leios conditional diffusion

Yves Hauser's §5.6 — supporting the full-diffusion conditional analysis

Purpose

Yves Hauser's §5.6 extension to the Leios ΔQ report (his notebook analysis.ipynb on branch yveshauser/improved-deltaq-notebook in ouroboros-leios; our framing / derivation write-ups of it are 5.6-full-diffusion-framing-draft.md and 5.6-conditional-derivation-walkthrough.md) answers a specific network-safety question:

Given that an EB was certified at the voter deadline $t_v = 7\text{ s}$, what is the probability that all $N = 2500$ honest nodes have received the EB body by the end of the round at $t = 14\text{ s}$?

Linear Leios inherits from Full Leios a network-safety property: certification of an EB implies its body has reached every honest node in time for the next round. If this doesn't hold, honest nodes can fall behind the certified chain state, breaking Praos timing assumptions. §5.6 quantifies the probability of that property holding in the ΔQ model.

The 14 s is not a hard wall. A certificate is includable only if the next RB arrives ≥ 14 slots after the announcing RB (CIP inclusion rule), so the binding constraint is next-RB arrival, and CIP Constraint 2 bounds full transmission against next-RB processing with some slack. A node that misses recovers via MsgLeiosBlockRangeRequest — at the cost of delaying its own chain adoption (the certified-EB "urgency inversion" — a certified EB becomes as urgent as the RB it blocks, CIP:1193-1198), not an instant safety break. So $F_{\text{full}\mid C}(14)$ is a conservative proxy for the safety margin, not a cliff edge.

This document records how our branch's mux telemetry supports that analysis — measurement of the formula's inputs, direct validation of its output on a testnet, and runtime-adaptive levers derived from the formula's structure. Companion to leios-overlap.md, leios-testnet.md, and leios-report-gaps.md.

What §5.6 computes

The closed-form result:

$$F_{\text{full}\mid C}(t) = \frac{G(t)^N \cdot \overline{B}(\lceil\tau M\rceil-1;, M,, G(t_v)/G(t))}{P(C)}\quad(t \ge t_v)$$

In plain English. The numerator is the joint probability that all $N$ nodes arrived by $t$ and the voter subset generated a quorum by $t_v$. The denominator is the marginal certification probability $P(C)$. Their ratio is Bayes' rule turning the joint into the conditional "given certification, everyone made it".

Where:

• $G(t)$ = the per-node end-to-end EB-body arrival CDF from multi-hop diffusion. A node's arrival time is the sum of the per-hop times along its path — so its distribution is the per-hop transfer-time CDF convolved once per hop, mixed over the path-length distribution (cdf_blended_delay(s_eb_body_kb) in Yves's notebook). The per-hop CDF is parametrized by CC, loss, and RTT bins; the path-length distribution comes from a regular random graph (2500 nodes, degree 10) in the current implementation.
• $N = 2500$ — honest nodes.
• $M = 600$ — committee voters.
• $\tau = 0.75$ — quorum threshold.
• $t_v = 3L_{\text{hdr}} + L_{\text{vote}} = 7\text{ s}$ — voter deadline.
• $t = L_{\text{total}} = 14\text{ s}$ — round end.
• $P(C) = \overline{B}(\lceil\tau M\rceil-1;, M,, G(t_v))$ — marginal certification probability.

At the report's default parameters: $F_{\text{full}\mid C}(14) \approx 1.000$ at every EB body size up to 512 kB, under either Mathis or CUBIC. The formula's interesting structure (the Binomial factor) only becomes informative when $G(t)$ is appreciably below 1 in $[t_v, t]$, which is not the case at those parameters. (Intuitively: the Binomial factor's success parameter is $G(t_v)/G(t)$ — "a voter that arrived by $t$ also arrived by the earlier deadline $t_v$" — so it only does work when a real fraction of nodes are still arriving between $t_v$ and $t$. If $G$ has already saturated to ~1 by $t_v$, that parameter is ~1, the factor pins to 1 along with $P(C)$ and $G(t)^N$, and $F$ collapses to 1 trivially. It "bites" only when the arrival CDF is still climbing across $[t_v, t]$ — larger payloads, higher loss, or longer RTT.)

