Shekyl Changelog

[Unreleased]

Added

• Your sent transactions now appear in your transfer history, and they say what actually happened to them. get_transfers / get_transfer_by_id project send-journal rows as direction: OUTGOING with the realized fee and txid-keyed ids (SJ-DQ-7, PR-SJ-2, feat/wallet-rpc-outgoing-sj2). Closes the Phase 4b W-D FOLLOWUP; Engine journal record landed in PR-SJ-1 (#414).

  Each outcome is its own state rather than being folded into a neighbouring one, because every such fold is a different lie to the person reading their history (rule 82):

  • FAILED — the daemon refused the send; it was never mined. Never reported as CONFIRMED.
  • DROPPED — the wallet's watchdog established that the network no longer holds the send and released the funds for re-spending. Never reported as PENDING: the wallet has stopped waiting, and saying otherwise would contradict the balance the same wallet reports.

  Transfer.block_height is now optional and means inclusion height only. A send that was never mined carries no height instead of the height it was dispatched at, so no client renders a plausible block number beside a payment that does not exist on chain. since_height bounds inclusion height and therefore never hides a row that has none — unsettled, failed and dropped sends survive any polling watermark, including across a reorg that returns a confirmed send to unsettled.

  get_transfer_by_id now distinguishes a malformed id (-32602) from a well-formed id naming no row (-29400): an uppercase txid pasted from a block explorer is answered as a formatting problem, not as "that transfer does not exist".

  shekyl-cli wallet transfers shows the fee alongside the amount, and prints — where a row has no inclusion height.

• WI-RPC-4 thin CLI/RPC surfaces (feat/wallet-rpc-wi-rpc-4-thin): get_wallet_info aggregates wallet height, daemon height, balances, primary address, capability/network, restore floor, and staking summary in one round-trip (no new Engine API). Transfer gains FA-8 attribution — present on INCOMING rows only, since "which payment request did this arrive against" has no meaning for a row the wallet sent; get_transfers accepts an optional attribution filter. CLI un-stubs engine_info and history incoming --unattributed, and reports ? rather than 0 for a height the server did not send (0 is a real height, so defaulting would show a synced wallet as unsynced). Closes the WI-RPC-2b deferrals for those commands; parity matrix rows 33/39 updated. Contract: docs/api/wallet_rpc.yaml.

• The wallet now keeps a durable record of its own sends. A new send-journal ledger block (docs/design/WALLET_SEND_RECORD.md, PR-SJ-1) records, at dispatch, what a chain replay can never rebuild: the realized recipients and per-recipient amounts (cryptographically unrecoverable under CT), the realized wire fee, the selected input set, and the change amount. Rows follow the tx through the daemon verdict (accepted → lock baseline; terminal refusal → kept as failed-send history; retryable refusal → dispatch undone) and through refresh (confirmed at height; reorg returns the row to dispatched; watchdog release marks it presumed-dead — a display state, keys retained). The journal lives outside the scan-derived state, so it survives rescan_blockchain by construction, and a new merge post-pass re-derives the awaiting-confirmation locks from it during replay.

Changed

• rescan_blockchain no longer refuses while a submitted transaction is unconfirmed. The -29202 RESCAN_BLOCKED refusal previously covered two hazards; the unconfirmed-submitted-tx half is retired — the send journal carries the dispatched input set across the wipe and the locks re-derive during replay, so a never-mined transaction can no longer wedge rescan permanently. The refusal remains for outstanding pending-tx reservations (consumer-held or in-flight), whose in-memory output locks index rows the wipe would destroy.

• The relay hop parameter now carries measured provenance: the adopted verification-cost table lands. shekyl-relay-privacy gains verify_cost.rs — the DAEMON_RELAY_PRIVACY.md §80 decision as code: a per-shape f(n_in, tree_depth) lookup over two closed axes, populated with the spec machine's (Raspberry Pi 4, rule 76) pinned measurements, refusing — never clamping — past its edge or at an unpopulated cell, with cell provenance as an asserted field so a spec value can never again be filled by scaling a fast machine's number. DandelionParams::adopted() derives hop through the table (124.5 ms modal verification + a 50 ms transit assumption recorded as such), and both FFI construction sites (embargo timer, relay zone) now build from it.

  No behavior change: the derived hop equals the inherited 175 ms by arithmetic — the old constant was Monero-era processing plus an ocean crossing; ours is FCMP++ verification plus the same crossing — so the embargo stays 190 s and the wallet propagation timeout 874 s, both test-pinned. What changed is that the number's justification is now a measurement with a named assumption instead of a 2019 laptop comment. Remaining, tracked in FOLLOWUPS.md: recovering the other 44 measured table cells from the bench-host artifacts, per-shape embargo consumption, and the clearnet hop-distribution measurement (§65.3).

Removed

• The transitional rust/shekyl-engine-rpc crate is deleted (C++-retirement roadmap B1). It was the wallet2-era Rust FFI library — a JSON-RPC server and embeddable library wrapping C++ wallet2 through src/wallet/wallet2_ffi.{h,cpp} — and every consumer had already migrated off it: shekyl-cli became a native RPC client at WI-RPC-2a, the Tauri GUI wallet dropped it for in-process shekyl-engine-core path-deps, and Phase 4a/4b/4c built the Engine-native shekyl-wallet-rpc beside it rather than through it. Verified at deletion: no Cargo manifest in the workspace depended on it, no file under rust/ outside the crate referenced wallet2_ffi, and cmake/BuildRust.cmake never built it (it builds shekyl-ffi and shekyl-daemon-image only), so no C++ extern could resolve against it.

  Retired with the crate: its rust-scanner feature and the scanner_state::{LiveLedger, ScannerState} read-side JSON-RPC cache (the FOLLOWUPS entry that scheduled this for a Phase 4b cutover is closed — it retired by deletion instead), its native-sign feature, and its multisig feature, which named no code inside the crate and only forwarded to shekyl-engine-core / shekyl-fcmp; dropping it from the ci/multisig-feature lane removes a no-op arm, not coverage. .github/workflows/codeql.yml loses a now-pointless --exclude, and rust-audit-test.yml's dalek-ff-group isolation loop loses an entry whose every dependency is separately named in the same loop.

  Not in scope: the C++ src/wallet/wallet2_ffi.{h,cpp} facade this crate wrapped is untouched and still compiled. It now has no Rust consumer at all; deleting it is Phase 5's job (docs/design/WALLET_REWRITE_PLAN.md §Phase 5). docs/WALLET_RPC_RUST.md is re-anchored on that surviving C++ surface, and is no longer the wallet-RPC reference — that is docs/api/wallet_rpc.yaml.

[3.1.0-alpha.7] - 2026-08-06

Changed

• Dandelion++ relay timing is now decided in Rust; the daemon C++ is a transport shim. The relay-privacy arc (DAEMON_RELAY_PRIVACY.md, RP-1…RP-4; PRs #370, #372, #374, #377, #380) cut the stem/fluff epoch scheduler, stem map, fluff batching and delays, covert-channel scheduling, and the stem embargo out of levin_notify.cpp / tx_pool.cpp into shekyl-relay + shekyl-relay-privacy behind the shekyl_relay_zone_* / shekyl_dandelionpp_* FFI. src/net/dandelionpp.{h,cpp} is deleted; asio keeps only the sleep (one timer armed from Rust's next_wake()).

  The inherited mechanism was defective, not just relocated: the 39 s Poisson embargo did not follow from its own printed derivation and its distribution contradicted the derivation's survival assumption (F-1/F-2). The replacement is an exact-solve memoryless embargo, re-derived at 190 s after fluff_return_ms was re-measured under the outbound-only flood the anonymity zones actually run (F-7: 2250 → 3250 ms); the wallet's propagation timeout moves 664 → 874 s. Relayed clearnet arrivals now take a 2 %-per-hop anonymity-zone eligibility roll (R-1, #389), and per-successor stem outcomes are recorded (StemWatch) and readable via the new /get_stem_tallies RPC — recorded only; no reputation thresholds act on them yet.

  Operator impact: cover traffic ("noise") is removed, not optional — configuration B (Tor + noise) was an origin-routing oracle, so --tx-proxy's disable_noise flag is a warn-and-ignore no-op and no shipped configuration sends covert padding (the wire-observer defense returns as Q-11 Unit 2). Anonymity-zone deployments now require an outbound-connection floor of 12: --tx-proxy refuses below it and runtime out_peers changes clamp to it (F-8b).

• The relay minimum supported device is stated: Raspberry Pi 4. The hop verification surface (#408, #409; DAEMON_RELAY_PRIVACY.md §§72–87) measured proof-verification cost across the full 48-cell shape domain on both x86 and Pi 4 arms and resolved the decisions: Pi 4 is the provisioning floor (promoted to .cursor/rules/76-device-provisioning-floor.mdc), per-shape cost is a lookup table rather than a scalar or a fitted curve (option D — decoupling FCMP_MAX_INPUTS_PER_TX from the embargo), and the table refuses below-spec entries rather than clamping. The adopted hop parameter set these decisions imply has not yet shipped in shekyl-relay-privacy (tracked in IMPLEMENTATION_INDEX.md, RP row).

• blocks.dat bootstrap files now carry the credit-wire attestation witness, and older files are refused. bootstrap::block_package gained an attestation_witness field, written by blockchain_export and threaded through blockchain_import's verifying connect. Without it a bootstrapped node held no witness for any imported block: it could serve none to its IBD peers and, after the credit-wire cutover, could not re-drive their admission.

  Operator impact: the bootstrap header minor version moves 1.0 → 1.1, and blockchain_import now refuses a file below 1.1 with an explicit "re-export it with this build" message rather than importing a permanently witness-less chain. Re-run blockchain_export to regenerate any existing blocks.dat.

• Genesis regenerated: the final five-founder allocation on every network, and the pins are now reproducible. All three GENESIS_TX strings in src/cryptonote_config.h are re-pinned from freshly generated production wallets (fresh OS entropy via geblock gen-wallets; BIP-39 on mainnet/stagenet, raw-32 on testnet; every wallet restore-verified from its written seed before its address was committed). Mainnet and stagenet move from a single combined 100,000 SKL treasury output to the same 5 × 20,000 SKL shape testnet already shipped; the total (100,000 SKL, the block-0 reward) is unchanged, as are every NETWORK_ID and GENESIS_NONCE (10000 / 10101 / 10002). Only public addresses are committed — no seed material is in any repository.

  Because the genesis tx key is derived from the recipients file, the pins are reproducible from committed inputs: geblock verify is green on all three networks and the byte-compare gate (shekyl-genesis-tool/tests/config_pin_gate.rs::genesis_hex_matches_config_pin) is un-ignored and live in CI — recipients-vs-pin drift now fails the build. The placeholder-era generator test is deleted with the era.

  Derived artifacts re-pinned in the same change: the mining_parity frozen genesis ids; the shekyl-wire regtest vectors (regtest_coinbase_h{0,1,2}.block + hashes; h0 is the mainnet genesis, so it now carries five outputs — coinbase_roundtrip asserts the count per height); and the shekyl-rpc-types §3.4 txid-oracle miner-tx blobs (regtest_coinbase_h{0,1}.tx + pins), which extract from those wire vectors and must move with them. Each network's genesis id is confirmed by three independent derivations: geblock block-id (pure Rust), the C++ generate_genesis_block path in mining_parity, and the live-daemon RPC capture (coinbase_hash also CI-cross-anchors h0 to the published mainnet id). mining_parity asserts the shipped genesis tx_extra is a fixed point of C++ sort_tx_extra and the explicit field order 0x01 → 0x06 → 0x07, making geblock's canonical-emit-order claim fully executable against the real sorter and field parser.

• docs/GENESIS_ALLOCATIONS.md published, fulfilling the GENESIS_TRANSPARENCY.md §5 commitment: per-network allocation tables, genesis identities, the tx-key derivation spec, key-custody statement, and the commands to rebuild and check the pinned bytes independently.

Added

• Levin p2p compression routed through Rust; system libzstd dropped. The C++ epee::levin compression path is now a marshaling shim over the new shekyl_levin_* FFI (rust/shekyl-ffi/src/levin_ffi.rs, backed by shekyl-levin), making the workspace-pinned vendored libzstd the binary's single zstd implementation: the root-CMake zstd detection, the HAVE_ZSTD gate (and its silently-degraded "compression disabled" fallback), the epee system-libzstd link, and the C++ compression constants are all deleted. Receive-side hardening rode the cut: the C++ handler now bounds decompression by min(packet limit, per-command cap) — the same bound the Rust BucketReader enforces — closing a ~34 MB inflation accept-window on NOTIFY_NEW_TRANSACTIONS and a 128-MiB-allocation-per-connection exhaustion surface — the bound is the same expression the bucket header is checked against, so a compressed message can deliver exactly what an uncompressed one could and no more. The emit seam is whole-message (shekyl_levin_compress_message), not payload-level: whether a buffer may be compressed at all is a property of its bucket header, so a payload-level seam left those questions stranded in C++ as a second, weaker copy of the policy — one that checked neither the signature, nor that the header accounted for every byte after it, nor the noise/fragment class whose constant on-wire size is the entire property the white-noise feature buys. epee::levin::try_compress_message is now a forwarding shim and epee::levin::compress_payload is gone; the C++ carries no compression policy at all. Five new levin_compression gtests cover the seam (the C++ tree previously had zero compression coverage), including cover_traffic_is_returned_unchanged — negative-controlled, a 4 KiB dummy compresses to 52 bytes without the guard. The Levin constant-parity CI gate drops its three compression rows (single-sourced in Rust now, nothing left to drift). zstd is promoted to [workspace.dependencies] (decision 2026-08-06) — not to hold a place for the anticipated shard-serving consumer, which the same day's Z-1 measurement ruled out, but because the feature set is load-bearing and must not be re-litigated per crate — pinned default-features = false: the default zdict_builder compiles dictionary-builder C that calls POSIX qsort_r and breaks the Win64 mingw link once zstd objects enter libshekyl_ffi.a, and the default legacy compiles decoders for frame formats v0.1–v0.7 we never emit, which would only widen the attacker-reachable C surface on the p2p receive path.

  Four hardening items rode the same cut:

  • Padding is no longer compressed away. --pad-transactions quantizes a relayed tx blob to a 1024-byte boundary so an observer cannot read transaction volume off the frame size; zstd erases that run almost perfectly. Since the HAVE_ZSTD gate is gone, compression is now unconditional, so make_payload_send_txs skips the compressor when pad is set — privacy over bandwidth, at the only layer that knows the size was deliberate. Pinned on the wire bytes by levin_notify.padding_survives_the_emit_path (the existing padding tests inspect the decoded message, which carries its padding either way and so cannot see this), with levin_notify.unpadded_messages_still_compress as the control that the guard did not simply switch compression off. The test uses pseudorandom bodies matching the Z-1 entropy measurement, because the hazard does not depend on compressible transactions: padding is a long run of one character, so a padded message compresses however random its transactions are. Measured — 9216 payload bytes padded, 8237 on the wire with the guard removed, quantization gone.
  • Decompression writes into caller storage. shekyl_levin_ inflated_size + shekyl_levin_decompress_into replace the buffer-returning decompress export, so the C++ shim inflates straight into its std::string: one allocation instead of two, no copy across the FFI, no wipe of public wire data, and no heap ownership crossing the boundary on the IBD receive path.
  • Failure causes are distinguishable. A frame that is malformed (-3) and one whose declared size exceeds the cap (-7) are separate codes with separate log lines. Both close the connection, but they call for opposite operator responses, and a single code cannot say which.
  • ShekylBuffer::from_vec shrinks to fit. A ShekylBuffer has no capacity field, so shekyl_buffer_free must free through Vec::from_raw_parts(ptr, len, len) — sound only if the allocation was exactly len wide, which zstd::bulk::compress (sized at compress_bound) is not. Now an invariant of the boundary rather than a per-caller obligation.

• shekyl-levin — Rust Levin framing crate (LV-1), inert until wired. The byte-exact Rust skeleton of docs/LEVIN_PROTOCOL.md: the 33-byte bucket header, notification/request/response builders, noise and noise-shaped fragmentation, the zstd COMPRESSED path (feature-gated, HAVE_ZSTD parity), and an incremental BucketReader mirroring the C++ handle_recv state machine (signature early-reject, 256 KiB / 100 MB packet limits, fragment reassembly, message classification). Byte identity is pinned by KATs mirroring the tests/unit_tests/levin.cpp gtests assertion for assertion, and by a CI gate (ci/levin-constant-parity) that fails the build when any hand-copied wire constant stops matching its C++ definition — including HEADER_SIZE, anchored by a new static_assert(sizeof(bucket_head2) == 33) in levin_base.h. The reader is feed/pull (feed buffers, next_message parses one bucket), matching the oracle's dispatch-inside- the-parse-loop shape: at most one decoded payload is live at a time, and a delivered message survives a later bucket in the same read being malformed. Divergences from the C++ are enumerated once, in the crate docs (rust/shekyl-levin/src/lib.rs); every other mention points there rather than restating the list. Framing only — no portable_storage, no sockets, no daemon wiring; the C++ p2p path stays live until the scheduled cutover (IMPLEMENTATION_INDEX.md LV row; FOLLOWUPS "Levin p2p migration" carries LV-2/LV-3). New optional dependency: zstd 0.13 — compatibility with C++ peers comes from the zstd frame format, not from a shared library: zstd-sys compiles its own vendored libzstd unless its non-default pkg-config feature is enabled, while the C++ links the system one. Choosing between them is an LV-3 item (see the manifest comment and the FOLLOWUPS entry) — it needs a link graph that does not exist while the crate is in no staticlib.

• Phase 4c wallet RPC rescan (Engine::start_rescan + rescan_blockchain). Named Engine API that rebuilds the wallet's transaction history from the chain, starting at the wallet's scan floor. Everything a replay cannot re-derive survives — retained tx_keys, notes, payment-request rows, restore height, and the durable staking bond record; everything scan-derived is rebuilt. The chain-global curve tree is left untouched (it holds no wallet data). Every refusal is raised before the destructive step: the single-flight slot it shares with refresh (-29200), a daemon preflight (-29201), and a new -29202 RESCAN_BLOCKED for in-flight transactions whose spend record a chain replay cannot rebuild — checked atomically with the reset, so a concurrently-built transaction cannot slip through. Mid-scan failures after the reset is durable return -29203 RESCAN_INCOMPLETE for every join-path producer failure (not -29201, whose rescan contract is "wallet untouched", and not a catch-all -32603). shekyl-wallet-rpc dispatches rescan_blockchain; CLI rescan is un-stubbed and reports whether a failure left the wallet reset. Closes FOLLOWUPS Phase 4b rescan / WI-RPC-2b rescan deferrals; opens the abandon_tx follow-up that -29202 needs as an escape hatch. Of the Phase 4b quality gaps only the OUTGOING filter remains Engine-gated — the build write-lock and submit verdict entries closed in this same release (below).

• submit_pending_tx reports the real daemon verdict. The wallet-RPC send lifecycle no longer flattens every successful submit to ACCEPTED: Engine::submit_pending_tx{,_async} returns the new identity-bearing SubmitOutcome, and the OpenAPI ALREADY_IN_POOL / ALREADY_IN_CHAIN verdicts — with the verdict-scoped confirmed_height carrying the daemon-claimed confirming height (display metadata, never settlement truth) — are reachable for the first time. The CLI renders the three verdicts distinctly. Lock lifecycle is unchanged: every success verdict places the F14 awaiting-confirmation lock and refresh remains the settlement authority (DAEMON_SUBMIT_VERDICT.md §2.5 / §7.2).

• geblock — deterministic Rust genesis pipeline (rust/shekyl-genesis-tool). Replaces the C++ genesis_builder end-to-end: gen-wallets (exactly five fresh-entropy founder/developer wallets — BIP-39 for mainnet/stagenet, raw-32 for testnet; 0600 custody files staged then promoted, refused inside any git tree before mkdir), build (genesis coinbase hex, same stdout contract as the old tool), verify (rebuilds all three networks and byte-compares against the GENESIS_TX pins in src/cryptonote_config.h, replacing the dead verify_genesis.py; pin-parser always gated on the real header), and block-id (v9-header genesis block id + tx hash). The genesis tx key is now deterministic — cSHAKE256 with customization shekyl/genesis-txkey-v1 over the recipients file — so the pinned genesis is byte-reproducible from committed inputs for the first time; genesis is CT-Null/cleartext/published by design, so the public derivation discloses nothing (GENESIS_TRANSPARENCY.md §5). Recipients move in-repo to config/genesis_recipients.{mainnet,testnet,stagenet}.json in the final 5 × 20,000 SKL shape on all networks (mainnet/stagenet placeholder-keyed until the founder ceremony; the combined single treasury output is retired). Golden KATs pin the derivation → output construction → wire encoding → v9 block hash chain; the config-pin byte-compare gate lands #[ignore]d until the post-regen re-pin un-ignores it (parse coverage is always on).

Removed

• C++ genesis-builder path retired (rules 15/16/20 — superseded by geblock): cryptonote::build_genesis_coinbase_from_destinations (cryptonote_tx_utils.{h,cpp}; its fresh-txkey draw made every build irreproducible), the GENESIS_TOOL_SRC_DIR CMake seam + genesis-builder Makefile target (the shekyl-dev tools/genesis_builder C++ tool they built is deleted in shekyl-dev), and the out-of-build-graph shekyl-crypto-pq/examples/gen_genesis_addrs.rs placeholder generator (its label-derivation continues, documented and testable, as the placeholder_recipients test in shekyl-genesis-tool).

Fixed

• build_pending_tx / submit_pending_tx no longer stall read RPCs. Slow send work (FCMP++ membership assembly, daemon submit RPC) ran under the wallet-RPC process's exclusive Engine lock, so get_balance / get_height / get_transfers blocked for the whole operation. Engine::build_pending_tx{,_async} and Engine::submit_pending_tx{,_async} (and discard_pending_tx) now take &self; wallet-RPC holds a read lock; builds serialize on an engine-owned permit of one inside the engine — taken by build's membership assembly and by submit's stale-reference re-anchor alike, so the network observable is unchanged (one membership-assembly round-trip at a time; raising the permit is an explicitly gated future decision, not a tuning knob).

• A build no longer commits inputs a concurrent refresh invalidated. refresh merges scan results under a shared engine borrow, so it was never serialized against the send lifecycle by the wallet-RPC lock — under the write lock a merge simply landed just after the build instead of during it, and either way the build committed against the state it selected from. Build now re-validates its selected inputs at the commit boundary — the same lock₂ discipline the CT-5d re-anchor applies to its reference — and refuses if the transfer vector shifted under a reorg or an input was observed spent elsewhere, rather than returning a PendingTx the daemon is certain to reject as a double spend.

• A daemon's AlreadyInChain height can no longer strand the spent inputs. The claimed confirming height is untrusted metadata (DAEMON_SUBMIT_VERDICT.md §7.2) but was persisted verbatim as the submit watchdog's horizon baseline. A claim above the wallet's tip — a lying remote node, a reorg-confused daemon, or u64::MAX — held the horizon at zero forever, so the escape ladder never ran and the persisted awaiting-confirmation lock never released: the inputs stayed unspendable across restarts with no alarm. The baseline is now clamped to a height the wallet has actually reached, making §7.2's "bounded liveness cost" damage cap true by construction. The raw claim still routes the release path and still reaches the client.

[3.1.0-alpha.7] - 2026-08-03

Changed

• 8C retention-proof Status REVERSED in part — the challenge payload is superseded by the test≡job sequencing ruling (ARCHIVAL_RETENTION_PROOF_8C_FEASIBILITY.md ↔ ARCHIVAL_TEST_EQUALS_JOB_SEQUENCING.md, 2026-07-29). The Round-1 BUILD statement (~3 KB Merkle opening as the serve challenge) is reversed on its payload: the test must demand the shard (~3.3 MB), because pricing the test three orders of magnitude below the service manufactured the A5 free-rider margin, and the doc's own §3 (public CT tuples — any opening-shaped test is reacquirable by construction) and §4 ("m is the wrong lever until §7.5 closes") already carried the root cause. §7.5's reacquisition hinge is reinstated while Round 1's fetch-on-demand doctrine survives — payload corrected, doctrine preserved. The R_k-anchored verify machinery survives as TJ-A's substrate. Do not build the challenge from the Round-1 statement.

Added

• Shard-indexed staker-share escalation — shape frozen and wired live, genesis-neutral (D2 Stage 3; feat/stage3-escalation-shape). The staker pool share is no longer a frozen constant: it is a pure map of n = frozen_segment_count (the archival burden operand), with the §6.1 shape — monotone, floored at today's 25%, asymptote < 100%, banded-PL integer fixed-point, no controller — implemented in shekyl-units/shekyl-economics with the five constraints as tests and EscalationParams load-time validation (persisted-params digest 0x01→0x02). The wiring is live consensus C++: every burn split routes shekyl_compute_burn_split_escalated, the operand is read at parent-block state through the asserting Blockchain::parent_frozen_segment_count (throws on a template/connect divergence — that mispricing is a chain halt), n is computed once per template build (both construct_miner_tx passes) and once per connect (money check and staker-inflow accrual share it), and the prev_block/from_block template path — the one path that could not read its parent's n — is deleted with the RPC field reserved and loudly refused. SHEKYL_STAKER_POOL_SHARE is deleted from the generated C++ header: no share constant crosses the FFI. Shipped genesis-neutral by construction (asymptote_share == floor_share, bit-identity to the flat constant pinned by test); the asymptote numeric stays provisional-until-testnet under the §11.4 capture-point ceremony (ARCHIVAL_WORK_PRECISION_AND_ESCALATION.md §12.12).

• Daemon chain-store design (DRS-*) — gap-close (docs only). SoT docs/design/DAEMON_REDB_STORE.md (§0.1 Tier A/B, surface map, P0 envelope, findings A-1…A-6). Implementation PRs (pure-virtual hooks, etc.) go on short-lived branches off dev, not direct-to-dev design-session edits.

• Transaction proofs and reserve proofs across the wallet stack (WI-RPC-3; Phase 2c, feat/wallet-rpc-proofs). The shekyl-proofs DLEQ primitives are projected through the Engine (engine/proofs.rs workflow with explicit ProofsCtx per ENGINE_COMPOSITION_DECOMPOSITION.md; KeyActor generates inbound and reserve proofs so secrets never leave the actor), the wallet_rpc.yaml contract, shekyl-wallet-rpc (get_tx_proof, check_tx_proof, get_reserve_proof, check_reserve_proof; the check_* pair is wallet-less — a verifier needs only a daemon), and the CLI (RESERVED stubs un-stubbed, with disclosure warnings and proof strings kept out of readline history). Proof strings are Bech32m (shekyltxproof…/shekylreserveproof…). Prerequisite landed in the same tranche: the send path now retains per-tx secrets in TxMetaBlock.tx_keys at dispatch, with the spend-quadruple (TransferDetails.spending_tx_hash, KeyImageObserved.containing_tx_hash) and reconciliation keeping the I-2 no-orphans invariant through confirmation, reorg, and rescan. Review hardening (F-13): check_reserve_proof rejects any proof whose entries repeat a key image (-29300 malformed) — entries verify independently, so a duplicated unspent output would otherwise inflate the proven reserve N-fold. Review hardening (2026-07-24 high review, retention lifecycle): the retention write moved from the submit-ACCEPTED verdict to dispatch (persisted atomically with the in-flight flip, before the bytes can reach the daemon), closing the crash/restart window that silently lost the secret of an already-exposed tx; terminal and retryable submit verdicts (provably unrelayed) retire the record so refused builds still leave no residue. Retention death is now reconciliation-only: a reorg rewind re-pends unreferenced entries instead of collecting them (a rewound tx commonly re-confirms, and a deleted secret can never serve that proof), and the watchdog's confirmed-absent release clears F14 locks only — its trigger is a local relay verdict, not a proof of network-wide absence. Lifecycle pins amended in wallet_rpc.yaml §OUTBOUND PREREQUISITE. Review hardening (2026-07-24 merge review, F1–F6): get_reserve_proof refuses amount = "0" at the RPC params surface (-32602 "amount must be positive"; the engine's selection independently refuses an empty selection as -29302, so a zero bound can never reach the key actor and surface as an internal error); check_reserve_proof resolves locator-named txs in chunked batched get_transactions calls (100 hashes per call, the daemon's restricted-RPC cap) instead of one round trip per unique txid; OUTBOUND generation reuses the shared secrets derived during recipient-output discovery (generate_outbound_proof_with_secrets — the hybrid KEM runs once per output instead of twice; wire format unchanged, entries stay Zeroizing in transit); the per-output hybrid-KEM ciphertext layout constants have one home (shekyl_crypto_pq::kem::{X25519_KEM_CT_LEN, HYBRID_KEM_CT_LEN} — the scanner/engine/fee-model copies are gone); actor-side proof failures keep their typed ProofError through the workflow error mapping (KeyEngineError::Proof → ProofsError::Generate, honoring the variant's documented discrimination); and the wallet-rpc Hex32 rule has a single shared parser (params::parse_hex32) behind both the txid and transfer-id surfaces.

• cli: receiving, staking, and fee commands over the WI-RPC-1 surface (WI-RPC-2b). request new / requests list (payment requests — the Shekyl-native receive-attribution primitive, un-deadening the FA-8 stubs), make_uri / parse_uri, stake / staked_balance / staked_outputs / staking_info (never-conflated staked-balance breakdown as the RPC reports it), and fee (tier quotes + size/weight estimate; principal lane only — P-lane fees are canonical and never user-facing).

Fixed

• consensus: archival slash single-struck on one missed baseline — sliding-window m-of-n failure confirmation now gates it (feat/archival-failure-window; builds the pinned-but-unimplemented policy of ARCHIVAL_FAILURE_CONFIRMATION_PIN.md §1, pinned 2026-06-08; pre-genesis V3.0 correctness gap). The m-of-n existed only in the Round-1 sim (failure_confirmation::run_sliding), so consensus went straight from gate-2 §6's challenge_failed(P, s, E) to the gate-4 §4.2 slash and forfeited a FLOOR on a single missed challenge — punishing exactly the isolated connectivity flukes the pin exists to absorb, and leaving the Round-2 stressnet with nothing to stress. The slash now fires only when m misses fall within the last n baseline observations for a (P_id, shard) (shekyl-archival-retention::failure_window, reached through shekyl_archival_failure_window_params / _slashable). The interval-append is untouched — slash_open_interval_to_append still produces exactly what the writer appends; only whether it fires moved. The window counts epochs at which a challenge was actually posed, so a bonded-but-untested epoch can never become a miss, and look-back stops at the boundary of the pair's current continuous challengeable run — which makes a Rebond-reinstated record start clean rather than sit one or two misses from the next slash. Nothing is persisted: the window is recomputed from the serve_credit_bit ledger and the bond record, both already reverted by pop_block, so there is no schema change (no rule-42 bump) and reorg safety is structural. m = 11 / n = 13 are the Round-1 provisional values in config/consensus_constants.json (shape genesis-frozen, numerics re-pinned at the Round-2 stressnet — the bond_duration precedent); C++ reads them through the FFI, so there is no cross-language drift pair, and a re-pin is a deliberate two-site edit (the JSON value plus the Round-1 sentinel const-assert that pins the shipped pair — the bond_floor idiom). The consensus decision is held equal to the sim policy that measured the pin by an exhaustive equivalence sweep, and archival_substrate_lmdb covers absorb / sustained-slash / full-window-slide / pop-recompute at the scheduler's production site. Consequence — the window working as designed at end-of-life: the window widens the exit-forgiven tail, so a persona that goes dark can Unbond with full collateral inside the grace, where single-strike would have slashed it at the next deadline. Grounded in the numbers this is not a new escape: the release cooldown is 2 epochs, far below m = 11, so a departing record only rides the same m − 1 forgiveness envelope a still-bonded record already gets, earns nothing while dark, and cannot exceed the window's tolerance without crossing m-of-n and being slashed. An exit-time "clear the window" gate would punish the honest crash-then-leave record identically to the adversarial squeeze — they are on-chain indistinguishable — so it is a mis-fix (rule 82); the exit tail is subsumed by the m/n sizing the Round-2 stressnet already owns (FOLLOWUPS.md V3.1), not a separate decision (rule 21). Two db_lmdb.cpp comments that justified the exit-forgiven tail with "'stop serving and just hold' keeps being slashed every epoch" were single-strike arguments and are corrected in place.

• scanner: KEM-ciphertext extra packing — vout ≥ 1 of multi-output txs was silently unscannable (fix/kem-extra-packing; closes the FOLLOWUPS V3.0 genesis gate "KEM-ciphertext extra packing mismatch", WI-RPC-3 review F-14; pre-genesis, no compat shim per rule 60). Extra::for_hybrid_transfer emitted one 0x06 PqcKemCiphertext extra field per output, but every reader — the scanner's scan path, the proof-check path, shekyl-wire::pqc_kem_per_output, and the C++ wallet2 reader — consumes a single field and slices output o's ciphertext at o × HYBRID_KEM_CT_LEN within it (the packing the C++ writers already emitted). Every output at vout ≥ 1 of a production-built multi-output tx — including all change — was therefore undetectable by the wallet and unverifiable by inbound proof checking. The writer now concatenates all per-output ciphertexts into one 0x06 field (readers unchanged); tx_fee_model::extra_kem_field_weight(n_out) accounts the single field so predict_weight stays byte-exact; bench fixtures serialize through the production writer; regression test asserts both vouts of a production-packed 2-output tx recover through Scanner::scan. On-chain data was intact throughout — a rescan recovers.

Changed

• docs: verified-complete archive policy + Batch 1 relocate. Wrote the durable policy (previously commit-message-only) into docs/design/IMPLEMENTATION_INDEX.md §8, with eligibility triad, living-SoT hold rule, move checklist, and Batches 2–3 / hold ledger. Moved four closed historical records to docs/completed/ after self-check + code verify: ARCHIVAL_REWARD_GATE_M1.md (RETIRED #346), ARCHIVAL_COVER_DRAW.md (RETIRED), REWARD_EMISSION_E3_GATING_ROUND.md (round CLOSED), ARCHIVAL_EXIT_STANDOFF_FD4_WINDOW.md (mechanism deleted; X-1…X-3 CLOSED). Inbound/outbound relative links and path citations repaired (FOLLOWUPS, RELEASE_CHECKLIST, living design SoTs, shekyl-standoff module docs). Stage 0 / Stage 1 PR 4–7 and closed-audit pins remain follow-up batches per the ledger.
• docs: CONFIDENTIAL_STAKING supersession hardening (agent-misread). The retired confidential-claim / 3C / entitlement staking body moved to docs/completed/CONFIDENTIAL_STAKING.md with a loud non-SoT banner. A short redirect stub remains at docs/design/CONFIDENTIAL_STAKING.md naming the living authoritative surfaces (PHASE_2B_STAKE_LIFECYCLE, PRINCIPAL_STAKE_LIFECYCLE, REWARD_EMISSION_LEG, bond/firewall docs) so basename greps under docs/design/ hit the tombstone instead of ~1300 lines of obsolete design that read as current. Index §8 records the superseded-with-stub pattern.
• proofs: tx-proof wire format carries per-entry vout indices (WI-RPC-3; pre-genesis wire change, no compatibility shim per rule 60). Outbound/inbound per-output entries grew a vout_index[u32 LE] prefix (128 → 132 bytes) so verification re-derives KEM secrets at the actual output index; previously non-prefix output subsets verified incorrectly against positional indices. FFI (shekyl_generate_tx_proof_inbound) and the wallet2 caller pass explicit indices.

Removed

• cli: get_tx_key / check_tx_key (WI-RPC-3; rule 60/21). Exporting the raw per-transaction secret is the wallet2-era mechanism; the DLEQ-based get_tx_proof/check_tx_proof is the product (proves the payment without an interactive secret handoff, and INBOUND proofs never reveal wallet key material at all). The commands refuse at parse time with guidance naming the replacement.
• engine-state: TxSecretKeys.additional (WI-RPC-3 adjacent, rule 15). No producer existed — the send path signs every output including change with one tx key; TX_META_BLOCK_VERSION bumped to 2.
• cli: wallet2-era commands with no Shekyl-native equivalent (WI-RPC-2b; rule 60, WI-RPC-1 pin 1). account* / address new (no account or subaddress model — payment requests replace receive attribution), seed / viewkey / spendkey (no secret-egress RPC by design; the mnemonic shows once at create/restore), export/ import_key_images (Phase 2d bundles replace the workflow — locked), and sweep_all (no engine surface; FOLLOWUPS row carries the reopening criterion). Removed commands and --account/--subaddr-* flags refuse at parse time with guidance naming the replacement. RESERVED stubs (proofs, sign/verify, offline signing, rescan, wallet info, unattributed receives) name their gates; carriers in docs/FOLLOWUPS.md §"WI-RPC-2b deferrals". CLI_PARITY_MATRIX.md reconciled against the new command set.

Security

• wallet-rpc: in-process RPC serves over a private Unix domain socket, not auth-less loopback TCP (WI-RPC-2a; WALLET_REWRITE_PLAN.md Shape B). spawn_in_process previously bound an ephemeral 127.0.0.1 TCP port with authentication disabled — reachable by any local process for the lifetime of a CLI session. It now serves over a UDS created 0600 inside a private per-spawn 0700 directory under $XDG_RUNTIME_DIR (private tempdir fallback), removed on shutdown. Priority-1 fix under 00-mission.mdc: the wallet's unauthenticated command surface is no longer visible to other local users or processes outside the owning uid.
• cli/wallet-rpc: seed and secret hygiene across the RPC surface (WI-RPC-2a). The interactive create now preflights terminal safety before creating the wallet and has no non-TTY fallback: it refuses to print the one-time seed to a pipe, redirect, or log (the deliberate, auditable file path is create --seed-out). The JSON-RPC client zeroizes the serialized request/response byte buffers that carry the password and seed (rule 35), not just the caller's own copies. Internal wallet-RPC error messages no longer echo raw io/persistence strings that can carry a local filesystem path or schema detail — they return a category-only message and log the cause server-side (honoring the message() never-carries-secrets contract, rule 30).

Added

• wallet-rpc: restore_wallet (WI-RPC-2a; contract in docs/api/wallet_rpc.yaml same PR). Restores a wallet from its seed backup
  • password + optional restore_height, mirroring create_wallet's lifecycle shape. The seed format is network-governed, matching create: mainnet/stagenet take a BIP-39 mnemonic, testnet a 32-byte raw seed as hex (so a testnet wallet made by this stack is recoverable). Error mapping keeps seed material out of every message (stable InvalidParams strings).
• cli: native wallet-RPC client (WI-RPC-2a; ratified Shape B, decision log 2026-04-25). shekyl-cli is now always a JSON-RPC client: the REPL and one-shot commands self-host shekyl-wallet-rpc in-process over the private UDS above; --rpc-url targets an external daemon. Core commands (lifecycle incl. restore, balance, address, status, refresh, the build→confirm→submit/discard transfer flow, transfers) run over the OpenAPI contract; the CLI is presentation-only.
• cli: non-interactive create / restore subcommands (WI-RPC-2a) for scripting/automation. shekyl-cli create <name> --seed-out <path> [--password-file <path> | --password-stdin] writes the one-time seed backup to an explicit 0600 file (O_EXCL, fsync) instead of a terminal; restore <name> --seed-file <path> … reads it back. This is the sanctioned way for a seed to reach a file — the interactive path refuses non-TTY output rather than leak it (see Security).

Removed

• cli: the wallet2 FFI path (WI-RPC-2a). EngineContext and the shekyl-engine-rpc dependency are deleted from shekyl-cli; a test gate greps the crate for wallet2/shekyl-engine-rpc/EngineContext identifier residue. Commands whose native RPC surface has not landed answer with a uniform transitional stub (migrated or deleted in WI-RPC-2b).

Security

• consensus: output points must be canonical prime-order at admission (GENESIS_TX_WIRE_FORMAT.md §2.3 output-point rule, ratified 2026-07-22; prompted by advisory GHSA-r675-h3pj-wj2f). Every output public key O (all tx shapes, including coinbase) and every coinbase outPk mask must be a canonical, prime-order (torsion-free) encoding — output keys additionally non-identity — matching the strictness the FCMP++ leaf builder already applies. Previously a torsioned/identity output point passed the inherited crypto::check_key (on-curve only) or, for coinbase masks under CTTypeNull, no point check at all, and was then silently skipped by curve-tree leaf construction: deterministic on every node and self-inflicted (the output was unspendable and unreceivable — not a theft or inflation vector), but a permanent hole in the every-on-chain-output-is-a-leaf invariant. Admission now rejects loudly. Single home shekyl-ct-balance::{check_output_keys, check_commitment_masks} (the crate owning §2.3 point canonicality), exported as shekyl_check_output_keys / shekyl_check_commitment_masks; the C++ check_outs_valid / check_commitment_mask_valid are now thin marshaling shims (rule 20 boundary advancement), the trivial-mask fingerprints (identity, G, coinbase zeroCommit(amount)) migrated to Rust in the same cut, and prevalidate_miner_transaction gains the previously-missing output-key gate for the miner tx. Pre-genesis freeze: no installed base ever ran the lax rule, so no fork surface exists.

Removed

• the GF-7 order coin, the entry-seam "second event," and the r = 1.86 verdict (the GF-7 retirement: PR #354 §14.4 withdrawal, PR #356 deletion, PR-C retraction; ARCHIVAL_BOND_WI4_MEASUREMENT.md §13.1 + §14.4 banners). Gone: the bond_first order coin (draw_entry_gap now returns the bare spread), the whole second-event abstraction (shekyl-standoff::plan — EntrySeamPlan/plan_entry_seam/ is_inverted), the phantom FundingSendDispatched timeline event, the conformance fair-order grade, FORCED_CAUSAL_ORDER, and the sim's inversion axis. Ground (unconditional, no posture qualifier): at entry only the bond post is chain-attributable — the funding transfer is the unnamed, CT-hidden FCMP++ input, so there was never a second event to order, and the channel r = 1.86 measured was never on the chain (the correlator held its anchors by construction — the strawman). The transport observer is the named residual, defended structurally by shekyl-p-transport circuit isolation (open front: the principal-side default flip, WI-4 §18.13). The spread survives only against an off-chain-anchored adversary (execution site due_height, pscan/dispatch.rs); DEFAULT_ENTRY_GAP_WINDOW = 600 converts to an F-W3-pattern provisional sentinel; GF4b-2's funding-input count is the surviving entry-seam channel (structural, gated, not yet closed). The §14.4 founder-cover PARTITION-PASS was withdrawn in full alongside (false premise, retired §14 posture, 70%-phantom feature dictionary) — distinct from and not touching the Foundation's five CompleteTree reliability anchors. Golden vector re-frozen [u64; 16] with a consumption-identity proof (exactly one word removed per draw); new bounded_uniform cover-scale KAT. No wire change (the persisted record already stored the bare scalar). Deliberately retained fail-closed as reference: both sim arms emit named withdrawals (GF7_FAIL_CLOSED, the §14.4 WITHDRAWN status) — never a verdict — a doc that says "not citable" loses to a binary that prints a pass on demand.

• the M1 K_COVER gate machinery (the implementation half of the retirement below; ARCHIVAL_REWARD_GATE_M1.md §13.3 enumerates the surface). Gone from production code: the epoch_close_compute early return and the frozen_shard_count/k_cover operands, the k_cover.rs sentinel module + KCover newtype, the build.rs generation + JSON keys, the provisional-k-cover feature and its seven enablement sites, the FFI/C++ operand pass (shekyl_archival_epoch_close_compute loses a parameter; the segment-freeze O(1) frozen-count substrate stays — it is freeze bookkeeping with future consumers), the G-row gate KATs + fixture, and the predicate-sites tripwire's gate invariant — its five segment-freeze substrate invariants survive as check_segment_freeze_sites.sh, still wired as consensus-invariants [5/5] (cursor accounting, boundary operator, writer/division/ counter-mutation one-site). Deliberately retained as reference: shekyl-staking-sim (the partition-adversary and GF-7 instruments), every sim finding and measurement record in the design docs, and the M1 spec itself — the record that this was considered thoroughly and rejected after the surviving-justification audit. No behavior change at any tip (the gate only ever ran as the k_cover = 0 identity).

Changed

• wallet design: the §15 remote-daemon structural refusal is REJECTED at review (WI-4 §15 head banner, 2026-07-23; the GF-7 retirement arc's fourth surface). The proposed dispatch-driver refusal does not ship: the endpoint check measures socket locality, not control, and errs in both directions (tunnel false-negative — §15.3's own concession — and own-LAN/VPS false-positive); refusal removes user choice on a proxy signal; and the pricing's r ≈ 5 basis is from the withdrawn instrument. The ratified replacement: the asymmetric warn-only rule (non-loopback draws a warning true regardless of daemon control; loopback draws silence; no configuration ever draws an assurance — the anti-autodetect rule) and the structural defense of circuit isolation (persona side already built — shekyl-p-transport, unrepresentable-otherwise), with the principal-side Tor default flip as the open front. §15.4's transport-isolation reopening criterion is dispositioned absorbed — the path it named was built. The warn-only disclosure is BUILT (shekyl-cli::network_posture: warns on a non-loopback endpoint that no configured proxy actually reaches, silent on loopback / unix socket / a genuinely proxied connection. --proxy is wired into the --rpc-url client (ureq) and the REPL's direct daemon client, so those are proxied and stay silent; the self-hosted server's block-scanning connection to the daemon has no proxy support in its transport, so a non-loopback daemon warns regardless of --proxy — the warning reflects what is actually proxied, never a global --proxy is set guess. A test pins that the only emissible message is a warning — never an assurance; it does not grade the operator's own proxy). The principal-side Tor default flip is not yet built — Tor as default and a first-class, never-ambient opt-out are settled, but the embedded-Arti-vs-external-Tor source fork and the transport-selection knob (whose axis is who provides the transport, not "Tor or not") remain open and are deliberately not being decided by implementation. The broadcast-③ type-level refusal (SP-T4a BroadcastPosture, no ThirdParty variant) is untouched — that one is structure, not detection.

• consensus design: the M1 K_COVER reward gate is RETIRED (ARCHIVAL_REWARD_GATE_M1.md §13 — the record; spec preserved, code removal tracked in FOLLOWUPS as the implementation half). Ruling: reward withholding is legitimate only as the consequence of an action the individual controls — slash/bad-intervals is the stick a staker accepts, payment is the carrot that makes it acceptable; a collective gate that zeroes every persona's rewards on an uncontrollable condition is retired as a concept. The surviving-justification audit (M1 §13.1): anti-farming is structural in the serve-credit acceptance gate (unfrozen shards uncreditable, data possession proven, per-(P,shard,E) dedup), inflation is bounded by construction (Σ rewards ≤ budget(E) — the denominator sums the numerators), and the privacy floor inverted on the lineup argument: every relevant anonymity denominator (ambient traffic, unmarked joins, active personas) is built by paid participation, which the gate suppressed — it confiscated the g(age)/r_market pioneer premium that funds the organic cover bootstrap and zeroed the §14 founder personas' own market rewards. The WI-4 §13.2 cold-start measurement stands, re-dispositioned to the (now market-funded) founder-entry schedule plus a wallet-side thin-market entry disclosure (new FOLLOWUPS build item). No behavior changes at any tip: the gate has only ever run as the k_cover = 0 gate-identity degenerate.

Added

• wallet (engine): F-D2 aggregate drain-balance read — DS-PR-3 PR-A (ARCHIVAL_DRAIN_SEND_FD2.md §1 layer 1). The core-side "how much is drainable?" accessor the GUI polls: Engine::drain_balance_aggregate (engine/drain_read.rs), a self-arc method that loads the sealed PScanState, anchors the canonical send-path reference via bond_orchestrator::anchored_reference_block (the same helper the drain path anchors through — so the displayed drainable figure is measured at the block a spend proves against, never raw tip), and returns drain_balance's aggregate scalar. "Spendable" is mature ∧ unreserved: a funding output a live bond post / claim / drain already commits (the sealed reserved_gindexes union, read via load_pending_posts_for_engine) is netted out — the same "spendable = unreserved mature" definition the bond sweep uses. The F-D1 planner (plan_drain / project_drain_operands) applies the identical reserved carve, so the read total, the drain plan's affordability check, and the selectable candidate set are one consistent net set: the numbers reconcile, and the selector can never pick an output an in-flight tx already holds (a double-spend of a committed input). Non-stakers / unscanned wallets report an honest Ok(0) (short-circuited before anchoring). The new DrainBalanceReadError is two-armed by design (rule 82; DS-PR-3 locked decision) — Unanchorable (transient; the UI renders "syncing", never a zero) vs. State (non-transient fault) — so a balance read never renders a misleading zero and never conflates "still syncing" with a real fault; the anchor-error mapping fails closed with a static message on any unexpected arm, so no amount or gindex crosses the read surface. Aggregate-only by construction: no reward decomposition crosses the surface (F-D1 trust boundary). The GUI wiring (EngineSession/command/ render) follows in DS-PR-3 PR-B (shekyl-gui-wallet).

• wallet (engine): F-D2 drain orchestration + dispatch landed — DS-PR-2 (ARCHIVAL_DRAIN_SEND_FD2.md §DS-PR-2, the core-side dispatch half). The P→principal drain request path, the emission-claim sibling:

  • Orchestrator. orchestrate_drain — a free function over an explicit DrainCtx (borrowed handles/records/reserved-set/destination/amounts/ chain_tip, never &Engine; the orchestrate_emission_claim shape): anchor the reference → scope + plan the persona's records → assemble membership paths → delegate to the actor's assemble_drain (engine/drain_orchestrator.rs). No new Engine generic or inherent multi-step method (composition discipline §4).
  • Exit-fee reserve (DS-4 / T-DS-4). EXIT_FEE_RESERVE_ATOMIC lands as a real constant (shekyl-standoff::reserve, 50_000_000 atomic = 0.05 SKL, 0 < reserve < COVER_RUNG_ATOMIC compile-time asserted — re-grounded post-#350 as a corner-fraction bound vs the tiling cover draw) and is enforced in the orchestrator: a partial drain from a live persona may not spend the pool below the reserve (DrainOrchestrationError::ReserveBreached); a retired persona sweeps to zero (reserve-moot). The retired flag is resolved engine-side from PScanState::pending_unbonds (confirmed terminal Unbond → no future Unbond owed) — not retired_records, which is funded-gated and would deadlock the reserve gate against a drain-all sweep.
  • Dispatch seam (T-DS-2). Engine::submit_drain (engine/drain_dispatch.rs, the claim_dispatch sibling): resolve the wallet's own principal destination engine-side (T-DS-3, never caller-supplied), assemble through the pipeline, seal the PendingDrain before any send (persist-before-dispatch; the reserved_gindexes fold dedups against bond/claim/second-drain), one live drain per persona, and dispatch only through the audited persona-transport choke point (BroadcastSubmitter::local → submit_bound), never a bare submitter or default DaemonClient. A comment-stripped self-grep tripwire pins the three invariants (pipeline entry, choke-point, seal-before-send order).
  • Composite wire-shape arm — final leg (T-DS-6 ∧ T-DS-7). regtest_e2e::e2e_drain_wire_shape_matches_a_real_transfer builds a real 1-in/2-out transfer (sign_tx) and a real 1-in/2-out drain (submit_drain), both daemon-accepted (consensus verify), and asserts their normalized wire skeletons byte-identical while raw bytes differ (non-vacuous); flatten_tx_shape = the in-slice normalize_shape plus the public fee varint (transfer weight-priced, drain caller-priced). This discharges the "a real drain must exist to diff against a real transfer" condition DS-PR-1 could only stage.
  • No new schema — dev's PENDING_POST_VERSION (v6, post- entry_offset_blocks removal) already carries PendingDrain from DS-PR-1.
  • Deferred (named, WI-3 sibling slice): drain retirement wiring (confirmation-observe / terminal-reject prune, byte-identical resubmit) — the sealed PendingDrain shape already serves it. Gates: fmt + clippy -D warnings clean.

• wallet (engine): F-D2 drain assembly landed — DS-PR-1 (ARCHIVAL_DRAIN_SEND_FD2.md §DS-PR-1). The actor-side P→principal drain-send assembly, mirroring the emission-claim shape: AssembleDrain/AssembledDrain messages + a thin validate-and-delegate handler on the StakeEngine actor (stake_engine.rs) over the new free-function assemble_drain_tx (engine/drain_assembly.rs); a durable PendingDrain record with its reserved_gindexes fold in engine-state::pending_post_block (schema PENDING_POST_VERSION v4 → v5, snapshot updated, v4_seal_fails_closed_under_v5_binary fails-closed). The drain is transfer-shaped by construction, now compile-time-enforced: the whole WireEncodeInput is built by a single shared constructor (sign_bridge::assemble_transfer_wire, extracted in this slice) that sign_bridge::sign_tx also calls, so transfer-parity is one-constructor-two- callers rather than a property re-established per test (outputs still via build_output, inputs via prepare_funding_inputs, prefix/proving/PQC-auth via the plain sign_transaction calls with empty extra_inputs + spend-only pqc_auths) — realizing the T-DS-6 ∧ T-DS-7 composite wire-shape arm (full serialization byte-identical to a modal 2-out confidential transfer modulo hidden values). Drain-all splits the payment into two nonzero principal outputs (a sweep to self) rather than emitting a zero-value change output: the shared prover rejects ZeroOutputAmount, so the ratified zero-value-change mechanism was unrealizable — the split preserves the same two-nonzero-output wire shape and strengthens T-DS-6 (uniform across partial drain / drain-all / ordinary transfer). Partial-drain change returns to P's own base spend key (T-DS-3, change-to-principal unrepresentable — no destination arg on the surface); a net-payment < 2 drain-all is refused loudly (DrainAssemblyError::PaymentUnsplittable), and a zero payment is refused up front (DrainAssemblyError::PaymentZero) before any output construction. The drain owns a dedicated DrainAssemblyError taxonomy wrapped by StakeEngineError::DrainAssembly (a value-out failure never mis-reports as "bond assembly"). Threat-arm dispositions (T-DS-4 crossing-class maps onto an existing F-D4 §16 class — F-W10: the drain is not an identifiable transaction on-chain; DS-4 exit-reserve: partial drain is a mid-life constructor reserving EXIT_FEE_RESERVE_ATOMIC, post-retirement sweep moot — enforcement rides DS-PR-2 selection) recorded in the design doc round log (2026-07-20). Composition-discipline clean (assemble_drain_tx never names Engine; god-files gain only the thin handler). A whole-tx normalized byte-diff lands in-slice (drain_partial_and_drain_all_are_wire_identical: partial and drain-all serialize identically modulo hidden/committed leaves — a non-vacuous diff, raw bytes asserted to differ), guarding the one freedom the shared constructor does not pin (split-on-drain-all reshaping amounts without perturbing the skeleton). Gates: fmt + clippy -D warnings clean; drain_assembly_shape::{drain_is_transfer_shaped, drain_all_still_emits_two_outputs, drain_all_net_below_two_is_refused, drain_partial_and_drain_all_are_wire_identical} + sign_bridge + the engine-state schema snapshot green. Remaining carries (drain orchestrator/dispatch over DrainCtx, persona-transport self-grep, the full transfer-vs-drain end-to-end byte-diff) ride DS-PR-2. The engine decomposition ratchet ceiling for stake_engine.rs is raised 4749 → 5253 under the conf's reviewed-raise clause (~82 lines genuine in-actor handler growth per rule 36; ~422 lines inline drain_assembly_shape tests pending extraction); the coherent decomposition that ratchets it back down is carried by the stake_engine.rs decomposition item in docs/FOLLOWUPS.md.

• docs: F-D2 drain-send subsystem design round opened (docs/design/ARCHIVAL_DRAIN_SEND_FD2.md, scoping — review rounds 1–4 applied: rounds 1–2 review + Round 3 threat-model addenda + Round 4 structural-distinguishability pass, threat-model axis closed). Scopes Gate-6 R4's last open item — the unbuilt P-value-out subsystem in shekyl-gui-wallet — against the verified substrate: gui-wallet dev embeds engine-core::Engine in-process (EngineSession, engine backend default-on, start_pscan_if_staker at every engine open, activate_staker → Engine::first_stake), the core-side planner (plan_drain) is fee-agnostic with no data source and no consumer, and the claim pipeline is the assembly analog. Design questions DS-1…DS-7 drafted (assembly locus, staker-mode engine adoption, destination pin, assembly-side fee carve + first-class sweep entry, round-number / random-split default with an F-D1-sibling arm, the accepted F-D4 §16.4 funding default, shape-era doc sweep) with cross-repo sub-PR slicing (rule 26 cited; pre-flight owed before code). DS-2 RATIFIED engine-first (dual-open rejected); the shekyl-engine-rpc-is-a-wallet2-FFI-shim crate-role correction is recorded, and DS-PR-3 is re-scoped to its remainder (the aggregate P-balance read; doc §2.4/DS-2/round log). Carries the FOLLOWUPS "P-drain mechanism re-walk" items (a)/(b)/(c). Rule-94 registrations: the DS- family + the drain-send current-front row. Closing F-D2 closes Gate-6 R4; per PR #337's scope review (merged into this round before its first review) the former GF-4/F-D1+F-D2 K_COVER seal seat is REMOVED (M1 §4, F-W10) — F-D2 stays a pre-genesis Gate-6 build item, not seal evidence. (Round 1's initial "GUI holds no Engine" substrate assumption was corrected in review round 2; the full correction is in the doc's round log.) DS-4 records the weight-uniformity cross-reference: the P-lane fee is f(weight, daemon-rate) with no capital/cover term (impl-verified against the landed WI-RPC-1 fee surface — tx_fee_model / fee_query / wallet-RPC fees.rs; contract pin 3d22d1e), so the only fee-adjacent distinguisher left is weight/input-count itself — GF-4b's funding-input-count territory, not the fee's. Round 3 runs the rule-26 A3 threat-model addenda (§5): five attacker objectives (T-DS-1…T-DS-5 — amount-channel, transport linkage, mis-send, crossing-class inflation, funding-input leak) graded; T-DS-1/2/3 in-scope (defended by construction), T-DS-4/5 forward-actioned into DS-PR-1 (F-D4 §16 crossing-class mapping + GF-4b funding-input discipline), T-DS-2 arms DS-PR-2 (persona-transport self-grep). The core-side impl-time pre-flight (rule 26 Part B) was run early 2026-07-19 (ARCHIVAL_DRAIN_SEND_FD2_AUDIT.md, Round 0): every DS-PR-1/DS-PR-2 shekyl-core substrate cite re-verified at pin (one B6 errata — §2.3 "stake" route handlers.rs:48 → :51, chain terminus unaffected) and all 24 core artifacts (F-D1/F-D2 planner + weight-only fee + P-scan persistence) green; the GUI-side pre-flight (DS-PR-3/4/5) is carried to each GUI sub-PR's open. Composition discipline pinned against ENGINE_COMPOSITION_DECOMPOSITION.md (doc §4): DS-PR-1/DS-PR-2 mirror the claim path's already-target shape (free-function orchestrator over an explicit DrainCtx, actor-held signing, separate dispatch driver — never &Engine, no new Engine generic/inherent method), drain code stays in its own drain_* module set (not the flagged stake_engine.rs/local_pending_tx.rs god-files), and DS-PR-4's entry point is a thin façade delegate — armed as an F-D1-sibling self-grep acceptance property. Round 4 (maintainer adversarial pass) adds the structural-distinguishability axis, settled at source: T-DS-6 (drain-tx output shape) — absorbed, a spend with n_out < 2 is consensus-invalid (shekyl-wire/transaction.rs:1868) so a change-free drain-all is not a 1-out tx but 2-out like the modal confidential send (DS-4 "change-free" is economic, not a wire property); T-DS-3 change-output arm (change → persona P-space, not the transfer assembly's default principal subaddress_index: 0 at signing_assembly.rs:126) and T-DS-7 (Monero-era field re-walk — payment_id absent + single ct_type closed, unlock_time builder-zeroed not removed, tx_extra structural) forward-actioned to DS-PR-1; plus a GF-7 disposition line (drain is the F-W7/F-W10 phantom, not a GF-7 event) and a local-adversary scope-boundary paragraph (rule-36 jurisdiction). Round 4 closed maintainer-accepted: T-DS-6 and T-DS-7 fold into a single composite wire-shape arm (the distinguisher can live in the join, since the drain is claim-plumbed but transfer-shaped) — the drain's full wire serialization must be byte-identical to a modal 2-out confidential transfer modulo hidden/committed values, enforced by routing through the shared sign_bridge path and verified by diffing a real drain tx against a real transfer tx (not separate count/tx_extra/unlock_time checks); the flagged 0x07 PQC leaf-hash is confirmed appended unconditionally by that shared path (sign_bridge.rs:283), uniform across transfer and drain. Threat-model axis closes clean; the three impl-time arms gate DS-PR-1, not the round. No prior disposition reopened.

• rpc: WI-RPC-1 — receiving, fee, and staking-read wallet-RPC surfaces. shekyl-wallet-rpc gains nine JSON-RPC methods, each a pure projection of an existing Engine surface (contract updated in docs/api/wallet_rpc.yaml; no tx/consensus/secret surface): receiving — create_payment_request (the one mutating method; local bookkeeping persisted via the wallet's normal crash-atomic save path, URI composed from the stored request so rid cannot drift), list_payment_requests, make_uri, parse_uri. The merchant reference is the non-zero u48 rid on the shekyl: URI — no subaddress or account type exists or was added. Fees — estimate_tx_size_and_weight and get_default_fee_priority over new read-only Engine helpers (estimate_tx_size_and_weight, quote_fee_tiers) that project the single predict_weight byte model and the build path's fee-converge fixpoint; a failed daemon snapshot is the same -29102 the build path uses. Staking reads — get_staked_balance (three never-conflated fields: bonded_principal_confirmed, bonded_principal_pending, rewards_received_unspent), get_staked_outputs, staking_info, via a new authoritative Engine::staking_read_view aggregating reconcile evidence + sealed pending posts + funding outputs — never the bonded_slots hint (hint-divergence KAT pins this). Staking actions (unstake, claim) remain engine-gated and RESERVED.

• tests: the emission-claim end-to-end (PR-4c) — the E4 merge gate closes. e2e_emission_claim_accepted_and_applied (regtest_e2e.rs) drives the whole reward loop live on a regtest chain: a market (ShardSetCompact) bond posted through the production assembly, serve credit injected for the first claimable epoch (onset stagger: membership starts at join + 1) under the SHEKYL_SETTLEMENT_EPOCH_BLOCKS lever, the epoch mined closed, the claim built by the production CB-3 path, accepted by the PR-4b daemon battery, and applied — the daemon claimed-set row lands, the loud reward vout equals budget_atomic(E) byte-exactly (the staker-inflow conservation identity over real RPC), and the production P-scan re-discovers the reward as rung-1 EmissionReward funding. Three pop legs bound the identity under reorgs: depth-1 idempotency, the epoch-straddling pop (the close is undone and re-closes byte-identically from the pop-surviving credit bits, floored above the non-pop-symmetric injection), and the deep pop through the claim's reference block (the chain re-converges and the stranded claim stays inert; the replacement-claim half is the named retire/resubmit follow-up). The shared confirmed-bond fixture (stake_persona_to_confirmed_bond) now serves both PR-4 e2e legs.

Fixed

• daemon: the settlement-epoch lever armed before the genesis add. On a fresh datadir, Blockchain::init added the genesis block — which runs epoch arithmetic and latches the process-wide schedule — before the SHEKYL_SETTLEMENT_EPOCH_BLOCKS arm gate, so every levered daemon refused to start (ArmedTooLate). The lever had no live consumer until the PR-4c e2e's first spawn caught it; the gate now runs at the top of init, before anything touches the DB. The fail-loud ArmedTooLate invariant in shekyl-archival-retention is unchanged — it did its job.

Known gaps (named, tracked in FOLLOWUPS)

• The first_stake genesis posture cannot earn an emission: it posts JoinMarket CompleteTree holdings, the daemon's close gather flags every complete-tree bond foundation, and E-2 excludes foundation complete-tree bonds from market_R/Σwork — so no wallet-postable bond can claim today. Everything below the entry handles market bonds first-class; the missing piece is solely the wallet entry's holdings policy (automatic shard selection — coupled to the gate-6 serving stack). The e2e claims through the composed production steps as the executable pin of what the entry must produce.

• daemon: emission-claim Phase-C submit battery (PR-4b completion). The Rust submit engine accepts the second and last transaction kind the E4 e2e needs: SubmitTxKind::Emission classifies at Phase A (the opaque vin is decoded + validated once under the canonical emission_wire codec; loud reward sum must be non-zero; the FCMP++ proof presence couples to the fee-input count), Phase B marshals the §8.7.2 E6/E7 fact bundle (claimant bond record + one frozen as-of-E gather snapshot per claimed epoch, through a C++-owned handle inside the single snapshot lock scope), and Phase C runs the battery natively: O6, the mint-side CT balance (Σ pseudoOuts + Σ loud vouts = Σ out_masks + fee via the shared archival balance's debit slot), Bp+, the E2 auth-slot/claim-key binding, the F-C1c vin-less signable hash, and the emission_vin_verify_claims/_backing/_auth minters — the same shekyl-archival-retention functions the C++ oracle reaches over FFI — plus the shared fee-input FCMP++ subset and whole-tx PQC legs. Phase D re-probes the claim slot from the reparsed blob (record gone or epoch consumed → DoubleSpendConflict). The DAEMON_SUBMIT_VERDICT.md §8.7.2 E-row matrix pins every leg at source; the FOLLOWUPS "daemon Rust submit engine" item closes, and PR-4c (the E4-gate e2e) has no remaining daemon-side gap.

• wallet: SP-R0 arm #2 — the done-side retirement ledger + atomic retire-time prune (feat/sp-r0-arm2-retire-gc). RetiredPersonaRecord rows land in PScanState (PSCAN_STATE_VERSION 6 → 7, schema snapshot regenerated), written by PScanAccrual::retire_persona: the persona's bond_post_matches rows and the pending_unbonds trigger leave in the same mutation that appends the record — one atomic seal (the bound on bond_post_matches growth, the most privacy-sensitive structure in the state). Funding rows are already gone by then: the funded-gate defers retire until the slot is drained (arm #1 pruned each spend as it was observed), with a defense-in-depth retain + debug_assert behind the gate. The durable prune fires only under the DQ-D sweep-corroborated tip clamp min(claimed_tip, verified_frontier + reorg_depth) (the WI-3 R2-1 reserve, consumed as corroboration; a low-claiming source defers the prune — fail-safe; the actor key-wipe keeps its frontier basis). At open, retired slots are cleaned from the live bonded_slots hint before derive ("stop deriving slot N"; an emptied hint reverts the wallet to a non-staker), with the derive-forward subtraction following from the monotone cursor. Guard-2: logic-discharged at the task/accrual/lifecycle test level (disclosed cfg(test)-evidence deviation — claim-window reachability); production-discharge rides the PR-4b-gated regtest lane.

• daemon: bond-post Phase-C submit battery (PR-4b, bond-post half). The Rust submit engine's SubmitTxKind::BondPost arm is no longer an unimplemented refusal: DaemonTxVerifier runs the §8.7.1 BP battery for JoinMarket bond-posts — O6 mask checks, the bond CT balance (Σ pseudoOuts + bond_debit = Σ out_masks + fee + bond_credit), BP2 canonical-id recomputation, the BP5 identity-key auth pin, BP3 record claim-slot + BP4 economic battery (native shekyl-archival-retention::verify_join_market_bond_post — the same function the C++ oracle reaches over FFI), Bp+, FCMP++ over the ToKey funding subset, and PQC hybrid auth over every input. SubmitFacts gains the BP3 bond_record_exists fact (Phase-B probe keyed on the vin's claimed id; Phase-D re-probe from the reparsed blob races a record-appearing-during-verify to DoubleSpendConflict). The stale verifier.rs reachability docs ("§13 wire reshape" / "bond posts cannot clear Phase A") are corrected — no wire contradiction existed. Non-JoinMarket post kinds (Unbond/HoldingsUpdate/Rebond) refuse loudly under a named rule-21 reopening criterion. The PR-4a staker-harness tripwire is promoted to accepted-and-applied — staking through the production Engine::first_stake entry (bond mined, bond-post match + BondPostChange change funding re-discovered by the production P-scan, swept funding records pruned from the sealed state: the SP-R0 arm-#1 production discharge, DQ-F fire live). The emission submit leg remains open on its FOLLOWUPS item and still gates PR-4c.

  Driving the battery live surfaced and fixed two latent production bugs (each invisible until a bond post could actually reach FCMP++ verification and a block):

  • wallet: ordinary transfers omitted the tx_extra 0x07 PQC leaf-hash blob — every transfer output was unspendable. The curve-tree leaf's 4th component H(pqc_pk) can only come from the sender (the PQC key is KEM-derived), and an output ingested without the field carries a zero leaf hash no spend can ever satisfy. The bond/emission assembly paths always appended it; sign_bridge.rs's transfer assembly did not, so transfer-created outputs (e.g. persona funding) failed FCMP++ verification at first spend (BatchVerificationFailed). Fixed: the transfer path now appends the per-output h_pqc blob exactly as the bond path does.
  • daemon: Blockchain::prepare_handle_incoming_blocks crashed on any block carrying an archival vin. Three scan-table prefill loops did an unguarded std::get<txin_to_key> over every vin; the first mined bond-post threw std::bad_variant_access out of generateblocks (and would have crashed block relay on any archival-vin block). Fixed with the file's own holds_alternative skip idiom — archival vins carry no key image and no amount.

• wallet: the staker-activation entry — first-stake goes production (ARCHIVAL_STAKE_ACTIVATION_PLAN.md §5.8). New wallet-rpc stake method (Capability::Full-gated; refusals -29500 StakeNotReady / -29501 StakeInFlight / -29502 AlreadyStaked; password crosses only the local transport into Zeroizing). SA-R1-a: Engine:: open_full_with_first_stake_intent spawns the StakeEngine for a non-staker under a transient intent (never persisted; an aborted first-stake leaves nothing durable — pin test included), with the on-demand P-scan started under intent so stake_in funding can scan-discover. Engine::first_stake composes the ratified order: idempotency/W2 split (new persona_canonical_id actor projection) → preflight sweep (W1-clean, production witness) → re-entrant persist_bond_record → sign/assemble → the .wallet.pending seal; no broadcast on the path (GF-7 preserved structurally — the bond dispatch driver sends at its offset). SA-R1-c: multi-input bond posts are now a consciously-logged exception (tracing::warn! at assemble). Retires the GF4b rule-21 dead-code half (b) on all five witness consumers. Same PR: SP-R0 arm #3 (open-time phantom bonded_slots GC at the derive-time locus, phantom ⟺ no-pending ∧ absent-within-covered with the pending-record bridge as the wrongful-GC argument; logic-discharged by the SA-DQ-3 co-designed crash-fixture lane). Guard-2: arms #1/#3 production-discharge is blocked on the PR-4b daemon submit-legs battery (named; the regtest tripwire's promotion note carries the conversion instruction). Post-review hardening (same branch, ARCHIVAL_STAKE_ACTIVATION_PLAN.md §5.9): wallet-level idempotency + typed WrongSlot guards on first_stake (a call naming another slot can no longer mint a second first-stake); verify-then-close on the intent reopen (new WalletFile::verify_password — a wrong password or daemon fault refuses with the wallet still open; name-bound close + best-effort restore for the residue); dark-scan self-heal (a retry reopens when no P-scan handle is parked); rule-82 taxonomy split (new State / FeeEstimate arms — internal/daemon faults no longer misdiagnosed as the -29500 funding refusal; fee faults map to -29102); the amount/gindex-free sanitizer now covers the post-persist assemble/sign path; one shared sweep_bond_funding body for preflight + assemble (BondFloorZero now refuses W1-clean); the arm-#3 GC degrades (keep-all + warn) instead of bricking open on a corrupt auxiliary seal; the GF-7 pending-release ordering contract is pinned on reconcile_phantom_bonded_slots + PendingPostState; stake's password is Zeroizing on every path; and docs/api/wallet_rpc.yaml now specifies stake + -29500..-29502.

• wallet: SP-R0 arm #1 — spent-funding-record prune via key-image watch (logic-discharged). The P-scan dual extractor gains arm (c): each scanned tx's FCMP++ ToKey key images are matched against an in-actor watch-set of the key images of P's held funding outputs (derived from the vault via the single shared KI = x·Hp(O) definition assemble also uses; DQ-A structural containment — redacting Debug, no Serialize, zeroize-on-drop, tripwire-enforced). Derivation is offloaded off the actor's async executor (DQ5/DQ6) with per-record quarantine: a deterministically underivable record is skipped loudly, never a scan halt (assemble re-derives the same bundle and fails identically, so a quarantined record can never be swept into a bond post). A hit prunes the matching PScanState::funding_outputs record at ingest (extend-then-retain — a discover-then-spend within one scan step nets to no record; the in-step blind spot is closed by the handler's trailing pass), no PSCAN_STATE_VERSION bump (D-2: element removal is wire-identical + pre-genesis fresh-sync). Mints the sole production SpentRecordsDurablyPruned constructor (arm1_watch_pruning_live), discharging the GF4b-5 structural go-live gate on sweep_funding_outputs and its five consumers. DQ-F fire lane: shekyl-engine-core/tests/sp_r0_arm1_fire.rs (harness compiled test-helpers + not(test), so Guard 1 — no for_test() on the path under test — is a compile-time fact) drives the production scan/watch/prune/witness path; CI asserts both prune paths fire. Guard 2: logic-discharged only — production-firing gated on the staker-activation round (ARCHIVAL_BOND_SP_R0_PLAN.md §4 build record).

Changed

• docs: economic-model docs corrected to the live archival pay-for-service staking model. DESIGN_CONCEPTS.md still described the retired passive lock-tier PoS model (staked_amount × duration_multiplier, duration tiers, claim/unstake, "Staking is implemented end-to-end") as if live; Components 3–4, the §2 config note, the §5 lifecycle/value-flow, §6 anti-gaming, §9 test coverage, §10 dashboard, §11 simulation params, and the §13 core-parameter table are rewritten archival-native (transfer-shaped admission, on-chain bonds, reward budget divided by capped verified serve-work, no lock/tier/claim wire, no consensus-minimum bond). STAKER_REWARD_DISBURSEMENT.md (the claim/lock-tier disbursement spec) gains a SUPERSEDED — do not implement banner pointing at the live specs. V3_STAKER_ARCHIVAL.md gains a dated ship-timing correction: archival is the genesis (V3.0) model, not a V3.x dot-release. User-facing guides are corrected too: USER_GUIDE.md's ## Staking section is rewritten archival-native and no longer documents the retired stake <tier> / claim_rewards / unstake shekyl-cli commands (which do not exist — the CLI staking UX is roadmap; staking today is via the GUI or wallet-RPC stake + read methods), the RPC method reference is corrected to the live surface, and the multisig "staking security" use case is de-tiered; STAKER_OPERATOR_GUIDE.md and GENESIS_TRANSPARENCY.md drop residual lock-tier phrasing. Canonical live references are design/REWARD_EMISSION_LEG.md (consensus reward leg) and V3_STAKER_ARCHIVAL.md (mechanism); retirement history is in design/LEGACY_CLAIM_ERA_RETIREMENT.md. Documentation-only; no code or consensus change.

• ci: Rust: audit, test, determinism split into its own workflow (ci/gh-actions/rust). The Rust audit/test/determinism gate moved out of ci/gh-actions/cli (build.yml) into rust-audit-test.yml so a flaked C/C++ compile_by_OS runner can be re-run without waiting for this ~35–48m job to conclude (GitHub only allows re-running failed jobs once the whole workflow run finishes). The job never depended on the OS builds — no needs:, no artifact download, its own Swatinem/rust-cache — so the job body is byte-identical and only the containing workflow (and its concurrency group) changed. No branch-protection change is needed: required status checks are keyed by the bare job name (Rust: audit, test, determinism) plus the GitHub Actions app, not by the workflow name, so the existing required-check context keeps matching this job in its new workflow.

Removed

• multisig: group_id deleted — group identity is the address fingerprint (MS-5 PR-B). multisig_group_id was a per-output cn_fast_hash over the leaf MultisigKeyContainer (whose keys are derived per-output from KEM shared secrets), so it produced a different value for every output while being named for the group; it had no consumer under Option E′; and its one long-term caller (wallet2::create_pqc_multisig_group) threw on every input. Deleted, both languages: the Rust multisig_group_id{,_with_versions,_from_address}, DOMAIN_SEP_V31, rotating_prover_index, verify_fcmp_multisig_partials, and the Option-D receive-construction unit (construct_multisig_output_for_sender / validate_multisig_output_at_receive / MultisigOutputConstruction / PersistedMultisigOutput / GriefingTracker); verify_multisig's expected_group_id parameter and check 9 (GroupIdMismatch, FFI error code 9 — now a 9-check pipeline, codes 10/11 unchanged, discriminant 9 retired not renumbered); the FFI shekyl_pqc_multisig_group_id / shekyl_pqc_verify_with_group_id and their C headers; the C++ wallet2 PQC-multisig surface (create_pqc_multisig_group, get_pqc_multisig_info, the four m_pqc_multisig_* fields + accessors + boost-serialize lines — the on-disk epee cache never emitted them, so this is a clean drop with no version gate); and the fuzz_group_id harness (+ its inventory smoke-gate row). Group identity is now the address fingerprint (cSHAKE256(canonical(MultisigAddressPayload), "shekyl/multisig-address-v1"), PR #323): per-group, independently derivable, version-binding via the canonical payload. Chosen consequence: with the Option-D receive constructor deleted, there is no multisig output constructor at all until S2/S4 writes E′'s two-component O = ho·G + B_group + y_out·T. The MultisigKeyContainer per-output-vs-long-term lifetime ambiguity is filed as its own S2-blocking slice.

Added

• wallet/sim: GF-7 leg-(b) sealing-run harness + grader landed; first session's PASS withdrawn in-PR after review; hardened re-run graded PASS 2026-07-19; seal-input status then WITHDRAWN on scope review and the K_COVER seal re-dispositioned as designed (ARCHIVAL_BOND_WI4_MEASUREMENT.md §19.8 design / §19.9.1 withdrawal / §19.9.2 re-grade / §19.10 scope correction; ARCHIVAL_REWARD_GATE_M1.md §4 2026-07-19 update). The receipt-timestamped live-driver form: a #[cfg(test)] + gf7-hooks harness in shekyl-engine-core (gf7_sealing_run.rs, #[ignore]d, SHEKYLD_BIN-gated) drives the production P-scan task + dispatch driver against a live shekyld --regtest through a new feature-gated seam (start_pscan_sealing_run — production config/cadence pinned, observer + positive-control-only DispatchConfig override injected; byte-identical control flow with the feature off), writing a receipts artifact that shekyl-staking-sim --gf7-seal grades with the same circular statistic and committed bound (r = P(link)·(N−1) < 2). A first 4 h 42 m session graded PASS (gate row r = 1.275), then the PR #337 review found the harness could not detect background-miner death (chain-advancement geometry unverifiable from the artifact), the grader enforced neither R = 24 + 8 nor run-ordinal contiguity, the recording period was three untied literals across two crates, and the documented space-separated --gf7-seal form silently ran the default simulation — the grade is withdrawn (WI-4 §19.9.1) and the hardening landed in this same PR: fail-loud miner watch, grader R-floor/contiguity/cadence_ms == TICK_MS enforcement (artifact rows now self-describe their period), an Arm type binding label/seed-domain/config so a mislabeled row is unconstructible, both CLI forms with a loud missing-path error, sim verdict strings made status-neutral (they point at §19.9 instead of asserting its outcome), and a CI clippy lane compiling the gf7-hooks combination so the reopening-criterion re-run harness cannot rot silently. The hardened re-run then executed (both sessions disclosed, §19.9.2): session 1 graded INVALID — the §19.8.3 negative control biting on shared-host cross-wallet coupling, exactly its job — and session 2 graded PASS (gate row r = 0.412, clustered SE 0.121, ≈ 13 SEs under the committed bound 2; positive control 0.875 ≥ 0.80, negative 0.087 at chance, receipt-noise floor 413.9 ms of T = 60 s). Scope review (same PR, §19.10): the form's K = 2 concurrently-posting-persona premise is design-foreclosed — the grounded persona-lifecycle enumeration (§19.10.1) shows 2 + E + H (+R) wallet-timed P-attributed txs per persona lifetime and stake_engine has no rotation scheme — so leg (b)'s seal-input status is withdrawn (the TM-1 "does the design do this?" correction class, applied to WI-4's own arm); measurement records stand, and the hardened instrument + CI lane are retained as a dispersal-regression tripwire. K_COVER's seal predicate is now stated once in M1 §4 and dispositioned as designed: partition-proof operand DISCHARGED (§14.4), value paired to the measured cover floor (N ≈ 10 min / 20 with margin; thin-cover failure r = 3.54 is the enforced fact) via the §14 founder schedule; the GF-4/F-D2 seal seat is removed (F-W10 — not an on-chain observable; stays a Gate-6 build item); the §17.9 calibration reduces to a one-page recorded derivation. Companion corrections landed with the sweep: TM-1/FIREWALL_THREATS "sequential rotation" wording (claims an unenforced code property), V3_STAKER_ARCHIVAL.md registration-tx line and Gate-6 refund-output line (both superseded by gate-4), and a FOLLOWUPS wallet-UX item for thin-cover disclosure at bond/claim time (warn-don't-prohibit on user acts; the enforced invariant stays consensus-side). Rule-94 registrations in the same slice: the §17.9 Gate-7 calibration and the terminal K_COVER seal act each gained an IMPLEMENTATION_INDEX.md front row.

• fcmp: F-D1 drain-amount taint-carve BUILT (ARCHIVAL_FIREWALL_GATE6.md §12.3) + F-D2 core-side aggregate-only surface (§12.4). The P→principal value-out (drain) path lands in shekyl-engine-core/src/engine/ as three modules mirroring the three stages of the (a)+strip encoding: drain_orchestrator.rs is the single trust boundary — the only drain-path site that names/holds PFundingOutputRecord (which carries MintLineageOutput); it projects the funding records into an aggregate spendable scalar (DrainBalance, the F-D2 core-side surface) and a stripped {output_id, amount, spendable_height} candidate vector, dropping {lineage, epoch, height} so no reward-sequence decomposition survives. drain_amount.rs consults the scalar for an affordability check only (target ≤ affordable), never as a computation input, so core code cannot derive a reward-shaped amount from the per-output decomposition — the vector never reaches the stage. (Steering the returned value away from any subsum is the F-D2 round-number / random-split UI default, not built here.) drain_select.rs does lineage-blind largest-first coin selection over the stripped vector. plan_drain composes the three; it takes a single scalar target, so a UI on this surface structurally cannot pre-fill a reward-shaped decomposition. The M1 import-check arm was landed on a skeleton first, a deliberately-wrong MintLineageOutput import was proven to fail it (exit 101) and reverted, then the real logic went in against the armed gate — the arm now runs as fd1_arm_* unit tests (CI-enforced) that grep each guarded module's own source and refuse if it names a forbidden type. plan_drain lands as a correctly-carved planner with no data source and no consumer yet — reachable API, not yet load-bearing. F-D2's remaining half is NOT a pending UI default and NOT gated on RPC: the GUI (shekyl-gui-wallet) is a Tauri app that links the engine crates in-process and would call plan_drain directly from a #[tauri::command] handler; shekyl-engine-rpc is an FFI library, not a wallet-RPC server. What is unbuilt is a whole P-value-out (drain-send) subsystem — a P-scan data source (PScanState.funding_outputs) feeding the planner, a drain tx assemble→sign→broadcast path, and the round-number/random-split default on top. F-D2 is not recorded as landed until that subsystem exists; Gate-6 R4 stays open on it.

Changed

• wallet-rpc: WI-1 — wire the 2d-1 P-scan task into the wallet lifecycle (embedder-held handle). The P-scan driving task (Engine::start_pscan) had no production caller: start_pscan / start_pscan_if_staker were pub, which disarmed the dead_code lint rather than satisfying it, so the "unwired" gap read as closed from a source-first check. shekyl-wallet-rpc's Tenant now holds the PScanHandle — create/open_wallet auto-start it for a staker (a non-staker parks None), and close_wallet PScanHandle::shutdown().awaits the task before Arc::try_unwrap: the task holds its own clone of the engine arc, so a live handle would fail the close "still in use" (the prior Drop-based "close-stops-task by ownership" framing was insufficient — shutdown is the step that makes the unwrap possible). A staker whose sealed P-scan state cannot load fails the open closed (00-mission priority 2 — privacy is not a degraded mode); a close that cannot complete re-arms the scan on restore (logged, never silent). Closure is a behavioral test (staker_open_parks_a_pscan_handle_and_close_shuts_it_down), not the lint a pub item cannot trip. Enabler: engine-core __test_helpers::make_staker_for_test (feature-gated) — the first test-helpers downstream consumer, the rule-21 public-re-export reopen the feature reserved for its first named caller.
• docs: F-D5 disposition round RAN — the structural-derivation attempt failed at source; NO GRID ships at genesis; Gate-6 R4 close condition (iv) discharged (outcome record at Gate-6 §12.7 OUTCOME). Executed in the ratified order and the halves resolved oppositely — the inverse of X-3 (correct geometry, empty harm): the harm survives F-D1 in one sentence (the grid protects §18.12's lifetime-aggregate drain-all floor, not the subsum match F-D1 closes — a real P→user bridge), but the width derivation fails at three ineliminable, source-anchored population entry points: (1) no population-free lattice exists below the Curve's shape constants (scarcity_milli divides by r_market, the shard's live replication count); (2) the atomic-value spacing is budget(E)/Σwork(E) — fees + release-scaled emission over the live cohort's work, a quotient X-3's block-height-space derivation never had in its path; (3) the strongest variant (a rate-adaptive relative grid, K curve-derivable work buckets, consensus-deterministic and zero-tolerance-compatible) delivers reachable-collision, not cover — epoch sets are published per claim and every reward_P(E) is a loud P-attributed mint vout, so collisions among published sums are population occupancy (the GF-7 nominal-vs-effective finding again). Sharpest form: the grid's cost side is derivable today (dust + the pass-4-priced contribution→reward distortion), its benefit side is derivable by nobody pre-genesis — an inequality with one computable side cannot be optimized structurally. All three charter preconditions discharged: the genesis-frozen consequence is spent knowingly (any future grid is a hard fork), pass-4 is reconciled (different target linkage; its cost half transfers intact), and the attempt's failure is derived, not defaulted. The lifetime-aggregate band registers as the first R5 S-2 ledger row; R4 remains open on F-D1 + F-D2 only.
• docs: Gate-6 R4 close condition (iv) re-worded — F-D5's "→ §14.4 economics" routing was a dangling pointer (dated amendment at Gate-6 §12.9; disposition-round charter at §12.7). WI-4's §14.4 is the partition-adversary arm (RATIFIED PR #291, closed — no quantization or economics agenda); the pointer was a summary-layer conflation of WI-4's discharged strata/lifetime riders with its quantization GF-4-candidate routing (WI-4 §18.10 R-3), propagated through Gate-6 and the index as though it named a real round. F-D5 itself survives the substance filters (real off-chain observer, no spend graph in the path — method note 5 does not dissolve it). A fresh measurement round was refused (the grid's privacy benefit is behavioral, testnet-unproducible — method note 3). The chartered round: (1) names the genesis-frozen consequence (deferral to a post-genesis S-2 read means no grid at genesis; a hard fork if ever wanted); (2) reconciles the §10.12 pass-4 banding rejection explicitly; (3) runs the structural-derivation attempt first (grid width from reward-curve structure, rate-independent, X-3-shaped) — width derives ⇒ grid ships at genesis with S-2 grading the residual; width doesn't ⇒ no grid, recorded plainly. The lifetime-aggregate band registers as an R5 S-2 ledger row either way. Every propagation site carries a dated annotation (Gate-6 header/§11.7/§12/§12.7/§12.8/§12.9, index rows). The failure shape got its own record — Gate-6 §11.8 method note 6: the referent was minted by summarization (WI-4 never wrote it; the index row and Gate-6 prose joined two true routings into a false one that survives verification-by-grep because both halves check out separately). Distinct from method note 5's five instances; the rule: summary-cited routing targets verify against the source document's own words, and a summary that joins two source claims is a new claim.
• docs: ring-signature/decoy legacy sweep across the user-facing corpus (Gate-6 §11.7 method note 5 applied to documentation — inherited privacy prose re-walked against what FCMP++ actually emits). Contrastive mentions ("unlike ring signatures…") were left alone; five stale claims fixed: (1) LMDB_SCHEMA.md — txs_prunable described as containing "ring signatures"; corrected to the actual rctSigPrunable contents (Bulletproof+ range proofs, pseudo-outs, FCMP++ proof blob). (2) V3_ENGINE_TRAIT_BOUNDARIES.md — PendingTxEngine::build "picks fresh decoys"; corrected to fresh FCMP++ membership-witness assembly. (3) UPGRADE_POLICY.md — HF2 planned "lattice-based ring signatures", contradicting POST_QUANTUM_CRYPTOGRAPHY.md's retirement of that survey; re-worded to the lattice-only membership-proof successor. (4) USER_GUIDE.md + EXECUTABLES.md — documented shekyl-blockchain-mark-spent-outputs, a binary with no source and no CMake target (rows and section deleted); --trusted-daemon described with Monero decoy-fanout prose ("privacy-preserving request splitting"), corrected to the code's actual meaning; the surviving ancestry/depth/usage/known-spent tools annotated as having no spend-graph substrate under FCMP++ and queued for a V3.2 deletion audit (new FOLLOWUPS.md entry). (5) DESIGN_CONCEPTS.md §14 research appendix — dated re-walk note added: the "clean coins as mixing layer" hypothesis is ring-decoy-era framing, and Mechanism A's harm model ("when a coinbase output is spent") presupposes an observable FCMP++ does not emit; Mechanism B (claim batching) is the only one with a live substrate (claims are P-attributed with loud amounts).

Removed

• archival-retention: release_cooldown_anchor_height deleted (rule 15 — the F-D4 mechanism deletion orphaned it). The decision-5 PR below removed draw_exit_gap, the anchor helper's only production consumer; post-landing every call site was a unit test, the lib.rs re-export, or the staking-sim standoff.rs doc-comment — an armed primitive with no trigger. Its F-D6 anti-drift job was also discharged: the 20_000 doc fossil it was minted to purge is gone, and keeping a production function alive so a sim comment can cite it is speculative generality. Decided as its own rule-15 disposition (the decision-5 out-of-scope call was consumer-relative, and the deletion is what falsified it), with the keep-as-derivation-home branch declined: a future caller needing an earliest-spend height re-derives (last_served + RELEASE_COOLDOWN_EPOCHS) × SEB from the named consts at its own site and boundary-tests against release_cooldown_elapsed (reopen note at release_cooldown.rs; git history holds the reference implementation and boundary tests). Removed: the function, its four unit tests, the re-export; the standoff.rs exit-seam paragraph rewritten to cite the consensus predicate and the F-D4 deletion instead of the deleted symbol. F-D6's named-const half stands (config-generated RELEASE_COOLDOWN_EPOCHS, no restated integer anywhere); release_cooldown_elapsed — enforced consensus with two live verify consumers — is untouched. Disposition at Gate-6 §12.7.

• standoff: F-D4 exit-standoff mechanism deleted at Gate-6 §12.9 decision 5's scope (ARCHIVAL_EXIT_STANDOFF_FD4_WINDOW.md §15.4 item 1 reviewer-map). The round-4 premise audit found the channel the mechanism decorrelates against unpopulated (F-W7: no on-chain principal-side re-appearance observable), and the R4 decision round re-homed the exit seam to the off-chain principal↔user crossing, whose instrument is the S-2 ledger — so the apparatus guards nothing and is audit surface (rule 15). Removed: shekyl-standoff/src/exit.rs wholesale (draw_exit_gap, ExitGap, ExitGapWindow, the DEFAULT_EXIT_GAP_WINDOW sentinel + compile-refusal + seal tripwire), the provisional-exit-gap-window and exit-window-kat features with every consumer acknowledgment line (shekyl-engine-core, shekyl-staking-sim, the crate's own dev-graph line), the exit arms in conformance.rs (grade_exit_sample, certify_exit_draw, exit_release_population, ExitCertifyReport), and the exit tests (tests/exit_golden_vector.rs; five arms in conformance_grading.rs). Out of scope, untouched: release_cooldown_anchor_height (F-D6 — anti-drift/slashability, predates the audit; its doc comment re-anchored on its own grounds) and release_cooldown_elapsed (enforced consensus). The F-D4 §15.4 tripwire and archived re-run template are unchanged; the sentinel was deleted having never shipped a value (the K_COVER pattern's vindication, F-D4 §15.7, now complete through the deletion arm). R4's re-formed close condition (iii) is satisfied.

Added

• docs: Gate-6 method note 5 extended — the generative pattern named (fifth instance of one failure) and first-applied to §2.4's remaining two CryptoNote-lineage carries. F-W10 was recognized at ratification review as the fifth instance of a single failure — phantom T (F-W7), the cross-persona k-collapse near-miss (F-D4 §16.3), X-3's harm model (F-W8), σ_L, and output-count (F-W10) — each a privacy intuition imported from a visible-spend-graph chain into FCMP++, which has none. §11.8 method note 5 now records the pattern (an inherited pin is a claim about the chain it was written for; re-walk every CryptoNote-lineage carry against what FCMP++ actually emits) and its first application: Gate-6 §2.4's other two PHASE_2B-§2.4 pin bullets, re-walked in the same sitting rather than left to surface as instances six and seven. Verdicts (recorded at §2.4): rewards→stealth-outputs holds, re-anchored — its real mechanism is §2.1 key/scan-boundary independence (creation-side, substrate-independent); the graph-side half of its old justification is by-construction under FCMP++. Unbond-refund is half-phantom — "release creates a P-attributed output at public bond_floor amount" named an output no observer can identify (the refund enters as ordinary hidden vouts against the public bond_debit source term, gate-4 §2.4; F-D4 T-2 had already graded the watch-the-refund channel structurally unrepresentable), and the "same decorrelated-drain discipline" tail retires with F-W10. §2.1's transfer-leg pin scoped to entry-leg-only ("timing/output still leak" holds only for the funding spend's existence and timing — the GF-7 seam); the §2.1 crypto-layer carry checked in passing and stands (key derivation and scan separation carry no graph presupposition). Source doc corrected in place: PHASE_2B_STAKE_LIFECYCLE.md §2.4 tx-leg rows (decorrelated-drain cells struck with dated notes) and the §7 Unbond-refund threat row (re-graded structurally unrepresentable with the source-term/vout distinction). No new F-W tokens minted: both verdicts are dispositions of existing pin prose under an adopted method note, not blocking findings.

• docs: Gate-6 R4 decision round (§12.9) — the F-D4 §15.5 hand-forward answered and RATIFIED: the exit seam re-homes, the joint grade dissolves by four-axis attrition (F-W10 added at ratification). Four decisions recorded with the F-D4 §2.1/§15 audit and the F-W9 premise correction as inputs. (1) Seam re-homed to the principal↔user crossing (WI-4 §18.13): the timing half is phantom (F-W7/F-W9 — zero observable exits on either branch), the amount half was closed on-chain by construction and its surviving off-chain subsum match is that seam's boundary class 3, which F-D1/F-D2 close — they re-label, build and arms unchanged. After this round the on-chain P↔principal surface is the entry seam alone (GF-7). (2) Joint grade dissolved by axis attrition. Ratification rejected the draft's walk (three of §12.8's four named axes; output-count silently absent, mis-disposed as an F-D1-sibling arm — F-D1 governs the amount computation's inputs, output-count shapes the drain's outputs) and added the fourth row: F-W10 — output-count is phantom. Under FCMP++ the drain is not an identifiable transaction (no spend graph; spend set unenumerable; reward-output spends carry no P-typing on the wire), so its output count is not an observable; the Gate-6 §2.4 lump-sweep discipline is retired as a CryptoNote/ring-signature-lineage carry never re-walked across the crypto change — §2.4's own goal ("beyond what a disciplined user already avoids on ordinary transfers") is met by construction. With all four axes attrited (exit-timing phantom; amount structural-armed pass/fail; holdings a public posture fact; output-count phantom), CB-3's joint-grading obligation is discharged — nothing left to multiply — so GF-10's width grades standalone against its §11.5 pre-committed advantage claim and R3's close re-forms accordingly; the correlated-trigger obligation relocates to the crossing as an S-2 row. Method note 5 adopted (a pin carried across a substrate change re-walks at carry time; "carry from X" is a re-walk trigger, not an exemption). (3) F-D4 §16.4 funding default ACCEPTED as F-D2-class: self-funding via the GF-4b lineage machinery is the honest-wallet default, external growth-funding is a loud override routed through the entry-standoff draw; growth-gating cost accepted, consensus enforcement stays rejected. (4) Harness deleted, not re-parameterized (a rate model over counterparty arrivals fails method note 3; archived-unlanded is final) and the mechanism-deletion PR is scoped (shekyl-standoff/src/exit.rs wholesale; F-D6 anchor + release_cooldown_elapsed out of scope). Re-formed R4 close: F-D1 + F-D2 (incl. the funding default) + the deletion PR + F-D5's §14.4 disposition; S-2 opens R5 with F-W9's finite domain. Swept: Gate-6 header/round-table/§2.4/§11.8/§12.1/§12.3/§12.8/§14.4/revision history, F-D4 status banners + §15.4/§15.5/§16.4, WI-4 §18.13, FOLLOWUPS L17-wargame rider, index rows 95/97/98; the retired output-count discipline's downstream consumers updated in place (PRINCIPAL_STAKE_LIFECYCLE.md — DQ3 closes without a count rule, drain() shape constraint lifted; F1_TA3_TA7_LIFETIME_WINDOW.md T-A5 residual; V3_STAKER_ARCHIVAL.md output-layer bullet; PHASE_2B_STAKE_LIFECYCLE.md carry-over row).

• docs: F-W9 — F-D4 §13.3's repetition premise corrected by walking the lifecycle; m is a bounded count, not a growth variable; Gate-6 method note 4 adopted (enumerate the events that compose). §13.3's intersection argument quantified over a growing observation count m that was never counted against the state machine — four review rounds sharpened the base (q) while the exponent was inherited as "grows." F-D4 §16 counts it against the landed FSM (bond_post.rs, all four post_kinds): one mandatory observable principal↔P crossing per bonded life (JoinMarket; one-per-life enforced at :540), two optional wallet-default-closeable crossing classes (HoldingsUpdate-add; credit-bearing Rebond — the common standing-only Rebond moves no value by Pin 2), zero observable exits (voluntary refund CT-hidden in-tx; terminal slash emits no transaction at all), rejoin unmodeled (self-harm class; slot-indexed persona derivation). The amount channel carries no grouping signal on any row (bond_credit is a pure function of the public holdings descriptor). Consequences: the geometric-collapse clause falls (at the mandatory m = 1, GF-7's per-event grade is the on-chain lifetime grade per persona per observer class, at nominal cover); the E[m]-is-economics objection dissolves (the mandatory count is mechanism-class — readable from the state machine); the residual's dead σ_L routing loses its last claim; the S-2 routing survives narrowed and finite. A near-miss is recorded in the same section (§16.3): cross-persona intersection (q^k over a principal's k personas) was raised and withdrawn for want of a linking key — funding sources FCMP++-hidden, amounts publicly determined, entry timing per-event decorrelated, network isolated; clustering over an unknown partition is not intersection over a known key (F-W7's phantom-observable shape, caught at draft). Surviving composition surfaces: the T-4 off-chain counterparty ledger (its own books are the key) and shared-trigger funding clusters (the entry standoff's existing graded case). The §16.4 proposal rides the §15.5 hand-forward to Gate-6 R4: aim the GF-4b lineage filter at the optional-crossing funding paths (honest-wallet default, not consensus; cost stated — growth gated on accumulated rewards ≥ FLOOR). Swept: F-D4 §13.3 banner + new §16, Gate-6 §12.8 hand-forward + §11.8 method note 4 + revision history, WI-4 §13.5 and FOLLOWUPS carry-4 geometric-collapse citations (conclusion unchanged, ground narrowed), index rows 97/98 (family extended F-W1…F-W9).

• F-7 (R1-F-7): first EngineSignerKind associated item — SigningCeremony. The sealed signer-kind marker was a zero-associated-item trait; adding the first item was a Round-1 closure prerequisite (associated items must be defined by every implementor, and associated-type defaults are unstable, so a compiler would have forced it mid-MS-1). Landed the trait-surface amendment now: EngineSignerKind::SigningCeremony, with SoloSigner::SigningCeremony = core::convert::Infallible. A solo wallet runs no multisig ceremony, so its ceremony type is uninhabited — "a solo wallet ran a multisig ceremony" is unrepresentable, guarded by a compile-time match ceremony {} pin (same compile-forced tier as the !Clone archival keys). MultisigSigner<N, K> (V3.1) will set its own FROST ceremony type (MS-5). rust/shekyl-engine-core/src/engine/signer.rs.

• sim + docs: GF-7 effective-cover sensitivity sweep (shekyl-staking-sim --gf7-breakeven, gf7_breakeven.rs); fifth WI-4 §13.5 conditional's kind sharpened; r < 2 found structurally blind to cover; aspiration-vs-gate framing pinned. Follow-through on the reclassification entry below, per review; reading corrected same day, per review. Kind: "the isolation-conditioning kind" got permanence right and shape wrong — isolation conditions a channel (fails ⇒ new channel, qualitative change); effective cover conditions the number itself: 1.86 was computed at nominal cover, an upper bound, and the honest characterization is stacked marginals of opposite sign (pessimistic oracle-union adversary panel × optimistic nominal cover; F-W4's hygiene applied on this side). Scope narrowed: thin-cover-as-regime is already L12/design-away (M1 reward gate refuses the regime); the conditional carries effective-vs-nominal at steady state. Sweep (mechanism-class under method note 3 — a property of the model, no testnet, no economics input): the new arm sweeps the gate-relevant posture over N ∈ [2, 16] with per-N validity controls, worst arm per row, 1 000 trials/point. Finding: worst-arm r clears the bound at every row of the range, never trending toward the bar as cover thins — r < 2 is structurally blind to cover. The LR scorer's hit probability and the 1/N blind baseline shrink together, so the ratio renormalizes thin-cover harm away by construction (at N = 2 the worst arm links 72.9% and still "clears"). Consequences: cover was never gated — not on an optimistic assumption, not at all; the gate's ~7% margin is margin on the mechanism's fixed relative leak, never margin against cover (the structural fact that made the §12.8 misfiling possible); the pre-sweep "true r ≥ 1.86, unknown" framing is retracted; and no per-event monitoring threshold was discovered — the candidate P(link) ≤ 0.2 is the ratio bar evaluated at nominal cover, back-derived arithmetic (under flat r the parity point sits at N ≈ nominal · r/bound by identity, the run's parity row landing at P = 0.199/N = 9 vs 0.179/N = 10), so it restates the nominal-cover assumption with no independent content, and pinning it as an absolute bar is refused as commitment-backwards-from-the-number. Per-event P(link) also does not bound the aspiration's quantity (the P↔principal binding is observed repeatedly; intersection collapses geometrically, F-D4 §13.3/F-W5): the conditional's instrument is the S-2 fused exposure ledger (Gate-6 R5, "build first," unbuilt). Framing pinned at WI-4 §13.5: the conditional register is the aspiration's ledger — the standing statement of what stands between "every gate passed" and "the aspiration holds" (gates are falsifiable and ours; the aspiration — only-KYC-remains — cannot be gated on); and S-2's permanent deferral while every track terminates at "S-2 is the instrument" is now itself recorded as a finding on that ledger. The "state actor has KYC anyway" scope argument is explicitly rejected as a reading of the measurement (KYC yields principal→user; GF-7 protects P→principal; both broken yields P→user — which shards, what earnings, what patterns). Surfaces: gf7_breakeven.rs + --gf7-breakeven (scale-invariance report; parity line labeled as identity), WI-4 §13.5 (fifth conditional rewritten; verdict clause (3) reworded to name S-2 as the instrument; aspiration-ledger pin), Gate-6 §12.8 + §11.8 method note 3 (constructive-half demonstration corrected to its honest output) + revision history, FOLLOWUPS carry 4, IMPLEMENTATION_INDEX.md row "Round N / R N".

• docs: F-D4 review round 4 — the premise audit (ARCHIVAL_EXIT_STANDOFF_FD4_WINDOW.md §2.1 + §15; F-W7/F-W8 minted; disposition RATIFIED 2026-07-16: deletion-with-tripwire). The correlated observable T ("principal-side re-appearance") that every exit-seam channel quantifies over was never named by rounds 0–3; the §2.1 population audit finds it empty within the seam: T-2 structural (the refund is the bond_debit source term of the Unbond tx itself — hidden outputs in the posting transaction, CT-enforced to the public floor, no later release to watch; bond_connect.rs), T-1 policy + economics (rotation dead by S-5 scope + T-A1 portfolio identity + in-place HoldingsUpdate; population ≈ 0 by design), T-3 conditioning (§10.9 default-on isolation cannot be assumed and harvested), T-4 re-homed (the off-chain counterparty crossing is Gate-6 §18.13's principal↔user seam — widen-not-close, S-2 ledger). F-W8 retracts X-3's harm model (cohort membership is last_served_epoch, already public; the partition only fed assignment, which is a function of T). §5–§14 outputs stamped conditional-then-closed; disposition RATIFIED: deletion-with-tripwire (§15.4 — reopen criteria named: rotation in scope / refund moved out of the posting tx / new public principal-keyed term / isolation weakened; re-run shape specified; the mechanism-deletion PR's reviewer-map is §15.4 item 1, with the --exit-standoff harness sequenced behind the §15.5 answer — a harness grading a phantom channel is a trigger with no gate, but deleting-then-resurrecting would fight a re-homing PR; landing disposition: the harness never landed on dev, preserved at archive/feat/fd4-exit-sweep-2026-07-16). §15.5 — whether GF-4's exit seam re-homes to §18.13 wholesale, and what the four-axis joint grade becomes without its on-chain timing axis — is handed forward to Gate-6 R4 with the audit attached (received at Gate-6 §12.8). Ratification sweeps landed: Gate-6 §12.5/§12.6/§12.8 + revision history, the RELEASE_CHECKLIST.md DEFAULT_EXIT_GAP_WINDOW seal entry removed, FOLLOWUPS swan-2/W8 wargame closed-as-posed (reopen rides the §15.4 tripwire), index rows 95–98. Methodological finding adopted (§15.6 + Gate-6 §11.8 method note 2): observer-as-code, pre-registered before any row runs — the harness's declared variable is what exposed the phantom four prose rounds missed; a channel's meaning is its observable. The K_COVER sentinel pattern is vindicated (§15.7): the unsealable value already refused to compile, so the premise collapse required no un-shipping. F-W7/F-W8 registered at birth per rule 94 (index row 97, family extended F-W1…F-W8).

• **docs: mechanism-vs-economics measurement filter adopted (F-D4 §15.8

  • Gate-6 §11.8 method note 3 + RELEASE_CHECKLIST.md seal-queueing rule).** Second finding extracted at the F-D4 round-4 ratification, true before the phantom-T finding: two of the three Phase 7.7 seal inputs were unmeasurable on a testnet in principle — σ_L is the latency to an event that doesn't occur (empty, not noisy), N_x is a market-panic cohort size (no real value at stake ⇒ no panic; a scripted mass-exit measures the script), ρ_x is profit-taking cadence (economic behavior). The read would have returned the test plan with the authority of "measured," and a genesis constant would have been sealed on it. Standing posture: before queuing any constant for a stressnet seal, classify the measurement — mechanism (partition firing, draw bias, determinism KATs, timing under load; a testnet reproduces these because the software doesn't know the money is fake) vs. economics (exit rate, churn, panic cohorts, mobility; functions of real value at risk, which a testnet cannot produce). Economics ⇒ the stressnet is the wrong instrument; the honest exits are derive-structurally / design-the-constant-away / don't-ship-the-genesis-frozen-value. Filter run across the PF-9 / Phase 7.7 queue at adoption: K_COVER is the only queued seal and passes (the §14.4 partition run is mechanism); the remaining Phase 7.7 entries are mechanism exercises; one caveat placed at Gate-6 §12.8 — GF-7's effective-vs-nominal-cover residual is testnet-dischargeable only on its observer machinery, never on the cover level (post-isolation network-event rate is economics).

• docs: GF-7 effective-cover reclassified as the fifth WI-4 §13.5 standing conditional; method-note-3 sweep extended across Gate-6's residuals. The §12.8 caveat's "stays open on the level" was the wrong filing — "open" implies it closes when someone does the work, and the cover level is unfalsifiable before real value is at risk: a standing conditional of the isolation-conditioning kind (carried as a stated assumption with a post-genesis monitoring plan, never a task). Verified at source that the 1.86 was computed on nominal cover (gf7_timeline.rs seeds N = TARGET_ANON_SET = 10 at full honest strength; Gate-6 §11 (iv) already names the measured set an upper bound), so the conditional is load-bearing: effective cover below nominal moves realized per-event exposure P(link) up (the later sweep entry above shows r itself is cover-blind, so the harm never registers gate-side), and per WI-4's no-cross-subsidy pin it cannot be paid out of the gate's margin. WI-4 §13.5 ledger extended four → five conditionals; the seal-time verdict line now carries three permanent clauses (isolation, GF-4 promotion, effective cover). FOLLOWUPS funding-seam carry 4 split (observer machinery = testnet obligation, retained; cover level = register). Sweep across Gate-6's remaining named residuals: one proviso (GF-6 dummy/fragmentation ratio — the ambient large-v3 distribution must be observed from the live Tor network, never synthesized by the replay, or the ratio is tuned against the load generator); leg-(b), the §14.4 partition run, G-10.D, and the heavy-path L-curve classify as mechanism; L12 cold-start passes because its §14 disposition is already the design-away exit; isolation conditioning was already correctly filed.

• docs: the F-D4 §8 exit-seam sweep — X-1/X-2/X-3 arms built and run; findings recorded; the instrument itself never landed on dev (ARCHIVAL_EXIT_STANDOFF_FD4_WINDOW.md §8/§9 step 4; new §14). Per the round-4 landing disposition the harness is preserved at archive/feat/fd4-exit-sweep-2026-07-16 and its fate rides the §15.5 hand-forward (re-parameterized on the crossing observer if Gate-6 R4 re-homes the seam; otherwise never resurrected). The instrument as built and run: shekyl-staking-sim --exit-standoff (src/exit_standoff.rs), built to the bar before any row ran: X-1 steady-state arm over the §5.1 planning-box corners in the WI-4 N-sweep form (r < 2 at every swept N, worst row reported); X-2 crisis-cohort arm (N_x ∈ {3, 5, 8}, one/two-anchor per the §3 quantization lemma, swept σ_L) whose two-anchor rows certify the X-3 coverage boundary (measured cross-anchor overlap = predicted (W − SEB)/W at all three windows — mixes-at-all, never "merged"); the §8.3 shared-trigger negative control (caught via clustering-detection; the assignment observer is provably blind to the skip, which is why the control keys on clustering); the §8.4 thin-regime bias arm (unbiased); and the §5.3 lever-vs-queue costing on the shared capital-idle axis. The §5.4 frozen rule is encoded once (frozen_rule_window, planning-box corners pinned as its KAT) and EXIT_TARGET_ANON_SET is minted at this consumer (F-W5 §13.4 carrier). Observer pre-registered: support-gated exact Bayes under L ~ U[0, σ_L]. Two structural findings recorded at §14, stated not buried: delivered X-1 cover is latency-gated (ρ_x · σ_L, W-independent — the window buys de-quantization and the X-3 merge; confusability is bought by σ_L, priced by the exact inversion required_sigma_l), and marginal confusability is not r < 2 (the X-2 trough needs σ_L on the W/2 scale; 71/72 swept rows reported failing per GF7 §5.1 — the pre-committed §5.3 costing surface, never a bar move). On the archived branch the sim is a named approved consumer of exit-window-kat (comments pinned in both Cargo.tomls; the binary sits outside every production graph). The seal this instrument was to serve is removed by the round-4 entry above; the numbers survive as the §15.4 tripwire's re-run calibration template.

• docs: F-W5 resolved — the exit-seam N_t, derived a-priori (ARCHIVAL_EXIT_STANDOFF_FD4_WINDOW.md §13). Result: N_t(exit) = 10 — numerically equal to the entry posture anchor by derivation, not inheritance. The committed bar is WI-4's N-invariant ratio bound (r < 2 per regime row); N_t is only the posture anchor the window is sized to deliver. Each seam-variant structural fact was examined for whether it moves the anchor: cover class moves ρ_x (already spent on W), one-sidedness moves W and a graded §8 arm, the trough cohort is its own X-2 regime row (WI-4 regime splitting — never averaged into steady state); the anchor's own determinants (protected secret, bar, advantage semantics) are seam-invariant. The one real asymmetry — the persona↔principal binding observed repeatedly, keyed to the public P_id (recurring drops + terminal drain + entry∩exit intersection) — provably cannot be priced into a per-event anchor (intersection collapses geometrically; inflating N_t re-imports F-W3 via the pre-testnet E[m]) and routes to the σ_L re-appearance discipline and the S-2 exposure ledger as a named residual with reversion criteria. The §5.4 rule's X-1 term reads 9/ρ_x; the §8.1 arm grades at 10 and carries the WI-4 N-sweep form; EXIT_TARGET_ANON_SET is minted at the sweep-harness PR (numerically equal to the sim's entry constant, independently movable). The N_t = 9 ⇒ 20_000 exact re-cut trap did not bind — 9 has no model support in the derivation. Gate-6 §12.5/§12.6/§12.8, index F-W/Round-N rows, and the release-checklist seal entry swept.

• standoff: draw_exit_gap against the F-D4 provisional sentinel (Gate-6 §12.5 F-D3; ARCHIVAL_EXIT_STANDOFF_FD4_WINDOW.md §9 step 2). New shekyl-standoff/src/exit.rs: the one-sided exit-seam draw through the shared unbiased bounded_uniform — no order coin, no inversion (forced by the cooldown) — with typed ExitGap and an ExitGapWindow capability newtype whose wallet_default() reads DEFAULT_EXIT_GAP_WINDOW, a K_COVER-pattern provisional sentinel (0; provisional ⇔ 0 const-asserted; compile_error! unless the consumer enables the grep-able provisional-exit-gap-window acknowledgment feature, deleted at the Phase 7.7 seal; kat_inject() behind the permanent dev-only exit-window-kat feature — named per the kat_forge precedent so the PF-6a tripwire's for_kat grep stays scoped to KCover). Golden vector at a synthetic KAT window (10 007) with a seal tripwire that fails at seal time to force the re-freeze; the §12.5 pinned shared-trigger negative control landed (conformance.rs::exit_release_population, clustering-detection) beside a two-property exit grade (uniformity + serial independence — no order axis). Consumer acks: shekyl-engine-core and shekyl-staking-sim enable the arming feature explicitly.

• archival: F-D6 cooldown-anchor derivation — release_cooldown_anchor_height (Gate-6 §12.7, DONE). The exit-standoff scheduling anchor H_cd = (last_served + RELEASE_COOLDOWN_EPOCHS) × SETTLEMENT_EPOCH_BLOCKS now derives from named consts in one home (shekyl-archival-retention release_cooldown.rs), mirroring release_cooldown_elapsed exactly (vacuous never-served arm; fail-closed overflow arm) with a boundary test proving the two agree at H_cd and disagree one block before it. The last 20_000 doc-comment fossil (staking-sim standoff.rs module docs — the drift vector F-D6 was opened against) is purged, pointing at the derivation instead.

• docs: F-D4 review round 3 — F-W6: X-3 anchor-merge bound folded into the frozen rule (ARCHIVAL_EXIT_STANDOFF_FD4_WINDOW.md §5.2a/§12). Round 2 had parked the 2 × SEB structural argument as a tiebreak narrative; round 3 made it precise — it is a derived bound, from the §3 quantization lemma with no rate input: adjacent anchors sit SEB apart, cohort windows overlap iff W > SEB (measure-zero at equality), so at 1 × SEB the adversary partitions a straddling crisis cohort by exit height — invisible to X-1, which grades background cover, not cohort integrity. Minted X-3 (W ≥ 2 × SETTLEMENT_EPOCH_BLOCKS); the §5.4 rule is now W := smallest SEB multiple ≥ max((N_t − 1)/ρ_x, 2 × SEB). Carried with it: the coverage boundary (2 × SEB opens the split — 50 % mixed fraction at the cliff, continuous improvement, no second cliff; the §8 two-anchor arm grades the actual fraction; nothing may claim "merged") and the cost stated beside the benefit (the §5.3 queue predicate gains a hard 20_000 LHS floor in every measured world, so the F-W2 lever-vs-queue costing no longer evaporates on a dense ρ_x read). A preference-shaped max() floor was refused; the derived bound is what earned rule entry. Gate-6 §12.6, RELEASE_CHECKLIST.md seal entry, index X-/F-W/Round-N rows, and FOLLOWUPS swan-2/W8 swept to the two-term form.

• docs: F-D4 review round 2 — F-W3/F-W4/F-W5: the window value is not derivable pre-measurement; sentinel + frozen decision rule (ARCHIVAL_EXIT_STANDOFF_FD4_WINDOW.md §5.4/§11). F-W3 (blocking): the X-1 bound spans a ~19× planning box over the doc's own ranges (N_P ∈ 79–154, c ∈ [0.02, 0.2]; corners 2_922–56_962), so both draft candidates (2 × SEB, 3 × SEB) were points picked from a box, not derivations — ρ_x is a pre-testnet unknown and the value cannot precede the rate. Resolution mirrors the ratified K_COVER pattern (M1 §9.3): DEFAULT_EXIT_GAP_WINDOW ships as a provisional sentinel 0 with compile-time refusal absent explicit acknowledgment, sealed by the Phase 7.7 stressnet read of (ρ_x, N_x, σ_L) (RELEASE_CHECKLIST.md entry added beside K_COVER/PF-9). A wallet default sizing an anonymity set is soft-frozen (post-ship change = §16.1 partition trap as a flag day), hence consensus-constant treatment. Frozen now: the decision rule (smallest SEB multiple ≥ the X-1 bound), the F-W4 conservatism commitment (10th percentile of the joint (N_P, c) read — no stacked marginal worst cases), and the F-W5 pin (exit-seam N_t re-derived a-priori before the seal; the entry-inherited 10 is not the exit constant). 2 × SEB's structural argument survives independent of X-1. draw_exit_gap unblocked against the sentinel — compiles for testnet under explicit arming, refuses to ship unsealed. Gate-6 §12.6, index F-W/X-/Round-N rows, and the FOLLOWUPS swan-2/W8 entry swept to match.

• docs: F-D4 rate-model review round 1 — F-W1/F-W2 resolved by amendment (ARCHIVAL_EXIT_STANDOFF_FD4_WINDOW.md §10). F-W1 (blocking): the draft candidate 2 × SEB = 20_000 failed its own X-1 planning-instance bound (22_500, itself the conservative end — the pessimistic c = 0.05 pushes the bound up) while §5.4 said "clears" — the GF7 §5.1 bar-moving violation; re-derived to 3 × SEB = 30_000 (33 % margin, clears down to c ≥ 0.0375), failure recorded in-place, not erased. F-W2 (load-bearing): σ_L is wallet-drawn — a design lever, not a fact of nature — so the §5.3 predicate is a joint constraint over (W, σ_L); the wallet-discipline lever (σ_L ≥ W/N_x = 6_000 blocks, cost borne by exiters only) is now costed against the release-queue (domain widens for everyone, always) on the shared capital-idle axis, neither pre-selected. Lemma, X-1 shape, X-2 form, and the one-window pin survived review. N_t citation disambiguated to shekyl-staking-sim/src/standoff.rs:119. F-W family registered. (The 3 × SEB re-derivation was itself superseded same-day by round 2's F-W3 sentinel reshape — see the entry above.)

• MSW-6: relax the tx-wide scheme_id agreement (staking unblock). A v3 transaction may now carry per-input PQC schemes from {1,2} freely — e.g. scheme-2 (multisig) funding sharing a tx with a scheme-1 (single) bond vin. The former tx-wide agreement (every input matching pqc_auths[0].scheme_id) is dropped in lockstep across the C++ verify batteries (tx_pqc_verify.{h,cpp}, blockchain.cpp) and the Rust submit verifier (shekyl-daemon-rpc/.../verifier.rs); per-input scheme validity, key-blob length, and signature remain enforced. The agreement's stated scheme-downgrade purpose was vacuous (self-referential; per-output binding is the h_pqc leaf hash), and its actual effect — foreclosing a solo/multisig cross-model linkage — belongs in the wallet on no externality (one-time keys, FCMP++ proof over the whole tree — no other anonymity set shrinks) plus Shekyl's own opt-in scheme_id=2 self-marking precedent, not TM-1; the compensating coin-selection invariant (never cross key models, with a test) + disclosure line are a blocking E′/MS-5 ship gate, not consensus. Cross-seam KAT: tests/unit_tests/fcmp.cpp::msw6_mixed_scheme_transaction_verifies. See PQC_MULTISIG.md §16.3.

• MSW-1/2/3/4/5/8: V3.1 multisig wire-format bundle @ MAX=5. One validation surface; the cross-language KAT is the gate whose absence produced F-1.

  • MSW-1 (bound family + MAX=5). MAX_MULTISIG_PARTICIPANTS 7→5 (MSW-G, 2f+1 at f=2). The canonical wire length now lives on the type that owns the bytes (HybridPublicKey/HybridSignature::CANONICAL_LEN); SINGLE_KEY_CANONICAL_LEN / SINGLE_SIG_CANONICAL_LEN alias it. The DoS ceilings (PQC_MAX_PUBLIC_KEY_BLOB = 16384, PQC_MAX_SIGNATURE_BLOB = 32768) are decoupled from MAX and guarded by compile-time const _ asserts against the largest legal container — so a ceiling below a legal max-threshold blob is now a build error. The F-1 fossil 2 + N·LEN (which omitted the 3-byte container header and the 32-byte-per-participant spend-auth keys) is deleted from cryptonote_config.h, tx_pqc_verify.cpp, and shekyl-wire. The same stale n > 7 cap survived in multisig_receiving.rs and shekyl-address (×3): both are deduped to MAX_MULTISIG_PARTICIPANTS, and the crypto-pq↔address caps are pinned equal at compile time. F-1 catcher: the new shekyl_pqc_canonical_lens() FFI accessor + fcmp.cpp::msw1_pqc_constants_match_rust prove the C++ config constants equal the Rust ones across the FFI — the one mechanism that would have caught F-1, where each side was internally consistent and disagreed only across the boundary.
  • MSW-2 (disjointness KAT). The scheme-1 leaf length (1996) is disjoint from every scheme-2 container length, expected_blob_len is injective (so a length-relabelled blob is rejected on the length cross-check), and m_required ≥ 1 is the secondary separator. Leaf encoding untouched.
  • MSW-3 (misattribution / MS-8 record). The misattributed "output committed=" string was already removed by MSW-6; MS-8 stays retired (group_id verify no-op → folded into MSW-2).
  • MSW-4 (group_id version plumbing). multisig_group_id_from_address sources group_version / spend_auth_version from the group's MultisigAddressPayload rather than crate constants, so a version change produces a distinct group_id (§5.3); the bare multisig_group_id wrapper is now documented tests/fuzz-only.
  • MSW-5 (reserved-version carrier). The address payload transports a reserved spend_auth_version = 0x02 (Option E′ marker) opaquely — it round-trips unchanged for forward-compatible readers (§8.2).
  • MSW-8 (address shrink). The vestigial MultisigAddressPayload.hybrid_sign_pubkeys (Solution C fossil, zero consumers — leaf sign keys are derived per-output from KEM shared secrets) is deleted; PER_PARTICIPANT_LEN collapses 3200→1216 (~2.6× smaller address). Clean removal at payload version 0x01 — no version bump. PQC_TEST_VECTOR_002_MULTISIG.json regenerated off the F-1 fossil model. See docs/design/V3_1_MULTISIG_RUST_ENGINE.md (wire-work table) and PQC_MULTISIG.md §5.3 / §6.2.

• docs: F-D4 a-priori exit-window derivation (ARCHIVAL_EXIT_STANDOFF_FD4_WINDOW.md, Gate-6 §12.6). Committed before any draw_exit_gap code or sweep (GF7_HOOKS §5.1 ordering): anchor (last_served + RELEASE_COOLDOWN_EPOCHS) × SEB from named consts (F-D6); inherited r < 2 threshold, regime-split (steady-state X-1 vs L17 crisis-cohort X-2); the anchor-quantization lemma (the cooldown delays and quantizes a synchronized cohort — no smear; the a-priori answer to swan-2/W8's mechanism question, wargame-confirmed arm pre-registered); the §5.3 queue predicate making "is a release queue needed" decidable; DEFAULT_EXIT_GAP_WINDOW (the draft's committed candidate was retracted by review rounds 1–2 — sealed by measurement per the F-W3 entry above). Exit window does not borrow the entry 600 — the derivation shows SEB-scale. Code gated on the rate-model adversarial review.

• docs: F-D3/F-D4 activation fired — fossil sweep (Gate-6 §12.5). The rule-21 activation criterion ("a verify path reads the release cooldown as a spendability gate") is met at source: bond_post.rs:369 (HoldingsUpdate-drop) / :627 (Unbond), landed with the bond FSM (PR #303/#307). Swept every row that still claimed the gap: Gate-6 header/§6 R4 cell/§12 statuses, IMPLEMENTATION_INDEX.md Round-N row, PHASE_2B_FSM_RETOOL.md P2B-7 residuals row (said "open" against its own exit checklist's "closed" — Pin-4/Pin-5 closed at PR #303, sim reconciliation DONE at §L18), and the FOLLOWUPS HoldingsUpdate "Still open" clause. New §12.5 pin: draw_exit_gap per-event independence gets its own shared-trigger negative control. Build order: F-D4 a-priori window derivation before any code or sweep.

• ci: F-6 --features multisig lane + P0-n doc gate (follow-on to #308). Lands the F-6 lane (.github/workflows/multisig-feature.yml) and the P0-n doc-literal gate (scripts/ci/check_multisig_doc_literals.sh), split across two workflows (multisig-feature.yml, multisig-doc-literals.yml) so a docs-only change runs only the cheap ripgrep gate, not the full cargo check/clippy/test. Clippy posture matches build.yml (toolchain 1.94.0; -D warnings on clippy argv only). The gate catches the pqc_auth fee fossil in bare / comma / approximation forms (not only tilde-prefixed) and any k-of-n config over MAX_MULTISIG_PARTICIPANTS = 5 (not only the two 7-literals), and now scans the design carrier / tracking index / FOLLOWUPS instead of excluding them wholesale — genuinely-historical lines opt out with an inline doc-literal-gate-allow marker.

• fix: stale pqc_auth size in POST_QUANTUM_CRYPTOGRAPHY.md. The hardened P0-n gate surfaced a comma-grouped fossil (5,385 bytes) that contradicted the same doc's oracle figure — corrected to 5,389 (pqc_auth_weight()).

• docs: PR #308 Copilot round 2 — E′ consistency (principles, roles, ops, VERSIONING). Principle 5 no longer claims FROST SAL is out of V3.1 scope (E′ is 15.4a). Roles / MULTISIG_OPERATIONS banner Option D prover playbooks as historical. §15.1 / §7.2 / §7.4 spend_auth_version = 0x02. USER_GUIDE ~5.4 KB. VERSIONING / §15.4a cite derive_output_secrets for y ≠ 0, not output.rs:304.

• docs: defer F-6 / P0-n CI to follow-on PR (PR #308). Remove ci/multisig-feature workflow + check_multisig_doc_literals.sh from this docs carrier so #308 can land alone. Fossil sweeps remain here; gate script + workflow ship in the follow-on CI PR. Carrier / INDEX status: R1-F-6 open again until that PR greens.

• ci: align F-6 multisig lane with build.yml clippy posture (PR #308). Dropped job-level RUSTFLAGS=-D warnings (it denied rustc deprecated in path-dep helioselene, which main CI only warns on). Pin toolchain to 1.94.0 (not @stable); keep -- -D warnings on the clippy argv only; add --keep-going. (CI files moved to follow-on PR — see deferral bullet above.)

• docs: PR #308 Copilot review — decide/enforce labels + F-11 consistency. MAX=5 is the ratified MSW-G target; docs no longer imply the live constant (still = 7 until MSW-1). Changelog drops the superseded same-day MSW-G=8 bullet (trail stays in the carrier history). Finding range unified to R1-F-1…F-11. §16.7 feature-flag block labeled planned sketch (not a copy-pasteable Cargo.toml).

• ci/docs: P0-n doc gate + F-6 --features multisig lane (PR #308). scripts/ci/check_multisig_doc_literals.sh (cap / fee-oracle fossils) and .github/workflows/multisig-feature.yml (cargo check / clippy -D warnings / test on engine-core + engine-rpc + ffi with --features multisig). Operator docs swept off 5-of-7 / 5385 fossils. Pause before MSW-6 — first enable may clippy-fail on frost_sal (Option A debt); that is the signal. (CI files moved to follow-on PR — fossil sweeps stay in #308.)

• docs: D-7…D-10 — VERSIONING + MS-4/MS-5 under E′ (PR #308). VERSIONING: two-component gate discharged (output.rs:304); remaining blockers = threshold-share y_group + wire 0x02; protocol-3 wire is scheme_id=2 M-of-N list (not "FROST-style"); 15.4b gets IR 8214C → MPTC ~2027 → later-process scale. MS-4/MS-5 restated: receive = local KI via b (no I7); spend = FROST-on-y + nonce types (not prover handoff). Round 1 closure checklist + §10.3.1 premise date.

• docs: Pin #1 reversion + VERSIONING/§10.3.1 for E′ (PR #308). Named reversion: comment-only production-source amendments allowed when recording a semantic this doc-only PR pins (bond_wire.rs MSW-7 pseudonym-uniformity — was a silent Pin #1 break). VERSIONING.md: 15.4a blocker open (y≠0 landed); 0x02 = E′ product path. V3_ENGINE_TRAIT_BOUNDARIES §10.3.1 status: MS-8 retired, E′, MSW-*. Sequencing note: MSW-G cold before MSW-1 code.

• docs: Phase 0 sweep D-1…D-6 + P0-n grep-gate (PR #308). Fix normative n_total > 7 → MAX_MULTISIG_PARTICIPANTS (D-1). Correct ROLLOUT vs-N-solos ratios (0.57× / 0.48×), cap fossils (=7 / 5-of-7 / ~37 KB → 5 / 5-of-5 / ~27 KB), pqc_auth 5385→5389 from pqc_auth_weight(), Last-updated date (D-2…D-5). ANALYSIS: historical banner, E′ row in §2.1, §6/key-escrow superseded, §7.6 E′ tweak Phase 6 target; rotation naming collision (§11.1 ≠ §15.2). P0-n: doc grep-gate against bare-cap / fee-oracle drift.

• docs: MSW-8 — delete vestigial address hybrid_sign_pubkeys (PR #308). Confirmed zero consumers: multisig_receiving.rs derives leaf sign keys from KEM; address field is construct/parse-only (Solution C fossil). ~2.6× address shrink is MSW-8, not E′ (attribution correction). N=2 ≈ QR-able. §15.3 registry demoted off critical path. Defect class named: shape-from-prose without a read site. E′ three closes complete (dealer-only, y-tweak→Phase 6, MSW-8).

• docs: Option E′ — two-component trust split is the product path (PR #308). O = ho·G + B + y·T: b group-plaintext (view+link / local KI); y FROST M-of-N with y_out = y_group + y_kem (E′, not fixed-y E). Dealer-mode, no DKG, no export_multisig_info. Deletes mandatory-prover Option D scaffold (~prover/heartbeat/ counter_proof/I7). spend_auth_version=0x02; 0x01 never issued. frost-sal-v4 = E′ gate (keep primitives; delete Option A wrapper). Does not shrink auth blobs or fix anonymity partition. Address size win deferred to MSW-8. Carrier §0.5; PQC_MULTISIG §15.4a / §16.7 aligned.

• docs: MSW-6 + MSW-G=5 overhaul; MSW-7 retract (PR #308). Track A staking unblock is MSW-6 — relax tx-wide scheme_id agreement (per-input ∈ {1,2}); archival core never sees funding inputs (verify_*_bond_post(vin, record_state)). MSW-G = 5 (2f+1 at f=2; withdraws same-day MAX=8). MSW-1 narrowed to SINGLE_KEY_CANONICAL_LEN single-source + DoS ceiling. MSW-7 retracted — bond_spend_pk stays 1996 for pseudonym uniformity (bond_wire.rs comment amended). Pin #4 named reversion for MSW-6 only. Sequencing: Phase 0 docs → MSW-6 → MSW-1…5 → F-6 → Option E′. Phase 0: V3_ROLLOUT whole-tx weights; PQC_MULTISIG §5 derivation, §11.1 rotation≠hostile-sender, §14.2 stream attribution, §15.4a two-component O open, §16.3/16.4/16.7 retire DiD/wallet2. (Same-day provisional MSW-G=8 withdrawn into this entry — decision trail lives in V3_1_MULTISIG_RUST_ENGINE.md history, not as a separate changelog bullet.)

• docs: corrected picture — design done; Track A is the urgent half (PR #308). Banner in V3_1_MULTISIG_RUST_ENGINE.md: April decisions stand; gap is unbuilt scaffold + consensus surfaces the feature gate never covered. Three buckets, differential rigor, reviewer scorecard. §11.1 / ANALYSIS grinding lead → availability ~k·n, not scare-n^k.

• docs: R1-F-3 → DELETE Option A FROST fossil (PR #308). Not the Apr 15 rotating-vs-fixed prover fork (both Option C/D; rotating chosen with named 1/N loss). MultisigGroup.pqc_public_key is Option A (rejected 2026-04-04 for pqc_auth fingerprint). Do not quarantine behind frost-sal-v4 — artifact fuses SAL keys with rejected fixed group PQC key. F-4/F-5/F-9 evaporate on delete. V3_ROLLOUT.md coordinator-held + staking-recommendation drift fixed (P0-h partial). Retract "Phase 6 cryptographer" claim on per-output privacy.

• docs: §0.4 coexistence — V4 rewrites beside V3.1 (PR #308). §15.4–15.5 imply permanent dual stack (version byte + HRP), not in-place evolution. Discriminability > evolvability; MSW-4/5 version bytes are the entire V3.1↔V4 interface. Track A permanent / Track B ~4y then legacy — process inversion named. MS-1(a)/(c) preferred, (b) rejected under coexist. MS-7: versioned record with working discriminator, not evolvable enum.

• docs: R1-F-11 / MSW-4+5 — version hooks for 2030+ (PR #308). group_version fused with MULTISIG_CONTAINER_VERSION (constant, not container.version); spend_auth_version hardcoded / not on container wire by accident; reserved-namespace KATs incomplete (group_version never varied). Same shape as F-1 — feature gate does not protect genesis-frozen bytes. MSW-4 unfuse + known-version set; MSW-5 pin carrier decision; §15.1 honesty (P0-k).

• docs: §15.4 posture pin — auth already PQ; SAL = liveness (PR #308). Scheme_id=2 is M×ML-DSA today; solo and multisig share classical FCMP++ membership/SAL. Multisig adds no classical exposure. Classical SAL is 1/N permanent-loss (availability), not compromise. Grinding / griefing → MS-4/5 engineering, not Phase 6 crypto. Phrase pin: spend_auth_version=0x02 = 15.4a threshold classical SAL; 15.4b = composite/lattice-only auth size — not lattice SAL (impossible under FCMP++). Ship decision = economics (~3×), not crypto-maturity.

• docs: split PQC_MULTISIG §15.4 — FROST SAL ≠ lattice auth (PR #308). §15.4a FROST SAL (mandatory prover / 1/N) blocked on two-component address / y, not NIST. §15.4b pure-PQC composite auth blocked on lattice threshold maturity; NIST IR 8214C is reference-material only (MPTC ~2027 → later process). TRacoon wrong N regime + trusted KeyGen

  • not FIPS; watch dPN25 / TALUS for size. MSW-G size lens has 15.4b expiry; genesis still freezes on today's signature-list economics. VERSIONING.md V4 note aligned. P0-j landed.

• docs: MSW-G — MAX=7 has no derivation; F-1 fix is the 6/7/8 pick (PR #308). Recorded in V3_1_MULTISIG_RUST_ENGINE.md §0.3. Fossil bound accidentally caps spendable N at 6; reward zone independently caps worst-case at 6. Raising the bound to admit 7 is a behavior change. Candidates 6/7/8 held open. MSW-2 reopen names either separator (length primary; byte[2] secondary). V3_ROLLOUT fossil ~7× table + coordinator/staking drift → P0-h. TRacoon / lib-q-threshold-raccoon noted as V4 research, not Track A.

• docs: F-2 retraction — Track A revised to constant fix (PR #308). Leaf preimage left alone (not free: wallet2 / emission Auth-B / FFI ABI / vectors; not needed: byte[2] prefix disjointness already separates scheme 1 vs 2). Track A = MSW-1 bounds reconcile + MSW-2 disjointness KAT + MSW-3 misattribution; MSW-G on whether MAX=7 survives reward-zone. Fee model / MAX_INPUTS=128 → Track B. wallet2 PQC multisig group surface acknowledged under MS-2.

• docs: Round 1 adversarial on V3.1 multisig engine design — Track A/B split (PR #308). Records R1-F-1…F-11 in V3_1_MULTISIG_RUST_ENGINE.md. Track A (MSW-1…MSW-3): V3.0 pre-genesis wire — N=7 blob-bound fossil (fund-loss), leaf scheme_id genesis decision, dual verify sites; not held by engine rule-26 halt. Track B: MS-1…MS-7 remain gated; MS-8 retired (group_id verify is a no-op → MSW-2). Round 1 cannot close until F-3…F-7 + F-6 CI. INDEX MSW- registry; FOLLOWUPS group_id item superseded.

• docs: V3.1 multisig Rust engine integration design — Round 1 OPEN (docs/v31-multisig-rust-engine-plan). Fires V3_ENGINE_TRAIT_BOUNDARIES.md §10.3.1. New carrier docs/design/V3_1_MULTISIG_RUST_ENGINE.md poses MS-1…MS-8 (trait identity, Rust-owns-logic C++ boundary, feature-gate flip criteria, receive/spend/transport placement, Persistence R6 confirm, daemon group_id verify as separate PR). Protocol remains PQC_MULTISIG.md; §16.4 C++ wallet bullets marked superseded pending Phase 0. INDEX registry + FOLLOWUPS pointer updated. No implementation until design rounds + rule-26 pre-flight and explicit go-ahead.

• archival: ShardSet newtype — parse-don't-validate holdings shard list, and the shard list is now a set on the wire (gate-4 §3.4.1; feat/shardset-newtype). Converts HoldingsDescriptor.shard_ids from a bare Vec<u64> to a validated ShardSet: the structural invariants that were carried by convention — the MAX_HOLDINGS_SHARDS bound (each verify re-guarding; bond_floor signalling an invalid set with an in-band 0, the same value the empty exit shape returns) and duplicate-freeness — are enforced once, at construction, so an invalid set is unrepresentable past any decoder.

  • Consensus tightening (ratified 2026-07-15): holdings are a set. A shard is a distinct retention obligation, so a ShardSetCompact list carries no duplicate id — previously rejected only inside the HoldingsUpdate/Rebond diffs and silently tolerated by JoinMarket ([7, 7] bonded 2·FLOOR for one shard). Duplicate-carrying byte strings now reject at decode.
  • Byte-identical for accepted txs. Insertion order is preserved (not canonicalized), so a valid ShardSet encodes exactly as the old Vec did — no accepted tx re-encodes; only the validity predicate tightens. Pinned by the unchanged golden-vector codec test.
  • Construction routes through ShardSet::new at every decoder boundary: the wire decoder (new WireError::HoldingsDuplicateShard), the FFI vin marshal (a second decoder — new code 48 HOLDINGS_DUPLICATE_SHARD beside the count cap), the emission claim-source decoder, and every builder/fixture. ShardSet derefs to [u64], so read sites are untouched. The independent shekyl-wire oracle enforces the same duplicate-reject in its own Holdings::read.
  • Retires the per-verify oversize guards the FOLLOWUP named: the RebondPostOversize verify belt is dead (verify receives a bounded ShardSet) — removed; FFI/C++ code 45 reserved, not renumbered. The raw-slice connect path keeps its RebondConnectError::PostOversize belt (C++ marshals the post array to the connect fold without re-constructing a ShardSet); bond_floor_of keeps its count-path oversize guard (the Unbond fold's C++ count crosses the FFI as a primitive).
  • Tests: ShardSet bound/duplicate rejection, insertion-order-preserved byte-identity, decode-rejects-duplicate-wire-bytes, FFI-marshal and shekyl-wire duplicate-reject twins. Behavior-preserving migration across 6 crates (retention, ffi, engine-core, bond-builder, staking-sim, shekyl-wire).

• archival: Rebond — post-slash reinstatement, end-to-end + the same-epoch slash-interval consensus-halt fix (gate-4 §3.4; P2B-9, ratified 2026-07-14; feat/bond-fsm-rebond). The final bond-FSM kind: the full genesis lifecycle (JoinMarket / HoldingsUpdate / Rebond / Unbond) now verifies, connects, and reorg-reverts through the real block path. Reinstatement, not re-entry: a slash is a bounded penalty (one shard + one burned FLOOR + a zero-earning gap) and Rebond resumes the persona in place — same P_canonical_id, carried tenure, backlog; it is the only exit from a terminal slash (nothing to unbond at bonded_total == 0).

  • Consensus-halt fix (commit 1, P2B-9 Pin 5): every held shard is challenged every epoch against a stale eligibility copy, so an offline N-shard record appended N identical open bad intervals in one block — at N > the 256-interval codec cap the encode threw inside the block-connect slash hook, a deterministic consensus freeze reachable by accident. Same-epoch slashes now coalesce (append only when no open interval exists); the pop revert was already idempotent-compatible, so the fix is apply-side only. Establishes the ≤ 1 open interval invariant the Rebond close targets. KAT drives a 300-shard same-epoch sweep (above the cap) with byte-exact revert.
  • Verify (Rust-native): precondition = exactly one open bad interval (zero → not slashed; more → the coalescing invariant's loud corruption reject); post ⊇ current duplicate-free non-empty superset (Pin 1 — shedding of carried shards forbidden, stays HU-drop's gated job; the slashed shard's abandonment is priced — burn + portfolio gap — not prevented, rule-21 reopen if slash economics ever return collateral); bond_credit == bond_floor(post) − bonded_total with zero legal and common (Pin 2 — the landed slash preserves floor-equality, no deficit exists); interval-log headroom ≤ 254 (Pin 6 — one slot for the next slash + one for Unbond's clean close, exit always reachable); ShardSetCompact both sides. Auth = identity key on the landed GF-1 selector (credit path, Pin 4).
  • Connect/pop: the connect closes the open interval in place at end_exclusive = E_rebond + 1 (Pin 3 — the partial rebond epoch forfeited in both directions, the E_add+1 mirror; carried and added shards resume together) and rebuilds the coupled add-epochs (carried keep theirs, added take E_rebond — Pin 7); the pop re-opens the journaled interval to MAX (identity-belted) and reverts the |added|·FLOOR credit, zero delta included. New archival_bond_rebond_log pre-image journal (maxdbs 45→46) carrying the closed interval's index + start alongside the holdings pre-image — pre_bonded_total == 0 legal (terminal reinstatement).
  • FFI + dispatch: shekyl_archival_verify_rebond_bond_post / shekyl_archival_rebond_connect / shekyl_archival_rebond_pop; shared BOND_POST error space codes 37–44 + the REBOND_APPLY family; the C++ verify arm marshals the record + full interval log and pins the identity key; per-post live-counter threading throughout. rebuild_shard_add_epochs generalized to a K-shard override set (shared with HU).
  • KATs: 17 Rust (standing-only/growth/terminal accepts; swap-shed, headroom-boundary, multi-open, and every term/shape reject) + 3 C++ real-block-path (growth connect/pop with interval close/re-open and add-epoch rebuild; standing-only zero-credit round-trip; journal codec).
  • Docs: P2B-9 pins in PHASE_2B_FSM_RETOOL.md (incl. the corrected Pin 1 coverage boundary + the R-3-routed retention-valve forward question); gate-4 §3.2/§3.4/§4.1 swept to the credit equation and the E_rebond + 1 close.
  • Review round (9 findings + 2 Copilot): two new verify belts — RebondPostOversize (an oversize post on a terminal-slashed record collapsed bond_floor to 0, verified at zero credit, then aborted block connect at the record encode) and RebondRecordFloorBroken (a floor-drifted record now rejects at verify instead of riding to the connect fold's FATAL belt — tx rejection, not a chain halt); the FFI vin marshal now enforces the wire codec's MAX_HOLDINGS_SHARDS bound for every post kind (the marshal is a second decoder), and the Rebond connect fold belts oversize posts. The Pin-5 coalescing decision moved Rust-side (slash_open_interval_to_append, KAT-covered) — the C++ slash writer appends exactly what the fold returns. Duplication paid down: the HU marshal prologue is shared with the Rebond FFI entry (bond_post_record_marshal_prologue), the LMDB connect-writer scaffold is generalized to all POST-holdings kinds (apply_archival_bond_record_update, with the in-place interval close as a fold output), the verify arms share one record-fact marshal (archival_marshal_record_facts), and the Rebond round-trip KATs share one seed/tx builder.

• archival: HoldingsUpdate add + drop — the voluntary one-shard bond balance path, end-to-end (gate-4 §4.4; P2B-7; feat/bond-fsm-holdings-update). Building on slice A's bond_duration freeze: the fourth and final bond-FSM kind (JoinMarket / Rebond / Unbond / HoldingsUpdate) now verifies, connects, and reorg-reverts through the real block path. A record stays Bonded throughout — one shard is added (+FLOOR credit) or dropped (−FLOOR debit) under the bonded_total == bond_floor(holdings) balance.

  • Record (v6): ArchivalBondValue gains a per-shard shard_add_epochs array, index-parallel to held_shard_ids under one holdings count (a length desync cannot round-trip). Join-time shards take E_join; a HoldingsUpdate-add appends E_add; a drop removes the dropped shard's entry. The drop path reads it for the retention horizon and (slice A) the age-at-add. The reorg-log schemas ripple to match: ArchivalSlashRevertValue v3 and ArchivalBondUnbondRevertValue v2 carry the coupled add-epochs.
  • Verify (Rust-native, shekyl-archival-retention::bond_post): verify_holdings_update_add gates on ShardSetCompact record + post, exactly +FLOOR credit, good-standing (good_through the current epoch), a single-shard set-diff add, and post-floor equality; verify_holdings_update_drop gates on exactly −FLOOR debit, a single-shard removal (drop-last rejected — a full exit is Unbond), post-floor equality, the retention horizon (current_epoch − add_epoch ≥ bond_duration), and the grace-tail precondition (the dropped shard's release cooldown elapsed and slashes settled through its last-served anchor). 22 KATs.
  • Grace-tail DROP model (ratified 2026-07-15): the release cooldown is a verify precondition; at connect the shard leaves holdings and the FLOOR returns immediately via the bond_debit source term — no cooldown sub-state, no interval, no clean-close marker (superseding the earlier drop-then-cool fossil, P2B-7 Pin 2/3, swept in the design docs).
  • Connect/pop folds + FFI: holdings_update_{add,drop}_connect produce the counter movement (absolute post-values, threaded per post) and the single-shard delta; holdings_update_pop reverts by the connect's ±FLOOR. Exposed across the single shekyl-ffi boundary (shekyl_archival_verify_holdings_update_{add,drop}, shekyl_archival_holdings_update_{add_connect,drop_connect,pop}).
  • C++ dispatch (thin glue): the bond-post verify branch routes add/drop on the debit direction and applies the GF-1 auth selector (credit → identity key; drop's debit → the record's committed bond_spend_pk, the Unbond arm's twin); the connect arm journals the record pre-image to a dedicated archival_bond_holdings_update_log (the record stays Bonded, so it cannot share Unbond's Exited/clean-close pop path) and applies the fold's write set with per-post live-counter threading; pop_block reverts it. Real-block-path add/drop connect/pop KATs assert the add-epoch rebuild, the counter movement, and the byte-exact reorg restore.
  • Review round (2026-07-14): seven correctness findings fixed. The checkpoint fast-path GF-1 belt is re-keyed on the GF-1 selector itself (bond_debit > 0, not post_kind != JoinMarket) — as written it rejected every valid HoldingsUpdate-add block under fast sync (the add is a credit arm, identity-key authorized): a network split. The HU verify arms gain the Bonded-state gate (shared prologue; P2B-7 Pin 1 Bonded → Bonded, HoldingsUpdateRecordNotBonded + connect-fold RecordNotBonded belt) — without it an Exited record passed every add gate (the zero-length clean close excludes nothing from good_through; bond_floor(∅) vacuously satisfies the floor pins) and became a JoinMarket-bypassing resurrection whose connect threw on the empty-pre-image journal row: verify-valid but unconnectable on every node, a chain-stall vector. Pin-4 + Pin-5 are CLOSED, not follow-on: archival_bond_holds_shard — the one accessor both serve-credit acceptance and slash eligibility bottom out in — bounds a tip-held shard below by its v6 add-epoch (and the slash-log reconstruction by the row's journaled add-epoch), enforcing per-shard E ≥ E_add + 1 symmetrically: no add-epoch serve credit, no unjust slash for a challenge that fired before the add; a voluntarily dropped shard answers not-held everywhere (grace-tail keeps no drop interval — the drop epoch's pending acceptances are forfeited, the add-forfeit's twin). Unfrozen-at-add fails closed to the LONGEST retention horizon on both corners (ShardAgeAtAdd::from_add: freeze ≥ H_close(add_epoch) → age max, matching the C++ missing-freeze-row sentinel; previously the same condition earned a 4- or 20-epoch lock depending on when the freeze landed — a 5× early-recycle hole vs. the §L18 age-stratified friction). The drop-after-fire scenario is documented as the RATIFIED grace-tail bounded forgiveness (Pin 3; capped at one cooldown — "stop serving and hold" keeps being slashed), and the slash-apply FATAL's HoldingsUpdate revisit is discharged. The pop-ordering comment now states the real dependency (slash revert FIRST; the slash journal restores the same record fields — the "compose in any order" claim was false). Dedup: shared C++ debit-auth pin (Unbond + HU-drop), shared Rust verify + FFI marshal prologues, shared HU connect-writer scaffold (add/drop differ only in the fold call).

• archival: bond_duration(age) retention-horizon freeze — HoldingsUpdate slice A (gate-4 §4.4; ARCHIVAL_TIMING_CONSTANTS.md §1; P2B-7 Pin 3 / P2B-8 Q3; feat/bond-fsm-holdings-update). The genesis-frozen per-shard drop-eligibility formula, landed on its own reviewable surface ahead of the HoldingsUpdate verify/connect (slices B/C) that consume it — pure functions, no schema or consensus-path change.

  • bond_duration(ShardAgeAtAdd) -> epochs (shekyl-archival-retention:: bond_duration): BASE·(1 + SCALE·age), integer-canonical (round-half-up, floored at 1; no float in consensus). BOND_DURATION_{BASE_EPOCHS,AGE_SCALE} = 4/4 (H2 plateau arm, provisional within the scale band [2,8]) wired from config/consensus_constants.json through build.rs (emitted into the OUT_DIR-generated include that bond_floor.rs pulls in) and, in parallel, through generate_consensus_constants.py into the C++ constants header for cross-language parity (no C++ consumer at genesis — the bond-FSM verify is Rust-native).
  • ShardAgeAtAdd newtype makes two consensus properties unrepresentable at the type rather than tested-against: the age is evaluated at add, not at drop (the sim arms the lock on fresh acquisition and counts down, so a rising-target drop-time age cannot be expressed), and its close reference is H_close(add_epoch), the same settlement-close height the reward curve feeds shard_age_milli (the constructor derives the close from the add epoch, so a raw within-epoch block height cannot be passed). One age normalization across reward and retention, by construction — the age-realization invariant, pinned in ARCHIVAL_TIMING_CONSTANTS.md §1.
  • KATs: endpoints/midpoint/monotonicity/floor, the F1 close-reference check (age uses H_close(add_epoch)), and the F2 full-sweep parity — the integer artifact equals the sim's f64 model across every age_milli ∈ [0, WORK_MILLI_SCALE], with the integer authoritative: a divergence fails loudly as the signal to re-check the sim economics (the genesis 4/4 constants have no half-boundary case, so the sweep is clean; the KAT is the tripwire on any re-pin).

• archival: GF-1 bond_spend_pk wire+record — the debit-side enable flip (gate-4 §3.5 step 5 / §4.1 / §9.11; feat/gf1-bond-spend-pk). The sequenced prerequisite the Unbond wiring named is landed; Unbond txs now verify end-to-end and HoldingsUpdate's drop-path auth is unblocked.

  • Wire: txin_archival_bond_post gains the JoinMarket-coupled GF-1 debit authorizer in all three C++ serializers (binary/boost/JSON) and in the Rust bond_wire codec — present with the exact canonical single-key length iff JoinMarket, absent otherwise, enforced both directions on every representation (a misconstruction is loud, never silently dropped). Reconciles the shekyl-wire §9.11 divergence; the §3.4.1 signature_preimage binds the key (the operative consensus binding also rides the tx prefix inside the pqc payload); the gate-4 lifecycle KAT fixture is regenerated from the coupled codec and now exposes bond_spend_pk_hex for the C++ integration KATs.
  • Record (v5): ArchivalBondValue commits the key once at JoinMarket connect — put_archival_bond_record takes it as a no-default parameter (no caller can silently commit an empty authorizer); v4 rejects at decode (pre-genesis posture: reset the data directory). The real-block-path connect KAT asserts the committed copy.
  • Auth (the reject→auth swap, one change): the §3.5 step-5 selection is live in check_archival_bond_post_input as the shared debit authorizer — credit paths pin the pqc auth key to the identity P_pubkey; debit paths pin it to the record's committed bond_spend_pk (the signature over the whole-tx payload is verified against that key by verify_transaction_pqc_auth). A record committing no key authorizes nothing — fail-closed, never identity fallback. Pinned by the discriminating KATs: committed key accepts, identity key / foreign key / keyless record all reject; the credit-path twin proves the vin's own key does not authorize the credit.
  • Wallet seam: ArchivalBondPostVin carries the key (build_join_market_vin sets it from ArchivalPKeys::bond_spend_pk; wire_bond_post_input's supply-alongside parameter deleted), so the A-1 assembly invariant now pins the key byte-for-byte between the prefix input and the signed vin.
  • Review round: the boost serializer enforces the coupling both directions (it admitted a non-canonical key on load — the one codec bypassing the length pin the record-commit relies on — and silently dropped a stray one on save); JSON toJsonValue refuses at write what fromJsonValue refuses at read. The FFI vin marshaler threads the real bond_spend_pk through both verify entry points and enforces the coupling itself (SHEKYL_ARCHIVAL_BOND_POST_ERR_BOND_SPEND_PK_COUPLING, code 23) instead of placeholdering the field into a vin the Rust wire codec refuses to serialize. check_archival_bond_post_input gains the §9.11 belts for non-parse callers on both arms and pins the committed key BEFORE the per-shard cursor scans + FFI verify (an unauthorized Unbond no longer pays the LMDB walk). The block-level checkpoint fast-path arm executes the swap its belt named: under the fast path it re-pins the debit's pqc auth key against the record's committed bond_spend_pk instead of blanket-rejecting every debit kind — without this, a block carrying a valid Unbond was rejected by every node, contradicting the enable flip; debit-side posts now also feed the per-P block-unique pass. The gate-4 lifecycle KAT reads gate-2's integration section directly instead of embedding a copy (the committed copy had silently drifted on dev with no test failing).

• archival: Unbond release-gate hardening + block/template dedup (review round, feat/bond-fsm-unbond-connect). The release cooldown gains a second predicate — slashes_settled_through: the slash scheduler's settled watermark (archival_last_slash_epoch) must have reached P's last-served anchor, so a held-but-unserved failure at or before the last serve is slash-processed on bonded collateral before the exit verifies. This closes the one-block race where the connect dispatch precedes the per-block slash fold. Epochs after the last serve are exit-forgiven by construction: slashability ends at the Unbond connect and the refund is never clawed back (so the pop-order slash revert is a defensive belt, not a real-case dependency; apply_archival_slash_one now FATALs on a shard the record does not hold rather than silently no-op). A CompleteTree record's cooldown anchor is sourced from an all-shards P-prefix serve-credit scan (archival_bond_all_last_served_epochs) instead of its empty stored shard list. The block-level pass gains a GF-1 fail-closed belt (any debit-side bond-post kind rejects the block, matching the per-tx rejection the PER_BLOCK_CHECKPOINT fast path skips), and the mempool/template fill dedups archival block-unique keys (bond-post P, emission (P,E), serve-credit (P,shard,E)) so two conflicting txs cannot co-occupy one self-invalid template (a mining-stall vector). A serve-credit + Unbond for one P in one block is deliberately allowed (served epochs are slash-immune; the re-armed span is the exit-forgiven tail).

• archival: Unbond C++ dispatch wiring — connect arm, pre-image journal, pop twin, verify dispatch, per-P block pass (gate-4 §3.5/§4.3/§5; P2B-8 increment c, feat/bond-fsm-unbond-connect). The add_transaction bond arm dispatches on post_kind: Unbond → apply_archival_unbond, the single writer that journals the record's full pre-image (m_archival_bond_unbond_log, BE(height)‖BE(seq) — ArchivalBondUnbondRevertValue carries exactly the three mutated fields, disjoint from the emission journal's), applies the Rust fold's write set verbatim (Exited record + clean interval-close + counter debit), and FATALs on any fold error. Counter threading is per-post (live get → fold → set inside the writer) — armed by the two-P-one-block KAT, which a hoisted per-block read would fail. pop_block calls revert_archival_unbonds_at_height after the slash revert as a defensive ordering belt — slashability ends at the Unbond connect (an Exited record holds no shards, so it is never a slash candidate; ratified 2026-07-12), so nothing trails the clean close and the pop fold's trailing-close check holds unconditionally; the fold validates the Exited shape + trailing close before re-crediting, and the pre-image restores byte-exactly (real-block-path connect/pop KAT). Verify dispatch: check_archival_bond_post_input gains the chain-height operand and an Unbond branch marshaling record facts + the P2B-8 Q1/Q2 cooldown anchors (archival_bond_last_served_epochs: one reverse-cursor seek per held shard over the BE serve-credit key; never-served omitted). The per-P block pass is marshaled beside the emission (P,E) pass (shekyl_archival_bond_post_block_unique, reject-not-serialize). Named blocker (rule 22, gate-4 §3.5 + FOLLOWUPS): Unbond txs remain verify-rejected fail-closed at the §3.5 step-5 debit-auth step — no record commits a bond_spend_pk (the §9.11 field the Rust wallet wire carries is absent from the C++ vin serializer and the v4 record), and the identity key must never authorize a value-out (GF-1). The GF-1 wire+record sub-increment is the enable flip.

• archival: Unbond connect fold + pop twin, Rust-native (gate-4 §4.3 "On confirm" / §5; P2B-8 increment b, feat/bond-fsm-unbond-connect). shekyl-archival-retention::bond_connect is the single implementation of the release's write set — the post-connect record (bonded_total = 0, compact-and-empty holdings; the record persists for backlog claims), the total_bonded_atomic debit, and the §4.3 clean interval-close, landed as a zero-length interval [E_unbond, E_unbond) in the record's interval log: good_through-inert by construction (KAT-pinned, including next to an open slash interval), it records the exit epoch for the later W-lapse / p_slot-burn step with no schema change. The pop twin validates the tip record is the connect's product (Exited state + trailing clean close) before re-crediting the counter; record fields restore from the connect's full pre-image journal (emission WS-2 §6.3 shape — the vin carries the post-state, so holdings are otherwise unreconstructible). FFI: shekyl_archival_unbond_connect / shekyl_archival_unbond_pop — the C++ connect site (follow-on wiring increment) writes exactly what the out-params dictate, no consensus arithmetic caller-side; all non-OK codes map to FATAL, never a soft skip. The refund needs no connect write: bond_debit is the CT-balance source term on the wire (§2.4 — the refund vouts are ordinary hidden FCMP++ outputs that mix normally). Riders: verify_unbond_bond_post gained the IntervalLogFull belt (a record whose interval log is at the codec cap rejects at verify — a verified-but-unconnectable tx would be a deterministic halt); gate-4 §4.1 executed P2B-8 Q2's forward amendment (last_served_epoch dropped — derived, never stored) and now pins the landed bond_event_log representation; §3.5 documents the connect/pop write set and names the wiring obligations (block-level per-P bond-post pass, journal table). Review round (same increment): the marker's storage half is now KAT-pinned end-to-end (archival_substrate_lmdb.unbond_clean_close_marker_round_trips: v4 codec encode→decode→re-encode identity on [E, E), the production LMDB writer/reader on the Exited shape, and the production good_through read path — verified besides that no codec/marshal/decode path anywhere asserts start < end); kMaxBadIntervals pinned as a genesis-frozen consensus constant (verify validity keys on it; static_assert + Rust-twin lockstep note) with the interval log's two entry kinds documented at both BadInterval types; and the block-level pass's decision function landed (bond_post_block_unique + shekyl_archival_bond_post_block_unique, the emission_block_claims_unique sibling keyed on P alone, reject-not- serialize) — covering the whole same-P same-block class (double-JoinMarket credit, double-Unbond debit, mixed kinds), which the §4.5 conservation audit cannot catch (a double-credit doubles both sides consistently). C++ marshaling of the pass stays with the wiring increment (§3.5).

• tests/wallet/rpc: emission-claim PR-4a — staker regtest harness up to the daemon submit gap, its enablers, and the Q11 blob-boundary arm (EMISSION_CLAIM_BUILDER.md §8 "PR 4 split"; feat/emission-regtest-e2e). Driving the harness live surfaced that the daemon's Rust submit engine accepts neither transaction kind the E4-gate e2e needs (no bond-post Phase-C battery; Phase A rejects Input::ArchivalRewardEmission), so PR-4 split into 4a/4b/4c — 4a is this batch, 4b is the daemon submit batteries (FOLLOWUPS V3.0 item), 4c is the e2e proper. Landed here:

  • tests: the CB-4 Q11 blob-boundary invariance arm (archival_emission_ct_balance.cpp): the emission fixture made valid under the full ver_non_input_consensus dispatch (valid-domain output keys, fee-input key image, per-input pqc_auths), plus the arm asserting the CT-balance verdict is invariant under canonical_bytes variation with an oversized-pseudoOuts control. Closes the Q11-KAT FOLLOWUPS item. (Header hygiene rider: tx_verification_utils.h now includes blobdatatype.h — it referenced blobdata without declaring it.)
  • archival: a FAKECHAIN-only settlement-epoch-blocks override (SHEKYL_SETTLEMENT_EPOCH_BLOCKS, read once and armed explicitly: an unarmed process — every wallet, every public-net daemon — runs the genesis schedule no matter what the environment says, and the wallet warns once when it ignores a set lever), so the regtest e2e reaches an epoch close in minutes instead of hours. The daemon arms only on FAKECHAIN at Blockchain::init, refusing on the lever's presence on public nets and on an invalid value (loud, never a silent clamp-to-genesis), and pins the effective schedule into the fakechain datadir (LMDB properties) so a reopen under a different schedule than its epoch-derived rows were written with refuses with the remedy named. FFI exposes the effective value, overridden flag, presence, and the arming entry point.
  • rpc: a FAKECHAIN-only serve-credit-bit injection RPC (inject_archival_serve_credit, WS-1 bits-only form over the production writer set_archival_serve_credit_bit) — Gate-6's regtest stand-in; CORE_RPC_VERSION → 3.19. The poke is deliberately not pop-symmetric; the e2e's pop leg is bounded above the injection height.
  • wallet: LocalNodeRpc, the local-posture PersonaIsolatedTransport (fail-closed loopback pin via IpAddr::is_loopback + localhost; in-URL credentials rejected — authority-scoped — without leaking them) — the DQ-T2.3 choice site's local arm. SimpleRequestRpc's credential parse is likewise scoped to the URL authority (a whole-URL @ split misparsed path/query content as credentials).
  • wallet: the SweptFeeInputs/ClaimOperands designation-event witness (PR-3's named forward item, landed with the seam as scoped): DesignatedBacking::fee_sweep is the sole mint of a sealed fee selection carrying the designation's anchor and exclusion, with_paths zips membership paths into sealed ClaimOperands, and the handler's two step-2 runtime refusals (StaleClaimAnchor, BackingInFeeSet) are deleted — cross-pairing is now unrepresentable, refusals moved to mint time (ClaimFundingError), all three KAT'd at the mint.
  • wallet: the CB-3 dispatch seam (engine/claim_dispatch.rs): submit_emission_claim — claimant id from the actor's read-only PersonaIdentityOf projection (no activation: a claim is read-and-sign, never a rotation) → orchestrate → persist-before-dispatch (a sealed PendingEmissionClaim, pending-post block v4, carries the bytes, the fee-gindex reservation feeding the shared reserved_gindexes union, and the claimed epochs; one live claim per persona is the in-flight epoch dedup) → submit through the audited posture→BroadcastSubmitter::local choke point (scheduling stays external, the GF-4 seam; claim retirement/resubmit = the WI-3- sibling claim driver slice); tripwire test pins the pipeline route, the choke point, and the seal-before-send ordering.
  • tests: the staker regtest harness (regtest_e2e.rs): staker wallet lifecycle against a live shekyld --regtest, persona funding over a production FCMP++ transfer, P-scan discovery, live-estimate fee sizing, production bond assembly (with not-yet-spendable retry), and dispatch — asserting the daemon's exact Phase-C refusal (RejectedTerminal { Malformed }) as a tripwire that fails loudly and promotes to accepted-and-applied when PR-4b lands the battery. (The live FeeTooLow drawn en route disproved phase_a.rs's stale "bond posts can't clear Phase A" docs — flagged to PR-4b.)

Fixed

• wallet: payments encapsulated to montgomery(view_pk), not raw Edwards bytes (PR-4a, harness-surfaced). sign_tx passed the recipient's Edwards view key straight into the output builder's X25519 KEM-encapsulation slot, so every cross-wallet payment produced outputs the recipient's scanner could never recover (funds visible only to the sender's change path). The view key is now converted via ed25519_pk_to_x25519_pk at the single build site; KAT'd end-to-end (decoded-address payment recovered by the recipient's GuaranteedScanner).
• wallet: P-scan exhaustiveness gate fetches full tx bodies (PR-4a, harness-surfaced). The SP-6 exhaustiveness check recomputes each body's committed hash from received material, but the block source fetched pruned bodies — a storage-pruned FCMP++ spend hashes with the null prunable component, so the scan wedged permanently (BodyMismatch) at the first spend-bearing block. TxBodyForm::{Pruned,Full} now parameterizes the fetch (block_fetch.rs), the P-scan block sources request full bodies, and parse_full_tx rejects prunable-stripped spends — naming the storage-pruned-daemon cause and its remedy (run an unpruned node) when the split body is exactly a canonical pruned spend, since that is a supported daemon mode and not corruption; the bandwidth-cheap pruned option over Tor is a rejected-with-reopening FOLLOWUPS item (V3.2).

Added

• wallet: emission claim handler + Engine-side orchestrator — claim-builder PR 3 (EMISSION_CLAIM_BUILDER.md §8 PR 3; REWARD_EMISSION_VIN_PLAN.md §8.0.2/§8.0.3). The builder half of the E4 gate is complete: the production path assembles a signed txin_archival_reward_emission transaction end-to-end. Six commits:

  • wire: the emission input arm (dense tag 0x04, opaque canonical_bytes) — closing the latent break where a wallet scanning a chain containing any emission claim failed to parse the block.
  • pscan: the EmissionReward scan arm (GF-4b item 2) — own emission vins classify their vouts' lineage, so first-emission backing change lands as BondPostChange instead of stranding in rung 3.
  • engine: the designated-backing selector (GF-4b §5 item 1): BackingSet::from_spendable (spendability + lineage filters, survivor tripwire) → designate_backing (most-recent-eligible, reproducible from chain state) → DesignatedBacking, whose private record and fee_sweep-owned Q11 exclusion make backing-as-fee-input unrepresentable through the claim path.
  • engine: the AssembleEmissionClaim handler (CB-2 AssembleBond sibling): derive + assemble via the PR-2 module, F-C1c assembly order (fee inputs + vouts + extra → signable hash over the vin-less prefix → membership proof (prove_backing_membership, spawn_blocking) → dual auths from the derived bundle (Auth-B backing key, Auth-P identity hybrid key; CB-2: no master-seed re-borrow) → full prefix hash → fee-side FCMP++ proof + tx PQC auths), with the daemon-side differential KAT re-deriving the whole verify chain over the produced bytes.
  • engine: the claim orchestrator (engine/claim_orchestrator.rs): fetch → reference-height anchoring (daemon's two-sided age gate reconciled with REF_ANCHOR_AGE) → provable-record filter → designate → fee sweep → membership-path assembly → handler dispatch; the reply returns unbroadcast (CB-3: dispatch is the GF-4 seam). End-to-end integration test over a real 30k-block CurveTreeClient, a canned RPC transport, and the real actor, with daemon-side re-derivation against the real tree root.
  • cleanup: every PR-1/PR-2 staging allow whose named consumer was PR-3 is deleted; skip diagnostics now log locally (their stated purpose); the one remaining claim-surface allow is the orchestrator
    • its reply's fields, staged narrowly against the CB-3 dispatch seam. FOLLOWUPS: the reward→identity structural-binding forward-dep discharged (the vin binds identity via the hybrid pubkey chain, never the deleted ed25519/spend-key equality); the AtomicUnits::mul_div_rem deferral re-evaluated on its named shape (criterion not met — the rebased arithmetic is u64 consensus surface; re-anchored V3.1). PR 4 (regtest e2e + the Q11 blob-boundary arm, both named in the §8 PR-4 scope row) is the chain's only open item, gated on #281.

• wallet: WI-2 Engine-side assemble_bond_post orchestrator. Wires §3.3 steps 1–6 over an independently constructed PendingPostStore (F-1), named daemon_claimed_tip for anchor_t0 (F-2), and the existing curve-tree anchoring procedure for ReferenceBlock (F-6). Domain-newtype carrier: PFundingOutputRecord / sweep amounts / funding_gindexes → PSlot / TxHash / GlobalOutputIndex / AtomicUnits; PSCAN_STATE_VERSION 6 + PENDING_POST_VERSION 3 (pre-genesis fail-closed). Go-live remains compile-blocked on SpentRecordsDurablyPruned until 2d-1 / SP-R0; dead_code allows on the assemble surface retire only when SP-R0 and RPC entry land. (feat/wi2-bond-orchestrator)

• sim: leg-(b) wall-clock sweep-phase arm graded in-model (ARCHIVAL_BOND_WI4_MEASUREMENT.md §19; WI-3 §3.2 part 3; WI-4 reconvergence leg (b)). The §13.3 closing requirement — sub-block wall-clock emission + re-grade of the channel the dispersal draw exists to defend, which no block-resolution re-run can see — landed in its harness-timestamp form: spec + a-priori bound (r = P(link)·(N−1) < 2, sibling identification) committed in the doc one commit ahead of the grading code (§3.5 ordering), then wallclock_leg.rs models the wallet cadence phase (T = 60 s, mirror of DEFAULT_PSCAN_CADENCE) with the live driver's bounded_uniform(bound_ms − 1) dispersal shape and grades a circular-phase observer. Measured (1 000 trials/row): production dispersal U[0,T) at r ∈ [0.84, 1.32] across m ∈ {1,4,12,52} and N ∈ {10,20,50} — PROVISIONAL-PASS; the sub-T cliff is steep (T/4 fails at every m, T/2 from m = 4), so the production range is load-bearing, not slack; 2T confirms over-dispersal is a no-op. Controls bite (phase-lock caught at P = 1.000; severed-wallet coupling tripwire at chance) and the §19.5 observer-strength tripwire is armed (T/2, m = 52 correctly fails at r = 5.82). The leg's verdict joins the --gf7-timeline criterion-9.9 computed conjunction — an invalid leg grades the whole run INVALID. The finer-hook alternative was rejected (hooks §3 wall-clock payload ban stays intact) with a §19.1 reopening criterion; leg (b) closes only at the §19.1 sealing form (receipt-timestamped live-driver re-run), the named open carrier in FOLLOWUPS.md.

• sim: §14.4 partition-adversary arm implemented in shekyl-staking-sim (ARCHIVAL_BOND_WI4_MEASUREMENT.md §14.4; WI-4/GF-7). Co-first deliverables landed before any grading run per the R4/R5 binding ordering: the gating lemma (a-priori absolute i.i.d. founder-clustering bound M·((c+1)/(W+1))^{M−1} = 3.5393e-5 at M=5, c=30, W=600, exact-CDF domination test, no user-cohort reliance) and compile-time witness-typed controls (ControlWitness is a distinct type with no constructor or conversion path from the production founder-config surface — the five marked controls are un-constructible from production constructors at the type level, §17.7 finding 4). New partition_adversary.rs: named feature dictionary (11 posture-conditioned observables per pair), family members 1–7 (k-swept clustering, per-feature outlier, most-cohesive subset, spectral partition, seeded nearest-neighbor expansion, joint-density isolation, most-regular-subset repulsion detector), max-statistic T with Jaccard label agreement, permutation-calibrated null, and the five marked controls M-a…M-e. The first graded run surfaced a bound-2 under-specification on the single-member-targeted controls (M-b/M-d), initially pinned; review escalated it to a detector-architecture finding — the T-site fact verified at source shows the family-max null re-maximizes per relabeling (≈ 0.66 at N=10), rendering lone member-6/7 (Q2-A/Q2-B) signals structurally invisible and a T-only bound 1 potentially false-clean. Resolution (§14.4 UPDATE block): an any-member arm — per member vs its own null-of-the-mean, exact rank p-value, Bonferroni α/7 at a-priori α = 0.05, with a perms resolution guard and trials = 500 power-sized a-priori to the M-b hypergeometric effect ceiling. Deployed bound 1 requires both arms (family-max at chance and no member flags); whole-set controls retain family-max +0.30 plus the aimed-member flag; single-member controls grade on the aimed-member flag. Re-graded at N=10 (500 trials × 200 permutations): deployed clean on both arms, all five controls bite their aimed member — PARTITION-PASS, no pins remaining. New riders.rs (same round): §16.7 N-sweep (r < 2 holds at every N ∈ {10, 20, 50}), M6.2 coupling control (blind arm at window 0 must stay ≥ 2/N; measured 0.231 ≥ 0.200), attribute-stratified bridge grading (holdings→period coupling: deployed at null 0.110 vs 0.115, positive control bites at 0.985), and the lifetime-accumulation sweep (1 − (1−p)^events at the 52-event long-lived-founder anchor). Trackers updated (FOLLOWUPS.md WI-4 entry, IMPLEMENTATION_INDEX.md WI-4 row, §14.4 status lines).

• docs: WI-4/GF-7 review-closure ratified — distinct-position round R4 lands §17.6 (ARCHIVAL_BOND_WI4_MEASUREMENT.md). The §16.10 questions 2 (partition-family completeness) and 3 (K_COVER cycle break) adjudicated by the standing review: six constructions (four landed, two failed, no bound moves), six premise-strengthening findings. §14.4 family grows to seven members (joint-density isolation; most-regular-subset repulsion detector) and five witness-typed controls (M-d correlation-breaking, M-e repulsed/scheduled); a named a-priori gating lemma (absolute i.i.d. founder-clustering bound, no user-cohort reliance) becomes the implementation round's first deliverable. P2 reworded (statistical staggering only) with three companion premises (timing-law K-invariance, count K-independence, founder-bond persistence — lifecycle-verified: offline forfeiture and slashing are involuntary removal paths; the persistence premise is withdrawn at R7, below). §16.2 obligation 3: strip row elevated to primary at gate-open (worst-case zero-pre-gate-cover floor, P3 de-load-borne); cohort-dynamics row rests on the monotone floor with named non-existence behavior. Axis completeness recorded (timing ∪ loud-but-constant amount ∪ SP-T isolation; founder-tier residual named). §§17.1–17.6 ratified together (2026-07-10); §§14–16 closed; the §14.4 implementation round is released. Trackers updated (FOLLOWUPS.md WI-4 entry, IMPLEMENTATION_INDEX.md WI-4 row). Round R5 (§17.7, same day) adjudicated the R4 landing itself under the §17.6-head lens (structural, generator-invisible channels): tier residual promoted to a named channel with per-channel strip floor (bond_floor satisfiability verified at source — shard-descriptor choice, never treasury wealth); monotone floor recorded snapshot-by-construction (gate reads frozen_shard_count only) with an a-priori induced-forfeiture thinning margin required; premise-2 OR struck (fixed pre-gate schedule only at gate-open); control witness type a compile-time co-first-deliverable. Round R6 (§17.8, same day) adjudicated the R5 landing and closed §17: the R5 thinning margin was sized for the transient (restoration-lag) window while the cumulative-trigger/live-property divergence is permanent — verified at source that frozen_segment_count has no bond-exit decrement path (segment_freeze.rs), the derive-don't-cache exception recorded as deliberate (a live-cover sensor is the M2 flood-then-withdraw DoS surface), P2's persistence commitment reshaped to a maintenance commitment (replace attrited personas within a named lag), the margin re-derived against the detection-plus-replacement window, and maintenance breach named as the irreducible post-genesis residual. Thickness-reachability now runs against the union of per-channel floors with a profile-commonality check on the descriptor channel (fingerprint-not-zero-cover routes to redesign, never larger K); "fixed pre-gate schedule" pinned to {count, completion-before-gate} only (a schedule-fixes-times reading would manufacture member 7's repulsion signature). Round R7 (§17.9, 2026-07-11) reopened R6's landing and re-closed §17 load-bearing: the maintenance commitment was a ratified founder-differential mechanism produced by a category error — "founder" carried two referents, the anonymous founder-user population and the consensus-mechanized Foundation backstop (reward-invisible, Market-excluded; verified at source) — resolved by a §14-head terminology pin (three referents, three tokens; operator usages scrubbed). The commitment is withdrawn on two independent grounds (categorical: founders are users and owe no continuity; anti-masking: the obligation's coupling is masked only by population flow, thinnest exactly when the floor is load-bearing). A claimed exit-correlated-posting channel was refuted at source (epoch-quantized entry, RELEASE_COOLDOWN_EPOCHS = 2 decorrelation headroom, no repost mechanism) and withdrawn. Finding 1 re-homed to population-level churn calibration: the §16.2 margin derives against adversarial max net attrition over the full pre-gate window (never expected churn); Q3-B re-seated on the same statistical basis. Final Gate-7 gates are §17.9's (adversarial-max-attrition margin; per-channel reachability); §17 reopens only against the termination bar — a construction defeating both the categorical rule and the substrate's decorrelation.

