Week 35 · 2026

Highlights

19 PRs merged, 3 opened and 63 commits across three repos, with no issue activity. The headline is the specification stack: six PRs, in flight since late July, that move the spec from LaTeX to Typst, formalise it in Agda, and differentially test the node and validator against the machine-checked reference. The stack carries the Maintenance and DevX milestone; its integration merge (#2847) has none, which is why the reactive bucket looks bigger than it is.

Reactive. All three PRs opened last week merged. Blockfrost query caching (#2835) fixes the per-block TimeHandle rebuild behind roughly 75% of steady-state Blockfrost API usage (#2833), and along the way caches the genesis fetch, fails fast on CBOR decode errors instead of swallowing them, and puts a retry limit on tx submission. Script integrity fixes (#2836) unblock the reference-script commit pattern (#2594). Strict value UTxO (#2837) forces L2 UTxO values at construction (#2831); its follow-up (#2844) fixed a seed-dependent flake in the thunk test (the test seeded an unforced UTxO, violating the every-ingress-forces design it checks) and made the one ingress that was only incidentally forced, the deposit observation, force explicitly, with a new property pinning that. The KZG trusted-setup warm-up is now traced (#2843): it ran before the tracer existed, so a node could burn minutes of CPU while writing nothing (see M3 below), and log batches now flush instead of sitting in a 64KB buffer, so lightly-logging nodes are no longer silent to docker logs. The bench variance pair opened in W33 merged (#2827, #2828, stragglers in #2840): PR benchmarks now measure PR and merge-base back to back on the same runner and aggregate same-machine pair deltas, cancelling GitHub's cross-runner CPU spread, with pinned seeds, raw-series JSON reports, RTS gauges and tmpfs cluster state. Flakiness fixes (#2838) and the spec font trim plus faster-clone docs (#2839), both described last week, landed Monday as noted. Of the three PRs opened: smoke tests lose about 10 of their 30 minutes, which went almost entirely to two protocol-deadline waits, without narrowing any validity window (#2850, merged Monday morning); the partial fanout chunk-size search builds at most five candidate transactions instead of a dozen at head size 4000, by capping the search at the deployed CRS length and not rebuilding the accumulator per candidate (#2849, for #2848); and the fanout property tests now generate outputs carrying native tokens and datums rather than only ada, size-capped because per-output size, not count, is what exhausts execution memory (#2851).

Maintenance and DevX (M5). The specification stack (#2784 through #2788 and #2842, integrated via #2847). In order: the head logic now enforces the spec's rule that a commit and a decommit cannot be in flight at once, and a decommit blocked past its TTL is rejected with a new DepositInFlight reason instead of being silently dropped (#2784), the only running-node behaviour change in the stack; the spec prose moved from LaTeX to Typst, with native diagrams replacing TikZ/SVG and the LaTeX toolchain deleted (#2785); the Agda formalisation went into the literate spec tree, typechecked on every spec build (#2786); its decidable core is extracted to Haskell as hydra-agda, with a CI gate that fails if the committed extraction drifts from the source (#2787); and new agreement suites differentially test the real Plutus head validator and the real head-logic handlers against that extracted reference (#2788). The final PR adds a global solvency invariant over the head's on-chain transactions and a lint for unreachable error codes, structure that would have caught a recent deposit bug (#2842). Separately, hydra-explorer was redeployed on EC2 (hydra-explorer#61).

Operational Excellence (M3). linux/arm64 hydra-node docker images are now published alongside amd64 (#2814). The investigation behind it found that 2.2.0+ amd64 images under Rosetta on Apple Silicon do not just run slowly, they never come up: the KZG trusted-setup warm-up, about a second natively, had not finished after 16 minutes of emulated CPU, and since it ran before the tracer started the container looked healthy while logging nothing. The native arm64 image starts in about a second. The warm-up tracing follow-up (#2843) is in the reactive bucket above.

KPI & Outcome Achievement (M6). Routine only: the W34 note published.