SilkNode

Private by design. Built to evolve.

SilkNode is building a private-by-default payment network around a proof-of-work, multi-parent DAG: a graph in which records can reference more than one parent. The aim is practical payment speed, strong privacy and decentralized operation in one coherent system—not privacy added after the fact.

This is a research architecture under active development. Its advantages must be demonstrated, not assumed because the design is different.

The framework

Private state and payments

The private F0.4 core implements shielded transfers and cryptographic verification, with scoped local evidence. The goal is to protect sender, recipient and amount while allowing nodes to check the rules. Protection against timing and network-level linking is a separate requirement, not something encryption alone establishes.

Ordering and consensus

The DAG and proof of work establish the structure from which nodes derive a shared execution order. The research question is whether this design can improve privacy-enabled payment performance without weakening safety or decentralization. That advantage is not yet proven.

Durable history and recovery

Authenticated storage, bounded synchronization and restart recovery are intended to let nodes grow and recover without repeatedly rebuilding their entire history. Recovery must preserve verified state and ownership—not quietly reset trust.

Networking and participation

The target is authenticated discovery and resilient private routing without one indispensable seed or operator. Open participation, resistance to network capture and measurable metadata protection remain active research and implementation work.

Modules and upgrades

The architectural goal is a small consensus-critical core with explicit, versioned boundaries for storage, networking, wallets and later features. Changes must preserve state and privacy guarantees or be rejected as incompatible. Consensus changes still require coordinated adoption; modularity is not a promise of risk-free upgrades.

Where we are

Public experimental source alpha

The experimental source alpha is available at https://github.com/Bobtoshi/silknode. It is source for inspection and local experiments, not a turnkey public node distribution.

Valueless public seed testnet

Historical seed evidence: eight genuine proof-of-work vertices and checkpoint 1. As checked on 30 September 2026, the valueless seed is available again, running the bounded-worker source. Test SILK has no value. Independent participation is not established.

Experimental first-join and miner source and the guide are now public on GitHub main. Published source now includes opt-in, pinned multi-source catch-up. A same-host real-node peer-loss and restart journey passed; this does not establish independent outside participation or a live deployment. The valueless public seed is available again, running the bounded-worker source. A bounded same-owner separate-host check built public source 2ec2a58 on a fresh Linux VPS, joined without mining, locally verified eight genuine-work vertices and derived checkpoint 1. A separate-process cold reopen and resync reproduced the checkpoint and state. Wrong-network traffic and a wrong local head pin were refused. This is verification-only evidence, not new consensus code or independent third-party adoption; sustained operation, anonymity, throughput and production readiness remain unproven. No persistent node service, mining or value activation was enabled. Independent third-party participation remains unproven. The guide is PUBLIC_TESTNET_V1.md in the public repository.

Private core and historical evidence

The private F0.4 core implementation exists with scoped local evidence. Earlier bounded private experiments demonstrated shielded transfers, agreement between local nodes, recovery and restart behavior. These are separate results; they do not establish that every component is integrated into a finished public network.