Why the tail dominates when it bites. When a real fraction of nodes are still receiving the EB between $t_v$ and $t$, the $G(t)^N$ factor is what makes $F_{\text{full}\mid C}$ hinge on the upper tail of the arrival CDF rather than its centre. $G(t)^N$ is (under the i.i.d. assumption of caveat 1) the probability that all $N \approx 2500$ nodes arrived by $t$ — a max-over-$N$, so it is governed by the slowest stragglers: the deficit $1 - G(t)$ in $G$'s upper tail. Raising to $N$ amplifies that deficit sharply — $G(14) = 0.999$ gives $0.999^{2500} \approx 0.08$, but $G(14) = 0.9999$ gives $0.9999^{2500} \approx 0.78$: a 10× change in the tail deficit swings the factor ~10×. And $G$'s tail is inherited, through the per-hop convolution, from the per-hop transfer-time tail — per-hop tail → (convolution over path length) → $G(t)$ tail → raised to $N$ → $F_{\text{full}\mid C}$. That is why the per-hop input must be characterised by its measured tail shape, not a mean-and-variance summary — the very information a symmetric-band description discards (see Per-hop CDF).

However, the 1.000 is body-only and honest-case. Body-only: $G$ is the 512 kB EB-body arrival CDF, not the up-to-12 MB closure. Each node fetches only the closure's missing fraction, so with normal pre-diffusion the 1-hop bound applies (feasible under CUBIC, ~0.93 under Mathis); under pre-diffusion failure or adversarial withholding the full-blended bound applies instead (Mathis ~0.14) — see Closure coverage below. Honest-case: $G$ assumes the body diffuses from its honest producer to the whole mesh; under an adversarial producer that serves only enough voters to certify (threat-model T22), the relevant object is a different CDF, $G_{\text{adv}}$, re-diffusing from a scattered seed set in the tighter $L_{\text{diff}}$ window (see Adversarial diffusion below). The honest body-only 1.000 is necessary, not sufficient, for the safety property it is often read as establishing.

Modelling assumptions. Yves's derivation lists six explicit caveats:

1. i.i.d. arrivals across nodes — real arrivals are positively correlated (shared paths, common bottlenecks). Makes the formula pessimistic: true $F_{\text{full}\mid C}$ is larger.
2. Committee size fixed at $M = 600$ — real Leios uses stake-weighted Poisson sortition. The bias largely cancels in the numerator/denominator ratio.
3. $G$ scope is EB body only — the 12 MB closure needs a different formulation (the Closure coverage section covers that separately).
4. Stake-independent hop count — if larger SPOs are systematically better-connected, committee oversamples fast nodes and the formula is optimistic: true $F_{\text{full}\mid C}$ smaller. Opposite direction from caveat 1.
5. Comparison to Coretti et al. 2025 Lemma 7 is by analogy — the formula is a fresh ΔQ-model derivation.
6. No Monte Carlo cross-validation in Yves's version.

Which caveats our machinery addresses. Caveats 1, 3, 4 are addressable by measurement — 1 and 4 via the per-EB arrival log (see below), 3 via the Closure coverage section (which also touches our tx-submission machinery). Caveats 2 and 5 sit outside our machinery: caveat 2 is a sortition-randomness question (network telemetry doesn't observe committee-selection bias), caveat 5 is a theoretical question (whether Lemma 7's analogy holds is not a measurable property). Caveats 1 and 4 have opposite directional biases that partially cancel; the measurement campaign lets us quantify each independently and see which dominates.

Closure coverage

§5.6's $F_{\text{full}\mid C}$ is body-only: $G$ is the 512 kB EB-body arrival CDF. The safety property Linear Leios actually needs is about the closure — the up-to-12 MB set of transaction bodies the EB references — since a node cannot validate the EB (and so cannot apply the certifying RB) until it holds the whole closure.

Yves's notebook answers the closure question at the feasibility level (its §5.2/§5.3 — can the network deliver the closure in time), rather than as a conditional $F_{\text{full}\mid C}$. At 12 MB:

• 1-hop (each node fetches only its missing $\pi_1$ fraction from an upstream peer): $P(\le 7\text{ s}) \approx 0.933$ Mathis / $0.999$ CUBIC — feasible under either throughput model.
• Full-blended (worst case: the closure is not pre-diffused, so the whole 12 MB traverses the multi-hop mesh): $P(\le 14\text{ s}) = 0.139$ Mathis / $0.991$ CUBIC — Mathis fails, CUBIC essentially succeeds on network delivery alone.

