Satsuma
S

@satsuma/experiments

PublicThe system
Clone

Governed runs of Satsuma trading on tangerine over ISMP. Results are published as articles when a run completes.

Lab runs, not the live system. Each run uses lab chains that are reset afterwards, with synthetic users unless a run says otherwise. Nothing here happened on the Satsuma chain.
RunsLab run · 29 October 2026, 11:28 UTC

The first fast-mode scenario runs

Can each way the system maintains its products be shown end to end in minutes, starting from a saved chain state instead of from the beginning?

27/32 passed5 inconclusive · 4 d 2 h

Setup

Chains
Satsuma lab chain
  • RoleHome
  • KeptLab, not retained
tangerine lab chain
  • RoleProving
  • KeptLab, not retained
Users
  • UsersSynthetic
Model
No model: scripted answers
  • ModeScripted
Operator seat
  • SeatBy delegate
Unattended
Yes: nobody was watching to step in
Time
4 d 2 h · ended 13:26 UTC

Checklist 32 items

Every item, unless its row says otherwise
  • ChainLab
  • UsersSynthetic
  • DecisionsScripted

Handling liquidity withdrawals

0/1 passed
InconclusiveA brief dip in the market's liquidity is ignored; a lasting withdrawal stops the product, which starts again when liquidity returns2 of 4 attempts

Retiring a product cleanly

3/7 passed
InconclusiveFunds on tangerine are swept to Satsuma's own treasury there, and nowhere else2 of 4 attempts
InconclusiveThe swept funds on tangerine can be moved again by a council vote2 of 4 attempts
InconclusiveNothing is left stranded on tangerine at an address no one controls there2 of 4 attempts
InconclusiveSatsuma's own record of the retirement matches the chain2 of 4 attempts
PassThe product's retirement is voted and carried out4 of 4 attempts
PassThe retired product holds no funds afterwards4 of 4 attempts
PassNo trading continues on the retired product4 of 4 attempts

Stopping and restarting a product

2/2 passed
PassA product adopted with a known critical issue is stopped at once2 of 2 attempts
PassThe product starts again after the fix2 of 2 attempts

Fixing by a setting change

1/1 passed
PassThe fix, a changed setting, passes the council's vote and takes effect2 of 2 attempts

Fixing by redeploying

1/1 passed
PassA fixed version of the exchange's router is built, deployed in its place and accepted by vote, while the rest of the exchange stays where it is1 of 1 attempts

Fixing by an in-place upgrade

2/2 passed
PassA fix lands as an in-place upgrade: same address, same holdings, new code1 of 1 attempts
PassA fix lands as an in-place upgrade: same address, same holdings, new code1 of 1 attempts

Rolling back a bad change

2/2 passed
PassAfter the upgrade, the watch period ends with nothing wrong found1 of 1 attempts
PassAn upgrade that made things worse is rolled back to the version before it1 of 1 attempts

Refusing changes that corrupt stored data

1/1 passed
PassA first fix that would corrupt the product's stored data is refused, and a corrected fix lands3 of 3 attempts

Fixing by a migration

1/1 passed
PassA fix lands as a migration: a successor is deployed and the holdings move to it across the two chains1 of 1 attempts

Reviewing its own products

1/1 passed
PassThe review after a fix reads the code the chain now runs, not an older copy1 of 1 attempts

Stolen-key safety

2/2 passed
PassThe test of a stolen deployment key ran to a conclusion3 of 3 attempts
PassEvery administrative call made with the stolen key is refused3 of 3 attempts

Handling a cross-chain outage

6/6 passed
Pass6 items passedShow them
PassFailed deliveries during the outage are filed as an incident on the link, not as a fault of the product2 of 2 attempts
PassThe outage is filed within five minutes of the first failure2 of 2 attempts
PassTrading works again once the link is back2 of 2 attempts
PassFailed deliveries during the outage are filed as an incident on the link, not as a fault of the product1 of 1 attempts
PassTrading works again once the link is back1 of 1 attempts
PassThe outage incident is closed as an outside cause once trading has recovered, and no fix is built for it1 of 1 attempts

Defending against market manipulation

4/4 passed
PassA large trader pushes the market far off its price and holds it there2 of 2 attempts
PassThe pushed market is detected as a breach of the product's rules2 of 2 attempts
PassThe product is stopped within the allowed number of checks2 of 2 attempts
PassThe stop comes from the product's declared rule on market depth2 of 2 attempts

Tracking security advisories

1/1 passed
PassTwo security advisories against the same package become two separate issues1 of 1 attempts

What this proves

  • Which maintenance paths reached their expected end from a saved state, with scripted model answers, while the scenarios were first being built.

What it does not

  • The model's own judgment: every model answer is scripted.
  • Repeatability: the code changed between some of these attempts.

What broke, what was fixed

The record of this run does not say whether a person stepped in, so it does not count as a run without repairs.

Cost in tokens

Not recorded: this run has no chain-derived scorecard.

Archived evidence

The lab chains this run used were reset afterwards and are not retained, so nothing here links to an explorer. The record below is the archived copy.

Scorecard
None archived.