@black-market/sdk 0.10.0 → 0.11.0

package/docs/launch-lifecycle.md

@@ -7,6 +7,50 @@ The canonical authorities are the registry/certification/adapter/config contract
 in the protocol repository. Plan identity is `LaunchPlanV1`. Pool-bound V4 uses **config 6**,
 canonical Abyss uses **config 1**, and generic current shared-V4 support uses **config 4**.
 
+## 0.11.0 release: gas sizing, packing and prefix proof
+
+New atomic/activation envelopes containing HMM V2 markets add one forwarding target:
+`R = 4_250_000 + 500_000 * (hmmMarkets - 1)` gas (zero for non-HMM plans).
+For measured gross gas `G` (`maxUsedGas`, falling back to `gasUsed`), compute is
+`min(max(G + R, ceil(G * (10000 + headroomBps) / 10000)), computeCap)`.
+Begin/preparation/approval/cancel commands do not receive this reserve. Nitro poster
+gas is budgeted separately inside the same complete gas envelope. Optional padding
+and the reserve are targets, not refusal thresholds; exact validated replay proves
+the clamped envelope. There is no bisection or extra ordinary-path request.
+
+Staged planning greedily packs contiguous markets against the unpadded compute cap:
+HMM V2 costs 14.5M per market; other profiles cost a conservative 16M. At 32M,
+1/2/3/5 HMM markets produce `[1]`/`[2]`/`[2,1]`/`[2,2,1]`.
+Only a packed measurement failure consuming at least 95% of its given gas splits
+that batch in half, regardless of its error selector. Low-gas semantic failures
+remain failures. `preparationBatchSize` is removed; inspect each preparation's
+`marketStart`/`marketCount`. The pure unsigned compiler still accepts explicit
+`preparationBatches`.
+
+Robinhood chain 4663 defaults `limits.maxSimulationGas` to **50_000_000n** aggregate
+gas **used**, not the sum of individual legal transaction envelopes. Override it
+for a provider with a different budget. The SDK measures and validates the longest
+estimated prefix that fits: begin 9.5M, preparations as above, activation 6M per
+market plus `R`, and small approvals/cancellation. A measurement failure after
+cumulative use reaches 95% of that cap defers the failed call and suffix.
+If even the immediate estimate cannot fit that budget, refusal first identifies
+any estimated per-transaction compute overflow (gas displayed in millions to one
+decimal), rather than suggesting that a larger RPC budget solves it. Estimates
+alone do not reject an envelope that can still be measured and exactly proved.
+
+`simulation.admitted`, `executionProof: "proved"` and `protocolFit: "proved"` cover
+only the successful proven prefix. **They do not promise eventual activation.**
+`simulation.deferredTransactionIds` explicitly lists unproved remaining steps
+(empty for full coverage); these commands carry no `gas`, `gasPrice`, `estimate`
+or `admission`. Call `buildNextTransaction` before each signature: canonical
+progress advances the proof window and gives the immediate next transaction exact
+gas. Reviewed envelopes receive only a direct exact replay of that immediate step,
+without new measurement, poster/price recommendations or suffix proof.
+
+`buySlippageBps` requires actual activation outputs. If activation is deferred,
+calibration refuses clearly; use a higher-budget native provider or preserve
+already committed minima by omitting recalibration. Outputs are never fabricated.
+
 ## 0.9.1 release: Abyss 0.01% fee tier
 
 `ABYSS_FEE_TIERS` now includes `{ feePips: 100, tickSpacing: 1, label: "0.01%" }`.
@@ -342,15 +386,13 @@ progress, funding/allowances and deployment/profile authority. It matches
 Preparation batching remains SDK-derived, not caller-selected. Malformed,
 wrong-step or changed envelopes refuse without returning executable calldata.
 
-Fresh measurement and complete native validated replay use the held price.
-The immediate replay uses the exact held gas; later unfinished steps receive
-fresh gas bounds and remain in the same stateful sequence. Current compute,
-poster, minimum headroom, tightening ceilings and full-sequence actual-balance
-affordability still apply. Exact replay also checks gross-gas headroom without
-counting Nitro's temporary compute hold. Neither natural child base fees nor
-payer balances are overridden. A higher advisory quote alone is not a refusal;
-an invalid current fee, insufficient gas or failed proof never silently raises
-the held envelope.
+The SDK directly validates only the immediate transaction at its exact held
+gas/price. It does not repeat measurement, quote a new gas price/poster budget or
+simulate future steps. Current protocol/transaction limits, native metering,
+postconditions and immediate actual-balance affordability still apply. Existing
+padding may be consumed; neither a new padding target nor a higher advisory quote
+alone invalidates a held envelope. Natural child base fees and payer balances are
+never overridden, and failed replay never raises held gas or switches backend.
 
