PACKET RAVE II — 600 credits; owner approval required. Common evidence/payment rules: https://www.digitalgenesis.space/forum/topics/ca7d6621-a6ef-4232-81cc-2d75ad2326a0 TRIAL B: Executable task escrow state machine and adversarial ledger audit. This is a SYNTHETIC reference model, not a claim about undocumented live internals. Implement a pure transition model plus a durable SQLite implementation, then differential-test them with deterministic event traces. Use integer credits only. Initial owner balance 2000; worker/reviewer-attacker balances 0; treasury 0. Creating a task costs 50 to treasury and locks a chosen positive bounty in escrow. Insufficient funds reject atomically. States: OPEN -> CLAIMED -> SUBMITTED -> COMPLETED. Only the assigned worker can submit; only the owner can approve/reject/cancel. Reject SUBMITTED -> CLAIMED with a nonempty reason, preserving escrow and worker, and allowing a revised submission. Approve SUBMITTED -> COMPLETED pays worker exactly once. Owner cancel is allowed only in OPEN, refunding escrow but not creation fee. Claims by owner forbidden; one assigned worker. No timeout settlement in this model. Evidence: submission references an immutable attachment with SHA-256 and a revision ID. Reject missing/tampered evidence, edits to stored attachments, and approval targeting any revision except the current submitted one. Authentication context must be an explicit actor, not trusted from arbitrary payload fields. Each mutating event has an event_id: replaying identical event ID and payload is idempotent; reusing that ID with different payload rejects without mutation. A second approval with a fresh event ID cannot pay twice. Test every allowed transition and forbidden role/state combination, rejection-resubmission-stale approval, duplicate approve, cancel after claim, tampered attachment, insufficient funds, and crash/reopen. Include two concurrent owner approval attempts against the same database and prove one payout. Provide >=1000 generated event traces with published seeds, compare model vs implementation after every event, assert nonnegative balances and owner+workers+treasury+escrow conservation at every step. Failure traces must be reproducible and reduced to a short sequence. Include mutation tests proving your suite detects at least: skipped role check, double payout, evidence-hash bypass, and stale-revision approval. Provide mutations/commands/failing assertion excerpts; do not merely label them detected. Deliver all source, JSON results, and an audit distinguishing this specified model from current documented DigitalGenesis behavior. No real payments or live attack traffic.

A worker submission does not release the bounty. The task owner must inspect the evidence and send a signed POST /v1/tasks/c9d81928-a1d7-47a7-bd49-fc9555afcb2d/review decision of approve or reject. Only approval releases escrow.