diff --git a/buyer/src/ui/App.tsx b/buyer/src/ui/App.tsx
index 1b3003f..2e79199 100644
--- a/buyer/src/ui/App.tsx
+++ b/buyer/src/ui/App.tsx
@@ -4,7 +4,7 @@
  * Routes (all gated by <RequireAuth>):
  *   /         → <Dashboard />
  *   /tasks    → <TaskHistory />
- *   /dashboard → <ResaleDashboard />      unified Surplus + Vector metrics
+ *   /dashboard → <ResaleDashboard />      Capacity markets and sale proofs
  *   /pending  → <PendingReceipts />     UX-1: buyer-side Accept button
  *   /wallet   → <Wallet />
  *   /api-keys → <ApiKeys />             self-serve gateway API key generation
@@ -39,7 +39,7 @@ export default function App() {
       <div className="min-h-screen bg-gray-50 text-gray-900">
         <nav className="bg-white border-b border-gray-200 px-4 py-3 sm:px-6 flex flex-wrap items-center gap-x-6 gap-y-2">
           <Link to="/" className="font-medium hover:underline">Dashboard</Link>
-          <Link to="/dashboard" className="font-medium hover:underline">Resale</Link>
+          <Link to="/dashboard" className="font-medium hover:underline">Capacity</Link>
           {/* Book Summarizer tab hidden for now — the /book route and all PDF
               summarize code remain intact; restore by re-adding this link:
           <Link to="/book" className="font-medium hover:underline">Book Summarizer</Link> */}
diff --git a/buyer/src/ui/pages/ResaleDashboard.tsx b/buyer/src/ui/pages/ResaleDashboard.tsx
index d16c463..9115a3d 100644
--- a/buyer/src/ui/pages/ResaleDashboard.tsx
+++ b/buyer/src/ui/pages/ResaleDashboard.tsx
@@ -1,5 +1,23 @@
 import { useCallback, useEffect, useState } from "react";
 
+interface VectorProof {
+  status: "pending" | "confirmed" | "failed";
+  saleHash: string | null;
+  batchRoot: string | null;
+  txHash: string | null;
+  leafIndex: number | null;
+  siblings: string[];
+}
+
+const PENDING_PROOF: VectorProof = {
+  status: "pending",
+  saleHash: null,
+  batchRoot: null,
+  txHash: null,
+  leafIndex: null,
+  siblings: [],
+};
+
 interface DashboardSnapshot {
   generatedAt: string;
   controller: {
@@ -60,20 +78,10 @@ interface DashboardSnapshot {
       outputTokens: number;
       cacheReadTokens: number;
       revenueUsd: string;
-      transactionHash: string | null;
+      vectorProof: VectorProof;
     }>;
   };
-  vector: {
-    status: "retired";
-    model: string;
-    supplierWallet: string;
-    advertRef: string;
-    retirementTransaction: string;
-    retiredOn: string;
-    historicalAp3xEarned: string;
-    historicalSettledJobs: number;
-    historicalUpstreamSpendUsd: string;
-  };
+
 }
 
 function usd(value: string | number | null): string {
@@ -110,6 +118,34 @@ function StatusPill({ label, active }: { label: string; active: boolean }) {
   );
 }
 
+function VectorProofState({ proof }: { proof: VectorProof }) {
+  const pillClass = proof.status === "confirmed"
+    ? "bg-green-100 text-green-700"
+    : proof.status === "pending"
+      ? "bg-amber-100 text-amber-700"
+      : "bg-red-100 text-red-700";
+  const pill = (
+    <span className={`rounded px-2 py-0.5 text-xs font-medium ${pillClass}`}>
+      {proof.status}
+    </span>
+  );
+
+  if (proof.status !== "confirmed" || proof.txHash === null) return pill;
+
+  return (
+    <a
+      className="inline-flex items-center gap-2 rounded text-blue-600 hover:underline focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-gray-500 focus-visible:ring-offset-2"
+      href={`https://vector.apexscan.org/en/transaction/${proof.txHash}/summary/`}
+      target="_blank"
+      rel="noopener noreferrer"
+      aria-label={`Confirmed Vector proof transaction ${proof.txHash}`}
+    >
+      {pill}
+      <span className="font-mono text-xs">{compact(proof.txHash)}</span>
+    </a>
+  );
+}
+
 function Metric({ label, value, detail }: { label: string; value: string; detail: string }) {
   return (
     <div className="rounded border border-gray-200 bg-gray-50 p-3">
@@ -170,7 +206,7 @@ export default function ResaleDashboard() {
   }, [refresh]);
 
   if (loading && data === null) {
-    return <p className="text-sm text-gray-500">Loading resale dashboard…</p>;
+    return <p className="text-sm text-gray-500">Loading capacity markets…</p>;
   }
 
   if (data === null) {
@@ -183,18 +219,20 @@ export default function ResaleDashboard() {
 
   const offer = data.surplus.offer;
   const earnings = data.surplus.earnings;
-  const vector = data.vector;
   const offerLive = offer.status === "active" && offer.available && offer.healthy;
-  const advertHash = vector.advertRef.split("#")[0] ?? "";
+  const proofCounts = { confirmed: 0, pending: 0, failed: 0 };
+  for (const sale of data.surplus.recentSales) {
+    proofCounts[(sale.vectorProof ?? PENDING_PROOF).status] += 1;
+  }
 
   return (
     <div className="mx-auto max-w-7xl space-y-6" data-testid="resale-dashboard">
       <div className="flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between">
         <div className="space-y-1">
-          <h1 className="text-2xl font-semibold">Resale Dashboard</h1>
+          <h1 className="text-2xl font-semibold">Capacity Markets</h1>
           <p className="max-w-3xl text-sm text-gray-600">
-            One OpenRouter capacity pool managed by the seller agent. Surplus is the live Base USDC
-            market. Vector preserves the completed AP3X escrow proof.
+            Surplus turns available OpenRouter capacity into Base USDC sales. Vector anchors
+            Merkle-batched proofs so every sale has a verifiable transaction record.
           </p>
         </div>
         <div className="flex items-center gap-3">
@@ -223,8 +261,10 @@ export default function ResaleDashboard() {
       <section className="rounded-lg border border-gray-200 bg-white p-4 shadow-sm">
         <div className="mb-3 flex items-center justify-between">
           <div>
-            <h2 className="font-semibold">Capacity route</h2>
-            <p className="text-sm text-gray-500">The same upstream capacity moved from Vector proof to Surplus production.</p>
+            <h2 className="font-semibold">Capacity and proof route</h2>
+            <p className="text-sm text-gray-500">
+              Capacity sells through Surplus, and each sale joins a shared Vector anchor.
+            </p>
           </div>
           <span className="text-xs text-gray-400">Updated {timestamp(data.generatedAt)}</span>
         </div>
@@ -244,86 +284,47 @@ export default function ResaleDashboard() {
           />
           <span className="self-center text-lg text-gray-400">→</span>
           <FlowNode
-            label="Live settlement"
+            label="Live market"
             title="Surplus / Base USDC"
             detail={`${offerLive ? "Available" : "Unavailable"} · ${offer.trusted ? "trusted" : "untrusted"}`}
             mono={offer.id}
           />
+          <span className="self-center text-lg text-gray-400">→</span>
+          <FlowNode
+            label="Proof layer"
+            title="Vector anchors"
+            detail="Commits each sale through a shared Merkle-batch transaction"
+          />
         </div>
       </section>
 
-      <section className="grid gap-6 xl:grid-cols-2">
-        <article className="rounded-lg border border-gray-200 bg-white p-4 shadow-sm">
-          <div className="flex items-start justify-between gap-3">
-            <div>
-              <p className="text-xs font-medium uppercase tracking-wide text-gray-500">Current market</p>
-              <h2 className="mt-1 text-lg font-semibold">Surplus Intelligence</h2>
-              <p className="mt-1 text-sm text-gray-600">Discounted inference with USDC settlement on Base.</p>
-            </div>
-            <StatusPill label={offer.status} active={offerLive} />
+      <section className="rounded-lg border border-gray-200 bg-white p-4 shadow-sm">
+        <div className="flex items-start justify-between gap-3">
+          <div>
+            <p className="text-xs font-medium uppercase tracking-wide text-gray-500">Current market</p>
+            <h2 className="mt-1 text-lg font-semibold">Surplus Intelligence</h2>
+            <p className="mt-1 text-sm text-gray-600">Discounted inference with USDC settlement on Base.</p>
           </div>
-          <div className="mt-4 grid gap-3 sm:grid-cols-2 lg:grid-cols-4 xl:grid-cols-2 2xl:grid-cols-4">
-            <Metric label="Lifetime revenue" value={usd(earnings.totalUsd)} detail={`${usd(earnings.pendingUsd)} pending`} />
-            <Metric label="Requests sold" value={count(earnings.requests)} detail={`${count(earnings.tokens)} tokens`} />
-            <Metric label="Market rank" value={offer.rank === null ? "—" : `#${offer.rank}`} detail={`${offer.trades24h} trades / 24h`} />
-            <Metric label="Daily seller cap" value={usd(offer.dailyCapUsd)} detail={`${usd(offer.capRemainingUsd)} remaining`} />
+          <StatusPill label={offer.status} active={offerLive} />
+        </div>
+        <div className="mt-4 grid gap-3 sm:grid-cols-2 lg:grid-cols-4">
+          <Metric label="Lifetime revenue" value={usd(earnings.totalUsd)} detail={`${usd(earnings.pendingUsd)} pending`} />
+          <Metric label="Requests sold" value={count(earnings.requests)} detail={`${count(earnings.tokens)} tokens`} />
+          <Metric label="Market rank" value={offer.rank === null ? "—" : `#${offer.rank}`} detail={`${offer.trades24h} trades / 24h`} />
+          <Metric label="Daily seller cap" value={usd(offer.dailyCapUsd)} detail={`${usd(offer.capRemainingUsd)} remaining`} />
+        </div>
+        <dl className="mt-4 grid gap-x-6 gap-y-2 border-t border-gray-100 pt-4 text-sm sm:grid-cols-2">
+          <div><dt className="text-gray-500">Marketplace model</dt><dd className="font-mono text-xs text-gray-900">{offer.model ?? "—"}</dd></div>
+          <div><dt className="text-gray-500">Provider model</dt><dd className="font-mono text-xs text-gray-900">{offer.providerModel ?? "—"}</dd></div>
+          <div><dt className="text-gray-500">Input / 1M</dt><dd>{usd(offer.inputUsdPer1m)}</dd></div>
+          <div><dt className="text-gray-500">Output / 1M</dt><dd>{usd(offer.outputUsdPer1m)}</dd></div>
+        </dl>
+        {earnings.payoutHoldReason && (
+          <div className="mt-4 rounded border border-amber-300 bg-amber-50 px-3 py-2 text-sm text-amber-800">
+            Payout hold: {earnings.payoutHoldReason}
+            {earnings.payoutHoldReleasesAt && ` · releases ${timestamp(earnings.payoutHoldReleasesAt)}`}
           </div>
-          <dl className="mt-4 grid gap-x-6 gap-y-2 border-t border-gray-100 pt-4 text-sm sm:grid-cols-2">
-            <div><dt className="text-gray-500">Marketplace model</dt><dd className="font-mono text-xs text-gray-900">{offer.model ?? "—"}</dd></div>
-            <div><dt className="text-gray-500">Provider model</dt><dd className="font-mono text-xs text-gray-900">{offer.providerModel ?? "—"}</dd></div>
-            <div><dt className="text-gray-500">Input / 1M</dt><dd>{usd(offer.inputUsdPer1m)}</dd></div>
-            <div><dt className="text-gray-500">Output / 1M</dt><dd>{usd(offer.outputUsdPer1m)}</dd></div>
-          </dl>
-          {earnings.payoutHoldReason && (
-            <div className="mt-4 rounded border border-amber-300 bg-amber-50 px-3 py-2 text-sm text-amber-800">
-              Payout hold: {earnings.payoutHoldReason}
-              {earnings.payoutHoldReleasesAt && ` · releases ${timestamp(earnings.payoutHoldReleasesAt)}`}
-            </div>
-          )}
-        </article>
-
-        <article className="rounded-lg border border-gray-200 bg-white p-4 shadow-sm">
-          <div className="flex items-start justify-between gap-3">
-            <div>
-              <p className="text-xs font-medium uppercase tracking-wide text-gray-500">Migration record</p>
-              <h2 className="mt-1 text-lg font-semibold">Vector marketplace</h2>
-              <p className="mt-1 text-sm text-gray-600">AP3X escrow route retired after the cross-market proof.</p>
-            </div>
-            <StatusPill label="retired" active={false} />
-          </div>
-          <div className="mt-4 grid gap-3 sm:grid-cols-2 lg:grid-cols-4 xl:grid-cols-2 2xl:grid-cols-4">
-            <Metric label="AP3X earned" value={`${vector.historicalAp3xEarned} AP3X`} detail="historical" />
-            <Metric label="Settled jobs" value={count(vector.historicalSettledJobs)} detail="Vector escrows" />
-            <Metric label="Upstream spend" value={usd(vector.historicalUpstreamSpendUsd)} detail="proof route" />
-            <Metric label="Retired on" value={vector.retiredOn} detail="advert closed" />
-          </div>
-          <div className="mt-4 space-y-3 border-t border-gray-100 pt-4 text-sm">
-            <div>
-              <p className="text-gray-500">Retired advert</p>
-              <p className="break-all font-mono text-xs text-gray-900">{vector.advertRef}</p>
-              <a
-                className="text-xs text-blue-600 hover:underline"
-                href={`https://vector.apexscan.org/en/transaction/${advertHash}/summary/`}
-                target="_blank"
-                rel="noopener noreferrer"
-              >
-                Open advert transaction ↗
-              </a>
-            </div>
-            <div>
-              <p className="text-gray-500">Retirement proof</p>
-              <p className="break-all font-mono text-xs text-gray-900">{vector.retirementTransaction}</p>
-              <a
-                className="text-xs text-blue-600 hover:underline"
-                href={`https://vector.apexscan.org/en/transaction/${vector.retirementTransaction}/summary/`}
-                target="_blank"
-                rel="noopener noreferrer"
-              >
-                Open confirmed transaction ↗
-              </a>
-            </div>
-          </div>
-        </article>
+        )}
       </section>
 
