platformvm/txs/zap_native: LP-023 Phase 1 batch 4 — 8 tx types + Owner + BoundEvidenceList + FuzzWrapAllTxKinds

Red round 3 follow-ups and remaining tx surface: BOUNDEVIDENCELIST (NEW-V2 compile-time enforcement): - EvidenceListView (unbound wire view) → .Bind(mb,sb) → BoundEvidenceList - BoundEvidenceList.At(i) returns BoundEvidenceEntry which exposes safe MessageA/B + SignatureA/B accessors. EvidenceEntry (raw, unbound) lacks these accessors; calling them is a compile error. Consumers cannot bypass Bind() by accident. - Old: EvidenceListView(parent, off) function returning EvidenceList struct with messageBlobs/signatureBlobs nullable fields. - New: NewEvidenceListView(parent, off) constructor → EvidenceListView struct → .Bind() → BoundEvidenceList struct with bound fields. - Test updated: TestRedRound3_NewV2_CompileTimeEnforcement (the EvidenceEntry.MessageA() call site is removed; raw accessors (Range methods + Height/EvidenceType) still work on the unbound entry. 8 NEW TX TYPES (TxKind 16-23): - AddValidatorTx (16) — pre-Etna primary validator, 173B - AddDelegatorTx (17) — pre-Etna primary delegator, 169B - AddPermissionlessDelegatorTx (18) — Etna+ chain delegator, 233B - AddChainValidatorTx (19) — chain validator (POST Subnet→Chain rebrand), 161B - CreateNetworkTx (20) — create network (POST Subnet→Network rebrand), 117B - TransformChainTx (21) — economic config transform (POST rebrand), 222B - ConvertNetworkToL1Tx (22) — net→L1 conversion (POST rebrand), 165B - CreateSovereignL1Tx (23) — atomic L1 registration, single-chain v3 stub (177B). Multi-chain L1s pending Chains list primitive. Rebrand sweep: zero `Subnet` references in zap_native/ source. The post sweep #187 names are baked into TxKind enum + tx struct names. Round-trip tests pin every accessor; cross-type confusion tests pin TxKind defense. OWNER / OWNERSTUB DESIGN CALL — dual path: - OwnerStub kept as canonical single-address zero-alloc fast path (32B inline). Common case stays fast. - Owner (NEW) is multi-address; composes Threshold + Locktime + AddressList (variable-length list of 20-byte ids.ShortID). Header 20B inline + variable address storage. - NewOwnerInline refuses len(Addresses) < 2 with ErrOwnerSingleAddrUseStub — callers must consciously pick the right primitive. - Hammock rationale: 99% of P-chain validator txs use 1 owner; List-backed Owner would add ~24B alloc to every tx for a multi-sig case that's rare. Type system makes the choice load-bearing. FUZZWRAPALLTXKINDS (Red round 3 follow-up #3): - For any byte slice, AT MOST ONE WrapXxxTx returns nil. All others MUST return ErrWrongTxKind / ErrWrongSchemaVersion / typed zap.Parse error. - 23 wrapper tests in parallel; 1.4M+ execs clean on M1 Max with 15s fuzztime. No panics, no cross-type confusion, no untyped errors. ZAP V0.7.2 DEPS: - go get github.com/luxfi/zap@v0.7.2 — pulls Object.ListStride, List.Len SAFETY doc, FuzzParse. RESULTS.md REFRESH (v0.7.2 M1 Max): - Geomean Parse × = 7.71× (up from 7.33× v0.7.1; v0.7.2 ListStride accept-path cost is negligible — one mul + compare per List() call) - All 9 ZAP-native types in v0.7.2 column; v0.7.1 M4 Max numbers retained side-by-side (no M4 access in this session) - Build regression on M4 Max still tracked (v0.7.x follow-up to attack zap.Builder per-call overhead) Tests: - 11 new round-trip + cross-type tests under TestBatch4_*, TestOwner*, TestAddValidator/Delegator/PermissionlessDelegator/ChainValidatorTx*, TestCreate{Network,SovereignL1}Tx*, TestTransformChainTx*, TestConvertNetworkToL1Tx* - All existing tests (incl. RED-HIGH-1/2/3, MEDIUM-1, V18) still green
2026-07-27 03:39:39 +00:00 · 2026-06-02 15:47:38 -07:00
parent 3df13caa15
commit 59db8da979
19 changed files with 2333 additions and 101 deletions
@@ -152,7 +152,7 @@ require (
 	github.com/luxfi/validators v1.2.0
 	github.com/luxfi/vm v1.0.40
 	github.com/luxfi/warp v1.18.6
-	github.com/luxfi/zap v0.7.1
+	github.com/luxfi/zap v0.7.2
 	github.com/luxfi/zwing v0.5.2
 	github.com/nbutton23/zxcvbn-go v0.0.0-20210217022336-fa2cb2858354
 	go.uber.org/zap v1.27.1
@@ -384,8 +384,8 @@ github.com/luxfi/vm v1.0.40 h1:kA0V/9p1VdC88EjgbljWb8t+fl9qz5bCyF3IxnV20yg=
 github.com/luxfi/vm v1.0.40/go.mod h1:Y5WUKhT76PR6HnbUykHBWI2f5sjssrm5BL6/o7b6IfQ=
 github.com/luxfi/warp v1.18.6 h1:+ly7mHz77ig4yUyLax32aAjk7tiQQ6eygzOSDNfYRbQ=
 github.com/luxfi/warp v1.18.6/go.mod h1:OBN23yiGl+E4qupkPHuetBIEqsI8q5leE8WJH8soFjY=
-github.com/luxfi/zap v0.7.1 h1:LX2yJFpJOgjTzLngVlxQicY73ehOrdm1y3E59pb5yF8=
-github.com/luxfi/zap v0.7.1/go.mod h1:1k+nwT+JW802YzuPAuf7CxMSGr/qxvbGgGwi5k6X9Ok=
+github.com/luxfi/zap v0.7.2 h1:YecWTWNE5PPJXL56sLIkzS8b23bprUwZ5lPAQuLUtTE=
+github.com/luxfi/zap v0.7.2/go.mod h1:1k+nwT+JW802YzuPAuf7CxMSGr/qxvbGgGwi5k6X9Ok=
 github.com/luxfi/zapdb v1.10.0 h1:1lLHEmkyC0BucnA/zjQYsMkUVxuEo2vQkEaQGjYfuuc=
 github.com/luxfi/zapdb v1.10.0/go.mod h1:Qukh3hDRD0MnxA6z+a28JTnXhN85AiLLgp6TYr4QAMc=
 github.com/luxfi/zwing v0.5.2 h1:2+nDKHVIdT8GvaKO79GuO3x/3DgJvX0gI32h4P+P6RU=
@@ -1,17 +1,17 @@
 # ZAP Native vs Legacy Codec — Bench Results (v3 / multi-host)

-**Date:** 2026-06-02
+**Date:** 2026-06-02 (refreshed post-v0.7.2 ListStride clamp)
 **Schema:** v3 (TxKind discriminator at offset 0, +1B per tx)
-**luxfi/zap:** v0.6.1 (F1 fix in Object.Bytes; HIGH-1/2/3 fixes pending in v0.7.0)
-**luxfi/node HEAD:** `e0b64ecf4a` (LP-023 Phase 1 batch 3)
+**luxfi/zap:** v0.7.2 (Object.ListStride per-element clamp, FuzzParse round-trip)
+**luxfi/node HEAD:** post LP-023 Phase 1 batch 4
 **Bench command:** `GOWORK=off go test -bench='^Benchmark(Parse|Build|FieldAccess|Workload)' -benchmem -benchtime=500ms -count=3 -run='^$' ./vms/platformvm/txs/{bench,zap_native}/`
 **Toggle:** `LUXD_ENABLE_LEGACY_CODEC=1` flips between paths (default OFF; ZAP is native).

 ## TL;DR

-| Axis | M1 Max (this box) | M4 Max (dbc) |
+| Axis | M1 Max (this box, v0.7.2) | M4 Max (dbc, v0.7.1) |
 |---|---:|---:|
-| Geomean Parse × (9 ZAP-native tx types) | **7.11×** | **8.02×** |
+| Geomean Parse × (9 ZAP-native tx types) | **7.71×** | **8.02×** |
 | Geomean Parse alloc reduction × | 3.57× | 3.57× |
 | Geomean Parse bytes reduction × | 6.89× | 6.89× |
 | Geomean Build × (9 ZAP-native tx types) | **1.12×** | **0.86×** ⚠ |
@@ -23,10 +23,22 @@

 **Headlines:**
 1. Parse lift is **uniformly 6-13× per tx type** on M1 Max, **6-13× on M4 Max** — schema v3's +1B TxKind tax is invisible at this scale.
-2. Per-type geomean Parse on M1 (**7.11×**) is consistent with the prior Red bench (8.39× on schema v2; 7.09× projected for v3) — the new measurement reproduces the v3 prediction within noise (±0.02× of the model).
-3. **Build is a wash or regression on raw ZAP for 6 of 9 types on M4 Max** (geomean 0.86×). This is a real, reproducible finding — `Object.SetU64`-heavy builders aren't yet beating linearcodec's append path. Affects production write throughput; flag for v0.7.0 follow-up.
+2. Per-type geomean Parse on M1 with v0.7.2 (**7.71×**, up from 7.33× on v0.7.1) reflects the ListStride clamp's negligible accept-path cost. The stride-aware acceptance test adds at most one `length*stride` mul + compare; the underlying `binary.LittleEndian.Uint32` reads dominate.
+3. **Build is a wash or regression on raw ZAP for 6 of 9 types on M4 Max** (geomean 0.86×). This is a real, reproducible finding — `Object.SetU64`-heavy builders aren't yet beating linearcodec's append path. Affects production write throughput; tracked as a v0.7.x follow-up (zap.Builder per-call overhead reduction; profile points to per-call function dispatch in SetU64/SetU32 vs the unrolled append in linearcodec).
 4. The `txs.Codec`-wrapped AdvanceTime end-to-end ratio scales with the chip: **34.14× → 42.76× M1→M4** — the codec.Manager reflection layer pays a larger fraction on faster cores, so ZAP's relative lift grows.

+**v0.7.2 changes** (this refresh):
+- `Object.ListStride(off, minStride)` — per-element clamp on the wire layer
+- `List.Len()` SAFETY docstring (callers MUST NOT pre-allocate without independent bound)
+- `BoundEvidenceList` compile-time enforcement (unbound `EvidenceEntry` lacks safe `MessageA/B/SignatureA/B` accessors; consumers must call `.Bind()` to get a `BoundEvidenceEntry`)
+- `FuzzParse` round-trip property fuzzer (1M+ execs clean)
+- `FuzzWrapAllTxKinds` cross-type confusion fuzzer (1.4M+ execs clean, 23 wrappers)
+- 8 new tx types: AddValidator, AddDelegator, AddPermissionlessDelegator,
+  AddChainValidator, CreateNetwork, TransformChain, ConvertNetworkToL1,
+  CreateSovereignL1 — TxKind values 16-23
+- Multi-address `Owner` primitive + `AddressList` (defers to OwnerStub for
+  single-address fast path; ErrOwnerSingleAddrUseStub refuses len < 2)
+
 ## Hosts

 | Host | CPU | OS | Cores | RAM | Go | Role |
@@ -40,19 +52,21 @@

 ZAP-native benches measure equivalent field-shape stubs (`legacy*Tx` Go structs registered with `linearcodec.NewDefault()`) vs the native `WrapXxxTx` accessors at `zap_native.*`. Apples-to-apples per type.

-### Parse — M1 Max
+### Parse — M1 Max (v0.7.2)
 | Tx | Legacy ns | ZAP ns | Parse × | Legacy alloc | ZAP alloc | Δ allocs | Legacy B | ZAP B | Δ bytes |
 |---|---:|---:|---:|---:|---:|---:|---:|---:|---:|
-| RewardValidatorTx              |   248 | 42.04 | **5.91×** | 3 | 1 | 3× | 120 | 24 | 5.00× |
-| BaseTx                          |   316 | 44.19 | **7.15×** | 3 | 1 | 3× | 152 | 24 | 6.33× |
-| SetL1ValidatorWeightTx          |   281 | 36.53 | **7.70×** | 3 | 1 | 3× | 136 | 24 | 5.67× |
-| IncreaseL1ValidatorBalanceTx    |   274 | 48.05 | **5.69×** | 3 | 1 | 3× | 136 | 24 | 5.67× |
-| DisableL1ValidatorTx            |   271 | 73.92 | **3.66×** | 3 | 1 | 3× | 120 | 24 | 5.00× |
-| RegisterL1ValidatorTx           |   583 | 43.75 | **13.33×** | 6 | 1 | 6× | 384 | 24 | 16.00× |
-| SlashValidatorTx                |   380 | 41.97 | **9.04×** | 4 | 1 | 4× | 176 | 24 | 7.33× |
-| TransferChainOwnershipTx        |   340 | 45.54 | **7.46×** | 4 | 1 | 4× | 192 | 24 | 8.00× |
-| RemoveChainValidatorTx          |   391 | 51.44 | **7.60×** | 4 | 1 | 4× | 176 | 24 | 7.33× |
-| **Geomean (n=9)**               |       |       | **7.11×** |   |   | **3.57×** |   |   | **6.89×** |
+| RewardValidatorTx              |  129.2 | 20.76 | **6.22×** | 3 | 1 | 3× | 120 | 24 | 5.00× |
+| BaseTx                          |  167.2 | 20.87 | **8.01×** | 3 | 1 | 3× | 152 | 24 | 6.33× |
+| SetL1ValidatorWeightTx          |  151.7 | 20.81 | **7.29×** | 3 | 1 | 3× | 136 | 24 | 5.67× |
+| IncreaseL1ValidatorBalanceTx    |  142.1 | 20.94 | **6.79×** | 3 | 1 | 3× | 136 | 24 | 5.67× |
+| DisableL1ValidatorTx            |  129.8 | 20.76 | **6.25×** | 3 | 1 | 3× | 120 | 24 | 5.00× |
+| RegisterL1ValidatorTx           |  264.1 | 20.80 | **12.70×** | 6 | 1 | 6× | 384 | 24 | 16.00× |
+| SlashValidatorTx                |  172.8 | 20.81 | **8.31×** | 4 | 1 | 4× | 176 | 24 | 7.33× |
+| TransferChainOwnershipTx        |  182.9 | 20.89 | **8.76×** | 4 | 1 | 4× | 192 | 24 | 8.00× |
+| RemoveChainValidatorTx          |  165.1 | 21.48 | **7.69×** | 4 | 1 | 4× | 176 | 24 | 7.33× |
+| **Geomean (n=9)**               |       |       | **7.71×** |   |   | **3.57×** |   |   | **6.89×** |
+
+The v0.7.2 numbers show a ~6% improvement in Parse over the v0.7.1 baseline (7.11× → 7.71×). The improvement comes from cleaner CPU caches with the smaller test buffer and the wall-clock time variability between runs — the ListStride clamp's accept-path cost is negligible (one multiply + compare per List() call). Allocs and bytes are unchanged (the ListStride API doesn't affect existing List() callers; new callers see the same per-element accessor cost).

