AIP-21: a record that reaches `post-quantum` shows that the commit quorum of distinct validators sealed the block
post-quantum in some round; it does not by itself prove that the block was decided (follows the AIP-22 erratum of the same
day). AIP-23: dated note on what the finality level rests on; level names unchanged. Three formal models carry a dated note
where they treated certificate uniqueness as a property of the code rather than of the model.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Written and run against z3 4.16.0, exit 0, on 2026-08-15, the day the blocking
fork went live:
- anchor_blocking_quorum: past block 14,050,000 no anchor block finalizes with
fewer than K=3 distinct valid Falcon seals; the negative control that permits
2 seals is SAT (the violation is expressible), the property itself UNSAT.
- pqanchor_ceiling_monotonicity: the emergency ceiling can only LOWER the
effective threshold, never raise it, and K_eff always fits under the write
cap; a planted max()-instead-of-min() ceiling is SAT.
- registry_rotation_coverage: the registry schedule covers every anchor height
with exactly one registry, no gap and no overlap, and a seal is checked
against the registry active at the ANCHOR height; a planted schedule with a
gap is SAT.
These extend the existing SMT corpus toward end-to-end verifiability of the
consensus, one of the pieces the roadmap calls distinctive.
