Reserved conflict capacity experiment plan

Experimental comparison · 5 September 2026 · opt-in implementation, not promoted

The first bounded comparison is implemented and tested. See docs/RESERVED_CAPACITY_V1.md for results, journal rules, costs, and remaining gaps. The workloads below describe the broader experiment; not every dimension is covered.

Question and control

Can bounded conflict accounting preserve unrelated existing sponsored receipts under unsolicited equivocation floods without permitting known conflicting slots? Use identical claims, signatures, arrival times, and total accounting capacity. Keep the current blanket-suspension implementation as the named control. The frozen semantic discovery configuration and trees remain unchanged.

Candidate state and rules

Maintain at most N accepted receipts, with a quarantine flag reserved in every accepted sponsored slot record. Maintain a separate bounded map of at most F foreign slot tombstones for valid evidence about slots not accepted locally. No new signed-proof archive is implied; evidence forwarding remains separate.

• Admission first checks eligibility and both local/foreign quarantine maps.
• A newly accepted sponsored slot reserves its quarantine state before the durable acknowledgement. A rejected attempt reserves nothing.
• Valid evidence for an accepted slot sets its reserved flag even if the foreign map is full. Duplicate evidence changes neither counts nor storage.
• Valid evidence for an unknown slot inserts a foreign tombstone when space exists.
• At F foreign tombstones, refuse new sponsored allocations, including claims whose slots are absent from both maps. This avoids accepting evidence that may have been dropped under saturation. Existing clean receipts remain usable.
• Do not evict tombstones or release reserved flags within an epoch. Clean replay creates no new allocation; quarantined replay fails. Open-cost eligibility stays separate but still obeys the shared receipt capacity.

The full-map gate is derived from persisted occupancy and survives restart. Epoch rollover atomically installs a new policy and empty accounting after the previous epoch has ended. Evidence from the old epoch cannot affect new allocations. Sync errors poison the handle; partially acknowledged state is never served. This design needs a versioned journal representation and downgrade rejection; reinterpreting old records silently is prohibited.

Matched workloads and measurements

Compare the control's N receipts plus N conflict entries against the candidate's N receipts with reserved flags plus F=N foreign entries. Report actual bytes, allocation overhead, and journal growth; equal entry counts are not equal RAM. Sweep smaller F only as separately labeled budget variants.

Use deterministic schedules: honest-first, attack-first, alternating, replay storms, duplicate/reversed evidence, invalid evidence, local-slot conflicts after foreign saturation, clean restarts, interrupted commits, and epoch boundaries. Include an adversary sponsored by the same issuer as honest publishers, multiple issuers, and cheap identities. Attacker power is valid conflicting credentials, not forged signatures. Report issuer assumptions and offered valid-proof counts.

Measure accepted honest/newcomer claims, continued usability of unrelated receipts, quarantined-slot usability (must remain zero after committed evidence), new admissions rejected, open-lane capacity, signature checks, RAM, bytes written, and restart time. Repeat identical seeds and operation schedules for both policies. Later integrate retention and measure honest recall; admission counts alone cannot establish useful semantic discovery or newcomer fairness.

Promotion gate and expected failure

The candidate must preserve unrelated existing receipts without accepting known quarantine, exceeding declared bounds, or forgetting committed restrictions after restart. A single safety counterexample blocks promotion. Publish attack-first starvation and refusal rates even if honest-first availability improves.

An attacker can still fill capacity before honest newcomers arrive. Reserving flags does not solve that admission problem, signature-verification floods, disk exhaustion, eclipse attacks, or unavailable evidence. Specify bounded verification queues before network exposure. The default runtime policy remains unchanged. Keep the opt-in candidate behind review until broader schedules and durability failure injection are complete.