#Math Handoff Protocol — hold-and-win draft-v0.2

This protocol is the manifest submitted at AWAITING_USER_APPROVAL — FREEZE & HANDOFF. Approval applies only to the identities and scope recorded here.

This manifest is APPROVED and SEALED. Every sealed at the gate placeholder has been replaced with the SHA-256 of the artifact as it stood at approval. Those hashes are the manifest: if any one of them stops matching, this approval no longer describes the thing it approved, and a new Draft and protocol version are required.

Current position: FREEZE & HANDOFF approved 2026-08-09. The immutable Final hold-and-win-math-final-v1.0.md was created from the approved draft-v0.2 after that answer, not before. Backend cd4c093 is merged and pushed to main. The mechanic is developer-ready and dormant in production.

#Approval decision

• Allowed decision: APPROVE FREEZE & HANDOFF or CHANGES REQUESTED.
• Decision given: APPROVE FREEZE & HANDOFF (user, 2026-08-09), with the instruction to merge and push main first; the seal below is computed against the post-merge state.
• Approved scope: hold_and_win mechanic final-v1.0 (verbatim from draft-v0.2) and the hold-and-win-reference pack, at backend cd4c093 on main.
• Conditions/exclusions: excludes collector, multiplier, feature buy and any additional-wager behavior; excludes every other game and the existing partial hold_and_spin feature. Approval covers the mathematics, the runtime that executes it and the wire contract binding them — it does not enable the feature for any operator, which is a separate explicit decision.
• Approver and timestamp: user (Bogdan), 2026-08-09.

Silence, DESIGN approval and DRAFT MATH approval do not approve this handoff. This approval is not external certification.

#Bound artifacts

Living documents are deliberately not hashed, because they must keep growing after the gate and a hash on them would be invalid the moment the next entry lands: the mechanic changelog, the game changelog, the game README and this protocol itself. Their integrity comes from Git history, not from a seal.

#Live response fixtures

#Runtime identity

#Approved math contract

• Locked parameters and rules: 3 columns × 5 rows, 15 cells; normative reel-major cell order; trigger at ≥6 BONUS; 3 initial respins; reset to 3 on any newly landed prize; decrement by 1 on a miss-only step; locked cells never redrawn and consuming no RNG; Mini 10×, Minor 25×, Major 100×, Grand 500×; Grand not a landed type; full grid awards exactly 500× replacing the sum; cap applied once at settlement; no collector, multiplier, feature buy or additional wager.
• Parameters closed by draft-v0.2: LandingChancePPM = 43000 and regular-value weights 30/25/18/15/10/2, both selected under the approved tuning direction and confirmed on independent seeds. Still open: prize-type weights and base trigger weights — neither was needed, and neither was touched.
• Payout unit, evaluation order, rounding and cap: multiplier of total bet; base evaluation then feature then a single round cap; multipliers stay float64 and money crosses to exact integer minor units only at the wallet boundary; 500× applies once as a whole-round bound.
• Trigger/state/termination contract: as in the Draft's state machine — Idle → Triggered → Respinning → Settled, terminating at zero respins or a full grid.
• Declared max win and validation type: 500× total bet, reachable (a full grid awards it exactly), not merely an upper bound. Validation must observe it and confirm no round exceeds it.
• Deviations from GDD/targets: RESOLVED at draft-v0.2. Total RTP 96.0031% ±0.1189pp against a 96.0% ±0.3pp target, feature contribution 20.8871% against 20.884% required, conditional mean 32.4593× against 32.4545×, full-grid 0.090053% of triggers (1 in 1,110 features, 1 in 172,570 base rounds) inside the 0.05%–0.25% band. Base RTP 75.1160% and trigger 1 in 155.4035 are exact and unchanged from draft-v0.1. The draft-v0.1 deviation (mechanic RTP ≈4× over, an 18.71% full-grid rate) is retained in the changelog as the reason this revision exists.

#Verification and evidence

Theoretical/exact and Monte Carlo results are reported separately. Total, base and mechanic RTP are reported with confidence intervals alongside trigger frequency, volatility and mechanic-specific metrics. Monte Carlo is never labelled exact.

#Developer delivery

• Final Math, changelog, game Math Spec and GDD.
• Canonical config identity (path + SHA-256) and the backend commit/build that executes it.
• Config schema, API contract and the persisted-state contract, including the typed next_state of kind hold_and_win and the durable sequence/step-operation schema.
• Golden examples with expected outcomes, including trigger, miss decrement, reset, each jackpot tier, the 500× cap and the full-grid Grand.
• Commands required to reproduce tests and simulation in a clean environment.
• Migration and version-routing instructions: migration 023 is additive; an unknown persisted mechanic version fails closed and never falls back to hold_and_spin.
• Known product, parity, compliance and certification blockers.

#Seal

• Protocol SHA-256: recorded in ../../../changelog.md, not here. A file cannot contain its own hash, and writing one that was computed over a different version of the file would be worse than writing none.

• Final decision: APPROVE FREEZE & HANDOFF — user (Bogdan), 2026-08-09.

• Developer-ready: YES.

• Outstanding blockers: none.

  1. four open parameters — CLEARED at draft-v0.2: landing chance and regular weights closed.
  2. the mechanic RTP deviation — CLEARED: all acceptance bands met on independent seeds.
  3. no reference/runtime parity — CLEARED: the live orchestrator is compared with RunHoldAndWinToCompletion over complete state at three landing chances, and the comparison was mutation-checked so a green result is evidence rather than a tautology.
  4. the spin orchestrator does not route to the durable runtime — CLEARED: a paid trigger opens the feature inside the paid gameplay transaction and each respin is its own wager-free request. Engine capability is SupportFull, promoted in the same commit as that evidence.
  5. the backend response contract — CLEARED: one projection, bound to live fixtures, OpenAPI and the handler's serialized output.

• Scope statement, not a blocker: the durable path is dormant in production by construction. hold_and_win_enabled and hold_and_win:<operator> both default to DENY and a nil gate denies, so this approval enables play for nobody. Turning it on for an operator is a separate, explicit decision, and the dev deploy triggered by the main push ships the code inert.

• Certification statement: internal handoff approval is not external certification. No external laboratory has reviewed this mechanic. The mechanic is not enumerable, so its RTP contribution is a seeded Monte Carlo estimate reported with a standard error and interval, and it must never be quoted as exact.

Changing any bound path, version, hash, locked rule, RNG mapping, evaluation order, rounding or cap invalidates this protocol. Start a new Draft and a new protocol version as appropriate; never edit final-v1.0 in place.