sememe 0.4.25 → 0.4.27

package/README.md

@@ -2,7 +2,7 @@
 
 A local meaning layer for Solana bytes. `sememe pull <program>` fetches and verifies a program interface; every process on the machine can then decode instructions, accounts, and events offline.
 
-**Status: v0.4.25 — published on the npm registry AND as a git tag. Pull/store plus an offline decoder for instructions, Anchor event self-CPIs and account state, verified against real mainnet programs; union decode across a program's on-chain IDL and its adopted first-party published copy (`sememe adopt` + `sememe decode --union`); the fingerprint lockfile ships (`sememe lock` + `sememe verify`); the decode path installs zero runtime dependencies. The ecosystem-wide measured coverage is 88.8% (18,967/21,350 payloads across 6 finalized blocks, 2026-11-13; 96.4% on the curated watchlist, 63.8% outside it; byte-exact re-encode on 93.1% of decoded). The honest limits ride with every number: zero external users so far — publish is not consumption — one machine, no audit.**
+**Status: v0.4.27 — published on the npm registry AND as a git tag. Pull/store plus an offline decoder for instructions, Anchor event self-CPIs and account state, verified against real mainnet programs; union decode across a program's on-chain IDL and its adopted first-party published copy (`sememe adopt` + `sememe decode --union`); the fingerprint lockfile ships (`sememe lock` + `sememe verify`); the decode path installs zero runtime dependencies. The ecosystem-wide measured coverage is 88.8% (18,967/21,350 payloads across 6 finalized blocks, 2026-11-13; 96.4% on the curated watchlist, 63.8% outside it; byte-exact re-encode on 93.1% of decoded). The honest limits ride with every number: zero external users so far — publish is not consumption — one machine, no audit.**
 
 Everything below the fold is what you run. The full measurement and qualification history — every number, artifact, defect found and fixed, and every honest limit — was moved verbatim to [docs/measured-history.md](https://github.com/auroraxo/sememe/blob/main/docs/measured-history.md) on 2026-11-13; nothing was deleted.
 
@@ -56,7 +56,7 @@ Measured on that sample (2026-11-04): 1,000 checked transactions, 6,337 payloads
 ## Install (as a consumer, not a contributor)
 
 ```bash
-npm install github:auroraxo/sememe#v0.4.25   # tagged release; no npm account needed
+npm install github:auroraxo/sememe#v0.4.27   # tagged release; no npm account needed
 ```
 
 ```js
@@ -75,14 +75,14 @@ The **library** refuses the same way: importing `sememe/pull` or `sememe/gap` wi
 **From an install (not a clone), the CLI is `npx sememe …`** — npm exec resolves the package's own `bin` from `node_modules`; the bare command `sememe` is not on your `PATH` after a plain `npm install`, and `node bin/sememe.mjs` works only inside a clone of the repository (both measured 2026-11-05 from a real tarball install). The consumer journey from the install, verbatim:
 
 ```bash
-npm install github:auroraxo/sememe#v0.4.25 @solana/web3.js   # acquisition needs the peer
+npm install github:auroraxo/sememe#v0.4.27 @solana/web3.js   # acquisition needs the peer
 npx sememe pull whirLbMiicVdio4qvUfM5KAg6Ct8VwpYzGff3uctyCc --store ./store
 npx sememe decode whirLbMiicVdio4qvUfM5KAg6Ct8VwpYzGff3uctyCc 2b04ed0b1ac91e62a40d0100000000000100000000000000af331ba8327fbb35b1c4feff00000000010001010000000601 --store ./store
 ```
 
 `./store` is the local content-addressed store the error `no sememe store at ./store: run "sememe pull" first` tells you to create — the `pull` above is that creation step; the vendored programs (System, ComputeBudget, SPL Token, Token-2022, Raydium AMM v4, SPL Associated Token Account) need no store at all: `npx sememe decode-native 11111111111111111111111111111111 <payload>` answers offline from the pinned upstream tables. If you ever point the decoder at a store directory that does not exist yet, the refusal names the fix; `npx sememe` is the form of that fix that runs where you are. Measured 2026-11-05 from the packed tarball of this tree: install (zero deps) → `npx sememe pull` (live mainnet) → `npx sememe decode` (byte-exact, live-pulled object byte-identical to the fixture store object `0b886e37…660f`).