Each node fetches only the closure's missing fraction (miss rate $\pi_1$) during the diffusion window. Under normal operation $\pi_1$ is small (~0.06), so that fetch is small and completes 1-hop — the baseline, comfortable (feasible under CUBIC, ~0.93 under Mathis). Where pre-diffusion has not delivered the EB's txs — honest failure or adversarial withholding — $\pi_1$ approaches 1, most or all of the 12 MB must be fetched, and the full-blended bound (Mathis 0.139) applies:

• Honest pre-diffusion failure (low $\alpha$): the closure isn't pre-diffused, so it is a worst-case blended fetch.
• Adversarial withholding (the $G_{\text{adv}}$ / T22 case above): the producer serves non-voters nothing, so their only closure source is post-certification re-diffusion inside the tight $L_{\text{diff}}$ window.

So closure coverage is comfortable in the honest baseline (pre-diffusion working) and binds precisely in the degraded and adversarial regimes — the same ones where $G_{\text{adv}}$ bites. A full conditional closure-coverage formula (the closure analogue of §5.6's body $F_{\text{full}\mid C}$) is not part of Yves's notebook; the feasibility bounds above, together with the $G_{\text{adv}}$ analysis, are what the current work provides.

Measurement. Log closure-completion times (not just body arrivals) at every node; the per-EB arrival log of leios-priority-measurement.md must carry a closure-complete timestamp per node per EB. The informative comparison is closure completion under honest conditions (pre-diffusion working, expected ≈ the 1-hop bound) versus under induced pre-diffusion failure or a T22 injection (expected to fall toward the full-blended bound) — the same experiment as $G_{\text{adv}}$.

Adversarial diffusion and the G-adv counterpart

§5.6's $G$ is the honest-case body CDF: the EB diffuses from its honest producer through the broadening gossip tree, every node pulling along the same expanding front. The threat model's T22 breaks that premise. An adversarial producer serves the body/closure to just enough committee voters to reach the 75% quorum, and to no one else. Certification succeeds — the voters saw it and voted — but the ~1,900 non-voter nodes have received nothing from the producer; their only source is whichever voters happen to hold it.

This is not a corner case; it is the scenario the CIP's $L_{\text{diff}}$ is explicitly sized against. The 75% quorum under ≤50% adversarial stake guarantees a certified EB is held by >25% of honest nodes (CIP:375-379), and $L_{\text{diff}}$ is the budget for those holders to re-diffuse to everyone else. So the object that actually bounds safety under adversarial production is not $G$ but:

$G_{\text{adv}}(t)$ — the CDF of the 12 MB closure reaching the whole mesh, starting from an adversary-chosen ~25%-of-nodes seed set, within $L_{\text{diff}} = 7$ s.

$G_{\text{adv}}$ is harder than $G$ on three axes at once: the origin is a scattered fraction of the mesh, not a point; the clock is the tighter $L_{\text{diff}}$ (7 s), not the full round; and the seed set's geography is adversary-chosen — the adversary picks voters that are topologically clustered, maximising distance to the rest. Nobody has computed it — not the report, the CIP, or Yves — yet it is the honest safety question once an adversarial producer is admitted.

Computing it is a small modification of Yves's machinery: replace the single-origin per-hop convolution with a multi-source diffusion seeded from a random (baseline) or worst-case-clustered (adversarial) 25%-node set, and evaluate the all-arrived probability over the remaining 75% in a 7 s window — a multi-source spread from the scattered seed set, rather than the single wavefront broadening from one producer.

Measuring it is a clean testnet injection (see leios-testnet.md's campaign adversarial menu): a producer that serves the closure only to a configured voter subset, with $\hat{F}$ read over the non-voter nodes — a direct empirical $G_{\text{adv}}$.

The seed-egress corollary. Even in the honest case, the seed-hop story concentrates load: ~76% one-hop coverage means ~1,900 nodes pull 12 MB from big-ledger seeds within ~3 s, and stake-weighted selection points them at the largest pools. A top pool that is a big-ledger peer of ~50 nodes must serve ~600 MB in a ~3 s burst ≈ 1.6 Gbps — plausibly the binding constraint before any per-hop TCP effect the report models, and a simple division nobody has done. Under $G_{\text{adv}}$ it is worse: the re-diffusing holders are whichever voters the adversary seeded, possibly a few high-stake nodes, concentrating egress further.

Grounding §5.6's inputs and caveats

Our tracing produces empirical replacements for the formula's inputs, and lets us quantify the caveats it rests on.

