v0.9.0

[Revertron]

Alfis 0.9.0

⚠️ This is a breaking release. The consensus rules changed, so 0.9.0 nodes
are not compatible with 0.8.x and older. Every node operator must upgrade —
the minimum accepted peer version is now 0.9.0, and older nodes are disconnected
from the swarm. Please update as soon as you can.

Two big things landed in this release: a brand-new native GUI that replaces the
old resource-hungry web interface, and self-healing — a consensus change that
lets the network recover on its own when too few of a block's signers are online.

---

🖥️ A new native GUI (goodbye, web view)

Until now the desktop interface was a WebView: Alfis embedded a full HTML/JS UI and
handed it to the operating system's browser engine to render. It worked, but it was
heavy — it dragged an entire web stack into the process just to show a list of domains.

0.9.0 replaces it with a native GUI built on Lumio,
a lightweight retained-mode toolkit that renders directly with OpenGL. The result is
a leaner, faster, snappier app with a much smaller footprint.

What's new on the surface:

• Native rendering — no embedded browser, dramatically lower memory and CPU use.
• System tray icon — Alfis can sit quietly in the tray and keep serving DNS.
• Reworked domain and record dialogs for creating and managing names.

Everything you could do before — create domains, manage records, watch sync and
mining progress — is here, just without the browser engine underneath it. Also fixed
along the way: several UI glitches during sync, including the interface flickering
when peers advertised an incorrect chain height.

---

🩹 Self-healing: the network can recover from missing signers (RFC-0002)

This is the headline consensus change. The full design lives in
docs/rfc/0002-healing-signatures.md; here's the
short version.

The problem. Every full block (a domain registration or renewal) must be locked by
4 signatures from a set of 7 signer keys chosen pseudorandomly and fixed forever
the moment the block is mined. If fewer than four of those specific keys ever come
online, the block stays unlocked forever — there was no timeout, no re-draw, and no
alternative path. The chain simply stalls, permanently. With signing power concentrated
in a handful of veteran keys, this went from theoretical to real.

The fix: healing signatures. After a full block has been stuck for 5 days, the
missing signatures may be supplied by a standby pool of up to 12 keys derived
entirely from chain history:

• 7 anchors — the most productive keys of all time. Practically impossible to grind
  your way into (it takes years of block production to overtake them).
• 5 recent keys — the most active keys of the recent window, an open on-ramp that
  even pure domain-mining keys can enter through genuine activity.

At least one of the counted signatures must come from an anchor key. That anchor
rule, combined with the 5-day wait, is what keeps healing from being abused to fork the
chain across a network partition.

Why this design:

• Fully automatic. No key ceremony, no configuration, no operator action, no new
  message types. Healing signatures are ordinary empty signing blocks — a node holding a
  standby key just starts offering them once the timeout passes.
• Conservative. It completes the existing 4-signature lock rather than inventing a
  new quorum. A healthy network locks blocks in minutes and never touches this path.
• Adaptive. If a chain is clearly operating in the healed regime, the timeout drops
  from 5 days to 3 so throughput isn't throttled unnecessarily.
• Loud on failure. If a genuine irreconcilable fork ever forms, it's now surfaced as
  an error and a UI event instead of being silently swallowed.

The change also tightens three long-standing gaps in the lock machinery (enforcing the
lock on incoming full blocks, capping empty blocks over a locked window, and checking key
strength for empty blocks).

Activation. These rules only apply above HEALING_ACTIVATION_HEIGHT — set to the
currently stuck full block — so no historical block is re-judged. This is exactly why old
nodes are incompatible: they'd reject healing blocks (and everything built on them), so
0.9.0 raises the minimum peer version to keep the network together.

Also included as groundwork: RFC-0001, the design for human-gated emergency recovery
in the catastrophic case where nearly the entire key population is lost — a backstop
behind the automatic healing shipped here.

---

🔧 Other changes

• Updated a large number of dependencies.
• Updated CI and the gui feature wiring for the new toolkit.
• Various small fixes and stability improvements.

---

Upgrading

Just install 0.9.0 and restart. Your keys and blockchain database carry over unchanged.
Because 0.8.x nodes can no longer participate, please upgrade promptly — a stalled
chain quietly costs real domains as their renewal grace windows expire.

---

This discussion was created from the release v0.9.0.