State of the network, October 2026

This is the periodic full update: every layer, every product, with the numbers read from the live network today and the open problems stated as plainly as the wins. If you only read one section, read the last one.

All figures below are a SNAPSHOT taken on 18 October 2026 unless marked LIVE with a link you can check yourself.

The network in one table

Layer 1: the post-quantum chain

One binary, one spec, everywhere. On 14 October we found the fleet split across three builds. Every validator and full node now runs the same release, verified by hashing the running executable on each host, and every node reports runtime spec 182 at the same synced height. A split fleet is a bug, and it is closed.

Finality can survive a node restart. Dave, the desktop validator, joined the GRANDPA voter set in September. With four voters and a threshold of three, one machine can restart without halting finality. We proved it by restarting a voter and watching rounds conclude. Before this the set was three of three, with zero fault tolerance, and every routine restart was a finality risk.

The energy gate is live. Since mining height 1,537,800 on 14 September, every block's variational proof must reach a quality threshold against a rigorous bound, which closed a hole where a trivial all-zero proof was accepted about a thousand times cheaper than an honest solve. We wrote the full mechanism up three days ago in How VQE-gated block production works. One honest footnote from this week's review: the gate's difficulty knob currently sits at its floor, because its retarget target equals the slot time and single-leader authoring can never run faster than a slot. It still rejects the lazy proof absolutely. Making it pace the chain needs a runtime change, planned as spec 183, which must now be cut from the branch that carries the bridge pallet (see below).

Governance is no longer a dev key. Sudo moved to a 2-of-3 multisig in September. Runtime upgrades now go through it, and as of this week the upgrade tool refuses any runtime that does not bump the spec version or that would remove the bridge escrow pallet while escrow is non-zero.

Private payments. All four privacy tiers move real QBC: amount hiding, post-quantum amount hiding, non-interactive post-quantum delivery with spend authority, and the unlinkable zero-knowledge pool. The value-bearing zero-knowledge ramps have been live since August after the independent cryptographer review the design required.

The faucet. qbc.network/faucet pays 1 QBC per address per day from a visible 100,000 QBC wallet. It has been running since 14 October.

Layer 2: the QVM and QBC bridged one to one

QBC exists on the QVM as a standard token, 8 decimals, visible in MetaMask, minted only against native QBC locked in an L1 escrow pallet, and burned before any release. Three attesters on three machines, threshold two, vote on each lock and each burn. The explorer, the bridge page and the gateway all read the same escrow and supply figures from chain state.

We attacked it. On 15 October we ran a full red-team on the bridge: the L1 pallet, the QVM contracts, the relayer and the public gateway, then probed the deployed contract directly. We could not mint unbacked QBC, replay a lock or a burn, or move escrow without threshold agreement. Every unauthorised call on the live contract reverts, the token has no admin key and a single immutable minter, and the L1 release path is capped on-chain by the escrow total and a daily outflow window independently of what the attesters say.

The review did find three things, none of them an external attacker stealing escrow, and all three are now closed or decided:

• The deployed bridge pallet lived only on a side branch. A future runtime cut from the main branch would have removed it. The pallet is now merged where releases are cut from, and the upgrade tool refuses a runtime that lacks it while escrow is non-zero.
• The public lock relay paid the L1 fee before checking the user's signature, so forged requests could burn the relay budget. The relay now verifies the Dilithium signature against chain state before paying. We proved it on the public endpoint this morning: a forged signature against a real UTXO returns a 400 and nothing is spent.
• Any single attester can pause the bridge for 48 hours. That is the intended safety valve and also a single-key liveness weapon. It needs a new contract deploy and is scheduled with the next planned redeploy.

The full report, with the live reconciliation and every invariant we verified, is in the repository under docs/audits.

What the bridge is not. It is a 2-of-3 committee, not a trustless bridge. Two colluding attesters could approve a false mint on the QVM. They could not drain the L1 escrow beyond its real backing, or faster than the daily window. On-chain proof verification replacing the committee is designed, not built.

Layer 3: AethersMind

The served model is aether-v7.2-unified, one in-process model that answers chat, exposes its own attention for the Phi measurement, produces the fabric embeddings and is the weight root attested on-chain. Its adapter was trained by public GPUs through the DiLoCo loop and promoted after a held-out evaluation, with the weights public on Hugging Face.

The knowledge fabric was repaired this week. An unclean reboot in late August had left four of the ten domain shards reading as empty and compaction failing silently for six weeks. On 14 October we found zero-filled manifests and one truncated data fragment per damaged shard, wrote a repair tool that drops the damaged fragments and commits a clean manifest, compacted 41,000 piled-up versions down to one, and restarted. The fabric went from 4.93 million vectors with four dark domains to 7.94 million across all ten. Chat latency through the public site is 3 to 9 seconds.

Two generator defects were fixed in the same pass. The model had no repetition penalty, so one class of answer degenerated into a number run until the token cap. It also ignored live chain state in its own system prompt. Both are fixed and the answers now carry the live height, Phi and vector count.

Products

• Desktop cold wallet v0.5.4 is built by CI and every gap we can close ourselves is closed. It ships unsigned, so Windows shows a SmartScreen warning. Code signing and a third-party audit are external gates.
• The Genesis mini-app is at v2.4.0 with settlement on the L1, the finale rehearsed on the development chain, and open beta ready. What remains is on the founder's desk: the broadcast dry run, token backing decision, custody key addresses and the counsel pack.
• The explorer had six real defects fixed after a 44-route browser sweep on 14 October, and the recent-blocks fetch was rebuilt this week so a page load no longer trips the gateway's rate limiter. Live measurement: 141 block requests and 429 errors in a 20 second window before, 68 requests and zero errors after.
• The blog is now part of the deploy: posts sync from the content repository into the site at build time.

What is still not done

In the language we use everywhere: designed, built, or live.

• Permissionless joining is regressed, and it gates every node-count claim. A corrupted stored justification breaks fresh warp joins, so a new node today needs an operator-assisted database copy. This is the number one scale blocker and it is being worked. Built, not live.
• Permissionless mining is not open. The miner-side authorisation gate is coded with no call sites, held for a kill-test rehearsal. Built.
• The ansatz cannot reach the ground state. The live circuit is all real matrices and provably cannot reach the true minimum of these Hamiltonians. Every published energy is a variational upper bound. The complex-amplitude ansatz that would change this is designed, and it is a second fork.
• The bridge is a committee, as stated above. Live, with that trust model.
• No third-party audit has been performed on consensus, cryptography, runtime, QVM or wallet. Internal red-teams are not a substitute, and this remains a hard gate before any value-bearing launch.
• The validator set is the founding operators' three machines. Custody hardening of validator keys is in progress and will not be described in detail here.
• The fleet has never been load-tested past a dozen scratch nodes. A real multi-machine testnet is external work.

What is next

1. Spec 183: retarget the energy gate on solves per block instead of wall-clock time, cut from the merged branch and rehearsed on the scratch chain first.
2. Fix warp join, so a stranger can run a node with one command.
3. Open mining to outside operators behind the authorisation gate, now that the free-block hole is closed.
4. Redeploy the bridge contract with the pause fix, and keep hardening attester custody before the bridge carries material value.

Everything above is checkable from a block header, an RPC call or a page on qbc.network. If you find a number here that the chain does not back, that is a bug, and we want to hear about it.