feat(sysio.system): derive producer rank from a score, and demote on missed rounds (WIRE-367)

[heifner]

Closes WIRE-367.

Producer rank stops being a governance write and becomes position in a score-ordered index, and producer pay stops being a per-round threshold and becomes per block produced. A candidate could already complete every self-service step — authex link, regoperator, collateral deposit, regproducer, regfinkey — reach OPERATOR_STATUS_ACTIVE, and still never be scheduled, because producer_info.rank was written only by setrank / setprods / setprodkeys, all require_auth(sysio). With sysio@active moving to a node-owner msig, every producer add/remove/reorder would have become an msig round.

The on-ramp this completes

A stranger can now bond on Ethereum and Solana and be scheduled as a block producer, with no
vote, no sysio@active action, and nobody's approval. That is the point of the PR; everything
below is what it took. The whole path is self-service — regoperator requires only the account's
own signature, and only the bootstrapped flag needs the registry's authority:

1. sysio.authex::createlink on each chain, so a deposit made on an outpost is attributable to the
   WIRE account.
2. sysio.opreg::regoperator(account, OPERATOR_TYPE_PRODUCER, is_bootstrapped = false), self-signed.
3. Bond on the outposts themselves — OperatorRegistry.deposit on Ethereum, the outpost
   program's deposit instruction on Solana, each signed by the operator's own wallet. The
   deposits ride OPP to the depot, credit sysio.opreg, and once every required chain is at its
   minimum the operator flips ACTIVE and is rescored on the bond it actually posted.
4. regproducer + regfinkey, self-signed.
5. The next ranked rebuild schedules it by position. No further action by anyone.

flow-producer-registration drives exactly that path against real outposts, and carries both
controls that make it meaningful: it registers the producer and its finalizer key before any
collateral and asserts that no schedule — active, pending or proposed — ever names it, so entry
is demonstrably driven by the bond rather than by registration; and at the end it withdraws the
whole Ethereum bond and asserts the producer leaves the schedule, the same mechanism in reverse.
In between the account starts its own node, enters the ranked schedule and produces a real block,
which is also the first end-to-end coverage anywhere of regfinkey → set_proposed_finalizers
(every other cluster installs finality directly at genesis).

New in this PR: docs/becoming-a-block-producer.md — the
operator-facing guide to that path, covering the six steps, how rank is scored, how pay works, and
how demotion and recovery behave.

What changed

• rank_score replaces rank — two tier bits (healthy / bootstrapped / demoted) over one weighted composite. Adding a scoring factor is a new weight field on the prodscorecfg singleton, never a re-layout of an unbounded table. setrank and assign_producer_ranks are deleted.

• Three live factors — collateral (linear, uncapped, min across the required pairs, computed on the operator's posted balance rather than available(), so a free withdraw / cancelwtdw pair cannot oscillate a score), participation, and snapshot attestations. Snapshot ships at a tenth of the collateral weight: at parity one quorum attestation moved the composite by as much as an entire minimum bond, so among producers bonded near each other the credit decided the top-21 boundary and the pay-period reset decided it back, proposing a schedule and a finalizer policy each way for no change in real standing. Snapshot service should separate producers the collateral term has left tied, not outrank collateral. relay / api / benchmark ship at weight 0 pending an attestation path.

• Missed rounds is a separate model, not just a factor, and its gates mirror the batch operators'. The existing counters record presence only, so absence left no trace; onblock now walks the active schedule between the previous block's producer and this one's and records every scheduled round as produced or missed. Two gates demote, the same pair sysio.opreg::termcheck applies to batch operators: a consecutive run (max_consecutive_missed_rounds, default 3) and a miss rate over a rolling window (max_pct_missed_rounds_in_window, default 5, over missed_round_window_ms, default 24h). A round counts against the rate gate two ways — it produced nothing, or it came up short: below min_blocks_per_round (default 6 of 12) the producer delivered a fraction of a window it was holding, which reads as fully available under a whole-window rule. Only the rate gate sees short rounds; the consecutive gate stays reserved for rounds that produced nothing, so a total outage is still caught within three rounds while a degraded node is given the window to recover in. The block count is the difference between the round's first and last block heights, both already in the header onblock deserializes, so the eleven-of-twelve blocks that do not change producer do no extra work. The rate gate arms only once the window holds enough rounds for the percentage to mean anything, and that minimum sample is derived from the two settings (max_consecutive × 100 / max_pct — 60 rounds at the defaults) rather than configured separately, so it cannot be set to a value the consecutive gate would already have caught. Demotion sets a tier no amount of collateral can climb out of.