 Approvals/resets, atomic launches, every staged next step and cancellation use
 this same contract. Cancellation retains its adapter-independent recovery policy.
@@ -742,13 +784,13 @@ Validation uses `validateV4LifecycleMarket`; the collector factory getter is
 | --- | --- |
 | `readLifecycleProfiles({client, orchestrator, profileIds?, offset?, limit?})` | Bounded registry discovery, schema/topology dispatch, reviewed graph/terms certification and current registry admission. Default offset/limit is 0/100; explicit IDs can select a reviewed deployment's identities. |
 | `predictLifecycleToken({client, plan})` | Exact prediction from the explicit core. |
-| `prepareAndPlanLifecycleLaunch({client, account, plan, mode, allowTopologyGaps?, allowMissingPermanentTail?, limits?, fork?, receipts?, confirmations?, signal?, onProgress?})` | Mines config6/V2 salts offchain, verifies per-market launch topology and exact final deployment bindings, and returns complete selected-mode admission under one SDK-owned fresh post-mining snapshot. No source-chain deployment or broadcast. |
+| `prepareAndPlanLifecycleLaunch({client, account, plan, mode, buySlippageBps?, allowTopologyGaps?, allowMissingPermanentTail?, limits?, fork?, receipts?, confirmations?, signal?, onProgress?})` | Mines config6/V2 salts offchain, verifies per-market topology and exact final deployment bindings, and proves the selected-mode prefix under one fresh post-mining snapshot. Reports deferred steps; buy calibration requires activation coverage. No source-chain deployment or broadcast. |
 | `readPoolBoundHookDeployment({client, plan, marketIndex})` | Verifies typed factory, code chunks, constructor, normalized economics, initcode, salt, CREATE2 prediction and recorded provenance of existing code. Works with draft salts; permission bits are additionally required for executable predeployment. |
 | `buildPoolBoundHookDeploymentTransaction({client, plan, marketIndex})` | Optional permissionless typed `deploy(parameters,salt)` calldata. Does not create a token, register/initialize a pool, bind a collector or activate a launch. |
 | `planLaunch({client, account, plan, mode, allowTopologyGaps?, allowMissingPermanentTail?, limits?, fork?, receipts?, confirmations?, signal?})` | Independently fresh per-market topology/domain/funding/profile/progress/execution admission of the already-finalized commitment, simulating only the explicitly selected mode. |
 | `simulateLaunchPlan({client, planned, limits?, fork?, receipts?, confirmations?})` | Rereads canonical state and proves remaining work. Preserves receipt evidence, economics and selected mode. |
 | `readLaunchProgress({client, planned, receipts?, confirmations?})` | Confirmation-bound canonical state, latest head, receipt/replacement/reorg status, account-nonce safety and actual prepared market/live state. |
-| `buildNextTransaction({client, planned, reviewedTransaction?, submissionClient?, limits?, fork?, receipts?, confirmations?, action?})` | Rereads progress, constraints and complete stateful proof before returning one admitted transaction. Optional untrusted `reviewedTransaction` must match the current canonical next step and freshly prove its exact gas/price. Optional `submissionClient` adds read-only immediate exact-envelope preflight. `action: "cancel"` uses the stored commitment without requiring fresh adapter/profile admission. Terminal launches return `undefined`. |
+| `buildNextTransaction({client, planned, reviewedTransaction?, submissionClient?, limits?, fork?, receipts?, confirmations?, action?})` | Rereads canonical progress and constraints, proves the immediate next transaction plus the fitting prefix, and returns one admitted envelope. With `reviewedTransaction`, directly replays only that matching immediate step at its exact held gas/price. Optional `submissionClient` adds read-only exact-envelope preflight. `action: "cancel"` retains adapter-independent recovery. Terminal launches return `undefined`. |
 
 Clients may be viem public clients or raw `request({method,params})` RPC clients. Transport, wallet, signing and durable storage are application-owned. `PlannedLaunch` contains bigint values and live limit callbacks: persist `serializeLaunchPlan(plan)`, explicit execution mode, confirmation policy and receipt references, not the entire object.
 
@@ -879,17 +921,17 @@ Mining is cancellable/nonblocking; `abort()` raises `AbortError` and does not ca
 Every planning call requires `mode: "atomic" | "staged"`. Only that requested mode receives economic simulation; staged does not compute or expose an unused atomic attempt.
 
 - Atomic: after funding prerequisites, token creation, empty infrastructure, all mint/lock/buys/public activation are one transaction.
-- Staged: prerequisites, `beginLaunch(Staged)`, contiguous empty `prepareMarkets` batches, then one `activateLaunch`. Only a stateful preparation refusal classified as capacity with a compute or gas-envelope constraint can partition into smaller empty batches. Opaque `DeploymentFailed`, unclassified/source/provider-clamp errors, byte-cap refusals and near-cap consumption do not authorize that search. Core/validator/registry/hook invariant errors stop planning.
+- Staged: prerequisites, `beginLaunch(Staged)`, greedily packed contiguous empty `prepareMarkets` batches, then one `activateLaunch`. A packed measurement failure using at least 95% of its given gas splits only that batch; low-gas semantic errors, byte caps and unlocated provider failures do not justify a split. Proof may cover only a prefix, with the unproved suffix explicitly deferred.
 - Activation cannot split. If mint/lock/all buys/opening cannot fit, staged is also refused. No position/buy/minimum is omitted to manufacture success.
 
 No automatic atomic-to-staged fallback exists. Obtain separate consent to review the same commitment as staged. Both venues use token transfer restrictions plus activation-time canonical opening-state checks, not a pool gate. Manipulated opening price or preactivation liquidity fails verification; the token stays inactive and the launch remains Ready/cancellable. Failed activation rolls back every mint, seal, buy and opening together.
 
