sememe 0.4.21 → 0.4.23

package/README.md

@@ -69,7 +69,7 @@ What this changes about the thesis, stated plainly: sememe's decode path is stro
 
 **HADRo's 195 refusals were NOT source lag — stored discriminators are stored at ANY length (fixed and measured 2026-11-12, `tools/measure-hadro-short-discriminator.mjs` -> `research/hadro-short-discriminator-2026-11-12.json`, pinned by `test/hadro-short-discriminator.test.mjs` 7 tests + `test/hadro-short-discriminator-measurement.test.mjs` 5 tests).** The ecosystem measurement had labelled HADRo (`HADRo…VDQ8`) a "total source-lag face" at 0/195. It was wrong, and the PULS V two-tree measurement (`git archive c304e80` for the pre-fix tree, a byte-identical probe in both) proved why: the program's published IDL stores **38 one-byte instruction discriminators** — a real, chain-accepted wire table (unique values 0x00..0x26) — and `withDerivedDiscriminators` treated only 8-byte arrays as "stored", so every stored byte was OVERWRITTEN with Anchor's 8-byte sighash, against that module's own header rule ("stored discriminators are never changed"). The replaced table matches no payload: pre-fix 0/195 decoded; post-fix **123/195 decode through the product path** (51 full byte-exact, 72 `setCurve` described-exact with reported trailing bytes), and the remaining 72 (`setRiskCurve`) stay **honestly refused and NAMED** — that IDL declares a vector length the wire bytes do not carry. The same `length === 8` assumption in `src/union.mjs`'s rename-evidence map was fixed the same way (stored means any non-empty byte array). The fix is surgical and the measurement pins that: pump.fun (400/842, 249 byte-exact), pfeeU (5/464) and Eternal (227/242 byte-exact) verdicts are BYTE-IDENTICAL between the trees; Eternal's 76 stored 1-byte EVENT discriminators are now preserved too (the event dispatch path reads 8-byte heads, so that preservation changes no decode in this window — stated, not smoothed). Honest limits ride in the artifact; the unit face flips `false -> true` on both instruction and event preservation, and the store face `0/38 -> 38/38`.
 
-The stranger-facing truth this pins down: **the 1,000-transaction decode is one command, offline, and fails loudly.** What it does not prove is that an outside person has run it — and that is now **measured, not asserted** (`tools/measure-foreign-run.mjs` -> `research/foreign-run-2026-11-05.json`): verdict `not-distributed-not-consumed`, i.e. zero non-owner signals on every channel that was read — 0 non-owner stars/forks/issues/PRs on this repo, 0 non-owner comments on the two outbound threads (`step-finance-oss/step-ingestooor#1` and `jup-ag/rfq-webhook-toolkit#96`, both open), 0 foreign-authored threads containing this project's slug. The first external run therefore remains the open gate. The measurement has limits and names them: the broad mention sweep covers 92 of 93 results (GitHub's search index hides one result in every ordering — measured, not assumed), a registry `404` for the bare name `sememe` on npm/crates.io/PyPI means **no install channel is published yet**, never "nobody used it", and the code-index absence is only claimed for the indexed part of GitHub (the sweep's self-reference control passes). Reproduce with `npm test` (includes `test/stranger-decode.test.mjs`, which runs this tool against both fixtures and falsifies it three ways: tampered payload, missing store, and a mutation of the pass/fail logic). The funnel a stranger walks before that first run is measured separately (2026-11-05, `tools/measure-stranger-funnel.mjs` -> `research/stranger-funnel-2026-11-05.json`): a fresh GitHub clone ran both quickstart commands verbatim (1,089 and 6,337 payloads, all decoded byte-exactly, exit 0), the published tag `v0.3.0` installed into an empty app with no npm account, and its entry decoded 1,119/1,119 real payloads byte-exactly from `node_modules/sememe` — the harness (tools/test/research) does not travel into the install. The quickstart block itself is pinned by `test/quickstart-funnel.test.mjs`, which caught and fixed one defect on 2026-11-05: the documented output line was the pre-2026-11-04 schema (missing `rpcEncoding`, `chainParsedInstructions`, `missingBytes`) — a stranger comparing her terminal to the README saw two different products. The README now documents the line the tool actually prints, and a hand-edited documented line goes red.
+The stranger-facing truth this pins down: **the 1,000-transaction decode is one command, offline, and fails loudly.** What it does not prove is that an outside person has run it — and that is now **measured, not asserted** (`tools/measure-foreign-run.mjs` -> `research/foreign-run-2026-11-05.json`): verdict `not-distributed-not-consumed`, i.e. zero non-owner signals on every channel that was read — 0 non-owner stars/forks/issues/PRs on this repo, 0 non-owner comments on the two outbound threads (`step-finance-oss/step-ingestooor#1` and `jup-ag/rfq-webhook-toolkit#96`, both open), 0 foreign-authored threads containing this project's slug. The first external run therefore remains the open gate. The measurement has limits and names them: the broad mention sweep covers 92 of 93 results (GitHub's search index hides one result in every ordering — measured, not assumed), a registry `404` for the bare name `sememe` on npm/crates.io/PyPI meant **no install channel was published yet** at that time, never "nobody used it" — npm published the name on 2026-11-12 (crates.io/PyPI still have no `sememe`; both are aliasing checks, not consumption evidence), and the code-index absence is only claimed for the indexed part of GitHub (the sweep's self-reference control passes). Reproduce with `npm test` (includes `test/stranger-decode.test.mjs`, which runs this tool against both fixtures and falsifies it three ways: tampered payload, missing store, and a mutation of the pass/fail logic). The funnel a stranger walks before that first run is measured separately (2026-11-05, `tools/measure-stranger-funnel.mjs` -> `research/stranger-funnel-2026-11-05.json`): a fresh GitHub clone ran both quickstart commands verbatim (1,089 and 6,337 payloads, all decoded byte-exactly, exit 0), the published tag `v0.3.0` installed into an empty app with no npm account, and its entry decoded 1,119/1,119 real payloads byte-exactly from `node_modules/sememe` — the harness (tools/test/research) does not travel into the install. The quickstart block itself is pinned by `test/quickstart-funnel.test.mjs`, which caught and fixed one defect on 2026-11-05: the documented output line was the pre-2026-11-04 schema (missing `rpcEncoding`, `chainParsedInstructions`, `missingBytes`) — a stranger comparing her terminal to the README saw two different products. The README now documents the line the tool actually prints, and a hand-edited documented line goes red. Re-measured 2026-11-13 after the registry channel opened (`research/foreign-run-2026-11-12.json`): the registry check reads `npm: found` for the bare name while the verdict stays `not-distributed-not-consumed` — publish is not consumption, and the first external run remains the open gate.
