btc: adopt oracle FLOOR for v36 version-gate tail accept (SSOT step-2, + green KAT) - #550
Merged
Merged
Conversation
…ergence (flip-RED KAT, held) SSOT step-2 #1 standardization target. p2pool oracle (data.py) accept threshold is the FLOOR form counts>=sum*60//100; the BTC inline tail-guard (auto_ratchet.hpp:169) is the algebraic CEIL form target*100>=total*60. When (total*60)%100!=0 the oracle latches up to one share EARLIER. New SSOT2_OracleFloorVsInlineCeilBoundary KAT pins the gap at a non-integral boundary (total=101: floor=60, ceil=61) with an integral control (total=100, forms agree). Proven flip-RED: asserting the inline form latches at 60 fails (Actual false / Expected true). Test-only, consensus surface UNCHANGED; the EXPECT_FALSE inline seam flips to PASS only when the operator-tap-gated core floor adoption lands. btc_share_test 38->39 PASS.
Replace the inline tail-guard CEIL form (target*100 >= total*60) with the p2pool data.py FLOOR form (target >= floor(total*60/100)) in AutoRatchet::get_share_version. At a non-integral boundary (total*60 % 100 != 0) the cross-multiplied CEIL latched up to one work-unit later than the network oracle; FLOOR makes our 60%-by-work accept gate byte-identical to every peer, removing the c2pool-only late-latch divergence. Updates the test replica inline_tail_ok to the same FLOOR form and closes the SSOT2 standardization seam: the boundary KAT now pins the CONVERGED state (inline==oracle at total=101) instead of the proven divergence. All 7 AutoRatchet KATs + full btc_share_test (39/39) green; sibling C3 accept-gate / mint-cannot-outrun-accept / monotonic gates unaffected (integral or far-from-boundary). Consensus surface now equals the p2pool oracle exactly. Held off btc/version-gate-ssot-step2-floor-kat; pairs with the step-2 evidence pair (KAT 291fafa + prod-vote-safety 1579dc4). Operator-tap gated via the version_gate SSOT decision card.
frstrtr
force-pushed
the
btc/version-gate-ssot-floor-adoption
branch
from
June 26, 2026 19:59
22eb191 to
e8011fc
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
v36 version_gate SSOT — adopt oracle FLOOR for the tail accept gate
Operator-approved standardization: drop the c2pool-only late-latch CEIL and adopt
the p2pool oracle FLOOR form for the v36 version-gate 60%-by-work tail accept gate.
Fenced to the version_gate path; two files, no behavioural change on any realizable
work-weighted tally (see safety proof below).
Change
src/impl/btc/auto_ratchet.hppAutoRatchet::get_share_versiontailguard: CEIL
tail_target*100 < tail_total*60-> FLOORtail_target < (tail_total*60)/100(p2pooldata.pyform). Only behaviouraldelta: at a non-integral boundary the gate latches one work-unit earlier, in
lock-step with the oracle every deployed peer enforces.
auto_ratchet_sim_test.cpp:inline_tail_okreplica updated to the sameFLOOR form, and
SSOT2_OracleFloorVsInlineCeilBoundaryflipsEXPECT_FALSE -> EXPECT_TRUEat the total=101 boundary — the seam is now CLOSED,pinning the CONVERGED state. The KAT was proven flip-RED before this change, so it
is load-bearing.
Verified locally: 7/7 AutoRatchet KATs + full
btc_share_test39/39 green. Siblingaccept-gate / mint-cannot-outrun-accept / monotonic cases unaffected (integral or
far-from-boundary).
Consensus-safety (paired evidence)
The FLOOR vs CEIL forms differ on exactly one integer value of
target_work— a1-work-unit band. The gate reads the work-weighted tally
(
get_desired_version_weights, weight =ShareIndex::work), not a flat count. Theminimum single-share work quantum
W_minis bounded below by the scrypt pow_limitat >= 2^20 (~1.05e6) work-units, so every share moves
target_workby >= ~1e6 >>the 1-unit band. Oracle-FLOOR and inline-CEIL therefore latch on the identical share
for any realizable tally — the early latch is unreachable by construction, not merely
improbable. Direction of risk: FLOOR removes a latent c2pool-only late-latch
divergence and introduces no early activation.
Full exhaustive proof: evidence doc
1579dc4(frstrtr/the#12,docs/v36-version-gate-ssot-step2-prod-vote-safety.md).Notes
lands. The version_gate commits touch disjoint files from btc: v35->v36 crossing-drive standup harness (held-for-tap) #543.