UPGRADE WINDOW
#11,900 – #11,999
⚠ V13 UPGRADE WINDOW — BLOCKS 11,900 → 11,999 (100 blocks before activation).
Every miner and full-node operator MUST have the V13 binary running by block 11,999 at the latest — the binary swap is consensus-mandatory. NTP synchronisation is strongly recommended (not consensus-mandatory): with the V13 future-timestamp drift cap at 30 s, a host whose clock is more than 30 s ahead of true time will produce blocks that every validator rejects. The recommended window is #11,900 to #11,999 (~18 hours at the target block time, room for one full sleep cycle). Activation lands on block #12,000; from that block on, pre-V13 binaries will be on a stale rule set and pre-NTP hosts will produce blocks that every validator rejects. Recommended sequence inside the window: (1) stop your miner; (2) verify sha256sum -c SHA256SUMS && gpg --verify SHA256SUMS.asc SHA256SUMS against the SOST release key 41B1A46E626064AB524CB99EB6B9E2852AE41A04 once binaries are published; (3) swap the binary; (4) timedatectl and sudo timedatectl set-ntp true if NTP is not active; (5) restart miner with your existing --wallet + --mining-key-label. Do NOT wait until block #12,000 to start — by then any candidate block you mine on the wrong binary or with a drifted clock is already rejected. Last-resort cutoff is block #11,999.
⚠ WHAT V13 CHANGES AT BLOCK 12,000 (CONFIRMED, WIRED IN CODE)
- All cASERT equalizer profiles E7-H35 active — ceiling rises from H20 to H35 via
effective_profile_ceiling_at(height) + validator_profile_ceiling_at(height) in include/sost/params.h. Closes the equalizer calibration started in V6.
- DTD lottery cooldown 5 → 6 blocks —
lottery_exclusion_window_at(height) returns 6 for height ≥ V13_HEIGHT. Deterministic 2-firing exclusion under permanent 1-of-3 cadence.
- Future-timestamp drift cap 60 s → 30 s —
max_future_drift_at(height) returns 30 for height ≥ V13_HEIGHT. NTP synchronisation is strongly recommended post-V13; a host whose clock is more than 30 s ahead of true time will produce blocks validators reject.
- Beacon Phase II-A —
BEACON_PHASE2A_ACTIVATION_HEIGHT = V13_HEIGHT. Local notices.json, ECDSA-SHA256 single-sig, file-only, no HTTP from the node. Operator-signed advisory banner on miner / node startup.
- Beacon Phase II-B — adds N-of-M threshold signatures (default 3-of-5) for critical notices, revocation by notice ID (only threshold-signed notices can revoke), and an optional
mirror_url metadata field that the node never fetches. Active at V13_HEIGHT.
- Beacon Phase III (P2P gossip) —
BEACON_P2P_ACTIVATION_HEIGHT = V13_HEIGHT. The BCNN dispatcher relays valid signed notices between nodes with hard limits (4 KB max notice, 32-notice LRU dedup cache, 8 notices/peer/min rate limit, signature verify, network match, expiry). Pre-V13: DiscardDormant. Advisory only — never affects consensus, mining, or block validation.
- SbPoW hardening — at
V13_HEIGHT the signed PoW preimage grows from V11 layout (7 fields, 129 B) to V13 layout (11 fields, 205 B). New committed fields: timestamp, bits_q, merkle_root, and a chain-specific genesis_hash salt — closes timestamp-restamp, difficulty-fork, tx-set mutation, and cross-chain replay seams. Domain tag bumped to SOST/POW-SIG/v13. See docs/V13_SBPOW_HARDENING.md.
// TRADING — SIMPLE & SECURE BY DESIGN (DEX + OTC P2P)
- SOST DEX (PoPC contracts ↔ gold) — ALREADY SECURE. Trades happen between users via client-side ED25519-signed offers + X25519 end-to-end encrypted relay messages + the on-chain Ethereum smart-contract escrow
SOSTEscrow.sol. SOST Protocol holds no keys, custodies no funds, cannot reverse or arbitrate. The contract itself enforces the trade rules — no admin, no intermediary, no oracle. UI hardening (contract-address allowlist, WYSIWYS sign-time modal, offer fingerprint comparison) is the next web-only sprint. No further consensus change required for the DEX.
- SOST OTC / P2P Board — crypto↔crypto only (BTC, ETH, USDT, USDC, BNB, PAXG, XAUT) — uses atomic swap HTLC for trustless settlement. The candidate branch
feat/atomic-swap-htlc-v13-candidate ships HTLC_LOCK/CLAIM/REFUND validation, wallet helpers, RPC + CLI — all gated by ATOMIC_SWAP_HTLC_ACTIVATION_HEIGHT = INT64_MAX (sentinel OFF). Counterparty legs (Bitcoin Script + EVM contract) and external review are PENDING. Target activation: V14 / block 15,000 only after Phase 4 + Phase 5 sign-off. Until then the chain rejects every HTLC tx_type. See docs/reviews/ATOMIC_SWAP_PRE_ACTIVATION_REVIEW.md.