  There are two doors back and no cooldown or expiry on either: producing a block while still scheduled, and regproducer for a producer the schedule has dropped. Producing is the one that matters, because demotion and rescheduling are not simultaneous — when demotions drop the schedulable count below min_schedule_size the rebuild retains the last good schedule, so the demoted producers keep producing under it, and without this they would earn nothing until every operator pushed regproducer by hand. A mass outage is exactly the case that produces it. regproducer clears the demotion and the window but deliberately not the consecutive streak: it costs nothing but a signature and may be repeated, so clearing the streak there would let an offline operator cron its way back to healthy after every second miss without ever producing a block. Resetting the window is safe for the same reason — the consecutive gate is what defeats the cron loop, and a demoted producer is not scheduled, so it observes no rounds and its rate could otherwise never improve.

• Two predicates, not one. is_schedulable — active row, ACTIVE PRODUCER operator, active finalizer key — governs ranking, pay and snapshot-provider eligibility. is_eligible_operator drops only the finalizer-key requirement and is what peer discovery walks: a producer scheduled through setprods produces blocks and needs the BP gossip mesh whether or not it has registered a finalizer key yet, so hiding it from getpeerkeys would cut a live producer out of that mesh. getpeerkeys also seeds from the chain's own active schedule before it walks the index, so a producer the min_schedule_size floor retained through a demotion — producing blocks from the demoted tier — stays in the mesh it is still serving. Previously the four consumers disagreed pairwise, each taking the first N index slots; each now counts schedulable entries while walking. Making emissions honour the finalizer-key check is a behavioural fix: a producer that can never be scheduled should not draw top-21 pay.

• The walks are bounded by construction, not by trust. regproducer is permissionless, so the table is unbounded and every walk needs a reason to stop. producer_rank::compute gives it one: a producer with no active finalizer key, or a non-bootstrapped one whose bond is below the live collateral minimum, scores into the demoted tier, which sorts last — so a walk that breaks on the first demoted row has already seen every schedulable producer, and a max_rank_walk_rows cap backstops it. Reading the live minimum rather than the stored status is what makes a raised requirement bind: setconfig re-evaluates nobody, so an operator left ACTIVE under the old bar would otherwise stay scheduled and paid indefinitely. It keeps its ACTIVE status and can top up — it simply stops being rankable until it does, and the raise itself opens the sweep that carries the new minimum across the table. Bootstrapped producers are exempt here exactly as they are in meets_role_min: ACTIVE by fiat, with no bond to measure.

• The demoted tier is a claim about LIVE standing, and every event that ends a producer's standing now rescores it. unregprod rescores in the same action; sysio.opreg dispatches its processprod notification from slash and terminate_inline as well as on every balance change. Before this, a parked, slashed or terminated producer kept its healthy-tier key until some unrelated event happened to rescore it — skipped by every walk but visited by all of them, and contradicting the invariant the walks are bounded by.

• Bounded rescore drain. A weight change (setscorecfg) or a producer collateral-minimum change invalidates every stored score at once, so rather than rewrite an unbounded table inline, onblock drains a bounded cursor inside the 120-slot throttle it already pays for. sysio.opreg::setconfig notifies sysio.system on the same channel processprod uses, and the handler opens the sweep the moment the action lands.

