Off-chain code

This layer builds, checks, signs, and sends the transactions that call the Sickle program, and it tests the program from the outside.

Note: Every path:line below is relative to the repository root. Nothing in this layer links the Rust crate. Every module reads the program through the Anchor IDL.

management-ui/ is a legacy compatibility tree, not the application serving so.vf.at; vfat-io/sickle-sol-ui owns that surface and its deployment. The legacy tree cannot yet be deleted because both Meteora canary adapters bundle its action builder and preparation modules (deploy/meteora-keeper/meteora-canary-adapter.ts:20-21, deploy/meteora-keeper/meteora-ui-acceptance-adapter.ts:27-28), and root tests consume its IDL and fixtures. Treat its routes and pages as retirement scope, not as the target for a live UI fix.

Files

The layer has 5 parts. The tables below give one row per file. The last column says whether the file is pure or whether it touches RPC, an HTTP API, a signer, or the process environment.

Builder: scripts/builder/, shared timing

Keeper: scripts/keeper/, scripts/keeper-sim.ts, scripts/canary*.ts

Legacy compatibility UI: management-ui/src/

Tests and fixtures

Scripts and configuration

Responsibilities

• Derive every PDA and ATA that the program re-derives on chain.
• Produce the exact camelCase account map that accountsStrict requires for each instruction.
• Decode the foreign venue accounts that the IDL does not describe.
• Size liquidity, slippage floors, fees, and Token-2022 transfer fees.
• Plan a keeper authorization in canonical form, compute its digest, and sign it.
• Compose the atomic transaction B for each keeper action.
• Freeze transaction A, transaction B, and a cancellation before A is sent.
• Check the packet size against the wire limit before a send.
• Send with a blockhash refresh and refuse to retry a program error.
• Predict off chain whether the program accepts a keeper action.
• Serve the management UI with unsigned transactions and read models.
• Proxy JSON-RPC for the browser with a method allowlist.
• Test the program on a legacy validator, on a mainnet fork, and on mainnet.

Public items

scripts/builder/pdas.ts

scripts/builder/accounts.ts

accounts.ts:60-63 re-exports SNAPSHOT_ACCOUNT_CODER_NAMES and eventCpiAccounts, and accounts.ts:459 re-exports IntentRef, so existing Orca-facing imports keep working while the canonical definitions live in the venue-neutral module below.

scripts/builder/common-accounts.ts

scripts/builder/instructions.ts

scripts/builder/clmm-owner-rebalance.ts

shared/intent-timing.ts

scripts/builder/clmm-intent-composer.ts

scripts/builder/flows.ts

scripts/builder/intent.ts

scripts/builder/intent-codec.ts

scripts/builder/intent-packets.ts, scripts/builder/alt.ts, scripts/builder/send.ts

Other builder files

scripts/keeper/decide.ts

Meteora keeper runtime

Management UI routes

Every route is a SvelteKit +server.ts. The server builds unsigned transactions and reads state. The browser signs. The table names the server function each route calls. No route calls scripts/builder/. The UI has its own copy of the encoders under management-ui/src/lib/sickle/.

The /api/tx actions map to these server builders.

The IDL contract

How a call flows through it

This follows one keeper Orca rebalance as scripts/canary-intent.ts runs it. Transaction A carries the owner's signed limits. Transaction B does the work.

1. The canary reads pool, position, global config, settings, mint owners, and transfer fees in one slot context. scripts/builder/intent.ts:510-606
2. It derives the exact new tick range from the live tick and the settings shape. scripts/canary-intent.ts:942-947, scripts/builder/orca.ts:894
3. It plans the withdrawal floors, the post-fee balances, and the swap direction. scripts/builder/intent.ts:826-881
4. If a swap is needed it fetches one Jupiter quote and freezes it with a slot window and the exact slippage floor. scripts/builder/flows.ts:193-224, scripts/builder/jupiter-api.ts:61
5. It builds the authorization: 2 pool vaults as assets, the swap edge, the floors, the window, the nonce. It sorts the assets and edges and checks the canonical rules. scripts/builder/intent.ts:289-392, scripts/builder/intent-codec.ts:257-426
6. It computes the digest over prefix, version, program, domain PDA, domain value, and payload. scripts/builder/intent-codec.ts:433-452
7. It composes transaction B from the same snapshot and frozen quote: rebalance_for, the optional keeper swap, orca_increase_liquidity, and finalize_intent. The Orca adapter owns the venue legs and the shared core validates/builds the signed swap. scripts/builder/intent.ts:1434-1603, scripts/builder/clmm-intent-composer.ts:110-209
8. Each instruction maps its accounts through a resolver and the Anchor client. scripts/builder/accounts.ts:773-792, scripts/builder/instructions.ts:912-943
9. The owner or session key signs the digest, and transaction A becomes [ed25519 verify, preauthorize_intent]. scripts/builder/intent.ts:400-433, scripts/builder/intent-codec.ts:460-495
10. A cancellation for the same nonce is built. scripts/builder/instructions.ts:731
11. All 3 packets are signed on one blockhash, fetched lookup tables are checked, and each packet is measured against the wire limit. Then the window and the quote age are checked one last time. scripts/builder/intent-packets.ts:66-170
12. A is sent and confirmed, then B. On any failure the cancellation is sent and the authorization PDA must be absent. scripts/builder/intent-packets.ts:223-266

