the proven present — the present proves the past

the property, fixed by the owner on 2026-10-17 as a base property of the system, cross-cutting and necessary:

every block is a proven transition, and its proof verifies the proofs of its parents. so every state, at every height, is verified recursively back to genesis by one proof of constant size — the present proves the past. a block is proved first and mined second: work orders transitions that are already proven; it never stands in for a proof. a neuron that holds the state and the proof of the tip is a full validator, in the first month and in the tenth year, by the same procedure, at the same cost.

this is how the system is designed, and the system has no meaning until it works this way. there is no cadence (every block, not every hundred), no shadow stage, no "once proving fits in the block time". the measured distance to the target is a list of work to close (§3, §5), never a reason to lower it.

the question that prompted the page: the zheng specs say O(n) and parano1d says O(1) — did we lose by design? no. zheng's O(n) is the prover's time, which is optimal: no prover beats reading its own trace. parano1d's O(1) is the verification of history in the height of the chain: a terminal proof whose size and verification work do not grow with age. zheng's design has the same property (recursion on release/0.4: "a proof of any number of steps is the last step's proof, the state it started from and one decider — its size does not depend on the number of steps"), with a proof about fifteen times smaller than parano1d's. what soft3 lacks is the chain as a recursive computation: the phase-1 root chain validates natively, keeps every body, makes a newcomer replay from genesis, and calls zheng proofs "optional and later" (§7.4). this page makes the property ours, names what every component owes it, and orders the work.

it depends on proof-system-repair (the constant-size profile), privacy-frozen (one material; the block proof, G2), steps-blocks-epochs (the DAG and the clock) and the root chain spec. it reverses one sentence of steps-blocks-epochs §1 and corrects one claim of goldilocks-parano1d §2 (§2.3, §2.4).

0. the property, stated once

blocks form a DAG (steps-blocks-epochs §1: a block is a bundle of steps ordered against k parents; the phase-1 chain is the case k = 1). for a block B of chain c with pinned genesis G_c:

π(B) proves:   B's parents P_1 … P_k each carry a proof π(P_j) that verifies
                 (the recursion: the verifier of π(P_j) runs inside π(B)),
               every step in B is valid — its authorization, its apply over bbg —
               B is valid under the rule set active at its height
                 (header, work, timestamps, difficulty, budgets, fees, conservation),
               applying B to its parents' state yields bbg root R(B),
               and chainwork(B) = W(B)
base:          π(G_c) is the genesis axiom: id(G_c), R(G_c), W = 0
public:        (c, height, id(B), R(B), W(B), rule set)
size:          constant in height and in the DAG's width — ≤ 64 KiB (the profile-6 bound)
verify:        constant — goal ≤ 1 ms
order:         π(B) is complete before the work on B is searched (prove first, mine second)

it is proof-carrying data over the DAG: every node of the DAG carries a proof that its whole past is valid, and verifying one tip verifies everything beneath it.

what it does not prove, said once so nobody reads it in:

and the rule it imposes on everyone: no consensus state without a proof path. a dimension, a transaction kind or a rule set that the block relation cannot express does not activate (§2.11).

1. why it is base

without it, five things soft3 promises are hollow:

1. bootstrap grows with age. a replaying chain is cheap in year one and a barrier in year ten; it ends with a few archive operators and everyone else trusting them.
2. checkpoints are trust with an expiry date. until CHECKPOINT_SUNSET (525,600 blocks, about six months) a foundation key anchors newcomers (chain §5.3). a proven tip anchors them without a key.
3. a phone cannot be a validator. with the tip's proof, cyb checks the state itself and trusts a server only for bytes.
4. pruning without trust is impossible. with every block proven, old bodies are history, not authority — state follows live use, not chain age.
5. proven answers over an unproven state are a contradiction. "remember" — a proven answer is a file with a hash, checked with 32 bytes — is only as good as the root it is read against; provable reads (inf over bbg) need a proven R.

2. decisions

each is final for this design; alternatives are named once.

1. every block, from genesis. every block of every chain has a proof that verifies its parents' proofs. no interval, no sampling, no "checkpoint proofs". blocks produced before the block proof becomes a validity condition are proven after the fact (§2.8), so the recursion still starts at genesis and no state in the chain's history is left without one.

2. prove first, mine second. a miner assembles the block, completes π(B), freezes the template, and only then searches the work. a block whose proof does not verify is invalid however much work it carries. work chooses the order among proven transitions and nothing else.

3. recursion over the DAG, not accumulation alone. each block proof runs the verifiers of its parents' proofs inside its own circuit; only the last proofs travel (zheng specs/recursion.md; audit/accumulation-2026-10.md §6: without a verifier inside the next step the proof grows with the run). this corrects goldilocks-parano1d §2, which assumed accumulation alone gives constant size. soft3 pays the recursion, but in a field-native circuit, and its proof is 64 KB, not parano1d's 1 MB.

4. this reverses steps-blocks-epochs §1 ("from-genesis validity lives in the accumulator, not in each block"): from-genesis validity lives in each block. it costs one constant-size merge per block, not a re-proof of history — the parents' proofs are verified, their pasts are never recomputed. the epoch remains the tier of finality and of ranking, not of validity.

5. the work is spread over the DAG. the proving of a block is never one machine's sequential job. each step is proved where its witness lives: the neuron that authored it proves its authorization and its apply (as parano1d's wallet proves authorization and its miner the transition); aggregators fold step proofs in a tree (the leaf/node/top programs of zheng's block aggregation, G2); the block producer runs one merge: its parents' proofs, the folded steps, the block rules. the block's latency is the depth of that tree times one merge, not the number of its transactions times one proof. parallel branches of the DAG are proven concurrently; joining them is a merge.