- OTC / P2P with fiat (bank transfers, SEPA, wire) — NOT OFFERED AS A PROTOCOL FEATURE. The SOST chain cannot see a bank, cannot verify a SEPA transfer, cannot penalise an unpaid fiat leg without becoming a regulated intermediary or inviting Sybil/oracle attacks. SOST strongly recommends users stay in the crypto-to-crypto path (atomic swap above) and treat any fiat OTC as off-protocol, at user risk, with no protocol safety net. The community OTC board still hosts discussion but does not endorse, intermediate, or guarantee fiat trades. See
docs/SOST_TALK_COMMUNITY_RULES.md.
- Simplicity rule for both surfaces — every trade flow follows the same five-step UI discipline: (1) load the official URL (
sostcore.com or sostprotocol.com) only; (2) read the signed offer fields before signing; (3) verify counterparty address against the LOCK/escrow payload; (4) confirm txids on-chain in the explorer; (5) do a small test transaction before any larger amount. Anything sold outside this flow (Telegram DM, screenshots, address-by-chat, advance-fee request) is a scam pattern — Sentinel flags 26 known variants at the chat layer, OTC and DEX pages document each pattern with worked examples.
⚠ FALLBACK TO V14 (BLOCK 15,000) — DO NOT EXPECT THESE AT 12,000
- PoPC Model A + B — full automated lifecycle. Deferred to V14 / block 15,000 (high confidence). Five of nine PoPC consensus-readiness gates are RED today:
POPC_ACTIVATION_HEIGHT missing, no audit daemon, no auto-slash, no auto-settlement, no Ethereum bridge, no end-to-end lifecycle test. SOSTEscrow.sol exists in source (contracts/SOSTEscrow.sol) but is not deployed. PoPC accumulation (25% per block to the PoPC Pool address) continues unchanged at consensus since genesis. PoPC is NOT half-shipped. Full audit: docs/V13_POPC_ESCROW_AUTO_ACTIVATION_GAPS.md.
- Gold Vault governance — spend-side governance (purpose restriction, dual whitelists, per-spend cap, rate limit, 90% block-based miner signaling over a 67-block window ~12 h, Transitional Guardian with 10-block pronouncement window, auto-disconnect at block 25,000). Deferred to V14 / block 15,000. Five of six gates RED today;
classify_gv_spend() exists and is unit-tested but is dead code (not called by the validator). Accumulation (25% per block to ADDR_GOLD_VAULT) continues unchanged at consensus since genesis. Full audit: docs/V13_GOLD_VAULT_GOVERNANCE_GATES.md.
- Memory-Lock per-instance — second anti-pool mechanism originally proposed alongside SbPoW. REJECTED — not scheduled for V13 or V14. Numerical analysis of realistic hardware budgets shows the mechanism penalises small miners proportionally MORE than large rigs (small miners lose ~75% of their threads at the 8 GB RAM floor; rigs lose ~50%), achieving the opposite of the declared anti-pool goal. SbPoW (active since block 7,100) remains the protocol's only anti-pool defense.
Operator decision at block 12,100.
~100 blocks after V13 stabilises, the operator will open the DTD lottery decision in this thread:
Option A keep the DTD lottery at 1-of-3 permanent (cooldown stays at 6) as supplementary redistribution alongside PoPC when PoPC is live ·
Option B disable the lottery; extra-coinbase rewards stay on the original PoPC + Useful Compute path only.
The decision is community-driven, not unilateral.
Community OTC / P2P Board.
Separate from Beacon (which is node-to-node gossip of signed advisory notices), the
OTC / P2P Board is a community discussion room inside
SOST Talk where users post voluntary buy/sell talk between each other
(e.g.
WTB 100 SOST /
WTS 50 SOST).
SOST Protocol does NOT intermediate trades. SOST Protocol does NOT custody funds. SOST Protocol does NOT provide escrow.
No guarantee of buyer, seller, price, liquidity, settlement, or safety. Admins never DM first.
Use small test transactions and verify all addresses independently.
Anyone claiming "official escrow" or "guaranteed buyer/seller" is a scammer — Sentinel (the chat moderation bot) auto-flags these patterns and the chat rules block them.
Three rules that stop most OTC scams:
- Screenshots are NOT proof of payment. Editable, fakeable. Until the money is in your bank or wallet, you have not been paid.
- Verify funds DIRECTLY in your bank or wallet. Log in and check the balance yourself. Do NOT trust SMS / email / push notifications alone (spoofable, lag the actual settlement).
- Beware chargeback risk per payment method. Wait the FULL clearing window before releasing SOST: PayPal F&F (180 days), SEPA / instant bank transfer (8 weeks), Wise / Revolut instant (reversible on fraud claim). Irreversible methods: cash in person, on-chain USDC / USDT.
The first time you open the OTC room, SOST Talk shows a pre-trade safety checklist (acknowledgement persisted in browser localStorage). Sentinel auto-flags pressure patterns (release-first, hurry-up, move-to-DM, screenshot-as-proof, impersonation). Full guide at
sost-otc.html, full rules at
docs/SOST_TALK_COMMUNITY_RULES.md.
