[{"data":1,"prerenderedAt":4},["ShallowReactive",2],{"qDvGIqdvE9":3},"# lean-dag\n\n> **Provenance.** Code and prose in this project were co-written with\n> heavy LLM assistance. The Lean proofs are machine-checked — the kernel\n> verifies every theorem against its stated form — but whether the\n> definitions and theorem statements capture their *intended* meaning,\n> and whether the surrounding prose is faithful to what is proved, has\n> only human-plus-LLM review behind it. Read critically.\n\nA Lean 4 + Mathlib formalization of uncertified DAG consensus in the\nstyle of Mysticeti: the DAG itself, the commit rule, and machine-checked\nsafety and liveness — together with further developments built on the\nsame foundation, each in its own module consuming the core read-only.\nThe core is stated for `n ≥ 3f+1` validators with quorums of size\n`n − f`, over pipelined, multi-leader slot schedules; the variant arcs\nmove the committee — `n ≥ 5f+1` for two-round commitment,\n`n = 3f + 2p − 1` for a fast path that tolerates `p` missing votes,\n`n ≥ 5·fb + 3·fc + 1` for hybrid faults, and a bare majority at\n`n ≥ 2f+1` for crash faults alone.\n\n## What is proved\n\n- **Safety** of the Mysticeti-style commit rule — agreement across\n  views and routes, uniqueness of the committed sequence, a monotone and\n  agreed ledger — with no network assumption of any kind.\n- **Chain quality** (`LeanDag/Quality/`): every commit's flush carries,\n  at every round below it, blocks from **at least half of the correct\n  validators** — with no synchrony assumption — and once the DAG is\n  synchronous, every correct block enters the agreed ledger within a\n  schedule-window of its creation; a six-validator counterexample shows\n  the aggregate guarantee provably does not imply the individual one.\n- **Liveness** above *eventual DAG synchrony*, a structural condition on\n  the DAG under which no liveness theorem mentions time. The whole of\n  what the network must supply reduces to a single clause of **view\n  convergence** — after stabilisation, whatever one correct validator\n  holds reaches every correct validator within `Δ` — from which the\n  structural condition is derived, and block production with it, rather\n  than assumed. The threshold a deployment must meet is the constant\n  `2Δ + proc`: no quantity set by deployment appears, because the\n  pacemaker's catch-up rule collapses any clock spread to `Δ + proc` in\n  one post-stabilisation round. And liveness is **local** — not merely\n  that some view commits, but that every reliable validator decides on\n  *its own* view, at an explicit time (`commits_recur_local`).\n- **Denial-of-service resistance** (`LeanDag/DoS/`): safety is shown\n  independent of any anti-equivocation condition; storage is bounded\n  under an exposure condition (with a matching construction showing its\n  exponential constant is forced) and made linear-forever under an\n  enforceable, author-blind **novelty budget** (`dos_resistance`).\n- **Garbage collection** (`LeanDag/GC/`): a per-validator horizon below\n  which nothing is retained, with commit verdicts invariant across the\n  cut, storage **constant** at a lag, bootstrap by an `f+1`-sampled\n  attested base — and **no consensus on the cut** anywhere.\n- **Odontoceti** (`LeanDag/Odontoceti/`): safety and liveness of the\n  two-round commit rule (arXiv:2510.01216), generalized from `n = 5f+1`\n  to `n ≥ 5f+1`, on the unmodified DAG layer — including four findings\n  about the published safety argument, one of which (agreement among\n  indirect commits resting on candidate-iteration order) is refutable\n  on data without the canonicity repair the formalization supplies.\n- **Reactive schedules** (`LeanDag/Reactive/`): both commit rules remain\n  live when validators wait only until they hold the leader's block —\n  or, under Mysticeti, until they can certify — with the timeout as a\n  fallback. The fast path is quantified: round latency is bounded by\n  drift, delivery and processing with the timeout appearing nowhere,\n  and when delivery undercuts the timeout no timeout ever fires.