Changelog
what changed.

011.0.0 — first release

Current First release: the engine and the console.

Built

• Solana layer in-tree: base58, ed25519 curve check, PDA and associated token address derivation, read-only JSON-RPC with endpoint rotation and backoff, Helius DAS holder enumeration, Dexscreener pair lookup.
• Token-2022 aware throughout; transfer-fee and transfer-hook extensions detected and warned about.
• Snapshot at the current slot, recorded with the snapshot (reads pinned to it with getProgramAccounts).
• Time-weighted snapshots in the console: a window of 1 to 365 days, Record a balance sample to add every holder's current balance to a ledger kept on the device per snapshot mint, and a dry run that averages balances over the window from those samples.
• Exclusions with evidence: off-curve detection, an AMM program registry that can be verified on chain, Dexscreener venue labels, an exchange-omnibus heuristic that flags, operator lists (treasury, team, burn, exchange).
• Pro-rata and tiered computation in integer base units, with a largest-remainder rule and an iterating dust rule. A tier editor in the project form: balance multiplier or fixed portion of the pool, minimums in whole tokens with the snapshot token's decimals read from the mint.
• Operator fee: empty by default, capped at 200 basis points in code.
• Distribution by direct SPL TransferChecked transfers, prepared as unsigned batches for the operator's own wallet. Every batch opens with SetComputeUnitLimit and SetComputeUnitPrice; the priority fee is read live from recent prioritization fees, and the dry run's cost estimate shows exactly what is bid. Up to 18 transfers per transaction, up to 8 when each also creates a token account.
• Signature verification per batch: a batch is marked paid only when its transaction is finalized and its transfers match the batch exactly; a mismatching signature is refused; a transaction not yet available waits for a re-check.
• Dry run, audit trail, reproducibility check, realised rate over a past window.
• Exports: allocations (CSV), exclusions (CSV, JSON), audit bundle (JSON: snapshot, exclusions, plan and how to check them), settlement report (JSON).
• Vocabulary presets and recurring schedules.
• Operator passcode: the console exists only in a build compiled with SLUICE_OPERATOR_PASSCODE (6 characters or more) and opens only after it is entered (details).
• Web: a Content-Security-Policy in web/index.html without 'unsafe-inline' or 'unsafe-eval'; in a browser the endpoints and the Helius key are kept for the session only.
• Android: compileSdk and targetSdk 36. iOS and macOS: no Apple team in the project. macOS: outgoing connections allowed in the sandbox.
• The SLUICE product icon as the app icon on Android, iOS, macOS and web, and as the console header mark.
• Demo build script tool/build_web_demo.sh with the sample project "SLUICE Demo Pool (sample data)"; test/release_rules_test.dart guards the points above. The test suite passes and flutter analyze is clean.

Not built in this version

• No holder-facing page and no wallet connector: SLUICE prepares unsigned batches; you sign them with tooling you control.
• No looking through vaults or LP positions.
• No retroactive snapshots: a past slot or a past window cannot be read on an ordinary endpoint, so time-weighted windows need samples recorded while they run.
• --wasm web builds fail (flutter_secure_storage_web uses dart:html).

Upgrading: 1.0.0 is the first release, so there is nothing to migrate from yet.

02How to update

1. Back upExport the audit bundle of every round you care about.
2. Keep your changes in GitCommit the original package on a vendor branch before you change anything, then unzip each new version onto that branch and merge it into your own.
3. Check

   flutter pub get
   flutter analyze
   flutter test

4. RebuildLocal data stays on the machine; read the entry for your version for any migration.