  The rebuild does not wait for the sweep. Ranking is allowed to converge: while the cursor drains, the index carries scores from two configurations and a producer can be ordered by one the current weights would not give it, which self-corrects within a few ticks. Deferring instead is what is unsafe — the sweep's length scales with the table, regproducer is permissionless, and its RAM is billed to the contract, so waiting would let anyone hold both the schedule and the finalizer policy frozen for as long as they kept registering, during which a slashed or terminated producer keeps its slot and its finality weight.

  The sweep re-derives the demotion flag for the rate gate only, so a lowered rate limit reaches windows that already breach it — a producer off the schedule observes no rounds, so its recorded rate can never improve on its own. The consecutive gate is deliberately not reconciled: regproducer clears the demotion but preserves the streak, so re-deriving that gate would re-demote a pardoned producer with no new miss, and — unscheduled — it could never produce the block that is its only other door back. Every later sweep would undo regproducer again. The gate loses nothing by waiting, since a lowered limit binds on the producer's very next missed round.

• onblock pays only for what moved. The round path rescored unconditionally — two cross-contract sysio.opreg reads apiece, up to 21 times on a block that follows an outage — even when no scoring input had changed. It now rescores only when the streak, the demotion flag or the snapshot credit actually moved, and producer_info::set_demoted makes consuming the period's snapshot credit a property of the transition rather than of one call site, so the three places that raise the flag cannot diverge again.

• setscorecfg validates. Ten governance-tunable fields previously took anything. The one that mattered: max_consecutive_missed_rounds = 0 reads as "disable the consecutive gate" and instead collapsed the rate gate's derived minimum sample to zero, demoting every producer on its first missed slot and dropping the schedule below its floor chain-wide.

• Also: opreg::deposit rejects bootstrapped operators (matching depositinle), regoperator re-evaluates eligibility so a score is correct from registration, and termcheck records why an indefinitely-demoted producer stays demoted rather than being terminated.

Producer pay is per block produced

The old model paid a producer for a round in which it made at least min_blocks_per_round_for_pay (6) of 12 blocks, and paid nothing for the rest. That threshold is gone, along with eligible_rounds, current_round_blocks, last_block_num and the global total_unpaid_blocks. onblock now does one thing: increment the producer's unpaid_blocks.

payepoch splits the producer pool into an active slice and a standby slice (standby_bps, a new emitcfg field, default 800):

• Block pay is active_pool × blocks / divisor, where the divisor is the period's nominal slot count raised to the blocks actually produced when a period runs long. A missed block is simply not counted, so its pay stays in the treasury rather than being redistributed to whoever did show up — the rate does not depend on who produced. When the integer division rounds a producer's block pay to zero, the blocks are not consumed: they carry to the next period rather than being silently zeroed, so a producer whose share rounds away in a thin period accrues instead of losing it.
• Standby retainer — positions 22 through standby_end_rank draw a fixed per-position share of the standby slice, decaying linearly from position 22. A vacant position pays nobody.
• Nothing is ever forfeited. A producer that is not payable when the walk reaches it — parked, keyless, slashed, terminated, demoted — is neither paid nor reset, and keeps its block count for the first payepoch at which it is payable again. Unregistering right after producing and re-registering before the next round costs nothing.

Two consequences worth knowing. The period's snapshot credit is consumed at the moment a producer leaves the walk — unregprod and demotion each clear it — rather than being inferred on re-entry, because a tier transition cannot distinguish a stale credit from one earned since; the miss streak deliberately survives both, so leaving and re-entering cannot dodge a demotion. And blocks carried across periods are paid at the later period's rate and enter that period's divisor.

One shape is deliberate and worth stating plainly: a miss short of demotion still costs a producer its schedule slot if the penalty drops it below the active set, and the streak clears only by producing — so a displaced producer holds the penalty until it acts. Enough additional collateral outranks it, and producing clears it outright. That is the intended behaviour rather than an oversight: a producer that missed is worth less than an identical one that did not, and the way back is an explicit assertion of readiness rather than the passage of time.