 
 ## Your own transactions: raw RPC responses (the shape you already hold)
 
@@ -132,7 +132,7 @@ sememe is a local, content-addressed schema store with a verification contract:
 ## Install (as a consumer, not a contributor)
 
 ```bash
-npm install github:auroraxo/sememe#v0.4.21   # tagged release; no npm account needed
+npm install github:auroraxo/sememe#v0.4.23   # tagged release; no npm account needed
 ```
 
 ```js
@@ -151,14 +151,14 @@ The **library** refuses the same way: importing `sememe/pull` or `sememe/gap` wi
 **From an install (not a clone), the CLI is `npx sememe …`** — npm exec resolves the package's own `bin` from `node_modules`; the bare command `sememe` is not on your `PATH` after a plain `npm install`, and `node bin/sememe.mjs` works only inside a clone of the repository (both measured 2026-11-05 from a real tarball install). The consumer journey from the install, verbatim:
 
 ```bash
-npm install github:auroraxo/sememe#v0.4.21 @solana/web3.js   # acquisition needs the peer
+npm install github:auroraxo/sememe#v0.4.23 @solana/web3.js   # acquisition needs the peer
 npx sememe pull whirLbMiicVdio4qvUfM5KAg6Ct8VwpYzGff3uctyCc --store ./store
 npx sememe decode whirLbMiicVdio4qvUfM5KAg6Ct8VwpYzGff3uctyCc 2b04ed0b1ac91e62a40d0100000000000100000000000000af331ba8327fbb35b1c4feff00000000010001010000000601 --store ./store
 ```
 
 `./store` is the local content-addressed store the error `no sememe store at ./store: run "sememe pull" first` tells you to create — the `pull` above is that creation step; the vendored programs (System, ComputeBudget, SPL Token, Token-2022, Raydium AMM v4, SPL Associated Token Account) need no store at all: `npx sememe decode-native 11111111111111111111111111111111 <payload>` answers offline from the pinned upstream tables. If you ever point the decoder at a store directory that does not exist yet, the refusal names the fix; `npx sememe` is the form of that fix that runs where you are. Measured 2026-11-05 from the packed tarball of this tree: install (zero deps) → `npx sememe pull` (live mainnet) → `npx sememe decode` (byte-exact, live-pulled object byte-identical to the fixture store object `0b886e37…660f`).
 
-Publishing to the npm registry itself is deliberately not done: the files allowlist already ships none of this repository's tests, fixtures or qualification harness (pinned by `test/package.test.mjs`), and no registry name squatting is part of the plan. The git tag is the release artifact; `test/package.test.mjs` (the contract above), `tools/e2e-package-consumer.mjs` (a real install into an empty directory) and `test/install-surface.test.mjs` (the shipped README's install commands run verbatim from the packed tarball) keep it honest.
+Publishing to the npm registry changed on 2026-11-12: the `sememe` name is now live on registry.npmjs.org (first shipped as 0.4.21; the measured registry install of `sememe@0.4.22` into an empty app decoded the Whirlpool fixture payload `swap_v2`, `roundTripByteExact: true`). `npm install sememe` and `npm install github:auroraxo/sememe#v0.4.23` deliver the same product files from the same code: the files allowlist already ships none of this repository's tests, fixtures or qualification harness (pinned by `test/package.test.mjs`), so the git tag remains the release artifact — `test/package.test.mjs` (the contract above), `tools/e2e-package-consumer.mjs` (a real install into an empty directory) and `test/install-surface.test.mjs` (the shipped README's install commands run verbatim from the packed tarball) keep both channels honest.
 
 ## Working now: pin the answers (`sememe lock` + `sememe verify`, 2026-11-05)
 
@@ -271,7 +271,8 @@ freshness against the chain; `scope: "extra"` tells you *where* the damage
 is, not *who* wrote it; and the reported extra is an unpinned program, so a
 store can still gain a program the lock has never seen (by design — that is
 the minimums rule). No third party has run this; there are 0 external users,
-0 stars, and `npm publish` remains credentials-blocked. The published
+0 stars (`npm publish` was credentials-blocked until 2026-11-12, when the
+registry name shipped — see the Install section). The published
 `v0.4.10` tag keeps this defect (a tag is immutable); `v0.4.11` carries
 the fix.
 
@@ -2570,6 +2571,166 @@ way shank was. What this fix guarantees is that until that happens, the
 interface is refused by name at every boundary and never crashes the codec
 or pretends to be decodable.
 
+## The product SPEAKS the dialect it named: the raw-LE engine is wired (2026-11-12)
+
+PULS X named the refusal ("naming a dialect is not speaking it") and PULS Y
+built the speaker — an engine for exactly the grammar the diabloarb file
+DECLARES (`encoding: "little-endian; u8/u16/u32/u64 unsigned, i64 signed; no
+padding; no length prefixes except the u8 counters named in each header"`):
+u8-tag dispatch, dict `types` with declared fixed sizes, counter-prefixed
+vectors (`Base[n_bases]`, `u8[n_hops]`), one byte-decided optional trailing
+field. 102/102 committed payloads decoded byte-exactly, and the product
+boundary stayed untouched — deliberately: capability first, the wiring with
+the pins it rewrites.
+
+**This pulse is the wiring** (the card's own declared next step):
+
+- `src/codec.mjs` routes every decode/encode of a file OUTSIDE the Anchor
+  shape but INSIDE the engine grammar through `src/rawle.mjs`, before the
+  shape gate. The result carries the codec's own fields (`discriminator` is
+  the dispatch prefix in hex; `dialect: 'raw-le'`), and every engine refusal
+  is translated into `CodecError` — one refusal family at the product
+  boundary, never a `RawLeError` leak, never a crash.
+- `src/dialect.mjs` splits the question "can anything read this file?" from
+  "can the Anchor codec read it?": `unreadableDialectReason`/`assertReadableDialect`
+  pass an engine-readable file and keep the exact named refusal (code
+  `unsupported-idl-dialect`) for everything else; `idlDialect` reports
+  `'raw-le'` for a wired dialect.
+- The store gates (`src/adopt.mjs` write path, `src/store-read.mjs` read
+  path) use the readable-dialect guard: a raw-LE object adopts under its
+  own program id, reads back, and the CLI loop `sememe adopt` → `sememe
+  decode` works end-to-end offline (measured 2/2). Mislabelling under a
+  foreign program id stays refused via `program_id` — the wiring opens the
+  dialect gate, not the re-labelling gate.
+- The derivation (`src/discriminators.mjs`) passes the file WITHOUT filling
+  any Anchor sighash table (the PULS X fill defect stays dead — measured
+  filled {instructions: 0, events: 0}); the union (`src/union.mjs`)
+  decodes through the engine like through any source.
