Protocol capability and flow-test frontier — 2026-08-29

Evidence class: offline source-contract and checked-in evidence analysis at commit 6d9d4b362cc14039dfce6dc6b11d7b7e17e98573. No build, validator, RPC, wallet, key, deployment, or submission was used for this analysis. A devnet statement below means only what the checked release/evidence records establish; it is not mainnet evidence.

Result

The repository is not one uniformly callable protocol. It currently contains four distinct strata:

1. durable private exteriors for founding, participant admission, Direct, Resolution, wallet payout, source abort, and retirement;
2. complete public-wallet submission for redemption only;
3. public-wallet signing and packet export, but deliberately no submission, for Dealer equity and release activation;
4. constructor, projection, or real-SBF component artifacts without a durable capability caller for Series Shadow, the Series Hot plan, General submission, Product Runtime V2 admission, Dealer Accepted completion, and the funded failure walk.

The seven devnet programs are a previous-generation role deployment. Registry and Rent are installed, and the five execution roles Core, Claims, Trading, Resolution, and Custody were activated. That does not activate current-source Dealer, Series, or General links, and it does not prove a market selected any of those families. The current Upgrade/release/fresh-Market cycle is still pending. The prior devnet campaign published a Realm and reached real founding prestates, but no Market reached Open; therefore admission, trading, resolution, Claims payout, redemption, and retirement have no market-level devnet activation.

There is no current-source, all-stage economic system execution. The PRIVATE lifecycle preflight is an offline reachability and expected-execution model and states that its actual probe still stops before validator launch. There is also no concurrent runtime campaign. The twenty-seed multiwallet oracle includes simultaneous candidates and shared nonces, but deterministically orders and applies them in one offline model; it is not parallel Solana transaction execution.

Classification vocabulary

• Constructor-only means the tree can encode, derive, or compile the action but has no non-test durable caller that owns observation, journaling, signing, submission, and finalized poststate. A browser preview or packet download is still constructor-only at the mutation boundary.
• Caller-backed means a non-test executable exterior consumes the artifact. partial means the caller reaches a preparation/checkpoint step but cannot finish the named capability.
• Private-runner-backed distinguishes real-ELF ProgramTest or an owned-loopback/local-validator command from a public client. ProgramTest is named explicitly; it is not validator evidence.
• Public-wallet-backed is submit only when a browser Wallet Standard path both signs and submits with durable recovery. sign/export is a different, incomplete boundary.
• Devnet-activated distinguishes role deployment/Registry activation, record publication, and Market-selected capability activation. A deployed role is not an Open Market.
• Economic system test means an executable multi-stage run reconciles the exact integer ledger across its protocol boundaries. A pure model or an isolated component conservation check is named separately.
• Concurrent system test means two or more real transactions contend in a runtime. Sorting “simultaneous” model actions is not such a test.

Capability matrix

The SDK package is named @dclutch/sdk but currently declares "private": true. Its root comment is the correct governing rule: a packet constructor is not public until one caller owns the durable journal, acknowledgement, and finalized poststate. The wildcard subpath export makes many lib/*.ts modules importable even when they are not re-exported at the root, while directTransaction, directCodec, and registered Direct packet paths are explicitly nulled. Package reachability must therefore be tested as a real API boundary rather than inferred from index.ts alone.

Executable producer/caller trace

Flow-test frontier before GMF3 all-link work

These gates are host/static/model work or focused existing-link work. None requires the expensive all-link build. The order prioritizes false capability claims and cross-stage seams before compute measurement.

P0 — machine-readable capability reachability

Add one source-owned manifest with a row per mutating action, not merely per program. Each row should name:

• constructor symbol and ABI/version;
• program dispatch route;
• non-test caller command/component;
• journal and terminal evidence schema;
• private/public-wallet exposure;
• release role/link and Market selector;
• current execution evidence class.

A static test should refuse an exported mutating constructor with no caller or an executable command hidden from accepted help. Seed the hostile cases with the Series three-builder orphan, Product Runtime V2 admission, Series Shadow, General's missing submission edge, Dealer's missing final commit, and failure walk submission. The existing PRIVATE preflight already proves dispatch/help reachability for its fourteen commands; generalize that pattern instead of creating a parallel list.

P0 — release deployment is not capability activation

Add a pure release/capability state classifier with exhaustive states:

Absent -> Installed -> RegistryActivated -> MarketSelected -> Executed

Require source digest and activation evidence at every transition. A test must refuse to label Dealer, Series, or General “devnet” merely because the SDK has an ABI or the current checked release enumerates 13 links. It must likewise report the old seven-role release honestly without projecting it onto current source. This gate is cheap and prevents the most damaging public-truth error.

P0 — cross-flow durable journal conformance

Extract a test contract, not a second implementation, for the common states:

Observed -> Planned/fsynced -> Signed+Submitted/fsynced -> Finalized+poststate

Run the existing founding, admission, Direct, payout, abort, retirement, and upgrade journal fixtures through it. Required hostile cases: ambiguous send never resubmits; expired unsigned packet may be archived/rebuilt; submitted packet may not be discarded; release/Market/generation/account scope cannot change; poststate must be read at or after the confirmed slot. This is a high-value pre-GMF3 architecture test because every later journey depends on the same crash semantics.

P0 — account-lock and packet census from constructors

Compile host-side v0 messages with two ComputeBudget instructions and count resolved unique transaction locks, not instruction metas. Cover one maximum fixture for:

• current founding plan;
• participant admission;
• Direct;
• Dealer create/page/evaluate/reserve/rollback/cleanup and projected commit;
• Series prepare/consume/expire;
• all seven General actions;
• Claims replay and payout;
• each aggregate-retirement suffix;
• staged abort and funded failure walk;
• release activation.

