Fast finality that survives recovery.

The rohu does not carry a barometer. It feels the current.

Every consensus paper starts with a confession of faith. We assume partial synchrony. We assume an asynchronous adversary. The author picks a weather at whitepaper time and prays for the rest of the protocol's life. Rohu-Paplet refuses to pick.

The rohu is a river fish. Here it is the fast path, which finalizes in two message delays when the network is kind. The paplet is a sea fish. Here it is the asynchronous reader, which orders by common coin when the network is not. Both read the same water. This post tells the line in three acts:

• Act I, two readers, one river. One uncertified DAG, written the same way in every weather and read two ways. Rohu finalizes in 2δ when the river runs clear. Paplet orders by coin in a storm. The monsoon flip moves between them on evidence that sits in the DAG itself. Cross-read confluence (O1-C) says the two readings give one order. It is machine-checked for all N and reduced to one threshold-clock rule, and its 2δ leg is conditional on granular synchrony. On 11 nodes across four continents, the log kept committing through a storm in which River finalized nothing.
• Act II, the dabbas get their own train. Transaction data gets its own plane: independent producer chains with DA certificates, under the same control DAG. For f ≥ 2, no rule over a control cone alone can carry a fast extension both completely and soundly, so the frontier has to travel as a signed artifact, the FrontierCert. The paper makes no claim at f = 1. T1 to T4 compose the two planes into one log and one checkpoint sequence. Then a stricter per-position state-root oracle caught a real ordering bug. Anchors agreed, total order did not, and the paper reports it.
• Act III, the monsoon, one parent at a time. The global eras, the flip, and the Heal go away. Each certified parent gets one domain that can close forever. Votes cast before a timeout can still form a certificate after recovery starts, and every valid closure set must select that child (Section 9). This is the current design, and most of the post.

Claim status · read this first

The headings argue with swagger. This table is where each claim meets its proof. A claim not in the table is positioning, not a result.

A word on register before the swagger starts. The jokes live in the headings. The theorem statements, quorum counts, and caveats are exactly as strong as the paper makes them, and no stronger. When a quip and a theorem disagree, the theorem wins, and the claim-to-artifact ledger in Section 11 settles the rest.

Field guide

A timeout is not an eraser

Somewhere a Byzantine collector is sitting on a finished certificate and a smirk. Recovery has to plan for that collector, not for the polite ones.

Byzantine consensus must connect three statements: some data exists, validators agree on its position, and an application can consume the agreed result. A fast certificate counts only if later recovery preserves it.

Each statement needs its own contract. A certificate for a block digest proves that the data exists only under a custody contract. Agreement on selected DAG anchors fixes a position only with a deterministic interpretation of their complete ancestry. A fast certificate gives irreversible authority only if later recovery preserves it. That must hold even when no recovery participant has assembled the certificate yet.

The late-certificate problem

A proposal that looks unsuccessful can still finalize. Signed messages can be delayed, and a Byzantine collector can reveal them after recovery makes another choice. So recovery needs evidence about what could already finalize, not only a report of what its participants have learned. The evidence must also survive the loss of the first recipient of a certificate. A signed promise to hold a complete artifact must imply that the signer retains it and that others can eventually retrieve it.

Certified descendants create a second difficulty. Suppose a late certificate proves p → x, and another observer has already certified x → y. Recovery of p must then authorize exactly x. It cannot preserve x and append a recovery transition after it, because that transition would be a competing successor of x. It also cannot treat two proofs for x as two different parents. Otherwise, honest validators could sign conflicting children in domains that they wrongly think are separate.

Four distinctions used throughout

The four distinctions explain why a working fast path, a DAG, and a persistence layer are not enough. The system still needs a composition argument.

Contributions and scope

The paper makes four contributions within the stated model:

1. A complete interface from data to certificate: compatible producer paths, accepted cuts, exact semantic children, replaceable proof artifacts, and deterministic ordered deltas.
2. A parent-local preservation construction. Quorum arguments show that closure and ordered resolution preserve possible late FAST and receipt finality. Induction then gives one certified prefix across both routes.
3. A connection to native asynchronous DAG ordering. It states the broadcast, coin, complete-cone, and first-resolution obligations, the explicit progress premises, and a structural count of recovery stages.
4. An implementation and falsification record. It separates the signed reference construction, its ordering adapter, the earlier native components, and the independent transport and extension experiments.

The paper establishes one algorithmic comparison, against the earlier era-based design. One parent resolution replaces the cycle of barrier, executed checkpoint intent, and Heal ownership in that design.

The water

Everyone writes the same water in every weather. The fault budget is f, in total, for the whole execution, and it counts the people who fall in later.