+
+Measured two-tree, byte-identical probe
+([`research/rawle-product-2026-11-12.json`](research/rawle-product-2026-11-12.json),
+pinned in `test/rawle-product-measurement.test.mjs` with a full
+gh-gated re-derivation): prefix tree = the PULS Y engine commit `05e6643`
+(engine present, product refuses — 0/102, store loop closed), this tree =
+102/102 decoded AND 102/102 byte-exact re-encoded at `decodeInstructionData`,
+5/5 product-level refusals as named `CodecError` faces (unknown tag,
+truncated payload, trailing bytes, unknown instruction on encode, missing
+argument on encode), derivation passes with NO table, adopt/read/union open,
+CLI store loop 2/2, Whirlpool control unchanged, a file that defeats BOTH
+engines keeps the exact PULS X named refusal at codec AND union. 24
+falsification counts, all zero. The PULS X measurement
+([`research/dialect-named-refusal-2026-11-12.json`](research/dialect-named-refusal-2026-11-12.json))
+was re-derived in its invariant form: its delta now reads crash → decodes
+through the engine, fill {4,0} → {0,0} — the no-crash, no-fill, no-mislabel
+invariants pinned on every payload. The PULS Y artifact stays the frozen
+pre-wiring baseline; its tool now exits 3 NO VERDICT in a wired tree BY
+DESIGN (stated in the tool header).
+
+**Tests: 1 new pin file** (`test/rawle-product-measurement.test.mjs`, 12
+tests) plus the bent faces in `test/dialect-named-refusal.test.mjs` (D1b),
+`test/rawle-decoder.test.mjs` (G1) and
+`test/dialect-named-refusal-measurement.test.mjs`. Suite 912 → **933: 929
+pass / 4 named network skips / 0 fail**. Product code changed; the pin is
+the next release.
+
+## The wiring SHIPS in v0.4.22 — and the ecosystem number it moves is +102 for the user who adopts, not the shipped store (2026-11-12)
+
+This release carries the raw-LE wiring above to the install channel: the
+pinned tag now contains `src/rawle.mjs` and every wired boundary, so
+`npm install github:auroraxo/sememe#v0.4.22` degrades nobody (Whirlpool,
+shank, name-only anchor controls pin unchanged) and answers the diabloarb
+dialect where v0.4.21 refused it by name.
+
+The wiring also prompted the card's declared coverage re-measurement, and
+the honest answer is TWO-HALVED (`tools/measure-diablo-adoption-coverage.mjs`
+→ `research/diablo-adoption-coverage-2026-11-12.json`, pinned by
+`test/diablo-adoption-coverage.test.mjs`, 9 tests, gh-gated re-derivation
+included):
+
+- **At the shipped store the headline does NOT move.** Re-running the
+  committed 2026-11-11 fixture through the coverage tool on this tree
+  reproduces the committed artifact exactly: **88.5%, DiabLokxis 0 decoded
+  / 102 no-interface.** The wiring changed the codec, not the store, and
+  the diabloarb copy cannot ship inside the store: `cryptodiablo/diabloarb`
+  carries **no license** at the pin `f5005ac4` — live re-checked inside the
+  pin test (GitHub license API 404 at the pin AND at HEAD, repo field
+  null), not narrated. The bytes stay out of the repository and the
+  package; `committedStoreModified: false` (readdir + per-file hash digest
+  before/after).
+- **For the user who adopts, the 102 are real.** ONE `adopt` of the
+  hash-gated first-party copy (canonical fingerprint
+  `d6d4e8aa…` verified before anything runs) through the product's own
+  write path, into a throwaway copy of the committed store, and the SAME
+  report tool answers **102/102 decoded, 0 refused, 102 byte-exact**:
+  headline **88.5% → 89.0%** of measured traffic, outside the watchlist
+  **62.4% → 64.4%**. Every one of the 102 rides the **adopted** evidence
+  column (`decodedVia.adopted +102`; `pulled` moves by exactly zero) — the
+  same class split the pfeeU, manifest and archer measurements keep, so an
+  adoption can never silently inflate the on-chain-pull number.
+
+So "102 jetzt zählbar" was half true: countable **yes** — as adoption-path
+coverage, with a name and a byte-exact check — and **not** as a shipped
+headline. The acquisition gap at that program is a LICENSE gap, not a
+decoder gap: the one thing between the user and those 102 payloads is a
+licensed first-party copy, which is exactly what `sememe adopt` exists to
+carry while origin stays declared.
+
+Suite after this release: **954 tests / 950 pass / 4 named network skips /
+0 fail** (945 → 954: the 9 new pin tests). CI green on `main`
+(43287274405) and on the published tag v0.4.22 (43287274209); the release
+surface re-measured against that tag is clean (newest = latest = pinned,
+0 defects — `research/release-surface-2026-11-12b.json`).
+
+## v0.4.23: struct-internal absent fields decode under the evidence gate — and the registry stays truthful (2026-11-13)
+
+The absent-field policy (`absent: "report"`) only fired at TOP-LEVEL argument
+boundaries, so a payload that ends on the boundary of the LAST FIELD INSIDE a
+struct argument was refused under every policy. Measured on mainnet: Archer's
+legacy Swap form (tag `0f`, 19 bytes) omits `SwapParams.builderFeePpm`
+INSIDE `swapParams` and is chain-executed — witness `5Kpdai4oRG…`, slot
+468261978, `err: null`, instruction bytes byte-identical to the payload
+(`research/archer-legacy-swap-witness-2026-11-12.json`; the pinned IDL's own
+`SwapParams` docs describe the shorter form as supported and read as a 0 fee,
+with the program's own `success` log line). One of the 83 payloads in
+`research/archer-second-source-2026-11-12.json` hit exactly this and v0.4.22
+refused it with `truncated input: need 4 byte(s) at offset 19`.
+
+This release decodes it and re-encodes it byte-exactly: inside a named struct,
+under the same decode-only evidence gate (`ctx.__absentPolicy`), a boundary
+ending mid-struct makes the remaining fields ABSENT, named by their dotted path
+(`swapParams.builderFeePpm`), never invented; cuts INSIDE a field and boundary
+cuts inside vec/array elements still refuse; the strict default policy is
+untouched; `encodeInstructionData` accepts the dotted absent names (trailing
+run per struct). `verifiedShortForm` now matches short (sub-8-byte) shank
+discriminators by prefix — the rule the codec's instruction index already used
+— so the 1-byte Archer tag reaches the chain-verified short-form table. Pinned
+by `test/struct-absent-short-form.test.mjs` (10 tests: the falsification
+ladder is 6 red on the v0.4.22 tree, green here).
+
+The registry channel is live and carries this release with the tag: the
+foreign-run sweep measured `npm: found` for the bare name with the verdict
+still `not-distributed-not-consumed`
+(`research/foreign-run-2026-11-12.json`) — publish is not consumption, and
+the first external run stays the open gate.
