The V446 Upgrade

Introduction

Spec 446 makes three pieces of economic state more faithful to what actually happened on chain. Historical alpha issuance and burn counters are repaired, the conviction ownership quorum excludes alpha that cannot support a challenger, and a timelock reveal that cannot succeed becomes a visible terminal state instead of disappearing into repeated work. The release also lets subnet owners choose which epoch's consensus drives Liquid Alpha and corrects the initial-set offset used by Finney GRANDPA warp sync.

The ownership gate counts eligible alpha

Conviction-based ownership still requires a subnet to be at least one year old and selects the hotkey with the most rolled aggregate conviction. What changes is the quorum denominator. Protocol-owned and burned alpha cannot express support for a challenger, so v446 excludes both:

eligible alpha = saturating(
  SubnetAlphaOut - SubnetProtocolAlpha - AlphaBurned
)

ownership quorum = 10% × eligible alpha

If eligible alpha is zero, ownership does not transfer. Existing locks and conviction continue to count; the release does not reset them. Operators and indexers should stop deriving the threshold from SubnetAlphaOut alone. The conviction guide and subnet-convictions read expose the new accounting fields and threshold.

The upgrade migrations also repair historical SubnetAlphaOut undercounts, backfill alpha burned before the counter existed, and remove issuance, burn, and recycle offsets inherited by reused subnet slots. Every correction is scoped to the expected mainnet subnet generation; a slot whose registration block does not match is left untouched.

Liquid Alpha can use current or previous consensus

Liquid Alpha's per-bond EMA can now be driven by one of three consensus modes. The new storage value defaults to Auto:

A subnet owner can change the mode during the admin window, subject to the normal per-hyperparameter rate limit. Root can make the same change. Until a first-class transaction wrapper is added, use the raw call:

btcli call AdminUtils.sudo_set_liquid_alpha_consensus_mode \
  --args '{"netuid": 42, "mode": "Auto"}' -w my_owner_wallet

This setting only chooses the consensus source; liquid_alpha_enabled still controls whether the per-weight Liquid Alpha calculation runs at all.

Failed timelock reveals remain auditable

The chain now distinguishes a commitment still waiting for a pulse from one that can never reveal. A current or future missing pulse remains TimelockEncrypted and stays in the retry index. Corrupt ciphertext, a mismatched round, an invalid quicknet point, or an expired pulse becomes TimelockRevealFailed.

A terminal failure emits CommitmentRevealFailed once, remains in CommitmentOf for audit, and is removed from the reveal index so the hook does not retry it forever. Users cannot submit the failure variant directly. The SDK now accepts either its portable timelock envelope or the pallet-native inner ciphertext when publishing, and exposes Timelocked.encrypted for the canonical inner form. See the timelock guide for an end-to-end commitment example.

GRANDPA warp sync applies the offset once

Finney's historical GRANDPA set-ID offset is now applied only when warp sync starts from set zero. Later proof fragments use the set ID returned by the previous fragment, rather than applying the initial correction repeatedly across authority rotations. This is a node synchronization fix; it does not change runtime consensus rules or require application-level changes.

Upgrade checklist

• Upgrade nodes and metadata-generated clients to runtime spec 446.
• Recalculate conviction ownership thresholds from eligible alpha.
• Leave Liquid Alpha on Auto unless the subnet deliberately needs a fixed current- or previous-consensus policy.
• Teach commitment indexers that TimelockRevealFailed is terminal and retained for audit, while TimelockEncrypted is pending.