 ## Execution constraints and stateful simulation
 
-Optional `chainGasLimit`, `rpcGasLimit`, `accountGasLimit`, `maxCalldataBytes` and
-`maxSimulationGas` tighten admission when supplied. Missing policy remains explicit in
-`limits.unknownExecutionConstraints`/`unknownConstraints`; it does not reject an otherwise
-proved exact sequence or invent a provider/account cap. No policy service is required.
+Optional `chainGasLimit`, `rpcGasLimit`, `accountGasLimit` and `maxCalldataBytes`
+tighten admission. `maxSimulationGas` sets the aggregate used-gas proof-window
+budget (default 50M on 4663, unknown on other chains). Missing policy stays explicit
+in `limits.unknownExecutionConstraints`/`unknownConstraints`; no policy service is required.
 A `LifecycleLimitSource` callback receives the canonical chain/account/core/block context.
 Any supplied provenance must match it; stale/mismatched/malformed facts or a failed supplied
 resolver reject rather than disappearing into optional uncertainty. Gas caps are positive
@@ -897,7 +939,9 @@ exact uint64 `bigint`; calldata is a positive safe integer byte count.
 Reviewed gas envelopes are positive uint64 too; zero-metering observations cannot admit
 a zero-gas transaction. Headroom calculations retain wide exact bigint intermediates.
 
-Headroom defaults to 1,500 bps, bounded 0–10,000. Generic EVM admission uses the pinned
+Headroom defaults to 1,500 bps, bounded 0–10,000; it clamps to current legal ceilings
+instead of rejecting a fitting measured requirement. HMM V2 adds the forwarding
+target documented above once on atomic/activation. Generic EVM admission uses the pinned
 bounded header and supplied total-envelope restrictions plus actual validated RPC proof.
 It reports an absent independent per-transaction cutoff honestly, without importing a
 universal Ethereum cutoff. `executionGasCeiling` and `transactionGasCeiling` are equal on
@@ -910,8 +954,8 @@ carries that successfully replayed ceiling, never a smaller unproved envelope.
 Replay source, HTTP and malformed-response failures remain provisional with
 `executionProof: "unavailable"` and do not retry economic execution. `AbortError`
 propagates unchanged, including cancellation during supplied policy and Nitro getter
-reads. A recognized execution refusal may discover at most one genuinely larger
-validated envelope within the same legal compute/total limits. Without returned
+reads. Only explicit genuine native out-of-gas evidence may discover at most one
+larger validated envelope within the same legal compute/total limits. Without returned
 failing-call evidence, `failedTransactionId` stays absent; an opaque RPC error does
 not invent a failing transaction or authorize preparation partitioning.
 Returned failures retain the actual exact-replay prefix and its first failing
@@ -949,10 +993,10 @@ The buffered compute-discovery envelope plus buffered poster budget is carried i
 exact validated replay; an approximate poster quote is never subtracted from total
 gas use to certify exact compute fit.
 Measurement waits for successful capability and candidate-specific poster evidence,
-then uses the legal complete compute-plus-poster envelope. Near-cap gas consumption
-does not diagnose OOG, constructor failure or collision. Unsupported/transport
-evidence remains unavailable, and only a recognized execution-envelope refusal
-can trigger bounded envelope discovery.
+then uses the legal complete compute-plus-poster envelope. A packed preparation
+failure consuming at least 95% may invalidate its cost estimate without claiming
+its selector diagnoses OOG. Unsupported/transport evidence remains unavailable,
+except an observed aggregate-budget exhaustion can preserve a successful prefix.
 
 A separate pinned validated simulation probes all three ArbOS/version/getter values
 against the canonical observations. Only that isolated capability probe temporarily
@@ -975,13 +1019,13 @@ does not manufacture an all-in estimate. All observations and limits refresh for
 For initial construction, the exact legacy gas-price envelope is the greater of
 the fresh RPC recommendation and twice the pinned base fee. This avoids
 underpriced submission when `eth_gasPrice` lags the block base fee. Reviewed
-envelopes retain their exact gas/price only after fresh full-sequence measurement,
-native validated replay, current minimum headroom and affordability checks.
+envelopes retain exact gas/price through direct immediate native validated replay
+and immediate affordability, without repeating measurement or applying new padding.
 The held price need not equal a new recommendation or twice the current base fee;
 natural child fees and the actual submission estimate must accept it. Replay,
 affordability and submission use that same price, without a base-fee override.
-A known aggregate budget whose legal minimum already exceeds its ceiling refuses
-before capability probes or poster work; equality is allowed. A definitive returned
+An aggregate budget selects the longest fitting estimated prefix; only when even
+the immediate estimate does not fit is no proof possible. A definitive returned
 failure from the final exact replay skips a later payer-balance lookup, while
 retaining fee/estimate validation and final canonical checks. Successful replay
 still requires current actual-balance affordability.
@@ -1013,14 +1057,15 @@ Simulation and `next.admission` carry flat, independent proof outcomes:
 
 | Field | Values | Scope |
 | --- | --- | --- |
-| `executionProof` | `"proved"`, `"failed"`, `"unavailable"` | Complete stateful exact-envelope execution and postconditions, never permissive measurement alone. |
+| `executionProof` | `"proved"`, `"failed"`, `"unavailable"` | Stateful exact-envelope execution/postconditions for the proven prefix (or the immediate reviewed step), never measurement alone or an unproved suffix. |
 | `protocolFit` | `"proved"`, `"failed"`, `"unknown"` | Applicable proven protocol and known tightening restrictions. Missing optional policy remains separately disclosed. |
 | `transportPreflight` | `"not-requested"`, `"passed"`, `"failed"` | Immediate exact next-transaction acceptance estimate on the supplied submission RPC. |
 
