EmPoWering: onto the pooling substrate (lips PR 375), with the gate suites mutation-tested and the reports rewritten for a lay reader - #9
Open
madxor wants to merge 23 commits into
Conversation
… substrate (lips PR 375) logos-lips PR 375 replaces burning/minting with a pending rewards pool, a finite genesis reserve (B_0 = 1e9 LGO), a windowed recycled term, and S_cap anchoring, with a conservation identity across the three stocks. Planned against PR head 2b3b698 (thomaslavaur approved, one review pending, Verified checklist open). The verdict, measured before planning: NO headline number in the de-novo reports moves. A_t saturates at 1 over every horizon we run, so the one term whose mechanics change never engages at a magnitude that matters; S_tge -> S_cap is numerically identity; the fee formulas are untouched, so every closed form stands; the reserve outlives our longest run by years. What the plan is actually about: * ONE COLLISION. The RFC states fees are routed "in full" into the pool and its R_block decomposition has no PoW term; our POW_SHARE diversion intercepts 10%. As specified, both cannot be true. Two resolutions drafted (pre-pool carve-out vs distribution from the pool), recommendation recorded, decision the design owner's. * ONE OPPORTUNITY. EmPoWering is already an instance of the RFC's own pattern -- the endowment is a genesis-minted sub-reserve (the RFC's author introduced reserve sub-pools himself, in review), the sub-pool schedule is a metered release, Q7's tail is "lasts Y years at max rate, longer when slower", the dust fold is the depleted-reserve fallback, and our conservation gate is their conservation identity. MAPPING gets reframed around that table; "orthogonal to the pool redesign" is false as of this RFC. * Code: windowed recycled term (noting the PR's own flagged integer/real divergence), pool and reserve stocks with the RFC's implementation checklist taken wholesale as a gate menu, terminology, diverted re-derived against the R_block decomposition, blend-pool constant re-measured and gated. * Upstream (each needs an explicit go): answer the PR's open P_t >= 0 boundary question with our dust-fold machinery; raise the collision; quantify the leader-incentive concern from review if wanted. Nothing in the plan moves a published number; anything that does move one is a finding, not a revision, and stops the line. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…he carve-out decided Executes the PR-375 revision plan (sections 3-4), with the collision resolved by the design owner (2026-08-24): fees enter the pending rewards pool IN FULL, the RFC's sentences stay true, and the EmPoWering POW_SHARE is the pool's FIRST OUTFLOW -- a carve-out from the pooled reward flow, not an interception ahead of it. Recorded with its accounting consequences as contradiction 4.13. The reward rule's window carries the pool's distributable inflow (fees net of the carve-out -- the same value the pre-pooling code computed), which is also what keeps the pool non-negative at A_t = 0, where distributing against gross inflow would drain it by exactly the PoW share per block. emission.py implements the RFC: * The recycled term is the WINDOWED average of pooled fees (T = 120), per PR 375's real-valued rule. The PR's own integer section still computes the single-block form and is flagged "Rederivation required", so that form stays callable as block_reward_lgo_single_block and the divergence is pinned by a parity gate (a lone 12-LGO block: 0.1 windowed against 12 single-block) -- contradiction 4.12. The window boundary the spec leaves unstated is decided and gated: pre-genesis entries are zero, a short history divides by the full T. * The pool and reserve are explicit stocks (B_0 = I_max * S_cap * Y = 1e9 LGO) with the conservation identity accumulated and gated to zero over a random path, the depletion fallback pinned to the measured sequence, and the RFC's one open question (P_t >= 0 in the early-life regime) MEASURED rather than discussed: a fee spike then silence at A_t = 0 drives the unguarded balance negative, and the guarded form -- pay what the pool holds, the de-novo room cap's move -- floors it at zero and still conserves. * Vocabulary: pooled/distributed/released throughout both simulators' code and docstrings; identifiers renamed where they lied (price_for_block_burn -> price_for_block_pool, burnt_window -> pooled_window, minted -> released). No figure moves, and that is now pinned rather than asserted: the settled blend pool is gated at its source (1,235,274 LGO/epoch, the default strategy run's median) so the emission machinery cannot drift under retirement.py silently, and the flat-window gate records why the windowed rule is invisible here. 205 gates pass on the empowering suite (up from 196), 65 on the de-novo suite, 150/150 golden values, web exports byte-identical. Docs: MODEL.md frames the endowment as a genesis-minted sub-reserve and fee_bucket as the PoW-share view of a draw against the pending rewards pool; MAPPING.md replaces the "orthogonal to the pool redesign" row -- false as of the RFC -- with the term-for-term pattern table and the carve-out row; PLAN.md records the decision; CONTRADICTIONS.md gains 4.12 and 4.13 (and notes PR 375 dissolves 4.9's anchor question while leaving its min_stake consequence standing); the report and SUMMARY carry one provenance paragraph each. The remaining upstream ask is one sentence in the RFC acknowledging the carve-out as a pool outflow. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…d claim everywhere The question "are we in sync with PR 375?" had a measured answer for the two simulator suites and an unmeasured one for everything else. Closed: * simulations/EmPoWering (the tokenomics model's own codebase) has a drift gate, spec_sync, whose whole point is that sync is checked rather than promised. Run against clean remote trees it told the truth precisely: its baseline (the EmPoWering RFC branch, PR 400) passes 42/42, and overlaying PR 375's block-rewards.md broke exactly ONE check -- the S_tge parametrization row the PR rewords to the hard cap. The gate now accepts both forms (numerically identical at 10^10) and, on a PR-375 tree, additionally pins the new reserve lifetime Y = 10. Both trees pass: 42/42 baseline, 43/43 combined. Whichever PR merges first, drift lands as a gate failure, not stale prose. (The local logos-lips checkout sits on a Blend docs branch, which is why checking against it misleads; the trees were fetched from the remote.) * tokenomics-model.md gains addendum 0.5, its own convention for decisions that move beneath it: the one-line translation (read "burnt" as "routed to the pending rewards pool" -- removed from circulation, not existence), which arguments survive and why (3.4 and 4.4.2 re-founded on circulating supply; every ratio argument untouched since both sides ride the same fee flow), the 4.13 carve-out decision, the PR's windowed-term change being out of the document's regime, and the note that its master line-citations are the record of what it was derived against. Not a rewrite -- the document cites master verbatim and carries its own correction history, which a sweep would destroy. * strategies-report.md: eleven substrate descriptions reworded in place (release/distribute/pool for mint/burn), with the PR-375 provenance and the carve-out stated once where the pool refill is introduced. * REWARD-MODEL.md: a substrate note atop the extraction -- it records the burn/mint tree it read, and the differences live in emission.py under contradictions 4.12/4.13. * The inscription affordability figure regenerated with the pooled-fees axis label its code now carries. * The tokenomics web target had the same silent-degrade bug the de-novo calculator shipped with -- worse: `node selfcheck || echo skipped` swallowed real drift AND real failures alike, exiting zero for both. It now fails hard; 220/220 golden values agree. Not swept, deliberately: the survey's "electricity a computation burns" and the de-novo documents' own PR-375 text, which describe physics and the RFC respectively, not the substrate. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…tation that was not there
Five findings from reviewing the PR-375 substrate work, all applied.