Per-hop CDF: direct timing, or estBurstS reconstruction

Measure the per-hop transfer-time CDF directly: bracket each fetch at the driver — the request→full-reply latency, from mkSimpleDriver's recvMessage (or, no code change, the TraceSendMsg/TraceRecvMsg timestamp gap it already emits); for a pipelined chunked fetch, the batch completion (all chunks in), not per-chunk. That number is the composed per-hop transfer time (RTT + peer processing + serialization + any loss/RTO), it captures the loss-recovery tail the safety property turns on, and it is CC-agnostic. Aggregated per peer-distance bin, these per-fetch times are the empirical per-hop CDF that plugs into the convolution producing $G$. Three caveats. Under pipelining (closure chunks) bracket the whole logical message — first request out to last reply in — not each chunk: per-chunk brackets are inter-arrival gaps with the RTT amortised away. It folds in the upstream's serve time (disk read/validate) — genuine per-hop diffusion delay, separable only as a mean (the intercept of a T_wait-vs-size regression, minus the cookie RTT). And if you convolve your own per-hop T_wait into $G$, that assumes hop-independence (caveat 1) and omits the handoff between hops — the notify-and-request latency from one node finishing its fetch to its downstream issuing the next, which neither hop's T_wait covers. Both are avoided by measuring $G$ end-to-end from the per-EB arrival log (the headline route), which needs no composition at all: the measured arrival already includes every hop and handoff, in situ.

Or reconstruct it from the low-level DeltaQ signals: estBurstS supplies the throughput slope (seconds/byte from response bursts, independent of the assumed $p$ and CC law) and PeerRTT.quantile the timing base (slow-start round durations, steady-state ACK-clocking), together giving per-hop transfer time as a function of message size. Keep this for what direct timing can't do as easily — it decomposes the delay (a divergence is attributable to throughput vs RTT) and its size-slope lets you predict to sizes or topologies you didn't run (convolve over a different path-length distribution). But as a measurement of the completion-time distribution it is a proxy that misses the tail: prefer direct timing for the number, reconstruction for the why and the what-if.

A caution common to all these routes: the machinery exposes two different dispersions, and only one is the model's input. What §5.6 consumes is the per-hop transfer-time distribution — the spread of whole-message (per-burst) completion times across transfers, size-binned — which aggregating the burst samples into the per-hop CDF already yields. It feeds the model by being convolved into $G$, where (via the $G(t)^N$ amplification above) its upper tail sets $F_{\text{full}\mid C}$ — so it is the distribution's shape, its tail especially, that matters, not a single throughput number. What it is not is the per-SDU estDeltaQVVar the trace also emits: the ΔQ|G,S,V residual at SDU granularity (within-burst micro-jitter) — a useful low-level CC diagnostic (BBR's paced delivery vs CUBIC's ACK-clocked burstiness), but not the model input, and not recoverable into it, since per-SDU residuals are strongly correlated within a transfer (one ramp or loss-recovery stall delays many SDUs together). Sampling that slow per-hop tail densely enough — and per regime — to pin down the quantiles $F_{\text{full}\mid C}$ depends on is therefore a per-burst sample-count and stratification problem — see leios-testnet.md.

Congestion-control robustness. DeltaQ is a framework for composing outcome distributions, encoding delay and loss, regardless of their origin, which can be derived or empirical. In particular, building an analytical model of BBR CC is out of scope, but in our framework it is not necessary because we can build up our CDF of choice with inputs from measured data, such as the primitive per-hop delays. Such a CDF is CC-agnostic (and empirically grounds $G$). What is CC-specific is the report's analytical Mathis/CUBIC CDF — a loss-based-controller model; in measured data the BBR estBurstS shows up as roughly flat in $p$ (throughput ≈ the bottleneck rate) instead of the CUBIC rise with loss, so the closed form no longer describes it. Two consequences, both absorbed by measurement:

• A mixed-controller mesh is just a mixture CDF. "Fraction $f$ of far peers run BBR" is a weighted sum of the BBR and CUBIC per-hop CDFs (fast BBR hops, loss-limited CUBIC hops), which the convolution composes without change — $f$ becomes a modelled parameter tying the diffusion CDF back to the near/far design.
• The variance is measured, not derived. Where the CUBIC model derives the completion-time spread from the loss process, under BBR the per-hop transfer-time spread has no clean closed form. It comes from transfer-level events: how many STARTUP ramp rounds the fetch takes (RTT-quantized → staircase), whether it hits a loss-recovery stall (a heavy upper tail), and — because transfers on the far, slow paths where BBR is deployed span many round trips — the periodic drain in BBR's ProbeBW cycle, where it paces below line rate to empty the queue before re-probing, so a transfer spanning that phase is transiently throttled (the probe-up itself, if anything, speeds the transfer; the hiccup is the drain). So the spread enters as the empirically-measured per-hop distribution (the jitter envelope), not a derived term.