 
-Publishing to the npm registry changed on 2026-11-12: the `sememe` name is now live on registry.npmjs.org (first shipped as 0.4.21; the measured registry install of `sememe@0.4.22` into an empty app decoded the Whirlpool fixture payload `swap_v2`, `roundTripByteExact: true`). `npm install sememe` and `npm install github:auroraxo/sememe#v0.4.25` deliver the same product files from the same code: the files allowlist already ships none of this repository's tests, fixtures or qualification harness (pinned by `test/package.test.mjs`), so the git tag remains the release artifact — `test/package.test.mjs` (the contract above), `tools/e2e-package-consumer.mjs` (a real install into an empty directory) and `test/install-surface.test.mjs` (the shipped README's install commands run verbatim from the packed tarball) keep both channels honest.
+Publishing to the npm registry changed on 2026-11-12: the `sememe` name is now live on registry.npmjs.org (first shipped as 0.4.21; the measured registry install of `sememe@0.4.22` into an empty app decoded the Whirlpool fixture payload `swap_v2`, `roundTripByteExact: true`). `npm install sememe` and `npm install github:auroraxo/sememe#v0.4.27` deliver the same product files from the same code: the files allowlist already ships none of this repository's tests, fixtures or qualification harness (pinned by `test/package.test.mjs`), so the git tag remains the release artifact — `test/package.test.mjs` (the contract above), `tools/e2e-package-consumer.mjs` (a real install into an empty directory) and `test/install-surface.test.mjs` (the shipped README's install commands run verbatim from the packed tarball) keep both channels honest.
 
 ## Working now: pin the answers (`sememe lock` + `sememe verify`, 2026-11-05)
 
@@ -110,6 +110,41 @@ npx sememe verify --store ./store --lock ./sememe.lock
 
 What the lock does NOT do: it is not a freshness check against the chain (the pin says "this is what I answered", not "this is what the program is now"); it does not cover vendored programs (System/ComputeBudget/SPL Token/Token-2022/Raydium AMM v4/SPL Associated Token Account have no receipts, they are pinned from upstream sources instead); and it cannot stop you from re-pulling — it makes every re-pull that changes an answer visible.
 
+## Working now: when the on-chain interface copy is complete but incomplete on the wire (`sememe adopt-hadron`, 2026-11-14)
+
+Most interface gaps are "no interface exists at all" — the ATA, Lighthouse and Manifest cases, closed by a derived wire table or a vendored first-party copy. HADRo (`HADRoNbLovyqhCsocfYQYB7QdfCAAinN9HTePvBCVDQ8`) is the other kind: the on-chain metadata IDL declares **all 38 instructions and every type**, and it is still incomplete **on the wire**. It lacks exactly two argument declarations — `sequence: u64`, last on `setCurve` and `setRiskCurve` — and the wire carries those 8 bytes after the points.
+
+Measured on the 144 committed chain-accepted payloads of those two instructions:
+
+| from the on-chain copy alone | |
+|---|---|
+| decoded | 144/144, 0 refused |
+| payloads ending in unexplained bytes | 144/144 (8 bytes each) |
+| **re-encoding byte-exactly** | **0/144** |
+| refused under `--trailing error` | 144/144 |
+
+So a consumer had no path to byte-exactness on real mainnet traffic, and `--trailing error` refused every one of those payloads outright.
+
+```bash
+npx sememe adopt-hadron --store ./store
+npx sememe decode --union HADRoNbLovyqhCsocfYQYB7QdfCAAinN9HTePvBCVDQ8 <payload> --store ./store
+```
+
+`adopt-hadron` adopts the program's **first-party published copy** (`Hadron-Fi/hadron-tx-verifier`, Apache-2.0 AND MIT) from a sha256-pinned vendored file, hash-checked **before** any write, through the product's own write path. Afterwards the union reproduces **144/144 payloads byte-exactly**, 0 unexplained bytes, 0 refusals under `--trailing error` — and *names* the disagreement with the on-chain copy instead of silently picking one (`verdict: layout_drift`, drift path `sequence`, arbitration basis `byte_evidence_full_roundtrip`).
+
+Neither half of this was sufficient alone, and that was measured rather than argued (`research/hadron-adoption-2026-11-14.json`, four faces over the same 144 payloads):
+
+| face | decoded | refused | byte-exact |
+|---|---|---|---|
+| before the header-count rule + on-chain IDL | 72 | 72 | 0 |
+| before the header-count rule + first-party IDL | 72 | 72 | 0 |
+| after the header-count rule + on-chain IDL | 144 | 0 | 0 |
+| after the header-count rule + first-party IDL | 144 | 0 | **144** |
+
+The second row is the falsifier for "just adopt the source IDL": the first-party copy declares `points` as a Borsh vector too, so on its own it refuses the same 72 payloads. The third row is the falsifier for "the header rule alone is the fix": it stops the refusals but drops the 8-byte tail, so nothing round-trips. Only the composition reproduces every byte.