THE CONSERVATION GATE COULD NOT FAIL. Stocks tracked only the pool and the
reserve and accumulated the three deltas into a residual -- but the deltas cancel
symbolically, so the residual reduced to `reward - (distribution + release)`,
defined as zero one line above. Demonstrated: a state that violates the RFC's own
P_t >= 0 (pool at -119 LGO) reported a residual of exactly 0.00e+00, while the
gate's note claimed to be running "the RFC's central claim". The RFC's claim is
about S + P + B, and circulating supply was never a stock. It is one now: each
stock moves by its own flow and the total is compared against genesis, so the
check can fail -- and a companion gate PROVES it does, leaking one token a block
and catching +5.0 LGO. Tolerance is relative (1e-12 of genesis), because the
honest path drifts 1.3e-15 on a 10^9 total and an absolute threshold failed on
float noise -- itself evidence the check now has resolution the old one lacked.
A CITATION THAT WAS NOT THERE. MODEL.md said the endowment is a sub-reserve "in
exactly the RFC's sense -- its author models the reserve with sub-pools", and
MAPPING.md said "the RFC models reserve sub-pools explicitly". Neither is true:
PR 375's text has 31 mentions of "reserve" and ZERO of "sub-pool" in any
spelling. The term exists only in the review thread, and there as a reviewer's
objection ("Why do we need sub pools in the reserve? it's a bit poping without
explanation"), with the author replying it is conceptual and up to implementers.
The structural analogy stands on the structure; it is now labelled as our term
rather than propped up by a citation to a document that does not say it. PLAN.md
records what the planning draft got wrong.
NET-VS-GROSS R_block WAS A DECISION PRESENTED AS FORCED. The RFC defines R_block
as fees routed to the pool -- gross, under "in full" routing plus a carve-out
outflow -- while emission.py feeds the window the net figure. Net is defensible
(it is what is distributable, and what the pre-pooling code measured) but so is
gross (KPI-2 measures the pooling rate). Resolved: net, with the cost now GATED
rather than assumed -- identical at A_t = 1 where every published figure sits,
0.0005% near target, and exactly 1/(1-pow_share) = 11.1% only in the genesis-seed
transient, on three ten-thousandths of a token. Recorded in contradiction 4.13
so the reading can be revisited on evidence rather than rediscovered.
Also: RESERVE_GENESIS_LGO was a literal beside a RESERVE_LIFETIME_YEARS that
nothing read, so the spec_sync pin on Y bound nothing -- it is derived now, from
the release cap times the year times the lifetime, and gated both for its value
(10^9 LGO, a tenth of the cap) and for the RFC's sizing claim (exactly 10 years
at the cap). And the scope of Stocks is stated where it was implied: it is a
fidelity check against the RFC, not a component of published results -- no study
carries the pool and reserve through a run, because the reserve outlives every
horizon they model.
210 gates pass on the empowering suite (up from 205), 65 on the de-novo suite,
and spec_sync still passes both trees: 42/42 baseline, 43/43 with PR 375.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Every document in the set now opens with a reader's guide and every section with a plain-words paragraph that says what it covers and why it matters, in everyday terms, before any arithmetic. Reading only those paragraphs gives the whole argument -- which is the point: the audience for these documents is wider than the people who wrote them, and until now the entry cost was a working knowledge of the mechanism. Per document: * SUMMARY: a "how to read this" with routes for two minutes / ten minutes / no arithmetic at all, the three terms the document actually depends on defined up front, and twelve section intros. Remaining jargon replaced in place -- "elevation is a hump" became what it means, "sybil flood" became "flooded with fake identities", "demand-indexed reward inviting manipulation" became "setting the price from last period's demand invites someone to fake it". * denovo-report: a new opening that states the chicken-and-egg problem the whole mechanism exists to solve, a route table, a map of the argument's shape, a six-term glossary, and twelve section intros. Section 2 gains a three-paragraph intuition -- the fund, the schedule, the crowd -- before any formula. * adversarial-analysis: a guide that says what "attack" means here (nobody breaks cryptography; everyone follows the rules while behaving selfishly), a table naming each attack in a phrase, and fourteen section intros. * design-comparison: a guide pointing readers at its own section 0 as a complete, arithmetic-free account they can stop at, plus seven intros. * MODEL: framed as the exact-rules document with the whole design restated in four sentences for anyone who opened it by mistake, plus twelve intros. * MAPPING: a guide explaining why the document exists at all -- the design was derived ignoring the current system, so something has to reconcile them. * strategies-report: a guide that gives away the answer up front so the rest reads as evidence, and twelve intros. * tokenomics-model: a navigation guide for a document whose shape actively misleads -- addenda run newest-first, sections 4.5 and 4.6 sit after section 9, and spec line-references are provenance rather than live links. Now says so, gives a reading order, and points first-time readers elsewhere. Also structural: four sub-sections were marked as top-level headings (design-comparison 4.1, SUMMARY 4.1, MODEL 8.5, MAPPING 4.1), so every outline and table of contents rendered them as peers of the sections they belong to. Nested correctly; no "## N.M" headings remain anywhere in the set. No figure, number or claim changed -- this commit is presentation only. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…t found A gate that catches no mutation of the code it claims to cover is not evidence. This asks that question directly: perturb the thing under test, run the suite, count the gates that notice. THE HARNESS FOUND ITSELF FIRST. Its initial run reported zero of fifteen mutations caught -- because it inferred "green" from the ABSENCE of [FAIL] lines, and `bash -lc` had resolved to a Python without tomllib, so the suite never ran at all. A check that cannot distinguish "passed" from "did not run" is precisely the defect the harness exists to find. It now requires the positive marker. Corrected, it caught 11 of 15 and found four real holes. All four are closed, and each fix was verified by re-running the mutation that escaped: * NET-VS-GROSS FEE WINDOW. The carve-out convention (contradiction 4.13) was spelled out separately in elevation.py and strategies.py and pinned by neither -- feeding the reward window GROSS fees changed no gate in either suite. It now lives in one named function, `emission.pooled_inflow_lgo`, called from both and gated. * EFFICIENCY_PERSISTENT. Moving it 15% -> 25% failed nothing: the reference triple implies 50%, above both, so every satisfiability gate read the same either way. The published 15% -- the number SUMMARY's whole re-strike recommendation is computed against -- was unpinned. Now pinned directly, plus a triple implying exactly 20% that straddles the two ceilings and so can tell them apart where the reference triple cannot. * POOL GUARD DEFAULT. Flipping it off passed the entire suite; the shipped default is now asserted. * KPI-2 FEE COEFFICIENT. A_t saturates at 0 or 1 in every gated run, where the coefficient is invisible. Now exercised with the stake deviation zeroed, so the fee term alone sets A_t. The FIRST attempt at this gate computed its expected value FROM FEE_AVG_NUMERATOR -- the constant under test -- so the mutation moved both sides and it still passed. The re-run caught that; the expected value is a literal now, and 15/15 mutations are caught. 213 gates on the empowering suite, 67 on the de-novo suite, both green. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…rvation property that lied Writing up PR 375's open boundary question so it is not carried in anyone's head turned up a bug in the machinery that answers it. THE BUG. `Stocks.genesis_total_lgo` returned the DEFAULT reserve constant rather than what the instance was actually constructed with, so every non-default instance -- which is every boundary test -- reported a conservation error of minus a billion LGO. The gates had quietly worked around it by writing their own totals by hand (`abs(tiny.total_lgo - 200.0)`), which is why the suite stayed green and the property stayed wrong. Captured at construction now, and both gates use the property instead of hand-written totals, so it is exercised rather than bypassed. Worth naming: the mutation test could not have found this. Mutating a constant tests whether a gate notices a changed value; it says nothing about a property that is wrong for inputs no gate uses. Writing the answer out for an external audience is what surfaced it. THE ANSWER, now in reports/EmPoWering/UPSTREAM-PENDING.md with question, answer, evidence and gate locations, ready to post: * The P_t >= 0 regime is real and NOT confined to early life. The recycled term pays the window's average while the pool only ever received the actual fees, so any fee burst followed by quiet pays out history the pool never banked. It needs only a spike, then quiet, with A_t low -- which is the mature at-target regime the design aims for. Measured: one 120-LGO block then 240 quiet ones drives the unguarded balance to -119.00 LGO. * The treatment is one line -- clip the distribution to what the pool holds. P_t >= 0 then holds by construction, conservation is untouched (the clip defers a payment rather than destroying it), and it is self-clearing: the guard binds for 119 blocks, one short of the window, then releases as the spike rolls out. * The point for the reviewers: CONSERVATION AND P_t >= 0 ARE INDEPENDENT. The unguarded run conserves perfectly while sitting at -119 LGO, a state the spec forbids. Anyone checking the conservation algebra and concluding the pool is safe has checked the wrong thing -- and the conservation argument is exactly what PR 375 asks reviewers to scrutinise. The file also carries the POW_SHARE carve-out acknowledgement (contradiction 4.13) and records the leader-incentive concern as noticed-but-unanswered. Nothing has been sent; posting is outward-facing and waits for an explicit go. PLAN.md section 5 and CONTRADICTIONS 4.13 now point at it. 213 gates on the empowering suite, 67 on the de-novo suite, both green. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
… carried number is computed The report set already read plainly; what criterion five exposed was thinner: three of the documents carrying headline claims had no figures at all, two findings had no plot anywhere, and one number confessed in its own export note to being "carried from the strategy study; not reproducible from committed code and not gated". THE CONFESSION, RESOLVED. The current design's "point of no return" -- the epoch the waiting queue passes every bond the remaining pool could ever fund -- was the literal 212. Computed from the elevation run (queue > remaining_pool/min_stake), it is 214 under persistence -- the carried figure was its neighbour -- and 338 under retirement, which had never been stated: the same regime-lean the closing door had, quoted at the persistent end with no label. Now computed in webexport.current_design() for both regimes, regime-aware on the comparison page, pinned by a gate, and corrected in SUMMARY and design-comparison. TWO FINDINGS GET THEIR FIRST PLOTS (plots.py, house style): * retirement_price.png -- the token price decides who retires: bonds flat at 7,963 above $0.20 and rising to 22,054 at a cent, beside how long incumbents keep mining. The x-axis runs dearer-to-cheaper so reading rightward means the token cheapening. The strongest finding in the study, previously table-only. * flood_denial.png -- the fake-identity flood, all three designs, every bar from a run in the figure's own code: the current-design bars (48/89/96%) are computed live from elevation, so those three numbers stop being transcriptions. THE BOUNDARY ANSWER GETS ITS VISUAL. pool_boundary.png (new plots_emission.py): the unguarded pending-rewards pool sliding to -119 LGO over exactly the look-back window while the guarded one floors at zero -- the picture for UPSTREAM-PENDING section 1, embedded there with its regeneration command. EMBEDS. adversarial-analysis gains three figures (price curve in 2.3, the whale/cliff panel in 3.3, the flood in 4), SUMMARY two (flood in 3.4, price in 3.5), design-comparison one (arrival shapes in 2). PLAN.md gains the reader guide it was the last document without, and loses two more survivors of the spikes-shorten-the-phase reading (sections 1.5 and the validation checklist, contradicting section 1.2 four paragraphs above). EMA and Pareto are glossed at first use in the report. Both suites green -- 214 gates on the strategy simulator (the point-of-no-return pin is new), 67 on the de-novo one -- and 150/150 golden values agree. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Brings in the consolidated layout -- all three simulators under tools/simulators/empowering/, powcost beside the benchmark it reads, reports lowercased -- along with the de-novo study and the arrivals work in the strategies report. Git relocated five files this branch had added into directories the base had renamed, and they landed correctly: UPSTREAM-PENDING.md, three figures, and plots_emission.py into strategies/. Two content conflicts in the strategies report, both the same shape -- this branch's plain-words gloss against the base's corrected text -- and both resolved by keeping each: - Section 6 keeps the gloss, and takes the base's framing. "Dynamic arrivals" had to go: section 7 now owns arrivals as a process, and section 6's are a budget. - Section 13 keeps the gloss, and takes "release" from here and section 10 from there. That second one was not only a conflict. Section 7 shifted every section after it by one, and this branch's reader-map table was written before it existed: it sent readers to section 8 for electricity, 9 for the full horizon and 12 for the caveats, all off by one. Corrected, and the row about how long getting in takes now points at section 7 as well, which is where that answer moved. Paths this branch cited from the old layout are updated too, including plots_emission.py's --out default, which gained a level when the file moved into strategies/. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
… gate green again `make notation` fails on this branch and failed before the merge too -- the same five breaks -- so the lips PR 375 paragraphs went in without the gate ever having been run over them. Section 1.0 promises that code spans carry self-describing names and equations carry symbols, and that the two never mix. These five spans carried PR 375's own symbols, which is worse than untidy: `T = 120` reads as this report's T, and this report's T is target_claims_per_block, not a 120-block averaging window. Same for B_0, I_max, Y, S_tge and the three deltas -- all upstream notation this document never declares. Rewritten as prose, which also suits the plain-words rewrite this branch is doing. `S_cap` stays: the gate traces it, so it is a name here rather than a borrowed symbol. No number, claim or citation changes -- report-numbers still matches all 72, and every figure in the branch regenerates byte-identically. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…re, and a branch name in a report Three defects found by reviewing the branch rather than by any gate. A zero-byte `.!74017!adversary.parquet` under reports/blend/. I swept it in with `git add -A` while consolidating the simulator directories; it is a filesystem artefact, it is not on master, and nothing reads it. Removed. `MODEL §8.3` is cited twice -- from the de-novo report and from SUMMARY.md -- and resolved nowhere: section 8's four analysis obligations were a bare numbered list while 8.5 beside them was a real heading. The obligations are now 8.1 to 8.4, so the citations land and the numbering is uniform. design-comparison.md located the strategy report "on the `EmPoWering-simulator` branch". Branches are transient and that one has since merged; a reader a month from now has nothing to open. Replaced with the report's path and both simulators'. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
REVIEW-*.md under reports/ are working records, not part of the report set, and are not meant to be committed. `git add -A` in the previous commit swept this one in. Untracked here rather than by rewriting the pushed commit; the file stays on disk. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…give the set a front door
Two gaps the review turned up, both about the distance between a number and the
run behind it.
**The reports were not gated, only duplicated.** The tokenomics report has had
report_numbers.py for a while: it reads the document and checks every quoted
number against the model. The strategies and de-novo reports had nothing of the
kind -- their headline tables were pinned as literals inside validate.py, which
is a second copy of the number rather than a check on the first. Editing a table
failed nothing. They happened to agree; nothing made them.
Now they are checked. report_check.py carries the engine -- a claim is a section,
a pattern locating the number inside it, and the model expression that must
produce it -- and lives in empowering_sim because the de-novo simulator already
imports that package, so one implementation serves both rather than two that
drift apart. A pattern matching zero times, or more than once, fails: silently
losing coverage to a reworded sentence is the failure mode this exists to stop.
strategies: 23 numbers -- section 3's five medians and their ratios, section
6's two elevation regimes and the pool's clock, section 7's
arrival table, section 11's fee multiple
de novo: 11 numbers -- the reference run, and the same figures again where
sections 4 and 10 restate them, so an edit to one and not the
other fails
Both were tested by perturbing a number and confirming the gate catches it.
Writing them found two things. Section 7 carries three tables with a "50" row,
so a pattern anchored on the rate alone asserts against whichever came first --
each is now anchored to the absorption table's own shape. And the de-novo
report's 7,963 is the run where each miner re-decides and keeps mining, not
`retire_on_bond=False`, which is a third experiment landing near 5,600. The
docstring says so, because the wrong one looks right.