\n- **Catch-up**, now a clause of the pacing core: drift between\n  validators is *preserved*, not contracted, by the waiting rule alone —\n  refuted on data — and the pacemaker's second rule (seeing evidence of a\n  round is entering it) collapses any spread to `Δ + proc` in a single\n  post-stabilisation round, whatever it was before; a witness starts with\n  a spread of ten and collapses to exactly three. A valid block cannot\n  outrun the honest schedule, so the author-blind rule a deployment runs\n  is safe (`exists_honest_floor`).\n- **The view a validator holds** (`LeanDag/Mysticeti/PaceDelivery.lean`): the\n  commit rules are view-relative and the pacing line reasons about\n  time-indexed holdings; the two are now joined. A validator's holdings\n  *are* a view (`viewAt_ids`), which is what makes liveness local; and a\n  pacing structure **induces** a delivery layer, so the storage model of\n  the DoS arc is derived rather than postulated — including its\n  acceptance rule, at most one block per author, which follows from the\n  reference discipline (`heldOf_inj`). One structure plus the acceptance\n  budget then yields liveness and linear storage together\n  (`dos_resistance_of_pace`).\n- **Safe Skip** (`LeanDag/SafeSkip/`): a crashed validator rejoins with\n  **one constant-size message** denoting a block for every missed round —\n  a donor's references plus the self reference the validity rules force.\n  The fill is proved a block universe extending the old one unchanged;\n  production is restored at every missed round, a filled leader\n  candidate is directly skipped rather than committed, and every verdict\n  reached before the fill re-derives and agrees after it\n  (`decided_fill_agree`).\n- **Adaptive leaders** (`LeanDag/Adaptive/`): a Hammerhead-style\n  schedule — the leaders ahead recomputed from the agreed prefix, to\n  favour validators observed live — proved safe and live for **both**\n  commit rules. Safety is unconditional: the schedule-and-verdict\n  fixpoint is unique under **no synchrony or fairness hypothesis**, for\n  arbitrary adapted policies (`adaptiveRun_agree`); liveness is its\n  existence under one clause — the policy keeps placing runs of\n  reliable leaders (`adaptiveRun_exists`); and the layer is\n  rule-agnostic, the two-round mirror consuming the same policy\n  objects.\n- **Hybrid fault tolerance** (`LeanDag/Hybrid/`): the two-round rule\n  proved safe and live under **separate Byzantine and crash caps** —\n  `fb` equivocators, `fc` honest validators that may halt — at\n  Orcaella's bound `n ≥ 5·fb + 3·fc + 1` (arXiv:2607.04789), for every\n  indirect threshold in an admissible interval whose nonemptiness *is*\n  the committee bound. Four validators suffice for two-round finality\n  under a single crash, where Byzantine tolerance costs six; at\n  `fc = 0` the development collapses onto Odontoceti. The bound is\n  also proved **necessary**: one validator short, one view derives\n  conflicting verdicts at every threshold\n  (`hybrid_bound_necessary`).\n- **Resilient checkpoints** (`LeanDag/Hybrid/Checkpoint/`): explicit\n  epoch-, height-, and history-bearing proposal messages are\n  emitted from append-only per-validator protocol state. Forked\n  per-validator histories are execution inputs: this layer does not\n  derive an AbC fork from the DAG or compose with the DAG safety proofs.\n  `BaseSpec.lean` and `RecoverySpec.lean` are the human-review trust\n  boundary; theorem statements still require review, while the bodies\n  in `SafetyProofs.lean` and `RecoveryProofs.lean` are Lean-checked.\n  Conditional on those inputs, at\n  `fabc \u003C n - 3·fb - 2·fc`, quorum intersection derives same-height\n  uniqueness and within-epoch prefix consistency; checkpoint safety is\n  intentionally scoped to one epoch. Concrete witness messages prove\n  that finality leaves a recovery-correct recorder. Recovery broadcasts\n  concrete checkpoint-certificate payloads carrying signer sets and\n  checkpoint content. An explicit local verifier checks the epoch,\n  quorum, and every authenticated proposal, with a soundness theorem\n  constructing a `CheckpointQC`; malformed broadcast inputs are not\n  channel-excluded. Finite highest-checkpoint selection handles the\n  empty case with the closing epoch's canonical execution genesis.