Security and fault tolerance

Validators are run by parties whose identities are known, bound by legal contract, and paid under service agreements in real money. As a result the network needs no inflation, and a customer chain's fuel token needs no market value at all.

This is a fundamental cost difference, not an optimisation at the margin. The competing model must sustain an asset's price to maintain security; somebody ends up paying that cost.

Who pays for security — and one question this document cannot answer

The sentence above is about a customer chain's validators, and there it holds: the customer pays real money under a service agreement, so that chain runs whether or not LOVE9 is worth anything. But the signers of the shared 9Chain network are not covered by it — Nine roles places them under the LIBERTAS part of the daily release, meaning they are paid in LOVE9 itself. Two different models, and this document used to let them blur together.

All three mismatches, stated in full, because a careful reader will find them whether or not we say so:

Which is design and which is destination must be said plainly. The two ways of counting votes belong to two different tiers: technical governance of the chain counts staked capital, because that is what bears the technical consequence; governance of rules and shares aims at one-person-one-vote, and it cannot run yet because the tier that counts people is unfinished. Until it is, every vote on this network is a vote by staked capital, including votes carrying the community's name. As for the founding period's stake: because the project advanced it, it demonstrates operating commitment, not personal capital at risk — two different things, and only the second deters.

The hardest question is left here because it has no answer yet: in the interval — when the endowment cannot open because the receiving mechanism is LEFT BLANK, while the scaffolding has begun coming down — the source that pays the shared network's signers is a gate not yet passed. This is not an operational detail: it is the condition that keeps the promise "nobody can switch it off" from being empty. A network secured by token price weakens when the price falls; a network secured by salary stops entirely when whoever pays the salary runs out — and this project promises to remove that payer. Anyone who can answer this should write to the two addresses in Taking part, and the doors still owed; it is the most valuable contribution available.

Three operating modes, one codebase

Figure 22 — Three modes differing in configuration, not in code.

The law of fault tolerance

Consensus needs more than two thirds of total voting power to finalise a block. With power divided equally, a network of n nodes tolerates f sudden failures according to n ≥ 3f+1. This is a mathematical constraint; no configuration lowers it.

Three things easily misread

Counting validators is not counting fault tolerance. What decides it is the number of independent failure domains, because what dies is the machine, not the process. Nine validators on one cluster tolerate exactly one machine: lose it and the network stops, even though the validator list is still nine lines long.

The threshold for spreading machines follows from the halting rule itself, not from a feeling of safety. A network halts when a third of voting power disappears at once, so no machine may hold a third or more of the validators — with nine validators that means at most two per machine, that is at least five machines, and those five must fail for different reasons before they deserve to be called five domains. That number is an arithmetic consequence of the consensus threshold: the only way to lower it is to change the halting rule.

From which comes a way to read every piece of news about decentralisation: one machine leaving the cluster is not yet decentralisation. That step is real and necessary, but the measurement does not move while one machine still holds more than the halting threshold — before that point, losing exactly one machine still loses the whole network. That is why this document writes decentralisation as a gate with a countable threshold rather than a process to be narrated step by step: a step narrated sounds like a result, while the result has only one place to be read — ask the network how many machines its voting power sits on.

Consensus would rather halt than split. Past the threshold, the chain stops entirely instead of forking into two branches each claiming to be real. That is the safe choice, not a defect. The duty that comes with it is fast recovery: a time objective, a procedure, and rehearsals.

Cheap capital requirements make a chain cheap to capture. If the self-bond threshold is low, the network's total stake is small too, and a modest sum buys two thirds of voting power. That is why the threshold is set high. But its status must be stated correctly: the text engraved at genesis says plainly that the chain does not yet enforce that floor in consensus — it is a proposed figure and an operating discipline, not a protection already in place. Enforcing it is a gate not yet passed, and you can check that by reading the genesis file itself.

In short: a network is only trustworthy when you know exactly how many failures it survives — and that number is usually smaller than the validator count you can see.