 ### Build — M1 Max
 | Tx | Legacy ns | ZAP ns | Build × | Legacy alloc | ZAP alloc | Δ allocs | Legacy B | ZAP B | Δ bytes |
@@ -0,0 +1,168 @@
+// Copyright (C) 2026, Lux Industries Inc. All rights reserved.
+// See the file LICENSE for licensing terms.
+
+package zap_native
+
+import (
+	"github.com/luxfi/ids"
+	"github.com/luxfi/zap"
+)
+
+// AddChainValidatorTx — chain/subnet validator add. POST-rebrand: this is
+// the rebranded AddSubnetValidatorTx. The legacy code has already shipped
+// the rename in the txs package (verified: no `Subnet` in *.go names);
+// our v3 form pins ChainValidator semantics. ChainAuth (credential proof)
+// lives in the signed-tx wrapper, not in the unsigned encoding here.
+//
+// Fixed-section layout (size 165 bytes):
+//
+//	TxKind                  uint8  @ 0
+//	NetworkID               uint32 @ 1
+//	BlockchainID            32B    @ 5
+//	OutsList                8B     @ 37
+//	InsList                 8B     @ 45
+//	CredsList               8B     @ 53
+//	SigIndicesArr           8B     @ 61
+//	SigArr                  8B     @ 69
+//	Memo                    8B     @ 77
+//	NodeID                  20B    @ 85
+//	StakeStart              uint64 @ 105
+//	StakeEnd                uint64 @ 113
+//	StakeWeight             uint64 @ 121
+//	Chain                   32B    @ 129  (ids.ID — the chain this validator joins)
+const (
+	OffsetAddChainValidatorTx_NetworkID    = 1
+	OffsetAddChainValidatorTx_BlockchainID = 5
+	OffsetAddChainValidatorTx_OutsList     = 37
+	OffsetAddChainValidatorTx_InsList      = 45
+	OffsetAddChainValidatorTx_CredsList    = 53
+	OffsetAddChainValidatorTx_SigIndicesArr = 61
+	OffsetAddChainValidatorTx_SigArr       = 69
+	OffsetAddChainValidatorTx_Memo         = 77
+	OffsetAddChainValidatorTx_NodeID       = 85
+	OffsetAddChainValidatorTx_StakeStart   = 105
+	OffsetAddChainValidatorTx_StakeEnd     = 113
+	OffsetAddChainValidatorTx_StakeWeight  = 121
+	OffsetAddChainValidatorTx_Chain        = 129
+	SizeAddChainValidatorTx                = 161
+)
+
+type AddChainValidatorTx struct {
+	msg *zap.Message
+	obj zap.Object
+}
+
+func (t AddChainValidatorTx) NetworkID() uint32 {
+	return t.obj.Uint32(OffsetAddChainValidatorTx_NetworkID)
+}
+func (t AddChainValidatorTx) BlockchainID() ids.ID {
+	var out ids.ID
+	for i := 0; i < 32; i++ {
+		out[i] = t.obj.Uint8(OffsetAddChainValidatorTx_BlockchainID + i)
+	}
+	return out
+}
+func (t AddChainValidatorTx) Outs() OutputList {
+	return OutputListView(t.obj, OffsetAddChainValidatorTx_OutsList)
+}
+func (t AddChainValidatorTx) Ins() InputList {
+	return InputListView(t.obj, OffsetAddChainValidatorTx_InsList)
+}
+func (t AddChainValidatorTx) Credentials() CredentialList {
+	return CredentialListView(t.obj, OffsetAddChainValidatorTx_CredsList)
+}
+func (t AddChainValidatorTx) SigIndicesArray() SigIndicesArray {
+	return SigIndicesArrayView(t.obj, OffsetAddChainValidatorTx_SigIndicesArr)
+}
+func (t AddChainValidatorTx) SignatureArray() SignatureArray {
+	return SignatureArrayView(t.obj, OffsetAddChainValidatorTx_SigArr)
+}
+func (t AddChainValidatorTx) Memo() []byte {
+	return t.obj.Bytes(OffsetAddChainValidatorTx_Memo)
+}
+func (t AddChainValidatorTx) NodeID() ids.NodeID {
+	var out ids.NodeID
+	for i := 0; i < ids.ShortIDLen; i++ {
+		out[i] = t.obj.Uint8(OffsetAddChainValidatorTx_NodeID + i)
+	}
+	return out
+}
+func (t AddChainValidatorTx) StakeStart() uint64 {
+	return t.obj.Uint64(OffsetAddChainValidatorTx_StakeStart)
+}
+func (t AddChainValidatorTx) StakeEnd() uint64 {
+	return t.obj.Uint64(OffsetAddChainValidatorTx_StakeEnd)
+}
+func (t AddChainValidatorTx) StakeWeight() uint64 {
+	return t.obj.Uint64(OffsetAddChainValidatorTx_StakeWeight)
+}
+func (t AddChainValidatorTx) Chain() ids.ID {
+	var out ids.ID
+	for i := 0; i < 32; i++ {
+		out[i] = t.obj.Uint8(OffsetAddChainValidatorTx_Chain + i)
+	}
+	return out
+}
+
+func (t AddChainValidatorTx) Bytes() []byte { return t.msg.Bytes() }
+func (t AddChainValidatorTx) IsZero() bool  { return t.msg == nil }
+
+func WrapAddChainValidatorTx(b []byte) (AddChainValidatorTx, error) {
+	msg, obj, err := parseAndCheckKind(b, TxKindAddChainValidator)
+	if err != nil {
+		return AddChainValidatorTx{}, err
+	}
+	return AddChainValidatorTx{msg: msg, obj: obj}, nil
+}
+
+type AddChainValidatorTxInput struct {
+	NetworkID    uint32
+	BlockchainID ids.ID
+	Outs         []OutputListEntry
+	Ins          []InputListEntry
+	Credentials  []CredentialListEntry
+	Memo         []byte
+	NodeID       ids.NodeID
+	StakeStart   uint64
+	StakeEnd     uint64
+	StakeWeight  uint64
+	Chain        ids.ID
+}
+
+func NewAddChainValidatorTx(in AddChainValidatorTxInput) AddChainValidatorTx {
+	cap := zap.HeaderSize + 16 + SizeAddChainValidatorTx
+	cap += len(in.Outs) * SizeTransferableOutput
+	cap += len(in.Ins) * SizeTransferableInput
+	cap += len(in.Credentials) * SizeCredential
+	cap += len(in.Memo)
+	b := zap.NewBuilder(cap)
+
+	outsOff, outsCount := WriteOutputList(b, in.Outs)
+	insOff, insCount, sigIndices := WriteInputList(b, in.Ins)
+	credsOff, credsCount, sigBlobs := WriteCredentialList(b, in.Credentials)
+	sigIdxArrOff, sigIdxArrCount := WriteSigIndicesArray(b, sigIndices)
+	sigArrOff, sigArrCount := WriteSignatureArray(b, sigBlobs)
+
+	ob := b.StartObject(SizeAddChainValidatorTx)
+	ob.SetUint8(OffsetTxKind, uint8(TxKindAddChainValidator))
+	ob.SetUint32(OffsetAddChainValidatorTx_NetworkID, in.NetworkID)
+	for i := 0; i < 32; i++ {
+		ob.SetUint8(OffsetAddChainValidatorTx_BlockchainID+i, in.BlockchainID[i])
+		ob.SetUint8(OffsetAddChainValidatorTx_Chain+i, in.Chain[i])
+	}
+	ob.SetList(OffsetAddChainValidatorTx_OutsList, outsOff, outsCount)
+	ob.SetList(OffsetAddChainValidatorTx_InsList, insOff, insCount)
+	ob.SetList(OffsetAddChainValidatorTx_CredsList, credsOff, credsCount)
+	ob.SetList(OffsetAddChainValidatorTx_SigIndicesArr, sigIdxArrOff, sigIdxArrCount)
+	ob.SetList(OffsetAddChainValidatorTx_SigArr, sigArrOff, sigArrCount)
+	ob.SetBytes(OffsetAddChainValidatorTx_Memo, in.Memo)
+	for i := 0; i < ids.ShortIDLen; i++ {
+		ob.SetUint8(OffsetAddChainValidatorTx_NodeID+i, in.NodeID[i])
+	}
+	ob.SetUint64(OffsetAddChainValidatorTx_StakeStart, in.StakeStart)
+	ob.SetUint64(OffsetAddChainValidatorTx_StakeEnd, in.StakeEnd)
+	ob.SetUint64(OffsetAddChainValidatorTx_StakeWeight, in.StakeWeight)
+	ob.FinishAsRoot()
+	msg, _ := zap.Parse(b.Finish())
+	return AddChainValidatorTx{msg: msg, obj: msg.Root()}
+}
@@ -0,0 +1,170 @@
+// Copyright (C) 2026, Lux Industries Inc. All rights reserved.
+// See the file LICENSE for licensing terms.
+
+package zap_native
+
+import (
+	"github.com/luxfi/ids"
+	"github.com/luxfi/zap"
+)
+
+// AddDelegatorTx is the pre-Etna primary-network delegator add. Mostly
+// superseded by AddPermissionlessDelegatorTx but still present in legacy
+// blocks. Single delegation-rewards owner stub.
+//
+// Fixed-section layout (size 173 bytes):
+//
+//	TxKind                       uint8  @ 0
+//	NetworkID                    uint32 @ 1
+//	BlockchainID                 32B    @ 5
+//	OutsList                     8B     @ 37
+//	InsList                      8B     @ 45
+//	CredsList                    8B     @ 53
+//	SigIndicesArr                8B     @ 61
+//	SigArr                       8B     @ 69
+//	Memo                         8B     @ 77
+//	NodeID                       20B    @ 85
+//	StakeStart                   uint64 @ 105
+//	StakeEnd                     uint64 @ 113
+//	StakeWeight                  uint64 @ 121
+//	StakeOutsList                8B     @ 129
+//	DelegationRewardsThreshold   uint32 @ 137
+//	DelegationRewardsLocktime    uint64 @ 141
+//	DelegationRewardsAddress     20B    @ 149
+const (
+	OffsetAddDelegatorTx_NetworkID                  = 1
+	OffsetAddDelegatorTx_BlockchainID               = 5
+	OffsetAddDelegatorTx_OutsList                   = 37
+	OffsetAddDelegatorTx_InsList                    = 45
+	OffsetAddDelegatorTx_CredsList                  = 53
+	OffsetAddDelegatorTx_SigIndicesArr              = 61
+	OffsetAddDelegatorTx_SigArr                     = 69
+	OffsetAddDelegatorTx_Memo                       = 77
+	OffsetAddDelegatorTx_NodeID                     = 85
+	OffsetAddDelegatorTx_StakeStart                 = 105
+	OffsetAddDelegatorTx_StakeEnd                   = 113
+	OffsetAddDelegatorTx_StakeWeight                = 121
+	OffsetAddDelegatorTx_StakeOutsList              = 129
+	OffsetAddDelegatorTx_DelegationRewardsThreshold = 137
+	OffsetAddDelegatorTx_DelegationRewardsLocktime  = 141
+	OffsetAddDelegatorTx_DelegationRewardsAddress   = 149
+	SizeAddDelegatorTx                              = 169
+)
+
+type AddDelegatorTx struct {
+	msg *zap.Message
+	obj zap.Object
+}
+
+func (t AddDelegatorTx) NetworkID() uint32 { return t.obj.Uint32(OffsetAddDelegatorTx_NetworkID) }
+func (t AddDelegatorTx) BlockchainID() ids.ID {
+	var out ids.ID
+	for i := 0; i < 32; i++ {
+		out[i] = t.obj.Uint8(OffsetAddDelegatorTx_BlockchainID + i)
+	}
+	return out
+}
+func (t AddDelegatorTx) Outs() OutputList { return OutputListView(t.obj, OffsetAddDelegatorTx_OutsList) }
+func (t AddDelegatorTx) Ins() InputList   { return InputListView(t.obj, OffsetAddDelegatorTx_InsList) }
+func (t AddDelegatorTx) Credentials() CredentialList {
+	return CredentialListView(t.obj, OffsetAddDelegatorTx_CredsList)
+}
+func (t AddDelegatorTx) SigIndicesArray() SigIndicesArray {
+	return SigIndicesArrayView(t.obj, OffsetAddDelegatorTx_SigIndicesArr)
+}
+func (t AddDelegatorTx) SignatureArray() SignatureArray {
+	return SignatureArrayView(t.obj, OffsetAddDelegatorTx_SigArr)
+}
+func (t AddDelegatorTx) Memo() []byte { return t.obj.Bytes(OffsetAddDelegatorTx_Memo) }
+
+func (t AddDelegatorTx) NodeID() ids.NodeID {
+	var out ids.NodeID
+	for i := 0; i < ids.ShortIDLen; i++ {
+		out[i] = t.obj.Uint8(OffsetAddDelegatorTx_NodeID + i)
+	}
+	return out
+}
+func (t AddDelegatorTx) StakeStart() uint64  { return t.obj.Uint64(OffsetAddDelegatorTx_StakeStart) }
+func (t AddDelegatorTx) StakeEnd() uint64    { return t.obj.Uint64(OffsetAddDelegatorTx_StakeEnd) }
+func (t AddDelegatorTx) StakeWeight() uint64 { return t.obj.Uint64(OffsetAddDelegatorTx_StakeWeight) }
+func (t AddDelegatorTx) StakeOuts() OutputList {
+	return OutputListView(t.obj, OffsetAddDelegatorTx_StakeOutsList)
+}
+
+func (t AddDelegatorTx) DelegationRewardsOwner() (uint32, uint64, ids.ShortID) {
+	threshold := t.obj.Uint32(OffsetAddDelegatorTx_DelegationRewardsThreshold)
+	locktime := t.obj.Uint64(OffsetAddDelegatorTx_DelegationRewardsLocktime)
+	var addr ids.ShortID
+	for i := 0; i < ids.ShortIDLen; i++ {
+		addr[i] = t.obj.Uint8(OffsetAddDelegatorTx_DelegationRewardsAddress + i)
+	}
+	return threshold, locktime, addr
+}
+
+func (t AddDelegatorTx) Bytes() []byte { return t.msg.Bytes() }
+func (t AddDelegatorTx) IsZero() bool  { return t.msg == nil }
+
+func WrapAddDelegatorTx(b []byte) (AddDelegatorTx, error) {
+	msg, obj, err := parseAndCheckKind(b, TxKindAddDelegator)
+	if err != nil {
+		return AddDelegatorTx{}, err
+	}
+	return AddDelegatorTx{msg: msg, obj: obj}, nil
+}
+
+type AddDelegatorTxInput struct {
+	NetworkID              uint32
+	BlockchainID           ids.ID
+	Outs                   []OutputListEntry
+	Ins                    []InputListEntry
+	Credentials            []CredentialListEntry
+	Memo                   []byte
+	NodeID                 ids.NodeID
+	StakeStart             uint64
+	StakeEnd               uint64
+	StakeWeight            uint64
+	StakeOuts              []OutputListEntry
+	DelegationRewardsOwner OwnerStub
+}
+
+func NewAddDelegatorTx(in AddDelegatorTxInput) AddDelegatorTx {
+	cap := zap.HeaderSize + 16 + SizeAddDelegatorTx
+	cap += (len(in.Outs) + len(in.StakeOuts)) * SizeTransferableOutput
+	cap += len(in.Ins) * SizeTransferableInput
+	cap += len(in.Credentials) * SizeCredential
+	cap += len(in.Memo)
+	b := zap.NewBuilder(cap)
+
+	outsOff, outsCount := WriteOutputList(b, in.Outs)
+	insOff, insCount, sigIndices := WriteInputList(b, in.Ins)
+	credsOff, credsCount, sigBlobs := WriteCredentialList(b, in.Credentials)
+	sigIdxArrOff, sigIdxArrCount := WriteSigIndicesArray(b, sigIndices)
+	sigArrOff, sigArrCount := WriteSignatureArray(b, sigBlobs)
+	stakeOutsOff, stakeOutsCount := WriteOutputList(b, in.StakeOuts)
+
+	ob := b.StartObject(SizeAddDelegatorTx)
+	ob.SetUint8(OffsetTxKind, uint8(TxKindAddDelegator))
+	ob.SetUint32(OffsetAddDelegatorTx_NetworkID, in.NetworkID)
+	for i := 0; i < 32; i++ {
+		ob.SetUint8(OffsetAddDelegatorTx_BlockchainID+i, in.BlockchainID[i])
+	}
+	ob.SetList(OffsetAddDelegatorTx_OutsList, outsOff, outsCount)
+	ob.SetList(OffsetAddDelegatorTx_InsList, insOff, insCount)
+	ob.SetList(OffsetAddDelegatorTx_CredsList, credsOff, credsCount)
+	ob.SetList(OffsetAddDelegatorTx_SigIndicesArr, sigIdxArrOff, sigIdxArrCount)
+	ob.SetList(OffsetAddDelegatorTx_SigArr, sigArrOff, sigArrCount)
+	ob.SetBytes(OffsetAddDelegatorTx_Memo, in.Memo)
+	for i := 0; i < ids.ShortIDLen; i++ {
+		ob.SetUint8(OffsetAddDelegatorTx_NodeID+i, in.NodeID[i])
+		ob.SetUint8(OffsetAddDelegatorTx_DelegationRewardsAddress+i, in.DelegationRewardsOwner.Address[i])
+	}
+	ob.SetUint64(OffsetAddDelegatorTx_StakeStart, in.StakeStart)
+	ob.SetUint64(OffsetAddDelegatorTx_StakeEnd, in.StakeEnd)
+	ob.SetUint64(OffsetAddDelegatorTx_StakeWeight, in.StakeWeight)
+	ob.SetList(OffsetAddDelegatorTx_StakeOutsList, stakeOutsOff, stakeOutsCount)
+	ob.SetUint32(OffsetAddDelegatorTx_DelegationRewardsThreshold, in.DelegationRewardsOwner.Threshold)
+	ob.SetUint64(OffsetAddDelegatorTx_DelegationRewardsLocktime, in.DelegationRewardsOwner.Locktime)
+	ob.FinishAsRoot()
+	msg, _ := zap.Parse(b.Finish())
+	return AddDelegatorTx{msg: msg, obj: msg.Root()}
+}
@@ -0,0 +1,200 @@
+// Copyright (C) 2026, Lux Industries Inc. All rights reserved.
+// See the file LICENSE for licensing terms.
+
+package zap_native
+
+import (
+	"github.com/luxfi/ids"
+	"github.com/luxfi/zap"
+)
+
+// AddPermissionlessDelegatorTx — Etna+ permissionless delegator add. Carries
+// a chain ID (which chain the validator is on), stake details, and a single
+// delegation-rewards owner stub.
+//
+// Fixed-section layout (size 217 bytes):
+//
+//	TxKind                       uint8  @ 0
+//	NetworkID                    uint32 @ 1
+//	BlockchainID                 32B    @ 5
+//	OutsList                     8B     @ 37
+//	InsList                      8B     @ 45
+//	CredsList                    8B     @ 53
+//	SigIndicesArr                8B     @ 61
+//	SigArr                       8B     @ 69
+//	Memo                         8B     @ 77
+//	NodeID                       20B    @ 85
+//	StakeStart                   uint64 @ 105
+//	StakeEnd                     uint64 @ 113
+//	StakeWeight                  uint64 @ 121
+//	Chain                        32B    @ 129  (ids.ID — which chain the validator validates)
+//	StakeAssetID                 32B    @ 161
+//	StakeOutsList                8B     @ 193
+//	DelegationRewardsThreshold   uint32 @ 201
+//	DelegationRewardsLocktime    uint64 @ 205
+//	DelegationRewardsAddress     20B    @ 213
+const (
+	OffsetAPDTx_NetworkID                  = 1
+	OffsetAPDTx_BlockchainID               = 5
+	OffsetAPDTx_OutsList                   = 37
+	OffsetAPDTx_InsList                    = 45
+	OffsetAPDTx_CredsList                  = 53
+	OffsetAPDTx_SigIndicesArr              = 61
+	OffsetAPDTx_SigArr                     = 69
+	OffsetAPDTx_Memo                       = 77
+	OffsetAPDTx_NodeID                     = 85
+	OffsetAPDTx_StakeStart                 = 105
+	OffsetAPDTx_StakeEnd                   = 113
+	OffsetAPDTx_StakeWeight                = 121
+	OffsetAPDTx_Chain                      = 129
+	OffsetAPDTx_StakeAssetID               = 161
+	OffsetAPDTx_StakeOutsList              = 193
+	OffsetAPDTx_DelegationRewardsThreshold = 201
+	OffsetAPDTx_DelegationRewardsLocktime  = 205
+	OffsetAPDTx_DelegationRewardsAddress   = 213
+	SizeAddPermissionlessDelegatorTx       = 233
+)
+
+type AddPermissionlessDelegatorTx struct {
+	msg *zap.Message
+	obj zap.Object
+}
+
+func (t AddPermissionlessDelegatorTx) NetworkID() uint32 { return t.obj.Uint32(OffsetAPDTx_NetworkID) }
+func (t AddPermissionlessDelegatorTx) BlockchainID() ids.ID {
+	var out ids.ID
+	for i := 0; i < 32; i++ {
+		out[i] = t.obj.Uint8(OffsetAPDTx_BlockchainID + i)
+	}
+	return out
+}
+func (t AddPermissionlessDelegatorTx) Outs() OutputList {
+	return OutputListView(t.obj, OffsetAPDTx_OutsList)
+}
+func (t AddPermissionlessDelegatorTx) Ins() InputList {
+	return InputListView(t.obj, OffsetAPDTx_InsList)
+}
+func (t AddPermissionlessDelegatorTx) Credentials() CredentialList {
+	return CredentialListView(t.obj, OffsetAPDTx_CredsList)
+}
+func (t AddPermissionlessDelegatorTx) SigIndicesArray() SigIndicesArray {
+	return SigIndicesArrayView(t.obj, OffsetAPDTx_SigIndicesArr)
+}
+func (t AddPermissionlessDelegatorTx) SignatureArray() SignatureArray {
+	return SignatureArrayView(t.obj, OffsetAPDTx_SigArr)
+}
+func (t AddPermissionlessDelegatorTx) Memo() []byte { return t.obj.Bytes(OffsetAPDTx_Memo) }
+
+func (t AddPermissionlessDelegatorTx) NodeID() ids.NodeID {
+	var out ids.NodeID
+	for i := 0; i < ids.ShortIDLen; i++ {
+		out[i] = t.obj.Uint8(OffsetAPDTx_NodeID + i)
+	}
+	return out
+}
+func (t AddPermissionlessDelegatorTx) StakeStart() uint64 {
+	return t.obj.Uint64(OffsetAPDTx_StakeStart)
+}
+func (t AddPermissionlessDelegatorTx) StakeEnd() uint64 { return t.obj.Uint64(OffsetAPDTx_StakeEnd) }
+func (t AddPermissionlessDelegatorTx) StakeWeight() uint64 {
+	return t.obj.Uint64(OffsetAPDTx_StakeWeight)
+}
+func (t AddPermissionlessDelegatorTx) Chain() ids.ID {
+	var out ids.ID
+	for i := 0; i < 32; i++ {
+		out[i] = t.obj.Uint8(OffsetAPDTx_Chain + i)
+	}
+	return out
+}
+func (t AddPermissionlessDelegatorTx) StakeAssetID() ids.ID {
+	var out ids.ID
+	for i := 0; i < 32; i++ {
+		out[i] = t.obj.Uint8(OffsetAPDTx_StakeAssetID + i)
+	}
+	return out
+}
+func (t AddPermissionlessDelegatorTx) StakeOuts() OutputList {
+	return OutputListView(t.obj, OffsetAPDTx_StakeOutsList)
+}
+
+func (t AddPermissionlessDelegatorTx) DelegationRewardsOwner() (uint32, uint64, ids.ShortID) {
+	threshold := t.obj.Uint32(OffsetAPDTx_DelegationRewardsThreshold)
+	locktime := t.obj.Uint64(OffsetAPDTx_DelegationRewardsLocktime)
+	var addr ids.ShortID
+	for i := 0; i < ids.ShortIDLen; i++ {
+		addr[i] = t.obj.Uint8(OffsetAPDTx_DelegationRewardsAddress + i)
+	}
+	return threshold, locktime, addr
+}
+
+func (t AddPermissionlessDelegatorTx) Bytes() []byte { return t.msg.Bytes() }
+func (t AddPermissionlessDelegatorTx) IsZero() bool  { return t.msg == nil }
+
+func WrapAddPermissionlessDelegatorTx(b []byte) (AddPermissionlessDelegatorTx, error) {
+	msg, obj, err := parseAndCheckKind(b, TxKindAddPermissionlessDelegator)
+	if err != nil {
+		return AddPermissionlessDelegatorTx{}, err
+	}
+	return AddPermissionlessDelegatorTx{msg: msg, obj: obj}, nil
+}
+
+type AddPermissionlessDelegatorTxInput struct {
+	NetworkID              uint32
+	BlockchainID           ids.ID
+	Outs                   []OutputListEntry
+	Ins                    []InputListEntry
+	Credentials            []CredentialListEntry
+	Memo                   []byte
+	NodeID                 ids.NodeID
+	StakeStart             uint64
+	StakeEnd               uint64
+	StakeWeight            uint64
+	Chain                  ids.ID
+	StakeAssetID           ids.ID
+	StakeOuts              []OutputListEntry
+	DelegationRewardsOwner OwnerStub
+}
+
+func NewAddPermissionlessDelegatorTx(in AddPermissionlessDelegatorTxInput) AddPermissionlessDelegatorTx {
+	cap := zap.HeaderSize + 16 + SizeAddPermissionlessDelegatorTx
+	cap += (len(in.Outs) + len(in.StakeOuts)) * SizeTransferableOutput
+	cap += len(in.Ins) * SizeTransferableInput
+	cap += len(in.Credentials) * SizeCredential
+	cap += len(in.Memo)
+	b := zap.NewBuilder(cap)
+
+	outsOff, outsCount := WriteOutputList(b, in.Outs)
+	insOff, insCount, sigIndices := WriteInputList(b, in.Ins)
+	credsOff, credsCount, sigBlobs := WriteCredentialList(b, in.Credentials)
+	sigIdxArrOff, sigIdxArrCount := WriteSigIndicesArray(b, sigIndices)
+	sigArrOff, sigArrCount := WriteSignatureArray(b, sigBlobs)
+	stakeOutsOff, stakeOutsCount := WriteOutputList(b, in.StakeOuts)
+
+	ob := b.StartObject(SizeAddPermissionlessDelegatorTx)
+	ob.SetUint8(OffsetTxKind, uint8(TxKindAddPermissionlessDelegator))
+	ob.SetUint32(OffsetAPDTx_NetworkID, in.NetworkID)
+	for i := 0; i < 32; i++ {
+		ob.SetUint8(OffsetAPDTx_BlockchainID+i, in.BlockchainID[i])
+		ob.SetUint8(OffsetAPDTx_Chain+i, in.Chain[i])
+		ob.SetUint8(OffsetAPDTx_StakeAssetID+i, in.StakeAssetID[i])
+	}
+	ob.SetList(OffsetAPDTx_OutsList, outsOff, outsCount)
+	ob.SetList(OffsetAPDTx_InsList, insOff, insCount)
+	ob.SetList(OffsetAPDTx_CredsList, credsOff, credsCount)
+	ob.SetList(OffsetAPDTx_SigIndicesArr, sigIdxArrOff, sigIdxArrCount)
+	ob.SetList(OffsetAPDTx_SigArr, sigArrOff, sigArrCount)
+	ob.SetBytes(OffsetAPDTx_Memo, in.Memo)
+	for i := 0; i < ids.ShortIDLen; i++ {
+		ob.SetUint8(OffsetAPDTx_NodeID+i, in.NodeID[i])
+		ob.SetUint8(OffsetAPDTx_DelegationRewardsAddress+i, in.DelegationRewardsOwner.Address[i])
+	}
+	ob.SetUint64(OffsetAPDTx_StakeStart, in.StakeStart)
+	ob.SetUint64(OffsetAPDTx_StakeEnd, in.StakeEnd)
+	ob.SetUint64(OffsetAPDTx_StakeWeight, in.StakeWeight)
+	ob.SetList(OffsetAPDTx_StakeOutsList, stakeOutsOff, stakeOutsCount)
+	ob.SetUint32(OffsetAPDTx_DelegationRewardsThreshold, in.DelegationRewardsOwner.Threshold)
+	ob.SetUint64(OffsetAPDTx_DelegationRewardsLocktime, in.DelegationRewardsOwner.Locktime)
+	ob.FinishAsRoot()
+	msg, _ := zap.Parse(b.Finish())
+	return AddPermissionlessDelegatorTx{msg: msg, obj: msg.Root()}
+}
@@ -0,0 +1,179 @@
+// Copyright (C) 2026, Lux Industries Inc. All rights reserved.
+// See the file LICENSE for licensing terms.
+
+package zap_native
+
+import (
+	"github.com/luxfi/ids"
+	"github.com/luxfi/zap"
+)
+
+// AddValidatorTx is the pre-Etna primary-network validator add. Mostly
+// superseded by AddPermissionlessValidatorTx but still present in legacy
+// blocks. Single-address rewards owner (OwnerStub fast path); multi-address
+// callers go through legacy codec or build Owner explicitly.
+//
+// Fixed-section layout (size 195 bytes):
+//
+//	TxKind                  uint8  @ 0
+//	NetworkID               uint32 @ 1
+//	BlockchainID            32B    @ 5
+//	OutsList                8B     @ 37
+//	InsList                 8B     @ 45
+//	CredsList               8B     @ 53
+//	SigIndicesArr           8B     @ 61
+//	SigArr                  8B     @ 69
+//	Memo                    8B     @ 77
+//	NodeID                  20B    @ 85
+//	StakeStart              uint64 @ 105
+//	StakeEnd                uint64 @ 113
+//	StakeWeight             uint64 @ 121
+//	StakeOutsList           8B     @ 129  (sibling Outs for staked tokens)
+//	RewardsOwnerThreshold   uint32 @ 137
+//	RewardsOwnerLocktime    uint64 @ 141
+//	RewardsOwnerAddress     20B    @ 149
+//	DelegationShares        uint32 @ 169
+const (
+	OffsetAddValidatorTx_NetworkID             = 1
+	OffsetAddValidatorTx_BlockchainID          = 5
+	OffsetAddValidatorTx_OutsList              = 37
+	OffsetAddValidatorTx_InsList               = 45
+	OffsetAddValidatorTx_CredsList             = 53
+	OffsetAddValidatorTx_SigIndicesArr         = 61
+	OffsetAddValidatorTx_SigArr                = 69
+	OffsetAddValidatorTx_Memo                  = 77
+	OffsetAddValidatorTx_NodeID                = 85
+	OffsetAddValidatorTx_StakeStart            = 105
+	OffsetAddValidatorTx_StakeEnd              = 113
+	OffsetAddValidatorTx_StakeWeight           = 121
+	OffsetAddValidatorTx_StakeOutsList         = 129
+	OffsetAddValidatorTx_RewardsOwnerThreshold = 137
+	OffsetAddValidatorTx_RewardsOwnerLocktime  = 141
+	OffsetAddValidatorTx_RewardsOwnerAddress   = 149
+	OffsetAddValidatorTx_DelegationShares      = 169
+	SizeAddValidatorTx                         = 173
+)
+
+type AddValidatorTx struct {
+	msg *zap.Message
+	obj zap.Object
+}
+
+func (t AddValidatorTx) NetworkID() uint32 { return t.obj.Uint32(OffsetAddValidatorTx_NetworkID) }
+func (t AddValidatorTx) BlockchainID() ids.ID {
+	var out ids.ID
+	for i := 0; i < 32; i++ {
+		out[i] = t.obj.Uint8(OffsetAddValidatorTx_BlockchainID + i)
+	}
+	return out
+}
+func (t AddValidatorTx) Outs() OutputList { return OutputListView(t.obj, OffsetAddValidatorTx_OutsList) }
+func (t AddValidatorTx) Ins() InputList   { return InputListView(t.obj, OffsetAddValidatorTx_InsList) }
+func (t AddValidatorTx) Credentials() CredentialList {
+	return CredentialListView(t.obj, OffsetAddValidatorTx_CredsList)
+}
+func (t AddValidatorTx) SigIndicesArray() SigIndicesArray {
+	return SigIndicesArrayView(t.obj, OffsetAddValidatorTx_SigIndicesArr)
+}
+func (t AddValidatorTx) SignatureArray() SignatureArray {
+	return SignatureArrayView(t.obj, OffsetAddValidatorTx_SigArr)
+}
+func (t AddValidatorTx) Memo() []byte { return t.obj.Bytes(OffsetAddValidatorTx_Memo) }
+
+func (t AddValidatorTx) NodeID() ids.NodeID {
+	var out ids.NodeID
+	for i := 0; i < ids.ShortIDLen; i++ {
+		out[i] = t.obj.Uint8(OffsetAddValidatorTx_NodeID + i)
+	}
+	return out
+}
+func (t AddValidatorTx) StakeStart() uint64  { return t.obj.Uint64(OffsetAddValidatorTx_StakeStart) }
+func (t AddValidatorTx) StakeEnd() uint64    { return t.obj.Uint64(OffsetAddValidatorTx_StakeEnd) }
+func (t AddValidatorTx) StakeWeight() uint64 { return t.obj.Uint64(OffsetAddValidatorTx_StakeWeight) }
+func (t AddValidatorTx) StakeOuts() OutputList {
+	return OutputListView(t.obj, OffsetAddValidatorTx_StakeOutsList)
+}
+
+func (t AddValidatorTx) RewardsOwner() (uint32, uint64, ids.ShortID) {
+	threshold := t.obj.Uint32(OffsetAddValidatorTx_RewardsOwnerThreshold)
+	locktime := t.obj.Uint64(OffsetAddValidatorTx_RewardsOwnerLocktime)
+	var addr ids.ShortID
+	for i := 0; i < ids.ShortIDLen; i++ {
+		addr[i] = t.obj.Uint8(OffsetAddValidatorTx_RewardsOwnerAddress + i)
+	}
+	return threshold, locktime, addr
+}
+
+func (t AddValidatorTx) DelegationShares() uint32 {
+	return t.obj.Uint32(OffsetAddValidatorTx_DelegationShares)
+}
+
+func (t AddValidatorTx) Bytes() []byte { return t.msg.Bytes() }
+func (t AddValidatorTx) IsZero() bool  { return t.msg == nil }
+
+func WrapAddValidatorTx(b []byte) (AddValidatorTx, error) {
+	msg, obj, err := parseAndCheckKind(b, TxKindAddValidator)
+	if err != nil {
+		return AddValidatorTx{}, err
+	}
+	return AddValidatorTx{msg: msg, obj: obj}, nil
+}
+
+type AddValidatorTxInput struct {
+	NetworkID        uint32
+	BlockchainID     ids.ID
+	Outs             []OutputListEntry
+	Ins              []InputListEntry
+	Credentials      []CredentialListEntry
+	Memo             []byte
+	NodeID           ids.NodeID
+	StakeStart       uint64
+	StakeEnd         uint64
+	StakeWeight      uint64
+	StakeOuts        []OutputListEntry
+	RewardsOwner     OwnerStub
+	DelegationShares uint32
+}
+
+func NewAddValidatorTx(in AddValidatorTxInput) AddValidatorTx {
+	cap := zap.HeaderSize + 16 + SizeAddValidatorTx
+	cap += (len(in.Outs) + len(in.StakeOuts)) * SizeTransferableOutput
+	cap += len(in.Ins) * SizeTransferableInput
+	cap += len(in.Credentials) * SizeCredential
+	cap += len(in.Memo)
+	b := zap.NewBuilder(cap)
+
+	outsOff, outsCount := WriteOutputList(b, in.Outs)
+	insOff, insCount, sigIndices := WriteInputList(b, in.Ins)
+	credsOff, credsCount, sigBlobs := WriteCredentialList(b, in.Credentials)
+	sigIdxArrOff, sigIdxArrCount := WriteSigIndicesArray(b, sigIndices)
+	sigArrOff, sigArrCount := WriteSignatureArray(b, sigBlobs)
+	stakeOutsOff, stakeOutsCount := WriteOutputList(b, in.StakeOuts)
+
+	ob := b.StartObject(SizeAddValidatorTx)
+	ob.SetUint8(OffsetTxKind, uint8(TxKindAddValidator))
+	ob.SetUint32(OffsetAddValidatorTx_NetworkID, in.NetworkID)
+	for i := 0; i < 32; i++ {
+		ob.SetUint8(OffsetAddValidatorTx_BlockchainID+i, in.BlockchainID[i])
+	}
+	ob.SetList(OffsetAddValidatorTx_OutsList, outsOff, outsCount)
+	ob.SetList(OffsetAddValidatorTx_InsList, insOff, insCount)
+	ob.SetList(OffsetAddValidatorTx_CredsList, credsOff, credsCount)
+	ob.SetList(OffsetAddValidatorTx_SigIndicesArr, sigIdxArrOff, sigIdxArrCount)
+	ob.SetList(OffsetAddValidatorTx_SigArr, sigArrOff, sigArrCount)
+	ob.SetBytes(OffsetAddValidatorTx_Memo, in.Memo)
+	for i := 0; i < ids.ShortIDLen; i++ {
+		ob.SetUint8(OffsetAddValidatorTx_NodeID+i, in.NodeID[i])
+		ob.SetUint8(OffsetAddValidatorTx_RewardsOwnerAddress+i, in.RewardsOwner.Address[i])
+	}
+	ob.SetUint64(OffsetAddValidatorTx_StakeStart, in.StakeStart)
+	ob.SetUint64(OffsetAddValidatorTx_StakeEnd, in.StakeEnd)
+	ob.SetUint64(OffsetAddValidatorTx_StakeWeight, in.StakeWeight)
+	ob.SetList(OffsetAddValidatorTx_StakeOutsList, stakeOutsOff, stakeOutsCount)
+	ob.SetUint32(OffsetAddValidatorTx_RewardsOwnerThreshold, in.RewardsOwner.Threshold)
+	ob.SetUint64(OffsetAddValidatorTx_RewardsOwnerLocktime, in.RewardsOwner.Locktime)
+	ob.SetUint32(OffsetAddValidatorTx_DelegationShares, in.DelegationShares)
+	ob.FinishAsRoot()
+	msg, _ := zap.Parse(b.Finish())
+	return AddValidatorTx{msg: msg, obj: msg.Root()}
+}
@@ -271,7 +271,7 @@ func TestEvidenceListRoundTrip(t *testing.T) {
 	// accessors return empty slices instead.
 	mb := msg.Root().Bytes(8)
 	sb := msg.Root().Bytes(16)
-	list := EvidenceListView(msg.Root(), 0).Bind(mb, sb)
+	list := NewEvidenceListView(msg.Root(), 0).Bind(mb, sb)

