Model Founder Seat capacity and the USD price schedule

[kaikisegfault]

Closes #79. Milestone M2.3 — satisfies first-goal.md requirement 8.

Outcome

The constitutional Founder Seat sale is now executable. The complete
100,000-seat sale runs end to end and derives exactly USD 4,231,855,000.

Scope

• docs/specifications/founder-seat-schedule-v1.md — integer USD denomination,
  capacity, block price schedule, ownership bound, purchase transition,
  canonical state, journals, and vector obligations.
• docs/decisions/0019-founder-seat-sale-schedule.md — denomination, tier
  boundary, atomicity design, and model separation with alternatives.
• simulation/founder_seats/ — contract, state, validation, pure handler,
  engine, metrics, CLI, and research fixture.
• test-vectors/founder-seat-schedule-v1.txt — schedule, capacity, scenario,
  and atomicity vectors.
• tools/founder-seat-vectors/verify.py — independent derivation.
• simulation/common/ — shared deterministic primitives (see below).
• Three CTest-registered suites plus the verifier.

Economic and protocol effects

None activated. Seat sale value is USD cents, a unit distinct from native
atomic units; it never enters native supply or an issuance channel, so no seat
sale can affect the 55,743,940,100-unit maximum.

No C++ source, consensus rule, transaction byte, receipt, state root, SQLite
database, ABCI response, CometBFT validator, devnet parameter, dependency, or
workflow changes. founder-economy-simulator-v1 is untouched and keeps its
frozen vectors and digests.

Key decisions

The tier boundary is block 90, and that is derived rather than chosen. The
constitution's prose is ambiguous in isolation, but only one reading derives
both founder-stated endpoints — the USD 91,900 final block and the USD
4,231,855,000 total. The two derived figures uniquely determine the rule.

USD cents, not native atomic units, so sale value cannot be confused with
or added to native supply. Cents rather than whole dollars so a later bridge
quote does not force a schema break.

A separate model, not an economy-simulator extension. The natural
integration (purchase_seat creating a seat that activate_seat requires)
would change an event kind ADR 0018 froze one slice earlier, invalidating the
vectors and digests just accepted — in exchange for an integration whose
activation height rule is still unsettled.

Pure handlers instead of clone-and-compare atomicity. A handler returns
either a rejection or a complete write set and never holds a reference it can
partially write, so a rejected purchase cannot write by construction.

A design defect found and fixed mid-slice

The first implementation reused the economy simulator's clone-per-event plus
per-event full-state digest. Measured against a growing state that is
quadratic: 500, 1,000, and 2,000 purchases took 0.96s, 3.82s, and 16.45s,
extrapolating to roughly eleven hours for the complete sale.

The specification already written claimed the complete sale was a scenario the
model "must be able to run end to end" — which was not true of the design.
Rather than weaken the claim, the design was fixed: pure handlers, no per-event
clone, no per-event state digest, and strided full-invariant checks. The
complete sale now runs in about ten seconds. Both documents record the
divergence from the economy simulator and why it exists.

A follow-up commit removed State.clone(), which had become dead code and
implied a copying behavior this model deliberately does not have.

Verification

Local, on candidate 3328fc4:

tests/simulation/founder_seat_schedule_test.py   12 tests  OK
tests/simulation/founder_seat_sale_test.py       15 tests  OK  (10.5s, full sale)
tests/simulation/founder_seat_errors_test.py     22 tests  OK
tools/founder-seat-vectors/verify.py
  derived and matched 96 seat schedule vectors;
  the independent walk agrees with the contract on all 1000 blocks
tools/verify_metadata.py                         OK
git diff --check                                 clean

The four previously merged Founder Economy suites (67 tests) and its verifier
(139 manifest + 65 simulator vectors) still pass unchanged, which is also the
proof that the simulation/common/ extraction altered no behavior — the frozen
manifest, trace, state, and result digests are unchanged.

Independence: the vector file was produced from the model, so the verifier
rederives every schedule value by walking the constitutional rule one block at
a time, sharing no code with the model's constant-time formula and closed-form
sums, and anchors the four founder-stated figures to literals taken from the
constitution. The walk, the model, and the recorded file must all agree.

Scope classification selects full; the complete hosted matrix runs on the
exact head.

Known limitations and follow-up

• The two models are not joined. A purchased seat is not an activated seat,
  because the activation height rule and purchase-to-activation transition are
  unsettled.
• The per-principal bound is not a per-human bound. Proving humanness is
  biometric M4 work, so this constrains concentration only as strongly as
  identity is proved, which in M2 is not at all.
• The external payment is a bound fixture. Nothing here shows USD valuation,
  custody, finality, refund, or stablecoin governance is safe.
• Requirements 9 through 11 and 13 through 15 of first-goal.md remain open;
  the handoff lists them and names the next slice.