The fee reserve: RESERVE_FEE and validation rule 7

[EvanWinget]

What this adds

RESERVE_FEE at opcode 0x50, the vocabulary's fee floor, and validation rule 7: the transaction's fee (inputs minus outputs) must be at least the exact sum of every reserve of every BitLisp input, error insufficient_fee. The fee reserve is the fourth condition sort beside claims, asserts, and message records: counted, not idempotent, occurrences sum. Semantics match Chia's deployed RESERVE_FEE exactly, probe-verified (16 probes against the chia_rs 0.46.0 wheel under COST_CONDITIONS, provenance in the condition record's section 2).

The unit also records four declines (decision 21): ASSERT_FEE_LE (transaction-wide form is merge-poison per decision 14, per-input form decomposes into ASSERT_MY_AMOUNT plus claims), ASSERT_OUTPUT_COUNT in both exact and floor forms, ASSERT_INPUT_COUNT mirroring it, and the witness-dependent grid cells (weight, fee rate) as self-referential. The reserved tier is the recorded reintroduction path. The same session ratified the Phase 2 sequencing: AGG_SIG next, rule 5 last so costing prices the complete vocabulary.

A follow-up ratified after the review landed as the final two commits: decision 22 settles the cross-rule error question raised in PR 39 and re-raised by this review's surviving check-reorder mutant. Fail-fast stays, multi-violation error codes are unpinned by design, and full-enumeration diagnostics are recorded as Phase 3 and 5 tooling.

Spec authority

• spec/CONDITIONS.md: the RESERVE_FEE entry, the fees block, the trimmed planned list.
• spec/VALIDATION.md: rule 7, the fee-reserve sort bullet, the composition guarantee's reserve sentence, rule 2's extended validity enumeration, rule 4's counted bullet, four family invariants, and the preamble's error-code paragraph (decision 22).
• docs/condition-record.md: decision 21 (seven parts), decision 22, divergence C15 (operand domain, MAX_MONEY at parse against Chia's below-2^64 at comparison), register row 7.

Read the commits in this order

1. spec: the normative text, self-contained.
2. docs: decision 21, C15, provenance, and the catch-up corrections described below.
3. validation: the implementation, one parse function and one comparison.
4. tools: the pinned JSON form.
5. vectors: 14 conditions cases, 21 validation cases.
6. tests: 10 hypothesis invariants plus two deterministic separating tests.
7. spec: the decision 22 error-code paragraph.
8. docs: the decision 22 record.

Verify independently

.venv/bin/pytest python/tests                       # 153 passed
.venv/bin/python tools/run_vectors.py               # 26 files, 829 cases, 0 failures
.venv/bin/python tools/diff_clvm.py --count 10000 --seed 823   # 0 failures
ci/lint/lint.sh

Mutation teeth: max-semantics, set-collapse, strict-inequality, 32-bit truncation of either comparison side, and lexicographic atom-compare mutants all die in the vector corpus alone.

The five-agent review, catches folded in pre-PR

• Spec lens: three stale sort enumerations amended for the fourth sort (rule 4's constrains-nothing bullet, the one-way implication paragraph, CONDITIONS.md's intro), rule 7 reads amounts not content, invariant clause covers zero-amount additions.
• Implementation lens: a misplaced error-code parenthetical in the RESERVE_FEE entry. Full parse-edge and validation probing found nothing else.
• Adversarial lens: no composition counterexample in 20,000 randomized merges, no DoS shape. Substantive catch: decision 14's line listing the fee reserve as per-spend value protection was an over-read. The floor is fungible across inputs, so an aggregator can capture a spend's surplus while covering the reserve from their own value. Corrected in place, pinned by the new surplus_capture_with_attacker_input acceptance vector.
• Coverage lens: three mutants survived the original corpus, 32-bit truncation of either comparison side and lexicographic atom comparison. Four separating vectors added (the recorded above-2^32 lesson, plus off-boundary cases the boundary-heavy corpus lacked), and the hypothesis pools now cross 2^32. All three mutants now die on vectors alone. Its third finding, the surviving check-reorder mutant, is resolved by decision 22 rather than a vector: the mutant surviving is now the specified behavior.
• Docs lens: decision 19 sequencing-flag citation corrected (the flag was session state, not repo record, sequencing now recorded fresh in decision 21), the 9-byte operand claim corrected (chia_rs accepts a canonical 9-byte encoding with a protective leading zero), decision 20's stale register reference, and the comparison doc's pre-existing staleness from PRs 38 and 39 caught up.

Flagged for your judgment

• int64 port note. About 4,400 MAX_MONEY reserves overflow a signed 64-bit accumulator. C15 records the wide-accumulator obligation for the hardened implementation, and rule 5's costing will bound condition counts. No multi-kilobyte vector added, tell me if you want one anyway.
• The evaluation doc was touched. Obligation 4's universal-asserts line gained a dated parenthetical recording the decline. It is the design-case document, so review that one-line amendment with its own eye.
• The counts decline was the 65 percent call. Recorded as "for now" with the reserved tier as the path back, per the chat ratification.