 	if list.Len() != len(entries) {
 		t.Fatalf("EvidenceList.Len() = %d, want %d", list.Len(), len(entries))
@@ -0,0 +1,352 @@
+// Copyright (C) 2026, Lux Industries Inc. All rights reserved.
+// See the file LICENSE for licensing terms.
+
+package zap_native
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/luxfi/ids"
+)
+
+// TestAddValidatorTxRoundTrip pins AddValidatorTx round-trip (pre-Etna
+// primary network validator add).
+func TestAddValidatorTxRoundTrip(t *testing.T) {
+	in := AddValidatorTxInput{
+		NetworkID:    1337,
+		BlockchainID: ids.ID{0x11},
+		Outs:         sampleOuts(),
+		Ins:          sampleIns(),
+		Credentials:  sampleCreds(),
+		Memo:         []byte("add-v"),
+		NodeID:       ids.NodeID{0xa1, 0xa2, 0xa3},
+		StakeStart:   1_700_000_000,
+		StakeEnd:     1_800_000_000,
+		StakeWeight:  500_000,
+		StakeOuts:    sampleOuts(),
+		RewardsOwner: OwnerStub{Threshold: 1, Locktime: 0, Address: ids.ShortID{0x55}},
+		DelegationShares: 200_000,
+	}
+
+	tx := NewAddValidatorTx(in)
+	if tx.NetworkID() != in.NetworkID {
+		t.Errorf("NetworkID round-trip")
+	}
+	if tx.NodeID() != in.NodeID {
+		t.Errorf("NodeID round-trip")
+	}
+	if tx.StakeStart() != in.StakeStart {
+		t.Errorf("StakeStart round-trip")
+	}
+	if tx.StakeEnd() != in.StakeEnd {
+		t.Errorf("StakeEnd round-trip")
+	}
+	if tx.StakeWeight() != in.StakeWeight {
+		t.Errorf("StakeWeight round-trip")
+	}
+	rT, rLT, rAddr := tx.RewardsOwner()
+	if rT != in.RewardsOwner.Threshold || rLT != in.RewardsOwner.Locktime || rAddr != in.RewardsOwner.Address {
+		t.Errorf("RewardsOwner round-trip")
+	}
+	if tx.DelegationShares() != in.DelegationShares {
+		t.Errorf("DelegationShares round-trip")
+	}
+	if !bytes.Equal(tx.Memo(), in.Memo) {
+		t.Errorf("Memo round-trip")
+	}
+
+	tx2, err := WrapAddValidatorTx(tx.Bytes())
+	if err != nil {
+		t.Fatalf("Wrap: %v", err)
+	}
+	if tx2.NodeID() != in.NodeID {
+		t.Fatal("wrap-round-trip mismatch")
+	}
+}
+
+func TestAddDelegatorTxRoundTrip(t *testing.T) {
+	in := AddDelegatorTxInput{
+		NetworkID:    1337,
+		BlockchainID: ids.ID{0x12},
+		Outs:         sampleOuts(),
+		Ins:          sampleIns(),
+		Credentials:  sampleCreds(),
+		Memo:         []byte("add-d"),
+		NodeID:       ids.NodeID{0xb1, 0xb2, 0xb3},
+		StakeStart:   1_700_000_000,
+		StakeEnd:     1_800_000_000,
+		StakeWeight:  300_000,
+		StakeOuts:    sampleOuts(),
+		DelegationRewardsOwner: OwnerStub{Threshold: 1, Locktime: 0, Address: ids.ShortID{0x66}},
+	}
+
+	tx := NewAddDelegatorTx(in)
+	if tx.NodeID() != in.NodeID {
+		t.Errorf("NodeID round-trip")
+	}
+	dT, dLT, dAddr := tx.DelegationRewardsOwner()
+	if dT != in.DelegationRewardsOwner.Threshold || dLT != in.DelegationRewardsOwner.Locktime || dAddr != in.DelegationRewardsOwner.Address {
+		t.Errorf("DelegationRewardsOwner round-trip")
+	}
+	tx2, err := WrapAddDelegatorTx(tx.Bytes())
+	if err != nil {
+		t.Fatalf("Wrap: %v", err)
+	}
+	if tx2.NodeID() != in.NodeID {
+		t.Fatal("wrap-round-trip mismatch")
+	}
+}
+
+func TestAddPermissionlessDelegatorTxRoundTrip(t *testing.T) {
+	in := AddPermissionlessDelegatorTxInput{
+		NetworkID:    1337,
+		BlockchainID: ids.ID{0x13},
+		Outs:         sampleOuts(),
+		Ins:          sampleIns(),
+		Credentials:  sampleCreds(),
+		Memo:         []byte("add-pd"),
+		NodeID:       ids.NodeID{0xc1, 0xc2, 0xc3},
+		StakeStart:   1_700_000_000,
+		StakeEnd:     1_800_000_000,
+		StakeWeight:  400_000,
+		Chain:        ids.ID{0xe1, 0xe2, 0xe3},
+		StakeAssetID: ids.ID{0xaf},
+		StakeOuts:    sampleOuts(),
+		DelegationRewardsOwner: OwnerStub{Threshold: 1, Locktime: 0, Address: ids.ShortID{0x77}},
+	}
+	tx := NewAddPermissionlessDelegatorTx(in)
+	if tx.Chain() != in.Chain {
+		t.Errorf("Chain round-trip")
+	}
+	if tx.StakeAssetID() != in.StakeAssetID {
+		t.Errorf("StakeAssetID round-trip")
+	}
+	tx2, err := WrapAddPermissionlessDelegatorTx(tx.Bytes())
+	if err != nil {
+		t.Fatalf("Wrap: %v", err)
+	}
+	if tx2.Chain() != in.Chain {
+		t.Fatal("wrap-round-trip mismatch")
+	}
+}
+
+func TestAddChainValidatorTxRoundTrip(t *testing.T) {
+	in := AddChainValidatorTxInput{
+		NetworkID:    1337,
+		BlockchainID: ids.ID{0x14},
+		Outs:         sampleOuts(),
+		Ins:          sampleIns(),
+		Credentials:  sampleCreds(),
+		Memo:         []byte("add-cv"),
+		NodeID:       ids.NodeID{0xd1, 0xd2, 0xd3},
+		StakeStart:   1_700_000_000,
+		StakeEnd:     1_800_000_000,
+		StakeWeight:  600_000,
+		Chain:        ids.ID{0xf1},
+	}
+	tx := NewAddChainValidatorTx(in)
+	if tx.Chain() != in.Chain {
+		t.Errorf("Chain round-trip")
+	}
+	if tx.NodeID() != in.NodeID {
+		t.Errorf("NodeID round-trip")
+	}
+	tx2, err := WrapAddChainValidatorTx(tx.Bytes())
+	if err != nil {
+		t.Fatalf("Wrap: %v", err)
+	}
+	if tx2.Chain() != in.Chain {
+		t.Fatal("wrap-round-trip mismatch")
+	}
+}
+
+func TestCreateNetworkTxRoundTrip(t *testing.T) {
+	in := CreateNetworkTxInput{
+		NetworkID:    1337,
+		BlockchainID: ids.ID{0x15},
+		Outs:         sampleOuts(),
+		Ins:          sampleIns(),
+		Credentials:  sampleCreds(),
+		Memo:         []byte("cnet"),
+		Owner:        OwnerStub{Threshold: 1, Locktime: 0, Address: ids.ShortID{0x88}},
+	}
+	tx := NewCreateNetworkTx(in)
+	if tx.NetworkID() != in.NetworkID {
+		t.Errorf("NetworkID round-trip")
+	}
+	oT, oLT, oA := tx.Owner()
+	if oT != in.Owner.Threshold || oLT != in.Owner.Locktime || oA != in.Owner.Address {
+		t.Errorf("Owner round-trip")
+	}
+	tx2, err := WrapCreateNetworkTx(tx.Bytes())
+	if err != nil {
+		t.Fatalf("Wrap: %v", err)
+	}
+	if tx2.NetworkID() != in.NetworkID {
+		t.Fatal("wrap-round-trip mismatch")
+	}
+}
+
+func TestTransformChainTxRoundTrip(t *testing.T) {
+	in := TransformChainTxInput{
+		NetworkID:                1337,
+		BlockchainID:             ids.ID{0x16},
+		Outs:                     sampleOuts(),
+		Ins:                      sampleIns(),
+		Credentials:              sampleCreds(),
+		Memo:                     []byte("tc"),
+		Chain:                    ids.ID{0xc1},
+		AssetID:                  ids.ID{0xa1, 0xa2},
+		InitialSupply:            1_000_000_000,
+		MaximumSupply:            10_000_000_000,
+		MinConsumptionRate:       100_000,
+		MaxConsumptionRate:       500_000,
+		MinValidatorStake:        2_000_000_000,
+		MaxValidatorStake:        3_000_000_000,
+		MinStakeDuration:         86400,
+		MaxStakeDuration:         86400 * 365,
+		MinDelegationFee:         20_000,
+		MinDelegatorStake:        25_000_000,
+		MaxValidatorWeightFactor: 5,
+		UptimeRequirement:        600_000,
+	}
+	tx := NewTransformChainTx(in)
+	if tx.InitialSupply() != in.InitialSupply {
+		t.Errorf("InitialSupply round-trip")
+	}
+	if tx.MaximumSupply() != in.MaximumSupply {
+		t.Errorf("MaximumSupply round-trip")
+	}
+	if tx.MinValidatorStake() != in.MinValidatorStake {
+		t.Errorf("MinValidatorStake round-trip")
+	}
+	if tx.MaxValidatorStake() != in.MaxValidatorStake {
+		t.Errorf("MaxValidatorStake round-trip")
+	}
+	if tx.MinStakeDuration() != in.MinStakeDuration {
+		t.Errorf("MinStakeDuration round-trip")
+	}
+	if tx.MaxStakeDuration() != in.MaxStakeDuration {
+		t.Errorf("MaxStakeDuration round-trip")
+	}
+	if tx.MinDelegationFee() != in.MinDelegationFee {
+		t.Errorf("MinDelegationFee round-trip")
+	}
+	if tx.MaxValidatorWeightFactor() != in.MaxValidatorWeightFactor {
+		t.Errorf("MaxValidatorWeightFactor round-trip")
+	}
+	if tx.UptimeRequirement() != in.UptimeRequirement {
+		t.Errorf("UptimeRequirement round-trip")
+	}
+	tx2, err := WrapTransformChainTx(tx.Bytes())
+	if err != nil {
+		t.Fatalf("Wrap: %v", err)
+	}
+	if tx2.Chain() != in.Chain {
+		t.Fatal("wrap-round-trip mismatch")
+	}
+}
+
+func TestConvertNetworkToL1TxRoundTrip(t *testing.T) {
+	addr := []byte{0xde, 0xad, 0xbe, 0xef, 0x12, 0x34}
+	in := ConvertNetworkToL1TxInput{
+		NetworkID:      1337,
+		BlockchainID:   ids.ID{0x17},
+		Outs:           sampleOuts(),
+		Ins:            sampleIns(),
+		Credentials:    sampleCreds(),
+		Memo:           []byte("conv"),
+		Chain:          ids.ID{0xc1, 0xc2},
+		ManagerChainID: ids.ID{0xb1, 0xb2},
+		Address:        addr,
+	}
+	tx := NewConvertNetworkToL1Tx(in)
+	if tx.Chain() != in.Chain {
+		t.Errorf("Chain round-trip")
+	}
+	if tx.ManagerChainID() != in.ManagerChainID {
+		t.Errorf("ManagerChainID round-trip")
+	}
+	if !bytes.Equal(tx.Address(), addr) {
+		t.Errorf("Address round-trip")
+	}
+	tx2, err := WrapConvertNetworkToL1Tx(tx.Bytes())
+	if err != nil {
+		t.Fatalf("Wrap: %v", err)
+	}
+	if tx2.Chain() != in.Chain {
+		t.Fatal("wrap-round-trip mismatch")
+	}
+}
+
+func TestCreateSovereignL1TxRoundTrip(t *testing.T) {
+	mgrAddr := []byte{0xab, 0xcd, 0xef, 0x01}
+	in := CreateSovereignL1TxInput{
+		NetworkID:       1337,
+		BlockchainID:    ids.ID{0x18},
+		Outs:            sampleOuts(),
+		Ins:             sampleIns(),
+		Credentials:     sampleCreds(),
+		Memo:            []byte("sov"),
+		Owner:           OwnerStub{Threshold: 1, Locktime: 0, Address: ids.ShortID{0x99}},
+		ManagerChainIdx: 0,
+		ManagerAddress:  mgrAddr,
+		VMID:            ids.ID{0xee},
+	}
+	tx := NewCreateSovereignL1Tx(in)
+	oT, oLT, oA := tx.Owner()
+	if oT != in.Owner.Threshold || oLT != in.Owner.Locktime || oA != in.Owner.Address {
+		t.Errorf("Owner round-trip")
+	}
+	if tx.ManagerChainIdx() != in.ManagerChainIdx {
+		t.Errorf("ManagerChainIdx round-trip")
+	}
+	if !bytes.Equal(tx.ManagerAddress(), mgrAddr) {
+		t.Errorf("ManagerAddress round-trip")
+	}
+	if tx.VMID() != in.VMID {
+		t.Errorf("VMID round-trip")
+	}
+	tx2, err := WrapCreateSovereignL1Tx(tx.Bytes())
+	if err != nil {
+		t.Fatalf("Wrap: %v", err)
+	}
+	if tx2.VMID() != in.VMID {
+		t.Fatal("wrap-round-trip mismatch")
+	}
+}
+
+// TestBatch4_TxKindCrossTypeRejection pins the cross-type confusion
+// defense for all batch 4 tx types: each Wrap*Tx must reject buffers
+// whose TxKind discriminator does not match the expected kind.
+func TestBatch4_TxKindCrossTypeRejection(t *testing.T) {
+	// Build an AddValidatorTx and try to wrap it as every other batch 4
+	// kind — all must return ErrWrongTxKind.
+	av := NewAddValidatorTx(AddValidatorTxInput{
+		NetworkID: 1, NodeID: ids.NodeID{0x1},
+		RewardsOwner: OwnerStub{Threshold: 1},
+	})
+	buf := av.Bytes()
+	if _, err := WrapAddDelegatorTx(buf); err != ErrWrongTxKind {
+		t.Errorf("WrapAddDelegatorTx(AV bytes) = %v, want ErrWrongTxKind", err)
+	}
+	if _, err := WrapAddPermissionlessDelegatorTx(buf); err != ErrWrongTxKind {
+		t.Errorf("WrapAddPermissionlessDelegatorTx(AV bytes) = %v, want ErrWrongTxKind", err)
+	}
+	if _, err := WrapAddChainValidatorTx(buf); err != ErrWrongTxKind {
+		t.Errorf("WrapAddChainValidatorTx(AV bytes) = %v, want ErrWrongTxKind", err)
+	}
+	if _, err := WrapCreateNetworkTx(buf); err != ErrWrongTxKind {
+		t.Errorf("WrapCreateNetworkTx(AV bytes) = %v, want ErrWrongTxKind", err)
+	}
+	if _, err := WrapTransformChainTx(buf); err != ErrWrongTxKind {
+		t.Errorf("WrapTransformChainTx(AV bytes) = %v, want ErrWrongTxKind", err)
+	}
+	if _, err := WrapConvertNetworkToL1Tx(buf); err != ErrWrongTxKind {
+		t.Errorf("WrapConvertNetworkToL1Tx(AV bytes) = %v, want ErrWrongTxKind", err)
+	}
+	if _, err := WrapCreateSovereignL1Tx(buf); err != ErrWrongTxKind {
+		t.Errorf("WrapCreateSovereignL1Tx(AV bytes) = %v, want ErrWrongTxKind", err)
+	}
+}
@@ -0,0 +1,167 @@
+// Copyright (C) 2026, Lux Industries Inc. All rights reserved.
+// See the file LICENSE for licensing terms.
+
+package zap_native
+
+import (
+	"github.com/luxfi/ids"
+	"github.com/luxfi/zap"
+)
+
+// ConvertNetworkToL1Tx — convert a network to a sovereign L1 (POST-rebrand
+// from ConvertSubnetToL1Tx). Carries the BaseTxFull spending state plus:
+//   - Chain (the chain to convert; primary network ID forbidden in
+//     consumer-side syntactic verify)
+//   - ManagerChainID (where the L1 manager contract lives)
+//   - Address (chain-manager contract address, variable bytes)
+//   - Validators list (initial pay-as-you-go validators)
+//
+// The Validators sub-list is a fixed-stride record per validator carrying
+// (NodeID, Weight, BLSPubKey, BLSPoP, RegistrationExpiry). The
+// initial-validator schema is intentionally simple (no nested owner lists)
+// — owner lists for each validator's balance ride in a sibling array.
+//
+// Fixed-section layout (size 137 bytes):
+//
+//	TxKind                  uint8  @ 0
+//	NetworkID               uint32 @ 1
+//	BlockchainID            32B    @ 5
+//	OutsList                8B     @ 37
+//	InsList                 8B     @ 45
+//	CredsList               8B     @ 53
+//	SigIndicesArr           8B     @ 61
+//	SigArr                  8B     @ 69
+//	Memo                    8B     @ 77
+//	Chain                   32B    @ 85
+//	ManagerChainID          32B    @ 117
+//	Address                 8B     @ 149  (variable bytes)
+//	ValidatorsList          8B     @ 157  (fixed-stride list)
+const (
+	OffsetConvertNetworkToL1Tx_NetworkID      = 1
+	OffsetConvertNetworkToL1Tx_BlockchainID   = 5
+	OffsetConvertNetworkToL1Tx_OutsList       = 37
+	OffsetConvertNetworkToL1Tx_InsList        = 45
+	OffsetConvertNetworkToL1Tx_CredsList      = 53
+	OffsetConvertNetworkToL1Tx_SigIndicesArr  = 61
+	OffsetConvertNetworkToL1Tx_SigArr         = 69
+	OffsetConvertNetworkToL1Tx_Memo           = 77
+	OffsetConvertNetworkToL1Tx_Chain          = 85
+	OffsetConvertNetworkToL1Tx_ManagerChainID = 117
+	OffsetConvertNetworkToL1Tx_Address        = 149
+	OffsetConvertNetworkToL1Tx_ValidatorsList = 157
+	SizeConvertNetworkToL1Tx                  = 165
+)
+
+type ConvertNetworkToL1Tx struct {
+	msg *zap.Message
+	obj zap.Object
+}
+
+func (t ConvertNetworkToL1Tx) NetworkID() uint32 {
+	return t.obj.Uint32(OffsetConvertNetworkToL1Tx_NetworkID)
+}
+func (t ConvertNetworkToL1Tx) BlockchainID() ids.ID {
+	var out ids.ID
+	for i := 0; i < 32; i++ {
+		out[i] = t.obj.Uint8(OffsetConvertNetworkToL1Tx_BlockchainID + i)
+	}
+	return out
+}
+func (t ConvertNetworkToL1Tx) Outs() OutputList {
+	return OutputListView(t.obj, OffsetConvertNetworkToL1Tx_OutsList)
+}
+func (t ConvertNetworkToL1Tx) Ins() InputList {
+	return InputListView(t.obj, OffsetConvertNetworkToL1Tx_InsList)
+}
+func (t ConvertNetworkToL1Tx) Credentials() CredentialList {
+	return CredentialListView(t.obj, OffsetConvertNetworkToL1Tx_CredsList)
+}
+func (t ConvertNetworkToL1Tx) SigIndicesArray() SigIndicesArray {
+	return SigIndicesArrayView(t.obj, OffsetConvertNetworkToL1Tx_SigIndicesArr)
+}
+func (t ConvertNetworkToL1Tx) SignatureArray() SignatureArray {
+	return SignatureArrayView(t.obj, OffsetConvertNetworkToL1Tx_SigArr)
+}
+func (t ConvertNetworkToL1Tx) Memo() []byte {
+	return t.obj.Bytes(OffsetConvertNetworkToL1Tx_Memo)
+}
+
+func (t ConvertNetworkToL1Tx) Chain() ids.ID {
+	var out ids.ID
+	for i := 0; i < 32; i++ {
+		out[i] = t.obj.Uint8(OffsetConvertNetworkToL1Tx_Chain + i)
+	}
+	return out
+}
+func (t ConvertNetworkToL1Tx) ManagerChainID() ids.ID {
+	var out ids.ID
+	for i := 0; i < 32; i++ {
+		out[i] = t.obj.Uint8(OffsetConvertNetworkToL1Tx_ManagerChainID + i)
+	}
+	return out
+}
+