+
+Install — both channels ship the same product files:
+
+```bash
+npm install sememe                          # registry
+npm install github:auroraxo/sememe#v0.4.23  # tagged release
+```
+
+Limits, stated plainly: the Archer interface still does not ship inside the
+store (no on-chain IDL; the Apache-2.0 first-party copy stays adopt-only and
+hash-gated — unchanged); enum- and vec-body boundary cuts still refuse until a
+chain witness names them (the rule stays evidence-gated; no speculative wire
+form is accepted); tags <= v0.4.22 keep the truncation refusal (a tag is
+immutable); one owner account, zero external users, no audit.
+
+Suite for this release: **964 tests / 960 pass / 4 named network skips /
+0 fail** (954 → 964: the 10 new pin tests). CI green on `main`
+(43332583023); release surface re-measured after publishing below.
+
 ## The remaining 35 publish-nothing programs, classified against foreign sources (2026-11-04)
 
 With Lighthouse decoded under shank, exactly **35 programs (87 payloads)** remained

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sememe",
-  "version": "0.4.21",
+  "version": "0.4.23",
   "description": "Local, fingerprint-verified Solana program interfaces: pull an IDL once, then decode instructions, accounts and events offline. Zero dependencies on the decode path. Ships derived wire tables for System, ComputeBudget, SPL Token, Token-2022 (incl. its token-metadata fallback), Raydium AMM v4 and the SPL Associated Token Account, pinned to upstream Rust.",
   "license": "MIT",
   "type": "module",

package/src/adopt.mjs

@@ -39,7 +39,7 @@ import path from 'node:path';
 import { canonicalJson } from './canonical.mjs';
 import { writeOnce } from './store-write.mjs';
 import { originDigestOf, receiptDigestOf } from './receipt-digest.mjs';
-import { assertIdlShape, declaredProgram } from './dialect.mjs';
+import { assertIdlShape, assertReadableDialect, declaredProgram } from './dialect.mjs';
 
 const sha256 = (data) => createHash('sha256').update(data).digest('hex');
 
@@ -117,12 +117,13 @@ export async function adopt(programInput, filePath, storeDir, { source = 'publis
     }
     throw Error(`${filePath} declares program ${declared}, not ${program} — refusing to re-label a foreign interface`);
   }
-  // Gate 2 — the dialect gate runs at the store's WRITE path too: an
-  // interface the codec cannot read (measured 2026-11-12: diabloarb's
-  // tag/data dispatch with dict `types`) is refused HERE, not after
-  // adoption when every decode crashes unnamed. Same reason text as the
-  // codec's guard (src/dialect.mjs).
-  assertIdlShape(idl, (reason) => Error(`${filePath}: ${reason}`));
+  // Gate 2 — the dialect gate at the store's WRITE path: a dialect NO
+  // engine of the product can read is refused HERE by name, before
+  // adoption can store an undecodable interface. SINCE THE PULS-Z WIRING
+  // a raw-LE file passes (the codec serves it from src/rawle.mjs),
+  // everything else keeps the named refusal (measured 2026-11-12:
+  // diabloarb's dict `types` was the face of that refusal).
+  assertReadableDialect(idl, (reason) => Error(`${filePath}: ${reason}`));
 
   const json = Buffer.from(canonicalJson(idl) + '\n');
   const fingerprint = sha256(json);

package/src/codec.mjs

@@ -20,7 +20,8 @@
 
 import { encodeBase58, decodeBase58 } from './base58.mjs';
 import { isShankIdl, isShankDiscriminant, shankDiscriminatorBytes, SHANK_LEB128_TYPES } from './shank.mjs';
-import { assertIdlShape } from './dialect.mjs';
+import { assertIdlShape, unsupportedIdlReason } from './dialect.mjs';
+import { rawLeDialectReason, decodeRawLe, encodeRawLe, RawLeError } from './rawle.mjs';
 
 const MAX_DEPTH = 32;
 // Instruction data is bounded by transaction size; a hostile length prefix
@@ -364,8 +365,14 @@ function decodeAt(type, cur, ctx, path, depth) {
       throw new CodecError(`vector length ${length} needs ${length * minimum} byte(s) but ${cur.remaining} remain`, path);
     }
     const out = [];
-    for (let index = 0; index < length; index++) {
-      out.push(decodeAt(type.vec, cur, ctx, `${path}[${index}]`, depth + 1));
+    const insideCollection = ctx.__insideCollection;
+    ctx.__insideCollection = true;
+    try {
+      for (let index = 0; index < length; index++) {
+        out.push(decodeAt(type.vec, cur, ctx, `${path}[${index}]`, depth + 1));
+      }
+    } finally {
+      ctx.__insideCollection = insideCollection;
     }
     return out;
   }
@@ -427,8 +434,40 @@ function decodeAt(type, cur, ctx, path, depth) {
       throw new CodecError('malformed struct field', path);
     }
     const out = {};
-    for (const field of fields) {
-      assign(out, field.name, decodeAt(field.type, cur, ctx, `${path}.${field.name}`, depth + 1), path);
+    for (const [index, field] of fields.entries()) {
+      // The payload ends exactly where this struct's next field would begin.
+      // Under the caller-risk 'report' policy (reached only through
+      // ctx.__absentPolicy — decodeInstructionData sets it, and nothing else
+      // in the codec opts in), the rest of THIS struct is ABSENT, not
+      // truncated: a field boundary is the only place a payload can end and
+      // still carry a complete value for what came before. The marker names
+      // the missing fields by their path RELATIVE TO THE ARGUMENT (e.g.
+      // builderFeePpm inside swapParams), so decodeInstructionData can report
+      // `swapParams.builderFeePpm` and tell a struct-internal absence from a
+      // missing top-level argument. Under the strict default this branch
+      // never engages and the field decode refuses as truncated.
+      if (ctx.__absentPolicy === 'report' && cur.remaining === 0) {
+        if (ctx.__insideCollection) {
+          // A struct inside a vec/array: the wire stopped inside a repeated
+          // element, and the element INDEX is not recoverable from the
+          // bytes. Naming an absence there would be a guess, so it refuses
+          // like a mid-field cut until a witness says what to call it.
