Blockula v1.0.1: a jailed validator that stays online keeps following the chain

Blockula v1.0.1: a jailed validator that stays online keeps following the chain. UNSIGNED, like every release so far.

This release is not signed. The offline ML-DSA-65 release key doesn't exist yet, so there is no
checksums.txt.sig and no release key id to pin. blockula release install refuses to install without
one. The one-line install.sh and the MCP's install_node check each archive's SHA-256 against
checksums.txt (first line # blockula-release v1.0.1) and, with a logged-in gh, its SLSA build
provenance (gh attestation verify <file> --repo jackdishman/blockula --source-ref refs/tags/v1.0.1), and
report which checks ran. A compromised GitHub account or release workflow could produce both, so the
stronger check is a bit-for-bit rebuild of the Linux archives:
COMMIT=1e90cc20b82c10115641512f7cf3951942c7a457 scripts/reproduce-release.sh v1.0.1.
Each chain's FANG, the testnet's included, has no value: nobody sells it, buys it or gets paid in it.

What's fixed (#95)

• A validator jailed for downtime whose node stays online now keeps following the chain.
  • Before: every node let connect only the active set and the likeliest next validators, and a jailed
    validator is neither. About two epochs after it left the set, no other node accepted its connections. Its
    node then froze until it was restarted, and an Unjail sent through it never left its own mempool.
  • Now: nodes keep jailed validators (not tombstoned or removed ones) as secondary peers until they
    unjail, in the slots the likely next validators leave. So blockula validator unjail --rpc can point at
    the validator's own node.
  • Scope: this changes only which peers a node accepts. Nothing changes in blocks, state, consensus or
    the wire format.
  • Tests: a new simulator test at the production setting (two tracked peer sets) fails on v1.0.0 and
    passes now.
• On v1.0.0 and earlier: a jailed validator that stopped following comes back when it's restarted, or
  once an Unjail sent through another node lands.

The testnet (unchanged): chain blockula-testnet-2, address prefix tboo, genesis hash
b004e2f91b63429fc009088b16ec02b6d5388a03642699ae3dc6e325939f19b2, public node
https://blockula-testnet.fly.dev. The checkpoints are v1.0.0's, unchanged: the newest is block #1115999 of
2026-10-31 12:14 UTC.

Upgrading

• Node/CLI: a drop-in replacement for v1.0.0, with the same protocol versions and no state, consensus or
  wire-format change. Every PR replays the recorded v1 history, and this release's tree replays the
  testnet's own history to block 173,082 unchanged. Validators should upgrade; restart them one at a time.
• Joining the testnet: blockula join --genesis https://blockula-testnet.fly.dev --home <dir> uses the
  compiled-in checkpoint until about 2026-11-04 00:14 UTC (the testnet's 3.5-day weak-subjectivity period).
  After that, take a recent one with blockula checkpoint --peer https://blockula-testnet.fly.dev and pass
  it as --checkpoint.
• SDK and MCP: unchanged. @blockula/sdk and @blockula/mcp stay at 1.0.0.

Commit: 1e90cc20b82c10115641512f7cf3951942c7a457 (PR #95 merge). Built by release.yml; CI rebuilt the x86_64 Linux archive bit for bit on a second runner, and the aarch64 Linux archive was also rebuilt bit for bit outside GitHub, on the maintainer's machine in the pinned build image (rust:1.98.1-bookworm@sha256:93ce27a8…). scripts/check-release-files.sh accepts this release against the reviewed commit, and every file's build provenance verifies against release.yml at refs/tags/v1.0.1.