# Native flourishing long-term admission repair ## Identity and reproduced defect `NATIVE-LONGTERM-01` is a software defect reproduced against committed source `189bf4bcaf0034baace58bfe28b580b26fd9fa95`, tree `29723e49be7e422602ebda2737a461ba8df67d64`, with actual SDK-encoded transactions and the matching retained SBF `64ee58076d649fe80ce4734c1472a024926d8b60ac9f41013102fbdf306f9616`. The real disposable loopback validator rejects `create_Partnership_sponsor_allocation` with custom error 6004, `InvalidDeadline`, for a fully funded, participant-and-sponsor-signed ten-year reward allocation. This was a behavioral failure, not a compiler failure. The old create handler requires the entire reward plan to end by the bond's short custody maturity, then applies the generic 366-day custody limit to its wall recovery deadline. Base's allocation policy permits 3,650 days. Although the native numeric formulas contain the later loyalty/time tiers, old allocation admission cannot reach them. Earlier scoped short-duration passes did not establish long-term parity. ## Source repair and unchanged safety boundaries Reward allocation admission is separate from principal custody. The program must still be created against a genuinely active, not-yet-matured bond with its exact terms and both actual participant signers plus the actual sponsor. The sponsor funds the entire immutable cap atomically. Allocation creation does not change the bond, principal vault, maturity or remedy entitlement. Subsequent metric instructions have no principal/remedy accounts. - **Reward duration:** at most 3,650 active-clock days, matching Base's duration limit. Ordinary native custody deadlines retain their existing limits. - **Future start:** at most 366 active-clock days after creation. This native-specific finite admission bound does not extend principal custody. - **Pause extension:** the explicitly co-signed wall stop must be no earlier than the initial projected reward end and no later than 366 days after it. Recovery after that hard stop returns only unearned sponsor funds; finalized earned allowances survive recovery. - **Arithmetic:** checked signed additions and subtractions reject impossible timestamps and overflow instead of wrapping. Native-v1 still uses the durable protocol active clock while Base uses wall time. This is a versioned policy distinction, not wall-clock-equivalent cross-chain scheduling. Observation signatures authenticate public synthetic aggregates in these tests, not external factual truth. This repair also does not establish terminal-bond lifecycle equivalence. Base's integrated bond contracts release their unused reward commitment when the bond terminates. This native version deliberately keeps the separately funded and explicitly three-party-signed reward allocation alive until its own dates, even after short principal custody ends. It never extends custody to make a numeric tier reachable. This bounded policy difference requires owner review before activation; exact Base termination coupling, if required, needs an additional versioned native bond/schedule design. Closing the unreachable-duration defect does not close whole-native Base parity. ## Verified repair scope `NATIVE-LONGTERM-01` is CLOSED for the unreachable-duration/tier defect. It is not closure of whole-native Base parity. The fresh locally compiled executable is 2,265,200 bytes, SHA-256 `942af6d2bbe90eb85aa3ba5f6a61f3634dae6d9c46db46fe02334a3803907f26`. Its production-input binding is retained alongside the executable in `full-v3/solana/evidence/native-v2-sbf/`. This is a source-bound local build, not independent compilation, public deployment or authenticated live runtime. Sixteen tests execute the dependency-free production evaluator and ledger. They include exact maximum duration, future-start and wall-stop boundaries, overflow, yearly finalizability and the unchanged 20,000-vector conservation sweep. Compile the host test with Rust 1.89.0 and `--edition=2021`, matching the crate's Cargo edition. `v3-src/test/bonds/FlourishingLongTermParityV3.t.sol` passes with a fresh Solc 0.8.24 build and actual `FlourishingRewardPolicyV3` execution. It checks 18 annual numeric vectors, years one through nine for both families, plus rejection of a duration one second above ten years. These unsigned previews establish numeric vectors only, not observation authorization or finality. The Rust host and new SBF lifecycle tests assert the same exact independent outputs instead of deriving runtime expectations by calling the Rust quote. The complete current native run passes 78 host tests and 26 actual SBF tests, with zero failures or skips. Both families recover and actually withdraw short-custody principal before year one, then sequentially submit, correct, finalize and claim annual rewards through year nine. Tests preserve principal and remedy account bytes, reject early sponsor recovery, and preserve unclaimed earned AI allowances through a pause and hard-stop sponsor return. Elapsed time is explicitly simulated using the Clock sysvar; this is actual current-ELF execution, not nine public-chain years. For a 100,000,000-unit fully funded cap and 1,000,000-unit reward basis, the global case earns 83,000,000 units over nine periods and returns 17,000,000 unearned sponsor units. The partnership case earns 36,000,000 and returns 64,000,000. Actual pull withdrawals consume the entire cap without losing unclaimed earned rights