Reviewed public source progress — 2 October 2026

Public source progress — 8 October 2026: reviewed changes let explicit multi-source catch-up leave a definitely rejected carrier source only when verified local state and the retained pin are unchanged; rejected bytes are not retried, and local or uncertain faults still stop. Reference-history capacity is now checked before admission, checkpoint and mining jobs, with reconciliation headroom protected from clock metadata. A read-only capacity API exposes the local arithmetic without verification or disk-reservation authority. Published source also preflights bounded inner-envelope framing, context, counts, fees and distinct nullifiers before retention, durable admission or native work. Focused checks rejected malformed synthetic input without changing a fresh node’s verified state or stored bytes; this is not a mined payment, proof or live-network journey. Full work, Sapling and replay verification remain required. Public source now implements a reusable aligned cold-generation replay index and shared immutable ancestry and ledger-set pages across reversible snapshots. Focused synthetic representation and serialization checks support parity, sharing, capacity stops and exact hash/delta bytes; they do not prove mined reorgs, payments or operation beyond the cap. Limits remain 4,096 vertices/executed/sync and 20,000 generations, with wider history residency still unresolved. Broader durable history and sustained operation remain under development. Public source also shares immutable 64-item pages for executed IDs and reward rows, copying only an incomplete tail. Reconciliation and complete accounting stream without flattening; public slice interfaces are preserved and lazy memory is conservatively charged. Six focused representation, synthetic and accounting-rejection checks passed. This is source-only evidence, not native over-limit proof or durable disk paging. Limits remain 4,096 vertices, 20,000 generations, 50,000 effects and a 14 GiB store; seed deployment, privacy, speed and release readiness are not established by these checks. The published reducer now also shares 64-item wallet-recovery and output-reference pages. Scanning and witness reconstruction use complete ordered/indexed reads without flattening compatibility slices; successful bytes, complete validation and ceilings are preserved, with full lazy memory charged. Four new focused representation, synthetic, reference/hash/delta and witness checks passed—not accepted payments, encrypted recovery, fresh-process forks or over-limit evidence. Public source now stores receiver-derived ancestry leaves on disk with bounded reads and refusal of missing or tampered pages. Reopening freshly rederives leaves after full admission; saved pages never establish validity. Seven new filesystem/synthetic checks, six affected ancestry checks and a genuine eight-vertex fresh full replay with deliberate auxiliary-corruption STOP passed. The 4,096-vertex limit remains; wider graph/ledger residency and beyond-limit restart/reorg evidence remain open. This source milestone does not establish pruning, performance, payment privacy or independent-operator readiness and has not been deployed to the seed. No node deployment or activation follows from this source milestone. Public source now exports exact original durable source-record bytes through bounded owned-file reads, with source-address bindings established only after full admission or fresh replay. Missing, tampered or hardlinked source refuses the whole range without a resident fallback; receivers still perform ordinary full ingest. Three synthetic source checks and one genuine eight-vertex fresh-replay/export/missing-last case passed. Whole-graph/history paging remains unfinished and the 4,096-vertex limit is unchanged. These source checks establish no beyond-limit reorg, privacy, speed or readiness claim. Checkpoint reduction and uncached parent reconstruction now require bounded reads of exact original durable source records under existing cumulative budgets before using resident verified bodies. Missing required source refuses before state, head, order or graph publication. One new synthetic refusal check and one genuine eight-vertex fresh-replay/scratch-reconstruction case passed, including missing-source refusal without publication. This establishes neither disk-byte validity nor body eviction, native reorgs, whole-history operation or beyond-4,096 evidence. Ordering residency and existing bounds remain unchanged. Reconstruction now loads owned bodies from bounded original durable-source reads, decodes in the accepted context and requires full equality with the same live verified candidate before reusing its proof capability. Eight loaded bodies are held only for the batch. That earlier slice retained resident candidates and capabilities; it did not establish eviction or fresh cryptographic verification per read. A synthetic owned-read check and an affected genuine eight-vertex empty-body fresh-replay/scratch-reconstruction check passed, including missing-source refusal before publication. The earlier empty-body check did not establish nonempty reload integration, native reorgs or beyond-4,096 operation. Current public Node graph entries detach full candidate, body and envelope bytes only after full fresh validation, exact durable-source binding and receiver-derived metadata sealing. That body-detachment slice retained compact metadata and live full-representation cryptographic bindings; execution loads owned bodies from checked original disk records. The public resident Graph borrowed API is preserved. Thirteen focused checks cover detached views/export/adapters, genuine eight-vertex empty-body replay and reconstruction, refusal cases, and separate freshly verified nonempty-proof reattachment. A new isolated nonempty-detachment integration check freshly replayed a valueless 16-vertex lineage with five encrypted envelope representations, reproducing its two-checkpoint state and uncached parent reconstruction with compact graph entries and checked owned disk-body loads. Known repeats added no effects or credits; missing nonempty source refused repeat, export and both reducers without new persistent publication. This test-only source change alters no node behavior or public defaults. It does not establish native reorgs, beyond-4,096 operation, durable ledger/index/full-order closure, privacy, speed or release readiness. Disk-backed ledger state, ordering/index closure, beyond-4,096 operation, native reorgs and whole-core readiness remain unproven; caps, codecs and defaults are unchanged. Public Node graph entries now also detach per-vertex ordering metadata and merge-blue lists after full fresh sealing and original-source binding. Bounded, fallible reads from checked content-addressed records materialize the exact receiver-derived metadata; stored flags confer no validity. Missing or tampered source refuses ordering or new sealing without index credit or head changes. Twelve focused cases include the isolated 16-vertex nonempty replay, both scratch reducers and missing-source refusal, with resident metadata release checked. Full ordering vectors/indexes, ledger payloads and wider restart/reorg history remain unfinished; the 4,096 limit is unchanged. This is not native-reorg, privacy, speed or release acceptance. Recovery payloads in current and cached checkpoint states now reside in receiver-derived, content-addressed disk pages. Public borrowed snapshots materialize once per checkpoint for compatibility; repeated borrows are not fresh disk verification. Twelve focused cases passed, including the isolated 16-vertex nonempty full replay and missing-page refusal before execution or scratch rollback. Damaged auxiliary pages stop cold replay without previous-head fallback. At that recovery-page checkpoint, the remaining ledger payloads, indices and full ordering were unfinished. This source checkpoint is not genuine executed reorganization, larger-history proof, privacy/speed acceptance or finished-core readiness. Nullifier and accepted-effect key payloads now reside in live receiver-derived disk pages in current/cached core states, with full key leaves dropped from core RAM. Missing or damaged pages refuse reads rather than imply unspent or absent keys. Public snapshots remain resident compatibility views reused per checkpoint, not repeatedly fresh disk-validated. Fifteen distinct focused cases include isolated 16-vertex nonempty replay, exact state/hash/delta bytes, missing-page refusals and auxiliary-corruption cold STOP without older-head fallback. At that key-page checkpoint, output-link, executed and reward payloads and graph/order indices remained resident; the 4,096 limit was unchanged. Native executed reorganization, larger-history, privacy/speed and finished-core acceptance remain unproven. Execution-order history, reward rows and accepted-output linkage payloads now reside in receiver-derived disk pages in current/cached core states. Missing execution history propagates through prefix, status, capacity and cache selection rather than imply divergence or trigger genesis fallback. Public borrowed snapshots remain resident compatibility views reused per checkpoint, not repeatedly fresh disk-validated. Thirteen distinct focused checks include isolated 16-vertex nonempty replay, exact two-checkpoint and snapshot/parent payload parity, missing-page refusals and damaged-output-link cold STOP