[0.33][Runtime] Extend bounded Cell selection and correspondence for heterogeneous and dynamic data #49

Alpha closure disposition — 2026-10-28

The implementation is included in v0.33.0-alpha.1. The maintainer explicitly authorized publication after integration tests, without CI or additional peripheral review. This issue is closed for that alpha implementation scope; public APIs may still change.

The original stable-admission checklist below is retained. Its unexecuted full-gate and stable-freeze conditions are deferred for this alpha, not recorded as passed. See the alpha validation record and the Chinese closure comment for completed evidence and remaining boundaries.

Outcome and version

Planned for 0.33, following the maintainer's October 5 request. Extend executable bounded Cell selection and input/output correspondence beyond the current same-Type-group, fixed-layout batch shapes. Deliver reusable general primitives with explicit ownership and full transaction evidence.

Priority within this program: 1 — Cell selection, pairing and conservation support, driven by complex settlement and batch migration. Record implementation ownership and review disposition before executable admission. Finance formulas and application authorization stay in protocol packages.

Motivation and duplicate check

Target use cases are mixed-asset settlement and migration of bounded batches whose Cell data contains variable payloads. A runtime-provided index list is only a proposal: it must not omit a protected Cell, duplicate an obligation, or turn foreign observation into local lifecycle authority.

Reviewed all 41 existing open/closed issues on October 5. No issue owns this general extension:

The current collections matrix defines the narrow supported shapes and is the starting inventory.

flowchart TD
    Tx["Actual transaction Cells"] --> Select["Explicit source, identities and bounded selection"]
    Select --> Complete["Prove count, uniqueness and complete protected coverage"]
    Complete --> Roles{"Authority of each selected Cell"}
    Roles --> Owned["Local-owned lifecycle checks"]
    Roles --> Foreign["Foreign observation and required peer group"]
    Owned --> Pair["Canonical input-output correspondence"]
    Foreign --> Peer["Peer authorization remains with its own Script"]
    Pair --> Rules["Package-defined conservation and allocation"]
    Rules --> All["Every required Script group accepts the same transaction"]
    Peer --> All

Required decisions and staged scope

1. Inventory concrete failing programs and freeze a source/role/layout/operation matrix. Specify transaction-wide versus group-relative coordinates, exact Script identities, selection predicates, ordering, min/max counts, per-Cell/aggregate bytes, scan bounds and stable failures. Limits apply per transaction, not to the total user or order population.
2. First implement fixed-layout heterogeneous observation and correspondence across explicitly admitted exact roles, using a closed set of schemas or tagged variants. Retain each Cell's complete identity and authority; mixed schemas are not interchangeable merely because their widths match.
3. Then implement one bounded variable-payload batch transition using the nested-data codec contract. Define each predecessor/successor pairing, permitted create/burn/merge behavior and identity policy. No generic unrestricted container of linear Cell resources is implied.
4. Independently derive or verify complete protected membership on chain. Specify unrelated fee/change exclusions, duplicate indices/identities, missing/extra successors and equivalent versus invalid permutations. A shared output must not discharge competing obligations twice; financial allocation rules remain explicit protocol predicates.
5. Keep foreign observation, local ownership and required peer execution separate. Classify each claim by current-Script enforcement, required peer group, builder/dry-run checking or consensus. Local observation does not grant consume/create authority or establish peer success.
6. Extend existing ProtocolBundle and generated builders. Bind selected roles, indices, data/codec identities, correspondence and witness ownership to the final transaction; no alternate serializer or builder-only consensus rule.

Authoring direction — 2026-10-19

The maintainer adopted this authoring direction on 2026-10-19. Existing experimental lowerings and tests remain reusable evidence; they do not freeze the final public API. Exact declaration grammar remains to be selected against complete programs. This adds acceptance work within #47–#49 and preserves every existing runtime, checker, builder, resource, gate and review requirement; it is not a release claim or review waiver.

