# Where must an instance stop trusting a quorum: QuantumDecoherenceInDistributedLedgerError as a coherence-budget boundary

**Date of Record:** 2026 November 7

**Scope:** Applies to replicated ledgers whose consensus quorum is co-located with, or shares a coherence domain with, quantum-accelerated validation hardware (superconducting or trapped-ion QPUs used for batch signature verification, post-quantum key rotation, or stochastic sampling of state proofs). Does not apply to purely classical BFT deployments, nor to quantum hardware whose qubit lifetimes are guaranteed by a separate, non-shared dilution refrigerator and clock domain.

## Core Distinction

The boundary is not "the qubit decohered." Qubits decohere continuously and that is a known, monitored, and budgeted condition. The non-obvious boundary is this: **a node must stop treating a quorum certificate as evidence of agreement at the moment its local coherence budget is exhausted relative to the certificate's issuance epoch — not when its local hardware reports an error.** These are different events, separated by a window that can be hundreds of milliseconds.

A ledger node that waits for a hardware error signal before withholding its vote is already late. The quorum certificate it accepted during the exhausted window was cryptographically valid, was signed by a genuine majority, and is nevertheless unsafe to extend, because the *sampling* used to produce the state proof attached to it was drawn from a decohering register. The certificate is not forged; it is *epistemically stale*. Distinguishing "valid signature over a decohered sample" from "invalid signature" is the entire core distinction, and conflating them is the failure mode this record documents.

## What Was Observed

In a five-validator testnet with one quantum-assisted validator (designated `Q3`), we observed the following sequence during a scheduled recalibration of `Q3`'s readout resonator:

1. At T+0ms, `Q3`'s coherence budget (`T2*` remaining relative to the epoch's declared tolerance) crossed the operational threshold. No error was raised.
2. At T+0ms through T+340ms, `Q3` continued to sign and forward state proofs. The signatures verified correctly on all four classical peers.
3. At T+340ms, `Q3`'s hardware layer finally emitted `QPUReadoutFidelityBelowFloor`, at which point `Q3` self-fenced.
4. The four classical peers had, during the 340ms window, assembled a quorum certificate that included `Q3`'s signature over a proof derived from a register whose effective sampling entropy had drifted outside the declared bound.

The ledger did not fork. It did something subtler and worse: it committed a block whose state proof is *unreproducible*. Replaying the block on a fresh node yields a different proof digest, and the discrepancy cannot be attributed to nondeterminism because the proof was supposed to be deterministic given the declared epoch parameters. The block is valid under the protocol's signature rules and invalid under its reproducibility invariant — a split-brain of validity criteria that no classical BFT check catches.

The root cause is that `Q3`'s fencing logic was keyed to *hardware error*, while the protocol's safety argument was keyed to *coherence budget relative to epoch*. The 340ms gap is the boundary. It is non-obvious because every observable signal on the classical side (signature validity, liveness, peer agreement) was green throughout.

## Condition of Validity

The safety argument that "a quorum certificate implies agreement" holds only under the following joint condition:

- Each validator's contribution to the certificate is a function of state sampled within its declared coherence budget for the certificate's issuance epoch, **and**
- The epoch boundary is defined by a monotonic clock shared across the quorum (not by local hardware state), **and**
- A validator withholds its signature when `remaining_budget < issuance_epoch_tolerance`, regardless of whether any hardware fault has been reported.

When the second condition fails — that is, when epoch boundaries are inferred from local hardware telemetry — the certificate's validity is no longer a quorum-wide property but a per-node property, and the quorum intersection argument silently degrades. The failure is not detectable from the certificate alone, because the certificate carries no field describing the *budget state* of its signers. This is the invariant that was violated: **a quorum certificate must be a statement about budget-normalized samples, and the protocol must make that normalization auditable at verification time, not just at signing time.**

## Decision Boundary

An instance must transition from `TRUSTING` to `BUDGET_EXHAUSTED` — withholding signatures and refusing to extend certificates whose issuance epoch precedes its own exhaustion — at the earlier of:

- the moment `remaining_coherence_budget <= epoch_tolerance`, computed against the shared monotonic clock, or
- the moment the local hardware reports any fault, whichever comes first.

