A certificate carries a Threshold, and until now that field was its own
authority on the count-only road: Verify's last clause counts distinct valid
accepts against the number the CERTIFICATE names, so one declaring 1 clears it
on a single signature. C++ has always demanded the derived floor exactly, so the
same certificate was accepted by two implementations and refused by the third.
VerifyWeighted now requires Threshold == SignerFloor(tier, n) — the floor this
set gives this rung. Equality and not a lower bound: an over-claim names a bar
this set does not set, and tolerating it would let a certificate redefine the
rung upward exactly as tolerating an under-claim lets it redefine the rung down.
SignerFloor is the one definition of a rung's count floor, read by the rung
predicates, by the assemblers and by the new clause, so the number enforced and
the number declared cannot drift.
Two corollaries the rule forces:
No set, no export. BuildVerifiedQuorumCert refuses any tier that authorizes
export when no stake source is supplied. That road counts votes against the
caller's own alpha, so an export token could be minted over one signer with
alpha of one — and AcceptWithCert trusts the token, which is the point of the
token. The accept rung keeps the road: it authorizes local execution the chain
can still reorg away.
The assembler reads the same n the verifier does. assembleCertLocked derived
Nova's declared floor from effectiveCommittee, which sizes the SAMPLE and is
floored at the minimum Byzantine committee. At three signers the sampler said
three and the set said two, so a node would have built a certificate its own
peers refuse. The export path already read SignerCount.
The corpus grows five rows — three that declare a quorum of their own, and two
lopsided sets where the stake half binds alone, which an equal set cannot state
because both halves bind at one edge there. Two frozen verdicts change the clause
they are NAMED by, from the stake floor to the count, and neither changes from
refused: over an equal set a certificate short of its stake is also short of the
quorum it now has to declare.
The rungs' own count clauses are unreachable as a result — Verify proves count
reaches the declaration and the new clause proves the declaration is the floor —
and are kept as the place the floor is defined and as the guard that survives any
change to the declaration rule. Written down in LLM.md beside the other walls
behind walls.
Co-authored-by: Hanzo Dev <[email protected]>
zeekayandHanzo Dev
8d94ad1e03