Invariants the layer owns

1. An owner composer never composes a keeper flow. composeRebalance and composeRaydiumRebalance throw when keeper is set. scripts/builder/flows.ts:263-267, scripts/builder/raydium-flows.ts:171-175.
2. A standalone swap instruction never carries automator accounts. buildJupiterSwap rejects keeper and position. scripts/builder/instructions.ts:467-473.
3. An authorization reaches the signer only in canonical form. The codec sorts and then applies every rule of validate_canonical, with a plain Error per rule. scripts/builder/intent-codec.ts:257-426.
4. Every swap output asset carries a positive floor. The codec rejects a zero minOut on an edge output. scripts/builder/intent-codec.ts:322-329.
5. A frozen quote is exact. assertFreshIntentQuote requires minAmountOut === applySlippage(quotedOut, bps, "min") and a slot inside the window. scripts/builder/flows.ts:168-190.
6. A composer refuses a snapshot that disagrees with the signed authorization. Withdrawal floors, edge direction, input cap, output floor, position, and action are compared. Venue adapters check snapshot identity; the shared core checks authorization and swap bounds. scripts/builder/intent.ts:1486-1496, scripts/builder/clmm-intent-composer.ts:26-75, scripts/builder/clmm-intent-composer.ts:110-209.
7. Nothing is quoted, planned, or fetched after transaction A. The freeze does the last RPC read before A and the executor only sends and confirms. scripts/builder/intent-packets.ts:149-169, scripts/builder/intent-packets.ts:223-266.
8. A packet never exceeds the wire limit. assertPacketFit throws with the measured size. scripts/builder/send.ts:294-314, scripts/builder/intent-packets.ts:92-98.
9. A route never exceeds its ceiling. jupiterSwapLegFromApi throws JupiterRouteLimitError on data bytes or account count. scripts/builder/jupiter.ts:372-387.
10. The Sickle PDA is never marked a signer in a Jupiter route. scripts/builder/jupiter.ts:391-398.
11. A landed program error is never retried. The single-attempt helper throws on confirmation.value.err, and isRetriableError returns false for custom program error, InstructionError, and simulation failed. scripts/builder/send.ts:153-180, scripts/builder/send.ts:344-369.
12. A keeper session key is never the executor. The codec rejects sessionSigner === executor. scripts/builder/intent-codec.ts:403-407.
13. The management server never signs. /api/tx returns serialize({ requireAllSignatures: false }) bytes. The browser adds local position-mint signatures and then the wallet signature. management-ui/src/lib/server/tx.ts:223-233, management-ui/src/lib/wallet/wallet.svelte.ts:143-185.
14. A digest signature is re-verified on the server before transaction A is assembled. management-ui/src/lib/server/intent.ts:681-684.
15. A disabled feature returns 403 before the body is parsed further. management-ui/src/routes/api/tx/+server.ts:316-324, management-ui/src/lib/server/runtime.ts:139-163.
16. The RPC proxy forwards only 4 methods. management-ui/src/routes/api/rpc/+server.ts:9-14.

Limits

Tests

The routine check is anchor test --validator legacy. It runs tests/**/*.ts minus tests/mainnet-acceptance.ts on a solana-test-validator with 8 cloned mainnet accounts. Anchor.toml:28, Anchor.toml:47-69. The Surfpool scripts run 3 fork processes. Anchor.toml:29-32. CI runs yarn test:keeper-runtime without a validator and the 3 Surfpool scripts after the legacy run. .github/workflows/ci.yml:114, .github/workflows/ci.yml:218-244.

