# Node operations

What a running node is responsible for: bounded execution, local verification, reorg safety, peering, private endpoints and monitoring.

> Part of the SQRL documentation, section "Protocol".
> Rendered page: https://docs.sqrl.tech/protocol/nodes/operations

## Core responsibilities

Your node:

* Executes contracts deterministically in the VM.
* Pulls context from Bitcoin (commitments, anchor transactions, block height).
* Stores and serves contract history, state, and events.
* Rejects invalid or divergent payloads.
* Publishes a state root at every Bitcoin block.

## Bounded execution

The VM enforces limits by default to keep verification safe:

* 100k instructions per call: one budget shared across nested cross-contract calls
* 1024 stack depth
* 64 call depth
* 64 KB persistent storage per contract
* 64 KB max payload size, enforced identically at REST intake and gRPC

  These caps stop denial-of-service attempts and keep cost predictable. A call chain can't escape them by nesting; every frame inherits the same ceilings.

## Verification model

Verification is local. You don't trust peers for results. You replay payloads against Bitcoin commitments. If the outcome doesn't match, you reject.

This design removes consensus entirely:

* No Proof-of-Work.
* No leader election.
* No need for network-wide votes.

Invalid payloads just fail replay everywhere. Anchor binding is checked twice: once at intake, and again at confirmation where it's consensus-critical: a mismatched envelope is deterministically invalid on every honest node, with no execution.

## Reorg safety

Settlement follows Bitcoin, including its reorganizations. Your node keeps undo logs and a block journal covering the last 144 blocks (about one day):

* **Shallow reorg:** state rolls back automatically via undo logs, then the new branch replays.
* **Deep divergence:** the node re-derives state from the confirmed-call log.

No operator action is required in either case.

## Sync and peering

Nodes exchange histories and payloads to stay in sync: pending payloads via gossip, state via Merkle-based diffing over gRPC. You can cap peer count with `peer_limit`. If a peer diverges from Bitcoin-anchored truth, replay exposes it automatically; state roots make the comparison one HTTP call.

Gossip is hardened against abuse: nodes track already-seen payloads to stop replay storms, rate-limit inbound traffic, and cap send concurrency.

## Private endpoints

Two endpoint groups are operator-only, protected by the `api_token` bearer token:

* `GET /calls/{contract_id}`: the paginated confirmed-call log.
* `POST /admin/clear_halt`: clears a consensus halt after operator investigation.

With no token configured, these endpoints stay locked.

## Monitoring

* `GET /health`: liveness.
* `GET /node_status`: node state summary.
* `GET /v2/state_root`: compare against peers to confirm you're in consensus.
* Logs (`RUST_LOG=info` and up) plus local storage give you a complete audit trail.

  Node operations aren't about agreeing with others. They're about independently replaying Bitcoin-anchored truth.