Test cost

Making producers schedulable made the snapshot-attestation fixture expensive: with finalizer keys registered, update_ranked_producers proposes a five-finalizer policy and the node signs plus verifies a vote on every block of the block_spacing advance. The fixture now takes a cadence-period count and builds that history in its constructor — before the system contract is deployed and before any key is registered — so those blocks run no contract code under the one-finalizer genesis policy. The suite is also its own ctest entry, so the other cases no longer queue behind it.

	before	after
whole binary, single ctest entry	2337s	—
CI form, parallel wall clock	—	950s (636 + 950)
margin vs the 2700s TIMEOUT	1.16×	2.84×

WIRE-382 tracks making block_spacing configurable, which retires the advance entirely in all three binaries that pay it.

Validation

• contracts_unit_test 715 cases and contracts_snapshot_attest_test 37 cases, the two ctest entries being exact complements of the binary's 752.

  The review round is covered by cases of its own: pay that rounds to zero keeps its blocks, a miss RATE demotes without a consecutive run, raising the collateral minimum sinks the producers now below it, a bonded producer without a finalizer key holds no rank, slash and termination sink the key at once, producing while still scheduled clears a demotion, and getpeerkeys returns every scheduled producer. Three more cover the second round: a config sweep does not undo regproducer (the lockout above, checked every ten blocks through the drain rather than at the end, because the window where the producer is still unscheduled is narrow and an end-of-run check passes straight over it), setscorecfg rejects a configuration that inverts the rate gate, and rmvproducer sinks the key and consumes the credit.

• producer_rank_test on a live 5-node cluster, extended here to cover demotion and recovery — what a single-process contract test cannot reach. It stops a scheduled producer's node and asserts demotion at exactly the threshold with no miss charged to the producers that kept going, asserts the min_schedule_size floor retains the demoted producer rather than publishing a short schedule, then restarts the node and asserts producing a block clears the demotion. Observed: demotion 80s after the outage began, recovery 19s after relaunch.

• e2e gate 33992129110 on this head: 15/15 flows green, including producer-registration and emissions-soak — the latter being where genesis producers newly drawing producer pay would have surfaced.

Stack

Merge first. Downstream, in order:

1. chore(sdk-core): regenerate SysioContractTypes for the producer-score ABI (WIRE-367) wire-libraries-ts#80 — regenerated ABI types
2. feat(cluster-tool): per-producer finalizer keys, genesis producer registration, and the producer-registration flow (WIRE-367) wire-tools-ts#94 — harness + the producer-registration flow

Note for whoever merges: this repo's ruleset requires approval from the cicd team specifically; other approvals do not unblock it, and auto-merge is disabled repo-wide.

[huangminghuang]

[P1] Re-registration can erase every missed round without proving liveness

The existing-row upsert clears both is_demoted and consecutive_missed_rounds on every regproducer or regproducer2 call. Both actions are repeatable with only producer authorization and accept the same key, so an offline but transaction-capable operator can resubmit after every one or two misses, or immediately after demotion, and restore the healthy tier without producing a block. That bypasses the core demotion mechanism indefinitely. Please make block production the only way to clear the streak, or introduce a recovery state, proof, or cooldown that cannot be reset repeatedly.

[huangminghuang]

[P1] Residual on b569e00: re-registration still erases the miss-rate evidence\n\nThe latest change preserves consecutive_missed_rounds, but every repeatable regproducer/regproducer2 still zeros rounds_in_window, missed_rounds_in_window, and miss_window_open_ms. A producer that alternates misses with produced rounds, or chronically delivers short rounds (which do not advance the consecutive streak), can re-register before the minimum rate sample and remain eligible indefinitely. Please reset the window only on a genuine demoted-to-recovered transition, not on an ordinary active-row upsert.

[heifner]

Confirmed and fixed in 4fce5f4 — and it was worse than described. Short rounds feed the rate gate ALONE (a short round deliberately does not advance the consecutive counter), so a producer delivering a fraction of every round accrues evidence only in the window, and a free repeatable wipe left none of it. The cron loop the streak was protected from applied in full to the rate gate.