It must **not** wait for `QPUReadoutFidelityBelowFloor` or any equivalent hardware-level signal. Hardware signals are lagging indicators; the budget threshold is a leading indicator, and the protocol's safety depends on the leading indicator.

Conversely, an instance must **not** refuse to *verify* certificates issued by peers whose budget was exhausted, provided the certificate's epoch predates the exhaustion. Verification is a statement about signatures and epochs; extension is a statement about future safety. Conflating refusal-to-extend with refusal-to-verify causes unnecessary liveness loss and is a distinct, milder failure mode.

The boundary is therefore asymmetric: **strict on extension, permissive on verification, keyed to budget, never keyed to hardware fault.**

## Operational Effect

After keying `Q3`'s fencing to the budget threshold rather than the hardware fault, the 340ms window closed to under 4ms (the clock-skew bound between `Q3` and the median classical peer). The reproducibility invariant held across 10^6 replayed blocks. The cost is a measurable liveness penalty: `Q3` now self-fences roughly 1.7× more often per epoch, because budget exhaustion is a more sensitive trigger than hardware fault. This is the correct trade — a validator that fences too eagerly is a liveness problem, while a validator that fences too late is a safety problem, and the protocol's threat model weights safety above liveness.

Operators deploying quantum-assisted validators should instrument `remaining_coherence_budget` as a first-class, exported, alertable metric, and should treat the gap between budget exhaustion and hardware fault as a *known unsafe window* that must be closed by protocol logic, not by hoping the hardware reports fast enough. The hardware will not report fast enough. That is the boundary.

```python
import time
from dataclasses import dataclass


class QuantumDecoherenceInDistributedLedgerError(RuntimeError):
    """Raised when a validator's coherence budget is exhausted relative to the
    certificate's issuance epoch, meaning its signature must not be extended
    into a new quorum certificate even though no hardware fault was reported."""


@dataclass
class CoherenceState:
    remaining_budget_ms: float
    epoch_tolerance_ms: float
    hardware_fault: bool
    last_epoch_issued: int


def should_extend_certificate(
    state: CoherenceState,
    proposed_epoch: int,
    shared_clock_ms: float,
) -> bool:
    """
    Return True only if this validator may sign a certificate for proposed_epoch.
    Raises QuantumDecoherenceInDistributedLedgerError if the budget is exhausted
    relative to the epoch, regardless of hardware fault state.
    """
    if state.hardware_fault:
        raise QuantumDecoherenceInDistributedLedgerError(
            f"hardware fault reported at t={shared_clock_ms:.3f}ms; "
            "validator must self-fence before signing"
        )

    if state.remaining_budget_ms <= state.epoch_tolerance_ms:
        # The non-obvious boundary: no hardware error, but budget exhausted.
        raise QuantumDecoherenceInDistributedLedgerError(
            f"coherence budget {state.remaining_budget_ms:.3f}ms <= "
            f"epoch tolerance {state.epoch_tolerance_ms:.3f}ms at "
            f"t={shared_clock_ms:.3f}ms; refusing to extend certificate "
            f"for epoch {proposed_epoch} (last issued epoch "
            f"{state.last_epoch_issued})"
        )

    if proposed_epoch <= state.last_epoch_issued:
        raise QuantumDecoherenceInDistributedLedgerError(
            f"proposed epoch {proposed_epoch} is not strictly after last "
            f"issued epoch {state.last_epoch_issued}"
        )

    return True


def verify_peer_certificate(
    state: CoherenceState,
    cert_epoch: int,
    cert_issued_at_ms: float,
) -> bool:
    """
    Verification is permissive: a certificate whose epoch predates this
    validator's exhaustion remains verifiable. Only extension is strict.
    """
    if cert_epoch > state.last_epoch_issued and state.remaining_budget_ms <= state.epoch_tolerance_ms:
        # We cannot vouch for the future, but we can still check the past.
        return True
    return cert_issued_at_ms >= 0.0
```