node: D-Chain (dexvm) plugin = native consensus matcher VM (dex/cmd/dchain)

The D-Chain runs as a PluginDir plugin loaded by luxd at the dexvm vmID
(mDVT5EWMumBp3LCqvKwuyZQeY1VXr1jvjGNAt8nL4UFiXvqXr). Until now that slot was
built from chains/dexvm/cmd/plugin — the STATELESS PROXY that relayed clob_*
frames over ZAP to a standalone dchain-venue (DexZapEndpoint). Matching did
NOT happen in luxd consensus; it happened in the external venue's single-node
sealer.

Build the dexvm slot from github.com/luxfi/dex@v1.5.10 ./cmd/dchain instead:
the NATIVE VM (pkg/dchain, block.ChainVM) that runs the lx.OrderBook matcher
INSIDE luxd consensus — BuildBlock drains the mempool, Block.Verify matches
against a versiondb overlay, Block.Accept commits. The trade IS the D-Chain
state transition, sequenced by luxd's multi-validator engine. No
DexZapEndpoint, no standalone venue in the trading path.

cmd/dchain wraps the VM in the same rpc.Serve plugin harness luxfi/evm uses
and is pure-Go (CGO=0); same GOFLAGS/go.sum-heal pattern as CHAINS_REF. The
other 10 chains VMs still build from chains. New ARG DEX_REF=v1.5.10; a FATAL
guard fails the build if the native D-Chain plugin is missing. Verified: a
fresh v1.5.10 clone builds ./cmd/dchain CGO=0 -mod=mod in Docker-like
isolation; native VM suite (TestLocalnetVenueE2E/TestFourPath/conservation)
passes.

.github/hero.svg

@@ -1,9 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="1280" height="640" viewBox="0 0 1280 640" role="img" aria-label="node">
-<rect width="1280" height="640" fill="#0A0A0A"/>
-<svg x="96" y="215" width="210" height="210" viewBox="17 26 66 66"><path d="M50 88 L17.09 31 L82.91 31 Z" fill="#fff"/></svg>
-<text x="378" y="276" font-family="Inter,system-ui,-apple-system,sans-serif" font-size="78" font-weight="800" letter-spacing="-2" fill="#ffffff">node</text>
-<text x="378" y="322" font-family="Inter,system-ui,sans-serif" font-size="30" fill="#ffffff" opacity=".66">Lux blockchain node — multi-consensus, post-quantum ready</text>
-<rect x="378" y="338" width="806" height="3" rx="1.5" fill="#ffffff" opacity=".9"/>
-<text x="378" y="390" font-family="Inter,system-ui,sans-serif" font-size="24" font-weight="600" fill="#ffffff" opacity=".5">github.com/luxfi</text>
-<text x="1184" y="390" text-anchor="end" font-family="Inter,system-ui,sans-serif" font-size="24" font-weight="600" fill="#ffffff" opacity=".5">lux.network</text>
-</svg>

.github/workflows/docker-gpu.yml

@@ -1,127 +0,0 @@
-name: Docker (GPU variant)
-
-# Per-arch NATIVE build of the GPU-accelerated node image (DEXVM_GPU=1).
-#
-# The standard image (docker.yml) is pure-Go (CGO_ENABLED=0) and cross-compiles
-# arm64 on an amd64 runner — correct, because nothing native is linked. The GPU
-# variant is different: its D-Chain dexvm plugin links the per-arch native
-# liblux_gpu (lux_gpu_dex_match_order), and a native GPU lib CANNOT be
-# cross-linked. So each arch is built on the arcd pool that owns the matching
-# silicon and the matching liblux_gpu artifact from lux-private/gpu-kernels:
-#
-#   arm64 → spark (GB10, CUDA)  → lux-gpu-linux-arm64.tar.gz
-#   amd64 → evo   (ROCm, native-linux personality) → lux-gpu-linux-amd64.tar.gz
-#
-# Each job emits ghcr.io/luxfi/node:<tag>-gpu-<arch>; the manifest job fuses
-# them into ghcr.io/luxfi/node:<tag>-gpu. The plain (CPU) manifest is untouched.
-#
-# This is opt-in and separate from docker.yml on purpose: an operator that wants
-# GPU matching pulls :<tag>-gpu; everyone else pulls the portable CPU image.
-
-on:
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: 'version tag to build as the GPU variant, e.g. v1.33.1'
-        required: true
-      lux_gpu_version:
-        description: 'lux-private/gpu-kernels release providing the per-arch liblux_gpu'
-        required: false
-        default: 'v0.1.0'
-
-permissions:
-  contents: read
-  packages: write
-  id-token: write
-
-jobs:
-  build:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - arch: arm64
-            runner: spark-lux-linux     # GB10 — CUDA host, native arm64
-            platform: linux/arm64
-          - arch: amd64
-            runner: evo-lux-linux        # Strix Halo — ROCm host, native amd64
-            platform: linux/amd64
-    name: node:gpu-${{ matrix.arch }} (native)
-    runs-on: ${{ matrix.runner }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.inputs.tag }}
-
-      # NATIVE only — no QEMU, no cross. The GPU lib is per-arch; assert the
-      # runner arch matches the target before building.
-      - name: Assert native arch
-        run: |
-          set -euo pipefail
-          host="$(uname -m)"
-          case "${{ matrix.arch }}" in
-            arm64) [ "$host" = "aarch64" ] || [ "$host" = "arm64" ] || { echo "::error::arm64 target on $host"; exit 1; } ;;
-            amd64) [ "$host" = "x86_64"  ] || { echo "::error::amd64 target on $host"; exit 1; } ;;
-          esac
-          echo "OK native ${{ matrix.arch }} on $host"
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-        with:
-          driver: docker-container
-          driver-opts: network=host
-
-      - name: Login to GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Resolve cross-repo PAT for private luxfi/* deps
-        id: pat
-        env:
-          GH_TOKEN: ${{ secrets.GH_TOKEN }}
-          UNIVERSE_PAT: ${{ secrets.UNIVERSE_PAT }}
-        run: |
-          tok="$GH_TOKEN"; [ -z "$tok" ] && tok="$UNIVERSE_PAT"
-          [ -n "$tok" ] || { echo "::error::no GH_TOKEN/UNIVERSE_PAT for private luxfi deps"; exit 1; }
-          echo "::add-mask::$tok"
-          { echo "token<<EOF"; echo "$tok"; echo "EOF"; } >> "$GITHUB_OUTPUT"
-
-      # Single-arch, native build. DEXVM_GPU=1 + CGO_ENABLED=1 make the dexvm
-      # plugin link the per-arch liblux_gpu fetched inside the Dockerfile from
-      # the lux-gpu release. BUILDPLATFORM == TARGETPLATFORM (native) so the
-      # Dockerfile's cross-compile branch is never taken.
-      - name: Build & push GPU variant (native ${{ matrix.arch }})
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: Dockerfile
-          platforms: ${{ matrix.platform }}
-          push: true
-          build-args: |
-            CGO_ENABLED=1
-            DEXVM_GPU=1
-            LUX_GPU_VERSION=${{ github.event.inputs.lux_gpu_version }}
-          secrets: |
-            ghtok=${{ steps.pat.outputs.token }}
-          tags: ghcr.io/luxfi/node:${{ github.event.inputs.tag }}-gpu-${{ matrix.arch }}
-
-  manifest:
-    needs: build
-    runs-on: [self-hosted, linux, amd64]
-    steps:
-      - name: Login to GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Fuse per-arch GPU images into one manifest
-        run: |
-          set -euo pipefail
-          T="ghcr.io/luxfi/node:${{ github.event.inputs.tag }}-gpu"
-          docker manifest create "$T" "$T-amd64" "$T-arm64"
-          docker manifest push "$T"
-          echo "published $T (amd64 + arm64)"

.github/workflows/docker.yml

@@ -2,11 +2,6 @@ name: Docker
 
 on:
   workflow_dispatch:
-    inputs:
-      tag:
-        description: 'existing version tag to (re)build as a multi-arch manifest, e.g. v1.32.1'
-        required: false
-        default: ''
   push:
     tags: ['v*']
 
@@ -16,27 +11,16 @@ permissions:
   id-token: write
 
 jobs:
-  build:
+  build-amd64:
     # In-cluster ARC pool (lux-build autoscalingrunnerset in lux-k8s, amd64
     # DOKS nodes, DinD sidecar). Replaces the offline evo classic runner.
     # ARC matches on the scale-set name, NOT classic [self-hosted,linux,amd64]
     # labels — the org runner group + arcd repo allowlist enforce isolation.
-    # arm64 is produced by Go cross-compile (CGO_ENABLED=0, Dockerfile
-    # TARGETARCH path) on the amd64 runner — no QEMU emulation of the build.
     runs-on: lux-build
     outputs:
       digest: ${{ steps.build.outputs.digest }}
     steps:
       - uses: actions/checkout@v4
-        with:
-          # On workflow_dispatch with an explicit `tag`, (re)build that tag
-          # as a multi-arch manifest; otherwise build the pushed ref.
-          ref: ${{ github.event.inputs.tag || github.ref }}
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-        with:
-          platforms: arm64
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
@@ -66,7 +50,6 @@ jobs:
             latest=false
           tags: |
             type=ref,event=tag
-            type=raw,value=${{ github.event.inputs.tag }},enable=${{ github.event.inputs.tag != '' }}
             type=sha,format=short,prefix=sha-
 
       - name: Resolve cross-repo PAT for private luxfi/* deps
@@ -102,13 +85,13 @@ jobs:
           echo "$tok" >> "$GITHUB_OUTPUT"
           echo "EOF" >> "$GITHUB_OUTPUT"
 
-      - name: Build & push (multi-arch)
+      - name: Build & push (amd64)
         id: build
         uses: docker/build-push-action@v6
         with:
           context: .
           file: Dockerfile
-          platforms: linux/amd64,linux/arm64
+          platforms: linux/amd64
           push: true
           build-args: |
             CGO_ENABLED=0
@@ -120,11 +103,11 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           provenance: false
-          cache-from: type=registry,ref=ghcr.io/luxfi/node:buildcache
-          cache-to: type=registry,ref=ghcr.io/luxfi/node:buildcache,mode=max
+          cache-from: type=registry,ref=ghcr.io/luxfi/node:buildcache-amd64
+          cache-to: type=registry,ref=ghcr.io/luxfi/node:buildcache-amd64,mode=max
 
   notify-universe:
-    needs: build
+    needs: build-amd64
     if: startsWith(github.ref, 'refs/tags/v')
     runs-on: lux-build
     steps:

Dockerfile

@@ -38,15 +38,12 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 
 WORKDIR /build
 
-# Skip checksum verification for luxfi + hanzoai packages: both are cross-org
-# deps not registered in the public sum.golang.org / proxy (reading e.g.
-# hanzoai/vfs@v0.4.1's go.mod via the public sumdb 404s and fails the build).
-ENV GONOSUMCHECK=github.com/luxfi/*,github.com/hanzoai/*
-ENV GONOSUMDB=github.com/luxfi/*,github.com/hanzoai/*
-# Use Go proxy for most deps (gonum.org is flaky via direct), direct only for
-# the cross-org private modules.
+# Skip checksum verification for luxfi packages (tags may be rewritten)
+ENV GONOSUMCHECK=github.com/luxfi/*
+ENV GONOSUMDB=github.com/luxfi/*
+# Use Go proxy for most deps (gonum.org is flaky via direct), direct only for luxfi
 ENV GOPROXY=https://proxy.golang.org,direct
-ENV GONOPROXY=github.com/luxfi/*,github.com/hanzoai/*
+ENV GONOPROXY=github.com/luxfi/*
 ENV GOFLAGS="-mod=mod"
 
 # Copy and download lux dependencies using go mod.
@@ -66,8 +63,7 @@ RUN --mount=type=secret,id=ghtok,required=false \
     if [ -s /run/secrets/ghtok ]; then \
         git config --global url."https://x-access-token:$(cat /run/secrets/ghtok)@github.com/".insteadOf "https://github.com/"; \
     fi && \
-    sed -i -E '/^github.com\/(luxfi|hanzoai)\//d' go.sum && \
-    go mod download -x
+    go mod download
 
 # Copy the code into the container
 COPY . .
@@ -98,26 +94,16 @@ RUN if [ "$TARGETPLATFORM" = "linux/arm64" ] && [ "$BUILDPLATFORM" != "linux/arm
     echo "export CC=gcc" > ./build_env.sh \
     ; fi
 
-# Fetch pre-built lux-accel (GPU crypto library). The release assets live in
-# the PRIVATE luxcpp/accel repo (resolves to lux-private/accel) — an
-# unauthenticated GitHub release-download 404s, so the fetch is authenticated
-# with the same `ghtok` BuildKit secret used for private go modules. It is
-# also best-effort (matches the cevm/lpm fetch contract below): the library is
-# ONLY linked at CGO_ENABLED=1, so a CGO_ENABLED=0 build (the canonical CI/devnet
-# build, pure-Go) does not need it and must not fail when it is unreachable.
+# Fetch pre-built lux-accel (GPU crypto library)
 ARG ACCEL_VERSION=v0.1.0
-RUN --mount=type=secret,id=ghtok,required=false \
-    ARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) && \
+RUN ARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) && \
     if [ "$ARCH" = "amd64" ]; then ACCEL_ARCH="linux-x86_64"; else ACCEL_ARCH="linux-arm64"; fi && \
     mkdir -p /usr/local/include /usr/local/lib && \
-    AUTH=""; [ -s /run/secrets/ghtok ] && AUTH="--header=Authorization: Bearer $(cat /run/secrets/ghtok)"; \
-    ( wget -q ${AUTH:+"$AUTH"} \
-        "https://github.com/luxcpp/accel/releases/download/${ACCEL_VERSION}/lux-accel-${ACCEL_ARCH}.tar.gz" \
-        -O /tmp/accel.tar.gz \
-      && tar -xzf /tmp/accel.tar.gz -C /usr/local \
-      && rm /tmp/accel.tar.gz \
-      && ldconfig 2>/dev/null \
-    ) || echo "WARN: lux-accel ${ACCEL_VERSION} fetch skipped (private/unreachable; GPU accel unused at CGO_ENABLED=0)"
+    wget -q "https://github.com/luxcpp/accel/releases/download/${ACCEL_VERSION}/lux-accel-${ACCEL_ARCH}.tar.gz" \
+        -O /tmp/accel.tar.gz && \
+    tar -xzf /tmp/accel.tar.gz -C /usr/local && \
+    rm /tmp/accel.tar.gz && \
+    ldconfig 2>/dev/null || true
 
 # Fetch pre-built luxcpp/cevm libs (libevm, libevm-gpu, libluxgpu,
 # libcevm_precompiles + go_bridge.h). When CGO_ENABLED=1 these libraries are
@@ -149,11 +135,6 @@ ARG BUILD_SCRIPT=build.sh
 ARG LUXD_COMMIT=""
 ENV CGO_ENABLED=${CGO_ENABLED}
 RUN . ./build_env.sh && \
-    # `COPY . .` above restored the committed go.sum (stale first-party hashes when
-    # a luxfi/hanzoai module was re-tagged). Re-strip first-party lines so -mod=mod
-    # re-records the CURRENT content hashes already in the module cache (from the
-    # `go mod download` step). Without this, a re-tag => go.sum SECURITY ERROR.
-    sed -i -E '/^github.com\/(luxfi|hanzoai)\//d' go.sum && \
     echo "{CC=$CC, TARGETPLATFORM=$TARGETPLATFORM, BUILDPLATFORM=$BUILDPLATFORM, CGO_ENABLED=${CGO_ENABLED}}" && \
     export GOARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) && \
     export LUXD_COMMIT="${LUXD_COMMIT}" && \
@@ -231,33 +212,7 @@ RUN . ./build_env.sh && \
 # The money path (V4 swap ABI, marker install, two-phase atomic settle) is byte-for-byte
 # unchanged: ONLY the dispatch-path timestamp source, the SubBalance fail-mode, the genesis
 # builder guard, and stale 0x9010 comments changed.
-#
-# v1.99.37 (precompile v0.5.57): wires the 0x9999 ERC-20 Call surface to the DEX
-# settlement precompile (commit 2cf30e43d) and gates that Call surface to the DEX
-# settlement family 0x9999/0x9996 (commit 9579f2e34). Before this, a CALL into
-# 0x9999's ERC-20 settle path saw a nil PrecompileEnv (GetPrecompileEnv == nil) and
-# could not resolve the token-transfer Call seam — the two-phase atomic settle's
-# ERC-20 leg had no env to execute against. precompile v0.5.57 also adds the
-# CALL-only DELEGATECALL guard (commit feeaab5a0) so the settle surface is reachable
-# only via CALL (not DELEGATECALL, which would run it in the caller's context). Also
-# converges deps to latest patch within v1.x.x (threshold v1.9.9, crypto v1.19.21,
-# database v1.20.3, geth v1.17.12, warp v1.19.5, vm v1.2.5, api v1.0.15 — the
-# UTXOAssetID rename that fixed the LuxAssetID build break) and removes the dead
-# vendored dexConfig upgrade fixtures. The 0x9999 swap ABI + dated-fork activation
-# (DexSettleActivationTime = 1766704800) are unchanged from v1.99.34.
-#
-# v1.99.40 (precompile v0.5.59, chains v1.3.19, consensus v1.25.21): the permissionless
-# 0x9999 DEX value path lands end-to-end. precompile v0.5.58/59 = AssetResolver (real
-# on-chain canonical resolution, NO admin allowlist), one synchronous router/book/journal,
-# minOut on every route, no keeper/venue/live-ZAP/second-book; the env→Call ERC-20 vault
-# seam + in-state-vault resolution make a real ERC-20 settle. evm v1.99.39 = the
-# reprocess-bind fix: NewBlockChain binds the chain Runtime (networkID/C-Chain id) BEFORE
-# startup reprocess, so an unclean restart after a 0x9999 swap re-executes the committed
-# swap with the correct identity instead of (0, Empty) — previously that reverted the swap,
-# failed ValidateState, and BRICKED the node. Proven on-node: real swap → kill -9 →
-# clean reboot, state intact. v1.99.40 = v1.99.39 + deps to latest. consensus v1.25.21 =
-# stake-weighted alpha-of-K quorum finality + per-height single-finalize + epoch-bound certs.
-ARG EVM_VERSION=v1.101.2
+ARG EVM_VERSION=v1.99.35
 ARG EVM_VM_ID=mgj786NP7uDwBCcq6YwThhaN8FLyybkCa4zBWTQbNgmK6k9A6
 # the pinned evm go.mod may pin a dead luxfi/upgrade pseudo-version
 # (v1.0.1-0.20260603055252-f51810805436 — commit pruned from origin). Heal it to
@@ -270,18 +225,6 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
     cd /tmp/evm && \
     . /build/build_env.sh && \
     go mod edit -require=github.com/luxfi/upgrade@v1.0.1 && \
-    # evm v1.99.52 = v1.99.51 + the idle-builder bounded-wake backstop
-    # (startPendingTxPoll: a 500ms mempool re-poll so a tx after idle wakes the
-    # builder within a bounded window — closes the lost-wakeup/subscribe-gap;
-    # deterministic, wake-timing only). v1.99.51 = the block-production stall fix
-    # (WaitForEvent builder-ready race + target-rate build pacing — un-freezes the
-    # C-Chain that stalled at the imported frontier) on top of precompile v0.16.0
-    # enable-everything
-    # (wallet curves + standard precompiles enabled; fflonk fail-closed; accel
-    # byte-identity; DEX big.Rat + determinism). Pin chains v1.4.8 (warp
-    # consolidated to one luxfi/warp helper; graphvm genesis-last-accepted fix)
-    # to match the chain-VM plugin stage (CHAINS_REF) below.
-    go mod edit -require=github.com/luxfi/chains@v1.4.8 && \
     find /tmp/evm -name go.sum -exec sed -i -E '/^github.com\/(luxfi|hanzoai)\//d' {} + && \
     GOARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) \
     CGO_ENABLED=0 GOFLAGS=-mod=mod \
@@ -306,12 +249,9 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
 #   zkvm         -> vv3qPfyTVXZ5ArRZA9Jh4hbYDTBe43f7sgQg4CHfNg1rnnvX9
 
 # MUST track node's go.mod luxfi/chains (the D-Chain dexvm + 10 VM plugins).
+# v1.3.14 = the native-atomic seam (rail-bound D->C atomic, LP committed-liquidity).
 # Bump with every chains release or the bundled VM plugins go stale vs node's deps.
-# v1.4.7 == node go.mod's luxfi/chains pin: warp consolidated to ONE luxfi/warp
-# helper (bridgevm/zkvm/thresholdvm), graphvm genesis-last-accepted fix, built on
-# evm v1.99.48 + precompile v0.16.0 (enable-everything builder surface). Keeps the
-# baked VM plugins in lockstep with the host node.
-ARG CHAINS_REF=v1.4.8
+ARG CHAINS_REF=v1.3.16
 RUN --mount=type=cache,target=/root/.cache/go-build \
     git clone --depth 1 --branch ${CHAINS_REF} https://github.com/luxfi/chains.git /tmp/chains && \
     find /tmp/chains -name go.sum -exec sed -i -E '/^github.com\/(luxfi|hanzoai)\//d' {} +
@@ -363,77 +303,19 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
 # REPLACES the former chains/dexvm proxy (which relayed clob_* over ZAP to a
 # standalone dchain-venue): there is no DexZapEndpoint and no standalone venue in
 # the trading path. cmd/dchain wraps the VM in the SAME rpc.Serve plugin harness
-# luxfi/evm boots through. The STANDARD node builds this plugin pure-Go (CGO=0),
-# so its matcher is lx.MatchOrderCPU — the pure-Go oracle that works on every
-# arch with no native deps. GPU acceleration is OPT-IN via DEXVM_GPU=1 (below):
-# pkg/lx's single orderbook_gpu.go links the unified lux-gpu (liblux_gpu) and
-# runtime-selects CUDA/HIP/Metal, falling back to MatchOrderCPU when no device is
-# present — so the two paths are byte-equal by contract (orderbook_gpu_test.go).
-# Because lux-gpu is a per-arch native lib, the DEXVM_GPU variant CANNOT be
-# cross-compiled: it must be built on the matching arcd GPU pool (see the
-# per-arch GPU-variant build in .github/workflows/docker-gpu.yml). v1.5.10 is
-# the first tag whose cmd/dchain builds CGO=0
-# (drops the phantom dchain+cgo gate); v1.5.11 wires CLOB order ingestion over the
-# node HTTP router (VM.CreateHandlers -> /ext/bc/D/dex/<method>, pkg/dchain/ingest.go)
-# so an order POSTed to the node flows submitTx -> mempool -> consensus -> Verify
-# (match) -> Accept; v1.5.12 persists the head block so the VM survives a restart
-# once advanced past genesis (GetBlock(lastAccepted) no longer ErrNotFound);
-# v1.5.13 indexes processing blocks so the plugin transport's ID-only Accept
-# (GetBlock(builtID)) resolves the just-built block — without it the engine's
-# self-finalize Accept is a silent no-op and the clob submitTx waiter hangs (no
-# D-Chain blocks). v1.5.14 consumes luxfi/database v1.20.4, which fixes prefixdb
-# returning ZERO rows for a nil-start prefix scan over a prefixdb-wrapped chain
-# DB (every plugin VM via vm/rpc) — that stranded the native D-Chain order book
-# (rebuildBookFromDB folded empty -> 0 fills despite committed asks). v1.5.15 adds
-# the committed-state READ surface (clob_get_trades/orders/markets/book over
-# /ext/bc/D/dex/<method>, pkg/dchain/read.go): read-only JSON of the durable trade
-# log / resting book / markets, served beside the writes with ZERO consensus
-# impact. Needed to VERIFY a fill replicated identically across validators (query
-# every node, diff the trade rows + head root) and to feed markets-display (native
-# fills are trade: rows). Bump with every dex release that changes the VM, like
-# CHAINS_REF for the other 10 VMs.
-ARG DEX_REF=v1.5.15
-
-# GPU-accelerated D-Chain matcher (opt-in). DEXVM_GPU=1 fetches the per-arch
-# unified lux-gpu (built natively on the arcd GPU pools by
-# lux-private/gpu-kernels' liblux-gpu.yml — CUDA/arm64 on spark, HIP/amd64 on
-# evo, Metal on the mac) and builds the dexvm plugin with CGO_ENABLED=1 so
-# pkg/lx/orderbook_gpu.go links liblux_gpu (lux_gpu_dex_match_order +
-# lux_gpu_backend_name). Default 0 = the portable pure-Go CPU matcher, unchanged.
-# The fetch is per-arch and best-effort in the same spirit as lux-accel above,
-# but for DEXVM_GPU=1 a MISSING lib is FATAL: an operator asking for the GPU
-# variant must get a GPU-linked plugin, not a silent CPU one. Do NOT set
-# DEXVM_GPU=1 in a cross-arch (BUILDPLATFORM != TARGETPLATFORM) build — a native
-# GPU lib cannot be cross-linked; build the GPU variant on the matching pool.
-ARG DEXVM_GPU=0
-ARG LUX_GPU_VERSION=v0.1.0
-RUN --mount=type=secret,id=ghtok,required=false \
-    if [ "${DEXVM_GPU}" = "1" ]; then \
-        ARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) && \
-        AUTH=""; [ -s /run/secrets/ghtok ] && AUTH="--header=Authorization: Bearer $(cat /run/secrets/ghtok)"; \
-        wget -q ${AUTH:+"$AUTH"} \
-            "https://github.com/lux-private/gpu-kernels/releases/download/${LUX_GPU_VERSION}/lux-gpu-linux-${ARCH}.tar.gz" \
-            -O /tmp/lux-gpu.tar.gz \
-          && tar -xzf /tmp/lux-gpu.tar.gz -C /usr/local \
-          && rm /tmp/lux-gpu.tar.gz \
-          && ldconfig 2>/dev/null || true; \
-        test -f /usr/local/lib/pkgconfig/lux-gpu.pc \
-            || { echo "FATAL: DEXVM_GPU=1 but lux-gpu ${LUX_GPU_VERSION} (${ARCH}) unavailable — cannot build the GPU dexvm variant"; exit 1; }; \
-    else \
-        echo "DEXVM_GPU=0: dexvm builds pure-Go CPU matcher (no lux-gpu link)"; \
-    fi
-
+# luxfi/evm boots through, and is pure-Go (CGO=0) — the optional GPU AMM
+# accelerator in pkg/lx is a separate concern gated by its own cuda/metal tags and
+# is NOT linked here. v1.5.10 is the first tag whose cmd/dchain builds CGO=0
+# (drops the phantom dchain+cgo gate). Bump with every dex release that changes the
+# VM, like CHAINS_REF for the other 10 VMs.
+ARG DEX_REF=v1.5.10
 RUN --mount=type=cache,target=/root/.cache/go-build \
     git clone --depth 1 --branch ${DEX_REF} https://github.com/luxfi/dex.git /tmp/dex && \
     find /tmp/dex -name go.sum -exec sed -i -E '/^github.com\/(luxfi|hanzoai)\//d' {} + && \
     cd /tmp/dex && \
     . /build/build_env.sh && \
-    # DEXVM_GPU=1 → CGO on, orderbook_gpu.go links lux-gpu (pkg-config finds the
-    # per-arch lib fetched above). Default → CGO off, portable pure-Go matcher.
-    if [ "${DEXVM_GPU}" = "1" ]; then DEX_CGO=1; else DEX_CGO=0; fi && \
-    export PKG_CONFIG_PATH="/usr/local/lib/pkgconfig:${PKG_CONFIG_PATH:-}" && \
     GOARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) \
-    CGO_ENABLED=${DEX_CGO} GOFLAGS=-mod=mod \
+    CGO_ENABLED=0 GOFLAGS=-mod=mod \
     go build -ldflags="-s -w" \
         -o /luxd/build/plugins/mDVT5EWMumBp3LCqvKwuyZQeY1VXr1jvjGNAt8nL4UFiXvqXr ./cmd/dchain && \
     chmod +x /luxd/build/plugins/mDVT5EWMumBp3LCqvKwuyZQeY1VXr1jvjGNAt8nL4UFiXvqXr && \
@@ -464,12 +346,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     curl ca-certificates git \
     && rm -rf /var/lib/apt/lists/*
 
-# Native GPU libraries (optional). /usr/local/lib exists (empty) on the builder
-# for the standard CGO_ENABLED=0 / DEXVM_GPU=0 image, so this COPY is a no-op
-# there. For the DEXVM_GPU=1 variant it carries the per-arch liblux_gpu.so that
-# the D-Chain dexvm plugin dynamically links; ldconfig then makes it resolvable.
-# Pure-Go fallbacks are used whenever the library is absent.
-COPY --from=builder /usr/local/lib/ /usr/local/lib/
+# GPU crypto library (optional -- only present when built with CGO_ENABLED=1 + luxcpp).
+# Pure Go fallbacks are used when the library is absent.
 RUN ldconfig 2>/dev/null || true
 
 # Maintain compatibility with previous images.

LLM.md

@@ -137,17 +137,7 @@ charge less.
 
