Version history

Three audit adjectives removed. Nothing that was measured changed; three things we could not cite stopped being asserted.

• The wrapped library. The post-quantum precompile chapter used to attach the adjective audited to the native library the precompiles wrap. That library is Bouncy Castle. Aere ships bcprov-jdk18on, which is not a FIPS validated cryptographic module and for which no published third-party review is known to us. It now reads a maintained native library. The evidence in the rest of that sentence is untouched: bit-for-bit agreement with the same NIST KAT and ACVP vectors the on-chain Solidity verifiers pass, 41 of 41 accept and reject cases.
• AereDelegate7702V2. The same adjective was attached to this contract, called the audited replacement for the earlier V1. That is our own contract, and this project has had no third-party security audit; the sentence now reads the corrected replacement, which is what the paragraph above it already said in full.
• webauthn-sol. The port we build on was described with the same adjective, this time about someone else's work. An audit of someone else's library is still a claim, and we carry no link to it, so the adjective is gone. What the port does is stated as before.
• Why it took this long. The check that has guarded this wording since July looked for the two words side by side. All three sentences put something in between, so it passed them for weeks. The check now reads the whole sentence, in both orders, and covers the production sources as well as the published copies.

The validator set grew from nine to ten, and the tenth validator runs a different client; the document now says so in every place that counted validators.

• Ten validators, f=3, quorum 7 of 10, since 2026-09-11. The tenth validator was admitted by the usual header vote (six of nine) and produces blocks in the normal rotation. It runs Nethermind, so mainnet blocks are now produced by two independent clients (nine Besu validators, one Nethermind validator); until this date the second client only validated and followed. All ten keys remain operated by the Foundation, so the honest counterweight about a single operator is unchanged.
• What the anchor certificate now is. Its enforced minimum stays six seals. At nine validators that was a full 2f+1 quorum; at ten it is above f+1 but below the new quorum of seven, and the document says so instead of keeping the old sentence. Raising the minimum is a separate, coordinated change and is not claimed here.
• Dated history kept. Sentences about earlier heights and dates keep their numbers and gain "of that time"; sentences about the present were changed to ten.

The anchor interval changed on chain, and the document now says so wherever it described the anchor.

• Every 128th block, from block 17,225,968 (2026-09-05). Until that height the post-quantum anchor certificate was carried by every 32nd block; from it, by every 128th. The certificate itself is unchanged: Falcon-512 and SLH-DSA-SHA2-128s seals of at least six of the nine validators, bound under the block hash. The ten places that said "every 32nd block" now say "every 128th block (every 32nd block until block 17,225,968, on 2026-09-05)"; sentences dated to earlier events keep their dates.
• Why. Each hybrid certificate adds about 53 KB to its header (six SLH-DSA-SHA2-128s seals of 7,856 bytes each). Quartering the frequency divides that cost by four without touching the rule, the threshold or the schemes. The change was rehearsed on the public testnet first and is measured on mainnet by a published gate before this text was allowed to change.

Five places still said that consensus signatures are classical. They stopped being true in stages, and the document now says which stage is which.

• Consensus signatures: classical per block, post-quantum by layers. Per-block finality still rests on classical secp256k1 QBFT signatures. Since block 13,014,000 every anchor block also carries a post-quantum certificate of validator seals under its block hash (hybrid Falcon-512 and SLH-DSA-SHA2-128s since 2026-09-04). Since 2026-09-01 every QBFT message also carries a post-quantum seal of its author, and from blocks 17,250,000, 17,400,000, 17,550,000 and 17,700,000 (commit, proposal, round change, prepare; armed on all nine validators on 2026-09-05) a message without a valid seal is refused. The callout that said "Consensus signatures are classical", the figure caption, the diagram label and two sentences in the MEV chapter were rewritten to say this with dates.
• What did not change. The application-layer post-quantum verifiers, the anchor certificate and the whitepaper's other measurements; the correction of 2026-09-04 ("Consensus is classical" in the live note) had missed these five places, found by reading the published page for the word "classical".

Two statements the document still made had stopped being true, and both were found by reading the published page as an outsider would.

