Series pre-Market expiry — real-ELF ProgramTest, 2026-09-07

Evidence level: real SBF execution in an in-process ProgramTest bank. This is not local-validator founding, packet-size/finalization evidence, devnet execution, or evidence for the complete two-occurrence Series lifecycle.

Source and result

The test host and Trading source were the clean committed revision 548a2f1f624f900fd99eb9aeff362af2972a1dbd, checked at hbox:/tank/dregg-build/dclutch-integrated-fa0198512 immediately before each run. Companion programs were the controlled release-B artifacts built at 56767e555d05ecd005edec4fc939d269e8757417. The mixed artifact set is deliberate component evidence; it is not a checked release of the newer source.

Both shipped and profiled Trading runs passed all seven named-target tests:

• current_source_series_expire_lands_before_the_future_market_exists: accepted expiry, all selected child calls and exact replay/resource poststates.
• a_permit_prepaid_below_todays_minimum_still_expires_on_the_deployed_elf: accepted under the permit's recorded funded-rent basis.
• a_restated_config_identity_refuses_before_the_composition: its accepted control and the hostile root-config substitution remain distinct.
• precommit_caller_substitutions_refuse_with_exact_state_reversion: all four hostile rows run and assert their exact Trading refusal and full rollback.
• Three native fixture controls: controller-manifest substitution, exact/disjoint root-independent substrate, and the single config-identity author.

The four caller refusals are TradingSbfError::SeriesPrecommitCallerKey, SeriesPrecommitCallerPrivileges, SeriesPrecommitCallerOwner, and SeriesPrecommitCallerData. Their discriminants are owned by the enum and namespaced census; no earlier generic refusal or prior-CPI log substitutes for those assertions. The earlier assertion that Custody must already have executed before Core preflight was incorrect: preflight precedes every CPI.

For each accepted ordinary expiry control, Trading consumed 1,216,428 CU in the shipped build and 1,251,928 CU in the profiled build. The enclosing Registry continuation consumed 1,304,551 and 1,338,676 CU respectively, under the test's 1,399,700 available units after compute-budget instructions. These are measured costs of these artifacts, not new protocol limits.

Poststates and repairs

The future Market stays vacant. The transient projected Custody state and vault close, their exact recorded rent returns to RentCredit, the permit closes, and Trading commits the expected root and Ticket replay bytes. Ordinary collateral refund ownership remains the Ticket's wallet owner; rent credit is a different physical recipient. The comparison checks data, owner, lamports, executable bit and rent epoch. Expected surviving modified accounts use Agave 4.3's bank-owned u64::MAX rent-epoch normalization; no economic or byte comparison is omitted.

The integrated repair in fa0198512 authenticates the semantic Template id from the finalized config bytes, derives the Custody transfer bump for the future Market, carries the physical rent-credit address, specializes projected abort to its exact 768-byte wire and 11-account frame, verifies its typed receipt and rent poststate, and downgrades Core's two replay observations without granting it Trading's commit authority.

That combined shipped build initially emitted 58 frame-overwrite diagnostics in authenticate_and_execute_hot_v3. It was rejected before execution. Extracting selected-entry decoding into a non-inlined helper in 548a2f1f6 produced shipped and profiled Trading ELFs with zero occurrences of either compiler frame-error pattern. This does not discharge the later all-program frame baseline debt.

Reproduction and artifacts

Run from the exact clean host revision, on hbox through swarm-build, with SWARM_MEM_MAX=32G CARGO_BUILD_JOBS=6. Set SBF_OUT_DIR to the controlled release-b-test-elf directory below and DCLUTCH_TRADING_ELF_PATH to one of the explicit new Trading artifacts. The named target is intentionally serial:

cargo test --locked -p dclutch-trading-program-test \
  --test series_pre_market_expiry_program_test -- --nocapture --test-threads=1

All relative paths in this table are under hbox:/tank/dregg-build/dclutch-codex-evidence-20260907/.

The native seam controls also passed: five Core precommit tests, two projected cleanup tests and the three family's mined-bump controls. The Series bump control was first observed red before the future-Market derivation repair. Complete Found→Prepare→Consume/Expire→retirement execution on a local validator remains assigned to the Series producer lane.