-`admitted` means the current exact sequence is proved to fit and affordable; it is
-not guaranteed wallet submission or future execution. Admission reuses simulation
-`blockNumber`, `blockHash`, `account`, `chainId` and `limits`. Plans never preflight
-future dependent transactions against state that does not exist.
+`admitted` means the proven prefix fits and is affordable, not that deferred
+transactions have executed or that eventual activation is guaranteed. Always
+inspect `simulation.deferredTransactionIds`. Admission reuses `blockNumber`,
+`blockHash`, `account`, `chainId` and `limits`; signing uses only fresh build-next
+admission. Plans never preflight future steps independently against nonexistent state.
 
 ```ts
 const planned = await planLaunch({ client, account: plan.creator, plan, mode: "atomic" });

package/examples/.env.example

@@ -35,3 +35,7 @@ NFT_BASE_URI=
 # EXAMPLE_ACCOUNT_GAS_CAP=
 # EXAMPLE_MAX_CALLDATA_BYTES=
 # EXAMPLE_HEADROOM_BPS=1500
+#
+# Robinhood aggregate simulation gas-used budget defaults to 50M. Override only for
+# a provider supporting that budget; buy-output calibration needs activation coverage.
+# EXAMPLE_SIMULATION_GAS_CAP=100000000

package/examples/README.md

@@ -1,8 +1,8 @@
 # Examples
 
-The launch examples use the public `@black-market/sdk` 0.9.0 package and viem.
+The launch examples use the public `@black-market/sdk` 0.11.0 package and viem.
 Build this checkout before running its examples; in a consumer project install
-`@black-market/sdk@0.8.0` or later for the `positionGaps` and recovery APIs.
+`@black-market/sdk@0.11.0` for current gas packing and proof-coverage semantics.
 The default chain-4663 launch cases retain
 the October8 mined fixed pool-bound V4 config6/V2 and canonical Abyss config1 deployment.
 The SDK additionally knows the October11 zero-author-royalty Dynamic Fee Hook;
@@ -73,6 +73,18 @@ generic EVM, not as a Nitro metering substitute. Unsigned review reports
 RPC to build-next. See the
 [lifecycle guide](../docs/launch-lifecycle.md#execution-constraints-and-stateful-simulation).
 
+Robinhood defaults to a 50M aggregate simulation gas-used budget. Inspect
+`simulation.deferredTransactionIds`: admitted/proved means the proven prefix,
+not every future transaction or eventual activation. Deferred commands have no
+gas/price/estimate/admission; obtain each fresh immediate envelope through
+`buildNextTransaction` after canonical progress advances. Reviewed envelopes are
+replayed directly, without measuring/replaying the suffix again. The saved-plan
+CLI prints proof coverage and never signs. Override `limits.maxSimulationGas` only
+for a provider that supports the selected budget. Examples requiring actual
+activation outputs for `buySlippageBps` or economic review refuse if activation is
+deferred; use a suitably higher-budget provider rather than inventing buy outputs.
+
+
 For a real new graph, create the saved plan using `readLifecycleProfiles` with its
 explicit chain/core and admitted pool-bound config6 profile. Supply that graph's RPC
 to `launch.ts`; do not substitute the historical known preset. Applications may use
@@ -381,6 +393,13 @@ to tighten the complete transaction envelope: `EXAMPLE_CHAIN_GAS_CAP`,
 restrictions, not invented provider/account assurances or admission bypasses.
 Poster allocation is already inside Nitro gas/affordability and is not charged twice.
 
+Robinhood's separate aggregate simulation gas-used budget defaults to **50M**.
+`EXAMPLE_SIMULATION_GAS_CAP` overrides that budget (positive decimal gas) for
+providers supporting more or less. It does not change per-transaction compute
+capacity. Multi-step examples requiring full activation outputs for buy protection
+and economic review need a provider/budget covering activation, or refuse before
+signing; do not raise the setting beyond the provider's actual supported budget.
+
 ### Evidence and failure recovery
 
 Each dry run or broadcast automatically creates `launch-results/<timestamp-case-random>/`;

package/examples/launch-example-support.ts

@@ -540,6 +540,7 @@ export async function readExampleConfiguration(sdk, redactor, env = process.env)
       chainTransactionGasLimit: gasCap("EXAMPLE_CHAIN_GAS_CAP"),
       rpcTransactionGasLimit: gasCap("EXAMPLE_RPC_GAS_CAP"),
       accountTransactionGasLimit: gasCap("EXAMPLE_ACCOUNT_GAS_CAP"),
+      rpcTotalSimulationGasLimit: gasCap("EXAMPLE_SIMULATION_GAS_CAP"),
       maxCalldataBytes: integer("EXAMPLE_MAX_CALLDATA_BYTES", undefined, 1, Number.MAX_SAFE_INTEGER),
       headroomBps: integer("EXAMPLE_HEADROOM_BPS", 1500, 0, 10000),
       provenance: { scope: "user-ceilings", note: "Optional local tightening restrictions, not verified provider or account limits" },

package/examples/launch-example.ts

@@ -477,6 +477,7 @@ function limitSource(fixture, artifacts) {
       chainGasLimit: policy.chainTransactionGasLimit === undefined ? undefined : BigInt(policy.chainTransactionGasLimit),
       rpcGasLimit: policy.rpcTransactionGasLimit === undefined ? undefined : BigInt(policy.rpcTransactionGasLimit),