**The set had no front door.** reports/blend and reports/tsi each carry a
README; reports/empowering, the largest of the three, carried none -- eight
documents across three subdirectories and no way in. Added in the same shape:
scope and units, where to start by how long you have, the headline, the contents,
and how to re-run any number in it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…nd one flag came off without its fix lips PR 375 merged to master on 2026-08-26 at 6aaa6db, past the 2b3b698 head this workstream pinned. Synchronized, in three parts. THE DRIFT GATE DID ITS JOB, THEN GOT WIDER. spec_sync failed five checks against merged master -- exactly as designed -- all from pre-merge formatting cleanups that moved no value: the reference constants wrapped in int64(...), STAKE_TARGET rewritten from int(3e9) to int64(3_000_000_000), and the Y row's maths backticked. Patterns widened with alternations and the fragile string comparison of the stake target replaced by a numeric one (a formatting change that moves no value is drift the gate should survive, not report). 43/43 against merged master with the EmPoWering RFC overlaid, and still 43/43 against a pre-merge RFC checkout, which is what a PR-400 branch checkout remains until rebased. ONE MERGE-DAY FACT IS A FINDING, NOT A FORMATTING CHANGE. The 2026-08-25 commit "removing 'rederivation required'" deleted the integer section's honest callout, rewrote the block around int64, renamed the window to pooled_fees_window -- and left last_pooled_fee in the recycled term. Verified against merged master: the real-valued rule distributes the windowed average while the consensus-level integer reference still distributes the latest block's fee, and the flag that admitted the divergence is gone. Contradiction 4.12 rewritten around this; UPSTREAM-PENDING gains section 3 (measured: 0.1 LGO windowed against 12 single-block for a lone spike -- the parity gate's own pin), with the ask stated both ways: apply the prescribed rederivation, or restore the callout, because a known divergence with a warning is a defect and the same divergence unflagged is a trap. THE PRE-MERGE WORLD SWEPT OUT OF ELEVEN SITES. emission.py's header and the single-block form's docstring, the parity gate's note, CONTRADICTIONS 4.12 and 4.13, REWARD-MODEL's substrate note, tokenomics-model 0.5 (which now records that the "drift lands as a gate failure" promise was kept, with the five failures as the evidence), PLAN's revision header (outcome recorded against the plan), spec_sync's own comments, and UPSTREAM-PENDING retargeted entirely: items 1 and 2 verified unchanged by the merge (the P_t >= 0 constraint still bare, "in full" still unqualified at storage-markets line 99) and now aimed at follow-ups against master rather than PR review. Plus one stale pre-reorg path and the Makefile's "five figures" comment, which had been seven for a week. All green after: strategies suite and its 23-number report gate, de-novo suite and its 11-number report gate, tokenomics verify, and the drift gate on both combined trees. Findings F1-F4 from the simulator review remain open and are untouched here -- this commit is the synchronization only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…number, the gentler attacker, the absorbing zero, the two-regime field F1 -- THE HUMP WAS THE THIRD CARRIED NUMBER IN THE SAME DISGUISE. The adoption triple 951/~6,100/5,001 reproduced from no committed code at any horizon. Measured at the study's 400-epoch window it is 707/5,682/4,646 under persistence and 800/25,934/14,398 under retirement -- and the carried triple is recognisably the PERSISTENT row quoted regime-free, exactly as the closing door and the point of no return had been. Both rows now computed in webexport.current_design beside their siblings, pinned by two gates, and quoted with their regime and their horizon in SUMMARY 3.2 and design-comparison 2. The ratio sentence was wrong too: the worst rate onboards an eighth of the best under persistence and a thirty-second under retirement, not "a sixth". F2 -- THE PUMP TABLE QUOTED THE GENTLEST ATTACKER. The modelled pump withheld the opening epoch, forfeiting the 11.87-LGO bonanza that withholding cannot inflate. pump_vs_honest now plays the strongest simple pattern -- harvest the opening, then alternate -- and every published number moved: 0.64/0.73/0.96 at 10/25/50% against the old 0.44/0.54/0.80, decaying to 1.02x at the phase. The conclusion survives at every share and every horizon, but the defence margin at the 50% boundary is 4%, not 20% -- five times thinner than published. Table, balances, horizon rows and SUMMARY updated; the weak-pattern robustness sweeps retained and labelled as such; gates re-pin themselves from measurement and one hardcoded note corrected. F3 -- THE RETARGET'S ABSORBING ZERO, PINNED INSTEAD OF PATCHED. The spec's integer form clamps above but not below: target 1 under a full block returns 0, and 0 maps to 0 under any load, forever -- no claim can land at win probability zero, and no claim landing keeps it there. The simulator mirrors the spec faithfully rather than flooring at 1 and silently diverging; a gate demonstrates the absorbing state, and UPSTREAM-PENDING gains section 4 (a one-character fix, max(1, .), aimed at PR 400 review where the retarget lives). F4 -- MODEL.md's saturation_block definition now states both regimes' events: bootstrap records the block spend first EXCEEDED the budget (the borrow begins), post records the block one more reward WOULD exceed it (admission stops; spend never exceeds). The old single-regime definition made the post-phase figures the report leans on undefined by the model's own words. All green: strategies suite (hump and absorbing-zero gates new) and its 23-number report gate, de-novo suite and its 11-number gate, 150/150 golden values. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ys so On the design owner's go, the three prepared items went upstream under their own account -- which is also one of PR 375's reviewers, so they land under exactly the right identity: * logos-lips issue #432 -- the P_t >= 0 boundary: stated in the merged spec with nothing delivering it; the regime measured (-119 LGO after a spike-then-quiet, conserving perfectly the whole time), the one-line treatment, and the point that conservation and the pool constraint are independent claims. * logos-lips issue #433 -- the integer reference still computes the single-block recycled term after the "Rederivation required" callout was removed without the rederivation; the 0.1-vs-12 LGO divergence, and the ask stated both ways. * PR 400 review comment -- the POW_SHARE carve-out as the pending rewards pool's first named outflow, reconciling this RFC with merged master's "in full" routing in one sentence. UPSTREAM-PENDING marks each SENT with its link; item 4 (the retarget's absorbing zero, drafted this session) and item 5 (leader incentives, machinery ready but unasked) remain drafted-not-sent. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…- reframed to the missing fence Explaining the finding exposed the overstatement: UPSTREAM-PENDING section 4 said the walk to zero needs "~70 consecutive max-load blocks -- sustained, extreme over-demand, but nothing forbids it". Physics forbids it: each of the ~65 steps divides the threshold by ~11.14, so filling the NEXT block at the new threshold demands ~11x more hashrate than the last -- the full walk needs roughly 11^65-fold power escalation. No attacker rides that down from a healthy chain. The defensible claim is different in kind and stronger in consequence: THE MAP HAS A CLIFF WITH NO FENCE. The clamp that guards the top (min(., p - 1)) has no counterpart at the bottom, so any road to a tiny threshold -- a mis-seeded genesis value, a small deployment whose equilibrium sits low, an integer bug writing the target once -- ends in permanent, unrecoverable death of the claim flow. The walk is impossible; the cliff is not. Also measured and added, because it strengthens the same fix: the map is asymmetric at the edge. One full block moves the threshold down /11.14; recovery under silence eases at only x10/9 per block -- 23 quiet blocks to undo one overloaded one, measured with the integer map itself and now pinned by a gate, since the draft quotes both figures. The gate comment carried the same "remote but nothing forbids it" framing and is reframed identically. The draft remains DRAFTED, NOT SENT -- it was written after the posting go and waits for its own. Strategies suite green with the new asymmetry gate. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ger updated Item 4 posted on its own go, in the reframed form: the cliff-with-no-fence claim, the honest reachability (the walk needs ~11^65-fold power escalation and physics forbids it), the measured /11.14-down 23-blocks-up asymmetry, and the one-character ask. UPSTREAM-PENDING marks it SENT with the link; only item 5 (leader incentives) remains drafted-not-sent. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
… own false provenance claims
The sync-audit question ("is everything in sync with the recent change?")
surfaced something better than staleness: the strategies report's section 7 --
arrivals as a process, Poisson over 600 epochs -- lives in this tree
(empowering_sim.arrivals.run_dynamic, merged in from the simulator branch during
the interim reorganisation) and reproduces EXACTLY the numbers this workstream
had branded carried and unreproducible:
rate elevated door no-return
2 951 479 None
100 6,145 34 212
500 5,001 None 72
The hump triple, the door at 34, the point of no return at 212 -- all gated by
the strategies report's own number-gate. The 2026-08-25 review's "not
reproducible from committed code" was checked against constant-arrival
elevation only, never the study's stated Poisson protocol, and at that time the
module lived on the sibling branch; the 2026-08-31 hump fix then hardened the
error into print as "the third carried number found wearing that disguise".
That accusation was the defect. What was true throughout, and remains: the
figures are the PERSISTENT regime's and had been quoted regime-free.
Corrected everywhere the false claim reached: SUMMARY's three bullets (which now
present section 7 as the study of record with the constant-arrival companion
beside it, two protocols both gated, agreeing -- 212 against 214 at the
reference rate is the agreement one wants between independent implementations),
design-comparison's two rows, webexport's hump comment and point-of-no-return
docstring, three gate notes, and compare.js's hump cell (now regime-aware from
the exported fields, citing both protocols). The correction itself is recorded
in SUMMARY rather than silently overwritten.
Also in this pass, the actual sync findings: the regenerated figures are
byte-identical (the pump change touches no figure -- verified by regeneration,
not assertion), and MODEL 4.2 now notes the reused retarget inherits the
spec's absorbing zero (UPSTREAM-PENDING section 4, pinned by the strategy
suite's gates).
All green: strategies suite and 23-number report gate, de-novo suite and
11-number gate, 150/150 golden values.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ing only the endgame The mantle binds every PoW claim to a recent block and expires it after EXPECTED_BLOCKS_PER_WINDOW = 10; our engines clipped offered claims at block space before paying, so whatever the window would have killed never existed in any published figure. window.py now models it exactly: a persistent FIFO inclusion queue fed the UNCLIPPED demand (EpochRow.offered_mu, new), expiry past the window, and the energy tax closed back through the retirement decision (Rational.cost_multiplier, default None -- every previously pinned result is unchanged). Findings, gated six ways in validate and seven in report_numbers: - Free where it matters: the reference run's worst epoch inflates energy by 1.000x with 0.00% expiry, and the x100 spike -- 759 offered a block against 1,024 of space -- clears inside the window losing not one solution. - The tax lives only in the late persistent endgame: at epoch 194 the never-shrinking field offers 1,439 a block, 28.8% of solutions expire, and energy per paid claim inflates x1.41. - It moves no retirement threshold at any tested price: persists-until 195/112/66/16 at $1/$0.10/$0.05/$0.01, identical taxed and untaxed -- congestion and marginal decisions never overlap. - R7b's one hidden fee: 0.135% of a settled post-phase epoch's solutions die between saturation and the window's grace strip. - Grinding resistance quantified: a stockpile is bounded by ten blocks of the attacker's own rate (~1,079 claims for a 10x whale against an epoch capacity of 648,000), which is why the adversary harness's live-rate limit was never an understatement. Also corrects section 4's block-space quote: "fills the cap outright, 958 average" was the gate's shared-draw path quoted as the reading. Across independent draws the x100 epoch runs 730-759 claims a block (peaks 853-863, 83-84% of the cap); what actually pegs the cap is the front-loaded shape, three epochs at 1,024. Both wrong drafts are named in the text, and the report gate now pins the range endpoints. The 8.3 reservation-rule ask stands unchanged. New figure window_tax.png; MAPPING's claim-operation row now points at the price alongside the mechanics.