• Consensus is no longer described as classical. Since block 14,961,456 (2026-08-21) every 32nd block requires a certificate of at least six of the nine validators' Falcon-512 seals under the block hash, and since 2026-09-04 that certificate is hybrid: Falcon-512 and SLH-DSA-SHA2-128s seals, two independent mathematics in one certificate. The live note, the structured-data description and the audit list now say so; every block in between is still sealed with secp256k1 ECDSA under QBFT, and the document says that too.
• The 273,000 TPS figure is withdrawn everywhere it appeared, not merely labelled a ceiling. The site's about page had withdrawn it on 2026-08-19 because its stated derivation does not reach that number; the document kept calling it a design ceiling in five places. It is now withdrawn in all five, kept only where the block-space arithmetic can be checked.

Chapter 9 gained a section. The roadmap already said what runs and what is gated; the new section says in what order the remaining engineering work is taken, and why that order is what it is.

• Added Section 9.3, "Engineering direction: distinct before fast". It publishes the single criterion that orders the engineering programme: work that makes AERE distinct outranks work that makes AERE faster, because the second kind can be built by anyone with money and engineers and the first kind cannot. The reasoning is written out rather than asserted, so a reader can argue with it and can check later whether it was followed.
• Named the three pieces of work ordered first. Binding the post-quantum seal quorum into the block header commitment, the move from an L1 EVM to an L1 execution kernel with consensus and the state model declared immovable in advance, and a cryptographic abstraction layer that puts an interface between the protocol and any single algorithm.
• Published the rest of the queue in the same two piles, with no dates. An ordering is not a schedule, and the section says so in its own text. Nothing in it is presented as shipped; Section 9.2 remains the account of what exists.
• Restated the scope line rather than softening it. AERE mainnet consensus signs classical secp256k1 ECDSA. Post-quantum verification is available as on-chain precompiles and application-layer verifiers, not as the consensus mechanism. The new section repeats that in the one place where a reader might otherwise infer the opposite.
• Renumbered "Risks and limitations" from 9.3 to 9.4 and updated the single cross-reference in Chapter 3 that pointed at it, so no reference in the document points at a section number that no longer means what it did.
• Fixed which entry the auto-filled hash row decorates. The three cells that fetch the current published hashes were attached to the 2.1.1 entry, so a historical entry displayed today's values. They now sit on the current entry, and 2.1.1 states plainly that its own hashes are not recorded on this page rather than borrowing someone else's.

A sweep of factual corrections after a measured audit of the document against the live chain. Every item below was re-read from a public node before it was written, and the corrections run in both directions.

• Corrected both hard-fork activation heights. The document gave Pectra at block 2,075,363 and Fusaka at 2,106,606. Both forks are gated by timestamp, so the height must be read off the chain, and both published figures were too high, by 22 and 9 blocks. The measured heights are 2,075,341 and 2,106,597, re-derived twice over: 2,075,341 is the first block carrying a requestsHash header field and also the first whose timestamp reaches pragueTime, and 2,106,597 is the first whose timestamp reaches osakaTime.
• Withdrew "every Ownable contract is Foundation-owned". Of the 191 addresses in the canonical registry, 71 answer owner(); 57 return the Foundation account and 14 return an operational deployment account awaiting transfer. The word "every" was false and the count is now published in its place.
• Withdrew "the route owner cannot forge a verification". Each concrete verifier is immutable, but the route owner chooses which contract a selector resolves to, and the routes in use are not frozen, so the guarantee holds against the verifier a route already points at rather than against the owner of the route.
• Corrections that run in our favour, stated as plainly as the ones that do not. The canonical RISC Zero route is live rather than awaiting a signature; the over-18 program is registered on chain with a non-zero authorized root rather than pending; the Governor and Timelock are deployed, with the 48-hour minimum delay reading back from the chain, so what is missing is the ownership transfer and not the code.
• Deprecated addresses now travel with their replacements. The passkey factory, the intent pair, the storage-proof verifier, the aggregator and the Ethereum light client were each cited as current while our own registry marks them superseded. Each now carries what is wrong with it and the live replacement.
• Published the supply position instead of only the allocation. The six genesis wallets hold 2,239,999,990.70 AERE against the 2,800,000,000 cap, and the difference is accounted for rather than left as a gap a reader discovers by adding up the table.
• The same re-stamp failure as last time, caught and closed again. The corrections of 2026-08-01 were applied to the page without re-running the version block, so for a period the published verification command again did not reproduce the published hash. It has been re-stamped and both reader commands were replayed against the exact bytes on disk before this entry was written.