+
+What it does **not** do: plain `sememe decode` keeps the on-chain receipt as its default answer (measured unchanged on both sides of the adoption — the adopted receipt sorts at slot 0, so it never wins the single-source read), and the receipt's origin stays `declared`: a commit is content-addressed, not signed, and nothing here proves the bytes describe the deployed program. Chain proof stays with the decode — every payload must re-encode byte-exactly or the union refuses. See [docs/measured-history.md](https://github.com/auroraxo/sememe/blob/main/docs/measured-history.md) and [research/hadron-adoption-2026-11-14.json](research/hadron-adoption-2026-11-14.json).
+
 ## Where the numbers come from
 
 Every claim above is pinned by a test and backed by a committed artifact. If you want to know **why** a number is what it is, and what was measured wrong before it was measured right:

package/bin/sememe.mjs

@@ -52,6 +52,18 @@ const usage = `usage:
       (L2TExMFK…, 1,214 payloads in the committed 6-block window) from the
       vendored first-party copy (Jac0xb/lighthouse, MIT), hash-checked against
       its pin BEFORE any write; the receipt's origin stays declared.
+  sememe adopt-hadron [--store <directory>]
+      the measured case where the ON-CHAIN interface copy is complete but
+      incomplete ON THE WIRE: HADRo (HADRoNbLovy…) declares every instruction
+      and type, yet lacks the trailing "sequence: u64" of setCurve and
+      setRiskCurve, so 144 committed chain-accepted payloads decode with 8
+      unexplained trailing bytes and 0 of them re-encode byte-exactly
+      (research/hadron-adoption-2026-11-14.json). This adopts the first-party
+      published copy (Hadron-Fi/hadron-tx-verifier, Apache-2.0 AND MIT) from a
+      sha256-pinned vendored file, hash-checked BEFORE any write. Afterwards
+      "sememe decode --union" reproduces 144/144 payloads byte-exactly and
+      NAMES the disagreement with the on-chain copy (drift path "sequence").
+      Plain "sememe decode" keeps the on-chain receipt as its answer.
   sememe lock [--store <directory>] [--out <file>]
       snapshot the WHOLE store into a sememe.lock document: for every program,
       the exact fingerprint its newest verified receipt answered with, plus
@@ -279,6 +291,23 @@ try {
       path: result.receipt.path,
       receiptPath: result.receipt.receiptPath,
     }, null, 2));
+  } else if (command === 'adopt-hadron') {
+    const store = option('--store', path.join(os.homedir(), '.sememe'));
+    const { adoptHadron } = await import('../src/hadron.mjs');
+    const { adopt: adoptFn } = await import('../src/adopt.mjs');
+    const result = await adoptHadron(store, { adopt: adoptFn });
+    console.log(JSON.stringify({
+      program: result.receipt.program,
+      source: result.receipt.source,
+      origin: result.receipt.origin,
+      originStatus: result.receipt.originStatus,
+      originNote: result.receipt.originNote,
+      fingerprint: result.receipt.fingerprint,
+      instructionCount: result.receipt.instructionCount,
+      path: result.receipt.path,
+      receiptPath: result.receipt.receiptPath,
+      note: 'the on-chain receipt still answers plain "sememe decode"; use "sememe decode --union" to let the two sources arbitrate by bytes',
+    }, null, 2));
   } else if (command === 'decode') {
     if (!program) throw Error('decode needs a program id');
     const payload = args.shift();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sememe",
-  "version": "0.4.25",
+  "version": "0.4.27",
   "description": "Local, fingerprint-verified Solana program interfaces: pull an IDL once, then decode instructions, accounts and events offline. Zero dependencies on the decode path. Ships derived wire tables for System, ComputeBudget, SPL Token, Token-2022 (incl. its token-metadata fallback), Raydium AMM v4 and the SPL Associated Token Account, pinned to upstream Rust.",
   "license": "MIT",
   "type": "module",
@@ -24,6 +24,7 @@
     "./raydium": "./src/raydium.mjs",
     "./ata": "./src/ata.mjs",
     "./lighthouse": "./src/lighthouse.mjs",
+    "./hadron": "./src/hadron.mjs",
     "./gap": "./src/gap.mjs"
   },
   "files": [

package/src/cli-surface.mjs

@@ -100,6 +100,10 @@ export const COMMAND_SPECS = {
     flags: { '--store': 'value' },
     positionals: 0,
   },
+  'adopt-hadron': {
+    flags: { '--store': 'value' },
+    positionals: 0,
+  },
   decode: {
     flags: { '--store': 'value', '--trailing': 'value', '--absent': 'value', '--union': 'boolean' },
     positionals: 2,

package/src/codec.mjs

@@ -365,7 +365,7 @@ function decodeAt(type, cur, ctx, path, depth) {
     // keeps the strict prefix codec byte for byte.