…target, 3-permutation basis Upstream moved (head 425f4000, ~20 commits): the claim operation now carries a ZkSignature (= Groth16, 128 B) and 590 execution gas; the retarget gained REWARD_TARGET_FLOOR = ceil(F/(P-F)) = 9; a claim may name the current or the previous epoch's nonce; the design rationale moved from the Mantle text into the PR description; block-rewards counts the PoW pool as a fourth conserved stock W_t with R_block stated net of the diverted share; the genesis seed is restated as 5/1000 of S_cap (the same 5e7 LGO); and the Mantle text now prices a mining attempt at three Poseidon2 permutations with the sponge prefix precomputed. Two of those close our own upstream findings. The absorbing zero was fenced with a STRONGER floor than the max(1, .) we proposed -- floors 1..8 are an absorbing band under floor division, which the PR description demonstrates -- and the fence was in flight before our comment, so the ledger records it as independently fixed, not adopted. The carve-out landed as divert-at-source rather than our first-outflow, which is per-block identical; no simulator change was needed. Issues #432 (P_t >= 0 boundary) and #433 (last_pooled_fee) remain open; #433's contradiction survived the PR's own edit of the file. Code adopts all of it: claim 434 B / 1,180 gas (fee 6,664 -> 11,298 lepta at rest), seconds_per_candidate_reward 165.658e-6 -> 68.439e-6 (3 x our measured permutation; the naive measurement stays recorded as the upper bound), the floor in both retarget transcriptions, spec_sync rewritten to 48 green checks (pure value-margins replace the eight prose quotes that moved out of the spec; new pins for the floor line, W_t, the straddle and the signed claim), and an isfinite guard in the tokenomics report gate -- the T = 50 builder edge went infinite when that target fell under water and abs(inf - x) <= inf passed silently. Three stale hardcodes surfaced and died: variant.whale_run's 24,146 board rate (which quietly shrank the whale 2.4-fold), elevation's pi5_rate default, and build_population's. The 3-permutation basis re-derives the de-novo physics, all re-measured across seeds and re-pinned: - The x100 spike epoch now pegs the 1,024-tx cap outright in every draw (1,769-1,837 offered a block); front- and back-loaded fields are rationed by block space (~5,000 of 28,600 retiring, ~2,800 persistent, from complete/76-100% before); MODEL 8.3's reservation rule is non-negotiable. - The acceptance window no longer acquits the spike (44.2% expiry, x1.79 energy) and dominates the late persistent endgame (70.6%, x3.40); the congestion tax now moves the $0.10 retirement threshold 19 epochs -- the old no-threshold-moves result flips at exactly one price. - Block space caps the x100 borrow-forward at ~45 budgets (median, 29-58 across seven seeds; was ~97) and flattens the whale at 21% of the endowment across every size (was 33-56%); the de novo* cap still halves that to 9%. - The decided outcome is 7,635 bonds (was 7,963); the reference retiring run 24,674 (was 24,707); the section-7 Poisson triple 949/6,132/4,997; the fee-funded margins re-derive (reward_over_fee 2.96, break-even 203 tx/block, pow_share band [6.8%, 11.8%]). One design break is pinned rather than fixed, deliberately: the two-transfer anchor (11,158 lepta) no longer clears the claim's own fee (11,298), so R1's self-funding margin is gone at the anchor. The re-strike -- three transfers, or the claim's fee plus one -- is the design owner's decision; a gate, the report and SUMMARY all carry the warning so it cannot ship silently. All three suites, all three report gates, notation, and both web cross-checks are green; every figure set is regenerated from the new basis, and the two legacy tokenomics table columns whose generator predates the denomination are withdrawn rather than rescaled.
…l the throttle target The design owner's decision (2026-09-05) on the break the upstream claim signature forced: the anchor is now the claim's own fee plus one average transfer -- 16,877 lepta at the resting prices -- instead of two transfers (11,158). The old strike's margin over the claim's fee was a coincidence of a fee ratio upstream then moved; the new one writes R1 into the definition, so the surplus is one transaction by construction and no future movement of the claim's fee ratio can reopen it. The violation gate this replaces lived for exactly one commit. The re-strike exposed a rounding seam in the post-phase throttle. Its per-block target was floor(capacity / blocks): invisible while the old anchor made that division exactly 30, but at the new anchor's 19.83 the floored target steered the field to offer less than the budget funds, the epoch chronically under-spent, saturation -- the property R7b exists for -- turned intermittent, and the engine and the adversarial harness drifted out of their gated exact agreement. The target now rounds UP in both transcriptions and in MODEL 4.2, which restores reliable saturation and the harness identity at any anchor. The honest price: the ~1% offer overshoot is re-mined, so the post-phase tail fee rises from 0.137% to a measured 1.05% of a settled epoch's solutions -- gated, and stated in the report beside its cause. Downstream re-derivations, all gated: post-phase capacity is now pow_share * txs_per_epoch / (1 + claim_fee/tx_fee), about 428,400 claims an epoch (~20 a block) -- the two-transfer strike's exact 648,000 and its "half the diverted count" elegance died with it, though fee-LEVEL independence survives; the fee drag at the anchor is 66.9% (was 59.7%); the R7b saturation pin widens from the last half-percent to the last ~1.6%, admission still open for over 98% of every settled epoch. Retirement economics are untouched -- the decision reads the budget, not the anchor. The web calculator's cross-check caught its own stale 2x formula, which is what it is for.
… the space it leaves
The reservation rule (design owner's go, 2026-09-05):
claim_room = max(32, MAX_BLOCK_TXS - ordinary_txs_in_block)
No tuned fraction: ordinary transactions have priority and claims fill only
the space they leave -- 424 a block at the reference 600, floored at 32 so a
full ordinary block cannot starve claims outright. This closes the design's
one declared blocking defect (a x100 spike epoch pegged the whole
1,024-transaction block in every draw) and the model's own inconsistency
beneath it: the fee flow always assumed 600 ordinary transactions per block
while the old clip let claims displace exactly that traffic. Implemented in
the engine, the adversarial harness and the window model's service rate;
gated as `the reservation rule holds: claims never displace ordinary
traffic`.
What the rule costs, measured across seeds and re-pinned: the crunches pay
for their own protection. The x100 borrow-forward truncates at ~19 budgets
(median 18.6x, range 11.8-23.9; 45x under the raw clip, ~97x on the naive
basis), the spike cohort's bond median stretches to 64 epochs (still 100%
bonded), and the loaded arrival shapes stay space-rationed (~5,000 of 28,600
front-loaded). The acceptance window's tax on the backlog is now steep and
lands on the crowd that causes it: the spike loses 76.9% of its solutions at
x4.33 energy, and the persistent endgame runs 87.8% expiry at x8.21.
