Distributed Settlement Protocol

1. Protocol Scope

This appendix specifies the minimum safe loop from finalized $\operatorname{PeriodClosed}(P)$ to Activated Power. It defines protocol semantics and security invariants without presenting unmeasured ABI, gas, capacity, tree, or reward values as production constants.

2. Core Invariants

ID	Invariant
P-01	Only finalized ContributionEvent objects enter the input set
P-02	$L$ comes only from the on-chain Active cursor; the range is exactly $\mathcal{R}(L,P)=[L+1,P]$
P-03	Each source period uses its own Config, Registry, price-identity mapping, and Retention
P-04	Price values come only from the latest-stable snapshot at Context price_read_fence
P-05	Every Validator recomputes independently and never follows an Aggregator's result
P-06	QC uses the full Committee denominator and strictly satisfies $3S>2W$
P-07	The chain validates QC, binding, and continuity without executing the Power formula
P-08	Partial Batches, Sealed-but-unactivated, Expired, and Rejected states never alter Active Power
P-09	Empty Patch still passes Vote, QC, Seal, and Activate and advances the cursor
P-10	NoQuorum or delivery failure leaves the cursor unchanged; the next boundary expands the complete range

Global notation: $P$ is the latest closed source period; $L$ is the Active cursor; $C$ and $T$ are the compute and target periods; $\mathcal{R}(L,P)=[L+1,P]$ is the covered range; and $S$ and $W$ are signed and full-Committee voting power.

3. Period Range and Automatic Catch-Up

Under normal operation:

$$L=P-1,\qquad C=P+1,\qquad T=P+2,\qquad \mathcal{R}(L,P)=[P,P]$$

If source period $P$ produces no activatable result, the cursor remains $P-1$. After $P+1$ closes:

$$\operatorname{NQ}(P)\Longrightarrow L'=L,\qquad \mathcal{R}(L',P+1)=[L+1,P+1]$$

Here $\operatorname{NQ}(P)$ denotes NoQuorum at source period $P$, and $L'$ is the cursor at the next boundary. Nodes recompute the complete range from the same Active base. Votes for an older covered end cannot be mixed with the new range, and administrators cannot mark a failed period as processed.

4. Input Snapshot

For $\operatorname{PeriodClosed}(P)$, L1 creates a lightweight immutable InputSnapshot. It references rather than copies all events and binds:

• chain identity, boundary, and LedgerFence;
• Active root, version, and cursor;
• covered range $\mathcal{R}(L,P)=[L+1,P]$;
• ordered per-period PeriodFacts references and root;
• price_read_fence;
• Committee, Operator-to-compute-key authorization, and ProtocolSuite; and
• projection epoch and object limits.

Ingestion scans complete transaction versions continuously and atomically commits each event batch with next_tx_version. An Indexer may accelerate discovery but cannot prove completeness alone.

5. Context

ComputeRangeContext binds at least:

$$\mathrm{Ctx}=(I,A,\mathcal{R},C,T,H_{\mathrm{in}},H_{\pi},\Gamma)$$

Here $I$ groups chain/protocol/algorithm identity; $A$ groups Active root/version/cursor; $\mathcal{R}=\mathcal{R}(L,P)$, $C$, and $T$ bind the covered range and its compute/target periods; $H_{\mathrm{in}}$ binds period input count/root; $H_{\pi}$ binds the price fence/count/root; and $\Gamma$ binds Committee epoch/set, compute-key roots, and total voting power.

Local job id, database UUID, thread count, page size, wall clock, and Settlement Duty Seed do not enter Context. Duty Seed affects delivery after QC fixes the result and cannot influence Power computation.

6. Topo DEX Latest Stable Price

The Topo DEX oracle maintains one latest stable price per ordered identity $\iota=(b,q)$, where $b$ and $q$ denote the base and quote tokens:

Price state	POC behavior
Current-period accumulator	Unavailable because it is still changing
Latest stable price	Read at the fixed price_read_fence and committed into Context
Never formed a stable price	The entire task Abstains
No valid sample in the current period	Retain the previous stable price and report staleness

Every source period retains its own price-identity mapping, while actual values for all required identities are resolved once at the range Context fence. Later oracle updates cannot change an existing Context. A new Context after NoQuorum may use a newer latest stable price at its new fence.

7. Contribution Interpretation

Each Contribution follows a fixed order:

1. Verify that its event cursor belongs to the source-period interval.
2. Verify raw bytes, schema, and event emitter.
3. Apply Registry transitions that precede the contribution cursor.
4. Validate App, equity token, custody, and immediate admission state.
5. Resolve weight, price identity, units, and minimums from $\operatorname{Config}(p)$.
6. Apply business identity and duplicate rules.
7. Normalize with fixed integer rules.
8. Produce Accepted, BusinessRejected, or a task-level error.

