[raymondjacobson]

Drafts V2 reward settlement with signatures bound to their complete payout context and a manager-authorized oracle policy. Policy changes increment an epoch to revoke outstanding claims; a disabled policy pauses settlement, and claims expire by slot. The legacy settlement instruction is rejected unconditionally.

This is NOT ready to merge or deploy. Disabling legacy settlement affects all pools, including ordinary AUDIO rewards. The API/SDK and static reward migration, trusted reward/pool validation, chain-domain definition, compiled BPF tests, and independent security review remain required. reward-manager/attestation-v2.txt records the wire format, migration requirements and validation limits. Production containment is separate and remains active.

Validation completed:

• Twelve native library/policy tests pass with Cargo and RUSTC pinned to 1.59.0. They cover cross-language vectors, role separation, manager authorization, policy identity, immutable domain, epoch overflow, revocation, expiry, nonce bounds and unconditional legacy rejection.
• New settlement integration tests compile. They cover prefunded policy creation, secp256k1 attestations, altered claims, token transfer, replay and revocation.
• Full settlement execution is NOT validated: native simulation fails in the existing initialization CPI helper because solana-program-test 1.8.14 requires the token program AccountInfo. The new settlement tests must run against compiled BPF programs with the supported toolchain. Existing legacy transfer/burn success tests still require V2 migration.

No on-chain upgrade, policy transaction, claim or funds transfer was submitted.

Companion draft: OpenAudio/go-openaudio#630