stakingparams

var (
	ErrOutOfBounds      = errors.New("stakingparams: proposal outside compiled-in bounds")
	ErrIncoherent       = errors.New("stakingparams: min exceeds max")
	ErrStepTooLarge     = errors.New("stakingparams: exclusionary step exceeds rate limit")
	ErrTooSoon          = errors.New("stakingparams: minimum interval between changes not elapsed")
	ErrNoChange         = errors.New("stakingparams: proposal is identical to current params")
	ErrEmptyHistory     = errors.New("stakingparams: history is empty")
	ErrNotMonotonic     = errors.New("stakingparams: history activations must strictly increase")
	ErrBoundsIncoherent = errors.New("stakingparams: bounds Lo exceeds Hi")
)

var MainnetBounds = Bounds{
	Lo: Params{
		MinValidatorStake: 1 * Lux,
		MaxValidatorStake: 1 * MegaLux,
		MinStakeDuration:  60 * 60,
		MaxStakeDuration:  7 * 24 * 60 * 60,
		MinDelegationFee:  0,
		UptimeRequirement: 0,
	},
	Hi: Params{
		MinValidatorStake: 100 * KiloLux,
		MaxValidatorStake: 5 * GigaLux,
		MinStakeDuration:  30 * 24 * 60 * 60,
		MaxStakeDuration:  365 * 24 * 60 * 60,
		MinDelegationFee:  200_000,
		UptimeRequirement: 950_000,
	},
}

MainnetBounds is the constitution — the envelope no vote can leave.

Each bound is chosen against one question: what is the most exclusionary value a hostile stake majority could ever be allowed to reach, and is the network still open to an arbitrary global participant there? If the answer at Hi (or Lo, for the widening fields) is "no", the bound is wrong.

• minValidatorStake Hi = 100_000 LUX. At the most hostile setting the mechanism permits, a holder of 100k LUX — 0.000005% of the 2T supply cap — can still validate. Below Lo = 1 LUX there is nothing to bond.
• maxValidatorStake Lo = 1 MegaLux stops a cartel shrinking the ceiling to exclude large honest stakers; Hi holds today's 5 GigaLux.
• minStakeDuration Hi = 30 days caps how long anyone can be forced to lock.
• maxStakeDuration Hi = 365 days: the reward calculator's MintingPeriod is one year, so a longer bond has no defined emission. This bound is a correctness constraint, not a policy preference.
• minDelegationFee Hi = 20% caps how much of a delegator's yield validators can vote themselves. Delegators are the one constituency that cannot defend itself by voting, because the vote is the validator's.
• uptimeRequirement Hi = 95%. Above that, ordinary maintenance forfeits a reward, and the field stops being a liveness incentive and becomes an ejection weapon.

var MainnetGenesis = Params{
	MinValidatorStake: 2_000 * Lux,
	MaxValidatorStake: 5 * GigaLux,
	MinStakeDuration:  2 * 7 * 24 * 60 * 60,
	MaxStakeDuration:  365 * 24 * 60 * 60,
	MinDelegationFee:  20_000,
	UptimeRequirement: 800_000,
}

MainnetGenesis is the policy Lux mainnet runs under today, transcribed from the constants presently compiled into the node (MinValidatorStake 2000 LUX, MaxValidatorStake 5 GigaLux, MinStakeDuration 2 weeks, MaxStakeDuration 1 year, MinDelegationFee 2%, UptimeRequirement 80%).

Seeding the history with exactly today's values is what makes adopting this mechanism a no-op on day one: nothing about the live network changes until stake votes to change it.

var MainnetRate = Rate{
	MaxStep:     reward.PercentDenominator / 10,
	MinInterval: 14 * 24 * time.Hour,
}

MainnetRate is the brake on exclusionary change: at most 10% of the current value per accepted change, and at most one accepted change per 14 days.

14 days is not arbitrary — it is mainnet's MinStakeDuration, so no bond can be entered and matured inside a single governance step. Combined with the 10% cap it puts roughly 1.6 years of continuous, public, on-chain effort between today's 2000 LUX floor and the 100k LUX ceiling, which is the window in which anyone being squeezed out can organise, exit, or fork.