Fixtures shared with Rust.

The management UI has 62 vitest files under management-ui/src/ (61 before this change; src/lib/server/input.test.ts is new). One of them, management-ui/src/lib/sickle/builder-parity.test.ts, compares the UI encoders with scripts/builder/pdas.ts, jupiter.ts, and transfer-fees.ts byte for byte.

Gaps.

• composeRaydiumRebalance runs only in tests/builder-transfer-fees.ts:838 with a recording program. No validator or fork test sends its output.
• decide.ts does not model validate_rebalance_progress programs/sickle/src/state.rs:723 or the placement check. tests/keeper-sim.ts has no case for RebalanceNoOp or InvalidRangePlacement.
• The shared send transport is unit-tested with a stubbed Connection, but no validator or fork test sends through it. Only mainnet acceptance and the canaries use that path live.
• ensureLookupTable and ensurePersistentLookupTable run only in the validator and fork suites.
• surfpool-jupiter.ts self-skips when the Jupiter API is unreachable. tests/surfpool-jupiter.ts:271-279. A network fault reads as a pass.

Simplification and audit notes

7. L10-N007 — Retirement boundary and duplication across repositories. The legacy management UI does not import scripts/builder/. It carries a second implementation of 7 modules. The PDAs are at management-ui/src/lib/sickle/orca-tx.ts:36-104. The tick and liquidity math is at management-ui/src/lib/sickle/orca.ts:329-503. The Raydium tick math is at management-ui/src/lib/sickle/raydium.ts:299-355. The fee math is at management-ui/src/lib/sickle/fees.ts:11-19. The transfer-fee math is at management-ui/src/lib/sickle/transfer-fees.ts:97-113. The swap planner is at management-ui/src/lib/sickle/jupiter.ts:83-282. The authorization codec is at management-ui/src/lib/sickle/intent.ts:175-425. The UI comments say so at orca.ts:2-3, raydium.ts:2, jupiter.ts:1, fees.ts:2. builder-parity.test.ts:1-25 states that nothing else checks the claim. That test covers PDAs, admin encoding, discriminators, transfer fees, and Jupiter. It does not cover the tick or liquidity math, the account maps of the Orca and Raydium position instructions, or the codec. The codec rests on the shared vectors alone. The HTTP app is not served: deploy-restricted.sh:59-80 recognizes the authoritative sickle-sol-ui marker and exits without rebuilding or repointing traffic. Two selected server modules remain production inputs through the canary adapter imports cited at the start of this page, so deleting the whole tree is not yet safe. A shared live off-chain core would have to include the sibling repository; extracting only against this legacy copy would solve the wrong boundary.

8. L10-N008 — Duplication inside the legacy UI. PDA derivation appears in management-ui/src/lib/server/solana.ts:62-80, management-ui/src/lib/server/tx.ts:44-48, management-ui/src/lib/sickle/orca-tx.ts:36-104, management-ui/src/lib/sickle/intent.ts:458-507, and management-ui/src/lib/dlmm/pdas.ts:31-40.

9. L10-N009 — Very long functions. MeteoraKeeperRuntime scripts/keeper/meteora-runtime.ts:1837-2824 is 988 lines. MeteoraKeeperRuntimeStore meteora-runtime.ts:669-1800 is 1132 lines. createMeteoraKeeperRpcCollector scripts/keeper/meteora-rpc-collector.ts:667-1312 is 646 lines. The /api/tx POST handler management-ui/src/routes/api/tx/+server.ts:314-935 is 622 lines with 2 switch statements over the same body.action. planIntent management-ui/src/lib/server/intent.ts:281-645 is 365 lines. planRebalanceSwap scripts/builder/jupiter.ts:139-258 is 120 lines.

10. L10-N010 — Error handling is inconsistent. The builder throws Error in most places, RangeError in send.ts:71-79 and intent.ts:1074-1089, and 4 custom classes: JupiterRouteLimitError jupiter.ts:268, InvalidProtocolAccountData scripts/builder/protocol-account.ts:2, DryRunSealBreach dry-run.ts:64, MeteoraOwnerPacketRejected meteora-flow.ts:466. buildJupiterSwap returns Promise.reject instructions.ts:467-473 while buildFinalizeIntent throws synchronously instructions.ts:821-823. isRetriableError classifies by substring match on the message text send.ts:153-180. /api/tx maps every thrown Error to HTTP 422, including a programming error api/tx/+server.ts:931-934.

