The core node maintains connectivity and monitors the state of its connections with neighbors. Attributable excess traffic or malformed transport messages may cause disconnection and blacklisting. Low traffic affects connection health and replenishment, but does not by itself cause a ban.

Two principles apply throughout this document:

• Bans require attribution. A neighbor is added to the blacklist only for misbehavior attributable to its authenticated identity over a TLS connection. Silence, underperformance, Blend decapsulation failures, and traffic that cannot be bound to an authenticated sender never cause a ban.
• The number of open connections is hard-bounded by $\Phi_{CC}^{Max}$ at all times. The node never grows the connection set beyond this bound in response to an attack, which limits the worst-case bandwidth an adversary can induce.

Definitions and notation

• round — the base time unit (see Blend Protocol).
• epoch — the protocol time scope for participation, quotas, nullifiers, and maintenance. Sessions are not used, as specified in ‣.
• $W$ — the connection-specific moving observation-window length, in rounds; $W = 30$.
• $\mu$ — the Blend Protocol upper bound on messages released during one release round. It is a release-rate parameter, not a Proof-of-Quota value, and is used only to motivate expected traffic scale.
• $\lambda$ — the expected number of successfully TLS-processed messages received on one healthy core-to-core connection per round under nominal operation. Unless a more precise fan-out derivation is supplied by the Blend release schedule, take $\lambda = \mu$.
• $F_1^W(c,t)$ — the number of messages received over connection $c$ that successfully pass TLS processing and signature validation during the trailing $W$ rounds ending at time $t$. It is a count, not a rate. Invalid-signature messages and TLS failures do not increment $F_1^W$.
• $\lceil F_1 \rceil^W = W \cdot \lambda = 30 \cdot \lambda$ — the maximum message count for a connection over the moving window.
• $\lfloor F_1 \rfloor^W = 3 \cdot \lambda$ — the minimum healthy message count for a connection over the moving window.
• $\Phi_{CC}$ — the number of open core-to-core connections, including connections whose handshakes have reserved a slot.
• $\Phi_{CC}^{Min}$, $\Phi_{CC}^{Target}$, $\Phi_{CC}^{Max}$ — the minimum, target, and maximum numbers of core-to-core connections, where $\Phi_{CC}^{Min} < \Phi_{CC}^{Target} < \Phi_{CC}^{Max}$.
• $h(\Phi_{CC})$ — the number of healthy core-to-core connections.
• $R$ — the number of reserved but not yet established core-to-core handshake slots.
• $P$ — the number of pending established core-to-core connections (fewer than $W$ rounds since establishment).
• $\Phi_{CE}^{Max}$ — the independently enforced maximum number of open edge-to-core connections.
• $S$ — the current epoch's map from message identifiers (Proof-of-Quota nullifiers) to the set of authenticated sender identities from which each identifier has been received after signature validation.