Fix f ≥ 1 and a committee N of n = 5f+1 authenticated identities. Over the whole execution, at most f identities in total may deviate, disappear, or lose their safety state.

The budget is total, and it counts later failures too. It is not f Byzantine identities plus a separate crash allowance. Quorums count distinct configured identities, not messages. A restarted process keeps its identity and must restore its earlier restrictions before it signs again.

Roles

Configuration binds

Communication

What consensus guarantees

Write hist(π) for the semantic history that a finality proof π describes, and ⪯ for the prefix relation. Certified-prefix safety then reads:

Notation

Quorum arithmetic

Every safety proof on this page uses one counting fact. For sets A, B ⊆ N of distinct identities:

With n = 5f+1, the four thresholds give the intersections below. A positive honest count means that the two sets share an honest identity. An honest identity never signs two conflicting values in one domain or slot.

The route map

One transaction from the platform to the terminus, with six validators and no surprises. Then the same trip with one surprise.

Data certificates establish compatible, retrievable producer paths. Accepted control vertices expose finite source cones. A proposal uses a complete cone to build an exact child of a certified parent. River can finalize that child directly. Otherwise, closed statuses constrain an Ocean resolution.

Application delivery follows the certified parent chain, whichever route supplied the certificate. Ocean has two jobs here, and neither job is to decide the application head. It supplies accepted cuts to child construction, and it orders recovery records. Only a valid finality route authorizes a child: River or an effective resolution.

From a transaction to a certified child (f = 1, six validators)

1. A producer puts transaction t in a signed block b. Four distinct DA votes certify the compatible path through b. At least three of those voters are honest holders of the complete data.
2. An accepted control cone advertises this certificate. The designated leader derives a frontier that extends F_p and sweeps the newly included blocks. It proposes child x with t at a deterministic position. The source-cut round is strictly newer than the round of p, and the proposal verifier has all prerequisite evidence.
3. Open validators persist a choice for x and multicast PREPARE. Five distinct PREPAREs form FAST, and an observer can then certify x. Alternatively, validators can retain a complete four-PREPARE certificate U_p(x). Three distinct receipt signers then acknowledge it to produce FIN. A receipt proves possession of the complete U. It is not another name for an isolated PREPARE vote.
4. After it verifies either proof, an observer enables the domain for children of x. The application can consume D_x when its payloads and predecessors are available. It does not wait for a recovery record for p.

The same execution with a late certificate

Suppose five PREPARE signatures for x exist, but the assembled FAST is withheld. A timeout closes d_p at an honest signer. Closure spreads, and validators collect five complete statuses. The FAST signers and the status authors share at least three honest identities:

Each of these three must include its earlier PREPARE for x in its status. So the selection rule preserves x, although no status collector has seen FAST. For a hidden FIN, every five-status set contains at least one honest holder of its complete U, and that status supplies the same preservation evidence.

A validator advertises a complete resolution record. The first valid resolution for p in Ocean order certifies x. Another observer may already have learned FAST and certified a descendant x → y. Then the resolution is one more proof for x. It has no authority to create a different successor of x.

When the statuses force no child, the record supplies a complete valid fallback child instead. Its delta can be empty only if its source cut and semantic height still advance under the normal validity rule.

Dabbas

The dabba principle: the routing is painted on the box. A DA certificate names the 3f+1 validators that hold the data, and anyone along the way can check it.

A producer block has an authenticated header. The header identifies the configuration, the producer, an increasing sequence number, the exact predecessor, a payload commitment, and the committed transaction positions and identities. Each producer starts at a configured genesis.

An honest DA voter durably chooses one append-only branch per producer. It retains the complete payload path that justifies each of its votes. It may not vote for conflicting branches, at the same height or at different heights. The certificate for a block contains 3f+1 distinct DA votes with matching bindings. The DA certificate is therefore a full-holder availability contract.

A Byzantine producer can withhold a new block or strand an uncertified branch. Neither stops the control DAG, which advances without that advertisement. Honest data holders keep serving earlier certified blocks.

Frontiers, cuts, and their certificates

A frontier F gives one certified position for each configured producer. A coordinate can stay at the position of its parent or advance along a compatible DA-certified path. The lemma makes the valid positions on one producer chain comparable, so their greatest position is well defined.

A source cut c identifies an accepted Ocean vertex and its complete, finite strong-and-weak ancestry, with authenticated bodies and accepted-slot proofs. The physical round r(c) of the cut is the round of its root vertex. Source cuts are available before Ocean needs to select their vertices as ordering anchors. Acceptance proves the contents of the cut. It does not ratify a proposed application transition.

Start at F_p. Extract every valid compatible DA-certified coordinate that the complete cut advertises, and take the coordinatewise maximum. For each producer i:

Here A_i(c_x) is the set of valid compatible DA-certified positions of producer i that the complete cut advertises. The full contribution is mandatory.