       accountGasLimit: policy.accountTransactionGasLimit === undefined ? undefined : BigInt(policy.accountTransactionGasLimit),
+      maxSimulationGas: policy.rpcTotalSimulationGasLimit === undefined ? undefined : BigInt(policy.rpcTotalSimulationGasLimit),
       maxCalldataBytes: policy.maxCalldataBytes, headroomBps: policy.headroomBps,
     };
     artifacts.event("execution-limits", { limits, provenance: policy.provenance });

package/examples/launch.ts

@@ -30,6 +30,7 @@ const options = { client, account: plan.creator, plan, mode, limits, fork, recei
 const planned = args.includes("--mine")
   ? await prepareAndPlanLifecycleLaunch({ ...options, onProgress: ({ marketIndex, attempts }) => console.error("salt mining", marketIndex, attempts.toString()) })
   : await planLaunch(options);
+console.error("Proof coverage:", planned.simulation.steps.length, "steps; deferred:", planned.simulation.deferredTransactionIds);
 const progress = await readLaunchProgress({ client, planned, receipts, confirmations });
 const next = planned.simulation.admitted ? await buildNextTransaction({ client, planned, limits, fork, receipts, confirmations }) : undefined;
 console.log(JSON.stringify({ plan: JSON.parse(serializeLaunchPlan(planned.plan)), mode,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@black-market/sdk",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "TypeScript SDK for Abyss token launches, swaps, and lending.",
   "license": "MIT",
   "repository": {

package/src/lifecycle/calibration.ts

@@ -43,6 +43,7 @@ export function validateBuySlippageBps(bps: number): void {
 export function protectOrderedBuyMinimums(planned: PlannedLaunch, bps: number): LaunchPlanV1 {
   validateBuySlippageBps(bps);
   const { simulation, plan } = planned;
+  if (simulation.deferredTransactionIds.length !== 0) throw new LifecyclePlanningError("LAUNCH_DIAGNOSTIC_FAILED", "Buy slippage calibration requires actual activation outputs beyond the proven RPC prefix; use a higher aggregate simulation cap/provider or preserve already committed minima without buySlippageBps", simulation);
   if (simulation.confidence !== "stateful" || simulation.backend === "unavailable" || simulation.steps.length !== planned.transactions.length || simulation.steps.some((step, index) => !step.success || step.transactionId !== planned.transactions[index]?.id)) throw new LifecyclePlanningError("LAUNCH_DIAGNOSTIC_FAILED", simulation.reason ?? "The complete diagnostic launch sequence did not execute successfully", simulation);
   const activation = planned.transactions.find((transaction) => transaction.kind === "atomic" || transaction.kind === "activate");
   const step = simulation.steps.find((candidate) => candidate.transactionId === activation?.id);

package/src/lifecycle/planner.ts

@@ -10,7 +10,7 @@ import { prepareLaunchSimulation, simulateLaunchTransactions, type NextTransacti
 import { LifecyclePlanningError, type BuildNextTransactionOptions, type CanonicalLaunchProgress, type LifecycleBlock, type LifecycleConstructionProfile, type LifecycleFundingPrerequisite, type LifecyclePoolBoundHookDeployment, type LifecycleProfile, type LifecycleRpcClient, type LifecycleSimulation, type LifecycleTransaction, type PlannedLaunch, type PlanLaunchOptions, type PrepareAndPlanLifecycleLaunchOptions, type SimulateLaunchPlanOptions } from "./types.js";
 import { deriveKnownPoolBoundHookDeployment, protectOrderedBuyMinimums, validateBuySlippageBps } from "./calibration.js";
 import { getKnownLifecycleDeployment, getKnownLifecycleProfile } from "./presets.js";
-import { buildLaunchTransactions } from "./transactions.js";
+import { buildLaunchTransactions, packPreparationBatches } from "./transactions.js";
 import { assertLifecycleMarketAllocation, assertLifecycleSupplyAllocation } from "./allocations.js";
 
 type ValidatedPlanShape = {
@@ -132,11 +132,9 @@ async function readPlanMetadata(client: LifecycleRpcClient, plan: LaunchPlanV1,
   return { profiles, hookDeployments, reasons: live.filter((profile) => !profile.admitted).map((profile) => profile.reason ?? "Unlisted lifecycle profile is unavailable") };
 }
 
-function orderedTransactions(plan: LaunchPlanV1, mode: "atomic" | "staged", progress: CanonicalLaunchProgress, approvals: readonly LifecycleTransaction[], batchSize: number): LifecycleTransaction[] {
+function orderedTransactions(plan: LaunchPlanV1, mode: "atomic" | "staged", progress: CanonicalLaunchProgress, approvals: readonly LifecycleTransaction[], batches: readonly number[]): LifecycleTransaction[] {
   if (progress.canonical.phase === LifecyclePhase.Active || progress.canonical.phase === LifecyclePhase.Cancelled) return [];
   const prepared = progress.canonical.preparedMarkets;
-  const batches: number[] = prepared > 0 ? [prepared] : [];
-  for (let first = prepared; first < plan.markets.length; first += batchSize) batches.push(Math.min(batchSize, plan.markets.length - first));
   const commands = buildLaunchTransactions({ plan, mode, preparationBatches: mode === "staged" ? batches : undefined }).filter((transaction) =>