• daemon RPC: Axum now enforces --rpc-max-connections* + reports a live rpc_connections_count. A purpose-built Rust connection layer (shekyl-daemon-rpc::conn_limit: LimitedListener + ConnTracker over axum::serve's Listener) admits each inbound connection against the total and per-IP caps (--rpc-max-connections = 100, --rpc-max-connections-per-public-ip = 3, --rpc-max-connections-per-private-ip = 25 by default; 0 = unlimited), closing connections over a cap; slots release on connection close. The same tracker's live total is injected into get_info.rpc_connections_count (REST and json_rpc, unrestricted only), replacing the hardcoded 0. Caps flow from core_rpc_server::init (still parsed/cross-validated in C++) through the shekyl_daemon_rpc_start FFI. This lands the two connection-management items the epee-listener deletion deferred; see DAEMON_RPC_RUST.md.

Removed

• daemon RPC: epee HTTP listener + --no-rust-rpc deleted (Phase 1 transport cutover; DAEMON_RPC_RUST.md). Axum is the sole daemon HTTP transport. core_rpc_server no longer inherits epee::http_server_impl_base; MAP dispatch macros are gone (FFI tables only). shekyld does not register inbound --rpc-login / --rpc-ssl* (unrepresentable; wallet-RPC keeps the full set). CORS default-deny; --rpc-access-control-origins honored when set. Dead decoy surface removed: get_output_distribution (+ .bin), wallet2::get_rct_distribution, and wallet_errors.h::get_output_distribution. Deleted tests/rpc_comparison/compare_rpc.sh. Opportunistic RPC SSL key autogen on the daemon path is gone with the epee listener. (Connection-limit CLI args were inert in this Phase 1 cut; they are now enforced by Axum — see the Added entry above.)

• consensus: pre-activation staker-inflow burn leg deleted (rule 60; ARCHIVAL_BUDGET_SCHEDULE.md §2.1 retirement, REWARD_EMISSION_E3_GATING_ROUND.md §9.9 landed entry). The connect-site redirect's else branch — destroy staker_inflow when the connecting block's version predates archival emission — was unreachable by construction: emission is a genesis fact (HF_VERSION_ARCHIVAL_EMISSION == 1, block-version floor 1, versions never decrease), and the leg's lineage is the scrapped direct-distribution model's conditional no-staker burn (cebbe017b), carried forward as a placeholder (PR-4) and then version-gated (C-1 block 1) without ever becoming reachable. Deleted with it:

  • HF_VERSION_ARCHIVAL_EMISSION (cryptonote_config.h) — both live reads were tautologies at version floor 1. The redirect gate is gone (blockchain.cpp now accrues unconditionally per non-genesis block, same operands: verify's base_reward, bl.major_version into the split/fee-burn); the raw-import guard (blockchain_import.cpp) now refuses all non-genesis blocks unconditionally, since every block carries emission-era bookkeeping raw import cannot reproduce.
  • The conservation KAT's burn-leg expectations and static_assert(HF_VERSION_ARCHIVAL_EMISSION <= k_post_fork_version) (tests/core_tests/archival_budget_conservation.{h,cpp}) — expectations now unconditional (whole inflow in the accrual row, zero burn row in the fee-free fixture); the labeled-row form stays as the guard against inflow mis-routed into the burn row, and the v1→v2 fork table stays because major_version remains a live split/fee-burn operand and pop/reconnect replays the boundary.
  • The unit-level straddle framing: archival_substrate_lmdb.cpp KATs reframed as budget_burn_accrual_partition_and_conservation (fee-burn rows and accrual rows coexisting at one height; close sums only the accrual side) and budget_reorg_pop_symmetry (pop symmetry for both tables) — the storage properties they pin survive the leg.
  • CI tripwire (scripts/ci/check_archival_reward_gates.sh) re-anchored from the redirect block to the accrual block, same banned symbols (get_block_reward, get_current_version, get_ideal_version() — F-B1b's version-operand discipline outlives the branch it originally selected; arming re-verified. A future post-genesis activation-gated inflow change re-derives the redirect discipline from §2.1's historical record rather than resurrecting the code.

Added

• docs: epee HTTP listener recorded as deletion-scheduled; DAEMON_RPC_RUST.md brought current (2026-07-09). A liveness check during claim-builder PR 1 (the dual-dispatch-map registration question) confirmed the epee HTTP listener no longer binds in a default daemon: Axum owns the standard RPC port, a failed Axum bind is fatal, and the epee acceptor binds only under the transitional --no-rust-rpc flag. docs/DAEMON_RPC_RUST.md corrected accordingly (single-listener architecture and port table replace the stale dual-server +10000 mode; the curve-tree-endpoints-404 section updated to reflect the PR #174 resolution; dispatcher counts refreshed; the validation-results section marked historical). The listener, the flag, the epee dispatch macros in core_rpc_server.h, and the dual-server comparison harness are now a named deletion target — docs/FOLLOWUPS.md "epee HTTP listener + --no-rust-rpc: delete", target V3.0, with the outstanding wallet-sync-over-Axum check folded in as the deletion PR's verification gate (transport only; epee KV serialization and Levin P2P remain separate migration phases).

• wallet: emission claim assembly module — claim-builder PR 2 (EMISSION_CLAIM_BUILDER.md §2 steps 1/2/5/7, §8 PR 2). New pure module shekyl-engine-core/src/engine/emission_claim.rs: everything between the decoded claim source and the signed transaction that is deterministic given the source — KAT-able with a fixture EmissionEpochSource, no live daemon, no actor harness. derive_claimable_epochs consumes five boundaries and never re-derives boundary arithmetic: top/expiry/dedup through the read-only predicates (epoch_is_not_settled — extracted in this PR's review round, retiring an interim scratch-clone-oracle disposition and discharging its V3.1 FOLLOWUPS item on the named trigger — plus the existing epoch_is_claim_expired / claimed_epochs_contains; the connect mutator resolves through the same predicates, pinned by a differential test), join via the newly extracted epoch_is_before_join (verify step 2's E ≥ E_join + 1 against the record's join epoch — a review finding: without it a retire-then-rejoin record wedged the whole batch behind the cause-blind SelfCheckFailed), and strict finalization via verify's own epoch_close_height predicate (a window epoch with no close height at all is refused SourceInvalid — it can never finalize). The share recompute is the shared steps-4/5 evaluation head claimant_reward_share, called by the verify body and the derivation alike (never a mirrored copy). The finalization boundary is a review finding: an earlier revision claimed the missing-close-row skip foreclosed the edge — disproved at daemon source (the close of E runs while connecting E's last block, blockchain_db.cpp add_block; gather height and settled come from one db.height() read, archival_claim_source.cpp), so at chain_height == h_close(E) the connect window admits E while verify rejects it next-block — a once-per-epoch spurious-refusal window, closed by deferring one count (EpochSkip::NotFinalized, premise-asserted boundary KAT). Claimable ⇔ recomputed share > 0 through the verify-exact chain (discharges the M1 round-1 forward obligation; no K_COVER read anywhere in the module; zero-share skip cause-blind by construction). Assembly emits the canonical minimal rows (credited shards only, ascending, serve_credit_bit = true), with the u64→u32 scarcity conversion armed at the builder's site (compile-time const-assert as the production guarantee, checked try_from refusal + hostile-fixture KAT as non-production defense) and the entry-sum-vs-work_P hard check; sizing measures the claims leg with the production encoder at structural maxima — on the one vin the assembly's content is returned from (claims_vin, the single construction site) — against the binding per-tx relay bound, the new shekyl_wire::TX_WEIGHT_LIMIT (149 400 B, pinning the C++ get_transaction_weight_limit; a review finding re-based this off MAX_TX_SIZE, the non-binding 1 MB parse cap, which could pass a permanently-unsubmittable batch) minus a re-derived 48 KiB non-claims reserve, dropping youngest-first (bound-or-split, GF-4b §5 item 5) and refusing when one epoch cannot fit. The PR-1 decode now also enforces the settled/height invariant (current_settled_epoch == settlement_epoch_at_height(chain_height), a Malformed refusal otherwise), so the derivation's window boundaries and the self-check's recomputed boundaries provably share one basis. The step-7 self-check (self_check_claims) drives the literal emission_vin_verify_claims on the assembled rows before any signing — a builder/verifier disagreement surfaces loudly at build time as SelfCheckFailed, cause-blind per the CB-5 builder pin (unit variant; verify detail log-local only), with a differential KAT proving each of six vin mutations and three context arms flips accept → refuse. CB-5 refusal taxonomy landed minus InsufficientBacking (PR 3, with its constructor). Rides along: the dead shekyl_engine_core::error::EngineCoreError module deleted (separate commit; FOLLOWUPS item closed — zero live consumers re-verified against the live tree).

• rpc: emission claim-source query — claim-builder PR 1 (EMISSION_CLAIM_BUILDER.md §7 / §8 PR 1). New daemon JSON-RPC get_archival_emission_claim_source (both transports; RPC minor bumped 17→18): request carries p_id only, response carries the part-A claim context (bond record as get_archival_bond_value returns it) plus one as-of-E snapshot per epoch in [claim_window_floor(settled), settled − 1], unconditionally. The marshal helper (src/rpc/archival_claim_source.cpp) is a serializer over the single landed gather in its windowed form (gather_archival_emission_window_snapshots — same one row-selection routine, all window epochs in ONE serve-credit table pass, so the unauthenticated endpoint costs one scan per request instead of 26) under one db_rtxn_guard read view; the window's low end resolves through a new thin FFI delegate shekyl_archival_claim_window_floor (the one landed boundary definition, per §2 step 1's consumption-not-re-derivation pin). The archival LMDB read helpers dropped their bare if (m_write_txn) fast path for the thread-aware block_rtxn_start selection — the RPC (the first cross-thread caller) can no longer touch the writer thread's live write txn. Wallet-side decode (shekyl-engine-core/src/engine/emission_source.rs) produces the verify-side EmissionEpochSource/ClaimantBondRecord views via the new single-sourced EpochCloseInputs::verify_view constructor (also adopted by both verify FFI shims — the construction previously existed as three hand-aligned struct literals), and enforces the untrusted-daemon decode contract loudly: status == "OK" required (a BUSY body must not decode as "nothing claimable"), claimed_settlement_epochs strictly increasing (the binary-search operand), window epochs strictly ascending. Tests pin the two round-2 watch items mechanically: LMDB operand fidelity against a direct gather (§7.1 single-gather trace, now also proving windowed ≡ per-epoch gather), identical window shape for bonded and bond-less claimants + request-member-count == 1 (§7.2 transport cause-blindness), plus epee wire round-trip, the SIZE_MAX→u64::MAX no-credit sentinel, and the omit-empty-container behavior the Rust decode's absent-equals-empty rule relies on (tests/unit_tests/archival_claim_source_rpc.cpp — fixture single-sourced with the substrate emission KAT via the new archival_lmdb_test_helpers.h; Rust decode unit tests in-module).

• docs: emission claim-builder design round 2 opened and CLOSED (2026-07-09, docs/design/EMISSION_CLAIM_BUILDER.md §7–§8). The CB-1 ratification residue: the daemon RPC surface + the implementation PR chain. Ratified: §7.1 single-gather pin — the RPC serializes the landed gather_archival_emission_epoch_snapshot, recorded as CB-1(b) itself, daemon-side face (one invariant, two faces: wallet doesn't re-derive, RPC doesn't re-gather; weakening either reopens CB-1); §7.2 one composite window-batched query (request = p_id only — the query cannot encode the claimable subset; CB-5 cause-blindness at the transport); §7.3 field enumeration with four load-bearing exclusions, the k_cover/frozen_shard_count exclusion recorded as CB-5-structural (sending the gate operands would make representable the cause-distinguishing branch CB-5 makes unrepresentable), not payload-minimization; §7.4 gate-6 review (persona transport pin, query timing routed into CB-3's GF-4 joint grade). §2 step 1's claimable range corrected against the rejection predicates: top strict (E ≥ settled rejects NotSettled — a round-1 off-by-one against source), bottom verified clean-for-a-structural-reason (epoch_is_claim_expired is single-sourced through claim_window_floor) and pinned to predicate-function consumption, never inline boundary arithmetic. §8 four-PR chain endorsed (daemon RPC → pure assembly → StakeEngine handler → regtest e2e + blob-boundary arm, PR 4 gated on #281's harness), with two grep-checkable PR-1 watch items named at closure.

• wallet-rpc: Phase 4b send lifecycle (build_pending_tx, submit_pending_tx, discard_pending_tx). Async Engine methods; SendError / SubmitError / PendingTxError map to -29100..-29107. Discard is idempotent. rescan_blockchain remains -32601 (FOLLOWUPS). Phase 4b SPECIFIED methods complete except rescan.

• wallet-rpc: Phase 4b refresh (refresh). Calls Engine::refresh with default RefreshOptions; maps RefreshError::AlreadyRunning → -29200 and daemon/scanner IO → -29201. rescan_blockchain stays -32601 until Engine grows an explicit rescan API (docs/FOLLOWUPS.md).

• wallet-rpc: Phase 4b read queries (get_balance, get_primary_address, get_transfers, get_transfer_by_id, get_height). Typed OpenAPI result structs + ledger projections (no secrets on the wire). Empty-wallet balance is zeros; unknown transfer id → -29400; daemon height failure → -29201.

• wallet-rpc: Phase 4b lifecycle slice 1 (WALLET_REWRITE_PLAN.md Phase 4b; docs/api/wallet_rpc.yaml). create_wallet, open_wallet, close_wallet, and change_password on rust/shekyl-wallet-rpc, Engine-backed (Engine::<SoloSigner>). Tenant holds the open Engine; CLI gains --daemon-address and --network. Create returns one-shot backup material (mnemonic on mainnet/stagenet; raw_seed_hex on testnet). Error mapping covers -29000..-29005. Remaining SPECIFIED methods still return -32601 until later 4b slices.

• tests: end-to-end archival budget conservation KAT — the C-1 fast-follow (REWARD_EMISSION_E3_GATING_ROUND.md §9.9; ARCHIVAL_BUDGET_SCHEDULE.md §7 B1's connect-path counterpart). New chaingen core test archival_budget_conservation_boundary (tests/core_tests/archival_budget_conservation.{h,cpp}) drives the real connect path (handle_block_to_main_chain) across a v1→v2 fork table and asserts the §2.2 conservation identity per block in labeled-row form: accrual row and burn row each checked against the block's own major_version — the only form that catches the branch-selection class (F-B1b: wrong burn-vs-accrue branch with byte-identical operands, invisible to operand KATs and the grep tripwire, and sum-invariant because the redirect is a pure destination switch). Also asserts the genesis exclusion, coinbase = miner_emission, ledger advance = an independently recomputed modulated subsidy, and byte-identical row restoration after pop/reconnect across the fork boundary. Arming-verified (inverted redirect branch fails at height 1). Wired into CI as the conservation subcommand of run_economics_c2a_prime.sh with its own workflow matrix entry; the workflow's paths filter covers the KAT's full guarded surface (src/blockchain_db/**, src/shekyl/**, src/cryptonote_config.h). Genesis-posture caveat recorded in the test header: HF_VERSION_ARCHIVAL_EMISSION == 1 leaves the burn leg compile-alive but unexercised; a post-genesis activation bump to the fixture's top fork version (2) arms it through the same fixture with no test change, and a static_assert forces a fork-table extension for bumps past that (no silent de-arming). Fee-leg caveat (disclosed in the test header): the fee-free fixture exercises only the emission half of staker_inflow end-to-end — the fee-pool half (staker_pool_amount) rides the E4/E5 regtest-e2e residue (chaingen cannot build valid FCMP++ fee txs), guarded meanwhile by the unit-level B5 KATs and the F-B1c-c1 operand pin. Review hardening (same branch): the block-injection helper, independent subsidy recompute, and chain-extension scaffold are single-sourced in tests/core_tests/economics_chain_helpers.h (shared with the Layer 3 harness), the helper now cleans up the incoming-blocks batch on the failure path and requires main-chain placement for success, and the fail-closed core_tests CI gate is one parameterized function. Closes the FOLLOWUPS V3.0 conservation-KAT item (fee-leg residue carried as above).

• docs: emission claim-builder design round 1 opened (docs/design/EMISSION_CLAIM_BUILDER.md). The E4-gate part-1 work unit after C-1 (#277) landed: the wallet-side builder that assembles authed txin_archival_reward_emission transactions — the piece the Track-2 regtest e2e (E4-gate part 2) is blocked on. Spec: seven-step assembly over landed substrate only (verifier-exact positive-share recompute for claimable-epoch derivation; backing exclusively through BackingSet at arity 1 per GF-4b §5; prove_membership_only; the shared auth_msgs builder + dual hybrid sign; build-time self-check against the landed verify functions), the GF-4b §5 / M1 inherited-obligation discharge table, and round-1 questions CB-1…CB-5 with CB-1 (archival-state recompute sourcing: new daemon RPC vs wallet-side re-derivation vs regtest shortcut — recommended (a), the RPC shaped as EmissionEpochSource) as the gating decision. IMPLEMENTATION_INDEX.md registers the CB- family and refreshes the stale #263/#264/#277 "in review" rows to landed with code-anchored verification stamps. Round 1 CLOSED (2026-07-09) — Round-1 dispositions + CB-4 tripwire strengthening: CB-1…CB-5 all ratified at source with two builder-PR pins (sign within StakeEngine's seed-gone-after-assemble() discipline; SelfCheckFailed refuses cause-blind) and CB-3's joint-grading reopen (GF-4 grades cadence + amount + holdings stratum jointly). The CB-4 source pass found the Q11 balance-exclusion arming KAT (tests/unit_tests/archival_emission_ct_balance.cpp) was necessary-not-sufficient: the exclusion is enforced by a structural three-leg guard (backing in the vin's opaque canonical_bytes never deserialized into pseudoOuts; dispatch + leaf size checks at tx_verification_utils.cpp:175 + rctSigs.cpp:362), and CB-4 ratifies on that guard — not on the KAT. Fixed in this PR (cheap, in-surface, known-wrong): arm 1 strengthened to derive operands through the production functions the dispatch uses (classify_archival_tx + shekyl_checked_sum_amounts, replacing a test-local mirror), arming the guard's operand + leaf legs; the E3 §2.2 rationale corrected (its claimed identity-catch was green-by-construction — the backing never reaches verCtSemanticsEmission); and a general test-doc discipline pinned in 50-testing.mdc ("Test rationales state their coverage boundary"). The remaining blob-boundary invariant arm (drive the full dispatch, assert CT-balance verdict invariant under canonical_bytes variation) is harness-gated and homed to the claim-builder PR where the valid-proof emission-tx harness is born (FOLLOWUPS.md) — tripwire-completeness, not a consensus change.

Fixed

• wire: Transaction::validate() pins the Bp+ |L|/|R| round count by the output count (consensus-parity gap, docs/FOLLOWUPS.md flagged 2026-06-24). A tx with a valid output count but an inconsistent/oversize Bp+ |L| parsed and passed local validate() while the C++ daemon rejects it — a local↔daemon divergence surfacing at submit. Mirroring the C++ split: BpPlus::read now rejects |L| ∉ 6..=MAX_BP_LR_LEN and |R| != |L| (the deserialization-time n_bulletproof_plus_max_amounts rejects), and validate() enforces |L| == |R| == 6 + ceil(log2(next_pow2(n_out))) exactly (parse-time n_padded >= n_out + verify-time V/L tightness, V restored from outPk). weight()'s overflow clamp stays for hand-built, not-yet-validated txs.

• consensus: C-1 emission review hardening (PR #277 review, REWARD_EMISSION_E3_GATING_ROUND.md §9.5). Batch of correctness/robustness fixes from the high-effort review of the reward-emission activating cut:

  • Raw unverified import fails closed on emission-active blocks. The --dangerous-unverified-import path called add_block with archival_budget_accrual = 0, so the epoch close froze a present-and-zero (structurally non-claimable) budget(E) for every epoch — an import-synced node would then reject live emission txs the network accepts (a silent consensus split, not the bookkeeping parity the old comment claimed). Since emission is active from genesis, raw import cannot produce the accrual (verify's base_reward + fee summary) without re-deriving the operands the connect path deliberately single-sources (F-B1b); it now aborts on any non-genesis block with a message pointing to verifying import. Whether the fast unverified path is worth re-deriving the split for is a testnet-stress-test question.
  • Zero-plaintext-vout ban gated on the full emission classification. check_tx_outputs skipped the v3 zero-amount-vout ban on a bare emission_vins == 1 count, which also exempted a malformed tx pairing an emission vin with a bond-post; it now uses the same strict classification as check_tx_inputs.
  • Archival tx-kind predicate single-sourced. The bond-post/emission/serve-credit taxonomy was open-coded in check_tx_inputs, check_tx_outputs, and ver_non_input_consensus; it now lives once in classify_archival_tx (cryptonote_basic.h), so the three consensus sites cannot drift on what a tx is.
  • Emission-vout storage predicate single-sourced. The store (add_transaction) and remove (remove_tx_outputs) sides of the amount-0 emission-vout treatment now share tx_has_archival_emission_vin, so a pop cannot disagree with the add.
  • CT-balance tail de-duplicated. verCtSemanticsEmission and verRctSemanticsBondPost shared a near-verbatim flatten + balance-FFI + Bulletproof+ tail; extracted to verArchivalCtBalanceAndRange, called with each path's (credit, debit) operands.
  • Emission reward-sum arithmetic moved to Rust (rule 20). The hand-rolled C++ overflow-checked vout-amount summation (two copies) now routes through shekyl_checked_sum_amounts, single-sourcing the inflation-audit operand across check_tx_inputs and the CT-balance shape check.
  • Emission wire tag named. The bare 0x04 literal at three C++ sites (transport guard, VARIANT_TAG, JSON echo) is now TXIN_ARCHIVAL_REWARD_EMISSION_WIRE_TAG, mirroring Rust's wire tag.
  • Stale dispatch comment corrected: the C-1 emission branch is LIVE from genesis (the whitelist flip landed in this cut), not the "gate-last / unreachable" the old comment claimed. Two review items were assessed as refuted, not deferred: the block-level (P,E) re-parse is load-bearing (the sole parse on the PER_BLOCK_CHECKPOINT fast path, where check_tx_inputs is skipped), and the canonical_bytes container serializer has no pre-allocation DoS (remaining_bytes() < cnt guard + no-op reserve) — changing it would be a rule-42 wire change for a micro-opt. The FFI-surface ergonomics finding (grouping shekyl_emission_vin_verify's 22 positional args into #[repr(C)] structs) is a separate follow-up on its own validation surface.

• consensus: redirect keys on bl.major_version + CI tripwire (F-B1b hardening, REWARD_EMISSION_E3_GATING_ROUND.md §9.9, ARCHIVAL_BUDGET_SCHEDULE.md §2.2). The burn-vs-accrue decision read get_current_version() — correct pre-add_block (verified at source: the previous block's HardFork::add advances to the connecting block's own voted version, and m_hardfork->check(bl) enforces bl.major_version == get_current_version() upstream), but resting on the height+1 advance convention §2.2 pins against, and keyed to a different height notion than the split it gates. Now keys on bl.major_version — the block's own consensus-checked version, explicit and convention-free. New grep tripwire in scripts/ci/check_archival_reward_gates.sh (consensus-invariants gate) fails on get_block_reward / get_current_version / get_ideal_version( inside the redirect block, with positive anchor checks so block moves can't silently retire it; verified armed. The end-to-end conservation KAT (activation-boundary fixture, core-tests harness) is the prioritized fast-follow — docs/FOLLOWUPS.md V3.0.

• consensus: budget emission leg uses verify's modulated base_reward (F-B1c-c2 disposition (a), REWARD_EMISSION_E3_GATING_ROUND.md §9.9, ARCHIVAL_BUDGET_SCHEDULE.md §1). The staker-inflow emission leg derived from the 5-arg get_block_reward (no release multiplier, no weight penalty) while the coinbase and the supply-ledger advance use the 6-arg modulated base_reward. The unmodulated leg predates C-1 and was benignly deflationary as a burn (over-destroying); the C-1 redirect inverted its sign — an over-sized accrual makes the excess re-mintable through emission claims, coins already_generated_coins never counted (an inflation surface, merge-blocker class). Both legs (pre-activation burn, post-activation accrual) now split verify's base_reward itself: conservation by construction (base_reward = coinbase + staker leg), and the redirect becomes a pure destination switch — same quantity, burn-vs-accrue on the block's own version. Genesis computes no inflow (its hardcoded emission is paid whole by the genesis coinbase). Disposition (b) (demand-insulated budget) rejected with a rule-21 sim-gated reopen — see §9.9 and the docs/FOLLOWUPS.md V3.0 item.

• consensus: budget accrual ordering and redirect operands (F-B1a / F-B1b / F-B1c-c1, REWARD_EMISSION_E3_GATING_ROUND.md §9.9, ARCHIVAL_BUDGET_SCHEDULE.md §§1–3). The staker-inflow accrual row was written after m_db->add_block returned — after the epoch-close hook had already range-summed the epoch — so every budget(E) dropped its final block's inflow (F-B1a, per-epoch under-mint and a §2.2 conservation violation). The redirect gate read get_current_version() post-add, the next block's version, flipping the redirect one block early at an activation boundary (F-B1b). And the accrual site called compute_fee_burn with tx_volume = 0, zeroing the fee-pool half of the inflow and the destroyed share's burn record (F-B1c-c1). Structural fix: the computation moved before add_block (block's own validated version; verify's exact get_tx_volume_avg operand), the amount rides into BlockchainDB::add_block as a new archival_budget_accrual parameter written before the connect hooks, and the pop-side removal moved into BlockchainDB::pop_block (same layer, same wtxn). New production-path KAT (budget_epoch_boundary_includes_final_block_through_real_block_path) crosses the epoch-0 boundary through real add_block/pop_block, verified armed against the F-B1a ordering. The emission-quantity operand drift (F-B1c-c2, 5-arg vs 6-arg get_block_reward) was initially parked pending spec adjudication and is resolved by the entry above.

• consensus: emission connect-arm height operands (F-B5a / F-B5b, REWARD_EMISSION_E3_GATING_ROUND.md §9.8). The emission arm in BlockchainDB::add_transaction derived its height via get_block_height(blk_hash) before the block's block_heights row exists, throwing BLOCK_DNE on every block carrying an emission vin (F-B5a) — it now reads height(), the connecting block's index and verify's pin-(b) operand. pop_block passed its post-block chain height (N+1) to the claim-journal revert keyed on the block index N, making the revert a silent no-op that left the claimed-epoch set standing across a pop (F-B5b) — it now reverts at removed_block_height - 1. New real-LMDB KAT (emission_connect_pop_roundtrip_through_real_block_path) drives the shared fixture vin through the real add_block → pop_block machinery and was verified armed against each finding independently; the fixture's claimed epochs moved to {1, 2} to keep the chain build short.

• consensus: bond-post connect arm carried the same latent get_block_height-before-write crash (F-B5a sibling, pre-dating C-1) — same height() fix, so a JoinMarket bond-post vin connects instead of throwing BLOCK_DNE. New real-LMDB KAT (bond_post_connect_pop_roundtrip_through_real_block_path) connects a bond-post through the real add_block path, pins the join epoch to the real connect height, and pops it back off.

Added

• sim: F-B1c-c2 disposition-(b) reopen evidence + closure — swing tolerable, (a) stands permanently (REWARD_EMISSION_E3_GATING_ROUND.md §9.9 reopen-resolution addendum). Two companion sim modes produce the rule-21 reopen evidence the c2 adjudication gated on: shekyl-economics-sim --fb1c-c2 measures the per-epoch budget(E) swing under disposition (a) against the demand-insulated (b) counterfactual across six volume regimes (throttle floors at exactly 0.8× — the release_min clamp, never zero; (b)'s worst-window uplift bounded at 25 % of the emission leg; the gap decays to ~nothing at the fee-era handoff), and shekyl-staking-sim --budget-throttle cross-checks coverage on the L11 budget → APR → entry → coverage transfer curve, 8-seed-averaged, with the emis_frac-weighted effective multiplier (the fee leg is disposition-neutral). No real operating point materially degrades: the deep-throttle regime (mining era, saturated purse) and the coverage-knee regime (fee era, emission leg decayed to ~1 % of budget) are disjoint under the 0.90/yr share decay — the honest counterfactual (full 0.8× on a lean purse, a regime that does not occur) does cross the knee, so the recorded safety is regime separation, not throttle harmlessness. Reopen closed: FOLLOWUPS V3.0 item moved to the audit trail; consequence note updated in ARCHIVAL_BUDGET_SCHEDULE.md §1.

• docs: C-1 review closure recorded — blocks 3 and 5 pass at file:line; IMPLEMENTATION_INDEX.md emission rows updated to code (rule 94). Block 3 (F-C1c signable_tx_hash, §9.6 pin): the emission vin is removed wholesale from a transaction_prefix copy (blockchain.cpp:3889–3894, true structural erase, not a zeroed placeholder), and the arity-1 classification gates the branch ahead of the hash by control flow (:3388–3421 → :3779), with the whitelist's emissions > 1 reject as the second independent layer. Block 5 (WS-2 journal, §6.3): the connect writer journals the full pre-mutation claim state before mutating (db_lmdb.cpp:5748–5757, same write txn — atomic), and the prune-straddle KAT's primary assertion is re-claim rejection after pop + rebuild (archival_substrate_lmdb.cpp:1628–1631), byte-identity the corollary. No findings; the C-1 consensus surface is reviewed end to end. The IMPLEMENTATION_INDEX.md §2 PR-E row and §5 emission-leg row now lead with C-1 IMPLEMENTED — in review (PR #277), blocks 4–6 recorded (previously listed as "still missing"), residue named (wallet-side claim builder + regtest e2e, conservation-KAT fast-follow).

• consensus: Q11 balance-exclusion arming KAT — the ratified reopen trigger (REWARD_EMISSION_E3_GATING_ROUND.md §2.2). New unit KATs (archival_emission_ct_balance.cpp) pin that the emission vin's membership-only backing pseudo-out is structurally excluded from the CT balance: backing_identity_O_vs_O_prime asserts two txs differing only in the backing commitment (backing-on-O vs backing-on-O′) balance bit-identically through the production verCtSemanticsEmission with dispatch-derived operands — catching the coordinated regression where the backing is summed and the pseudoOuts.size() == fee_input_count check is bumped in lockstep (the naive append already trips the size assert). backing_inclusion_shape_rejects_in_production proves the teeth: a fixture balanced only with the backing on the pseudo side rejects in production while the manually-included shape passes the underlying single-sourced balance FFI, so the rejection is the Q11 exclusion working, not an unrelated malformation. Flipping these tests is the §2.2 reopen signal, not a test to update in lockstep.

• economics: C-1 commit-block 6 — KAT B5 fee-bearing coinbase foreclosure; regtest e2e deferral recorded (§9.5 item 8, ARCHIVAL_BUDGET_SCHEDULE.md §7). New unit KATs (economics_b5_fee_coinbase.cpp) drive the production decision site validate_miner_transaction directly (standing IN_UNIT_TESTS seam) with fee-bearing operands recomposed through the same single-evaluator helpers the check calls: exact miner_emission + miner_fee_income accepts (fix-α full-subsidy out-param pinned), coinbase additionally claiming staker_pool_amount or staker_emission rejects, and an underclaim rejects — the §2.2 coinbase-foreclosure pin's "exactly" is two-sided. Closes the fee-side gap the economics_c2a_prime tests leave (fee-free blocks). The connect-path block vehicle defers with the chaingen FCMP++ fee-transaction gap, and the §9.5 item 8 regtest e2e defers on the wallet-side claim builder (no production path can assemble an emission tx yet; a hand-rolled test builder would prove a parallel path) — filed in docs/FOLLOWUPS.md (V3.0 pre-genesis, E4/E5 gate) with the claim-builder landing as the reopening trigger.

• consensus: C-1 commit-block 5 — connect arm: emission-claim single writer + vout storage shape (§9.5 item 7). BlockchainDB::add_transaction gains the txin_archival_reward_emission arm: re-extract (P_canonical_id, settlement_epochs) from the opaque blob through shekyl_archival_emission_vin_extract (the Rust codec is the only parser; an unparseable vin at connect is a hard error, never a soft skip) and hand them to apply_archival_emission_claim — the WS-2 single writer whose §6.3 pre-image journal and height-keyed pop_block revert are already armed, so the pop side needs no vin arm. Vout storage: emission reward vouts share the coinbase shape (plaintext amount in the tx — the loud mint — real Pedersen commitment in outPk, balance already verified by verCtSemanticsEmission), so both store as amount-0 RCT records with the commitment kept, keeping them FCMP++-spendable; add_block's num_rct_outs counts them and remove_tx_outputs keys their removal on amount 0 (connect/pop symmetric). Mint accounting needs no new counter: the staker subsidy entered already_generated_coins at accrual (F-C1a), fee-derived budget is recycled circulation, and unclaimed budget is supply never created. KATs: deterministic connect fixture (emission_connect_kat_v1.json, length-canonical filler — extraction parses structure, no crypto) generated and drift-pinned by emission_connect_kat.rs; C++ side (archival_emission_connect.cpp) proves the arm extracts the fixture's operands and calls the single writer once with the connect height, stores both reward and change vouts amount-0 with their outPk commitments preserved, and hard-errors on a tag-correct garbage blob without reaching the writer.

• consensus: C-1 commit-block 4 — activation cut: whitelist flip, CT semantics, block-level (P,E) Rust-decided pass (§9.5 items 4 + 6 and the item-5 CT cross-checks). check_inputs_types_supported now admits txin_archival_reward_emission under the Q3/Q11 gates — exactly one emission vin per tx, co-residence with key-imaged txin_to_key fee inputs only (no bond-post, no serve-credit mixing); the block-3 dispatch branch becomes live consensus. CT semantics: new rct::verCtSemanticsEmission (fcmp/rctSigs.cpp) verifies the emission balance Σ pseudoOuts + total_reward·H = Σ out commitments + fee·H by reusing the bond-post credit/debit balance FFI with bond_credit = 0, bond_debit = total_reward (the mint enters the equation as a debit-side credit), FCMP++ proof presence keyed to the fee-input count (absent when zero fee inputs), BP+ range proofs over all outputs; ver_non_input_consensus dispatches emission txs to it (overflow-checked plaintext total_reward sum, pqc_auths sized to all inputs). check_tx_outputs exempts the emission tx's non-zero plaintext reward vouts from the v3 zero-amount rule (they are the claim's public mint; change vouts stay CT), and check_inputs_overflow skips the amountless vin. Block-level (P,E) uniqueness (§6.2 third layer, item 6): the decision is Rust — emission_block_claims_unique (claimed_epochs.rs, sort + adjacent-compare over the block's flattened (P_canonical_id, epoch) pairs) via new FFI shekyl_emission_block_claims_unique — C++ in handle_block_to_main_chain only extracts each emission vin's pairs (reusing shekyl_archival_emission_vin_extract) and marshals; a duplicate verdict rejects the block (per-tx layers cannot see cross-tx duplicates pre-connect; without this the second claim double-mints inside one block). Key-image bookkeeping loops in cryptonote_core.cpp skip the key-image-less emission vin. KATs: the block-2 whitelist tripwire flips to admit-at-arity-1, plus two-emission-vins and emission×bond-post / emission×serve-credit mixing rejections (§6.4's dedup KATs), and Rust-side same-(P,E)-duplicate / distinct-pairs / FFI negative-surface tests.

• consensus/ffi: C-1 commit-block 3 — emission verify FFI + dispatch wiring (§9.5 items 3 + 5; gate-last, still dead code). Rust side: the production AuthVerified minter emission_vin_verify_auth (emission_verify.rs) verifies both Q1 hybrid auths — Auth-B under backing_pubkey with the leaf-gate pin (hash_pqc_public_key must equal the committed pqc_pk_hash), Auth-P under P_pubkey — over the domain-separated auth_msgs binding messages; new AuthMalformed/AuthRejected{role} diagnostics. Two FFI entries in archival_ffi.rs (mirrored in shekyl_ffi.h): shekyl_archival_emission_vin_extract (pre-parse: P_canonical_id + claimed epochs, for C++ operand gathering) and shekyl_emission_vin_verify (the full §7.1 body — claims 1–5, membership-only backing 6, hybrid auth 8, auth-before-backing for DoS ordering — one coarse crossing returning verdict + total_reward + epochs_to_commit); shekyl_archival_emission_epoch_snapshot gains budget_atomic. C++ side: ArchivalEmissionEpochSnapshot + gather_archival_emission_epoch_snapshot lifted to the BlockchainDB interface (LMDB overrides; default backend rejects via has_budget_row=false), and the check_tx_inputs emission branch — classify (exactly one emission vin, txin_to_key co-residents only), fee-input pre-gates, PQC-slot binding (pqc_auths[emission_index]'s hybrid key must derive the vin's P_canonical_id), pseudoOuts sized by the fee subset, reference-block age windows + curve-tree context shared by both proofs, F-C1c signable hash (prefix hash with the emission vin removed wholesale — circularity exclusion, re-bound per the §9.6 table), per-epoch frozen snapshot gather (absent budget row rejects), ordered reward commit set (non-zero plaintext vouts: commitment ‖ amount LE ‖ one-time key), the coarse verify call, and step-7 fee-input FCMP++ verification (proof must be absent with zero fee inputs). Gate-last: check_inputs_types_supported still rejects the vin type — the whole branch is unreachable until the block-4 whitelist flip. FFI KATs cover extract/verify round-trips and the negative surface; the 79 C++ archival tests pass unchanged.

• docs: F-C1c pinned in REWARD_EMISSION_E3_GATING_ROUND.md §9.6 (for ratification) — the emission vin's auth messages and backing proof bind signable_tx_hash, but the full tx prefix contains the vin itself (its own signatures in the preimage — circular). Pin: signable_tx_hash = prefix hash of the tx with the emission vin removed wholesale; every dropped property re-bound (Q1 fields 1–6, the field-7 commit set, tx-level hybrid auth over the complete prefix, fee-input FCMP++ over the unmodified tx_prefix_hash).

• consensus: C-1 commit-block 2 — txin_archival_reward_emission transport shim (dense tag 0x04, F-C1b pin). New vin variant in cryptonote_basic.h carrying the complete Rust canonical encoding as an opaque canonical_bytes blob — emission_wire.rs owns the codec, the parse, and every structural bound; C++ never reads inside the blob. Transport-layer checks only: ARCHIVAL_EMISSION_VIN_MAX_BYTES (1 MiB deserializer allocation cap, cryptonote_config.h) and the leading-byte echo of the Rust wire tag 0x04, enforced identically on the binary serializer and the JSON/RPC entrypoint (json_object.cpp) so no admission skew between parsers (the PR #229 r3 lesson). Boost archive, JSON/debug VARIANT_TAGs, and the signature-size visitor (0 — auths live inside the Rust-verified blob) complete the surface; check_for_double_spend passes it through (no key image — emission dedup is the WS-2 journaled check-and-set plus the block-level (P,E) pass). Gate-last: check_inputs_types_supported still rejects the type (the block-4 flip is the activating cut), pinned by a standing tripwire KAT. Transport KATs in archival_reward_emission.cpp: dense-tag round-trip byte-identity, wire-tag-echo rejection on both serialize and deserialize, size-bound fail-closed, whitelist-still-rejects.

• consensus/db: C-1 commit-block 1 — budget(E) production per ARCHIVAL_BUDGET_SCHEDULE.md (ratified; F-C1a closed). The redirect-the-write lands at the connect site (blockchain.cpp): the single per-height staker_inflow write switches target on the connecting block's own fork version (HF_VERSION_ARCHIVAL_EMISSION, genesis feature set) — pre-activation → burn record (unchanged), post-activation → new archival_budget_accrual LMDB row (add/get/remove_archival_budget_accrual, burn-record idiom: BE keys, written only when nonzero, pop removes the height row beside remove_block_burn). The epoch close materializes the frozen archival_budget row (bounded accrual range-sum over [E·SEB, (E+1)·SEB), same write txn as the Σwork(E) sigma row — the M1 same-snapshot pin; written unconditionally so present-and-zero ≠ NOTFOUND), the close revert deletes it, and both tables join prune_archival_epochs_before. The emission snapshot gather now carries budget_atomic + has_budget_row (stored-shape probe), so the verify shim reads budget and denominator from the same close event — no new live operand. KATs B1 (straddle partition / conservation: burned inflow never enters budget(E_flip)), B2 (reorg across the fork: pop symmetry of both targets, total_burned untouched by the accrual side), B3 (close/revert/re-close byte-identity; §3.3 present-and-zero vs never-closed shape) landed in archival_substrate_lmdb.cpp. Consensus-inert until the C-1 whitelist flip: nothing reads archival_budget until dispatch lands.

• archival: serve-credit equivalence audit — mirrors, standing KAT, fuzz, and the SCE-1 unify (implements ARCHIVAL_SERVE_CREDIT_EQUIVALENCE_AUDIT.md; FOLLOWUPS V3.0 audit-half item). Pure-Rust mirrors of the three C++ serve-credit consensus decisions land in shekyl-archival-retention::serve_credit_decisions (D-SC-A (P,s,E) BE key + pre-block membership; D-SC-B wide acceptance gate with ordered first-failing-branch reasons, reusing serve_credit_epoch_ok / challenge_fire_height / challenge_leaf_chunk_bounds rather than re-deriving; D-SC-C block-level uniqueness, first-collision-wins). The standing equivalence KAT runs both legs over the shared fixture serve_credit_equivalence_kat_v1.json: the Rust leg asserts verdict + reason for every vector, the C++ leg (archival_serve_credit_equivalence.cpp) drives the live check_archival_serve_credit_input over seeded state and asserts the verdict bool only (§5 leg-responsibility split; the four C++-unreachable marshaling vectors are enumerated, not dropped). Fuzz targets fuzz_serve_credit_gate and fuzz_serve_credit_block_unique join the CI fuzz-harness smoke gate. Both audited decision sites in blockchain.cpp carry guard comments naming the fixture. Audit outcome: no divergence found. Finding SCE-1 resolved post-proof by a standalone behavior-preserving commit: the block-level pass now keys with ArchivalServeCreditKey (new bytes() accessor), removing the native-endian composite-key construction db_lmdb.cpp:1657–1659 forbids; the fixture re-pins expect_equal: true so a reintroduced split fails both legs.

• wallet-rpc: Phase 4a scaffold — rust/shekyl-wallet-rpc (WALLET_REWRITE_PLAN.md Phase 4a; docs/api/wallet_rpc.yaml). New Engine-native crate (not the transitional shekyl-engine-rpc wallet2 FFI bridge): axum JSON-RPC on POST / (TCP or uds://), WalletRpcError / allocated -29xxx codes from the OpenAPI contract, single-tenant Tenant type, HTTP basic auth middleware, UDS listener, spawn_in_process for Shape B CLI, and get_version (api_version: 1). Other SPECIFIED methods return -32601 method not found until their 4b sub-PRs. Binary name shekyl-wallet-rpc (coexists with the C++ binary of the same name until Phase 5 deletion — operators must not confuse them).

• docs: serve-credit C++-decision equivalence audit — design (ARCHIVAL_SERVE_CREDIT_EQUIVALENCE_AUDIT.md, rounds 1–3 + post-closure pins CLOSED; implementation go issued 2026-07-09). Specifies the V3.0 verification task from the FOLLOWUPS queue: pure-Rust mirrors of the three C++ serve-credit consensus decisions (blockchain.cpp:4247 (P,s,E) LMDB dedup; :4224–4396 full acceptance gate, wide scope with ordered first-failing-branch reasons; :4889–4910 block-level uniqueness), equivalence via a shared-JSON standing KAT with no new FFI (C++ leg asserts the verdict bool only — all the C++ contract exposes; the reason/branch is a Rust-mirror fidelity assertion against a source-inspection-authored column, no MERROR_VER log-parsing), Rust fuzz targets, and mirror-then-fix discipline throughout. First finding SCE-1: the (P,s,E) key is built big-endian for the persistent LMDB set (ArchivalServeCreditKey) but native-endian for the in-block set — no live bug (the sets never cross), dispositioned unify-after (prove equivalence against today's split, then a standalone behavior-preserving C++ commit unifies onto the BE type). Post-closure pins: fixture substrate_commit header + C++ gate guard comment as staleness guards; step-9 holds-at-H_fire mirrors the WS-1-corrected as-of reconstruction already live at db_lmdb.cpp:5040–5072 (PR #269), with strictly-above slash-boundary vectors on the C++ leg. SCE- family registered at birth in IMPLEMENTATION_INDEX.md §2 (rule 94 §1) with §5 inventory + §7 doc-directory rows. The decision-site flip stays V3.1 (FOLLOWUPS), decoupled at the genesis boundary.

• docs: C-1 pre-flight executed against dev 6671d565b (REWARD_EMISSION_E3_GATING_ROUND.md §9) — every C-1 operand read at its production site after #269/#271/#272 landed. All merge blockers green (E1 hybrid auth, E3 verify body, WS-2 write side, as-of-E snapshot, GF-4b §8.0.3 precondition) and all dispatch anchors confirmed (whitelist, check_tx_inputs seam, reference-block root sourcing, block-level (P,E) pass template, connect-arm slot). Two findings for ratification: F-C1a — budget(E) has no production source (the burn site blockchain.cpp:5026 destroys the staker inflow with a redirect promise; recommended: connect/pop-symmetric accrual persisted beside Σwork(E) at close, implicit under-mint on claim expiry); F-C1b — the C++ VARIANT_TAG 0x06 pin is pre-renumber drift (dense scheme makes 0x04 next-free and the genesis registry already assigns it; recommended: pin 0x04, aligned with the Rust wire tag). C-1 scope enumerated in §9.5; E4's deletion surface shrank (txin_stake_claim already deleted by the claim-era retirement PR-4). Both findings dispositioned same day: F-C1b ratified at 0x04; F-C1a ratified in direction but gated on a spec-first round — the as-recommended phrasing carried a straddle-epoch over-mint (the epoch containing the activation height mixes burned and emittable inflow; activation is HF-gated, not epoch-aligned).

• docs: ARCHIVAL_BUDGET_SCHEDULE.md — gate-1 budget(E) spec (RATIFIED 2026-07-08 with the C-1 build opening; unblocks C-1 item 4). Pins: budget(E) = post-activation staker inflow over E's blocks, via redirect-the-write (the fork switches the target of the single per-height staker_inflow write — pre-activation → burn record, post-activation → budget accrual, by each block's own height) so the straddle is correct by construction, burn-stop/accrual-start are atomic, and pop symmetry is inherited from the landed burn-record idiom; three pop-symmetric writes (per-height accrual row mirroring block_burn; frozen archival_budget close row beside Σwork(E), deleted by the close revert, pruned with the epoch family; verify reads the frozen row in the snapshot gather — no new live operand); expiry = implicit under-mint (R1.B posture, rule-21 reopen on economics evidence); zero-budget epochs structurally non-claimable through the M1 §2.3 positivity path, with the builder's single positive-share omission predicate named to cover the budget factor; five armed KATs (straddle conservation, reorg-across-the-fork, close/revert symmetry, zero-budget omission/rejection, fee-bearing coinbase foreclosure). The §2.2 coinbase-foreclosure pin names its cross-function dependency (validate_miner_transaction's exact-equality check is what makes the redirect supply-safe; nothing in the budget code references it) and the standing economics_c2a_prime assertions that hold it today, with the fee-side coverage gap closed by KAT B5 at the C-1 build. The §8 servo clause carries a scale note: the servo is a design round, not a commit (it reopens conservation, one-write-one-target, the §6 determinism pins, and the digest surface at once).

• docs: C-1 decision-placement pin ratified (REWARD_EMISSION_E3_GATING_ROUND.md §9.5) — source-verified split: computation is uniformly Rust; decisions are mixed (emission verify Rust-decides via typed errors that archival_ffi.rs only maps; the older serve-credit path decides in C++ against LMDB at blockchain.cpp:4247/:4312/:4889–4910). C-1 builds every new consensus decision in Rust with C++ as marshaler/applier — the block-level (P,E) pass (item 6) takes its verdict from a Rust function rather than mirroring the C++ std::set idiom; the connect arm's dedup decision is already Rust (claimed_epochs_check_and_set), and the mint application stays C++. The three C++ serve-credit decisions — and only those; the C-1 emission block-pass is new code with no C++ predecessor and ships at C-1, never deferred — are queued in FOLLOWUPS.md as extraction candidates with the audit and the flip decoupled at the genesis boundary: the Rust mirror + equivalence proof + standing KAT is V3.0 pre-genesis (a verification task — divergences found are free fixes before genesis; mirror-then-fix, never mirror-a-fixed-version), and the behavior-preserving decision-site flip is V3.1 (unblocked when the equivalence KAT is green and the flip carries no behavior delta).

• wallet: GF-4b backing-lineage pre-join wiring — sweep, lineage ladder, BackingSet; the REWARD_EMISSION_VIN_PLAN.md §8.0.3 C-1 activation precondition is satisfied (ARCHIVAL_GF4B_BACKING_LINEAGE.md, design + review round GF4b-1…6):

  • Shared maturity math. eligible_height extracted to shekyl_engine_state::transfer — the single wallet-side definition of "leaf in the curve tree yet" — with SPENDABLE_AGE unified onto shekyl_consensus::DEFAULT_LOCK_WINDOW (X5's transfer path and the scan seam now call one function; two-constants-both-10 drift seam closed).
  • Lineage + spendability at the scan seam (schema v5). PFundingOutputRecord gains MintLineageOutput (EmissionReward / BondPostChange / ExternalTransfer; no miner rung — P is shard-serving only, coinbase-to-P classifies rung 3) and spendable_height (the shared eligible_height result). PSCAN_STATE_VERSION 4 → 5; snapshot regenerated; lineage and spendable-height KATs at the dual-extract seam.
  • Sweep conversion. select_funding_outputs → sweep_funding_outputs: consumes the persona's entire unreserved spendable eligible set (no early break; a subset is inexpressible) — GF-4b's structural-emptiness claim rests on it. Spendability filter per GF4b-6 (an immature record — fresh funding or adversarial coinbase-to-P — survives to the next sweep instead of denying the bond). Gated on the new SpentRecordsDurablyPruned witness token (GF4b-5): zero production constructors until SP-R0 durable pruning lands, so premature go-live fails to compile.
  • BackingSet (engine/backing_set.rs): constructor-gated backing-eligibility type — possession proves every member is rung 1/2; filter-not-fail-closed on legal between-sweeps tranches; GF4b-3 survivor debug_assert! armed (doc names its late-surfaced-output false-positive mode). Zero-pre-bond-output test landed.
  • Docs. WI-2 §3.2 extent amendment + WI-4 measurement citation updated; lifecycle GF-4b sequencing corrected to wired state; FOLLOWUPS: "2d-1 WI-2 durable removal" annotated with sweep severity
    • structural gate, and the GF4b-2 genesis gate added to the V3.0 pre-genesis queue (stake_in single-structured-output funding; common-case sweep consumes exactly one input).
  • Review-round hardening (2026-07-08). BackingSet::from_spendable now enforces the GF4b-6 spendability filter itself (new reference_height arg) rather than trusting a caller contract, so the type's "spendable" guarantee holds by construction and immature records are dropped before the survivor tripwire; the GF-4b scan pre-pass debug_assert!s the transaction_hashes ↔ transactions positional pairing (an invariant violation now fails loudly in debug instead of silently degrading lineage to ExternalTransfer, release keeps fail-toward-forbidden); sweep_funding_outputs folds its sum + collect into one pass; the PFundingOutputRecord test fixture is single-sourced in engine::test_support::funding_record. The removed-subset-bound tx-size facet and the reference_height freshness contract are recorded as C-1 residue criteria (§5 items 5–6).

• archival: WS-2 emission-claim dedup plumbing — connect-side writer + journaled revert (REWARD_EMISSION_E3_GATING_ROUND.md §3 item 3a / §6.2–§6.4). The write side of the three-layer dedup, landing beneath the verify body's read-only layer:

  • Single writer FFI. shekyl_archival_claimed_epochs_check_and_set (archival_ffi.rs / shekyl_ffi.h) wraps the windowed Rust claimed_epochs_check_and_set — validated write-back over a caller-owned buffer, distinct status codes for inserted / already claimed / not-settled / expired / invalid. C++ stores bytes, Rust decides (the good_through split).
  • Connect path + journal. BlockchainLMDB::apply_archival_emission_claim loads the bond, journals the full pre-image (claimed_settlement_epochs
    • first_paying_emission_height) into the new archival_emission_claim_log table (BE(height)||BE(seq), slash-log idiom), then runs the FFI writer per claimed epoch. A dedup hit or unclaimable epoch at connect is a hard error, not a reject — verify's contains-check and the block-level pass make it unreachable, so reaching it means an emission paid without marking E (§6.2's Ok(false)-at-connect posture). first_paying_emission_height is set-once on the first claim.
  • Pop path. revert_archival_emission_claims_at_height restores the journaled pre-image (reverse-seq) and consumes the rows; wired into BlockchainDB::pop_block after the slash/close reverts. The pre-image shape (not an insert-inverse) is what closes §6.3's double-mint: the connect mutation is insert plus window prune, and removing the inserted epoch cannot restore what the prune evicted.
  • KATs (archival_substrate_lmdb.cpp): apply/journal/revert roundtrip (byte-identical restore, journal consumed), connect-breach hard errors (dedup hit, unsettled, expired, unknown P), the §6.4 prune-straddle property test — claimed E_old evicted by a later claim's prune, popped across the epoch boundary, then re-claim of E_old rejected (the assertion the naive remove-inverse fails) — and first-paying set-once / pop-symmetric.
  • Deferred to C-1: the block-level (P,E) uniqueness pass and its KATs — it iterates txin_archival_reward_emission, whose C++ variant type lands with C-1's transport shim.

• archival: emission vin verify body, §7.1 steps 1–6 — KAT-tested, not on the consensus dispatch (REWARD_EMISSION_E3_GATING_ROUND.md §3 item 3; REWARD_EMISSION_VIN_PLAN.md §7.1 / PR-E3). New shekyl-archival-retention::emission_verify module implementing the fail-fast verify: finalization + claim-age bounds (F-E1, explicit structural checks), bond posture, the WS-2 read-only dedup layer (claimed_epochs_contains against the pre-block record; the write side stays on the connect path, item 3a), work recompute through as_of_e_served_work with per-shard exactness (serve_credit_bit must equal the ledger fact, scarcity_milli must equal the member-masked recompute — a wrong split cannot hide behind a right total), three-channel economics over the persisted Σwork(E) via reward_share_floor plus the loud Σvout zero-tolerance compare, and the membership-only backing gate (leaf-hash equality + verify_membership_only). Fail-closed by type (§3.0 gate-last): the accept verdict (EmissionVerified) is only constructible from three sealed witnesses — ClaimsVerified and BackingVerified minted by the verify functions, and AuthVerified, which has no production constructor in the crate; the ML-DSA witness minter lands with C-1, so an authed acceptance is unrepresentable until the activating cut. No FFI entry point yet, by the same gate-last discipline (deferred to C-1 with the dispatch wiring). Twelve KATs (tests/emission_verify_kat.rs): honest-claim accept built from the same sourcing functions (the numerator-is-a-denominator-term identity), F-E1 boundary (reject at h_close(E), accept at h_close(E)+1), claim-age boundary at C − W, read-only dedup rejection, wrong-epoch / wrong-claimant polarity, per-entry work-claim polarity (scarcity drift, false/denied credit bits, omission, duplicates, nonzero scarcity on an unserved shard), no-credit-sentinel rejection (the Q12 economic leg), economics zero-tolerance (±1 atomic unit, vout drift), and the step-6 negative paths (leaf mismatch, garbage proof).

• archival: as-of-E emission epoch snapshot — the M-2/Q7 verify-side work channel (REWARD_EMISSION_E3_GATING_ROUND.md §3 item 2; REWARD_EMISSION_VIN_PLAN.md §8.0.2(B)). The substrate PR-E3's verify shim will consume: a by-value snapshot (Q7: no callbacks across the FFI) carrying the same rows the epoch close computed from, plus the persisted Σwork(E) denominator — never a recompute, since the M1 K_COVER gate's operand (frozen_shard_count as-of-close) is a close-only quantity whose outcome reaches verify only through the stored value. Three coupled cuts:

  • One gather routine, two consumers. The epoch close's inline serve-credit/bond/shard row gather is extracted into BlockchainLMDB::gather_archival_epoch_rows; the close and the new gather_archival_emission_epoch_snapshot both call it, so row-selection divergence between close and verify is unrepresentable (WS-1 §5.5 single sourcing, C++ side). The close-processing boundary (E+1)·SEB is single-sourced through the new shekyl_archival_epoch_close_processing_height FFI wrapper rather than re-derived by hand.
  • One decoder, one work function. shekyl_archival_emission_epoch_work (archival_ffi.rs / shekyl_ffi.h) computes claimant work_P(E) and its Curve(work_P) term via as_of_e_served_work — the same sourcing function whose output built the persisted denominator — over arrays decoded by the same decode_epoch_rows helper the close FFI uses.
  • Identity KATs. Sum-of-capped-terms == persisted Σwork(E) at the Rust FFI layer (emission_epoch_work_sums_to_persisted_sigma) and at the LMDB layer over a production-shaped close (emission_snapshot_identity_and_descriptor_immunity), which also pins live-descriptor immunity: mutating tip holdings after the close (the M2-1 drop-after-serve mutation) leaves every snapshot output bit-identical, and a bonded-but-never-credited claimant resolves to the no-credit sentinel with zero work.

• emission: E3 gating design round closed — leg design complete (REWARD_EMISSION_E3_GATING_ROUND.md). Pre-flight found PR-E2 already landed (stale-doc corrections to IMPLEMENTATION_INDEX.md / REWARD_EMISSION_VIN_PLAN.md); policy trio closed (Q3 vacuous at arity 1; Q11 same-tx backing+fee ACCEPT with balance-exclusion KAT; Q12 zero-work rejected as foreclosed). WS-1 ratified: M-2 supply conservation closes under bits-sourcing ∧ as-of-fire-height acceptance — work_P(E) sources the per-(P,s,E) serve-credit bits, not the tip-mutable held_shard_ids; one shared as_of_E_served_work both sides; one at_height-honoring accessor with two consumers (blockchain.cpp:4307 acceptance, db_lmdb.cpp:5270 slash-eligibility); three armed KATs. WS-2 ratified: three-layer (P,E) dedup (wire / block-level pass / verify-read + connect single writer), with the prune-straddle identified as a double-mint (window floor keys on reorg-non-monotonic current_settled_epoch) closed by a journaled revert whose row restores the prune-evicted members atomically with the inserted E (implemented as the full claimed-set pre-image, per the round's §3a pin); prune-against-finalized recorded as the rule-21 reopen that retires the journal. PR-E3 build list unblocked (round §3).

Changed

• RCT→CT rename, V3.0 public-API slice (docs/FOLLOWUPS.md RingCT→CT sweep umbrella, flagged 2026-06-22). A Shekyl tx is a confidential transaction — there is no ring — so the public, genesis-locking surface drops the inherited "R" before it becomes breaking. Name-only: no wire, hash, or consensus byte changes. (1) Daemon-RPC transaction JSON keys rct_signatures/rctsig_prunable → ct_signatures/ctsig_prunable (JSON-archive-only ar.tag; binary_archive::tag is a no-op, so binary serialization is untouched; breaking for JSON consumers of decode_as_json, tx-pool JSON, print_tx). (2) Legacy wallet-RPC estimate_tx_size_and_weight request field rct → ct; WALLET_RPC_VERSION bumped 1.30 → 2.0 (incompatible request-field rename), FFI dispatch and Python RPC framework updated. (3) C++ enum variants rct::RCTTypeNull/rct::RCTTypeFcmpPlusPlusPqc → rct::CTTypeNull/rct::CTTypeFcmpPlusPlusPqc (type byte values unchanged). (4) Cross-language constant chain renamed end to end: consensus_constants.json key ct_type_fcmp_plus_plus_pqc, C++ macro SHEKYL_CT_TYPE_FCMP_PLUS_PLUS_PQC, Rust CT_TYPE_FCMP_PLUS_PLUS_PQC; plus Rust residue (ct_base_blob preimage component, stale doc refs). The rct:: namespace, rctSig* struct/module/file names, and the transaction.rct_signatures field stay gated on wallet2 retirement per CT_SURFACE_NAMING_PIN.md §5 (V3.1+ internal bulk). Clears the rename dependency on the CT-balance batched-FFI followup. (chore/rct-to-ct-public-api)

• rct: delete the dead base-slot pseudoOuts and the three standalone object serializers — byte-identical; a claimed coinbase wire bug is REFUTED (CT_SURFACE_NAMING_PIN.md §2 correction). The legacy rctSigBase::pseudoOuts was never populated on any live type and — the load-bearing correction — never serialized on any wire: every real byte producer (transaction serializer, tx-hash paths, FCMP++ pre-hash, PQC payload binding) uses the serialize_rctsig_base member function, which never emitted it. The FIELD(pseudoOuts) branch previously believed to put a varint-0 on every coinbase blob lived in a standalone BEGIN_SERIALIZE_OBJECT() with no production caller — a second, disagreeing definition of the rct bytes that was laxer than the real wire (it round-tripped states the member serializer rejects) and whose existence produced the phantom wire-format finding. Deleted together: the field, its ctor init, all eight always-false emptiness guards (tx_verification_utils.cpp, blockchain.cpp, rctSigs.cpp), the base arm of get_pseudo_outs() (now unconditionally the prunable vector), and all three caller-less object serializers (rctSigBase, rctSigPrunable, rctSig) so the class of second-serializer phantom cannot recur; the two unit tests that round-tripped the dead serializer are repointed at the member function (the real path), with a new pin that a no-output Null base is exactly the one type byte. The naming-pin doc's step-3 routing (wire change + version bump) is retracted in place, and its deletion inventory's cryptonote_boost_serialization.h item is corrected — that line is the prunable field, live and load-bearing, and must not be touched by the rename sweep. Verified byte-identical: full unit suite (fcmp/Serialization/archival, 129 tests) plus the shekyl-wire live-oracle KATs (coinbase_block_and_tx_hashes_match_the_daemon, coinbase/spend round-trips) all pass against the pre-change pinned blobs; GENESIS_TX and all hashes untouched by construction. Rule 42 does not fire (no persisted engine-state block embeds the rct base).

• archival: WS-1 held-sourcing correction — serve-credit ledger is the sole work_P(E) source; holdings reads are as-of-fire-height (REWARD_EMISSION_E3_GATING_ROUND.md §5, item 1 of the PR-E3 §3 build list; closes the M-2/Q10 two-conjunct condition "bits-sourcing ∧ as-of-fire-height acceptance"). Four coupled cuts, one validation surface:

  • Single sourcing function. as_of_e_served_work (rust/shekyl-archival-retention/src/consensus_state.rs) now derives market membership, R_market, and per-bond work from the frozen serve-credit pairs alone; epoch_close_compute delegates to it, and the PR-E3 verify body will call the same function — numerator/denominator sourcing divergence (the M-2 silent over/under-mint) is unrepresentable, not tested-against.
  • Descriptor out of the work channel. held_shard_ids is removed from EpochCloseBond, the FFI struct (shekyl_archival_epoch_close_bond in shekyl_ffi.h / archival_ffi.rs), and the LMDB gather marshal — the tip-holdings re-filter that produced the drop-after-serve under-count no longer compiles. Fixture sigma_work_milli values recomputed (consensus_state_kat_v1.json, reward_gate_kat_v1.json).
  • As-of-height accessor, one implementation, both consumers. BlockchainLMDB::archival_bond_holds_shard honors at_height by reconstructing from tip holdings + the slash log (holdings are shrink-only post-join at the current substrate); the slash log gains a v2 holdings_pre_kind field (pre-genesis posture: v1 rejected at decode) which also fixes the pop-revert heuristic that mis-restored a slashed single-shard compact bond to complete-tree. Serve-credit acceptance (blockchain.cpp) and slash eligibility (db_lmdb.cpp, tip-holdings pre-filter deleted per the round's third-consumer finding) now answer "held at the challenge fire height" identically, with the h_fire guard aligned (h_fire == 0 || h_fire > h_close) on both sides.
  • KATs armed on the new sole gate. Drop-after-serve (consensus_state.rs), acceptance-gate both polarities (archival_serve_credit_integration.cpp, asserting the gate queries exactly the derived h_fire), slash-side mirror through the production add_block → slash-scheduler path plus as-of-fire reconstruction and revert KATs (archival_substrate_lmdb.cpp), and the one-strike bad-interval cascade guard.

Fixed

• staking: S6 session self-cert chi-square graded against flat expected counts, miscalibrating the advertised α=1e-6 to ~1.5e-2 (rust/shekyl-standoff/src/conformance.rs, rust/shekyl-stats; ARCHIVAL_BOND_S6_CERTIFY_DRAW_PLAN.md §2 R0-D3 UPDATE 2026-07-09). grade_sample bins the 601 discrete outcomes of window = 600 into 60 bins — one bin is 11 outcomes wide — but scored the histogram against a flat n / n_bins expected count, injecting a noncentrality of ≈ 32.7 at n = 200 000. A correct OsRng therefore failed the wallet-open self-cert (and the dedicated S6 CI test) about once per 70 grades; the R0-D3 false-fail previously attributed to the legitimate α tail was this bug. Expected counts are now proportional to the exact bin widths (new chi_square_counts_expected in shekyl-stats, fail-closed on degenerate expecteds; exact u128 binning replaces the f64 index map, which also lost integer precision above 2^53), restoring the advertised calibration. Regression test pins an exactly-uniform sample to a chi-square of zero.

• gitian: pre-install the pinned Rust toolchain serially so release builds stop racing rustup (contrib/gitian/gitian-{linux,osx,win,freebsd,android}.yml). The gitian containers installed rustup with its default toolchain, but rust/rust-toolchain.toml pins 1.94.0; the first cargo under the parallel make then auto-installed 1.94.0 with the default profile from several processes at once, and the concurrent writes to ~/.rustup/downloads aborted every platform build with component download failed for clippy-…: could not rename 'downloaded' file. All four v3.1.0-alpha.6 gitian jobs (Linux/macOS/Windows/FreeBSD) died this way. The rustup installer now pins --default-toolchain 1.94.0 --profile minimal: the pinned toolchain is present before make, so no build-time auto-install races, and the minimal profile drops clippy/rustfmt — a gitian build only compiles the Rust FFI, it never lints. The install is also hardened to the house download-then-run form (curl --retry … -o /tmp/rustup-init.sh then sh …, mirroring .github/actions/install-rust) rather than curl | sh, which can mask a partial/empty download as an exit-0 no-op. The 1.94.0 pin is added to rust/rust-toolchain.toml's bump-policy lockstep list. RELEASE_PROMOTION.md §4 gains a gitian dry-run gate: dispatch the gitian workflow against the frozen SHA (no tag pushed) and require all four platforms green before the cut/promote/tag, so release-only build breakage is caught pre-tag instead of forcing a bump.

Security

• deps: clear the cargo audit warning backlog (rust/Cargo.lock, rust/.cargo/audit.toml). Bumped anyhow 1.0.102 → 1.0.103, closing the soundness notice RUSTSEC-2026-0190 (the only unsound advisory in the tree; patched >= 1.0.103). Dropped the now-stale ignore for RUSTSEC-2026-0097 (rand unsoundness): the tree already resolves to rand 0.8.6/0.9.4, both in the patched ranges (>= 0.8.6, >= 0.9.3), so the advisory no longer applies. The two remaining notices are crate-level unmaintained INFO advisories on transitive, non-consensus, render/build-time deps that cannot be dropped without an upstream move — atomic-polyfill (RUSTSEC-2023-0089, via postcard 1.1.3 → heapless 0.7, and not even compiled on native-atomic targets) and ttf-parser (RUSTSEC-2026-0192, via the imageproc chain, same root as paste). Both are now documented in audit.toml with explicit reopen criteria per 21-reversion-clause-discipline.mdc, alongside the existing paste entry. cargo audit is fully green with zero unexplained warnings.

[3.1.0-alpha.6] - 2026-07-07

Added

• wallet-rpc: OpenAPI 3.1 contract for shekyl-wallet-rpc (Phase 4 spec-first gate) (docs/api/wallet_rpc.yaml; WALLET_REWRITE_PLAN.md §"Phase 4"; IMPLEMENTATION_INDEX.md §3 Phase 4 row). The spec lands before the first method per the plan's spec-first rule: JSON-RPC 2.0 envelope, the stable error-code range allocation (-29000..-29999 by domain), and full schemas for the 15 methods whose engine-layer prerequisites (Phase 1 orchestrator + Phase 2a send path) have landed — wallet lifecycle, balance/address, the build/submit/discard send trio (with the CT-5d content_gen gate and the SubmitVerdict success/rejection projection per DAEMON_SUBMIT_VERDICT.md §2.5), transfers, refresh/rescan, and height/version. JSON shapes are Shekyl-native and locked: atomic-unit string amounts, first-class staking fields in get_balance (zero until Stage 3), explicit capability mode on every wallet handle, structured hybrid PQC signatures. Stake, payment-request, proofs, sign/verify, and air-gapped-bundle methods are RESERVED with named prerequisites (rule 21 reversion shape) — their error-code ranges are allocated now so the contract never shifts under clients. No implementation crate yet; the first rust/shekyl-wallet-rpc sub-PR conforms to this file.

• archival: segment-freeze pipeline design round 1 opened (ARCHIVAL_SEGMENT_FREEZE_PIPELINE.md) — the production writer/deleter for m_archival_shard_segment, satisfying the M1 §1.3 merge condition. Substrate survey (doc §2): the daemon already maintains the curve tree inside the block write txn with a drain-journaled, pop-symmetric leaf count, so freezing reduces to a first-crossing rule — segment k freezes at the first height where leaf_count ≥ (k+1)·SEGMENT_LEAF_COUNT, R_k read from the layer-2 chunk the same-txn grow computed — and O-1..O-3 discharge by inheritance (doc §3), with the pop hook a derived delete (no freeze journal). Pins SEGMENT_LEAF_COUNT = 25 992 (level-2 subtree, 38·18·38) into the constants pipeline with the boundary division in a single Rust FFI entry point called by both connect and pop hooks (M1-1 single-source shape). Exercises the maintainer's pre-genesis schema-restructure authorization once: archival_shard_leaf is deleted (doc §6.2) — it is a derived copy of m_curve_tree_leaves; the gate-2 challenge path reads the 38-leaf chunk directly from the tree's own leaf table. Adversarial review of the round-1 draft pending; implementation gated on round closure.

• archival: segment-freeze pipeline implemented — steps 1–7 of the round-1 plan (ARCHIVAL_SEGMENT_FREEZE_PIPELINE.md §7, on feat/segment-freeze-pipeline). (1) SEGMENT_LEAF_COUNT = 25 992 through the constants pipeline + Rust first-crossing arithmetic (frozen_segment_count, challenge_leaf_chunk_bounds) with boundary/overflow unit tests; (2) FFI exports for both; (3) connect/pop hooks in db_lmdb inside the block write txn — process_archival_segment_freezes_at_height writes newly-crossed segment rows reading R_k from the layer-2 chunk the same-txn grow computed, revert_archival_segment_freezes is the derived delete (O-3 pop-symmetry); (4) archival_shard_leaf deleted — the gate-2 challenge path reads the 38-leaf chunk directly from m_curve_tree_leaves; (5) the §9 C++ suite (archival_segment_freeze.cpp: first-crossing, multi-segment catch-up, independent R_k recomposition, bit-identical pop/re-apply, pop-above-boundary no-op, missing-layer-2-chunk loud abort, M1 operand against production rows — the §11.10 fixture caveat retired) + gate-2 fixture regenerated at 25 992; (6) tripwire extensions (check_reward_gate_predicate_sites.sh: writer one-site, cursor accounting, division one-site, for_kat containment); (7) docs (LMDB_SCHEMA.md v7 note, M1 §1.3 discharge record). O-1..O-3 discharged. Pre-flight additions folded in: PF-8 transposition-distinguishing epoch-close FFI fixture (exact-sigma pin catches any swap of the three leading u64s); PF-6a KCover capability newtype (consensus() sole production constructor; KAT injection behind the permanent dev-only consensus-kat feature).

• archival: O(1) pop-symmetric frozen-shard counter — the M1 gate operand's persisted backing store (schema V8) (ARCHIVAL_SEGMENT_FREEZE_PIPELINE.md §4.4; M1 §11.11; closes the FOLLOWUPS.md efficiency follow-on from code-review #263). properties["archival_frozen_shard_count"] moves in structural lockstep with the segment table: +1 in put_archival_shard_segment (now MDB_NOOVERWRITE — rows are CREATE-only, enforced at the mutation site), −1 per deleted row in revert_archival_segment_freezes (underflow-aborted). count_frozen_shards_at_close drops its full-table walk for an O(1) counter read + MDB_LAST frontier check (row must decode; freeze_height ≤ h_close; future-dated frontier and counter/table divergence are loud aborts). This is not M1 §11.8 M3-1's cached-counter adversary — the adversary lacked O-3 pop-symmetry, which this counter has by construction, differential-tested against the retained walk oracle (count_frozen_shard_rows_by_walk_for_test, zero production callers) across freeze/pop/re-apply cycles. Tripwire: segment-table cursor accounting 4→5; new invariant 6 pins the counter's mutation surface (key literal ×2, setter call sites ×2, walk oracle unreferenced in production). Breaking (rule 42): DB VERSION 7→8; migrate refuses pre-V8 databases loudly (delete-and-resync; no pre-genesis migration code per 15-deletion-and-debt.mdc).

• archival: M1 pre-flight dispositions recorded — PF-1 breach record, PF-2 accepted residual, PF-9 seal-before-stressnet pin. PF-1: the §11.9 sequencing breach recorded in FOLLOWUPS.md as a breach (not a precedent); 26-sub-pr-design-discipline.mdc gains the explicit halt condition — no implementation commits on a branch whose governing design doc names an undischarged pre-flight pass. PF-2: the compile-refusal's out-of-band hand-built-artifact residual recorded as accepted with its upstream dependency named (Guix-reproducible builds + signed-tag release path — M1 §4). PF-9: K_COVER finalization pinned as a prerequisite of Phase 7.7 stressnet entry (M1 §4 rule-21 entry + RELEASE_CHECKLIST.md) — while provisional the gate runs as identity, so only a post-seal stressnet exercises the activation boundary live before genesis.

• archival: M1 reward gate implemented — steps 1–5 of the §11.9 pinned sequence (ARCHIVAL_REWARD_GATE_M1.md §11.10 implementation record). Executed on feat/m1-reward-gate-design after the pre-flight pass held the §6 enumeration at the audit pin (re-verified post-WI-4-merge at 1e89df832; M3-3 discharged — WI-4 §16.3 pins shard_count as structural, the K_COVER calibration derives against segment count). (1) k_cover + k_cover_provisional constants with build.rs validation and a compile_error! refusal absent the provisional-k-cover feature — armed before the identifier existed anywhere else; sentinel refined in-arc from fail-closed u64::MAX to gate-identity 0 (provisional ⇔ 0, sealed ⇒ ≥ 1) so the pre-seal corpus stays live end-to-end while the compile refusal remains the shipping guard. (2) count_frozen_shards_at_close (single production call site in the close gather; freeze_height ≤ H_close filter, decode failure aborts loudly) threaded as an FFI frozen_shard_count parameter into EpochCloseInputs::{frozen_shard_count, k_cover} with the zero-at-top gate factor in epoch_close_compute. (3) Wire-level positivity: WireError::RewardAmountZero at both validate() and read_payload() — the zero-amount row is unencodable and undecodable; the EMISSION_AUTH_MSG_V1 corpus zero row replaced and its four pinned digests regenerated in the same commit. (4) reward_gate_kat.rs G-1..G-10 plus C++ store-side cases: count-filter boundary (equality counts), malformed-row loud abort, write-txn precondition, and the zero-output stored shape + reorg round-trip via a legitimately-empty epoch (bitwise-identical to a gated close per §2.1; direct gated-path test deferred to K_COVER sealing). (5) scripts/ci/check_reward_gate_predicate_sites.sh as consensus-invariants invariant 5: single K_COVER comparison site, single counting read over m_archival_shard_segment (mdb_stat refused), ≤ boundary pinned with strict-< refused, positive controls guarding the guards. Outstanding before the PR merges: the segment-freeze pipeline design round opens (§1.3 condition).

• docs: M1 reward-gate consensus rule — design rounds 1–3 spec + closure (ARCHIVAL_REWARD_GATE_M1.md). The WI-4 launch posture's cold-start refusal in consensus-rule form: zero reward accrual for every persona in epochs where shard_count < K_COVER, enforced as a uniform zero-at-top factor in epoch_close_compute and inherited by the emission zero-tolerance compare through the zeroed stored Σwork. Spec-first per 05-system-thinking and 26-sub-pr-design-discipline (cited). Carries the WI-4 §16.2 obligations — activation-boundary KAT as a first-class deliverable, the zero-accrual/no-seniority invariant enumeration with source-verification checks, and the spec/constant split (K_COVER finalization gates on the §14.4 partition run). Round 1 closed against an adversarial wargame (§9): consumer walk verified zero pre-gate readers of the epoch-close outputs and join_settlement_epoch as eligibility-only; the non-claimable rule amended to the uniform positive-share form; the provisional k_cover sentinel hardened to a compile-time refusal in non-test builds; the reorg-across-activation-boundary argument written out against the existing connect/revert pairing. Round 2 closed against a second independent review (§10, findings M1-1..M1-9): the non-claimable rule resited to the wire level (strictly positive reward_amount_plain, rejected at validate() — the zero-row beacon becomes unencodable, and K_COVER is compared at exactly one code site, guarded by a new CI grep tripwire); §2.1 output naming corrected to the real two-field EpochCloseResult (no per-P surface widening); the gate pinned to run through the normal close path, never an early-return skip (close-log/revert symmetry, prune advance, stored-zero sigma), with the zero-accrual-is-not-zero-accountability invariant (serve credits, bad intervals, slashing stay live during gated epochs); the §4.5 lagged-read discipline recorded as load-bearing for non-claimability (never recompute Σwork from primaries); KAT extended G-6..G-9 plus C++ store-shape and boundary-reorg tests; reorg-argument and prune-optimization reversion clauses added (rule 21). Surface enumeration updated; wallet-claim-builder obligation pinned forward. Round 3 closed against two parallel reviews (§11, R2-1..R2-4 + M2-1..M2-5), surfacing a critical defect the earlier rounds missed: §1.1's concrete anchor pinned the epoch-close gather count — credit-derived, a participation measurement (the sensor class §1.2 forbids: non-monotone, withdraw-service griefing lever) — while the security argument, dead-rule acceptance, and reorg triviality are proofs about the segment-table count. §1.1 re-anchored to m_archival_shard_segment filtered on freeze_height ≤ H_close(E), threaded as a new EpochCloseInputs::frozen_shard_count field + FFI parameter + C++ gather count pass (the §6 "FFI zero-change" row corrected); G-10 participation-independence KAT added. The segment-freeze substrate is confirmed unbuilt (put_archival_shard_segment has no production caller, no delete path) — §1.3 restates the substrate properties as named obligations O-1..O-3 (determinism, per-branch monotonicity, pop-symmetry) on the future freeze-pipeline design round, with implementation conditioned on them and the §9.4 reorg argument explicitly conditioned on O-3. WI-4 provenance resolved as a merge-ordering dependency (feat/wi4-gf7-measurement, pushed, unmerged). Closure-review items: lagged-read tripwire made a standing pre-flight check, stored-close reader enumeration recorded, reorg-crossing-claim-attempt pinned as a wallet-builder forward obligation, claim-era-retirement (2615c0d) interaction closed at source (no shared wire/table/path). Round-3 amendment (§11.8, M3-1..M3-3, post-closure pin): the count pass — the surface round 3 itself created — armed to the same standard as the predicate site. Single named helper (count_frozen_shards_at_close, one call site) owns the freeze_height ≤ H_close(E) filter; the CI tripwire extended to refuse any other counting read over m_archival_shard_segment; C++ unit cases pin the filter boundary (equality counts, per ≤ — the off-by-one the Rust KAT structurally cannot reach) and the decode-failure discipline (undecodable segment row aborts the close loudly, same class as the gather's FATAL — a lenient skip would be a consensus fork in the gating direction); G-1..G-3 rebound to frozen_shard_count; named pre-flight item added requiring the WI-4 §14.4 K_COVER calibration to derive against the segment count, not any served/participation quantity. Implementation gates decided (§11.9): §1.3 fork resolved to the second branch — the gate implements now on fixture rows (wargamed: the count helper binds to the LMDB_SCHEMA.md-fixed schema, not pipeline behavior; future-dated freezes handled by ≤, non-dense IDs by walk-not-watermark, versioned segments unrepresentable under the existing key; O-3 is chain-wide, so serializing the gate behind the pipeline buys almost nothing while delaying the unpatchable-after-seal item), with O-1..O-3 blocking on the pipeline round and that round opening before the gate PR merges. Pre-flight audit pin = dev head at pre-flight time, not 69af41a. WI-4 doc merge holds sequence slot 0. Intra-PR order pinned: constants + compile-refusal before the k_cover identifier exists anywhere else in the tree (the refusal armed before there is anything to guard), then helper + threading, wire positivity + corpus fix in the same commit, KATs + C++ store tests, tripwire scripts last.

• sim: GF-7 graded genesis gate — WI-4 (PROVISIONAL-PASS, local-daemon posture only) (ARCHIVAL_BOND_WI4_MEASUREMENT.md; IMPLEMENTATION_INDEX.md §4 WI-4 row). The GF-7 principal↔P funding-seam unlinkability property is now measured, not just hooked. The a-priori bound r = P(link)·N < 2 (the modeled observer may at most double blind guessing) is committed in the reviewed acceptance doc before any grading code (§3; provenance settled §13.4), then graded by a real S-3 correlator replacing the nearest_principal placeholder (shekyl-staking-sim/src/gf7_timeline.rs, --gf7-timeline). The 2026-07-06 adversarial review re-grade hardened the round: the observer is posture-conditioned (§4.1.1 — session/refresh markers are loopback-invisible under the local-daemon posture and excluded as direct anchors; the remote/non-isolated-daemon posture is a named unmet residual on the verdict, D-B1 2d-2 reopen family; the indirect session channel is coupled in the generator and graded — blind 0.237 at window 0 → ≈0.13 under full jitter); the stress arm is an oracle-panel with an exact seam-consistency-gated member (§4.3.1; lr > s3 on every gate row); the D-B3 resume channel is swept (session-lattice resubmit, r = 1.57, under bound). Controls valid; every gate-relevant row clears the bound on all three arms; worst gate row r = 1.86 (honestly thin margin; per §4.3.1's pinned ceiling the margin holds against the strongest observer of the modeled channel, not the strongest adversary). Cold-start reclassified: low-activity fails the bound (panel r = 3.54) and is the genesis regime — disposition is the §14 founder-cover launch posture (refuse the regime: production-path-identical staggered founder cover under permanent consented attributability; shard-schedule structural gate; §14.4 partition-adversary arm spec-committed with a-priori bounds and a pre-implementation-widened hypothesis class — max-statistic over a named rule family vs the permutation null of the maximized statistic, one marked control per failure mode; implementation gated on review). Remote-daemon disposition made explicit (§15, proposed, review-gated): structural refusal at the dispatch driver rather than a warned override — privacy is not a setting; tunneled circumvention the named residual; reversion on a measured decorrelated remote transport. Mechanization addendum (§16, proposed, review-gated): the launch posture converted from policy to structure under the global-and-blind constraint (mechanisms sort on structure, never identity). M1 — reward-eligibility-by-shard-count as a genesis-frozen consensus rule (zero accrual pre-K_COVER, not deferred payout; shard count verified at source as a deterministic monotone function of height; refuses the cold-start claim-cohort hazard in the same window) — is the build-first item and gets its own design round, with two obligations pinned for that round: the activation-boundary consensus test as a first-class deliverable (the once-firing rule's boundary is never re-exercised at runtime), and K_COVER finalization gated on the §14.4 widened-class measurement (rule shape specs immediately; the constant waits on the cover model that measurement validates). Three closing pins (§13.5, §14.4, §16.10): the sealed claim stays conditional by construction (isolation conditioning never discharges — two-of-three-measured is not three-of-three-cleared); the partition arm's output feeds two consumers with opposite dispositions (distinguishability fail ⇒ posture redesign; sound-but-thin cover ⇒ K_COVER calibrates higher); and the §§14–16 review closure is held to an adversarial read of the bounds themselves, not a consistency check. M3/M7 CI enumerations (gate-11 / F25 shape), M4 global launch-window bond rate cap (WI-3 D-B2), M5 never-serialized PublicByConsent marker, M6 generator-coupling control (blind@window-0 ≥ 2× chance or INVALID) + leg-(b) wall-clock emission. Irreducible three named. Review-closure round R1 conducted (§17, 2026-07-06; ratification pending): the three §16.10 attacks run to land, each answered attack-shaped on the record. Attack 1: r < 2 survives (claim-anchored, observer-independent) but measured r(N) is only known at N = 10 — N-sweep added (§16.7 item 4, r < 2 at every swept N, a-priori). Attack 2: the widened family was still a proper subset — members 4–5 added (spectral graph partition; seeded nearest-neighbor expansion with one granted founder label), and two label-free channels closed: M3 extended to the full persona lifecycle (claim-absence sorts non-claiming founders, §16.4/§14.3.4) and P4 gains a non-disclosure commitment (consent-to-risk ≠ license-to-disclose; enumeration collapses recorded cover retroactively — §14.3.4, founder-strip sensitivity row in the K_COVER cover model). Attack 3: the K_COVER cycle traced and does not close — the validation projection is K-independent (the breaking joint), the calibration projection a monotone fixed point; the cover model gains a gate-open cohort-dynamics row with its demand assumption as a named conditional (§16.2 obligation 3). No bound relaxed; all amendments adversary-strengthening, pre-code. Distinct-position round R2 (§17.5, 2026-07-06): the standing reviewer's post-merge pass. WI-3 (PR #260) traced at source against D-B1..D-B7 — faithful; one finding (A-1): the R2-1 clock-trust marker reasoned about one of two tip consumers, and the alarm horizon's sensitivity is inverted (inflation ⇒ premature alarm, not benign-later) — marker + WI3 doc amended so the 2d-2 clamp covers both reads. On the WI-4 pins: B-1 converts the no-cross-subsidy pin to structure (§9 criterion 9 — aggregate verdict is a computed conjunction over every committed bound, INVALID on absence, FAIL on any miss); B-2 pins that §16.10 attacks come from a distinct adversarial position with the construction recorded; its concrete instance — the r < 2 mean-vs-max challenge — survives (exchangeability makes the bound per-persona in-model; the untargeted reading was conceded at the floor) and forces the §3.2 pin naming exchangeability as the load-bearing step and regime-splitting as the mean-to-max carrier in deployment. Closure requires §§17.1–17.5 ratified together. Distinct-position round R3 (§18, 2026-07-06): the mean-vs-max disposition is sound but incomplete (captured the max for the split axis, assumed the heterogeneity enumeration complete). Five surfaces scope what 1.86 means — one seam (entry; exit/drain is GF-4, unmeasured), one scope (per-post, not per-principal), one channel (timing, not the loud reward-amount value channel), one instant (not lifetime-cumulative), one stratum (unstratified by observable bond attributes). Landed on the verdict line: the cross-seam conditional (§13.1/§13.5) — r < 2 promotes per-post → per-principal only where persona mutual-unlinkability (GF-4) holds, parallel to isolation conditioning; the most important previously-unstated dependency (S-1 is per-principal; the bound is per-post). Verified at source: the archival reward value channel is loud by design (reward_amount_plain cleartext, P-tied, per-epoch recurring; confidential reward deleted — emission_wire.rs, REWARD_EMISSION_LEG.md; consensus-inert until PR-E3/C-1) — orthogonal to the timing gate, needs its own measurement; the attribute-strata coupling is real but via holdings/bond_floor, not the retired lock-tier multipliers. New sealing-path rounds: GF-4 exit seam (co-equal genesis gate, graded jointly with persona rotation) + the value channel. Ride the §14.4 round: attribute-stratified grading, lifetime-accumulation sweep. No bound reopened. R3 addendum (§18.7): tiers-vs-continuous-accrual answered at source — the shipped leg already embodies the strong form (accrual reads shard age, not persona duration; g(age) linear, no knees; duration structurally quantized at settlement-epoch granularity, so the exit→entry back-solve is capped at class width by construction). Four pins routed to existing rounds: curve shape as privacy parameter (reopen on any g_age_milli/curve_milli change; Curve plateau breakpoints cluster the holdings stratum — §18.3 measures direction), SETTLEMENT_EPOCH_BLOCKS as a-priori duration-class width (GF-4 derives the bound before 10k is a privacy value), per-epoch claim submission as a recurring entry-gap-shaped timing observable (GF-4/value-channel round), and correlated mass-unbonding as a named GF-4 wargame (duration-class anonymity under co-triggered exits). R3 correction round (§18.8): the P-is-public reframing — P is the pseudonym, public by construction; only the P→user link is protected. Retracted §18.3's intrinsic-stratification claim and §18.7's P-curve privacy-primary escalation; re-anchored claim-timing, lifetime accumulation, and correlated-exit on user-rhythm/user-event correlation. Amount-bridge trace verified at source: closed at entry structurally — the bond's public amount is consensus-forced to bond_floor(holdings) (bond_post.rs FloorMismatch), funding and change FCMP++-hidden, no principal reach-across in the assemble path. Surviving residuals routed to GF-4: V-2a staker-membership prior (universal funding constant vs off-chain user-side amount surfaces) and V-2b exit lifetime-total match (P's lifetime value publicly computable to the atomic unit — the value channel's surviving form). Mechanism pin (§18.9): a follow-on CT reading (bond amount hidden above the floor behind a user-configurable mask) verified at source wrong in mechanism — the bond term is a transparent amount·H cleartext term in the CT balance (bond_ct_balance.rs; funding and change are the hidden legs), commitment_mask is HKDF-derived and never user-chosen; closure is loud-but-constant, the proposed mask-consistency wargame unrepresentable-by-construction (reopen on any user-supplied blinding factor or above-floor bonding). On-chain bridges are timing-only; V-2a/V-2b survive off-chain. R4 exit-seam inventory (§18.10): both determinative source checks resolved — the reward payout is cleartext by genesis disposition (REWARD_EMISSION_LEG.md §5.5/§9) and exact (no grid), and reward_P(E) is ex-ante computable from public consensus state. R-1 confirmed dominant but reach-bounded (severed at first spend by FCMP++/CT; all bits at the off-chain matching surface — V-2b in sharpest form). CT-committing the payout foreclosed (priority-1 inflation audit); open defenses: quantization (grid width a-priori derived, GF-4 candidate) + gate-6 routing. Claim-cadence, reward amount, and holdings stratum graded jointly on GF-4. R-1 disposition (§18.11): FCMP++ hides amount AND linkage at every on-chain hop (no non-mint cleartext amounts; P's spend set unenumerable — the precomputed sequence has no anchor after hop one). R-1 is a managed residual at the economically-guaranteed off-chain boundary, defended in layers: firewall-routing (primary, complete on-chain), new gate-6 pin candidate drain-amount decoupling (exact-subsum match is a wallet-policy footgun — drain amounts never computable reward subsums), quantization as defense-in-depth for the approximate lifetime-aggregate band. R4 closure (§18.12): whole-path routing obligation retracted (discharged by the base transfer format); drain-decoupling pin tightened to input-level — the drain-amount computation must not read the reward sequence as an input (user target/cadence/randomness only; verified at the selection path's inputs when the gate-6 policy lands). Why-loud recorded: the mint is loud by priority-1 decision (inflation audit) — R-1 is a priority-ordered tradeoff at its floor, not an unclosed defect; do not "fix" it by CT-committing the mint. Arc closure (§18.13): theory ceiling declared; Tor-default trace resolved at source — persona side Tor-mandatory by construction (shekyl-p-transport compile_error! without SOCKS), principal side opt-in (--proxy default None); principal-side default-on Tor added to FOLLOWUPS as a V3.0 pre-genesis item. Principal↔user seam closing frame recorded: chain-only adversary blind by construction; residual boundaries are the irreducible on-ramp witness, the network default (until flipped), and the enumerated user-mistake set closed by safe-by-default coverage. PROVISIONAL: the block-time sealing re-run is confirmatory by construction (live BondPostDispatched.at is the due block; dispersal is sub-block U[0,60s)), so no block-resolution re-run can close reconvergence leg (b); the wall-clock sweep-phase channel is the primary open uncertainty — closing requires sub-block wall-clock emission + re-grade (docs/FOLLOWUPS.md). Sim-only, feature gf7-hooks (non-default); no production telemetry.

• wallet: block-timed bond-post dispatch driver — WI-3 (ARCHIVAL_BOND_WI3_DISPATCH.md; IMPLEMENTATION_INDEX.md §4 WI-3 row). The sealed pending post now actually reaches a wire at its planned block. The driver (pscan/dispatch.rs) rides the P-scan sweep's own tip read (§3.1 named invariant: the dispatch clock is the daemon's claimed tip, sound under the recommended local-daemon posture; the sweep-corroborated clamp is held in reserve for the 2d-2 reopen), dispatches at most one due post per tick in deterministic order behind a fresh dispersal draw, and seals the Dispatched transition before any send — every attempt, first or resubmit, re-lifts the stored bytes through the submit_bound choke (pin P-2). Outcome handling per §3.4: accept/F31 holds resubmits for the pscan's own reorg-deep confirmation (a daemon's F40 claim never releases the reservation), terminal verify rejection removes bytes + reservation in one seal and alarms (never auto-re-assembles), unknown outcomes resubmit byte-identical next due tick, bounded by the derived 1.5×ARCHIVAL_REORG_DEPTH_BLOCKS alarm horizon (funds-safety over liveness: the alarmed record is held, not dropped). Schema: PENDING_POST_VERSION 1 → 2 for the Dispatched arm; v1 fails closed (pre-genesis, rule 15). Wiring: a DispatchTick seam at the end of pscan_sweep (a failed tick logs and retries next sweep, never halts the scan); production store is the WalletFile-backed region-2 AEAD seal of .wallet.pending, production broadcast is the Local-posture BroadcastSubmitter. GF-7: live BondPostDispatched emission at the submit call site (per-submit emission-completeness test, gate 8); WI-3's GF-7 acceptance stays open until WI-4's a-priori threshold artifact + live-emission sealing re-run per the §5 reconvergence gate. Enforcement: ci/pending-post-write-path (scripts/ci/check_pending_post_write_path.sh) pins the single write path / single payload kind for pending-post persistence (gate 11) — the torn-state-unrepresentability argument (gate 10) rests on it.

• wallet: start_pscan lifecycle wiring — WI-1, completing 2d-1 SP-5 (ARCHIVAL_BOND_2D1_PSCAN_PLAN.md §"WI-1"; IMPLEMENTATION_INDEX.md §4 WI-1 row). The firewalled P-scan gains its lifecycle call sites: Engine::start_pscan_if_staker (the post-open auto-start — a staker wallet gets its scan at production settings, a non-staker gets Ok(None) and pays nothing) and Engine::start_pscan (the on-demand entry mirroring start_refresh; NoStakeEngine for a non-staker). Both run PScanConfig::production() at DEFAULT_PSCAN_CADENCE (60 s, rule-75 rationale + bounds documented on the constant); the config-injectable seam stays crate-private (start_pscan_with) for tests. The returned PScanHandle is embedder-held, not engine-held — the running task's store holds a strong engine arc, so engine-held storage would make the pair immortal; embedder-held makes "close stops the task" ownership-enforced (close(self) is unreachable until the handle is shut down and Arc::try_unwrap succeeds). The transient #[allow(dead_code)] chain through block_source/cadence/task/accrual is removed; remaining allows each name their later consumer (2d-2 posture selector, SP-7 C_min, SP-R0 reconcile GC, cold-start cover discovery). Lifecycle tests cover staker auto-start, non-staker quiet path, double-start refusal (single-flight), shutdown-releases-engine, and restart-after-stop.

Changed

• net: rotated NETWORK_ID for all three networks (mainnet, testnet, stagenet) (src/cryptonote_config.h). The GENESIS_TX for every network was regenerated during the post-v3.1.0-alpha.3 work, but the NETWORK_ID handshake identifiers were left unchanged — the exact silent-fork combination the RELEASE_PROMOTION.md §6 frozen-tuple gate warns about (same network id, incompatible genesis → peers attempt to connect, then reject each other's genesis block). Rotating the ids makes the fresh-genesis network cleanly distinct so pre-rotation and post-rotation nodes cannot even attempt to peer. Pre-genesis, no live network stands on the old tuple, so this is a rm -rf ~/.shekyl + re-sync change with no migration path (per 15-deletion-and-debt.mdc). Gates the next testnet rehearsal release, which must run TESTNET_REHEARSAL_CHECKLIST.md from clean datadirs per §6.
• ci: CodeQL C/C++ runs buildless; ignores vendored external/ code (.github/workflows/codeql.yml, .github/codeql/config.yml). Switched the analyze-cpp job to build-mode: none and added paths-ignore: ['external/**']. The path filter is the goal — dropping the standing vendored highs in external/db_drivers/liblmdb/mdb.c (cpp/integer-multiplication-cast-to-long, cpp/comparison-with-wider-type) and external/qrcodegen/QrCode.cpp, which Shekyl never patches in place — but config-file paths-ignore only applies to a compiled language analyzed without a build, so the buildless switch is what makes it effective (a trace-based build silently ignores it). Those queries stay live on Shekyl-owned src/; the crypto/consensus/amount logic that once justified a deep trace-based build now lives in Rust (covered by the separate analyze-rust job), and C/C++ src/ currently has zero open Shekyl-owned CodeQL highs. Side benefit: drops the ~150-minute C++ build from CI. Prevents dev→main release PRs from re-attributing pre-existing library alerts as PR-introduced. The pre-existing per-id query-filters (rust/hard-coded-cryptographic-value, cpp/upcast-array-pointer-arithmetic) are unchanged and remain a distinct, results-stage safety net.

Documentation

• docs: submit-verdict / 2c completion-status sweep (rule 91). Landed work is now marked landed where the docs still read as pending: DAEMON_SUBMIT_VERDICT.md §12 gains a series-status banner (all six PRs merged as #244/#247, #245, #246, #248, #249, #250) and §10 item 1 records the F40 wire amendment + R1 pin as landed (#254, R2 riding 2c-2b); the docs/FOLLOWUPS.md submit-outcome SUPERSEDED entry's absorbed remainders are closed. Two stale-doc residues the PR-6 sweep (#250) missed are corrected: V3_ENGINE_TRAIT_CONFORMANCE_LENSES.md's CL-4 exemplar and V3_ENGINE_TRAIT_BOUNDARIES.md's §4 idempotency row/retry prose no longer cite the retired AlreadyKnown dedup heuristic — submit_transaction idempotency is stated as the verdict contract's resubmit-is-a-status-query property (§2.5/F31).

Added

• wallet: submit lifecycle driver — the §5.3 watchdog actor + F40 re-scan executor / R2 breaker land (DAEMON_SUBMIT_VERDICT.md §5.3 / §2.5 / §10 items 1 & 8; docs/FOLLOWUPS.md AlreadyInChain entry, now resolved). The landed-inert submit-watchdog kernel gains its production consumer: SubmitLifecycleDriver owns the persistent overlay (escape- ladder wait epochs, alarm latches, F40 re-scan / R2 counters) and, on each tick, projects the F14-lock-derived held submits, fetches daemon health (new DaemonEngine::get_health surface), runs the escape ladder per held tx (projection → health gate → rung-1 resubmit-same-bytes probe → outcome), and drains the PendingTxState rescan queue to execute the F40 targeted re-scan. The probe uses an ephemeral in-memory held-bytes store (retained at finalize-accept / finalize-already-in-chain, pruned when the hash leaves the held projection); after a restart the bytes are gone and the probe rung degrades to the operator-alarm rung, converting a would-be silent cross-restart re-broadcast into a human decision (rule-21 reversion clause: durability-only reopen, auto-vs-confirm stays a separate human-in-the-loop axis). The re-scan is cheap-check-then-escalate: one block-hash fetch at the claimed height compared against the ledger's stored hash — match + spend still unobserved = fruitless (per-txid consecutive counter), divergence = defer to refresh reorg-heal (counter untouched), capping a lying daemon's per-lie cost at one fetch. The fruitless-soundness guard (claimed_height ≤ synced_height, re-checked at execution) keeps the inference sound: an above-synced request re-routes to the §2.6 path-1 wait, never the counter. F40-R2 trips at 3 consecutive fruitless re-scans → PendingTxDiagnostic::FruitlessRescanBreakerTripped operator alarm; F40-R1 is structural (the lock stays placed — no path here releases it). New bounded diagnostics: WatchdogAlarm, FruitlessRescanBreakerTripped, WatchdogProbeDispatched, WatchdogProbeResolved. Exposed via the public Engine::run_submit_lifecycle_tick (production call site: after each refresh cycle); the former #![allow(dead_code)] on the kernel is lifted. Fifteen driver regressions land over a hermetic StubHost/StubDaemon (submit_lifecycle::tests), including the R2 breaker test explicitly deferred from #254.

• wallet/rpc: AlreadyInChain { height } — the F40 disposition lands (DAEMON_SUBMIT_VERDICT.md §2.2 carve-out / §2.5 row / §10 item 1; docs/FOLLOWUPS.md AlreadyInChain entry). The wire verdict grows the required height field (frozen fixture updated atomically per the §2.3 third-category rule; new skew test D pins a field-less already_in_chain to the deserialization-error arm). The daemon reads the confirming-block height under the same lock scope as the membership fact (in_chain_height, FFI snapshot size 80 → 88) and emits it at both the Phase-B short-circuit and the Phase-D classify_race settled arm. Wallet-side, finalize_submit_already_in_chain is reshaped from the superseded "no lock, refresh settles" interim (#252) to F40: the F14 awaiting-confirmation lock is placed in both height cases (no selectable-input window either way), baselined at the claimed height; height routes only the release path — above-synced waits for §2.6 path-1 refresh catch-up, at/below-synced emits the new PendingTxDiagnostic::TargetedRescanRequested for the reorg-heal re-scan. F40-R1 (rescan never releases) is structural and pinned by regression; the re-scan executor consuming TargetedRescanRequested and the R2 fruitless-re-scan breaker land in the submit lifecycle driver (see the driver entry above).

• wallet: posture→submitter dispatch — the frozen SP-T4a §3.1 shape lands (ARCHIVAL_BOND_2D2_SP_T4_BROADCAST.md §3.1, frozen 2026-07-04; docs/FOLLOWUPS.md 2c-2a dispatch-shape entry). The closed-set BroadcastSubmitter<D> { Local, PerP } enum with match-delegation (RPITIT, no Box), the single for_posture construction choke point carrying the ②→PerP routing guard (an OwnRemote broadcast can never ride the shared principal connection — the first-seen-origin leak the dispatch closes), the PBoundBytes byte↔persona newtype equality-checked at the submit_bound façade (debug_assert loud in dev, fail-closed PersonaMismatch in release), and PTransactionSubmitter tightened to for_persona so the persona↔circuit binding is by construction and the retained PCanonicalId feeds the pairing check. Lands inert (allow(dead_code); proving tests are the callers) — the 2c-2b request path is the lift condition and owns the P-1/P-2 provenance pins.

• standoff/engine/sim: 2c-2b block-timed placement wiring + GF-7 measurement seam (docs/design/ARCHIVAL_BOND_2C_GF7_HOOKS.md §6 acceptance criteria, all five). shekyl-standoff gains plan_entry_seam/EntrySeamPlan — the single-sourced consumer of the full draw_entry_gap tuple (order-coin cannot be dropped; the triangular mis-build cannot be re-introduced) — and, behind the non-default gf7-hooks feature, the BroadcastTimelineObserver seam with the three-axis joint TimelineEvent vocabulary. The StakeEngine::SignBond handler now consumes both draw values into the plan and replies with SignedBondPost (signed vin + placement plan, never decoupled), emitting draw-consumption and schedule events to the injected observer (production injects the no-op). shekyl-staking-sim --gf7-timeline is the §6.3 pipeline proof: the only recording observer, all three event classes through one recorded timeline per pair, funding-seam-blind + funding-seam grading arms over the recorded stream only (on the fixed seed the jitter degrades the funding arm 0.999→0.242 across windows 0→600 while the blind arm plateaus ~0.55 over a 0.125 baseline — the residual the measurement round will grade). CI gains ci/gf7-no-emit-guard (§6.4): a dependency-graph assertion that shekyl-staking-sim has zero dependents and a per-crate feature-resolution check that gf7-hooks never resolves on production edges outside the sim, with a positive control against rename-vacuousness. The §6.5 no-behavioral-delta argument is documented in the stake_engine module docs.

• docs: GF-7 measurement-hook specification — the evidence pipeline for the genesis gate (2c design round, docs/design/ARCHIVAL_BOND_2C_GF7_HOOKS.md). GF-7 (principal↔P timing unlinkability, GATE6 §10.12) is a genesis blocker whose P(link | T_obs) first becomes measurable when the 2c-2b scheduler broadcasts a bond-post on a real timeline. The new spec pins what that scheduler must emit before its wiring PR lands: an injected BroadcastTimelineObserver seam (no hardwired sink), a three-axis joint event vocabulary — principal lifecycle, bond-post with the consumed draw parameters, P's other broadcasts — graded jointly per the co-triggered-firewalls principle, with the funding-seam-blind adversary as a first-class arm (the named certifies-the-wrong-gate failure mode). Containment is build-structural, three independent layers: inert-by-type trait, sim-only recording impl enforced by a CI dependency-graph assertion, and a non-default gf7-hooks feature compiled out of release (the shekyl-standoff conformance shape). The 2c-2b wiring PR is gated on the spec's §6 acceptance criteria; threshold-setting stays with the sim-side measurement round.

• rpc: shekyl-rpc-types crate — the typed wallet↔daemon submit contract (docs/design/DAEMON_SUBMIT_VERDICT.md §2, PR-2 of the submit-path Rust cutover). SubmitVerdict / RejectCause / SubmitTransactionRequest as the single Rust definition both shekyl-daemon-rpc and shekyl-rpc-client will consume, replacing the Monero-inherited status-string-plus-booleans reply schema. Ships with the §2.3 version-skew pins (unknown cause → Unrecognized fail-safe; unknown verdict tag → Err arm; unknown fields tolerated), frozen JSON representations for every variant, and the §3.4 frozen-hex txid KAT (C++-daemon-captured oracle blobs proving shekyl-wire txid ≡ C++ get_transaction_hash). Contract is draft until the §8 parity matrix's ⚠-rows resolve (that document's freeze rule).

• daemon: SEEDHASH_EPOCH_* override now refuses to start on every public network. The RandomX seed-epoch schedule is consensus; the SEEDHASH_EPOCH_BLOCKS / SEEDHASH_EPOCH_LAG env overrides are a fakechain-only (regtest) lever. A node started with the lever active computed wrong seedheights and silently rejected every block its peers accepted (warn-only since the #235 port) — self-forking mainnet, or the testnet/stagenet rehearsal infrastructure, if the lever leaked in from a shared environment. Init now fails closed with an actionable error on MAINNET, TESTNET, and STAGENET; FAKECHAIN (regtest daemons and test fixtures — the lever's legitimate fast-epoch use) keeps the warning-only behavior.

• pow: runtime differential modes wired into CI (RandomX v2 test-regime hardening, runtime-mode change). The harness's --mode=correctness three-leg differential (Rust ≡ C ≡ canonical) is now merge-blocking per-PR at per-PR sizing and full-size on the daily cron; --mode=latency (T5, ≤3.0× in-mode ratio gate, interleaved same-process sampling) and --mode=concurrent (T7 concurrent byte-equality + T8 RSS ceiling — the deferral's last unwired runtime mode) run in a dedicated runtime-modes cron job on both active branches (main + dev matrix; opt-in on dispatch via the runtime_modes input, so a parity-recovery dispatch is not forced red by T5's disclosed known-over-budget state, and with a triage band that classifies a T5 red as known-state vs fresh regression); and the T6 adversarial worst-case-ratio gate gets a weekly cron (previously dispatch-only; also main + dev matrix) plus a concurrency group and the pinned install-rust composite (replacing a dtolnay/rust-toolchain@stable moving-ref). set_canonical's eager-derive claim is now a state-probe test (epoch rollover cannot stall the first post-boundary verify). The rustup sweep completed repo-wide: every inline/env-block rustup install (14 sites across 8 workflow files, including build.yml and the disabled release workflow) now uses the hardened install-rust composite — cross-target sites add a separate rustup target add step (the depends.yml pattern) — so zero curl | sh or hand-copied recipes remain.

• pow: native-aarch64 CI lane (RandomX v2 test-regime hardening PR-2). New native-arm job on ubuntu-24.04-arm (native silicon, deliberately not qemu — softfloat would mask a real FP-rounding divergence): verifier crate tests, the T2 adversarial byte-equality against an arm-built C oracle, a new canonical_pins_full test re-deriving all 1024 committed canonical pins, and the harness's three-leg --mode=correctness (Rust ≡ arm-built C ≡ canonical over the same 1024) — the first-ever CI executions of the fpu_rounding FPCR path and of the correctness mode. The 1024-pin test also runs per-PR on x86_64. The rustup install (all four jobs) and the out-of-band C-reference build (the three jobs that use it; full-parity builds through the parent CMake project) are now composite actions (.github/actions/install-rust, .github/actions/build-randomx-v2-ref).

• pow: the Phase 3a full-dataset parity gate is wired into CI (RandomX v2 test-regime hardening PR-1). New full-parity cron job in randomx-v2-differential.yml: daily subset / weekly full sweep of the C full-dataset (miner mode) vs Rust light-cache (verifier) parity harness, now widened to re-check all 1024 Phase 2g canonical pins under C-full-dataset (gen-parity-corpus + corpus harness mode), plus a separate-process miner-shaped KAT provenance test (randomx-v2-miner-kat) and a binary nm symbol-isolation gate on the linked daemon (check_randomx_symbol_isolation.sh).

• crypto/wallet: real-tree FCMP++ prove→verify roundtrip now works (feat/ct-5-real-tree-verify). The first test to verify an FCMP++ membership proof over a real multi-layer assemble_path (join_market_bond_post_fcmp_verify_over_real_tree, previously #[ignore]d) was failing BatchVerificationFailed. Root cause: shekyl-curve-tree::assemble emits partial (narrow) branch chunks for incomplete tree nodes, but the FCMP membership circuit requires the full chunk width — a seam the upstream FCMP tests never exercise (they always fill to width), and the prover doesn't catch (it ignores the root). Fixed by zero-padding branch chunks to width in shekyl_fcmp::proof::prove / prove_with_sal: zero scalars vanish in the layer hash, so the consensus tree root is unchanged (no daemon/consensus change, no CT-2 Tier-A regression), and the daemon's shekyl_fcmp_verify — the same Rust verify via FFI — accepts it. The audited vendored FCMP crypto was sound; the bug was first-party (our driving). Closes PR 2c-1's deferred verify half and the 2a real-tree milestone; covers depth-2 (deeper trees tracked in FOLLOWUPS.md). Regression KAT: ct5_partial_branch_chunk_is_padded_and_verifies.

• wire: real consensus-valid FCMP++ spend round-trip (shekyl-wire/tests/fcmp_spend_e2e.rs). New end-to-end test that builds a real, consensus-valid FCMP++ spend entirely in Rust — a depth-3 Selene/Helios curve tree (700 outputs, exercising both c1 and c2 branch layers, the multi-layer path that broke the C++ spend), assemble_path → SpendInput → sign_transaction → sign_pqc_auths — self-validates it against the Rust consensus rules (shekyl_fcmp::proof::verify, verify_rct_balance, Bulletproof::verify), then proves shekyl-wire serializes it byte-identically (read(write(x)) == x, deterministic re-emit). The oracle is the consensus verifier itself, not a captured blob.

• wire: removed the unsound #[ignore]d live-oracle spend KAT (regtest_spend_round_trips_byte_identical in shekyl-wire/tests/fcmp_spend_roundtrip.rs) and its capture script (tests/vectors/capture_spend.py). The KAT planned to round-trip a "known-good" FCMP++ spend blob captured from the C++ daemon, but the C++ FCMP++ spend path never produced a daemon-accepted transaction — there is no known-good blob to capture, and building one to capture would be constructing the house to draw the blueprint. The byte-identity proof now rides the Rust-built, consensus-validated spend in fcmp_spend_e2e.rs (above). The synthetic read(write(x)) round-trip and structural rejection tests in fcmp_spend_roundtrip.rs are unchanged.

• wallet: archival StakeEngine lifecycle wiring (Model D) -- inert (PR 2c-2a) (docs/design/ARCHIVAL_BOND_CONSTRUCTION.md §10.2, feat/archival-stake-wiring). Wires the inert 2b StakeEngine into the engine lifecycle under Model D, which eliminates session-long master-seed retention: the actor no longer owns the seed. At assemble(), a staker-flagged wallet derives the derive-forward set — {personas with live bonds} ∪ {p_slot ..= p_slot + k} (k = 2, bounds [0, 8]) — synchronously inside the sync open/create call (staker-only; one PQ keygen per slot), hands the pre-derived ArchivalPKeys bundles to the actor, and drops the borrowed seed (&[u8; 64]) at function end, exactly as for AllKeysBlob. The whole create / open_full call is the blocking unit async callers already wrap in spawn_blocking, so the keygens are off the async hot path at that granularity; intra-call parallelism across the (small, k-bounded) set is a documented perf follow-up, not done here. Non-stakers derive and hold nothing (Engine.stake == None). Lookahead exhaustion / first-stake mid-session / post-panic recovery all resolve via reopen — no re-auth or KEK machinery.

  • New sealed StakingBlock in WalletLedger (shekyl-engine-state, region-2 state file; STAKING_BLOCK_VERSION = 1, WALLET_LEDGER_FORMAT_VERSION bumped, schema snapshot + CI pairing added). Carries staking_enabled, the p_slot cursor, and bonded_slots (the per-persona live-bond record). Chosen over SettingsBlock (C++/FFI surface, not loaded by assemble()) and WalletPrefs (advisory tier — a tamper-reset would silently drop funds-load-bearing state); the ledger is the semantically correct home for chain-reconciled bond bookkeeping and gives AEAD sealing + atomic_write_file (tmp → fsync → rename → fsync(parent)) crash-atomic durability.
  • bonded_slots is a reconcilable hint, not truth (flat Vec<u32>, documented semantics) so the 2d scan-reconcile GCs phantom records (from a persist-before-sign crash) without a second version bump.
  • p_slot is a scan-reconciled monotone cursor — current = max(persisted p_slot, highest_bonded_slot_seen + 1) (StakingBlock::monotone_current_slot) — a privacy property: it can never re-activate a retired persona (which would link its activities), and it heals a rolled-back cursor without depending on a region-2 anti-rollback property.
  • PersistedBondTicket persist-before-use typestate (the cross-split seam): Engine::persist_bond_record(..) -> PersistedBondTicket is the sole producer; the ticket is !Clone, consumed by value, and minted only after a durable save_state, so 2c-2b's sign_bond(ticket, ..) makes sign-before-persist uncallable.
  • Operation-scoped PersonaHandle minted only for held personas (collapses the can't-happen PersonaUnreachable to one slot→handle boundary; keeps LookaheadExhausted as a real domain error), !Clone, with an actor generation counter that rejects a stale handle after rotation (StaleHandle) — closing the use-after-wipe on a wiped ephemeral persona.
  • HeldPersona Bonded/Ephemeral with a wipe_ephemeral path that consumes only the Ephemeral variant, so "wipe a persona with a live bond" is uncallable — the bonded-union invariant (retired-but-bonded personas stay resident so unbonding remains reachable) enforced by type. Drops the actor's StakeMasterSeed root, in-handler spawn_blocking, and in-actor derivation error path. Landed inert: wired, derived, spawned, and test-exercised (12 stake_engine + 2 stake_persist tests, incl. durable persist+reopen and staker-reopen-over-bonded-union-lookahead), with no JoinMarket request path (that, the typed timing seams, the live RNG check, and the milestone KAT land in PR 2c-2b; broadcast/re-anchor + Arti transport in PR 2d). The CT-5d re-anchor finding (persona signature binds tx_prefix_hash, not the proof) is pinned now so the schema and derive-forward set are correct when 2d wires submission. See FOLLOWUPS.md "StakeEngine Model D wiring" for the deferred-work reopens.

• crypto/economics: archival bond-post construction PR 2c-1 -- real-tree composition KAT (docs/design/ARCHIVAL_BOND_CONSTRUCTION.md §3, feat/archival-bond-realtree-kat). PR 2a closed the bond round-trip over a synthetic depth-1 tree; PR 2c-1 re-runs the same composition over a real curve tree. The new test join_market_bond_post_signs_and_verifies_over_real_tree (in shekyl-engine-core::engine::local_pending_tx::tests) spends a drained leaf of the consistent funded_ledger_and_tree fixture, assembles its membership path via the production CurveTreeClient::assemble_path (the same path build_then_submit_marks_outputs_spent drives), carries the bond's bond_credit through shekyl-tx-builder::sign_transaction_with_terms as the sole output-side cleartext term over genuine depth-2 branch layers, and checks BP+, the RCT balance over prover-emitted commitments (with 8*C → C cofactor recovery), and verify_join_market_bond_post/the hybrid signature accept+reject. Scope honesty: the construct→prove half over real branch layers is proved here; the FCMP++ verify-accept half over a real multi-layer path is the one piece still gated on the CT-5 series closing the upstream Fcmp::prove↔verify roundtrip (no workspace test verifies a real multi-layer path today; the first attempt returns BatchVerificationFailed), so it rides as an #[ignore]d sibling (join_market_bond_post_fcmp_verify_over_real_tree) rather than a faked pass. See FOLLOWUPS.md "real-tree FCMP++ verify" for the reopening trigger.

• wallet: archival staking actor (StakeEngine) -- inert (PR 2b) (docs/design/ARCHIVAL_BOND_CONSTRUCTION.md §10/§10.1, feat/archival-stake-engine). The gate-6 staking firewall realized as actor isolation: a new kameo actor (shekyl-engine-core::engine::stake_engine) that owns the wallet's master_seed_64 and the active archival persona P, structurally disjoint from the LedgerEngine transfer pipeline. It mirrors the KeyActor/KeyEngineHandle discipline:

  • Operation-shaped protocol, public-only replies. Messages name operations (ActivatePersona, ActivePersona); replies carry only public material -- PersonaIdentity holds the typed HybridPublicKey (P_pubkey), a type with no secret field to leak. The secret ArchivalPKeys bundle (!Clone + per-field ZeroizeOnDrop) cannot be requested or copied out of the actor.
  • Typed domain values (Rust-first, rule 20): PSlot(u32) newtype so a persona slot can't be confused with any other index; StakeMasterSeed newtype (Zeroize/ZeroizeOnDrop, not Clone, redacted Debug) so the wipe discipline lives on the type; typed StakeEngineError.
  • Lazy derivation off the hot path. An idle actor holds no persona (active == None); the first ActivatePersona derives via derive_archival_p_keys on tokio::task::spawn_blocking (PQ keygen is CPU-bound). The only copy of the seed leaves as a Zeroizing buffer wiped at closure end.
  • Atomic rotation + re-derive-on-restart. Slot rotation is a single state transition (derive-into-local, then one assignment that drops/wipes the old) -- never two live personas (§10.9), never a gap with none. The bundle is not persisted; the actor re-derives deterministically from master_seed_64 on every (re-)spawn.
  • Fail-stop, not supervised. A handler panic returns ControlFlow::Break; afterward every handle call collapses to the terminal, user-facing StakeEngineError::StakeActorUnavailable ("close and reopen the wallet to recover"). Recovery re-derives every P. Landed inert: registered and exercised by tests only (idle-has-no-persona, lazy derive matches the ARCHIVAL_P_DERIVE_V1 oracle, rotation, cross-respawn determinism, impermissible-seed-format error, require-ambient-runtime, fail-stop terminality). PR 2c wires it into the open/create lifecycle with its first consumer (the JoinMarket bond request), so no seed-holding actor comes into existence until something uses it.

• crypto/economics: archival bond-post construction PR 2a -- full-prover synthetic-tree round-trip KAT (docs/design/ARCHIVAL_BOND_CONSTRUCTION.md §3, feat/archival-bond-roundtrip-kat). PR 1 closed the bond balance against a hand-built (synthetic) balance witness; PR 2a closes it against the real FCMP++ prover. The new test join_market_bond_post_signs_and_verifies_through_prover (in shekyl-engine-core::engine::local_keys::tests, reusing the M3c synthetic depth-1 tree and key-derivation fixtures rather than promoting them to public API) builds a JoinMarket vin with shekyl-archival-bond-builder, carries its bond_credit through shekyl-tx-builder::sign_transaction_with_terms as the sole output-side cleartext term, and checks the prover-emitted commitments against the genesis-frozen verify side: verify_join_market_bond_post, the hybrid signature under P_pubkey, the Bulletproof+ range proof, the FCMP++ membership proof, and verify_bond_post_rct_balance. It also asserts the verify side rejects a wrong bond_credit (SumMismatch), a tampered output commitment, a tampered signature preimage, and a replayed post (RecordExists) -- the honest milestone is "valid accepts and invalid rejects." One encoding bridge: sign.rs emits output commitments as 8*C (wire cofactoring) while the balance equation is defined over the prime-order C, so the KAT recovers C = (8*C) * 8^{-1} before the balance check. Adds shekyl-archival-bond-builder + shekyl-archival-retention as shekyl-engine-core dev-deps (first-party path-deps, no new third-party supply-chain surface, no dependency cycle). Tree stays synthetic; on-chain end-to-end remains CT-5 work.

• wallet: CT-5d submit-time proof re-anchor (reprove) + consent gate (docs/completed/CT5D_REANCHOR.md, feat/ct-5d-reanchor-closeout). A built-but- unsubmitted FCMP++ proof anchors to a reference block tip − REF_ANCHOR_AGE; a tip advance past the rebuild horizon, or a reorg that orphans the reference, would otherwise degrade to a submit-time daemon rejection. The submit path now re-anchors instead of rejecting:

  • The reference is the submit staleness authority (should_reanchor || reference_orphaned), replacing the SnapshotId check that invalidated on every block — a benign tip advance now broadcasts the existing proof as-is.
  • When stale, submit reproves in place (fresh reference, re-assemble, re-sign) three-phase so the prover never holds the pending-tx lock (mirrors build; the shape the Stage-4 PendingTxActor migration needs). The fresh reference is selected under a two-sided ingested-tip gate (anchors at/below the ingested tip; refuses a reference already past the rebuild threshold).
  • Consent: submit(id, seen_gen) gates broadcast on a content_gen that advances only when the re-anchor changes the realized (fee, recipients, change) — fingerprinted semantically + canonically (excludes the re-randomized change address; invariant under the output shuffle). A change is withheld as SubmitError::ContentChanged for re-confirm; broadcasting unauthorized content is unrepresentable.
  • ConsumerHeldEntry carries the rebuild substrate (request, reference, content_gen, fingerprint); PendingTx exposes content_gen + reference_height. Runtime-only state — no schema migration.
  • Deferred (rule-21): the content-changing reselect path (deep reorg orphaning a selected input, or fee escalation) fails clean as SubmitError::ReselectionRequired (discard and rebuild) rather than transplanting locks under the stable rid; see FOLLOWUPS.md.

• crypto/economics: archival bond-post construction PR 1 -- single-sourced RCT balance + JoinMarket builder (docs/design/ARCHIVAL_BOND_CONSTRUCTION.md §7, feat/archival-bond-builder). The construct side of the archival bond, the mirror of the genesis-frozen shekyl-archival-retention verify side. Three pieces:

  • shekyl-rct-balance (new crate) single-sources the genesis-frozen RCT cleartext balance equation sum(pseudoOuts) + extra_inputs = sum(out_masks) + fee + extra_outputs and its typed-side terms. The side is a type, not a runtime tag: InputTerm and OutputTerm (checked-u64 newtypes over AtomicUnits) make a wrong-side cleartext term unrepresentable. The verify equation that previously lived in shekyl-archival-retention::bond_rct_balance migrated here; bond_rct_balance now wraps it with the bond-specific credit-xor-debit term rigidity. Imported by both shekyl-tx-builder (construct) and shekyl-archival-retention (verify), so the two cannot diverge on a consensus rule (§7.2 / §11.1 Q2).
  • shekyl-tx-builder gains sign_transaction_with_terms, threading the shekyl-rct-balance typed-side terms into funds-sufficiency validation; sign_transaction is now a zero-terms wrapper, so the transfer path is unchanged. The crate stays bond-agnostic (never names "bond"; it consumes generic typed-side terms).
  • shekyl-archival-bond-builder (new crate) builds the JoinMarket ArchivalBondPostVin (bonded_total == bond_credit == bond_floor, bond_debit == 0), signs its preimage with the P identity hybrid key, supplies bond_credit = floor as the OutputTerm, and enforces the credit funding rule. The masked commitments + FCMP++ membership proofs are left to the prover (PR 2); re-deriving them here would be a second construction path for a genesis-frozen commitment. A round-trip KAT (tests/join_market_round_trip.rs) derives P, constructs + signs the vin, and confirms verify_join_market_bond_post + verify_bond_post_rct_balance accept against a synthetic balance witness -- the honest §3 milestone (not an on-chain bond; that is CT-5 work). Cross-refs: FOLLOWUPS.md (construction-flow item; "RCT" naming-review item deferred to a separate PR).

• docs: design the wallet-side archival bond-post construction flow (docs/design/ARCHIVAL_BOND_CONSTRUCTION.md, 2026-06-17, docs/archival-bond-construction-design). The verify side (shekyl-archival-retention) is the fixed, genesis-frozen contract; construction genuinely does not exist yet (no builder, no bond_credit in the RCT balance, no P-identity derivation). The doc specifies the full four-kind architecture (so JoinMarket-first does not paint into a corner), implements JoinMarket only, and single-sources by importing the validated verify-side types. Key calibrations recorded: (a) the honest milestone is the round-trip KAT (construct -> verify accepts) against a synthetic curve tree, not a bond on a real chain -- on-chain is a sequenced dependency on the real CurveTreeClient (CT-5); (b) shekyl-tx-builder gains a generic extra cleartext balance term (the way fee is one; the verify side already treats fee and bond_credit symmetrically as amount_h(...)), bond-named only in the bond crate; (c) the other three kinds (Rebond/Unbond/HoldingsUpdate) are provisional (paper-only, reopenable when their verify+construct PRs land); (d) PR 2 runs the standoff self-cert (certify_draw against the wallet's actual CSPRNG), not just draw_entry_gap. Review target 2-3 rounds (not 4-6: the construct side is largely determined by the validated verify side). PR 0 (archival_p derivation) is built in parallel, not gated on the doc's rounds -- its design is settled (gate-6 §9.3/§9.4) and it is the highest-stakes primitive in the project. Cross-refs: FOLLOWUPS.md (construction-flow item), ARCHIVAL_FIREWALL_GATE6.md §9, STAKER_OPERATOR_GUIDE.md (slices i/ii attach here).

• docs: publish the staker-operator opsec + setup guide (docs/STAKER_OPERATOR_GUIDE.md, 2026-06-17, chore/staker-operator-guide). First slice of the operator-experience work unit (the post-seal pivot: the staker-archival parameters are frozen; the remaining risk lives in operator behavior, where the sim is silent). The guide consolidates the residuals the design rounds routed to operator education into one audience-scoped doc: the drop-to-reallocate capital strand (freed collateral is frozen for the 2-epoch release cooldown -- do not drop a shard to fund another within it), the shared-anchor funding tell (let the wallet draw the uniform-independent entry gap; do not batch/schedule/hand-roll it), the anonymity-transport and P↔principal isolation opsec (loud refusal, never clearnet fallback), and the cold-start thin-cover consequence (earliest operators carry the thinnest entry cover and must be the most conservative). The guide is also the spec the V3.1 wallet-conformance guards implement against; items it can only ask the operator to self-enforce today are marked [operator-enforced until V3.1]. Cross-refs: FOLLOWUPS.md (operator-experience item, slice 1 landed).

• archival: single-source the funding-seam entry-standoff draw into shekyl-standoff + generic goodness-of-fit primitives into shekyl-stats (2026-06-16, feat/standoff-shared-crate). First slice of the implementation-drift-guard substrate: the load-bearing standoff draw moves out of #[cfg(test)]-local sim code into a library crate the wallet, sim, and (future) verifier all import, so "what we validated is what ships" holds by construction. shekyl-standoff ships a float-free draw::draw_entry_gap (s ~ U[0, window] via unbiased integer rejection sampling over a minimal GapRng trait) in its default build — zero #[allow(clippy::cast_*)], so float-freeness of the wallet's production path is machine-enforced, not a module-boundary claim — and gates the float grading + RNG-generic certify_draw self-cert harness behind a conformance feature. The published KAT is split along the determinism boundary: tests/golden_vector.rs (default features, the integer (spread, order) sequence, bit-identical and now run on the aarch64 qemu-user lane) and tests/conformance_grading.rs (conformance feature, float grading, x86-only because float is not bit-identical across arches). shekyl-stats is the new dependency-free home for the generic primitives (chi_square_upper_crit, Z_ALPHA_1E6, discrete-uniform chi-square, lag1_autocorr); shekyl-staking-sim and shekyl-crypto-pq (its enc_label test, previously carrying duplicated literals) both dedup onto it. No wallet call site yet — the crate is made importable ahead of the unbuilt V3.0 funding flow. Docs: ARCHIVAL_FIREWALL_GATE6.md §10.12, STAKER_ARCHIVAL_SIM.md, FOLLOWUPS.md (funding-seam carry 2 + wallet-wiring + alpha-provenance items).

Fixed

• tx-builder: FCMP++ output commitments are the real Pedersen commitment, not cofactor-scaled. shekyl-tx-builder::sign now emits outPk[i] = C = mask·G + amount·H (×1) instead of 8·C. The consensus balance check sum(pseudoOuts) == sum(outPk) + fee·H (verRctSemanticsSimple) sums these points directly and the pseudo-outs are real C, so the output side must match — the prior 8·C broke balance verification. Surfaced and validated by the new shekyl-wire/tests/fcmp_spend_e2e.rs (its verify_rct_balance stage). The C++/Rust FFI spend-path debugging that surfaced this was otherwise reverted as out-of-scope C++ debt; the findings are captured in FOLLOWUPS.md ("C++ FCMP++ wallet send path incomplete"). The wire/scanner contract already required real C — the production scanner recomputes z·G + amount·H and byte-compares it against the on-wire commitment, and sign_bridge copies SignedProofs.commitments straight onto the wire — so the fix aligned the builder with the rest of the stack. The downstream documentation and the two shekyl-engine-core bond-post round-trip test helpers (which had compensated for the old encoding by multiplying by 8⁻¹) were reconciled to feed the real C directly.

Removed

• rpc: delete the legacy transaction-submit surface (docs/design/DAEMON_SUBMIT_VERDICT.md §9, PR-5 of the submit-path Rust cutover, chore/submit-legacy-deletions). The typed /submit_transaction route (Rust admission engine, PR-3) is the only submit surface; the §9 deletion enumeration executes with its greps re-run as the completeness check:
  • on_send_raw_tx endpoint (§9.3): handler, epee route maps, the COMMAND_RPC_SEND_RAW_TX defs with their eleven-boolean reply schema, the core_rpc_ffi DJSON dispatch entries, and the shekyl-daemon-rpc axum proxy routes. wallet2::commit_tx ports to the typed endpoint via a transport-only epee mirror (COMMAND_RPC_SUBMIT_TRANSACTION); the trezor mock daemon serves the typed route as a test-only pool-admit stand-in.
  • tx_sanity_check (F29, §8.8/§9.2): S1 duplicated the Rust Phase-A parse gate; S2 (coinbase-submit reject) lives in the engine; S3 (decoy-median heuristics) was verified vacuous at runtime under FCMP++ (empty key_offsets → unconditional early-return true).
  • m_timed_out_transactions (D3, §9.1): the RAM-only eviction memory whose resubmit gate produced unexplained false-terminal rejections, contradicting the §5.2 retry contract. Resubmits of evicted bytes now re-enter full admission and resolve to a definite verdict.
  • python-rpc send_raw_transaction helper: superseded by submit_transaction (PR-3).
  • Kept per §9.4: the P2P add_tx ingestion path (with the PR-3 double-spend regression pin), tx_verification_context as an internal P2P contract, Dandelion++ relay machinery, and the relay-only on_relay_tx operator endpoint.
• rpc: delete the RPC-payment subsystem in its entirety (legacy-PoW cleanup, 2026-06, chore/rpc-payment-deletion). The Monero-inherited pay-for-RPC subsystem — clients hash RandomX/CryptoNight to earn "credits" they spend on daemon RPC calls — is removed across the daemon, the legacy wallet, the daemon↔wallet wire contract, and the Rust wallet's persisted prefs. It was orphaned dead code (the Phase-0 "delete in its entirety" decision, RANDOMX_V2_RUST.md §15) and the named blocker for the deferred Phase 3c/4 PoW C-core cleanup (FOLLOWUPS.md); this PR unblocks that cluster. Plan: docs/completed/LEGACY_POW_CLEANUP_PLAN.md. Net ≈1000–1500 lines across ~20 files; consensus-inert (RPC access control, not block validation — the parity/mining gates are untouched).
  • Wholesale-deleted files: src/rpc/rpc_payment.{cpp,h}, src/rpc/rpc_payment_costs.h, src/rpc/rpc_payment_signature.{cpp,h}, src/wallet/wallet_rpc_payments.cpp, src/wallet/wallet_rpc_helpers.h.
  • Daemon: removed core_rpc_server::check_payment(), the CHECK_PAYMENT* macros and all per-handler pay-gates, the m_rpc_payment / m_rpc_payment_allow_free_loopback members + init() plumbing, the COMMAND_RPC_ACCESS_{INFO,SUBMIT_NONCE,PAY,TRACKING,DATA,ACCOUNT} endpoints (structs + handlers + core_rpc_ffi.cpp dispatch), the rpc_payments CLI command (command_server/command_parser_executor/rpc_command_executor), and the payment parameters from bootstrap_daemon. RPC_TRACKER is kept as pure perf timing (its RPCTracker payment-tracking class is gone).
  • Wire contract: rpc_access_request_base / rpc_access_response_base (the client / credits / top_hash fields) collapse into the plain rpc_request_base / rpc_response_base; CORE_RPC_VERSION_MINOR 15 → 16 (backward-incompatible, but in-tree clients only, pre-genesis — 60-no-monero-legacy.mdc / 15-deletion-and-debt.mdc).
  • Legacy wallet: removed the pay-for-RPC client wiring from wallet2.{cpp,h}, node_rpc_proxy.{cpp,h}, wallet_args.{h,cpp}, wallet_rpc_server.cpp, and the payment_required error (wallet_errors.h).
  • Rust wallet: removed the orphaned RpcPrefs persisted-prefs bucket (persistent_rpc_client_id, auto_mine_for_rpc_payment_threshold, credits_target) from shekyl-engine-prefs — it had no reader or writer; PREFS_SCHEMA_VERSION 2 → 3 (pre-genesis: rm -rf ~/.shekyl, no migration owed). shekyl-daemon-rpc drops the three rpc_access_* restricted-method names; the Python RPC test framework drops its six rpc_access_* wrappers.
  • Out of scope (still deferred, tracked in FOLLOWUPS.md): RandomX v1 (rx-slow-hash.c) is retained as the consensus rollback hatch; CryptoNight slow-hash.c stays (live legacy C++ KDF callers — chacha.h, cryptonote_format_utils.cpp — migrate to argon2id first); the RX_BLOCK_VERSION #define stays (still referenced by mining_parity.cpp / chaingen.cpp on the PoW-dispatch surface); the IPowSchema / pow_registry / shekyl-consensus abstraction layer stays.

Changed

• wallet: submitter error split from the reservation-bound orchestrator error (docs/FOLLOWUPS.md "Submit-error reservation-id placeholder", closed; 2c pre-wiring). TransactionSubmitter::submit now fails with a reservation-unaware SubmitterError (RejectedTerminal / RejectedRetryable / Ambiguous — a closed enum carrying no ReservationId); the reservation-bound SubmitError arms are produced only by LocalPendingTx's finalizers, which bind the reservation under submit. The former ReservationId::new(0) placeholder in the submitter arms is unrepresentable, so the 2c StakeEngine submit consumer — which has no orchestrator re-binder — cannot observe a fabricated reservation id. Behavior-preserving for the existing wallet path (the finalizers already re-bound the real id); the change is to the type surface the second consumer will build against.

• wallet: AlreadyInChain submit verdict gets its distinct §2.5 lock-lifecycle disposition (interim) (docs/FOLLOWUPS.md "AlreadyInChain submit verdict", still open — F40 conformance pending; 2c pre-wiring; DAEMON_SUBMIT_VERDICT.md §2.5/§2.6). TransactionSubmitter::submit now succeeds with SubmitSuccess, splitting the Ok arm by disposition: Broadcast (Accepted / AlreadyInPool) places the F14 awaiting-confirmation lock as before; AlreadyInChain resolves through the new finalize_submit_already_in_chain, releasing the reservation and its output locks without placing a fresh awaiting-lock — refresh remains the settlement authority. Fixes the collapsed-Ok(hash) behavior that stranded inputs "awaiting confirmation" whenever the confirming block was at/below the wallet's synced height (no mark_spent re-observation, watchdog confirmed-absent release unbuilt). Note: this change predates the F40 design merge (AlreadyInChain { height }, §2.2 carve-out); it carried no height discriminant and implemented only the "no lock" shape the design round superseded. The F40 reshape landed in this same unreleased span (see the AlreadyInChain { height } entry above); its interim regression test is replaced by the two F40 routing tests.

• docs: constant-work-on-Conceal named as invariant F41 (2c design round, docs/design/DAEMON_SUBMIT_VERDICT.md §3.1/§10/§11). The stem-presence-oracle closure was held by an accident of absence: the Conceal path runs the full Phase-C battery and no verification cache exists — true, load-bearing, and previously asserted by nothing, so the first well-meaning perf PR adding a txid cache would have re-opened the oracle as a timing oracle (fast cached hit vs full-verify tells the foreign prober what the verdict no longer does). F41 states the coupling: any submit-path cache must exempt the Conceal path or equally delay it. Companions: a §10 timing-uniformity tripwire test (both Conceal and fresh-bytes submits run the full battery, asserted by verifier invocation counting); a §11 reversion clause naming the only terms a cache may land under (rate-limiter + F39 semaphore shown insufficient first); and the DoS-relief sibling pinned at the transport layer — per-source rate limiting, Owner never limited, Foreign per-source-limited — so the pressure that would motivate the cache is relieved where it cannot touch the timing property. Structural round (same day): F41's enforcement decomposed into three layers, each vector matched to what its layer can prove — the engine-cache vector (the realistic kill) becomes a compile error via move-only disclosure-capability tokens minted at disclose_pool_presence (MustFullyVerify on Conceal / FastPathEligible on Reveal/Absent; cache lookups accept only the latter; the Conceal route consumes the former by exchanging it for the §3.3 certificate — the P-1/P-2 mint-once/carry-through idiom applied to a capability); the transport-memoization vector becomes a named assumption with its own engine-entry test; and the invocation-count tripwire guards only the irreducible battery-timing residual, its necessary-not-sufficient seam documented (types don't prove timing — stated, not hidden). The tokens' sole-origin is itself structural, not conventional: both types are pub(crate) with a single constructor reachable only from disclose_pool_presence, inheriting the F25 write-site enumeration audit (§3.5 item 4 — "grep token construction = grep the disclosure choke point"), closing the construct-by-alternate-constructor side door (test helpers, Default, From) that the carry-not-reconstruct defeat alone does not answer. The §11 reversion clause is rewritten around the token: a Reveal-path cache type-checks freely; touching Conceal requires a compile-visible MustFullyVerify conversion naming F41. Implementation obligations and the ordering constraint (tokens + tests precede the first perf/cache PR touching submit) tracked in FOLLOWUPS.md.

• docs: dispatch-shape post-freeze wargame — byte-holder enumeration confirms the freeze, adds two provenance pins (2c design round, docs/design/ARCHIVAL_BOND_2D2_SP_T4_BROADCAST.md §3.1.1). The frozen §3.1 shape (closed-set enum + constructor choke point + PBoundBytes equality check) pins the check but not the provenance: the F31 status-query resubmit and the watchdog probe rung re-send held bytes, and a held record storing raw Vec<u8> forces a re-wrap at probe time — the choke point then validates the wrapper's claim, not the bytes' provenance, reopening the cross-persona/principal routing hazard on the retry axis. Two freeze-compatible pins close it: P-1 single private mint site in the assemble/sign module (possession is proof of provenance); P-2 the held record stores the PBoundBytes value itself, so every resubmit re-sends the stored value through the same choke path. Freeze confirmed, no reopen; the pins are recorded as §3.1 part 6 (mint-once / store-wrapped — an addition beside the frozen five) and are implementation obligations for the 2c wiring slices.

• docs: AlreadyInChain { height } — the F40 lock-release discriminant (2c design round, docs/design/DAEMON_SUBMIT_VERDICT.md §2.1/§2.2/§2.3/ §2.5/§4.1/§7.2/§10; closes the FOLLOWUPS AlreadyInChain design half). The unit AlreadyInChain verdict forced the wallet to guess which release path clears the awaiting-confirmation lock — a guess steerable by anyone who can slow the wallet's own daemon's block delivery into a selectable-input leak plus F28/F37 alarm fatigue. The verdict now carries the confirming-block height: the lock is placed in both height cases, and height routes the release (refresh catch-up above the synced height; targeted re-scan at/below it, falling through to the F31 status query). Recorded as a reasoned carve-out from §2.2 wire minimalism admitted through the §5 inform-never-drive principle, held by two pinned rules — F40-R1: a below-synced claim authorizes a re-scan and never a release (release stays refresh-/watchdog-authoritative); F40-R2: fruitless daemon-directed re-scans are breaker-bounded (F28/F37 family) to operator alarm, closing the lie-low wallet-work amplifier — plus a new §7.2 trust-rider row (damage-capped both directions), a new §2.3 schema-evolution category (required-field additions: atomic pre-genesis, optional-with-default post-genesis), and a §2.2 disambiguation note keeping F40 (wallet consumes a bounded height discriminant) distinct from F22 leg 2 (daemon cache fails to bind height — the opposite direction on the same field). Implementation lands with the 2c submit-consumer slices.

• docs: submit-verdict series stale-doc sweep (docs/design/DAEMON_SUBMIT_VERDICT.md §12 PR-6, rule 91, docs/submit-verdict-sweep). Docs describing the deleted legacy submit surface are corrected rather than left misleading: DAEMON_RPC_RUST.md endpoint coverage recounted post-deletion (the native Rust /submit_transaction route is now first-class); PHASE_2A_SEND_PATH.md §3.6 carries a superseded banner mapping the historical honest-subset design onto the shipped verdict contract; SHEKYLD_PREREQUISITES.md §5 records its stale-root audit as resolved; and the FOLLOWUPS.md fcmp_root_stale item is closed ahead of its V3.1 target — the ProofStale reversion clause's reopening criterion fired, satisfied by RejectCause::StaleRoot with finer cause resolution than the item's own spec.

• wallet: submit path cut over to the typed SubmitVerdict contract (docs/design/DAEMON_SUBMIT_VERDICT.md §12 PR-4, feat/wallet-submit-cutover). The wallet now consumes the daemon's atomic Rust verdict instead of the legacy status-string reply, and its post-submit state machine is re-shaped around it:

  • Typed client. shekyl-rpc-client::publish_transaction posts the native submit_transaction route and returns SubmitVerdict; the string-keyed TxRelayResponse is deleted. The transaction id is computed locally from the held bytes, never read from the daemon (wire minimalism, §2.2).
  • Outcome reshape. TxSubmitOutcome is the 1:1 wallet projection of the verdict (Submitted / AlreadyInPool / AlreadyInChain / Rejected { cause }). The wallet-side AlreadyKnown dedup heuristic is retired in favor of daemon-attested identity facts, and the formerly-deferred ProofStale detection is now constructible as RejectCause::StaleRoot (closes that FOLLOWUPS reopening criterion).
  • Per-cause dispositions (§2.5). Terminal rejections release locks and surface a TerminalErrorKind; retryable rejections (StaleRoot, ReferenceTooRecent, ReferenceNotFound) restore the reservation to consumer ownership losslessly with output locks retained.
  • F28/F37 loop-breakers. A second consecutive Malformed, FeeTooLow, or Unrecognized rejection trips a circuit breaker: further builds are refused with SendError::SubmitLoopBreakerTripped until operator acknowledgment — fee-driven rebuild loops leak co-ownership per iteration, so the bound is a privacy control.
  • F14 awaiting-confirmation lock (§2.6). Submit-accept no longer marks inputs spent = true; it places a persisted awaiting_confirmation lock (tx hash + accepted height) on each input, released either by observed chain confirmation (confirmed-present → spent-final via mark_spent) or by the watchdog's confirmed-absent path. A restart between accept and confirmation can no longer self-inflict a same-key-image broadcast. LEDGER_BLOCK_VERSION 7→8, WALLET_LEDGER_FORMAT_VERSION 9→10; balance reporting gains an awaiting_confirmation bucket excluded from unlocked.
  • Watchdog decision kernel (§5.3 scaffolding). Pure, unit-tested escape-ladder logic in engine/submit_watchdog.rs: chain-confirmation-keyed held tracking, presence branching (absent → re-offer same bytes; present-but-unconfirmed past horizon → operator alarm, never auto-rebuild), daemon-health gating, and an escape horizon bounded inside the daemon's 1.5-day re-relay window (F35). The async actor that drives it lands with the refresh-loop integration.

• wallet: migrate the scan/refresh block-parse from shekyl-oxide to shekyl-wire (§8 step-4 scanner slice, 2026-06, feat/scan-refresh-wire-migration). The wallet's block/transaction parse on the scan and refresh path now rides the canonical, daemon-KAT'd shekyl-wire reader instead of the legacy shekyl-oxide block/tx serializer.

  • ScannableBlock relocated + re-typed. It is no longer a shekyl-rpc type built from shekyl-oxide; it is a shekyl-wire-typed struct owned by shekyl-scanner (block / transactions / first_output_index). The output_index_for_first_ringct_output field is replaced by first_output_index: Option<u64> (sourced from get_o_indexes), retiring the inherited ringct name (closes the FOLLOWUPS ringct-residue rename item for this surface).
  • Native fetch. Blocks are fetched through the new DaemonEngine::fetch_scannable_block (default impl in engine/block_fetch.rs), which drives the shekyl-rpc transport and parses via shekyl-wire. scan.rs and engine/curve_tree_decode.rs consume the wire types directly; unlock_time: u64 is mapped to the scanner's Timelock at the wire→scanner boundary.
  • Fixes Engine::start_refresh failing at block fetch with RpcError::InvalidNode("invalid block") against a live daemon: the shekyl-oxide parse dropped the coinbase Null confidential-tx committed base, so real daemon blocks would not deserialize. New live regtest acceptance gate e2e_refresh_scans_coinbase_balance mines to the wallet and asserts a matured coinbase balance after refresh.
  • Removed the now-dead shekyl-rpc ScannableBlock struct and its get_scannable_block / _by_hash / _by_number default trait methods (zero callers post-migration; 15-deletion-and-debt.mdc).
  • Scope. This is the scanner/refresh slice only; the shekyl-tx-builder spend-encode cutover and the final shekyl-oxide block/tx deletion remain (the scanner still imports the Timelock / StakingMeta domain types from shekyl-oxide::transaction). See docs/design/GENESIS_TX_WIRE_FORMAT.md §8 step 4.

• consensus: collapse the Proof-of-Work path to RandomX v2; remove CryptoNight and RandomX v1 (RandomX v2 genesis cutover, 2026-06, feat/randomx-v2-genesis-cutover). Every block — genesis included — now verifies through the Rust RandomX v2 light-cache verifier (shekyl_pow_randomx_v2_hash, exported from shekyl-ffi); miners run the v2 C library (external/randomx-v2, full-dataset fast mode). The permanent C-JIT-for-mining / Rust-interpreter-for-verification split is sound because v2's light-cache hash equals its full-dataset hash; the release-gate Hole-1 differential test (tests/randomx_v2_parity/randomx_v2_full_parity.cpp) proves C-full ≡ Rust-light over a corpus + a frozen in-process full-dataset KAT (a separate-process miner-run KAT is deferred; see FOLLOWUPS), halt-on-red. See docs/design/RANDOMX_V2_RUST.md, docs/design/RANDOMX_V2_PLAN.md, and docs/design/RANDOMX_V2_PHASE3_PLAN.md.

  • Removed from the consensus path (60-no-monero-legacy.mdc): src/crypto/pow_cryptonight.cpp and the get_cryptonight_* schema; get_pow_for_height collapsed to RandomX for every block version; all RX_BLOCK_VERSION consensus guards; both block-202612 longhash fossils plus the sibling block-id-202612 fossil in calculate_block_hash (whose vestigial blob param was dropped); the dead CryptoNight RPC branch; and the transient SHEKYL_RANDOMX_V2_VERIFY build flag (the v2 path is now unconditional). Seed-hash resolution is unconditional.
  • New FFI surface: shekyl_pow_randomx_v2_hash and shekyl_pow_randomx_v2_set_canonical (the synchronous, off-hot-path canonical-cache pin that delivers the ratified sticky-eviction DoS mitigation — RANDOMX_V2_RUST.md §5/§6).
  • Genesis identity is unchanged, and now gated. Genesis mines at difficulty 1, so the first nonce tried (GENESIS_NONCE) wins regardless of the longhash algorithm, and the block id is Keccak(header) — PoW-independent. mining_parity.cpp's genesis_identity_is_pow_independent freezes the per-net genesis nonce + block id (mainnet 919f8db5… at the time; the credit-wire attestation_root header field, PR #395, later moved every genesis id — mainnet is now bcdcf5e0… — still cross-checked against the daemon-captured height-0 hash in rust/shekyl-wire/tests/vectors/regtest_coinbase_hashes.json); the frozen coinbase/block-hash vectors needed no regeneration then, and were regenerated with #395.
  • Deferred to Phase 3c/4 (blocked by the RPC-payment subsystem deletion + wallet2.cpp touchpoints; tracked in docs/FOLLOWUPS.md): deleting rx-slow-hash.c / slow-hash.c, the seedheight export + shekyl-pow-randomx::consensus module, the RX_BLOCK_VERSION #define, and the IPowSchema / pow_registry / shekyl-consensus abstraction layer.

• wallet: cut the spend path over to real FCMP++ membership proofs; delete the synthetic placeholders (CT-5c assembler cutover, 2026-06-18, feat/ct-5c-assembler-cutover). The send path now assembles the real curve-tree membership path the daemon will verify, instead of synthetic vectors. build splits into synchronous selection → one batch AssembleTx actor round-trip → a fold into the signing context (the tx-level ReferenceBlock carries the consensus root + block hash; the per-input paths carry the real leaf chunks and branch layers). Owned outputs resolve by gindex (the tree's unique key, X3) with a post-resolution (O, C) consistency check (ClientError::IdentityMismatch) that guards the tree-next_output_seq ↔ scanner-global_output_index numbering equivalence; the assembler's reference param drops to ReferenceBlock (T1) and the depth is read from the assembled path / a root_and_depth_at snapshot rather than a hardcoded 1 (T2). A spend now requires the curve tree — the no-tree synthetic fallback is gone (synthetic_tree survives only #[cfg(test)] for the weight/signing KATs that need depth-controlled fixtures; the A4 reversion clause of CT5C_ASSEMBLER_CUTOVER.md).

  • Fixes a latent FCMP++ proof-input bug: shekyl-tx-builder's branch-layer validation had the C1 (Selene) / C2 (Helios) parity inverted (expected Selene as the first branch above the leaf; the real curve tree and the prover are Helios-first). The pre-cutover synthetic generator shared the same inversion, so the two agreed while both disagreed with the real tree — a wrong-layout proof the daemon would have rejected. Surfaced by the real assemble_path and corrected to c2 = ceil(B/2), c1 = floor(B/2).
  • Calibrates the fee model against measured proof sizes: the deferred-to-CT-5 placeholder (a flat +320 bytes/layer that under-estimated real depth-2 proofs → under-paid fees) is replaced by a measured [n_in][depth] table. The series is non-monotonic in depth (the FCMP++ inner-product proof rounds), so a closed-form per-layer increment is impossible; the table is emitted over depth-consistent single-path synthetic trees (PF7) and its depth-1 column cross-checks the prior measured row.

• wallet/scanner: eligible_height now floors on the output's additional timelock and stake lock, not just +SPENDABLE_AGE (CT-5c X5, 2026-06-17, feat/ct-5c-x5-eligible-height). TransferDetails::from_wallet_output previously set eligible_height = block_height + SPENDABLE_AGE unconditionally. That undercounts for a coinbase (whose leaf is inserted into the curve tree at its block-based maturity lock, not at +SPENDABLE_AGE) and for a staked output (locked until its tier's lock_blocks elapse), so reference-block selection could treat such an output as spendable while its leaf is still absent from the tree, attempting an unprovable spend. eligible_height is now max(block_height + SPENDABLE_AGE, additional_timelock_block, stake_lock_until), agreeing with the tree's insertion height. A wall-clock Timelock::Time is enforced at consensus rather than via the tree-insertion height, so it contributes no block floor. Pure derive-time change, no persisted-schema bump. KATs cover the baseline, the block-timelock floor, the ignored time-timelock, and the stake-lock floor.

• archival: verifier-set spec-level model recorded in firewall §10.4; cold-start weak-cover residual ratified (pre-seal decisions, 2026-06-16, feat/standoff-shared-crate). Two doc-only pre-seal dispositions, no code or parameter change. Verifier set (§10.4): the bonded-verifier disposition is given a concrete structural model — membership = the bonded archival staker set itself (mutual oversight, no separate privileged registry), rotation = consensus-seeded, per-epoch, firewall-aware (discharges the §10.4 condition-(a) chokepoint structurally: no verifier accumulates a standing {.onion ↔ P ↔ shard} view, assignments excluded where they would leak the map), and the m-of-n availability margin (L14b condition (b), provisional 11/13) routed to the Round-2 stressnet availability CDF gate for gate-2/gate-4 to ratify from measurement rather than assertion. Cold-start residual: ratified to accept documented weak early-P cover for V3.0 — decoy injection is self-undercutting (foundation decoys are attributable, so a sophisticated adversary discounts them) and no non-attributable source exists short of reopening confidential staking (S-5, closed); the residual is a bounded, self-resolving cold-start transient (cover strengthens as organic funding accrues), so V3.0 ships it documented rather than adding permanent decoy-injection machinery for a finite problem. Reopen criteria (rule-21) recorded on both. Cross-refs: ARCHIVAL_FIREWALL_GATE6.md §10.4, FOLLOWUPS.md funding-seam entry-standoff carry (3).

• archival-sim: mid-band age_weight lever characterized and CLOSED — keep the minimal floor+no-cushion posture (decision, 2026-06-16, feat/standoff-shared-crate). The faithful-freeze fix reopened economics finding 6 with an apparent emergent 7th replica at age_weight >= 7, and the pre-seal lean was to price it into genesis. A fine characterization sweep (hu_cushion_*: age_weight 3→8 × three seeds) refuted the lean: the 7th replica is seed-dependent (reached in only two of three worlds at any age_weight >= 5; seed 0x5EED_2222 never reaches it even at 8), so it is not a cushion the network can lean on; and the lever is inert on the metrics that matter (committed_deep_under already 0.0000 at age_weight = 3; gini/max_actor_share flat across 3→8, confirming age_weight redistributes a fixed budget rather than scaling emission). Genesis keeps age_weight = 3, r_target_deep = floor + 1, no cushion — the lever buys no reliable redundancy and costs nothing to leave alone. Replaces the prior hu_lever_* sweep with the finer hu_cushion_* characterization that produced the disposition. Reopen only if a new friction erodes the deep band and a sweep shows the 7th replica robust across seeds at tolerable concentration cost. Cross-ref: FOLLOWUPS.md mid-band lever item, STAKER_ARCHIVAL_SIM.md §L18 finding 6.

• archival-sim: faithful HoldingsUpdate release-cooldown freeze — pre-charge held deep collateral; close the same-epoch drop-to-reallocate recycle (Copilot PR#148 #4/#5, 2026-06-16, feat/standoff-shared-crate). The L18 freeze model was one epoch too lenient (escrow pushed epochs_remaining = C but advance_epoch decrements before the next best-response, so capital froze for C − 1) and, more materially, let best_response recycle a voluntarily-dropped bond within the same epoch — the futile drop-to-reallocate move the cooldown exists to prevent and that finding 3's prose already claimed was precluded. best_response now pre-charges the collateral of every deep shard held at epoch start (it seeds used_bond, so a same-epoch drop cannot refund a fresh acquisition); pre-charge (drop epoch) + escrow (next C − 1) span the full RELEASE_COOLDOWN_EPOCHS. release_cooldown_epochs == 0 pre-charges only locked shards, so every c0 arm is byte-identical to the pre-cooldown baselines. The seal verdict and every shipped genesis parameter are unchanged (RELEASE_COOLDOWN = 2, r_target_deep = floor + 1, age_weight = 3, no foundation widening): both the old and faithful models clear all c2 gates, so this strengthens the seal (binding committed_deep_under moves 0.0138 → 0.0000) rather than altering calibration. The model correction reveals the c4 "cliff" was an artifact of the spurious churn (gone; floor holds at 6), confirms the rationality-preclusion thesis in the budget arithmetic, and surfaces a mid-band age_weight lever (aw ≥ 7 reaches a 7th oldest-band replica) now tracked in FOLLOWUPS.md. Also guards freeze_blocks_recoverage against bond_rate <= 0 (#1) and aligns the oldest_margin doc comments to the implemented >= 0 hold-the-floor gate (#2/#3). Docs: STAKER_ARCHIVAL_SIM.md §L18 "Faithful-freeze reconciliation".

• archival-sim: adversarial-dodge arm completes the cooldown's two-leg seal — and inverts the premise on the committed channel (2026-06-16, feat/standoff-shared-crate). The faithful-freeze fix left the seal on one leg: under the rational cooldown-aware agent the cooldown is inert, so the sim gave no evidence for RELEASE_COOLDOWN_EPOCHS at all. Added AgentParams.dodge_pref / SimConfig.dodge_pref and a hu_dodge_{nolock,ship}_{lag0,lag2}_{dp0,dp1}_{c0,c2} sweep modeling a non-cooldown-aware operator that wants the drop-and-refund dodge P2B-7 Pin 3 defends against. Result inverts the expectation on the committed channel: at c0 the dodge is pure churn (1.364 vs rational 0.268) with no committed-coverage harm (oMinCmtR holds at 6, instant re-seat); at c2 the cooldown causes the sweep's only committed breach (oMinCmtR 6 → 4, 37 % capital stranded) by freezing the refunded bond in the lock-off regime. The coverage defense is the L9 retention lock, not the cooldown — every ship arm (locks on) holds oMinCmtR at 7 at both c0 and c2. Corrected mechanism: the cooldown is a cost/deterrent (Pin 3 anti-dodge property, demonstrated), complementary to the retention lock, not a coverage protector; alone (nolock) it backfires. Two-leg seal (sealed against the ship config): good-actor leg costless, bad-actor leg bounded-safe (oMinCmtR 7, frzCo 0.107, no breach). New load-bearing operating-envelope constraint: never ship the cooldown without the L9 retention lock (rule-21 reopen keyed on BOND_DURATION_AGE_SCALE/BASE → 0). No shipped parameter moved. Docs: STAKER_ARCHIVAL_SIM.md §L18 "Adversarial-dodge arm".

• standoff: the conformance grader must not certify an empty sample, and the conformance suite now runs in CI (Copilot PR#150, 2026-06-16, feat/standoff-shared-crate). grade_sample reported uniform_ok = true for an empty (or single-point) sample — a zero chi-square clears the critical value, so "no data" read as "passed uniformity," a false positive a wallet self-cert must never accept; it now requires n >= 2 before a uniformity claim. summarize_gaps on an empty sample took the denom = 1.0 fallback and manufactured a max_decile_dev of 0.10 (a real-looking failing shape) for no data; it now returns explicit zeros. Both are locked by new empty_sample_summary_does_not_manufacture_a_shape / no_observations_cannot_claim_uniformity tests. The conformance-gated suite (chi-square / order-balance / serial-independence grader + triangular-trap negative control) was never exercised in CI because the default-feature workspace test does not compile it; build.yml now runs cargo test -p shekyl-standoff --features conformance on the x86_64 lane (x86-only by design — float GoF probes are not bit-identical across arches; the cross-arch guarantee remains the integer golden vector under qemu).

• standoff/stats: public conformance helpers are now well-defined for every u64 window and the chi-square critical value fails closed on invalid df (Copilot PR#150 review 2, 2026-06-16, feat/standoff-shared-crate). Three latent edge-case panics/NaNs on the feature-gated helpers — none reachable from the sim (window is 600, df >= 1), but the helpers are public and must honor the production draw's u64 contract. correlated_walk computed its modulus as window as i64 + 1, which wraps to a non-positive modulus (panic in rem_euclid) for window > i64::MAX; it now walks with overflow-safe u64 modular add/sub. grade_sample sized its bin count with window as usize + 1, which overflows at usize::MAX and truncates a large window on a 32-bit target; it now computes the count in u64. chi_square_upper_crit divided by df without guarding, yielding NaN/inf for df <= 0; it now returns NaN explicitly, which makes any downstream statistic < crit comparison false — the cert fails closed rather than passing on a bogus critical value. Locked by helpers_are_well_defined_at_extreme_windows (u64::MAX window, no panic) and critical_value_fails_closed_for_invalid_df. The sim model is untouched: the review surfaced no soundness finding, only input-validation hardening on the shared crate's public surface.

• bench: migrate the iai instruction-count harness from iai-callgrind 0.16 to gungraun 0.19 (2026-06-16, chore/bench-gungraun-migration). iai-callgrind was renamed to gungraun upstream from 0.17.0 and the 0.16.x line no longer receives backports; depending on it is compounding debt. All five bench crates (shekyl-engine-core, -engine-file, -engine-state, -scanner, -tx-builder) move iai-callgrind = "0.16" → gungraun = "0.19" (latest stable, 0.19.2), the 13 _iai bench files swap use iai_callgrind::* → use gungraun::* (macro API is source-compatible — no structural changes), and benchmarks.yml + capture_rust_baseline.sh install/invoke gungraun-runner (the _iai filename suffix and the iai_callgrind JSON envelope section key are retained as stable identifiers consumed by compare.py). gungraun is a dev-dependency only, so its 0.19 MSRV bump (Rust 1.85.1 / edition 2024) does not raise any production crate's MSRV (our toolchain is 1.94). This re-lands the disposition from docs/investigation/2026-05-09-bench-baseline-flake.md §4.1 (Option A), whose original 0.18 attempt was archived unmerged; targeting current-stable 0.19 rather than the stale 0.18 pin. Whether it fixes the instructions=0 capture flake (the producer guard from PR #35 that was hard-failing per-PR capture-pr jobs) is speculative — the cause remains unknown (§3.3); the upgrade is justified on supported-upstream / debt-reduction grounds.

• wallet: CT-5b — curve-tree reference selection + §3.3 ingest verify + C2 spendability gate (2026-06-16, feat/ct-5b-reference-verify). Builds on CT-5a's actor/ingest wiring (docs/completed/CT5_ENGINE_WIRING.md §6):

  • §3.3 ingest-time root verify (O5). After each block is ingested into the curve tree, the reconstructed root must byte-equal the consensus header-committed root (producer range from block_curve_tree_roots, backfill from the daemon-fetched block's header.curve_tree_root). A mismatch is the inconsistent-liar daemon: a terminal RefreshError::CurveTreeIngest { recoverable_by_respawn: false }, before the ledger advances (O2). New production VerifyRoot actor message.
  • C2 reference-block spendability gate. Selection now rejects outputs too fresh for the reference block (eligible_height > tip − REF_ANCHOR_AGE) with a clean SendError::OutputNotYetSpendable { eligible_height, reference_block_height, wait_blocks }, and the pre-maturity window with SendError::WalletTooYoungToSpend — distinct from the self-healing SpendUnavailableRebuilding (tree lag) and from InsufficientFunds.
  • Real reference binding. At send time the reference root is re-derived from the tree (reference_height = tip − REF_ANCHOR_AGE; never persisted — derive>hold) and bound into a ReferenceBlock, threaded into assembly. The signer still builds synthetic membership paths (the assembler cutover and assemble_path are CT-5c); only the reference selection is real. KATs pin the §3.3 mismatch rejection, the C2 OutputNotYetSpendable wait signal, the too-young window, and the reference-root threading.

• archival: long-lived P is the committed staking-identity architecture — S-5 fork consciously closed (2026-06-16). The last genuinely-structural firewall fork (long-lived vs. short-lived/rotating archival pseudonym P) is closed in favor of long-lived P, ratifying what serve-credit accrual, lock tiers, bond_duration, the L18 freeze-friction seal, and bond-as-consensus-balance already assume — making the decision-by-accumulation explicit rather than latent. Short-lived/rotating P is out of scope for V3.0 (it would require a bond-migration-between-identities consensus op, reopening the bond FSM and the gate-4 §3.2 custody seal). The surviving privacy question is characterization of the long-lived handle's fusion surface (S-2 exposure ledger + S-3 adversary sim + operator-behavior levers), not a protocol re-fork. Reopen criterion (per 21-reversion-clause-discipline.mdc): a measured S-2/S-3 per-P attribution breach severe enough to reconsider the confidential-staking rejection, via a fresh PHASE_2B model-level round. Docs: ARCHIVAL_FIREWALL_GATE6.md (§10 S-5 + revision 2026-06-16).

• archival: GF-1-carve resolved — dedicated bond-spend key authorizes bond debits (2026-06-16, feat/gf1-dedicated-bond-spend-key). Releasing bonded collateral (bond_debit: Unbond, HoldingsUpdate drop-shard) is now authorized by a dedicated bond_spend_pk — a hybrid scheme_id = 1 (Ed25519 + ML-DSA-65) keypair committed into the ArchivalBondRecord at JoinMarket and immutable for the record's life — not the account identity key (P_pubkey / hybrid_sign_pk). This was the last open "carve": gate-4 §3.5 step 5 previously read "P hybrid signatures on vin," which, implemented at face value, would have silently made the account identity key spend the bond — turning its compromise surface from "reveals nothing spendable" into "drains the bond." Naming a domain-separated debit key at source keeps the Round-1 identity-only invariant intact and compromise-isolates bond-spend authority. The key is derived under two new HKDF labels (shekyl-archival-p-bond-spend-{ed25519,ml-dsa-65}-v1), bound into the bond-post sig-preimage at JoinMarket, and added to the ARCHIVAL_P_DERIVE_V1 KAT obligation. Credit/identity paths (JoinMarket, Rebond, HoldingsUpdate add-shard) still authorize against P_pubkey; the account key never authorizes a value-out. The consensus-balance custody model (gate-4 §3.2, sealed Round 1) is unchanged — no key image, no receipt UTXO; the receipt-UTXO alternative was declined with a named reopen criterion. Spec-only (no code yet); pairs with the gate-4 implementation checklist item. Docs: ARCHIVAL_BOND_GATE4.md (§3.4 / §3.4.1 / §3.5 / §4.1 / §8 / revision 2026-06-16), ARCHIVAL_FIREWALL_GATE6.md (§9.3 / §9.4 / §9.6 / §10.11 / §7 / revision 2026-06-16).

• archival: HoldingsUpdate (partial-unbond/rebond) promoted to genesis scope (2026-06-15). The full bond lifecycle (JoinMarket / Rebond / HoldingsUpdate / Unbond) ships at V3.0, promoted from deferred-V3.1. Bond balance is consensus-state-machine state under the gate-4 conservation law, so adding mid-life shard adjustment post-genesis would be a hard fork; and without it the only way to add or shed a single shard is Unbond + re-JoinMarket, tearing down a working multi-shard operation (all collateral into release cooldown, all serving interrupted, all serve-credit continuity reset) to swap one slot. The add-shard credit path covers the voluntary holdings-increase/top-up direction. All bond-lifecycle verify/connect logic is Rust-native (shekyl-archival-retention); C++ daemon retains only thin glue + FFI delegation; wallet-side construction is Rust. Two follow-on dependencies tracked, in order: (1) FSM-friction pin in PHASE_2B_FSM_RETOOL.md (partial-unbond action, per-shard release-cooldown on drop, slashable-when boundary) — landed; (2) age-stratified sim bond-mobility reconciliation — landed (STAKER_ARCHIVAL_SIM.md §L18). Docs: ARCHIVAL_BOND_GATE4.md §4.4, ARCHIVAL_FIREWALL_GATE6.md (R2 / revision 2026-06-15), FOLLOWUPS.md (V3.0 lifecycle item).

• archival/sim: L18 — HoldingsUpdate release-cooldown freeze reconciliation; genesis redundancy floor re-derived unchanged (2026-06-16). The staker sim's frictionless-mobility optimism is closed: a new --axis=holdingsupdate_cooldown sweep freezes released collateral for the release cooldown (World.cooling; spendable budget reduced by frozen capital in best_response). Two source-faithfulness corrections vs. ARCHIVAL_BOND_GATE4.md — the frozen amount is flat ARCHIVAL_BOND_FLOOR (§8.1, not the first-draft age-scaled bond_age(s), which over-stated the deep-band freeze exactly where the redundancy margin lives) and the cooldown anchors at per-shard last-served (§4.4, faithful under serve-until-drop). The friction is flat in amount, age-stratified in incidence (bond_duration(age) immobility + thin deep-tail coverage). Result: genesis RELEASE_COOLDOWN passes all three absolute seal gates (committed_deep_under < 0.10, sole_source = 0 lag-free, hold-the-floor oldest_margin ≥ 0) on both duration arms. The binding seal number is the faithful age-scaled arm (committed_deep_under = 0.0138; gate-4 §3.4 makes bond_duration(age) genuinely age-scaled, so the rosier flat 0.0064 is the optimistic contrast, not the headline). The flat-floor freeze costs ~0 floor erosion at genesis, so r_target_deep requires no freeze-driven increase. The +1 redundancy is a provisioning property of r_target_deep (= availability_floor + 1), not an emergent buffer: no market lever buys slack — neither budget (hu_buf_*) nor deep-tail reward premium (hu_lever_*, age_weight 3→12) lifts oldest_min_committed above r_target_deep, because the 1/R reward is anti-over-replication by construction; a wider band is provisioning-only (raise r_target_deep, or lean on the foundation backstop), both priced. The "harmless at c2" result is the conjunction (freeze_harm_co bounded AND oldest_min holds), not causal = 0: the causal/transient detector reads 0 in every epoch of every arm including c4 where the floor eroded 6→5. The 0 is precluded under cooldown-aware optimization, not by construction (best_response budgets on capital−Σfrozen, so it never makes the stranding drop-to-reallocate; validated by positive/negative control tests freeze_predicate_* in model.rs) — the state stays reachable by a naive operator, routed to operator-education + a candidate wallet-side conformance guard (V3.1), not the consensus floor. The freeze's real harm mode is structural (caught by oldest_min, invisible to the transient detector). A cliff check confirms genesis cooldown is not on a bifurcation edge in the faithful age-scaled composition (the super-linear 2→4 degradation is a flat-duration-contrast artifact); the duration-shape × cooldown sign reversal across the sweep is positive evidence the model captures real dynamics. The rule-21 reopen clause is widened to any newly-discovered friction that erodes the deep band (no emergent cushion beneath the provisioned +1). Docs: STAKER_ARCHIVAL_SIM.md §L18, FOLLOWUPS.md (V3.0 lifecycle item, sub-items 2–3).

• wallet/crypto-pq: retire the enc_label real-label gate; prove the indistinguishability invariant (2026-06-15, feat/enc-label-ungate). The cooperative-payment-request gate (operational.cooperative_payment_requests, env SHEKYL_COOPERATIVE_PAYMENT_REQUESTS, payment_request_flag.rs, and the cooperative_enabled parameters threaded through outbound_label.rs, attribution.rs, merge.rs, the FFI, and cryptonote_tx_utils.cpp) is deleted. The gate delivered no privacy or consensus value: the universal sentinel-XOR-k_label masking is mandatory and active on every output from genesis, so a non-recipient sees uniform-random 8 bytes whether the plaintext is a sentinel or a real label — gated or not. The gate was a test-coverage interlock standing in for an unwritten invariant, now discharged. Real-label population is ungated: send echoes the URI rid when present; receive always classifies/matches. The indistinguishability invariant is now stated normatively in SUBADDRESS_UNDER_PQC.md §5.7.10 (cross-referenced from FCMP_PLUS_PLUS.md §4) and proven by the statistical KAT real_label_indistinguishable_from_sentinel in shekyl-crypto-pq/src/label.rs (chi-square uniformity + homogeneity over the real derive_output_secrets path, with a plaintext-on-wire negative control). GUI tooling emitting rid URIs is the de-facto feature boundary. Breaking: wallet config files carrying cooperative_payment_requests no longer deserialize (deny_unknown_fields); acceptable pre-genesis (rm -rf ~/.shekyl). Docs: WALLET_PREFS.md, FOLLOWUPS.md.

Added

• wallet: engine-path curve-tree root-match against the CT-2 oracle (CT-5a commit 6, 2026-06-15, feat/ct-5a-curve-tree-actor). Closes the CT-5a root-match DoD through the engine ingest path. Two KATs drive ingest_scan_result_into_curve_tree with OwnedTxLeaves parsed from the ct2_tier_a oracle and assert the engine-reconstructed root byte-matches the oracle at every height: a forward ingest of the main chain, and a reorg_rewind onto reorg_deep exercising engine-path rollback + re-ingest. Root read-back is a #[cfg(test)]-only RootAt actor message + CurveTreeHandle::root_at (the production root-read is CT-5b's §3.3 verify, not this slice). Pending-table-equality post-reorg (E6a) is not asserted here — it remains Tier-B-gated (a coinbase-only fixture cannot express a class-(b) pending migration; that assertion lands at CT-5c when the non-coinbase fixture exists). A green commit 6 proves the engine ingest wiring transports leaves to the actor/client correctly; it does not prove non-coinbase backfill. Docs: CT5_ENGINE_WIRING.md (CT-5a DoD commit-6 status).

• wallet: engine-side respawn-on-poison for the curve-tree actor (CT-5a commit 5, 2026-06-15, feat/ct-5a-curve-tree-actor). Implements the R1-Q4 recovery body: a curve-tree actor that fail-stops (kameo on_panic does not restart it, by design) or whose client is ClientError::Poisoned is now healed engine-side by a drop-and-reopen respawn rather than failing the refresh permanently. CurveTreeHandle's inner ActorRef is wrapped in an Arc<Mutex<…>> shared, swappable cell so a respawn propagates the fresh actor to every handle clone at once (including the LocalPendingTx spend-gate clone) — without the shared cell a respawn would heal refresh but leave spends pointing at the dead actor forever (a partial heal). The new CurveTreeHandle::respawn does kill → wait_for_shutdown → reopen → spawn → atomic swap; because kameo drops the actor value (and its redb single-writer lock) after wait_for_shutdown returns, the reopen is retried on a short poll bounded by a 2 s deadline so the lock-release lag is absorbed but a genuinely corrupt/held store still surfaces its error. RefreshError::CurveTreeIngest gains a recoverable_by_respawn: bool classification (true for a fail-stopped actor or ClientError::Poisoned; false for non-consecutive-height / root-mismatch / store / decode failures a reopen would only reproduce). Engine::ingest_scan_result_with_respawn wraps the bare ingest with a single respawn-and-retry on a recoverable error and is wired into both refresh ingest call sites (async run_refresh_task and the synchronous scan pass). KATs: respawn_resumes_from_store_and_propagates_to_clones (handle-level: respawn resumes from the persisted cursor and a pre-respawn clone sees the live actor) and ingest_pre_pass_respawns_after_actor_fail_stop (engine-path happy path: a fail-stopped actor is classified recoverable, then heals via respawn-and-retry with the cursor resuming from the persisted tip). The bounded-retry-budget-then-escalation arm that distinguishes a transient hiccup from a permanently corrupt store at the refresh-budget level (O3-sub) is staged for CT-5d. Implements CT-5 §3.3 R1-Q4. Docs: CT5_ENGINE_WIRING.md.

• wallet: surface the pending-incoming summary and rebuild status on the refresh progress channel (CT-5a commit 4b-2, 2026-06-15, feat/ct-5a-curve-tree-actor). RefreshProgress (the watch-channel refresh signal) gains three fields, no new persisted state: pending_incoming_count / pending_incoming_atomic_units (the per-attempt "you received" summary — the count and summed amount of outputs the scan detected this attempt) and rebuilding_membership (true while the curve tree lags the ledger, i.e. the adopting / tree-wiped wallet whose backfill is in flight and whose spends may be temporarily gated by 4b-1's SendError::SpendUnavailableRebuilding). Detection is decoupled from spendability: a received output is displayed as soon as the scan finds it, independent of whether its curve-tree membership is yet provable. The orchestrator (run_refresh_task) assembles the summary once from the full ScanResult and emits it on the pre-merge Merging frame (with rebuilding_membership read from the tree cursor before the ingest pre-pass, so a long adopting backfill surfaces the rebuild status for its whole duration) and on the terminal success frame (rebuilding_membership: false — the pre-pass acked the full range under ack-before-commit, so the tree is caught up). The forward-from-genesis common case never flags rebuilding (tree and ledger advance in lockstep). Per-block scanning frames and the seed/retry/cancel pings carry the zeroed display fields via the new RefreshProgress::phase_only constructor. KATs: membership_rebuilding_predicate (the pure ledger-ahead-of-tree predicate across fresh/adopting/caught-up/ ahead) and hybrid_refresh_from_genesis_surfaces_not_rebuilding (the wiring smoke test). A non-zero pending-incoming amount and the rebuilding == true path need a wallet-addressed (non-coinbase) fixture and a divergent adopting state respectively — both Tier-B-gated to CT-5c. Implements CT-5 §3.2.1 D3 display surface. Docs: CT5_ENGINE_WIRING.md.

• archival: standoff conformance suite gains the two independence probes + discrete-GoF grade (2026-06-13). The marginal uniform/trap tests are structurally blind to the independent half of "uniform-independent draw"; added the two probes the marginal cannot see (rust/shekyl-staking-sim/src/standoff.rs): (1) population anchor-independence — the catastrophic shared-trigger mode (an epoch-snapped anchor passes every gap test while clustering absolute bond times → candidate set ~1.01); population_bond_time / max_bin_share + population_anchor_independence_disperses_shared_trigger_clusters with an epoch-snapped negative. (2) serial independence — load-bearing now that rebond/partial-unbond/re-entry make a P draw several gaps over its life (a weak PRNG yields a uniform marginal with correlated successive draws, linking recurring bond ops); lag1_autocorr + serial_independence_reference_passes_correlated_fails. Also added the grading form: a discrete chi-square against the uniform (chi_square_uniform, not continuous KS — the gap is integer blocks) at a strict grading alpha ~1e-6 (chi_square_upper_crit / Z_ALPHA_1E6; chi_square_grades_uniform_at_strict_alpha), chosen so a correct wallet essentially never false-fails while the trap fails by orders of magnitude; the fixed seed is reference-determinism, not a PRNG mandate. Suite is 49 sim tests green; economic sweep + --standoff report untouched. Docs: STAKER_ARCHIVAL_SIM.md §Construction and per-seam geometry, FOLLOWUPS.md.