Under the common parser, an invalid complete data advertisement contributes nothing. A missing required opening is Pending, and no verifier can mistake it for an empty contribution. The resulting portable evidence is a FrontierCert (FC). It stays a candidate until an exact child that carries its vector and source cut is ratified. Two valid candidates can be compatible coordinate by coordinate and still induce different transaction interleavings. The ratified parent chain selects the actual order.

Optional complete vector evidence

The conservative v4 evidence interface also permits a complete, proposal-relative vector pool. The pool supplements the mandatory cut. It contains 4f+1 distinct signed records. Each record binds one configuration, source proposal, predecessor frontier, and vector schema, and supplies its body and authenticated compatible paths.

On a proposed path, a position that at least 3f+1 records support is eligible. Beyond a fully supported proposed tip, selection requires the support of 4f+1 records. Support from 2f+1 records for an extension is carry evidence for a later proposal. It gives no authority to execute that extension now. The child commits one exact result before validators sign PREPAREs. Different complete pools can justify different candidates. Agreement comes from the ratification of one child.

Sweep and duplicate handling

For each producer, enumerate the blocks strictly after its parent coordinate, through its new coordinate. Sort the union lexicographically by producer sequence (seq), then configured producer index (idx), then block digest:

Within a block, transactions keep their committed order. Keep the first occurrence of each canonical transaction identity in the delivered prefix. A receiver computes the whole delta before it appends it. It cannot sweep only the part of a cone that it can see now. Missing payloads can delay transaction decoding and execution. They cannot change the certified order of block identifiers.

The inclusion obligation

Every child names a cut with a strictly greater round than the cut of its parent: r_x > r_p. The child includes the entire contribution of that cut. Each honest Ocean author includes its own previous accepted vertex as a strong parent. Each author also serves an arrival-ordered FIFO queue of older accepted vertices that are absent from its own cone. While that queue is not empty, each new vertex carries a positive, bounded number of weak references from it. Arrival means complete accepted admission. Canonical sorting of the selected references must not let newer arrivals overtake an older queued vertex.

The lemma needs an honest advertisement of the certified data. It says nothing about fairness for a client request that was never admitted, or for a producer that never gets its DA certificate. Its purpose is narrower. It stops infinitely many otherwise successful children from omitting already eligible data forever.

Promises in ink

A child is its contents, not its paperwork. Signatures, routes, and proof bytes never enter its identity.

The configured semantic genesis has height zero, source-cut round zero, initial producer frontiers, and the initial ordered-log commitment. Its authority comes from the agreed configuration, not from a certificate collected at runtime.

A child of a certified parent p is the semantic tuple

Here F is the certified frontier, and c_x commits to the complete accepted source cut. Its physical round is r_x > r_p. D_x is the canonical ordered block delta, and L_x is the extended log commitment. The identity of the child and the successor domain of the parent are

Neither identity contains proposal signatures, signer subsets, delivery routes, or Ocean proof representations. Frontier and cut commitments identify their semantic contents, not the bytes of the DA or broadcast certificates around them. The domain has no era number and no retry counter.

Complete child validity

The verifier checks:

• configuration and canonical encoding,
• exact predecessor and height,
• a complete finality proof for p,
• a complete accepted cut at a strictly later round,
• compatible certified frontier contributions,
• mandatory inclusion of the entire cut,
• recomputed delta and log commitments.

An empty delta is legal only when these same checks pass. Renaming an arbitrary empty value is not a recovery opportunity. A fast proposal also needs the signature of the designated leader. An Ocean-selected fallback needs no leader signature, because the ordered resolution authorizes it. Both routes check the same semantic child predicate.

Evidence types and quorums

Evidence counts are typed. A STORE quorum is not a finality quorum, and a receipt is not an isolated PREPARE. PREPARE and receipt signatures bind (config, d_p, id(x), kind). A receipt acknowledges possession of a complete valid U_p(x) and carries that protection. It does not require every receipt signer to retain the same U signer subset, which would split aggregation.

A closed status binds d_p. It contains the own PREPARE of its author, if any.

The status also contains every complete U protection that the author retained before closure, including the protection behind a receipt. A signer may have prepared a different child from the one in its retained U. The status must disclose both.

State and the publication barrier

Each validator keeps a durable map indexed by d_p. An entry holds:

• the chosen PREPARE or reserved signing intent,
• the retained complete protection,
• the released receipt,
• the immutable closed status, if any,
• the matching outbox.

Learned finality is recorded separately, so learning a child does not erase the entry of its parent. A monotone floor for timer backoff also survives parent changes.

