[alexanderlhicks]

Motivation

The discrepancy and gap records promoted oversized raw-decoder probes to a guest
execution discrepancy. The normal serialized guest rejects those particular nodes
at SSZ admission, so the records need an explicit input-domain qualification.
Addresses the factual finding in the #408 review.

Change in behaviour or contract

Preserve historical raw measurements and explain that the 33,330/33,331-depth
nodes occupy 111,280/111,284 bytes, exceeding the 1,024-byte per-node limit. Move
shared qualifications to DISC-001 and propagate them to the gap/module owners.
The raw diagnostic now prints root/max-node byte sizes and whether every node
meets that necessary byte bound. It still calls both decoders regardless of the
flag. Passing that predicate is not full guest admission or validation.
All Lean source bytes and decoder semantics are unchanged.

EELS sources

At pin 59c1473ddfba341babaeca1c97a50e996f639a0b,
src/ethereum/forks/amsterdam/stateless.py:34–35,46–49,63–66 defines witness member
limits. stateless_guest.py:26–38,53–61 decodes before validation. Actual bounded
ExecutionWitness component decoding supports that ordered-source inference; no
whole-guest execution or historical stress rerun is claimed.

Source-to-Lean rows

EthCommit C17 and EthStateless §10 now distinguish raw decoder evidence from
admitted serialized guest inputs. There is no new Lean operation or law.
The diagnostic retains its original generators, source checks and decoder calls.

Decisions and questions

Q6/Q20 keeps the same operative unresolved disposition under D14. O12, admitted
cross-node/DAG cases and other host-resource questions remain open. No new policy,
outcome, public interface, dependency, pin or accepted deviation.

Checks and tests

All 148 current CONTRIBUTING commands passed independently in author, ROOT and
two fresh CODE review lanes. Each audited 23,506 declarations with zero findings
and kernel-replayed all 513 library modules. Complete component controls normally
and with -O accept 0/1,024-byte members and reject 1,025-byte and the recorded
oversized-node members. Independent controls cover state and header members.
Small raw CLI tests verify sizes, deterministic digests, outcomes and the unchanged
optimization refusal: a 1,074-byte raw node still decodes while its flag is false.
Installed dependency integrity is checked against RECORDs without a wheel-origin
claim. No large historical decoder, memory, guest/EEST or performance run is claimed.

Review verdicts

Two fresh independent SOURCE scope reviews and two fresh independent adversarial
CODE reviews: CLEAN for their respective exact scopes. ROOT independently checked
factual fidelity, AST-preserved raw behavior, authority, full checks and all four
source/tree identities before commit. No finding was waived or downgraded.

Documentation

DISC-001, Q6/Q20 explanatory tail, EthCommit C17, EthStateless §10, cross-cutting
and generated gaps, six citation locations and the raw diagnostic documentation.
Historical observations and broader unresolved owners are preserved.

Stack

Based on main. No PR is merged or maintainer branch rewritten. The related
#417 review
also concerns its owner-controlled description; this correction does not change
that PR or declare it clean.

Generated with Codex.

[alexanderlhicks]

CLEAN_SCOPED_WORK_ITEM at a0c13a049bccfc0aabc822fe93cafdb6ea134bcc (tree c492410912382f08f2489d6dece46f4e6ae23266), against actual parent/base 50dfb658. No blocking finding in this corrective work item; whole-head cleanliness and adoption into current main are separate.

Reviewed all eight changed paths and the pinned witness schema, eager SSZ admission and guest entry order. The recorded 33,330/33,331-depth raw nodes occupy 111,280/111,284 bytes, outside the 1,024-byte per-state-node wire limit. They therefore do not establish the promoted admitted-guest divergence. The revised owners preserve the historical raw evidence and broader admitted cross-node/DAG/host-resource questions. The diagnostic adds sizes and a necessary per-node predicate; generators, both decoder calls, digests, exception handling and optimization refusal are preserved. Passing that predicate still does not establish full guest admission. No Lean semantics, pin, outcome policy or decision disposition changes.

Root and two independent review lanes each passed all 148 literal candidate CONTRIBUTING commands on separate cold exact-head clones: 23,506 declarations with zero findings, all 513 modules replayed, and 22 retained producer captures per lane. I authenticated the complete closed streams, tracked sources, captures and byte-compared cache archives, and read both independent reports. A's #429 campaign ran fresh after its separately qualified #428 receipt recovery. No historical decoder/SSZ/raw-probe/stress campaign was repeated; author component/CLI experiments are not credited as our new runtime evidence. No guest/EEST, resource or performance result is established. Local uv0.8.17 differs from CI0.13.6; literal uv/Python3.12 commands were retained without claiming environment equivalence.

Non-blocking clarity recommendation: repeat the raw-node/admitted-guest qualification in the unchanged shorthand at EthStateWitness.md:186 and its generated gap row. Those summaries already cite the corrected C17/DISC-001 owners and make no independent admitted-guest counterexample claim, so this is not a blocker under CONTRIBUTING §5.5.

This candidate addresses the specific #408 finding. That finding remains open on current main until the correction is adopted and its disposition handled. The separate #417 changed-claim finding remains open: this main-based branch changes neither that PR's head nor its description and does not waive its NOT_CLEAN verdict. General O12/resource obligations remain open.