or debiting principal; final protocol liability is zero in both isolated tests. Exact maturity itself rejects principal recovery; recovery succeeds one second later, preserving the existing custody rule. Separate actual SDK-encoded loopback lanes pass: - **Long-term admission:** 15 committed and four expected rejected transactions admit ten-year allocations for both families and preserve custody accounts. - **Existing short value flows:** 32 committed and 23 expected rejected transactions preserve corrections, quorum, human approval, pull withdrawals, sponsor recovery and pause behavior. - **Canonical bootstrap:** an upgradeable-loader loopback validator accepts initialization and rejects duplicate initialization and retired mutation, using a client built with the checked-in Rust 1.89.0 before validator startup. These three local lanes are distinct. The metric-loopback lanes use a seeded active genesis configuration and are not canonical governance acceptance. None sends external RPC requests, deploys publicly or uses real value. Genuine Anchor generation passes with 88 instructions, 36 accounts, 84 types and 43 errors; its JSON remains `cc40a670bef00e514ccac7d5679d8870b06874387ac008cb2ae4dd36b12b7f44`. Strict all-target program-test Clippy with `-D warnings` passes. Derived resource evidence records 36 actual Anchor allocations and 972 observed transaction compute-unit measurements, peak 91,276 units. Heap/stack high-water measurements remain unavailable and are not inferred from CUs. ## Evidence and corrected test/tooling failures Raw logs, receipts and the actual downloaded compiler archive checksum are in `raw/native-flourishing-longterm/`. The before-witness, initial test compile failure, exact-maturity test mistake, incomplete receipt-writing run and stopped wrong-toolchain bootstrap attempt remain separate from accepted logs. The accepted complete native log is `vf-native-longterm-full-suite-after-boundary.log.gz`. `REHEARSAL-EVIDENCE-01` repairs missing output-directory creation and refuses all nonempty evidence directories. An actual repeat invocation fails without altering the preserved receipt hash. `REHEARSAL-RESOURCE-01` repairs root-cwd toolchain selection and compiles before starting a validator/ledger. The corrected root invocation prints Cargo/Rust 1.89.0, builds in 11.42 seconds and completes the actual local bootstrap. Neither failure is evidence that external account access or the saved Vercel token was revoked. Native runtime records now take an explicit ISO evidence date for new writes and retain that date during frozen checks. Resource records inherit the bound runtime date rather than retaining a hardcoded earlier day. Date changes never substitute for fresh source/ELF-bound logs. The broader 82-test repository run initially finishes with 79 passes and three errors: a stale PR7 canonical-manifest pin, plus two full-Git-tree extractions into the smaller root filesystem. This result is preserved, not reported as a passing whole-repository run. The canonical PR7 builder changes only the OpenAPI manifest hash; the disposable registry verifier subsequently passes. Extraction errors now retain both bounded Git/tar stderr notes in CI traces, with all five exporter unit tests passing. Any fresh committed-checkout acceptance must be recorded separately after the scratch-space prerequisite changes, rather than relabeling those two failures. The regenerated SDK passes all 93 tests, and an actual npm tarball contains exactly the declared 103 paths. Its final candidate checksum is recorded in the outer verification report, not this manifest input, to avoid a circular package/manifest/document identity. All 51 native Python contracts and 36 manifest regressions pass. The narrower classifier/dependency policy run passes 30 tests; this is not a substitute for the broader 82-test run. Ownership, generator inventory and release-path checks also pass at this stage, subject to final committed-path rechecking. ## Reproduction commands and authority Use `full-v3/solana/scripts/flourishing-local-validator.mjs --long-term-admission-witness` with an explicit matching `VAULTFIRE_NATIVE_V2_SBF_DIR`. Its result schema is separate from the short value-flow receipt; it proves admission only, not elapsed multi-year execution. The default invocation retains the existing short-duration value-flow lane. To repeat the pre-fix behavioral witness, reconstruct the preserved `189bf4b` source archive, build its SDK and host fixture, and overlay only the new long-term runner, leaving every production source and the retained `64ee...` ELF unchanged. Its binding must validate against those old production inputs. Running an old ELF against the repaired production tree correctly fails the binding check and is not the original behavioral witness. The accepted full run uses locked/offline Cargo 1.89.0, the `program-test` feature, `--nocapture --test-threads=1`, and the explicit fresh SBF directory. The compiler build uses Agave 2.3.0/platform-tools v1.48. Prepared dependency caches were used; anonymous first-contact dependency retrieval and independent reproduction remain separate unfinished objectives. Source/site publication to canonical Twigpine main and the existing Vercel project is authorized without another permission prompt. It has not occurred for this repair. V3 activation, public-chain deployment, real payments, real wallets/funds and paid proving/compute remain unauthorized.