So the framework is salvaged by swapping the per-hop input, not the composition algebra: DeltaQ-as-measurement is CC-robust, DeltaQ-as-analytical-prediction is CC-specific. Yves's §5.6 conditional structure — the Binomial factor, the $G(t_v)/G(t)$ intuition — is untouched; only the shape of the per-hop input changes. See leios-fetch-scheme.md's congestion-control note for the throughput quantification.

Path-length distribution

The convolution's other input. Two complementary sources, per gap 3 of leios-report-gaps.md:

• Topology survey: pseudo-mainnet dataset in ouroboros-leios/data/simulation/pseudo-mainnet and analysis notebook cfd.ipynb. Preliminary read shows degree ~30 and diameter 6 hops — the report's degree-10 regular-random-graph baseline is empirically divergent.
• Reconstruction from live diffusion: cross-node correlation of per-EB arrival events on a testnet (leios-testnet.md's "What requires cross-node correlation" section). Produces the actual path-length distribution during EB diffusion, which may differ from shortest-graph-paths due to peer-selection preferences.

Both plug into $G$'s convolution.

i.i.d.-vs-correlated check (Yves's caveat 1)

Yves's caveat 1 says the i.i.d. assumption is pessimistic. Our measurement can quantify by how much:

• Log per-EB arrival times at every measurement node (same log needed for reconstruction).
• Compute empirical correlation between $T_i$ and $T_j$ for pairs of nodes (across the EB population).
• Illustratively — the actual thresholds depend on how close $G(14)$ is to 1:
  • Low correlation (~0.1): i.i.d. is close to reality; formula's pessimism is minimal.
  • High correlation (~0.5): formula meaningfully understates $F_{\text{full}\mid C}$.

This is also exactly gap 2 of leios-report-gaps.md — cross-node correlation silently assumed lockstep. Yves's §5.6 is a specific downstream consumer of what gap 2 asks us to measure.

Stake-independent hop count check (Yves's caveat 4)

Cross-reference stake distribution against observed per-node arrival times. If large SPOs are systematically 2× faster than mainstream ones, the formula is optimistic in caveat 4's direction. Empirical bias direction and magnitude are measurable from the same per-EB arrival log plus the public stake distribution.

Validating $F_{\text{full}\mid C}$ empirically

The formula's output is directly measurable — we don't have to validate only the inputs. Recipe:

1. Per-EB arrival logging across the mesh. Same log required for gap 3's reconstruction: (node, EB_id, arrival_ts) for every EB at every measurement node.
2. Certification outcome per EB. From cardano-tracer's block-diffusion / EB-certification traces.
3. Empirical joint distribution. For each EB $j$ (indexing over the EB population; the per-node index $i$ from Yves's formula is still there, now as a superscript):
   • $C_j$ = certification-succeeded flag
   • $T_j^{(1)}, \ldots, T_j^{(N)}$ = per-node arrival times for this EB
   • Compute whether $\max_i T_j^{(i)} \le 14\text{ s}$.
4. Empirical estimator.

$$\hat{F}_{\text{full}\mid C}(14) = \frac{\left|{j : C_j \text{ AND all arrived by 14 s}}\right|}{\left|{j : C_j}\right|}$$

5. Compare to Yves's formula. If $\hat{F}{\text{full}\mid C}(14) \approx 1.000$, the headline result is validated. If systematically lower, either the formula's assumptions are wrong (revisit caveats 1 and 4) or the mesh is worse than the report's default parameters suggest. Note this validates only the body-only, honest-case headline; closure coverage and the adversarial $G{\text{adv}}$ are separate measurements requiring closure-complete timestamps and a T22 injection respectively (see those sections).