 ## Essential Commands
 
-### Release & build (canonical) — via platform.hanzo.ai, NOT GitHub Actions
-The ONE way to build + publish releases is **[`RELEASE.md`](./RELEASE.md)**:
-platform.hanzo.ai reads [`hanzo.yml`](./hanzo.yml) on a `v*` tag push and
-schedules the image build onto self-hosted **arcd** pools (`lux-build-linux-*`)
-over the native long-poll fabric — no GitHub-Actions hop. ONE `Dockerfile`
-build yields BOTH artifacts: the node image (`ghcr.io/luxfi/node:vX.Y.Z`, luxd
-+ 12 baked VM plugins) and, via [`scripts/publish_plugin_set.sh`](./scripts/publish_plugin_set.sh),
-the plugin set to `s3://lux-plugins-<env>/<pluginset>/` (operator `pluginSource`).
-The `.github/workflows/*` build/release workflows are retired (RELEASE.md §Retire).
-
-### Building (local dev only)
+### Building
 ```bash
 # Build node binary
 ./scripts/run_task.sh build
@@ -576,7 +566,7 @@ For importing pre-merge blocks, Shanghai must be active based on `ShanghaiTime`,
 ### 8. `vms/components/lux` vs `luxfi/utxo` (parallel UTXO types)
 The `github.com/luxfi/node/vms/components/lux` package contains a parallel
 `lux.UTXO`/`lux.TransferableInput` type tree alongside `github.com/luxfi/utxo`.
-External consumers (e.g. a white-label tenant's network-bootstrap tooling) need
+External consumers (e.g. `~/work/liquidity/network-bootstrap/fund.go`) need
 to import the `vms/components/lux` variant to interop with PlatformVM/AVM
 tx builders — `luxfi/utxo` types alone are not accepted by the X→P export
 path. This is a known anomaly pending #58 follow-up consolidation; do NOT

README.md

@@ -1,5 +1,3 @@
-<p align="center"><img src=".github/hero.svg" alt="node" width="880"></p>
-
 <div align="center">
   <img src="resources/LuxLogoRed.png?raw=true">
 </div>

RELEASE.md

@@ -1,187 +0,0 @@
-# Lux release — build + publish via platform.hanzo.ai (the ONE canonical way)
-
-This is the single, repeatable way to build and publish the Lux release
-artifacts. It runs entirely on our own infrastructure — **the PaaS
-(platform.hanzo.ai) + self-hosted arcd runners + DOKS/fleet**. There is **no
-GitHub Actions build path** (the `.github/workflows/*` build/release workflows
-are retired — see [§Retire](#retire-the-github-actions-build-workflows)).
-
-## What a release produces
-
-ONE `Dockerfile` multi-stage build (this repo) is the single source of truth.
-It compiles `luxd` + all 12 VM plugins (CGO_ENABLED=0) and yields TWO
-distribution surfaces:
-
-| # | Artifact | Destination | Consumed by |
-|---|----------|-------------|-------------|
-| 1 | node image (luxd + 12 plugins baked at `/luxd/build/plugins/`) | `ghcr.io/luxfi/node:vX.Y.Z` | operator pod image; `startup.sh cp /luxd/build/plugins/*` |
-| 2 | plugin set (the 12 VM-ID binaries + `SHA256SUMS`) | `s3://lux-plugins-<env>/<pluginset>/` | operator `plugin-fetch` init container (LuxNetwork CR `pluginSource`) |
-
-Artifact 2 is **extracted from** artifact 1 — the plugins are never compiled
-twice. One build, two surfaces (DRY, orthogonal).
-
-The plugin versions are pinned as Dockerfile build-args, kept in lockstep with
-this repo's `go.mod`:
-
-- `EVM_VERSION` (luxfi/evm — C-Chain EVM, the `0x9999` settlement surface)
-- `CHAINS_REF` (luxfi/chains — the 10 non-DEX VMs incl. bridgevm)
-- `DEX_REF` (luxfi/dex `cmd/dchain` — the native D-Chain DEX VM)
-
-## The machinery
-
-```
-git tag vX.Y.Z (push)
-        │  GitHub App webhook ─▶ https://platform.hanzo.ai/v1/github-webhook
-        ▼
-  platform BuildScheduler  ── reads hanzo.yml @ tag, validates, enqueues
-        │                      one build_job per matrix entry
-        ▼
-  native long-poll fabric (build-queue.ts)        NO GitHub Actions hop
-        │  arcd runner POST /v1/arcd/poll  (HMAC)
-        ▼
-  arcd runner on pool lux-build-linux-<arch>
-        │  git checkout @ tag → docker build -f Dockerfile . → docker push
-        ▼
-  ghcr.io/luxfi/node:vX.Y.Z         (artifact 1)
-        │  POST /v1/arcd/complete (status, image_digest)
-        ▼
-  build_job (DB, system-of-record)
-```
-
-- **PaaS**: `platform.hanzo.ai` (`~/work/hanzo/platform`,
-  `pkg/platform/src/services/ci/`). Owns the schema, the scheduler, the durable
-  `build_job` record, and the native long-poll dispatch.
-- **Build muscle**: self-hosted **arcd** runner pools, `lux-build-linux-amd64`
-  and `lux-build-linux-arm64` (one daemon per fleet host; `spark` = linux/arm64,
-  amd64 via buildx). NO GitHub-hosted runners; NO GitHub Actions orchestration
-  on the native path.
-- **Contract**: `~/work/hanzo/platform/docs/PLATFORM_CI.md`.
-
-## Build — the one command
-
-A release is a semver tag push. The declarative entrypoint is this repo's
-[`hanzo.yml`](./hanzo.yml); the trigger is one of:
-
-**(a) Tag push (normal release).** Cutting the tag IS the release:
-
-```bash
-git tag v1.30.41 && git push origin v1.30.41
-```
-
-The webhook maps `refs/tags/v1.30.41` → `branch=v1.30.41`; `hanzo.yml`'s
-`tag-pattern: "{{git.branch}}"` yields the image tag `v1.30.41`. Platform
-schedules the amd64 + arm64 builds onto the live `lux-build-*` arcd pools and
-pushes the multi-arch image to GHCR.
-
-**(b) On-demand (re-release / backfill).** The platform `buildJob.trigger`
-tRPC mutation schedules the same build for an explicit ref, no push required:
-
-```
-buildJob.trigger({
-  installationId: "<luxfi GitHub App installation id>",
-  repo: "luxfi/node",
-  sha:  "<commit at the tag>",
-  ref:  "refs/tags/v1.30.41",
-  branch: "v1.30.41"            // → image tag via {{git.branch}}
-})
-```
-
-Track it: `buildJob.list` / `buildJob.one` / `buildJob.logs` (org-scoped).
-
-> A pool goes **native** the moment an arcd runner self-registers for it
-> (`arcd_runner.lastSeen` within 90s); until then platform transparently falls
-> back to `workflow_dispatch` so a build is never stranded. To run a release
-> fully GitHub-free, ensure a `lux-build-linux-{amd64,arm64}` runner is live
-> (`tRPC arcd` / the `arcd_runner` table). Set platform env
-> `WORKFLOW_DISPATCH_FALLBACK=false` to forbid the legacy hop.
-
-### What the runner runs (identical on a fleet host, for manual/DR builds)
-
-The native path runs exactly the repo's `Dockerfile`. To reproduce on a fleet
-host directly (e.g. `spark`), with no platform and no GitHub:
-
-```bash
-# on spark (linux/arm64; amd64 via buildx)
-git clone --branch v1.30.41 git@github.com:luxfi/node.git && cd node
-docker buildx build --platform linux/amd64 \
-  --build-arg CGO_ENABLED=0 \
-  -t ghcr.io/luxfi/node:v1.30.41 -f Dockerfile --push .
-```
-
-## Publish the plugin set — step 2
-
-After the image exists, publish artifact 2 from it (one command, idempotent,
-no second compile). Run on any fleet host or a DOKS Job that has `crane`/docker
-+ `mc`; typically the same arcd runner that just built the image:
-
-```bash
-scripts/publish_plugin_set.sh \
-  ghcr.io/luxfi/node:v1.30.41 \
-  lux-plugins-<env>/<pluginset> \
-  lux                          # mc alias for the target MinIO/S3
-# e.g. lux-plugins-testnet/v1.3.5
-```
-
-It extracts the 12 plugin binaries from the image, writes `SHA256SUMS`, uploads
-all to `s3://lux-plugins-<env>/<pluginset>/`, and verifies remote==local sha.
-
-S3 is the in-cluster MinIO (`s3.lux-system.svc.cluster.local:9000`, external
-`s3.lux.network`). Configure the `mc` alias once with the `hanzo-s3-secret`
-credentials:
-
-```bash
-mc alias set lux <endpoint> hanzo "$(kubectl -n lux-system get secret \
-  hanzo-s3-secret -o jsonpath='{.data.password}' | base64 -d)" --api s3v4
-```
-
-A pluginset prefix is **immutable** — bump `<pluginset>` for a new release,
-never overwrite a prefix a live network points at.
-
-## Deploy — step 3 (operator, not this repo)
-
-luxd rollout is owned by the **lux operator** (`~/work/lux/operator`,
-`LuxNetwork` CR). Update the CR's `image.tag` (artifact 1) and, when the
-network fetches plugins from S3, the `pluginSource.bucket` + per-plugin
-`sha256` (artifact 2, from the `SHA256SUMS` you just published). The operator's
-`plugin-fetch` init container verifies each sha256 fail-closed. This is
-deliberately decoupled from build: `hanzo.yml` has **no `deploy:` block**.
-
-## Reproducibility
-
-- The build is **functionally reproducible**: same source tags + same toolchain
-  (Go 1.26.4) + `CGO_ENABLED=0` ⇒ functionally identical plugins, provable by a
-  fleet rebuild (verified: `spark` rebuilt evm@v1.99.37 + dexvm@v1.5.15 from the
-  same tags). It is **not bit-identical by construction**: the Dockerfile plugin
-  stages omit `-trimpath` and use `-mod=mod` with a first-party `go.sum` strip
-  (re-resolves luxfi/* deps), so embedded paths + re-tagged module content can
-  shift the bytes (Go `BuildID` differs; binary ~16 KB larger). The published
-  image is the canonical artifact; verify against ITS baked sha (what
-  `publish_plugin_set.sh` records), not a separate fleet build.
-- To make releases bit-reproducible (future hardening, patch-only): add
-  `-trimpath` to every plugin `go build` and pin `go.sum` (drop the strip +
-  `-mod=mod`). Tracked as a follow-up; not required for correctness.
-
-## Retire the GitHub Actions build workflows
-
-These `.github/workflows/*` build/release/CI workflows are superseded by this
-flow and must be removed/disabled (platform owns build; the native long-poll
-owns dispatch). Delete them once a `lux-build-*` arcd runner is live:
-
-| Workflow | Replaced by |
-|----------|-------------|
-| `docker.yml` (built `ghcr.io/luxfi/node` on the `lux-build` ARC pool) | `hanzo.yml` (artifact 1) — native long-poll, NO GitHub Actions |
-| `release.yml` | the tag-push trigger above + `scripts/publish_plugin_set.sh` |
-| `build.yml`, `ci.yml` | platform CI test step (runner runs `go test` pre-build) |
-| `build-linux-binaries.yml` | `Dockerfile` builder stage (luxd binary) |
-| `build-ubuntu-amd64-release.yml`, `build-ubuntu-arm64-release.yml` | `Dockerfile` + buildx multi-arch |
-| `build-macos-release.yml`, `build-win-release.yml`, `build-and-test-mac-windows.yml` | arcd `lux-build-{macos,windows}-*` pools (matrix in `hanzo.yml` when desired) |
-| `build-deb-pkg.sh`, `build-tgz-pkg.sh` (under `.github/workflows/`) | packaging step on the arcd runner (post-build), not GitHub Actions |
-| `codeql-analysis.yml`, `fuzz.yml`, `fuzz_merkledb.yml`, `test-database-replay.yml` | scheduled jobs on arcd / DOKS (not a build dependency) |
-| `buf-lint.yml`, `buf-push.yml`, `labels.yml`, `stale.yml` | repo-hygiene; migrate to arcd cron or drop |
-
-The same retirement applies to the equivalent build/release workflows in the
-plugin-source repos (`luxfi/evm`, `luxfi/chains`, `luxfi/dex`): their artifacts
-are built from source by THIS repo's `Dockerfile` at the pinned refs, so those
-repos need no independent image/release CI — only their tags. Migrate each by
-adding a `hanzo.yml` (if it ships its own image) or deleting its build CI (if it
-is consumed only as a Go module / plugin source here).

chains/bootstrap_trust.go

@@ -1,531 +0,0 @@
-// Copyright (C) 2019-2026, Lux Industries, Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-// bootstrap_trust.go — the SEPARATE trust object for INITIAL SYNC, decomplected from
-// consensus finality.
-//
-// The mass-recovery DEADLOCK this fixes: the prior FrontierTip required a ⅔-by-stake quorum
-// of the CURRENT total validator set to be CONNECTED before it would name a sync frontier.
-// When the recovery TARGETS are themselves validators (a node that crashed IS one of the 5),
-// taking them down drops connected stake below ⅔ of the whole set — so on a network of 5
-// equal-weight validators, losing 2 leaves 3 (60% < ⅔) and NO node can ever name a frontier
-// to recover from. Bootstrap trust was braided into consensus finality, and finality's ⅔ rule
-// is mathematically unsatisfiable during a mass outage.
-//
-// The fix is a type split, NOT a renamed threshold. ConsensusQuorum decides FINALITY
-// (> ⅔ of CURRENT stake — UNCHANGED). BootstrapTrust decides whether a fetched frontier is
-// SAFE TO BEGIN SYNC FROM: a quorum of AUTHENTICATED CONFIGURED beacons that RESPOND, gated by
-// a response FLOOR (MinResponses) and an agreement threshold over the RESPONDERS (not over the
-// whole set). 3 of 5 reachable beacons all agreeing is a valid sync anchor even though 3 of 5
-// stake is not a finalizing supermajority. The two decisions have different threat models and
-// are different objects.
-package chains
-
-import (
-	"bytes"
-	"context"
-	"errors"
-	"fmt"
-	"math"
-	"math/bits"
-	"sort"
-	"time"
-
-	consensusconfig "github.com/luxfi/consensus/config"
-	"github.com/luxfi/ids"
-)
-
-// BootstrapTrust is not a consensus-finality oracle.
-// It selects a weak-subjective sync frontier from authenticated configured beacons.
-// Live block acceptance remains governed exclusively by ConsensusQuorum.
-type BootstrapTrust interface {
-	// AcceptsFrontier returns the block an empty/behind node may BEGIN SYNCING FROM, selected
-	// from the authenticated configured beacons' frontier replies — or an error
-	// (ErrInsufficientBootstrapResponses / ErrNoBootstrapQuorum) when no trusted frontier can be
-	// named this round. The returned Frontier is a sync ANCHOR, never a consensus certificate
-	// (see the type comment): the node must still re-execute every block it descends to before
-	// re-entering live consensus, where ConsensusQuorum alone governs acceptance.
-	AcceptsFrontier(ctx context.Context, replies []BeaconReply) (*Frontier, error)
-}
-
-// ConsensusQuorum decides FINALITY: whether a weight is a finalizing supermajority (> ⅔) of the
-// CURRENT validator set. This is the live-consensus rule; bootstrap does NOT change it. It is a
-// SEPARATE named type from BootstrapTrust precisely so the distinction is explicit and testable:
-// a frontier that AcceptsFrontier admits is "safe to sync from", and in general it does NOT
-// satisfy HasFinality (3 of 5 responders is a valid sync anchor; 3 of 5 stake is not finality).
-type ConsensusQuorum interface {
-	HasFinality(weight, total StakeWeight) bool
-}
-
-// StakeWeight is validator stake in the units the validator manager reports (Weight/Light).
-type StakeWeight = uint64
-
-// twoThirdsFinality is the production ConsensusQuorum: > ⅔ of the CURRENT total stake, exactly
-// the rule the live cert-gate uses (consensusconfig.TwoThirdsStakeFloor). Defined here only to
-// give the live rule a name to CONTRAST bootstrap trust against — it is not wired into the live
-// path (that already enforces ⅔ inside consensus), and bootstrap never calls it to ACCEPT.
-type twoThirdsFinality struct{}
-
-func (twoThirdsFinality) HasFinality(weight, total StakeWeight) bool {
-	return weight > consensusconfig.TwoThirdsStakeFloor(total)
-}
-
-// DefaultConsensusQuorum returns the live ⅔-of-current-stake finality rule — the thing bootstrap
-// trust is explicitly NOT. Used by the test suite to prove a bootstrap-accepted frontier does
-// not constitute finality.
-func DefaultConsensusQuorum() ConsensusQuorum { return twoThirdsFinality{} }
-
-var (
-	// ErrInsufficientBootstrapResponses: fewer than MinResponses configured beacons answered.
-	// Not a partition-capture-safe quorum — the node must keep waiting for more beacons (or use
-	// an operator checkpoint), never sync from the captured few. INVARIANT 2's response floor.
-	ErrInsufficientBootstrapResponses = errors.New("bootstrap: insufficient configured-beacon responses")
-	// ErrNoBootstrapQuorum: enough beacons responded, but no block clears the agreement threshold
-	// over the responders (a genuine partition, or a transient bleeding-edge split the loop retries).
-	ErrNoBootstrapQuorum = errors.New("bootstrap: no responder-agreed frontier")
-)
-
-// BeaconReply is one authenticated configured beacon's report of its accepted frontier tip
-// during initial sync. NodeID is authenticated at the transport handshake (a peer cannot forge
-// another's identity); Weight is the beacon's CONFIGURED stake from the trust anchor — NOT a
-// self-reported value. A reply whose NodeID is not in the policy's TrustedBeacons is ignored.
-type BeaconReply struct {
-	NodeID ids.NodeID
-	Tip    ids.ID
-	Weight StakeWeight
-}
-
-// Frontier is the weak-subjective sync anchor BootstrapTrust selects: the block a node descends
-// to and re-executes. It is NOT a consensus certificate (see BootstrapTrust). Height is the
-// tallied height when named via the ancestor-tolerant path, and 0 (unknown) when named via the
-// exact fast path before any ancestry fetch — the sync loop uses ID; Height is diagnostic.
-type Frontier struct {
-	ID             ids.ID
-	Height         uint64
-	Weight         StakeWeight // responder stake whose accepted chain contains this block
-	Responders     int         // distinct configured beacons that backed it
-	FromCheckpoint bool        // selected from an operator checkpoint (too few beacons responded)
-}
-
-// BlockRef is a parsed block's CONTENT-ADDRESSED identity (id, height, parent) — the only thing
-// the ancestor-tolerant tally needs. Decouples the policy from the VM/block types.
-type BlockRef struct {
-	ID     ids.ID
-	Height uint64
-	Parent ids.ID
-}
-
-// AncestrySource resolves a tip's CONTENT-ADDRESSED ancestry for the ancestor-tolerant tally —
-// the SAME parent-linked descent the sync loop trusts. Injected so the trust DECISION (which
-// beacons count, the response floor, the agreement threshold) stays separate from the transport.
-type AncestrySource interface {
-	// Ancestry returns up to max blocks ending at tip, parsed to (id, height, parent). An empty
-	// result (no error) means the tip's ancestry was not served — that anchor contributes nothing.
-	Ancestry(ctx context.Context, tip ids.ID, max int) ([]BlockRef, error)
-}
-
-// Checkpoint is an operator-pinned (id, height) the recovering node may anchor to when too few
-// beacons respond to form a quorum — the EXPLICIT override for INVARIANT 2's "1 of N reachable"
-// case. Absent (nil) ⇒ the default policy REJECTS rather than trusting a captured minority.
-type Checkpoint struct {
-	ID     ids.ID
-	Height uint64
-}
-
-// Ratio is an exact rational threshold (e.g. 2/3, 3/4). A value clears it iff
-// value > floorOf(whole) — strictly greater, matching the consensus ⅔ floor's semantics.
-type Ratio struct{ Num, Den uint64 }
-
-// floorOf returns ⌊whole · Num / Den⌋ without floating point, overflow-safe for the sub-unity
-// thresholds used here. Ratio{2,3}.floorOf(w) == consensusconfig.TwoThirdsStakeFloor(w) exactly,
-// so the responder-⅔ agreement reuses the same strict-greater floor the live rule uses.
-func (r Ratio) floorOf(whole uint64) uint64 {
-	if r.Den == 0 {
-		return whole // degenerate guard; constructors always set a real ratio
-	}
-	hi, lo := bits.Mul64(whole, r.Num)
-	if hi >= r.Den {
-		return math.MaxUint64 // Num ≥ Den: not a sub-unity threshold — nothing can exceed it
-	}
-	q, _ := bits.Div64(hi, lo, r.Den)
-	return q
-}
-
-// BootstrapPolicy is the default BootstrapTrust: a CONFIGURED-BEACON quorum with a response
-// FLOOR and an agreement threshold over the RESPONDERS — a SEPARATE object from ConsensusQuorum
-// with a SEPARATE threat model. It does NOT pass "reachable stake" into the ⅔-of-current-stake
-// finality rule (that conflation IS the mass-recovery deadlock). It reuses the ancestor-tolerant
-// common-ancestor tally only for HOW to find the agreed frontier; the ACCEPTANCE gate is the
-// response floor + responder agreement here.
-//
-// The three invariants:
-//   - INVARIANT 1 (non-circular beacon eligibility): only NodeIDs in TrustedBeacons count, and
-//     TrustedBeacons comes from the configured/checkpointed/genesis anchor — NEVER peer
-//     self-report. A recovering node never lets arbitrary peers define who is a beacon.
-//   - INVARIANT 2 (a floor prevents partition-capture): MinResponses authenticated beacons must
-//     respond before any frontier is named; an attacker who partitions the node down to a few
-//     beacons cannot capture the frontier. Below the floor, REJECT (or use Checkpoint).
-//   - INVARIANT 3 (acceptance ≠ finality): the named Frontier is "safe to begin sync from", not
-//     finalized. The node independently re-executes the descent before re-entering consensus.
-type BootstrapPolicy struct {
-	// TrustedBeacons is the trust anchor: configured-beacon NodeID → configured stake (INVARIANT
-	// 1). Resolved from --bootstrap-nodes / a finalized P-chain checkpoint / the genesis set —
-	// never from peer self-report.
-	TrustedBeacons map[ids.NodeID]StakeWeight
-	// AgreementThreshold is the fraction of the RESPONDER weight a named block must exceed
-	// (default 2/3). Over RESPONDERS, not the whole set — that is what permits mass recovery.
-	AgreementThreshold Ratio
-	// MinResponses is the FLOOR on distinct configured-beacon responders (INVARIANT 2). Default:
-	// a MAJORITY of the configured set (the largest floor that still lets a node recover when a
-	// minority of validators is down). Capped at the set size.
-	MinResponses int
-	// MinResponseWeight is an OPTIONAL floor on the total responder weight (0 ⇒ disabled).
-	MinResponseWeight StakeWeight
-	// MinResponders is the minimum DISTINCT beacons that must back a NAMED block (default 2), so a
-	// single beacon cannot alone name the frontier. Capped at the responder count.
-	MinResponders int
-	// MinFrontierHeight is the node's current last-accepted height. The ANCESTOR-TOLERANT path
-	// names only a block STRICTLY ABOVE it — a frontier genuinely AHEAD. A common ancestor BELOW it
-	// is history the node has (a partition above, not a frontier ahead). A block AT exactly this
-	// height is ALSO not named here (the M1 eclipse-stale fix): an eclipse can throttle the honest
-	// ahead-tips below the ⅔ naming threshold while the node's OWN height accrues ⅔ as their shared
-	// ANCESTOR — naming it would go Ready stale. Excluding own height routes that case to CaughtUp,
-	// which distinguishes a legit all-at-N fleet from an eclipse with ahead-tips the node lacks. So
-	// nothing at or below own height is named (→ ErrNoBootstrapQuorum, fail safe), never a
-	// false-complete at the stale height. The exact fast path is exempt: a tip a responder
-	// supermajority ACTIVELY reports is a real frontier even at own height (a genuinely fresh
-	// network, or a fleet unanimously AT the tip).
-	MinFrontierHeight uint64
-	// Checkpoint is the OPTIONAL operator override for the below-floor case (INVARIANT 2). nil ⇒
-	// reject below the floor.
-	Checkpoint *Checkpoint
-	// NamingWindow bounds the ancestry fetched per anchor; MaxAnchors bounds how many distinct
-	// reported tips are resolved. Both default to the package constants when zero.
-	NamingWindow int
-	MaxAnchors   int
-	// NamingTimeout TOTAL-bounds the ancestor-tolerant resolution (all anchor fetches combined) so
-	// a partition that ANSWERS the frontier query but WITHHOLDS ancestry cannot make the decision
-	// hang — it returns what it found (or nothing → ErrNoBootstrapQuorum) and the caller's bounded
-	// retry tries a fresh sample next round. Zero ⇒ the package default.
-	NamingTimeout time.Duration
-	// Source resolves content-addressed ancestry for the ancestor-tolerant tally. When nil, the
-	// policy decides on the exact fast path alone (no split resolution).
-	Source AncestrySource
-}
-
-// compile-time: the default policy IS a BootstrapTrust.
-var _ BootstrapTrust = (*BootstrapPolicy)(nil)
-
-func (p *BootstrapPolicy) effectiveMinResponses() int {
-	n := len(p.TrustedBeacons)
-	if p.MinResponses > 0 {
-		if p.MinResponses > n {
-			return n
-		}
-		return p.MinResponses
-	}
-	return n/2 + 1 // default: a MAJORITY of the configured beacon set
-}
-
-func (p *BootstrapPolicy) effectiveAgreement() Ratio {
-	if p.AgreementThreshold.Den == 0 {
-		return Ratio{Num: 2, Den: 3} // default: ⅔ of the RESPONDERS
-	}
-	return p.AgreementThreshold
-}
-
-func (p *BootstrapPolicy) effectiveMinResponders(responders int) int {
-	r := p.MinResponders
-	if r <= 0 {
-		r = bootstrapMinAgreeingBeacons // default 2
-	}
-	if r > responders {
-		r = responders
-	}
-	if r < 1 {
-		r = 1
-	}
-	return r
-}
-
-func (p *BootstrapPolicy) namingWindow() int {
-	if p.NamingWindow > 0 {
-		return p.NamingWindow
-	}
-	return bootstrapNamingWindow
-}
-
-func (p *BootstrapPolicy) maxAnchors() int {
-	if p.MaxAnchors > 0 {
-		return p.MaxAnchors
-	}
-	return maxNamingAnchors
-}
-
-func (p *BootstrapPolicy) namingTimeout() time.Duration {
-	if p.NamingTimeout > 0 {
-		return p.NamingTimeout
-	}
-	return bootstrapNamingTimeout
-}
-
-// tallyResponders applies INVARIANT 1 (only CONFIGURED beacons count, deduplicated by NodeID — a
-// reply from a peer not in TrustedBeacons, a repeat, or an empty tip is dropped) and returns the
-// distinct responder count + total responder stake plus the per-tip stake / voter maps the naming
-// tally walks. The authenticated NodeID (transport handshake) is what makes "configured"
-// unforgeable. Shared by AcceptsFrontier (which names a frontier AHEAD) and CaughtUp (which
-// concludes NONE is ahead) so both judge the IDENTICAL responder set under the SAME eligibility
-// rule — the eligibility decision lives in exactly one place.
-func (p *BootstrapPolicy) tallyResponders(replies []BeaconReply) (responders int, responderWeight StakeWeight, stakeOnTip map[ids.ID]StakeWeight, votersOf map[ids.ID]map[ids.NodeID]struct{}) {
-	seen := make(map[ids.NodeID]struct{}, len(replies))
-	stakeOnTip = make(map[ids.ID]StakeWeight)
-	votersOf = make(map[ids.ID]map[ids.NodeID]struct{})
-	for _, r := range replies {
-		w, ok := p.TrustedBeacons[r.NodeID]
-		if !ok || r.Tip == ids.Empty {
-			continue
-		}
-		if _, dup := seen[r.NodeID]; dup {
-			continue
-		}
-		seen[r.NodeID] = struct{}{}
-		responders++
-		responderWeight += w
-		stakeOnTip[r.Tip] += w
-		if votersOf[r.Tip] == nil {
-			votersOf[r.Tip] = make(map[ids.NodeID]struct{})
-		}
-		votersOf[r.Tip][r.NodeID] = struct{}{}
-	}
-	return responders, responderWeight, stakeOnTip, votersOf
-}
-
-// floorMet reports whether the responder set clears INVARIANT 2's partition-capture FLOOR: at
-// least MinResponses distinct configured beacons AND (when MinResponseWeight is configured) at
-// least that much total responder stake. AcceptsFrontier gates NAMING a frontier on it and
-// CaughtUp gates concluding NONE-AHEAD on the SAME floor — so an eclipse that suppresses the
-// honest ahead-nodes to fake EITHER outcome must drop the responder set below it and fail safe.
-func (p *BootstrapPolicy) floorMet(responders int, responderWeight StakeWeight) bool {
-	if responders < p.effectiveMinResponses() {
-		return false
-	}
-	if p.MinResponseWeight > 0 && responderWeight < p.MinResponseWeight {
-		return false
-	}
-	return true
-}
-
-// AcceptsFrontier implements BootstrapTrust. It (1) keeps ONLY configured-beacon replies
-// (INVARIANT 1, tallyResponders), (2) enforces the MinResponses / MinResponseWeight floor or falls
-// back to the operator checkpoint (INVARIANT 2, floorMet), then (3) names the highest block a
-// responder supermajority shares via the ancestor-tolerant tally. It never consults the
-// ⅔-of-current-stake finality rule (INVARIANT 3): the decision is the response floor + responder
-// agreement, a separate threat model.
-func (p *BootstrapPolicy) AcceptsFrontier(ctx context.Context, replies []BeaconReply) (*Frontier, error) {
-	responders, responderWeight, stakeOnTip, votersOf := p.tallyResponders(replies)
-
-	// INVARIANT 2: the response FLOOR prevents partition-capture. Below MinResponses (or below
-	// MinResponseWeight) the node has not heard from enough authenticated beacons to trust ANY
-	// frontier — an attacker may have partitioned it down to a captured few. REJECT, unless the
-	// operator explicitly pinned a checkpoint to anchor from.
-	if !p.floorMet(responders, responderWeight) {
-		if p.Checkpoint != nil {
-			return &Frontier{
-				ID:             p.Checkpoint.ID,
-				Height:         p.Checkpoint.Height,
-				Responders:     responders,
-				FromCheckpoint: true,
-			}, nil
-		}
-		return nil, fmt.Errorf("%w: %d configured beacons responded (weight %d), need %d",
-			ErrInsufficientBootstrapResponses, responders, responderWeight, p.effectiveMinResponses())
-	}
-
-	// The agreement threshold is over the RESPONDERS, not the whole configured set — this is what
-	// lets a node recover when validators are down (3 of 5 reachable, all 3 agreeing, is a valid
-	// sync anchor). The ⅔-of-current-stake finality rule is never used here (INVARIANT 3).
-	floor := p.effectiveAgreement().floorOf(responderWeight)
-	required := p.effectiveMinResponders(responders)
-
-	id, height, weight, ok := p.nameFrontier(ctx, stakeOnTip, votersOf, floor, required)
-	if !ok {
-		return nil, ErrNoBootstrapQuorum
-	}
-	return &Frontier{ID: id, Height: height, Weight: weight, Responders: responders}, nil
-}
-
-// CaughtUp reports whether the responder set PROVES the node is already AT OR ABOVE the network
-// frontier — the dual of AcceptsFrontier ("nobody is ahead" vs "here is the block ahead to sync
-// to"). It is the go-live path for a TIP-HOLDER on a mixed-height co-restart: when producers
-// restart together the responder set SPLITS (the tip-holders are exactly half — below the ⅔
-// naming threshold), so AcceptsFrontier names NOTHING (ErrNoBootstrapQuorum), yet the node is
-// plainly not behind. Without this determination such a producer fails safe DOWN at its own tip —
-// the exact OPPOSITE of the stale-go-live bug, and just as wrong. THREE conditions, ALL required:
-//
-//   - (a) the SAME response FLOOR AcceptsFrontier uses is met (floorMet: MinResponses distinct
-//     beacons AND MinResponseWeight stake-majority). An eclipse that hides the higher (real) tips
-//     to fake caught-up must SUPPRESS the ahead-nodes' replies, dropping the responder set below
-//     the floor → NOT caught up, fail safe. No partition-capture: faking caught-up costs the same
-//     stake-majority of honest beacons that faking a NAMED frontier does.
-//   - (b) every responder's reported ACCEPTED tip is at height ≤ lastAccepted. A genuinely STALE
-//     node has at least one honest responder AHEAD (height > lastAccepted) → NOT caught up: it
-//     still syncs, so the stale-go-live bug stays fixed. (GetAcceptedFrontier reports a beacon's
-//     last-ACCEPTED block, so an un-finalized N+1 a producer is merely processing is never reported
-//     — the ±1 pending-tip skew cannot fake "ahead", and a producer one ACCEPTED block ahead
-//     correctly defeats caught-up so the node syncs that block.)
-//   - (c) the node has ACCEPTED every reported tip — heightOf returns ok ONLY for a block on the
-//     node's FINALIZED chain, so a tip the node lacks OR merely holds-in-store-but-has-not-accepted
-//     (someone genuinely ahead, a gossiped-ahead block, or a same-height sibling/fork it never
-//     finalized) makes the conclusion fail. The node declares caught-up only to blocks it ACCEPTED.
-//
-// heightOf resolves a tip's height from the node's ACCEPTED chain (ok=false when the tip is not
-// accepted — including a block merely PRESENT in the store but unaccepted, the luxd-2 freeze case),
-// injected so the trust DECISION stays free of any VM/block dependency — the same separation as
-// AncestrySource. It is NEVER a network fetch: an unaccepted/absent tip simply makes the node
-// not-caught-up (the safe direction — it syncs). Because (c) requires the node to have ACCEPTED
-// every reported tip, the heights (b) compares are the blocks' canonical (content-addressed)
-// heights read from the finalized chain — store presence can never fake "caught up".
-func (p *BootstrapPolicy) CaughtUp(replies []BeaconReply, lastAccepted uint64, heightOf func(ids.ID) (uint64, bool)) bool {
-	responders, responderWeight, stakeOnTip, _ := p.tallyResponders(replies)
-	if !p.floorMet(responders, responderWeight) {
-		return false // (a) below the floor — an eclipse/partition can never fake caught-up
-	}
-	sawTip := false
-	for tip := range stakeOnTip {
-		sawTip = true
-		h, held := heightOf(tip)
-		if !held || h > lastAccepted {
-			return false // (c) a tip we do not hold, or (b) a responder ahead → NOT caught up
-		}
-	}
-	return sawTip // ≥1 responder tip evaluated (floor already implies this; guards an empty set)
-}
-
-// nameFrontier finds the block a responder supermajority shares — by CONTENT, reusing the
-// parent-link descent the sync loop trusts (HOW to find the agreed frontier; the ACCEPTANCE gate
-// already passed in AcceptsFrontier). A beacon reporting tip T vouches for every ANCESTOR of T,
-// so the named frontier is the HIGHEST block whose backing stake exceeds floor (the responder
-// agreement threshold) with ≥ required distinct voters.
-//
-//   - EXACT FAST PATH: if a single reported tip clears the floor outright, name it with NO
-//     ancestry fetch (the whole responding quorum already agrees on the same tip). Exempt from
-//     MinFrontierHeight: an actively-reported tip is a real frontier even when low.
-//   - ANCESTOR-TOLERANT PATH: otherwise, fetch the distinct tips' ancestries into ONE union index
-//     and globally credit each tip's stake to every block on its content-addressed chain. The
-//     highest block clearing the floor AND at a height STRICTLY ABOVE MinFrontierHeight (a frontier
-//     genuinely ahead — never the node's own height, which an eclipse could over-credit as a shared
-//     ancestor; that routes to CaughtUp) is named. A sibling split converges to the common committed
-//     ancestor; a partition that shares nothing ⅔-backed names nothing (→ fail safe).
-//
-// C1 (a forged chain finalizes ZERO) is preserved: a block is credited a beacon's stake only when
-// that beacon's tip lies on the block's CONTENT-ADDRESSED descendant chain (parent ids are bound
-// to block content), so a peer cannot fake linkage to over-credit; a block is named only with
-// backing > ⅔ of the responder weight; a minority (< ⅓) forged tip can only RATIFY real ancestors
-// it builds on, never name itself or raise the named height above the honest common block.
-func (p *BootstrapPolicy) nameFrontier(ctx context.Context, stakeOnTip map[ids.ID]StakeWeight, votersOf map[ids.ID]map[ids.NodeID]struct{}, floor StakeWeight, required int) (ids.ID, uint64, StakeWeight, bool) {
-	// EXACT fast path: a single reported tip already clears the floor — name it, no fetch.
-	for tip, st := range stakeOnTip {
-		if st > floor && len(votersOf[tip]) >= required {
-			return tip, 0, st, true
-		}
-	}
-	if p.Source == nil {
-		return ids.Empty, 0, 0, false
-	}
-
-	// TOTAL-bound all anchor fetches so a partition that answers the frontier query but withholds
-	// ancestry cannot hang the decision — the caller's bounded retry handles it next round.
-	ctx, cancel := context.WithTimeout(ctx, p.namingTimeout())
-	defer cancel()
-
-	// Build ONE union index from the distinct reported tips' ancestries (most stake first; skip a
-	// tip already present from an earlier fetch — a nested tip covers its ancestors). Bounded by
-	// MaxAnchors × NamingWindow blocks, so a Byzantine swarm reporting many forged tips cannot
-	// induce unbounded work.
-	index := make(map[ids.ID]BlockRef)
-	fetches := 0
-	for _, tip := range sortedByStakeDesc(stakeOnTip) {
-		if _, have := index[tip]; have {
-			continue
-		}
-		if fetches >= p.maxAnchors() {
-			break
-		}
-		fetches++
-		refs, err := p.Source.Ancestry(ctx, tip, p.namingWindow())
-		if err != nil {
-			continue
-		}
-		for _, ref := range refs {
-			if _, ok := index[ref.ID]; !ok {
-				index[ref.ID] = ref
-			}
-		}
-	}
-	if len(index) == 0 {
-		return ids.Empty, 0, 0, false
-	}
-
-	// Global credit: each reported tip vouches for every block on its content-addressed ancestry.
-	// The running backing at block B = the responder stake whose accepted chain contains B.
-	backing := make(map[ids.ID]StakeWeight)
-	voters := make(map[ids.ID]map[ids.NodeID]struct{})
-	for tip, st := range stakeOnTip {
-		cur := tip
-		for {
-			ref, ok := index[cur]
-			if !ok {
-				break // the served ancestry does not extend further down (or this tip was unserved)
-			}
-			backing[cur] += st
-			if voters[cur] == nil {
-				voters[cur] = make(map[ids.NodeID]struct{})
-			}
-			for v := range votersOf[tip] {
-				voters[cur][v] = struct{}{}
-			}
-			if ref.Parent == ids.Empty {
-				break
-			}
-			cur = ref.Parent
-		}
-	}
-
-	// Name the HIGHEST block clearing the floor with ≥ required distinct voters, at a height
-	// STRICTLY ABOVE MinFrontierHeight — a genuine frontier AHEAD. A block AT the node's own
-	// last-accepted height is NOT named here (it is history the node already holds, reachable as a
-	// ⅔-backed ANCESTOR of higher tips an eclipse can suppress below the naming threshold — the M1
-	// stale-go-live path): that case routes to CaughtUp, which alone can distinguish a legit
-	// all-at-N fleet (→ Ready at N) from an eclipse with ahead-tips the node lacks (→ sync). A block
-	// BELOW own height is a partition diverged beneath the node. Both fail safe, never false-complete.
-	var bestID ids.ID
-	var bestHeight, bestStake uint64
-	found := false
-	for id, st := range backing {
-		ref := index[id]
-		if st <= floor || len(voters[id]) < required || ref.Height <= p.MinFrontierHeight {
-			continue
-		}
-		if !found || ref.Height > bestHeight || (ref.Height == bestHeight && st > bestStake) {
-			bestID, bestHeight, bestStake, found = id, ref.Height, st, true
-		}
-	}
-	return bestID, bestHeight, bestStake, found
-}
-
-// sortedByStakeDesc returns the reported tips most-stake-first (stable id tiebreak) — the order
-// the ancestor-tolerant tally fetches anchors in, so the well-supported honest tips are covered
-// first and a forged low-stake outlier swarm falls outside the anchor cap.
-func sortedByStakeDesc(stakeOnTip map[ids.ID]StakeWeight) []ids.ID {
-	tips := make([]ids.ID, 0, len(stakeOnTip))
-	for t := range stakeOnTip {
-		tips = append(tips, t)
-	}
-	sort.Slice(tips, func(i, j int) bool {
-		if stakeOnTip[tips[i]] != stakeOnTip[tips[j]] {
-			return stakeOnTip[tips[i]] > stakeOnTip[tips[j]]
-		}
-		return bytes.Compare(tips[i][:], tips[j][:]) < 0
-	})
-	return tips
-}

chains/bootstrap_trust_test.go

@@ -1,830 +0,0 @@
-// Copyright (C) 2019-2026, Lux Industries, Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-// bootstrap_trust_test.go — the A–G proof matrix for the BootstrapTrust policy: the SEPARATE
-// trust object (distinct from consensus finality) that lets a node recover when validators are
-// down (mass recovery) while refusing partition-capture and never weakening finality.
-//
-// Most cases test the POLICY decision (AcceptsFrontier) directly — deterministic, no network
-// timing — since that IS the acceptance gate the owner specified. The mass-recovery success (A)
-// and the global-tally height-floor guard also run the FULL fetch+execute loop over the real
-// transport to prove the node converges (or fails safe) end to end. Each is load-bearing: revert
-// the response-floor policy to the prior ⅔-of-current-total-stake gate and A deadlocks; drop the
-// configured-beacon filter and D/E capture; drop the MinFrontierHeight floor and the shared-
-// genesis fork false-completes.
-package chains
-
-import (
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	consensusconfig "github.com/luxfi/consensus/config"
-	chainbootstrap "github.com/luxfi/consensus/engine/chain/bootstrap"
-	"github.com/luxfi/ids"
-)
-
-// ----- policy test helpers --------------------------------------------------
-
-// stubAncestry is an in-memory AncestrySource: it walks a parent-linked BlockRef map down from a
-// tip, exactly as the real wire transport would serve content-addressed ancestry. Modeling the
-// transport this way keeps the policy unit tests deterministic while exercising the real ancestor-
-// tolerant tally. `withhold` models a beacon that names a tip but does NOT serve its ancestry.
-type stubAncestry struct {
-	byID     map[ids.ID]BlockRef
-	withhold map[ids.ID]bool
-}
-
-func (s *stubAncestry) Ancestry(_ context.Context, tip ids.ID, max int) ([]BlockRef, error) {
-	if s.withhold[tip] {
-		return nil, nil
-	}
-	var out []BlockRef
-	cur := tip
-	for i := 0; i < max; i++ {
-		ref, ok := s.byID[cur]
-		if !ok {
-			break
-		}
-		out = append(out, ref)
-		if ref.Parent == ids.Empty {
-			break
-		}
-		cur = ref.Parent
-	}
-	return out, nil
-}
-
-// refChain builds genesis..n as content-addressed BlockRefs (parent-linked), returning the slice
-// and an id→ref index for the stub AncestrySource.
-func refChain(n int) ([]BlockRef, map[ids.ID]BlockRef) {
-	refs := make([]BlockRef, 0, n+1)
-	byID := map[ids.ID]BlockRef{}
-	var parent ids.ID
-	for h := 0; h <= n; h++ {
-		r := BlockRef{ID: ids.GenerateTestID(), Height: uint64(h), Parent: parent}
-		refs = append(refs, r)
-		byID[r.ID] = r
-		parent = r.ID
-	}
-	return refs, byID
-}
-
-// childRef makes a block extending `parent` at height parentHeight+1 — used to forge a "higher"
-// sibling tip built on a real block.
-func childRef(parent BlockRef) BlockRef {
-	return BlockRef{ID: ids.GenerateTestID(), Height: parent.Height + 1, Parent: parent.ID}
-}
-
-func nodeIDs(n int) []ids.NodeID {
-	out := make([]ids.NodeID, n)
-	for i := range out {
-		out[i] = ids.GenerateTestNodeID()
-	}
-	return out
-}
-
-// equalBeacons builds a TrustedBeacons map of equal-weight validators.
-func equalBeacons(beacons []ids.NodeID, w uint64) map[ids.NodeID]StakeWeight {
-	m := make(map[ids.NodeID]StakeWeight, len(beacons))
-	for _, id := range beacons {
-		m[id] = w
-	}
-	return m
-}
-
-func reply(id ids.NodeID, tip ids.ID, w uint64) BeaconReply {
-	return BeaconReply{NodeID: id, Tip: tip, Weight: w}