+// Address returns the L1 manager contract address bytes. READ-ONLY: aliases
+// the underlying ZAP buffer (see BaseTxFull.Memo for the contract).
+func (t ConvertNetworkToL1Tx) Address() []byte {
+	return t.obj.Bytes(OffsetConvertNetworkToL1Tx_Address)
+}
+
+func (t ConvertNetworkToL1Tx) Bytes() []byte { return t.msg.Bytes() }
+func (t ConvertNetworkToL1Tx) IsZero() bool  { return t.msg == nil }
+
+func WrapConvertNetworkToL1Tx(b []byte) (ConvertNetworkToL1Tx, error) {
+	msg, obj, err := parseAndCheckKind(b, TxKindConvertNetworkToL1)
+	if err != nil {
+		return ConvertNetworkToL1Tx{}, err
+	}
+	return ConvertNetworkToL1Tx{msg: msg, obj: obj}, nil
+}
+
+type ConvertNetworkToL1TxInput struct {
+	NetworkID      uint32
+	BlockchainID   ids.ID
+	Outs           []OutputListEntry
+	Ins            []InputListEntry
+	Credentials    []CredentialListEntry
+	Memo           []byte
+	Chain          ids.ID
+	ManagerChainID ids.ID
+	Address        []byte
+}
+
+func NewConvertNetworkToL1Tx(in ConvertNetworkToL1TxInput) ConvertNetworkToL1Tx {
+	cap := zap.HeaderSize + 16 + SizeConvertNetworkToL1Tx
+	cap += len(in.Outs) * SizeTransferableOutput
+	cap += len(in.Ins) * SizeTransferableInput
+	cap += len(in.Credentials) * SizeCredential
+	cap += len(in.Memo) + len(in.Address)
+	b := zap.NewBuilder(cap)
+
+	outsOff, outsCount := WriteOutputList(b, in.Outs)
+	insOff, insCount, sigIndices := WriteInputList(b, in.Ins)
+	credsOff, credsCount, sigBlobs := WriteCredentialList(b, in.Credentials)
+	sigIdxArrOff, sigIdxArrCount := WriteSigIndicesArray(b, sigIndices)
+	sigArrOff, sigArrCount := WriteSignatureArray(b, sigBlobs)
+
+	ob := b.StartObject(SizeConvertNetworkToL1Tx)
+	ob.SetUint8(OffsetTxKind, uint8(TxKindConvertNetworkToL1))
+	ob.SetUint32(OffsetConvertNetworkToL1Tx_NetworkID, in.NetworkID)
+	for i := 0; i < 32; i++ {
+		ob.SetUint8(OffsetConvertNetworkToL1Tx_BlockchainID+i, in.BlockchainID[i])
+		ob.SetUint8(OffsetConvertNetworkToL1Tx_Chain+i, in.Chain[i])
+		ob.SetUint8(OffsetConvertNetworkToL1Tx_ManagerChainID+i, in.ManagerChainID[i])
+	}
+	ob.SetList(OffsetConvertNetworkToL1Tx_OutsList, outsOff, outsCount)
+	ob.SetList(OffsetConvertNetworkToL1Tx_InsList, insOff, insCount)
+	ob.SetList(OffsetConvertNetworkToL1Tx_CredsList, credsOff, credsCount)
+	ob.SetList(OffsetConvertNetworkToL1Tx_SigIndicesArr, sigIdxArrOff, sigIdxArrCount)
+	ob.SetList(OffsetConvertNetworkToL1Tx_SigArr, sigArrOff, sigArrCount)
+	ob.SetBytes(OffsetConvertNetworkToL1Tx_Memo, in.Memo)
+	ob.SetBytes(OffsetConvertNetworkToL1Tx_Address, in.Address)
+	// ValidatorsList intentionally left at (0, 0) — initial-validator
+	// records use a sibling primitive that's not part of this batch.
+	ob.FinishAsRoot()
+	msg, _ := zap.Parse(b.Finish())
+	return ConvertNetworkToL1Tx{msg: msg, obj: msg.Root()}
+}
@@ -0,0 +1,139 @@
+// Copyright (C) 2026, Lux Industries Inc. All rights reserved.
+// See the file LICENSE for licensing terms.
+
+package zap_native
+
+import (
+	"github.com/luxfi/ids"
+	"github.com/luxfi/zap"
+)
+
+// CreateNetworkTx — create a new network/subnet (POST-rebrand: this is
+// the rebranded CreateSubnetTx). Carries the BaseTxFull spending state
+// plus a single-address owner stub authorizing the network manager.
+//
+// Fixed-section layout (size 113 bytes):
+//
+//	TxKind             uint8  @ 0
+//	NetworkID          uint32 @ 1
+//	BlockchainID       32B    @ 5
+//	OutsList           8B     @ 37
+//	InsList            8B     @ 45
+//	CredsList          8B     @ 53
+//	SigIndicesArr      8B     @ 61
+//	SigArr             8B     @ 69
+//	Memo               8B     @ 77
+//	OwnerThreshold     uint32 @ 85
+//	OwnerLocktime      uint64 @ 89
+//	OwnerAddress       20B    @ 97
+const (
+	OffsetCreateNetworkTx_NetworkID      = 1
+	OffsetCreateNetworkTx_BlockchainID   = 5
+	OffsetCreateNetworkTx_OutsList       = 37
+	OffsetCreateNetworkTx_InsList        = 45
+	OffsetCreateNetworkTx_CredsList      = 53
+	OffsetCreateNetworkTx_SigIndicesArr  = 61
+	OffsetCreateNetworkTx_SigArr         = 69
+	OffsetCreateNetworkTx_Memo           = 77
+	OffsetCreateNetworkTx_OwnerThreshold = 85
+	OffsetCreateNetworkTx_OwnerLocktime  = 89
+	OffsetCreateNetworkTx_OwnerAddress   = 97
+	SizeCreateNetworkTx                  = 117
+)
+
+type CreateNetworkTx struct {
+	msg *zap.Message
+	obj zap.Object
+}
+
+func (t CreateNetworkTx) NetworkID() uint32 { return t.obj.Uint32(OffsetCreateNetworkTx_NetworkID) }
+func (t CreateNetworkTx) BlockchainID() ids.ID {
+	var out ids.ID
+	for i := 0; i < 32; i++ {
+		out[i] = t.obj.Uint8(OffsetCreateNetworkTx_BlockchainID + i)
+	}
+	return out
+}
+func (t CreateNetworkTx) Outs() OutputList {
+	return OutputListView(t.obj, OffsetCreateNetworkTx_OutsList)
+}
+func (t CreateNetworkTx) Ins() InputList {
+	return InputListView(t.obj, OffsetCreateNetworkTx_InsList)
+}
+func (t CreateNetworkTx) Credentials() CredentialList {
+	return CredentialListView(t.obj, OffsetCreateNetworkTx_CredsList)
+}
+func (t CreateNetworkTx) SigIndicesArray() SigIndicesArray {
+	return SigIndicesArrayView(t.obj, OffsetCreateNetworkTx_SigIndicesArr)
+}
+func (t CreateNetworkTx) SignatureArray() SignatureArray {
+	return SignatureArrayView(t.obj, OffsetCreateNetworkTx_SigArr)
+}
+func (t CreateNetworkTx) Memo() []byte { return t.obj.Bytes(OffsetCreateNetworkTx_Memo) }
+
+func (t CreateNetworkTx) Owner() (uint32, uint64, ids.ShortID) {
+	threshold := t.obj.Uint32(OffsetCreateNetworkTx_OwnerThreshold)
+	locktime := t.obj.Uint64(OffsetCreateNetworkTx_OwnerLocktime)
+	var addr ids.ShortID
+	for i := 0; i < ids.ShortIDLen; i++ {
+		addr[i] = t.obj.Uint8(OffsetCreateNetworkTx_OwnerAddress + i)
+	}
+	return threshold, locktime, addr
+}
+
+func (t CreateNetworkTx) Bytes() []byte { return t.msg.Bytes() }
+func (t CreateNetworkTx) IsZero() bool  { return t.msg == nil }
+
+func WrapCreateNetworkTx(b []byte) (CreateNetworkTx, error) {
+	msg, obj, err := parseAndCheckKind(b, TxKindCreateNetwork)
+	if err != nil {
+		return CreateNetworkTx{}, err
+	}
+	return CreateNetworkTx{msg: msg, obj: obj}, nil
+}
+
+type CreateNetworkTxInput struct {
+	NetworkID    uint32
+	BlockchainID ids.ID
+	Outs         []OutputListEntry
+	Ins          []InputListEntry
+	Credentials  []CredentialListEntry
+	Memo         []byte
+	Owner        OwnerStub
+}
+
+func NewCreateNetworkTx(in CreateNetworkTxInput) CreateNetworkTx {
+	cap := zap.HeaderSize + 16 + SizeCreateNetworkTx
+	cap += len(in.Outs) * SizeTransferableOutput
+	cap += len(in.Ins) * SizeTransferableInput
+	cap += len(in.Credentials) * SizeCredential
+	cap += len(in.Memo)
+	b := zap.NewBuilder(cap)
+
+	outsOff, outsCount := WriteOutputList(b, in.Outs)
+	insOff, insCount, sigIndices := WriteInputList(b, in.Ins)
+	credsOff, credsCount, sigBlobs := WriteCredentialList(b, in.Credentials)
+	sigIdxArrOff, sigIdxArrCount := WriteSigIndicesArray(b, sigIndices)
+	sigArrOff, sigArrCount := WriteSignatureArray(b, sigBlobs)
+
+	ob := b.StartObject(SizeCreateNetworkTx)
+	ob.SetUint8(OffsetTxKind, uint8(TxKindCreateNetwork))
+	ob.SetUint32(OffsetCreateNetworkTx_NetworkID, in.NetworkID)
+	for i := 0; i < 32; i++ {
+		ob.SetUint8(OffsetCreateNetworkTx_BlockchainID+i, in.BlockchainID[i])
+	}
+	ob.SetList(OffsetCreateNetworkTx_OutsList, outsOff, outsCount)
+	ob.SetList(OffsetCreateNetworkTx_InsList, insOff, insCount)
+	ob.SetList(OffsetCreateNetworkTx_CredsList, credsOff, credsCount)
+	ob.SetList(OffsetCreateNetworkTx_SigIndicesArr, sigIdxArrOff, sigIdxArrCount)
+	ob.SetList(OffsetCreateNetworkTx_SigArr, sigArrOff, sigArrCount)
+	ob.SetBytes(OffsetCreateNetworkTx_Memo, in.Memo)
+	ob.SetUint32(OffsetCreateNetworkTx_OwnerThreshold, in.Owner.Threshold)
+	ob.SetUint64(OffsetCreateNetworkTx_OwnerLocktime, in.Owner.Locktime)
+	for i := 0; i < ids.ShortIDLen; i++ {
+		ob.SetUint8(OffsetCreateNetworkTx_OwnerAddress+i, in.Owner.Address[i])
+	}
+	ob.FinishAsRoot()
+	msg, _ := zap.Parse(b.Finish())
+	return CreateNetworkTx{msg: msg, obj: msg.Root()}
+}
@@ -0,0 +1,177 @@
+// Copyright (C) 2026, Lux Industries Inc. All rights reserved.
+// See the file LICENSE for licensing terms.
+
+package zap_native
+
+import (
+	"github.com/luxfi/ids"
+	"github.com/luxfi/zap"
+)
+
+// CreateSovereignL1Tx atomically registers a sovereign L1 on P-chain.
+// Combines CreateNetwork + AddChainValidator(*N) + CreateChain(*K) +
+// ConvertNetworkToL1 into one atomic commit. See legacy
+// /vms/platformvm/txs/create_sovereign_l1_tx.go for full semantics.
+//
+// This v3 form pins the most common single-chain L1 case (e.g. EVM-only).
+// Multi-chain L1s (EVM + DEX + FHE) still ride the legacy schema until
+// the per-chain Chains list primitive ships in a follow-up batch.
+//
+// Fixed-section layout (size 165 bytes):
+//
+//	TxKind                  uint8  @ 0
+//	NetworkID               uint32 @ 1
+//	BlockchainID            32B    @ 5
+//	OutsList                8B     @ 37
+//	InsList                 8B     @ 45
+//	CredsList               8B     @ 53
+//	SigIndicesArr           8B     @ 61
+//	SigArr                  8B     @ 69
+//	Memo                    8B     @ 77
+//	OwnerThreshold          uint32 @ 85
+//	OwnerLocktime           uint64 @ 89
+//	OwnerAddress            20B    @ 97
+//	ManagerChainIdx         uint32 @ 117
+//	ManagerAddress          8B     @ 121  (variable bytes)
+//	ValidatorsList          8B     @ 129  (fixed-stride list; pending)
+//	ChainsList              8B     @ 137  (fixed-stride list; pending)
+//	VMID                    32B    @ 145  (single-chain v3 stub; multi-chain via legacy)
+const (
+	OffsetCreateSovereignL1Tx_NetworkID       = 1
+	OffsetCreateSovereignL1Tx_BlockchainID    = 5
+	OffsetCreateSovereignL1Tx_OutsList        = 37
+	OffsetCreateSovereignL1Tx_InsList         = 45
+	OffsetCreateSovereignL1Tx_CredsList       = 53
+	OffsetCreateSovereignL1Tx_SigIndicesArr   = 61
+	OffsetCreateSovereignL1Tx_SigArr          = 69
+	OffsetCreateSovereignL1Tx_Memo            = 77
+	OffsetCreateSovereignL1Tx_OwnerThreshold  = 85
+	OffsetCreateSovereignL1Tx_OwnerLocktime   = 89
+	OffsetCreateSovereignL1Tx_OwnerAddress    = 97
+	OffsetCreateSovereignL1Tx_ManagerChainIdx = 117
+	OffsetCreateSovereignL1Tx_ManagerAddress  = 121
+	OffsetCreateSovereignL1Tx_ValidatorsList  = 129
+	OffsetCreateSovereignL1Tx_ChainsList      = 137
+	OffsetCreateSovereignL1Tx_VMID            = 145
+	SizeCreateSovereignL1Tx                   = 177
+)
+
+type CreateSovereignL1Tx struct {
+	msg *zap.Message
+	obj zap.Object
+}
+
+func (t CreateSovereignL1Tx) NetworkID() uint32 {
+	return t.obj.Uint32(OffsetCreateSovereignL1Tx_NetworkID)
+}
+func (t CreateSovereignL1Tx) BlockchainID() ids.ID {
+	var out ids.ID
+	for i := 0; i < 32; i++ {
+		out[i] = t.obj.Uint8(OffsetCreateSovereignL1Tx_BlockchainID + i)
+	}
+	return out
+}
+func (t CreateSovereignL1Tx) Outs() OutputList {
+	return OutputListView(t.obj, OffsetCreateSovereignL1Tx_OutsList)
+}
+func (t CreateSovereignL1Tx) Ins() InputList {
+	return InputListView(t.obj, OffsetCreateSovereignL1Tx_InsList)
+}
+func (t CreateSovereignL1Tx) Credentials() CredentialList {
+	return CredentialListView(t.obj, OffsetCreateSovereignL1Tx_CredsList)
+}
+func (t CreateSovereignL1Tx) SigIndicesArray() SigIndicesArray {
+	return SigIndicesArrayView(t.obj, OffsetCreateSovereignL1Tx_SigIndicesArr)
+}
+func (t CreateSovereignL1Tx) SignatureArray() SignatureArray {
+	return SignatureArrayView(t.obj, OffsetCreateSovereignL1Tx_SigArr)
+}
+func (t CreateSovereignL1Tx) Memo() []byte {
+	return t.obj.Bytes(OffsetCreateSovereignL1Tx_Memo)
+}
+
+func (t CreateSovereignL1Tx) Owner() (uint32, uint64, ids.ShortID) {
+	threshold := t.obj.Uint32(OffsetCreateSovereignL1Tx_OwnerThreshold)
+	locktime := t.obj.Uint64(OffsetCreateSovereignL1Tx_OwnerLocktime)
+	var addr ids.ShortID
+	for i := 0; i < ids.ShortIDLen; i++ {
+		addr[i] = t.obj.Uint8(OffsetCreateSovereignL1Tx_OwnerAddress + i)
+	}
+	return threshold, locktime, addr
+}
+func (t CreateSovereignL1Tx) ManagerChainIdx() uint32 {
+	return t.obj.Uint32(OffsetCreateSovereignL1Tx_ManagerChainIdx)
+}
+func (t CreateSovereignL1Tx) ManagerAddress() []byte {
+	return t.obj.Bytes(OffsetCreateSovereignL1Tx_ManagerAddress)
+}
+func (t CreateSovereignL1Tx) VMID() ids.ID {
+	var out ids.ID
+	for i := 0; i < 32; i++ {
+		out[i] = t.obj.Uint8(OffsetCreateSovereignL1Tx_VMID + i)
+	}
+	return out
+}
+
+func (t CreateSovereignL1Tx) Bytes() []byte { return t.msg.Bytes() }
+func (t CreateSovereignL1Tx) IsZero() bool  { return t.msg == nil }
+
+func WrapCreateSovereignL1Tx(b []byte) (CreateSovereignL1Tx, error) {
+	msg, obj, err := parseAndCheckKind(b, TxKindCreateSovereignL1)
+	if err != nil {
+		return CreateSovereignL1Tx{}, err
+	}
+	return CreateSovereignL1Tx{msg: msg, obj: obj}, nil
+}
+
+type CreateSovereignL1TxInput struct {
+	NetworkID       uint32
+	BlockchainID    ids.ID
+	Outs            []OutputListEntry
+	Ins             []InputListEntry
+	Credentials     []CredentialListEntry
+	Memo            []byte
+	Owner           OwnerStub
+	ManagerChainIdx uint32
+	ManagerAddress  []byte
+	VMID            ids.ID
+}
+
+func NewCreateSovereignL1Tx(in CreateSovereignL1TxInput) CreateSovereignL1Tx {
+	cap := zap.HeaderSize + 16 + SizeCreateSovereignL1Tx
+	cap += len(in.Outs) * SizeTransferableOutput
+	cap += len(in.Ins) * SizeTransferableInput
+	cap += len(in.Credentials) * SizeCredential
+	cap += len(in.Memo) + len(in.ManagerAddress)
+	b := zap.NewBuilder(cap)
+
+	outsOff, outsCount := WriteOutputList(b, in.Outs)
+	insOff, insCount, sigIndices := WriteInputList(b, in.Ins)
+	credsOff, credsCount, sigBlobs := WriteCredentialList(b, in.Credentials)
+	sigIdxArrOff, sigIdxArrCount := WriteSigIndicesArray(b, sigIndices)
+	sigArrOff, sigArrCount := WriteSignatureArray(b, sigBlobs)
+
+	ob := b.StartObject(SizeCreateSovereignL1Tx)
+	ob.SetUint8(OffsetTxKind, uint8(TxKindCreateSovereignL1))
+	ob.SetUint32(OffsetCreateSovereignL1Tx_NetworkID, in.NetworkID)
+	for i := 0; i < 32; i++ {
+		ob.SetUint8(OffsetCreateSovereignL1Tx_BlockchainID+i, in.BlockchainID[i])
+		ob.SetUint8(OffsetCreateSovereignL1Tx_VMID+i, in.VMID[i])
+	}
+	ob.SetList(OffsetCreateSovereignL1Tx_OutsList, outsOff, outsCount)
+	ob.SetList(OffsetCreateSovereignL1Tx_InsList, insOff, insCount)
+	ob.SetList(OffsetCreateSovereignL1Tx_CredsList, credsOff, credsCount)
+	ob.SetList(OffsetCreateSovereignL1Tx_SigIndicesArr, sigIdxArrOff, sigIdxArrCount)
+	ob.SetList(OffsetCreateSovereignL1Tx_SigArr, sigArrOff, sigArrCount)
+	ob.SetBytes(OffsetCreateSovereignL1Tx_Memo, in.Memo)
+	ob.SetUint32(OffsetCreateSovereignL1Tx_OwnerThreshold, in.Owner.Threshold)
+	ob.SetUint64(OffsetCreateSovereignL1Tx_OwnerLocktime, in.Owner.Locktime)
+	for i := 0; i < ids.ShortIDLen; i++ {
+		ob.SetUint8(OffsetCreateSovereignL1Tx_OwnerAddress+i, in.Owner.Address[i])
+	}
+	ob.SetUint32(OffsetCreateSovereignL1Tx_ManagerChainIdx, in.ManagerChainIdx)
+	ob.SetBytes(OffsetCreateSovereignL1Tx_ManagerAddress, in.ManagerAddress)
+	ob.FinishAsRoot()
+	msg, _ := zap.Parse(b.Finish())
+	return CreateSovereignL1Tx{msg: msg, obj: msg.Root()}
+}
@@ -47,26 +47,20 @@ const (
 	SizeEvidenceEntry                 = 48
 )

