Status: IN
`byzantine-fault-tolerance/pbft.py:46` is the only call site in the codebase that uses `json.dumps(sort_keys=True)` for hashing; all other `json.dumps` calls are for storage serialization where canonical form is irrelevant.
Source: entries/2026/05/29/topic-json-canonicalization-risks.md