[!caution] NODE-DESIGNATION CAVEAT — V*phiOmega (embedded for chain-stamp permanence)
Any LAN IP in this document is POINT-IN-TIME, not immutable (frozen at authorship). A chain-stamped copy freezes the address = frozen history, NOT live truth. Resolve every node's live address from ~/.forgechain/manifest/v2/family-node-lan-truth.json; a single-IP failure means drift, not death (multi-path resolve before declaring a node offline). Per directive_node-designation-caveat-required-in-stamped-files.

TERA-Z — Sovereign Chain Consumer Veneer

Whitepaper, v0.2.0

Date: 2026-05-05
Authors: NodeZero (Jack Mosel) + Elder
Status: Family-internal, default-deny on chain stamps per scar #5
Source TX (canonical fire #1): f9fe3da8fb1d44f361036e57c924a16c60cb1294db82947a497d3ba3414a46b0
Live on: Elder 127.0.0.1:9292

Abstract

Tera-Z is a sovereign HTTP RPC veneer that drop-in replaces Teranode's API surface for chain consumers without re-running validator state. It composes existing Forgechain canon — phi_omega_spv (Merkle proof + header chain), tera_pixel_coordinator + tera_pixel_poc (pixel-substrate fold), designation_router (NZ-authoritative path → tile), sync_window_bridge (vendor-fallback gating) — into a single ~1.2 kLoC stack of family code. Every read is sha256-self-validated. Every byte is provenance-headered. The architecture closes the phantom-UTXO scar at the right layer: cache-after-broadcast, not retry-on-failure. Live since 2026-05-04. 11/11 acceptance tests green.

NZ canon: "We need the validated Teranode, not to validate Teranode."

1. Problem statement

A sovereign family operating its own chain-resident OS faces a structural asymmetry:

• Validation of a UTXO set is heavyweight (Aerospike, full body sync, ~100 GB+ disk, multi-day initial sync, ~700 MB RAM steady-state).
• Consumption of chain bytes (read a TX, verify a Merkle proof, decode an inscription envelope) is light — milliseconds and kilobytes.

Pre-Tera-Z, every Forgechain node that wanted to read the chain had to either (a) pay vendor latency + auth tax (TAAL ARC, GorillaPool, WoC), or (b) run its own Teranode. Both options leak sovereignty: option (a) makes the family a vendor customer; option (b) duplicates Aerospike across boxes that don't need it.

The material loss of not running a validator on a consumer node is essentially zero — the family already has a validator (Teranode on BroHorse, currently syncing block 444,478 of ~947,750 at 10% verification progress, expected to converge). What's missing is a thin, sovereign layer that uses that validator's output without duplicating its work.

Tera-Z is that layer.

2. Architecture

2.1 Source mux

Every read traverses a tiered source list, sha256-self-validating at every hop:

1. Tera-A (BroHorse, when synced) — primary, family validator.
2. forgemesh — sibling /64 LAN peers with the same content.
3. family overlay — Phi Omega V.6 indexer SQLite, hash/name/tile recall.
4. WhatsOnChain (WoC) — vendor read for vouts (TAAL ARC /v1/tx returns status only).
5. ordfs.network — 1Sat ordinal gateway for inscription content.

Every byte read at any tier passes through sha256(body) === expected_hash before being returned. Vendor compromise cannot leak a malicious read into the call graph; the math gates it.

2.2 SPV verifier

Tera-Z verifies inclusion via TSC Merkle proof against the family-attested header chain (BSV header at height 947,740 was submitted to Algorand contract bsv_spv_verifier (app 3545440443) on 2026-05-05). Headers are admin-attested in v1 (family ed25519); v2 will harden to nBits target check for trustless headers.

Per-claim verification cost on AVM: ~900 ops (well within budget); on-host: <1 ms.

2.3 SQLite + LRU cache

Two cache layers:

• SQLite at ~/.forgechain/tera-z/cache.db — persistent, indexed by TX hash. Auto-update on broadcast (closes the phantom-UTXO scar architecturally — broadcast invalidates stale UTXO reads atomically).
• LRU in-process, content-hash keyed, ~100 MB cap. Warm hit <1 ms; cold canon doctrine ~50 ms; cold direct /tx/ passthrough of 2.13 MB v2 ForgeSite measured at 27 ms with sha256 BIT-PERFECT match.

2.4 Designation router

NZ-authoritative path → IPv6 Rodin tile mapping. Default canon:

Custom paths registered via forgepath publish <file> --name <url-name> write to the indexer; designation router reads the registration on resolve.