11. L10-N011 — Comment does not match code. management-ui/README.md:68 says the RPC proxy passes sendTransaction and simulateTransaction. The allowlist at management-ui/src/routes/api/rpc/+server.ts:9-14 has getAccountInfo, getSignatureStatuses, getTransaction, and sendTransaction only.

12. L10-N012 — Comment does not match code. scripts/builder/zap.ts:5-10 says the program requires the add-liquidity instruction through the Instructions sysvar with MissingZapInLeg. programs/sickle/src/errors.rs:96 still declares the variant, and no handler raises it. tests/sickle/orca.ts:2338-2341 records that the authorization ledger replaced it.

13. L10-N013 — Comment does not match code. scripts/builder/instructions.ts:166 is a one-line doc comment for orca_open_position followed by the TransferHookAccounts doc block. buildOpenPosition at instructions.ts:226 has no doc comment.

14. L10-N014 — Off-chain copy is incomplete. evaluateRebalance scripts/keeper/decide.ts:87-123 mirrors validate_rebalance_for programs/sickle/src/state.rs:586-687 but not validate_rebalance_progress state.rs:723 or the placement check. The header at decide.ts:5-10 says it predicts the exact on-chain error.

15. L10-N015 — Anchor null for an optional account. resolveIncreaseLiquidityAccounts returns null for globalAutomator, positionSettings, and actionIntent scripts/builder/accounts.ts:258-266. The comment in scripts/builder/executor-authorization.ts:8-11 explains that Anchor then emits the program ID as a sentinel. A reader of accounts.ts alone does not see that.

16. L10-N016 — Test self-skips. The 6 Surfpool files return early on a legacy validator tests/surfpool-lifecycle.ts:747-753, tests/surfpool-meteora-lifecycle.ts:872-875. tests/surfpool-jupiter.ts:271-279 also skips on any Jupiter transport failure. tests/mainnet-acceptance.ts records 47 ledger.skip calls with reasons in its ledger. A green legacy run proves nothing about those files.

17. L10-N017 — Missing execution tests. See the remaining gaps under Tests: composeRaydiumRebalance, the shared send transport, and the lookup-table creation path.

18. L10-N019 — A registry that looks like a gate gates nothing. The Meteora pair admission registry evaluates pairs as executable or not scripts/meteora-pair-admission.ts:1-24. No keeper, runtime, or UI code reads it. Only its report script and its test read it. The keeper and the UI act on pairs through their own hard-coded constants instead. Its v1 record docs/release-evidence/meteora-pair-admission-v1.json bounds ADX-USDC at 56 bins. The program now allows at most 55 on that pair, so the record evaluates as not executable. No path acts on that result.

19. L10-N020 — Some UI checks compare a width with the wrong limit. The program limits a keeper action to f of the pair's initialized reward slots: 55, 55, or 48 bins. Three management UI surfaces compare with the structural 55 instead. The settings encoder does it at management-ui/src/lib/sickle/settings-tx.ts:275, :358, and :430. The economics snapshot does it at management-ui/src/lib/sickle/meteora-economics.ts:215 and management-ui/src/lib/server/meteora-economics.ts:262. The action preparation does it at management-ui/src/lib/server/meteora-action-preparation.ts:330. On the one admitted pair, ADX-USDC, 55 is also f(1), so today the result is correct. If that pair initializes a second reward slot, f drops to 48. These surfaces then accept settings of 49 to 55 bins that the program rejects in transaction B. The user sees valid settings, and the keeper holds the rows. The fix is to compare with meteoraDlmmIntentMaxWidth(pair), as the readiness check and the intent composers already do. The review of pull request 297 found this.