The window now resets only on a genuine demoted-to-recovered transition. Two tests: regproducer_does_not_launder_the_miss_window drives the actual loop — alternate miss/produce, re-register after each — and asserts the gate still fires; regproducer_clears_the_window_of_a_demoted_producer pins the reset that IS kept, since a demoted producer is unscheduled, observes no rounds, and could otherwise never improve its recorded rate.

[huangminghuang]

[P1] Healthy-tier rows do not bound these scans

An ACTIVE producer operator remains in the healthy tier even without a finalizer key, so this loop can skip an arbitrary number of bonded but unschedulable rows before finding 21 producers. Producer admission is permissionless and max_available_producers is stored but not enforced. The same assumption appears in payepoch, which walks every non-demoted row. Enough such rows can exhaust action CPU during the periodic onblock rebuild or inline epoch payout. Please enforce a hard safe bound on active candidates or paginate and decouple these walks.

[huangminghuang]

[P2] The new hard ceiling makes debt beyond row 500 permanently unreachable\n\nThe CPU bound fixes the unbounded scan, but every payepoch restarts from prodrank.begin(). Registration/ACTIVE producer count is not otherwise capped, so a producer can earn blocks while top-21 and then be displaced below row 500 before payout. While ordering stays stable, no later payout reaches or clears that earned debt; retaining unpaid_blocks therefore does not provide eventual settlement. Please paginate with a persistent cursor or settle block debt through a separately bounded index.

[heifner]

Confirmed, and accepted with the promise corrected rather than the bound changed.

The reasoning is economic: a producer bonded and unpaid does not stay bonded — the capital moves to where it earns — so a standing population of 500+ ranked-but-unpaid producers is not a state the system settles into. Past what is paid there is nothing to look at.

Worth separating out the common case, which is not rank at all: a temporarily unschedulable producer (key rotation, transient opreg UNKNOWN) sits in the demoted tier that the walk breaks at, and its carried blocks settle at ANY position once it is schedulable again. The genuinely unreachable case is narrower than the general one — earning while top-21, then being displaced 500+ positions before the next payout, which needs a mass onboarding between two payouts rather than a slide.

So 4fce5f4 drops the "nothing is ever forfeited" claim from the operator guide. It now says blocks produced are not forfeited, and states plainly that settling held blocks requires being back within the pay walk's reach.

[huangminghuang]

[P1] Preserve actual schedule members in peer discovery

This result is based only on eligible-operator rank, not the active or pending schedules. A producer demoted but retained by the four-member schedule floor is omitted even though its next block is supposed to clear demotion. Conversely, 30 higher-scoring ACTIVE producers without finalizer keys can fill the response even though none can enter the ranked schedule. Because a nonempty cache refresh removes omitted keys, this can evict real scheduled BPs and disable or reject automatic BP gossip. Please seed and deduplicate active and pending schedule members first, then fill remaining capacity with ranked candidates.

[huangminghuang]

[P1] Reevaluate existing operators before activating new collateral minima

setconfig writes the new requirement vectors and only asks sysio.system to rescore. It never reevaluates existing operator statuses. Raising a minimum therefore leaves a now-undercollateralized producer ACTIVE; the score sweep lowers its composite but compute and is_schedulable still trust that stale status, so it can remain healthy, scheduled, and payable indefinitely. Lowering a minimum likewise leaves newly qualified UNKNOWN rows excluded. Please stage the config behind a bounded eligibility sweep or make authoritative consumers check the live minima.

[huangminghuang]

[P1] Residual on b569e00: the live producer ratio fixes only part of this\n\nA raised producer minimum is now caught by producer_score, but compute checks the stored ACTIVE status before evaluating that ratio. Lowering the minimum therefore cannot promote existing UNKNOWN producers. Batch operators and underwriters have no equivalent live-minimum check, so raising their minima leaves underbonded rows ACTIVE and still eligible for epoch selection or underwriter authorization until some balance mutation happens. The config change still needs a bounded status reconciliation or authoritative live checks for every role.

[heifner]

Confirmed on all three counts. The decision for this PR is to accept and document rather than reconcile, so flagging that explicitly rather than marking it fixed.

