Protocol Sync Intelligence Brief Full upstream reconciliation complete. Toly pushed a structural program upgrade — per-market admin limits baked into the slab config as immutable constraints. We absorbed the entire delta into the ALIENTOR stack. Every layer — on-chain parsing, instruction encoding, transaction building, error handling, operator tooling, and the live trading UI — now speaks the same wire format as the upgraded binary. The core change: governance guardrails at the config level. Three new immutable parameters get stamped into every market at initialization time. Once set, the program enforces them forever — no admin override, no multisig escape hatch. Maximum maintenance fee per slot (128-bit unsigned). Maximum risk threshold (128-bit unsigned). Minimum oracle price cap floor (64-bit unsigned). These act as hard ceilings and floors. Any subsequent admin operation that would violate these bounds gets rejected on-chain with the new InvalidConfigParam error. This is protocol-level trust minimization — market deployers commit to parameter bounds at genesis. Slab geometry shifted. The config region grew by 48 bytes to accommodate the three limit fields plus reserved space. Config length moves from 320 to 368. The engine block shifts downstream from offset 392 to 440. Total slab allocation grows from 992,560 to 992,616 bytes. Every offset-dependent read — bitmap parsing, account lookups, engine state extraction, vault balance reads — recalibrated across the full stack. Four independent parsing layers updated to match: the canonical server-side parser, the browser-side parser, the transaction builder's local constants, and the rent calculation constant for new market deployments. Three new instructions for post-resolution lifecycle. Tag 21: admin force-close for abandoned accounts after market resolution. Requires the resolved flag, zero position, admin signature. Eight account metas with the full vault/token/oracle context. This is how you clean up stragglers after a binary market settles. Tag 22: insurance withdrawal policy configuration. Admin sets an authority, minimum withdrawal base, maximum withdrawal basis points, and a cooldown period in slots. Rate-limited insurance access for resolved markets — the authority can drain incrementally but never exceed the configured bounds per epoch. Tag 23: execute a rate-limited insurance withdrawal under the configured policy. The authority submits an amount, the program checks it against the min/max/cooldown constraints, and transfers from the vault if valid. Seven account metas including clock for cooldown enforcement. All three fully encoded — instruction data layouts, account ordering specs with exact signer/writable flags, and high-level encode functions ready for both CLI and programmatic use. InitMarket wire format updated. The initialization instruction now expects three additional fields between the initial mark price and the risk parameters block: the three admin limits. Encoded as u128, u128, u64 in exact wire order. The CLI accepts them as --max-maintenance-fee, --max-risk-threshold, and --min-oracle-price-cap. The UI transaction builder injects generous defaults — trillion-scale ceilings for fee and threshold, zero floor for oracle cap — ensuring existing market deployment flows don't break while giving operators full control when they need it. Two new program error codes. Code 26: InvalidConfigParam — fires when any admin operation attempts to set a value that exceeds or undercuts the market's immutable limits. The CLI surfaces technical guidance; the UI translates to actionable user language about checking parameter constraints. ...