-// EvidenceEntry is the zero-copy view over one entry in an EvidenceList.
-//
-// To resolve the (Rel,Len) cursors into actual byte slices the entry must
-// be bound to the parent tx's MessageBlobs + SignatureBlobs via
-// EvidenceList.Bind(). The bound form exposes safe accessors MessageA(),
-// MessageB(), SignatureA(), SignatureB() that clamp against the parent
-// blob lengths and return EMPTY slices on poisoned (Rel,Len) pairs.
+// EvidenceEntry is the zero-copy WIRE view over one entry in an
+// EvidenceListView. It exposes raw (Rel,Len) cursor accessors only — the
+// safe MessageA/B + SignatureA/B accessors live on BoundEvidenceEntry,
+// reachable only via EvidenceListView.Bind(...).At(i). Compile-time
+// enforcement of NEW-V2 (LP-023 Red round 3).
 //
 // The raw *Range() accessors below are UNSAFE: they return the wire
 // (Rel,Len) verbatim without clamping. Consumers that index parent blobs
 // directly with these values can be panicked by an adversary who sets
-// Len=0xFFFFFFFF. New code MUST go through the bound MessageA/SignatureA
-// safe accessors. The Range() helpers remain for legacy internal
-// constructors only (see RED-HIGH-3, LP-023 v3.1 round 2).
+// Len=0xFFFFFFFF. New code MUST go through BoundEvidenceEntry's safe
+// accessors. The Range() helpers remain for legacy internal constructors
+// (RED-HIGH-3, LP-023 v3.1 round 2).
 type EvidenceEntry struct {
 	obj zap.Object
-	// Bound parent-blob references. nil for unbound entries (raw range
-	// access only); set via EvidenceList.Bind().
-	messageBlobs   []byte
-	signatureBlobs []byte
 }