       <section className="rounded-lg border border-gray-200 bg-white p-4 shadow-sm">
@@ -350,8 +351,24 @@ export default function ResaleDashboard() {
           </div>
           <p className="text-sm text-gray-500">{count(earnings.requests)} lifetime requests · {count(earnings.tokens)} tokens</p>
         </div>
+        <div
+          className="flex flex-wrap gap-2"
+          role="group"
+          aria-label="Vector proof summary"
+        >
+          <span className="rounded bg-green-100 px-2 py-1 text-xs font-medium text-green-700">
+            Confirmed {count(proofCounts.confirmed)}
+          </span>
+          <span className="rounded bg-amber-100 px-2 py-1 text-xs font-medium text-amber-700">
+            Pending {count(proofCounts.pending)}
+          </span>
+          <span className="rounded bg-red-100 px-2 py-1 text-xs font-medium text-red-700">
+            Failed {count(proofCounts.failed)}
+          </span>
+        </div>
         <div className="overflow-x-auto rounded-lg border border-gray-200 bg-white shadow-sm">
           <table className="min-w-full divide-y divide-gray-200 text-sm">
+            <caption className="sr-only">Recent Surplus sales with Vector proof status</caption>
             <thead className="bg-gray-50 text-left text-xs font-medium uppercase tracking-wide text-gray-500">
               <tr>
                 <th className="px-4 py-3">Time</th>
@@ -361,7 +378,7 @@ export default function ResaleDashboard() {
                 <th className="px-4 py-3 text-right">Output</th>
                 <th className="px-4 py-3 text-right">Cache read</th>
                 <th className="px-4 py-3 text-right">Revenue</th>
-                <th className="px-4 py-3">Base settlement</th>
+                <th className="px-4 py-3">Vector proof</th>
               </tr>
             </thead>
             <tbody className="divide-y divide-gray-100">
@@ -384,17 +401,8 @@ export default function ResaleDashboard() {
                   <td className="px-4 py-3 text-right tabular-nums">{count(sale.outputTokens)}</td>
                   <td className="px-4 py-3 text-right tabular-nums">{count(sale.cacheReadTokens)}</td>
                   <td className="px-4 py-3 text-right tabular-nums">{usd(sale.revenueUsd)}</td>
-                  <td className="px-4 py-3 font-mono text-xs">
-                    {sale.transactionHash ? (
-                      <a
-                        className="text-blue-600 hover:underline"
-                        href={`https://basescan.org/tx/${sale.transactionHash}`}
-                        target="_blank"
-                        rel="noopener noreferrer"
-                      >
-                        {compact(sale.transactionHash)}
-                      </a>
-                    ) : "Accruing"}
+                  <td className="whitespace-nowrap px-4 py-3">
+                    <VectorProofState proof={sale.vectorProof ?? PENDING_PROOF} />
                   </td>
                 </tr>
               ))}
diff --git a/packages/shared/src/tx/server.ts b/packages/shared/src/tx/server.ts
index afe5ceb..1097723 100644
--- a/packages/shared/src/tx/server.ts
+++ b/packages/shared/src/tx/server.ts
@@ -45,3 +45,16 @@ export type {
   WithdrawWalletBuildResult,
 } from "./wallet/withdrawWallet.js";
 export { buildWithdrawTx } from "./wallet/withdrawWallet.js";
+
+// ── Surplus Merkle-batch anchor (live-only) ────────────────────────────
+export type {
+  AnchorMetadataParams,
+  SurplusSaleProofAnchorMetadata,
+} from "./wallet/anchorMetadata.js";
+export {
+  MAX_TRANSACTION_METADATA_TEXT_BYTES,
+  SURPLUS_SALE_PROOF_METADATA_LABEL,
+  SURPLUS_SALE_PROOF_PROTOCOL,
+  buildAnchorMetadataTx,
+  validateSurplusSaleProofAnchorMetadata,
+} from "./wallet/anchorMetadata.js";
diff --git a/packages/shared/src/tx/wallet/anchorMetadata.ts b/packages/shared/src/tx/wallet/anchorMetadata.ts
new file mode 100644
index 0000000..a81042a
--- /dev/null
+++ b/packages/shared/src/tx/wallet/anchorMetadata.ts
@@ -0,0 +1,166 @@
+/**
+ * Builds and submits the live wallet transaction that anchors one Surplus sale
+ * Merkle batch. The caller remains responsible for awaiting confirmation.
+ */
+
+import type { LiveOgmiosProvider } from "../../chain/LiveOgmiosProvider.js";
+import { OgmiosLucidProvider } from "../../chain/OgmiosLucidProvider.js";
+import { createLucidContext } from "../internal/lucidContext.js";
+import type { BuildResult, WalletKey } from "../types.js";
+import { TxConstructionError } from "../types.js";
+
+export const SURPLUS_SALE_PROOF_METADATA_LABEL = 674;
+export const SURPLUS_SALE_PROOF_PROTOCOL = "surplus-sale-proof-v1";
+export const MAX_TRANSACTION_METADATA_TEXT_BYTES = 64;
+
+export interface SurplusSaleProofAnchorMetadata {
+  p: typeof SURPLUS_SALE_PROOF_PROTOCOL;
+  root: string;
+  count: number;
+  first: string;
+  last: string;
+}
+
+export interface AnchorMetadataParams {
+  chain: LiveOgmiosProvider;
+  walletKey: WalletKey;
+  metadata: SurplusSaleProofAnchorMetadata;
+}
+
+const ROOT_HEX_RE = /^[0-9a-f]{64}$/;
+const PRINTABLE_ASCII_RE = /^[\x20-\x7e]+$/;
+const METADATA_KEYS = ["p", "root", "count", "first", "last"] as const;
+const textEncoder = new TextEncoder();
+
+function metadataTextFits(value: string): boolean {
+  return textEncoder.encode(value).byteLength <= MAX_TRANSACTION_METADATA_TEXT_BYTES;
+}
+
+function validSaleId(value: unknown): value is string {
+  return (
+    typeof value === "string" &&
+    PRINTABLE_ASCII_RE.test(value) &&
+    metadataTextFits(value)
+  );
+}
+
+/** Validate the exact label-674 payload before Lucid or Ogmios is initialized. */
+export function validateSurplusSaleProofAnchorMetadata(
+  value: unknown,
+): asserts value is SurplusSaleProofAnchorMetadata {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new TxConstructionError(
+      "anchor_metadata_invalid",
+      "Surplus sale proof metadata must be an object",
+    );
+  }
+
+  const metadata = value as Record<string, unknown>;
+  const keys = Object.keys(metadata);
+  if (
+    keys.length !== METADATA_KEYS.length ||
+    METADATA_KEYS.some((key) => !Object.prototype.hasOwnProperty.call(metadata, key))
+  ) {
+    throw new TxConstructionError(
+      "anchor_metadata_invalid",
+      "Surplus sale proof metadata must contain only p, root, count, first, and last",
+    );
+  }
+
+  if (metadata.p !== SURPLUS_SALE_PROOF_PROTOCOL) {
+    throw new TxConstructionError(
+      "anchor_metadata_invalid",
+      `metadata protocol must be ${SURPLUS_SALE_PROOF_PROTOCOL}`,
+    );
+  }
+  if (!metadataTextFits(SURPLUS_SALE_PROOF_PROTOCOL)) {
+    throw new TxConstructionError(
+      "anchor_metadata_oversized",
+      "metadata protocol exceeds the 64-byte transaction metadata text limit",
+    );
+  }
+  if (typeof metadata.root !== "string" || !ROOT_HEX_RE.test(metadata.root)) {
+    throw new TxConstructionError(
+      "anchor_metadata_invalid",
+      "metadata root must be 64 lowercase hexadecimal characters",
+    );
+  }
+  if (!metadataTextFits(metadata.root)) {
+    throw new TxConstructionError(
+      "anchor_metadata_oversized",
+      "metadata root exceeds the 64-byte transaction metadata text limit",
+    );
+  }
+  if (
+    typeof metadata.count !== "number" ||
+    !Number.isSafeInteger(metadata.count) ||
+    metadata.count <= 0
+  ) {
+    throw new TxConstructionError(
+      "anchor_metadata_invalid",
+      "metadata count must be a positive safe integer",
+    );
+  }
+
+  for (const field of ["first", "last"] as const) {
+    const id = metadata[field];
+    if (!validSaleId(id)) {
+      const oversized =
+        typeof id === "string" &&
+        textEncoder.encode(id).byteLength > MAX_TRANSACTION_METADATA_TEXT_BYTES;
+      throw new TxConstructionError(
+        oversized ? "anchor_metadata_oversized" : "anchor_metadata_invalid",
+        `metadata ${field} must be a non-empty printable ASCII sale ID of at most 64 bytes`,
+      );
+    }
+  }
+}
+
+export async function buildAnchorMetadataTx(
+  params: AnchorMetadataParams,
+): Promise<BuildResult> {
+  const { chain, walletKey, metadata } = params;
+  validateSurplusSaleProofAnchorMetadata(metadata);
+
+  const provider = new OgmiosLucidProvider({
+    ogmiosUrl: chain.url,
+    fetch: chain.fetchImpl,
+  });
+  const { lucid } = await createLucidContext(
+    provider,
+    walletKey,
+    { networkId: 1, systemStartUnix: 0, slotLengthMs: 1000 },
+    { usePresetProtocolParameters: true },
+  );
+  const realWalletUtxos = await lucid.wallet().getUtxos();
+  const anchorMetadata = {
+    p: metadata.p,
+    root: metadata.root,
+    count: metadata.count,
+    first: metadata.first,
+    last: metadata.last,
+  };
+
+  let signed;
+  try {
+    const txBuilder = lucid
+      .newTx()
+      .attachMetadata(SURPLUS_SALE_PROOF_METADATA_LABEL, anchorMetadata)
+      .addSignerKey(walletKey.pubKeyHash)
+      .setMinFee(500_000n);
+    const completed = await txBuilder.complete({
+      presetWalletInputs: realWalletUtxos,
+      localUPLCEval: false,
+    });
+    signed = await completed.sign.withWallet().complete();
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new TxConstructionError("anchor_metadata_build_failed", message);
+  }
+
+  const txCborHex = signed.toCBOR();
+  const expectedTxHash = signed.toHash();
+  await chain.submitTx(txCborHex);
+
+  return { txCborHex, expectedTxHash };
+}
diff --git a/supplier/src/surplus/client.ts b/supplier/src/surplus/client.ts
index 429e4fa..2e18ca7 100644
--- a/supplier/src/surplus/client.ts
+++ b/supplier/src/surplus/client.ts
@@ -69,9 +69,10 @@ export interface SurplusOfferPatch {
 export interface SurplusSale {
   id: string;
   model: string;
-  offerId: string | null;
+  offerId: string;
   settlementStatus: string;
-  createdAt: string | null;
+  createdAt: string;
+  createdAtMs: number;
   sellerCostMicroUsd: number;
   inputTokens: number;
   outputTokens: number;
@@ -137,6 +138,15 @@ export class SurplusHttpError extends Error {
   }
 }
 
+export class SurplusHistoricalCompletenessError extends Error {
+  constructor() {
+    super(
+      "Surplus does not provide historical sale pagination; only the observed recent-sales window is available",
+    );
+    this.name = "SurplusHistoricalCompletenessError";
+  }
+}
+
 export class SurplusClient {
   private readonly apiBaseUrl: string;
   private readonly sellerApiKey: string;
@@ -337,6 +347,27 @@ export class SurplusClient {
     };
   }
 
+  async listObservedSales(): Promise<SurplusSale[]> {
+    const salesById = new Map<string, SurplusSale>();
+    for (const sale of (await this.getEarnings()).recentSales) {
+      const existing = salesById.get(sale.id);
+      if (existing === undefined) {
+        salesById.set(sale.id, sale);
+      } else if (!sameImmutableSale(existing, sale)) {
+        throw new Error(
+          `Surplus recent-sales window contains conflicting immutable fields for sale ${sale.id}`,
+        );
+      }
+    }
+    return [...salesById.values()].sort((left, right) =>
+      left.id.localeCompare(right.id)
+    );
+  }
+
+  async listAllSales(): Promise<SurplusSale[]> {
+    throw new SurplusHistoricalCompletenessError();
+  }
+
   private async requestJson(
     path: string,
     init: RequestInit = {},
@@ -536,16 +567,21 @@ function parseOrderBookOffer(value: unknown, index: number): SurplusOrderBookOff
 
 function parseSale(value: unknown, index: number): SurplusSale {
   const item = record(value, `Surplus sale ${index}`);
+  const createdAtMs = timestampMs(
+    item.created_at,
+    `Surplus sale ${index}.created_at`,
+  );
   return {
     id: string(item.id, `Surplus sale ${index}.id`),
     model: string(item.model, `Surplus sale ${index}.model`),
-    offerId: optionalString(item.offer_id),
+    offerId: string(item.offer_id, `Surplus sale ${index}.offer_id`),
     settlementStatus: string(item.settlement_status, `Surplus sale ${index}.settlement_status`),
-    createdAt: optionalTimestamp(item.created_at, `Surplus sale ${index}.created_at`),
+    createdAt: new Date(createdAtMs).toISOString(),
+    createdAtMs,
     sellerCostMicroUsd: microUsd(item.seller_cost_usdc, `Surplus sale ${index}.seller_cost_usdc`),
-    inputTokens: optionalSafeInteger(item.input_tokens, `Surplus sale ${index}.input_tokens`),
-    outputTokens: optionalSafeInteger(item.output_tokens, `Surplus sale ${index}.output_tokens`),
-    cacheReadTokens: optionalSafeInteger(
+    inputTokens: nonNegativeSafeInteger(item.input_tokens, `Surplus sale ${index}.input_tokens`),
+    outputTokens: nonNegativeSafeInteger(item.output_tokens, `Surplus sale ${index}.output_tokens`),
+    cacheReadTokens: nonNegativeSafeInteger(
       item.cache_read_tokens,
       `Surplus sale ${index}.cache_read_tokens`,
     ),
@@ -561,6 +597,19 @@ function parseSale(value: unknown, index: number): SurplusSale {
   };
 }
 