without older-head fallback. At that payload-page checkpoint, graph headers/facts and vertex/order indices remained resident; fixed profile limits were unchanged. Actual new fork/reorg publication, larger-history, privacy/speed and finished-core acceptance remain unproven. Durable graph entries now drop full resident headers and use exact owned original-record header reads for difficulty adjustment and median-time checks, while sealed parent/work summaries support ordering. Nine focused cases passed, including the isolated 16-vertex nonempty replay with unchanged original verification and state/delta/checkpoint bytes. Missing original source refuses header reads and reducers without credit. At that header-read checkpoint, graph facts, vertex directory/index and order vectors remained resident; the cap was unchanged. This source-only checkpoint establishes no larger-history, native-reorg, privacy/speed or whole-core acceptance. Durable graphs now discard the full resident vertex-ID lookup map and read receiver-derived sorted index pages with strict hash, inode, live-range and context checks. Complete staged-index validation precedes graph credit; lookup failures propagate through known repeats, parent/order and execution. Thirteen focused checks include isolated 16-vertex nonempty full replay and missing-index refusals. Damaged auxiliary index pages stop cold replay while preserving the original pin and active-replay state, without older-head fallback. At that vertex-index checkpoint, graph facts, vertex directory and Core order vectors remained resident; the cap was unchanged. This source checkpoint establishes no larger-history, native-reorg, privacy/performance or whole-core acceptance. Core now drops full total/eligible order snapshot vectors and loads operation-local eligible IDs from the exact original order object under the original job budget. Original bytes are checked before graph credit; saved order gains no new validity or format. Missing order stops reconciliation, capacity, default-parent selection, advance and flush before writes. Six focused checks include physical vector release, pre-credit refusal and isolated 16-vertex nonempty replay preserving both checkpoints and original bytes. Corrupted pinned original order refuses cold replay without adopting a previous head. At that order-read checkpoint, graph facts, vertex directory and operation scratch remained resident; the cap was unchanged. Larger-history, native-reorg, privacy/performance and whole-core acceptance remain unproven. Durable graph entries now drop complete parent-fact payloads and reconstruct them for execution from owned exact original header/source-footer reads, retaining compact live minimum-time, key and binding data. The public borrowed accessor is preserved. Six focused cases include isolated 16-vertex nonempty full replay with unchanged original record/state/delta bytes and refusal of changed facts, headers, footers, keys or minima. Receiver-created vertex-directory pages now replace resident compact vertex carriers. Owned internal reads preserve exact source, header, fact, metadata and ancestry bindings; missing or damaged pages refuse processing or publication. Verifier capabilities remain live-only, and cold replay fully verifies original records before rebuilding the directory rather than importing saved validity. Public borrowed resident Graph APIs and the const facts accessor are preserved. Eleven focused checks and one isolated 16-vertex nonempty integration passed with original state/checkpoint bytes and refusal behavior preserved. Directory appends now stage only one immutable tail or new page, preserving exact prefix bytes and live handles. Publication reuses one checked operation-local directory snapshot but still validates every current/staged page and identity before graph credit. Five focused checks and one changed-path isolated 16-vertex integration passed; the 64-to-65 boundary check refuses a missing prefix. This reduces avoidable work without establishing measured speed, larger-history or capacity gains. Directory reads now retain at most one operation-local page of 64 compact entries, with no cache across view drop, publication or reopen. Sequential enumeration validates every page against the exact index permutation and preserves sorted IDs; strict-past traversal retains bounded IDs rather than a full decoded graph, completing disk reads before callbacks. Eight focused checks and one changed-path isolated 16-vertex replay passed. Cumulative budgets, fresh source/index reads and fully checked uncached publication remain. Live handles/address directories, bounded index/ID scratch and expensive reads/traversal remain; no measured speed, global complexity, larger-history, cap-lift or core-readiness claim follows. Repeated graph lookups now reuse one fully qualified operation-local ID-index leaf of up to 64 keys under the same cumulative budget and exact ID/ordinal rules. Missing or corrupt target leaves remain errors; nothing is cached across operations, publication or reopen. Direct node reads, publication and full materialization remain fresh. Six focused checks and one isolated 16-vertex genuine replay passed. This source-only change establishes no runtime, network, speed-comparison or capacity readiness. The 4,096 horizon, remaining full index/order materialization, traversal/merge CPU and original metadata/source reads remain limiting or unproven. Repeated ancestry membership checks now reuse one fully hash/domain/page/live-context-qualified operation-local 64-byte leaf containing 512 membership bits. Private graph-view filtering/enumeration and the ancestry primitive retain the original cumulative budget, cache no missing/error result and inherit no cache across operations. Direct node/publication, union/retention and full strict-past materialization remain fresh. Eight focused cases and one isolated 16-vertex genuine replay passed. This is not a speed benchmark or capacity/readiness claim; the 4,096 limit, full index/order materialization, merge/traversal CPU, original metadata reads and broader core/runtime/network acceptance remain limiting or unproven. An immutable graph operation now reuses one fully checked ID/ordinal inventory across strict-past walks, avoiding repeated whole-directory reloads and rebuilding. It holds only IDs and sorted ordinals within the unchanged 4,096 horizon, not graph validity, bodies, capabilities or metadata. Full index/permutation/directory qualification precedes the first callback; partial/error results and cross-operation/publication/reopen caches are excluded. Ancestry remains freshly read each walk under the same cumulative budget. Nine focused checks and one isolated 16-vertex genuine replay passed. Whole-index first materialization, snapshots/order, merge/traversal and original metadata reads remain limiting; runtime/network, measured speed and capacity readiness are unproven. Strict-past traversal now enumerates set-bit ancestor positions instead of scanning every graph position. All retained ancestry leaves still undergo fresh full materialization and qualification before positions or callbacks, including leaves beyond an empty or tiny requested prefix. The complete operation-owned ID inventory, cumulative budget and exact increasing-ordinal callbacks are preserved; no partial/error or cross-operation validity cache is introduced. The 4,096-position horizon and direct/publication/retention/union checks are unchanged. Eight focused checks and one isolated original 16-vertex replay passed, preserving cryptography, headers, facts, order, two checkpoints, economics and refusals; scoped lint reported no changed findings. Whole-index first materialization, public/full order snapshots, remaining reference merge/selected walks and original metadata reads remain unfinished. This source evidence does not establish genuine large-fork/native-reorg, runtime/network, capacity or measured-speed acceptance. Reference ordering now reuses already qualified selected work and parent fields within one operation, avoiding duplicate metadata reads. Final commitment, publication and cold reads remain fresh; no persistent validity cache, rule or limit changes are introduced. Ten focused checks compared exact prior/full snapshots, commitments, read reduction and errors, including affected synthetic disk/resident consumers. This evidence includes no original unchanged-chain replay or genuine native fork, and establishes no expanded-history, measured-speed, privacy or whole-core acceptance. Reference fork/merge ordering now reuses the selected parent's complete ancestry already obtained during the parent-union walk. Every parent remains qualified; fallback, Kahn ordering, commitments, publication and cold reads are unchanged. Twelve focused checks compared exact prior snapshots and commitments, precise reduced ancestry-walk counts, missing/cycle/refusal cases and affected synthetic consumers. This adds no native-fork evidence, raises no cap and establishes no measured-speed, privacy or whole-core acceptance. The first operation-local graph ID/ordinal inventory is now built directly from fully qualified index pages, removing an intermediate full BTreeMap allocation. Every page, global key order, ordinal permutation and full directory identity remain checked before output. Fifteen focused checks and one changed-path original nonempty fresh replay passed, preserving existing commitments, order, economic and cryptographic