[cryptskii]

A SoFi trade, made faster in two steps.

1. One resolution reads each final cell, each object and each index once (§6.60).
2. A trade's independent reads and writes overlap (§6.61).

On the rig, against main at #1093's 53 s:

• a chain trade takes 23 s, with a settle of about 5 s;
• a split takes 19 s.

What repeated

Each node's requests were counted during one resolve_pending_position in the node harness. One rig settle read 33 cells, of which only 6 were distinct.

• Cells. The walks and the facts re-read cells the resolution had already read.
• The precommit. The settle fetched it, and then the walks fetched it again.
• The owner walk (A8). Each step of the vault owner's lineage fetched an object that every step shares: 7 times in a 7-step walk.
• The genesis locator. Each vault's locator was scanned four times.

The change

A verifier context is one per resolution, quote or walk. It keeps what it read for its life (ReadOnce in sofi_reads.rs). It keeps only readings nothing later can change:

• Cells, once Core evaluated them final.
  • SoFi cells: SofiReads::keep_completion now carries the reads along with the proof.
  • An owner walk's register cell: kept once read_root_cell reads a Final claim from it.
  • A cell is keyed by its namespace, key, seed and committed set.
• A Kept precommit, fulfillment or setup.
• A Stored object.
• A Complete genesis scan.
• An owner walk's object (OnceFetcher). It is kept only when its identity, recomputed from its bytes, is the one asked for.

Open or undecided cells, and unavailable or partial readings, are read again every time. Core evaluates exactly the evidence it did before. The settle now reads its precommit through the verifier's reads.

A first rule was unsound, and two existing tests caught it

The first version kept a cell once every seat had answered, and counted an empty seat as complete. So it kept open cells, and a later write in the same context was invisible:

• a_key_held_by_an_exercise_its_own_bytes_refute_is_skipped_on_those_bytes_alone
• an_unsigned_exercise_at_a_successor_key_takes_nothing

Both went red, and the rule is now Core's own verdict. The first of those tests now walks in a context of its own, so its request log still shows everything the walk reads.

Tests (release, Postgres node fleet)

• The new test: one_resolution_asks_each_node_for_a_final_cell_or_an_object_once. The order splits across two vaults A opened in turn, so the resolution walks A's lineage twice. The position is left pending by a refused pair write, then completed. One resolution realizes it, and no node is asked twice for anything except each vault's open next key. A fresh verifier confirms those keys are open.

• Mutation controls, all red, each naming what repeated:

  • the final-cell memo;
  • the walk-object memo;
  • the walk-register-cell memo;
  • genesis scans;
  • precommits, fulfillments and setups;
  • Stored objects;
  • the settle fetching the precommit itself again.

  The tree was restored byte for byte after each.

• SDK suites: 81 passed, 0 failed (node e2e, sender and recipient admission, token create, faucet, frontier verification, realized records, sofi_flow, route_seats, storage_node_sdk, storage_io, sofi_reads, sofi_advance).

• Core: dsm sofi::, 237 passed, 0 failed.

• Static checks: make lint exit 0, guard and self-test clean, no-clock gate OK.

Rig (three phones, APK = this branch, the GCP fleet)

Trade	Quote	Trade	Settle
Split, 1500 RIGT → 114.90 ERA, two vaults (position 15)	11 s	26 s	4.5 s
Chain, 20 ERA → 175.67 HOP (position 16)	10 s	27 s	5.3 s
#1093, before this change	20 s	53 s	28.7 s

The split was sized against the reserves: one vault alone would have given about 76.6 ERA. C's balances moved by exactly the quoted amounts, and each history row names both of its vaults.

Second step: independent I/O overlaps (§6.61)

• Vault heads at once. The trade walks each vault's head on its own scoped thread over the one verifier (chains_at_once). A walk reads only its own owner and cells; the kept reads are shared, and no memo lock is held across a read.

• Leg writes at once. Each leg's exercise is written at the same time (write_exercise). P's legs name strictly ascending vaults (R15-4), so every leg is its own cell, and cell puts take a per-key advisory lock.

• First verified answer wins. An object fetch keeps the first answer whose bytes re-hash to the address, instead of waiting for the slowest member.

• Withdrawn: publishing a produced operation's objects at once. It failed the trade. The cause is in the storage node, which aborts concurrent immutable puts:

  • each put runs as a SERIALIZABLE transaction, with no retry on SQLSTATE 40001;
  • a probe of 16 concurrent distinct puts at one node had 6 answered HTTP 500; the same puts one at a time had none;
  • the Postgres log gained exactly 6 serialization failures, and the same failure is logged locally since 2026-09-25.

  It is recorded in §6.61 as an open storage finding: two clients putting at once lose puts today. STORAGE has it, through CORE.

• Test. a_fetch_passes_over_a_member_that_answers_first_with_other_bytes: a member that answers first with other bytes is passed over. Reducing the re-hash check to a namespace check turns the test red.

• Suites. SDK node and handler suites: 82 passed, 0 failed. make lint exit 0, guard clean, no-clock gate OK.

Rig, APK = this branch	Trade	Head walks	Completing	Settle
Chain, 20 ERA → 106.95 HOP (position 17)	23 s	6.1 s	4.4 s	4.6 s
Split, 600 RIGT → 32.63 ERA (position 18)	19 s	3.7 s	4.4 s	4.9 s
First step only, chain (position 16)	27 s	8.5 s	6.8 s	5.3 s

Quotes take 10–12 s, unchanged. Their owner walks happen inside Core's vaults_of_token.

Pins

INTENT_PINS will be repinned once, from this PR's Code map.