Out of Scope

Move’s resource-safety theorem establishes conservation, while the Move Prover’s self-payment example exposes a separate choice about intended transaction behavior. Mysticeti’s authors connect their protocol to Sui through documented implementation adaptations, then compare production-ready systems in a private deployment. These cases show what must carry over when a technical result supports an operational decision. Sui’s 2023 performance disclosure adds workload and counting conventions; a historical fast-path migration and the Cetus recovery record add mechanism identity and institutional authority. Reconstructing each connection gives the result a specified operational use and identifies where the correspondence remains incomplete. The analysis does not identify an effect of research reputation on investment, exchange listings, delegation or valuation.

Sui Foundation’s April 2023 performance update identifies the earlier 120,000 TPS result as a single-validator, batched demonstration on an eight-core M1 MacBook Pro. Its newer experiment used 100 globally distributed validators and homogeneous payments, with reported throughput varying by batch size. The update counts individual operations inside a Programmable Transaction Block as transactions (Sui Foundation 2023, “The Journey” and “Measuring Sui’s Throughput”). The disclosure supplies conditions for interpreting the numbers.

A capacity decision needs those conditions. An application that performs contended swaps and an experiment that transfers independent coins can impose different demands on execution. Counting submitted blocks instead of their internal operations changes the numerator. Observing a lightly used public network changes offered load. A quotient between peak experimental throughput and realized public traffic therefore cannot, without a common workload and unit, identify the fraction of capacity being used or the size of an exaggeration.

An evaluator choosing an application needs a result that answers the relevant operational question and evidence that its conditions carry over. A resource guarantee and a transfer specification answer different questions, as do a protocol experiment, an implementation comparison and a decision authorizing exceptional action. Each can supply useful technical information when the connection is shown. A researcher’s reputation cannot supply the missing correspondence.

Blackshear and colleagues formalize an executable Move bytecode language. Their resource-safety result relates the resources present before and after execution to the resources introduced or eliminated by the relevant instructions. Theorem 5.10 establishes that conservation relation for a well-formed execution sequence. Creation and destruction remain actions controlled by the declaring module; resource safety does not mean that a program can never create or destroy an asset (Blackshear et al. 2020, §3.2 and Theorem 5.10).

That property removes a class of programming hazards. An application’s intended transfer policy remains a separate question. A module might conserve its resources while sending them to an unintended account, computing an undesirable amount or enforcing an inadequate authorization policy. These are reasons to specify additional behavior, rather than reasons to discount conservation. Whether a resource represents a sound economic asset also depends on facts that the language model does not define.

The Move Prover gives a worked example of that additional specification. It translates Move and written properties through a verification model to Boogie. In its 2020 evaluation, the authors verified the specified functions in two core Libra modules. Their payment example revealed that a proposed condition about the payer’s balance failed when payer and payee were the same account. They added a check rejecting that case, simplifying the specification (Zhong et al. 2020, §§3–6, especially pp. 145–146).

The example shows how verification can change the question a developer is asking. Conservation permits the resources to remain in the same account. A specification that says the payer’s balance must decrease requires a different treatment of self-payment. Deciding whether self-payment should succeed is part of defining the transaction’s intended behavior. The verifier can expose the consequence of that choice without choosing the policy for the developer.

The 2020 paper also describes its written specifications as concerning single executions of functions and identifies global properties as further work (Zhong et al. 2020, p. 148). That is a dated account of the evaluated tool, not a claim that every later Move verifier has the same limits. Applying the paper to a deployed Sui application would require identifying the application’s code, specification, tool version and deployment correspondence. A language result and an application verification can contribute to the same assurance, with different premises.

Mysticeti illustrates a stronger connection than a publication title alone. Its authors develop a DAG consensus protocol and a fast commit extension, prove properties under their model and evaluate specified implementations. Their experimental section identifies hardware, network regions, transaction size, offered load and failure conditions. Its latency measurements concern commitment under those conditions (Babel et al. 2025, §§V–VII).

Section VIII then describes the work of integrating Mysticeti-C into Sui: crash recovery, synchronization, additional testing and adaptations to the surrounding system. It records the July 2024 mainnet switch. Table I compares production-ready Mysticeti-C and Bullshark implementations with 137 validators at 5,000 TPS. The source of those comparison measurements is a private Vultr deployment, although the section is titled “Mysticeti in Production” (Babel et al. 2025, §VIII, pp. 15–16).

The integration and the measurement answer related questions. The adaptations show how a protocol design was connected to an operational codebase. The private comparison tests the resulting implementations under a specified configuration. Reading the table as an estimate of every mainnet transaction’s latency would change the population. Dismissing the integration as a purely theoretical result would discard the very correspondence that makes the research useful.

An evaluator can use the paper to identify what must be checked in another setting: the implementation, relevant load, committee and fault behavior, and the definition of completion. The paper can also motivate a new measurement. It does not, by itself, answer questions about an application’s workload, a current deployment or the independence of validator operators. Those conclusions concern different observations and may need different study designs.

Source names can obscure the correspondence when an architecture changes. In the pinned July Sui source, disable_preconsensus_locking describes routing transactions through consensus and moving owned-object conflict detection after consensus. The historical Mainnet response preserved in the July packet reports that flag and mysticeti_fastpath as enabled together. Repository history distinguishes the retired original path from the newer Mysticeti mechanism (MystenLabs 2026a; July evidence packet).

