predict: refresh NAV per market and flush from stored marks (DBU-557)

[0xaslan]

Summary

• New lifecycle-gated plp::refresh_expiry_nav: takes a transaction-loaded Pricer like the priced trade flows, rebalances one live market's cash, walks its payout tree once, and stores a ValuationMark (exact per-order liability + oracle anchors + landing time) on the ExpiryMarket. Several markets can share one refresh PTB. A Pricer cannot exist for a past-expiry market, so refresh is live-markets-only by construction; terminal markets keep their existing sweep path (rebalance_expiry_cash).
• The flush no longer walks any tree: start_pool_valuation still snapshots the active set into the hot-potato completeness proof, but the per-market step is now collect_expiry_nav (replaces value_expiry), which takes the market read-only plus a transaction-loaded Pricer and returns raw atoms — live free cash and the marked liability, unfloored. The flush sums both across markets and applies a single zero floor at the pool level (lp_pool_value), so an underwater market (a legitimate transient while backing_buffer_lambda < 1: adverse redemptions can extract more cash than their λ-scaled backing reduction) nets against the pool instead of being silently floored to zero per market. FlushExecuted emits both raw sums, making aggregate-underwater observable.
• Mark acceptance is split by altitude. Per market, the flush enforces only the freshness ceiling (the one guard a stalled feed cannot fool). Drift is a measured fact, not a per-market judgment: the mark exposes drift(pricer) — the potential dollar impact of oracle movement since its walk — and the flush aggregates Σ drift across markets and judges it once against pool NAV in finish_flush (assert_aggregate_drift_acceptable). This makes the guarantee direct: Σ drift ≤ threshold × pool NAV bounds the PLP-price error in its own units, which no per-market check can do (the per-contract → PLP translation floats with book size / pool equity). The drift measurement is a closed-form envelope (pricing::drift_envelope): the mark snapshots its walk's raw oracle anchors (forward + SVI params), and drift(pricer) bounds the worst single-contract price move between anchor and live — the normal curve's max slope (0.4) times a term-by-term bound on the worst d2 move (forward shift over the variance floor + one Lipschitz charge per SVI parameter delta over the unpinned strike band). Bound by construction: the surface IS those six numbers, so no reshape can hide between samples — chosen after measured evidence that sampled probes admitted 84–89%-of-face wing reshapes. The skew-correction term's own drift is charged by three further legs (its tails also force a dynamically-widening band threshold — deep-wing corrections can pull prices off their 0/1 pins), and the term assembly runs in u128 with a single fail-closed cap so envelope-corner surfaces saturate instead of aborting mid-flush. Dollarization multiplies by the book's live face quantity — an O(1) read of aggregates the payout treap already maintains (drift moves face, not value: equal-liability books can differ 100× in sensitivity). The measured drift is priced into the flush mark as a bid/ask spread rather than enforced as a threshold: the mark is two-sided — supplies price the pool at mid NAV + Σ drift, withdrawals at mid − Σ drift — so the true pool value provably sits inside the interval, the transacting party bears the marks' staleness, incumbents can be neither diluted nor drained, and a same-flush round trip strictly loses the spread (stale-NAV arbitrage dies by construction). Fresh marks collapse the spread to an exact single mark. There is no drift tolerance knob at all — the spread is fully determined by the measured bound (ValuationConfig holds only the freshness ceiling, the stalled-feed backstop) — and flush availability is unconditional: a wide spread self-resolves through each request's existing min_plp_out/min_dusdc_out limit (miss, carry, refund). FlushExecuted emits the half-spread (total_drift).
• Mint, live redeem, and liquidation all write their liability deltas through to the mark (+net_premium, −redeem_amount, −removed_live_value). The liquidation leg was a review finding: knock-out fires at qty·P ≤ floor/ltv, i.e. while the order still carries ~F·(1/ltv − 1) of live value, so every liquidation path (standalone entries and the sweeps inside mint/redeem) now returns the removed value and decrements the mark — without this the stored liability overstates and the supply queue over-mints. Cash moves need no maintenance because free cash is read live at flush. The mark struct and its freshness/drift acceptance policy live in a dedicated valuation_mark module.
• The pool-wide valuation lock (valuation_in_progress) is removed along with all 18 guard sites — the flush is one atomic PTB over read-only markets, so the stored-mark acceptance checks replace the lock's coherence duty.
• New admin-tunable ValuationConfig (nav_mark_freshness_ms default 60s, nav_mark_drift_epsilon default 0.02, both with envelope bounds), a NavRefreshed event, and max_payout_tree_nodes lowered 1,000 → 950.