-}
-
-// equalStake is the owner's mainnet shape: 5 validators each 0.5e18, total 2.5e18.
-const equalStake uint64 = 500_000_000_000_000_000
-
-// ----- A: MASS RECOVERY SUCCESS ---------------------------------------------
-
-// TestBootstrapTrust_A_MassRecoverySucceeds is THE deadlock fix. 5 EQUAL-weight validators; the 2
-// stranded recovery targets are down, so only 3 are reachable; the 3 reachable agree on the
-// frontier. With MinResponses=3 the policy ACCEPTS — even though 3 of 5 stake (1.5e18) is BELOW
-// the ⅔-of-current-total floor (1.667e18) that the prior code required to be CONNECTED. That old
-// floor was mathematically unsatisfiable here (the down nodes ARE validators), which is exactly
-// why no node could recover. This test pins both: the policy accepts, AND the old gate would have
-// rejected (the deadlock), AND the full loop converges over the real transport.
-func TestBootstrapTrust_A_MassRecoverySucceeds(t *testing.T) {
-	// The deadlock the fix escapes: 3-of-5 connected stake does NOT clear ⅔ of the total set.
-	require.LessOrEqual(t, 3*equalStake, consensusconfig.TwoThirdsStakeFloor(5*equalStake),
-		"precondition: 3 of 5 equal validators is BELOW ⅔ of total — the prior connect gate's deadlock")
-
-	// Policy decision: 5 configured, 3 reachable agree on the frontier (mainnet analog 1082796).
-	beacons := nodeIDs(5)
-	frontier := ids.GenerateTestID()
-	policy := &BootstrapPolicy{
-		TrustedBeacons: equalBeacons(beacons, equalStake),
-		MinResponses:   3,
-	}
-	replies := []BeaconReply{
-		reply(beacons[0], frontier, equalStake),
-		reply(beacons[1], frontier, equalStake),
-		reply(beacons[2], frontier, equalStake),
-		// beacons[3], beacons[4] are down/stranded — no reply.
-	}
-	f, err := policy.AcceptsFrontier(context.Background(), replies)
-	require.NoError(t, err, "3 of 5 reachable beacons agreeing MUST be accepted — the mass-recovery case")
-	require.Equal(t, frontier, f.ID)
-	require.Equal(t, 3, f.Responders)
-	require.False(t, f.FromCheckpoint)
-
-	// End to end over the real GetAcceptedFrontier/GetAncestors transport: a STALE node with only
-	// 3 of its 5 equal-weight validators reachable converges to the frontier N (not stuck at M).
-	const N = 40
-	const M = 23
-	chain, byID := buildBSChain(N, -1)
-	vm := newBSVMAt(chain, M)
-	v := nodeIDs(5)
-	weights := equalBeacons(v, equalStake)
-	bh, chainID := newBSHandlerWeighted(t, vm, weights)
-	bh.bootstrapMinResponses = 3 // the owner's MinBootstrapResponses=3
-	bh.net = &bsBeaconNet{
-		bh: bh, chainID: chainID, connected: []ids.NodeID{v[0], v[1], v[2]}, // 2 stranded down
-		byID: byID, tip: chain[N], serveAncestors: true,
-	}
-	bh.msgCreator = bsMsgBuilder{}
-	ctx := context.Background()
-
-	bh.bsActive.Store(true)
-	tip, status := bh.FrontierTip(ctx)
-	bh.bsActive.Store(false)
-	require.Equal(t, chainbootstrap.FrontierNamed, status,
-		"MASS RECOVERY: 3 of 5 equal validators reachable + agreeing must NAME the frontier (no deadlock)")
-	require.Equal(t, chain[N].id, tip)
-
-	require.NoError(t, runBS(t, bh), "mass-recovery node must converge")
-	last, _ := vm.LastAccepted(ctx)
-	require.Equal(t, chain[N].id, last, "RECOVERED: converged to the frontier N=%d despite 2 of 5 validators down", N)
-	require.True(t, bh.Accepted(ctx, chain[N].id))
-}
-
-// ----- B: ONE-BEACON CAPTURE REJECTED ---------------------------------------
-
-// TestBootstrapTrust_B_OneBeaconCaptureRejected: 5 configured, only 1 reachable. A single beacon —
-// even an authentic configured one — cannot name the frontier (it could be the attacker's lone
-// peer in an eclipse). The response FLOOR rejects it.
-func TestBootstrapTrust_B_OneBeaconCaptureRejected(t *testing.T) {
-	beacons := nodeIDs(5)
-	policy := &BootstrapPolicy{TrustedBeacons: equalBeacons(beacons, equalStake), MinResponses: 3}
-	replies := []BeaconReply{reply(beacons[0], ids.GenerateTestID(), equalStake)}
-
-	f, err := policy.AcceptsFrontier(context.Background(), replies)
-	require.Nil(t, f)
-	require.ErrorIs(t, err, ErrInsufficientBootstrapResponses,
-		"1 of 5 reachable must be REJECTED (capture) — below the MinResponses floor")
-}
-
-// ----- C: TWO-BEACON PARTITION REJECTED -------------------------------------
-
-// TestBootstrapTrust_C_TwoBeaconPartitionRejected: 5 configured, 2 reachable AGREEING. Two beacons
-// is still below MinResponses=3, so the policy rejects by default — an attacker who partitions the
-// node down to 2 beacons cannot capture the frontier even if both agree.
-func TestBootstrapTrust_C_TwoBeaconPartitionRejected(t *testing.T) {
-	beacons := nodeIDs(5)
-	frontier := ids.GenerateTestID()
-	policy := &BootstrapPolicy{TrustedBeacons: equalBeacons(beacons, equalStake), MinResponses: 3}
-	replies := []BeaconReply{
-		reply(beacons[0], frontier, equalStake),
-		reply(beacons[1], frontier, equalStake),
-	}
-	f, err := policy.AcceptsFrontier(context.Background(), replies)
-	require.Nil(t, f)
-	require.ErrorIs(t, err, ErrInsufficientBootstrapResponses,
-		"2 of 5 reachable + agreeing must be REJECTED by default — the partition-capture floor is MinResponses=3")
-}
-
-// ----- D: NON-CONFIGURED PEER IGNORED ---------------------------------------
-
-// TestBootstrapTrust_D_NonConfiguredPeerIgnored: an attacker peer that is NOT in the configured
-// beacon set reports a higher forged tip. INVARIANT 1 (non-circular eligibility): peers never
-// define who is a beacon, so the forged reply is dropped entirely and the configured beacons name
-// the real frontier.
-func TestBootstrapTrust_D_NonConfiguredPeerIgnored(t *testing.T) {
-	beacons := nodeIDs(5)
-	real := ids.GenerateTestID()
-	forgedHigher := ids.GenerateTestID()
-	attacker := ids.GenerateTestNodeID() // NOT in TrustedBeacons
-
-	policy := &BootstrapPolicy{TrustedBeacons: equalBeacons(beacons, equalStake), MinResponses: 3}
-	replies := []BeaconReply{
-		reply(beacons[0], real, equalStake),
-		reply(beacons[1], real, equalStake),
-		reply(beacons[2], real, equalStake),
-		reply(attacker, forgedHigher, 9_000_000_000_000_000_000), // huge self-reported weight, ignored
-	}
-	f, err := policy.AcceptsFrontier(context.Background(), replies)
-	require.NoError(t, err)
-	require.Equal(t, real, f.ID, "the non-configured attacker's forged tip must be IGNORED")
-	require.NotEqual(t, forgedHigher, f.ID)
-	require.Equal(t, 3, f.Responders, "only the 3 configured beacons count toward the quorum")
-}
-
-// ----- E: MINORITY CONFIGURED FORGERY REJECTED ------------------------------
-
-// TestBootstrapTrust_E_MinorityConfiguredForgeryRejected: 3 honest configured beacons report
-// frontier A; 2 configured beacons report a FORGED tip B built directly on A (a forged higher
-// sibling). C1: the forgers can only RATIFY A (the real block they built on); B itself holds only
-// the Byzantine minority's stake and is NEVER named. The policy selects A.
-func TestBootstrapTrust_E_MinorityConfiguredForgeryRejected(t *testing.T) {
-	const w uint64 = 100
-	refs, byID := refChain(30) // genesis..30; A := refs[30]
-	A := refs[30]
-	forgedB := childRef(A) // forged sibling at height 31, parent = real A
-	byID[forgedB.ID] = forgedB
-
-	beacons := nodeIDs(5)
-	policy := &BootstrapPolicy{
-		TrustedBeacons: equalBeacons(beacons, w),
-		MinResponses:   3,
-		Source:         &stubAncestry{byID: byID},
-	}
-	replies := []BeaconReply{
-		reply(beacons[0], A.ID, w),
-		reply(beacons[1], A.ID, w),
-		reply(beacons[2], A.ID, w),       // 3 honest on A (300)
-		reply(beacons[3], forgedB.ID, w), // 2 Byzantine on the forged child (200)
-		reply(beacons[4], forgedB.ID, w),
-	}
-	// floor = ⅔ of 500 = 333. Neither A (300) nor forgedB (200) clears it directly, so the
-	// ancestor-tolerant tally runs: the forgers' stake flows DOWN through A (its real parent),
-	// crediting A with 500 while forgedB keeps only 200 → A named, forgedB never.
-	f, err := policy.AcceptsFrontier(context.Background(), replies)
-	require.NoError(t, err)
-	require.Equal(t, A.ID, f.ID, "C1: the forged child only RATIFIES A — A is named")
-	require.NotEqual(t, forgedB.ID, f.ID, "C1: the Byzantine-minority forged tip is NEVER named")
-	require.Equal(t, A.Height, f.Height)
-}
-
-// ----- F: SPLIT REACHABLE ANCESTRY ------------------------------------------
-
-// TestBootstrapTrust_F_SplitReachableAncestrySelectsCommonAncestor: 3 reachable configured beacons
-// each report a DIFFERENT sibling tip (three pending blocks built on the same committed block H —
-// the healthy bleeding edge). No single tip holds a supermajority, but H is in all three accepted
-// chains, so the policy names H (the highest ⅔-of-responders common committed block), NOT any
-// isolated tip.
-func TestBootstrapTrust_F_SplitReachableAncestrySelectsCommonAncestor(t *testing.T) {
-	const w uint64 = 100
-	refs, byID := refChain(39) // genesis..39; H := refs[39] (the common committed block)
-	H := refs[39]
-	a1, a2, a3 := childRef(H), childRef(H), childRef(H) // three sibling pending blocks at height 40
-	for _, c := range []BlockRef{a1, a2, a3} {
-		byID[c.ID] = c
-	}
-
-	beacons := nodeIDs(3)
-	policy := &BootstrapPolicy{
-		TrustedBeacons: equalBeacons(beacons, w),
-		MinResponses:   3,
-		Source:         &stubAncestry{byID: byID},
-	}
-	replies := []BeaconReply{
-		reply(beacons[0], a1.ID, w),
-		reply(beacons[1], a2.ID, w),
-		reply(beacons[2], a3.ID, w),
-	}
-	// floor = ⅔ of 300 = 200. Each sibling holds only 100, but H is shared by all three → 300 > 200.
-	f, err := policy.AcceptsFrontier(context.Background(), replies)
-	require.NoError(t, err)
-	require.Equal(t, H.ID, f.ID, "must select the common committed ancestor H")
-	require.Equal(t, H.Height, f.Height)
-	require.NotEqual(t, a1.ID, f.ID)
-	require.NotEqual(t, a2.ID, f.ID)
-	require.NotEqual(t, a3.ID, f.ID)
-}
-
-// ----- G: FINALITY UNCHANGED ------------------------------------------------
-
-// TestBootstrapTrust_G_FinalityUnchanged proves INVARIANT 3: a bootstrap-accepted frontier is NOT
-// finality. The SAME 3-of-5 support that AcceptsFrontier admits as a sync anchor does NOT satisfy
-// ConsensusQuorum.HasFinality — live block acceptance still requires > ⅔ of CURRENT validator
-// stake (4 of 5 here). The bootstrap quorum cannot finalize a block.
-func TestBootstrapTrust_G_FinalityUnchanged(t *testing.T) {
-	const w uint64 = 100
-	const total = 5 * w
-	beacons := nodeIDs(5)
-	frontier := ids.GenerateTestID()
-	policy := &BootstrapPolicy{TrustedBeacons: equalBeacons(beacons, w), MinResponses: 3}
-
-	// BootstrapTrust ACCEPTS 3 of 5 (a sync anchor).
-	f, err := policy.AcceptsFrontier(context.Background(), []BeaconReply{
-		reply(beacons[0], frontier, w),
-		reply(beacons[1], frontier, w),
-		reply(beacons[2], frontier, w),
-	})
-	require.NoError(t, err)
-	require.Equal(t, frontier, f.ID)
-	require.Equal(t, StakeWeight(3*w), f.Weight, "the frontier is backed by exactly the 3 responders")
-
-	// ConsensusQuorum says that SAME 3-of-5 weight is NOT finality — the decisions are different
-	// objects with different thresholds. Finality is unchanged: it still needs > ⅔ (4 of 5).
-	cq := DefaultConsensusQuorum()
-	require.False(t, cq.HasFinality(3*w, total),
-		"INVARIANT 3: a bootstrap-accepted frontier (3 of 5) is NOT a finalizing supermajority")
-	require.True(t, cq.HasFinality(4*w, total),
-		"finality UNCHANGED: > ⅔ of current stake (4 of 5) still finalizes")
-	require.False(t, cq.HasFinality(f.Weight, total),
-		"the bootstrap quorum's own backing weight cannot finalize a block")
-}
-
-// ----- checkpoint override (complements B) ----------------------------------
-
-// TestBootstrapTrust_CheckpointOverride: below the response floor (1 of 5), the DEFAULT is reject
-// (test B), but an operator who pins a checkpoint gets the explicit override — the node anchors to
-// the pinned (id,height) instead of trusting the lone beacon. This is the sanctioned escape hatch
-// for a deeply-partitioned node, NEVER an open-ended ≥1-beacon acceptance.
-func TestBootstrapTrust_CheckpointOverride(t *testing.T) {
-	beacons := nodeIDs(5)
-	ckptID := ids.GenerateTestID()
-	policy := &BootstrapPolicy{
-		TrustedBeacons: equalBeacons(beacons, equalStake),
-		MinResponses:   3,
-		Checkpoint:     &Checkpoint{ID: ckptID, Height: 1_082_796},
-	}
-	// 1 reachable beacon — below the floor — but a checkpoint is pinned.
-	f, err := policy.AcceptsFrontier(context.Background(), []BeaconReply{
-		reply(beacons[0], ids.GenerateTestID(), equalStake),
-	})
-	require.NoError(t, err)
-	require.True(t, f.FromCheckpoint, "below the floor with a pinned checkpoint → anchor to the checkpoint")
-	require.Equal(t, ckptID, f.ID)
-	require.Equal(t, uint64(1_082_796), f.Height)
-
-	// Without the checkpoint the same 1-of-5 is rejected (the default — never trust the lone beacon).
-	policy.Checkpoint = nil
-	_, err = policy.AcceptsFrontier(context.Background(), []BeaconReply{
-		reply(beacons[0], ids.GenerateTestID(), equalStake),
-	})
-	require.ErrorIs(t, err, ErrInsufficientBootstrapResponses)
-}
-
-// ----- safety guard for the global ancestor-tolerant tally ------------------
-
-// TestBootstrapTrust_ForkAtSharedGenesisFailsSafe is the load-bearing guard for the
-// MinFrontierHeight floor — the safety property the global cross-anchor tally (which makes case F
-// work) would otherwise break. Two branches fork at a DEEP shared ancestor H (height 5), and the
-// node is stale ABOVE the fork (height 23). The tally credits H with the union of BOTH halves'
-// stake (all responders share H), so without the floor it would name H — and since the node
-// already HOLDS H, the loop would FALSE-COMPLETE at the stale height instead of recognizing it has
-// no ⅔-agreed frontier ahead. The MinFrontierHeight floor refuses to name any block beneath the
-// node's last-accepted height, turning the partition into a safe ErrNoBootstrapQuorum.
-//
-// Asserted deterministically at the POLICY level (a stub AncestrySource serves BOTH branches'
-// shared ancestry — the real wire transport's rotated sampling may only serve one, masking the
-// vulnerability, so the integration path is NOT a faithful test of this guard). Revert the floor
-// (set MinFrontierHeight: 0) and this names H instead of failing safe.
-func TestBootstrapTrust_ForkAtSharedGenesisFailsSafe(t *testing.T) {
-	const w uint64 = 100
-	const nodeHeight = 23
-
-	// Shared prefix genesis..H (H at height 5), then two divergent branches to height 40.
-	shared, byID := refChain(5)
-	H := shared[5]
-	branchA := []BlockRef{H}
-	branchB := []BlockRef{H}
-	for h := 6; h <= 40; h++ {
-		a := childRef(branchA[len(branchA)-1])
-		b := childRef(branchB[len(branchB)-1])
-		byID[a.ID], byID[b.ID] = a, b
-		branchA = append(branchA, a)
-		branchB = append(branchB, b)
-	}
-	tipA, tipB := branchA[len(branchA)-1], branchB[len(branchB)-1]
-
-	beacons := nodeIDs(6)
-	policy := &BootstrapPolicy{
-		TrustedBeacons:    equalBeacons(beacons, w),
-		MinResponses:      4,
-		MinFrontierHeight: nodeHeight, // the node is stale at height 23, ABOVE the fork at 5
-		Source:            &stubAncestry{byID: byID},
-	}
-	replies := []BeaconReply{
-		reply(beacons[0], tipA.ID, w), reply(beacons[1], tipA.ID, w), reply(beacons[2], tipA.ID, w),
-		reply(beacons[3], tipB.ID, w), reply(beacons[4], tipB.ID, w), reply(beacons[5], tipB.ID, w),
-	}
-	// H (height 5) is shared by all 6 → 600 > floor(400). But it is BELOW the node's height, so the
-	// floor refuses it; no block at/above height 23 has ⅔ → fail safe.
-	f, err := policy.AcceptsFrontier(context.Background(), replies)
-	require.Nil(t, f, "must not name the deep shared ancestor — that would false-complete at the stale height")
-	require.ErrorIs(t, err, ErrNoBootstrapQuorum,
-		"a fork sharing only blocks BELOW the node's height must fail safe, never name the deep common ancestor")
-
-	// The same split with the node BELOW the fork (a fresh node) legitimately names H — the floor
-	// only blocks naming history the node already has, never a real frontier ahead.
-	policy.MinFrontierHeight = 0
-	f, err = policy.AcceptsFrontier(context.Background(), replies)
-	require.NoError(t, err)
-	require.Equal(t, H.ID, f.ID, "with the node below the fork, H IS the ⅔-common frontier to sync to")
-}
-
-// ----- H: SKEWED-WEIGHT PARTITION-CAPTURE (the re-red HIGH; MinResponseWeight floor) ---------
-
-// weightedBeacons builds a TrustedBeacons map from an explicit per-node weight list — for
-// modeling a SKEWED (non-uniform) validator stake distribution.
-func weightedBeacons(beacons []ids.NodeID, w []uint64) map[ids.NodeID]StakeWeight {
-	m := make(map[ids.NodeID]StakeWeight, len(beacons))
-	for i, id := range beacons {
-		m[id] = StakeWeight(w[i])
-	}
-	return m
-}
-
-// TestBootstrapTrust_H_SkewedWeightPartitionRejected is the load-bearing regression for the re-red
-// HIGH finding. Under SKEWED validator weights the MinResponses COUNT floor and the ⅔-of-responders
-// WEIGHT agreement diverge: an attacker who eclipses the HEAVY honest beacon but lets enough LIGHT
-// honest beacons through to satisfy the count can shrink the responder-WEIGHT denominator until his
-// < ⅓-of-total Byzantine stake clears ⅔-of-responders and NAMES A FORGED FRONTIER. The MinResponseWeight
-// stake-majority floor (> ½ of TOTAL configured beacon stake) closes this — a < ⅓-stake adversary can
-// never make the responders carry a ⅔ weight majority once they must also carry > ½ of the total.
-//
-// Red's PoC: 6 beacons w={3,3,13,1,1,1}, total 22, Byzantine {B0,B1}=6 (27% < ⅓). The attacker
-// partitions to {B0,B1 on forgedF} + {H2,H3 on realR} = 4 responders (= the majority count floor),
-// responderWeight=8, ⅔-floor=5, backing[forgedF]=6 > 5 → forgedF would be named. The heavy honest H1
-// (weight 13, on the real tip) is eclipsed. With MinResponseWeight=⌈22/2⌉=12, responderWeight=8 < 12
-// → the partition is rejected (the node waits for / re-samples a stake-majority of beacons).
-func TestBootstrapTrust_H_SkewedWeightPartitionRejected(t *testing.T) {
-	refs, byID := refChain(30)
-	realR := refs[30]
-	forgedF := childRef(realR) // forged sibling at height 31 (its only honest ancestor is realR)
-	byID[forgedF.ID] = forgedF
-
-	b := nodeIDs(6)
-	weights := []uint64{3, 3, 13, 1, 1, 1} // total 22; Byzantine b[0],b[1]=6 (<⅓)
-	var total uint64
-	for _, w := range weights {
-		total += w
-	}
-	tb := weightedBeacons(b, weights)
-
-	// The eclipse: only the 2 Byzantine + 2 LIGHT honest answer; the HEAVY honest b[2] (the real
-	// tip's weight-13 voter) and b[5] are partitioned away.
-	replies := []BeaconReply{
-		reply(b[0], forgedF.ID, weights[0]), // Byzantine, light
-		reply(b[1], forgedF.ID, weights[1]), // Byzantine, light
-		reply(b[3], realR.ID, weights[3]),   // honest, light
-		reply(b[4], realR.ID, weights[4]),   // honest, light
-	}
-
-	// WITHOUT the stake-majority floor (the bug): the forged tip is named.
-	vuln := &BootstrapPolicy{TrustedBeacons: tb, MinResponses: 4, Source: &stubAncestry{byID: byID}}
-	if f, err := vuln.AcceptsFrontier(context.Background(), replies); err == nil && f != nil {
-		require.Equal(t, forgedF.ID, f.ID,
-			"VULN PRECONDITION: without MinResponseWeight the eclipsed skewed partition names the forged tip (proves the floor is load-bearing)")
-	}
-
-	// WITH the stake-majority floor (the fix, exactly as bootstrapPolicy() now wires it): rejected.
-	fixed := &BootstrapPolicy{
-		TrustedBeacons:    tb,
-		MinResponses:      4,
-		MinResponseWeight: StakeWeight(total/2 + 1), // ⌈total/2⌉ = 12
-		Source:            &stubAncestry{byID: byID},
-	}
-	_, err := fixed.AcceptsFrontier(context.Background(), replies)
-	require.ErrorIs(t, err, ErrInsufficientBootstrapResponses,
-		"FIX: responderWeight 8 < ½-stake floor 12 → the skewed partition cannot name a frontier (forged or otherwise)")
-
-	// And the fix still admits an HONEST stake-majority: add the heavy honest H1 (weight 13) on realR.
-	full := append(replies, reply(b[2], realR.ID, weights[2])) // responderWeight 8+13 = 21 ≥ 12
-	f, err := fixed.AcceptsFrontier(context.Background(), full)
-	require.NoError(t, err, "an honest stake-majority of responders still names the real frontier")
-	require.Equal(t, realR.ID, f.ID, "the real tip is named once a stake-majority is reachable; forged never")
-}
-
-// TestBootstrapTrust_D2_NonConfiguredSwarmNamesNothing is the cleaner load-bearing isolation of the
-// configured-beacon filter (INVARIANT 1) that the re-red asked for: a SWARM of non-configured peers
-// (enough to clear any count floor on their own) all shouting a forged frontier names NOTHING,
-// because none is in TrustedBeacons. This proves the filter, not merely the MinResponders floor.
-func TestBootstrapTrust_D2_NonConfiguredSwarmNamesNothing(t *testing.T) {
-	const w uint64 = 100
-	refs, byID := refChain(30)
-	real := refs[30]
-	forged, fbyID := refChain(40) // a wholly forged chain from a fresh genesis
-	for id, r := range fbyID {
-		byID[id] = r
-	}
-
-	configured := nodeIDs(3) // the real beacon set
-	policy := &BootstrapPolicy{
-		TrustedBeacons:    equalBeacons(configured, w),
-		MinResponses:      2,
-		MinResponseWeight: StakeWeight(w*3/2 + 1),
-		Source:            &stubAncestry{byID: byID},
-	}
-
-	// 50 non-configured peers, each heavy, all on the forged tip — NOT in TrustedBeacons.
-	swarm := nodeIDs(50)
-	var replies []BeaconReply
-	for _, p := range swarm {
-		replies = append(replies, reply(p, forged[40].ID, 9_000_000))
-	}
-	_, err := policy.AcceptsFrontier(context.Background(), replies)
-	require.ErrorIs(t, err, ErrInsufficientBootstrapResponses,
-		"INVARIANT 1: non-configured peers carry ZERO weight — a forged swarm names nothing")
-
-	// Add the 3 real configured beacons on the real tip → the real tip is named, swarm invisible.
-	for _, c := range configured {
-		replies = append(replies, reply(c, real.ID, w))
-	}
-	f, err := policy.AcceptsFrontier(context.Background(), replies)
-	require.NoError(t, err)
-	require.Equal(t, real.ID, f.ID, "only configured beacons name the frontier; the 50-peer forged swarm is ignored")
-}
-
-// TestBootstrapPolicy_WiresStakeMajorityFloor is the regression guard the re-red flagged (LOW):
-// the production constructor bootstrapPolicy() MUST emit MinResponseWeight = ⌈total/2⌉. The H/D2
-// tests construct policies directly, so a mutation that stops the constructor from setting the
-// floor would not be caught — this asserts the WIRING on the real production path. Mutation-proof:
-// neuter `if total > 0` in bootstrapPolicy() and this test fails (MinResponseWeight==0).
-func TestBootstrapPolicy_WiresStakeMajorityFloor(t *testing.T) {
-	refs, _ := refChain(5)
-	vm := newBSVMAt(refs5BSBlocks(refs), 0)
-	bh, _ := newBSHandlerWeighted(t, vm, map[ids.NodeID]uint64{}) // handler shell; we call bootstrapPolicy directly
-
-	// SKEWED set: total = 22, ⌈total/2⌉ = 12.
-	b := nodeIDs(6)
-	weights := map[ids.NodeID]uint64{b[0]: 3, b[1]: 3, b[2]: 13, b[3]: 1, b[4]: 1, b[5]: 1}
-	var total uint64
-	for _, w := range weights {
-		total += w
-	}
-
-	pol := bh.bootstrapPolicy(weights)
-	require.Equal(t, StakeWeight(total/2+1), pol.MinResponseWeight,
-		"REGRESSION: bootstrapPolicy() must wire MinResponseWeight = ⌈total/2⌉ (skewed-weight floor)")
-	require.Equal(t, len(weights)/2+1, pol.MinResponses,
-		"bootstrapPolicy() must wire the count-majority floor too")
-	require.NotNil(t, pol.Source, "the policy must carry an AncestrySource")
-
-	// EQUAL-weight: 5 × 0.5e18 — the floor must not re-deadlock 3-of-5 (= 0.6 ≥ 0.5).
-	eq := equalBeacons(nodeIDs(5), 500_000_000_000_000_000)
-	var eqTotal uint64
-	for _, w := range eq {
-		eqTotal += uint64(w)
-	}
-	eqPol := bh.bootstrapPolicy(eq)
-	require.Equal(t, StakeWeight(eqTotal/2+1), eqPol.MinResponseWeight)
-	require.Less(t, eqPol.MinResponseWeight, StakeWeight(3*500_000_000_000_000_000),
-		"3-of-5 equal stake (0.6·total) must clear the ½ floor — no re-deadlock")
-
-	// DEGENERATE: empty weights → floor disabled (0), no panic.
-	require.Equal(t, StakeWeight(0), bh.bootstrapPolicy(map[ids.NodeID]uint64{}).MinResponseWeight,
-		"empty weights → MinResponseWeight disabled (pre-P-chain / single-node fallback)")
-}
-
-// refs5BSBlocks adapts a BlockRef chain to the []*bsTestBlock the bsTestVM needs (genesis only
-// accepted), so newBSHandlerWeighted has a VM. The handler is used only to call bootstrapPolicy().
-func refs5BSBlocks(refs []BlockRef) []*bsTestBlock {
-	out := make([]*bsTestBlock, len(refs))
-	var parent ids.ID
-	for i, r := range refs {
-		out[i] = &bsTestBlock{id: r.ID, parent: parent, height: r.Height, bytes: []byte(r.ID.String()), valid: true}
-		parent = r.ID
-	}
-	return out
-}
-
-// ----- CaughtUp: the tip-holder go-live determination (RED CRITICAL fix) ----
-//
-// CaughtUp is the DUAL of AcceptsFrontier — "nobody is ahead" vs "here is the block ahead to sync
-// to". It is the go-live path for a TIP-HOLDER on a mixed-height co-restart, where the responders
-// SPLIT below the ⅔ naming threshold so AcceptsFrontier names NOTHING yet the node is plainly not
-// behind. Getting its SAFETY exactly right is the hinge between "fixes the freeze" and "reopens the
-// stale-go-live bug": these pin all three conditions (floor met, none-ahead, holds-every-tip) and
-// prove the two adversarial fake-caught-up attempts FAIL.
-
-// heldOracle builds the height ORACLE CaughtUp injects: a block's height, ok=false when not held.
-func heldOracle(held map[ids.ID]uint64) func(ids.ID) (uint64, bool) {
-	return func(id ids.ID) (uint64, bool) { h, ok := held[id]; return h, ok }
-}
-
-// TestBootstrapTrust_CaughtUp_TipHolderSplitGoesReady is the CRITICAL regression at the policy layer:
-// the EXACT mainnet co-restart shape. A producer at N sees 4 responders split {N, N, N-16, genesis};
-// the tip-holders are only ½ (< ⅔), so AcceptsFrontier names NOTHING (ErrNoBootstrapQuorum) — yet the
-// node holds every reported tip and none is above N, so CaughtUp is TRUE. It pins BOTH halves: the
-// SAME replies yield no NAMED frontier (the case the tip-holder fails safe DOWN without this fix) but
-// ARE caught-up.
-func TestBootstrapTrust_CaughtUp_TipHolderSplitGoesReady(t *testing.T) {
-	const N = 40
-	refs, byID := refChain(N) // genesis..N
-	b := nodeIDs(5)           // 5 equal-weight beacons (the node is the 5th, not a responder)
-	const w = uint64(100)     // total 500 → MinResponseWeight ⌈500/2⌉=251, MinResponses majority=3
-	policy := &BootstrapPolicy{
-		TrustedBeacons:    equalBeacons(b, w),
-		MinResponses:      3,
-		MinResponseWeight: 251,
-		MinFrontierHeight: N,
-		Source:            &stubAncestry{byID: byID},
-	}
-
-	// 4 connected responders: 2 at the tip N, one stale at N-16, one at genesis — the production shape.
-	replies := []BeaconReply{
-		reply(b[0], refs[N].ID, w),
-		reply(b[1], refs[N].ID, w),
-		reply(b[2], refs[N-16].ID, w),
-		reply(b[3], refs[0].ID, w),
-	}
-
-	// HALF 1: AcceptsFrontier names NOTHING — the tip-holders (200) do not clear ⅔ (266), and the
-	// ⅔-backed common ancestor N-16 is below MinFrontierHeight=N (history the node already has).
-	_, err := policy.AcceptsFrontier(context.Background(), replies)
-	require.ErrorIs(t, err, ErrNoBootstrapQuorum,
-		"the mixed-height split names no frontier — exactly the case the tip-holder froze on without CaughtUp")
-
-	// HALF 2: the node HOLDS its accepted chain 0..N, so it holds every reported tip and none is above
-	// N → CaughtUp is TRUE. This is the go-live path the regression was missing.
-	held := map[ids.ID]uint64{refs[N].ID: N, refs[N-16].ID: N - 16, refs[0].ID: 0}
-	require.True(t, policy.CaughtUp(replies, N, heldOracle(held)),
-		"a tip-holder that holds every reported tip and is at the top of all of them IS caught up")
-}
-
-// TestBootstrapTrust_CaughtUp_StaleNodeNotCaughtUp is the FORWARD safety guard (the stale-go-live bug
-// staying FIXED): a STALE node at N-16 with honest producers at N PRESENT must NOT be caught-up — an
-// honest responder is ahead, so it still SYNCS. CaughtUp must not fire merely because SOME responders
-// are at/below the node.
-func TestBootstrapTrust_CaughtUp_StaleNodeNotCaughtUp(t *testing.T) {
-	const N = 40
-	refs, _ := refChain(N)
-	b := nodeIDs(5)
-	const w = uint64(100)
-	policy := &BootstrapPolicy{TrustedBeacons: equalBeacons(b, w), MinResponses: 3, MinResponseWeight: 251, MinFrontierHeight: N - 16}
-
-	replies := []BeaconReply{
-		reply(b[0], refs[N].ID, w),    // honest, AHEAD
-		reply(b[1], refs[N].ID, w),    // honest, AHEAD
-		reply(b[2], refs[N-16].ID, w), // at the node's height
-		reply(b[3], refs[N-20].ID, w), // below
-	}
-	// The node holds only 0..N-16 — it does NOT hold the producers' tip N.
-	held := map[ids.ID]uint64{refs[N-16].ID: N - 16, refs[N-20].ID: N - 20}
-	require.False(t, policy.CaughtUp(replies, N-16, heldOracle(held)),
-		"a stale node with an honest responder ahead must NOT be caught up — it syncs (stale-go-live stays fixed)")
-}
-
-// TestBootstrapTrust_CaughtUp_StaleNodeMinorityFakeRejected is adversarial fake-caught-up #1 (honest
-// present): a node at N-16 where a <⅓-stake set of beacons reports ≤ N-16 to fake caught-up WHILE the
-// honest producers at N are also present. The honest max is ahead (and the node lacks tip N) → NOT
-// caught up. The minority cannot fake it past the honest responders.
-func TestBootstrapTrust_CaughtUp_StaleNodeMinorityFakeRejected(t *testing.T) {
-	const N = 40
-	refs, _ := refChain(N)
-	b := nodeIDs(5)
-	const w = uint64(100)
-	policy := &BootstrapPolicy{TrustedBeacons: equalBeacons(b, w), MinResponses: 3, MinResponseWeight: 251, MinFrontierHeight: N - 16}
-
-	// 3 honest producers at N (ahead) + 1 Byzantine at N-16 trying to fake "everyone is at my height".
-	replies := []BeaconReply{
-		reply(b[0], refs[N].ID, w),
-		reply(b[1], refs[N].ID, w),
-		reply(b[2], refs[N].ID, w),
-		reply(b[3], refs[N-16].ID, w), // the < ⅓ liar
-	}
-	held := map[ids.ID]uint64{refs[N-16].ID: N - 16} // node holds only up to N-16
-	require.False(t, policy.CaughtUp(replies, N-16, heldOracle(held)),
-		"a <⅓ minority reporting ≤N-16 cannot fake caught-up while honest producers at N are present")
-}
-
-// TestBootstrapTrust_CaughtUp_EclipsedMinorityFailsSafe is adversarial fake-caught-up #2 (honest
-// eclipsed): the honest producers (at N) are SUPPRESSED and only a <½-stake set of beacons reports
-// ≤ N-16. The response FLOOR (the SAME one AcceptsFrontier uses) is not met → CaughtUp is FALSE →
-// fail safe. Faking caught-up costs the same stake-majority of honest beacons that faking a NAMED
-// frontier does — no partition-capture.
-func TestBootstrapTrust_CaughtUp_EclipsedMinorityFailsSafe(t *testing.T) {
-	const N = 40
-	refs, _ := refChain(N)
-	b := nodeIDs(5)
-	const w = uint64(100) // total 500 → MinResponseWeight 251
-	policy := &BootstrapPolicy{TrustedBeacons: equalBeacons(b, w), MinResponses: 3, MinResponseWeight: 251, MinFrontierHeight: N - 16}
-
-	// Only 2 of 5 beacons answer (the honest producers at N are eclipsed). Their weight 200 < 251.
-	replies := []BeaconReply{
-		reply(b[2], refs[N-16].ID, w),
-		reply(b[3], refs[N-20].ID, w),
-	}
-	held := map[ids.ID]uint64{refs[N-16].ID: N - 16, refs[N-20].ID: N - 20}
-	require.False(t, policy.CaughtUp(replies, N-16, heldOracle(held)),
-		"an eclipsed <½-stake responder set cannot fake caught-up — the floor is not met (fail safe)")
-
-	// Sanity: AcceptsFrontier ALSO rejects this set below the floor (the SAME floor gates both paths).
-	_, err := policy.AcceptsFrontier(context.Background(), replies)
-	require.ErrorIs(t, err, ErrInsufficientBootstrapResponses, "the same floor gates naming and caught-up")
-}
-
-// TestBootstrapTrust_CaughtUp_OneAcceptedBlockBehindSyncs proves condition (b) uses the ACCEPTED
-// height: a node at accepted N that has merely PROCESSED N+1 (holds it) is NOT caught up when a
-// producer has ACCEPTED N+1 — it must sync that block. heightOf reads the block's canonical height,
-// so a held-but-above-lastAccepted tip correctly defeats caught-up (the ±1 pending skew cannot fake it).
-func TestBootstrapTrust_CaughtUp_OneAcceptedBlockBehindSyncs(t *testing.T) {
-	const N = 40
-	refs, _ := refChain(N + 1) // includes N+1
-	b := nodeIDs(5)
-	const w = uint64(100)
-	policy := &BootstrapPolicy{TrustedBeacons: equalBeacons(b, w), MinResponses: 3, MinResponseWeight: 251, MinFrontierHeight: N}
-	replies := []BeaconReply{
-		reply(b[0], refs[N+1].ID, w), // a producer ACCEPTED N+1
-		reply(b[1], refs[N].ID, w),
-		reply(b[2], refs[N].ID, w),
-	}
-	// The node holds 0..N AND has processed N+1 (held), but its ACCEPTED height is N.
-	held := map[ids.ID]uint64{refs[N+1].ID: N + 1, refs[N].ID: N}
-	require.False(t, policy.CaughtUp(replies, N, heldOracle(held)),
-		"a node one ACCEPTED block behind (even if it processed N+1) must NOT be caught up — it syncs")
-}
-
-// TestBootstrapTrust_CaughtUp_SameHeightForkNotHeld proves condition (c): a responder reporting a
-// DIFFERENT block at the node's height (a fork the node never finalized) defeats caught-up — the node
-// must HOLD every reported tip, not merely match heights numerically.
-func TestBootstrapTrust_CaughtUp_SameHeightForkNotHeld(t *testing.T) {
-	const N = 40
-	refs, _ := refChain(N)
-	fork := BlockRef{ID: ids.GenerateTestID(), Height: N} // a sibling at height N the node does NOT hold
-	b := nodeIDs(5)
-	const w = uint64(100)
-	policy := &BootstrapPolicy{TrustedBeacons: equalBeacons(b, w), MinResponses: 3, MinResponseWeight: 251, MinFrontierHeight: N}
-	replies := []BeaconReply{
-		reply(b[0], refs[N].ID, w),
-		reply(b[1], refs[N].ID, w),
-		reply(b[2], fork.ID, w), // a fork at the same height N
-	}
-	held := map[ids.ID]uint64{refs[N].ID: N} // the node holds its tip N but NOT the fork
-	require.False(t, policy.CaughtUp(replies, N, heldOracle(held)),
-		"a same-height fork the node does not hold defeats caught-up (condition c: holds every reported tip)")
-}
-
-// ----- M1: the pre-existing eclipse-stale own-height path (red fast-follow) ------------------
-//
-// M1 is the pre-existing path the own-height filter tightening closes. BEFORE: nameFrontier filtered
-// the ancestor-tolerant tally with `ref.Height < MinFrontierHeight` (== the node's own last-accepted),
-// so a block AT the node's own height PASSED the filter and could be NAMED. An eclipse that throttles
-// the genuinely-ahead responders below the ⅔ naming threshold — while letting the at-height responders
-// through — makes the node's OWN height accrue ⅔ purely as the shared ANCESTOR of those ahead tips, so
-// nameFrontier names it → FrontierNamed at own height → the node goes Ready STALE (here, 5 blocks
-// behind a finalized N+5). AFTER: the filter is `ref.Height <= MinFrontierHeight`, so own height is
-// EXCLUDED from naming; the at-own-height decision routes to CaughtUp, which SEES the N+5 ahead tips
-// (un-held, above) and REFUSES → the node syncs/fails safe instead of going Ready stale.
-//
-// Deterministic, no network timing. Revert the filter to `<` and the first assertion (own height
-// NOT named → ErrNoBootstrapQuorum) FAILS — that revert IS the M1 bug, so this is the RED-before /
-// GREEN-after pin. The boundary sub-assertion (one notch lower DOES name N) proves it is precisely
-// the OWN-HEIGHT exclusion doing the work, not some unrelated filter.
-func TestBootstrapTrust_EclipseOwnHeightNotNamedRoutesToCaughtUp(t *testing.T) {
-	const N = 40       // the node's own last-accepted height
-	const ahead = N + 5 // a GENUINELY FINALIZED block 5 ahead — the eclipse throttles its visibility
-	refs, byID := refChain(ahead) // genesis..N+5, parent-linked; the ahead set's tip descends through N
-	const w = uint64(100)
-
-	b := nodeIDs(6) // 6 configured beacons @100 → total 600; MinResponseWeight ⌈600/2⌉=301, MinResponses majority=4
-	policy := &BootstrapPolicy{
-		TrustedBeacons:    equalBeacons(b, w),
-		MinResponses:      4,
-		MinResponseWeight: 301,
-		MinFrontierHeight: N, // the node's own last-accepted height — exactly the M1 boundary
-		Source:            &stubAncestry{byID: byID},
-	}
-
-	// THE ECLIPSE CONSTRUCTION (red's, verbatim numbers): the ahead responders are throttled to
-	// R_a = 300 (3 beacons at N+5, BELOW the ⅔-of-responders naming threshold), the behind/at-height
-	// responders R_b = 200 (2 beacons at N) all get through; the 6th beacon is eclipsed (no reply).
-	// R = R_a + R_b = 500 > ½·600 (floor met). R_a = 300 < ⅔R = 333 (so N+5 is NOT named). YET block N
-	// accrues R_a + R_b = 500 > ⅔R because the ahead nodes credit N as an ANCESTOR of N+5.
-	replies := []BeaconReply{
-		reply(b[0], refs[N].ID, w),     // at the node's own height N
-		reply(b[1], refs[N].ID, w),     // at the node's own height N  (R_b = 200)
-		reply(b[2], refs[ahead].ID, w), // genuinely ahead at N+5
-		reply(b[3], refs[ahead].ID, w), // genuinely ahead at N+5
-		reply(b[4], refs[ahead].ID, w), // genuinely ahead at N+5      (R_a = 300, < ⅔·500 = 333)
-		// b[5] eclipsed — no reply.
-	}
-
-	// Sanity pins on the construction (so a future edit that breaks the eclipse shape is caught).
-	require.Equal(t, uint64(333), Ratio{2, 3}.floorOf(500), "⅔-of-responders floor over R=500 is 333")
-	require.Less(t, uint64(300), uint64(333), "R_a=300 is BELOW the ⅔ naming threshold — N+5 is not nameable")
-
-	// AFTER (the fix): own height N is EXCLUDED from naming → no ⅔-backed block ABOVE N exists
-	// (N+5 is sub-⅔) → ErrNoBootstrapQuorum. (Revert `<=`→`<` and this names refs[N] — the M1 bug.)
-	_, err := policy.AcceptsFrontier(context.Background(), replies)
-	require.ErrorIs(t, err, ErrNoBootstrapQuorum,
-		"M1 FIX: the node's OWN height must NOT be named even when ahead tips credit it as a ⅔-backed ancestor")
-
-	// …and the decision routes to CaughtUp, which SEES the genuinely-ahead N+5 tips (un-held, above
-	// the node's height) and REFUSES — so the node syncs toward N+5, never goes Ready at stale N.
-	held := map[ids.ID]uint64{} // the node holds 0..N, NOT N+1..N+5
-	for h := 0; h <= N; h++ {
-		held[refs[h].ID] = uint64(h)
-	}
-	require.False(t, policy.CaughtUp(replies, N, heldOracle(held)),
-		"M1 FIX: routed to CaughtUp, the eclipse's ahead tips (un-held, above N) correctly defeat caught-up → sync")
-
-	// BOUNDARY: the SAME replies with MinFrontierHeight one notch lower (N-1) DO name N (height N is
-	// now STRICTLY ABOVE the floor). This proves the refusal above is precisely the OWN-HEIGHT
-	// exclusion — not the ⅔ tally, the responder floor, or the voter count — doing the work.
-	policy.MinFrontierHeight = N - 1
-	f, err := policy.AcceptsFrontier(context.Background(), replies)
-	require.NoError(t, err, "one notch below own height, N is strictly above the floor and IS the ⅔-common frontier")
-	require.Equal(t, refs[N].ID, f.ID, "boundary: N is named iff its height is STRICTLY ABOVE MinFrontierHeight")
-	require.Equal(t, uint64(N), f.Height)
-}

chains/catchup_frame_test.go

@@ -1,110 +0,0 @@
-// Copyright (C) 2019-2026, Lux Industries, Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-// catchup_frame_test.go — the CERT-CARRYING catch-up wire format. These prove the
-// load-bearing property: a v2 (block,cert) entry round-trips, an entry with no cert
-// routes to the vote path, and a cross-version exchange fails CLEANLY (a legacy
-// decoder cannot misparse a v2 frame, and the v2 decoder treats a legacy raw block
-// as legacy — never a partial/garbage parse). The cert-accept SEMANTICS are proven
-// in the consensus engine tests; here we pin only the framing.
-package chains
-
-import (
-	"bytes"
-	"encoding/binary"
-	"testing"
-)
-
-func TestCatchupEntry_RoundTrip(t *testing.T) {
-	block := []byte("\xf9\x02\x00 a realistic-ish block body")
-	cert := []byte("a-marshaled-quorum-cert")
-
-	blk, crt, ok := decodeCatchupEntry(encodeCatchupEntry(block, cert))
-	if !ok {
-		t.Fatal("a v2 entry must decode as a v2 entry")
-	}
-	if !bytes.Equal(blk, block) {
-		t.Fatalf("block bytes corrupted: got %q want %q", blk, block)
-	}
-	if !bytes.Equal(crt, cert) {
-		t.Fatalf("cert bytes corrupted: got %q want %q", crt, cert)
-	}
-}
-
-func TestCatchupEntry_EmptyCertRoutesToVotePath(t *testing.T) {
-	// A still-pending block served on the live missing-parent path carries no cert.
-	// It must decode as a v2 entry with an EMPTY cert — the requester then votes on
-	// it (handleContext routes certLen==0 to Put), the legacy behaviour.
-	block := []byte("pending-block-no-cert")
-	blk, crt, ok := decodeCatchupEntry(encodeCatchupEntry(block, nil))
-	if !ok {
-		t.Fatal("a v2 entry with empty cert must still decode as v2")
-	}
-	if !bytes.Equal(blk, block) {
-		t.Fatalf("block bytes corrupted: got %q", blk)
-	}
-	if len(crt) != 0 {
-		t.Fatalf("cert must be empty, got %d bytes", len(crt))
-	}
-}
-
-func TestCatchupEntry_LegacyRawBlockIsNotV2(t *testing.T) {
-	// A legacy responder sends the raw block as the container (no magic). The v2
-	// decoder must report ok=false so handleContext treats it as a raw block (Put),
-	// never as a malformed v2 entry. Cover several real block-prefix shapes.
-	for _, raw := range [][]byte{
-		{0xf9, 0x02, 0x00, 0x11, 0x22}, // EVM/RLP list header
-		{0x00, 0x00, 0x00, 0x2a},       // P/X-chain codec version prefix
-		{},                             // empty
-		[]byte("LCU"),                  // 3 bytes — too short to even hold the magic
-	} {
-		if _, _, ok := decodeCatchupEntry(raw); ok {
-			t.Fatalf("legacy raw block %x must NOT decode as a v2 entry", raw)
-		}
-	}
-}
-
-func TestCatchupEntry_MagicIsNotAPlausibleLength(t *testing.T) {
-	// CROSS-VERSION SAFETY (new responder → legacy requester): a legacy decoder reads
-	// the first 4 bytes of a v2 entry as a uint32 length. The magic must be so large
-	// that it always exceeds the remaining buffer, so the legacy loop rejects the
-	// frame (0 blocks processed) rather than consuming garbage. 0x4C435532 ≈ 1.28 GB.
