[danielgorgonha]

What & why

Part of the fee release (#847). When the lower network fee ZIP 2009 allows is in force for a vault's build, the coordinator's check of its own transaction now requires exactly the fee the builder's rule gives (1,000 per action), instead of either fee the era accepts. Before, a signer that ignored its permission and paid 5,000 would have passed silently, and the vault would have kept paying the higher fee and kept that mark on chain. When the lower fee is not in force, nothing changes: exactly 5,000.

This is a consistency check on the coordinator's own build, not a defence. The devices judge the fee they sign and, from block 3,590,000, accept either fee. With the switch at its default (ON) every vault still pays 5,000, so nothing a payment pays changes in this release.

• orchestrator/src/fee.rs: guard_set returns fee_rule_for(target, zip2009_in_force(...)), a set of one, read with the same predicate and the same height as the signer.
• konclave-seal/src/epochs.rs: fee_marginals_permitted has no caller left. It stays, with its doc rewritten in place, so the crate built into the device (and the committed ui/src/wasm-pkg, which still reproduces byte for byte from source) is unchanged in this release. It is removed with the next device-package rebuild.
• deploy/helper/README.md: with per-vault, a send refused because the coordinator's own build paid 5,000 where the lower fee was required means the signer did not follow the permission; set the switch back to 5000 and restart.
• Changelog: the existing B3b entry (helper-server/CHANGELOG.md and its fragment) says the guard requires the exact fee.

Verify-before-finishing checklist

• cargo fmt --check + cargo clippy -- -D warnings pass (konclave-seal all features, orchestrator, helper-server)
• cargo test: konclave-seal, orchestrator (632), konclave-wasm (125) pass; helper-server 251 pass, 1 known timing flake (a_history_sync_and_a_funding_check_never_overlap_and_sync_once, fails on staging too)
• The wasm package rebuilt at this head equals the committed one (sha256 of all four files)
• Red tests first; a mutation round (8 of 8 killed)
• No secret, key share, seed, or passphrase in code, logs, URLs, or query strings
• Every fund-moving path keeps preview + explicit confirmation
• Reviewed: code, tester, security, plus a delta round on the fixes
• CHANGELOG: changelog.d and helper-server/
• Docs/comments in English; commits are type(scope): description
• AI disclosure: written with Claude Code, reviewed by the author, who answers for every line. Commits carry Co-Authored-By: Claude <noreply@anthropic.com>. No session link.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
konclave-demo	Ready	Preview	Nov 13, 2026 2:17pm UTC