Tail power caveat

At $F_{\text{full}\mid C}(14) \approx 1$ we are counting rare failures: the number of failing certified EBs is $\sim \text{Binomial}(n, 1-F)$. A week at ~1 EB / 20 s gives $n \approx 30,000$ certified EBs, so expected failures are ~30 at $F = 0.999$, ~300 at $F = 0.99$, ~3000 at $F = 0.9$ — the coarse gradations (0.9 / 0.99 / 0.999) are all trivially distinguishable from each other and from 1. The binding limit is the floor: observing zero failures bounds the true failure rate at $\lesssim 3/n \approx 10^{-4}$ (rule of three, 95%), so a week resolves $F$ down to about 0.9999; each further nine (0.9999 → 0.99999) needs ~10× more EBs. If the formula predicts 1.000 but reality is 0.999, ~30 counter-examples/week show up — comfortably detected.

Caveat — independence. These counts assume independent rounds. If failures cluster (gap 4 autocorrelation, or the livelock cascade), the effective independent sample size is smaller than $n$, confidence intervals widen, and the numbers above are optimistic. The autocorrelation is itself measurable (the cascade section in leios-testnet.md), so report $F$ with an autocorrelation-adjusted interval rather than a naive binomial one.

Measurement-definition rigor for F̂

Three definitional points the empirical estimator needs pinned down, or it is biased for boring reasons:

1. Eligibility filter (node churn). "All $N$ honest nodes by 14 s" is ill-defined while nodes restart, sync, or briefly partition — such a node "misses" for reasons unrelated to diffusion, biasing $\hat{F}$ low. Count a node toward a round only if it was up and chain-synced at that round's start (from its own join/sync traces), and report $\hat{F}$ over eligible nodes; state the filter so the number is reproducible.
2. $N$-sensitivity. $F$ is $G(t)^N$ — exponentially sensitive to the node count right where the headline lives. At per-node $P(\text{by }14\text{ s}) = 0.9999$, the all-arrived probability is $0.9999^{2500} \approx 0.78$ but $0.9999^{10000} \approx 0.37$: same per-node CDF, very different headline, purely from $N$. The report uses $N = 2500$; the calibrated pseudo-mainnet has 10 000. Always report $\hat{F}$ with its $N$, and compare to the formula at the same $N$ the testnet ran — never a 100-node $\hat{F}$ against a 2500-node analytical $F$.
3. NTP skew vs same-region hops. $\hat{F}$ itself only needs each node's local "arrived by my 14 s", which is skew-tolerant. But the path-length reconstruction on the same log infers forwarders from cross-node arrival ordering, and same-region hops (6–35 ms) are comparable to inter-host NTP skew (1–10 ms), so within-cluster ordering can invert (cross-region ordering is safe — the ~130 ms gap swamps skew). Fix: tight sync (PTP / chrony) on measurement nodes, or record arrived_from_peer directly (see leios-priority-measurement.md) so ordering isn't inferred from timestamps at all.

Derived validations from the same data

• Slowest-node identity and its temporal structure. For each certified EB $j$, record $\arg\max_i T_j^{(i)}$ (the round's slowest node) and analyse the pattern across EBs. Three qualitatively different regimes are possible — the same three the LeiosFetch analysis names (see leios-fetch-scheme.md's "What remains uncertain") — each implying a different intervention shape:

  • Persistent. Same handful of nodes are slowest repeatedly across rounds; identify the persistently-slow subset for peer-selection or operator review. Targeted per-node intervention pays off.
  • Rotating. Slowest-node identity varies per round with no stable slow subset. Per-node targeting has no stable target; per-round-adaptive levers (voter self-throttle, adaptive body sizing) apply instead.
  • Bimodal (churn-induced). Per-round-type structure rather than per-node — dense-origin rounds see fast completion, sparse-origin rounds see systematically slower completion, with orphaning approximately uniform across nodes within a sparse-origin round. Targeted big-ledger churn (Improvement #8 in leios-fetch-scheme.md) is a specific per-round-type countermeasure.

  Empirical disambiguation comes from computing $\hat{F}_{\text{full}\mid C}(14)$ split by round type (see leios-testnet.md's churn-tendency measurement recipe, item 7) and counting orphan-set overlap across rounds. Reality is likely mixed — mostly rotating/bimodal with a small persistent tail from unlucky peer draws, poor hardware, or bad network position.

• G(t)-empirical vs G(t)-modelled. Plot the empirical CDF of per-node arrival times against the modelled $G(t)$ at each body size. Divergence tells us whether $G$ is over- or under-estimated, and where in the tail the discrepancy lives.