Missing Price, Config, or historical Retention is a MissingDependency that causes the whole task to Abstain; it cannot be represented as zero contribution.

8. Deterministic Computation

Protocol collections are sorted and deduplicated before encoding or hashing. Events use $\tau=(v,i)$, where $v$ is transaction_version and $i$ is event_index; prices use the ordered identity $\iota=(b,q)$; users and Patch entries use raw address bytes; and Batches use batch_index.

Only fixed-width integers and checked arithmetic are permitted. Floating point, random map iteration, platform usize, local timezone, and wall clock cannot enter the result.

For user $u$, $V_p(u)$ is the period-end value, $R_p(u)$ is the value after Retention, $\Delta_p(u)$ is the period increment, and $\rho_p$ is the Retention parameter. Also, $m$ denotes last_materialized_period, $\operatorname{Ret}$ applies one-period Retention, and every $+$ below remains checked arithmetic.

Historical records are first materialized to Active cursor $L$:

$$\begin{aligned} R_q(u)&=\operatorname{Ret}\!\left(V_{q-1}(u),\rho_q\right), \\ V_q(u)&=R_q(u),\qquad q=m+1,\ldots,L \end{aligned}$$

The covered range is then processed:

$$\begin{aligned} R_p(u)&=\operatorname{Ret}\!\left(V_{p-1}(u),\rho_p\right), \\ V_p(u)&=R_p(u)+\Delta_p(u),\qquad p=L+1,\ldots,P \end{aligned}$$

Affected is the union of users with at least one valid, positive normalized contribution in the range. Each Affected user appears exactly once in the final Sparse Patch; all others are omitted.

9. Patch, Batch, and Empty Patch

Patch entries are strictly sorted by user and bind their count. The authenticated-state adapter proves that the base root equals the on-chain Active root and verifies member or non-member proof for every Affected user.

Batches derive only from the complete Patch using ProtocolSuite-defined item and byte limits. Thread count, temporary files, gas estimates, and submitter preference cannot change Batch boundaries.

When Affected is empty, let $\mathcal P$ be the Patch, $\mathcal B$ the Batch set, and $H_{\mathrm{base}}$ and $H_{\mathrm{post}}$ the base and post-state roots:

$$\lvert\mathcal P\rvert=\lvert\mathcal B\rvert=0,\qquad H_{\mathrm{post}}=H_{\mathrm{base}}$$

The Empty Patch still requires Artifact, Context, Commitment, Vote, and QC. Atomic Activate increments Active version and advances the cursor to the covered end.

10. Artifact, Commitment, and Vote

Artifact is a content-addressed evidence package containing period slices, policies and mappings, Contribution decisions, price snapshot, base witnesses, historical Retention, Patch, and Batches. A path, URI, or ETag is never content authority.

The construction order must remain acyclic:

$$\begin{gathered} H_{\mathrm{in}}=h(X_{\mathrm{in}}),\quad H_{\pi}=h(X_{\pi}),\quad H_{\mathrm{ctx}}=h(\mathrm{Ctx}), \\ \Omega=(U,H_{\mathrm{base}},\mathcal P,H_{\mathrm{post}},\mathcal B), \\ (X_{\mathrm{in}},X_{\pi},\mathrm{Ctx},\Omega) \longrightarrow \mathcal A \longrightarrow H_{\mathrm{art}}=h(\mathcal A), \\ H_{\mathrm{art}}\longrightarrow \mathcal M \longrightarrow H_{\mathrm{com}}=h(\mathcal M) \longrightarrow \mathrm{Vote} \end{gathered}$$

Here $h$ is the canonical hash; $X_{\mathrm{in}}$, $X_{\pi}$, and $U$ denote PeriodInputSlice, PriceSnapshot, and Affected; $\Omega$ groups base/Patch/post-state/Batches; and $\mathcal A$ and $\mathcal M$ denote Artifact and Commitment. The hash symbols retain the corresponding period_inputs_root, price_snapshot_root, context_hash, artifact_payload_digest, and commitment_hash bindings.

Before first signing, the Signer reopens Artifact, revalidates finalized eligibility, and uses the safety slot $\sigma=(\chi,\nu,e)$, where $\chi$, $\nu$, and $e$ denote chain_id, validator_id, and covered_source_end. An identical Vote is idempotent; any difference yields SignerConflict and fail-stop.

