate PR: #402's I1 shields the both-commit fork in the normal objective tree, so the weak config is what makes it reachable. core/node/modelcheck_tier2_test.go. Test-only. With this + the #357 launch replay, the launch tier now has all four scars (#357/B2/#397/#402) failing-first — the P1-run gate criterion.

#406 — consensus model-check, tier 1: the #357 launch replay (no reorg of a finalized block + fork-choice determinism) — core/chain/modelcheck_i5_357_test.go asserts the invariant that closes #357: over adversarial competing forks (bare-genesis, shorter, equal-height, and even taller conflicting), a super-quorum-finalized launch block is never reorged (D-1), and fork-choice is order-independent (reconciling the same fork set in any order yields the same head — a pure function, never the height-blind hash tiebreak that dropped committed blocks to height 0). Proven failing-first by a controlled revert: forcing finalityQuorumActive false (the pre-#357 no-gate state) lets a taller fork reorg the finalized chain — RED; with the shipped gate — GREEN. Also asserts the #357 weight face (a committed anchor-attested chain carries nonzero fork-choice weight). Test-only.

#406 — consensus model-check, tier 2: the I2-across-restart oracle — On the held-delivery substrate: a validator signs a block at height h through a REAL gather, then "crashes and restarts" (a fresh Node+chain on the same endpoint), and must refuse a competitor at h — the never-sign-twice watermark must survive restart (#397 Q1b; Tendermint priv_validator_state). Failing-first by construction: the identical scenario run with a NON-persisted mark (the pre-#397 crash-wipe) attests the competitor, so the in-test control proves the persistence is load-bearing and the assertion is not vacuous. core/node/modelcheck_tier2_test.go. Test-only.

#406 — consensus model-check, tier 2: the simnet held-delivery substrate (adversarial delivery over the REAL node loop) — adapters/simnet gains a test-only held-delivery mode (EnableHeldDelivery + Pending/Deliver/DropPending): Send parks each message so a driver fires them in an order IT chooses — the "adversarial delivery scheduler" the design specifies — off by default so every existing sim/e2e path is untouched, conformance-tested (adapters/simnet/helddelivery_test.go). core/node/modelcheck_tier2_test.go proves the substrate drives the real loop: a real proposer gathers a real quorum and commits + broadcasts to every replica entirely over driver-controlled delivery (no clock advance; request timeouts sit on the clock, which the driver never advances, so a gather completes purely by delivered replies). The adversarial invariant oracles that build on it (I2-across-restart; the genuine I5/#397 catch) are the documented next increment — the first I5 draft was withheld because it could not be shown failing-first: #402's I1 structurally prevents the both-commit fork the #397 slash needs, so the #397 fix is shielded by a different fix in the current codebase, and a genuine I5 catch needs a pre-#402 baseline (docs/thinking/2026-08-15-406-tier2-substrate-and-the-i5-honesty-catch.md). The only production code is the adapters/simnet held-delivery mode, which is inert unless EnableHeldDelivery is called (no existing path calls it), so all shipping behavior is unchanged.

#406 — consensus model-check, tier 1: the I3 mature weight-quorum oracle (the B2 catch) — core/chain/modelcheck_i3_test.go drives the REAL Chain to a mature epoch whose frozen epochSet holds the B2 imbalance — 3 real validators (distinct domains, 20 MiB) + 8 sybils (one shared domain, 2 MiB) — and asserts I3: a coalition finalizes IFF it carries a >⅔ WEIGHT super-majority, never a head-count one. The 8-sybil cohort is a head-count quorum (7 non-proposer attesters = bftThreshold(11)) but a weight minority (16 ≪ ⅔·76), so it is refused. Exhaustive over the finality-relevant space by equivalence class (finality is a pure function of proposer-type + #honest/#sybil attesters, so ~72 representatives cover all 2^10·11 cases). The setup is verified first (TestModelCheck_I3_SetupReachesMatureWeightedEpoch asserts the mature-epoch state + exact frozen weights before any oracle trusts it — the anti-#303 discipline; it caught a real proposer-never-seen setup bug during the build). Proven failing-first by a controlled revert of requireEpochWeightQuorum to head-counting → RED. Test-only; no production change.

#406 — consensus model-check, tier 1: the exhaustive I1 launch oracle — The first rung of the deterministic adversarial consensus harness (docs/design/consensus-model-check.md): core/chain/modelcheck_test.go drives the REAL Chain finality predicate over an exhaustive enumeration of adversarial anchor coalitions (N∈{3,4,5} launch regime, +8 sybils) and asserts I1 — no two disjoint anchor coalitions may both finalize a block at one height (the invariant all four scars #357/B2/#397/#402 violated at their core). Proven failing-first: reverting the launch rule to the pre-#402 AnchorQuorum=1 makes it go RED ("disjoint coalitions [0] and [1] both finalize" — the exact #402 defect) in milliseconds on a laptop, GREEN under the derived ⌊A/2⌋+1. This is the cheapest-tier catch the testing-tiers assessment calls for; it begins the gate that ends "discover a consensus invariant by billable field run" (D-CONSENSUS). WIP — the mature/I3/I5 oracles and the simnet tier-2 (I2-restart) layer are the documented next steps; scope is stated honestly in the file header (S5). Test-only; no production change.

#402 — chain-tier repro attributing the launch anchor-gate fork (the field "CAPTURE" was a fork, not a Sybil capture) — Field run 4faaee8-22913 graded a flow-5 "CAPTURE"; the captured evidence + core/chain/fork_anchor_gate_402_test.go show it was a fork. The wheels-engaged commit gate requires only AnchorQuorum=1 distinct anchor attester, and the honest side commits at the bare count quorum (proposer + 2), leaving one free anchor; a Sybil-proposed competitor attested by that one free anchor passes the gate — while a zero-anchor Sybil quorum is still refused (ErrAnchorRequired), so C2 holds (no quiet capture). The residual is a launch-phase fork-creation / liveness vector. A second test shows AnchorQuorum=2 closes the same fork (the honest commit then holds 2 non-proposer anchors, leaving <2 free), naming the fix direction AnchorQuorum ≥ ⌈#anchors/2⌉ and its cost (launch commits need 3-of-4 anchors up). The fix is a consensus-rule change, routed to research (docs/reviews/fork-anchor-gate-402-RESEARCH-CONSULT-2026-08-14.md); tests-only here, no product change.

cloudtest: a scenario-level FAIL/GAP now captures its evidence before teardown (build-immutable #7) — Run beb3628-95860 (the P1 all-corners run) ended with two FAILs (9-cross-nat, chaos-reprovide) and a new sybil-resume GAP that were unattributable: journals were only captured for nodes that never came ready, the scenario console died with the terminal, ft_publish's per-call gap signal was lost in its command-substitution subshell (so 9-cross-nat graded FAIL where the honest verdict may have been a #351 GAP, with no recorded error), and the next run overwrites results.jsonl/report.md. Now: record snapshots the flow's involved nodes' service state + journal + debug.log into flow-evidence-<run>.log the moment a non-green verdict lands (nodes stashed by require_nodes/require_live or explicit flow_evidence_nodes); ft_publish hands its gap signal and last captured error across the subshell boundary by file, so publish_verdict grades honestly and the report names the mechanism; 9-cross-nat attributes WHICH leg died (publish vs fetch); the scenario console is tee'd to console-<run>.log; and each run's results.jsonl + report.md are archived under archive/ so a regression is distinguishable from a never-passed flow. Harness-only; no product change.

#390 — the cross-NAT restart re-fetch (integration/nat, #69 phase) no longer flakes on a loaded CI runner — The RESTART=1 cross-NAT job REDed bimodally (~1-in-4, on docs-only commits too) at "content undiscoverable after restart". Attributed: reprovide-after-restart is a real, working product path (proofs persist to the proof store, reload on restart — reloaded storage proofs count=N — and AnnounceHeld re-plants provider records after re-bootstrap), but the harness waited for it with a fixed sleep 6 and then re-fetched ONCE. That is the magic-constant anti-pattern (build-immutable #5: wait for the condition, never a constant): under a loaded runner the re-announce + DHT propagation sometimes took longer than 6s, so the single re-fetch found no provider and false-FAILed. Fixed harness-side by confirming the reload then RETRYING the re-fetch on a ~60s bounded deadline — a genuine reprovide gap still fails after it (never masks a real #69 break; it only rides out a slow re-announce), the same "retry, don't guess a timeout" discipline the product uses. No product change. Green 5/5 locally (was ~1-in-4).

#378 — the -equivocate red-team drill is now deterministically drivable under WAN delay (the local adversarial gate's entry criterion for the external red team) — The netem adversarial gate (integration/adversarial, delay 80ms 20ms) REDed BIMODALLY on TestEquivocatorSlashedOverTCP — the drill that proves a double-sign is caught and slashed over real TCP (#184 accountability). The property itself always held (the slash fired); the drill driver wedged, so a required gate flapped ~1-in-4 — corrosive (it trains "re-run until green"). Root-caused to THREE distinct placement wedges under warm-up jitter, each closed and each guarded failing-first: (1) ErrDupRoot re-placement — the old driver rebuilt the conflicting blocks at the LIVE head every retry, so once a leg committed and the culprit synced it back (head advanced), later attempts re-proposed the same deterministic root at a new height and were refused forever; fixed by PINNING the fork base + blocks on the first attempt and LATCHING each placed leg (the #345 live-tip win is preserved — the base is the tip AT PIN TIME). (2) Attested-but-not- committed — a target attests on the proposer's standing but commits on its OWN attestation's qualification, which warms up later, so a leg could attest yet ack the commit not-OK; latching on the round-trip alone then stranded the next block chasing an uncommitted parent. Fixed by latching a leg only on a CONFIRMED commit (proposeAndCommitTo now reports committed) and retrying an attested-but-uncommitted one. (3) Detection disqualifies the proposer mid-drill (found via wire diagnostics) — the moment an honest node holds BOTH forks it slashes the culprit, removing it from that node's qualified-proposer set, so any REMAINING placement there is refused "not yet standing" forever (the property firing wedged the drill). Fixed by placing the COMPLETE heavier fork [Y,Z] FIRST and the conflicting X LAST, so no honest node can see both forks until every leg is down; the slash then propagates asynchronously (the detector reconciles the heavier fork), which is the property under test. Harness-only (core/node/adversary.go); no honest consensus path changes. Regressions: two failing-first unit repros (equivocation_resumable_test.go for the pin, equivocation_uncommitted_test.go for the commit-confirmed latch — both red-verified against the old code) plus the netem gate itself, now 10/10 consecutive PASS under the exact bimodal-RED condition (was ~1-in-4 FAIL). This clears the external red team's entry criterion.