\n  Submission and preservation are explicitly scoped to the closing\n  epoch, so retained older records do not make later recovery rounds\n  inconsistent. This recovers checkpoint history under explicit\n  submission, broadcast, validation, and adoption assumptions; it does\n  not recover the discarded DAG or restart consensus. The broadcast\n  algorithm and the paper's post-checkpoint VoteQC extension are not\n  formalized.\n- **Integration** (`LeanDag/Integration/`): the arcs are proved to\n  **compose** — not by settling a quadratic matrix, but by naming the\n  invariants each consumes and proving the two universe transformers\n  preserve them, after which a validator running four mechanisms at\n  once still cannot disagree about a verdict (`hybrid_agree_stack`).\n  The deployment constraints only the composition reveals: garbage\n  collection at lag `Λ` supports one-message recovery from outages of\n  up to `Λ` rounds and no more; a horizon must fall on an epoch\n  boundary of an adaptive schedule; and a validator pruned past its own\n  history can read but not produce until it **re-genesises** — a\n  provision that needs no exemption from the self-parent rule and no\n  agreement on where anyone's cut falls.\n- **Crash-fault consensus** (`LeanDag/Nemo/`): Nemo-Nemo, the same\n  commit rule at a **bare majority quorum** — `n ≥ 2f + 1`, at most `f`\n  validators halting, none equivocating — proved safe with **no fault\n  bound and no side conditions** (`Nemo.decided_unique`): universal\n  non-equivocation retires the twin machinery, and the quorum is\n  consumed exactly once in the agreement proof. Liveness holds at the\n  classical bound (`Nemo.all_decided_below_of_fairRun`) under a\n  fairness clause the mechanisation sharpens: with no failure detector\n  a lone committed leader settles only the slot two rounds below it,\n  and progress requires committed leaders at **adjacent** rounds —\n  which round-robin provides by counting.\n- **Mahi-Mahi** (`LeanDag/MahiMahi/`): the asynchronous protocol\n  (arXiv:2410.08670) — the same rule at a **wave of `w` rounds**, votes\n  counted through the causal cone with a canonical support choice —\n  proved safe for every `w ≥ 3` (collapsing onto the core at `w = 3`)\n  and live with **no synchrony hypothesis**: every wave directly\n  commits some correct validator's block at `w ≥ 4`, at least\n  `n − f − |byzantine|` of them at `w ≥ 5` (the core's own common-core\n  lemma), and liveness follows from one clause on the schedule and the\n  DAG — the late-revealed leader keeps landing among the committed\n  candidates — which a coin makes true and which synchrony derives from\n  fairness. Two findings about the published argument: the five-round\n  count holds only for non-equivocating authors (`1/3` per wave, not\n  `2/3`; `2f + 1` leader slots for a deterministic commit, not `f + 1`),\n  and the core's per-candidate skip rule is weaker than the\n  implementation's slot blame. The arc is built under a\n  statement/proof partition: definitions and statements are the audited\n  surface, proofs are generated, and a checker enforces the split.\n- **Black Marlin** (`LeanDag/BlackMarlin/`): the three-round commit rule\n  of a partially synchronous protocol (DISC 2025) that uses neither\n  reliable broadcast nor a common coin and elects an anchor in **every\n  round**. Its own safety results hold at the core's committee\n  `n ≥ 3f+1`, and liveness above the same structural condition as the\n  rest of the development, from a run of **two** consecutive reliable\n  anchors. **Definition 1's Agreement and Total order do not.