     if (ctx.__countFromHeader && ctx.__countFromHeader.vectorPath === path) {
       const length = ctx.__countFromHeader.count;
-      const elementSize = ctx.__countFromHeader.pointBytes;
+      const elementSize = ctx.__countFromHeader.elementBytes;
       const needed = length * elementSize;
       if (needed > cur.remaining) {
         // The measured count does not fit the remaining bytes: this is NOT a
@@ -1167,7 +1167,7 @@ export function decodeInstructionData(idl, data, { allowTrailing, trailing, abse
         countArg: headerRule.countArg,
         vectorArg: headerRule.vectorArg,
         vectorPath: `${instruction.name}.${headerRule.vectorArg}`,
-        pointBytes: headerRule.pointBytes,
+        elementBytes: headerRule.elementBytes,
         instruction: instruction.name,
       };
     }
@@ -1365,7 +1365,7 @@ export function encodeInstructionData(idl, name, args, { absent } = {}) {
           countArg: headerRule.countArg,
           vectorArg: headerRule.vectorArg,
           vectorPath: `${instruction.name}.${headerRule.vectorArg}`,
-          pointBytes: headerRule.pointBytes,
+          elementBytes: headerRule.elementBytes,
           instruction: instruction.name,
         };
       }

package/src/hadron.mjs

@@ -0,0 +1,228 @@
+// The HADRo acquisition: a pinned, hash-verified first-party published IDL for
+// the ONE program sememe can decode but NOT fully re-encode from the on-chain
+// copy (measured 2026-11-14, HADRoNbLovyqhCsocfYQYB7QdfCAAinN9HTePvBCVDQ8,
+// research/hadron-adoption-2026-11-14.json).
+//
+// THE MEASURED GAP (this is the reason the file exists, not a preference):
+//
+// The on-chain metadata IDL (pulled at slot 468262003) is COMPLETE on
+// instructions and types, but it is missing exactly two argument declarations
+// — `sequence: u64` as the last argument of setCurve and setRiskCurve. The
+// wire carries those 8 bytes after the points, so with the stored copy alone:
+//
+//   144/144 committed chain-accepted payloads decode        (0 refused)
+//   144/144 end with 8 UNEXPLAINED trailing bytes
+//     0/144 round-trip byte-exact                          (the tail is dropped)
+//   144/144 are REFUSED by --trailing error
+//
+// A user who wants byte-exactness has no fix available on that path: the bytes
+// are real, the IDL simply does not declare them. `sememe adopt-hadron` puts
+// the first-party published copy (Hadron-Fi/hadron-tx-verifier, which declares
+// the two `sequence: u64` tails) into the store beside the on-chain receipt, so
+// `sememe decode --union` arbitrates BY BYTES: the published copy then
+// reproduces 144/144 payloads byte-exact with 0 trailing bytes, and the drift
+// against the on-chain copy is reported by NAME (paths: ["sequence"]) instead
+// of silently choosing one source.
+//
+// WHAT THE PIN DOES NOT CLAIM (src/adopt.mjs says this on every surface): the
+// receipt's origin stays `declared` — the vendored bytes are bound to a commit
+// by sha256, but a commit is content-addressed, not signed, and nothing here
+// proves the bytes describe the DEPLOYED program. Chain proof stays with the
+// decode: every payload must re-encode byte-exactly or union refuses.
+//
+// WHAT SHIPPING THE COPY DOES NOT CHANGE: plain `sememe decode` still reads
+// the on-chain receipt (slot 0 sorts before every real slot — the rule
+// src/adopt.mjs measures and pins). Adoption widens what `--union` can
+// arbitrate; it never silently rewrites the default single-source answer.
+
+import { readFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+export const REPO_ROOT = path.resolve(HERE, '..');
+
+export const HADRON_PROGRAM = 'HADRoNbLovyqhCsocfYQYB7QdfCAAinN9HTePvBCVDQ8';
+
+export const HADRON_PIN = {
+  repo: 'Hadron-Fi/hadron-tx-verifier',
+  commit: '0c1bca1d8c9bc2abaa1b3d651d450c814cdd6328',
+  // Dual-licensed: the repo carries LICENSE-APACHE + LICENSE-MIT + NOTICE, all
+  // three vendored beside the IDL so a redistributor of the npm tarball has
+  // the terms and the attribution NOTICE in the same directory as the bytes.