• Correlation matrix. Cluster nodes by peer graph, compute within-cluster vs between-cluster arrival correlation. Directly validates caveat 1's magnitude.

Adaptive levers for improving $F_{\text{full}\mid C}$

The formula makes clear what "improving the odds" means: $G(t)$'s tail is what matters, and specifically the dependence on the slowest nodes via $G(t)^N$. Levers ordered by leverage:

1. Slowest-node targeting

Applicable only when the persistent regime dominates. Per the three-regime distinction described under Slowest-node identity and its temporal structure above, the empirical distribution of $\arg\max_i T_j^{(i)}$ across EBs falls into one of three regimes (persistent / rotating / bimodal), and this lever pays off only in the first:

• Persistent regime. Same nodes are slowest across rounds (unlucky peer draw that hasn't recovered, bad network position, poor hardware, cold-connection dynamics). Per-node intervention pays off. This is where slowest-node targeting is high-leverage.
• Rotating regime. No stable slow subset — the lever doesn't apply; use per-round-adaptive levers (2, 3, 4) instead.
• Bimodal regime. Structure is per-round-type rather than per-node; sparse-origin rounds see systematically worse mesh-wide $\hat{F}_{\text{full}\mid C}(14)$. Targeted big-ledger churn (Improvement #8 in leios-fetch-scheme.md) is the specific per-round-type countermeasure, not per-node targeting.

The measurement path in leios-testnet.md disambiguates. Reality is likely mixed — mostly rotating/bimodal with a small persistent tail — so this lever's applicability depends on the empirical persistent fraction.

When the persistent regime applies:

• Peer-selection at slow nodes could be biased toward well-connected hubs (shorter effective paths).
• The operator can be alerted (kernel tuning, connection diversity, bandwidth).
• When the empirical tail sits close to the deadline — i.e., when $G(14)$ is meaningfully below 1 and the slowest nodes are what's dragging it down — reducing $\max_i T_j^{(i)}$ by a second on the slowest 1 % of nodes shifts $G(14)^N$ far more than the same reduction on $\mathbb{E}[T_i]$ across the whole mesh. At the report's default parameters where $G(14) \approx 1$ already, neither intervention has room to help.

This is a coordination problem — no single node can identify itself as "the slowest"; it requires cross-node visibility from the trace consumer. But once identified, the intervention is per-node.

2. Adaptive body sizing at production time

Yves's formula gives the quantitative justification for how much improvement each 100 kB shave off the EB body buys, via its dependence on $G$ (which depends on body size).

A block producer that observes (via its own peer window) that mesh health is degraded can voluntarily cap the EB body below 512 kB — reducing G(t)'s tail. This is the "adaptive $S_{EB\text{-}tx}$ sizing" lever from leios-testnet.md's reader-view expansion, now with a specific analytical measure of what to trade against.

This lever is also the mesh's stabilizing feedback against sustained-overload livelock, per leios-testnet.md's "Cascade to livelock" section: TxCache amortizes retry cost but doesn't add capacity, so under sustained certification failure it's this lever — not TxCache — that reduces per-round load until certification recovers. That section carries the collapse-threshold and loop-stability measurement recipes.

3. Voter self-throttle (indirect improver)

This lever is structurally different from 1, 2, 4, 5: it does not improve $F_{\text{full}\mid C}$ directly. It lowers $P(C)$ (the marginal certification probability) by discarding valid-but-marginal votes from the tally; the rounds that still certify then have systematically better voter-arrival distributions than they otherwise would. Under positive cross-node correlation of $T_i$ (which is Yves's caveat 1 and likely the real-world case), that better voter timing correlates with better non-voter timing, so $F_{\text{full}\mid C}$ is higher on the rounds that certify — but this is selection, not improvement: the mesh's actual diffusion is no faster, so the unconditional all-arrived rate is unchanged. What it does buy is a liveness-for-safety trade: because marginal voter-arrival correlates with slow non-voter arrival, abstaining preferentially declines to certify the rounds most likely to violate the safety property — fewer certifications, but the certified ones are the well-diffused ones.

Trigger: a voter whose EB arrives just inside $t_v = 7\text{ s}$ — late enough that it is plainly on a slow path, though it could still cast a valid vote — voluntarily abstains. (Distinct from the hard deadline, which already drops voters that miss $t_v$; this drops marginal-but-in-time voters.)