The earlier interpretation treated the first flag as proof that a fast path had disappeared. The two mechanisms cannot be identified by the shared phrase alone. A statement about pre-consensus locking must follow that mechanism’s code and configuration; a statement about Mysticeti’s fast commit path must follow its own mechanism. The July response establishes reported configuration, while matching a validator’s executable to a source revision is an additional task.

The replacement GraphQL interface supplies a later observation. A checkpoint-specific response associates checkpoint 335421587 with epoch 1284 and protocol 138, and reports both disable_preconsensus_locking and mysticeti_fastpath as enabled. The inspected indexer derives configuration tables from protocol-version and chain rules; GraphQL reads those tables. The response therefore identifies the service’s interpretation of that epoch, while validator binaries and transaction latency require separate observations (MystenLabs 2026b; Sui GraphQL 2026).

An analyst can misread successive mechanisms even when the documentation distinguishes them. The fast-path correction identifies such an error. Demonstrating that a credential authorized a wider claim would additionally require the actual claim and its use; an ambiguous label supplies neither.

The Cetus recovery record concerns another kind of assurance: who could authorize an exceptional movement of assets. Sui Foundation’s May 2025 account separates frozen attacker accounts from a proposed protocol upgrade and validator vote. It describes Foundation stake as excluded from the vote and specifies transaction-bound aliases for the recovery (Sui Foundation 2025a).

The reviewed source contains distinct mechanisms. A node-local transaction-denial configuration affects a validator’s decision to sign. The recovery voting package supplies a separate stake-weighted process, and the temporary alias code specifies particular signer, sender and transaction-digest relationships. The later removal of the alias feature belongs to that bounded history (MystenLabs 2026a; Sui Foundation 2025b).

Current source uses the name address_aliases for a different arrangement. The sui::address_alias module lets an address configure additional transaction signers for its assets and operations. The current GraphQL response reports that feature as enabled, and a checkpoint-scoped query returns its global object at 0xa. User-managed signing delegation differs from the transaction-specific Cetus recovery tuples. A shared name cannot establish continuity of the authority or action being assessed (MystenLabs 2026b; Sui GraphQL 2026).

The July packet preserves a governance object reporting Passed, a finalization event with 99 yes, two no and two abstain votes, and a replay of historical stake maps. The replay yields approximately 90.88 percent yes of eligible stake (Sui Mainnet Queries 2026, governance object and finalization event). Source-to-package semantics attribution still requires a reproducible Move build and normalized package-byte comparison. The arithmetic and that attribution are distinct checks.

These mechanisms explain why application security, validator discretion and recovery authorization cannot be inferred from one another. The existence of a local denial function does not identify an incident advisory’s author or the validators that loaded a particular list. A later vote does not establish how initial containment occurred. Formal resource conservation does not select a recovery policy. Each inquiry concerns a real power, with a different actor and a different route of authorization.

A normative judgment about the recovery would need its own reasons: the effects on affected users, the scope and review of emergency discretion, and the terms under which such action is legitimate. The technical and voting records can inform that judgment. Neither research pedigree nor the presence of a vote supplies the judgment automatically.

A decision about a Sui application can draw on conservation, verified specifications or implementation measurements when their premises match the intended operation. Where the correspondence is missing, the next observation should address that gap. Publication venue alone cannot establish or defeat the connection.

A stronger empirical study of credibility use would examine dated materials in which particular actors invoke particular results. A financing decision that explicitly relies on a benchmark would identify one use of it. Establishing an effect on financing terms would additionally require a comparison that distinguishes research reputation from technical quality, team experience, market conditions and other explanations. A present-day discovery of such a document would extend the available evidence; it would not make a prior statement about a limited archive false.

Performance work should likewise match the question to the method. Reanalyzing a disclosure’s units can expose an invalid comparison. Estimating application capacity requires a workload and resource envelope, while estimating current service quality requires observations of that service. A new experiment should declare its definitions, selection and analysis decisions, with prospective commitments where appropriate. Historical documentary inquiry and retrospective analysis remain possible when their choices and limitations are transparent.

The cases show different ways technical assurance becomes operationally relevant: specifying intended behavior, adapting a protocol to a system, identifying an active mechanism and authorizing a particular intervention. None of these connections, by itself, establishes that research reputation caused financing, listings, grants, delegation, adoption or valuation.

An evaluator deciding whether to use a system needs the property and the connection that matter to that use. Move’s conservation result, a payment specification, a private performance comparison and a recovery vote can each supply part of the answer. The work lies in showing how that part applies to the intended operation. Following those connections preserves the authority earned by technical research while leaving room to question the operational conclusions drawn from it.

The earlier account sought a connection between research authority and market outcomes. The present comparisons examine how developers specify transactions, integrate protocols, measure performance and authorize recovery. The market mechanism remains unobserved.

The historical July observations remain separate from the October collection, which preserves complete retrieved primary documents, immutable source files, responses, times and hashes. The formal papers are read as dated publications, not current certification of Sui applications.

The public JSON-RPC request returned an API deprecation error, despite HTTP 200. The associated migration documentation explains the replacement interfaces. A subsequent GraphQL collection recovered checkpoint-specific epoch, configuration and singleton-object observations. It separately identifies mainnet release v1.81.1 and the indexer-derived nature of its configuration tables. These records do not inventory validator binaries or active signer delegations. July configuration and recovery observations remain historical. No transaction was submitted, performance experiment reproduced or source-to-validator-binary identity established.

The source comparisons and checkpoint decoding can be repeated from the retained inputs. They test the particular correspondence claimed in each case. Application safety, the legitimacy of a recovery decision and market causation require additional kinds of evidence.