[Judge-M]

What landed

Milestone 3 of the Rust port grows the Weave fold by the four remaining verification-critical paths, each ported from weave.py semantics and pinned byte-for-byte by reference-generated vectors:

• ATTEST adjudication-collapse (MERGE_SEMANTICS §4): an ATTEST with predicate: "adjudicates" collapses preserved MV/adjudicated heads; SELECT supersedes the named non-winner evidence (logical, not erasure — losers stay in provenance), and the resolution binds only named evidence so an unobserved concurrent head re-opens the conflict (§4.3).
• Trusted tiered promotion (NONA_RECKONER §7): a promote-ATTEST lifts a capability's quarantine (clears the flag + strips sandbox_only, resolved head kept in sync) ONLY when its author holds a live, root-authored promoter cell for the candidate's declared tier. The root is anchored on the parentless event with the smallest seq — never on the grindable content-addressed event id. Forged/self-granted/retracted promoter cells are ignored; fail closed.
• EffectReceipt projections (WEFT §8): receipts_for_idempotency (canonical fold order) and canonical_for_idempotency — the latest DEFINITE receipt supersedes an earlier UNKNOWN for the same logical op; all-UNKNOWN folds to None.
• LEASE1 lease-expiry derivation: frontier_lamport (max folded lamport — logical time, never wall-clock) plus the per-capability invoke tally feed capability::lease_status; a lapsed lease (expires_at reached or max_uses spent) fails closed exactly like a revoked grant and becomes a DERIVED_AUTHORITY cascade root in the same pure, idempotent derived pass.

Cascade over-closure fix

The milestone-2 cascade closed any cell descending from any retracted cell. Milestone 3 scopes descent-closure to cascade roots only (explicit cascade, TERMINATE→LEASE_TREE, non-SUPERSEDE capability RETRACT→DERIVED_AUTHORITY, and derived lease-expiry roots). A plain WITHDRAW/REDACT tombstone no longer cascades. Lease-expired flags are purely derived — cleared and recomputed per pass, so re-folds and repeated cascade_retractions() calls are idempotent (pinned by adversarial test).

Semantics surprises (mirrored honestly from the reference)

• Adjudication is ungated; promotion is gated. The reference gates NOTHING on the adjudicator — any principal's signed ATTEST collapses MV heads — while promotion requires a root-declared promoter for the tier. Both mirrored exactly, including an adjudication from a non-root attester in the vectors.
• Lease caveats are inherited min-clamped: attenuate takes min(new, inherited) for shrink-only caveats (budget, expires_at, max_uses), so an attenuated child of a leased cap is itself a lease root when the frontier passes — the subwallet lapses on its own inherited expires_at, while the budget-only view child (no lease caveat) fails closed purely by the cascade.
• Anti-grinding: the genesis root is seq-anchored because event ids are content-addressed and grindable. The vector script deterministically grinds a second parentless event whose id sorts before the real genesis (attacker_genesis_folds_first: true) — under an id-order anchor it would hijack the root; the seq anchor holds, and the attacker's self-declared "financial" promoter is ignored.

Verification evidence

• rust/vectors/extended_vectors_v3.json — generated FROM the Python reference (vectors/generate.py, all-zero seed, no wall-clock, pinned nonces; byte-stable), pinning 23 events across all four features.
• decima-verify now checks all three vector files: 386/386 (107 v1 + 109 extended + 170 v3).
• cargo test: 25/25, including 7 new adversarial tests (decima-core/tests/adversarial.rs): forged promoter ignored, self-grant refused, retracted anchor inert, grinding resistance, no-genesis fail-closed, adjudication per §4 (incl. §4.3 unnamed-head reopen), lease lapse + cascade + idempotency, UNKNOWN→definite reconciliation.
• cargo fmt --check, cargo clippy -- -D warnings, ruff check vectors/generate.py — all clean pre-push.
• Post-push integrity: branch tarball diffed byte-for-byte against the verified local tree — clean.

Deferred (documented in rust/README.md)

or-set / counter / append-log / sequence / map reducers; kernel delegation/authorization; key-rotation succession chains; ingest/sync; snapshots; time-travel windows.

Run

cd rust
cargo test                          # 25/25
cargo run -p decima-verify          # 386 checks, exit 0 = MATCH