Two second-order effects worth the headline. The room bounds the well-timed
whale at ~9% of the endowment BY ITSELF, flat across 3x-100x (55% on the
naive basis, 21% under raw block space) -- superseding de novo*'s cap at its
default 10%, which now measurably adds nothing (it still tightens to 5%/2%
at smaller caps, and its residual deferral is one epoch). SUMMARY's
adoption line is annotated for the design owner to re-weigh rather than
silently rewritten. And the congestion tax, closed through the retirement
decision, now moves every threshold above a cent in the helpful direction:
wasted energy pushes incumbents out early, so the taxed persistent field
onboards MORE (at $1, 9,617 bonds against 7,643; at $0.10, 16,844 against
14,181).
Baselines moved a hair (persistent decided 7,635 -> 7,643; the x100 retiring
run rises to 37,811 because rationing spreads its spend across more,
better-priced epochs) and every quote across the five documents, the gates,
the figures and the web goldens moved with them. Suite, report gate and the
JS cross-check are green.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #7 (
EmPoWering-denovo). Two things happened to the de-novo work since that PR: the tokenomic substrate it sits on changed underneath it (logos-lips PR 375), and a hard look at its own evidence found several claims stronger than what backed them. This PR is both, plus a rewrite of the whole report set for readers who do not already know the mechanism.1. Onto the pooling substrate — and one cross-spec collision, decided
lips PR 375 (
block-rewards.md1.1.0) replaces burning/minting with pooling/distributing/releasing: fees route into a pending rewards pool, rewards distribute from it topped up by a metered release from a finite genesis reserve (B₀ = I_max·S_cap·Y = 10⁹ LGO), the recycled term becomes the windowed average overT = 120blocks rather than the latest block's fee,S_tgegives way to the hard capS_cap, and the three stocks conserve.A_tsaturates at 1 over every horizon these studies run, so the one term whose mechanics change never engages at magnitude;S_tge → S_capis numerically identity; both markets' fee formulas are untouched. The settled blend pool comes out at exactly 1,235,274 LGO/epoch, unchanged, and is now pinned by a gate at its source so it cannot drift underretirement.pysilently.R_blockdecomposition has no proof-of-work term, while EmPoWering diverts 10%. As specified, both cannot be true the day both merge. Decided by the design owner 2026-08-24: the pool's routing stands and EmPoWering carves its share out of the pooled flow — the pool's first outflow, not an interception ahead of it. Recorded with its accounting consequences as contradiction 4.13; the one remaining upstream ask is a sentence in the RFC acknowledging the carve-out.MAPPING.md§1.1 is reframed around that; "orthogonal to the pool redesign" was false as of this RFC.emission.pyimplements the RFC's rule and stocks. The PR's own integer section still computes the superseded single-block form and is flagged "Rederivation required" upstream, so that form stays callable and the divergence is pinned by a parity gate (contradiction 4.12) rather than left to be discovered.2. "In sync" made a checked claim, not a promise
The tokenomics model has a drift gate,
spec_sync, whose whole point is that sync is verified. Run against clean trees fetched from the remote, it told the truth precisely: the EmPoWering RFC baseline passes 42/42, and overlaying PR 375'sblock-rewards.mdbroke exactly one check — theS_tgeparametrization row. The gate now accepts both wordings and additionally pins the new reserve lifetimeY = 10on a PR-375 tree. Both trees pass: 42/42 and 43/43. Whichever RFC merges first, drift lands as a gate failure rather than stale prose.3. The review, and what it found in our own evidence
Reviewing the above turned up three claims stronger than their support, all now fixed:
P_t ≥ 0(pool at −119 LGO) reported a residual of exactly0.00e+00while claiming to run "the RFC's central claim". Circulating supply is a real stock now, the total is compared against genesis, and a companion gate proves the check has teeth by leaking a token a block and catching +5.0 LGO.MODEL.mdandMAPPING.mdclaimed the RFC "models reserve sub-pools explicitly". PR 375's text has 31 mentions of "reserve" and zero of "sub-pool" — the term exists only in its review thread, as a reviewer's objection. The structural analogy stands; it is now labelled as ours.A_t = 1where every published figure sits, 0.0005% near target, and exactly1/(1−pow_share)only in the genesis-seed transient.4. Mutation testing — asking whether the gates are evidence at all
A gate that catches no mutation of the code it covers is not evidence, so this PR asks that question directly: perturb the thing under test, count the gates that notice.
The first harness reported zero of fifteen caught — because it inferred "green" from the absence of failures, and the suite had not run at all. The same defect it was built to find. Corrected to require the positive marker, it found 11 of 15 caught and four real holes, every one now closed with a gate written by breaking the thing and confirming the gate fails:
emission.pooled_inflow_lgo, gatedEFFICIENCY_PERSISTENT15% → 25%A_tsaturates at 0 or 1 in every gated run, where the coefficient is invisible — and the first fix computed its expected value from the constant under test, so the mutation moved both sides and the gate still passed. Caught by the re-run; now a literal15 of 15 mutations are caught after the fixes, each verified by re-running the mutation that escaped.
5. The report set, rewritten for a reader who knows none of this
Every document opens with a reader's guide and every section with a plain-words paragraph — read only those and you get the whole argument.
denovo-report.mdnow opens with the chicken-and-egg problem the mechanism exists to solve;adversarial-analysis.mdexplains that no attack here breaks cryptography, only self-interest;tokenomics-model.mdgets a navigation guide for a document whose shape actively misleads (addenda newest-first, §§4.5–4.6 after §9). Four sub-sections were marked as top-level headings and rendered as peers of their parents in every outline; nested correctly.No figure, number or claim changed in that commit.
State
Both gate suites green — 213 gates on the strategy simulator, 67 on the de-novo one — and the golden cross-checks agree.
spec_syncpasses against both candidate spec trees. Every number in the reports is produced by a gated run; the two remaining open items are upstream asks on lips PR 375, not work here.🤖 Generated with Claude Code