v0.10.0

ALFIS 0.10.0 — Dead signer keys are now excluded from consensus (RFC-0003)

This is a mandatory upgrade for all nodes. It changes consensus rules, and the minimum peer version is raised to 0.10.0 — nodes running 0.9.x and older will be disconnected from the network.

Why

Release 0.9.0 (RFC-0002) taught the chain to heal: when a full block could not collect its four signatures because the drawn signer keys were dead, a standby pool completed the lock after a timeout. Healing works — but it treated the symptom. The signer draw is weighted by all-time activity, so keys whose operators disappeared years ago kept being drawn for every new block, and the chain kept falling into the 3–5 day healing wait on nearly every domain registration.

Measured before this release: of the 16 keys eligible for the signer draw, about 7 are dead, carrying ~30% of the draw weight. Roughly every second block stalled.

What changes

Every healed lock window is now treated as on-chain proof of absence. The drawn signers that produced nothing during the entire stall — at least five publicly visible days, while the whole standby pool watched — are considered dead and are permanently banned:

• they are never drawn as signers again;
• they are skipped in the standby (healing) pool rankings, so living keys move up.

The ban list is computed by every node from chain data alone — there are no new messages, block fields, or configuration, and no one can ban a key by any means other than that key's own silence. Two safety valves bound the mechanism: bans stop while fewer than 10 eligible keys would remain (BAN_POOL_FLOOR), and a draw always sees at least 8 candidate keys (BAN_DRAW_MIN), so signer selection can never deadlock.

A key that signed even once during a stalled window — however late — is credited as alive. Banned keys keep all domain rights: registration, renewal, and transfer are untouched. Full details, rationale, and security analysis: RFC-0003 (Russian version).

Effect on the current chain

The rules activate at block 22529. The July 2026 stall already crystallized the first ban batch — the four long-dead keys that caused it (4116…, 1502…, 9A46…, B7FB…, silent since June 2026 or longer) are excluded from the very first draw after activation. Dead weight in the draw drops from ~30% to under 6%, and domain registrations should again lock in minutes instead of days.

For node operators with signer keys

Nothing new is required of you — except what was always expected: keep your node running. A drawn signer that stays silent through an entire healed window (5 days, or 3 in the degraded regime) is banned permanently. Your node logs a warning and shows a UI notification whenever a ban crystallizes. You can audit the ban state of your local database at any time:

cargo run --example ban_check

Other changes in this release

• KeysBanned event: ban crystallizations are reported in the log and the GUI — they never happen silently.
• Fixed release packaging: Linux/deb artifacts no longer drop a zero patch component from the version (v0.10.0 is no longer shortened to v0.10).
• Minimum peer version raised to 0.10.0.