Finality and rollback
A block on ZooBC becomes final in two ways. Once it is more than 720 blocks (3 hours) deep, no node that stays in step with the network will roll it back. And once a spine block co-signed by two thirds of the seats names it, or a later block, as its checkpoint, no node will reorganise below it at all, whatever weight a competing branch claims. A node that ends up stranded on the wrong side of these limits does not stay there: it declares itself wedged and rebuilds itself from the network.
Rollback, within a hard limit
ZooBC nodes follow the heaviest branch (see fork choice and cumulative difficulty). When a node learns of a heavier branch, it rolls its own recent blocks back to the point where the two branches split, then applies the other branch's blocks, checking each one. A rollback restores every state table to the target height from versioned rows, the coinbase of the removed blocks included.
That rollback has a hard limit, max_rollback_height: 720 blocks on mainnet, 3 hours at 15 seconds per block, and 60 blocks (15 minutes) on devnet. A branch that would need a deeper rollback is refused, whatever its weight.
The limit is safe because a node never rolls back blindly. It fetches a competing branch and weighs it before touching its own chain: it finds the real split point, checks the depth before downloading anything, weighs the branch page by page, gives up after a bounded number of attempts, and only rolls back once the branch is proven heavier.
The checkpoint floor
The spine chain adds a second, stronger guarantee. Each spine block names a main-chain reference block and pins it exactly, by its hash and weight, not just its height. Once a node stores a spine block with enough co-signatures, that reference height becomes the chain's finalized height.
No reorganisation crosses it. A node refuses a fork whose split point lies below the finalized height before it fetches a single block, and it refuses again if it is ever asked to remove blocks below it. A spine block needs the co-signatures of two thirds of the registered seats, and each signer first checks its content against its own chain, so a checkpoint is a statement by the registry as a whole. Every honest node treats it as final as soon as it stores it, without waiting for further spine blocks.
Why the checkpoint is deeper than the rollback limit
Two numbers meet here. A node may roll back up to 720 blocks. And a spine checkpoint, like the snapshot it names, describes the chain 760 blocks below the tip (main_snapshot_min_height).
If the checkpoint were shallower than the rollback limit, the spine could commit to a block that a legitimate reorganisation might still replace, and the signed checkpoint and the chain everyone follows would disagree. So the genesis builder requires main_snapshot_min_height to exceed max_rollback_height by at least 20 blocks. Mainnet uses 760 against 720, a margin of 40 blocks; devnet keeps the same shape with 80 against 60. Every block a checkpoint names is already beyond any permitted rollback.
Stranded nodes: wedge and rebuild
A node that was cut off for longer than the rollback limit may find that the rest of the network has followed a heavier branch beyond its reach. It does not roll back to it, and it does not carry on alone for ever either.
When at least three registered peers confirm a heavier branch that lies out of reach, the node declares itself wedged and stops producing on its own branch. The node's own wedge detector, a local rule, also watches for 10 consecutive failed fork resolutions at one height, against at least 2 peers, over at least 1,800 seconds (30 minutes). With auto_resync on, the default from version 0.5.8, a wedged node discards its local chain and rebuilds it from the network, starting from the spine checkpoints and snapshots (see snapshots and fast sync).
A stale node follows the registry
A node whose tip is more than 7,200 seconds (2 hours) old does not trust whichever peer claims to be ahead. It follows the tip that at least two thirds of a sample of registered peers report (at least ceil(2 × n / 3) of n peers, with n at least 3).
Compared with probabilistic finality
In Proof of Work, confidence in a block grows with its depth but never becomes certain; Bitcoin users often wait six blocks before treating a payment as settled. ZooBC replaces that habit with rules: a hard rollback limit of 3 hours and a co-signed checkpoint about once a day, below which history does not change. The price is that a node cut off for more than 3 hours on a minority branch cannot switch back by rolling back; it rebuilds instead.