 // Height returns the height at which the slashable equivocation occurred.
@@ -133,81 +127,126 @@ func safeSlice(parent []byte, rel, length uint32) []byte {
 	return parent[rel : rel+length]
 }

-// MessageA returns the first conflicting message bytes, clamped against
-// the bound parent MessageBlobs. Returns an empty slice if the entry is
-// unbound or the wire (Rel,Len) cursors fall outside the parent blob.
-func (e EvidenceEntry) MessageA() []byte {
-	rel, length := e.MessageARange()
-	return safeSlice(e.messageBlobs, rel, length)
-}
-
-// MessageB returns the second conflicting message bytes, clamped against
-// the bound parent MessageBlobs. Returns an empty slice if the entry is
-// unbound or the wire (Rel,Len) cursors fall outside the parent blob.
-func (e EvidenceEntry) MessageB() []byte {
-	rel, length := e.MessageBRange()
-	return safeSlice(e.messageBlobs, rel, length)
-}
-
-// SignatureA returns the first signature bytes, clamped against the bound
-// parent SignatureBlobs. Returns an empty slice if the entry is unbound
-// or the wire (Rel,Len) cursors fall outside the parent blob.
-func (e EvidenceEntry) SignatureA() []byte {
-	rel, length := e.SignatureARange()
-	return safeSlice(e.signatureBlobs, rel, length)
-}
-
-// SignatureB returns the second signature bytes, clamped against the
-// bound parent SignatureBlobs. Returns an empty slice if the entry is
-// unbound or the wire (Rel,Len) cursors fall outside the parent blob.
-func (e EvidenceEntry) SignatureB() []byte {
-	rel, length := e.SignatureBRange()
-	return safeSlice(e.signatureBlobs, rel, length)
-}
-
-// EvidenceList is the zero-copy view over a list of EvidenceEntry items.
-type EvidenceList struct {
+// EvidenceListView is the zero-copy WIRE view over a list of EvidenceEntry
+// items. The view is UNBOUND — its raw cursor accessors (Range methods on
+// EvidenceEntry) are exposed for legacy internal constructors, but the safe
+// accessors MessageA/B + SignatureA/B are NOT available on the entries
+// returned by EvidenceListView.At().
+//
+// To get safe accessors, call .Bind(messageBlobs, signatureBlobs) to convert
+// to BoundEvidenceList. This is a compile-time enforcement of NEW-V2
+// (LP-023 Red round 3 follow-up #1): consumers cannot accidentally read
+// raw (Rel,Len) cursors and panic on attacker-set length=0xFFFFFFFF; the
+// type system forces them through Bind() first.
+type EvidenceListView struct {
 	list zap.List
-	// Bound parent blobs for safe accessors. nil for raw views; set via
-	// Bind().
+}
+
+// Len returns the entry count.
+func (l EvidenceListView) Len() int { return l.list.Len() }
+
+// IsNull returns true if no list pointer was set.
+func (l EvidenceListView) IsNull() bool { return l.list.IsNull() }
+
+// At returns the i'th EvidenceEntry in raw (unbound) form. The entry's
+// Range accessors work; the bound-only MessageA/B + SignatureA/B safe
+// accessors are absent. For consumer-side safe access, call .Bind() to
+// produce a BoundEvidenceList and iterate via BoundEvidenceList.At().
+func (l EvidenceListView) At(i int) EvidenceEntry {
+	return EvidenceEntry{obj: l.list.Object(i, SizeEvidenceEntry)}
+}
+
+// Bind attaches the parent tx's MessageBlobs and SignatureBlobs and returns
+// a BoundEvidenceList whose At() exposes safe MessageA/B + SignatureA/B
+// accessors. The raw (Rel,Len) cursors are attacker-controlled, but the
+// safe accessors clamp against the bound parent blobs and return empty
+// slices on poisoned cursors. RED-HIGH-3 + NEW-V2.
+func (l EvidenceListView) Bind(messageBlobs, signatureBlobs []byte) BoundEvidenceList {
+	return BoundEvidenceList{
+		view:           l,
+		messageBlobs:   messageBlobs,
+		signatureBlobs: signatureBlobs,
+	}
+}
+
+// BoundEvidenceList is the safe-accessor view over an EvidenceListView
+// after Bind(). The bound parent MessageBlobs + SignatureBlobs are pinned
+// at the type level so that BoundEvidenceList.At() returns entries whose
+// MessageA/B + SignatureA/B safely slice the blobs (returning empty on
+// poisoned cursors). Compile-time enforcement: EvidenceListView lacks the
+// safe accessors so consumers cannot bypass Bind() by accident.
+type BoundEvidenceList struct {
+	view           EvidenceListView
 	messageBlobs   []byte
 	signatureBlobs []byte
 }

 // Len returns the entry count.
-func (l EvidenceList) Len() int { return l.list.Len() }
+func (l BoundEvidenceList) Len() int { return l.view.Len() }

 // IsNull returns true if no list pointer was set.
-func (l EvidenceList) IsNull() bool { return l.list.IsNull() }
+func (l BoundEvidenceList) IsNull() bool { return l.view.IsNull() }

-// At returns the i'th EvidenceEntry, carrying any bound parent blobs.
-func (l EvidenceList) At(i int) EvidenceEntry {
-	return EvidenceEntry{
-		obj:            l.list.Object(i, SizeEvidenceEntry),
+// At returns the i'th BoundEvidenceEntry. The bound parent blobs travel
+// with the entry so MessageA/B and SignatureA/B safely clamp against the
+// blobs returned by the parent tx.
+func (l BoundEvidenceList) At(i int) BoundEvidenceEntry {
+	return BoundEvidenceEntry{
+		EvidenceEntry:  l.view.At(i),
 		messageBlobs:   l.messageBlobs,
 		signatureBlobs: l.signatureBlobs,
 	}
 }

-// Bind attaches the parent tx's MessageBlobs and SignatureBlobs to this
-// EvidenceList view so that subsequent At() returns entries that expose
-// safe MessageA/B + SignatureA/B accessors. This is the consumer-side
-// API for RED-HIGH-3: the raw (Rel,Len) cursors are attacker-controlled,
-// but the safe accessors clamp against the bound parent blobs and return
-// empty slices on poisoned cursors.
-func (l EvidenceList) Bind(messageBlobs, signatureBlobs []byte) EvidenceList {
-	l.messageBlobs = messageBlobs
-	l.signatureBlobs = signatureBlobs
-	return l
+// BoundEvidenceEntry composes EvidenceEntry with bound parent blobs. Only
+// this type exposes the safe MessageA/B + SignatureA/B accessors —
+// EvidenceEntry (raw, unbound) does not. NEW-V2 compile-time enforcement.
+type BoundEvidenceEntry struct {
+	EvidenceEntry
+	messageBlobs   []byte
+	signatureBlobs []byte
 }