A factual correction, and a repair to the verification scheme itself, recorded together with the failure that prompted it.

• Corrected the sub-second transition height. The document said the transition to sub-second blocks activated at block 2,138,451. The measured height is 2,137,652: the mean block interval over the 200 blocks before it is 1.100 s and over the 200 blocks after it is 0.575 s, which anyone can recompute from public block bodies. All five occurrences were corrected.
• The failure, stated plainly. That correction was applied to the page on 2026-07-20 after the version block had been generated, and the re-stamp was missed. From then until this version was published, the published verification command did not reproduce the published hash, so a reader who followed our own instructions was in effect told the page had been tampered with. It had not been; it had been corrected without being re-stamped. The distinction matters and the process now enforces it.
• Added the content hash as the primary verification: it covers a delimited region holding the measured figures, the table of contents and the nine chapters, so an edit to the surrounding page cannot invalidate it, while any edit to the claims still does. The exact-bytes document hash remains published alongside it.
• Publishing now refuses a mismatched hash. The publish pipeline replays both reader commands over the exact bytes about to be shipped and refuses to publish unless each reproduces, so this class of failure can no longer reach the site.
• Rewrote the block-interval note so it stays true in degraded periods: the measured mean is published against the 500 ms target even when an outage pushes it well above the target, and the note now says exactly that instead of assuming the gap is small.

First version published under provable versioning. The document gained machinery rather than argument: its chain-derived figures stopped being typed by hand and started being generated.

• Added a version block carrying the semantic version, the date content last changed, both hashes, and the block height the measured figures were read at.
• Added a Measured on chain panel whose values are generated from a read-only RPC at a single pinned block height, so the figure set is internally consistent rather than assembled from readings taken minutes apart.
• Precompile liveness is now proved by measurement instead of asserted. Presence is established by gas differential against a control address holding no code. This proves the five mainnet precompiles are live and independently proves 0x0AE6 and 0x0AE7 are not on mainnet, matching their testnet-only status.
• Burn rate and burn cap are now read from the live splitter contract rather than quoted from a design document, and are cross-checked against the burn vault balance.
• Stated plainly, from measurement, that AERE is not deflationary today: lifetime burn is a rounding error against the 2.8 billion supply because validator coinbase revenue is effectively zero.
• Corrected the stated scale of the burn. While building the generator, the share of supply burned was computed in parts per billion and labelled as a percentage, which overstated it by a factor of ten million. The correct figures are published: 0.049 parts per billion of supply, which is 0.0000000049 percent. The error was caught before publication and is recorded here rather than quietly fixed, because a correction nobody can see is not a correction.
• Published the measured block interval next to the configured 500 ms target rather than in place of it. The long-run measured mean runs a few percent above the target, and the document now says so instead of quoting the target as though it were an observation.
• Labelled the 273,000 TPS figure as an architectural ceiling wherever it is generated, never as a measured rate.
• Restated that consensus is classical secp256k1 ECDSA QBFT, and that post-quantum cryptography on this chain is at the account and application layer.

The version 2 whitepaper. Date and version taken from the status line the document carried in its own cover metadata, which is self-reported and was not independently recorded at the time.

• What specifically changed between version 1 and version 2 is unknown. No changelog was kept and the file was not under version control, so any list here would be reconstruction presented as record.
• An archived copy of the version 1 document is retained at whitepaper-v1-archive.html.
• No hash is published for this entry. None was recorded at the time, and the file has been edited since.

An earlier revision, retained at whitepaper-v1-archive.html.

• Publication date unknown. The archived file's modification timestamp records when it was last touched on disk, not when it was published, so it is not quoted here as a publication date.
• Revision history within version 1 is unknown.