papers/lp-224-dchain-deposit-withdraw-consensus-wire/lp-224-dchain-deposit-withdraw-consensus-wire.tex

\documentclass[11pt,a4paper]{article}
\usepackage{../shared/luxcover}
\usepackage[utf8]{inputenc}
\usepackage[T1]{fontenc}
\usepackage{amsmath,amssymb,amsfonts}
\usepackage{graphicx}
\usepackage{hyperref}
\usepackage{booktabs}
\usepackage{enumitem}
\usepackage{xcolor}
\usepackage{siunitx}
\usepackage{listings}

\hypersetup{colorlinks=true,linkcolor=black,citecolor=blue,urlcolor=blue}

% Absorb the few overfull boxes from long unbreakable \texttt{} identifiers
% (DepositAck.credited, seen:<txID>, export_utxo) without loosening normal lines.
\emergencystretch=3em

\lstset{
  basicstyle=\ttfamily\scriptsize,
  breaklines=true,
  frame=single,
  showstringspaces=false,
}

\title{D-Chain Deposit/Withdraw Consensus-Wire Activation:\\
       Proposer-Relayed-Once Custody Acknowledgements
       Carried in the ZAP-Proxy Block}
\author{Lux Industries, Inc. \\
        \texttt{[email protected]}}
\date{}

\begin{document}
\luxcoverpage

\begin{abstract}
The D-Chain is the order-book venue: it owns balances, the book,
matching, and settlement. The public-network DEX VM
(\texttt{chains/dexvm}) is a stateless atomic ZAP proxy --- it holds
no order, pool, position, or balance keys; it moves value in and out
of the venue atomically via cross-chain shared memory and relays
order traffic. LP-223-adjacent work (the \emph{carried-fills}
consensus fix) established that a moving venue ledger makes
per-validator relay non-deterministic: if each validator independently
relayed a \texttt{clob\_submit} during block verification, each would
observe a different ledger and derive different fills, forking the
state root. The fix makes the \emph{proposer} relay the submit once at
\texttt{BuildBlock} and \emph{carry} the resulting fills in the block
and DAG-vertex bytes, so every validator settles from identical bytes
and reaches an identical state root. That closed the order-submission
path. It deliberately did \emph{not} close the deposit/withdraw
custody path, which is proven against the D-Chain VM directly and
against the proxy atomic rail (real \texttt{atomic.SharedMemory}) but
is \emph{not} yet carried in the proxy consensus block. This LP
specifies that follow-up. The proxy block and DAG vertex carry
\emph{deposit acknowledgements} (the import-then-credit result) and
\emph{withdraw-realized / export commitments} (the debit-then-export
result) so all validators apply the identical custody delta. We
specify replay protection (consumed-UTXO set $\cap$ per-transaction
idempotency), a network-upgrade activation height $H$ with strict
pre-/post-$H$ rejection (no ambiguous window), reuse of the reserved
fill-signature field that the carried-fills layout already carved for
the trustless path, the conservation invariant that gates release, the
proposer-trust security surface (conservation-bounded, no supply
inflation), and the multi-validator acceptance gates (deposit,
order-lock, match, withdraw --- all validators reach an identical state
root). This is a design specification; it does not implement the wire.
\end{abstract}

\tableofcontents
\newpage

\input{sections/01-motivation}
\input{sections/02-specification}
\input{sections/03-conservation}
\input{sections/04-security}
\input{sections/05-acceptance}

\bibliographystyle{plain}
\bibliography{biblio}

\end{document}