N2 · The MoE window

Where mixture-of-experts certificates actually appear in chain history.

MoE proofs were legal from height 71,935 (PIP-2, the only consensus change with a proposal) to 91,630 (a softfork no document proposes). Certificates using them appear only in bins 84,000–91,999: 1,929 of 97,900 blocks all time (2.0%), first appearing 12,065 blocks after legalization at this bin resolution, and none since the retraction.

Denominator: canonical blocks per 1,000-block bin; cell shading scales with each bin’s MoE share. Data tier: semi-live, frozen at DS-003 tip 97,899; read from the committed snapshot, never fetched live. Full analysis: OBS-006.

N9 · How the protocol works, in one screen

The mechanism in four steps, source-verified against the published mining stack. Mining is the search for a tile whose keyed BLAKE3 commitment clears the difficulty target, BLAKE3(seed, tile) < 2^(256−b). One clause below is inferred and marked; everything else is verified.

1. 01A forward pass is the work unit

   The official miner is a vLLM quantization plugin: it registers a pearl scheme and replaces quantized linear ops with a noisy GEMM kernel, so a genuine LLM forward pass doubles as the proof-of-work, and the kernel denoises so inference still gets the correct result. The mined call is a tiled INT8 matrix multiply: activations are int8 clamped to ±63 with per-token dynamic scales, and weights arrive pre-quantized. Shapes are opportunistic, not chosen: m is the live batch-token count, n and k come from the layer, and the same three values land in the certificate, so the chain records the true dimensions of whatever matrices were multiplied.

   Source: Keshi source review, pearl-src @ v1.3.0
2. 02Where the noise overhead comes from

   Before the multiply, both operands are perturbed with deterministic rank-r noise (r = 128 on mainnet), seeded from the certificate’s own commitments. Two noising passes are genuine extra work, stated as fractions of the call’s base m·n·k INT8 MACs: the activation side costs 2r/n and the weight side 2r/m, and the weight side is two rank-r products because its seed depends on the activation commitment and cannot be cached. Denoising costs 2r/k and is fused into the GEMM epilogue on the resident accumulator, so there is no extra read or write of the m×n output. The transcript hash adds 1/(2r) of the op count on its own basis. The overhead lab below turns these terms into numbers.

   Source: Keshi source review, pearl-src @ v1.3.0
3. 03Acceptance is dimensional

   Consensus checks ranges, never contents. The verifier enforces: rank a power of two in [32, 1024] and divisible by 16; k divisible by 64 with 1,024 ≤ k ≤ 65,536 and 16r ≤ k ≤ 4r²; tile h·w in [32, 256] with h and w even; m and n at most 2^24. Nothing constrains matrix contents or provenance: the accepting predicate is purely dimensional plus the difficulty comparison, so any matrices that satisfy it are accepted. The reference CPU miner draws fresh random matrices every iteration; the redraw is that path’s documented nonce mechanism.

   Source: Keshi source review, pearl-src @ v1.3.0
4. 04The configuration surface

   Engagement floor

   The official stack mines a GEMM call only above min_m=1024, min_n=256, min_k=1024. These are miner-side YAML defaults, not consensus constants. Below the gate the call routes to pearl_gemm_vanilla, a plain GEMM with no noise and no hashing, so a decode step with fewer than 1,024 concurrent sequences never mines.

   Skip flags

   The kernel exposes skip_reduction and skip_denoising, a path that would produce hashrate without restoring a usable inference result. In the published source those flags appear only in tests, and the production path passes both false (verified). The certificate carries no record of them (inferred: the documented 164-byte public-data layout holds dimensions, rank, tile patterns and commitments, no kernel flags).

   Rank and tile patterns

   Noise rank is a miner-chosen proof parameter, not throughput. The shipped kernel compiles only ranks 64 and 128, and MINER_* environment variables can override rank, patterns and tiles. Since height 96,251 consensus rejects rank below 128 and multiplies the difficulty bound by 128/rank.

   Shape choice

   The official stack takes its shapes from live traffic. Custom software may declare any shape the predicate accepts; the declaration is a claim (the ladder below grades it).

   Source: Keshi source review, pearl-src @ v1.3.0

neutral mechanismEach row of the configuration surface is something the published software permits, reported as measurement. Whether any given operator uses a configuration is a separate question this panel does not answer. What a certificate can and cannot prove is the claim ladder (N7, below).

Neither Nakamoto figure is quotable without its basis. Addresses are not entities: pool labels attach to coinbase payout addresses, one operator can span several addresses and pools, and no label names a party. The co-spend measurement of that gap is the entity panel below and OBS-009. The work basis apportions each bin’s exact integer work sum to pools by block count inside the bin (an inferred step; per-block work stays in the dataset); block counts and totals are exact. The bases diverge because the unattributed mass sits mostly in early low-difficulty bins. Rolling 24h/7d/30d label windows stay live on /mining. Data tier: semi-live, frozen at DS-003 tip 97,899; read from the committed snapshot, never fetched live.

Largest entity

10,861 blocks from 1 address

Multi-pool entities

0

Largest unattributed cluster

107 addresses, 8,931 blocks

Clusters are lower bounds on linkage, never identities: co-spend joins addresses whose coinbase outputs were spent together, so one operator can still appear as several clusters, and no cluster names a party. The entity collapse is a historical genesis-era fact, not a current-window threat: the largest unattributed cluster went dark at height 30,768. Denominator: 97,900 blocks with a decoded coinbase payout address. Data tier: semi-live, frozen at DS-004 tip 97,900; read from the committed snapshot, never fetched live. Full analysis: OBS-009.

N7 · What a certificate proves

The claim ladder: each rung is strictly weaker evidence than the one below implies. Reading a figure above this rung boundary is over-reading it.

1. 01Declared shapea claim

   The certificate carries the matrix dimensions the miner says were multiplied (m, n, k) plus rank and tile parameters. Consensus checks their ranges, never their truth: any matrices that satisfy the predicate are accepted.

2. 02Committed operandprovable, public checkpoints only

   The certificate commits byte-exactly to the weight-side matrix with a keyed BLAKE3 root. Recomputing that root from a published checkpoint proves which operand was committed, and only public, static checkpoints can be checked at all: private, fine-tuned or evolving weights are indistinguishable from noise.

3. 03Declared matmul, inference, customersnever provable on chain

   The ZK proof opens at most 256 output entries of the declared result. It never proves the full declared multiplication ran, that inference occurred, or that anyone was served.

Declared dimensions are what the miner claims was multiplied; the ZK proof covers at most tileSize ≤ 256 output entries of the result, never the full declared matmul, and never a measure of AI work performed.