Ocean keeps its accepted DAG, seals and coin authority, emitted transcript, and first-effective-resolution map. All of these are separate from the application delivery cursor. Every signing transition follows four steps:

1. Validate the input and its complete dependencies against the configured instance and semantic parent. If required evidence is missing, stop with Pending.
2. Reserve the permitted choice or closure in durable state. After this step, recovery cannot choose a conflicting signature, even if no signature was sent.
3. Produce and retain the authorized signed output and its outbox entry. Publish only after the persistence contract acknowledges the transition.
4. After restart, check identity and state consistency, restore the restrictions, and retransmit the retained outbox as needed.

Valid, Invalid, Pending

Every verifier distinguishes three outcomes. A known wrong digest, an invalid signature, a conflicting binding, or forward Ocean authority is Invalid. An earlier opening that was promised but not yet fetched is Pending. A reader can skip a record only when it is completely and deterministically invalid.

Proof dependencies are finite and acyclic. Equivalent proofs establish one semantic identity. But one proof artifact can still be unusable at a particular Ocean position. An Ocean proof from a future position cannot replace a FAST proof to justify an earlier resolution.

Rohu, in the river

The Virar fast does not stop for anybody. Board with 4f+1 PREPAREs, or watch it go.

The configuration fixes the leader for each child height. The exact certified parent enables one attempt. A timer, an alternative certificate encoding, or late evidence cannot change the leader or create another attempt for that parent.

Proposal, prepare, and possession receipt

The leader proposes an exact valid child with its complete parent, cut, frontier, and availability evidence. Each open validator verifies the signature of the designated leader and the complete child predicate. If it has not chosen another child in d_p, it persists its choice and multicasts one PREPARE. A validator answers duplicate messages from its outbox. Duplicates cannot authorize a new choice.

A complete certificate U_p(x) contains 3f+1 matching PREPAREs. A validator may retain it even if its own PREPARE named another child. If its domain is still open and its receipt restriction permits, it persists this complete protection and multicasts a possession receipt. A receipt certifies retention of that evidence. It does not assert that the receipt signer proposed or prepared the same value.

Fast-path transition rules

Two ways to learn the same finality

An observer finalizes x on either of two typed quorums:

Both prove an exact immediate child of p. The observer does not wait for Ocean to process a resolution for p before it proposes or votes for a child of x.

Two complete U quorums share an honest signer:

An honest signer prepares only one child, so distinct valid U certificates cannot protect conflicting children. FAST contains such protection, and FIN acknowledges it explicitly. The smaller receipt quorum does not weaken dependency checking. It is large enough that an honest holder of the complete artifact appears in every later closure set (Section 9).

Message-delay ledger

The ledger assumes ready prerequisites and open signers. Processing and persistence time are either inside the service envelope or charged separately. The smaller receipt quorum does not remove the extra causal leg.

When the fast path does not finish

The fast path has no internal view-change rule. If the parent stays unresolved, a finite local timer can close its domain and start recovery. A closure is a promise about future signing. It does not prove that the old child never finalized.

An early timeout can preempt an honest proposal. Safety survives because recovery preserves its possible finality. Fast-service claims must still require that signers stay open for the stated interval.

Monsoon

Panic is unilateral, recovery is collective. A local timer closes one domain without asking anyone. Ocean then orders one resolution that everyone reads the same way.

Recovery must preserve evidence that can become visible later. It uses three separate functions. Closure stops new honest signatures in the old domain. Complete statuses constrain which child is permissible. Ocean chooses one common resolution. A status set alone is not an agreement decision.

Permanent closure

A finite local timeout for an unresolved child closes only d_p. Receipt of f+1 valid closed statuses for d_p also triggers closure and a status multicast. Closure atomically records both the ban on future old-domain signatures and the complete status, before the status is published.

After it advances, a signer keeps serving valid requests about the old parent. It returns its cached status and any finality evidence it has. Closing an ancestor never closes a child. A signer may learn a late valid finality proof after closure. It may not create a new old-domain signature.

Protection extracted from a status set

Take exactly 4f+1 distinct complete statuses S_p. Verify all signatures, parent bindings, and embedded evidence. Then apply the first matching rule:

Each rule selects at most one child. Two conflicting complete U certificates cannot exist under the fault contract (Section 6). Each status reports at most one own PREPARE, so two distinct children cannot both reach 2f+1 reports in one set:

A verifier rejects inconsistent evidence. It does not choose arbitrarily among it. A status set is preservation evidence, not an agreement certificate. Different valid sets can return different unfinalized children.

The resolution record and its authority

Any validator may form R = (p, π_p, S_p, z). Here π_p proves the exact parent, and z is a complete valid fallback child derived from a strictly newer accepted source cut. The fallback does not need the signature of the designated fast leader. The common selection function is

Use the normal form z = protect(S_p) when protection is present. The protected old child already has a valid cut strictly newer than p, so the resolution does not need an extra unused fallback. In the unprotected case, any complete valid fallback child is eligible.

