Skip to content

fix(economic): decode the 0x0032 bundle-acceptance leaf — a trader who settled could admit nothing again - #855

Merged
cryptskii merged 1 commit into
mainfrom
fix/economic-decode-bundle-acceptance-leaf
Sep 11, 2026
Merged

fix(economic): decode the 0x0032 bundle-acceptance leaf — a trader who settled could admit nothing again#855
cryptskii merged 1 commit into
mainfrom
fix/economic-decode-bundle-acceptance-leaf

Conversation

@cryptskii

Copy link
Copy Markdown
Collaborator

A live defect on main since #852, found while implementing the C2 cutover. Landed separately and first: it is its own topic, and C2's walk depends on it.

What broke

#852 made the bundle-acceptance leaf (0x0032) mandatory in every market settle's write set, and added the fifth EconomicLeafState arm's encoder, key, value — and even its arm in the pre-state match — but not its decoder arm. read_leaf_state fell through to WrongClass for 0x0032.

path consequence since #852
producer_tree_and_pre_state every admission rebuilds its pre-state from the leaf cache, which after a settle holds the acceptance leaf — a trader who settled once could admit nothing again: no send, no second trade
resume_pending_admission a crash-resumed settle could not decode its own frozen witness
peer lineage walk a peer walking a trader through a settle read the witness as INVALID
economic proof artifacts a settle's inclusion proof did not decode

The first row is established by execution. With the arm removed, the new end-to-end test fails on a genuine settle with:

decode cached leaf state: unexpected object class 0x0032

The fix

The missing arm, mirroring the encoder exactly — envelope and two digest32, no rejection. The encoder refuses nothing; a decoder stricter than its encoder makes valid leaves unreadable.

The guard

every_leaf_class_round_trips_through_the_decoder matches every EconomicLeafState arm with no wildcard. A sixth arm fails to compile there until a sample is added, and the sample fails at runtime until the decoder handles it. #852 slipped because no test ever decoded the leaf it added.

Controls — each executed red with the arm removed, green with it

test what it decodes
every_leaf_class_round_trips_through_the_decoder one sample of every leaf class
a_settle_witness_carrying_the_acceptance_leaf_decodes_to_itself a real settle witness from build_write_set
an_artifact_proving_a_bundle_acceptance_leaf_decodes_and_verifies a settle's inclusion proof
a_trader_that_settled_can_still_build_its_next_pre_state live route, end to end

Dependent sweep: nothing asserted the old failure.

Verification

economic_provenance_wire              18/18
trader_acceptance_producer             9/9
economic::proof_artifact               7/7
dlv_routes new end-to-end control      1/1
make lint                             exit 0
ci/production_safety_checks.sh        exit 0

…o settled could admit nothing again

#852 made the bundle-acceptance leaf (0x0032) a mandatory part of every
market settle's economic write set. It added the fifth EconomicLeafState
arm's encoder, key, value, and even its arm in the pre-state match — but
not its DECODER arm. read_leaf_state fell through to WrongClass for 0x0032.

So since #852 every structure that decodes a settle's leaves failed:

  producer_tree_and_pre_state   every admission rebuilds its pre-state from
                                the leaf cache, which after a settle holds
                                the acceptance leaf — so a trader who settled
                                once could admit NOTHING again: no send, no
                                second trade
  resume_pending_admission      a crash-resumed settle could not decode its
                                own frozen witness
  peer lineage walk             any peer walking a trader THROUGH a settle
                                read the undecodable witness as INVALID
  economic proof artifacts      a settle's inclusion proof (the acceptance
                                leaf is citable) did not decode

The first is established by execution, not by reading. With the arm
removed, the new end-to-end test fails on a genuine settle with:

  decode cached leaf state: unexpected object class 0x0032

Found while implementing the realization cutover (C2), whose walk and TA_B
decoder both go through this function. Landed separately and first: it is
a live defect on main and a separate topic.

THE FIX mirrors the encoder exactly — envelope and two digest32, no
rejection — because the encoder refuses nothing, and a decoder stricter
than its encoder makes valid leaves unreadable.

THE GUARD. every_leaf_class_round_trips_through_the_decoder matches every
EconomicLeafState arm with no wildcard: a sixth arm fails to COMPILE there
until a sample is added, and the sample fails at runtime until the decoder
handles it. #852 slipped because no test ever decoded the leaf it added.

Controls, each executed red with the arm removed, green with it:

  every_leaf_class_round_trips_through_the_decoder              wire
  a_settle_witness_carrying_the_acceptance_leaf_decodes_to_itself  REAL settle witness
  an_artifact_proving_a_bundle_acceptance_leaf_decodes_and_verifies  proof artifact
  a_trader_that_settled_can_still_build_its_next_pre_state      live route, end to end

Dependent sweep: nothing asserted the old failure.

Verification:
  economic_provenance_wire              18/18
  trader_acceptance_producer             9/9
  economic::proof_artifact               7/7
  dlv_routes new end-to-end control      1/1
  make lint                             exit 0
  ci/production_safety_checks.sh        exit 0
@cryptskii
cryptskii merged commit 0b58920 into main Sep 11, 2026
16 checks passed
@cryptskii
cryptskii deleted the fix/economic-decode-bundle-acceptance-leaf branch September 11, 2026 02:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant