test: complete GI full stateful invariant verification

[garykocsis]

Summary

Completes GI — Full Stateful Invariant Verification for Standby.

Adds production-path, handler-driven stateful invariant verification over the F8D-complete realization without introducing new protocol semantics or modifying production code.

The campaigns adversarially compose O1, O2, O3, lifecycle, eligibility, liquidity, swap, failure, and relevant external actions while independently verifying global safety properties across persistent histories.

Stateful Verification

Adds:

• adversarial stateful action generation through production interfaces;
• independent Supporting Capacity derivation;
• independent Aggregate Capacity Obligation derivation over full commitment history;
• independent fulfillment and Beneficiary-delivery accounting;
• commitment conservation and immutable-history verification;
• bounded-reference integrity and slot-reuse verification;
• O2 causal-context isolation;
• authority and rejection-atomicity verification;
• protocol custody invariants;
• canonical and generalized campaign configurations;
• deterministic stateful sequence evidence and campaign diagnostics.

The generalized campaign reverses the protected direction and uses heterogeneous currency decimals to verify that the realization is not coupled to the canonical token ordering, direction, or six-decimal fixture.

G-I

Independent review result:

• GI — Full Stateful Invariant Verification: COMPLETE
• G-I: PASS / CLOSED
• all 23 G-I conditions satisfied;
• no production counterexample discovered;
• no production correction required.

Verification

Repository verification:

• forge fmt --check — clean
• forge build --sizes — successful
• forge test — 579 passed, 0 failed
• FOUNDRY_PROFILE=ci forge test — 579 passed, 0 failed

Both canonical and generalized stateful invariant campaigns pass, together with the directed stateful sequence evidence.

Post-GI Coverage

Refreshed the existing diagnostic coverage baseline after GI:

Metric	Post-F8D	Post-GI
Lines	99.42%	99.42%
Statements	98.33%	98.52%
Branches	91.35%	92.31%
Functions	100%	100%

The newly exercised production surface is the untrusted-perimeter liquidity-removal refusal previously identified as a potential GI input.

Coverage remains diagnostic and is not used as evidence of G-I closure.

Scope

No production semantics were changed.

No production source, frozen artifact, or protocol configuration was modified as part of GI.

The coverage workflow required one behavior-preserving test-side helper extraction to compile under coverage instrumentation; campaign behavior and verification results remained unchanged.

Documentation

Updates Session 15 implementation/audit evidence, post-GI coverage reporting, project status, and the contemporaneous ChatGPT retrospective.

Next

F9 — Canonical Acceptance is the next authorized implementation slice / current blocker.