Why

• Setting: the pool flush is the one flow that prices every active market at a single mark and drains the LP supply/withdraw queues against it; today it must value all markets inside one transaction because the valuation hot potato is transaction-local.
• Problem: Sui caps dynamic-field child objects loaded per transaction at ~1,000, and the flush's tree walks accumulate against that cap across all markets — at current testnet state the flush aborts inside dynamic_field::borrow_child_object and LP queues cannot fill (predeploy C-1 capacity model; this is the measured object-cache wall, not a compute wall).
• Trigger: the live testnet flush has been failing since 2026-07-13; recovery is non-durable while markets keep growing.

Linear / Context

• DBU-557
• Predeploy record: packages/predict/predeploy/open-items.md § C-1 (capacity model + evidence).

Key Decisions

• Store the liability, not the NAV. Free cash is O(1), exact, and oracle-independent, so the flush reads it live; only the oracle-priced tree walk is memoized. Cash rebalances between refresh and flush therefore cannot double-count or stale the mark.
• Write-through instead of invalidation. Every liability-changing op has an exactly-computable delta at its own oracle, so mutators maintain the mark instead of clearing it — organic trading does not block the flush, and blocking it deliberately requires moving real value. Residual: deltas are priced at the op's oracle while the mark's sum is anchored at its refresh oracle; the drift guard bounds that mixing, and the planned invariant tests (follow-up) will pin stored-liability ≡ fresh-walk.
• The mark is now bounded-stale, not exact-at-one-instant. Each market's mark is exact at its refresh; the flush accepts it only within the freshness ceiling and drift tolerance, bounding any order's price drift to ~0.4 * epsilon of face. Both queue directions still price at the same composed mark. Accepted and to be disclosed in docs/risks.md with the follow-up; this supersedes the earlier decisions.md rejection of a multi-tx valuation (its premise — one PTB can afford the full walk — is what C-1 falsified).
• Refresh carries the same privilege as the flush start (registry-generated MarketLifecycleProof): mark timing prices the queues, so refresh authority carries the flush's existing oracle-timing trust. For parallel refresh submission the cap can be held as a Sui party object — no Move change required.
• A settled or past-expiry market blocks the flush fail-closed (its mark cannot revalidate): sweep it via refresh_expiry_nav/rebalance_expiry_cash so it leaves the active set, then retry. Skipping it would undercount pool NAV while its cash is still inside the market.
• Node cap 950: a single market's refresh walk must now fit one transaction's object budget (measured single-market crossing ~982 children), so the per-market cap needs headroom below the wall.

Scope / Descoped

• Source-only draft to iterate the contract shape. Deliberately not included: unit-test updates (existing suites reference the removed lock and old value_expiry shape and will fail), harness/simulation TS + python_replay updates (9 files call the old entrypoints), keeper service changes, predeploy/docs record updates (C-1 closure, response-policy entry for the lock removal, risks.md disclosure), and the capacity re-measurement that will finalize the cap values and default thresholds. Each lands as follow-up work under DBU-557 once the shape settles.

Test Plan

• sui move build --path packages/predict --warnings-are-errors — clean (exit 0; one pre-existing suppressed lint)
• git diff --check — clean
• Predict Move suites updated + green (follow-up)
• Stored-liability ≡ fresh-walk invariant tests at frozen oracle (follow-up)
• Localnet capacity re-measurement: per-market refresh footprint, K-markets-per-PTB packing, refresh→flush latency (follow-up)

Risk / Rollout

• Pre-deploy source change; no deployed objects affected. Ships with the next contract publish alongside its keeper rework.