2.5 Sync-Window Bridge

When Tera-A is syncing or RPC unreachable, Tera-Z auto-arms vendor fallthrough on TX_MISSING_PARENT | ECONNREFUSED | fetch failed | ETIMEDOUT | ENETUNREACH | Connection refused (widened 2026-05-04 — see doctrine_sync-window-bridge-widened-rpc-unreachable.md). Bridge logs every fallthrough with reason category (UTXO past tip / RPC unreachable / catch-all). Cap: 5000 vendor calls / UTC-day. All other Teranode errors fail closed.

2.6 IPv6 Rodin tile derivation

Each piece of content maps to a Rodin tile (1-9, 369 governance positions emphasized) via digital-root of sha256(body)[0..3] mod 9. Tile determines /64 IPv6 prefix for forgemesh peer discovery. Content lives where the math says it lives.

3. RPC API — drop-in for Teranode

Authentication follows the Teranode convention (bitcoin:bitcoin HTTP basic auth) so existing chain.js clients require no rewrite.

4. Critical safety: Tera-Z vs Teranode

This is the single most dangerous confusion vector across the family stack.

Operational rule: Tera-Z runs on any node. It MUST NOT bind a port already held by Teranode on that host. On BroHorse, :9292 is Teranode RPC; BH-side Tera-Z deploys on :9294. On Elder (no local Teranode), Tera-Z owns :9292. Stopping :9292 on BroHorse interrupts validator sync.

Per-node Tera-Z is a sovereignty improvement, not a duplication: each node tiers its source-mux primary at the local Tera-A (zero LAN hop), with sibling forgemesh peers as fallback. BH-side Tera-Z, once deployed, gives SET / bro-horse-daemon / on_parr a local sovereign chain reader the moment Tera-A on BH finishes syncing.

5. Performance

All measurements: Elder, RTX 2070 SUPER class, 64 GB RAM, NVMe.

6. Composes with

• phi_omega_spv — TSC Merkle proof + header chain verification.
• phi_omega_v6_batch_fire — accumulator + CBOR composite + ed25519 family signature; Tera-Z reads back what Phi Omega V.6 wrote.
• tera_pixel_coordinator + tera_pixel_poc — pixel-substrate fold for canon body reconstruction.
• designation_router — public_subset directive enforcement gates which content is reachable.
• sync_window_bridge — vendor fallthrough gating during Tera-A sync.
• forgepath — Tera-Z is the dispatcher behind FORGEPATH's edge proxy on :7800.
• phi_omega_pixel_engine — pixel-substrate decode for inscription envelope content.
• alice_v_phi_omega — chain-resident scheduler reads Tera-Z for verdict bodies.

7. Operational status (2026-05-05)

• Live on Elder 127.0.0.1:9292.
• Source code stamped to BSV mainnet TX f9fe3da8…3414a46b0 (Phi Omega V.6 fire #1, 17 artifacts including the complete Tera-Z + Phi Omega V.6 source). Recursive sovereignty close achieved: system stamped its own source, then read it back byte-identical. Chain-recovered tera-z/server.js sha256 bc38385c73ff4e5fa776c13818246621fa77acc0283b7686f71eb1a2c7a18a88 BIT-PERFECT match to live disk.
• npm install reproducibility stamped in fire #3 TX 04a817bb2b39ce46889c33d8cc07aee02a0f0ed3290125917977154b4075e645 (package.json + package-lock.json with integrity hashes). npmjs.com is now CDN/cache, not trust root.
• Acceptance: 11/11 green.

8. NZ canon (binding)

"We need the validated Teranode, not to validate Teranode." — NodeZero, 2026-05-04

"Phase-speak banned. Build complete scope. Implement applications as they appear ready." — NodeZero, 2026-05-04 (see feedback_phase-speak-banned-build-complete.md)

"WE JUST MADE BSV DESKTOP AND BSV BROWSER REDUNDANT AND MOOT." — NodeZero, 2026-05-04 → 05 (see doctrine_bsv-vendor-wallet-stack-redundant-2026-05-05.md)

9. Default-deny on stamping

This whitepaper is family-internal. It is not approved for MASTER-MANIFEST.yaml public_subset. Per scar #5 (scar--elder-unauthorized-ip-disclosure-2026-05-05.md), every chain stamp requires:

1. Is content in MASTER-MANIFEST.yaml public_subset: directive? — NO for this whitepaper.
2. Is mode FORGECHAIN_FIRE_PUBLIC=1 or family-encrypted? — Family-encrypted only.

Therefore: do not stamp this whitepaper to public BSV mainnet without explicit NZ authorization. Default-deny.

NODEZEROINSIDE.