λ-sampling: quarantine durability and what silence means — both deferred to multi-operator

[defenwycke]

Two policy questions that §6 sampling raises but does not answer. Neither blocks anything today; both block admitting a node we do not own, so they belong with #608.

Recording them with reasoning so they surface at the right moment rather than being rediscovered.

Context: sampling itself is fine

Measured 2026-08-22 over 24h: 32–40 sampling requests per node per day, zero refusals (vm1 40, vm2 34, vm5 32, vm8 34). The full path is built, wired and exercised — request selection, merkle proof verification, per-leaf PoW/GHOST-09/binding checks. Entropy is drawn by the requester and held in memory only, so leaf selection is genuinely unpredictable to the audited node, which is the property §6 rests on.

Sampling is not the multi-operator blocker. The consequence of catching someone is.

One of the three consequence questions is now settled and recorded in SHARE_SHARD.md §8: a proven liar loses the future, not the past, and nothing may make the merge subtractive. These are the other two.

---

1. Quarantine durability

quarantined is an in-memory BTreeSet. The code states plainly that "a rolling deploy DOES amnesty every quarantine", so a liar simply waits for the next deploy.

Recommendation: keep in-memory for now.

Persisting it means building an operator release path that nobody will exercise while we own all eight nodes — and an untested recovery path is exactly how the 2026-08-12 fleet-wide terminal quarantine became unrecoverable: the mark worked, the release did not, and a false positive had nowhere to go. The current design is the safe end of that trade and was chosen deliberately, not overlooked.

A TTL variant was considered and is the weakest option: it builds the mechanism against an adversary that does not exist yet, and a patient liar just waits out the timer.

Revisit when: the first node we do not own joins. At that point the release path must be built and tested before the mark is made durable.

2. What silence means

Refusal to serve a sample is explicitly not a verdict, and an expired audit is not one either — §6 declines to say, because the response cap makes an honest partial answer legal. So "stop answering once caught" currently costs nothing.

Recommendation: do not set a policy yet — measure first.

Deciding a threshold without data would repeat a trap we avoided this week. H-7's address proof measured 9,681 passes against 181 failures, and 181 of 181 were Unreachable — transient, spread across seven peers, none above ~8% of its own probes. Had non-response been treated as a verdict there, every honest node would have lost its subnet on a link hiccup and the diversity floor #629 fixed would have collapsed. Sample silence has the same shape.

We currently have no measurement of what honest non-response looks like for sampling: how often a legitimate partial answer, a dropped frame or a busy peer produces silence.

Action taken: a report-only counter of unanswered audits per peer, so the threshold is chosen against real data when the mesh opens rather than guessed. Same report-only-first discipline H-7 followed — the probe ran for weeks before its verdict was ever emitted.

---

Not urgent, and why that is a real claim

Both are inert while every node is ours. The honest description of today's trust model is "we own all eight nodes", which is already the stated v1 position.

[defenwycke]

Proposed answer to "what does catching a liar cost" — penalise QUALIFICATION, not identity

Operator proposal 2026-08-22: a shared ban list, escalating 24h → 7 days → life on the node ID. Working through it produced a better-specified answer, and one that does not have to wait for multi-operator.

What is right about it, and it is the hard part

A shared ban list needs no vote. §6 already requires rejection to be evidence-based and published — "if node A finds a bad share it broadcasts it, and every peer reaches the same verdict from the same evidence." So a ban derived from published evidence is deterministic: every node computes the same list independently. No quorum, and no reintroduction of the consensus Stage 6 is removing.

It is also compatible with the settled grow-only rule — a ban list is separate state, so the merge never becomes subtractive.

Why banning the node ID does not bite

NODE_ID_POW_DIFFICULTY = 24 — from its own doc comment, "~16 million hashes on average (tens of seconds on modern hardware)."

tier	cost to evade
24 hours	~30s of CPU
7 days	~30s of CPU
for life	~30s of CPU

The ladder never reaches tier two, because a liar never carries an identity long enough to re-offend under it. They are caught, they discard the ID, they rejoin fresh. Banning node_id bans something that costs nothing to replace.

⛔ And the permanent tier reintroduces a known injury: a mark with no release path is exactly the 2026-08-12 fleet-wide terminal quarantine, where a false positive was unrecoverable. That is the specific reason the current quarantine is in-memory.

What already deters this, measured

The cost of a fresh identity is not the PoW — it is everything the old one had accumulated. From constants.rs:

requirement	value
MIN_CHALLENGES_FOR_QUALIFICATION	10
pass rate	95% (GhostPay 90%)
UPTIME_WINDOW_DAYS	7
UPTIME_GATEKEEPER_THRESHOLD	95%

A new ID also starts with accrued = 0 and can never hold an elder position (registration order, ossified at 101).

⇒ A caught liar already pays ~7 days of standing to rejoin, ban list or not. That is a far stronger deterrent than a 24-hour ban, and it is live today.

The proposal

Keep the ban list — evidence-derived, no vote — but attach escalation to qualification rather than to time or identity:

1. Published evidence of a bad share resets the offender's capability qualification.
2. Each subsequent offence doubles the requalification window (7 → 14 → 28 days).
3. No permanent tier, so no unrecoverable false positive.

The point of (1) and (2): the penalty follows the behaviour, and discarding the identity does not dodge it — a fresh ID starts at exactly the zero the penalty imposes. The escalation becomes real instead of theatrical.

⚠ Two things still to settle before building it:

• Where the offence count lives. It has to survive a restart or it is the current in-memory quarantine again — but it must not be permanent. A durable counter with a decay is probably the shape.
• This raises the stakes on evidence quality. A penalty that costs a week must not fire on a false positive, which is the same reason the H-7 verdict rule records nothing for Unreachable and NotSigned and only votes FAIL on a cryptographic failure. Whatever publishes ban-worthy evidence needs that discipline.

Still deferred

Quarantine durability and what silence means (the original two questions). Note that the qualification-penalty design subsumes the quarantine-durability question — if the penalty is a qualification reset, there is no separate in-memory mark to persist.