+          throw new CodecError(
+            `truncated input: the payload ends inside a repeated struct field (${path})`,
+            path);
+        }
+        const missing = fields.slice(index).map((rest) => rest.name);
+        ctx.__absentCollected?.push(...missing.map((name) => [...(ctx.__absentTrail ?? []), name].join('.')));
+        out.__absentFields = missing;
+        return out;
+      }
+      const trail = ctx.__absentTrail;
+      trail?.push(field.name);
+      try {
+        assign(out, field.name, decodeAt(field.type, cur, ctx, `${path}.${field.name}`, depth + 1), path);
+      } finally {
+        trail?.pop();
+      }
     }
     return out;
   }
@@ -444,6 +483,10 @@ function decodeAt(type, cur, ctx, path, depth) {
     if (!shape) throw new CodecError(`malformed variant ${JSON.stringify(variant.name)}`, path);
     const out = { __kind: variant.name };
     if (shape.kind === 'unit') return out;
+    // Note: a payload cut inside an enum variant's fields refuses even under
+    // the absent:'report' policy — the struct-boundary absence rule covers
+    // struct arguments (the shape every measured witness used), not variant
+    // bodies. Widening it needs its own chain witness first.
     if (shape.kind === 'tuple') {
       out.fields = shape.fields.map((fieldType, position) =>
         decodeAt(fieldType, cur, ctx, `${path}.fields[${position}]`, depth + 1));
@@ -460,14 +503,46 @@ function decodeAt(type, cur, ctx, path, depth) {
 
 function decodeArray(inner, length, cur, ctx, path, depth) {
   const out = [];
-  for (let index = 0; index < length; index++) {
-    out.push(decodeAt(inner, cur, ctx, `${path}[${index}]`, depth + 1));
+  const insideCollection = ctx.__insideCollection;
+  ctx.__insideCollection = true;
+  try {
+    for (let index = 0; index < length; index++) {
+      out.push(decodeAt(inner, cur, ctx, `${path}[${index}]`, depth + 1));
+    }
+  } finally {
+    ctx.__insideCollection = insideCollection;
   }
   return out;
 }
 
 // --- encoder ----------------------------------------------------------------
 
+/**
+ * Struct fields of a type that an absent PATH may descend through. Only
+ * named structs qualify: a dotted absent name like swapParams.builderFeePpm
+ * describes where the wire stopped, and only a named struct's fields can
+ * name that place. Anything else (tuple struct, enum, array, primitive) is a
+ * refusal — inventing an absence inside a shape that cannot name its fields
+ * would be exactly the guesswork the policy exists to avoid.
+ */
+function structFieldsForAbsentPath(type, ctx, path) {
+  let current = type;
+  if (current && typeof current === 'object' && 'defined' in current) {
+    const name = typeof current.defined === 'string' ? current.defined : current.defined?.name;
+    const typedef = ctx.types.get(name);
+    if (!typedef) throw new CodecError(`absent path crosses unknown type ${JSON.stringify(name)}`, path);
+    current = typedef.type;
+  }
+  if (current && typeof current === 'object' && current.kind === 'type' && 'type' in current) {
+    current = current.type;
+  }
+  const fields = structShape(current);
+  if (!fields || !isNamedStructFields(fields)) {
+    throw new CodecError(`absent path crosses a type that is not a named struct`, path);
+  }
+  return fields;
+}
+
 function encodeAt(type, value, ctx, path, depth) {
   if (depth > MAX_DEPTH) throw new CodecError('type nesting too deep (recursive type?)', path);
 
@@ -561,8 +636,31 @@ function encodeAt(type, value, ctx, path, depth) {
     const expected = new Set(fields.map((field) => field.name));
     const unknown = Object.keys(value).filter((key) => !expected.has(key));
     if (unknown.length) throw new CodecError(`unexpected field(s): ${unknown.join(', ')}`, path);
+    // Struct-internal absent fields: encodeInstructionData resolves dotted
+    // absent names (swapParams.builderFeePpm) to the VALUE object that owns
+    // the field and records the omission on ctx. Same rule as the top level:
+    // within this struct only a trailing run may be omitted, every omitted
+    // name must be declared, and what remains must still carry a value —
+    // byte-exactness is the only evidence this encoder offers.
+    const skip = ctx.__absentFields?.get(value);
+    if (skip) {
+      const unknownSkip = [...skip].filter((name) => !expected.has(name));
+      if (unknownSkip.length) {
+        throw new CodecError(`unexpected absent field(s): ${unknownSkip.join(', ')}`, path);
+      }
+      let seenSkip = false;
+      for (const field of fields) {
+        if (skip.has(field.name)) { seenSkip = true; continue; }
+        if (seenSkip) {
+          throw new CodecError(
+            `field ${JSON.stringify(field.name)} follows an absent field — only a trailing run may be omitted`,
+            path);
+        }
+      }
+    }
     const parts = [];
     for (const field of fields) {
+      if (skip?.has(field.name)) continue;
       if (!(field.name in value)) throw new CodecError(`missing field ${JSON.stringify(field.name)}`, path);
       parts.push(encodeAt(field.type, value[field.name], ctx, `${path}.${field.name}`, depth + 1));
     }
@@ -925,6 +1023,43 @@ export function decodeInstructionData(idl, data, { allowTrailing, trailing, abse
     throw new CodecError(`unknown absent policy ${JSON.stringify(absent)}`, null);
   }
   if (!(data instanceof Uint8Array)) throw new CodecError('instruction data must be a Uint8Array/Buffer', null);
+  // The raw little-endian dialect is WIRED at the product boundary (12.11.
+  // PULS Z). Until PULS X the diabloarb interface crashed the codec unnamed
+  // (TypeError over the dict `types`, 102/102 payloads); until this wiring
+  // the same interface was refused by name — honest, but naming a dialect is
+  // not speaking it (PULS Y: the engine decoded 102/102 byte-exactly, and
+  // the card's own next step was this adapter). The branch runs BEFORE the
+  // shape gate: a raw-LE IDL is exactly the shape the dialect gate names as
+  // unsupported, so the engine must answer first. When the bytes defeat the
+  // declared grammar the RawLeError is translated into the codec's error
+  // family — one refusal family at the product boundary, never a RawLeError
+  // leaking past it. The message text stays the engine's own words.
+  if (unsupportedIdlReason(idl) && rawLeDialectReason(idl) === null) {
+    try {
+      const raw = decodeRawLe(idl, data);
+      const { kind, instruction, tag, args, absent, consumed, total, trailing: rawTrailing } = raw;
+      const bytes = data instanceof Uint8Array ? data : Buffer.from(data);
+      return {
+        kind: kind ?? 'instruction',
+        instruction,
+        tag,
+        // The dispatch prefix in hex, like the codec's own `discriminator`
+        // field — here the prefix is the u8 tag the engine dispatched on,
+        // not an Anchor sighash. Consumers that render the prefix (CLI,
+        // src/decode.mjs) therefore see the real wire bytes.
+        discriminator: Buffer.from(data.subarray(0, 1)).toString('hex'),
+        args,
+        absent: absent ?? [],
+        consumed,
+        total,
+        trailing: rawTrailing ?? { count: Math.max(0, bytes.length - consumed), hex: '' },
+        dialect: 'raw-le',
+      };
+    } catch (error) {
+      if (!(error instanceof RawLeError)) throw error;
+      throw new CodecError(error.message, error.path);
+    }
+  }
   const ctx = context(idl);
   const index = instructionIndex(idl);
   const prefixLength = Math.min(8, data.length);
@@ -948,6 +1083,14 @@ export function decodeInstructionData(idl, data, { allowTrailing, trailing, abse
   const args = {};
   const absentArgs = [];
   const declaredArgs = instruction.args ?? [];
+  // Struct-internal absences (the payload ends INSIDE a declared struct
+  // argument, on that struct's own field boundary) surface as a marker the
+  // struct decoder leaves on the decoded value. The struct decoder only
+  // produces that marker under ctx.__absentPolicy === 'report' — every other
+  // entry into the codec leaves these inert.