     (transaction.kind !== "begin" && transaction.kind !== "atomic" || progress.canonical.phase === LifecyclePhase.None) &&
     (transaction.kind !== "prepare" || (transaction.marketStart ?? 0) >= prepared));
@@ -147,7 +145,8 @@ function orderedTransactions(plan: LaunchPlanV1, mode: "atomic" | "staged", prog
 function attachEstimates(transactions: readonly LifecycleTransaction[], simulation: LifecycleSimulation): LifecycleTransaction[] {
   return transactions.map((transaction) => {
     const estimate = simulation.steps.find((step) => step.transactionId === transaction.id)?.estimate;
-    return { ...transaction, calldataBytes: (transaction.data.length - 2) / 2, gas: estimate?.gasLimit, gasPrice: estimate?.gasPrice, estimate, admission: { admitted: simulation.admitted, confidence: simulation.confidence, executionProof: simulation.executionProof, protocolFit: simulation.protocolFit, transportPreflight: simulation.transportPreflight, blockNumber: simulation.blockNumber, blockHash: simulation.blockHash, account: simulation.account, chainId: simulation.chainId, reason: simulation.reason, limits: simulation.limits } };
+    return { ...transaction, calldataBytes: (transaction.data.length - 2) / 2, gas: estimate?.gasLimit, gasPrice: estimate?.gasPrice, estimate,
+      admission: estimate === undefined ? undefined : { admitted: simulation.admitted, confidence: simulation.confidence, executionProof: simulation.executionProof, protocolFit: simulation.protocolFit, transportPreflight: simulation.transportPreflight, blockNumber: simulation.blockNumber, blockHash: simulation.blockHash, account: simulation.account, chainId: simulation.chainId, reason: simulation.reason, limits: simulation.limits } };
   });
 }
 type ReviewedNextTransaction = Pick<LifecycleTransaction, "id" | "kind" | "chainId" | "from" | "to" | "data" | "value"> & NextTransactionEnvelope;
@@ -364,8 +363,8 @@ async function planLaunchWithReads(options: PlanLaunchOptions, client: Lifecycle
     }),
   ]));
   assertPlanningActive(options.signal);
-  const placeholder: LifecycleSimulation = { backend: "unavailable", confidence: "provisional", admitted: false, executionProof: "unavailable", protocolFit: "unknown", transportPreflight: "not-requested", blockNumber: block.number, blockHash: block.hash, account, chainId: plan.chainId, limits, steps: [] };
-  let planned: PlannedLaunch = { ...identity, tokenFactory, tokenFactoryCodeHash, chainId: plan.chainId, transactions: [], totalCalldataBytes: 0, prerequisites: [], profiles: [], hookDeployments: [], progress, simulation: placeholder, preparationBatchSize: plan.markets.length, limits: options.limits,
+  const placeholder: LifecycleSimulation = { backend: "unavailable", confidence: "provisional", admitted: false, executionProof: "unavailable", protocolFit: "unknown", transportPreflight: "not-requested", blockNumber: block.number, blockHash: block.hash, account, chainId: plan.chainId, limits, steps: [], deferredTransactionIds: [] };
+  let planned: PlannedLaunch = { ...identity, tokenFactory, tokenFactoryCodeHash, chainId: plan.chainId, transactions: [], totalCalldataBytes: 0, prerequisites: [], profiles: [], hookDeployments: [], progress, simulation: placeholder, limits: options.limits,
     allowTopologyGaps: options.allowTopologyGaps === true, allowMissingPermanentTail: options.allowMissingPermanentTail === true };
   const receiptsPending = progress.receipts.some((receipt) => receipt.status === "pending" || receipt.status === "unconfirmed");
   if (!progress.confirmationSafe || receiptsPending) {
@@ -393,48 +392,58 @@ async function planLaunchWithReads(options: PlanLaunchOptions, client: Lifecycle
   ]));
   assertFinalPlan(planned, options.signal);
   planned = { ...planned, prerequisites: funding.prerequisites, profiles: metadata.profiles, hookDeployments: metadata.hookDeployments };
-  let preparationBatchSize = plan.markets.length;
-  let transactions = orderedTransactions(plan, mode, progress, funding.approvals, preparationBatchSize);
+  const prepared = progress.canonical.preparedMarkets;
+  const computeCap = limits.transactionGasCeiling !== undefined && limits.transactionGasCeiling < limits.executionGasCeiling ? limits.transactionGasCeiling : limits.executionGasCeiling;
+  let batches: number[] = [];
+  if (mode === "staged") batches = reviewed === undefined ? packPreparationBatches(plan, prepared, computeCap)
+    : [...(prepared > 0 ? [prepared] : []), ...(prepared < plan.markets.length ? [plan.markets.length - prepared] : [])];
+  if (reviewed !== undefined && reviewed.kind === "prepare") {
+    // Canonical progress fixes the start; the exact held calldata fixes its span.
+    // Never rediscover a batch or enlarge a reviewed transaction.
+    const match = /^prepare:(\d+):(\d+)$/.exec(reviewed.id);
+    const start = Number(match?.[1]), count = Number(match?.[2]);
+    if (start !== prepared || !Number.isSafeInteger(count) || count <= 0 || start + count > plan.markets.length) throw new LifecyclePlanningError("REVIEWED_TRANSACTION_MISMATCH", "Reviewed preparation differs from canonical unfinished progress");