state, and refusals. The 4,096 cap and consensus, API, publication and cold-read rules are unchanged. This does not establish fully paged ordering/index append, larger-history acceptance, new native-fork evidence, benchmark results, privacy or whole-core readiness. Public source adds an owned immutable mining template and single-nonce miner interface. Preparation closes the node job under the unchanged receiver budget before external search; ordinary ingress remains the sole fresh verifier. Consensus, work backend, wire bytes, economics, defaults and caps are unchanged. Retained bounded local evidence covers 18 genuine vertices, including two new empty-body vertices (a sibling and two-parent merge), an original genuine sibling, opposite ingestion, executed-checkpoint rollback/convergence, full independent execution/state/order parity, same-process and second-process cold replay, no-credit exact repeats and forged-work/facts rejection. The final fresh-copy replay took 41.087307 seconds with 589M peak memory and zero swap; cumulative runs took 96.228285 seconds within the original 120-second/3GB limits. Failures were preserved and exact saved public carriers reused in fresh copies; failed stores were not reopened. Eleven unique focused checks passed; changed production spans had zero lint findings, with 156 outside-span baseline warnings retained. Source-review acceptance is not independent runtime reproduction. No new payment proofs or valuable assets were created. Larger history or a lifted 4,096 cap, two-host operation, private transfers/wallet recovery, privacy/Monero equivalence, speed, production economics and whole-core/release acceptance remain UNPROVEN. The alpha release is unchanged; this source update does not deploy the node runtime. Public source provides bounded UNVERIFIED file-backed full public history distribution within the existing 4,096 inventory and 32-carrier range limits. Fresh file checks establish exact bytes only; ordinary Node.ingest remains the sole validity boundary. Five synthetic checks and a static-codec check of 3,080 carriers in 97 ranges passed without native hashes, proof verification, node opens or mining. The subsequent source-26 native gate FAILED at vertex 1,361 (ordinal 1,360) on cumulative foreground CPU/wall refusal. The last complete generation had 1,360 vertices, checkpoint 170 and sequence 1,530; no stage-one pins receipt or second cold OS phase followed, and full 3,080/checkpoint-385/original-state comparison was not reached. Aggregate RAM/disk/run bounds were not exhausted; the CPU-versus-wall branch and finer ingress phase are unknown. The failed owner and marker remain preserved without rerun, repair or adoption. Newly implemented and independently source-reviewed shared physical ordering history preserves original SNF04OR1 canonical bytes/hash and Record commitments. Orders of at most 64 IDs and existing raw orders stay unchanged; new larger orders use typed bounded hash-checked page reconstruction. Original foreground budgets, horizons, quotas and consensus/wire/economic/release boundaries are unchanged. Thirteen focused component tests passed: seven synthetic storage checks (including an in-memory 4,096-prefix model and 64–256 disk-prefix/cold typed reads), five existing order-binding/refusal checks and one raw held-directory reader. Changed production spans had zero Clippy findings; 156 outside-span baseline findings remain separate. Append-prefix sharing is a physical-storage fact, not a general reorg, CPU or throughput claim, and is NOT evidenced as curing the native foreground refusal. Those component checks did not establish native paged-order blockchain operation or larger native replay; the later exact-source native result is stated below. Practical speed, privacy, independent networking, wallet recovery and whole-core/release completion remain UNPROVEN. The preceding 18-vertex fork/mining-template evidence remains specific to its historical source. This remains valueless research; alpha is unchanged and no live node deployment or activation follows. Public source adds an operation-scoped checked ancestry query for delayed-key frontier search and first cooperative-expiry diagnostics reporting the active call phase and cumulative CPU/wall observations. Seventeen focused component checks passed (five diagnostics, two ancestor-query, five existing quantum and five existing order checks); changed production spans had zero Clippy findings, with 156 outside-span baseline findings separate. A 65-vertex synthetic disk frontier returned the same 64 answers with budget-counted source calls reduced from 256 to 6 under the original two-second CPU allowance. This is not all physical reads, a 42x CPU/throughput claim or full native parent-key acceptance. Original work/proof/source-ledger checks, consensus/wire/economics, target/key rules, budgets, quotas, horizons and release defaults remain unchanged; no persisted validity or negative cache is added. The source-26 failure and its unknown finer ingress phase/CPU-versus-wall branch remain unchanged. The separately authorized fresh source-28 native diagnostic FAILED at candidate 1,233 (ordinal 1,232), with GraphOrder active at detection: cumulative CPU 2.000250328s against 2s, wall 2.043431403s against 5s. CPU expired; wall did not. This call boundary is not exclusive phase cost or root-cause proof. Outer runtime was 746.205s, CPU 675.446s, peak 731.7 MiB and swap zero, within unchanged 20-minute/1,000-CPU-second/3-GiB limits. Both failed owners remain preserved without retry. Those frontier component checks did not establish native ingestion or larger-history/cold replay; later exact-source results are stated below. Networking, wallet recovery, privacy, practical speed and whole-core/release completion remain UNPROVEN. New public source retains compact operation-owned, freshly recurrence-checked chain facts to emit the unchanged canonical graph commitment; inventory lookup reuses fully qualified IDs. No checks are removed and no persisted validity, negative cache or cap raise is added. One focused 129-vertex synthetic disk-chain test passed exact reference/fork/staged-130 parity and fresh-damage/expired-budget refusal. Its 251 budget-counted source calls are not an old/new baseline, all-I/O count or CPU gain. Research-VPS compilation, focused testing and changed-span Clippy passed; changed spans had zero diagnostics and 258 outside-span baseline diagnostics remain separate. Source29 subsequently PASSED a fresh 1,361-prefix native gate under original two-second CPU/five-second wall and ten-second checkpoint limits: Ready, checkpoint 170, 1,360 executed and no active job; service 652.754s, CPU 584.663s, peak 753.7 MiB, swap zero. This is bounded progress through the earlier failure points, not full native acceptance. A new full 3,080 attempt then FAILED at candidate 2,449 (ordinal 2,448), with GraphOrder active at detection: cumulative CPU 2.000403901s against 2s, wall 2.040395417s against 5s. CPU expired, wall did not; this is not exclusive phase cost or unique causal attribution. Service 1568.259s, CPU 1392.526s, peak 950.2 MiB, swap zero stayed within unchanged one-hour/3,300-CPU-second/3-GiB outer limits. Full comparison and the cold process were never reached. All failed owners, markers and evidence remain preserved without reopen, repair or adoption. Source30 now retains bounded checked parent/work header facts in an immutable ordering View after complete fresh ID/directory qualification, reusing owned fields while preserving membership/budget checks and fresh metadata/ancestry paths. No API, consensus, wire, library commitment, mandatory check, default, quota or horizon changes. Two affected synthetic checks passed reference/diamond/staged-130 parity, damage refusal and 65-vertex directory-boundary qualification. The same 129-vertex fixture used 138 rather than 251 budget-counted source calls; this is not all physical I/O or CPU gain. VPS build/lint passed with a separately approved compiler-only 16-task ceiling; node/test/native limits remain four tasks. Changed-span lint had zero findings; 156 outside-span baseline findings remain separate. Published historical source30 evidence now records PASS for fresh ordinary ingestion of all 3,080 public carriers and separate-process cold semantic replay on its exact ELF (71e4b31c7fe75fceb29ece752629ac1552c4d236f4c2b2b6944ceb6526f6ea2d). Ready, 385 checkpoints, state/order/ledger parity and exact-repeat no-duplicate-credit checks passed under unchanged per-vertex, checkpoint and shared run limits. The pair used 2866.01s wall and 2612.004s CPU. An earlier source30 v3 fixture exhausted its 65,536 inodes while bytes remained; only a fresh v4 fixture inode geometry changed within the same 1-GiB image cap, with source and limits unchanged. All failed owners remain untouched. The newly reviewed public source adds exact public-window binding before ordinary ingress and a receiver-derived read-only admitted prefix using freshly checked membership and original carrier bytes. Static bound-window checks, genuine four-carrier admission, a separate-process cold-prefix query and fresh source-damage refusal passed. This is implemented local mechanism evidence; the historical full 3,080/cold PASS does not transfer to the newer ELF. The existing private file-based operator now implements history-resume and history-ingest: complete static response binding precedes parameter/store opening, requested start must equal the fresh receiver-derived prefix, and ordinary native admission/Ready reconciliation remains required. One bounded eight-carrier sequence PASSED across two hosts using an SSH STATIC SOURCE and an isolated native receiver. The second stream was cut after 1,448 of 2,897 bytes by terminating its exact owned SSH client (exit 255); preserved partial bytes refused before parameter/store opening, with every receiver-file byte unchanged. A fresh process derived prefix 4 from its retained receiving HEAD; start 0 refused without duplicate admission. A new complete second frame admitted four more carriers to Ready 8/checkpoint 1, and a final fresh process derived prefix 8 with the same HEAD/state/checkpoint and valueless leaves 4/pool 299/burn 1, without previous recovery. All eight phases passed, including two expected refusal exits. Combined native CLI units used 15.258s CPU/15.497s wall, excluding SSH, with peak at most 324.2M and swap zero; this is not a speed benchmark. Fixed budgets/defaults remain unchanged; no mining, new proofs, secret transfer, failed-owner repair/adoption, full 3,080 rerun or new listener occurred. This demonstrates two-host SSH static-source receiving/restart/resume, not native P2P transport or two independently operating consensus peers. Competing branches/churn, public-network performance, full-prefix query cost, beyond-4,096 operation, wallet recovery, production privacy/speed and whole-core/security/release readiness remain UNPROVEN. The earlier full 3,080/cold PASS belongs only to its historical source30 ELF, not this operator ELF. Source-only review is not independent full-core execution acceptance. No profile, deposit, value or release activation follows; network, wallet recovery, privacy, practical speed and whole-core/security/release acceptance remain UNPROVEN. The chain-facts component checks did not establish full 3,080/cold restart; later exact-source results are stated below. Two-host operation, privacy, practical speed and whole-core/release readiness remain UNPROVEN. New public source wires page-scanned order/executed-ledger inspection into reconciliation, capacity preflight and selected-parent qualification. Exact canonical order and all ledger pages are qualified before returning a prefix or up to eight selected IDs; late corruption, early mismatch and short-order cases cannot hide missing data. One 64-row decoded ledger page is held at a time, without a global validity cache; original cumulative budgets, consensus bytes, formats and defaults are unchanged. Final VPS build and two new focused synthetic cases passed; changed production spans had zero Clippy findings, with 157 outside-span baseline findings separate. These are component checks, not native work, new proofs or native checkpoint acceptance. This is a necessary scaling dependency, not a capacity lift or evidence beyond 4,096 vertices/20,000 generations or for indefinite history. Reducer/economic hashing still materialize ledger data, graph derivation still produces full snapshots, and coupled ancestry/order/index/ledger/sync/generation horizons remain. The prior SSH eight-carrier result and historical full 3,080/cold PASS remain tied to their exact earlier source/ELFs and do not transfer to this ELF. Native P2P, independently operating consensus peers, churn, private cross-host payments, practical performance/privacy and whole-core/release readiness remain UNPROVEN. Bounded order-page publication now regenerates one existing-format page at a time, keeps a metadata-only missing-page plan and reserves exact quota charges before writes. Canonical/page bytes, commitments, HEAD publication ordering and limits remain unchanged; full canonical input and applicable checked-read buffers still exist, so this is not bounded whole-core memory. Byte-oracle checks at 65/66/511/512/513/4,095/4,096 and existing quota/deadline refusal passed. A separate owner-executed native gate on the exact source35 production ELF passed 72 original genuine carriers in frames 32+32+8, crossing the shared-order boundary with nine checkpoints. A separately pinned cold OS process reproduced the same HEAD/order/checkpoint/state/public fields and receiver-derived hint 72. Aggregate CPU was 77.867s/service wall 78.403s, peak 600.4M and swap zero; repeated parameter/replay work is included, so these are not benchmark results. Original two-second CPU/five-second wall vertex and ten-second checkpoint limits stayed unchanged; failed owners and the original image were preserved, with no new listener. This closes the 72-carrier changed-path boundary only: the older full 3,080/cold source30 and SSH-eight source33 results remain tied to their earlier ELFs. Beyond-4,096 capacity, P2P, independent consensus peers, churn, private cross-host wallet operation, privacy/performance and release acceptance remain UNPROVEN. Next growth work requires coupled ancestry/order/graph/index/ledger/sync/generation representations, not a cap-only lift or pruning. Public source now replaces the fixed eight ancestry addresses with an immutable sparse eight-way path-copied tree retaining one root. Existing 112-byte leaf bytes stay unchanged; new receiver-local branch/directory formats carry the root. Corrected synthetic sparse growth reached position 1,048,575, not Node admission. A separate 520-original-carrier/65-checkpoint native and pinned cold-process gate passed exact HEAD/order/checkpoint/state/public-ledger parity on the preceding source36 v3 ELF only. Its 362.230s CPU/385.657s service wall, peak 631.4M and zero swap are not benchmark results; the PASS does not transfer to the later sparse-only correction or source37. Physical order trees now calculate depth, keeping minimum depth two and all existing page/descriptor/canonical bytes, complete quota reservation, one-page publication and HEAD ordering unchanged. Physical-only 4,097/32,768/32,769-row oracle, typed-read and refusal checks passed; current policy still refuses oversized orders, and the u16 coordinate ceiling remains 65,536 leaves. The 4,096 integrated policy is NOT lifted. Graph/index/ledger/sync/generation resource integration remains next; this is not whole-core completion. Historical full 3,080/cold, SSH-eight and native-72 evidence remains bound to its earlier exact versions. P2P, independent consensus peers, churn, private wallet operation, privacy/speed and release readiness remain UNPROVEN. State hashing now streams retained nullifier, effect, recovery-ciphertext and public-reward payloads through completely checked page visitors into a private accumulator, preserving identical canonical hash inputs. Observations stay provisional until complete page/count/budget qualification; any failure refuses the digest. Three focused synthetic literal-hash parity, late-page damage and count/deadline checks passed on the exact source38 test ELF. This removes retained payload-collection materialization from hashing, not bounded whole-reducer/node memory: page metadata remains retained, and reducer mutation/rollback/public compatibility loads remain open. The 4,096 policy and canonical bytes/defaults are unchanged. No new native checkpoint, payment, recovery, privacy or P2P acceptance follows; the earlier 520 and other native results remain bound to their preceding frozen ELFs. Forward checkpoint deltas now avoid full executed/current-plus-prior set/recovery/reward payload materialization. Complete prefix comparison and a two-single-leaf ordered merge drain both streams, including unused prior suffixes; addition counts and suffix bytes stay staged until every check and final budget pass. Original SNF04DL1 bytes are unchanged. Four synthetic literal-serializer parity and late-input refusal checks passed. The same frozen source39 ELF also passed a fresh isolated replay of 16 original genuine payment-bearing records, including five nonempty representations, two checkpoints, exact original checkpoint/parent scratch reconstruction and fail-closed source/ledger pages; valueless pool 58/burn 2/leaves 7 matched. Native service was 12.070s/CPU 11.825s, peak 327.2M, swap zero, with no new work, proofs or wallet secrets. The final intentional damaged-directory cold reopen STOP owner is preserved; this is NOT separate-process cold-success evidence. Reducer mutation/rollback/public compatibility full loads remain. No wallet recovery, native fork/P2P or beyond-4,096 acceptance follows, and older 72/520/3,080 results remain attached only to their own ELFs. An admitted checkpoint with no envelopes now keeps unchanged private recovery, nullifier/effect and accepted-output payload pages disk-retained; executed/reward histories still materialize for appends. Any envelope, including a duplicate or conflict, keeps the full-mutation path. Shared economic count/reward rules, complete streamed reward/executed/output-link invariants and full private hash qualification must pass before scratch state returns. Exact canonical/page/delta bytes, the 4,096 policy, budgets and defaults remain unchanged. Three focused synthetic checks passed. On the same source40 frozen ELF, fresh genuine 24-carrier admission reached three checkpoints; the third admitted empty checkpoint reproduced its actual manifest while private pages stayed retained, closing without ACTIVE markers (9.420s service/8.660s CPU, peak 324.2M, swap zero). A separate fresh 16-record nonempty fixture reproduced exact two checkpoints/private counters and fail-closed source/page/scratch reads (12.599s service/12.384s CPU, peak 