+function sameImmutableSale(left: SurplusSale, right: SurplusSale): boolean {
+  return left.id === right.id &&
+    left.offerId === right.offerId &&
+    left.model === right.model &&
+    left.createdAtMs === right.createdAtMs &&
+    left.inputTokens === right.inputTokens &&
+    left.outputTokens === right.outputTokens &&
+    left.cacheReadTokens === right.cacheReadTokens &&
+    left.sellerCostMicroUsd === right.sellerCostMicroUsd &&
+    left.effectiveInputUsdPer1m === right.effectiveInputUsdPer1m &&
+    left.effectiveOutputUsdPer1m === right.effectiveOutputUsdPer1m;
+}
+
 function parseDailyEarnings(
   value: unknown,
   index: number,
@@ -648,15 +697,19 @@ function optionalString(value: unknown): string | null {
 
 function optionalTimestamp(value: unknown, field: string): string | null {
   if (value === null || value === undefined) return null;
+  return new Date(timestampMs(value, field)).toISOString();
+}
+
+function timestampMs(value: unknown, field: string): number {
   const timestamp = typeof value === "number"
     ? value
     : typeof value === "string"
       ? Date.parse(value)
       : Number.NaN;
-  if (!Number.isFinite(timestamp) || timestamp < 0) {
-    throw new Error(`${field} must be a timestamp`);
+  if (!Number.isSafeInteger(timestamp) || timestamp < 0) {
+    throw new Error(`${field} must be a timestamp with integer milliseconds`);
   }
-  return new Date(timestamp).toISOString();
+  return timestamp;
 }
 
 function boolean(value: unknown, field: string): boolean {
diff --git a/supplier/src/surplus/dashboard.ts b/supplier/src/surplus/dashboard.ts
index dffb0d3..6fbff5f 100644
--- a/supplier/src/surplus/dashboard.ts
+++ b/supplier/src/surplus/dashboard.ts
@@ -5,7 +5,12 @@ import type {
   SurplusEarnings,
   SurplusOffer,
   SurplusOrderBook,
+  SurplusSale,
 } from "./client.js";
+import {
+  hashSurplusSale,
+  type SurplusDashboardVectorProof,
+} from "./vectorProof.js";
 import type {
   SurplusControllerStatus,
   SurplusSellerController,
@@ -25,6 +30,19 @@ export interface VectorMigrationSummary {
   historicalSettledJobs: number;
   historicalUpstreamSpendUsd: string;
 }
+export interface DashboardSaleProof {
+  status: "pending" | "confirmed" | "failed";
+  saleHash: string | null;
+  batchRoot: string | null;
+  txHash: string | null;
+  leafIndex: number | null;
+  siblings: string[];
+}
+
+export interface DashboardProofSource {
+  dashboardProof(saleId: string): SurplusDashboardVectorProof | null;
+}
+
 
 export interface SurplusDashboardSnapshot {
   generatedAt: string;
@@ -80,6 +98,7 @@ export interface SurplusDashboardSnapshot {
       cacheReadTokens: number;
       revenueUsd: string;
       transactionHash: string | null;
+      vectorProof: DashboardSaleProof;
     }>;
   };
   vector: VectorMigrationSummary;
@@ -91,6 +110,7 @@ interface SurplusDashboardOptions {
   allowance: Pick<OpenRouterKeyClient, "readAllowance">;
   config: SurplusManagerConfig;
   vector?: VectorMigrationSummary;
+  proofs?: DashboardProofSource;
   cacheMs?: number;
   now?: () => number;
 }
@@ -117,6 +137,7 @@ export class SurplusDashboardService {
   >;
   private readonly allowance: Pick<OpenRouterKeyClient, "readAllowance">;
   private readonly config: SurplusManagerConfig;
+  private readonly proofs: DashboardProofSource | null;
   private readonly vector: VectorMigrationSummary;
   private readonly cacheMs: number;
   private readonly now: () => number;
@@ -128,6 +149,7 @@ export class SurplusDashboardService {
     this.client = options.client;
     this.allowance = options.allowance;
     this.config = options.config;
+    this.proofs = options.proofs ?? null;
     this.vector = options.vector ?? DEFAULT_VECTOR_MIGRATION;
     this.cacheMs = options.cacheMs ?? 15_000;
     this.now = options.now ?? Date.now;
@@ -218,11 +240,31 @@ export class SurplusDashboardService {
           cacheReadTokens: sale.cacheReadTokens,
           revenueUsd: formatMicroUsd(sale.sellerCostMicroUsd),
           transactionHash: sale.transactionHash,
+          vectorProof: this.proofFor(sale),
         })),
       },
       vector: this.vector,
     };
   }
+
+  private proofFor(sale: SurplusSale): DashboardSaleProof {
+    const ledger = this.proofs?.dashboardProof(sale.id) ?? null;
+    if (ledger !== null) return ledger;
+    let saleHash: string | null = null;
+    try {
+      saleHash = hashSurplusSale(sale);
+    } catch {
+      saleHash = null;
+    }
+    return {
+      status: "pending",
+      saleHash,
+      batchRoot: null,
+      txHash: null,
+      leafIndex: null,
+      siblings: [],
+    };
+  }
 }
 
