fix(spec): economics refuses, never throws, on a number the canonical form cannot write (D5, #359)

[LamaSu]

Economics refuses a number the canonical form cannot write, and never throws on one. This answers the semantic conflict between #359 (evidence's D5) and the merged #360. It works in either order with #359 and #566, and #359 merges after it (board v3.461, row N15).

The problem

Under D5 (#359, evidence profile v1 §1), canonicalize refuses two kinds of number: one that is not finite, and one whose magnitude is 2^53 or more. Hashing a body that holds one throws. Three economics paths hashed their input before checking it.

#359's CI. #359's red build-and-test (run 37157738930, job 111304576433) fails only economics-review.test.ts, in three "clean-room round 3b" tests. #566 fixes R8 only. Locally, master cd9d8770 + #359 725635b3 + #566 f1a0d6ff still fails those three.

Product. These were traced on master + #359 + #566 and compared with master.

compileEconomics threw NonCanonicalValueError out of the compiler. Each schedule in options.schedules is hashed inside the options check (compile.ts:89), before rule 5 runs. Each input below was a refusal or compiled before D5:

Input	Before D5	Under D5
thresholdCents 2^53	SCHEMA_INVALID	throws
scale 1e16	compiles	throws
scale 2^53	compiles	throws
decayPerSecond 1e21	RATE_UNVERIFIED	throws
scale Infinity	SCHEMA_INVALID	throws

clausesFromCompositionManifest threw because it hashes the manifest before any check:

• groupBps 2^53 was GROUP_WEIGHTS_INVALID before D5;
• an unknown field holding 1e21 was accepted before D5.

splitsFromTrainingManifest threw because the schema leaves dataPointCount unbounded: 2^53 was accepted before D5. These adapters are called from contracts' licensing-engine.ts and payouts.ts.

Not affected. The agreement, license and kit hashes are safe: every economics field is required and safe-bounded, with no optional members. bind.ts parses server facts before it canonicalizes them. The gateway's publish route runs rule 5 and then a guarded hash, so it answers 400. The dashboard's publish page hashes inside try blocks.

The fix

Every change holds with or without D5 in canonicalize.

• Rule 5 (assertScheduleIsWellFormed): scale and decayPerSecond must be finite and have magnitude at most 2^53−1, which is D5's number domain. A larger real is an integer outside the safe range, so it has no canonical form. The registry's publish route uses the same check.
• Compiler: the schedule hash in the options check is guarded. A body with no canonical form is a SCHEMA_INVALID options refusal.
• Adapters: numberWithoutCanonicalForm (economics/input.ts) refuses such a manifest before it is hashed (MANIFEST_INVALID), and the hash itself is guarded.
  • The helper reads numbers only and invokes no accessor.
  • A cycle, a Proxy trap, or a structure past the input bounds is left to the guarded hash.
• Docs: ECONOMIC_AGREEMENTS.md, rule 5 and §8.

Tests

• Round 3b's sealed() uses a stand-in hash when the body has none, because the compiler must refuse whatever hash it carries.
• The toString test keeps only the reals that both forms write the same way.
• Two new round-3b tests:
  • A real of magnitude 2^53 or more is refused by rule 5 and by the compiler, and 2^53−1 still compiles.
  • Every schedule number without a canonical form is an options refusal, never a throw.
• A new file, economics-d5.test.ts, mocks each hash to throw the way D5's does, so the guards are exercised in either order. It also covers the adapters' number check and the helper.

Tree	Spec result
Fix alone	2168/2168, tsc clean
Fix + #359 + #566	2355/2355, tsc clean; merging fix → #566 → #359 gives an identical tree
master, without the fix	the new tests fail 4 of 73
master + #359 + #566, without the fix	the new tests fail 7 of 73

• Gateway: contributors and money-path, 51/51.
• Contracts: licensing-engine, immutability, integration and abi, 64/64.
• Mutations: 6 of 6 caught. The mutants were the compile guard dropped, the rule-5 bound dropped, the rule-5 bound made too strict at 2^53−1, the adapters' check dropped, the adapters' guard dropped, and the helper's bound made too strict.

🤖 Generated with Claude Code