AIP-22 stage 1 on chain 2800: anchor certificate threshold K=7, the QBFT quorum of ten validators, from block 20,715,632

RUN-A-NODE.md

@@ -318,7 +318,7 @@ export BESU_OPTS="\
 -Daere.pq.anchorInterval=32 \
 -Daere.pq.anchorIntervalSchedule=17225968:128 \
 -Daere.pq.anchor.maxSeals=9 \
--Daere.pq.anchorMinSeals=13014000:0,13034000:3,14961456:6,17102384:0,17102416:6 \
+-Daere.pq.anchorMinSeals=13014000:0,13034000:3,14961456:6,17102384:0,17102416:6,20715632:7 \
 -Daere.pq.anchorV2Block=17047600 \
 -Daere.pq.chainId=2800 \
 -Daere.pq.hybridRegistry=$REG/hibrid-10.properties \

SPEC.md

@@ -489,7 +489,7 @@ passes"):
 -Daere.pq.anchorInterval=32
 -Daere.pq.anchorIntervalSchedule=17225968:128
 -Daere.pq.anchor.maxSeals=9
--Daere.pq.anchorMinSeals=13014000:0,13034000:3,14961456:6,17102384:0,17102416:6
+-Daere.pq.anchorMinSeals=13014000:0,13034000:3,14961456:6,17102384:0,17102416:6,20715632:7
 -Daere.pq.anchorV2Block=17047600
 -Daere.pq.chainId=2800
 -Daere.pq.hybridRegistry=<registries>/hibrid-10.properties

anchor/README.md

@@ -22,9 +22,11 @@ should not be confused:
    least one honest validator signed; eight or nine are carried in practice). Raised at block
    14,961,456 (August 21, 2026): the enforced minimum became **six**, which at that time was a full
    2f+1 quorum of the nine-validator set, the same count QBFT itself required to agree on the block.
-   **Since 2026-09-11 the set is ten and QBFT's quorum is seven, so the same six is above f+1 and
-   below the quorum.** The threshold did not move; the set did. The schedule step is
-   `aere.pq.anchorMinSeals=13014000:0,13034000:3,14961456:6`, uniform on all ten validators; the
+   From 2026-09-11 the set was ten and QBFT's quorum seven, so the same six was above f+1 and
+   below the quorum: the threshold had not moved, the set had. **From block 20,715,632 (AIP-22 stage 1,
+   armed 2026-09-29) the enforced minimum is seven, again a full 2f+1 quorum of the ten-validator set.**
+   The schedule is `aere.pq.anchorMinSeals=13014000:0,13034000:3,14961456:6,17102384:0,17102416:6,20715632:7`,
+   uniform on all ten validators; the
    startup guard refuses any threshold above N - f = 7, the highest count reachable with the fault
    budget down. Blocks between anchors carry no Falcon seals and are finalized by ECDSA alone, so
    the post-quantum guarantee is a checkpoint about every 75 seconds (128 blocks; about every 16
@@ -295,8 +297,10 @@ sentence. Someone else has to do the verifying, which is why it is here.
 
 **A certificate at an anchor height is signed by at least six validators, since block 14,961,456
 (August 21, 2026). It was f+1 before that, and this paragraph said so. Between that date and
-2026-09-11 six WAS the 2f+1 quorum of a nine-validator set; since the tenth validator joined, the
-quorum is seven and six is not one, so we do not call it a quorum.** The distinction
+2026-09-11 six WAS the 2f+1 quorum of a nine-validator set; from 2026-09-11 until block 20,715,632,
+with ten validators, the quorum was seven and six was not one, so we did not call it a quorum. From
+block 20,715,632 (AIP-22 stage 1, armed 2026-09-29) the minimum is seven, the 2f+1 quorum of ten, and there it
+is a quorum again.** The distinction
 is worth keeping in view rather than deleting, because it is the difference between two genuinely
 different claims. f+1 signatures guarantee only that at least one honest validator signed. A quorum
 of 2f+1 is the same count QBFT itself requires to agree on the block. Between 14,961,456 and

run-node.sh

@@ -266,7 +266,7 @@ export BESU_OPTS="\
 -Daere.pq.anchorInterval=32 \
 -Daere.pq.anchorIntervalSchedule=17225968:128 \
 -Daere.pq.anchor.maxSeals=9 \
--Daere.pq.anchorMinSeals=13014000:0,13034000:3,14961456:6,17102384:0,17102416:6 \
+-Daere.pq.anchorMinSeals=13014000:0,13034000:3,14961456:6,17102384:0,17102416:6,20715632:7 \
 -Daere.pq.anchorV2Block=17047600 \
 -Daere.pq.chainId=2800 \
 -Daere.pq.hybridRegistry=$REG/hibrid-10.properties \

tools/verify-anchor.mjs

@@ -93,7 +93,7 @@ const K6_HEIGHT = 14961456;
 // that did not know the step would call that anchor wrong; one that hides it would be lying. MIN_SEALS_SCHEDULE
 // ("h:k,h:k") overrides for experiments and for other chains.
 // 28001, 2026-09-22: step 2988864:4, the per-scheme minimum becomes the QBFT quorum (4 of 5), AIP-22 stage 1 rehearsal.
-const K_DEFAULT = CHAIN_ID === 28001 ? [[64, 0], [128, 3], [168032, 0], [168064, 3], [2988864, 4]] : [[0, 3], [K6_HEIGHT, 6], [17102384, 0], [17102416, 6]];
+const K_DEFAULT = CHAIN_ID === 28001 ? [[64, 0], [128, 3], [168032, 0], [168064, 3], [2988864, 4]] : [[0, 3], [K6_HEIGHT, 6], [17102384, 0], [17102416, 6], [20715632, 7]];
 const K_SCHEDULE = (process.env.MIN_SEALS_SCHEDULE || '').split(',').filter(Boolean).map(p => p.split(':').map(Number)).sort((a, b) => a[0] - b[0]);
 if (!K_SCHEDULE.length) K_SCHEDULE.push(...K_DEFAULT);
 // D-338 (2026-09-04): the SCHEMES the certificate must carry, by height of the PARENT (the seals are made when the