This covers a list of candidate mechanisms for deciding who writes a sovereign zone channel’s next inscription, and their pros/cons (in relation to the design tenets of Bedrock and Sovereign zones).
A final verdict is included for reference by the ‘Permissionless Channel Sequencer’ proposal. Also serves as the requested record of how the per-turn lottery path falls apart (asked 30/06/2026). Admission design itself (lock, registry, reflection) lives separately.
- Design points:
- N = 100-1000 sequencers;
- threat model led by channel spam/DoS (02/07/2026 discussion).
- Legend: = needs an experiment;
- “derived” = arithmetic produced here from cited sources.
- N = registered sequencers;
- K = positions held by one sequencer;
- f = L1 slot activation rate;
- f_ch = a channel’s target inscription rate per slot.
2. Evaluation properties
Properties a scheme is considered with:
- P1 turn determinism
- Single-winner is already guaranteed at append: parent == tip admits exactly one successor per tip, so concurrent writes race and the log never forks.
- The scheme can add to that guarantee:
- a 0-winner turn costs liveness (a pending user tx waits on an absent writer)
- a multi-winner turn is contention the tip race settles anyway, i.e. the election adds nothing binding; and every extra accepted message is follower validation work (P3).
- Under a pure rate-cap reading, empty slots are intended; the more important consideration is the liveness/ordering job.
- P2 binding at append:
- the winner predicate must be checkable with state the L1 already has with the envelope, else it does not bind against spam (W1 below).
- P3 lightweight validation, on both layers:
- L1 envelope check costs ~one Ed25519 verify (56k cycles) and must stay that order; additions to L1 validation must be comparably cheap and must not restructure it
- heavy machinery belongs only to L2!
- On L2, followers already validate every inscription’s ZoneTX content (follows the on-chain-mempool model), and that load must not expand substantially either. No zone randomness beacon exists.
- P4 known denominator:
- stake-relative predicates need an observable, summable total (W2 below)
- with a public registry the total is observable in L2 state, no L1-consensus authority required
- P5 Sybil-priced identity: entry carries a continuing cost (the platform pattern: the SDP minimum-stake lock, “makes Sybil attacks more expensive”, [1.0.0][Overview] Cryptoeconomics ).
- P6 stake-proportional write share: writes biased toward skin in the game so the garbage rate tracks the adversarial stake fraction.
Two facts to reference:
- W1, the envelope wall.
- The complete append-time check is three assertions: in-turn signer (round_robin), parent == tip, signature over the tx hash ([1.5.0] Mantle ).
- An envelope violation never enters the log; everything else (content, lottery outcomes, quotas) is invisible to L1, enters the log, and consumes storage, tip, and follower validation work before any follower can react. A selection rule binds only if expressible over the envelope’s state (key membership, slot arithmetic, tip, thresholds). The platform’s own stake-gated rate limiter agrees on locus: Proof of Quota is verified off-chain by Blend nodes, who bind because they ARE the transport; a channel’s transport is L1 inclusion, which zone-side verifiers do not control ([1.0.1] Proof of Quota ).
- W2, the denominator.
- On L1, total stake is estimated (Total Stake Inference, aliased “Lottery Difficulty”), and only because stake is private; f is fixed, TSI adjusts the estimate, never f ([1.0.2] Cryptarchia Protocol , [1.0.0] Total Stake Inference).
- TSI is sound because every observation is a proof-carrying win and block production is demand-free; it converges in 2-5 epochs (roughly two to five weeks) with ~15% underestimate at realistic delay ([1.0.0][Analysis] Total Stake Inference ).
- A channel analogue has neither soundness input: inscriptions carry no win evidence (W1), and production is demand-coupled, so observed occupancy = stake x demand x liveness. Sample rates are also starved: L1’s window holds ~13k events (~0.9% noise); a channel at f_ch = 1/30 gets ~120 events per hour-long window (~9% noise, beta = 1.0); at f_ch = 1/600, matching L1 precision needs ~90-day windows (derived).
- With locked, REGISTERED stake, the denominator is exact and free; W2 is the cost of not having a registry.
3. The catalogue
S1. Deterministic rotation over the accredited list (round-robin)
- Mechanism: round_robin() positional rotation over accredited_keys, slot-clocked, posting_timeout takeover.
- Admission variants:
- incumbent-managed list, the status quo;
- stake registry mirrored into the list, K locks = K positions, the proposal’s composition. The scheme is identical; only admission differs. EXISTS.
- Pros:
- one winner per turn (P1);
- the selection rule IS the envelope check, so it binds at append (P2);
- no election step, no randomness, no denominator (P4 free via registry under (b));
- write share proportional to stake, exact, under K positions (P6);
- cheapest possible verification; graceful liveness floor via timeout.
- Cons:
- the next writer is public and schedule-walkable: targeted DoS, bribery, lazy participation are documented costs of predictable leadership (in-house: Best-Possible-Unpredictability notes; the NomosDA deterministic-assignment grinding incident).
- rotation bounds WHO writes per window, not messages per slot (volume is priced per byte and capped per block only).
- Scope note, privacy (not a con): a known, identified sequencer set is the zone's design point; unlike Cryptarchia's anonymous consensus (paid for with PoL, TSI, Blend), channel sequencing has no privacy goal.