All dependencies, including the selected old child, must be retrievable under the storage contract. An external object reference is eligible only with 4f+1 distinct STORE signatures. These signatures commit to the type, canonical length, content hash, chunk Merkle root, and exact acyclic dependency list of the object. A STORE signer first retains the complete body and validates the retention certificates of its dependencies. The resulting (4f+1) − f = 3f+1 honest holders supply eventual retrieval. An arbitrary unbacked hash is structurally invalid. It is not an instruction to wait forever.

Position precedence

Every Ocean authority that a resolution reaches through its parent-proof chain must come before the transcript position of the resolution itself:

Here ocean(π_p) is the set of Ocean authorities reachable through the parent-proof chain. A complete forward or cyclic Ocean dependency is invalid. Substituting a future Ocean proof for an otherwise equivalent FAST parent proof must not make an earlier record wait forever. The check applies recursively at the position of every embedded Ocean certificate, including through intervening FAST or FIN proof wrappers. A known false position or digest membership is Invalid. Only earlier evidence that is truly unavailable is Pending. An explicitly forward Ocean dependency is Invalid at once. Retrieval must not turn that structural contradiction into an indefinite wait.

Validity and firstness depend on complete evidence and transcript order. They never depend on the current application head of the reader or on when certificates arrive. An earlier record with an unavailable opening keeps the interpreter Pending. The interpreter cannot skip it in favor of a later record that is open. Structurally invalid complete records are deterministic no-ops. Every anchor advances the control transcript. Only effective parent resolutions advance application authority.

Installing certified children

The selected old x keeps its exact identity, even if Ocean supplies an extra proof for it. Install certified ancestors before descendants, and append each semantic transition at most once. A resolution for x can appear in Ocean before a resolution for its ancestor p when it carries a FAST proof of x. A later resolution of p must certify that same x. It neither rewinds execution nor appends an extra transition after x. An honest observer gossips every newly verified finality proof and serves its complete dependencies. It does this independently of application execution and parent closure.

There is no mode switch, no global signing stop, no checkpoint attestation, and no Heal. After a leaderless fallback z is certified, d_z is the next opportunity. The old domain d_p stays closed forever. Storage compaction must preserve an equivalent permanent exclusion.

Deterministic interpretation

The interpreter keeps a durable transcript cursor and a map first[d_p], initially empty for each parent. It processes each ordered record in four steps:

1. Verify the ordered position and the authenticated record opening. Retrieve certified dependencies. If an earlier required opening is unavailable, return Pending and do not move the cursor past it.
2. Check the configuration, the parent proof, the recursively decreasing positions of Ocean authority, exactly 4f+1 distinct complete statuses, and the complete semantic validity of the selected child. Treat a structurally invalid reference or a complete contradiction as a deterministic no-op.
3. If the parent of the valid record already has an effective first resolution, advance the cursor and leave its child unchanged. Otherwise, durably record this position and the selected child as the first resolution of that parent.
4. Retain the verified preceding transcript and the record evidence that justifies firstness. Publish the resulting finality authority. Install any semantic ancestors that are now complete before the child. Advance the durable cursor.

A later Pending record does not erase certificates produced from an earlier complete prefix. Conversely, a local fast head does not permit the interpreter to skip an old-parent record before it checks it. Application delivery can be idempotent while record interpretation stays complete and ordered.

Why preservation still needs agreement

For f = 1, one five-status set can contain three own PREPAREs for x, two for another child, and no complete four-PREPARE U. Another valid five-status set can show a different unfinished distribution. The protocol does not require these sets to select the same child unless an admissible fast final forces it. Every eligible set must preserve such a final. Ocean chooses among the remaining possibilities. The signed reference tests exercise split-support cases and competing records. They do not assume a common local selection.

Firstness also has an explicit proof cost. A membership proof for record i cannot show that no earlier valid record resolves the same parent.

Paplet, in the ocean

The ocean keeps moving when the tracks are under water. Control rounds advance through empty bodies, unresolved coins, and a stuck fast path.

Ocean accepts authenticated control vertices, supplies complete source cuts to child construction, and orders recovery advertisements. Its output is a control transcript. Application authority comes only from the parent-resolution interpreter. This split prevents a generic anchor from writing application successors on its own.

Strong edges connect a vertex to the previous round. The wave arguments use them. Weak edges bring older accepted vertices into complete emitted cones. They do not replace the strong-parent quorum. A vertex is accepted only with its entire certified strong-and-weak parent closure. Complete cuts advance even when their transaction contributions are empty.