+    batches = [...(prepared > 0 ? [prepared] : []), count, ...(start + count < plan.markets.length ? [plan.markets.length - start - count] : [])];
+  }
+  let transactions = orderedTransactions(plan, mode, progress, funding.approvals, batches);
+  if (reviewed !== undefined) {
+    if (!matchesReviewedNextTransaction(transactions[0], reviewed)) throw new LifecyclePlanningError("REVIEWED_TRANSACTION_MISMATCH", "Reviewed transaction differs from the current canonical unfinished next step");
+    transactions = transactions.slice(0, 1);
+  }
   if (metadata.reasons.length > 0) {
     await assertLifecycleBlock(client, block, plan.chainId);
     return { ...planned, simulation: { ...placeholder, confidence: "stateful", reason: metadata.reasons.join("; "), failureCategory: "semantic" }, transactions, totalCalldataBytes: transactions.reduce((total, transaction) => total + (transaction.data.length - 2) / 2, 0) };
   }
-  const preparedSimulation = prepareLaunchSimulation({ client, planned, limits: options.limits, fork: options.fork, signal: options.signal }, block);
+  const preparedSimulation = prepareLaunchSimulation({ client, planned, limits: options.limits, fork: options.fork, signal: options.signal }, block, true, reviewed);
   try {
-    const execute = diagnostic ? preparedSimulation.measure : (candidate: readonly LifecycleTransaction[]) => {
-      if (reviewed === undefined) return preparedSimulation(candidate);
-      if (!matchesReviewedNextTransaction(candidate[0], reviewed)) {
-        // A fresh prepare batch may still require SDK-owned capacity discovery.
-        // Never use held fees for a different step or caller-selected calldata.
-        if (candidate[0]?.kind === "prepare" && reviewed.kind === "prepare") return preparedSimulation(candidate);
-        throw new LifecyclePlanningError("REVIEWED_TRANSACTION_MISMATCH", "Reviewed transaction differs from the current canonical unfinished next step");
-      }
-      return preparedSimulation(candidate, reviewed);
-    };
+    const execute = diagnostic ? preparedSimulation.measure : (candidate: readonly LifecycleTransaction[]) => preparedSimulation(candidate, reviewed);
     let simulation = await execute(transactions);
     assertFinalPlan(planned, options.signal);
     if (mode === "staged") {
-      // Only explicit gas/compute evidence can partition empty preparations.
-      // Byte caps cannot shrink: each prepare still carries the entire plan.
-      while (!simulation.admitted && simulation.failureCategory === "capacity" &&
-        (simulation.capacityConstraint === "compute" || simulation.capacityConstraint === "gas-envelope") &&
-        !(reviewed !== undefined && simulation.capacityConstraint === "gas-envelope" && simulation.failedTransactionId === transactions[0]?.id && matchesReviewedNextTransaction(transactions[0], reviewed)) &&
-        simulation.failedTransactionId?.startsWith("prepare:") && preparationBatchSize > 1) {
-        const failedMarketCount = transactions.find((transaction) => transaction.id === simulation.failedTransactionId)?.marketCount ?? 0;
-        if (failedMarketCount <= 1) break;
-        preparationBatchSize = Math.ceil(failedMarketCount / 2);
-        transactions = orderedTransactions(plan, mode, progress, funding.approvals, preparationBatchSize);
+      // Only a measurement that consumed almost its entire legal envelope
+      // invalidates packing estimates, including gas hidden by CREATE wrappers.
+      while (reviewed === undefined && !simulation.admitted && simulation.failedTransactionId?.startsWith("prepare:")) {
+        const failedIndex = transactions.findIndex((transaction) => transaction.id === simulation.failedTransactionId);
+        const failedTransaction = transactions[failedIndex];
+        const step = simulation.steps.find((candidate) => candidate.transactionId === simulation.failedTransactionId);
+        const count = failedTransaction?.marketCount ?? 0;
+        if (count <= 1 || step?.estimate !== undefined || step?.gasUsed === undefined || step.gasLimit === undefined || step.gasUsed * 100n < step.gasLimit * 95n) break;
+        let first = 0;
+        const batchIndex = batches.findIndex((batch) => { const matches = first === failedTransaction?.marketStart; first += batch; return matches; });
+        const left = Math.ceil(count / 2);
+        batches.splice(batchIndex, 1, left, count - left);
+        transactions = orderedTransactions(plan, mode, progress, funding.approvals, batches);
         simulation = await execute(transactions);
         assertFinalPlan(planned, options.signal);
       }
       if (!simulation.admitted && simulation.failedTransactionId === "activate") simulation = { ...simulation, reason: `${simulation.reason ?? "Final activation failed"}; final mint/lock/all-buys/public-opening is indivisible and will not be partitioned` };
-    } else if (!diagnostic && !simulation.admitted) {
+    } else if (!diagnostic && !simulation.admitted && !(simulation.capacityConstraint === "compute" && simulation.confidence === "provisional")) {