** At\n  `n = 4`, `f = 1` two reliable validators output different twins of an\n  equivocating anchor and neither ever outputs the other's; on the same\n  execution they order two *reliable* authors' twinless blocks\n  oppositely, which no rule for choosing among twins can repair. The\n  repair that restores both descends to a supported anchor, and no\n  validator can run it: deciding from its own view loses safety, waiting\n  for the evidence loses liveness. The arc is the second under the\n  statement/proof partition.\n\n\n- **Minnow** (`LeanDag/Minnow/`): `crs*`, the commit rule proposed as\n  *minimal* for eventual synchrony (arXiv:2608.18029), which decides a\n  leader slot from the round immediately above it — `2f+1` processes\n  pointing commits, `2f+1` not pointing skips. Two of its clauses are\n  written in a way their own sentences do not support, and both are\n  settled on data at four processes with `f = 1`. **Two defects survive\n  either reading.** A slot counts as *resolved* when some vertex of it\n  lies in a candidate's causal past, which is not that vertex being\n  decided: under equivocation one twin carries a later leader past the\n  slot while the other acquires its quorum, costing **Safe-Commit** —\n  and Lemma 10's own case split is where the paper's proof permits it.\n  The commit and skip thresholds then leave a gap no view ever decides,\n  costing **Live-Commit** for the rule paired with a multi-leader round\n  robin, though not for the rule alone.\n\n- **FinWhale** (`LeanDag/FinWhale/`): a fast path at a tunable committee\n  (arXiv:2606.26292), which commits a leader block **one round above\n  it** — `n − p` distinct validators referencing it — at\n  `n = 3f + 2p − 1`, `1 ≤ p ≤ f`, where `p` is not a second class of\n  fault but how many of the round's votes the path can do without. Its\n  safety rests on one statement: under such a commit **every** block two\n  rounds up is evidence for it, so no view can commit a conflicting\n  block, skip the slot, or reach a different verdict through an anchor. The committee is exactly the\n  least at which that closes — at one validator fewer the count falls\n  one short, for every `f` and `p` in range — which is a tightness\n  result the paper has and does not use, asserting optimality by\n  citation instead. Liveness is derived from the protocol's own\n  block-creation conditions C1, C2 and C3 rather than from reference\n  coverage, which a reactive builder does not have; the\n  two-message-delay latency of Definition 1, stated and not proved\n  there, is proved here. **Three further findings**: Lemma 22's proof\n  covers `p = 1` only, the C3 case of Lemmas 18 and 19 counts one\n  validator too many into a set and has no margin left at `p = 1` once\n  that is fixed, and Lemmas 6 and 7 are routed through a clause that a\n  validator which has not seen the committed block satisfies for\n  nothing. A `Run` bundles one execution and states what a validator\n  guarantees — agreement, total order, integrity, validity — with no\n  verdict assignment, view or well-formedness condition in the\n  statements. And a Mysticeti DAG under this development's\n  denial-of-service condition satisfies FinWhale's validity rule with\n  the self-parent edge included, so the whole arc applies to it\n  unchanged — on the reactive schedule such a universe is a run at every\n  horizon, and the condition provably never leaves a builder short of\n  authors it may cite.\n- **Barnacle** (`LeanDag/Barnacle/`): the adaptive **leader\n  count** — every few seconds, measure on the agreed DAG the fraction\n  of leader slots the base protocol decided directly and drive the\n  number of leaders per round with an additive-increase,\n  multiplicative-decrease rule — proved safe and live over an explicit\n  interface rendering the paper's assumptions A1–A4, and instantiated\n  on Mysticeti, Odontoceti, Nemo-Nemo and Orcaella. Safety is agreement of the\n  configuration sequence and of the ledger for **any** update rule,\n  under no synchrony or fairness hypothesis (`Agreement.holds`,\n  `Ledger.holds`): the algorithm decides under the count in force and\n  only then switches, so