v0.9.3-l

What's Changed

• Canonical full-drain stake Split: one branch A for every activation status by @DavidB-77 in #45
• Changelog: 0.9.3-l by @DavidB-77 in #46

Full Changelog: v0.9.3-k...v0.9.3-l

What's Changed

• Canonical full-drain stake Split: one branch A for every activation status by @DavidB-77 in #45
• Changelog: 0.9.3-l by @DavidB-77 in #46

Full Changelog: v0.9.3-k...v0.9.3-l

v0.9.3-k

What's Changed

• README: add Ecosystem section linking the standalone libraries by @DavidB-77 in #42
• Live-parity port: canonical stake Split, runtime sysvars, armed vote threshold, ingest hardening by @DavidB-77 in #43
• Changelog: 0.9.3-k by @DavidB-77 in #44

Full Changelog: v0.9.3-j...v0.9.3-k

v0.9.3-j

What's Changed

• chore: remove development references from source comments by @DavidB-77 in #39
• fix(produce): route block production through the single golden ladder by @DavidB-77 in #40
• docs: changelog for 0.9.3-j by @DavidB-77 in #41

Full Changelog: v0.9.3-i...v0.9.3-j

v0.9.3-i

What's Changed

Fixed

• Consensus: the live vote executor propagates allocator failure instead of reporting it as success. 0.9.3-h described this fix, but the released code did not contain it — the seven affected paths were still returning success. A dropped account write carries that account's lattice-hash delta, so losing one froze the slot with a missing contribution and produced a bank_hash no other node would agree with.
• Block production: the cache of recently committed signatures is now populated on the parallel replay path as well as the serial one. It was previously populated only by the serial path, so with parallel execution selected it stayed empty and the producer's already-processed check never refused a candidate.

Changed

• Block production: a leader slot packs for the whole slot rather than taking a single batch. Two new environment variables bound the work — VEX_PACK_BUDGET_MS (default 60) and VEX_PACK_MAX_SCAN (default 100000). Both have working defaults and need not be set.
• Consensus: the vote-threshold percentage is computed in 128-bit arithmetic. The multiply by 100 overflowed 64 bits above roughly 184.5 million SOL of cluster-voted stake. The path is currently reached only with a zero operand, so no incorrect threshold has been computed.
• Build: the production optimize mode is ReleaseFast, changed from ReleaseSafe. Note that the --release= value on the command line is inert — build.zig pins the mode — though omitting the flag still yields a Debug build. Binary size cannot detect the mistake, because a Debug binary is smaller than a ReleaseFast one. Verify from the artifact: strings <binary> | grep -c "reached unreachable code" must be 0.

Removed

• Two .orig files — pre-fix copies of two consensus sources, about 1.0 MB — were tracked alongside the fixed originals and have been removed.

Transaction-bearing block production remains gated in this release. The two block-production items above remove defects on that path, but the remaining production-path work is not included here. VEX_TXBEARING_BROADCAST should stay off.

Full Changelog: v0.9.3-h...v0.9.3-i

v0.9.3-h

What's Changed

• Four consensus-correctness fixes: strict ed25519, BLS PoP compute units, epoch-boundary allocation failures by @DavidB-77 in #37
• changelog: cut 0.9.3-h by @DavidB-77 in #38

Full Changelog: v0.9.3-g...v0.9.3-h

v0.9.3-g

What's Changed

• fix(afxdp): return copy-path RX frames to the UMEM free reservoir by @DavidB-77 in #35
• changelog: cut 0.9.3-g by @DavidB-77 in #36

Full Changelog: v0.9.3-f...v0.9.3-g

v0.9.3-f

What's Changed

• chore(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @dependabot[bot] in #30
• chore(deps): bump github/codeql-action/upload-sarif from 4.37.2 to 4.37.3 by @dependabot[bot] in #31
• docs: move cosign bundle-format fix into 0.9.3-e changelog section by @DavidB-77 in #32
• fix(lthash): use the account's real pre-state executable flag by @DavidB-77 in #33
• changelog: cut 0.9.3-f by @DavidB-77 in #34

Full Changelog: v0.9.3-e...v0.9.3-f

v0.9.3-e

What's Changed

• release: sign release binaries with cosign keyless, attach as assets by @DavidB-77 in #27
• changelog: cut 0.9.3-e by @DavidB-77 in #28
• release: fix cosign signing step for bundle format (v4 default) by @DavidB-77 in #29

Full Changelog: v0.9.3-d...v0.9.3-e

v0.9.3-d

Fixed

Consensus — --wait-for-supermajority restart gate stake accounting.

The restart gate's observed-stake calculation now excludes gossip peers whose shred version differs from
the expected one, matching Agave's shred-version-pure stake accounting.

Previously the gate summed stake for every staked node identity present in gossip regardless of shred
version. During a coordinated cluster restart — precisely when the gate is load-bearing, and when the
shred version changes — this counted nodes still on the pre-restart chain toward the new chain's
supermajority, over-reporting observed stake and risking the gate resuming before real supermajority was
reached.

Validated during a live testnet coordinated restart against an Agave reference node and independent RPC
ground truth: observed stake moved from a ~21-point overcount to within ~2 points of both references.

No-op when --expected-shred-version is unset, so non-restart boots are unchanged.

The version-report string (gossip client-id advertisement and boot banner) now reads 0.9.3-d.

What's Changed

• restart-gate: filter gossip stake numerator by shred version by @DavidB-77 in #25

Full Changelog: v0.9.3-c...v0.9.3-d

What's Changed

• restart-gate: filter gossip stake numerator by shred version by @DavidB-77 in #25
• changelog: cut 0.9.3-d by @DavidB-77 in #26

Full Changelog: v0.9.3-c...v0.9.3-d

v0.9.3-c

Fixed

• Consensus/replay: fixed a livelock between the fast-wake and far-ahead deferral gates that could recur when the last-frozen slot moves non-monotonically (out-of-order catch-up churn). The far-ahead gate is now keyed on a monotonic high-water mark of the highest slot ever frozen, so it can no longer contradict a parent-frozen fact the fast-wake gate already certified; the far-ahead deferral path no longer re-triggers fast-wake. Covered by a known-answer regression test pinned to the incident's exact slots.

Changes

• Housekeeping: removed internal-repository path references and legacy pre-rename naming from source comments, a diagnostics log banner, and build test-step descriptions. No behavior change.
• Version-report string (gossip client-id + boot banner) now reads 0.9.3-c.

What's Changed

• docs: trim README Attribution/Acknowledgments; verify metrics current by @DavidB-77 in #18
• docs: condense Live-proven capabilities and Conformance sections by @DavidB-77 in #19
• ci: OpenSSF Scorecard, dependency-review, tag-push releases, SHA-pinned actions by @DavidB-77 in #20
• ci: wire fuzz harnesses into build.zig + PR smoke workflow by @DavidB-77 in #21
• fix: fuzz runner exits non-zero on crash found by @DavidB-77 in #22
• ci: least-privilege workflow tokens; vendor: patch blst CVE-2026-2681 by @DavidB-77 in #23
• v0.9.3-c: fix chain-defer fast-wake/far-ahead recursion; public-repo hygiene scrub by @DavidB-77 in #24

Full Changelog: v0.9.3-b...v0.9.3-c