Make inherited security-pool outcomes final (#598)

* Make inherited pool outcomes final

* Prevent fixed child escalation locks

* Clarify fixed outcome settlement timing

* Retry transient CI failure

Author: KillariDev

docs/contract-interaction-reference.md

@@ -412,8 +412,8 @@ <h2>Remediated Launch Findings</h2>
 								</td>
 								<td>
 									A branch selected by a matching fork becomes the immutable
-									continuation outcome, unrelated forks preserve the previous fixed
-									outcome, and escalation-deposit withdrawal rejects a pool/game
+									continuation outcome, later universe forks cannot transition that
+									fixed pool, and escalation-deposit withdrawal rejects a pool/game
 									mismatch.
 								</td>
 							</tr>
@@ -1748,16 +1748,21 @@ <h2>Escalation Games and Carried Claims</h2>
 							<div class="invariant-property">
 								When a universe forks on a pool's question, each child pool and its
 								continuation game use that child's Invalid, Yes, or No branch as
-								the final pool-question outcome. A later fork on the same question
-								replaces the inherited outcome with its newly selected branch; a
-								fork on another question preserves the inherited outcome. Deposit
-								withdrawal reverts unless the pool and game report the same outcome.
+								the final pool-question outcome. Once a pool inherits that fixed
+								outcome, new local escalation deposits and every later fork
+								transition revert, whether the new universe fork uses the same
+								question or another one. Deposit withdrawal reverts unless the pool
+								and game report the same outcome.
 							</div>
-							<p class="invariant-example"><strong>Example:</strong> A Yes child created by a fork on the pool question pays carried Yes deposits even if copied game balances favored No; a later unrelated fork keeps Yes as the payout outcome.</p>
+							<p class="invariant-example"><strong>Example:</strong> A Yes child created by a fork on the pool question pays carried Yes deposits even if copied game balances favored No. It rejects new local escalation REP before escrow, so a later local non-decision cannot lock vault redemption. A later matching or unrelated universe fork leaves the stored <code>SystemState.Operational</code> and fixed Yes outcome unchanged, and eligible share, vault REP, and carried-proof redemption paths remain available, while universe-fork guards still freeze normal operating calls.</p>
 							<dl class="invariant-metadata">
 								<div><dt>Type</dt><dd>Safety</dd></div>
 								<div><dt>Enforcement status</dt><dd>Reviewed preservation</dd></div>
 								<div><dt>Primary evidence</dt><dd>
+										<a
+										href="../solidity/contracts/peripherals/SecurityPool.sol"
+										><code>activateForkMode</code></a
+										>,
 										<a
 										href="../solidity/contracts/peripherals/EscalationGameCalculations.sol"
 										><code>getQuestionResolution</code></a

docs/invariants.html

@@ -13,7 +13,7 @@
 		{
 			"id": "deploymentStatusOracle",
 			"label": "Deployment Status Oracle",
-			"address": "0x99c01b10dd0FFa4e111a1F024523f618F4040743"
+			"address": "0xf81e0586e246C0c46C6e5A60C89645402eFfF7d8"
 		},
 		{
 			"id": "multicall3",
@@ -53,34 +53,34 @@
 		{
 			"id": "shareTokenFactory",
 			"label": "ShareTokenFactory",
-			"address": "0xCbec97Fc9699af3366e4a86A94Fb7478b2ea419d"
+			"address": "0xDa7655f600D2A298e44E3649983c800C08F746F1"
 		},
 		{
 			"id": "priceOracleManagerAndOperatorQueuerFactory",
 			"label": "OpenOracle Price Coordinator Factory",
-			"address": "0x34fd97b4DA610998A871cA35c89603D56EDC9354"
+			"address": "0x2675524c278277161474CA2Bb61DdFC52E0E187e"
 		},
 		{
 			"id": "securityPoolForker",
 			"label": "Security Pool Forker",
-			"address": "0x89655E77A6A623934C6f9c2Ccb28154febC16043"
+			"address": "0x836da20a717298e55f03Ce98cDBf73F3C011B585"
 		},
 		{
 			"id": "escalationGameFactory",
 			"label": "Escalation Game Factory",
-			"address": "0x3352BA09Be76FAB7795e7319B4Ec4daA4afE9AA9"
+			"address": "0xB16Cf95eDf6b8BA654555e72d55d58faE992C4B6"
 		},
 		{
 			"id": "securityPoolFactory",
 			"label": "Security Pool Factory",
-			"address": "0x01dbD6b3576EfcE2B0C7F9FeD1538bD20B673182"
+			"address": "0xdcc473e4a941fC651309e8D1042DfB4a9C31c957"
 		}
 	],
 	"derivedContracts": [
 		{
 			"id": "escalationGameProofVerifier",
 			"label": "Escalation Game Proof Verifier",
-			"address": "0xcbb9f8b87F4A6cFB3776a356C57A865320c72C29"
+			"address": "0x9DcA4f0Ed5A7E9F560f8074E5A70AeD41Fdb8894"
 		}
 	]
 }

