Imagine you're building a domino chain on a busy café table. You lay down each piece so that the next one must match the pip count — but anyone at the table can bump a domino before you place the next. The standard fix is to pre-build the entire chain in advance, gluing pieces together. This paper says: instead of gluing, etch a rule into each domino that forces any valid successor to carry the constraint forward. That rule is what they call a Recursive Invariant. The committed claim: you can express multi-step workflow constraints on UTXO blockchains as transaction-level predicates that propagate forward without shared mutable state, executable output scripts, or pre-constructed successor transactions — and this propagation is provably sound under a three-valued (true/false/unknown) deduction system. This is not the first attempt at stateful UTXO protocols, but it is the first to formalize the one-step checking fragment with a typed DSL, prove soundness of the deduction system, and benchmark six practical workloads showing roughly linear cumulative validation cost. The architecture sits in the formal-methods-for-blockchain family — think domain-specific languages layered on top of the UTXO model rather than account-model smart contracts (Ethereum/Solidity). The DSL is small, statically typed, and uses three-valued semantics to handle the fundamental problem that some successor obligations cannot be checked at the time the current transaction is validated. The 'unknown' value defers those checks until the successor actually appears, at which point the predecessor's RI is re-checked one step forward. This preserves the UTXO model's validation-time locality — you never need global ledger state to check a transaction. The ladder context matters here. Bitcoin's Script is intentionally limited; Cardano's Plutus adds expressiveness but ties logic to individual outputs. BitVM and BitVM2 push Bitcoin toward more complex off-chain verification but don't formalize multi-step invariant propagation. The Recursive Invariant approach is closer in spirit to Cardano's extended UTXO model or Ergo's register-based boxes, but the contribution is the formal framework and soundness proof, not a new blockchain. The paper does not benchmark against Plutus or BitVM execution costs directly — the six workloads are evaluated on a prototype RI interpreter, measuring a validation-cost proxy (not wall-clock gas costs on a live chain). Integrity is mixed in a specific way. The soundness proof for the three-valued deduction system is a genuine formal contribution — this is math grading math, not simulation grading simulation. But the benchmark side is weaker: six synthetic workloads on a prototype interpreter, no comparison to existing systems handling similar workflows (Plutus validators, BitVM circuits), and no independent replication. The 'roughly linear cumulative validation-cost proxy growth' is a good sign but needs real-chain confirmation. The OOPSLA 2026 acceptance provides peer-review credibility. The milestone to watch is adoption into an actual UTXO chain's scripting layer. The formal framework is chain-agnostic by design, but the real test is whether Bitcoin (via soft fork or overlay protocol), Cardano, or Ergo integrates RI-style checking. The gap between 'prototype interpreter on synthetic workloads' and 'production chain with adversarial traffic' is where most formal blockchain proposals die. A concrete next number: demonstrating RI enforcement on a live testnet with 1,000+ concurrent workflow instances under adversarial spend-racing conditions would validate the linear-cost claim under real conditions. The obvious experiment not run is a head-to-head comparison with Plutus validators on equivalent multi-step workflows — same workflow logic, same security guarantees, measured in actual execution cost and developer ergonomics. The honest read: the authors are formalizing a model-level contribution (the RI framework and soundness proof), not building a production system, so cross-platform benchmarking is out of scope for this paper. But it's the experiment that would convert skeptics, and its absence means practitioners can't yet answer 'should I use this instead of Plutus?'