Runs into the observation-manipulation attack surface (Proposal A of threat-model-additions.md) — voters that self-throttle based on observations can be targeted by observation-inflating adversaries. Median-based aggregation and hysteresis apply.

4. Freshest-First-Delivery driven by observed $T_j$

As its 14 s budget runs down without the EB body, a node can (re)direct the fetch at the peer likeliest to deliver fastest — the one that announced the header earliest (header precedes body), refined by observed PeerRTT / estBurstS — and prioritise this EB over older or lower-value fetches competing for the same downlink. Concretely: reissue the LeiosFetch MsgLeiosBlockRequest to the fastest-observed peer and bump its priority, improving $G(14)$ on rounds that would otherwise miss.

5. Peer-topology-aware peer selection

The path-length distribution feeding $G$ is shaped by peer selection. Options:

• Prefer close peers (short RTT, likely same region). Better $G$ under normal conditions, worse under partition.
• Prefer diverse peers (different ASN, different region). Worse per-hop RTT but better resilience.

Yves's formula doesn't tell us which is right — but it gives a quantitative framework for comparing the two under measured $G$. The current network stack's peer-selection strategy is a mix; the formula plus measurement can quantify the trade-off.

Connection to existing report-gaps

Yves's §5.6 is a downstream consumer of several gaps in leios-report-gaps.md, not a new gap of its own:

• Gap 2 (cross-node correlation) — Yves's caveat 1 is the same observation. Fixing gap 2 (measuring correlation) directly quantifies the caveat.
• Gap 3 (path-length distribution) — $G(t)$'s convolution depends on this. Fixing gap 3 (topology survey + reconstruction) directly improves $G$'s fidelity.
• Gap 5 (per-node interface contention) — not in Yves's formulation; affects $G$ in real deployments and would show up in the empirical-vs-modelled $G$ comparison.
• Gap 8 (uncertainty envelope) — Yves lists 6 explicit caveats with directional biases. Under an uncertainty-envelope regime, $F_{\text{full}\mid C}$ carries a confidence interval derived from those caveats.

Not covered by §5.6. Yves's formula is single-round: it treats one certification event in isolation. Multi-round dynamics — cascading feedback from a heavy round that consumes mesh bandwidth, oscillatory recovery after a failure — are outside the scope of the formula and its empirical estimator. That's gap 4 of leios-report-gaps.md (round-to-round feedback and recovery dynamics), addressed by a separate multi-round measurement or simulation.

The measurement campaign that closes gaps 2, 3, 5 also directly serves Yves's §5.6.

Follow-up ideas / open questions

• Closure coverage. Treated in its own section, Closure coverage. Yves's notebook gives the closure feasibility bounds (§5.2/5.3); with the missing fraction small under normal pre-diffusion the 1-hop bound is the baseline, and the full-blended bound applies under pre-diffusion failure or adversarial withholding. Measurement need: a closure-complete timestamp per node per EB (not just body arrival); relevant transport signal is per-mini-protocol DeltaQ on LeiosFetch (MsgLeiosBlockTxsRequest), with tx-in-mempool the complementary tx-submission signal.
• What $F_{\text{full}\mid C}$ looks like under stress. The formula gives ~1.000 at the report's default parameters. What are the parameter regimes where it drops? Empirical sensitivity study: sweep body size, sweep loss rate, sweep RTT bin distribution. Yves's formula computes these cheaply; the interesting output is "at what parameter combination does $F_{\text{full}\mid C}(14)$ first drop below 0.99?".
• Adaptive body-size feedback loop. If §5.6 is used to size bodies adaptively (lever 2 above), that creates a feedback: smaller bodies improve $G$, which raises the threshold at which the producer would downsize, which allows larger bodies again. Whether that loop is stable is worth analysing before deploying. leios-testnet.md's "Cascade to livelock" section now carries the empirical measurement plan (collapse- threshold sweep, adaptive-sizing loop-gain from perturbation experiments); this open question has a concrete recipe rather than being purely analytical.
• The measurement + formula combination gives a very concrete operational test. "Do we see any rounds where a certified EB fails to reach all nodes by 14 s?" is a single-line question with a single-number answer from the testnet log. If the answer is "yes, X per week", the safety property is empirically weaker than the model predicts, and CIP-0164 has to decide what to do about it (revise parameters, revise expected topology, or explicitly accept the observed failure rate).