MATURING cloud topology + field flow 10: the handoff/post-shed regime is now field-exercisable (§4 of the PE ruling; gates the external red team) — The base cloud topology never matures BY DESIGN (4 equal validator bonds → Nakamoto coefficient 2 < -mature-validators 4), so every prior field run exercised only the YOUNG anchor-gated regime — while the red team's sharpest target (brief seam #8) is the handoff and what follows. MATURING=1 SYBILS=8 ./cloudtest.sh now runs the topology that hands off on the wire: the maturity bar is set to the coefficient the 4 distinct-operator validators actually reach (2, at an explicit -operator-margin 1 — deliberate and disclosed, uniform across every consensus role) and the Sybil cohort bonds the MINIMUM (1M vs the validators' 64M) so the B2 drills price per-head cheapness the way the research certification does. The new flow_maturing_handoff (flow 10) grades, outcome-first: (10) the everMature latch trips on the wire (wheels shed permanently), commits cross the epoch boundary into the governed mature snapshot, and no anchor-required refusal appears post-shed; (10a) the B2 stall drill — the cheap cohort declines to attest (stopped) and the honest >⅔-weight coalition must still commit (head-counted quorum left this exact network born-unable-to-commit); (10b) the B2 capture drill — the cohort alone must not advance past the honest ceiling (ceiling read from the honest validators before stopping them, the #383 catch-up lesson; a real capture also requires a fresh cohort commit log; the frozen-weight super-majority refusal corroborates), with the clincher that the chain resumes when honest weight returns; (10c) WS cold-sync under the latch — a validator restarts pinned to a peer-published checkpoint: H:HASH, catches up, and comes back with the wheels STILL shed (a restart must never re-arm the anchors, F-1). Preconditions grade as honest GAPs (latch never tripped, cohort never banked), never fake passes; flow 5 (anchor-gate no-capture) self-skips under MATURING=1 since its premise — a network that never sheds — is deliberately absent. Runs LAST (it stops validators). Both topology modes dry-run-validated; the base topology is unchanged byte-for-byte with MATURING unset.

Parallel publish-token gather — transport concurrent, signer selection unchanged (research-stamped) — The flagship privacy flow (a fresh ephemeral client acquiring a -token-quorum k blind-signed publish token) was failing over real WAN under load: every leg was sequential — issuer-key fetches, per-issuer credit mints, canonical-set discovery, and the k blind-sign round-trips — ~2·V+k WAN round-trips end to end (ft_publish FAILED after 120s in both SYBILS=8 runs). All four legs now overlap, collapsing the gather to ~3 round-trip times. The privacy boundary is unchanged and research-certified (token-gather-privacy-and-fault-tolerance- RESEARCH-CERTIFICATION-2026-08-13.md, Item A1): requests fire concurrently at the fixed network-canonical top-k signers and wait for that exact set — acceptance is a function of canonical rank + liveness, with per-issuer failures falling forward in canonical order, never first-k-of-N-to-reply (the forbidden variant that would stamp the publisher's network position into the token's revealed signer set, re-opening R-3); token Sigs are assembled in canonical order so the token cannot leak the arrival permutation structurally. Canonical-set discovery (FetchCanonicalIssuersFromAny) races all validators for a deterministic answer (privacy-neutral: who answers first changes nothing about what is answered). Issuance is now idempotent under transport retries (certification Item A2): a retry re-presents the SAME blinded serial (deterministic RSA-FDH ⇒ identical signature) and the issuer dedups both the signature and the charge/credit-spend keyed on the blinded-serial hash within the transport retry window — before this, a lost reply double-charged the legacy fee and was refused as a credit double-spend on the prepaid-credit path, failing the whole gather. Instrumented per-leg (token gather leg debug logs with per-issuer elapsed). Failing-first regressions at unit (issuer dedup: single charge, identical sig, credit-retry accepted, TTL-bounded) and sim tier (canonical set accepted under heavy reply-order jitter across seeds; canonical fall-forward past a dead signer; round-trips proven to overlap on the virtual clock; 25% loss ridden out at exactly k fees). The named prediction for the next field run: ft_publish and the ~6 cascading flows flip to PASS, and 6-fault-tolerance recovers (research Item B1's conditional close — if it does not, the latency attribution reopens).

Attribution repro for the SYBILS=8 6-fault-tolerance GAP: quorum sizing is correct; the GAP is gather-latency under load, not a consensus bug — core/chain/TestFaultToleranceBranch_SybilBondsDoNotInflateLaunchQuorum reproduces the exact committed state (4 anchors + 8 banked single-domain sybil bonds, pre-maturity, objective, epochs on) and names the branch behind the field GAP: validatorSetSize=4 (the launch anchor branch fires — NOT the qualifiedCount=12 fall-through), RequiredQuorum=2, and a 3-of-4 anchor commit with one validator down passes in-process. So banked sybil bonds do not inflate the launch quorum, and the cloud GAP is a gather-latency effect under the 8-sybil load — not a quorum-sizing bug, no consensus rule change. Test-only; routed to research for concurrence (archive/reviews/token-gather-privacy-and-fault-tolerance-RESEARCH-CONSULT-2026-08-13.md).

#357 Conditions A+B — the mature phase epoch-snapshots its validator set, and the young→mature handoff lands at a finalized boundary (research-certified) — Completes the #357 arc: the research certification conditioned its C1/C2 soundness ruling on two pieces of mature-phase machinery, both now built. Condition A — finality is quorum-INTERSECTION safety, which only holds when every super-quorum is taken over the SAME set; recomputing validatorSetSize/qualification live from the churning bond ledger (joins, renewals, TTL expiry) could let two conflicting commits each "finalize" against two different sets. Post-handoff consensus (quorum size N, attester/proposer qualification, attester fork-choice weight) now reads a per-epoch FROZEN snapshot of the committed bonded set (Config.EpochBlocks), rotated only at epoch-boundary blocks — each itself super-quorum-final under the §3 gate. Churn integrates at the next rotation (bounded by one epoch); the one live mid-epoch disqualification is a proven slash, which is shrink-only against a frozen N (can only raise the effective bar). Condition B — the anchor→bond weight-meaning transition is now the FIRST mature rotation: after the everMature latch trips mid-epoch, the anchors keep governing (eligibility, weight, anchor sign-off) for at most one more epoch until the finalized boundary sheds them, so bond-weighted fork-choice is rooted at an immutable base and can never reach back across the boundary. One-way both ways (F-1: neither the latch nor the handoff ever re-arms). Daemon: -epoch-blocks (consensus-critical, set identically across the swarm), safe-by-default for an untrusted objective validator (DerivedEpochBlocks 8 — ≤ ¼ of the derived bond TTL, so a mid-epoch-lapsed bond's vote outlives its TTL by at most an epoch); explicit 0 opts a trusted/demo swarm out (pre-epoch live recompute, unchanged). Failing-first regressions at the chain tier: mid-epoch join/TTL-expiry cannot move N, RequiredQuorum, or qualification; the handoff waits for the boundary (anchor sign-off still required between latch and boundary); a mid-epoch slash disqualifies immediately with N frozen; plus the certification's repro-ladder step-2 drain-window ordering test (a lagging replica converges by catch-up; a conflicting, heavier drain ordering is refused without dropping committed height; weight strictly monotone across the drain). Full go test ./... + -race (chain/node/sim) green.

Regression guard for the #288 evict-on-one-miss anti-pattern (P0-4) — core/node TestLivePeerIsRetriedNotEvictedOnOneMiss locks the build-immutable #5 rule that a live peer must be retried, not evicted, on a single slow/dropped packet: a dead peer given RequestRetries=2 must be dialed 3 times (initial + 2 retries) before eviction, so re-introducing evict-on-the-first-miss (the shape that starved consensus under loss) turns this test red. Counting dials over a run-to-completion is timing-independent, so it can't flake. The internal/wanguard scope note now records that retry/evict are guarded by routing + this behavior test (they are semantic policy, not an AST-lintable construct). No product behavior change.

Handshake attribution instrumentation (#286 Layer 2 Q3) — To attribute the cross-region inbound err=EOF before tuning any deadline (the research team's "instrument first" discipline), tcpnet now logs, on every failing handshake, the numbers that separate the candidate causes: the inbound side logs the concurrent in-flight handshake count (the hub-stampede gauge) and the elapsed time before failure; the dialer side logs the dial budget and the elapsed spent. On the next run, a clustered EOF with high concurrency and elapsed ≈ the dialer budget attributes it to the hub-stampede / dialer-deadline variant (which the -persistent-peers fix independently relieves by spreading load and letting the proposer dial out); an instant failure points instead at a pin-rejection / teardown. Logging-only; docs/network-durability.md §8.

-persistent-peers: a static, never-evicted consensus-peer tier (#286 Layer 2, dominant fix) — The blind field tester root-caused the cross-region genesis stall (with the #327 -log debug): it is a mesh address-convergence bug, not a timeout. A proposer had send with no known address for the other validators, so it could not initiate the attestation gather → no quorum → no genesis. Cause: at genesis there is no chain (no discoverable validator registry), all validators bootstrapped to ONE seed, and silt's routing table holds bare NodeIDs (addresses live in the transport layer, learned only from inbound frames/gossip) — so hub-and-spoke never converges addresses across a fresh WAN, and the proposer cannot dial out. Fix (research-directed, docs/network-durability.md §8; the settled BFT/PoS practice — Tendermint persistent_peers, Ethereum static peers, libp2p peerstore): configure the validator/anchor set as -persistent-peers ID@HOST:PORT,… in every validator. Those peers are AddPeer'd at boot (their address is known up front, no dependence on inbound learning) and marked a never-evicted tier — a transient WAN miss is a retry, never an eviction, so a proposer can't lose an attester mid-formation and stall quorum (Q4). The cloudtest/awstest topologies now pass the whole validator set as persistent-peers. Guarded by TestStaticPeerSurvivesReachabilityEviction286 (a static peer survives retry-exhaustion eviction; a normal discovered peer does not). WAN-certified on the next GCP run.

