This week's protocol changes include choices you cannot take back

Victoria Shinder27 September 2026, 19:512 min read

Most settings in software can be changed later. Three items from this week are notable for the ones that cannot, and for how each project handles that.

A flag that locks a business model. On the XRP Ledger, an issuer of a multi-purpose token who enables confidential balances under XLS-96 can never charge a native percentage transfer fee, and the flag cannot be cleared. An issuer already charging a fee cannot adopt confidentiality without reissuing the token. A discussion opened on 22 September points out that the trade-off is documented only in the specification's detailed sections and asks for a plain FAQ entry.

A setting fixed when a node is created. Erigon 3.7 now persists receipts by default in new data directories, making log queries faster at the cost of disk space. Changing that setting on an existing directory requires creating a new one, so the choice belongs at provisioning time. The release notes say so in the breaking-changes section.

A rule that fails closed. A draft Bitcoin proposal to classify which outputs expose their public keys resolves uncertainty in one direction: where the data cannot tell two levels apart, the more exposed one applies. That is not irreversibility in the same sense, but it is a deliberate choice of which mistake to make when information is missing.

The pattern

Irreversible choices are sometimes unavoidable. A privacy guarantee that could be switched off would not be much of a guarantee, and storage layouts are expensive to migrate. What differs is how visibly the cost is presented. Erigon puts its limit where operators look before upgrading. The Bitcoin draft names its fail-closed rule as the first thing a reader meets. The XRPL case shows what happens when a permanent consequence is correct but sits in a section most issuers will not read before acting.

A checklist that follows

For anyone designing or adopting such features: list every setting that cannot be undone, say so next to the switch rather than only in the specification, and make the default the choice most users would not regret. For anyone flipping one: find the section called "limitations" or "breaking changes" before the button, not after.