Uniform reliable broadcast

A slot is the triple (configuration, round, author). The sender signs its exact payload. An honest validator sends ECHO for at most one authenticated valid payload and READY for at most one digest. It persists both choices before it releases them. Every ECHO holder retains and serves the complete payload.

DAG and coin boundary

The Ocean instance starts with one deterministic round-zero seed vertex per configured author. The agreed configuration binds these seeds. They need no broadcast, and Ocean never emits them as control records. An accepted vertex has:

• Q = 4f+1 or more exact strong parents from the previous round, each from a distinct author,
• optional weak parents from earlier rounds, and
• complete parent closure.

The accepted slot is globally unique. Honest authors produce a vertex when enough parents arrive, with an empty control body if necessary. Unresolved coins do not block later control rounds. Transaction execution does not block them either.

W is the wave length in rounds. The first round of a wave is its candidate round. Before an honest author produces a coin share, it durably seals Q accepted final-round endpoints and their complete ancestry.

The coin domain binds the configuration, the Ocean genesis instance, and the wave. Different shares can have different seals. The seal digest is not part of the common signed coin message. The seal is the local durable prerequisite for signing that message.

Backward commitment and closed-cone emission

A reader keeps the last closed wave and an ordered anchor sequence. To close a later wave that has direct support, the reader does five things:

1. Recover every earlier unresolved coin through that wave.
2. Set current to the elected candidate of that wave.
3. Scan waves backward to the last closed wave. Select an earlier elected vertex if and only if it is in the complete strong cone of current. Each selected vertex becomes the new current.
4. Emit the selected chain in forward order. For each anchor, emit its complete strong-and-weak cone minus the IDs already emitted, sorted by (round, author, digest).
5. Persist the whole state update atomically.

Missing evidence is Pending. Absence becomes an exclusion only inside the specified complete strong cone.

The bound (8.4) is tightest at f = 1. Because f/n = f/(5f+1) < 1/5 for every f, the right column bounds every committee size.

A shorter four-round wave under the total-f budget also has a counting argument. Any Q third-round vertices have at least Q² strong edges into at most n second-round vertices. If each second-round vertex had at most f supporters, there would be at most n·f such edges. But

So, by pigeonhole, some second-round vertex has more than f supporters. A fourth-round parent quorum misses at most n − Q = f third-round vertices, so every such quorum intersects that supporter set.

From ordered cones to recovery service

Inside an emitted vertex, the configured canonical body encoding fixes the order of its advertised records. Three things together define the record transcript that the first-resolution interpreter reads: the anchor order, deterministic cone emission, and body order. Readers retain the authenticated ordering evidence and the complete openings that interpretation needs. A firstness proof also verifies the interpretation of the earlier records. An accepted-slot proof is not enough, and inclusion under one anchor is not enough. These are the concrete dependencies of Assumption 2.

Why nothing forks

Two lemmas about one parent, one induction over all of them, zero forks.

The safety argument composes the data and evidence contracts with the two finality routes. It depends on four facts: the certified-data-paths lemma, complete child validity, durable per-parent signing, and the authenticated common Ocean transcript. Two lemmas cover one parent. Induction connects all parents.

Proof dependencies and what they rule out

Each row is necessary even when the adjacent component is correct in isolation.

A scoped necessity result for receipts

The honest-intersection inequality has a matching indistinguishability witness. Fix one certified predecessor p, prepare threshold 3f+1, and 4f+1 complete retired statuses. A one-shot status-only selector must choose a successor from those statuses, with no further old-side exchange.

Lower the FIN threshold from 2f+1 to 2f. Then two executions with incompatible hidden finals can produce identical complete recovery evidence. The witness partitions the committee into Byzantine B, honest A and C, honest D, and honest T:

A Byzantine leader signs two valid successors x and y. A prepares x, C prepares y, and D prepares neither. T prepares x in execution E_x and y in execution E_y. All cross-group messages are delayed past recovery.

The status bytes are identical in E_x and E_y, but the hidden weakened finals conflict. So no selector that sees only the status bytes can choose safely in both executions.

With 2f+1 receipts, at least f+1 honest holders exist. Only f identities lie outside the status set, so an honest holder inside it exposes the U. Actual-signature witnesses at f = 1 to 4 accompany the construction in spec/v4/test_transfer_bound.py. This result concerns one interface. It is not a lower bound on rounds, bytes, or storage.

The fast-path bound, honestly

Two delays when the river runs clear. Six when the data is fresh off the boat. A few coin-elected waves when the weather turns. Here is the bill, itemized.

Every certified child strictly increases its source-cut round and includes the entire cut contribution. So unbounded certified progress eventually includes every continually advertised certified block. This holds even when some earlier fallbacks had empty deltas.

