[DeFi][FIN-09][M5] Make financial builders recover safely and benchmark contention #59

Implementation ownership — protocol-first, no finance-specific compiler feature

Primary implementation layer: off-chain SDK/adapter, operational recovery and measurement infrastructure; no new consensus semantics. Transaction discovery, stale-state detection, quote preservation, retry policy, signing and submission outcome tracking are client operations, not CellScript action keywords or VM opcodes.

Implementation shape: implement an explicit state machine over current generated-builder/CKB adapter and RPC interfaces. Preserve immutable user intent (limits, recipient, input asset, fee and chosen operation), distinguish signed/unsigned and unknown-submission states, and measure pool contention against actual node/VM evidence. The user/client may rebuild or re-quote only within authorised limits; no SDK decision can relax enforcing Script checks.

Acceptance interpretation: correct idempotency/retry behaviour and credible benchmark provenance, not proof that the compiler supports a new "recover transaction" intrinsic.

Compiler-change gate (all FIN work): This issue does not authorise finance-specific grammar, IR, opcodes, codegen branches or hidden protocol semantics. First try existing general CellScript constructs. Any genuinely missing general capability needs a minimal failing application, a non-financial use case, its own narrow issue and independent checker/ABI/resource/gate acceptance as required by #43 §2.2. Application correctness and builder convenience are distinct from language support.

Umbrella: #43 FIN-09/M5. Owner roles: generated-builder/adapter + performance/evidence engineers; reviewer unassigned. Status: proposed.

Dependencies and staged start

• Early prototype: start once [DeFi][FIN-04][M2] Complete constant-product AMM/LP lifecycle with generated builders #54 FIN-04 has a runnable generated pool builder, in parallel with FIN-05/FIN-06/07/08. Reuse the existing signing, construction, dry-run and adapter mechanisms; do not create a second transaction protocol.
• Final M5 acceptance hard-depends on [DeFi][FIN-08][M4] Enforce shared-payment allocation and bounded multihop routes #58 FIN-08: include accepted pool/order/shared-output/multihop shapes and their exact frozen semantics. [DeFi][FIN-07][M3] Settle an order against an AMM with enforced asset flows #57 FIN-07 is implicit via FIN-08.
• Source/CBV/cycle measurement infrastructure: reuse completed [0.31][Cost] Extend cost budgets to rejection paths, composition, and call-chain stack use #35–[0.32][Backend] Shorten low-mask immediates with validated logical right shifts #41 rather than revising their frozen baseline budgets. This issue owns separate full financial operation measurements.

Scope

1. Specify a state machine for discover → resolve live identities/Cells → quote → select funding and capacity → allocate → encode → preflight → sign → submit → observe commitment, explicitly classifying stable success, stale input, Script rejection, RPC unavailability, unknown submission status and reorganisation risks.
2. Preserve user intent on every retry: input/output asset identity, exact user price/slippage limits, minimum received, payout/owner, selected pool/order identity, cancellation policy and upper fee/capacity limit. If re-quoting cannot preserve intent, reject or ask the caller; never silently relax limits.
3. Build competing-builder and double-spend scenarios against live pool/order state. Handle failures before signing and after a potentially accepted but unconfirmed submission; do not duplicate an economic operation merely because an RPC call timed out.
4. Measure whole-operation timings (discovery, quote, construction, signing adapter, preflight, node acceptance and confirmation where measured), full transaction/script-group cycles, code bytes, witness sizes, observed VM stack, occupied/refundable capacity and actual fee/rounding residuals.
5. Record offered load, successful throughput, rejected conflicts, retries, terminal failures and latency distribution for the tested contention pattern; distinguish disposable pinned-node evidence from general network capacity.

Acceptance

• Versioned operational recovery taxonomy and idempotency/observation rules cover pre-submit, submit-unknown and reorg/stale input conditions.
• Tests demonstrate safe competing submissions, stale quotes and updated pool/order state, uncertain RPC outcome, fee changes and cancelled/interrupted signing while preserving immutable user intent.
• Generated SDK/adapter rebuild produces deterministic, valid transactions for supported retries; wrong-new-transaction bindings, duplicate payout and loosened slippage/fee/recipient constraints reject.
• Frozen per-case, per-metric full operation budgets and raw observations cover simple AMM, partially filled orders, C1 and C2–C4 composite settlements, valid and expensive late-reject cases; existing compiler cost baselines unchanged.
• Runtime/host statistics report exact source/ELF/transaction/toolchain/node identities, cache/repetition/environment, unavailable outcomes distinctly, full-gate evidence and review disposition.
• Failure and retry documentation is usable without treating off-chain observation as consensus finality.

Non-goals: live automated market making, routing optimality, production mainnet throughput or latency guarantees, reorg elimination or a new signing framework. Source: #43 §§10–12.

Dependency cross-links (confirmed GitHub issues)

Early start: #54 FIN-04's runnable builder (recovery pilot). Hard dependency for final M5 acceptance: #58 FIN-08 (thus #57/#54/#56 upstream), so the suite covers shared-output/multihop. Required by: #60 FIN-10.

Umbrella dependency graph and authoritative financial acceptance: #43.