One correction to the finding, though: the underwriter half is narrower than it looks. sysio.uwrit::try_select_winner refuses any candidate whose LIVE available_via_mirrors does not cover src + dst, so every underwritten leg stays collateral-backed at its real value — the minimum is an eligibility floor, not a capacity control. The exposure that remains is the batch-operator one: an underbonded op keeps serving in groups with a smaller slash-at-risk than governance just set.

Accepted because that exposure is one role in one direction, self-corrects on any balance movement (reevaluate_eligibility fires on deposit, withdraw, withdraw-flush, slash and terminate), and is auditable off-chain by comparing balances against op_config. The operator guide now states that a minimum change binds new registrations immediately and existing operators on their next balance movement, and that a lowered minimum needs a balance touch to take effect.

A bounded reconciliation sweep in opreg following the flushwthdw shape is the right permanent fix for all three roles and both directions — but it is opreg work rather than producer ranking, and deciding what happens to an operator whose status flips mid-epoch deserves its own review.

[huangminghuang]

[P2] Do not publish ranks from mixed score generations

Only 32 primary-key rows are rescored before update_ranked_producers consumes the secondary index. The comment says tiers make the partial state safe, but composite order selects the top 21 and standby positions within each tier. For example, reducing collateral_weight to zero makes the first batch lose that term while untouched rows retain their old inflated scores, so schedules, retainers, snapshot eligibility, and peer ranks match neither configuration for multiple ticks. Please stage scores by generation and atomically activate them after the sweep, or defer every rank consumer until one coherent generation is ready.

[huangminghuang]

[P2] Apply a lowered miss threshold to existing streaks

setscorecfg stores the new max_consecutive_missed_rounds and opens only a score sweep. The sweep recomputes participation, but tier_for still uses the persisted is_demoted flag. A producer whose streak already meets the lower threshold can therefore stay healthy indefinitely, especially after falling outside the schedule where no later missed-round event can flip the flag. Please reconcile streak-to-demotion state during the sweep, with explicit semantics for threshold increases.

[huangminghuang]

[P2] Keep block entitlement when integer pay rounds to zero

A producer with unpaid blocks is added to to_reset even when active_pool multiplied by blocks divided by slot_divisor rounds to zero, so the later reset erases those blocks without crediting anything. A valid 60-second period with a one-unit active pool and 120 nominal slots demonstrates the loss. This contradicts the stated no-forfeiture invariant. Please retain the blocks or carry a per-producer fractional remainder until the entitlement is representable.

[huangminghuang]

[P1] The zero-rounding fix can now over-distribute the active pool\n\nOn b569e00, first-pass-zero rows are removed from slot_divisor but the final loop still pays them if that smaller divisor makes them nonzero. A reachable carried-debt state with nominal_slots=120, active_pool=1, and two payable rows holding 120 blocks each first removes all 240 blocks, obtains a final divisor of 120, and then credits both rows 1: two units of claims from a one-unit pool. Please keep first-pass-excluded rows carried for this payout, or recompute the payable set while enforcing the pool total.

[heifner]

Confirmed — your arithmetic is exact, and this one was mine. Fixed in 4fce5f4: the first pass now DECIDES the payable set and the second only prices it, so a row excluded from the divisor is excluded from payment and its blocks carry to the next payout.

The comment I had written argued for the bug ("a row that crosses back over the threshold is simply paid, which is the outcome we want") without accounting for those blocks no longer being in the divisor. Test a_tiny_pool_never_credits_more_than_it_holds asserts a one-unit pool can never credit more than one unit.

[huangminghuang]

[P2] This withdrawal path cannot release the outpost bonds described above

The guide tells operators to bond on Ethereum and Solana, but sysio.opreg::withdraw is hardcoded to the WIRE balance on WIRE_TOKEN. Following this instruction records an insufficient-balance failure and leaves the outpost collateral untouched. Please direct operators to each holding outpost withdrawal entry point, which then reaches withdrawinle on WIRE.