-	asLen := binary.BigEndian.Uint32(catchupEntryMagic[:])
-	if asLen < (1 << 30) {
-		t.Fatalf("magic read as a length (%d) is too small — a legacy decoder could misparse a v2 frame", asLen)
-	}
-	// And a full v2 frame's leading length-word (the magic) dwarfs the frame itself,
-	// so the legacy `blockLen > remaining` guard always fires.
-	frame := encodeCatchupEntry([]byte("blk"), []byte("crt"))
-	if uint64(binary.BigEndian.Uint32(frame[:4])) <= uint64(len(frame)) {
-		t.Fatal("magic-as-length must exceed the frame length so a legacy decoder self-rejects")
-	}
-}
-
-func TestCatchupEntry_CorruptV2FramesRejected(t *testing.T) {
-	good := encodeCatchupEntry([]byte("block-body"), []byte("cert-body"))
-
-	// Truncations inside the v2 structure must fail to ok=false (never a partial
-	// parse): drop the trailing cert byte, drop the certLen word, etc.
-	for _, bad := range [][]byte{
-		good[:len(good)-1], // last cert byte missing → certLen != remaining
-		good[:len(good)-5], // certLen word + cert missing
-		good[:8],           // magic + blockLen only, block missing
-		good[:6],           // magic + 2 bytes of blockLen
-		append(append([]byte(nil), good...), 0x00), // trailing byte → does not consume exactly
-	} {
-		if _, _, ok := decodeCatchupEntry(bad); ok {
-			t.Fatalf("a corrupt v2 frame (len %d) must be rejected, not partial-parsed", len(bad))
-		}
-	}
-
-	// An overflowing blockLen (claims more block than the buffer holds) is rejected.
-	overflow := append([]byte(nil), catchupEntryMagic[:]...)
-	var u32 [4]byte
-	binary.BigEndian.PutUint32(u32[:], 0xFFFFFFFF)
-	overflow = append(overflow, u32[:]...)
-	overflow = append(overflow, []byte("tiny")...)
-	if _, _, ok := decodeCatchupEntry(overflow); ok {
-		t.Fatal("a v2 frame with an overflowing blockLen must be rejected")
-	}
-}

chains/catchup_test.go

@@ -1,56 +0,0 @@
-// Copyright (C) 2019-2025, Lux Industries, Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package chains
-
-import (
-	"context"
-	"testing"
-
-	"github.com/luxfi/ids"
-	"github.com/stretchr/testify/require"
-)
-
-// *blockHandler must satisfy ancestorRequester, or the catch-up wire silently
-// loses its transport. Catch it at compile time, not in production.
-var _ ancestorRequester = (*blockHandler)(nil)
-
-// catchupSpy records the requestContext calls networkCatchup bridges to.
-type catchupSpy struct {
-	calls     int
-	lastFrom  ids.NodeID
-	lastBlock ids.ID
-}
-
-func (s *catchupSpy) requestContext(_ context.Context, from ids.NodeID, blockID ids.ID) {
-	s.calls++
-	s.lastFrom = from
-	s.lastBlock = blockID
-}
-
-// TestNetworkCatchup_BridgesEngineSignalToWire is the regression for the
-// stranded-follower bug: node never set netCfg.Catchup, so the engine's
-// requestCatchup hit a nil interface and a follower that fell behind during
-// consensus never fetched the missing ancestors — it looped on an unfinalizable
-// orphan forever (observed live: mainnet luxd-0/2 stuck at 1082780 while peers
-// reached 1082793). The wire must (a) be nil-safe before its handler is
-// late-bound and (b) route the engine's RequestAncestors to the handler's
-// GetAncestors transport (requestContext), once, for the right block and peer.
-func TestNetworkCatchup_BridgesEngineSignalToWire(t *testing.T) {
-	missing := ids.GenerateTestID()
-	peer := ids.GenerateTestNodeID()
-
-	// (a) Before late-binding (handler nil): a harmless no-op, never a panic.
-	c := &networkCatchup{}
-	require.NoError(t, c.RequestAncestors(ids.Empty, ids.Empty, missing, peer))
-
-	// (b) Once wired: the engine's catch-up signal reaches the GetAncestors wire
-	// exactly once — for the missing block, addressed to the peer that advertised
-	// its child. RED before the fix: handler is never set, calls stays 0.
-	spy := &catchupSpy{}
-	c.handler = spy
-	require.NoError(t, c.RequestAncestors(ids.Empty, ids.Empty, missing, peer))
-	require.Equal(t, 1, spy.calls, "RequestAncestors must route to requestContext — a nil wire IS the stranded-follower bug")
-	require.Equal(t, missing, spy.lastBlock)
-	require.Equal(t, peer, spy.lastFrom)
-}

chains/pchain_height_finality_test.go

@@ -1,591 +0,0 @@
-// Copyright (C) 2019-2026, Lux Industries, Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-// pchain_height_finality_test.go — the b2 load-bearing proof the prior round
-// lacked: that the node delivers the REAL P-chain epoch height to the chain
-// engine, so a K>1 quorum chain finalizes against the LIVE validator set — not
-// the frozen genesis set.
-//
-// The consensus-layer TestPChainEpochFinality_RealWiring proved the engine reads
-// the RIGHT height GIVEN a block that already exposes one; it fed a synthetic
-// block carrying PChainHeight directly, BYPASSING the boundary. The boundary —
-// where a bare plugin block yields pChainHeightOf==0 — was exactly what shipped
-// broken (set@0 = genesis). These tests drive the REAL boundary:
-//
-//	inner VM (bare block, no PChainHeight)
-//	  └─ pChainHeightVM (the b2 wrapper, backed by a real validators.State)
-//	       └─ consensus engine (real α-of-K cert finality, node BLS sources)
-//
-// and prove three properties end to end:
-//
-//	(1) pChainHeightOf(realBlock) returns the wrapper's stamped P-chain height
-//	    (NOT 0) — at BuildBlock AND after a ParseBlock round-trip of the gossiped
-//	    bytes (the determinism guarantee: every node recovers the same height).
-//	(2) K>1 FINALIZES at genesis (set@H0).
-//	(3) K>1 FINALIZES AFTER a staking change — validators that JOINED post-genesis
-//	    cast the deciding votes+stake. This is the case that STALLS on the set@0
-//	    path (the joiners are absent from the genesis set), so finalizing proves
-//	    the real height is load-bearing.
-//
-// CGO-free: the node BLS sources use the pure-Go BLS path under CGO_ENABLED=0, so
-// this runs the ACTUAL production quorum sources (blsVoteVerifier / blsVoteSigner
-// / validatorStakeSource / validatorSetRootSource) — not an ed25519 stand-in.
-package chains
-
-import (
-	"context"
-	"sync"
-	"testing"
-	"time"
-
-	consensusconfig "github.com/luxfi/consensus/config"
-	consensuschain "github.com/luxfi/consensus/engine/chain"
-	"github.com/luxfi/consensus/engine/chain/block"
-	"github.com/luxfi/crypto/bls"
-	"github.com/luxfi/ids"
-	validators "github.com/luxfi/validators"
-	"github.com/luxfi/validators/validatorstest"
-)
-
-// --- a bare inner VM whose blocks carry NO P-chain height --------------------
-
-// fakeInnerBlock is a minimal chain block: it satisfies block.Block but does NOT
-// expose PChainHeight() — exactly like the plugin VM blocks (C-Chain EVM, dexvm)
-// the node runs. Its Bytes() is its own opaque encoding; the wrapper frames a
-// P-chain height AROUND these bytes for transport.
-type fakeInnerBlock struct {
-	id        ids.ID
-	parentID  ids.ID
-	height    uint64
-	bytes     []byte
-	timestamp time.Time
-
-	mu           sync.Mutex
-	acceptCalled int
-}
-
-func (b *fakeInnerBlock) ID() ids.ID                    { return b.id }
-func (b *fakeInnerBlock) Parent() ids.ID                { return b.parentID }
-func (b *fakeInnerBlock) ParentID() ids.ID             { return b.parentID }
-func (b *fakeInnerBlock) Height() uint64               { return b.height }
-func (b *fakeInnerBlock) Timestamp() time.Time         { return b.timestamp }
-func (b *fakeInnerBlock) Status() uint8                { return 0 }
-func (b *fakeInnerBlock) Bytes() []byte                { return b.bytes }
-func (b *fakeInnerBlock) Verify(context.Context) error { return nil }
-func (b *fakeInnerBlock) Reject(context.Context) error { return nil }
-func (b *fakeInnerBlock) Accept(context.Context) error {
-	b.mu.Lock()
-	b.acceptCalled++
-	b.mu.Unlock()
-	return nil
-}
-func (b *fakeInnerBlock) accepted() int {
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	return b.acceptCalled
-}
-
-// fakeInnerVM is a BlockBuilder over fakeInnerBlocks, keyed by id and by bytes so
-// ParseBlock(bytes) reconstructs the SAME inner block on a follower. It builds one
-// block on demand (set via stage) so the test controls the proposed block.
-type fakeInnerVM struct {
-	mu       sync.Mutex
-	byID     map[ids.ID]*fakeInnerBlock
-	byBytes  map[string]*fakeInnerBlock
-	staged   *fakeInnerBlock // returned by the next BuildBlock
-	lastAcc  ids.ID
-}
-
-func newFakeInnerVM() *fakeInnerVM {
-	return &fakeInnerVM{
-		byID:    make(map[ids.ID]*fakeInnerBlock),
-		byBytes: make(map[string]*fakeInnerBlock),
-	}
-}
-
-func (vm *fakeInnerVM) register(b *fakeInnerBlock) {
-	vm.mu.Lock()
-	vm.byID[b.id] = b
-	vm.byBytes[string(b.bytes)] = b
-	vm.mu.Unlock()
-}
-
-// stage sets the block the next BuildBlock returns (and registers it for Get/Parse).
-func (vm *fakeInnerVM) stage(b *fakeInnerBlock) {
-	vm.register(b)
-	vm.mu.Lock()
-	vm.staged = b
-	vm.mu.Unlock()
-}
-
-func (vm *fakeInnerVM) BuildBlock(context.Context) (block.Block, error) {
-	vm.mu.Lock()
-	defer vm.mu.Unlock()
-	return vm.staged, nil
-}
-
-func (vm *fakeInnerVM) ParseBlock(_ context.Context, b []byte) (block.Block, error) {
-	vm.mu.Lock()
-	defer vm.mu.Unlock()
-	if blk, ok := vm.byBytes[string(b)]; ok {
-		return blk, nil
-	}
-	// Unknown bytes: synthesize a block so a follower can still parse. Real VMs
-	// decode deterministically; the test pre-registers every block it gossips, so
-	// this path is only a safety net.
-	return nil, errUnknownInnerBytes
-}
-
-func (vm *fakeInnerVM) GetBlock(_ context.Context, id ids.ID) (block.Block, error) {
-	vm.mu.Lock()
-	defer vm.mu.Unlock()
-	if blk, ok := vm.byID[id]; ok {
-		return blk, nil
-	}
-	return nil, errUnknownInnerBytes
-}
-
-func (vm *fakeInnerVM) LastAccepted(context.Context) (ids.ID, error) {
-	vm.mu.Lock()
-	defer vm.mu.Unlock()
-	return vm.lastAcc, nil
-}
-
-func (vm *fakeInnerVM) SetPreference(_ context.Context, id ids.ID) error {
-	vm.mu.Lock()
-	vm.lastAcc = id
-	vm.mu.Unlock()
-	return nil
-}
-
-var errUnknownInnerBytes = errInnerBytes{}
-
-type errInnerBytes struct{}
-
-func (errInnerBytes) Error() string { return "fakeInnerVM: unknown block bytes" }
-
-// --- BLS validator material (pure-Go BLS under CGO_ENABLED=0) ----------------
-
-type blsValidator struct {
-	nodeID ids.NodeID
-	sk     *bls.SecretKey
-	pkComp []byte
-	light  uint64
-}
-
-func newBLSValidator(t *testing.T, weight uint64) blsValidator {
-	t.Helper()
-	sk, err := bls.NewSecretKey()
-	if err != nil {
-		t.Fatalf("bls.NewSecretKey: %v", err)
-	}
-	return blsValidator{
-		nodeID: ids.GenerateTestNodeID(),
-		sk:     sk,
-		pkComp: bls.PublicKeyToCompressedBytes(sk.PublicKey()),
-		light:  weight,
-	}
-}
-
-func (v blsValidator) out() *validators.GetValidatorOutput {
-	return &validators.GetValidatorOutput{
-		NodeID:    v.nodeID,
-		PublicKey: v.pkComp,
-		Light:     v.light,
-		Weight:    v.light,
-	}
-}
-
-// stateByHeight builds a height-indexed validators.State reporting the given sets
-// per height (empty for unknown heights / wrong net), with GetCurrentHeight fixed
-// to `current` so the wrapper stamps that height onto built blocks.
-func stateByHeight(netID ids.ID, current uint64, byHeight map[uint64][]blsValidator) *validatorstest.TestState {
-	s := validatorstest.NewTestState()
-	s.GetCurrentHeightF = func(context.Context) (uint64, error) { return current, nil }
-	s.GetValidatorSetF = func(_ context.Context, height uint64, gotNet ids.ID) (map[ids.NodeID]*validators.GetValidatorOutput, error) {
-		if gotNet != netID {
-			return map[ids.NodeID]*validators.GetValidatorOutput{}, nil
-		}
-		out := make(map[ids.NodeID]*validators.GetValidatorOutput)
-		for _, v := range byHeight[height] {
-			out[v.nodeID] = v.out()
-		}
-		return out, nil
-	}
-	return s
-}
-
-// --- a recording cert gossiper (engine CertGossiper) -------------------------
-
-type recordingCertGossiper struct {
-	mu    sync.Mutex
-	certs [][]byte
-}
-
-func (g *recordingCertGossiper) GossipCert(_ ids.ID, _ ids.ID, certBytes []byte) error {
-	g.mu.Lock()
-	g.certs = append(g.certs, append([]byte(nil), certBytes...))
-	g.mu.Unlock()
-	return nil
-}
-
-func (g *recordingCertGossiper) count() int {
-	g.mu.Lock()
-	defer g.mu.Unlock()
-	return len(g.certs)
-}
-
-var _ consensuschain.CertGossiper = (*recordingCertGossiper)(nil)
-
-// --- helpers -----------------------------------------------------------------
-
-func params5() consensusconfig.Parameters {
-	return consensusconfig.Parameters{K: 5, AlphaPreference: 3, AlphaConfidence: 3, Beta: 2}
-}
-
-func waitForCond(d time.Duration, cond func() bool) bool {
-	deadline := time.Now().Add(d)
-	for time.Now().Before(deadline) {
-		if cond() {
-			return true
-		}
-		time.Sleep(5 * time.Millisecond)
-	}
-	return cond()
-}
-
-// signBLSVote produces validator v's signed accept Vote for a position (the same
-// canonical message the node's blsVoteSigner/Verifier use).
-func signBLSVote(t *testing.T, v blsValidator, pos consensuschain.VotePosition) consensuschain.Vote {
-	t.Helper()
-	sig, err := v.sk.Sign(consensuschain.CanonicalVoteMessage(pos))
-	if err != nil {
-		t.Fatalf("sign vote: %v", err)
-	}
-	return consensuschain.Vote{
-		BlockID:   pos.BlockID,
-		NodeID:    v.nodeID,
-		Accept:    true,
-		SignedAt:  time.Now(),
-		Signature: bls.SignatureToBytes(sig),
-		ParentID:  pos.ParentID,
-		Round:     pos.Round,
-	}
-}
-
-// quorumEngineFixture wires a real consensus engine with the node's production
-// BLS quorum sources, all height-pinned to a height-indexed validators.State,
-// driving blocks through the b2 pChainHeightVM wrapper over a bare inner VM.
-type quorumEngineFixture struct {
-	engine   *consensuschain.Transitive
-	wrapper  *pChainHeightVM
-	inner    *fakeInnerVM
-	chainID  ids.ID
-	netID    ids.ID
-	proposer blsValidator
-	certs    *recordingCertGossiper
-}
-
-func newQuorumEngineFixture(t *testing.T, netID ids.ID, state validators.State, proposer blsValidator, byHeight map[uint64][]blsValidator) *quorumEngineFixture {
-	t.Helper()
-	inner := newFakeInnerVM()
-	wrapper := newPChainHeightVM(inner, state, netID)
-
-	chainID := ids.GenerateTestID()
-	certs := &recordingCertGossiper{}
-
-	vdrState := state
-	engine := consensuschain.NewWithConfig(
-		consensuschain.Config{Params: params5(), VM: wrapper},
-		consensuschain.WithQuorumCert(chainID, proposer.nodeID, newBLSVoteVerifier(vdrState, netID), certs, newBLSVoteSigner(proposer.sk)),
-		consensuschain.WithStakeWeighting(newValidatorStakeSource(vdrState, netID)),
-		consensuschain.WithValidatorSetRoot(newValidatorSetRootSource(vdrState, netID)),
-	)
-	if err := engine.Start(context.Background(), true); err != nil {
-		t.Fatalf("engine.Start: %v", err)
-	}
-	t.Cleanup(func() { _ = engine.Stop(context.Background()) })
-
-	return &quorumEngineFixture{
-		engine:   engine,
-		wrapper:  wrapper,
-		inner:    inner,
-		chainID:  chainID,
-		netID:    netID,
-		proposer: proposer,
-		certs:    certs,
-	}
-}
-
-// proposeViaWrapper builds the staged inner block THROUGH the wrapper (stamping
-// the live P-chain height), tracks it as the engine's own verified proposal with
-// the wrapper-delivered epoch, records the proposer's self-vote, and returns the
-// wrapped block + the canonical vote position followers must sign.
-func (f *quorumEngineFixture) proposeViaWrapper(t *testing.T, inner *fakeInnerBlock) (block.Block, consensuschain.VotePosition) {
-	t.Helper()
-	f.inner.stage(inner)
-	wrapped, err := f.wrapper.BuildBlock(context.Background())
-	if err != nil {
-		t.Fatalf("wrapper.BuildBlock: %v", err)
-	}
-	pos := f.engine.TrackOwnProposalForTest(context.Background(), wrapped, 0)
-	return wrapped, pos
-}
-
-// newFakeInner is a small constructor for an inner block at value height h with a
-// unique opaque encoding (tag-derived, so byBytes keys never collide).
-func newFakeInner(h uint64, parent ids.ID, tag string) *fakeInnerBlock {
-	return &fakeInnerBlock{
-		id:        ids.GenerateTestID(),
-		parentID:  parent,
-		height:    h,
-		bytes:     []byte("inner:" + tag),
-		timestamp: time.Now(),
-	}
-}
-
-// --- (1) the boundary delivers the REAL height (not 0), build + parse ---------
-
-// TestPChainHeightVM_DeliversRealHeight is the direct b2 boundary proof: the
-// wrapper stamps the proposer's live P-chain height onto the block the engine
-// sees, so pChainHeightOf(realBlock) returns that height — NOT 0 — at BuildBlock,
-// AND a follower recovers the IDENTICAL height by parsing the gossiped bytes (the
-// determinism guarantee H rides the bytes, never recomputed from a skewing view).
-//
-// This is the assertion the whole fix turns on. On the broken path
-// pChainHeightOf(any real plugin block)==0 → set@0 (genesis) forever.
-func TestPChainHeightVM_DeliversRealHeight(t *testing.T) {
-	const epoch = uint64(7) // the live P-chain height the proposer stamps
-	netID := ids.GenerateTestID()
-	v := newBLSValidator(t, 20)
-	// A state whose GetCurrentHeight is 7 (so BuildBlock stamps 7); the set content
-	// is irrelevant to the stamping itself, but we register it at 7 for symmetry.
-	state := stateByHeight(netID, epoch, map[uint64][]blsValidator{epoch: {v}})
-	wrapper := newPChainHeightVM(newFakeInnerVM(), state, netID)
-
-	inner := newFakeInner(10_000_000, ids.Empty, "real-height") // value height races ahead
-	wrapper.inner.(*fakeInnerVM).stage(inner)
-
-	wrapped, err := wrapper.BuildBlock(context.Background())
-	if err != nil {
-		t.Fatalf("BuildBlock: %v", err)
-	}
-
-	// (1a) the engine's boundary read on the BUILT block returns the stamped height.
-	if got := consensuschain.PChainHeightOfForTest(wrapped); got != epoch {
-		t.Fatalf("pChainHeightOf(built block) = %d, want %d — the boundary still delivers the wrong height "+
-			"(0 would mean the genesis-set freeze the b2 fix removes)", got, epoch)
-	}
-	// Sanity: the inner block itself exposes no PChainHeight, so without the wrapper
-	// the engine would read 0. This pins WHY the wrapper is load-bearing.
-	if got := consensuschain.PChainHeightOfForTest(inner); got != 0 {
-		t.Fatalf("bare inner block must expose no P-chain height (pChainHeightOf=0), got %d", got)
-	}
-
-	// (1b) determinism: a follower parsing the GOSSIPED bytes recovers the same H.
-	parsed, err := wrapper.ParseBlock(context.Background(), wrapped.Bytes())
-	if err != nil {
-		t.Fatalf("ParseBlock(gossiped bytes): %v", err)
-	}
-	if got := consensuschain.PChainHeightOfForTest(parsed); got != epoch {
-		t.Fatalf("pChainHeightOf(parsed block) = %d, want %d — a follower recomputed/lost the height; "+
-			"finality would stall on a dynamic set (worse than the genesis fallback)", got, epoch)
-	}
-	if parsed.ID() != wrapped.ID() {
-		t.Fatalf("parsed block ID %s != built block ID %s — the inner identity must be preserved across the envelope", parsed.ID(), wrapped.ID())
-	}
-}
-
-// --- (2) K>1 finalizes at genesis (set@H0) -----------------------------------
-
-// TestPChainHeightVM_FinalizesAtGenesis proves the fix UNBRICKS finality in the
-// base case: a K>1 quorum chain whose validator set is the genesis set (current
-// P-chain height 0) finalizes through the real BLS quorum sources. This is the
-// safe floor the genesis fallback guarantees — even here the height is delivered
-// honestly (0), and the set@0 is non-empty so a ⅔ quorum finalizes.
-func TestPChainHeightVM_FinalizesAtGenesis(t *testing.T) {
-	const genesis = uint64(0)
-	netID := constantsPrimaryNetworkID()
-
-	g := make([]blsValidator, 5)
-	for i := range g {
-		g[i] = newBLSValidator(t, 20) // equal stake, total 100
-	}
-	state := stateByHeight(netID, genesis, map[uint64][]blsValidator{genesis: g})
-
-	f := newQuorumEngineFixture(t, netID, state, g[0], map[uint64][]blsValidator{genesis: g})
-
-	inner := newFakeInner(42, ids.Empty, "genesis-finalize") // value height advanced past genesis
-	wrapped, pos := f.proposeViaWrapper(t, inner)
-
-	// The block was stamped at the genesis height (0); the position binds set@0.
-	if got := consensuschain.PChainHeightOfForTest(wrapped); got != genesis {
-		t.Fatalf("expected genesis stamp %d, got %d", genesis, got)
-	}
-	if pos.ValidatorSetRoot == ids.Empty {
-		t.Fatal("genesis set-root must be non-Empty (the genesis set is non-empty)")
-	}
-
-	// proposer g[0] self-voted; drive 3 more signed accepts → 4/5 = 80/100 stake > ⅔.
-	f.engine.ReceiveVote(signBLSVote(t, g[1], pos))
-	f.engine.ReceiveVote(signBLSVote(t, g[2], pos))
-	f.engine.ReceiveVote(signBLSVote(t, g[3], pos))
-
-	if !waitForCond(2*time.Second, func() bool { return inner.accepted() == 1 }) {
-		t.Fatalf("UNBRICK: a K>1 block must finalize against the genesis set (VM.Accept=%d)", inner.accepted())
-	}
-	if f.certs.count() == 0 {
-		t.Fatal("a verified quorum cert must be assembled + gossiped at finality")
-	}
-}
-
-// --- (3) K>1 finalizes AFTER a staking change (THE b2 proof) ------------------
-
-// TestPChainHeightVM_FinalizesAfterStakingChange is the load-bearing b2 proof:
-// validators that JOINED after genesis cast the deciding votes + stake, and the
-// block finalizes — which is IMPOSSIBLE on the broken set@0 path, where the
-// joiners are absent from the genesis set so their votes are dropped and their
-// stake is uncounted.
-//
-// The set@epoch (height 7) holds {g0, j1, j2, j3, j4}: only g0 overlaps genesis;
-// j1..j4 JOINED at 7. The genesis set@0 holds five DIFFERENT validators with only
-// g0 in common. A 4-voter cert {g0, j1, j2, j3} = 80/100 stake-at-7 > ⅔.
-//
-//   - With the b2 fix: the block is stamped 7, the verifier resolves j1..j3 at
-//     set@7 (present) and the ⅔ tally is measured at 7 → the cert verifies →
-//     FINALIZES.
-//   - On the broken set@0 path: j1..j3 are unknown at height 0 → their signed
-//     votes are dropped → only g0 (20/100) verifies < ⅔ → STALLS FOREVER.
-//
-// The test asserts BOTH directly: (a) the block finalizes, and (b) the production
-// verifier itself rejects a joiner's vote at height 0 but accepts it at height 7 —
-// pinning the exact mechanism that would stall the frozen-set path.
-func TestPChainHeightVM_FinalizesAfterStakingChange(t *testing.T) {
-	const (
-		genesis = uint64(0)
-		epoch   = uint64(7) // staking change landed here; current P-chain height = 7
-	)
-	netID := constantsPrimaryNetworkID()
-
-	// g0 is a validator present at BOTH epochs (so the fixture proposer key resolves
-	// at the stamped epoch). j1..j4 JOINED at epoch 7. gen1..gen4 are the OTHER four
-	// genesis validators (present only at 0) — they make set@0 a genuinely different
-	// set so "the joiners decide" is unambiguous.
-	g0 := newBLSValidator(t, 20)
-	j1 := newBLSValidator(t, 20)
-	j2 := newBLSValidator(t, 20)
-	j3 := newBLSValidator(t, 20)
-	j4 := newBLSValidator(t, 20)
-	gen1 := newBLSValidator(t, 20)
-	gen2 := newBLSValidator(t, 20)
-	gen3 := newBLSValidator(t, 20)
-	gen4 := newBLSValidator(t, 20)
-
-	genesisSet := []blsValidator{g0, gen1, gen2, gen3, gen4} // total 100 at height 0
-	epochSet := []blsValidator{g0, j1, j2, j3, j4}           // total 100 at height 7
-
-	state := stateByHeight(netID, epoch, map[uint64][]blsValidator{
-		genesis: genesisSet,
-		epoch:   epochSet,
-	})
-
-	// (b) PIN THE MECHANISM that makes the frozen path stall: the production verifier
-	// rejects a joiner at height 0 (frozen/genesis) and accepts it at height 7.
-	verifier := newBLSVoteVerifier(state, netID)
-	// Build a position to sign (any height-7-bound position works for this probe).
-	probeBlk := newFakeInner(123, ids.Empty, "probe")
-	probeWrapper := newPChainHeightVM(newFakeInnerVM(), state, netID)
-	probeWrapper.inner.(*fakeInnerVM).stage(probeBlk)
-	probeWrapped, _ := probeWrapper.BuildBlock(context.Background())
-	probePos := consensuschain.VotePosition{
-		ChainID:          ids.GenerateTestID(),
-		Height:           probeWrapped.Height(),
-		BlockID:          probeWrapped.ID(),
-		ParentID:         ids.Empty,
-		ValidatorSetRoot: newValidatorSetRootSource(state, netID).ValidatorSetRoot(epoch),
-	}
-	probeMsg := consensuschain.CanonicalVoteMessage(probePos)
-	j1Sig, err := j1.sk.Sign(probeMsg)
-	if err != nil {
-		t.Fatalf("sign probe: %v", err)
-	}
-	j1SigBytes := bls.SignatureToBytes(j1Sig)
-	if verifier.VerifyVote(j1.nodeID, probeMsg, j1SigBytes, genesis) {
-		t.Fatal("frozen-path mechanism broken: a post-genesis joiner must NOT verify at height 0 " +
-			"(if it does, the genesis-set path would not actually stall and the test is vacuous)")
-	}
-	if !verifier.VerifyVote(j1.nodeID, probeMsg, j1SigBytes, epoch) {
-		t.Fatal("a joiner present at the epoch MUST verify at the epoch height — the b2 read is broken")
-	}
-
-	// (a) THE END-TO-END FINALIZATION: drive the real engine with the joiners.
-	f := newQuorumEngineFixture(t, netID, state, g0, map[uint64][]blsValidator{
-		genesis: genesisSet,
-		epoch:   epochSet,
-	})
-
-	inner := newFakeInner(10_000_000, ids.Empty, "post-staking-change") // value height far ahead
-	wrapped, pos := f.proposeViaWrapper(t, inner)
-
-	// The block carries the LIVE epoch height (7), and the position binds set@7.
-	if got := consensuschain.PChainHeightOfForTest(wrapped); got != epoch {
-		t.Fatalf("block must carry the live epoch height %d, got %d", epoch, got)
-	}
-	if pos.ValidatorSetRoot != newValidatorSetRootSource(state, netID).ValidatorSetRoot(epoch) {
-		t.Fatal("position must bind the set-root at the epoch height (set@7), not another height")
-	}
-	if pos.ValidatorSetRoot == newValidatorSetRootSource(state, netID).ValidatorSetRoot(genesis) {
-		t.Fatal("test vacuous: set@7 root must differ from set@0 root (the sets must genuinely differ)")
-	}
-
-	// proposer g0 self-voted; the JOINERS j1,j2,j3 cast the deciding votes.
-	// 4 distinct accepts {g0,j1,j2,j3} = 80/100 stake-at-7 > ⅔ → MUST finalize.
-	f.engine.ReceiveVote(signBLSVote(t, j1, pos))
-	f.engine.ReceiveVote(signBLSVote(t, j2, pos))
-	f.engine.ReceiveVote(signBLSVote(t, j3, pos))
-
-	if !waitForCond(3*time.Second, func() bool { return inner.accepted() == 1 }) {
-		t.Fatalf("b2: a block whose ⅔ quorum is post-genesis JOINERS must finalize against the LIVE set@%d "+
-			"(VM.Accept=%d). On the broken set@0 path the joiners are unknown → votes dropped → permanent stall.",
-			epoch, inner.accepted())
-	}
-
-	// The gossiped cert must verify stake-weighted AT THE EPOCH, and must FAIL at
-	// genesis (where the joiners are absent) — proving the height is load-bearing.
-	if f.certs.count() == 0 {
-		t.Fatal("a verified quorum cert must be assembled + gossiped at finality")
-	}
-	f.certs.mu.Lock()
-	lastCert := f.certs.certs[len(f.certs.certs)-1]
-	f.certs.mu.Unlock()
-	cert, err := consensuschain.UnmarshalQuorumCert(lastCert)
-	if err != nil {
-		t.Fatalf("decode gossiped cert: %v", err)
-	}
-	stake := newValidatorStakeSource(state, netID)
-	if err := cert.VerifyWeighted(verifier, stake, epoch); err != nil {
-		t.Fatalf("cert must verify stake-weighted at the epoch height %d: %v", epoch, err)
-	}
-	if err := cert.VerifyWeighted(verifier, stake, genesis); err == nil {
-		t.Fatal("b2: cert must NOT verify at the genesis height (joiners absent / below ⅔ there) — " +
-			"if it does, the epoch height is not actually being used")
-	}
-	// The cert must contain at least one joiner — proving a post-genesis validator's
-	// vote was counted (the exact case the frozen-set path drops).
-	var hasJoiner bool
-	for i := range cert.Votes {
-		if cert.Votes[i].NodeID == j1.nodeID || cert.Votes[i].NodeID == j2.nodeID || cert.Votes[i].NodeID == j3.nodeID {
-			hasJoiner = true
-			break
-		}
-	}
-	if !hasJoiner {
-		t.Fatal("the finality cert must include a post-genesis joiner's vote (it was the deciding quorum)")
-	}
-}
-
-// constantsPrimaryNetworkID returns the primary-network ID the node uses for
-// native-chain validator lookups (ids.Empty). Declared here so the test reads the
-// SAME net the production wiring resolves native chains against, without importing
-// the constants package for one value.
-func constantsPrimaryNetworkID() ids.ID { return ids.Empty }

chains/pchain_height_hardening_test.go

@@ -1,327 +0,0 @@
-// Copyright (C) 2019-2026, Lux Industries, Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-// pchain_height_hardening_test.go — the receive-side hardening proofs for the b2
-// transport wrapper (Red round): the three node-layer fixes that close the
-// receive-side gaps the build-side stamping left open.
-//
-//	(HIGH-1, predicate b — RECENCY) ParseBlock rejects a wrapped block whose
-//	stamped P-chain epoch exceeds this node's live P-chain height by more than the
-//	recency slack (an absurd-future epoch). Honest forward skew within the slack —
-//	including a legitimate P-chain advance during a staking change — still parses.
-//
-//	(MEDIUM-3 — MAP DoS) the heights map is bounded: it plateaus at the finalized
-//	watermark under mass parse+accept, and a still-pending block's epoch is never
-//	evicted by the watermark prune. A sustained unverified-parse flood is capped.
-//
-//	(LOW-2 — FRAME DISCRIMINATOR) a raw inner block whose first bytes coincidentally
-//	equal the 4-byte frame magic is NOT mis-parsed as framed: the inner re-parse of
-//	the framed payload fails, so ParseBlock falls back to a raw whole-block parse.
-package chains
-
-import (
-	"context"
-	"testing"
-
-	"github.com/luxfi/ids"
-)
-
-// --- (HIGH-1 b) RECENCY: reject absurd-future epoch ---------------------------
-
-// TestParseBlock_RejectsFarFutureEpoch is the receive-side upper-bound proof. A
-// node whose live P-chain height is 100 parses a wrapped block stamped at epoch
-// 10_000 (far beyond 100 + slack). ParseBlock REJECTS it fail-closed — the block
-// is dropped, never returned to be tracked. This stops a Byzantine proposer from
-// pinning a block to an epoch the network has not reached.
-func TestParseBlock_RejectsFarFutureEpoch(t *testing.T) {
-	const localH = uint64(100)
-	netID := ids.GenerateTestID()
-	v := newBLSValidator(t, 20)
-	state := stateByHeight(netID, localH, map[uint64][]blsValidator{localH: {v}})
-	wrapper := newPChainHeightVM(newFakeInnerVM(), state, netID)
-
-	// Craft a frame stamped at an absurd-future epoch, with a registered inner block
-	// so the ONLY reason to reject is the recency bound (not an inner parse failure).
-	inner := newFakeInner(5_000_000, ids.Empty, "far-future-epoch")
-	wrapper.inner.(*fakeInnerVM).register(inner)
-	framed := wrapPChainHeight(inner.Bytes(), localH+pChainHeightRecencySlack+1) // just past the bound
-
-	if _, err := wrapper.ParseBlock(context.Background(), framed); err != errPChainHeightNotRecent {
-		t.Fatalf("ParseBlock(far-future epoch) err = %v, want errPChainHeightNotRecent — an absurd-future "+
-			"P-chain epoch must be rejected fail-closed so a follower never tracks a block at an unreachable epoch", err)
-	}
-}
-
-// TestParseBlock_AcceptsEpochWithinSlack proves the recency gate admits HONEST
-// forward skew: a follower at local P-chain height 100 parses a block stamped at
-// 100 + slack (the boundary — the largest legitimate skew, e.g. a proposer that
-// saw P-chain blocks this follower has not yet synced during a staking change).
-// The block parses and carries its real epoch.
-func TestParseBlock_AcceptsEpochWithinSlack(t *testing.T) {
-	const localH = uint64(100)
-	netID := ids.GenerateTestID()
-	v := newBLSValidator(t, 20)
-	state := stateByHeight(netID, localH, map[uint64][]blsValidator{localH: {v}})
-	wrapper := newPChainHeightVM(newFakeInnerVM(), state, netID)
-
-	inner := newFakeInner(5_000_000, ids.Empty, "within-slack-epoch")
-	wrapper.inner.(*fakeInnerVM).register(inner)
-	atBound := localH + pChainHeightRecencySlack // exactly at the bound — must be admitted
-	framed := wrapPChainHeight(inner.Bytes(), atBound)
-
-	parsed, err := wrapper.ParseBlock(context.Background(), framed)
-	if err != nil {
-		t.Fatalf("ParseBlock(epoch within slack) err = %v, want nil — honest forward skew up to the slack "+
-			"(a real P-chain advance during a staking change) must still parse", err)
-	}
-	if got := parsed.(*pChainHeightBlock).PChainHeight(); got != atBound {
-		t.Fatalf("parsed epoch = %d, want %d — the wrapper must carry the real (recent) epoch unchanged", got, atBound)
-	}
-}
-
-// TestParseBlock_RecencyDisabledWithoutState proves the fail-soft: a wrapper with
-// no P-chain view (nil state, current height 0) cannot bound recency, so it admits
-// the block — the verifier still fails closed on an unresolvable future epoch at
-// set-resolution time. (Production installs the wrapper only on K>1 chains the
-// manager guards to have a live state, so this is a defensive path, not a mode.)
-func TestParseBlock_RecencyDisabledWithoutState(t *testing.T) {
-	wrapper := newPChainHeightVM(newFakeInnerVM(), nil, ids.GenerateTestID())
-	inner := newFakeInner(7, ids.Empty, "no-state-epoch")
-	wrapper.inner.(*fakeInnerVM).register(inner)
-	framed := wrapPChainHeight(inner.Bytes(), 9_999_999) // would be far-future if state existed
-
-	if _, err := wrapper.ParseBlock(context.Background(), framed); err != nil {
-		t.Fatalf("ParseBlock with nil state must admit (recency unenforceable, verifier fails closed downstream): %v", err)
-	}
-}
-
-// --- (LOW-2) FRAME DISCRIMINATOR: a magic-colliding raw block is NOT mis-framed -
-
-// TestParseBlock_MagicCollisionParsesRaw is the discriminator proof. A raw inner
-// block whose Bytes() coincidentally BEGIN with the 4-byte frame magic (the
-// 2^-32 collision the raw-hash-prefix VMs hit) must parse as a RAW block, not be
-// mis-classified as framed (which used to fail the inner decode → bootstrap stall).
-// The inner re-parse of the framed payload fails (the payload is the block minus
-// its first 12 bytes — not a valid inner block), so ParseBlock falls back to a raw
-// whole-block parse.
-func TestParseBlock_MagicCollisionParsesRaw(t *testing.T) {
-	netID := ids.GenerateTestID()
-	v := newBLSValidator(t, 20)
-	state := stateByHeight(netID, 50, map[uint64][]blsValidator{50: {v}})
-	inner := newFakeInnerVM()
-	wrapper := newPChainHeightVM(inner, state, netID)
-
-	// A raw block whose bytes START with the exact magic prefix, then arbitrary
-	// payload. Length is >= the header width so the prefix check would treat it as a
-	// candidate frame. Crucially, bytes[12:] is NOT a registered inner block, so the
-	// framed-payload re-parse fails and the whole-bytes parse must be used.
-	raw := &fakeInnerBlock{
-		id:       ids.GenerateTestID(),
-		parentID: ids.Empty,
-		height:   1234,
-		bytes: append(append([]byte{}, pChainHeightMagic[:]...),
-			[]byte("RAW-BLOCK-COLLIDES-WITH-MAGIC-PREFIX-payload")...),
-	}
-	inner.register(raw) // registers byBytes[whole] = raw; bytes[12:] stays UNregistered
-
-	parsed, err := wrapper.ParseBlock(context.Background(), raw.bytes)
-	if err != nil {
-		t.Fatalf("ParseBlock(magic-colliding raw block) err = %v, want nil — a raw block whose prefix collides "+
-			"with the frame magic must parse as RAW (the old behavior mis-framed it → inner decode fail → bootstrap stall)", err)
-	}
-	if parsed.ID() != raw.id {
-		t.Fatalf("parsed block ID %s != raw block ID %s — the colliding block must decode to the SAME raw inner block", parsed.ID(), raw.id)
-	}
-	// A raw block falls back to the genesis-set epoch (0): it was NOT framed, so no
-	// proposer epoch was carried.
-	if got := parsed.(*pChainHeightBlock).PChainHeight(); got != 0 {
-		t.Fatalf("magic-colliding raw block epoch = %d, want 0 — it must NOT be read as a framed epoch", got)
-	}
-	// Its re-gossip bytes must be the raw passthrough (the inner bytes verbatim), not
-	// re-framed — so a follower of THIS node also sees it raw.
-	if string(parsed.Bytes()) != string(raw.bytes) {
-		t.Fatal("a raw colliding block must re-gossip its inner bytes verbatim (passthrough), not a new frame")
-	}
-}
-
-// TestParseBlock_GenuineFrameStillParses guards the discriminator's other side: a
-// GENUINE frame (whose payload IS a valid inner block) still parses as framed and
-// recovers the stamped epoch. This pins that the collision fix did not break the
-// normal framed path.
-func TestParseBlock_GenuineFrameStillParses(t *testing.T) {
-	netID := ids.GenerateTestID()
-	v := newBLSValidator(t, 20)
-	const epoch = uint64(33)
-	state := stateByHeight(netID, epoch, map[uint64][]blsValidator{epoch: {v}})
-	inner := newFakeInnerVM()
-	wrapper := newPChainHeightVM(inner, state, netID)
-
-	innerBlk := newFakeInner(9000, ids.Empty, "genuine-frame")
-	inner.register(innerBlk)
-	framed := wrapPChainHeight(innerBlk.Bytes(), epoch)
-
-	parsed, err := wrapper.ParseBlock(context.Background(), framed)
-	if err != nil {
-		t.Fatalf("ParseBlock(genuine frame) err = %v, want nil", err)
-	}
-	if parsed.ID() != innerBlk.ID() {
-		t.Fatalf("genuine frame parsed ID %s != inner ID %s", parsed.ID(), innerBlk.ID())
-	}
-	if got := parsed.(*pChainHeightBlock).PChainHeight(); got != epoch {
-		t.Fatalf("genuine frame epoch = %d, want %d", got, epoch)
-	}
-}
-
-// --- (MEDIUM-3) MAP BOUND: plateau at watermark, pending never evicted --------
-
-// TestHeightsMap_PlateausAtWatermark is the DoS bound proof. We parse a long run
-// of distinct framed blocks (each adds a heights entry) and ACCEPT them in order;
-// each Accept advances the finalized-height watermark and prunes entries at/below
-// it. The map plateaus — it does NOT grow without bound as the chain advances.
-func TestHeightsMap_PlateausAtWatermark(t *testing.T) {
-	netID := ids.GenerateTestID()
-	v := newBLSValidator(t, 20)
-	const epoch = uint64(10)
-	state := stateByHeight(netID, epoch, map[uint64][]blsValidator{epoch: {v}})
-	inner := newFakeInnerVM()
-	wrapper := newPChainHeightVM(inner, state, netID)
-
-	const n = 500
-	var lastParsed *pChainHeightBlock
-	for h := uint64(1); h <= n; h++ {
-		blk := newFakeInner(h, ids.Empty, "plateau-"+itoa(h))
-		inner.register(blk)
-		framed := wrapPChainHeight(blk.Bytes(), epoch)
-		parsed, err := wrapper.ParseBlock(context.Background(), framed)
-		if err != nil {
-			t.Fatalf("ParseBlock #%d: %v", h, err)
-		}
-		// Accept the PREVIOUS block (so the most-recent one is still "pending").
-		if lastParsed != nil {
-			if err := lastParsed.Accept(context.Background()); err != nil {
-				t.Fatalf("Accept #%d: %v", h-1, err)
-			}
-		}
-		lastParsed = parsed.(*pChainHeightBlock)
-
-		// After each accept the map must be bounded: only entries strictly above the
-		// watermark survive. We accept (h-1) blocks, so at most a tiny constant remain
-		// (the just-parsed, not-yet-accepted block, plus any equal-height entries).
-		wrapper.mu.Lock()
-		size := len(wrapper.heights)
-		wm := wrapper.finalizedHeight
-		wrapper.mu.Unlock()
-		if size > 4 { // generous constant: the pending working set, not O(n)
-			t.Fatalf("heights map grew to %d entries at height %d (watermark %d) — it must plateau at the "+
-				"finalized watermark, not accrete one permanent entry per parsed block (MEDIUM-3 DoS)", size, h, wm)
-		}
-	}
-}
-
-// TestHeightsMap_PendingNeverEvictedByWatermark proves the watermark prune NEVER
-// drops a still-pending block's epoch. We track a pending block at height 1000
-// (epoch recalled), accept a LOWER-height block (watermark advances only to that
-// lower height), and assert the pending block's epoch is still recallable. A blind
-// LRU would have dropped it; the watermark prune must not.
-func TestHeightsMap_PendingNeverEvictedByWatermark(t *testing.T) {
-	netID := ids.GenerateTestID()
-	v := newBLSValidator(t, 20)
-	const epoch = uint64(12)
-	state := stateByHeight(netID, epoch, map[uint64][]blsValidator{epoch: {v}})
-	inner := newFakeInnerVM()
-	wrapper := newPChainHeightVM(inner, state, netID)
-
-	// Pending block at a HIGH value height (1000).
-	pending := newFakeInner(1000, ids.Empty, "pending-high")
-	inner.register(pending)
-	pendingFrame := wrapPChainHeight(pending.Bytes(), epoch)
-	if _, err := wrapper.ParseBlock(context.Background(), pendingFrame); err != nil {
-		t.Fatalf("ParseBlock(pending): %v", err)
-	}
-
-	// A different block at a LOW value height (5) finalizes → watermark = 5.
-	low := newFakeInner(5, ids.Empty, "finalized-low")
-	inner.register(low)
-	lowFrame := wrapPChainHeight(low.Bytes(), epoch)
-	lowParsed, err := wrapper.ParseBlock(context.Background(), lowFrame)
-	if err != nil {
-		t.Fatalf("ParseBlock(low): %v", err)
-	}
-	if err := lowParsed.Accept(context.Background()); err != nil {
-		t.Fatalf("Accept(low): %v", err)
-	}
-
-	// The watermark advanced to 5 (the low block). The PENDING block at height 1000
-	// is strictly above the watermark, so its epoch MUST survive the prune.
-	if got, ok := wrapper.recall(pending.ID()); !ok || got != epoch {
-		t.Fatalf("pending block's epoch recall = (%d,%v), want (%d,true) — the watermark prune (wm=5) must NEVER "+
-			"evict a still-pending block at height 1000 (that would reset its epoch to 0 = re-freeze)", got, ok, epoch)
-	}
-	// And the finalized low block's entry WAS pruned (it is at/below the watermark).
-	if _, ok := wrapper.recall(low.ID()); ok {
-		t.Fatal("the finalized low block's entry should have been pruned at/below the watermark (loss-free: epoch already captured)")
-	}
-}
-
-// TestHeightsMap_FloodCappedPreservingNearTip proves the hard-cap backstop: a
-// sustained UNVERIFIED-parse flood (blocks that never finalize, so the watermark
-// never advances) cannot grow the map past the cap, AND the cap evicts
-// highest-value-height-first so the near-tip pending band survives. We seed a
-// near-tip pending entry (low height), then flood with far-future-height frames;
-// the map stays at the cap and the near-tip entry is retained.
-func TestHeightsMap_FloodCappedPreservingNearTip(t *testing.T) {
-	netID := ids.GenerateTestID()
-	v := newBLSValidator(t, 20)
-	const epoch = uint64(8)
-	// Slack must admit the flood frames' epoch; we stamp them at the current epoch so
-	// the recency gate is not what bounds them — the CAP is what we are testing.