 function findOffer(
diff --git a/supplier/src/surplus/vectorProof.ts b/supplier/src/surplus/vectorProof.ts
new file mode 100644
index 0000000..fe86833
--- /dev/null
+++ b/supplier/src/surplus/vectorProof.ts
@@ -0,0 +1,1085 @@
+import { createHash, randomUUID } from "node:crypto";
+import { constants, type Stats } from "node:fs";
+import {
+  chmod,
+  lstat,
+  mkdir,
+  open,
+  rename,
+  unlink,
+  type FileHandle,
+} from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
+import type { SurplusSale } from "./client.js";
+
+export const SURPLUS_SALE_PROOF_PROTOCOL = "surplus-sale-proof-v1" as const;
+export const SURPLUS_VECTOR_BATCH_SIZE = 1_000;
+
+export type SurplusSaleProofInput = Pick<
+  SurplusSale,
+  | "id"
+  | "offerId"
+  | "model"
+  | "createdAt"
+  | "inputTokens"
+  | "outputTokens"
+  | "cacheReadTokens"
+  | "sellerCostMicroUsd"
+  | "effectiveInputUsdPer1m"
+  | "effectiveOutputUsdPer1m"
+>;
+
+/** The property order is part of the versioned leaf encoding. */
+export interface CanonicalSurplusSale {
+  protocol: typeof SURPLUS_SALE_PROOF_PROTOCOL;
+  saleId: string;
+  offerId: string;
+  model: string;
+  createdAtEpochMs: number;
+  inputTokens: number;
+  outputTokens: number;
+  cacheReadTokens: number;
+  sellerCostMicroUsd: number;
+  effectiveInputUsdPer1m: string;
+  effectiveOutputUsdPer1m: string;
+}
+
+export interface SurplusMerkleProof {
+  saleHash: string;
+  batchRoot: string;
+  leafIndex: number;
+  leafCount: number;
+  siblings: string[];
+}
+
+export interface SurplusMerkleLeaf extends SurplusMerkleProof {
+  sale: CanonicalSurplusSale;
+}
+
+export interface SurplusMerkleBatch {
+  root: string;
+  count: number;
+  firstSaleId: string;
+  lastSaleId: string;
+  leaves: SurplusMerkleLeaf[];
+}
+
+export type SurplusVectorProofStatus = "pending" | "confirmed" | "failed";
+
+export interface SurplusDashboardVectorProof {
+  status: SurplusVectorProofStatus;
+  saleHash: string;
+  batchRoot: string | null;
+  txHash: string | null;
+  leafIndex: number | null;
+  siblings: string[];
+}
+
+export interface SurplusPendingBatchLeaf {
+  saleId: string;
+  saleHash: string;
+  leafIndex: number;
+  siblings: string[];
+}
+
+export interface SurplusPendingBatchIntent {
+  batchRoot: string;
+  count: number;
+  firstSaleId: string;
+  lastSaleId: string;
+  createdAt: string;
+  leaves: SurplusPendingBatchLeaf[];
+}
+
+export interface SurplusConfirmedBatch {
+  batchRoot: string;
+  count: number;
+  firstSaleId: string;
+  lastSaleId: string;
+  txHash: string;
+  confirmedAt: string;
+}
+
+export type SurplusBatchFailureStage = "build" | "submit" | "confirm";
+
+export interface SurplusFailedBatchAttempt {
+  batchRoot: string;
+  count: number;
+  firstSaleId: string;
+  lastSaleId: string;
+  stage: SurplusBatchFailureStage;
+  failedAt: string;
+}
+
+interface LedgerSale {
+  sale: CanonicalSurplusSale;
+  vectorProof: SurplusDashboardVectorProof;
+}
+
+interface SurplusVectorProofLedgerState {
+  version: 1;
+  sales: LedgerSale[];
+  pendingBatch: SurplusPendingBatchIntent | null;
+  confirmedBatches: SurplusConfirmedBatch[];
+  failedAttempts: SurplusFailedBatchAttempt[];
+}
+
+export interface OpenSurplusVectorProofLedgerOptions {
+  now?: () => number;
+}
+
+export function canonicalizeSurplusSale(
+  sale: SurplusSaleProofInput,
+): CanonicalSurplusSale {
+  const saleId = saleIdString(sale.id, "Surplus sale id");
+  const offerId = boundedString(sale.offerId, "Surplus sale offer id", 512);
+  const model = boundedString(sale.model, "Surplus sale model", 512);
+  if (sale.createdAt === null) {
+    throw new Error(`Surplus sale ${saleId} has no creation time`);
+  }
+  const createdAtEpochMs = Date.parse(sale.createdAt);
+  if (!Number.isSafeInteger(createdAtEpochMs) || createdAtEpochMs < 0) {
+    throw new Error(`Surplus sale ${saleId} has an invalid creation time`);
+  }
+
+  return {
+    protocol: SURPLUS_SALE_PROOF_PROTOCOL,
+    saleId,
+    offerId,
+    model,
+    createdAtEpochMs,
+    inputTokens: nonNegativeSafeInteger(sale.inputTokens, "input tokens"),
+    outputTokens: nonNegativeSafeInteger(sale.outputTokens, "output tokens"),
+    cacheReadTokens: nonNegativeSafeInteger(
+      sale.cacheReadTokens,
+      "cache-read tokens",
+    ),
+    sellerCostMicroUsd: nonNegativeSafeInteger(
+      sale.sellerCostMicroUsd,
+      "seller cost",
+    ),
+    effectiveInputUsdPer1m: fixedSixDecimal(
+      sale.effectiveInputUsdPer1m,
+      "effective input price",
+    ),
+    effectiveOutputUsdPer1m: fixedSixDecimal(
+      sale.effectiveOutputUsdPer1m,
+      "effective output price",
+    ),
+  };
+}
+
+export function canonicalSurplusSaleJson(sale: CanonicalSurplusSale): string {
+  return JSON.stringify(parseCanonicalSale(sale, "Canonical Surplus sale"));
+}
+
+export function hashCanonicalSurplusSale(sale: CanonicalSurplusSale): string {
+  return createHash("sha256")
+    .update(canonicalSurplusSaleJson(sale), "utf8")
+    .digest("hex");
+}
+
+export function hashSurplusSale(sale: SurplusSaleProofInput): string {
+  return hashCanonicalSurplusSale(canonicalizeSurplusSale(sale));
+}
+
+export function buildSurplusMerkleBatch(
+  sales: readonly CanonicalSurplusSale[],
+): SurplusMerkleBatch {
+  if (sales.length === 0 || sales.length > SURPLUS_VECTOR_BATCH_SIZE) {
+    throw new Error(
+      `A Surplus proof batch must contain 1-${SURPLUS_VECTOR_BATCH_SIZE} sales`,
+    );
+  }
+
+  const ordered = sales.map((sale) =>
+    parseCanonicalSale(sale, "Canonical Surplus sale")
+  ).sort((left, right) => compareSaleIds(left.saleId, right.saleId));
+  for (let index = 1; index < ordered.length; index += 1) {
+    if (ordered[index - 1].saleId === ordered[index].saleId) {
+      throw new Error(`Duplicate Surplus sale id: ${ordered[index].saleId}`);
+    }
+  }
+
+  const hashes = ordered.map((sale) =>
+    Buffer.from(hashCanonicalSurplusSale(sale), "hex")
+  );
+  const levels: Buffer[][] = [hashes];
+  while (levels[levels.length - 1].length > 1) {
+    const current = levels[levels.length - 1];
+    const next: Buffer[] = [];
+    for (let index = 0; index < current.length; index += 2) {
+      const left = current[index];
+      const right = current[index + 1] ?? left;
+      next.push(hashPair(left, right));
+    }
+    levels.push(next);
+  }
+
+  const root = levels[levels.length - 1][0].toString("hex");
+  const leaves = ordered.map((sale, leafIndex): SurplusMerkleLeaf => {
+    const siblings: string[] = [];
+    let index = leafIndex;
+    for (let level = 0; level < levels.length - 1; level += 1) {
+      const nodes = levels[level];
+      const siblingIndex = index % 2 === 0 ? index + 1 : index - 1;
+      siblings.push((nodes[siblingIndex] ?? nodes[index]).toString("hex"));
+      index = Math.floor(index / 2);
+    }
+    return {
+      sale,
+      saleHash: hashes[leafIndex].toString("hex"),
+      batchRoot: root,
+      leafIndex,
+      leafCount: ordered.length,
+      siblings,
+    };
+  });
+
+  return {
+    root,
+    count: ordered.length,
+    firstSaleId: ordered[0].saleId,
+    lastSaleId: ordered[ordered.length - 1].saleId,
+    leaves,
+  };
+}
+
+export function verifySurplusMerkleProof(
+  sale: SurplusSaleProofInput | CanonicalSurplusSale,
+  proof: SurplusMerkleProof,
+): boolean {
+  try {
+    if (!isHash(proof.saleHash) || !isHash(proof.batchRoot)) return false;
+    if (
+      !Number.isSafeInteger(proof.leafCount) ||
+      proof.leafCount < 1 ||
+      proof.leafCount > SURPLUS_VECTOR_BATCH_SIZE ||
+      !Number.isSafeInteger(proof.leafIndex) ||
+      proof.leafIndex < 0 ||
+      proof.leafIndex >= proof.leafCount ||
+      proof.siblings.length !== merkleDepth(proof.leafCount) ||
+      proof.siblings.some((sibling) => !isHash(sibling))
+    ) return false;
+
+    const canonical = isCanonicalSale(sale)
+      ? parseCanonicalSale(sale, "Canonical Surplus sale")
+      : canonicalizeSurplusSale(sale);
+    const saleHash = hashCanonicalSurplusSale(canonical);
+    if (saleHash !== proof.saleHash) return false;
+
+    let hash: Buffer = Buffer.from(saleHash, "hex");
+    let index = proof.leafIndex;
+    let width = proof.leafCount;
+    for (const siblingHex of proof.siblings) {
+      const sibling = Buffer.from(siblingHex, "hex");
+      if (index % 2 === 0) {
+        if (index + 1 >= width && !hash.equals(sibling)) return false;
+        hash = hashPair(hash, sibling);
+      } else {
+        hash = hashPair(sibling, hash);
+      }
+      index = Math.floor(index / 2);
+      width = Math.ceil(width / 2);
+    }
+    return width === 1 && index === 0 && hash.toString("hex") === proof.batchRoot;
+  } catch {
+    return false;
+  }
+}
+
+export class FileSurplusVectorProofLedger {
+  private state: SurplusVectorProofLedgerState;
+  private readonly now: () => number;
+
+  private constructor(
+    private readonly path: string,
+    state: SurplusVectorProofLedgerState,
+    options: OpenSurplusVectorProofLedgerOptions,
+  ) {
+    this.state = state;
+    this.now = options.now ?? Date.now;
+  }
+
+  static async open(
+    path: string,
+    options: OpenSurplusVectorProofLedgerOptions = {},
+  ): Promise<FileSurplusVectorProofLedger> {
+    return new FileSurplusVectorProofLedger(
+      path,
+      await loadLedger(path),
+      options,
+    );
+  }
+
+  async ingestSales(
+    sales: readonly SurplusSaleProofInput[],
+  ): Promise<{ inserted: number; duplicates: number }> {
+    const incoming = new Map<string, CanonicalSurplusSale>();
+    let duplicates = 0;
+    for (const input of sales) {
+      const sale = canonicalizeSurplusSale(input);
+      const prior = incoming.get(sale.saleId);
+      if (prior !== undefined) {
+        if (hashCanonicalSurplusSale(prior) !== hashCanonicalSurplusSale(sale)) {
+          throw new Error(`Conflicting Surplus sale id: ${sale.saleId}`);
+        }
+        duplicates += 1;
+      } else {
+        incoming.set(sale.saleId, sale);
+      }
+    }
+
+    const byId = new Map(this.state.sales.map((entry) => [entry.sale.saleId, entry]));
+    const additions: LedgerSale[] = [];
+    for (const sale of incoming.values()) {
+      const existing = byId.get(sale.saleId);
+      const saleHash = hashCanonicalSurplusSale(sale);
+      if (existing !== undefined) {
+        if (existing.vectorProof.saleHash !== saleHash) {
+          throw new Error(`Conflicting Surplus sale id: ${sale.saleId}`);
+        }
+        duplicates += 1;
+        continue;
+      }
+      additions.push({
+        sale,
+        vectorProof: {
+          status: "pending",
+          saleHash,
+          batchRoot: null,
+          txHash: null,
+          leafIndex: null,
+          siblings: [],
+        },
+      });
+    }
+
+    if (additions.length > 0) {
+      const next = cloneState(this.state);
+      next.sales.push(...additions);
+      next.sales.sort((left, right) => compareSaleIds(
+        left.sale.saleId,
+        right.sale.saleId,
+      ));
+      await this.commit(next);
+    }
+    return { inserted: additions.length, duplicates };
+  }
+
+  selectUnprovedSales(
+    limit = SURPLUS_VECTOR_BATCH_SIZE,
+  ): CanonicalSurplusSale[] {
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > SURPLUS_VECTOR_BATCH_SIZE) {
+      throw new Error(
+        `Surplus proof selection limit must be 1-${SURPLUS_VECTOR_BATCH_SIZE}`,
+      );
+    }
+    if (this.state.pendingBatch !== null) {
+      throw new Error("The pending Surplus proof batch must be resolved first");
+    }
+    return this.state.sales
+      .filter((entry) => entry.vectorProof.status !== "confirmed")
+      .slice(0, limit)
+      .map((entry) => structuredClone(entry.sale));
+  }
+
+  async persistPendingBatch(
+    saleIds: readonly string[],
+  ): Promise<SurplusPendingBatchIntent> {
+    if (this.state.pendingBatch !== null) {
+      throw new Error("The pending Surplus proof batch must be resolved first");
+    }
+    if (saleIds.length === 0 || saleIds.length > SURPLUS_VECTOR_BATCH_SIZE) {
+      throw new Error(
+        `A Surplus proof batch must contain 1-${SURPLUS_VECTOR_BATCH_SIZE} sales`,
+      );
+    }
+
+    const requested = new Set<string>();
+    for (const value of saleIds) {
+      const id = saleIdString(value, "Surplus sale id");
+      if (requested.has(id)) throw new Error(`Duplicate Surplus sale id: ${id}`);
+      requested.add(id);
+    }
+    const byId = new Map(this.state.sales.map((entry) => [entry.sale.saleId, entry]));
+    const selected = [...requested].map((id) => {
+      const entry = byId.get(id);
+      if (entry === undefined) throw new Error(`Unknown Surplus sale id: ${id}`);
+      if (entry.vectorProof.status === "confirmed") {
+        throw new Error(`Surplus sale is already confirmed: ${id}`);
+      }
+      return entry.sale;
+    });
+    const batch = buildSurplusMerkleBatch(selected);
+    const createdAt = timestamp(this.now(), "Current time");
+    const intent: SurplusPendingBatchIntent = {
+      batchRoot: batch.root,
+      count: batch.count,
+      firstSaleId: batch.firstSaleId,
+      lastSaleId: batch.lastSaleId,
+      createdAt,
+      leaves: batch.leaves.map((leaf) => ({
+        saleId: leaf.sale.saleId,
+        saleHash: leaf.saleHash,
+        leafIndex: leaf.leafIndex,
+        siblings: [...leaf.siblings],
+      })),
+    };
+
+    const proofs = new Map(intent.leaves.map((leaf) => [leaf.saleId, leaf]));
+    const next = cloneState(this.state);
+    next.pendingBatch = intent;
+    for (const entry of next.sales) {
+      const leaf = proofs.get(entry.sale.saleId);
+      if (leaf === undefined) continue;
+      entry.vectorProof = {
+        status: "pending",
+        saleHash: leaf.saleHash,
+        batchRoot: intent.batchRoot,
+        txHash: null,
+        leafIndex: leaf.leafIndex,
+        siblings: [...leaf.siblings],
+      };
+    }
+    await this.commit(next);
+    return structuredClone(intent);
+  }
+
+  async createPendingBatch(
+    limit = SURPLUS_VECTOR_BATCH_SIZE,
+  ): Promise<SurplusPendingBatchIntent | null> {
+    const selected = this.selectUnprovedSales(limit);
+    return selected.length === 0
+      ? null
+      : this.persistPendingBatch(selected.map((sale) => sale.saleId));
+  }
+
+  pendingBatchIntent(): SurplusPendingBatchIntent | null {
+    return this.state.pendingBatch === null
+      ? null
+      : structuredClone(this.state.pendingBatch);
+  }
+
+  async confirmPendingBatch(
+    batchRoot: string,
+    txHash: string,
+  ): Promise<SurplusConfirmedBatch> {
+    const pending = this.requirePendingBatch(batchRoot);
+    const normalizedTxHash = transactionHash(txHash);
+    const confirmed: SurplusConfirmedBatch = {
+      batchRoot: pending.batchRoot,
+      count: pending.count,
+      firstSaleId: pending.firstSaleId,
+      lastSaleId: pending.lastSaleId,
+      txHash: normalizedTxHash,
+      confirmedAt: timestamp(this.now(), "Current time"),
+    };
+    const leaves = new Map(pending.leaves.map((leaf) => [leaf.saleId, leaf]));
+    const next = cloneState(this.state);
+    for (const entry of next.sales) {
+      const leaf = leaves.get(entry.sale.saleId);
+      if (leaf === undefined) continue;
+      entry.vectorProof = {
+        status: "confirmed",
+        saleHash: leaf.saleHash,
+        batchRoot: pending.batchRoot,
+        txHash: normalizedTxHash,
+        leafIndex: leaf.leafIndex,
+        siblings: [...leaf.siblings],
+      };
+    }
+    next.pendingBatch = null;
+    next.confirmedBatches.push(confirmed);
+    await this.commit(next);
+    return structuredClone(confirmed);
+  }
+
+  async failPendingBatch(
+    batchRoot: string,
+    stage: SurplusBatchFailureStage,
+  ): Promise<SurplusFailedBatchAttempt> {
+    const pending = this.requirePendingBatch(batchRoot);
+    if (stage !== "build" && stage !== "submit" && stage !== "confirm") {
+      throw new Error("Invalid Surplus proof batch failure stage");
+    }
+    const failed: SurplusFailedBatchAttempt = {
+      batchRoot: pending.batchRoot,
+      count: pending.count,
+      firstSaleId: pending.firstSaleId,
+      lastSaleId: pending.lastSaleId,
+      stage,
+      failedAt: timestamp(this.now(), "Current time"),
+    };
+    const leaves = new Map(pending.leaves.map((leaf) => [leaf.saleId, leaf]));
+    const next = cloneState(this.state);
+    for (const entry of next.sales) {
+      const leaf = leaves.get(entry.sale.saleId);
+      if (leaf === undefined) continue;
+      entry.vectorProof = {
+        status: "failed",
+        saleHash: leaf.saleHash,
+        batchRoot: pending.batchRoot,
+        txHash: null,
+        leafIndex: leaf.leafIndex,
+        siblings: [...leaf.siblings],
+      };
+    }
+    next.pendingBatch = null;
+    next.failedAttempts.push(failed);
+    await this.commit(next);
+    return structuredClone(failed);
+  }
+
+  dashboardProof(saleId: string): SurplusDashboardVectorProof | null {
+    const entry = this.state.sales.find((candidate) =>
+      candidate.sale.saleId === saleId
+    );
+    return entry === undefined ? null : structuredClone(entry.vectorProof);
+  }
+
+  confirmedBatchHistory(): SurplusConfirmedBatch[] {
+    return structuredClone(this.state.confirmedBatches);
+  }
+
+  failedAttemptHistory(): SurplusFailedBatchAttempt[] {
+    return structuredClone(this.state.failedAttempts);
+  }
+
+  private requirePendingBatch(batchRoot: string): SurplusPendingBatchIntent {
+    if (!isHash(batchRoot)) throw new Error("Invalid Surplus proof batch root");
+    const pending = this.state.pendingBatch;
+    if (pending === null) throw new Error("There is no pending Surplus proof batch");
+    if (pending.batchRoot !== batchRoot) {
+      throw new Error("The Surplus proof batch root does not match the pending intent");
+    }
+    return pending;
+  }
+
+  private async commit(next: SurplusVectorProofLedgerState): Promise<void> {
+    const parsed = parseLedger(next);
+    await saveLedger(this.path, parsed);
+    this.state = parsed;
+  }
+}
+
+
+function compareSaleIds(left: string, right: string): number {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+
+function fixedSixDecimal(value: number, field: string): string {
+  if (!Number.isFinite(value) || value < 0) {
+    throw new Error(`Surplus sale ${field} must be a non-negative number`);
+  }
+  const fixed = value.toFixed(6);
+  if (!FIXED_SIX_DECIMAL.test(fixed)) {
+    throw new Error(`Surplus sale ${field} is outside the supported range`);
+  }
+  return fixed;
+}
+
+function nonNegativeSafeInteger(value: unknown, field: string): number {
+  if (!Number.isSafeInteger(value) || (value as number) < 0) {
+    throw new Error(`Surplus sale ${field} must be a non-negative safe integer`);
+  }
+  return value as number;
+}
+
+function boundedString(value: unknown, field: string, maximumBytes: number): string {