Gather-path debug logging for the #286 Layer-2 root-cause — The consensus propose→gather→attest path previously logged ONLY on a successful commit ("block committed"), so a quorum-2 genesis gather that starts and never completes over the WAN (the #286 Layer-2 blocker) was invisible — a silent ValidateProposal reject of the ~1.5 MB first block looked identical to "never received". Added -log debug lines on both sides (core/node/chainrole.go): the PROPOSER logs gather: starting (with block SIZE), each gather: requesting attestation, each collected/refused/ failed reply, and gather: NO QUORUM; the ATTESTER logs receive → REJECTED (ValidateProposal) with the reason / REFUSED (already attested) / ATTESTED. So the next multi-region GCP run with -log debug shows exactly where the round stalls. Debug-level only — no info-level noise, no behaviour change (all consensus tests unchanged).

silt daemon -goodpropose <peerID> — a POSITIVE CONTROL for the -forge-block/-lowbond-propose rejections — The integration/redteam forged-block and low-bond scenarios asserted only that H3 replied OK:false, but a validator replies OK:false for many unrelated reasons (chain role disabled, ErrWrongParent, already-attested), so a target that refuses every proposal would false-pass both — "reject the good one too" is indistinguishable from "reject the bad one" (audit #303). New test-harness flag -goodpropose <peerID> (sibling to -forge-block/-lowbond-propose), backed by core/node.ProposeGoodBlock, sends a well-formed, properly-bonded proposal and asserts the target ACCEPTS it — logging goodpropose proposal ACCEPTED by <id> on attest, goodpropose proposal UNEXPECTEDLY REJECTED by <id> otherwise (it retries until its bond earns standing). The redteam harness now gates SCENARIO 2 & 3 on this positive control, so a rejection is attributed to the real defence, not a dead/wedged target. (#303)

PoR audit seam on silt daemon — -liar + -audit make the verify-without-fetch catch+slash wire-driveable — The silt sim run audit headline (a verify-WITHOUT-fetch PoR challenge catches a storage node that kept its proof tags but dropped the bytes, and slashes its standing) existed only in-process: Node.SetLiar and Node.Audit were unit/sim-tested, but nothing in cmd/silt toggled the liar or invoked the sweep, so over the wire a liar was caught only indirectly (it answers MsgHasChunk=false once its bytes are gone). Two new flags (siblings to the consensus red-team flags -equivocate/-forge-block/-lowbond-propose): -liar (keep the tags, advertise as a provider, drop the bytes, prove over data it no longer holds) and -audit <interval> (a -care-ing caretaker runs Node.Audit on every cared root — challenge each shard's providers, grade the proofs against the care-link key with no ground-truth fetch, and slash the liar). integration/audit now gates the literal claim over the wire (honest holders pass, the liar is caught and slashed) and demonstrates why it is needed — the liar's MsgHasChunk lie fools the availability probe but not the audit. (#232)

swarm add token-replay seam (-save-token / -use-token) drives the double-spend rejection over the wire — The publish-token double-spend guard (core/chain ErrTokenSpent + the online issuer's spent-set) was real and unit-tested but had no CLI/wire seam: every swarm add -token-quorum N minted a fresh random serial, so two publishes never collided. swarm add now takes -save-token <file> (write the acquired token, CBOR) and -use-token <file> (publish carrying that saved token instead of minting a fresh one). Re-presenting the same token for a second file re-uses its already-committed serial, which the registry's pre-check refuses with the exact ErrTokenSpent reason and never commits. integration/economy now gates the double-spend over the wire (a fresh-token control still commits) and ties its unlinkability assertion to the tokened entry's own zero-NodeID Publisher. (#233)

Cloud variants of the field-test series in integration/cloudtest — Four new GCP scenarios carry the local suites' properties onto real VMs / real regions, mapped onto the existing 13-node topology with no topology change: flow_publisher_unlinkability (privacy #3 — a durable-Publisher publish is refused by the default chain over the real wire), flow_durability_turnover (durability #2 — content survives a permanent storage-node departure, fetched bit-perfect from a survivor), flow_chaos_crash (chaos #7 — a SIGKILLed storage node re-announces its chunks (#69) via Restart=on-failure and content stays fetchable), and flow_web_ui_guard (client/UI #4 — the #89 web-UI guard holds on a real VM: no-token→401, DNS-rebinding→403, read→200). Wired into run_all_scenarios; shell/topology dry-validated (no billable run). C2-Sybil (#5) has no cloud flow yet — it needs non-anchor Sybil validator VMs (a topology.py addition) so the Sybils' bonds bank over a longer cloud run and the pure ErrAnchorRequired gate + ≥8-bond atomization note become assertable; recorded as a skip until then.

New field test: chaos / crash-recovery (integration/chaos) — Tests whether the system survives hard crashes: a SIGKILL (abrupt process death, no graceful shutdown), then a restart of the same node — same identity, same IP, same on-disk store (docker start on an un-removed container, unlike durability's docker rm). WAVE 1 (default, the gate): SIGKILL every holder, restart, and assert each re-bootstraps AND logs re-announced N held chunks (#69) so content stays discoverable, then a fresh client cold-fetches it back bit-perfect — with no crash-loop. Validated locally (PASS: 6/6 holders re-announced, bit-perfect after a full holder crash). WAVE 2 (opt-in, WAVES=2): also SIGKILLs the sole seed/registry/bootstrap; this surfaces a discoverability gap — the content stays on disk but a fresh client can't rediscover the providers in the window, and a single holder re-announce doesn't restore it — recorded honestly as an observation to root-cause (entangled with the single-bootstrap SPOF a real deployment avoids; retest with a redundant-bootstrap topology + on the cloud test), not a verified product defect, which is why it is off by default. Wired into run-all.sh (gate tier).

New field test: C2 "no quiet capture" under a Sybil validator set (integration/sybil) — Tests the M0 systemic C2 claim cynically, as an OUTCOME: can a bonded Sybil validator set — many identities, real bonds, its own quorum — quietly capture a young objective network? Two honest anchors (a1 proposer, a2 co-signer, since one anchor can't co-sign its own block under -anchor-quorum 1) plus a Sybil set. C2-a: with the anchors present the chain commits a real block and the daemon prints wheels engaged (young network — anchor quorum still required) — the chain is live and the training wheels are on. C2-b: stop both anchors and the Sybil set (s1 proposes, s2 attests) cannot advance the chain — no new block; the test reports which training-wheels layer refused it (locally the standing gate — a young Sybil set can't even earn committed bonded standing without an anchor-proposed block; behind it the anchor co-sign gate, ErrAnchorRequired). A chain advancing for the Sybils would be a hard FAIL. C2-c (bonus): with ≥8 committed equal bonds the C2 metric's atomization note fires (an equal-bond split reads as a fingerprint, not real decentralization). Honest scope (immutable #5): on one host the Sybils' bonds don't reliably bank on-chain, so the standing gate usually fires first (itself a faithful no-capture outcome); the pure anchor-co-sign gate with pre-banked bonds and the ≥8-bond atomization signal are exercised at scale on the cloud test. Validated locally (PASS). Wired into run-all.sh (gate tier).

New field test: the client / web-UI path under an adversary (integration/client) — Tests the path a real user takes — run a daemon, open its web UI, drop a file in, get a link, someone fetches it back — over the daemon's HTTP API, not the silt swarm CLI; and the path a real attacker takes against that same local API. A ui node (storage + its own registry + -ui) plus N holders; the test drives the UI with curl from inside the operator's container (the realistic browser-on-the-same-box model, and the only way the guard's local-Host rule is met). U1–U3: POST /api/publish (multipart + the bearer token grabbed from the daemon's own ui: …?token= line) scatters the file, /api/roots reflects it, and GET /api/fetch?link=… returns the bytes bit-perfect — the real end-to-end round-trip over HTTP. U4–U8 attack the guard (#89): a no-token and a wrong-token POST are refused 401, a DNS-rebinding request (non-local Host) and a cross-origin drive-by (evil Origin) are refused 403, and a token-free localhost read still returns 200 (ergonomics preserved). Every assertion is a real HTTP status code / real SHA-256, never an echoed string; any failure is a hard FAIL (the user path and the local-security guard are both load-bearing). Validated locally (PASS, all eight). Wired into run-all.sh (gate tier).

New field test: publisher unlinkability under an adversary (integration/privacy) — Tests immutable #4 (refuse-to-surveil) cynically, as an OUTCOME: can an adversary get the network to record who published a given file? A silt registry entry may carry a durable Publisher NodeID — a permanent file→publisher link on the append-only chain (the #14/F1 privacy corner) — and the M0 default refuses it. Two real silt -validator daemons form a committing chain; the test asserts on real chain-status commit counts and the validator's rejection line, never an echoed string. P0 (positive control) shows a chain run with -allow-publisher=true commits a Publisher entry — so the refusal below is real policy, not a broken publish. P1 shows the default chain commits a normal unlinkable publish and fetches it back bit-perfect (privacy isn't a broken product). P2 (the crux) shows the same default chain refuses an -allow-publisher publish — the real error surfaces over the wire (chain: entry carries a durable Publisher (records permanent linkage; publish unlinkably…)) and no new block commits. P3 shows a -token-quorum publish commits with a blind validator credential and no Publisher — authorized yet unlinkable (the F1 fix). A privacy regression (the default chain committing a Publisher entry, or the private path failing) is a hard FAIL; the metadata-correlation layer is a stated M0 tradeoff, not covered. Validated locally (PASS, all four). Wired into run-all.sh (gate tier).

New field test: durability under permanent holder loss (integration/durability) — Tests the core promise cynically — does content outlive the nodes that held it? A seed + 16 holders + caretaker swarm publishes a file at replication=1 (every column single-copy, the honest stress), then permanently kills holders one at a time and never replaces them so the pool shrinks onto ever-fewer survivors. Crucially it kills without re-scaling: an earlier rm -f+--scale design let Docker recycle a dead holder's IP to a fresh empty identity, and the caretaker dialing old-NodeID@that-IP hit a TLS-pin impostor — a Docker artifact (real infra doesn't recycle IPs in seconds) that masqueraded as "content lost." Shrinking the swarm removes the artifact and isolates the real mechanic: reconstruct-from-parity (k=10 of n=16) + re-scatter onto survivors. It reads two separate oracles — the caretaker's repair below k log (authoritative, unrecoverable content loss) for durability, and a warm-peer swarm get (every survivor handed as a direct peer) for retrieval, so a discovery flake is never miscounted as loss. Finding: durability held — across 10 permanent departures (16→6 holders) no stripe ever fell below k and the caretaker performed 13 reconstructions, so the bytes provably survived — but a fresh client's end-to-end retrieval stayed bit-perfect only down to ~11 survivors, then degraded (the #43 retrieval surface under permanent loss: durable is not the same as retrievable). Exits 0 as a FINDING (EXPECT=pass to hard-fail; MIN_SURVIVORS=11 for the retrieval-healthy clean PASS). True membership rotation (fresh VMs = fresh IPs) is the cloud test's job. Wired into run-all.sh (slow tier).