-	state := stateByHeight(netID, epoch, map[uint64][]blsValidator{epoch: {v}})
-	inner := newFakeInnerVM()
-	wrapper := newPChainHeightVM(inner, state, netID)
-
-	// Near-tip pending block at LOW value height 1.
-	nearTip := newFakeInner(1, ids.Empty, "near-tip")
-	inner.register(nearTip)
-	if _, err := wrapper.ParseBlock(context.Background(), wrapPChainHeight(nearTip.Bytes(), epoch)); err != nil {
-		t.Fatalf("ParseBlock(near-tip): %v", err)
-	}
-
-	// Flood: cap + 200 distinct frames at FAR-future value heights (never accepted).
-	for i := 0; i < pChainHeightMapCap+200; i++ {
-		h := uint64(1_000_000 + i) // far above the near-tip height
-		blk := newFakeInner(h, ids.Empty, "flood-"+itoa(h))
-		inner.register(blk)
-		if _, err := wrapper.ParseBlock(context.Background(), wrapPChainHeight(blk.Bytes(), epoch)); err != nil {
-			t.Fatalf("ParseBlock(flood %d): %v", i, err)
-		}
-	}
-
-	wrapper.mu.Lock()
-	size := len(wrapper.heights)
-	_, nearTipKept := wrapper.heights[nearTip.ID()]
-	wrapper.mu.Unlock()
-
-	if size > pChainHeightMapCap {
-		t.Fatalf("heights map = %d entries, must be capped at %d under flood (MEDIUM-3 backstop)", size, pChainHeightMapCap)
-	}
-	if !nearTipKept {
-		t.Fatal("the near-tip pending entry (height 1) must SURVIVE the cap — eviction is highest-height-first, " +
-			"so a flood of far-future-height spam is shed before any near-tip pending block (NOT a blind LRU)")
-	}
-}
-
-// itoa is a tiny, allocation-light uint64→string for unique test tags (avoids
-// importing strconv into a hot test loop and keeps byBytes keys distinct).
-func itoa(v uint64) string {
-	if v == 0 {
-		return "0"
-	}
-	var buf [20]byte
-	i := len(buf)
-	for v > 0 {
-		i--
-		buf[i] = byte('0' + v%10)
-		v /= 10
-	}
-	return string(buf[i:])
-}

chains/pchain_height_vm.go

@@ -1,486 +0,0 @@
-// Copyright (C) 2019-2026, Lux Industries, Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-// pchain_height_vm.go — the node-layer boundary that delivers the REAL P-CHAIN
-// EPOCH HEIGHT to the consensus chain engine (the b2 wiring; the LAST
-// QUORUM_FINALITY blocker).
-//
-// THE BUG IT FIXES. The chain engine pins a block's weighted validator set to a
-// P-CHAIN height (engine/chain: pChainHeightOf → epochHeightLocked → the SINGLE
-// height the set-root commitment, the ⅔-by-stake tally, AND the per-voter pubkey
-// resolution are read at). It reads that height by asserting the VM block to a
-// `PChainHeight() uint64` (consensus block.SignedBlock). A bare VM block — every
-// block the node's plugin VMs (C-Chain EVM, dexvm, …) produce — does NOT expose
-// one, so pChainHeightOf returns 0 and the engine resolves the set at P-chain
-// height 0: the GENESIS set. That is SAFE (non-empty, identical on every node,
-// ≤ current) and UNBRICKS finality, but it FREEZES the epoch at genesis: a
-// validator that JOINED after genesis is absent from set@0, so its vote is
-// dropped and its stake is not counted — finality cannot track a DYNAMIC
-// validator set (a departed genesis majority could even collude). This is the
-// frozen-set caveat Gate D must sign away.
-//
-// THE FIX. pChainHeightVM wraps the chain's BlockBuilder (the VM the engine
-// builds/parses blocks through) and makes the block the engine sees carry the
-// proposer's P-chain epoch height — WITHOUT changing the inner VM's block format,
-// IDs, or ledger state:
-//
-//   - BuildBlock (proposer): build the inner block, then stamp the proposer's
-//     live P-chain epoch height H = max(GetCurrentHeight, parentH) (the
-//     proposervm selectChildPChainHeight rule — monotone, ≤ current). Return a
-//     pChainHeightBlock whose Bytes() are [magic|H|innerBytes] and whose
-//     PChainHeight() is H. Every other method (ID, ParentID, Height, Verify,
-//     Accept, …) delegates to the inner block — so the block's IDENTITY and the
-//     VM's state are the inner VM's, unchanged.
-//   - ParseBlock (follower): split [magic|H|innerBytes], parse the inner bytes
-//     through the inner VM, and re-attach H. Bytes WITHOUT the magic (a raw inner
-//     block from a pre-wrapper peer, GetAncestors, or genesis) parse with H=0 →
-//     the SAFE genesis-set fallback — never worse than today.
-//
-// DETERMINISM is the whole point and is why H must travel IN the gossiped bytes.
-// The engine gossips only blk.Bytes(); a follower recovers the block solely via
-// ParseBlock(those bytes). The proposer STAMPS H; every follower ADOPTS the
-// identical H from the envelope — it never recomputes H from its own (skewing)
-// current P-chain view. So every honest node derives the SAME epoch height from
-// the SAME signed block, which is the invariant the engine's cert verifier
-// requires (engine/chain HandleIncomingCert cross-checks the cert's set-root
-// against the set-root WE recompute at OUR epoch height for the block: equal H ⟹
-// equal root ⟹ the cert verifies; a post-genesis validator's vote+stake now
-// count). A build-time-only stamp would give the proposer a real H but leave
-// followers computing a DIFFERENT root from their own height → the cert is
-// dropped → finality STALLS on a dynamic set (strictly worse than the genesis
-// fallback). That is why the height is carried, not recomputed.
-//
-// This is a consensus-TRANSPORT framing (an 8-byte height + 4-byte magic prefix
-// on the gossiped bytes), NOT a chain/ledger fork: the inner VM's bytes, block
-// IDs, and execution state are byte-identical, so there is no re-genesis — only a
-// coordinated node upgrade (the whole validator set ships together).
-package chains
-
-import (
-	"context"
-	"encoding/binary"
-	"errors"
-	"sync"
-	"time"
-
-	consensuschain "github.com/luxfi/consensus/engine/chain"
-	"github.com/luxfi/consensus/engine/chain/block"
-	"github.com/luxfi/ids"
-	validators "github.com/luxfi/validators"
-)
-
-// pChainHeightMagic tags a transport-wrapped block so ParseBlock can tell a
-// wrapped block ([magic|H:8|innerBytes]) from a raw inner block (no magic →
-// H=0, the genesis-set fallback). Distinct, fixed, version-pinned: a future
-// envelope change bumps the last byte and is non-malleable. "LXP" = Lux P-chain.
-var pChainHeightMagic = [4]byte{'L', 'X', 'P', 0x01}
-
-// pChainHeightHeaderLen is the fixed transport-header width: magic(4) + height(8).
-const pChainHeightHeaderLen = 4 + 8
-
-// pChainHeightRecencySlack is the receive-side UPPER bound on how far a gossiped
-// block's stamped P-chain epoch height H may exceed THIS node's live P-chain
-// height before the block is rejected as absurd-future (HIGH-1, predicate b). The
-// proposer stamps H = its own GetCurrentHeight (the proposervm selectChildPChainHeight
-// rule, ≤ its current); a follower lagging the P-chain sees a smaller current, so
-// some forward skew is LEGITIMATE during a staking change or a gossip burst. 256
-// P-chain heights swamps any honest inter-node skew (P-chain blocks are seconds
-// apart; gossip+verify is sub-second) while still rejecting a wildly-future H. The
-// bound is a LIVENESS/DoS sanity gate, NOT the safety bound (that is the monotone
-// gate in the engine): a future H always FAILS set resolution at the verifier
-// (errUnfinalizedHeight) and never finalizes against a bogus set regardless — this
-// just fails it fast and keeps the heights map from accreting unresolvable entries.
-const pChainHeightRecencySlack = uint64(256)
-
-// pChainHeightMapCap is the hard backstop on the heights map size — the cap that
-// bounds the gossip-parse DoS (MEDIUM-3): ParseBlock runs before the engine's
-// dedup/Verify, so an attacker peer could stream distinct unverified blocks, each
-// adding a permanent entry. The map plateaus far below this in steady state (the
-// watermark prune evicts every finalized block's entry as finality advances); the
-// cap fires only under a sustained flood, and then evicts HIGHEST-chain-height
-// first — spam claims wild heights, real pending blocks cluster just above the
-// finalized watermark, so the near-tip pending band is preserved (NOT a blind LRU
-// that could drop a live block). Chosen >> any realistic pending working set.
-const pChainHeightMapCap = 4096
-
-// errPChainHeightNotRecent is returned by ParseBlock when a wrapped block's stamped
-// P-chain epoch exceeds this node's live P-chain height by more than the recency
-// slack. Returning an error fails CLOSED: HandleIncomingBlock drops the block (it
-// is never tracked or voted), which is the correct response to an absurd-future
-// epoch a follower cannot resolve a set at.
-var errPChainHeightNotRecent = errors.New("chains: gossiped block P-chain epoch height exceeds local P-chain height + recency slack (absurd-future epoch, rejected fail-closed)")
-
-// pChainHeightVM wraps a chain BlockBuilder so the block the consensus engine
-// sees carries the proposer's P-chain epoch height. It is the ONLY thing that
-// changes between the engine and the inner VM; everything else is the inner VM,
-// verbatim.
-//
-// It is installed ONLY on K>1 (quorum) chains: a K==1 chain finalizes on its
-// sole validator's self-vote with no cert and no validator-set epoch, so the
-// stamp is inert there and the wrapper is not installed (the inner VM is used
-// directly — one obvious path per mode).
-type pChainHeightVM struct {
-	inner     consensuschain.BlockBuilder
-	state     validators.State
-	networkID ids.ID
-
-	// heights memoises blockID → (stamped P-chain epoch, value-chain height) for
-	// blocks this node has built or parsed, so GetBlock can re-attach the epoch a
-	// block was stamped with (the inner VM stores only the inner bytes, which carry
-	// no epoch). Best-effort: a cache miss yields H=0 (the genesis-set fallback).
-	// GetBlock is NOT on the finality-capture path — the engine records a block's
-	// epoch the first time it BUILDS or PARSES the block (where the epoch is always
-	// present) and reads it back from its own pending-block record, never by
-	// re-fetching via GetBlock — so a miss here cannot drop a LIVE block's epoch
-	// (the consensus PendingBlock holds it, not this map).
-	//
-	// BOUNDED (MEDIUM-3): the value-chain height tagged on each entry lets onAccepted
-	// PRUNE every entry at or below the finalized-height watermark (a finalized block
-	// never needs a GetBlock epoch re-attach), so under steady finality the map
-	// plateaus at the watermark. finalizedHeight is that watermark, advanced as
-	// blocks Accept. A hard cap (pChainHeightMapCap) backstops a sustained
-	// unverified-parse flood, evicting highest-height-first to preserve the near-tip
-	// pending band. A still-PENDING block (height above the watermark) is never
-	// evicted by the watermark prune.
-	mu              sync.Mutex
-	heights         map[ids.ID]heightEntry
-	finalizedHeight uint64
-}
-
-// heightEntry records, for a remembered block, both the P-chain EPOCH it was
-// stamped with (re-attached by GetBlock) and its VALUE-CHAIN height (the prune key:
-// an entry at/below the finalized watermark is evictable).
-type heightEntry struct {
-	epoch       uint64
-	chainHeight uint64
-}
-
-// newPChainHeightVM wraps inner with P-chain-epoch-height stamping backed by the
-// height-indexed validators.State. networkID is the set the height is resolved
-// against (PrimaryNetworkID for native chains; the L1's set ID otherwise) — it is
-// recorded for symmetry with the engine's epoch reads, though GetCurrentHeight is
-// a P-chain-global height. A nil state disables stamping (BuildBlock falls back to
-// H=0): callers install this ONLY for K>1 chains, which the manager already
-// guards to have a live height-indexed state, so the nil path is a defensive
-// fail-soft, not a runtime mode.
-func newPChainHeightVM(inner consensuschain.BlockBuilder, state validators.State, networkID ids.ID) *pChainHeightVM {
-	return &pChainHeightVM{
-		inner:     inner,
-		state:     state,
-		networkID: networkID,
-		heights:   make(map[ids.ID]heightEntry),
-	}
-}
-
-var _ consensuschain.BlockBuilder = (*pChainHeightVM)(nil)
-
-// remember records the epoch a block (at value-chain height chainHeight) was
-// stamped with so GetBlock can re-attach it. BOUNDED (MEDIUM-3): the map is pruned
-// against the finalized-height watermark by onAccepted, so it plateaus under steady
-// finality; remember additionally enforces the hard cap as a flood backstop. The
-// chainHeight is the prune key.
-func (vm *pChainHeightVM) remember(id ids.ID, epoch, chainHeight uint64) {
-	vm.mu.Lock()
-	defer vm.mu.Unlock()
-	vm.heights[id] = heightEntry{epoch: epoch, chainHeight: chainHeight}
-	vm.enforceCapLocked()
-}
-
-func (vm *pChainHeightVM) recall(id ids.ID) (uint64, bool) {
-	vm.mu.Lock()
-	e, ok := vm.heights[id]
-	vm.mu.Unlock()
-	return e.epoch, ok
-}
-
-// onAccepted advances the finalized-height watermark to acceptedHeight and PRUNES
-// every remembered entry at or below it (MEDIUM-3). A finalized block's epoch is
-// already captured in the engine's records and will never be re-attached via
-// GetBlock, so dropping its entry is loss-free — and a still-PENDING block (height
-// strictly above the watermark) is NEVER evicted by this prune, so its GetBlock
-// epoch survives. Called from the wrapped block's Accept (the block tells its VM
-// the height at which it finalized). Idempotent and monotone: a re-accept or an
-// out-of-order lower height never lowers the watermark.
-func (vm *pChainHeightVM) onAccepted(acceptedHeight uint64) {
-	vm.mu.Lock()
-	defer vm.mu.Unlock()
-	if acceptedHeight > vm.finalizedHeight {
-		vm.finalizedHeight = acceptedHeight
-	}
-	for id, e := range vm.heights {
-		if e.chainHeight <= vm.finalizedHeight {
-			delete(vm.heights, id)
-		}
-	}
-}
-
-// enforceCapLocked is the flood backstop: if the map exceeds the hard cap, evict
-// the entry with the HIGHEST value-chain height. Real pending blocks cluster just
-// above the finalized watermark (the next few heights); an unverified-parse flood
-// claims arbitrary, typically far-future heights — so evicting highest-first sheds
-// spam while preserving the near-tip pending band (NOT a blind LRU that could drop
-// a live block's epoch). The cap is reached only under attack: the watermark prune
-// keeps the steady-state map far below it. Caller holds vm.mu.
-func (vm *pChainHeightVM) enforceCapLocked() {
-	for len(vm.heights) > pChainHeightMapCap {
-		var victim ids.ID
-		var maxHeight uint64
-		first := true
-		for id, e := range vm.heights {
-			if first || e.chainHeight > maxHeight {
-				victim, maxHeight, first = id, e.chainHeight, false
-			}
-		}
-		delete(vm.heights, victim)
-	}
-}
-
-// currentPChainHeight returns the proposer's live P-chain height, the upper end
-// of the proposervm selectChildPChainHeight rule. A nil state or a read error
-// yields 0 (the genesis-set fallback): a height the proposer cannot resolve must
-// not be stamped onto a block, since a follower could not resolve the set there
-// either. A read error is symmetric across nodes for a committed P-chain, so the
-// fallback is uniform.
-func (vm *pChainHeightVM) currentPChainHeight(ctx context.Context) uint64 {
-	if vm.state == nil {
-		return 0
-	}
-	h, err := vm.state.GetCurrentHeight(ctx)
-	if err != nil {
-		return 0
-	}
-	return h
-}
-
-// parentHeight returns the P-chain epoch height stamped on parentID, or 0 if it
-// is unknown — used to keep a child's stamped height monotone ≥ its parent's
-// (selectChildPChainHeight). An unknown parent (0) cannot LOWER the child below
-// the current height (the max below), so monotonicity is preserved fail-soft.
-func (vm *pChainHeightVM) parentHeight(parentID ids.ID) uint64 {
-	h, _ := vm.recall(parentID)
-	return h
-}
-
-// BuildBlock builds the inner block and stamps it with the proposer's P-chain
-// epoch height H = max(currentPChainHeight, parentH). This is the proposer side
-// of the epoch: the one node building this block chooses H from its own live
-// P-chain view, and that H rides the gossiped bytes to every follower (which
-// adopt it, never recompute it). Monotone ≥ parent so a chain's epoch never goes
-// backwards across blocks (a cert at a lower epoch than its parent would bind a
-// stale set).
-func (vm *pChainHeightVM) BuildBlock(ctx context.Context) (block.Block, error) {
-	inner, err := vm.inner.BuildBlock(ctx)
-	if err != nil {
-		return nil, err
-	}
-	h := vm.currentPChainHeight(ctx)
-	if ph := vm.parentHeight(inner.ParentID()); ph > h {
-		h = ph
-	}
-	vm.remember(inner.ID(), h, inner.Height())
-	return newPChainHeightBlock(vm, inner, h), nil
-}
-
-// ParseBlock recovers a block from transport bytes. Wrapped bytes
-// ([magic|H|innerBytes]) yield a block whose PChainHeight() is the EXACT H the
-// proposer stamped — the determinism guarantee: every node parsing the same
-// gossiped bytes recovers the identical epoch height. Bytes without the magic are
-// a raw inner block (a pre-wrapper peer, GetAncestors, genesis): parsed straight
-// through with H=0, the SAFE genesis-set fallback.
-//
-// FRAME DISCRIMINATOR (LOW-2). The 4-byte magic collides at 2^-32 with the raw
-// hash prefix some VMs use as their Bytes() (dexvm/quantumvm/dchain serialize
-// parentID[0:32]||…). The magic match alone is NOT sufficient: a frame is real
-// only if the inner re-parse of the framed payload ALSO succeeds. So when the
-// prefix matches, attempt to parse b[header:] as an inner block; if that FAILS,
-// fall back to parsing the WHOLE b as a raw inner block (the colliding raw block,
-// whose bytes minus the 12-byte prefix are not a valid inner block). This removes
-// the bootstrap stall a magic collision used to cause (mis-framed → inner decode
-// fails closed → stall on that chain).
-//
-// RECENCY GATE (HIGH-1, predicate b). A real frame's stamped epoch H must be
-// recent relative to THIS node's live P-chain height: H ≤ localCurrentH + slack.
-// An absurd-future H (a Byzantine proposer claiming an epoch the network has not
-// reached) is rejected fail-closed (the block is dropped, never tracked). This is
-// the upper half of the epoch bound; the engine's monotone gate is the lower half
-// (≥ parent's recorded epoch), so the epoch is pinned to [parentEpoch, localH+slack].
-func (vm *pChainHeightVM) ParseBlock(ctx context.Context, b []byte) (block.Block, error) {
-	candidateInner, h, magicMatched := unwrapPChainHeight(b)
-	if magicMatched {
-		// The prefix looks like a frame. It IS a frame only if the framed payload
-		// parses as an inner block AND the stamped epoch is recent.
-		if inner, err := vm.inner.ParseBlock(ctx, candidateInner); err == nil {
-			if !vm.epochRecent(ctx, h) {
-				return nil, errPChainHeightNotRecent
-			}
-			vm.remember(inner.ID(), h, inner.Height())
-			return newPChainHeightBlock(vm, inner, h), nil
-		}
-		// Magic matched but the framed payload did NOT parse → this is a RAW block
-		// whose first bytes coincidentally equal the magic. Parse the whole b raw.
-	}
-	// Raw inner block: no proposer epoch available → genesis-set fallback. Still
-	// wrap (uniform block type to the engine) but with H=0 and a passthrough
-	// Bytes() so re-gossip of a raw block stays raw.
-	inner, err := vm.inner.ParseBlock(ctx, b)
-	if err != nil {
-		return nil, err
-	}
-	return newRawPChainHeightBlock(vm, inner), nil
-}
-
-// epochRecent reports whether a stamped P-chain epoch height is within the recency
-// slack of this node's live P-chain height (HIGH-1, predicate b). A node with no
-// resolvable current height (state nil / read error → 0) cannot bound recency, so
-// it admits the block (the verifier still fails closed on an unresolvable future
-// epoch at set-resolution time — recency here is a fast-fail/DoS sanity gate, not
-// the safety bound). Heights at or below local are always recent.
-func (vm *pChainHeightVM) epochRecent(ctx context.Context, h uint64) bool {
-	localH := vm.currentPChainHeight(ctx)
-	if localH == 0 {
-		return true
-	}
-	return h <= localH+pChainHeightRecencySlack
-}
-
-// GetBlock fetches a block from the inner VM and re-attaches the P-chain height
-// it was stamped with (recalled from build/parse). A miss yields H=0 — acceptable
-// because GetBlock is not on the engine's finality-capture path (see the heights
-// field doc). The returned block's Bytes() is the inner bytes (the inner VM's
-// canonical at-rest form); a stamped height is re-attached for the engine's
-// in-memory use only.
-func (vm *pChainHeightVM) GetBlock(ctx context.Context, id ids.ID) (block.Block, error) {
-	inner, err := vm.inner.GetBlock(ctx, id)
-	if err != nil {
-		return nil, err
-	}
-	if h, ok := vm.recall(id); ok {
-		return newRawPChainHeightBlockWithHeight(vm, inner, h), nil
-	}
-	return newRawPChainHeightBlock(vm, inner), nil
-}
-
-// LastAccepted delegates to the inner VM.
-func (vm *pChainHeightVM) LastAccepted(ctx context.Context) (ids.ID, error) {
-	return vm.inner.LastAccepted(ctx)
-}
-
-// NOTE: this wrapper deliberately does NOT forward GetBlockIDAtHeight. The bootstrap acceptance
-// oracle's fork-sibling check reads the IN-PROCESS consensus finalized ledger
-// (blockHandler.finalizedBlockAtHeight → engine.FinalizedBlockAtHeight), NOT a VM height index —
-// because the VM index is dead over ZAP (the zap server has no MsgGetBlockIDAtHeight handler, so
-// the real C-Chain returns nothing). A forwarder here would only re-expose that dead path.
-
-// SetPreference delegates to the inner VM.
-func (vm *pChainHeightVM) SetPreference(ctx context.Context, id ids.ID) error {
-	return vm.inner.SetPreference(ctx, id)
-}
-
-// wrapPChainHeight frames inner bytes with the proposer's P-chain height:
-// magic(4) || height(8,BE) || innerBytes. The header is fixed-width so unwrap is
-// a constant-time prefix read.
-func wrapPChainHeight(innerBytes []byte, height uint64) []byte {
-	out := make([]byte, pChainHeightHeaderLen+len(innerBytes))
-	copy(out[0:4], pChainHeightMagic[:])
-	binary.BigEndian.PutUint64(out[4:12], height)
-	copy(out[pChainHeightHeaderLen:], innerBytes)
-	return out
-}
-
-// unwrapPChainHeight is a PURE prefix splitter: it reports whether b carries the
-// frame magic at the header width and, if so, returns the candidate payload and
-// the encoded height. magicMatched==true means ONLY that the prefix looks like a
-// frame — NOT that b is definitely framed. ParseBlock makes the real decision by
-// re-parsing the candidate payload (LOW-2): a raw block whose first bytes collide
-// with the magic (2^-32) yields magicMatched==true here but its payload fails the
-// inner re-parse, so ParseBlock falls back to a raw whole-b parse. Keeping this a
-// pure split (no VM dependency) localizes the collision handling to ParseBlock.
-func unwrapPChainHeight(b []byte) (payload []byte, height uint64, magicMatched bool) {
-	if len(b) < pChainHeightHeaderLen ||
-		b[0] != pChainHeightMagic[0] || b[1] != pChainHeightMagic[1] ||
-		b[2] != pChainHeightMagic[2] || b[3] != pChainHeightMagic[3] {
-		return b, 0, false
-	}
-	height = binary.BigEndian.Uint64(b[4:12])
-	return b[pChainHeightHeaderLen:], height, true
-}
-
-// --- the wrapped block -------------------------------------------------------
-
-// pChainHeightBlock is a chain block that carries a P-chain epoch height for the
-// engine while delegating identity, verification, and acceptance to the inner VM
-// block. It satisfies consensus block.SignedBlock's PChainHeight() (the subset
-// the engine reads via pChainHeightOf), so the engine records the real epoch
-// height — every other behaviour is the inner VM's.
-//
-// `bytes` is what the engine gossips. For a proposer-built / wrapped-parsed block
-// it is the framed [magic|H|innerBytes] so a follower recovers H; for a raw block
-// (genesis-set fallback) it is the inner bytes verbatim (passthrough) so re-gossip
-// stays raw.
-type pChainHeightBlock struct {
-	vm           *pChainHeightVM
-	inner        block.Block
-	pChainHeight uint64
-	bytes        []byte
-}
-
-// newPChainHeightBlock wraps inner with height h and a FRAMED Bytes()
-// ([magic|h|inner]) — the proposer/parse path, where H must travel to followers.
-func newPChainHeightBlock(vm *pChainHeightVM, inner block.Block, h uint64) *pChainHeightBlock {
-	return &pChainHeightBlock{
-		vm:           vm,
-		inner:        inner,
-		pChainHeight: h,
-		bytes:        wrapPChainHeight(inner.Bytes(), h),
-	}
-}
-
-// newRawPChainHeightBlock wraps inner with H=0 and a PASSTHROUGH Bytes() (the
-// inner bytes verbatim) — the genesis-set fallback for a raw inner block.
-func newRawPChainHeightBlock(vm *pChainHeightVM, inner block.Block) *pChainHeightBlock {
-	return &pChainHeightBlock{vm: vm, inner: inner, pChainHeight: 0, bytes: inner.Bytes()}
-}
-
-// newRawPChainHeightBlockWithHeight re-attaches a recalled height to an inner
-// block fetched via GetBlock while keeping a PASSTHROUGH Bytes() (the inner VM's
-// at-rest bytes). Used off the finality-capture path; the height is for the
-// engine's in-memory epoch read, not for re-gossip framing.
-func newRawPChainHeightBlockWithHeight(vm *pChainHeightVM, inner block.Block, h uint64) *pChainHeightBlock {
-	return &pChainHeightBlock{vm: vm, inner: inner, pChainHeight: h, bytes: inner.Bytes()}
-}
-
-func (b *pChainHeightBlock) ID() ids.ID           { return b.inner.ID() }
-func (b *pChainHeightBlock) Parent() ids.ID       { return b.inner.Parent() }
-func (b *pChainHeightBlock) ParentID() ids.ID     { return b.inner.ParentID() }
-func (b *pChainHeightBlock) Height() uint64       { return b.inner.Height() }
-func (b *pChainHeightBlock) Timestamp() time.Time { return b.inner.Timestamp() }
-func (b *pChainHeightBlock) Status() uint8        { return b.inner.Status() }
-func (b *pChainHeightBlock) Bytes() []byte        { return b.bytes }
-
-// PChainHeight is the method the engine reads via pChainHeightOf — the SOLE
-// reason this wrapper exists. The inner block does not expose it; this does.
-func (b *pChainHeightBlock) PChainHeight() uint64 { return b.pChainHeight }
-
-// Verify/Reject delegate to the inner VM block: the wrapper changes the epoch the
-// engine SEES, never the block's validity or state transition.
-func (b *pChainHeightBlock) Verify(ctx context.Context) error { return b.inner.Verify(ctx) }
-func (b *pChainHeightBlock) Reject(ctx context.Context) error { return b.inner.Reject(ctx) }
-
-// Accept finalizes the inner block, then advances the VM's finalized-height
-// watermark and prunes the heights map at/below it (MEDIUM-3). The inner Accept
-// runs FIRST: finalization must not depend on the bookkeeping prune, and the prune
-// is a pure memory-management side effect that can never fail. The block carries
-// its own height, so the VM learns the exact finalized height with no extra read.
-func (b *pChainHeightBlock) Accept(ctx context.Context) error {
-	if err := b.inner.Accept(ctx); err != nil {
-		return err
-	}
-	if b.vm != nil {
-		b.vm.onAccepted(b.inner.Height())
-	}
-	return nil
-}
-
-// Unwrap exposes the inner block for code that must reach the underlying VM block
-// (e.g. a missing-context reparse). Kept narrow on purpose.
-func (b *pChainHeightBlock) Unwrap() block.Block { return b.inner }

chains/proposervm_wrap_test.go

@@ -1,130 +0,0 @@
-// Copyright (C) 2019-2026, Lux Industries, Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-// proposervm_wrap_test.go — pins the single policy gate that decides whether a
-// linear chain.ChainVM is re-wrapped in proposervm for single-proposer-per-height
-// block production (the consensus-safety fix for the equivocation crash). The
-// gate is a pure function so the policy is verifiable without standing up a chain.
-package chains
-
-import (
-	"testing"
-
-	"github.com/luxfi/constants"
-	"github.com/luxfi/ids"
-)
-
-func TestShouldWrapInProposerVM(t *testing.T) {
-	// A native chain ID that is NOT the P-Chain (e.g. the C-Chain): first 31
-	// bytes zero, last byte the chain letter. Any non-platform ID exercises the
-	// chainID condition; this mirrors how native chain IDs are shaped.
-	cChainID := ids.ID{}
-	cChainID[ids.IDLen-1] = 'C'
-	xChainID := ids.ID{}
-	xChainID[ids.IDLen-1] = 'X'
-
-	tests := []struct {
-		name             string
-		k                int
-		chainID          ids.ID
-		innerIsDAGNative bool
-		want             bool
-		why              string
-	}{
-		{
-			name:             "C-Chain devnet K=4",
-			k:                4, // LocalBFTParams
-			chainID:          cChainID,
-			innerIsDAGNative: false,
-			want:             true,
-			why:              "multi-validator EVM, not the P-Chain, not DAG — the chain that crashed; must be wrapped",
-		},
-		{
-			name:             "C-Chain mainnet K=21",
-			k:                21, // MainnetParams
-			chainID:          cChainID,
-			innerIsDAGNative: false,
-			want:             true,
-			why:              "large multi-validator EVM is wrapped exactly as avalanchego wraps it",
-		},
-		{
-			name:             "P-Chain is excluded even at K>1",
-			k:                4,
-			chainID:          constants.PlatformChainID,
-			innerIsDAGNative: false,
-			want:             false,
-			why:              "P-Chain validator state is published mid-create; its windower would be empty — keep newPChainHeightVM",
-		},
-		{
-			name:             "X-Chain (DAG-native) is excluded",
-			k:                4,
-			chainID:          xChainID,
-			innerIsDAGNative: true,
-			want:             false,
-			why:              "linearized DAG VM uses a push-notification bridge that does not compose with proposervm's window",
-		},
-		{
-			name:             "single-node K=1 is not wrapped",
-			k:                1, // SingleValidatorParams
-			chainID:          cChainID,
-			innerIsDAGNative: false,
-			want:             false,
-			why:              "one validator is trivially the sole proposer; no equivocation to prevent",
-		},
-		{
-			name:             "K=1 P-Chain is not wrapped",
-			k:                1,
-			chainID:          constants.PlatformChainID,
-			innerIsDAGNative: false,
-			want:             false,
-			why:              "K==1 short-circuits regardless of chain",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := shouldWrapInProposerVM(tt.k, tt.chainID, tt.innerIsDAGNative)
-			if got != tt.want {
-				t.Fatalf("shouldWrapInProposerVM(k=%d, chainID=%s, dag=%v) = %v, want %v — %s",
-					tt.k, tt.chainID, tt.innerIsDAGNative, got, tt.want, tt.why)
-			}
-		})
-	}
-}
-
-// TestShouldWrapInProposerVM_FlowsFromSelectedParams proves the K the gate reads
-// is the one selectConsensusParams produces per network, so the wrap decision is
-// consistent with the BFT committee actually chosen: every sybil-protected
-// network yields K>1 (C-Chain wrapped), and single-node yields K==1 (not wrapped).
-func TestShouldWrapInProposerVM_FlowsFromSelectedParams(t *testing.T) {
-	cChainID := ids.ID{}
-	cChainID[ids.IDLen-1] = 'C'
-
-	cases := []struct {
-		name            string
-		sybilProtection bool
-		networkID       uint32
-		wantWrapCChain  bool
-	}{
-		{"single-node dev", false, constants.LocalID, false},
-		{"devnet sybil", true, constants.DevnetID, true},
-		{"localnet sybil", true, constants.LocalID, true},
-		{"mainnet", true, constants.MainnetID, true},
-		{"testnet", true, constants.TestnetID, true},
-	}
-
-	for _, c := range cases {
-		t.Run(c.name, func(t *testing.T) {
-			params := selectConsensusParams(c.sybilProtection, c.networkID)
-			got := shouldWrapInProposerVM(params.K, cChainID, false)
-			if got != c.wantWrapCChain {
-				t.Fatalf("network %s (sybil=%v): K=%d → wrap=%v, want %v",
-					c.name, c.sybilProtection, params.K, got, c.wantWrapCChain)
-			}
-			// The P-Chain is never wrapped, whatever the committee.
-			if shouldWrapInProposerVM(params.K, constants.PlatformChainID, false) {
-				t.Fatalf("network %s: P-Chain must never be wrapped (K=%d)", c.name, params.K)
-			}
-		})
-	}
-}

chains/quorum.go

@@ -1,401 +0,0 @@
-// Copyright (C) 2019-2026, Lux Industries, Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-// quorum.go — the node-layer wiring that makes the consensus engine's α-of-K
-// quorum-cert finality LIVE (HIGH-4). The consensus engine (luxfi/consensus
-// engine/chain) defines the quorum RULE and the vote/cert topology interfaces;
-// THIS file supplies the concrete node implementations the engine needs:
-//
-//   - blsVoteVerifier  — verifies a validator's BLS signature over the canonical
-//     vote message against the chain's validator set (the engine is scheme-
-//     agnostic; the node injects BLS).
-//   - blsVoteSigner    — signs THIS node's accept votes with its staking BLS key
-//     so its signature can be collected into a cert.
-//   - validatorStakeSource — supplies per-validator stake so finality is a
-//     ⅔-by-STAKE supermajority (HIGH-3), not a raw voter count.
-//   - networkGossiper.BroadcastVote / GossipCert — the QuorumGossiper transport:
-//     a follower broadcasts its signed vote to ALL validators and any node that
-//     collects α distinct signed votes gossips the assembled cert, so finality
-//     never hinges on one node's inbound Chits (liveness; no proposer-freeze).
-//
-// Inbound votes/certs arrive as app-gossip and are demuxed in blockHandler.Gossip
-// (see manager.go) into engine.HandleIncomingVote / HandleIncomingCert.
-package chains
-
-import (
-	"bytes"
-	"context"
-	"crypto/sha256"
-	"encoding/binary"
-	"errors"
-	"sort"
-
-	consensusconfig "github.com/luxfi/consensus/config"
-	consensuschain "github.com/luxfi/consensus/engine/chain"
-	"github.com/luxfi/constants"
-	"github.com/luxfi/crypto/bls"
-	"github.com/luxfi/ids"
-	validators "github.com/luxfi/validators"
-)
-
-// isLocalDevNetwork reports whether networkID is an explicitly-local developer
-// network: devnet (3) or localnet (1337). These are EXACT IDs (per luxfi/constants
-// convention), NOT a range — a custom value L1 with a high networkID (e.g. an
-// L1 whose chainID == networkID) is a VALUE network and must NOT match here.
-// Local dev networks are the only IDs that run the minimal-BFT committee
-// (LocalBFTParams, K=4) instead of the large-committee Default (K=20), because a
-// handful of localhost validators cannot reach an α=14-of-K=20 quorum.
-func isLocalDevNetwork(networkID uint32) bool {
-	return networkID == constants.DevnetID || networkID == constants.LocalID
-}
-
-// selectConsensusParams picks the consensus parameters for a chain.
-//
-//   - sybilProtection == false (--dev / single-node): K=1, the sole validator's
-//     accept is the 1-of-1 quorum (no peer signatures).
-//   - sybilProtection == true, VALUE network: a large BYZANTINE-fault-tolerant
-//     param set — NEVER LocalParams() (K=3/α=2, f=0, which a single Byzantine
-//     validator forks; this was CRITICAL-2). Mainnet→K=21, Testnet→K=11, every
-//     other value net→Default K=20.
-//   - sybilProtection == true, LOCAL DEV network (devnet 3 / localnet 1337):
-//     LocalBFTParams() (K=4/α=3, f=1) — the MINIMAL real-BFT committee. Default
-//     K=20 is unsatisfiable on a few localhost validators: α=14 affirmative votes
-//     are unreachable with 3-4 validators, so no block ever finalizes and the
-//     P-Chain freezes at height 0 (no C-Chain is ever created). K=4 makes quorum
-//     reachable (3 of 4) while staying genuinely BFT — it still clears
-//     ValidateForValueNetwork (K≥4, f≥1) and the CRITICAL-2 multi-node-is-BFT
-//     regression, so production safety is untouched. (A local devnet should run
-//     ≥4 validators to realise f=1; with 3 it degrades to near-unanimous f=0,
-//     which is safe though not live under a fault.)
-//
-// All branches satisfy the 2α−K ≥ f+1 overlap bound; the manager call site also
-// asserts ValidateForValueNetwork as a fail-closed backstop (K=4 passes it).
-func selectConsensusParams(sybilProtection bool, networkID uint32) consensusconfig.Parameters {
-	if !sybilProtection {
-		return consensusconfig.SingleValidatorParams()
-	}
-	switch networkID {
-	case constants.MainnetID:
-		return consensusconfig.MainnetParams()
-	case constants.TestnetID:
-		return consensusconfig.TestnetParams()
-	default:
-		if isLocalDevNetwork(networkID) {
-			return consensusconfig.LocalBFTParams()
-		}
-		return consensusconfig.DefaultParams()
-	}
-}
-
-// shouldWrapInProposerVM decides whether a linear chain.ChainVM is wrapped in
-// proposervm to enforce single-proposer-per-height block production (the
-// Snowman++ window). It is the SINGLE policy gate (the manager calls it once);
-// keeping it a pure function makes the policy unit-testable without standing up
-// a whole chain. All three conditions must hold:
-//
-//   - k > 1: a multi-validator quorum. K==1 (single-node --dev) has exactly one
-//     proposer already, so there is no equivocation to prevent and no schedule
-//     to compute (proposervm would only add a wrapper with no safety value).
-//   - chainID is NOT the P-Chain: the P-Chain publishes its OWN height-indexed
-//     validators.State DURING its createChain, AFTER the chainRuntime snapshot
-//     proposervm's windower reads — so its windower would see an empty set and
-//     fall back to anyone-can-propose with a P-chain-height-0 stamp. The P-Chain
-//     keeps the existing newPChainHeightVM path (which DOES get the live state).
-//   - inner is NOT DAG-native (no Linearize): a linearized DAG VM (X-Chain) is
-//     driven by a push-notification bridge that does not compose with
-//     proposervm's pull/window model without avalanchego's initializeOnLinearizeVM
-//     machinery. It keeps the existing path.
-//
-// The C-Chain and sovereign-L1 EVM chains satisfy all three (multi-validator,
-// not the P-Chain, not DAG) — they are exactly the chains that exhibited the
-// equivocation crash, and exactly the chains avalanchego wraps in proposervm.
-func shouldWrapInProposerVM(k int, chainID ids.ID, innerIsDAGNative bool) bool {
-	return k > 1 && chainID != constants.PlatformChainID && !innerIsDAGNative
-}
-
-// --- BLS vote verifier -------------------------------------------------------
-
-// blsVoteVerifier verifies a validator's BLS signature over the canonical vote
-// message. The validator's BLS public key is resolved FROM THE HEIGHT-INDEXED
-// validators.State AT THE BLOCK'S P-CHAIN EPOCH HEIGHT (RESIDUAL-B) — the SAME
-// height-pinned source the set-root and the ⅔-by-stake tally read from
-// (validatorSetAtHeight). It is NOT resolved from the CURRENT validator map.
-//
-// Why the epoch, not the current map: during an async validator-set change a
-// validator can be present in the set@H (it legitimately signed the block being
-// voted on at height H) yet ALREADY GONE from the current map. Resolving its
-// pubkey from the current map drops its valid vote, and if that validator holds
-// >⅓ of the stake-at-H the stable set falls below ⅔ and block H NEVER finalizes
-// (this is not self-healing for that block — the skew is permanent for H). Pinning
-// pubkey resolution to set@H — alongside membership, set-root, and stake — makes
-// the cert internally consistent at exactly one epoch.
-//
-// An unknown validator at the epoch, a validator with no BLS key, or a bad
-// signature all yield false (never an error/panic) — a cert with such a voter is
-// simply invalid, the fail-closed contract the engine requires. A nil state (the
-// no-op on a non-quorum node) yields false for every voter; a K>1 chain is
-// guarded against ever reaching here with a nil/no-op state (manager.go).
-type blsVoteVerifier struct {
-	state     validators.State
-	networkID ids.ID
-}
-
-func newBLSVoteVerifier(state validators.State, networkID ids.ID) *blsVoteVerifier {
-	return &blsVoteVerifier{state: state, networkID: networkID}
-}
-
-// VerifyVote implements consensuschain.VoteVerifier. epochHeight is the block's
-// P-chain height; the voter's pubkey is read from the set IN FORCE AT that height.
-func (v *blsVoteVerifier) VerifyVote(nodeID ids.NodeID, message []byte, sig []byte, epochHeight uint64) bool {
-	out, ok := validatorSetAtHeight(v.state, v.networkID, epochHeight)[nodeID]
-	if !ok || out == nil || len(out.PublicKey) == 0 {
-		return false
-	}
-	pk, err := bls.PublicKeyFromCompressedBytes(out.PublicKey)
-	if err != nil || pk == nil {
-		return false
-	}
-	signature, err := bls.SignatureFromBytes(sig)
-	if err != nil || signature == nil {
-		return false
-	}
-	return bls.Verify(pk, signature, message)
-}
-
-var _ consensuschain.VoteVerifier = (*blsVoteVerifier)(nil)
-
-// --- BLS vote signer ---------------------------------------------------------
-
-// blsVoteSigner signs this node's accept votes with its staking BLS key.
-type blsVoteSigner struct {
-	signer bls.Signer
-}
-
-func newBLSVoteSigner(signer bls.Signer) *blsVoteSigner {
-	if signer == nil {
-		return nil
-	}
-	return &blsVoteSigner{signer: signer}
-}
-
-// SignVote implements consensuschain.VoteSigner.
-func (s *blsVoteSigner) SignVote(message []byte) ([]byte, error) {
-	sig, err := s.signer.Sign(message)
-	if err != nil {
-		return nil, err
-	}
-	return bls.SignatureToBytes(sig), nil
-}
-
-var _ consensuschain.VoteSigner = (*blsVoteSigner)(nil)
-
-// --- height-pinned epoch read (MEDIUM-1) -------------------------------------
-
-// validatorSetAtHeight reads the validator set IN FORCE AT a value-chain height
-// from the height-indexed validators.State. This is the SINGLE source of epoch
-// truth shared by the stake source and the set-root source: both membership and
-// weights are read at the SAME height H so a cert's signed set-root and its
-// ⅔-by-stake tally are measured against the identical set.
-//
-// Determinism across nodes is the whole point. validators.State.GetValidatorSet
-// returns the set the network already agreed on at height H (P-chain / L1-staking
-// consensus), so every honest node computes the same set — and therefore the