6. the proof carries the work. W(B) is public. a newcomer picks, among valid tip proofs for its chain, the greatest W; the reorg limit (chain §5.2) binds nodes that already follow a tip. how a newcomer chooses across a fork deeper than FINALITY_DEPTH is written into chain §5 with the activation (§6.5).

7. one material. the proof is hash-only over hemera and Goldilocks, the profile-6 family of zheng. nothing in it may introduce a second assumption (privacy-frozen §1.1).

8. the canary blocks are proven after the fact. the blocks produced before the block proof becomes a validity condition (rule set 1 from 2026-11-05) are proven by catch-up provers in order, from genesis to the tip, until the proving keeps pace with the chain; from the activation height every block carries its own. a node may verify the catch-up proofs before the activation; it must verify the block proof from the activation.

9. authorization is hash-only where it is frozen; ECDSA lives only where legacy keys live. in a proven step a neuron authorizes by proving, inside the step's proof, knowledge of the secret its neuron id commits to — no public key and no signature on the wire, as in the pool (privacy-frozen §1.4) and in parano1d. the owner's plan of 2026-10-17 decides where ECDSA may exist at all:

   chain	authorization	why
   pussy and bostrom (PUSSY, BOOT)	secp256k1 ECDSA (mudra NSIG1, chain §2.7) as specified, for as long as balances remain unclaimed; in time it moves into contracts	the burial balances belong to legacy secp256k1 keys; those chains exist to carry them until they are claimed. their block proofs pay the ECDSA cost, and the canary blocks are proven once, after the fact (§2.8)
   cyb (the CYB chain)	hash-only from its genesis. no ECDSA in its genesis, its rule sets or its consensus — not even a little	CYB is the money whose material is frozen at genesis (privacy-frozen §1.1); a classical signature in it would be a permanent second assumption

   CYB launches as early as the proving and the encryption reach a stable construction, and it launches without transfers: its first rule set carries claims only. a claim never verifies a secp256k1 signature in CYB's consensus; the legacy key was already checked where it lives — on pussy or bostrom — and the claim proves, against that chain's proven state, the lock or burn that names the CYB neuron. this is the proven present used across chains: CYB verifies a pussy or bostrom state by its proof, never by its signatures.

10. the bodies' retention follows the proofs. while blocks without proofs are final (before the activation), nodes stay archival (chain §3.6). from the activation, a node that keeps the state and the tip's proof is a full validator, and keeping bodies is a service, not a duty.

11. every rule set extends the relation before it activates. rule set 2 (the pool, settlement, fold, foculus) does not activate until the block relation covers its kinds, dimensions and block-proof statement. this is the cross-cutting rule, and its owner is whoever writes the rule set.

3. where we stand

measured on Apple M4 Max with hemera 0.3; every figure is re-measured after the hemera 0.4 sweep (zheng feat/hemera-0.4).

the arithmetic of the target, not a measurement: with the step proofs made by their authors and folded in a 4-ary tree, a block of 1,024 steps is five merge levels; at one merge of the order of the IVC step (1.12 s today on Metal) plus the block merge with its parents, a block proof completes in seconds of wall-clock across machines, inside 30 s. S3 measures it.

a note on sources: the zheng specs on master describe the retired Brakedown line — openings that grow with the trace, and a constant-size opening that stayed blocked on lens issue #6. the live line is release/0.4 (WHIR, profile 6); read it when comparing zheng with anything. bringing master level is part of the coordinated release of proof-system-repair §9.

4. what each component owes

5. the plan

each phase closes on its last merge, with a receipt in audit/. the order of S1 → S2 → S4 is fixed; S3 runs beside S2 and must close before S4; S5 and S6 follow.

6. open, and who closes it

1. authorization — decided 2026-10-17 (§2.9). pussy and bostrom carry ECDSA until their balances are claimed; CYB has none. what stays open: the exact claim relation of CYB — a proof against pussy's or bostrom's proven state of a lock or burn naming a CYB neuron — and the stable proving and encryption construction that sets CYB's launch date. soft3 chain, mudra, zheng.
2. who pays the provers. the step author proves its own step; aggregators and the producer's merge need a reward — the tier-2 fold subsidy of settlement mining (tru specs/rewards.md §7–8), fees, or the block subsidy. owner decision before S4.
3. verify ≤ 1 ms. today ×5 short on one thread. zheng.
4. the verifying key on a phone. 8.98 MB today. zheng with cyb, before S6.
5. newcomer fork choice across a deep fork. heaviest proven work against the reorg limit; written into chain §5 with S4. soft3 chain.
6. snapshot availability. a proof makes the data checkable, not present; who serves snapshots and what they earn is a sync question, before S5. radio/sync.
7. bostrom. the same property for the second chain from its own genesis (launch tracker); nothing here is pussy-specific.

7. sources

• zheng release/0.4: specs/recursion.md, audit/wrap-fastverify-2026-10.md, audit/ivc-speed-2-2026-10.md, audit/accumulation-2026-10.md; PR #70 (block aggregation, draft).
• bbg master: rs/src/root.rs, rs/src/checkpoint.rs, dimension version 3 (PR #43).
• mudra: specs/neuron-auth.md (NSIG1).
• soft3: chain §0, §2.7, §2.8, §3.3, §3.6, §5, §7; proof-system-repair; privacy-frozen; steps-blocks-epochs; goldilocks-parano1d.
• tru specs/rewards.md §7–8 (the fold and its subsidy).
• parano1d: parano1d.org sections 02, 03, 04, 09, 14 ("the present proves the past", bootstrap from proof, proofs built where the information lives, recursive history, prove first, mine second), read 2026-10-17; workspace analysis in goldilocks-parano1d.