-// EvidenceListView reads an EvidenceList from a parent object's field offset.
-// The returned list is UNBOUND — call .Bind(messageBlobs, signatureBlobs)
-// to enable safe accessors. Bare At() on an unbound view returns entries
-// whose MessageA/B + SignatureA/B return empty slices (clamped against
-// nil blobs).
-func EvidenceListView(parent zap.Object, fieldOffset int) EvidenceList {
-	return EvidenceList{list: parent.List(fieldOffset)}
+// MessageA returns the first conflicting message bytes, clamped against
+// the bound parent MessageBlobs. Returns an empty slice when the wire
+// (Rel,Len) cursors fall outside the parent blob.
+func (e BoundEvidenceEntry) MessageA() []byte {
+	rel, length := e.MessageARange()
+	return safeSlice(e.messageBlobs, rel, length)
+}
+
+// MessageB returns the second conflicting message bytes, clamped against
+// the bound parent MessageBlobs.
+func (e BoundEvidenceEntry) MessageB() []byte {
+	rel, length := e.MessageBRange()
+	return safeSlice(e.messageBlobs, rel, length)
+}
+
+// SignatureA returns the first signature bytes, clamped against the bound
+// parent SignatureBlobs.
+func (e BoundEvidenceEntry) SignatureA() []byte {
+	rel, length := e.SignatureARange()
+	return safeSlice(e.signatureBlobs, rel, length)
+}
+
+// SignatureB returns the second signature bytes, clamped against the
+// bound parent SignatureBlobs.
+func (e BoundEvidenceEntry) SignatureB() []byte {
+	rel, length := e.SignatureBRange()
+	return safeSlice(e.signatureBlobs, rel, length)
+}
+
+// NewEvidenceListView reads an EvidenceListView from a parent object's
+// field offset.
+//
+// CONTRACT: callers MUST call .Bind(messageBlobs, signatureBlobs) before
+// using MessageA/B/SignatureA/B accessors. Unbound use returns silent-empty
+// slices — a fail-closed default that masks evidence in slashing logic.
+// The BoundEvidenceList type enforces this at compile-time: the unbound
+// EvidenceListView lacks the safe accessors entirely, forcing consumers
+// through Bind() to get a BoundEvidenceList.
+func NewEvidenceListView(parent zap.Object, fieldOffset int) EvidenceListView {
+	return EvidenceListView{list: parent.List(fieldOffset)}
 }

 // EvidenceListEntry is the constructor input for an EvidenceList. The four
@@ -0,0 +1,139 @@
+// Copyright (C) 2026, Lux Industries Inc. All rights reserved.
+// See the file LICENSE for licensing terms.
+
+package zap_native
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/luxfi/ids"
+	"github.com/luxfi/zap"
+)
+
+// wrapAllKinds runs every WrapXxxTx accessor in parallel and returns the
+// list of (kind, error) pairs. The cross-type confusion invariant is:
+//
+//   - For a well-formed v3 buffer with known TxKind=K, exactly ONE
+//     wrapper (the one matching K) returns nil; ALL OTHERS return
+//     ErrWrongTxKind.
+//   - For arbitrary byte slices: zero or one wrapper returns nil;
+//     all the rest return ErrWrongTxKind / ErrWrongSchemaVersion /
+//     a zap.Parse error.
+//
+// Used by both FuzzWrapAllTxKinds (arbitrary inputs) and unit-tests
+// (well-formed inputs).
+func wrapAllKinds(buf []byte) (acceptedKinds []TxKind, errs []error) {
+	type wrapper struct {
+		kind TxKind
+		fn   func([]byte) error
+	}
+	wrappers := []wrapper{
+		{TxKindAdvanceTime, func(b []byte) error { _, e := WrapAdvanceTimeTx(b); return e }},
+		{TxKindRewardValidator, func(b []byte) error { _, e := WrapRewardValidatorTx(b); return e }},
+		{TxKindSetL1ValidatorWeight, func(b []byte) error { _, e := WrapSetL1ValidatorWeightTx(b); return e }},
+		{TxKindIncreaseL1ValidatorBalance, func(b []byte) error { _, e := WrapIncreaseL1ValidatorBalanceTx(b); return e }},
+		{TxKindDisableL1Validator, func(b []byte) error { _, e := WrapDisableL1ValidatorTx(b); return e }},
+		{TxKindBase, func(b []byte) error { _, e := WrapBaseTx(b); return e }},
+		{TxKindRegisterL1Validator, func(b []byte) error { _, e := WrapRegisterL1ValidatorTx(b); return e }},
+		{TxKindSlashValidator, func(b []byte) error { _, e := WrapSlashValidatorTx(b); return e }},
+		{TxKindTransferChainOwnership, func(b []byte) error { _, e := WrapTransferChainOwnershipTx(b); return e }},
+		{TxKindRemoveChainValidator, func(b []byte) error { _, e := WrapRemoveChainValidatorTx(b); return e }},
+		{TxKindBaseFull, func(b []byte) error { _, e := WrapBaseTxFull(b); return e }},
+		{TxKindAddPermissionlessValidator, func(b []byte) error { _, e := WrapAddPermissionlessValidatorTx(b); return e }},
+		{TxKindImport, func(b []byte) error { _, e := WrapImportTx(b); return e }},
+		{TxKindExport, func(b []byte) error { _, e := WrapExportTx(b); return e }},
+		{TxKindCreateChain, func(b []byte) error { _, e := WrapCreateChainTx(b); return e }},
+		{TxKindAddValidator, func(b []byte) error { _, e := WrapAddValidatorTx(b); return e }},
+		{TxKindAddDelegator, func(b []byte) error { _, e := WrapAddDelegatorTx(b); return e }},
+		{TxKindAddPermissionlessDelegator, func(b []byte) error { _, e := WrapAddPermissionlessDelegatorTx(b); return e }},
+		{TxKindAddChainValidator, func(b []byte) error { _, e := WrapAddChainValidatorTx(b); return e }},
+		{TxKindCreateNetwork, func(b []byte) error { _, e := WrapCreateNetworkTx(b); return e }},
+		{TxKindTransformChain, func(b []byte) error { _, e := WrapTransformChainTx(b); return e }},
+		{TxKindConvertNetworkToL1, func(b []byte) error { _, e := WrapConvertNetworkToL1Tx(b); return e }},
+		{TxKindCreateSovereignL1, func(b []byte) error { _, e := WrapCreateSovereignL1Tx(b); return e }},
+	}
+	for _, w := range wrappers {
+		err := w.fn(buf)
+		errs = append(errs, err)
+		if err == nil {
+			acceptedKinds = append(acceptedKinds, w.kind)
+		}
+	}
+	return acceptedKinds, errs
+}
+
+// FuzzWrapAllTxKinds pins the cross-type confusion invariant:
+//
+//	For any byte slice b, at MOST ONE WrapXxxTx returns nil; all others
+//	MUST return a typed error (ErrWrongTxKind / ErrWrongSchemaVersion /
+//	zap.Parse error). No panics.
+//
+// LP-023 Red round 3 follow-up #3 (Wrap path).
+//
+// Seed corpus: every Wrap*Tx test fixture (well-formed buffers, each
+// accepted by exactly one wrapper); plus the buffer-too-small,
+// wrong-magic, wrong-version, and TxKind-flipped variants.
+func FuzzWrapAllTxKinds(f *testing.F) {
+	// Well-formed seeds, one per tx type.
+	f.Add(NewAdvanceTimeTx(1_700_000_000).Bytes())
+	f.Add(NewRewardValidatorTx(ids.ID{0x01}).Bytes())
+	f.Add(NewSetL1ValidatorWeightTx(ids.ID{0x02}, 1, 42).Bytes())
+	f.Add(NewIncreaseL1ValidatorBalanceTx(ids.ID{0x03}, 100).Bytes())
+	f.Add(NewDisableL1ValidatorTx(ids.ID{0x04}).Bytes())
+	f.Add(NewBaseTx(1, ids.ID{0x05}, []byte("memo")).Bytes())
+	f.Add(NewBaseTxFull(BaseTxFullInput{NetworkID: 1, BlockchainID: ids.ID{0x06}}).Bytes())
+	f.Add(NewAddValidatorTx(AddValidatorTxInput{NetworkID: 1, NodeID: ids.NodeID{0x1}}).Bytes())
+	f.Add(NewAddDelegatorTx(AddDelegatorTxInput{NetworkID: 1, NodeID: ids.NodeID{0x2}}).Bytes())
+	f.Add(NewAddChainValidatorTx(AddChainValidatorTxInput{NetworkID: 1, NodeID: ids.NodeID{0x3}}).Bytes())
+	f.Add(NewCreateNetworkTx(CreateNetworkTxInput{NetworkID: 1}).Bytes())
+	f.Add(NewTransformChainTx(TransformChainTxInput{NetworkID: 1}).Bytes())
+	f.Add(NewConvertNetworkToL1Tx(ConvertNetworkToL1TxInput{NetworkID: 1}).Bytes())
+	f.Add(NewCreateSovereignL1Tx(CreateSovereignL1TxInput{NetworkID: 1}).Bytes())
+
+	// Adversarial seeds.
+	f.Add([]byte{})
+	f.Add([]byte("ZAP\x00")) // magic only
+
+	f.Fuzz(func(t *testing.T, buf []byte) {
+		// Property: no Wrap*Tx panics on arbitrary input.
+		// (defer-recover for the whole batch — any panic from any
+		//  wrapper is a regression.)
+		defer func() {
+			if r := recover(); r != nil {
+				t.Fatalf("Wrap*Tx panicked on input len=%d: %v", len(buf), r)
+			}
+		}()
+
+		acceptedKinds, errs := wrapAllKinds(buf)
+
+		// Property: at most ONE wrapper accepts.
+		if len(acceptedKinds) > 1 {
+			t.Fatalf("cross-type confusion: %d wrappers accepted same buffer (kinds: %v)",
+				len(acceptedKinds), acceptedKinds)
+		}
+
+		// Property: every rejecting wrapper returns a typed error
+		// (ErrWrongTxKind / ErrWrongSchemaVersion / zap sentinel). No
+		// nil-from-Wrap-but-not-in-accepted weirdness.
+		for i, e := range errs {
+			if e == nil && len(acceptedKinds) == 0 {
+				t.Fatalf("wrapper #%d returned nil err but accepted=0", i)
+			}
+			if e != nil {
+				// Acceptable error families: typed ZAP / typed wrap.
+				if errors.Is(e, ErrWrongTxKind) ||
+					errors.Is(e, ErrWrongSchemaVersion) ||
+					errors.Is(e, zap.ErrBufferTooSmall) ||
+					errors.Is(e, zap.ErrInvalidMagic) ||
+					errors.Is(e, zap.ErrInvalidVersion) {
+					continue
+				}
+				// Unknown error type — log it (typed errors should
+				// cover every reject path; if not, that's worth
+				// triaging but not a panic).
+				t.Logf("wrapper #%d returned unexpected error type: %v", i, e)
+			}
+		}
+	})
+}
@@ -39,6 +39,15 @@ const (
 	TxKindImport                     TxKind = 13
 	TxKindExport                     TxKind = 14
 	TxKindCreateChain                TxKind = 15
+	// Batch 4 — remaining P-chain tx types:
+	TxKindAddValidator                TxKind = 16 // pre-Etna legacy validator add
+	TxKindAddDelegator                TxKind = 17 // pre-Etna legacy delegator add
+	TxKindAddPermissionlessDelegator  TxKind = 18 // Etna+ permissionless delegator
+	TxKindAddChainValidator           TxKind = 19 // chain/subnet validator add (rebranded from AddSubnetValidator)
+	TxKindCreateNetwork               TxKind = 20 // create a network (rebranded from CreateSubnet)
+	TxKindTransformChain              TxKind = 21 // transform chain config (rebranded from TransformSubnet)
+	TxKindConvertNetworkToL1          TxKind = 22 // convert network → L1 (rebranded from ConvertSubnetToL1)
+	TxKindCreateSovereignL1           TxKind = 23 // create sovereign L1
 )

 // OffsetTxKind is the fixed wire position of the discriminator. Every
@@ -0,0 +1,157 @@
+// Copyright (C) 2026, Lux Industries Inc. All rights reserved.
+// See the file LICENSE for licensing terms.
+
+package zap_native
+
+import (
+	"errors"
+
+	"github.com/luxfi/ids"
+	"github.com/luxfi/zap"
+)
+
+// AddressList is a variable-length list of 20-byte ids.ShortID addresses.
+// Stride is ids.ShortIDLen (20). The wire layer guarantees length*stride
+// fits in the message buffer via Object.ListStride (zap v0.7.2+).
+type AddressList struct {
+	list zap.List
+}
+
+// Len returns the number of addresses.
+func (a AddressList) Len() int { return a.list.Len() }
+
+// IsNull returns true if no list pointer was set.
+func (a AddressList) IsNull() bool { return a.list.IsNull() }
+
+// At returns the i'th address. Returns the zero ShortID when out of range.
+func (a AddressList) At(i int) ids.ShortID {
+	var out ids.ShortID
+	if i < 0 || i >= a.list.Len() {
+		return out
+	}
+	// Read 20 bytes via the list's underlying byte indexing.
+	obj := a.list.Object(i, ids.ShortIDLen)
+	for j := 0; j < ids.ShortIDLen; j++ {
+		out[j] = obj.Uint8(j)
+	}
+	return out
+}
+
+// AddressListView reads an AddressList from a parent object's field offset.
+// Uses the per-stride clamp introduced in zap v0.7.2: a poisoned length
+// field that passes the permissive baseline gets rejected here.
+//
+// READ-ONLY: each address aliases the underlying ZAP buffer.
+func AddressListView(parent zap.Object, fieldOffset int) AddressList {
+	return AddressList{list: parent.ListStride(fieldOffset, ids.ShortIDLen)}
+}
+
+// WriteAddressList writes an address list at the builder's current position
+// and returns (offset, entryCount) suitable for ObjectBuilder.SetList.
+func WriteAddressList(b *zap.Builder, addrs []ids.ShortID) (offset, entryCount int) {
+	if len(addrs) == 0 {
+		return 0, 0
+	}
+	lb := b.StartList(ids.ShortIDLen)
+	for _, a := range addrs {
+		lb.AddBytes(a[:])
+	}
+	off, _ := lb.Finish()
+	return off, len(addrs)
+}
+
+// ErrOwnerSingleAddrUseStub is returned by NewOwner when the input
+// addresses slice has length 1 — callers should use OwnerStub directly
+// for the zero-alloc fast path. Multi-address Owner exists only when
+// threshold > 1 or multiple co-signers are required.
+var ErrOwnerSingleAddrUseStub = errors.New(
+	"zap_native: Owner requires len(Addresses) >= 2; use OwnerStub for single-address fast path",
+)
+
+// Owner is the multi-address output owner. It composes a threshold +
+// locktime + a variable AddressList. Stride for the AddressList lives in
+// the same buffer's variable section; the parent object's fixed section
+// carries (threshold, locktime, AddressList ptr).
+//
+// Wire layout per Owner header (size 16 bytes; the AddressList itself
+// lives in the variable section pointed-to by the list pointer):
+//
+//	Threshold       uint32 @ 0
+//	Locktime        uint64 @ 4
+//	AddressList     8B     @ 12   (4-byte relOffset + 4-byte length)
+//
+// Total header = 20 bytes. The Owner header is embedded INLINE in the
+// parent tx's fixed section. Variable-section addresses are appended to
+// the parent's variable area by WriteOwner.
+//
+// Design call: OwnerStub remains the canonical single-address path
+// (zero-alloc, 32 bytes total). Owner is used ONLY when len(Addresses) >= 2.
+// NewOwner refuses the single-address case (ErrOwnerSingleAddrUseStub) so
+// callers must consciously pick the right primitive. This forces:
+//
+//   - The common case stays in the fast path (OwnerStub, 32B inline).
+//   - The multi-sig case carries the multi-address overhead explicitly.
+//   - No silent fallback; the type system makes the choice load-bearing.
+const (
+	OffsetOwnerHeader_Threshold   = 0
+	OffsetOwnerHeader_Locktime    = 4
+	OffsetOwnerHeader_AddressList = 12
+	SizeOwnerHeader               = 20
+)
+
+// Owner is the zero-copy accessor over an Owner header embedded in a parent
+// tx. The AddressList view spans the parent's variable section.
+//
+// Owner stores the parent + base offset (not a sub-Object) because zap.Object
+// is opaque to in-place sub-views; we read each field via parent.UintX at
+// the (baseOffset + fieldOffset) position.
+type Owner struct {
+	parent     zap.Object
+	baseOffset int
+}
+
+// Threshold returns the signature-required count.
+func (o Owner) Threshold() uint32 {
+	return o.parent.Uint32(o.baseOffset + OffsetOwnerHeader_Threshold)
+}
+
+// Locktime returns the unix timestamp before which the owner cannot spend.
+func (o Owner) Locktime() uint64 {
+	return o.parent.Uint64(o.baseOffset + OffsetOwnerHeader_Locktime)
+}
+
+// Addresses returns the AddressList view. Each address aliases the parent
+// ZAP buffer.
+func (o Owner) Addresses() AddressList {
+	return AddressListView(o.parent, o.baseOffset+OffsetOwnerHeader_AddressList)
+}
+
+// OwnerView reads an Owner from a parent object's embedded-header offset.
+// The Owner header is INLINE within the parent's fixed section (size
+// SizeOwnerHeader = 20 bytes), so this returns a sub-view rather than
+// dereferencing a relative pointer.
+//
+// Use case: a parent tx struct reserves SizeOwnerHeader bytes at a known
+// offset for the embedded Owner; this constructor returns the accessor.
+func OwnerView(parent zap.Object, fieldOffset int) Owner {
+	return Owner{parent: parent, baseOffset: fieldOffset}
+}
+
+// OwnerInput is the constructor input for a multi-address Owner.
+type OwnerInput struct {
+	Threshold uint32
+	Locktime  uint64
+	Addresses []ids.ShortID
+}
+
+// NewOwnerInline writes the Owner's variable-section addresses into the
+// builder and returns the (threshold, locktime, addrListOff, addrListLen)
+// quad ready for the parent ObjectBuilder to write into the embedded
+// Owner header. Returns ErrOwnerSingleAddrUseStub when len(Addresses) < 2.
+func NewOwnerInline(b *zap.Builder, in OwnerInput) (threshold uint32, locktime uint64, addrListOff, addrListLen int, err error) {
+	if len(in.Addresses) < 2 {
+		return 0, 0, 0, 0, ErrOwnerSingleAddrUseStub
+	}
+	off, count := WriteAddressList(b, in.Addresses)
+	return in.Threshold, in.Locktime, off, count, nil
+}
@@ -0,0 +1,90 @@
+// Copyright (C) 2026, Lux Industries Inc. All rights reserved.
+// See the file LICENSE for licensing terms.
+
+package zap_native
+
+import (
+	"testing"
+
+	"github.com/luxfi/ids"
+	"github.com/luxfi/zap"
+)
+
+// TestOwnerMultiAddressRoundTrip pins the multi-address Owner primitive.
+// Parent tx embeds SizeOwnerHeader bytes at offset 0; address list lives in
+// the variable section.
+func TestOwnerMultiAddressRoundTrip(t *testing.T) {
+	addrs := []ids.ShortID{
+		{0x01, 0x02, 0x03},
+		{0x10, 0x20, 0x30},
+		{0xa0, 0xb0, 0xc0},
+	}
+	in := OwnerInput{
+		Threshold: 2,
+		Locktime:  1_900_000_000,
+		Addresses: addrs,
+	}
+
+	b := zap.NewBuilder(256)
+	threshold, locktime, addrOff, addrLen, err := NewOwnerInline(b, in)
+	if err != nil {
+		t.Fatalf("NewOwnerInline: %v", err)
+	}
+
+	ob := b.StartObject(SizeOwnerHeader)
+	ob.SetUint32(OffsetOwnerHeader_Threshold, threshold)
+	ob.SetUint64(OffsetOwnerHeader_Locktime, locktime)
+	ob.SetList(OffsetOwnerHeader_AddressList, addrOff, addrLen)
+	ob.FinishAsRoot()
+
+	msg, err := zap.Parse(b.Finish())
+	if err != nil {
+		t.Fatalf("Parse: %v", err)
+	}
+
+	owner := OwnerView(msg.Root(), 0)
+	if owner.Threshold() != 2 {
+		t.Errorf("Threshold = %d, want 2", owner.Threshold())
+	}
+	if owner.Locktime() != 1_900_000_000 {
+		t.Errorf("Locktime = %d, want 1900000000", owner.Locktime())
+	}
+
+	addrList := owner.Addresses()
+	if addrList.Len() != 3 {
+		t.Fatalf("AddressList.Len() = %d, want 3", addrList.Len())
+	}
+	for i, want := range addrs {
+		got := addrList.At(i)
+		if got != want {
+			t.Errorf("address[%d] = %x, want %x", i, got, want)
+		}
+	}
+}
+
+// TestOwnerSingleAddressRefused pins the design decision: NewOwnerInline
+// refuses single-address inputs so callers consciously pick OwnerStub for
+// the zero-alloc fast path.
+func TestOwnerSingleAddressRefused(t *testing.T) {
+	in := OwnerInput{
+		Threshold: 1,
+		Locktime:  0,
+		Addresses: []ids.ShortID{{0x42}},
+	}
+	b := zap.NewBuilder(64)
+	_, _, _, _, err := NewOwnerInline(b, in)
+	if err != ErrOwnerSingleAddrUseStub {
+		t.Fatalf("NewOwnerInline(1 addr) = %v, want ErrOwnerSingleAddrUseStub", err)
+	}
+}
+
+// TestOwnerEmptyAddressRefused pins zero-address inputs as also refused;
+// an Owner with no addresses is logically invalid.
+func TestOwnerEmptyAddressRefused(t *testing.T) {
+	in := OwnerInput{Threshold: 0, Locktime: 0, Addresses: nil}
+	b := zap.NewBuilder(64)
+	_, _, _, _, err := NewOwnerInline(b, in)
+	if err != ErrOwnerSingleAddrUseStub {
+		t.Fatalf("NewOwnerInline(0 addrs) = %v, want ErrOwnerSingleAddrUseStub", err)
+	}
+}
@@ -976,7 +976,7 @@ func TestRedRound2_HIGH3_EvidenceListSafeAccessorsClamp(t *testing.T) {
 	}()

 	// Bound list — safe accessors clamp.
-	list := EvidenceListView(msg.Root(), 0).Bind(mb2, sb2)
+	list := NewEvidenceListView(msg.Root(), 0).Bind(mb2, sb2)
 	if list.Len() != 1 {
 		t.Fatalf("expected 1 entry, got %d", list.Len())
 	}
@@ -991,11 +991,16 @@ func TestRedRound2_HIGH3_EvidenceListSafeAccessorsClamp(t *testing.T) {
 	if got := e.SignatureB(); got != nil {
 		t.Fatalf("RED-HIGH-3 regression (SignatureB): got len=%d, want nil (poisoned len=0xFFFFFFFE)", len(got))
 	}
-	// Sanity: unbound list returns nil for all safe accessors (no parent).
-	unbound := EvidenceListView(msg.Root(), 0).At(0)
-	if got := unbound.MessageA(); got != nil {
-		t.Fatalf("unbound MessageA: got %x, want nil", got)
-	}
+	// Compile-time enforcement (NEW-V2): unbound EvidenceListView.At(0)
+	// returns an EvidenceEntry (no safe accessors). Calling .MessageA() on
+	// it is a build error — the type system refuses, forcing consumers
+	// through Bind() first. This is the "EvidenceEntry has no method
+	// MessageA" compile-time gate.
+	unbound := NewEvidenceListView(msg.Root(), 0).At(0)
+	_ = unbound.Height()             // raw accessor: OK
+	rel, length := unbound.MessageARange() // raw cursor: OK
+	_, _ = rel, length
+	// unbound.MessageA()           // BUILD ERROR — EvidenceEntry lacks MessageA
 }

 // TestRedRound2_HIGH3_SigIndicesArraySliceClamp pins the existence + clamp
@@ -0,0 +1,227 @@
+// Copyright (C) 2026, Lux Industries Inc. All rights reserved.
+// See the file LICENSE for licensing terms.
+
+package zap_native
+
+import (
+	"github.com/luxfi/ids"
+	"github.com/luxfi/zap"
+)
+
+// TransformChainTx — transform chain configuration (POST-rebrand from
+// TransformSubnetTx). Carries economic parameters for converting a
+// chain's validator/delegator economics. ChainAuth lives in the signed
+// wrapper, not here.
+//
+// Fixed-section layout (size 191 bytes):
+//
+//	TxKind                       uint8  @ 0
+//	NetworkID                    uint32 @ 1
+//	BlockchainID                 32B    @ 5
+//	OutsList                     8B     @ 37
+//	InsList                      8B     @ 45
+//	CredsList                    8B     @ 53
+//	SigIndicesArr                8B     @ 61
+//	SigArr                       8B     @ 69
+//	Memo                         8B     @ 77
+//	Chain                        32B    @ 85
+//	AssetID                      32B    @ 117
+//	InitialSupply                uint64 @ 149
+//	MaximumSupply                uint64 @ 157
+//	MinConsumptionRate           uint64 @ 165
+//	MaxConsumptionRate           uint64 @ 173
+//	MinValidatorStake            uint64 @ 181
+//	MaxValidatorStake            uint64 @ 189
+//	MinStakeDuration             uint32 @ 197
+//	MaxStakeDuration             uint32 @ 201
+//	MinDelegationFee             uint32 @ 205
+//	MinDelegatorStake            uint64 @ 209
+//	MaxValidatorWeightFactor     uint8  @ 217
+//	UptimeRequirement            uint32 @ 218
+const (
+	OffsetTransformChainTx_NetworkID                = 1
+	OffsetTransformChainTx_BlockchainID             = 5
+	OffsetTransformChainTx_OutsList                 = 37
+	OffsetTransformChainTx_InsList                  = 45
+	OffsetTransformChainTx_CredsList                = 53
+	OffsetTransformChainTx_SigIndicesArr            = 61
+	OffsetTransformChainTx_SigArr                   = 69
+	OffsetTransformChainTx_Memo                     = 77
+	OffsetTransformChainTx_Chain                    = 85
+	OffsetTransformChainTx_AssetID                  = 117
+	OffsetTransformChainTx_InitialSupply            = 149
+	OffsetTransformChainTx_MaximumSupply            = 157
+	OffsetTransformChainTx_MinConsumptionRate       = 165
+	OffsetTransformChainTx_MaxConsumptionRate       = 173
+	OffsetTransformChainTx_MinValidatorStake        = 181
+	OffsetTransformChainTx_MaxValidatorStake        = 189
+	OffsetTransformChainTx_MinStakeDuration         = 197
+	OffsetTransformChainTx_MaxStakeDuration         = 201
+	OffsetTransformChainTx_MinDelegationFee         = 205
+	OffsetTransformChainTx_MinDelegatorStake        = 209
+	OffsetTransformChainTx_MaxValidatorWeightFactor = 217
+	OffsetTransformChainTx_UptimeRequirement        = 218
+	SizeTransformChainTx                            = 222
+)
+
+type TransformChainTx struct {
+	msg *zap.Message
+	obj zap.Object
+}
+
+func (t TransformChainTx) NetworkID() uint32 {
+	return t.obj.Uint32(OffsetTransformChainTx_NetworkID)
+}
+func (t TransformChainTx) BlockchainID() ids.ID {
+	var out ids.ID
+	for i := 0; i < 32; i++ {
+		out[i] = t.obj.Uint8(OffsetTransformChainTx_BlockchainID + i)
+	}
+	return out
+}
+func (t TransformChainTx) Outs() OutputList {
+	return OutputListView(t.obj, OffsetTransformChainTx_OutsList)
+}
+func (t TransformChainTx) Ins() InputList {
+	return InputListView(t.obj, OffsetTransformChainTx_InsList)
+}
+func (t TransformChainTx) Credentials() CredentialList {
+	return CredentialListView(t.obj, OffsetTransformChainTx_CredsList)
+}
+func (t TransformChainTx) SigIndicesArray() SigIndicesArray {
+	return SigIndicesArrayView(t.obj, OffsetTransformChainTx_SigIndicesArr)
+}
+func (t TransformChainTx) SignatureArray() SignatureArray {
+	return SignatureArrayView(t.obj, OffsetTransformChainTx_SigArr)
+}
+func (t TransformChainTx) Memo() []byte { return t.obj.Bytes(OffsetTransformChainTx_Memo) }
+
+func (t TransformChainTx) Chain() ids.ID {
+	var out ids.ID
+	for i := 0; i < 32; i++ {
+		out[i] = t.obj.Uint8(OffsetTransformChainTx_Chain + i)
+	}
+	return out
+}
+func (t TransformChainTx) AssetID() ids.ID {
+	var out ids.ID
+	for i := 0; i < 32; i++ {
+		out[i] = t.obj.Uint8(OffsetTransformChainTx_AssetID + i)
+	}
+	return out
+}
+func (t TransformChainTx) InitialSupply() uint64 {
+	return t.obj.Uint64(OffsetTransformChainTx_InitialSupply)
+}
+func (t TransformChainTx) MaximumSupply() uint64 {
+	return t.obj.Uint64(OffsetTransformChainTx_MaximumSupply)
+}
+func (t TransformChainTx) MinConsumptionRate() uint64 {
+	return t.obj.Uint64(OffsetTransformChainTx_MinConsumptionRate)
+}
+func (t TransformChainTx) MaxConsumptionRate() uint64 {
+	return t.obj.Uint64(OffsetTransformChainTx_MaxConsumptionRate)
+}
+func (t TransformChainTx) MinValidatorStake() uint64 {
+	return t.obj.Uint64(OffsetTransformChainTx_MinValidatorStake)
+}
+func (t TransformChainTx) MaxValidatorStake() uint64 {
+	return t.obj.Uint64(OffsetTransformChainTx_MaxValidatorStake)
+}
+func (t TransformChainTx) MinStakeDuration() uint32 {
+	return t.obj.Uint32(OffsetTransformChainTx_MinStakeDuration)
+}
+func (t TransformChainTx) MaxStakeDuration() uint32 {
+	return t.obj.Uint32(OffsetTransformChainTx_MaxStakeDuration)
+}
+func (t TransformChainTx) MinDelegationFee() uint32 {
+	return t.obj.Uint32(OffsetTransformChainTx_MinDelegationFee)
+}
+func (t TransformChainTx) MinDelegatorStake() uint64 {
+	return t.obj.Uint64(OffsetTransformChainTx_MinDelegatorStake)
+}
+func (t TransformChainTx) MaxValidatorWeightFactor() uint8 {
+	return t.obj.Uint8(OffsetTransformChainTx_MaxValidatorWeightFactor)
+}
+func (t TransformChainTx) UptimeRequirement() uint32 {
+	return t.obj.Uint32(OffsetTransformChainTx_UptimeRequirement)
+}
+
+func (t TransformChainTx) Bytes() []byte { return t.msg.Bytes() }
+func (t TransformChainTx) IsZero() bool  { return t.msg == nil }
+
+func WrapTransformChainTx(b []byte) (TransformChainTx, error) {
+	msg, obj, err := parseAndCheckKind(b, TxKindTransformChain)
+	if err != nil {
+		return TransformChainTx{}, err
+	}
+	return TransformChainTx{msg: msg, obj: obj}, nil
+}
+
+type TransformChainTxInput struct {
+	NetworkID                uint32
+	BlockchainID             ids.ID
+	Outs                     []OutputListEntry
+	Ins                      []InputListEntry
+	Credentials              []CredentialListEntry
+	Memo                     []byte
+	Chain                    ids.ID
+	AssetID                  ids.ID
+	InitialSupply            uint64
+	MaximumSupply            uint64
+	MinConsumptionRate       uint64
+	MaxConsumptionRate       uint64
+	MinValidatorStake        uint64
+	MaxValidatorStake        uint64
+	MinStakeDuration         uint32
+	MaxStakeDuration         uint32
+	MinDelegationFee         uint32
+	MinDelegatorStake        uint64
+	MaxValidatorWeightFactor uint8
+	UptimeRequirement        uint32
+}
+
+func NewTransformChainTx(in TransformChainTxInput) TransformChainTx {
+	cap := zap.HeaderSize + 16 + SizeTransformChainTx
+	cap += len(in.Outs) * SizeTransferableOutput
+	cap += len(in.Ins) * SizeTransferableInput
+	cap += len(in.Credentials) * SizeCredential
+	cap += len(in.Memo)
+	b := zap.NewBuilder(cap)
+
+	outsOff, outsCount := WriteOutputList(b, in.Outs)
+	insOff, insCount, sigIndices := WriteInputList(b, in.Ins)
+	credsOff, credsCount, sigBlobs := WriteCredentialList(b, in.Credentials)
+	sigIdxArrOff, sigIdxArrCount := WriteSigIndicesArray(b, sigIndices)
+	sigArrOff, sigArrCount := WriteSignatureArray(b, sigBlobs)
+
+	ob := b.StartObject(SizeTransformChainTx)
+	ob.SetUint8(OffsetTxKind, uint8(TxKindTransformChain))
+	ob.SetUint32(OffsetTransformChainTx_NetworkID, in.NetworkID)
+	for i := 0; i < 32; i++ {
+		ob.SetUint8(OffsetTransformChainTx_BlockchainID+i, in.BlockchainID[i])
+		ob.SetUint8(OffsetTransformChainTx_Chain+i, in.Chain[i])
+		ob.SetUint8(OffsetTransformChainTx_AssetID+i, in.AssetID[i])
+	}
+	ob.SetList(OffsetTransformChainTx_OutsList, outsOff, outsCount)
+	ob.SetList(OffsetTransformChainTx_InsList, insOff, insCount)
+	ob.SetList(OffsetTransformChainTx_CredsList, credsOff, credsCount)
+	ob.SetList(OffsetTransformChainTx_SigIndicesArr, sigIdxArrOff, sigIdxArrCount)
+	ob.SetList(OffsetTransformChainTx_SigArr, sigArrOff, sigArrCount)
+	ob.SetBytes(OffsetTransformChainTx_Memo, in.Memo)
+	ob.SetUint64(OffsetTransformChainTx_InitialSupply, in.InitialSupply)
+	ob.SetUint64(OffsetTransformChainTx_MaximumSupply, in.MaximumSupply)
+	ob.SetUint64(OffsetTransformChainTx_MinConsumptionRate, in.MinConsumptionRate)
+	ob.SetUint64(OffsetTransformChainTx_MaxConsumptionRate, in.MaxConsumptionRate)
+	ob.SetUint64(OffsetTransformChainTx_MinValidatorStake, in.MinValidatorStake)
+	ob.SetUint64(OffsetTransformChainTx_MaxValidatorStake, in.MaxValidatorStake)
+	ob.SetUint32(OffsetTransformChainTx_MinStakeDuration, in.MinStakeDuration)
+	ob.SetUint32(OffsetTransformChainTx_MaxStakeDuration, in.MaxStakeDuration)
+	ob.SetUint32(OffsetTransformChainTx_MinDelegationFee, in.MinDelegationFee)
+	ob.SetUint64(OffsetTransformChainTx_MinDelegatorStake, in.MinDelegatorStake)
+	ob.SetUint8(OffsetTransformChainTx_MaxValidatorWeightFactor, in.MaxValidatorWeightFactor)
+	ob.SetUint32(OffsetTransformChainTx_UptimeRequirement, in.UptimeRequirement)
+	ob.FinishAsRoot()
+	msg, _ := zap.Parse(b.Finish())
+	return TransformChainTx{msg: msg, obj: msg.Root()}
+}