From c8f3f6f05f22f85e2f1dd2a4cfb76c8276a15a99 Mon Sep 17 00:00:00 2001 From: Nicholas Dudfield Date: Wed, 29 Apr 2026 15:27:46 +0700 Subject: [PATCH] docs(consensus): clarify extension fallback semantics --- src/xrpld/app/consensus/ConsensusExtensionsDesign.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/xrpld/app/consensus/ConsensusExtensionsDesign.md b/src/xrpld/app/consensus/ConsensusExtensionsDesign.md index 30787a5a4..87c502fb4 100644 --- a/src/xrpld/app/consensus/ConsensusExtensionsDesign.md +++ b/src/xrpld/app/consensus/ConsensusExtensionsDesign.md @@ -18,6 +18,15 @@ succeed. Works means missed or late extension material follows that feature's deterministic fallback, such as zero entropy for RNG or normal Export retry/expiry, rather than blocking core consensus. +## Fallback Semantics + +RNG and Export use similar positive-path sidecar gates, but they do not have +the same safe fallback. RNG can safely close with deterministic zero entropy +when peers cannot establish quorum alignment on non-zero entropy in time. +Export has no equivalent dummy success value: without quorum-aligned verified +export signatures, the export must not be treated as complete and must retry or +expire under transaction rules. + ## Core Invariants 1. Core consensus remains keyed by the transaction set.