• archival: executable reference for the standoff draw conformance vector (2026-06-13). Added draw_entry_gap (the conformance-correct direct draw: s ~ U[0,600] + fair order-coin) and summarize_gaps (realized (spread, order) distribution: mean spread, order balance, first-decile mass, decile uniformity probe) to rust/shekyl-staking-sim/src/standoff.rs, with two validating tests — correct_draw_is_well_distributed (flat spread, balanced order) and double_jitter_trap_fails_the_same_check (the same summary rejects the triangular double-jitter trap; notably the trap's order-coin still looks fair, proving the spread distribution is the load-bearing check, not order balance). This makes the published wallet test vector executable rather than prose: the vector asserts on the realized spread and order over a sample, not the ±600 bound alone. No model change to the economic sweep; opt-in --standoff report untouched.

• archival: standoff construction + per-seam geometry pinned (2026-06-13). Two conformance-critical construction details folded into the funding-seam entry-standoff spec (STAKER_ARCHIVAL_SIM.md §Funding-seam entry standoff → Construction and per-seam geometry, ARCHIVAL_FIREWALL_GATE6.md §10.12). (1) Draw the gap directly, do not independently jitter two event-times around a common anchor: the difference of two uniforms is triangular/zero-peaked and clusters the events (near-zero effective standoff) while passing the ±600 bound — a conformance trap that matters because the draw is wallet-side and unenforceable. Correct shape: place event 1 at the private intent t0, draw s ~ U[0,600], event 2 at t0+s, fair order-coin (uniform separation, free inversion, max latency 600, per-P independence). The published test vector must reject the triangular construction. (2) The 600 is per-seam: the ±600 symmetric envelope is the entry seam (announce↔bond, inversion-eligible, 1200-block search width); the exit seam (terminal drain + recurring partial-unbond) is a separate, one-sided standoff (no inversion — collateral isn't spendable before the 20_000-block release cooldown) whose latency is measured from cooldown expiry (breaking the deterministic fixed-offset cooldown tell), so symmetric entry/exit = two independent 600-block draws, each free on its own seam. Also recorded: width is the expensive axis (proven rate-driven), so the cheap thin-regime levers are biasing the gap toward the max and the inversion, not a wider window. FOLLOWUPS.md item extended (test vector must reject double-jitter; exit-seam geometry named). Docs + harness doc-comment; no model change, no re-sim.

• archival: standoff recommendation reframed after review pass — cap is anti-griefing, cover is conditional on isolation (2026-06-13). Folded four review-pass carries into the --standoff recommendation (STAKER_ARCHIVAL_SIM.md §Funding-seam entry standoff → Conditionality and caveats, ARCHIVAL_FIREWALL_GATE6.md §10.12), two of which change what the number means: (a) the max announce↔bond cap is an anti-griefing ceiling, not a privacy control — the privacy floor (minimum spread + uniform-independent draw) is wallet-only and consensus-unenforceable, so the draw is promoted to a hard conformance requirement with a published test vector, and a per-block bond-post smoothing rate-limit is opened as the one (partial, non-free) consensus-side surge backstop; (b) the measured cover is P(link | §10.9 isolation holds) — a multiplier on isolation, never additive — and the rate that drives it is the post-isolation network-event rate, not the on-chain funding-spend rate the sim proxied. Carried as named residuals: cold-start weak cover (pre-seal, L12; foundation-decoy injection is self-undercutting per the injected-decoy critique) and nominal-vs-effective cover (testnet must probe the S-3 modeled observer, not a passive honest-rate measurement). New FOLLOWUPS.md V3.0 item; harness doc-comments updated so the code stops overclaiming. No re-sim (the reframings are meaning-changes, not value-changes); no consensus surface touched yet (the consensus questions are opened, not decided).

• docs: track five CT deferrals in FOLLOWUPS (CT survey cleanup, 2026-06-13). A CT-* state survey found five pieces of real deferred work recorded only inside design/closeout docs, not in the central FOLLOWUPS.md ledger. Added a tracked row (target version + reopening trigger per 21-reversion-clause-discipline.mdc) for each, with back-references from the source docs so they are bisect-locatable both ways: (1) CT-2 Tier B reconstruct-root KATs (staked/non-coinbase maturity, the recon_tier_b.rs #[ignore] set) — V3.0, after CT-5; (2) CT-1 full-segment freeze/prune KAT at j=2 (~26k leaves/segment vs the CI-scale j=0/Tier-A coverage) — V3.0, with prune-policy; (3) wallet-local O.x → position match index (§4.3 scan cost) — V3.x perf; (4) confirm segment layer j / shard size E against mainnet leaf growth (§7.2.2, level-2 ≈26k provisional) — V3.x, with the ArchivalEngine shard policy; (5) anonymized (Tor/I2P) routing for non-forward segment fetch (§7.4) — V3.0, riding the SegmentSource seam. Docs-only; no code or consensus surface touched.

• economics: CI gate enforces the pure-integer contract for reward_arithmetic (2026-06-13). scripts/ci/check_archival_reward_gates.sh (run from check_consensus_invariants.sh) now rejects f32/f64, usize/isize, and atomics in reward_arithmetic.rs, with an inline reward-arith-allow escape hatch for reviewed-benign uses. This makes the cross-arch bit-identity guarantee (M-1 half (b)) hold by construction, not convention: #![deny(clippy::float_arithmetic)] only guards float arithmetic, so a usize leaking into a credited value would silently drop the aarch64 guarantee from "real" to "emulated-and-hoping" on a future 32-bit target, and qemu-user would not flag it. Docs: ARCHIVAL_REWARD_ARITHMETIC.md §Pure-integer contract gate.

• economics: pre-genesis-seal carry for float-calibrated redundancy floors (tail-margin finding, 2026-06-13). PR 1.5 showed the float sim over-reads worst-shard redundancy by up to one replica. Genesis-sealed redundancy params that gate sole-sourcing — the L12 r_target_deep floor and any sealed R_target/redundancy floor — must be re-derived against the integer backend with a +1 deep-tail replica margin before the seal (a sealed value cannot move post-genesis without a fork; "watch on testnet" only covers the tunable bands). Availability-scoped (Foundation complete-tree B+C seeds are the durability backstop), not a durability escalation. Tracked as a V3.0 pre-genesis FOLLOWUPS item so it cannot slip into genesis at its float value by omission; cross-refs in ARCHIVAL_SIM_ECONOMICS_VERDICT.md §tail-margin, REWARD_EMISSION_VIN_PLAN.md §9, STAKER_ARCHIVAL_SIM.md §L12.

• docs: CT-4 Round 1 closed — membership-path assembly + reference-block horizon (shekyl-curve-tree, 2026-06-13). Added CT4_ROUND1_CLOSEOUT.md recording the two landed CT-4 surfaces: (1) assemble_path → AssembledPath (gated on the §3.3 root match, FCMP++ prover Path layout pinned at source, C3 c1+c2+1 == depth self-checked) and (2) reference.rs validity-horizon arithmetic (select_reference_height, proof_submittable/proof_expired, should_reanchor; REF_ANCHOR_AGE/PROOF_VALIDITY_HORIZON/REBUILD_AT). Both landed ahead of their decomposition slot and were hardened by the CT-3↔CT-4 audit (ReferenceBlock now carries block_hash). Flipped CURVE_TREE_CLIENT.md §9 CT-4 row to Round 1 closed. Test gates: assemble_kat (independent root recompute + OutputNotDrained/RootMismatch rejection), reference::tests (selection/window/aging/re-anchor/reorg), and the archival-retention cross-checks. Deferred-with-reversion-clause: F5 store-backed/pruned assembly (rides prune-policy) and the C++ hash_to_p3 path-RPC FFI migration (rides the daemon path-assembler). Docs-only; no code or consensus surface touched.

• docs: CT-3 Round 1 closed — CT-3d closeout (shekyl-curve-tree, 2026-06-13). Added CT3_ROUND1_CLOSEOUT.md recording the landed persistent-client lifecycle (CT-3a store schema / CT-3b open+resume+delta-ingest / CT-3c reorg rollback), the DoD mapping, and the deferred-with-reversion-clause surfaces. Flipped CURVE_TREE_CLIENT.md §9 CT-3 row to Round 1 closed and closed §8 #6 (block-derived forward sync is the confirmed default — the §6 reversion criterion fired). Marked CT3_SYNC.md CT-3d landed / Round 1 complete. The bulk-leaf RPC endpoint (R1-Q1) and SegmentSource seam (R1-Q5) remain deferred-with-recorded-shape, landing with the post-prune refetch path; the F5 store-backed assembly, resume-path/full R_k recheck, and CT-5 poison-reaction items stay routed in FOLLOWUPS.md. Docs-only; no code or consensus surface touched.

• archival: staking-sim --standoff mode — funding-seam entry-standoff anonymity model (2026-06-13). New self-contained sub-report (rust/shekyl-staking-sim/src/standoff.rs, peer to --timing-cluster / --failure-confirmation) executing the Gate 6 §10.12 pass-4 BUILD target. Monte-Carlo (200k trials/arm, reproducible SplitMix64) over candidate-set size = 1 target + Poisson background funding-shaped decoys, sweeping window width × background rate × inversion × trigger-independence, with an analytical homeostasis bound (entry latency = window/epoch; economic dynamics are epoch-quantized at 10_000 blocks, so a minutes-to-hours window is off the economic axis — not re-simmed, to avoid over-reading the epoch-granularity model). Findings: anonymity is rate-driven, not width-driven (the background funding-spend rate is the load-bearing unmeasured input, swept like fetch_latency_per_unit); the inversion carries the low-activity worst case (link 0.52→0.32, thin-cover 56%→20% where set-enlargement can't help); a shared trigger is catastrophic (candidate set 16→1.01 — uniform-independent draws mandatory); the standoff is homeostasis-free ≤ ~1000 blocks. Recommended: 600-block (~20 h) uniform-independent window, inversion on; testnet must measure the background rate. Recorded in STAKER_ARCHIVAL_SIM.md §Funding-seam entry standoff and ARCHIVAL_FIREWALL_GATE6.md §10.12. New code

  • docs; 5 unit tests; existing 325-scenario economic sweep untouched (new mode is opt-in via --standoff).

• archival: Gate 6 Round 2 adversarial pass 4 — cadence closed, standoff promoted (2026-06-13). Added the organizing principle behind the close: the firewall protects P ↔ principal (a linkage), not P ↔ its own rewards (a conceded-public function of contribution). Earning-function obfuscation (reward-magnitude banding — distinct from the sealed g operating-band in REWARD_EMISSION_LEG.md — and pay-every-block) spends the anti-whale/trilemma budget twice on a conceded property; the seam mitigation (standoff + inversion) touches no economic quantity and is off the trilemma's axis. Cross-P sybil correlation resolves to seam protection too (signature is timing/pattern, not magnitude), and FCMP++/RingCT already hides seam amounts — leaving timing + origin as the public seam leak. Resolved the two live pass-3 §10.12 scenarios in ARCHIVAL_FIREWALL_GATE6.md. CLOSED the pay-every-block / implicit accumulator-emission path and corrected the pass-3 over-claim that accumulator credit "deletes GF-6/GF-10." Reasoning: Shekyl staker payments are a roll-call (every accrual keyed to P_canonical_id because dedup demands it — confidential staking was rejected), so continuous attributed payment makes an absence a one-block edge at the GF-4 exit rather than crowd-cover; and consensus cannot mint a hidden-recipient output (it holds no ephemeral secret — the miner coinbase is private only as sender-to-self), so a per-block reward is either publicly-derivable (every P's reward stream traceable to P_canonical_id) or an invisible accrual that, auto-compounded to exit, concentrates into the terminal event (worse GF-4) and destroys the claim-timing decorrelation lever. The periodic-claim model is the better spot given public attribution (claims timing-decorrelatable; decoupled from unstake per R0-D6). The obfuscation being reached for needs membership-hiding claims = the confidential-staking machinery already rejected, so this is the S-4 bridge cost in disguise; the real question (reopen confidential staking?) folds into S-5. PROMOTED the funding-seam entry standoff + inversion to a build target for the S-3 adversary sim (the door, GF-7), sharpened past "smooth vs surge": candidate-set sizing for the targeted principal (not window width); the low-activity principal as the worst case (set-enlargement can't help, only the inversion does); trigger-independence as the clustering knob; and enumerate the separable funding events first (prep-spend vs. announce vs. bond-post tx — ties to the S-2 ledger). Quick dispositions: terminal-lump → existing wallet-side GF-4 fragmentation (no consensus mechanism); per-block accrual rejected (more state churn + reorg surface for the same exposure); seed compromise = named residual (recoverability ⟺ single-point-of-failure), weight on key hygiene. Docs-only.

• archival: Gate 6 Round 2 adversarial pass 3 — end-to-end trace + cross-layer findings (2026-06-13). An end-to-end P-lifecycle trace (key-gen → announce → bond-post → serving → emission → bond-adjustment → exit) surfaced model-level findings the per-round decomposition is blind to by construction; landed as a new §10.12 (S-1…S-6) in ARCHIVAL_FIREWALL_GATE6.md. S-1: the money seams (GF-7 funding-in, GF-4 value-out) are the only findings protecting principal↔P unlinkability and the only two still deferred — they sit at the on-chain ∧ network ∧ timing conjunction no single layer owns (deferral ≠ ownership). S-2 (build first, cheapest): specified the missing fused, per-observer, whole-life exposure ledger (observer × lifecycle-event matrix + per-observer fusion closure, conceded cells marked distinctly from leaked) — the §10.1 table is only per-adversary "must not learn." S-3: privacy is named, not measured (325 economic scenarios, 0 adversary); reframed as the privacy axis of the R-3 reconciliation already gating the seal — deliverable is an adversary sim on the funding/exit timing seams (P(link | T_obs) vs standoff / jitter / batch). S-4: labeled the onion↔P_canonical_id bridge a conceded staking-model cost traceable to the confidential-staking rejection, not closable at the network layer. S-5: longevity-vs-privacy named a model-level pre-seal question — long-lived P is the worst bridge structure, but rotation relocates the seam (fresh GF-7 per rotation) and reopens the bond FSM (bond = consensus balance), so the answer is open. S-6: pinned key locality — the always-on serving box holds only the P-subtree, never the master seed (cold-derive + provision; HKDF one-wayness preserves recoverability), extending the §10.9 isolation pin from circuits to keys. Recorded three sim scenarios: variable announce↔funding standoff; randomized 0–9-block entry incl. P-before-bond; and implicit accumulator emission (deterministic Σwork credit with no broadcast claim deletes GF-6/GF-10 by folding them into GF-4 — vs. literal per-block pay, which sharpens the unbond cessation edge). Prioritization: ledger → adversary sim → longevity question, all pre-seal. Docs-only; the ledger/sim/model calls live in their home docs (STAKER_ARCHIVAL_SIM, REWARD_EMISSION_LEG, staking model).

• archival: Gate 6 Round 2 adversarial pass 2 — GF-1-carve asymmetry + age-stratified R-3 (2026-06-13). Two sharpenings on the pass-1 landings in ARCHIVAL_FIREWALL_GATE6.md. GF-1-carve is not a balanced fork — the carve is the default trajectory by omission: gate-4 §3.5 step 5's existing wording ("P hybrid signatures on vin") already presumes the account hybrid_sign_pk, written before the Round-1 identity-only invariant existed, so the carve happens silently unless explicitly chosen against (the "absence of the claim is a claim of absence" trap). Reframed the §9.6 collateral-out cell + note: collateral-out is the only P path with neither a key image nor a bindable leaf (the bond is a consensus balance), which is exactly why the account key tempts; carving trades the cleanest Round-1 invariant (account key = identifier, compromise reveals nothing spendable) for "compromise drains the bond." Recommended disposition: a dedicated bond-spend key committed in the record (own HKDF label + KAT, domain-separated from identity; non-replay from bond_debit ≤ bonded_total + tx-height/input binding, no key image needed). Recorded a receipt-UTXO custody direction (non-transferable receipt spent on the standard per-output + key-image path — replay-free, partial-unbond = receipt split, value-leg byte-indistinguishable) as a gate-4 custody-model call, not a prescription. Concrete action pinned: re-word gate-4 §3.5 step 5 to name the authorizing key and resolve at gate-4 source before the bond-post verifier lands (consensus rule — wrong-once = fork-to-fix). R-3 reconciliation must be age-stratified, not a re-tuned flat scalar: the sim's "flat seating cost" stands in for a friction (cooldown, partial-slash, lockup, bond_duration(age)) that is worst on the deep tail, so recalibrating it to a network average stays structurally optimistic on the binding constraint — the pre-seal requirement is "model friction age-stratified," else a re-tuned flat cost looks reconciled while shipping an optimistic floor over the +1 margin it protects. Added a critical-path-out-of-Round-2 note (§10.11): the GF-1-carve wording fix + the FSM→age-stratified-reconciliation→seal chain are the real path; transport tuning defers to testnet replay. Docs-only.

• archival: Gate 6 Round 2 adversarial pass 1 — fork dispositions + rebond/unbond scope (2026-06-13). Worked ARCHIVAL_FIREWALL_GATE6.md §10 with the reviewer, verifying the load-bearing claims at source before landing (Round-1 verify-don't-infer discipline). Rebond/unbond at genesis (R-1/R-2/R-3): confirmed bond is consensus-tracked balance (gate-4 conservation law), so completing the FSM post-genesis is a hard fork. Source-reframe — the FSM already carries JoinMarket/Rebond/full Unbond + cooldown (=2 < W) + bond_duration(age); voluntary partial-unbond is HoldingsUpdate (post_kind=3), specified but flagged "V3.1 wire" (ARCHIVAL_BOND_GATE4.md §3.2/§4.4), so R-1 = a V3.1→genesis promotion (+ top-up wire), a gate-4/FSM-retool call. §9.6 bond-post row split collateral-in / collateral-out with the GF-1-carve open question named (bond-debit vin auth key — account identity vs per-output); §6 R4 re-scoped to recurring GF-4/GF-7, GF-10 extended to bond ops. R-3 verified: the sim explicitly abstracts release cooldown / partial slash / capital-lockup to "a flat seating cost" (STAKER_ARCHIVAL_SIM.md §steady-state #6) and the genesis-seal carry is integer + +1 deep-tail margin (ARCHIVAL_SIM_ECONOMICS_VERDICT.md); since bond_duration peaks on the deep tail where the margin lives, the FSM-friction reconciliation compounds the tail-margin finding — the rebond/unbond FSM is a pre-genesis-seal dependency for the R-3 sim reconciliation. §10 forks: §10.4 bonded-verifier-only + restricted-discovery (L14 oversight volume is challenge≡retrieval / population-independent — the real check is challenger liveness vs L14b m-of-n); §10.5 announce → broadcast (event-sensitivity + R3 sequencing hazard); §10.6 own-node/Dandelion secondary (GF-6 shape orthogonal); §10.7 crypto over-coupling foreclosed (HKDF one-wayness), real risk is restore co-activation. New §10.9 P↔principal client/circuit isolation exit pin (forks 1+4: independent Arti clients/guards + restore-flow discipline — StakeEngine must not co-launch P's HS with principal sync). Pure-rendezvous genesis lean (§10.8); I2P-closed-at-genesis lean (§10.11). Docs-only; the gate-4/FSM promotion + the GF-1-carve resolution are cross-doc calls, not executed here.

• archival: Gate 6 Round 2 draft opened — network + transport layer (2026-06-13). Drafted ARCHIVAL_FIREWALL_GATE6.md §10 as the opening position for the Round 2 adversarial pass (OPEN, not closed). The round's bar is defense-in-depth (named fingerprint + measurable mitigation + honest residual), explicitly not algebraic separation — the network layer cannot rest on a proof the way the crypto layer (§9) does. Threat model: live network observer (ISP, malicious peer, HS-side, partial passive); property is that P's serving/challenge/broadcast traffic never links to the principal's clearnet identity or wallet traffic. Two traffic classes: light/privacy- critical over Tor, heavy/archival serving over onion-rendezvous (no clearnet fallback, worst-case L-regime by construction per L16). The five R1-named entry gates were threaded into the draft: GF-12 — Arti service-side onion-service hosting confirmed (done/stable since Arti 1.2.0, 2024-03; onion-service-service feature on arti-client 0.43.0; web-verified per dependency-discipline, with the at-source pin carried to the transport PR), embed-Arti-vs-external fork decidable on that pin; GF-3 — challenge-response + liveness-re-proof Levin class added to the anonymity-routable set, P refuses clearnet-arriving challenges (loud, no fallback); GF-5 — pre-join backing presentation pinned to a fresh anonymity circuit with no principal stream reuse (it is P's first network appearance), announce↔anchor timing handed to Round 3; GF-6 — P-tx broadcast-origin fingerprint characterization obligation (cell/fragment granularity) + dummy/fragmentation policy shape, with the explicit distinction that on-chain P-typing is public-by-function and not the concern, tuned ratio carried to testnet replay; GF-9 — HS identity key p_slot-bound + seed-derived via a new §9.3 HKDF label (launch_onion_service_with_hsid), making .onion rotation structural and seed-recoverable, serving-side key-compromise residual named (and the new label must enter the ARCHIVAL_P_DERIVE_V1 KAT). Added the single heavy-path relaxation lever that feeds the sim (§10.8, privacy > bandwidth) and ten open questions for the pass (§10.10). Docs: ARCHIVAL_FIREWALL_GATE6.md (§§1-status, 2.2, 6, 10 [new], 11 [renumbered], revision history).

• archival: Gate 6 Round 1 closed — P lifecycle + pseudonym hygiene (2026-06-13). Adversarial-pass disposition on ARCHIVAL_FIREWALL_GATE6.md §9. GF-1 (critical): rewrote §9.6 with a per-transaction-type verifier contract — the account-level hybrid_sign_pk is the bond-record identity only (the on-wire P_pubkey feeding P_canonical_id) and is never a per-input PqcAuthentication.hybrid_public_key; emission backing inputs authenticate against the leaf-committed per-output pqc_pk the membership proof binds in-circuit (FCMP_MEMBERSHIP_ONLY.md §7, no key image), fee inputs / ordinary transfers / terminal drains use per-output keys, and ordinary P transfers carry no P-typing (byte-identical to principal transfers — the firewall property, not a gap). This aligns the doc to the already-implemented FcmpMembershipOnly contract; no consensus-rule change. GF-2 (high): made the dual-scan firewall architectural rather than a naming convention — StakeEngine owns P.view_sk as an identification context disjoint from the principal LedgerEngine scan, separation rests on distinct combined_ss/decap material (shared output-derive labels are safe because the discriminator is the decap layer), a shared scan loop is allowed only with match-routing and no cross-assignment, and the cross-pipeline non-cross-assignment negative test is named; added P-scan ownership rows to the §5 consumer map. Corrections: GF-8 (the §9.3 L = … placeholder was cosmetic — per-row L is pinned 64/64/64/32, matching account.rs and derivation.rs), GF-11 (MAX_CLAIM_AGE_W = 26 > MAX_SETTLEMENT_EPOCHS_PER_ EMISSION = 15 already pinned in ARCHIVAL_TIMING_CONSTANTS.md §1 — added the cross-ref, no new pin), GF-4 (drain delay floor already pinned; the terminal-drain output-count discipline is the remaining Round 4 hard exit). Remaining findings folded into the §6 round table as named criteria: GF-3 / GF-5 / GF-6 / GF-9 / GF-12 as Round 2 entry gates, GF-10 as a Round 3 exit, GF-4 / GF-7 as Round 4 hard exits. Reviewer sign-off recorded (§9.8). Three post-sign-off review refinements folded in: C-1 — the emission backing-input quantum spend-authority binding is now a named carried dependency (§9.8), verified at source (FCMP_MEMBERSHIP_ONLY.md §7/§8.2/§9: the membership proof and ML-DSA check bind the same proven leaf at the same input index via the in-circuit H(pqc_pk) extra scalar — implemented; the vin-layer ML-DSA equality check is a not-yet-landed hard merge blocker that must precede the archival_p impl + emission verifier); C-2 — re-anchored the GF-2 ownership boundary, since PHASE_2B §4.6 is claim-era/pending-retool: StakeEngine sole ownership of P.view_sk is now a Gate-6 forward requirement on the FSM retool (the §2.1 dual-scan pin is authoritative; the crypto basis is actor-independent); C-3 — the cross-pipeline negative test now asserts a loud-fail defensive invariant (double-match unreachable by construction). A second-order C-1 confirmation followed: verified at source (FCMP_MEMBERSHIP_ONLY.md §5.1) that the MembershipSpendAuth R_O leg proves classical knowledge of the leaf's spend secret (ownership) — "membership-only" omits the key image, not the authority — so the interim "classical security only" characterization is accurate (PQ-weak, not authority-free); and the C-1 dependency is now enforced by a failing test (the §7 pqc_pk-mismatch forgery negative rejects until the vin-layer ML-DSA equality check lands), with a stressnet negative-case obligation. The ARCHIVAL_P_DERIVE_V1 KAT manifest + shekyl-crypto-pq::archival_p implementation and the C-1 confirm-at-source dependency are the Round-1 carries. Docs: ARCHIVAL_FIREWALL_GATE6.md (§§1-status, 2.3, 2.4, 5, 6, 7, 9.3, 9.4, 9.6, 9.8, revision history).

• docs: reward-emission vin implementation plan (REWARD_EMISSION_VIN_PLAN.md, 2026-06-13). Sub-PR decomposition (PR-E0…E5) for the REWARD_EMISSION_LEG.md §12 emission leg, downstream of the closed consensus spec. Round-0 pre-flight substrate audit recorded against actual code; ML-DSA backing-auth hard merge gate bound to PR-E3; txin_stake_claim/C_stake deletion surface enumerated; 07-consensus-atomic-cutovers.mdc evaluated (exception does not apply, standard splitting governs). Architecture is Rust-first: the new emission consensus logic (untrusted-input parse, amount arithmetic, membership + ML-DSA crypto) lives in Rust behind shekyl_emission_vin_verify joining the shekyl_archival_*/shekyl_fcmp_* FFI family; C++ keeps only the txin_v variant + epee/boost/JSON transport shim, pushing the FFI boundary forward for the Stage-5 cutover (10-shekyl-first.mdc, 20-rust-vs-cpp-policy.mdc). No production code lands against the plan. Cross-refs: REWARD_EMISSION_LEG.md §13, FCMP_MEMBERSHIP_ONLY.md §9.

Fixed

• oxide: transaction wire version corrected from 2 to 3 (2026-06-14). shekyl-oxide's Transaction hardcoded wire version 2, but Shekyl's sole admissible transaction version is 3 (CURRENT_TRANSACTION_VERSION, src/cryptonote_config.h; the daemon rejects tx.version < 3). The Rust reader gated on version != 2 and so rejected every real Shekyl transaction — including the genesis coinbase — a latent correctness bug on the RPC sync path that was masked only by the absence of a live v3 chain. Fixed the four version scalars (Transaction::read gate, write emit, version(), and the TransactionPrefix::hash preimage — the last keeps the tx hash in sync with the daemon's get_transaction_prefix_hash) and renamed the single enum variant Transaction::V2 → Transaction::V3 so the type reflects the one admissible wire version. The scanner's coinbase tx.version() != 2 guard was corrected to != 3 in lockstep. New cross-language KAT (rust/shekyl-oxide/shekyl-oxide/src/tests/transaction.rs real_mainnet_genesis_tx_parses_as_v3) parses the verbatim mainnet GENESIS_TX and asserts version 3 + coinbase shape; the synthetic round-trip test is now v3_coinbase_round_trip. Prerequisite for the CT-5a genesis-seed facility. No consensus or wire-format change — the wire was always v3; only the Rust constant was wrong.

• archival: standoff harness review-response fixes (PR137, 2026-06-14). Resolved Copilot review findings on rust/shekyl-staking-sim/src/standoff.rs and the standoff docs: (1) run() guarded with assert!(cfg.trials > 0) (an empty sets indexed p05 / divided by zero) and dropped to private (no caller outside the module); (2) both block→minute conversions centralized in a blocks_to_minutes helper that casts to f64 before multiplying and maps the u64::MAX "no finite window" sentinel (returned by recommended_window_blocks for rate <= 0) to infinity, removing a u64 overflow; (3) inversion_prior_break computed from the discrete gap model 0.5·W/(W+1) instead of a constant 0.5 — accurate for the integer gap and correctly 0 at W=0 (events coincide, no inversion possible); the --standoff report's inversion arm now reads 0.49834 (was 0.5), all other metrics byte-identical. Also fixed a doc inconsistency in STAKER_ARCHIVAL_SIM.md and FOLLOWUPS.md (the spread test was described as continuous "KS against uniform" in one place and the correct discrete chi-square GoF in another — unified on the discrete chi-square the implementation uses). Follow-up review round: (4) search_width_blocks now reports the width that actually feeds the decoy model — the surge cluster width under a shared trigger, not the inversion-adjusted window — so the shared-trigger arms read 3.0 instead of the misleading window value (anon_set unchanged; the model already used the cluster internally); (5) recommendation()'s entry_latency_frac_epoch maps the u64::MAX "no finite window" sentinel to ∞ (was a huge finite number), keeping homeostasis_free meaningful and consistent with recommended_window_minutes. fmt + clippy clean; 49 sim tests green.

• oxide: deserialize the consensus block-header curve_tree_root (CT-5 pre-0, block-deserializer correctness fix surfaced by CT-5, 2026-06-14). The Rust shekyl-oxide BlockHeader parsed only five fields and stopped at nonce (block.rs), while the consensus C++ block_header serializes a sixth field — the FCMP++ curve_tree_root — after nonce (src/cryptonote_basic/cryptonote_basic.h, FIELD(curve_tree_root)). On a real six-field block this left 32 bytes unconsumed and Block::read mis-aligned the following miner transaction (parsing the root's first byte as the tx-version varint → version != 2 reject), so Block::read would fail loudly on any real Shekyl block. Severity verified at source as "not-yet-exercised": no real consensus block had ever been deserialized by the Rust path (tests fed synthetic five-field blocks); there was no compensating offset (the only block-hash special-case is the unrelated inherited 202612 Monero test-vector remap), and serialize_pow_hash hashed the five-field header so the Rust block hash could not match consensus. This fix adds curve_tree_root: [u8; 32] to BlockHeader and reads/writes it unconditionally after nonce — never gated on hardfork_version, because the field is present from genesis (Shekyl minimum hard fork is 1) and a version gate would be a dead pre-genesis branch (60-no-monero-legacy.mdc). It also corrects Block::hash() (the preimage now includes the root) and thus ReferenceBlock.block_hash, which CT-5 depends on. KATs: header round-trip preserving the root, a consensus field-layout cross-check (six-field byte order matching the C++ BEGIN_SERIALIZE), and a full-block round-trip proving the miner transaction no longer mis-aligns. Establishes block-header/block deserialization correctness for the first time; lands ahead of CT-5a per CT5_ENGINE_WIRING.md §3.6 / §6 (R1-Q6, E3).

• docs: correct stale REBUILD_AT default in CURVE_TREE_CLIENT.md §8 #3 (2026-06-13). §8 open-question #3 read MAX_AGE/2 = 47 as a "first cut", but the landed reference.rs defines REBUILD_AT = FCMP_REFERENCE_BLOCK_MAX_AGE / 2 = 50 (MAX_AGE = 100), pinned by a const-eval assert and reference::tests — and §5/§5.2 already say 50. The 47 was stale arithmetic. Corrected to 50 and marked the open question CLOSED (value landed + pinned), with the reopening criterion retained (measured propagation/confirmation latency). Docs-only.

• archival: bond load-modify-store no longer wipes the v4 emission-dedup fields (F-S1 / F-E5, PR-E0, 2026-06-13). put_archival_bond_record reconstructs a fresh ArchivalBondValue from scalar args and cannot carry the v4 claimed_settlement_epochs set or first_paying_emission_height. The slash apply/revert paths loaded the full bond, mutated it, then wrote back through that reconstructing writer — silently dropping both v4 fields on every slash and every reorg revert. Added a full-bond writer BlockchainDB::put_archival_bond_value(p_id, bond) (LMDB impl + no-op base + testdb stub) that serializes the entire decoded record; put_archival_bond_record now delegates to it (its only caller is JoinMarket connect, a fresh-P create where the scalar path is correct). apply_archival_slash_one and revert_archival_slashes_at_height now write the mutated bond through the full-bond writer, so the dedup state survives a slash and reverts cleanly with pop_block. Added a public reader get_archival_bond_value and three regression tests in archival_substrate_lmdb.cpp (bond_v4_fields_survive_full_writer, bond_v4_fields_survive_load_modify_store, bond_v4_claimed_set_survives_reorg_revert). The claimed_epochs_check_and_set C++ FFI stays deferred to its first consumer (the emission write path, PR-E3) per spec §6.3 and 15-deletion-and-debt.mdc. Also closed a sibling encode/decode asymmetry in the same write path: ArchivalBondValue::encode() serialized any holdings_kind byte while decode() rejects unknown values, so a writer could persist a record no read path can decode. encode() now rejects unknown holdings_kind alongside its existing at-rest invariants (bounds, claimed-epoch well-formedness), which protects every writer through the single serialization funnel; regression test bond_encode_rejects_unknown_holdings_kind. Because apply_archival_slash_one was moved to public scope for the slash regression tests, it now carries the same check_open() + active-write-txn precondition the internal scheduler enforces, so direct invocation without a write txn fails loudly instead of dereferencing a null *m_write_txn; regression test apply_slash_requires_active_write_txn. This is a latent-bug precursor the emission vin (PR-E3) depends on; no emission behavior changes. Docs: REWARD_EMISSION_VIN_PLAN.md §1.5 / §3 PR-E0.

Changed

• economics: shekyl-staking-sim default backend is now the authoritative integer Curve (2026-06-13). --curve-impl=integer (imports the canonical shekyl-archival-retention::reward_arithmetic, the code the emission vin mints with) is the default for all sweeps; --curve-impl=float is opt-in exploration only and is no longer authoritative — PR 1.5 (ARCHIVAL_SIM_ECONOMICS_VERDICT.md) showed the float backend over-reads worst-shard redundancy by up to one replica (the tail-margin finding). An unrecognized --curve-impl value now fails loudly (exit 2) instead of silently falling back to float, and every run prints the active backend (with a "NOT authoritative" tag for float). The CurveImpl type-level default and the scenario base config flip to Integer accordingly; the float↔integer reconciliation tests remain as drift guards. Closes the M-1 follow-on "stop treating float as a co-authoritative validation substrate."

• docs: emission-vin plan readiness review — M-2 promoted to supply keystone (REWARD_EMISSION_VIN_PLAN.md, 2026-06-13). Round-1.5 readiness pass: substrate frozen, PR-E0 ready to branch now (zero open deps), PR-E1/E2/E3 gated on a named §8 gating cluster. M-2 (numerator as-of-E sourcing) is promoted from a Q10 parenthetical to its own pinned disposition as the supply-conservation keystone and a PR-E3 hard blocker: the accumulator schema was pulled and confirmed at source (ARCHIVAL_CONSENSUS_STATE.md §3.5 persists aggregate Σwork(E) + per-shard R_market(s,E), not per-P capped_P(E)), so the vin reconstructs the numerator and the supply property rests on as-of-E frozen inputs; three are pinned, the fourth (held(P,E)) is Q10/F-E6, so M-2 closes with Q10 and is resolved jointly with Q7 (the snapshot ABI = M-2's frozen-input set). Q9/F-E3 (intra-block dedup) flagged as the second hard blocker; Q1 gates PR-E2's wire; gating-cluster table + round-2 leverage order added to §8.

• fcmp: FcmpMembershipOnly — spend authority + tree membership, no key image (2026-06-12). Implements the REWARD_EMISSION_LEG.md §7.2 verify API (the §12 sibling-API gap) as a sibling type to FcmpPlusPlus in the shekyl-oxide FCMP++ crate; first consumer is the emission vin. MembershipSpendAuth keeps SAL's R_O leg alone (96 B/input — the self-contained (x, y~) opening proof over (G, T)); the BP+/P'/L key-image machinery is not carried; the Fcmp membership leg, including the H(pqc_pk) extra-leaf-scalar binding, is unchanged. Both SAL-family challenge transcripts now open with fixed-width 64-byte zero-padded type tags (the full spend path's transcript changed too — consensus transcript change, migration-free pre-genesis, guarded by a named roundtrip regression), with length-regularity of both preimages verified field-by-field as the invariant the tags rest on. Per-input challenges bind the tx hash and the input index (u32 LE — forecloses cross-slot transplant); empty input sets reject rather than vacuously verify. All per-proof scalars are synthesized RFC-6979-style (a degraded RNG cannot zero or reuse them) with a loud degenerate-rerandomization guard as backstop, since O~ freshness is the entire non-linkability property for an input type publicly tagged as archival activity. Measured strictly smaller than the 1-input FcmpPlusPlus order it was provisionally sized at (3 104 B vs 3 392 B at 1 layer), closing the §10.1 caveat's size arm. 18 tests: roundtrips, cross-type rejection at the deserialization seam (both directions), mixed-type batch rejection (both polarities), freshness/ZeroRng/guard, index-binding, blob-swap, replay, wrong-root, tamper, sizing. Two named gates carried: external review of the soundness reduction (FCMP_MEMBERSHIP_ONLY.md §5.5) pre-genesis, and the ML-DSA backing-auth hard merge gate on the emission vin PR — the membership-only proof is classically secure only; quantum spend authority lives at the vin (FCMP_MEMBERSHIP_ONLY.md §7). Docs: FCMP_MEMBERSHIP_ONLY.md (new), emission-leg §7.2/§10.1/§12 + layer table.

• archival: ArchivalBondValue v4 — inline ClaimedEpochSet + first_paying_emission_height (2026-06-12). Implements the schema half of the Stage-3 gate per REWARD_EMISSION_LEG.md §6.2/§6.3 (encoding pinned 2026-06-11; P2B-3). The LMDB codec (blockchain_db/shekyl_types.h) appends the windowed claimed-epoch set (u32 count + u64 BE entries) and the set-once first_paying_emission_height (sentinel 0 = unset, unreachable — no emission pays before the first settlement epoch closes); v3 is decode-rejected per the pre-genesis posture. Decode invariants: cap W + 6 (= 32, §6.3 pin), strict monotone order, span ≤ W; the cap derives from max_claim_age_w in config/consensus_constants.json, newly wired into the C++ generator (SHEKYL_ARCHIVAL_MAX_CLAIM_AGE_W). The dedup semantics live in Rust only (shekyl-archival-retention::claimed_epochs), per the C++-deletion direction and the good_through precedent: window maintenance is part of check_and_set (prunes entries below current − W on insert), closing the review round's liveness finding — insert-only semantics would have a continuously-claiming honest P overflow the cap at ~epoch 33. FFI surface deferred to its first caller (emission vin). Also lands the §4.5 / consensus-state §4-invariant-2 joint finalization-boundary pin (Σwork(E) materializes at the boundary block (E+1)·SEB connect; citing emissions valid strictly above it; reorg-safe by pop ordering). Docs: LMDB_SCHEMA.md v4 layout, ARCHIVAL_CONSENSUS_STATE.md §8/§9.1 schema-implemented status, emission-leg §1.1/§6.2/§6.3/§12, PHASE_2B_FSM_RETOOL.md P2B-3 landed, PHASE_2B_STAKE_LIFECYCLE.md §2.4 gate line (Stage 3 now gates on gate-6 soundness only), FcmpMembershipOnly proof-type domain-separation requirement made load-bearing (§7.2).

Changed

• crypto: CT-3↔CT-4 audit cleanup — fold the reference-block hash into ReferenceBlock; doc-code resync (shekyl-curve-tree, 2026-06-13). CurveTreeClient::assemble_path no longer takes a loose positional reference_block_hash: [u8; 32]; the hash is now ReferenceBlock.block_hash, so the caller supplies the full consensus anchor (height, curve_tree_root, block_hash) as one value. This removes a footgun — output keys, commitments, roots, and block hashes are all [u8; 32], and a positional arg invited a silent swap — and brings the API to the two-arg shape CURVE_TREE_CLIENT.md §5 already documents (the third arg was residue of the now-landed §5 horizon work). All call sites (assemble_kat, archival-retention crosscheck/serve KATs) and ReferenceBlock literals updated; no production caller existed yet (CT-5 engine wiring is unbuilt). Docs resync: the assemble.rs "horizon deferred" comment was stale (reference.rs landed select_reference_height et al. in CT-4) and is rewritten; CURVE_TREE_CLIENT.md §9 CT-4 row flipped from a select_reference_block/client stub to Landed with the real assemble + reference modules and symbols; the non-existent select_reference_block symbol corrected to select_reference_height / should_reanchor in FOLLOWUPS.md, PHASE_2A_SEND_PATH.md, and SHEKYLD_PREREQUISITES.md. FFI audit: recorded (not fixed — it is a planning-activity daemon change per 20-rust-vs-cpp-policy.mdc / 15-deletion-and-debt.mdc) that on_get_curve_tree_path recomputes the key-image generator I = Hp(O) via C++ hash_to_p3 instead of the existing shekyl_compute_output_key_image FFI, folding into the daemon path-assembler migration. No consensus surface touched.

• fcmp: typed the FCMP++ composition layer to make the verify input-context misalignment unrepresentable (2026-06-12). The Copilot rounds on the membership-only PR surfaced a recurring shape in shekyl-oxide's FCMP++ crate rather than one bug: proof_size hard-coded the per-leg byte counts, and FcmpPlusPlus::verify took the key images and H(pqc_pk) leaf scalars as two parallel Vecs whose lengths each needed a guard (one of which misrouted a PQC-count mismatch to the key-image error variant, fixed in PR #129 round 3). This change addresses the cause: per-leg wire sizes are now owned by their types (Input::PARTIAL_WIRE_SIZE, SpendAuthAndLinkability::WIRE_SIZE, MembershipSpendAuth::WIRE_SIZE), with proof_size composed from them and transitively asserted against the serialized length by the existing roundtrip tests; and FcmpPlusPlus::verify takes a single ordered Vec<InputVerification> bundling each input's key image with its leaf scalar, so a length mismatch or cross-input transposition is no longer representable as two independently-sized collections. The two count-mismatch error variants (InvalidKeyImageQuantity, InvalidPqcPkHashQuantity) collapse into one InvalidInputCount; the wrapper in shekyl-fcmp already does its own granular length checks before calling the oxide layer, so no downstream granularity is lost. The membership-only verify keeps its single pqc_pk_hashes Vec — it has no second per-input collection by construction, so the bundle is not warranted there (reversion clause: introduce it if a second collection is ever added). No consensus behavior changes; all 18 fcmp++ and 66 shekyl-fcmp tests pass.

Fixed

• sim: sole-source window tick moved to end-of-epoch (PR #126 Copilot round 2). The swan-4 tick ran after the mid-epoch wipe-out scan but before process_exits and its post-exit re-scan, so a window opened by an epoch's voluntary exits started counting one epoch late and a window the next epoch's re-acquisition closed immediately was never counted. The tick now reads end-of-epoch serving state (after the post-exit re-scan refreshes deep_seated). Re-measured swan-4 arms confirm the predicted +1-per-exit-opened-window undercount exactly (ssSE += run-wide extT on each row): reseed-3 V-trough 365 → 429 (worst window 9 → 10), reseed-12 170 → 204, servo-400 282 → 403, and 5 final-epoch windows on the servo row are now visible at the run boundary (ssOpn 0 → 5). Banked figures updated in STAKER_ARCHIVAL_SIM.md §L17 (table, Finding 4, ledger row), FOLLOWUPS.md, and the public prose (~9 → ~10 epochs worst window). Same round: the per-epoch scan comment's stale "data-extinction" wording aligned with the swan-4 sole-source framing. Round 1 of the same review (commit 2fdf33650) aligned the ScenarioResult / ExtinctionScan doc comments, added the [0, 1] loud-failure assert on the shock exit fractions, corrected the ArchivalLockModel formula doc, and made locked_atomic panic on blocks_per_shard == 0 instead of silently reporting zero locked supply.

Added

• crypto: CT-3c persistent reorg rollback (shekyl-curve-tree, 2026-06-12). CurveTreeClient::rollback_to_fork(BlockHeight) now rolls the redb-backed LeafStore back to an inclusive fork point, verifies the boundary-adjacent frozen segment's R_k, rebuilds in-memory state from the authoritative store, and resumes forward ingest at fork + 1. Rollback partitioning is aligned with CT-2's drain boundary (maturity > drained_through(fork_height), while sync_tip_height and the orphan filter remain fork-height based), fixing the off-by-one that would otherwise keep maturity == fork rows drained and make the first post-rollback block remove already-drained pending rows. New structured store errors identify frozen-record absence and R_k mismatch. Coverage adds the primary direct pending-row equality KAT with a re-draining class-(b) witness and a 150k-lock never-draining witness, plus a file-backed reorg_deep rollback/resync KAT against fresh replay and consensus roots. LeafStore::append_drained is now test-only so production ingest cannot bypass pending-table maintenance. Review hardening (2026-06-13): the rollback poison contract is now machine-enforced — the client sets an internal poison flag at the store commit and clears it only on full rebuild success, so a post-commit failure makes every load-bearing call (ingest_block, root_at, verify_root, rollback_to_fork) fail fast with ClientError::Poisoned instead of relying on caller prose discipline; verify_frozen_tail maps a corrupt freeze-segment counter to StoreError::CorruptMeta rather than panicking on the rollback path; and the persistent reorg_deep KAT asserts its deep_pop <= main_tip fixture invariant explicitly.

• crypto: CT-3b persistent client lifecycle (shekyl-curve-tree, 2026-06-12). CurveTreeClient::open(path) resumes from a persisted LeafStore with no genesis replay: in-memory state is rebuilt as the gindex-sorted union of the drained and pending tables, element-wise identical to a never-restarted run (B4 invariant, KAT-pinned end to end via a restart round-trip). ingest_block now writes both tables atomically through append_block_deltas before committing in-memory state, making the store-behind-memory divergence structurally unreachable — the CT-2-era self-heal path is deleted with that inversion. Resume refuses pruned stores loudly (ResumeFromPrunedStore; pruned-resume is F5/V3.0 work) and rejects cross-table gindex duplicates as corruption. The client's outward API (BlockLeaves.height, ingest_block, root_at, verify_root, drained_leaf_count, error fields) is retyped u64 → BlockHeight, closing the client portion of the CT-3a P5 FOLLOWUPS row. Staked-lock resume coverage lands both B3 halves: a synthetic 300-block stake drains correctly across a restart, and the adversarial 150 000-block stake is asserted byte-correct in the pending table without ever draining. SCHEMA_VERSION bumps 2 → 3: a CT-3a-window store is byte-identical but its pending table was not yet maintained by ingest, so resuming from one would silently corrupt the drained/pending contract — v2 stores now fail open with SchemaVersionMismatch; the pre-genesis migration path is delete the wallet store and re-sync.

• crypto: CT-3a persistent-resume store schema (shekyl-curve-tree, 2026-06-12). The LeafStore now carries the full CT-3 sync/reorg contract at the store layer (CT3_SYNC.md Round 1, closed): redb-typed keys end to end (BlockHeight/Gindex newtypes plus the TreePosition/SegmentId retrofit, byte/order delegation KAT-verified), a schema_version stamp checked before any write on an existing file (error-without-mutation), creation_height on LeafEntry/leaf_meta, a pending-candidates table, the single-txn append_block_deltas write API (collision/missing-row loud, abort-leaves-no-trace), resume read paths with runtime-checked invariants (gindex parity, maturity monotonicity, key-set symmetry), and rollback_to_fork — pruned-range-safe partition search, two-class drained→pending migration, the uniform creation_height > fork orphan filter, and frozen-segment rollback through shared truncate internals. KAT/robustness coverage includes equal-maturity partition boundaries, a full-snapshot atomicity check, deterministic rand_chacha codec round-trips, and a rollback-equals-prefix-replay property test driven through the production write API. Client wiring is CT-3b/3c.

• docs: swan-arc closure notes — seeding SLO recommendation, domain diversity, enforcement pins (2026-06-11). Five small dispositions closing the L17 black-swan round series. (1) Seeding SLO carries the recommendation, not just the measurement: provision foundation re-seed capacity at the crisis multiple, ~4× steady-state flow — the 40 → 10 wipe-out result is the actionable number (surge seeding interrupts the trough cascade before it propagates), and unlike adaptive m/n widening it is not gameable (the foundation's own provisioning decision, not an adversary-triggerable consensus rule, so the §3.3 static-margin objection doesn't apply). Landed in the authority pin, L17 Finding 4, disposition, ledger row, FOLLOWUPS. (2) Foundation domain diversity folded into the SLO: during a sole-source window the shard's availability is the foundation's uptime with effective domain count 1 in the L15 sense; internal redundancy counts toward the diversity floor only if the N_active = 3 seats sit in distinct failure domains. (3) Liveness-signal escape inherits the unpredictability prerequisite (ARCHIVAL_FAILURE_CONFIRMATION_PIN.md §3.2): whatever replaces m-keyed slashing carries the H_fire-class beacon-unpredictability requirement — a predictable liveness probe rebuilds the §5 gaming surface under a new name. (4) Crisis-price multiplier pinned (rule 21): the deterrence-credible criterion is evaluated at the L17 fatal channel, ×0.25 permanent — evaluators do not choose their own stress level; reopens only with the L17 grid itself. (5) Closure observation banked (L17 Finding 4): the scarcity servo and foundation seeding compose by construction through the sole-source window — foundation isn't in Market, so a sole-source shard reads R_market = 0 (maximal scarcity, maximal g-weighted re-acquisition reward) exactly while the foundation supplies the bytes; the binding constraint is reseed_rate, which is what the SLO sizes. The trough self-heals as designed; no emergency mechanism is needed. Black-swan layer closed in the full sense: measured tails, named guarantees, scoped residues (W16/W17 in the Round-2 enforcement gate, W4/W8 in FOLLOWUPS), reversion clauses keyed to the right triggers.

• sim: swan-4 — retention correction + foundation-sourced re-seed bottleneck (L17, 2026-06-11). Third wargame response; dissolves the swan-2/-3 extinction framing. The genesis foundation seeds retain at least one complete copy of every shard permanently, so market-side extT/shkExt events are foundation-as-sole-source transitions, not data loss — the 37/99 price-row results re-read as an availability / re-seed bottleneck, and the sim's previously "sourceless" backfill is coincidentally modeling the real foundation-sourced path. New reseed_rate knob caps fresh-deep acquisitions of sole-source shards per epoch (bandwidth-bound foundation seeding over the L16 rendezvous path); new metrics ssSE (sole-source shard-epochs), ssMxW (max single-shard window), ssOpn (windows open at end). Measured (swan4_vshape_reseed3/12, swan4_servo400_reseed3): at reseed_rate = 3 (~1 seeding flow per active seat) the V-trough costs 429 sole-source shard-epochs, worst window 10 epochs, servo-400 403/9 (5 final-epoch windows open at the run boundary; everything else re-seeded by horizon end); 4× provisioning halves exposure (429 → 204) and cuts wipe-out count 40 → 10 (faster re-seat interrupts trough cascades). (Figures re-measured after the PR-126 Copilot fix below; the pre-fix tick undercounted each exit-opened window by one epoch.) Foundation seeding bandwidth is therefore an availability-SLO sizing input, exported to gate-5 ops. L17 verdicts re-worded ("extinct" → "sole-source"), Findings 1/4/5 + disposition re-anchored on the retention guarantee ("no shock in this grid loses data; the grid measures availability"), reversion clause keyed on the no-sunset retention pin (W12/W13 completeness questions parked against it, not deleted). docs/design/STAKER_ARCHIVAL_SIM.md §L17.

• docs: swan-4 retention authority pin + availability re-frame (2026-06-11). V3_STAKER_ARCHIVAL.md §Foundation complete-tree seeds gains the authority pin distinguishing three previously conflated properties: retention (complete B+C held permanently, no sunset — the durability guarantee of record), internal redundancy (foundation ops: N_active = 3 seats, fiat-diversified reserves), and serving participation (the population-decaying floor the sim models). Names the single-organization threat model the guarantee creates (infra loss, seizure, dissolution over the timeframe-2/3 horizon — the single point the market architecture otherwise exists to avoid) with a reversion clause: if the no-sunset pin is ever reopened, the swan-3 W12/W13 market-completeness questions re-activate at that sunset. FOLLOWUPS.md treasury item re-anchored: the swan-2/-3 "deep-set completeness requirement" converts to documentation of the existing guarantee; what remains is fiat-diversified reserves sized for serving + re-seed duty through the servo-400 impaired window, plus seeding bandwidth as an availability-SLO input. Public prose aligned (ECONOMY_EXPLAINED.md, PUBLIC_NARRATIVE_FAQ.md): crash troughs cause bounded foundation-only availability windows (~10 epochs worst measured), never data loss, and through a trough durability rests on one disclosed organization — stated plainly, not hedged.

• sim: swan-3 black-swan iteration — band read, floor-on closure arms, class-correlated exit (L17 W12–W15, 2026-06-11). Second wargame response; converts the swan-2 export's two inferences into measurements and pins the domain-result provenance. Per-band extinction read (W12): extB bins each shock extinction by age band at extinction time; the price rows are mid-deep-modal, not oldest-concentrated (vshape 20/17 b4/b5; servo-400 5/64/30; permanent-gap 23/181/143) — trough extinction follows holder economics at eviction, not shard age, so the swan-2 oldest-stratum completeness scope under-scoped; gate-5 export re-scoped to the entire deep set. Floored read + closure arms (W13): the swan worlds were bare-lean (floor_replicas = 0 — pinned in the ledger row), so 37/99 was the unbacked read; new shkExF counts data-dead only when market holders and foundation_floor_aged are simultaneously zero (also catches the floor-withdrawal hand-off race). swan3_vshape_floor / swan3_servo400_floor reproduce identical market damage with shkExF = 0 — closure evidence that deep-set completeness converts every measured trough loss into a covered availability window (incl. the 114-epoch servo-400 window); swan3_vshape_floor_t9 shows the P3 tilt ≤ 0.9 doesn't leak (tilt redistributes depth, not membership; any schedule zeroing a deep band's floor share violates completeness — new reversion trigger). Class- correlated exit (W15): the swan-2 domain rows ran with no placement diversity floor (the L15 machinery is scoring-only) — benign results were bucketing luck; new shock_exit_top_deep exits the top deep-holders (honest worst case for the FTX class-correlation pattern): at 50 %, stride 0 / domain-bucketed 1 / class-correlated 28 extinctions; class 30 % costs 4 (outranks every independent 50 %). Reversion criterion (c) re-keyed on class- or domain-concentrated exit ≥ ~0.3. W14: aftershock 4 banked as within the independence-to-no-reseat envelope [(1/2)⁶×120 ≈ 1.9, (3/4)⁶×120 ≈ 21] — above the independence floor because 3 epochs of rate-limited reseat leave the second stride no longer anti-correlated with surviving holder sets. docs/design/STAKER_ARCHIVAL_SIM.md §L17 (table, Findings 4–6, disposition, reversion clause, ledger row).

• docs: swan-3 dispositions W16–W18 (2026-06-11). W16 ARCHIVAL_FAILURE_CONFIRMATION_PIN.md §3.2 gains the fourth joint criterion deterrence-credible: crisis-tail m (W6) and slash deterrence pull in opposite directions — at m = 11/n = 13 a strategic actor misses 10 of 13 baselines slash-free, and a crisis-sized m makes the slash vestigial exactly when the fetch-on-demand temptation peaks (composes with the W5 residue); E[slash] under the realistic degrade play must exceed storage-opex savings at crisis prices, and if no m satisfies all four criteria the decoupled liveness signal becomes the design, not the contingency. W17 the W5 telemetry trigger's observables pinned in L17 Finding 6 + reversion trigger (e): challenge-latency distribution shift (weak, continuous — fetch-on-demand is indistinguishable at the challenge interface per 8c) and correlated load spikes on surviving true holders at challenge anchors (confirmatory — the source set's bandwidth is the side channel degraders cannot hide); ledger row honest that detection is open, not solved; stressnet to exercise the source-load observable under induced degradation. W18 public-facing prose aligned: ECONOMY_EXPLAINED.md "graceful degradation" passage gains the coverage-vs-data caveat (survival of irreplaceable history through troughs is a gate-5 requirement, verified by the W13 arms, not an emergent market property); PUBLIC_NARRATIVE_FAQ.md "market archivers thin out" answer pins the condition (complete over all deep history, held continuously, treasury crisis-uncorrelated per W4). FOLLOWUPS.md treasury item re-scoped to deep-set completeness.

• sim: swan-2 black-swan iteration — extinction read, domain-correlated exit, aftershock, knee timing (L17 W1–W3, 2026-06-11). Wargame response to the adversarial review of the L17 close; converts three assumed-away tails into measured ones. Extinction accounting (W1): backfill in the model is sourceless (best-response sets holdings[a][s] with no surviving-source check), so shkRec was a metric-recovery claim only; new extT/shkExt reads count deep shards whose serving holder set empties after being seated at depth (sticky per slot until recycle; scanned at the shock instant, per epoch, and after voluntary exits — the death-spiral channel's orphanings were otherwise invisible). Domain-correlated exit (W2): shock_exit_domains = n wipes failure domain 0 under the L15 a % n bucketing — stride was the most benign correlation structure (holder sets straddle it; per-shard total loss ≈ 0 by construction). Aftershock + timing (W3): aftershock_at re-fires every shock leg against the survivors; swan2_knee_cascade fires at the L13 decayed-purse knee; swan2_cascade_rho compounds 50 % exit with an entry-suppressing ρ ×2. Five swan2_* scenarios + all swan-1 rows re-run: stride 50 % = 0 extinctions but domain-correlated 50 % = 1 and the 50 %+50 % aftershock pair = 4 (analytic match: (1/2)⁶ × ~120 deep); the recovered V-crash and servo-400 rows quietly extinguish 37 / 99 deep shards in their troughs — metric recovery ≠ data recovery, now measured. Knee-timed and domain-1/3 cascades absorbed with zero data loss. L17 re-dispositioned (claim narrowed to measured; reversion re-keyed on domain-concentrated exit ≥ ~0.3, correlation not magnitude; floor completeness over the oldest stratum exported as a gate-5 survival requirement; honest-holding-under-stress named as residue W5 with telemetry trigger). docs/design/STAKER_ARCHIVAL_SIM.md §L17 + ledger row.

• docs: swan-2 cross-gate exports W4–W11 (2026-06-11). The adversarial review's reversion-clause and cross-reference edits, landed with authority: W4 foundation-treasury diversification named as a V3.0 ops requirement (FOLLOWUPS.md; the floor's fiat capacity is pro-cyclical in exactly the crisis it must absorb, and Finding 4 makes it load-bearing for data survival) and the servo-ceiling pro-cyclicality caveat folded into L17 Finding 3 (crisis-time fee capacity sits below the static ceiling). W6 enforcement pro-cyclicality: ARCHIVAL_FAILURE_CONFIRMATION_PIN.md §3.3 — n − m sized statically against crisis-tail run-lengths under induced correlated failure (adaptive emergency widening rejected per the escalation-dodge result); stressnet campaign extended accordingly. W7 T-A1/F1 acceptance recorded as regime-bounded (F1_TA3_TA7_LIFETIME_WINDOW.md §7: the lean-eq premise is temporarily invalidated at swan troughs of 9–25, where the intersection surface is maximally cheap; Form-C not reopened). W8 gate-6 synchronized-exit wargame queued V3.0 (FOLLOWUPS.md; does RELEASE_COOLDOWN_EPOCHS = 2 smear or merely delay the unbond cohort?). W9 AGG reversion clause gains the downward N_P trigger (reopen iff envelope extends below ~25–30; per-archiver claims scale as 1/N_P — ~70 kB single tx at N_P = 17 year-30; named guard = per-emission claim cap forcing batch splitting) in STAKER_ARCHIVAL_SIM.md + REWARD_EMISSION_LEG.md §10.1. W10 gate-7 bonds-only ↔ R_market weighting coupling cross-referenced both ways (ARCHIVAL_CONSENSUS_STATE.md §3.3 note: serve-credit weighting is load-bearing against ~0.75-coin/pseudonym Sybil inflation; gate-7 close is a blocking input to any re-weighting). W11 swan_regime verdict conditioned on the Finding-0 windowed-Gini reconciliation (L17 Finding 7).

• sim: L17 black-swan / acute-shock axis (2026-06-11). Closes the due-diligence gap between the gradual-decline stresses (L13 subsidy taper, P2 price decay) and step-event crises observed in production networks. Gated shock_* knobs in shekyl-staking-sim (shock_at = 0 ⇒ inert; legacy rows verified byte-identical): one-epoch token-price gap-down with optional V-shaped recovery (March-2020 class vs FTX/deep-bear class), reservation-yield step with relaxation (2008 flight-to-liquidity vs permanent regime change), and stride-sampled forced exit of an active-set fraction (custody-collapse contagion). New reads shkP/shkRec/shkBA (post-shock worst deep gap, epochs-to-recovery, bonded trough). Ten swan_* scenarios at the pinned genesis economics. Findings (STAKER_ARCHIVAL_SIM.md §L17): population shocks are absorbed by construction (30 % overnight exit and ρ×3 panic never breach the deep bar; 50 % exit recovers in 4 epochs; permanent ρ×2 settles leaner but covered); a V-shaped −75 % crash recovers fully in 17 epochs with no ratchet; the fatal channel is a permanent price collapse with fiat-denominated opex (the Filecoin 2022→24 provider-exodus pattern — confirms P2 for step ignition), survivable only when fee-market headroom scales with the real cost multiplier. Disposition: no new V3.0 mechanism; the L13 adaptive servo + re-engaging foundation floor are the bridge; reversion clause recorded.

• sim: spread gate re-anchored on direct whale gauges — Layer-2 close-out (2026-06-11). Implements the gate the Layer-2 band run sealed: shekyl-staking-sim's spread/sprdW verdicts now gate on max_actor_share < 0.20 and oldest-band whale share wB4 < 0.20 (the per-band distinct-actor-seating term rides on the coverage claims, since R counts distinct actors); gini_actor/giniW are printed as reported trend gauges only. Whale-capture bar unchanged at 0.20 — this is a metric re-derivation against the threat model, not a threshold move. Verified by re-run: all lean/whale band rows pass sprdW across g ∈ [1.5, 4.0], and bare-lean coloc fails re-attribute to coverage oscillation (churn_stable), matching the Finding-3 reading. Verdict columns recorded before this date used the gini-gated definition; raw gauge columns are unchanged (supersession notes in STAKER_ARCHIVAL_SIM.md §Layer-2 results and REWARD_EMISSION_LEG.md). Stale pre-Curve-repair attractor counts (~79 archivers) annotated to the post-repair ~113 equilibrium in ECONOMY_EXPLAINED.md and the L11 section (Finding-0 fallout; attractor properties unchanged).

• archival: g(age) normalization pinned — relative-depth age; constant mapped to the sealed band (2026-06-11). Closes the Layer-2 Finding-5 FOLLOWUPS item the day it opened (pre-genesis discount; ARCHIVAL_REWARD_ARITHMETIC.md §Shard age). Consensus shard age is now a relative depth fraction — age_milli = floor(age_epochs · 1000 / chain_epochs) ∈ [0, 1000] — so g(age) spans [1, 1 + age_weight] for the life of the chain, matching the sim semantics the Layer-2 band run sealed. The prior raw-epoch form grew g without bound (≈ 700·w for a 10-year shard at SEB = 10 000), concentrating Σwork onto oldest-band holders over mission timeframes — a shape no sim run validated and the whale-capture surface Layer 2 gates. shard_age_milli reimplemented (signature unchanged — callers already pass close_block_height); archival_reward_age_weight_milli 1000 → 2000 (sealed target g* ≈ 2, calibration band [1500, 2500], retunable on stressnet evidence without a design round); epoch-close KAT vector re-derived by hand (Σwork 3500 → 2590, derivation recorded in the fixture description); REWARD_EMISSION_LEG.md Channel-1 prose carries the unit. Mission-timeframe note: this change is what makes the g ≈ 2 seal valid at the 30-year horizon, not just at genesis.

• archival: Layer-2 margin-robustness band run and closed (2026-06-11). Built and ran the scoped sweep (shekyl-staking-sim axes layer2_band{,_whale,_coloc}, layer2_budget{,_whale}, layer2_colocbud; 29 scenarios; results in STAKER_ARCHIVAL_SIM.md §Layer-2 margin-robustness band — results). Decomposition confirmed decisively: giniW tracks population leanness (bondA) in both sweep directions while every direct whale gauge stays flat (mxSW 0.013–0.018 vs the 0.20 bar, wB4 = 0, whale ΔginiW ≤ 0.003). Dispositions: spread gate re-anchored on direct whale gauges (gini_actor demoted to trend); g sealed as a band [1.5, 2.5], genesis target g ≈ 2 — the band's upper bound is polarized-world coverage oscillation (g ≥ 3.0 fails at any purse; the g ∈ {2.0, 2.5} shoulder heals at +30 % purse, the L13 servo's static image); budget cross confirms the purse as the spread lever (giniW 0.598 → 0.217 over budget 100 → 200); Curve reserve untriggered. Finding 0: the 2026-06-07 gate4_fine readings are superseded — the banded PL Curve repair (4071ec032) moved the L11 equilibrium (bondA 79 → ~113; coloc pin row oscillates at bare-lean purse); the bond_rate* = 0.75 pin stands under the re-read (Finding 4). Finding 5: sim-vs-consensus g(age) units gap (normalized [0,1] age vs raw epoch counts) blocks mapping the sealed band onto archival_reward_age_weight_milli — normalization pin queued in FOLLOWUPS.md (V3.0). Cross-docs: REWARD_EMISSION_LEG.md §1.2 #4 + keystone row + checklist; WALLET_REWRITE_PLAN.md status. Phase 2B design is fully closed; Stage 3 gates on schema implementation + gate-6 soundness.

• archival: Layer-2 margin-robustness band scoped (2026-06-11). The last open 2B design item (STAKER_ARCHIVAL_SIM.md §Layer-2 margin-robustness band — scope; L1/L2 ledger rows updated; REWARD_EMISSION_LEG.md §1.2 #4). Decomposes the giniW ≈ 0.599 grazing reading before sweeping: the whale gauges have wide margins (max_actor_share ≈ 0.011 vs 0.20; wB4 ≈ 0.12) and the ~0.59 baseline is the lean L11 attractor's intrinsic inequality (entry-until-breakeven leanness + g(age) incumbency premium + windowed churn flicker), not whale capture. Sweep: g ∈ {1.5–4.0} × pin rows at bond_rate = 0.75 + budget cross {100–200} pricing the gate-1/7 purse as the spread lever. Three named outcomes: seal as-is, re-anchor the gate on direct whale gauges (metric re-derivation, not threshold relaxation), or pull the declining-tail Curve (V3 reserve).

• docs: ECONOMY_EXPLAINED.md — plain-language economy walkthrough (2026-06-11). Human-friendly explainer of the four control loops (emission curve, release multiplier, adaptive burn, staker emission share) with worked numerical examples from the gate-7 sim run and the L11 attractor tables. Carries the CALIBRATION caveat (coefficients provisional per DESIGN_CONCEPTS.md). Linked from PUBLIC_NARRATIVE_FAQ.md.

• archival: §2.4 close-condition (ii) closed — per-reward proof aggregate (2026-06-11). Worked byte sweep (STAKER_ARCHIVAL_SIM.md §Close-condition (ii), ledger row AGG; REWARD_EMISSION_LEG.md §10.1): per-emission tx ≈ 17–19 kB dominated by constant-size hybrid crypto, not the work claim; aggregate at the pinned cadence (SETTLEMENT_EPOCH_BLOCKS = 10_000, MAX = 15) amortizes to 80–310 B/block = 0.027–0.103 % of the 300 kB penalty-free zone across the N_P envelope {40, 79, 154}; single-tx max ≈ 29 kB; boundary burst self-drains in ≈ 11 blocks; no compounding growth term. Wire confirmed as specced — no format change. Reversion clause: built FcmpMembershipOnly > 3× estimate, N_P > ~1 500, or epoch < 1 000 blocks. All three PHASE_2B §2.4 close-conditions are now resolved; Stage 3 gates on schema implementation + gate-6 soundness.

• archival: gate-7 bonds-only disposition executed across specs (2026-06-11). Cross-document spec edits landing PHASE_2B §2.4 close-condition (iii) on maintainer sign-off: REWARD_EMISSION_LEG.md deletes the admission branch (no admission_proof vin field §5.3, no admission-threshold verify step §7.1, backing_ok loses the Σ ≥ ADMISSION_MIN_ATOMIC conjunct §7.2, §7.4 amount proof deleted-not-gated, §10.2 records the closure + reversion pointer); PHASE_2B_STAKE_LIFECYCLE.md closes §2.4 (iii), the staking-form admission row, the §2.3 principal wire, and the reward-leg threshold-proof bill item; ARCHIVAL_FIREWALL_GATE6.md §2.5 becomes the sole owner of any funding minimum (wallet hygiene, non-consensus); V3_STAKER_ARCHIVAL.md admission bullet updated. ADMISSION_MIN_ATOMIC is not a consensus constant; reinstatement only via the G7 reversion clause (STAKER_ARCHIVAL_SIM.md ledger). Follow-up pin (same day, maintainer direction): gate-6 §2.5 pins no wallet-policy minimum either — no funding minimum at any layer (consensus, economics, Sybil pricing, and privacy surfaces each examined; none is load-bearing on an amount floor; reversion clause names the reopening threats).

• economics-sim: gate-7 locked-supply re-pricing built and run — §2.4 (iii) resolves bonds-only (2026-06-11). Iteration 5 per the STAKER_ARCHIVAL_SIM.md §Iteration-5 scope: ArchivalLockModel in shekyl-economics-sim derives locked supply from the consensus pins (compile-tied to shekyl-archival-retention::ARCHIVAL_BOND_FLOOR_ATOMIC / SETTLEMENT_EPOCH_BLOCKS), denominating stake_ratio and the burn input against consensus circulating per the pinned build constraint; eleven gate7_* scenarios behind --gate7 (arm A across the N_P envelope + shard-geometry sensitivity, arm B MIN grid, volume-stress pair, asserted comparators); legacy eight-scenario output verified byte-identical. Result: derived lock collapses to bond_floor × R × shards(t) at lock/circ ≤ 10⁻⁴ in every arm; all three macro gauges insensitive to both arms at every N_P → the pre-named indeterminate criterion resolves bonds-only (gate-7 ledger row G7; cross-doc spec edits landed same day — see entry above). Corollary FOLLOWUP (V3.1): the (1 + stake_ratio) factor in calc_burn_pct is effectively inert in V3.

• archival: 2B design dispositions — bond-duration shape, ClaimedEpochSet encoding, gate-7 iteration-5 scope (2026-06-11). Three Phase-2B design closures, docs-only: (1) bond retention-commitment shape pinned age-scaled-constant at the sim-exercised plateau arm (BOND_DURATION_BASE_EPOCHS = 4, BOND_DURATION_AGE_SCALE = 4, numerics provisional until testnet fetch_latency_per_unit; STAKER_ARCHIVAL_SIM.md §L10-hardening disposition, ARCHIVAL_TIMING_CONSTANTS.md §1, ARCHIVAL_BOND_GATE4.md §3.4); (2) ClaimedEpochSet encoding decided under W = 26 — inline sorted absolute-epoch list on ArchivalBondValue (v3 → v4 at the implementing PR), bitmap / separate-table / DUPSORT / roaring rejected with reversion clause (REWARD_EMISSION_LEG.md §6.3, PHASE_2B_FSM_RETOOL.md P2B-3); (3) iteration-5 gate-7 locked-supply re-pricing sim scoped — derived archival-lock model replacing the asserted stake_ratio in shekyl-economics-sim, two admission arms, named close criteria for §2.4 close-condition (iii) (STAKER_ARCHIVAL_SIM.md §Iteration-5 scope).

• curve-tree: CT-3 design Round 1 opened (docs/completed/CT3_SYNC.md). Pre-flight substrate audit (pinned citations) of the persistent-client gap: CT-1/CT-2 landed persistence and KAT-verified block-derived reconstruction, but no path opens on disk, resumes, or rolls back a reorg without genesis replay. Round 1 questions with proposed dispositions: block-derived forward sync confirmed as default (the parent §6 reversion criterion fired — bulk-leaf RPC repositioned to post-prune refetch + archival, deferrable pre-genesis), pending-candidate persistence (long stake tier locks 150k blocks; tail re-scan on resume is unbounded), transactional reorg rollback via maturity binary-search + truncate_from_tree_position, source-seam trait deferred with its first consumer. Parent CURVE_TREE_CLIENT.md §8 #6 / §9 CT-3 row updated; store-backed assembly routed to FOLLOWUPS.md (V3.0, rides prune policy). Round 1 review (same day): R1-Q1/Q4/Q5/Q6 endorsed; R1-Q2/Q3 amended — the original rollback lost still-valid leaves created on the shared prefix but drained on the orphaned suffix, and maturity is not invertible to creation height, so pending rows and leaf_meta gain creation_height and the rollback becomes truncate-with-migration → creation-height filter → tip reset in one transaction. New findings F6–F9 routed (no-secrets test over the pending table, synthetic equal-maturity partition KAT, restore-from-seed scope totality, freeze-aware truncate source-confirmed); deferred get_curve_tree_leaves endpoint + KAT now a tracked FOLLOWUPS.md row bound to prune policy. Round 1 closure verified (same day): three CT-3a/3c implementation riders folded (direct pending-table row-set equality in the CT-3c KAT; shared truncation internals between rollback_to_fork and truncate_from_tree_position; migration read-then-delete contract); title synced to closed.

Changed

• archival: epoch-close consensus computation moved to Rust (PR 123). All epoch-close arithmetic — market membership, scarcity, curve, shard age, R_market / Σwork aggregation — now lives in shekyl-archival-retention::consensus_state::epoch_close_compute and crosses the FFI as one coarse shekyl_archival_epoch_close_compute call. The C++ LMDB sweep (process_archival_epoch_close_at_height) is gather/store only; C++ copies of the consensus logic (archival_shard_age_milli, ArchivalBondValue::good_through, in-sweep membership/aggregation) are deleted, as are the fine-grained FFI exports they consumed (shekyl_archival_curve_milli, shekyl_archival_scarcity_milli, shekyl_archival_max_claim_age_w, shekyl_archival_settlement_epoch_blocks). Epoch timing exports (settlement_epoch_at_height, epoch_close_due, prune_below_epoch) and shekyl_archival_good_through replace them. KAT consensus_state_kat_v1.json gains an epoch_close section; LMDB gather/store/revert covered by epoch_close_gather_compute_store_revert. Sim integer/float curve backends harmonized: degenerate caps credit zero. Fixes pre-existing LMDB cursor bug in delete_archival_* loops (MDB_GET_CURRENT after delete of last record).

• ci: PR pushes no longer double-run workflows. build.yml and randomx-v2-differential.yml triggered on both an unrestricted push and pull_request, so every push to an open PR ran every job twice (and merge-from-dev pushes spuriously fired path-filtered workflows the PR never touched). Their push triggers are now restricted to dev/main (post-merge validation); PR branches are covered by the pull_request event alone, which tests the PR merged into its base. Branches without an open PR get CI via a draft PR.

• Workspace MSRV 1.88 → 1.94; CT-1 redb 2.6.3 → 4.1.0. Intentional 1.94.0 pin for RandomX PoW + CT-1 redb 4.1.0 (rustc ≥ 1.89), aligned with shekyl-gui-wallet rust-toolchain.toml. shekyl-pow-randomx uses Box::new_zeroed_slice (stable 1.92.0). CI adds rust-msrv-gate (dtolnay/[email protected] + cargo check --workspace). Pre-genesis greenfield: redb v3 format only.

Added

• engine: Phase 1 orchestrator closeout. The shekyl-engine-core::Engine<S: EngineSignerKind> domain orchestrator (lifecycle, refresh + scan merge, pending-tx send lifecycle, query surface, tracing forwarder) is complete per the done-matrix in docs/completed/PHASE_1_ORCHESTRATOR_STATUS.md. docs/design/WALLET_REWRITE_PLAN.md reconciled to the binding Engine naming (decision log 2026-04-27): frontmatter phase0_closeout and phase1_domain_model marked completed, global naming-supersession banner added, Phase 1 section banner points at the status matrix, and the stale "orchestrator methods remain pending Phase 1" Phase 2a prose corrected. Carried residue: open_view_only / open_hardware_offload bodies stay blocked on shekyl-crypto-pq view-only/HW constructors (FOLLOWUPS V3.0 entry holds the reversion clause).

• engine: Engine::primary_address() accessor + Phase 1 query-pattern docs. Thin &self accessor assembling the wallet's one reusable ShekylAddress (End-state 5) from the KeyActor's cached public projection and the engine's cached network; ShekylAddress re-exported from shekyl-engine-core. engine/mod.rs gains a "Query surface (Phase 1 disposition)" section documenting the ledger()-guard balance/transfers patterns and replacing the stale "Constructors land next" block; encode→decode round-trip test included. Phase 2c expands the receive surface (payment requests).

• engine: change_password on-disk integration tests (FULL). Two lifecycle tests pin the I/O ↔ KDF ↔ AEAD chain at the orchestrator layer (FOLLOWUPS V3.0 item, Phase 1 closeout): change_password_round_trips_via_independent_wallet_file_open verifies the rotated envelope through an independently constructed WalletFile::open (new password loads state; old password fails with InvalidPasswordOrCorrupt), and change_password_with_new_kdf_rewrites_envelope_header asserts the rotated Argon2id parameters on the raw on-disk header via inspect_keys_file. ViewOnly / HardwareOffload coverage rides the capability-dispatch commit when those open_* bodies land.

• logging: single-Rust-image tracing contract, per binary. Rust tracing::* events are no longer silently dropped (FOLLOWUPS V3.2 item, absorbed into Phase 1): every binary now links exactly one Rust static archive carrying the shekyl_log_* C ABI and one tracing-core dispatcher shared by all Rust call sites. shekyl-ffi folds in shekyl-logging, making libshekyl_ffi.a the wallet-side image; the new link-image crate shekyl-daemon-image (shekyl-ffi + shekyl-daemon-rpc, no logic) is the daemon's image, selected per binary by a generator expression in cmake/BuildRust.cmake (SHEKYL_RUST_IMAGE_DAEMON target property). The standalone libshekyl_logging.a link and the force-load (WHOLEARCHIVE/--whole-archive) machinery are deleted — with one image per binary there is no resolution race to arbitrate (the MSVC LNK1104 flag-parsing failure goes with it). A post-link nm gate fails the shekyld build on any second GLOBAL_DISPATCH. New C-ABI export shekyl_log_install_tracing_forwarder (decision log 2026-04-25; mechanism amendments 2026-06-10, 2026-06-11) pins init ordering and idempotency (SHEKYL_LOG_ERR_ALREADY_INSTALLED = -12); shekyld calls it after mlog_configure. State-machine integration test plus C-harness coverage in shekyl-logging.

• crypto-pq: ADDRESS_DERIVATION_V1 freeze hardening (enforcement only). Published CODEOWNERS-protected KAT corpus at docs/test_vectors/ADDRESS_DERIVATION_V1/ with a kat_address_derivation_v1.rs consumer that verifies the manifest's self-describing fields (vectors_sha256_hex = sha256sum vectors.json, tier counts) and Tier-2 account distinctness; wired scripts/lint_cpp_clamp_ban.sh into the rust-audit-and-test CI job; added ADDRESS_DERIVATION_MANIFEST_HASH tripwire in address_derivation_freeze.rs with shekyl-cli derivation-freeze-self-check as the operator surface (no C FFI export: no C++ consumer exists). Zero semantic changes to the frozen v1 derivation pipeline in account.rs.

• archival: consensus state emission read surface (ARCHIVAL_CONSENSUS_STATE). Integer reward_arithmetic + consensus_state in shekyl-archival-retention; banded float/integer Curve in shekyl-staking-sim (--curve-impl=float|integer); LMDB archival_r_market / archival_sigma_work epoch-close sweep; partial-slash bad_interval F3 fix; KATs (consensus_state_kat_v1, gate4 phase-2 emission); docs ARCHIVAL_REWARD_ARITHMETIC.md, ARCHIVAL_SIM_ECONOMICS_VERDICT.md; FA-6 Pi scenario B capture in PERFORMANCE_BASELINE.md; CI archival reward gates and aarch64 determinism KAT on depends ARM v8 job.

• curve-tree: CT-1 LeafStore on redb (Round 1). LeafStore persists drained leaves and frozen segment metadata (R_k, end_block_height) in redb; height-gated segment freeze, ACID reorg truncate, pin/prune seam, and mixed_composition_root hot path with full-rebuild fallback. CurveTreeClient mirrors drained leaves on ingest. Tier-A store_kat, upper_layers_kat, and unchanged recon_kat / assemble_kat. Pins: CT1_ROUND1_PINS.md, close-out CT1_ROUND1_CLOSEOUT.md.

  Robustness sweep (CT1_ROUND1_CLOSEOUT.md §5): root_at / verify_root / assemble_path are &self queries bounded by the ingested chain tip (ClientError::ReferenceBeyondIngestedTip); the ahead-of-ingest store catch-up machinery is deleted, making the drained mirror append-only by construction and the freeze clock drivable only by ingested heights. append_drained rejects non-canonical Selene scalars at write time (StoreError::InvalidLeafBytes); store bounds checks read META_LEAF_COUNT inside the operating transaction (single-snapshot, no check/use gap).

• docs: 2026-06-10 doc sweep — key-signature freeze anchored, completed archive consolidated, stale references repaired. Retroactive decision-log entry for the frozen v1 seed→address pipeline (V3_WALLET_DECISION_LOG.md, from Cursor plan stabilize_key_signature_15d8e48a; landed 2026-04-22, f46ddaf56). FCMP_PLUS_PLUS.md "Wallet Restore from Seed" rewritten against the landed pipeline (old 32-byte HKDF diagram and transfer_details stored-secret restore copy removed); USER_GUIDE.md seed copy fixed to 24-word BIP-39 + opt-in passphrase (Electrum Phase-6 residue). ATOMIC_UNITS_NEWTYPE.md and PRIMARY_CLAIM_DERIVATION_RENAME.md archived to docs/completed/; the 104 references broken by the earlier DAA/Electrum moves to docs/completed/ repaired repo-wide (source comments, CI workflow headers, consensus-constants JSON, workspace rules, docs). Four FOLLOWUPS V3.0 items filed: dedicated ADDRESS_DERIVATION_V1 KAT corpus, lint_cpp_clamp_ban.sh CI wiring, ADDRESS_DERIVATION_MANIFEST_HASH tripwire, USER_GUIDE Rust-CLI realignment. CODEOWNERS freeze-spec path fixed to WALLET_FILE_FORMAT_V1.md; machine-local .cursor/plans/ links in active docs repointed to in-repo continuations.

• docs: FOLLOWUPS realigned to the Phase 2b retool; two fired deferral triggers re-dispositioned. The Decision-3C staking-subtree entry is superseded (3C / h_bind / 5-scalar leaf are docs-only per PHASE_2B_STAKE_LIFECYCLE.md §2.4; entitlement stack is a deletion target), with its claim-nullifier backstop note retired alongside (dedup is now the per-P claimed-epoch bitmap). AtomicUnits::mul_div_rem's reopening criterion re-anchored from entitlement.rs to the rebased reward-emission arithmetic (PR #123 surface); the confidential stake-UTXO transfer entry re-anchored to the bond model. Freshness: FA-2 (#112) / FA-8 (#113) marked merged (2026-06-08); Stage 3 blocks-on updated (Stage 2 merged; subaddress round resolved; Phase 2b gate list cited); Phase 2b planning-session entry gains a status note (claim-centric FSM scope superseded by the retool). Per 21-reversion-clause-discipline.mdc, the two "pre Stage 1 PR 4 kickoff" items whose triggers fired are re-dispositioned: wallet2_ffi_create_wallet / on_create_wallet cleanup is superseded by the Phase 5 wholesale deletion (reopens on new consumers or Phase 5 slipping past stressnet), and the epee::wipeable_string mlock residual is committed as documented-not-mitigated until Phase 5 under the same named reopening criteria.

• docs: confidential-tx surface naming pin (CT_SURFACE_NAMING_PIN.md). Records disposition for inherited rct:: / rctSigs naming: ct_signatures alias is partial fix; verifier → ct_semantics at wallet2 cutover; Rust vocabulary effective now across FFI; no rename PR pre-Phase 5. Updates FOLLOWUPS.md and STRUCTURAL_TODO.md.

• engine: Phase 2a-4 — TestDaemon fee-bound build→submit; engine send substrate complete. daemon_fee_estimator_maps_test_daemon_priority_tiers and Custom sanity-ceiling unit tests; output locks reserved before async sign with release_build_reservation on sign failure; integration tests for daemon-derived tx.fee, submit dedup, missing key-image rejection, and reserved-output blocking. Doc closeout in PHASE_2A_SEND_PATH.md / audit §2a-4. The orchestrator Phase 2a methods, pending Phase 1 when this landed, shipped with the Phase 1 closeout above; remaining 2a residue is tracked in PHASE_2A_SEND_PATH.md §10.

• wallet: Phase 2a-3 sign, wire encode, submit. KeyActor/LocalKeys sign bridge, shekyl-tx-builder wire module, async Signer::sign_transfer, TransactionSubmitter, non-empty tx_bytes, depth-1 fcmp_proof_size KAT, and predict_weight self-consistency on the build path (PHASE_2A_SEND_PATH.md §5 2a-3).

• docs: Round 4 subaddress design closure (FA-9 / FA-10). New THREAT_MODEL_WALLET.md — pit-of-success vs adversary, T6/T7, R2-F9 phishing tier. FA-10 cooperative attribution foundation pin in POST_QUANTUM_CRYPTOGRAPHY.md. FA-4 recorded closed (FA-7 + §5.7.8/§5.7.9); USER_GUIDE.md Monero subaddress copy removed. SUBADDRESS_UNDER_PQC.md §9–§11 Round 4 closed.

• curve-tree: CT-2 Round 1 close-out. Tier-A boundary pin (last_empty=60, first_drain=61), fixture provenance baseline, Tier-B #[ignore] drift-canary scaffold (recon_tier_b.rs), scanner tx_extra 0x07 parse tests (first-match; daemon parity unverified). Close-out docs/completed/CT2_ROUND1_CLOSEOUT.md; CT2_DRAIN_ORDER.md empty-window prose aligned to fixture truth.

• crypto-pq: FA-6 §8.5.1 decap pre-filter gate harness. fa6_decap_prefilter_gate example (--path fa6|classical, scenarios smoke / a / b), classical counterfactual derivation, criterion smoke bench fa6_decap_prefilter; Pi capture script scripts/bench/fa6_pi4_gate.sh. §8.7 recorded fail on §8.4 budget (2026-06-08): ship FA-6 at genesis; §10.1 T6 waiver rejected (Pi classical path slower than FA-6). Close-out docs/completed/FA-6_CLOSEOUT.md; Round 3 closed / Round 4 scoped in SUBADDRESS_UNDER_PQC.md §10.1. Matrix in PERFORMANCE_BASELINE.md §FA-6; Pi scenario B capture pending.

• archival: serve-credit consensus integration test (gate-2 §10 step 3). archival_serve_credit_integration.cpp seeds in-memory archival substrate from KAT fixture integration block (CT-2 opening + epoch-0 challenge geometry) and exercises Blockchain::check_archival_serve_credit_input end-to-end; duplicate-bit rejection test.

• archival: slash scheduler at H_slash_deadline (gate-2 §10 step 4 / gate-4 §4.2). process_archival_slash_at_height on block connect applies per-shard floor slash when challenge_failed; updates total_bonded_atomic / total_burned; journal + pop_block revert. FFI: shekyl_archival_challenge_resolution_blocks, shekyl_archival_epoch_slash_deadline_height. CompleteTree slash deferred.

• archival: gate-4 §8 phase-1 lifecycle KAT and Rust-first join verify (bonded-aggregation). shekyl-archival-retention: bond_floor, verify_join_market_bond_post (incl. both-terms reject), serve_credit_epoch_ok, verify_conservation_snapshot (audit/KAT only). gate4_lifecycle_kat_v1.json exercises join → serve E_first and bonded aggregation; paying-emit stub null. FFI: shekyl_archival_verify_join_market_bond_post (distinct SHEKYL_ARCHIVAL_BOND_POST_ERR_* per reject reason), shekyl_archival_serve_credit_epoch_ok. ArchivalBondValue LMDB v3 stores per-P bonded_total_atomic; pre-v3 bond blobs rejected at decode. blockchain.cpp delegates join-market semantics and E_first lower bound to Rust; hybrid pubkey + P_id hint stay C++.

• archival: JoinMarket bond-post verify and LMDB connect (gate-4 §3.4.1). txin_archival_bond_post wire (tag 0x05), put_archival_bond_record, and total_bonded_atomic on connect/pop; JoinMarket-only at genesis.

• archival: bond-post RCT balance verifier (gate-4 §3.2 / §3.5 step 6). verRctSemanticsBondPost closes sum(pseudoOuts) + bond_debit = sum(out masks) + fee + bond_credit; commitment sum is verified in shekyl-archival-retention via shekyl_archival_verify_bond_post_rct_balance; Bulletproof+ stays in C++. Bond-post path enforces canonical BP+ layout when proofs are present, requires a non-zero bond term, and routes away from verRctSemanticsSimple in NIC verify.

• archival: bond + shard-registry LMDB substrate (gate-2 §5.3 steps 2, 6–7). archival_bond, archival_shard_segment, and archival_shard_leaf subdbs with put_* seeding APIs; serve-credit verifier reads bond posture and registry geometry from LMDB (rejects when substrate is missing). JoinMarket bond-post connect is separate (see entry above); Rebond/Unbond/HoldingsUpdate kinds remain gate-4 deferred.

• archival: serve-credit consensus hook + LMDB bit (gate-2 §10 steps 2–3). shekyl-ffi shekyl_archival_verify_serve_credit_vin; Blockchain::check_archival_serve_credit_input and pure archival tx admission in check_tx_inputs; archival_serve_credit LMDB subdb (serve_credit_bit write on connect, revert on pop_block).

• archival: txin_archival_serve_credit_response deserializer (gate-2 §10 step 2). C++ txin_v tag 0x04 with path bounds; shekyl-oxide Input::ArchivalServeCreditResponse delegates to shekyl-archival-retention::wire; KAT cross-check in C++ and Rust unit tests.

• archival: serve_credit_bit rename sweep (gate-2 §11). retention_bit / proven_retention → serve_credit_bit across emission/consensus specs, WorkClaimVector field pin, and shekyl-staking-sim T-A1 fingerprint helper.

• archival: gate-2 serve-credit KAT fixture (v1). tests/fixtures/gate2_serve_credit_kat_v1.json tripwires challenge replay, wire bytes, signature preimage, and CT-2 founder opening; regen via regenerate_gate2_kat_fixture.

• archival: serve-credit response vin wire (gate-2 §5.1.1). ArchivalServeCreditResponse encode/decode (vin tag 4), encode(path) for signature preimage, roundtrip + preimage determinism tests in shekyl-archival-retention::wire.

• crypto-pq / engine: primary claim derivation rename (FA-2 residue). subaddress → output_claim; subaddress_derivation_scalar → output_spend_offset_scalar; derive_primary_source_secrets_bundle hardcodes PRIMARY_CLAIM_INDEX_LE. Deleted public SubaddressIndex, subaddress_lookahead (settings v2, prefs schema v2), AddressBookEntry::is_subaddress (BOOKKEEPING_BLOCK_VERSION 5); paired WALLET_LEDGER_FORMAT_VERSION 6→7 (wallet_ledger.snap). Spec: PRIMARY_CLAIM_DERIVATION_RENAME.md.

• staking-sim: L14b pins sliding-window over escalation FSM (2026-06-08). failure_confirmation.rs — paired dodge slash (esc 0 / slide 1), sliding m sweep, policy_pin + Round-2 joint-m gate note. ARCHIVAL_FAILURE_CONFIRMATION_PIN.md restructured: §1 pinned policy, §5 rejected-alternative stratum; R_market serve-credit substrate in consensus §3.3.

• docs: archival failure-confirmation policy pin (2026-06-08). ARCHIVAL_FAILURE_CONFIRMATION_PIN.md — escalate-on-failure with randomized near-term recheck (not exponential backoff); not-durably-absent enforcement claim; outage-CDF quantile → false-slash; sim decision gate vs sliding-window m-of-n before per-P confirmation FSM. Cross-links in gate-2 §0 and STAKER_ARCHIVAL_SIM.md L14b.

• archival: shekyl-archival-retention verify crate (gate-2 §10 step 1). Challenge leaf index + beacon fire height (cSHAKE domain labels per ARCHIVAL_RETENTION_GATE2.md §3.3–§3.4); verify_segment_path replays shekyl-fcmp::tree to R_k with Selene leaf-layer chunk scalars; CT-4 assembled-path cross-check KAT. Provisional CHALLENGE_BEACON_SEAL_BLOCKS = 1.

• docs: gate-2 Round 1 on-demand serving obligation (2026-06-08). ARCHIVAL_RETENTION_GATE2.md §0 — solved shape: affirmative serve-credit per epoch; leaf ℓ deterministic, H_fire beacon-sealed; no 24/7 disk proof. serve_credit_bit rename; L15 = reach not durability; traffic-pay reopen §0.3. Retires §7.5 reacquisition panic (ARCHIVAL_RETENTION_PROOF_8C_FEASIBILITY.md).

• wallet: FA-8 — payment requests + cooperative attribution (V3.0 substrate). PaymentRequest / ReceiveAttribution types; BookkeepingBlock v4 (payment_requests); TransferDetails.receive_attribution; ledger block v6 / WALLET_LEDGER_FORMAT_VERSION 6 (paired wallet_ledger.snap). Inbound: after scan merge, classify decrypted label (sentinel vs REQUEST) and match open requests when operational.cooperative_payment_requests or env SHEKYL_COOPERATIVE_PAYMENT_REQUESTS=1 (default off). Outbound: shekyl-address payment URI parse/format; construct_output_with_label_plaintext; C++ send path echoes REQUEST via shekyl_construct_output_labeled when destination original is a shekyl:…?rid= URI. CLI stubs: request new, requests list, history incoming --unattributed.

• docs: 8c retention-soundness hinge + gate-2 ordering fix (2026-06-08). Review amendment: Merkle opening proves membership, not set-B retention (public leaves + reacquire-on-demand). ARCHIVAL_RETENTION_PROOF_8C_FEASIBILITY.md §7.5 reacquisition-asymmetry hinge OPEN; economics reopen if hinge fails; m=3 scoped to partial-deletion only. ARCHIVAL_RETENTION_GATE2.md downgraded to Round 0 draft; H_anchor must fall inside epoch E (fixes H_close+1 bug); bytes/KATs held for Round 1.

• docs: archival retention gate-2 Round 0 spec (2026-06-08). ARCHIVAL_RETENTION_GATE2.md — challenge derivation (cSHAKE, m=3, R_k-local Merkle openings), txin_archival_retention_response wire, verifier order, slash handoff to gate 4; §4 flags retention-credit vs slash-window tension for stressnet. Cross-refs: consensus state §6, bond gate 4 §4.2, 8c feasibility §10.

• docs: loud 8c retention-proof constructibility pass (2026-06-08). ARCHIVAL_RETENTION_PROOF_8C_FEASIBILITY.md — BUILD disposition: Merkle opening PoR to shard R_k on shekyl-fcmp::tree primitives; ZK and FCMP++ membership rejected for genesis.

• docs: archival corpus fossil sweep (2026-06-08). ARCHIVAL_CORPUS_FOSSIL_SWEEP.md — superseded-model rationale audit; 8c constructibility test surface §5. Active fossils fixed (SEB-as-F1-lever, lapse-decorrelation, deferred SEB pin).

• archival: timing cluster pinned + reorg/retention split (2026-06-07). ARCHIVAL_TIMING_CONSTANTS.md: W=26, RETENTION_HORIZON_BLOCKS=420_000, ARCHIVAL_REORG_DEPTH_BLOCKS=720, RELEASE_COOLDOWN_EPOCHS=2, CHALLENGE_RESOLUTION_BLOCKS=10_000 (T-A16 margin); prune_horizon_epochs=W. Deleted conflated REORG_HORIZON. F4 drain inequality signed. shekyl-staking-sim --timing-cluster + src/timing_cluster.rs. config/consensus_constants.json documented (codegen deferred). T-A4 consensus leg unblocked; gate-6 Round 3–4 wallet defaults remain open.

• docs: P2B-6 §7 landed + LMDB substrate verify (2026-06-07). PHASE_2B_STAKE_LIFECYCLE.md §7 — archival threat model (T-A*, G11 extended, F1/T-A1 gate); claim-era wargame → §7.A. §7.11: LMDB on dev verified (m_properties scalars, already_generated_coins, pop_block revert pattern; bond wire greenfield). FSM retool substrate-verify row closed.

• staking-sim: T-A1/T-A2 F1 re-linkage instrument v2 (2026-06-07). rust/shekyl-staking-sim/src/fingerprint.rs re-pointed: timeline channel (baseline-relative rotation advantage) + cohort channel (portfolio co-holder size). Axes ta1_f1 (four scenarios) and ta1_cohort (lean vs distinctive pin). v2 run: timeline passes at lean eq (baseline 0.959, lapse 0.928 — rotation harder than chance); cohort fails (mean cohort 1.0, singleton ~98%). ta1_cohort_shared positive control: cohort 92.6, singleton 0.075, F1 PASS (instrument validated; lean failure is emergent portfolio diversity). SEB=20_000 does not move cohort. F1 qual wargame T-A3–T-A7: conditionally finally accepted (Form-C reopen not triggered); T-A4/T-A6 pending timing + wallet-default pins. Disclosure draft §10. F1_TA3_TA7_LIFETIME_WINDOW.md. See STAKER_ARCHIVAL_SIM.md §T-A1 / T-A2.

• docs: P2B-6 §7 threat model review round 1 (2026-06-07). PHASE_2B_SECTION7_DRAFT.md — F1 SEB structural lever + T-A1 sim gate; T-A16 (A6); G11 KAT invariants; G1 three-tier slash surfacing; partial slash stays Bonded (FSM). Timing doc §1.1 SEB/F1 coupling.

• docs: Archival timing constants stub + PHASE_2B §3 FSM (2026-06-07). ARCHIVAL_TIMING_CONSTANTS.md — joint cluster enumeration and couplings (W, reorg, release cooldown, SEB). PHASE_2B §3.1–§3.4: archival FSM, ArchivalPInstance, P_canonical_id, pending emission, reorg (P2B-5). §4–§7 bannered claim-era pending retool. Gate-4 §8.2 → timing doc; FSM retool forward order updated.

• docs: Gate 4 round-1 custody base (2026-06-07). ARCHIVAL_BOND_GATE4.md — consensus-balance model; bond_credit/bond_debit balance terms; conservation law; == bond_floor; slash forward-only; reorg all-types-atomic; §8.2 numeric cluster. Retool P2B-5/forward order.

• docs: Gate 4 G4-1–G4-7 review pins (2026-06-07). ARCHIVAL_BOND_GATE4.md — Unbond clean release + cooldown; escrow vs spend-lock (reject attestation-only); supply/burn coupling; E_join+1 boundary; unified Market predicate; HoldingsUpdate principle; bond_floor CompleteTree exception. Corpus sync: emission, archival state, PHASE_2B, sim note.

• docs: Gate 4 join-Market + bond-post wire (2026-06-07). ARCHIVAL_BOND_GATE4.md — join-Market seam (lag-forced distinct from paying mint); txin_archival_bond_post sketch; reorg. Emission §6.4/§8, PHASE_2B §2.4, archival state Market, gate-6 lifecycle amended.

• docs: PHASE_2B FSM retool disposition P2B-1–6 (2026-06-07). PHASE_2B_FSM_RETOOL.md — master key P_canonical_id; dedup inversion; state collapse; reorg re-read; §3 supersession banner. Emission §6.3: reject LMDB DUPSORT dup-keys option.

• docs: Gate 6 Round 1 — P hybrid derivation draft (2026-06-07). ARCHIVAL_FIREWALL_GATE6.md §9: archival HKDF labels, p_slot, account-level ML-DSA, P_canonical_id, dual-scan contract, V4 reversion clauses. Builds on Round 0 scaffold.

• docs: Gate 6 firewall design scaffold (2026-06-07). ARCHIVAL_FIREWALL_GATE6.md — Round 0: four firewall layers + bond-funding, P lifecycle, invariants, adversarial round plan; couplings to epoch-length (F1), L16 transport, E-4 rotation threat.

Changed

• staking-sim + docs: F1–F4 archival pin closure (2026-06-07). churn_stable re-pointed to coverage oscillation (oUmx), not participation churn (F2 bank — pin rows pass all_pass). ARCHIVAL_CONSENSUS_STATE.md: timeline-axis honest residual (F1); §9.2 settlement-epoch length joint gate-2/6; good_through interval event log (F3); W × per-P batch drain invariant (F4). REWARD_EMISSION_LEG.md §6.5–§6.6 synced.

• docs: Archival read contract + gate-3 ν dissolution (2026-06-07). ARCHIVAL_CONSENSUS_STATE.md rewritten: two-half contract (read surface + invariants), public P_id keying, derived R_market, W prune horizon. Gate-3 ν = H(P, shard) dropped (incompatible with form C). Corpus sync: V3_STAKER_ARCHIVAL.md, PHASE_2B_STAKE_LIFECYCLE.md, foundation docs, REWARD_EMISSION_LEG.md §1.1 sim reconciliation (gate4_fine endogenous; l11_bud bond-rate caveat; churn vs spread).

• staking-sim: windowed spread discipline gate (sprdW) (2026-06-07). shekyl-staking-sim reports gini_actor_window / max_actor_share_window; ALL sub-claim uses windowed spread (L9 lesson). Keystone holds at bond_rate* = 0.75 (graze survives); fails at ≥1.00 on both reads.

• docs: Archival consensus state critical path (2026-06-07). New ARCHIVAL_CONSENSUS_STATE.md — gate 2/3 schema, MAX_CLAIM_AGE_W, interface vs 8c deferral. REWARD_EMISSION_LEG.md Layer 1 closed; §4.5 collapsed; §1.2 forward path; Layer 2 margin-robustness gate; FSM unblocked.

• docs: Spread thin-margin + §4.5 scope reframe (2026-06-07). REWARD_EMISSION_LEG.md §1.1: sprdW passes thinly (~0.001–0.007); whale window worsens (0.581→0.594); sim↔spec coherence (reward.rs Σ capped). §4.5: denominator scope (all-recorded lagged leading); E-3 slash stays in denominator. STAKER_ARCHIVAL_SIM L1×L2 entanglement.

• docs: Reward-emission E-1–E-4 pins (2026-06-07). REWARD_EMISSION_LEG.md §4.0: genesis form C budget·Curve(work)/Σ Curve(work) (reject post-servo cap); market-only Σwork; per-epoch good_through(E); drop consensus backing rotation; Σwork accumulator. V3 gate-list + reward-curve prose reconciled.

• docs: Reward-emission leg spec — Layer 1 structural core (2026-06-06/07). docs/design/REWARD_EMISSION_LEG.md: three-channel reward stack; open §4.5 accumulator timing (joint gate 1); ordinary-transfer admission (no C_stake); four-layer sequencing; spread windowing verdict in §1.1.

• docs: Transfer-shaped admission as leading genesis staking form (2026-06). Elevates §2.4 in PHASE_2B_STAKE_LIFECYCLE.md: principal↔P as ordinary FCMP++ main-tree transfers; bond + reward emission as the two irreducible special surfaces; reward dedup via per-P claimed-epoch bitmap on bond record (no N_arch tag); membership-only control on emission (not ClaimLinkability); off-chain backing before first reward; intra-epoch window covered by bond slash; gate 7 reopen if admission principal drops. Mirrors in V3_STAKER_ARCHIVAL.md, WALLET_REWRITE_PLAN.md, FCMP_PLUS_PLUS.md §15 (3C not genesis), CONFIDENTIAL_STAKING.md status, STAKER_ARCHIVAL_SIM.md gate 7 coupling. Round 3–4 close-conditions (i)–(iii); next spec: reward-emission leg.

• docs: End-state 5 sequencing + checklist cleanup (2026-06-07). Pins implementation land order in WALLET_REWRITE_PLAN.md (YAML todos, Phase 2c sequencing table: FA stack → 2c outbound/Wallet API → 4b RPC; 2a-3 not blocked). Updates SUBADDRESS_UNDER_PQC.md §9–§11 (FA-7 landed, FA-2/FA-8 PR refs). PHASE_2A_SEND_PATH.md §6 gate table + FOLLOWUPS.md subaddress-round status.

• wallet: FA-2 — subaddress deletion (End-state 5). Per docs/design/SUBADDRESS_UNDER_PQC.md §5.7.4 / §6.2: scanner claims outputs when recovered spend key matches the account primary spend key; removed KeyEngine::derive_subaddress, subaddress registry/labels from BookkeepingBlock (version 3), TransferDetails::subaddress (ledger block version 5), WALLET_LEDGER_FORMAT_VERSION 4→5 (paired wallet_ledger.snap), TxRequest::from_subaddress, and TxOutputContext::Change subaddress index. Closes FA-2 item in docs/FOLLOWUPS.md subaddress round.

• docs: FA-7 — End-state 5 supersedes flat-subaddress wallet plan. Amends docs/design/WALLET_REWRITE_PLAN.md (cross-cutting decisions, Phase 1–2c, CLI/RPC method lists) to match End-state 5 in docs/design/SUBADDRESS_UNDER_PQC.md §5.7: one primary address per account, no create_subaddress at V3.0; payment requests + enc_label for invoice attribution. Supersession entry in docs/V3_WALLET_DECISION_LOG.md; PHASE_2A_SEND_PATH.md §3.10.3 interim SubaddressIndex note; STAGE_1_PR_3_KEY_ENGINE.md §3.1.3 superseded banner. Closes FA-7 item in docs/FOLLOWUPS.md subaddress round.

Added

• wallet: Phase 2a-1 — daemon fee-snapshot + broadcast primitives. Implements the DaemonEngine-trait primitives on DaemonClient (docs/design/PHASE_2A_SEND_PATH.md §3.3/§3.6, §5 row 2a-1): get_fee_estimates issues one get_fee_estimate JSON-RPC call and stores a single snapshot-level quantization_mask across all tiers (no tier-vs-tier skew); submit_transaction parses tx_bytes, computes the TxHash locally (never trusts a daemon-returned hash), and maps the daemon relay verdict onto TxSubmitOutcome via the honest-subset rule (status == "OK" → Submitted; double_spend/fee_too_low → DaemonRejectedTerminal { DoubleSpend | FeeTooLow }; every other failure → Malformed). Rpc::publish_transaction (shekyl-oxide, Shekyl-owned) reshaped to return a TxRelayResponse so the full daemon verdict (including Failed statuses) is always surfaced to the caller. ProofStale detection is deferred to Phase 6 — the C++ daemon reports a stale FCMP++ root as a generic verification failure with an empty reason, indistinguishable client-side; the reopening criterion (a daemon-side fcmp_root_stale signal on send_raw_transaction) is recorded in docs/SHEKYLD_PREREQUISITES.md §5 and docs/FOLLOWUPS.md. The LocalPendingTx async boundary + capability narrowing (§3.1/§3.2) were re-split out of 2a-1 to land with their first consumers (fee-source in 2a-2, submitter in 2a-3), since both capabilities are consumer-less in 2a-1 (see §5 re-split note).

• wallet: Phase 2a-2 — signing context + fee plumbing. Wires the LocalPendingTx async build path per docs/design/PHASE_2A_SEND_PATH.md §5 row 2a-2: FeeSnapshotSource / DaemonFeeSnapshotSource (PF2) fetch one FeeEstimates snapshot per build; FeeEstimationContext carries output_count, fee_snapshot, and tree_depth (PF1); structural predict_weight / converge_fee / FeeDirective land in tx_fee_model; assemble_tx_to_sign builds populated TxToSign from ledger TransferDetails; TxInputSigningContext / TxOutputContext / FcmpPlusPlusContext reshaped per §3.9. Canonical dust threshold (shekyl-rpc::tx_fee::dust_threshold) shared with shekyl-scanner::coin_select. Real sign_transfer / tx_bytes / submitter remain 2a-3; fcmp_proof_size KAT and predict_weight == tx.weight() grid deferred likewise.

• stake-lifecycle: Round 3 dual-wargamer synthesis — top finding F0 re-gates closure. Two independent adversarial passes over the §7.5 wargame were synthesized into docs/design/PHASE_2B_STAKE_LIFECYCLE.md §7.5.3 (2026-06-05). Headline F0: a confidential claim does not inherit FCMP++'s whole-chain anonymity set — its effective set is the {tier × creation_height} cohort. The reveal-vs-ZK question is resolved at source: tier (u8) and creation_height (u64) are cleartext public wire fields (CONFIDENTIAL_STAKING.md §6.4.8; verifier recomputes h_bind + multiplier from them, §6.4.3) — not merely brute-forceable, published directly. The reveal is load-bearing for inflation-safety (the single revealed tier excludes tier-forgery by driving both h_bind and the multiplier; the 3C-over-3A "no new primitive" win), so hiding (tier, creation) re-opens the 3C-vs-3A decision — L4 is V4 co-design, not a v1 bolt-on. Because every claim of one stake carries the identical cleartext (tier, creation_height), claim↔claim linkage is deterministic exact-match — not residual (the DDH split protects claim↔unstake, not claim↔claim), and at cold start the cohort approaches one (the Zcash small-shielded-pool lesson with a tier×exact-creation-height multiplier). F0 reframes T1/T2/T3 into one variable (cohort size), re-opens CONFIDENTIAL_STAKING.md §14.4 item-9, and re-gates Round 3 closure on a consensus policy decision that is three-way, not binary: (1) accept-exact (a high, eyes-open product bar — P1>P2 licenses the reveal but does not price the residual, which is confidentiality materially weaker than the spend path's whole-chain set for stakers); (2) cleartext creation bucketing (the cheap middle — bind a bucketed creation into h_bind; cohort → {tier × bucket}; all cleartext, no circuit/primitive; hard inflation constraint: round creation UP as the single canonical value for lower-bound + eff_lock + lock-enforcement — round-down silently inflates; cost = bounded ≤W lock-shift; tier axis irreducible without V4); or (3) V4 in-circuit hiding (removes the tier axis, at 3A circuit + 8a re-audit cost). The reveal also shrinks the 8a entitlement circuit (cleartext checks stay out of the circuit → tighter soundness perimeter on the existential item; a V4 hide is therefore not security-neutral — it grows the 8a re-audit surface, a named V4 cost). The §14 band_sum floor does not close this — it smooths the public-rate readout (a separate leak); cold-start needs both ("incentivize more staking" fixes absolute size, not the partition). T7 (DDH / G_S-NUMS-independence) is elevated by F0 to the soundness tier — cohort linkage is now chain-owned, so DDH is the sole on-chain protection for within-cohort claim unlinkability, and per-claim circuit hygiene is re-scoped to "don't let the network undo DDH." Baseline-budget calibration (2026-06-05) de-escalates the decision: F0 is the same category of cost the project accepted before confidential staking (staking is the exposed overlay; the spend path is untouched; the core promise is intact), exceeding baseline only in scale-resistance (the block-granular cohort does not dilute with growth — a steady-state thinness) and targeted-cascade; the marginal delta over the realistic already-linkable counterfactual most penalizes the privacy-conscious staker. So option 2 (bucketing) is the recommended v1 disposition (restores dilution-with-growth toward the accepted membership-shaped baseline), and the remaining consensus decision shrinks to ratify bucketing + pick width W. De-tiering (the economic redesign) is deferred V-future — reject-now-with-reopening-criterion (a high-value-target threat model on the within-tier within-bucket residual); the economics are a designed counterweight and bucketing likely already closes the gap, so it is not a forced move: a derivative (uniform) reward would drop the tier field from the wire (cohort → {creation_bucket}), but creation/height stays (time-accrued reward needs a provable accrual-start = the same 3C-vs-3A choice). Other synthesis outcomes: inflation T8 split into 8a entitlement-proof soundness + 8b band-declaration binding (co-equal silent-inflation surfaces — the band↔C_stake range proof must carry the same rigor as the value range proof); new adversary A5 (economic/rational — bank-run / mass-unstaking, MEV, stake-rental) with a required mass-unstaking servo-stability simulation; and sharpenings — T9 induced-duplicate (daemon claimability is advisory, never a license to reveal a second nullifier), T1/T4/T14 circuit hygiene (fresh circuit per broadcast + Dandelion++-equivalence as acceptance criteria), T10/G12 stake-age leak via nullifier-count (accept-vs-pad decision), T3 public-rate whale/cold-start readout, T5 constant-time claim-build pin + view-key-resident residual, T7 G_S NUMS independence, T6 §11 all-five- members-in-one-txn atomicity as load-bearing. Recorded as a result (not a gap): confidential-claim staking structurally excludes the delegated-PoS attack class (slashing-griefing, nothing-at-stake, long-range revision, equivocation, stake-grinding). §7.4 gains A5; §9 row + §10.1 boxes re-gated on F0; FOLLOWUPS.md V3.1 entry updated.

• stake-lifecycle: F0 bucketing quantified + window-adaptivity + self-advertisement input. docs/design/PHASE_2B_STAKE_LIFECYCLE.md §7.5.3 (2026-06-05). Bucketing math: cohort ≈ W·λ/3; exact-height baseline is W=1 (per-block, scale-resistant); W>1 is a tunable multiplier and restores dilution-with-growth. Cost is a bounded, tier-relative lock-shift (flat W=720 ≈ +72 % on a tier-1 1,000-block lock vs ~0.5 % on tier-3 150k) → scale W per tier, all publicly derived from the revealed tier (no new leak). Window-adaptivity (open W-choice): sliding the window to a participant floor k — hard count-closed buckets rejected (future-state ceiling → non-causal binding, reorg-unstable membership, cold-start deadlock, new high-resolution λ(t) width-leak, Sybil binning-knob, caps cohort at k); soft DAA-style W(tier,epoch)=clamp(⌈k·B/λ̂_tier⌉,W_min,W_max) frozen-at-binding is the candidate (past-state → reorg-stable, no new aggregate leak, adapts cost to need) under servo-stability discipline (clamp+lag+slew per 75-system-autonomy.mdc); honest limit — no scheme makes k-anonymity from <k total stakers. λ̂_tier estimator reuses the LWMA-1 difficulty algorithm, estimator-half only (no setpoint/retarget; over per-tier height-keyed creation counts → immune to the timestamp surface difficulty defends; window re-tuned longer than difficulty's, since responsiveness is double-edged — aids cold-start but eases Sybil flood-thinning). Self-advertisement threat-model input: Shekyl ships shareable shard-art (V3_SHARD_VISUALIZATION.md) and tier↔archival-role legibility (V3_STAKER_ARCHIVAL.md) → many stakers self-doxx; for them F0's marginal cost ≈ 0 (reinforces "F0 penalizes the privacy-conscious"), and for the silent tail self-doxx by others erodes the cohort by elimination (so W must clear k after attrition). Cross-track: share feature + on-chain holder-registry + distinctive held-shard-sets can bridge identity → on-chain-holder → claim-cohort — an archival / shekyl-shard-visual privacy-review item, not Phase 2B scope. FOLLOWUPS.md V3.1 entry extended.

• stake-lifecycle: F-ARCHIVAL refinement — per-shard retention bonds (the keystone), replace-not-converge framing, and gate-list correction. Iterates the resolution below across docs/V3_STAKER_ARCHIVAL.md, docs/design/PHASE_2B_STAKE_LIFECYCLE.md §7.5.3, docs/FOLLOWUPS.md (2026-06-05). Framing (replace, not converge): F0 and 8a dissolve because pay-for-retention abandons the subsystem they live in — the reserve-DLEQ entitlement, bounded-remainder, entitlement.rs/tiers.rs/rewards.rs become dead code, not adapted; "converge" wrongly implies the entitlement proof still applies. What transfers: the adversarial method + the primitives (membership proofs, DDH-independent nullifiers, firewall hygiene). Keystone — per-shard retention bonds (collapses the old tier-decision + Sybil-overloaded-lock gates into one): demonstrated longevity is a past signal and cannot bind future retention; a slashable per-shard retention bond can (drop the shard → lose the archival bond, principal untouched). One mechanism gives (a) the deep-history guarantee (bond-at-risk, not inferred); (b) death of the staker tier → F0 + the portfolio tier-oracle both close because bonds replace tier (the third convergence, earned not free); (c) Sybil-immunity — total bond = shards × rate, pseudonym-count-independent, so splitting buys nothing, flipping the scarce input back to expensive-countable capital; (d) de-overloaded lock (small eligibility lock vs. scaling per-shard bonds = two separate parameters). Slogan corrected: not "pay for work, not wealth" (capital re-enters proportional to work) but "pay for work, where doing the work requires proportional capital-at-risk that bonds the work" — capital re-based from "yield multiplier" to "slashable service-collateral," the better answer to the founding Problem 1 critique (the old principal bond bonded nothing). Two over-reaches in the prior gate-list, corrected: (1) the Σwork servo is differencing-clean — band_sum leaked because it aggregated confidential amounts; Σwork sums continuously-public numbers (challenge-responses, replication counts), so differencing reveals nothing not already on P's public record (supply-safe and strictly better than band_sum on privacy); (2) public R via ν-hiding superseded 2026-06-07: gate 3 dissolved — R_market is ledger-derived; form C makes holdings consensus-public. 8a → loud 8c: the existential item moves to retention-proof unforgeability, detectable not silent. P simplified: needs unlinkability + backing-proof, not uniqueness (bonds carry Sybil; replication-Sybil is self-defeating). Bootstrap: flat per-active-bonded-shard, foundation-overlapped (no zero-coverage instant), sunset. Genesis-class: capital-bonded yield cannot re-justify itself in the fee-only era (the rent the mission forbids; the one part that fails once the subsidy ends), so this is not a deferrable refinement — the corrected foundational gate is the economic sim re-priced for capital-collateralizing-work, not curve-tuning. Corrected gate-list: (1) Σwork servo (supply-safe + differencing-clean); (2) retention-proof soundness + state cost (8a → loud 8c); (3) per-shard-nullifier counting derived R_market (2026-06-07); (4) per-shard retention bond replacing tier (keystone; residual = bond-rate calibration); (5) bootstrap = flat per-bonded-shard, overlapped, sunset; (6) P backing+firewall (unbuilt; uniqueness relaxed); (7) economic sim re-priced (the foundational gate). Next step — the sim, spec-first: docs/design/STAKER_ARCHIVAL_SIM.md (new), iteration 1 isolating coverage dynamics (1/R + plateau-cap + per-shard bonds → covered/spread/none-holds-everything/deep-history-held), gates 1/4/5/7 layered as later iterations; no code until the spec is reviewed.

• stake-lifecycle: F-ARCHIVAL RESOLVED IN DESIGN — pay-for-service rebasing + firewalled-pseudonym identity model (supersedes the two-stream framing; pending sim/soundness ratification). docs/design/PHASE_2B_STAKE_LIFECYCLE.md §7.5.3 (F-ARCHIVAL resolution subsection) + docs/V3_STAKER_ARCHIVAL.md (new canonical §Pay-for-service rebasing and the firewalled-pseudonym identity model, with Decoupling / Tier interaction / Conclusion forward-annotated as superseded)

  • docs/V3_SHARD_VISUALIZATION.md (graceful-degradation-achieved resolution) + docs/FOLLOWUPS.md (2026-06-05). Enumeration: archival is the only service staking provides — consensus is PoW's job (no block-production/fork-choice/finality; the classic-PoS attack class was retired for this reason); the capital "bond" is slashable for nothing so it bonds nothing; supply/monetary effects are achievable by just-holding; governance signaling is downstream of staking existing. So the staking reward is payment for archival, "stake without archiving" is the Problem 1 rent the design exists to kill, and there is no opt-out privacy tier. Model: one archiver type; one work-paid reward (proven-retention-based — not retrieval — scarcity-weighted, banded plateau-cap reusing the rate-servo band machinery for deterministic recomputability); principal = never-slashed collateral serving as admission + per-pseudonym Sybil cost + longevity-credibility, not a yield multiplier. Archival cannot be unlinkable like a claim (reachability + persistence + challengeability require a stable holder), so the goal is a firewalled pseudonym P: replace StakeEngine::is_active_staker(entity_id) with membership-proof registration ("some active stake backs me") + an archival nullifier N_arch = x·G_arch over a base independent of Hp(O) and G_S (one stake → one P Sybil-resistance; uniqueness without revealing which stake; extends T7 DDH to a third base {Hp(O), G_S, G_arch})
  • HKDF-derived independent keypair P + periodic liveness re-proof that lapses on unstake. Tier-neutral, longevity-priced shard pricing breaks the tier oracle (critical-shard stability premium on demonstrated holding-longevity, which is observable but is not tier) — paying the loss of the "tier-3 → archivist" elegance to stop the portfolio re-publishing tier. The firewall is a 4-layer stack (crypto + network + timing + output). Convergence: publicly-computable reward dissolves F0 (tier leaves the claim wire — reward no longer needs tier_num) and F-INFLATION 8a (no confidential amount in the entitlement → silent inflation becomes loud/recomputable); the only ZK left on the reward path is membership/backing + stealth payout. Gate-list before consensus-real: (1) aggregate supply normalizer (the §14 servo guaranteed Σreward ≤ budget; a per-staker cap does not — a budget·work_P/Σwork servo restores it but reintroduces Σwork-differencing, band_sum-differencing reborn); (2) retention-proof soundness + per-P/per-shard consensus state-cost (8a transforms, not vanishes — the irony being archival-reward accounting becomes the state-growth problem archival exists to solve); (3) private replication counting becomes central (scarcity drives the whole reward now); (4) tier decision — no free option (dies system-wide with longevity-pricing recovering deep-history retention-horizon matching, vs. lives-with-oracle); (5) Sybil scarce-input shift capital→storage+bandwidth (cheap/invisible/firewall-hidden) + overloaded lock (small for monetary supply vs. large for cap-teeth); (6) bootstrap shape (cold-start coverage cliff vs. named time-limited subsidy whose privacy shape matters); (7) P/N_arch unbuilt — the persistent-pseudonym lifecycle is the crux. Scope: this replaces the confidential-yield subsystem (CONFIDENTIAL_STAKING.md + rust/shekyl-staking/ entitlement.rs/tiers.rs/rewards.rs) — a large audit-surface deletion, which is the point; CONFIDENTIAL_STAKING.md left untouched until gates 4 + 1 settle. Nutshell: staking is the opt-in to archival because staking = archiving.

• stake-lifecycle: F-ARCHIVAL — archival commitment binding is the load-bearing whole-system tier/membership question, outranks the F0 W-choice. docs/design/PHASE_2B_STAKE_LIFECYCLE.md §7.5.3 (new finding, 2026-06-05), with docs/V3_STAKER_ARCHIVAL.md + docs/V3_SHARD_VISUALIZATION.md updated. Reading the archival + visualization docs together surfaces three couplings the sharing reality activates: (1) archival is staking ("if you stake, you archive") → archival visibility = membership disclosure, now wired to a virality-engineered feature; (2) the portfolio is a tier oracle by economic design (tier-sorted shards → held shards ⇒ tier), a channel separate from the claim wire — so whole-system tier privacy needs both the claim-wire tier (F0) and the archival tier-weighted pricing weakened, further devaluing de-tiering-alone (reinforces parking it); (3) gamification selects high-value targets (rarest = most shareable = most identifying). Load-bearing undecided question: is the archival commitment public address-bound or privately membership-proof-bound? Draft mechanisms (on-chain challenge-response, holder registry, identified reward routing) lean public — and public + mandatory archival + tier-sorted shards = every staker's membership and tier public by construction, no sharing required (dwarfs F0). Private is the presumption (architectural consistency with the privacy-first claim/unstake model; public is the inherited "easier to count" convenience); the hard part is private replication counting for 1/R scarcity pricing (private set cardinality). Priority actionable set: (1) resolve public-vs-private binding (gates all); (2) weaken tier-weighted pricing (explicit economics-vs-privacy); (3) HKDF-separate archival identity from claim/spend; (4) share-UX privacy warnings (graceful degradation). Non-sharer bucketing privacy is conditional on (1)+(2) — bucketing softens only the last cascade link. Organizing principle: graceful degradation (share discloses only what you chose, no silent cascade to tier/claim-history/amounts). Decide before ArchivalEngine ships; FOLLOWUPS.md V3.1 entry extended.

• stake-lifecycle: Round 3 wargame executed — threat model exhausted against privacy-crypto history. docs/design/PHASE_2B_STAKE_LIFECYCLE.md §7.5 drives every §7.4 agenda item (T1–T9, G1–G10) to a disposition and augments the agenda with vectors that deployed privacy chains actually suffered: T10 claim-tx-type / staker-set distinguishability (Zcash transparent↔shielded lesson), T11 stake↔unstake commitment linkage (MimbleWimble graph reconstruction), T12 one-time-key collision (Monero 2018 burning bug), T13 remote-node query-pattern leakage (Monero malicious-remote-node), T14 whole-lifecycle broadcast-origin linkage, G11 proof-soundness / inflation (Zcash 2018 counterfeiting + Monero 2017 RingCT bug), G12 wallet/tx- construction fingerprint (Monero wallet2), G13 claim front-running / censorship (MEV); Janus subaddress-linkage confirmed N/A under FA-1's single static address. Each disposition is mitigated-in-design / FOLLOWUP+trigger / cross-track / priority-reject per 21-reversion-clause-discipline.mdc. Four load-bearing findings (§7.5.1): (1) inflation is the worst historical class — the wallet's job is non-masking (derives claimable only from its own secret weight × public ρ_e, loud-fails local inconsistency; priority-1); (2) T11 stake↔unstake commitment linkage — investigated and resolved at source: unstake is an unlinkable FCMP++ membership spend appending a fresh main-tree output (CONFIDENTIAL_STAKING.md §6.3/§6.4.3/§7), so the literal C_stake is never re-published and there is no point-equality link — no Priority-2 finding; (3) bulk-fetch-only nullifier scan (T13, inherits the curve-tree-client never-per-item-query invariant); (4) staking is publicly observable as a class — v1-accepted with full intra-cohort uniformity (not "privacy as a setting"), structural hide deferred to V4/L4. Residuals (§7.5.2): 7 FOLLOWUPS (V3.1, recorded in docs/FOLLOWUPS.md), 2 cross-track upstream asks (T3 cohort floor, T10 L4-for-V4 — T11 resolved at source, no longer an ask), 5 Stage-3 load-bearing implementation pins, 1 priority-reject (G10 fee-bump, PR 5 G3 precedent), 3 N/A. A first clean close was recorded 2026-06-05, then re-gated the same day by the dual-wargamer synthesis (see the entry above, §7.5.3) on new top finding F0. Stage 3 merge remains gated on the §8.0 confidential-consensus dependency, independent of this round. No wallet design change; no disposition reversal.

• units: AtomicUnits amount-newtype (shekyl-units crate). A new foundational shekyl-units workspace member owns AtomicUnits(u64), the wallet's monetary-amount type, replacing raw u64 on the money path. It is checked-only — no Add/Sub/Mul/Div operator impls and no saturating_*, so a + b does not compile and a local accounting bug cannot silently wrap or saturate; arithmetic goes through checked_add / checked_sub / checked_sum, whose None arm is surfaced as an error, never defaulted to zero. #[serde(transparent)] + #[repr(transparent)] make it wire- and ABI-identical to the u64 it replaced (no serialized-format version bump). Display/Debug render raw atomic units with an au marker (never SKL) to kill the unit-confusion bug class; SKL formatting is the explicit, single-sourced to_skl_string / from_skl_str. The 10^9 atomic-units-per-SKL relationship is generated by build.rs from config/economics_params.json (the same JSON the other economics build scripts read), with a const drift-guard. The amount domain (shekyl-engine-state, -prefs, -scanner, -staking, -engine-core including the OutputClaim secret site, -tx-builder, -engine-rpc) now carries AtomicUnits; raw u64 survives only at the enumerated edges (the shekyl-oxide Commitment/fee/output amounts, the multisig signed-hash sites, the FFI #[repr(C)] boundary, the commitment_bytes postcard serializer, and the verified JSON-number RPC field). The CLI's inherited 10^12 format_amount/parse_amount (the constant that overflowed u64 on Shekyl's 2^32 whole-SKL supply) is reconciled to 10^9 through the newtype. Design + complete edge inventory: docs/design/ATOMIC_UNITS_NEWTYPE.md.

• curve-tree: reference-block selection + proof validity horizon (§5). New shekyl-curve-tree reference module lands the wallet-side anchor arithmetic: select_reference_height (tip − REF_ANCHOR_AGE, the privacy-canonical MIN_AGE + 1 = 6 offset every honest wallet shares), the proof validity horizon (PROOF_VALIDITY_HORIZON = MAX_AGE − REF_ANCHOR_AGE = 94), and the proactive re-anchor threshold (REBUILD_AT = MAX_AGE / 2 = 50), plus total predicates reference_block_age / proof_submittable / proof_expired / should_reanchor mirroring the daemon acceptance window (MIN_AGE ≤ age ≤ MAX_AGE, SpendIntent::validate_temporal). Selection is height arithmetic, not a CurveTreeClient method — the client stores no header roots; binding a height to a consensus root stays the caller's job (caller-supplies-root model, §3.5). REFERENCE_BLOCK_{MIN,MAX}_AGE are emitted from config/consensus_constants.json by a per-crate build.rs (same JSON authority as the C++ header; keeps the crate lean, drift-safe per the 2026-05 FFI constant-drift audit), with const-eval sentinels guarding the 5/100 baseline. Resolves PHASE_2A_SEND_PATH.md §9 #5 (proof lifetime "unbounded in Round 0"). Spec: docs/design/CURVE_TREE_CLIENT.md §5.

• curve-tree: CT-4 membership-path assembly. The shekyl-curve-tree assemble module lands CurveTreeClient::assemble_path, producing the FCMP++ prover's Path for one owned output at a reference block: the leaf_chunk as compressed-point tuples (O, I = Hp(O), C, h_pqc) plus the full child chunk of each path node from leaf to root, with the root point excluded (carried as TreeContext.tree_root). Layout pinned to the prover at source (C1 = Selene, C2 = Helios): odd tree layers → c2_layers, even internal layers → c1_layers. Assembly runs the verify_root integrity gate first (OutputNotDrained / RootMismatch rather than a bad proof). New public types AssembledPath / ChunkLeaf / TreeContext (owned by this crate, mapped to SpendInput at the engine boundary); drained leaves retain their OutputIdentity so the compressed I can be re-derived via the new shekyl_fcmp::tree::key_image_generator. A Tier-A KAT (assemble_kat) independently re-hashes the assembled branches back to the recorded consensus header root and checks the C3 depth invariant. Spec: docs/design/CURVE_TREE_CLIENT.md §3.5 / §5.

• curve-tree: CT-3 block-derived reconstruction client. The shekyl-curve-tree client module lands CurveTreeClient, the wallet-facing orchestrator that ingests synced blocks reduced at the caller's decode boundary (BlockLeaves/TxLeafInputs/RawOutput, carrying the scanner-Extra-parsed tx_extra 0x07 blob), resolves per-output h_pqc, threads the global output index, owns the reference-height → drain-cutoff mapping (drained_through = H − 1), reconstructs the root, and enforces the integrity gate (verify_root → RootMismatch on a root the wallet cannot reproduce — loud failure, not a silent bad proof). Reorg is rebuild-from-post-reorg-chain (from_blocks), no separate machinery (derive-don't-accumulate, CT2_DRAIN_ORDER.md §7.1). The crate stays lean (no shekyl-scanner dep). The CT-2 Tier-A KAT now also runs end-to-end through this production path and pins client-path == recon-path height-for-height. Spec: docs/design/CURVE_TREE_CLIENT.md §3.

• curve-tree: CT-2 reconstruct-root KAT (Tier A) against consensus. New shekyl-curve-tree test recon_kat replays a checked-in regtest fixture (tests/fixtures/ct2_tier_a.json, generated offline by gen_ct2_fixture.py, never run in CI) and asserts the wallet's block-derived build_layers root byte-equals the C++ consensus header curve_tree_root at every height across three chains (main + deep/shallow coinbase reorgs). Pins S1 (index order), the S2 drain boundary (drained_through = height − 1; empty window 0..=60, first founder drain at 61), and S3 reorg position-stability + freeze-lag. Spec: docs/design/CT2_DRAIN_ORDER.md §8.

• wallet: Phase 2b stake-FSM pending-claim model pinned (Round 2, PHASE_2B_STAKE_LIFECYCLE.md §3.4). A confidential claim is non-spending, so it has no OutputId and nothing for PendingTxEngine's output-keyed reservation (selected_transfer_indices, verified at engine/pending.rs) to lock; the resource a claim reserves is the epoch-nullifier set. Pin: the stake actor gains a runtime-only claim_pending_epochs reservation (not persisted, not on the wire/sealed region — so the EpochSet encoding carries one set per stake, not two), mirroring PendingTxEngine's own crash-self-heal model. PendingTxEngine stays spend-pure (Hybrid-B): confirm/reorg is already shared via RefreshEngine scan + §5.2 (nullifier marker; verification carried by the still-open §5 reconciliation box), and the only spend-engine-specific sliver — the submit-time staleness gate — is duplicated on the claim path (~10 lines) rather than abstracted (E shape), because the gate is a consensus-backstopped UX optimization (a stale claim is rejected at consensus regardless), so copy drift is benign. Rejected: Hybrid-A (lockless PendingTxEngine entry) and Option C (generalize the reservation to abstract resources) — both re-merge claim/spend separation or drag staking-domain semantics into the spend engine. Reversion trigger (§8.9): factor a shared staleness/broadcast primitive on the third claim-tx-type OR a non-backstopped check, whichever first; Stage 5 ArchivalEngine disbursement is the live third-consumer candidate (archival is otherwise additive and does not reopen the FSM). Ratified: Accruing/Claimable stay separate; PendingBroadcast discard drops the instance (no terminal Discarded); R0-D6 post-unstake claims confirmed. Backstop dependency for any future nullifier-set pruning workstream flagged in FOLLOWUPS.md (only out-of-claim-window nullifiers prunable). §5.2 reorg reconciliation collapsed to a single authoritative full-rebuild (claimed_epochs = {S ∈ window : x·G_S ∈ post-reorg chain set}): removes the prior incremental "un-claim epochs observed at/above fork_height" step, which presumed a per-epoch observation height the EpochSet does not carry. The collapse is forcing, not preferential: the incremental path requires a field that does not exist and should not (storing it would foreclose the bitset encoding the roaring-vs-bitset wire choice is weighing), so the height-free rebuild is the only implementable mechanism — in-session reorg and post-Restore resync are now one operation, claimed_epochs stays a pure (payload-free) index set, and claim_pending_epochs (runtime-only) is never repopulated by reorg. The reorg path persists ledger → stake → persist (§5.3 parity) with no transactional atomicity — a crash mid-rewind self-heals on reopen via the rebuild, which runs before any claimable balance is exposed. §5 is designed-complete but box-pending two forward-dependencies. §4.7 message protocol now pinned (D1–D4): reorg is folded onto ApplyStakeEvents { reorg_rewind } rather than a separate RewindTo — handled rewind-first in one uninterruptible actor turn (atomicity: nothing interleaves between rewind and forward replay; mirrors the ledger's reorg_rewind field). Reorg semantics are clear-all / replay-all of the full surviving own-nullifier set across the whole post-reorg chain (a windowed [fork_height, tip] replay would drop the below-fork survivors of a lock that straddles the fork), with heights living in the scanner, never in the payload-free claimed_epochs. The claim_pending_epochs lifecycle is wired as a PrepareClaimBuild side-effect (set, idempotent under union) + a new AbandonClaim message (clear on staleness/discard, touching claim_pending_epochs only, never claimed_epochs — whose sole authority is the on-chain nullifier). Snapshot excludes claim_pending_epochs and Restore starts it empty. This discharges §5's first forward-dependency (§4.7); only the consensus-track pop_block nullifier-revert (cross-tree atomicity) the wallet reorg mirror assumes still holds the §5 box open. EpochSet wire/sealed encoding pinned (§3.3.2): a fixed u16 relative bitmask anchored at the public creation_height (2 fixed bytes, one set per stake), not roaring/croaring. Consensus bounds claimed_epochs to ≤15 elements over a contiguous ≤15-wide window (tier-3 = 150,000 blocks ÷ 10,000 blocks/settlement-epoch = 15 settlement-epochs = MAX_EPOCHS_PER_CLAIM), so roaring's large-sparse-domain compression has nothing to compress and would only add overhead + a crate dependency. The bitmask is payload-free by construction — the anchor is the public creation height and the mask is purely relative, so there is no field in which a per-epoch height could live, which is what forecloses the incremental reorg path (§5.2) structurally rather than by discipline. StakeId derivation pinned (§3.3.3): cSHAKE256(customization = "shekyl/stake-id-v1", input = tx_hash ‖ le_u64(index_in_transaction)), full 32-byte XOF read, mirroring the in-workspace derive_output_handle (shekyl-crypto-pq/handle.rs) idiom — cSHAKE256, not cn_fast_hash, not BLAKE3. cn_fast_hash (shekyl-crypto-hash) is inherited Keccak-256 with CryptoNote 0x01 padding, a consensus-critical primitive whose purpose is byte-identity with src/crypto/keccak.c / upstream Monero; deriving a new wallet-local id with it drags inherited legacy crypto into post-CryptoNote code, against the 00-mission.mdc modern-not-inherited / PQC-hardened posture (an intermediate pass had "corrected" the Round-1 BLAKE3 placeholder to cn_fast_hash on reuse grounds — that read the intent backwards). cSHAKE256 (FIPS 202 / SP 800-185) is the workspace's PQC-aligned hash (already used by key_actor/local_keys/traits::key/handle) and dependency-clean: sha3 = "0.10" (exposing CShake256) is already a workspace dependency (verified at source: shekyl-crypto-pq, shekyl-shard-visual), whereas blake3 is not — so modern-not-inherited and 17-dependency-discipline.mdc select the same primitive, and BLAKE3 would add a crate for no gain. Domain separation is native via cSHAKE's customization parameter (no hand-rolled input prefix; "shekyl/stake-id-v1" is distinct from "shekyl/output-handle-v1", so no collision despite both absorbing tx_hash); input fields are fixed-width so no length prefix is needed; no view_secret (the id is non-secret, not a secret-keyed handle). The id derives only from the on-chain (tx_hash, index) and is therefore rescan-stable (load-bearing for mapping StakedOutputConfirmed / OwnNullifierObserved events back to the same persisted instance); the v1 customization + a wallet-internal KAT guard persistence stability (a bump is a pre-genesis rm -rf migration).

• staking: pop_block reorg-atomicity spec unified for 3C + h_bind re-stamp closed in design (CONFIDENTIAL_STAKING.md §11 / §6.4.3). Verified at source that 3C state (staking subtree, nullifier table, h_bind) is spec-only — grep nullifier|h_bind in blockchain.cpp is empty, and the live pop_block_from_blockchain reverts the pre-3C accrual/pool/burn model. The Apr-07 LMDB_WRITE_ATOMICITY_AUDIT.md PASS is therefore not "for a dead path" wholesale: its curve-tree half is live and is the reusable pattern (deferred insertion via add_pending_tree_leaf(maturity) / drain_pending_tree_leaves, with m_pending_tree_drain + block-pending-additions journals giving exact, DUPSORT-free, atomic pop); only the staking-economics half (accrual/pool reversal) is superseded. Rewrote §11 from the C-2-era subset (which cited the stale blockchain.cpp:800–822 and omitted cross-tree atomicity) into the complete reversal surface, mapping each element onto the proven journaled-pop pattern: (1) staking-subtree leaves via their own pending/drain/block-additions triple, (2) cross-tree stake/unstake transitions both directions (§6.4.3), (3) nullifier-table insertions (new reorg-state, C-2), (4) band_sum/rate-epoch records, (5) minted rewards + staked-output insertions — all journaled, all inside the one batch_start/batch_stop block txn; the Round-2 audit re-run is mechanical. h_bind re-stamp concern closed: the MIN_AGE-buffer composition holds tier-independently because the buffer is the mining → eligible deferred-insertion drain (no tier term; tier_lock governs only the claim-validity window, smallest tier ≫ MIN_AGE). A leaf is membership-provable only after drain (creation_height ≜ eligible_height = mining + MIN_AGE, where h_bind is frozen), and claims prove membership at the current root, so re-stamping a drained leaf's h_bind requires un-mining its source block = a ≥ MIN_AGE + 1 reorg (catastrophic, out of scope); a shallow reorg (≤ MIN_AGE) catches the output undrained in pending_tree_leaves, where the journaled pop restores/removes it and re-mine re-derives h_bind on re-drain — no drained-leaf h_bind mutation ever occurs. Upgraded §6.4.3 ground (iii) from a one-line assertion to this deferred-insertion argument, and disambiguated "consensus-set at inclusion" (§3C decision / re-stake-after-transfer) to "at subtree drain" so it cannot be misread as mining-height stamping. Cross-linked into PHASE_2B_STAKE_LIFECYCLE.md §3.3.2: the EpochSet 2-byte relative-bitmask anchor (creation_height) is reorg-stable by the same MIN_AGE buffer (shallow reorg catches a stake pre-drain — no anchor to move; the §5.2 full-rebuild re-anchors anything caught early), closing the anchor-mutability seam the h_bind re-stamp surfaced. Net: the §5 box's consensus-track pop_block forward- dependency is now a written spec (Round-2 implementation + mechanical audit re-run), not an open question. Follow-on (convergence reframing + source verification): verified at source (blockchain_db.cpp::collect_outputs / db_lmdb.cpp::drain_pending_tree_leaves) that maturity is computed from the source block height, never the drain-time tip, and the drain gate is purely maturity ≤ current_height — so the drain anchor is source-relative, transitively. This dissolves the h_bind re-stamp concern within bound by convergence rather than by getting pop mechanics right: a source-relative anchor is invariant under any reorg ≤ MIN_AGE, so pop-then-re-extend re-drains at the identical eligible_height and re-derives the identical h_bind — "restore the stamped leaf" and "recompute on re-insert" are two spellings of the same value within bound, making pop-correctness unobservable within bound (the guarantee no longer rests on pop carefulness). Corrected two framings: (a) the protection is structural on the insertion side (the drain-gate admits only ≥ MIN_AGE-deep-sourced leaves, so every root — current included — holds only stable-h_bind leaves), not on the reference side, so "membership at the current root" and "h_bind stable" coexist with no tension; (b) §6.4.3 no longer conflates the live main tree's lock-based staked maturity (max(effective_lock_until, H + DEFAULT_TX_SPENDABLE_AGE), pre-3C single tree) with the 3C subtree's own eligible_height = mining + MIN_AGE buffer — the mechanism is reused verbatim, only the buffer constant is 3C-specific, both source-anchored by the same gate. §11 item 1 now pins re-drain-recompute as load-bearing: re-drain MUST recompute h_bind from the re-mined source height and MUST NOT cache/restore the stamped leaf across a pop — a within-bound no-op (convergence) that silently becomes a beyond-bound permanent corruption if a future implementer "optimizes" by stashing the stamped leaf in pending. The beyond-bound (> MIN_AGE) regime inherits the FCMP reorg envelope (already invalidates in-flight FCMP references broadly) — no stake-specific new exposure. §3.3.2 sharpened: the hot reorg path pays nothing (mask base unmoved when only the drain block is popped); the deep-reorg re-anchor is a rare-path correctness item, not a common-path cost.

• wallet: stake-opening persistence DISSOLVED — (amount, z) re-derived, never at rest (PHASE_2B_STAKE_LIFECYCLE.md §3.3.1 / §4.1 / §4.2 / §4.7 / §8.8). The opening was pinned to the file_kek-protected sealed wallet region (claim-forgery-grade secret at rest). That persist-half is redundant with a re-derive-half the doc already specifies and relies on: source check confirmed C_stake = z·G + amount·H is plain Pedersen with z = OutputSecrets.z — the standard output blinding, not a fresh subtree mask and no τ·H_t term (CONFIDENTIAL_STAKING.md §"Pinned commitment construction (staked outputs, Decision 3C)"

  • the z mask-table row) — so (amount, z) recover from the staked output alone via derive_output_secrets, the same HKDF expand the §4.2 resync row (and every received-output scan) already runs, with no whole-tx-balancing context. Pin: the stake record persists public fields + claimed_epochs only; there is no sealed stake region. The opening is re-derived on hydration (Restore), held in memory for the session (zeroized on drop), and constructed in-process at build-time registration (Secret<StakeOpening> move, not a sealed blob); Snapshot carries no opening. Exposure flips from claim-forgery-grade sealed material to no claim-grade secret at rest — the dissolution stops persisting a half already re-derived, it does not invent a recovery path. This generalizes R0-D8 (which already excludes theft-grade x from persistence) to claim-grade (amount, z): nothing claim- or theft-grade is at rest. Held-on-hydration over fully-transient (sub-decision): x stays transient-per-claim (theft-grade, claim path already composes it); (amount, z) is re-derived once at Restore and held in memory rather than re-derived per operation, because (a) it is read on every display poll and holding avoids a per-read KeyEngine round-trip, (b) it adds no marginal at-rest exposure (nothing persists either way) and no marginal in-memory exposure that matters (the view key — root of all derivation — is resident all session regardless), and (c) fully-transient would force a claim-build-flow change (R0-D4 / PrepareClaimBuild would move (amount, z) from held-and-returned to orchestrator-re-derived-via-KeyEngine) for that marginal gain. The §3.3.1 severity asymmetry (x = principal-theft, (amount, z) = claim-forgery) justifies the different treatment; the claim-build flow is unchanged. Two distinct reopen clauses (rule 21), do not conflate: (1) the original R0-D8 x-cost clause (reopen persist-x only if measured resync derivation dominates UX budget and cannot be batched, PERFORMANCE_BASELINE.md evidence); (2) the dissolution's own clause — a future ledger-pruning pass that evicts a spent staked output before all its accrued epochs are claimed breaks post-unstake re-derivation, and since accrued epochs are claimable indefinitely after unstake (R0-D6, not age-bounded), this reopener is claim-completion-gated, not height-gated: a pruning pass MUST check per-spent-output claim-completion before evicting. Landed coherently across §0.8/§0.10 framing, R0-D3 transport (in-process Secret move, not sealed blob), the StakeInstance doc, the §4.7 message table (Restore re-derives, Snapshot opening-free), the §7 threat table (in-memory not at-rest), §9 Round-2 record + §10.1 (was decided-in-principle → gate-confirmed-at-source → now landed; closes the last two Round-2 R-residuals alongside the async split). CONFIDENTIAL_STAKING.md needs no change (consensus-side; it only references x non-persistence and defers to §3.3.1).

• wallet: StakeEngine async/sync split resolved — last Phase 2b field residual (PHASE_2B_STAKE_LIFECYCLE.md §4.6). Verified at source that RPITIT-+ Send is the established idiom across five engines (KeyEngine key.rs:803/887, RefreshEngine refresh.rs:268, PersistenceEngine persistence.rs:204/244/280, PendingTxEngine pending_tx.rs:197/263, DaemonEngine daemon.rs:206/235), each mixing sync reads with RPITIT actor ops and carrying the Send bound in the trait contract for the async wallet-RPC/CLI/GUI call sites. Ratified, not chosen: StakeEngine stays Send + Sync + 'static; every actor-routed method returns impl Future<…> + Send (not bare async fn, not async_trait — a fifth-engine wart). Marked the §4.6 all-sync draft accordingly. Forced-async four (register_pending_stake, apply_stake_events, prepare_claim_build, abandon_claim) — architecture-forced by secret-locality + rewind-first atomicity. Reads all-async now, no StakeView cache (anti-pre- provisioning): safe because prepare_claim_build is the authoritative path (stands alone, re-validates against current claimed_epochs/claim_pending_epochs in-turn), so no read feeds an unvalidated security decision — every read is display-grade / stale-tolerant / consensus-backstopped (§8.9 staleness-is-UX-not-soundness). Corrected the prior lean that kept claimable_rewards_atomic/unclaimed_epochs async "regardless": their own backstop argument makes them display-grade like the rest, so the claim-feeding-vs-public split collapses. Cache is a measured-performance reversion (rule 21; PERFORMANCE_BASELINE.md evidence, not a passive "snapshot already exists") with a named Stage-5 candidate (ArchivalEngine cross-actor is_active_staker/stake_tier polling); its shape (almost certainly uniform over all reads, prepare_claim_build the single validation point) is confirmed at build time, not pre-baked. Closes the field-residual pass without pre-provisioning either the cache or its shape. Deferred sub-item (now resolved): the register_pending_stake opening-persistence descriptor was held pending a §4.2 review — the source check correctly found the opening dissolution had not landed (§4.1/§4.2/§3.3.1/§4.7 still persisted (amount,z) to the sealed region; an earlier turn had referenced it as done from conversational memory, the document-analogue of the enumeration-brittleness the project guards against in code). That review is now complete and the dissolution landed as the coherent multi-section change recorded in the next entry, which turns this descriptor to "runtime-only opening from the build context"; the RPITIT-async signature is unaffected.

• wallet: Phase 2b §6 user-facing orchestrator API signed off (Round 2, PHASE_2B_STAKE_LIFECYCLE.md §6 / §4.6 / §7). Closes the last §6 review residual after a completeness/surplus/inherited-shape pass. StakeView pinned as a concrete owner-grade struct (id, tier, band, state, per-stake claimable: AtomicUnits, claimed_epochs, unlock_height) — it was previously prose-only ("public fields + claimable amount"), so the per-stake claim(stake_id) decision had no surfaced bridge from the global claimable_rewards() total. Trust-grade split made explicit: per-stake claimable is a deterministic function of the confidential principal and public params, so it discloses the staked amount (and claimed_epochs the claim pattern); StakeView is therefore owner-only (owner UI / owner-authenticated RPC) and the §7 lens-3 diagnostic projection is a distinct, more-redacted shape (global total + coarse state, no per-stake fields) — one struct cannot serve both grades. Amounts are AtomicUnits end-to-end: rejected the "wrap-u64-at-the-boundary" layering (it Shekyl-ifies the already-safe public return and leaves the engine holding the inherited raw-uint64 Monero primitive at exactly the cross-instance-sum site where overflow/unit-confusion bugs live). The newtype is the in-Rust domain type across trait/orchestrator/computation; u64 reappears only at the true edges (postcard, FFI, consensus amount boundary). Consequence: claimable_rewards_atomic -> u64 becomes claimable_rewards -> AtomicUnits (the type carries the "atomic" meaning, so the suffix is redundant), projected_yield -> AtomicUnits, ClaimableRewardsAtomic message → ClaimableRewards, and StakeOpening.amount_atomic/Accruing.accrued_rewards_atomic drop the suffix. StakeFilter declared as a closed by-state enum (All/Accruing/ Claimable/FullyUnstaked) mirroring StakeState — the open-ended filter param had no named consumer (rule 21). Abandon-claim wiring pinned (§3.4/§6): a built claim() is an ordinary claim-type PendingTx; the orchestrator's general pending-tx discard path dispatches AbandonClaim for claim-type txs specifically, so "rides the normal path" does not silently drop the claim_pending_epochs clear (AbandonClaim touches claim_pending only, never claimed, D3). Pre-stake yield projection omitted by decision (a forward estimate would project the public rate forward and overpromise, §8.6). FA-1 regrounded: dropped the inherited "primary account address" framing (which pre-provisions an account/ subaddress hierarchy Shekyl does not have) for "the wallet's single static address," with an independent-accounts reopen-pointer (rule 21) — when seed-derived independent accounts land, cross-account staking becomes a new opsec decision designed then, not baked into a one-address API now. Also fixed a stale StakeOpening doc-comment ("SECRET — sealed at rest") the dissolution's closing grep missed on phrasing drift — verify-by-reading, not re-grepping. Round-2 confirm pass (2026-06-05) hardened four of the above against source: (1) lens-3 redaction now names the derived-value class explicitly — the old "no view/spend, no z, no per-output secret correlation" wording was written for the secret class and does not cover claimable/claimed_epochs, which are derived leaks (claimable → principal via public params, claimed_epochs → claim pattern); the redaction now excludes both by name. (2) Abandon-claim keying located — PendingTx (engine/pending.rs) carries no claim discriminator and no (stake_id, epochs) (verified at source; it stays spend-pure, so threading a claim ref through Reservation::extensions is the rejected Option-C boundary break). The discriminator + key therefore live in the orchestrator (the one site holding both the ReservationId from PendingTxEngine::build and the (stake_id, epochs) from prepare_claim_build), which records ReservationId → (stake_id, epochs) for claim builds and consults it on discard. (3) StakeFilter made total — corrected from the 4-variant subset to a 1:1 mirror of all 7 StakeState variants + an All sentinel, both #[non_exhaustive] and held in lockstep, so filtering is total (no inexpressible state, no dead variant). (4) AtomicUnits is forward intent, not an existing type — verified at source (rule 17): the newtype does not exist anywhere in rust/ (the wallet uses raw amount_atomic_units: u64). The §6 sign-off is therefore recorded "modulo the AtomicUnits convention" (§10.1 box); the method set is signed off, the amount type is a dangling dependency introduced by a separate interim PR before broad wiring (bounded-cost-now), now tracked in docs/FOLLOWUPS.md (V3.0). Note the most load-bearing constraint for that PR: OutputClaim.amount_atomic_units is a secret (wiped on drop, [REDACTED] Debug), so the newtype must preserve Zeroize + non-leaking Debug.

• staking: EconomicsEngine::rate_at_epoch finalized; pool_weighted_total retired (PHASE_2B_STAKE_LIFECYCLE.md §8.6 + V3_ENGINE_TRAIT_BOUNDARIES.md §2.7). Closes the R0-D5 Round-2 box. rate_at_epoch(rate_epoch) -> Result<u64, Self::Error> is pinned as the sole yield-schedule surface StakeEngine consumes, with seven semantics pins: (1) rate_epoch is a rate-epoch index, not a height — the caller converts via the public rate_epoch_blocks; (2) returns the public rate ρ_e as fixed-point u64 (a rate, not an amount, so not AtomicUnits; consensus-defined scale the wallet consumes); (3) fallible with Ok(0) ≠ Err — Ok(0) is a settled empty-staker epoch, Err is "cannot determine" (unsettled epoch / unsynced mirror / overflow), un-overloading the 0 that the infallible pool_weighted_total conflated; (4) consensus-derived from the on-chain band_sum, not wallet-recomputed (Bug-2-class avoidance); (5) the AtomicUnits crossing is the yield product own_weight · K_S, not the rate itself (this is the checked-arithmetic centralization site the shekyl-units newtype exists for); (6) no per-stake state — index in, no stake_id (§8.2 reversion preserved); the signature uses the trait's Self::Error convention (the earlier EconomicsEngineError sketch was wrong vs base_emission_at/burn_amount). pool_weighted_total (-> u128) retired — delete, not renarrate (rule 15): verified at source in both the trait rustdoc and the boundaries doc that its sole named consumer was StakeEngine::projected_yield's pool denominator, which the confidential redesign eliminated ("no daemon-supplied denominator anymore", §7); zero V3.0 consumers. Reopen-criterion is rule-21-shaped (a future consumer needing a pool aggregate not composable from rate_at_epoch

  • chain state). The band_sum mirror (ChainEconomicsSource::active_weighted_stake) is repurposed as rate_at_epoch's internal ρ_e-derivation input, not deleted. The boundaries doc is amended across all 7 sites (§2.7 Ownership list, method sketch, projected_yield consumer narrative, discipline-test example, and the 3.3.6 / class-a / blocking-semantics tables), framed "retired pending Stage-3 code removal"; the code swap + grep-retire targets (economics.rs, local_economics.rs, economics_differential.rs, chain_economics_source.rs, mod.rs, lifecycle.rs) are enumerated in §8.6 for Stage 3. Round-2 status: both wallet-design boxes (§6, §8.6) are now closed; the only remaining open box (§5 reconciliation) is designed-complete and held open solely by the consensus-track pop_block nullifier-revert cross-track dependency — no further wallet design work blocks Round 3.

• staking: §0.1 pre-flight re-verify trio closed; boundaries-doc §10.5.1 pool-denominator residual fixed (PHASE_2B_STAKE_LIFECYCLE.md §0.1 + V3_ENGINE_TRAIT_BOUNDARIES.md §10.5.1). Re-walked the three §0.1 engine-identification boxes against the §0.10 secret-ownership shift: (1) §2 trait-binding — §2.7 / §3.3 already discharged by the rate_at_epoch landing (rate_at_epoch is a §3.3.6 pure-read, carries no cross-engine .await-ordering obligation), §8.3 lens row clean; (2) §1.5 three-condition test re-confirmed — the actor's only secret state is in-memory (amount, z) (re-derived on hydration, never sealed), and fail-stop failure isolation holds precisely because that secret is reconstructable, not authoritative-at-rest; (3) surface-amendment confirmed — the Stage-2 "no secrets in stake actor" inheritance is superseded by the "in-memory-only, re-derived, never-sealed" invariant. One residual fixed: §10.5.1 still described StakeEngine as owning "principal-pool aggregation state at Stage 4" — an 8th dead pool-denominator site the literal-name pool_weighted_total sweep missed — corrected to per-stake in-memory openings with no principal-pool aggregation (exact yield = rate_at_epoch × own secret weight, §7 / §8.6).

• staking: §5 reconciliation box split — wallet design signed off; consensus pop_block carry isolated (PHASE_2B_STAKE_LIFECYCLE.md §10.1 / §5 / §9). The §5 planning box conflated the (discharged) wallet-design legs with the (open, external) consensus dependency. Split into: (a) a checked wallet-design box — the single full-rebuild un-claim mechanism (§5.2, in-session reorg == post-Restore), no-transaction self-heal-on-reopen, cross-engine ordering (§5.3), and the §4.7 message-protocol leg (D1–D4) — no further wallet design work remains; and (b) an explicitly-external cross-track carry — §5's reorg correctness assumes the consensus pop_block path atomically reverts the stake-claim nullifier set (cross-tree atomicity); the wallet mirror is already maximally correct and cannot fix a consensus pop that fails to revert. The carry closes only by confirming pop_block behavior upstream (CONFIDENTIAL_STAKING.md, consensus Round 2), not by any wallet change. This makes the consensus pop_block nullifier- revert the sole remaining open §5 item, and confirms no wallet design work blocks Round 3.

• staking: Round 3 agenda pre-staged (PHASE_2B_STAKE_LIFECYCLE.md §7.4 / §9 / §10.1). With both wallet-design Round-2 boxes closed, pre-staged the threat-model-exhaustion + wider-substrate- audit round (Principles 5–7). Added §7.4 enumerating: adversary models A1–A4 (adversary- controlled daemon / passive observer / memory-disclosure / collusion); a 9-item threat- exhaustion agenda T1–T9 (per-stake claim-sequence correlation, claim↔stake linkage across a sequence, cold-start band-cohort leakage, claim-timing correlation, in-memory opening exposure, nullifier-reorg shapes, nullifier/key-image cross-link, silent-inflation wallet role, fake-event injection); and a 10-item wider-substrate audit seed G1–G10 (Principle 6 — slashing N/A, delegation N/A, lock-up surprise, dust/fee-starved claim, resync-in-flight, mempool eviction, long-range reorg, HW-wallet latency, locked-during-claim, fee-bump rejection mirroring the PR 5 G3 precedent). Pre-staging is not closure (Principle 5): every T/G item is OPEN and Round 3 closes only when each carries a disposition (mitigated / FOLLOWUP+trigger / priority-reject+ criteria, rule 21). Cross-track deps recorded: consensus pop_block carry (T6/G7), upstream Round 2 wire/KAT (T8/G7), possible cold-start cohort-floor upstream ask (T3). Also fixed a dangling §7.3 cross-reference (line-134 "§7.3 projection axes") by giving the lens-3 diagnostic projection its §7.3 heading.

• staking: confidential-claim entitlement D pinned + remainder range-proof construction closed (Round 2, §6.4.1 decisions 1(a)/1(b)). Corrected the underspecified D = SCALE to D = D_tier · SCALE_rate = 2^(k+1): D_tier = 2 is the LCD of the pinned tier multipliers {1.0, 1.5, 2.0} (so tier_num_reduced ∈ {2,3,4} exact, one bit) and SCALE_rate = 2^k is the precision dial. Decision 1(b): the remainder commitment C_ρ is folded into the reward output's existing native 64-bit AggregateRangeProof as one aggregated commitment — not a separate or tight ⌈log2 D⌉-bit proof — and is the same group element the entitlement relation consumes, bound across both sub-proofs in one transcript (decision 3). The inflation-critical bound is the lower bound ρ ≥ 0 (over-claim forces ρ < 0; the field-wrap escape needs reward > 2²⁰³ while the reward output's own range proof bounds it < 2⁶⁴ — a 139-bit margin at the pinned k), so any width ∈ [⌈log2 D⌉ … ~203] is sound and the cheapest is the one already on the wire; a tight ρ < D would only forbid harmless under-claim. Because the fold fixes the proof width at 64, precision became free up to the field-wrap margin, so k is re-pinned from the obsolete "smallest k clearing a 0.1 % floor" (k = 38) to the floor-dominated knee k = 48 ⇒ D = 2⁴⁹ (SCALE_RATE_K): the precision sweep's worst-case relative rate-quantization error falls until k = 48 (2.1e-5) and then plateaus (the irreducible reward floor, not the rate scale, dominates), with a 139-bit margin and 132-bit N·amount overflow headroom. The knee is lifetime-invariant: it is set by the smallest meaningful rate, floored by the era-independent meaningful-yield cutoff, and the sweep grid spans down to the terminal tail subsidy — so emission decay (0.90/yr) does not move it (knee_is_lifetime_invariant_not_genesis_only). New integer core + de-risking bundle in rust/shekyl-staking/src/entitlement.rs (tier_num_reduced, denominator, SCALE_RATE_K, reward_and_remainder, precision_sweep, recommend_k_knee, wraparound_over_claim_margin_bits) with soundness/overflow/fold proptests; committed sweep (with margin column) docs/test_vectors/staking/entitlement_precision_sweep.json. Spec: docs/design/CONFIDENTIAL_STAKING.md §6.4.1; audit: docs/AUDIT_SCOPE.md.

• staking: confidential-claim transcript composition / anti-splicing closed (Round 2, §6.4.1 decision 3). All four claim components (subtree membership, ClaimLinkability, entitlement Schnorr, folded remainder range proof) bind to one shared root μ_claim = signable_tx_hash — reusing the existing FCMP++ message rather than a monolithic transcript (the proof systems are heterogeneous and the BP+ is self-contained; a single transcript would re-architect upstream proofs for zero soundness gain). μ_claim covers the full claim — prefix (tier, creation, settlement_epochs, the nullifier vector, subtree root), rct base (C~, C_claim, C_ρ), and the folded BP+ hash — so moving any component onto another claim, mutating the nullifier set, or swapping C_ρ flips the challenge and rejects. The entitlement Schnorr challenge is keccak256_to_scalar("shekyl-stake-entitlement-v1" ‖ G ‖ H ‖ N_le ‖ D_le ‖ C~ ‖ C_claim ‖ C_ρ ‖ R ‖ μ_claim); its consensus-critical field set + order are locked dependency-free in rust/shekyl-staking/src/entitlement/transcript.rs (EntitlementChallengeInputs, entitlement_challenge_preimage via offset constants) with KAT / field-presence / μ_claim-load-bearing tests, so the prover and C++/FFI verifier cannot drift on what is hashed. Spec: docs/design/CONFIDENTIAL_STAKING.md §6.4.1 (decision 3) + §6.4.8 verifier ordering; audit: docs/AUDIT_SCOPE.md (item 5a + negative anti-splice vectors).

• crypto-pq: FA-6 ML-KEM-keyed view-tag pre-filter (T6 account path). Re-key on-wire view_tag from derive_view_tag_x25519 to derive_view_tag_prefilter(ml_kem_ss); scanner leg-swap (universal decap → tag compare → X25519 on match). HKDF salt shekyl-view-tag-prefilter-v1. Regenerated docs/test_vectors/PQC_OUTPUT_SECRETS.json. Regenerated mainnet/testnet/stagenet GENESIS_TX in cryptonote_config.h (coinbase view_tag_prefilter; block 0 hash changes). Reference hex in the shekyl-dev repo at tools/genesis_builder/genesis_tx_*.hex. Spec: docs/design/FA-6_VIEW_TAG_ML_KEM.md.

Fixed

• fcmp: the Selene leaf layer is never the curve-tree root. build_layers/build_upper_layers returned the bare layer-0 Selene leaf node as the root for any 1..=SELENE_CHUNK_WIDTH-leaf tree, diverging from the daemon's grow_curve_tree, which always wraps the leaf chunk into the layer-1 Helios node before its root-stop check. The wallet's reconstructed root therefore mismatched consensus at every height with a small tree (e.g. the founder coinbase at height 61). build_upper_layers now stops at "single node at layer ≥ 1" — every non-empty tree is depth ≥ 2; the empty tree remains the selene_hash_init() sentinel. Proven by the new CT-2 KAT; corrects the CT-0 freeze model (undeepen_helios_collapse_39_to_38 renamed to helios_root_shrinks_39_to_38_without_undeepening; reorg_compound_45_to_35 target re-wrapped). Docs: CT2_DRAIN_ORDER.md §5, CURVE_TREE_CLIENT.md.

• Genesis GENESIS_TX regen (FA-11 enc_labels). Rebuilt mainnet, testnet, and stagenet genesis coinbase hex with current build_genesis_coinbase_from_destinations so enc_labels matches enc_amounts on load. Mainnet and stagenet use a single treasury output (100_000 SKL combined founder allocation) with deterministic placeholder Bech32m keys until production wallet addresses land; testnet keeps five developer outputs (20_000 SKL each) with deterministic raw-seed keys. Recipient JSON and reference hex live in the shekyl-dev repo (tools/genesis_builder/); address generation: rust/shekyl-crypto-pq/examples/gen_genesis_addrs.rs.

Added

• engine: KeyEngine migrated into a kameo actor (Stage 2). Key material now lives in a KeyActor running on its own task and owning AllKeysBlob privately; the orchestrator holds a Clone KeyEngineHandle instead of keys: Arc<AllKeysBlob>. Engine<S, …> stays seven-parameter Engine<S, D, L, E, R, P, F> (no inline K: KeyEngine generic — the deferred-inline-shape reversion clause resolved in favor of the handle). The request half of the actor protocol is public (OutputDetectionInput → OutputClaimResult); the reply OutputClaim carries secret-derived bytes (the decrypted amount plus the privacy-linkable handle/key_image) and is ZeroizeOnDrop (see Security below); the SignTransaction message exists but its reply is a Phase-1 stub. Handle-resolved reads (account_public_address, primary derive_subaddress) serve from an immutable KeyPublicProjection with no mailbox round-trip; non-primary derive_subaddress(Audit) is served from a construction-time AuditSubaddressSecret projection (it touches the view scalar — the §2.4/§3.1 "pure function of public keys" claim was corrected during pre-flight). The scanner merge post-pass reads a distinct construction-time HandleDerivationViewSecret (the 6-i disposition: apply_scan_result is synchronous under a std::sync::RwLock guard, so routing it through the actor mailbox is foreclosed until the Stage 4 Ledger-actor lock cutover). KeyActor is fail-stop by construction: a handler panic runs on_panic → stop (not restart), on_stop wipes the blob, and the handle maps every kameo::SendError to the terminal, non-retryable KeyEngineError::KeyActorUnavailable. KeyEngineHandle::spawn requires an ambient Tokio runtime and asserts it (panics with a contract message if absent) rather than self-hosting an engine-owned runtime: an owned, long-lived runtime would panic on drop inside the production async context, and kameo's spawn is tokio::spawn, which any flavor hosts, so the spawn needs no rt-multi-thread. Tests that reach spawn use #[tokio::test]; sync tests driving a post-create method that forbids an ambient runtime enter a leaked runtime only around create. tokio's rt-multi-thread feature is promoted to production [dependencies] as an independent fix for the pre-existing drive_persistence::block_in_place feature-unification bug (decoupled from the spawn decision, which does not need it). §5.2 contract/protocol tests landed, as did the §5.3 B9 dispatch-overhead benchmark (see the next entry). No consensus or wire-format change. Design: docs/completed/STAGE_2_KEY_ENGINE_ACTOR.md.

• bench: Stage 2 §5.3 B9 dispatch-overhead + merge-path benchmarks. Five bench-internals-gated bench targets in shekyl-engine-core: engine_trait_bench_key_dispatch (criterion; three IDs — baseline_claim_mine direct LocalKeys::try_claim_output, actor_claim_mine via the KeyEngineHandle ask, and the cheap actor_claim_not_mine), engine_trait_bench_key_dispatch_baseline_iai (iai-callgrind for the deterministic crypto baseline only), and the 6-i merge-path projection pair engine_trait_bench_key_merge_projection (criterion) + engine_trait_bench_key_merge_projection_iai (iai-callgrind). B9 is a bench-vs-bench ratio (actor ≤ 1.05 × baseline), not an absolute gate. The actor ask paths are criterion-(wall-clock)-only — a cross-thread async round-trip's Callgrind instruction count folds in nondeterministic runtime-scheduling machinery, so there is no iai actor sibling (reversion-claused: reopen if a deterministic async-dispatch measurement method lands); only the synchronous crypto baseline and the synchronous merge projection get iai siblings. The merge-path bench is decision evidence for the §8.1 6-ii deferral. New KeyDispatchBenchHarness, KeyBaselineBenchFixture, and MergeProjectionBenchFixture shims are exported through __bench_internals; populate_engine_handle_fields was widened to pub(crate) so the merge bench drives the real post-pass. compare.py routes all five IDs into the engine_trait_bench threshold class by prefix (no script change). The baseline iai drives its synchronously-completing future with a no-op-waker poll (a current-thread Tokio block_on under Callgrind collapsed the count to ~4.8k handshake instructions instead of the ~15.2M decap); the three B9 rows were added to scripts/bench/capture_rust_baseline.sh so CI captures them. Baselines captured by CI workflow_dispatch (run 26732235292, SHA d377edfdb) and transcribed into docs/PERFORMANCE_BASELINE.md: B9 ratio 1.039 — PASS (actor 1.386 ms / baseline 1.334 ms; ≤ 1.05); baseline iai 15,163,668 instr; merge projection ≈ 1.71 µs/output (iai 5,160,059), confirming eager-6-i. No production-path or consensus change.

• engine: EconomicsEngine trait surface (Stage 1 PR 7). Extracted the canonical economic-derivation surface — base_emission_at (base subsidy on the neutral trajectory), burn_amount (absolute adaptive fee burn), pool_weighted_total (the u128 pool-weighted stake denominator), and parameters_snapshot — as the pub(crate) EconomicsEngine trait with the LocalEconomics Stage 1 implementor, its ChainEconomicsSource read-abstraction (LedgerChainEconomicsSource adapter), and the EconomicsParametersSnapshot / CalibrationStamp return types. The snapshot's CalibrationStamp.params_digest is a canonical Blake2b-256 over the full calibration surface the snapshot exposes — the EconomicParams sub-digest plus the staker-emission consts and the shekyl-staking tier table — so a staker/tier recalibration that omits a generation bump cannot false-accept a stale snapshot (shekyl_economics::params_digest stays EconomicParams-scoped for the C4 fixture lineage). The Engine generic list grows the E slot (Engine<S, D, L, E, R, P, F>); the economics field is carried for struct-shape stability with zero V3.0 consumer call sites (R6) — production fee/burn/supply computation is not yet wired through the trait. Method rustdoc carries the §6.3 G4 (burn_amount point-estimate / as_of_height staleness) and G5 (parameters_snapshot generation/digest re-compare) consumer contracts. Differential tests replay RecordedChainFixture vectors through a ChainMirrorSource against shekyl-economics; Criterion + iai-callgrind benches cover base_emission_at and parameters_snapshot. This is the 7-trait PR (C0, C1, C2b–C7); the sibling 7-cutover (C2c) that delegates the C++ ESF base subsidy to Rust landed separately (PR #93) and wires the consensus path to the shekyl_base_block_reward primitive, not to this trait — the trait remains consumer-free until its own cutover per docs/design/STAGE_1_PR_7_ECONOMICS_ENGINE.md §6.2. No consensus or wire-format change.

Security

• crypto-pq/engine: zeroize secret-derived values on the scan/sign hot path (Stage 2 zeroization audit, Findings 1–4). A memory-disclosure audit run while Stage 2 was touching the scan/sign code found that the zeroization discipline protecting AllKeysBlob (sound and unchanged — ZeroizeOnDrop, #[repr(transparent)] wrappers, borrow-returning accessors) did not extend to the values derived from it.
  • Finding 1: RecoveredOutput's hand-rolled Zeroize silently omitted recovered_spend_key (a per-wallet, per-subaddress linkable identifier) and h_pqc. Replaced with #[derive(ZeroizeOnDrop)] so field coverage is compiler-enforced, not implicit in an editable function body.
  • Finding 2 (highest severity): the wallet view secret — reconstructed as a bare curve25519-dalek::Scalar once per scanned output on a daemon-drivable path — and the per-output ho/y/z scalars and the decrypted-amount bytes were left resident on the stack on every exit path (Scalar/MontgomeryPoint are Zeroize but not ZeroizeOnDrop). Enabled the zeroize feature on curve25519-dalek and Zeroizing- wrapped the locals in scan_output_recover.
  • Finding 3: swept the same bare-scalar pattern across the rest of output.rs's production scan/construct/key-image paths and Zeroizing- wrapped every secret-derived scalar / cleartext-amount local (public points left unwrapped).
  • Finding 4 (Stage-2-specific): the actor mailbox introduces a new non-zeroized surface — replies traverse kameo channel buffers this crate does not own. Established the contract that every actor message/reply type carrying secret-derived bytes is ZeroizeOnDrop: OutputClaim now is (its decrypted amount_atomic_units is treated as a secret, reversing an earlier "balance-display, non-secret" disposition), closing the ask-cancellation leak where the channel drops an un-taken reply. A reply_path_wipes_on_drop test asserts the reply's Drop wipes. No consensus or wire-format change. Design: docs/completed/STAGE_2_KEY_ENGINE_ACTOR.md §4.3.1.

Changed

• engine/docs: Stage 1 cleanup + status-doc reconciliation. Closed Stage 1 trait extraction's accumulated debt without touching Phase 2 functional stubs. (1) Reconciled the status docs to the ground-truthed dev reality: the orchestrator is the seven-parameter Engine<S, D, L, E, R, P, F> and EconomicsEngine is landed (PR #94), not the pre-#94 five-parameter / "economics spec-only" shape — updated V3_ENGINE_TRAIT_BOUNDARIES.md, FOLLOWUPS.md, and appended a dated closure checkpoint to STAGE_1_COMPLETION_AUDIT.md. (2) Recorded the deliberate KeyEngine inline-orchestrator-integration deferral as an explicit reversion-clause FOLLOWUPS.md entry (reopen criterion: the Stage 2 KeyEngineHandle actor migration). (3) Removed obsolete #[allow(dead_code)] annotations on the now-production-dispatched LedgerEngine::synced_height / snapshot and RefreshEngine::produce_scan_result trait methods (the bench-internals-only LedgerEngine::balance allow is retained with an updated rationale). (4) Swept stale in-code narrative across the engine crate: dropped dangling deleted-MockLedger precedent references, rewrote the obsolete Mock* test-substrate framing to the actual no-Mock substrate, normalized current-behavior C5α/C5β stage labels into behavior descriptions (preserving genuinely-historical notes), and fixed stale four-/five-parameter Engine<…> shape references in comments. Docs/comments plus one annotation removal; no behavior, consensus, or wire-format change.

• shard-visual: type-safe renderer dispatch (no panic fallback). render::render now dispatches on a closed Algorithm enum (AperiodicTile / Phyllotaxis / Truchet / Crystalline) instead of a &str match with a panic!("Unknown algorithm: …") fallback. Dispatch is compile-time exhaustive, so an unknown algorithm is unrepresentable rather than a runtime panic. candidate.rs carries the layer identities as Algorithm constants and derives the serialized CandidateRecipe strings via Algorithm::as_str(), so the frontend-facing recipe JSON is unchanged.

• shard-visual: per-renderer structural SHAKE256 namespaces (docs/V3_SHARD_VISUALIZATION.md §"Structural entropy"). The four candidate.v1 renderers (aperiodic_tile, phyllotaxis, truchet, crystalline) now draw their structural parameters from a dedicated per-algorithm namespace (shard.v1.render.<algorithm>) rather than sharing the legacy eight-word hash_words pool. Two renderers reading the same word index previously produced structurally-correlated geometry for one shard, and eight 32-bit words did not stretch across four algorithms without reuse; SHAKE256's XOF gives each (shard_hash ‖ 0x01 ‖ namespace) an independent, unbounded stream. aperiodic_tile previously consumed zero hash entropy (identical features → identical geometry) and now draws a rosette rotation and palette-spread jitter. The now-dead RenderParameters::hash_unit / hash_words accessor and field are removed from the crate. The Python explorer (shekyl-dev/visualization) is updated byte-identically. Pre-genesis / pre-release: no archived shard images depend on the old layout.

• economics: C2c cutover — get_block_reward base subsidy delegates to Rust (Stage 1 PR 7 §5.8). The duplicated C++ ESF base-subsidy formula ((MONEY_SUPPLY − already_generated) >> esf + tail floor) in cryptonote::get_block_reward (src/cryptonote_basic/cryptonote_basic_impl.cpp) is deleted; the 4-arg path now calls the canonical Rust primitive shekyl_base_block_reward (7-base) through the new shekyl::base_subsidy_before_penalty thin wrapper in src/shekyl/economics.h, mirroring the compute_fee_burn / compute_emission_split shape. The weight penalty (mul128 / div128_64) and the 5-arg release-multiplier path stay in C++ and are behavior-identical to the C2a′ witnesses; production call sites 1–7 are unchanged (signatures untouched), and fix α was already landed in 7-base. This is a consensus-atomic cutover (07-consensus-atomic-cutovers.mdc): no production path computes the ESF curve in C++ afterward, and the C2a′ dual-leg KAT remains bit-identical. Branched off the post–7-base dev tip (7-base merge fed6f594b; C2a′ ancestor by topology). Closes the docs/FOLLOWUPS.md base-emission migration item.

Fixed

• build: cargo-audit ignore config relocated to the path cargo-audit actually reads. The advisory-ignore config lived at rust/audit.toml, but cargo-audit only auto-loads .cargo/audit.toml (no --config flag exists), so the file was inert — the existing RUSTSEC-2026-0097 (rand) ignore never applied. The config now lives at rust/.cargo/audit.toml, making both ignores live (verified under cargo audit --deny warnings). Added RUSTSEC-2024-0436 (paste unmaintained) to the ignore list with rationale: paste is a compile-time-only proc-macro pulled transitively by shekyl-shard-visual's imageproc dependency, emits no runtime code, and is not security- or consensus-load-bearing; reopen if imageproc / nalgebra drop paste or if the crate replaces imageproc with hand-rolled rasterization. Pre-existing atomic-polyfill / bincode unmaintained notices and the aes yanked notice are unrelated to this change and left untouched (plain cargo audit, which CI runs, does not fail on them).

• refresh: async path no longer skips the engine post-pass (FOLLOWUPS P1/P3). The asynchronous refresh path (Engine::start_refresh → run_refresh_task) merged scan results through LedgerEngine::apply_scan_result, which discarded the inserted-index Vec<usize> and never ran populate_engine_handle_fields, leaving newly-merged transfers without output_handle / source_ciphertext. The mutator is removed from the LedgerEngine trait (now read-only: synced_height / snapshot / balance); run_refresh_task and Engine::start_refresh are specialized to LocalLedger and merge through the inherent Engine::apply_scan_result, which runs the merge body and the M3b post-pass under one LocalLedger write guard. This closes P1 (post-pass skip) and P3 (discarded Vec<usize> allocation) in a single commit. The dead FaultInjecting<LocalLedger> test wrapper and replace_ledger test helper were deleted; hybrid retry tests drive ConcurrentMutation producer-side. Shape (b) per docs/design/STAGE_1_PR_4_REFRESH_ENGINE.md §8; atomicity rationale per docs/completed/STAGE_1_PR_3_M3B_PREFLIGHT.md §3.

Documentation

• stake-lifecycle: §5 reorg reconciliation is forward-rebuild only — drop the pop_block nullifier-revert as wallet-tracked work. docs/design/PHASE_2B_STAKE_LIFECYCLE.md previously narrated the consensus pop_block stake-claim-nullifier revert as a §5 "cross-track carry" / dependency across six sites. This conflated a daemon implementation detail with wallet work. The wallet does no reversal: §5.2 rebuilds claimed_epochs forward from the canonical post-reorg chain (derive-don't-accumulate, the same pattern as CURVE_TREE_CLIENT.md's from_blocks). Its reliance on the daemon having reverted the nullifier set is baseline daemon correctness — identical to the spend path's reliance on spent-key-image revert when a spend is reorged-then-respent — so it is not a stake-specific dependency at all, and the daemon's pop_block mechanism (CONFIDENTIAL_STAKING.md §11; inherited-architecture consensus code) is not the wallet's to track. Edits: §10.1 box rewritten to "forward-rebuild only, no reversal work"; §5.2 closing note collapsed to the key-image-parity statement; §9 Round-2 cell + §3 Round-3 row de-special-cased; §8.0 note trimmed to the minimal "part of this gate, not separate"; §7.4 T6/G7 reframed as wallet-side forward-rebuild properties ("does claimed_epochs recompute correctly from the post-reorg chain?") and the nullifier-revert removed from the cross-track-deps list. Kept: the rejected-incremental-reversal decision record (§5.2). No wallet design change; no disposition reversal — §5 wallet design remains signed off. (2A is confirmed not the owner: PHASE_2A_SEND_PATH.md §3.0.4 defers reorg/tree handling to the curve-tree-client phase.)
• engine: seven-lens conformance pass on PersistenceEngine / PendingTxEngine / KeyEngine trait surfaces. Documentation-only rustdoc work bringing the three trait files to the LedgerEngine/DaemonEngine bar per docs/V3_ENGINE_TRAIT_CONFORMANCE_LENSES.md. No signatures, behavior, or implementor changes; no #[allow] scope change beyond adding per-attribute reasons.
  • persistence.rs: added the CL-1 owns-vs-deliberately-off-trait framing (§2.6; hydration open/create stays on Engine per Q9.11), the CL-2 # Supertrait bounds section (Send + Sync + 'static driven from the sync lifecycle via drive_persistence, shared by Arc; not Clone — single-owner artifact + advisory lock), the full CL-5 # Stage-4 swap-in section, the CL-4 C/I/P triad on all six methods (including a new save_prefs body), and per-attribute CL-6 #[allow(dead_code)] reasons on base_path/network/capability. save_prefs is documented as not panicking on mutex poisoning — verified against the implementor, which routes through shekyl_engine_prefs::save_prefs and never acquires the WalletFile mutex.
  • pending_tx.rs: added the CL-4 C/I/P triad to build/submit/discard/signal_mempool_evicted and # Panics to outstanding, plus a module-level note on the deliberate poison-handling asymmetry (mutators map Mutex poisoning to a domain error; outstanding panics on it).
  • key.rs: added # Panics to all four methods (account_public_address lockless; derive_subaddress / try_claim_output RwLock-poison; sign_transaction M3a stub does not panic), reconciled sign_transaction's # Cancellation from b to a to match the §4 table (with a PR-5 reversion-clause forward note), and rewrote the stale # M3a transitional bridge section (which referenced the removed TxInputSigningContext::source_secrets field) to state the M3a stub reality.
  • Reconciled docs/V3_ENGINE_TRAIT_BOUNDARIES.md §4: discard async → sync (cancel b → n/a, idempotency yes → no), added the missing signal_mempool_evicted row, and appended the PR-5 forward trigger to the sign_transaction cancel cell. Flipped the docs/V3_ENGINE_TRAIT_CONFORMANCE_LENSES.md §2 scorecard (the three surfaces → conformant) with past-tensed footnotes, and tracked the deferred CL-7 forward-compat audit of the off-trait value/error types in docs/FOLLOWUPS.md (V3.0).
• Codify the seven engine-trait conformance lenses. Added docs/V3_ENGINE_TRAIT_CONFORMANCE_LENSES.md, which enumerates the documentation-as-contract discipline previously implicit in the LedgerEngine / DaemonEngine reference surfaces and scattered across V3_ENGINE_TRAIT_BOUNDARIES.md §§1.4–1.6: CL-1 ownership boundary, CL-2 supertrait bounds, CL-3 error landing pad, CL-4 per-method C/I/P triad (= §1.6's documentation discipline), CL-5 Stage-4 swap-in invariance, CL-6 justified #[allow(dead_code)], CL-7 value/error-type forward-compat. The doc disambiguates these conformance lenses (trait documentation) from §8.3.1's design lenses (trait shape), carries a current-dev conformance scorecard for all seven traits, and pins the add/remove-a-lens discipline per 21-reversion-clause-discipline.mdc. Cross-referenced from V3_ENGINE_TRAIT_BOUNDARIES.md §1.6 and hooked into the per-trait PR pre-flight via STAGE_1_PER_PR_TEMPLATE.md §3.6. Documentation-only; no code or behavior change.
• Inter-stage cleanup: tech-debt tracker consolidation + stale-ref fixes. Post-P2 audit of Stage 1 (trait-extraction) closure. (1) Consolidated open structural-debt tracking into a single file: the three orphan MSVC/Windows build items (libunbound stub, vendored-code warnings, vcpkg manifest-mode) moved from docs/STRUCTURAL_TODO.md into docs/FOLLOWUPS.md §"V3.2 — Rust cutover and cleanup"; STRUCTURAL_TODO.md repurposed as a structural-reference / reviewer-rubric doc (retains the 32-bit "bit-width carve-out" security argument and migration-on-touch rubric that other docs/code cite as canonical), not an open-todo list. Inbound refs in rust/shekyl-logging/src/legacy.rs and .cursor/rules/93-legacy-symbol-migration.mdc retargeted to FOLLOWUPS.md. (2) Fixed stale scan_range_start / effective_floor_at_tip references in FOLLOWUPS.md and STAGE_1_PR_4_REFRESH_ENGINE.md (helpers removed in the P2 TOCTOU fix, commit 87264a3a2; the producer now derives its scan start from the anchored snapshot). (3) Added a dated closure checkpoint to docs/completed/STAGE_1_COMPLETION_AUDIT.md recording P1/P2/P3 closure and confirming C2c economics cutover remains the sole open V3.0 economics item (standalone 7-cutover PR per STAGE_1_PR_7_ECONOMICS_ENGINE.md §6.2, not eligible for chore bundling). Docs-only; no code or consensus changes.

Changed

• Refresh: wallet-birthday scan floor (P2). LocalRefresh carries scan_start_floor from sync_state.restore_from_height and session skip_to_height / refresh_from_block_height overrides. Refresh preflight anchors the ledger at floor - 1 when needed so the merge gate stays start == synced_height + 1; the producer scans from the floor through tip. Engine::create persists restore_height_hint into sync_state.restore_from_height.

• Workspace MSRV raised 1.85 → 1.88; kameo = "=0.20.0" pinned (Stage 2 gate). Satisfies the three preconditions in the docs/FOLLOWUPS.md "kameo dependency pin and MSRV alignment before Stage 2 cuts" entry: (1) exact-patch pin of the actor framework in [workspace.dependencies] (declared-only; no consumer yet, so inert in the build graph), (2) MSRV bump to kameo 0.20.0's required 1.88.0 (verified at source via the crates.io index), propagated per-crate via rust-version.workspace = true across all first-party members so the gate is enforced workspace-wide rather than declared only on the virtual root, and (3) the workspace bounded-mailbox default (mailbox(64), overrides documented at the actor site). No rust-toolchain.toml added — CI builds on @stable (≥ 1.88); the gate's intent is the MSRV declaration, not a pinned channel. Stage 2's first commit adds the live consumer and closes the FOLLOWUP.

• Stage 1 PR 6 — PersistenceEngine C7: remove password save_state. WalletFile::save_state now takes session-cached wrap_key_region_2 only; password-taking steady-state save deleted. shekyl_wallet_save_state FFI drops the password parameters. Design: docs/design/STAGE_1_PR_6_PERSISTENCE_ENGINE.md.

• Wallet file format v1: per-region HKDF wrap keys (spec + implementation). docs/WALLET_FILE_FORMAT_V1.md §2.6 prescribes wrap_key_region_1 (label-only HKDF) and wrap_key_region_2 (info || addr) via HKDF-SHA-256 Expand from CSPRNG file_kek, replacing direct file_kek AEAD for regions 1 and 2. On-disk layout and file_version unchanged; Tier-3 KAT fixtures regenerated. See docs/design/WALLET_FILE_FORMAT_V1_HKDF_REGION_DERIVATION.md.

Documentation

• Stage 1 PR 6 — external lessons canvass (§5.12). docs/design/STAGE_1_PR_6_PERSISTENCE_ENGINE.md records historical wallet-disaster lessons, OS discipline for F5(b), Stage 4 actor-model pins (bounded mailbox, save coalescing, supervisor stop), and substrate verification (KDF params in wrap AAD; HKDF address = 65-byte classical address). Blocking PR 6: panic-hook redaction test, mlock honest contract, region-2 OsRng nonce rustdoc. V3.1/V3.x items in docs/FOLLOWUPS.md.

• Stage 0 PR-A — iai-callgrind symmetry rule (3d313256c). Backfill. docs/design/STAGE_0_HARNESS.md §4.2 codifies the symmetry rule (setup and fixture teardown excluded from the measured region; criterion amortizes Drop via b.iter, iai-callgrind does not) and adds Finding 5 to the §4.4 gap-check inventory. Closes the Drop-contamination capture (synced_height reported 60,033 instructions vs the expected low-tens, a property-preservation gap), class-level across every engine_trait_bench_* bench.

• Stage 0 PR-A-extension — iai-callgrind boundary rule (2e5309ad3). Backfill. docs/design/STAGE_0_HARNESS.md §4.2 adds the boundary rule (iai-callgrind measures function-boundary value movement; Engine<SoloSigner> is 6,296 bytes, so by-value fixture passing cost ~600 instructions of memcpy) and the §4.4 unified (Box<Engine<S>>, TempDir) component-model fixture shape. Closes the memcpy-at-boundary finding.

• Stage 0 PR-C — iai-callgrind hoisting rule (93d515123). Backfill. docs/design/STAGE_0_HARNESS.md §4.2 adds the hoisting rule (criterion-side b.iter iter-amortization can elide state-dependent compute the author meant to count) and the §4.4 two-anchor static check (predict criterion median_ns from iai instructions by workload class). Closes Finding 7 (criterion-vs-iai workload-class disagreement), completing the symmetry/boundary/hoisting rule-triple.

Added

• Stage 1 PR 6 — PersistenceEngine Phase 0–2c (trait surface + file layer). docs/V3_ENGINE_TRAIT_BOUNDARIES.md §2.6 amends steady-state save_state / save_prefs to F5(b) sealing keys; shekyl-engine-core adds PersistenceError, OpenError::Persistence, ChangePasswordError, StateWrapKey, and the PersistenceEngine trait module; shekyl-crypto-pq adds seal_state_file_with_wrap_key_region_2; shekyl-engine-file adds Mutex<WalletFileState>, rotate_password on &self, additive save_state_with_wrap_key_region_2, and base_path(). WalletFile trait impl and Engine<F> wiring follow in C3–C5. Design: docs/design/STAGE_1_PR_6_PERSISTENCE_ENGINE.md.

• RandomX v2 Track A Phase 2h adversarial-corpus methodology landed (feat/randomx-v2-phase2h-impl, target PR; commits C1–C10 per docs/completed/RANDOMX_V2_PHASE2H_PLAN.md §8). Closes the Phase 2g R7-D1/R7-D2/R7-D3/R7-D4 deferrals by replacing the V1-shaped class-heaviness grinding methodology (unreachable under V2's PROGRAM_SIZE = 384 σ-gaps) with the V2-substrate-anchored recipe-based corpus per R1-D1's three-category composition (Category 1 audit-anchored spec-silence enumeration; Category 2 coverage-metric attestation; Category 3 substrate-derived boundary values). The methodology ships first-class evaluator + declarative recipe DSL + canonical-output pinning + per-PR M5 mechanical citation-validation. T2/T6 originally inherited the Phase 2g runtime-test #[ignore] gating behind the (then-open) universal-across-inputs compute_hash divergence FOLLOWUP; that FOLLOWUP closed on dev via PR #79 (989610cac, 2026-05-26; root cause: RANDOMX_FLAG_V2 missing at randomx_create_vm), and the post-rebase substrate-close commits in this PR (see C11 below) lift the FOLLOWUP-gated attributes and workflow conditions.

  • C1 canonical-output substrate + Pass-3 measurement constants. New rust/shekyl-randomx-differential/src/adversarial_canonical_outputs.rs lands the M1 canonical-output discipline for adversarial recipes plus the Pass-3 measurement-bundle constants (RUNNER_NOISE_MARGIN, per-class regression threshold, SAMPLE_BUDGET_PER_RECIPE). The Family-1 array (FAMILY_1_RECIPE_OUTPUTS) is regenerated at C5 alongside the recipe-corpus expansion and pinned via gen_canonical_outputs.rs Family-1 branch.

  • C2 PreparedCache::from_raw_for_testing accessor. The R1-D2 close cache-level test-internals accessor lands on rust/shekyl-pow-randomx/src/prepared_cache.rs under the existing test-internals feature gate (R5-D1 carve-out shape; sole consumer is shekyl-randomx-differential). C-side symmetry via the pre-existing randomx_get_cache_memory extraction path keeps the production surface unchanged. A round-trip test asserts that from_raw_for_testing(seedhash, bytes) of a fresh derive output's bytes reproduces the same PreparedCache (cache-bytes byte-identical; superscalar programs re-derived from the seedhash).

  • C3 recipe types + first-class evaluator. New rust/shekyl-randomx-differential/src/adversarial/ module landing types.rs (BaseSeedhash, CacheRecipe, EvaluatedRecipe), interpreter.rs (declarative recipe → (seedhash, cache_bytes) evaluator with C-side base-cache derivation amortization), canonical.rs (base-cache bytes derivation helpers), and the recipes/ submodule scaffold (spec_silence_anchors.rs, coverage_targets.rs, boundary_values.rs, dataset_item_extrema.rs) per R1-D3 close.

  • C4 initial recipe corpus (8 recipes; Cat 1 + 3). The starter corpus lands with two Category 1 spec-silence anchors (u128-high-half-cache-word-0, shift-mask-boundary-cache-word-1), three Category 3 boundary-value recipes (boundary-cache-first-byte, boundary-cache-last-byte, boundary-dataset-item-stride-first-edge), and three Category 3 dataset-item-extrema recipes (boundary-block-stride-second-block-base, boundary-block-stride-first-block-tail, boundary-line-stride-within-block). Each recipe's rationale field cites the specific V2 substrate (plan-doc section, configuration constant, or cache-implementation line range) per R1-D8's three-evidence-category structure. Coverage-targets module ships empty per R1-D1's coverage-tooling-reproducibility reopen criterion.

  • C5 FAMILY_1_RECIPE_OUTPUTS + Family-1 generator branch. The canonical-output array is regenerated alongside the C4 recipe expansion via the gen_canonical_outputs.rs Family-1 generator branch; each entry pins the expected (seedhash, hash) against the C reference per M1 canonical-output discipline.

  • C6 mode_adversarial_ratio binary mode. New rust/shekyl-randomx-differential/src/mode_adversarial_ratio.rs implements the worst-case-ratio measurement mode replacing the §3.19 R7-D4 diagnostic-only branch at main.rs's --mode=adversarial-ratio dispatch (renamed from --mode=worst-case per the methodology shift). Measures Rust-to-C latency ratios over the recipe corpus against R1-D6's Claim 1 (per-recipe bound) + Claim 2 (corpus-median regression-tracking signal); emits structured T6_OBSERVATION / T6_CLAIM_2_TRACKING JSON for the regression-tracking dashboard harvester.

  • C7 T2 + T6 reactivation with inherited deferral gating. Phase 2g §6 T2 (adversarial_corpus_byte_equality) and T6 (worst_case_ratio) reactivate as new integration tests under rust/shekyl-randomx-differential/tests/. T2 asserts byte-equality between Rust and C across the recipe corpus; T6 invokes mode_adversarial_ratio and enforces Claim 1 + emits Claim 2 tracking signals. C7 cross-input diagnostics revealed that the Phase 2g compute_hash FOLLOWUP's "large data sizes" framing was incomplete — the divergence surfaces universally across all tested seedhashes and data inputs, including 32-byte fixed inputs. T2/T6 inherit the same #[ignore] deferral as the Phase 2g runtime tests (T1/T3/T5/T7/T8/T16); the FOLLOWUPS amendment records the revised characterization.

  • C8 CI workflow wiring (per-PR T2 + workflow_dispatch T6). .github/workflows/randomx-v2-differential.yml gains a per-PR cargo test --ignored T2 step gated behind if: false until the divergence FOLLOWUP closes. New .github/workflows/randomx-v2-adversarial-ratio.yml workflow_dispatch-only T6 workflow scaffolds the activation surface for measurement-mode runs (heavy enough to warrant a separate workflow gate per R1-D7 Sub-A close); same if: false gating mechanism. The activation surface is one-line workflow edits + one-line test-attribute edits when the FOLLOWUP closes.

  • C9 M5 mechanical citation-validation script. New scripts/ci/check_phase2h_citations.sh implements R2-D4's mechanical citation validation: parses recipe rationale fields and validates per-category prefix (R1-D8 taxonomy invariant), cited plan-doc existence under docs/design/, cited source-file existence under rust/shekyl-pow-randomx/src/ (for *.rs) or external/randomx-v2/src/ (for *.{c,cpp,h,hpp}), and cited line-number validity against the file's actual line count. Composes with M3 PR-template discipline (the procedural ceiling for semantic verification) per the T-A15 mitigation chain. Wired into the per-PR structural-validate job as a fifth gate step. Sub-second runtime on the C4 starter corpus (8 recipes); scales through R1-D1's 50–200 target.

  • FOLLOWUPS reflow. The "Post-2g adversarial-corpus methodology + implementation" entry is annotated as closed by Phase 2h with cross-citations to C1–C9; the "Investigate shekyl-pow-randomx::compute_hash divergence" entry is amended to record the Phase 2h cross-input findings (universal-across-inputs scope correction; the 192-byte t16 vector continues to pass only because it pins the seedhash + input combination at the known-good point). Both edits land in C10.

  • C11 post-rebase substrate-close (V3.0 verifier-divergence FOLLOWUP closed by PR #79; this PR carries the operational close). PR #79 (989610cac, 2026-05-26) closed the V3.0 shekyl-pow-randomx::compute_hash-divergence-from-C-reference FOLLOWUP by passing RANDOMX_FLAG_V2 at randomx_create_vm in COracleSession::new. Following PR #79's merge, this PR rebased onto the post-#79 dev and landed four commits discharging the activation-surface contract that C7/C8 established:

    1. c71ce2413 — RANDOMX_FLAG_V2 extension to COracleSession::from_raw_for_testing + T17 round-trip backstop. Mirrors PR #79's fix at the testing constructor so substrate-overwrite-based session creation (the path T2/T6 exercise) is flag-equivalent to Self::new. New rust/shekyl-randomx-differential/tests/c_oracle_session_round_trip.rs (T17) asserts cache-byte SHA + hash parity between the two constructors for a fixed (seedhash, payload) pair; bracket-tested by temporary V1 revert to confirm it catches flag drift.
    2. 6fc059e1e — lift T2 #[ignore] + workflow if: false gating. Removes the #[ignore] attribute on t2_adversarial_corpus_byte_equality; rewrites the test module's "C7 close" docstring as past-tense "Active per-PR cadence (post-PR-#79 closure)" naming the substrate-anchored reopening criterion per 21-reversion-clause-discipline.mdc; preserves the R1-D6 close Reframe 1 substrate-broken vs ignore-ladder distinction as the discipline's authoritative instance. The randomx-v2-differential.yml workflow's if: false gate on the dedicated T2 step is lifted; the preceding default cargo test step gains -- --skip t2_adversarial_corpus_byte_equality so T2 runs exactly once per CI invocation (release-mode via the dedicated step) within R1-D6 close Reframe 2's T2_PER_PR_BUDGET_MS budget.
    3. 1b1bda7df — lift T6 workflow if: false gating + reframe T6 docs. Rewrites the worst_case_ratio module rustdoc's "C7 close" section as past-tense "Post-PR-#79 substrate note (FOLLOWUP closed)" and lifts the randomx-v2-adversarial-ratio.yml workflow step's if: false gate. T6 itself retains its test-layer #[ignore] attribute for runtime-cost reasons orthogonal to the FOLLOWUP (~40 s per recipe, outside per-PR cadence per R1-D6 close Reframe 2); the inline comment and step body record that the --ignored flag persists on this basis. workflow_dispatch cadence is unchanged.
    4. 72a4a9eed — reframe T16 docs as regression guard. Rewrites divergence_triage module rustdoc from past-tense D1 substrate-triage investigation tool to forward-tense three-way (Rust ↔ C ↔ fixture) byte-equality regression guard at the canonical input. Preserves the D1 historical context (the three-hypothesis enumeration, outcome (A) confirmation, D2 → PR #79 diagnostic terminus); cites the substrate-anchored reopening criterion; cross-references T17 as the lighter-weight per-PR-cadence backstop. T16 stays #[ignore]-gated for runtime-cost reasons (256-MiB Argon2d-512 cache + ~10–30 s wall); #[ignore] reason text updated to surface the runtime-cost-only basis.

• RandomX v2 Track A Phase 2g differential-test harness landed (feat/randomx-v2-phase2g-impl, PR #75, merge commit 33d22a83b, 2026-05-25). Final sub-PR of the Rust pure-software RandomX v2 verifier port per docs/design/RANDOMX_V2_PLAN.md §"Track A — Phase 2" and the design plan docs/completed/RANDOMX_V2_PHASE2G_PLAN.md. Stack landed across the planned C0–C10 work commits plus follow-ups (two Copilot review rounds, two mechanical rustfmt absorptions, the R5-D2 plan-doc soft-fail refinement, and the R7 adversarial-corpus deferral cluster) landing a separate test-only artifact (rust/shekyl-randomx-differential) that links the Rust verifier (shekyl-pow-randomx) and the v2 fork's C reference (via the new rust/randomx-v2-sys bindings crate) and asserts byte equality across a corpus of (seedhash, data) inputs per Phase 0 §7's differential-harness-as-separate-artifact discipline (no dev-dependency edge from shekyl-pow-randomx; the verifier crate's cargo test still succeeds without the C library present). Preceded by the R5-D1 substrate-amendment PR #74 (merge 93d1155bb) that landed the test-internals feature gate on shekyl-pow-randomx exposing PreparedCache::cache_block_bytes_for_testing (gated by cfg(feature = "test-internals")), resolving the contradiction between R1-D14's cache-equivalence precondition requiring byte-level access to the Rust cache and §5.3.1's "zero new production surfaces" disposition. The feature is enabled exclusively by the harness crate; production builds see no new surface.

  • Workspace deps + randomx-v2-sys skeleton + CMake gate (commits 8d8d4a109, 013984118, e8d2eaccf, 8b67d7775, e8dec6278, 432162ddb; C0–C4). New rust/randomx-v2-sys crate is the sole consumer of the v2 fork's C ABI per §5.3 R1-D14; its build.rs resolves RANDOMX_V2_INSTALL_DIR (preferred) or falls back to the in-tree install layout under <build-dir>/external/randomx-v2-install per the R5-D2-refined R4-D3 soft-fail discipline (commit 429044cf8's plan-doc refinement landed the soft-fail-on-missing-library framing before C3's implementation). The harness crate rust/shekyl-randomx-differential is a bin with hand-rolled argument parsing (no clap dependency) and dispatches --mode=correctness, --mode=latency, --mode=concurrent, plus a deferred --mode=worst-case that exits with an informative diagnostic pointing at the post-2g design round per §3.19 R7-D4. CMakeLists.txt gains the BUILD_RANDOMX_V2_DIFFERENTIAL_HARNESS option (default OFF; flipped ON in CI) per Phase 0's miner-only-build-flag pattern.

  • C5a corpus + canonical outputs (R6 cluster) (5e00f457e, 12884d945). corpus.rs builds the random (seedhash, data) corpus with a bimodal block-template-shaped [200 .. 600·1024) byte distribution per §3.16, and canonical_outputs.rs carries 1024 pre-computed (seedhash, data) → hash canonicals generated against the pinned C reference at the workspace-pinned fork SHA (per §5.4 R6 cluster's canonical-pinning discipline). The gen_canonical_outputs.rs tooling binary regenerates the canonicals as a separate operation outside the harness's runtime modes (skip-listed in .cargo/mutants.toml per cargo-mutants skip-list discipline).

  • R7 adversarial-corpus deferral (c41a6c7f8, 5598adea0). Plan-doc Round 7 reopens R1-D5 (adversarial seedhash corpus) and R1-D6 (u128/__int128_t edge-case data corpus) under two independent substrate findings: (i) the verifier-accessor gap (the class-heaviness grinding methodology requires a test-internals-gated opcode-stream accessor whose implementation would duplicate compute_hash_inner under a feature gate); (ii) the statistical-infeasibility gap (R1-D5's ≥40% per-class / ≥60% combined acceptance criteria were calibrated against V1's PROGRAM_SIZE = 256 and are unreachable by random grinding against V2's PROGRAM_SIZE = 384 with per-class σ-gaps from 6.8 (CACHE_MISS) to ~125 (CFROUND); fewer than 10⁻⁸ threshold-meeting candidates expected within any realistic compute budget). R7-D3 defers R1-D8 (worst-case timing test T6) by the same reasoning; R7-D4 routes the deferred work to the post-2g design round; R7-D5 carries the §6 T2 deferral. The post-2g round is queued in docs/FOLLOWUPS.md (V3.0 pre-genesis queue) as "Post-2g adversarial-corpus methodology + implementation."

  • Cache-precondition + Rust/C oracle wrappers (558eba59a). cache_precondition.rs derives the Rust and C caches from the same seedhash, compares them block-by-block via the test-internals-gated cache_block_bytes_for_testing accessor, and emits an O(1)-block divergence window when they differ (window construction refactored under Copilot Round 2 below from the naïve O(N) re-iteration to the streaming form). rust_subject.rs wraps shekyl-pow-randomx's PreparedCache + compute_hash surface; c_oracle.rs wraps randomx-v2-sys's randomx_alloc_cache / randomx_init_cache / randomx_create_vm / randomx_calculate_hash lifecycle. The C oracle is !Send + !Sync (the C library's VM holds a per-thread JIT page); the harness pre-computes C-side reference hashes single-threadedly before spawning workers.

  • Correctness + latency + concurrent modes (71f5077d2, f25e6356f). mode_correctness walks the random corpus + canonical-output corpus, asserting Rust hash = C hash = canonical hash at every entry. mode_latency benchmarks per-hash latency over the random corpus, reporting median/p95/max in (Rust, C) pairs with upper-median statistic for even-length samples (matching standard benchmark convention; doc-comment corrected under Copilot Round 2). mode_concurrent orchestrates multi-worker correctness assertion plus Linux-specific RSS-ceiling enforcement via /proc/self/statm sampling (RSS_CEILING_BYTES, RSS_TOLERANCE, RSS_SAMPLE_INTERVAL, RSS_STEADY_STATE_WARMUP_HASHES constants documented inline); the smoke test surfaced the known V3.0 compute_hash divergence at large data inputs per docs/FOLLOWUPS.md's V3.0 pre-genesis queue, which validates the harness's detection capability rather than indicating a Phase 2g regression.

  • Failure output schema + invocation banner (cadacf7a3, b63cd2592). failure_output.rs defines the 11-field structured-JSON failure schema (M4/T11) emitted to stderr on Rust vs. C divergence; the schema carries mode, seedhash, data_sha256, rust_hash, c_hash, canonical_hash (optional), rust_subject_version, c_oracle_version, fork_pin_sha, timestamp, plus the divergence-window blob from cache_precondition.rs when relevant. invocation_banner.rs emits the M4/T17 banner to stderr before any test output, recording mode, corpus sizes, seedhash count, fork pin, and the test-internals feature- gate citation as the harness's authority-claim line. The rustfmt drift commit b63cd2592 absorbed mechanical formatting changes from C8 to keep the C9 commit scope-clean.

  • CI wiring + crate-invariant extension + mutants + PR template (dd984d115). New .github/workflows/randomx-v2-differential.yml runs the structural-validate job per-PR (build cleanliness, unit/integration tests, invariant-script coverage, cargo fmt + clippy) and the mutants job on a staggered weekly cron; runtime modes (correctness, latency, concurrent end-to-end) are deferred behind continue-on-error: true with a comment pointing at the docs/FOLLOWUPS.md V3.0 compute_hash divergence entry, and become merge-blocking once that V3.0 work lands. The workflow builds the C reference library out-of-band by invoking the submodule's own CMakeLists.txt (external/randomx-v2) directly with Ninja + ccache; this avoids pulling the parent project's C++ dependencies into the harness build path. .github/workflows/build.yml and .github/workflows/codeql.yml gain --exclude shekyl-randomx-differential on their workspace cargo build / cargo test invocations so the daemon CI matrix does not link against the C library it does not need; build.yml's lint-rust-debug-macros step gains a */src/bin/* exclusion so gen_canonical_outputs.rs's println! (legitimate CLI output) is not flagged. scripts/ci/check_randomx_crate_invariants.sh is extended to scan randomx-v2-sys and shekyl-randomx-differential for Pattern A (OnceCell/OnceLock/Lazy imports) and Pattern B (column-0 static declarations); shekyl-randomx-differential is also scanned for Pattern C (FFI exports), while randomx-v2-sys is exempt from Pattern C (it is the FFI consumer crate). New rust/shekyl-randomx-differential/tests/crate_invariants.rs integration tests T13 (script coverage), T14 (randomx-v2-sys sole-consumer property — verified by walking cargo metadata to confirm no other workspace member depends on randomx-v2-sys), and T15 (randomx-v2-sys signature-audit pin — matches the bindings file's fork-pin SHA against the submodule HEAD at external/randomx-v2). New .cargo/mutants.toml configures cargo-mutants with timeout_multiplier = 5.0 and skip-globs for tooling binaries (src/bin/**) and canonical outputs (canonical_outputs.rs) per the skip-list discipline. New .github/pull_request_template.md carries the three-line discipline checklist for harness / verifier modifications (amendment-cite, audit-line-range cite, harness-pass-as-evidence with audit co-citation).

  • Copilot Round 1 — inline review responses (3ac2d777f). Four findings against the implementation diff: (1) build.rs warning message uses <build-dir>/external/randomx-v2-install as the documented fallback path string; (2) RANDOMX_V2_PHASE2G_PLAN.md §3992's embedded build.rs example matches the live wording; (3) the randomx-v2-sys bindings file gains the fork-pin signature comment with the exact submodule SHA for T15 to assert against; (4) cross-citation provenance lines for cache-precondition and Rust/C oracle hand-off discipline.

  • Copilot Round 2 — post-implementation findings (d60186fa9, 90a536219). Five substantive findings: (1) parse_seedhash_hex now explicitly rejects uppercase A–F with a load-bearing diagnostic (--seedhash: character {i}: uppercase hex rejected; use lowercase per Seedhash::Display), pinning the lowercase convention shared with the verifier's Seedhash::Display via a new parse_seedhash_hex_rejects_uppercase regression test; (2) mode_latency::median_p95_max's doc-comment now states samples[n/2] is the upper-median for even-length samples (the prior wording said "lower median" but the implementation has always been upper-median; fixing the doc rather than the code preserves existing test expectations); (3) RustSubjectSession::seedhash's doc-comment recommends *session.seedhash() (the idiomatic deref for a Copy type) over .clone(); (4) failure_output::timestamp_increases_across_constructions is replaced by timestamp_is_nonzero_and_recent, which asserts the timestamp is non-zero and within a plausible epoch window (post-2020 / pre-2200) instead of relying on SystemTime::now() monotonicity through a thread::sleep(1s) (the prior test was flaky under clock adjustments); (5) cache_precondition::build_divergence_window is refactored from O(N) re-iteration of the cache block stream to O(1)-block streaming construction by passing the current_block, buffering the prev_block, and accepting the remainder_iter as a mutable iterator — the doc-comment claim ("at-most-two 1-KiB blocks") was true of the window contents but not of the cost to construct it, and the refactor brings cost in line with the doc with four new unit tests covering interior, crosses-backwards, crosses-forwards, and at-cache-start windows. Stale README + canonical_outputs.rs doc-comments that referenced C5b / C6 boundaries and a placeholder error (pre-R7-D4 framing) are updated to reflect the post-2g deferral and the completed C4–C10 sequence.

  §9 / Phase 2g gate confirmation (HEAD at PR #75 merge = 33d22a83b): Format cargo fmt --all -- --check ✓; Lint cargo clippy -p shekyl-randomx-differential -p randomx-v2-sys --all-targets -- -D warnings ✓; Test cargo test -p shekyl-randomx-differential -p randomx-v2-sys --release ✓ (unit + integration including T13/T14/T15); Crate-invariant gate scripts/ci/check_randomx_crate_invariants.sh ✓ (extended scan scope across shekyl-pow-randomx, randomx-v2-sys, shekyl-randomx-differential); FPU unsafe grep scripts/ci/check_randomx_fpu_rounding.sh ✓ (inherited from 2d); workspace test cargo test --workspace --exclude shekyl-randomx-differential ✓ on the daemon CI matrix (the harness crate's tests are exercised on the randomx-v2-differential.yml matrix that has the C library available). Four substantive Copilot review threads on PR #75 resolved with provenance citations to the commits that addressed each finding; 14 outdated threads were auto-greyed by GitHub as the surrounding code shifted.

  Deferrals named, with reopening criteria per 21-reversion-clause-discipline.mdc:

  • mode_worst_case + adversarial-corpus methodology (R7-D1/R7-D2/R7-D3/R7-D4). Deferred to a post-2g design round; tracked in docs/FOLLOWUPS.md V3.0 pre-genesis queue. Reopens via the design round's plan-doc landing (the methodology must be V2-substrate-anchored; class- heaviness grinding is V1-shaped and statistically infeasible against V2 substrate). Phase 2g's --mode=worst-case flag is reachable but emits the deferral diagnostic referencing the FOLLOWUPS entry.
  • compute_hash divergence at large data inputs. Surfaced by Phase 2g C7's first end-to-end smoke test against a 387,581-byte data input in R1-D4's bimodal upper-half distribution; cache-equivalence precondition passes (caches byte-identical); divergence is in compute_hash's VM path. Closed 2026-05-26 by substrate-triage on chore/randomx-v2-c-oracle-flag-v2 — root cause was the harness's C oracle and canonical-output generator both passing RANDOMX_FLAG_DEFAULT (v1, PROGRAM_SIZE = 256) to randomx_create_vm against a Rust verifier implementing v2 (PROGRAM_SIZE = 384). The Rust verifier was correct throughout. Fix: expose RANDOMX_FLAG_V2 = 128 in randomx-v2-sys with cache- vs-VM flag-split docs (cache memory is V2-flag-invariant per external/randomx-v2/src/randomx.cpp:79's (JIT | LARGE_PAGES) mask at randomx_alloc_cache; only randomx_create_vm honors the V2 bit); switch the two callsites at c_oracle.rs + gen_canonical_outputs.rs; regenerate CANONICAL_RANDOM_HASHES under the v2 flag (v1-c5a-nightly-1024 → v2-flag-nightly-1024; CANONICAL_CACHE_SHAS unchanged, as predicted by the mask). End-to-end --mode=correctness re-runs the nightly corpus (1024 random pairs / 32 seedhashes) with three-way agreement (Rust ≡ C ≡ canonical, exit 0). Full closure record + lessons-into-substrate dispositions in docs/FOLLOWUPS.md "Recently resolved (audit trail)" section; post-mortem with the missed-altitude finding in docs/completed/RANDOMX_V2_PHASE2G_PLAN.md. The harness's detection of this divergence (and the diagnostic-triage test that bisected it) is end-to-end validation of its M4 detection capability against a real substrate gap.
  • Per-hash latency CI gate (≤3.0× ratio). Phase 2g produces the harness binary that the Phase 3a per-PR CI mechanism (RANDOMX_V2_RUST.md §8) consumes; the gate activates when Phase 3a's FFI shim lands. Phase 2g itself runs mode_latency informationally, not as a CI gate.

• RandomX v2 Track A Phase 2f implementation core landed (feat/randomx-v2-phase2f-impl, 2026-05-23). Implements docs/completed/RANDOMX_V2_PHASE2F_PLAN.md Round 2 + Round 3 dispositions on rust/shekyl-pow-randomx in five commits versus the §8 Round 3 ceiling of six (commit 5 omitted per Branch A — see prediction-vs-measured reconciliation below).

  • Seedhash newtype + PreparedCache bundle (e687cf68b). Closes the Phase 2c-inherited consensus-correctness footgun where compute_hash(&Cache, &[u8; 32], &[u8]) carried the cache and the seedhash as separate arguments — a caller passing the wrong cache for a given seedhash got a wrong hash. New src/seedhash.rs introduces pub struct Seedhash([u8; 32]) with from_bytes / as_bytes / Display (lowercase hex per §1.1 Round 2 + post-closure pin #1) replacing every &[u8; 32] seedhash parameter site. New src/prepared_cache.rs bundles Cache + Seedhash with PreparedCache::derive as the single public construction path; Cache transitions pub → pub(crate) per §1.1 Round 2. compute_hash signature transitions from (&Cache, &[u8; 32], &[u8]) to (&PreparedCache, &[u8]). Atomic codebase sweep updates every in-crate call site (Phase 2c/2d tests, vm.rs tests, cache.rs tests, benches) per §3.1 Round 2 sweep-discipline. Per 16-architectural-inheritance.mdc's pre-genesis discount

    • cost-benefit-defer-to-later anti-pattern, the substrate correction lands at Phase 2F rather than V3.x.

  • CacheStore two-slot type (31aa0ff9d). New src/cache_store.rs implements §3.1 Round 2's frozen API: lookup, lookup_or_derive, set_canonical. Internal sync-shape per §3.1 Round 2: per-slot RwLock<Option<Arc<PreparedCache>>> (canonical non-evictable + transient displace-on-publish), Mutex<HashMap<Seedhash, Shared<DerivationFuture>>> for in-flight derivation deduplication with cleanup-on-publish per §3.1 Round 2 (closes F3 thundering-herd attack on novel-seedhash + F4 unbounded HashMap growth). Eleven unit tests T-CS-1 through T-CS-11 per §6.1 Round 3 cover the state-transition table (3-seedhash interleave attack; cold-start; advance-promotes-and-demotes), in-flight dedup (T-CS-7), cleanup-on-publish white-box (T-CS-8), concurrent-determinism property (T-CS-9), and type-shape compile-time checks (T-CS-10/11). Caller hand-off Arc-lifetime discipline note in the rustdoc per §4 F2 disposition.

  • Crate-invariant grep gate (68086d99c). New scripts/ci/check_randomx_crate_invariants.sh enforces §3.6 R1-E1 patterns A/B/C: pattern A bans imports of once_cell / lazy_static / OnceLock / LazyLock (stricter than module-level-static-only by rejecting at the import); pattern B bans column-0 static declarations (function-local statics live inside fn bodies and are indented; const items are a different keyword); pattern C bans #[no_mangle], #[unsafe(no_mangle)], #[export_name, #[unsafe(export_name, and extern "C" fn definition form anchored at column 0 modulo attribute indentation (so the lib.rs rustdoc citation of the discipline does not collide with the gate). The rustfmt-rely-chain note per §3.6 Round 3 records that the column-0 anchor is robust against function-local statics if and only if cargo fmt --check is a CI gate (which it is per Phase 2c R0-D6). New .github/workflows/build.yml step sibling to the FPU-rounding step. New tests/crate_invariants.rs cargo-test wrapper makes the gate runnable via cargo test for local pre-PR checks. Verification at HEAD: zero hits across rust/shekyl-pow-randomx/src/.

  • Cfg-gated VmStatePool + four-bench A/B harness (3121b726d). New src/vm_pool.rs gated by #[cfg(any(test, feature = "internal-pool-bench"))] per §3.3 Round 3. VmStatePool::new(capacity: usize) is a runtime parameter per §3.5 R1-D5 Round 3 (panics in non-test builds without the feature flag, enforcing explicit configuration); Mutex<Vec<VmState>> storage with capacity cap; acquire() returns a VmStateGuard whose Drop returns the instance to the pool if capacity allows. vm.rs factors compute_hash into a thin wrapper over pub(crate) compute_hash_inner(&mut VmState, ...) so the production no-pool path (VmState::new() per call) and the cfg-gated pool path share one implementation; compute_hash_inner zeros state.fprc on entry (the only VmState field with observable carry-over across pooled reuse, since CFROUND writes fprc during execute_program but does not reset it at boundaries). Seven unit tests T-PL-1 through T-PL-7 cover acquire/release, capacity bounds, and equivalence to the no-pool path. New benches/per_call_alloc.rs measures B-2 (scratchpad zero-init) + B-3 (register-file/program alloc); compute_hash_alloc.rs extends with B-pool-off (always on) + B-pool-on (under --features internal-pool-bench). The cfg-gated approach closes the Round 1 circular-sequencing problem ("can't bench the pool without implementing the pool").

  • Phase 2f A/B bench measurement — Branch A (a37aac054). BENCH_RESULTS.md records the §3.4 R1-D4 Round 3 disposition empirically: B-pool-off 304.44 ms median (CI [303.14, 305.96]), B-pool-on 303.72 ms median (CI [302.71, 304.88]), B-2 48.6 µs, B-3 81.7 ns. Component-floor sum (B-2 + B-3) ≈ 48.7 µs caps the achievable pool savings; the point-estimate A/B delta of 720 µs is statistically indistinguishable from zero (95% CIs overlap heavily) and structurally bounded above by the component-floor cap (so the 720 µs is run-to-run measurement noise, not pool benefit). Disposition: Branch A — achievable savings is below the §3.4 Round 3 50 µs threshold; pooling produces no production-relevant benefit on this hardware class. The cfg-gated VmStatePool stays in source as a bench-only artifact; §8 commit 5 (cfg-gate flip to default-on) is omitted. Phase 3a's FFI shim sees the unchanged production compute_hash body.

    Prediction-vs-measured reconciliation per §8 Round 3 discipline: prediction A held. The §8 plan-doc recorded two competing predictions (Branch C plausible per PR-66's hundreds-of-µs full-pipeline alloc cost; Branch A plausible per modern allocators amortizing 2 MiB zero-init to tens of µs). B-2 measured at 48.6 µs on this hardware (mmap-backed glibc on kernel 6.12, large-page-aware allocator) is consistent with the Branch A framing; PR-66's per-call full-pipeline cost (~300 ms) is dispatch-loop dominated (2048 iterations × 8 chains × per-iter AES + scratchpad RW + dataset reads), not allocation-specific. Pooling can amortize only allocation cost; the component-floor cap is structurally below Branch B/C thresholds. Reopening criterion per 21-reversion-clause-discipline.mdc: a hardware class with substantially different allocator behavior, a Phase 3a FFI fanout pattern not captured by the single-thread bench, or a Phase 2g per-hash-latency surface on production-target hardware that yields A/B delta ≥ 100 µs reopens the disposition via a fresh §3.4 pin in the relevant plan-doc.

  §9 gate confirmation (HEAD = a37aac054): Format cargo fmt -p shekyl-pow-randomx -- --check ✓; Lint cargo clippy -p shekyl-pow-randomx --all-targets -- -D warnings ✓ (feature off); Lint cargo clippy -p shekyl-pow-randomx --all-targets --features internal-pool-bench -- -D warnings ✓ (feature on); Test cargo test -p shekyl-pow-randomx --release -- --test-threads=1 ✓ (117 passed, 2 ignored — T6/T7 superseded by Phase 2d's T16; 4 crate_invariants integration tests passed; 1 perf placeholder ignored — T17 per-hash latency Phase 2g deliverable); Doc cargo doc -p shekyl-pow-randomx --no-deps ✓; FPU unsafe grep scripts/ci/check_randomx_fpu_rounding.sh ✓ (inherited from 2d); Crate-invariant grep scripts/ci/check_randomx_crate_invariants.sh ✓ (new gate landed in commit 3); Bench delta informational — compute_hash_alloc::per_call 307.42 ms vs. Phase 2d baseline 303.60 ms (+1.27%; under §9's ±10% regression-trigger threshold).

• RandomX v2 Track A Phase 2f — review-cycle fix (PR #72 Copilot finding NF8, fifth pass) (feat/randomx-v2-phase2f-impl, 2026-05-24). One finding surfaced by the fifth Copilot review pass against 84d5ba72a and addressed in-place. NF8 is a documentation-vs-implementation discrepancy in the cargo-test wrapper's rustdoc claim about its regression-detection role; the architectural disposition is unchanged, and the fix tightens the substrate by expanding scan scope rather than weakening the documented claim.

  • NF8 — tests/crate_invariants.rs rustdoc claimed an active regression-detection mechanism the scan scope did not realize. The cargo-test wrapper preamble described "would-match" comments inside tests/crate_invariants.rs as a positive regression-detection surface — if a future patch un-anchored one of the patterns, the in-comment citations would start matching and the gate would fire. The mechanism is real only if the file is in scan scope; pre-NF8, the script's CRATE_SRC="rust/shekyl-pow-randomx/src" constant excluded the test directory entirely, so the regression-detection claim was a fiction.

    Fix. Expanded CRATE_SRC from a single path to an array ("rust/shekyl-pow-randomx/src", "rust/shekyl-pow-randomx/tests", "rust/shekyl-pow-randomx/benches") in scripts/ci/check_randomx_crate_invariants.sh. The recursive grep arm gains --include='*.rs' to skip C/C++ reference-vector generators at tests/vectors/reference/<primitive>/_generator/*.{c,cpp} (legitimate column-0 static declarations under C/C++ semantics; out of scope for a Rust-targeted invariant gate). The per-file awk multi-line scanner already iterated via find ... -name '*.rs' and picked up the change automatically. The verifier crate's tests/ and benches/ directories carry zero column-0 banned shapes today, so the scope expansion is mechanical with no false-positive surface.

    Verification. Plant-revert positive-side tests across both new scope arms: use std::sync::OnceLock; plant in tests/ → gate FAILS; multi-line bypass plant in benches/ → gate FAILS; column-0 static plant in tests/ → gate FAILS; pub extern "C" fn plant in benches/ → gate FAILS; baseline → gate PASSES. Regression-detection reality check: simulated un-anchoring of Pattern A (drop the ^ from the regex) fires the gate from multiple in-scope sources: (1) the tests/crate_invariants.rs:146-147 would-match comments, exactly as the rustdoc claim describes; (2) legitimate function-local indented use std::sync::OnceLock; statements inside #[cfg(test)] mod tests { } blocks at src/cache_store.rs:596, src/vm.rs:2767, and src/vm.rs:3342, which the column-0 anchor was protecting and would un-protect under regression. The mechanism is doubly real with the expanded scope.

    Documentation. Updated the tests/crate_invariants.rs preamble to explicitly cite the NF8 fix and the now-real regression-detection mechanism, naming the scope expansion (src/ → src/ + tests/ + benches/) as the substrate change.

• RandomX v2 Track A Phase 2f — review-cycle fix (PR #72 Copilot finding NF7, fourth pass) (feat/randomx-v2-phase2f-impl, 2026-05-24). One finding surfaced by the fourth Copilot review pass against 321b89edb and addressed in-place. NF7 is a CI-gate completeness defect against §3.6 R1-E1 Pattern A; the architectural disposition is unchanged. Plan-doc round history records the fix as audit trail per 21-reversion-clause-discipline.mdc's post-closure-pin discipline.

  • NF7 — PATTERN_RUNTIME_STATE regex bypassed by rustfmt-default multi-line grouped imports. §3.6 Round 3 froze Pattern A as a column-0-anchored grep -E regex matching banned identifiers (once_cell / lazy_static / OnceLock / LazyLock) anywhere on the same line as a use statement. The single-line grouped form use std::sync::{Arc, OnceLock}; is correctly caught (OnceLock appears on the same line as the column-0 use); the rustfmt-default multi-line grouped form, where the use opener carries no banned identifier and the indented identifier lines fail the column-0 anchor, bypasses entirely: use std::sync::{\n Arc,\n OnceLock,\n}; matches none of the per-line patterns. rustfmt's default imports_granularity = "Preserve" accepts the multi-line form and a cargo fmt-mediated rewrite from the single-line form is a one-max_width-overflow away (or a future imports_granularity = "Crate" config change), so the bypass is reachable in production-discipline workflows. The Round 3 R1-E1 Pattern A invariant is "no module-level imports of these types," not "no module-level imports in a specific formatting style"; the gate's stated property and its mechanical coverage diverged.

    Fix. Added a per-file POSIX awk scanner that complements the single-line grep regex in scripts/ci/check_randomx_crate_invariants.sh. The scanner triggers on any column-0 use statement opening an unclosed brace block, accumulates subsequent lines tracking nested-brace depth via balanced {/} counts (so use foo::{bar::{baz, OnceLock}} spread across lines is handled correctly), and on depth-zero closure scans the accumulated buffer against the same banned-token alternation (once_cell|lazy_static|OnceLock|LazyLock). The two arms (single-line grep, multi-line awk) jointly enforce Pattern A regardless of rustfmt grouping style.

    Verification. Plant-revert positive-side tests: synthesized multi-line bypass file → gate FAILS (exit 1) with the banned token cited; nested-brace multi-line bypass → gate FAILS; clean multi-line use (no banned tokens) → gate PASSES; baseline crate state → gate PASSES. The cargo-test wrapper tests/crate_invariants.rs invokes the unmodified bash entry point so the test surface continues to assert exit-zero discipline; the documentation comment was extended with a multi-line bypass would-match example mirroring the single-line / Pattern B / Pattern C citations so the regression-detection mechanism is auditable for the new arm too.

• RandomX v2 Track A Phase 2f — review-cycle fixes (PR #72 Copilot findings NF3 + NF4 + NF5 + NF6, second pass) (feat/randomx-v2-phase2f-impl, 2026-05-24). Four findings surfaced by the second Copilot review pass against d4d88bdc1 and addressed in-place. Three (NF3, NF4, NF5) are documentation drift inherited from Phase 2c phrasing or from PR #72 NF2's prior commit; one (NF6) is an implementation defect on the in-flight-derivation rendezvous architecturally specified in Round 2 but under-specified at the panic-unwind boundary. None reopen Round 2 / Round 3 / post-closure-pin architectural dispositions. Plan-doc round history records the fixes as audit trail per 21-reversion-clause-discipline.mdc's post-closure-pin discipline.

  • NF3 — lib.rs crate-level rustdoc still framed dispatch_instruction as having a NOP body ("Phase 2d replaces the dispatch body in-place per §5.1.1 of the plan doc"). The bullet was correct as of Phase 2c's PR landing; Phase 2d (PR #70 → dev) replaced the body in-place with the real table-driven per-opcode dispatch and added the T16 reference vector for end-to-end real-dispatch parity, but the rustdoc was not updated to record the now-landed state. Fix: rephrased the dispatch bullet to reflect both the Phase-2c-landed NOP and the Phase-2d-landed real dispatch, named T16 as the current end-to-end consensus-parity gate, and reframed "Subsequent sub-PRs" to "Sub-PR ladder" with explicit (landed) / (planned) markers on 2d / 2f / 2g. Also updated the bench bullet's compute_hash_alloc description to record the post-2d baseline alongside the 2c stub-NOP number.

  • NF4 — benches/compute_hash_alloc.rs rustdoc framed the per-call cost composition under the stub-NOP body ("Under the stub-NOP dispatch_instruction body, the per-call cost is dominated by …"; "8 × 2048 stub-NOP iteration-loop bodies … no per-instruction work since dispatch is NOP"). Same drift as NF3. Fix: rephrased the cost-composition section to describe the pipeline neutrally (per-iteration dispatch is a step in the iteration body; Phase 2c measured under stub-NOP, Phase 2d adds per- instruction work at that step), and updated the file-header summary + the PER_CALL_SAMPLE_SIZE rationale to record the post-2d baseline.

  • NF5 — Cargo.toml internal-pool-bench feature comment claimed VmStatePool is a pub(crate) type whose Default panics in non-test builds. First half is wrong post-PR-72 F2 (the type is #[doc(hidden)] pub so the criterion bench in benches/compute_hash_alloc.rs, a separate cargo target, can name VmStatePool::new and compute_hash_with_pool across the crate boundary; pub(crate) would forbid that). Second half is incomplete (the panic is gated specifically by cfg(all(not(test), feature = "internal-pool-bench")); the no-feature production build never compiles vm_pool at all). Fix: rewrote the comment to record the actual visibility (#[doc(hidden)] pub), the actual gating shape (whole module behind #[cfg(any(test, feature = "internal-pool-bench"))]), and the actual panic discipline (panic only when Default::default() is called outside #[cfg(test)], enforcing §3.5 R1-D5 explicit-capacity at Phase 3a).

  • NF6 — DerivationSlot::wait_for_result deadlocks on leader thread panic in rust/shekyl-pow-randomx/src/cache_store.rs. Round 2 §3.1 pinned the in-flight-derivation rendezvous as Mutex<HashMap<Seedhash, Shared<DerivationFuture>>> at the architecture level; the implementation used a Mutex<Option<Arc<PreparedCache>>> per-slot rendezvous with a Condvar for follower wake-up. Pre-fix, if the leader thread panicked inside PreparedCache::derive (e.g., allocation failure during the 256 MiB Argon2d-512 fill), slot.publish never ran, the inner mutex stayed at None, the Condvar was never broadcast, and (a) every follower already parked on cv.wait blocked forever; (b) the in_flight HashMap entry was never removed, so subsequent callers for the same seedhash acquired in_flight.lock(), found the orphaned slot, became followers of the dead leader, and joined the deadlock cascade. Production builds set panic = "abort" for dev / release (process aborts before any of this matters), but cargo test always builds with panic = "unwind" per the test-harness contract — so a test exercising the failure path would hang rather than fail with a diagnostic message. Fix: replaced Mutex<Option<Arc<PreparedCache>>> with Mutex<DerivationOutcome> (Pending / Published(Arc<PreparedCache>) / LeaderAborted); added LeaderGuard<'cs> that owns the leader's slot Arc + a borrow of the in-flight mutex + a success: bool flag, with Drop that always removes the in-flight entry (cleanup-on-publish + cleanup-on-panic in one path) and conditionally broadcasts LeaderAborted via publish_aborted_if_pending when mark_success was never called; wait_for_result now panics with a diagnostic message on LeaderAborted instead of looping on the condvar. The lookup_or_derive leader branch wraps its PreparedCache::derive + slot.publish + transient.write sequence in the guard's scope with a mark_success flag flip after the transient write — on success the guard's drop is a no-op for the abort broadcast and the in-flight removal becomes the cleanup-on-publish step that previously lived inline. Test added — T-CS-13 cachestore_leader_abort_wakes_followers_and_cleans_in_flight: white-box test using a standalone Mutex<HashMap<Seedhash, Arc<DerivationSlot>>> mock so the test runs without paying the ~150–200 ms PreparedCache::derive cost; spawns a follower thread on slot.wait_for_result(), drops a LeaderGuard without mark_success, and asserts (1) in-flight entry removed; (2) slot in LeaderAborted; (3) follower panic-propagated rather than hanging. With the pre-fix slot type the test would hang indefinitely on assertion (3); with the fix it passes deterministically.

• RandomX v2 Track A Phase 2f — review-cycle fixes (PR #72 Copilot findings NF1 + NF2) (feat/randomx-v2-phase2f-impl, 2026-05-24). Two implementation defects surfaced by the post-fix Copilot review against 7b5302ee9 and addressed in-place. Both are localized refinements at the implementation layer; the Round 2 / Round 3 / post-closure-pin architectural dispositions remain unchanged. Plan-doc round history records the fixes as audit trail per 21-reversion-clause-discipline.mdc's post-closure-pin discipline.

  • NF1 — PATTERN_FFI_EXPORT blind spot in scripts/ci/check_randomx_crate_invariants.sh. The Round 3 §3.6 R1-E1 pattern C extern "C" fn arm anchored extern as the first non-whitespace token; pub extern "C" fn, pub(crate) extern "C" fn, unsafe extern "C" fn, and pub unsafe extern "C" fn all bypassed the gate. Without #[no_mangle] they are not C-callable today, but the gate's stated purpose is to forbid the export-intent shape independent of #[no_mangle] so that stepwise FFI-export drift (add pub extern "C" fn first, attach #[no_mangle] later) fires the gate at the first commit rather than only the second. Fix: extend the regex to allow optional pub / pub(crate) / pub(super) / pub(in path) visibility prefix and optional unsafe keyword before extern, mirroring pattern A's prefix coverage (closes the same shape of blind spot the F1 fix closed for pattern A). Verified against eleven positive shape variants (all match) and eight negative shapes (extern "C" { fn bar(); } import blocks, rustdoc citations, use std::ffi::CStr;, fn extern_c() {}, etc. — all skip).

  • NF2 — CacheStore::lookup linearizability race on transient→canonical promotion in rust/shekyl-pow-randomx/src/cache_store.rs. The Round 2 §3.1 per-slot RwLock<Option<Arc<PreparedCache>>> shape was specified at the architecture level; the implementation acquired and released each slot's read guard sequentially across the comparison sequence. A concurrent set_canonical could promote an entry from transient to canonical between lookup's two slot inspections, causing lookup(&S) to observe canonical=Some(prior) → released → transient=Some(prior_canonical) → return None despite the requested entry being live in the canonical slot the entire time. Soft consequence: a lookup_or_derive consumer falls through to a ~150–200 ms Argon2d-512 re-derivation that should have been a slot hit; violates the documented "few hundred nanoseconds" cost-model. Fix: acquire both slot read guards before the comparison sequence and hold them across both inspections. The canonical-then-transient acquisition order matches set_canonical's canonical-write-then-transient- write order, so there is no deadlock cycle. Updated lookup rustdoc with explicit linearizability + lock-ordering discussion; updated the CacheStore struct's # Synchronization shape rustdoc to record the global lock-ordering invariant ("every method acquiring both slot locks acquires them canonical-then-transient, regardless of read-vs-write mode"). New test T-CS-12 cachestore_lookup_linearizable_under_canonical_swap: seeds the store with two pre-derived prepared caches in distinct slots, runs alternating set_canonical(p_a) / set_canonical(p_b) calls in one thread while a second thread tightly polls lookup(&seedhash_a) / lookup(&seedhash_b) for 2,000 iterations and asserts both never return None (both entries are live in some slot at every observable moment, so a linearizable lookup must always find them). With the buggy implementation the test fails probabilistically; with the fix it passes deterministically because a concurrent set_canonical cannot interleave between the two slot reads.

• RandomX v2 Track A Phase 2f — plan-doc front-matter staleness corrections (chore/randomx-v2-phase2f-plan, 2026-05-23). Addresses PR #71 review findings (4 items, all header drift between the scaffold-as-of-Round-0 framing and the post-Round-3

  • post-closure-pin actual state). Per 91-documentation-after-plans.mdc audit-trail discipline, the scaffold-original framing is preserved in place and the superseding state is marked inline; this preserves the discipline's evolution as auditable rather than flattening history.

  (1) §Status block reframed. The opening paragraph previously described the doc as a "Round-0 substrate capture" with Round 1 as the next deliverable. Reframed to "Round 3 closed + post-closure pins + post-closure pin refinements" with a brief inventory of what each round / post-closure amendment landed; readers wanting current state read the status block, readers wanting evolution read §11 Round history. Two new front-matter paragraphs (Reading order + Original scaffold framing preserved) make the audit-trail discipline explicit.

  (2) §front-matter "No 2c or 2d public surface changes in 2f" claim flagged as superseded. The original claim was correct as of the scaffold but is false post-Round-2 (which intentionally amends the inherited 2d public surface to close the consensus-correctness footgun the 2d signature carried). The original claim is preserved as audit trail; a Round-2-supersedes paragraph immediately follows it citing 16-architectural-inheritance.mdc's pre-genesis discount rationale for landing the substrate correction in plan-doc Round 2 rather than V3.x.

  (3) §Scope envelope ≤600 net-new-lines target flagged as superseded. Round 2's Seedhash newtype + PreparedCache + atomic Seedhash sweep added ~200 net lines per §5.2's line-count table (~800 net-new lines total; ~50–150 additional if the R1-D3 cfg-gated pool flips to production). The scaffold-original ≤600 figure is preserved as audit trail; the load-bearing budget is §5.2's per-item table.

  (4) CHANGELOG post-closure-pin-refinements entry honestly framed. The previous closing paragraph said "No structural changes to Round 2 / Round 3 / post-closure-pin dispositions; only narrower specifications" — but item (1) in the same bullet is a narrow structural change to a post-closure pin (reversing the pin-#2 framing on cache_ref() in favor of an explicit accessor). Reworded to "No changes to Round 2 / Round 3 dispositions. Item (1) above is a narrow structural change to a post-closure pin …; the other five items are narrower specifications of pre-existing pins." This is the same shape as the prediction-vs-measured discipline added in commit cb9dc0dd2's §8 framing — make the divergence visible rather than letting it slip past.

  No changes to plan-doc dispositions (Round 1 / Round 2 / Round 3) or to post-closure pins (item-#1 reversal already landed in commit cb9dc0dd2); these are framing-staleness corrections only. No CI / code changes; PR #71 remains doc-only.

• RandomX v2 Track A Phase 2f — post-closure pin refinements (chore/randomx-v2-phase2f-plan, 2026-05-23). Companion commit to the post-closure substrate-completeness pins (docs/completed/RANDOMX_V2_PHASE2F_PLAN.md). Six narrow refinements, each tightening a post-closure pin against a substrate observation. Per 21-reversion-clause-discipline.mdc's post-closure-pin discipline; not a Round 4.

  (1) §1.1 pin #2 reversed: explicit pub(crate) cache_ref() accessor on PreparedCache. The original post-closure-pin disposition ("no accessor; compute_hash private-field-extracts internally") is replaced. The explicit accessor:

  impl PreparedCache {
      pub(crate) fn cache_ref(&self) -> &Cache;
  }
  

  documents the established reach-through shape from &PreparedCache to &Cache for the dispatch loop's in-crate consumption, and prevents a future contributor from re-exposing Cache's API on PreparedCache (e.g., adding prepared.derive_item(...) as a convenience). Per 05-system-thinking.mdc's "specification first, code second" discipline, the explicit accessor is the documented contract. Tests continue to use pub(crate) Cache::from_raw per Phase 2c R0-D6.

  (2) §4 Round 4 placeholder explicit close. F1–F7 is the threat-model close for Phase 2F. The §4 "Round 4 placeholder" is preserved per 91-documentation-after-plans.mdc audit-trail discipline so the Round 1 framing remains visible; it is not a queued deliverable. Future findings (impl-PR pre-flight; Phase 2g differential-harness surface) reopen the threat model via substrate-change criteria, not via sequential numbering — there is no Round 4 hanging on this plan-doc.

  (3) §8 commit-5 prediction-vs-measured discipline. The impl-PR description must include both the predicted branch (from §8 — Branch C plausible per PR-66's hundreds-of-µs; Branch A plausible per modern-allocator tens-of-µs) and the measured branch (from commit 4's BENCH_RESULTS.md) with explicit reconciliation: "prediction held" or "prediction wrong because <substrate-anchored reason>." Mirrors the mp-correction discipline (Phase 2c PR-65); makes the divergence visible rather than letting it slip past as an undocumented surprise.

  (4) §10.3 layering note: shim absorbs (g)-style discipline the verifier rejected. The shim-side scoped-closure discipline ("borrow for the duration of one hash computation" rather than "store the handle in async state") absorbs the API constraint Round 2 §3.1 rejected at the verifier layer. The (g)-option scoped-closure pattern was rejected at the verifier's Rust-side API for being too constraining on consumers; the same pattern is acceptable on the shim side because the shim's consumers are FFI callers who already navigate explicit allocate/use/destroy lifecycle. The responsibility moved layers (verifier → shim) rather than disappeared. Future readers see that the (g)-rejection at the verifier and the (g)-style absorption at the shim are the same discipline, applied at the layer where it doesn't constrain the wrong consumers.

  (5) §10.4 cfg-gated-additions principle + TraceSink scope. Cfg-gated test-infrastructure additions are not "tweaks to upstream RandomX" — they are Rust-language affordances for tooling. The "don't tweak upstream unless we need to" discipline applies to consensus-affecting behavior (production-build code paths influencing hash output, cache derivation, dispatch loop, validation rules), not to bisection convenience (test-only paths gated by #[cfg(any(test, feature = ...))]). The line is consensus-affecting, not Shekyl-specific. TraceSink trait scope pinned: the trait's surface design lives with Phase 2g's plan-doc, not with the verifier's public API; the trait stays scoped to the differential harness's consumption. Do not promote TraceSink to a public surface — a pub trait TraceSink exposed from the verifier crate would create an API contract that constrains future verifier-internal refactors.

  (6) §10.5 Phase 2g audit posture against the C reference. Three-leg framing for the "Shekyl's verifier is canonical RandomX v2" claim: (1) spec-faithful implementation discipline (Phases 2b/2c/2d/2f); (2) C-reference audit where the spec is silent (Argon2d salt; SuperscalarHash program-generation seed; JIT-vs-interpreter dispatch; etc.); (3) differential-harness corpus testing (Phase 2g). The load-bearing claim is leg 1; leg 3 is the backstop. Corpus testing on a finite set of inputs does not establish behavior on the unbounded set of all inputs, but it does increase confidence that leg 1's discipline was applied correctly. For an external auditor asking "how do you know this is right?", the answer is "we implemented to spec, audited against the C reference where the spec is silent, and test against the C reference's outputs as a backstop" — not "we test against the C reference" alone. Phase 2g's plan-doc inherits this framing.

  No changes to Round 2 / Round 3 dispositions. Item (1) above is a narrow structural change to a post-closure pin (the pin-#2 framing on cache_ref() is reversed in favor of an explicit pub(crate) fn cache_ref(&self) -> &Cache accessor); the other five items are narrower specifications of pre-existing pins. Reopen criteria are substrate-anchored per the named items; none anticipated. The chore branch holds Round 2 + Round 3 + post-closure pins + post-closure pin refinements; no push without separate authorization.

• RandomX v2 Track A Phase 2f — post-closure substrate- completeness pins (chore/randomx-v2-phase2f-plan, 2026-05-23). Companion commit to Round 2 + Round 3 of docs/completed/RANDOMX_V2_PHASE2F_PLAN.md. Per 21-reversion-clause-discipline.mdc ("an under-specification surfaced post-closure does not reopen the round it belonged to but is named explicitly as a post-closure pin"; not a Round 4). Six items, all narrow specifications of what Round 2 / Round 3 already pinned at the architectural level.

  (1) §1.1 Display impl framing corrected. Round 2's framing claimed "lowercase hex for logging consistency with Phase 2c's existing seedhash-formatting conventions"; verification at HEAD (rg -i seedhash across rust/shekyl-pow-randomx/src/) found zero tracing:: / log:: / format! / hex-rendering sites. Phase 2c does not establish a seedhash-formatting convention because Phase 2c does not log seedhashes. The lowercase-hex disposition stands (matches hex::encode and the cryptographic-output convention); the framing is corrected to cite the convention directly rather than the unsupported "Phase 2c consistency" claim. The Display impl is for downstream consumers (FFI shim, daemon-side logging, test diagnostics) — the verifier crate itself does not log.

  (2) §1.1 dispatch-loop / Cache visibility pin. The Round 2 Cache: pub → pub(crate) transition does not affect the dispatch loop's vm.rs::execute_one signature (in-crate cache: &Cache — the visibility transition is crate-boundary-only). compute_hash extracts &prepared.cache via private-field access internally (both in the same crate); no cache_ref() accessor on PreparedCache is added. Tests that need direct Cache construction continue to use pub(crate) Cache::from_raw per the Phase 2c R0-D6 tests-use-the-actual-API discipline.

  (3) §1.1 PreparedCache equality pin. PreparedCache does not derive PartialEq / Eq. Two equality semantics are needed; each is served by a more specific primitive than PartialEq on PreparedCache: seedhash equality (slot.seedhash() == lookup_key via Seedhash's derived PartialEq) for CacheStore slot indexing, and Arc::ptr_eq for identity comparisons in tests T-CS-5/7/9. Deriving PartialEq would either be structural value-equality (compare 256 MiB cache bytes; no caller wants this) or delegating equality (compare seedhash only; conflates "same seedhash" with "same PreparedCache instance"). Both shapes are wrong; the absence of the impl forces consumers to use the right primitive at the call site.

  (4) §8 commit-5 empirical-conditional + branch-prediction pin. Commit 5 (cfg-gate flip per §3.4 Round 3) is conditional on the §6.3 A/B bench delta measured at commit 4. The empirical answer does not exist at plan-doc-close time. Branch C (≥ 100 µs delta) plausible per PR-66's hundreds-of-µs per-call alloc cost; Branch A (< 50 µs) plausible per Box::<[u8]>::new_zeroed_slice(2 MiB) typical tens-of-µs cost on modern allocators. Both predictions are consistent with the §3.4 Round 3 disposition; the impl-PR's commit-4 bench result resolves the prediction with substrate-anchored data, and the impl-PR description names the branch taken so reviewers can spot surprises against the prediction.

  (5) §10.3 Phase 3a FFI shim discipline. The verifier crate provides the Rust-side type system (Seedhash, PreparedCache, Arc<PreparedCache>, CacheStore); the Phase 3a FFI shim owns the C-side opaque-handle shape, Seedhash::from_bytes(*ptr) construction at the boundary, Arc<PreparedCache> lifecycle across the boundary (daemon-facing API discourages long-lived holds per the caller hand-off Arc-lifetime discipline), and VmStatePool::new(capacity) runtime-parameter derivation from dev-tip daemon threadpool source at Phase 3a wire-up time. Phase 3a's plan inherits the disposition rather than re-litigating it.

  (6) §10.4 Phase 2g compute_hash_with_trace pre-pin. Pre-pinned the option for a #[cfg(any(test, feature = "differential-trace"))] pub fn compute_hash_with_trace(prepared, data, trace_sink) -> [u8; 32] test-infrastructure entry point for differential- harness bisection (per-iteration register-file snapshots; not a public-API addition; production build pays no overhead). The C reference does not expose this; the Rust verifier exposes it under #[cfg(...)] so the verifier's "stay minimal; don't add Shekyl-specific divergence" discipline is preserved. Phase 2g's plan inherits the option; uses it iff bisection workflow requires per-iteration trace visibility (otherwise the API is not added).

  No structural changes to Round 2 / Round 3 dispositions; only narrower specifications. The reopen criteria for the post-closure pins are substrate-anchored per the named items; none are anticipated. The chore branch holds Round 2

  • Round 3 + post-closure pins; no push without separate authorization.

• RandomX v2 Track A Phase 2f — Round 3 design (refinement bundle) (chore/randomx-v2-phase2f-plan, 2026-05-23). Companion commit to Round 2's architectural keystone for docs/completed/RANDOMX_V2_PHASE2F_PLAN.md. Round 3 hardens the dispositions Round 2 left for follow-up. §3.3 R1-D3 reframed to cfg-gated A/B approach — pool body implemented behind #[cfg(any(test, feature = "internal-pool-bench"))] regardless of R1-D4 outcome; bench harness measures both paths directly (B-pool-off always; B-pool-on when feature enabled). Closes the Round 1 circular-sequencing problem. §3.4 R1-D4 dissolved into R1-D3 — the threshold (Decision #7's 100 µs) is a binding source; the Round 1 task is mechanical application of the threshold to the A/B delta. The cfg-gated pool stays in source as the bench-only artifact on Branch A; flips to default-on on Branch C. §3.5 R1-D5 refined to runtime-configurable capacity — VmStatePool::new(capacity: usize) constructed from the Phase 3a FFI shim's threadpool-source-derived value; the default constructor panics in non-test builds to enforce explicit configuration. The Round 1 R1-D5 survey methodology stands; the substrate-anchored value flows in at runtime rather than baking into a pub(crate) const at compile time. Closes the Round 1 staleness footgun where a Phase-2F-baked-in capacity could mismatch the Phase 3a daemon configuration. §3.6 R1-E1 rustfmt-rely-chain note added — the column-0 anchor is robust against function-local statics if and only if cargo fmt --check is a CI gate (which it is, per Phase 2c R0-D6); the rely-chain is named explicitly in the §3.6 Round 3 sub-block. §4 threat-model F1–F7 enumeration (Round 4 placeholder retained as audit trail; Round 3 supersedes inline): F1 cache-derivation DoS amplification (closed by canonical non-eviction); F2 Arc-holding memory exhaustion (bounded by capacity-2 + caller-side discipline note); F3 thundering herd on novel-seedhash (closed by in-flight dedup); F4 unbounded HashMap growth (closed by cleanup-on-publish); F5 concurrent-derivation race (covered by determinism property + dedup); F6 mutex contention amplification (addressed by RwLock-per-slot + capacity-2-no-sharding); F7 cache-derivation cost asymmetry (out of scope; upstream daemon-side validation discipline). Caller hand-off Arc-lifetime discipline note added to the CacheStore rustdoc (consumers should hold Arc<PreparedCache> only for the duration of the immediate hash computation; long-lived holds extend cache memory residency beyond CacheStore's bound; daemon-side discipline, not a CacheStore enforcement). §6.1 test plan reshaped to Round-2-typed pre/post table (T-CS-1..11; in-flight-dedup test T-CS-7; cleanup-on-publish white-box test T-CS-8; concurrent-determinism property test T-CS-9; type-shape compile-time checks T-CS-10/11). §6.3 bench harness reshaped to B-pool-off / B-pool-on A/B per §3.3 Round 3; component-floor benches retained as cross-check; BENCH_RESULTS.md records the A/B delta + Branch disposition. §8 commit table reshaped to 6-commit Round-2-+-Round-3 shape: Seedhash + PreparedCache type sweep (1); CacheStore (2); invariant grep gate (3); cfg-gated pool + A/B bench (4 — always); cfg-gate flip (5 — Branch C only); plan close + CHANGELOG (6). The Round 1 5-commit shape's Branch-A-omits-commit-4 / Branch-B-defers-commit-4 / Branch-C-includes-commit-4 trichotomy collapses to "is commit 5 included" rather than "does commit 4 exist." §3.1 (g) rejection inline at CacheStore rustdoc — the Arc-holding memory exhaustion finding is named in the public rustdoc so future readers asking "wouldn't this be simpler without two slots?" find the adversarial finding rather than re-proposing the shape. Adversarial-pass-precedent named — the (g) → (b) Round 2 reversal is the second documented instance of "adversarial pass reverses an aesthetically-preferred choice" (first: LWMA-1 time-source local-time-only over peer-time- derived). The recurrence justifies promotion to 26-sub-pr-design-discipline.mdc as a sibling discipline- promotion PR (chore/sub-pr-design-discipline-adversarial-pass). No outstanding Round-N+1 follow-ups queued from Round 3; Round 4 (if any future round opens) reopens via the §3.1 / §3.3 / §3.5 substrate-change reopening criteria, not via sequential numbering.

• RandomX v2 Track A Phase 2f — Round 2 design (architectural reframe) (chore/randomx-v2-phase2f-plan, 2026-05-23). Architectural keystone for docs/completed/RANDOMX_V2_PHASE2F_PLAN.md Round 2; supersedes the Round 1 dispositions where the Phase 2c freeze inherited a consensus-correctness footgun the type system can close at zero cost. Round 1 dispositions stand as audit trail. Round 3 follow-up commit (queued; same chore branch) refines the dispositions Round 2 doesn't directly touch (R1-D3 / R1-D4 / R1-D5 / R1-E1 refinements; threat-model F1–F7 enumeration; commit-table reshape). The "no push" framing is the right shape: both Round 2 and Round 3 commits stay on the chore branch until both are ready, then push together. Merging the keystone alone would create a transient state where the architecture is reframed but the synchronization shape isn't pinned, the in-flight deduplication isn't specified, etc.

  • §1.1 substrate correction (load-bearing). Phase 2c's compute_hash(&Cache, &[u8; 32], &[u8]) -> [u8; 32] shape carries the cache and the seedhash as separate arguments; a caller passing the wrong cache for a given seedhash gets a wrong hash, which is fine for chain integrity (network rejects) but is a footgun the type system can close at zero cost. Round 2 introduces:
    • pub struct Seedhash(/* private [u8; 32] */) — newtype replacing [u8; 32] aliases for seedhashes. Derives Copy / Clone / Debug / Eq / Hash / PartialEq plus a Display impl (hex). Representation is private (accessor- mediated from_bytes / as_bytes); pre-genesis the representation is fixed but post-genesis the accessor shape lets the representation evolve without churning every call site. Future-proofs typed-provenance refinements (e.g., ValidatedSeedhash(Seedhash) for "this seedhash came from a validated block header" vs arbitrary user input).
    • pub struct PreparedCache bundling Cache + Seedhash. The bundle is constructed via pub fn PreparedCache::derive(Seedhash) -> PreparedCache; pub fn PreparedCache::seedhash(&self) -> &Seedhash. Wrong-cache-for-seedhash is unrepresentable: there is no public path to construct a PreparedCache whose cache wasn't derived from its seedhash.
    • compute_hash signature amended: pub fn compute_hash(&PreparedCache, &[u8]) -> [u8; 32]. No separate seedhash parameter. The bundling propagates through to the FFI surface (per §10.2) — the C++ caller passes an opaque PreparedCache* and never sees a seedhash on the compute path.
    • Cache transitions pub → pub(crate). The pub(crate) Cache::derive(&Seedhash) -> Cache is the implementation primitive but not the public API. Test access is preserved via src/*.rs#mod tests discipline (Phase 2c R0-D6); Cache rustdoc carries a pointer to PreparedCache as the public construction path.
    • Two-layer derivation discipline. Cache::derive(&Seedhash) -> Cache is the pure transform (testable in isolation, preserves Phase 2c's T1 spec-vector test infrastructure); PreparedCache::derive(Seedhash) -> PreparedCache is the bundling wrapper (three lines of body; calls Cache::derive and pairs the result with the seedhash). Two-layer chosen over one-layer for test-infrastructure continuity (T1 spec vectors assert Cache::derive against canonical reference output; reusing those tests against the internal Cache::derive is cheaper than rewiring them through PreparedCache.cache()).
    • Seedhash-newtype sweep is atomic with introduction. Every site that currently passes &[u8; 32] for a seedhash (Cache::derive, PreparedCache::derive, CacheStore::*, FFI shim's seedhash constructor, every test that constructs a literal seedhash) updates to &Seedhash / Seedhash in the same impl-PR commit as the newtype's landing. Not as a follow-up. Otherwise the codebase has a transitional period where some sites use &[u8; 32] and some use &Seedhash, which is exactly the drift the newtype prevents.
  • §3.1 R1-D1 + R1-D2 merged disposition. Round 1's single-axis question (CacheStore API shape) is layered into a three-axis question post-PreparedCache:
    • Axis 1 (consensus-correctness): where the cache+seedhash binding lives. (i) separate parameters [Phase 2c freeze; Round 2 rejects]; (ii) PreparedCache bundle [Round 2 picks]. Type-enforces the binding.
    • Axis 2 (QoS): canonical-protection shape. (a) transparent memo with pin/unpin [Round 1 rejected]; (b) explicit two-slot type [Round 1 picked, Round 2 reaffirms; now operates on Arc<PreparedCache>]; (c) type-stratified composition [Round 1 rejected as over-provisioning at capacity 2]. Once Axis 1 type-enforces consensus correctness, Axis 2's stakes drop from "structurally enforce consensus correctness" to "structurally enforce QoS sticky property" — (b) is still right but the argument is lower-stakes.
    • Axis 3 (whether CacheStore exists): (d) no-CacheStore [Round 2 rejects]; (e) thin amortizing layer [Round 2 partial pick]; (f) full canonical-protection structure [Round 1 (b) shape, pre-PreparedCache; Round 2 partial pick]. Round 2 picks (e)/(f) hybrid: thin amortizing layer with explicit two-slot canonical-protection on top of Arc<PreparedCache>. Rejects (d) and its (g) refinement (no-CacheStore + per-consumer in-flight deduplication map) for the Arc-holding memory exhaustion attack: without a capacity-N cap at a CacheStore layer, an attacker who induces concurrent novel-seedhash lookups gets the daemon to hold many Arc<PreparedCache> clones whose total memory footprint scales with seedhashes-seen- in-attack-window. Capacity-N at the CacheStore layer bounds this; consumer-side discipline does not.
  • Frozen CacheStore public surface (Round 2 supersedes Round 1's code-block). pub fn new() -> CacheStore, pub fn lookup(&self, seedhash: &Seedhash) -> Option<Arc<PreparedCache>>, pub fn lookup_or_derive(&self, seedhash: &Seedhash) -> Arc<PreparedCache>, pub fn set_canonical(&self, prepared: Arc<PreparedCache>). The Round 1 insert method is removed; its function (publish a derived cache into the transient slot) is subsumed by lookup_or_derive's on-completion publication. No caller-driven insert path remains. Separating fast-path (lookup, no derivation) from slow-path (lookup_or_derive, may derive) lets a hot-path validator that knows it should hit canonical call lookup and treat None as an error signal rather than transparently paying ~150 ms of unexpected derivation cost.
  • In-flight derivation deduplication shape pinned (Round 2 new vs. Round 1 surface). Mutex<HashMap<Seedhash, Shared<DerivationFuture>>> inside CacheStore. Concurrent lookup_or_derive calls for the same novel seedhash share one in-flight derivation; only one Argon2d fill runs. Cleanup-on-publish drops the in-flight-map entry immediately on derivation completion — load-bearing for memory-boundedness (without it, the in-flight HashMap grows unboundedly under sustained novel-seedhash attack). Closes the thundering-herd attack surface that applies regardless of Axis 2/3 selection. The Shared<DerivationFuture> is the futures::future::Shared adapter (or a sync alternative built on std::sync::Arc<std::sync::Mutex<DerivationState>> + condvar; the choice is a Round 3 sub-detail per dependency discipline).
  • Synchronization shape pinned at Round 2. Per-slot RwLock<Option<Arc<PreparedCache>>> for canonical and transient (lookups are hot path; writes are rare; concurrent readers proceed; canonical reads don't block transient writes and vice versa). Mutex<HashMap> for in-flight (writes/reads balanced; short critical section; RwLock would not buy meaningful concurrency). Sharding rejected at capacity-2 (no contention to reduce when there are only two slots). Pre-genesis discount makes synchronization changes bounded; reopen via Round X+1 if Phase 3a profiling surfaces RwLock-not-helping or Mutex-contention.
  • 11-row state-transition table refreshed. Pre/post states typed against Arc<PreparedCache> (rather than (seedhash, Arc<Cache>) pairs); insert→lookup_or_derive substitution; in-flight-dedup concurrent row added. The Round 1 table is preserved as audit trail in §3.2 and superseded by §3.1 Round 2 disposition. Substantive transitions are unchanged from Round 1 (canonical non-evictable; transient displace-on-publish; advance promotes-and-demotes); the table refresh is the typing.
  • Capacity-2 reopen criterion sharpened. Round 1: "a second Rust caller of CacheStore lands that needs concurrent canonicality across multiple chains." Round 2: "a named real consumer surfaces a sustained operational pattern where 2 caches isn't sufficient and the operator demonstrably has to choose between paying re-derivation cost or extending the CacheStore." Substrate-anchored event = consumer's call-site grep evidence + measurement showing the cost.
  • Transparent-memo framing retired. Parent-plan RANDOMX_V2_PLAN.md Decision #6 wording ("transparent memo with capacity-2 LRU and pin() API") belonged to the rejected Option (a). Option (b) is honest about the two-slot structure. Wording amendment queued as precursor PR chore/randomx-v2-plan-decision6-amendment that lands before the Phase 2F implementation PR opens. Bounded scope; one-file change. Precedent: Phase 2c F4-absorbed parent-plan rescope.
  • Reversion clause expanded to three independent axes. Axis 1 (PreparedCache bundling): reopens if a deserialization use case surfaces, FFI-shim audit reveals C-ABI cost, or V4 PQC architectural choice requires PQC-authenticated cache metadata. Axis 2 (canonical-protection-in-(b)): carries forward Round 1's three reopening criteria unchanged. Axis 3 (CacheStore exists): reopens if Phase 3a profiling shows Mutex<HashMap> is the bottleneck or if architectural- inheritance audit reveals consumer-side discipline can be made structural (e.g., scoped handle pattern).
  • §5 implementation hand-off contract updated. Frozen items per Round 2 (compute_hash signature, Seedhash newtype, PreparedCache, Cache visibility, CacheStore API, eviction-policy table, sweep-atomic-with-introduction) plus Round 1 freeze items unchanged where Round 2 doesn't apply. In-scope artifacts table grows by 5 rows (Seedhash newtype, PreparedCache, Cache visibility transition, compute_hash signature update, atomic Seedhash sweep within the crate). Out-of-scope re-emphasized: FFI shim updates land at Phase 3a; parent-plan Decision #6 wording lands at the precursor PR. Total ~800 lines net-new (was ~600 pre-Round-2; +~200 from PreparedCache + Seedhash + sweep + larger CacheStore + larger test matrix).
  • §10 forward path updated. 2g and 3a inherit the compute_hash(&PreparedCache, &[u8]) -> [u8; 32] shape (not the Phase 2c-frozen compute_hash(&Cache, &[u8; 32], &[u8])). Phase 3a's FFI shim constructs Seedhash::from_bytes(*ptr) from the C-ABI's *const [u8; 32] and passes Arc<PreparedCache> as opaque pointers. §10.2 PQC migration space note: the verifier crate's API is PQC-orthogonal by construction (Seedhash is 32 bytes; PreparedCache uses classical Argon2d-derived state; compute_hash produces 32 bytes). PQC architectural choices (V4-lattice signatures, hybrid- PQC verification pipeline shape) land at Phase 3a's shim layer, not in the verifier. Future contributors should not attempt to "PQC-prepare" the verifier crate's API.
  • Plan-doc edits (this commit): §1.1 rewritten with scaffold-and-Round-1 freeze preserved as audit trail and Round 2 amendment as load-bearing supersession; §3.1 Round 2 disposition added (covers merged R1-D1+R1-D2, three-axis options matrix, frozen API code-block, in-flight dedup shape, synchronization shape, 11-row state-transition table, capacity-2 reopen criterion, transparent-memo retirement, three-axis reversion clause); §3.2 Round 2 marker added (R1-D2 merged into R1-D1); §5.1 frozen-by-this-doc list updated with Round 2 supersession markers; §5.2 in-scope artifacts grows by 5 rows; §5.3 out-of-scope additions (FFI shim updates; parent-plan Decision #6 wording); §10 forward path updated for PreparedCache shape + §10.1 precursor PR queue + §10.2 PQC migration space note; §11 Round history gains Round 2 row.

• RandomX v2 Track A Phase 2f — Round 1 design closure (chore/randomx-v2-phase2f-plan, 2026-05-23). Closes Round 1 of docs/completed/RANDOMX_V2_PHASE2F_PLAN.md six decision points after the 2026-05-23 scaffold (f3da9f093):

  • R1-D1 (CacheStore API surface): picks option (b) explicit two-slot type with new / lookup / insert / set_canonical. Rejects (a) transparent memo on the basis that the F1 sticky- canonical defense depends on the caller never letting the canonical seedhash be evicted by routine lookup ordering; folding the canonical-vs-transient distinction into the type structurally enforces what (a) would push to caller discipline. Rejects (c) type-stratified composition as over-provisioning at capacity 2. Internal sync via std::sync::Mutex only — lru is not a workspace dependency (verified at rust/Cargo.toml), parking_lot is transitive-only via the existing criterion / tokio paths, and a 2-slot store does not justify pulling either into the direct dep set per 17-dependency-discipline.mdc. Frozen API code-block pinned in RANDOMX_V2_PHASE2F_PLAN.md §3.1 Round 1 disposition; revert criteria (substrate-anchored): a second Rust caller emerges needing concurrent canonicality across multiple chains; Decision #5 (FFI-locality) reverses; Phase 3a FFI shim survey surfaces concurrency requirements incompatible with the two- slot shape.
  • R1-D2 (eviction policy + interleave matrix): policy falls out of (b) — canonical slot is non-evictable, transient slot is displace-on-insert, set_canonical advance promotes-from- transient + demotes-prior. Cold-start window (no set_canonical yet called) leaves both slots subject to attacker churn; bounded to daemon startup and handled by the FFI shim's discipline (no fallback policy in CacheStore itself). 11-row pre/post state- transition table covering RANDOMX_V2_PHASE2C_PLAN.md §5.11.7 #1 3-seedhash interleave attack, the 2-seedhash cold-start degenerate case, the canonical-advance demotion, and the no-op cases. Reversion criteria tied to R1-D1.
  • R1-D3 (bench methodology for per-call VmState isolation): picks option (b) Component method. Rejects (a) Diff method because the natural amortization shape requires either promoting VmState to pub or adding a pub fn compute_hash_with_state helper — both contradict RANDOMX_V2_PHASE2F_PLAN.md §1.1 (VmState is pub(crate)) and Decision #7 (no public VmPool). Rejects (c) Population method per the scaffold's sequencing- cycle note. Component sum: Box::<[u8]>::new_zeroed_slice(2 MiB) median + synthetic register-file zero-init median (the bench does not consume the production VmState newtype to keep visibility clean); the sum is a floor on per-call alloc cost. Bench code-block pinned in §3.3 Round 1 disposition. Revert criteria: floor lands in [50, 100) µs ambiguity band per R1-D4 (would require option (a)'s tighter measurement); Decision #7 reverses; empirical evidence shows the component decomposition systematically underestimates by > 30%.
  • R1-D4 (pool decision threshold + reversion clause): confirms the 100 µs threshold per RANDOMX_V2_PLAN.md line 240. Three- band decision rule on the R1-D3 component-floor median: < 50 µs → no pool (Branch A); [50, 100) µs → escalate to impl-PR pre- flight per R1-D3 reversion-clause #1 (Branch B); ≥ 100 µs → pool inside compute_hash, no public VmPool, capacity from R1-D5 (Branch C). Reversion clauses for the no-pool path enumerate substrate-anchored triggers (allocator regression; scratchpad-size change at consensus level; runtime-architecture mismatch).
  • R1-D5 (daemon parallel-verification fanout survey methodology): audit-against-actual-code per 16-architectural-inheritance.mdc against src/cryptonote_core/blockchain.cpp, src/cryptonote_core/tx_pool.cpp, src/cryptonote_core/cryptonote_tx_utils.cpp, src/cryptonote_core/tx_pqc_verify.cpp, and src/common/threadpool.{h,cpp} at dev tip = fb21909ff. Substrate correction vs. prompt: only one parallel compute_hash call site exists at HEAD — alt-chain branch validation's block_longhash_worker via tools::threadpool::getInstanceForCompute(), capped by m_max_prepare_blocks_threads (default 4). Mempool tx verification does not call compute_hash in parallel; the prompt's two-source assumption was incorrect. Pool capacity formula: min(threadpool::getInstanceForCompute().get_max_concurrency(), m_max_prepare_blocks_threads) + 1 reserve. Reversion criteria: a future PR introduces tools::threadpool + compute_hash in tx_pool.cpp / cryptonote_tx_utils.cpp / tx_pqc_verify.cpp; m_max_prepare_blocks_threads default change; Phase 3a FFI shim survey reveals new concurrent consumer.
  • R1-E1 (CI grep pattern set + permitted exceptions): three patterns. Pattern A bans imports of once_cell / lazy_static / OnceLock / LazyLock (stricter than module-level-static-only — eliminates the disambiguation between module-level and function- local usage by rejecting the import; the crate provably needs none of these). Pattern B bans column-0 static declarations (function-local statics are inside fn bodies and indented per rustfmt; const items are a different keyword and not matched). Pattern C bans #[no_mangle], #[unsafe(no_mangle)], #[export_name, #[unsafe(export_name, and extern "C" fn definition form (extern "C" { fn foo(); } import blocks consuming external FFI surfaces are not matched since they require fn inside the brace block, not after "C"). New script scripts/ci/check_randomx_crate_invariants.sh modeled on scripts/ci/check_randomx_fpu_rounding.sh from Phase 2d. CI integration: new .github/workflows/build.yml step enforce RandomX crate-level isolation invariants sibling to the FPU step. Substrate finding at verification: pattern C's first draft (anywhere-on-line match) collided with the existing lib.rs rustdoc at lines 31–32, which legitimately cites the forbidden tokens as part of the documented discipline. Disposition: anchor pattern C at column 0 with optional leading whitespace (matches code attributes indented inside fn bodies; excludes rustdoc lines, which start with //!). Verified clean baseline at HEAD post-fix across rust/shekyl-pow-randomx/src/. Per-pattern reversion criteria: stdlib evolution producing pattern A successor primitives; genuine large-immutable-shared- state need motivating pattern B relaxation; Decision #5 (FFI- locality) reversal motivating pattern C reopen.
  • Plan-doc edits: §3.1–§3.6 each gain a Round 1 disposition sub-block (preserving the scaffold's framing as audit-trail per 91-documentation-after-plans.mdc); §5 superseded by frozen- surface contract (5.1 frozen items + 5.2 in-scope artifact table + 5.3 out-of-scope re-emphasis); §6 superseded by the 7-row CacheStore unit-test table + 4-row CI-invariant table + 4-row bench-harness table; §8 superseded by the 5-commit table with R1-D4 three-branch (A/B/C) conditional on commit 4; §11 Round history gains Round 1 row.
  • Implementation deferred to feat/randomx-v2-phase2f-impl after Round-N closure (target 4–6 rounds, matching Phase 2c/2d cadence). Round 4 specifically does the threat-model addenda pass against scaffold §4. Branch policy per 06-branching.mdc — chore branch is short-lived; commit not pushed pending user authorization.

• RandomX v2 Track A Phase 2d implementation core landed (feat/randomx-v2-phase2d, 2026-05-22). Implements docs/completed/RANDOMX_V2_PHASE2D_PLAN.md §3.5/§3.7 R1–R6 decisions on rust/shekyl-pow-randomx:

  • F128 newtype + integer helpers (bd7cea464). Promotes the Phase 2c type F128 = [f64; 2] alias to a #[derive(Copy)] struct F128([f64; 2]) carrying add/sub/mul/div/sqrt/swap

    • FSCAL XOR-mask methods per §3.2 R1-D2. Adds private sign_extend_i32_to_i64, load64/store64, rotr/rotl helpers matching instructions_portable.cpp semantics. Quarantines the FPU rounding-mode write in a new fpu_rounding module (x86_64 _mm_setcsr, aarch64 mrs/msr fpcr inline asm) per §3.1 R1-D1 / §3.7 R6-D1. Replaces the Phase 2c stub-NOP dispatch_instruction body with a dense match on decode_instruction_type(opcode) covering all 28 executable opcodes plus CFROUND + CBRANCH, driven by a PC loop with Program.cbranch_table static metadata populated during init_program (§3.6 R2-D1/R2-D2/R2-D3). Promotes superscalar::{mulh, smulh_u64, randomx_reciprocal} to pub(crate) for IMULH/IMUL_RCP dispatch.

  • T16 real-dispatch hash vector + CI grep + FPU reset (26fc49d6c). Adds tests/vectors/reference/vm/t16_vm_compute_hash_real.bin emitted by the pinned fork's interpreted-light VM under RANDOMX_FLAG_V2 (§6.2 T16 / §8 commit 5b); Phase 2c's stub-NOP T6/T7/T8 vectors are marked #[ignore] because real dispatch mutates the register file before later iterations, so the end-to-end T16 byte-equality supersedes them. Adds scripts/ci/check_randomx_fpu_rounding.sh wired into the existing Lint job to enforce the §9 FPU primitive scope (_mm_setcsr exactly once on x86_64, two asm!( calls on aarch64, no fesetround). Restores FPU rounding mode to round-to-nearest at compute_hash entry/exit and around the execute_program determinism tests so the process-wide MXCSR/FPCR mutation from CFROUND does not leak across tests. Phase 2d post-dispatch compute_hash_alloc::per_call measures 303.60 ms median (+2.6% vs. Phase 2c stub-NOP baseline of 296.00 ms), under the §9 ±10% regression-trigger threshold (rust/shekyl-pow-randomx/BENCH_RESULTS.md).

  • T9–T15 single-opcode reference vectors (Phase 2d §6.2 / §8 commit 5a). Adds a new tests/vectors/reference/_generator/phase2d/ generator (gen.cpp + Makefile + README) driving the pinned fork's randomx::BytecodeMachine::compileInstruction + executeInstruction against fabricated single instructions over a canonical NativeRegisterFile + scratchpad fixture, and emits seven new .bin + .meta.txt reference vectors under tests/vectors/reference/vm/: T9 integer smoke (IADD_RS / IMULH_R / IROR_R / ISTORE), T10 FP smoke under RN (FADD_R / FMUL_R / FDIV_M / FSQRT_R), T11–T14 the 9-FP-opcode matrix under MXCSR modes 0..3, and T15 CFROUND throttle (throttled + 2 unthrottled cases, paired with rx_get_rounding_mode() u32). Rust spec-vector tests in src/vm.rs#mod tests drive dispatch_instruction against the same canonical fixture and assert byte-equality ({t9,t10,t11,t12,t13,t14,t15}_vm_..._matches_fork_reference). Phase 2d's implementation core (PRs landed prior) plus T9–T15 per-opcode coverage and T16 end-to-end hash now exhaust the executeInstruction dispatch surface against the v2 fork pin aaafe71 byte-for-byte.

  • Phase 2d post-gate fmt cleanup (4fc0606d1). Six mechanical cargo fmt --check divergences accumulated across the four Phase 2d substantive commits surfaced together when the §9 Format gate re-ran post-T9-T15 land: four in dispatch_instruction's integer arms (IAddRs / IMulRcp / IRorR / IRolR) from bd7cea464, plus CANONICAL_E_MASK_PD from 043076f18. Addressed in a single fmt-only commit per 15-deletion-and-debt.mdc's "fix mechanical formatting errors in a file already being modified" carve-out; no semantic change. §8 commit-table reconciliation (five landed commits vs. seven planned slots) is documented in docs/completed/RANDOMX_V2_PHASE2D_PLAN.md §11's Implementation row with SHA → §8 mapping and §9 gate confirmation at HEAD 4fc0606d1.

• Sub-PR design discipline rule (PR #67, 2026-05-22). Promotes fourteen Phase 2c-emergent process disciplines from docs/completed/RANDOMX_V2_PHASE2C_PLAN.md / RANDOMX_V2_PHASE2C_AUDIT.md into .cursor/rules/26-sub-pr-design-discipline.mdc (Option A; opt-in — cite when scoping multi-round per-trait PRs). Closes docs/FOLLOWUPS.md V3.0 discipline-promotion item. Applies to RandomX v2 sub-PRs, LWMA-1 Phase 4, and other multi-round consensus-critical design work.

• RandomX v2 Track A Phase 2d — Rounds 1–6 design closure (PR #68). Expands docs/completed/RANDOMX_V2_PHASE2D_PLAN.md through Round 6 after PR #66 on dev (e9917097f): Round 1 (FPU/F128/frequency dispatch/u128 audit); Round 2 (PC-driven loop, Program.cbranch_table, VmState.branch_pc); Round 3 (threat-model addenda); Round 4 (phase2d generator CLI for T9–T16); Round 5 (closure + §10 FPU grep patterns). Round 6 closes two Round-6-blocking findings against the Round-5 state: (R6-D1) aarch64 FPU primitive resolves the R1-D1/R5-D1 inconsistency by reopening R1-D1 option (b) for aarch64 only — stable inline asm mrs/msr fpcr write — with substrate justification (no stable core::arch::aarch64 FPCR-write intrinsic exists); (R6-D2) out-of-range opcode disposition changes from R1-D3's debug_assert!/no-op pair to panic! in both profiles, removing the debug-vs-release behavior divergence the §10 equivalence gate would surface. Plan-doc edits ride along: R1-D4 IMUL_RCP unreachability citation (R6-D3), §8 commit-5 split into 5a (T9–T16 additions) + 5b (T8 expectation flip) keeping the consensus-affecting flip independently bisectable (R6-D4), exec_pc invariant- documentation note + sentinel reset for implementation-PR rustdoc (R6-D5). Implementation authorized on feat/randomx-v2-phase2d.

• RandomX v2 Track A Phase 2c — Cache derivation + VM substrate + T1-T8 spec-vector parity + bench baselines (feat/randomx-v2-phase2c-impl, PR #66, 2026-05-22). Third sub-PR of the Rust pure-software RandomX v2 verifier port per docs/design/RANDOMX_V2_PLAN.md §"Track A — Phase 2" and the design plan docs/completed/RANDOMX_V2_PHASE2C_PLAN.md. Eight-commit stack landing the cache + VM substrate end-to-end with byte-for-byte parity against the randomx-v2 fork at pin aaafe71 (v2.0.1) for all eight reference vectors (T1-T8), plus the bench baseline + CI cross-profile gate that Phase 2d/2f/2g inherit:

  • Commit 1 — Cache type skeleton + size constants + Drop (39eda3164). src/cache.rs pub Cache struct + CACHE_SIZE / DATASET_ITEM_SIZE / DATASET_ITEM_COUNT constants + empty Drop (review-surface hook per §5.11.4). Per the §3 module layout + §2 surface 1 framing.
  • Commit 2 — Cache::derive + T1' determinism + unsafe carve-out #1 (48e7df633). Argon2d 256 MiB fill (delegating to Phase 2a's pub(crate) fill_cache) + 8 × Blake2Generator-seeded generateSuperscalar programs (delegating to Phase 2b's Blake2Generator + generateSuperscalar from src/superscalar.rs)
    • RANDOMX_CACHE_ACCESSES constant + the cache-memory allocation unsafe carve-out (the only #![deny(unsafe_code)] exception this commit introduces, per the §1 covenant 7 enumeration) + cache-site debug_assert!s per §5.11.2. T1' (Cache::derive determinism property test, ~100 invocations) + the programs field landing on Cache. Plan-doc errata 86f058c3b/431a54b38/3e6bb2734 (impl-time pre-flight R0-D5/R0-D6/R0-D7: drop Cache::from_raw, relocate T1-T8 to unit tests, withdraw randomx_reciprocal pub(crate) promotion).
  • Commit 3 — Cache::derive_item + item_bytes + T2' invariance (9ab584596). pub(crate) Cache::derive_item (the per-iteration dataset-item read consumed by VmState's 2048-iteration loop)
    • pub(crate) Cache::item_bytes (the byte-level indexing accessor) + the dataset-item spec constants (SUPERSCALAR_MUL_0, SUPERSCALAR_ADD_1..SUPERSCALAR_ADD_7). T2' (invariance under item-number permutation) property test. Dissolves the #[allow(dead_code)] on superscalar::execute_superscalar.
  • Commit 4 — VmState skeleton + scratchpad alloc + Drop (c63555a5e, with 186a8cfdf fix-up for the PROGRAM_SIZE/PROGRAM_ITERATIONS distinction caught at R0-D9 pre-flight). src/vm.rs pub(crate) VmState skeleton with the frozen §5.1.1 field set (per §5.5 F5 v2-only simplification), pub(crate) type definitions (F128, Instruction, Program), the PROGRAM_SIZE (384) / PROGRAM_ITERATIONS (2048) / RANDOMX_SCRATCHPAD_L3 (2 MiB) spec constants, the alloc_zeroed_scratchpad carve-out (the second and final #![deny(unsafe_code)] exception this PR introduces per §1 covenant 7), the scratchpad-allocation debug_assert! per §5.11.2, the empty Drop (review-surface hook per §5.11.4), and the threat-model disposition rustdoc per §5.11.4 (public-input-only scope note).
  • Commit 5 — init_scratchpad + init_program + T3'-T5' determinism (76cf9a5ae). VmState::init_scratchpad via crate::aes::fill_aes_1r_x4; VmState::init_program (stack- allocate the 3 200-byte program buffer per spec §4.5's 128 + 8 × PROGRAM_SIZE budget, fill via crate::aes::fill_aes_4r_x4, parse entropy[0..128] into the register-init field set, parse instructions[128..3200] into self.program.instructions); plus the IEEE-754 / dataset helpers the parser consumes (get_small_positive_float_bits, get_float_mask, CACHE_LINE_ALIGN_MASK, DATASET_EXTRA_ITEMS, CACHE_LINE_SIZE). T3' / T4' / T5' fixture-free determinism property tests inline per §5.11.1
    • §14 Round 0 R0-D6 (test placement inside src/*.rs#mod tests).
  • Commit 6 — compute_hash + execute_program + T6'-T8' determinism (4b182292b). pub fn compute_hash(&Cache, &[u8; 32], &[u8]) -> [u8; 32] (the crate's single hash- producing entry point) + VmState::execute_program (the spec §4.6 / vm_interpreted.cpp::execute() 2048-iteration loop — the single per-iteration body that the stub-NOP dispatch_instruction dispatches into per spec §4.6.5) + the private dispatch_instruction NOP-body stub (the §5.1 function-body replacement contract Phase 2d fills in per §5.1.1 frozen surfaces 1-3); plus the supporting helpers (SCRATCHPAD_L3_MASK_64, DYNAMIC_MANTISSA_MASK, RANDOMX_PROGRAM_COUNT, cvt_packed_int_to_f128, mask_register_exponent_mantissa). T6' / T7' / T8' fixture- free determinism property tests inline per §5.11.1.
  • Commit 7 — T1-T8 spec-vector parity vs. randomx-v2 fork (4ba995469). Reviewer-runnable C++ reference generator at tests/vectors/reference/_generator/phase2c/ (Makefile + gen.cpp + README + .gitignore) compiled against the vendored fork at pin aaafe71. Eight reference vectors pre-computed and committed under tests/vectors/reference/cache/ (T1: cache fingerprint Blake2b-256 over the entire derived cache + the 8 superscalar programs; T2: 8-item dataset batch) and tests/vectors/reference/vm/ (T3: scratchpad init; T4: register init from entropy; T5: program parse from entropy; T6: spAddr0/spAddr1 snapshot across 4 stub-NOP iterations; T7: post-AES-mix register snapshot across 4 stub-NOP iterations; T8: end-to-end compute_hash output under stub-NOP dispatch). Ten Rust spec- vector tests (T1-T8) inline in src/cache.rs and src/vm.rs pass byte-equality against the committed fixtures. Refactor: VmState::execute_program split into execute_program (the outer per-chain orchestration) + execute_iteration (the per-iter body) to enable T6/T7 intermediate-state snapshotting. Two implementation-time substrate-divergence findings landed in this commit per 16-architectural-inheritance.mdc's cross-language-port discipline:
    • R0-D10 — chain-boundary integer-register reset (cross-language-port-implicit-state-loss discipline). The C reference's per-chain NativeRegisterFile nreg; construction (vm_interpreted.cpp:59) implicitly zero- initializes the integer-register array via the struct definition at bytecode_machine.hpp:40. The Rust port fuses reg + nreg into a single VmState.r per 30-cryptography.mdc secret-locality framing; the per-chain reset that fell out of C's two-struct shape is re-asserted explicitly as self.r = [0; 8]; at the top of VmState::execute_program. T8 (the end-to-end vector that runs all 8 chains) surfaced the missing reset; T6/T7 (single chain) don't. Disposition under §14 Round 0 R0-D10.
    • R0-D11 — IMUL_RCP::imm32 storage divergence (cross- language-port-storage-divergence discipline). The C reference's initCache (dataset.cpp:131-138) post-processes the 8 SuperscalarPrograms after generateSuperscalar by replacing each IMUL_RCP instruction's imm32 in-place with an index into a reciprocal-cache side table; the reciprocal value is later resolved at execution time via that index. The Rust port keeps the original imm32 and computes the reciprocal on-the-fly in execute_superscalar (result-equivalent, byte-divergent for serialization). T1 (the cache fingerprint vector that hashes the serialized programs alongside the derived cache) surfaced the divergence; T2 (which only consumes the derive_item output, not the program serialization) didn't. Resolution lives in the C++ generator (emit_t1 re-runs Blake2Generator + generateSuperscalar directly rather than reading the C reference's cache->programs to hash the pre-modification programs); the Rust port's storage shape is the consensus-relevant one. Verified result- equivalence via T2's dataset-item parity (which exercises the same IMUL_RCP arm at execution time via Rust's on-the-fly reciprocal calculation). Disposition under §14 Round 0 R0-D11.
  • **Commit 8 — Phase 2c benches + per_hash_latency placeholder
    • debug-vs-release CI gate + scope-bounding doc-comment + BENCH_RESULTS + CHANGELOG** (this commit). Two criterion benches at benches/cache_derive.rs
    • benches/compute_hash_alloc.rs landing the §5.8 PR-gate baseline measurement infrastructure. tests/perf/per_hash_latency.rs placeholder (#[ignore] + unimplemented!() cross-referencing F8 + §13 forward-path 2g inheritance) at the canonical 2g deliverable path per R3-minor-2 — structural code out-survives prose discipline per 21-reversion-clause-discipline.mdc; 2g's author finds the placeholder by grep against its own deliverable name and replaces the body in-place. Workflow line addition in .github/workflows/build.yml Gate 2: cargo test --release -p shekyl-pow-randomx per §5.11.3 R4 (Rust integer-overflow semantics differ between debug-panic and release-wrap; T1-T8 byte-equality assertions catch any silent drift). Crate-level scope-bounding doc-comment in src/lib.rs per §5.11.4 R4 (public-input-only scope with substrate-anchored reopening criterion). Baseline measurements recorded in BENCH_RESULTS.md (i9-11950H, Debian 13, kernel 6.12.88): Cache::derive median 341.45 ms; compute_hash end-to-end (stub-NOP) median 296.00 ms. Both measurements exceed the §5.8 plan-author budgets (200 ms and 100 µs respectively); the threshold-vs-actual gap is documented in BENCH_RESULTS.md §"Threshold reconciliation" with the diagnosis (single-thread Argon2d on this hardware class is fundamentally a ~300 ms operation; the compute_hash_alloc budget framing was internally inconsistent with what the bench measures) and named reopening criteria per 21-reversion-clause-discipline.mdc. Plan-doc errata R0-D12 (separate commit landing alongside this one) records the gap in §14 Round 0; Phase 2c does not block on the reconciliation per the §5.8 explicit "implementation-PR-time decision" authority.

  Phase 2c retains the Phase 2a/2b forward-compatibility posture: no #[no_mangle], no extern "C" fn, no #[export_name], no module-level runtime-mutable state. #![deny(unsafe_code)] at the crate level with the two carve-outs above per §1 covenant 7 (cache::CACHE_MEMORY_ALLOC and vm::alloc_zeroed_scratchpad). cargo test -p shekyl-pow-randomx succeeds without external/randomx-v2/ initialized and without a C++ toolchain — the spec-vector reproducibility check (make vectors in the generator directory) opts in to the fork submodule + C++ build. The live differential harness remains Phase 2g's separate artifact. Phase 2d builds on the Phase 2c dispatch_instruction NOP stub via function-body replacement (no trait wiring, no impl swap, no signature change to compute_hash per §5.1.1's frozen surfaces 1-3); Phase 2f wraps Cache::derive in a CacheStore LRU + VmState pool; Phase 2g lands the C-side differential harness as a separate test-only artifact; Phase 3 then exposes the verifier through shekyl-ffi and rewires the C++ daemon to it; Phase 4 deletes the C++ verifier path.

Documentation

• RandomX v2 Track A Phase 2c plan + 2d skeleton scaffold + parent-plan alignment (chore/randomx-v2-phase2c-plan, PR #65, 2026-05-21). Doc-only branch landing the design substrate for Phase 2c implementation (Cache::derive + VmState + compute_hash + NOP-body dispatch_instruction), the Phase 2d skeleton scaffold (function-body replacement of dispatch_instruction), and the parent-plan alignment commits that absorb the cross-cutting decisions. Thirteen commits across five design rounds. Implementation cut authorized post-PR-#65 merge per the §14 closure entries.

  • Round 1 (2026-05-21). F1–F9 interactive walk closed nine findings via gap-analysis; ShekylU128 audit verified the v2-only simplification surface. F4 absorption (Cache::derive moves from originally-scoped Phase 2e into 2c) lands as a parent-plan precursor commit. Per RANDOMX_V2_PHASE2C_PLAN.md §14 Round 1 entry.

  • Round 2 (2026-05-21). Substrate-finding pass tightens the type-and-module shape within Round 1's locked dispositions. Three structural restructurings: (R2-D1) BytecodeDispatch trait plus StubNopDispatch impl → dispatch_instruction free function with NOP body replaced in 2d, eliminating the mock-X anti-pattern; (R2-D2) Vm<'a> public type → compute_hash public transform with VmState private (module layout collapses 5 files → 2); (R2-D3) Cache::from_raw visibility correction (pub → pub(crate); test-time only, not FFI surface). Parent-plan alignment commit follows (Decision #7 substrate-shift: VmState pooling becomes internal to compute_hash, not a public VmPool type).

  • Round 3 (2026-05-21). Substrate-completeness pass closes out before implementation. (R3-D1) §5.1.1 "Function-body replacement contract" pins the 2c → 2d hand-off: frozen dispatch_instruction signature, frozen Instruction field set, and VmState field set populated empirically from an audit against bytecode_machine.hpp's 29 opcode handlers + vm_interpreted.cpp::execute(). Audit produced one correction-from-prompted-list finding: mp is a v2-only local-variable alias for mem.ma, not a struct field; §5.5 F5 entry updated to match (the audit-against-actual-code precedent that §5.11.8 formalizes in Rounds 4–5). (R3-D3) Sibling commit lands RANDOMX_V2_PHASE2D_PLAN.md skeleton scaffold: §5.1.1 contract carry-forward, VmState field-set reference, forward-actions from F1/F2/F3/F5/F7, decision points for 2d Round 1 (FPU rounding-mode mechanism; F128 newtype shape; per-opcode dispatch shape).

  • Round 4 (2026-05-21). Threat-model addenda pass against priority-1 surface (per .cursor/rules/00-mission.mdc's security-and-quantum-resilience commitment) enumerating six attack objectives: mining-faster differential; cache poisoning; FFI exploitation; resource DoS; Rust safety boundary gaps; consensus split via implementation divergence. New §5.11 records eight findings + dispositions. In-scope 2c-implementation additions: T1' (Cache::derive determinism) + T2' (derive_item invariance) property tests (~60 LoC per §5.11.1's per-sub-test estimate; T1'a/b/c ~10 LoC each + T2'a ~30 LoC); debug_assert! discipline at the two unsafe Box::new_zeroed_slice sites (~10 LoC); debug-vs-release equivalence as PR gate (1 line in CI workflow); public-input-only scope note. Forward-actions to downstream phases: 2g adversarial seedhash corpus + pathological-program worst-case timing bound (≤5.0×); 3a FFI null-pointer + length-validation + seedhash: *const [u8; 32] typed-array pointer + ERR_NULL_PTR/ERR_DATA_TOO_LARGE taxonomy + RANDOMX_BLOCK_TEMPLATE_MAX_SIZE pinned at 2 MiB; 2f CacheStore canonical-seedhash slot eviction-protection + VmState pool capacity sized against daemon parallel-verification fanout. Discipline note: §5.11.8 audit-against-actual-code validation (the discipline that produced R3-D1's mp correction is the discipline 2d/2g inherit). Parent plan alignment + 2d skeleton addenda ship as sibling commits.

  • Round 5 (2026-05-21). Closure-only refinement pass against the Round 4 plan-doc; substantive review surface closed at Round 4, four discipline-enforcement edges tightened:

    • (R5-D1) RANDOMX_V2_PHASE2C_PLAN.md §5.11.8 framing amendment: "reading-the-source vs. producing-a-table-from-intuition" named as the load-bearing audit step (the table is the audit's output; the audit's substance is the line-by-line reading that produces the table). "Show your work" enforcement formalized: every audit table cites line ranges at the pinned fork commit; reviewer spot-checks by opening the cited file and reading the named lines. The R3-D1 mp correction is reframed from "we caught one bug" to the precedent that proves the discipline (a prompted-list table without a reading-the-source pass IS the failure mode .cursor/rules/16-architectural-inheritance.mdc's "audits-are-clean-so-compress" anti-pattern names).
    • (R5-D2) RANDOMX_V2_PLAN.md Phase 0 §5 FFI hardening refinements: C-side header form const uint8_t (*seedhash)[32] (not decayed const uint8_t *seedhash); C++ call-site declaration discipline (uint8_t seedhash_buffer[32]; ...&seedhash_buffer), documented at each call site not just at the signature; RANDOMX_BLOCK_TEMPLATE_MAX_SIZE rationale-sentence cross-check (generous ceiling above any realistic Shekyl block template; the 2 MiB == scratchpad-size coincidence is explicitly named non-load-bearing; reversion-clause per .cursor/rules/21-reversion-clause-discipline.mdc).
    • (R5-D3) RANDOMX_V2_PHASE2D_PLAN.md §3.1 CI-time grep mechanical-enforcement addendum: the unsafe-block scope-check discipline (Scaffold-R4 prose-form) is promoted to a §10 hard-gate CI grep modeled on the RANDOMX_V2_PLAN.md §7.7 shekyl-pow-randomx never uses #[no_mangle] invariant pattern. The grep asserts the rounding-mode-setter function body contains exactly one of the chosen-option primitives (_mm_setcsr/__set_fpcr/asm!/chosen-crate) and nothing else (no other intrinsic calls, no pointer dereferences, no allocator calls, no function calls beyond the primitive). Catches the "future contributor adds a reasonable-seeming improvement that silently expands the unsafe surface" failure mode that prose-as-discipline depends on reviewer attention to catch.
    • (R5-D4) New docs/FOLLOWUPS.md V3.0 entry: sibling PR (opens post-PR-#65 merge to dev; parallel-eligible with the Phase 2c implementation PR, not gated on it) to promote five 2c-emergent disciplines to project-level documentation (likely .cursor/rules/26-sub-pr-design-discipline.mdc with substantial prose, similar shape to 16-architectural-inheritance.mdc). The disciplines: function-body replacement contract; audit-against-actual-code; threat-model addenda framing; reversion-clause for sub-PR boundary changes; forward-action propagation convention. Scoped as a short-lived sibling per .cursor/rules/06-branching.mdc rule 2; opens within 5 working days of PR #65 merging; lands before Phase 2d Round 1's design doc cuts. Explicitly not a Round 5 deliverable per .cursor/rules/15-deletion-and-debt.mdc "while we're here is the enemy."

  • Posture-shift note (recorded for downstream sub-PRs). Round 4's threat-model framing converted "design closure" into design closure plus active defense against named attacker objectives. The shift is named in the §14 Round 5 entry so 2d Round 1, 2f Round 1, 2g Round 1, and LWMA-1 Phase 4's design rounds inherit the shape rather than revert to per-finding review — the threat-model-objective frame surfaces findings (mp, eviction interleave, FPU rounding-mode escape, u128 edge cases) that per-finding review wouldn't catch because no individual finding suggests the next one; the attacker-objective frame does.

  • Touched files. docs/completed/RANDOMX_V2_PHASE2C_PLAN.md (new; Rounds 1–5); docs/completed/RANDOMX_V2_PHASE2D_PLAN.md (new; Scaffold + Scaffold-R4 + Scaffold-R5); docs/design/RANDOMX_V2_PLAN.md (parent-plan alignment commits for F4 absorption, Decision #7 substrate-shift, Round 4 FFI/perf/risk carries, Round 5 FFI refinements); docs/FOLLOWUPS.md (Round 5 V3.0 entry).

• Phase 2a PR #62 — address Copilot review (post-Round-1 follow-up cycle). Doc-only commits on feat/randomx-v2-phase2a. Addresses five Copilot review findings surfaced against the Phase 2a initial commits (107d6f8ce, 9f854e0ce, f0d648fb2). The fixes cluster on two distinct substantive concerns in the _generator/ directory; the Rust test source and the production argon2d.rs primitive are unaffected.

  • Findings C1–C4 — "architecture-independent" wording is materially wrong (4 sites). The committed _generator/gen.c, _generator/Makefile, m8_t3_p1_shekyl_test_key.meta.txt, and m64_t3_p1_shekyl_test_key.meta.txt all asserted that the argon2_ref.c reference Argon2 implementation "keeps the produced bytes architecture-independent." That is wrong on endianness: gen.c's write_raw does a raw fwrite of block { uint64_t v[128] } memory, which serializes each uint64_t in the host's native byte order. The committed .bin files happen to be little-endian u64 streams because they were generated on a little-endian host (x86_64 Linux); regenerating on a big-endian host would silently produce different bytes and break the byte-for-byte test.

    Reworded each site to the accurate framing: the reference impl is instruction-set-independent (no AVX2/SSSE3 codegen variance across hosts that share a byte order), and the on-disk vector format is a little-endian u64 stream — the same format argon2d.rs's blocks_to_le_bytes produces in Rust via u64::to_le_bytes (per argon2d.rs:230-241). gen.c's comment additionally records the big-endian-host disposition: the fix if a future maintainer regenerates on big-endian hardware is to add a htole64-style serialization step in write_raw, not to redefine the on-disk format.

    Important asymmetry preserved: the Rust test side is already architecturally portable — blocks_to_le_bytes pins the LE convention on both sides regardless of Block's in-memory layout, so the cargo test path works correctly on big-endian targets. The bug was only on the C generator side and only in the comment claims, not in the bytes themselves (which are correct for the all-little-endian maintainer/CI fleet the project ships against).

  • Finding C5 — _generator/README.md provenance check command is broken (1 site). The "Reviewing the vectors" section documented diff -r . .. as the verification command. That compares the _generator/ directory's file set (gen.c, Makefile, README.md) against the parent directory's file set (*.bin, *.meta.txt); the file sets do not overlap, so diff -r always reports "only in" entries instead of the intended check (do the regenerated .bin files match the committed bytes?).

    Replaced with git diff --stat -- ../*.bin issued from inside _generator/. make vectors overwrites the committed bytes in-place; git diff --stat then asks git whether the working tree has drifted from HEAD on the specific .bin paths. A clean exit (no output) is the affirmative attestation that the committed bytes match the named fork pin. Added a paragraph explaining why the prior diff -r . .. command did not work so a future reviewer doesn't reintroduce the same shape.

  Gates. Doc/comment-only changes; no production Rust touched. cargo fmt --check, cargo clippy -p shekyl-pow-randomx --all-targets -- -D warnings, cargo test -p shekyl-pow-randomx, and cargo doc -p shekyl-pow-randomx --no-deps all clean. The Phase 2f forward-compatibility greps from RANDOMX_V2_RUST.md §7.2 (#[no_mangle], extern "C" fn, #[export_name], module-level runtime-mutable state) still return zero hits on the crate.

  Scope discipline note. C1–C4 land as a single commit because they are the same finding instance applied at four sites with identical content fixes (per 90-commits.mdc scope-per-commit rule — "scope" is the substantive change class, not the file count); C5 lands as a separate commit because it is a distinct finding (functional bug in a procedure command vs. wording precision). The Lean-A disposition (reword the comments to describe the constraint accurately) is preferred over Lean-B (add htole64 portability shims to gen.c) because the generator is a developer-machine-only artifact that runs on the project's all-little-endian maintainer fleet, and bundling portability shims for a host architecture nobody runs on is the cost-benefit-defer-to-later anti-pattern's mirror image per 16-architectural-inheritance.mdc. The big-endian-host disposition is recorded in gen.c's comment so a future maintainer who needs it knows the prescribed shape.

• Post-PR-4 docs/FOLLOWUPS.md cleanup (chore/post-pr4-followups-cleanup, 2026-05-21). Two scope-respecting doc-only commits closing the cleanup work that became actionable once PR 4 (commit fd6005e2a, merged 2026-05-21) landed. Scoped per the post-PR-4 FOLLOWUPS triage to Class A relocations (closed-but- mislocated entries) and D-item 481 substrate corrections, with Class B (P1 / P2 / P3) and Class C (F11-S Windows-midrange, refresh bandwidth under α) deliberately untouched to avoid the cost-benefit-defer-to-later anti-pattern of reflexive re-anchoring under 16-architectural-inheritance.mdc — their existing trigger language remains accurate and the merge SHA will be cited at each focused PR's open date.

  • Commit 1 — Relocate three [CLOSED 2026-05-20] PR 4 entries to Recently resolved (38a599fc6): docs/FOLLOWUPS.md gains three audit-trail entries relocated from the live queues, prose-verbatim with the [CLOSED 2026-05-20] prefix folded into the standard "(closed YYYY-MM-DD, merged to dev YYYY-MM-DD at SHA)" parenthetical the section uses, plus the dev-merge SHA fd6005e2a added for traceability:

    1. "Stage 1 retroactive Mock-X cleanup: MockLedger → LocalLedger::from_test_blocks(...) + FaultInjecting<LocalLedger>" (was V3.0 queue L697; PR 4 §7.X commit C6β),
    2. "Stage 1 retroactive Mock-X cleanup: MockDaemon → TestDaemon rename" (was V3.0 queue L744; PR 4 §7.X commit C6γ),
    3. "Stage 1 PR 4 Phase 0d — RefreshEngine checkpoint 3 mid-scan- reorg-abort extension: struck, not deferred" (was V3.x staker- archival queue L4116; PR 4 §7.X commit C8). The Phase-0d entry had one substrate-anchored cross-reference that became wrong in its new location (referenced ReorgAmplificationDetector as "below" — true in V3.x queue context, false in Recently-resolved context); rephrased to "(above, in the V3.x staker-archival queue)". Net diff: 117 insertions / 118 deletions (relocation-shape).

  • Commit 2 — Sharpen PR 3 engine-property test re-location entry (95ece3760): docs/FOLLOWUPS.md V3.0-queue entry "Stage 1 PR 3 engine-property test re-location" (~L481) gains two substrate-correctness fixes surfaced during the post-PR-4 cleanup triage that confirmed why the work is not completable in the current cleanup PR:

    1. Trigger anchor corrected from STAGE_1_PR_3_KEY_ENGINE.md §4.4 (which does not exist — §4 is the "Post-amendment §2.1 trait surface" and has no §4.4) to §7.7 ("V3.x full-PQC trait churn acknowledgement") + §3.4 Decision 4. Trigger reworded to name the V3.2 unified KeyEngine / LedgerEngine / DaemonEngine pub(crate) → pub visibility-promotion bundle explicitly, with an inline "unilateral KeyEngine widening does not satisfy this trigger" clause that prevents future maintainers from acting on a single-trait widening — re-introducing the trust-model incoherence the per-trait pub(crate) lock prevents per Stage 1's Trust-class A classification (PR 3 §2.1 trust-class table row for KeyEngine).
    2. M3b D5 peer-test name removed (the ..._subaddress peer test the pre-flight estimated was consolidated into the primary test's inner loop during M3b implementation; local_keys.rs:1278-1322). Added one-sentence pre-flight-vs-implementation note for cross-reference traceability to STAGE_1_PR_3_M3B_PREFLIGHT.md §D5. File:line anchors added for both tests (local_keys.rs:1258, :1554) and the inline test-docstring deviation notes (:1243-1251, :1538-1541). Disposition unchanged: entry remains open with the same V3.2 trigger and one-PR-covers-both-tests bundling guidance.

  Gates. Doc-only changes; no code touched. git diff shape verified to be relocation + substrate-correctness only; no live disposition re-anchoring. No CHANGELOG drift relative to the as- landed FOLLOWUPS state.

  Scope discipline note. The cleanup PR's scope was bounded explicitly against the user-named anti-pattern of continual re-anchoring without completion: items where the work cannot be completed at this time (P1 / P2 / P3, F11-S Windows-midrange, refresh bandwidth under α, the PR 3 engine-property test re-location itself) get their existing dispositions preserved verbatim, and the merge SHA fd6005e2a will be cited at each focused PR's open date per 21-reversion-clause-discipline.mdc's named-criteria principle. Only completable work (relocations + substrate-correctness fixes) lands here.

Added

• RandomX v2 Track A Phase 2b — AES + Blake2Generator + SuperscalarHash primitives + spec-vector parity tests (feat/randomx-v2-phase2b, 2026-05-21). Second sub-PR of the Rust pure-software RandomX v2 verifier port per docs/design/RANDOMX_V2_PLAN.md §"Track A — Phase 2" and the design plan docs/completed/RANDOMX_V2_PHASE2B_PLAN.md. 7-commit stack (6 designed + 1 rustfmt cleanup interleaved between commits 5 and 6 to absorb residue an editor save reintroduced into superscalar.rs between gate-runs) landing the remaining v2 primitives the verifier needs:

  • Commit 1 — AES round primitives + Blake2Generator + MSRV bump. cipher_round / equiv_inv_cipher_round at src/aes.rs wrapping aes-0.9.0::hazmat (_mm_aesenc_si128 / _mm_aesdec_si128 equivalent-inverse semantics, matching RandomX soft_aesenc / soft_aesdec). Blake2Generator PRNG at src/blake2_generator.rs per spec §3.5. Workspace rust-version = "1.85" pin for aes-0.9.0's edition-2024 MSRV, verified against the Guix substrate before pinning. F1 convergence on src/argon2d.rs's #[allow(dead_code)] from module-level to per-item attributes.
  • Commit 2 — AES composites. AesGenerator1R (state writeback), AesGenerator4R (no writeback), AesHash1R per spec §3.2–3.4. Initial state, generator keys, and extra- round keys ported as const [u8; 16] arrays via pack_le_u32x4 reproducing _mm_set_epi32(i3, i2, i1, i0)'s little-endian memory layout exactly.
  • Commit 3 — SuperscalarHash generator + executor. src/superscalar.rs implementing spec §6 + §7.2. Pure function call surface (no module-level mutable state) per permanent decision #6; #![deny(unsafe_code)] survives. Includes the §5.5 spec- silence audit table in the module rustdoc with 8 documented spec-silent decisions matching the C reference verbatim.
  • Commit 4 — AES spec-vector parity tests. 8 reference vectors at tests/vectors/reference/aes/ covering round primitives, the F6 chained-pair multi-round supplement, AesGenerator1R / 4R outputs, and AesHash1R on uniform + empty inputs. Reviewer-runnable C++ generator at _generator/ instantiates <softAes=true> templates to keep emitted bytes SIMD-codegen-independent.
  • Commit 5 — SuperscalarHash spec-vector parity tests. 7 reference vectors at tests/vectors/reference/superscalar/ per the F4 structured 3-vector decomposition: 3 Layer A program serializations (baseline / nonce-mixing / seed- derivation isolation), 3 Layer B executions against fixed r=[0..8], and 1 combined end-to-end attestation tuple. Test names encode the failure-mode attribution (vector_2_tests_nonce_mixing_only, etc.). Layer B decouples generation parity (Layer A) from execution parity; combined tests the full generate→execute pipeline without intermediate serialization. Wire format documented in _generator/README.md "Wire format" and in serialize_program / deserialize_program helpers.
  • Commit 6 — CHANGELOG + FOLLOWUPS entry (this commit). F7 AES symbol-surface handoff to V3.0 / Phase 3c recorded at docs/FOLLOWUPS.md; the live runnable check (cargo build --release && nm shekyld | grep -iE '(aes|randomx)') and its expected disposition (no randomx_* matches per RANDOMX_V2_RUST.md §7.1; aes-crate Rust-mangled symbols expected and benign) are recorded at the pre-genesis queue so the Phase 3c PR closes the item.
  • Phase 2b retains the Phase 2a forward-compatibility posture: no #[no_mangle], no extern "C" fn, no #[export_name], no module-level runtime-mutable state. #![deny(unsafe_code)] at the crate level. cargo test -p shekyl-pow-randomx succeeds without external/randomx-v2/ initialized and without a C++ toolchain — the live differential harness remains Phase 2g's separate artifact. Phase 2c–2e build on Phase 2b's primitives to deliver Vm, bytecode dispatch, and Cache::derive; Phase 3 then wires the verifier through shekyl-ffi; Phase 4 deletes the C++ verifier path.

• RandomX v2 Track A Phase 2a — shekyl-pow-randomx crate scaffold + Argon2d primitive (feat/randomx-v2-phase2a, 2026-05-21). First sub-PR of the Rust pure-software RandomX v2 verifier port per docs/design/RANDOMX_V2_PLAN.md §"Track A — Phase 2" and docs/design/RANDOMX_V2_RUST.md.

  • New workspace crate rust/shekyl-pow-randomx/ with crate-level rustdoc citing the Phase 0 decision substrate (spec-first per RANDOMX_V2_RUST.md §3; derived-first per §4; isolation invariants per §7).
  • pub(crate) fn fill_cache(key: &[u8], blocks: &mut [argon2::Block]) at src/argon2d.rs implementing the Cache Argon2d "memory fill" per external/randomx-v2/doc/specs.md §7.1 + Table 7.1.1 (parallelism = 1, memory = 262144 KiB = 256 MiB, iterations = 3, Argon2d, salt = "RandomX\x03"). Built on argon2 = "0.5.3"'s Argon2::fill_memory after verifying at source that the omit-finalizer path matches RandomX's spec-required surface (recorded in the module rustdoc). Constants and Params are compile-time validated.
  • Argon2d spec-vector parity tests at tests/vectors/reference/argon2d/: two derived vectors (m=8 boundary case; m=64 multi-segment) from argon2_ref.c at fork pin aaafe71 (v2.0.1), with per-file .meta.txt provenance headers and a reviewer-runnable _generator/ reproducer (gen.c, Makefile, README.md). The Rust tests consume pre-committed bytes via include_bytes!; no cargo test dev-dep on the C library (Phase 2g owns the live differential harness at full RandomX parameters).
  • Forward-compatible with Phase 2f's CI isolation invariants: no #[no_mangle], no extern "C" fn, no #[export_name], no module-level runtime-mutable state (no Mutex/RwLock/ OnceCell/OnceLock/Lazy/static mut/atomics-at-module-scope). #![deny(unsafe_code)] at the crate level.
  • Phase 2a scope is purely additive: no FFI surface, no C++ caller rewire, no deletion of src/crypto/rx-slow-hash.c (those are Phase 3a/3b/3c/4). Phase 2b lands AES round + SuperScalarHash next.

• Stage 1 closeout audit tracking (2026-05-27, post–PR #81; updated 2026-05-29 post–PR #88). Records Stage 1 trait-extraction status in FOLLOWUPS.md V3.0 queue and cross-refs V3_ENGINE_TRAIT_BOUNDARIES.md §8.1 / §1 banner plus WALLET_REWRITE_PLAN.md. Dedicated audit markdown now landed: docs/completed/STAGE_1_COMPLETION_AUDIT.md.

• Stage 1 PR 5 — PendingTxEngine trait surface and Phase 1 substrate (feat/stage-1-pr5-pending-tx-engine, 2026-05-27). Lands the Round-3-closed PendingTxEngine trait, the (γ) lean three-collection reservation model, secondary-engine trait seams, and Engine<S, D, L, R, P> orchestration dispatch per docs/design/STAGE_1_PR_5_PENDING_TX_ENGINE.md §4 / §5.0 / §7.X (C0 = 4466d153e … C7 = ca7622558; C8 doc commit follows).

  • pub trait PendingTxEngine: Send + Sync + 'static at engine/traits/pending_tx.rs with build / submit / discard / outstanding / optional signal_mempool_evicted (C5α/β).
  • pub struct LocalPendingTx<S, O, F> at engine/local_pending_tx.rs as the V3.0 production P parameter default for Engine<S, D, L, R, P> (C5β).
  • pub struct SnapshotId([u8; 16]) and domain-separated derive_snapshot_id(&LedgerSnapshot) (C1).
  • Submit-path error vocabulary: SubmitError, TerminalErrorKind, AmbiguousErrorKind, DiscardReason, ReservationExtension, PendingTxError augmentations (C2).
  • pub enum PendingTxDiagnostic + emit_pending_tx helper on DiagnosticSink (C3); AssertionSink / PanickingSink pending-event recording for tests (C7).
  • Secondary-engine traits: Signer + LocalSigner (C4α), OutputSelector + WalletGreedyOutputSelector (C4β), FeeEstimator + DaemonFeeEstimator (C4γ).
  • FaultInjecting<P: PendingTxEngine> FIFO fault-injection wrapper under #[cfg(any(test, feature = "test-helpers"))] (C7); Engine::replace_pending_tx test hook (C6).

• Stage 1 PR 4 — RefreshEngine trait surface (feat/stage-1-pr4-refresh-engine, 2026-05-15 → 2026-05-20). Lands the Phase-0a-binding RefreshEngine trait and the ViewMaterial adjacent type per docs/design/STAGE_1_PR_4_REFRESH_ENGINE.md §4 Phase 0a + Phase 0c + Phase 0e and docs/V3_ENGINE_TRAIT_BOUNDARIES.md §2.3 (PR 4 C0 = 322677261; C1 = d3edc1abb).

  • pub trait RefreshEngine: Send + Sync + 'static at engine/traits/refresh.rs with one async method produce_scan_result(snapshot: LedgerSnapshot, daemon: &D, opts: &RefreshOptions, cancel: &CancellationToken, progress: &watch::Sender<RefreshProgress>, diagnostics: &dyn DiagnosticSink) -> Result<ScanResult, Self::Error> and type Error: Into<RefreshError>.
  • Five-checkpoint cancellation discipline (1 / 4 on the orchestrator; 2 / 3 / 5 on the trait body; checkpoint 5 is the per-transaction inner check per §5.4.9 F2 + F11 + F11-S safe-point pins).
  • Self::Error is unit-variant-only at the trait surface per §5.4.7 R6 reframe: rich structured diagnostic information flows through the &dyn DiagnosticSink second channel; the synchronous return is a structural- branch signal only. Of RefreshError's six variants, three are reachable from a RefreshEngine impl's Self::Error via Into (Cancelled unit, Io(IoError), InternalInvariantViolation { context: &'static str }); three are orchestrator-constructed only (MalformedScanResult at the merge layer; ConcurrentMutation at the merge gate; AlreadyRunning at binary-layer single-flight).
  • ScanResult atomicity-under-cancellation contract: produce_scan_result returns either a ScanResult covering the full span it scanned or RefreshError::Cancelled — no partial-span result is ever returned (R7 disposition).
  • LedgerSnapshot is passed by value (R5 + §5.4.5): the orchestrator constructs under the engine read-guard, drops the guard, and hands the snapshot to the producer by move; the snapshot carries reorg-window descriptors only and is cheap to clone.
  • &D daemon-handle borrow with the §2.5 Clone + Send + Sync + 'static bound on D, so implementors can clone internally if they need an owned handle to spawn work (e.g., parallel block-fetch refinements); implementors MUST NOT borrow &D across a tokio::spawn boundary.
  • pub struct ViewMaterial { spend_pub: EdwardsPoint; view_scalar: Zeroizing<Scalar>; x25519_sk: Zeroizing<[u8; 32]>; ml_kem_dk: Zeroizing<Vec<u8>>; spend_secret: Zeroizing<[u8; 32]> } at engine/view_material.rs with Zeroize + ZeroizeOnDrop derived; capturing the view-and-spend material at LocalRefresh::new so the Scanner builds once and is held for the instance lifetime (no per-attempt scanner construction; no per-attempt secret duplication; R4 a-instance-scoped).
  • The LocalRefresh implementor at engine/local_refresh.rs (PR 4 C4 = ac100e1ab) is the V3.0 production R parameter for Engine<S, D, L, R>; future implementors (Stage 4 actor-mesh RefreshActor; any future producer variant) implement the same trait surface.

• Stage 1 PR 4 — RefreshDiagnostic enum + DiagnosticSink trait + Stage 1 sink implementations (PR 4 C2 = 8fc207051; SuppressedRateLimit variant per Round 4 review pass F6 = same commit). Lands the second channel of the two-channel error / diagnostic actor-mesh seam per docs/design/STAGE_1_PR_4_REFRESH_ENGINE.md §5.4.7 R6 reframe + §5.4.8 attack-surface dispositions.

  • pub enum RefreshDiagnostic at engine/diagnostics.rs with #[non_exhaustive] and the Round-4-audit-confirmed Stage 1 variant set: DaemonMalformed { kind: MalformedKind }, DaemonTimeout { op: DaemonOp, elapsed: Duration }, DaemonProtocolError { kind: ProtocolErrorKind }, ReorgObserved { fork_height: u64, depth: u32 }, ScanProgress { height: u64, candidates: u32 }, and the Round-4-F6-added SuppressedRateLimit { class: SuppressedClass }.
  • Supporting bounded enums (MalformedKind, DaemonOp, ProtocolErrorKind, SuppressedClass), all #[non_exhaustive]; SuppressedClass carries one arm per rate-limited event class (DaemonMalformed, DaemonTimeout, DaemonProtocolError, ReorgObserved, ScanProgress). The SuppressedRateLimit variant carries only class: SuppressedClass — no count, no timing, no original-event payload — per the §5.4.8 #5 F13-pin closing the suppressed-event-count covert channel back from the producer's internal state.
  • pub trait DiagnosticSink: Send + Sync + 'static with one method fn emit(&self, event: RefreshDiagnostic). Trait-level contract pins (rustdoc): emission is non-blocking (extends to non-blocking under concurrent emission, foreclosing Mutex<VecDeque<_>>- style implementations that re-introduce the producer- liveness hazard at scale); emission/return coherence (every non-Cancelled Err return is preceded by at least one corresponding RefreshDiagnostic emission before the error returns, with AssertionSink-driven property tests at C7 as the canonical reference per 19-validation-surface-discipline.mdc); per-emitter FIFO ordering preserved (the seventh contract pin added by Round 4 review pass F4 = §5.4.6; cross-emitter ordering is undefined); and the in-process-only trust-boundary contract per §5.4.6 / §5.4.8 #4 (full-fidelity RefreshDiagnostic consumers MUST live inside the wallet trust boundary recursively; cross-process / network-bound consumers receive only projection types sanitized at the boundary).
  • pub struct NoopDiagnosticSink + pub struct TracingDiagnosticSink ship as the Stage 1 sink implementations; TracingDiagnosticSink::emit routes per-class projections to tracing::event! per the Round-4-review-pass F9 audit (variant tag only for DaemonMalformed / DaemonProtocolError / SuppressedRateLimit; bucketed elapsed for DaemonTimeout; bucketed depth for ReorgObserved; bucketed candidates for ScanProgress with height elided), not the full RefreshDiagnostic Debug impl.
  • All trait + enum surface re-exported flat at the shekyl_engine_core crate root per the R3 pattern.

• Stage 1 PR 4 — C6 no-Mock substrate pass (RefreshEngine / LedgerEngine failure-injection wrappers) (feat/stage-1-pr4-refresh-engine, 2026-05-20). Lands the C6α + C6β sub-commits of PR 4's substrate pass per the Round 5 amendment (commit 8484e669a) and sub-pin extension (commit 29cb7e138, F-Mock-1 through F-Mock-8). The pass closes the docs/FOLLOWUPS.md "Stage 1 retroactive Mock-X cleanup: MockLedger → LocalLedger::from_test_blocks(...)

  • FaultInjecting<LocalLedger>" entry and applies the no-Mock pattern PR 3 established (production-only implementors + composable trait-level FaultInjecting<T> wrappers) to PR 2's inherited MockLedger parallel-implementation.

  C6α — FaultInjecting<R: RefreshEngine> wrapper + test-helpers feature (commit e9310542a):

  • Adds test-helpers = [] Cargo feature to rust/shekyl-engine-core/Cargo.toml (mirrors the bench-internals precedent) gating the C6 test-helper surfaces with #[cfg(any(test, feature = "test-helpers"))] per the F-Mock-1 symmetry pin.
  • Adds engine/fault_injecting_refresh.rs implementing FaultInjecting<R: RefreshEngine> with the Option (i) wrapper API (type Error = RefreshError; FIFO Mutex<VecDeque<RefreshError>> queue; queue_failure(err) general injector; queued_failures() drain inspector; debug_assert!-on-Drop queue-drain contract per F-Mock-2).
  • Adds Engine::replace_refresh test-only setter on engine/lifecycle.rs mirroring the existing replace_daemon / replace_ledger helpers.
  • Adds Class 1 trait-surface smoke tests covering empty-queue passthrough, single-injection-then-delegation, multi-injection FIFO ordering, and #[should_panic] queue-drain-on-teardown.

  *C6β — FaultInjecting<L: LedgerEngine> + LocalLedger::from_test_blocks

  • MockLedger retirement*:
  • Adds engine/fault_injecting_ledger.rs implementing FaultInjecting<L: LedgerEngine> with the same Option (i) wrapper shape (queue-of-RefreshError, queue_failure / queue_concurrent_mutation / queued_failures, debug_assert!-on-Drop). Not Clone by design — the prior MockLedger's Arc<Mutex<…>> aliasing shape (inherited from CryptoNote test patterns) does not survive the no-Mock transition.
  • Adds test-only LocalLedger::from_test_blocks(Vec<Block>) constructor at engine/local_ledger.rs. The V3.0 substrate supports the empty-Vec case only (the sole shape every existing MockLedger-replaced caller needs); non-empty Vec panics with a forward-pointer to the V3.1 TestLedgerBuilder substrate-design FOLLOWUPS entry. The Vec<Block> signature is load-bearing — V3.1's substrate consumes the body without a signature change per the rationale recorded in the constructor's rustdoc.
  • Migrates the §5.2 hybrid retry integration test hybrid_apply_scan_result_retries_on_concurrent_mutation (in engine/refresh.rs) from MockLedger::with_seed(...) + queue_concurrent_mutation() to FaultInjecting::new(LocalLedger::from_test_blocks(Vec::new()))
    • queue_concurrent_mutation(). The wrapper's non-Clone posture required restructuring the assertion sites from a cloned handle to read-guard access through the engine's Arc<RwLock<Engine<…>>>; this is the structurally-correct shape (single owner per the no-Mock substrate-inheritance discipline).
  • Deletes MockLedger + MockLedgerState + ROLE_LEDGER + associated rustdoc + contract tests + derive_seed_pinned_fixture_for_role_ledger test from engine/test_support.rs (ROLE_LEDGER becomes dead weight because LocalLedger's from_test_blocks is deterministic and consumes no seed; the ROLE_DAEMON HKDF-derivation pinned-fixture test in the same module covers the underlying derivation mechanism).
  • Updates the stale MockLedger reference in docs/V3_ENGINE_TRAIT_BOUNDARIES.md §1.2 (the only active-doc factual claim that named MockLedger as the current substrate; the broader historical references in §§4+ and the PR 2 / PR 3 design docs remain as historical-record prose per the 15-deletion-and-debt.mdc "while we're here" discipline).

  C6γ — MockDaemon → TestDaemon rename:

  • Mechanical rename of the test-substitute type and every call site across engine/test_support.rs (struct, impl Rpc, impl DaemonEngine, module docstrings), engine/refresh.rs, engine/lifecycle.rs, engine/mod.rs, benches/common/engine_fixture.rs (forward-pointer comment), and Cargo.toml (ChaCha20Rng rationale comment).
  • Structural shape unchanged — the type is still an alternative real implementation that serves canned / cached test responses without network connectivity (per PR 3 §2.1.2's distinction between "alternative real implementation" and "parallel- implementation fake"). Only the naming changed: TestDaemon signals the role correctly per the no-Mock substrate- inheritance discipline.
  • Active-doc trajectory updates in docs/V3_ENGINE_TRAIT_BOUNDARIES.md §1.2 (Generic DaemonClient trajectory row), §1.4 rename-chain note, §6.1 hybrid-test discussion, §6.2 RNG-seed pin, §3.5 Rpc-impl rationale, and the §"Linked file paths" inventory entry (rename chain extended: MockRpc → MockDaemon → TestDaemon).

  Test gates (post-C6). cargo fmt --all -- --check clean; cargo clippy -p shekyl-engine-core --all-targets --features test-helpers -- -D warnings clean; cargo clippy -p shekyl-engine-core --all-targets -- -D warnings clean (default features); cargo test -p shekyl-engine-core --lib 152/152 pass including the migrated hybrid retry test; cargo check -p shekyl-engine-core (default + --features test-helpers + --tests + --benches + --workspace --tests) all green.

  C7 — hybrid retry test + property tests (AssertionSink / PanickingSink) (commit c9e65bbc6):

  • Refactors Engine::replace_refresh at engine/mod.rs from a &mut self setter into a consume-and-rebuild constructor (fn replace_refresh<R2: RefreshEngine>(self, refresh: R2) -> Engine<S, D, L, R2>) mirroring the existing replace_daemon / replace_ledger shape at engine/lifecycle.rs. The refactor lets the generic R type parameter change between construction and replacement so test orchestration can build an Engine<…, LocalRefresh> at assemble time and rewire it to Engine<…, FaultInjecting<LocalRefresh>> for failure-injection scenarios without going through a dyn-erased trait object.
  • Adds AssertionSink, PanickingSink, and the PanickingSinkTrigger configuration enum to engine/diagnostics.rs, all gated #[cfg(any(test, feature = "test-helpers"))] per the F-Mock-1 cfg-symmetry pin. AssertionSink records emitted RefreshDiagnostic events for post-hoc coherence assertions; PanickingSink panics on configured trigger events to exercise producer panic-safety.
  • Adds proptest = "1" as a dev-dependency in rust/shekyl-engine-core/Cargo.toml powering the new producer property tests below.
  • Adds the hybrid retry test hybrid_refresh_engine_orchestrator_cancellation_retries at engine/refresh.rs that exercises the producer-trait / orchestrator cancellation-checkpoint split end-to-end against the fully-composed Engine<SoloSigner, TestDaemon, FaultInjecting<LocalLedger>, FaultInjecting<LocalRefresh>> stack, verifying the orchestrator retries on ConcurrentMutation (driven by FaultInjecting<LocalLedger>::queue_concurrent_mutation) and surfaces cancellation cleanly when FaultInjecting<LocalRefresh> injects RefreshError::Cancelled.
  • Adds the producer_property_tests module at engine/local_refresh.rs with five parametric coherence tests, one proptest!-driven fuzz test (coherence_proptest_fuzz_chain_and_injection) exercising randomized chain length + failure-injection scenarios, four panic-safety tests verifying clean unwind through PanickingSink panics across DaemonMalformed / DaemonProtocolError / ScanProgress / Any triggers plus a recovery test, and a classifier sanity test. The coherence tests exercise the §5.4.6 emission/return coherence pin: every non-Cancelled RefreshError is preceded by a corresponding RefreshDiagnostic emission. The panic-safety tests verify the §5.4.6 producer-side robustness property: Scanner zeroizes cleanly via Drop across a panicking emit, cancellation-token state remains well-defined, and the refresh attempt fails predictably without corrupting interior state. Tests are deterministic via a compile-time-generated PROPERTY_TEST_MASTER_SEED and #[tokio::test(start_paused = true)] for fake-time async scheduling.

  Test gates (post-C7). cargo fmt --all -- --check clean; cargo clippy -p shekyl-engine-core --all-targets --features test-helpers -- -D warnings clean; default-feature clippy clean; cargo test -p shekyl-engine-core --features test-helpers --lib 170/170 pass (152 → 170: +18 C7 tests); cargo doc -p shekyl-engine-core --features test-helpers --no-deps green with no new doc warnings (pre-existing intra-doc-link warnings to private items are baseline and unrelated to C7 changes).

  C8 — docs propagation (this commit):

  • This CHANGELOG entry extended with the C7 sub-section above and the C8 sub-section here.
  • docs/design/STAGE_1_PR_4_REFRESH_ENGINE.md gains the Phase-1-landed Status-banner closure paragraph enumerating C0–C8 landing SHAs; §7.X gains per-Commit Cn Landed: lines anchoring each commit's SHA inline next to the design-time prose.
  • docs/V3_ENGINE_TRAIT_BOUNDARIES.md §2.3 past-tenses the "Stage 1 surface" header and cross- references the as-landed implementation locators (engine/traits/refresh.rs, engine/diagnostics.rs, engine/local_refresh.rs, engine/mod.rs, engine/fault_injecting_refresh.rs, engine/fault_injecting_ledger.rs) with their commit SHAs (C1 / C2 / C4 / C5a / C6α / C6β).
  • docs/FOLLOWUPS.md gains a Phase 0d explicit retirement note ("struck, not deferred") at the top of the V3.x section, distinguishing the Round 2 composition reframe's struck-candidate from the live R5 / R6 / R4 (c) V3.x consumer-actor deferrals that remain open per Round 3's prior amendments. The pre- existing closed-entries for Mock-X cleanup (MockLedger → FaultInjecting<LocalLedger> + LocalLedger::from_test_blocks and MockDaemon → TestDaemon) carry the [CLOSED 2026-05-20] marker from C6β / C6γ landing and are unchanged in C8.

  C9 — FOLLOWUPS P1 / P2 / P3 re-anchor post-Phase-1 landing (this commit):

  • Doc-only follow-up commit; not in the original Round 4 C0–C8 decomposition but added post-PR-open per the user-directed "correct known document errors within the current PR" trigger (per .cursor/rules/91-documentation-after-plans.mdc's stale-doc detection discipline and .cursor/rules/15-deletion-and-debt.mdc's "deferred without a named home is the failure mode" framing). Surfaced during a post-C8 review of docs/FOLLOWUPS.md against the actual code state in engine/local_ledger.rs:356–367 (trait-method apply_scan_result discards Vec<usize> and short- circuits populate_engine_handle_fields) and engine/merge.rs:181–215 (inherent Engine::apply_scan_result runs the post-pass against the captured inserted indices) — the two paths diverge by construction in the post-Phase-1 substrate.
  • docs/FOLLOWUPS.md P1 / P2 / P3 entries rewritten with Post-PR-4-Phase-1 substrate subsections
    • substrate-anchored reopening criteria per .cursor/rules/21-reversion-clause-discipline.mdc. The pre-Phase-1 "defer to PR 4" dispositions all assumed α/β/γ Round 1 would reshape the producer/consumer pattern and the LedgerEngine::apply_scan_result trait surface, absorbing P1 / P2 / P3 as a side effect. Phase 1 settled on α (preserved current shape; trait surface unchanged) per STAGE_1_PR_4_REFRESH_ENGINE.md §5.4 Round 1, and did not absorb the three items. P1's hard precondition ("PR 4 lands before any binary integrates RefreshHandle") survives intact and is restated as "P1 closes before any binary integrates RefreshHandle". Each entry's re-anchored disposition names a focused follow-up PR landing V3.0 pre-genesis: P1 → refresh/p1-async-path-post-pass (two candidate closing shapes both feasible against the post-Phase-1 substrate — shape (b) RefreshEngine owns the merge post-pass is newly available because PR 4 landed the RefreshEngine trait at C1 / C4); P2 → refresh/p2-wallet-birthday-plumbing (substrate well-defined: LocalRefresh::new is the V3.0 production implementor per C4 = ac100e1ab); P3 → downstream of P1, closes alongside P1 in the same focused PR (both candidate P1-closing shapes close P3 as a side effect; P3 stays catalogued separately to preserve the Copilot PR #37 audit trail).
  • docs/design/STAGE_1_PR_4_REFRESH_ENGINE.md §5.5 named-home table rows P1 / P2 / P3 updated with a bold Phase 1 landed without absorption marker plus one-sentence cross-refs to the re-anchored FOLLOWUPS dispositions, preserving the §5.5 audit-trail discipline per 15-deletion-and-debt.mdc.
  • STAGE_1_PR_4_REFRESH_ENGINE.md §7.X Status banner extended to enumerate C9 alongside C0–C8; the same §7.X gains a new **Commit C9 — FOLLOWUPS P1 / P2 / P3 re-anchor post-Phase-1 landing** block documenting design-time intent and landing SHA, mirroring the per-commit documentation pattern from C0–C8.
  • Gate inheritance from C8: C9 is doc-only, so cargo fmt --check, cargo clippy -- -D warnings, cargo test --lib, and cargo doc --no-deps all inherit C8's results unchanged (170 / 170 lib tests pass; fmt clean; clippy clean under both default and test-helpers features; 48 doc warnings unchanged at the C7 baseline).

  C10 – C13 — Copilot post-PR-open review responses:

  • Four small post-PR-open commits closing the nine line-anchored findings the GitHub Copilot review raised against 95affda61 (C8 head before C9 push) on PR #60. Each commit is scoped to a single concern (file + correction class) per .cursor/rules/90-commits.mdc's scope-per-commit discipline; each commit cites its Copilot finding IDs in the commit message body. Doc-only / harness-only; no API surface, no trait body, and no production code-path touched.
  • C10 60f401e77 — scanner rustdoc fn-name corrections in rust/shekyl-scanner/src/scan.rs. Six sites updated from pre-C4 scan_transaction to C4-landed scan_transaction_with_cancel, plus the gate-test rustdoc return-type updated from Ok(Timelocked::empty()) to Ok(ScanOutcome::Completed(Timelocked(empty))) to match the actual ScanOutcome variant the gate returns. Closes Copilot finding IDs 3278232594 / 3278232649 / 3278232666 / 3278232686 plus two same-class adjacent sites discovered during the audit.
  • C11 949e42bd8 — bench_fixtures rustdoc fact-fix in rust/shekyl-scanner/src/bench_fixtures.rs. The make_bench_wallet spend-secret comment cited the on-chain spend point as the basepoint when fake_spend_key_bytes() actually returns 2 * G. The fake_spend_key_bytes() rustdoc opening was internally contradictory and is rewritten as a clean three-property justification (torsion-free; non-default; distinct from G). Behaviour unchanged — fake_spend_key_bytes() body still returns (2 * G).compress().to_bytes() byte-identically; F11-S cold-cache audit-trail unaffected. Closes Copilot finding IDs 3278232628 / 3278232770.
  • C12 20b082a38 — refresh-trait checkpoint-list temporal-firing-order explanation in rust/shekyl-engine-core/src/engine/traits/refresh.rs. The RefreshEngine trait rustdoc lists checkpoints in temporal-firing order (1 → 2 → 3 → 5 → 4) rather than numeric order. Copilot read this as out-of-order, but the numbering is repo-wide audit-trail convention preserving "checkpoint 5 added per PR 4 Round 4 F2". Synchronized renumbering would touch 12+ cross-reference sites and dissolve the F2-audit-trail provenance; rejected per .cursor/rules/21-reversion-clause-discipline.mdc's substrate-anchored disposition. Fix applied: add an explanatory paragraph to the trait rustdoc that names the temporal-firing-order convention explicitly so the question isn't re-litigated. Closes Copilot finding ID 3278232791.
  • C13 262ece667 — scan-transaction warm-cache bench harness clone-out-of-timed-region fix in rust/shekyl-scanner/benches/scan_transaction.rs. Both warm-cache benchmark variants used iter_batched_ref with an in-routine mem::replace(b, block.clone()), placing ScannableBlock::clone inside the timed region. Switched to iter_batched(|| block.clone(), |block| scanner.scan(block), ..) so the clone is in the setup closure and only Scanner::scan is measured. F11-S audit-trail impact: ZERO — the F11-S binding measurement (per docs/design/STAGE_1_PR_4_REFRESH_ENGINE.md §3.1 / §5.4.9 / §7.Y) is anchored on the cold-cache N=16 worst-case p99 (12.95 ms per-tx / 819 µs per-output), and the cold variant was already methodologically correct (all setup outside the timed region). Captured F11-S numbers at a4da2212a and the C4 per-output safe-point disposition stand without revision. Closes Copilot finding IDs 3278232713 / 3278232736.
  • Gates per commit: each commit ran its scoped bisection- discipline gates against the affected crate (shekyl-scanner for C10 / C11 / C13; shekyl-engine-core for C12). Test counts and doc- warning baselines unchanged: 57 / 57 scanner lib tests pass; 170 / 170 engine-core lib tests pass; scanner doc warnings = 2 (C8 baseline); engine-core doc warnings = 49 (C9 baseline). C13 additionally ran cargo check --benches to confirm the bench targets compile under the new iter_batched shape.

  C14 — [Unreleased] doc-after-plans propagation for C10 – C13 (this commit):

  • Doc-only follow-up commit per .cursor/rules/91-documentation-after-plans.mdc's final-task-always rule. After C10 / C11 / C12 / C13 landed locally with green gates, the design doc §7.X Status banner (line ~478) was extended to enumerate C10 – C13 alongside C0 – C9 with landing SHAs and per-commit one-paragraph summaries, and the §7.X commit-block section gained a new **Commits C10 – C13 — Copilot post-PR-open review responses.** block with the same per-commit prose + F11-S impact statement + gate evidence. The C9 block's placeholder **Landed: this commit** was replaced with the landed SHA 839c4bbfd. This *C10 – C13 — Copilot post-PR-open review responses* subsection above is the matching CHANGELOG entry; the doc-after-plans propagation also updates the closing C0–C13 paragraph below.
  • Gate inheritance from C13: C14 is doc-only, so the cargo fmt --check, cargo clippy --all-targets -- -D warnings, cargo test --lib, and cargo doc --no- deps gates all inherit C13's results unchanged (no rust files touched in C14).

  C15 – C16 — Copilot second-round review responses:

  • Two small post-PR-open commits closing the four additional line-anchored findings the GitHub Copilot reviewer raised against 30798d783 (the C14 push head) on PR #60. Both batches touch engine/-side rustdoc and harness surfaces only; doc-only / harness-only; no API surface, no trait body, and no production code-path touched. Each commit cites its Copilot finding IDs in the commit message body per .cursor/rules/90-commits.mdc.
  • C15 bafb9c548 — refresh-trait [LocalRefresh] rustdoc link target fix in rust/shekyl-engine-core/src/engine/traits/refresh.rs. Two [LocalRefresh] reference-link aliases (lines 204 + 258 of the RefreshEngine trait file) pointed at super::super::Engine instead of super::super::LocalRefresh. The misroute was silent (the alias target is a valid path; rustdoc accepts it) but the rendered docs at the two body sites (lines 48 and 244) linked "LocalRefresh" to the Engine struct rather than LocalRefresh. Correct target verified at source: LocalRefresh lives at engine/local_refresh.rs:250, re-exported at engine/mod.rs:187; from engine::traits::refresh, super::super::LocalRefresh resolves through the re-export (matching the working precedent at engine/fault_injecting_refresh.rs:105). Closes Copilot finding IDs 3278391428, 3278391456.
  • C16 376e1e821 — FaultInjecting<R> + FaultInjecting<L> Drop-time debug_assert! message fix in rust/shekyl-engine-core/src/engine/fault_injecting_refresh.rs and rust/shekyl-engine-core/src/engine/fault_injecting_ledger.rs. Both Drop messages told test authors to "drain via queued_failures() and consume_or_inject". Neither instruction was usable: consume_or_inject does not exist anywhere in the workspace (rg -nF 'consume_or_inject' returned only the two message-body sites — leftover prose from an earlier API draft), and queued_failures() is a usize inspector, not a drain. Rewritten to direct readers at the real drain mechanism — produce_scan_result(..) for the refresh wrapper, apply_scan_result(..) for the ledger wrapper — with queued_failures() cited explicitly as the inspector. The two #[should_panic(expected = ...)] test attributes (fault_injecting_ledger.rs:528, fault_injecting_refresh.rs:590) re-pinned to the new substring shape in the same commit per scope-per- commit discipline (mechanical follow-on of the production-message edit). The refresh-side should_panic had also been pinned on the older "FaultInjecting" (without <R>) spelling; both ledger and refresh assertions now consistently include the generic-parameter suffix. Closes Copilot finding IDs 3278391467, 3278391479.
  • Gates per commit: each ran its scoped bisection- discipline gates against shekyl-engine-core (fmt --check, clippy --all-targets -- -D warnings, test --lib, doc --no-deps). C15 doc-only (rustdoc-target); C16 production message + same-scope should_panic re-pin. Test counts unchanged at 170 / 170 lib tests pass; doc warnings unchanged at 49 (C9 baseline). The two re-pinned should_panic tests both confirm the new substrings.

  C17 — [Unreleased] doc-after-plans propagation for C15 – C16:

  • Doc-only follow-up per .cursor/rules/91-documentation-after-plans.mdc's final-task-always rule. After C15 / C16 landed locally with green gates, the design doc §7.X status banner was extended to enumerate C14 / C15 / C16 alongside C0 – C13 with landing SHAs and per-commit one-paragraph summaries, and the §7.X commit-block section gained a new **Commits C15 – C16 — Copilot post-PR-open second-round review responses.** block with per-commit prose + Copilot finding IDs + gate evidence. This *C15 – C16 — Copilot second-round review responses* subsection above is the matching CHANGELOG entry; the doc-after-plans propagation also updates the closing C0–C20 paragraph below.
  • Gate inheritance from C16: C17 is doc-only, so the cargo fmt --check, cargo clippy --all-targets -- -D warnings, cargo test --lib, and cargo doc --no-deps gates all inherit C16's results unchanged (no rust files touched in C17).

  C18 – C20 — Copilot third-round review responses:

  • Three small post-PR-open commits closing the three additional line-anchored findings the GitHub Copilot reviewer raised against 966154d27 (the C17 push head) on PR #60. The findings clustered on substantive discipline questions rather than rustdoc cosmetics: F11-S cancellation safe-point completeness, dead-arm invariant enforcement, and cryptographic-decoding constant-time-or-explicit-rejection discipline. Each commit cites its Copilot finding ID in the commit message body per .cursor/rules/90-commits.mdc.
  • C18 6cc22965f — Scanner::scan_with_cancel per-tx safe-point cancellation check in rust/shekyl-scanner/src/scan.rs. The F11-S binding's between-tx safe-point per RefreshEngine trait rustdoc checkpoint 5 was delivered only via the inner per-output iter-0 check inside scan_transaction_with_cancel. For transactions whose per-output loop never runs (zero-output txs; tx.version() != 2; malformed extra; oversized per the defense-in-depth size gate) the inner check is bypassed and the outer per-tx loop delegated straight back without cancellation opportunity. Worst case: a block of N such transactions deferred cancellation by N × O(1)-per-tx-skip cost rather than bounded at a single tx-entry's cost. Fix adds if is_cancelled() { return Cancelled } at the outer per-tx loop entry, rewrites the misleading "subsumed by per-output check at iter 0" comment to describe the new two-checkpoint shape, and adds the outer_per_tx_loop_cancellation_fires_for_zero_output_tx regression test (V2 miner-only block via Input::Gen(0) + empty outputs/extra). The cancel_tests module rustdoc was simultaneously updated from a three-axis to a four-axis taxonomy naming the outer-loop per-tx boundary explicitly. F11-S benchmark impact: zero — added check is one closure invocation per tx, a few nanoseconds amortized across N_outputs per tx and well below the F11-S worst-case per-output cost. Closes Copilot finding ID 3278452877.
  • C19 5749f444c — dead ScanOutcome::Cancelled arm debug_assert! in InternalScanner::scan in rust/shekyl-scanner/src/scan.rs. The function delegates to scan_with_cancel with a never-cancelling closure (|| false); under the closure-invariant, the Cancelled variant is unreachable. The previous code mapped the unreachable variant to Ok(Timelocked(Vec::new())) for production-panic-free behavior — but the empty-result fallback would silently mask future logic-dispatch regressions. Fix adds debug_assert!(false, …) naming the closure-invariant before the empty-result fallback, so debug-mode tests catch the violation immediately while production behavior is unchanged. Discipline (preferring debug_assert! over unreachable!()) named in the same arm's comment so a future refactor preserves the rationale. Closes Copilot finding ID 3278452893.
  • C20 3331fb82e — ViewMaterial::try_from_keys view_scalar canonical-bytes decoding in rust/shekyl-engine-core/src/engine/view_material.rs. The previous reconstruction via Scalar::from_bytes_mod_order(*keys.view_sk .as_canonical_bytes()) silently reduces non-canonical / corrupted input to a canonical scalar — masking in-memory corruption of view-key state and producing a scalar that is NOT the wallet's actual view secret on bad input. The same construction site (lines 211–222) validates keys.spend_pk with explicit IoError::Scanner on non-canonical bytes; the asymmetric treatment of view-scalar vs. spend-public-key was not justified by the threat model. Fix switches to Option::<Scalar>::from(Scalar::from_canonical_bytes(...)) .ok_or_else(|| RefreshError::Io(IoError::Scanner { detail: ... }))?. On canonical input the resulting scalar is bit-identical to the pre-fix output; on non-canonical input the conversion returns None and maps to RefreshError::Io(IoError::Scanner) with an operator-actionable detail string. The rustdoc's field-derivation summary and # Errors block were both updated to describe the new shape and cite 30-cryptography.mdc's constant-time-or-explicit- rejection discipline as the anchor. Closes Copilot finding ID 3278452905.
  • Gates per commit: each ran its scoped bisection-discipline gates against the touched crate (C18 / C19: shekyl-scanner; C20: shekyl-engine-core) plus downstream shekyl-engine-core regression for the scanner-side changes (fmt --check, clippy --all-targets -- -D warnings, test --lib, doc --no-deps). Scanner test count: 57 → 58 (C18 added regression test; C19 unchanged). Engine-core test count unchanged at 170 / 170 lib tests pass. Scanner doc warnings unchanged at 2 (C8 baseline). Engine-core doc warnings unchanged at 49 (C9 baseline).

  C21 — [Unreleased] doc-after-plans propagation for C18 – C20 (this commit):

  • Doc-only follow-up per .cursor/rules/91-documentation-after-plans.mdc's final-task-always rule. After C18 / C19 / C20 landed locally with green gates, the design doc §7.X status banner was extended to enumerate C18 / C19 / C20 alongside C0 – C17 with landing SHAs and per-commit one-paragraph summaries, and the §7.X commit-block section gained a new **Commits C18 – C20 — Copilot post-PR-open third-round review responses.** block with per-commit prose + Copilot finding IDs + gate evidence. This *C18 – C20 — Copilot third-round review responses* subsection above is the matching CHANGELOG entry; the doc-after-plans propagation also updates the closing C0–C21 paragraph below.
  • Gate inheritance from C20: C21 is doc-only, so the cargo fmt --check, cargo clippy --all-targets -- -D warnings, cargo test --lib, and cargo doc --no-deps gates all inherit C20's results unchanged (no rust files touched in C21).

  C22 – C23 — Copilot fourth-round review responses:

  • Two small post-PR-open commits closing the five additional line-anchored findings the GitHub Copilot reviewer raised against 5557b3192 (the C21 push head) on PR #60. Four of the five findings clustered on a single class (stale expect() panic-message references in the bench harness) and bundle into a single mechanical commit; the fifth is a substantive test-discipline refinement and lands separately. Each commit cites its Copilot finding ID(s) in the commit message body per .cursor/rules/90-commits.mdc.
  • C22 168ff0e22 — stale scan_transaction_with_cancel expect() strings in rust/shekyl-scanner/benches/scan_transaction.rs. Four .expect("scan_transaction_with_cancel must not error on well-formed fixture") sites (warm + cold variants of the worst-case and typical-case bench groups) referenced the private inner helper but the call sites themselves invoke the public surface Scanner::scan(..). The mismatch is the same class as the C10 commit (60f401e77) that rewrote six rustdoc fn-name references in scan.rs post the C4 rename + split (ac100e1ab); C22 closes the bench- file residue C10's review-attention scope didn't cover. Fix updates all four sites to "Scanner::scan must not error on well-formed fixture"; rustfmt collapsed the now-shorter message to single-line form. No semantic change (panic messages only fire on Err, and the bench fixtures' Scanner::scan invocations never produce Err by construction). Operator-facing diagnostic discipline (audit-trail clarity when a bench panics in CI). Closes Copilot finding IDs 3278543704, 3278543738, 3278543753, 3278543764.
  • C23 a2f173c73 — replace Debug-substring with structural CryptoError::DecapsulationFailed match in rust/shekyl-scanner/src/bench_fixtures.rs. The typical_case_first_output_exits_via_view_tag_mismatch sanity-check test asserted format!("{err:?}") .contains("X25519 view tag mismatch") to verify the fast-path-rejection error class — brittle to Debug- format changes (re-derivation, additional context fields, terse-vs-verbose variants) per Copilot's test-discipline finding. Validation at source confirms scan_output_recover constructs multiple DecapsulationFailed(String) instances along distinct early-exit paths (view-tag mismatch, invalid ML-KEM ciphertext length, invalid decap key, ML-KEM decap rejection); a pure variant-only check would not distinguish the typical-case fixture's intended path from sibling reasons, so the substring check on the inner message IS load-bearing. Fix uses a let-else binding both the variant AND the inner String field followed by a separate inner-message assert! — the two-class pinning (variant + reason within variant) is preserved; only the FORM changes (binding the inner String directly via pattern-match rather than going through format!("{err:?}")). Comment rewritten to enumerate the two drift classes the new shape catches explicitly. CryptoError imported via the existing shekyl_crypto_pq::error public path. Closes Copilot finding ID 3278543725.
  • Gates per commit: C22 ran cargo fmt -p shekyl- scanner -- --check (auto-format applied to collapse the shorter message to single-line; second --check clean) + cargo clippy -p shekyl-scanner --all- targets -- -D warnings (clean) + cargo build -p shekyl-scanner --benches (clean) + cargo test -p shekyl-scanner --lib (58 / 58 pass; unchanged from C19). C23 ran the same scoped gates plus a targeted cargo test ... typical_case_first_output_exits_via_view_tag_mismatch -- --nocapture to confirm the new structural form classifies the fixture's view-tag-mismatch error correctly (1 / 1 pass). Scanner doc warnings unchanged at 2 (C8 baseline).

  C24 — [Unreleased] doc-after-plans propagation for C22 – C23 (this commit):

  • Doc-only follow-up per .cursor/rules/91-documentation-after-plans.mdc's final-task-always rule. After C22 / C23 landed locally with green gates, the design doc §7.X status banner was extended to enumerate C22 / C23 alongside C0 – C21 with landing SHAs and per-commit one- paragraph summaries, and the §7.X commit-block section gained a new **Commits C22 – C23 — Copilot post-PR-open fourth-round review responses.** block with per-commit prose + Copilot finding IDs + gate evidence. This *C22 – C23 — Copilot fourth-round review responses* subsection above is the matching CHANGELOG entry; the doc-after-plans propagation also updates the closing C0–C24 paragraph below.
  • Gate inheritance from C23: C24 is doc-only, so the cargo fmt --check, cargo clippy --all-targets -- -D warnings, cargo test --lib, and cargo doc --no-deps gates all inherit C23's results unchanged (no rust files touched in C24).

  C25 – C28 — Copilot fifth-round review responses:

  • Four small post-PR-open commits closing the five additional line-anchored findings the GitHub Copilot reviewer raised against 3f4460a59 (the C24 push head) on PR #60. All five findings are substantive doc/code-hygiene issues (none nitpicky): three are stale-doc references to deleted symbols / abandoned test substrates (per .cursor/rules/91-documentation-after-plans.mdc's "Stale-doc detection ... the doc update is not optional — the doc is wrong and will mislead readers" rule); one is a dead lint-allow attribute (per .cursor/rules/15-deletion-and-debt.mdc's "Default: delete"); one is a Cargo feature description that claimed re-exports the feature doesn't actually perform.
  • C25 543fffe23 — stale build_scanner_from_keys rustdoc / comment references in rust/shekyl-engine-core/src/engine/mod.rs (comment above pub(crate) fn keys()) and rust/shekyl-engine-core/src/engine/view_material.rs (module rustdoc § "Field shape"). The free function build_scanner_from_keys was deleted in C5β (b6a1274de — legacy producer-scaffolding deletion in engine/refresh.rs) and replaced by ViewMaterial::try_from_keys(&AllKeysBlob) (engine assembly time, per C5a = 553d70139) + LocalRefresh::build_scanner (per-attempt scanner construction, per C4 = ac100e1ab). Both LIVE Rust sites updated to name the actual current derivation path; the surviving live consumer of Engine::keys() (Engine::replace_refresh's test- substrate re-derivation per C6α = e9310542a) named explicitly; reopening-criterion clause added per .cursor/rules/21-reversion-clause-discipline.mdc naming Phase 2's sign_transfer / tx_proof / reserve_proof surfaces as the substrate-change that would reopen #[allow(dead_code)] deletion. Initial rewrite introduced an [Engine::replace_refresh](super::Engine::replace_refresh) intra-doc link that triggered a new rustdoc privacy warning (replace_refresh is pub(crate), link from pub view_material module's rustdoc unresolves); reverted to a plain backtick reference per the C18 cross-crate-link mitigation pattern; doc-warning count back to baseline 49. Closes Copilot finding IDs 3278677182, 3278677211.
  • C26 1cdcd6e52 — dead #[allow(unused_imports)] on pub(crate) use refresh::RefreshEngine re-export in rust/shekyl-engine-core/src/engine/traits/mod.rs. The suppression was load-bearing at C1's introduction commit (d3edc1abb) when the re-export landed ahead of consumers; C5 (7140f726a — Engine<S, D, L, R> four-parameter type slot + retry-loop migration to trait dispatch) introduced multiple production consumers making the import live. The suppression has not been load-bearing since C5 and now masks future regressions where the import becomes dead again. Removed per .cursor/rules/15-deletion-and-debt.mdc's "Default: delete"; accompanying comment rewritten to anchor C1 / C5 / C26 and explain the masking-future- regressions failure mode the removal prevents. Symmetric form to C25's update of Engine::keys()'s #[allow(dead_code)] (same discipline check, different disposition because that suppression's live-consumer audit surfaced an ongoing default-feature production justification). Closes Copilot finding ID 3278677226.
  • C27 15c76a73e — reword test-helpers Cargo feature description in rust/shekyl-engine-core/Cargo.toml to reflect that the feature gates compilation only, NOT public re-exports. The previous description claimed the feature "re-exports otherwise-pub(crate) failure-injection wrappers ... for downstream integration test crates", but the four named surfaces (FaultInjecting<R: RefreshEngine>, FaultInjecting<L: LedgerEngine>, Engine::replace_refresh, LocalLedger::from_test_blocks) remain pub(crate) with the feature enabled — no __test_helpers re-export module exists at the crate root (verified at source vs. the sibling bench-internals feature which DOES have a __bench_internals re-export at lib.rs:46-56). Per .cursor/rules/21-reversion-clause-discipline.mdc chose option (b) of Copilot's two options: reword to reflect actual shape, NOT speculatively add re- exports for hypothetical downstream consumers that don't yet exist (the "pre-provisioning for hypothetical consumers" anti-pattern). The rewritten comment names: what the feature actually does (compile-gate the four pub(crate) surfaces); what it does NOT do (no public re-exports; compare-and- contrast with bench-internals makes the asymmetry explicit); why no re-exports yet (pre-genesis no-consumer state); reopening criteria (when the first downstream consumer emerges, add __test_helpers module under the __bench_internals precedent + V3.0-targeted FOLLOWUPS item + AUDIT_SCOPE.md amendment if needed); load-bearing production-build safety property (the #[cfg(any(test, feature = "test-helpers"))] gating at the definition site keeps the four failure-injection surfaces out of default-feature production builds). Closes Copilot finding ID 3278677251.
  • C28 1879baf73 — Post-PR-4 retirement note added to docs/V3_ENGINE_TRAIT_BOUNDARIES.md §6 "Test boundary" / §6.1 "Pinned commitments for Stage 1". The §6 framing still asserted a "fully- mocked Engine<SoloSigner, MockKey, MockLedger, MockDaemon, …>" Stage-1 test direction and the §6.1 Round-3 commitment list still enumerated all seven Mock-X types, but three of the seven have retired: MockKey in PR 3 (per STAGE_1_PR_3_KEY_ENGINE.md §6.4 no-Mock substrate — already acknowledged in §6.1 Round-4b's (Post-M3 note) but NOT in the §6 framing paragraph); MockLedger in PR 4 C6β (replaced by FaultInjecting<L: LedgerEngine>); MockRefresh in PR 4 C6α (replaced by FaultInjecting<R: RefreshEngine>). Three additions: (1) new > (Post-M3 + Post-PR-4 note: ...) block-quote beneath the §6 opening paragraph naming all three retirements + replacement substrates + surviving Mock-X types; (2) nested (Post-M3 + Post-PR-4 update to the Round-3 list) item inside §6.1's pinned-commitments list inline-annotating each retired type with its anchor commit + replacement; (3) extension of the existing (Post-M3 note: ...) paragraph inside §6.1 Round-4b to include the Post-PR-4 retirements + name the contract-fidelity discipline as applying to FaultInjecting<...> wrappers (which honor the trait contract by delegating to the wrapped real production implementor's behavior — wrapper-injected failures fire BEFORE or AFTER delegation per the wrapper's documented semantics, not by substituting alternative return values). §6.2+ RNG-injection example snippets (lines 4102, 4149, 4177) retain MockLedger::with_seed(...) literal example text as a deliberate scope decision per 15-deletion-and-debt.mdc "while we're here is the enemy" — those examples demonstrate the seeded-RNG injection MECHANISM (invariant under implementor name) and rewriting them would either lose pedagogical clarity or require a §6.2+ refactor outside C28's named-Copilot-finding scope. Closes Copilot finding ID 3278677269.
  • Gates per commit: each ran its scoped bisection- discipline gates. C25 / C26 touched shekyl-engine-core Rust files (cargo fmt -p shekyl-engine-core -- --check, cargo clippy -p shekyl-engine-core --all-targets --features test-helpers -- -D warnings, default-feature clippy, cargo test -p shekyl-engine-core --lib, cargo doc -p shekyl-engine-core --no-deps) all clean: 170 / 170 lib tests pass; 49 doc warnings unchanged (C9 baseline). C27 touched Cargo.toml only (comment-only change inside [features]); fmt / clippy / test all clean; no .rs files touched. C28 touched a docs/ markdown file only; gate inheritance from C27.

  C29 — [Unreleased] doc-after-plans propagation for C25 – C28 (this commit):

  • Doc-only follow-up per .cursor/rules/91-documentation-after-plans.mdc's final-task-always rule. After C25 / C26 / C27 / C28 landed locally with green gates, the design doc §7.X status banner was extended to enumerate C25 / C26 / C27 / C28 alongside C0 – C24 with landing SHAs and per-commit one-paragraph summaries, and the §7.X commit-block section gained a new **Commits C25 – C28 — Copilot post-PR-open fifth-round review responses.** block with per-commit prose + Copilot finding IDs + gate evidence. This *C25 – C28 — Copilot fifth-round review responses* subsection above is the matching CHANGELOG entry; the doc-after- plans propagation also updates the closing C0–C29 paragraph below.
  • Gate inheritance from C28: C29 is doc-only, so the cargo fmt --check, cargo clippy --all-targets -- -D warnings, cargo test --lib, and cargo doc --no-deps gates all inherit C28's results unchanged (no rust files touched in C29).

  PR 4 §7.X commits C0 through C29 are now all landed; PR #60 carries the full C0–C29 set. See the separate ### Added and ### Changed entries below for the trait- surface and Engine<S, D, L, R> four-parameter additions PR 4 ships, per the C8 spec at STAGE_1_PR_4_REFRESH_ENGINE.md §7.X C8.

• RandomX v2 — Phase 1: pinned submodule + out-of-tree build wiring (feat/randomx-v2-phase1, PR #54, merge commit c0c4a11e5, 2026-05-19). Adds external/randomx-v2 submodule pinned to Shekyl-Foundation/RandomX SHA aaafe71322df6602c21a5c72937ac284724ae561 (v2.0.1 release; identical to tevador/RandomX:master at pin time, per the dependency-discipline verification in docs/completed/RANDOMX_V2_PHASE1_PLAN.md §1.3). Adds BUILD_RANDOMX_V2_MINER_LIB CMake option (default OFF). When ON on a single-config generator (Ninja, Make), an ExternalProject_Add block in external/CMakeLists.txt builds the v2 fork out-of-tree under ${CMAKE_BINARY_DIR}/external/randomx-v2-build/ and exposes the shekyl_randomx_v2 IMPORTED static-library target plus its include directory. The block forwards the standard CMake cross-build knobs (toolchain file, sysroot, Apple/Android settings, system name/processor, compiler launchers) to the sub-build via a semicolon-safe LIST_SEPARATOR-based forwarding pattern. On multi-config generators (MSVC, Xcode, Ninja Multi-Config) the option fails with a FATAL_ERROR directing the developer to -G Ninja plus an explicit -DCMAKE_BUILD_TYPE; per-CONFIG wiring is the V3.x Phase 2 FOLLOWUPS item alongside the first real consumer. The out-of-tree build pattern avoids the target-name collision with external/randomx (v1.2.1), which declares the same project(RandomX) and add_library(randomx ...) symbols; see RANDOMX_V2_PHASE1_PLAN.md §2 for the collision analysis and disposition rationale. No Shekyl C++ consumer links the new target in this PR; first consumers are Phase 2 cross-check tests against the canonical v2 implementation (the new Rust crate rust/shekyl-pow-randomx/) and Phase 3's miner cutover. The existing external/randomx (v1.2.1 at 102f8acf) is unchanged; the v1 fallback path per docs/design/RANDOMX_V1_FALLBACK.md §1 remains reachable. See docs/completed/RANDOMX_V2_PHASE1_PLAN.md for the full scope, the ExternalProject_Add configuration rationale, the build-smoke test results, the §10 implementation-time dispositions (D1 check_submodule omission, D2 multi-config fail-fast, D3 toolchain forwarding expansion, D4 semicolon-escape), and the reversibility plan.

• LWMA-1 difficulty-adjustment migration — Phase 4 C++ cutover (feat/daa-lwma1-phase4, 2026-05-18). Lands the consensus-atomic cutover from the inherited CryptoNote cut-windowed-average DAA to LWMA-1, plus the two paired FTL/MTP value changes, in a single PR invoking 07-consensus-atomic-cutovers.mdc. The PR contains eleven commits that respect single-purpose scope per 90-commits.mdc; the eleven-commit structure is the pre-flight-disposed shape (docs/design/DAA_LWMA1_PHASE4_PREFLIGHT.md §18). Closes work-items 1–14 of docs/design/DAA_LWMA1_PLAN.md Phase 4 and the V3.0 DAA item in docs/FOLLOWUPS.md.

  Consensus-rule deltas (the load-bearing changes a validator must agree on):

  • DAA: Blockchain::next_difficulty (CryptoNote cut-windowed-average, DIFFICULTY_WINDOW=720, DIFFICULTY_LAG=15 // !!!, DIFFICULTY_CUT=60) is replaced by LWMA-1 from zawy12/difficulty-algorithms#3 with N=90, T=120s, GENESIS_DIFFICULTY=100. The FFI surface (shekyl_difficulty_lwma1_next) is wrapped at the three Blockchain call sites (get_difficulty_for_next_block, recalculate_difficulties, get_next_difficulty_for_alternative_chain) by the lwma1_next_difficulty helper in blockchain.cpp, which throws cryptonote::difficulty_computation_error (declared in src/cryptonote_core/difficulty_engine_error.h) on non-zero FFI return codes.
  • FTL: CRYPTONOTE_BLOCK_FUTURE_TIME_LIMIT (60*60*2 = 7200s) becomes SHEKYL_DAA_FTL_SECONDS = 540s (zawy12-required N*T/20). Tightens by 13.3×; reorgs more than 9 minutes deep on local-clock disagreement are no longer accepted.
  • MTP: BLOCKCHAIN_TIMESTAMP_CHECK_WINDOW = 60 becomes SHEKYL_DAA_MTP_WINDOW = 11. Tightens back from the Monero-era widening to the CryptoNote-original window.

  Mechanical rewires (value-preserving):

  • DIFFICULTY_TARGET_V2 (120s) consumers across the daemon, wallet, RPC, and tests are rewired to SHEKYL_DAA_TARGET_SECONDS (also 120s). 8 production sites and 5 test sites; verified by the consensus-invariants gate (scripts/ci/check_consensus_invariants.sh invariant 3).
  • CRYPTONOTE_LOCKED_TX_ALLOWED_DELTA_SECONDS_V2 is preserved with its RHS rewired from DIFFICULTY_TARGET_V2 to SHEKYL_DAA_TARGET_SECONDS; two live consumers (blockchain.cpp:4043, wallet2.cpp:7330) are unaffected.
  • DIFFICULTY_BLOCKS_ESTIMATE_TIMESPAN (60s V1 alias used by tests as a generic "block time" multiplier) is replaced by SHEKYL_DAA_TARGET_SECONDS (120s) at 4 non-deletion test files (bulletproof_plus.cpp, chaingen.cpp, transactions_flow_test.cpp, block_validation.cpp:267). Semantic shift: 60s base → 120s base for tests' block-time approximation, matching the actual block rate.

  Deletions:

  • Seven inherited #defines removed from src/cryptonote_config.h: DIFFICULTY_TARGET_V[12], DIFFICULTY_WINDOW, DIFFICULTY_LAG (with its // !!! warning), DIFFICULTY_CUT, DIFFICULTY_BLOCKS_COUNT, DIFFICULTY_BLOCKS_ESTIMATE_TIMESPAN. The V1 lock-delta CRYPTONOTE_LOCKED_TX_ALLOWED_DELTA_SECONDS_V1 is removed (pre-genesis Monero behavior, dead under 60-no-monero-legacy.mdc).
  • next_difficulty and next_difficulty_64 deleted from src/cryptonote_basic/difficulty.{h,cpp} (surgical, per the pre-flight's drift-F6 amendment: the check_hash PoW family in the same file is retained with ~12 live production consumers).
  • tests/difficulty/{difficulty.cpp,data.txt,generate-data,gen_wide_data.py,wide_difficulty.py} deleted (~23 KB) — exercised the now-deleted CryptoNote DAA; the lwma1-cross-check harness (Phase 2 vintage) is retained in tests/difficulty/CMakeLists.txt.
  • lift_up_difficulty helper plus gen_block_invalid_nonce and gen_block_invalid_binary_format test classes removed from block_validation.{cpp,h} (V1-only fixtures, already disabled in the test driver).

  Regression tests added:

  • tests/unit_tests/rpc_target_wire_contract.cpp — pins the public JSON-RPC wire contract for mining_status.block_target and get_info.target at 120. Both gtests plus the static_assert(SHEKYL_DAA_TARGET_SECONDS == 120, …) static pin remain after the cutover.
  • tests/unit_tests/stall_detection_calibration.cpp — pins the daemon's stall-detection calibration: 1/7200 false-positive threshold, {45, 30, 15, 10, 5} expected-block counts across the five Poisson windows, and the zero-blocks-tail-probability boundary (the 600s window must NOT trip at λ=5; the four longer windows must trip at λ ≥ 10).

  CI gate added:

  • .github/workflows/consensus-invariants.yml plus scripts/ci/check_consensus_invariants.sh — three source-level grep invariants (no live consumers of the deleted DAA functions; no C-ABI in rust/shekyl-difficulty; no orphaned references to the deleted #defines). Shared landing pad for the upcoming RandomX v2 Phase 2f symbol-isolation checks. Binary-level nm-on-shekyld verification is a deferred enhancement (recorded in this entry as a follow-up below).

  Pre-flight drift findings closed:

  • F1 — surgical (not wholesale) deletion of tests/difficulty/; the lwma1-cross-check harness stays.
  • F2 — CRYPTONOTE_LOCKED_TX_ALLOWED_DELTA_SECONDS_V2 preserved with rewired RHS (option B); _V1 deleted.
  • F3 — V1 next_difficulty(...) fixtures in block_validation.cpp deleted along with the helper that drove them.
  • F4 — DIFFICULTY_TARGET_V2 consumer count corrected from "~14 sites across 9 files" to the actual 8 production + 5 test sites enumerated by the commit-6 sweep.
  • F5 — DIFFICULTY_TARGET_V2 consumer undercount in blockchain.cpp: the plan's §9.7 enumeration missed two sites at lines 4239 / 4243 (an MTP-window correction and a timestamps.back() + DIFFICULTY_TARGET_V2 adjustment inside check_block_timestamp); both rewired to SHEKYL_DAA_TARGET_SECONDS. wallet2.cpp's lines 181, 182, 5975, 11548 were never drift — the earlier text mis-attributed F5 to wallet2.cpp; corrected 2026-05-18 per PR #53 Copilot review C-6.
  • F6 — surgical (not wholesale) deletion of src/cryptonote_basic/difficulty.{h,cpp}: the check_hash PoW-validation family is retained; only the next_difficulty family is deleted.
  • F7 — check_difficulty_checkpoints() is NOT a deletion target. Pre-flight §14 (and DAA_LWMA1.md §7.1) erroneously enumerated it as a symbol-isolation deletion candidate. The function in blockchain.cpp:1066 is a checkpoint-cumulative- difficulty comparison independent of the deleted DAA functions; retained. The spec doc and pre-flight are amended in this commit.

  Reviewer-map structure (per 07-consensus-atomic-cutovers.mdc sub-clause 4.3):

  • A. Consensus-affecting changes (priority attention): blockchain.cpp DAA rewires (commit 3), FTL rewires (commit 4), MTP rewires (commit 5), cryptonote_config.h deletions (commit 7), difficulty.cpp deletions (commit 8).
  • B. Mechanical rewires (value-unchanged): DIFFICULTY_TARGET_V2 → SHEKYL_DAA_TARGET_SECONDS (commit 6), DIFFICULTY_BLOCKS_ESTIMATE_TIMESPAN rewires in tests (commit 7).
  • C. Deletions: legacy DAA tests + V1 fixtures (commit 9).
  • D. New artifacts: regression tests (commits 1, 2), CI gate (commit 10), this changelog entry (commit 11).

  Rollback procedure (per sub-clause 4.4):

  If consensus breaks post-merge, the reversion is to revert the merge commit on dev (single non-FF merge per 06-branching.mdc) and re-tag. Because the cutover is atomic (FTL/MTP/DAA all in one PR), no partial reversion is required. The pre-merge state of blockchain.cpp's three next_difficulty call sites, the FTL/MTP consumer surfaces, and the deleted #defines are all captured in the pre-cutover dev SHA recorded in the PR description; reverting the merge restores them byte-identically.

  Follow-up: binary-level nm shekyld | rg -q '^.* (T|U) (next_difficulty_64|next_difficulty)\b' symbol-isolation check. Source-level grep (this PR's invariant 1) is a necessary precondition for binary absence; the binary-level check is a deferred enhancement when CI is restructured to expose the linked daemon binary to a post-link grep step. Tracked in docs/FOLLOWUPS.md.

• LWMA-1 difficulty-adjustment migration — Phase 0 design docs (feat/daa-lwma1-phase0-design, 2026-05-17). Adds two Phase 0 design documents under docs/design/: DAA_LWMA1.md (the primary design) and DAA_LWMA1_PLAN.md (the phased execution plan, five phases sequential, no parallel tracks). The primary design records the disposition to replace the inherited CryptoNote cut-windowed-average DAA (src/cryptonote_basic/difficulty.cpp, DIFFICULTY_WINDOW=720, DIFFICULTY_LAG=15 with literal // !!! warning, DIFFICULTY_CUT=60) with LWMA-1 from zawy12's canonical reference at zawy12/difficulty-algorithms#3, implemented as a Rust crate shekyl-difficulty per 20-rust-vs-cpp-policy.mdc rule 2 (cryptographic-contract surface). Concrete parameter selection: N=90 (zawy12 canonical for T=120s), T=120s (inherited), GENESIS_DIFFICULTY=100 (proposed), FTL=N*T/20=540s (zawy12-required, replaces inherited 7200s), MTP=11 (Cryptonote default unchanged). The design pins genesis-time landing per 16-architectural-inheritance.mdc pre-genesis discount and 60-no-monero-legacy.mdc no-version-dispatch rule. Sibling track to RandomX v2 but independent: math-orthogonal (DAA operates on (timestamps, cum_difficulties); PoW changes the hash function), no wallet V3.2 gate applies, no Monero release-time audit dependency. A pre-design rust/shekyl-difficulty/src/lwma1.rs sketch is explicitly documented as not canonical (different formula, missing 6*T solvetime clamp, missing N*N*T/20 minimum-L floor, missing 99/200 bias factor) and was deleted during Phase 0 so Phase 1 starts from an empty crate directory; the divergence catalogue is retained in DAA_LWMA1.md §2.4 as the design record of why each non-canonical shape is rejected. Reversion clauses per 21-reversion-clause-discipline.mdc cover LWMA-2/3/4 and ASERT reopening criteria.

  Round 2 review update (2026-05-17): (a) reframes shekyl-difficulty as a leaf crate with zero internal workspace dependencies per 18-type-placement.mdc, with FFI exposure routed through shekyl-ffi (DAA_LWMA1.md §2.1); (b) records the explicit "DAA is a primitive, not an actor" disposition (DAA_LWMA1.md §2.7) — lwma1_next is a free function plus typed constants plus the FTL/MTP predicates, no DifficultyEngine actor wrapper; (c) pivots the consensus-constants source-of-truth from a cbindgen handwave to the existing config/consensus_constants.json JSON-authority pattern documented in docs/FOLLOWUPS.md and the 2026-05-05 FFI constant-drift audit (DAA_LWMA1.md §4, plan Phase 1 task); (d) adds a chain-state- ownership disposition (DAA_LWMA1.md §17) acknowledging that daemon-side LMDB chain state remains in C++ Blockchain through Phase 4 and that no Rust crate owns daemon-side chain state today; the future Rust validator actor will consume the same DAA transform without changes to the DAA crate.

  Round 3 review update (2026-05-17): (a) corrects the contradictory dispositions for DIFFICULTY_TARGET_V2 — design doc §9.2 now matches the plan's delete-not-rename directive (rename would preserve the hand-maintained #define drift class the JSON authority exists to close); (b) corrects two real factual errors surfaced by a Round 3 reconnaissance grep of the C++ tree: the constant is CRYPTONOTE_BLOCK_FUTURE_TIME_LIMIT (not BLOCK_FUTURE_TIME_LIMIT; there is no _V2 variant), and BLOCKCHAIN_TIMESTAMP_CHECK_WINDOW is currently 60 (Monero-era widening from the CryptoNote-original 11), so the LWMA-1 disposition is a tightening — not preservation — from 60 back to 11; (c) adopts algorithm-version-free naming for the JSON keys (daa_window_n, etc.) and the generated C++ symbols (SHEKYL_DAA_*, not SHEKYL_DAA_LWMA1_*) so a future §10 reversion doesn't require renaming every consumer; (d) enumerates the full Phase 4 consumer surface in new sections §9.5 (CRYPTONOTE_BLOCK_FUTURE_TIME_LIMIT: 2 sites), §9.6 (BLOCKCHAIN_TIMESTAMP_CHECK_WINDOW: 9 sites), and §9.7 (DIFFICULTY_TARGET_V2: ~14 sites across 9 files), and adds §9.8 to flag the core_rpc_server.cpp:1452 res.block_target RPC-contract preservation property; (e) acknowledges Phase 4 atomicity as a deliberate exception to 06-branching.mdc (FTL/MTP value changes cannot stage behind alias #defines without weakening consensus in the intermediate state); (f) resolves the bias-factor location drift — 99 and 200 (plus 6 and 1/20) appear as bare integer literals inside src/lwma1.rs to match canonical zawy12 verbatim, not as named pub(crate) const in consts.rs; (g) mechanizes Phase 5's conditional cross-reference to 24-reviewer-discipline.mdc so the Phase 5 reviewer can verify by grep; (h) closes open question #3 (build.rs location) as Option A per the leaf-crate property in §2.1; (i) adds a solvetime[1] -T offset regression vector to §8.1's required-vector list; (j) adds explicit MIT attribution to the Phase 2 vendored tests/difficulty/zawy12_lwma1_reference.h; (k) moves long reviewer-note prose out of the long-lived Cargo.toml into a Phase 1 review-checklist section; (l) flags is_above_mtp's &[u64; 11] vs slice ergonomics as a Phase 1 implementation choice (not a Phase 0 blocker); (m) adds canonical line-number stability caveats to §5.3 step 7 and step 8 (line numbers are stable only against the Phase 2 pinned-spec revision); (n) updates Phase 4 work-item count from 11 to the actual 14.

  Round 4 review update (2026-05-17): (a) pivots the FFI ABI for difficulty values from u128 / __uint128_t to canonical little-endian [u8; 16] byte arrays (DAA_LWMA1.md §6.1 and plan Phase 3). Rationale: Rust's u128 C ABI was unsound on several targets until rustc 1.77 (March 2024) and remains a target-portability footgun on uncommon platforms; for a consensus-critical surface that's unacceptable. Explicit byte arrays match the FCMP++ and KEM-derivation FFI precedent already in the workspace and immunize the boundary against target-dependent ABI surprises. C++ consumers memcpy between their native uint128_t and the canonical-LE buffer at every call site so the endianness assumption is a deliberate checkpoint rather than an implicit invariant. (b) Consensus-correctness fix to §8.1 test vectors. The Round 3 vector "perfectly stable hashrate produces next_D == avg_D (within rounding)" was mathematically wrong: with solvetime[i] == T for all i, the formula yields next_D == avg_D * 99 / 100 — a deliberate 1 % downward bias, which is the point of the 99/200 factor per §5.3 step 7's derivation. The Round 3 expectation invited three implementer failure paths (relax tolerance to absorb the 1 % shift; remove the bias from the algorithm to satisfy the test; misread "rounding" as ±1 %). Round 4 replaces all ≈-shaped vectors with concrete numerical tuples: stable hashrate → 0.99 * avg_D, 2× hashrate increase → 1.98 * avg_D, 2× hashrate decrease → 0.495 * avg_D, minimum-L floor (all solvetimes == 1) → ~10.01 * avg_D. Tuples are derived analytically from §5.3 and force the Phase 1 implementer to confront the bias at design time, not at debug time. Also corrects an off-by-one in §2.6's "first N+1 blocks" framing (canonical's height < N short-circuit covers N blocks, not N+1; the Shekyl FFI chain_height < N translation puts blocks 1..=N in the short-circuit per the new §5.6 validator consumer contract). (c) Adds DAA_LWMA1.md §5.6 "Validator consumer contract: chain_height → header.difficulty" specifying the off-by-one mapping between the DAA function's chain_height parameter (predecessor's height) and the block-being-validated's height, plus the per-block disposition: block 0 (genesis) is exempt; blocks 1..=N carry GENESIS_DIFFICULTY; blocks ≥ N+1 are algorithm-computed. Pre-empts the Phase 4 reviewer's first question. (d) Closes all Phase 0 open questions. GENESIS_DIFFICULTY = 100 and N = 90 are ratified zawy12 canonical with reversion triggers in §10 covering simulation-driven change; the "Shekyl-empirical RandomX v2 single-CPU measurement" alternative referenced a measurement that cannot exist until RandomX v2 ships and is functionally identical to the §10 reversion trigger already in place. Phase 2 cross-check harness language closed as C++ test target (the canonical reference is C++; consuming it directly is simpler than Rust-side vendoring; the alternative was a cosmetic preference). Build.rs location (Option A) and JSON-key naming (daa_* algorithm-version-free) were already closed in Round 3 and are restated for completeness. No open questions are carried into Phase 1; the design-rounds-in- implementation-PR anti-pattern is closed at Phase 0. (e) Adds three LWMA1_() disambiguation anchors to DAA_LWMA1.md §3 and plan Phase 2: byte-offset range, first-line, last-line. zawy12 Issue #3 contains four LWMA reference functions (LWMA1_/2_/3_/4_); §5.3's "Issue #3, lines N–M" citations are otherwise ambiguous and would break Phase 2 cross-check at the smallest upstream reordering. (f) Reframes T = 120 s as Shekyl's chosen target block time (zawy12 LWMA-1 recommends 60–120 s for CPU-mineable chains) rather than "inherited from CryptoNote DIFFICULTY_TARGET_V2." The numerical value matches; the source-of-truth is the JSON authority daa_target_seconds, not the inherited #define.

  Round 5 review update (2026-05-17): (a) FFI ABI pivot from [u8; 16] byte arrays to #[repr(C)] struct ShekylU128 { lo: u64, hi: u64 }. Round 4 named the u128 ABI unsoundness as a Tier 1 blocker but stopped short of proposing the specific wire representation. Round 5 closes this. ShekylU128 decomposes the 128-bit value into two u64 fields whose ABI is universally stable on every Shekyl- supported target — no improper_ctypes exposure, no MSRV-pin-to-1.78 constraint, no per-target ABI verification matrix. The struct-with-named-fields shape preserves explicit lo/hi semantics (debugger-friendly, unambiguous, survives any future endianness disposition because the field meaning is carried by the field name). Endianness is consensus-locked in DAA_LWMA1.md §6.1: ShekylU128 is little-endian by field semantics — lo is the low 64 bits, hi is the high 64 bits, reconstruction is value = (hi as u128) << 64 | (lo as u128). Cost: one struct definition and four lines of From impls per direction. Benefit: the consensus-critical surface is immune to u128-ABI target-portability issues permanently, not just on rustc ≥ 1.77. (b) MTP 60 → 11 trade-off framing. The BLOCKCHAIN_TIMESTAMP_CHECK_WINDOW = 60 → SHEKYL_DAA_MTP_WINDOW = 11 change travels in opposite directions on two security axes simultaneously and a release-note skimmer reading the value change in isolation would misread it as a security regression. Surfaced explicitly: the MTP-only timestamp- attack defense weakens (it is easier for an adversary to satisfy "strictly greater than the median of 11 timestamps" than "strictly greater than the median of 60 timestamps" in isolation), and the LWMA-1-coupled defense engages (the canonical zawy12 math is calibrated against MTP = 11, not MTP = 60; running LWMA-1 with MTP = 60 would understate the algorithm's solvetime-clamp resistance). DAA_LWMA1.md §5.5 names all three checks (MTP + FTL + solvetime-clamp) as jointly load-bearing — the combined defense profile post-Phase-4 is stronger than either the pre-Phase-4 MTP=60-only profile or a hypothetical LWMA-1-with-MTP=60 configuration. The value change is the cost of moving from a MTP-only-anchored defense to the canonical zawy12-coupled defense; it is not a unilateral loosening. (c) RPC-contract preservation regression test (§9.8). The byte-identity assertion is now explicit: a wallet calling get_info against the post-Phase-4 daemon receives a block_target field that is byte-identical to the same wallet's response against the pre-Phase-4 daemon (captured as a fixture at PR-open). The value-identity assertion (120 == 120) catches value drift; the byte-identity assertion catches encoding drift (a future "change varint encoding to little-endian byte array" refactor would preserve the numeric value but break the wire contract). Both are required to make the RPC-contract-preservation property auditable rather than asserted. (d) "Consensus-atomic cutover" exception class drafted in DAA_LWMA1_PLAN.md Phase 4 (four criteria: consensus-rule boundary; structural indivisibility; surface enumerated in advance; documented disposition citing the criteria). The class was drafted here as four criteria; the sibling PR feat/consensus-atomic-cutovers-rule ratifies the criteria as .cursor/rules/07-consensus-atomic-cutovers.mdc and refines them through Round 6 / Round 7 review before landing (PR #50). The ratified form: the rule is opt-in (alwaysApply: false) and unreachable by any PR that does not cite it explicitly; criterion 2 is reframed as the structural-inapplicability of flag decomposition to consensus rules — a flag decomposition is consensus-safe only if both flag states are simultaneously valid, which for a consensus rule is impossible by definition, so criterion 2 is met whenever criterion 1 is met (closing the "yes-it's-consensus- but-splitting-would-be-inconvenient" loophole); criterion 3 adds a base-commit-anchored, timestamped grep so reviewers re-run against the same SHA; criterion 4 is numbered into sub-clauses 4.1–4.4 with reviewer-map-accuracy and rollback-correctness promoted into the criterion itself (rejecting the PR is the response to a map miss, not patching the map); a "what this is not" section disqualifies convenience / velocity / reviewer-bandwidth / retroactive-citation; and the history of application is split into "Approved invocations" (LWMA-1 Phase 4) and "Cases that might appear analogous but are not" (RandomX v2 Phase 3, where the 3a flag is build-system / FFI-routing rather than consensus, the algorithm change ships in Phase 1's submodule swap, and criterion 1 is therefore not met for Phase 3 at all — structurally inapplicable, not "evaluated and rejected"). The mechanism for future invocations is self-anchoring: an invoking PR must include a commit that adds its own entry to the rule's history-of-application section. Phase 4's section in this plan invokes the ratified rule by name and maps each criterion to LWMA-1 Phase 4 specifically; Phase 4's exception is auditable against the class's four criteria mechanically, not against LWMA-1-specific precedent. (e) Round 8 bias-factor stochastic-vs-deterministic clarification (DAA_LWMA1.md §5.3 step 7, §8.1). The Round 4 test-vector correction landed concrete numerical tuples that expect next_D == avg_D * 99/100 on the §8.1 perfectly-stable hashrate input (deliberate downward bias from the 99/200 factor). The Round 4 fix did not synchronously update §5.3 step 7's derivation prose, which still described the 99/100 factor as "compensating for a ~1 % upward bias" — leaving the doc internally contradictory: one section described the factor as canceling drift (stable input → avg_D exactly), the other expected a 1 % residual. Round 8 resolves the contradiction by making the stochastic-vs-deterministic distinction explicit: the canonical zawy12 bias correction targets stochastic upward drift (Poisson skew, 6*T clamp truncation, jump-rule amplification from downstream LWMA-2+ variants) present under realistic chain operation; on §8.1's deterministic unit-test vectors (all solvetimes exactly T, no clamp engagement, no PRNG), the same factor surfaces as a deterministic 1 % downward residual rather than as a corrective cancellation. Both readings of the algorithm are correct under their respective input shapes; the doc now says so explicitly so a Phase 1 implementer who transcribes the formula and observes next_D == 990_000 on the §8.1 stable vector knows that's a correctly implementing algorithm rather than a test expectation to "fix." A Phase 1 pre-flight verification step is added to DAA_LWMA1_PLAN.md: the canonical zawy12 C++ reference is run once against the §8.1 stable vector and the result recorded in the Phase 1 PR description before implementation begins, removing the residual ambiguity as a function of empirical evidence rather than as a function of prose interpretation. (f) Round 8 §11 wallet touchpoint correction. §11 previously read "LWMA-1 is not consumed by the wallet — wallets do not compute or check difficulty (validators do)" — true for the algorithm but incomplete for the target-block-time constant T, which §9.7's enumeration surfaced as a wallet consumer at wallet2.cpp:181, 182, 5975, 11548 and wallet_rpc_server.cpp:163 (unlock-time defaults, recent-spend-window math, seconds_per_block consumers, suggested_confirmations_threshold math — five wallet-side sites). §11 now reads accurately: the algorithm is not consumed by the wallet, but T is, with a value-preserving rewire from DIFFICULTY_TARGET_V2 to SHEKYL_DAA_TARGET_SECONDS across all five sites. Phase 4's wallet impact is no longer mis-stated as "no wallet impact." The §11 prose-vs-§9.7 enumeration drift was a Round 1 grep finding that didn't make it into the §11 prose; Round 8 closes the loop. (g) Round 8 polish. (i) DAA_LWMA1.md §6.3 explicitly records that the is_above_mtp and is_timestamp_below_ftl predicates committed in §2.5 are Rust-internal helpers consumed by the §17 future validator actor, not exposed via the FFI — the C++ side does the corresponding FTL and MTP checks directly against the generated header constants per §6.2's source-of-truth pattern, keeping the FFI surface minimal per §6.1's "one committed export" discipline. (ii) DAA_LWMA1.md §9.5 adds a Phase 4 reviewer note that with the FTL value change from 7200 to 540, the FTL test margin in tests/core_tests/block_validation.cpp:137 shrinks from "7.2 hours past FTL" to "1 hour past FTL"; the test must assert rejection specifically because of the FTL check (error-code equality, not generic "block rejected"), so the test can't pass for the wrong reason if a future refactor moves rejection to a different validation path. (iii) DAA_LWMA1.md §9.7 adds a Phase 4 reviewer note for the cryptonote_core.cpp:1817, 1829, 1838 Poisson stall-detection sites: the rewire is value-preserving but the path is not exercised by any current test, so Phase 4 either confirms coverage exists or adds a minimal regression test; "rewire textually, value unchanged" alone is not a sufficient verification claim for a path with no test coverage. (iv) DAA_LWMA1.md §9.3 is repopulated with substantive consolidation prose pointing FTL/MTP enumeration cross- references to §9.5 and §9.6 respectively (was previously an empty "deprecated section header" pointer with no content). (v) DAA_LWMA1_PLAN.md Phase 4 adds a reviewer-expectation note that the "14 work items" framing categorizes work but understates diff size: actual file-change count lands at roughly 45–55 files across src/ and tests/. (vi) DAA_LWMA1.md status block on line 3 updated from "Round 1" to reflect that Rounds 1–8 have all landed against this PR. (h) Round 9 zawy12 issue #24 cumulative-history review. Reviews the design against zawy12/difficulty-algorithms#24 ("LWMA's history"), the canonical author's cumulative log of known LWMA issues, fixes, and security-relevant findings. Five items receive explicit dispositions; four (#1, #2, #4, #5, #6, #10, #12, #15, #16) are confirmed already-addressed. Substantive changes:

  • Item #14 (September 2018 selfish-mine via out-of-sequence timestamps). Algorithm-level change. DAA_LWMA1.md §5.3 steps 2 and 3 adopt LWMA-3's running-max + signed-solvetime mechanism and symmetric ±6*T clamp, replacing the kyuupichan-style forward-pass-with-1-floor used through Round 8. The remainder of the algorithm (weighted-sum, minimum-L floor, bias factor 99/200, overflow guard, genesis-window short-circuit) stays LWMA-1-canonical. Disposition recorded in §1.3 (alternatives — "Partial LWMA-3 adoption"), §3 (pinned spec — deviation note + LWMA3_() reference pin), §5.3 steps 2/3/4 (algorithm rewrite to signed-i128 intermediates + symmetric clamp), §5.4 ("Signed-arithmetic discipline" property), §5.5 (defense-surface enumeration grows to four mechanisms), and §8.1 (out-of-sequence vector reformulated for running-max semantics, new "Selfish-mine attack regression (zawy12 issue #24 item 11)" required vector). DAA_LWMA1_PLAN.md Phase 1 adds a signed-arithmetic discipline section detailing the i128/u128 boundary and lists the two Round 9 test vectors as required Phase 1 merge-gate criteria. Phase 2's cross-check harness composes expectations from both canonical LWMA1_() and LWMA3_() references per §8.2.
  • Item #17 (May 2019 33% Sybil attack via peer-time-offset). Closed by absence of substrate. The attack's precondition ("If your coin uses network time instead of node local time") is not met by Shekyl. Blockchain::check_block_timestamp(b) compares against time(NULL) directly (blockchain.cpp:4276); Blockchain::get_adjusted_time(height) is blockchain-derived (median of recent block timestamps) and consulted only by non-consensus paths. No peer-time-correction mechanism exists in the daemon; audit-trail grep returned zero matches for time_offset|TimeOffset|GetAdjustedTime|GetTimeOffset|MAX_PEER_DELTA|MAX_TIME_DELTA|MEDIAN_TIME|TIMESTAMPS_FOR_TIME_SYNC against consensus-relevant surface. Lowering FTL from 7200 s to 540 s is therefore safe against the zcash/zcash#4021 attack class. Disposition recorded in DAA_LWMA1.md §5.5's "Disposition on peer-time-derived clocks" paragraph, with a forward-looking constraint: if a future Shekyl version adds peer-time correction, the FTL / 2 revert-threshold relationship per zawy12 issue #24 item 14 becomes load-bearing at that point and daa_peer_time_revert_threshold_seconds MUST be added to the JSON authority. The FTL value reduction (7200 → 540) pre-dates this round but the safety rationale is now explicit: it is safe because Shekyl does not implement peer-time-derived clocks.
  • Item #7 (Jagerman MTP patch). Verified present in Shekyl's inherited Blockchain::create_block_template at blockchain.cpp:1650–1656 (the canonical pattern: set b.timestamp = time(NULL), then if check_block_timestamp fails, raise to median_ts). The MTP window change from 60 to 11 preserves the patch's effectiveness; no Phase 4 work required. Disposition recorded in DAA_LWMA1.md §5.5 with code citation. A minor doc-vs-code drift at blockchain.cpp:1540's cached-template path is recorded as a FOLLOWUPS.md candidate, not a Phase 4 atomic-cutover work item.
  • Item #3 (window size N=60 vs N=90). Documentation polish. DAA_LWMA1.md §4's N parameter row notes that zawy12 issue #24's 2018 "N ≈ 60" recommendation referred to T = 60 s chains; the recommendation scales inversely with T and for T = 120 s the canonical N is 90 (same ~90-minute window).
  • Item #9 (±7xT header timestamp limits vs FTL boundary). Documentation only. DAA_LWMA1.md §5.5 records that Shekyl uses MTP + FTL + symmetric solvetime clamp + running-max normalization (four mechanisms) as the defense surface and does not implement a separate per-block-header ±7xT rule, consistent with zawy12 issue #24 item 9's post-FTL deprecation of ±7xT.

  DAA_LWMA1_PLAN.md gains a "Round 9 dispositions" section recording all five issue-item dispositions and naming items #1, #2, #4, #5, #6, #10, #12, #15, #16 as already-addressed with their corresponding §ref. DAA_LWMA1.md status block on line 3 updated from "Round 8" to "Round 9" to reflect the cumulative review pass. (i) Round 9 supplement — local-time-only FTL trade-off named. The Round 9 closure of zawy12 issue #24 item 17 (FTL vs peer-time-derived clocks) recorded the absence of substrate but did not name the threat-model trade the local-time-only FTL disposition deliberately accepts. This supplement makes the trade explicit so a future reader does not misread the disposition as missing functionality. DAA_LWMA1.md §5.5's "Disposition on peer-time-derived clocks" paragraph is expanded into four labelled subsections: (1) the trade-off, named explicitly — Shekyl trades the zawy12 #17 / zcash/zcash#4021 peer-time-Sybil attack class (a ~$1000 attack accessible to anyone with bandwidth to run enough peers) for an operator-side NTP-hygiene requirement plus a coordinated-NTP-infrastructure- compromise threat that requires state-level access; (2) residual threat-class ranking — four classes documented from highest- probability/lowest-impact (individual node clock skew, mitigated by standard NTP hygiene, isolates affected node without propagating to peers) through lowest-probability/highest-impact (coordinated NTP-infrastructure compromise at scale, requiring state-level access, not consensus-protocol-mitigated); (3) operator obligations — validators are responsible for keeping local clocks within ±540 s of network truth via standard NTP discipline (multiple time sources, drift monitoring); NTP failure is a liveness failure for the affected node, not a safety failure that propagates; (4) Y2038-adjacent note — time(NULL) returns time_t, which on 64-bit platforms (the only Shekyl-supported platforms per the 32-bit retirement chore landed at commit e06ee37d96af, recorded in docs/FOLLOWUPS.md) is 64-bit signed and Y2038 is not a concern; if 32-bit platforms ever return to scope, both the FTL comparison and the FTL/2 forward-looking peer-time constraint must be revisited. DAA_LWMA1.md §1.2 (Commitment 1) gains a closing observation: "The FTL-disposition choice (local-time- only, no peer-time-derived clock) reflects a deliberate threat-model preference for closing low-bar consensus attacks at the cost of slightly higher operator NTP-hygiene responsibility — consistent with Shekyl's broader posture on operator autonomy per 75-system-autonomy.mdc." The trade itself, ranking observation, and the "safe because" framing on the FTL value reduction (7200 → 540) are now consistently cross-referenced from §1.2, §5.5, and this CHANGELOG entry. (j) Round 10 zawy12 issue #24 item-number reconciliation + issue pin + reference-file enumeration + commit-hash cite-stabilization. Round 10 review identified one load-bearing finding and three robustness improvements:

  • Item-number drift sweep (load-bearing). The Round 9 body edits used item numbers that did not match the live zawy12 issue #24 numbering: 11 was used for the September 2018 selfish-mine attack (live: item 14), 14 for the May 2019 33% Sybil (live: item 17), 6 for the Jagerman MTP patch (live: item 7), 8 for the post-FTL ±7xT disposition (live: item 9), and 13 for the January 2019 LWMA-2/3/4 deprecation (live: item 16). The pattern was not a uniform offset but a cluster of mistranscriptions during Round 9's body edits while the status block was checked separately. The Round 10 sweep corrected 14 sites in DAA_LWMA1.md body, 2 sites in DAA_LWMA1_PLAN.md body, and 2 sites in this CHANGELOG entry — all now consistent with the live issue and with the status block's "items 3, 7, 9, 14, 17" enumeration. The discipline going forward: cite by date + description as the primary identifier (e.g., "September 2018 selfish-mine attack class") so renumbering by the upstream author does not silently invalidate cross-references; the item number is a redundant cross-reference resolving against the §3 pin (next item).
  • zawy12 issue #24 pin (audit-trail-stable). DAA_LWMA1.md §3 gains a "zawy12 issue #24 pin (Round 10 addition)" bullet pinning the raw .body of zawy12/difficulty-algorithms#24 via docs/design/refs/zawy12_issue_24_history.md at Phase 2 PR time, using the same gh api + jq -r .body mechanism as the existing issue-#3 pin. Every "zawy12 issue #24 item N" cross-reference downstream now resolves against this pin's numbered list, not against the live GitHub-rendered issue. The pin's SHA-256 and capture timestamp land in §3's pin record at Phase 2 commit time. DAA_LWMA1_PLAN.md Phase 2 task content extends to commit the issue-#24 pin alongside the existing issue-#3 pin.
  • Phase 2 reference-file enumeration clarified. DAA_LWMA1.md §3's Round-9 disposition paragraph is expanded into an explicit three-file enumeration making clear that zawy12_issue_3_lwma1.md (raw issue-#3 .body, the canonical pin), zawy12_issue_3_lwma3.md (convenience extraction of just the LWMA3_() function, not the canonical pin), and zawy12_issue_3_lwma1_with_lwma3_step2.md (Shekyl-composed hybrid, a derived file used by the cross-check harness) are three distinct files with distinct purposes. The "snapshot pinned per §3" cross-reference at §5.3 step 2 now resolves unambiguously. DAA_LWMA1_PLAN.md Phase 2 body section gains a "Round 9 + Round 10 supplementary reference files" subsection enumerating all four Phase-2-committed files (three issue-#3 derivatives plus the issue-#24 pin) and extending the anchors-file schema with the LWMA3_() byte-offset anchors.
  • Commit-hash cite for 32-bit-retirement chore. DAA_LWMA1.md §5.5's Y2038-adjacent note and this CHANGELOG's Round 9 supplement entry both previously cited the chore by branch name (chore/retire-32bit-targets), which is a deleted post-merge branch and not a stable cite target. Both citations are now anchored on the merge commit e06ee37d96af ("Merge pull request #15 from Shekyl-Foundation/chore/retire-32bit-targets") with the rationale named in §5.5.

  Status block on line 3 updates from "Round 9" to "Round 10" recording the cumulative review pass. No algorithm-level or consensus-rule changes in Round 10; the round is documentation drift remediation and audit-trail-stability improvements. (k) Round 11 consumer-count drift reconciliation (Copilot review of PR #49). Copilot's first review pass on the ready-for-review PR flagged two count-mismatch findings of the same shape as Round 10's item-number drift — prose totals that did not match their adjacent enumerations. The Round 11 sweep reconciles both flagged sites plus the adjacent sites Copilot did not flag but that exhibit the same drift pattern (per the Round 10 discipline: fix the pattern, not just the flagged instances).

  • MTP consumer count (§9.6 in DAA_LWMA1.md, propagated to DAA_LWMA1_PLAN.md Phase 4 work item 6 and the breakdown paragraph). The §9.6 prose said "seven direct consumers ... plus two test-suite consumers" but the enumeration immediately below has always listed: blockchain.cpp:1981, 1985 (2 daemon sites) + blockchain.cpp:4223, 4230, 4240, 4259, 4285, 4293 (6 daemon sites) + tests/core_tests/block_validation.h:92, 97 (2 test sites) + tests/core_tests/block_validation.cpp:106, 120, 122 (3 test sites) — 8 daemon + 5 test = 13 total sites across 3 files. The prose now matches the enumeration: "eight direct consumers ... plus five test-suite consumers — thirteen total sites across three files." Downstream propagation: the Phase 4 work item 6 in DAA_LWMA1_PLAN.md previously read "the nine MTP consumers ... (seven in blockchain.cpp, two in block_validation.{h,cpp})"; it now reads "the thirteen MTP consumers ... (eight in blockchain.cpp, five in block_validation.{h,cpp})." The Phase 4 file-change breakdown paragraph previously read "9 MTP consumer rewires across 4 files (§9.6)" and now reads "13 MTP consumer rewires across 3 files (§9.6)" — the file count was also wrong (blockchain.cpp + block_validation.h + block_validation.cpp is 3 files, not 4; the prior "4" likely double-counted cryptonote_config.h where the #define lives, but that's already counted in the adjacent "1 MTP #define removed" item).
  • DIFFICULTY_* count (§9.2 in DAA_LWMA1.md and Phase 4 work item 3 + YAML phase4-cpp-cutover todo in DAA_LWMA1_PLAN.md). Copilot flagged the plan's Phase 4 work item 3 ("six constants" but enumerating seven names); the same drift exists in DAA_LWMA1.md §9.2 line 1973 ("all five inherited DIFFICULTY_* #defines and the two timestamp-validation #defines") and in the plan's YAML todo block (line 18: "Delete the 6 inherited DIFFICULTY_*"). The §9.2 enumeration has always listed seven DIFFICULTY_* defines plus two timestamp-validation defines, and the §9.3 cross-reference at line 2022 ("the seven DIFFICULTY_* defines plus FTL plus MTP") and the plan's breakdown at line 789 ("7 DIFFICULTY_* defines removed") have always been correct. The prose at line 1973, the plan's work item 3 body, and the plan's YAML todo are now reconciled to "seven" everywhere.
  • Forward-looking discipline. Both drift instances share the same pattern as Round 10's item-number drift: prose totals composed by hand on top of enumerations that accumulated incrementally across review rounds. The fix going forward, per the Round 10 discipline, is the same: a pre-PR scan for "prose says N, enumeration says M" mismatches catches the class before it lands as a Copilot finding.

  Status block on line 3 updates from "Round 10" to "Round 11" recording the cumulative review pass. No algorithm-level or consensus-rule changes in Round 11; the round is documentation drift remediation surfaced by the first AI-reviewer pass on the ready-for-review PR. (l) Phase 0 closeout (Round 12): §5.3 step 2 pseudocode reorder, Phase 1 pre-flight execution, hybrid-reference rename. (2026-05-18 UTC). Phase 0 ratified after 12 review rounds. Three load-bearing closeout actions in a single commit:

  • Status block transition. DAA_LWMA1.md line 3 transitions from "Status: DRAFT — Round 11 …" to "Status: RATIFIED — Phase 0 close (2026-05-18 UTC) — 12 review rounds. Round 12 was the final round; the status reflects ratification, not 'round 12 of N.'" The status block now records the Round 12 findings inline (pseudocode reorder, pre-flight execution, hybrid-reference rename, three reference pins landed) so that a future reader of the design doc sees the closeout summary without needing to read the CHANGELOG.
  • §5.3 step 2 pseudocode reorder (load-bearing correctness fix). Round 12 review identified an order-of-operations bug in the §5.3 step 2 pseudocode that contradicted the surrounding prose at lines 957–960 and 994–996. The pre-Round-12 pseudocode read prev_max = max(prev_max, timestamps[i-1]); solvetime[i] = timestamps[i] - prev_max; which, on the first loop iteration (i=1), executes prev_max = max(timestamps[0] - T, timestamps[0]), evaluating to timestamps[0] since T > 0. This overwrites the -T anchor the surrounding prose claims is preserved, producing solvetime[1] = timestamps[1] - timestamps[0] rather than the intended solvetime[1] = timestamps[1] - (timestamps[0] - T) = T + T = 2T on the stable input. The pseudocode is now reordered to subtract-then-max: solvetime[i] = timestamps[i] - prev_max; prev_max = max(prev_max, timestamps[i]);. On the first iteration this correctly evaluates solvetime[1] = timestamps[1] - (t0 - T) = 2T (using the -T anchor), then updates prev_max = max(t0 - T, t1) = t1. The prose at §5.3 lines 957–960 and 994–996 is updated to make the subtract-then-max semantics explicit, including the empirical observation (from the pre-flight harness, below) that the canonical zawy12 LWMA1_() reference behaves equivalently to the corrected Shekyl pseudocode on monotonic inputs (both produce 990_000 on the §8.1 stable vector) but diverges on out-of-sequence inputs (canonical 990_000 vs Shekyl-corrected 992_000 on the Round 12 regression vector), confirming the running-max mechanism's security property is load-bearing rather than cosmetic.
  • Phase 1 pre-flight verification (executed at Phase 0 close per §5.3 step 7). Built a minimal C++ harness from the canonical LWMA1_() reference transcribed verbatim from docs/design/refs/zawy12_issue_3_lwma1.md (lines 77–119 of the pinned .body), compiled with g++ -std=c++17 -O2, and ran against the §8.1 "perfectly stable hashrate" input vector with avg_D = 1_000_000, N = 90, T = 120, and timestamps[i] = 1_700_000_000 + i*T for i ∈ 0..=N. Result: canonical output 990_000 (matches §8.1 expected value). An initial harness run with timestamps[i] = i*T produced 10_000_000 due to uint64_t(0) - uint64_t(120) underflow at timestamps[0] - T; corrected to realistic Unix epoch timestamps and re-ran with the expected result. The Shekyl-corrected algorithm (transcribed from docs/design/refs/shekyl_lwma1_running_max_symmetric_clamp.md) was also compiled and run against the same stable input, producing byte-identical 990_000 (confirming §8.2's cross-check assertion that monotonic inputs match canonical byte-for-byte). An out-of-sequence regression vector (the same stable timestamps with timestamps[2] = timestamps[1] - 5*T) produced canonical 990_000 (attack neutralized to +1 via canonical's previous_timestamp+1 floor; no penalty) versus Shekyl-corrected 992_000 (attacker's negative-solvetime contribution to L produces higher next_D, denying the attack). The §5.3 step 7 stochastic-vs- deterministic framing and §8.1's stable-vector expected value are both empirically confirmed; the running-max mechanism's load-bearing security property in §5.3 step 2 is empirically verified by the regression vector. DAA_LWMA1.md §5.3 step 7 and §8.1 record the inputs, the actual outputs, and the divergence on the out-of-sequence vector; DAA_LWMA1_PLAN.md's Phase 1 pre-flight subsection records the executed result and preserves the reversion-clause triggers for any Phase 1 re-run that produces a different number.
  • Hybrid-reference rename (zawy12_issue_3_lwma1_with_lwma3_step2.md → shekyl_lwma1_running_max_symmetric_clamp.md). The Round 9 working name attributed the running-max + symmetric-clamp mechanism to canonical LWMA-3 ("with_lwma3_step2"), but canonical LWMA-3 (per the docs/design/refs/zawy12_issue_3_lwma3.md extraction referenced in the Phase 2 plan) does not actually implement running-max, signed-solvetimes, or symmetric clamping in the form §5.3 step 2 specifies — these are Shekyl-specific refinements drawing on the idea of LWMA-3's out-of-sequence handling but composed independently. The file is renamed to shekyl_lwma1_running_max_symmetric_clamp.md to reflect the Shekyl-specific construction; the file's preamble documents the naming rationale, the empirical equivalence on monotonic inputs, and the divergence on the regression vector. All cross-references in DAA_LWMA1.md §3 and DAA_LWMA1_PLAN.md are updated to the new name. The zawy12_issue_3_lwma3.md convenience extraction (verbatim LWMA-3 reference, not a pin) remains a Phase 2 work item per DAA_LWMA1_PLAN.md; it is not load-bearing for Phase 1.
  • Three reference pins landed at Phase 0 close. Per the Phase 0 close discipline obligation, the three Phase 2 spec- pin files landed as a Phase 1 precondition: docs/design/refs/zawy12_issue_3_lwma1.md (canonical LWMA-1 pin, SHA-256 14c68aee9780ca1b1fb8ca28ac43f7956996859f5281ef166cc0634b2cc50df9, captured-at 2026-05-18T05:25:21Z), docs/design/refs/zawy12_issue_24_history.md (LWMA history issue pin, SHA-256 94a6fc8f10b57cf7d0731f62d07c0b4bbdf65d969d7c8679755b22eace76891d, same capture timestamp), and docs/design/refs/shekyl_lwma1_running_max_symmetric_clamp.md (Shekyl hybrid reference, SHA-256 f16f62695ae74b2ca47d15227b79035cdc349609d9fc73db2b7a3c57c0dfcc4a, same capture timestamp). DAA_LWMA1.md §3's pin records embed the SHA-256s and timestamps; the LWMA1_() byte-offset anchors and the LWMA3_() convenience extraction remain Phase 2 work per DAA_LWMA1_PLAN.md (not load-bearing for Phase 1).

  Status block on line 3 updates from "DRAFT — Round 11" to "RATIFIED — Phase 0 close (2026-05-18 UTC) — 12 review rounds." Phase 0 is closed; Phase 1 (shekyl-difficulty crate scaffold per DAA_LWMA1_PLAN.md) opens against ratified spec. The pre-flight harness source (transcribed from the pinned zawy12_issue_3_lwma1.md LWMA1_() function) is available at this commit and is reproducible via g++ -std=c++17 -O2 preflight.cpp -o preflight && ./preflight.

  (m) Round 13 post-Phase-0-close cleanup (§5.3 step 9 canonical-rounding-step documentation, §8.1 base-anchor convention and arithmetic correction, harness commit). (2026-05-18 UTC.) Addresses Copilot PR #49 findings 3, 4, 5 surfaced after the Phase 0 close commit. Phase 0 stays ratified; Round 13 is post-ratification cleanup against the same design intent. Four load-bearing changes:

  • §5.3 new step 9 — canonical zawy12 LWMA-1 trailing rounding step. Documents the previously-undocumented ((next_D + r/2) / r) * r rounding-to-3-significant-decimal- digits step from canonical LWMA1_() (zawy12_issue_3_lwma1.md lines 116–119 of the pinned .body). The §8.1 expected values all depend on this step; without it, the raw outputs are 989_758 (stable), 1_035_252 (out-of-sequence), etc. — close but not byte-equal to the canonical 3-significant- digit values. Round 13 adds the step explicitly so the §8.2 canonical-reference byte-cross-check is well-defined, and includes a reversion clause requiring a §10 disposition for any future PR proposing to drop or alter it.
  • §8.1 timestamp base-anchor convention (Copilot finding 5). All §8.1 vectors are now specified as timestamps[i] = B + f(i) with B = 1_700_000_000 (Unix epoch base). The pre-Round-13 specification used i*T or (i-1)*T formulas with B implicit; the latter produced timestamps[0] = -T, unrepresentable as u64 (wraps to ~1.8e19) and the cause of the pre-flight harness's initial 10_000_000 mis-output before the Round 12 correction. Base-anchoring is now a §8.1 invariant rather than a harness-side workaround.
  • §8.1 out-of-sequence and minimum-L-floor vectors — full arithmetic rederivation (Copilot findings 3, 4). The pre-Round-13 out-of-sequence vector's worked arithmetic inflated the numerator by ~1000× and omitted the rounding step entirely (numerator 97_297_560 * 10^7 instead of 97_297_200_000_000; quotient 1_035_521_504 instead of step-9-rounded 1_040_000). Round 13 rederives L = T*(N-1)*(N-2)/2 = 469_920, computes raw next_D = 1_035_252, applies step 9 to round to 1_040_000, and cross-checks against the harness output. The minimum-L floor vector's expected output drops from 10_010_000 (analytic, missing step 9) to 10_000_000 (step-9-rounded); the analytic intermediate is preserved in the prose so the rounding-step contribution is auditable.
  • §8.1 selfish-mine attack regression — pinned numerical outputs. The Round-9-era assertion was relational only ("Shekyl > kyuupichan output," "Shekyl > all-monotonic-T reference"). Round 13 pins the empirical values: canonical 911_000, Shekyl 1_040_000. Canonical's 911_000 is below the 990_000 stable reference, surfacing the load-bearing property that canonical LWMA-1 actually rewards this attack class (lower difficulty post-attack means cheaper subsequent mining) — the regression Shekyl's running-max + symmetric-clamp formulation exists to fix. The §8.1 entry is rewritten to specify the canonical-and- Shekyl outputs side-by-side, the divergence ratio (~1.14×), and the four-part assertion the test vector must verify.
  • Pre-flight harness committed to tests/phase0/. The three C++ harnesses produced during Phase 0 close and Round 13 (preflight.cpp, preflight_corrected.cpp, preflight_outofseq.cpp) are now committed alongside the design doc as authoritative reproducibility artifacts, with README.md explaining build/run/license. The MIT SPDX identifier covers the canonical LWMA1_() transcription; the Shekyl variant header documents Shekyl Foundation origin. The DAA_LWMA1.md §3 reference list and §8.1 vector-derivation footer point at the harness directory; the Phase 1 implementer reproduces the pinned values via g++ -std=c++17 -O2 preflight_outofseq.cpp -o p && ./p before opening Phase 1's first commit.

  Round 13 leaves the RATIFIED — Phase 0 close (2026-05-18 UTC) line on DAA_LWMA1.md line 3 unchanged — Phase 0 closed at Round 12; Round 13 is post-ratification cleanup of finding-classes that surfaced after PR #49 was marked merge-ready. The summary paragraphs below line 3 are extended with a "Round 13 applied:" block listing the four changes above. Phase 1 remains unblocked.

• 07-consensus-atomic-cutovers.mdc — named exception to branching policy for consensus-atomic cutovers (feat/consensus-atomic-cutovers-rule, 2026-05-17). New rule ratifying the "consensus-atomic cutover" exception class drafted during PR #49's Round 5 review (DAA_LWMA1_PLAN.md Phase 4) and refined through Round 7 before landing. 06-branching.mdc's 5-working-day / 10-commit splitting guidance defends against unreviewable PRs accumulating; this rule names the small class of PRs that genuinely cannot split because every intermediate state would be a non-canonical consensus configuration. The rule is opt-in (alwaysApply: false) — a PR that does not explicitly cite the rule cannot invoke it. Four objectively-testable criteria, all required:

  1. Consensus-rule boundary. The PR changes behavior all correctly-implementing nodes must reproduce byte-identically on the same input. Refactors, RPC formatting, internal caches, renames, and file reorganizations of consensus code that preserve the rule do not qualify.
  2. Indivisible under flag decomposition. Met whenever criterion 1 is met, for structural rather than contingent reasons. A flag decomposition only counts as consensus-safe if both flag states are simultaneously valid (build-system flags, performance-tuning flags, instrumentation flags qualify). For a consensus rule, simultaneous validity is impossible by definition: the flag would have to dispatch identically regardless of state, which means it doesn't gate consensus behavior at all. Hard-fork activations are the consensus event the PR ratifies, not a decomposition of it; Shekyl's 60-no-monero-legacy.mdc no-version-dispatch posture forecloses any other interpretation. This shape closes the loophole where a PR author argues "yes, this is a consensus change, but splitting would be inconvenient": either the change affects consensus output (criteria 1+2 both met) or it does not (neither met).
  3. Surface enumerated in advance, with evidence. A grep-result-derived enumeration of every consensus-affecting symbol/file/constant pasted into the PR description, run against the PR's base commit and timestamped at PR-open so reviewers re-run the same grep against the same base commit to verify the surface hasn't shifted.
  4. Disposition documented in PR. Numbered sub-clauses: 4.1 rule citation; 4.2 per-criterion justification; 4.3 reviewer-map (with enforcement: substantive consensus changes found outside the map's "consensus-affecting" subsection are grounds for rejecting the PR — the response is re-opening with a corrected enumeration, not patching the map); 4.4 rollback procedure (with enforcement: procedure must be executable by a reviewer who has not seen the PR; tacit-knowledge rollback procedures fail 4.4).

  A "what this is not" section explicitly disqualifies convenience, velocity, reviewer bandwidth, and retroactive citation as justifications. A "compensating discipline" section names scope-creep within an exception-invoking PR as itself grounds for rejection. The rule records LWMA-1 Phase 4 as its first approved instance under "Approved invocations," and RandomX v2 Phase 3 under a separate "Cases that might appear analogous but are not" subsection — Phase 3 ships implementation routing (the 3a flag is a build-system / FFI-routing flag, not a consensus flag; the algorithm body is byte-identical on both sides), so criterion 1 is not met and the exception is structurally inapplicable, not "evaluated and rejected" (the latter framing would invite precedent-erosion arguments against future invocations). The mechanism for future invocations is self-anchoring: the invoking PR must include a commit that adds its own entry to the rule's history-of-application section, so the audit trail cannot be reconstructed retrospectively. Per 21-reversion-clause-discipline.mdc's named-criteria principle, the exception is auditable mechanically against the four criteria, not against LWMA-1-specific precedent erosion.

• RandomX v2 Rust port — Phase 0 design docs (feat/randomx-v2-phase0-design, 2026-05-16). Adds three Phase 0 design documents under docs/design/: RANDOMX_V2_RUST.md (the primary design), RANDOMX_V1_FALLBACK.md (the contingency design), and RANDOMX_V2_PLAN.md (the phased execution plan with sub-PR breakdown and gating diagram). The primary design pins the permanent C-miner / Rust-verifier split, derived-first verifier architecture under 18-type-placement.mdc, the one-function FFI target, no-prewarm disposition, performance budgets, C-library symbol-isolation invariant, and the wallet V3.2 gate before Track B. The Grover-bound argument scaffold is recorded in RANDOMX_V2_RUST.md §10; the concrete release-checklist target-range calculation is explicitly deferred to Phase 0 review per §10's closing sentence rather than shipped in this PR. The fallback doc records the late-binding unpin-and-revert recovery path (102f8acf pin plus verifier toggle) for any time between Phase 0 and genesis release if the algorithm-review gate fails per RANDOMX_V2_RUST.md §1.4.

• LWMA-1 difficulty-adjustment migration — Phase 2 cross-check harness + FFI export (absorbs original Phase 3) (feat/daa-lwma1-phase2, 2026-05-18). Lands the C++ cross-check harness that validates the Phase 1 Rust implementation against both the canonical zawy12 LWMA-1 reference and the Shekyl hybrid (running-max + symmetric-clamp) reference across the §8.1 test corpus per docs/design/DAA_LWMA1_PLAN.md Phase 2, and lands the shekyl_difficulty_lwma1_next FFI export the harness consumes.

  Phase 2/3 absorption. The original plan separated Phase 2 ("harness only") from Phase 3 ("FFI export only"). The "or" clause in Phase 2 ("via FFI declared in Phase 3, or via a tiny test-only C++ wrapper") collapsed to a single architectural disposition on audit: any C++ caller into Rust requires extern "C" symbols, and the only architecturally clean place to host them is shekyl-ffi (hosting in shekyl-difficulty itself would violate the Phase 1 #![deny(unsafe_code)] posture; hosting as a throwaway test shim would be torn down by the original Phase 3 anyway). The two paths collapsed: land the production FFI export in Phase 2 alongside the harness, and have Phase 3 collapse to a "see Phase 2" plan-doc note. The Phase 2 PR is correspondingly larger but produces zero throwaway code; the harness is the integration test for the production FFI surface.

  catch_unwind panic-safety wrapper dropped. The original Phase 3 prescription wrapped the FFI body in std::panic::catch_unwind. The workspace runs panic = "abort" in both dev and release profiles (rust/Cargo.toml lines 103, 106); under panic = "abort", catch_unwind is a no-op because panics terminate the process before any catch can engage. The Rust algorithm body is panic-free by construction (returns Result<u128, Error> for every spec error path; uses explicit checked_* / try_from overflow guards), and the §8.1 corpus exercises both branches. The FFI shim calls lwma1_next directly. SHEKYL_DIFFICULTY_ERR_INTERNAL (-4) remains reserved in the C header for forward compatibility but is not currently emitted.

  Reference pinning. Three pin records land:

  • docs/design/refs/zawy12_issue_3_lwma1.anchors.json — byte-offset
    • first/last-line anchors for LWMA1_() and the upstream LWMA-3 function inside the pinned .body, plus the pinned-body SHA-256 cross-reference (14c68aee9780ca1b1fb8ca28ac43f7956996859f5281ef166cc0634b2cc50df9). The anchors file's own SHA-256 (406320ca29e67e564b7c13eb0fd706b393f0af7558fd99bac391a73542250783) and capture timestamp (2026-05-18T18:22:42Z) land in DAA_LWMA1.md §3 as the pin record.
  • docs/design/refs/zawy12_issue_3_lwma3.md — convenience extraction of the canonical LWMA-3 (next_difficulty_v3) function from the pinned body. Shekyl-authored header (SPDX BSD-3-Clause AND MIT) plus byte-identical extraction against the anchors above. The pinned upstream LWMA-3 contains malformed C++ at upstream lines 376-381 (incomplete next_D = assignment and an unbalanced ) in the jump-rule branch); the extraction preserves the malformation as-is, documented in both the file header and DAA_LWMA1.md §3. The closing-brace anchor at upstream line 384 is a textual delimiter, not a balanced-brace marker. SHA-256: 9e2db49a7e2151177cced1748a3d0a4e7cb68ed2b0ecd0c2995cf86f38323671.

  FFI surface (rust/shekyl-ffi/src/difficulty_ffi.rs). New module exposing shekyl_difficulty_lwma1_next as a pub unsafe extern "C" fn with the ShekylU128 two-u64 decomposition ABI per DAA_LWMA1.md §6.1 (Round 5's disposition against target-defined Rust u128 C ABI). Error codes wire-stable at 0 / -1 / -2 / -3 / -4; null-input pointers permitted iff count == 0 (genesis short-circuit). Five unit tests cover the ShekylU128 round-trip, the genesis path, the null-pointer rejection paths (both out and inputs-with-nonzero-count), and the ERR_INVALID_COUNT mapping.

  C header (src/shekyl/shekyl_ffi.h). Adds the shekyl_difficulty_lwma1_next declaration, the struct shekyl_u128 definition, and the SHEKYL_DIFFICULTY_OK / SHEKYL_DIFFICULTY_ERR_NULL_PTR / _ERR_INVALID_COUNT / _ERR_OVERFLOW / _ERR_INTERNAL macros. The struct lives inside the existing top-of-file extern "C" block; macros sit at file scope below the block per the C++ rule that extern "C" applies to linkage of declarations, not to preprocessor symbols.

  **Cross-check harness (tests/difficulty/lwma1_cross_check.cpp

  • tests/difficulty/zawy12_lwma1_reference.h + tests/difficulty/shekyl_lwma1_hybrid_reference.h).** Iterates the seven §8.1 vectors and asserts the documented cross- implementation relations:
  • Vectors 1-5 (monotonic): canonical ≡ hybrid ≡ Rust (byte-equal at the §8.1 pinned outputs).
  • Vectors 6-7 (out-of-sequence): hybrid ≡ Rust (byte-equal at 1_040_000), both strictly different from canonical (1_010_000 for vector 6, 911_000 for vector 7 — the load-bearing security divergence per zawy12 issue #24 item 14).

  The canonical reference header carries the MIT SPDX header citing the pinned-body byte-offset anchor; the hybrid reference header is BSD-3-Clause-MIT dual-licensed (canonical portions are MIT; the step-2/3 refinement is BSD-3-Clause per the Shekyl Foundation copyright). The harness uses SHEKYL_DAA_* constants from shekyl/consensus_constants_generated.h (Phase 1's JSON-authoritative emit) so any drift between the JSON authority and the harness expectations fails the build.

  CMake / ctest integration. Extends tests/difficulty/CMakeLists.txt with the lwma1-cross-check target (linked against ${SHEKYL_FFI_LINK_LIBS}) and the lwma1_cross_check ctest registration. Harness reports 100 % passing across the §8.1 corpus; failure aborts the test.

• **LWMA-1 difficulty-adjustment migration — Phase 1 crate scaffold

  • spec-vector tests** (feat/daa-lwma1-phase1-crate, 2026-05-18). Lands the Rust crate rust/shekyl-difficulty per docs/design/DAA_LWMA1.md and DAA_LWMA1_PLAN.md Phase 1. Pure- arithmetic #![no_std] + #![deny(unsafe_code)] leaf crate with zero internal workspace deps; the FFI export (shekyl_difficulty_lwma1_next with the ShekylU128 ABI per DAA_LWMA1.md §6.1) is deferred to Phase 3 in shekyl-ffi.

  Public surface. lwma1_next(chain_height, &timestamps, &cumulative_difficulties) -> Result<u128, Error> transcribes the §5.3 algorithm verbatim (running-max + signed-solvetime per the §5.3 step-2 Shekyl refinement, symmetric ±6T clamp per step 3, i128 weighted-sum accumulation per step 4, min-L floor at N²T/20 per step 5, bias-corrected 99/200 formula per step 7, overflow guard per step 8, and the canonical rounding-to-3-significant-decimal- digits step 9 added in Round 13). Coupled timestamp predicates is_timestamp_below_ftl and is_above_mtp co-located in the same crate per DAA_LWMA1.md §2.5. Window-shape constants N, T_SECONDS, FTL_SECONDS, MTP_WINDOW, GENESIS_DIFFICULTY flow through the existing config/consensus_constants.json JSON authority (extended with five daa_* keys); the bias factor 99/200, the solvetime clamp 6, and the min-L floor divisor 20 deliberately stay as bare integer literals inside src/lwma1.rs per the Round 3 disposition (DAA_LWMA1.md §4) because changing them is a deviation from canonical zawy12 LWMA-1, not a tunable parameter.

  JSON-authority extension. config/consensus_constants.json adds daa_window_n=90, daa_target_seconds=120, daa_ftl_seconds=540, daa_mtp_window=11, daa_genesis_difficulty=100. cmake/generate_consensus_constants.py extends KEYS_INTEGER and the emitted header with five SHEKYL_DAA_* macros; until Phase 4 lands, these macros are emitted but have no C++ consumer (the Phase 4 cutover replaces inherited DIFFICULTY_TARGET_V2, CRYPTONOTE_BLOCK_FUTURE_TIME_LIMIT, and BLOCKCHAIN_TIMESTAMP_CHECK_WINDOW). rust/shekyl-difficulty/build.rs reads the same JSON and emits the Rust mirrors to OUT_DIR (Round 3's Option A; extending shekyl-engine-core/build.rs would have broken the leaf-crate property). The build script also emits usize mirrors of N and MTP_WINDOW as plain usize literals rather than via usize::try_from(u64) in a const block, because TryFrom::try_from is not yet const-trait-stable in rustc 1.95.0 (issue #143874); this keeps the workspace's cast_possible_truncation = "deny" lint clean without per-site #[allow] annotations.

  Test corpus. 18 tests all pass with the workspace's full lint suite under -D warnings. The 7 §8.1 spec vectors reproduce the Phase 0 C++ harness outputs byte-for-byte: 990_000 (stable), 1_980_000 (2× up), 495_000 (2× down), 892_000 (clamp engagement), 10_000_000 (min-L floor), 1_040_000 (out-of- sequence single back-step, Shekyl ≠ canonical's 1_010_000), 1_040_000 (selfish-mine attack regression, Shekyl ≠ canonical's 911_000). Edge cases: genesis short-circuit across chain_height ∈ 0..N returns GENESIS_DIFFICULTY, the §5.3 step-1 boundary surfaces Error::InvalidCount on length mismatch, a non- monotonic cumulative-difficulty input surfaces Error::Overflow, both branches of the §5.3 step-8 overflow guard execute cleanly, the solvetime[1] = -T regression computes without overflow, and the FTL/MTP predicates cover their respective boundaries.

  Gates. Per 45-rust-lint-checks.mdc, cargo test --package shekyl-difficulty, cargo clippy --package shekyl-difficulty --all-targets -- -D warnings, and cargo fmt --package shekyl-difficulty -- --check all pass. cargo check --workspace passes (the JSON authority extension does not affect existing consumers; shekyl-engine-core/build.rs continues to read only the FCMP/RCT keys it already consumed).

Changed

• Stage 1 PR 5 — Engine parameterized over P: PendingTxEngine (fifth type parameter) (feat/stage-1-pr5-pending-tx-engine, C6 = 0713591bf; default P = LocalPendingTx<LocalSigner, WalletGreedyOutputSelector, DaemonFeeEstimator>). Orchestrator methods build_pending_tx / submit_pending_tx / discard_pending_tx / outstanding_reservations dispatch through self.pending rather than reading Engine's former inline reservation map. Engine::replace_pending_tx (test-helpers) mirrors PR 4's replace_refresh pattern.

• Stage 1 PR 5 — Engine::discard_pending_tx reason-parameter drop at orchestrator boundary (C6). The orchestrator-facing discard_pending_tx(id) no longer accepts DiscardReason; the trait surface retains discard(id, reason) for V3.x consumer actors (ReservationTTLActor, etc.). Test call sites narrowed per the PR 4 precedent.

• Stage 1 PR 5 — reservation / pending-tx data-shape augmentation (C2γ). Reservation gains snapshot_id, extensions, and collection-membership encoding (no ReservationState enum under segment 2h); PendingTx gains snapshot_id. Submit snapshot staleness returns SubmitError::SnapshotInvalidated with rich ids; terminal daemon failures emit Discarded { DaemonRejectedTerminal }; ambiguous failures emit SubmitPendingResolution and keep the reservation in_flight.

• Stage 1 PR 5 — engine/pending.rs free-function extraction (C5β). Production paths live on LocalPendingTx; legacy build_pending_tx_in_state / submit_pending_tx_in_state / discard_pending_tx_in_state remain under #[cfg(test)] for migrated unit tests.

• Stage 1 PR 4 — Engine parameterized over R: RefreshEngine (fourth type parameter) (feat/stage-1-pr4-refresh-engine, PR 4 C5a = 553d70139; default R = LocalRefresh per the Round 4 turnkey-default discipline). Engine<S: Signer> becomes Engine<S: Signer, D: DaemonEngine = DaemonClient, L: LedgerEngine = LocalLedger, R: RefreshEngine = LocalRefresh> at engine/mod.rs. The orchestrator retry loop in engine/refresh.rs migrates from a free-function produce_scan_result(...) to trait dispatch on R via self.refresh.produce_scan_result(...) per PR 4 C5 = 7140f726a; the legacy producer scaffolding (produce_scan_result free function + ProduceError + ProgressEmitter + duplicated helpers + constants) is deleted from engine/refresh.rs per PR 4 C5β = b6a1274de. The new Engine::replace_refresh test-only constructor (consume-and- rebuild; refactored at PR 4 C7 = c9e65bbc6 from its initial &mut self setter form per PR 4 C6α = e9310542a) lets the R type parameter change between construction and replacement so test orchestration can build the engine with LocalRefresh at assemble time and rewire to FaultInjecting<LocalRefresh> for failure-injection scenarios. ViewMaterial::try_from_keys at engine/view_material.rs derives the trait-required view-and-spend material from the KeyEngine at engine-assemble time, populating the LocalRefresh constructor argument. Crate-level public APIs consuming the engine type alias (Wallet, WalletWithLedger<L> test helpers, RefreshHandle, the benchmark fixtures) thread the additional type parameters forward with appropriate defaults; no consumer outside the shekyl-engine-core crate is required to name R explicitly under the default-parameter discipline.

• Stage 1 PR 4 — RefreshError::InternalInvariantViolation { context: &'static str } variant addition (PR 4 C3 = c45894ffe; Phase 0c amendment per docs/design/STAGE_1_PR_4_REFRESH_ENGINE.md §5.4.7 R6 close-out). Resolves the Round 2 R6 "(a) extend ConcurrentMutation or (b) introduce InternalInvariantViolation" cleanup pin at the design layer. Disposition (b): conflating "wallet under sustained merge contention" and "wallet hit an internal bug" into ConcurrentMutation would deny downstream consumers (PeerReputationActor, telemetry, user-facing error surface) the structural distinction they need to respond correctly. The retry-loop call sites in engine/refresh.rs (per PR 4 C5 = 7140f726a) and the RefreshHandle::join dropped-sender site surface state-machine invariant violations as InternalInvariantViolation { context } with compile-time-fixed developer content; &'static str is appropriate at the orchestrator-internal site because the field carries no attacker-influenced data (the memory- amplifier and log-exfiltration vectors the producer-trait unit-variant discipline closes do not apply here). The variant is one of three RefreshError variants reachable from a RefreshEngine impl's Self::Error via Into (alongside Cancelled unit and Io(IoError)); the other three variants (MalformedScanResult, ConcurrentMutation, AlreadyRunning) are orchestrator-constructed only per the §6.1.1 two-enum architecture pin and the F-Mock-3-sharpening trait-reachable-variant enumeration.

Removed

• Electrum-words subsystem — Phase 2: JSON-RPC surface deletion (feat/electrum-words-removal-phase2-rpc-deletion, 2026-05-19). Deletes the inherited CryptoNote 25-word seed surface from the wallet JSON-RPC layer per docs/design/ELECTRUM_WORDS_REMOVAL_PLAN.md Phase 2 and docs/design/ELECTRUM_WORDS_REMOVAL.md substrate §2.4. Closes Phase 0 Mission Audit Lens B finding B-1 at the RPC layer (FFI + wallet2 core deletions follow in Phase 3 / Phase 4 / Phase 5). Landed across the commit list below (the bullet list is the source of truth; explicit count omitted because review iterations add closeout commits). All in src/wallet/wallet_rpc_server* plus tests/:

  • restore_deterministic_wallet JSON-RPC method + handler + COMMAND_RPC_RESTORE_DETERMINISTIC_WALLET request/response structs deleted. The method took a 25-word Electrum seed + optional seed_offset + language and reconstructed an account; Shekyl wallets restore from raw seeds via the shekyl_account_generate_from_raw_seed FFI surface (testnet/fakechain only per rust/shekyl-crypto-pq/src/account.rs's permitted network/seed-format matrix), not from word lists.
  • get_languages JSON-RPC method + handler + COMMAND_RPC_GET_LANGUAGES request/response structs deleted. The method enumerated Electrum-word language packs that have no analogue in the Shekyl seed flow.
  • language request field + is_valid_language(req.language) validation branch + wal->set_seed_language(req.language) call removed from COMMAND_RPC_CREATE_WALLET and COMMAND_RPC_GENERATE_FROM_KEYS. The request-schema change drops the field from the deserializer surface. epee KV-serialization is pull-based: keys the consumer struct does not declare are silently ignored, so callers that still send language="English" do not see a parse error — the value is dropped on the floor and wallet2::generate() runs with the wallet2 default seed language. The §4.3 hard-error discipline is enforced at the FFI surface (Phase 1 wallet2_ffi_create_wallet / wallet2_ffi_generate_from_keys reject non-empty language per src/wallet/wallet2_ffi.cpp:309–320, 485–495); the wallet-RPC handler reaches wallet2::generate() directly, so the FFI's hard-error gate is not on this code path. The load-bearing property at the wallet-RPC layer is therefore structural unreachability of the field from request parsing — no read path from JSON to behavior — rather than runtime rejection. Phase 3 deletes the FFI parameter entirely, collapsing both surfaces. The underlying wallet2::set_seed_language and crypto::ElectrumWords::is_valid_language symbols still exist (called from wallet2_ffi.cpp and wallet2 internals); their full removal lands with the mnemonics module in Phase 5.
  • seed and seed_offset request fields + the entire seed-recovery branch (the if (!req.seed.empty()) { words_to_bytes / decrypt_key / account.generate(...) / spend-key match check } block at wallet_rpc_server.cpp:2316–2366) removed from COMMAND_RPC_STOP_BACKGROUND_SYNC. The branch was P0-broken on mainnet/stagenet under the legacy 3-arg account.generate() overload (constant-drift audit docs/audit_trail/2026-05-ffi-constant-drift-audit.md); password-only stop_background_sync survives unchanged. A BIP39 / raw-seed replacement is a docs/FOLLOWUPS.md V3.2 item, not Phase 2 scope.
  • #include "mnemonics/electrum-words.h" removed from wallet_rpc_server.cpp (no remaining ElectrumWords callers in the file).
  • tests/functional_tests/ (29 files, 6,786 lines) deleted outright. The plan-doc draft proposed migrating 12 (actually 28) restore_deterministic_wallet and 3 (actually 4) stop_background_sync(seed=...) call sites to surviving RPC methods. Pre-flight investigation (2026-05-19) surfaced four blockers that flipped the disposition from migrate to delete: (a) the harness invokes monerod / monero-wallet-rpc binaries that don't exist in the Shekyl tree; (b) functional_tests_rpc and check_missing_rpc_methods were silently skipped in CI because the build environment lacked the requests / psutil / monotonic / deepdiff Python deps at cmake configure time — inherited dead code with no live caller; (c) shekyl-wallet-rpc lacks a --regtest / --fakechain flag and defaults to mainnet, so the FFI rejects raw-seed restore on the regtest daemon's fakechain network; (d) the harness is Monero-shaped end-to-end and warrants a Shekyl-native rewrite under its own design doc, not a "while we're here" revival here. Per 15-deletion-and-debt.mdc's default-delete posture, deletion is the disposition. add_subdirectory(functional_tests) removed from tests/CMakeLists.txt; the Functional tests section of tests/README.md is rewritten to record the deletion + the planning posture for a Shekyl-native replacement.

  Build verification: wallet_rpc_server, wallet, shekyld, and unit_tests targets all build clean; unit_tests ctest pass (306s, 0 failures).

• Vestigial CLSAG-era ring_size field (Phase 0 Mission Audit Lens E finding E.2-A; Batch α PR 2) (chore/audit-batch-alpha-pr2-ring-size-cleanup, 2026-05-17). Removes the surviving CLSAG-era "ring signature size" parameter from the C++ wallet RPC surface and from two blockchain-utility residue sites. Under FCMP++ with full-chain membership proofs, there is no user-tunable ring size; the anonymity set is the entire UTXO set. This entry completes the cleanup begun by the prior Rust-side ring_size removal recorded above ("Decoy and ring_size removal from Rust RPC") by deleting the remaining C++ residue that pre-genesis audit reviewers would otherwise read as semantically live.

  Wallet RPC surface (src/wallet/wallet_rpc_server_commands_defs.h). Deleted ring_size field + serializer from four request structs (COMMAND_RPC_TRANSFER, COMMAND_RPC_TRANSFER_SPLIT, COMMAND_RPC_SWEEP_ALL, COMMAND_RPC_SWEEP_SINGLE; all four were accepted-and-ignored via KV_SERIALIZE_OPT(..., (uint64_t)0) with zero readers in the post-FCMP++ codepath) and from one response struct (transfer_description inside COMMAND_RPC_DESCRIBE_TRANSFER; KV_SERIALIZE(ring_size) mandatory in response, populated by the now-meaningless min-across-sources walk below).

  Wallet RPC handler (src/wallet/wallet_rpc_server.cpp). Deleted the L1503–1505 min(cd.sources[s].outputs.size()) walk that populated desc.ring_size; under FCMP++, cd.sources[s].outputs.size() does not represent a CLSAG ring and the computed value has no consensus meaning. Adjusted the res.desc.push_back({...}) brace-init at L1471 to drop the corresponding std::numeric_limits<uint32_t>::max() third element.

  Blockchain logging (src/cryptonote_core/blockchain.cpp). Removed the ring_size local at L3192 and reformatted the MINFO log line from I/M/O to I/O (inputs/outputs). Under FCMP++ the "M" (mixin / ring-member count) field pulled from txin_to_key.key_offsets.size() no longer represents a CLSAG ring and was a vestigial logging residue.

  Blockchain-usage analysis utility (src/blockchain_utilities/blockchain_usage.cpp). Removed the ring_size field from the reference struct, the corresponding constructor parameter (uint64_t rs), and updated the sole call site at L216 from reference(height, txin.key_offsets.size(), n) to reference(height, n). The field was write-only across the utility's lifetime; the per-output frequency accounting at the loop's tail (L222–236) counts out.second.size() only.

  Scope and rationale. Pre-genesis Rule-60 residue cleanup per .cursor/rules/60-no-monero-legacy.mdc. The standalone-PR disposition (rather than folding into the V3.1+ Legacy wallet_rpc_server Rust cutover) was selected because folding means vestigial ring_size ships at genesis = concrete audit-confusion vector for genesis-audit reviewers (5 RPC structs + desc calc + log line + utility struct all look semantically live without reading FCMP++ disambiguators). Bisectable, mechanical, no architectural implications. Production- source diff (excluding this CHANGELOG entry, which adds ~70 lines of documentation delta): 4 files changed, 4 insertions(+), 19 deletions(-). Not RingCT proper — rct::* types, output commitments, Bulletproofs+ range proofs, and the wider RCT machinery remain load-bearing under RCTTypeFcmpPlusPlusPqc.

Changed

• RandomX v2 Phase 0 — Copilot PR #45 Round 2 findings addressed (5 inline + 16 low-confidence suppressed) (feat/randomx-v2-phase0-design, 2026-05-17). Round 2 of Copilot's inline review surfaced 5 inline comments and 16 low-confidence suppressed findings against the four design documents. Triage and disposition follow; all 21 were accepted with fixes (no rejections). The findings clustered into seven themes:

  1. Error-taxonomy ambiguity (RUST.md:776, PLAN.md:290). ERR_CACHE_DERIVE_FAILED and ERR_INTERNAL both claimed coverage of "Rust panic caught at FFI shim," making the taxonomy ambiguous for implementers. Resolved by assigning panics uniformly to ERR_INTERNAL (-4) via catch_unwind at the shim, while ERR_CACHE_DERIVE_FAILED (-3) covers only structured VM-level failures the derivation deliberately returns (e.g., debug_assert paths). The two codes are now disjoint by construction; the PLAN.md §2e prose mirrors the §17 taxonomy verbatim so future drift is impossible.

  2. Reviewer-rule misattribution (RUST.md:934, FOLLOWUPS reviewer-discipline rules-queue entry). Both entries cited .cursor/rules/06-branching.mdc as the source of an "at least one reviewer who is not the author" rule. Verified against the file: 06-branching.mdc governs branch flow and release operations and contains no reviewer-count rule. Rewrote both to acknowledge the requirement is an aspirational project convention, not a codified rule, and to record that the V3.1 24-reviewer-discipline.mdc rules-queue entry is the introducing rule rather than a promotion of an existing one.

  3. cncrypto PUBLIC-link survey gaps (RUST.md:499, PLAN.md:338/402, CHANGELOG.md:98). The Round 1 survey expansion (from 4 to 9 targets) was still incomplete and misnamed monero_fcmp_pp_crypto. Re-ran the survey against the pinned tree: corrected monero_fcmp_pp_crypto → fcmp_basic (with fcmp as the second src/fcmp/ target); added src/blockchain_db/, src/checkpoints/, src/device/, and src/wallet/ (wallet_rpc_server) to the production-src/ direct-consumer list; added tests/wallet_bench/, tests/daemon_tests/, tests/functional_tests/ (two targets), tests/hash/, and tests/performance_tests/ to the test-target list. Total direct-consumer count grew from 9 to 19 (13 production + 6 test). Also clarified the §10 vs §11 citation in PLAN.md: the survey is RUST.md §11, not §10 (§10 is the Grover-bound section); two PLAN.md references corrected.

  4. Phase 3c / Phase 4 ordering hazard (PLAN.md:338). Phase 3c deletes slow-hash.c / rx-slow-hash.c / pow_cryptonight.cpp together, but src/cryptonote_basic/miner.cpp still declares slow_hash_allocate_state / slow_hash_free_state extern "C" and src/cryptonote_basic/cryptonote_format_utils.cpp still calls crypto::rx_slow_hash and crypto::cn_slow_hash (PoW and KDF). Phase 4 was scheduled to remove these callers, so the intermediate state between 3c-landed and 4-landed would not build. Added an explicit ordering precondition: Phase 3c assumes §15 (RPC payments delete) and Phase 4 (version-gate + IPowSchema deletion) have already cleared the miner.cpp and cryptonote_format_utils.cpp call sites; if any caller remains at 3c open-time, the ordering is to pull that caller's removal forward into the 3c PR. Also noted that cryptonote_format_utils.cpp's cn_slow_hash calls at lines 1465/1473 are non-PoW KDFs that need a Rust-side replacement before 3c — a Phase 4 deliverable.

  5. RPC-payments §15.4 incompleteness (RUST.md:642). The deletion checklist omitted three surfaces: src/rpc/core_rpc_ffi.cpp (registers the six rpc_access_* JSON-RPC dispatch entries), src/rpc/core_rpc_server_commands_defs.h (defines the COMMAND_RPC_ACCESS_* request/response structs), and tests/functional_tests/functional_tests_rpc.py (includes 'rpc_payment' in DEFAULT_TESTS at line 13). All three added to the checklist.

  6. Section-number drift (CHANGELOG.md:23 inline + multiple §10 vs §11 references in PLAN.md). The May-16 changelog said "Grover-bound argument scaffold is recorded in RANDOMX_V2_RUST.md §9," but the actual section is §10 (§9 is "Environment and Consensus Constants"). The PLAN.md Phase 3c step and its corresponding Risk acknowledgement said "Phase 0 §10 PUBLIC-link survey" where the survey is RUST.md §11. All corrected to RUST.md §10 (Grover) and §11 (cncrypto) respectively.

  7. Smaller items. (a) #[export_name] CI grep extended in PLAN.md §2f to cover both bare and #[unsafe(export_name = "...")] forms, mirroring the existing no_mangle pattern; the RUST.md §7.2 prose now names both spellings explicitly so the design doc and the CI grep cite the same patterns. (b) PLAN.md §6 "5 hours of baseline PoW work" rewritten to match RUST.md §8's canonical numbers: 2-hour C baseline (12 ms × 600k), 4-hour delta at 3.0× ratio, 6-hour Rust-target total. (c) PLAN.md §9 Grover "√2 speedup" corrected to "square- root speedup against unstructured preimage search, ~2²⁵⁶ → ~2¹²⁸" matching RUST.md §10. (d) PLAN.md §15 "rewrite or delete" reframed as the resolved-to-delete disposition. (e) PLAN.md §5 (and RUST.md §5) seedheight(height) -> u64 discretionary export reshaped to the same i32-return + out-parameter discipline as the committed hash export, per 40-ffi-discipline.mdc. (f) FALLBACK.md §2's "external/randomx-v2 is not added in fallback mode" framing split into pre-Phase-1 and post-Phase-1 cases so §1's late-binding framing is honored. (g) FALLBACK.md §4 "filled after RUST.md §1" placeholder replaced with the concrete list of v2-deferred improvements drawn from RUST.md §1.3 (CFROUND throttling, F/E AES mix, program size, prefetch lookahead, efficiency-per-watt aggregate). (h) CHANGELOG.md May-16 entry's "six places" replaced with "eight places" so the count matches the enumeration that follows.

  Files touched: docs/CHANGELOG.md, docs/design/RANDOMX_V2_PLAN.md, docs/design/RANDOMX_V2_RUST.md, docs/design/RANDOMX_V1_FALLBACK.md, docs/FOLLOWUPS.md.

• RandomX v2 Phase 0 — Copilot PR-review-bot findings triaged and addressed (PR #45) (feat/randomx-v2-phase0-design, 2026-05-16). Copilot's inline review of PR #45 surfaced 13 findings against the Phase 0 design docs. Triage and disposition follow; 12 accepted with fixes, 1 accepted as a CHANGELOG-only softening (the Grover §9 placeholder is intentional Phase 0 work, but the CHANGELOG previously overpromised that it was shipped).

  Fixes in this commit:

  • CHANGELOG: PLAN.md added to the "Added" entry alongside RUST.md and FALLBACK.md (PLAN.md was added in this PR but the Added entry only named two of the three design docs). The Grover-bound claim softened to "scaffold recorded in §9; concrete release-checklist calculation deferred to Phase 0 review per §9's closing sentence."
  • PLAN.md frontmatter: overview: value wrapped in double- quotes per the WALLET_REWRITE_PLAN.md precedent so the unquoted : sequences (No prewarm: lazy, etc.) no longer break YAML parsing. Confirmed parsing via python3 -c "import yaml; ...".
  • PLAN.md Decision #6 cost analysis + §6 perf budget: rewrote the "below Nielsen's 100 ms threshold" claim (mathematically wrong: 150 ms > 100 ms). New framing: "above 100 ms by ~50 ms but well below the 1 s continuous-flow threshold, and invisible in practical RPC-round-trip context."
  • PLAN.md root-relative links: 32 cross-references rewritten from repo-root-relative (](src/...), ](rust/...), etc.) to proper relative paths (](../../src/...)) so GitHub renders them correctly from docs/design/. Verified each rewritten link resolves to a real path (29 OK; 2 intentional forward references: external/randomx-v2 is added by Phase 1, RANDOMX_V2_PHASE_3B_DELETED_CALL_AUDIT.md by Phase 3b).
  • PLAN.md Phase 2f C-ABI exports invariant: the existing extern\s*"C"\s*\{ grep matches only foreign import blocks, not the pub extern "C" fn shape the invariant is supposed to forbid. Replaced with three explicit patterns: #[no_mangle] (both spellings), extern "C" fn (any function declaration), and #[export_name = "..."] (the bypass shape). The intent of each pattern is documented inline.
  • PLAN.md Phase 3 caller-survey scope: added an explicit clarifying paragraph noting that the "six C++ daemon-side caller files" is the Phase 3 rewire set, not the full repo- wide rx_* footprint. The four additional files Copilot's grep surfaced (miner.cpp, cryptonote_format_utils.cpp, rpc_payment.cpp, wallet_rpc_payments.cpp) are intentionally handled by §15 (RPC payments deletion) and Phase 4 (version- gate + IPowSchema deletion), not by Phase 3.
  • PLAN.md Phase 2e allocation guidance: softened the misleading OOM coverage. The Phase 2e allocation APIs (Box::new_zeroed_slice, vec![]) are infallible: they abort on OOM rather than return an error, so the FFI shim never sees a result it could map to ERR_CACHE_DERIVE_FAILED. The plan now records that OOM at cache derivation aborts and that a fallible-allocation path with an ERR_CACHE_ALLOC_FAILED taxonomy entry is V3.x work if any future caller needs OOM- recoverable derivation.
  • RUST.md §1.2 reference clone: removed the contributor-specific absolute path /home/torvaldsl/shekyl/RandomX/ (committing a single developer's $HOME path is non-reproducible). Replaced with a portable description noting that Phase 0 contributors may keep a sibling clone at the same pin as a contributor-local convention, with a fork URL for those who prefer not to.
  • RUST.md §11 cncrypto PUBLIC-link survey: expanded the direct-consumer list from 4 targets to 9, adding the load- bearing common link (which sits below most subsystems and transitively re-exports randomx_* to everything depending on common) plus cryptonote_basic (two targets), cryptonote_core, daemon, and fcmp (two targets). Also recorded that tests/crypto/CMakeLists.txt's cncrypto-tests does not link cncrypto directly (it links common and gets cncrypto transitively); the test name is historical. Phase 3 link-drop checklist is now accurate.
  • RUST.md §19 audit doc filename: renamed RANDOMX_V2_PHASE3B_AUDIT.md (RUST.md's spelling) to RANDOMX_V2_PHASE_3B_DELETED_CALL_AUDIT.md (PLAN.md's canonical spelling). Single canonical filename across both design docs.
  • RUST.md §17 ERR_CACHE_DERIVE_FAILED semantics: clarified that this code covers VM-level failures and Rust panics caught at the FFI shim, not allocation failure. OOM during cache derivation aborts the process via handle_alloc_error per Rust's default allocator; this is consistent with PLAN.md §2e's infallible-allocation choice. A future ERR_CACHE_ALLOC_FAILED (-5) entry is sketched as V3.x work if a caller ever needs OOM-recoverable derivation.
  • FALLBACK.md status block: rewrote the L6 status block to match §1's late-binding framing. The previous text ("invoked only if Phase 0 review concludes RandomX v2 is not ready") contradicted the §1 round-1 revision that made the fallback invocable any time between Phase 0 and genesis release.

  Findings rejected or partially addressed:

  • Grover §9 placeholder (RUST.md L481): Copilot flagged §9 as incomplete because it ends with "Phase 0 review must fill this section with the concrete target-range calculation." The placeholder is intentional — concrete numbers depend on Shekyl's final difficulty-target tuning, which is a Phase 0 review item, not implementation. Disposition: keep §9 as-is; soften the CHANGELOG's claim about Grover-bound coverage (done in this commit) so the doc-vs-changelog asymmetry resolves.

  Files touched: docs/CHANGELOG.md, docs/design/RANDOMX_V2_PLAN.md, docs/design/RANDOMX_V2_RUST.md, docs/design/RANDOMX_V1_FALLBACK.md.

• RandomX v2 Phase 0 — plan-vs-design-doc drift fix and four smaller items (feat/randomx-v2-phase0-design, 2026-05-16). The previous round moved the algorithm-review gate from "before Phase 2" to release- time in RANDOMX_V2_RUST.md §1.4, but RANDOMX_V2_PLAN.md still carried the old Phase-2-gate framing in eight places: frontmatter algorithm-review-gate todo, frontmatter overview text, frontmatter phase5-docs todo, body §"Algorithm-review gate (Track A intra-track)", body §"Track A — Algorithm-review gate", body §"Track A — Phase 2 (gated on algorithm review)" title, body §"Risk acknowledgments" v2-algorithm-posture entry, and the mermaid diagram. This commit aligns the plan with the design doc: the gate is release-time, Phase 2 proceeds in parallel with Monero's audit, and the mermaid diagram redrawn so the release gate sits after Phase 5 with MonAudit/MonDeploy as parallel external inputs that don't block Track A or Track B. Also folds in four smaller items from the same review pass: (a) RANDOMX_V2_RUST.md §16 gains a const _: () = assert!(...) compile-time assertion that SEEDHASH_EPOCH_BLOCKS.is_power_of_two(), because the & !(SEEDHASH_EPOCH_BLOCKS - 1) mask in the seedheight() formula silently produces the wrong consensus result if the constant is ever changed to a non-power-of-2. (b) §17 adds an explicit four-case table for the data / data_len pairing so the data == NULL && data_len == 0 empty-input case is no longer ambiguous at the FFI boundary. (c) §23 gains §23.1 recording the per-gate reviewer-discipline calibration pattern as a candidate for promotion to .cursor/rules/24-reviewer-discipline.mdc. (d) Two new V3.1 FOLLOWUPS entries in FOLLOWUPS.md: one tracking the §22 Guix reproducible-build obligation pickup (fires when Guix integration lands; closes when the Guix-integration design doc rewrites §22 to point at the actual manifest), and one tracking the §23.1 reviewer-discipline rule promotion (sibling to the existing rules-queue entries). Softens the previous round's framing: the RandomX v2 work is primarily fresh debt clearance (IPowSchema/pow_registry, shekyl-consensus, RPC payments, and the rx-slow-hash.c stateful core were not previously tracked in FOLLOWUPS), so the Phase 5 FOLLOWUPS pass is mostly forward-looking close-records rather than closure of pre-existing items. The V3.0 pre-genesis queue's accumulation/resolution trajectory is unaffected by this work.

• RandomX v2 Phase 0 — algorithm-review gate moves from Phase-2 to release (feat/randomx-v2-phase0-design, 2026-05-16). Rewrites RANDOMX_V2_RUST.md §1.4 to record that the two Phase-0 open questions ("who else deploys v2?" and "who funds the v1→v2 delta audit?") both resolve to Monero. Monero is in the process of deploying upstream RandomX v2 (PR #317) in parallel with Shekyl's implementation, and is funding the delta audit. Because Shekyl is non-divergent from upstream (§1.1) the audit's scope covers Shekyl's pinned code byte-for-byte; Shekyl inherits the audit result without coordinating it. The previously-listed "algorithm-review gate before Phase 2" is removed — Phase 2 is faithful spec implementation, not an algorithm-soundness decision, and gating it on external work Shekyl does not control would either delay or duplicate effort. §1.4 introduces the explicit release-time gate: before genesis, Monero's production v2 deployment must have had meaningful observation-window exposure AND the Monero-funded delta audit must have completed without contraindicating findings. §1.1 records that non-divergence is a load-bearing strategic posture — what buys Shekyl audit inheritance and the unpin-and-revert v1 fallback — not an accident. §23 reviewer-discipline updated to reflect the release-time gate and to distinguish inherited external review (via non-divergence) from Shekyl-direct external review. RANDOMX_V1_FALLBACK.md §1 reframes the fallback as late-binding (any time between Phase 0 and release), unpin-to-102f8acf rather than stop-and-restart, with explicit Production-deployment-failure and Inheritance- failure trigger classes added to the existing list. Plan todo algorithm-review-gate rewritten from a Phase-2 blocker to a release-time gate that runs in parallel with implementation work.

• RandomX v2 Phase 0 — fork relationship and pinned source recorded (feat/randomx-v2-phase0-design, 2026-05-16). Rewrites RANDOMX_V2_RUST.md §1 from a forward-looking "Shekyl-controlled divergence" framing to the empirical picture: the Shekyl-Foundation/RandomX fork tracks upstream tevador/RandomX without divergence; RandomX v2 is the upstream tevador algorithm landed in PR #317 (commit bb6ed2c); and the fork's pinned commit is aaafe71 ("Prepare v2.0.1 release", 2026-05-10). (The original draft of §1.2 named a contributor-local sibling-clone path; that path was removed in the same review round per the portable-path rule, see the later Changed entry. The path is intentionally not quoted here either.) §1.3 distills the four concrete v1→v2 changes from the fork's doc/design_v2.md (CFROUND throttling, F/E AES mix replacing XOR, program-size 256→384, two-iteration dataset prefetch lookahead) and their ~130-165 % efficiency improvement on Zen 3/4/5 silicon. §1.4 records the algorithm-review status: the four 2019 audits in the fork's audits/ directory (Trail of Bits, X41, Kudelski, Quarkslab) cover v1 and bound the Phase 2 review scope to the v1→v2 delta rather than RandomX from scratch. §3 names the three normative spec files (doc/specs.md, doc/design_v2.md, doc/configuration.md) as the Rust port's source-of-truth references. §11 records that the current external/randomx submodule is at v1-era 102f8acf and Phase 1 adds external/randomx-v2 at aaafe71 as a new submodule alongside it (not a repoint) so the v1→v2 swap is a single reviewable commit later. RANDOMX_V1_FALLBACK.md §2 records that v1 lives at any pre-PR-#317 commit on the same fork (default fallback pin: 102f8acf, already in the existing submodule), and §3 records that the four 2019 audits already ship in the fork's audits/ directory at the pinned v1 commit.

• RandomX v2 Phase 0 — RPC-payments disposition resolved to delete (feat/randomx-v2-phase0-design, 2026-05-16). Rewrites RANDOMX_V2_RUST.md §15 from the open "rewrite or delete" question to an explicit delete decision with the rationale recorded (no users pre-genesis per 60-no-monero-legacy.mdc; the feature shipped with essentially zero Monero production adoption; a future monetization story is better designed fresh against 2026+ options than inherited from 2020). Adds §15.4 with the concrete deletion checklist — five rpc_payment* files plus wallet_rpc_payments.cpp plus a functional test deleted whole, surgical hook removal across core_rpc_server, bootstrap_daemon, node_rpc_proxy, wallet2, wallet_args, wallet_rpc_helpers, wallet_rpc_server, the daemon CLI command files, cryptonote_config.h, and the two CMakeLists — so Phase 4 inherits a checklist rather than a question. Tightens Phase 4 scope materially: the v2 verifier FFI export is consumed by daemon block verification only, with no wallet wiring. RANDOMX_V1_FALLBACK.md §2 records the deletion as algorithm-independent and inherits the same checklist under fallback.

• RandomX v2 Phase 0 — Round 1 review-feedback revisions (feat/randomx-v2-phase0-design, 2026-05-16). Expands RANDOMX_V2_RUST.md with new sections §16 (genesis-block seedhash handling, including the rx_seedheight early-block branch and a canonical Rust seedheight() form), §17 (FFI error-code taxonomy with stable negative codes), §18 (thread- safety contract for shekyl_pow_randomx_v2_hash), §19 (block.major_version field disposition after PoW dispatch deletion), §20 (BSD-3-Clause licensing and attribution), §21 (MSRV pin proposal and #[no_mangle] / #[unsafe(no_mangle)] grep coverage), §22 (Guix reproducible-build forward-looking impact), and §23 (reviewer discipline under the project's solo-architect reality). Tightens §3 with test-vector provenance rules (tests/vectors/spec/ vs tests/vectors/reference/), §8 with the synthetic pre-genesis 600k-block release-gate harness, and §15 with a checked-in grep result narrowing wallet-tree PoW touchpoints to wallet_rpc_payments.cpp:156/158/163. RANDOMX_V1_FALLBACK.md §2 records the upstream-tevador/RandomX-vs-Shekyl-fork v1 source choice and the BUILD_RANDOMX_V2_MINER_LIB rename, §4 fixes the cross-reference to RANDOMX_V2_RUST.md §1, §6 corrects the same cross-reference, and §7 mirrors the reviewer-discipline section.

• Stage 1 PR 3 — close-out: engine_trait_bench_key_account_public_address pair (chore/stage-1-pr3-closeout, 2026-05-12). Introduces the criterion + iai-callgrind sibling pair for the KeyEngine::account_public_address trait method, classified under the engine_trait_bench_* threshold class via compare.py's classify() function-name routing. The fixture is Box<LocalKeys> rather than the canonical (Box<Engine<...>>, TempDir) shape per the substrate-forced divergence documented in STAGE_1_PR_3_CLOSEOUT_PREFLIGHT.md §1.2 — Engine does not yet hold a LocalKeys field; orchestrator integration is KeyEngine PR-5 territory per STAGE_1_PR_3_KEY_ENGINE.md §2.1.1 (Round 4a workflow-shape pivot). Workload class is trivial pure-read (cached AccountPublicAddress borrow); iai-callgrind is the load-bearing signal because criterion median_ns reflects optimizer amortization across the iteration loop (§4.4 hoisting caveat). The bench-internals visibility expansion adds only LocalKeys to the pub surface (following the exact precedent of LocalLedger at Stage 1 PR 2 — name-only expansion; fields stay private). LocalKeys::from_test_seed becomes pub under #[cfg(any(test, feature = "bench-internals"))] matching LocalLedger::populate_for_bench's gating. AccountPublicAddress stays pub(crate) — the bench helper returns a primitive usize summary (sum of address-field byte-lengths) rather than the natural &AccountPublicAddress return type, sidestepping the API-widening Copilot's PR review flagged. Closes two of four deferred-bench slots from FOLLOWUPS.md's Stage-1-performance-baseline entry (ledger_balance previously satisfied at Stage 1 PR 2, key_account_public_address here); two EconomicsEngine slots remain pinned to the EconomicsEngine trait-introducing PR.

Changed

• Stage 1 PR 4 — Round 4 review pass meta-review amendment (review of F1–F9 disposition substrate; three additional findings F11–F13 dispositioned without reopening Round 1–4) (feat/stage-1-pr4-round-4, 2026-05-15). Doc-only meta-review of the F1–F9 disposition substrate itself, asking "do the dispositions create new attack surface or leave under-specifications that would surface at Phase 1 commit-authoring as substrate decisions?" Three additional findings emerged, each targeting an under- specification introduced by an F1–F9 disposition rather than a substrate decision Rounds 1–4 settled; none reopens a Round 1–4 disposition; the F1–F9 dispositions remain unchanged. F11 (per-transaction cancellation safe-point pin; meta-review of F2). F2's five-checkpoint discipline pinned that a per-transaction cancellation check fires but did not pin where in the per-transaction body. F11 pins the check fires between transactions, after the prior iteration's Zeroizing<…>-wrapped per-output materials have left scope, before the next transaction's view-tag / hybrid-decap / key-image derivation begins (forbidding mid-derivation firing that would defeat F2's lock-latency property by exposing partial-derivation state on the unwound stack to memory-disclosure adversaries). C7's AssertionSink / coherence-pair test substrate gains a safe-point fixture asserting no partial- derivation state at the observed cancellation point. F12 (cross-emitter ordering contract-gap; meta-review of F4). F4's seventh contract pin (per-emitter FIFO preserved; cross-emitter ordering undefined) is enforced procedurally; consumer-actor authors who depend on cross-emitter arrival order produce code that compiles cleanly, passes per-emitter FIFO tests, and silently misbehaves under reordering at audit. F12 closes the gap at the discipline level (V3.0: §5.4.6 amendment binding consumer actors to derive cross-emitter ordering from causal-context fields like SnapshotId, ReservationId

  • version, BlockHeight) and at the lint level (V3.1+: scope-extending the FOLLOWUPS F5 entry to a unified diagnostic_consumer_discipline lint covering both recursive-trust-boundary and cross-emitter-ordering misuse sub-scopes). PR 5 §5.0.3 carries the parallel amendment. F13 (SuppressedRateLimit field-shape pin; meta-review of F6). F6 added the SuppressedRateLimit variant without pinning its field shape; counts, timestamps, and original-event payloads are each attacker-relevant signal (counts are a covert channel back from the producer's internal state; timestamps add scheduling side-channels; payloads defeat the projection-type discipline). F13 pins the variant carries class: SuppressedClass only, where SuppressedClass is a project-defined #[non_exhaustive] enum at the same crate-root scope with arms one-per-rate-limited event class; consumer actors derive the suppression count from absence-of- further-events within the attempt boundary. C2's SuppressedClass enum addition lifts the flat-crate-root re-export list from eight items to nine. The implementation-branch authorization continues to hold; the meta-review amendment shapes Phase 1's substrate without reopening it or extending its scope. The meta-review pattern itself is recorded as a forward- template under 16-architectural-inheritance.mdc's "audits-are-clean-so-compress" anti-pattern framing: clean F1–F9 dispositions invite declaring victory; the discipline asks whether the dispositions themselves carry the property they claim before implementation cuts against them.

  Post-amendment sub-pins (F11-S, F12-S, F13-S, 2026-05-15). A third-pass review of the F11–F13 dispositions themselves surfaced three Phase-1-author-aware sub-pins. Each sharpens the corresponding F-finding's disposition without reopening it; none reopens a Round 1–4 substrate decision; none reopens an F1–F9 disposition. The recursive structure (review pass → meta-review → post-amendment) is the closure rule's reopening mechanism operating at each level of the substrate hierarchy. F13-S (SuppressedRateLimit emission-cadence sub-pin; the substantive one). F13's field-shape pin (carries class only) closed the payload covert channel but left the emission-cadence covert channel open: if the producer emits one notice per suppression-fire, an attacker reconstructs suppression frequency by counting notice arrivals in their own emit-arrival timeline regardless of payload shape. F13-S pins emission cadence at "at most one SuppressedRateLimit { class } per class per attempt" — the producer's per-attempt emit_state carries a per-class notice_emitted: bool latch, cleared at attempt start, never cleared mid-attempt; subsequent in-class budget exceedances drop events but do not emit further notices. Cross-attempt cadence (attacker forcing many attempts via ConcurrentMutation-driven retries) is bounded at the orchestrator's existing retry-loop policy layer; no producer-side state survives across attempts (the zeroization scope for ViewMaterial and Scanner forecloses producer-side cross-attempt state). F11-S (per-output safe-point escalation criterion). F11's per-transaction safe-point closes the mid-derivation residency window for typical transactions but may not hold under hostile transactions carrying many outputs (FCMP++ permits some upper bound; the §3.1 lock-latency property's content-independence becomes content-dependent if recover_outputs_in_tx's per-output cost grows linearly with output count above the lock-latency target). F11-S pins the escalation criterion: Phase 1 commit-author verifies against benchmarked cost on reference hardware and against the protocol-parameter upper bound on outputs per transaction; if worst-case per-tx scan time exceeds the §3.1 lock-latency target, the safe-point escalates to per-output granularity (check between consecutive per-output decap iterations). The C4 commit message records the measurement and the chosen granularity. F12-S (diagnostic_consumer_discipline lint conceptual unification). F12's unification is at the contract level (one named discipline, two related properties); the implementation strategy follows each property's nature (F5 sub-scope likely as a compile-time trait-bound or clippy lint over consumer constructors; F12 sub-scope likely as an AST-level pattern-match over event-handler bodies). F12-S pins the conceptual-not-monolithic clarification in the FOLLOWUPS entry, foreclosing a future "the lint doesn't exist as a single pass" finding from invalidating a multi-check implementation that delivers the unified discipline. The post-amendment pattern compounds the closure-rule discipline (PR 5 §7): each level closes the wargaming surface known at its own closure time; reopening is explicit at the level of the surface that surfaced. The implementation-branch authorization continues to hold; the sub-pins shape Phase 1's substrate without reopening it or extending its scope.

• Stage 1 PR 4 — Round 4 review pass (adversarial review of post-Round-4 substrate; nine findings dispositioned) (feat/stage-1-pr4-round-4-review, 2026-05-15). Doc-only pre-implementation adversarial review of the post-Round-4 substrate before Phase 1 cuts. Two reviewers exercised the diagnostic-stream seam, the encrypted-persistence opt-in language at PR 4 §5.4.8 #1, and the resilience surface from a hostile-daemon perspective; the pass produced nine actionable findings, all dispositioned and applied as substrate hardening rather than reopening any Round 1–4 question. Full writeup at PR 4 §5.4.9. Findings cluster across three threat-model surfaces. Feature-soft-commitment hardening (F1, F7). F1 rewrites the §5.4.8 #1 R17 encrypted-persistence opt-in language from "V3.x evaluates" to a hard rejection at V3.0 with strict conditional reopening criteria (six attack vectors named: crypto code-path expansion, deserialization-on-startup, metadata side-channel, cross-wallet correlation, adversary-controlled DoS, forensic-artifact); F7 adds a parallel new §5.4.8 #6 rejecting "encrypted cache for RPC recovery" V3.x candidates at V3.0 under symmetric criteria. PR 5 §5.4 R17 carries the F1 hardening symmetrically; the FOLLOWUPS PersistenceConsumerActor entry is rewritten as a conditional-reopening bookmark with no version target. Checkpoint-discipline tightening (F2). §3.1 wallet-lock-latency property refines from "single-block scan time, typically tens of ms" to "per-transaction scan time, sub-block-bounded; millisecond- scale even under adversarial daemon block crafting"; §7 checkpoint discipline extends from four to five checkpoints with a per-transaction inner cancellation check inside the per-block scan loop (closing the adversarial-block-crafting / extended-spend-secret- residency vector). Diagnostic-stream contract pinning (F3, F4, F5, F6, F8, F9). F3 pins AssertionSink / PanickingSink as permanent CI regression coverage rather than one-shot landing tests; F4 adds a seventh contract pin at §5.4.6 (per-emitter FIFO ordering preserved; cross-emitter ordering undefined) — the same pin lands symmetrically in PR 5 §5.0.3; F5 strengthens §5.4.8 #4's aggregator-republisher recursive-leak framing with a V3.x forward-template (per-consumer external-surface audit, projection-or-rejection, future CI-lint enforcement) and gets a new V3.1+ FOLLOWUPS entry (consumer-actor-PR aggregator-republisher CI lint); F6 adds a producer-side per-class emission rate budget to §5.4.8 #5 (per-block ceilings per event class plus a RefreshDiagnostic::SuppressedRateLimit variant); F8 adds a new §5.4.8 #7 acknowledging emit-timing variance as a microarchitectural side-channel residual with a Phase 1 implementation note for bounded-variance lock-free queues; F9 adds a §6 projection-type audit per event class with explicit V3.0 per-class projections for TracingDiagnosticSink and gets a new V3.x FOLLOWUPS entry (diagnostic-stream spec-doc projection- type formalization). The §7.X commit decomposition absorbs the substrate hardening: C2 carries the SuppressedRateLimit variant + per-class projections + 7th contract pin; C4 carries the per-transaction inner cancellation check + producer-side per-class emission rate budget enforcement; C7 carries AssertionSink / PanickingSink as permanent CI fixtures. The α-disposition still holds; all Round 1–4 dispositions still hold; the review pass hardens contract pins and attack-surface dispositions without reopening any design question. Implementation-branch authorization (per §6 Round 4 readiness gate) is unchanged; Phase 1 cuts against the hardened substrate. The review-pass shape is recorded as a forward-template artifact under 16-architectural-inheritance.mdc's "discovery cadence" framing — substrate hardening ahead of implementation is reusable for PR 5+ pre-implementation substrate review.

• Stage 1 PR 4 — Round 4 close (commit decomposition + Phase 1 commit list) (feat/stage-1-pr4-round-4, 2026-05-14). Single-commit doc-only Round 4 close on STAGE_1_PR_4_REFRESH_ENGINE.md per the PR 1 / PR 2 / PR 3 / PR 5 precedent. §4 Phase 0 candidates (0a–0e, with 0d struck) finalize as binding-pinned at the type-signature level; Round 4 audit confirms DaemonOp two-variant and ProtocolErrorKind five-variant refresh-reachable subset against the producer's actual call sites. §6 review checklist fills in following PR 5's shape (binding-check matrix against V3_ENGINE_TRAIT_BOUNDARIES.md §2.3, test-substrate preservation list, call-site sweep audit, Round 4 readiness gate authorizing Phase 1 cut). §7 extends with the Round-4 retrospective + a new §7.X Phase 1 commit decomposition subsection — eight load-bearing-ordered commits (C0 doc-only spec amendment + C1 trait declaration + ViewMaterial type; C2 RefreshDiagnostic + DiagnosticSink + Stage 1 sink impls; C3 RefreshError::InternalInvariantViolation variant addition; C4 LocalRefresh aggregate + producer-body migration; C5 Engine parameterization + retry-loop call-site migration + RpcError classification; C6 MockRefresh test substrate + replace_refresh; C7 hybrid retry test + AssertionSink / PanickingSink property tests; C8 docs + CHANGELOG). §8 closes out the five "Remaining for Round 4" items (each marked Round-4-deliverable or Phase-1-commit-target) and updates the round trajectory banner — all PR-4-internal design rounds are closed. Implementation branch (feat/stage-1-pr4-refresh-engine) is authorized to cut off the post-Round-4 dev tip per the §6 Round 4 readiness gate; no further design rounds open unless Phase 1 commit-authoring surfaces a structural finding (the closure rule per STAGE_1_PR_5_PENDING_TX_ENGINE.md §7 governs reopening if it does).

• Stage 1 PR 4 — Round 3 confirmation (α confirmed by PR 5 Round 1's actor-mesh-framed disposition) (feat/stage-1-pr4-round-3-confirmation, 2026-05-14). Single-commit doc-only Round 3 closure on STAGE_1_PR_4_REFRESH_ENGINE.md. PR 5 Round 1's disposition under the actor-mesh framing (per STAGE_1_PR_5_PENDING_TX_ENGINE.md §5.0 / §5.2 / §5.5) confirmed shape (1) — snapshot-ID pinning — with the reservation tracker holding monotone semantics under PR 4's α; PR 4 advances directly to Round 4 (commit decomposition

  • Phase 1 commit list). The provisionally-load-bearing qualifier on Round 1's α (per §5.3 / §5.4.7 R1 / §8) is closed; the re-evaluation gate collapsed without firing. Four housekeeping items land alongside the closure: (1) §3.1 acknowledges the V3.0 dual spend-material holder state — LocalRefresh / Scanner (PR 4 R4 (a), inheritance-asymmetry justification) and LocalSigner (PR 5 R11 (b), architectural-integrity-now justification), convergent to one holder via R4 (c) in V3.x; (2) §8 / FOLLOWUPS R4 (c) entry cross-references PR 5 R11 (b)'s Signer trait substrate as the V3.x migration target — the R4 (c) migration becomes "Scanner stops holding spend material; delegates key-image generation via the existing Signer trait" rather than designing the split from scratch, shrinking the V3.x cost to a producer-side shape change (no architectural change); (3) the REFRESH_DIAGNOSTIC_STREAM.md → DIAGNOSTIC_STREAM.md rename housekeeping was already covered by PR 5 segment 2g — no PR 4 doc references remain to sweep (confirmed by rg); (4) §5.4.8 #1's drop-on-close-by-default rule is acknowledged as project-wide rather than refresh-specific per PR 5 R17's closure — V3.0 ships drop-on-close across all diagnostic streams; per-stream wallet-internal encrypted-persistence opt-in is a V3.x refinement evaluated at the diagnostic-stream spec doc. The discovery-cadence prediction in 16-architectural-inheritance.mdc ("PR 4 onward's audits are increasingly likely to be confirmations") holds at the Round 1 / Round 3 boundary on the load-bearing question; the Round 2 reframe and PR 5 R11 (b)'s reframe are the two structural-density events that surfaced inside this PR's design rounds.

• **Stage 1 PR 3 — close-out: STAGE_1_PR_* design-doc past-tensing

  • plan-vs-state-divergence rules-queue input sharpening** (chore/stage-1-pr3-closeout, 2026-05-12). Three-commit close-out PR consolidating audit findings from PR #40 under the trinary rule-15 reading per STAGE_1_PR_3_CLOSEOUT_PREFLIGHT.md:
  • A1 commit (mechanical past-tensing sweep): reconciled 17-reference enumeration across STAGE_0_HARNESS.md, STAGE_1_PR_1_DAEMON_ENGINE.md, and STAGE_1_PR_2_LEDGER_ENGINE.md to 13 in-scope references; PERFORMANCE_BASELINE.md's four references were deferred to the A2 commit which rewrites those sections wholesale. Mode-2 closing-out residue under the trinary rule-15 reading, swept inline rather than deferred.
  • B1+B2 + lemma commit (rules-queue input sharpening for V3.1): extends FOLLOWUPS.md §19 (plan-vs-state-divergence) with the commit-history-level fourth-precedent instance (PR #40's 4-vs-6-vs-8 commit divergence between planned logical units, pre-review commit count, and final merged commit count). Extends the rule-15 trinary entry with PR #40's applied-disposition table (eight dispositions across two review-response cycles, classified by mode 1/2/3). Adds a new V3.1 entry — "Rules-queue: encode the pre-flight-FOLLOWUP-scope discipline" — generalizing the recurrence that FOLLOWUP items naming target PRs as resolution points orphan when target pre-flights don't claim them; cites L353-379 KeyEngine slot's M-series-wide skip as precedent.
  • A2 commit (KeyEngine bench introduction): see the "Added" section above for full detail.
  • C1-C3 audit verifications (recorded in PR description): TransferDetails field removal structurally complete; M3-series naming sweep complete (preserved-as-history or false-positive); 42-serialization-policy.mdc stale globs closed in M3e. Three clean-as-found invariants from PR #40's audit pass.

• Stage 1 PR 3 — M3e: documentation realignment to post-M3d architecture (feat/stage-1-pr3-m3e; six commits cut off dev post-M3d, landing the four logical units planned at amendment-cycle time per STAGE_1_PR_3_M3E_PREFLIGHT.md §4: the "preflight + review-response + amendment" logical unit landed across three actual commits — original preflight at 82693bab7, forward-templates capture at 4b931b1b5, amendment at 1f9a7ad59 — followed by three substantive commits at 8e6780062 / 582c19caf / c61f0d38f. The plan-vs-state divergence between the four-logical-unit framing and the six-actual- commit landing is recorded inline in §4 of the preflight as an instance of the §19 plan-vs-state-divergence pattern at the commit- history level). Closes the M3-series migration of TransferDetails per docs/completed/STAGE_1_PR_3_MIGRATION_PLAN.md §3.5 (M3e — documentation realignment-of-the-whole) and docs/completed/STAGE_1_PR_3_M3E_PREFLIGHT.md §6 (Success criteria). The M3-series (M3a–M3e) is complete; the "secrets confined to engine" property activated by M3d is now reflected throughout the design-doc and rules-corpus surfaces.

  • Design-doc realignment. KEY_ENGINE.md carries a post-migration status banner and past-tensed forward-looking framing in §1.1, §1.2, §5.2; open questions in §7 are annotated per-question with [Closed at M3<X>; see <ref>] or [Remains open / Forward-looking record] while preserving original framing as historical record. V3_ENGINE_TRAIT_BOUNDARIES.md replaces the pre-migration KeyEngine trait block with the post-M3 4-method shape (account_public_address, derive_subaddress, try_claim_output, sign_transaction per rust/shekyl-engine-core/src/engine/traits/key.rs:616), refactors the per-method classification table and retry-safety enumeration, and updates 13 scattered narrative references to sign_with_spend → sign_transaction while preserving the "Round 2 dispositions" section's original Q9.1/Q9.2/Q9.3 framings as historical record. MIGRATION_AUDIT.md gains a post-M3 status banner clarifying that the audit's commit hashes (ffcaa62e9 and e6efaf5b5) are immutable historical anchors and are not to be refreshed to post-M3d state. The discrepancy between the M3e preflight's D2 count (claimed "0 references to old KeyEngine method names outside the trait block") and the actual surface (17 references found) is documented in the commit message; the surface was classified as mode-2 mechanical-residue under the rule-15 trinary reading (per STAGE_1_PR_3_M3E_PREFLIGHT.md §11.1) and swept inline rather than deferred.

  • Rules realignment. .cursor/rules/42-serialization-policy.mdc underwent a mechanical rename of all 11 stale crate-path references (shekyl-wallet-state → shekyl-engine-state; shekyl-wallet-file → shekyl-engine-file) across the globs frontmatter, intro paragraph, pairing table, mechanical enforcement subsections, and procedure section. The stale globs field previously prevented the rule from auto-applying to any file under the workspace's renamed crate trees; the realignment restores the auto-application surface. Closes the M3d-surfaced rule-realignment FOLLOWUP (relocated to the "Recently resolved (audit trail)" section in FOLLOWUPS.md).

  • FOLLOWUPS structuring. FOLLOWUPS.md gains a "Queue structure" preamble that splits the queue into V3.0 pre-genesis (load-bearing; per-PR overhead compounds the pre-genesis trajectory) and V3.1+ post-genesis (sustainable backlog) queues. The Stage 2 KeyEngine-actor entry is updated to reflect the post-M3 trait surface. Two new V3.1 rules-queue entries are added: "Encode the rule-15 trinary reading in 15-deletion-and-debt.mdc" (codifying the M3e §11.1 calibration shift that distinguishes in-scope mechanical- residue from out-of-scope structural-tangent) and "Consolidate the rules-queue itself into 1–2 PRs" (pinning the consolidation target from M3e §11.3 against the current six-deep rules-queue accumulation).

  • Path-rename residue sweep. The 34-occurrence path-rename residue surfaced by the M3d → M3e D5 audit (path-rename surface across 12 files) was swept inline per the rule-15 trinary-reading calibration shift. Per-category disposition:

    • Active narrative documents updated (current-state references, no append-only constraint): 8 adversarial test fixture markdown files + their README; 2 crate-internal READMEs (shekyl-engine-state/fuzz, shekyl-scanner); 3 benchmark prose documents (benchmarks/README.md, shekyl_rust_v0.manifest.md, wallet2_baseline_v0.manifest.md); the V3_WALLET_DECISION_LOG.md intro paragraph only (dated entries preserved per append-only discipline); and the WALLET_REWRITE_PLAN.md current-state architecture descriptions (Mermaid diagrams, inventory section, gap section, locked-design section, code-block comment, narrative paragraphs at §3.2 and Phase 1 audit; PR-0.X sections preserved as historical PR descriptions).
    • References preserved as historical anchors (49 occurrences across 6 files): CHANGELOG.md (6 occurrences: rename-event entries plus this M3d entry's historical reference to the pre-realignment rule state, which this M3e entry now closes); FOLLOWUPS.md (8 occurrences across historical audit-trail entries plus the new M3e entries that reference the rename event); V3_WALLET_DECISION_LOG.md (16 occurrences across dated decision-log entries protected by the file's append-only discipline); WALLET_REWRITE_PLAN.md (6 occurrences inside PR-0.X historical descriptions); shekyl_rust_v0.json (10 occurrences; captured baseline pinned to git_rev anchor a2bf417e4b7985ed2097dc5d3fb53affef306d1a); and shekyl_rust_v0.iai.snapshot (3 occurrences; historical iai-callgrind capture). Refreshing these would falsify their respective historical anchors.

    The trinary-reading calibration anchors the sweep: substrate- change mechanical-residue (the rename was the substrate change; the path references inside active documents are its residue) folds into the closing PR; historical anchors and append-only entries are preserved by construction. The discriminating tests (derivability + boundedness + traceability

    • surface-during-review) are satisfied by the sweep's discoverability via single rg invocation and by surface during the M3e preflight's D5 audit.

Removed

• Stage 1 PR 3 — M3d: legacy secret-bearing fields removed from TransferDetails (feat/stage-1-pr3-m3d; one pre-flight commit + one pre-flight-review-amendment commit + four implementation commits cut off dev post-M3c). Activates the "secrets confined to engine" property for the orchestrator/engine boundary per docs/completed/STAGE_1_PR_3_MIGRATION_PLAN.md §3.4 (and §3.4.1's M3d landing-notes cross-reference), docs/completed/STAGE_1_PR_3_M3D_PREFLIGHT.md §3.3, and the audit migration table at docs/completed/STAGE_1_PR_3_MIGRATION_AUDIT.md §2.1 row 1 (now marked "Removed at M3d (landed 2026-05-11)").

  • Schema change: five Option<Zeroizing<[u8; N]>> fields deleted from shekyl_engine_state::TransferDetails: combined_shared_secret (64 bytes), ho, y, z, k_amount (32 bytes each). Corresponding entries in the TransferDetailsSchema mirror struct, the impl Zeroize for TransferDetails block, and the rust/shekyl-engine-state/.zeroize-allowlist schema-mirror entries were removed in the same commit.

  • Version bumps (paired per the in-source rule at rust/shekyl-engine-state/src/wallet_ledger.rs:67): LEDGER_BLOCK_VERSION: 3 → 4; WALLET_LEDGER_FORMAT_VERSION: 3 → 4. The wallet_ledger.rs docstring is the authoritative in-source statement of the pairing rule ("Each per-block bump implies a WALLET_LEDGER_FORMAT_VERSION bump") — the workspace-wide rule .cursor/rules/42-serialization-policy.mdc still carries pre-rename shekyl-wallet-state / shekyl-wallet-file path references (tracked as a focused FOLLOWUP for path-rename realignment). Per the workspace's 15-deletion-and-debt.mdc "no in-Shekyl migration code" rule, v4 stores refuse v3 loads rather than migrate; pre-genesis users rm -rf ~/.shekyl and re-sync.

  • Property activated: orchestrator-side TransferDetails no longer carries derived per-output secrets. The engine re-derives them inside its signing-session boundary from (view_secret, source_ciphertext) via LocalKeys::derive_source_secrets_bundle (per STAGE_1_PR_3_KEY_ENGINE.md §7.10–§7.12) and wipes them on drop. Orchestrator memory disclosure no longer exposes output-secret material; capability disclosure is unchanged (per Round 3 §7.10 / §7.11 framing).

  • Snapshot regeneration: the two .snap files that transitively serialize TransferDetails (schemas/ledger_block.snap, schemas/wallet_ledger.snap) drift; the three others (bookkeeping_block.snap, tx_meta_block.snap, sync_state_block.snap) are unchanged, confirming pre-flight invariant 8 (snapshot universe verification).

  • Production write-site removed: the five td.<field> = Some(Zeroizing::new(...)) write lines at shekyl-scanner/src/ledger_ext.rs::process_scanned_outputs deleted; the M3b deterministic-handle pathway (source_ciphertext, output_handle populated by engine::merge::populate_engine_handle_fields) is the only write path post-M3d.

  • Test/bench fixture rewrites: shekyl-engine-state (transfer.rs::tests, ledger_block.rs::tests, ledger_indexes.rs::tests, invariants.rs::tests, four benches/*.rs), shekyl-scanner::balance.rs::tests, and the engine-core bench fixtures (benches/common/engine_fixture.rs, benches/refresh_snapshot.rs) updated to the post-M3d shape. Where the prior fixtures populated the five legacy secrets, the replacement populates source_ciphertext (via direct HybridCiphertext construction) and output_handle (via shekyl_crypto_pq::handle::derive_output_handle) so Option-valued roundtrip / snapshot benches continue exercising non-default payloads representative of post-M3d transfers. The postcard_roundtrip_with_secrets test was renamed to postcard_roundtrip_with_handle_fields.

  • Documentation cleanup (carve-out per 91-documentation-after-plans.mdc): the past-tensing edits to STAGE_1_PR_3_KEY_ENGINE.md §3.5 ("residue of that direct port" paragraph), STAGE_1_PR_3_MIGRATION_AUDIT.md §2.1 row 1 (five legacy-field disposition column), and docs/benchmarks/shekyl_rust_v0.manifest.md (the two §3 paragraphs referencing the five legacy fields) landed in M3d's final docs commit alongside the plan §3.4 amendment. The broader M3e doc sweep remains scope-bounded to whole-doc realignment.

  • Commit decomposition (five commits, matching pre-flight's planned count but with a different load distribution): the per-commit-CI-green gate forced consolidation of pre-flight commits 1 + 3 plus the scanner's from_wallet_output cleanup into a single cross-crate schema-migration commit (commit 2); a fifth slot was reused for a small bench-fixture-fix commit (commit 4) feature-gating two shekyl_crypto_pq imports under bench-internals in the engine-core common bench fixture after cargo clippy --all-targets surfaced them as unused when included from the default-feature synced_height bench pair. See plan §3.4.1 for the forward-template framing (pre-flight wording may strengthen during implementation if the underlying property is preserved).

Added

• Stage 1 PR 3 — M3c: additive end-to-end engine-bundle signing test (feat/stage-1-pr3-m3c; one pre-flight commit + two implementation commits + one cross-reference commit cut off dev at ea1df2539). Lands the validation milestone per docs/completed/STAGE_1_PR_3_MIGRATION_PLAN.md §3.3 (with §3.3.1 cross-reference to the implementation disposition) and the pre-flight in docs/completed/STAGE_1_PR_3_M3C_PREFLIGHT.md §2.1 (Option C disposition; §2.1.1 Trim-1 amendment). Property delivery: complete for the bundle → SpendInput → SignedProofs cryptographic chain at the tx_builder::sign_transaction surface — the precondition M3d depends on for removing the legacy TransferDetails-secret-bearing-fields fallback.

  • New unit test: engine_derived_bundle_signs_through_tx_builder_end_to_end, inline in rust/shekyl-engine-core/src/engine/local_keys.rs's mod tests as a peer to M3b D5. Constructs a LocalKeys from TEST_SEED; for each of 9 fixtures (3 input counts {1, 2, 3} × 3 subaddress indices {PRIMARY, SubaddressIndex::new(1), SubaddressIndex::new(42)} — SubaddressIndex is a flat u32, not a (major, minor) pair) synthesizes n_in outputs paid to subaddress_keys(idx) for every idx (including PRIMARY — see the test docstring's relationship-to-M3b-D5 section for why bare primary spend keys cannot recover here); recovers each output via scan_output_recover to compose a hand-derived legacy bundle; derives the engine bundle via LocalKeys::derive_source_secrets_bundle; asserts engine and legacy SpendInputs are byte-identical field-by-field at the input layer (12 fields per input including per-leaf_chunk- entry equality); calls tx_builder::sign_transaction(...) once on the engine path; asserts BP+ deserializes via Bulletproof::read_plus and verifies via Bulletproof::verify against un-cofactored output commitment points; asserts FCMP++ verifies via shekyl_fcmp::proof::verify against engine-derived key images, the proof's pseudo-outputs, the synthetic h_pqc Selene scalars, the synthetic single-leaf-chunk tree root, and the same signable_tx_hash passed to the prover; asserts reference_block and tree_depth echo unchanged.
  • Inline cryptographic tree-fixture helpers. Replicates the recipe from shekyl-fcmp::proof::tests::prove_verify_roundtrip inline in local_keys.rs::tests (single-leaf chunk; depth = 1; tree_root = SELENE_HASH_INIT + multiexp_vartime over Selene generators × leaf scalars; h_pqc derived deterministically via dalek_ff_group::FieldElement::wide_reduce for reproducibility; recipient output_index offset by n_in + 100 to avoid the input/output commitment-mask collision that collapses FCMP++'s rerandomization scalar to zero in single-input/single-output sweeps with shared combined_ss). Helpers: build_synthetic_single_chunk_tree_root, make_synthetic_h_pqc_bytes, make_recipient_output_info, compute_test_key_image. New [dev-dependencies] on shekyl-tx-builder, shekyl-fcmp, shekyl-bulletproofs, shekyl-fcmp-plus-plus, shekyl-generators, shekyl-io, shekyl-primitives, multiexp, ec-divisors, ciphersuite, helioselene, dalek-ff-group, rand_core per 17-dependency-discipline.mdc.
  • Layered framing. The test docstring records three layers: Layer 1 — cryptographic chain bundle → SpendInput → tx_builder::sign_transaction → BP+ verify + FCMP++ verify (this test's scope); Layer 2 — KeyEngine::sign_transaction trait method (PR-5+ scope; today returns KeyEngineError::SignTransactionTraitSurfaceIncomplete because TxToSign's outputs and fcmp_plus_plus_context are PR-5-pinned forward-declared stubs); Layer 3 — orchestrator- engine message envelope / actor mailbox (PR-5+ scope; cryptographic chain in Layer 1 is invariant under that decision). The test docstring also records the relationship to M3b D5 as intentional layered coverage (M3b D5 pins bundle- byte identity without exercising recovery; M3c-via-C pins recovery-correctness which forces the recipient subaddress consistency M3b D5 doesn't enforce — the two pin complementary properties at adjacent layers).
  • Trim-1 disposition (post-implementation amendment). An earlier draft issued a parallel sign call with legacy-derived SpendInputs for commitments / enc_amounts byte-equality at the signer-output layer. Pre-flight review surfaced that SpendInput byte-equality at the input layer is strictly stronger (subsumes the original property by signer determinism, and additionally guards regressions in SpendInput fields irrelevant to commitments / enc_amounts but relevant to signature behavior or future field additions). Substituting the parallel sign call for input-layer byte- equality + sign-once on the engine path halves the test runtime (32s → 17.65s debug; 12s → 6.87s release). Pre-flight §2.1.1 records the discovery and names it as a forward template: implementation may strengthen pre-flight properties post-implementation; weakening requires explicit revisit. The named coverage gap (workspace sole-coverage of tx_builder::sign_transaction end-to-end success goes from 2× to 1×) is named-and-accepted given M3d removes the legacy bundle-derivation chain entirely; the engine path is the load-bearing path going forward and the redundant second exercise of the same signer would only have decaying value. Workspace-coverage note: pre-PR-3 this end-to-end success path had 0× coverage anywhere (shekyl-tx-builder/src/tests.rs only validation-error paths; transfer_e2e[_iai].rs benches explicitly elide full sign pending a checked-in tree-fixture; shekyl-fcmp::proof::tests::prove_verify_roundtrip exercises FCMP++ in isolation only; FFI / engine-rpc are production callers without in-file tests; BP+ fuzz target only fuzzes BP+ in isolation). Post-Trim-1 the test is the workspace's sole end-to-end successful-execution coverage of tx_builder::sign_transaction.
  • Migration plan + FOLLOWUPS updates. STAGE_1_PR_3_MIGRATION_PLAN.md §3.3.1 records the Option C disposition + Trim-1 amendment so a reader of the original §3.3 wording reaches the implementation-side disposition in one hop. docs/FOLLOWUPS.md's M3b-D5 re-location entry is refactored to cover both M3b D5 and M3c-via-C under the same KeyEngine-widens-to-pub trigger (one re-location PR bundles both tests; the visibility flip is the trigger for both, and bundling them keeps the migration-tail discipline cost bounded).

• Stage 1 PR 3 — M3b: scanner reroute + bridge source switch (feat/stage-1-pr3-m3b; ten substantive commits + one mechanical rustfmt fix + one docs commit cut off dev at 647f82d59 on 2026-05-09). Lands the KeyEngine-mediated source-secrets derivation path per docs/completed/STAGE_1_PR_3_MIGRATION_PLAN.md §3.2 and the pre-flight dispositions in docs/completed/STAGE_1_PR_3_M3B_PREFLIGHT.md §2 / §3 / §5. Property delivery: partial — every output the scanner ingests now carries a deterministic OutputHandle and the HybridCiphertext it was decapsulated from on its TransferDetails; the legacy secret-bearing TransferDetails fields remain populated transitionally to keep the bridge-impl fallback live until M3d removes them.

  • Two-layer derivation primitive split (D1). shekyl_crypto_pq::output::recover_combined_ss(view_x25519_sk, ml_kem_dk, kem_ct_x25519, kem_ct_ml_kem) -> Result<SharedSecret, CryptoError> (Layer 1, transform-shaped, in shekyl-crypto-pq) extracts the X25519 + ML-KEM-768 + HKDF-SHA-512 re-decap chain from scan_output_recover's prefix; LocalKeys::derive_source_secrets_bundle( source_ciphertext, output_index, subaddress_idx) -> Result<SourceSecretsBundle, KeyEngineError> (Layer 2, state-shaped, in shekyl-engine-core::engine::local_keys) composes Layer 1's output with the engine-owned b (spend secret) and m_i (subaddress derivation scalar). Placement per 18-type-placement.mdc: transform-shaped lives with its function; state-shaped lives with its owner.
  • TransferDetails schema extension (D3). Two Option<…> fields — source_ciphertext: Option<HybridCiphertext> (the on-chain hybrid X25519 + ML-KEM-768 ciphertext the scanner detected) and output_handle: Option<OutputHandle> (the deterministic 16-byte handle from cSHAKE256 keyed by the view secret). Zeroize impl skips the new non-secret fields per 35-secure-memory.mdc's redaction discipline. Both fields land behind an Option so the bridge-impl fallback is feature-detected (presence of source_ciphertext ↔ primary path; None ↔ legacy field path). LEDGER_BLOCK_VERSION and WALLET_LEDGER_FORMAT_VERSION bumped 2 → 3; both schema snapshots regenerated. The new fields' wire stability is locked by extending the postcard round-trip test; postcard-schema = "0.2" added as a direct dep on shekyl-crypto-pq per 17-dependency-discipline.mdc (matches the existing shekyl-engine-state direct-dep pin).
  • TxInputSigningContext field swap (D2). Drops source_secrets: SourceSecretsBundle (the by-value secret carrier that contradicted the engine-confined-secrets property) in favor of source_ciphertext: HybridCiphertext + output_index: u64. The trait-surface input is now the public on-chain ciphertext; the engine derives the secrets internally via LocalKeys::derive_source_secrets_bundle. Debug impl simplified; redaction tests updated.
  • Engine post-pass at the orchestrator layer (Q2 δ disposition). Engine::apply_scan_result becomes a three-step body inside one LocalLedger write guard: collect_detection_residue (pre-collects a HashMap<(tx_hash, internal_output_index), HybridCiphertext> from the ScanResult's new transfers) → apply_scan_result_to_state (the existing sync bookkeeping merge, unchanged) → populate_engine_handle_fields (walks the freshly-merged TransferDetails and binds each to its source_ciphertext + deterministic output_handle from the residue map). Atomic against external readers — concurrent reads either see pre-merge or post-population, never an intermediate state. Idempotent. The sync helper is async-ready by design: M3b derives the handle directly via shekyl_crypto_pq::handle::derive_output_handle (a synchronous pure function that requires only (view_secret, tx_hash, output_index)); M3c+ wires LocalKeys onto Engine and re-routes the helper through KeyEngine::try_claim_output, at which point the helper signature becomes async fn and Engine::apply_scan_result takes the corresponding .await. The two-step trajectory is intentional and pinned in the helper's doc-comment; M3b's architectural property (every output gets a deterministic handle) does not require the audit's "engine sole authority on handles" framing to activate, which lands at M3d.
  • Scanner residue plumbing. RecoveredWalletOutput extended with four public on-chain residue fields (source_ciphertext: HybridCiphertext, view_tag: u8, enc_amount: [u8; 8], amount_tag: u8, all #[zeroize(skip)] per the type's redaction discipline) so the engine post-pass has the structured input it needs. The pre-flight estimated this commit as "~0–10 lines, may be no-op," but inspection revealed RecoveredWalletOutput was discarding the on-chain residue at construction time. Reordered to land before the engine post-pass commit so each commit leaves the workspace cargo check-green; the layering is honest about producer (scanner) and consumer (engine).
  • Named failure mode (D6). KeyEngineError::SourceCiphertextDecapsulationFailed(#[from] CryptoError) for re-decap rejection. The variant carries the inner CryptoError so audit logs distinguish whether the rejection was at the X25519 layer (LowOrderPoint), the ML-KEM-768 layer (DecapsulationFailed), or the input-shape layer (InvalidKeyMaterial); all three indicate the same operational class (corrupted or tampered persisted state) but name which step rejected the input. The expected operational case for this variant is none — re-decap runs only on outputs the wallet itself scanned and persisted; a failure implies storage corruption or malicious local actor.
  • Byte-identical-derivation property test (D5). Two unit tests in local_keys.rs::tests: (a) derive_source_secrets_bundle_byte_identical_against_legacy_chain asserts field-by-field byte-equality between the new Layer 2 chain (derive_source_secrets_bundle) and a hand-rolled bundle from scan_output_recover's RecoveredOutput across 24 derivations (8 distinct (output_index, tx_hash) pairs × 3 subaddress indices — PRIMARY, idx=1, idx=42); (b) derive_source_secrets_bundle_diverges_across_distinct_seeds exercises cross-seed isolation. The second test's docstring pins a subtle property: ML-KEM-768 implements implicit rejection per FIPS 203, so a wrong-wallet decap succeeds with a junk bundle (the IND-CCA2 oracle defense); the isolation property is "junk bundle differs byte-for-byte," not "function refuses." Located alongside C6's smoke tests in local_keys.rs::tests rather than the pre-flight's planned tests/byte_identical_derivation.rs integration test, due to the M3a Round 4a pub(crate) lock on LocalKeys, SourceSecretsBundle, and KeyEngineError; tracked for re-location in docs/FOLLOWUPS.md § V3.2 if the visibility lock relaxes at the wallet-RPC cutover.

  Property-delivery framing: structural — no consensus rule, no wire format on-chain, no FFI layout changes. The TransferDetails schema bumps WALLET_LEDGER_FORMAT_VERSION from 2 to 3, which is a wallet-state schema change handled by the pre-V3-launch rm -rf ~/.shekyl migration path per 15-deletion-and-debt.mdc (no in-Shekyl format-detection code; pre-genesis users have no real state to preserve). M3c–M3e land the additive test caller (M3c), the legacy-fallback removal (M3d), and the audit closure (M3e).

• Stage 1 PR 3 — Phase 0: AllKeysBlob zeroize-discipline realignment (chore/allkeysblob-zeroize-realignment; closes docs/completed/STAGE_1_PR_3_KEY_ENGINE.md §3.5 (Phase 0e) and §7.5). Three rule-grounded edits that landed together as a focused chore PR before the M3b implementation, each closing an audit finding cited to a rule with a concrete failure mode prevented:

  • F1 / 35-secure-memory.mdc:21–22. AllKeysBlob.ml_kem_dk (the ML-KEM-768 decap secret key, 2400 bytes) was the lone unwrapped secret-bearing array on the struct; wrapped in a new MlKem768DecapKey typed newtype in rust/shekyl-crypto-pq/src/keys.rs that mirrors the established ViewSecret / SpendSecret shape (#[repr(transparent)], Clone + Zeroize + ZeroizeOnDrop, no Copy, no Debug, pub(crate) constructor, public as_canonical_bytes() accessor). Sweeps eight in-Rust read sites (account.rs's field/zeroed/rederive/test, local_keys.rs:344, refresh.rs:1283, account_ffi.rs:531); the FFI mirror keeps raw [u8; ML_KEM_768_DK_LEN] and the bit-for-bit layout invariant (size, alignment, per-field offsets) is preserved by #[repr(transparent)] and asserted directly by account_ffi::tests::struct_layout_matches. The producer [crate::account::ml_kem_keypair_from_d_z] returns the typed MlKem768DecapKey directly (constructed via from_zeroizing consuming a Zeroizing<[u8; N]> source) — the secret travels through the type system from producer to consumer without any call site materialising an untracked stack Copy of the 2400-byte buffer between them.
  • F2 / 35-secure-memory.mdc:23–25. AllKeysBlob migrated from a hand-written Drop impl (which the design doc itself characterized as "documenting the lie" — the spec asserted AllKeysBlob: ZeroizeOnDrop while the trait was not implemented) to #[derive(Zeroize, ZeroizeOnDrop)]. With every field now Zeroize-bearing (typed wrappers + zeroize-crate blanket impls on [u8; N]), the structural condition for the derive holds and the manual impl is replaced wholesale. The derived Drop::drop calls self.zeroize() once on every field; field-drop-glue then re-invokes each ZeroizeOnDrop field's destructor independently — an idempotent double-wipe documented in the struct rust-doc so future ZeroizeOnDrop-grep audits do not mistake the pattern for a discipline violation.
  • F3 / KEY_ENGINE.md §7.5. AllKeysBlob: Clone derive deleted. Workspace audit (rg 'AllKeysBlob.*\.clone\(\)' + per-call-site read; cargo build --workspace --all-targets is the locking gate that compiles every #[cfg(test)] block) surfaced zero callers in production or test code; per 30-cryptography.mdc and 35-secure-memory.mdc:26-28, Clone on a secret-bearing struct requires explicit justification, and none surfaced. The traits/key.rs:581 doc-comment ("Not Clone — implementors wrap AllKeysBlob") becomes literally enforced.

  ml_kem_ek deliberately stays raw [u8; ML_KEM_768_EK_LEN]. Public encap key, broadcast in the address; outside 35-secure-memory.mdc:21–22's reach as public material. Wrapping it would be uniformity-driven completionism without rule grounding (per 15-deletion-and-debt.mdc's "while we're here is the enemy") and would create a permanent type-system signal collision (Zeroize semantics on a public type as a distractor for any future grep-for-secrets audit). Five-reason disposition recorded inline at docs/completed/STAGE_1_PR_3_KEY_ENGINE.md §3.5's "Closed (post-M3a, post-Phase-0)" subsection against re-litigation.

  Closure-path narrative. The originally-specified §3.5 sequencing was "Phase 0e lands first, before PR 3 cuts." The actual landing was post-M3a, via this chore. The deviation is substrate-change, not extension: §3.5 was specced when AllKeysBlob carried raw [u8; N] fields (where derive(ZeroizeOnDrop) would have been a literal one-line addition). The intervening chore/allkeysblob-typed-wrappers-monero-sweep (which closed the inheritance audit's spend_sk / view_sk secret-flow finding) left ml_kem_dk as the residual raw secret-bearing array, which prevented the parent derive from taking. This chore re-anchors §3.5's load-bearing goal (Q9.3 precondition true; AllKeysBlob: ZeroizeOnDrop literally implemented) to the post-sweep substrate; the work-shape adapted to the post-sweep state rather than extended from the original 5–10-line plan.

  Property-delivery framing: structural — no consensus rule, no wire format, no FFI layout changes. The deliverable is rule alignment between code and spec on the AllKeysBlob zeroize discipline, restoring the precondition that Q9.3 / Phase 0d's cross-reference language now resolves cleanly against. M3b cuts off the post-merge dev tip with the precondition true.

• Single-source-of-truth JSON authority for the consensus-affecting constant subset: config/consensus_constants.json. Mirrors the existing config/economics_params.json pattern. The JSON is the authority; cmake/generate_consensus_constants.py emits shekyl/consensus_constants_generated.h for the C++ build, and rust/shekyl-engine-core/build.rs reads the same file and emits a consensus_constants_generated.rs module that rust/shekyl-engine-core/src/multisig/v31/intent.rs consumes via include!(). Closes the C++/Rust drift class for the constants where drift causes silent wrong-output (vs. fail-closed-on-load).

  Constants in scope (per docs/audit_trail/2026-05-ffi-constant-drift-audit.md):

  • FCMP_REFERENCE_BLOCK_MIN_AGE = 5 — reorg-safety margin locked by Decision 14. Pre-fix, hand-defined as 5 in src/cryptonote_config.h and as 10 in rust/shekyl-engine-core/src/multisig/v31/intent.rs. The drift was Bug 3 of the audit and silently rejected legitimate multisig intents at the wallet layer.
  • FCMP_REFERENCE_BLOCK_MAX_AGE = 100 — same shape, no observed drift but in the same value class and migrated together.
  • RCT_TYPE_FCMP_PLUS_PLUS_PQC = 7 — single-source on each side today (enum RCTType in C++; ProofType::FcmpPlusPlusPqc => 7 in shekyl-oxide); both sides now stamped against the JSON via static_assert (C++ in src/fcmp/rctTypes.cpp) and a runtime test (Rust, in intent.rs::tests::shekyl_oxide_proof_type_matches_consensus_authority).

  Sentinel discipline: every consumption site that previously hand-defined a value now carries either a static_assert (C++) or a const _: () = assert!(...) (Rust) sentinel pinning the value to a Decision-14-era baseline. Bumping the sentinel requires updating both the JSON and the consumption-site comment, so a silent value drift through the JSON alone fails the build with a clear message.

  Fixture update: intent.rs::tests::validate_temporal_rejects_ref_block_too_fresh changed from tip = 905 (age = 5, the boundary value age < 5 evaluates false under the post-fix MIN_AGE = 5) to tip = 903 (age = 3, unambiguously rejected). The test exercises the rejection branch (age < MIN_AGE) and stays correct as long as MIN_AGE > 3 — i.e. it survives any tightening (MIN_AGE increasing above 5) and any loosening down to and including MIN_AGE = 4. Only a loosening to MIN_AGE = 3 or lower would invalidate the fixture, which itself would warrant the consensus re-review the sentinel demands.

  Out of scope: ADDRESS_VERSION_V1 is single-source in Rust with no C++ duplicate, so there's nothing to align. The full-migration follow-up for the remaining SHEKYL_* fail-closed- on-misuse constants (~40) stays as FOLLOWUPS V3.0.

Documentation

• Stage 1 PR 5 — address PR #43 Copilot review findings, Round 2 (post-Round-2-close follow-up cycle). Doc-only commit on feat/stage-1-pr5-pending-tx-engine-design. Addresses nine additional Copilot review findings surfaced against the Round-2-close-out commit (b85edec9a), the first Copilot-fix commit (871efa40c), and the Round-1 CHANGELOG entries. The fixes consolidate hash-primitive dependency-discipline correctness, cryptographic-security- rationale framing, sink-binding shape alignment across segments, variant-name alignment in V3.x FOLLOWUPS entries, and architectural soundness of the V3.x TimeoutResolverActor correlation contract.

  • Findings A + E + H — SnapshotId hash primitive correction (covers three Copilot comments on §4 Phase 0b, §5.4 R2 sketch, CHANGELOG segment-2g entry, §5.5 Round 2 summary, and the doc header). Segment-2g's prior binding pinned SnapshotId to SHA-256 via sha2 = "0.10", citing rust/shekyl-engine-core/Cargo.toml line 115 as the workspace-state-reuse anchor. That citation was a dependency-discipline error: Cargo.toml line 115 is in [dev-dependencies] (test-only), and the production sha2 at line 33 is optional = true (gated behind a feature flag). The Copilot-fix follow-up switches the primitive to shekyl-crypto-hash::cn_fast_hash (Keccak-256, original padding) — shekyl-crypto-hash is an unconditional [dependencies] entry per Cargo.toml line 28, the consensus-audited Keccak primitive Shekyl already uses throughout its codebase. Strictly better disposition against the 17-dependency-discipline.mdc workspace-state reuse rule against the actual production-dependency graph. The §5.4 R2 sketch also still showed a prior blake3::hash form from segment-2d's open-shape-not-primitive disposition; the sketch is updated to the binding cn_fast_hash form.

    The security rationale is also reframed. Segment-2g's prior framing was "128-bit collision resistance gives ~2⁶⁴ classical work and ~2³² quantum work via Grover- doubled width." Two errors: (i) Grover's algorithm gives 2^(n/2) work against preimage attacks, not collision attacks — quantum collision is governed by BHT (Brassard–Høyer–Tapp), ~2^(n/3) ≈ 2⁴³ for 128-bit outputs; (ii) the use-case framing is incorrect — SnapshotId is a wallet-internal equality token over a bounded snapshot population, not a collision- resistance primitive against arbitrary inputs.

    Corrected framing: second-preimage resistance over bounded snapshot population. The wallet observes ≪ 2⁴⁰ snapshots over its operational lifetime (≤ ~10⁷ snapshots over 100 years; one snapshot per refresh merge). Classical second-preimage on 128-bit truncated hash is ~2¹²⁸ work; quantum Grover second- preimage is ~2⁶⁴ work — large but bounded under aggressive quantum-adversary assumptions. The impact bound under successful attack is also constrained: a daemon-forged colliding LedgerSnapshot merely makes the wallet submit a tx valid against the prior snapshot; the daemon could have rejected the tx anyway via DoubleSpend if the prior snapshot's outputs are now spent on-chain. No consensus violation; no wallet- state corruption that refresh cannot reconcile. The versioned domain-separation prefix (b"shekyl-snapshot-id-v1") permits V3.x migration to a wider output or different hash family without cross- stage rebuild.

    Sites updated: docs/design/STAGE_1_PR_5_PENDING_TX_ENGINE.md §4 Phase 0b binding, §5.4 R2 sketch + prose, §5.5 Round 2 summary, §6 review-checklist SnapshotId item, and the header status block; this CHANGELOG segment-2g entry with a Copilot-fix forward-pointer.

  • Finding B — §5.4 R2 cross-reference to rejected option (b). §5.4 R2 prose referenced DIAGNOSTIC_STREAM_CONTRACTS.md (the parent-doc factoring option (b) considered in §5.0.3), but segment 2g's diagnostic-stream-doc generalization closed as option (a) — rename REFRESH_DIAGNOSTIC_STREAM.md → DIAGNOSTIC_STREAM.md. The cross-reference is updated to the chosen doc name with the closure rationale.

  • Finding F — &dyn DiagnosticSink vs Arc<dyn DiagnosticSink> inconsistency. §5.0.2.1 (the segment-2f sink-binding-closure section) used the earlier &dyn DiagnosticSink form when the closure section itself pins Arc<dyn DiagnosticSink>; this is corrected for self-consistency. The Round-1-close CHANGELOG entry's &dyn DiagnosticSink description receives a forward-pointer noting that segment 2f tightened the form to Arc<dyn> for reference-shape ergonomics during R11 closure (the earlier wording remains historically accurate at Round 1 close).

  • Findings C + D — V3.x FOLLOWUPS SubmitFailureAnalyzer variant-name alignment. The SubmitFailureAnalyzer FOLLOWUPS entry referenced SnapshotInvalidated in two places and SubmitFailed { kind: Timeout } in one place; the binding variant names per segment 2f / Phase 0a / Phase 0f are SubmitSnapshotInvalidated and SubmitFailed { kind: DaemonTimeout | DaemonUnavailable } respectively. All three sites updated; the timeout bullet is also expanded to cover both ambiguous-failure variants per segment-2f's daemon-side authority disposition (both carry the same operational signal for pattern-detection purposes).

  • Finding G — TimeoutResolverActor chain-observation correlation contract architectural mismatch. The TimeoutResolverActor FOLLOWUPS entry described subscribing to LedgerDiagnostic::SnapshotMerged to observe whether the timed-out tx_hash landed on chain — but SnapshotMerged is pinned by Phase 0g as { new: SnapshotId, prior: SnapshotId, height: BlockHeight } and carries no tx_hash field, so the actor cannot implement the correlation from the stated event stream. The §5.4 R9 disposition prose carried the same mismatch. Disposition: soften both prose surfaces to defer the chain-observation mechanism to the V3.x consumer-actor PR's own design — the actor needs either (i) an additive LedgerDiagnostic variant carrying tx-confirmation payloads, or (ii) an additive LedgerEngine chain-query accessor, or (iii) both (event-driven for low-latency notification, polling for restart-amnesia catch-up). Pinning the mechanism in PR 5 would overspecify a V3.x consumer-actor that doesn't ship in V3.0; the LedgerEngine and LedgerDiagnostic surfaces have their own additive- extension discipline that the consumer-actor PR composes against. Wallet-correctness is preserved by R8's ReservationTTLActor safety net regardless of when TimeoutResolverActor lands.

  • Finding I — PR #43 title + description scope correction. The PR title and body still framed PR #43 as a Round-1-only doc-only PR with three commits, but the branch now contains all seven Round 2 segments (segments 2a–2g) plus two Copilot-review follow-up commits. PR metadata updated to reflect the actual Round 1 + Round 2 closed scope, with the seven-segment summary and Phase 0 binding enumeration mirroring the design doc's §5.5 closure. The earlier "Round 1 only, Round 2 out of scope" wording is replaced.

  Markdownlint baseline parity confirmed after edits (no new violations introduced). Round 2 remains closed; Round 3 (commit decomposition + Phase 1 commit list) is the next forward step pending user authorization.

• Stage 1 PR 5 — address PR #43 Copilot review findings (Round 2 close-out follow-up). Doc-only commit on feat/stage-1-pr5-pending-tx-engine-design. Addresses three Copilot review findings surfaced against the Round 2 segments and segment 2g close-out:

  • Finding 1 — §3.3 pre-flight checklist staleness (raised against b85edec9a, line 609 of design doc; re-raised on the same line). The pre-flight checklist at §3.3 still marked R1 disposition / Phase 0 spec amendments / PR 4 Round 3 input bundle as pending, even though Round 1 closed those items (R1 in §5.5; Phase 0 in segment 2g §4; PR 4 Round 3 bundle as confirmation per §5.2 + §6). Fix: marked R1 / Phase 0 / PR 4 Round 3 items as [x] with cross-references to the closure sections; Phase 1 commit decomposition remains [ ] pending Round 3.
  • Finding 2 — R8 ReservationTTLActor subscription contract incomplete (raised against 2f177a0c3, line 987 of design doc). Segment 2e's R8 closure named only PendingTxDiagnostic::BuildSucceeded as the actor's subscription, with no terminal events. This would leak closed reservations into the actor's in-memory age-tracking map indefinitely, producing stale ReservationOutstanding warnings on already-terminated reservations and spurious AutoDiscardMessage round-trips to PendingTxActor. Fix: §5.4 R8 prose expanded with a full subscription contract section pinning BuildSucceeded (insert), SubmitSucceeded (remove — terminal success), and Discarded (remove regardless of reason — covers all four DiscardReason variants including the segment-2f DaemonRejectedTerminal and the segment-2e TTLAutoDiscard self-cleanup). Explicit "what SubmitFailed does not close" note per segment-2f R9's two-stage submit-flow + Finding-2 daemon-side authority disposition: SubmitFailed on DaemonTimeout / DaemonUnavailable keeps the reservation in SubmitPendingDaemonAck and the actor keeps tracking. Memory-bound property pinned: actor's map size is bounded by PendingTxActor::outstanding(), not by cumulative reservation count.
  • Finding 3 — FOLLOWUPS ReservationTTLActor entry has the same subscription gap (raised against 2f177a0c3, FOLLOWUPS line 3029). Identical finding to Finding 2, in the FOLLOWUPS entry rather than the design doc. Fix: same subscription-contract expansion applied to the FOLLOWUPS entry; cross-reference to the design-doc §5.4 R8 closure preserved.
  • Finding 4 — CHANGELOG Round 1 close entry residuals count predates R12 (raised against b85edec9a, CHANGELOG line 1449). The Round 1 close entry says "four carry to Round 2; one new (R11)"; R12 was added in a subsequent Round 1 follow-up commit (the immediately-following CHANGELOG entry). Fix: added a parenthetical forward-pointer to the Round 1 close entry noting R12's addition in the follow-up; preserves the entry's historical accuracy at commit time while resolving the in-isolation reader's apparent inconsistency. The follow-up entry's existing R12 documentation is unchanged.

  No segment-2g substrate is revised; all four fixes are contract-clarification / status-update edits. Round 3 readiness gate per segment 2g §8 fenceposts is unaffected. Updates docs/design/STAGE_1_PR_5_PENDING_TX_ENGINE.md (§3.3 checklist; §5.4 R8 subscription-contract subsection); docs/FOLLOWUPS.md (ReservationTTLActor entry subscription- contract subsection); docs/CHANGELOG.md (this entry + forward-pointer note on the Round 1 close entry). No code changes; no test impact.

• Stage 1 PR 5 — Round 2 segment 2g (Round 2 close-out: §4 Phase 0 binding-form enumeration; SnapshotId hash primitive pin; §5.0.3 diagnostic-stream-doc generalization closure; §6 review checklist filled). Doc-only commit on feat/stage-1-pr5-pending-tx-engine-design. Segment 2g closes Round 2 — the final segment that pins all Phase 0 binding-form type-signature detail, fills the review checklist, and finalizes the diagnostic-stream-doc generalization disposition. Round 3 (commit decomposition + Phase 1 commit list) is the next forward step. §4 Phase 0 binding-form enumeration finalized: Phase 0a (SubmitError and SubmitErrorKind enums per segment 2f); Phase 0b (SnapshotId opaque type with binding hash primitive — see below); Phase 0c (REMOVED at the trait surface per segment 2d's R12 (a) closure); Phase 0d (Reservation struct shape with extensions: Vec<ReservationExtension> per segment 2b R14); Phase 0e (reservation-lifecycle prose with R5 / R9 segment-2f / R10 closure cross-references); Phase 0f (PendingTxDiagnostic enum + constructor-bound DiagnosticSink per segment-2f §5.0.2.1); Phase 0g (LedgerDiagnostic::SnapshotMerged deferred to consumer-PR per segment-2g introduction-PR disposition — avoids speculative-introduction-without-consumer violation of the 15-deletion-and-debt.mdc no-live-caller rule); four new Phase 0 candidates from segment-2b / segment-2c residual closures: Phase 0h (Signer trait surface per R11 (b) segment-2b closure); Phase 0i (OutputSelector trait surface per R13 segment-2c closure); Phase 0j (FeeEstimator trait surface + FeePriority enum per R16 segment-2c closure with segment-2d V3.0-lift evaluation); Phase 0k (SubmissionStrategyActor topology slot per R15 segment-2c closure — V3.x introduction; no V3.0 trait amendment). SnapshotId hash primitive pinned as Keccak-256 via shekyl-crypto-hash::cn_fast_hash (original padding, consensus-audited) truncated to the first 128 bits with versioned domain-separation prefix (b"shekyl-snapshot-id-v1"). (Forward-pointer: the Copilot-fix follow-up entry below revised this binding from segment-2g's prior sha2-based form to the Keccak-based form. The prior sha2 citation referenced rust/shekyl-engine-core/Cargo.toml line 115, which is in [dev-dependencies] and therefore unavailable to production code; the production sha2 at line 33 is optional = true. shekyl-crypto-hash is the consensus-audited Keccak primitive already unconditional in shekyl-engine-core production deps at line 28 — the strictly better dependency-discipline disposition.) Selection rationale (revised form): shekyl-crypto-hash is an unconditional [dependencies] entry per 17-dependency-discipline.mdc workspace-state reuse rule against the actual production-dependency graph; security framing reset from collision-resistance / Grover-doubled-width (technically incorrect — Grover applies to preimage, not collision; quantum collision is governed by BHT, ~2⁴³ for 128 bits) to second-preimage resistance over bounded snapshot population (wallet observes ≪ 2⁴⁰ snapshots over its operational lifetime; classical second-preimage ~2¹²⁸ work; quantum Grover second-preimage ~2⁶⁴ work; impact bound by adversary-controlled-daemon design-center per §5.3); versioned prefix permits V3.x migration to a wider output or different hash family without cross-stage rebuild because SnapshotId is a wallet-internal token that does not cross the wire. §5.0.3 diagnostic-stream-doc generalization closure: option (a) — rename REFRESH_DIAGNOSTIC_STREAM.md → DIAGNOSTIC_STREAM.md (general). Existing FOLLOWUPS entry amended with rename rationale (shared contracts modest in volume relative to per-stream taxonomies; single doc with shared-then-per- stream structure lower cross-reference cost than parent-and-children factoring) and doc-structure prescription for V3.x introduction PR (shared contracts at top; per-stream sections for RefreshDiagnostic / PendingTxDiagnostic + DiscardReason / LedgerDiagnostic pending the consumer-actor PR). Option (b) — parent DIAGNOSTIC_STREAM_CONTRACTS.md factoring — preserved as retroactively-applicable if growth justifies. §6 review checklist filled: binding-check matrix against the §2.4 spec (trait surface methods unchanged; engine-type parameter additions S: Signer, O: OutputSelector, F: FeeEstimator); test-substrate preservation list (AssertionSink / PanickingSink property-test infrastructure inherited from PR 4 pattern; per-error-class R9 coverage; Finding-2 daemon-side authority coverage); call-site sweep audit enumeration (Phase 1 confirms every diagnostic-event emission site); PR 4 Round 3 input bundle resolved as confirmation per §5.2. Round 3 readiness gate: all §4 Phase 0 candidates binding-pinned; §6 filled; FOLLOWUPS amended for the segment-2g rename; Round 3 ready to proceed. Updates §4 Phase 0 enumeration (full rewrite with binding-form signatures for all candidates 0a–0k); §5.0.3 generalization-question section (closes as (a) rename); §5.5 "What Round 2 carried" inventory (seven-segment summary; Round 2 final form); §6 review checklist (filled with all sub-checklists); §8 fenceposts (segment 2g moves to "Round 2 — completed"; Round 3 named as next forward step); header status (Round 2 closed); CHANGELOG; FOLLOWUPS. No code changes; no test impact.

• Stage 1 PR 5 — Round 2 segment 2f (R9 two-stage submit-flow closure with daemon-side authority for Finding 2 ambiguous outcomes; SubmitError + SubmitErrorKind enum pins; sink-binding constructor-bound closure for Finding 4). Doc-only commit on feat/stage-1-pr5-pending-tx-engine-design. Segment 2f closes the last residual on the load-bearing submit path and the constructor-vs-per-method sink-binding question, leaving only Round 2 close-out work for segment 2g. R9 closure pins the two-stage submit flow with explicit internal ReservationState machine (Active | SubmitPendingDaemonAck | Resolved); trait surface unchanged (outstanding() counts Active + SubmitPendingDaemonAck). Self-continuation message pattern pinned: PendingTxActor defers reply until SubmitCompleted self-message arrives, preserving mailbox throughput. Per-error-class disposition table pins state-transition + diagnostic-event-sequence + trait-return tuples for Accepted / AlreadyInMempool / DoubleSpend / FeeTooLow / Malformed / Timeout / NetworkError. Finding 2 closes as (B) — daemon-side authority: on Timeout or DaemonUnavailable, reservation stays in SubmitPendingDaemonAck; consumer-explicit discard(id, ConsumerExplicit) is the resolution path; R8's ReservationTTLActor (per-state TTL with shorter TTL on SubmitPendingDaemonAck) is the safety net for forgotten resolutions. (A) actor-state authority rejected because the phantom-spent-output window violates the monotonicity property the tracker delivers per §3.4.5 (the same "consumer checking does work the trait should be doing structurally" anti-pattern PR 4 named). SubmitError + SubmitErrorKind enums pinned in §5.0.2 (both #[non_exhaustive]): SubmitError = SnapshotInvalidated{..} | DaemonRejected{kind: SubmitErrorKind}; SubmitErrorKind = DoubleSpend | FeeTooLow | Malformed | DaemonTimeout | DaemonUnavailable. R5 ↔ R8 ↔ R9 coherence verified — reactive cleanup (SnapshotRotationAutoDiscard), proactive cleanup (TTLAutoDiscard), and daemon-authority cleanup (DaemonRejectedTerminal) share the DiscardReason/Discarded event infrastructure. No new PendingTxDiagnostic variants needed (existing variant set sufficient for R9 state machine); no new trait surface methods needed (discard(id, ConsumerExplicit) is sufficient for consumer-explicit resolution of Finding-2 ambiguity; resolve_pending(id, chain_observation) preserved as a V3.x ergonomic-API candidate). Sink-binding closure (Finding 4): new §5.0.2.1 pins LocalPendingTx::new(..., sink: Arc<dyn DiagnosticSink>, ...) as constructor-bound under PR 4 §3.4.5 / R4 (a) consistency. R11's segment-2b closure as (b) made the sink-binding question independent of spend-material disposition; the two close separately. Rationale: engine-identity coupling (1-to-1 mapping load- bearing at the type level); Stage 4 actor wiring alignment (spawn-time DI); call-site cleanliness; runtime-swap surface preserved via sink-side indirection; no load-bearing reason for per-method override in production engines. Existing SubmitFailureAnalyzer FOLLOWUPS entry amended with segment-2f closure status; new TimeoutResolverActor FOLLOWUPS entry added naming the V3.x ergonomic-complement surface for Finding 2's daemon-side authority disposition. Updates §5.0.2 (SubmitError + SubmitErrorKind enum sketches); new §5.0.2.1 (sink-binding closure rationale); §5.4 R9 (closure prose with state-transition table); §5.5 "What Round 2 carries" inventory; §8 fenceposts (segment 2f moves to "Round 2 — completed"); header status; CHANGELOG; FOLLOWUPS. No code changes; no test impact.

• Stage 1 PR 5 — Round 2 segment 2e (R8 ReservationTTLActor composition closure; DiscardReason::TTLAutoDiscard variant pin). Doc-only commit on feat/stage-1-pr5-pending-tx-engine-design. Segment 2e closes R8 (reservation TTL / leak prevention) by pinning all V3.0 deliverables explicitly so V3.x's ReservationTTLActor introduction is additive-only — no V3.x trait revision, no V3.x enum revision, no V3.x consumer-side breaking change per the 16-architectural-inheritance.mdc continuous-discipline corollary. The Round 1 reframe already named ReservationTTLActor as the consumer-actor composition shape (same pattern as PR 4's PeerReputationActor / RecoveryActor); segment 2e pins the V3.0 deliverables: (1) PendingTxDiagnostic::BuildSucceeded emitted at the build-success path in LocalPendingTx::build / PendingTxActor::handle_build (Phase 1 call-site review confirms); (2) PendingTxDiagnostic::Discarded { reason: SnapshotRotationAutoDiscard } emitted at submit's snapshot-mismatch path (R5's lazy-discard semantics); (3) PendingTxDiagnostic::ReservationOutstanding variant exists in the #[non_exhaustive] enum (no V3.0 emitter; V3.x ReservationTTLActor is the first emitter); (4) new in segment 2e: DiscardReason::TTLAutoDiscard variant added to the #[non_exhaustive] DiscardReason set so V3.x's ReservationTTLActor can trigger PendingTxActor to emit Discarded { reason: TTLAutoDiscard } events without a V3.x enum revision. R5 ↔ R8 coherence verified — R5's SnapshotRotationAutoDiscard is the reactive cleanup path (cleanup-on-use); R8's TTLAutoDiscard is the proactive complement (age-based policy on never-used reservations); both share the DiscardReason/Discarded event infrastructure. Hard mitigation pins inherited verbatim from PR 4 §5.4.8 (restart-amnesia per #1; recursive trust boundary per #4; bounded mailbox per #5) bind on the V3.x consumer-actor PR via §5.0.3 — no PR 5 amendments needed. Existing ReservationTTLActor FOLLOWUPS entry amended with segment-2e closure-status confirmation and the new DiscardReason::TTLAutoDiscard variant pin; no new FOLLOWUPS entry needed. The R1 disposition still holds; segment 2e is residual-closure work that finalizes R8's disposition for design purposes. Updates §5.0.2 DiscardReason enum sketch (adds TTLAutoDiscard variant); §5.4 R8 (closure prose); §5.5 "What Round 2 carries" inventory; §8 fenceposts; header status; CHANGELOG; FOLLOWUPS. No code changes; no test impact.

• Stage 1 PR 5 — Round 2 segment 2d (R2 + R12 co-disposition; Phase 0c truly collapses; SnapshotId opacity closed as 16-byte content-addressed digest). Doc-only commit on feat/stage-1-pr5-pending-tx-engine-design. Segment 2d closes the two remaining SnapshotId-adjacent residuals against the actual shape of the LedgerSnapshot substrate landed in PR 2. R12 closes as (a) — content-derived SnapshotId from existing LedgerSnapshot data; substrate inspection confirmed LedgerSnapshot carries synced_height: u64 + reorg_blocks: ReorgBlocks (deterministic by construction; sufficient for content- addressed derivation). Stage 1's LocalPendingTx derives SnapshotId from LedgerEngine::snapshot() (existing trait method); Stage 4's PendingTxActor receives identical values via LedgerDiagnostic::SnapshotMerged events using the same digest function. No LedgerEngine trait amendment; Phase 0c truly collapses. R2 closes as opaque 16-byte content-addressed digest (pub struct SnapshotId([u8; 16])); domain-separated hash over LedgerSnapshot's deterministic fields; specific hash primitive pinned at Phase 0 review (segment 2g) per §3.1 PQC-discipline alignment. Determinism required by §5.0's submit-handler field-comparison contract; height-leak side-channel closed by construction. §5.5 ground-1 prose softening — drop "(pending R12)" qualifier; ground 1 is now closure-confirmed alongside grounds 2 and 3. §4 Phase 0c prose softening — drop "(pending R12)" qualifier; Phase 0c is REMOVED at the trait surface, full stop. Projection-type discipline preserved-as-pattern — no V3.0 PR 5 call-site introduces a cross-trust-boundary SnapshotId or SnapshotMerged consumer; the projection-type implementation lands in the V3.x consumer-actor PR per PR 4 §5.4.8 #4's recursive- trust-boundary discipline. R16 conditional V3.0 lift evaluation (segment-2c trigger): LedgerBlock carries no per-block fee data today; lifting R16 (c) to V3.0 would require either a storage-layout amendment (persistence- layer migration) or an unbounded historical-block walk per estimator call — neither is bounded cost; R16 (c) does not lift to V3.0, the conservative segment-2c default holds, and R16 (c) lands in V3.x behind a coordinated LedgerEngine + FeeEstimator PR. The R1 disposition still holds; segment 2d is segment-2c follow-through (closure-rule operational discipline applied to the conditional-V3.0-lift surface) plus the SnapshotId-substrate co-disposition the §8 fenceposts sequenced for this slot. Updates §5.4 R2, §5.4 R12, §5.4 R16, §4 Phase 0c, §5.5 ground 1, §5.5 "What Round 2 carries" inventory, §8 fenceposts, header status, and CHANGELOG. No code changes; no test impact.

• Stage 1 PR 5 — Round 2 segment 2c (closure-rule and lens-applicability refinements paired with R13 / R15 / R16 / R17 named with dispositions). Doc-only commit on feat/stage-1-pr5-pending-tx-engine-design. Segment 2c lands two project-wide discipline refinements (lens-applicability structural-conditions test; closure-rule wargaming-surface- known-at-closure-time qualifier) alongside four named-with- disposition R-residuals (R13 output-selection algorithm; R15 submission-strategy as composable actor; R16 wallet-side fee estimation; R17 event-sourced recovery as user-controlled tradeoff). All four R-residuals close their V3.0 vs V3.x decisions with seam-design implications for Phase 0 (OutputSelector / SubmissionStrategyActor / FeeEstimator / refined diagnostic-stream contract).

  §5.0.4 lens-applicability discipline. Section expanded with structured "Lens-applicability discipline" subsection establishing three structural conditions that govern when the actor-mesh lens applies to a per-engine extraction: (1) trait surface mediates state-mutation across actors, (2) adversarial review surfaces a cross-actor liveness or quiescence dependency, (3) Stage 4 actor-migration target is non-trivial. Per-engine PR pre-flights test applicability rather than presume it; the lens compounds across PRs whose structure admits it, not uniformly. Closure-rule cross-reference and fourth-shape adversarial- test record (Round 1 closure-review log: (1)-build paired with (3)-submit hybrid tested and rejected on criterion 5). Forward-template content for V3.1 rules-queue PR.

  §7 closure-rule strengthening. Restructured into "Closure rule (strengthened)" + "Round 1 closure rule (applied to PR 5)". General rule pinned: Round-N closes when the wargaming surface known at closure time is genuinely exhausted; new shapes surfacing in Round-N+1 reopen Round N rather than slipping past closure (the closure rule pins what was known, not what could ever be known). Lens-applicability cross-reference: closure rule's "exhausted" criterion is satisfied differently depending on whether the lens applies. Round 1 fourth-shape closure-review test recorded as instance of the strengthened rule. Forward-template content for V3.1 rules-queue PR.

  §5.4 R13 — output selection algorithm. Added with threat-model framing (deterministic-correlation, change- reuse, order-leak independent of FCMP++ ring semantics); options enumerated; disposition closed as V3.0 ships wallet2-greedy under OutputSelector trait-parameter seam (LocalPendingTx<S: Signer, O: OutputSelector>); V3.x lands RandomizedSelector / EntropyMaximizingSelector alternatives.

  §5.4 R15 — submission strategy as composable actor. Added with threat-model framing (transaction-network-entry-point timing / routing as wallet-layer privacy weakness against ANONYMITY_NETWORKS.md adversary); options enumerated; disposition closed as V3.0 ships SubmissionStrategyActor seam with DirectStrategy default; V3.x lands JitteredSubmissionStrategy / CircuitRotationStrategy / BroadcastStrategy / BatchedStrategy.

  §5.4 R16 — wallet-side fee estimation. Added with threat-model framing (daemon-recommendation on-chain fingerprint exploitable by malicious daemon per §5.3 threat-model anchor); options enumerated; disposition closed as V3.0 ships daemon-recommendation-with-explicit-override under FeeEstimator trait seam; V3.x lands WalletSideEstimator analyzing LedgerEngine historical block fee distribution. Conditional V3.0 lift noted: if segment-2d Phase 0 review confirms bounded LedgerEngine- accessor cost, R16 (c) lifts to V3.0.

  §5.4 R17 — event-sourced recovery as user-controlled tradeoff. Added with threat-model framing (PR 4 §5.4.8 #1 restart-amnesia rule's privacy property = diagnostic-event persistence does not leak across trust boundaries; refinement narrows prohibition to cross-boundary persistence specifically); options enumerated; disposition closed as V3.0 ships PR 4 §5.4.8 #1 carryover (drop-on-close); V3.x optionally lands encrypted-persistence consumer for institutional / long-running / multi-day workflows. Diagnostic-stream contract pin refined: in-memory-by-default plus permitted user-controlled encrypted-persistence opt-in for consumers entirely within wallet's own encrypted-state surface (no cross-trust-boundary leak per PR 4 §5.4.8 #4).

  FOLLOWUPS update. Four V3.x entries added (output- selection alternatives under OutputSelector trait seam; submission-strategy actors under SubmissionStrategyActor seam; wallet-side fee estimator under FeeEstimator trait seam; encrypted-persistence PersistenceConsumerActor for long-running deployments). Each names the V3.x trigger and the seam-design implication that segment 2c lands at V3.0.

  What Round 2 carries (§5.5). Inventory updated to reflect R13 / R15 / R16 / R17 named-with-dispositions in segment 2c; §5.0.4 lens-applicability discipline + §7 closure-rule strengthening landed in segment 2c; pending segments (2d / 2e / 2f / 2g) unchanged in scope.

  §8 fenceposts. Segment 2c moved from "Round 2 — pending" to "Round 2 — completed" with structured prose (six sub-bullets: §5.0.4 + §7 + R13 + R15 + R16 + R17 + CHANGELOG forward-template note).

  V3.1 rules-queue inputs (forward-template content). Two forward-template patterns this segment surfaces belong in the consolidated V3.1 rules-queue PR:

  • Closure-rule wargaming-surface-known-at-closure-time qualifier. "Round-N closes when the wargaming surface known at closure time is genuinely exhausted; new shapes surfacing in Round-N+1 reopen Round N rather than slipping past closure." Lift to a project-wide 16-architectural-inheritance.mdc amendment (or standalone closure-discipline rule) when the rules- queue PR consolidates.
  • Lens-applicability structural-conditions test. The actor-mesh lens compounds across PRs whose structure admits it (three conditions: (1) trait mediates state-mutation across actors; (2) adversarial review surfaces cross-actor liveness/quiescence dependency; (3) Stage 4 actor-migration target non-trivial). Per- engine PR pre-flights test applicability rather than presume it. Lift to 16-architectural-inheritance.mdc or a new discipline.mdc rule when the rules-queue PR consolidates.

  Discipline note (forward-template). Segment 2c is discipline-strengthening + opportunity-surface naming work that compounds project-wide design discipline without reopening the load-bearing question. Where segment 2a was audit-readiness and segment 2b was architectural-integrity-now at the residual level (R11), segment 2c lifts the project-wide pattern that makes future per-engine PR pre-flights answer the same questions methodically rather than adversarially.

• Stage 1 PR 5 — Round 2 segment 2b (R11 signing-actor split reframe to (b); R14 reservation extensibility seam). Doc-only commit on feat/stage-1-pr5-pending-tx-engine-design. The post-Round-1-closure adversarial review's primary finding surfaced an architectural-integrity-now item that the Round 1 R11 working disposition deferred under PR 4 R4-consistency grounds; segment 2b reframes R11 to (b) — separate LocalSigner / SigningActor from Stage 1 — and adds R14 as a near-zero-cost reservation extensibility seam in the same commit.

  • R11 reframe to (b) (architectural-integrity-now). §5.4 R11 prose replaced. Round 1's working disposition leaned (a) — PendingTxActor holds spend material, "matches PR 4 R4's instance-scoped pattern" — with shape (b) (separate SigningActor) deferred to V3.x with the HW-wallet trigger. The cost-asymmetry argument that justified PR 4 R4's tactical (a) (Scanner already existed in C++ holding view + spend material; restructuring Scanner was the deferral trigger) does not apply to PR 5 R11: PR 5 is opening the trait surface; LocalPendingTx does not yet exist; the choice between (a) and (b) is the same cost either way (we are designing one or the other from scratch, not moving from one to the other). R4-consistency cuts the other way: PR 4 R4's (a) explicitly named (c) as the long-term shape with the HW-wallet trigger; PR 5 R11 lands that long-term shape from the start. HW wallets are core, not edge, per 00-mission.mdc §1; designing the trait surface so spend material never enters PendingTxActor is the threat-model-correct shape; deferring it to V3.x treats the architecturally-cleaner shape as an optimization rather than the baseline. Audit surface narrows under (b) (one actor whose sole job is signing); Stage 4 actor-migration cost is asymmetric (splitting an existing actor is harder than designing actors split). §5.0.1 sketches updated to add signer: Arc<S> (Stage 1) and signer: ActorRef<SigningActor> (Stage 4) fields plus prose pinning the spend-material-locality discipline.

  • R14 reservation extensibility seam. New §5.4 R14 entry. Reservation shape gains an extensions: Vec<ReservationExtension> field; ReservationExtension is #[non_exhaustive] with empty V3.0 variant set; same extensibility pattern as RefreshDiagnostic / PendingTxDiagnostic. Forecloses V3.x trait revision when coinjoin / atomic-swap / time-locked / multi-stage / composable reservation variants land in V3.x consumer-actor PRs. Round 2 hygiene at near-zero cost; large optionality preservation.

  • FOLLOWUPS update. The pre-segment-2b PendingTxEngine-(b)-signing-actor-split V3.x deferral entry in FOLLOWUPS.md is replaced by a V3.x entry tracking HW-wallet integration as a Signer-impl substitution against the existing architecture. PR 4 R4 V3.x deferred-(c) (split-producer/recoverer for view-tag matching vs. final hybrid-decap) remains V3.x-deferred but benefits from PR 5 R11 (b)'s SigningActor infrastructure: the spend-key- isolated actor R4 (c) needs has a precedent in PR 5's SigningActor; lifting R4 (c) at the V3.x trigger becomes simpler.

  • Discipline note (forward-template). R11's reframe is the architectural-integrity-now discipline applied at the residual-disposition level — R-residual dispositions inherit the same architectural-integrity-now discipline that PR 3 / PR 4 established at the load-bearing question. The cost-benefit-defer-to-later anti-pattern per 16-architectural-inheritance.mdc recurred in a residual disposition rather than a load-bearing question; segment 2b's reframe makes future per-engine PRs subject to the same discipline at the R-residual level.

  • Header status + §8 fenceposts updated. Header acquires a Round 2 segment 2b paragraph documenting the R11 reframe rationale and the R14 extensibility seam. §8 fenceposts: segment 2b moves to "Round 2 — completed" with a per-item breakdown; pending segments renumber as 2c (closure-rule + lens-applicability + R13 / R15 / R16 / R17 named with dispositions), 2d (R2 + R12 co-disposition), 2e (R8), 2f (R9 + sink-binding decouple from R11), 2g (close-out).

• Stage 1 PR 5 — Round 2 segment 2a (audit-readiness): §5.3 criterion 5 strengthening + threat-model anchor explicit defense + §5.5 scorecard rationale clarification. Doc-only commit on feat/stage-1-pr5-pending-tx-engine-design. The post-Round-1-closure adversarial review surfaced five refinements for Round 2; segment 2a lands the three audit- relevant items (3 / 4 / 5 from the outcomes summary) in one commit ahead of the R-residual dispositions per the audit-blocking sequencing decision so audit-prep does not sequence behind R2 / R8 / R9 / R11 / R12.

  • Item 4 (audit-blocking) — §5.3 criterion 5 strengthening. Reframes the rejection ground for shapes (2)/(3) from "cross-actor liveness query" to "contract dependency on refresh quiescence at any point in the build/submit flow." Documents the stream-subscription steelman implementation (PR 4 RefreshDiagnostic::AttemptStarted / AttemptCompleted events push-driving a refresh_in_flight: bool rather than a synchronous query) and explains why it still fails: the daemon controls when AttemptCompleted fires, the bool stays true indefinitely under drip-feed responses, and the build (or submit) stalls regardless of which mechanism observes quiescence. The load-bearing property is the contract dependency, not the observation channel — synchronous query, push-driven bool, mailbox await, polling, or any other mechanism delivering the "quiescent" signal carries the same daemon-controllable failure mode.

  • Item 5 — §5.3 threat-model anchor explicit defense. Adversary-controlled-daemon-as-design-center made explicit (not citation-only). References ANONYMITY_NETWORKS.md plus the structural property "daemon outside the wallet's trust boundary by design choice, not as a hardened edge case." The Tor/I2P-first deployment posture means adversary-controlled daemons are the expected deployment, not an exception. Designs that admit structural single-peer DoS of transaction submission are rejected as structurally incompatible with the project's primary deployment model — the rejection is not "we can tolerate this in some deployments and harden against it in others"; it is "this contract shape contradicts the deployment model the design serves."

  • Item 3 — §5.5 scorecard rationale clarification. One-line clarification expanded into structured prose explaining criteria 4 and 5 share underlying mechanism (the contract dependency on refresh quiescence) but score distinct consequences: criterion 4 (implementation-feasibility / actor-migration compatibility) evaluates "the implementation creates the vulnerability"; criterion 5 (threat-model-survival / adversarial-daemon resistance) evaluates "the threat model exercises the vulnerability." Both ✗s correctly scored; the shared mechanism is one structural property; the criteria evaluate distinct consequence axes; not double-counting.

  • Propagation: §5.1 (2)/(3) + §5.5 ground 3. Updated to use the contract-dependency reframe consistently with §5.3's strengthened framing. The standard implementation and stream-subscription steelman share the same fatal property (contract dependency on refresh quiescence); the prose says so explicitly; the rejection ground is named as "contract-level, not implementation-level."

  • Header status + §8 Round 2 fenceposts updated. Header acquires a Round 2 segment 2a paragraph documenting what landed and why the audit-blocking sequencing puts items 3/4/5 ahead of the R-residual dispositions. §8 restructured into "Round 2 — completed" / "Round 2 — pending" sub-sections with segment 2a marked completed and segments 2b/2c/2d enumerated as pending.

  R1 disposition still holds — the strengthening sharpens the audit-blocking defense without reopening the disposition. Segments 2b (closure-rule + lens-applicability), 2c (R2/R12, R8, R9, R11 dispositions), and 2d (Phase 0 enumeration + close-out) follow at normal cadence.

  V3.1 rules-queue inputs (forward-template content). Two patterns this adversarial pass surfaced belong in the consolidated rules-queue PR alongside the §19 / rule-15-trinary / pre-flight-FOLLOWUP-scope items already queued from PR #41 Commit 2: (i) closure-rule scope qualifier ("Round-N closes when the wargaming surface known at closure time is exhausted; new shapes surfacing in Round-N+1 reopen Round N rather than slipping past closure"), generalizes from PR 5's specific instance to any project-wide design discipline using round-by-round wargaming closure; (ii) lens-applicability discipline ("project-wide design lenses compound across PRs whose structure admits the lens; future per-trait PRs test applicability rather than presume it"), tempers PR 4 §5.4.6 / PR 5 §5.0.4's projection without weakening the institutional payoff claim. Both land in segment 2b's doc edits to §5.0.4 and §7; the V3.1 rules-queue PR will consolidate them with the other queued inputs.

• Stage 1 PR 5 — PR #43 Copilot review-pass disposition: two R12-enumeration-consistency findings. Doc-only follow-up commit on feat/stage-1-pr5-pending-tx-engine-design. copilot-pull-request-reviewer surfaced two valid findings on PR #43, both at the same audit-time question ("does R12 appear in every Round 2 residual enumeration?"): §5.1 closure summary at line 429 ("R3 / R5 / R10 dissolve by composition under §5.0; R2 / R8 / R9 / R11 carry to Round 2") and §7 discipline budget revised estimate at line 1294 ("Round 2 disposes residuals (R2 / R8 / R9 / R11)"). Both omitted R12 despite the surrounding sections (§1, §5.2, §5.4, §5.5 "What Round 2 carries", §8 fenceposts) consistently including it. Both fixed verbatim per Copilot's suggestions; defensive sweep via grep confirmed all six R-residual enumerations now consistently carry R12, and the four "what dissolves" enumerations correctly remain on R3 / R5 / R10. Doc-only; no Rust or C++ code touched.

• Stage 1 PR 5 — Round 1 follow-up: R12 (Stage 1 current_snapshot acquisition mechanism) added; §5.5 ground-1 prose softened against implicit overclaim. Doc-only follow-up commit on feat/stage-1-pr5-pending-tx-engine-design. Round 1 review surfaced one R1-adjacent finding the closure commit implicitly overclaimed: §5.0.1's LocalPendingTx sketch holds ledger: L "for current_snapshot reads in Stage 1," but §5.5's first structural ground claimed Phase 0c collapses without naming Stage 1's actual snapshot-acquisition mechanism. Adding R12 names the three options without resolving them (deferred to Round 2 alongside R2's SnapshotId opacity disposition); the §5.5 ground-1 prose is softened from "Phase 0c collapses" to "Phase 0c collapses at the trait surface (pending R12)" to match the mechanism uncertainty.

  Three options enumerated in R12 (no resolution).

  • (a) Content-derived SnapshotId from existing LedgerSnapshot data (working hypothesis). Stage 1 reads snapshot identity via existing LedgerEngine / LedgerSnapshot surface; computes content-addressed ID locally. Phase 0c truly collapses in this disposition; no new trait surface.
  • (b) Stage 1 subscribes to the LedgerDiagnostic stream. Stage 1 implementation symmetric with Stage 4; modest implementation-symmetry cost in LocalPendingTx. Phase 0c still collapses at the trait surface.
  • (c) LedgerEngine grows a small additive accessor. Phase 0c partially restored, but additive only — read- only and idempotent; not the load-bearing coupling the original Phase 0c projected.

  Round 2 confirms by inspecting LedgerSnapshot's actual shape against the working hypothesis. Disposition's outcome triggers a small mechanical softening of §5.5 ground-1 prose (drop "pending R12" qualifier on (a); reword for (b)/(c) as needed) and the matching §4 Phase 0c hedge.

  Round 1 disposition unchanged. Grounds 2 and 3 (CAS-isn't-CAS / adversarial-daemon-resistance-as-structural) are independently sufficient to defeat shapes (2) and (3) under the actor-mesh framing per STAGE_1_PR_5_PENDING_TX_ENGINE.md §5.5. Ground 1 is expected confirmation, not load-bearing for the disposition.

  Findings deferred to Round 2 (review-pass scoping).

  • Finding 2 — mailbox-ordering vs daemon-side authority for R9 (terminal-rejection visibility): R9 contract clarification in Round 2.
  • Finding 3 — criterion 5 strengthening from "cross-actor liveness query" framing to "contract-dependency-on-refresh- quiescence" framing: closes a steelman attack ("but you could implement (2) via stream subscription, no synchronous query") without changing the disposition. Round 2 prose pass.
  • Finding 4 — sink-binding decoupling from R11 in §5.0.2: constructor-bound is the right answer on PR 4 §3.1 / R4 consistency grounds, independent of R11's spend-material disposition. Round 2 hygiene.

  This is the architectural-integrity-now disposition per 16-architectural-inheritance.mdc applied to documentation honesty: cheap residual addition + one prose softening preserves the discipline against the cost-benefit-defer-to-later anti-pattern (the Round 2 commit would otherwise have to correct an overclaim that lived in the Round 1 commit's prose). Doc-only; no Rust or C++ code touched.

• Stage 1 PR 5 — Round 1 close: actor-mesh reframe + shape (1) disposition (snapshot-ID pinning). Doc-only commit on feat/stage-1-pr5-pending-tx-engine-design (off dev at PR-#42 merge 6de8335d5). Closes the load-bearing open question docs/design/STAGE_1_PR_5_PENDING_TX_ENGINE.md §5 in one round rather than the seed's three-to-four-rounds projection because the §5.0 actor-mesh framing exhausts the wargaming surface in this round per the §7 closure rule. Shape (1) — build-against-current-snapshot + snapshot-ID pinning — wins on structural grounds; shapes (2) and (3) fail criterion 5 (adversarial-daemon resistance) by construction under the actor framing; no fourth shape survives. Two rounds saved against the seed projection.

  The §5.0 actor-mesh reframe. PR 4's Round 2 reframe established a project-wide design lens: the trait surface is the synchronous decision point that consumers branch on; the rich semantic surface lives on the diagnostic-stream seam (DiagnosticSink parameter; typed event enum). PR 5 inherits the lens from Round 1 — the cost-benefit-defer-to-later anti-pattern PR 4 named has its cure now structurally available per 16-architectural-inheritance.mdc, applied at the load-bearing question rather than discovered in Round 2+.

  Three structural grounds shape (1) wins on (§5.1).

  • Phase 0c collapses (§5.5 ground 1). Under the seed's synchronous framing, LedgerEngine had to grow current_snapshot_id() -> SnapshotId so PendingTxEngine::build could read it inline. Under the actor framing, snapshot identity flows through the diagnostic-stream surface as LedgerDiagnostic::SnapshotMerged { new, prior, height } events emitted at the merge gate's normal operation. Phase 0c (load-bearing cross-trait surface coupling) collapses to Phase 0g (additive event-variant amendment).
  • The CAS isn't a CAS (§5.5 ground 2). Under the actor mesh, submit is a mailbox message; the actor processes one message at a time; "check reservation.snapshot_id against current_snapshot" is a field comparison in the message handler, not a compare-and-swap. There is no concurrency to swap against — the actor is the serialization point. R3 / R10 dissolve as trait-surface contract questions.
  • Adversarial-daemon resistance is structural (§5.5 ground 3, criterion 5). Under the actor mesh, PendingTxActor is decoupled from RefreshActor's liveness by mailbox. Hostile daemon stalling refresh keeps RefreshActor busy in produce_scan_result; PendingTxActor's mailbox continues processing build/submit/discard against the most-recently-merged snapshot regardless. Shapes (2) and (3) require PendingTxActor to query RefreshActor's state, which is what creates the DoS surface; shape (1) has no such query. Per 00-mission.mdc §1 (security as precondition) and ANONYMITY_NETWORKS.md (adversary- controlled daemons in privacy-wallet topologies), a shape that admits structural single-peer DoS of transaction submission is rejected even when its UX and trait surface are otherwise minimal.

  Five-criteria scorecard (§5.5). Shape (1) passes all five; (2)/(3) pass criteria 1–3 but fail criteria 4 (Stage 4 actor-migration compatibility — their cross-actor query introduces the DoS surface) and 5 (adversarial-daemon resistance, structurally).

  Implications for PR 4 (§5.2 — resolved as confirmation). PR 4 §5.3 deferred PR 4 Round 3 to PR 5 R1. Resolution: PR 4 α confirms; the "provisionally load-bearing" qualifier on PR 4 §5.3's α is withdrawn. PR 4 Round 3 is a confirmation-shape round, not a re-evaluation round — α holds and PR 4 advances directly to Round 4 (commit decomposition + Phase 1 commit list). No γ-style consumer-driven refresh-progress streaming is required: under the actor framing, PendingTxActor already gets refresh-progress state push-driven from the diagnostic stream; γ becomes a redundant pattern the framing makes superfluous.

  The diagnostic-stream seam for PR 5 (§5.0.2). Parallel to PR 4's RefreshDiagnostic, PR 5 defines PendingTxDiagnostic (#[non_exhaustive]) carrying BuildSucceeded / BuildFailed / SubmitAttempted / SubmitSucceeded / SubmitFailed / SubmitSnapshotInvalidated / Discarded / ReservationOutstanding plus the DiscardReason enum (#[non_exhaustive]: ConsumerExplicit / SnapshotRotationAutoDiscard (R5 lazy-discard) / DaemonRejectedTerminal (R9 terminal disposition)). The trait surface adds a &dyn DiagnosticSink parameter on LocalPendingTx::new (constructor-bound, matching PR 4 §3.1 / R4 preference; constructor-vs-per-method shape jointly disposed with R11 in Round 2). (Forward-pointer: Round 2 segment 2f tightened the constructor parameter from &dyn DiagnosticSink to Arc<dyn DiagnosticSink> for reference-shape ergonomics during the R11 closure; see the segment-2f and segment-2g CHANGELOG entries below for the final binding form.) The cross-cutting DiagnosticSink contracts from PR 4 §5.4.6 / §5.4.7 R6 reframe / §5.4.8 (non-blocking emit, recursive trust boundary, restart-amnesia detection, panic safety, concurrent emit, emission/return coherence) bind verbatim per §5.0.3.

  Residuals (§5.4). Five residuals dissolve by composition under §5.0; four carry to Round 2; one new (R11) surfaces. (R12 — Stage 1 current_snapshot acquisition mechanism — was identified in a subsequent Round 1 follow-up commit and added to the Round 2 carry list; see the immediately-following Round 1 follow-up changelog entry. Round 2 thus carries five residuals in total: R2 / R8 / R9 / R11 / R12.)

  • Dissolved by §5.0: R3 (build-during-refresh-during-reorg — mailbox FIFO orders structurally), R5-trait-surface-aspect (outstanding-reservations-on-rotation policy is local to PendingTxActor, not a trait-surface question), R10 (concurrent build/submit/discard — mailbox FIFO is the actor-system contract).
  • Carry to Round 2: R2 (SnapshotId opacity / projection types; recursive trust boundary), R8 (reservation TTL / leak prevention — reframed as ReservationTTLActor composition + V3.x FOLLOWUPS), R9 (daemon-side submit failure — reframed as two-stage submit flow with intermediate submitted-pending-daemon-ack state and self-continuation message), R11 (signing-actor split — new under §5.0; Stage 1 keeps option (a) instance-scoped per PR 4 R4; V3.x FOLLOWUPS for option (b) SigningActor isolation, same trigger as PR 4 R4 deferred-(c) HW-wallet integration).
  • Retained but lower-priority hygiene: R4 (discard semantics under invalidation), R5-policy-aspect, R6 (outstanding() semantics), R7 (Send + Sync + 'static on P).

  Phase 0 net change (§4). One amendment removed: 0c (load-bearing cross-trait synchronous query → LedgerEngine). Two added: 0f (PendingTxDiagnostic enum + DiagnosticSink parameter on LocalPendingTx); 0g (LedgerDiagnostic::SnapshotMerged variant addition — cross-trait but additive only, lives in the diagnostic-stream surface not in LedgerEngine's trait surface). Net effect: load-bearing surface coupling collapses to additive-only event-surface coupling, which is exactly the kind of structural cleanup 16-architectural-inheritance.mdc's continuous-discipline corollary predicts.

  V3.x FOLLOWUPS landed in this commit.

  • ReservationTTLActor consumer actor (closes R8 by composition; subscribes to BuildSucceeded / Discarded events; restart-amnesia constraint per PR 4 §5.4.8 #1).
  • SubmitFailureAnalyzer consumer actor (subscribes to SubmitFailed / SubmitSnapshotInvalidated; pattern detection — many SnapshotInvalidated in a row → adversarial reorg-churn; recurring FeeTooLow → fee estimator drift; recursive trust boundary applies).
  • ReservationAuditActor consumer actor (subscribes to all PendingTxDiagnostic events; in-memory wallet-action audit log; falls under recursive trust boundary discipline if it persists or exports — projections only).
  • SigningActor migration entry (R11 option (b); Stage 4 spend-secret isolation; same HW-wallet-trigger language as PR 4 R4 deferred-(c)).

  Cross-cutting DiagnosticSink contract-doc generalization (Round 2 disposition). The contracts are now used by both PR 4 and PR 5; they are cross-cutting design invariants. PR 4's FOLLOWUPS named docs/design/REFRESH_DIAGNOSTIC_STREAM.md as the spec doc; Round 2 disposes whether to rename to DIAGNOSTIC_STREAM.md (general) or factor a parent DIAGNOSTIC_STREAM_CONTRACTS.md that PR 4 / PR 5 inherit from. Doc-only.

  Doc-only; no Rust or C++ code touched. Cross-references: STAGE_1_PR_5_PENDING_TX_ENGINE.md §5.0 (actor-mesh framing as Round 1 substrate), §5.1 (three-shape comparison under the lens), §5.2 (PR 4 α confirmed), §5.3 (five criteria), §5.4 (residuals), §5.5 (Round 1 disposition + scorecard); STAGE_1_PR_4_REFRESH_ENGINE.md §5.4.6 / §5.4.7 R6 reframe / §5.4.8 (the cross-cutting DiagnosticSink contracts inherited by PR 5); V3_ENGINE_TRAIT_BOUNDARIES.md §2.4 (PR 5's binding trait surface — unchanged by Round 1).

• Stage 1 PR 4 — PR #42 Copilot review-pass disposition: two typos, one stale work-list row, two CHANGELOG link retargets, one CHANGELOG ordering correction. Six findings surfaced by copilot-pull-request-reviewer on PR #42's design-branch open. Validated each at source; five fixes landed verbatim, one fixed in the opposite-direction-from-Copilot-suggested (CHANGELOG ordering — Copilot suggested oldest-first; the file's established [Unreleased] convention is newest-first within substantive groupings, so the §5.5 hygiene entry moved to the top of the PR 4 cluster rather than to the bottom). Concrete dispositions:

  • Typo Forecloseing → Foreclosing in STAGE_1_PR_4_REFRESH_ENGINE.md §5.4.6 (R6 reframe, concurrent-emit pin discussion).
  • Typo dispositon → disposition in REFRESH_DESIGN_LANDSCAPE.md §6 (bandwidth/pruning interplay paragraph).
  • §5.5 work-list row for β internal-batching updated from pre-Round-2 staleness (V3.x (R2) / "promotion to FOLLOWUPS pending Round 2 R2 disposition") to the settled Round 2 R2 disposition (closed — kept as §2.2 future-scaling note; not promoted to FOLLOWUPS yet; revisit if V3.0 RC stabilization bandwidth profiling identifies β as the remediation over alternatives).
  • Two CHANGELOG citation links retargeted from self-references to STAGE_1_PR_4_REFRESH_ENGINE.md over to the actual engine/refresh.rs source. The link text named the source file; the link target pointed to the design doc. Audit readers couldn't follow the citation to code; that misled the audit trail.
  • PR 4 CHANGELOG cluster reordered so the newest commit (§5.5 hygiene) sits at the top, matching the file's [Unreleased] newest-first convention. The Round 1 chronological pair (disposition above review pass) is preserved as a narrative — moving them to the bottom of the cluster would have required two cross-reference rewrites (above → below) for marginal benefit; the minimal-invasive disposition is correct here. The Round 2 sub-cluster was already newest-first; only the §5.5 hygiene's position needed correction. PR #42 test plan updated to describe the resolved layout. Doc-only; no Rust or C++ code touched.

• Stage 1 PR 4 — §5.5 work-list hygiene: P3 apply_scan_result_to_state Vec<usize>-discard row added. Single-row addition to the STAGE_1_PR_4_REFRESH_ENGINE.md §5.5 work-list against the dev-side FOLLOWUPS entry ("P3: apply_scan_result_to_state allocates Vec<usize> even for trait-impl callers that discard it") that landed via PR #37 (commit 0a0d46b38, 2026-05-10) during the design branch's pre-M3-tail window. The design branch was cut at 9e53c82fa (pre-PR-#37); PR #37 reshaped the merge pipeline (LedgerIndexes::ingest_block, process_scanned_outputs, apply_scan_result_to_state carry insertion-index ranges) and added P3 to FOLLOWUPS as a PR 4-triggered deferral. The work-list row closes the audit delta between the design doc's enumeration and the dev-side FOLLOWUPS state before the design branch lands onto dev. P3's disposition under α (Round 1) plus (a-instance-scoped) view-material (Round 2 R4) remains Round 3 / Round 4 trait-surface enumeration: either LedgerEngine::apply_scan_result grows to surface the insertion-range carryout (Vec consumed, optimization dead code) or RefreshEngine owns the post-pass directly and the trait method is removed (discard sites disappear). Doc-only; no Rust or C++ code touched.

• Stage 1 PR 4 — Round 1 disposition: α (preserved current shape) for the RefreshEngine producer-redesign question. Doc-only commit on feat/stage-1-pr4-refresh-engine-design (off dev at 9e53c82fa). Closes the load-bearing open question docs/design/STAGE_1_PR_4_REFRESH_ENGINE.md §5 named in the seed; α is the disposition because it satisfies all four review criteria — PR 4 extraction cleanliness, PR 5 two-phase build/submit/discard contract over reorg events, reservation-tracker reorg surfacing, Stage 4 actor-migration compatibility — without forcing additional discipline into the per-trait PR or its consumers. β (internal batching) and γ (consumer-driven streaming) are separated as independent validation surfaces per 19-validation-surface-discipline.mdc (named on dev 2026-05-10) and recorded as residual questions R2 (β as V3.x FOLLOWUPS) and a hypothetical follow-up PR (γ if R1's PR 5 design surfaces correctness need).

  • Adds docs/design/STAGE_1_PR_4_REFRESH_ENGINE.md §5.4 (Round 1 disposition with four-criteria rationale and R1 / R2 / R3 residuals) and §5.5 (work-list table for every refresh-adjacent item with its target version and "where documented" pointer); marks the producer-redesign decision complete on §3.3's pre-flight checklist; rewrites §5.3's rounds trajectory to reflect Round 1's convergence on α and the resulting compression of Rounds 2–4.
  • Adds docs/design/REFRESH_DESIGN_LANDSCAPE.md: refresh-design-space substrate covering the privacy-by-default precondition (§2), the operational view-tag pre-filter from STAGE_1_PR_3_KEY_ENGINE.md §3.1.1 (§3), FMD as a V4 research direction (§4 — negative result for V3.0), OMR as a V3.x research direction (§5 — negative result for V3.0), and the pruning-vocabulary sidebar (§7) disambiguating daemon-side --prune-blockchain / archival --no-prune / RPC-server prune / wallet-side prune-by-birthday / prune-by-skip-to-height.
  • Adds a V3.0 docs/FOLLOWUPS.md entry ("Refresh bandwidth tradeoff under α") naming the cost-benefit artifact PR 4's α-disposition consumed; entry pinned to V3.0 RC stabilization (per the user's 2026-05-12 sequencing decision) so the cold-sync bandwidth tradeoff is load-bearing on RC stabilization rather than open-ended on the post-genesis backlog.

  Doc-only; no Rust or C++ code touched. Branch posture: feat/stage-1-pr4-refresh-engine-design stays on dev-rooted doc-only commits until M3e closes per STAGE_1_PR_4_REFRESH_ENGINE.md's branch policy.

• Stage 1 PR 4 — Round 1 review pass: more carefully-specified α (view-material flow, atomicity, error taxonomy). Same-day follow-up to the Round 1 disposition above. The review pass corrected STAGE_1_PR_4_REFRESH_ENGINE.md §3.1's materially-wrong "no secret-touching surface" framing to master-secret isolation routed through R4 — the existing producer (engine/refresh.rs:1254) builds a Scanner carrying both the view secret (X25519 view-tag pre-filter + hybrid-decap chain) and the spend secret (key-image computation) per attempt, so the load-bearing threat-model property is "no per-output derived secrets cross the trait surface," not "no secrets." The review pass surfaced four additional residual questions and three trait-contract observations:

  • R4 — view-material flow (constructor-bound vs. per-call vs. split-producer/recoverer). Load-bearing; affects LocalRefresh::new constructor shape and Stage 4 actor envelope. §4 Phase 0a / 0b candidate. Round 2 disposition.
  • R5 — mid-scan reorg-abort at checkpoint 3. Mitigation for the reorg-amplification adversarial scenario (§5.4.5). Trade-off: extra daemon RPC cost vs. hostile-daemon work amplification. §4 Phase 0d (conditional). Discipline-budget gated. Round 2 disposition.
  • R6 — RefreshError::ConcurrentMutation boundary. Pinned as orchestrator-internal translation of LedgerEngine errors; excluded from RefreshEngine::produce_scan_result's error type. §4 Phase 0c variant set: Cancelled, DaemonError(D::Error), ScannerContractViolation { kind, evidence }, ReorgTooDeep { fork_height, max_rewind }. Round 2 hygiene disposition.
  • R7 — ScanResult atomicity-under-cancellation contract. Confirmed against the existing implementation (cancel checks at lines 980 / 1140 / 1186 return Cancelled immediately; partial state drops via the function frame). Pinned in the trait contract per V3_ENGINE_TRAIT_BOUNDARIES.md §2.3 / §7. §4 Phase 0a candidate.
  • Refines R1's working hypothesis to build-against-current-snapshot with snapshot-ID pinning — the reservation tracker carries a snapshot ID per reservation; the submit path becomes a CAS against current_snapshot == reservation.snapshot_id. PR 5's design rounds open with this as the working hypothesis.

  §5.4.4 three-call-mode constraint. Cold open / restore, steady-state poll (~10–30 s), and post-submit confirmation have very different cost and cancellation profiles; per-call setup must be near-zero for steady-state. Phase 1's commit decomposition (Round 4) must not introduce per-call setup the inherent method did not have.

  §5.4.5 adversarial scenarios under α. Four daemon-attack vectors recorded with their dispositions: reorg amplification (mitigation = R5), view-tag DoS (Scanner implementation property; constant-time framing assumes non-adversarial input rates), withholding / partial responses (inherited from PR 1's DaemonEngine contract), snapshot poisoning via LedgerSnapshot (confirmed value-typed at lines 147–156), and ScannerContractViolation.evidence as memory-amplifier vector (bounded shape required).

  §5.4.6 trait-surface contract pins. Send + Sync + 'static bound on R: RefreshEngine (Stage 4 kameo actor wrap predicate); Progress-channel trust-boundary pin (consumers must be inside the wallet trust boundary; refused as a design question if not).

  The α-disposition holds against all of the review pass' findings — none argue for β or γ. They argue for a more carefully-specified α. Doc-only; no Rust or C++ code touched.

• Stage 1 PR 4 — Round 2 close-out: Phase 0c InternalInvariantViolation + Phase 0e DaemonOp / ProtocolErrorKind seed enums. Same-day follow-up to the Round 2 reframe contract-pin refinements (immediately-following bullet) that resolves two items the refinements had flagged as "Round 4 vs Round 2 hygiene" questions. Both worth settling in Round 2 because of downstream impact: deferring to Round 4 re-opens a phase Round 2 was supposed to close.

  Phase 0c amendment — InternalInvariantViolation { context: &'static str } on the orchestrator-side RefreshError enum. Resolves the §5.4.7 R6 "(a) extend ConcurrentMutation or (b) introduce InternalInvariantViolation" cleanup pin at the design layer, not Round 4 commit-decomposition. The retry-loop call sites at engine/refresh.rs:1672–1680 and :2055–2065 are state-machine invariant violations ("loop body itself is broken" per the existing site comments), not retry-budget exhaustion. Conflating both into ConcurrentMutation would route "wallet under sustained merge contention" (back off and retry) and "wallet hit an internal bug" (report and stop) through the same variant; downstream consumers (PeerReputationActor, telemetry, user-facing error surface) need the structural distinction. &'static str for context is appropriate at this site — compile-time-fixed developer content, not attacker- influenced data; the memory-amplifier and log- exfiltration vectors the producer-trait unit-variant discipline closes do not apply. The variant also bounds future migrations: future "state machine reached a should-never-happen path" findings route here. Round 4 migration target: the two call sites migrate from MalformedScanResult { reason: "..." } to InternalInvariantViolation { context: "..." }; existing reason strings become context values.

  Phase 0e seed enums — DaemonOp and ProtocolErrorKind initial variant sets, audited against the producer's actual call-site surface. Two ground-truth findings:

  • DaemonOp narrows to two variants per the engine/refresh.rs audit. The producer issues exactly two daemon RPCs: daemon.get_height() (tip fetch; lines 1480 / 1958) and rpc.get_scannable_block_by_number(...) (per-block fetch; line 1190). Under FCMP++ with view-tag pre-filtering, get_scannable_block_by_number returns the full per-block payload; no separate GetBlocks / GetTransactions / GetOutputs / GetChainHashes are issued. GetFeeEstimates and SubmitTransaction are PendingTxEngine-issued (PR 5), not refresh-issued.
  • ProtocolErrorKind is fresh-defined, not a re-export of upstream shekyl_rpc::RpcError. Upstream RpcError is a flat enum carrying String payloads in three of its eight variants (InternalError(String) / ConnectionError(String) / InvalidNode(String)) and is not a bounded re-export candidate. The producer must classify upstream into the bounded enum at the RefreshDiagnostic-emission boundary; the String payload elision is the load-bearing classification step per §5.4.7 R6's memory-amplifier closure. Initial variant set seeded against the call-site- reachable subset for the refresh producer: { ConnectionError, InternalError, InvalidNode, InvalidTransaction, PrunedTransaction }. The other upstream variants (TransactionsNotFound, InvalidFee, InvalidPriority) are not reachable from refresh-issued RPCs.

  Round 4 commit-decomposition re-audits both seeds (the audit may surface additional reachable variants the seed missed, or paths the seed listed that aren't actually reachable); the audit is authoritative. The seeds serve as design-doc completeness and as an audit checklist.

  Doc-only; no Rust or C++ code touched.

• Stage 1 PR 4 — Round 2 reframe contract-pin refinements: concurrent-emit clarification, producer-panic-safety property, and test-as-canonical-reference pin. Same-day follow-up to the Round 2 reframe follow-up (immediately-following bullet) that closes three smaller remaining holes before Phase 0 closes. None re-open the reframe; each closes a class of drift / failure-mode that would otherwise propagate to the V3.x consumer-actor PR.

  Concurrent-emit clarification on the non-blocking pin (§5.4.6 + DiagnosticSink docstring). The Send + Sync bound permits concurrent emit from multiple tasks; the non-blocking contract holds under concurrent emission, not merely per call. Serializing internal synchronization that admits unbounded contention — Mutex<VecDeque<_>>, RwLock-wrapped state, any shared mutable structure without bounded-wait guarantees — violates the contract even when each emit call returns promptly in isolation. Conforming implementations use lock-free queueing (crossbeam::queue::ArrayQueue, flume non-blocking sends), atomic counters, or sharded mailboxes. Forecloses a class of implementation that type-checks against the literal per-call non-blocking property and still re-introduces the producer-liveness hazard at scale — load-bearing under any future producer-side parallelism shape or Stage 4 actor-mesh topology where multiple LocalRefresh instances share a sink.

  Producer-panic-safety property and Round 4 PanickingSink test deliverable (§5.4.6). The non-blocking pin closes the producer-liveness hazard from a blocking emit. It does not close the adjacent hazard from a panicking emit — a buggy or third-party sink implementation that panics (null pointer dereference in a logger, allocator failure in a metrics consumer, panic-on-overflow in an aggregator) propagates unwind through the producer's call stack while the Scanner (holding spend material) is live across the emit call. Pinning "MUST NOT panic" on emit as a hard trait contract is rejected — it is unenforceable at the type system and pushes development cost onto every sink author for limited gain. The load-bearing property lives on the producer side: any panic propagating out of emit results in a predictable refresh-attempt failure with Scanner cleanly zeroized via Drop, no leaked half-state, and the cancellation token consistently in either fired-or-not state. Phase 1 test deliverable: the AssertionSink coherence property test grows a PanickingSink variant that panics on configured event variants; the test asserts (a) Scanner is dropped before the panic crosses the producer frame (visible via a Zeroize observer wrapper in the test harness), (b) no inconsistent producer state remains observable after the unwind, and (c) the panic propagates without Drop-chain corruption or double-panic. Round 4 commit-decomposition pass records this alongside the AssertionSink coherence test as a Phase 1 deliverable.

  Test-as-canonical-reference pin on the coherence contract (§5.4.6 + DiagnosticSink docstring). When the AssertionSink coherence property test lands in Round 4 it becomes executable documentation of what coherence means. If a future implementer reads §5.4.6 prose and is uncertain about an edge case (e.g., "does a ScanProgress emission count toward coherence for a MalformedScanResult return?" or "do two distinct error-class events from the same scan span count as one emission or two?"), the test's behavior is the authoritative answer. Prose ambiguities resolve against test behavior, not the other way around; if the test is wrong, the test is fixed and the prose follows, never the reverse. Per 19-validation-surface-discipline.mdc, the property test is one of the validation surfaces for the coherence rule; naming it as authoritative makes prose / test drift impossible without explicit re-examination — a future PR landing prose changes to the coherence contract is required to re-examine the test, and vice versa.

  §5.5 work-list amendments and §8 Round 4 deliverable update. New work-list rows record the four-part contract-pin bundle (non-blocking + concurrent-emit clarification + coherence + canonical-reference) and the producer-panic-safety Round 4 test deliverable. §8's "Remaining for Round 4" prose names the paired AssertionSink (coherence) and PanickingSink (panic-safety) test deliverables as Phase 1 test-design outputs.

  Doc-only; no Rust or C++ code touched.

• Stage 1 PR 4 — Round 2 reframe follow-up: DiagnosticSink contract pins and §5.4.8 refinements. Follow-up to the Round 2 reframe (immediately-following bullet) that pins load-bearing contracts the V3.x consumer-actor PR would otherwise have to re-derive from first principles, and tightens two §5.4.8 attack-surface dispositions whose Round 2 framing was correct but underspecified.

  Two contract pins added at §5.4.6 / §5.4.7 R6 / Phase 0e docstring.

  • Non-blocking emit contract. DiagnosticSink::emit MUST NOT block. Implementations use try_send-shaped semantics; on a full bounded channel, unavailable consumer, or any other back-pressure condition, emit drops the event silently and returns promptly. Pinned to close the producer-liveness hazard: a blocked sink would pin the producer at the emission call holding the Scanner's spend material and would block observation of the cancellation token at checkpoints 2 and 3 — defeating both the §5.4.4 invocation-overhead constraint and the §3.1 wallet-lock-latency property. Without the trait-surface pin, a hostile or buggy consumer-actor sink in V3.x can introduce the hazard post-hoc with no structural reason for the consumer- actor author to know they did.
  • Emission/return coherence contract. RefreshEngine implementations MUST emit at least one corresponding RefreshDiagnostic event to the sink for every non-Cancelled RefreshError returned, before returning the error. Pinned to close the silent-error failure mode (orchestrator rotates peer with no telemetry; reputation actor blind) and the phantom-error failure mode (telemetry attributes a defect to a peer but the wallet then merges that peer's scan result as authoritative). Both fail open at the type-system level; only a contract pin closes them. Phase 1 delivers a property-test CI invariant: an AssertionSink wraps LocalRefresh and asserts coherence on fuzzed inputs (Round 4 test-design deliverable).

  §5.4.8 #1 — restart-amnesia named explicitly as a deliberate threat-model consequence. The no-persistence posture is correct privacy-first, but an adversary who can observe or trigger wallet restarts (process kill, RPC-daemon restart, scheduled rotation, OOM, user quit-and-restart cycles) can rate-limit hostile behavior to evade reputation accumulation. Pinned forward to the V3.x consumer-actor PR design: detection logic is coarse-window-based, not credit-history-based; no "trust accumulation" over time. Forecloses the evasion-via-restart-cycle and the dual evasion-via-trust- accumulation patterns. Binding on PeerReputationActor and ViewTagAnomalyDetector design.

  §5.4.8 #4 — trust-boundary framing re-phrased recursively. The current text targeted obvious network-bound consumers (analytics, crash reporters, remote tracing); the subtler case is the in-process aggregator-republisher — a consumer in-process by topology but trust-boundary-crossing by publication (metrics-export actors with HTTP endpoints, debug UI actors over IPC, logger actors writing files collected by remote infrastructure, developer-mode flags dumping to off-host log collectors). The principle reframed: full- fidelity events flow only to actors whose external surface is itself inside the wallet trust boundary, recursively. The recursion creates a continuous audit obligation that binds on every PR touching the consumer- actor topology, anchored procedurally to 19-validation-surface-discipline.mdc.

  Phase 0e seed — MalformedKind initial variants recorded. Six daemon-attributable variants (NonEmptyForEmptyRange, RangeLengthMismatch, RangeMembershipViolation, DuplicateHeight, MissingHeightEntry, ResidualAfterApply) covering the current MalformedScanResult { reason: &'static str } call sites in engine/merge.rs and engine/refresh.rs, so the unit-variant migration has a straightforward mapping at Round 4 commit decomposition. Non-daemon- attributable call sites (the retry-loop-exhaustion reasons in engine/refresh.rs:1678–1680 and :2061–2064) are flagged for Round 4 cleanup — they don't belong on MalformedScanResult's "peer rotation decision needed" structural branch.

  Variant-ordering / serialization forward-note. Under the §5.4.6 / §5.4.8 #4 in-process trust-boundary pin, the diagnostic stream is not serialized to any stable external format and variant ordering is not load-bearing; the #[non_exhaustive] attribute preserves additive evolution. The note exists for a hypothetical future PR that records diagnostic streams to disk for test replay — at that point, on-disk-format stability becomes load-bearing and the additive-evolution discipline acquires a backward- compatibility constraint. No PR 4 action required; the note is forward-recorded so the future PR has the constraint named.

  FOLLOWUPS amendments.

  • Added ViewTagAnomalyDetector V3.x entry with the explicit producer-side dependency: before the detector lands, the producer must grow a ViewTagFalsePositive { observed_rate, expected_rate } (or equivalent) variant. #[non_exhaustive] makes the addition additive without trait-surface revision.
  • Extended the diagnostic-stream spec-doc FOLLOWUPS entry (docs/design/REFRESH_DIAGNOSTIC_STREAM.md) to record the four binding contract pins (non-blocking, coherence, recursive trust-boundary, restart-amnesia detection discipline) as load-bearing spec content that consumer-actor PRs reference rather than re-deriving.

  Doc-only; no Rust or C++ code touched.

• Stage 1 PR 4 — Round 2 reframe: diagnostic-stream seam supersedes Round 2 first-pass R5 / R6 dispositions. This bullet supersedes the immediately-following bullet's R5 and R6 dispositions per the Round 2 reframe section §5.4.7 R5 reframe / §5.4.7 R6 reframe / §5.4.8. The immediately-following bullet's R1 / R2 / R3 / R4 / R7 dispositions are unchanged and still hold.

  Why the reframe. Round 2's first-pass R5 (defer to V3.x with telemetry trigger) and R6 (keep MalformedScanResult { reason: &'static str }) reasoned about RefreshEngine in a synchronous function-call graph where the error is a single isolated event and the payload question is "what does this caller branch on." The design target is an actor-mesh fabric (Stage 4) where the error is a stream event with temporal context, and the same event routes to multiple consumers with different security properties per consumer. The first-pass disposition is the cost-benefit-defer-to-later anti-pattern per 16-architectural-inheritance.mdc; the reframe is the architectural-integrity-now answer — lay the seam now, defer only the consumer implementations.

  The two-channel shape (R6 reframe). The synchronous trait return and the actor-mesh diagnostic stream are different artifacts with different consumers and different security properties; they get different types.

  • Channel 1: synchronous trait return RefreshError — unit variants only. Three variants: Cancelled, Io, MalformedScanResult. No string, no evidence, no payload of any kind. The orchestrator's branch table is structural (cancel-propagate / retry-with-backoff / peer-rotation); the decision needs zero information beyond the variant tag. Closes the memory-amplifier vector by construction — there is no attacker-controlled data anywhere on the producer trait error surface.
  • Channel 2: RefreshDiagnostic event stream emitted via DiagnosticSink. Rich structured events fan out to specialized consumer actors with per-consumer trust posture and sanitization rules. produce_scan_result gains a diagnostics: &dyn DiagnosticSink parameter (per-call; runtime-dispatch; locked now so Stage 4 doesn't re-rev the trait). Stage 1 emits a minimal seed variant set (DaemonMalformed { kind: MalformedKind }, DaemonTimeout { op, elapsed }, DaemonProtocolError { kind }, ReorgObserved { fork_height, depth }, ScanProgress { height, candidates }); Stage 1 sinks are NoopDiagnosticSink / TracingDiagnosticSink; the actor-mesh sink lands in V3.x. The enum is #[non_exhaustive] so the variant set grows additively with PR 1's peer-aware DaemonEngine surface and future-PR consumer patterns.
  • Sanitization is a property of the consumer, not the stream. Full-fidelity events stay in-process per the §3.1 / §5.4.6 trust-boundary pin (extended from the Progress-channel pin to the broader diagnostic-stream pin); persisted or exported projections are lossy by design.

  R5 dissolved by composition (R5 reframe). The reorg-amplification scenario resolves via a ReorgAmplificationDetector consumer actor that subscribes to RefreshDiagnostic::ReorgObserved events, maintains a windowed count, and signals cancellation back through the existing CancellationToken checkpoint-3 plumbing. The producer's §7 checkpoint discipline does not grow. No per-checkpoint-3 daemon RPC; no §7 amendment. The capability is added by composition of the actor mesh's consumers; the implementation deferred to the V3.x actor-mesh PR. Trigger is policy-driven, not evidence-driven — the previous "if hostile-daemon work-amplification scenarios become measurable" gate is withdrawn.

  What the reframe unlocks (consumer-side; deferred implementations). Fail2ban-style intra-session mitigation via PeerReputationActor (per-peer event history with decay; threshold-based graduated response); pattern-based recovery via RecoveryActor (Byzantine-fault-tolerance-flavored N-of-M agreement on contested data); reorg-amplification detection via ReorgAmplificationDetector (R5's natural home); future variant additions as the consumer-pattern surfaces mature.

  Five new attack surfaces honestly enumerated (§5.4.8). The reframe is not free; the diagnostic-stream seam introduces five attack surfaces, each with a mitigation pinnable now and a deferred consumer-actor implementation.

  • Peer-reputation fingerprint → in-memory only, scoped to wallet session, drop on close. Privacy-first wins over classical fail2ban's cross-session memory.
  • PeerId stability under Tor/I2P → PeerId is a transport-defined opaque token; decay calibrated to circuit-rotation cadence; Stage 1 variants omit peer attribution entirely until PR 1's peer-aware DaemonEngine surface lands.
  • Rotation-timing side-channel → jittered rotation, batched decisions, temporal decoupling of event-observation-time from rotation-action-time inside the PeerReputationActor.
  • Diagnostic stream as covert channel → trait-contract pin (§5.4.6 / §3.1): full-fidelity events flow only to in-process consumers inside the wallet trust boundary; cross-process or network-bound consumers receive only explicitly-sanitized projection types.
  • Mailbox saturation as DoS → bounded consumer mailboxes with explicit overflow policies (drop-oldest for diagnostics consumers; aggregate-on-overflow for reputation; event-sequence-aware drop for recovery). Producer-side: emit at natural rate; lossless delivery is not promised.

  Phase 0 finalized under the reframe.

  • Phase 0a: trait-surface contract pins + ViewMaterial type definition (R4) + diagnostic-stream trust-boundary pin (Round 2 reframe).
  • Phase 0b: LocalRefresh::new(view_material: ViewMaterial) constructor + flat-crate-root exports (R3 confirmation + ViewMaterial).
  • Phase 0c: reframed — unit-variant RefreshError (Cancelled / Io / MalformedScanResult; no payload). Orchestrator-side RefreshError retained with backward-compat content constructed orchestrator-side; no attacker-controlled trait payload.
  • Phase 0d: retired — R5 resolves by composition, not by deferral.
  • Phase 0e (new): RefreshDiagnostic enum + DiagnosticSink trait + produce_scan_result signature change (diagnostics: &dyn DiagnosticSink parameter). Stage 1 sinks: NoopDiagnosticSink, TracingDiagnosticSink.

  FOLLOWUPS amended. The previous Round 2 "extend checkpoint 3" V3.x FOLLOWUPS entry is withdrawn and replaced by the ReorgAmplificationDetector entry. Three new V3.x FOLLOWUPS entries added: PeerReputationActor (with §5.4.8 #1 / #2 / #3 mitigation pins binding on the implementation), RecoveryActor, and docs/design/REFRESH_DIAGNOSTIC_STREAM.md spec doc (seeded by PR 4's §5.4.7 R6 / §5.4.8 content; grows additively as consumers are designed).

  Trajectory after the reframe. Only Round 4 remains as PR-4-internal work (Phase 0 commit decomposition + §6 review checklist); PR 5's design rounds carry R1 forward with the snapshot-ID-pinning working hypothesis. The α-disposition's provisionally load-bearing status remains the re-evaluation gate.

  Meta-observation recorded. The reframe is the recurrence pattern named by 16-architectural-inheritance.mdc "the cost-benefit-defer-to-later anti-pattern" working against itself — Round 2's first pass defaulted to deferral and minimal-surface; the architectural-integrity-now answer was to lay the structural seam (one parameter, one enum, one trait) and defer only the consumer implementations. The compounded benefit is what 16-architectural-inheritance.mdc's "continuous discipline as inheritance prevention" framing predicts: the seam landed now removes the need for V3.x to re-litigate the trait surface.

  Doc-only; no Rust or C++ code touched.

• Stage 1 PR 4 — Round 2 dispositions: R2 / R3 / R4 / R5 / R6 / R7 settled. Same-day follow-up to the Round 1 review pass above. Round 2 closes all seven residuals named by Round 1 + the review pass; the more-carefully-specified-α frame is now closed and PR 4's design surface is Phase-0-ready.

  • R1 — PendingTxEngine::build during long refresh. Carried into PR 5's design rounds as the working hypothesis build-against-current-snapshot + snapshot-ID pinning — the reservation tracker carries a snapshot ID per reservation; the submit path becomes a CAS against current_snapshot == reservation.snapshot_id. Of the three sub-options, the only one that gives the reservation tracker monotone snapshot semantics + low-latency UI without serializing user input behind background work.
  • R2 — β internal-batching. Stays as the §2.2 "future scaling refinement" note; not promoted to FOLLOWUPS. The V3.0 bandwidth FOLLOWUP entry already names α's bandwidth cost; V3.0 RC stabilization profiles cold-sync; if β is the right remediation, promote then. Premature promotion overspecifies against alternatives (daemon-side prefix matching, view-tag pre-filter improvements, wallet-side prune-by-birthday).
  • R3 — RefreshOptions / RefreshProgress public-module promotion. Confirmation, not discovery: RefreshOptions, RefreshProgress, RefreshSummary, RefreshHandle, RefreshReorgEvent, RefreshPhase are already crate-publicly re-exported from shekyl_engine_core/src/lib.rs:25–30 at the flat crate root, matching the DaemonEngine / LedgerEngine convention. Stage 4's kameo actor implementor imports them as Stage 1 callers do today; no module promotion needed.
  • R4 — view-material flow to the producer (load-bearing). Disposition: (a-instance-scoped) — LocalRefresh::new(view_material: ViewMaterial). New public Zeroize + ZeroizeOnDrop type carrying { spend_pub, view_scalar, x25519_sk, ml_kem_dk, spend_secret } — exactly the fields build_scanner_from_keys extracts from &AllKeysBlob today. One Scanner held for LocalRefresh's lifetime; per-attempt cost drops to snapshot+daemon RPC (no scanner construction). Stage 4 actor mailbox carries no secrets. Wallet-lock semantics drop LocalRefresh and zeroize via the existing ZeroizeOnDrop chain. (c) split-producer/recoverer deferred to V3.x FOLLOWUPS with trigger "HW-wallet-backed signing or post-V3 threat- model refinement requires producer-side spend-key isolation." (b) per-call rejected (hostile to actor migration).
  • R5 — mid-scan reorg-abort at checkpoint 3. Deferred to V3.x FOLLOWUPS. The per-checkpoint-3-hit get_height RPC cost (~per-block; ~10K+/wallet-day in steady-state) is non-trivial; the reorg-amplification attack is mitigated at a higher layer by PR 1's DaemonEngine peer-rotation contract; the discipline-budget cost of extending §7's checkpoint discipline is non-trivial. Trigger for V3.x: "hostile-daemon work-amplification scenarios become measurable in V3.0 RC stabilization or post-genesis production telemetry."
  • R6 — RefreshError::ConcurrentMutation boundary + variant set. Promote the existing crate-internal ProduceError (engine/refresh.rs:202) to public RefreshEngineError; use it as RefreshEngine::Error: Into<RefreshError>. Variant set: Cancelled, Io(IoError), MalformedScanResult { reason: &'static str } — the existing name and bounded payload are kept; the user-proposed ScannerContractViolation { kind, evidence } rename declined for V3.0 since &'static str is the strictest possible memory-amplifier-mitigation bound. Excluded from producer trait error: ConcurrentMutation (orchestrator-internal merge-gate concern), AlreadyRunning (orchestrator-internal handle-racing concern), ReorgTooDeep (kept as Ok-with-rewind merge-layer detection per §1.5 actor-identity reasoning). The trait/orchestrator split is a Phase 0c spec amendment.
  • R7 — ScanResult atomicity-under-cancellation contract. Pinned in V3_ENGINE_TRAIT_BOUNDARIES.md §2.3 / §7 prose: a produce_scan_result call returns either a ScanResult covering the full span scanned, or RefreshError::Cancelled; no partial-span ScanResult. Already true in the existing implementation per the cancel checks at engine/refresh.rs:980 / :1140 / :1186; the contract pin prevents future drift.

  §4 Phase 0 finalized. Phase 0a: trait-surface contract pins (Send + Sync + 'static on R; Progress-channel trust boundary; ScanResult atomicity per R7; LedgerSnapshot value-typed contract; ViewMaterial type definition per R4). Phase 0b: LocalRefresh::new(view_material: ViewMaterial) constructor + flat-crate-root export of ViewMaterial. Phase 0c: RefreshEngineError promotion per R6. Phase 0d: retired (R5 deferred).

  Two new V3.x FOLLOWUPS entries in docs/FOLLOWUPS.md: R5 mid-scan reorg-abort deferral; R4 (c) split-producer/recoverer deferral. Both have named triggers per 15-deletion-and-debt.mdc.

  Trajectory after Round 2. Only Round 4 remains as PR-4-internal work (Phase 0 commit decomposition + §6 review checklist). PR 5's design rounds carry R1 forward with the snapshot-ID-pinning working hypothesis. The α-disposition's provisionally load-bearing status remains the re-evaluation gate: if PR 5's R1 resolution requires γ for correctness, PR 4 re-opens; otherwise PR 4 advances directly to Round 4.

  Doc-only; no Rust or C++ code touched.

Fixed

• CI bench gate no longer false-fails on baseline=0 capture anomalies; the anomaly is surfaced as informational rather than silenced. Discovered on PR #34: the bench-baseline branch's most-recent refresh (from dev-tip 647f82d5) recorded instructions=0 for six hot_path_bench_ledger_postcard_* entries that the prior nine baselines measured at ~4.4M / 44M / 444M instructions each, with no causal code change between snapshots and iai-callgrind's own run summary embedded in baseline.iai.snapshot reporting 6 without regressions; 0 regressed; 6 benchmarks finished — the capture ran to completion. Cause is unknown (runner-image drift, iai-callgrind-runner version skew, build-flag drift, or a transient anomaly in the measurement layer are all candidates); investigation lives on chore/investigate-bench-baseline-flake-2026-05-09. scripts/bench/compare.py now routes (base_val == 0 && pr_val != 0) into a distinct baseline_zero bucket — informational, not gating — that preserves the PR-side measurement for diagnosis. scripts/bench/post_comment.py renders the bucket under its own header line ("Baseline anomaly (informational, not gated)") and table rows with a _baseline=0_ verdict badge distinct from ok / FAIL / added / missing, so the anomaly surfaces to reviewers rather than being silently masked under the "new in PR" label. The post-merge update-baseline job re-captures from the next push to dev; if the next refresh produces real numbers the anomaly was transient and self-heals, if zeros persist the investigation branch has a fresh signal. Regression guards: real regressions still trip fail (validated with a +39% hot_path fixture); the (base=0, pr=0) edge case is preserved as a 0% delta ok rather than getting routed away. Lock-down: scripts/bench/test_compare.py pins the routing logic with four regression tests (baseline-zero-bucket, real-regression-still-fails, both-zero-stays-ok, added-in-pr-distinct-from-baseline-zero); stdlib-only, runs via python3 scripts/bench/test_compare.py.

• Bench-capture producer guard rejects instructions=0 rows at source so the anomaly cannot reach bench-baseline again. Paired defense-in-depth with the consumer-side baseline_zero bucket (above): the consumer routes around already-corrupted baseline data; the producer prevents new corruption from being written. Implemented in scripts/bench/capture_rust_baseline.sh inside the JSON-assembly heredoc, post-parse / pre-write: any iai entry with metrics.instructions == 0 causes the script to exit 2 with a structured error that lists the offending (crate, bench_target, group, function, run_id) tuples and points operators at docs/investigation/2026-05-09-bench-baseline-flake.md. The canonical shekyl_rust_v0.json is not written when the guard trips, so the prior good bench-baseline content is preserved across both pipeline arms — update-baseline (push to dev) and capture-pr (per-PR baseline). The raw stdout snapshot at shekyl_rust_v0.iai.snapshot is still written unconditionally as bisection evidence, and a diagnostic side-file at shekyl_rust_v0.json.flake.json carries the parsed envelope plus a flake block enumerating the zero entries — investigators can gh run download-style fetch it without re-running the harness. Bypass: SHEKYL_BENCH_ALLOW_ZERO=1 skips the check with a loud WARNING line for local debugging of the capture-zero phenomenon itself; CI workflows must not set this. Validated with three smoke-tests against the heredoc body in isolation: mixed-healthy-and-zero rejects with exit 2 and writes only the flake side-file; bypass env var allows write-through with the warning; clean capture flows normally with no flake side-file. The guard's error message frames a workflow rerun as the expected operator response, matching the empirically observed flake rate (the same runner class typically produces a healthy capture on retry).

• account_base::generate(...) no longer hardcodes FAKECHAIN; the legacy 3-arg overload is deleted entirely and every caller spells its network out explicitly. Pre-fix, the 3-arg account_base::generate(recovery_key, recover, two_random) overload (with default args secret_key{} / false / false) hardcoded DerivationNetwork::Fakechain as the raw-seed derivation salt regardless of the wallet's actual network_type. Three production callers reached it via the implicit FAKECHAIN default: wallet2::generate(name, password, recovery, recover, ...) (the CLI / RPC wallet-creation and recovery entry), wallet2's 0-change dummy-destination address generator (transfer_selected_rct), and wallet_rpc_server::on_stop_background_sync's seed-recovery path. On TESTNET, every from-seed wallet creation produced a FAKECHAIN-salted account that failed wallet2::load's rederive (which uses m_nettype, not FAKECHAIN). On MAINNET / STAGENET, the call was doubly broken: the FAKECHAIN-derived keys disagreed with the rederive salt, and RAW32 isn't a permitted seed format on those networks anyway. This footgun was masked for the entire window during which Bug 1's off-by-one was preventing any wallet from loading. Bug 4-adjacent in the 2026-05-05 FFI constant- drift audit.

  Fix: the new account_base::generate(recovery_key, recover, two_random, network_type nettype) overload threads the caller's network through generate_from_raw_seed, and is now the only generate(...) overload — the legacy 3-arg form is deleted entirely. wallet2::generate(...) and wallet_rpc_server::on_stop_background_sync migrated to pass m_nettype / m_wallet->nettype(). The 0-change dummy- destination caller in wallet2::transfer_selected_rct migrated to the same 4-arg form with cryptonote::FAKECHAIN hardcoded — it's a transient one-shot whose secret keys are discarded; properly network-matching the dummy address requires a BIP-39 path on MAINNET / STAGENET (RAW32 isn't permitted there) and is filed under FOLLOWUPS V3.2. All 28 test callers across tests/{unit_tests,core_tests,performance_tests,trezor, functional_tests,wallet_bench} migrated to pass cryptonote::FAKECHAIN explicitly. The structural deletion eliminates the "one omitted argument away from FAKECHAIN" footgun class entirely — there is no longer a generate(...) overload that can pick a network silently.

  Failure-mode change: on MAINNET / STAGENET, every wallet2-routed raw-seed creation path now throws cleanly via the FFI's permitted_seed_format check instead of silently producing FAKECHAIN-salted unspendable wallets. The throw scope is wider than just the recovery path: wallet_rpc_server::on_create_wallet (fresh CSPRNG-seed wallet creation) and wallet2_ffi::create (FFI wallet creation) also throw on MAINNET / STAGENET. Both paths were already silently broken pre-fix — the post-fix behaviour is a strict improvement (fail-loud over fail-silent), but neither becomes a finished feature: fresh-seed wallet creation on MAINNET / STAGENET via wallet2 simply does not work by design until the wallet2 BIP-39 entry point lands (Bug 4 in the audit, deferred per the Rust wallet migration). On TESTNET / FAKECHAIN, every migrated caller produces correctly- network-salted accounts that round-trip through wallet2::load.

  New regression test: tests/unit_tests/account.cpp :: generate_uses_explicit_nettype_argument pins (a) generate(..., TESTNET) matches generate_from_raw_seed(..., TESTNET), (b) generate(..., FAKECHAIN) produces a distinct account (different HKDF salt), and (c) generate(..., MAINNET / STAGENET) throws for both recover=true (recovery) and recover=false (fresh CSPRNG seed). See docs/audit_trail/2026-05-ffi-constant-drift-audit.md Bug 4-adjacent.

• FCMP_REFERENCE_BLOCK_MIN_AGE aligned to consensus authority (5). rust/shekyl-engine-core/src/multisig/v31/intent.rs defined FCMP_REFERENCE_BLOCK_MIN_AGE = 10 while src/cryptonote_config.h defines it as 5 (locked by Decision 14 in commit 6561278d9, asserted by tests/unit_tests/fcmp.cpp:668, documented in docs/FCMP_PLUS_PLUS.md:432). The Rust multisig SpendIntent was added in 744ab6407 23 days after Decision 14 and copied the pre-Decision-14 value 10. Bug 3 of the 2026-05-05 FFI constant-drift audit. Failure mode: a multisig wallet would reject reference blocks at heights tip-9..tip-5 that the daemon consensus accepts — fail-closed at the wallet's own pre-broadcast validation, no path to silent acceptance, but still a real bug (UX: legitimate intents rejected by the proposer's own check). Fixed by aligning the Rust value to 5, with a doc-comment that cross-references the C++ authority and the audit. Test validate_temporal_rejects_ref_block_too_fresh updated to use tip = 903 (age = 3) instead of tip = 905 (age = 5, which was the boundary value that masked the regression — age = 5 is not < 5). docs/SHEKYL_MULTISIG_WIRE_FORMAT.md aligned. The chore/cbindgen-consensus-constants follow-up generates this value from the Rust authority into the C++ build to prevent recurrence. See docs/audit_trail/2026-05-ffi-constant-drift-audit.md.

• C++/Rust FFI constant disagreement broke every wallet round-trip on every network. src/shekyl/shekyl_ffi.h defined SHEKYL_CLASSICAL_ADDRESS_BYTES = 64 while authoritative rust/shekyl-crypto-pq/src/account.rs::CLASSICAL_ADDRESS_BYTES = 1 + 32 + 32 = 65. Because ShekylAllKeysBlob is #[repr(C)] with byte-aligned [u8; N] arrays, the 1-byte deficit shifted every later field's offset by one. C++ populate_account_from_blob read spend_sk and view_sk from the wrong bytes; the resulting non-canonical Ed25519 scalars failed sc_check inside secret_key_to_public_key, so verify_keys returned false and every wallet2::load threw error::wallet_files_doesnt_correspond. Header constant set to 65. Bug 1 of 2 surfaced by wallet_storage.{store_to_mem2file, change_password_mem2file}. See docs/audit_trail/2026-05-ffi-constant-drift-audit.md.

• C++/Rust FFI constant disagreement caused every RAW32 wallet to silently mis-encode its seed_format byte. src/shekyl/shekyl_ffi.h defined SHEKYL_SEED_FORMAT_BIP39 = 0 / _RAW32 = 1 while authoritative rust/shekyl-crypto-pq/src/account.rs defines SEED_FORMAT_BIP39 = 0x01 / SEED_FORMAT_RAW32 = 0x02 (with 0 reserved for "unset"). C++ wrote m_seed_format = 1 to disk meaning RAW32; on wallet2::load, the FFI received seed_format = 1 and Rust decoded it as Bip39; permitted_seed_format(Fakechain, Bip39) returned false; the rederive returned false with "(network, seed_format) pair disallowed or derivation inconsistent". The BIP-39 path was equally broken (both sides held 0, which Rust rejected as "unset") but had no test exercising it at the C++/FFI layer — the bug went undetected for the entire window during which Bug 1 was masking it. Header constants set to 1 / 2. Bug 2 of 2. Pre-V3 launch: no on-disk wallets exist, so no migration code is required. See docs/audit_trail/2026-05-ffi-constant-drift-audit.md.

• wallet_storage round-trip tests now construct wallet2 with cryptonote::FAKECHAIN. wallet2::generate(name, password) routes through the legacy account_base::generate() test wrapper, which hardcodes FAKECHAIN for raw-seed derivation regardless of the wallet's m_nettype. The default-constructed wallet2 inherited MAINNET, so the rederive on load passed MAINNET, which doesn't permit RAW32. Tests now use tools::wallet2 w(cryptonote::FAKECHAIN, 1, true) to keep the in-memory derivation network and the on-disk rederive network aligned. The same hardcoded-FAKECHAIN footgun in account_base::generate()'s callers (the wallet2::generate("", password) test path and wallet_rpc_server::stop_background_sync) is the Bug 4-adjacent finding in docs/audit_trail/2026-05-ffi-constant-drift-audit.md, slated for the sibling branch fix/legacy-account-generate-network-guard.

Performance

• Refresh post-pass cost drops from O(n × B) to O(k × B). The engine post-pass at shekyl-engine-core::engine::merge::populate_engine_handle_fields previously scanned the full ledger.transfers Vec on every Engine::apply_scan_result invocation, even though only result.new_transfers.len() entries can match the residue map. At a 100k-transfer ledger refreshed across 1k batches with k≈10 new transfers per batch, the post-pass alone executed ~10⁸ HashMap probes against residue that found nothing — ~5 s of refresh-time wallclock. The merge pipeline now threads the inserted-index list out of LedgerIndexes::ingest_block (now Range<usize>), through LedgerIndexesExt::process_scanned_outputs (now Range<usize>) and apply_scan_result_to_state (now Result<Vec<usize>, RefreshError>); the post-pass walks only the freshly-merged indices. Trait-impl wrappers (LocalLedger::apply_scan_result, EngineFixture::apply_scan_result) discard the Vec via .map(|_| ()) so the orchestrator-public surface is unchanged. Closes the FOLLOWUPS V3.0 entry "populate_engine_handle_fields O(n) → O(k) per scan". Pre-flight: docs/design/PERF_MERGE_INSERTION_INDICES_PREFLIGHT.md.

Removed

• Monero-era keys-file fixtures and unconditionally-skipped wallet_storage tests deleted. The tests/data/wallet_00fd416a* and tests/data/wallet_9svHk1* fixtures were inherited from upstream Monero and predate the SHKW1 master-seed envelope entirely; they cannot be loaded under any version of the v3-from-genesis keystore. The three tests that referenced them (wallet_storage.{store_to_file2file, change_password_same_file, change_password_different_file}) had been gated behind GTEST_SKIP() for that reason and were providing zero coverage. Per .cursor/rules/15-deletion-and-debt.mdc's "default: delete": 4 fixture files (~2.3 MB) and 3 skipped tests removed.

Added

• Rust-internal FFI constant equality-assertion tests (rust/shekyl-ffi/src/account_ffi.rs::tests). ffi_classical_address_bytes_matches_rust_authority and ffi_seed_format_constants_match_rust_authority pin the FFI re-exports to the authoritative rust/shekyl-crypto-pq/src/account.rs constants. Scope (honest): these tests compare two Rust-side values; they do not read src/shekyl/shekyl_ffi.h. A hand-edit to the C++ #define alone — the exact drift that produced Bugs 1 and 2 — would still leave them green. They catch a different and narrower bug class: divergence introduced inside the Rust workspace between authoritative and re-exported constants, before the C++ build runs. Cross-boundary detection (catching C++-side drift) is the explicit job of the reduced-scope generator in the sibling branch chore/cbindgen-consensus-constants, which generates a header from the Rust constants for RCTTypeFcmpPlusPlusPqc, FCMP_REFERENCE_BLOCK_*_AGE, and ADDRESS_VERSION_V1. Full migration of the remaining ~40 fail-closed-on-misuse constants is filed as FOLLOWUPS V3.0 (target pre-audit-final).

• tests/unit_tests/account.cpp — BIP-39 + MAINNET coverage. Four new tests close the only path Bug 2 broke that the existing test surface didn't exercise: rederive_from_bip39_reproduces_account_mainnet (full BIP-39 derive + rederive round-trip via account_base), bip39_passphrase_changes_account_mainnet (passphrase isolation), generate_from_bip39_rejects_fakechain_and_testnet, generate_from_raw_seed_rejects_mainnet_and_stagenet, rederive_from_bip39_reproduces_account_stagenet, and rederive_from_raw_seed_reproduces_account_testnet (consensus-level (network, format) matrix invariants). The wallet2-level BIP-39 entry point that would let the test use the production API end-to-end does not exist by design — see Bug 4 below.

• CI tripwire defending the wallet2::generate_from_bip39 absence (tests/unit_tests/wallet_storage.cpp). Three SFINAE detectors + one combined static_assert that fires at build time if a future contributor adds wallet2::generate_from_bip39 with any of the three most plausible signatures ((std::string&, std::string&, network_type), (epee::wipeable_string&, epee::wipeable_string&, network_type), or (std::string&, network_type) — the defaulted-passphrase shorthand). The honest scope: an exotic signature could still slip past the detectors, so the load-bearing artifact remains the FOLLOWUPS architectural decision, not the tripwire itself. Includes per-detector positive-control self-tests (tripwire_self_test::synthetic_has_member_*) so a refactor that breaks any detector fails its own assertion rather than silently letting the negative one pass for the wrong reason. Tripwire deletes itself with wallet2.cpp at Phase 5 of the Rust rewrite. Architectural decision recorded in docs/FOLLOWUPS.md §"V3.1+ Legacy C++ → Rust rewrite scope". See docs/audit_trail/2026-05-ffi-constant-drift-audit.md Bug 4.

• Cross-reference comment in shekyl-crypto-pq::tests::generate_from_bip39_mainnet_roundtrips_to_rederive. Identifies the Rust test as the primary functional guarantee for BIP-39 wallet creation on Mainnet and points forward at the C++ tripwire and the FOLLOWUPS architectural-decision entry. A future investigator asking "where is BIP-39 wallet creation tested?" finds the answer here, not in C++.

• docs/audit_trail/2026-05-ffi-constant-drift-audit.md — one-page audit record. Documents the wallet_storage failure trace, the Bug 1 / Bug 2 / Bug 3 / Bug 4 findings, the 43 constants confirmed aligned, and the prevention work pattern (per-PR equality assertions in this branch, reduced-scope generated header in the cbindgen sibling, full migration in V3.0). Audit-quality artifact for the August external review.

• AllKeysBlob and KeyImage typed-wrapper sweep (between Stage 1 PR 3 M3a and M3b; short-lived sweep branch off the M3a PR head per docs/completed/STAGE_1_PR_3_MIGRATION_PLAN.md §3 "Landing notes (M3a closed)"). Closes the deferred-from-M3a typed-wrapper migration that the M3a ViewSecret work pre-announced in shekyl-crypto-pq::keys's "near-term workstream" docstring. Three new newtypes plus two API extensions, no consensus or wire format changes (every wrapper is #[repr(transparent)]; serde formats use #[serde(transparent)]).

  shekyl-crypto-pq::keys newtypes:

  • SpendSecret — secret-bearing scalar mirroring ViewSecret's discipline exactly: #[repr(transparent)], Clone + Zeroize + ZeroizeOnDrop, no Copy, no Debug, pub(crate) fn from_bytes, as_canonical_bytes() accessor for raw-byte consumers at the boundary.
  • SpendPublicKey / ViewPublicKey — public-key identity values: Copy + PartialEq + Eq + Hash + PartialOrd + Ord + Zeroize for use as registry keys (LocalKeys's HashMap<SpendPublicKey, SubaddressIndex> reverse-lookup registry); manual truncated Debug matching KeyImage's privacy-correlation discipline (first two bytes only); pub fn from_canonical_bytes constructor — engine boundaries outside this crate (shekyl-engine-core::engine::local_keys::derive_subaddress) are legitimate construction sites, mirroring KeyImage's pattern. No ZeroizeOnDrop because that conflicts with Copy (Rust trait coherence rule); the surrounding AllKeysBlob::drop clears these public fields explicitly via .zeroize() for the same uniform- write-pattern reason raw [u8; 32] fields had.

  AllKeysBlob field migration:

  • spend_pk: [u8; 32] → spend_pk: SpendPublicKey
  • view_pk: [u8; 32] → view_pk: ViewPublicKey
  • spend_sk: [u8; 32] → spend_sk: SpendSecret
  • view_sk: ViewSecret (already typed in M3a Commit 2; unchanged)

  The Drop implementation simplifies: spend_sk and view_sk now wipe via field-drop-glue (ZeroizeOnDrop), only public-key + composite fields remain in the manual zeroization block. The #[repr(transparent)] invariant continues to be asserted by shekyl-ffi's size_of::<...>() test against ShekylAllKeysBlob.

  shekyl-crypto-pq::key_image::KeyImage API extensions:

  • Now derives Zeroize, Serialize, Deserialize, with #[serde(transparent)]. Wire format remains byte-identical to [u8; 32].
  • Zeroize (without ZeroizeOnDrop, which would conflict with Copy) lets containers that hold a KeyImage alongside genuinely- secret material (shekyl_engine_state::TransferDetails, shekyl_scanner::RecoveredWalletOutput) wipe every field on Drop for uniform-write-pattern hygiene — the same Copy + Zeroize pairing the new public-key newtypes use. The manual Debug and absence-of-Display privacy discipline is unchanged.

  KeyImage call-site sweep across the workspace:

  • shekyl-engine-state::TransferDetails.key_image: Option<[u8; 32]> → Option<KeyImage>. The on-disk and postcard-schema layouts are preserved by KeyImage's #[serde(transparent)]. TransferDetails::zeroize continues to wipe the field; Zeroize on KeyImage removes the special-case Option-then-bytes accessor previously needed at the wipe site.
  • shekyl-engine-state::LedgerIndexes.key_images: HashMap<[u8; 32], usize> → HashMap<KeyImage, usize>. Method signatures on mark_spent, unmark_spent, detect_spends, set_key_image, freeze_by_key_image, thaw_by_key_image updated to take &KeyImage / KeyImage / &[KeyImage]. The [0u8; 32] filter on rebuild/ingest is removed: the runtime-scanner path always produces a real key image, and Option<KeyImage> already encodes "not yet computed" — sentinel-byte gating was redundant in the on-disk path. (See FOLLOWUPS for the matching deferred promotion of RecoveredWalletOutput.key_image to Option<KeyImage> in V3.1.)
  • shekyl-scanner::RecoveredWalletOutput.key_image: [u8; 32] → KeyImage with #[zeroize(skip)]. The boundary in ledger_ext.rs retains a [0u8; 32] test-fixture filter so RecoveredWalletOutput::new_for_test's zero placeholder maps to td.key_image = None (preserving the offline-derivation / set_key_image fill-in semantics view-only wallets rely on); a FOLLOWUPS V3.1 entry tracks promoting the field itself to Option<KeyImage> and deleting the boundary filter.
  • shekyl-engine-core::scan::KeyImageObserved.key_image: [u8; 32] → KeyImage. Constructor sites in refresh.rs's per-block input-walk wrap raw bytes via KeyImage::from_canonical_bytes.
  • shekyl-proofs::reserve_proof::{ReserveOutputEntry, VerifiedReserveOutput}.key_image: [u8; 32] → KeyImage. The 192-byte per-output wire layout is unchanged — the proof's write_per_output consumes via key_image.as_bytes() and the verifier wraps the on-wire bytes back into KeyImage at the return boundary.
  • shekyl-engine-core::multisig::v31::prover::ProverInputProof.key_image: [u8; 32] → KeyImage. signable_bytes() consumes via key_image.as_bytes(); serde wire format unchanged.
  • shekyl-engine-core::multisig::v31::counter_proof::CounterProof.consumed_inputs: Vec<[u8; 32]> → Vec<KeyImage>; CounterProofChainView::is_tracked_unspent signature updated to take &KeyImage.
  • shekyl-engine-core::engine::traits::key::SubaddressKeyPair: spend_pk / view_pk typed as SpendPublicKey / ViewPublicKey.
  • shekyl-engine-rpc::handlers::parse_key_image: now returns KeyImage (constructor site at the wallet-RPC boundary).
  • All [u8; 32] test fixtures across shekyl-engine-state, shekyl-engine-core (including bench fixtures and adversarial multisig tests), and shekyl-scanner updated to construct KeyImage::from_canonical_bytes(...) explicitly.

  Cascade closure (verify API + tests). Final pass on the cascade — the public verifier surface and the last test-helper seams:

  • shekyl-fcmp::proof::verify: key_images: &[[u8; 32]] → &[KeyImage]. pseudo_outs: &[[u8; 32]] stays raw — pseudo- output commitments are a different concept, and the type-system protection is specifically for the key-image slot. The verifier consumes typed inputs via .as_bytes() exactly once at the point where the function downcasts to the upstream FCMP++ library's byte-shaped API. New shekyl-fcmp regular dependency on shekyl-crypto-pq (cycle-free: shekyl-crypto-pq references shekyl-fcmp only as a [dev-dependencies] entry). The type is re-exported as pub use shekyl_crypto_pq::key_image::KeyImage from shekyl-fcmp::proof so callers (fuzz harnesses) can name it without taking a direct dep.
  • shekyl-ffi::lib's shekyl_fcmp_verify marshaling: rebuilds Vec<KeyImage> via KeyImage::from_canonical_bytes from the C-supplied *const u8 buffer; pseudo_outs marshaling is unchanged.
  • shekyl-fcmp fuzz targets (fuzz_tx_deserialize_fcmp_type7, fuzz_fcmp_proof_deserialize) updated their key-image generators to Vec<KeyImage> since they call verify directly.
  • shekyl-engine-core::engine::refresh::tests::make_block_with_spending_tx: key_image: [u8; 32] → key_image: KeyImage; the typed value is unwrapped via .as_bytes() exactly once at the Input::ToKey { key_image: CompressedPoint(...) } construction site (the on-wire CompressedPoint is the raw-byte boundary).
  • shekyl-ffi/tests/signing_round_trip::ScannedSecrets.key_image: intentionally remains [u8; 32]. This is a C-ABI scratch buffer: shekyl_scan_and_recover writes via key_image.as_mut_ptr() and the bytes are re-handed to a later FFI call via .as_ptr(). The C ABI is the authoritative raw- byte boundary on both sides; wrapping in KeyImage here would inject from_canonical_bytes / as_bytes shuffles at every seam without adding type protection. A doc-comment on the struct records the rationale.

  Property-delivery framing. This sweep is structural — no consensus rule, no wire format, no FFI layout changes. The type-system protection is the deliverable: every secret-bearing 32-byte field and every per-output KeyImage field now refuses accidental cross-wiring through Rust's nominal type system, which is what M3d's "secrets confined to engine" property is later going to lean on. M3a alone landed ViewSecret and the KeyEngine trait; this sweep extends the typed-wrapper coverage to every remaining call site so M3b–M3e don't have to revisit the same surface.

• Monero-reference rename for Shekyl-genesis primitives (sweep branch follow-on; analogous to M3a Commit 5's classical-Monero → classical Edwards-curve rename per 60-no-monero-legacy.mdc). Three call sites in Shekyl-first crates framed Shekyl-genesis-locked primitives as Monero-side artifacts; reframed to put Shekyl primary, with the upstream/CryptoNote provenance noted as context rather than ownership.

  • rust/shekyl-ffi/Cargo.toml description: "FFI bridge between C++ Monero core and Rust modules" → "FFI bridge between Shekyl's C++ core and Shekyl's Rust crates". The C++ daemon is Shekyl's (forked-and-renamed); the FFI does not bridge to upstream Monero.
  • rust/shekyl-crypto-pq/src/derivation.rs test-helper varint comment: // Monero varint encoding → "Shekyl wire varint (7-bit continuation, CryptoNote-style; same shape as upstream Monero's varint, but Shekyl-genesis-locked)". The varint format is the standard 7-bit-continuation shape inherited from CryptoNote, not a Monero-specific construct.
  • rust/shekyl-crypto-hash/src/lib.rs module doc-comment: Keccak-256 hashing matching Monero/Shekyl's cn_fast_hash → Keccak-256 hashing for Shekyl's cn_fast_hash primitive (byte-identical to upstream Monero's; that compatibility is incidental to the genesis-locked Shekyl spec, not a Monero-compatibility requirement).

  Out of scope: legitimate provenance pointers (monero-oxide's hash_to_point, fork-attribution license headers in shekyl-scanner, "Monero mainnet" empirical comparisons, 60-no-monero-legacy.mdc exclusion notices documenting what Shekyl deliberately rejects from Monero) are preserved as-is — those describe the fork relationship correctly. The earlier M3a Commit 5 sweep cleared the design-doc misframings; this pass closes the remaining Rust-side residue.

• KeyEngine trait surface and LocalKeys in-process implementor introduced (Stage 1 PR 3 — M3a; the third trait-boundaries PR per docs/V3_ENGINE_TRAIT_BOUNDARIES.md §2.3). The M3a slice of the five-PR Stage-1 PR 3 migration (M3a–M3e per docs/completed/STAGE_1_PR_3_MIGRATION_PLAN.md §3) lands as pub(crate) on shekyl-engine-core. M3a is the architectural foundation against which the "secrets confined to engine" structural property activates at M3d's merge; M3a itself delivers no user-visible behavior change. The trait owns AllKeysBlob privately and exposes a workflow-shape surface (no per-output secret material crosses the trait boundary).

  • pub(crate) trait KeyEngine in engine::traits::key. Four workflow-shaped methods per docs/completed/STAGE_1_PR_3_KEY_ENGINE.md §4: account_public_address(&self) -> &AccountPublicAddress (sync borrowed read); derive_subaddress(&self, idx, purpose) -> Result<SubaddressFor, Self::Error> (sync, two purposes — Audit returns the classical Edwards-curve (spend_pk, view_pk) pair, Recipient returns the encoded address + hybrid KEM PK pair); try_claim_output(&self, input) -> impl Future<Output = Result<OutputClaimResult, Self::Error>> + Send (async; bundles X25519 view-tag pre-filter, hybrid decap, HKDF chain, key-image computation, deterministic OutputHandle derivation behind a single trait boundary); sign_transaction(&self, tx) -> impl Future<Output = Result<TxSignatures, Self::Error>> + Send (async; resolves per-input handles to per-output spending material and produces hybrid signatures + FCMP++ witnesses). The associated type Error: Into<KeyEngineError> lets orchestration code propagate uniform errors regardless of implementor.
  • pub(crate) struct LocalKeys in engine::local_keys. Owns AllKeysBlob privately; caches AccountPublicAddress and pre-computes (view_scalar, spend_public) cryptographic forms at construction; guards a reverse-lookup subaddress registry under RwLock (the LocalLedger precedent for &self async with synchronous interior mutation). Real implementations of account_public_address, derive_subaddress(_, Audit), and try_claim_output; named-infrastructure-gap stubs for derive_subaddress(_, Recipient) and sign_transaction. Constructors: from_keys_blob(keys, network) (production) and #[cfg(test)] from_test_seed(seed) (raw32 testnet derivation for unit/integration fixtures); 11 tests cover cached-address stability, audit-derivation determinism, recipient-stub validation, claim happy path, deterministic- handle property, varying tx_hash, other-wallet rejection, unregistered-subaddress rejection, register-then-claim sequence, and sign_transaction stub validation.
  • Two named-infrastructure-gap KeyEngineError variants: RecipientSubaddressKemKeygenNotImplemented (per-subaddress hybrid X25519+ML-KEM-768 keygen, shekyl_crypto_pq::subaddress::derive_subaddress_kem_keypair, is unbuilt; lands per docs/completed/STAGE_1_PR_3_KEY_ENGINE.md §6.4 / §3.1.3) and SignTransactionTraitSurfaceIncomplete (TxToSign's public-on-chain per-input data and FCMP++ tree-branch context are PR-5-pinned forward-declared; the bridge to shekyl_tx_builder::sign_transaction lands when the PendingTxEngine PR finalizes the shape). Both variants are #[non_exhaustive]-shaped accretions; existing call sites stay source-compatible as the surface evolves.
  • OutputHandle newtype + derive_output_handle in shekyl_crypto_pq::handle. 16-byte opaque reference deterministically derived via cSHAKE256 over view_secret || tx_hash || output_index_le8 with customization "shekyl/output-handle-v1" per docs/completed/STAGE_1_PR_3_KEY_ENGINE.md §7.12. The deterministic-handle pathway (Round 4 pre-flight closure of §7.11=(3)) replaces the originally-considered cached HandleTable data structure: re-derivation at spend time is cheap (one cSHAKE256 invocation) and dissolves the A6 (memory pressure) and Pattern-5 (concurrent-access) Round-3 attack-surface clusters by construction. Reference vectors locked in the module's test substrate.
  • KeyImage newtype in shekyl_crypto_pq::key_image. 32-byte canonical compressed Ed25519 encoding of I = x · H_p(O); the per-output public on-chain double-spend identifier. Carries the same privacy-correlation discipline as OutputHandle (truncated Debug exposing the first two bytes only; no Display; no Zeroize because key images are publicly derivable from on-chain data). Per .cursor/rules/18-type-placement.mdc, KeyImage is transform-shaped — defined by its derivation function — so it lives with the function rather than with any state-shaped consumer that happens to store it.
  • ViewSecret newtype in shekyl_crypto_pq::keys. #[repr(transparent)] 32-byte wrapper preserving the bit-for-bit FFI layout invariant with shekyl_ffi::ShekylAllKeysBlob.view_sk: [u8; 32]. Manual truncated Debug; structural ZeroizeOnDrop. Wraps AllKeysBlob::view_sk; downstream call sites consume the canonical bytes via .as_canonical_bytes(). The remaining AllKeysBlob typed-wrapper migration (spend_sk → SpendSecret, view_pk → ViewPublicKey, spend_pk → SpendPublicKey) lands as a separate short-lived branch between M3a and M3b.
  • Subaddress derivation primitives relocated to shekyl_crypto_pq::subaddress. Classical Edwards-curve subaddress_derivation_scalar and subaddress_keys (formerly methods on shekyl_scanner::ViewPair) move to a dedicated module per the path-stateless discipline (extension to the stateless-actor framing): paths from trait surface to cryptographic primitive must be stateless end-to-end, not just at their endpoints. The module is positioned to also house the future derive_subaddress_kem_keypair (per-subaddress hybrid X25519
    • ML-KEM-768 keygen, §6.4) when its infrastructure lands — the canonical home for all Shekyl subaddress derivation. ViewPair::subaddress_keys is preserved as a thin call- through; ViewPair::subaddress_derivation was deleted (no live caller after the relocation, per .cursor/rules/15-deletion-and-debt.mdc). SubaddressIndex::to_canonical_bytes accessor and the PRIMARY constant added to shekyl_engine_state::SubaddressIndex per .cursor/rules/18-type-placement.mdc: state-shaped types whose serialization is cryptographically load-bearing carry a single canonical-bytes accessor at the type definition; the cryptographic functions take pre-converted bytes rather than the typed index.
  • SourceSecretsBundle transitional contract type in engine::traits::key. Documents the per-input secret material KeyEngine::sign_transaction needs — (spend_key_x, spend_key_y, commitment_mask, combined_ss, output_index), each Zeroizing-wrapped — independent of where the secrets originate. The bundle's shape is stable across the migration (M3a populates from TransferDetails's legacy fields; M3b+ derives internally from (view_secret, source_ciphertext, output_index)); only the source evolves. Localizing the M3b churn to bundle-population sites (rather than across the trait surface and every implementor) is the load-bearing property of this transitional field.

  Property-delivery framing: M3a alone does not activate the "secrets confined to engine" property — TransferDetails still carries its 5 secret-bearing fields, and the bridge reads from them transitionally. The property activates at M3d's merge per docs/completed/STAGE_1_PR_3_MIGRATION_PLAN.md §4.1, when those fields are deleted. M3a is what makes the activation possible: the KeyEngine trait is the boundary the property eventually attaches to, and the deterministic OutputHandle is the stateless-shape that replaces a per-call handle table by re-deriving spending material at spend time.

  Post-merge fix-ups against the M3a PR's review feedback (PR #32 Copilot review, landed before merge):

  • Redacted Debug on secret-bearing message shapes. SourceSecretsBundle, TxInputSigningContext, and TxToSign each now carry a manual Debug impl (no derive(Debug)) redacting the four Zeroizing<…> secret fields under [REDACTED]. Per 35-secure-memory.mdc, Zeroizing<T>: Debug delegates to T: Debug, so deriving Debug on a secret-bearing struct prints raw secret bytes through tracing fields, panic backtraces, or dbg!() calls. Three new sentinel-byte tests in engine::traits::key::tests pin the redaction.
  • PRIMARY special-cased in derive_subaddress(_, Audit). The encoded primary address packs the wallet's base keys (spend_pk = D, view_pk = a*G) into classical_address_bytes directly, and the reverse-lookup registry pre-registers keys.spend_pk against SubaddressIndex::PRIMARY. The trait method previously routed PRIMARY through subaddress_keys, returning (D + m_0*G, a*(D + m_0*G)) — a different point that matched neither the encoded address nor the registry. Special- casing idx.is_primary() to return the base account keys aligns the trait with the encoded address; for idx >= 1, the per-index derivation is unchanged. New derive_subaddress_primary_audit_returns_base_account_keys test pins the contract; docstrings on shekyl_engine_state::SubaddressIndex, shekyl_crypto_pq::subaddress, and the subaddress_keys primitive itself updated to spell out the special-case truth.
  • Hard-coded pinned vector for subaddress_derivation_scalar. The prior derivation_scalar_pinned_vector test re-ran the same keccak256_to_scalar primitive on both sides of the equality, so any drift inside that primitive flowed through both arms. Replaced with a true known-answer test (32-byte expected vector hard-coded for (view = 0x0102_0304_0506_0708, idx = 1)) plus a renamed formula-lock companion test that retains the prior coverage. The pair fails in different classes of regression and pins both the spec output bytes and the implementation composition.
  • Type-placement rule corrected. .cursor/rules/18-type-placement.mdc named SubaddressIndex's home as shekyl-engine-core (twice); the type actually lives in shekyl-engine-state. Updated.

• LedgerEngine trait extracted; Engine<S, D> parameterized over L: LedgerEngine with default LocalLedger (Stage 1 PR 2, the second trait-boundaries PR per docs/V3_ENGINE_TRAIT_BOUNDARIES.md §2.2). The Phase 2a LedgerEngine slice of the Stage 1 trait-extraction work lands as pub(crate) on shekyl-engine-core. The PR's primary surface — the LedgerEngine trait, the LocalLedger aggregate, and the Engine<S, D, L> / OpenedEngine<S, D, L> parameterization. The new type parameters carry default arguments (D = DaemonClient, L = LocalLedger) so non-test consumers continue to name Engine<S> / OpenedEngine<S> exactly as before; the default-argument shape preserves the names of the public types, not every method signature underneath them. The one observable public-API signature change is Engine::ledger(), which now returns LedgerReadGuard<'_> (a wrapper around RwLockReadGuard<'_, LedgerState>) instead of &WalletLedger; LedgerReadGuard derefs to WalletLedger, so call-style read access (engine.ledger().balance(), etc.) is source-compatible. Code that named the previous return type explicitly (let r: &WalletLedger = engine.ledger();) or stored the method as a function item must update — see the Engine::ledger() doc-comment in rust/shekyl-engine-core/src/engine/mod.rs for the explicit upgrade path. The PR's lifecycle threaded three pre-flight doc-only spec amendments (PRs #22, #23, #25) before the implementation work began — see docs/completed/STAGE_1_PR_2_LEDGER_ENGINE.md §1.1 / §2.2 for the discipline pattern.

  • pub(crate) trait LedgerEngine in engine::traits::ledger. Post-Phase-0c four-method surface: synced_height(&self) -> u64, snapshot(&self) -> LedgerSnapshot, balance(&self) -> BalanceSummary (sync, infallible reads), and apply_scan_result(&self, ScanResult) -> Result<(), RefreshError> (async, mutating; signals RefreshError::ConcurrentMutation for the §5.2 retry contract). The async &self mutation is enabled by interior RwLock<LedgerState> per §2.2's Round 3 disposition; this is the Stage-4-correct call shape, landed Stage-1-early so the actor cutover becomes a no-op for this concern. LedgerError is reserved as an empty starter type for Phase-2a-specific error variants the trait does not currently emit.
  • pub struct LocalLedger { state: RwLock<LedgerState> } in engine::local_ledger. LedgerState bundles WalletLedger + LedgerIndexes (the two fields previously held flat on Engine); reservations stay on Engine for now and migrate to LocalPendingTx when the PendingTxEngine PR ships. The aggregate is pub (not the originally-planned pub(crate)) because Rust requires every default type parameter on a pub type to be at least as visible as the type itself; the trait LedgerEngine itself stays pub(crate) per §1.4 of the contract. See docs/completed/STAGE_1_PR_2_LEDGER_ENGINE.md §3.4 for the visibility-lift rationale.
  • Engine<S, D: DaemonEngine = DaemonClient, L: LedgerEngine = LocalLedger> and OpenedEngine<S, D, L>. The ledger component becomes a third generic parameter with a default that preserves the existing concrete-typed shape for production callers, while making the ledger surface substitutable for hybrid tests. The trait-dispatch shape monomorphizes away as expected, but the parameterization intentionally pairs with the LocalLedger interior-mutability refactor below; the measured iai-callgrind cost of the combined change on engine_trait_bench_ledger_synced_height is +390% (10 → 49 instructions, sourced entirely from the RwLock::read() acquisition in LocalLedger::read(), not from trait dispatch). Per the docs/V3_ENGINE_TRAIT_BOUNDARIES.md §3.3.1 disposition (a) — intrinsic to Stage 1's interior- mutability shape and retiring at Stage 4 when Path B replaces RwLock<LedgerState> with Arc-published snapshots for read paths — the cumulative-delta breach is acknowledged as structural rather than as a regression to optimize within PR 2; full reasoning in docs/PERFORMANCE_BASELINE.md's engine_trait_bench_ledger_synced_height cumulative-delta footnote. Each pub item bounded by the pub(crate) LedgerEngine trait carries an #[allow(private_bounds)] annotation paralleling the DaemonEngine annotations from PR 1; both clear at Stage 4 when both traits promote to pub per §1.4.
  • Refresh path migrated to &self interior mutation. Engine::synced_height now dispatches through LedgerEngine::synced_height; Engine::apply_scan_result, Engine::refresh, and Engine::refresh_with flip from &mut self to &self; the producer task run_refresh_task's outer Arc<RwLock<Engine>> write-lock guard becomes a read-lock per the §3.3 over-serialization framing. The synchronous wrappers refresh / refresh_with retain their LocalLedger-specialized impl block because the trait method apply_scan_result is async fn and the sync entry points use LocalLedger::write() directly without a Tokio runtime in scope (queued at V3.x in docs/FOLLOWUPS.md for full sync-wrapper generalization). Engine::start_refresh and run_refresh_task are generalized over L: LedgerEngine, sufficient for the hybrid retry test to dispatch through the trait against MockLedger.
  • MockLedger deterministic in-memory LedgerEngine implementor in engine::test_support. Holds WalletLedger + LedgerIndexes + a queued-failure pump (ConcurrentMutation) + a ChaCha20Rng reserved for future RNG-driven fixtures. Constructors mirror PR 1's MockDaemon: with_seed(master, ROLE_LEDGER), with_seed_and_state, plus a queue_concurrent_mutation helper for failure injection. ROLE_LEDGER was reserved in PR 1's test_support.rs and is now consumed.
  • Engine::replace_ledger<L2: LedgerEngine>(self, ledger: L2) -> Engine<S, D, L2> mirrors Engine::replace_daemon from PR 1. #[cfg(test)] pub(crate) for now; retires alongside the Stage 4 trait-promotion / production-constructor generalization at V3.2 per the docs/V3_ENGINE_TRAIT_BOUNDARIES.md §1.2 row.
  • Hybrid retry test hybrid_apply_scan_result_retries_on_concurrent_mutation — end-to-end coverage of the §5.2 retry contract via MockLedger.queue_concurrent_mutation. PR 1 covered the §5.2 happy path (hybrid_linear_scan_5_blocks_advances_synced_ height); PR 2 covers the failure-path retry contract; PR 3+ pick up the remaining §5.2 properties under the "each per-trait PR exercises one §5.2 property predecessors have not yet covered" template pinned in docs/completed/STAGE_1_PR_2_LEDGER_ENGINE.md §2.3.
  • engine_trait_bench_ledger_balance criterion + iai-callgrind bench pair under rust/shekyl-engine-core/benches/, gated on the existing bench-internals Cargo feature. Measures the LedgerEngine::balance trait method against a 1024- TransferDetails state-populated fixture (LocalLedger::populate_for_bench injects state through a bench-internals-only escape hatch; production state remains behind the trait-dispatched mutating path). The engine_trait_bench_ledger_synced_height pair from Stage 0 PR-2 carries forward and gains a cumulative-delta row at the PR-tip SHA 8efae3a40 per §3.3.1 of the trait-boundaries spec. Frozen-baseline source, iai-callgrind gate metric, iai informational metrics, criterion metrics, and capture- environment cross-references for engine_trait_bench_ledger_balance (instructions=20580 on a 1024-TransferDetails fixture) are now transcribed into docs/PERFORMANCE_BASELINE.md from N=3-invariant CI workflow_dispatch runs 25307774464, 25307777614, 25307781436 against PR-tip 8efae3a40, following the "do-not-transcribe-laptop-captures" discipline established during Stage 0 PR-2. The PR-tip SHA 8efae3a40 includes two preparatory script commits (80d913ea2: extend BENCHES row format to thread cargo --features; 8efae3a40: append the balance bench row with :bench-internals) that landed after the design doc's nine- commit plan to surface the new bench to the rolling-baseline harness.

• DaemonEngine trait extracted; Engine<S> parameterized over the daemon implementor (Stage 1 PR 1, the first trait-boundaries PR per docs/V3_ENGINE_TRAIT_BOUNDARIES.md §2.5). The Phase 2a DaemonEngine slice of the Stage 1 trait-extraction work lands as pub(crate) on shekyl-engine-core. The PR's primary surface — the DaemonEngine trait and the Engine<S, D> / OpenedEngine<S, D> parameterization — is pub(crate) and only visible to crate-internal callers; existing public types (Engine, OpenedEngine, DaemonClient, the lifecycle / refresh / pending re-exports in lib.rs) keep their existing shapes for non-test consumers via the D = DaemonClient default. The one externally-visible surface change is the removal of the previously-public DaemonClient::inner() accessor (called out under "Removed" below); cross-workspace audit found zero remaining callers, and the functionality is preserved via DaemonClient's direct Rpc impl.

  • pub(crate) trait DaemonEngine: Rpc + Clone + Send + Sync + 'static in engine::traits::daemon. type Error: Into<IoError>. Stage 1 surface per §2.5: two method signatures (get_fee_estimates, submit_transaction) defined as impl Future (the in-trait-async stable form) so the trait is dyn-incompatible by design and every consumer monomorphizes against a concrete D. Method bodies on DaemonClient are todo!() stubs pending Phase 2a fee-policy / submit-policy work; the trait surface is what's load-bearing for this PR.
  • #[non_exhaustive] FeeEstimates { economy, standard, priority: FeeRate } and #[non_exhaustive] enum TxSubmitOutcome { Submitted { hash }, AlreadyKnown { hash } } colocated with the trait. Both types are pub(crate) and grow additively; Phase 2a may extend FeeEstimates with estimated_block_height / estimation_timestamp etc. and TxSubmitOutcome with richer dedup context without breaking callers.
  • Engine<S, D: DaemonEngine = DaemonClient> and OpenedEngine<S, D: DaemonEngine = DaemonClient>. The daemon component becomes a generic parameter with a default that preserves the existing concrete-typed shape for production callers (shekyl-cli, shekyl-engine-rpc, the forthcoming Rust JSON-RPC server), while making the daemon-touching surface substitutable for hybrid tests. The parameterization compiles to identical code via monomorphization; expected iai-callgrind delta on engine_trait_bench_ledger_synced_height is 0% (10 → 10 instructions) since the bench's call path doesn't observe the daemon parameter. Each pub item bounded by the pub(crate) DaemonEngine trait carries an #[allow(private_bounds)] annotation with a centralized rationale on the Engine struct definition; the annotations clear at Stage 4 when the trait promotes to pub per V3_ENGINE_TRAIT_BOUNDARIES.md §1.4.
  • DaemonClient now implements Rpc directly by delegating each method to its inner SimpleRequestRpc. The previous DaemonClient::inner() accessor is removed; in-tree callers (engine::refresh::*) bind against DaemonEngine or Rpc instead of reaching through to the wrapped transport. From<RpcError> for IoError lands in engine::error to satisfy DaemonEngine::Error: Into<IoError> for the DaemonClient impl.
  • MockDaemon (renamed from MockRpc) extends to a full DaemonEngine implementor in engine::test_support. Adds submit_transaction deduplication by deterministic tx hash, get_fee_estimates returning a fixed snapshot (configurable via set_fee_estimates), fee-error queueing, submit-error queueing, and the with_seed / with_seed_and_chain constructors that carry a ChaCha20Rng reserved for future RNG-driven affordances per §6.2 (fee jitter, synthetic-fork randomization) — held but not yet consumed at this PR's contract surface. Failure-injection contract fidelity per §6.1 is exercised by a new test suite in the same module (deterministic submit hashing across clones, submit dedup behaviour, fee-snapshot-override persistence, queued-error drain semantics).
  • MockDaemon chain-indexing convention now matches the real-daemon protocol (chain[0] is genesis at height 0; chain[h] is the block at height h; get_height returns chain.len()). The previous off-by-one convention (chain[i] was the block at height i + 1) was a latent contradiction that surfaced as soon as a hybrid test composed MockDaemon with the production producer's range derivation. Aligning the conventions removes the bug-attractor; the existing refresh_driver_tests were re-arithmetic'd in the same commit so the test substrate has one convention going forward.
  • derive_seed(master: &[u8; 32], role: &[u8]) -> [u8; 32] in engine::test_support (HKDF-SHA256 per V3_ENGINE_TRAIT_BOUNDARIES.md §6.2). The first role tag ROLE_DAEMON = b"role/daemon" lands in this PR; per-trait roles join as their owning trait extracts. Pinned by a fixture-based unit test so accidental changes to the role tag or KDF construction surface as test failures.
  • #[cfg(test)] pub(crate) Engine::replace_daemon<D2>(self, daemon: D2) -> Engine<S, D2> in engine::lifecycle. Move-rebuild helper for the §6.3 hybrid-construction discipline: real Engine::create with a dummy DaemonClient pays the lifecycle cost once (file lock, KDF, ledger init, refresh slot), then replace_daemon(mock) swaps in the MockDaemon for the measured region. Test-only visibility; cleanup target is V3.2 alongside the production-constructor generalization over D: DaemonEngine (documented at the method site).
  • First end-to-end hybrid test under start_refresh_integration_tests::hybrid_linear_scan_5_blocks_advances_synced_height. Wires MockDaemon as the engine's daemon component for a real start_refresh invocation (fresh wallet at synced_height = 0, six-block chain at heights 0..=5), asserting (a) the producer derives processed_height_range == 1..6, (b) blocks_processed == 5 (post-genesis only), (c) post-refresh synced_height() == 5, (d) the refresh slot releases within 5s of join().await returning. This is the §5.2 retry-contract reachability proof — the slot release timing observation is the first coverage of the success-path lifecycle for the refresh slot (the existing start_refresh_integration_tests module exercises only the unreachable-daemon error path).
  • Closes the FOLLOWUPS.md V3.1 row "Generic DaemonClient so MockRpc can drive start_refresh". The row's close-condition (handle-layer end-to-end scenarios against a synthetic block batch via a substitutable daemon transport) is satisfied by the parameterization plus the hybrid test above.

  Performance gate per V3_ENGINE_TRAIT_BOUNDARIES.md §3.3.1: the engine_trait_bench_ledger_synced_height cumulative-delta row for this PR's tip is captured via GHA workflow_dispatch (N=3 invariance) and appended to docs/PERFORMANCE_BASELINE.md in a follow-up commit on this branch before merge per the "do-not-transcribe-laptop-captures" discipline established during Stage 0 PR-2.

Removed

• Chaingen-dependent C++ test surface (tx_validation, fcmp_tests, staking). Test hygiene Δ1 (2026-05-05) deletes tests/core_tests/{tx_validation,fcmp_tests,staking}.{cpp,h} (~2200 lines, 32 registered tests + 7 already-disabled struct decls), the chaingen_main.cpp registrations, and the dead helpers apply_fcmp_pipeline / construct_fcmp_tx / construct_fcmp_staked_tx in chaingen.cpp (no callers remain after the test deletion). Root cause: the chaingen synthetic-block mining infrastructure (MAKE_GENESIS_BLOCK, REWIND_BLOCKS_N, MAKE_NEXT_BLOCK) produces v1 coinbase transactions that cryptonote_format_utils.cpp:295 rejects under v3-from-genesis ("Shekyl requires tx version >= 3"); no chain ever materializes on the synthetic side, so fill_tx_sources_and_destinations returns no spendable outputs and every test that needs to construct a user transaction fails at chain setup. The CI baseline previously flagged 19 failures (cluster C); a full survey (this PR) confirmed the same root cause hits all 32 chaingen-dependent tests including gen_fcmp_tx_valid. The invariants those tests covered migrate to Rust per docs/FOLLOWUPS.md — three target-V3.x entries (tx-validation, FCMP++ tx-pool, staking lifecycle), each landing with the corresponding Rust port of the daemon-side validation path. Per .cursor/rules/20-rust-vs-cpp-policy.mdc, tx validation defines a cryptographic contract → Rust. Per .cursor/rules/15-deletion-and-debt.mdc "default: delete," dead code goes; the V3.1 disposition that previously deferred this work to "wallet2 hardening / V3.2 wallet2 removal" is closed by this deletion. Closes docs/CI_BASELINE.md cluster C.

• DaemonClient::inner() accessor in engine::daemon. The method exposed the wrapped SimpleRequestRpc so callers could invoke Rpc methods through it; with the Stage 1 PR 1 parameterization, DaemonClient implements Rpc directly and the indirection is dead. Cross-workspace audit (shekyl-core, shekyl-gui-wallet, shekyl-dev, shekyl-web, shekyl-mobile-wallet, monero-oxide) found zero remaining callers; per 15-deletion-and-debt.mdc "default: delete" and the no-#[deprecated]-without-deletion-target rule, the accessor is removed outright rather than retained as a deprecation shim. Any downstream caller can replace client.inner().get_height() with client.get_height() (the Rpc supertrait is in scope wherever DaemonClient is) with no functional difference.

Changed

• Rust workspace clippy and rustfmt CI gates in .github/workflows/build.yml (Rust: audit, test, determinism job, immediately after cargo audit). Two gates added:

  • cargo fmt --all -- --check — fails CI on any unformatted Rust file across the 14-crate workspace.
  • cargo clippy --workspace --all-targets --keep-going -- -D warnings — fails CI on any clippy finding of any severity. The workspace already configured many lints at deny-level via rust/Cargo.toml [workspace.lints.clippy] (let_underscore_must_use, cast_possible_truncation, uninlined_format_args, et al.); -D warnings extends enforcement to the default-warn lints (clone_on_copy, type_complexity, dead_code, bound_in_more_than_one_place, …).

  The pre-existing fmt and clippy debt was discharged in this PR's preceding commits before the gates were wired:

  • cargo fmt --all over 15 Rust files (mechanical import-sort and module-declaration reordering, zero behavior change).
  • 12 machine-applicable clippy auto-fixes (9 clone_on_copy deref + 3 uninlined_format_args inlines).
  • 19 let_underscore_must_use cures via destructuring assignment (let _ = expr; → _ = expr;) at best-effort channel-send and join-drain sites.
  • 7 substantive clippy findings cured with per-site rationale: bound consolidation in run_refresh_task, usize::try_from at the test-loop cast site, RefreshHandleFixture typedef, and per-item #[allow(dead_code)] on the Phase 2a-stub DaemonEngine trait surface.

• .cursor/rules/15-deletion-and-debt.mdc "While we're here" carve-out. New paragraph in the rule clarifying that the "while we're here is the enemy" prohibition does not preclude the disciplined practice of leaving files you are already editing for substantive reasons in fmt-clean and clippy-clean shape. The carve-out distinguishes:

  • Undisciplined "while we're here" creep (still prohibited): fixing arbitrary out-of-scope issues in unrelated files.
  • Disciplined "leave the file you touched in good shape" (now explicitly permitted): mechanical fmt/clippy cleanup within the substantive-edit set such that the post-PR file is fmt-clean and clippy-clean.

  The cleanup-PR pattern this project ran for Stage 1 PR 1's fmt-debt is now a one-time discharge, not a recurring practice. Going forward, every file your PR touches is fmt-clean and clippy-clean by the time the PR lands; mechanical findings in files your PR does not otherwise touch remain out-of-scope.

• docs/CONTRIBUTING.md Rust style and lints section. New section between "CI baseline" and "Branch protection on dev" documenting the two new gates, the workspace-vs-per-item-vs- module suppression hierarchy ([workspace.lints.clippy] allow in rust/Cargo.toml for project-wide misleading lints; #[allow(lint_name)] with one-line rationale comment for site-specific suppressions matching the existing project convention; module-level allows reserved for explicit reviewer sign-off), and the carve-out reference. The "Status checks must pass" bullet under "Branch protection on dev" was updated to enumerate the two new gates explicitly.

  Discipline reversal recorded for future readers: from this PR forward, the previous practice of noting "pre-existing fmt debt in <files> is unmodified per the deletion-and-debt rule" is no longer applicable. Fmt-clean is the gate, not a per-PR option to defer.

• Swatinem/rust-cache@v2 replaces actions/cache@v5 in the rust-audit-and-test CI job in .github/workflows/build.yml. The prior cache strategy had three documented waste modes measured against dev tip 1155c1abe:

  • ~8m44s post-job cache UPLOAD on every run, regardless of whether the cache key changed (see docs/CI_TIMING_BASELINE.md "Per-step breakdown"). actions/cache@v5 re-uploads the full path set when the cache key differs from what was restored; Swatinem/rust-cache@v2 writes deltas only.
  • No rustc version component in the cache key, so a toolchain bump (e.g. 1.94.0 → 1.95.0 as occurred mid-cycle on the ubuntu-latest runner) would have silently restored a 1.94-built target/. Swatinem's default key includes rustc --version.
  • No ~/.cargo/bin caching, so cargo install cargo-audit --locked recompiled from source every run (~2m34s). Swatinem caches ~/.cargo/bin by default; combined with --locked idempotency, the install becomes a few-second metadata check on cache hits.

  The install cargo-audit step also moved from pre-checkout (where the cache had no chance to populate ~/.cargo/bin) to immediately after the Swatinem step, so the cache restore reaches it first.

  Measured impact (GHA run id 25265761303, chore/ci-cache-tightening branch tip 911989b24, toolchain 1.95.0; full breakdown in docs/CI_TIMING_BASELINE.md):

  • Post-run cache UPLOAD: 8m 44s before → 1m 30s cold, 0s hot. Structural; reliably reproduces every run.
  • install cargo-audit: 2m 34s before → 0s on hot-cache. Structural; reliably reproduces every hot-cache run.
  • Rust job total wall clock: 48m 22s before (run 25263753443, dev tip 1155c1abe) → 37m 24s cold, 35m 57s hot. Headline numbers are noisy because cargo test swings ±~3m run-to-run independently of the cache (24m 20s cold vs 27m 16s hot on the same SHA). The structural cache savings above are the durable component of the wall-clock delta.

  The PR scope is intentionally tight per the tight_then_iterate disposition (2026-05-02). APT package caching, extending Swatinem to the C++ build matrix's Rust half (Ubuntu 22.04, Ubuntu 24.04, Arch Linux), ccache effectiveness audits, and cargo-binstall migration are enumerated as deferred follow-ups in docs/CI_TIMING_BASELINE.md "Out of scope". Each of those is a >1 commit change with its own baseline-then-after capture cycle and lands as its own PR after the Swatinem deltas are observed and documented.

• docs/CI_TIMING_BASELINE.md introduced to record CI wall-clock per job per dev tip, anchored on the metric being recorded (job-level wall clock, not step durations) so deltas across caching changes are reproducibly comparable. The document captures the chore/ci-cache-tightening baseline before/after pair and is the going-forward home for similar captures (CI cache strategy changes, runner-image upgrades, toolchain bumps that affect compile time, etc.). Per 91-documentation-after-plans.mdc, this file lives under docs/ rather than scratch so future readers don't have to re-derive baselines from gh run logs.

Fixed

• CI Post Run cleanup no longer surfaces ##[error]ENOENT on rust/target/tests/target for the Rust: audit, test, determinism job. The Swatinem/rust-cache@v2 post-run cleanup walker (src/cleanup.ts cleanProfileTarget) treats any target/ subdirectory named tests as a kaos / macrotest / trybuild nested-workspace layout and recursively cleans both tests/target/ and tests/trybuild/. The recursive cleanTargetDir calls are not awaited, so async ENOENT rejections on missing paths escape the synchronous try/catch and surface as ##[error]ENOENT: opendir rust/target/tests/target annotations in the run summary. The job concludes success (the action continues), but the annotation pollutes the run summary and obscures real errors.

  Why we hit it: rust/shekyl-logging/tests/trybuild.rs uses dtolnay/trybuild, which creates rust/target/tests/trybuild/. We do not use kaos/macrotest, so rust/target/tests/target/ never gets created — the walker tries it anyway. Confirmed against Swatinem/rust-cache#144 (open since 2023; the user-proposed if (e.code === "ENOENT") continue; patch never landed).

  Workaround: a defensive mkdir -p rust/target/tests/target step runs as the last pre-cleanup step in the job, ensuring the walker's opendir call succeeds and finds an empty directory to clean. Cache cost: a single empty directory entry, negligible. The new step's comment documents the upstream issue, the removal condition (delete the step in the same PR that bumps the action pin once Swatinem merges either the ENOENT-skip patch or adds await to the recursive cleanTargetDir calls), and the dependency chain (shekyl-logging trybuild test → target/tests/trybuild/ → walker → target/tests/target/ ENOENT). Files touched: .github/workflows/build.yml in the Rust: audit, test, determinism job (one new step after determinism check).

• Workspace clippy gate green on Rust toolchain 1.95.0. Three newly-deny-able clippy 1.95 findings cured with mechanical, behavior-identical fixes after the toolchain on the ubuntu-latest GitHub Actions runner advanced past 1.94.0 (which is what the preceding chore/workspace-fmt-clippy-baseline PR was triaged against). Without this fix the cargo clippy --workspace --all-targets --keep-going -- -D warnings gate added in that PR rejects every push to dev.

  • clippy::useless_conversion (×3 in vendored rust/shekyl-oxide/): for (a, b) in xs.into_iter().zip(ys.into_iter()) → for (a, b) in xs.into_iter().zip(ys). Iterator::zip accepts any IntoIterator, so the inner .into_iter() was redundant. Sites:
    • rust/shekyl-oxide/crypto/generalized-bulletproofs/src/inner_product.rs lines 216 and 220 (BP++ inner-product reduction g_bold / h_bold recursion).
    • rust/shekyl-oxide/shekyl-oxide/fcmp/bulletproofs/src/plus/weighted_inner_product.rs line 380 (verifier folding loop over commitment pairs (L_i, R_i)).
  • clippy::unnecessary_sort_by (×2 in Shekyl-native shekyl-scanner): rust/shekyl-scanner/src/coin_select.rs lines 114–115. Both calls sort descending by the second tuple element; rewrote to sort_by_key(|b| std::cmp::Reverse(b.1)) per clippy's suggestion. Behavior-identical sort key, no change in coin-selection ordering.

  Vendored-divergence framing (in keeping with 10-shekyl-first.mdc): the vendored copies under rust/shekyl-oxide/ are already Shekyl-modified relative to the monero-oxide fork pin (UPSTREAM_MONERO_OXIDE_COMMIT=3933664, sync 2026-04-25); a prior commit (44fe03453 chore: resolve all clippy warnings across the Rust workspace) rewrote inner_product.rs with +360/-332 against upstream for clippy compliance under toolchain 1.94. There is no upstream fix to cherry-pick — the same pattern exists at the same lines in upstream (monero-oxide crypto/generalized-bulletproofs/src/inner_product.rs:204,208), last touched 2025-08-30, and would fail the same lint under clippy 1.95. This PR continues the precedent of treating rust/shekyl-oxide/ as Shekyl-customized vendored code rather than a frozen mirror.

  Affected-crate test runs locally (release profile, toolchain 1.95.0):

  Crate	Tests passing
  generalized-bulletproofs (with --features tests)	5 / 5
  shekyl-bulletproofs	5 / 5
  shekyl-scanner	47 / 47 (1 ignored, pre-existing)

  Local cargo clippy --workspace --all-targets --keep-going -- -D warnings on toolchain 1.95.0 returns exit 0 after the fixes.

Changed (BREAKING)

• Wallet → Engine rename across Rust workspace (decision log "Wallet → Engine rename", 2026-04-27). Mechanical rename of the domain orchestrator type and its supporting crates and modules to consistently use "engine" terminology. The on-chain consensus rules and wire formats are unaffected; this is a source-only API churn.

  • Crates renamed. Workspace members and on-disk paths: shekyl-wallet-core → shekyl-engine-core, shekyl-wallet-state → shekyl-engine-state, shekyl-wallet-file → shekyl-engine-file, shekyl-wallet-prefs → shekyl-engine-prefs, shekyl-wallet-rpc → shekyl-engine-rpc. The shekyl-cli, shekyl-ffi, shekyl-scanner, shekyl-tx-builder, shekyl-daemon-rpc, shekyl-fcmp, shekyl-crypto-pq, shekyl-proofs, shekyl-address, shekyl-shard-visual, and the monero-oxide family (shekyl-oxide) are unchanged.
  • Module renamed. shekyl-engine-core::wallet → shekyl-engine-core::engine. The module re-exports retain their semantics through the new path.
  • Types renamed. Orchestrator-shaped types now use Engine*: Wallet<S> → Engine<S>, WalletSignerKind → EngineSignerKind, WalletCoreError → EngineCoreError, OpenedWallet → OpenedEngine, WalletCreateParams → EngineCreateParams. Domain-shaped types that name file format primitives or generic envelope concepts (WalletFile, WalletLedger, WalletPrefs, WalletEnvelopeError, WalletOutput) are intentionally retained — they describe a user's set of secrets, not the orchestrator.
  • CLI surfaces. shekyl-cli user-facing strings, help text, REPL prompts (shekyl-cli [engine]>), and command names (engine_info replaces wallet_info) now use "engine" terminology throughout per Option α. The --wallet-dir / --wallet-file flags are renamed to --engine-dir / --engine-file.
  • Filesystem layout. Default home directory subtree ~/.shekyl/wallets/ is renamed to ~/.shekyl/engines/. The .wallet and .wallet.keys file extensions are retained so that existing tooling and the file format documentation in docs/WALLET_FILE_FORMAT_V1.md stay valid.
  • What is not renamed in this release.
    1. FFI C ABI symbols. shekyl_wallet_* #[no_mangle] exports and the ShekylWallet opaque-handle struct retain their names. The internal Rust types backing those handles are renamed; the C ABI is held stable until the C++ wallet2.cpp retirement work in V3.2 lets us cut both at once. See FOLLOWUPS V3.2.
    2. C++ JSON-RPC method names. wallet_* JSON-RPC method strings exposed by the C++ shekyl-wallet-rpc.exe binary are not renamed here. They are deleted, not aliased, when the Rust-native JSON-RPC server lands as part of Phase 4b's Shekyl-native RPC method-set work in V3.2. See FOLLOWUPS V3.2.
    3. C++ binary names (shekyl-wallet-rpc, shekyl-wallet-cli, shekyl-wallet-bench) and references to them in .github/workflows/build.yml, scripts/bench/, and stress-net harnesses. Tied to the same C++ retirement work.
  • Migration guidance. No on-disk migration code is shipped or needed pre-V3 launch (per 15-deletion-and-debt.mdc). Pre-launch users re-sync from genesis. Tooling that depends on the renamed Rust crates updates [dependencies] paths and import paths in one mechanical pass; the FFI C ABI and JSON-RPC wire surfaces are intentionally unchanged.

Added

• Engine::refresh driver and produce_scan_result producer (Phase 2a refresh_scan_loop bundle, Branch 1). The shekyl_engine_core::engine::refresh module ships the snapshot-merge-with-retry sync driver that replaces the standalone shekyl-scanner::sync::run_sync_loop. Public surface:

  • Engine::refresh(&mut self, opts: &RefreshOptions, runtime: &tokio::runtime::Handle) -> Result<RefreshSummary, RefreshError> — synchronous entry point on Engine<S>. Captures a LedgerSnapshot of the wallet's current (synced_height, reorg_blocks) under a brief read borrow, drops the borrow, drives the async producer on runtime, and merges the result back via apply_scan_result_to_state under &mut self. On RefreshError::ConcurrentMutation the snapshot is re-taken and the call retries up to RefreshOptions::max_retries.
  • produce_scan_result(rpc, scanner, &LedgerSnapshot, height_range, cancel) -> Result<ScanResult, ProduceError> — pub(crate) async producer that fetches blocks via the Rpc trait, scans them with shekyl_scanner::Scanner, detects reorgs by comparing header.previous against the snapshot's reorg_blocks (with a find_fork_point walk on mismatch), and returns a typed ScanResult envelope rather than mutating wallet state in place. Reorgs surface as ScanResult::reorg_rewind: Some(_); the merge applies the rewind atomically before applying forward-progress events.
  • LedgerSnapshot { synced_height: u64, reorg_blocks: ReorgBlocks } — minimal read-only view of the pieces of (LedgerBlock, LedgerIndexes) the producer needs to detect reorgs and resume scanning. Cloned (not Arc-wrapped) per the snapshot benchmark in rust/shekyl-engine-core/benches/refresh_snapshot.rs, which measures clone cost across realistic reorg-window sizes so any future Arc switch has an empirical baseline.
  • RefreshOptions { max_retries: u32 } — caller-supplied knobs for the snapshot-merge retry loop. Default 8; rationale on the bound is in the decision-log entry "Snapshot-merge-with-retry semantics for Wallet::refresh" (2026-04-26). #[non_exhaustive] so Branch 2 can add the cancel-token / progress-channel / batch-size knobs without a breaking change.
  • RefreshSummary { processed_height_range, blocks_processed, transfers_detected, key_images_observed, stake_events, reorg: Option<RefreshReorgEvent>, merge_attempts } — caller-visible result of a successful refresh. #[non_exhaustive]; stake_events is reserved for Phase 2b's richer event vocabulary and is always 0 today.
  • RefreshError — typed failure surface: ConcurrentMutation { wallet, result } (snapshot drifted under the producer; safe retry), AlreadyRunning (single-flight enforcement at the binary layer; reserved for Branch 2's handle path), MalformedScanResult { reason } (producer-bug signal: scan-result invariants violated; not a race), Cancelled (cooperative shutdown), Io (RPC failure surfaced from ProduceError::MaxRetriesExhausted). The variant set is #[non_exhaustive].

  The driver is the snapshot-merge realization of the cross-cutting locking decision: queries take &self, mutations take &mut self, and refresh threads the long-running scan between borrow points so the wallet is never held across an await. The contract is locked in docs/V3_WALLET_DECISION_LOG.md "Wallet::refresh snapshot-merge-with-retry" (2026-04-26), "MalformedScanResult: producer-bug signal vs. ConcurrentMutation" (2026-04-26), and "Retire shekyl-scanner::sync::run_sync_loop (Phase 2a/4b boundary)" (2026-04-27).

  The RefreshHandle async surface (cancel-on-drop, watch-based RefreshProgress, AlreadyRunning enforcement, start_refresh spawning) lands in Branch 2 of the bundle (immediately below); this branch is the synchronous entry point and the producer / merge contract that the handle wraps.

  Test coverage lives in rust/shekyl-engine-core/src/engine/refresh.rs's mod tests (producer-side: smoke / linear-scan / reorg-shallow / reorg-deep / reorg-at-tip / RPC-failure-fetch / RPC-failure-tip / scanner-failure / cancellation-mid-scan / cancellation-between-blocks / empty-range / range-validation; driver-side: round-trip, reorg-merge, retry-on-concurrent-mutation, retry-budget-exhausted, malformed-scan-result-bypass-retry, cancellation-end-to-end, no-progress-when-tip-equal, reorg-rewind-then-apply). The MockRpc test scaffold and make_synthetic_block helper live in rust/shekyl-engine-core/src/engine/test_support.rs for deterministic fault injection across producer and driver suites.

• Engine::start_refresh async refresh handle (Phase 2a refresh_scan_loop bundle, Branch 2). The shekyl_engine_core::engine::refresh module ships the cancel-on-drop / one-at-a-time / progress- channel handle that wraps the snapshot-merge driver from Branch

  1. The handle spawns the long-running scan onto a tokio runtime the caller does not have to manage, and threads cancellation and progress through typed channels. Public surface:
  • Engine::start_refresh(self_arc: Arc<tokio::sync::RwLock<Self>>, opts: RefreshOptions) -> Result<RefreshHandle, RefreshError> — async constructor on Engine<S>. Claims a RefreshSlot under a brief read borrow, spawns a producer task, and returns a handle observing the running task. A second call while a handle is alive returns RefreshError::AlreadyRunning. The Arc<RwLock<Engine<S>>> shape is the transitional shared- handle realization of the message-passing boundary decided in 2026-04-27 — Engine binary boundary: pure message-passing over shared handle; the actor migration replaces the parameter without changing the handle's external surface.
  • RefreshHandle — RAII handle for the running refresh. Methods: progress() -> watch::Receiver<RefreshProgress> (clonable observer of phase / height / blocks-processed / blocks-total updates), cancel() (idempotent; fires the shared CancellationToken), is_running() -> bool (non- blocking poll of the producer's JoinHandle::is_finished), async fn join(self) -> Result<RefreshSummary, RefreshError> (push-completion via internal oneshot; consumes the handle). Drop for RefreshHandle is cancel-only — slot release lives on producer task exit, not on handle drop, so the cancel contract is Drop-scoped while the slot is self-healing across success / error / cancellation paths.
  • RefreshProgress { height, blocks_processed, blocks_total, phase: RefreshPhase } — #[non_exhaustive] snapshot delivered through a tokio::sync::watch channel. Per-attempt semantics: blocks_total is the per-retry total, not a cumulative running count. The watch channel is seeded by Engine::start_refresh with the wallet's current synced_height (and zeroed counters) so subscribers observe a baseline matching the wallet state before the producer publishes its first per-attempt update.
  • RefreshPhase { Scanning, Merging, Retrying, Cancelled } — coarse-grained producer state. Scanning covers fetch + scan of a per-block batch; Merging covers the brief write-locked apply_scan_result call; Retrying is published when the merge returned ConcurrentMutation and the loop is about to retake the snapshot; Cancelled is published before the handle's completion oneshot fires Err(Cancelled).
  • RefreshOptions extended with no new fields in Branch 2; max_retries (Branch 1) is the only public knob. #[non_exhaustive] so future progress / batching knobs do not break call sites.
  • RefreshError::AlreadyRunning becomes load-bearing in this branch (Branch 1 reserved the variant); other variants propagate unchanged.

  Test coverage lives in three new modules: mod refresh_handle_tests (six unit tests pinning the handle's channel-shaped surface in isolation: progress baseline, progress propagation, cancel + is_running flip, join success, join error, dropped-sender → MalformedScanResult), mod refresh_slot_tests (four unit tests pinning single-flight semantics: claim-when-unheld, claim-fails-when-held, release-on- guard-drop, clone-shares-flag), and mod start_refresh_integration_tests (three integration tests against the real engine + unreachable- daemon: start_refresh propagates IoError::Daemon via join, concurrent start_refresh returns AlreadyRunning, drop releases the slot for a subsequent start_refresh). A pub(crate) fn for_test(...) constructor on RefreshHandle is the testability seam that lets the surface tests run without spinning up an Engine<S>.

  The decision-log scope-closing entry is 2026-04-27 — RefreshHandle (Phase 2a Branch 2) ships transitional Arc<RwLock<Engine>> under Path B; the upstream handle-shape entry is 2026-04-25 — RefreshHandle: cancel-on-drop RAII, one-at-a-time, scanner checkpoints between blocks. Wider scenario coverage of start_refresh against synthetic block batches lands when DaemonClient is generic (deferred outside Branch 2; tracked under V3.1 in docs/FOLLOWUPS.md).

• Engine::create / Engine::open_full / Engine::change_password / Engine::close lifecycle methods on shekyl-engine-core (Phase 1 lifecycle task). The new shekyl_engine_core::engine::lifecycle module composes shekyl-engine-file, shekyl-crypto-pq::account::rederive_account, shekyl-engine-prefs, shekyl-engine-state::WalletLedger, and shekyl-engine-state::LedgerIndexes into the Engine<S> orchestrator's open / create / rotate / close surface. Public API:

  • Credentials<'a> — forward-compatible authentication parameter. V3.0 has a private password: &'a [u8] field reachable through Credentials::password_only(&[u8]) and Credentials::password(); V3.1 adds authenticator: Option<AuthenticatorRequest<'a>> and Credentials::password_with_authenticator(pwd, auth) without breaking existing call sites. See docs/V3_WALLET_DECISION_LOG.md "Wallet authentication: V3.0 password-only; MFA is V3.1 via format-version bump" (2026-04-26) for the API shape rationale.
  • OpenedEngine<S> typed-sum return for open_full. Loaded(Engine<S>) indicates the persisted ledger file decoded cleanly; Restored { wallet, from_height } indicates the keys file was intact but the ledger file was missing or unreadable — the wallet was reconstructed against an empty ledger anchored at from_height = restore_height_hint and the caller must drive a refresh to rebuild state. See docs/V3_WALLET_DECISION_LOG.md "Wallet::open_full: lost-state surfacing via typed OpenedWallet sum" (2026-04-26).
  • EngineCreateParams<'a> (9 public fields) and CapabilityInput<'a>::Full { master_seed_64, seed_format } for Engine::create. ViewOnly / HardwareOffload CapabilityInput variants are deferred alongside the matching open_* bodies; the FULL variant ships end-to-end. A #[cfg(test)] EngineCreateParams::for_test_full(base_path, password, master_seed_64) helper pins all eight non-essential fields to known-good defaults for unit-test fixtures; production callers (CLI / RPC) construct the struct literal so the field set is explicit at every call site.
  • Engine::create(params) -> Result<Engine<SoloSigner>, OpenError> — delegates to WalletFile::create with derived DerivationNetwork / SeedFormat, runs rederive_account to populate AllKeysBlob, cross-checks blob.classical_address_bytes against the envelope's expected_classical_address (failure → KeyError::PublicBytesMismatch), initializes WalletLedger::empty() and LedgerIndexes::empty(), persists initial prefs via WalletFile::save_prefs, and assembles the Engine<SoloSigner> instance.
  • Engine::open_full(base_path, &credentials, network, daemon, overrides) -> Result<OpenedEngine<SoloSigner>, OpenError> — opens the envelope (mapping WalletEnvelopeError::InvalidPasswordOrCorrupt to OpenError::IncorrectPassword, RequiresMultisigSupport to OpenError::RequiresMultisig, and capability / network mismatches to the corresponding typed variants), enforces FULL-only on this entry point (OpenError::CapabilityMismatch if the disk envelope is ViewOnly or HardwareOffload), runs the same rederive + public-bytes-cross-check sequence as create, surfaces tampered prefs as a structured tracing::warn! and falls back to defaults per docs/WALLET_PREFS.md §5's advisory failure policy, rebuilds LedgerIndexes from the persisted LedgerBlock, and returns Loaded or Restored { from_height } based on the WalletFile::open outcome.
  • Engine::open_view_only(...) / Engine::open_hardware_offload(...) — signature-only stubs that return OpenError::CapabilityNotYetImplemented { capability } pending the matching shekyl-crypto-pq AllKeysBlob constructors. The error variant is deletion-tracked at the code site and in docs/FOLLOWUPS.md V3.0 → "View/HW lifecycle bodies in shekyl-engine-core". See docs/V3_WALLET_DECISION_LOG.md "Wallet<S> lifecycle: capability scoping for V3.0" (2026-04-26) for the stub-shape rationale.
  • Engine::change_password(&old, &new, new_kdf) -> Result<(), OpenError> — delegates to WalletFile::rotate_password, mapping WalletEnvelopeError::InvalidPasswordOrCorrupt to OpenError::IncorrectPassword. Available on every signer kind (FULL / ViewOnly / HardwareOffload / multisig) since the underlying envelope rewrap is capability-agnostic.
  • Engine::close(self, &credentials) -> Result<(), OpenError> — refuses with OpenError::OutstandingPendingTx { count } when outstanding_pending_txs() > 0 (drives cross-cutting lock 4's "no clean close while reservations are live" invariant). Otherwise saves state via WalletFile::save_state, saves prefs via WalletFile::save_prefs, and consumes self. The method's doc comment names the zeroization chain explicitly: WalletFile::Drop releases the advisory lock on <base>.keys; AllKeysBlob::Drop zeroizes spend_sk / view_sk / ml_kem_dk and the public-key fields. The chain is single-level (Engine<S>.keys: AllKeysBlob directly, no wrapper), and the underlying Drop semantics are tested in shekyl-crypto-pq's own unit tests.

  Eleven unit tests cover the round-trip create / open path, password rotation followed by reopen-with-new-password and refusal of the old, OpenError::IncorrectPassword, OpenError::NetworkMismatch, the Restored { from_height } lost-state path (state file deleted between create and open), OpenError::OutstandingPendingTx (close refused while a synthetic reservation is in Engine::reservations), the structured tracing::warn! on prefs HMAC tamper events, and the typed OpenError::CapabilityNotYetImplemented returns from the view-only and hardware-offload stubs. The apply_scan_result_post_open_works lifecycle ↔ scan-result composition test is deferred to the Phase 2a refresh commit where it can exercise a real ScanResult against the lifecycle's LedgerIndexes::rebuild_from_ledger output.

  The lifecycle commit ships tracing = "0.1" as a runtime dependency on shekyl-engine-core (used for the prefs-tamper warn log only) and tempfile = "3" plus tokio = { version = "1", features = ["macros", "rt"] } as dev-dependencies (lifecycle tests construct on-disk fixtures and instantiate a SimpleRequestRpc against an unreachable URL for the dummy DaemonClient).

• Engine::build_pending_tx / submit_pending_tx / discard_pending_tx three-method PendingTx lifecycle (Phase 1 pending_tx task). The new shekyl_engine_core::engine::pending module lands the runtime-only side of cross-cutting lock 4. Public surface:

  • PendingTx { id, built_at_height, built_at_tip_hash, fee_atomic_units, tx_bytes, recipients } — the chain-state-tagged handle returned by build_pending_tx. tx_bytes is Vec::new() in Phase 1 and is explicitly documented as Phase-2a's integration point for shekyl-tx-builder.
  • TxRequest { recipients, priority, from_subaddress }, TxRecipient { address, amount_atomic_units }, FeePriority { Economy, Standard, Priority, Custom(NonZeroU64) }, TxRecipientSummary, ReservationId(u64), TxHash([u8; 32]) — the strongly-typed input/handle/summary newtypes.
  • Engine::build_pending_tx(&request) -> Result<PendingTx, SendError> — selects largest-amount-first spendable outputs from LedgerIndexes/LedgerBlock (excluding outputs already reserved by another in-flight PendingTx), captures real chain state (synced_height + block_hash_at(synced_height)), bumps a monotonic next_reservation_id, and inserts a Reservation into Engine::reservations. Phase 1 uses a fixed STUB_FEE_ATOMIC_UNITS = 1_000 stub fee; Phase 2a will replace it with a daemon.get_fee_estimates() call.
  • Engine::submit_pending_tx(id) -> Result<TxHash, PendingTxError> — runs the cross-cutting-lock-4 invariants (PendingTxError::TooOld { built, current, max_reorg } against NetworkSafetyConstants::for_network(network).max_reorg_depth, PendingTxError::ChainStateChanged { height } against the stored built_at_tip_hash, PendingTxError::UnknownHandle for unknown ids), and on success removes the reservation, marks each selected TransferDetails as spent = true with spent_height = None (the "unconfirmed-spent" Phase-1 state, made proper in Phase 2a once daemon broadcast confirmation arrives), and returns a stub TxHash whose first 8 bytes encode the ReservationId.
  • Engine::discard_pending_tx(id) -> Result<(), PendingTxError> — idempotent: returns Ok(()) regardless of whether id is currently recognized, releases the reservation entry so the referenced outputs become selectable by a subsequent build.
  • Engine::outstanding_pending_txs() -> usize — count accessor used by Engine::close (lifecycle commit) to refuse closing while any reservation is active.

  Reservations live exclusively on Engine<S> as a runtime-only BTreeMap<ReservationId, Reservation> field alongside the existing runtime-only indexes: LedgerIndexes. They are not persisted in WalletLedger.bookkeeping; BOOKKEEPING_BLOCK_VERSION does not change. Process crash between build and submit/discard drops reservations along with the in-memory PendingTx handle — which is the correct behavior, since the tx never broadcast and the outputs are correctly spendable again on next open.

  The full lifecycle body is exposed as pub(crate) free helpers (build_pending_tx_in_state, submit_pending_tx_in_state, discard_pending_tx_in_state) operating on (&LedgerBlock, &mut BTreeMap<ReservationId, Reservation>, ...) so unit tests can drive the full lifecycle without standing up an Engine<S> (whose constructors land in the lifecycle commit). Twelve unit tests cover output reservation, the reserved-output filter, insufficient-funds, the no-block-yet SendError::CannotSign, all three PendingTxError paths, the spent-state mutation on submit, the rebuild-after-discard path, discard idempotency on unknown handles, and FeePriority::Custom preservation.

  See docs/V3_WALLET_DECISION_LOG.md "Reservation tracker: runtime-only on Wallet, never persisted" (2026-04-26 sub-section of the Wallet<S> struct entry) for the runtime-vs-persisted decision and the supersession of the original cross-cutting-lock-4 draft phrasing.

• shekyl_engine_core::scan::ScanResult typed scanner-output value and Engine::apply_scan_result merge surface (Phase 1 scan_result task). A new shekyl_engine_core::scan module defines the additive event vocabulary the Phase 2a Engine::refresh() pipeline produces from a scanner pass:

  • ScanResult { processed_height_range, parent_hash, block_hashes, new_transfers, spent_key_images, stake_events, reorg_rewind }.
  • DetectedTransfer { block_height, output: RecoveredWalletOutput } — the secret-bearing variant; RecoveredWalletOutput already ZeroizeOnDrop, so dropping the enclosing ScanResult wipes PQC re-derivation material in place.
  • KeyImageObserved { block_height, key_image } — drives LedgerIndexes::detect_spends per height.
  • StakeEvent::Accrual { height, record }, #[non_exhaustive] so Phase 2b StakeInstance variants can land additively.
  • ReorgRewind { fork_height } — drives LedgerIndexes::handle_reorg before per-height events.
  • ScanResult::empty_at(start, parent_hash) for the nothing-changed-at-tip case and tests.

  The companion Engine::apply_scan_result(&mut self, ScanResult) -> Result<(), RefreshError> lives in engine::merge and is the only audited code path that mutates the scanner-derived slice of WalletLedger plus LedgerIndexes during refresh. It enforces two snapshot-consistency invariants before applying any events, rejecting with RefreshError::ConcurrentMutation on either failure:

  1. Start-height equality. processed_height_range.start must equal synced_height + 1 (or fork_height when reorg_rewind is present, since the rewind sets synced_height to fork_height - 1 first).
  2. Parent-hash chain. parent_hash must match LedgerBlock::block_hash_at(start - 1), with None matching None at genesis (start == 1).

  The merge runs in a fixed order: optional reorg rewind first, then per-height ingest (process_scanned_outputs + detect_spends) driven by block_hashes so synced_height advances exactly once per scanned block — even when the block had no events — then staker-pool aggregate events. Engine<S> now carries indexes: LedgerIndexes as a direct field so the merge can mutate both the persisted LedgerBlock (via WalletLedger.ledger) and the runtime indexes under a single &mut self borrow without needing an inner lock. The full merge body is exposed pub(crate) as apply_scan_result_to_state(&mut LedgerBlock, &mut LedgerIndexes, ScanResult) so tests can drive it without standing up a full Engine<S> (whose lifecycle methods land in a follow-up commit).

  See docs/V3_WALLET_DECISION_LOG.md "ScanResult type" (2026-04-25, crate location: shekyl-engine-core::scan) and "Wallet::apply_scan_result invariants and Wallet-side LedgerIndexes" (2026-04-26).

Changed

• RuntimeWalletState folded into LedgerBlock + LedgerIndexes (Phase 1 runtime_state_audit task). The RuntimeWalletState type and the transitional pub use ... as WalletState re-export are deleted. Its responsibilities split along the persistence boundary:

  • Persisted, on-disk state — transfers, synced_height, reorg_blocks, claim watermarks — was already covered by WalletLedger.ledger (LedgerBlock). Read-only queries (height, transfers, unspent_transfers, staked_outputs, matured_staked_outputs, locked_staked_outputs, claimable_outputs, unstakeable_outputs, spendable_outputs, block_hash_at) and transfer-only mutators (set_staking_info, update_claim_watermark, freeze, thaw, transfer_mut) move to inherent methods on LedgerBlock.
  • Runtime-only derived state — the key_images and pub_keys lookup maps plus the staker_pool accrual aggregate — moves to a new pub struct LedgerIndexes in rust/shekyl-engine-state/src/ledger_indexes.rs. LedgerIndexes is never serialized, has no Serialize / Deserialize derives, and is rebuilt by scanner replay at every wallet open via LedgerIndexes::rebuild_from_ledger. Cross-cutting mutations (ingest_block, mark_spent, unmark_spent, detect_spends, set_key_image, freeze_by_key_image, thaw_by_key_image, handle_reorg, insert_accrual) take &mut self, ledger: &mut LedgerBlock, … so a single call updates ledger and indexes atomically. Invariant: LedgerIndexes is reconstructible from LedgerBlock plus daemon block replay; this is enforced by convention (struct doc-comment) rather than by the type system.

  Live wallet state behind a single mutex is the tuple pub type LiveLedger = (LedgerBlock, LedgerIndexes) in both shekyl-engine-rpc::scanner_state and the (cfg rust-scanner) shekyl-scanner::sync background loop. Scanner-specific behavior that needs Timelocked / RecoveredWalletOutput / BalanceSummary / ClaimableInfo lives in extension traits in shekyl-scanner::ledger_ext (TransferDetailsExt, LedgerIndexesExt, LedgerBlockExt); the canonical shekyl-engine-state crate stays scanner-free. The old shekyl-scanner::runtime_ext and shekyl-scanner::wallet_state modules are deleted.

  See docs/V3_WALLET_DECISION_LOG.md "RuntimeWalletState audit: full fold, derived indexes rebuilt at open" (2026-04-25); the same commit also corrects two errata in that entry: the persisted transfer path is WalletLedger.ledger.transfers (not bookkeeping.transfers), and staker_pool's home on LedgerIndexes is now pinned explicitly.

Documentation

• Performance baseline document restructured for per-bench frozen baselines + §3.3.1 spec amendment + responsibility- allocation and toolchain-bump policies (Stage 0 PR-B). docs/PERFORMANCE_BASELINE.md is rewritten from the Round 4b template stub into the per-bench frozen-baseline shape that docs/design/STAGE_0_HARNESS.md §4.5 operationalizes (one populated section for engine_trait_bench_ledger_synced_height frozen at Stage 0 PR-2's merge SHA; four deferred-bench placeholder sections for engine_trait_bench_ledger_balance, engine_trait_bench_economics_current_emission, engine_trait_bench_economics_parameters_snapshot, and engine_trait_bench_key_account_public_address, each pinned to its introducing per-trait PR per §4.6's per-bench deferred assignment). The new document shape carries: per-bench frozen-baseline source (introducing PR + merge SHA), workload class (per §4.2 hoisting rule), iai-callgrind gate metric (instructions) isolated in its own table from the hardware-dependent informational rows (l1_hits, ll_hits, ram_hits, total_read_write, estimated_cycles), criterion metrics (median_ns, std_dev_ns) with hoisting-rule note, capture-environment cross-reference (env-<short-SHA>), and a cumulative-delta table with one row representing the introducing capture itself. The threshold-of-concern disposition is restated to apply per-bench (cumulative deltas do not sum across benches) and to the iai-instructions gate metric only (criterion median_ns is informational and does not gate). Two new policy sections close gaps surfaced during PR-B drafting: responsibility allocation pins that the PR which pushes cumulative delta past 10% (warn) or 25% (fail) is responsible for the breach regardless of its own per-PR contribution size (closes the slow-bleed failure mode where N PRs each at +9% cumulatively breach +25%); toolchain-bump policy pins that rustc / valgrind / iai-callgrind-runner version changes during Stage 1 trigger a per-bench rebaseline (re-capture each in-scope bench at its introducing PR's tree state under the new toolchain; reset the cumulative-delta column; CHANGELOG entry; the rebaseline commit is itself a non-Stage-1 change and does not count toward any bench's cumulative-delta column). A new in-tree reference capture (docs/benchmarks/reference-captures/stage-0-pr-2-c4c-shekyl_rust_v0.json, with explanatory README) supports PR-B's review-surface verification gate against a stable in-tree artifact rather than a transient GHA artifact path. docs/V3_ENGINE_TRAIT_BOUNDARIES.md §3.3.1 Component 1 is amended to match: replaces the single-SHA / "first Stage 1 PR" / "cumulative-is-sum" framing with per-bench introducing-PR-merge-SHA framing, per-bench cumulative-delta independence, and a §4.5 back-pointer for operational details. The amendment bundles with the PERFORMANCE_BASELINE.md rewrite per the bundling exception codified in §4.6 of the design doc (correction of existing wrong text, fully derived from already-merged design content, ~27 lines within an existing ~36-line component — above the ~15-line soft anchor but below the 50-line "structural rewrite" cutoff, with content qualifying as mechanical-derivation rather than re-framing per the codification's allowance). Numbers and in-tree iai-callgrind snapshot refresh are deferred to Stage 0 PR-2 commit 5 per the framing-vs-numbers split. FOLLOWUPS.md §"V3.0" gets two updates: the existing Stage 1 baseline-measurement row is rewritten to the per-bench framing (replacing the single-SHA / 30-day-tip language with the four-deferred-benches close-condition); a new row tracks the CHANGELOG-backfill discipline gap surfaced during PR-B (PR-A 3d313256c, PR-A-extension 2e5309ad3, and PR-C 93d515123 merged without ## [Unreleased] / ### Documentation entries). The CHANGELOG-backfill row is targeted at V3.0 and can land any time before V3.0 cut.

• engine_trait_bench_ledger_synced_height frozen baseline transcribed (Stage 0 PR-2 commit 5). The validated CI capture values (iai instructions=10, hardware-dependent informational rows l1_hits=16 / ll_hits=0 / ram_hits=2 / total_read_write=18 / estimated_cycles=86, criterion median_ns=0.6221 / std_dev_ns=0.005864) are recorded in docs/PERFORMANCE_BASELINE.md under the bench's frozen-baseline source, gate metric, informational metric, and cumulative-delta tables. The env-0276d210 capture environment is populated with the toolchain (rustc 1.95.0 / cargo 1.95.0 / valgrind-3.22.0 / iai-callgrind-runner 0.16.1) and runner state (AMD EPYC 7763 / Linux 6.17.0-1010-azure) from the GHA workflow_dispatch run 25239954863, one of the three N=3 invariance-verification captures (runs 25239954863, 25239956447, 25239958016) that produced byte-identical iai-callgrind output (±0% variance on the gate metric per STAGE_0_HARNESS.md §4.4 dynamic check). The bench's "frozen at" SHA is the capture SHA 0276d210e (PR-2 commit 4c, post-Q Box<Engine<S>> fixture); the in-tree reference-captures/stage-0-pr-2-c4c-shekyl_rust_v0.json remains the stable artifact citation. The four deferred bench sections (balance, current_emission, parameters_snapshot, account_public_address) are unchanged — each will be populated by its introducing per-trait PR per §4.6's per-bench deferred assignment. Closes Stage 0 PR-2's measurement work.

• Stage 1 trait-boundaries spec, Round 1 draft (docs/V3_ENGINE_TRAIT_BOUNDARIES.md). First draft of the Stage 1 design document called for by the decision-log entry "Engine architecture: actor model with staged migration from composition" (2026-04-27) and the phase_2b_prep_stage_1_trait_boundaries plan. Pins six trait surfaces (KeyEngine, LedgerEngine, RefreshEngine, PendingTxEngine, DaemonEngine, PersistenceEngine), the composition shape (Engine<S, K, L, R, P, D, F> with default type parameters; concrete fields, generic-bounded methods, no Box<dyn>), the per-trait async story, the per-trait error model (per-trait families with a single shared EngineError aggregate), the test boundary unlocked by MockKeyEngine / MockDaemonEngine / etc. (closes today's gap that there is no way to plug MockRpc into start_refresh end-to-end), the Stage 4 transition guarantee (the trait surface in §2 does not change at Stage 4; kameo actors implement the same traits with the same signatures), the Stage 1 migration order (DaemonEngine first to unlock integration tests; LedgerEngine second; the other four in any reviewer-convenient order), and a consolidated 15-item open-questions list as the Round 2 agenda. Markdown-only; no code changes. Per .cursor/rules/20-rust-vs-cpp-policy.mdc, the document runs through 4–6 review rounds against dev before any Rust lands. Round 1 draft only — open questions are written down with tentative answers, not closed.

• Engine binary boundary pinned as pure message-passing (decision log "Engine binary boundary: pure message-passing over shared handle", 2026-04-27). The post-Stage-4 binary boundary in shekyl-engine-rpc is settled as HashMap<EngineId, ActorRef<EngineActor>>, not Arc<RwLock<Engine>>. Per-engine concurrency control is the kameo mailbox; the registry holds actor handles directly. The new entry documents the rationale (Shape B retired the synchronous-blocking caller; actors handle concurrency internally; kameo's API targets the wrapper-free model), the three honest costs (test ergonomics, re-entrancy discipline, pure-CPU operations on the actor-dispatch path), and the resolutions (free-function vs message boundary criterion; cross-leaf immutable-data construction-time pattern with an enumerated immutable-fields list; no-cycle DAG topology; kameo-specific constraints including issue #306 forward-chain avoidance and bounded mailboxes). The same commit amends the prior 2026-04-27 "Engine architecture: actor model with staged migration from composition" entry: the RPC boundary paragraph gains an Update (2026-04-27): supersession block, and Stage 4's description picks up the wrapper removal and the no-cycle-DAG / kameo-constraints / cross-leaf-immutable-data implementation requirements. A FOLLOWUPS entry under V3.0 gates Stage 2 on kameo >= 0.20.0 version pin, MSRV >= 1.88 verification, and a workspace-wide bounded-mailbox default.

• Phase 1 sub-decision log entries appended (Phase 1 decision_log_entries task). Three new dated entries land in docs/V3_WALLET_DECISION_LOG.md to lock the Phase 1 surface decisions whose defaults were taken from the Phase 0 surface_decisions review:

  • "RuntimeWalletState audit: full fold, derived indexes rebuilt at open" — RuntimeWalletState ceases to exist; key_images / pub_keys indexes promote into a pub(crate) LedgerIndexes owned by Wallet, rebuilt from the authoritative ledger at open time, never persisted. Schema unchanged. Closes the runtime_state_audit Phase 1 task and the pub use ... as WalletState transitional alias deletion.
  • "tx_keys storage: persist in TxMetaBlock, never re-derived" — pins the rule that per-tx randomness lives in TxMetaBlock::tx_keys: BTreeMap<TxHash, TxSecretKeys> (already shipped in schema), is never reconstructed from any other state, and that Engine::tx_proof / Engine::reserve_proof (Phase 2) read it by txid lookup with a typed ProofError::TxKeyNotPersisted on miss.
  • "Daemon-side tracing install: shekyl_log_install_tracing_forwarder under shekyl-logging::ffi" — locks the FFI export name, signature (pub unsafe extern "C" fn() -> i32, idempotent, returns typed ALREADY_INSTALLED / NOT_INITIALIZED), home (shekyl-logging::ffi, not shekyl-daemon-rpc::ffi), and the rule that shekyl-daemon-rpc's tracing::* call sites are kept verbatim — the forwarder routes them through shekyl-logging automatically. Closes the docs/FOLLOWUPS.md V3.2 entry "shekyl-daemon-rpc staticlib: tracing::* calls silently dropped" by absorption into the Phase 1 logging deliverable.

  No code changes ship in this entry; each decision is realized by a subsequent Phase 1 commit (the RuntimeWalletState fold is the next task in line per the todo list).

• Engine rename, actor-architecture, and pending-tx protocol decision-log entries appended (2026-04-27). Three new dated entries land in docs/V3_WALLET_DECISION_LOG.md to pin major Phase-2-and-beyond architectural commitments whose rationale must be in tree before the supporting code commits land:

  • "Wallet<S> renamed to Engine<S>: privacy-correct framing for the local artifact" — pins the renaming of the orchestrator type, all related types, all crate paths (shekyl-wallet-core → shekyl-engine-core, shekyl-wallet-file → shekyl-engine-file, shekyl-wallet-state → shekyl-engine-state, shekyl-wallet-rpc → shekyl-engine-rpc, shekyl-wallet-prefs → shekyl-engine-prefs), JSON-RPC method strings (wallet_* → engine_*), CLI subcommand names, file paths (~/.shekyl/wallets/ → ~/.shekyl/engines/), and CLI user-facing language ("engine" used consistently in CLI help text). GUI/mobile user-facing language stays a separate marketing decision deferred to post-V3 user- interaction testing. Domain-primitive crates (shekyl-shard-visual) and binary/product crates remain as- is. The decision is realized by the immediately-following mechanical rename commit on shekyl-core dev.
  • "Engine architecture: actor model with staged migration from composition" — pins the migration of Engine<S> from composition to an actor model with kameo as the framework, over five staged actor builds plus a Stage 1 framework- agnostic preparation pass. Stage 2 introduces kameo and builds KeyEngine first (smallest internal state, cleanest privacy boundary, framework-friction surfaces with bounded blast radius). Stage 3 builds StakeEngine native-as-actor in Phase 2b for consensus-bond responsibilities only. Stage 4 migrates remaining subsystems (DaemonEngine, PersistenceEngine, PendingTxEngine, RefreshEngine, LedgerEngine) one at a time. Stage 5 (V3.x, simulation- gated) builds ArchivalEngine as a sibling to StakeEngine (not a child) for slashing-domain integrity, failure isolation, and the Hayekian shard-market property. The entry pins the locked stage sequence end-to-end, the framework choice (kameo), the privacy benefits realized (view-key vs spend-key separation across actors becomes enforceable), the horizontal-scaling benefits enabled (V4+, stateless actor pools), and the long-tier staker upgradability shape (V5+, signed actor-patch distribution; V3 and V4 use restart-based upgrades). The entry rejects the alternatives explicitly: pure composition (privacy weaker), Stage-1-as-kameo (premature framework lock-in), single-cutover migration (review-undeliverable), ArchivalEngine-as-child-of- StakeEngine (slashing-domain integrity violation).
  • "Pending-tx protocol: two-phase build/submit/discard over single-phase callback" — pins the canonical transaction- sending API as the two-phase pending-transaction protocol (build / submit / discard, with inspect, adjust_fee, sign_partial, aggregate_signatures, export as additional pending-tx operations). The single- phase send(request, confirm_fn) -> Result<TxHash> callback model is rejected. Rationale: explicit lifecycle for multisig and air-gapped signing flows, RPC-friendly across the JSON-RPC boundary, fee-adjustment without rebuild, audit/inspect surface, recovery from partial failure.

  Companion docs/FOLLOWUPS.md updates land in the same commit:

  • V3.0 — Stage 2 KeyEngine migration; Stage 3 StakeEngine native build; Stage 4 remaining-subsystem migrations (DaemonEngine, PersistenceEngine, PendingTxEngine, RefreshEngine, LedgerEngine in suggested order); RPC boundary refinements (idle eviction with TBD-at-implementation rationale, engine_lock JSON-RPC method, multi-engine registry, snapshot reads from LedgerEngine, multi-peer archival routing client surface).
  • V3.1 — sibling resolution entry for the assemble_tree_path_for_output bug, locking the resolution architecture (foundation --no-prune archival as floor; staker-distributed archival via ArchivalEngine as primary path; multi-peer routing against per-block root snapshots). The original bug entry is preserved untouched as historical record.
  • V3.x — Stage 5 ArchivalEngine native build (simulation- gated); no-tradeability invariant codification placeholder cross-referencing docs/V3_SHARD_VISUALIZATION.md and docs/V3_STAKER_ARCHIVAL.md.
  • V4+ — horizontal scaling via stateless actor pools.
  • V5+ — signed actor-patch distribution over staker P2P.

  The 2026-04-25 "Locking discipline: RwLock<Wallet> over RefCell / sharded locks / actor model" sub-section receives a one-line forward-pointer noting that it is partially superseded by the new actor-architecture entry from Stage 2 onward; lock- discipline reasoning still applies during Phase 2b composition.

  This commit is documentation-only. No code, schema, or protocol surface changes here. The mechanical rename commit ships separately as the immediately-following commit on shekyl-core dev; Stage 1 and beyond ship over subsequent PRs per the locked stage sequence in the actor-architecture decision-log entry.

• docs/V3_STAKER_ARCHIVAL.md and docs/V3_SHARD_VISUALIZATION.md added under shekyl-core/docs/ (relocated and rescoped from shekyl-dev/docs/V4_*). Two design documents covering the staker-distributed chain-history archival mechanism and the deterministic shard visualization surface relocate from the shekyl-dev planning workspace to the shekyl-core canonical documentation tree, content-checked to reflect their V3 ship scope rather than the V4 ship scope they originally drafted against. Status blocks at the top of each document pin the new ship target and reference the 2026-04-27 actor-architecture decision-log entry that established ArchivalEngine as a sibling to StakeEngine and shekyl-shard-visual as a domain-primitive library crate. The earlier docs/V4_STAKER_ARCHIVAL.md and docs/V4_SHARD_VISUALIZATION.md copies in shekyl-core/docs/ (added in commit 9dc44687d) are removed in this commit; the V3-named documents are the canonical homes going forward. The companion git rm of the V4-named drafts from shekyl-dev/docs/ ships as a separate commit on shekyl-dev dev that references this commit's shekyl-core SHA.

• Phase 2b prep — Track 1 audit-hygiene pass (2026-04-28). Five small editorial / re-export commits close the loose ends surfaced by the Phase 2a Branch 2 audit before Stage 1 spec work begins. None of the five touch consensus, secret-handling, persisted format, or wire format; they are pure plumbing / docs / re-exports.

  1. shekyl-engine-core crate-root re-exports for Refresh* types. rust/shekyl-engine-core/src/lib.rs now re-exports RefreshHandle, RefreshOptions, RefreshPhase, RefreshProgress, RefreshReorgEvent, and RefreshSummary alongside the RefreshError it already re-exported. Downstream callers (CLI, JSON-RPC server, benches, FFI) no longer have to reach through engine::refresh::*. The engine module itself already re-exported the full set (engine/mod.rs:168–170).

  2. CHANGELOG [Unreleased] editorial sweep — Wallet → Engine running prose. Phase 1 and Phase 2a Branch 1 bullets (lifecycle, pending-tx, scan-result, refresh-driver, struct, module-skeleton) carried Wallet<S> / Wallet::* / OpenedWallet / WalletSignerKind / WalletCreateParams / shekyl_engine_core::wallet::* references that pre-dated the 2026-04-27 rename bullet at the top of [Unreleased]. The sweep normalizes the running prose. Decision-log title citations and the rename bullet's mapping enumeration are intentionally preserved verbatim — the cited docs/V3_WALLET_DECISION_LOG.md entries still carry their historical titles.

  3. docs/FOLLOWUPS.md V3.1 row added — transfer_details Rust migration. .cursor/rules/15-deletion-and-debt.mdc cites transfer_details Rust migration as V3.1 scope; the row now exists. Rewrites each C++ consumer of struct transfer_details (balance, output selection, key-image / spend tracking, payment-id surface, password rotation, persistent wallet-cache I/O) to drive shekyl-engine-state::TransferDetails through FFI, then deletes the C++ struct from src/wallet/wallet2.h and src/wallet/wallet_rpc_server_commands_defs.h. Closes either at V3.1 or by superseding deletion in the V3.2 wallet2.cpp retirement.

  4. docs/FOLLOWUPS.md V3.2 row added — "Re-examine /FIiso646.h and rct:: → ct:: deferrals." Reconciles a dead citation in docs/STRUCTURAL_TODO.md:17–18, 37–38. Both deferrals rest on the same upstream-cherry-pick-risk framing the STRUCTURAL_TODO calls "largely notional"; the V3.2 row pins per-item disposition rules (/FIiso646.h: /permissive- vs. mechanical replacement vs. stay-on-workaround; rct::→ct::: confirm or compress the V4 target).

  5. Engine::refresh cancellation contract pinned in the docstring at rust/shekyl-engine-core/src/engine/refresh.rs (lines 1815–1827 in the pre-edit revision). Sync path stays cancel-internal (the token is created fresh per call and never fires); async path (Engine::start_refresh returning RefreshHandle) owns cooperative cancellation. The split is deliberate, not a TBD: threading a token through every sync caller is design churn for no win, and the async surface already exists for callers that need shutdown.

  Audit reference: .cursor/plans/phase_2b_prep_stage_1_trait_boundaries_0d37a30e.plan.md Track B items 1–5. Track 2 (Stage 1 trait-boundaries spec, V3.2) begins after this hygiene pass lands.

Removed

• shekyl-scanner::sync module and shekyl-scanner::rust-scanner Cargo feature retired (Phase 2a refresh_scan_loop bundle, Branch 1). The standalone background-sync surface (run_sync_loop, LiveLedger, SyncProgress, SyncError) and its feature flag are deleted in favor of the shekyl-engine-core::Engine::refresh driver. shekyl-scanner becomes a pure scanning library — Scanner, extra-field parsing, KEM rederivation, the LedgerBlock / LedgerIndexes extension traits, balance, and coin selection — and drops its tokio / tokio-util optional dependencies along with the feature. shekyl-engine-rpc::rust-scanner is not affected by this change; that feature gates a JSON-RPC-side (LedgerBlock, LedgerIndexes) cache (scanner_state::LiveLedger, a local type alias unrelated to the deleted scanner-side alias) which retires in Phase 4b alongside shekyl-engine-rpc's Rust cutover. See docs/V3_WALLET_DECISION_LOG.md "Retire shekyl-scanner::sync::run_sync_loop (Phase 2a/4b boundary)" (2026-04-27) for the rationale and Phase boundary. The sync_bookkeeping test module in shekyl-scanner is retained: it exercises the (LedgerBlock, LedgerIndexes) state-management primitives (progress monotonicity, reorg handling, spend-detection tracking) that the producer side of Engine::refresh now drives, and remains load-bearing regardless of who owns the outer loop.

• rust/shekyl-ffi/src/wallet_ledger_ffi.rs deleted as a Phase 5 pre-emption. The typed cache-handle FFI surface from sub-commit 2l.a — ShekylTransferDetailsC / ShekylBlockchainTipC / ShekylReorgBlockEntryC / ShekylSubaddressRegistryEntryC / ShekylSubaddressLabelEntryC / ShekylAddressBookEntryC / ShekylTxKeyEntryC / ShekylTxNoteEntryC / ShekylTxAttributeEntryC / ShekylScannedPoolTxEntryC / ShekylSyncStateScalarsC and their shekyl_wallet_{get,set,free}_* trios plus shekyl_wallet_ledger_preflight — is gone. The corresponding declarations in src/shekyl/shekyl_ffi.h are stripped; the reserved SHEKYL_WALLET_ERR_BLOCK_NOT_HYDRATED (codepoint 29) retires alongside the surface that produced it. save_as (the in-scope C-ABI export from wallet_file_ffi.rs) and its refusal codes (SAVE_AS_CROSS_FILESYSTEM / SAVE_AS_TARGET_EXISTS) remain unchanged. The shekyl-primitives main- and dev-dep are also removed from rust/shekyl-ffi/Cargo.toml; the only consumer was the deleted file's Commitment reconstruction path.

  Caller evidence (commit message body). Pre-flight git grep against *.cpp / *.cc / *.h / *.hpp for every export of the deleted surface returned only src/shekyl/shekyl_ffi.h itself (the prototypes that this commit removes). Zero .cpp consumers ever materialized — the original consumer (wallet2_handle_views.h/.cpp) was scheduled but never written, and Phase 5 will delete the enclosing wallet2.cpp shim wholesale. Full git grep transcript pinned in the deletion commit's message body for reproducibility.

  Decision rule. This deletion establishes the Phase 5 pre-emption rule in docs/V3_WALLET_DECISION_LOG.md: an individual Phase 5 inventory item may be deleted early when (1) zero current .cpp callers, (2) grep evidence in the deletion commit's message body, and (3) atomic update of docs/FOLLOWUPS.md / Phase-5-inventory metadata in the same commit. Pre-empting items with surviving callers is not acceptable. The Decision Log entry locks the rule so future pre-emptions follow a precedent rather than an ad-hoc precedent.

  Inventory hygiene. docs/FOLLOWUPS.md (sub-bullet "Phase 5 inventory pre-emptions" under the wallet2.cpp absorption entry) records this file as already pre-empted; the eventual Phase 5 commit's deletion list excludes it. The pre-existing clippy lints in the now-deleted file (as u8 casts, explicit iter() loop, _keep_imports arg count) close by absorption — the file holding them no longer exists.

Changed

• Subaddress namespace flattened to SubaddressIndex(u32) across the wallet stack and the typed-ledger FFI surface (Phase 1 of the shekyl-v3-wallet-rust-rewrite plan, primitives task). SubaddressIndex is now a u32 newtype with index == 0 reserved for the primary address; the legacy {account, address} pair is gone everywhere — WalletLedger, BookkeepingBlock::subaddress_registry / subaddress_labels.per_index, scanner outputs, transfer records, RuntimeWalletState::filter, and the typed-ledger FFI in rust/shekyl-ffi/src/wallet_ledger_ffi.rs. Account-level concepts inherited from wallet2 (AccountTags, the tag_descriptions / account_tags FFI trios) are removed wholesale; the Decision Log entry "Subaddress hierarchy: flat, no account level" pins the rationale (most users use one account; account-level tags were wallet2 baggage; multi-wallet-file isolation is genuinely stronger than account-level subaddresses). A separate SubaddressLabels::primary slot is gone too — the primary label is the index == 0 entry of per_index like every other label.

  FFI surface delta (this commit). shekyl_ffi.h mirrors the Rust: ShekylSubaddressRegistryEntryC and ShekylSubaddressLabelEntryC carry a single index: u32 field (sizes 36 and 24 respectively, no trailing pad — there are zero .cpp callers in tree, so preserving the legacy stride for hypothetical future callers would be a defensive measure for nobody); the ShekylTagDescriptionEntryC / ShekylAccountTagAssignmentEntryC typedefs and their static_asserts, plus the shekyl_wallet_{get,set,free}_{tag_descriptions,account_tags,primary_label} prototypes, are removed. The FFI file wallet_ledger_ffi.rs itself is scheduled for outright deletion in the immediate follow-up commit (Phase 5 pre-emption); this commit lands the field-rename half of the migration so the deletion commit is a one-concern review.

  Behavioral delta. shekyl_wallet_set_subaddress_registry now rejects an entry with index == 0 by returning SHEKYL_WALLET_ERR_LEDGER. The primary address is reconstructed from the wallet keys at every load and is not registry-managed; an attempted insert at index 0 is structurally impossible rather than benign overwrite. wallet2 silently accepted such inserts; the V3 surface fails loudly. Belt-and-suspenders unit test wallet_ledger_ffi::tests::registry_set_rejects_index_zero pins the contract.

  On-disk schema. All three persisted-block version constants are bumped from 1 to 2: BOOKKEEPING_BLOCK_VERSION (the direct field-shape changes — subaddress_registry / subaddress_labels.per_index flatten and account_tags removal), LEDGER_BLOCK_VERSION (transitive — every TransferDetails in LedgerBlock::transfers now carries the flattened newtype), and WALLET_LEDGER_FORMAT_VERSION (transitive — the bundle's serialized bytes shift wherever any nested SubaddressIndex or SubaddressLabels appears). The strict pairing of "snap drift ↔ paired version-constant bump" is enforced by the ci/schema-snapshot workflow per docs/MID_REWIRE_HARDENING.md §3.4 and .cursor/rules/42-serialization-policy.mdc; the gate caught the original commit shipping only the bookkeeping bump, and the missing two were folded in atop the existing branch rather than rewriting history. Legacy v1 ledgers have no live readers — pre-V3 launch, rm -rf ~/.shekyl is the migration path per .cursor/rules/15-deletion-and-debt.mdc. The bookkeeping_block.snap / ledger_block.snap / wallet_ledger.snap schema fixtures are regenerated; the SubaddressIndex shape went from a two-field struct to a NewtypeStruct(u32), and BookkeepingBlock::account_tags is gone.

  JSON shape factoring. Transfer records expose subaddress indices as {"index": u32} (bare form, no label); address-list responses expose them as {"index": u32, "label": Option<String>} (joined form, label looked up at handler time). Decision Log entry "Subaddress JSON shapes: two schemas, no label join in transfer records" pins the factoring for Phase 4b OpenAPI work.

Added

• shekyl-engine-core::Engine<S> struct + DaemonClient thin wrapper (Phase 1 of the shekyl-v3-wallet-rust-rewrite plan, cross-cutting locks 1, 3, 4 type-layer realization). Lands the Engine<S: EngineSignerKind> struct itself with its full dependency graph wired in: file: shekyl_engine_file::WalletFile, keys: shekyl_crypto_pq::account::AllKeysBlob, ledger: shekyl_engine_state::WalletLedger, prefs: shekyl_engine_prefs::WalletPrefs, daemon: DaemonClient, network: Network, capability: Capability, plus _signer: PhantomData<S> for compile-time signer-kind dispatch. network and capability are cached from WalletFile's region 1 (which is write-once after create) so the hot accessors are infallible and O(1). Read-only accessors (network(), capability(), file(), ledger(), prefs(), daemon()) plus a pub(crate) keys() for in-crate sign / proof code paths. Redacted Debug impl: keys prints as <redacted: AllKeysBlob>, ledger / prefs print as <…>, file and daemon delegate to their own already-redacting impls. No Drop impl on Engine<S> itself: AllKeysBlob and WalletFile each ship their own Drop for the secret bytes / KEK / advisory lock; composing types that already wipe correctly is sound, and a wrapper Drop would risk shadowing the inner ones. New DaemonClient thin wrapper around shekyl_simple_request_rpc::SimpleRequestRpc insulates Engine's public API from the transport choice and gives Phase 2a a single audited site for get_info network verification, get_fee_estimates fee-priority resolution, and tx submission. The six lifecycle methods (create, open_full, open_view_only, open_hardware_offload, change_password, close), RefreshHandle, PendingTx, and ScanResult each land in their own follow-up commits on this same Phase 1 branch. Cargo dependency graph: shekyl-crypto-pq is now a non-optional dependency of shekyl-engine-core (the multisig feature flag previously gated it; with keys: AllKeysBlob on the struct it is mandatory regardless of feature). Full rationale and field-by-field justification recorded in docs/V3_WALLET_DECISION_LOG.md §"Wallet<S> struct shape and accessor surface".

• shekyl-engine-core::engine module skeleton (Phase 1 of the shekyl-v3-wallet-rust-rewrite plan, cross-cutting locks 2, 4, 5, 6, 7, 8 type-layer realization). New module rust/shekyl-engine-core/src/engine/ ships the type-layer foundations of the V3 wallet orchestrator without yet introducing the Engine struct itself: per-domain error enums (OpenError, RefreshError, SendError, PendingTxError, KeyError, IoError, TxError) with the plan-locked variants pinned by name (OpenError::NetworkMismatch, RefreshError::ConcurrentMutation, PendingTxError::TooOld, PendingTxError::ChainStateChanged, TxError::DaemonFeeUnreasonable, etc.); a re-export of shekyl_address::Network (the fourth Fakechain variant lands in a separate scoped commit on the same branch); a re-export of shekyl_engine_file::Capability (canonical spelling — the plan's "CapabilityMode" reference is satisfied); and a sealed EngineSignerKind trait with SoloSigner ZST as the V3.0 default. V3.1's MultisigSigner<N, K> will join behind the existing multisig Cargo feature without changing call sites. #[from] impls for upstream errors (WalletFileError, CryptoError, WalletLedgerError, etc.) are deliberately deferred to the lifecycle / refresh / send commits that introduce the call sites needing them, so an #[from] impl never exists without a caller. Full rationale recorded in docs/V3_WALLET_DECISION_LOG.md §"Per-domain Wallet error enums + sealed WalletSignerKind".

• shekyl-engine-state::LocalLabel and SecretStr<'a> (Phase 1 of the shekyl-v3-wallet-rust-rewrite plan, cross-cutting lock 9 type-layer realization). Locally-sensitive UTF-8 wrappers for every user-supplied string the wallet persists but never transmits — address-book descriptions, subaddress labels, transaction notes. LocalLabel is Zeroizing<String> with redacting Debug / Display ("<redacted N bytes>"); no derived Serialize / Deserialize. Persistence routes through the explicit serde_helpers::local_label adapter, which is wire-byte-identical to a plain String (test serde_helpers::tests::local_label_postcard_wire_matches_plain_string pins this), so the upcoming bookkeeping_block / tx_meta_block retypes will not bump BOOKKEEPING_BLOCK_VERSION or TX_META_BLOCK_VERSION. Borrowed in-process inspection goes through LocalLabel::expose() -> SecretStr<'_>, whose only Display / Debug output is the redaction marker; callers that need raw bytes call SecretStr::as_str() explicitly so the call site is the audit point. Full rationale (including why the value-typed SecretStr<'a> shape rather than the literal &SecretStr shorthand from the decision log — unsafe_code is forbidden workspace-wide) recorded in docs/V3_WALLET_DECISION_LOG.md §"LocalLabel / SecretStr typing for locally-sensitive UTF-8".

Changed

• monero-oxide vendor-bump 87acb57 → 3933664 (PR 0.6 of the shekyl-v3-wallet-rust-rewrite plan, closing Operation A of the monero-oxide un-pin question). Updated rust/shekyl-oxide/UPSTREAM_MONERO_OXIDE_COMMIT from 87acb57e0c3935c8834c8a270bd3bdcbbe36bcde (sync_date 2026-04-06) to 3933664d0851871c976f07298b862373d1c6fec0 (sync_date 2026-04-25), the current Shekyl fork tip on Shekyl-Foundation/monero-oxide fcmp++. No vendored source files changed. Of the five fork commits between the two pins, the only ones with code-content deltas (182b648 Cargo profiles + base58 decoder hardening) touched shekyl-oxide/wallet/base58/, a Monero-shaped wallet path that is not vendored in shekyl-core per 60-no-monero-legacy.mdc — Shekyl uses native Bech32m via shekyl-address instead. The umbrella shekyl-oxide/Cargo.toml is byte-identical between the vendored copy and fork tip; 182b648's Cargo profile changes live in the fork's workspace-root Cargo.toml, which we do not vendor either. Workspace grep for monero_base58 | shekyl-oxide.*base58 | ::base58:: returns zero matches across rust/, confirming that shekyl-address (Bech32m via the bech32 crate) and no other Shekyl crate imports the fork's base58 module. The hardening itself is strictly more restrictive — checked_add overflow detection plus non-canonical-encoding rejection — so even a hypothetical downstream consumer would only see additional None returns, never different Some(_) payloads. Verification per docs/SHEKYL_OXIDE_VENDORING.md: cd rust && cargo build --locked -p shekyl-fcmp clean, cd rust && cargo test --locked --workspace 900 passed, 0 failed, 6 ignored (exit 0). ninja shekyld skipped because PR 0.6 does not touch the C++ side and docs/SHEKYLD_PREREQUISITES.md already certifies the C++ daemon as ready. The .github/workflows/shekyl-oxide-divergence.yml CI guard now compares against the new pin and reports zero divergence until the fork advances again. Operation B (40-commit fork ↔ upstream merge, including the cypherstack generalized-bulletproofs-fix audit response and the Veridise HelioseleneField::invert correctness cluster) remains a separate V3.1.x follow-up per docs/FOLLOWUPS.md § "V3.1+ — Legacy C++ → Rust rewrite scope" and is unaffected by this PR. Half-day review gate (PR 0.4 / 0.5 findings, FOLLOWUPS V3.1+ rewrite interactions, cross-cutting locks confirmation, un-merged-upstream impact on Phase 1 Wallet API shape) cleared cleanly before this PR; conclusions recorded in docs/V3_WALLET_DECISION_LOG.md. With PR 0.6 merged, Phase 0 of the V3 wallet rewrite is complete (six PRs for six PRs); Phase 1 (Wallet API + cross-cutting locks) is now unblocked. Audit doc docs/MONERO_OXIDE_VENDOR_STATUS.md amended with a "PR 0.6 vendor-bump execution (2026-04-25)" section recording the metadata-only finding so future readers don't replay the base58-content review against vendored paths that don't have it.

• shekyl-engine-file::WalletFileHandle → WalletFile (PR 0.2 of the shekyl-v3-wallet-rust-rewrite plan). Mechanical rename across all call sites in shekyl-engine-file, shekyl-engine-prefs, shekyl-ffi, and the C FFI doc-comment in src/shekyl/shekyl_ffi.h. No ABI change (the C-ABI symbols use the shekyl_wallet_* prefix, not the Rust type name). Frees the Engine identifier for the Phase 1 shekyl-engine-core::Engine orchestrator and aligns the file-orchestrator type name with what it actually is — envelope, atomic IO, advisory locking, payload framing. Rationale and decision archive in docs/V3_WALLET_DECISION_LOG.md ("Wallet stack greenfield Rust rewrite", 2026-04-25).

Documentation

• shekyld Phase 0 prerequisites audit (PR 0.3 of the shekyl-v3-wallet-rust-rewrite plan). New file docs/SHEKYLD_PREREQUISITES.md consolidating the audit of three daemon-side prerequisites against the rewrite plan's later phases:

  1. Instant-mining regtest mode (Phase 6 prereq): PRESENT — --regtest --offline --fixed-difficulty 1 + generateblocks JSON-RPC works as inherited from Monero; V3-specific caveats documented (FCMP++ tx-type and curve_tree_root header checks bypassed on FAKECHAIN, reference-block age rules still enforced). No daemon change required.
  2. get_fee_estimate(s) RPC (Phase 2a prereq): PRESENT as singular get_fee_estimate returning a positional 4-element fees vector matching HF 2021-scaling tiers; no name-keyed buckets on the wire — priority-name binding is wallet-side. Decision-log entry adjusted: wallet supplies the names, daemon supplies the numbers. No daemon change required.
  3. Fee policy / rules version exposure: ABSENT entirely — no fee_version / fee_policy_id on get_fee_estimate, on get_info, or as a separate RPC. Filed as a V3.1 daemon-side follow-up; not a Phase 0 blocker. The rewrite's Phase 2a builds a forward-compatible client that consumes the field gracefully if it appears later.

  Phase 6 and Phase 2a unblocked against the existing daemon surface.

• monero-oxide vendor freshness audit (PR 0.4 of the V3 wallet rewrite plan, docs/MONERO_OXIDE_VENDOR_STATUS.md). Point-in-time (2026-04-25) record of where the vendored shekyl-oxide snapshot (87acb57e) sits relative to the Shekyl fork tip (Shekyl-Foundation/monero-oxide fcmp++ 3933664d, +5 commits, all non-crypto) and the original upstream (monero-oxide/monero-oxide fcmp++ 0e438ae, +40 commits since the 2025-11-22 merge base, including the cypherstack generalized-bulletproofs-fix audit response, the Veridise HelioseleneField::invert correctness cluster, and a major upstream restructure that the fork has not adopted). The doc is a freshness audit only — it does not re-vendor or un-pin. The actual un-pin / merge-from-upstream operation is a separate plan; this audit produces its input queue (substantive upstream commits the fork is missing) and baseline (the eight Shekyl-only fork commits, of which only 416d8d1 rename and 87acb57 extra leaf scalars are crypto-substantive). Audit lifecycle: append-only — refresh runs add a new dated section rather than editing in place, so the rewrite plan's Phase 0 record stays intelligible after the un-pin lands.

• Mid-rewire hardening plan (docs/MID_REWIRE_HARDENING.md) amended in §3.1 and §4.3. §3.1 updated to reflect the architecturally honest scope for the C++ baseline capture: path relocated to tests/wallet_bench/ (repo convention for benchmarks; src/ is product code), coverage reduced to three of the Five with explicit per-benchmark C++/Rust availability table and the daemon-coupling rationale spelled out for the two Rust-only paths (scan_block_K, transfer_e2e_1in_2out). §4.3 gained a "Benchmarks Rust-only by necessity" subsection capturing the asymmetry so the bench-comparison script (§3.3) and the PR-comment format can handle it deterministically rather than treating missing C++ numbers as a regression. The acknowledgment is explicit: two paths have no pre-deletion C++ baseline and will never have one; regression detection across the rewire for those paths relies on the Rust rolling baseline plus human order-of-magnitude sanity, not on a pre-deletion comparator.

• Mid-rewire hardening plan (docs/MID_REWIRE_HARDENING.md). New design spec pinning the eight-commit instrumentation pass that lands between the Rust-side wallet-file FFI (commits 2a…2k.4, merged) and the C++ consumer rewire (commits 2k.5a onward, deferred). Covers: Google Benchmark C++ baseline capture against the existing wallet2.cpp hot paths; criterion + iai-callgrind Rust benchmark harness mirroring the same five paths; GitHub Actions CI integration with bidirectional thresholds for crypto_bench_* (any drift is suspicious — constant-time property defense) and slowdown-only thresholds for hot_path_bench_*; rolling baseline on a dedicated bench-baseline branch; postcard-schema snapshot files with CI-enforced block_version bump on every drift; ripgrep + allowlist secret-wipe discipline for shekyl-engine-state blocks; WalletLedger::check_invariants() with five cross-block tripwires and a new WalletFileError::InvariantFailed { invariant, detail } variant; adversarial wallet-file corpus covering the three capability- mode attack shapes (tamper-in-place, declared-FULL-with-VIEW_ONLY- shape, declared-VIEW_ONLY-with-trailing-bytes); proptest fuzz harness on stable plus checked-in (non-CI) cargo-fuzz targets. Also captures the dual-path output-equivalence requirement for 2k.5b…2l as a structural commit-message template line, not a reviewer convention. No code or CI changes in this commit — spec only; the eight follow-up commits each cite a section.

Added

• Mid-rewire benchmark warning window (commit 2k.c of the wallet-state-promotion plan, docs/MID_REWIRE_HARDENING.md §3.3.1). Closes the structural-noise loophole that the 2k.a / 2k.b dual-stack rewire would otherwise punch through the ci/benchmarks gate. New sentinel file docs/benchmarks/MID_REWIRE_WARNING_WINDOW.active toggles warning-only mode — when present, the fail job on threshold trip step in .github/workflows/benchmarks.yml downgrades the would-be ::error:: annotation to a ::warning:: and exits 0, preserving the upstream compare / PR comment / profile-on-fail observability chain without blocking merges. Policy paragraph in MID_REWIRE_HARDENING.md §3.3.1 pins why the window is needed (pre-rewire baseline vs. post-rewire gate calibration vs. structurally-slower-during-dual-stack middle state), how the sentinel beats workflow-level flags / Actions secrets / branch-name matching on grep discoverability and git-authored toggle trail, and when it must close (2m-cache commit, with a mandatory post-rotation of bench-baseline). The sentinel path is included in the workflow's paths: filters for both pull_request and push triggers, so opening and closing the window self-triggers the gate. Reviewers still see every delta and every samply profile during the window; what they lose is the automated merge block, which would otherwise fire on structural noise the rewire is expected to produce.

• 2k.b — refuse legacy store_keys writes on SHKW1 wallets (commit 2k.b of the wallet-state-promotion plan, .cursor/plans/wallet-state-promotion_ab273bfe.plan.md §2k.b). Installs the keys-layer fault line in wallet2::store_to so SHKW1-backed wallets cannot silently corrupt their on-disk file by falling back to the legacy store_keys JSON path. The two triggers that would otherwise reach the legacy save branch — save-as (path differs from the current m_wallet_file) and password change (force_rewrite_keys=true, as routed from wallet2::change_password) — now throw a typed tools::error::wallet_shkw1_operation_unsupported before any wallet-state mutation (no trim_hashchain cache touch, no prepare_file_names path rewrite, no cache serialization). Both flows require FFI that doesn't exist yet (shekyl_wallet_save_as, shekyl_wallet_rotate_password) and land in 2l alongside the cache-side rewire. The common store() → store_to("", "") path (same file, no forced keys rewrite) is not refused — it never touches the keys file, and its cache save still works through the legacy shekyl_encrypt_wallet_cache path until 2l. Callers audited: wallet2::change_password (exposed via wallet2_ffi.cpp and wallet_rpc_server.cpp) and direct store_to(path, pw) invocations in tests/wallet_bench/ and tests/unit_tests/wallet_storage.cpp — all refused for SHKW1-backed wallets during the 2k.a → 2l window, revalidated in the rewrite-testing phase. wallet_errors.h hierarchy extended with the new wallet_logic_error subclass carrying both the operation name and the keys file path for UX rendering. Verified locally: full shekyl-core C++ rebuild clean across wallet, daemon, shekyl-engine-rpc, unit_tests, core_tests, functional_tests; no new lints introduced.

• 2k.a — rewire wallet2 load/verify/rewrite onto the SHKW1 handle (commit 2k.a of the wallet-state-promotion plan, .cursor/plans/wallet-state-promotion_ab273bfe.plan.md §2k.a). The keys-side half of the wallet2 → Rust rewire. wallet2::load_keys now magic-sniffs via shekyl_wallet_keys_inspect; on an SHKW1 match it routes through shekyl_wallet_open, gates before any secret material leaves Rust on capability (tools::error::wallet_keys_unsupported_capability) and derivation network (tools::error::wallet_keys_wrong_network), then extracts only the 64-byte master seed into a scrubbing file-local TransitionalRederivationInputs RAII wrapper (epee::mlocked<tools::scrubbed_arr<uint8_t, 64>>). m_account.load_from_shkw1 rebuilds every derived field (classical SK/PK, view SK/PK, ML-KEM decap key, account address) from the seed; m_account.forget_master_seed immediately scrubs the C++ copy (Option β — the ShekylWallet handle is the single in-memory source of truth for the master seed post-load). An AAD-bound address-match sanity check against ShekylWalletMetadata::expected_classical_address catches corruption, HKDF policy drift, and handle-repoint bugs via a distinct tools::error::wallet_keys_aad_address_mismatch; init_type and set_createtime land atomically with the handle-stash on m_shekyl_wallet. wallet2::load_keys_buf refuses SHKW1 inputs with error::wallet_internal_error — the envelope requires the file-lock path and cannot be driven through a raw buffer. Both verify_password overloads route SHKW1 verification through shekyl_wallet_keys_open with a sizing probe for the capability payload; the instance overload runs the same address-match sanity check against the opened handle's metadata so a future migration tool that repoints m_keys_file without re-opening the handle surfaces as a typed error rather than silently returning keys from the wrong handle. The static overload logs an L1 warning if a caller passes no_spend_key=false (no in-tree caller does today; the log guarantees any future regression trips test output). wallet2::rewrite becomes a logged L1 no-op for SHKW1 wallets — settings writes land in 2k.b's store_to rewire. wallet2::deinit resets m_shekyl_wallet before m_account.deinit() so the Rust handle's final state write runs while C++ secrets are still live, and the C++ wipe happens after the handle drops. Three new typed refusals in src/wallet/wallet_errors.h discriminate structural failure modes (wrong network vs. AAD-bound cryptographic inconsistency vs. unsupported capability) so CLI, wallet RPC, and tests can render targeted messages without parsing log strings. Security invariants: the 64-byte master seed lives in C++ only for the duration of load_from_shkw1, under mlock; the address-match check fires before any scalar is materialized in C++; xor_with_key_stream / rederive_from_master_seed / decrypt are all length-gated, so the post-scrub empty vector state is a no-op everywhere it's read. Verified locally: full shekyl-core C++ rebuild clean across wallet, daemon, shekyl-engine-rpc, unit_tests, core_tests, functional_tests; cargo check -p shekyl-engine-file -p shekyl-ffi clean. Test regeneration / wallet2 fixture migration deferred to the rewrite-testing phase per the user-approved scope split.

• Region-2 parser fuzz harnesses (commit 8 of the mid-rewire hardening pass, docs/MID_REWIRE_HARDENING.md §3.8). Closes the gap the adversarial corpus (commit 7) structurally cannot cover: the corpus pins specific typed refusals against specific malformations it was written to check, which says nothing about byte patterns nobody thought to enumerate. New rust/shekyl-engine-state/tests/fuzz_region2.rs is a stable-Rust proptest harness that drives randomized input into WalletLedger::from_postcard_bytes — the canonical region-2 decoder used by the wallet-file orchestrator — and asserts the single load-bearing property: the parser never panics and always terminates with a typed result (either Ok, or one of the four enumerated WalletLedgerError variants). Five strategies at 128 cases each cover every relevant mutation shape: point mutation of a valid empty bundle, truncation, random byte insertion, random byte deletion, and entirely-random bytes up to 4 KiB. The error-classification match in assert_typed_or_ok is deliberately exhaustive with distinct classification tags per arm, so adding a new WalletLedgerError variant without updating the harness is a compile-time error — the harness stays in lockstep with the error taxonomy mechanically rather than culturally. Total wall-clock is ≈0.06 s per run (three orders of magnitude under the plan's 30 s-per-PR exit criterion); cases = 640 total (128 × 5), comfortably inside the plan's ~500-iteration budget. Companion local-only coverage-guided harness at rust/shekyl-engine-state/fuzz/: a minimal fuzz_target! wrapping let _ = WalletLedger::from_postcard_bytes(data), excluded from the workspace via new exclude = ["shekyl-engine-state/fuzz"] in rust/Cargo.toml so stable CI never tries to resolve libfuzzer-sys. Runnable locally with cargo +nightly fuzz run region2_parser; its README documents the two-condition graduation plan (nightly stabilisation OR mainnet-freeze proximity) and why nightly is not in CI today. The harness is kept trivial by design so that it cannot itself panic and mask a parser regression. Verified locally: 96 existing shekyl-engine-state unit tests remain green; 5-test proptest harness passes in 0.06 s; cargo check --workspace --tests on stable ignores the fuzz crate entirely; clippy is clean with -D warnings; fmt is clean.

• Adversarial wallet-file corpus (commit 7 of the mid-rewire hardening pass, docs/MID_REWIRE_HARDENING.md §3.7). Locks in the "every layer refuses with a typed error, not a panic or a silent fallback" posture at the integration boundary. New rust/shekyl-engine-file/tests/adversarial_corpus.rs drives 16 programmatic attack shapes through WalletFile::open and asserts the exact WalletFileError variant each one must surface: envelope header attacks on .wallet.keys (wrong magic → UnknownMagic, truncated header → FileTooShort, file_version = 0xFF → FormatVersionTooNew, region-1 ciphertext bit flip → InvalidPasswordOrCorrupt); envelope header attacks on .wallet (wrong magic, future state_version, region-2 ciphertext bit flip → StateSeedBlockMismatch as currently mapped, cross-wallet companion swap → StateSeedBlockMismatch); SWSP frame attacks (BadMagic, UnsupportedPayloadVersion, BodyLenMismatch); WalletLedger body attacks (bundle format_version bump → UnsupportedFormatVersion, per-block block_version bump → UnsupportedBlockVersion, truncated postcard → Postcard); the cross-block invariant gate from commit 6 (INV_TX_KEYS_NO_ORPHANS → InvariantFailed); and a wiring assertion that capability-shape mismatches (plan rows B / C) flow through the existing envelope-level CapContentLenMismatch { mode, len } variant unchanged — the plan's proposed new CapabilityPayloadMismatch was dropped on review because validate_cap_content in shekyl-crypto-pq::wallet_envelope already enforces the entire intended (mode, cap_content_len) shape, and adding a second variant with identical semantics would duplicate the gate. The corpus is programmatic rather than binary-pinned: each test builds a real wallet pair via WalletFile::create(...), then performs narrow byte surgery (on ciphertext-protected regions via the public shekyl_crypto_pq::wallet_envelope::seal_state_file helper) so it stays green across future format-field renames and AEAD parameter changes. New docs/WALLET_FILE_FORMAT_V1.md §2.5 writes up the capability decode posture the corpus enforces — mode first, then cap_content_len, then per-capability interpretation, each step refusing rather than tolerating — so reviewers encountering a "why no new variant?" test can follow the trail. New rust/shekyl-engine-file/tests/fixtures/adversarial/ holds a README + one .md per attack row documenting the construction and the rationale behind each typed refusal (including the deliberate region-2-bit-flip → StateSeedBlockMismatch collapse rather than InvalidPasswordOrCorrupt, which the envelope cannot distinguish from a seed-block-tag mismatch without running the full region-2 verification twice). Verified locally: all 16 corpus tests pass; the rest of the shekyl-engine-file suite remains green; clippy clean with -D warnings; fmt clean.

• WalletLedger::check_invariants() aggregator-level gate (commit 6 of the mid-rewire hardening pass, docs/MID_REWIRE_HARDENING.md §3.6). Closes the gap that neither single-block schemas (commit 4) nor the zeroizing-field grep (commit 5) structurally cover: a .wallet bundle whose every block decoded cleanly and whose every field is correctly wrapped can still be semantically impossible (a scanner tip below a recorded transfer; a key image shared between two transfers; an orphan per-tx secret whose transaction has been garbage-collected from every live reference). New rust/shekyl-engine-state/src/invariants.rs owns the closed set of five cross-block invariants with stable machine-readable names: tip-height-not-below-transfer, tx-keys-no-orphans, subaddress-registry-dense, reorg-trail-monotonic, spent-state-consistent. Each check is O(n) in the number of transfers or map keys with a single HashSet<[u8; 32]> allocation, well under 100 µs for a 10 k-transfer bundle. New WalletLedgerError::InvariantFailed { invariant, detail } variant carries the stable name plus a pointed diagnostic ("missing minor index 3 in [1, 4]" rather than "file is corrupt"), which flows through shekyl-engine-file's WalletFileError::Ledger by existing #[from]. Two call sites wire the checks in: WalletLedger::from_postcard_bytes runs them after the per-block version gates pass (typed refusal on load), and WalletLedger::preflight_save runs them ahead of every save_state in shekyl-engine-file/src/handle.rs — debug_assert! in debug so a runtime-induced invariant break aborts tests loudly, typed Err in release so a user save never panics mid-write. Two invariants (subaddress density, key-image uniqueness) replace the plan's §3.6 spent_images and transfer_index proposals with shapes that match the actual blocks (BookkeepingBlock::subaddress_registry and TransferDetails::key_image — there is no separate spent-image set and no transfer-index join); the plan explicitly sanctions such adjustment on landing, and the machine-readable names are chosen to outlive any future shape refactor. Verified locally: 16 unit tests (one positive + at least one negative per invariant, plus alternate reference paths for I-2 proving a pool- or pending-referenced tx passes) all pass; the pre-existing 96-test shekyl-engine-state suite and 51-test shekyl-engine-file suite remain green; clippy clean with -D warnings; fmt clean.

• Zeroizing-field grep + allowlist CI guard (commit 5 of the mid-rewire hardening pass, docs/MID_REWIRE_HARDENING.md §3.5). Closes the gap that the wire-schema snapshot from commit 4 structurally cannot cover: Zeroizing<[u8; 32]> and [u8; 32] produce byte-identical postcard output, so unwrapping a zeroize wrapper leaves the snapshot green while silently breaking the runtime secret-wipe contract. New scripts/ci/check_zeroize.sh walks rust/shekyl-engine-state/src/**/*.rs and emits every [u8; N] or Vec<u8> field declaration: production code only (#[cfg(test)] modules and everything past the first #[cfg(test)] in a file are elided), with paren-depth tracking across multi-line fn signatures so pub fn new(x: [u8; 32], …) parameters are not mistaken for struct fields, and with standard filters on //, ///, use, type, impl, let, for, match, -> , and assert lines. Every hit must either carry a Zeroizing<...> / SecretKey<...> wrapper on the same line (auto-pass, no allowlist entry needed) or be enumerated verbatim — <relative-path>|<normalized decl> — in rust/shekyl-engine-state/.zeroize-allowlist. The allowlist is bi-directional: a new unwrapped field with no entry fails with FATAL: unwrapped byte-shaped field(s) without allowlist entry, and an allowlist line whose field no longer exists fails with FATAL: stale allowlist entry — field no longer exists, so the file cannot rot with ghost entries that would silently re-admit a future field of the same spelling. Initial allowlist encodes 27 deliberate public-bytes entries across six files (bookkeeping_block, ledger_block, payment_id, runtime_state, sync_state_block, transfer, tx_meta_block), grouped by category with per-entry comments: (a) public chain hashes (tip/reorg/creation-anchor/pending-tx/reference-block), (b) public key-image markers on TransferDetails, (c) 32-byte map keys keying per-tx metadata (tx hashes are public lookup handles; values that carry secrets, like TxSecretKey, are wrapped on their own line), (d) the clear PaymentId([u8; 8]) handle (obfuscation is applied by the tx-builder, not the storage type), (e) FCMP++ path_blob: Vec<u8> (public-input proof bytes; leaks anonymity-set choice but not spender secrets), (f) mirror-struct schema fields on TransferDetailsSchema / TxSecretKeySchema that exist only to drive the postcard_schema::Schema derive and never allocate at runtime, (g) runtime_state.rs in-memory indexes that are rebuilt from LedgerBlock on every load and never persisted. New .github/workflows/zeroize-check.yml runs the script on PRs into dev that touch the wallet-state source tree, the allowlist, the script itself, or this workflow. Policy captured in .cursor/rules/42-serialization-policy.mdc's enforcement section (§3.4 schema snapshot + §3.5 zeroize grep together form the mechanical half of the wire-format and secret-wipe discipline). Verified locally: script exits 0 on the current tree ("33 candidate field(s) scanned, all wrapped or allowlisted"); the three failure modes — adding an unwrapped scratch_field: [u8; 32], adding a stale allowlist entry, unwrapping an Option<Zeroizing<[u8; 32]>> to Option<[u8; 32]> — each produce the expected pinpoint error.

• Wire-schema snapshot + paired block_version CI guard (commit 4 of the mid-rewire hardening pass, docs/MID_REWIRE_HARDENING.md §3.4). Converts the block_version discipline from cultural invariant (previously policed only by reviewer attention and the prose rule in .cursor/rules/42-serialization-policy.mdc) into a mechanical check that fires on every PR. Adds a postcard-schema = "0.2" dependency to shekyl-engine-state (pinned at the same major as the on-disk postcard = "1" wire-format crate, stable schema representation), derives postcard_schema::Schema on every persisted block (WalletLedger, LedgerBlock, BookkeepingBlock, TxMetaBlock, SyncStateBlock, plus the nested BlockchainTip, ReorgBlocks, FcmpPrecomputedPath, SubaddressLabels, AddressBookEntry, AccountTags, TxSecretKeys, ScannedPoolTx, SubaddressIndex, PaymentId types), and hand-rolls Schema for the two leaf types whose fields use #[serde(with = "…")] helpers the derive macro cannot introspect (TransferDetails, TxSecretKey). The hand-rolled impls use the mirror-struct pattern: a compile-only TransferDetailsSchema / TxSecretKeySchema that mirrors the wire layout with Vec<u8> for byte sequences, then lifts NamedType.ty out of its derived Schema impl under the domain-facing type name. This is wire-identical to the original types (both produce length-prefixed byte sequences under postcard) but participates in postcard-schema's NamedType tree, which is the load-bearing part of the check. rust/shekyl-engine-state/src/schema_snapshot.rs is a new test module that renders each block's NamedType tree as pretty JSON (via OwnedNamedType — NamedType holds &'static references that serde_json cannot roundtrip through) and diff-compares against a committed .snap file under rust/shekyl-engine-state/schemas/. Seven tests: one per block (5) plus a self-parseability roundtrip guard and a canonicality check on the schemas-dir path. Running UPDATE_SNAPSHOTS=1 cargo test -p shekyl-engine-state schema_snapshot regenerates; running without the env var asserts. Mismatches print a line-oriented unified diff, name the file that moved, and spell out the three-step fix (bump the constant, regenerate, review). .github/workflows/schema-snapshot.yml wires two jobs. The first runs cargo test -p shekyl-engine-state schema_snapshot --no-fail-fast against the PR head. The second diffs the PR against the dev merge-base and, for every .snap that changed, insists that both (a) the paired source file was touched, and (b) the pub const line that declares the matching version constant appears on either side of the file's unified diff. Pairing is canonical in both the workflow (PAIRS array) and the schema_snapshot.rs module docs: wallet_ledger.snap ↔ WALLET_LEDGER_FORMAT_VERSION, ledger_block.snap ↔ LEDGER_BLOCK_VERSION, bookkeeping_block.snap ↔ BOOKKEEPING_BLOCK_VERSION, tx_meta_block.snap ↔ TX_META_BLOCK_VERSION, sync_state_block.snap ↔ SYNC_STATE_BLOCK_VERSION. Workflow paths filter is scoped to the wallet-state crate plus the workflow file itself, so unrelated PRs skip the job entirely. Design choices surfaced in §3.4: (a) the snapshot is schema JSON, not postcard bytes — a hex diff is opaque to a reviewer, whereas a NamedType diff names every field and spells out its DataModelType; (b) the schema-stability contract leans on postcard-schema's SemVer (pinned 0.2), because the NamedType representation is part of the crate's public API; (c) the mirror-struct pattern is preferred over upstream-patching postcard_schema to understand #[serde(with)] because it is local, reviewable, and does not couple us to an upstream release cadence. Exit criteria met: five snapshot files exist, the assert-test passes on a clean checkout, a deliberate field rename produced a unified diff pointing at the exact node (verified locally against a scratch #[serde(rename = "restore_height")] on SyncStateBlock::restore_from_height), and the workflow's grep-logic dry-run correctly accepts a pub const … = N → N+1 diff and rejects source-file edits that leave the declaration line untouched.

• CI benchmark gate — iai-callgrind per-PR + rolling baseline on bench-baseline (commit 3 of the mid-rewire hardening pass, docs/MID_REWIRE_HARDENING.md §3.3). New ci/benchmarks workflow (.github/workflows/benchmarks.yml) running on PRs into dev (the gate) and pushes to dev (the rolling-baseline updater). On a PR: ubuntu-latest runs the full five-bench iai-callgrind harness via scripts/bench/capture_rust_baseline.sh (~8-10 min, cached cargo registry + target dir), diffs the resulting shekyl_rust_v0.json against the tip of the orphan bench-baseline branch's baseline.json via scripts/bench/compare.py, and upserts a Markdown PR comment via scripts/bench/post_comment.py. Threshold table enforced mechanically: crypto_bench_* ±5% warn / ±15% fail (bidirectional — speed-ups are suspicious on constant-time paths too), hot_path_bench_* +5% warn / +15% fail (slowdown-only), missing-bench-in-PR = fail. On any fail a second job re-runs the criterion sibling of the tripped bench under samply record and uploads a profile.json artifact for flamegraph review. Bootstrap: the first PR before the bench-baseline branch exists gets a bootstrap-pending comment and the gate passes; the first subsequent push to dev creates the branch with a bot-authored orphan commit. Design choices documented in §3.3 "Implementation notes": (a) Tier 1 only — criterion wall-clock numbers are rendered in the comment as an informational table but do not trip the gate (the Tier 2 upgrade to dedicated-runner wall-clock is tracked in §6.1); (b) C++ Google Benchmark is not wired in this commit because only BM_balance_compute ships live on the C++ side and it is wall-clock (same Tier-2 bucket as criterion); (c) the gate diffs against bench-baseline/baseline.json directly rather than re-running the bench on the baseline commit, because iai-callgrind instruction counts are machine-independent for deterministic code (Valgrind VEX IR, not native cycles) — saves ~8 min of CI per PR and the rolling baseline is always at most one dev-merge cycle stale. The compare report schema (shekyl_rust_v0_compare_v1) is its own versioned envelope so a future schema bump on the capture side does not silently drift the comparator. Companion documentation: docs/benchmarks/README.md gains a full "CI integration" section with per-PR flow, threshold routing, rolling-baseline semantics, and a "When a gate trips" triage runbook. Permissions are scoped per-job (read-only at top level; pull-requests: write only on the comment-posting job; contents: write only on the baseline-updater job), using the default GITHUB_TOKEN — no PAT, no self-hosted runner, no secret provisioning required.

• Provisional laptop-captured shekyl_rust_v0 baseline (follow-up to hardening-pass commit 2). The harness commit's CHANGELOG entry deferred the frozen shekyl_rust_v0.json + shekyl_rust_v0.iai.snapshot to a reference-machine capture. To unblock commit 3 (CI threshold gate), those two files are landed here as a laptop capture on the commit author's host; the envelope records the exact CPU model, kernel, and toolchain (captured_on.* fields) so the "provisional" status is self-documenting. The iai-callgrind instruction-count columns are stable across back-to-back runs on that host (the §3.2 determinism criterion is met), so the baseline is a valid slowdown detector for same-host re-captures; the criterion wall-clock columns are soft numbers that CPU frequency scaling and background load will drift, and the reference-machine re-capture will overwrite them. Schema is stable across the swap (shekyl_rust_v0), so commit 3's comparison script does not need to branch. The capture-script probe for iai-callgrind-runner is also fixed in the same landing: the tool's --version flag exits 1 outside the cargo-bench handshake protocol, so the envelope's iai_callgrind_runner_version field was previously "unknown"; it now resolves via cargo install --list with a fallback through the runner's own error banner. docs/benchmarks/README.md gains a "Provisional laptop baseline" subsection naming the policy relaxation and the exit condition for it.

• Rust wallet-state benchmark harness — criterion + iai-callgrind (commit 2 of the mid-rewire hardening pass, docs/MID_REWIRE_HARDENING.md §3.2). Five hot paths from the §3.1 list, each shipped with a criterion binary (wall-clock, Tier-2 metric) and an iai-callgrind sibling (deterministic instruction-count + cache- miss metrics, Tier-1 metric that CI will gate on in commit 3): shekyl-engine-state::{ledger, balance}, shekyl-engine-file::open, shekyl-scanner::scan_block, shekyl-tx-builder::transfer_e2e. Naming convention enforced: crypto_bench_* (bidirectional ±5% warn / ±15% fail) for anything touching curve25519, ML-DSA-65, Argon2id, or ChaCha20- Poly1305; hot_path_bench_* (slowdown-only) for postcard serde, balance compute, and scanner bookkeeping. All ten harnesses compile under cargo check --benches, run locally under cargo bench -p <crate> --bench <name>, and — on a host with valgrind + iai-callgrind-runner on PATH — produce byte-identical instruction counts across back-to-back runs (§3.2 exit criterion). One deliberate deviation from production code is documented: the transfer_e2e_iai bench bypasses HybridEd25519MlDsa::sign and inlines the two sign steps with fips204::ml_dsa_65::try_sign_with_seed + try_keygen_with_rng(seeded) because the production wrapper's OsRng draws inside ML-DSA-65 keygen + rejection-sampling loop produced ~16% instruction-count variance on the sign call and ~66% variance once keygen was accounted for, both violating the determinism criterion. The FIPS-204 deterministic variant exercises the identical signing primitives (same NTT, same rejection predicates, same packing); the criterion sibling preserves the randomized production path so the human-facing wall-clock number is honest. Known gap: the full sign_transaction call including the FCMP++ membership proof is not benched, because a deterministic curve-tree path fixture keyed to a synthetic tree root is its own scope of work; the manifest §6.1 tracks this and names the un-gap conditions for a future shekyl_rust_v1 schema bump. Companion artifacts: docs/benchmarks/shekyl_rust_v0.manifest.md (per-bench operation lists, fixture shapes, six documented known gaps, apples-to-oranges notes against the C++ baseline), scripts/bench/capture_rust_baseline.sh (reference-machine capture wrapper — sibling of capture_cpp_baseline.sh from commit 1 — emits a schema-versioned shekyl_rust_v0.json envelope with toolchain + host CPU + git-rev metadata alongside a raw shekyl_rust_v0.iai.snapshot text artifact), docs/benchmarks/README.md updated with a "Capturing the Rust baseline" section and the shipped file-layout listing. Workspace impact is dev-dep-only: criterion + iai-callgrind land as [dev-dependencies] on the four crates that own a bench (shekyl-engine-state, shekyl-engine-file, shekyl-scanner, shekyl-tx-builder); the shekyl-scanner bench gains a self-referential shekyl-scanner = { path = ".", features = ["test-utils"] } dev-dep so WalletOutput::new_for_test + RecoveredWalletOutput::new_for_test are available in the bench without exposing them to downstream consumers. The frozen shekyl_rust_v0.json is captured on a reference machine by the commit author and landed as a follow-up — this commit ships the harness, not the numbers, because the reference machine is part of the measurement (same discipline as commit 1).

• Wallet2 C++ baseline benchmark harness (tests/wallet_bench/, commit 1 of the mid-rewire hardening pass, docs/MID_REWIRE_HARDENING.md §3.1). Google Benchmark v1.9.1 harness fetched via FetchContent, opt-in behind -DBUILD_SHEKYL_WALLET_BENCH=ON (OFF by default so normal contributors do not pay the cold-build cost). Of the five hot paths identified in §3.1, one ships live on this tree (BM_balance_compute, N ∈ {100, 1000, 10000}, O(n) balance() iteration over a seeded synthetic transfer set) and two are scaffolded-but-gated with state.SkipWithError(...) (BM_open_cold, BM_cache_roundtrip): those two depend on wallet2::generate → store_to → load round-tripping, which is broken on this tree and reproduced by the already-failing unit test wallet_storage.store_to_mem2file. Root-causing the wallet2 regression is the work scope of hardening-pass commits 2l / 2m-keys / 2m-cache; patching it here would violate the "clear separations" invariant. Un-skipping is a one-line change in each bench function when those commits land. Fixtures use a pinned seed (0xBEEFF00DCAFEBABE) so two runs produce byte-identical inputs; the bench defines its own wallet_accessor_test in tests/wallet_bench/bench_fixtures.h (matching the existing friend declaration in src/wallet/wallet2.h, disjoint from the same-named class in tests/core_tests/wallet_tools.h — the two headers are never included in the same TU) with a minimal surface: m_transfers get, get_cache_file_data, load_wallet_cache. Two of the Five (scan_block_K, transfer_e2e_1in_2out) ship only in the Rust harness from commit 3.2: wallet2's scanner and FCMP++ proof paths are daemon-coupled and have no hermetic provisioning path; the architecturally honest move is to acknowledge the gap in docs/MID_REWIRE_HARDENING.md §3.1 and §4.3 rather than reimplement daemon-side synthetic-tree logic in code that is deleted in 2m-cache. Companion artifacts: docs/benchmarks/wallet2_baseline_v0.manifest.md (prose manifest: every operation in each live bench's hot loop, every I/O boundary, apples-to-oranges notes against Rust, and the un-skip criteria for the two gated paths), docs/benchmarks/README.md (capture procedure + baseline-update policy), scripts/bench/capture_cpp_baseline.sh (reference-machine capture wrapper emitting a schema-versioned JSON envelope with toolchain + host CPU + git-rev metadata), tests/wallet_bench/README.md (local build + run instructions + known gaps). The frozen wallet2_baseline_v0.json is captured on a reference machine by the commit author and landed as a follow-up — this commit ships the harness, not the numbers, because the reference machine is part of the measurement.

• Boost program_options link-time dep on libcommon (src/common/CMakeLists.txt). removed_flags.cpp calls boost::program_options::error_with_option_name::get_option_name(), which inlines get_canonical_option_name and therefore requires the libboost_program_options symbol to resolve at link time (libcommon.so is linked with -Wl,--no-undefined). The dep was missing since removed_flags landed and only surfaced during a clean rebuild triggered by the benchmark harness above. Fix is a one-line PRIVATE ${Boost_PROGRAM_OPTIONS_LIBRARY} in src/common/CMakeLists.txt. No behavior change outside CMake.

Chore

• Workspace cargo fmt --all baseline (PR 0.5 of the V3 wallet rewrite plan, .cursor/plans/shekyl_v3_wallet_rust_rewrite_3ecef1fb.plan.md Phase 0). Five files (rust/shekyl-ffi/src/wallet_file_ffi.rs, rust/shekyl-ffi/src/wallet_ledger_ffi.rs, rust/shekyl-scanner/benches/scan_block.rs, rust/shekyl-tx-builder/benches/transfer_e2e.rs, rust/shekyl-engine-file/src/handle.rs) had accumulated hand-edited formatting drift before this plan started; cargo fmt --all --check flagged them on dev. Mechanical, fmt-only run; no logic, behaviour, or API change. Lands before Phase 1 begins so subsequent rewrite PRs can use cargo fmt --all --check as a cheap branch-hygiene signal without wading through pre-existing drift. Drift cause was hand-edits bypassing fmt (verified: git log --follow on each file shows the drifting hunks were introduced under the same rustfmt toolchain in use today), so unconditional cargo fmt --all is the correct fix — no #[rustfmt::skip] warranted.

• Phase 0 PR 0.6 planning + FOLLOWUPS scope adjustments (chore/phase0-pr06-vendor-bump-planning). Split the monero-oxide re-pin question into two distinct operations and scoped them differently:

  • Operation A — vendor-bump 87acb57 → 3933664 (fork tip). Mechanical, cheap, none crypto-substantive except 182b648's base58 decoder hardening. Added as PR 0.6 to Phase 0 of the V3 wallet rewrite plan. Total Phase 0 grows from five PRs to six.
  • Operation B — un-pin / 40-commit upstream merge. Stays as a V3.1.x peer plan, not scoped to Phase 0. The active correctness bug 00bafcf (HelioseleneField::invert Veridise edge case) does not change this assessment: the bug exists today on dev, it is below the wallet stack's API surface, and the rewrite's Phase 1 API shape does not depend on it. The un-pin runs in parallel with rewrite Phases 1–3 if bandwidth allows.

  Plan adjustments (.cursor/plans/shekyl_v3_wallet_rust_rewrite_3ecef1fb.plan.md): (1) new PR 0.6 section with cost-ceiling discipline (bail out if base58 review or workspace verification surfaces concerns); (2) half-day review gate expanded from one item to five (PR 0.4 vendor status, PR 0.3 daemon-side findings, FOLLOWUPS V3.1+ section, cross-cutting locks confirmation, and new item 5 confirming whether un-merged-upstream commits affect Phase 1 Wallet API shape); (3) Phase 1 logging deliverable now absorbs the daemon-side staticlib tracing silently-dropped follow-up — the same subscriber init solves both the wallet stack and the daemon staticlib in one deliverable; (4) Phase 5 commit message inventory now explicitly closes two V3.2 follow-ups (shekyl-cli key image binary format — no Monero binary-format port; wallet_tools.cpp mixin/decoy — swept with tests/unit_tests/wallet*.cpp); (5) Phase 3b deliverables flag an optional --format=qr-chunks on the typed bundles for air-gapped UX, replacing the V3.2 hex-blob QR follow-up; (6) bumped Phase 0 PR count in the Branching cadence section.

  FOLLOWUPS adjustments (docs/FOLLOWUPS.md): the V3.1+ section gains an at-a-glance index table (absorbed / closed-by-Phase-5 / cross-linked / independent) used by review-gate item 3; the monero-oxide un-pin entry rewritten to describe Operation A vs Operation B with cross-links in both directions; the three V3.2 entries that get explicit closure (shekyl-cli key image binary, wallet_tools.cpp mixin, daemon staticlib tracing) carry inline closure notes pointing to the rewrite phase that absorbs or closes them; the V3.2 hex-blob QR entry annotated to die with the hex format in favour of the typed bundles.

  Decision-log entry (docs/V3_WALLET_DECISION_LOG.md): new entry "monero-oxide re-pin: split into Operation A (Phase 0) and Operation B (un-pin V3.1.x plan)" pinning the rationale for why the active correctness bug doesn't force Operation B into Phase 0, and naming the alternatives considered (fold both into Phase 0, defer both to V3.1.x, fold Operation A into PR 0.4) and why each was rejected.

  No code changes in this PR — planning + cross-link maintenance only. PR 0.6 (the actual vendor-bump) lands in a subsequent PR.

• Phase 0 audit cleanup (chore/phase0-audit-cleanup). Three small follow-ups surfaced by the post-merge comprehensive audit of dev against the V3 wallet rewrite plan's Phase 0 expectations: (1) consolidated the duplicate ### Documentation heading under [Unreleased] that was a rebase artefact across PR 0.2 / PR 0.3 / PR 0.4 — three entries moved up into the canonical section, no content lost; (2) added a back-link in docs/SHEKYLD_PREREQUISITES.md pointing forward to the two consuming docs/V3_WALLET_DECISION_LOG.md entries (positional fee mapping, fee_policy_version absence) and the daemon-side V3.1 follow-up in docs/FOLLOWUPS.md, so the audit's downstream consumers are reachable from the audit doc itself; (3) fixed a pre-existing clippy::needless_return lint in rust/shekyl-engine-file/src/handle.rs::is_cross_device_error (introduced under commit 2l.a, not by Phase 0) for readability. Recorded a follow-up in docs/FOLLOWUPS.md noting that the workspace as a whole is not clippy --workspace -- -D warnings clean (shekyl-ffi carries ~12 inherited warnings from its FFI shape) and that a dedicated cleanup pass + CI gate belongs to V3.1.x.

Fixed

• shekyl_account_public_address_check argument-order mismatch between Rust definition and C-side declaration (Track 0a CI triage, 2026-04-28). The Rust definition in rust/shekyl-ffi/src/account_ffi.rs takes (pqc_pk_ptr, view_pk_ptr); the C header in src/shekyl/shekyl_ffi.h declared (view_pub_ptr, pqc_public_key_ptr), and the one C++ caller in src/cryptonote_basic/cryptonote_basic_impl.cpp followed the wrong order. Every decode therefore ran the FIPS-203 well-formedness check on garbage bytes, surfacing in CI as 14 uri.* unit_tests failures with the log line cn: Address failed v1 canonical invariant check (view_pub <-> X25519 prefix or malformed ML-KEM-768 encapsulation key). Introduced in commit 0092a8da1 ("ffi,cryptonote_basic: pin m_pqc_public_key format and publish v1 account FFI"); reached dev only at the feat/wallet-account-rewire merge 30db140fe (2026-04-22). The Rust unit tests at rust/shekyl-ffi/src/account_ffi.rs:954,975 use the correct (pqc, view) order and never caught the C-side divergence. Per .cursor/rules/10-shekyl-first.mdc, Rust is the source of truth; the fix aligns the C header and the C++ caller. Two files touched, no fixture regeneration; the previously-failing 14 uri.* tests are themselves the regression test (FAIL → PASS). Local verification: 858/870 unit_tests passing after the fix (was 854/870), the 2 remaining failures are wallet_storage.{store_to_mem2file, change_password_mem2file} tracked in docs/CI_BASELINE.md Cluster B and docs/FOLLOWUPS.md (V3.1, wallet2 hardening-pass close).

• CI baseline established as docs/CI_BASELINE.md (Track 0e CI triage, 2026-04-28). Records the documented list of known-failing C++ tests with diagnoses, close conditions, and FOLLOWUPS row pointers (Cluster A — uri.*, fixed; Cluster B — wallet_storage, deferred to V3.1 wallet2 hardening-pass; Cluster C — core_tests gen_*, deferred to V3.1 chaingen-harness rewrite or V3.2 wallet2.cpp removal; Cluster D — shekyl-oxide divergence canary, currently green). The document also pins the interim shekyl-oxide divergence-sync policy (explicit trust assumption + spot-check discipline scaling with window size) and the pre-enforcement noise-floor rule that reviewers apply today: any failure outside the documented list blocks PR merges to dev until investigated, with mechanical enforcement (a required-status-check on the failing-test set) tracked separately as a follow-up. Linked from docs/CONTRIBUTING.md under "CI baseline"; CI status is contributor surface, not first-impression surface, so the link does not appear in the top-level README. The full Track 0 plan (CI triage ahead of audit hygiene and Stage 1 spec) is the source of these entries.

• apply_scan_result_to_state strict-contract enforcement (Phase 2a refresh_scan_loop bundle, Branch 1). Closes the PR #16 Copilot-review finding tracked in docs/FOLLOWUPS.md V3.0 → "apply_scan_result strict-contract enforcement (refresh commit)" (now retired to Recently resolved). The merge in rust/shekyl-engine-core/src/engine/merge.rs previously had two defensive-coding gaps:

  1. block_hashes was collected via BTreeMap::insert, silently overwriting duplicate height entries instead of rejecting them.
  2. new_transfers / spent_key_images / block_hashes entries with heights outside processed_height_range were silently dropped at scope end (the per-height BTreeMap::remove loop consumed only in-range entries; out-of-range residue fell off the stack uninspected).

  Both are producer-bug signals, not concurrent-mutation races. apply_scan_result_to_state now pre-validates block_hashes for length-matches-range, in-range, no-duplicates, every covered height present, and post-loop drains the per-height per-hash maps to assert no out-of-range residue remains. Contract violations surface as the new RefreshError::MalformedScanResult { reason: &'static str } variant; this is distinct from RefreshError::ConcurrentMutation (which signals "the wallet moved under the producer; safe to retry") because a malformed scan result indicates the producer itself is broken and retry cannot help. Decision Log entry "MalformedScanResult: producer-bug signal vs. ConcurrentMutation" (2026-04-26) pins the boundary. New tests: block_hashes_length_mismatch, block_hashes_duplicate_height, block_hashes_out_of_range, block_hashes_missing_height, transfer_out_of_range_block_height, key_image_out_of_range_block_height.

• shekyl-engine-state ledger / ledger_iai benches: pin BlockchainTip.synced_height to the synthetic transfers' max block_height. The benches under rust/shekyl-engine-state/benches/ledger.rs and rust/shekyl-engine-state/benches/ledger_iai.rs were authored against WalletLedger::empty() (commit a9a81a17e) before invariant I-1 (tip-height-not-below-transfer) was wired into WalletLedger::from_postcard_bytes by hardening-pass commit 6 (def7d3379, "feat(wallet-state): WalletLedger::check_invariants"). build_ledger was inheriting tip.synced_height = 0 from the empty constructor while the synthetic transfers carried block_height ∈ [1_000, 1_000 + N), so the deserialize half of the round-trip panicked with WalletLedgerError::InvariantFailed { invariant: "tip-height-not-below-transfer", … } on every iteration. The fix reconstructs the LedgerBlock with tip.synced_height = max(transfers[*].block_height) (and a non-None tip_hash) so the fixture is invariant-coherent before postcard sees it. The outdated docs/FOLLOWUPS.md entry that claimed four iai-callgrind targets failed to compile against the post-RuntimeWalletState fold has been replaced with a re-review entry capturing the actual finding (see "Phase 1 bench harness re-review post-RuntimeWalletState fold (April 26, 2026)"). All ten core benches under capture_rust_baseline.sh now build and smoke-run cleanly.

• source archive CI job: pin git describe to release tags (v*). The branch-archival policy in .cursor/rules/06-branching.mdc rule 5 has accumulated seven archive/<branch>-<date> annotated tags since 2026-04-13 (four of them on 2026-04-25, on commits that are merge-ancestors of dev). The source-archive job in .github/workflows/build.yml was calling plain git describe, which returns the closest reachable tag. Once an archive/* tag became the closest tag to dev, VERSION="shekyl-$(git describe)" started resolving to e.g. shekyl-archive/phase0-pr06-oxide-vendor-bump-2026-04-25, whose / was interpreted as a directory by git-archive-all, failing with [Errno 2] No such file or directory: '…/shekyl-archive/<branch>-<date>.tar'. The job had failed on every push for ~2 hours before this fix, including PR #16's source-archive run. Fix is a one-line filter (git describe --match 'v*') that ignores branch-archival tags and keeps VERSION shaped like shekyl-vX.Y.Z-N-gSHA. Verified locally: git describe origin/dev returns archive/phase0-pr06-oxide-vendor-bump-2026-04-25 (broken), git describe --match 'v*' origin/dev returns v3.1.0-alpha.3-135-g39981643f (correct). No behavior change for branches with a v* tag in their ancestry, which is every branch off dev since the first release tag.

Security

• rand 0.8.5 → 0.8.6 in rust/Cargo.lock (RUSTSEC-2026-0097 / GHSA-cq8v-f236-94qc, severity Low). The advisory describes an unsoundness in ThreadRng::TryRng that can produce aliased mutable references — Undefined Behaviour — when all of the following hold simultaneously: (a) the log and thread_rng features are enabled, (b) a custom log::Logger is installed, (c) the custom logger calls rand::rng() / rand::thread_rng() and any TryRng (formerly RngCore) method on it, and (d) ThreadRng reseeds while called from inside the logger.

  This bump is defense-in-depth, not active-vulnerability fix: the project's custom logger lives in shekyl-logging and a workspace-wide audit confirmed it does not call rand::rng() or rand::thread_rng() from any logger code path. The exploit precondition (c) is therefore not reachable from current shekyl code. The bump still lands so that future logger work does not accidentally reach into the unsoundness window.

  Application is a one-line Cargo.lock change (cargo update --precise 0.8.6 -p [email protected]) plus the cascading edge updates in seven downstream consumers' dependency blocks (monero-rpc-utils, chacha20poly1305, shekyl-crypto-pq, shekyl-engine-core, shekyl-fcmp, shekyl-staking, fcmp_pp). No source changes; the workspace constraints (rand = "0.8", caret-bounded) accept the bump without Cargo.toml edits.

  The companion advisory RUSTSEC-2026-0097 against the fuzz-only lockfile (rust/shekyl-crypto-pq/fuzz/Cargo.lock) is intentionally not addressed in this PR. That lockfile is stale relative to the workspace (path-dep version markers still at v2.0.0 pre-Wallet→Engine rename); a precise rand bump there cascades into ~50 lines of unrelated lockfile refresh churn. The exploit precondition is equally unreachable from fuzz harness code, and the cleanup belongs with the next routine fuzz-Cargo.lock hygiene pass rather than slipped into this focused security bump.

  cargo audit exits clean against the bumped lockfile (the RUSTSEC entry no longer matches any resolved version); Cargo.toml constraints unchanged; cargo check --workspace --tests, cargo fmt --all -- --check, and cargo clippy --workspace --all-targets --keep-going -- -D warnings all exit 0.

  Two further open dependabot alerts on Shekyl-Foundation/shekyl-core are stale and self-clear on the next main rescan: rustls-webpki GHSA-82j2-j2ch-gfr8 (already at the patched 0.103.13 in the workspace lockfile) and cryptography (pip) CVE-2026-39892 (the alert points at tools/reference/requirements.txt, which no longer exists in the repo). Neither requires a code change.

Documentation

• Stage 1 PR 4 (RefreshEngine) — Round 5 substrate-decision amendment (no-Mock substrate for C6). (feat/stage-1-pr4-refresh-engine, 2026-05-20). Doc-only amendment to docs/design/STAGE_1_PR_4_REFRESH_ENGINE.md landed mid-Phase-1 between C5β (legacy producer scaffolding deletion) and C6 (test substrate). The Round 4 §7.X C6 plan ("MockRefresh test substrate; mirrors MockDaemon / MockLedger from PR 1 / PR 2") is stale prose from before PR 3 §2.1.2's Mock-X rejection landed; building MockRefresh would re-instantiate the parallel-implementation anti-pattern PR 3 rejected as a category and compound the Mock-X debt that docs/FOLLOWUPS.md already scheduled to be paid down. The amendment dispositions:

  1. C6 replaces MockRefresh with FaultInjecting<R: RefreshEngine>. Composable wrapper around the production LocalRefresh (landed at C4); queues RefreshError::Cancelled / Io / InternalInvariantViolation for failure injection at the trait boundary; composes against any current or future R implementor without per-impl parallel-Mock proliferation.

  2. Retroactive Mock-X cleanup of MockLedger lands in PR 4 C6β (not deferred to PR 5). Extracts the existing MockLedger body into FaultInjecting<L: LedgerEngine>; adds LocalLedger::from_test_blocks(...) constructor replacing the parallel-implementation MockLedger::new(...) surface. Current MockLedger is structurally already a FaultInjecting<LocalLedger>-shaped wrapper (delegating to the canonical apply_scan_result_to_state); the cleanup is mostly extraction-and-rename, not a re-implementation. Closes docs/FOLLOWUPS.md lines 578–604.

  3. MockDaemon → TestDaemon rename lands in PR 4 C6γ alongside C6β. Mechanical rename only — the structural shape is already correct (alternative real implementation serving canned / cached test responses without network connectivity); only the Mock naming was the bug. Closes docs/FOLLOWUPS.md lines 606–620.

  The amendment is not a round reopening per the §7 amendment framing: it does not revisit any trait-surface contract pin, attack-surface disposition, or commit-decomposition ordering decision; it replaces stale C6 substrate prose with the binding no-Mock shape PR 3 §2.1.2 settled. The α-disposition, the F1–F13 dispositions, and the C0–C5 / C7 / C8 commit prose are all unchanged.

  The no-Mock rationale is re-iterated explicitly in §6 of the design doc (new "Test-substrate discipline — no-Mock substrate inheritance from PR 3 §2.1.2" subsection) and in the §7.X C6 prose, naming the five failure modes the Mock-X pattern instantiates: (1) attack surface from test-only types in production code; (2) conflation of test-controlled inputs to real implementations with substitute implementations; (3) inherited-Monero pattern that has produced real bugs in the inherited codebase; (4) foreclosure of composition with future trait implementors; (5) tests verifying against fake semantics rather than real semantics, degrading the coverage claim.

  Rationale anchor: 16-architectural-inheritance.mdc §"cost-benefit-defer-to-later anti-pattern" names the architectural-integrity-now disposition as the default for security-load-bearing substrate work pre-genesis; 15-deletion-and-debt.mdc pre-genesis discount applies. Cross-references: docs/completed/STAGE_1_PR_3_KEY_ENGINE.md §2.1.2 (Mock-X rejection rationale + five named failure modes), §2.1.5 (four-pattern pre-flight checklist future per-trait PRs inherit).

  Files touched (doc-only): docs/design/STAGE_1_PR_4_REFRESH_ENGINE.md (Status banner; new §6 no-Mock substrate inheritance discipline subsection; test-substrate preservation list rewritten; §7.X C6/C7/C8 prose updated), docs/FOLLOWUPS.md (two retroactive Mock-X cleanup entries pinned to PR 4 C6β/C6γ; fix the prior bug that called PR 4 PendingTxEngine — PR 4 is RefreshEngine; PR 5 is PendingTxEngine), and this CHANGELOG entry.

• **Stage 1 PR 4 (RefreshEngine) — Round 5 sub-pin extension

  • amendment-layering coherence pass (F-Mock-1 through F-Mock-8
  • Option (i) wrapper API + two-enum architecture pin).** (feat/stage-1-pr4-refresh-engine, 2026-05-20). Doc-only follow-up to the Round 5 substrate-decision amendment above. Same-day review pass surfaced eight Mock-X-substrate findings (F-Mock-1 through F-Mock-8) on the Round 5 amendment, then ran an amendment-layering coherence pass against the post-Round-5 substrate to surface forward-pointer gaps and paradigm-language conflations. The pass landed four substantive sharpenings, four minor audit-trail notes, a new §6.1 "Test-substrate paradigm pin" subsection, and a new §6.1.1 "Two-enum architecture (RefreshEngine-specific positive pattern)" sub-section pinning the producer-internal / trait-surface error-enum split as a positive architectural reference and forward-template for future per-trait PRs. None reopen any Round 1–4 disposition or the Round 5 amendment itself; the sub-pin refines the Round 5 C6 substrate so the Phase 1 author implements against an explicit pin rather than reverse-engineering from tests.

  Substantive dispositions (F-Mock-1 through F-Mock-4 + Option (i) wrapper API + two-enum architecture).

  1. F-Mock-1 — cfg-gating symmetry (Option (a)). All four C6 surfaces (FaultInjecting<R: RefreshEngine>, Engine::replace_refresh, FaultInjecting<L: LedgerEngine>, LocalLedger::from_test_blocks) are gated uniformly #[cfg(any(test, feature = "test-helpers"))]. The test-helpers feature is introduced as part of C6α's scope per the F-Mock-7 disposition, with a rationale comment matching the existing bench-internals precedent at rust/shekyl-engine-core/Cargo.toml lines 223–227.

  2. F-Mock-2 — FaultInjecting queue contract. Wrapper- internal queue (not actor mailbox) holding RefreshError values directly per Option (i) below. Contract: FIFO ordering; queued_failures(&self) -> usize drain inspector per the existing MockLedger::queued_failures precedent; debug_assert!-on-Drop for non-empty queue (panic-on-leftover in test/debug builds); reentrance pops the head per the "pop head if non-empty" semantics.

  3. F-Mock-3 + F-Mock-3-sharpening + Option (i) wrapper API. The wrapper carries type Error = RefreshError (not R::Error) and queues RefreshError values directly, uniform across all R. Cross-wrapper symmetry justifies the choice: FaultInjecting<L: LedgerEngine> must queue RefreshError by trait necessity (per engine/traits/ledger.rs:270–273 — apply_scan_result returns Result<(), RefreshError> with no Self::Error indirection), so FaultInjecting<R> queuing RefreshError matches.

     Empirical variant enumeration (per source). Of the six RefreshError variants at engine/error.rs:148, three are reachable from a RefreshEngine impl's Self::Error via the From conversion: Cancelled (unit), Io(IoError) (payload), and InternalInvariantViolation { context: &'static str } (payload constructed at the From impl site per engine/local_refresh.rs:368–384). Three are orchestrator-constructed only: MalformedScanResult { reason } (constructed exclusively by the merge layer at engine/merge.rs:315–451 when scan-result internal-shape invariants fail — superseding the doc's prior framing that grouped it with Cancelled / Io as trait-reachable), ConcurrentMutation { wallet, result } (constructed at the merge gate), and AlreadyRunning (constructed at the binary-layer single-flight). Under Option (i) direct injection the wrapper can inject any of the six variants into the orchestrator surface; for InternalInvariantViolation both direct injection (testing producer-returned-then-orchestrator-propagated path) and cause injection (driving causes through FaultInjecting<LocalLedger>::queue_concurrent_mutation per F-Mock-2 to exhaust the retry budget at orchestrator- side construction sites in engine/refresh.rs) are legitimate test classes.

  4. F-Mock-4 — MockLedger-structurally-already-FaultInjecting verification gate anchored. The Round 5 amendment's load-bearing claim ("current MockLedger is structurally already a FaultInjecting<LocalLedger>-shaped wrapper") is anchored to source at engine/test_support.rs:773–812: MockLedger::apply_scan_result (line 792) pops from concurrent_mutation_queue (line 794); on empty-queue, delegates to the canonical apply_scan_result_to_state (line 810). Future re-readers don't have to re-verify; C6β scope is bounded as anticipated.

  Two-enum architecture pin (§6.1.1). The RefreshEngine trait carries a deliberate two-enum architecture worth pinning as a positive architectural reference and forward- template for future per-trait PRs. Producer-internal LocalRefreshError is pub(crate), unit-variant-only by convention, four variants (Cancelled, Io, Malformed, Internal). Orchestrator-facing RefreshError is pub, payload-bearing throughout. The From impl boundary at engine/local_refresh.rs:368–384 is where payload information is constructed or discarded. The architectural cleanness this delivers — payload guarantees enforced by the type system at the conversion boundary, not by convention at every producer return site — makes the trait surface auditable in a way single-enum architectures cannot match. The pattern is shape-applicable to traits whose canonical method signatures return Result<_, Self::Error> with Self::Error: Into<OrchestratorError>; it is not load-bearing for traits whose canonical method signatures return Result<_, OrchestratorError> directly (per the LedgerEngine precedent). Per-trait PR pre-flight checks include "does this trait have an impl-side Self::Error indirection, and if so, is the producer-internal enum unit-variant-only?" as a substrate-application check alongside the four-pattern no-Mock pre-flight per PR 3 §2.1.5.

  Test-substrate implications (two test classes named explicitly). Two test classes follow from the two-enum architecture, both load-bearing for C6α's smoke-test coverage:

  • Class 1 — wrapper-based trait-surface tests. Tests use FaultInjecting<R: RefreshEngine> to inject RefreshError values directly (per Option (i) wrapper API); verify the orchestrator handles each variant correctly. Lives in C6α's new fault_injecting_refresh.rs test module plus the trait-dispatched Engine integration tests. Sub-properties: empty-queue passthrough; single-injection- then-delegation; multi-injection FIFO ordering; queue-drain-on-teardown (with Drop-time debug_assert! #[should_panic] separately verified).

  • Class 2 — From-conversion tests against LocalRefresh. Tests drive LocalRefresh directly via the pub(crate) producer-internal surface to produce each LocalRefreshError variant; verify the From<LocalRefreshError> impl produces the correct RefreshError variant. Lives in local_refresh.rs's existing tests module per the local_refresh_error_maps_to_refresh_error test precedent; sibling to Class 1, not a replacement because the wrapper bypasses the From conversion by injecting RefreshError directly under Option (i).

  Amendment-forward-pointer convention (recorded as meta-discipline). The coherence pass surfaced the pre-Phase-0c forward-pointer gap as a recurrence pattern — the same class of finding F-Mock-3 surfaced from one angle, present at three sites (the Status banner's Round 2 reframe paragraph; §3.1's two-channel error surface prose; §4 Phase 0c's inline comment) all carrying the Round 2 reframe's "unit-variant-only; no payload of any kind" framing that the Phase 0c amendment later refined. Three additive forward-pointers added at those sites preserve each round's historical record (what was decided at that round) while resolving the ambiguity (what the current binding contract is). The convention is recorded as a meta-discipline alongside 21-reversion-clause-discipline.mdc's named-criteria principle: any future amendment that narrows or refines an earlier round's contract lands its own forward-pointer at the earlier site. The two disciplines are complementary — reversion-clauses make rejection- dispositions readable across substrate changes; forward-pointers make narrowing-amendments readable across layered rounds. Both are about making layered prose readable across time.

  Minor dispositions (F-Mock-5 through F-Mock-8). F-Mock-5 adds an explicit C6β migration table mapping MockLedger's four public test-affordance methods (with_seed, with_seed_and_state, queue_concurrent_mutation, queued_failures) to their post-migration homes and corrects the prior "replaces MockLedger::new(...)" prose error (the constructor is with_seed / with_seed_and_state, not new). F-Mock-6 adds a Phase 1 author commit-message-template note to C6γ enumerating the MockDaemon test affordances surviving the rename unchanged. F-Mock-7 confirms the test-helpers feature does not currently exist in Cargo.toml and pins the introduction as part of C6α's scope. F-Mock-8 enumerates C6α smoke-test property classes by name across the two test-class structure above.

  V3.1 ledger-generator FOLLOWUPS entry (sub-pin extension Decision 4: coordinated TestLedgerBuilder substrate design). The three V3.x invariant-test FOLLOWUPS entries (tx-validation, FCMP++ tx-pool, staking lifecycle at docs/FOLLOWUPS.md lines 2411–2438) share a common test-infrastructure need beyond what PR 4 C6β's LocalLedger::from_test_blocks covers. The sub-pin lands a new V3.1 substrate-design FOLLOWUPS entry pinning the coordinated-design disposition: build one TestLedgerBuilder / TestBlockBuilder / TestTransactionBuilder substrate designed before the first daemon Rust port lands (cost asymmetry from 16-architectural-inheritance.mdc "cost-benefit-defer-to-later anti-pattern"); design to be forward-composable with PR 4 C6β's LocalLedger::from_test_blocks signature; flag the structurally-valid-but-semantically-stubbed middle-ground option in the V3.1 design conversation rather than defaulting to a binary "Need A or full Need B" framing.

  The sub-pin extension is not a round reopening: no Round 1–4 disposition, attack-surface pin, or commit- decomposition ordering is touched; only the Round 5 C6 substrate and the layered-amendment prose are refined. α-disposition, F1–F13 dispositions, Round 5 amendment, and C0–C5 / C7 / C8 commit prose remain unchanged; the C6 sub-decomposition (C6α / C6β / C6γ) gains the F-Mock dispositions inline.

  Files touched (doc-only): docs/design/STAGE_1_PR_4_REFRESH_ENGINE.md (Status banner Round 5 sub-pin extension paragraph + coherence-pass paragraph + amendment-forward-pointer convention recording; three forward-pointer additions at the layered-amendment sites; new §6.1 paradigm pin + §6.1.1 two-enum architecture pin; §6 preservation list FaultInjecting<R> / FaultInjecting<L> / TestDaemon entries updated; §7.X C6α wrapper-definition / F-Mock-3-sharpening / F-Mock-2 queue contract / F-Mock-7 test-helpers feature / F-Mock-8 smoke-test prose all updated; §7.X C6β migration table added; §7.X C6γ commit-message template note added), docs/FOLLOWUPS.md (new V3.1 coordinated TestLedgerBuilder substrate-design entry), and this CHANGELOG entry.

• Stage 1 PR 3 (KeyEngine) M3a pre-flight closures landed. The four open STAGE_1_PR_3_KEY_ENGINE.md dispositions Round 4 deliberately deferred — the handle-model emergent attack surface Round 3 surfaced — closed as a coupled disposition cluster:

  • §7.11 (handle persistence) = option (3) deterministic from ciphertext. Handle is cSHAKE256(view_secret || tx_hash || output_index_le_bytes(8)) with customization "shekyl/output-handle-v1", 16-byte output. The Round-3 lean toward (1) ephemeral was amended; the four-question coupled cluster collapses from this one disposition.
  • §7.12 (handle unforgeability / A7) = cSHAKE256-based deterministic derivation. A7 closes by construction (cSHAKE256 with view_secret in the input phase is a PRF in view_secret under standard assumptions). Implementation crate: sha3 = "0.10" (already a workspace dep) with the zeroize feature flag enabled, giving Sha3State wipe-on-drop discipline structurally per 35-secure-memory.mdc.
  • §7.10 (memory-pressure / A6) = dissolved by §7.11=(3). No table; no growth target; no eviction policy.
  • §7.13 (concurrency / Pattern-5) = dissolved by §7.11=(3). No shared mutable state; pure per-call sponge-state mutation only.

  STAGE_1_PR_3_MIGRATION_PLAN.md §3.1 amended to cite the closures and revise the M3a scope (no HandleTable data structure; derive_output_handle pure function instead; source_ciphertext + output_handle added to TransferDetails at M3b alongside the legacy fields, with legacy fields removed at M3d). M3a feat branch cleared to cut. Documentation-only change; no code shipped.

[3.1.0-alpha.5] - 2026-04-22

Security

• Retired 32-bit build targets (v3.1.0-alpha.5, Chore #3). Shekyl is now 64-bit only, on security grounds — not on maintenance grounds. Shekyl's Post-Quantum primitives — fips203 (ML-KEM-768) and fips204 (ML-DSA-65), consumed on the hot path by shekyl-crypto-pq and shekyl-tx-builder — state their constant-time guarantees against native 64-bit arithmetic. On 32-bit targets the compiler lowers u64 operations through compiler-emitted libgcc helpers (__muldi3, __udivdi3, __ashldi3) with no constant-time guarantee, plus variable-latency u64 multiply on common 32-bit ARM cores (Cortex-A series). That is a CT violation introduced by the code generator, not the source — exactly the class source-level CT audits cannot catch. KyberSlash (Bernstein et al., 2024) demonstrates remote-timing key recovery against ostensibly constant-time Kyber implementations broken by non-CT division; the Cortex-M4 Kyber timing-attack line (2022–2024) is supporting context. The X25519+ML-KEM hybrid does not save us: "hybrid is secure if either half is secure" protects against algorithmic breaks, not side-channel breaks — if ML-KEM leaks its secret via timing on 32-bit, X25519 is offline-attackable against captured ciphertexts with unlimited attacker time. FCMP++ proof generation has not been audited for constant-time properties on 32-bit targets, and Shekyl will not take responsibility for that audit across all 32-bit toolchains we would otherwise ship (policy framing, not speculation). MDB_VL32 (LMDB's 32-bit paged-mmap mode) and the src/crypto/slow-hash.c 32-bit software fallback are untested consensus-adjacent storage and PoW paths respectively.

  32-bit Shekyl wallet users were at meaningfully elevated risk of key extraction compared to 64-bit users; supporting the platform was a tacit lie about the security posture of users on it. This is the correction.

  Node-only operation is also retired. A future contributor will argue "I just want to run a 32-bit pruned node on a Pi, I'm not doing wallet operations, the CT argument doesn't apply." That is partially true — node code does not touch secret PQC keys. But MDB_VL32 paging against a multi-GB chain makes sync time measured in weeks (not a supported posture), and shipping a 32-bit daemon binary creates a reasonable user expectation that wallet operation is supported, which it is not. The operational complexity of splitting "32-bit daemon supported, 32-bit wallet refused" outweighs any benefit.

  Four independent tripwires (defense-in-depth):

  1. Tripwire D — CMakeLists.txt. C++-side configure gate: message(FATAL_ERROR …) on NOT CMAKE_SIZEOF_VOID_P EQUAL 8, placed before any find_package / include / add_subdirectory so configure fails early with the CT argument in the message. Exercised on every PR to dev by .github/workflows/cmake-gate-test.yml + tests/cmake-gate-test/, which drives CMake with a fake 32-bit toolchain and asserts non-zero exit, gate message + KyberSlash citation in stderr, and no find_package chatter (so a PR that moves the gate below a probe also fails the test).
  2. Tripwire A — rust/shekyl-crypto-pq/src/lib.rs. Primary compile_error! on not(target_pointer_width = "64"), since this crate is the ML-KEM-768 / ML-DSA-65 consumer. The gate that fires in practice on a 32-bit Rust build.
  3. Tripwire B — rust/shekyl-ffi/src/lib.rs. Structural-not-observable: duplicated by design to preserve the refusal at the FFI seam under a future refactor that might split this crate from shekyl-crypto-pq. Do not delete this gate on the grounds that it "never fires" — its value is structural, not observable; see the comment block on the tripwire and docs/audit_trail/RESOLVED_260419.md §"Chore #3".
  4. Tripwire C — rust/shekyl-tx-builder/src/lib.rs. Direct fips204 (ML-DSA-65) consumer on the transaction-signing hot path; independent of Tripwire A so a future refactor that narrows the dependency shape cannot silently drop the refusal.

  Deleted, not #if 1-ed out. Every 32-bit-conditional block removed in this chore was deleted outright. Dead #if ARCH_WIDTH == 64 / #ifdef __i386__ / #ifdef __arm__ scaffolding invites future contributors to assume a meaningful 32-bit alternative exists somewhere and reason about it; the whole point of the retirement is to foreclose that reasoning.

  What went away. Build system: cmake/32-bit-toolchain.cmake; the six 32-bit Makefile targets that actually existed on dev (release-static-win32, debug-static-win32, release-static-linux-i686, release-static-linux-armv6, release-static-linux-armv7, release-static-android-armv7); BUILD_64 / DEFAULT_BUILD_64 / ARCH_WIDTH / ARM_TEST / ARM6 / ARM7 machinery and the Clang+32 libatomic workaround in the root CMakeLists.txt; the -D BUILD_64=ON argument on all remaining 64-bit Makefile targets; ARCH_WIDTH != 32 conditional in src/blockchain_utilities/blockchain_import.cpp (body retained, guard deleted); -D MDB_VL32 in external/db_drivers/liblmdb/CMakeLists.txt (vendored mdb.c MDB_VL32 code paths are now unreachable in Shekyl builds and deliberately left unpatched in-tree — see docs/VENDORED_DEPENDENCIES.md §"MDB_VL32 — 32-bit retirement note" for the future-update drill); contrib/depends/ toolchain template i686 / armv7 / BUILD_64 / LINUX_32 branches, package recipes for boost / openssl / android_ndk / the arch-asymmetric _cflags_mingw32+="-D_WIN32_WINNT=0x600" line in unbound.mk, README.md host list, .gitignore i686* / arm* entries, packages.md example; cmake/BuildRust.cmake all non-64-bit CMAKE_SYSTEM_PROCESSOR branches; gitian configs (gitian-linux.yml, gitian-android.yml, gitian-win.yml) 32-bit hosts and MinGW alternatives.

  C/C++ conditionals: src/common/compat/glibc_compat.cpp __wrap___divmoddi4 block and __i386__/__arm__ glob symver arms (plus the corresponding -Wl,--wrap=__divmoddi4 linker flag in the root CMakeLists.txt); src/crypto/slow-hash.c outer guard narrowed from __arm__ || __aarch64__ to __aarch64__ and the 32-bit fallback cn_slow_hash_{allocate,free}_state stubs removed; src/crypto/CryptonightR_JIT.{c,h}, src/crypto/CryptonightR_template.h x86 gates narrowed from __i386 || __x86_64__ to __x86_64__; src/cryptonote_basic/miner.cpp FreeBSD APM gates narrowed from __amd64__ || __i386__ || __x86_64__ to __amd64__ || __x86_64__; src/blockchain_db/lmdb/db_lmdb.h __arm__ DEFAULT_MAPSIZE branch removed; src/blockchain_db/lmdb/db_lmdb.cpp MISALIGNED_OK gate narrowed to __x86_64 only. Disambiguation: tests/hash/main.cpp:192,206 <emmintrin.h> SSE-intrinsic gates are x86_64 arch gates, not 32-bit gates, and are not deleted — an earlier draft of STRUCTURAL_TODO.md lumped them with the 32-bit retirement imprecisely.

  Rust: three compile_error! tripwires (A/B/C, above); rust/shekyl-oxide/crypto/helioselene/benches/helioselene.rs target_arch = "x86" branches collapsed to x86_64 only.

  CI: .github/workflows/depends.yml ARM v7 stub replaced with a pointer to this chore; new .github/workflows/cmake-gate-test.yml

  • tests/cmake-gate-test/ enforcing Tripwire D placement.

  Docs: README.md, docs/INSTALLATION_GUIDE.md, docs/RELEASING.md, and docs/COMPILING_DEBUGGING_TESTING.md are now 64-bit-only; docs/VENDORED_DEPENDENCIES.md carries the MDB_VL32 future-update note; docs/STRUCTURAL_TODO.md §"32-bit targets cannot safely run Shekyl" is the canonical reviewer-facing copy; docs/audit_trail/RESOLVED_260419.md §"Chore #3 (v3.1.0-alpha.5) — 32-bit target retirement: security closure" carries the closure narrative.

  Supported architectures going forward: x86_64, aarch64 (Linux and Apple Silicon), riscv64 (Gitian). armhf, armv7, armv6, i686, i386 are out of scope — not deferred, not "maybe later," out of scope. Users on 32-bit hardware must not run Shekyl wallets; node operation on 32-bit hardware is not supported either. Operators on ARM32 / i686 hardware should plan a migration to 64-bit before upgrading past v3.1.0-alpha.5.

  Maintenance benefits are real but secondary: every 32-bit carve-out in STRUCTURAL_TODO.md §"bit-width carve-out without coverage" is eliminated in one chore, closing the dead-scaffolding pattern that motivated the §.

Changed

• Shekyl Foundation institutional release-signing key adopted. v3.1.0-alpha.5 is the first release signed by the Shekyl Foundation institutional signing key (subkey fingerprint 3778 B4C8 63C6 1512 B5FC 2203 6914 D748 23DD A8DC, long ID 6914D74823DDA8DC; primary fingerprint F5F7 5A47 70C9 4FE1 D5A5 AE59 844E 424F 9866 4F44, long ID 844E424F98664F44). The primary certification key is held offline; the signing subkey is hardware-backed (OpenPGP applet) with a two-year expiry (2028-04-18) enforcing a rotation cadence.

  Previous alphas (v3.1.0-alpha.3, v3.1.0-alpha.4) were signed with Rick Dawson's personal maintainer key and remain verifiable against that key — prior signatures are not invalidated. Going forward, maintainer keys remain a valid additive fallback for release-tag signing when the institutional key is unavailable (documented exception, not default path); they continue to be the right tool for commit signing, where authorship-attribution is the question.

  docs/SIGNING.md is rewritten as the canonical, self-contained reference: both key blocks inline (no loose .asc files), an explicit step-by-step release-tag signing ceremony with pre-flight checks, expected-output annotations, a failure-mode table, and a separate downstream-verification path. docs/RELEASING.md §3 (tag creation) now points at the SIGNING.md ceremony and captures the minimum command sequence (gpg --card-status → git tag -u 6914D74823DDA8DC -a -s … → git verify-tag before push) as a summary, not a replacement. Resolves the docs/SIGNING.md §"Future: Foundation institutional signing key" deferral that had been carried forward from V3.1 on the premise that institutional signing required ceremony (offline primary, hardware-backed subkey, bounded expiry) before it added value over a plain personal-key setup; those prerequisites are now in place.

• Logging output format (breaking change, all binaries). Chore #2 of the easylogging++ retirement completes the migration started in V3.1 alpha.4: shekyld, shekyl-wallet-rpc, shekyl-cli, and every other in-tree binary now emit through the same Rust tracing-subscriber stack. The default formatter is tracing_subscriber::fmt::layer, and its line shape is not byte-compatible with the vendored easylogging++ layout it replaces:

  # Before (easylogging++ default format string):
  2026-04-19 14:23:11.042    INFO    global   src/daemon/main.cpp:322    Shekyl 'Codename' (v3.1.0-alpha.3-release)
  
  # After (tracing-subscriber fmt::layer default):
  2026-04-19T14:23:11.042123Z  INFO global: Shekyl 'Codename' (v3.1.0-alpha.3-release)
  

  Timestamps are RFC 3339 UTC (not local time with microseconds), level tokens are full words (ERROR / WARN / INFO / DEBUG / TRACE, not the E / W / I / D / V single letters), the target appears as a structured target: field, and source location (file:line) is elided by default. Log-scraping tooling that parsed the prior format byte-for-byte must be updated; docs/USER_GUIDE.md §"Logging" documents the new shape for operators.

• MONERO_LOGS → SHEKYL_LOG (env-var rename). Every in-tree consumer of MONERO_LOGS now reads SHEKYL_LOG instead. This closes the C++-side half of the per-.cursor/rules/93-legacy- symbol-migration.mdc rename — Chore #1 (V3.1 alpha.4) already migrated the Rust binaries. SHEKYL_LOG accepts the same tracing-subscriber-compatible directive grammar as Chore #1 (bare levels, per-target overrides, module-qualified targets) plus the legacy easylogging++ category grammar (net.p2p:DEBUG,wallet.wallet2:INFO, numeric 0..=4 presets, +/- modifiers) routed through the Rust-side translator. The legacy grammar is preserved on purpose: the ~1,345 MINFO / MDEBUG / etc. call sites in src/ and contrib/ ship category strings in that grammar, and operator runbooks doing SHEKYL_LOG='*:DEBUG,net.p2p:TRACE' must keep working with no downstream edits.

  Operator action required before upgrading past V3.x alpha.0: scripts, systemd units, Docker/Podman compose files, or launch plists that set MONERO_LOGS=... will silently become no-ops. Add a SHEKYL_LOG=... line alongside each MONERO_LOGS=... line before cutting over (both can coexist on pre-Chore-#2 builds so the rollover is safe).

• Log target separator normalized to ::. Targets that used to render in the easylogging++ output as net.p2p / daemon.rpc now appear as net::p2p / daemon::rpc in every tracing-subscriber-rendered line. The FFI boundary (shekyl_log_emit / shekyl_log_level_enabled in rust/shekyl-logging/src/ffi.rs) rewrites dot-separated category names into Rust-idiomatic module-path form before handing the event to the dispatcher, matching the form the legacy-grammar translator emits into EnvFilter directives (net::p2p=trace). Without this, every category-scoped emit from the C++ shim (MCINFO("net.p2p", …), MCLOG(level, "daemon.rpc", …), …) would silently fall through to the bare default clause because EnvFilter compares target strings byte-for-byte. Operator-supplied SHEKYL_LOG directives continue to accept both spellings — the legacy-grammar translator rewrites . to :: on the way in, so SHEKYL_LOG='*:WARNING,net.p2p:TRACE' and SHEKYL_LOG='warn,net::p2p=trace' behave identically. Only the rendered output changes. Log-scraping pipelines that grep for target=net\.p2p need to grep for target=net::p2p (or, per the format-break entry above, net::p2p: at the front of the fields block) instead.

• shekyld default log sink moved to ~/.shekyl/logs/. Under chore/cxx-logging-consolidation, the daemon's default --log-file path changed from <data_dir>/shekyld.log (next to the blockchain database) to ~/.shekyl/logs/shekyld.log, resolved through the Rust FFI's shekyl_log_default_path. Testnet/stagenet/regtest runs use the suffixed base names shekyld-testnet.log / shekyld-stagenet.log / shekyld-regtest.log so the three networks can run side-by-side without clobbering each other's log. Rotation defaults to ~100 MB × 50 archives, and the live file plus every rotated archive are forced to POSIX mode 0600 on Unix — operator-tunable permissions are not a supported knob. Operators who want to keep the legacy next-to-data-dir layout can pass --log-file explicitly; the override path is unchanged.

• CMake Python discovery modernized (Chore #3 follow-up). include(FindPythonInterp) at the top of CMakeLists.txt is replaced with find_package(Python3 COMPONENTS Interpreter REQUIRED) as a single, early, authoritative discovery pass; two downstream shadowing call sites (find_package(Python3 ...) before the economics-params generator and find_package(PythonInterp) before the tests subdir) are deleted. The legacy PYTHON_EXECUTABLE and PYTHONINTERP_FOUND variables are aliased post-discovery so consumers under tests/difficulty/CMakeLists.txt, tests/block_weight/CMakeLists.txt, and the cmake/CheckTrezor.cmake fallback arm continue to work without a cascading migration. The cmake_policy(SET CMP0148 OLD) migration-debt carve-out that preserved the deprecated module on CMake ≥ 3.27 is removed in the same commit — there is no legacy module left to un-deprecate. Resolves the Copilot review comment on PR #15; addresses docs/CHANGELOG.md V3.1.0-alpha.3 entry's own callout of the same migration debt.

Removed

• MONERO_LOG_FORMAT env var (no replacement). The custom format string that MONERO_LOG_FORMAT used to seed on the easylogging++ tree is no longer a tunable. Formatting is owned by the Rust subscriber's layer stack (fmt::layer, optionally stacked with tracing-subscriber feature flags at build time), not by an operator env var. There is no V3.x alpha.0 replacement and no intent to re-add one — if you have a log-format requirement that RFC 3339 UTC does not satisfy, file an issue rather than patching the format string.

• Vendored external/easylogging++/ tree. Deleted in ded9875b6. All call sites that reached el::Logger / el::Configurations / el::base::Writer etc. directly have been rewritten to route through the shekyl_log_emit / shekyl_log_level_enabled FFI in src/shekyl/shekyl_log.h. The el:: namespace survives only as a thin typedef-only compatibility shim in contrib/epee/include/misc_log_ex.h (el::Level, el::Color, el::base::DispatchAction) so the existing MINFO / MDEBUG / MWARNING / MCINFO macros expand without touching the ~1,345 call sites. Closes the STRUCTURAL_TODO.md §"Replace easylogging++ with a maintained logger" item (both chores); swept narrative in docs/audit_trail/RESOLVED_260419.md.

• src/rpc/rpc_version_str.{h,cpp} and its unit test (tests/unit_tests/rpc_version_str.cpp), inherited from Monero. The daemon constructs its own version string deterministically in cmake/GitVersion.cmake from the annotated tag on HEAD, then emits SHEKYL_VERSION_FULL over RPC as an opaque value. The validator regex was a Monero-era sanity check that parsed that string back against a hardcoded pattern — "protecting" consumers from a failure mode that the CMake construction logic already makes impossible.

  Exposed on the v3.1.0-alpha.3 tag-push CI run (#394, test-ubuntu matrix): on a tagged build, SHEKYL_VERSION_FULL resolves to 3.1.0-alpha.3-release, and the regex (adapted from Monero but never taught SemVer 2.0.0 §9 dotted pre-release identifiers) rejects the dot in -alpha.3. Every tagged release using -alpha.N / -beta.N / -rc.N numbering would trip the same assertion — so every tagged release with this file in tree is inherently broken, which is enough of a tell that the file is wrong to have on disk.

  Per .cursor/rules/60-no-monero-legacy.mdc "ask why is this here?" — this is an inherited assertion against a Shekyl-owned invariant. The invariant is enforced by cmake/GitVersion.cmake; the daemon should not re-parse its own output to re-check it. rpc_command_executor.cpp keeps the empty-string guard (if (res.version.empty())) so the CLI still reports "version not available" when the RPC response lacks a version, but no longer attempts to format-validate the string it receives.

Fixed

• Tagged-release ci/gh-actions/cli jobs on test-ubuntu matrix. Follows from the rpc_version_str removal above. v3.1.0-alpha.3 shipped with the daemon, wallet, and source archive built cleanly, but its tag-push CI ran red on this single unit test; v3.1.0-alpha.4 will be the first alpha whose tag-push CI is green end-to-end.

• Tripwire D processor regex broadened; gate-test probe assertion tightened (Chore #3 fixup). The CMAKE_SYSTEM_PROCESSOR arm of the 64-bit-only gate in CMakeLists.txt previously used armv[67]l?, which only matches armv[67] and armv[67]l exactly — real toolchains also emit armv7-a, armv7a, armv7ve, armv7hf, armv6kz, armv5te, etc., which are all 32-bit ARM profiles. Broadened to armv[567].* so the "defense-in-depth" half of the predicate (which fires when CMAKE_SIZEOF_VOID_P is misreported as 8 on a 32-bit target) actually covers those variants. 64-bit names (aarch64, arm64, armv8* in AArch64 mode) remain outside the pattern by construction. Companion tightening in tests/cmake-gate-test/run.sh: the probe-chatter assertion now also catches -- Performing Test ... (from CheckCCompilerFlag / CheckCXXCompilerFlag / CheckLinkerFlag), matching the set of modules actually relocated below the gate; -- Detecting C/CXX compiler ABI info is deliberately NOT caught because those lines come from project() itself, which runs before the gate by construction (the gate's CMAKE_SIZEOF_VOID_P predicate is populated by project()'s own compiler probe). Resolves the second Copilot review on PR #15.

• contrib/depends Win64 unbound build restored (Chore #3 fixup). The $(package)_cflags_mingw32+=-D_WIN32_WINNT=0x600 line in contrib/depends/packages/unbound.mk was deleted in the Chore #3 build-system commit under the mistaken framing of "arch-asymmetric 32-bit MinGW carve-out." The _mingw32 suffix in contrib/depends is the OS segment of the host triple, not an architecture gate: it matches every *-w64-mingw32 host including x86_64-w64-mingw32. Unbound 1.19.1's util/netevent.c uses WSAPoll / POLLOUT / POLLERR / POLLHUP unconditionally and requires _WIN32_WINNT >= 0x0600 to be defined before <winsock2.h> is included; the vendored x86_64-w64-mingw32 toolchain does not default this the way MSYS2 pacman toolchains do, so the deletion broke the depends.yml Win64 lane (the build.yml MSYS2 and MSVC lanes use different toolchain pathways and stayed green). Line restored with the scope unchanged — only one MinGW host remains after Chore #3, and the flag belongs on it.

Known regressions

• MLOG_SET_THREAD_NAME(label) no longer reaches the log stream. The macro still compiles and still evaluates its argument (so -Wunused-value stays quiet at the call sites), but the label ([SRV_MAIN] from abstract_tcp_server2.inl, [miner N] from miner.cpp, DLN from download.cpp) does not appear in emitted events. easylogging++ used this hook to stamp a semantic label into every subsequent log line; the Rust tracing-subscriber formatter reads the OS-level thread name instead (via the platform pthread_getname_np / GetThreadDescription path), and those names are not being populated in Chore #2. Restoring semantic thread labels — either by teaching the C++ shim to call pthread_setname_np + Windows equivalents, or by routing the label through the Rust subscriber as a span field — is tracked as a V3.2 follow-up in docs/FOLLOWUPS.md. The impact is diagnostic only: thread-scoped log lines now show a generic thread ID instead of the human-readable label the prior format carried.

[3.1.0-alpha.3] - 2026-04-19

Added

• Release signing policy and maintainer keys (docs/SIGNING.md). New document establishing that every release tag from v3.1.0-alpha.3 onward is a signed annotated tag created with git tag -a -s. It records the initial maintainer signing key (Rick Dawson, ed25519 FEFEC7EF9952D40C, ASCII-armored public key embedded in the doc so downstream verifiers can import it from the repo without trusting a keyserver lookup), and documents verification with git verify-tag, the reproducible-build cross-check that tag verification does not subsume, procedures for adding new maintainer keys, rotation, retirement, revocation, key hygiene expectations (passphrase, offline revocation certificate, hardware token or encrypted storage, GitHub registration), and the rationale for GPG over SSH signing or Sigstore at this stage. Earlier alpha tags (v3.1.0-alpha.1, v3.1.0-alpha.2) predate this policy and are not signed; their authenticity is established by branch topology and reproducible Guix builds.

Changed

• Branch policy mandates signed annotated release tags and non-fast-forward merges from dev to main. .cursor/rules/06-branching.mdc was updated to require that main advance only via a merge commit (git merge --no-ff dev, GitHub "Create a merge commit") with a signed annotated tag placed on the resulting merge commit. Fast-forward, rebase-and-merge, squash-and-merge, and force-push to main are now explicitly forbidden. The rule cross-links to docs/SIGNING.md at both the Hard rule 1 mention and the Release flow step 4 mention so a maintainer reading the policy lands on the signing doc. A new "Rationale (why merge commit, not fast-forward)" section was added to capture the reasoning so the decision is not re-litigated each cycle.

• docs/FOLLOWUPS.md tracks Shekyl Foundation institutional signing key as V3.1.x+ item. Records the V3.1 decision: release signing uses maintainer keys, not an institutional Foundation key, until the Foundation has multi-maintainer operational structure (two or more active release maintainers). Cross-referenced from docs/SIGNING.md §"Future: Foundation institutional signing key".

Security

• Bump cryptography from 44.0.2 to 46.0.6 in tools/reference/requirements.txt to clear two Dependabot advisories indexed 2026-04-13:

  • GHSA-r6ph-v2qm-q3c2 (high): missing subgroup validation for SECT curves could allow a small-subgroup attack during ECDH.
  • GHSA-m959-cc7f-wv43 (low): incomplete DNS name constraint enforcement on peer names.

  Not exploitable against Shekyl users. cryptography is pulled in only by tools/reference/derive_output_secrets.py, a developer-only HKDF test-vector generator that never ships in any binary and is not on a consensus path at runtime. Inspection shows the cryptography.hazmat.primitives.{hashes,kdf.hkdf} imports in that script are unused — all HKDF logic is hand-rolled with stdlib hmac/hashlib — so the bump cannot change its output. Verified by regenerating docs/test_vectors/PQC_OUTPUT_SECRETS.json under the new version in a clean venv; SHA-256 matches byte-for-byte (1159cb6de2ce3fa4af5d7a8f88eac71ed35c8f00ebf297a4d9259439b6477163).

• Accept seven rand 0.8.5 Dependabot alerts as risk-tolerated. GHSA-cq8v-f236-94qc ("Rand is unsound with a custom logger using rand::rng()") indexes against the five workspace crates that pin rand = "0.8" plus two Cargo.lock files. CVSS is 0 on all seven; the actual exploit requires calling rand::rng() (a 0.9+ thread-local RNG API that does not exist in 0.8) while a custom log::Log implementation is installed. Shekyl uses rand::rngs::OsRng directly and rand_chacha::ChaCha20Rng::from_seed for deterministic derivation, and the daemon installs no custom log::Log, so no Shekyl code path reaches the vulnerable code. Migrating to rand = "0.9" cascades into bumping curve25519-dalek 4 → 5 plus several other crypto crates; per .cursor/rules/20-rust-vs-cpp-policy.mdc that is a planning activity with its own design doc and review cycle, tracked in docs/FOLLOWUPS.md §"rand 0.9 migration and curve25519-dalek 5 cascade" with target V3.1.x. Alerts #3 through #9 dismissed on GitHub with reason "risk tolerated" and a link to the follow-up.

Changed

• wallet2_ffi no longer carries wallet-directory state. Removed wallet2_ffi_set_wallet_dir and the wallet_dir field on wallet2_handle. The four wallet-file FFI entry points (wallet2_ffi_create_wallet, wallet2_ffi_open_wallet, wallet2_ffi_restore_deterministic_wallet, wallet2_ffi_generate_from_keys) now take a full wallet_path parameter in place of the bare filename that was joined with wallet_dir using a hardcoded "/" separator. Path construction was inherited Monero wallet_rpc_server scaffolding and produced mixed-separator paths on Windows (C:\Users\x\...\...//My Wallet.keys). Callers now join paths in Rust via PathBuf::join, which is platform-correct on every target. The legacy C++ wallet_rpc_server.cpp keeps its own wallet_dir state and is unaffected — it does not go through the FFI. The shekyl-cli WalletContext now holds the directory and joins filenames before each call; the shekyl-wallet-rpc Rust shim keeps ServerConfig.wallet_dir for the V3.2 cutover when its handlers will own wallet-file creation. validate_filename was narrowed and renamed to validate_wallet_path (empty-path check only) — path-component validation is the caller's responsibility now that the caller also owns the directory.

• Nightly proptest-exhaustive job tuned and extended to dev. Dropped PROPTEST_CASES from 1_000_000 to 200_000 — the old value could not finish inside the 30-minute runner cap on ubuntu-latest (ML-KEM-768 keygen per case dominates wall time, the run was being cancelled not failed). Raised timeout-minutes to 180 so the job has real headroom, and added a branch matrix [main, dev] with per-branch cache keys so nightly coverage tracks both active histories instead of only the default branch. Actual elapsed time is surfaced via the job's ::notice:: annotation so the 200k / 180m bracket can be tightened once we have real data. See .github/workflows/nightly.yml.

[3.1.0-alpha.2] - 2026-04-17

Retroactive CHANGELOG entry. The v3.1.0-alpha.2 tag was created without promoting [Unreleased] first; the bullets below were subsequently split out from [Unreleased] during the alpha.3 release cycle. The split is based on the commit range v3.1.0-alpha.1..v3.1.0-alpha.2; content is verbatim from the original [Unreleased] copy and has not been edited retrospectively.

Removed

• Daemonizer layer. Deleted src/daemonizer/ (POSIX fork() detach, Windows Service Control Manager registration, console-control glue) and the four thin wrapper classes in src/daemon/ (t_core, t_protocol, t_p2p, t_rpc) plus the executor shim. Background execution is now delegated to systemd (Linux), launchd (macOS), Task Scheduler (Windows), or the Tauri sidecar (GUI wallet); in-process forking and Windows service registration were untested code paths touching privilege boundaries and file-descriptor lifetimes, so their removal is a security improvement in addition to an audit-surface reduction. The removal also breaks the circular include chain where daemon/command_line_args.h transitively pulled windows.h into most of the codebase. Closes FOLLOWUPS.md §"windows-daemonizer-cleanup" and STRUCTURAL_TODO.md §"Daemonizer removal".
• Daemonizer CLI flags: --detach, --pidfile, --install-service, --uninstall-service, --start-service, --stop-service, --run-as-service. Both shekyld and shekyl-wallet-rpc accept these only long enough to print a migration message pointing at platform service managers (see src/common/removed_flags.{h,cpp}, marked TODO(v3.2) for deletion alongside the shekyl-wallet-rpc Rust cutover). --non-interactive is preserved in both binaries.

Changed

• Daemon orchestration class renamed. daemonize::t_daemon is now daemonize::Daemon in shekyld, and shekyl-wallet-rpc's unrelated inline class is now WalletRpcDaemon. The two binaries no longer share a type name, clarifying audit scope and the V3.2 Rust cutover plan.
• Default data directory resolution moved to src/common/. The admin-vs-user CSIDL_* branching formerly in daemonizer now lives in common/daemon_default_data_dir.{h,cpp}, preserving the exact path shekyld resolved before V3.1. Pinned by a new daemon_default_data_dir unit test so a future refactor cannot silently point operators at an empty data directory.
• MSVC CI job now builds --target daemon wallet instead of just --target wallet, matching what the GUI wallet release workflow actually compiles. Future MSVC regressions in daemon code will be caught in shekyl-core CI rather than surfacing in the GUI wallet release after an hour of compilation.

Fixed

• Fixed probabilistic flake in shekyl-crypto-pq::multisig_receiving::tests::scan_wrong_participant_ciphertext_fails. The view tag hint is a single byte by design (fast scanner pre-filter), so a wrong-ciphertext decapsulation had ~1/256 chance of producing a hint that collided with the published one, causing the test's rejection assertion to fail. Test now retries keypair generation (bounded to 64 attempts) until the wrong-ciphertext hint actually differs, so the rejection path is exercised deterministically. No protocol or code change; scan semantics are unchanged.
• Made all src/daemon/ headers self-contained for MSVC portability: protocol.h (6 missing includes), p2p.h (2), daemon.h (2), rpc.h (2). These headers relied on include ordering from their callers, which GCC/Clang tolerated but MSVC rejects.
• Fixed #ifdef inside MERROR() macro argument in core_rpc_server.cpp (undefined behavior, C2059 on MSVC). Replaced with literal function name.
• Explicitly captured handshake in lambda in abstract_tcp_server2.inl (C3493 on MSVC).
• Explicitly captured credits_per_hash_threshold in lambda in core_rpc_server.cpp (C3493 on MSVC).
• SFINAE-constrained network_address template constructor in net_utils_base.h to prevent MSVC eager instantiation (C2039).

[3.1.0-alpha.1] - 2026-04-15

First public alpha release. First green CI in repository history.

This release establishes the Shekyl versioning scheme: software versions follow SemVer independently per repo; the protocol version is a separate integer (protocol_version = 3). See docs/VERSIONING.md for the full scheme. The version jump from prior tags (v3.0.x-RC series) to 3.1.0 reflects the addition of FROST-style multisig to the feature set.

Highlights

• FCMP++ end-to-end test suite passing. The full prove-sign-verify pipeline works across C++ and Rust via FFI, validated by 10-iteration randomized round-trip tests and C++ unit tests on Ubuntu 22.04/24.04, Arch Linux, macOS, and Windows.

• Five FCMP++ integration bugs fixed. Root causes documented in docs/FOLLOWUPS.md audit trail: FFI depth/layers off-by-one, branch extraction loop bound, missing point-to-scalar conversion, leaf count off-by-one, key image y-normalization breaking batch verification. Additionally, a sixth bug (FFI depth-to-layers convention ambiguity) was found and fixed during CI stabilization.

• V3.1 multisig protocol specified and implemented. FROST-style coordinator-less multisig with hybrid PQC signing, specified in docs/PQC_MULTISIG.md and wire format in docs/SHEKYL_MULTISIG_WIRE_FORMAT.md. 93 unit tests, 19 integration tests, 11 fuzz harnesses.

• Versioning scheme established. docs/VERSIONING.md defines SemVer for software versions and a separate integer protocol version. SHEKYL_PROTOCOL_VERSION constant added to cryptonote_config.h, exposed via --version output and /get_info RPC.

Unreleased

✨ Added

• PQC Multisig V3.1: equal-participants protocol implementation. Full implementation of the coordinator-less multisig protocol as specified in PQC_MULTISIG.md. Key components:

  • MultisigKeyContainer v1.1 with spend_auth_version field and multisig_group_id v1.1 (includes version byte)
  • rotating_prover_index: cryptographic hash-based prover assignment
  • 8 HKDF-derived key/nonce labels for domain-separated derivation
  • construct_multisig_output_for_sender, scan_for_multisig_output, validate_multisig_output_i7 for output lifecycle
  • GriefingTracker: per-output cost bounding for invalid outputs
  • shekyl1m Bech32m address format with file-based handling and 3-representation fingerprint
  • SpendIntent: 14-check validation pipeline (structural, temporal, chain state, balance)
  • ProverOutput, SignatureShare, ProverReceipt: prover and signing flow types with equivocation detection
  • Honest-signer invariants I1–I7 enforcement
  • MultisigEnvelope with 11 message types and AEAD encryption (ChaCha20-Poly1305 with HKDF-derived keys)
  • Per-intent state machine (8 states: Proposed → Broadcast + terminal)
  • HeartbeatTracker: liveness, censorship, and sync anomaly detection
  • CounterProof: 8-rule chain evidence verification for counter recovery
  • C++ tx_extra tags 0x08, 0x09, 0x0A for multisig metadata
  • FFI: shekyl_pqc_verify_with_group_id for defense-in-depth
  • Consensus: scheme_id consistency enforcement across transaction inputs

• PQC Multisig V3.1: GUI components (shekyl-gui-wallet). 7 React components for the multisig UX:

  • FingerprintBadge: grouped hex fingerprint with copy and metadata
  • ProverView: per-participant prover assignment breakdown
  • LossAcknowledgment: mandatory 1/N loss checkbox
  • AddressProvenance: fingerprint history with change detection
  • RelayConfig: multi-relay management with operator diversity
  • ViolationAlert: I1–I7 violation display with auto-abort
  • SigningDashboard: real-time intent state with sign/veto actions

• PQC Multisig V3.1: test infrastructure.

  • 93 unit tests across all V3.1 modules
  • 19 integration tests (functional, adversarial, determinism)
  • 4 cross-platform determinism canaries with pinned byte prefixes
  • 11 fuzz harnesses (wallet-core) covering serialization, encryption, state machine, validation, and verification
  • Criterion benchmarks for intent_hash, encryption, serialization, fingerprint computation, and assembly consensus

• docs/MULTISIG_OPERATIONS.md: end-user operations guide covering group setup, receiving, spending, recovery, relay configuration, and security considerations.

• docs/AUDIT_SCOPE.md: expanded to include V3.1 multisig attack surface (KDF, prover assignment, invariants, AEAD, CounterProof, griefing defense).

• docs/SHEKYL_MULTISIG_WIRE_FORMAT.md: standalone portable wire format spec for the V3.1 multisig protocol. Covers MultisigEnvelope binary layout, SpendIntent canonical serialization, 11 message type discriminants, AEAD parameters (ChaCha20-Poly1305 with HKDF-SHA256), DecryptedPayload encoding, chain state fingerprint computation, file transport conventions, and conformance requirements. Enables third-party wallet implementations without reading the full spec.

• GroupDescriptor: canonical JSON backup file format for multisig groups. One file contains everything needed to restore a group from seeds (group_id, threshold, pubkeys, relays, fingerprint). Rust type in shekyl-wallet-core, Tauri export/import commands, and GUI component in shekyl-gui-wallet.

• Failure-mode UX: Multisig page restructured with 6 failure-mode alert banners (unresponsive co-signer, counter divergence, relay disconnect, fingerprint change, stuck intent, CounterProof failure). All Phase 3 components (SigningDashboard, ViolationAlert, ProverView, FingerprintBadge, LossAcknowledgment, AddressProvenance, RelayConfig) wired into the Multisig page.

• File-based transport: promoted from placeholder to first-class GUI option with Tauri file I/O commands and functional import/sign/export workflow. Equal prominence with relay transport.

• Fee impact analysis: added to MULTISIG_OPERATIONS.md with tx size comparison, per-input/per-output overhead, Bitcoin comparison, and economic viability analysis for small transactions.

• Address format discipline: cursor rule 65-address-format-discipline.mdc codifying that shekyl1m is the sole multisig HRP for V3.x, with version bytes as the extension mechanism.

📚 Documentation

• docs/MULTISIG_OPERATIONS.md: expanded from 222-line protocol reference to ~500-line comprehensive operations guide with decision framework, 3 operational playbooks, 6 failure recovery guides, threat model worksheet, and honest limitations section.

• docs/FOLLOWUPS.md: added hardware wallet constraints (ML-DSA-65 computation cost on Cortex-M, screen constraints, vendor outreach) and headless co-signer service reference implementation, both targeting V3.2.

• GUI wallet cursor rules: added 81-no-protocol-knowledge.mdc (users never see FCMP++, KEM, HKDF in the UI) and 82-failure-mode-ux.mdc (every feature must enumerate failure modes before implementation, failure states get dedicated UI).

🔒 Security

• Zeroize ephemeral multisig signing seeds. ed_seed and ml_seed stack copies in construct_multisig_output_for_sender are now wrapped in Zeroizing<[u8; 32]>, ensuring automatic zeroing on drop. Closes a theoretical side-channel surface from FOLLOWUPS.md V3.1 audit response.

• PersistedMultisigOutput Debug redaction. The Debug derive on PersistedMultisigOutput was replaced with a manual implementation that redacts my_shared_secret (64-byte KEM-derived material). Prevents accidental secret exposure through dbg! or structured logging.

• validate_balance checked arithmetic. SpendIntent::validate_balance now uses checked_add for input sums, output sums, and fee addition. Previously used wrapping sum() — crafted u64 values could wrap both sides to the same value and pass the equality check.

• HKDF derivations return Result. derive_multisig_kem_seed and derive_participant_kem_randomness now return Result<..., CryptoError> instead of panicking via .expect() on the transaction construction path.

• eprintln! removed from shekyl_fcmp_verify FFI. Two diagnostic eprintln! calls in the FCMP verification FFI path have been removed. The C++ caller already logs verification failures; the Rust-side stderr output was redundant and failed the CI lint.

🐛 Fixed

• FCMP++ FFI: move depth-to-layers conversion to C++ callers. shekyl_fcmp_prove and shekyl_fcmp_verify previously converted LMDB depth to upstream layers internally (layers = depth + 1). This created an ambiguous contract where the same tree_depth parameter meant different things in different FFI functions. Now both functions accept the upstream layers count directly; C++ callers (blockchain.cpp, rctSigs.cpp) perform depth + 1 before calling. shekyl_sign_fcmp_transaction still accepts LMDB depth and converts internally (wallet callers pass LMDB depth). Added diagnostic tracing to proof::verify for FcmpPlusPlus::read and key image decompression failures. Fixed validate.rs c1/c2 alternation comment (the formula was correct but had been transiently swapped during refactoring). Tests simplified to single-layer Selene root (layers=1) to match the Rust unit test convention.

• CI: fix cargo audit failure from RUSTSEC-2026-0098/0099. Bumped rustls-webpki 0.103.10 -> 0.103.12 and rand 0.9.2 -> 0.9.4 in Cargo.lock. Added rust/audit.toml to acknowledge rand 0.8.5 (RUSTSEC-2026-0097, not applicable: Shekyl uses OsRng, not rand::rng() with a custom logger).

• Remove dead verify_transaction_pqc_auth one-arg overload. The no-argument overload in tx_pqc_verify.cpp had zero callers — the sole production caller (blockchain.cpp) uses the two-arg form with expected_scheme_id. Replaced with a default parameter. Per 15-deletion-and-debt.mdc: dead code goes.

• Fix stale shekyl_ffi.h shekyl_pqc_verify_debug comment. The error code documentation (0-4) did not match the Rust PqcVerifyError enum (0-11). Updated to reflect the actual repr(u8) discriminants.

• Reconcile FOLLOWUPS.md and STRUCTURAL_TODO.md. Marked 5 items in STRUCTURAL_TODO as resolved (code already fixed). Corrected the expected_scheme_id FOLLOWUPS entry (parameter is actively used by blockchain.cpp, contrary to the prior note). Marked rpassword audit as covered by CI.

🔄 Changed

• FFI: verification functions return typed u8 error codes instead of bool. shekyl_pqc_verify, shekyl_pqc_verify_with_group_id, and shekyl_fcmp_verify now return 0 on success and a nonzero error discriminant on failure. PQC verify uses PqcVerifyError codes 1-11; FCMP verify uses VerifyError codes 1-7. Error codes are available in all build modes, eliminating the debug-only double-call pattern. C++ callers (tx_pqc_verify.cpp, blockchain.cpp) updated to log error codes unconditionally. Per 30-ffi-discipline.mdc.

• Clippy lint rename: unchecked_duration_subtraction → unchecked_time_subtraction. Updated in workspace Cargo.toml to track the upstream rename.

🗑️ Removed

• shekyl_pqc_verify_debug deleted. Now that production shekyl_pqc_verify returns typed error codes, the debug-only variant is redundant. All call sites and the #ifndef NDEBUG C header guard removed.

🐛 Fixed (continued)

• All Rust clippy warnings resolved in shekyl-crypto-pq. Fixed 1 error (missing_fields_in_debug in PersistedMultisigOutput) and 13 warnings: op_ref (11 sites in kem.rs, montgomery.rs, output.rs), needless_range_loop and unnecessary_map_or (in multisig_receiving.rs), uninlined_format_args (in output.rs tests). Also ran cargo fmt across workspace.

• FCMP++ proof verification: five integration bugs fixed, first green CI. The FCMP++ core tests (gen_fcmp_tx_valid, gen_fcmp_tx_double_spend, gen_fcmp_tx_reference_block_too_old, gen_fcmp_tx_reference_block_too_recent, gen_fcmp_tx_timestamp_unlock_rejected) have never passed since integration. Root causes identified and fixed:

  1. FFI depth/layers off-by-one. LMDB stores 0-indexed tree_depth; the upstream library expects 1-indexed layers count. Fix: layers = tree_depth + 1 at the FFI boundary.
  2. C++ branch extraction loop was < depth instead of <= depth. Both genRctFcmpPlusPlus and assemble_tree_path_for_output skipped the root layer's branch data. Fix: layer <= tree_depth in both.
  3. Point-to-scalar conversion missing in witness construction. Raw LMDB point hashes were passed as branch siblings without converting to cycle scalars. Fix: selene_to_helios_scalar / helios_to_selene_scalar applied during genRctFcmpPlusPlus branch assembly.
  4. compute_leaf_count_at_height off-by-one. Maturity comparison used <= target_height + 1 while LMDB's drain_pending_tree_leaves uses <= current_height. Fix: removed the + 1 to match LMDB semantics.
  5. key_image_y_normalize broke Ed25519 batch verification. The normalization (clearing byte 31 sign bit) modified the key image away from the true x * Hp(O) used by the Rust prover. Fix: deleted key_image_y_normalize entirely — FCMP++ key images are not y-normalized.
  6. PQC signing payload computed before all public keys were derived. get_transaction_signed_payload hashes all inputs' hybrid_public_key values, but the single-loop approach signed early inputs before later keys existed. Fix: two-phase PQC signing (derive all keys, then sign all inputs). All 5 FCMP++ core tests, 4 staking tests, 28 FCMP unit tests, and 45 Rust shekyl-fcmp tests now pass. This is the first green CI in the repository's history.

• Consensus-critical: curve tree leaf ordering bug (DB v6 → v7). pending_tree_leaves used MDB_DUPSORT on 128-byte leaf data, causing outputs with the same maturity height to drain into the curve tree in byte-sorted order rather than global_output_index order. This broke the implicit global_output_index == tree_leaf_index assumption that every caller of get_curve_tree_leaf() relied on. Replaced with 16-byte composite keys BE(maturity) || BE(output_index) enforcing canonical drain order. Same restructuring applied to pending_tree_drain. Added explicit bidirectional mapping tables (output_to_leaf, leaf_to_output) and a block_pending_additions journal for robust pop_block reversal. DB schema bumped to v7 (incompatible with v6 — requires resync).

• get_curve_tree_leaf() parameter was silently misnamed. The function accepted global_output_index in its signature but actually looked up by tree position. Renamed to get_curve_tree_leaf_by_tree_position() and added get_curve_tree_leaf_by_output_index() (double lookup via mapping table). All callers updated — compile errors catch any missed sites.

• check_stake_claim_input now recomputes and verifies the stored leaf. Previously the stake claim gate only checked bounds (staked_output_index < leaf_count). Now the stored leaf is retrieved via the output→leaf mapping and bytewise-compared to a leaf recomputed from the output's (output_key, commitment, h_pqc). This binds the claim to the actual output data in the tree.

✨ Added

• src/blockchain_db/shekyl_types.h: Strongly-typed identifiers (TreePosition, OutputIndex, MaturityHeight, BlockHeight) and LMDB key/value encoders (PendingLeafKey, DrainKey, DrainValue, BlockPendingKey, BlockPendingValue) for curve-tree state. Designed for 1:1 translation to Rust newtypes and heed BytesEncode/BytesDecode.

• 4 new regression tests in deferred_insertion.cpp: same-maturity drain order by output_index, block_pending_additions journal round-trip, output↔leaf mapping round-trip, pop_block journal-driven reversal simulation.

📋 Protocol

• X25519 public key derived from Ed25519 view key. The X25519 public key used in the hybrid KEM classical component is the Edwards→Montgomery image of the Ed25519 view public key: x25519_pub = (1 + y) / (1 - y) mod p. It is not carried in the address or generated independently. The Bech32m address PQC segments carry ML-KEM material exclusively. See POST_QUANTUM_CRYPTOGRAPHY.md §X25519 Binding to View Key.

• Unclamped Montgomery DH (not RFC 7748 X25519). The classical KEM component performs Scalar * MontgomeryPoint with the Ed25519 view scalar as the private input. RFC 7748 scalar clamping is not applied because the view scalar is already reduced mod ℓ; clamping would mutate it and desynchronize sender/receiver derivation. See POST_QUANTUM_CRYPTOGRAPHY.md §DH Semantics.

• Low-order Montgomery point rejection (validation rule). Recipients MUST reject low-order Montgomery points on kem_ct_x25519 before performing DH: if (8 * point).is_identity() → reject. This replaces RFC 7748 clamping's cofactor-clearing role. Sender-side check on the derived recipient X25519 pub is defense-in-depth. See POST_QUANTUM_CRYPTOGRAPHY.md §DH Semantics.

• m_pqc_public_key layout invariant: 1216 bytes. X25519_pub[0..32] || ML-KEM-768_ek[32..1216] where X25519_pub is derived (never transmitted). Canonical assemblers: get_account_address_from_str, generate_pqc_key_material. Runtime checks enforce exact size at every split site.

• Wallet key consistency invariant. m_pqc_secret_key[0..32] == m_view_secret_key. Wallet refuses to open on mismatch.

• X25519 derivation test vectors published. docs/test_vectors/PQC_TEST_VECTOR_005_X25519_DERIVATION.json pins the Ed25519→X25519 derivation, unclamped DH shared secrets, low-order rejection inputs, and Edwards rejection inputs for third-party implementers.

✨ Added

• montgomery.rs: Edwards→Montgomery conversion, unclamped scalar interpretation, low-order point detection. (shekyl-crypto-pq)
• shekyl_view_pub_to_x25519_pub FFI export for C++ callers. (shekyl-ffi)
• Genesis reproducibility artifacts: verify_genesis.py script and GENESIS_BUILD_INFO.txt. (shekyl-dev/tools/genesis_builder/)

🔄 Changed

• genesis_builder print_usage updated to Bech32m. Usage example now shows <bech32m> addresses instead of <base58>.

🐛 Fixed

• Fixed core_tests FCMP++ proof verification failures. gen_fcmp_tx_valid, gen_fcmp_tx_double_spend, and gen_staking_lifecycle all failed with "FCMP++ proof verification failed" because test-chain block headers carried a placeholder curve_tree_root (selene_hash_init) while witness paths were assembled from the real LMDB tree. Added per-height curve tree root storage (m_curve_tree_roots LMDB table) so both the prover and verifier read the correct historical root for any reference block height. Also aligned compute_leaf_count_at_height in chaingen.cpp with production collect_outputs logic (output-type filtering and outPk bounds checks).

• Reverted vcpkg.json manifest that broke MSVC CI. Commit 397817b introduced a vcpkg.json with "builtin-baseline": null, which caused the MSVC CI job to fail (vcpkg auto-detected the manifest and rejected the null baseline). The CI workflow already manages vcpkg dependencies via explicit CLI invocation. Deleted the manifest to restore the working state.

• Restored and upgraded JsonSerialization.FcmpPlusPlusTransaction test. Replaced ring-style make_transaction with make_fcmp_transaction() that constructs a real v3 FCMP++ transaction via the full Rust FFI signing pipeline: KEM keypair generation, output construction, scan-and-recover, curve tree leaf/root building, FCMP++ proof signing and verification, and PQC auth signing. The test now exercises real cryptographic operations (not stubs) before round-tripping through JSON serialization. Deprecated wallet_tools::gen_tx_src with migration note pointing to the FCMP++ pipeline in chaingen.cpp.

• Fixed rctSig JSON serializer missing message and referenceBlock. The JSON round-trip for rct::rctSig did not serialize the message field (tx prefix hash) or the referenceBlock field (for RCTTypeFcmpPlusPlusPqc). Both are part of the binary wire format in rctTypes.h but were silently lost during JSON serialization. Added message to all rctSig JSON output and referenceBlock for FCMP++ transactions. Discovered by the FcmpPlusPlusTransaction JSON round-trip test.

• on_get_curve_tree_path RPC consistency fix. The RPC handler read leaf_count from tip state but returned a reference_block several blocks behind tip. If the tree grew in between, the returned leaf data and layer hashes did not match the reference block's curve_tree_root. Fixed by computing ref_leaf_count at reference_height via drain journal, capping all reads to that count, and applying boundary-chunk hash trimming for sibling chunks that changed since the reference block. Mirrors the fix already applied to the test harness in chaingen.cpp.

• MSVC portability batch. Expanded src/common/compat.h with centralized platform-conditional includes for unistd.h/io.h, dlfcn.h, and sys/mman.h. Added AND NOT MSVC guards to monero_enable_coverage (GCC-only --coverage flags) and enable_stack_trace (GNU ld -Wl,--wrap=__cxa_throw). Fixed bootstrap_file.cpp long types to std::streamoff/uint64_t for LLP64 correctness. Fixed unsigned negation in wallet2.cpp:772 (std::advance(left, -N) where N is size_t) with static_cast<ptrdiff_t>. Created root vcpkg.json manifest for deterministic dependency management.

• FCMP++ test harness: tree state mismatch. assemble_tree_path_for_output and construct_fcmp_tx in tests/core_tests/chaingen.cpp read the current (tip) curve tree state but the verifier checks against the reference block's historical tree root. Fixed by computing ref_leaf_count at the reference block height and capping all leaf/layer reads to that count, with boundary chunk hash trimming via shekyl_curve_tree_hash_trim_selene for siblings that changed since the reference block. Also fixed a layer offset bug where sibling hashes were read from layer instead of layer - 1.

• FCMP++ test harness: staking tests missing FCMP++ pipeline. gen_staking_lifecycle and gen_stake_all_tiers used construct_staked_tx which produced stub RCT signatures without FCMP++ proofs or PQC auth. Rewritten to use callback-based testing (like gen_fcmp_tx_valid) with a new construct_fcmp_staked_tx that routes through the full FCMP++ proving and PQC signing pipeline via apply_fcmp_pipeline.

🔄 Changed

• Unified constant-time comparison for all 32-byte crypto types. public_key, key_image, and hash now use crypto_verify_32 via CRYPTO_MAKE_HASHABLE_CONSTANT_TIME instead of memcmp-based CRYPTO_MAKE_HASHABLE. Eliminates the footgun of a developer choosing the non-constant-time macro for a new secret-bearing 32-byte type.

• Added ct_signatures type alias. using ct_signatures = rct::rctSig; added in cryptonote_basic.h as the starting point for migrating away from the Monero-era rct_signatures name. Full caller migration and rct:: namespace rename deferred to V4.

• Documented alternative tokens decision. Keeping /FIiso646.h workaround for MSVC; mechanical replacement of not/and/or is high-effort, low-value. Recorded in STRUCTURAL_TODO.md.

• Workspace-wide clippy cleanup. Resolved all cargo clippy --all-targets --no-deps -- -D warnings errors across the Rust workspace (14 crates, 52 files). Key changes: replaced as u128 casts with u128::from(), added #[allow] for intentional truncation in economics/FFI code, marked FFI extern "C" functions unsafe with # Safety docs, replaced redundant closures with method references, used let...else, switched from_slice to GenericArray::from() in chacha20poly1305, changed &Vec<T> to &[T] in public APIs. No behavioral changes.

✨ Added

• Fuzz target for derive_output_secrets. New fuzz_derive_output_secrets cargo-fuzz harness in rust/shekyl-crypto-pq/fuzz/. Exercises arbitrary combined_ss inputs (up to 1200 bytes) and output indices; asserts determinism, non-zero ho/y scalars, and absence of panics on truncated/oversized input. Closes FOLLOWUPS.md fuzz-derivation item.

• Witness header round-trip test. New witness_header_build_then_parse_roundtrip test in rust/shekyl-ffi/ with locked vectors in docs/test_vectors/WITNESS_HEADER.json. Proves shekyl_fcmp_build_witness_header (writer) and parse_prove_witness (reader) agree byte-for-byte on all 8 header fields [O:32][I:32][C:32][h_pqc:32][x:32][y:32][z:32][a:32]. Closes FOLLOWUPS.md witness-roundtrip item.

📚 Documentation

• y=0 consensus check resolved as infeasible. Documented that a consensus-level rejection of outputs with y=0 T-component cannot be implemented: the verifier does not know y (it is a KEM-derived secret) and testing whether O lies in the G-only subgroup requires knowing the DL between G and T. Defense is structural via derive_output_secrets hard-assert and fuzz coverage. Closes FOLLOWUPS.md y=0-consensus item.

• scheme_id binding analysis corrected in PQC_MULTISIG.md. The expected_scheme_id parameter in verify_transaction_pqc_auth is unused because FCMP++ hides which output is being spent. Scheme downgrade protection is provided by the h_pqc curve tree leaf commitment — the FCMP++ proof binds H(hybrid_public_key) to the leaf, making a downgrade require a Blake2b-512 collision. Updated Attack 1 mitigation description and POST_QUANTUM_CRYPTOGRAPHY.md accordingly.

• FOLLOWUPS.md and STRUCTURAL_TODO.md audit and cleanup. Marked 5 stale items as resolved (2 in FOLLOWUPS, 3 in STRUCTURAL_TODO): signing_round_trip.rs now exercises FFI, AUDIT_SCOPE.md exists, C++20-isms audit complete, easylogging++ MSVC fully fixed, wallet2.h:2324 bool/char pattern removed by wallet refactoring. Updated 2 stale references: simplewallet.cpp deleted (removed from long type sites and memcmp resolution list), wallet2.cpp:782 shifted to line 772. Updated test memcmp count from 84 to ~90. Annotated expected_scheme_id removal as deferred to PQC multisig PR.

📚 Documentation

• Cross-repo documentation audit. Comprehensive review across all five Shekyl repos fixing stale references, Monero-era branding, completed-but- unchecked items, and broken cross-references. Key changes:
  • README.md: Removed Monero CI badges (Coverity, OSS Fuzz, Coveralls), stale distribution packages (apt install monero, etc.), Raspberry Pi Jessie instructions, 2022-era pruning sizes, monerod.conf references. Fixed research section cross-references to shekyl-dev repo.
  • proxies.md: Renamed "Monero ecosystem" to "Shekyl ecosystem".
  • DOCUMENTATION_TODOS_AND_PQC.md: Fixed FCMP++ "Phase 8" references (doc exists), CryptoNight reference (Shekyl uses RandomX from genesis), CURVE_TREE_OPERATIONS.md reference (covered in FCMP_PLUS_PLUS.md), v2.0 tx references (should be v3).
  • INSTALLATION_GUIDE.md: FCMP_PLUS_PLUS.md exists, not "planned."
  • V4_DESIGN_NOTES.md: Checked boxes for items done in V3.
  • RELEASE_CHECKLIST.md: Marked wallet/exchange/pool entries as placeholders for Shekyl-specific partners.
  • FOLLOWUPS.md: Added items for fuzz harness on derive_output_secrets, witness header round-trip test, y=0 consensus check, and AUDIT_SCOPE.md creation.
  • KEM plan: Updated 18 todo items from pending to completed matching actual codebase state.

🗑️ Removed

• tests/unit_tests/address_from_url.cpp deleted. The test referenced MONERO_DONATION_ADDR (removed constant) and tested Monero OpenAlias DNS resolution against donate.getmonero.org. Both the constant and the DNS endpoint are irrelevant to Shekyl; the test broke the macOS CI build.

• simplewallet (shekyl-wallet-cli) deleted. The 9,126-line C++ interactive wallet REPL has been removed. Its replacement, shekyl-cli (Rust), was already at full parity for all actively-used commands. Removed src/simplewallet/ directory, CMake target, CI artifact references, and Windows installer entries. The translations/ directory retains simplewallet-era .ts strings as dead entries within shared i18n files.

• wallet/api/ C++ wrapper layer deleted. The 3,909-line Monero-era C++ wrapper (wallet2_api.h and 10 implementation files) had no production consumer -- the GUI uses wallet2_ffi via shekyl-wallet-rpc (Rust). Removed src/wallet/api/ directory, tests/libwallet_api_tests/, and the add_subdirectory(api) entry from src/wallet/CMakeLists.txt. Cleaned up stale #include "wallet/api/*.h" references in object_sizes.cpp and address_from_url.cpp.

🐛 Fixed

• 19 core_tests failures and SEGFAULT from v3 transaction incompatibility. The test framework's construct_miner_tx_manually was hardcoded to produce v2 transactions without PQC output construction, causing 16 block validation tests to fail during generation and a SEGFAULT in tx_validation tests. Rewrote the function to perform genuine v3 output construction via shekyl_construct_output FFI. Added append_v3_output_to_miner_tx helper for tests that add outputs to coinbase. Fixed fill_tx_sources to populate ho/v3_ho_valid on source entries via try_v3_scan_output. Removed stale classical key derivation from view tag tests. Fixed serialization consistency in tests that modify vout/vin without updating rct_signatures fields.

• Non-exhaustive TxBuilderError match in FFI error-code mapping. Commit aff9f777 added TreeDepthTooLarge(u8) to TxBuilderError but did not add the corresponding arm to tx_builder_error_code() in shekyl-ffi, breaking CI compilation on all platforms. Added TreeDepthTooLarge(_) => -27.

[core-v3.1.0] - 2026-04-13

🔄 Changed

• Dev merged into main. 128 commits from dev promoted to main including: FCMP++ curve-tree integration, hybrid PQC KEM scanning, shekyl-cli full parity, shekyl-address Bech32m encoding, native Rust transaction signing, staking enhancements, wallet/api removal, and ZeroMQ cleanup. Tagged as core-v3.1.0 for GUI wallet CI pinning.

✨ Added

• shekyl-cli full parity with simplewallet (40 of 81 commands). The rust/shekyl-cli/ crate now covers all actively-used simplewallet functionality. Key additions since the initial scaffold:

  • Security-hardened UX: display.rs for secret display with TTY checks, multiplexer warnings, best-effort scrollback clear, and honest residual-scrollback warning. errors.rs for JSON-RPC error sanitization (strips paths/hex; --debug routes raw errors to stderr or 0600 log file, never stdout). Context-specific confirm_dangerous() tokens for destructive operations (sweep amount, address prefix, acknowledgment phrase).
  • Stateless account model: ReplSession holds session-default account on REPL stack; ResolvedCommand enum resolves --account N at parse time. No wallet-level current-account state. --subaddr-index/--subaddr-indices for subaddress selection.
  • Independent daemon client: daemon.rs using ureq (rustls backend, pinned) for chain_health. SOCKS stream isolation via distinct auth username. --daemon-ca-cert and --proxy CLI flags. Differentiated error reporting (5 failure modes).
  • Staking: stake, unstake, claim, staking_info, chain_health.
  • Keys: viewkey, spendkey with terminal safety; export_key_images (0600 permissions, --since-height, --all); import_key_images with format validation.
  • Proofs: get_tx_key, check_tx_key, get_tx_proof, check_tx_proof, get_reserve_proof, check_reserve_proof.
  • Wallet ops: password (old-first with fast-fail validation), rescan (confirm_dangerous), sweep_all (privacy warning), show_transfer.
  • Offline signing: describe_transfer, sign_transfer, submit_transfer; --do-not-relay on transfer.
  • Signing: sign, verify (domain separation documented), version, wallet_info (no filename).
  • Input validation: validate.rs with hex, txid, address, and input-length validators.
  • Fuzz tests: proptest dev-dependency with 14 property tests for amount parsing, hex validation, address validation, and argument parsing.
  • Parity matrix: docs/CLI_PARITY_MATRIX.md maps all 81 simplewallet commands to shekyl-cli equivalents or explicit out-of-scope with reasons. Phase 3 deletion gate defined.
  • Categorized help with per-command usage docs and domain-separation note on sign/verify.

• CI gate: dalek-ff-group version isolation. Added a workflow step that asserts shekyl-ffi's normal dependency tree never pulls in dalek-ff-group v0.4. The 0.4 version is allowed transitively inside ciphersuite internals but must never be used directly by Shekyl code.

• CI lint: no debug macros in production Rust. Added a workflow step that rejects eprintln!, dbg!, and println! in production Rust code (excluding test modules, build scripts, binary entry points, and the economics simulator). Prevents accidental debug logging from reaching production builds.

• CI lint: BOOST_FOREACH guard. Added a workflow step that fails if any BOOST_FOREACH usage is reintroduced via upstream cherry-picks. All 31 prior instances were replaced with range-based for loops.

🔄 Changed

• CI lint: exclude shekyl-cli from debug-macro ban. The interactive CLI REPL legitimately uses println!/eprintln! for terminal output. The lint now skips rust/shekyl-cli/ to avoid false positives on binary crate I/O.

🐛 Fixed

• [CONSENSUS] Genesis TX blobs upgraded to v3 wire format. The hardcoded GENESIS_TX hex in cryptonote_config.h (mainnet, testnet, stagenet) was still in the legacy v2 format, missing the enc_amounts and outPk arrays required by the current serialize_rctsig_base. Updated all three blobs to v3 (tx.version = 3) with zero-filled enc_amounts/outPk for RCTTypeNull coinbase. This was the root cause of core_tests SEGFAULT, block_weight failure, and wallet init failures in CI.

• JSON serialization now includes enc_amounts/commitments for RCTTypeNull coinbase. The toJsonValue/fromJsonValue for rct::rctSig previously skipped these fields for RCTTypeNull, but the binary wire format serializes them for all RCT types since the v3 format change. This caused JSON round-trip failures for coinbase transactions.

• HTTP_Client_Auth.MD5_auth test used hardcoded empty cnonce. The test computed the expected MD5 digest with cnonce="" while the production http_auth.cpp generates a random cnonce. Fixed to extract the actual cnonce from the parsed auth response.

🗑️ Deprecated

• test::make_transaction ring-style helper. The helper constructs Monero-era ring-signature source entries incompatible with v3/FCMP++ transaction construction. BulletproofPlusTransaction is GTEST_SKIP'd pending FCMP++ test infrastructure.

• [CONSENSUS-ADJACENT] Branch layer depth validation off-by-one in shekyl-tx-builder. The rule c1 + c2 == depth was corrected to c1 + c2 + 1 == depth (layer 0 is the leaf hash and has no branch entry). The previous rule incorrectly rejected valid witnesses at depth=1 and accepted structurally wrong branch counts at all other depths. Discovered by the FFI signing round-trip test introduced in this release. Verifier side verified: uses proof-structure-implicit depth enforcement (no explicit c1/c2 check needed). Additionally, validation now enforces the spec-correct C1/C2 alternation split (c1 == c2 or c1 == c2 + 1), the error.rs doc was corrected (previously stated the relationship backwards), and MAX_TREE_DEPTH=24 was added as a named constant in shekyl-fcmp with enforcement in both prover and verifier. See FOLLOWUPS.md for the full audit trail.

✅ Testing

• FFI signing round-trip test rewritten to use shekyl_sign_fcmp_transaction. rust/shekyl-ffi/tests/signing_round_trip.rs now exercises the full C-ABI FFI boundary: KEM keypair generation, output construction, output scanning, curve tree leaf/root computation, JSON serialization of FcmpSignInput + OutputInfo, signing via shekyl_sign_fcmp_transaction, and verification via shekyl_fcmp_verify. Runs 10 iterations with different random seeds. Previously called proof::prove directly, bypassing FFI JSON parsing, key derivation, and buffer management.

📚 Documentation

• FFI header upgraded to /// doc comments (Phase 6 completion). Converted all // function and struct documentation comments in src/shekyl/shekyl_ffi.h to /// Doxygen-style. Covers all ~70 FFI exports: output construction/scanning, key image computation, FCMP++ prove/verify, wallet proofs, cache encryption, KEM operations, Bech32m encoding, curve tree hashing, seed derivation, and daemon RPC. Rewrote the SHEKYL_PROVE_WITNESS_HEADER_BYTES comment from DEPRECATED/TODO language to document its role as test infrastructure for genRctFcmpPlusPlus in core_tests.

🔄 Changed

• simplewallet marked deprecated. Added a yellow deprecation banner to simplewallet.cpp startup: "shekyl-wallet-cli is deprecated and will be removed. Use shekyl-cli instead." No new features will be added; the binary will be deleted once shekyl-cli reaches parity.

• Axum RPC binds to standard port. When --no-rust-rpc is not set, the Axum daemon RPC server now binds to the standard RPC port (11029/12029/13029) and the epee HTTP listener is skipped. Falls back to epee on Axum startup failure. Previously Axum bound to epee_port + 10000.

• Production eprintln! removed from Rust FFI. Replaced 6 eprintln! calls in shekyl-ffi/src/lib.rs error handlers with silent error suppression (the C++ caller checks the bool return). Converted 1 eprintln! in shekyl-daemon-rpc/src/ffi_exports.rs to tracing::error!.

• Test code migrated to remove all calls to deleted crypto/device functions. Updated 14 test files across tests/crypto/, tests/unit_tests/, tests/core_tests/, tests/performance_tests/, tests/trezor/, and tests/benchmark.cpp to remove references to derive_public_key, derive_secret_key, derivation_to_scalar, derive_subaddress_public_key, derive_view_tag, is_out_to_acc, lookup_acc_outs, ecdhDecode, ecdhHash, genCommitmentMask, generate_key_image_helper, and generate_output_ephemeral_keys. Where inline key derivation was needed (block/miner-tx construction tests), local helpers using Ed25519 primitives (hash_to_scalar, ge_scalarmult_base, sc_add) replace the deleted functions. Legacy output scanning in chaingen.cpp and chain_switch_1.cpp falls through to the v3 scan path. All additional_tx_keys parameters removed from construct_tx_and_get_tx_key call sites. Benchmark harnesses for derive_subaddress_public_key and per-tx scanning removed.

🗑️ Removed

• Complete ZMQ removal. Deleted the entire ZeroMQ subsystem: ZMQ pub/sub (zmq_pub.cpp), ZMQ RPC server (zmq_server.cpp, daemon_handler.cpp, daemon_messages.cpp), low-level ZMQ helpers (net/zmq.cpp), message schema (message.cpp, daemon_rpc_version.h, rpc/fwd.h), and the rpc_pub, daemon_rpc_server, daemon_messages CMake targets. Removed libzmq build dependency from root CMakeLists, contrib/depends, and all link targets. Deleted 3 test files (zmq_rpc.cpp, txpool.py, python-rpc/framework/zmq.py) and the zeromq.mk depends recipe with its patches. Removed --zmq-rpc-bind-ip, --zmq-rpc-bind-port, --zmq-pub, --no-zmq CLI arguments. ZMQ was a duplicate, unauthenticated RPC surface inherited from an abandoned Monero "migrate RPC to ZMQ" effort. It had zero first-party consumers, leaked do_not_relay transactions, and its tests had been broken for 82+ consecutive CI runs, polluting the test signal during the FCMP++ migration. Ports 11025/12025/13025 are now reserved. Re-audit follow-up: removed stale #include "rpc/daemon_messages.h" and two ZMQ-schema-dependent tests (DaemonInfo, HandlerFromJson) from json_serialization.cpp, and fixed daemon link order (rpc after ${SHEKYL_DAEMON_RPC_LINK_LIBS}) to resolve circular FFI back-references previously satisfied transitively through daemon_rpc_server.

• wallet/api/ C++ wrapper layer deleted (~3,900 lines). The src/wallet/api/ directory (22 files) wrapped wallet2 for GUI consumption. With the Tauri GUI using wallet2_ffi via Rust, no production consumer remained. Removed the directory, add_subdirectory(api) from wallet CMakeLists, wallet/api includes and sizeof reporters from object_sizes.cpp, broken includes in subaddress.cpp and trezor tests, wallet_api link target from trezor CMakeLists, and CI --target wallet_api build steps.

• libwallet_api_tests/ test suite deleted (~1,300 lines). Removed the tests/libwallet_api_tests/ directory and its CMake entry. Cleaned up the Makefile's libwallet_api_tests ctest exclusions (originally disabled for Issue #895, now fully removed). Also removed the wallet_api_tests class and implementation from trezor tests.

• load_deprecated_formats / is_deprecated dead code excised (Phase 6 completion). Removed the is_deprecated() method, is_old_file_format member, m_load_deprecated_formats member and its getter/setter from wallet2.h. Deleted the is_deprecated() definition, JSON save/load of load_deprecated_formats, the non-JSON wallet keys file fallback (now a hard error), and the boost portable_binary_iarchive version \003/\004 branches in parse_unsigned_tx_from_str and parse_tx_from_str from wallet2.cpp. Removed the set_load_deprecated_formats command, its CHECK_SIMPLE_VARIABLE entry, settings display line, and the is_deprecated() upgrade flow from simplewallet.cpp/.h. Shekyl is v3-from-genesis; there are no legacy non-JSON wallet files or boost-serialized transaction blobs to load.

• additional_tx_keys / additional_tx_pub_keys infrastructure fully removed. Deleted member variables, struct fields, serialization entries, and function parameters referencing additional transaction keys from wallet2.h, wallet2.cpp, cryptonote_tx_utils.h/.cpp, cryptonote_format_utils.h, device.hpp, device_default.hpp/.cpp, and device_ledger.hpp/.cpp. In wallet2.cpp, removed all additional_tx_pub_keys / additional_tx_keys local variables, derivation computation loops, m_additional_tx_keys map operations, etd.m_additional_tx_keys export/import paths, and updated function definitions (get_tx_key_cached, get_tx_key, set_tx_key, check_tx_key, get_tx_proof) to match the simplified header signatures. The conceal_derivation device method implementations were updated to match the simplified signatures (no additional keys/derivations parameters). The ABPkeys struct no longer carries additional_key. Cleaned up all remaining call sites across wallet2_ffi.cpp, wallet/api/wallet.cpp, simplewallet.cpp, wallet_rpc_server.cpp, and trezor/protocol.cpp — removing additional-key parsing loops, serialization, and pass-through parameters. get_additional_tx_pub_keys_from_extra is now an inline stub returning an empty vector. In V3, per-output KEM ciphertexts replace additional tx keys; there is only one tx pubkey per transaction.

• derive_public_key, derive_secret_key, and derivation_to_scalar removed from the device interface chain. Deleted the pure virtual declarations from device.hpp and all override implementations from device_default and device_ledger. Also deleted derive_public_key and derive_secret_key from crypto.cpp/crypto.h (kept derivation_to_scalar in crypto, still needed by derive_subaddress_public_key). Removed associated performance test files. These Keccak-based one-component key derivation helpers are superseded by the V3 HKDF two-component output key derivation in cryptonote_tx_utils.

• out_can_be_to_acc, is_out_to_acc_precomp, and derive_view_tag dead code removed. Deleted the Keccak-based out_can_be_to_acc and is_out_to_acc_precomp functions from cryptonote_format_utils, the derive_view_tag function from crypto, and the derive_view_tag virtual method from the device interface chain (device.hpp, device_default, device_ledger). Removed associated performance tests. These functions were superseded by the X25519/HKDF view-tag derivation path in the V3 transaction format.

• ecdhHash and genCommitmentMask dead code removed. Deleted the ecdhHash and genCommitmentMask function definitions from rctOps.cpp, their declarations from rctOps.h, the genCommitmentMask virtual method from the device interface chain (device.hpp, device_default, device_ledger), and the ecdhDecode unit test that depended on them. These Keccak-based helpers were superseded by HKDF-derived amount encryption in V3.

• Ring signature / decoy infrastructure removed from wallet2. Removed fake_outs_count parameters from create_transactions_2, create_transactions_all, create_transactions_single, and create_transactions_from. Removed transfer_selected_rct's fake_outputs_count and outs parameters. Deleted get_output_relatedness, outs_unique, m_print_ring_members, and m_rings bookkeeping. FCMP++ eliminates ring signatures, making decoy selection and output relatedness scoring dead code.

🔒 Security

• m_combined_shared_secret changed to scrubbed_arr<uint8_t, 64> (Phase 6, Gate 3). Replaced std::vector<uint8_t> with tools::scrubbed_arr<uint8_t, 64> in both transfer_details and exported_transfer_details. This ensures zero-on-drop semantics consistent with m_y and m_mask. A boolean m_combined_shared_secret_set flag replaces size-based emptiness checks. All serialization (epee and Boost) updated with safe vector round-trip conversion.

• WalletState invariant enforcement (Phase 6, Gate 5b). Added check_invariants() to WalletState verifying 8 structural properties (balance consistency, spendable/spent partition, key image correspondence, etc.). debug_assert! fires after every mutation in debug builds. Property test (Gate 5c) exercises random operation sequences against invariant checks.

✨ Added

• PQC output round-trip property tests (Phase 6, Gate 1). prop_round_trip.rs exercises construct_output → scan_output_recover → derive_proof_secrets → compute_key_image with random keys and amounts via proptest. Asserts determinism (same inputs → identical outputs) and non-zero secrets (ho, y, z, k_amount, key_image). Includes boundary cases for amount=0 and amount=u64::MAX. Runs with --release in CI.

• Wallet cache AEAD tests (Phase 6, Gate 2). cache_crypto.rs covers encrypt/decrypt round-trip, version mismatch detection (returns -1 before AEAD decryption attempt), wrong-key auth failure, empty ciphertext, and truncated ciphertext. Sub-case A2 proves version check ordering by corrupting ciphertext and asserting version mismatch fires first.

• 100-iteration signing round-trip stress test (Phase 6, Gate 4). test_gate4_signing_round_trip_100 in proof_round_trip.rs runs full outbound prove+verify cycle 100 times with unique randomness per iteration.

• unmark_spent unit tests (Phase 6, Gate 5a). Five tests covering: reversal to spendable pool, unknown key image noop, idempotent on already-unspent, partial set behavior, and invariant preservation after unmark.

• Random-sequence invariant property test (Phase 6, Gate 5c). proptest drives random sequences of AddOutputs, MarkSpent, UnmarkSpent, Freeze, Thaw, and Reorg operations, asserting check_invariants() after each step.

• Sync bookkeeping tests (Phase 6, Gate 7). Mock-block-driven tests for WalletState mutations: progress monotonicity, spend detection, reorg state restoration, empty block height advancement, and spend/unmark round-trip. Explicitly documented as bookkeeping-only (not integration against a real daemon).

• CI grep gates (Phase 6). Seven blocking grep gates in build.yml: shekyl_y absence, derivation_to_y_scalar absence, legacy RCT type absence, v1/v2 tx version branch absence, HASH_KEY_TXPROOF absence, combined_shared_secret confinement to wallet boundary, ecdhEncode/ecdhDecode confinement to Ledger gate. All run without continue-on-error.

• FFI header documentation (Phase 6). shekyl_ffi.h now has Doxygen-style file-level documentation covering the memory model, secret handling conventions, and error reporting contract.

🗑️ Removed

• derivation_to_y_scalar deleted (Phase 6). Removed the function body from crypto.cpp, declarations from crypto.h, and all call sites in derive_public_key and derive_subaddress_public_key. The "shekyl_y" salt no longer appears in the binary.

• Test stubs 9-10 deleted (Phase 6). Removed #[ignore] placeholder tests test_09_watch_only_outbound_proof_error and test_10_restored_wallet_outbound_proof_error from proof_round_trip.rs. Future implementations tracked in WALLET_STATE_MIGRATION.md.

• Dead v1/v2 transaction branches in consensus (Phase 5). check_tx_outputs now rejects tx.version < 3 instead of < 2. Removed redundant if (tx.version >= 2) zero-amount guard (now unconditional). Tightened coinbase version check from >= 2 to >= 3. Removed dead tx.version < 3 early return in check_commitment_mask_valid. Commitment mask checks are now unconditional (version is always >= 3).

• Dead legacy code excision (Phase 6 completion). Deleted decodeRctSimple and its overload from rctSigs.cpp/.h. Deleted tools::decodeRct wrapper and all callers in wallet2.cpp. Deleted generate_output_ephemeral_keys declaration from cryptonote_tx_utils.h. Deleted tx_proof.cpp unit test (referenced removed crypto::generate_tx_proof_v1). Deleted is_out_to_acc.h performance test and its registrations.

• generate_key_image_helper / generate_key_image_helper_precomp fully removed. Migrated remaining production callers in wallet2.cpp (export_key_images, two import_outputs overloads) to the v3 HKDF path via shekyl_derive_proof_secrets FFI. Replaced dead else branch in cryptonote_tx_utils.cpp::construct_tx_with_tx_key with a hard error. Replaced scan_output's generate_key_image_helper_precomp call with a v3-only assertion (function is dead for v3 scanning). Deleted both function definitions from cryptonote_format_utils.cpp/.h, the compute_key_image virtual method from device.hpp and its Trezor override in device_trezor.hpp/.cpp. Updated test callers in chaingen.cpp and tx_validation.cpp to use v3 sc_add(ho, b) derivation.

🔒 Security (Phase 5 Audit Notes)

• Consensus hardening: commitment mask validation verified (Phase 5). Audited check_commitment_mask_valid in blockchain.cpp: confirms rejection of identity commitment (mask=0, amount=0), generator-point commitment (mask=1, amount=0), and coinbase zeroCommit(amount) form (mask=1, any amount). Called unconditionally for both miner transactions and regular transactions.

• y=0 defense-in-depth verified (Phase 5). Confirmed construction-time assert!(y != [0u8; 32]) and assert!(ho != [0u8; 32]) in derive_output_secrets (Rust, release-mode assert). Both sender (construct_output) and receiver (scan_output_recover) hit the same assert. Documented in POST_QUANTUM_CRYPTOGRAPHY.md with full defense stack analysis.

✨ Added

• GUI wallet native-sign activation (Phase 4a). Added native-sign feature to the GUI wallet's shekyl-wallet-rpc dependency. The transfer path is now: C++ prepare → Rust sign → C++ finalize.

• Scanner keys FFI export (Phase 4b). Added wallet2_ffi_get_scanner_keys to the wallet2 FFI layer, returning all keys needed by the Rust scanner (spend/view secrets, X25519 SK, ML-KEM DK) as JSON. Added get_scanner_keys wrapper method to Wallet2.

• Hybrid PQC KEM scanner (Phase 3a). shekyl-scanner now scans blocks using the V3 two-component key derivation: X25519 + ML-KEM-768 hybrid KEM. The InternalScanner::scan_transaction pipeline parses TX_EXTRA_TAG_PQC_KEM_CIPHERTEXT (0x06), applies X25519 view-tag pre-filtering (~99.6% rejection), and calls scan_output_recover for full KEM decapsulation, HKDF secret derivation, amount decryption, and B' recovery. Key images are computed natively in Rust via hash_to_point + compute_output_key_image. Legacy ECDH scan path removed.

• RecoveredWalletOutput struct. New scan result type carrying all KEM-derived secrets (ho, y, z, k_amount, combined_shared_secret), the computed key_image, and decrypted amount alongside the base WalletOutput. Implements ZeroizeOnDrop — secrets are wiped when the struct leaves scope.

• TransferDetails PQC fields and eligible_height. Extended with ho, y, z, k_amount, combined_shared_secret (all Zeroizing) and eligible_height: u64 (block_height + SPENDABLE_AGE). Outputs below eligible_height are immature (no curve-tree path) and cannot be spent. is_spendable() enforces this gate.

• WalletState KEM-aware processing. process_scanned_outputs now populates all PQC fields from RecoveredWalletOutput, sets key images at scan time, and performs duplicate output key detection (burning bug). spendable_outputs filters on eligible_height.

• unmark_spent for rollback. WalletState::unmark_spent reverses spent marks on outputs whose signing round succeeded but whose finalize step failed (daemon rejection, relay timeout). Prevents phantom-spent balance loss.

• Background sync loop (Phase 3b). shekyl-scanner::sync::run_sync_loop polls the daemon RPC for new blocks, feeds them through the hybrid KEM scanner, detects spent outputs via key-image matching against block inputs, and emits SyncProgress events after each block. Cancellation-safe via tokio_util::CancellationToken. Configurable flush interval: every 100 blocks on desktop, every block on mobile (OS can kill without warning).

• BalanceSummary uses eligible_height. Timelock categorization now reads td.eligible_height directly instead of recomputing from block_height + DEFAULT_LOCK_WINDOW.

• ViewPair extended with KEM keys. Added x25519_sk and ml_kem_dk fields to ViewPair for hybrid KEM decapsulation. The scanner requires both the X25519 secret and ML-KEM decapsulation key.

🐛 Fixed

• Stale fake_outs_count arguments in wallet transaction creation. Removed vestigial 0 (decoy count) from 9 call sites across wallet2_ffi.cpp, wallet_rpc_server.cpp, and wallet/api/wallet.cpp that no longer match create_transactions_2, create_transactions_all, and create_transactions_single signatures after ring removal.

• Test compilation: wallet_tools.cpp and transactions_flow_test.cpp. Replaced removed td.is_rct() calls with true (all Shekyl outputs are RCT), changed tools::wallet2::get_outs_entry to the local typedef from chaingen.h, and removed stale mix_in_factor argument in the functional test.

• PQC doc label error. Fixed incorrect HKDF label reference in POST_QUANTUM_CRYPTOGRAPHY.md: the output-key check uses ho with label shekyl-output-x, not shekyl-pqc-output (which is the ML-DSA seed label).

• Test compilation: json_serialization.cpp aggregate init. Replaced brace-enclosed initializer list for tx_source_entry with explicit member assignment. The struct is no longer an aggregate (user-declared destructor for ho wiping) and the old initializer also referenced a removed real_out_additional_tx_keys field.

• Multi-output scan bug. Removed erroneous break in InternalScanner::scan_transaction that exited the output iteration loop after finding the first matching output. Transactions with multiple wallet outputs (e.g., payment + change) now detect all of them.

• Reorg handling in handle_reorg. Rewrote WalletState::handle_reorg to use (height, hash) pairs instead of treating height as a direct vector index. Correctly handles non-genesis-aligned and sparse sync histories. synced_height is now derived from the last remaining block entry.

• Reorg detection in sync loop. run_sync_loop now compares each incoming block's header.previous hash against the wallet's stored hash for the prior height. On mismatch, walks backwards to find the fork point and calls handle_reorg before resuming.

• Block fetch retry with backoff. Per-block get_scannable_block_by_number calls now retry up to 5 times with exponential backoff (500ms initial, capped at 30s) instead of immediately aborting the sync loop on transient failures.

• Secure memory wiping. TransferDetails now implements both Zeroize (covering all fields including key, commitment, and fcmp_precomputed_path) and Drop (calls zeroize() on drop). WalletState implements Drop to wipe all transfers, key images, pub keys, and block hashes. Removed unsafe #[derive(Clone, Debug)] from TransferDetails; Debug is now manual and redacts secret fields.

• Misleading payment ID comment. Corrected comment in scan.rs that incorrectly described ECDH-based XOR decryption for payment IDs; V3 transactions do not use encrypted payment IDs.

• Always-true pattern in sync loop. Removed if let Some(tx_hashes) = Some(&scannable.block.transactions) which was a no-op guard. Block transactions are now iterated directly.

🔄 Changed

• EncryptedAmount wire format fix. The Rust EncryptedAmount struct (in shekyl-oxide::fcmp) now correctly includes both amount: [u8; 8] and amount_tag: u8, matching the C++ 9-byte wire format. Previously only the 8-byte amount was read, causing silent data misalignment.

• Scanner::new signature. Now requires the wallet's spend_secret (Zeroizing<[u8; 32]>) for native key image computation at scan time. Both Scanner::new and GuaranteedScanner::new updated.

• Deterministic KEM encapsulation from tx_key_secret. construct_output now derives X25519 ephemeral keys and ML-KEM ciphertexts deterministically via HKDF-SHA-512 (derive_kem_seed), eliminating the need to cache per-output shared secrets. The sender can re-derive combined_ss at proof time from tx_key_secret and public data.

• Proof pipeline helpers in shekyl-crypto-pq. Seven new functions: rederive_combined_ss, derive_proof_secrets, derive_output_key, recover_recipient_spend_pubkey, decrypt_amount, compute_output_key_image, and compute_output_key_image_from_ho. These support the V3 tx_proof / reserve_proof / key-image protocols. The narrow ProofSecrets(ho, y, z, k_amount) projection ensures combined_ss never crosses the FFI boundary.

• ProofSecrets widened to include z. The Pedersen commitment mask is now part of the proof secrets projection, enabling direct C = z*G + amount*H verification in TX proofs. derive_proof_secrets passes z through instead of discarding it.

• shekyl-proofs crate: full Phase 1a implementation. Three modules:

  • dleq.rs: Two-base Schnorr DLEQ proof with domain separator shekyl-reserve-proof-dleq-v1 and full base binding in the challenge hash (G, Hp(O), R1, R2, P, I, msg). 6 unit tests.
  • tx_proof.rs: Outbound (101+128N bytes) and inbound (69+128N bytes) proof generation and verification. Domain-separated Schnorr signatures (shekyl-outbound-tx-proof-v1, shekyl-inbound-tx-proof-v1). Per-output ho, y, z, k_amount with algebraic output key and commitment checks.
  • reserve_proof.rs: Reserve proof (69+192N bytes) with per-output DLEQ key image binding. enc_amount sourced from blockchain, not from proof.
  • Version assertion (v1) before any cryptographic work. 4-byte output_count (u32 LE) supporting up to 2³²−1 outputs per proof.
  • 10-point round-trip test skeleton (exit criterion for Phase 5, #[ignore]).

• FCMP_PLUS_PLUS.md section 21: Wallet Proof Structure. Genesis-native proof design rationale. Documents the Schnorr/KEM decomposition, reserve proof DLEQ requirement, HKDF binding argument for z-omission in reserve proofs, and the enc_amount-from-chain invariant.

• Phase 1b FFI exports (PR-wallet). New exports in shekyl_ffi.h:

  • shekyl_scan_and_recover: Merged scan + key image in one call. All secret outputs write directly into transfer_details fields (no intermediate scratch buffers). persist_combined_ss flag controls whether combined_ss is returned or wiped internally (hot vs cold).
  • shekyl_compute_output_key_image / _from_ho: Key image computation for the 2 remaining sites (stake claim, tx_source_entry).
  • shekyl_sign_fcmp_transaction: Collapsed signing. C++ passes wallet master spend key b + per-input {combined_ss, output_index, ...}. Rust derives x = ho + b and y internally via HKDF. C++ never touches x.
  • shekyl_derive_proof_secrets: Helper writing ho, y, z, k_amount directly to caller-provided destination addresses.
  • shekyl_encrypt_wallet_cache / shekyl_decrypt_wallet_cache: AEAD encryption with AAD binding on cache_format_version. Distinct error codes for version mismatch (-1), auth failure (-2), and format error (-3).
  • 6 proof FFI exports: shekyl_generate_tx_proof_outbound, shekyl_verify_tx_proof_outbound, shekyl_generate_tx_proof_inbound, shekyl_verify_tx_proof_inbound, shekyl_generate_reserve_proof, shekyl_verify_reserve_proof. Signatures stabilized; wiring to shekyl-proofs internals deferred to Phase 2e.

• shekyl-chacha AEAD extension. Added chacha20poly1305 (v0.10) support: encrypt_with_aad and decrypt_with_aad wrapping XChaCha20-Poly1305. No hand-rolled AEAD — nonce handling, constant-time tag comparison, and AD framing delegated to audited crate. 6 new tests.

• RecoveredOutput now includes combined_ss. The scan result carries the 64-byte combined shared secret so the merged scan FFI can optionally persist it without re-doing KEM decapsulation. Wiped by ZeroizeOnDrop.

• ML-KEM shared secret Zeroizing wrap (W5 fix). All 4 production sites where ml_ss.into_bytes() produces a bare stack-local now wrap the result in Zeroizing<[u8; 32]>, ensuring the ML-KEM shared secret bytes are zeroed on scope exit. Closes the W5 correlation leak.

• Fixed stale shekyl_construct_output C header. Added missing tx_key_secret parameter to match the Rust implementation.

• KEM derivation KAT vectors. docs/test_vectors/KEM_DERIVE_V1_KAT.json with 8 pinned vectors for derive_kem_seed. Serves as tripwire against silent behavior changes from fips203 or curve25519-dalek upgrades.

• fips203 exact version pin. Pinned to =0.4.3 with audit comment explaining the DummyRng::fill_bytes = unimplemented!() risk.

• Fuzz target for derive_output_key. Exercises derive_output_key and recover_recipient_spend_pubkey round-trip with fuzzer-supplied inputs.

• Ledger V3 hard gate. device_ledger.cpp now has a #error that fires when WITH_DEVICE_LEDGER is defined, preventing silently broken builds. The Ledger APDU protocol has not been updated for V3 two-component keys.

• Fuzz target for malformed KEM ciphertexts on scan. New fuzz_scan_malformed_ct exercises corrupted, truncated, and random ML-KEM ciphertexts through scan_output_recover with a valid wallet KEM secret. Validates ML-KEM implicit rejection + downstream algebraic checks fail closed without panics or timing leaks.

📚 Documentation

• Security properties of the derivation section in docs/POST_QUANTUM_CRYPTOGRAPHY.md. Documents the y==0 defense-in-depth stack (construction assert + probabilistic impossibility + fuzz coverage), explains why a wire-level y==0 check is impossible, documents malformed KEM ciphertext handling through ML-KEM implicit rejection, view-tag pre-filter behavior on adversarial match grinding, and the wallet cache version gate requirement for PR-wallet.

• Tightened malformed KEM ciphertext framing. Reframed amount_tag as a ~99.6% cheap pre-filter (performance optimization), not a security gate. Commitment algebraic check C == z*G + amount*H is the soundness barrier. Documented structural independence of the two algebraic checks (different HKDF labels, different scalar families).

• Wallet cache version gate hardened. Added mandatory AAD binding (include cache_format_version in XChaCha20-Poly1305 AAD to prevent version-confusion attacks) and hard no-migration policy (delete and resync from seed, never in-place migration).

🗑️ Removed

• ecdhTuple / ecdhEncode / ecdhDecode removal. Deleted the Monero-era ECDH amount-masking struct and encode/decode functions from rctTypes.h, rctOps.h/.cpp, device.hpp, device_default.hpp/.cpp, device_ledger.hpp/.cpp, and the Trezor protocol files. The enc_amount_to_ecdh_compat shim is deleted.

• check_tx_key_helper / is_out_to_acc deletion. Both overloads of wallet2::check_tx_key_helper and wallet2::is_out_to_acc removed. These used derive_public_key (Keccak Category 1) and the old ecdhDecode path. Replaced by KEM-based proof FFI round-trip in check_tx_key.

• crypto::generate_tx_proof / generate_tx_proof_v1 / check_tx_proof deletion. Monero-era DH-based Schnorr proof functions removed from crypto.cpp, crypto.h, device_default.cpp, device_ledger.cpp, device.hpp, and derived device headers. HASH_KEY_TXPROOF_V2 removed from cryptonote_config.h.

• ecdh.rs module stub cleanup. Removed orphaned mod ecdh declaration and associated test functions from shekyl-tx-builder (module file was previously deleted, declaration left behind).

• V3-from-genesis Boost serialization purge (wallet2.h). Deleted all if (ver < N) migration branches from Boost serialize functions for transfer_details, unconfirmed_transfer_details, confirmed_transfer_details, payment_details, address_book_row, unsigned_tx_set, signed_tx_set, tx_construction_data, and pending_tx. Deleted the initialize_transfer_details helper (both saving and loading overloads). Reset all BOOST_CLASS_VERSION macros to 1 (genesis version). Added assert(ver == 1) guards. Epee cache envelope if (version < N) branches also removed, replaced with assert(version == 2). Staking fields (m_staked, m_stake_tier, m_stake_lock_until, m_last_claimed_height) and new Phase 2b field (m_k_amount) added to the transfer_details Boost serializer. Legacy m_rct field no longer serialized (previously removed from struct).

🔄 Changed

• Phase 2e: Proof functions collapsed to Rust FFI (PR-wallet). All six wallet proof functions (get_tx_proof, check_tx_proof, get_reserve_proof, check_reserve_proof) now delegate to the shekyl-proofs Rust crate via the FFI bridge. check_tx_key also uses the FFI round-trip (generate outbound proof + verify with on-chain data). The intermediate C++ helpers check_tx_key_helper (both overloads) and is_out_to_acc have been deleted. New gather_on_chain_proof_data helper extracts output keys, commitments, encrypted amounts, and KEM ciphertexts from transactions for proof verification. Reserve proof wire format now includes output locators (txid + index_in_tx) as a header so the verifier can independently fetch on-chain data from the daemon.

• Phase 2f: Category 1 Keccak deletions (PR-wallet). Deleted Monero-era DH-based proof functions from the crypto layer: crypto::generate_tx_proof, crypto::generate_tx_proof_v1, crypto::check_tx_proof, along with their device implementations (device_default, device_ledger) and virtual interface declarations. Removed HASH_KEY_TXPROOF_V2 from cryptonote_config.h. Removed orphaned ecdh.rs module declaration and tests from shekyl-tx-builder. Remaining Category 1 functions (derive_public_key, derivation_to_scalar, derive_subaddress_public_key, decodeRctSimple) still have live callers in scan/sign paths and are deferred to Phase 3 migration. ecdhHash and genCommitmentMask have been removed.

• Phase 2d: Collapsed signing via shekyl_sign_fcmp_transaction (PR-wallet). The CLI wallet's transfer_selected_rct now calls the Rust collapsed signing FFI instead of C++ genRctFcmpPlusPlus. C++ builds JSON arrays of FcmpSignInput (per-input combined_ss, output_index, tree layers) and OutputInfo (per-output commitment_mask, enc_amount), then unpacks the returned SignedProofs (BP+ blob, FCMP++ proof, pseudo-outs, commitments, enc_amounts) into tx.rct_signatures. Rust owns all witness assembly — C++ never touches the ephemeral spend secret x. genRctFcmpPlusPlus is deprecated (retained only for chaingen.cpp test infrastructure).

• Rust sign_transaction updated for v3 HKDF semantics (PR-wallet). OutputInfo now carries commitment_mask: [u8; 32] and enc_amount: [u8; 9] (pre-derived by construct_output), replacing the old amount_key field. SignedProofs.enc_amounts widened from 8 to 9 bytes. The signing pipeline uses pre-derived HKDF masks for BP+ instead of generating random ones, and uses pre-encrypted amounts instead of Keccak-based ECDH encoding.

• wallet2_ffi.cpp enc_amounts field name fix. The native-sign finalize path now reads enc_amounts from Rust SignedProofs JSON (was incorrectly reading ecdh_amounts).

• enc_amounts field comment updated in rctTypes.h. Clarifies that byte [8] is the HKDF-derived amount_tag AAD, documents the Rust scanner validation behavior (reject on mismatch), and removes the stale RESERVED_AMOUNT_TAG_PLACEHOLDER reference.

• Comprehensive CLI User Guide (docs/USER_GUIDE.md). Covers all shipped executables, daemon operation (flags, config file, console commands), wallet CLI (create, restore, send, receive, proofs), staking (tiers, unstake, claim, accrual rules), mining, PQC multisig (file-based workflow, size table), anonymity networks (Tor/I2P), wallet RPC, blockchain utilities, security/backup, and troubleshooting. Mirrors the GUI wallet guide structure for easy cross-referencing.

• C++/Rust cross-validation test for total_weighted_stake. New test in staking.cpp constructs the same staker set via both the C++ 128-bit cache accumulation and the Rust FFI, then asserts byte-equality of the results. Prevents spec/impl drift regression.

• u128 saturation test. Demonstrates that the u128 weighted stake does NOT saturate where u64 would (100M stakers at 100 SKL, tier 2), and verifies reward computation remains correct with the large denominator.

• LMDB write atomicity audit. Comprehensive audit of all BlockchainLMDB write paths (block connect, block pop, txpool, alt blocks, staking, FCMP++ curve tree). Documented in docs/LMDB_WRITE_ATOMICITY_AUDIT.md. Found and fixed a missing lock.commit() in get_relayable_transactions (Dandelion++ timestamp rollback bug) and added a defensive db_wtxn_guard around the staker accrual reversal in pop_block_from_blockchain.

• LMDB schema reference (docs/LMDB_SCHEMA.md). Complete documentation of all 28 sub-databases: LMDB names, open flags, custom comparators, key/value byte layouts with struct field offsets, read/write access patterns, and hard fork version introduction. Standalone audit value and prerequisite for the eventual heed migration.

• Vendored dependency tracking (docs/VENDORED_DEPENDENCIES.md). Documents the vendored LMDB version (0.9.70, based on OpenLDAP mdb.master branch), applied upstream patches (ITS#9385, ITS#9496, ITS#9500, etc.), CVE review (CVE-2026-22185 does not affect us), and the mdb.master vs mdb.master3 branch distinction relevant to future heed migration.

• V4 design notes (docs/V4_DESIGN_NOTES.md). Records the heed LMDB migration deferral with detailed reasoning (shared-write risk, schema drift, map resize race conditions) and the recommended approach for V4 (single Rust-owned Env, no split write ownership, full BlockchainLMDB unit cutover).

• Additional C++ conservation-invariant tests. Six new tests in tests/unit_tests/staking.cpp: weighted denominator >= raw sum invariant, tier-0 weight equality, higher-tier strict inequality, zero-staker burn path, single-staker full capture, dust staker conservation, multi-block claim range conservation, and MAX_CLAIM_RANGE boundary validation.

• shekyl-wallet-core crate. New Rust crate providing transaction builder plans for stake, unstake, and claim operations. Includes ClaimTxBuilder for constructing claim transaction plans with automatic MAX_CLAIM_RANGE splitting, and ClaimAndUnstakePlan for the two-step drain-then-unstake workflow.

• Coin selection module (shekyl-scanner/coin_select.rs). Min-relatedness output selection algorithm that prefers combining outputs with fewer shared metadata fingerprints (tx hash, block height, subaddress, tier) for improved on-chain privacy. Supports dust separation and configurable selection criteria.

• Output freezing and coin control. WalletState now supports freeze/thaw of individual outputs by index or key image, with frozen outputs excluded from spendable candidate lists. New spendable_outputs() method with optional account, subaddress, and minimum amount filters.

• Staker pool tracking in Rust (shekyl-scanner/staker_pool.rs). Wallet-side StakerPoolState mirrors per-block accrual records from the daemon, enabling local reward estimation without RPC round-trips. Supports reorg handling and conservation invariant checking.

• Claim watermark tracking. TransferDetails now carries last_claimed_height for monotonic claim watermark management. WalletState exposes update_claim_watermark(), claimable_outputs(), and claimable_rewards_summary() methods. New ClaimableInfo struct provides per-output claim state including accrual frozen status.

• New RPC methods. get_claimable_stakes, get_unstakeable_outputs, freeze, and thaw added to the Rust scanner-backed RPC handler. All four are routed through the Rust scanner when rust-scanner feature is active.

• GUI wallet staking bridge. wallet_bridge.rs extended with get_scanner_claimable_stakes, get_scanner_unstakeable_outputs, scanner_freeze, and scanner_thaw for Tauri frontend integration.

• Staking transaction types in shekyl-oxide. Input::StakeClaim variant (binary tag 0x03) and Output::staking: Option<StakingMeta> (binary tag 0x04) added with full binary serialization/deserialization. StakingMeta carries the lock_tier field (lock_until is computed dynamically).

• Property-based staking tests. 11 new property tests in shekyl-staking: conservation across uniform/mixed/stress scenarios, proportionality, floor division safety, weight function validation, multi-block accumulation bounds, and adversarial edge cases.

• shekyl-chacha crate. New Rust crate providing XChaCha20 (192-bit nonce) stream cipher for wallet and cache file encryption. Wraps the NCC-audited RustCrypto chacha20 crate. Exported via FFI as xchacha20(), replacing the C implementation in chacha.c.

• KEM-derived output secrets (OutputSecrets). New Rust infrastructure in shekyl-crypto-pq/src/derivation.rs derives per-output secrets (ho, y, z, k_amount, view_tag_combined, amount_tag, ml_dsa_seed) from the combined X25519 + ML-KEM shared secret via HKDF-SHA-512 with distinct info labels. Includes derive_view_tag_x25519 for fast wallet scan pre-filtering without ML-KEM decapsulation. FFI exports: shekyl_derive_output_secrets, shekyl_derive_view_tag_x25519.

• Cross-language HKDF test vectors. Python reference implementation (tools/reference/derive_output_secrets.py) generates locked JSON test vectors (docs/test_vectors/PQC_OUTPUT_SECRETS.json). Rust unit tests validate byte-for-byte against these vectors.

• Witness header constant. SHEKYL_PROVE_WITNESS_HEADER_BYTES = 256 defined in both shekyl_ffi.h and shekyl-ffi/src/lib.rs, replacing all magic literal 256 values.

• Consensus mask=1 placeholder. check_commitment_mask_valid() wired into check_tx_outputs for all v3 transactions. Returns accept-all now; PR-construct will flip to reject zeroCommit form for non-coinbase.

• HKDF label registry. docs/POST_QUANTUM_CRYPTOGRAPHY.md now documents all HKDF salt/info pairs for the per-output derivation stream and the separate X25519-only view tag derivation.

• Unified Rust output construction (construct_output). New shekyl-crypto-pq/src/output.rs implements construct_output (KEM encapsulation + HKDF → two-component key O = ho*G + B + y*T, Pedersen commitment C = z*G + amount*H, encrypted amount, view tag, PQC leaf hash) and scan_output_recover (KEM decapsulation + HKDF → recovered spend key B' = O - ho*G - y*T for subaddress lookup, plus all per-output secrets). FFI exports: shekyl_construct_output, shekyl_scan_output_recover.

• PQC signing in Rust (sign_pqc_auth). ML-DSA-65 keypair is derived, used, and wiped entirely within Rust. The secret key never crosses the FFI boundary. FFI export: shekyl_sign_pqc_auth.

• FCMP++ witness header assembly in Rust. The 256-byte witness header ([O:32][I:32][C:32][h_pqc:32][x:32][y:32][z:32][a:32]) is now assembled via shekyl_fcmp_build_witness_header with a typed ProveInputFields struct, replacing 8 raw memcpy calls in C++.

• construct_miner_tx and construct_tx_with_tx_key rewired to Rust. Both v3 output construction paths now call shekyl_construct_output per output in a unified loop. KEM ciphertexts and PQC leaf hashes are written to tx_extra. The legacy derivation_to_y_scalar path is retired on all construction paths.

• Wallet scanner uses scan_output_recover. wallet2::process_new_transaction has a v3-specific scanning path that calls shekyl_scan_output_recover for KEM decapsulation, HKDF derivation, amount recovery, and subaddress lookup. Key images are computed as (ho + b_spend) * Hp(O).

• X25519-derived view tag. Per-output view tags are now derived from the X25519 shared secret only (no ML-KEM needed), enabling fast wallet scan pre-filtering. Written during construction, checked first during scanning.

• additional_tx_keys removed for v3. need_additional_txkeys is false for tx.version >= 3. The additional_tx_public_keys field is no longer populated or consumed in v3 construction or scanning.

• Real Pedersen commitments for coinbase (RCTTypeNull). outPk and enc_amounts are now serialized for RCTTypeNull transactions. blockchain_db.cpp uses the on-chain outPk[i].mask for v3+ coinbase instead of computing zeroCommit(amount).

• check_commitment_mask_valid enforced. Rejects trivial commitment masks (z = 0 or z = 1) for all non-coinbase v3 outputs. Called from both check_tx_outputs and prevalidate_miner_transaction.

• PQC salt consolidation. All per-output PQC key derivation now uses the unified OutputSecrets.ml_dsa_seed from salt B (shekyl-output-derive-v1). The legacy HKDF_SALT_PQC_DERIVE salt A is deleted. Testnet reset required — invalidates all existing h_pqc.

• Chaingen test infrastructure updated for v3. init_output_indices, fill_tx_sources, init_spent_output_indices, and construct_fcmp_tx now use shekyl_scan_output_recover for HKDF-based output ownership detection, mask recovery, and key image computation.

• genRctFcmpPlusPlus uses HKDF commitment masks. The function now accepts pre-computed HKDF z scalars (commitment_masks) and pre-computed encrypted amounts (enc_amounts_precomputed) instead of re-deriving them internally via Keccak. This fixes a critical mismatch where BP+ proofs used Keccak-derived masks while scan_output expected HKDF-derived values. The old amount_keys parameter is removed. Testnet reset required — on-chain commitments and encrypted amounts are now HKDF-derived, incompatible with prior Keccak format.

• Stake claim outputs use shekyl_construct_output. The wallet's create_stake_claim_tx now constructs outputs via the unified Rust HKDF path, producing correct output keys, view tags, KEM ciphertexts, leaf hashes, and enc_amounts with amount_tag. BP+ blinding factors remain constrained by the zeroCommit pseudo-out balance equation (sum to N).

• Chaingen PQC signing via shekyl_sign_pqc_auth. Core test construct_fcmp_tx now uses the high-level FFI that derives, signs, and wipes the ML-DSA secret key entirely inside Rust. The raw shekyl_pqc_sign call (which accepted the secret key as a C++ byte pointer) is replaced.

• zeroCommit dead code removed from DB layer. blockchain_db.cpp and db_lmdb.cpp no longer fall back to zeroCommit(amount) for output commitments. All outputs (including coinbase) use on-chain outPk[i].mask. The pre_rct_outkey branch in LMDB now throws for amount != 0 (Shekyl has no pre-RCT outputs).

• RCTTypeNull round-trip serialization test. New test in tests/unit_tests/serialization.cpp verifies that RCTTypeNull transactions with populated outPk and enc_amounts (8-byte amount + 1-byte amount_tag) survive binary serialize/deserialize round-trip.

• libFuzzer harness for construct_output. New fuzz target fuzz_construct_output in rust/shekyl-crypto-pq/fuzz/ exercises construct_output + scan_output round-trip with arbitrary spend keys, amounts, corrupted enc_amount, and wrong amount_tag.

• libFuzzer harness for malformed KEM keys. New fuzz target fuzz_construct_output_malformed_kem feeds arbitrary bytes as X25519 and ML-KEM-768 encapsulation keys to construct_output. Exercises wrong-length, oversized, and garbage KEM public key inputs to ensure the function returns Err, never panics.

• PQC leaf hash known-answer test. New JSON fixture docs/test_vectors/PQC_LEAF_HASH_KAT.json (8 vectors) pins the output of derive_pqc_leaf_hash(combined_ss, output_index). Rust KAT test validates byte-for-byte against the fixture.

• Coinbase check_commitment_mask_valid hardened. For RCTTypeNull (coinbase) outputs, the consensus check now rejects commitments that equal zeroCommit(public_amount) (i.e. C = G + amount*H), preventing miners from constructing trivial-mask coinbases that leak amount to observers. Non-coinbase defense-in-depth checks (identity and G) are retained.

• Dead Keccak y-scalar fallback removed from wallet scanner. The else if (tx.vout[o].amount == 0) and else if (miner_tx) branches that fell back to derivation_to_y_scalar are removed. Shekyl is v3 from genesis; all matched outputs must succeed the HKDF scan path. A hard wallet_internal_error is thrown if v3_hkdf_scanned is false, preventing silent domain fallback that would produce unspendable outputs.

• Legacy coinbase construction path removed. construct_miner_tx now asserts PQC key presence with a clear error message (CHECK_AND_ASSERT_MES) before entering the output construction loop, instead of falling back to legacy Keccak derive_public_key / derive_view_tag which would produce an invalid (unscannable, missing outPk/enc_amounts) coinbase. All Shekyl addresses carry PQC keys from genesis.

• Genesis coinbase builder uses shekyl_construct_output. build_genesis_coinbase_from_destinations now constructs outputs via the Rust HKDF path, producing correct HKDF-derived output keys, view tags, commitments, encrypted amounts with amount_tag, KEM ciphertexts, and PQC leaf hashes. The legacy Keccak derivation path is removed.

• Legacy additional_tx_public_keys dead code removed. The need_additional_txkeys logic, additional_tx_public_keys vector, and pre-v3 output derivation loop in construct_tx_with_tx_key are deleted. V3 replaces per-output additional tx keys with KEM ciphertext (tag 0x06).

🔄 Changed

• transfer_details::m_mask type changed. rct::key → crypto::secret_key for automatic zeroization on drop. All RCT call sites use explicit rct::sk2rct() / rct::rct2sk() conversion. Binary-compatible (same 32-byte layout).

• ecdhInfo replaced by enc_amounts. The per-output encrypted amount format changes from ecdhTuple (64 bytes: 32 mask + 32 amount) to std::array<uint8_t, 9> (8 bytes XOR-encrypted amount + 1 byte amount tag). Affects rctSigBase, all serialization paths (binary, boost, JSON), and transaction construction (genRctFcmpPlusPlus, fill_construct_tx_rct_stub, wallet claim construction).

• ecdhEncode removed. The ECDH encoding function is deleted from rctOps, device.hpp, and device_default. Transaction construction now writes enc_amounts directly via Rust HKDF-based output construction. ecdhDecode is retained as a scanner shim until the wallet migrates to Rust scan_output. ecdhHash and genCommitmentMask have been fully removed from rctOps, the device interface chain, and tests.

• FROST SAL deferred to V4. Per-output HKDF-derived y is incompatible with DKG group-shared y. FROST SAL section in docs/PQC_MULTISIG.md marked as deferred with V4 resolution path (Carrot-style address scheme).

🐛 Fixed

• sc_check() signed left-shift undefined behavior. signum(...) << k on int64_t in crypto-ops.c is UB when the result is negative. Introduced signed_lshift() helper that uses multiplication on non-GCC compilers. Ported from monero@c5be4dd.

• wallet2::verify_password() logic inversion. Background wallet detection used HasParseError() && IsObject() instead of !HasParseError() && IsObject(), causing background wallets to fail password verification. Added the missing !. Ported from monero@b19cd82.

• HTTP digest auth missing client nonce (cnonce). The epee HTTP client sent an empty cnonce with qop=auth, weakening the digest exchange against replay attacks. Now generates a random 16-byte cnonce via RAND_bytes and includes it in the response hash and Authorization header. Ported from monero@3d6b9fb.

• Critical: SAL y / commitment mask z conflation in FCMP++ prover. wallet2.cpp passed td.m_mask (Pedersen commitment mask) as spend_key_y to the FCMP++ prover, but SAL requires y such that O = xG + yT. Since legacy outputs had y = 0 and z != 0, OpenedInputTuple::open always failed. Fixed by migrating to two-component output keys (O = xG + yT) where y = Hs_y(derivation || i), and passing z as a separate commitment_mask field. Affects every spend on the chain — this was the root cause of all FCMP++ proof generation failures.

• Coinbase commitment mask in test harness. fill_tx_sources in chaingen.cpp set ts.mask = rct::zero() for coinbase, but zeroCommit(amount) = G + amount*H has mask = scalar 1. Fixed to rct::identity().

• Critical: u64 saturation in total_weighted_stake (Bug 7). The in-memory cache and LMDB staker_accrual_record used uint64_t for the tier-weighted stake denominator. With 12-decimal atomic units and tier multipliers > 1.0, this saturates at ~18.4M SHEKYL of weighted stake — well below moderate adoption. Reward computation collapses to a meaningless ceiling once saturated. Fixed by widening to u128 end-to-end: in-memory cache uses lo/hi u64 pairs with proper carry arithmetic, LMDB record gains total_weighted_stake_hi field (32→40 bytes), FFI shekyl_calc_per_block_staker_reward accepts lo/hi parameters, and Rust AccrualRecord/StakeRegistry::total_weighted_stake() return u128.

• Critical: back-dating exploit on first claim (Bug 3). check_stake_claim_input only enforced from_height == watermark when watermark > 0. For the first claim (no watermark), from_height was unconstrained. An attacker could stake at block N, then submit a claim with from_height = 0, walking 10,000 historical blocks and collecting rewards against denominators that never included the attacker's output. Fixed by looking up the staked output's creation height and requiring from_height >= creation_height when no watermark exists.

• Critical: inter-tx pool sufficiency race within a block (Bug 4). The per-tx pool balance check in check_tx_inputs reads the pre-block pool balance, so five claim txs each claiming 1000 against a pool of 3000 all individually pass. The silent-skip path in add_transaction_data then lets over-claimed txs through without decrementing the pool. Fixed with two changes: a block-level aggregate pool check in handle_block_to_main_chain that sums all claim amounts across ALL txs and rejects the block if the total exceeds the pool, plus converting the silent-skip path in add_transaction_data to a hard throw (dead code if validation is correct, fatal if not).

• Reorg watermark restoration loses data (Bug 5). remove_transaction used from_height == 0 as the signal for "first claim, remove watermark." But from_height for a first claim is typically the creation height (non-zero). Fixed by looking up the staked output's creation height to distinguish first claims from subsequent claims.

• Reorg pool reversal direction wrong for no-staker blocks (Bug 6). pop_block_from_blockchain unconditionally subtracted accrued inflow from pool_balance, but for no-staker blocks the inflow was burned (not added to pool). Popping such a block caused a spurious pool underflow. Fixed by reading the accrual record's total_weighted_stake: if zero, subtract from total_burned instead of pool_balance.

• Empty-staker-set accrual audit trail. The actually_destroyed field in the persisted accrual record did not reflect the no-staker burn because the record was written before the burn decision. Fixed by moving add_staker_accrual to after the no-staker burn path, so the record captures the full actually_destroyed value.

• Dandelion++ relay timestamp rollback. get_relayable_transactions in tx_pool.cpp was missing lock.commit(), causing all stem/forward timestamp updates to be silently rolled back by the LockedTXN destructor. Transactions in Dandelion++ stem/forward states could be re-relayed with stale timing data, degrading transaction-origin privacy. Fixed by adding the missing commit.

• Staker accrual reversal without write transaction guard. The staker pool balance and burn total reversal in pop_block_from_blockchain relied on the caller's batch context for a write transaction but had no defensive guard. While all current production callers maintain a batch, a future caller without one would crash or produce undefined behavior. Fixed by wrapping the reversal block in db_wtxn_guard.

• Critical: weighted denominator bug in staker reward accrual. The per-block total_weighted_stake was computed from raw staked amounts instead of tier-weighted amounts, causing proportional over-distribution (up to +100% when all stakers use the Long tier). Fixed by introducing separate caches for raw and tier-weighted stake amounts in blockchain.h/blockchain.cpp.

• Claim timing: lock conflated with claimability. check_stake_claim_input incorrectly rejected claims when lock_until > current_height, making rewards unclaimable during the lock period. Fixed by removing the lock-based rejection and adding to_height <= min(current_height, lock_until) enforcement. Wallet filters updated to include both locked and matured-but-unspent outputs.

• Zero-staker blocks: unclaimed pool accumulation. When no stakers existed, staker emission and fee pool amounts accumulated in staker_pool_balance indefinitely. Fixed to burn these amounts when total_weighted_stake == 0.

• Staked outputs incorrectly spendable. is_spendable() allowed spending staked outputs after maturity. Fixed: staked outputs are never directly spendable -- they must go through the unstake path.

• Claim watermark not persisted. Added m_last_claimed_height to transfer_details (C++ wallet) and TransferDetails (Rust scanner) with serialization. FFI layer now calls stage_claim_watermarks() after broadcasting claim transactions.

• Critical: stake tx only mineable in exact creation block (Bug 13). handle_block_to_main_chain validated staked outputs with strict equality staked.lock_until == blockchain_height + lock_blocks. Since the wallet signed lock_until = current_height + lock_blocks, any mempool latency made every honest stake tx permanently unminable. Fixed by removing lock_until from the on-chain txout_to_staked_key struct entirely. The effective lock expiry is now computed dynamically as creation_height + tier_lock_blocks at every check site. Removes ~8 bytes per staked output and eliminates the signing-time/mining-time mismatch bug class.

• High: mempool admits unminable stake txs (Bug 12). Pool admission checked tier validity and non-zero lock_until but not the strict equality that block validation enforced. Honest and malicious stake txs passed admission but were rejected at block-add time, causing miners to waste work on blocks that would be rejected. Resolved by the Bug 13 fix: with no on-chain lock_until, the entire validation path is removed.

• Medium: off-by-one at upper lock boundary (Bug 11). The accrual scan excluded an output at block lock_until (<= eval_height), but claim validation accepted to_height <= lock_until. A staker could claim a one-block reward at lock_until against a denominator that didn't include their weight. Fixed by changing the accrual scan to effective_lock_until < eval_height (inclusive upper bound) and scheduling unlock subtraction at effective_lock_until + 1. lock_blocks = N now means exactly N blocks of accrual.

• Medium: unstake forfeits unclaimed rewards (Bug 8). create_unstake_transaction jumped straight to create_transactions_from without checking for unclaimed reward backlog. A user who staked for the long tier and never claimed would silently forfeit all accrued rewards. Fixed: the wallet now refuses to unstake if any target output has m_last_claimed_height < min(current_height, effective_lock_until) and instructs the user to claim first.

• Minor: local claim watermark advanced on broadcast, not confirmation. update_claim_watermarks (now stage_claim_watermarks) committed the watermark immediately after broadcast. If the tx was dropped or never confirmed, the local watermark diverged from consensus. Fixed with an in-flight tracking system: claims are staged in m_pending_claim_watermarks at broadcast, committed by confirm_claim_watermarks when the tx appears in a confirmed block during scan, and expired by expire_pending_claim_watermarks after 100 unconfirmed blocks.

🔄 Changed

• Wallet encryption upgraded from ChaCha20 (64-bit nonce) to XChaCha20 (192-bit nonce). The 24-byte nonce eliminates collision risk for randomly-generated nonces. Implementation moved from C (chacha.c) to Rust (shekyl-chacha crate) using the NCC-audited RustCrypto chacha20 crate. CHACHA_IV_SIZE increased from 8 to 24 bytes. Wallet keys files and cache files now use XChaCha20 exclusively.

• Two-component output keys (O = xG + yT). All output public keys now include a domain-separated y component along generator T, satisfying the FCMP++ SAL proof's OpenedInputTuple::open constraint. Previously, outputs were single-component (O = xG + 0·T) and the wallet incorrectly passed the Pedersen commitment mask z as the SAL y, causing proof generation to fail. The y-scalar uses the "shekyl_y" domain separator in crypto.cpp. The commitment mask z is now passed separately in the 256-byte witness header at offset 192. transfer_details stores m_y (boost serial v14). Two regression tests in proof.rs verify that the old bug (y=mask) fails and the correct path (y=real) succeeds.

• MAX_TX_EXTRA_SIZE (24576 bytes). The previous Monero-era cap (1060) was too small for FCMP++ tx_extra payloads (hybrid KEM ciphertexts ~1120 B per output, PQC leaf hashes, pubkey/nonce). Construction of v3 spends failed once PQC fields were appended; the pool and construct_tx checks now allow the larger bound.

• construct_tx RCT/PQC stubs. v3 spends require |pqc_auths| == |vin| for binary serialization, and RCTTypeFcmpPlusPlusPqc needs BP+, ECDH, and pseudo-out vectors sized to inputs/outputs. construct_tx now assigns stub pqc_authentication entries and calls rct::fill_construct_tx_rct_stub() (dummy Bulletproofs+, ECDH encoding, Pedersen pseudo-outs) so get_transaction_hash and JSON/blob round-trips succeed before the wallet replaces the RCT payload with genRctFcmpPlusPlus().

🗑️ Removed

• shekyl_fcmp_derive_pqc_keypair FFI function. Deleted the Rust FFI function and its C declaration. This function returned the ML-DSA secret key to C++, violating the security invariant that PQC secrets stay in Rust. Replaced by shekyl_derive_pqc_leaf_hash (returns only h_pqc) and shekyl_derive_pqc_public_key (returns only the public key).

• derive_pqc_keypair, derive_hybrid_pqc_keypair, DerivedPqcKeypair, DOMAIN_PQC_OUTPUT from shekyl-crypto-pq. These legacy derivation functions used the old salt A (shekyl-pqc-derive-v1) and returned secret key material. All callers now use derive_output_secrets (salt B) + keygen_from_seed or the higher-level sign_pqc_auth_for_output.

• derived_pqc_secret_keys, derived_pqc_public_keys, claim_signing_sks vectors in wallet2.cpp. These C++ vectors held PQC secret keys in wallet memory. All 4 call sites migrated to shekyl_derive_pqc_leaf_hash + shekyl_sign_pqc_auth, which derive and zeroize internally in Rust.

• pqc_secret_keys from native_sign_state (wallet2.h). The deferred native-signing path no longer stores PQC secret keys. The Rust tx-builder receives combined_ss + output_index and derives keys internally.

• SpendInput::pqc_secret_key from shekyl-tx-builder. Replaced with combined_ss: Vec<u8> (64 bytes) and output_index: u64. The Rust sign_pqc_auths function now calls sign_pqc_auth_for_output internally.

• 4 legacy Monero fixture tests in serialization.cpp. Removed portability_wallet, portability_outputs, portability_unsigned_tx, portability_signed_tx. These tested Monero-era wallet/tx formats that Shekyl does not support (no backward compatibility).

• 10 Monero-specific long-term block weight tests. Removed all tests from long_term_block_weight.cpp (empty_short through cache_matches_true_value). Monero-specific weight baselines do not apply to Shekyl economics.

• chacha.c (C ChaCha implementation). Replaced by the Rust shekyl-chacha crate via FFI. The C implementation had a strict aliasing violation in its U8TO32_LITTLE/U32TO8_LITTLE macros (pointer cast to uint32_t*).

• ChaCha8 dead code. All crypto::chacha8() call sites in wallet2.cpp were Monero backward-compatibility fallbacks for reading pre-2018 wallet files. Shekyl has no legacy wallets; these paths were unreachable.

🔒 Security

• ML-DSA secret keys never cross the FFI boundary. All wallet PQC signing paths now use shekyl_sign_pqc_auth (Rust FFI) or sign_pqc_auth_for_output (Rust tx-builder), which derive the keypair from combined_ss + output_index, sign, and zeroize the secret key — all within Rust. No ML-DSA secret key bytes exist in C++ memory at any point. This eliminates the largest PQC secret key exposure surface (~4064 bytes per input) from the wallet process.

• XChaCha20 192-bit nonces for wallet encryption. Upgraded from the DJB ChaCha20 64-bit nonce to XChaCha20 192-bit nonce, eliminating nonce collision risk for randomly-generated nonces. The previous 64-bit nonce was safe for Shekyl's usage pattern but the larger nonce provides a wider safety margin.

• Secure memory hardening (project-wide). Systematic implementation of the secure-memory.mdc rule across Rust and C++ codebases:

  • shekyl_buffer_free now uses zeroize crate instead of std::ptr::write_bytes, preventing the compiler from optimizing away the secret-wiping write.
  • native_sign_state::clear() in wallet2.h now memwipes all secret fields (spend_key_x, spend_key_y, h_pqc, amount_key, pqc_secret_keys) before clearing vectors.
  • Added prctl(PR_SET_DUMPABLE, 0) to daemon (main.cpp), simplewallet, and wallet2_ffi_create() to prevent core dumps containing key material on Linux.
  • Passwords, seeds, spend keys, and view keys in wallet2_ffi.cpp JSON-RPC dispatch now use memwipe scope guards to wipe temporary std::string buffers after use.
  • New shekyl_madvise_dontdump FFI function (MADV_DONTDUMP on Linux, no-op elsewhere) declared in shekyl_secure_mem.h.
  • PQC long-lived secret keys (m_pqc_secret_key) are now mlocked and madvise(MADV_DONTDUMP)ed after generation and decryption, and memwiped + munlocked on forget_spend_key().

• Dev branch audit: Tier 1-6 security and code hardening. Comprehensive re-audit of the dev branch with 22 findings addressed:

  • PQC secret key lifecycle (Tier 1). Added ~account_keys() destructor that wipes all secret keys (classical + PQC) and munlocks PQC material. Fixed create_from_keys and set_null to wipe+unlock PQC secrets before clearing. Prevents secrets from lingering in freed heap memory.
  • Debug trait on secret key types (Tier 1). Removed #[derive(Debug)] from HybridSecretKey, HybridKemSecretKey, and SharedSecret. All now implement manual Debug printing [REDACTED] to prevent log leakage.
  • Proof generation panic removal (Tier 1). Replaced 12 ScalarDecomposition::new(...).unwrap() calls in proof.rs with ?-propagated ProveError::ScalarDecompositionFailed. Zero-scalar blinding factors now return a clean error instead of panicking the wallet.
  • RELEASE-BLOCKER resolution (Tier 1). Evaluated and downgraded all 6 RELEASE-BLOCKER comments in shekyl-oxide to TODO with documented justifications. None were correctness or security blockers.
  • FROST multisig feature-gated (Tier 1). All FROST SAL and DKG FFI functions gated behind #[cfg(feature = "multisig")]. Production builds exclude multisig code unless the feature is enabled. C++ #ifdef SHEKYL_MULTISIG blocks have been removed from shekyl_ffi.h, wallet2.h/cpp, and wallet2_ffi.cpp — FROST multisig is now consumed exclusively through the Rust wallet crates.
  • CString unwrap removal (Tier 2). Replaced all CString::new().unwrap() in shekyl-wallet-rpc with to_cstring() helper returning WalletError. Fixed Mutex::lock().unwrap() in server.rs to return JSON-RPC error on lock poisoning.
  • Sign function zeroization (Tier 2). HybridEd25519MlDsa::sign() now wraps temporary secret arrays in Zeroizing<[u8; N]> for automatic cleanup.
  • hex_to_key temp buffer wiped (Tier 2). Added memwipe scope guard to hex_to_key in wallet2_ffi.cpp.
  • PQC verify debug gated (Tier 2). shekyl_pqc_verify_debug now only compiled with debug_assertions or debug-verify feature to prevent use as a signature oracle in production.
  • Free-string wipe (Tier 2). wallet2_ffi_free_string now wipes the buffer before freeing, protecting against secret-bearing JSON residue.
  • Buffer free contract documented (Tier 2). shekyl_buffer_free len safety contract documented in both Rust doc-comment and C header.
  • Claim builder silent wrong index (Tier 2). position(...).unwrap_or(0) replaced with explicit TransferNotFound error in claim_builder.rs.
  • deny(unsafe_code) added (Tier 3). Added to 5 pure-Rust crates: shekyl-consensus, shekyl-economics, shekyl-staking, shekyl-crypto-hash, shekyl-crypto-pq.
  • Workspace lints inherited (Tier 3). [lints] workspace = true added to 11 Shekyl-first crates for consistent Clippy enforcement.
  • Legacy naming cleanup (Tier 4). Renamed MONERO_DEFAULT_LOG_CATEGORY to SHEKYL_DEFAULT_LOG_CATEGORY across 128 files.
  • FCMP++ edge-case tests (Tier 5). Added 9 parametrized tests covering boundary input counts, missing tree paths, empty proof data, count mismatches, zero tree depth, and wrong signable_tx_hash.
  • CI improvements (Tier 6). Added .env to .gitignore, created explicit CodeQL workflow targeting both dev and main branches, added permissions: contents: read to build.yml.

• Base58 overflow and non-canonical encoding fix (monero-oxide fork). shekyl-base58::decode() now uses checked_add to prevent integer overflow during character accumulation, and rejects non-canonical encodings where unused high bytes of the decoded sum are non-zero. Defense-in-depth measure; Shekyl production addresses use Bech32m.

• Cargo profile hardening (both Rust workspaces). All profiles (dev, release, test, bench) now enforce overflow-checks = true in both the monero-oxide fork Cargo.toml and the Shekyl rust/Cargo.toml. Dev and release profiles additionally set panic = "abort".

• HKDF domain-separated salts for PQC key derivation. All HKDF-SHA-512 calls in shekyl-crypto-pq now use explicit fixed salts (shekyl-pqc-derive-v1, shekyl-master-derive-v1) instead of None. Strengthens domain separation and prevents cross-protocol seed reuse if the same combined shared secret appears in other contexts.

• FrostSalSession secret deduplication. Removed the redundant x (spend secret scalar) from FrostSalSession struct fields. Previously the secret was stored both in the struct and inside SalAlgorithm, with only the struct copy explicitly zeroized on drop. Now the secret lives solely inside the algorithm, eliminating the unprotected duplicate.

• Levin double-compression guard. try_compress_message now checks LEVIN_PACKET_COMPRESSED in the input header before compressing. Prevents double-compression of already-compressed messages in future refactors.

• Divisor degree underflow assertions. Divisor::div now asserts that self.a.degree >= rhs.degree and self.b.degree >= rhs.degree before usize subtraction, converting silent wraparound into a clear panic with diagnostic context.

• Interpolator allocation bounds fix. Interpolator::interpolate now allocates the output coefficient vector using the domain size (self.lagrange_polys.len()) instead of evals.len(), preventing trailing zeros from inflating the vector when callers provide excess evaluations.

• member_of_list witness construction hardened. Replaced next_eval.unwrap() with carry_eval.zip(next_eval) in the FCMP++ circuit gadget, eliminating a potential panic if evaluation invariants change.

✨ Added

• shekyl-tx-builder crate. New Rust crate (rust/shekyl-tx-builder/) consolidating Bulletproofs+ range proofs, FCMP++ full-chain membership proof construction, ECDH amount encoding, and PQC (ML-DSA-65) signing into a single native Rust call path. Replaces the prior C++ → Rust → C++ → Rust FFI round-trip for proof generation. Includes 19 unit tests covering validation edge cases (0 inputs, overflow amounts, empty trees, wrong-length PQC keys) and ECDH encoding round-trips. All secret key material is wrapped in zeroize::Zeroizing and wiped on drop.

• shekyl_sign_transaction FFI export. New C ABI function in shekyl-ffi wrapping shekyl-tx-builder::sign_transaction(). Accepts JSON-serialized inputs/outputs, returns a ShekylSignResult with either JSON proofs or a structured error code and message. Declared in shekyl_ffi.h.

• Wallet RPC native-sign feature. shekyl-wallet-rpc gains an optional native-sign Cargo feature that enables transfer_native() — a pure-Rust transfer path using shekyl-tx-builder directly, eliminating C++ proof FFI round-trips. The split pipeline uses wallet2_ffi_prepare_transfer (C++ → JSON) → shekyl-tx-builder::sign_transaction (pure Rust) → wallet2_ffi_finalize_transfer (JSON → C++).

• wallet2_ffi_prepare_transfer / wallet2_ffi_finalize_transfer implemented. Full C++ implementation of the split transfer pipeline. prepare_transfer activates native-sign mode in transfer_selected_rct (skipping C++ proof generation), gathers per-input signing data (secret keys, tree paths parsed into c1/c2 branch layers, leaf chunks, PQC key material), per-output data (dest keys, amount keys), tree context (reference block, curve tree root, depth), and serializes everything as hex-encoded JSON matching the Rust SpendInput/OutputInfo/TreeContext types. finalize_transfer receives the Rust-generated SignedProofs JSON, manually reconstructs the BP+ struct from the Rust blob (handling the V-field format difference), inserts all proofs into tx.rct_signatures, performs PQC signing using stored secret keys, and commits/broadcasts the transaction. Fee estimation uses shekyl_fcmp_proof_len() to pad the stub FCMP++ proof to the correct estimated size.

• Native-sign mode in wallet2::transfer_selected_rct. New m_native_sign_mode flag and native_sign_state struct on wallet2. When enabled, transfer_selected_rct skips genRctFcmpPlusPlus and PQC signing, instead storing all signing data for the Rust path. Tree path blobs are parsed into structured c1/c2 branch layers. Padded stub proofs provide accurate fee estimation.

• Hex serde for shekyl-tx-builder types. All [u8; 32], Vec<u8>, and Vec<[u8; 32]> fields on SpendInput, OutputInfo, TreeContext, SignedProofs, LeafEntry, and PqcAuth now serialize/deserialize as hex strings via custom serde modules. This enables clean JSON interop with the C++ FFI layer which produces hex-encoded cryptographic keys and blobs.

• Secure memory Cursor rule. Added .cursor/rules/secure-memory.mdc codifying project-wide conventions for cryptographic secret zeroization in both Rust (Zeroizing<T>, ZeroizeOnDrop) and C++ (memwipe, scope guards, wipeable_string), FFI boundary ownership, and OS-level protections (mlock, prctl(PR_SET_DUMPABLE, 0), MADV_DONTDUMP).

• Vendored monero-oxide protocol crates. Completed the vendored crate set in rust/shekyl-oxide/: added shekyl-primitives (Keccak-256, Pedersen commitments), shekyl-bulletproofs (BP+ range proofs), the root shekyl-oxide crate (transaction/block types, FCMP module), shekyl-rpc (daemon RPC trait, ScannableBlock), and shekyl-simple-request-rpc (HTTP transport). Resolved the shekyl-address naming collision by removing the oxide base58 address dependency from the vendored RPC crate (Shekyl uses Bech32m exclusively). Added crypto-heavy crate optimizations to [profile.dev.package] and workspace-level clippy lints for the oxide crates.

• shekyl-scanner crate. New Rust crate (rust/shekyl-scanner/) providing a native transaction scanner with Shekyl-specific extensions. Ported the core scanning pipeline from monero-oxide (SharedKeyDerivations, Extra parsing, ViewPair, per-block/per-tx/per-output ECDH scan loop) and extended it with:

  • PQC KEM ciphertext parsing (tx_extra tag 0x06) and leaf hash parsing (0x07)
  • Staking output detection and balance categorization (matured/locked tiers)
  • TransferDetails struct with FCMP++ path precompute, combined PQC shared secret, and spend tracking fields
  • WalletState for in-memory transfer management with key image dedup, spend detection, and reorg handling
  • BalanceSummary with staking-aware breakdown (total, unlocked, timelocked, staked matured/locked, frozen)

• Split RPC routing (rust-scanner feature). shekyl-wallet-rpc now supports a rust-scanner feature flag that routes scanner-backed read-only methods (get_balance, get_transfers, incoming_transfers, get_height, get_staked_outputs, get_staked_balance) to native Rust handlers via shekyl-scanner, while all mutation methods continue through the C++ FFI. Added ScannerState, dispatch_with_scanner(), and typed scanner handlers.

• GUI wallet scanner integration. Updated wallet_bridge.rs in shekyl-gui-wallet to include a ScannerState alongside the FFI Wallet2 handle. Added get_scanner_balance(), get_scanner_staked_outputs(), and get_scanner_height() bridge methods for future scanner-backed queries.

• shekyl-encoding crate. New standalone Rust crate (rust/shekyl-encoding/) for general-purpose Bech32m blob encoding and decoding with arbitrary HRPs. Defines HRP constants for wallet proofs (shekylspendproof, shekyltxproof, shekylreserveproof, shekylsig, shekylmultisig, shekylsigner).

• shekyl-address crate. New standalone Rust crate (rust/shekyl-address/) for network-aware segmented Bech32m address encoding. Defines Network enum (Mainnet, Testnet, Stagenet) with HRP lookup tables for classical (shekyl, tshekyl, sshekyl) and PQC (skpq/skpq2, tskpq/tskpq2, sskpq/sskpq2) segments. ShekylAddress supports encode(), decode(), and decode_for_network().

• Generic Bech32m blob FFI. shekyl_encode_blob() and shekyl_decode_blob() FFI functions allow C++ to encode/decode arbitrary binary data with purpose-specific HRPs, replacing all direct Base58 calls in wallet proofs.

• Network-aware address FFI. shekyl_address_encode() and shekyl_address_decode() now accept/return a network parameter (0=mainnet, 1=testnet, 2=stagenet) for HRP-based network discrimination.

• Shekyl-first development rule. Added .cursor/rules/shekyl-first-development.mdc codifying that Shekyl core is the authoritative codebase and the monero-oxide fork is a disposable downstream consumer.

• FROST SAL threshold signing for FCMP++ multisig. New frost_sal module in shekyl-fcmp wraps upstream SalAlgorithm<Ed25519T> for threshold Spend-Auth-and-Linkability proofs. FrostSalSession manages per-input FROST state; prove_with_sal() constructs FCMP++ proofs from pre-aggregated SAL pairs. FFI functions (shekyl_frost_sal_session_new, _get_rerand, _aggregate_and_prove, _session_free) expose the session lifecycle to C++. The multisig feature flag enables FROST dependencies (modular-frost, transcript, rand_chacha).

• FROST DKG key management. New frost_dkg module in shekyl-fcmp provides SerializedThresholdKeys for ThresholdKeys<Ed25519T> serialization/deserialization, group key extraction, and parameter validation. FFI functions (shekyl_frost_keys_import, _export, _group_key, _validate, _free) manage threshold keys from C++.

• Variable-length FCMP++ witness wire format. shekyl_fcmp_prove FFI now accepts a single witness_ptr/witness_len blob containing per-input fixed headers, leaf chunk Ed25519 output data, and Helios/Selene branch layers. genRctFcmpPlusPlus in rctSigs.cpp serializes the full witness.

• Daemon RPC chunk_outputs_blob. get_curve_tree_path response now includes per-chunk compressed Ed25519 output data (O, I=Hp(O), C, H(pqc_pk)) enabling the wallet to pass full output points to the prover.

• C++ wallet FROST multisig integration (removed). Previously added C++ FROST integration in wallet2.cpp (prepare_multisig_fcmp_proof, export_multisig_signing_request, import_multisig_signatures, threshold key import/export). This C++ code has been replaced by the Rust-native wallet crates and all #ifdef SHEKYL_MULTISIG blocks have been removed from wallet2.h/cpp, wallet2_ffi.cpp, and shekyl_ffi.h.

• FrostSigningCoordinator for multi-input nonce aggregation. New coordinator in shekyl-fcmp/src/frost_sal.rs manages per-input preprocess collection, nonce sum computation, share collection, and final aggregation into SpendAuthAndLinkability pairs for prove_with_sal().

• Full FROST DKG ceremony via MultisigDkgSession. New wallet-level wrapper in shekyl-wallet-core/src/multisig/dkg.rs drives the dkg-pedpop KeyGenMachine state machine through all three rounds with type-safe transitions: generate_coefficients → generate_secret_shares → calculate_share → complete. DKG messages are exchanged as byte buffers (file-based, air-gap compatible).

• MultisigSigningSession for wallet-level FROST orchestration. New session in shekyl-wallet-core/src/multisig/signing.rs wraps per-input FrostSalSession instances and a FrostSigningCoordinator, providing hex-encoded preprocess/share exchange for transport-agnostic signing.

• MultisigGroup with PQC keypair management. New type in shekyl-wallet-core/src/multisig/group.rs stores threshold keys, group metadata, and PQC hybrid keypairs with automatic zeroization on drop. Supports serialization/deserialization for wallet storage.

• FROST multisig RPC endpoints. 9 new JSON-RPC methods in shekyl-wallet-rpc/src/multisig_handlers.rs for FROST signing coordination: multisig_register_group, multisig_list_groups, multisig_create_signing, multisig_sign_preprocess, multisig_sign_add_preprocess, multisig_sign_nonce_sums, multisig_sign_own, multisig_sign_add_shares, multisig_sign_aggregate. All byte fields hex-encoded. DKG is intentionally excluded from RPC (file-based only).

• SalLegacyAlgorithm and legacy_multisig removed from shekyl-oxide. Deleted the legacy Monero multisig SAL algorithm and test module from the vendored shekyl-oxide/fcmp/fcmp++ crate. Only the modern SalAlgorithm (used by FrostSalSession) is retained.

• 16+ new Rust tests for FROST. 4 frost_sal unit tests (session creation, pseudo-out distinctness, identity rejection, field roundtrip), 6 FrostSigningCoordinator tests (wrong preprocess count, shares before nonces, duplicate shares, nonce sums timing, point addition, bytes roundtrip), 2 FrostSalSession negative tests, 4 frost_dkg unit tests (serialization roundtrip, group key extraction, parameter validation, byte-level roundtrip), 8 FFI lifecycle tests (null safety, invalid data rejection, session handle management), 5 shekyl-wallet-core multisig tests (DKG 2-of-3 and 3-of-5 roundtrips, DKG state machine errors, group serialization, threshold keys roundtrip).

• FCMP++ prove/verify round-trip test. prove_verify_roundtrip() in rust/shekyl-fcmp/src/proof.rs exercises the full stack: random key generation, single-leaf tree root computation, prove(), verify(), and negative tests (tampered key image, wrong tree root).

🐛 Fixed

• Suppressed vendored crate warnings. Fixed dead_code warning for InconsistentWitness variant in generalized-bulletproofs (only constructed under debug_assertions) with #[cfg_attr(not(debug_assertions), allow(dead_code))]. Fixed deprecated GenericArray::as_slice() in helioselene ciphersuite by replacing with as_ref().

• Stake-claim vs verRctSemanticsSimple conflict. Stake-claim transactions use RCTTypeFcmpPlusPlusPqc but have no FCMP++ membership proof (they prove ownership via PQC auth on public amounts). ver_non_input_consensus now excludes stake-claim-only transactions from the RCT semantics batch that rejects empty fcmp_pp_proof.

• genRctFcmpPlusPlus hard-fail on proof failure. Previously logged and returned an rctSig with an empty proof when shekyl_fcmp_prove failed; now throws CHECK_AND_ASSERT_THROW_MES so the wallet catches the error immediately rather than producing an invalid transaction.

• PQC leaf scalar now uses proper Selene field reduction. PqcLeafScalar::from_pqc_public_key and hash_pqc_public_key previously truncated Blake2b-512 to 32 bytes and cleared bit 255, which could produce non-canonical values exceeding the Selene base field modulus. Now uses HelioseleneField::wide_reduce on the full 64-byte hash for unbiased, canonical field elements.

• Deterministic PQC keygen stability. Replaced rand::rngs::StdRng with rand_chacha::ChaCha20Rng for ML-DSA-65 keypair derivation. StdRng's underlying algorithm is not a stability guarantee across rand versions, which could break wallet-restore-from-seed.

• Bech32m variant enforcement. decode_blob now strictly enforces the Bech32m checksum variant instead of accepting both Bech32 and Bech32m. Removed unused EncodingError::EmptyData variant.

🔒 Security

• FrostSalSession spend secret zeroized on drop. The FROST SAL session's spend secret scalar is zeroized when the session is dropped, per the project-wide secure memory rule. After the FrostSalSession secret deduplication (see Changed), the secret lives solely inside the SalAlgorithm and is zeroized through its Drop impl.

• RELEASE-BLOCKER resolved in circuit gadgets. The incomplete_add_pub function in the FCMP++ circuit already receives parameters typed as OnCurve, which guarantees the on-curve constraint. Replaced the RELEASE-BLOCKER(shekyl) comment with documentation explaining why no additional constraint is needed.

• Pruning watermark hardening. BlockchainLMDB::prune_tx_data() now fails the current batch on missing transaction rows (TX_DNE) instead of logging and continuing, so tx_prune_next_block cannot advance on partial pruning.

• FCMP++ compile-path compatibility fixes. Updated wallet/core-test FCMP++ construction callsites for the current genRctFcmpPlusPlus leaf-chunk API, and added explicit cached-chunk to rct::fcmp_chunk_entry conversion in wallet construction to keep GCC 14 builds green.

• CI portability and fuzz gate hardening. Replaced GNU-only xargs -r usage in Cargo absolute-path guard with a portable shell loop, and added a required fuzz-harness inventory smoke gate in Rust CI.

• Stale fuzz targets updated. fuzz_fcmp_proof_deserialize and fuzz_tx_deserialize_fcmp_type7 now pass the required signable_tx_hash 7th argument to verify(). fuzz_block_header_tree_root rewritten for the current ProveInput struct and 4-arg prove() signature.

• prune_tx_data miner output lookup. When storing output-pruning metadata, RCT coinbase outputs are keyed under amount 0 in LMDB (same as add_transaction); pruning now uses that amount for get_output_key instead of the plaintext vout.amount, avoiding OUTPUT_DNE during prune for miner transactions.

🗑️ Removed

• RingCT-era dead code excision (C++ wallet). Comprehensive removal of ring-signature infrastructure that is structurally unreachable on an FCMP++ chain. Deleted: gamma_picker class and GAMMA_SHAPE/GAMMA_SCALE constants, transfer_selected (non-RCT overload), wallet2::get_outs decoy-fetching overloads (~700 lines), tx_add_fake_output, select_available_mixable_outputs, select_available_outputs_from_histogram, get_spend_proof/check_spend_proof (ring-sig-dependent proofs), get_min_ring_size/get_max_ring_size, m_confirm_non_default_ring_size preference, the entire ringdb.h/ringdb.cpp subsystem (LMDB ring database), ring commands in simplewallet, spend proof RPC endpoints and FFI dispatch, boroSig struct from rctTypes.h, unreachable hf_version < HF_VERSION_FCMP_PLUS_PLUS_PQC branch in cryptonote_tx_utils.cpp, blockchain_blackball utility, and output_selection.cpp unit test. Removed LMDB link dependency from wallet CMake target.

• Decoy and ring_size removal from Rust RPC. Removed ring_size: u32 parameter from shekyl-wallet-rpc transfer API (types.rs, wallet.rs, ffi.rs), from the C++ FFI boundary (wallet2_ffi.h/.cpp), and from the C++ wallet RPC estimate_tx_size_and_weight command definition. Deleted Decoys struct, MAX_RING_SIZE constant, DecoyRpc trait and blanket implementation, OutputInformation struct, rpc_point helper, and test_decoy_rpc test from shekyl-oxide. Removed /get_output_distribution.bin route from shekyl-daemon-rpc.

• Bulletproof v1 ("Original") deletion. Deleted the entire original/ module tree and its tests from shekyl-bulletproofs. Removed Bulletproof::Original enum variant, v1 prove()/read() functions, v1 match arms in verify/batch_verify/write_core, and the standalone BulletproofsBatchVerifier struct. Cleaned up dead inner_product and mul_vec methods that were only used by v1 code.

• Light wallet support removed. Deleted all m_light_wallet state, set_light_wallet, light_wallet_login, light_wallet_get_outs, import_outputs, get_unspent_outs, submit_raw_tx, and all if (m_light_wallet) branches from wallet2.cpp/.h. Deleted wallet_light_rpc.h entirely. Removed light wallet API from wallet2_api.h/wallet.h/wallet.cpp. Fundamentally incompatible with FCMP++ privacy model (sends view keys to remote server).

🔄 Changed

• MLSAG naming debt resolved. Renamed get_pre_mlsag_hash to get_tx_prehash, mlsag_prehash/mlsag_prepare/mlsag_hash/mlsag_sign to tx_prehash/tx_prepare/tx_hash/tx_sign across the device interface hierarchy (device.hpp, device_default.hpp/.cpp, device_ledger.hpp/.cpp), rctSigs.cpp/.h, and protocol.cpp. Renamed Ledger INS_MLSAG constant to INS_TX_SIGN. These functions are live code repurposed for FCMP++ transaction hashing; the names now reflect their actual role.

• Base58 encoding removed entirely. Deleted src/common/base58.{h,cpp}, tests/unit_tests/base58.cpp, tests/fuzz/base58.cpp, and all CMake references. Removed CRYPTONOTE_PUBLIC_ADDRESS_BASE58_PREFIX, CRYPTONOTE_PUBLIC_INTEGRATED_ADDRESS_BASE58_PREFIX, and CRYPTONOTE_PUBLIC_SUBADDRESS_BASE58_PREFIX constants from all network namespaces and config_t. No code path accepts or produces Base58 strings.

• Legacy address structs removed. integrated_address, legacy_account_public_address, and legacy_integrated_address structs removed from cryptonote_basic_impl.cpp. Subaddress and integrated address logic removed from address encoding/decoding chokepoints.

🔄 Changed

• Rust naming convention cleanup. Fixed phantom FFI function reference in shekyl_pqc_verify doc comment (referenced non-existent shekyl_pqc_verify_multisig_with_group_id, now points to shekyl_pqc_multisig_group_id). Renamed Windows SystemInfo.dw_page_size to page_size (drop Hungarian notation). Renamed shekyl-wallet-rpc-rs binary to shekyl-wallet-rpc (drop -rs suffix per Rust API Guidelines).

• Address encoding migrated to Bech32m. get_account_address_as_str() and get_account_address_from_str() now call Rust FFI (shekyl_address_encode, shekyl_address_decode) for network-aware Bech32m encoding. The subaddress parameter is retained for API compatibility but ignored. address_parse_info fields is_subaddress and has_payment_id are always false.

• Wallet proofs use Bech32m blob encoding. Spend proofs, tx proofs (in/out), reserve proofs, message signatures, multisig signatures, and signer keys are now encoded with purpose-specific HRPs via shekyl_encode_blob / shekyl_decode_blob FFI. Version headers (SpendProofV1, InProofV2, etc.) removed; the HRP now serves as the type discriminator.

• shekyl-crypto-pq re-exports shekyl-address. The address module in shekyl-crypto-pq is now a re-export of the standalone shekyl-address crate. The old shekyl-crypto-pq/src/address.rs has been deleted.

• Tx-data prune watermark. prune_tx_data now stores tx_prune_next_block (exclusive next height) instead of ambiguous last_pruned_tx_data_height values; legacy keys migrate on read/write. LMDB unit tests live in tests/unit_tests/tx_data_pruning_lmdb.cpp (minimal block builder only; does not link tests/core_tests/chaingen.cpp into unit_tests, avoiding duplicate object code and macOS linker unwind/diagnostic issues in CI).

• FCMP++ Rust dependency source moved in-repo. shekyl-fcmp now consumes vendored shekyl-oxide crates via path dependencies under rust/shekyl-oxide/ instead of git dependencies plus local absolute-path [patch] overrides. This removes host-specific Cargo path failures in CI and keeps builds fully repo-local.

• Upstream sync and portability guardrails. Added vendored snapshot metadata at rust/shekyl-oxide/UPSTREAM_MONERO_OXIDE_COMMIT, a divergence workflow (.github/workflows/shekyl-oxide-divergence.yml), and build workflow checks that fail on absolute local paths in Cargo manifests/config.

✨ Added

• --prune-blockchain transaction-data pruning. LMDB v6 adds txs_pqc_auths (split from txs_pruned at pqc_auths_offset), implements prune_tx_data (batch 256 blocks, output metadata, watermark, TOCTOU height check), default depth CRYPTONOTE_TX_PRUNE_DEPTH (5000), pop_block guard when verification data is gone, continuous pruning via update_blockchain_pruning, RPC get_transactions.pruned and get_info.tx_prune_height.

• Staking FFI and config-driven tier parameters. shekyl-staking now generates tier lock durations, yield multipliers, and max stake-claim range from config/economics_params.json at build time (aligned with shekyl-economics). New FFI: shekyl_calc_per_block_staker_reward (128-bit division with optional overflow flag), shekyl_stake_tier_count, shekyl_stake_tier_name, shekyl_stake_max_claim_range. C++ uses these in blockchain.cpp, core_rpc_server.cpp, and simplewallet instead of duplicating tier strings or inline mul128/div128_64 reward math.

• FCMP++ transaction construction helper (construct_fcmp_tx). New chaingen helper in tests/core_tests/chaingen.cpp that builds fully valid FCMP++ transactions during core test replay: tree path assembly from the live LMDB curve tree, genRctFcmpPlusPlus proof generation, KEM decapsulation for per-input PQC keypair derivation, and PQC auth signing. This unblocks 30+ disabled core tests that relied on the old construct_tx_rct stub.

• FCMP++ core test generators (Phase 7). Five new tests in tests/core_tests/fcmp_tests.cpp:

  • gen_fcmp_tx_valid: end-to-end FCMP++ transaction construction and pool acceptance during replay
  • gen_fcmp_tx_double_spend: second FCMP++ spend of the same output rejected
  • gen_fcmp_tx_reference_block_too_old: stale referenceBlock rejected
  • gen_fcmp_tx_reference_block_too_recent: too-recent referenceBlock rejected
  • gen_fcmp_tx_timestamp_unlock_rejected: timestamp-based unlock_time rejected

• Verification caching unit tests. Six new GTest cases in tests/unit_tests/fcmp.cpp validating compute_fcmp_verification_hash determinism, sensitivity to proof/referenceBlock/key-image changes, null return for non-FCMP++ types, and multi-input handling.

• Deferred insertion boundary tests. New tests/unit_tests/deferred_insertion.cpp with tests for: outputs not drainable before maturity, coinbase maturity window (60 blocks), regular tx maturity window (10 blocks), drain journal atomicity round-trip, and insertion ordering determinism across two DB instances.

• Pending tree add/pop stress test. New tests/unit_tests/pending_tree_fuzz.cpp with randomized stress test (100 random leaves, multi-height draining), add/remove round-trip, drain journal CRUD, and leaf removal correctness.

• fuzz_tx_deserialize_fcmp_type7 Rust fuzz target. New cargo-fuzz target in rust/shekyl-fcmp/fuzz/ that exercises FCMP++ proof verification with transaction-structured random inputs: pseudoOuts, proof blobs, PQC hashes, corrupted type bytes, empty proofs, and mismatched input counts.

• Comprehensive staking test suite. New test coverage across C++ and Rust:

  • tests/unit_tests/staking.cpp: 20+ GTest unit tests covering txin_stake_claim and txout_to_staked_key serialization round-trips, reward integer math (including mul128/div128_64 vs double divergence at large values), helper function coverage (get_inputs_money_amount, check_inputs_overflow, check_inputs_types_supported, get_output_staking_info, set_staked_tx_out), stake weight/tier FFI validation, and variant type handling.
  • tests/core_tests/staking.cpp + staking.h: 18 chaingen core tests covering staking lifecycle (stake output creation), invalid claim rejection (inverted range, oversized range, future height, wrong watermark, wrong amount, non-staked output, output not in tree), lock period enforcement (invalid tier), rollback correctness (pool balance, watermark), txpool handling, sorted-input enforcement, and multi-tier staking.
  • rust/shekyl-staking/src/tiers.rs: 10 edge-case tests including exhaustive invalid tier ID rejection, ordering invariants for yield multiplier and lock blocks, contiguous ID verification, and positive parameter assertions.
  • rust/shekyl-staking/fuzz/fuzz_targets/fuzz_claim_reward.rs: cargo-fuzz target that generates random accrual records and verifies reward computation invariants (no overflow, reward <= pool, weight monotonicity, cumulative bounds).

🔄 Changed

• Universal deferred curve-tree insertion (Decision 15). All outputs (coinbase, regular, staked) now enter the pending_tree_leaves table at creation and drain into the curve tree only after their type-specific maturity height (coinbase: +60, regular: +10, staked: max(effective_lock_until, +10)). The pending_staked_* identifiers were renamed to pending_tree_* across all database interfaces. The drain journal (pending_tree_drain) now stores full 136-byte entries (maturity_height + leaf_data) for exact pop_block reversal instead of just a drain count. pop_block restores drained leaves to pending and removes the popped block's own pending entries.

• FCMP_REFERENCE_BLOCK_MIN_AGE reduced to 5 (Decision 14). With maturity enforced by deferred tree insertion, MIN_AGE now serves only as a reorg safety margin (5 blocks ≈ 10 minutes). The old static_asserts tying MIN_AGE to unlock windows have been removed.

• Timestamp-based unlock_time rejected (Decision 13). Transactions with unlock_time >= CRYPTONOTE_MAX_BLOCK_HEIGHT_SENTINEL (500M) are now rejected in check_tx_outputs. Only height-based lock times are accepted.

• prune_tx_data status clarification. The output-metadata pruning loop in db_lmdb.cpp is a plumbing-only stub (TODO(phase6f)). The store_output_metadata, get_output_metadata, and is_output_pruned interfaces are live, but the block-iteration pruning loop does not execute.

🗑️ Removed

• Vestigial hard fork constants. Removed HF_VERSION_CLSAG and HF_VERSION_MIN_V2_COINBASE_TX from cryptonote_config.h. All test references replaced with literal 1.

• Legacy tests incompatible with FCMP++ consensus. Disabled 30+ core and unit tests that relied on Monero-era transaction construction (RCTTypeBulletproofPlus, CLSAG ring signatures, v1/v2 transactions):

  • tests/core_tests/chaingen_main.cpp: Disabled gen_simple_chain_001, gen_simple_chain_split_1, gen_chain_switch_1, gen_ring_signature_1, gen_ring_signature_2, all txpool_* tests, all gen_double_spend_* tests, gen_block_reward, all gen_bpp_* Bulletproofs+ tests, and several gen_tx_* tests whose setup required valid user transactions. These tests construct transactions via MAKE_TX/construct_tx_rct which produce RCTTypeFcmpPlusPlusPqc stubs with empty pqc_auths, rejected by check_tx_inputs even in FAKECHAIN mode.
  • tests/unit_tests/bulletproofs.cpp: All three weight tests (weight_equal, weight_more, weight_pruned) prefixed with DISABLED_ and hex blobs removed. Shekyl's rctSigBase serialization rejects any type other than RCTTypeFcmpPlusPlusPqc (type 7), so old RCTTypeBulletproofPlus (type 6) blobs fail to deserialize.
  • Re-enabling requires a chaingen FCMP++ transaction generator that produces valid PQC auth signatures and curve-tree membership proofs.

🔄 Changed

• Upstream monero-oxide dependencies renamed to shekyl-oxide. Updated shekyl-fcmp/Cargo.toml and all Rust source files to use the renamed packages from the monero-oxide fork (monero-fcmp-plus-plus → shekyl-fcmp-plus-plus, monero-generators → shekyl-generators). Cargo.lock advanced from pin 92af05e to 416d8d1 which includes the complete monero-oxide/ → shekyl-oxide/ directory and package rename.

• shekyl-fcmp crate cleanup. Removed unused sha2 and shekyl-crypto-pq dependencies from rust/shekyl-fcmp/Cargo.toml. Renamed the misleading ProveError::InputCountMismatch variant to ProveError::PqcHashMismatch with a clear input_index field indicating which input has a mismatched leaf h_pqc vs pqc_auth commitment.

🐛 Fixed

• Private member access in pending tree unit tests. Fixed 18 compile errors in pending_tree_fuzz.cpp and 4 in deferred_insertion.cpp on macOS CI where calls to add_pending_tree_leaf, drain_pending_tree_leaves, add_pending_tree_drain_entry, get_pending_tree_drain_entries, remove_pending_tree_drain_entries, and remove_pending_tree_leaf were calling private overrides on BlockchainLMDB. Changed all test methods to use BlockchainDB& references, accessing the public base class interface.

• CI compile errors across all platforms. Fixed compilation failures in the new staking and FCMP++ test suites:

  • tests/core_tests/staking.cpp: Added missing fill_tx_sources declaration to chaingen.h and moved Blockchain::check_stake_claim_input from the private section to the public API so core tests can call it without IN_UNIT_TESTS.
  • tests/unit_tests/fcmp.cpp: Fixed serialization calls to use do_serialize(ar, v) instead of non-existent v.serialize(ar) member; replaced binary_archive<false>(istringstream&) with the correct binary_archive<false>(span<const uint8_t>) constructor; fixed shekyl_pqc_verify call to include the required scheme_id first argument and corrected parameter order.
  • tests/unit_tests/staking.cpp: Same binary_archive<false> constructor fix — replaced istringstream with epee::span<const uint8_t> in all four serialization round-trip tests.
  • macOS CI: Added zstd to Homebrew dependencies and fixed CMake to use PkgConfig::ZSTD imported target instead of bare library name, resolving ld: library 'zstd' not found on macOS Homebrew where the library lives in a non-standard path (/opt/homebrew/lib).

• RPC estimate_claim_reward floating-point precision bug. The on_estimate_claim_reward RPC handler used double-precision arithmetic for reward estimation, which diverges from the consensus mul128/div128_64 path when total_weighted_stake > 2^53. Fixed to use identical 128-bit integer math, ensuring wallet reward estimates always match consensus.

🐛 Fixed

• FCMP++ wallet precompute metadata and input consistency checks. transfer_selected_rct and multisig proof prep now read tree depth from RPC metadata (tree_depth) instead of path_blob[0], enforce that all selected inputs share the same reference block/depth snapshot, and reject empty precomputed paths. This fixes silent spend-construction failures.

• Stake-claim input routing in consensus verification. Blockchain::check_tx_inputs now routes pure txin_stake_claim transactions through the claim-specific input checks before generic FCMP++ txin_to_key validation, preventing incorrect rejection of valid stake-claim transactions that use RCTTypeFcmpPlusPlusPqc.

• Stake-claim reward math overflow defense. Added a defensive q_hi != 0 check after div128_64 in claim reward computation, rejecting impossible overflow states instead of silently truncating.

• Claim transaction PQC signing correctness/performance. Removed wallet master-key fallback for claim input signing and now require per-output shared-secret rederivation for all claim inputs. Claim signing keypairs are derived once per input and reused for both pqc_auths public key and signature generation.

• Curve-tree path RPC returns spendable reference block. get_curve_tree_path now returns a reference_block at least FCMP_REFERENCE_BLOCK_MIN_AGE + 1 behind tip, avoiding immediate mempool rejection of freshly built transactions that used a too-recent tip anchor.

• PQC derivation index correctness and duplicate derivation overhead. Spend-path and multisig PQC key derivation now use m_internal_output_index (matching KEM encapsulation/decapsulation) and derive each per-input keypair once per transaction, reusing it for both H(pqc_pk) and signing.

• Staked-output FCMP++ path precompute filtering. Wallet precompute/incremental updates now skip still-locked staked outputs (m_stake_lock_until > current_height) to avoid daemon path lookup errors.

• Stake-claim rollback completeness. BlockchainDB::remove_transaction now fully reverses txin_stake_claim state on reorg: watermark is restored to its pre-claim value (or removed for first-time claims) and the claimed amount is credited back into the staker reward pool. Previously only the spent key was removed, leaving claim-progress accounting permanently advanced after a reorg.

• Txpool key-image handling for stake claims. All six txpool functions that walk transaction inputs (insert_key_images, remove_transaction_keyimages, have_tx_keyimges_as_spent, have_key_images, append_key_images, mark_double_spend) now handle txin_stake_claim inputs alongside txin_to_key. Previously they used CHECKED_GET_SPECIFIC_VARIANT(..., txin_to_key, ...) which caused immediate false-return on any stake-claim input, breaking mempool bookkeeping for claim transactions.

• remove_transaction_keyimages no longer returns early on error. The function now continues removing remaining key images instead of aborting at the first mismatch, eliminating the partial-cleanup semantics noted by the long-standing FIXME.

• Core helper support for txin_stake_claim. get_inputs_money_amount and check_inputs_overflow now handle both txin_to_key and txin_stake_claim input variants instead of failing on the latter. These are called unconditionally for all transactions (via check_money_overflow), so the old hard-cast to txin_to_key would reject any transaction containing a stake claim.

🔒 Security

• FFI buffer zeroization before free. shekyl_buffer_free now wipes buffer contents prior to deallocation, reducing secret-key residue risk in allocator-managed memory.

• Wallet KEM key management fix. generate_pqc_key_material() now generates HybridX25519MlKem KEM keypairs via shekyl_kem_keypair_generate() instead of HybridEd25519MlDsa signing keypairs. The wallet-level PQC keys (m_pqc_public_key / m_pqc_secret_key) are encapsulation/decapsulation keys; per-output ML-DSA-65 signing keys are always derived from the KEM shared secret at spend time.

• Full hybrid ciphertext storage in tx_extra tag 0x06. All KEM encapsulation sites (coinbase, claim, regular transfers) now store the complete 1120-byte hybrid ciphertext (x25519_ephemeral_pk[32] || ml_kem_ct[1088]) instead of only the ML-KEM portion. This enables correct hybrid decapsulation during wallet scanning and seed restore.

✨ Added

• FCMP++ wallet transaction construction (Phase 5). transfer_selected_rct now builds transactions using full-chain membership proofs instead of ring signatures:

  • Inputs contain only the real output (no decoy selection).
  • genRctFcmpPlusPlus generates the combined Bulletproofs+ and FCMP++ membership proof.
  • Per-input PQC auth signatures use ML-DSA-65 keypairs derived from the KEM shared secret and output index.
  • construct_tx_with_tx_key adds KEM encapsulation (tag 0x06) and H(pqc_pk) leaf hashes (tag 0x07) for each output, and skips wallet-level PQC signing.

• KEM decapsulation during wallet scanning. process_new_transaction now extracts hybrid KEM ciphertexts from tx_extra tag 0x06, calls shekyl_kem_decapsulate with the wallet's KEM secret keys, and stores the resulting 64-byte combined shared secret in transfer_details::m_combined_shared_secret. This enables per-output PQC key derivation at spend time.

• FCMP++ fee estimation. estimate_rct_tx_size now accounts for the FCMP++ membership proof size (shekyl_fcmp_proof_len), per-input PQC auth envelopes (~5400 bytes each), and per-output KEM ciphertexts and leaf hashes.

• GUI wallet QR code. Receive page now renders a real QR code encoding the full FCMP++ Bech32m address via qrcode.react.

• GUI wallet fee preview. Send page shows an estimated transaction fee before submission, debounced as the user types.

🗑️ Removed

• CLSAG device interface methods. Removed clsag_prepare, clsag_hash, and clsag_sign virtual methods from device.hpp and all implementations (device_default.cpp, device_ledger.cpp). Shekyl never supported CLSAG; the device interface now only exposes FCMP++ methods.

• get_outs / get_outs.bin RPC endpoints. Removed the ring member fetching endpoints from the C++ daemon (core_rpc_server), the FFI dispatch tables (core_rpc_ffi.cpp), and the Rust daemon RPC (shekyl-daemon-rpc). FCMP++ uses full-chain membership proofs; there is no decoy selection.

• Dead hard fork constants. Removed HF_VERSION_MIN_MIXIN_4/6/10/15, HF_VERSION_SAME_MIXIN, HF_VERSION_ENFORCE_MIN_AGE, HF_VERSION_EFFECTIVE_SHORT_TERM_MEDIAN_IN_PENALTY, HF_VERSION_REJECT_SIGS_IN_COINBASE, HF_VERSION_ENFORCE_RCT, HF_VERSION_DETERMINISTIC_UNLOCK_TIME from cryptonote_config.h. These were defined but never referenced in production code. HF_VERSION_CLSAG and HF_VERSION_MIN_V2_COINBASE_TX are retained for test compilation until Phase 7 rewrites the legacy tests.

✨ Added

• Zstd compression for Levin P2P relay (Phase 6e). P2P payloads above 256 bytes are transparently compressed with zstd (level 1) before relay. A new LEVIN_PACKET_COMPRESSED flag (0x10) in the Levin header marks compressed frames. Peers negotiate compression via P2P_SUPPORT_FLAG_ZSTD_COMPRESSION (0x02) in the handshake support flags. Reduces relay bandwidth by ~10-20% for FCMP++ transactions, especially important for Tor/I2P connections. Compression is optional at compile time (requires libzstd); decompression always succeeds if the flag is set.

📚 Documentation

• Updated DAEMON_RPC_RUST.md. Fixed stale references to get_outs.bin and get_curve_tree_root; corrected endpoint counts and cutover test steps.

🐛 Fixed

• rct::key missing operator!=. Added operator!= to the key struct in rctTypes.h. The operator was present for cross-type comparisons (rct::key vs crypto::public_key) but not for rct::key vs rct::key, causing compilation failures on all platforms when comparing pseudo-outs to expected zero-commitments in the stake claim verification path.

• MSVC binary_archive constructor mismatch. Fixed wallet2.cpp to use epee::strspan<std::uint8_t> instead of std::istringstream for constructing binary_archive<false>, which MSVC could not resolve.

• Memory leak on exception in PQC auth signing. Added RAII scope guard for ShekylPqcKeypair buffers in transfer_selected_rct Phase C, ensuring Rust-allocated key material is freed even if THROW_WALLET_EXCEPTION_IF throws mid-loop.

• Secret key material not wiped on KEM decapsulation failure. The stack buffer in process_new_transaction KEM decapsulation is now wiped unconditionally (success or failure), preventing partial key material from lingering on the stack.

• Shadowed tx_extra_fields variable in KEM decapsulation. Removed redundant inner tx_extra_fields reference that shadowed the outer one in process_new_transaction, using the already-resolved outer reference instead.

🔄 Changed

• Decoy selection functions are dead code. get_outs, tx_add_fake_output, and light_wallet_get_outs in wallet2.cpp are no longer called from the active transfer path. They remain in the codebase for reference and will be removed in a follow-up cleanup.

• Claim transaction indistinguishability (Phase 4 — CRITICAL). Rewrote wallet2::create_claim_transaction() to produce privacy-preserving claim transactions that blend into the anonymity set:

  • Uses RCTTypeFcmpPlusPlusPqc with Bulletproofs+ range proofs instead of RCTTypeNull with plaintext amounts.
  • Adds a dummy change output (amount = 0) to match the standard 2-output transaction structure, preventing structural fingerprinting.
  • Performs hybrid KEM derivation (X25519 + ML-KEM-768) via shekyl_fcmp_derive_pqc_keypair() for per-output PQC keys instead of reusing the wallet master PQC key.
  • Embeds ML-KEM ciphertexts in tx_extra under tag 0x06 and H(pqc_pk) leaf hashes under new tag 0x07.
  • Signs with per-output KEM-derived PQC keys, not the wallet-level key.
  • Sets deterministic pseudo-outs (zeroCommit(claim_amount)) for each stake claim input to satisfy the Bulletproofs+ balance check.

• Consensus rejects RCTTypeNull for non-coinbase v3 transactions. check_tx_inputs now enforces that only coinbase (txin_gen) may use RCTTypeNull. All other v3 transactions (including stake claims) must use RCTTypeFcmpPlusPlusPqc with confidential amounts. Claim transactions are validated within the FCMP++ handler with their own sub-path that verifies pseudo-out determinism, PQC ownership, and pool balance while skipping the membership proof (which is not applicable to txin_stake_claim inputs).

✨ Added

• TX_EXTRA_TAG_PQC_LEAF_HASHES (0x07). New tx_extra field (tx_extra_pqc_leaf_hashes) stores per-output H(pqc_pk) values — the 32-byte Blake2b-512 hashes of each output's derived ML-DSA-65 public key. Used by curve tree insertion to commit the correct PQC ownership hash to each leaf instead of a zero placeholder.

• Curve tree leaves use actual H(pqc_pk) from tx_extra. The collect_outputs / make_leaf path in blockchain_db.cpp now extracts H(pqc_pk) values from the 0x07 tag, replacing the zero placeholder that was previously committed to the 4th leaf scalar. This enables the PQC ownership cross-check for stake claim verification.

• Coinbase transactions emit H(pqc_pk) leaf hashes. construct_miner_tx now derives per-output PQC keypairs via KEM shared secrets and includes their H(pqc_pk) values in the 0x07 tx_extra field alongside the existing KEM ciphertexts in 0x06.

🔒 Security

• Integer-only stake reward computation. Replaced floating-point arithmetic ((double)total_reward * weight / total_weighted_stake) with 128-bit integer math (mul128/div128_64) in check_stake_claim_input to eliminate rounding errors that could cause determinism mismatches across platforms.

• Batch pool balance validation for stake claims. Moved the staker pool balance check from per-claim (check_stake_claim_input) to a batch check in check_tx_inputs that sums all claim amounts first. Prevents multiple claims in the same block from independently passing the balance check and overdrawing the pool.

• PQC ownership cross-check on stake claims. Each txin_stake_claim now verifies that the H(pqc_pk) stored in the curve tree leaf (bytes 96–128) matches shekyl_fcmp_pqc_leaf_hash(pqc_auths[i].hybrid_public_key), preventing reward claims for outputs the claimer does not own the PQC key for.

🐛 Fixed

• Stake claim key image cleanup on reorg. remove_transaction in blockchain_db.cpp now handles txin_stake_claim key images in addition to txin_to_key, preventing stale key images from persisting after block pops.

🔄 Changed

• Sorted input enforcement extended to stake claims. The sorted-inputs check in check_tx_inputs now covers both txin_to_key and txin_stake_claim key images, ensuring consistent ordering rules across all input types.

• Third-party headers treated as SYSTEM includes. external/, external/rapidjson, external/easylogging++, and external/supercop are now -isystem in CMake, suppressing -Wsuggest-override and other warnings from third-party code while keeping strict warnings for first-party code.

🗑️ Removed

• Dead check_ring_signature function. Removed unused ring signature verification from blockchain.cpp and its declaration from blockchain.h. Shekyl uses FCMP++ from genesis; ring signatures are never validated.

• Dead expand_transaction_2 function. Removed the no-op transaction expansion function from blockchain.cpp and its declaration from blockchain.h. FCMP++ does not use mixRing expansion.

• Dropped serde_json dev-dependency from shekyl-fcmp. Replaced the JSON round-trip test with a byte-level serialization check, reducing the dev-dep surface.

📚 Documentation

• Synced docs/FCMP_PLUS_PLUS.md curve-tree text with consensus: outputs are indexed at creation; maturity is enforced via referenceBlock and other rules, not by delaying leaf insertion.
• Clarified docs/POST_QUANTUM_CRYPTOGRAPHY.md to use pqc_auths (per-input) terminology consistently.
• Documented mempool FCMP verification-cache id: compute_fcmp_verification_hash binds proof + referenceBlock + key images (comment in blockchain.cpp).
• Noted the monero-oxide commit pin in rust/shekyl-fcmp/Cargo.toml comments (lockfile remains authoritative).
• Updated docs/STAKER_REWARD_DISBURSEMENT.md with integer arithmetic, batch pool check, PQC cross-check, and sorted input consensus rules.

✨ Added

• Block-inclusion FCMP++ cache fast path. When a transaction was previously verified in the mempool and arrives in a block, check_tx_inputs skips the expensive shekyl_fcmp_verify FFI call (~35ms/input) while still running all structural checks (referenceBlock, depth, key images, PQC auth).

• construct_leaf now accepts PQC key hash parameter. The Rust FFI function shekyl_construct_curve_tree_leaf takes a 4th h_pqc_ptr argument (32 bytes) to set the 4th leaf scalar. Callers pass zero bytes until per-output PQC commitments are wired in Phase 3.

• Deferred staked leaf insertion infrastructure. Added pending_staked_leaves (LMDB DUPSORT/DUPFIXED table keyed by lock_until_height with 128-byte leaf values) and pending_staked_drain (block_height → drain count) tables to the blockchain database layer. Five new methods on BlockchainDB: add_pending_staked_leaf, drain_pending_staked_leaves, set_pending_staked_drain_count, get_pending_staked_drain_count, and remove_pending_staked_drain_count. This enables staked outputs whose effective_lock_until > block_height to be parked in a pending table and batch-inserted into the curve tree when they mature.

• Comprehensive FCMP++ test suite and fuzz targets (Phase 7). Added 6 cargo-fuzz targets across rust/shekyl-fcmp/fuzz/ (proof deserialization, curve tree leaf hashing, block header tree root mismatch) and rust/shekyl-crypto-pq/fuzz/ (Bech32m address decoding, KEM decapsulation with corrupted ciphertexts). Extended Rust unit tests in proof.rs, tree.rs, leaf.rs, kem.rs, address.rs, and derivation.rs covering prove/verify round-trips, hash grow/trim inverse properties, boundary values, and cross-crate consistency. Extended C++ unit tests in tests/unit_tests/fcmp.cpp with RCTTypeFcmpPlusPlusPqc serialization round-trip, key image y-normalization, referenceBlock staleness constants, and empty proof rejection. Added PQC rederivation criterion benchmark (rust/shekyl-crypto-pq/benches/pqc_rederivation.rs) targeting < 100ms per output for the full ML-KEM-768 decapsulation + HKDF-SHA-512 + ML-DSA-65 keygen pipeline.

• Stressnet tooling for FCMP++ pre-audit gate (Phase 7.7). Added tests/stressnet/ with configuration, load generator, and monitoring scripts for a 4-week sustained-load testnet. The stressnet exercises curve tree growth, verification caching, wallet restore correctness, pruned vs. full node storage, staking lifecycle, and block validation latency under near-block-weight-limit load. Includes config.yaml with load profiles, load_generator.py for synthetic transaction submission, and monitor.py for real-time metric collection, consensus checking, and daily report generation.

• Security audit scope document (Phase 9). Added docs/AUDIT_SCOPE.md defining the scope for a third-party security review of the 4-scalar leaf circuit modification. Covers soundness, zero-knowledge, and completeness verification for the H(pqc_pk) extension, Shekyl fork modifications to monero-fcmp-plus-plus, PQC commitment binding, and the FFI verification boundary. Includes materials list, auditor guidance questions, success criteria, and timeline.

• Mainnet gate: stressnet and audit prerequisites in release checklist. Updated docs/RELEASE_CHECKLIST.md with "Stressnet stable for 4 consecutive weeks" and "4-scalar leaf circuit audit completed" as hard prerequisites for mainnet launch.

🔄 Changed

• Renamed src/ringct/ to src/fcmp/ for naming consistency. Shekyl does not use ring signatures; the directory now reflects the actual FCMP++ confidential transaction system. CMake targets renamed from ringct/ringct_basic to fcmp/fcmp_basic. All #include "ringct/..." paths updated across 44 source and test files. Log categories, user-facing strings ("RingCT" → "FCMP"), JSON keys, and documentation updated. The rct:: namespace is preserved for now as a separate future rename.

• Unified coinbase transaction version to v3. construct_miner_tx and build_genesis_coinbase_from_destinations now emit tx.version = 3, matching regular FCMP++ transactions. All miner_tx && tx.version == 2 checks have been widened to >= 2 across blockchain_db, blockchain, wallet2, and test infrastructure. The pqc_auths serialization gate (!txin_gen) already excluded coinbase, so v3 coinbase serializes identically to v2 minus the version byte.

🐛 Fixed

• Fixed wallet API compilation errors after ring-signature removal. wallet/api/wallet.cpp still referenced the undefined fake_outs_count variable and called estimate_fee with the old 12-argument signature. Replaced fake_outs_count with 0 (FCMP++ has no decoys) and updated estimateTransactionFee to use the simplified 8-argument estimate_fee signature with hardcoded use_per_byte_fee=true, use_rct=true, use_view_tags=true.

• Fixed CI build failure from removed legacy RCT types in test files. Stripped all references to removed rct::Bulletproof, rct::RCTConfig, rct::RangeProofType, rct::RCTTypeBulletproofPlus, rct::clsag, rct::proveRctCLSAGSimple/verRctCLSAGSimple, and rct::genRctSimple from: chaingen.h/.cpp, bulletproof_plus.cpp/.h, chain_switch_1.cpp, wallet_tools.h/.cpp, bulletproofs.cpp (unit), ringct.cpp (unit), serialization.cpp (unit), ver_rct_non_semantics_simple_cached.cpp, json_serialization.cpp, fuzz/bulletproof.cpp, and all performance test headers. Removed legacy-only test cases; updated shared test helpers to drop RangeProofType/bp_version parameters.

🗑️ Removed

• Dead verification cache code (verRctNonSemanticsSimple, ver_rct_non_semantics_simple_cached). Removed the stub verRctNonSemanticsSimple from rctSigs.cpp/.h (returned true unconditionally), the ver_rct_non_semantics_simple_cached wrapper and its ver_rct_non_sem helper from tx_verification_utils.cpp/.h, the unused rct_ver_cache_t type alias and m_rct_ver_cache member from Blockchain, and the dead RCT_CACHE_TYPE constant from check_tx_inputs. Real FCMP++ verification lives in check_tx_inputs (blockchain.cpp) and the mempool uses compute_fcmp_verification_hash for caching.

🔒 Security

• CRITICAL: PQC signed payload now binds to prunable FCMP++ data (Phase 4c). get_transaction_signed_payload now includes H(serialize(RctSigPrunable)) in the signed payload, binding PQC signatures to the FCMP++ proof, pseudoOuts, curve_trees_tree_depth, and Bulletproofs+. Without this, an attacker could substitute different prunable data without invalidating PQC signatures, breaking the dual-layer security model.

• CRITICAL: Wired stake claim validation in check_tx_inputs (Phase 4e audit fix). The non-FAKECHAIN gate in check_tx_inputs rejected all RCTTypeNull transactions, which includes pure stake-claim txs. The gate now allows RCTTypeNull transactions through when all inputs are txin_stake_claim. Additionally, the RCTTypeNull switch case now calls check_stake_claim_input for each claim input and checks key image double-spend — previously it breaked without any validation.

• HIGH: Bound all inputs' H(pqc_pk) hashes into PQC signed payload. get_transaction_signed_payload now appends H(pqc_pk_0) || ... || H(pqc_pk_{N-1}) after the per-input header blob, preventing key-substitution attacks where an attacker replaces one input's PQC key without invalidating other signatures.

• MEDIUM: Stake claim curve tree leaf verification (Phase 4e). check_stake_claim_input now verifies the staked output's leaf is present in the curve tree by checking staked_output_index < get_curve_tree_leaf_count() and reading the leaf with get_curve_tree_leaf(). Previously, only the lock period check was performed, which didn't guarantee the leaf had been inserted into the tree.

• MEDIUM: PQC auth_version and flags consensus enforcement. verify_transaction_pqc_auth now rejects auth_version != 1 and flags != 0, enforcing spec steps 6a/6c. Previously these fields were serialized and signed over but never validated.

• LOW: Single-signer hybrid_public_key size enforcement. verify_transaction_pqc_auth now verifies single-signer key blobs are exactly HYBRID_SINGLE_KEY_LEN (1996 bytes). Previously only multisig keys had size bounds checks; single-signer keys relied solely on the FFI call to reject malformed keys.

• LOW: Added deserialization size bounds for pqc_authentication blobs. hybrid_public_key and hybrid_signature vectors are now rejected during deserialization if they exceed PQC_MAX_PUBLIC_KEY_BLOB or PQC_MAX_SIGNATURE_BLOB, preventing memory-exhaustion attacks via oversized PQC fields.

🐛 Fixed

• HIGH: Fixed pop_block() off-by-one for staked-output curve tree removal. The height used for staked-output eligibility checking was captured after remove_block(), using the post-pop height instead of the removed block's height. This caused a mismatch with add_block()'s logic: outputs added at the exact lock boundary were inserted during add but not removed during pop, leaving orphaned leaves in the curve tree.

• HIGH: Fixed pseudoOuts serialization mismatch in generic rctSigBase. The generic BEGIN_SERIALIZE_OBJECT() path in rctSigBase unconditionally included pseudoOuts, even for RCTTypeFcmpPlusPlusPqc where pseudo-outs live in the prunable section. Now gated with if (type != RCTTypeFcmpPlusPlusPqc) to match the custom serializer.

• MEDIUM: get_curve_tree_path RPC now fails on missing layer hashes. Previously, a failed get_curve_tree_layer_hash() silently inserted zeros into the proof path, potentially generating invalid proofs from inconsistent DB state. Now returns CORE_RPC_ERROR_CODE_INTERNAL_ERROR.

• CRITICAL: Fixed incorrect existing_child in internal layer hash propagation (grow_curve_tree). When updating an existing child chunk's hash, the parent's Pedersen commitment was computed with existing_child = 0 instead of the previous cycle-scalar. This produced wrong chunk hashes for any block that updated (rather than created) a child chunk. The fix tracks both old and new hashes through updated_chunk_t and passes the previous cycle-scalar to hash_grow.

• CRITICAL: Replaced O(N) trim_curve_tree with incremental hash_trim. Reorgs previously read all remaining leaves, cleared the tree, and rebuilt from scratch — a liveness risk at scale. The new implementation uses hash_trim_selene/hash_trim_helios FFI to surgically update only the affected chunks, then propagates the old→new deltas up through internal layers. Complexity is now O(removed × log N).

• CRITICAL: Enforced output maturity via FCMP_REFERENCE_BLOCK_MIN_AGE. Outputs enter the curve tree at creation time (maximising the anonymity set). Maturity is enforced at spending time by requiring the reference block to be at least CRYPTONOTE_MINED_MONEY_UNLOCK_WINDOW (60) blocks behind the tip. Added static_asserts in cryptonote_config.h to prevent regression.

• HIGH: Validated meta reads in save_curve_tree_checkpoint. The function now checks that root, depth, and leaf_count were all successfully read from meta before storing a checkpoint. If any value is missing or leaf_count is 0, the checkpoint is skipped with a log warning instead of storing a corrupt zero-valued checkpoint.

🔄 Changed

• Consensus: curve_trees_tree_depth validation now accepts <= current. The referenceBlock's tree may have fewer layers than the current tip (depth is monotonically non-decreasing). The strict != check was replaced with a range check (0, current_depth], and the FCMP++ proof verifier provides the authoritative depth validation.

• Consensus: Removed ring-based validation path from check_tx_inputs. Shekyl starts at genesis with FCMP++; the legacy ring-signature per-input validation is unreachable dead code. The else branch now immediately rejects non-FCMP++ transactions with a clear error message.

• Coinbase KEM: Added warning when miner address lacks PQC public key. If a miner's address has no PQC key at the FCMP++ hard fork, a warning is logged noting that the output will have H(pqc_pk) = 0 in the curve tree — a distinguishable pattern.

• RPC: Replaced hardcoded chunk widths with FFI calls. get_curve_tree_path now calls shekyl_curve_tree_selene_chunk_width() and shekyl_curve_tree_helios_chunk_width() instead of using static constants.

• RPC: Added reference_height and leaf_count to get_curve_tree_path response. Wallets can now verify response freshness and detect stale paths without parsing the reference block hash.

• RPC: Added MAX_OUTPUTS_PER_RPC_REQUEST (64) rate limit to get_curve_tree_path to prevent abuse from unbounded requests.

✨ Added

• RPC: get_curve_tree_info endpoint returns root hash, depth, leaf count, and chain height for the current curve tree state.

• RPC: get_curve_tree_checkpoint endpoint retrieves a stored checkpoint (root, depth, leaf_count) at a given block height, needed for fast-sync.

📚 Documentation

• Documented verRctNonSemanticsSimple stub status: the FCMP++ membership proof is verified in the main consensus path (check_tx_inputs), not in the verification-caching path. Added TODO for Phase 5 unification.
• Documented coinbase tx.version = 2 rationale — superseded: coinbase is now version 3, unified with regular transactions.
• Documented LMDB post-delete cursor contract (MDB_GET_CURRENT after mdb_cursor_del returns the next item) in pruning and GC loops.
• Added ct_layer_chunk_key bit-layout comment explaining the 8-bit layer / 56-bit chunk index encoding for LMDB integer keys.
• Documented construct_leaf zero 4th scalar (H(pqc_pk)) and the tree rebuild requirement when PQC per-output keys are activated.
• Documented depth tracking semantics (root layer index, not layer count) and root detection invariant in grow_curve_tree.
• Added TODO for async/batched checkpoint+pruning in add_block.
• Documented get_curve_tree_root empty-tree return semantics (returns hash_init, callers should check leaf_count).

🗑️ Removed

• Legacy RCT and mixin references stripped from wallet layer. Completed the wallet-side refactor removing all references to legacy ring sizes, adjust_mixin, default_mixin, m_default_mixin, RCTConfig, and mixin-count parameters:
  • wallet2.h: Removed estimate_fee mixin/bulletproof/clsag params, adjust_mixin(), default_mixin() getter/setter, m_default_mixin member, rct_config from pending_tx and transfer_selected_rct.
  • wallet2.cpp: Removed mixin from estimate_rct_tx_size, estimate_tx_size, estimate_tx_weight, estimate_fee signatures and all call sites. Removed adjust_mixin() definition, JSON serialization of default_mixin, constructor initialization. Removed const bool clsag/bulletproof/bulletproof_plus = true patterns.
  • wallet_errors.h: Removed mixin_count field from not_enough_outs_to_mix error struct.
  • wallet2_ffi.cpp: Replaced adjust_mixin calls with constant 0.
  • wallet_rpc_server.cpp: Replaced adjust_mixin calls with constant 0.
  • wallet2_api.h, wallet.h, wallet.cpp: Removed mixin_count parameter from createTransaction and createTransactionMultDest.
  • unsigned_transaction.cpp: Simplified mixin() and minMixinCount() to always return 0 (FCMP++ has no explicit mixin).
  • simplewallet.cpp: Removed ring-size parsing, adjust_mixin calls, and default_mixin display. All fake_outs_count set to 0.
• Legacy RCT references stripped from all src/ files. Removed all remaining references to CLSAG, legacy RCT types, RCTConfig, mixRing, and low_mixin from device drivers, Trezor protocol, RPC handlers, blockchain verification, transaction utilities, wallet, and serialization:
  • device_ledger.cpp: Removed INS_CLSAG define, legacy type branches in mlsag_prehash, replaced clsag_prepare/clsag_hash/clsag_sign with FCMP++ TODO stubs.
  • protocol.cpp/protocol.hpp (Trezor): Removed rct::Bulletproof variant, is_simple()/is_req_bulletproof()/is_bulletproof()/ is_clsag() helpers, mixRing resize, CLSAG deserialization in step_final_ack. Added is_fcmp_pp() helper.
  • core_rpc_server.cpp/core_rpc_server_commands_defs.h: Removed low_mixin field and its assignment from send_raw_tx response.
  • daemon_handler.cpp: Removed m_low_mixin error branch.
  • verification_context.h: Removed m_low_mixin from tx_verification_context.
  • blockchain.cpp: Replaced legacy mixin-checking branch with a reject gate for non-FCMP++ transactions (Shekyl only supports FCMP++).
  • cryptonote_tx_utils.h/.cpp: Removed rct::RCTConfig parameter from construct_tx_with_tx_key and construct_tx_and_get_tx_key. Replaced genRctSimple call with FCMP++ proof generation stub. Removed mixRing construction.
  • cryptonote_format_utils.cpp: Removed is_rct_bulletproof/ is_rct_clsag calls, simplified BP+ weight calculations.
  • cryptonote_boost_serialization.h: Removed serialization functions for rct::rangeSig, rct::Bulletproof, rct::mgSig, rct::clsag, rct::RCTConfig, rct::boroSig. Simplified rctSigBase and rctSigPrunable serialization to only handle FCMP++.
  • tx_verification_utils.h/.cpp: Removed mix_ring parameter from ver_rct_non_semantics_simple_cached. Removed expand_tx_and_ver_rct_non_sem, calc_tx_mixring_hash, and is_canonical_bulletproof_layout.
  • json_object.h/.cpp: Removed JSON serialization for rct::rangeSig, rct::Bulletproof, rct::boroSig, rct::mgSig, rct::clsag. Removed legacy prunable fields from rctSig JSON output.
  • wallet2.h: Removed rct_config field from tx_construction_data serialization and the version-gated RangeProofPaddedBulletproof defaults in Boost serialization.
  • wallet2.cpp: Fixed construct_tx_and_get_tx_key call site that still passed {} where the removed rct_config parameter was.
  • bulletproofs.h/.cc: Gutted non-plus Bulletproof PROVE/VERIFY functions — the rct::Bulletproof struct was already removed from rctTypes.h, making these 1000+ lines of dead code.
• Legacy RCT types stripped from core. Removed RCTTypeFull (1), RCTTypeSimple (2), RCTTypeBulletproof (3), RCTTypeBulletproof2 (4), RCTTypeCLSAG (5), and RCTTypeBulletproofPlus (6) from the enum. Only RCTTypeNull (0) and RCTTypeFcmpPlusPlusPqc (7) remain.
• Deleted structs: mgSig, clsag, rangeSig, Bulletproof (non-plus), RangeProofType enum, and RCTConfig.
• Removed mixRing member from rctSigBase and mixin parameter from serialize_rctsig_prunable.
• Removed from rctSigPrunable: rangeSigs, bulletproofs (non-plus), MGs, CLSAGs vectors and their serialization blocks.
• Removed functions: CLSAG_Gen, proveRctCLSAGSimple, verRctCLSAGSimple, genRctSimple (both overloads), populateFromBlockchainSimple, getKeyFromBlockchain, is_rct_simple, is_rct_bulletproof, is_rct_borromean, is_rct_clsag, proveRangeBulletproof, verBulletproof, make_dummy_bulletproof, make_dummy_clsag.
• Removed HASH_KEY_CLSAG_ROUND, HASH_KEY_CLSAG_AGG_0, HASH_KEY_CLSAG_AGG_1, and HASH_KEY_TXHASH_AND_MIXRING from cryptonote_config.h.
• Removed VARIANT_TAG entries for mgSig, rangeSig, Bulletproof, and clsag.
• Simplified get_pre_mlsag_hash to only handle RCTTypeFcmpPlusPlusPqc.
• Simplified verRctSemanticsSimple and verRctNonSemanticsSimple to only accept FCMP++ transactions (no CLSAG/ring verification path).

🔄 Changed

• FCMP++ Phase 3: Per-input PQC authorization vector. Replaced std::optional<pqc_authentication> pqc_auth with std::vector<pqc_authentication> pqc_auths on cryptonote::transaction (one pqc_authentication per input). Updated binary, Boost, and JSON serialization, transaction hash (cn_fast_hash of serialized pqc_auths), per-input PQC verification, and wallet/RPC signing paths.

✨ Added

• FCMP++ (Full-Chain Membership Proofs): complete implementation across Phases 1–6. Shekyl replaces ring signatures (CLSAG) with FCMP++ from genesis. Every spend proves membership in the entire UTXO set via a Helios/Selene curve tree, giving every transaction full-chain anonymity instead of 16-decoy ring ambiguity. Combined with hybrid post-quantum spend authorization (Ed25519 + ML-DSA-65), this makes Shekyl the first cryptocurrency to offer full-UTXO-set anonymity with quantum-resistant ownership.

  Key components delivered:

  • Rust foundation (Phase 1): shekyl-fcmp crate wrapping upstream monero-fcmp-plus-plus with 4-scalar leaf type {O.x, I.x, C.x, H(pqc_pk)}. Hybrid X25519 + ML-KEM-768 KEM with HKDF-SHA-512. Bech32m segmented address encoding. Per-output PQC key derivation. 15 FFI exports. Security audit (zero vulnerabilities, zero unsafe in first-party code). Reproducible builds with pinned Cargo.lock.
  • Transaction format (Phase 3): RCTTypeFcmpPlusPlusPqc = 7 with referenceBlock, curve_trees_tree_depth, and fcmp_pp_proof fields. curve_tree_root commitment in every block header.
  • Consensus verification (Phase 4): 7-step verification order in check_tx_inputs — referenceBlock age, tree depth, key image y-normalization, FCMP++ proof via Rust FFI, PQC signature verification, BP+ range proofs. Mempool verification caching (fcmp_verification_hash in txpool_tx_meta_t). Staked output curve-tree leaves.
  • Curve tree database (Phase 2): Full get_curve_tree_path RPC implementation assembling real Merkle paths (leaf scalars + per-layer sibling hashes with position encoding). Selective pruning of intermediate tree layers between checkpoints, wired into add_block after save_curve_tree_checkpoint. Old checkpoint garbage collection.
  • Wallet integration (Phase 5): genRctFcmpPlusPlus() proof construction. get_curve_tree_path RPC. Tree-path precomputation and incremental update in wallet refresh loop. PQC key rederivation from stored shared secret. Restore-from-seed PQC rederivation.
  • Infrastructure (Phase 6): Hardware device FCMP++ stubs. CI pipeline for Rust workspace build, FCMP crate, determinism check, Bech32m tests. output_pruning_metadata_t and m_output_metadata LMDB table for transaction pruning. LMDB curve tree schema (leaves, layers, meta, checkpoints). Checkpoint every 10,000 blocks for fast-sync resumption.

  See docs/FCMP_PLUS_PLUS.md for the full specification.

• FCMP++ Phase 3: KEM ciphertext tx_extra and coinbase self-encapsulation.

  • tx_extra_pqc_kem_ciphertext with tag TX_EXTRA_TAG_PQC_KEM_CIPHERTEXT (0x06): payload blob is the concatenation of N ML-KEM-768 ciphertexts (1088 bytes each), one per output in order.
  • Coinbase: When the miner address has a PQC key and the hard-fork version is at least HF_VERSION_FCMP_PLUS_PLUS_PQC, construct_miner_tx performs KEM self-encapsulation to the miner’s own address per coinbase output (same tag and derivation semantics as normal transfers), then wipes the shared secret after use.

• FCMP++ Phase 5e: Wallet precomputation of curve tree paths.

  • Added fcmp_precomputed_path struct to wallet2.h caching per-output tree path, root hash at precompute time, and precompute height.
  • Added m_fcmp_precomputed_paths runtime cache (not serialized) and m_fcmp_last_precompute_height watermark to wallet2.
  • precompute_fcmp_paths() fetches tree paths for all unspent outputs via the get_curve_tree_path daemon RPC endpoint.
  • update_fcmp_paths_incremental(new_height) extends existing paths and adds newly discovered outputs, pruning paths for spent outputs.
  • Incremental path update is hooked into the wallet refresh loop, triggering after sync catches up if blocks were fetched.
  • Progress callbacks (on_fcmp_path_precompute_progress) fire during both initial and incremental precomputation.

• FCMP++ Phase 5.5: Wallet sync and restore-from-seed PQC support.

  • transfer_details::m_combined_shared_secret (64 bytes) stores the hybrid KEM shared secret needed to rederive per-output PQC keys.
  • rederive_pqc_keys_for_output(td) calls shekyl_fcmp_derive_pqc_keypair via FFI to validate keypair derivation from stored shared secret.
  • rederive_all_pqc_keys() iterates all transfers with stored shared secrets and rederives PQC keys, with progress callback on_pqc_rederivation_progress.
  • Restore-from-seed triggers full PQC key rederivation on first refresh after sync completes.

🐛 Fixed

• Curve tree pop_block over-trim: pop_block previously counted all tx.vout entries when computing how many leaves to trim, but add_block skips outputs that fail type checks (unknown target types), locked staked outputs, and outputs whose FFI leaf construction fails. The trim count now mirrors the same filtering logic used in the grow path, preventing tree desynchronization during reorgs.

• Curve tree pruning correctness: prune_curve_tree_intermediate_layers was deleting all intermediate layer entries instead of selectively pruning only chunks fully below the previous checkpoint boundary. Fixed to compute the chunk boundary from the previous checkpoint's leaf_count and only remove sealed entries. Also added garbage collection of stale checkpoint records (only the two most recent are kept).

• LMDB output metadata: removed undefined behavior in cursor macros.

  • store_output_metadata now uses mdb_put directly with m_write_txn instead of the CURSOR() macro which required m_cursors to be in scope.
  • get_output_metadata and prune_tx_data now use m_txn (from TXN_PREFIX_RDONLY) instead of txn_ptr (from TXN_PREFIX).
  • Removed unused m_txc_output_metadata cursor field and m_cur_output_metadata macro from db_lmdb.h.

• Wallet FCMP++ path precomputation: fixed undefined behavior.

  • Replaced reinterpret_cast<std::string&> on std::vector<uint8_t> with a proper intermediate std::string copy in both precompute_fcmp_paths and update_fcmp_paths_incremental.

• FCMP++ Phase 6c: CI pipeline updates.

  • Added x86_64 architecture verification step to the rust-audit-and-test CI job in .github/workflows/build.yml.
  • Added explicit cargo build --locked -p shekyl-fcmp step to verify the FCMP++ crate builds as part of the Rust workspace.
  • Added dedicated Bech32m address encoding test step that runs shekyl-crypto-pq address tests with visible CI output.
  • The monero-oxide git dependency is cached via ~/.cargo/git in the existing Cargo cache key (rust-${{ hashFiles('rust/Cargo.lock') }}).
  • Determinism check (build twice, diff libshekyl_ffi.a hashes) and cargo audit remain in place.

• FCMP++ Phase 6f: Transaction pruning mode (skeleton).

  • Added output_pruning_metadata_t packed struct to blockchain_db.h storing per-output scan data (pubkey, commitment, unlock_time, height, pruned flag) for wallet scanning after transaction pruning.
  • Added abstract interface in BlockchainDB: store_output_metadata(), get_output_metadata(), is_output_pruned(), prune_tx_data().
  • Added m_output_metadata LMDB table (keyed by global_output_index) in db_lmdb.h and db_lmdb.cpp with cursor, rflag, and DBI member.
  • LMDB implementation: store_output_metadata and get_output_metadata are fully wired; is_output_pruned delegates to get_output_metadata; prune_tx_data validates depth against CRYPTONOTE_DEFAULT_TX_SPENDABLE_AGE and reads/writes a last_pruned_tx_data_height watermark in the properties table to skip already-processed blocks on subsequent runs. The block-iteration pruning loop is documented as a TODO skeleton.
  • --prune-blockchain CLI flag now also triggers prune_tx_data() in cryptonote_core.cpp, running output-metadata pruning alongside Monero's existing stripe-based pruning.
  • Test DB (testdb.h) updated with no-op stubs for all four new methods.

• FCMP++ Phase 4b: Mempool verification caching.

  • Added fcmp_verification_hash (32-byte crypto::hash) and fcmp_verified (1-bit flag) to txpool_tx_meta_t in src/blockchain_db/blockchain_db.h, carved from the existing 76-byte padding (now 44 bytes). Struct stays 192 bytes.
  • New Blockchain::compute_fcmp_verification_hash() computes a deterministic cache key from hash(proof || referenceBlock || key_images).
  • tx_memory_pool::add_tx stores the cache hash on successful FCMP++ verification.
  • tx_memory_pool::is_transaction_ready_to_go checks the cached hash via is_fcmp_verification_cached() and seeds m_input_cache to skip re-running shekyl_fcmp_verify() for previously-verified mempool transactions.
  • Added static_assert guards at the memcmp site on txpool_tx_meta_t (tx_pool.cpp line 1656) enforcing trivially-copyable layout and 192-byte struct size.
  • All padding and new fields are zero-initialized at every meta construction site.

• FCMP++ Phase 4e: Staking consensus rules for FCMP++.

  • collect_outputs in blockchain_db.cpp::add_block now handles txout_to_staked_key outputs using the same 4-scalar leaf format {O.x, I.x, C.x, H(pqc_pk)}.
  • Deferred insertion: staked outputs only enter the curve tree when block_height >= effective_lock_until. Outputs still within their lock period are stored in the pending_staked_leaves DB table and inserted into the curve tree when they mature (see deferred staked leaf insertion entry below).
  • check_stake_claim_input validates claims against the staked output's effective_lock_until (creation_height + tier_lock_blocks) and enforces to_height <= min(current_height, effective_lock_until).

• FCMP++ Phase 5: Wallet transaction construction skeleton.

  • Added rct::genRctFcmpPlusPlus() in src/fcmp/rctSigs.cpp — builds an FCMP++ rctSig with RCTTypeFcmpPlusPlusPqc, Bulletproofs+ range proofs, balanced pseudo-outputs, and invokes shekyl_fcmp_prove() via FFI to generate the membership proof.
  • Declared the new function in src/fcmp/rctSigs.h.
  • Added COMMAND_RPC_GET_CURVE_TREE_PATH RPC command in src/rpc/core_rpc_server_commands_defs.h — accepts output indices and returns Merkle paths from the curve tree (stub handler for now).
  • Wired get_curve_tree_path JSON-RPC endpoint in src/rpc/core_rpc_server.h and src/rpc/core_rpc_server.cpp.
  • Added TODO scaffolding in src/wallet/wallet2.cpp at the decoy selection (get_outs), transaction construction (construct_tx_and_get_tx_key), and fee estimation (estimate_tx_weight) sites, documenting how FCMP++ replaces ring signatures in the wallet transfer flow.

• FCMP++ Phase 6a: Hardware device stubs.

  • Added fcmp_prepare, fcmp_proof_start, and fcmp_proof_add_input virtual methods to hw::device (base class) with default return false implementations for unsupported devices.
  • Software device (device_default) returns true (scaffolding for Rust FFI delegation).
  • Ledger device (device_ledger) logs an informative error and returns false, guiding users to software wallets until Ledger firmware gains FCMP++ support.
  • Trezor inherits the base-class defaults (unsupported) without code changes.
  • Updated RELEASE_CHECKLIST.md to document hardware wallet readiness status.

• FCMP++ Phase 4a: Verification in check_tx_inputs.

  • Added RCTTypeFcmpPlusPlusPqc verification path in Blockchain::check_tx_inputs (src/cryptonote_core/blockchain.cpp).
  • referenceBlock age validation: confirmed within [tip - MAX_AGE, tip - MIN_AGE] using DB block lookup.
  • curve_trees_tree_depth validated against the current tree state.
  • Key offsets verified empty for all FCMP++ inputs.
  • Key image y-normalization enforced (sign bit of byte 31 cleared).
  • Input count bounded by FCMP_MAX_INPUTS_PER_TX.
  • shekyl_fcmp_verify() FFI call wired up with key images, pseudo outputs, and proof blob.
  • Per-input pqc_auths verification left as documented TODO pending the per-input auth field migration.

• FCMP++ Phase 4a-pre: PQC auth binding specification.

  • New docs/FCMP_PLUS_PLUS.md formally documents the dual-layer binding model, per-input signed payload layout, and 7-step consensus verification order for RCTTypeFcmpPlusPlusPqc transactions.

• FCMP++ Phase 3.5: Curve tree root in block header (consensus-critical).

  • Added curve_tree_root (crypto::hash) field to block_header in src/cryptonote_basic/cryptonote_basic.h, initialized to null_hash.
  • Field is always serialized (genesis-native, no version gating) in both the binary archive (BEGIN_SERIALIZE) and Boost serialization.
  • Block template creation (Blockchain::create_block_template) snapshots the current DB curve tree root into the header.
  • Block validation (Blockchain::handle_block_to_main_chain) verifies curve_tree_root matches the locally-computed tree root after add_block grows the tree; rejects the block on mismatch.
  • RPC block_header_response now includes curve_tree_root hex string.
  • Test generator (chaingen.cpp) sets curve_tree_root to null_hash in construct_block and construct_block_manually.

• FCMP++ Phase 3: Transaction format for FCMP++ PQC.

  • Added RCTTypeFcmpPlusPlusPqc = 7 to the RCT type enum in src/fcmp/rctTypes.h — Shekyl's only non-coinbase transaction type.
  • Added referenceBlock (block hash anchoring the curve tree snapshot) to rctSigBase, serialized only for the new type.
  • Added curve_trees_tree_depth and fcmp_pp_proof (opaque FCMP++ proof blob) to rctSigPrunable, replacing CLSAG ring signatures for the new type.
  • Added TX_EXTRA_TAG_PQC_KEM_CIPHERTEXT (0x06) to tx_extra.h for per-output ML-KEM-768 ciphertexts.
  • Added key_image_y_normalize() to crypto.h/crypto.cpp — clears the sign bit of a key image's y-coordinate as required by FCMP++.
  • Added is_rct_fcmp_pp_pqc() helper to rctTypes.h/rctTypes.cpp.
  • Updated serialization helpers (serialize_rctsig_base, serialize_rctsig_prunable) and type classifier functions (is_rct_simple, is_rct_bulletproof_plus) to handle the new type.

• FCMP++ Phase 2e: Curve tree checkpoint strategy.

  • New BlockchainDB virtual methods: save_curve_tree_checkpoint, get_curve_tree_checkpoint, get_latest_curve_tree_checkpoint_height, prune_curve_tree_intermediate_layers.
  • LMDB implementation with curve_tree_checkpoints table (MDB_INTEGERKEY), storing root[32] + depth[1] + leaf_count[8] per checkpoint.
  • Automatic checkpoint every FCMP_CURVE_TREE_CHECKPOINT_INTERVAL (10 000) blocks during add_block, enabling fast-sync resumption.
  • Configurable interval via cryptonote_config.h constant.

• FCMP++ Phase 2f: Curve tree pruning strategy.

  • prune_curve_tree_intermediate_layers removes recomputable internal hash layers between checkpoints, preserving leaves and the root layer to reduce storage overhead.

• FCMP++ Phase 1: Rust foundation crates.

  • New rust/shekyl-fcmp/ crate wrapping upstream monero-fcmp-plus-plus (from Shekyl-Foundation/monero-oxide fork, fcmp++ branch) with 4-scalar curve tree leaf type {O.x, I.x, C.x, H(pqc_pk)}.
  • Implemented HybridX25519MlKem (X25519 + ML-KEM-768 FIPS 203) in shekyl-crypto-pq/src/kem.rs with HKDF-SHA-512 shared-secret combination and master-seed key derivation.
  • Implemented Bech32m segmented address encoding (shekyl1<classical>/skpq1<pqc_a>/skpq21<pqc_b>) in shekyl-crypto-pq/src/address.rs, keeping each segment within Bech32m's proven checksum range.
  • Implemented per-output PQC keypair derivation (HKDF-Expand → ML-DSA-65 deterministic keygen) in shekyl-crypto-pq/src/derivation.rs.
  • Added 15 new FFI exports to shekyl-ffi for FCMP++ proofs, KEM operations, address encoding, and seed derivation.
  • Added FCMP++ consensus constants to cryptonote_config.h: HF_VERSION_FCMP_PLUS_PLUS_PQC, FCMP_REFERENCE_BLOCK_MAX_AGE (100), FCMP_REFERENCE_BLOCK_MIN_AGE (2), FCMP_MAX_INPUTS_PER_TX (8).
  • Updated BuildRust.cmake with --locked flag for reproducible builds.

• FCMP++ Phase 1a.1: Security review of forked monero-oxide crates.

  • cargo audit: 226 crate dependencies scanned, zero vulnerabilities found.
  • unsafe block audit: zero unsafe in first-party monero-oxide workspace code (helioselene, ec-divisors, generalized-bulletproofs, fcmps, monero-oxide). Only 4 unsafe blocks exist in helioselene benchmarks (_rdtsc() for cycle counting, not in library code). dalek-ff-group (crates.io dependency) also has zero unsafe blocks.
  • Veridise audit status: FCMPs circuit audited by Veridise (June 2025); Generalized Bulletproofs security proofs by Cypher Stack; Divisor proofs reviewed by both Veridise and Cypher Stack. Pinned commit 92af05e0 is post-audit. Helioselene and ec-divisors are not yet independently audited. Multi-phase integration audit (seraphis-migration/monero#294) is in planning.

• FCMP++ Phase 1a.2: Rust reproducible builds.

  • Cargo.lock pins all git dependencies to exact commit hash 92af05e0.
  • Double-build determinism verified: libshekyl_ffi.a hash identical across consecutive builds on x86_64.
  • Added CI job rust-audit-and-test to .github/workflows/build.yml with cargo audit, workspace tests, and determinism check (build twice, diff).
  • Documented x86_64-only build requirement and Guix integration status in docs/COMPILING_DEBUGGING_TESTING.md.

🔄 Changed

• P2P reorg functional test uses deadline-based polling. Replaced three fixed-sleep polling sites in test_p2p_reorg() (time.sleep(10) x2, loops = 100 counter) with 240 s deadline + 0.25 s interval polling, matching the pattern already used in test_p2p_tx_propagation(). Adapted from upstream Monero #9795.

✨ Added

• Extra compiler warnings and hardening flags. Added -Wredundant-decls, -Wdate-time, -Wimplicit-fallthrough, -Wunreachable-code (common); -Woverloaded-virtual, -Wsuggest-override (C++ only); -Wgnu, -Wshadow-field, -Wthread-safety, -Wloop-analysis, -Wconditional-uninitialized, -Wdocumentation, -Wself-assign (Clang); -Wduplicated-branches (GCC). Added security protections: -fno-extended-identifiers, -fstack-reuse=none, and ARM64 branch protection (-mbranch-protection=bti on macOS, standard elsewhere). Adapted from upstream Monero #9858.
• Linker dead-code stripping. Added -ffunction-sections -fdata-sections to compile flags and -Wl,--gc-sections (Linux) / -Wl,-dead_strip (macOS) to linker flags, enabling the linker to strip unreferenced functions and data. Inspired by upstream Monero #9898 author's findings (~14 MiB reduction in Docker images).

📚 Documentation

• Upstream Monero PR triage. Replaced the stale "To be done (and merged)" section in COMPILING_DEBUGGING_TESTING.md with a structured triage table covering applied PRs (#6937, #9762, #9795, #9858, #9898) and tracked-for- future-work PRs (#10157, #10084, #9801) with STRUCTURAL_TODO.md cross-refs.
• FCMP++ documentation rework (Phase 0.5a). Reworked all core documentation to reflect FCMP++ as the membership proof system from genesis. Replaced CLSAG and ring signature references with FCMP++ full-chain membership proof language. Updated PQC spec for per-input pqc_auths, per-output KEM derivation, Bech32m addresses, and curve tower architecture. Retired V4 lattice ring signature roadmap. Updated V3_ROLLOUT.md size estimates for ~23 KB typical transactions. Added FCMP++ items to RELEASE_CHECKLIST.md.

🐛 Fixed

• Re-enabled gen_block_reward core test with Shekyl economics. Rewrote check_block_rewards() in block_reward.cpp to verify miner outputs against Shekyl's four-component economics formula (release multiplier + emission split + fee burn) instead of legacy Monero fixed expectations. Updated construct_miner_tx_by_weight to pass explicit economics parameters. Fixed construct_block and construct_block_manually in chaingen.cpp to pass circulating_supply=already_generated_coins to construct_miner_tx, preventing parameter mismatch between test generator and validator. 80 core_tests now pass (was 79).

• MSVC C4334: 23 1 << n sites widened to 1ULL << n in consensus code. Fixed potential undefined behavior (signed 32-bit overflow if shift amount ever reaches 32) in cryptonote_format_utils.cpp (3), bulletproofs.cc (6), bulletproofs_plus.cc (6), rctTypes.cpp (5), rctSigs.cpp (2), and multiexp.cc (2).

• MSVC C4333 right-shift warning in UTF-8 helpers. Changed wint_t cp to uint32_t cp in src/common/util.cpp get_string_prefix_by_width(), and added an explicit static_cast<uint32_t> on the transform result in src/common/utf8.h utf8canonical(). On MSVC, wint_t is 16-bit unsigned short, so cp >> 18 shifted by more than the type's width.

• Remaining HF17 references corrected to HF1. Fixed stale Monero-era HF17 / HF_VERSION_SHEKYL_NG = 17 references in POST_QUANTUM_CRYPTOGRAPHY.md (scheme registry, rollout notes, V4 roadmap), PQC_MULTISIG.md (V3 heading, V4 scheme table, activation target), V3_ROLLOUT.md (title, consensus gate, node checklist), and STAKER_REWARD_DISBURSEMENT.md. Also corrected HF18 references to HF2 in multisig V4 rollout tables. The source code constant HF_VERSION_SHEKYL_NG was already correctly defined as 1 in cryptonote_config.h; only documentation was affected.

• CMake Boost detection on CMake 3.30+: The built-in FindBoost.cmake module was removed in CMake 3.30. Restructured Boost detection to try CONFIG mode first (finding BoostConfig.cmake installed by b2), falling back to MODULE on older CMake. Fixes contrib/depends builds on Ubuntu 24.04 runners with CMake ≥ 3.30.

🗑️ Removed

• Classical multisig wallet RPC commands. Removed all 9 Monero-inherited multisig RPC endpoints (is_multisig, prepare_multisig, make_multisig, export_multisig_info, import_multisig_info, finalize_multisig, exchange_multisig_keys, sign_multisig, submit_multisig) from the wallet RPC server. Removed multisig_txset fields from transfer and sweep response structs. Removed the CHECK_MULTISIG_ENABLED macro and multisig/multisig.h dependency. Classical secret-splitting multisig is replaced by PQC-only authorization (scheme_id = 2); see docs/PQC_MULTISIG.md.
• Classical multisig simplewallet CLI commands. Removed all multisig and MMS (Multisig Messaging System) commands from simplewallet: prepare_multisig, make_multisig, exchange_multisig_keys, export_multisig_info, import_multisig_info, sign_multisig, submit_multisig, export_raw_multisig_tx, and all mms subcommands. Removed --generate-from-multisig-keys and --restore-multisig-wallet CLI flags. Removed enable-multisig-experimental wallet setting. Removed wallet/message_store.h dependency. The transfer_main/called_by_mms indirection was collapsed into a single transfer method.
• Classical multisig test and device_trezor remnants. Removed stale multisig references from test infrastructure: m_multisig* wallet resets in wallet_tools.cpp, multisig_sigs.clear() in Trezor tests, multisig_txset assertion in cold_signing.py, and deleted tests/functional_tests/multisig.py. Removed multisig from the functional test default list. Cleaned up device_trezor protocol: removed translate_klrki, MoneroMultisigKLRki alias, m_multisig member, and multisig cout decryption in Signer::step_final_ack. Removed mms_error, no_connection_to_bitmessage, and bitmessage_api_error error classes from wallet_errors.h.
• Classical multisig wallet API layer. Removed all classical multisig code from the public wallet API: MultisigState struct, virtual multisig declarations (multisig, getMultisigInfo, makeMultisig, exchangeMultisigKeys, exportMultisigImages, importMultisigImages, hasMultisigPartialKeyImages, restoreMultisigTransaction, publicMultisigSignerKey, signMultisigParticipant, multisigSignData, signMultisigTx). Removed multisig helper functions and multisig threshold check from PendingTransaction commit path. Removed multisig guard from the background-sync validation macro.
• Classical multisig wallet core (wallet2.cpp). Removed all classical multisig code from the wallet core: #include "multisig/..." headers, MULTISIG_UNSIGNED_TX_PREFIX/MULTISIG_EXPORT_FILE_MAGIC/MULTISIG_SIGNATURE_MAGIC constants, m_multisig/m_multisig_threshold/m_multisig_rounds_passed/ m_enable_multisig/m_message_store/m_mms_file member initializations, num_priv_multisig_keys_post_setup, get_multisig_seed, multisig restore path in generate(), make_multisig, exchange_multisig_keys, get_multisig_first_kex_msg, multisig(), has_multisig_partial_key_images, frozen(multisig_tx_set), all save/parse/load/sign_multisig_tx overloads, the multisig transaction builder path in transfer_selected_rct, export_multisig, import_multisig, update_multisig_rescan_info, get_multisig_signer_public_key, get_multisig_signing_public_key, get_multisig_k, get_multisig_kLRki, get_multisig_composite_kLRki, get_multisig_composite_key_image, get_multisig_wallet_state, sign_multisig_participant, JSON serialization/deserialization of multisig fields, MMS file handling, and all scattered m_multisig guard branches.
• Classical multisig m_key_image_partial remnants. Removed the m_key_image_partial bitfield from exported_transfer_details and all code references in wallet2.cpp and simplewallet.cpp. Since classical multisig was removed, partial key images can never exist; all guard conditions (!known || partial, known && !partial, standalone partial checks) were simplified to reference only m_key_image_known. Removed the dead old_mms_file cleanup block from wallet2::store_to.

✨ Added

• Daemon RPC migrated to Rust/Axum (Phase 1). The daemon HTTP RPC transport is now served by the shekyl-daemon-rpc Rust crate using Axum, replacing epee::http_server_impl_base. All 90 endpoints (33 JSON REST, 9 binary, 48 JSON-RPC 2.0) are routed through Axum with PQC-ready 10 MiB body limits, CORS, and restricted-mode enforcement. The C++ core_rpc_server handler logic is unchanged and accessed via a core_rpc_ffi C ABI facade. Enabled by default; --no-rust-rpc falls back to the legacy epee HTTP server. JSON REST endpoints accept both GET and POST (matching epee). Binary endpoints return 400 on parse failure (matching epee's MAP_URI_AUTO_BIN2). Validated on live testnet: 23/25 pass, 2 expected diffs (rpc_connections_count), 2 binary skips (empty-POST → 400 on both). Validation harness at tests/rpc_comparison/compare_rpc.sh; test data in shekyl-dev/data/rpc_comparison/.
• PQC multisig core (scheme_id=2). Implemented M-of-N hybrid Ed25519 + ML-DSA-65 multisig in Rust. Includes MultisigKeyContainer, MultisigSigContainer, multisig_group_id, and a 10-check adversarial verification pipeline. Maximum 7 participants (consensus constant). Domain separator: shekyl-multisig-group-v1.
• PQC multisig FFI bridge. Extended shekyl_pqc_verify to accept scheme_id and dispatch between single-signer (1) and multisig (2) paths. Added shekyl_pqc_verify_debug for diagnostic error codes and shekyl_pqc_multisig_group_id for group identity computation.
• Scheme downgrade protection. New tx_extra_pqc_ownership tag (0x05) records the expected PQC scheme and group ID for each output, preventing attackers from spending multisig-protected outputs with single-signer transactions.
• Wallet multisig coordination. New wallet2 methods for PQC multisig: create_pqc_multisig_group, export_multisig_signing_request, sign_multisig_partial, import_multisig_signatures. File-based JSON signing protocol. Wallet serialization version bumped to 32.
• Cargo-fuzz harnesses. 4 fuzz targets for multisig deserialization and verification (fuzz_multisig_key_blob, fuzz_multisig_sig_blob, fuzz_multisig_verify, fuzz_group_id), each validated at 10M iterations with zero panics.
• PQC multisig subset-signing test. Added valid_subset_signing_3_of_5 test to shekyl-crypto-pq verifying that any valid 3-of-5 signer subset produces a valid multisig through the full 10-check verification pipeline.
• PQC multisig test vectors. Published docs/PQC_TEST_VECTOR_002_MULTISIG.json with canonical encoding sizes, wire-format sizes, verification pipeline checks, the 10-check pipeline, size regression data, and adversarial test cases for scheme_id = 2.
• MSVC wallet-core build path: BuildRust.cmake now selects the x86_64-pc-windows-msvc Rust target when CMake is driven by MSVC, enabling the Tauri GUI wallet to link against shekyl-core on Windows. The existing MinGW cross-compilation path for headless binaries is unchanged.
• CI: Windows MSVC wallet-core job (build-windows-msvc): New CI lane builds the wallet-core static libraries with Visual Studio / MSVC via vcpkg, validating the MSVC portability patches on every push.
• Unified Gitian release pipeline. The gitian workflow is now the sole release pipeline, replacing the separate release-tagged workflow. Gitian builds produce reproducible binaries; a new package-and-publish job creates .deb/.rpm packages, a Windows NSIS installer, source archive, and SHA256SUMS, then publishes the GitHub Release. Eliminates duplicate cross-compilation and host-toolchain issues.
• Source archive in GitHub Releases. The packaging job produces shekyl-vX.Y.Z-source.tar.gz containing the full source tree with all submodules, attached to each release alongside the binaries.

🔄 Changed

• shekyl_pqc_verify FFI signature change. Now requires scheme_id as first parameter for scheme dispatch.
• depends.yml demoted to PR-only. The cross-compilation CI workflow now runs only on pull requests (and manual dispatch), not on every push. Saves significant CI minutes; Gitian catches cross-platform issues at release time.
• release-tagged.yml disabled. The Gitian pipeline now handles all release artifacts. The old workflow is preserved as .disabled for one release cycle.
• Gitian reproducible builds: migrated from Ubuntu 18.04 (Bionic) to 22.04 (Jammy). All five build descriptors (gitian-linux.yml, gitian-win.yml, gitian-osx.yml, gitian-android.yml, gitian-freebsd.yml), gitian-build.py, and dockrun.sh now target Jammy. Drops GCC 7 and Python 2 dependencies in favour of the distro-default GCC 11 and Python 3. Upgrades FreeBSD cross-compiler from Clang 8 to Clang 14. Removes Bionic-specific workarounds (i686 asm symlink hack, glibc math-finite.h hack). Adds linux-libc-dev:i386 for native i686 headers. C++17 is now fully supported by the Gitian toolchain.

🐛 Fixed

• Comprehensive compiler warning cleanup across all CI platforms. Eliminated ~30 unique warnings inherited from Monero across Linux, macOS, Windows, and Arch Linux CI builds:
  • Removed dead code: add_public_key (format_utils), keys_intersect (wallet2), unused addressof template specialization (crypto test), unused max_block_height variable (protocol_handler).
  • Fixed oaes_lib.c: replaced deprecated ftime() with gettimeofday(), corrected transposed calloc argument order (5 call sites).
  • Fixed rx-slow-hash.c: added (void) to K&R-style function definitions.
  • Suppressed GCC false positive -Wstringop-overflow in tree-hash.c.
  • Replaced deprecated strand::wrap() with boost::asio::bind_executor() in levin_notify.cpp.
  • Suppressed GCC -Wuninitialized for safe circular-reference constructors in cryptonote_core.cpp and long_term_block_weight.cpp.
  • Added default member initializers to BulletproofPlus (rctTypes.h), transfer_details and payment_details (wallet2.h) to silence -Wmaybe-uninitialized.
  • Fixed Windows: removed unused variables in windows_service.cpp, eliminated -Wcast-function-type in util.cpp via void* intermediate cast, fixed -Wtype-limits in utf8.h by using uint32_t instead of wint_t for code points.
  • Suppressed intentional uninitialized read in memwipe.cpp test.
  • Set MACOSX_DEPLOYMENT_TARGET for native Darwin Cargo builds in BuildRust.cmake to eliminate 672 linker warnings from ring crate.
• CI link errors: separated shekyl-daemon-rpc from shekyl-ffi. The daemon RPC Axum crate was bundled into libshekyl_ffi.a, causing undefined reference to core_rpc_ffi_* on non-daemon targets (gen-ssl-cert, wallet-crypto-bench, etc.) across all 5 CI platforms. Moved FFI exports (shekyl_daemon_rpc_start, shekyl_daemon_rpc_stop) into a new ffi_exports.rs within the daemon-rpc crate, which now produces its own libshekyl_daemon_rpc.a staticlib. Only the daemon target links both libraries. BuildRust.cmake updated with a second cargo build step and SHEKYL_DAEMON_RPC_LINK_LIBS.
• Wallet: --daemon-port help text referenced Monero port 18081. Updated to Shekyl's default RPC port 11029.
• Wallet: account_public_address equality after PQC. Destination and change-address checks used memcmp on the whole struct; m_pqc_public_key is a std::vector, so equality was wrong when keys matched but allocations differed. All such sites now use operator== / !=. Added a static_assert that the type is not trivially copyable to discourage raw memcmp regressions.
• Wallet / Ledger: constant-time comparison for 32-byte secrets. wallet2::is_deterministic and Ledger HMAC secret lookup now use crypto_verify_32 instead of memcmp.
• MSVC: add <io.h> and POSIX guards in util.cpp. Added <io.h> for _open_osfhandle/_close, expanded MinGW conditionals to cover MSVC for setenv→putenv, mode_t/umask, and closefrom→no-op.
• MSVC: replace __thread with thread_local in perf_timer.cpp and threadpool.cpp. GCC's __thread is not supported by MSVC.
• MSVC: rename xor parameter in slow-hash.c to xor_pad. MSVC treats xor as a reserved keyword in C mode. Both the x86/SSE and ARM/NEON variants of aes_pseudo_round_xor() were affected.
• MSVC: fix iterator-to-pointer cast in http_auth.cpp. MSVC boost::as_literal() iterator is a class, not a raw pointer. Used &*data.begin() to obtain the address.
• MSVC: guard unbound.h include and usage in util.cpp. The include and unbound_built_with_threads() function/call were not wrapped in HAVE_DNS_UNBOUND, causing a missing-header error.
• MSVC: guard unistd.h in easylogging++. The third-party logging library unconditionally included <unistd.h> which does not exist on MSVC.
• MSVC: add <io.h> include for _isatty in mlog.cpp. The WIN32 code path uses _isatty/_fileno which require <io.h> on MSVC.
• MSVC: fix boost::iterator_range conversion in http_auth.cpp. Boost 1.90 as_literal() returns an iterator type that does not implicitly convert to iterator_range<const char*> on MSVC. Changed to auto deduction.
• MSVC: add <cwctype> include for std::towlower in language_base.h. MSVC does not transitively include wide-character utilities through other Boost headers.
• MSVC: fix rvalue binding in portable_storage serialization. Changed array_entry_t::insert_first_val and insert_next_value from strict rvalue-reference parameters (t_entry_type&&) to pass-by-value, allowing lvalue forwarding from portable_storage::insert_first_value / insert_next_value to work correctly under MSVC template deduction.
• MSVC: force-include <iso646.h> for C++ alternative tokens. The codebase uses not, and, or extensively (hundreds of sites). MSVC does not recognise these as keywords by default. Added /FIiso646.h to the MSVC compile definitions so they are defined in every translation unit.
• MSVC: enable conformant preprocessor (/Zc:preprocessor). MSVC's traditional preprocessor breaks nested __VA_ARGS__ forwarding in the THROW_ON_RPC_RESPONSE_ERROR macro chain, causing throw_wallet_ex template deduction failures. Added /Zc:preprocessor to MSVC compile flags and removed the obsolete Boost.Preprocessor-based throw_wallet_ex fallback in favour of the standard variadic template version.
• Gitian: enable universe repository and remove apt proxy in Docker base image. The ubuntu:jammy Docker image only enables main restricted by default; gitian-build.py now patches the base image after make-base-vm to add universe and remove the apt-cacher-ng proxy configuration (/etc/apt/apt.conf.d/50cacher). The proxy routes all apt traffic through 172.17.0.1:3142 which is unreliable on ephemeral CI runners, causing persistent 503 failures during package installation. Uses docker build (not run+commit) to preserve the image's CMD/USER metadata.
• Gitian Linux: fix i386-dependent package installation. The i386 architecture is now enabled in the Docker base image (via gitian-build.py's docker build step) along with passwordless sudo for the ubuntu user, allowing linux-libc-dev:i386, gcc-multilib, and g++-multilib to be installed normally via the descriptor's packages: section.
• Gitian macOS: add libtinfo5 and python-is-python3, remove python from FAKETIME_PROGS. The pre-built Clang 9 cross-compiler requires libtinfo.so.5. The python faketime wrapper broke CMake's FindPythonInterp version detection in the native_libtapi build (empty PYTHON_VERSION_STRING); removing python from the faketime wrappers fixes this while preserving timestamp reproducibility for ar, ranlib, date, dmg, and genisoimage.
• Gitian Android: add python-is-python3. Android NDK r17b scripts use #!/usr/bin/env python which does not exist on Jammy without this package.
• Gitian macOS: fix Rust ring crate cross-compilation. BuildRust.cmake incorrectly overrode the macOS cross-compiler with the Linux system clang when cross-compiling for Darwin, causing the ring crate to include Linux-only cet.h. Now only uses system clang on native macOS builds.
• Gitian Windows: drop i686 (32-bit) target. The i686-pc-windows-gnu Rust target has an unresolved GetHostNameW@8 symbol against MinGW's ws2_32. Since the release workflow only targets x86_64, the 32-bit Gitian build is removed.
• macOS cross-build: exclude -fcf-protection=full. Intel CET is x86 Linux only; the flag defines __CET__ which triggers #include <cet.h> in the ring crate's assembly, but cet.h does not exist in the macOS SDK. Now excluded for all Apple targets.
• macOS aarch64 cross-build: set MACOSX_DEPLOYMENT_TARGET=10.16. Clang 9 (depends cross-compiler) does not recognise macOS version 11.0+. Apple aliases 10.16 == 11.0; the cc-rs crate respects this env var, fixing the ring build for aarch64-apple-darwin.
• Gitian Docker base image: install sudo before creating sudoers entry. The /etc/sudoers.d/ directory does not exist in the minimal Ubuntu image until the sudo package is installed.

🔄 Changed

• Replace all BOOST_FOREACH / BOOST_REVERSE_FOREACH with range-for loops. 31+ call sites across test and utility code replaced with standard C++11 range-based for. Adds /DNOMINMAX to MSVC definitions to prevent Windows min/max macro collisions.
• Replace hardcoded -fPIC with POSITION_INDEPENDENT_CODE. The CMake property works across all compilers (GCC, Clang, MSVC). Applied to liblmdb and easylogging++ CMakeLists.
• Guard/remove unguarded #include <unistd.h>. POSIX header guarded behind #ifndef _WIN32 in blockchain_import.cpp; unused include removed from crypto.cpp.
• Replace C++20 designated initializers with C++17-compatible member assignment. Rewrote 10 call sites in cryptonote_core.cpp, blockchain.cpp, levin_notify.cpp, multisig_tx_builder_ringct.cpp, and wallet2.cpp. GCC/Clang accepted these as extensions; MSVC rejects them.
• Replace all __thread with thread_local. Covers easylogging++.cc, perf_timer.cpp, and threadpool.cpp. The __thread qualifier is GCC/Clang-specific; thread_local (C++11) is portable across GCC, Clang, and MSVC.
• Centralize ssize_t typedef in src/common/compat.h. Replaces duplicate #if defined(_MSC_VER) guards in util.h and download.h with a single include.

🗑️ Removed

• Classical multisig code removed from wallet2.h. Removed all classical Monero-style multisig types (multisig_info, multisig_sig, multisig_kLR_bundle, multisig_tx_set), public/private multisig API methods, multisig private members, MMS (message store) integration, and associated Boost serialization functions. The src/multisig/ directory and src/wallet/message_store.h are deleted; wallet2.h no longer depends on those headers. All multisig uses PQC-only authorization (scheme_id = 2) via the pqc_auth layer.
• Gitian Android build. Removed from the Gitian matrix since there is no Android wallet. The Android NDK r17b is also incompatible with Ubuntu Jammy.
• Gitian Linux: drop i686-linux-gnu (32-bit x86) target. Eliminates the need for linux-libc-dev:i386, gcc-multilib, g++-multilib, sudo, and the dpkg --add-architecture i386 workaround. Simplifies the Docker base image patching to only enable the universe repository.

📚 Documentation

• docs/RELEASING.md: document all release artifacts. Updated the artifact table to list all 13 files produced per release (was 6), including cross-platform tarballs, aarch64 .deb/.rpm, and source archive. Updated "Future Platforms" to reflect that macOS tarballs are now shipping and .dmg/AppImage remain planned.

[3.0.3-RC1] - 2026-03-31

Known Limitations

• Multisig not yet implemented. Multisig wallets are restricted to v2 transactions (no PQC authentication). PQC-enabled multisig is planned for a future release. See docs/PQC_MULTISIG.md for the design.

✨ Added

• Rust wallet RPC server (shekyl-wallet-rpc): New Rust crate that replaces the C++ wallet_rpc_server with an axum-based JSON-RPC server. Calls the existing C++ wallet2 library through a new C FFI facade (wallet2_ffi.cpp/.h). Supports all 98 RPC methods with full parity. Can run as a standalone binary (shekyl-wallet-rpc) or be embedded as a library in the Tauri GUI wallet. See docs/WALLET_RPC_RUST.md.

• C++ wallet2 FFI facade (wallet2_ffi.cpp/.h): Opaque-handle C API over wallet2 with JSON serialization at the boundary. Includes a generic wallet2_ffi_json_rpc() dispatcher that routes all RPC methods to the underlying wallet2 implementation. Covers lifecycle, queries, transfers, sweeps, proofs, accounts, address book, import/export, multisig, staking, mining, background sync, and daemon management.

• GUI wallet direct FFI integration: The Tauri GUI wallet now calls wallet2 directly through the Rust FFI bridge (wallet_bridge.rs) instead of spawning a child shekyl-wallet-rpc process and communicating via HTTP. Eliminates process management, port allocation, and HTTP overhead. Removed wallet_process.rs and wallet_rpc.rs.

v3-First Core Test Adaptation

• Enforced min_tx_version=3 for non-coinbase transactions: All user transactions in the test suite now construct v3 with PQC authentication (hybrid Ed25519 + ML-DSA-65). Coinbase transactions remain v2.
• Adapted chaingen framework for RCT-from-genesis: Transaction construction helpers (construct_tx_to_key, construct_tx_rct) thread hf_version=1 and use_view_tags=true. Coinbase outputs are indexed under amount=0 for correct RCT spending. Fixed difficulty is injected for FAKECHAIN replay. Mixin checks are relaxed for FAKECHAIN.
• Added RCT-aware balance verification: Pool transaction balance checks in gen_chain_switch_1 now decrypt ecdhInfo amounts using the recipient's view key instead of relying on the plaintext o.amount field (always 0 for RCT outputs).
• Recalibrated economic constants for Shekyl: Test constants (TESTS_DEFAULT_FEE, FIRST_BLOCK_REWARD, MK_COINS) match Shekyl's COIN = 10^9, EMISSION_SPEED_FACTOR = 21, and staker/burn splits. construct_miner_tx_manually in block validation tests uses Shekyl's reward distribution.
• Fixed Bulletproofs+ test suite: Dynamically discover miner output amounts, set HF to 1 for all block construction, correctly flag coinbase outputs as RCT. All 15 BP+ tests pass.
• Fixed txpool tests: Adjusted key image count assertions for multi-input RCT transactions and corrected unlock_time handling.
• Fixed double-spend tests: Modified output selection to pick the largest decomposed output, avoiding underflow on fee subtraction.
• Disabled legacy-incompatible tests: gen_block_invalid_binary_format (hours-long), gen_block_invalid_nonce, gen_block_late_v1_coinbase_tx, gen_uint_overflow_1, gen_block_reward, gen_bpp_tx_invalid_before_fork, gen_bpp_tx_invalid_clsag_type, gen_ring_signature_big. These rely on pre-RCT economics, legacy fork transitions, or are prohibitively slow.
• All 79 core_tests pass with 0 failures.

Test suite cleanup for Shekyl HF1

• Removed 96 dead Borromean ringct tests: All tests in tests/unit_tests/ringct.cpp that exercised legacy Borromean range proofs were removed. Shekyl HF1 rejects Borromean proofs at the genRctSimple level. Retained 9 non-Borromean tests (CLSAG, HPow2, d2h, d2b, key_ostream, zeroCommit, H, mul8).
• Updated transaction construction helpers to Bulletproofs+: The test::make_transaction helper (used by JSON serialization and ZMQ tests) now constructs transactions with { RangeProofPaddedBulletproof, 4 } (BP+/CLSAG) instead of the removed Borromean or unsupported BP v2 configs. Removed the obsolete bulletproof parameter. Consolidated three JSON serialization tests (RegularTransaction, RingctTransaction, BulletproofTransaction) into one BulletproofPlusTransaction test. Fixes all 8 zmq_pub/zmq_server test failures.
• Updated serialization round-trip test to BP+: Changed Serialization.serializes_ringct_types from bp_version 2 (throws "Unsupported BP version") to bp_version 4 (Bulletproofs+). Updated assertions from MGs to CLSAGs and from bulletproofs to bulletproofs_plus.
• Removed legacy Monero-era core/perf test executions: Stopped running deprecated Borromean/pre-RCT/fork-transition test generators in core_tests and removed Borromean/MLSAG/range-proof performance test invocations and defaults, so CI validates HF1-era behavior only.
• Hardened block-weight test contract for HF1 semantics: block_weight comparison now enforces deterministic H/BW/LTBW parity and EMBW floor invariants instead of byte-identical legacy model output, preventing false failures from non-consensus median implementation details.
• Fixed block_reward test expected values: Updated emission curve expectations to match Shekyl's EMISSION_SPEED_FACTOR = 21 (120s blocks) and per-block tail floor of FINAL_SUBSIDY_PER_MINUTE * target_minutes.
• Rewrote mining_parity release multiplier test: Replaced legacy pre-Shekyl-NG equality assertion (which tested a non-existent version 0) with a test that verifies the release multiplier correctly scales rewards above and below the tx volume baseline.
• Fixed Ubuntu 24.04 CI test runner: Replaced pip install with apt install python3-* packages to comply with PEP 668 (externally-managed-environment).

🐛 Fixed

• macOS cross-compilation (depends CI): Fixed multiple build failures for Cross-Mac x86_64 and Cross-Mac aarch64 targets:

  • Raised macOS minimum deployment target from 10.8 (Mountain Lion, 2012) to 10.15 (Catalina, 2019) to enable std::filesystem support in the cross-compiled libc++.
  • Fixed Boost discovery in depends builds by setting Boost_NO_BOOST_CMAKE and forcing MODULE mode, preventing BoostConfig.cmake variant-check failures on cross-compiled Darwin libraries.
  • Made boost_locale a conditional dependency (Windows only), since it is only used within #ifdef WIN32 blocks and was unavailable for Darwin cross-builds.
  • Added per-target CC_<triple>/AR_<triple>/CFLAGS_<triple> environment variables in BuildRust.cmake so the ring crate can locate the cross-compiler for C/assembly code.
  • Used system clang (instead of the depends-bundled Clang 9) for Rust crate C compilation on Darwin, since ring 0.17 requires clang features unavailable in Clang 9 (macOS 11 version strings, -fno-semantic-interposition).
  • Guarded -fno-semantic-interposition behind check_c_compiler_flag() so it is only added when the compiler supports it (Clang 9 does not).
  • Fixed OSX SDK cache key in depends.yml to include the SDK version and skip the cache step for non-macOS builds.

• FreeBSD cross-compilation (depends CI): Fixed multiple build failures for the x86_64 FreeBSD target:

  • Switched Boost's b2 toolset from gcc to clang for FreeBSD, fixing C++ standard library header resolution (<cstddef> not found).
  • Embedded -stdlib=libc++ in the FreeBSD clang++ wrapper script so all depends packages automatically use the correct C++ standard library, regardless of whether their own $(package)_cxxflags overrides the host flags (previously broke zeromq, sodium, and other packages).
  • Fixed compiler wrapper argument quoting: replaced the broken echo "...$$$$""@" pattern with printf '..."$$$$@"' so "$@" passes through correctly to the generated wrapper, preventing argument mangling for flags containing quotes (e.g. -DPACKAGE_VERSION="1.0.20").
  • Added -D_LIBCPP_ENABLE_CXX17_REMOVED_UNARY_BINARY_FUNCTION to both Boost's FreeBSD cxxflags and the CMake toolchain, restoring std::unary_function compatibility needed by Boost 1.74's container_hash/hash.hpp under FreeBSD's strict C++17 libc++.
  • Removed the unsupported no-devcrypto option from OpenSSL's FreeBSD configure flags (the devcrypto engine was removed in OpenSSL 3.0).
  • Added threadapi=pthread runtime-link=shared to Boost's FreeBSD config options for correct threading and linking behavior.

• Linux static release build (libudev linking): Added libudev-dev to the release-tagged.yml CI package list. Static libusb-1.0.a and libhidapi-libusb.a depend on libudev for USB hotplug support; without the dev package installed, find_library(udev) failed and the final link produced undefined udev_* references, preventing the "Publish GitHub Release" step from running.

• Win64 build failure (ICU generator expression): Replaced broken CMake generator expressions $<$<BOOL:${WIN32}>:${ICU_LIBRARIES}> with if(WIN32) blocks in simplewallet, wallet_api, and libwallet_api_tests CMakeLists. Generator expressions cannot contain semicolon-separated lists; the old pattern passed literal fragments like $<1:icuio to the linker on MinGW cross-compilation.

• Linux static build (libunbound linking): Fixed FindUnbound.cmake scoping bug where list(APPEND UNBOUND_LIBRARIES ...) created a local variable shadowing the find_library cache entry. The transitive static deps (libevent, libnettle, libhogweed, libgmp) were silently dropped, causing undefined reference errors in release-static-linux-x86_64 builds.

• JSON serialization of v3 (PQC) transactions: Added missing pqc_auth field to the RapidJSON toJsonValue/fromJsonValue roundtrip for cryptonote::transaction. V3 transactions created under HF_VERSION_SHEKYL_NG include a pqc_authentication envelope; without JSON support the field was silently dropped, causing get_transaction_hash to fail with "Inconsistent transaction prefix, unprunable and blob sizes" after a JSON roundtrip. Fixes the JsonSerialization.BulletproofPlusTransaction unit test failure.

GUI Wallet

• New project: Shekyl GUI Wallet (shekyl-gui-wallet) at Shekyl-Foundation/shekyl-gui-wallet. Built with Tauri 2 (Rust backend) + Vite + React 19 + TypeScript + Tailwind CSS 4. Initial scaffold includes 6 pages (Dashboard, Send, Receive, Staking, Transactions, Settings), stub Tauri commands, Shekyl gold/purple design system, and verified production builds for Linux (.deb, .rpm, .AppImage). Phase 2 will add the C++ FFI bridge to wallet2_api.h for real wallet operations.
• Added testing infrastructure: Vitest + React Testing Library for frontend (20 tests across 6 suites), cargo test for Rust backend (10 tests), with Tauri IPC mocking for isolated component testing.
• Added CI/CD via GitHub Actions: ci.yml runs ESLint, TypeScript type-check, Vitest, Rustfmt, Clippy, and cargo test on every PR; release.yml builds multi-platform binaries (Linux x64, Windows x64, macOS ARM64 + Intel) via tauri-action and creates draft GitHub releases.

Consensus timing alignment (HF1)

• Fixed remaining runtime paths that still derived timing from legacy DIFFICULTY_TARGET_V1 (60s) so active Shekyl HF1 behavior consistently uses DIFFICULTY_TARGET_V2 (120s) for difficulty target selection, block reward minute-scaling, unlock-time leeway checks, sync ETA reporting, and wallet lock-time display.
• Updated docs/ECONOMY_TESTNET_READINESS_MATRIX.md to mark the 120s block-time drift item as resolved (code_fix_required completed).

📚 Documentation

• Updated docs/V3_ROLLOUT.md to reflect HF1 (genesis) activation instead of the stale HF17 references. Added v3-first test strategy section.
• Updated docs/POST_QUANTUM_CRYPTOGRAPHY.md scheme_id status table and deferred-items section from HF17 to HF1.
• Updated docs/PQC_MULTISIG.md V3 signature list heading from HF17 to HF1.
• Updated docs/STAKER_REWARD_DISBURSEMENT.md to reference HF1 activation.
• Updated docs/ECONOMY_TESTNET_READINESS_MATRIX.md HF naming drift label from doc_correction to resolved.
• Added core_tests section to docs/COMPILING_DEBUGGING_TESTING.md documenting the v3-from-genesis test approach and how to run/filter tests.

Genesis initialization compatibility

• Regenerated GENESIS_TX for mainnet, testnet, and stagenet to modern coinbase format (tx.version = 2) with tagged outputs.
• Removed all legacy genesis compatibility exceptions and enforced strict coinbase version checks (tx.version > 1) across all network types, including FAKECHAIN.
• Fixed genesis reward validation to accept the hardcoded GENESIS_TX amount at height == 0 while leaving post-genesis reward accounting unchanged.
• Fixed startup edge case where long-term weight median calculations could evaluate with zero historical blocks during genesis initialization (count == 0), causing daemon boot failure on empty data dirs.
• Updated genesis-construction helper (build_genesis_coinbase_from_destinations) to emit tx.version = 2 with view-tagged outputs for current HF1 expectations.
• Added canonical root build command make genesis-builder (using the main release build dir with GENESIS_TOOL_SRC_DIR) to avoid split/ambiguous genesis-builder binaries across multiple build trees.

Testnet economy readiness checks

• Added docs/ECONOMY_TESTNET_READINESS_MATRIX.md to track design-vs-code status for economy testnet rehearsal with explicit drift tags (doc_correction, code_fix_required, needs_decision).
• Added scripts/check_testnet_genesis_consensus.py to verify multi-node testnet tuple consistency (height 0 block hash, miner tx hash, tx hex) and optional economy field presence in get_info.
• Added Rust parity/invariant tests:
  • shekyl-economics-sim: validates SimParams::default() against config/economics_params.json.
  • shekyl-economics: added release monotonicity, burn bounds, and emission-share monotonicity tests.
  • shekyl-ffi: added direct FFI-vs-Rust consistency tests for burn pct and emission share.
• Added functional RPC test tests/functional_tests/economy_info.py and included it in functional_tests_rpc.py default test list to assert required economy fields are exposed by get_info.
• Corrected documentation errors without changing design intent:
  • Clarified DESIGN_CONCEPTS.md Section 2 as historical baseline.
  • Removed duplicate heading in GENESIS_TRANSPARENCY.md.
  • Linked RELEASE_CHECKLIST.md testnet section to the rehearsal runbook/checklist and deterministic tuple check command.

BREAKING: Second-pass rebrand (wallet, URI, serialization)

• URI scheme: Wallet URI generation and parsing now use shekyl: only. The legacy monero: scheme is no longer accepted. QR codes and payment links generated by previous builds will fail to parse. Regenerate all payment URIs before upgrading wallets.
• Wallet/export/cache magic strings: All file-format magic prefixes have been rewritten from Monero to Shekyl:
  • UNSIGNED_TX_PREFIX → "Shekyl unsigned tx set\005"
  • SIGNED_TX_PREFIX → "Shekyl signed tx set\005"
  • MULTISIG_UNSIGNED_TX_PREFIX → "Shekyl multisig unsigned tx set\001"
  • KEY_IMAGE_EXPORT_FILE_MAGIC → "Shekyl key image export\003"
  • MULTISIG_EXPORT_FILE_MAGIC → "Shekyl multisig export\001"
  • OUTPUT_EXPORT_FILE_MAGIC → "Shekyl output export\004"
  • ASCII_OUTPUT_MAGIC → "ShekylAsciiDataV1"
  • Wallet cache magic → "shekyl wallet cache" Old wallet caches, exported key images, multisig exports, signed/unsigned tx sets, and output exports are incompatible and must be re-exported after upgrading.
• Message signing domain: HASH_KEY_MESSAGE_SIGNING changed from "MoneroMessageSignature" to "ShekylMessageSignature". Messages signed with the old domain separator will fail verification.
• i18n domain: Translation catalogue domain changed from "monero" to "shekyl".
• Daemon stdout redirect: Daemonized output file changed from bitmonero.daemon.stdout.stderr to shekyl.daemon.stdout.stderr.
• Log file names: All blockchain utility log files renamed from monero-blockchain-* to shekyl-blockchain-*.
• DNS seed/checkpoint domains: Replaced moneroseeds.* and moneropulse.* lookups with 5-domain consensus set: shekyl.org, shekyl.net, shekyl.com, shekyl.biz, shekyl.io. Majority threshold is 3 of 5. See shekyl-dev/docs/DNS_CONFIG.md for the full infrastructure reference.
• Update check: Software name comparison for macOS .dmg extension switched from monero-gui to shekyl-gui.
• Hardware wallet: Ledger app error message now references "Shekyl Ledger App" instead of "Monero Ledger App". Trezor protobuf namespaces are unchanged (third-party protocol dependency).
• Intentionally preserved: Trezor/Ledger protobuf includes and protocol namespaces (hw.trezor.messages.monero.*), Esperanto mnemonic word "monero" (means "money"), academic paper citations, copyright headers, MONERO_DEFAULT_LOG_CATEGORY build-internal macros, and MakeCryptoOps.py build artifacts.

Operator migration checklist

1. Delete old wallet cache files (.keys files are unaffected).
2. Re-export any key-image, multisig, or output export files.
3. Re-export and re-sign any unsigned/signed transaction sets.
4. Regenerate all monero: QR codes/payment URIs as shekyl: URIs.
5. Update any scripts or integrations that parse URI scheme or file magic.
6. Verify message signatures were not created with the old signing domain.
7. Update log rotation configs if they reference monero-blockchain-* paths.
8. Update DNS infrastructure to serve records under all 5 TLDs (.org, .net, .com, .biz, .io). See shekyl-dev/docs/DNS_CONFIG.md.

Dead Monero legacy code removal

• Dead HF branch cleanup: Collapsed all always-true / always-false hard fork version branches across blockchain.cpp (~25 sites), wallet2.cpp (~22 sites), cryptonote_basic_impl.cpp (2 sites), and cryptonote_core.cpp (2 sites). Since all HF_VERSION_* constants are 1, every hf_version >= HF_VERSION_* was always true and every hf_version < HF_VERSION_* was always false. Collapsed fee algorithms, ring size ladders, tx version ladders, difficulty target selection, sync block size selection, BP/CLSAG/BP+ gating, dynamic fee scaling, long-term block weight calculations, and use_fork_rules() call sites. Removed ~500-800 lines of dead conditional logic.

• Dropped v1 transaction support entirely:

  • Consensus: check_tx_outputs now rejects tx.version == 1 outright. check_tx_inputs sets min_tx_version = 2 unconditionally; unmixable output counting and ring-size exemptions removed. v1 ring signature verification code and threaded v1 signature checking removed from check_tx_inputs. expand_transaction_2 only handles CLSAG and BulletproofPlus; old RCTTypeFull/Simple/Bulletproof/Bulletproof2 branches removed.
  • RingCT (rctSigs.cpp/.h): Removed ~770 lines of dead crypto code: genBorromean, verifyBorromean, MLSAG_Gen, MLSAG_Ver, proveRange, verRange, proveRctMG, proveRctMGSimple, verRctMG, verRctMGSimple, populateFromBlockchain, genRct (both overloads), verRct, decodeRct (both overloads). genRctSimple, verRctSemanticsSimple, verRctNonSemanticsSimple, and decodeRctSimple only accept RCTTypeCLSAG and RCTTypeBulletproofPlus. Header reduced from 144 to 87 lines.
  • Transaction construction (cryptonote_tx_utils.cpp): Removed v1 ring signature generation block and non-simple RCT construction (genRct). All transactions now use genRctSimple (CLSAG path).
  • Tx verification utils: Removed RCTTypeSimple, RCTTypeFull, RCTTypeBulletproof, RCTTypeBulletproof2 from batch semantics verification.
  • Test fixups: Updated all test files under tests/ to match the removed RCT primitives. Stubbed performance benchmarks for MLSAG (rct_mlsag.h, sig_mlsag.h) and Borromean range proofs (range_proof.h). Replaced verRct with verRctNonSemanticsSimple in check_tx_signature.h. Removed decodeRct else-branches from rct.cpp, rct2.cpp, bulletproofs.cpp, bulletproof_plus.cpp. In unit_tests/ringct.cpp: removed Borromean, MLSAG, and RCTTypeFull-only tests; rewrote make_sample_rct_sig to use genRctSimple; replaced all verRct calls with verRctSimple.

• Wallet v1 cleanup: Removed unmixable sweep functions, v1 fee/amount paths, v1 coinbase optimization, dead non-RCT creation branches, and replaced RangeProofBorromean defaults with RangeProofPaddedBulletproof. sweep_dust RPC returns error; createSweepUnmixableTransaction API returns empty result with error status.

• Trezor Shekyl rebrand: Renamed all include guard macros from MONERO_*_H to SHEKYL_*_H in 8 device_trezor/ headers. Updated derivation path comment and HTTP Origin URL. Protobuf message types and wire protocol identifiers intentionally preserved (must match Trezor firmware definitions).

Epee Phase 1: Rust replacement for security-critical primitives

• SSL certificate generation migrated to Rust (rcgen): Replaced the deprecated OpenSSL RSA/EC_KEY certificate generation in net_ssl.cpp with Rust's rcgen crate (ECDSA P-256) via FFI. Eliminates all RSA_new, RSA_generate_key_ex, EC_KEY_new, EC_KEY_generate_key, and other OpenSSL 3.0-deprecated API calls. The create_rsa_ssl_certificate and create_ec_ssl_certificate functions are replaced by a single create_ssl_certificate that delegates to shekyl_generate_ssl_certificate in the Rust FFI, returning PEM-encoded key+cert for loading into OpenSSL's SSL_CTX via non-deprecated BIO APIs.
• Post-quantum hybrid key exchange enabled: TLS context configuration now prefers X25519MLKEM768 (FIPS 203 ML-KEM-768 hybrid) key exchange groups, falling back to classical X25519:P-256:P-384 when the OpenSSL build lacks PQ support. Also added explicit TLS 1.3 ciphersuite configuration. Removed deprecated SSL_CTX_set_ecdh_auto call.
• Secure memory wiping migrated to Rust (zeroize): Replaced the platform-specific memwipe.c implementation (memset_s / explicit_bzero / compiler-barrier fallback) with a single call to the Rust zeroize crate via shekyl_memwipe FFI. The zeroize crate uses write_volatile which is guaranteed not to be optimized away, replacing the fragile compiler barrier tricks.
• Memory locking migrated to Rust (libc): Replaced the GNUC-only mlock/munlock/sysconf calls in mlocker.cpp with Rust FFI functions (shekyl_mlock, shekyl_munlock, shekyl_page_size) backed by the libc crate. Adds Windows VirtualLock/VirtualUnlock support that was previously missing (#warning Missing implementation). The mlocked<T> and scrubbed<T> C++ template wrappers are preserved unchanged.
• New Rust FFI dependencies: Added rcgen = "0.14", zeroize = "1", libc = "0.2" to shekyl-ffi/Cargo.toml.
• C-compatible FFI header: Added src/shekyl/shekyl_secure_mem.h with C-linkage declarations for the secure memory primitives, usable from both C (memwipe.c) and C++ (mlocker.cpp) translation units.
• CMake wiring: epee library now links ${SHEKYL_FFI_LINK_LIBS} and includes ${CMAKE_SOURCE_DIR}/src for the FFI headers.

Build fixes

• Boost CONFIG-mode compatibility shim: When Boost is found via cmake CONFIG mode (Boost 1.85+), old-style ${Boost_XXX_LIBRARY} variables may resolve to versioned .so paths that don't exist on rolling-release distros (e.g. Arch Linux with Boost 1.90). Added a shim in the root CMakeLists.txt that remaps all Boost_*_LIBRARY variables to Boost::* imported targets when CONFIG mode is active. Fixes linker failures on Arch.
• Removed duplicate parse_amount test: Two identical TEST_pos(18446744073709551615, ...) entries in tests/unit_tests/parse_amount.cpp caused a redefinition error on macOS Clang. Removed the duplicate.
• Boost CONFIG-mode validation: Added a cmake-configure-time check that verifies Boost imported-target IMPORTED_LOCATION files exist on disk. Gives a clear FATAL_ERROR with remediation steps instead of a cryptic linker failure minutes into the build.
• Arch Linux CI: Added boost-libs to the Arch pacman install to provide shared .so files alongside the boost headers/cmake-config package.
• Ubuntu 24.04 test matrix: Added Ubuntu 24.04 to the test-ubuntu CI matrix (previously only 22.04 was tested).

Depends system updates

• FreeBSD sysroot updated to 14.4-RELEASE: The cross-compilation sysroot was stuck at FreeBSD 11.3 (EOL Sept 2021), whose base.txz had been removed from FreeBSD mirrors (404). Updated to 14.4-RELEASE (March 2026), updated SHA256 hash, and fixed clang wrapper scripts from clang-8 to clang-14 to match hosts/freebsd.mk. Added -stdlib=libc++ to CXXFLAGS and LDFLAGS since FreeBSD uses libc++ and the Ubuntu host's clang-14 defaults to libstdc++. Also added libc++-14-dev and libc++abi-14-dev to CI packages for the FreeBSD cross-build so the host compiler can find libc++ headers when -stdlib=libc++ is specified.
• Boost: skip CONFIG mode for depends builds: The depends-built Boost 1.74.0 installs CMake config files whose variant detection fails for darwin cross-builds (boost_locale reports "No suitable build variant"). find_package(Boost ... CONFIG) is now skipped when DEPENDS is true (set by the depends toolchain), falling back to the more robust MODULE mode (FindBoost.cmake).
• OpenSSL: disabled devcrypto engine for FreeBSD: Added no-devcrypto to FreeBSD OpenSSL configure options. The /dev/crypto engine requires the crypto/cryptodev.h kernel header which is not available in a cross-compilation sysroot.
• libsodium updated to 1.0.20: The 1.0.18 tarball was removed from download.libsodium.org (404). Updated to 1.0.20 with new SHA256 hash. Removed the 1.0.18-specific patches (fix-whitespace.patch, disable-glibc-getrandom-getentropy.patch) which no longer apply.

Warning cleanup and dead code removal

• Removed dead fork helpers: Deleted unused get_bulletproof_fork(), get_bulletproof_plus_fork(), and get_clsag_fork() from wallet2.cpp. These Monero-era version ladders had no call sites; Shekyl activates all features from HF1.
• Removed dead variable: Deleted unused bool refreshed in wallet2::refresh().
• Removed legacy result_type typedefs: Deleted using result_type = void from add_input and add_output visitor structs in json_object.cpp. These were required by boost::static_visitor but are unused by std::visit.
• Fixed uninitialized-variable warning: Zero-initialized local_blocks_to_unlock and local_time_to_unlock in wallet2::unlocked_balance_all().
• Fixed aliasing cast in wallet serialization: Replaced C-style cast of m_account_tags from pair<serializable_map, vector> to pair<map, vector>& with direct .parent() accessor, eliminating formal undefined behavior.
• Suppressed epee warnings: Added targeted #pragma GCC diagnostic guards for -Wclass-memaccess (memcpy into mlocked<scrubbed<>> in keyvalue_serialization_overloads.h) and -Wstring-compare (type_info comparisons in portable_storage.h).
• Renamed test target: monero-wallet-crypto-bench renamed to shekyl-wallet-crypto-bench.
• Trezor Protobuf fixes: Added std::string() wrapping for GetDescriptor()->name() calls in messages_map.cpp/.hpp to handle Protobuf 22+ returning absl::string_view/std::string_view. Added missing <cstdint> include to exceptions.hpp.

Rust crypto infrastructure

• New shekyl-crypto-hash crate: Implements cn_fast_hash (Keccak-256 with original padding, not SHA3) and tree_hash (Merkle tree) in Rust using tiny-keccak. Both functions produce byte-identical output to the C implementations in src/crypto/hash.c and src/crypto/tree-hash.c.
• FFI exports: shekyl_cn_fast_hash and shekyl_tree_hash exposed through shekyl-ffi with C-ABI declarations in shekyl_ffi.h. The C++ side can now call Rust hashing alongside or instead of the C path.
• Rust-preferred development rule: Added .cursor/rules/rust-preferred.mdc establishing policy for gradual C++ to Rust migration: new modules in Rust, crypto primitives via RustCrypto crates, computational extraction to Rust behind FFI when modifying existing C++ modules.

Hardfork reboot and testnet wallet readiness

• Hardfork schedule rebooted: All HF_VERSION_* constants collapsed to 1. The chain starts with all features active from genesis -- no legacy migration gates. Hardfork tables reduced to single-entry { 1, 1, 0, timestamp } for all three networks (mainnet, testnet, stagenet).
• Removed all raw numeric HF version gates (hf_version <= 3, >= 7, < 8, > 8, etc.) from consensus and transaction construction code, replacing them with named HF_VERSION_* constants. Legacy Monero-era transition logic (borromean proofs, bulletproofs v1, grandfathered txs) removed.
• Coinbase transactions always v2 RCT with single output, zero dust threshold.
• Staked outputs excluded from spendable balance: is_transfer_unlocked() now returns false for staked outputs, preventing them from being selected during normal transfers. balance_per_subaddress and unlocked_balance_per_subaddress skip staked outputs.
• Unstake transaction fixed: create_unstake_transaction now passes matured staked output indices directly to create_transactions_from, properly using the actual staked UTXOs as transaction inputs with standard ring signatures.
• Claim reward validation fixed: check_stake_claim_input now looks up the real staked output from the blockchain DB to get the actual amount and tier, replacing the hardcoded shekyl_stake_weight(0, 0) placeholder.
• New daemon RPC estimate_claim_reward: computes per-output reward server-side using the accrual database, returning reward amount, tier, and staked amount. Wallet estimate_claimable_reward now calls this RPC instead of returning a hardcoded zero.
• CLI improvements: balance command now shows staked balance alongside liquid and unlocked balances. New staking_info command shows wallet staking overview (locked/matured output counts with tier and remaining lock blocks). stake, unstake, and claim_rewards commands now include daemon connectivity guards.
• Wallet RPC fixes: unstake response changed from single tx_hash to tx_hash_list array to support multi-transaction unstaking. stake request now accepts account_index parameter. New get_staked_balance RPC returns staked balance with locked/matured output counts.

Post-quantum cryptography

• Phase 4 wallet/core PQC wiring completed: all v3 transaction construction paths now include hybrid Ed25519 + ML-DSA-65 signing via pqc_auth. Fixed create_claim_transaction (staking reward claims) which previously built v3 transactions without PQC authentication, causing consensus rejection.
• PQC verification enforced in both mempool acceptance and block validation for all non-coinbase v3 transactions.
• Multisig wallets intentionally restricted to v2 transactions (no PQC); the PQC secret key is cleared on multisig creation with a documented design note.
• Aligned POST_QUANTUM_CRYPTOGRAPHY.md field naming: hybrid_ownership_material renamed to hybrid_public_key to match the canonical code implementation.
• Added three negative PQC test vectors (docs/PQC_TEST_VECTOR_002–004) covering tampered ownership material, wrong scheme_id, and oversized/truncated signature blobs. Each vector is generated and verified by integration tests in rust/shekyl-crypto-pq/tests/negative_vectors.rs.
• Reconciled POST_QUANTUM_CRYPTOGRAPHY.md Open Items: resolved Rust crate selection, RctSigningBody layout, ownership binding, and max tx size; only scheme_id registry extension remains open.
• Added tentative V4 PQC Privacy Roadmap to POST_QUANTUM_CRYPTOGRAPHY.md with four phases (V4-A Research, V4-B Prototype, V4-C Testnet, V4-D Activation) and explicit KEM composition decision milestone (X25519 + ML-KEM-768 via HKDF-SHA-512).
• Added payload limit guidance section to V3_ROLLOUT.md with recommended minimum mempool/ZMQ/relay buffer sizes for post-PQC transactions.

Economics and simulation

• Added rust/shekyl-economics-sim workspace crate: reproducible 8-scenario simulation harness driven from config/economics_params.json. Scenarios cover baseline, boom-bust, sustained growth, stuffing attack, stake concentration, mass unstaking, chain bootstrap, and late-chain tail state. Results archived in docs/economics_sim_results.json.
• Provisionally locked tx_baseline (50) and FINAL_SUBSIDY_PER_MINUTE (300,000,000) in DESIGN_CONCEPTS.md after simulation validation; pending final testnet confirmation.
• Wired live chain-health RPC fields in get_info: release_multiplier now computed from rolling tx_volume_avg, burn_pct from current chain state, total_burned persisted in LMDB and accumulated per block.
• Wired total_staked in get_staking_info via new Blockchain::get_total_staked() accessor backed by existing stake cache.
• Added total_burned LMDB persistence: set_total_burned/get_total_burned on BlockchainDB, with rollback support via extended staker_accrual_record (actually_destroyed field).

Privacy and anonymity networks

• Updated ANONYMITY_NETWORKS.md with measured v3 payload impact analysis (cell/fragment counts for Tor and I2P), known leak vectors vs mitigations matrix, and recommended pre-mainnet testing checklist.
• Extended LEVIN_PROTOCOL.md wire inventory with per-command PQC size impact, anonymity sensitivity ratings, and a summary table covering all P2P and Cryptonote protocol commands.
• Added privacy considerations section to STAKER_REWARD_DISBURSEMENT.md covering claim timing, amount correlation, and staked output visibility.
• Added reward-driven privacy/mixing research appendix to DESIGN_CONCEPTS.md evaluating random maturation delay, claim batching, and reward output shaping with adversarial analysis and go/no-go criteria.

C++17 and Boost migration

• C++17 standard bump: CMAKE_CXX_STANDARD changed from 14 to 17 in both the main CMakeLists.txt and the macOS cross-compilation toolchain (contrib/depends/toolchain.cmake.in). This unblocks std::filesystem, std::optional, and other modern C++ features. Upstream Monero cherry-picks that required C++14-to-C++17 back-ports now compile without shims.
• boost::optional → std::optional (complete): Migrated ~486 use sites across ~93 files in src/, contrib/epee/, and tests/. Replaced boost::optional<T> with std::optional<T>, boost::none with std::nullopt, boost::make_optional with std::make_optional, and .get() accessor calls with * / ->. Added a std::optional Boost.Serialization adapter in cryptonote_boost_serialization.h so PQC auth fields serialize correctly. Replaced BOOST_STATIC_ASSERT/boost::is_base_of with static_assert/std::is_base_of in Trezor messages_map.hpp.
• boost::filesystem → std::filesystem (wallet/RPC layer): Migrated wallet_manager.cpp, wallet_rpc_server.cpp, core_rpc_server.cpp, and wallet_args.cpp from boost::filesystem to std::filesystem. Combined with the earlier utility-file migration, this covers all filesystem usage outside of net_ssl.cpp (epee, deferred due to permissions API coupling).
• boost::format removal (wallet/RPC layer): Replaced all boost::format calls in wallet2.cpp (4), wallet_rpc_server.cpp (8), and wallet_args.cpp (1) with stream output or string concatenation. simplewallet.cpp (106 uses, i18n-sensitive) remains deferred.
• boost::chrono/boost::this_thread in daemonizer: Replaced with std::chrono/std::this_thread in windows_service.cpp (PR #9544 equivalent).
• Medium-effort Boost removals (completed earlier):
  • boost::algorithm::string (trim, to_lower, iequals, join) replaced with tools::string_util helpers in src/common/string_util.h.
  • boost::format replaced with snprintf, stream output, or string concatenation in util.cpp, message_store.cpp, gen_ssl_cert.cpp, gen_multisig.cpp.
  • boost::regex replaced with std::regex in simplewallet.cpp and wallet_manager.cpp.
  • boost::mutex, boost::lock_guard, boost::unique_lock, and boost::condition_variable replaced with std::mutex, std::lock_guard, std::unique_lock, and std::condition_variable in util.h, util.cpp, threadpool.h, threadpool.cpp, and rpc_payment.h/rpc_payment.cpp.
  • boost::thread::hardware_concurrency() replaced with std::thread::hardware_concurrency().
• Filesystem migration (utility files, completed earlier):
  • boost::filesystem replaced with std::filesystem in blockchain_export.cpp, blockchain_import.cpp, cn_deserialize.cpp, util.cpp, bootstrap_file.h/.cpp, and blocksdat_file.h/.cpp.
  • Eliminated BOOST_VERSION preprocessor conditional in copy_file().
• Upstream Monero cherry-pick verification: Confirmed PRs #9628 (ASIO io_service → io_context), #6690 (serialization overhaul), and #9544 (daemonizer chrono/thread) are already absorbed in our tree.
• boost::variant → std::variant (complete): Full migration from boost::variant to C++17 std::variant across the entire codebase (~100+ replacements in ~40 files):
  • Serialization layer rewrite (serialization/variant.h): Replaced Boost.MPL type-list iteration with C++17 if constexpr recursion for deserialization and std::visit lambda for serialization. Removed all boost::mpl, boost::static_visitor, and boost::apply_visitor usage.
  • Archive headers: Replaced boost::mpl::bool_<B> with std::bool_constant<B> in binary_archive.h, json_archive.h, and serialization.h. Replaced boost::true_type/false_type and boost::is_integral with std equivalents.
  • Core typedefs: Changed txin_v, txout_target_v, tx_extra_field, transfer_view::block, and Trezor rsig_v from boost::variant to std::variant.
  • Boost.Serialization shim: Added a local ~45-line std::variant serialization adapter in cryptonote_boost_serialization.h (save/load with index + payload, wire-compatible with old boost::variant format). Removed dependency on <boost/serialization/variant.hpp>.
  • Mechanical replacements across all src/ and tests/ files: boost::get<T>(v) → std::get<T>(v), boost::get<T>(&v) → std::get_if<T>(&v), v.type() == typeid(T) → std::holds_alternative<T>(v), v.which() → v.index(), boost::apply_visitor(vis, v) → std::visit(vis, v).
  • P2P layer: Updated net_peerlist_boost_serialization.h to use std::false_type/std::true_type instead of boost::mpl equivalents.
  • tests/unit_tests/net.cpp retains boost::get<N> for boost::tuple access via boost::combine (not variant-related).
• Remaining deferred Boost areas: ASIO deep plumbing, multi-index containers, Spirit parser, multiprecision, net_ssl.cpp filesystem, simplewallet.cpp format strings, boost::thread::attributes (stack size). Tagged with TODO(shekyl-v4) in source. See DOCUMENTATION_TODOS_AND_PQC.md section 1.11 for the full backlog.

CI/CD and build system

• Boost minimum bumped to 1.74: BOOST_MIN_VER in CMakeLists.txt raised from 1.62 to 1.74. The contrib/depends system now pins Boost 1.74.0 (previously 1.69.0) and builds with -std=c++17. Removed legacy Boost 1.64 patches (fix_aroptions.patch, fix_arm_arch.patch) that do not apply to 1.74.
• CI containers updated to Ubuntu 22.04 minimum: Dropped Debian 11 and Ubuntu 20.04 build jobs from build.yml, depends.yml, and release-tagged.yml. Ubuntu 22.04 is now the lowest-common-denominator Linux build environment (ships Boost 1.74+ and GCC 11+). Added Ubuntu 24.04 build matrix entry.
• Migrated version identifiers from legacy MONERO_* symbols to canonical SHEKYL_* names (SHEKYL_VERSION, SHEKYL_VERSION_TAG, SHEKYL_RELEASE_NAME, SHEKYL_VERSION_FULL, SHEKYL_VERSION_IS_RELEASE) in src/version.h and src/version.cpp.in. The old MONERO_* names are retained as preprocessor aliases so existing call sites and future Monero upstream cherry-picks continue to compile unchanged. The aliases will be removed in a single cleanup after v4 RingPQC stabilises.
• Fixed Gitian deterministic build pipeline: replaced all hardcoded Monero repository URLs and internal package names with Shekyl equivalents across gitian-build.py, all 5 gitian descriptor YAMLs, dockrun.sh, and the gitian.yml GitHub Actions workflow. The workflow now passes --url to ensure the correct repository is cloned. Added checkout error handling with an actionable message when a tag/branch is missing.
• Tag-driven versioning: GitVersion.cmake now extracts the version string from git tags (e.g. v3.0.2-RC1 → 3.0.2-RC1). The hardcoded version in version.cpp.in is replaced with the CMake-substituted @SHEKYL_VERSION@; a default (3.1.0) is used for development builds not on a tag. Version.cmake centralises the fallback default in SHEKYL_VERSION_DEFAULT.
• Updated RPC version string validator (rpc_version_str.cpp) from Monero's four-number format to Shekyl's three-number semver with optional pre-release suffix (e.g. 3.0.2-RC1-release).
• Updated gitian descriptor names from Monero's 0.18 to Shekyl 3 series.
• Added release/tagged GitHub Actions workflow: builds static Linux x86_64 binaries, cross-compiles Windows x64 via MinGW, and produces .tar.gz, .deb, .rpm, .zip, and NSIS .exe installer artifacts on every v* tag.
• Added BuildRust.cmake cross-compilation support: detects CMAKE_SYSTEM_NAME and CMAKE_SYSTEM_PROCESSOR to derive Rust target triples for Windows, macOS, Android, FreeBSD, and Linux cross-targets (ARM, aarch64, i686, RISC-V); automatically configures the MinGW linker for Windows cross-compilation.
• Added Rust toolchain installation to all CI workflows (build.yml, depends.yml, release-tagged.yml) and all 5 Gitian deterministic build descriptors with appropriate cross-compilation targets; required for libshekyl_ffi.a linking.
• Fixed Gitian gitian-build.py to fetch tags explicitly (--tags) during repository setup, preventing checkout failures for tag-based builds.
• Enhanced gitian-build.py error handling: robust lsb_release detection, auto-correction of stale clone origins when --url changes, and detailed diagnostics on checkout failure (lists available remote tags and suggests the push command).
• Added workflow_dispatch trigger to gitian.yml with configurable tag and repo_url inputs, allowing manual re-runs and testing against forks without retagging.
• Fixed Doxygen project name from Monero to Shekyl in cmake/Doxyfile.in.
• Replaced bundled Google Test 1.7.0 (2013) with CMake FetchContent for GoogleTest v1.16.0. Fixes GTEST_SKIP compilation errors on all platforms without a system gtest. Removes 34k lines of vendored source.
• Upgraded all GitHub Actions workflows to Node.js 24: bumped actions/checkout to v5, actions/cache to v5, actions/upload-artifact to v6, and actions/download-artifact to v7 to resolve the Node.js 20 deprecation warnings.
• Trimmed depends.yml cross-compilation matrix: dropped i686 Win and i686 Linux (32-bit targets are dead); deferred RISCV 64-bit and ARM v7 until user demand materialises. Active matrix is now ARM v8, Win64, x86_64 Linux, Cross-Mac x86_64, Cross-Mac aarch64, and x86_64 FreeBSD (6 targets, down from 10). Added Cross-Mac aarch64 to the artifact upload filter.
• Added Linux packaging files: contrib/packaging/linux/shekyld.service (systemd unit) and contrib/packaging/windows/shekyl.nsi (NSIS installer).

Upstream Monero sync (March 2026)

Cherry-picked 62 upstream Monero commits (from monero-project/monero master) across five risk-phased integration rounds. Key improvements absorbed:

• Wallet: Fee priority refactoring (fee_priority enum + utility functions), improved subaddress lookahead logic, set_subaddress_lookahead RPC endpoint (no longer requires password), incoming transfers without daemon connection, HTTP body size limit, fast refresh checkpoint fix, ring index sanity checks, find_and_save_rings() deprecation, pool spend identification during scan.
• Daemon/RPC: Dynamic print_connections column width, ZMQ IPv6 support, dynamic base fee estimates via ZMQ, getblocks.bin start height validation, CryptoNight v1 error reporting, batch key image existence check, blockchain prune DB version handling, removed COMMAND_RPC_SUBMIT_RAW_TX (light wallet deprecated).
• P2P/Network: Removed state_idle connection state, fixed inverted peerlist ternary, removed #pragma pack from protocol defs, connection patches for reliability, dynamic block sync span limits.
• Crypto/Serialization: Fixed invalid constexpr on hash functions, added hash_combine.h, aligned container pod-as-blob serialization, fixed apply_permutation() for std::vector<bool>.
• Build system: Removed iwyu/MSVC/obsolete CMake targets, added MANUAL_SUBMODULES cache option, Trezor protobuf 30 compatibility, fixed FetchContent/ExternalProject cmake usage.
• Tests: New unit tests for format utils, threadpool, varint, logging, serialization static asserts, cold signing functional test fixes.
• Misc: Boost ASIO 1.87+ compatibility, fixed Trezor temporary binding, fixed multisig key exchange intermediate message update, constexpr cn_variant1_check, extra nonce length fix, removed redundant BP consensus rule.

Skipped commits (deferred to future integration): input verification caching (conflicts with txin_stake_claim/PQC), wallet_keys_unlocker refactoring, get_txids_loose DB API (missing prerequisite), complex subaddress lookahead fixes, and several CMake/depends version bumps that conflict with Shekyl's build system divergences.

Cherry-picked code was initially adapted to C++14 compatibility; with the subsequent C++17 standard bump, many of those back-ports are now unnecessary and can use native std::optional, std::string_view, etc.

Documentation

• Added docs/EXECUTABLES.md: comprehensive reference for all 17 build artifacts covering usage, CLI options, interactive commands, and examples for shekyld, shekyl-wallet-cli, shekyl-wallet-rpc, blockchain utilities, and debug tools.

Operations

• Added utils/systemd/shekyld.service for Shekyl-native daemon service deployment (/usr/local/bin/shekyld + /etc/shekyl/shekyld.conf).
• Updated docs/INSTALLATION_GUIDE.md related-doc references to include seed operations documentation in the companion shekyl-dev docs set.
• Added docs/BLOCKCHAIN_NETWORKS.md with a deep-dive comparison of network models across Bitcoin, Ethereum, Monero, Solana, Polkadot, and Avalanche, and mapped those patterns to Shekyl's mainnet/testnet/stagenet/fakechain usage guidance.
• Migrated Shekyl stagenet defaults from legacy Monero ports to 13021 (P2P), 13029 (RPC), and 13025 (ZMQ), and aligned test/docs references so --testnet workflows use 12029 while scripts support overrideable network/daemon variables.
• Updated libwallet API helper scripts to call shekyl-wallet-cli (not monero-wallet-cli) so test tooling matches Shekyl binary names.

Staking (end-to-end claim-based system)

• Added txout_to_staked_key output target type for locking coins at a chosen tier (short/medium/long). Outputs carry lock_tier field enforced at the consensus layer. (Note: lock_until was originally stored on-chain but was removed in a subsequent fix — see Bug 13 under Unreleased.)
• Added txin_stake_claim input type for claiming accrued staking rewards. Claims specify a height range and are validated against deterministic per-block accrual records.
• Extended LMDB schema with staker_accrual and staker_claims tables plus a staker_pool_balance property for on-chain reward pool accounting.
• Per-block accrual logic computes staker emission share and fee pool allocation at block insertion time, with full reversal on reorg (block pop).
• Consensus validation: lock period enforcement on staked outputs, claim amount verification against accrual records, watermark-based anti-double-claim, maximum claim range (10,000 blocks), pool balance sufficiency checks.
• Pure claim transactions (txin_stake_claim-only inputs) use RCTTypeNull signatures, cleanly separated from ring-signature transaction validation.
• Extended tx_destination_entry with is_staking and stake_tier fields. construct_tx_with_tx_key emits txout_to_staked_key outputs when is_staking is set.
• Extended transfer_details with m_staked, m_stake_tier, and m_stake_lock_until for wallet-side staking metadata tracking. (m_stake_lock_until is computed locally from creation_height + tier_lock_blocks.)
• Implemented wallet2 methods: create_staking_transaction, create_unstake_transaction, create_claim_transaction, get_matured_staked_outputs, get_locked_staked_outputs, get_claimable_staked_outputs, get_staked_balance, estimate_claimable_reward.
• Added simplewallet commands: stake <tier> <amount>, unstake, claim_rewards.
• Added wallet RPC endpoints: stake, unstake, get_staked_outputs, claim_rewards.
• Added daemon RPC endpoint: get_staking_info returning current staking metrics (height, stake ratio, pool balance, emission share, tier lock blocks).
• Wired stake_ratio and staker_pool_balance in /get_info to live blockchain state.
• No minimum stake amount enforced (matches design doc).
• Fixed compilation errors from txin_stake_claim missing in exhaustive boost::static_visitor patterns: added operator() overloads to the double-spend visitor (blockchain.cpp) and the JSON serialization visitor (json_object.cpp), added JSON deserialization branch for "stake_claim" inputs, added toJsonValue/fromJsonValue declarations and implementations for txin_stake_claim, and added Boost.Serialization serialize() free function for wallet binary archive support (cryptonote_boost_serialization.h).

Consensus and mining economics

• Wired Four-Component economics to live chain-state inputs for miner reward paths:
  • block template construction now passes rolling tx_volume_avg, circulating_supply, and stake_ratio to construct_miner_tx
  • miner transaction validation now uses the release-multiplier reward path and non-placeholder fee-burn inputs
  • tx pool block template estimation now uses the same rolling tx_volume_avg reward path for consistency
• Added Blockchain::get_tx_volume_avg(height) and Blockchain::get_stake_ratio(height) (stubbed to 0 until staking state is consensus-tracked).

Modular PoW

• Added pluggable PoW schema abstractions:
  • IPowSchema interface
  • RandomX and Cryptonight schema implementations
  • PoW registry-based selection preserving existing behavior by block version
• Refactored get_block_longhash to route through the PoW schema registry while keeping existing RandomX seed handling and the historical block 202612 workaround.
• Updated miner thread preparation to call schema-level prepare_miner_thread(...) (RandomX prepares thread context; Cryptonight is a no-op).