each configuration's verdicts are derivations\n  against one fixed schedule and no fixpoint is needed. There is no\n  total run — a finite universe closes finitely many configurations —\n  and the paper's sequence of configurations is what every prefix of it\n  agrees on. Liveness is Configuration Progress and runs of every\n  height under a horizon (`Progress.holds`), from a clause on a\n  schedule the paper assumes of its base protocols and that its own\n  rotation does not meet by this development's run-fairness route at\n  two leaders and four validators; it holds by a descent through the\n  *heads* of rounds and a pigeonhole on residues (`Heads.holds`), so\n  each rule is live under round-robin at **every** leader count — the\n  paper's A4 for its schedule, proved. Seven findings for the paper,\n  among them that its liveness clause needs a margin above the slot and\n  that Nemo-Nemo's slack is what a majority may miss, not the crash\n  bound. The Orcaella instantiation holds at **every admissible\n  indirect threshold**, over the subtype of universes whose honest —\n  crash-prone included — class does not equivocate, at slack\n  `fb + fc` and gap `n + 1`; its witnesses include one DAG the\n  interval's two ends decide differently, the twin-canonicity case at\n  the genuinely mixed committee, and the slack proved exact. The arc\n  is the third under the statement/proof partition.\n\n- **Hydrozoan** (`LeanDag/Hydrozoan/`): the dual-path commit rule of\n  the Hydrozoan paper under the hybrid fault model of DagHydrangea —\n  `n ≥ 3f + 2c + k + 1`, at most `f` Byzantine, at most `c` crashed,\n  `k` a tunable slack — which commits a leader in two message delays on\n  `n − p` votes, `p = ⌊(c + k)/2⌋`, or in three on `2f + c + 1`\n  certificates, skips it on `n − p` blames, and decides a slot none of\n  those settles from the nearest committed anchor by a graded rule\n  (certificate, weak quorum, skip). Safety is agreement of any two\n  verdicts across views and routes, from six threshold inequalities\n  that hold for every fault configuration the class admits — no cap on\n  the slack is needed, though the Hydrangea paper states one — and\n  prefix consistency of the committed sequences. Liveness above a\n  structural rendering of synchrony routes through the slow path, the\n  only one a quorum of correct replicas is sure to reach; the fast\n  path and the direct skip are stated as performance facts outside the\n  liveness claim, firing exactly when the actual faults fit `p`. The\n  hypotheses are grounded by exhibition: the wave-aligned rotation is\n  fair with no premise, where per-slot rotation is starved inside the\n  hybrid bound, and the synchrony package is realizable at every\n  horizon. Two findings for the paper: the anchor-sees-the-fast-footprint\n  row is consumed in a strengthened, non-Byzantine form, and a slot can\n  fast-commit while no certificate for it exists anywhere, so the\n  indirect rule's weak rung is necessary. The arc is the fourth under\n  the statement/proof partition, and the one that partition was\n  designed for; it is developed in\n  [`asonnino/mysticeti`](https://github.com/asonnino/mysticeti) beside\n  the reference implementation.\n\n- **Optimal-Hydrozoan** (`LeanDag/OptimalHydrozoan/`): the theory-only\n  variant of Hydrozoan whose fast path tolerates one more fault —\n  `pOpt = ⌊(c + k)/2⌋ + 1`, Hydrangea's lower bound on two-round\n  commits, at the same committee — by FinWhale's device: a decision-round\n  block that has seen the leader equivocate must not reference the\n  leader's block, and quorums of decision-round blocks that are\n  *fast evidence* for a candidate replace Hydrozoan's weak quorum of\n  votes, in the indirect rule's second rung and in the direct skip. The\n  seam consumes the validity rule exactly once, so the evidence rung is\n  unique with no tie-break and the statements need no order on ids.