New field test: retrieval / discoverability at scale (integration/retrieval) — Measures the most basic user promise — can I get my content back? — on a real multi-holder swarm as short-lived publisher/fetcher identities churn the DHT (#43/#60). It publishes files, optionally pollutes routing with throwaway ephemeral publishes, then measures the bit-perfect cold-fetch success rate from fresh ephemeral clients and gates it on a floor. Validated locally, it cleanly isolates the cause: raw scale (24 holders, no churn) fetches 100%, but adding 40 churning ephemeral identities drops cold discovery to 85% — a real, honest reproduction of the #43 ephemeral-identity routing degradation (POLLUTERS=0 vs POLLUTERS=40). A sub-floor rate is a FINDING (exits 0 like upgrade reproducing #237; EXPECT=pass flips it to a hard fail), never a faked green. Wired into run-all.sh (slow tier).

Blind-session ease: an "LLM instructions" README section + interactive GCP setup — The field-test scripts stay simple and emit clean per-test output; the dated silt_local_fieldtest_<date>.md / silt_cloud_fieldtest_<date>.md roll-ups + per-test detail reports are written by the operating agent, guided by a new "For an LLM/agent operator" section in integration/README.md (plus a Quick-start). ./integration/cloudtest/cloudtest.sh setup is now an interactive step — it asks for the GCP project, walks the user through gcloud auth (login + the application-default creds Terraform needs), enables the required APIs, and writes config.env — so spinning up the cloud test needs no hand-editing.

integration/run-all.sh + shared integration/lib.sh — the clone-and-run field-test experience — One driver runs the local Docker suites in sequence (each owns its topology, so they run one at a time), captures each suite's real RESULT: line + duration, and writes a shareable consolidated report.md plus a terminal summary; exit 0 iff every suite that ran is PASS or a deliberately-reproduced FINDING. Runs the fast gate set by default (FULL=1 adds the slow soak/upgrade suites; SUITES="…" picks a subset). lib.sh factors the shared shell — RESULT classification, timing, prereq checks — that each suite otherwise re-implements; the suites still stand alone. Suite → M0-claim mapping lives in the driver's catalog.

Registry economics — -freeload role separation for the daemon (#47) — A daemon can now be started with -freeload to serve the registry / relay / routing role while refusing to store or serve content — so a public-infrastructure operator can run a rendezvous registry without being conscripted into hosting arbitrary content (the conflation that caps how many public registries the network can attract, which bootstrap/NAT-traversal depend on). The mechanism (node.SetFreeload, honored by the serve paths) already existed and was sim-only; this exposes it on the real daemon and announces the role. The node still carries DHT routing. (The leaner -registry-only mode — no storage node constructed at all — is the follow-up.) Covered by a real-TCP e2e; whole suite green with -race.

H9 takedown transparency — the CT-style append-only log (#180) — New core/translog: an RFC 6962 (Certificate Transparency) append-only Merkle log — adopted, not invented (B8) — for honored revocations. It offers the two proofs that make a takedown auditable and non-silent: inclusion ("revocation R is entry i of the log at size N") so a specific takedown is provably recorded, and consistency ("the log at size M is a prefix of size N") so an operator can't quietly rewrite history — a dropped or back-dated revocation breaks the consistency proof. Exhaustively tested: prover-generated inclusion paths (every leaf × every size) and consistency proofs (every prefix pair) cross-check against the recomputed roots, and a tampered history fails. This is the M0-honest core of pluralistic takedown; the ZK non-globality predicate + PIR-routed probes on top are post-M0. Wired into the chain: every honored revocation/un-revocation is appended to the log in Chain.apply (a deterministic function of the committed blocks, rebuilt identically on replay), and the chain exposes RevocationLogRoot + inclusion/consistency proofs + the exported RevocationLeaf so an auditor can reconstruct a leaf from public block data — so silt can now prove a takedown was recorded and that its takedown history was never silently rewritten. Whole suite green with -race.

D-DEMAND — the delivery receipt goes live on the wire (#181) — The core/demand primitive is now a real node capability. A fetcher AcquireDemandToken blind-withdraws a retrieval token from an issuer over the existing token-request wire (no new issuance path — the blind signature is domain-agnostic), then SubmitDeliveryReceipt sends the server a MsgDeliveryReceipt (the token + a PoR-bound, signed ack over the received bytes). The server verifies it against the issuer key it trusts and banks it into a neutral witnessed-demand observable (Node.WitnessedDemand) — never wired to consensus standing, so a forged or self-dealt receipt buys zero standing (the γ→1/N firewall). Only receipts naming this server are banked; replays (double-spent serial) and forged/mis-issued tokens are rejected over the wire. Integration sim covers the honest flow + both rejections. Whole suite green with -race. (Fee-burn cost-to-wash is P3; fetcher-unlinkability needs D3.)

GCP field test — an automated multi-machine RC gate (#52) — integration/cloudtest/ spins up a real ~13-node silt network across three GCP regions (validators, storage, a -registry-only node, a relay, a fetcher, a NAT gateway + natted peers, and an adversary), runs the acceptance flows (publish → commit → fetch bit-perfect, earned-standing validator onboarding, multi-validator convergence, f=1 fault tolerance, restart survival, per-hash takedown, cross-NAT via the relay) plus the #184 adversarial consensus drills (equivocation→slash, partition→heal, forged/low-bond→reject) over the real wire, emits a shareable report (report.md / report.html), and tears the whole network down. Deterministic and self-configuring — every peer/anchor/attester reference is computed from silt id -id-seed + static internal IPs before any VM boots, so there is no discovery wait. Cost-bounded four ways (SPOT instances + per-VM TTL self-destruct + destroy-on-exit + optional budget alarm, with a nuke-by-label fallback), reusable by outside developers against their own GCP project, and SMOKE=1 trims it to a 4-node run for a pennies-scale plumbing check. This automates roadmap #52 and is the standing field-test gate for every release candidate.

-registry-only — the leanest public-registry role (#47) — A daemon started with -registry-only serves a file-backed registry over HTTPS and constructs no storage node at all — no DHT, chunk store, chain, or caretaker. It sits below -freeload (which is still a full routing node that merely refuses to host content): a public-infrastructure operator can now run a rendezvous registry at minimal cost. The daemon returns to a tiny registry-serving path before any of the node machinery is built. Proven over real TLS (e2e/registry_only_test.go: a pinned client publishes + looks up an entry, and the daemon never announces a routing peer). With -freeload (PR #201) this completes #47.

Registry read-cost bounding — keep public registries cheap to run (#48) — A registry is a costless public good only if a single caller can't drive unbounded cost, so the registry HTTP server now enforces a per-client-IP token-bucket rate limit (generous defaults — 20 req/s, burst 40 — so normal clients never notice; sustained floods from one source get 429) plus server timeouts (read-header / read / write / idle) against slowloris. Idle rate buckets are pruned on a timer so a caller cycling source IPs can't grow the bucket map without bound (the map would be its own cost vector). GET /all is additionally priced by work (see the Fixed entry below) — a flat token bucket alone meters request count, not the O(N) serialization /all does. Covers the read-cost-bounding lever of #48 for a single source; a distributed /all flood, full cursor pagination, liveness-pruning of dead entries, and federation/sharding remain as post-launch work.

D3 issuance-mixing, slices 1 & 2 — ephemeral-identity + relay-routed token withdrawal (#179) — Closes the remaining fetcher-unlinkability links in the demand receipt. The token issuer authenticates whoever dials it via the end-to-end TLS handshake, so a withdrawal made over a fetcher's durable identity tied that withdrawal to the fetcher (the blind signature hid only the token serial, not the network identity). Now client. WithdrawDemandTokenPrivately performs the withdrawal over a fresh ephemeral identity — a one-off keypair + transport, torn down on return — paying with a prepaid blind credit (Node. AcquireDemandTokenWithCredit) rather than a durable account, so the issuer authenticates only an unlinkable ephemeral key and charges nothing it can tie to the fetcher (slice 1 — the identity link). Given a relay-form issuer address (relay:R@host:port) the ephemeral transport dials the issuer THROUGH a content-blind relay, so the issuer's inbound connection is from the relay, not the fetcher — hiding the fetcher's IP as well (slice 2 — the IP link); the end-to-end TLS still authenticates the ephemeral key across the relay pipe. Proven over real TCP (client/privissue_test.go: a mock issuer records the authenticated identity — it is the ephemeral one, never the fetcher's, direct and relay-routed; a withdrawal with no valid credit is refused). Fetcher-unlinkability is now cryptographic + identity + IP; timing-correlation (epoch-batching) is deferred to the post-M0 H8 mixnet. Whole suite green with -race; full e2e suite green over real TCP.

#184 verify — forged-block→reject and low-bond→reject over the REAL WIRE (#184) — The two ValidateProposal defences, proven against real daemons over TCP: an honest validator refuses to attest a proposal whose proposer signature is forged (corrupted after signing) or whose proposer lacks a qualifying bond. A single red-team primitive (Node.ProposeBadBlock, behind the daemon's -forge-block / -lowbond-propose flags) sends one crafted proposal to a peer and reports whether it was refused; the block is otherwise valid and built at the target's head, so the only reason for refusal is the fault under test (a bad signature → ErrBadSignature, or an under-bonded proposer → ErrLowReputation). TestForgedBlockRejectedOverTCP and TestLowBondProposerRejectedOverTCP. These complete #184's four consensus-safety cases over the real wire (with equivocation→slash and partition→heal). Whole suite green with -race; full e2e suite green over real TCP.

D-DEMAND P1 — blind-withdrawn retrieval token (#181) — The demand token is now blind-withdrawn: core/blindtoken gains a domain-separated demand variant (BlindDemand/VerifyDemand — a demand token can't be presented as a publish token or credit under the same key), and core/demand upgrades the token from a placeholder issuer-signed serial to Withdraw → SignWithdrawal → Unblind. The issuer blind-signs the token without learning its serial, so the token that later redeems is cryptographically unlinkable to its withdrawal. Fetcher-unlinkability stays nominal until D3 issuance-mixing (H8) closes the IP/timing channel — the blind signature hides the serial, not the withdrawer's network identity. The P0 unforgeability red-team carries over (now over blind tokens), plus an unlinkability regression. Whole suite green with -race.

D-DEMAND P0 — the blind demand receipt primitive (witnessed delivery, unforgeable-at-the-token-level) (#181) — First phase of the B axis (served-demand) of the systemic claim. New pure core/demand: an issuer-signed retrieval token, a PoR-bound delivery-ack (the fetcher signs a Shacham–Waters proof over the delivered bytes, with the challenge bound to serial‖object‖server), and a bank/redeem that credits a per-object witnessed-demand counter once per token. It proves exactly one thing — #receipts(C) ≤ #issued-tokens-spent-on-a-signed-C-delivery — and, per the decision's doc-truth rule, deliberately does not prove demand authenticity (a self-fetch is a real paid delivery; a Douceur limit, re-priced by cost-to-wash in P3, never proven).