-// same set-root and the same tally — for a given H, INDEPENDENT of async
-// current-map skew during a validator-set change. (The previous Manager.GetMap()
-// read hashed the CURRENT map, which diverges between the signer and the
-// assembler across that skew window → mismatched canonical messages → dropped
-// votes → finality stall at every staking change. That was MEDIUM-1.)
-//
-// A nil state, a lookup error, or an empty set yields a nil map, which the
-// callers fold into their fail-soft answers (0 weight / Empty root). An error is
-// SYMMETRIC across nodes (a committed height H reads the same on every node, or
-// fails the same way), so the degraded answer is uniform — it never makes one
-// node's view disagree with another's, which is the property that matters here.
-func validatorSetAtHeight(state validators.State, networkID ids.ID, height uint64) map[ids.NodeID]*validators.GetValidatorOutput {
-	if state == nil {
-		return nil
-	}
-	set, err := state.GetValidatorSet(context.Background(), height, networkID)
-	if err != nil || len(set) == 0 {
-		return nil
-	}
-	return set
-}
-
-// --- stake source (HIGH-3, height-pinned by MEDIUM-1) ------------------------
-
-// validatorStakeSource supplies validator voting weights so the engine can
-// require a ⅔-by-stake supermajority for finality (HIGH-3). Weights are read
-// from the HEIGHT-INDEXED validators.State at the cert-position height, the same
-// height the set-root commits to (MEDIUM-1). Reading the tally at the same epoch
-// as the signed membership means a validator whose vote is in the cert (its
-// signature verifies against the height-H set-root) also contributes its height-H
-// weight to the tally — eliminating the second skew (a current-map weight read
-// could drop a legitimately-signed quorum when membership changed between sign
-// and tally).
-type validatorStakeSource struct {
-	state     validators.State
-	networkID ids.ID
-}
-
-func newValidatorStakeSource(state validators.State, networkID ids.ID) *validatorStakeSource {
-	return &validatorStakeSource{state: state, networkID: networkID}
-}
-
-// Weight implements consensuschain.StakeSource. Returns the validator's stake in
-// the set IN FORCE AT height — deterministic across nodes for a given height. An
-// unknown validator (or a fail-soft empty read) yields 0, which cannot inflate
-// the numerator.
-func (s *validatorStakeSource) Weight(nodeID ids.NodeID, height uint64) uint64 {
-	out, ok := validatorSetAtHeight(s.state, s.networkID, height)[nodeID]
-	if !ok || out == nil {
-		return 0
-	}
-	return out.Light
-}
-
-// TotalStake implements consensuschain.StakeSource. Total active stake of the set
-// IN FORCE AT height (the denominator of the ⅔ predicate), measured at the same
-// epoch as Weight and the set-root.
-func (s *validatorStakeSource) TotalStake(height uint64) uint64 {
-	var total uint64
-	for _, out := range validatorSetAtHeight(s.state, s.networkID, height) {
-		if out != nil {
-			total += out.Light
-		}
-	}
-	return total
-}
-
-var _ consensuschain.StakeSource = (*validatorStakeSource)(nil)
-
-// --- validator-set-root source (MEDIUM: epoch binding) -----------------------
-
-// validatorSetRootSource computes the deterministic commitment to the validator
-// set IN FORCE AT a value-chain height — the value the engine stamps into every
-// vote's VotePosition.ValidatorSetRoot so a cert is pinned to the exact set it
-// was certified under. It is the node side of the MEDIUM fix: it turns the
-// "⅔-by-stake measured at the cert-position epoch" property into an ENFORCED
-// invariant (a cross-epoch cert fails verification because every signature was
-// over this root).
-//
-// HEIGHT-PINNED (MEDIUM-1). The root is read from the HEIGHT-INDEXED
-// validators.State at the value-chain block height, NOT from the Manager's
-// CURRENT map. At a given height H, GetValidatorSet returns the set the network
-// already agreed on, so every honest node — signer and assembler alike — computes
-// the IDENTICAL root for H, independent of async current-map skew during a
-// validator-set change. Reading the current map (the prior bug) let the signer
-// and the assembler hold different maps across that skew window → different roots
-// → the canonical signed message differed → signatures failed verification →
-// votes dropped → finality stalled at every staking change.
-//
-// The commitment is a SHA-256 over the set serialized in a canonical order
-// (validators sorted by NodeID, each as nodeID || light || len(pubkey) ||
-// pubkey) — see hashValidatorSet. Sorting by NodeID + length-prefixing the
-// pubkey makes the encoding canonical and unambiguous; the byte layout is
-// UNCHANGED from the prior implementation, so the wire format and the engine's
-// epoch-binding contract are preserved (only the SOURCE of the set changed from
-// the current map to the height-indexed set).
-type validatorSetRootSource struct {
-	state     validators.State
-	networkID ids.ID
-}
-
-func newValidatorSetRootSource(state validators.State, networkID ids.ID) *validatorSetRootSource {
-	return &validatorSetRootSource{state: state, networkID: networkID}
-}
-
-// ValidatorSetRoot implements consensuschain.ValidatorSetRootSource. Returns the
-// commitment to the weighted set IN FORCE AT height (deterministic across nodes).
-// Returns ids.Empty when the state is absent or the set is empty (the explicit
-// "unbound" answer, consistent with the engine default); a height-read error is
-// symmetric across nodes, so the Empty fallback is uniform and never creates a
-// cross-node root disagreement.
-func (s *validatorSetRootSource) ValidatorSetRoot(height uint64) ids.ID {
-	return hashValidatorSet(validatorSetAtHeight(s.state, s.networkID, height))
-}
-
-var _ consensuschain.ValidatorSetRootSource = (*validatorSetRootSource)(nil)
-
-// hashValidatorSet computes the canonical SHA-256 commitment to a weighted
-// validator set: validators sorted by NodeID, each serialized as
-// nodeID || light(8,BE) || len(pubkey)(8,BE) || pubkey. An empty/nil set commits
-// to ids.Empty (the "unbound" answer). This is the SINGLE definition of the
-// set-root encoding (DRY) — both the live source and its tests hash through here,
-// so the wire format cannot drift between them.
-func hashValidatorSet(set map[ids.NodeID]*validators.GetValidatorOutput) ids.ID {
-	if len(set) == 0 {
-		return ids.Empty
-	}
-	nodeIDs := make([]ids.NodeID, 0, len(set))
-	for nodeID := range set {
-		nodeIDs = append(nodeIDs, nodeID)
-	}
-	sort.Slice(nodeIDs, func(i, j int) bool {
-		return bytes.Compare(nodeIDs[i][:], nodeIDs[j][:]) < 0
-	})
-	h := sha256.New()
-	var u64 [8]byte
-	for _, nodeID := range nodeIDs {
-		v := set[nodeID]
-		h.Write(nodeID[:])
-		binary.BigEndian.PutUint64(u64[:], v.Light)
-		h.Write(u64[:])
-		binary.BigEndian.PutUint64(u64[:], uint64(len(v.PublicKey)))
-		h.Write(u64[:])
-		h.Write(v.PublicKey)
-	}
-	var root ids.ID
-	copy(root[:], h.Sum(nil))
-	return root
-}
-
-// --- app-gossip envelope for votes/certs -------------------------------------
-
-// The QuorumGossiper transport rides on app-gossip. A single framed envelope
-// carries either a signed vote or an assembled cert. The receiver (blockHandler
-// .Gossip) demuxes on the magic + kind and routes to the engine. A payload
-// without the magic is a plain block gossip (legacy Put path), so the demux is
-// backward-compatible.
-//
-// Layout (big-endian):
-//
-//	magic:4 ("LXQ\x01")  kind:1  blockID:32  payload:...
-//
-// kind 1 = signed vote (payload = engine encodeSignedVote: nodeID+sig)
-// kind 2 = finality cert (payload = engine cert MarshalBinary)
-var quorumGossipMagic = [4]byte{'L', 'X', 'Q', 0x01}
-
-const (
-	quorumKindVote byte = 1
-	quorumKindCert byte = 2
-)
-
-// ErrNotQuorumGossip signals a payload is not a quorum envelope (so the caller
-// falls through to the block-gossip path).
-var ErrNotQuorumGossip = errors.New("chains: not a quorum gossip envelope")
-
-// encodeQuorumGossip frames a vote/cert payload for app-gossip.
-func encodeQuorumGossip(kind byte, blockID ids.ID, payload []byte) []byte {
-	buf := make([]byte, 0, 4+1+32+len(payload))
-	buf = append(buf, quorumGossipMagic[:]...)
-	buf = append(buf, kind)
-	buf = append(buf, blockID[:]...)
-	buf = append(buf, payload...)
-	return buf
-}
-
-// decodeQuorumGossip parses an envelope. Returns ErrNotQuorumGossip if the magic
-// is absent (a normal block gossip) — fail-soft so the legacy path is preserved.
-func decodeQuorumGossip(data []byte) (kind byte, blockID ids.ID, payload []byte, err error) {
-	if len(data) < 4+1+32 || [4]byte{data[0], data[1], data[2], data[3]} != quorumGossipMagic {
-		return 0, ids.Empty, nil, ErrNotQuorumGossip
-	}
-	kind = data[4]
-	copy(blockID[:], data[5:5+32])
-	payload = data[5+32:]
-	if kind != quorumKindVote && kind != quorumKindCert {
-		return 0, ids.Empty, nil, ErrNotQuorumGossip
-	}
-	return kind, blockID, payload, nil
-}

chains/quorum_guard_node_test.go

@@ -1,109 +0,0 @@
-// Copyright (C) 2019-2026, Lux Industries, Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-// quorum_guard_node_test.go — CRITICAL-1(c) fail-closed guard + the wiring proof
-// the MEDIUM-1 round lacked. The round-1 tests injected a validators.State into
-// the source constructors directly and never exercised the path where
-// m.validatorState is nil (the production default until the P-Chain publishes
-// its State). These tests pin:
-//
-//	(1) the guard predicate: a K>1 chain with NO height-indexed state is refused
-//	    (would otherwise stall finality forever);
-//	(2) the failure mechanism: getValidatorState(nil) → the no-op State, whose
-//	    GetValidatorSet is EMPTY at every height → the stake source totals 0 and
-//	    the set-root is Empty (exactly the inputs that make VerifyWeighted fail
-//	    closed). This is what the guard exists to prevent silently;
-//	(3) the fix: once a REAL height-indexed state is published, getValidatorState
-//	    returns it and the same sources read a live set (non-zero stake / non-Empty
-//	    root) — finality can proceed.
-package chains
-
-import (
-	"context"
-	"testing"
-
-	"github.com/luxfi/ids"
-	validators "github.com/luxfi/validators"
-	"github.com/luxfi/validators/validatorstest"
-)
-
-// TestQuorumGuard_RefusesNoopState pins the guard predicate (CRITICAL-1(c)): a
-// nil (unpublished) validator state is NOT live, so a K>1 chain must refuse to
-// start; a published state IS live.
-func TestQuorumGuard_RefusesNoopState(t *testing.T) {
-	if quorumValidatorStateLive(nil) {
-		t.Fatal("CRITICAL-1(c): a nil validator state must NOT be considered live (would stall finality)")
-	}
-	live := validatorstest.NewTestState()
-	if !quorumValidatorStateLive(live) {
-		t.Fatal("a published height-indexed validator state must be considered live")
-	}
-}
-
-// TestGetValidatorState_NoopIsEmptyAtEveryHeight proves the failure mechanism the
-// guard prevents: with no state published, getValidatorState yields the no-op
-// State, and the height-pinned sources read an EMPTY set at every height — zero
-// total stake and an Empty set-root, the exact inputs that make the engine's
-// VerifyWeighted fail closed (ErrQCStakeBelowSupermajority) so NO block finalizes.
-func TestGetValidatorState_NoopIsEmptyAtEveryHeight(t *testing.T) {
-	netID := ids.GenerateTestID()
-
-	// Production default: validatorState unset → getValidatorState(nil) = no-op.
-	noop := getValidatorState(nil)
-	if noop == nil {
-		t.Fatal("getValidatorState(nil) must return the no-op State, not nil")
-	}
-
-	stake := newValidatorStakeSource(noop, netID)
-	root := newValidatorSetRootSource(noop, netID)
-
-	for _, h := range []uint64{0, 1, 7, 1_000, 10_000_000} {
-		if total := stake.TotalStake(h); total != 0 {
-			t.Fatalf("no-op State must report zero total stake at height %d, got %d", h, total)
-		}
-		if r := root.ValidatorSetRoot(h); r != ids.Empty {
-			t.Fatalf("no-op State must commit to Empty set-root at height %d, got %s", h, r)
-		}
-	}
-}
-
-// TestGetValidatorState_LiveStateReadsSet proves the fix: once a real
-// height-indexed state is published (as the P-Chain does), getValidatorState
-// returns it and the SAME sources read a live set — non-zero stake and a
-// non-Empty set-root — so the ⅔-by-stake finality predicate can be satisfied.
-func TestGetValidatorState_LiveStateReadsSet(t *testing.T) {
-	netID := ids.GenerateTestID()
-	n0, n1, n2 := ids.GenerateTestNodeID(), ids.GenerateTestNodeID(), ids.GenerateTestNodeID()
-
-	const H = uint64(7)
-	live := validatorstest.NewTestState()
-	live.GetValidatorSetF = func(_ context.Context, height uint64, gotNet ids.ID) (map[ids.NodeID]*validators.GetValidatorOutput, error) {
-		if gotNet != netID || height != H {
-			return map[ids.NodeID]*validators.GetValidatorOutput{}, nil
-		}
-		return map[ids.NodeID]*validators.GetValidatorOutput{
-			n0: {NodeID: n0, PublicKey: []byte("pk0"), Light: 30, Weight: 30},
-			n1: {NodeID: n1, PublicKey: []byte("pk1"), Light: 30, Weight: 30},
-			n2: {NodeID: n2, PublicKey: []byte("pk2"), Light: 40, Weight: 40},
-		}, nil
-	}
-
-	// getValidatorState passes a non-nil state through unchanged.
-	got := getValidatorState(live)
-	stake := newValidatorStakeSource(got, netID)
-	root := newValidatorSetRootSource(got, netID)
-
-	if total := stake.TotalStake(H); total != 100 {
-		t.Fatalf("live State must report total stake 100 at the epoch, got %d", total)
-	}
-	if w := stake.Weight(n2, H); w != 40 {
-		t.Fatalf("live State must report n2 weight 40 at the epoch, got %d", w)
-	}
-	if r := root.ValidatorSetRoot(H); r == ids.Empty {
-		t.Fatal("live State must commit to a NON-Empty set-root at the epoch")
-	}
-	// A different height (no set) is still Empty/zero — the read is height-pinned.
-	if stake.TotalStake(H+1) != 0 || root.ValidatorSetRoot(H+1) != ids.Empty {
-		t.Fatal("live State read must be height-pinned (empty at a height with no set)")
-	}
-}

chains/quorum_params_test.go

@@ -1,132 +0,0 @@
-// Copyright (C) 2019-2026, Lux Industries, Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-// quorum_params_test.go — CRITICAL-2 node-layer regression: the node must NEVER
-// wire a non-BFT consensus param set for a multi-validator (sybil-protected)
-// chain. The round-1 hole was manager.go selecting LocalParams() (K=3/α=2 → f=0,
-// CFT) for ALL multi-node nets — a single Byzantine validator forks K=3/α=2.
-// These tests pin selectConsensusParams to a BFT-safe set for every multi-node
-// network and prove the value-network backstop (ValidateForValueNetwork) accepts
-// the selected params.
-package chains
-
-import (
-	"testing"
-
-	consensusconfig "github.com/luxfi/consensus/config"
-	"github.com/luxfi/constants"
-)
-
-// TestSelectConsensusParams_MultiNodeIsBFT proves that for EVERY multi-validator
-// (sybilProtection==true) network the node selects a Byzantine-fault-tolerant
-// param set (f≥1, i.e. K≥4) that also clears the value-network validator — and
-// that it is NEVER LocalParams (K=3) or any K<4 set. This is the node half of
-// CRITICAL-2 (the consensus half is config.ValidateForValueNetwork, tested in
-// the consensus module).
-func TestSelectConsensusParams_MultiNodeIsBFT(t *testing.T) {
-	local := consensusconfig.LocalParams()
-
-	cases := []struct {
-		name      string
-		networkID uint32
-	}{
-		{"mainnet", constants.MainnetID},
-		{"testnet", constants.TestnetID},
-		{"localnet-multinode", constants.LocalID},
-		{"unittest-multinode", constants.UnitTestID},
-		{"arbitrary-multinode", 424242},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			p := selectConsensusParams(true /* sybilProtection */, tc.networkID)
-
-			// MUST be Byzantine-fault-tolerant: f≥1 ⟹ K≥4.
-			if p.ByzantineFaultTolerance() < 1 {
-				t.Fatalf("multi-node net %q got non-BFT params K=%d f=%d (CRITICAL-2: a single faulty validator forks)",
-					tc.name, p.K, p.ByzantineFaultTolerance())
-			}
-			// MUST NOT be the CFT LocalParams (K=3/α=2) that was the round-1 hole.
-			if p.K == local.K && p.AlphaPreference == local.AlphaPreference && p.K == 3 {
-				t.Fatalf("multi-node net %q selected LocalParams (K=3/α=2) — the CRITICAL-2 fork config", tc.name)
-			}
-			// The selected params MUST themselves pass Valid() (the BFT α-floor:
-			// 2·AlphaPreference − K ≥ f+1).
-			if err := p.Valid(); err != nil {
-				t.Fatalf("multi-node net %q selected params fail Valid(): %v (K=%d α=%d)",
-					tc.name, err, p.K, p.AlphaPreference)
-			}
-		})
-	}
-}
-
-// TestSelectConsensusParams_LocalDevIsSatisfiableBFT proves that an explicitly-
-// local dev network (devnet 3 / localnet 1337) selects the MINIMAL real-BFT set
-// (LocalBFTParams: K=4/α=3, f=1) — satisfiable by a handful of localhost
-// validators — and NOT the large Default (K=20/α=14), whose α=14 quorum is
-// unreachable with 3-4 validators (the freeze-at-height-0 bug). It must still be
-// genuinely BFT (f≥1) and pass the value backstop (K=4 ≥ 4), so production
-// safety / CRITICAL-2 is untouched: a custom VALUE L1 (high networkID) still gets
-// the large Default set, never the local one.
-func TestSelectConsensusParams_LocalDevIsSatisfiableBFT(t *testing.T) {
-	for _, networkID := range []uint32{constants.DevnetID, constants.LocalID} {
-		p := selectConsensusParams(true /* sybilProtection */, networkID)
-
-		// Satisfiable on a small committee: α must be small (K=4 → α=3), NOT 14.
-		if p.K != 4 || p.AlphaPreference != 3 {
-			t.Fatalf("local dev net %d: want minimal-BFT K=4/α=3, got K=%d/α=%d (Default K=20 is unsatisfiable on localhost)",
-				networkID, p.K, p.AlphaPreference)
-		}
-		// Still genuinely BFT (f≥1) — does NOT regress CRITICAL-2.
-		if p.ByzantineFaultTolerance() < 1 {
-			t.Fatalf("local dev net %d: K=%d is not BFT (f=%d)", networkID, p.K, p.ByzantineFaultTolerance())
-		}
-		// Must clear the value backstop the manager asserts before engine start.
-		if err := p.ValidateForValueNetwork(networkID); err != nil {
-			t.Fatalf("local dev net %d: minimal-BFT params must pass the value backstop, got %v", networkID, err)
-		}
-	}
-
-	// A custom value L1 with a high networkID is NOT a local dev network: it must
-	// keep the large Default set (the isLocalDevNetwork predicate is EXACT, not a
-	// >=1337 range that would wrongly catch value L1s).
-	const customValueL1 = uint32(909090)
-	if p := selectConsensusParams(true, customValueL1); p.K != consensusconfig.DefaultParams().K {
-		t.Fatalf("custom value L1 %d must get Default K=%d, got K=%d (must NOT match the local-dev path)",
-			customValueL1, consensusconfig.DefaultParams().K, p.K)
-	}
-}
-
-// TestSelectConsensusParams_SingleNodeIsK1 proves --dev / sybil-disabled selects
-// the K=1 single-validator regime (the sole validator's accept is the 1-of-1
-// quorum) — and NOT a multi-node BFT set.
-func TestSelectConsensusParams_SingleNodeIsK1(t *testing.T) {
-	p := selectConsensusParams(false /* sybilProtection */, constants.LocalID)
-	if p.K != 1 {
-		t.Fatalf("sybil-disabled (single-node) must select K=1, got K=%d", p.K)
-	}
-}
-
-// TestSelectConsensusParams_ValueBackstop proves the params selected for a
-// multi-node net pass the STRICTER value-network validator for that net — the
-// fail-closed backstop asserted at the manager call site before starting the
-// engine. (Mainnet enforces K≥11, so MainnetParams K=21 passes; Default K=20
-// passes for an arbitrary value net.)
-func TestSelectConsensusParams_ValueBackstop(t *testing.T) {
-	cases := []struct {
-		name      string
-		networkID uint32
-	}{
-		{"mainnet", constants.MainnetID},
-		{"arbitrary-value-net", 909090},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			p := selectConsensusParams(true, tc.networkID)
-			if err := p.ValidateForValueNetwork(tc.networkID); err != nil {
-				t.Fatalf("selected params for value net %q must pass the value backstop, got %v (K=%d)",
-					tc.name, err, p.K)
-			}
-		})
-	}
-}

chains/quorum_setroot_test.go

@@ -1,293 +0,0 @@
-// Copyright (C) 2019-2026, Lux Industries, Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-// quorum_setroot_test.go — node-layer tests for MEDIUM-1: the set-root and the
-// ⅔-by-stake tally MUST be read from the HEIGHT-INDEXED validators.State at the
-// cert-position height, so every node computes the IDENTICAL root, weights, and
-// total for a given value-chain height — INDEPENDENT of async current-map skew
-// during a validator-set change.
-//
-// The cross-node test (TestValidatorSetRoot_CrossNodeAgreesDespiteSkew) is the
-// one the red flagged as MISSING: it models two nodes whose CURRENT validator
-// views diverge (a set-change in flight) but who agree on the historical set at a
-// pinned height H — and proves they nonetheless compute the SAME set-root at H.
-// Reading the current map (the prior bug) would have made their roots differ →
-// mismatched canonical signed messages → dropped votes → finality stall.
-package chains
-
-import (
-	"bytes"
-	"context"
-	"crypto/sha256"
-	"encoding/binary"
-	"errors"
-	"sort"
-	"testing"
-
-	"github.com/luxfi/ids"
-	validators "github.com/luxfi/validators"
-	"github.com/luxfi/validators/validatorstest"
-)
-
-// expectedSetRoot is an INDEPENDENT reimplementation of the canonical set-root
-// spec, used only by the golden test to cross-check hashValidatorSet. It is
-// deliberately NOT a call to hashValidatorSet (that would be a tautology): if the
-// production encoding ever diverges from this spec the golden test fails.
-func expectedSetRoot(t *testing.T, vdrs []vdr) ids.ID {
-	t.Helper()
-	sort.Slice(vdrs, func(i, j int) bool {
-		return bytes.Compare(vdrs[i].nodeID[:], vdrs[j].nodeID[:]) < 0
-	})
-	h := sha256.New()
-	var u64 [8]byte
-	for _, v := range vdrs {
-		h.Write(v.nodeID[:])
-		binary.BigEndian.PutUint64(u64[:], v.light)
-		h.Write(u64[:])
-		binary.BigEndian.PutUint64(u64[:], uint64(len(v.pk)))
-		h.Write(u64[:])
-		h.Write(v.pk)
-	}
-	var root ids.ID
-	copy(root[:], h.Sum(nil))
-	return root
-}
-
-// vdr is a tiny height→set fixture: which validators (and weights/keys) the
-// height-indexed state reports at each value-chain height.
-type vdr struct {
-	nodeID ids.NodeID
-	pk     []byte
-	light  uint64
-}
-
-// stateWithHistory builds a validators.State whose GetValidatorSet returns the
-// set registered for the requested height (and an empty set for unknown heights),
-// scoped to netID. This is the height-indexed source MEDIUM-1 reads from.
-func stateWithHistory(netID ids.ID, byHeight map[uint64][]vdr) *validatorstest.TestState {
-	s := validatorstest.NewTestState()
-	s.GetValidatorSetF = func(_ context.Context, height uint64, gotNet ids.ID) (map[ids.NodeID]*validators.GetValidatorOutput, error) {
-		if gotNet != netID {
-			return map[ids.NodeID]*validators.GetValidatorOutput{}, nil
-		}
-		out := make(map[ids.NodeID]*validators.GetValidatorOutput)
-		for _, v := range byHeight[height] {
-			out[v.nodeID] = &validators.GetValidatorOutput{
-				NodeID:    v.nodeID,
-				PublicKey: v.pk,
-				Light:     v.light,
-				Weight:    v.light,
-			}
-		}
-		return out, nil
-	}
-	return s
-}
-
-// TestValidatorSetRoot_CrossNodeAgreesDespiteSkew is the MEDIUM-1 regression
-// guard. Two nodes are mid validator-set change: their CURRENT sets differ
-// (height 11 vs height 12), but both still serve the SAME committed set at the
-// value-chain block height H=10 being voted on. The set-root at H MUST be
-// identical on both nodes — that identity is what makes their signatures over the
-// block's canonical message mutually verifiable. The prior current-map read would
-// have produced two different roots here and stalled finality.
-func TestValidatorSetRoot_CrossNodeAgreesDespiteSkew(t *testing.T) {
-	netID := ids.GenerateTestID()
-	n0, n1, n2, n3 := ids.GenerateTestNodeID(), ids.GenerateTestNodeID(), ids.GenerateTestNodeID(), ids.GenerateTestNodeID()
-	pk0, pk1, pk2, pk3 := []byte("pk-0-48bytes-placeholder"), []byte("pk-1"), []byte("pk-2"), []byte("pk-3")
-
-	const H = uint64(10)
-	setAtH := []vdr{{n0, pk0, 10}, {n1, pk1, 20}, {n2, pk2, 30}}
-
-	// Node A has already applied a stake bump that took effect at height 11
-	// (n1: 20→25) and sees that as its current set. It still knows the height-10
-	// set (the block being voted on).
-	nodeA := stateWithHistory(netID, map[uint64][]vdr{
-		H:  setAtH,
-		11: {{n0, pk0, 10}, {n1, pk1, 25}, {n2, pk2, 30}},
-	})
-	// Node B has already applied a NEW validator that joined at height 12
-	// (n3 added) — a different, later current set. It too still knows height 10.
-	nodeB := stateWithHistory(netID, map[uint64][]vdr{
-		H:  setAtH,
-		12: {{n0, pk0, 10}, {n1, pk1, 25}, {n2, pk2, 30}, {n3, pk3, 5}},
-	})
-
-	rootA := newValidatorSetRootSource(nodeA, netID).ValidatorSetRoot(H)
-	rootB := newValidatorSetRootSource(nodeB, netID).ValidatorSetRoot(H)
-
-	if rootA == ids.Empty {
-		t.Fatal("set-root at the voted height must be non-Empty (the set is non-empty)")
-	}
-	if rootA != rootB {
-		t.Fatalf("MEDIUM-1: cross-node set-root at height %d MUST be identical despite "+
-			"current-set skew, got A=%s B=%s", H, rootA, rootB)
-	}
-
-	// Sanity: had either node (wrongly) committed to its CURRENT set instead of
-	// the height-H set, the roots WOULD differ — proving the test actually
-	// exercises the skew (not a vacuous match).
-	rootA_cur := newValidatorSetRootSource(nodeA, netID).ValidatorSetRoot(11)
-	rootB_cur := newValidatorSetRootSource(nodeB, netID).ValidatorSetRoot(12)
-	if rootA_cur == rootB_cur {
-		t.Fatal("test is vacuous: the two nodes' CURRENT sets must differ to exercise the skew")
-	}
-	if rootA == rootA_cur {
-		t.Fatal("test is vacuous: height-H set must differ from node A's current set")
-	}
-}
-
-// TestValidatorSetRoot_HeightSelectsEpoch proves the root is a deterministic
-// FUNCTION OF HEIGHT (not a fixed current-set snapshot): different heights with
-// different sets yield different roots, the same height always yields the same
-// root, and the encoding is insertion-order independent (canonical sort).
-func TestValidatorSetRoot_HeightSelectsEpoch(t *testing.T) {
-	netID := ids.GenerateTestID()
-	n0, n1, n2 := ids.GenerateTestNodeID(), ids.GenerateTestNodeID(), ids.GenerateTestNodeID()
-	pk0, pk1, pk2 := []byte("pk-0-48bytes-placeholder"), []byte("pk-1"), []byte("pk-2")
-
-	state := stateWithHistory(netID, map[uint64][]vdr{
-		10: {{n0, pk0, 10}, {n1, pk1, 20}, {n2, pk2, 30}},
-		11: {{n0, pk0, 10}, {n1, pk1, 21}, {n2, pk2, 30}}, // n1 weight changed
-	})
-	src := newValidatorSetRootSource(state, netID)
-
-	root10 := src.ValidatorSetRoot(10)
-	root11 := src.ValidatorSetRoot(11)
-	if root10 == ids.Empty || root11 == ids.Empty {
-		t.Fatal("non-empty sets must commit to non-Empty roots")
-	}
-	if root10 == root11 {
-		t.Fatal("a different epoch (height with a changed weight) MUST yield a different root")
-	}
-	// Same height is stable (deterministic), repeatedly.
-	if again := src.ValidatorSetRoot(10); again != root10 {
-		t.Fatalf("set-root at a fixed height must be deterministic: %s != %s", again, root10)
-	}
-
-	// Insertion-order independence: a state that lists the SAME height-10 members
-	// in a different slice order yields the SAME root (canonical NodeID sort).
-	reordered := stateWithHistory(netID, map[uint64][]vdr{
-		10: {{n2, pk2, 30}, {n0, pk0, 10}, {n1, pk1, 20}},
-	})
-	if r := newValidatorSetRootSource(reordered, netID).ValidatorSetRoot(10); r != root10 {
-		t.Fatalf("set-root must be member-order independent: %s != %s", r, root10)
-	}
-}
-
-// TestValidatorSetRoot_FailSoftIsUniform proves the fail-soft answers are
-// Empty/uniform (never a panic, never a per-node-divergent default): a nil state,
-// an unknown height (empty set), an unknown network, and a height-read error all
-// commit to ids.Empty. Uniformity is the safety property — a symmetric error
-// degrades every node to the same Empty root, never to disagreeing roots.
-func TestValidatorSetRoot_FailSoftIsUniform(t *testing.T) {
-	netID := ids.GenerateTestID()
-
-	// nil state → Empty.
-	if got := (&validatorSetRootSource{state: nil, networkID: netID}).ValidatorSetRoot(10); got != ids.Empty {
-		t.Fatalf("nil state must commit to ids.Empty, got %s", got)
-	}
-
-	// Known network, but a height with no registered set → Empty.
-	state := stateWithHistory(netID, map[uint64][]vdr{
-		10: {{ids.GenerateTestNodeID(), []byte("pk"), 10}},
-	})
-	if got := newValidatorSetRootSource(state, netID).ValidatorSetRoot(999); got != ids.Empty {
-		t.Fatalf("unknown height must commit to ids.Empty, got %s", got)
-	}
-
-	// Wrong network → empty set → Empty.
-	if got := newValidatorSetRootSource(state, ids.GenerateTestID()).ValidatorSetRoot(10); got != ids.Empty {
-		t.Fatalf("unknown network must commit to ids.Empty, got %s", got)
-	}
-
-	// A height-read ERROR → Empty (and it is symmetric: the same error on every
-	// node yields the same Empty root).
-	errState := validatorstest.NewTestState()
-	errState.GetValidatorSetF = func(_ context.Context, _ uint64, _ ids.ID) (map[ids.NodeID]*validators.GetValidatorOutput, error) {
-		return nil, errors.New("state unavailable at height")
-	}
-	if got := newValidatorSetRootSource(errState, netID).ValidatorSetRoot(10); got != ids.Empty {
-		t.Fatalf("a height-read error must commit to ids.Empty, got %s", got)
-	}
-}
-
-// TestValidatorStakeSource_HeightPinned proves the ⅔-by-stake tally is read at
-// the SAME height as the set-root (MEDIUM-1's second skew): Weight/TotalStake are
-// a deterministic function of height, so a validator whose vote is in a
-// height-H cert contributes its height-H weight — not whatever the current map
-// happens to hold after a membership change. This is what stops a current-map
-// weight read from dropping a legitimately-signed quorum.
-func TestValidatorStakeSource_HeightPinned(t *testing.T) {
-	netID := ids.GenerateTestID()
-	n0, n1, n2 := ids.GenerateTestNodeID(), ids.GenerateTestNodeID(), ids.GenerateTestNodeID()
-
-	state := stateWithHistory(netID, map[uint64][]vdr{
-		10: {{n0, []byte("pk0"), 70}, {n1, []byte("pk1"), 30}},                       // total 100
-		11: {{n0, []byte("pk0"), 70}, {n1, []byte("pk1"), 30}, {n2, []byte("pk2"), 50}}, // total 150
-	})
-	src := newValidatorStakeSource(state, netID)
-
-	// At height 10 the tally is the height-10 epoch.
-	if w := src.Weight(n0, 10); w != 70 {
-		t.Fatalf("Weight(n0, h=10) = %d, want 70", w)
-	}
-	if total := src.TotalStake(10); total != 100 {
-		t.Fatalf("TotalStake(h=10) = %d, want 100", total)
-	}
-	// n2 is NOT in the height-10 set → 0 at h=10, but 50 at h=11. The tally is
-	// height-pinned, not current-map.
-	if w := src.Weight(n2, 10); w != 0 {
-		t.Fatalf("Weight(n2, h=10) = %d, want 0 (n2 joined at h=11)", w)
-	}
-	if w := src.Weight(n2, 11); w != 50 {
-		t.Fatalf("Weight(n2, h=11) = %d, want 50", w)
-	}
-	if total := src.TotalStake(11); total != 150 {
-		t.Fatalf("TotalStake(h=11) = %d, want 150", total)
-	}
-
-	// Unknown node at a known height → 0 (cannot inflate the numerator).
-	if w := src.Weight(ids.GenerateTestNodeID(), 10); w != 0 {
-		t.Fatalf("Weight(unknown, h=10) = %d, want 0", w)
-	}
-	// nil state → fail-soft zeros.
-	nilSrc := &validatorStakeSource{state: nil, networkID: netID}
-	if nilSrc.Weight(n0, 10) != 0 || nilSrc.TotalStake(10) != 0 {
-		t.Fatal("nil state must yield zero weight and total")
-	}
-}
-
-// TestHashValidatorSet_ByteStability is a GOLDEN test pinning the canonical
-// set-root encoding so the wire format cannot drift (the engine's epoch-binding
-// contract and any persisted/gossiped cert depend on this exact byte layout). If
-// this value changes, the set-root encoding changed and every node in the
-// network must upgrade in lockstep — it is a CONSENSUS-BREAKING change.
-func TestHashValidatorSet_ByteStability(t *testing.T) {
-	// Fixed (non-random) NodeIDs so the golden is reproducible.
-	var a, b ids.NodeID
-	a[0], b[0] = 0x01, 0x02
-	set := map[ids.NodeID]*validators.GetValidatorOutput{
-		a: {NodeID: a, PublicKey: []byte{0xaa, 0xbb}, Light: 10},
-		b: {NodeID: b, PublicKey: []byte{0xcc}, Light: 20},
-	}
-	got := hashValidatorSet(set)
-
-	// Independently recompute the expected commitment from the canonical spec:
-	// sorted-by-NodeID, each nodeID || light(8,BE) || len(pk)(8,BE) || pk, SHA-256.
-	want := expectedSetRoot(t, []vdr{
-		{a, []byte{0xaa, 0xbb}, 10},
-		{b, []byte{0xcc}, 20},
-	})
-	if got != want {
-		t.Fatalf("set-root encoding drifted (CONSENSUS-BREAKING):\n got  %s\n want %s", got, want)
-	}
-
-	// Empty/nil set → ids.Empty.
-	if hashValidatorSet(nil) != ids.Empty {
-		t.Fatal("nil set must commit to ids.Empty")
-	}
-	if hashValidatorSet(map[ids.NodeID]*validators.GetValidatorOutput{}) != ids.Empty {
-		t.Fatal("empty set must commit to ids.Empty")
-	}
-}

chains/quorum_verifier_height_test.go

@@ -1,165 +0,0 @@
-// Copyright (C) 2019-2026, Lux Industries, Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-// quorum_verifier_height_test.go — node-layer regression for RESIDUAL-B and the
-// CRITICAL-1 wiring: the BLS vote verifier resolves the voter's public key from
-// the HEIGHT-INDEXED validators.State AT THE BLOCK'S P-CHAIN EPOCH HEIGHT — the
-// SAME height-pinned source as the set-root and the ⅔-by-stake tally — NOT from
-// the current validator map.
-//
-// The round-1 fix left the verifier reading the CURRENT map (m.Validators):
-// a validator present in set@H (it legitimately signed block H) but already gone
-// from the current map during async staking skew had its vote DROPPED, and if it
-// held >⅓ of the stake-at-H the block never finalized. These tests prove the
-// verifier now reads set@H, so such a vote verifies at H (and a vote keyed to the
-// wrong height does not).
-package chains
-
-import (
-	"context"
-	"testing"
-
-	"github.com/luxfi/consensus/engine/chain"
-	"github.com/luxfi/crypto/bls"
-	"github.com/luxfi/ids"
-	validators "github.com/luxfi/validators"
-	"github.com/luxfi/validators/validatorstest"
-)
-
-// blsKey is a test validator's BLS key material.
-type blsKey struct {
-	nodeID ids.NodeID
-	sk     *bls.SecretKey
-	pkComp []byte
-}
-
-func newBLSKey(t *testing.T) blsKey {
-	t.Helper()
-	sk, err := bls.NewSecretKey()
-	if err != nil {
-		t.Fatalf("NewSecretKey: %v", err)
-	}
-	return blsKey{
-		nodeID: ids.GenerateTestNodeID(),
-		sk:     sk,
-		pkComp: bls.PublicKeyToCompressedBytes(sk.PublicKey()),
-	}
-}
-
-// stateWithBLSByHeight builds a height-indexed validators.State that reports the
-// given BLS validators at each height (empty for unknown heights / wrong net).
-func stateWithBLSByHeight(netID ids.ID, byHeight map[uint64][]blsKey) *validatorstest.TestState {
-	s := validatorstest.NewTestState()
-	s.GetValidatorSetF = func(_ context.Context, height uint64, gotNet ids.ID) (map[ids.NodeID]*validators.GetValidatorOutput, error) {
-		if gotNet != netID {
-			return map[ids.NodeID]*validators.GetValidatorOutput{}, nil
-		}
-		out := make(map[ids.NodeID]*validators.GetValidatorOutput)
-		for _, k := range byHeight[height] {
-			out[k.nodeID] = &validators.GetValidatorOutput{
-				NodeID:    k.nodeID,
-				PublicKey: k.pkComp,
-				Light:     1,
-				Weight:    1,
-			}
-		}
-		return out, nil
-	}
-	return s
-}
-
-// TestBLSVoteVerifier_ResolvesPubkeyAtEpochHeight is the RESIDUAL-B core: a
-// validator that is in set@H but has LEFT the set at a later height still has its
-// vote verified at H (the verifier reads set@H, not the current map).
-func TestBLSVoteVerifier_ResolvesPubkeyAtEpochHeight(t *testing.T) {
-	netID := ids.GenerateTestID()
-	keep := newBLSKey(t) // stays in the set across epochs
-	leaver := newBLSKey(t) // in set@10, GONE from set@11 (departed the current set)
-
-	const H = uint64(10)
-	state := stateWithBLSByHeight(netID, map[uint64][]blsKey{
-		10: {keep, leaver},
-		11: {keep}, // leaver has departed by height 11 (the "current" epoch)
-	})
-
-	v := newBLSVoteVerifier(state, netID)
-
-	// The leaver signs a message; its vote MUST verify at epoch H=10 (it was a
-	// member then), proving pubkey resolution is at the epoch, not the current set.
-	msg := []byte("LUX/chain/vote/v1\x00 — epoch-pinned verify")
-	sig, err := leaver.sk.Sign(msg)
-	if err != nil {
-		t.Fatalf("sign: %v", err)
-	}
-	sigBytes := bls.SignatureToBytes(sig)
-
-	if !v.VerifyVote(leaver.nodeID, msg, sigBytes, H) {
-		t.Fatal("RESIDUAL-B: a validator in set@H must verify at H even after leaving the current set " +
-			"(verifier read the current map instead of set@H)")
-	}
-
-	// At height 11 the leaver is NOT a member → its vote MUST NOT verify there.
-	// This proves the resolution is genuinely height-pinned (not height-agnostic).
-	if v.VerifyVote(leaver.nodeID, msg, sigBytes, 11) {
-		t.Fatal("a validator absent from set@11 must NOT verify at 11 (height pinning is not in effect)")
-	}
-
-	// The keeper verifies at both heights (it is in both sets) — sanity that the
-	// epoch read is not rejecting valid current members.
-	keepSig, _ := keep.sk.Sign(msg)
-	keepBytes := bls.SignatureToBytes(keepSig)
-	if !v.VerifyVote(keep.nodeID, msg, keepBytes, 10) || !v.VerifyVote(keep.nodeID, msg, keepBytes, 11) {
-		t.Fatal("a validator present at both epochs must verify at both")
-	}
-}
-
-// TestBLSVoteVerifier_FailClosed proves the verifier never panics and returns
-// false for every fail-soft case: nil state, unknown voter at the epoch, wrong
-// network, an unknown height (empty set), a wrong-length signature, and the
-// HIGH-1 malformed-infinity signature (0x40||zeros) that used to PANIC the purego
-// BLS path — here it must be a clean false, not a crash.
-func TestBLSVoteVerifier_FailClosed(t *testing.T) {
-	netID := ids.GenerateTestID()
-	k := newBLSKey(t)
-	state := stateWithBLSByHeight(netID, map[uint64][]blsKey{10: {k}})
-	msg := []byte("msg")
-	sig, _ := k.sk.Sign(msg)
-	good := bls.SignatureToBytes(sig)
-
-	// nil state → false for any voter.
-	if newBLSVoteVerifier(nil, netID).VerifyVote(k.nodeID, msg, good, 10) {
-		t.Fatal("nil state must yield false")
-	}
-	v := newBLSVoteVerifier(state, netID)
-	// unknown voter at a known epoch.
-	if v.VerifyVote(ids.GenerateTestNodeID(), msg, good, 10) {
-		t.Fatal("unknown voter at the epoch must yield false")
-	}
-	// known voter at an UNKNOWN epoch (empty set) → false.
-	if v.VerifyVote(k.nodeID, msg, good, 999) {
-		t.Fatal("known voter at an unknown epoch (empty set) must yield false")
-	}
-	// wrong network → empty set → false.
-	if newBLSVoteVerifier(state, ids.GenerateTestID()).VerifyVote(k.nodeID, msg, good, 10) {
-		t.Fatal("wrong network must yield false")
-	}
-	// wrong-length signature → false (no panic).
-	if v.VerifyVote(k.nodeID, msg, good[:len(good)-1], 10) {
-		t.Fatal("wrong-length signature must yield false")
-	}
-	// HIGH-1 malformed infinity sig (0x40||zeros) → clean false, NOT a panic.
-	mal := make([]byte, bls.SignatureLen)
-	mal[0] = 0x40
-	if v.VerifyVote(k.nodeID, msg, mal, 10) {
-		t.Fatal("malformed-infinity signature must yield false")
-	}
-	// A WRONG signature (valid form, wrong key) → false.
-	other := newBLSKey(t)
-	otherSig, _ := other.sk.Sign(msg)
-	if v.VerifyVote(k.nodeID, msg, bls.SignatureToBytes(otherSig), 10) {
-		t.Fatal("a signature by a different key must yield false")
-	}
-}
-
-// ensure the node verifier still satisfies the (now height-aware) engine interface.
-var _ chain.VoteVerifier = (*blsVoteVerifier)(nil)

chains/red_pendingcontext_dos_test.go

@@ -1,102 +0,0 @@
-// Copyright (C) 2019-2026, Lux Industries, Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-// red_pendingcontext_dos_test.go — regression guard for the catch-up DoS RED found
-// on the cert-carrying catch-up branch.
-//
-// The frontier-sync wiring connects the AcceptedFrontier handler to
-// requestContext(), which records each requested blockID in b.pendingContext.
-// Originally NOTHING evicted from that map, so a Byzantine peer streaming
-// AcceptedFrontier frames each naming a distinct random tip grew it without bound
-// → OOM (and a peer that took a request then withheld Context re-stranded the
-// victim forever). requestContext now reaps entries past pendingContextTTL and
-// hard-caps the map at maxPendingContext. These tests pin both properties; before
-// the fix the first asserted N=50_000 entries with ZERO eviction.
-package chains
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/luxfi/ids"
-	"github.com/luxfi/log"
-	"github.com/luxfi/math/set"
-	"github.com/luxfi/node/message"
-	"github.com/luxfi/node/network"
-	"github.com/luxfi/node/proto/p2p"
-)
-
-// redStubNet implements the one Network method requestContext uses (Send); every
-// other method is inherited from the embedded nil interface and is never called.
-type redStubNet struct {
-	network.Network
-	sends int
-}
-
-func (s *redStubNet) Send(_ message.OutboundMessage, nodeIDs set.Set[ids.NodeID], _ ids.ID, _ uint32) set.Set[ids.NodeID] {
-	s.sends++
-	return nodeIDs
-}
-
-// redStubMsg implements the one OutboundMsgBuilder method requestContext uses.
-type redStubMsg struct {
-	message.OutboundMsgBuilder
-}
-
-func (redStubMsg) GetAncestors(_ ids.ID, _ uint32, _ time.Duration, _ ids.ID, _ p2p.EngineType) (message.OutboundMessage, error) {
-	return nil, nil
-}
-
-func newRedTestHandler(net network.Network) *blockHandler {
-	return &blockHandler{
-		logger:         log.NewNoOpLogger(),
-		net:            net,
-		msgCreator:     redStubMsg{},
-		chainID:        ids.GenerateTestID(),
-		pendingContext: make(map[ids.ID]contextRequest),
-	}
-}
-
-// TestPendingContext_BoundedUnderFlood: a peer streaming distinct fake tips into
-// requestContext can NEVER grow pendingContext past maxPendingContext. Inverts the
-// original RED PoC, which asserted unbounded growth to 50_000 → OOM.
-func TestPendingContext_BoundedUnderFlood(t *testing.T) {