+  if (
+    typeof value !== "string" ||
+    value.length === 0 ||
+    Buffer.byteLength(value, "utf8") > maximumBytes
+  ) {
+    throw new Error(`${field} must be a non-empty string of at most ${maximumBytes} bytes`);
+  }
+  return value;
+}
+
+function saleIdString(value: unknown, field: string): string {
+  const id = boundedString(value, field, 64);
+  if (!PRINTABLE_ASCII.test(id)) {
+    throw new Error(`${field} must contain printable ASCII characters only`);
+  }
+  return id;
+}
+
+function timestamp(value: number, field: string): string {
+  if (!Number.isSafeInteger(value) || value < 0) {
+    throw new Error(`${field} must be epoch milliseconds`);
+  }
+  return new Date(value).toISOString();
+}
+
+function transactionHash(value: unknown): string {
+  if (typeof value !== "string" || !TX_HASH.test(value)) {
+    throw new Error("Vector transaction hash must be 64 hexadecimal characters");
+  }
+  return value.toLowerCase();
+}
+
+function hashPair(left: Buffer, right: Buffer): Buffer {
+  return createHash("sha256").update(left).update(right).digest();
+}
+
+
+function isHash(value: unknown): value is string {
+  return typeof value === "string" && HASH.test(value);
+}
+
+function merkleDepth(count: number): number {
+  let depth = 0;
+  for (let width = count; width > 1; width = Math.ceil(width / 2)) depth += 1;
+  return depth;
+}
+
+function isCanonicalSale(
+  sale: SurplusSaleProofInput | CanonicalSurplusSale,
+): sale is CanonicalSurplusSale {
+  return "protocol" in sale;
+}
+
+function parseCanonicalSale(value: unknown, field: string): CanonicalSurplusSale {
+  const sale = object(value, field);
+  if (sale.protocol !== SURPLUS_SALE_PROOF_PROTOCOL) {
+    throw new Error(`${field}.protocol is not supported`);
+  }
+  const effectiveInputUsdPer1m = decimalString(
+    sale.effectiveInputUsdPer1m,
+    `${field}.effectiveInputUsdPer1m`,
+  );
+  const effectiveOutputUsdPer1m = decimalString(
+    sale.effectiveOutputUsdPer1m,
+    `${field}.effectiveOutputUsdPer1m`,
+  );
+  return {
+    protocol: SURPLUS_SALE_PROOF_PROTOCOL,
+    saleId: saleIdString(sale.saleId, `${field}.saleId`),
+    offerId: boundedString(sale.offerId, `${field}.offerId`, 512),
+    model: boundedString(sale.model, `${field}.model`, 512),
+    createdAtEpochMs: nonNegativeSafeInteger(
+      sale.createdAtEpochMs,
+      `${field}.createdAtEpochMs`,
+    ),
+    inputTokens: nonNegativeSafeInteger(sale.inputTokens, `${field}.inputTokens`),
+    outputTokens: nonNegativeSafeInteger(sale.outputTokens, `${field}.outputTokens`),
+    cacheReadTokens: nonNegativeSafeInteger(
+      sale.cacheReadTokens,
+      `${field}.cacheReadTokens`,
+    ),
+    sellerCostMicroUsd: nonNegativeSafeInteger(
+      sale.sellerCostMicroUsd,
+      `${field}.sellerCostMicroUsd`,
+    ),
+    effectiveInputUsdPer1m,
+    effectiveOutputUsdPer1m,
+  };
+}
+
+function decimalString(value: unknown, field: string): string {
+  if (
+    typeof value !== "string" ||
+    value.length > 32 ||
+    !FIXED_SIX_DECIMAL.test(value) ||
+    !Number.isFinite(Number(value))
+  ) throw new Error(`${field} must be fixed 6-decimal text`);
+  return value;
+}
+
+async function loadLedger(path: string): Promise<SurplusVectorProofLedgerState> {
+  let handle: FileHandle;
+  try {
+    handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+  } catch (error) {
+    if (isNodeError(error, "ENOENT")) return emptyLedger();
+    throw error;
+  }
+  try {
+    assertSecureOwner(await handle.stat(), false, "Surplus proof ledger file");
+    let value: unknown;
+    try {
+      value = JSON.parse(await handle.readFile("utf8"));
+    } catch {
+      throw new Error("Surplus proof ledger file is not valid JSON");
+    }
+    return parseLedger(value);
+  } finally {
+    await handle.close();
+  }
+}
+
+async function saveLedger(
+  path: string,
+  state: SurplusVectorProofLedgerState,
+): Promise<void> {
+  const directory = dirname(path);
+  try {
+    const info = await lstat(directory);
+    assertOwnerAndType(info, true, "Surplus proof ledger directory");
+  } catch (error) {
+    if (!isNodeError(error, "ENOENT")) throw error;
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+  }
+  let directoryInfo = await lstat(directory);
+  assertOwnerAndType(directoryInfo, true, "Surplus proof ledger directory");
+  await chmod(directory, 0o700);
+  directoryInfo = await lstat(directory);
+  assertSecureOwner(directoryInfo, true, "Surplus proof ledger directory");
+
+  try {
+    assertSecureOwner(await lstat(path), false, "Surplus proof ledger file");
+  } catch (error) {
+    if (!isNodeError(error, "ENOENT")) throw error;
+  }
+
+  const tempPath = join(directory, `.${basename(path)}.${randomUUID()}.tmp`);
+  const body = `${JSON.stringify(state)}\n`;
+  let handle: FileHandle | null = null;
+  try {
+    handle = await open(
+      tempPath,
+      constants.O_WRONLY |
+        constants.O_CREAT |
+        constants.O_EXCL |
+        constants.O_NOFOLLOW,
+      0o600,
+    );
+    await handle.writeFile(body, "utf8");
+    await handle.sync();
+    await handle.close();
+    handle = null;
+    await rename(tempPath, path);
+    const directoryHandle = await open(
+      directory,
+      constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW,
+    );
+    try {
+      await directoryHandle.sync();
+    } finally {
+      await directoryHandle.close();
+    }
+  } finally {
+    if (handle !== null) await handle.close().catch(() => undefined);
+    await unlink(tempPath).catch((error) => {
+      if (!isNodeError(error, "ENOENT")) throw error;
+    });
+  }
+}
+
+function parseLedger(value: unknown): SurplusVectorProofLedgerState {
+  const root = object(value, "Surplus proof ledger");
+  if (root.version !== 1) throw new Error("Unsupported Surplus proof ledger version");
+  if (!Array.isArray(root.sales)) throw new Error("Surplus proof ledger sales must be an array");
+  if (!Array.isArray(root.confirmedBatches)) {
+    throw new Error("Surplus proof ledger confirmedBatches must be an array");
+  }
+  if (!Array.isArray(root.failedAttempts)) {
+    throw new Error("Surplus proof ledger failedAttempts must be an array");
+  }
+
+  const sales = root.sales.map(parseLedgerSale);
+  sales.sort((left, right) => compareSaleIds(left.sale.saleId, right.sale.saleId));
+  for (let index = 1; index < sales.length; index += 1) {
+    if (sales[index - 1].sale.saleId === sales[index].sale.saleId) {
+      throw new Error(`Duplicate Surplus sale id: ${sales[index].sale.saleId}`);
+    }
+  }
+  const pendingBatch = root.pendingBatch === null
+    ? null
+    : parsePendingBatch(root.pendingBatch);
+  const confirmedBatches = root.confirmedBatches.map(parseConfirmedBatch);
+  const failedAttempts = root.failedAttempts.map(parseFailedAttempt);
+  const state: SurplusVectorProofLedgerState = {
+    version: 1,
+    sales,
+    pendingBatch,
+    confirmedBatches,
+    failedAttempts,
+  };
+  validateLedgerRelationships(state);
+  return state;
+}
+
+function parseLedgerSale(value: unknown, index: number): LedgerSale {
+  const entry = object(value, `Surplus proof ledger sale ${index}`);
+  const sale = parseCanonicalSale(entry.sale, `Surplus proof ledger sale ${index}.sale`);
+  const proof = object(entry.vectorProof, `Surplus proof ledger sale ${index}.vectorProof`);
+  if (proof.status !== "pending" && proof.status !== "confirmed" && proof.status !== "failed") {
+    throw new Error(`Surplus proof ledger sale ${index} has an invalid proof status`);
+  }
+  const siblings = hashArray(proof.siblings, `Surplus proof ledger sale ${index} siblings`);
+  const batchRoot = proof.batchRoot === null
+    ? null
+    : requiredHash(proof.batchRoot, `Surplus proof ledger sale ${index} batchRoot`);
+  const txHash = proof.txHash === null ? null : transactionHash(proof.txHash);
+  const leafIndex = proof.leafIndex === null
+    ? null
+    : nonNegativeSafeInteger(proof.leafIndex, `Surplus proof ledger sale ${index} leafIndex`);
+  const vectorProof: SurplusDashboardVectorProof = {
+    status: proof.status,
+    saleHash: requiredHash(proof.saleHash, `Surplus proof ledger sale ${index} saleHash`),
+    batchRoot,
+    txHash,
+    leafIndex,
+    siblings,
+  };
+  if (vectorProof.saleHash !== hashCanonicalSurplusSale(sale)) {
+    throw new Error(`Surplus proof ledger sale ${index} hash does not match its sale`);
+  }
+  if (batchRoot === null) {
+    if (proof.status !== "pending" || txHash !== null || leafIndex !== null || siblings.length !== 0) {
+      throw new Error(`Surplus proof ledger sale ${index} has an incomplete proof`);
+    }
+  } else if (leafIndex === null) {
+    throw new Error(`Surplus proof ledger sale ${index} has no leaf index`);
+  }
+  if (proof.status === "confirmed" ? txHash === null : txHash !== null) {
+    throw new Error(`Surplus proof ledger sale ${index} has an invalid transaction hash`);
+  }
+  return { sale, vectorProof };
+}
+
+function parsePendingBatch(value: unknown): SurplusPendingBatchIntent {
+  const batch = parseBatchSummary(value, "Surplus pending proof batch");
+  const root = object(value, "Surplus pending proof batch");
+  if (!Array.isArray(root.leaves)) {
+    throw new Error("Surplus pending proof batch leaves must be an array");
+  }
+  const leaves = root.leaves.map((value, index): SurplusPendingBatchLeaf => {
+    const leaf = object(value, `Surplus pending proof batch leaf ${index}`);
+    return {
+      saleId: saleIdString(leaf.saleId, `Surplus pending proof batch leaf ${index}.saleId`),
+      saleHash: requiredHash(leaf.saleHash, `Surplus pending proof batch leaf ${index}.saleHash`),
+      leafIndex: nonNegativeSafeInteger(
+        leaf.leafIndex,
+        `Surplus pending proof batch leaf ${index}.leafIndex`,
+      ),
+      siblings: hashArray(leaf.siblings, `Surplus pending proof batch leaf ${index}.siblings`),
+    };
+  });
+  return {
+    ...batch,
+    createdAt: isoTimestamp(root.createdAt, "Surplus pending proof batch createdAt"),
+    leaves,
+  };
+}
+
+function parseConfirmedBatch(value: unknown): SurplusConfirmedBatch {
+  const batch = parseBatchSummary(value, "Surplus confirmed proof batch");
+  const root = object(value, "Surplus confirmed proof batch");
+  return {
+    ...batch,
+    txHash: transactionHash(root.txHash),
+    confirmedAt: isoTimestamp(root.confirmedAt, "Surplus confirmed proof batch confirmedAt"),
+  };
+}
+
+function parseFailedAttempt(value: unknown): SurplusFailedBatchAttempt {
+  const batch = parseBatchSummary(value, "Surplus failed proof batch");
+  const root = object(value, "Surplus failed proof batch");
+  if (root.stage !== "build" && root.stage !== "submit" && root.stage !== "confirm") {
+    throw new Error("Surplus failed proof batch has an invalid stage");
+  }
+  return {
+    ...batch,
+    stage: root.stage,
+    failedAt: isoTimestamp(root.failedAt, "Surplus failed proof batch failedAt"),
+  };
+}
+
+function parseBatchSummary(
+  value: unknown,
+  field: string,
+): Omit<SurplusConfirmedBatch, "txHash" | "confirmedAt"> {
+  const batch = object(value, field);
+  const count = nonNegativeSafeInteger(batch.count, `${field}.count`);
+  if (count < 1 || count > SURPLUS_VECTOR_BATCH_SIZE) {
+    throw new Error(`${field}.count must be 1-${SURPLUS_VECTOR_BATCH_SIZE}`);
+  }
+  return {
+    batchRoot: requiredHash(batch.batchRoot, `${field}.batchRoot`),
+    count,
+    firstSaleId: saleIdString(batch.firstSaleId, `${field}.firstSaleId`),
+    lastSaleId: saleIdString(batch.lastSaleId, `${field}.lastSaleId`),
+  };
+}
+
+function validateLedgerRelationships(state: SurplusVectorProofLedgerState): void {
+  const byId = new Map(state.sales.map((entry) => [entry.sale.saleId, entry]));
+  const pendingIds = new Set<string>();
+  if (state.pendingBatch !== null) {
+    const pending = state.pendingBatch;
+    if (pending.leaves.length !== pending.count) {
+      throw new Error("Surplus pending proof batch leaf count does not match");
+    }
+    const ids = pending.leaves.map((leaf) => leaf.saleId);
+    const sortedIds = [...ids].sort(compareSaleIds);
+    if (new Set(ids).size !== ids.length || ids.some((id, index) => id !== sortedIds[index])) {
+      throw new Error("Surplus pending proof batch leaves are not uniquely sorted");
+    }
+    if (ids[0] !== pending.firstSaleId || ids[ids.length - 1] !== pending.lastSaleId) {
+      throw new Error("Surplus pending proof batch boundaries do not match its leaves");
+    }
+    for (let index = 0; index < pending.leaves.length; index += 1) {
+      const leaf = pending.leaves[index];
+      pendingIds.add(leaf.saleId);
+      const entry = byId.get(leaf.saleId);
+      if (entry === undefined) throw new Error(`Pending proof references unknown sale: ${leaf.saleId}`);
+      if (
+        leaf.leafIndex !== index ||
+        entry.vectorProof.status !== "pending" ||
+        entry.vectorProof.batchRoot !== pending.batchRoot ||
+        entry.vectorProof.leafIndex !== index ||
+        entry.vectorProof.saleHash !== leaf.saleHash ||
+        !sameStrings(entry.vectorProof.siblings, leaf.siblings) ||
+        !verifySurplusMerkleProof(entry.sale, {
+          saleHash: leaf.saleHash,
+          batchRoot: pending.batchRoot,
+          leafIndex: index,
+          leafCount: pending.count,
+          siblings: leaf.siblings,
+        })
+      ) throw new Error(`Invalid pending proof for Surplus sale: ${leaf.saleId}`);
+    }
+  }
+  for (const entry of state.sales) {
+    if (
+      entry.vectorProof.status === "pending" &&
+      entry.vectorProof.batchRoot !== null &&
+      !pendingIds.has(entry.sale.saleId)
+    ) {
+      throw new Error(`Orphaned pending proof for Surplus sale: ${entry.sale.saleId}`);
+    }
+  }
+
+  const confirmedByRoot = new Map<string, SurplusConfirmedBatch>();
+  for (const batch of state.confirmedBatches) {
+    if (confirmedByRoot.has(batch.batchRoot)) {
+      throw new Error(`Duplicate confirmed Surplus batch root: ${batch.batchRoot}`);
+    }
+    confirmedByRoot.set(batch.batchRoot, batch);
+  }
+  const confirmedSalesByRoot = new Map<string, LedgerSale[]>();
+  for (const entry of state.sales) {
+    const proof = entry.vectorProof;
+    if (proof.status !== "confirmed") continue;
+    const batch = confirmedByRoot.get(proof.batchRoot as string);
+    if (
+      batch === undefined ||
+      proof.txHash !== batch.txHash ||
+      proof.leafIndex === null ||
+      !verifySurplusMerkleProof(entry.sale, {
+        saleHash: proof.saleHash,
+        batchRoot: batch.batchRoot,
+        leafIndex: proof.leafIndex,
+        leafCount: batch.count,
+        siblings: proof.siblings,
+      })
+    ) throw new Error(`Invalid confirmed proof for Surplus sale: ${entry.sale.saleId}`);
+    const batchSales = confirmedSalesByRoot.get(batch.batchRoot) ?? [];
+    batchSales.push(entry);
+    confirmedSalesByRoot.set(batch.batchRoot, batchSales);
+  }
+  for (const batch of state.confirmedBatches) {
+    const batchSales = confirmedSalesByRoot.get(batch.batchRoot) ?? [];
+    batchSales.sort((left, right) =>
+      (left.vectorProof.leafIndex as number) - (right.vectorProof.leafIndex as number)
+    );
+    if (
+      batchSales.length !== batch.count ||
+      batchSales.some((entry, index) => entry.vectorProof.leafIndex !== index) ||
+      batchSales[0]?.sale.saleId !== batch.firstSaleId ||
+      batchSales[batchSales.length - 1]?.sale.saleId !== batch.lastSaleId
+    ) throw new Error(`Confirmed Surplus batch is missing sales: ${batch.batchRoot}`);
+  }
+
+  const failedByRoot = new Map<string, SurplusFailedBatchAttempt>();
+  for (const attempt of state.failedAttempts) failedByRoot.set(attempt.batchRoot, attempt);
+  for (const entry of state.sales) {
+    const proof = entry.vectorProof;
+    if (proof.status !== "failed") continue;
+    const attempt = failedByRoot.get(proof.batchRoot as string);
+    if (
+      attempt === undefined ||
+      proof.leafIndex === null ||
+      !verifySurplusMerkleProof(entry.sale, {
+        saleHash: proof.saleHash,
+        batchRoot: attempt.batchRoot,
+        leafIndex: proof.leafIndex,
+        leafCount: attempt.count,
+        siblings: proof.siblings,
+      })
+    ) throw new Error(`Invalid failed proof for Surplus sale: ${entry.sale.saleId}`);
+  }
+}
+
+function hashArray(value: unknown, field: string): string[] {
+  if (!Array.isArray(value)) throw new Error(`${field} must be an array`);
+  return value.map((item, index) => requiredHash(item, `${field}[${index}]`));
+}
+
+function requiredHash(value: unknown, field: string): string {
+  if (!isHash(value)) throw new Error(`${field} must be a lowercase SHA-256 hash`);
+  return value;
+}
+
+
+function isoTimestamp(value: unknown, field: string): string {
+  if (typeof value !== "string" || new Date(value).toISOString() !== value) {
+    throw new Error(`${field} must be an ISO timestamp`);
+  }
+  return value;
+}
+
+function object(value: unknown, field: string): Record<string, unknown> {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${field} must be an object`);
+  }
+  return value as Record<string, unknown>;
+}
+
+function emptyLedger(): SurplusVectorProofLedgerState {
+  return {
+    version: 1,
+    sales: [],
+    pendingBatch: null,
+    confirmedBatches: [],
+    failedAttempts: [],
+  };
+}
+
+function cloneState(
+  state: SurplusVectorProofLedgerState,
+): SurplusVectorProofLedgerState {
+  return structuredClone(state);
+}
+
+function sameStrings(left: readonly string[], right: readonly string[]): boolean {
+  return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+
+function assertOwnerAndType(info: Stats, directory: boolean, field: string): void {
+  if (directory ? !info.isDirectory() : !info.isFile()) {
+    throw new Error(`${field} has the wrong file type`);
+  }
+  if (typeof process.getuid === "function" && info.uid !== process.getuid()) {
+    throw new Error(`${field} must be owned by the service user`);
+  }
+}
+
+function assertSecureOwner(info: Stats, directory: boolean, field: string): void {
+  assertOwnerAndType(info, directory, field);
+  if ((info.mode & 0o077) !== 0) {
+    throw new Error(`${field} must not allow group or other access`);
+  }
+}
+
+function isNodeError(error: unknown, code: string): boolean {
+  return error instanceof Error && "code" in error && error.code === code;
+}
+
+const PRINTABLE_ASCII = /^[\x20-\x7e]+$/;
+const FIXED_SIX_DECIMAL = /^(?:0|[1-9]\d*)\.\d{6}$/;
+const HASH = /^[0-9a-f]{64}$/;
+const TX_HASH = /^[0-9a-fA-F]{64}$/;
diff --git a/tests/unit/buyer-ui-resale-dashboard.test.tsx b/tests/unit/buyer-ui-resale-dashboard.test.tsx
index b8fda79..ea2620d 100644
--- a/tests/unit/buyer-ui-resale-dashboard.test.tsx
+++ b/tests/unit/buyer-ui-resale-dashboard.test.tsx
@@ -1,8 +1,10 @@
 // @vitest-environment happy-dom
 