       simulation = { ...simulation, reason: `${simulation.reason ?? "Exact atomic plan is not admitted"}; choose staged explicitly only if empty preparation can be partitioned and complete activation fits` };
     }
     if (reviewed !== undefined && !matchesReviewedNextTransaction(transactions[0], reviewed)) {
       throw new LifecyclePlanningError("REVIEWED_TRANSACTION_MISMATCH", "Reviewed transaction differs from the current canonical unfinished next step");
     }
-    return { ...planned, simulation, preparationBatchSize, transactions: attachEstimates(transactions, simulation), totalCalldataBytes: transactions.reduce((total, transaction) => total + (transaction.data.length - 2) / 2, 0) };
+    return { ...planned, simulation, transactions: attachEstimates(transactions, simulation), totalCalldataBytes: transactions.reduce((total, transaction) => total + (transaction.data.length - 2) / 2, 0) };
   } finally { preparedSimulation.close(); }
 }
 

package/src/lifecycle/presets.ts

@@ -1,13 +1,13 @@
 import type { Address, Hex } from "viem";
 import type {
-  AdapterRegistrationV1, LaunchEnvelopeV2, ProfileRegistrationV1, ProfileTopologyV1,
+  AdapterRegistrationV1, LaunchEnvelopeV2, LaunchPlanV1, ProfileRegistrationV1, ProfileTopologyV1,
 } from "./schema.js";
 import type { LifecycleProfile } from "./types.js";
 import { fixedFeePoolHookV1CreationCode } from "./deployments/fixed-fee-pool-hook-v1-20261008.js";
 import { dynamicFeePoolHookV1CreationCode } from "./deployments/dynamic-fee-pool-hook-v1-20261011.js";
 import { hmmFixedEnvelope, hmmFixedAdapter, hmmFixedRegistration, hmmFixedCreationCode } from "./deployments/hmm-fixed-pool-hook-v2-20261017.js";
 import { hmmDynamicEnvelope, hmmDynamicAdapter, hmmDynamicRegistration, hmmDynamicCreationCode } from "./deployments/hmm-dynamic-pool-hook-v2-20261017.js";
-import { HMM_FIXED_PROFILE_ID, HMM_DYNAMIC_PROFILE_ID } from "./hmm.js";
+import { HMM_FIXED_PROFILE_ID, HMM_DYNAMIC_PROFILE_ID, isHmmProfile } from "./hmm.js";
 
 export enum KnownLifecycleProfile {
   Abyss0 = "abyss-0",
@@ -280,6 +280,20 @@ const dynamicFeePoolPreset: LifecycleProfilePreset = Object.freeze({
   }),
 });
 
+// HMMLiquidityHookV2.sol:98-119 requires ~3.06M available before manager calls,
+// including opening and swaps. Robinhood fork measurements: activation minima
+// 9.60M/15.40M/21.11M for 1/2/3 markets despite used gas 5.85M/11.13M/16.54M.
+// Apply this forwarding target once per activate/atomic envelope, not per callback.
+export const HMM_V2_FORWARDING_BASE_GAS = 4_250_000n;
+export const HMM_V2_FORWARDING_EXTRA_MARKET_GAS = 500_000n;
+export const HMM_V2_PREPARE_GAS = 14_500_000n;
+
+export function hmmV2ForwardingReserve(plan: LaunchPlanV1): bigint {
+  let count = 0;
+  for (const market of plan.markets) if (isHmmProfile(market.profileId)) count += 1;
+  return count === 0 ? 0n : HMM_V2_FORWARDING_BASE_GAS + HMM_V2_FORWARDING_EXTRA_MARKET_GAS * BigInt(count - 1);
+}
+
 function hmmPreset(key: KnownLifecycleProfile, id: Hex, envelope: LaunchEnvelopeV2,
   adapter: AdapterRegistrationV1, registration: ProfileRegistrationV1, creationCode: Hex): LifecycleProfilePreset {
   return Object.freeze({

package/src/lifecycle/rpc.ts

@@ -433,6 +433,7 @@ async function resolveLifecycleLimitsFresh(context: LifecycleLimitContext, sourc
     throw new LifecyclePlanningError("LIMIT_CONTEXT_MISMATCH", "Supplied execution policy provenance differs from the canonical chain/account/core/block context");
   }
   const protocol = context.chainId === 4663n ? "nitro" : "evm";
+  const maxSimulationGas = configuration.maxSimulationGas ?? (context.chainId === 4663n ? 50_000_000n : undefined);
   let arbOSVersion: bigint | undefined; let maxTxComputeGas: bigint | undefined; let maxBlockComputeGas: bigint | undefined;
   if (protocol === "nitro") {
     try {
@@ -464,14 +465,14 @@ async function resolveLifecycleLimitsFresh(context: LifecycleLimitContext, sourc
     ...(configuration.rpcGasLimit === undefined ? ["RPC transaction gas-envelope cap is unknown"] : []),
     ...(configuration.accountGasLimit === undefined ? ["Current account/wallet transaction gas-envelope cap is unknown"] : []),
     ...(configuration.maxCalldataBytes === undefined ? ["Applicable chain/account/RPC calldata byte cap is unknown"] : []),
-    ...(configuration.maxSimulationGas === undefined ? ["RPC aggregate simulation gas cap is unknown"] : []),
+    ...(maxSimulationGas === undefined ? ["RPC aggregate simulation gas cap is unknown"] : []),
   ];
   assertCurrent();
   return {
     configuration, assertCurrent,
     limits: Object.freeze({
       protocol, executionGasCeiling, transactionGasCeiling, arbOSVersion, maxTxComputeGas, maxBlockComputeGas, headroomBps,
-      maxCalldataBytes: configuration.maxCalldataBytes, maxSimulationGas: configuration.maxSimulationGas,
+      maxCalldataBytes: configuration.maxCalldataBytes, maxSimulationGas,
       blockGasLimit: context.block.gasLimit, chainGasLimit: configuration.chainGasLimit,
       rpcGasLimit: configuration.rpcGasLimit, accountGasLimit: configuration.accountGasLimit,
       unknownExecutionConstraints: Object.freeze(unknownExecutionConstraints),