Skip to content

docs(rev15): the release family carries no parameters, and V_n gets its field table - #689

Merged
cryptskii merged 1 commit into
mainfrom
docs/rev15-release-policy-and-vault-state
Aug 21, 2026
Merged

cryptskii merged 1 commit into
mainfrom
docs/rev15-release-policy-and-vault-state

Conversation

@cryptskii

Copy link
Copy Markdown
Collaborator

Completes amendment 2a. Anchor V2 is unblocked.

P_R is near-empty, and that is the finding

OWNER_LOCAL_FULL_CLOSE version 1, same descriptor shape as P_M, no parameters.

I flagged earlier that this might be near-empty rather than padded, and it is. The family admits exactly one successor shape — both legs drained to zero, each leg's exact remaining amount credited to ordinary owner balance, the vault retired.

There is nothing left to parameterise: the amounts are the parent's reserves, the destination is ordinary owner balance, the authority is the owner signature over the exact successor (Def 5.1(a)), and the timing is Req 6.30's. A parameter here would be a value some verifier could read differently from the parent state — exactly what Req 4.6's decidability condition forbids.

A partial-release family would need a released amount per leg, which is precisely the parameter this family lacks, so it takes a new family_id under a new schema version rather than an optional field bolted on.

Confirmed against the implementation: VaultReserveMutation::Withdraw documents its legs as "exactly [pair.a, pair.b], in canonical order, each amount equal to the leaf it drains", and no partial-release path exists.

VaultStateV2 field table

The fifteen Def 4.1 members, numbered in the order that definition states them. Identities and roots digest32, generation and reserves u64, q u32, β an optional u64 with the §2.3 marker, and P_M/P_R/Φ/E/S nested inline by value.

Two aliases stay removed:

  • The token pair is not restated. Field 5 is the leg whose commitment is P_M.token_a_policy_commit, which 0x0007 requires to be the lexicographically smaller.
  • S and q are state fields, not B_M fields — Def 4.1 makes them members of V_n, and M commits their birth values transitively through c_0.

Registry status

Before After
Fully specified 8 10
Partial 4 4
Blocked 7 5

The five remaining — 0x000C, 0x000D, 0x0010, 0x0012, 0x0014 — belong to the routing and settlement amendments and do not gate Anchor V2.

What this means for Anchor V2

Its normative prerequisites are complete: the lineage recurrence h_n = c_{n-1}, the beta market and release families, Φ, and CCB(VaultStateV2). c_n is computable, so h_n is.

What stands between here and implementation is an encoder for 0x0001, checked against an independent one — not another amendment.

Report records the amendment; blob fc93e900 → 12c69d4c, drift mechanism fired four times, committed blob verified equal to the recorded pin.

…ts field table

Completes amendment 2a. Anchor V2 is unblocked.

Beta declares one release family: OWNER_LOCAL_FULL_CLOSE version 1, sharing the
descriptor shape of P_M and carrying NO parameters. It admits exactly one
successor shape — both reserve legs drained to zero in one transition, each
leg's exact remaining amount credited to ordinary owner balance, the vault
retired so no later successor may compose from the retired parent.

The absence of parameters is the finding, not a placeholder. The amounts are the
parent's reserves, the destination is ordinary owner balance, the authority is
the owner signature over the exact successor under Definition 5.1(a), and the
timing is Requirement 6.30's. A parameter here would be a value some verifier
could read differently from the parent state, which is exactly what Requirement
4.6's decidability condition forbids. A partial-release family would need a
released amount per leg — precisely the parameter this family does not have — so
it takes a new family_id under a new schema version rather than an optional
field bolted onto this one.

That matches the implementation: VaultReserveMutation::Withdraw documents its
legs as "exactly [pair.a, pair.b], in canonical order, each amount equal to the
leaf it drains", and no partial-release path exists.

VaultStateV2 gets its field table: the fifteen members of the Definition 4.1
tuple, numbered in the order that definition states them. Identities and roots
are digest32, generation and reserves u64, q u32, beta an optional u64 with the
2.3 presence marker, and P_M, P_R, Phi, E and S nested inline by value.

Two aliases stay removed. The token pair is not restated in V_n: field 5 is the
leg whose policy commitment is P_M's token_a, which 0x0007 requires to be the
lexicographically smaller. S and q are fields of the state rather than of B_M,
because Definition 4.1 makes them members of V_n and M commits their birth
values transitively through c_0.

The registry moves to ten specified, four partial, five blocked. The five that
remain — 0x000C, 0x000D, 0x0010, 0x0012, 0x0014 — belong to the routing and
settlement amendments and do not gate Anchor V2.

Anchor V2's normative prerequisites are now complete: the lineage recurrence,
the beta market and release families, Phi, and CCB(VaultStateV2). What stands
between here and implementation is an encoder for 0x0001 checked against an
independent one, not another amendment.

The report records the amendment and the new blob (fc93e90 -> 12c69d4). The
drift mechanism has now fired four times.
@cryptskii
cryptskii merged commit 5178dfe into main Aug 21, 2026
18 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant