EIP-8369 Profile 2: deterministic Frame omission check for FOCIL

## Problem

EIP-7805 currently has an executable Profile-1 omission check: an omitted inclusion-list transaction is tested for appendability at the end of the payload. That is not sufficient for EIP-8141 Frame transactions because validity can depend on programmable validation state.

EIP-8369 defines the nonbinding Profile-2 model and explicitly leaves consensus enforcement to a Standards Track extension. The missing executable boundary is therefore cross-EIP: given the same IL, payload, parent state, and builder claim, every EL must derive the same omission verdict for an eligible Frame transaction.

This is already a live integration gap rather than a theoretical one: client integration work has had to exclude Frame transactions from FOCIL omission enforcement until Profile 2 exists.

Related trackers: #1900 (EIP-7805), #2829 (EIP-8141).

## Proposed executable contract

For each omitted IL occurrence admitted by the Profile-2 static budget fill:

```text
resolve_frame_omission(
tx,
payload,
parent_state,
claimed_index,
fork_context,
) -> ENFORCE | EXCUSE
```

with the conformance invariant:

```text
same inputs => same verdict across EELS and independent clients
```

### 1. Candidate classification

A Frame transaction is a Profile-2 candidate only when it satisfies the EIP-8369 transaction-only rules:

- statically valid EIP-8141 transaction;
- empty blob-versioned-hash list;
- one of the admitted validation-prefix shapes;
- no atomic-batch flag in the validation prefix;
- no VERIFY frame after the validation prefix;
- static VERIFY cost within the per-tx cap.

Profile-1 behavior remains unchanged.

### 2. Claimed evaluation index

Evaluate an omitted Profile-2 transaction at the authenticated builder claim.

- `0` = before the first payload transaction;
- `len(payload.transactions)` = end of payload;
- missing or out-of-range claim defaults to end of payload.

Claim encoding/transport/commitment is intentionally a separate scope (execution-apis#882); EELS should consume the resolved claim as an input to the omission rule.

### 3. Authenticated state-at-index

Reconstruct the evaluation state from:

- parent state;
- pre-execution system updates;
- EIP-7928 block access-list changes for transactions before the claimed index.

The state-view interface must reproduce at least:

- sender/payer account fields;
- permitted sender/payer storage slots;
- code + codeHash for validation-reached accounts;
- EIP-8250 keyed nonce state;
- EIP-8272 recent-root state;
- cumulative gas consumed before the index.

A missing authenticated value is not an omission excuse.

### 4. Bounded isolated replay

Replay only the EIP-8141 validation prefix under a fully pinned block/fork environment. The replay must enforce the Profile-2 access matrix rather than public-mempool policy.

State outside the Profile-2 surface makes the transaction ineligible; it must not be silently read from ambient client state.

### 5. Verdict

Omission is unjustified (`ENFORCE`) iff all of the following hold:

- an occurrence survived the static per-IL budget fill;
- fee validity passes;
- stateful Profile-2 eligibility succeeds at the claimed index;
- the validation prefix succeeds and sets a payer according to EIP-8141 semantics;
- transaction gas fits the remaining block gas at that index.

Otherwise the omission is excused for the specific normative reason.

## Test matrix

The first conformance corpus should include, at minimum:

- all four admitted Frame validation-prefix shapes;
- index `0`, intermediate index, end-of-payload, missing claim, out-of-range claim;
- validity changed by an earlier payload transaction;
- fresh keyed nonce and consumed keyed nonce;
- valid and stale recent-root reference;
- sender payer and separate payer;
- payer balance mutation before/after the claimed index;
- codeHash/code-body dependency;
- permitted sender/payer slot and forbidden external storage read;
- reverted validation prefix;
- invalid protocol signature;
- VERIFY budget exhaustion / per-tx overflow;
- insufficient remaining block gas;
- identical state reconstructed by two state providers producing the same verdict.

Mutation controls should prove the corpus detects at least: replay-at-end instead of claimed index, external-storage admission, unauthenticated-state fallback, and undercharging the static VERIFY budget.

## Scope boundary

This issue is the **eligibility/replay algorithm**, not:

- the CL/EL encoding and transport of claimed indices (execution-apis#882), or
- FOCIL's existing post-reveal `inclusionListSatisfied` fork-choice enforcement.

Keeping those decisions separate lets each consensus boundary be reviewed without reopening the others.

## Proposed landing shape

I am preparing this as executable spec + conformance vectors, with the Frame-side logic based on the current `devnets/frames/0` implementation and the FOCIL-side check based on the current EIP-7805 branch. I will link the implementation PR(s) here.

Start with the current devnets/frames/0 implementation, the EIP-7805 branch, and the EIP-8369 and EIP-8141 rules. Define the claimed-index state reconstruction, bounded validation-prefix replay, eligibility, and ENFORCE/EXCUSE verdict, then add executable specification and conformance vectors covering the stated test matrix and proving identical inputs produce identical verdicts.

Written by the indexing model from the issue text.