[huangminghuang]

Additional findings on the current head. These inline comments cover issues not already tracked in the existing review threads; residual issues from those threads are posted as replies there.

[huangminghuang]

[P1] Add an upgrade path for existing producers and global rows

This widens persisted rank from uint32_t to uint64_t in place and replaces the existing producer tail. The same header also removes total_unpaid_blocks from the middle of the persisted global row before appending new fields. KV deserialization is positional, so rows already on chain will consume neighboring bytes as the new fields and/or underflow; onblock reads global immediately, making a populated-chain deployment capable of aborting block processing. Please add an explicit migration or a versioned compatibility decoder rather than reading the old bytes through the new structs.

[heifner]

Nothing deployed, we do not need an upgrade path.

[heifner]

Not adding one, per @heifner above: nothing is deployed, so there are no on-chain rows to migrate. These structs are the initial shape rather than a change to a live one.

[huangminghuang]

[P1] Migrate emitcfg instead of inserting into its serialized layout

standby_bps is inserted before the existing epoch_log_retention_count and pay_cadence_epochs fields. An existing row therefore shifts those two values and is two bytes too short for this decoder. Please use an explicit migration/versioned representation (or an actually compatible tail-extension strategy) before rollout.

[heifner]

Nothing deployed, we do not need an upgrade path.

[heifner]

Same ruling as the sibling thread — @heifner: nothing deployed, so there is no existing emitcfg row whose fields could shift.

[huangminghuang]

[P2] Gate snapshot credit on current schedulability, not only is_demoted

unregprod leaves the provider mapping and is_demoted == false, so the retained provider can still vote and this helper credits an inactive producer. The rescore parks that row below the pay walk, where the counter is never reset, and a later regproducer restores it with service credit earned while parked. Losing the finalizer key or opreg eligibility has the same lifecycle. Please test/gate the live schedulable predicate here, or consume credit on every transition out of the walk.

[heifner]

Fixed in 4fce5f4 — you are right that is_demoted was the wrong predicate. unregprod parks a row by clearing is_active and letting the rescore sink it by TIER, so the flag stays false and every parked producer was still credited; losing a finalizer key or opreg eligibility did the same. The gate is now producer_rank::is_schedulable against the live row.

Test a_parked_producer_earns_no_snapshot_credit (991f955) parks a producer, keeps it voting into a quorum, and asserts it earns nothing while the still-schedulable producer is credited.

[huangminghuang]

[P2] Preserve nominal slots across epoch-duration changes

This applies the current epoch duration to every epoch accrued in the open pay period. For example, a two-epoch period containing a 60-second epoch (120 slots) followed by a 120-second epoch (240 slots) has 360 nominal slots, but this computes 480 and pays only 75% of the active pool under full production. Persist accumulated nominal slots per accrual, or settle the period before applying a duration change.

[heifner]

Fixed in 4fce5f4 by accruing the divisor the same way the pool already is. t5_state gains pending_nominal_slots; accrueepoch adds each epoch's slots at the duration in force for THAT epoch, and payepoch consumes and resets it alongside pending_emission_amount.

Test nominal_slots_accrue_at_each_epochs_own_duration (991f955) accrues one 60s epoch, doubles the duration, accrues a second, and asserts the total is 120 + 240 rather than the 240 x 2 the payout-time formula produced.

[huangminghuang]

[P2] Reject min_blocks_per_round above the fixed round size

The standard producer round has 12 slots, but this config path accepts any uint32_t. Setting 13 makes every fully produced standard round count as short and eventually rate-demotes every healthy producer. Please retain zero as the disabled value and otherwise require the threshold to be at most blocks_per_round.

[heifner]

Fixed in 4fce5f4: setscorecfg now checks min_blocks_per_round <= blocks_per_round (12), with zero still the disabled spelling. Covered by setscorecfg_rejects_a_configuration_that_inverts_the_rate_gate, which asserts 13 is rejected and both 12 and 0 accepted.

Fair catch — that action gained five other bounds in the same commit that introduced this field, and I missed the one field the commit added.

