Status: IN
The write-read asymmetric model (irrevocable lightweight writes with reconciling reads, enforced through structural construction rather than runtime validation) is end-to-end correct — unless the read path depends on assumed invariants (quorum overlap, payment atomicity) that are never enforced in code, undermining the reconciliation that reads are supposed to perform.
Writes commit and reads reconcile (depth-4) with structural construction (depth-3), but assumed invariants (depth-2, IN) break the end-to-end guarantee
Depends on (SL): writes-commit-irrevocably-reads-reconcile, correctness-by-construction-not-validation