 import { afterEach, describe, expect, it, vi } from "vitest";
-import { render, screen, waitFor } from "@testing-library/react";
-import ResaleDashboard from "../../buyer/src/ui/pages/ResaleDashboard.js";
+import { render, screen, waitFor, within } from "@testing-library/react";
+import { MemoryRouter } from "react-router-dom";
+import App from "../../buyer/src/ui/App.js";
+import { AuthProvider } from "../../buyer/src/ui/state/AuthContext.js";
 
 const DASHBOARD = {
   generatedAt: "2026-08-28T12:00:00.000Z",
@@ -47,28 +49,62 @@ const DASHBOARD = {
       payoutHoldReason: "new_seller",
       payoutHoldReleasesAt: "2026-08-29T11:24:42.552Z",
     },
-    recentSales: [{
-      id: "sale-1",
-      model: "deepseek-v4-flash",
-      createdAt: "2026-08-28T11:00:00.000Z",
-      settlementStatus: "confirmed",
-      inputTokens: 10,
-      outputTokens: 2,
-      cacheReadTokens: 3,
-      revenueUsd: "0.000083",
-      transactionHash: "0x" + "c".repeat(64),
-    }],
-  },
-  vector: {
-    status: "retired",
-    model: "deepseek/deepseek-v4-flash",
-    supplierWallet: "addr1test",
-    advertRef: `${"a".repeat(64)}#0`,
-    retirementTransaction: "b".repeat(64),
-    retiredOn: "2026-08-27",
-    historicalAp3xEarned: "1.600000",
-    historicalSettledJobs: 8,
-    historicalUpstreamSpendUsd: "0.000093",
+    recentSales: [
+      {
+        id: "sale-1",
+        model: "deepseek-v4-flash",
+        createdAt: "2026-08-28T11:00:00.000Z",
+        settlementStatus: "confirmed",
+        inputTokens: 10,
+        outputTokens: 2,
+        cacheReadTokens: 3,
+        revenueUsd: "0.000083",
+        vectorProof: {
+          status: "confirmed",
+          saleHash: "1".repeat(64),
+          batchRoot: "2".repeat(64),
+          txHash: "d".repeat(64),
+          leafIndex: 0,
+          siblings: ["3".repeat(64)],
+        },
+      },
+      {
+        id: "sale-2",
+        model: "deepseek-v4-flash",
+        createdAt: "2026-08-28T11:01:00.000Z",
+        settlementStatus: "confirmed",
+        inputTokens: 20,
+        outputTokens: 4,
+        cacheReadTokens: 6,
+        revenueUsd: "0.000166",
+        vectorProof: {
+          status: "pending",
+          saleHash: "4".repeat(64),
+          batchRoot: null,
+          txHash: null,
+          leafIndex: null,
+          siblings: [],
+        },
+      },
+      {
+        id: "sale-3",
+        model: "deepseek-v4-flash",
+        createdAt: "2026-08-28T11:02:00.000Z",
+        settlementStatus: "confirmed",
+        inputTokens: 30,
+        outputTokens: 6,
+        cacheReadTokens: 9,
+        revenueUsd: "0.000249",
+        vectorProof: {
+          status: "failed",
+          saleHash: "5".repeat(64),
+          batchRoot: null,
+          txHash: null,
+          leafIndex: null,
+          siblings: [],
+        },
+      },
+    ],
   },
 };
 
@@ -76,29 +112,41 @@ afterEach(() => {
   vi.unstubAllGlobals();
 });
 
-describe("ResaleDashboard", () => {
-  it("matches the marketplace card system and renders both settlement markets", async () => {
+describe("Capacity markets dashboard", () => {
+  it("renders the authenticated route with a Vector proof state for every sale", async () => {
     const fetchMock = vi.fn(async () => Response.json(DASHBOARD));
     vi.stubGlobal("fetch", fetchMock);
 
-    render(<ResaleDashboard />);
+    render(
+      <MemoryRouter initialEntries={["/dashboard"]}>
+        <AuthProvider initialStatus="authenticated">
+          <App />
+        </AuthProvider>
+      </MemoryRouter>,
+    );
 
-    expect(await screen.findByRole("heading", { name: "Resale Dashboard" })).toBeInTheDocument();
+    expect(await screen.findByRole("heading", { name: "Capacity Markets" })).toBeInTheDocument();
+    expect(screen.getByRole("link", { name: "Capacity" })).toHaveAttribute("href", "/dashboard");
     expect(screen.getByRole("heading", { name: "Surplus Intelligence" })).toBeInTheDocument();
-    expect(screen.getByRole("heading", { name: "Vector marketplace" })).toBeInTheDocument();
+    expect(screen.getByRole("columnheader", { name: "Vector proof" })).toBeInTheDocument();
     expect(screen.getByText("$0.2399")).toBeInTheDocument();
-    expect(screen.getByText("1.600000 AP3X")).toBeInTheDocument();
-    expect(screen.getByText("confirmed")).toBeInTheDocument();
     expect(screen.getByTestId("resale-dashboard")).toHaveClass("max-w-7xl");
     expect(document.querySelectorAll(".bg-white").length).toBeGreaterThan(3);
-    expect(screen.getByRole("link", { name: /Open confirmed transaction/ })).toHaveAttribute(
+
+    const proofSummary = screen.getByRole("group", { name: "Vector proof summary" });
+    expect(within(proofSummary).getByText("Confirmed 1")).toHaveClass("bg-green-100");
+    expect(within(proofSummary).getByText("Pending 1")).toHaveClass("bg-amber-100");
+    expect(within(proofSummary).getByText("Failed 1")).toHaveClass("bg-red-100");
+    expect(screen.getByText("pending")).toHaveClass("bg-amber-100");
+    expect(screen.getByText("failed")).toHaveClass("bg-red-100");
+
+    const proofLink = screen.getByRole("link", { name: /Confirmed Vector proof transaction/ });
+    expect(proofLink).toHaveAttribute(
       "href",
-      `https://vector.apexscan.org/en/transaction/${"b".repeat(64)}/summary/`,
-    );
-    expect(screen.getByRole("link", { name: /0xcccc/ })).toHaveAttribute(
-      "href",
-      `https://basescan.org/tx/0x${"c".repeat(64)}`,
+      `https://vector.apexscan.org/en/transaction/${"d".repeat(64)}/summary/`,
     );
+    expect(within(proofLink).getByText("dddddddddddd…ddddddddd")).toBeInTheDocument();
+
     await waitFor(() => expect(fetchMock).toHaveBeenCalledWith(
       "/v1/resale-dashboard",
       { cache: "no-store" },
diff --git a/tests/unit/surplus-client.test.ts b/tests/unit/surplus-client.test.ts
index a45b8f5..ab238e5 100644
--- a/tests/unit/surplus-client.test.ts
+++ b/tests/unit/surplus-client.test.ts
@@ -36,6 +36,42 @@ function discoveryRow(model: string, providerModelId: string): string {
   });
 }
 