Resolved

1. L10-R001 — The six Orca and Raydium keeper composers repeated authorization action, venue-position, expiry-margin, withdrawal-floor, and signed-edge guards. Four repeated the same optional single-swap validation/build block, and the two exit composers repeated the same zero-to-two target-swap pipeline. Those shared rules now live in clmm-intent-composer.ts; the venue adapters retain their distinct snapshot predicates, economic planners, account maps, drain/re-add instructions, output names, and Raydium heap requirement. The old SEND_MARGIN_SLOTS import remains available through intent.ts. The focused composer and transfer-fee suites pin instruction order, mixed token programs, fee math, post-swap arithmetic, and both swap directions; the source-level boundary test also requires all six wrappers to call the shared guards and appropriate swap composer. A direct shared-composer suite now pins every migrated guard, current-slot quote freshness, the optional no-swap path, zero-leg rejection, strict signed limits, cumulative exit floors, and lookup-table propagation. Focused Orca and Raydium compound, rebalance (with and without a swap), and exit cases pin the returned venue/swap/re-add/finalize order. The Orca exit cases also run both in-kind and target-swap composeIntentExit paths offline with mixed token programs. The zero-amount frozen-leg branch was removed as unreachable because the now directly tested quote validation rejects a zero-sized leg.

2. L10-R002 — The Orca and Raydium owner-rebalance composers independently estimated the drain, loaded the protocol fee, applied transfer fees, planned and built an optional Jupiter swap, derived conservative post-swap balances, sized the re-add, ordered the three legs, and propagated route lookup tables. Those decisions now live once in clmm-owner-rebalance.ts. Each venue wrapper loads its own accounts, maps A/B or 0/1 into the shared pair, and supplies only its drain and increase builders. SwapLegFetcher moved with the shared policy and remains re-exported from flows.ts for compatibility. The existing 12 owner fee/swap cases pin both adapters; a source-level test also requires each wrapper to call the shared composer exactly once and forbids it from re-importing the extracted policy helpers.

3. L10-R003 — Six TypeScript exports had no importer in scripts/, tests/, shared/, or management-ui/src/, and this private package exposes no package entrypoint. The declarations and their orphaned imports are removed. The three composer connection parameters retain their call positions as _connection, following the existing exit-composer convention; unused drain-credit destructures, Sickle aliases, and the flows.ts value alias are removed. TypeScript compilation and the existing builder and keeper suites preserve the reachable account, instruction, and packet behavior.

4. L10-R004 — Orca, Raydium, and Meteora separately derived the same Sickle, global config, pool-token, and fee-collector accounts, while the two CLMM resolvers separately built the same three optional intent slots. Resolved by moving those derivations, the event-CPI pair, and shared account-coder names into scripts/builder/common-accounts.ts. Venue adapters retain only their intentional A/B, 0/1, and X/Y output names, and accounts.ts re-exports its old public names for compatibility. tests/builder-common-accounts.ts directly pins the shared contract; the existing Orca, Raydium, and Meteora suites still pin every public resolver map. Their mutation check rejected a side-1 ATA derived with side 0's token program in four independent tests.

5. L10-R005 — The keeper's narrow Orca decoder and the builder's full decoder both read the Whirlpool tick spacing and live tick, while the builder imported the position decoder and shared error upward from scripts/keeper/. Resolved by making scripts/builder/orca.ts the one owner of Orca account layouts: the narrow and full pool decoders share one field reader, every position decoder shares one core reader, and the keeper now imports those builder decoders. The venue-neutral error lives in protocol-account.ts, used by both Orca and Raydium. tests/offchain-boundaries.ts walks every builder TypeScript import and fails if the reverse dependency returns; its mutation check caught protocol-account.ts -> ../keeper/decide before this text was written.

6. L10-R006 — The UI coordinator generated and cached a replacement-position keypair it never used to sign, while the keeper independently generated a second keypair for the same logical role. Resolved by eliminating both secrets. The destination is now the PDA [b"dlmm_intent_position", sickle, nonce_le]; meteora_rebalance_for and meteora_intent_open_position independently require it, and the open handler supplies its signer privilege only through invoke_signed. The keeper packet is signed only by its ordinary service identity. The UI's bounded state retains the unsigned authorization draft, but no private key, and a stored authorization remains reconstructible after a server restart.

7. L10-R007 — buildFinalizeIntent and buildFinalizeDlmmIntent duplicated the same non-exit and exit remaining-account grammar, while their account resolvers duplicated every fixed key except the authorization PDA name. The two public builders are now thin wrappers over finalizeIntentRemainingAccounts that keep the family-specific discriminators and mismatch errors. The two public resolvers now share resolveFinalizeCommonAccounts, with a callback that inserts the typed authorization key at its original position. A focused offline suite pins every fixed key to its absolute expected address, both remaining-account forms, and both errors, while the source-level boundary test requires both public families to keep calling the shared cores.