-	stubNet := &redStubNet{}
-	bh := newRedTestHandler(stubNet)
-
-	const N = 10_000 // ≫ the maxPendingContext cap — enough to prove "stays bounded"
-	from := ids.GenerateTestNodeID()
-	for i := 0; i < N; i++ {
-		bh.requestContext(context.Background(), from, ids.GenerateTestID())
-	}
-
-	if got := len(bh.pendingContext); got > maxPendingContext {
-		t.Fatalf("pendingContext unbounded: %d entries exceeds cap %d (the RED HIGH DoS)", got, maxPendingContext)
-	}
-	t.Logf("bounded: %d entries after a %d-distinct-tip flood (cap %d, sends=%d)",
-		len(bh.pendingContext), N, maxPendingContext, stubNet.sends)
-}
-
-// TestPendingContext_StaleEntriesReaped: a request whose Context is withheld past
-// its TTL is reaped on the next requestContext, so the block is re-requestable from
-// an honest peer (fixes the RED MEDIUM re-strand).
-func TestPendingContext_StaleEntriesReaped(t *testing.T) {
-	bh := newRedTestHandler(&redStubNet{})
-	from := ids.GenerateTestNodeID()
-
-	stale := ids.GenerateTestID()
-	bh.pendingContext[stale] = contextRequest{
-		nodeID:    from,
-		requestID: 1,
-		blockID:   stale,
-		timestamp: time.Now().Add(-2 * pendingContextTTL),
-	}
-
-	// Any later request runs the reaper before recording its own entry.
-	bh.requestContext(context.Background(), from, ids.GenerateTestID())
-
-	if _, stillThere := bh.pendingContext[stale]; stillThere {
-		t.Fatalf("stale pendingContext entry (%v old) not reaped → re-strand persists", 2*pendingContextTTL)
-	}
-}

chains/zz_red_probe_test.go

@@ -1,172 +0,0 @@
-// Copyright (C) 2019-2026, Lux Industries, Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-// zz_red_probe_test.go — RED adversarial security-regression probe for the fresh-net self-vote
-// caught-up path. Demonstrates the connected-vs-replied divergence: the fix gates the self-vote
-// on fullyConnectedBeacons (CONNECTIVITY, from net.PeerInfo) but tallies CaughtUp over `replies`
-// (from collectFrontierReplies). A beacon that is CONNECTED but does NOT answer the frontier
-// query this round counts as "fully connected" yet contributes nothing to the caught-up tally —
-// and the self-vote backfills its missing weight, so a HEAVY validator self-completes caught-up
-// at a STALE height while an honest connected beacon is genuinely ahead. Blue's bsBeaconNet
-// cannot express this (its Send answers for EVERY connected beacon), so the regression slipped
-// through. These assertions encode the DESIRED safe behavior: they FAIL on the current code (the
-// break) and will PASS once the self-vote gate also requires every connected beacon to have
-// REPLIED this round.
-package chains
-
-import (
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	chainbootstrap "github.com/luxfi/consensus/engine/chain/bootstrap"
-	"github.com/luxfi/ids"
-	"github.com/luxfi/math/set"
-	"github.com/luxfi/node/message"
-	"github.com/luxfi/node/network"
-	"github.com/luxfi/node/network/peer"
-)
-
-// redSilentNet reports FULL connectivity (every beacon in `connected` is returned by PeerInfo)
-// but a designated `silent` beacon — though connected — withholds its GetAcceptedFrontier reply
-// this round. This is the exact capability an on-path adversary has (keep a beacon's
-// TCP/handshake alive so it shows connected, while dropping/delaying its application-level
-// frontier response past the 3s window) AND a natural occurrence during a mass co-restart (an
-// ahead beacon replaying state answers the frontier query slowly).
-type redSilentNet struct {
-	network.Network
-	bh        *blockHandler
-	connected []ids.NodeID          // all reported connected (the full set MINUS self)
-	silent    set.Set[ids.NodeID]   // connected but withhold their frontier reply
-	tipFor    map[ids.NodeID]ids.ID // what each VOCAL beacon reports
-}
-
-func (n *redSilentNet) PeerInfo(nodeIDs []ids.NodeID) []peer.Info {
-	want := map[ids.NodeID]bool{}
-	for _, id := range nodeIDs {
-		want[id] = true
-	}
-	var out []peer.Info
-	for _, b := range n.connected {
-		if len(nodeIDs) == 0 || want[b] {
-			out = append(out, peer.Info{ID: b, TrackedChains: set.Of(n.bh.networkID)})
-		}
-	}
-	return out
-}
-
-func (n *redSilentNet) Send(msg message.OutboundMessage, nodeIDs set.Set[ids.NodeID], _ ids.ID, _ uint32) set.Set[ids.NodeID] {
-	m, ok := msg.(*bsOutMsg)
-	if !ok || m.op != "frontier" {
-		return nil
-	}
-	for id := range nodeIDs {
-		if n.silent.Contains(id) {
-			continue // CONNECTED, but withholds its frontier reply this round
-		}
-		if tip, ok := n.tipFor[id]; ok {
-			n.bh.deliverBootstrapFrontier(id, tip)
-		}
-	}
-	return nil
-}
-
-// TestRED_PROBE_ConnectedButSilentAheadBeacon_SelfVoteFalseCompletesAtStale is a TWO-SIDED
-// CONTRAST: the ONLY difference between the two runs is whether the CONNECTED ahead-beacon B
-// delivers its frontier reply. B is fully connected in both runs, so fullyConnectedBeacons is
-// TRUE in both. Yet B-replies → safe (status != FrontierCaughtUp); B-connected-but-silent →
-// FrontierCaughtUp at the stale height (the break). This falsifies Blue's safety claim ("a
-// genuinely behind node has an ahead peer in the full set → CaughtUp is false → it keeps
-// waiting/syncing"): the gate keys on CONNECTIVITY while the caught-up decision keys on REPLIES,
-// and the two diverge.
-//
-// Why K is genuinely finalized-ahead (a real safety break, not a minority fork): a heavy
-// validator (self=60%) finalizes K WITH a minority (B=33%, so self+B=93% ≥ ⅔), then LOSES K to a
-// persistence lag (this codebase documents exactly this — the ZAP fire-and-forget Accept /
-// bsTestVM.frozenLastAccepted) and restarts STALE at M < K. B retained the finalized K. The node
-// MUST recover K; self-completing at M abandons finalized history and lets it build a conflicting
-// fork. The node cannot tell "M is the frontier" from "I lost finalized K" — which is precisely
-// why it must HEAR from connected B before concluding caught-up. self is NOT an independent
-// witness to its own caught-up-ness; the self-vote lets the node vouch for its own staleness.
-func TestRED_PROBE_ConnectedButSilentAheadBeacon_SelfVoteFalseCompletesAtStale(t *testing.T) {
-	const N = 10 // K: the finalized-ahead height B retained (self voted it, then lost it)
-	const M = 5  // the node's STALE accepted height after the persistence-lag crash
-
-	run := func(t *testing.T, bSilent bool) chainbootstrap.FrontierStatus {
-		chain, _ := buildBSChain(N, -1)
-		vm := newBSVMAt(chain, M) // node stale at M; it does NOT hold chain[N]=K
-
-		self := ids.GenerateTestNodeID()
-		a := ids.GenerateTestNodeID() // co-stale light beacon, at M
-		b := ids.GenerateTestNodeID() // AHEAD beacon, retained finalized K
-		// HEAVY self (60 of 100): self > total/2 - 1, so peers alone (40) < the 51 stake-majority
-		// floor → the self-vote branch. self+B=93% could finalize K; B=33% retains it.
-		weights := map[ids.NodeID]uint64{self: 60, a: 7, b: 33}
-
-		bh, _ := newBSHandlerWeighted(t, vm, weights)
-		bh.selfNodeID = self
-		bh.msgCreator = bsMsgBuilder{}
-
-		// FULL connectivity in BOTH runs: A and B are connected (B is in `connected` either way).
-		tipFor := map[ids.NodeID]ids.ID{a: chain[M].id} // A reports the stale tip M
-		silent := set.NewSet[ids.NodeID](1)
-		if bSilent {
-			silent.Add(b) // B connected but withholds its frontier reply this round
-		} else {
-			tipFor[b] = chain[N].id // B replies its genuine ahead tip K
-		}
-		bh.net = &redSilentNet{bh: bh, connected: []ids.NodeID{a, b}, silent: silent, tipFor: tipFor}
-
-		bh.bsActive.Store(true)
-		_, status := bh.FrontierTip(context.Background())
-		bh.bsActive.Store(false)
-		return status
-	}
-
-	bReplies := run(t, false)
-	bSilent := run(t, true)
-	t.Logf("B replies its ahead tip → status=%v (3=FrontierConnecting, safe)", bReplies)
-	t.Logf("B connected but SILENT  → status=%v (5=FrontierCaughtUp, the BREAK)", bSilent)
-
-	// Sanity: when the ahead beacon REPLIES, the node correctly fails safe (does not conclude caught-up).
-	require.NotEqual(t, chainbootstrap.FrontierCaughtUp, bReplies,
-		"sanity: when the ahead beacon REPLIES, the node correctly does NOT conclude caught-up")
-
-	// THE SECURITY REGRESSION ASSERTION. B is fully CONNECTED in both runs. The node must NOT
-	// self-complete caught-up while a connected beacon's position is unknown — that is a stale
-	// go-live. FAILS today (the break); PASSES once the self-vote gate also requires every connected
-	// beacon to have REPLIED this round (not merely be connected).
-	require.NotEqual(t, chainbootstrap.FrontierCaughtUp, bSilent,
-		"BREAK: suppressing only the CONNECTED ahead-beacon's frontier reply flips the heavy node to "+
-			"FrontierCaughtUp at the STALE height — the self-vote backfills the floor and the "+
-			"full-connectivity gate cannot see the reply suppression")
-}
-
-// TestRED_PROBE_EqualStakeNeedsNoSelfVote answers deploy-question #5: 5 EQUAL-stake beacons, node
-// a beacon, all four peers connected and reporting a common tip — the node concludes caught-up via
-// the ORDINARY AcceptsFrontier path (peers clear the stake-majority floor: 4·w of 5·w = 80% >
-// 50%). The self-vote is NEVER needed for equal stake, so the equal-stake devnet hang is NOT this
-// self-exclusion floor (look at primaryNetworkReady / P-chain bootstrap / beacon connectivity).
-func TestRED_PROBE_EqualStakeNeedsNoSelfVote(t *testing.T) {
-	chain, byID := buildBSChain(8, -1)
-	vm := newBSVM(chain) // node at genesis (height 0)
-
-	self := ids.GenerateTestNodeID()
-	p1, p2, p3, p4 := ids.GenerateTestNodeID(), ids.GenerateTestNodeID(), ids.GenerateTestNodeID(), ids.GenerateTestNodeID()
-	weights := map[ids.NodeID]uint64{self: 100, p1: 100, p2: 100, p3: 100, p4: 100}
-
-	bh, chainID := newBSHandlerWeighted(t, vm, weights)
-	bh.selfNodeID = self
-	bh.msgCreator = bsMsgBuilder{}
-	bh.net = &bsBeaconNet{bh: bh, chainID: chainID, connected: []ids.NodeID{p1, p2, p3, p4}, byID: byID, tip: chain[0]}
-
-	bh.bsActive.Store(true)
-	tip, status := bh.FrontierTip(context.Background())
-	bh.bsActive.Store(false)
-
-	t.Logf("equal-stake fresh net: status=%v tip=%v", status, tip)
-	require.Contains(t, []chainbootstrap.FrontierStatus{chainbootstrap.FrontierNamed, chainbootstrap.FrontierCaughtUp}, status,
-		"equal-stake peers clear the stake-majority floor unaided — no self-vote needed")
-	require.Equal(t, chain[0].id, tip, "caught up at genesis")
-}

cmd/pqkeygen/main.go

@@ -1,63 +0,0 @@
-// pqkeygen provisions the strict-PQ staking keypairs a local luxd needs:
-// ML-DSA-65 (FIPS 204) staking key + ML-KEM-768 (FIPS 203) handshake key.
-// Writes PEM blocks with the exact types the node's config loader expects.
-package main
-
-import (
-	"bytes"
-	"crypto/rand"
-	"encoding/pem"
-	"fmt"
-	"os"
-	"path/filepath"
-
-	"github.com/luxfi/crypto/mldsa"
-	"github.com/luxfi/crypto/mlkem"
-)
-
-func writePEM(path, typ string, der []byte) error {
-	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
-		return err
-	}
-	var b bytes.Buffer
-	if err := pem.Encode(&b, &pem.Block{Type: typ, Bytes: der}); err != nil {
-		return err
-	}
-	return os.WriteFile(path, b.Bytes(), 0o600)
-}
-
-func main() {
-	if len(os.Args) != 2 {
-		fmt.Fprintln(os.Stderr, "usage: pqkeygen <staking-dir>")
-		os.Exit(1)
-	}
-	dir := os.Args[1]
-
-	// ML-DSA-65 staking key
-	dsaPriv, err := mldsa.GenerateKey(rand.Reader, mldsa.MLDSA65)
-	if err != nil {
-		panic(err)
-	}
-	dsaPub := dsaPriv.PublicKey.Bytes()
-	if err := writePEM(filepath.Join(dir, "mldsa.key"), "ML-DSA-65 PRIVATE KEY", dsaPriv.Bytes()); err != nil {
-		panic(err)
-	}
-	if err := writePEM(filepath.Join(dir, "mldsa.pub"), "ML-DSA-65 PUBLIC KEY", dsaPub); err != nil {
-		panic(err)
-	}
-
-	// ML-KEM-768 handshake key
-	kemPub, kemPriv, err := mlkem.GenerateKeyPair(rand.Reader, mlkem.MLKEM768)
-	if err != nil {
-		panic(err)
-	}
-	if err := writePEM(filepath.Join(dir, "mlkem.key"), "ML-KEM-768 PRIVATE KEY", kemPriv.Bytes()); err != nil {
-		panic(err)
-	}
-	if err := writePEM(filepath.Join(dir, "mlkem.pub"), "ML-KEM-768 PUBLIC KEY", kemPub.Bytes()); err != nil {
-		panic(err)
-	}
-
-	fmt.Printf("ML-DSA-65 priv=%dB pub=%dB; ML-KEM-768 priv=%dB pub=%dB written to %s\n",
-		len(dsaPriv.Bytes()), len(dsaPub), len(kemPriv.Bytes()), len(kemPub.Bytes()), dir)
-}

cmd/repair-proposervm/main.go

@@ -1,352 +0,0 @@
-// Copyright (C) 2019-2026, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-// Command repair-proposervm is a ONE-TIME, fail-closed surgical tool to reconcile
-// a proposervm chain-state DB onto a known-canonical outer block at a single height.
-//
-// Motivation (incident 1082814, Lux mainnet C-Chain): a sub-quorum proposervm
-// envelope A (3-of-5 ACCEPT) was locally accepted on some nodes while the network
-// finalized the supermajority sibling B (4-of-5) that wraps the IDENTICAL inner EVM
-// block. The two siblings differ ONLY in the proposervm outer envelope; the inner
-// EVM state is byte-identical (no EVM divergence). On restart those nodes re-seed
-// finality from their persisted proposervm lastAccepted=A and fatal on B's cert
-// (EQUIVOCATION). This tool swaps the persisted record of `height` from A to the
-// canonical B, leaving the inner EVM completely untouched (no EVM rollback).
-//
-// It is NOT a blind hex edit: it opens the exact same typed proposervm state
-// (luxfi/node/vms/proposervm/state) over the exact same nested keyspace luxd uses
-// (chainID -> "vm" -> "proposervm" -> versiondb -> chain/block/height), and writes
-// via the state's own PutBlock / SetBlockIDAtHeight / SetLastAccepted so the on-disk
-// bytes are identical to what luxd itself wrote for B on the canonical node.
-//
-// proposervm invariant honored: proLastAcceptedHeight must never be < the inner VM's
-// last-accepted height (vm.repairAcceptedChainByHeight). The inner EVM is at `height`
-// (it accepted the shared inner block under A), so the recovery target is the
-// canonical block AT `height` (B), never height-1 — keeping outer==inner height.
-//
-// Modes:
-//
-//	inspect : read-only. Print lastAccepted, height index at H and H-1, and the
-//	          outer block currently recorded at H.
-//	export  : read-only. Read the outer block recorded at H and write its raw
-//	          stateless bytes to --block-file (run against a canonical node's DB).
-//	repair  : read-write, fail-closed. Parse --block-file (canonical B), assert it is
-//	          the expected block, assert the DB is in the expected bad state (lastAccepted
-//	          and heightIndex[H] both == the expected sub-quorum block A, and B's parent
-//	          == heightIndex[H-1]); then PutBlock(B), SetBlockIDAtHeight(H,B),
-//	          SetLastAccepted(B), Commit. Idempotent: if already on B, it no-ops.
-//
-// The DB uses an exclusive LOCK; luxd MUST be stopped on the target before `repair`.
-package main
-
-import (
-	"errors"
-	"fmt"
-	"os"
-
-	"github.com/spf13/cobra"
-
-	"github.com/luxfi/database"
-	databasefactory "github.com/luxfi/database/factory"
-	"github.com/luxfi/database/prefixdb"
-	"github.com/luxfi/database/versiondb"
-	"github.com/luxfi/ids"
-	"github.com/luxfi/log"
-	"github.com/luxfi/metric"
-
-	"github.com/luxfi/node/vms/proposervm/block"
-	"github.com/luxfi/node/vms/proposervm/state"
-)
-
-// The proposervm nests its state under these fixed prefixes inside the chain DB.
-// chainDB = prefixdb(chainID[:], baseDB)            [chains.ChainDBManager.GetDatabase]
-// vmDB    = prefixdb("vm", chainDB)                 [chains.ChainDBManager.GetVMDatabase / VMDBPrefix]
-// ppvmDB  = versiondb(prefixdb("proposervm", vmDB)) [proposervm.VM.Initialize dbPrefix]
-// state.New(ppvmDB) -> "chain"/"block"/"height" sub-prefixes
-var (
-	vmDBPrefix         = []byte("vm")
-	proposervmDBPrefix = []byte("proposervm")
-)
-
-var (
-	dbPath        string
-	dbType        string
-	chainIDStr    string
-	height        uint64
-	blockFile     string
-	expectBlockID string // canonical B (target)
-	expectCurID   string // sub-quorum A (the bad state we expect to overwrite)
-	yes           bool
-)
-
-func main() {
-	root := &cobra.Command{
-		Use:   "repair-proposervm",
-		Short: "Surgical, fail-closed reconcile of a proposervm chain-state onto a canonical outer block at one height",
-	}
-	root.PersistentFlags().StringVar(&dbPath, "db-path", "", "zapdb root (e.g. /data/db/mainnet/db) (required)")
-	root.PersistentFlags().StringVar(&dbType, "db-type", "zapdb", "database type")
-	root.PersistentFlags().StringVar(&chainIDStr, "chain-id", "2wRdZGeca1qkxzNCq88NWDF5nJ5A9o623vRJKd3FsjRYvuVvvt", "blockchain ID (proposervm chain)")
-	root.PersistentFlags().Uint64Var(&height, "height", 1082814, "contested height")
-	root.MarkPersistentFlagRequired("db-path")
-
-	inspect := &cobra.Command{Use: "inspect", Short: "read-only: print proposervm finality state at the height", RunE: runInspect}
-
-	export := &cobra.Command{Use: "export", Short: "read-only: write the outer block recorded at the height to --block-file", RunE: runExport}
-	export.Flags().StringVar(&blockFile, "block-file", "", "output file for the canonical outer block bytes (required)")
-	export.MarkFlagRequired("block-file")
-
-	probe := &cobra.Command{Use: "probe", Short: "read-only: look up an arbitrary block by ID (is it present in the store?)", RunE: runProbe}
-	probe.Flags().StringVar(&expectBlockID, "block-id", "", "block ID to look up (required)")
-	probe.MarkFlagRequired("block-id")
-
-	dump := &cobra.Command{Use: "dump", Short: "read-only: write an arbitrary block (by ID) raw stateless bytes to --block-file", RunE: runDump}
-	dump.Flags().StringVar(&expectBlockID, "block-id", "wDMUyGyaKcC2Vng8i8ngU5f83XEtHZx5hqCSe5tMTwLAPagmo", "block ID to dump (canonical B)")
-	dump.Flags().StringVar(&blockFile, "block-file", "", "output file for the block bytes (required)")
-	dump.MarkFlagRequired("block-file")
-
-	repair := &cobra.Command{Use: "repair", Short: "fail-closed: swap height's outer block from A to canonical B", RunE: runRepair}
-	repair.Flags().StringVar(&blockFile, "block-file", "", "canonical outer block (B) bytes, from `export` (required)")
-	repair.Flags().StringVar(&expectBlockID, "expect-block", "wDMUyGyaKcC2Vng8i8ngU5f83XEtHZx5hqCSe5tMTwLAPagmo", "expected canonical block ID (B)")
-	repair.Flags().StringVar(&expectCurID, "expect-current", "2U2pR3DHCNEFDLnMq2uraNVkThRWgETDd468hR26yGHBQuAnNy", "expected current sub-quorum block ID (A) to be overwritten")
-	repair.Flags().BoolVar(&yes, "yes", false, "confirm the write")
-	repair.MarkFlagRequired("block-file")
-
-	root.AddCommand(inspect, export, probe, dump, repair)
-	if err := root.Execute(); err != nil {
-		fmt.Fprintln(os.Stderr, "ERROR:", err)
-		os.Exit(1)
-	}
-}
-
-// openState opens the proposervm typed state over the exact nested keyspace luxd uses.
-// Returns the state, the proposervm versiondb (for Commit), and the base DB (for Close).
-func openState(readOnly bool) (state.State, *versiondb.Database, database.Database, ids.ID, error) {
-	chainID, err := ids.FromString(chainIDStr)
-	if err != nil {
-		return nil, nil, nil, ids.Empty, fmt.Errorf("bad chain-id: %w", err)
-	}
-	logger := log.New("cmd", "repair-proposervm")
-	gatherer := metric.NewRegistry()
-	base, err := databasefactory.New(dbType, dbPath, readOnly, nil, gatherer, logger, "repair", "db")
-	if err != nil {
-		return nil, nil, nil, ids.Empty, fmt.Errorf("open db %q: %w", dbPath, err)
-	}
-	chainDB := prefixdb.New(chainID[:], base)
-	vmDB := prefixdb.New(vmDBPrefix, chainDB)
-	ppvmDB := versiondb.New(prefixdb.New(proposervmDBPrefix, vmDB))
-	return state.New(ppvmDB), ppvmDB, base, chainID, nil
-}
-
-func idAt(st state.State, h uint64) string {
-	id, err := st.GetBlockIDAtHeight(h)
-	if errors.Is(err, database.ErrNotFound) {
-		return "<none>"
-	}
-	if err != nil {
-		return "<err:" + err.Error() + ">"
-	}
-	return id.String()
-}
-
-func runInspect(_ *cobra.Command, _ []string) error {
-	st, _, base, _, err := openState(true)
-	if err != nil {
-		return err
-	}
-	defer base.Close()
-	la, err := st.GetLastAccepted()
-	if err != nil {
-		return fmt.Errorf("GetLastAccepted: %w", err)
-	}
-	fmt.Printf("proposervm lastAccepted = %s\n", la)
-	fmt.Printf("heightIndex[%d]        = %s\n", height, idAt(st, height))
-	fmt.Printf("heightIndex[%d]        = %s\n", height-1, idAt(st, height-1))
-	if id, err := st.GetBlockIDAtHeight(height); err == nil {
-		if blk, err := st.GetBlock(id); err == nil {
-			fmt.Printf("block@%d: id=%s parent=%s bytes=%d\n", height, blk.ID(), blk.ParentID(), len(blk.Bytes()))
-		}
-	}
-	return nil
-}
-
-func runProbe(_ *cobra.Command, _ []string) error {
-	want, err := ids.FromString(expectBlockID)
-	if err != nil {
-		return fmt.Errorf("bad --block-id: %w", err)
-	}
-	// RW so Badger replays its WAL: a verified/built-but-unflushed block may live
-	// only in the memtable. Disposable copy only.
-	st, _, base, _, err := openState(false)
-	if err != nil {
-		return err
-	}
-	defer base.Close()
-	blk, err := st.GetBlock(want)
-	if errors.Is(err, database.ErrNotFound) {
-		fmt.Printf("NOT-PRESENT: block %s is not in this store\n", want)
-		return nil
-	}
-	if err != nil {
-		return fmt.Errorf("GetBlock(%s): %w", want, err)
-	}
-	fmt.Printf("PRESENT: id=%s parent=%s bytes=%d\n", blk.ID(), blk.ParentID(), len(blk.Bytes()))
-	return nil
-}
-
-func runDump(_ *cobra.Command, _ []string) error {
-	want, err := ids.FromString(expectBlockID)
-	if err != nil {
-		return fmt.Errorf("bad --block-id: %w", err)
-	}
-	// RW so Badger replays its WAL: a verified-but-unflushed block may live only in
-	// the memtable. We never call a state WRITER here (read + write output file only),
-	// and this runs against an idle (luxd-stopped) pod DB; the contested sibling B was
-	// verified by this node when it saw the conflicting cert, so it is present by ID.
-	st, _, base, _, err := openState(false)
-	if err != nil {
-		return err
-	}
-	defer base.Close()
-	blk, err := st.GetBlock(want)
-	if errors.Is(err, database.ErrNotFound) {
-		return fmt.Errorf("block %s is NOT present in this store (cannot dump)", want)
-	}
-	if err != nil {
-		return fmt.Errorf("GetBlock(%s): %w", want, err)
-	}
-	if blk.ID() != want {
-		return fmt.Errorf("self-ID mismatch: requested=%s parsed=%s (refusing)", want, blk.ID())
-	}
-	if err := os.WriteFile(blockFile, blk.Bytes(), 0o644); err != nil {
-		return fmt.Errorf("write %s: %w", blockFile, err)
-	}
-	fmt.Printf("DUMPED id=%s parent=%s bytes=%d -> %s\n", blk.ID(), blk.ParentID(), len(blk.Bytes()), blockFile)
-	return nil
-}
-
-func runExport(_ *cobra.Command, _ []string) error {
-	// Open read-WRITE so Badger replays its value-log/WAL: the canonical block at
-	// the contested height was the LAST write before the chain went idle, so on a
-	// crash-consistent snapshot copy it may live only in the memtable/WAL, not yet
-	// in an SST. A read-only open skips recovery and could miss it. We never call a
-	// state writer here (we only read + write the output file), and this only ever
-	// runs against a DISPOSABLE snapshot copy of a canonical node — never the live node.
-	st, _, base, _, err := openState(false)
-	if err != nil {
-		return err
-	}
-	defer base.Close()
-	id, err := st.GetBlockIDAtHeight(height)
-	if err != nil {
-		return fmt.Errorf("GetBlockIDAtHeight(%d): %w", height, err)
-	}
-	blk, err := st.GetBlock(id)
-	if err != nil {
-		return fmt.Errorf("GetBlock(%s): %w", id, err)
-	}
-	if blk.ID() != id {
-		return fmt.Errorf("block id mismatch: index=%s block=%s", id, blk.ID())
-	}
-	if err := os.WriteFile(blockFile, blk.Bytes(), 0o644); err != nil {
-		return fmt.Errorf("write %s: %w", blockFile, err)
-	}
-	la, _ := st.GetLastAccepted()
-	fmt.Printf("EXPORTED height=%d id=%s parent=%s bytes=%d -> %s\n", height, blk.ID(), blk.ParentID(), len(blk.Bytes()), blockFile)
-	fmt.Printf("  (source lastAccepted=%s heightIndex[%d-1]=%s)\n", la, height, idAt(st, height-1))
-	return nil
-}
-
-func runRepair(_ *cobra.Command, _ []string) error {
-	wantB, err := ids.FromString(expectBlockID)
-	if err != nil {
-		return fmt.Errorf("bad --expect-block: %w", err)
-	}
-	wantA, err := ids.FromString(expectCurID)
-	if err != nil {
-		return fmt.Errorf("bad --expect-current: %w", err)
-	}
-	raw, err := os.ReadFile(blockFile)
-	if err != nil {
-		return fmt.Errorf("read %s: %w", blockFile, err)
-	}
-	blk, err := block.ParseWithoutVerification(raw)
-	if err != nil {
-		return fmt.Errorf("parse block file: %w", err)
-	}
-	// (1) the supplied block must be exactly the canonical target B.
-	if blk.ID() != wantB {
-		return fmt.Errorf("block-file id %s != --expect-block %s (refusing)", blk.ID(), wantB)
-	}
-
-	st, ppvmDB, base, _, err := openState(false)
-	if err != nil {
-		return err
-	}
-	defer base.Close()
-
-	la, err := st.GetLastAccepted()
-	if err != nil {
-		return fmt.Errorf("GetLastAccepted: %w", err)
-	}
-	curAtH, err := st.GetBlockIDAtHeight(height)
-	if err != nil {
-		return fmt.Errorf("GetBlockIDAtHeight(%d): %w", height, err)
-	}
-
-	// (2) idempotency: if already on B, do nothing.
-	if la == wantB && curAtH == wantB {
-		fmt.Printf("ALREADY-CANONICAL: lastAccepted and heightIndex[%d] already == B (%s); no-op\n", height, wantB)
-		return nil
-	}
-
-	// (3) fail-closed: only proceed from the exact expected bad state (A at H, lastAccepted A).
-	if la != wantA {
-		return fmt.Errorf("refusing: lastAccepted=%s is neither A(%s) nor B(%s) — unexpected state", la, wantA, wantB)
-	}
-	if curAtH != wantA {
-		return fmt.Errorf("refusing: heightIndex[%d]=%s != A(%s) — unexpected state", height, curAtH, wantA)
-	}
-
-	// (4) B must extend the SAME finalized prefix: B.parent == the block recorded at H-1.
-	parentAtH1, err := st.GetBlockIDAtHeight(height - 1)
-	if err != nil {
-		return fmt.Errorf("GetBlockIDAtHeight(%d): %w", height-1, err)
-	}
-	if blk.ParentID() != parentAtH1 {
-		return fmt.Errorf("refusing: B.parent=%s != heightIndex[%d]=%s (B does not extend the local finalized prefix)", blk.ParentID(), height-1, parentAtH1)
-	}
-	if _, err := st.GetBlock(parentAtH1); err != nil {
-		return fmt.Errorf("refusing: parent %s (height %d) not present in store: %w", parentAtH1, height-1, err)
-	}
-
-	fmt.Printf("PLAN: height=%d  %s (A) -> %s (B)\n", height, wantA, wantB)
-	fmt.Printf("  current lastAccepted = %s\n", la)
-	fmt.Printf("  B.parent             = %s == heightIndex[%d] OK\n", blk.ParentID(), height-1)
-	if !yes {
-		return errors.New("dry-run only: re-run with --yes to write")
-	}
-
-	// (5) apply via the state's own typed writers (identical on-disk bytes to luxd).
-	if err := st.PutBlock(blk); err != nil {
-		return fmt.Errorf("PutBlock(B): %w", err)
-	}
-	if err := st.SetBlockIDAtHeight(height, blk.ID()); err != nil {
-		return fmt.Errorf("SetBlockIDAtHeight(%d,B): %w", height, err)
-	}
-	if err := st.SetLastAccepted(blk.ID()); err != nil {
-		return fmt.Errorf("SetLastAccepted(B): %w", err)
-	}
-	if err := ppvmDB.Commit(); err != nil {
-		return fmt.Errorf("commit: %w", err)
-	}
-
-	// (6) re-read to confirm.
-	la2, _ := st.GetLastAccepted()
-	fmt.Printf("DONE: lastAccepted=%s heightIndex[%d]=%s heightIndex[%d]=%s\n", la2, height, idAt(st, height), height-1, idAt(st, height-1))
-	if la2 != wantB || idAt(st, height) != wantB.String() {
-		return fmt.Errorf("post-write verification FAILED")
-	}
-	fmt.Println("VERIFIED: proposervm now records canonical B at the contested height; inner EVM untouched.")
-	return nil
-}

config/flags.go

@@ -309,7 +309,7 @@ func addNodeFlags(fs *pflag.FlagSet) {
 	fs.String(HandshakeMLKEMPubKeyPathKey, defaultHandshakeMLKEMPubKeyPath, fmt.Sprintf("Path to the ML-KEM-768 handshake public key (FIPS 203 PEM). Ignored if %s is specified", HandshakeMLKEMPubKeyContentKey))
 	fs.String(HandshakeMLKEMPubKeyContentKey, "", "Base64-encoded ML-KEM-768 handshake public key (FIPS 203 PEM)")
 	fs.String(StakingKMSEndpointKey, "", "KMS endpoint for staking key retrieval (e.g., https://kms.dev.lux.network)")
-	fs.String(StakingKMSSecretPathKey, "", "KMS secret path for staking keys (e.g., /staking/devnet/node-0)")
+	fs.String(StakingKMSSecretPathKey, "", "KMS secret path for staking keys (e.g., /staking/liquid-devnet/node-0)")
 	fs.String(StakingKMSTokenKey, "", "KMS auth token for staking key retrieval")
 	fs.Bool(SybilProtectionEnabledKey, true, "Enables sybil protection. If enabled, Network TLS is required")
 	fs.Uint64(SybilProtectionDisabledWeightKey, 100, "Weight to provide to each peer when sybil protection is disabled")

consensus/LLM.md

@@ -68,54 +68,3 @@ Block arrives
 ## Recent Changes
 
 - 2026-01-04: Created documentation files with Vote terminology
-
-## consensus/quasar — PQ-finality VERIFY gate (2026-06-28)
-
-Supersedes the stale "Quasar wrapper / CoronaCoordinator" notes above (that
-subpackage did not exist in-tree). The current `consensus/quasar` package is the
-node-side integration of `luxfi/consensus@v1.29.0`'s typed compact-cert finality
-layer (`protocol/quasar.VerifyConsensusCert`). It wires the VERIFY half only.
-
-Model: luxd finalizes on classical Snow every block; at CHECKPOINTS (height %
-interval) a sampled committee's QuasarCert over the finalized digest is VERIFIED.
-Default posture HYBRID_PQ = Beam(BLS) ∧ Pulsar (ML-DSA-65); STRICT_DUAL_PQ
-(+Corona) / POLARIS (+Magnetar) configurable.
-
-THE SAFETY CONTRACT — forward-dated, DORMANT by default:
-- `Gate.VerifyAccepted` is the accept-path boundary. nil gate / `Activation.Height
-  == 0` / below-height / non-checkpoint => no-op; classical finality UNCHANGED.
-- Activated at a checkpoint => REQUIRE a valid cert bound to the finalized block;
-  FAIL CLOSED (missing/mismatch/invalid => error from Accept, halts without
-  persisting). Activation is HEIGHT-ONLY (deterministic — no wall clock).
-- Hooked in `vms/proposervm/post_fork_block.go Accept()` via
-  `vm.verifyQuasarFinality(b)`; the VM's `quasarGate` is nil in production today
-  (set via `SetQuasarGate`). Nothing wires it yet — that is the activation step.
-
-Files: gate.go (Gate/ActivationConfig/bindCheck), policy.go (HYBRID_PQ default,
-cert can't pick its own policy), validators.go (ConsensusValidatorSet: BLS+Pulsar
-keys), store.go (MemCertStore), producer.go (committee-signer interface =
-scaffolding; nil = verify-only), errors.go. Tests: gate_test.go (13, -race green:
-dormant no-op, fail-closed, epoch/round/chain/height/block anti-replay, real-
-verifier delegation, misconfigured-fails-closed).
-
-REMAINING WORK to reach a live PQ-finality network (all owner-gated):
-1. Producer service (pulsard): the per-validator committee cert signer. Needs
-   pulsar v1.7.1 (no-reconstruct hyperball signer) AND consensus to EXPORT the
-   currently package-private cert/payload ENCODERS (an external producer cannot
-   assemble a ConsensusCert envelope without them; this also unblocks an end-to-
-   end positive verify test).
-2. Cert gossip/ingest -> MemCertStore (verify-before-store); MemCertStore needs
-   eviction below last-finalized height before this lands.
-3. Production per-epoch `ValidatorSetProvider` from the P-Chain validator manager
-   + KeyEra registry (BLS aggregate + Pulsar/Corona/Magnetar group keys per era).
-4. Config-flag -> SetQuasarGate wiring (construct a non-nil gate from node config;
-   choose ChainID = sovereign/EVM chain id).
-5. Cert-unavailability runbook + a bounded grace window (await cert N rounds)
-   before a checkpoint halts — fail-closed-after-decision can brick a chain if
-   gossip is down. REQUIRED before any forward-dated activation.
-6. A proposervm Accept-path integration test (nil/dormant/activated).
-
-Mainnet activation order (owner): deploy producer -> verify cert-gossip coverage
-at checkpoints -> set Activation.Height to a forward-dated height with margin ->
-roll via `kubectl patch sts luxd` OnDelete, 1 pod at a time. NEVER wipe /data/db,
-NEVER pkill, NEVER blind-restart.

consensus/quasar/config.go

@@ -0,0 +1,353 @@
+// Copyright (C) 2019-2025, Lux Industries Inc. All rights reserved.
+// See the file LICENSE for licensing terms.
+
+package quasar
+
+import (
+	"errors"
+	"fmt"
+	"time"
+)
+
+// Configuration errors
+var (
+	ErrInvalidK         = errors.New("K must be positive")
+	ErrInvalidAlpha     = errors.New("alpha must be in (0, 1]")
+	ErrInvalidBeta      = errors.New("beta must be positive and <= K")
+	ErrInvalidThreshold = errors.New("threshold must be >= 2 and <= parties")
+	ErrInvalidQuorum    = errors.New("quorum numerator must be <= denominator")
+	ErrInvalidTimeout   = errors.New("timeout must be positive")
+	ErrInvalidInterval  = errors.New("polling interval must be positive")
+)
+
+// -----------------------------------------------------------------------------
+// Core Consensus Parameters (compile-time, immutable after construction)
+// -----------------------------------------------------------------------------
+
+// CoreParams defines the fundamental Lux consensus parameters.
+// These are protocol-critical and must match across all validators.
+type CoreParams struct {
+	// K is the sample size for each consensus query round.
+	// Typical values: 20-25 for production networks.
+	K int
+
+	// Alpha is the quorum threshold as a fraction of K.
+	// A response is accepted if >= ceil(K * Alpha) validators agree.
+	// Must be in (0.5, 1] for Byzantine fault tolerance.
+	// Typical value: 0.8 (80% of sample must agree).
+	Alpha float64
+
+	// BetaVirtuous is the number of consecutive successful polls
+	// required to finalize a virtuous (non-conflicting) decision.
+	// Higher values increase latency but improve consistency.
+	// Typical value: 15-20.
+	BetaVirtuous int
+
+	// BetaRogue is the number of consecutive successful polls
+	// required to finalize a rogue (conflicting) decision.
+	// Should be >= BetaVirtuous.
+	// Typical value: 20-25.
+	BetaRogue int
+}
+
+// Validate checks CoreParams invariants.
+func (p CoreParams) Validate() error {
+	if p.K <= 0 {
+		return ErrInvalidK
+	}
+	if p.Alpha <= 0 || p.Alpha > 1 {
+		return ErrInvalidAlpha
+	}
+	if p.BetaVirtuous <= 0 || p.BetaVirtuous > p.K {
+		return ErrInvalidBeta
+	}
+	if p.BetaRogue <= 0 || p.BetaRogue > p.K {
+		return ErrInvalidBeta
+	}
+	if p.BetaRogue < p.BetaVirtuous {
+		return fmt.Errorf("BetaRogue (%d) must be >= BetaVirtuous (%d)", p.BetaRogue, p.BetaVirtuous)
+	}
+	return nil
+}
+
+// AlphaThreshold returns the minimum agreements needed for quorum.
+func (p CoreParams) AlphaThreshold() int {
+	return int(float64(p.K)*p.Alpha + 0.999) // ceil
+}
+
+// DefaultCoreParams returns production-ready core parameters.
+func DefaultCoreParams() CoreParams {
+	return CoreParams{
+		K:            20,
+		Alpha:        0.8,
+		BetaVirtuous: 15,
+		BetaRogue:    20,
+	}
+}
+
+// -----------------------------------------------------------------------------
+// Threshold Signing Parameters (compile-time, for Corona/BLS threshold)
+// -----------------------------------------------------------------------------
+
+// ThresholdParams defines t-of-n threshold signature configuration.
+type ThresholdParams struct {
+	// NumParties is the total number of signing parties (validators).
+	// Must be >= 3 for threshold signatures.
+	NumParties int
+
+	// Threshold is the minimum signers required (t in t-of-n).
+	// For BFT: typically 2/3 + 1.
+	// Must be >= 2 and <= NumParties.
+	Threshold int
+}
+
+// Validate checks ThresholdParams invariants.
+func (p ThresholdParams) Validate() error {
+	if p.NumParties < 3 {
+		return fmt.Errorf("%w: need at least 3 parties, got %d", ErrInvalidThreshold, p.NumParties)
+	}
+	if p.Threshold < 2 || p.Threshold > p.NumParties {
+		return fmt.Errorf("%w: threshold=%d, parties=%d", ErrInvalidThreshold, p.Threshold, p.NumParties)
+	}
+	return nil
+}
+
+// DefaultThresholdParams returns 2/3+1 threshold for n parties.
+func DefaultThresholdParams(numParties int) ThresholdParams {
+	threshold := (numParties * 2 / 3) + 1
+	if threshold < 2 {
+		threshold = 2
+	}
+	if threshold > numParties {
+		threshold = numParties
+	}
+	return ThresholdParams{
+		NumParties: numParties,
+		Threshold:  threshold,
+	}
+}
+
+// -----------------------------------------------------------------------------
+// Quorum Parameters (compile-time, for BLS aggregate weight verification)
+// -----------------------------------------------------------------------------
+
+// QuorumParams defines weight-based quorum requirements.
+type QuorumParams struct {
+	// Numerator and Denominator define the minimum weight fraction.
+	// Quorum is met when SignerWeight/TotalWeight >= Numerator/Denominator.
+	// For BFT: typically 2/3 (Numerator=2, Denominator=3).
+	Numerator   uint64
+	Denominator uint64
+}
+
+// Validate checks QuorumParams invariants.
+func (p QuorumParams) Validate() error {
+	if p.Denominator == 0 {
+		return fmt.Errorf("%w: denominator cannot be zero", ErrInvalidQuorum)
+	}
+	if p.Numerator > p.Denominator {
+		return fmt.Errorf("%w: numerator=%d > denominator=%d", ErrInvalidQuorum, p.Numerator, p.Denominator)
+	}
+	return nil
+}
+
+// RequiredWeight returns minimum weight needed for quorum given totalWeight.
+func (p QuorumParams) RequiredWeight(totalWeight uint64) uint64 {
+	return totalWeight * p.Numerator / p.Denominator
+}
+
+// IsMet returns true if signerWeight meets quorum given totalWeight.
+func (p QuorumParams) IsMet(signerWeight, totalWeight uint64) bool {
+	return signerWeight >= p.RequiredWeight(totalWeight)
+}
+
+// DefaultQuorumParams returns 2/3 quorum (67% of weight required).
+func DefaultQuorumParams() QuorumParams {
+	return QuorumParams{
+		Numerator:   2,
+		Denominator: 3,
+	}
+}
+
+// -----------------------------------------------------------------------------
+// Runtime Configuration (can be adjusted, but affects liveness not safety)
+// -----------------------------------------------------------------------------
+
+// RuntimeConfig holds tunable runtime parameters.
+// These affect performance and liveness but not consensus safety.
+type RuntimeConfig struct {
+	// PollInterval is the delay between consensus query rounds.
+	// Lower values decrease latency but increase network load.
+	// Typical value: 100-500ms.
+	PollInterval time.Duration
+
+	// QueryTimeout is the maximum time to wait for query responses.
+	// Must be > PollInterval.
+	// Typical value: 2-5s.
+	QueryTimeout time.Duration
+
+	// FinalityChannelSize is the buffer size for the finality event channel.
+	FinalityChannelSize int
+
+	// MaxConcurrentQueries limits parallel outstanding queries.
+	// 0 means unlimited.
+	MaxConcurrentQueries int
+}
+
+// Validate checks RuntimeConfig invariants.
+func (c RuntimeConfig) Validate() error {
+	if c.PollInterval <= 0 {
+		return ErrInvalidInterval
+	}
+	if c.QueryTimeout <= 0 {
+		return ErrInvalidTimeout
+	}
+	if c.QueryTimeout < c.PollInterval {
+		return fmt.Errorf("query timeout (%v) must be >= poll interval (%v)", c.QueryTimeout, c.PollInterval)
+	}
+	if c.FinalityChannelSize < 0 {
+		return fmt.Errorf("finality channel size must be >= 0")
+	}
+	return nil
+}
+
+// DefaultRuntimeConfig returns production-ready runtime configuration.
+func DefaultRuntimeConfig() RuntimeConfig {
+	return RuntimeConfig{
+		PollInterval:         250 * time.Millisecond,
+		QueryTimeout:         2 * time.Second,
+		FinalityChannelSize:  100,
+		MaxConcurrentQueries: 0, // unlimited
+	}
+}
+
+// -----------------------------------------------------------------------------
+// Complete Configuration
+// -----------------------------------------------------------------------------
+
+// Config is the complete Quasar consensus configuration.
+// Use ConfigBuilder for fluent construction.
+type Config struct {
+	Core      CoreParams
+	Threshold ThresholdParams
+	Quorum    QuorumParams
+	Runtime   RuntimeConfig
+}
+
+// Validate checks all configuration invariants.
+func (c Config) Validate() error {
+	if err := c.Core.Validate(); err != nil {
+		return fmt.Errorf("core params: %w", err)
+	}
+	if err := c.Threshold.Validate(); err != nil {
+		return fmt.Errorf("threshold params: %w", err)
+	}
+	if err := c.Quorum.Validate(); err != nil {
+		return fmt.Errorf("quorum params: %w", err)
+	}
+	if err := c.Runtime.Validate(); err != nil {
+		return fmt.Errorf("runtime config: %w", err)
+	}
+	return nil
+}
+
+// DefaultConfig returns a production-ready configuration.
+// Call DefaultConfig().WithNumParties(n) to set validator count.
+func DefaultConfig() Config {
+	return Config{
+		Core:      DefaultCoreParams(),
+		Threshold: DefaultThresholdParams(3), // default 3 validators
+		Quorum:    DefaultQuorumParams(),
+		Runtime:   DefaultRuntimeConfig(),
+	}
+}
+
+// -----------------------------------------------------------------------------
+// ConfigBuilder provides fluent configuration construction
+// -----------------------------------------------------------------------------
+
+// ConfigBuilder enables fluent Config construction with validation.
+type ConfigBuilder struct {
+	config Config
+}
+
+// NewConfigBuilder creates a builder starting from defaults.
+func NewConfigBuilder() *ConfigBuilder {
+	return &ConfigBuilder{
+		config: DefaultConfig(),
+	}
+}
+
+// WithK sets the sample size.
+func (b *ConfigBuilder) WithK(k int) *ConfigBuilder {
+	b.config.Core.K = k
+	return b
+}
+
+// WithAlpha sets the quorum fraction.
+func (b *ConfigBuilder) WithAlpha(alpha float64) *ConfigBuilder {
+	b.config.Core.Alpha = alpha
+	return b
+}
+
+// WithBeta sets both BetaVirtuous and BetaRogue.
+func (b *ConfigBuilder) WithBeta(virtuous, rogue int) *ConfigBuilder {
+	b.config.Core.BetaVirtuous = virtuous
+	b.config.Core.BetaRogue = rogue
+	return b
+}
+
+// WithNumParties sets the validator count and computes 2/3+1 threshold.
+func (b *ConfigBuilder) WithNumParties(n int) *ConfigBuilder {
+	b.config.Threshold = DefaultThresholdParams(n)
+	return b
+}
+