325.8M, swap zero). Its final deliberate damaged-directory cold STOP owner remains preserved, not reopened. No new work, proofs or wallet secrets were generated. This is not separate-process cold success, native reorg, P2P, wallet recovery, beyond-4,096 admission or fully bounded reducer memory. At source40, nonempty mutation, executed/reward appends and rollback still loaded complete collections; source41 retained mutation below supersedes that implementation boundary. Public compatibility views remain materialized. Checkpoint payment mutation now retains old payload pages, appends newly derived history rows and edits touched set leaves. Rollback freshly qualifies the selected complete digest/invariants and reuses its retained snapshot without full old-payload materialization. Literal hashes/checkpoint/recovery/page/DL1 bytes, ordered at-most-once semantics, modular public APIs, 4,096 policy and budgets stay unchanged. Build and eight focused checks passed on the exact source41 ELF. A new instrumented saved-carrier journey matched actual payment scratch execution, then exercised a real competing-checkpoint rollback/two-parent merge between two same-host receivers, with exact parity, same-process cold reopen and no duplicate credit. It consumed only authenticated existing public carriers: zero newly mined work, generated proofs, wallet secrets or valuable assets. This is not P2P, independent-peer or separate-process cold-success evidence; earlier native results are not transferred. Whole-node memory is not constant: metadata directories grow with history, new multi-checkpoint scratch suffixes can accumulate under existing caps, and public compatibility views remain resident. Larger-history/beyond-4,096 integration remains OPEN; privacy, practical speed and whole-core/release acceptance remain UNPROVEN. Durable admission and cold replay now stream one new receiver-derived ID into exact canonical 64-row index pages without constructing a full map. Atomic graph publication compares complete original/staged indices and directory prefixes through page-sized descriptors, replacing a full index map and two full graph-directory loads. Complete fresh context, permutation, count, prefix, append and original-budget checks still precede graph credit; late failure returns no partial credit. Exact page/consensus/hash/recovery/delta bytes, modular APIs, limits and defaults are unchanged. Build and five exact checks passed on the source42 frozen ELF: literal insertion boundaries, 65-to-66 synthetic late-current/staged refusal, affected readers, and an essential genuine saved-carrier admission/payment/real rollback/two-parent merge journey with same-process cold/repeat parity (25.856s service/25.263s CPU, peak 583.8M, no swap). Only existing public carriers were used, with no new mining, proofs, wallet secrets or value. Bounded ID vectors, permutation bits, directories and live bindings still grow with history; this is not constant whole-node RSS. Older native results do not transfer. Beyond-4,096 integrated resource policy remains open; P2P, independent peers, wallet recovery, separate-process cold success, privacy/speed and release acceptance remain UNPROVEN. Public source now implements an explicit bounded receiver-LOCAL history resource choice coordinated across admission, graph, order, ledger, sync and pinned recovery. Existing constructors/release defaults remain 4,096; an independently selected research profile permits nonzero multiples of eight up to 8,192. Configuration is nonserialized and never peer authority. The 20,000-generation ceiling and CPU/wall/memory/cache/effect/object/storage limits stay unchanged, as do consensus/wire/state/checkpoint bytes. A too-small local profile refuses before replay intent, without trusted snapshots or imported validity. Seven new synthetic 4,096-to-4,104/8,192 boundary/accounting/framing/page-refusal gates passed on the frozen v2 ELF, alongside a genuine SMALL saved 16/15-carrier create/replay/payment/fork-and-merge/opposite-ingress/same-process cold/repeat journey under the chosen 8,192 profile. A final preflight/public-accounting correction compiled and passed affected ledger/native checks separately on its final ELF; unchanged seven gates remain attributed to v2. Final native service was 24.428s/CPU 23.866s, peak 584.9MB, swap zero. No mining, new proofs, wallets/keys, value, listener or seed activation occurred. This is SMALL native evidence, not an 8,192-chain test: NO native chain above 4,096 has passed, and the pinned large corpus still contains 3,080 carriers. New work/replay requires separate approval. At source43 the two-host system gate was still unmet; the later small same-operator branch/response-recovery result is stated below; cold wallet recovery, network anonymity/decentralisation, constant whole-core memory, privacy and production/release readiness are not established. A SMALL same-operator two-host native branch/response-recovery gate now passed eight bounded one-shot phases on one frozen executable. Independently pinned 15-record baselines admitted different saved genuine siblings, exchanged actual Node-exported public ranges through ordinary ingress, and one receiver genuinely reorganised checkpoint/state to the other branch. A truncated response containing a complete unknown first carrier and partial second refused as a whole before admission, preserving HEAD/state/count. Full delivery then admitted the missing carrier once without duplicate credit; the saved two-parent merge brought both to 18. New separate cold-replay processes on each host reproduced each own retained HEAD and matched final state/order bytes across hosts; local HEADs correctly differ. All 18 repeats returned AlreadyKnown without extra credit or changes. Aggregate native CPU was 40.262s, not a throughput benchmark. This is interrupted RESPONSE delivery over SSH, not process crash/power-failure recovery, a P2P daemon/discovery service or Byzantine assurance. It is small 15-to-18 evidence from one operator, not independent external participation or native history above 4,096. No mining, new proofs, wallet secrets, value, public listener/service or seed activation occurred. Defaults remain 4,096; the explicit local 8,192-profile mechanism and native-above-4,096 UNPROVEN boundary remain separate. The lab result does not change the public seed’s reported eight vertices/checkpoint one. Anonymity, throughput, ordinary wallet recovery, sustained network operation and production/release readiness remain UNPROVEN. Public source adds opt-in native pipe-serve/pipe-sync: bounded context/framing and automatic source-zero range catch-up/reconciliation over preexisting authenticated private SSH pipes. The operator independently selects local history resources; omission remains 4,096, and explicit 8,192 was tested only on small history. Two real Linux hosts under the same operator used fresh own pinned 15-record stores, admitted different saved genuine siblings, automatically caught up and genuinely reorganised, refused a deliberately cut final response without partial import, then caught up in new processes and admitted the saved two-parent merge. Final repeated exchange processed all 18 as AlreadyKnown with zero new credit; independently checked final state/order bytes matched while own retained HEADs correctly differed. Seventeen bounded one-shot native phases used 77.632 aggregate CPU seconds; seven focused checks passed. Full original replay/work/crypto checks remained required, with no new mining, proofs, wallet secrets, public listener or core deployment. This is RESPONSE truncation and explicit healthy fresh-process catch-up, not process-crash/power-loss recovery or failed-owner retry. Public P2P/discovery, independent operators, native history above 4,096, whole-system anonymity, throughput, ordinary wallet recovery and release readiness remain UNPROVEN. The lab’s 18 records do not relabel the public seed’s reported eight/checkpoint one; alpha and defaults remain unchanged. Opt-in local source now implements a closed blocking 2,880-round UTC-epoch client owner: one baseline enrollment, eight cover-only warmup rounds, original anchored clock mapping, fixed T-8.125 decisions before T-8, bounded volatile one-offer/two-outcome mailboxes and health/public-view checks before payment selection. No session journal, re-export, reconnect or next-epoch API is added. Strict honest-A collection requires 32 actual distinct valid completions before labels are erased, carrying a privately minted configuration/manifest/round capability into the source round; no legacy batch conversion or filler supplies strict provenance. Legacy minimum-eight-plus-filler, B admitted-at-least-eight, wire/consensus/Sapling/wallet/defaults remain unchanged. Twenty-four relay, fifteen client and one compile-fail checks passed; two journal tests first refused the unchanged margin guard and passed separately on properly bounded server-filesystem fixtures. Actual TLS/HPKE 32-cell tests still used synthetic context/clock/admission. Full-plan scheduler seams checked offer/view combinations and deferred failure dropping a provisional successor; early successor manifest traffic remains possible. Fake journal fixtures showed empty later queues and separately explicit later exports, not global one-use. No day-long live session, mining, new Sapling proofs, real wallet secrets, service activation or seed deployment ran. This is bounded implementation and independent source