Good-case fast service

4f+1 multicast PREPAREs ratify a fully evidenced proposal from an honest leader within 2δ under three conditions:

• its first leg delivers the complete prerequisites,
• one-way delay is at most δ, and
• honest signers stay open for that proposal.

Consecutive eligible honest leaders can overlap accepted-cut production. After warmup, this sustains 2δ decision intervals. The condition is that each turn has a fresh, strictly later cut and complete evidence ready within its first-leg service bound. Fresh data can still need six delays from dissemination:

The redesign removes the recovery ownership stages. It does not remove these fresh-data dependencies.

One-resolution service bound

Measure time from the first honest admission of p. For a failed opportunity, define four service terms:

With supplied bounds on these services, the recovery time R_p satisfies

The bound has one new Ocean selection stage. The era baseline instead orders a barrier, a checkpoint intent, and a Heal. It also waits for executed checkpoint attestations and readmission. Those stages are absent from this algorithm. The bound omits them because they do not occur, not because their cost is assumed to be zero.

Suppose B distinct parent domains have stalled child opportunities that invoke recovery. Then recovery needs at most B effective first-resolution records and B immediate recovered children. These closures revoke no signing rights in other certified-parent domains. One faulty identity can cause unboundedly many failed opportunities, so f does not bound B.

For native Ocean, Q = 4f+1 and W = ⌈log₂ Q⌉ + 2. Suppose an external service envelope gives four bounds:

• A for catchup and advertisement,
• d accepted rounds for ancestry inclusion,
• ρ for each complete round, and
• K for the required coins and interpretation.

A conservative budget for m fresh waves is then

A union bound over B failed opportunities gives at most B·(f/n)^m, plus service-envelope and computational-coin errors. Eventual delivery alone gives no wall-clock values for these parameters.

Message, verification, and retention costs

Here n is the committee size and σ is the size of one signature.

Six timestamps are distinct: client submission, DA certificate, accepted cut, learned FAST or FIN, Ocean resolution, and executed transaction. A count of empty certified children proves neither positive transaction goodput nor bounded client latency.

In the workshop

Restoring a signer means restoring its promises. Forgetting a published vote is how forks start.

The repository contains several protocol generations. The parent-local source baseline is commit 2812f22.

Signed parent-local kernel

Ocean-model adapter

Native components (Rust)

Crash recovery as a protocol obligation

Restoring a signer means restoring its promises. Each component must retain its part:

The native Unix SnapshotStore acknowledges success only after four steps. It stages an identity-bound, checksummed snapshot, syncs the temporary file, renames it atomically, and syncs the containing directory. It holds an advisory lock for its lifetime and halts on an ambiguous I/O failure. Restore validates the installed snapshot. It does not treat an unfinished temporary file as a checkpoint. A checksum and a generation number in the same replaceable directory do not detect malicious rollback.

Before durable acknowledgement, no output that depends only on the staged state may escape. After acknowledgement, a restart must recover that state or a later one, even if its output was never sent. Keeping an unused vote reservation is safe. Forgetting a published choice is not safe. A parent-local integration must apply this rule to one coherent validator state. It must not combine individually correct stores whose checkpoints can disagree.

The blockchain-facing contract

A blockchain adapter supplies a trusted configuration and genesis, deterministic validity rules, transaction-data admission, and application execution. Consensus returns exact certified children with ordered block deltas and their verifiable parent chain. This gives a linear interface, although the control structure is a DAG. A consumer never picks its own order from the latest visible DAG or from the local arrival order of proofs.

No interface event implies that a later event is complete. A semantic child height counts transitions. An application delivery position can count blocks or transactions inside their deltas.

An empty child advances the height without creating application work. Under the baseline retention contract, a late observer can replay a complete certified history from genesis. An optimized state-sync checkpoint must bind the semantic identity, frontier, log commitment, application cursor, and retained proof obligations. It must also have an independently justified trust rule. Importing an executed state snapshot does not permit the signer to forget its closed old domains.

Claim-to-artifact ledger

Trying to sink it

We weakened the rules on purpose and watched the boat take on water. Then we put the rules back and checked that it floats.

The evaluation asks two questions. Do the implemented reference transitions respect the interfaces that the proofs use? What do the separate dissemination experiments show about transport cost?

Parent-local kernel and ordering adapter

The combined signed kernel and adapter suite has 32 tests: 21 kernel tests and 11 Ocean-adapter tests. The September 8 record reports 7.293 s. The September 10 validation reran the suite in 7.107 s with Python 3.12.3 and cryptography 41.0.7. The tests include:

• 28,591 finite quorum-intersection checks at f = 1, 2,
• actual signed late FAST and FIN assembly,
• proof aliases and competing resolutions, and
• permanent closure and interrupted journal updates.

