papers/lp-224-dchain-deposit-withdraw-consensus-wire/sections/05-acceptance.tex

\section{Test and Acceptance}
\label{sec:acceptance}

The single-venue custody model is already proven by two suites: a
real-VM conservation test against the D-Chain ledger
(deposit~$\to$~order-lock~$\to$~match~$\to$~withdraw with value
conservation and restart survival) and a real-shared-memory atomic-rail
test (import/export all-or-nothing). This LP requires the
\emph{multi-validator analog}: the same hard gates, but with $N \ge 3$
validators consuming identical carried blocks and reaching an identical
state root at every height. Acceptance is the conjunction of the gates
below; each is the multi-validator lift of an already-passing
single-venue gate.

\subsection{Hard gates}

\begin{enumerate}[leftmargin=2em]
\item \textbf{Deposit gate.} A deposit block carries a
  \texttt{DepositAck} with \texttt{credited} equal to the consumed-UTXO
  value. All $N$ validators apply the identical credit, the consumed
  UTXO is in every validator's consumed set, and all $N$ commit an
  identical state root. \emph{Negative:} a block carrying
  \texttt{credited} $\ne$ consumed-UTXO value is rejected by every
  validator (invalid import leg). \emph{Replay:} re-delivering the
  deposit block, or a proposer rebuild, credits exactly once across all
  validators.

\item \textbf{Order-lock gate.} An order block moves
  \texttt{available}~$\to$~\texttt{locked} by the exact reserve
  ($\lceil \mathrm{size}\cdot\mathrm{price}\rceil$ quote for a buy,
  $\mathrm{size}$ base for a sell). All $N$ validators apply the
  identical lock and commit an identical root. \emph{Negative:} an
  unfunded order (reserve $>$ \texttt{available}) is rejected
  identically by all validators (custody gate: lock before match).

\item \textbf{Match gate.} A match block carries fills (existing
  carried-fills section); all $N$ validators settle both legs wei-exact
  --- the maker is credited the taker's payment and the taker is
  credited the maker's asset, fees taken into $F$ --- and refund any
  unspent lock. All $N$ commit an identical root, and the per-asset sums
  $A, L, F$ match across validators. \emph{Determinism:} the proposer
  relays the underlying \texttt{clob\_submit} once at
  \texttt{BuildBlock}; \textbf{zero validators dial the venue} during
  \texttt{Verify}/\texttt{Accept} (the carried-fills property), and the
  same must hold for the custody relays.

\item \textbf{Withdraw gate.} A withdraw block carries a
  \texttt{WithdrawCommit} with \texttt{realized} $\le$
  \texttt{available} at relay; all $N$ validators apply the identical
  debit and observe the identical \texttt{export\_utxo}, and all $N$
  commit an identical root. The exported amount equals \texttt{realized}
  on the destination chain. \emph{Negative:} a block whose export leg
  would release more than \texttt{realized} is rejected by every
  validator. \emph{Replay:} re-delivery or rebuild exports exactly once.
\end{enumerate}

\subsection{End-to-end multi-validator conservation}

The capstone acceptance is the end-to-end run with $N \ge 3$
validators:

\begin{enumerate}[leftmargin=2em,nosep]
\item Deposit a maker account and a taker account (distinct assets).
\item Place a resting maker order (lock applied).
\item Cross with a taker order (one or more consensus fills settled in
  the ledger; maker credited, taker credited).
\item Withdraw both accounts.
\end{enumerate}

\noindent Acceptance holds when, \emph{at every block height across the
run}:

\begin{itemize}[leftmargin=2em,nosep]
\item all $N$ validators commit a byte-identical state root;
\item the conservation invariant $I = A + L + F + E$
  (Section~\ref{sec:conservation}) holds, with every term computed
  identically by every validator;
\item the per-account \texttt{available} and \texttt{locked} balances
  match across all validators;
\item the realized withdraw totals equal the deposited totals net of
  fees ($E + A + L + F = I$, and at the end with all balances withdrawn,
  $E + F = I$).
\end{itemize}

\subsection{Failure and restart gates}

\begin{enumerate}[leftmargin=2em,nosep]
\item \textbf{Lost-poll strand.} A block the proposer builds and relays
  but which loses the consensus poll commits no custody transition to
  the canonical chain across any validator; the source UTXO remains
  unconsumed (deposit) or the venue balance remains available
  (withdraw). No value is created or burned
  (Section~\ref{sec:strand}).
\item \textbf{Failed export refund.} A withdraw whose export leg fails
  after the venue debit results in a full refund to the account; the
  end-state conservation still holds.
\item \textbf{Restart.} After a node restart at the end of the run, the
  per-account \texttt{available} and \texttt{locked} balances survive
  (rebuilt from persisted rows) and match the pre-restart values on
  every validator --- the multi-validator lift of the single-venue
  restart proof.
\end{enumerate}

\subsection{Activation gates}

\begin{enumerate}[leftmargin=2em,nosep]
\item \textbf{Pre-$H$ rejection.} A block at height $h < H$ that carries
  custody sub-sections is rejected by every validator
  (Section~\ref{sec:compat}).
\item \textbf{Post-$H$ requirement.} A block at height $h \ge H$ that
  effects a custody transition without carrying its record is rejected
  by every validator.
\item \textbf{Identifier divergence at $H$.} A pre-$H$ node and a
  post-$H$ node compute different identifiers for any block carrying
  custody payloads, confirming the format cannot silently half-apply.
\end{enumerate}

\subsection{What ``done'' means}

This LP is dischargeable when all gates above pass with $N \ge 3$
validators on a network that has activated the upgrade at $H$, with the
evidence artifact recording: validator count, commit SHAs and released
versions, the activation height $H$, per-block state roots (identical
across validators), the deposit/withdraw \texttt{credited}/\texttt{realized}
values and UTXO references, the fill identifiers, before/after
\texttt{available}+\texttt{locked} per account, and the final
conservation output $I = A + L + F + E$. Until those gates pass on a
multi-validator network, the format is specified and the single-venue
model is proven, but the consensus-wired path is not released --- which
is precisely the boundary this LP draws.