Require confirmed teardown for reward eligibility

[wallscaler]

Documents the boundary between customer execution and the subnet. Contract only. No reward-policy, wallet, or chain behavior changes, and nothing is activated.

What changed

Reward eligibility requires proven teardown. The condition previously read "the attempt reached SUCCEEDED". An attempt also reaches a terminal state when the cleanup deadline expires without confirmed absence, so as written a provider that never tore down its resource could produce a reward-eligible fact. That inverts the incentive on the one behavior the customer plane most needs to enforce.

The condition now requires TerminalBasis.PROVIDER_ABSENCE with ProviderAbsenceStatus.PROVEN_ABSENT, naming the provider contract's own terms. The contract already enforces this by rejecting a deadline basis that targets SUCCEEDED, so this closes a documentation gap rather than an implementation one. A consumer implementing from this document alone could otherwise reintroduce it.

Validators deduplicate independently. The uniqueness condition relied on the producer's durable high-water state, while the same document says the validator contract never falls back to provider self-reporting. Each consuming validator now rejects a repeated (job_id, attempt_id) against its own replay state. Producer-side deduplication is a first filter, not the authority.

The metric is frozen. "A bounded fact such as verified_work_units" is now exactly verified_work_units, defined as a non-negative integer count with no latency, uptime, or capacity component. Changing it is a versioned reward-policy change, not an implementation detail.

Cathedral-operated capacity cannot set the comparative baseline. Using measurements from capacity the operator runs to score external capacity would let the operator set the bar it grades others against. Limited to operational monitoring until a versioned decision says otherwise.

A currently unsatisfiable condition is stated rather than left implicit. Proving resource absence requires controlling the resource lifecycle, so external providers cannot yet satisfy the teardown condition. That constraint is written down explicitly, because a gate that cannot be satisfied and is not documented reads as a working path that happens to be quiet.

Review

Reviewed against the shipped provider contract. An earlier review flagged the teardown gap as an implementation risk; that was refuted by reading the contract, which already forbids it. It stands as a documentation defect only.

Scope

Documentation only, 2 files. No code, no tests, no activation.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.