Falsifying schedules and regression oracles

The ordered-log oracle must compare the exact semantic child identity and the ordered delta at each position. Comparing only the latest height or the selected anchor is not enough. A later matching suffix cannot repair a conflicting prefix that is already published append-only. This requirement comes from a recorded failure in the earlier full-system evaluation. Agreement on anchors held, but a lagging observer emitted them in a different order.

Separate transport evidence

The local transport experiment compares direct dissemination with a coded one-relay construction. The coded path uses Reed–Solomon coding, a signed Merkle commitment, authenticated fragments, and k = n − f. Both paths keep complete native DA custody. The setup has six validators, one producer, equal-weight identities, and a fixed relay assignment.

At 64 KiB, producer upload falls 59.7% and total traffic rises 20.8%:

At eleven validators and 64 KiB, producer bytes fall 77.5% and aggregate bytes rise 23.7%. In the sequential local TCP harness, the median whole-experiment time rises from 63.96 to 94.38 ms with memory-acknowledged snapshots. With atomic fsync snapshots, it rises from 106.38 to 135.30 ms. The deterministic link model favors coding when serialization dominates. Coding loses for small payloads on fast links because of the extra hop. The endpoint of these measurements is a DA certificate, not finality.

Separate signed extension model

The model explored 5,554 bounded worlds and ran 1,112,888 fast/recovery prefix checks. It found no guarded-prefix violation. Naive lane merging produced incompatible order in 388 worlds. Complete statuses still permitted competing unfinished recovery continuations in 2,430 worlds. These are counterexamples to deliberately weakened interfaces. They are not attacks on published protocols.

Alibaug se aaya kya?

Walk into a review with a novelty claim and the first question back is: Alibaug se aaya kya? So this section is mostly about what the paper does not claim.

The comparison this revision establishes

The concrete structural comparison is with the archived era baseline. That baseline used an ordered barrier, a checkpoint intent, executed checkpoint attestations, and Heal with readmission. The parent-local construction replaces those ownership stages with one effective resolution for one exact parent. It preserves a child that is already certified and adds no new recovery tail. The comparison shows which stages the algorithm removes.

From two readers to exact parent domains

The earlier papers in this line read a control DAG in a weather-dependent way. River handled favorable conditions, Monsoon derived a boundary collectively, Ocean gave asynchronous commitment, and Heal handled re-entry. Their visibility-gap and re-entry arguments explain one point: the absence of a known fast result does not authorize an independent recovery result.

The era-based v4 manuscript added complete-artifact receipts, native broadcast and Ocean, and an explicit barrier–intent–Heal ownership sequence. The current design keeps producer-chain availability, River prepare/receipt protection, native Ocean ordering, and deterministic semantic transitions. It replaces global era ownership with one permanently closable domain per certified parent.

A stronger consistency oracle exposed a failure in the earlier eleven-validator, five-region deployment. A lagging observer emitted the same agreed anchors in a different order, and append-only publication made the error persistent. The lesson carried forward is to vary both graph contents and arrival order, use distinct payloads, and compare exact output at each position.

Shana mat ban. Let the lemmas do the talking.

Run it yourself

Do not trust the fish. Run the tests.

Reproduce the current reference checks

# signed kernel + Ocean adapter (32 tests)
python3 -m unittest spec.experiments.test_parent_local spec.experiments.test_parent_local_ocean -v

# the four signed CLI schedules
python3 -m spec.experiments.parent_local --f 1 --heights 18 --schedule round-robin
python3 -m spec.experiments.parent_local --f 2 --heights 22 --schedule round-robin
python3 -m spec.experiments.parent_local --f 1 --heights 12 --schedule all-silent
python3 -m spec.experiments.parent_local --f 2 --heights 12 --schedule all-silent

# executable v4 models (75 tests). Under Python 3.15 pass -t as well:
python3 -m unittest discover -s spec/v4 -t spec/v4 -q

# native component suites (pinned Commonware checkout required; see COMMONWARE_PIN.txt)
cargo test --locked --manifest-path rohu-paplet/Cargo.toml \
  --test native_rbc_v4 --test native_ocean_v4 --test native_weather_v4 --test native_river_v4 \
  --test native_frontier_v4 --test native_weather_cycles_v4 --test native_objects_v4 --test native_latency_v4

# transport + extension experiments
python3 bench/local_composition_lab.py --include-loopback --include-fsync --repeats 3
python3 -m unittest spec.experiments.test_extension_transfer -v

# manuscript
cd paper4 && latexmk -pdf -interaction=nonstopmode -halt-on-error main.tex

For each replication, retain the command, exit status, environment, source and binary fingerprints, raw outputs, workload, and unresolved requests. For a negative schedule, record the mutated rule and the resulting conflicting proofs.