docs/mainnet-deployment-addresses.json

@@ -77,7 +77,7 @@ contract-first form.
 | Escrowed REP withdrawal lock | `performWithdrawRep` rejects withdrawal while the vault still has REP escrowed in an escalation game; the vault must settle those locks first. | [SecurityPool.sol](../solidity/contracts/peripherals/SecurityPool.sol) |
 | External fork withdrawal lock | If the universe forked before the local escalation game ended and non-decision was not reached, parent-pool escalation withdrawal reverts. The child continuation already has the canonical snapshot and aggregate backing: winning inherited deposits settle there by proof, inherited losers require no transaction, and clearing the vault's parent lock accounting is optional. | [SecurityPool.sol](../solidity/contracts/peripherals/SecurityPool.sol), [`EscalationGameSettlement.withdrawDeposit`](../solidity/contracts/peripherals/EscalationGameSettlement.sol), [`EscalationGameCarry._getEffectiveInheritedUnresolvedTotal`](../solidity/contracts/peripherals/EscalationGameCarry.sol) |
 | REP-to-ownership round-up | `repToPoolOwnershipRoundUp` uses ceiling division when the pool removes vault ownership for an escalation deposit. That intentionally burns enough ownership to cover the requested REP even when the ownership conversion is fractional. | [`SecurityPool.repToPoolOwnershipRoundUp`](../solidity/contracts/peripherals/SecurityPool.sol), [`SecurityPool.depositToEscalationGame`](../solidity/contracts/peripherals/SecurityPool.sol) |
-| Escalation deposit wrapper | `depositToEscalationGame` deploys the game on the first valid post-end deposit, previews the accepted amount, removes vault REP ownership with round-up accounting, checks local and global solvency, transfers REP into the game, and records the deposit. | [`SecurityPool.depositToEscalationGame`](../solidity/contracts/peripherals/SecurityPool.sol), [`EscalationGame.recordDepositFromSecurityPool`](../solidity/contracts/peripherals/EscalationGame.sol) |
+| Escalation deposit wrapper | `depositToEscalationGame` rejects pools with an inherited fixed outcome because they cannot enter another fork or safely unwind a later local non-decision. Otherwise it deploys the game on the first valid post-end deposit, previews the accepted amount, removes vault REP ownership with round-up accounting, checks local and global solvency, transfers REP into the game, and records the deposit. | [`SecurityPool.depositToEscalationGame`](../solidity/contracts/peripherals/SecurityPool.sol), [`EscalationGame.recordDepositFromSecurityPool`](../solidity/contracts/peripherals/EscalationGame.sol) |
 | Direct ETH receiver | Ordinary calls to `receive()` accept ETH only from the forker, its truth auction, or its parent pool. Forced ETH can bypass `receive()`; it remains raw, unaccounted surplus and is not collateral or accrued fees. | [SecurityPool.sol](../solidity/contracts/peripherals/SecurityPool.sol) |
 | Vault enumeration | `getVaults(startIndex, count)` pages the append-only vault list in insertion order. `getActiveVaults(startIndex, count)` pages only active vaults in newest-first order by walking the active-vault linked list from `latestActiveVault`. Both return an empty array when `count == 0` or the start index is out of range. | [`SecurityPool.getVaults`](../solidity/contracts/peripherals/SecurityPool.sol), [`SecurityPool.getActiveVaults`](../solidity/contracts/peripherals/SecurityPool.sol) |
 