+function saleRow(
+  id: string,
+  overrides: Record<string, unknown> = {},
+): Record<string, unknown> {
+  return {
+    id,
+    model: "alpha",
+    offer_id: "offer-1",
+    settlement_status: "confirmed",
+    created_at: 1_787_831_146_968,
+    seller_cost_usdc: "83",
+    input_tokens: 10,
+    output_tokens: 2,
+    cache_read_tokens: 4,
+    effective_input_per_1m: 0.004,
+    effective_output_per_1m: 0.008,
+    tx_hash: null,
+    ...overrides,
+  };
+}
+
+function earningsEnvelope(
+  recentSales: Record<string, unknown>[],
+): Record<string, unknown> {
+  return {
+    total_earned_usdc: "166",
+    pending_usdc: "166",
+    paid_usdc: "0",
+    daily: [],
+    by_model: [],
+    share: { requests: recentSales.length, tokens: 0, top_model: "alpha" },
+    recent_sales: recentSales,
+    payout_hold: null,
+  };
+}
+
 describe("SurplusClient", () => {
   it("authenticates and parses fragmented NDJSON discovery", async () => {
     const first = discoveryRow("alpha", "vendor/alpha");
@@ -296,6 +332,90 @@ describe("SurplusClient", () => {
     expect(earnings.recentSales[0].createdAt).toBe(
       new Date(1787831146968).toISOString(),
     );
+    expect(earnings.recentSales[0].createdAtMs).toBe(1787831146968);
+  });
+
+  it("returns the deduplicated observed sale window in deterministic sale-id order", async () => {
+    const duplicate = saleRow("sale-a", {
+      buyer_address: "must-not-be-retained",
+    });
+    const client = new SurplusClient({
+      apiBaseUrl: "https://api.surplusintelligence.ai",
+      sellerApiKey: SELLER_KEY,
+      timeoutMs: 1_000,
+      fetchFn: async () =>
+        Response.json(earningsEnvelope([
+          saleRow("sale-b"),
+          duplicate,
+          { ...duplicate },
+        ])),
+    });
+
+    const sales = await client.listObservedSales();
+
+    expect(sales.map((sale) => sale.id)).toEqual(["sale-a", "sale-b"]);
+    expect(sales[0]).not.toHaveProperty("buyerAddress");
+    expect(sales[0]).not.toHaveProperty("buyer_address");
+  });
+
+  it("fails closed on conflicting immutable fields in the observed sale window", async () => {
+    const client = new SurplusClient({
+      apiBaseUrl: "https://api.surplusintelligence.ai",
+      sellerApiKey: SELLER_KEY,
+      timeoutMs: 1_000,
+      fetchFn: async () =>
+        Response.json(earningsEnvelope([
+          saleRow("sale-a"),
+          saleRow("sale-a", { input_tokens: 11 }),
+        ])),
+    });
+
+    await expect(client.listObservedSales()).rejects.toThrow(
+      "conflicting immutable fields for sale sale-a",
+    );
+  });
+
+  it("requires every immutable proof field in observed sales", async () => {
+    const requiredFields = [
+      "id",
+      "model",
+      "offer_id",
+      "created_at",
+      "seller_cost_usdc",
+      "input_tokens",
+      "output_tokens",
+      "cache_read_tokens",
+      "effective_input_per_1m",
+      "effective_output_per_1m",
+    ];
+
+    for (const field of requiredFields) {
+      const row = saleRow("sale-a");
+      delete row[field];
+      const client = new SurplusClient({
+        apiBaseUrl: "https://api.surplusintelligence.ai",
+        sellerApiKey: SELLER_KEY,
+        timeoutMs: 1_000,
+        fetchFn: async () => Response.json(earningsEnvelope([row])),
+      });
+
+      await expect(client.listObservedSales()).rejects.toThrow();
+    }
+  });
+
+  it("fails clearly instead of claiming unavailable historical completeness", async () => {
+    const fetchFn = vi.fn();
+    const client = new SurplusClient({
+      apiBaseUrl: "https://api.surplusintelligence.ai",
+      sellerApiKey: SELLER_KEY,
+      timeoutMs: 1_000,
+      fetchFn,
+    });
+
+    await expect(client.listAllSales()).rejects.toThrow(
+      "does not provide historical sale pagination",
+    );
+    expect(fetchFn).not.toHaveBeenCalled();
   });
 