8. L10-R008 — sendFrozenPacket and sendWithRetry duplicated raw submission, blockhash-lifetime confirmation, and landed-error handling even though their retry policies intentionally differ. That one-attempt boundary now lives in sendAndConfirmTransactionBytes. Frozen A, B, and cancellation packets each call it once without refreshing their reviewed bytes; sendWithRetry keeps the blockhash refresh, re-sign, backoff, and transient-error classification around it. Stubbed-RPC tests pin the exact bytes and lifetime, default and overridden transport options, landed failure, fresh signature on retry, and terminal no-retry path. The packet-orchestration suite continues to prove an uncertain A failure goes straight to the pre-frozen cancellation, while the source-level boundary test requires both callers to use the shared helper.

9. L10-R009 — Intent authorization timing was independently copied between the root builder, packet executor, management server, and browser form. The three defaults now live in dependency-free shared/intent-timing.ts; thin builder and UI modules preserve the old public import paths. The packet freeze uses the shared send margin instead of a literal, Meteora coordination imports validity directly instead of through the server intent module, and the form derives its string default from the shared bigint. Root and UI unit tests pin the three values and compatibility exports, while the source-level boundary test requires every consumer to import the shared policy. The send tests now also pin both callers' exact blockhash lifetime, commitment, and preflight options. Live transport remains an explicit acceptance/canary coverage gap.

10. L10-R010 — Four API routes carried local public-key parsers, and the transaction and intent routes separately parsed non-negative amounts. Those request primitives now live in management-ui/src/lib/server/input.ts:4-40. Public keys and amounts intentionally require JSON strings. The explicit key type guard is defense in depth relative to the shared parser introduced by the extraction, which already stringified and rejected non-string JSON keys. The extraction itself tightened the older transaction-route parser, which passed non-string values directly to PublicKey and accepted some of them. The amount rule intentionally tightens the old contract: it prevents already-rounded JSON numbers above JavaScript's safe-integer range from silently changing instruction data, accepts only canonical unsigned decimal strings, and rejects values above u64::MAX. Empty, padded, whitespace, signed, fractional, and radix-prefixed forms all fail with HTTP 400. All in-repo callers already send canonical decimal strings; valid request behavior is unchanged. parseRequiredKey preserves the Meteora owner-step routes' distinct missing-value error before delegating to the same key parser. The shared tick parser also replaces the Orca and Raydium deposit paths' ?? NaN bypasses at management-ui/src/routes/api/tx/+server.ts:701-771, so every CLMM tick request fails with the same HTTP 400 contract. The focused suite pins string-only values and both error shapes, requires all four routes to import the shared module, checks every Meteora owner-step key, and checks each deposit case independently management-ui/src/lib/server/input.test.ts:30-123. The transaction-route header now describes its admin, intent, and protocol-management scope.

11. L10-R011 — Two offline Meteora suites loaded the ignored build IDL while the other builder specs used the checked-in snapshot. builder-meteora-flow.ts and builder-meteora-driver.ts now use the snapshot too, so their runtime no longer depends on anchor build having populated target/idl. The source-level boundary suite walks every TypeScript spec's direct imports and rejects any dependency on the ignored IDL tests/offchain-boundaries.ts:373-396; reverting either import makes that guard fail. Generated target/types remain a typecheck input, not a runtime IDL source.

12. L10-R012 — The Orca and Raydium coherent intent snapshot loaders decoded GlobalConfig and PositionSettings through raw account coders and erased the generated account types with as any, including the earlier settings fetches. decodeSickleSnapshotAccount now maps the two runtime coder names to anchor.IdlAccounts<Sickle> once in common-accounts.ts. Both venue loaders keep the same raw buffers from their single-context account reads but use the typed helper for all four frozen decodes and typed Anchor fetch results. A source-level test pins both account mappings, four helper calls per venue, and rejects raw coder calls or as any in either loader tests/offchain-boundaries.ts:181-209. The helper documents the caller's owner check, the generated exit-token keys now flow without redundant PublicKey casts, and all builder references to the generated Sickle type are explicit type-only imports; a second boundary case enforces that import contract tests/offchain-boundaries.ts:254-281. Typecheck and the existing compound and rebalance suites preserve behavior.