@@ -112,12 +112,12 @@ consumption all live in this section.
 | Outcome room | Accepted deposit amount is capped to the selected outcome's remaining room under `nonDecisionThreshold`. | [`EscalationGameCalculations._getAcceptedDepositAmount`](../solidity/contracts/peripherals/EscalationGameCalculations.sol) |
 | Tie adjustment | If the accepted amount would create a tie with the current maximum balance while still below non-decision, the contract reduces the accepted amount by `1 wei`; if that breaks the accepted-amount rule, the deposit is rejected. | [`EscalationGameCalculations._getAcceptedDepositAmount`](../solidity/contracts/peripherals/EscalationGameCalculations.sol) |
 | Unresolved resolution state | If two or more outcomes meet the current running cost, `getQuestionResolution()` returns `None`. | [`EscalationGameCalculations.getQuestionResolution`](../solidity/contracts/peripherals/EscalationGameCalculations.sol) |
-| Matching-fork continuation resolution | When a universe fork uses the pool's question, every child stores the selected branch as its fixed question outcome whether the fork began through the pool-specific or direct Zoltar entrypoint. After the continuation deadline, the game uses that same fixed outcome for deposit settlement; unrelated descendant forks inherit an existing fixed outcome, while unrelated forks of unresolved pools retain local continuation semantics. Payout settlement also rejects any pool/game outcome mismatch. | [`EscalationGameCalculations.getQuestionResolution`](../solidity/contracts/peripherals/EscalationGameCalculations.sol), [`EscalationGameSettlement._getPayoutQuestionResolution`](../solidity/contracts/peripherals/EscalationGameSettlement.sol), [`SecurityPoolForker.getQuestionOutcome`](../solidity/contracts/peripherals/SecurityPoolForker.sol) |
+| Matching-fork continuation resolution | After the continuation deadline, a game with a fixed child outcome settles deposits against that outcome. Payout settlement rejects any pool/game outcome mismatch. See [Matching-question child outcome](#fork-migration) for the pool-level finality rule. | [`EscalationGameCalculations.getQuestionResolution`](../solidity/contracts/peripherals/EscalationGameCalculations.sol), [`EscalationGameSettlement._getPayoutQuestionResolution`](../solidity/contracts/peripherals/EscalationGameSettlement.sol), [`SecurityPoolForker.getQuestionOutcome`](../solidity/contracts/peripherals/SecurityPoolForker.sol) |
 | Empty-game fallback | If all outcome balances are zero after the running cost is non-zero, `getQuestionResolution()` returns `Invalid`; if the running cost is still zero, the unresolved check returns `None` first. | [`EscalationGameCalculations.getQuestionResolution`](../solidity/contracts/peripherals/EscalationGameCalculations.sol) |
 | Strict leading resolution | After the unresolved-cost check and the all-zero `Invalid` fallback, a strict `Invalid`, `Yes`, or `No` lead returns that outcome. Valid local deposits prevent tied maxima below non-decision by reducing the accepted amount by `1 wei`, or reverting if that adjusted amount becomes invalid. Continuation snapshots preserve the parent balances exactly, including ties, so every selected branch starts from the same unresolved game state. | [`EscalationGameCalculations.getQuestionResolution`](../solidity/contracts/peripherals/EscalationGameCalculations.sol), [`EscalationGameCalculations._getStrictLeaderOrNone`](../solidity/contracts/peripherals/EscalationGameCalculations.sol), [`EscalationGameCalculations._getAcceptedDepositAmount`](../solidity/contracts/peripherals/EscalationGameCalculations.sol), [`EscalationGameCarry.initializeForkCarrySnapshotWithResolutionBalances`](../solidity/contracts/peripherals/EscalationGameCarry.sol) |
 | Structural non-decision predicate | `hasReachedNonDecision()` becomes true when two or more outcomes reach `nonDecisionThreshold`; `nonDecisionState` separately records how that balance condition entered the lifecycle. New games use `ceil(forkThreshold / 2)`, so two threshold balances always contain at least the REP required to fund an own fork even when the fork threshold is odd. | [`Zoltar.getNonDecisionThreshold`](../solidity/contracts/Zoltar.sol), [`EscalationGameCalculations.hasReachedNonDecision`](../solidity/contracts/peripherals/EscalationGameCalculations.sol) |
 | `nonDecisionState = None` | No explicit non-decision transition has occurred. Deposits may remain available subject to the ordinary activation, continuation, timing, and amount guards. | [`EscalationGame.previewDepositOnOutcome`](../solidity/contracts/peripherals/EscalationGame.sol), [`EscalationGameDepositDelegate.recordDepositFromSecurityPool`](../solidity/contracts/peripherals/EscalationGameDepositDelegate.sol) |
-| `nonDecisionState = Local` | A local deposit brought a second outcome to the threshold. The game stores the real `nonDecisionTimestamp`, closes further deposits, and `canTriggerOwnFork()` returns true. | [`EscalationGameDepositDelegate.recordDepositFromSecurityPool`](../solidity/contracts/peripherals/EscalationGameDepositDelegate.sol), [`EscalationGameCalculations.canTriggerOwnFork`](../solidity/contracts/peripherals/EscalationGameCalculations.sol) |
+| `nonDecisionState = Local` | A local deposit brought a second outcome to the threshold. The game stores the real `nonDecisionTimestamp`, closes further deposits, and `canTriggerOwnFork()` returns true. That predicate is game-local: a pool with an inherited fixed outcome still rejects the fork transition in `activateForkMode()`. | [`EscalationGameDepositDelegate.recordDepositFromSecurityPool`](../solidity/contracts/peripherals/EscalationGameDepositDelegate.sol), [`EscalationGameCalculations.canTriggerOwnFork`](../solidity/contracts/peripherals/EscalationGameCalculations.sol), [`SecurityPool.activateForkMode`](../solidity/contracts/peripherals/SecurityPool.sol) |