\n  Safety and liveness mirror Hydrozoan's; what the arc adds is that a\n  slot whose leader produced no candidate is skipped by the guaranteed\n  quorum alone — a liveness claim where Hydrozoan's skip is\n  opportunistic — and not otherwise, since with a candidate present\n  `f` Byzantine votes defeat the skip, FinWhale's attack on data. At\n  `k = 2f + c − 2` every fault fits the fast path at `n ≥ 5f + 3c − 1`.\n  A peer arc importing the Hydrozoan arc read-only, and the second\n  developed in `asonnino/mysticeti`.\n\nEvery definition is exercised on concrete models by `decide` before\nanything is proved from it, and every principal result depends on\nexactly Lean's three standard axioms (`propext`, `Classical.choice`,\n`Quot.sound`) — no `sorry`, no bespoke axioms, no `native_decide`.\n\n## Building\n\n```\nlake build\n```\n\nRequires [elan](https://github.com/leanprover/elan). The toolchain version\nis pinned in `lean-toolchain`; `lake build` will fetch it automatically.\n\nA `Makefile` splits the work by what it costs. `make fast` builds the\nlibrary alone and runs the checks that cost nothing, which is the loop to\nwork in; `make check` adds the concrete-model layer and is what a commit\nneeds; `make deps` regenerates the dependency graph and is only needed when\nthe set of declarations changes. `make help` lists them.\n\n## Layout\n\n**Four kinds of arc.** Each directory under `LeanDag/` is one of them,\nand its entry file says which:\n\n| kind | what it varies | arcs |\n|---|---|---|\n| **commit rule** | the decision relation | `Mysticeti/` (the core), `Odontoceti/`, `Nemo/`, `Hybrid/`, `MahiMahi/`, `Hydrozoan/`, `OptimalHydrozoan/`, `FinWhale/`, and the two refuted rules `BlackMarlin/` and `Minnow/` |\n| **universe transform** | the DAG, owing a witness that it does so lawfully | `GC/` (the cut), `SafeSkip/` (the fill), re-genesis |\n| **schedule mechanism** | the `Slots` a rule runs on, and no universe at all | `Barnacle/` (how many leaders a round has), `Adaptive/` (which validators lead), `Reactive/` (when a validator builds), `Timed/` (the full-timeout baseline) |\n| **analysis** | nothing — it measures a DAG rather than deciding on one | `DoS/`, `Quality/`, `Network/` |\n\n`Common/` is the substrate all four read; `Properties/` is the contract\na commit rule meets and the other three consume; `Integration/` is what\npairs two kinds at once — a schedule over a rule, or two transforms\ncomposed. A commit rule reads in four parts, and its files are named for\nthem: the universe and the rule under `Model/`, what it shows in\n`Properties.lean` or `Carrier.lean`, and what it earns in `Record.lean`.\n\n- `LeanDag/` — theorem/definition source: the core DAG and Mysticeti\n  development at the top level, with the pacing structures in\n  `Mysticeti/ViewPace.lean` and the delivery layer they induce in\n  `Mysticeti/PaceDelivery.lean`. `Common/` (twenty files) holds what\n  every rule shares: `BlockRecord.lean` is the one universe shape every\n  rule instantiates, with the generic cut, fill and re-genesis built\n  against it once; `Causality.lean` and `Participation.lean` hold the\n  fault-agnostic vocabulary — reachability, the finite cone, production\n  and coverage — stated over the raw block data beneath it; `Anchored/`,\n  `Support.lean`, `Rules.lean` and `Ledger.lean` hold the generic\n  anchored-rule interface, the counting arguments a support discharges,\n  the five rule combinators, and the ledger a decided sequence assembles\n  into. `Properties/` states the target properties themselves\n  (`DagRule`, `Agree`, `Commit`, `Band`, `Sustain`, `Truncate`, …) and\n  the generic mechanism theorems every carrier gets for free\n  (`Properties/Arcs/`); `Timed/` holds the timed model built on top —\n  coverage, and the bridge from synchrony into certification — kept\n  apart from `Properties/` since it is timing-specific\n  (`scripts/check-arc-holes.py` enforces the separation). The arcs are\n  in subdirectories (`Quality/` —\n  chain quality; `DoS/` — equivocation and the novelty budget; `GC/` —\n  garbage collection; `Odontoceti/` — the two-round protocol;\n  `Reactive/` — the reactive schedule; `SafeSkip/` — crash recovery