+  license: 'Apache-2.0 AND MIT',
+  // sha256 of the bytes AS PUBLISHED at that commit, read via the GitHub
+  // contents API with `?ref=<commit>` — not from a mutable working tree.
+  files: [
+    {
+      file: 'idl/hadron.json',
+      role: 'first-party published IDL: the copy that declares the two sequence:u64 tails the on-chain metadata IDL lacks',
+      sha256: '219f44fb63729232b3685fbde49a817b0c8321a0203dcca68c88370fbed1279e',
+    },
+    {
+      file: 'LICENSE-APACHE',
+      role: 'Apache-2.0 terms the vendored copy ships under',
+      sha256: 'e4cbaf2699b8d6509727edfae292eabe12249f8a31d4dc978de59e15d12ec717',
+    },
+    {
+      file: 'LICENSE-MIT',
+      role: 'MIT terms the vendored copy ships under',
+      sha256: '81382b018e2877fc1f037cc427ecb62333e653ddd05e6e1ff141b184735c7d92',
+    },
+    {
+      file: 'NOTICE',
+      role: 'attribution NOTICE (fork of multisig-verifier, Squads Labs; Hadron modifications)',
+      sha256: 'e39dc25965a71c43d8e475edf3b123f6028239ba612026065d43a5f124dfc36f',
+    },
+  ],
+  // The FULL provenance string, as documentation. It is 96 characters, so
+  // `sememe adopt`'s own label sanitizer would TRUNCATE it to 64 (that is
+  // where the existing lighthouse origin loses its commit tail and its file
+  // path — a pre-existing shape this module does not copy). The label
+  // actually recorded is hadronOriginLabel() below, which FITS in 64 and
+  // therefore loses nothing.
+  origin: 'github.com/Hadron-Fi/hadron-tx-verifier@0c1bca1d8c9bc2abaa1b3d651d450c814cdd6328:idl/hadron.json',
+};
+
+/** The two arguments this acquisition exists to supply. They are the entire
+ * difference between an IDL that reports the wire's 8-byte tail as unexplained
+ * bytes and one that names it — measured, see research/hadron-adoption-*.json. */
+export const HADRON_MISSING_ARGS = [
+  { instruction: 'setCurve', arg: 'sequence', type: 'u64' },
+  { instruction: 'setRiskCurve', arg: 'sequence', type: 'u64' },
+];
+
+export function vendoredHadronPath(file, root = REPO_ROOT) {
+  return path.join(root, 'vendor', 'hadron', HADRON_PIN.commit, path.basename(file));
+}
+
+export function sha256File(filePath) {
+  return createHash('sha256').update(readFileSync(filePath)).digest('hex');
+}
+
+export class HadronPinError extends Error {
+  constructor(reason, detail) {
+    super(detail ? `${reason}: ${detail}` : reason);
+    this.name = 'HadronPinError';
+    this.reason = reason;
+  }
+}
+
+/**
+ * Read the vendored IDL and verify it against the pin. Every refusal is NAMED
+ * so a caller can tally failure faces without parsing prose.
+ *
+ * Returns { idl, path, sha256, bytes, declaredMissing } on success, where
+ * `declaredMissing` is the list of HADRON_MISSING_ARGS entries this copy
+ * actually declares — the measured reason for adopting it.
+ */
+export function loadVendoredHadron(root = REPO_ROOT, pin = HADRON_PIN) {
+  const pinned = pin.files.find((f) => f.file.endsWith('hadron.json'));
+  const vendoredPath = path.join(root, 'vendor', 'hadron', pin.commit, path.basename(pinned.file));
+  let raw;
+  try {
+    raw = readFileSync(vendoredPath);
+  } catch (error) {
+    throw new HadronPinError(
+      'hadron-vendor-missing',
+      `${vendoredPath} is not present (${error.code ?? error.message})`,
+    );
+  }
+  const now = createHash('sha256').update(raw).digest('hex');
+  if (now !== pinned.sha256) {
+    throw new HadronPinError(
+      'hadron-vendor-hash-mismatch',
+      `pinned ${pinned.sha256}, hashed now ${now} — refusing to adopt bytes that are not the reviewed copy`,
+    );
+  }
+  let idl;
+  try {
+    idl = JSON.parse(raw.toString('utf8'));
+  } catch (error) {
+    throw new HadronPinError('hadron-vendor-unparseable', String(error.message ?? error));
+  }
+  if (!idl || typeof idl !== 'object' || Array.isArray(idl)) {
+    throw new HadronPinError('hadron-vendor-unparseable', 'not an IDL object');
+  }
+  // Address binding: this file claims HADRo by its own `address`, the same
+  // field the on-chain receipt binds. A file declaring another program is
+  // never re-labelled (the rule src/adopt.mjs measures: a declared program
+  // that differs from the receipt's program is a re-labelling, refused).
