Repository navigation
docs(rev15): the release family carries no parameters, and V_n gets its field table - #689
Merged
Merged
Conversation
…ts field table Completes amendment 2a. Anchor V2 is unblocked. Beta declares one release family: OWNER_LOCAL_FULL_CLOSE version 1, sharing the descriptor shape of P_M and carrying NO parameters. It admits exactly one successor shape — both reserve legs drained to zero in one transition, each leg's exact remaining amount credited to ordinary owner balance, the vault retired so no later successor may compose from the retired parent. The absence of parameters is the finding, not a placeholder. The amounts are the parent's reserves, the destination is ordinary owner balance, the authority is the owner signature over the exact successor under Definition 5.1(a), and the timing is Requirement 6.30's. A parameter here would be a value some verifier could read differently from the parent state, which is exactly what Requirement 4.6's decidability condition forbids. A partial-release family would need a released amount per leg — precisely the parameter this family does not have — so it takes a new family_id under a new schema version rather than an optional field bolted onto this one. That matches the implementation: VaultReserveMutation::Withdraw documents its legs as "exactly [pair.a, pair.b], in canonical order, each amount equal to the leaf it drains", and no partial-release path exists. VaultStateV2 gets its field table: the fifteen members of the Definition 4.1 tuple, numbered in the order that definition states them. Identities and roots are digest32, generation and reserves u64, q u32, beta an optional u64 with the 2.3 presence marker, and P_M, P_R, Phi, E and S nested inline by value. Two aliases stay removed. The token pair is not restated in V_n: field 5 is the leg whose policy commitment is P_M's token_a, which 0x0007 requires to be the lexicographically smaller. S and q are fields of the state rather than of B_M, because Definition 4.1 makes them members of V_n and M commits their birth values transitively through c_0. The registry moves to ten specified, four partial, five blocked. The five that remain — 0x000C, 0x000D, 0x0010, 0x0012, 0x0014 — belong to the routing and settlement amendments and do not gate Anchor V2. Anchor V2's normative prerequisites are now complete: the lineage recurrence, the beta market and release families, Phi, and CCB(VaultStateV2). What stands between here and implementation is an encoder for 0x0001 checked against an independent one, not another amendment. The report records the amendment and the new blob (fc93e90 -> 12c69d4). The drift mechanism has now fired four times.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Completes amendment 2a. Anchor V2 is unblocked.
P_Ris near-empty, and that is the findingOWNER_LOCAL_FULL_CLOSEversion 1, same descriptor shape asP_M, no parameters.I flagged earlier that this might be near-empty rather than padded, and it is. The family admits exactly one successor shape — both legs drained to zero, each leg's exact remaining amount credited to ordinary owner balance, the vault retired.
There is nothing left to parameterise: the amounts are the parent's reserves, the destination is ordinary owner balance, the authority is the owner signature over the exact successor (Def 5.1(a)), and the timing is Req 6.30's. A parameter here would be a value some verifier could read differently from the parent state — exactly what Req 4.6's decidability condition forbids.
A partial-release family would need a released amount per leg, which is precisely the parameter this family lacks, so it takes a new
family_idunder a new schema version rather than an optional field bolted on.Confirmed against the implementation:
VaultReserveMutation::Withdrawdocuments its legs as "exactly[pair.a, pair.b], in canonical order, each amount equal to the leaf it drains", and no partial-release path exists.VaultStateV2field tableThe fifteen Def 4.1 members, numbered in the order that definition states them. Identities and roots
digest32, generation and reservesu64,qu32,βan optionalu64with the §2.3 marker, andP_M/P_R/Φ/E/Snested inline by value.Two aliases stay removed:
P_M.token_a_policy_commit, which0x0007requires to be the lexicographically smaller.Sandqare state fields, notB_Mfields — Def 4.1 makes them members ofV_n, andMcommits their birth values transitively throughc_0.Registry status
The five remaining —
0x000C,0x000D,0x0010,0x0012,0x0014— belong to the routing and settlement amendments and do not gate Anchor V2.What this means for Anchor V2
Its normative prerequisites are complete: the lineage recurrence
h_n = c_{n-1}, the beta market and release families,Φ, andCCB(VaultStateV2).c_nis computable, soh_nis.What stands between here and implementation is an encoder for
0x0001, checked against an independent one — not another amendment.Report records the amendment; blob
fc93e900 → 12c69d4c, drift mechanism fired four times, committed blob verified equal to the recorded pin.