in\n  one message; `Adaptive/` — adaptive leader schedules, generalised over\n  any `Properties.DagRule`; `Hybrid/` — Byzantine and crash faults\n  apart; `Nemo/` — crash-fault consensus at a majority quorum;\n  `Minnow/` — the minimal commit rule and its counterexamples;\n  `FinWhale/` — the fast path at `n = 3f + 2p − 1`, whose `Model/` holds\n  every definition of the protocol and no proof; `MahiMahi/` — the\n  asynchronous rule at wave `w`, `BlackMarlin/` — the three-round rule\n  with an anchor every round, and `Barnacle/` — the adaptive leader\n  count over an interface for the four base rules, `Hydrozoan/` — the\n  dual-path rule under hybrid faults, with its own fault model and\n  universe, and `OptimalHydrozoan/` — its fast path at Hydrangea's\n  bound, a peer arc importing the first, all under a statement/proof\n  partition (`Model/`, `\u003CResult>/Statement.lean`,\n  `\u003CResult>/Proof.lean`); `Network/` — the composed\n  denial-of-service capstones; `Integration/` — how the arcs compose).\n- `LeanDag.lean` — root import file.\n- `LeanDagTest/` — `decide` witnesses and concrete models, mirroring the\n  same layout.\n- `docs/` — the design records and the report. `docs/build-pdf.sh`\n  compiles them to `docs/pdf/` — requires `pandoc` and `typst`\n  (`brew install pandoc typst`).\n- `scripts/` — the extraction and verification pipeline. `DepGraph.lean`\n  and `depgraph.py` extract and draw the support diagrams\n  (`docs/depgraph/README.md`); `svg2pdf.sh` renders them to PDF;\n  `extract-decls.py` reads every declaration with its docstring and\n  statement into `docs/decls.json`, and `gen-reference.py` regenerates\n  the report's reference appendices from it, selecting the declarations the body and the\n  statement index name; `audit-report.py` checks the report's\n  cross-references, its Lean identifiers, and every displayed statement\n  verbatim against the compiled source. `docs/decls.json` and\n  `docs/depgraph/deps.tsv` are extracted, not tracked; a fresh clone\n  builds, then runs the two extractors before the audits. Regeneration\n  is deterministic,\n  so regenerate-and-diff is the pre-merge check. `check-arc-holes.py` enforces the statement/proof partition of the arcs that adopt it; `audit-rounds.py` closes each protocol's decision relation over the dependency graph and checks that no rule reads an absolute round, which is what the offset band needs (`docs/target-properties.md` §3.4c); `audit-conformance.py` recomputes which protocols have shown which properties (§11.2); and `black-marlin-figure.py` draws the execution that refutes Agreement (`docs/figures/`).\n\n## Documents\n\n| Document | Contents |\n|---|---|\n| [`docs/report.md`](docs/report.md) | **the entry point**: the full report — model, commit rule, trust boundary (including what the adversary may do), safety, liveness on view convergence, the extension arcs, satisfiability, mechanisation — plus generated reference appendices giving **every definition and public theorem verbatim** and an index of the internal lemmas |\n| [`docs/spec.md`](docs/spec.md) | the safety design record |\n| [`docs/chain-quality.md`](docs/chain-quality.md) | chain quality: coverage without synchrony, inclusion with it |\n| [`docs/dos-equivocation-and-growth.md`](docs/dos-equivocation-and-growth.md) | equivocation, exposure, view growth, and the novelty budget |\n| [`docs/garbage.md`](docs/garbage.md) | the horizon: truncation, bounded storage, bootstrap without consensus |\n| [`docs/odontoceti.md`](docs/odontoceti.md) | the two-round protocol: the generalized thresholds, and the findings |\n| [`docs/adaptive-leaders.md`](docs/adaptive-leaders.md) | adaptive leader schedules: the design record, built and since generalised to `Adaptive.Policy` over any rule |\n| [`docs/hybrid-plan.md`](docs/hybrid-plan.md) | hybrid fault tolerance: the design record, built, kept as the reasoning behind report §14 |\n| [`docs/mahi-mahi.md`](docs/mahi-mahi.md) | the asynchronous rule at wave `w`: the clause, and the statement/proof partition |\n| [`docs/black-marlin.md`](docs/black-marlin.md) | the three-round commit rule: the link clause, the run of two, what the reactive exit costs, agreement, the delivered order the descent computes, the sequence it outputs, where Agreement fails, and a repair |\n| [`docs/minnow.md`](docs/minnow.md) | the minimal commit rule: the two readings its own sentences force, and the two defects that survive both |\n| [`docs/finwhale.md`](docs/finwhale.md) | the fast path at `n = 3f + 2p − 1`: the committee and its tightness, the validity clause the fast path needs, liveness from the block-creation conditions, what a validator guarantees, and what the paper should change |\n| [`docs/barnacle.md`](docs/barnacle.md) | the adaptive leader count: the interface A1–A4, the configuration-sequence model and why it needs no fixpoint, the liveness clause and its margin, the heads descent, the four instantiations, and the findings |\n| [`docs/hydrozoan.md`](docs/hydrozoan.md) | the dual-path rule under hybrid faults: the thresholds and their table, the two-case consistency argument as one statement, the slow path as the guaranteed one, the liveness package and its grounding, and the findings |\n| [`docs/optimal-hydrozoan.md`](docs/optimal-hydrozoan.md) | the fast path at Hydrangea's bound: the validity rule and per-block fast evidence, the seam that consumes the rule once, the skip as a liveness claim and FinWhale's attack on it, and the always-fast parametrisation |\n| [`docs/target-properties.md`](docs/target-properties.md) | the properties: what a rule shows and what it gets, the definitions displayed verbatim, the one-carrier-per-rule discipline, the audits, and the record of the passes that reached them |\n| [`docs/integration.md`](docs/integration.md) | the mechanisms at every rule: the cut and fill cells and the relation they witness, and the standing facts no property states — coverage under the fill, horizon placement, re-genesis, the exposure check, the storage budgets — with the deployment conditions they yield |\n| [`docs/hydrozoan-integration.md`](docs/hydrozoan-integration.md) | Hydrozoan and Optimal-Hydrozoan through the properties: the carriers and supports, the Barnacle instantiations and the committee bound round-robin needs, the schedule-free leader-exclusion clause, the native cut and fill |\n| [`docs/related.md`](docs/related.md) | a survey of consensus on uncertified DAGs |\n| [`docs/style.md`](docs/style.md) | writing conventions for the documents and the source |\n\n## Contributors\n\n- [Alberto Sonnino](https://github.com/asonnino) — the crash-fault arc\n  (`LeanDag/Nemo/`,\n  [#1](https://github.com/gdanezis/lean-dag/pull/1)): the majority-quorum\n  foundation and its intersection lemma, the wave-two commit rule,\n  agreement without side conditions, liveness at `n ≥ 2f+1`, and the\n  three-validator witness model. He also contributed the wave-robin\n  schedule ([#3](https://github.com/gdanezis/lean-dag/pull/3)), the\n  Mahi-Mahi arc ([#5](https://github.com/gdanezis/lean-dag/pull/5)), the\n  Barnacle arc ([#7](https://github.com/gdanezis/lean-dag/pull/7)), and\n  the Hydrozoan arc (`LeanDag/Hydrozoan/`,\n  [#8](https://github.com/gdanezis/lean-dag/pull/8)): the dual-path commit rule\n  under hybrid faults, its safety from the threshold table alone and its\n  liveness through the slow path — and its Optimal variant\n  (`LeanDag/OptimalHydrozoan/`,\n  [#9](https://github.com/gdanezis/lean-dag/pull/9)), the fast path at\n  Hydrangea's bound.\n\n- [Lefteris Kokoris-Kogias](https://github.com/LefKok) — the resilient\n  checkpoint arc (`LeanDag/Hybrid/Checkpoint/`,\n  [#4](https://github.com/gdanezis/lean-dag/pull/4)): the\n  assume-guarantee model of epoch-bearing proposals over append-only\n  validator state, same-height uniqueness and within-epoch prefix\n  consistency from quorum intersection at\n  `fabc \u003C n − 3·fb − 2·fc`, resilient finality, and highest-checkpoint\n  recovery with its local verifier and soundness theorem.\n\n## License\n\nMIT — see [`LICENSE`](LICENSE).\n",1789154836591]