 | `nonDecisionState = InheritedThresholdTie` | Snapshot initialization preserved two or more threshold-full balances without fabricating a local timestamp. The game closes further deposits. With a fixed child outcome it follows the continuation clock and cannot trigger its own fork; without one, `canTriggerOwnFork()` returns true directly. | [`EscalationGameCarry.initializeForkCarrySnapshotWithResolutionBalances`](../solidity/contracts/peripherals/EscalationGameCarry.sol), [`EscalationGameCalculations.getEscalationGameEndDate`](../solidity/contracts/peripherals/EscalationGameCalculations.sol), [`EscalationGameCalculations.canTriggerOwnFork`](../solidity/contracts/peripherals/EscalationGameCalculations.sol) |
 | Carry proofs | Inherited carry uses Merkle Mountain Range peaks and nullifier roots so child games can consume proofs without replaying already-spent parent deposits. | [`EscalationGameSettlement.withdrawDeposit`](../solidity/contracts/peripherals/EscalationGameSettlement.sol), [`EscalationGameCarry._verifyAndConsumeCarriedDepositProof`](../solidity/contracts/peripherals/EscalationGameCarry.sol) |
 | Continuation withdrawal | Anyone may relay a batch of winning carried proofs for one beneficiary after a child continuation resolves. Each proof authenticates its recorded depositor, consumes that leaf once, and pays the depositor from aggregate game REP. Inherited losing outcomes retire in constant-size work when the result is final and require no proof transaction; locally created losing deposits retain ordinary settlement. | [`SecurityPool.withdrawForkedEscalationDeposits`](../solidity/contracts/peripherals/SecurityPool.sol), [`EscalationGameSettlement.withdrawDeposit`](../solidity/contracts/peripherals/EscalationGameSettlement.sol), [`EscalationGameCarry._getEffectiveInheritedUnresolvedTotal`](../solidity/contracts/peripherals/EscalationGameCarry.sol) |
@@ -143,7 +143,7 @@ child-pool creation, REP splitting, and child outcome selection.
 | Independent continuation liveness | Child creation initializes the canonical carry and aggregate backing without waiting for vault transactions. Once final, authenticated winning proofs can be relayed permissionlessly, inherited losers retire without proofs, and optional parent cleanup may happen independently. | [`SecurityPoolForkerBase._finalizeAwaitingForkContinuationIfReady`](../solidity/contracts/peripherals/SecurityPoolForkerBase.sol), [`EscalationGameSettlement.withdrawDeposit`](../solidity/contracts/peripherals/EscalationGameSettlement.sol), [`EscalationGameCarry._getEffectiveInheritedUnresolvedTotal`](../solidity/contracts/peripherals/EscalationGameCarry.sol) |
 | Own-fork REP buckets | When escalation triggers its own fork, `escalationChildRepAtFork` equals `escalationRepToFork - floor(forkThreshold / forkBurnDivisor)`. `vaultRepAtFork` preserves ordinary pool REP one-for-one. Creating one selected child does not reduce the post-haircut escalation backing available to another selected child. | [`SecurityPoolForker.forkZoltarWithOwnEscalationGame`](../solidity/contracts/peripherals/SecurityPoolForker.sol), [`SecurityPoolForker.getOwnForkRepBuckets`](../solidity/contracts/peripherals/SecurityPoolForker.sol), [`SecurityPoolForkerBase._initializeOwnForkRepBuckets`](../solidity/contracts/peripherals/SecurityPoolForkerBase.sol) |
 | Child-pool deployment window | Child pools are created lazily for selected fork outcomes, but only while the parent pool is `PoolForked` and the eight-week migration window is still open. | [SecurityPoolForkerVaultMigrationBase.sol](../solidity/contracts/peripherals/SecurityPoolForkerVaultMigrationBase.sol), [SecurityPoolUtils.sol](../solidity/contracts/peripherals/SecurityPoolUtils.sol) |
-| Matching-question child outcome | When the parent universe forks on the pool's question, the child stores its selected Zoltar outcome index as a fixed result whether the fork used the pool-specific path or a direct Zoltar call. The fixed result applies after continuation and is inherited through later unrelated descendants. `ownFork` changes accounting only. | [SecurityPoolForkerVaultMigrationBase.sol](../solidity/contracts/peripherals/SecurityPoolForkerVaultMigrationBase.sol), [SecurityPoolForker.sol](../solidity/contracts/peripherals/SecurityPoolForker.sol) |
+| Matching-question child outcome | When the parent universe forks on the pool's question, the child stores its selected branch as a fixed result. `depositToEscalationGame` rejects new local deposits, and `activateForkMode` rejects every later pool fork transition. See [Child Outcome Resolution](./statoblast-whitepaper.html#child-outcome-resolution) for the collateral and REP-liveness rationale. | [SecurityPool.sol](../solidity/contracts/peripherals/SecurityPool.sol), [SecurityPoolForkerVaultMigrationBase.sol](../solidity/contracts/peripherals/SecurityPoolForkerVaultMigrationBase.sol), [SecurityPoolForker.sol](../solidity/contracts/peripherals/SecurityPoolForker.sol) |
 | Unrelated-fork child outcome | A child created by an unrelated fork without an inherited fixed result uses a local escalation result only if that escalation ended before the universe forked; otherwise continuation or later state must produce the outcome. | [SecurityPoolForker.sol](../solidity/contracts/peripherals/SecurityPoolForker.sol) |
 