+  if (idl.address !== HADRON_PROGRAM) {
+    throw new HadronPinError(
+      'hadron-address-disagrees',
+      `vendored file declares ${idl.address ?? 'nothing'}, pin binds ${HADRON_PROGRAM}`,
+    );
+  }
+  if (!Array.isArray(idl.instructions) || idl.instructions.length === 0) {
+    throw new HadronPinError('hadron-no-instructions', 'not an interface copy');
+  }
+  // THE MEASURED REASON FOR SHIPPING THIS FILE: each of the two arguments the
+  // on-chain copy lacks must be present, last, and typed u64. A copy that lost
+  // them would still hash correctly against nothing in particular — the pin
+  // covers BYTES, this check covers the CLAIM those bytes make.
+  const byName = new Map(idl.instructions.map((instruction) => [instruction.name, instruction]));
+  const declaredMissing = [];
+  for (const expected of HADRON_MISSING_ARGS) {
+    const instruction = byName.get(expected.instruction);
+    if (!instruction) {
+      throw new HadronPinError('hadron-instruction-missing', `${expected.instruction} is not in the vendored copy`);
+    }
+    const args = Array.isArray(instruction.args) ? instruction.args : [];
+    const last = args[args.length - 1];
+    if (last?.name === expected.arg && last?.type === expected.type) {
+      declaredMissing.push({ ...expected });
+    }
+    // A copy WITHOUT the argument is still adopted honestly — it just cannot
+    // claim the reason this module exists, so `declaredMissing` stays short
+    // and the adopting caller reports the shortfall instead of the promise.
+  }
+  if (declaredMissing.length !== HADRON_MISSING_ARGS.length) {
+    throw new HadronPinError(
+      'hadron-tail-args-absent',
+      `this copy declares ${declaredMissing.length}/${HADRON_MISSING_ARGS.length} of the sequence:u64 tails `
+      + `the acquisition exists for (${HADRON_MISSING_ARGS.map((a) => `${a.instruction}.${a.arg}`).join(', ')}) `
+      + '— adopting it would promise byte-exactness it cannot deliver',
+    );
+  }
+  return { idl, path: vendoredPath, sha256: now, bytes: raw.length, declaredMissing };
+}
+
+/**
+ * The origin label adopt records.
+ *
+ * `sememe adopt` sanitizes the caller's label to a filename-safe form and
+ * caps it at 64 characters (src/adopt.mjs, `safeLabel`). A label longer than
+ * that is TRUNCATED, silently: the obvious label for this acquisition
+ * (`Hadron-Fi/hadron-tx-verifier@<40-hex commit>:idl/hadron.json`) is 96
+ * characters and comes back as a 64-char prefix that has LOST the tail of the
+ * commit hash and the whole file path — the same thing that already happens
+ * to the 105-character lighthouse origin. A commit truncated to 35 hex
+ * characters is not a commit, so this label drops the file path and the owner
+ * on purpose and keeps the FULL 40-hex commit: 59 characters, recorded whole.
+ * The owner and the file are in HADRON_PIN, beside the sha256 of every
+ * vendored byte — and the commit here is the directory the bytes live in.
+ */
+export function hadronOriginLabel() {
+  return `hadron-tx-verifier@${HADRON_PIN.commit}`;
+}
+
+/**
+ * Adopt the verified first-party copy into a store through the PRODUCT's one
+ * write path (src/adopt.mjs — the same path `sememe adopt` uses).
+ *
+ * Order is the point: the pin is checked FIRST, so a tampered, missing or
+ * tail-less vendored file means NOTHING was written. The receipt's origin
+ * stays `declared`: the pin binds the BYTES to a commit, not the bytes to the
+ * deployed program.
+ */
+export async function adoptHadron(storeDir, { adopt } = {}) {
+  if (typeof adopt !== 'function') throw Error('adoptHadron needs the product write path (src/adopt.mjs)');
+  const loaded = loadVendoredHadron();
+  const receipt = await adopt(HADRON_PROGRAM, loaded.path, storeDir, {
+    source: 'published',
+    origin: hadronOriginLabel(),
+  });
+  return { receipt, loaded };
+}

package/src/wire-layout.mjs

@@ -49,21 +49,25 @@
 // tail after the points is 8 bytes for all 144 (an undeclared field the IDL
 // does not name — reported as trailing, never invented).
 
-const POINT_BYTES = 21;
-
 /**
  * The measured count-from-header table, keyed by program address.
