H8 activates at DAA 79,251,000 (Aug 19, ~18:00 UTC). Every node must be running v1.4.9 before then.
Initial sync was broken since H7
Three independent defects stacked on top of each other. Each one had to be fixed before the next became visible.
The service-state transfer had no server. A syncing node asks its peer for the sealed service-bond state that belongs to the pruning point. That request handler was only ever registered for protocol version 7, so every modern peer answered no flow has been registered for message type RequestServiceState and dropped the connection. The syncee's own subscription to the reply was missing too. In practice: no fresh sync had completed since the transfer was introduced. Both sides are now registered for protocol v8 and above.
Audits were re-derived on top of themselves. While catching up, a node folds each chain block to rebuild the service-bond ledger. Blocks below the persisted event frontier carry events the stores already hold, and the cold-start path knew to fold those in warm-up mode — but the incremental path did not. A syncing node therefore re-derived strikes over a baseline that already counted them, the escalation ran away, and it burned entire miner vaults the network had never burned. On a real sync this produced 161 phantom SlashAllPending events; every canonical claim transaction then looked like a spend of a burned escrow, so every chain block carrying one was disqualified and the node wedged.
Burns were applied to blocks that predate them. The set of burned escrow outpoints carried no timestamp, so a burn was treated as binding for every point of view, including those before it happened. A live node never notices — its set only fills as the chain advances — but a node replaying history with rows already in hand rejects claims the network accepted. Burns are now bound to the score at which a live node flushes them, which is exactly where the network began enforcing them.
Alongside these, the sealed service state now ships the handoff band above the pruning point: the events a fresh node cannot re-derive on its own, because their cohort windows reach into history it does not retain. Peers must be on v1.4.9 to serve it, so a fresh sync now requires an upgraded peer and fails cleanly instead of wedging later.
H8 — the inference reward goes to whoever answers
Until now the reward of an inference request was locked to an escrow key the client picked, from a list of miners currently serving that model. Whichever key the client chose collected the reward, whether or not that miner was the one who answered — and if the designated miner stayed silent, the reward stayed locked until it expired.
From the gate, a request locks its reward in a keyless vault output, and the coinbase mints it to the first miner whose response the chain accepts. No designation, no favouritism, nothing to route. A request that nobody answers within the horizon has its reward burned.
H8 — a request can no longer be unanswerable
Request identity was the digest of the payload, which carries nothing unique: the same prompt, same model, same parameters is the same identity. A retry, a second user asking the same question, or a bot would produce a repeat — and each repeat opened a new audit that nobody could answer, because responders dedupe on that identity and the identical response is already on chain. Whole cohorts were struck for assignments that could not be served. Measured on one request over six hours: 29 repeat acceptances, 33 miners struck.
Two changes close this. A request is now identified by the transaction id of the AiRequest, unique by construction. And the ledger remembers the identities it has already admitted for about 24 hours, so a repeat is ignored instead of arming a second audit.
Miners must run v0.4.9 before the gate — the node and the miner have to agree on what a request is called, or answers stop being credited.
Also in this release
- Expired suspensions are no longer reported as active. The strike table returned every suspension ever recorded, so a miner whose production had resumed still appeared suspended on the tracker. Enforcement was always correct; only the report was wrong.
--rocksdb-no-blob-filesstores large values inline in the LSM instead of dedicated blob files. Existing datadirs stay readable and drain over time, no resync needed. It increases write amplification — an operational fallback, not a recommended setting.