Keep explicit borrow root as view { ... } for a useful lexical read-only region, without requiring a borrow block for every ordinary permitted field read. Distinguish semantic prohibitions from current proof/implementation limitations. Checked, bounded, non-escaping read-only helper composition must preserve each view's root, source, bounds, lifetime and authority. Current call/escape restrictions stay enforced until those proofs exist; this does not authorize general mutable borrowing, escaping borrowed values or foreign lifecycle authority.

Treat positional ckb::verify_cell_roles, inline ckb::exact_cell_role declarations and ckb::selected_*<T>(selection, role_number, ...) as experimental implementation surfaces. The stable authoring target uses named roles and named scan/count/byte limits declared once. Bind each role's schema, complete admitted Script identities, authority, identity field and correspondence at that declaration; resolve field/policy choices structurally with declaration-time diagnostics. A use site must not have to repeat both its schema type and numeric catalog ordinal.

Keep business predicates separate from deployment/policy plumbing and retain .data to distinguish schema fields from transaction properties. For illustration only, not implemented or frozen syntax: selected.orders.input(i) and selected.orders.successor(i) express named role access, where i is still role-local. Global/group coordinates remain explicit, and declaration reordering must not retarget a role. Named policy declarations are not authentication: reuse existing admitted identity and ProtocolBundle/generated-builder bindings.

Review the complete mixed-role settlement and variable-payload batch transition, including checked non-escaping read-only helpers. Do not simplify spelling by weakening protected membership, correspondence, required peer execution or the separation of observation from lifecycle authority.

Acceptance

• Review current/proposed complete mixed-role settlement and variable-payload batch programs, with role/budget declarations and extracted helpers; record the authoring decision before stable API freeze.
• Named role access derives the schema without repeated type/numeric-role arguments. Role reorder/rename, wrong role/field, incompatible schema and invalid named bounds have deterministic checked outcomes and editor support.
• Checked read-only helpers retain selected source/index/schema and authority, reject substituted or escaping views, and preserve compiler/checker/builder transaction outcomes and canonical bytes. All-group and resource evidence covers the final authoring form.
• A versioned semantic contract fixes the admitted matrix, numeric bounds and error taxonomy before positive lowering.
• Two executable examples cover fixed-layout mixed-role settlement and bounded variable-payload batch transition, with package rules separated from compiler primitives.
• Complete transaction execution covers minimum, representative and maximum sets, including every required Script group and a peer that deliberately rejects.
• Omission, insertion, duplicate identity/index, wrong source/group/role/schema, foreign-ownership misuse, missing/extra/mispaired outputs, shared-output double use, fee/change confusion and post-build substitution reject at named boundaries. Equivalent permutations follow the explicit ordering contract.
• Independent checker mutations cover selection, completeness, lifecycle and correspondence blocks after hashes are rebound; metadata-only selection is never counted as runtime support.
• Generated builder/adapter bytes agree; simulator results are separated from CKB-VM and stateful transaction evidence. Existing [Candidate][Consensus runtime] Implement executable bounded Cell-group consumption #7/[Candidate][Consensus runtime] Implement executable bounded output-plan correspondence #8 and closed-role fixtures retain their outcomes.
• Source/type/ownership analysis, IR, metadata, formatter/LSP, WASM summaries, builders and docs agree wherever affected. Publish frozen worst-case cycles, stack/memory, ELF, witness/transaction bytes and capacity evidence.
• Appropriate dev, backend and ci gates pass on identified source, and the scope-specific review disposition is recorded before stable admission.

Unbounded scans, arbitrary mutation within collection bodies, automatic protocol conservation inferred from names, unrestricted foreign ownership, a general persistent database and unrestricted DeFi composability are outside scope. Exact-role work does not require the general heap allocator; the variable-payload phase depends on the nested-data contract.

Related 0.33 work

#48 owns the nested-data codec needed by the variable-payload phase. Fixed-layout exact-role selection can proceed independently. #47 owns general value allocation and Map/Set helpers; it is not a mandatory prerequisite for bounded Cell selection or correspondence.