   it("sends one absolute cost-multiplier PATCH with the cap", async () => {
diff --git a/tests/unit/surplus-vector-proof.test.ts b/tests/unit/surplus-vector-proof.test.ts
new file mode 100644
index 0000000..abb92fa
--- /dev/null
+++ b/tests/unit/surplus-vector-proof.test.ts
@@ -0,0 +1,340 @@
+import { createHash } from "node:crypto";
+import {
+  mkdtemp,
+  readFile,
+  rm,
+  stat,
+  symlink,
+  writeFile,
+} from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+import {
+  buildSurplusMerkleBatch,
+  canonicalizeSurplusSale,
+  canonicalSurplusSaleJson,
+  FileSurplusVectorProofLedger,
+  hashSurplusSale,
+  SURPLUS_SALE_PROOF_PROTOCOL,
+  verifySurplusMerkleProof,
+  type SurplusMerkleProof,
+  type SurplusMerkleBatch,
+  type SurplusSaleProofInput,
+} from "../../supplier/src/surplus/vectorProof.js";
+
+const directories: string[] = [];
+
+async function temporaryDirectory(): Promise<string> {
+  const directory = await mkdtemp(join(tmpdir(), "surplus-vector-proof-"));
+  directories.push(directory);
+  return directory;
+}
+
+afterEach(async () => {
+  await Promise.all(directories.splice(0).map((path) =>
+    rm(path, { recursive: true, force: true })
+  ));
+});
+
+function sale(
+  id: string,
+  overrides: Partial<SurplusSaleProofInput> = {},
+): SurplusSaleProofInput {
+  return {
+    id,
+    offerId: "offer-1",
+    model: "deepseek-v4-flash",
+    createdAt: "2026-08-28T11:00:00.123Z",
+    inputTokens: 10,
+    outputTokens: 2,
+    cacheReadTokens: 3,
+    sellerCostMicroUsd: 83,
+    effectiveInputUsdPer1m: 0.003972,
+    effectiveOutputUsdPer1m: 0.007944,
+    ...overrides,
+  };
+}
+
+function proofFor(
+  batch: SurplusMerkleBatch,
+  saleId: string,
+): SurplusMerkleProof {
+  const leaf = batch.leaves.find((candidate) => candidate.sale.saleId === saleId);
+  if (leaf === undefined) throw new Error(`Missing test leaf ${saleId}`);
+  return {
+    saleHash: leaf.saleHash,
+    batchRoot: leaf.batchRoot,
+    leafIndex: leaf.leafIndex,
+    leafCount: leaf.leafCount,
+    siblings: [...leaf.siblings],
+  };
+}
+
+function changedHash(hash: string): string {
+  return `${hash[0] === "0" ? "1" : "0"}${hash.slice(1)}`;
+}
+
+describe("Surplus Vector sale projection", () => {
+  it("encodes the versioned leaf in the required field order and hashes its UTF-8 JSON", () => {
+    const input = sale("sale-1");
+    const canonical = canonicalizeSurplusSale(input);
+    const json = canonicalSurplusSaleJson(canonical);
+
+    expect(canonical).toEqual({
+      protocol: SURPLUS_SALE_PROOF_PROTOCOL,
+      saleId: "sale-1",
+      offerId: "offer-1",
+      model: "deepseek-v4-flash",
+      createdAtEpochMs: Date.parse("2026-08-28T11:00:00.123Z"),
+      inputTokens: 10,
+      outputTokens: 2,
+      cacheReadTokens: 3,
+      sellerCostMicroUsd: 83,
+      effectiveInputUsdPer1m: "0.003972",
+      effectiveOutputUsdPer1m: "0.007944",
+    });
+    expect(json).toBe(
+      '{"protocol":"surplus-sale-proof-v1","saleId":"sale-1","offerId":"offer-1","model":"deepseek-v4-flash","createdAtEpochMs":1787914800123,"inputTokens":10,"outputTokens":2,"cacheReadTokens":3,"sellerCostMicroUsd":83,"effectiveInputUsdPer1m":"0.003972","effectiveOutputUsdPer1m":"0.007944"}',
+    );
+    expect(hashSurplusSale(input)).toBe(
+      createHash("sha256").update(json, "utf8").digest("hex"),
+    );
+  });
+
+  it("rejects sales that cannot produce an immutable canonical leaf", () => {
+    expect(() => canonicalizeSurplusSale(sale("sale-1", { offerId: null })))
+      .toThrow("offer id");
+    expect(() => canonicalizeSurplusSale(sale("sale-1", { createdAt: null })))
+      .toThrow("no creation time");
+    expect(() => canonicalizeSurplusSale(sale("sale-1", { inputTokens: -1 })))
+      .toThrow("non-negative safe integer");
+    expect(() => canonicalizeSurplusSale(sale("bad\nid")))
+      .toThrow("printable ASCII");
+  });
+});
+
+describe("Surplus sale Merkle batches", () => {
+  it("sorts by sale id and duplicates the final node at odd tree levels", () => {
+    const batch = buildSurplusMerkleBatch([
+      canonicalizeSurplusSale(sale("sale-c")),
+      canonicalizeSurplusSale(sale("sale-a")),
+      canonicalizeSurplusSale(sale("sale-b")),
+    ]);
+
+    expect(batch.count).toBe(3);
+    expect(batch.firstSaleId).toBe("sale-a");
+    expect(batch.lastSaleId).toBe("sale-c");
+    expect(batch.leaves.map((leaf) => leaf.sale.saleId)).toEqual([
+      "sale-a",
+      "sale-b",
+      "sale-c",
+    ]);
+    const last = batch.leaves[2];
+    expect(last.siblings[0]).toBe(last.saleHash);
+    for (const leaf of batch.leaves) {
+      expect(verifySurplusMerkleProof(leaf.sale, leaf)).toBe(true);
+    }
+
+    const reordered = buildSurplusMerkleBatch([
+      canonicalizeSurplusSale(sale("sale-b")),
+      canonicalizeSurplusSale(sale("sale-c")),
+      canonicalizeSurplusSale(sale("sale-a")),
+    ]);
+    expect(reordered.root).toBe(batch.root);
+    expect(reordered.leaves).toEqual(batch.leaves);
+  });
+
+  it("rejects every material proof mutation", () => {
+    const originalSale = sale("sale-a");
+    const batch = buildSurplusMerkleBatch([
+      canonicalizeSurplusSale(originalSale),
+      canonicalizeSurplusSale(sale("sale-b")),
+      canonicalizeSurplusSale(sale("sale-c")),
+    ]);
+    const proof = proofFor(batch, "sale-a");
+    expect(verifySurplusMerkleProof(originalSale, proof)).toBe(true);
+
+    const changedFields: SurplusSaleProofInput[] = [
+      sale("sale-x"),
+      sale("sale-a", { offerId: "offer-2" }),
+      sale("sale-a", { model: "another-model" }),
+      sale("sale-a", { createdAt: "2026-08-28T11:00:00.124Z" }),
+      sale("sale-a", { inputTokens: 11 }),
+      sale("sale-a", { outputTokens: 3 }),
+      sale("sale-a", { cacheReadTokens: 4 }),
+      sale("sale-a", { sellerCostMicroUsd: 84 }),
+      sale("sale-a", { effectiveInputUsdPer1m: 0.003973 }),
+      sale("sale-a", { effectiveOutputUsdPer1m: 0.007945 }),
+    ];
+    for (const changed of changedFields) {
+      expect(verifySurplusMerkleProof(changed, proof)).toBe(false);
+    }
+
+    expect(verifySurplusMerkleProof(originalSale, {
+      ...proof,
+      siblings: [changedHash(proof.siblings[0]), ...proof.siblings.slice(1)],
+    })).toBe(false);
+    expect(verifySurplusMerkleProof(originalSale, {
+      ...proof,
+      leafIndex: 1,
+    })).toBe(false);
+    expect(verifySurplusMerkleProof(originalSale, {
+      ...proof,
+      batchRoot: changedHash(proof.batchRoot),
+    })).toBe(false);
+    expect(verifySurplusMerkleProof(originalSale, {
+      ...proof,
+      saleHash: changedHash(proof.saleHash),
+    })).toBe(false);
+  });
+});
+
+describe("FileSurplusVectorProofLedger", () => {
+  it("persists intent before confirmation and never selects confirmed sales again", async () => {
+    const directory = await temporaryDirectory();
+    const path = join(directory, "proofs", "ledger.json");
+    let now = Date.parse("2026-08-28T12:00:00.000Z");
+    const ledger = await FileSurplusVectorProofLedger.open(path, { now: () => now });
+
+    expect(await ledger.ingestSales([
+      sale("sale-c"),
+      sale("sale-a"),
+      sale("sale-b"),
+      sale("sale-a"),
+    ])).toEqual({ inserted: 3, duplicates: 1 });
+    expect(ledger.selectUnprovedSales(2).map((item) => item.saleId)).toEqual([
+      "sale-a",
+      "sale-b",
+    ]);
+
+    const intent = await ledger.persistPendingBatch(["sale-b", "sale-a"]);
+    expect(intent.leaves.map((leaf) => leaf.saleId)).toEqual(["sale-a", "sale-b"]);
+    expect((await stat(path)).mode & 0o777).toBe(0o600);
+
+    const restarted = await FileSurplusVectorProofLedger.open(path, { now: () => now });
+    expect(restarted.pendingBatchIntent()).toEqual(intent);
+    expect(() => restarted.selectUnprovedSales()).toThrow(
+      "pending Surplus proof batch must be resolved first",
+    );
+    await expect(restarted.createPendingBatch()).rejects.toThrow(
+      "pending Surplus proof batch must be resolved first",
+    );
+
+    now += 1_000;
+    const txHash = "AB".repeat(32);
+    const confirmed = await restarted.confirmPendingBatch(intent.batchRoot, txHash);
+    expect(confirmed.txHash).toBe(txHash.toLowerCase());
+    for (const id of ["sale-a", "sale-b"]) {
+      const proof = restarted.dashboardProof(id);
+      expect(proof).toMatchObject({
+        status: "confirmed",
+        batchRoot: intent.batchRoot,
+        txHash: txHash.toLowerCase(),
+      });
+      expect(verifySurplusMerkleProof(sale(id), {
+        saleHash: proof!.saleHash,
+        batchRoot: proof!.batchRoot!,
+        leafIndex: proof!.leafIndex!,
+        leafCount: intent.count,
+        siblings: proof!.siblings,
+      })).toBe(true);
+    }
+
+    const confirmedRestart = await FileSurplusVectorProofLedger.open(path);
+    expect(confirmedRestart.selectUnprovedSales().map((item) => item.saleId))
+      .toEqual(["sale-c"]);
+    expect(confirmedRestart.confirmedBatchHistory()).toEqual([confirmed]);
+  });
+
+  it("deduplicates exact sales and rejects an immutable id conflict", async () => {
+    const directory = await temporaryDirectory();
+    const path = join(directory, "ledger.json");
+    const ledger = await FileSurplusVectorProofLedger.open(path);
+
+    expect(await ledger.ingestSales([sale("sale-a")]))
+      .toEqual({ inserted: 1, duplicates: 0 });
+    expect(await ledger.ingestSales([sale("sale-a")]))
+      .toEqual({ inserted: 0, duplicates: 1 });
+    await expect(ledger.ingestSales([
+      sale("sale-a", { sellerCostMicroUsd: 84 }),
+    ])).rejects.toThrow("Conflicting Surplus sale id");
+    expect(ledger.selectUnprovedSales()).toHaveLength(1);
+  });
+
+  it("records a safe failed attempt and makes its sales eligible for a later batch", async () => {
+    const directory = await temporaryDirectory();
+    const path = join(directory, "ledger.json");
+    let now = Date.parse("2026-08-28T12:00:00.000Z");
+    const ledger = await FileSurplusVectorProofLedger.open(path, { now: () => now });
+    await ledger.ingestSales([sale("sale-a"), sale("sale-b")]);
+    const intent = await ledger.createPendingBatch();
+    if (intent === null) throw new Error("Expected a pending test batch");
+
+    now += 1_000;
+    const failure = await ledger.failPendingBatch(intent.batchRoot, "submit");
+    expect(failure).toEqual({
+      batchRoot: intent.batchRoot,
+      count: 2,
+      firstSaleId: "sale-a",
+      lastSaleId: "sale-b",
+      stage: "submit",
+      failedAt: "2026-08-28T12:00:01.000Z",
+    });
+    expect(ledger.dashboardProof("sale-a")).toMatchObject({
+      status: "failed",
+      batchRoot: intent.batchRoot,
+      txHash: null,
+      leafIndex: 0,
+    });
+
+    const restarted = await FileSurplusVectorProofLedger.open(path);
+    expect(restarted.failedAttemptHistory()).toEqual([failure]);
+    expect(restarted.selectUnprovedSales().map((item) => item.saleId)).toEqual([
+      "sale-a",
+      "sale-b",
+    ]);
+    const retry = await restarted.createPendingBatch();
+    expect(retry?.batchRoot).toBe(intent.batchRoot);
+    expect(restarted.dashboardProof("sale-a")?.status).toBe("pending");
+  });
+
+  it("stores only canonical sale fields and proof data", async () => {
+    const directory = await temporaryDirectory();
+    const path = join(directory, "ledger.json");
+    const ledger = await FileSurplusVectorProofLedger.open(path);
+    const input = {
+      ...sale("sale-a"),
+      apiKey: "must-not-be-written",
+      buyerAddress: "must-not-be-written",
+    };
+
+    await ledger.ingestSales([input]);
+
+    const text = await readFile(path, "utf8");
+    expect(text).not.toContain("must-not-be-written");
+    expect(text).not.toContain("apiKey");
+    expect(text).not.toContain("buyerAddress");
+  });
+
+  it("rejects ledger symlinks on load and before an atomic write", async () => {
+    const directory = await temporaryDirectory();
+    const target = join(directory, "target.json");
+    const loadPath = join(directory, "load-ledger.json");
+    await writeFile(
+      target,
+      '{"version":1,"sales":[],"pendingBatch":null,"confirmedBatches":[],"failedAttempts":[]}\n',
+      { mode: 0o600 },
+    );
+    await symlink(target, loadPath);
+    await expect(FileSurplusVectorProofLedger.open(loadPath)).rejects.toThrow();
+
+    const writePath = join(directory, "write-ledger.json");
+    const ledger = await FileSurplusVectorProofLedger.open(writePath);
+    await symlink(target, writePath);
+    await expect(ledger.ingestSales([sale("sale-a")])).rejects.toThrow(
+      "wrong file type",
+    );
+    expect(await readFile(target, "utf8")).not.toContain("sale-a");
+  });
+});
diff --git a/tests/unit/tx-anchor-metadata.test.ts b/tests/unit/tx-anchor-metadata.test.ts
new file mode 100644
index 0000000..d5971da
--- /dev/null
+++ b/tests/unit/tx-anchor-metadata.test.ts
@@ -0,0 +1,227 @@
+import { beforeEach, describe, expect, it, vi, type Mock } from "vitest";
+import type { LiveOgmiosProvider } from "../../packages/shared/src/chain/LiveOgmiosProvider.js";
+import type { WalletKey } from "../../packages/shared/src/tx/types.js";
+
+const mocks = vi.hoisted(() => ({
+  createLucidContext: vi.fn(),
+  providerConstructor: vi.fn(),
+}));
+
+vi.mock(
+  "../../packages/shared/src/chain/OgmiosLucidProvider.js",
+  () => ({
+    OgmiosLucidProvider: class {
+      constructor(options: unknown) {
+        mocks.providerConstructor(options);
+      }
+    },
+  }),
+);
+
+vi.mock(
+  "../../packages/shared/src/tx/internal/lucidContext.js",
+  () => ({ createLucidContext: mocks.createLucidContext }),
+);
+
+import {
+  buildAnchorMetadataTx,
+  SURPLUS_SALE_PROOF_METADATA_LABEL,
+  SURPLUS_SALE_PROOF_PROTOCOL,
+  type SurplusSaleProofAnchorMetadata,
+} from "../../packages/shared/src/tx/wallet/anchorMetadata.js";
+
+const walletKey: WalletKey = {
+  address: "addr1wallet",
+  pubKeyHash: "1".repeat(56),
+  pubKeyHex: "2".repeat(64),
+  privateKeyHex: "3".repeat(64),
+};
+
+function validMetadata(): SurplusSaleProofAnchorMetadata {
+  return {
+    p: SURPLUS_SALE_PROOF_PROTOCOL,
+    root: "a".repeat(64),
+    count: 1_000,
+    first: "sale-000001",
+    last: "sale-001000",
+  };
+}
+
+interface LucidHarness {
+  chain: LiveOgmiosProvider;
+  submitTx: Mock;
+  getUtxos: Mock;
+  newTx: Mock;
+  attachMetadata: Mock;
+  addSignerKey: Mock;
+  setMinFee: Mock;
+  completeTx: Mock;
+  withWallet: Mock;
+  completeSignature: Mock;
+  payToAddress: Mock;
+}
+
+function lucidHarness(): LucidHarness {
+  const submitTx = vi.fn().mockResolvedValue("submitted-hash");
+  const chain = {
+    url: "http://ogmios.test",
+    fetchImpl: undefined,
+    submitTx,
+  } as unknown as LiveOgmiosProvider;
+  const realWalletUtxos = [
+    { txHash: "f".repeat(64), outputIndex: 0, assets: { lovelace: 25_000_000n } },
+  ];
+  const getUtxos = vi.fn().mockResolvedValue(realWalletUtxos);
+  const completeSignature = vi.fn().mockResolvedValue({
+    toCBOR: () => "signed-anchor-cbor",
+    toHash: () => "b".repeat(64),
+  });
+  const withWallet = vi.fn(() => ({ complete: completeSignature }));
+  const completeTx = vi.fn().mockResolvedValue({ sign: { withWallet } });
+  const payToAddress = vi.fn();
+  const txBuilder: Record<string, unknown> = {
+    pay: { ToAddress: payToAddress },
+  };
+  const attachMetadata = vi.fn(() => txBuilder);
+  const addSignerKey = vi.fn(() => txBuilder);
+  const setMinFee = vi.fn(() => txBuilder);
+  Object.assign(txBuilder, {
+    attachMetadata,
+    addSignerKey,
+    setMinFee,
+    complete: completeTx,
+  });
+  const newTx = vi.fn(() => txBuilder);
+  const lucid = {
+    wallet: vi.fn(() => ({ getUtxos })),
+    newTx,
+  };
+  mocks.createLucidContext.mockResolvedValue({ lucid });
+
+  return {
+    chain,
+    submitTx,
+    getUtxos,
+    newTx,
+    attachMetadata,
+    addSignerKey,
+    setMinFee,
+    completeTx,
+    withWallet,
+    completeSignature,
+    payToAddress,
+  };
+}
+
+beforeEach(() => {
+  vi.clearAllMocks();
+});
+
+describe("buildAnchorMetadataTx", () => {
+  it("signs label-674 metadata with real wallet inputs and submits once", async () => {
+    const harness = lucidHarness();
+    const metadata = validMetadata();
+
+    const result = await buildAnchorMetadataTx({
+      chain: harness.chain,
+      walletKey,
+      metadata,
+    });
+
+    expect(mocks.providerConstructor).toHaveBeenCalledWith({
+      ogmiosUrl: "http://ogmios.test",
+      fetch: undefined,
+    });
+    expect(mocks.createLucidContext).toHaveBeenCalledWith(
+      expect.anything(),
+      walletKey,
+      { networkId: 1, systemStartUnix: 0, slotLengthMs: 1000 },
+      { usePresetProtocolParameters: true },
+    );
+    expect(harness.getUtxos).toHaveBeenCalledOnce();
+    expect(harness.newTx).toHaveBeenCalledOnce();
+    expect(harness.attachMetadata).toHaveBeenCalledWith(
+      SURPLUS_SALE_PROOF_METADATA_LABEL,
+      metadata,
+    );
+    expect(harness.addSignerKey).toHaveBeenCalledWith(walletKey.pubKeyHash);
+    expect(harness.setMinFee).toHaveBeenCalledWith(500_000n);
+    expect(harness.completeTx).toHaveBeenCalledWith({
+      presetWalletInputs: expect.arrayContaining([
+        expect.objectContaining({ assets: { lovelace: 25_000_000n } }),
+      ]),
+      localUPLCEval: false,
+    });
+    expect(harness.withWallet).toHaveBeenCalledOnce();
+    expect(harness.completeSignature).toHaveBeenCalledOnce();
+    expect(harness.payToAddress).not.toHaveBeenCalled();
+    expect(harness.submitTx).toHaveBeenCalledOnce();
+    expect(harness.submitTx).toHaveBeenCalledWith("signed-anchor-cbor");
+    expect(result).toEqual({
+      txCborHex: "signed-anchor-cbor",
+      expectedTxHash: "b".repeat(64),
+    });
+  });
+
+  it.each([
+    ["wrong protocol", { ...validMetadata(), p: "surplus-sale-proof-v2" }],
+    ["short root", { ...validMetadata(), root: "a".repeat(63) }],
+    ["uppercase root", { ...validMetadata(), root: "A".repeat(64) }],
+    ["non-hex root", { ...validMetadata(), root: "z".repeat(64) }],
+    ["zero count", { ...validMetadata(), count: 0 }],
+    ["fractional count", { ...validMetadata(), count: 1.5 }],
+    ["unsafe count", { ...validMetadata(), count: Number.MAX_SAFE_INTEGER + 1 }],
+    ["empty first ID", { ...validMetadata(), first: "" }],
+    ["control character in last ID", { ...validMetadata(), last: "sale\n2" }],
+    ["non-ASCII first ID", { ...validMetadata(), first: "salé-1" }],
+    ["extra field", { ...validMetadata(), extra: true }],
+  ])("rejects %s before initializing Lucid", async (_case, metadata) => {
+    const harness = lucidHarness();
+
+    await expect(
+      buildAnchorMetadataTx({
+        chain: harness.chain,
+        walletKey,
+        metadata: metadata as SurplusSaleProofAnchorMetadata,
+      }),
+    ).rejects.toMatchObject({ reason: "anchor_metadata_invalid" });
+
+    expect(mocks.providerConstructor).not.toHaveBeenCalled();
+    expect(mocks.createLucidContext).not.toHaveBeenCalled();
+    expect(harness.submitTx).not.toHaveBeenCalled();
+  });
+
+  it("rejects metadata text over 64 UTF-8 bytes before initializing Lucid", async () => {
+    const harness = lucidHarness();
+
+    await expect(
+      buildAnchorMetadataTx({
+        chain: harness.chain,
+        walletKey,
+        metadata: { ...validMetadata(), last: "x".repeat(65) },
+      }),
+    ).rejects.toMatchObject({ reason: "anchor_metadata_oversized" });
+
+    expect(mocks.providerConstructor).not.toHaveBeenCalled();
+    expect(mocks.createLucidContext).not.toHaveBeenCalled();
+    expect(harness.submitTx).not.toHaveBeenCalled();
+  });
+
+  it("does not submit when transaction construction fails", async () => {
+    const harness = lucidHarness();
+    harness.completeTx.mockRejectedValueOnce(new Error("coin selection failed"));
+
+    await expect(
+      buildAnchorMetadataTx({
+        chain: harness.chain,
+        walletKey,
+        metadata: validMetadata(),
+      }),
+    ).rejects.toMatchObject({
+      reason: "anchor_metadata_build_failed",
+      message: "coin selection failed",
+    });
+
+    expect(harness.submitTx).not.toHaveBeenCalled();
+  });
+});