• NEUTRAL by construction. A redeemed receipt is an observable (Bank.Demand) that is never wired to consensus standing — so even a forged or self-dealt receipt buys zero standing, keeping the γ→1/N shared-content firewall intact (fusing demand into standing stays gated on #182). Standing is bond-only today.
• Unforgeability red-team (each a permanent regression): a token not issuer-signed, a tampered/lifted receipt (server/object/fetcher/sig), a receipt claiming object C' while holding C's bytes (the PoR binding, not just the signature), a data-less "delivery", and a double-spent serial — all rejected; only an honest signed delivery credits demand. The public-per-object-key tag-forgery residual is documented (H7 precedent; inert because demand is neutral).
• P1 blind withdrawal, fetcher-unlinkability (needs D3/H8), P2 fair-exchange dispute, and P3 cost-to-wash economics remain. Whole suite green with -race.

C2 metric wiring — cost-to-corrupt from the committed bond ledger, split-resistant shed (#185) — The "no quiet capture" axis (C2 / D-C2) gets a first-class, published concentration measurement. chain.C2Metric computes {NakamotoBonds, NakamotoOperators, CostToCorruptBytes, TotalBondedBytes, Margin} over the committed on-chain BondReg ledger — never gossip, which kills the "lie about your size" skew half of the skew+split attack outright. It was previously a private helper that only gated the training-wheels shed; now it is a single measurement consumed by the shed and surfaced for operators.

• Split-half defense via an operator margin. A BondReg carries no operator label, so real key→operator clustering is impossible on-chain; instead a config OperatorMargin M discounts the bond-distinct coefficient to NakamotoOperators = ⌊k̂/M⌋, and Mature() sheds the anchor training-wheels only when k̂ ≥ MatureValidators × M — so a stake split across many keys must clear k·M distinct bonds. M=1 (default) is the legacy/single-operator behavior, unchanged; the daemon exposes -operator-margin and narrates the metric on every commit (nakamoto N bonds → M operators | cost-to-corrupt … | wheels shed/engaged).
• Honest residuals (D-C2, unchanged): operator clustering is heuristic by theorem (Kwon) — M only bounds it; M_est under adversarial NodeID placement is unquantified; the honest-whale / real cartel is outside C2. Byzantine-robust sampling and the private-lookup committee-certification consumer (H8/#179) are future. Unblocks the external C2 red-team (#183). Full unit coverage of the metric arithmetic + the split-resistant shed; whole suite green with -race.

H7 proof-of-correct-repair — the false-repair red-team (acceptance gate) (#95) — The self-dealing adversary is driven against the wired verification handler over a live network (core/node/redteam_repair_claim_test.go), proving the crypto's verdict actually reaches the ledger, each case a permanent regression:

• (a) garbage claim → slash. A claim naming a real position but a bogus shard id: the judge recomputes the position from the manifest-anchored survivors, sees the mismatch (a self-attributing fraud proof), and slashes the claimant — no bounty.
• (c) compute-but-don't-store → denied, never slashed. A correct shard id on a data-less liar holder (keeps the proof + PoR tags, drops the bytes) fails its identity-bound retrievability challenge → denied but not punished (a shortfall may be transient). This also pins the (b) anti-double-count property: retrievability binds to the named holder, so "the correct bytes exist on the survivors" does not pay.
• Positive control — an honest claim on a real holder clears both legs, the holder is paid, and no standing moves — so the deny/slash cases are discriminating, not blanket rejection.
• (d) quorum discovery — every caretaker announcing under the careKey rendezvous is found, so none is silently excluded from the vote. (Domain-diverse quorum SELECTION — refusing a single-domain quorum — is explicit deferred hardening, tracked with caretaker-selection work.) Whole suite green with -race.

H7 finite-but-renewable durability — instrument g + the funded horizon (slice 3) (#95) — silt does not promise perpetual cold-data solvency (that promise is the Arweave endowment identity in credits, and it holds only while the credit-denominated cost of storage keeps falling — which 2020s hardware evidence questions). So durability ships as an explicit finite-but-renewable contract, and this slice makes where an object sits on it measurable (decision D-S7):

• The escrow now tracks a repair count (PayBounty increments it), and a per-object ports.DurabilitySnapshot (reserve, lifetime funded/paid, repairs) crosses the CreditLedger interface — read-only, classified neutral under the Invariant-A guard.
• New pure instruments in core/credit read a snapshot: CostPerRepair (realised credits per shard-repair), Horizon (how long the reserve lasts at the observed burn — returning a finite flag so "no burn yet" reads as unproven, never perpetual achieved), and G — instrument g, the annualized trend of cost-per-repair, signed so g > 0 means cost is declining (the condition under which "perpetual" becomes earnable). g stays measured, never assumed.
• A bounty payment now narrates the drawn-down reserve and cost-per-repair (Node.DurabilitySnapshot exposes the accounting for the observatory). Full unit coverage of the instruments + a repair-loop sim asserting the snapshot's repair count matches bounties released and the funded horizon is a positive finite runway; whole suite green with -race.

H7 self-funding durability — the serve auto-skim goes live (#95) — The escrow that pays repair bounties is now topped up by the object's own traffic. The MsgFetchChunk serve path resolves each coded shard's object root from its storage proof and routes the serve through RecordServeToObject, which diverts a protocol-fixed slice (SkimNum/SkimDen, 1/8) of the serve revenue into that object's durability reserve — so popular data pays for its own repair while the server keeps the net. Shards with no proof-anchored root (manifest chunks, uncoded files) keep the plain serve.

• Publisher/operator funding API — Node.FundDurability(root, amount) prepays an object's reserve from the node's own balance (a pure balance move, never standing), so cold data can be endowed to outlive churn before it is popular enough to self-fund; Node.DurabilityReserve(root) reads the remaining horizon. ports.CreditLedger gains RecordServeToObject. (A publisher-side CLI subcommand waits on the client credit-balance model; the node API is the entry point today.)
• The invariant holds. Serve income funds the balance economy and the durability reserve — never standing. The integration sim retrieves a whole file, watches the reserve fill from the serves (a slice of the bytes, not the whole thing), and asserts no node's Reputation moves. Full unit + sim coverage; whole suite green with -race.

#184 verify — partition→heal proven over the REAL WIRE (partition control + reorg observability) (#184) — The M0 consensus denial "honest replicas cannot permanently diverge under a partition" now runs against real daemons over real TCP, not only the in-process sim (sim/reorg_test.go). A new -block-peers daemon flag (Node.SetBlockedPeers) simulates a severed link — the node drops all traffic to/from the listed peers — so a validator can be partitioned, each side can make its own progress, and then the link can HEAL (restart without the flag; the persisted chain reloads and reconciles). The e2e (TestPartitionHealsToHeavierForkOverTCP) splits two committing groups into divergent forks (a heavier two-block fork and a lighter one-block fork), then heals the lighter side, which reorgs onto the heavier fork — consensus reconverges on one history. Also adds a Node.OnReorg callback so the daemon surfaces a reorg on stdout (chain: reorged onto a heavier fork (dropped N block(s), …)) — a significant, operator-visible consensus event, and the precise signal the e2e asserts. -block-peers models a transport fault, not Byzantine behaviour (the node stays honest); a real deployment never sets it. Second of #184's four consensus-safety cases (after equivocation→slash); low-bond→reject and forged-block→reject follow. Whole suite green with -race; the e2e passes over real sockets.

#184 verify — equivocation→slash proven over the REAL WIRE (adversarial-daemon harness) (#184) — The accountability property "a proven double-sign costs standing" (D2) is now exercised against real daemons over real TCP, not only in the in-process sim. A new -equivocate red-team daemon flag (quarantined in core/node/adversary.go, loudly announced, reached by no honest path) makes a validator DELIBERATELY double-sign: it places block X at height 1 on one honest peer and a heavier conflicting fork (Y, Z) on another. The honest detector syncs the heavier fork, reconciles across the two histories, and chain.FindEquivocations catches the adversary signing two different blocks at the same height — slashing it. Because fork-choice is summed qualified-attester weight, the heavier fork is deterministic, so the e2e (TestEquivocatorSlashedOverTCP) is not a timing race. Also adds a Node.OnSlash callback so the daemon surfaces slashing on stdout (chain: slashed equivocator …) — a real operator-visible accountability event, not only a debug-log line. Keeping the adversary in the shipped binary (behind the flag) means it runs in CI and lets an external red-team drive the same attack against a deployment to confirm the defence holds. First of #184's four consensus-safety cases; partition→heal, low-bond→reject, and forged-block→reject follow. Whole suite green with -race; the e2e passes over real sockets.

D-DEMAND P2 — the optimistic fair-exchange abort-safety floor (#181) — The demand exchange is content C (server → fetcher) ⟷ a delivery receipt (fetcher → server). Fair exchange provably needs a TTP (Pagnia– Gärtner); silt's is the validator quorum as a threshold-distributed TTP (Asokan–Shoup–Waidner), invoked only on dispute. This ships the optimistic phase + both abort-SAFETY properties, which hold structurally today: (1) fetcher-side — an aborted exchange never consumes the token (a serial is spent only by a completed Redeem), so a server that takes the commitment and delivers nothing leaves the paid token reusable at another server (the fetcher can't be robbed of its token); (2) server-side — a fetcher's pre-release ExchangeCommitment (a signed promise made before content release, domain-separated from the receipt and carrying no PoR proof) can never redeem as demand, so a server can't turn "the fetcher engaged" into a fake completed delivery — the unforgeability bound #receipts(C) ≤ #completed correct deliveries survives the abort path. Regression-locked (token-reusable-after-abort, commitment-is-not-a-receipt, domain separation, optimistic path still credits). Gated, deliberately not built: the dispute-RESOLUTION half — turning a server-held commitment into a TTP-affidavit on fetcher default requires the quorum to verify delivery completed without the fetcher — i.e. verifiable escrow of the content key (Camenisch–Shoup) + threshold decryption t-of-n across validators. The threshold-decryption/DKG half is available in Go (dedis/kyber, drand-grade); the wall is the verifiable-escrow primitive (no adoptable pure-Go impl) plus the large new crypto trust surface — disproportionate to a neutral observable. Same strategy as H7 (floor now, heavy crypto as a fast-follow), different primitive. Demand-neutrality keeps this low-stakes: an unresolved abort only undercounts a neutral observable, never standing. ExchangeCommitment is the seam the future resolver consumes. Whole suite green with -race.

