darwin v0.3.11+ds.2

The darwin client v0.3.11+ds.2 for Linux x86_64 (Ubuntu 24.04 or newer).

Built from 86570fa by the Build workflow (run 40586891290), and published once that run and the commit's Test run had passed.
Check the archive with: sha256sum -c SHA256SUMS.txt

The archive holds darwin, LICENSE-MIT and LICENSE-APACHE, plus THIRD-PARTY-NOTICES.txt and RUST-STD-COPYRIGHT.html with the licences and copyright notices of the third-party code in the binary and of the tools used to build it.

What changes

This release changes how uploads pay and resume. Prices and quotes don't change: uploads are still planned and paid at the full amount, and the settlement version stays 1. What changes is how a payment is recorded, shared and reused, so that an interrupted upload pays for each record once.

This release was tested against darwin-node 0.23.0+ds.17, whose full nodes decline to quote a pointer they don't hold; its pointer-write check counts the nodes that quote. Against older nodes the check changes nothing.

Upload checkpoints: a format of their own

• The format. A checkpoint keeps its path and name, and now starts with DSCK and a format byte, then its body in msgpack. An earlier client reads the whole file as msgpack, fails, and stops with an error instead of paying again.
• Paid proofs are kept beside a native checkpoint, in <stem>.proofs, appended once each instead of rewritten at every step. A record cut off at the end of the file, as after a crash, is left out and written anew. A proof file that is missing, or shorter than its checkpoint records, refuses the checkpoint.
• Older checkpoints still load. A native msgpack checkpoint is migrated when it is opened: its proofs are written to a new proof file first, and the old file is replaced only once the new one is complete.
• Browsers. The browser core still hands on_checkpoint a string, now the checkpoint's bytes as base64: store it as text, as it is, and pass it back to resume. It also takes the bytes as a Uint8Array or as hex, and reads the JSON text earlier browser clients saved.
• Restoring a saved plan. A plan is reused only if its amounts equal one of exactly two recomputations from its signed quotes: the full amount, or the amount weighted for the size of its own data. A plan at neither is dropped and quoted again. A plan named by a pending payment attempt is never dropped or quoted again: it is settled exactly as recorded, from its journal and the chain. When saved plans are checked, the whole checkpoint is refused only for bad signatures or identities, or for a pending attempt that can't be checked (a missing or damaged proof file refuses it too, as above); the error then names the file and says not to delete it. One bad unpaid plan doesn't discard paid proofs.
• For servers: upload_checkpoint_files lists a checkpoint's files, for removing what ended uploads leave behind.

Shared payment waves

• One transaction for small payments. Payments of fewer than 64 records, from uploads paying with the client's own wallet, join that wallet's open wave, which pays every member's quotes in one transaction. A wallet still has one transaction in flight at a time.
• When a wave is sent: once it is full, once it holds every upload the client has in progress, or 500 ms after it opened.
• No record is quoted twice. Every file in a wave records the wave's journal before anything is signed for it, and no file in the wave is quoted again until that transaction is confirmed, reverted or replaced. A resume reconciles the wave's transaction before any file pays again.
• Each file's own record. A file's payment, proofs and envelope payment record show only its own quotes and amount, and its share of the gas.
• For higher rates, use one wallet per worker. Shared waves help one wallet's many small uploads; separate workers paying from separate wallets don't share waves.

Paid proofs are kept until stored

• No age limit on paid proofs. A paid single-node proof is kept until its record is stored, as darwin-node accepts an old paid quote. Quotes not yet paid keep their age limit, and merkle proofs their one week.
• Reused on resume while the node that was paid is among the 20 nearest storers in the fresh lookup the resume already does. Other storers are tried first.
• Paid again only when needed: when that lookup puts the paid node outside the 20, or the payment is missing or reverted on chain, or every storer tried refuses the old proof. So an upload never stalls on an old proof.
• At most once. A record is paid again this way at most once across all runs, marked in its checkpoint before the new payment is sent. A proof this run paid, or settled from its journal, is never paid again. While the payment's vault record can't be read, or where the client reads no such record at all (a browser build, or a client with no payment network), the proof is kept and the record fails with a message saying why. A browser that held the paid node off, or couldn't reach it, keeps the proof and leaves the decision to the storers.
• Cleaning up. Proofs are deleted with their upload. Checkpoints and cached receipts that nothing has touched for 30 days, and that hold no pending payment, are removed.

Pointer writes: nothing paid unless five of the seven can take the write

• Native and browser clients count the nodes that quoted a pointer's state before paying, and stop before anything is paid when fewer than 5 of the 7 in its close group did. 5 of 7 is the pointer's write quorum. With darwin-node 0.23.0+ds.17, a full node declines to quote a pointer it doesn't hold, so the count is of the nodes that can store the write.

The listings reader asks Robinhood's RPC first for logs

• On the bundled network, the listings reader's log queries go to Robinhood Chain's RPC first and ordofi's last, which answered payment reads busy or too late in October 2026. Other calls keep PublicNode first.
• A "busy" answer (JSON-RPC error -32005) to a log query from ordofi, which gives it to a query over a wider span than it serves, fails that query alone and holds nothing off; the query goes on to the next provider. From any other provider it holds that provider off, as before.

Also in this release

• darwin listings serve's census keeps each node's browser (WebRTC Direct) addresses, read from the node's signed address record.
• The vendored ant-protocol holds darwin-node's functions for pricing by record size. Nothing in this release plans or pays with them: the checkpoint's restore uses them only to recognise a plan saved at a record's weighted amount.
• THIRD-PARTY-NOTICES.txt lists ant-listings, the vendored copy of darwin-listings, with its licence and source again.

Library users: ant-protocol from the same tag

As in v0.3.11+ds.1, a project that uses ant-core takes both lines below, with the same tag:

[dependencies]
ant-core = { git = "https://github.com/Project-DSpace/darwin-client", tag = "v0.3.11+ds.2" }

[patch.crates-io]
ant-protocol = { git = "https://github.com/Project-DSpace/darwin-client", tag = "v0.3.11+ds.2" }

With the devnet feature, also repeat the webrtc patch from darwin-node at the rev in the tag's Cargo.toml.

Releases

• This release is published only after the tagged commit's Test run (the end-to-end and browser tests, against darwin-node at its pinned revision) and its Build run on main both passed.
• Going back. A revert is a re-pin to v0.3.11+ds.1, under the same pause used to move to this release: a service that takes ant-core by tag pauses its uploads, sets both lines' tags back, and resumes.
• Finish interrupted uploads first. If you used the darwin CLI for an upload that was interrupted, finish it with this release before downgrading. An earlier client stops with an error on this release's checkpoints rather than paying again.
• Checkpoints. A checkpoint that holds a pending payment attempt is never deleted, and a journaled payment attempt is never quoted again.