11. Vote and Weighted QC

An Aggregator groups only Votes with the same ordered binding $\beta=(H_{\Gamma},H_{\mathrm{ctx}},H_{\mathrm{com}})$, whose components denote committee_root, context_hash, and commitment_hash. Each Validator is weighted once using the finalized Committee snapshot.

$$\mathrm{QC}:\qquad 3S>2W$$

Before publishing QC, the Aggregator verifies every Vote, recomputes weights, and verifies the completed QC. Distinct Commitments never merge, and “most messages” does not select a winner. Without QC, the protocol writes no failure object on-chain and waits for the next larger range.

12. Candidate State Machine

Transition	Condition	Effect on Active
Unrecorded → Staging	Valid non-empty Patch QC	None
Unrecorded → Sealed	Valid Empty Patch QC	None
Staging → Sealed	All committed Batches have arrived idempotently	None
Staging → Expired	Protocol deadline reached	None
Staging/Sealed → Rejected	Authorized governance rejection	None
Sealed → Activated	Target boundary and valid base/cursor continuity	Atomically update root/version/cursor/next seed

Repeated submission of one Batch cannot replace its first valid Delivery Receipt; a different payload is rejected. Seal proves that staged content matches the QC Commitment but does not expose Power to consumers.

13. Settlement Duty and Public Fallback

After self-verifying QC, an Aggregator atomically persists canonical QC and QcReady; only then may a Settlement Worker consume it asynchronously. RPC, gas, nonce, mempool, and chain finality cannot enter Compute, Signer, or base-consensus call paths.

Duty order derives from the current Active seed generated by the prior activation and binds base, Context, Commitment, action kind, Batch index, and Validator address. The chain stores no Batch-by-Validator ranking table. Replay, NoQuorum, Expired, and Rejected never redraw the seed.

Secondary Validators take over after finalized fences when Primary fails. After all bounded Validator windows, the action enters permissionless Public fallback. A Public Relayer can deliver only QC-bound content and gains no QC weight or authority to modify the result.

14. Atomic Activate

Activation performs one transaction that:

1. verifies the Candidate is Sealed;
2. verifies base root/version/cursor against current Active;
3. verifies $s=L+1$, where $s$ is covered_source_start and $L$ is current_cursor;
4. completes idempotency, capacity, arithmetic, and reward-reservation checks;
5. creates one next-generation Duty Seed without redrawing on replay;
6. atomically switches root, version, and cursor and records activation period; and
7. marks reserved rewards Claimable without iterating the Committee or sending bulk transfers.

Any unexpected abort rolls back the complete write set.

15. Failure and Safe Convergence

Failure	Safe result	Recovery
Missing input, gap, or inconsistent interpretation	NotReady/Abstain	Restore from finalized chain or archive
Divergent Validator results or insufficient voting power	NoQuorum	Expand the complete range at the next boundary
Aggregator offline	Threshold unchanged	Another Aggregator repairs durable Votes
Artifact unverifiable	Do not sign or deliver	Switch provider and reverify by digest
Partial Batches	Candidate remains hidden	Complete idempotently or expire and recompute
Primary Settlement failure	Active unchanged	Secondary or Public fallback takes over
Reward Pool shortage or claim failure	Power continues	Disable this Candidate's reward or retry claim
Secure randomness temporarily unavailable	Power activation must not remain permanently blocked	Use the protocol-defined on-chain degraded path and alert; caller cannot choose it

16. Governance Boundary

Governance may update future policy, pause new work, freeze or reject Candidates, upgrade ProtocolSuite, and adjust versioned Reward and Duty policies. Governance cannot rewrite a QC result, advance the cursor manually, bypass QC to write Power, replace Active seed, or retroactively change an existing Candidate's beneficiary or Receipt.

17. Evidence-Gated Parameters

• Fixed-point scale, rounding, overflow, and maximum Power.
• Authenticated tree, proof, zero/delete behavior, and Genesis root.
• Production capacity for Batches, Artifact, range, and Committee.
• Exact Admission fences, gas, and storage budgets.
• Non-aborting randomness adapter and degraded-path drills.
• Duty windows, reward funding, amount function, and claim deadline.

Until closed, these parameters remain restricted to reference, shadow, or testnet validation.

18. Protocol Acceptance Criteria

• Two independent implementations produce bit-exact Context, Commitment, Patch, and root for the same snapshot.
• A missing required price, historical Retention, or valid base proof prevents signing.
• Signer Journal permanently rejects conflicting Votes for the same covered end.
• A QC without strictly more than two-thirds voting power cannot form or pass on-chain admission.
• Partial Batches, Expired/Rejected Candidates, and losing concurrent transactions cannot alter Active.
• Empty Patch advances the cursor and increments Active version.
• After all Validator Settlement Workers stop, a Public Relayer can complete delivery after the fence.
• NoQuorum causes the next period to recompute the complete range from the unadvanced cursor.