D-DEMAND P3b — the bonded-fetcher credential (second cost-to-wash lever) (#181) — Witnessed demand can now be gated on a bond-distinct fetcher credential: with demand.Bank.RequireBondedFetcher (wired on the daemon as Node.RequireBondedFetchers), a delivery receipt counts toward an object's demand only if the fetcher's signing key is a bond-distinct identity in the committed on-chain bond ledger (chain.IsBonded — the same Sybil-priced, deduped supply the C2 metric measures), and demand then counts distinct bonded fetchers per object. So a self-dealer running one bonded identity can still mint N perfectly valid receipts (a self-fetch is a real paid delivery — Douceur is unbeaten), but witnessed demand rises by 1, not N — re-pricing wash to one real storage bond per faked unit of demand, the best achievable under no-center. This is the second lever alongside the already-shipped P3a fee-burn (each wash burns a real retrieval fee). Demand stays a neutral observable throughout — the gate changes what counts as demand, never whether demand touches consensus standing (it never does; the γ→1/N firewall is intact). Off by default (raw count, unchanged). Self-dealing red-team locked at both the pure layer (core/demand: unbonded → 0, one bonded identity washing 6 → demand 1, 4 distinct bonded → demand 4) and the real node wire (sim: one bonded identity washes 5 → demand 1, unbonded delivery → 0, a distinct bonded identity → +1). Residual: the credential shows the bonded key in the clear, so fetcher-unlinkability stays nominal until D3/H8 — the demand.BondCheck doc marks the exact seam for a blind bond-distinctness proof. Whole suite green with -race.

H7 proof-of-correct-repair — the node/network quorum wiring (#95) — The core/repairproof gate is now wired into the live repair loop, so a durability bounty actually flows on a verified repair. When a caretaker rebuilds a lost shard and places it on a fresh holder (repairStripe), it emits a MsgRepairClaim naming that holder; the object's other caretakers — reached through a new careKey rendezvous (hash(root ‖ "silt/care/v1"), announced on Care), since only a care-link holder has the layout key needed to judge — each independently run both legs:

• Verify (handleRepairClaim, core/node/repairclaim.go) — reload the layout, fetch k survivors by column (verifying each against its committed id, dropping what it didn't already host — a paramedic, not a hoarder), VerifyByRecompute the claimed position, then challenge the holder's retrievability under the identity-bound RepairChallengeSeed, and Decide.
• Settle on the LOCAL ledger — release pays the new holder from the object's escrow (PayBounty, capped by the rarest-shard BountyFor multiplier); a self-attributing correctness lie slashes the claimant (SlashFalseRepair). Credit is per-node-local accounting, so each caretaker-judge settles independently and the τ-of-q quorum is the emergent property that τ honest judges reach release — no on-chain bounty transaction.
• The invariant holds through the wire. A bounty is a pure balance motion — the integration sim churns a stripe, watches a peer caretaker verify and release the reserve, and asserts no node's consensus standing moves at all, so the γ→1/N shared-content hole stays shut. ports.CreditLedger gains PayBounty/SlashFalseRepair/FundEscrow/EscrowBalance; new RepairBountyBase/RepairQuorumTau config (bounty economy off by default). Full unit coverage (settlement truth table) + happy-path sim; whole suite green with -race. (The full self-dealing red-team — garbage claim → slash, relay double-count → denied, compute-but-don't-store → denied, quorum domain-packing — and the caretaker-discovery hardening land next.)

H7 proof-of-correct-repair — the verification layer, slice 2 (logic + wire) (#95) — A repair bounty must pay only for a real, correct repair, never a bare claim. New core/repairproof composes the gate, unit-tested end to end short of the network wiring:

• Correctness leg (VerifyByRecompute) — reconstruct the lost shard from k survivors and check it is byte-identical to the manifest-committed shard ID. Sound, pure-Go, publicly checkable, content-blind. (A soundness pressure-test proved the plaintext-blind homomorphic-commitment path impossible in pure Go over silt's GF(2⁸) storage — there is no ring homomorphism GF(2⁸)→F_r — so M0 ships this recompute floor; the blind upgrade is a documented fast-follow. See docs/design/h7-proof-of-repair.md §3, §13.)
• Retrievability leg (VerifyRetrievability + RepairChallengeSeed) — a Shacham–Waters PoR challenge bound to the holder's own node identity, closing the relay/double-count attack (reuses core/por).
• Release/slash gate (Decide) — release iff correctness holds and a τ-of-q retrievability quorum confirms; a failing correctness recompute is self-attributing fraud → slash. Backed by a new credit.SlashFalseRepair press (classified reduces under the Invariant-A guard: it can only ever lower standing).
• Repair-role model decided from the real code: silt's repair is a paramedic split (the caretaker reconstructs but keeps nothing), so the bounty pays the new holder of the rebuilt shard (§8b). Wire types (MsgRepairClaim/MsgRepairVote, RepairClaim) landed; the node quorum handler + hot-path hook + sim/e2e are the next slice.

H7 durability-escrow primitives — the S7 funding layer, slice 1 (#95) — The repair loop that keeps content alive under churn must be paid in equilibrium, not charity (the wound that killed Freenet/GNUnet). New in core/credit/escrow.go: a per-object durability reserve (FundEscrow), keyed by an object's root, that pays repair bounties; an auto-skim (RecordServeToObject) that routes a protocol-fixed fraction — SkimNum/SkimDen, 1/8 — of each object's serving revenue back into that object's reserve, so popular data self-funds its durability while cold data draws down what it prepaid; a rarest-shard bounty multiplier (BountyFor) that scales the payout by how under-replicated a stripe is, so repairing the last spare before data loss pays the most; and a PayBounty draw-down that pays what the reserve can cover (a short reserve = the object's funded horizon running out, finite-but-renewable, not an overdraft).

• The one load-bearing invariant is enforced structurally. The durability budget lives in the balance economy and confers zero consensus standing — a durability credit that bought standing would re-open the shared-content γ→1/N hole (one physical copy of an erasure-coded shard answering for N pledges). The Invariant-A reflection guard (invariant_a_test.go) now classifies every escrow press neutral and fails the build if a new one ships unclassified; the behavioral half fires funding, skimming, and bounty-payout against a bondless identity and asserts Reputation never rises above zero. Standing is still minted by the bond press alone.
• Prototype-first: these are the ledger primitives. Wiring the auto-skim into the live serve path and gating PayBounty on a verified proof-of-repair transcript are later H7 slices (2 and 3). Full unit coverage; whole suite green with -race.

Design note: rebinding the storage bond to identity and size (M0 Sybil / G2) — docs/design/m0-sybil-rebind.md. The Sybil corner is open: a red-team pass over the F1 fix code broke it again via prefix plots (blocks 0..m-1 of an n-block plot are byte-identical to a standalone m-block plot, and each prefix has its own distinct Merkle root, so per-root dedup never fires). The root cause is that VerifySpaceTime checks only Merkle inclusion and never recomputes a label — proof-of-storage, not proof-of-space — while identity is asserted by a signature over an attacker-chosen root rather than verified. The note specifies the fix (a public, identity- and size-bound plot seed plus a labeling-consistency challenge the verifier recomputes without holding the plot), its soundness parameters (k ≥ λ·ln2/ε), the wire format, the build sequence, and the ordering constraints — including that the public seed must never land before the labeling check, and that the G3 "proof beats declaration" fix is load-bearing for its griefing safety. Derived by an independent researcher pass with no build context. Not yet built; M0 is not held.

silt daemon -honor-chain-revocations and -revoke: operate on-chain takedowns, with an e2e proof (F5) — the accountability fix's per-operator honoring and quorum-gated, existence-checked revocation are now operable from the binary. -honor-chain-revocations subscribes this operator to on-chain takedowns (default OFF — following the chain never imposes someone else's takedowns; the operator-local -denylist is always honored). -revoke <root> makes a validator propose an on-chain takedown of a root once it has earned standing and the root is committed (retried on the loop-safe clock; the chain enforces existence + quorum). This completes the F5 test pyramid with the e2e tier (e2e/TestChainRevocationCommitsOverTCP): a validator drives a quorum revocation of a published root over real TCP and it commits. The per-operator honoring is covered at integration (sim/revocation_test.go).

Anti-release bond floor (-min-bond-floor / Node.MinBondBytes): a bond too small to be safe against release + re-plot earns no standing (M0 Sybil F1/F2) — the byte-binding + read-bound-VDF plot makes a released prover recompute (memory-hard) before it can answer, but that only bites if re-plotting the pledged size takes LONGER than the challenge window. At the measured plot throughput (~270 MB/s, bond.BenchmarkSeal) a 500 ms window re-plots ~135 MiB and this daemon's ~2 s window ~540 MiB — so a bond at or below that could be released and recomputed just-in-time. A bond below Node.MinBondBytes now earns no standing, self or peer, at the live audit: bondAuditOnce gates both the self-credit and the peer-credit on the floor, so a valid answer for a sub-floor plot proves nothing about sustained possession. Exposed as silt daemon -min-bond-floor (default 0 = off, since every fast test/demo/NAT config uses tiny bonds; an open deployment sets it above window × throughput, e.g. 1G, and the daemon warns if -bond is below it). Coverage: unit (core/node/bondfloor_test.go — a sub-floor bond earns 0, an at-floor bond earns standing) and integration (sim/bond_floor_test.go — a sub-floor validator is denied standing over the live audit wire while an at-floor one earns it). BondVDFDelay remains the complementary time-floor knob. See docs/design/m0-sybil-bond.md.

silt daemon -objective: run consensus on objective on-chain-bond fork-choice (F6), with an e2e proof — a validator can now enable objective mode from the binary: -objective (with -min-bond, and requiring -anchors + -mature-validators > 0 for the cold-start) wires the on-chain-bond verifier and makes the validator register its real bond live as it proposes, so eligibility, quorum, and fork-choice weight come from verifiable on-chain bonds instead of the local reputation view. This completes the F6 test pyramid with the e2e tier (e2e/TestObjectiveConsensusCommitsOverTCP): two -objective daemons bootstrap via anchors and drive a real objective quorum commit over real TCP, and the file round-trips bit-perfect — the bond-registration-and-verification protocol works end to end, not just in the sim. Objective mode remains opt-in at the daemon (the default stays the legacy reputation path); flipping the shipped default is the remaining step, tracked in docs/design/m0-consensus.md.

Validator onboarding (acceptance re-run new-F1/new-F2): silt id, silt chain-status, and a runnable examples/ playbook — the M0 acceptance re-run PASSED (all 9 flows, all 8 tenets, zero broken), leaving two "major" gaps that both blocked a literal newcomer from the validator flow without changing any mechanism. (new-F1) Role-4 setup was chicken-and-egg: -attesters <ID_B> needs B's NodeID, but nothing told you how to learn it before launch (the acceptance script resorted to booting a throwaway daemon to read its peer: line). New silt id [-id-seed N | -store DIR] [-listen ADDR] prints the NodeID a daemon would use without launching one — resolving the identity exactly as the daemon does — so the topology is wireable up front. (new-F2) there was no operator playbook for the multi-validator flows 5–7 and no way to confirm convergence except hashing chain.cbor by hand. New read-only silt chain-status [-store DIR] prints a replica's head height, head hash, and block/entry counts — identical head height AND hash across replicas proves they agree; a rising head after a restart proves catch-up. And a new top-level examples/ directory ships four bash playbooks (flow2-publish-fetch, flow4-earned-standing, flows567-convergence-fault-restart, flow8-takedown) — the flows-5–7 script IS the field test roadmap #52 owes itself, now runnable in one command. The playbooks track only the PIDs they start (no blanket pkill) and use both new commands. docs/user-seam.md Role 4 gains a concrete silt id-based recipe and points at examples/. All four playbooks pass end to end locally (including the restarted-validator chain catch-up on real daemons — the daemon-level confirmation of the F1 restart fix). Traces to S5 (an operator can see and reproduce what's true), #52. Adopted from the M0 acceptance reproduction scripts.

Gate 4d (#93): the publish-token issuer key persists across restarts — a validator that issues blind-signed publish tokens generated a FRESH RSA key on every daemon start, which orphaned every token it had already FRESH RSA key on every daemon start, which orphaned every token it had already signed (they no longer verify) and staled every issuer public key its peers had cached. A new adapters/diskissuer persists the key (PKCS#1 DER, written atomically with 0600), and the daemon loads-or-creates it: first run mints the issuer identity, every restart keeps it — so outstanding tokens stay verifiable and the distributed issuer set is stable. A corrupt or foreign key file is a hard error, never silently overwritten with a new identity. Tested (V5): the restart property is pinned (two LoadOrCreates over the same dir return the same key), plus save/load round-trip, clean-absent, and corrupt-file handling; the real daemon (e2e + Docker NAT) starts and persists the key. Honestly labelled: this is the issuer-key half of §3d's "issuer survives restart"; on-chain issuer registration (so the qualified issuer set is chain-verifiable rather than fetched ad-hoc) is the remaining §3d piece, and it pairs with the deferred D3 canonical-validator-set work. Traces to M0 (the unlinkable-publish path stays live across restarts), B7. See docs/design/gate4-m0-mechanism.md §3d.

Gate 4f (#100): equivocation is provable and slashable — double-signing costs standing (D2) — the consensus analogue of a storage liar: a validator that signs two DIFFERENT blocks at the SAME height (trying to make two competing histories both look supported) is now caught and penalised. Two parts: (prevention) an honest validator records the block hash it signed at each height and REFUSES to sign a different block there — it never equivocates, even if two competing proposals reach it before either commits; (penalty) a chain.Equivocation is a compact, self-verifying proof (the two conflicting blocks; any node recomputes their hashes, confirms same height + different block, and that the culprit's signature — as proposer OR attester — verifies in both), and chain.FindEquivocations extracts every cross-fork double-signer from two competing histories. When a node reconciles across a fork it slashes each proven equivocator in its local ledger (credit.SlashEquivocation), a crushing, permanent reputation penalty that buries the culprit below any threshold — so its proposals are refused and its attestations stop counting toward any fork's weight. An honest validator signing sequential heights is never implicated (the heights differ) and a forged accusation fails (the signatures won't verify). Tested (V5): unit — a double-sign is provable, a sequential signer and an unsigned accusation are not, the same block is not a conflict, and every cross-fork culprit is found while one-fork signers are spared; node — a validator REFUSES a second block at a height it attested, and reconciling across a fork slashes the double-signer below zero. Honestly labelled: strict lock-on-attest can stall a height's liveness if a proposal fails and its attesters are needed again there — proper resolution is round-based unlocking (Tendermint POLC), a recorded 4f hardening; on-chain equivocation records so every replica slashes in lockstep (vs. each acting on what it observes) is the other recorded follow-up. Traces to M0 (a double-signing proposer cannot stand two histories AND keep its standing), D2. See docs/design/gate4-m0-mechanism.md §3e.

Gate 4f (#100): the chain can reconcile forks — reorg to the heavier history (D2) — the registry chain was append-only with no reorganisation ("first valid block at a height wins"), and SyncChain silently breaked on divergence, so a partitioned or diverged validator stayed forked forever. It now heals: Chain.Reconcile re-validates a peer's full chain end to end in a throwaway replica and, iff that history is strictly heavier (ties broken by the lower head hash, so every honest node picks the same winner), adopts it — rolling state back to the shared genesis and forward onto the heavier fork. Because all derived state (byRoot, spent, revoked, validatorsSeen) is a pure function of the blocks, the reorg is a whole-state swap, not fragile per-record undo. Fork-choice weight is the cumulative count of DISTINCT qualified non-proposer attestations across the chain — the heaviest history is the one the most earned standing has committed to, not merely the longest (which a fast Sybil could extend); signatures are objective, the qualification bar is the local reputation view (which converges among honest replicas). The fork is genesis-anchored, so a peer cannot swap in a heavier FOREIGN chain, and every block is re-validated, so a lying peer wastes time but cannot feed an invalid history. SyncChain now reconciles against each peer's full chain — one uniform path for catch-up, fork-heal, and no-op (an equal-length fork is invisible to "give me blocks above my head", which is why it compares whole chains). Tested (V5): unit — a heavier fork is adopted, a lighter one rejected, ties break deterministically by hash, a foreign genesis is refused, an under-quorum fork is re-validated and rejected; integration — a 10-node network partitions, each side commits its own history, then heals and the lighter side reorgs onto the heavier fork over the wire while the heavier side does not budge. Honestly labelled: fully-objective, partition-independent on-chain PoST-bond weight is the recorded D2 hardening (a self-asserted or locally-qualified weight can diverge under an adversarial partition); equivocation evidence + slashing is the next 4f increment; genesis-to-head diffs (vs. whole-chain fetch) are the scaling follow-up. Traces to M0 (consensus can't be captured by an off-head or partitioning proposer), D2. See docs/design/gate4-m0-mechanism.md §3e.

Gate 4b (#93): the bond plot persists — a restart reloads it, never re-plots — plotting the identity bond is deliberately expensive (that expense is the Sybil cost), so paying it again on every daemon restart would be wasteful and, for a large pledge, a long stall before a validator can prove standing. A new adapters/diskplot store persists the plot (one atomic file per identity: a small header with the block geometry and committed root, then the raw blocks), and EnableBond now loads-or-plots: if a persisted plot exists it is reloaded and its Merkle root re-derived from the bytes and checked against the committed root (B7 — persisted state is re-verified, not trusted), so a restart skips plotting entirely; a corrupt, truncated, or stale plot is detected and cleanly re-plotted. core/bond gains Reconstruct (rebuild a commitment from persisted blocks) and Blocks; a new ports.PlotStore seam keeps the node pure (nil = memory-only, fine for sims). The daemon wires it alongside the proof store (inheriting the #69/#93 restart discipline). Tested (V5): the adapter round-trips and flags truncated/foreign files; a reloaded bond answers a space-time challenge; and the node-level restart outcome is pinned — a second start with the same identity reloads instead of re-plotting (asserted via plot/reload counters), while a corrupted plot re-plots to the correct identity-bound root. Traces to M0, D1, B7. See docs/design/gate4-m0-mechanism.md §3b/§3d.

Gate 4b (#91): verifiable delay function primitive (core/vdf) — the sequential-work core of the proof-of-space-time bond, and the first 4b construction piece. A VDF evaluates in a prescribed number of inherently sequential steps (you cannot parallelise your way to the answer) yet emits a short proof anyone verifies almost instantly — exactly what a bond needs to bind a fresh epoch challenge to real elapsed, non-parallelisable time, so a Sybil can neither retroactively fake having held its pledged space across the epoch nor buy its way out of the wall clock with more cores. The construction is Wesolowski's VDF (EUROCRYPT 2019), adopted not invented (B8): over a group of unknown order (Z_N^* for an RSA modulus N), y = x^(2^T) mod N by T sequential squarings, with π = x^(⌊2^T/ℓ⌋) for a Fiat–Shamir prime ℓ computed in T steps via long division (never materialising the T-bit exponent), and verify π^ℓ·x^r ≟ y for r = 2^T mod ℓ in O(log ℓ + log T) — cheap enough to stay on the core loop. Security rests on N's factorisation being unknown (a documented trust anchor; the class-group variant removes it and is the noted upgrade path). Pure package (big integers and bytes only). Adversarially tested: relabelling a shorter computation as a longer one, a trivial π=1, tampered y/π, wrong-challenge, wrong-T, and non-canonical elements all fail; the delay loop is pinned against a direct x^(2^T) reference. Wiring the plot + epoch proof off-loop behind the existing bond.Verify seam is the next 4b change. Traces to M0 (the Sybil corner: space-time held, not asserted), D1, and B2 (the heavy work runs off the core loop). See docs/design/gate4-m0-mechanism.md §3b.

Gate 4a (#90): wire the real proof-of-retrieval into the live audit path — the core/por primitive now replaces the toy scheme in the running node. An auditor verifies that a peer still holds a shard without fetching the bytes: at distribute time the publisher computes each shard's per-block authenticators under a key derived from the file's layout key (node.DerivePorKey, mirroring the link key hierarchy) and ships them beside the Merkle proof (StorageProof.PorTags); the storage node keeps them with the chunk; on challenge the prover aggregates its bytes + tags into a compact (μ, σ) response; the auditor derives the same key from its care-link and checks the response touching no data. gradeAnswers loses its ground-truth fetch entirely — a liar node that kept its tags but dropped the bytes now fails an audit that never fetches, and is slashed via credit.RecordAudit. The auditor recomputes each full shard's expected block count from the layout ChunkSize and rejects any prover under-reporting it (soundness against partial deletion for every full shard; the single short tail shard is the one documented residue for the V3 red-team). The key never crosses the wire and a storage node — lacking the layout key — cannot forge. Two hand-rolled codecs were extended so the tags don't vanish in the field (a #65-class trap): the TCP wire codec (adapters/tcpnet) and the on-disk proof store (adapters/diskproofs, so a restarted host can still prove what it re-announces, #69). Repaired/re-seeded shards are re-tagged from the caretaker's care-link. Coverage (V5): unit (deterministic key derivation + cross-capability agreement, GCM-overhead guard, wire + persistence round-trips), sim (liars slashed with zero ground-truth fetches during the sweep — proven by a per-kind message counter), and the real-daemon TCP + cross -NAT (incl. full-swarm restart) harnesses stay green carrying the enlarged proofs. Traces to M0 (presence proven, not asserted), B8, and B7/V3. See docs/design/gate4-m0-mechanism.md §3a.

Gate 4a (#90): real proof-of-retrieval primitive (core/por) — the first Gate-4 construction piece. A verifier holding a small secret key can now check that a prover still holds a chunk's bytes without fetching them — the property the toy scheme (core/node/por.go, which grades against ground truth it fetches itself) deliberately lacked. The construction is the private-verification Compact Proof of Retrievability of Shacham & Waters (ASIACRYPT 2008) — a homomorphic linear authenticator over the Curve25519 field prime: per-block tags σᵢ = f_k(i) + Σⱼ αⱼ·mᵢⱼ, a seed-expanded challenge, and an O(s) aggregated response (μ, σ) whose size is independent of the chunk. A prover that deleted or altered any sampled block cannot make the verification equation hold without the secret αⱼ, which the tags do not reveal. The verify key is designed to ride the care-link, so caretakers audit over ciphertext while storage-node provers cannot forge. Pure package (bytes and keys only); wiring it into the manifest, node audit loop, and credit ledger is the next 4a change. Adversarially tested: tampered/deleted-block, key-less forgery, wrong-key, and wrong-unit proofs all fail. Traces to M0 (the Sybil corner: presence proven, not asserted), B8 (adopt the proven primitive), and B7/V3 (a non-holder fails the challenge). See docs/design/gate4-m0-mechanism.md §3a.

Deterministic NAT/relay/hole-punch in the sim (#27): the in-process network (simnet) now models a home router — a NATed node dials out freely (each outbound opening the conntrack reverse mapping so replies get back in) but is un-dialable cold from off its LAN. Two NATed nodes on different LANs therefore meet through a designated relay (counted in Stats.Relayed), or HolePunch opens a direct path for cone NATs and correctly falls back to the relay for symmetric ones. A relayed delivery pointedly does not open a direct mapping, so a later direct dial still needs a punch. This is the tier-1, seed-reproducible mirror of the integration/nat Docker harness; it is zero-overhead and byte-identical for every existing scenario (no NAT configured → the fast path short-circuits and draws no extra randomness).

Hole-punching: relay paths upgrade to direct connections (#27): when two NATed daemons talk through a relay, the relay now coordinates a hole-punch — it tells each the other's observed endpoint, and both dial it from their relay-registration port at once (SO_REUSEPORT, TCP simultaneous-open). Through a cone NAT the crossing SYNs establish a direct link, which the transport adopts so the bulk traffic leaves the relay; on symmetric NAT it simply fails and the relay path stays. The relay forwards no bytes for the direct path — it only swaps addresses. The punch primitive is proven end-to-end against real kernel NAT by the integration/nat harness, CI-gated (cone → direct connection, symmetric → relay); the relay coordination is unit-tested. This demotes the relay from every-byte carrier to rendezvous, the big cost win for cheap public infrastructure (S6). (The live two-daemon upgrade has a harness scenario in progress — the caretaker traffic-trigger needs the minimal-network provider resolution sorted.)

NATed nodes learn their public endpoint, STUN-style (#27, the groundwork for hole-punching): when a node registers with a relay, the relay reports the host:port it observed the registration coming from — the node's NAT mapping. A node behind NAT cannot otherwise know its own public address, and hole-punching needs it (it's the endpoint a peer aims a simultaneous-open at). Surfaced as relay.Client.Observed / node.ObservedAddr and logged by the daemon. This is phase 1 of #27; the relay-coordinated punch, port-reuse dial, and relay→direct upgrade follow. The integration/nat harness asserts a NATed node learns its mapped public IP (the gateway's), not its LAN address.

Automated cross-NAT integration harness (integration/nat/, and a nat-integration CI job): stands up two genuinely-NATed daemons plus a public relay in real container networks (real kernel NAT via iptables MASQUERADE, real TLS over real sockets), publishes from behind one NAT and fetches from behind another, and asserts the bytes come back bit-perfect having crossed the relay (verified by counting relay splices). This is the automatable replacement for the manual two-machine (Mac A ↔ Mac B) rig — the NAT/relay path that the in-process sim and flat-localhost e2e can't reach — and the seed harness for hole-punching (#27) and restart/re-provide (#69) scenarios. Runs on one host (CI, a dev box, or Docker Desktop); no second machine.

Opt-in in-RAM read cache for hot chunks (-cache SIZE, default off; #42): a cache hit serves trusted bytes from memory, skipping both the disk read and the per-read hash re-verification. Read-through LRU, cache-on-read only, and Delete evicts so purged content is never served.

The daemon caretakes content published through its own UI by default (-care-published, #44): without a caretaker a published file's redundancy only decays as nodes churn — now the publishing daemon repairs its own roots, and both the UI and CLI say whether a caretaker is running.

Paginated, shard-sorted roots list in the daemon UI (#45): the "identifiers this daemon holds shards of" table now paginates and sorts by shards held, instead of rendering every row (unusable at hundreds).

A public build log — a chronological "how it was built and why" narrative under docs/buildlog/ (dated Markdown entries), rendered to website/buildlog.html by scripts/gen_buildlog.py on the same source-of-truth pipeline as the changelog and roadmap (CI fails if the page drifts). It's the reasoning behind the design — the forks, the dead ends, the decisions — distinct from the changelog (what shipped) and the roadmap (what's next), and strictly about building the infrastructure. Seeded with three entries: the one-process/ports-and- adapters prime directive, the placement spectrum, and cross-network reachability. Linked from the site's docs and footer.

-log LEVEL — narrate the normal path, not just failures — both silt daemon and silt client take -log error|warn|info|debug, opening the debug.log sink at that threshold; -debug is now shorthand for -log debug. At info the happy path narrates — file distributed (chunks placed), block committed (quorum reached, by proposal or broadcast), file retrieved, alongside the existing stripe repaired, dispersion re-spread, and reachability verdict — so a real-world run can be checked against how the system is supposed to behave, not only when something breaks, and without the debug firehose. Free when off and off the hot path (per-chunk store events stay at debug); core still logs through the ports.Logger port and imports nothing new.

Multi-process end-to-end tests over real TCP (CI hardening, BACKLOG Phase 2) — a new e2e/ suite builds the silt binary and runs three daemons as separate OS processes, publishes a 1 MiB file through the chain-backed registry over pinned HTTPS (driving a real consensus round to a committed block), then fetches it back across the swarm and asserts it returns bit-perfect. This exercises the whole wire path the in-process sim deliberately bypasses — exactly where #36's "a reply can never reach a NATed peer" bug hid until real sockets carried it. It runs as its own CI job; the unit and race jobs pass -short to skip the process spawning.

Relay discovery by gossip (#27 polish) — a daemon offering -relay now stamps the service's dialable host:port on every outgoing envelope (borrowing the -advertise host when the relay listener is bound to a wildcard). Peers record these first-hand — a node only ever announces its own relay, and dialing pins the relay's identity, so gossip can direct but never impersonate. A daemon whose reachability verdict is NATed and that has no -relay-via adopts the first discovered relay automatically (and keeps watching until one appears): the two-Macs runbook now works with nothing but -bootstrap.

Two-slot address book: direct preferred, relay fallback (#27 polish) — the transport now remembers up to two addresses per peer, one direct host:port and one relay:R@host:port, instead of one slot the two forms fought over (an mDNS-learned LAN address used to be clobbered by the peer's relay stamp, sending house-mates through a relay on another continent). Dials try direct first — no third hop — and fall back to the relay within the same delivery; a direct address is dropped only when the relay fallback reaches the peer, which proves the address stale rather than the peer down. Contact gossip passes on the relay form when one is known (a relay-advertising peer is NATed, so its direct address is LAN-scoped hearsay); peers.json persists both slots. The reachability dial-back ignores relay addresses outright: reachable-through-a-relay is exactly what "public" must not mean.

Relay (#27, step 3 — the universal NAT fallback) — a NATed daemon can now be reached across networks through any reachable node running -relay ADDR. The shape is libp2p Circuit-Relay-v2's, without the dependency: the NATed node keeps one registered outbound connection to the relay (-relay-via RELAYID@HOST:PORT, taken up automatically when the reachability verdict says NATed) and advertises relay:R@host:port as its address; a sender dials the relay, the target dials back, and the relay splices the two streams. Crucially, the sender then runs its normal pinned end-to-end TLS handshake with the target through the splice — the relay moves opaque bytes it cannot read, alter, or forge, so "a frame's sender is whoever the handshake authenticated" holds unchanged across a relay. Relaying is a capability, not infrastructure: opt-in, capped (concurrent sessions, per-peer sessions, per-session bytes), no relay baked into the binary, and the relay-operator metadata exposure is documented in the threat model. CI proves the full path on localhost — including both-peers-NATed, every byte relayed — because "NATed" is modeled honestly as "accepts no inbound connections".

-debug flag → debug.log on both silt daemon and silt client — a leveled logger behind a new ports.Logger interface (core stays pure; the file sink is adapters/logfile). One grep-able line per event: transport failures (dials, handshakes, forged frames), node events (request timeouts, repairs, dispersion re-spreads, the reachability verdict), and daemon milestones (discovery, bootstrap). Quiet by default and free when disabled; with -debug, a failure in the field leaves an artifact that can be attached to a bug report. Groundwork for testing cross-network reachability (#27) on real networks, where failures are one-shot and remote instead of deterministic and replayable.

Zero-config LAN discovery (#27, first rung of cross-network reachability) — silt daemon now announces itself on the local network and folds any peer it hears into the routing table, so two nodes in the same house find each other with no -bootstrap, no DNS seed, and no infrastructure. It's link-local multicast (the same idea as mDNS, scoped to the LAN by TTL), and self-authenticating: an announcement carries a peer's ID@host:port, and the TLS handshake still must present a key hashing to that ID, so a rogue beacon can misdirect a dial but never impersonate a node. On by default; -mdns=false opts out, and a loopback-only -listen disables it with a note (nothing on the LAN could reach a loopback address anyway). See docs/design/cross-network.md.

Reachability check (#27, our AutoNAT) — after bootstrap, a daemon asks a couple of known peers to dial it back at its advertised address. A landed dial-back both proves and delivers the verdict "public"; silence within a timeout is read, conservatively, as "behind NAT" (which only ever costs a relay we might not have needed, never a false claim of being reachable). The daemon logs the result and the dashboard shows it; the relay step will key its advertise-direct-vs-via-relay decision off it. No new message plumbing beyond two wire kinds; the pure core stays NodeID-only — reachability is simply whether the transport can deliver.