  *
  * Every entry is a program+instruction pair whose wire layout was measured
  * against chain-accepted payloads with a committed artifact; nothing here is
- * inferred from an IDL claim or from a shape match.
+ * inferred from an IDL claim or from a shape match. `elementBytes` is the
+ * measured size of ONE vector element — a property of the element TYPE the
+ * measurement walked, never a global constant: CurvePointInput is 21 bytes
+ * (research/hadro-vec-wire-2026-11-13.json: 144/144 payloads fit n x 21),
+ * SpreadTriggerInput is 66 (research/live-layout-scan-hadro-witness-
+ * 2026-11-14.json: 2/2 chain-accepted live payloads numTriggers=5 x 66 =
+ * 330 body bytes, trailingBytes 0).
  */
 export const COUNT_FROM_HEADER = {
   HADRoNbLovyqhCsocfYQYB7QdfCAAinN9HTePvBCVDQ8: {
-    source: 'research/hadro-vec-wire-2026-11-13.json',
     instructions: {
-      setCurve: { countArg: 'numPoints', vectorArg: 'points' },
-      setRiskCurve: { countArg: 'numPoints', vectorArg: 'points' },
+      setCurve: { countArg: 'numPoints', vectorArg: 'points', elementBytes: 21, source: 'research/hadro-vec-wire-2026-11-13.json' },
+      setRiskCurve: { countArg: 'numPoints', vectorArg: 'points', elementBytes: 21, source: 'research/hadro-vec-wire-2026-11-13.json' },
+      updateSpreadConfig: { countArg: 'numTriggers', vectorArg: 'triggers', elementBytes: 66, source: 'research/live-layout-scan-hadro-witness-2026-11-14.json' },
     },
   },
 };
@@ -79,10 +83,10 @@ export const COUNT_FROM_HEADER = {
  *
  * @param {object} idl  the IDL being decoded (must carry `address`)
  * @param {string} name  the instruction name being decoded/encoded
- * @returns {{countArg: string, vectorArg: string, pointBytes: number}|null}
+ * @returns {{countArg: string, vectorArg: string, elementBytes: number, source: string}|null}
  */
 export function countFromHeader(idl, name) {
   const entry = COUNT_FROM_HEADER[idl?.address]?.instructions?.[name];
   if (!entry) return null;
-  return { ...entry, pointBytes: POINT_BYTES };
+  return { ...entry };
 }

package/vendor/hadron/0c1bca1d8c9bc2abaa1b3d651d450c814cdd6328/LICENSE-APACHE

@@ -0,0 +1,190 @@
+                              Apache License
+                        Version 2.0, January 2004
+                     http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+   "License" shall mean the terms and conditions for use, reproduction,
+   and distribution as defined by Sections 1 through 9 of this document.
+
+   "Licensor" shall mean the copyright owner or entity authorized by
+   the copyright owner that is granting the License.
+
+   "Legal Entity" shall mean the union of the acting entity and all
+   other entities that control, are controlled by, or are under common
+   control with that entity. For the purposes of this definition,
+   "control" means (i) the power, direct or indirect, to cause the
+   direction or management of such entity, whether by contract or
+   otherwise, or (ii) ownership of fifty percent (50%) or more of the
+   outstanding shares, or (iii) beneficial ownership of such entity.
+
+   "You" (or "Your") shall mean an individual or Legal Entity
+   exercising permissions granted by this License.
+
+   "Source" form shall mean the preferred form for making modifications,
+   including but not limited to software source code, documentation
+   source, and configuration files.
+
+   "Object" form shall mean any form resulting from mechanical
+   transformation or translation of a Source form, including but
+   not limited to compiled object code, generated documentation,
+   and conversions to other media types.
+
+   "Work" shall mean the work of authorship, whether in Source or
+   Object form, made available under the License, as indicated by a
+   copyright notice that is included in or attached to the work
+   (an example is provided in the Appendix below).
+
+   "Derivative Works" shall mean any work, whether in Source or Object
+   form, that is based on (or derived from) the Work and for which the
+   editorial revisions, annotations, elaborations, or other modifications
+   represent, as a whole, an original work of authorship. For the purposes
+   of this License, Derivative Works shall not include works that remain
+   separable from, or merely link (or bind by name) to the interfaces of,
+   the Work and Derivative Works thereof.