13. L10-R013 — The Orca keeper rebalance wrapper forced withSettings: true, then re-derived and overwrote the same old/new settings PDAs already returned by resolveRebalanceCommon; the Raydium wrapper carried the identical dead override. Both wrappers now re-export the common resolver's values with non-null assertions solely to preserve the account type required by accountsStrict scripts/builder/accounts.ts:743-762, scripts/builder/raydium-accounts.ts:706-728. The source boundary requires each wrapper to force settings, forbids a second positionSettingsPda call, and pins both re-exported values tests/offchain-boundaries.ts:211-252. The Orca and Raydium unit suites independently pin both returned settings addresses tests/builder-accounts.ts:523-537, tests/builder-raydium.ts:921-926. The program must still validate the required keeper settings because transactions are untrusted; that on-chain boundary is not removable duplication.

14. L10-N018 — A compute check depended on live mainnet state. The Meteora Surfpool test compared three measured compute figures with caps 1,400 CU above each measurement. The fork read the ADX-USDC pair and its bin arrays from mainnet, and one code path measured 3,866 CU and 5,056 CU apart on two days. Resolved by pinning that state, not by widening the allowance. The test writes the accounts in tests/fixtures/meteora-acceptance-state.json, captured at one mainnet slot, before it measures tests/surfpool-helpers.ts:237-273. It also refuses to measure a transaction that names a Meteora account outside the pinned set or the accounts that the test creates tests/surfpool-meteora-lifecycle.ts:1442-1484. That refusal stops a later flow from reading live state again without notice.

    Throwaway pull requests 300 to 303 show both properties. Each branch changed the test or the program on top of the fix, ran CI, and was closed without a merge. The figures are compound / rebalance / exit in CU. The pinned figures are 850,547 / 1,141,737 / 593,730.

    Run	Figures	Result
    300: one more address derivation	850,547 / 1,143,266 / 593,713	Fails: 129 over the cap
    302: light changed state, no pin	850,724 / 1,141,807 / 593,730	+177 / +70 / 0
    301: light changed state, then the pin	850,547 / 1,141,737 / 593,730	Equal to the pin
    302: strong changed state, no pin	850,621 / 1,120,640 / 593,713	+74 / −21,097 / −17
    301: strong changed state, then pin	850,547 / 1,141,737 / 593,713	Pin, exit −17
    303: strong, no pin, two-sided check	850,621 / 1,120,640 / 593,713	Fails: below the lower end
    299 at 6443f51, after an outage	850,547 / 1,141,737 / 593,730	Equal to the pin
    299 at 57e07b9, the next day	850,547 / 1,141,768 / 593,713	+0 / +31 / −17

    The light change multiplies bin amounts and liquidity by 1.5 and increases the fee accumulators and the volatility. The strong change also empties every other bin and adds 2^120 to each fee accumulator. The strong change without the pin moves rebalance by about 4 times the largest measured daily drift. Pull request 303 ran it twice and measured the same 1,120,640 both times. The two runs of pull request 299 are the first pinned runs apart in time: hours for 6443f51 and about one day for 57e07b9. They are not the week that the note asks for.

    Under the pin the figures agree within tens of CU. They are not always equal. Rebalance moved 31 CU and exit 17 CU with no code change. The likely cause is the number of digits in logged amounts. That is a hypothesis with some support: compound once moved 31 CU the same way, and no movement is a multiple of the 1,500 CU cost of one bump candidate. It is not a proven mechanism.

    The claim does not rest on a sample. The test overwrites each account that it reads, and the refusal enforces that. A later change made the check two-sided. Each figure must now stay within 1,400 CU of its pinned value in both directions tests/surfpool-meteora-lifecycle.ts:194-210. The earlier check allowed any decrease. With the pin, only a code change can move a figure by more than the residue, and a decrease is a change too. The two upper ends are the old caps without change, so the new check only adds a lower end. A later run on another day therefore needs no human check. Normal CI runs this test on each pull request that changes code. If the pin is incomplete, a figure moves and CI fails in either direction. A figure outside the band is a finding to report. After a deliberate optimization, set the figure again from CI in the same change. The residue sets a lower limit on the allowance. Do not make the band as small as about 100 CU, because it would then fail with no code change. Whether a flow fits is a separate check, the worst-work margin in the same test.

Related

• Entry points
• Venue bindings, the on-chain decoders the builder mirrors.
• State and settings, the checks decide.ts mirrors.
• Keeper authorization, the on-chain side of the codec and the finalizer.
• Dependency graph, section 8.