[ascandone]

Problem

A pull debits its source at once; the posting only exists once a send drains the queue. Two shapes pass vm.Verify and go wrong with no error:

• Funds still queued when set_current_asset runs are posted under the new asset.
• Funds still queued when the run ends are a debit that never becomes a posting.

Compiled numscript never emits either: every send statement either pulls exactly what it sends (check_enough_funds) or sends everything it pulled. They matter for bytecode that did not come out of this process's compiler, which is what the ledger replays.

Fix

Exec returns an InternalError for both, via a new funds.RunState.HasQueuedFunds():

• errSetAssetWithQueuedFunds at set_current_asset
• errEndWithQueuedFunds at the end of the run

HasQueuedFunds() is a length check. For that to hold, Pull no longer queues a zero amount, matching PullUncapped. Before, a zero-cap or empty-source pull queued a zero entry, and a send that stopped once its cap was met left it in the queue (e.g. send [USD 0]). A zero entry never produced a posting, so outputs are unchanged.

This is a run-time check because it is not statically decidable on the current bytecode: whether a capped send empties the queue depends on the balances. bytecode-verifier.md documents it under "What it does not check". #226 is the static alternative, at the cost of a compiler change and a bytecode version bump.

The two TODO crashes comments on the ext-word reads in vm.go are removed: Verify rejects a truncated two-word instruction, and Exec is total only for verified programs.

Not changed

• Pull destination aliasing its cap or overdraft: rejected by Verify since fix(vm): reject a pull whose destination aliases its cap or overdraft #225, not checked again in Exec.
• Exec on unverified bytecode can still panic (truncated instruction, out-of-range register or pool index); verify-first remains the contract.

Tests

• vm_test.go: each check, plus a zero-amount pull that must not trip it.
• ir_test.go: both shapes as IR, so they sit in the "sequences the compiler never emits" corpus.
• go test ./... (including the frozen bytecode corpus) and the difftest module pass.

Performance

The run-time checks themselves: BenchmarkCompiledVM*, 8 runs each against main, benchstat: no regression, identical B/op and allocs/op.

Not queuing zero amounts, 6 interleaved runs against the previous commit:

Benchmark	ns/op	allocs/op
{@a @b @c}, @a and @b empty (ad hoc, not committed)	−3.6%	14 → 12
CompiledVMAllotment	+0.8% (noise)	42 → 42
CompiledVMCapped	+0.7% (noise)	23 → 23

[NumaryBot]

The required automated review completed with no remaining findings.

[NumaryBot]

The required automated review completed with no remaining findings.

[NumaryBot]

The required automated review completed with no remaining findings.