review, not anonymity or under-load acceptance. External honest A, independently administered B, at least eight real independent active honest plausible senders, qualified at-most-500ms clocks and independently bounded public-view/wallet workers under load remain unresolved prerequisites. Malicious-A isolation, collusion/Sybil/intersection and exact B/producer envelope-to-settlement linkage remain outside the narrow claim. Whole-system anonymity/live integration/readiness remain UNPROVEN; rejected or unaccepted identity/proof designs are not implemented or activated. A consumed local producer offer now prepares an owned existing MiningTemplate using ordinary selected parents, current time, reward binding and the original foreground budget. The durable preparation job closes BEFORE external mining; cover creates no job, errors consume the offer without retry/requeue, and preparation performs no nonce evaluation, proof or ingestion. Synchronous mining/defaults/wire are unchanged. On a new authenticated 15-vertex public-payment copy, Linux native qualification checked exact ordered 1/3/32-envelope bodies and rewards, cover/foreign no-job behavior, unchanged HEAD/state/graph/carriers, templates outliving their owner and same-process cold reopen. Repeated saved envelopes test maximum FRAMING only, not independently valid payments. Six selected checks passed: one new consumed-offer compile-fail, four existing framing checks and one new native check. Native CPU was 10.459s/wall 10.672s, peak 325MiB; no new work, proofs or wallet keys were generated. A pre-execution namespace refusal was preserved and only its mount configuration corrected; passed checks were not rerun. This is not a fresh wallet-to-relay-to-new-settlement journey, crash/independent-operator test, above-4,096 history, anonymity or whole-core acceptance. Session-policy evidence remains conditional component qualification; design review does not establish compiled proof/runtime/privacy acceptance. The private 15-record fixture does not alter the public seed’s reported eight/checkpoint one or activate defaults. Consumed prepared mining templates now have bounded 632-to-89,912-byte LOCAL job encoding and independently pinned import for a separately contained miner process. Header/body/work-input transcripts stay exact; no trusted parent cache or node authority is imported. Pin custody and independently selected admitted genesis remain local premises. Bodies retain existing public Sapling proofs and ciphertexts, not wallet keys or newly generated proofs. Decoding derives the work key from the CLAIMED header seed: framing/pin/body bindings do not authenticate parent/source/DAA/time/work/payment validity or relay provenance. A deliberately forged pinned DAA claim can decode but gains no graph credit; ordinary ingest is mandatory. Two logical native cases passed on the exact final source48 ELF. A fresh 15-vertex preparer produced empty/1/32-envelope jobs and closed them without changing HEAD/state/graph/old bytes; empty uses explicit preparation, not cover. A separate same-host/operator importer, restricted to 13 read-only public files with store/parameter paths absent, matched exact 632/3,422/89,912-byte jobs and original nonce-0/7/maximum work-input transcripts, refusing malformed bindings and bounds. Zero nonce hashing/VM allocation applies ONLY to the importer; the preparing node uses a native VM to reverify retained work. Repeated envelopes test framing, not new valid payments. Preparer CPU/wall was 5.499s/5.757s, peak 324.3MiB; importer 67ms/82ms, peak 9MiB, not performance promises. Fresh final-ELF phases passed after clarification; earlier acceptance was not transferred and repeated qualifications are not extra independent samples. No new work/proofs/keys or ingress occurred. This is opt-in private source, not activation, permission to mine, a public endpoint or stable ABI. At the public Source48 boundary, fresh settlement was not established; the later private experiment below remains separate from downloadable source. Independent operators/cohort, crash recovery, above-4,096 native history, AIP2 compiled artifacts and real anonymity/core/release acceptance remain UNPROVEN. A separately reviewed PRIVATE implementation experiment now completed one fresh valueless wallet-to-relay-to-miner-to-receiver settlement on one host/operator; its complete experiment harness is not published; the later public Source49 package below exposes preparation components only. One Sapling payment bundle was proved ONCE (two spend/two output proof components) for two disposable wallets. An actual TLS/HPKE round accepted 32 inputs (one payment/31 covers), with A SealedAuth, B Finalized and three producer releases. The consumed producer offer became an ordinary current-time pinned job; a separate miner namespace without wallet/node/proving parameters produced genuine RandomX work, followed by ordinary fresh receiver admission. Exactly eight new records reached checkpoint one; exact repeats returned AlreadyKnown without credit. Wallet acceptance and a distinct cold wallet/full-node process recovered the same payment/effect/nullifiers, sender change one and recipient eight. New notes remain PendingCut, not maturity-spend acceptance; the historical synchronous settlement helper was not used. Explicit separate-host-margin relay-journal constructors support capped stores while preserving the legacy four-GiB guard, journal bytes/pins/restart rules and bad-margin/wrong-pin refusal. Failed receipts/journals were preserved without adoption or automatic proof/relay/job resend. The original run used TWO LOGICALLY CAPPED one-GiB filesystems; formatting discarded persistent backing allocation. After review, identical retained image bytes were physically reserved with whole-image hash equality, and ONLY one additional unchanged cold-wallet/full-node check passed on fully reserved backing. Initial proof/relay/mining/admission are NOT retroactively qualified as physically preallocated. The original slice closed at 1786.181588s within 1800s, using 335.178280 CPU seconds and 1,458,950,144-byte peak under one CPU/three GiB/no swap, with all native processes closed. This is one functional experiment, not independent samples or a deployed network; publication of preparation components below does not make it a turnkey reproduction. Public seed eight/checkpoint one and alpha remain unchanged. AIP2 stays INACTIVE; anonymity, honest independent cohort/operators, qualified UTC/whole-epoch operation, malicious-A resistance, crash/power-loss recovery, maturity spending, practical speed and whole-core/release readiness remain UNPROVEN. A later, independently reviewed PRIVATE R2 software fixture now connects one newly created two-input wallet payment through all 32 genuine membership checks, encrypted TLS/HPKE delivery, three actual producer inboxes and their consumed offer into ordinary current-time node jobs. Separate public-only miners produced eight genuine RandomX admissions and checkpoint one; duplicate candidates gained no credit. Separate cold node and both-wallet recovery reproduced the same payment, spent original inputs, sender change one and recipient eight. Both new notes remain pending maturity; recipient respending is UNPROVEN. CRITICAL TIMING LIMIT: the first live-clock attempt FAILED its fixed transmit slot. The successful composition reused the exact public statements and ciphertext under explicitly shifted protocol UTC with fresh journals, generating ZERO additional proofs or ciphertexts and adopting no failed owners. This was a software experiment, not an operational retry or qualified live-clock settlement. A shorter CPU-quota period and quieter supervisor were used, but neither is a proven causal remedy or reliability result. The accepted scope is SOFTWARE-FIXTURE FRESH VERTICAL ONLY, on one host/operator; the separate actual-UTC regression below has its own narrow acceptance. All native work ran on the research VPS; the accepted scope closed with zero tasks, 197.808129 CPU seconds and 1498.173590 measured service-wall seconds plus a ten-second closure reserve within its original 1800-second ceiling. Private backups, wallet keys and seeds were not exported. The complete private experiment remains separate from the public Source49 preparation package below. AIP2 remains INACTIVE and operational R2/core completion remains BLOCKED on independent ceremony/custody, external clock and delivery qualification, fixed five-second client dispatch, 32-real-payment worst-case margin and qualified fresh settlement. IM3, collusion resistance, anonymity, recipient respending and release readiness remain UNPROVEN. A separate independently accepted actual-UTC R2 functional regression now passed ONE round on the same host/operator, using 32 new genuine membership proofs, the existing exact public payment/genesis and unchanged pinned executables. The A-to-B per-frame train, complete 32-proof gate, one real Sapling payment, three producer releases/inboxes/exact offers and cold pin, old-authority and consumed-scope fences passed. Protocol slots and native guards were unchanged. Stage2 encrypted inputs were PRECOMPUTED: this does not test 32 real-client source links or fixed five-second client dispatch, and does not retest fresh ordinary-node settlement or wallet recovery. The separately accepted fresh full software journey above remains explicitly shifted-UTC after its earlier live failure. Three failed regression attempts remain