Require packet <= 1232 and locks <= 64. Existing General, retirement, Direct, founding, and Dealer measurements can become fixtures. This catches transport impossibility before an all-link build without pretending to measure SBF frame or compute.

P1 — producer-to-consumer poststate graph

For each journey, feed the prior stage's decoded poststate into the next production constructor in memory. Do not permit hand-planted intermediate accounts. At minimum exercise:

Realm -> founding -> admission -> Direct -> Resolution -> payout -> retirement

and the sibling fronts:

Dealer prepare -> reservations -> commit/rollback
Series open -> prepare -> consume/expire -> close
General batch -> orders -> best valid submitted candidate -> settlement -> close

The test should fail today at the honest missing edge, not fabricate a green journey. This pulls the Series caller, Dealer reservation producer, and General durable exterior gaps into executable architecture.

P1 — exact economy against observed component snapshots

Keep tools/economic-lifecycle-ledger/ledger.py as the one economic arithmetic owner. Have focused real-SBF or private-runner stages emit its existing observed snapshot schema after admission, each Direct group, resolution, payout groups, and retirement. Check all twenty named seeds at the component boundary before the full validator campaign. Include zero-payout losing burns, the 50-bps gross-199/gross-200 floor, exact fee destination, Hoard principal conservation, and the five retirement refund classes.

This is still not a whole-system result until one runner observes all stages, but it converts the current detached oracle into a reusable differential gate.

P1 — transaction contention model, then focused runtime races

First derive a writable-account conflict matrix from the exact compiled messages. Then add small focused real-runtime campaigns for:

• two Direct candidates sharing a maker nonce: one commit, one stale refusal;
• two admissions for one owner/Market/generation: one creates, one observes or refuses without double funding;
• two payouts for one Position coordinate: one burn, one replay refusal;
• payouts for distinct Positions: both may complete without a shared mutable client-side journal;
• late payout racing retirement: retirement cannot pass until every liability is zero;
• two Resolution candidates for one terminal sequence: only the best valid submitted candidate accepted by the named selection rule may advance;
• source abort racing Open: the state partition admits exactly one branch;
• release activation/upgrade racing a planned user packet: stale release binding refuses before semantic mutation.

The conflict matrix is architecture evidence. Only the follow-on runtime runs may be called concurrent system tests.

P2 — Rust/report/client differential gates

For General, Dealer, Series, founding, failure walk, payout, retirement, and release, serialize production Rust operator reports and feed those exact bytes to the SDK/browser hostile decoders. Require canonical re-encoding or an exact named refusal. Series currently lacks the public caller/decoder completeness of the better-covered families; add it only with the production caller, not as another decorative ABI.

Add a package-boundary test that enumerates package.json exports and the root exports. It should prove that intentionally private Direct packet modules remain unreachable, that wildcard subpaths do not silently convert a preview into a supported mutation API, and that every advertised public mutation has the same-package durable caller contract.

P2 — upgrade/resume interleaving

Use the current upgrade dry-plan and existing operation journals to model a release change between Planned, Submitted, and Finalized. A submitted signature is polled against its original release; it is never rebuilt merely because activation moved. An unsigned plan may be rebuilt only after explicit archive and fresh reauthentication. Apply the same test vector to founding, admission, Direct, redemption, retirement, source abort, and release itself.

Evidence anchors

• docs/evidence/DEVNET_ITERATION_2.md — exact previous seven-program deployment and pending current release/Market lifecycle.
• docs/evidence/DEPLOY_1.md — previous devnet Realm/founding prestates and explicit no-Open-Market result.
• docs/evidence/PRIVATE_LIFECYCLE_OFFLINE_EXECUTION_MODEL_2026_08_28.md — current private call graph and runtime evidence still owed.
• tools/economic-lifecycle-ledger/README.md — exact offline economic and twenty-seed simultaneous-candidate model boundary.
• docs/evidence/DEALER_ACCEPT_SPLIT_TOPOLOGY_2026_08_28.md — executable checkpoint primitives and missing Custody/final Accepted executor.
• docs/evidence/GENERAL_ACCELERATOR_CAMPAIGN_2026_08_27.md and docs/evidence/GENERAL_ALT_PACKET_WITNESS_2026_08_27.md — real-ELF action execution versus production packet-construction boundary.
• tools/gauntlet/tier4/README.md, docs/evidence/SERIES_ADAPTER_CORE_SEAM_2026_08_27.md, and docs/evidence/SERIES_SHADOW_SHA_ADAPTER_2026_08_28.md — test-only Core occurrence caller and Series artifact-without-caller boundaries.
• docs/evidence/AGGREGATE_RETIREMENT_CHECKPOINT_SPLIT_2026_08_28.md — focused four-transaction real-SBF retirement conservation.
• packages/dclutch-sdk/index.ts and packages/dclutch-sdk/package.json — read-first public contract and actual package export boundary.
• packages/dclutch-cli/src/commands/trade.ts, redeem.ts, and walk.ts — refused Direct submission, caller-complete redemption, and dry-run-only failure walk.
• apps/dclutch-web/components/DealerLiquidityWorkspace.tsx, GeneralWorkspace.tsx, ReleaseWorkspace.tsx, RedeemFlow.tsx, and CreateMarketWizard.tsx — the exact browser sign/export/submit/read-only boundaries.