+  ctx.__absentPolicy = absentPolicy;
+  ctx.__absentCollected = absentArgs;
+  ctx.__absentTrail = [];
   for (const [position, argument] of declaredArgs.entries()) {
     if (!argument || typeof argument.name !== 'string' || !('type' in argument)) {
       throw new CodecError(`instruction ${instruction.name} has a malformed argument`, null);
@@ -962,8 +1105,23 @@ export function decodeInstructionData(idl, data, { allowTrailing, trailing, abse
     }
     // With absent:'error' (default) this falls through to decodeAt, which
     // reports `truncated input` — the behaviour every existing caller pins.
-    assign(args, argument.name, decodeAt(argument.type, cursor, ctx, `${instruction.name}.${argument.name}`, 0), instruction.name);
+    ctx.__absentTrail.push(argument.name);
+    let value;
+    try {
+      value = decodeAt(argument.type, cursor, ctx, `${instruction.name}.${argument.name}`, 0);
+    } finally {
+      ctx.__absentTrail.pop();
+    }
+    // A struct the wire stopped inside carries the `__absentFields` marker;
+    // peel it off so the decoded args never show codec-internal keys. The
+    // dotted names were already collected into absentArgs. The strip is
+    // recursive: a struct nested in a struct carries its own marker.
+    stripAbsentMarkers(value);
+    assign(args, argument.name, value, instruction.name);
   }
+  delete ctx.__absentPolicy;
+  delete ctx.__absentCollected;
+  delete ctx.__absentTrail;
   const trailingCount = cursor.remaining;
   const trailingHex = trailingCount > 0
     ? Buffer.from(data.subarray(cursor.offset)).toString('hex')
@@ -989,6 +1147,26 @@ export function decodeInstructionData(idl, data, { allowTrailing, trailing, abse
   };
 }
 
+/**
+ * Remove the codec-internal `__absentFields` markers from a decoded value.
+ *
+ * The marker is how a struct tells the instruction level "the wire ended on
+ * my field boundary, and THESE fields are the ones it did not carry". It is
+ * bookkeeping, not data: a consumer must never see it inside the decoded
+ * args. Recursive, because a struct nested in a struct carries its own
+ * marker.
+ */
+function stripAbsentMarkers(value) {
+  if (!value || typeof value !== 'object') return value;
+  if (Array.isArray(value)) {
+    for (const item of value) stripAbsentMarkers(item);
+    return value;
+  }
+  delete value.__absentFields;
+  for (const key of Object.keys(value)) stripAbsentMarkers(value[key]);
+  return value;
+}
+
 /**
  * Encode one instruction payload (discriminator + args) using the IDL.
  *
@@ -998,6 +1176,17 @@ export function decodeInstructionData(idl, data, { allowTrailing, trailing, abse
  * layout, and byte-exactness is the only evidence this function offers.
  */
 export function encodeInstructionData(idl, name, args, { absent } = {}) {
+  // Same dialect branch as decodeInstructionData: a raw-LE interface is
+  // served by its engine, byte for byte, and every refusal comes back in
+  // the codec's own error family.
+  if (unsupportedIdlReason(idl) && rawLeDialectReason(idl) === null) {
+    try {
+      return encodeRawLe(idl, name, args, { absent });
+    } catch (error) {
+      if (!(error instanceof RawLeError)) throw error;
+      throw new CodecError(error.message, error.path);
+    }
+  }
   const ctx = context(idl);
   const instruction = instructionByName(idl, name);
   const bytes = discriminatorBytes(instruction) ?? (() => {
@@ -1009,6 +1198,10 @@ export function encodeInstructionData(idl, name, args, { absent } = {}) {
   const known = new Set(declared.map((argument) => argument.name));
   const absentSet = new Set(Array.isArray(absent) ? absent : []);
   for (const fieldName of absentSet) {
+    // A dotted name names a field INSIDE a declared struct argument; it is
+    // validated against that struct further down, where the struct's own
+    // field list is known.
+    if (fieldName.includes('.')) continue;
     if (!known.has(fieldName)) {
       throw new CodecError(`unexpected argument(s) for ${instruction.name}: ${fieldName}`, instruction.name);
     }
@@ -1030,13 +1223,68 @@ export function encodeInstructionData(idl, name, args, { absent } = {}) {
   if (unknown.length) {
     throw new CodecError(`unexpected argument(s) for ${instruction.name}: ${unknown.join(', ')}`, null);
   }
-  const parts = [bytes];
-  for (const argument of declared) {
-    if (absentSet.has(argument.name)) continue;
-    if (!(argument.name in args)) throw new CodecError(`missing argument ${JSON.stringify(argument.name)}`, instruction.name);
-    parts.push(encodeAt(argument.type, args[argument.name], ctx, `${instruction.name}.${argument.name}`, 0));
+  // Struct-internal absent fields: an absent name with a dot names a field
+  // INSIDE a declared struct argument (swapParams.builderFeePpm). Resolve
+  // each dotted path to the value object that owns the field, and record the
+  // omission on the encode context so encodeAt's struct branch skips it —
+  // with the same rules the top level enforces: only a trailing run of that
+  // struct's fields may be omitted, and the value must not carry the field.
+  // The encoder is the inverse of the decoder's struct-boundary marker: the
+  // dotted absent list is exactly what the decode reported.
+  const nestedAbsent = new Map(); // value object -> Set(struct-relative field names)
+  for (const fieldName of absentSet) {
+    if (!fieldName.includes('.')) continue;
+    const parts = fieldName.split('.');
+    if (!known.has(parts[0])) {
+      throw new CodecError(`unexpected argument(s) for ${instruction.name}: ${parts[0]}`, instruction.name);
+    }
+    const ownerName = parts[0];
+    const ownerType = declared.find((argument) => argument.name === ownerName)?.type;
+    // Walk the INTERMEDIATE segments through named structs; the LAST segment
+    // is the omitted field itself, validated against the struct it lives in.