[huangminghuang]

[P3] Align the guide with the implemented rescore behavior

The current implementation intentionally rebuilds the schedule after each partial rescore drain and accepts mixed-generation ordering while the sweep converges. This sentence promises the opposite behavior, so operators will reason incorrectly about when a configuration change becomes visible.

[heifner]

Fixed in 4fce5f4. The guide now says the schedule keeps being rebuilt while the sweep drains and that ranking converges over a few rounds rather than switching in one step. That sentence predated removing the publish freeze and I did not revisit it afterwards.

[huangminghuang]

Re-reviewed 991f955. I disregarded persisted-layout/backward-compatibility concerns as requested for the pre-launch stage. The new commits fix the ordinary re-registration reset, payout-divisor over-distribution, mixed-duration nominal-slot accrual, and min_blocks_per_round bound, but the remaining findings below prevent approval.

[huangminghuang]

[P1] Reset the rate window only after the producer has actually left the schedule

This treats every demoted row as the documented dropped-producer recovery case, but regproducer/regproducer2 never checks whether the producer has left the active schedule. A producer demoted by the rate-only path can submit regproducer immediately, before the next schedule rebuild, and this branch clears both is_demoted and the entire rate window without a produced block or any time off-schedule. Repeating that after each demotion makes chronic short-round delivery unpenalizable; preserving the consecutive streak does not help because short rounds deliberately leave it at zero. Gate this reset on actual schedule removal (or another recovery condition that cannot be invoked while the producer still holds a slot), and cover demotion followed by immediate re-registration.

[huangminghuang]

[P1] Implement the advertised rolling miss window

Once the elapsed time reaches the configured window, this discards every prior observation at once, so the implementation is a tumbling bucket rather than the rolling window promised by the config, guide, and PR description. Boundary-straddling short rounds can therefore exceed the limit in a real duration-sized window while neither bucket exceeds it. For example, with a five-round minimum and a 40% limit, GGGSS | SSGGG leaves each bucket at 40%, but the sliding five-round window after the first two rounds of the new bucket is GSSSS (80%); short rounds do not advance the consecutive gate. Expire observations as they age out (or use an equivalent rolling representation) and add a boundary-straddling test.

[huangminghuang]

[P2] Exclude demoted-tier producers from snapshot credit

is_schedulable checks the active producer row, ACTIVE producer opreg status, and finalizer key, but it does not check is_demoted or the row's rank tier. A miss-demoted producer therefore still passes this gate and can keep voting through its retained provider mapping. Its credit then accumulates while payepoch stops before the demoted tier, and regproducer restores the row without clearing snapshot_attestations, bringing that stale score back into ranking. Gate credit on the same tier-plus-live predicate used by the pay walk and add demoted-producer coverage; the new parked-producer test exercises only is_active == false.

[huangminghuang]

[P2] Consume snapshot credit on every pay-walk exit

Demotion and unregprod are not the only events that drop a row out of the pay walk. Deleting the last finalizer key, losing ACTIVE producer-opreg eligibility, or falling below a raised live collateral minimum all make compute return unscored(), but those paths only call rescore and never clear an existing snapshot_attestations value. Because payepoch stops at the demoted/unscored tier, the value can survive across pay periods and reappear after re-keying, top-up, or status recovery. Detect and consume every eligible-to-ineligible transition at its event (without consuming a fresh credit on the reverse transition), and test exit -> pay epoch -> return for finalizer/opreg eligibility.

[huangminghuang]

[P2] Make this regression test reach the over-distribution path

With the fixture defaults, compute_bps == 4000 and producer_bps == 7000, so tiny_emission == 1 produces compute_amount == 0, producer_pool == 0, and active_pool == 0. Both the old and fixed implementations credit zero, so reverting the new block_payable guard still passes this test. One three-producer cycle also leaves total produced blocks below the 120-slot nominal divisor, so the divisor cannot collapse in the way described above. Configure a nonzero one-unit active pool, create at least two excluded rows whose combined blocks exceed the nominal slots, and assert producer credit against the actual active pool so the pre-fix second pass demonstrably fails.