+
+   "Contribution" shall mean any work of authorship, including
+   the original version of the Work and any modifications or additions
+   to that Work or Derivative Works thereof, that is intentionally
+   submitted to the Licensor for inclusion in the Work by the copyright owner
+   or by an individual or Legal Entity authorized to submit on behalf of
+   the copyright owner. For the purposes of this definition, "submitted"
+   means any form of electronic, verbal, or written communication sent
+   to the Licensor or its representatives, including but not limited to
+   communication on electronic mailing lists, source code control systems,
+   and issue tracking systems that are managed by, or on behalf of, the
+   Licensor for the purpose of discussing and improving the Work, but
+   excluding communication that is conspicuously marked or otherwise
+   designated in writing by the copyright owner as "Not a Contribution."
+
+   "Contributor" shall mean Licensor and any individual or Legal Entity
+   on behalf of whom a Contribution has been received by the Licensor and
+   subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   copyright license to reproduce, prepare Derivative Works of,
+   publicly display, publicly perform, sublicense, and distribute the
+   Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   (except as stated in this section) patent license to make, have made,
+   use, offer to sell, sell, import, and otherwise transfer the Work,
+   where such license applies only to those patent claims licensable
+   by such Contributor that are necessarily infringed by their
+   Contribution(s) alone or by combination of their Contribution(s)
+   with the Work to which such Contribution(s) was submitted. If You
+   institute patent litigation against any entity (including a
+   cross-claim or counterclaim in a lawsuit) alleging that the Work
+   or a Contribution incorporated within the Work constitutes direct
+   or contributory patent infringement, then any patent licenses
+   granted to You under this License for that Work shall terminate
+   as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+   Work or Derivative Works thereof in any medium, with or without
+   modifications, and in Source or Object form, provided that You
+   meet the following conditions:
+
+   (a) You must give any other recipients of the Work or
+       Derivative Works a copy of this License; and
+
+   (b) You must cause any modified files to carry prominent notices
+       stating that You changed the files; and
+
+   (c) You must retain, in the Source form of any Derivative Works
+       that You distribute, all copyright, patent, trademark, and
+       attribution notices from the Source form of the Work,
+       excluding those notices that do not pertain to any part of
+       the Derivative Works; and
+
+   (d) If the Work includes a "NOTICE" text file as part of its
+       distribution, then any Derivative Works that You distribute must
+       include a readable copy of the attribution notices contained
+       within such NOTICE file, excluding any notices that do not
+       pertain to any part of the Derivative Works, in at least one
+       of the following places: within a NOTICE text file distributed
+       as part of the Derivative Works; within the Source form or
+       documentation, if provided along with the Derivative Works; or,
+       within a display generated by the Derivative Works, if and
+       wherever such third-party notices normally appear. The contents
+       of the NOTICE file are for informational purposes only and
+       do not modify the License. You may add Your own attribution
+       notices within Derivative Works that You distribute, alongside
+       or as an addendum to the NOTICE text from the Work, provided
+       that such additional attribution notices cannot be construed
+       as modifying the License.
+
+   You may add Your own copyright statement to Your modifications and
+   may provide additional or different license terms and conditions
+   for use, reproduction, or distribution of Your modifications, or
+   for any such Derivative Works as a whole, provided Your use,
+   reproduction, and distribution of the Work otherwise complies with
+   the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+   any Contribution intentionally submitted for inclusion in the Work
+   by You to the Licensor shall be under the terms and conditions of
+   this License, without any additional terms or conditions.
+   Notwithstanding the above, nothing herein shall supersede or modify
+   the terms of any separate license agreement you may have executed
+   with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade
+   names, trademarks, service marks, or product names of the Licensor,
+   except as required for reasonable and customary use in describing the
+   origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+   agreed to in writing, Licensor provides the Work (and each
+   Contributor provides its Contributions) on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied, including, without limitation, any warranties or conditions
+   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+   PARTICULAR PURPOSE. You are solely responsible for determining the
+   appropriateness of using or redistributing the Work and assume any
+   risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+   whether in tort (including negligence), contract, or otherwise,
+   unless required by applicable law (such as deliberate and grossly
+   negligent acts) or agreed to in writing, shall any Contributor be
+   liable to You for damages, including any direct, indirect, special,
+   incidental, or consequential damages of any character arising as a
+   result of this License or out of the use or inability to use the
+   Work (including but not limited to damages for loss of goodwill,
+   work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses), even if such Contributor
+   has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+   the Work or Derivative Works thereof, You may choose to offer,
+   and charge a fee for, acceptance of support, warranty, indemnity,
+   or other liability obligations and/or rights consistent with this
+   License. However, in accepting such obligations, You may act only
+   on Your own behalf and on Your sole responsibility, not on behalf
+   of any other Contributor, and only if You agree to indemnify,
+   defend, and hold each Contributor harmless for any liability
+   incurred by, or claims asserted against, such Contributor by reason
+   of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+Copyright 2025 Squads Labs, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.