+    let containerType = ownerType;
+    let containerValue = args[ownerName];
+    for (const part of parts.slice(1, -1)) {
+      const fields = structFieldsForAbsentPath(containerType, ctx, fieldName);
+      const nextField = fields.find((field) => field.name === part);
+      if (!nextField) {
+        throw new CodecError(`unexpected absent field(s) for ${instruction.name}: ${fieldName}`, instruction.name);
+      }
+      containerType = nextField.type;
+      if (!containerValue || typeof containerValue !== 'object' || !(part in containerValue)) {
+        throw new CodecError(
+          `absent path ${JSON.stringify(fieldName)} crosses a field the value does not carry`, instruction.name);
+      }
+      containerValue = containerValue[part];
+    }
+    const fields = structFieldsForAbsentPath(containerType, ctx, fieldName);
+    const leaf = parts[parts.length - 1];
+    if (!fields.some((field) => field.name === leaf)) {
+      throw new CodecError(`unexpected absent field(s) for ${instruction.name}: ${fieldName}`, instruction.name);
+    }
+    if (!containerValue || typeof containerValue !== 'object' || Array.isArray(containerValue)) {
+      throw new CodecError(`expected a struct object for ${JSON.stringify(fieldName)}, got ${describe(containerValue)}`, instruction.name);
+    }
+    if (leaf in containerValue) {
+      throw new CodecError(`argument ${JSON.stringify(fieldName)} is both absent and present`, instruction.name);
+    }
+    if (!nestedAbsent.has(containerValue)) nestedAbsent.set(containerValue, new Set());
+    nestedAbsent.get(containerValue).add(leaf);
+  }
+  if (nestedAbsent.size) {
+    ctx.__absentFields = nestedAbsent;
+  }
+  try {
+    const parts = [bytes];
+    for (const argument of declared) {
+      if (absentSet.has(argument.name)) continue;
+      if (!(argument.name in args)) throw new CodecError(`missing argument ${JSON.stringify(argument.name)}`, instruction.name);
+      parts.push(encodeAt(argument.type, args[argument.name], ctx, `${instruction.name}.${argument.name}`, 0));
+    }
+    return Buffer.concat(parts);
+  } finally {
+    delete ctx.__absentFields;
   }
-  return Buffer.concat(parts);
 }
 
 /**

package/src/dialect.mjs

@@ -43,6 +43,7 @@
 // shank take the same paths as before, byte for byte.
 
 import { isShankDiscriminant } from './shank.mjs';
+import { rawLeDialectReason } from './rawle.mjs';
 
 const isPlainObject = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
 
@@ -107,7 +108,12 @@ export function unsupportedIdlReason(idl) {
  * lists.
  */
 export function idlDialect(idl) {
-  if (unsupportedIdlReason(idl)) return 'unsupported';
+  // A raw-LE file is SUPPORTED now (PULS Z wiring) but is not one of the
+  // three Anchor-family dialects this classifier enumerates; it reports
+  // its own name so callers can tell a wired dialect from a refused one.
+  if (unsupportedIdlReason(idl)) {
+    return rawLeDialectReason(idl) === null ? 'raw-le' : 'unsupported';
+  }
   const instructions = idl.instructions;
   if (instructions.length === 0) return 'anchor';
   for (const instruction of instructions) {
@@ -143,3 +149,32 @@ export function assertIdlShape(idl, makeError) {
   }
   throw error;
 }
+
+/**
+ * The refusal reason ONLY when no engine in the product can read the file.
+ * Since 12.11. PULS Z the raw little-endian engine (src/rawle.mjs) is wired
+ * into the codec: an IDL the Anchor codec refuses by SHAPE but the engine
+ * claims grammar for is decodable, so the store write gate, the store read
+ * gate and the discriminator derivation must not refuse it. Every other
+ * unsupported shape keeps the exact named refusal of `unsupportedIdlReason`.
+ * The codec's own dispatch (src/codec.mjs) asks the same two questions in
+ * the same order: is it outside the Anchor shape, and is it inside the
+ * engine grammar?
+ */
+export function unreadableDialectReason(idl) {
+  const reason = unsupportedIdlReason(idl);
+  if (!reason) return null;
+  return rawLeDialectReason(idl) === null ? null : reason;
+}
+
+/** Like assertIdlShape, but raw-LE-readable files pass — the engine speaks
+ * them now (PULS Z). Same named refusal and same error code otherwise. */
+export function assertReadableDialect(idl, makeError) {
+  const reason = unreadableDialectReason(idl);
+  if (!reason) return;
+  const error = makeError(reason);
+  if (error && typeof error === 'object') {
+    error.code = UNSUPPORTED_DIALECT_CODE;
+  }
+  throw error;
+}

package/src/discriminators.mjs

@@ -28,7 +28,7 @@
 
 import { createHash } from 'node:crypto';
 import { isShankDiscriminant } from './shank.mjs';
-import { unsupportedIdlReason } from './dialect.mjs';
+import { unreadableDialectReason, idlDialect } from './dialect.mjs';
 
 const sha256 = (text) => createHash('sha256').update(text).digest();
 
@@ -119,14 +119,29 @@ export function verifyDerivedDiscriminators(idl) {
  * @returns {{ idl: object, filled: { instructions: number, events: number }, conflicts: object[] }}
  */
 export function withDerivedDiscriminators(idl) {
-  // A dialect the codec cannot read gets NO derived table at all. Measured
-  // 2026-11-12 on the diabloarb interface: the derivation filled all four
-  // tag-dispatch instructions with Anchor sighashes that match no wire — a
-  // table that looks authoritative and decodes nothing. The refusal is named
-  // (see src/dialect.mjs) and identical to the codec's own.
-  const refusal = unsupportedIdlReason(idl);
+  // A dialect NO engine in the product can read gets NO derived table at
+  // all. Measured 2026-11-12 on the diabloarb interface: the derivation
+  // filled all four tag-dispatch instructions with Anchor sighashes that
+  // match no wire — a table that looks authoritative and decodes nothing.
+  // The refusal is named (see src/dialect.mjs) and identical to the
+  // codec's own. SINCE THE PULS-Z WIRING the raw little-endian engine is
+  // a product engine: a raw-LE interface carries its own tag dispatch (a
+  // u8 `tag`, not a sighash) and passes this gate to the codec, which
+  // serves it from src/rawle.mjs — no Anchor table is derived for it and
+  // none is needed.
+  const refusal = unreadableDialectReason(idl);
   if (refusal) throw new Error(refusal);
   const copy = structuredClone(idl);
+  // A raw-LE file (PULS Z wiring) dispatches on the u8 tag its own file
+  // declares — Anchor sighash derivation for it is the measured PULS X
+  // defect one gate change later: filled {instructions: 4, events: 0}, a
+  // table that looks authoritative and matches no wire byte. The honest
+  // table for this dialect is NO derived table, and the codec serves the
+  // file from src/rawle.mjs. The file still passes the gate (an engine
+  // reads it); only the Anchor filling is withheld.