 ## Truth Auction Operations

docs/operator-reference.md

@@ -118,7 +118,7 @@ window.protocolTermDefinitions = Object.freeze({
 	MIN_SECURITY_BOND_DEBT: 'The smallest security-bond debt amount tracked. Smaller dust amounts are avoided.',
 	minLiquidationPriceDistanceBps: 'The basis-point distance required beyond the liquidation threshold before execution.',
 	'non-decision threshold': 'The REP balance level that two or more outcomes must reach for the structural non-decision condition.',
-	'non-decision': 'A structurally contested escalation state. Whether it authorizes a fork depends on whether it arose locally or was inherited and, for an inherited tie, whether the continuation has a fixed outcome.',
+	'non-decision': "A structurally contested escalation state. Its local or inherited origin determines the game's canTriggerOwnFork() predicate, but a successful pool fork also requires no inherited fixed outcome. Fixed-outcome pools reject new local escalation deposits before this state can be created.",
 	NUM_OUTCOMES: 'The Statoblast constant for the three supported outcomes: Invalid, Yes, and No.',
 	NULLIFIER_DEPTH: 'The depth of the tree used to remember consumed proofs. It prevents the same carried deposit from being used twice.',
 	'number of ticks': 'The scalar-outcome denominator used to map a scalar answer onto payout numerators.',