failures; no failed owner or scope was adopted. Corrected accounting includes all 45 PID1 service lifetimes, including cleanup-killed actors: the four runs used 478.762736, 613.279853, 662.667818 and 997.628027 aggregate service-wall seconds, each below its original ceiling; together they closed at 287.635440 CPU seconds with zero tasks. The original incomplete ledger remains preserved as REJECTED. One functional pass does not establish a causal timing remedy, sustained reliability, independent ceremony/custody, external clock/delivery qualification, 32-real-payment worst-case margin, anonymity or release readiness. Public GitHub now provides the Source49 optional preparation package; its publication scope and separate evidence boundaries are described below. AIP2 remains INACTIVE; operational R2/core completion remains BLOCKED. Public Source49 is now published after independent review for INSPECTABLE CODE AND FOCUSED TESTS ONLY. It exposes durable one-shot profile/round claims, strict co-signed 32-member profiles, actual Groth16 verification and the version-separated encrypted 32-proof/distinct-nullifier gate before Sapling work. Preparation is optional and OFF by default; R2 lab constructors additionally require both preparation and functional-lab features and an explicitly unqualified schedule. Defaults, consensus/payment bytes and runtime release policy are unchanged. Seventeen durable-claim/signed-profile tests are included in the normal relay crate. Fresh public-only offline Linux library checks passed 36 default, 54 preparation and 56 double-gated lab tests. The original controller remains FAILED at optional-license lookup; a separate authenticated inventory resolved that packaging issue for 33 added crate archives without relabelling the controller. Eighteen build-family service lifetimes totalled 951.978004 aggregate seconds, 822.886445 elapsed seconds and 422.096536 CPU seconds within the original ceilings, with zero remaining tasks. These checks generated no new proof, work record or wallet secret. The published contributor document provides commands and limits; execution controllers, proving keys and private journey state are excluded. Earlier actual-UTC relay and shifted-UTC full-settlement results retain their separate accepted executable bindings and do not automatically transfer to these new library test executables. This source publication adds no binary release, node deployment, trusted setup, independent custody, qualified client dispatch/ingress or clock/delivery, 32-real worst-case margin, anonymity or release-readiness acceptance. AIP2 remains INACTIVE; operational R2/core completion remains BLOCKED. [Published Source49](https://github.com/Bobtoshi/silknode/commit/4c382337b151e64c3be3cddcd901c56582a36785) · [Contributor commands, evidence and limits](https://github.com/Bobtoshi/silknode/blob/4c382337b151e64c3be3cddcd901c56582a36785/docs/AIP2_R2_PREPARATION_V1.md). A later PRIVATE checkpoint received independent acceptance for the default-off one-shot R2 client-owner source and ONE actual-UTC single-real-client timing case ONLY. Three new invariant tests and six separate guard checks were substantiated. In the accepted case, a fresh membership proof was accepted at T−1.437859 seconds, local verification/double-HPKE framing completed at T+0.504732, the TLS write at T+1.000955 and A received/opened the outer layer at T+1.001712. Two proof attempts produced one completed fresh proof; the first failed owner remained consumed and SILENT with no frame. This is one public-fixture client using an existing payment, not full-cohort B disclosure, Join admission, a new settlement or wallet-recovery result. FULL-FAMILY RESOURCE QUALIFICATION WAS REJECTED: final inactivity was 942.740883 seconds against the original 900-second ceiling, despite 877.741867 aggregate service-wall seconds, 221.379318 CPU seconds and zero remaining tasks. The online supervisor accounting omitted stopped/unloaded-unit history; the final complete PID1 audit exposed that limitation rather than curing online enforcement. Replacement collector/supervisor work remains separately unqualified and unpublished. Cover, late-manifest and old-proof owner cases were NOT executed. No full-cohort, setup/custody, qualified-clock, anonymity or settlement acceptance transfers. That earlier client-owner acceptance belongs to its exact private execution; the later public R2/IM3 source disclosure does not transfer execution acceptance to the curated package. AIP2 remains INACTIVE and operational R2/core completion remains BLOCKED. Published source now replaces the fixed local generation-replay directory with an extensible bounded directory. The default 20,000-generation cap is unchanged; callers may explicitly select a finite larger local profile, with other resource limits still enforced. Retained component evidence includes complete traversal of 20,033 synthetic headers and one saved genuine eight-carrier cold replay; these were not rerun or relabelled as integrated-source executions. This establishes neither a native graph above 4,096 vertices nor a native semantic Node workload above 20,000 generations, indefinite retention, pruning, whole-core completion or anonymity. Published IM3 update — 8 October 2026: experimental client integration, three-relay runtime gates, R2 prerequisites, original-link cancellation, durable round sequencing and mandatory runner ports are now public and off by default. The documented lab prerequisites include external fixtures, proof helpers, membership setup and bounded workers; the curated two-client harness has not been executed as a public package and is not turnkey reproduction. Separate private demonstrations cover an earlier joined settlement/cold-recovery journey, later two fresh timed clients through full 32-member gates with three matching producer offers, and one failed predeclared source-linking guess. These are distinct results: the other thirty members in the two-client run were prepared beforehand, and matching offers are not settlement. Fault evaluation remains incomplete. Independent custody, qualified clocks/load, 32 fresh timed honest clients, system-wide anonymity, Monero-equivalent privacy and release readiness remain UNPROVEN. This source publication activates no public service and changes no seed deployment. [Published change](https://github.com/Bobtoshi/silknode/commit/841660d6e43c3f8dc17d8324d86de7e00edeb9d5) · [Generation profile and limits](https://github.com/Bobtoshi/silknode/blob/841660d6e43c3f8dc17d8324d86de7e00edeb9d5/docs/F04_GENERATION_DIRECTORY_V1.md) · [Published experimental IM3 source](https://github.com/Bobtoshi/silknode/commit/11a3007b50e225160afc258365016519d3e0c8d0) · [IM3 prerequisites and limits](https://github.com/Bobtoshi/silknode/blob/11a3007b50e225160afc258365016519d3e0c8d0/docs/IM3_EXPERIMENTAL_V1.md). Published wallet-safety and client-connection privacy corrections — 8 October 2026: source now durably consumes one wallet handoff before export and retains input nullifier/note-commitment exclusions. Recoverable preparation errors destroy submission authority while holding the original connection for cleanup until the existing T+44 boundary or peer closure. Full-size validation scans and copies remove concrete kind-dependent shortcuts. Independent acceptance covers bounded source review; focused VPS checks are writer-reported, and the curated public package has not been executed. These experimental corrections establish no constant-time proving, crash masking, universal retransmission/rollback protection or whole-system anonymity. Privacy, speed, independent operators and release readiness remain UNPROVEN. [Published corrections](https://github.com/Bobtoshi/silknode/commit/9c1038146cdfae195a8b98cff04300ce9cfe3e8c) · [Handoff, cleanup and evidence limits](https://github.com/Bobtoshi/silknode/blob/9c1038146cdfae195a8b98cff04300ce9cfe3e8c/docs/IM3_HANDOFF_CLEANUP_V1.md). Live verifier/address handles and bounded operation scratch remain; the default reference horizon is 4,096, and larger native history and whole-core readiness are not established. These changes have not been deployed to the seed or exercised by a fresh join. Focused checks support these changes only. History limits, protocol bytes and release defaults are unchanged; these are source updates, not deployed runtime changes or full-chain assurance.

Still to prove

Shared immutable ancestry and ledger-set pages are implemented in public source. Receiver-derived ancestry leaves are disk-backed; broader durable history and sustained operation beyond the existing 4,096-vertex horizon remain under development. Current limits remain unchanged.

Privacy, sustained privacy-enabled throughput, independent participation and production security remain unproven. Independent proof and consensus review, adversarial network trials and measured network-metadata resistance remain necessary.

What “core complete” means

Independent operators must be able to run the network, make private payments, recover wallets, restart nodes and remain in agreement through faults. Privacy and performance must be assessed together. Upgrade compatibility and failure behavior must be reproducible, not just described.

Later interfaces and features build on that core. They do not substitute for completing it.

Experimental, valueless research. Test SILK has no value. This is not a completed production blockchain, a mainnet launch or a claim of proven superiority or anonymity.