+  if (idlDialect(idl) === 'raw-le') {
+    return { idl: copy, filled: { instructions: 0, events: 0 }, conflicts: [] };
+  }
   let instructions = 0;
   let events = 0;
   const conflicts = [];

package/src/rawle.mjs

@@ -42,15 +42,19 @@
 //     A remainder that is neither exactly the option size nor zero is a
 //     named refusal (trailing bytes the layout does not explain).
 //
-// NOT WIRED INTO THE PRODUCT. No call site in codec/union/adopt/store-read
-// or the CLI routes through this engine yet — PULS X's named refusal stays
-// the product's answer at every boundary, byte for byte, and the dialect
-// gate is untouched. That is deliberate: making support the product answer
-// changes 19 pinned faces of the PULS X measurement (its artifacts and
-// tools assert the refusal of THIS interface), and the release it belongs
-// to must state the change. The engine + measurement first, the wiring
-// with the pins it rewrites — this is the same order every pulse in this
-// repo has worked in.
+// WIRED INTO THE PRODUCT SINCE PULS Z (2026-11-12): src/codec.mjs routes
+// every decode/encode of a file OUTSIDE the Anchor shape but INSIDE this
+// grammar through this engine — instruction decode/encode, the union
+// probe, store adopt/read, and the discriminator derivation gate (an
+// engine-readable file passes it; no Anchor table is derived for it).
+// RawLeError is translated into CodecError at the boundary, so the
+// product keeps ONE refusal family. Everything else — every anchor/shank/
+// name-only file — takes the exact same codec paths as before, byte for
+// byte, and files no engine can read keep PULS X's named refusal.
+// The face this wiring turns: diabloarb's 102 sample payloads, refused
+// by name until now, decode byte-exactly through the product entry. The
+// pins it bends are the PULS X refusal faces for THIS interface, and the
+// measurement that proves them is tools/measure-rawle-product.mjs.
 //
 // Byte-exactness note: decoded integers come back as Number (<= 4 bytes)
 // or BigInt (8 bytes), exactly like src/codec.mjs's own convention, and

package/src/short-forms.mjs

@@ -114,23 +114,51 @@ const VERIFIED_SHORT_FORMS = [
     absent: ['is_cashback_enabled', 'creator_fee_bps', 'is_holder_reward'],
     witnesses: 1,
   },
+  // --- 2026-11-12: the first short form whose missing field sits INSIDE a
+  // struct argument (research/archer-legacy-swap-witness-2026-11-12.json).
+  // Every form above ends at a TOP-LEVEL argument boundary; this one ends on
+  // the boundary of the LAST field inside `swapParams`, so the absent name
+  // is dotted (`swapParams.builderFeePpm`) and the codec's struct-boundary
+  // rule is what makes it decodable. Evidence: a Swap executed at slot
+  // 468261978 with err:null whose instruction bytes are byte-identical to
+  // the 19-byte payload (checked against the RPC witness twice: `json`
+  // encoding base58 -> 0f430000000000000000000000000000000100), the Archer
+  // CPI's own `success` line, and the pinned IDL's SwapParams docs which
+  // describe the shorter legacy payload as a supported form read as a 0 fee.
+  {
+    program: 'Archer8kgiavM61GyusMzaaS2ft5sALtNsD1HxkUPMhy',
+    discriminator: '0f',
+    bytes: 19,
+    instruction: 'Swap',
+    absent: ['swapParams.builderFeePpm'],
+    witnesses: 1,
+    missingFieldInsideStruct: true,
+  },
 ];
 
 export const SHORT_FORM_SOURCE =
   'research/short-form-wire-forms-2026-11-03.json + research/short-form-wire-forms-2026-11-04.json '
-  + '(chain witnesses: err:null, byte-identical payload, matching program log line)';
+  + '(chain witnesses: err:null, byte-identical payload, matching program log line) '
+  + 'research/archer-legacy-swap-witness-2026-11-12.json (chain witness: err:null, byte-identical payload)';
 
 export const VERIFIED = VERIFIED_SHORT_FORMS;
 export { VERIFIED_SHORT_FORMS };
 
 /** Look up a payload in the chain-verified short-form table; null when absent. */
 export function verifiedShortForm(program, data) {
+  // Struct-internal short forms may carry a discriminator SHORTER than 8
+  // bytes (measured: Archer's shank tag, 1 byte). The old `data.length < 8`
+  // guard refused any lookup that could not yield such a match: a 19-byte
+  // payload with a 1-byte tag reaches the table fine once the prefix is
+  // clipped to min(8, len) — exactly the rule the codec's instruction index
+  // already uses for short stored discriminators.
   if (!program || !(data instanceof Uint8Array)) return null;
-  if (data.length < 8) return null;
-  const discriminator = Buffer.from(data.subarray(0, 8)).toString('hex');
+  if (data.length === 0) return null;
+  const prefixLength = Math.min(8, data.length);
+  const discriminator = Buffer.from(data.subarray(0, prefixLength)).toString('hex');
   return VERIFIED_SHORT_FORMS.find((entry) =>
     entry.program === program
-    && entry.discriminator === discriminator
+    && discriminator.startsWith(entry.discriminator)
     && entry.bytes === data.length) ?? null;
 }
 

package/src/store-read.mjs

@@ -33,7 +33,7 @@ import { canonicalJson } from './canonical.mjs';
 import { compareReceiptNames } from './receipt-order.mjs';
 import { classifyReceiptFiles, isReceiptFile } from './receipt-name.mjs';
 import { receiptIntegrity } from './receipt-digest.mjs';
-import { assertIdlShape, declaredProgram } from './dialect.mjs';
+import { assertIdlShape, assertReadableDialect, declaredProgram } from './dialect.mjs';
 
 export { canonicalJson } from './canonical.mjs';
 
@@ -80,11 +80,14 @@ export async function readVerified(storeDir, program, receiptName) {
   }
   if (!Array.isArray(idl.instructions)) throw Error(`stored object for ${program} has no instructions`);
   // Same two checks as the write path (src/adopt.mjs), applied on every
-  // read: a dialect the codec cannot read is refused by NAME before any
-  // decode can crash unnamed, and a declared program that differs from the
-  // receipt's program is a re-labelling no matter which field carries the
-  // declaration (`address`, `metadata.address` or `program_id`).
-  assertIdlShape(idl, (reason) => {
+  // read: a dialect NO engine of the product can read is refused by NAME
+  // before any decode can crash unnamed, and a declared program that
+  // differs from the receipt's program is a re-labelling no matter which
+  // field carries the declaration (`address`, `metadata.address` or
+  // `program_id`). Since the PULS-Z wiring a stored raw-LE object reads
+  // through the engine (src/rawle.mjs) — a store that refused it by name
+  // now decodes instead, which is the point of the wiring.
+  assertReadableDialect(idl, (reason) => {
     const error = Error(`stored object ${fingerprint} for ${program}: ${reason}`);
     error.code = 'unsupported-idl-dialect';
     return error;