See also
sost-community.html.
Beacon is a loudspeaker, not a remote control.
Beacon Phase II-A, II-B, and Phase III (all V13 confirmed) MAY inform; they MAY NOT restart, MAY NOT block any block or transaction, MAY NOT change consensus rules, MAY NOT execute commands on the host, MAY NOT move coins. The validator and the static safety lint enforce these guarantees together (link-time invariant pinned by tests/test_v13_beacon_phase3_p2p.cpp:t15: Beacon code never depends on block_validation symbols).
DTD flip at block 12,100 — VERIFIED AUTOMATIC.
100 blocks after V13 activates, the V11 Phase 2 lottery cadence transitions from bootstrap (2-of-3) to permanent (1-of-3) without any operator action, node restart, miner restart, Beacon notice, RPC call, or config flag. The flip is a pure consequence of is_lottery_block(height, V11_PHASE2_HEIGHT) in include/sost/lottery.h:126; both validator and miner route through the single function. Six audit gates GREEN on main; companion doc docs/V13_DTD_FLIP_12100_AUTOMATIC.md; tag v13-dtd-flip-12100-verification-v01.
V13 Public Scope Update (2026-05-18).
The operator-and-community version of V13 scope is at docs/V13_PUBLIC_SCOPE_UPDATE.md — read it before mining V13. Honest summary: V13 ships cASERT E7-H35, DTD cooldown 5→6, drift cap 60s→30s (NTP strongly recommended), SbPoW hardening, Beacon Phase II-A + II-B (3-of-5 threshold) + III (P2P gossip, advisory only). PoPC + Escrow + Gold Vault governance are DEFERRED to V14 / block 15,000 — five of nine PoPC gates and five of six Vault gates are RED today; shipping half-implemented consensus at block 12,000 is worse than waiting. Memory-Lock per-instance is REJECTED (numerical analysis shows it would penalise small miners more than rigs). The earlier "V15" label has been replaced by "V14" everywhere; the block height (15,000) is unchanged.
// MINER UPGRADE SEQUENCE
1. Pull V13 release tag
2. Verify min_commit matches
3. cmake / make
4. Sync NTP (clock not >30 s ahead)
5. Restart sost-node + sost-miner
BEFORE block 12,000
// SbPoW UNCHANGED
--wallet + --mining-key-label
(mandatory since block 7,100)
NO new wallet migration
NO key export
NO pool key sharing
// IF BLOCKS REJECTED POST-V13
1. Clock > 30 s ahead of true?
2. Old binary?
3. Old cASERT ceiling assumption?
4. Old DTD cooldown assumption?
See docs/V13_MINER_OPERATOR_CHECKLIST.md
// PUBLIC RC MANIFEST
/api/v13_release_candidate.json
docs/V13_RELEASE_CANDIDATE.md
docs/V13_MINER_OPERATOR_CHECKLIST.md
docs/V13_ACTIVATION_PLAN.md
docs/V13_READINESS_GATES.md
// PUBLIC ARTIFACT METADATA (SHA256SUMS SIGNED, binaries NOT uploaded)
/api/v13_rc1_artifact_manifest.json
/api/v13_rc1_SHA256SUMS.txt
/api/v13_rc1_SHA256SUMS.asc
docs/V13_RC1_PUBLIC_ARTIFACT_METADATA.md
docs/V13_RC1_SIGNING_AND_PUBLICATION_CHECKLIST.md
docs/V13_RC1_ARTIFACT_BUNDLE.md
docs/V13_BINARY_PREFLIGHT.md
V13 RC1 SHA256SUMS is now SIGNED.
/api/v13_rc1_SHA256SUMS.txt is signed with the SOST release key (primary fingerprint 41B1A46E626064AB524CB99EB6B9E2852AE41A04, signing subkey E2FCC898520842F0192EF7A46422CC120F51DCEA); the ASCII-armored detached signature is published at /api/v13_rc1_SHA256SUMS.asc (sha256 5e83889bb95d21404c3ae4faedfeb8c04729343fc88b03f5a9e608dd7c228779). release_status = signed_metadata_only. The binaries themselves are still NOT committed to this repo and have NOT yet been uploaded to a public distribution surface (binaries_uploaded = false). Anyone who later downloads V13 RC1 binaries from the operator's eventual release surface can already verify them offline with sha256sum -c SHA256SUMS && gpg --verify SHA256SUMS.asc SHA256SUMS against the release public key. Binary upload remains an explicit manual operator step and will be announced from the BitcoinTalk thread when it happens. See docs/V13_RC1_PUBLIC_ARTIFACT_METADATA.md and docs/V13_RC1_SIGNING_AND_PUBLICATION_CHECKLIST.md.
What V13 does NOT change.
No change to the SbPoW signing contract (active since block 7,100). No change to the coinbase split (50% miner / 25% Gold Vault / 25% PoPC Pool). No change to the emission schedule or the 4,669,201 SOST hard cap. No new wallet format. No new network endpoint. Useful Compute rewards remain POSTPONED — block 12,000 will NOT activate Useful Compute rewards (post #133 invariant unchanged).