Changelog

Protocol:

• Holds no longer lock inputs. Initiate nullifies inputs and parks value in the hold; resolve and reclaim each publish one output commitment. The lock set is gone, and with it the lock-id linkability leak.
• Accept and reject are one resolve circuit with a witness-selected branch and one wrapper phase_class; the chain cannot tell them apart. Reject needs no recipient wallet proof. Reclaim replaces "expire by anyone."
• FI state moved out of the registry leaf into fiState[] on the pool; registry roots accepted from a window; revocation checked directly.
• fi_index is a signed wrapper public at every phase; fi_binding hash removed in favor of stored indices. Possession proof required at admit and rotateKey.
• counterparty_fi_index added to the pool-welded phase leaves.
• Salts added to params, state, attestations, and vk_root.
• Proof flavors specified (ZK Keccak on chain, Poseidon2-transcript inside W); constant proof size made a build-time assertion.
• Time bucket accepts current or previous.
• Context grew to 64 shared + 128 nested payload + 64 sender-private + 16 phase; schema_id is witnessed with a minimum-version assert and additive-only evolution, which is what makes Goal 4 true.
• Envelope, fees, and a normative leakage profile specified. Unshield declared policy-free on purpose.

Framework:

• Rules return Verdicts; the generated main asserts. Combinators are boolean algebra; Either defines its attestation.
• Per-policy read analysis dropped for v1; regions open in full by phase type.
• Comptime versus CLI responsibilities made explicit.
• "Vacuity" lint renamed weld coverage; sensitivity check added; satisfiability uses witness solving, proving is nightly.
• Canonical empty state; keyed state and pruning strategy sketched.

Plan:

• Week-one spikes added; corridor is hand-written in M1 and framework-built in M3; recursion measurement moved ahead of W.