+// WithThreshold sets an explicit threshold (overrides default 2/3+1).
+func (b *ConfigBuilder) WithThreshold(threshold int) *ConfigBuilder {
+	b.config.Threshold.Threshold = threshold
+	return b
+}
+
+// WithQuorum sets the quorum fraction as numerator/denominator.
+func (b *ConfigBuilder) WithQuorum(num, denom uint64) *ConfigBuilder {
+	b.config.Quorum.Numerator = num
+	b.config.Quorum.Denominator = denom
+	return b
+}
+
+// WithPollInterval sets the polling interval.
+func (b *ConfigBuilder) WithPollInterval(d time.Duration) *ConfigBuilder {
+	b.config.Runtime.PollInterval = d
+	return b
+}
+
+// WithQueryTimeout sets the query timeout.
+func (b *ConfigBuilder) WithQueryTimeout(d time.Duration) *ConfigBuilder {
+	b.config.Runtime.QueryTimeout = d
+	return b
+}
+
+// WithFinalityChannelSize sets the finality channel buffer size.
+func (b *ConfigBuilder) WithFinalityChannelSize(size int) *ConfigBuilder {
+	b.config.Runtime.FinalityChannelSize = size
+	return b
+}
+
+// Build validates and returns the configuration.
+func (b *ConfigBuilder) Build() (Config, error) {
+	if err := b.config.Validate(); err != nil {
+		return Config{}, err
+	}
+	return b.config, nil
+}
+
+// MustBuild validates and returns the configuration, panicking on error.
+// Use only in tests or when configuration is known to be valid.
+func (b *ConfigBuilder) MustBuild() Config {
+	cfg, err := b.Build()
+	if err != nil {
+		panic(fmt.Sprintf("invalid config: %v", err))
+	}
+	return cfg
+}

consensus/quasar/config_test.go

@@ -0,0 +1,434 @@
+// Copyright (C) 2019-2025, Lux Industries Inc. All rights reserved.
+// See the file LICENSE for licensing terms.
+
+package quasar
+
+import (
+	"testing"
+	"time"
+)
+
+func TestDefaultConfig(t *testing.T) {
+	cfg := DefaultConfig()
+	if err := cfg.Validate(); err != nil {
+		t.Fatalf("default config should be valid: %v", err)
+	}
+
+	// Verify defaults match documentation
+	if cfg.Core.K != 20 {
+		t.Errorf("expected K=20, got %d", cfg.Core.K)
+	}
+	if cfg.Core.Alpha != 0.8 {
+		t.Errorf("expected Alpha=0.8, got %f", cfg.Core.Alpha)
+	}
+	if cfg.Core.BetaVirtuous != 15 {
+		t.Errorf("expected BetaVirtuous=15, got %d", cfg.Core.BetaVirtuous)
+	}
+	if cfg.Core.BetaRogue != 20 {
+		t.Errorf("expected BetaRogue=20, got %d", cfg.Core.BetaRogue)
+	}
+	if cfg.Quorum.Numerator != 2 || cfg.Quorum.Denominator != 3 {
+		t.Errorf("expected 2/3 quorum, got %d/%d", cfg.Quorum.Numerator, cfg.Quorum.Denominator)
+	}
+}
+
+func TestCoreParamsValidation(t *testing.T) {
+	tests := []struct {
+		name    string
+		params  CoreParams
+		wantErr bool
+	}{
+		{
+			name:    "valid defaults",
+			params:  DefaultCoreParams(),
+			wantErr: false,
+		},
+		{
+			name:    "zero K",
+			params:  CoreParams{K: 0, Alpha: 0.8, BetaVirtuous: 15, BetaRogue: 20},
+			wantErr: true,
+		},
+		{
+			name:    "negative K",
+			params:  CoreParams{K: -1, Alpha: 0.8, BetaVirtuous: 15, BetaRogue: 20},
+			wantErr: true,
+		},
+		{
+			name:    "alpha zero",
+			params:  CoreParams{K: 20, Alpha: 0, BetaVirtuous: 15, BetaRogue: 20},
+			wantErr: true,
+		},
+		{
+			name:    "alpha greater than 1",
+			params:  CoreParams{K: 20, Alpha: 1.5, BetaVirtuous: 15, BetaRogue: 20},
+			wantErr: true,
+		},
+		{
+			name:    "alpha exactly 1",
+			params:  CoreParams{K: 20, Alpha: 1.0, BetaVirtuous: 15, BetaRogue: 20},
+			wantErr: false,
+		},
+		{
+			name:    "beta virtuous zero",
+			params:  CoreParams{K: 20, Alpha: 0.8, BetaVirtuous: 0, BetaRogue: 20},
+			wantErr: true,
+		},
+		{
+			name:    "beta rogue less than virtuous",
+			params:  CoreParams{K: 20, Alpha: 0.8, BetaVirtuous: 20, BetaRogue: 15},
+			wantErr: true,
+		},
+		{
+			name:    "beta exceeds K",
+			params:  CoreParams{K: 10, Alpha: 0.8, BetaVirtuous: 15, BetaRogue: 20},
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := tt.params.Validate()
+			if (err != nil) != tt.wantErr {
+				t.Errorf("Validate() error = %v, wantErr %v", err, tt.wantErr)
+			}
+		})
+	}
+}
+
+func TestAlphaThreshold(t *testing.T) {
+	tests := []struct {
+		k     int
+		alpha float64
+		want  int
+	}{
+		{k: 20, alpha: 0.8, want: 16},  // 20 * 0.8 = 16
+		{k: 20, alpha: 0.51, want: 11}, // ceil(10.2) = 11
+		{k: 10, alpha: 0.67, want: 7},  // ceil(6.7) = 7
+		{k: 5, alpha: 1.0, want: 5},    // 5 * 1.0 = 5
+	}
+
+	for _, tt := range tests {
+		t.Run("", func(t *testing.T) {
+			p := CoreParams{K: tt.k, Alpha: tt.alpha, BetaVirtuous: 1, BetaRogue: 1}
+			got := p.AlphaThreshold()
+			if got != tt.want {
+				t.Errorf("AlphaThreshold(%d, %f) = %d, want %d", tt.k, tt.alpha, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestThresholdParamsValidation(t *testing.T) {
+	tests := []struct {
+		name    string
+		params  ThresholdParams
+		wantErr bool
+	}{
+		{
+			name:    "valid 3 of 5",
+			params:  ThresholdParams{NumParties: 5, Threshold: 3},
+			wantErr: false,
+		},
+		{
+			name:    "valid 4 of 5",
+			params:  ThresholdParams{NumParties: 5, Threshold: 4},
+			wantErr: false,
+		},
+		{
+			name:    "valid 2 of 3 minimum",
+			params:  ThresholdParams{NumParties: 3, Threshold: 2},
+			wantErr: false,
+		},
+		{
+			name:    "too few parties",
+			params:  ThresholdParams{NumParties: 2, Threshold: 2},
+			wantErr: true,
+		},
+		{
+			name:    "threshold too low",
+			params:  ThresholdParams{NumParties: 5, Threshold: 1},
+			wantErr: true,
+		},
+		{
+			name:    "threshold exceeds parties",
+			params:  ThresholdParams{NumParties: 5, Threshold: 6},
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := tt.params.Validate()
+			if (err != nil) != tt.wantErr {
+				t.Errorf("Validate() error = %v, wantErr %v", err, tt.wantErr)
+			}
+		})
+	}
+}
+
+func TestDefaultThresholdParams(t *testing.T) {
+	tests := []struct {
+		parties       int
+		wantThreshold int
+	}{
+		{parties: 3, wantThreshold: 3},   // 2/3 of 3 = 2, +1 = 3
+		{parties: 4, wantThreshold: 3},   // 2/3 of 4 = 2, +1 = 3
+		{parties: 5, wantThreshold: 4},   // 2/3 of 5 = 3, +1 = 4
+		{parties: 10, wantThreshold: 7},  // 2/3 of 10 = 6, +1 = 7
+		{parties: 21, wantThreshold: 15}, // 2/3 of 21 = 14, +1 = 15
+	}
+
+	for _, tt := range tests {
+		t.Run("", func(t *testing.T) {
+			p := DefaultThresholdParams(tt.parties)
+			if p.Threshold != tt.wantThreshold {
+				t.Errorf("DefaultThresholdParams(%d).Threshold = %d, want %d",
+					tt.parties, p.Threshold, tt.wantThreshold)
+			}
+			if err := p.Validate(); err != nil {
+				t.Errorf("DefaultThresholdParams(%d) produced invalid params: %v", tt.parties, err)
+			}
+		})
+	}
+}
+
+func TestQuorumParamsValidation(t *testing.T) {
+	tests := []struct {
+		name    string
+		params  QuorumParams
+		wantErr bool
+	}{
+		{
+			name:    "valid 2/3",
+			params:  QuorumParams{Numerator: 2, Denominator: 3},
+			wantErr: false,
+		},
+		{
+			name:    "valid 1/2",
+			params:  QuorumParams{Numerator: 1, Denominator: 2},
+			wantErr: false,
+		},
+		{
+			name:    "valid 1/1 (unanimous)",
+			params:  QuorumParams{Numerator: 1, Denominator: 1},
+			wantErr: false,
+		},
+		{
+			name:    "zero denominator",
+			params:  QuorumParams{Numerator: 2, Denominator: 0},
+			wantErr: true,
+		},
+		{
+			name:    "numerator exceeds denominator",
+			params:  QuorumParams{Numerator: 4, Denominator: 3},
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := tt.params.Validate()
+			if (err != nil) != tt.wantErr {
+				t.Errorf("Validate() error = %v, wantErr %v", err, tt.wantErr)
+			}
+		})
+	}
+}
+
+func TestQuorumIsMet(t *testing.T) {
+	q := QuorumParams{Numerator: 2, Denominator: 3} // 2/3 = 66.67%
+
+	// Note: integer math: 100 * 2 / 3 = 66 (floor division)
+	tests := []struct {
+		signerWeight uint64
+		totalWeight  uint64
+		want         bool
+	}{
+		{signerWeight: 67, totalWeight: 100, want: true},  // 67 >= 66
+		{signerWeight: 66, totalWeight: 100, want: true},  // 66 >= 66 (floor division)
+		{signerWeight: 65, totalWeight: 100, want: false}, // 65 < 66
+		{signerWeight: 100, totalWeight: 100, want: true}, // 100 >= 66
+		{signerWeight: 0, totalWeight: 100, want: false},  // 0 < 66
+		{signerWeight: 2, totalWeight: 3, want: true},     // 2 >= 2 (3*2/3=2)
+		{signerWeight: 1, totalWeight: 3, want: false},    // 1 < 2
+	}
+
+	for _, tt := range tests {
+		got := q.IsMet(tt.signerWeight, tt.totalWeight)
+		if got != tt.want {
+			t.Errorf("IsMet(%d, %d) = %v, want %v", tt.signerWeight, tt.totalWeight, got, tt.want)
+		}
+	}
+}
+
+func TestRuntimeConfigValidation(t *testing.T) {
+	tests := []struct {
+		name    string
+		config  RuntimeConfig
+		wantErr bool
+	}{
+		{
+			name:    "valid defaults",
+			config:  DefaultRuntimeConfig(),
+			wantErr: false,
+		},
+		{
+			name: "zero poll interval",
+			config: RuntimeConfig{
+				PollInterval: 0,
+				QueryTimeout: time.Second,
+			},
+			wantErr: true,
+		},
+		{
+			name: "negative poll interval",
+			config: RuntimeConfig{
+				PollInterval: -time.Millisecond,
+				QueryTimeout: time.Second,
+			},
+			wantErr: true,
+		},
+		{
+			name: "query timeout less than poll interval",
+			config: RuntimeConfig{
+				PollInterval: time.Second,
+				QueryTimeout: 100 * time.Millisecond,
+			},
+			wantErr: true,
+		},
+		{
+			name: "negative channel size",
+			config: RuntimeConfig{
+				PollInterval:        250 * time.Millisecond,
+				QueryTimeout:        2 * time.Second,
+				FinalityChannelSize: -1,
+			},
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := tt.config.Validate()
+			if (err != nil) != tt.wantErr {
+				t.Errorf("Validate() error = %v, wantErr %v", err, tt.wantErr)
+			}
+		})
+	}
+}
+
+func TestConfigBuilder(t *testing.T) {
+	// Test fluent API
+	cfg, err := NewConfigBuilder().
+		WithK(25).
+		WithAlpha(0.75).
+		WithBeta(18, 22).
+		WithNumParties(10).
+		WithQuorum(3, 4). // 75%
+		WithPollInterval(500 * time.Millisecond).
+		WithQueryTimeout(5 * time.Second).
+		Build()
+
+	if err != nil {
+		t.Fatalf("Build() error = %v", err)
+	}
+
+	if cfg.Core.K != 25 {
+		t.Errorf("K = %d, want 25", cfg.Core.K)
+	}
+	if cfg.Core.Alpha != 0.75 {
+		t.Errorf("Alpha = %f, want 0.75", cfg.Core.Alpha)
+	}
+	if cfg.Core.BetaVirtuous != 18 {
+		t.Errorf("BetaVirtuous = %d, want 18", cfg.Core.BetaVirtuous)
+	}
+	if cfg.Core.BetaRogue != 22 {
+		t.Errorf("BetaRogue = %d, want 22", cfg.Core.BetaRogue)
+	}
+	if cfg.Threshold.NumParties != 10 {
+		t.Errorf("NumParties = %d, want 10", cfg.Threshold.NumParties)
+	}
+	if cfg.Threshold.Threshold != 7 { // 2/3 of 10 + 1 = 7
+		t.Errorf("Threshold = %d, want 7", cfg.Threshold.Threshold)
+	}
+	if cfg.Quorum.Numerator != 3 || cfg.Quorum.Denominator != 4 {
+		t.Errorf("Quorum = %d/%d, want 3/4", cfg.Quorum.Numerator, cfg.Quorum.Denominator)
+	}
+	if cfg.Runtime.PollInterval != 500*time.Millisecond {
+		t.Errorf("PollInterval = %v, want 500ms", cfg.Runtime.PollInterval)
+	}
+}
+
+func TestConfigBuilderWithExplicitThreshold(t *testing.T) {
+	cfg, err := NewConfigBuilder().
+		WithNumParties(10).
+		WithThreshold(5). // Override default 7
+		Build()
+
+	if err != nil {
+		t.Fatalf("Build() error = %v", err)
+	}
+
+	if cfg.Threshold.Threshold != 5 {
+		t.Errorf("Threshold = %d, want 5", cfg.Threshold.Threshold)
+	}
+}
+
+func TestConfigBuilderValidationError(t *testing.T) {
+	_, err := NewConfigBuilder().
+		WithK(-1). // Invalid
+		Build()
+
+	if err == nil {
+		t.Error("Build() should return error for invalid K")
+	}
+}
+
+func TestConfigBuilderMustBuildPanics(t *testing.T) {
+	defer func() {
+		if r := recover(); r == nil {
+			t.Error("MustBuild() should panic on invalid config")
+		}
+	}()
+
+	NewConfigBuilder().WithK(-1).MustBuild()
+}
+
+func TestConfigBuilderMustBuildSuccess(t *testing.T) {
+	// Should not panic
+	cfg := NewConfigBuilder().MustBuild()
+	if err := cfg.Validate(); err != nil {
+		t.Errorf("MustBuild() produced invalid config: %v", err)
+	}
+}
+
+// TestConfigImmutability documents that Config values are immutable after creation.
+func TestConfigImmutability(t *testing.T) {
+	cfg := DefaultConfig()
+
+	// These are value types, so modifications don't affect the original
+	core := cfg.Core
+	core.K = 999
+
+	if cfg.Core.K == 999 {
+		t.Error("Config.Core should be immutable (value copy)")
+	}
+}
+
+// BenchmarkQuorumCheck benchmarks the quorum check operation.
+func BenchmarkQuorumCheck(b *testing.B) {
+	q := DefaultQuorumParams()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		_ = q.IsMet(70, 100)
+	}
+}
+
+// BenchmarkConfigValidation benchmarks config validation.
+func BenchmarkConfigValidation(b *testing.B) {
+	cfg := DefaultConfig()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		_ = cfg.Validate()
+	}
+}

consensus/quasar/coverage_test.go

@@ -0,0 +1,306 @@
+// Copyright (C) 2019-2025, Lux Industries Inc. All rights reserved.
+// See the file LICENSE for licensing terms.
+
+package quasar
+
+import (
+	"testing"
+	"time"
+
+	"github.com/luxfi/ids"
+	"github.com/luxfi/log"
+)
+
+// --- Config edge cases ---
+
+func TestDefaultThresholdParamsSmall(t *testing.T) {
+	// numParties=1: threshold clamped to numParties
+	p := DefaultThresholdParams(1)
+	if p.Threshold != 1 {
+		t.Errorf("expected threshold 1 for 1 party, got %d", p.Threshold)
+	}
+
+	// numParties=2: 2/3*2 + 1 = 2, min is 2
+	p = DefaultThresholdParams(2)
+	if p.Threshold != 2 {
+		t.Errorf("expected threshold 2, got %d", p.Threshold)
+	}
+
+	// numParties=3: 2/3*3 + 1 = 3
+	p = DefaultThresholdParams(3)
+	if p.Threshold != 3 {
+		t.Errorf("expected threshold 3, got %d", p.Threshold)
+	}
+}
+
+func TestQuorumParamsValidate(t *testing.T) {
+	p := DefaultQuorumParams()
+	if err := p.Validate(); err != nil {
+		t.Errorf("default quorum should be valid: %v", err)
+	}
+
+	p = QuorumParams{Numerator: 1, Denominator: 0}
+	if err := p.Validate(); err == nil {
+		t.Error("zero denominator should be invalid")
+	}
+
+	p = QuorumParams{Numerator: 4, Denominator: 3}
+	if err := p.Validate(); err == nil {
+		t.Error("num > denom should be invalid")
+	}
+}
+
+func TestQuorumParamsIsMet(t *testing.T) {
+	p := QuorumParams{Numerator: 2, Denominator: 3}
+	if !p.IsMet(200, 300) {
+		t.Error("200/300 should meet 2/3 quorum")
+	}
+	if p.IsMet(199, 300) {
+		t.Error("199/300 should not meet 2/3 quorum")
+	}
+}
+
+func TestQuorumParamsRequiredWeight(t *testing.T) {
+	p := QuorumParams{Numerator: 2, Denominator: 3}
+	if p.RequiredWeight(300) != 200 {
+		t.Errorf("expected 200, got %d", p.RequiredWeight(300))
+	}
+}
+
+func TestConfigBuilderWithFinalityChannelSize(t *testing.T) {
+	cfg, err := NewConfigBuilder().
+		WithThreshold(3).
+		WithFinalityChannelSize(256).
+		Build()
+	if err != nil {
+		t.Fatalf("build failed: %v", err)
+	}
+	if cfg.Runtime.FinalityChannelSize != 256 {
+		t.Errorf("expected 256, got %d", cfg.Runtime.FinalityChannelSize)
+	}
+}
+
+func TestThresholdParamsValidateEdge(t *testing.T) {
+	p := ThresholdParams{NumParties: 3, Threshold: 5}
+	if err := p.Validate(); err == nil {
+		t.Error("threshold > parties should be invalid")
+	}
+
+	p = ThresholdParams{NumParties: 3, Threshold: 0}
+	if err := p.Validate(); err == nil {
+		t.Error("threshold 0 should be invalid")
+	}
+}
+
+// --- Quasar lifecycle ---
+
+func TestQuasarGetCoreGetCorona(t *testing.T) {
+	q, err := NewQuasar(log.Noop(), 2, 2, 3)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if q.GetCore() == nil {
+		t.Error("GetCore should not return nil")
+	}
+	if q.GetCorona() != nil {
+		t.Error("Corona should be nil before initialization")
+	}
+}
+
+func TestQuasarSetGetFinalized(t *testing.T) {
+	q, err := NewQuasar(log.Noop(), 2, 2, 3)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	blockID := ids.GenerateTestID()
+	finality := &QuantumFinality{
+		BlockID:      blockID,
+		PChainHeight: 42,
+		Timestamp:    time.Now(),
+	}
+
+	q.SetFinalized(blockID, finality)
+
+	got, ok := q.GetFinalized(blockID)
+	if !ok {
+		t.Fatal("should find finality record")
+	}
+	if got.PChainHeight != 42 {
+		t.Errorf("height mismatch: %d", got.PChainHeight)
+	}
+
+	_, ok = q.GetFinalized(ids.GenerateTestID())
+	if ok {
+		t.Error("should not find non-existent finality")
+	}
+}
+
+func TestQuasarGetConfig(t *testing.T) {
+	q, err := NewQuasar(log.Noop(), 3, 2, 3)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	threshold, qNum, qDen := q.GetConfig()
+	if threshold != 3 {
+		t.Errorf("expected threshold 3, got %d", threshold)
+	}
+	if qNum != 2 || qDen != 3 {
+		t.Errorf("expected quorum 2/3, got %d/%d", qNum, qDen)
+	}
+}
+
+func TestQuasarIsRunning(t *testing.T) {
+	q, err := NewQuasar(log.Noop(), 2, 2, 3)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if q.IsRunning() {
+		t.Error("should not be running before Start")
+	}
+}
+
+func TestQuasarCheckQuorum(t *testing.T) {
+	q, err := NewQuasar(log.Noop(), 2, 2, 3)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if !q.CheckQuorum(200, 300) {
+		t.Error("200/300 should meet 2/3 quorum")
+	}
+	if q.CheckQuorum(100, 300) {
+		t.Error("100/300 should not meet 2/3 quorum")
+	}
+}
+
+func TestQuasarCreateMessage(t *testing.T) {
+	q, err := NewQuasar(log.Noop(), 2, 2, 3)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	event := FinalityEvent{
+		BlockID: ids.GenerateTestID(),
+		Height:  100,
+	}
+
+	msg := q.CreateMessage(event)
+	if len(msg) == 0 {
+		t.Error("message should not be empty")
+	}
+}
+
+func TestQuasarTotalWeight(t *testing.T) {
+	q, err := NewQuasar(log.Noop(), 2, 2, 3)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	validators := []ValidatorState{
+		{Weight: 100, Active: true},
+		{Weight: 200, Active: true},
+		{Weight: 50, Active: true},
+	}
+
+	total := q.TotalWeight(validators)
+	if total != 350 {
+		t.Errorf("expected 350, got %d", total)
+	}
+
+	// Inactive validators should not count
+	validators[2].Active = false
+	total = q.TotalWeight(validators)
+	if total != 300 {
+		t.Errorf("expected 300 without inactive, got %d", total)
+	}
+}
+
+// --- BLS Signature ---
+
+func TestBLSSignature(t *testing.T) {
+	signers := []ids.NodeID{ids.GenerateTestNodeID(), ids.GenerateTestNodeID()}
+	sig := NewBLSSignature([]byte("aggregated-sig"), signers)
+
+	if sig.Type() != SignatureTypeBLS {
+		t.Error("wrong type")
+	}
+	if len(sig.Bytes()) == 0 {
+		t.Error("bytes should not be empty")
+	}
+	if len(sig.Signers()) != 2 {
+		t.Errorf("expected 2 signers, got %d", len(sig.Signers()))
+	}
+}
+
+// --- CoronaCoordinator ---
+
+func TestCoronaCoordinatorSignNotInitialized(t *testing.T) {
+	rc, _ := NewCoronaCoordinator(log.Noop(), CoronaConfig{NumParties: 3, Threshold: 2})
+	_, err := rc.Sign([]byte("msg"))
+	if err == nil {
+		t.Error("should fail when not initialized")
+	}
+}
+
+func TestCoronaCoordinatorVerifyNotInitialized(t *testing.T) {
+	rc, _ := NewCoronaCoordinator(log.Noop(), CoronaConfig{NumParties: 3, Threshold: 2})
+	if rc.Verify([]byte("msg"), nil) {
+		t.Error("should return false when not initialized")
+	}
+}
+
+func TestCoronaCoordinatorTestMode(t *testing.T) {
+	rc, _ := NewTestCoronaCoordinator(log.Noop(), CoronaConfig{NumParties: 3, Threshold: 2})
+	validators := []ids.NodeID{ids.GenerateTestNodeID()}
+	rc.Initialize(validators)
+
+	sig, err := rc.Sign([]byte("test-message"))
+	if err != nil {
+		t.Fatalf("sign failed: %v", err)
+	}
+	if sig == nil {
+		t.Fatal("signature should not be nil")
+	}
+	if !rc.Verify([]byte("test-message"), sig) {
+		t.Error("should verify in testing mode")
+	}
+}
+
+func TestCoronaCoordinatorNotTestMode(t *testing.T) {
+	rc, _ := NewCoronaCoordinator(log.Noop(), CoronaConfig{NumParties: 3, Threshold: 2})
+	rc.Initialize([]ids.NodeID{ids.GenerateTestNodeID()})
+
+	_, err := rc.Sign([]byte("msg"))
+	if err == nil {
+		t.Error("should fail when not in testing mode")
+	}
+
+	sig := NewCoronaSignature([]byte("fake"), nil)
+	if rc.Verify([]byte("msg"), sig) {
+		t.Error("should return false when not in testing mode")
+	}
+}
+
+func TestCoronaCoordinatorStats(t *testing.T) {
+	rc, _ := NewCoronaCoordinator(log.Noop(), CoronaConfig{NumParties: 3, Threshold: 2})
+	s := rc.Stats()
+	if s.NumParties != 3 {
+		t.Errorf("expected 3 parties, got %d", s.NumParties)
+	}
+	if s.Initialized {
+		t.Error("should not be initialized")
+	}
+}
+
+func TestCoronaCoordinatorThresholdNumParties(t *testing.T) {
+	rc, _ := NewCoronaCoordinator(log.Noop(), CoronaConfig{NumParties: 5, Threshold: 3})
+	if rc.Threshold() != 3 {
+		t.Errorf("expected threshold 3, got %d", rc.Threshold())
+	}
+	if rc.NumParties() != 5 {
+		t.Errorf("expected 5 parties, got %d", rc.NumParties())
+	}
+}

consensus/quasar/doc.go

@@ -0,0 +1,59 @@
+// Copyright (C) 2019-2025, Lux Industries Inc. All rights reserved.
+// See the file LICENSE for licensing terms.
+
+/*
+Package quasar provides hybrid quantum-safe consensus finality.
+
+# Overview
+
+Quasar is the gravitational center of Lux consensus, binding P-Chain
+(BLS signatures) and Q-Chain (Corona post-quantum threshold) into
+unified hybrid finality across all Lux networks.
+
+# Architecture
+
+All validators maintain both keypairs:
+  - BLS keypair: Aggregate signatures (classical, fast)
+  - Corona keypair: Threshold signatures (post-quantum, 2-round)
+
+Both signature paths run in parallel:
+
+	Block arrives
+	    |
+	    +-- BLS PATH ----------+-- CORONA PATH --------+
+	    |   All validators     |   Round 1: commitments  |
+	    |   sign with BLS      |   Round 2: partials     |
+	    |   Aggregate (96B)    |   Combine threshold sig |
+	    +----------------------+-------------------------+
+	                           |
+	                     HYBRID PROOF
+	                  BLS + Corona combined
+	                           |
+	                   QUANTUM FINALITY
+
+# Vote Flow
+
+Validators cast votes (wire format: Chits) for proposed blocks. The
+Quasar engine collects these votes and produces finality proofs when:
+  - 2/3+ validator weight signed via BLS
+  - t-of-n validators completed Corona threshold signing
+
+# Signature Types
+
+The package defines several signature types:
+  - SignatureTypeBLS: Classical BLS signatures
+  - SignatureTypeCorona: Post-quantum threshold
+  - SignatureTypeQuasar: Hybrid combining both
+  - SignatureTypeMLDSA: ML-DSA fallback
+
+# Components
+
+Quasar: Main consensus hub coordinating both signature paths.
+
+CoronaCoordinator: Manages the 2-round threshold signing protocol
+for post-quantum security.
+
+QuantumFinality: Represents a block that achieved hybrid finality with
+both BLS and Corona proofs.
+*/
+package quasar

consensus/quasar/errors.go

@@ -1,38 +0,0 @@
-// Copyright (C) 2019-2026, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package quasar
-
-import "errors"
-
-// Typed, fail-closed errors. Every one is returned (never swallowed) and, when
-// surfaced from the accept hook post-activation, halts finalization rather than
-// accepting a checkpoint without valid post-quantum evidence.
-var (
-	// ErrFinalityCertMissing — a checkpoint was finalized post-activation but no
-	// QuasarCert is available for it (the producer has not delivered one).
-	ErrFinalityCertMissing = errors.New("quasar: finality cert missing for checkpoint")
-
-	// ErrFinalityCertMismatch — a cert exists but does not bind the finalized
-	// block (chain/height/block/state mismatch). Anti-replay.
-	ErrFinalityCertMismatch = errors.New("quasar: finality cert does not bind the finalized block")
-
-	// ErrFinalityCertInvalid — the cert is bound correctly but failed consensus
-	// verification (policy, validator-set root, or a leg signature).
-	ErrFinalityCertInvalid = errors.New("quasar: finality cert failed verification")
-
-	// ErrValidatorSetUnavailable — no committed validator set for the cert's
-	// epoch (the verifier cannot resolve the per-leg verification keys).
-	ErrValidatorSetUnavailable = errors.New("quasar: validator set unavailable for epoch")
-
-	// ErrPolicyUnavailable — the gate has no configured policy.
-	ErrPolicyUnavailable = errors.New("quasar: policy unavailable")
-
-	// ErrPolicyMismatch — the cert's PolicyID is not the configured policy. A
-	// cert cannot select its own (weaker) posture.
-	ErrPolicyMismatch = errors.New("quasar: cert policy id does not match configured policy")
-
-	// ErrGateMisconfigured — the gate is activated at a checkpoint but has no
-	// cert store or validator provider. Fail closed rather than panic.
-	ErrGateMisconfigured = errors.New("quasar: gate activated but missing store or validator provider")
-)

consensus/quasar/gate.go

@@ -1,268 +0,0 @@
-// Copyright (C) 2019-2026, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-// Package quasar is the node-side integration of the luxfi/consensus Quasar
-// post-quantum finality-certificate layer.
-//
-// luxd finalizes blocks on the classical Snow/Avalanche path (fast, every
-// block). On top, at CHECKPOINTS (epoch boundaries — NOT every block), a sampled
-// committee produces a QuasarCert over the finalized digest and validators
-// VERIFY it. This package wires the VERIFY half: it consumes
-// github.com/luxfi/consensus/protocol/quasar.VerifyConsensusCert as an OPTIONAL,
-// FORWARD-DATED, DORMANT-BY-DEFAULT check in the block-accept path.
-//
-// # Safety contract
-//
-// The forward-dated dormant activation is the whole reason this package has the
-// shape it does:
-//
-//   - Pre-activation (the default): VerifyAccepted is a pure no-op. Classical
-//     Snow finality is UNCHANGED. A nil *Gate, a zero Gate, or an unset
-//     activation height all mean "dormant" — zero behavior change.
-//   - Post-activation (owner sets Activation.Height to a real, forward-dated
-//     height): at every checkpoint height the gate REQUIRES a valid QuasarCert
-//     bound to the just-finalized block and FAILS CLOSED — a missing or invalid
-//     cert returns an error from Accept(), halting the chain rather than
-//     finalizing a checkpoint without post-quantum evidence.
-//
-// Activation is therefore a deliberate switch the owner flips only AFTER the
-// cert PRODUCER (the per-validator committee signer) is live and certs flow at
-// the checkpoint cadence — otherwise every checkpoint would halt. See
-// producer.go.
-//
-// # Default posture
-//
-// HYBRID_PQ = Beam(BLS) ∧ Pulsar (standard FIPS-204 threshold ML-DSA), at
-// checkpoint cadence. Per the measured policy-tier benchmarks, Pulsar verify
-// (~140µs) is cheaper than BLS itself and the cert is compact (~27KB) — the
-// right default production finality posture. STRICT_DUAL_PQ (∧ Corona) and the
-// POLARIS tiers (∧ Magnetar) are configurable for stricter mainnet finality.
-package quasar
-
-import (
-	"fmt"
-
-	qcert "github.com/luxfi/consensus/protocol/quasar"
-)
-
-// ActivationConfig is the forward-dated activation switch.
-//
-// The zero value is DORMANT: Height == 0 means "never activate" and the gate is
-// a no-op for every block. This mirrors the genesis upgrade discipline (a
-// far-future / unset activation point cannot affect live finality).
-//
-// Activation is by HEIGHT ONLY, deliberately. A block height is agreed by
-// consensus, so every honest validator enforces PQ finality at exactly the SAME
-// checkpoints — there is no node-local decision. (A wall-clock gate would split
-// finalization across validators with skewed clocks: some halting on a missing
-// cert while others finalize without one. Timestamp-based forward-dating is
-// expressed by choosing the activation HEIGHT at the target time.)
-type ActivationConfig struct {
-	// Height is the block height at and above which PQ-finality verification is
-	// enforced at checkpoints. 0 == dormant (never).
-	Height uint64
-}
-
-// dormant reports whether the activation is unset (the default — never enforce).
-func (a ActivationConfig) dormant() bool { return a.Height == 0 }
-
-// active reports whether enforcement is live for a block at the given height.
-// Deterministic: height-only, no wall clock. Dormant activation is never active.
-func (a ActivationConfig) active(height uint64) bool {
-	return a.Height != 0 && height >= a.Height
-}
-
-// DefaultCheckpointInterval is the default checkpoint cadence in blocks. PQ
-// certs ride epoch-boundary checkpoints, never every block (Magnetar sign is
-// checkpoint-only; even the cheap Pulsar sign is checkpoint cadence). The owner
-// overrides this to match the producer's cadence at activation time.
-const DefaultCheckpointInterval uint64 = 256
-
-// DefaultMode is the default Quasar posture: HYBRID_PQ (Beam ∧ Pulsar).
-const DefaultMode = qcert.PolicyHybridPQCheckpoint
-
-// Config is the node-surfaced PQ-finality configuration. Its zero value is
-// dormant + HYBRID_PQ + default cadence.
-type Config struct {
-	// ChainID is THIS chain's numeric identifier (the sovereign/EVM chain id),
-	// bound into every cert and checked against it. A per-chain constant sourced
-	// from chain config at gate construction — NOT pulled from a block, because
-	// the proposervm layer carries the 32-byte validator-set id, not the numeric
-	// chain id. Inert while dormant.
-	ChainID uint32
-
-	// Activation is the forward-dated dormant switch. Zero => dormant.
-	Activation ActivationConfig
-
-	// Mode is the Quasar evidence posture. Zero => DefaultMode (HYBRID_PQ).
-	Mode qcert.QuasarEvidenceMode
-
-	// MLDSAParam selects the ML-DSA parameter set for the Pulsar leg. 0 =>
-	// ML-DSA-65 (the consensus default).
-	MLDSAParam uint8
-
-	// Threshold is the BFT quorum floor (minimum aggregate signer weight) every
-	// leg's evidence must establish.
-	Threshold uint64
-
-	// CheckpointInterval is the checkpoint cadence in blocks. 0 =>
-	// DefaultCheckpointInterval.
-	CheckpointInterval uint64
-}
-
-// Checkpoint is the finalized-block position the accept hook hands the gate. It
-// is the binding the cert must match (anti-replay): a valid cert for a DIFFERENT
-// block must never satisfy THIS checkpoint. The chain id is gate-level config,
-// not a per-block field.
-type Checkpoint struct {
-	Epoch     uint64
-	Height    uint64
-	Round     uint32
-	BlockID   [32]byte
-	StateRoot [32]byte
-}
-
-// Gate enforces (or, dormant, ignores) PQ-finality at checkpoints. It is the
-// single node-side seam between the classical accept path and the consensus
-// Quasar verifier.
-type Gate struct {
-	cfg        Config
-	policy     *qcert.QuasarEvidencePolicy
-	store      CertStore
-	validators ValidatorSetProvider
-}
-
-// NewGate constructs a Gate. A Gate is meaningful even with a dormant Config:
-// VerifyAccepted is a no-op until Activation.Height is set. store and validators
-// are only consulted post-activation at checkpoints.
-func NewGate(cfg Config, store CertStore, validators ValidatorSetProvider) *Gate {
-	mode := cfg.Mode
-	if mode == 0 {
-		mode = DefaultMode
-	}
-	if cfg.CheckpointInterval == 0 {
-		cfg.CheckpointInterval = DefaultCheckpointInterval
-	}
-	cfg.Mode = mode
-	return &Gate{
-		cfg:        cfg,
-		policy:     qcert.NewQuasarEvidencePolicy(mode, cfg.MLDSAParam, cfg.Threshold),
-		store:      store,
-		validators: validators,
-	}
-}
-
-// VerifyAccepted is the accept-path hook and the SAFETY BOUNDARY.
-//
-//   - g == nil OR dormant activation => returns nil immediately. This is the
-//     default and guarantees classical Snow finality is unchanged.
-//   - height below activation, or activation time not yet reached => nil.
-//   - not a checkpoint height => nil (certs ride checkpoints only).
-//   - checkpoint, activated => REQUIRE a valid cert bound to this block; FAIL
-//     CLOSED. A missing, mis-bound, or invalid cert is an error (the caller
-//     returns it from Accept, halting rather than finalizing without PQ
-//     evidence).
-//
-// It is intentionally nil-safe so the proposervm hook can call
-// vm.quasarGate.VerifyAccepted(...) unconditionally with a nil gate.
-func (g *Gate) VerifyAccepted(cp Checkpoint) error {
-	if g == nil || g.cfg.Activation.dormant() {
-		return nil
-	}
-	if !g.cfg.Activation.active(cp.Height) {
-		return nil
-	}
-	if !g.isCheckpoint(cp.Height) {
-		return nil
-	}
-	// Activated checkpoint: the gate MUST have its cert store + validator
-	// provider, or it cannot verify. Fail closed with a typed error rather than
-	// panic in the accept hook (a panic would halt the chain uncontrollably).
-	if g.store == nil || g.validators == nil {
-		return fmt.Errorf("%w: chain=%d height=%d", ErrGateMisconfigured, g.cfg.ChainID, cp.Height)
-	}
-
-	cert, ok := g.store.Lookup(g.cfg.ChainID, cp.Height, cp.BlockID)
-	if !ok || cert == nil {
-		return fmt.Errorf("%w: chain=%d height=%d block=%x", ErrFinalityCertMissing, g.cfg.ChainID, cp.Height, cp.BlockID[:8])
-	}
-	if err := bindCheck(cert, g.cfg.ChainID, cp); err != nil {
-		return err
-	}
-
-	vs, err := g.validators.ValidatorSet(g.cfg.ChainID, cert.Epoch)
-	if err != nil {
-		return fmt.Errorf("%w: chain=%d epoch=%d: %v", ErrValidatorSetUnavailable, g.cfg.ChainID, cert.Epoch, err)
-	}
-	if err := qcert.VerifyConsensusCert(policyStore{policy: g.policy}, vs, cert); err != nil {
-		return fmt.Errorf("%w: chain=%d height=%d: %v", ErrFinalityCertInvalid, g.cfg.ChainID, cp.Height, err)
-	}
-	return nil
-}
-
-// Activated reports whether enforcement is live for a block at the given height
-// and the current wall clock. Used by the producer-request site to decide
-// whether a cert is needed at a checkpoint.
-func (g *Gate) Activated(height uint64) bool {
-	if g == nil {
-		return false
-	}
-	return g.cfg.Activation.active(height)
-}
-
-// IsCheckpoint reports whether the given height is a checkpoint under the gate's
-// configured cadence. Exported so the producer-request site shares ONE cadence
-// definition with the verify path (no second source of truth).
-func (g *Gate) IsCheckpoint(height uint64) bool {
-	if g == nil {
-		return false
-	}
-	return g.isCheckpoint(height)
-}
-
-func (g *Gate) isCheckpoint(height uint64) bool {
-	iv := g.cfg.CheckpointInterval
-	if iv == 0 {
-		iv = DefaultCheckpointInterval
-	}
-	return height%iv == 0
-}
-
-// bindCheck pins the cert to the actual finalized block. Without this, a valid
-// cert produced for a different (chain, height, block) could be replayed to
-// satisfy this checkpoint. VerifyConsensusCert checks the cert's INTERNAL
-// consistency and the validator-set/policy binding; bindCheck adds the external
-// binding to THIS node's finalized position.
-func bindCheck(cert *qcert.ConsensusCert, chainID uint32, cp Checkpoint) error {
-	if cert.ChainID != chainID {
-		return fmt.Errorf("%w: cert chain %d != finalized chain %d", ErrFinalityCertMismatch, cert.ChainID, chainID)
-	}
-	// Bind the epoch. The gate resolves the verification keys from the cert's
-	// epoch, so an UNBOUND epoch would let a cert signed under a DIFFERENT
-	// validator-set era (e.g. a compromised RETIRED committee's group key) certify
-	// the current block — nullifying KeyEra rotation as a blast-radius bound. The
-	// honest producer signs over Subject.Epoch == cp.Epoch, so honest certs match.
-	if cert.Epoch != cp.Epoch {
-		return fmt.Errorf("%w: cert epoch %d != finalized epoch %d", ErrFinalityCertMismatch, cert.Epoch, cp.Epoch)
-	}
-	if cert.Round != cp.Round {
-		return fmt.Errorf("%w: cert round %d != finalized round %d", ErrFinalityCertMismatch, cert.Round, cp.Round)
-	}
-	if cert.Height != cp.Height {
-		return fmt.Errorf("%w: cert height %d != finalized height %d", ErrFinalityCertMismatch, cert.Height, cp.Height)
-	}
-	if cert.BlockHash != cp.BlockID {
-		return fmt.Errorf("%w: cert block hash != finalized block id", ErrFinalityCertMismatch)
-	}
-	// StateRoot contract: at the proposervm layer the post-state root is
-	// committed TRANSITIVELY through BlockHash, so cp.StateRoot is zero and the
-	// cert MUST carry a zero StateRoot too. A non-zero cert StateRoot is rejected
-	// (no state to cross-check here) — the producer follow-on MUST emit
-	// StateRoot==0 at this layer; a chain that wants an explicit state binding
-	// plumbs cp.StateRoot AND signs it, and this check then enforces equality.
-	var zero [32]byte
-	if cert.StateRoot != zero && cert.StateRoot != cp.StateRoot {
-		return fmt.Errorf("%w: cert state root != finalized state root", ErrFinalityCertMismatch)
-	}
-	return nil
-}

consensus/quasar/gate_test.go

@@ -1,270 +0,0 @@
-// Copyright (C) 2019-2026, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package quasar
-
-import (
-	"context"
-	"errors"
-	"testing"
-
-	qcert "github.com/luxfi/consensus/protocol/quasar"
-)
-
-// vsRoot is a fixed committed-validator-set root used across the tests.
-var vsRoot = [48]byte{0x11, 0x22, 0x33, 0x44}
-
-// testValidators is a ValidatorSet whose Root matches vsRoot, with non-empty
-// (placeholder) HYBRID_PQ keys. The delegation test never reaches signature
-// math, so the key bytes need only be non-empty.
-func testValidators() *ValidatorSet {
-	return NewValidatorSet(vsRoot, 1, []byte("bls-agg-key"), []byte("pulsar-group-key"))
-}
-
-// newGate builds a gate with a tight cadence (checkpoint every 10 blocks) and
-// the given forward-dated activation height. interval 10 keeps the heights in
-// the tests readable.
-func newGate(activationHeight uint64, store CertStore) *Gate {
-	return NewGate(Config{
-		ChainID:            1337,
-		Activation:         ActivationConfig{Height: activationHeight},
-		Mode:               DefaultMode, // HYBRID_PQ
-		Threshold:          100,
-		CheckpointInterval: 10,
-	}, store, StaticValidatorSetProvider{Set: testValidators()})
-}
-
-func checkpointAt(height uint64) Checkpoint {
-	return Checkpoint{
-		Epoch:   1,
-		Height:  height,
-		BlockID: [32]byte{0xab, 0xcd, 0xef},
-	}
-}
-
-// TestDormantIsNoop — the default (Activation.Height == 0) is a pure no-op even
-// at a checkpoint height with a poisoned store. This is the core safety
-// property: pre-activation, classical Snow finality is unchanged.
-func TestDormantIsNoop(t *testing.T) {
-	store := NewMemCertStore()
-	g := NewGate(Config{CheckpointInterval: 10}, store, StaticValidatorSetProvider{Set: testValidators()})
-	// height 10 is a checkpoint; no cert exists; yet dormant => nil.
-	if err := g.VerifyAccepted(checkpointAt(10)); err != nil {
-		t.Fatalf("dormant gate must be a no-op, got %v", err)
-	}
-	if g.Activated(10) {
-		t.Fatal("dormant gate must never report Activated")
-	}
-}
-
-// TestNilGateIsNoop — a nil *Gate is the wire-it-but-leave-it-off default; the
-// proposervm hook calls VerifyAccepted on a possibly-nil gate.
-func TestNilGateIsNoop(t *testing.T) {
-	var g *Gate
-	if err := g.VerifyAccepted(checkpointAt(10)); err != nil {
-		t.Fatalf("nil gate must be a no-op, got %v", err)
-	}
-	if g.Activated(10) || g.IsCheckpoint(10) {
-		t.Fatal("nil gate must report neither Activated nor IsCheckpoint")
-	}
-}
-
-// TestBelowActivationIsNoop — activated at height 100 but the block is at 10:
-// below the forward-dated height => nil, even at a checkpoint with no cert.
-func TestBelowActivationIsNoop(t *testing.T) {
-	g := newGate(100, NewMemCertStore())
-	if err := g.VerifyAccepted(checkpointAt(10)); err != nil {
-		t.Fatalf("below activation must be a no-op, got %v", err)
-	}
-}
-
-// TestNonCheckpointIsNoop — activated and at/above activation height, but the
-// height is not a checkpoint => nil (certs ride checkpoints only).
-func TestNonCheckpointIsNoop(t *testing.T) {
-	g := newGate(10, NewMemCertStore())
-	// height 15 is activated (>=10) but not a checkpoint (15 % 10 != 0).
-	if err := g.VerifyAccepted(checkpointAt(15)); err != nil {
-		t.Fatalf("non-checkpoint must be a no-op, got %v", err)
-	}
-	if !g.Activated(15) {
-		t.Fatal("height 15 should be activated")
-	}
-	if g.IsCheckpoint(15) {
-		t.Fatal("height 15 must not be a checkpoint")
-	}
-}
-
-// TestMissingCertFailsClosed — activated checkpoint with no cert in the store =>
-// ErrFinalityCertMissing. Post-activation a checkpoint without PQ evidence must
-// NOT finalize.
-func TestMissingCertFailsClosed(t *testing.T) {
-	g := newGate(10, NewMemCertStore())
-	err := g.VerifyAccepted(checkpointAt(20))
-	if !errors.Is(err, ErrFinalityCertMissing) {
-		t.Fatalf("want ErrFinalityCertMissing, got %v", err)
-	}
-}
-
-// TestMismatchedCertRejected — a cert that does not bind the finalized block
-// (wrong block id / height / chain) is rejected by bindCheck before any crypto.
-// Anti-replay: a valid cert for a different block must not satisfy this one.
-func TestMismatchedCertRejected(t *testing.T) {
-	// cp = checkpointAt(20) has Epoch 1, Round 0. Each case sets every binding
-	// field correctly EXCEPT the one named, so it fails at that field.
-	cases := []struct {
-		name string
-		cert *qcert.ConsensusCert
-	}{
-		{"wrong block", &qcert.ConsensusCert{ChainID: 1337, Epoch: 1, Height: 20, BlockHash: [32]byte{0x99}}},
-		{"wrong height", &qcert.ConsensusCert{ChainID: 1337, Epoch: 1, Height: 21, BlockHash: [32]byte{0xab, 0xcd, 0xef}}},
-		{"wrong chain", &qcert.ConsensusCert{ChainID: 7, Epoch: 1, Height: 20, BlockHash: [32]byte{0xab, 0xcd, 0xef}}},
-		{"wrong epoch", &qcert.ConsensusCert{ChainID: 1337, Epoch: 2, Height: 20, BlockHash: [32]byte{0xab, 0xcd, 0xef}}},
-		{"wrong round", &qcert.ConsensusCert{ChainID: 1337, Epoch: 1, Round: 1, Height: 20, BlockHash: [32]byte{0xab, 0xcd, 0xef}}},
-		{"wrong state root", &qcert.ConsensusCert{ChainID: 1337, Epoch: 1, Height: 20, BlockHash: [32]byte{0xab, 0xcd, 0xef}, StateRoot: [32]byte{0x55}}},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			store := NewMemCertStore()
-			// Index it at the checkpoint's lookup key so Lookup returns it and
-			// bindCheck (not Lookup) does the rejecting.
-			store.certs[certKey{chainID: 1337, height: 20, blockID: [32]byte{0xab, 0xcd, 0xef}}] = tc.cert
-			g := newGate(10, store)
-			err := g.VerifyAccepted(checkpointAt(20))
-			if !errors.Is(err, ErrFinalityCertMismatch) {
-				t.Fatalf("want ErrFinalityCertMismatch, got %v", err)
-			}
-		})
-	}
-}
-
-// TestDelegatesToVerifier — a cert that BINDS correctly and passes the full
-// ConsensusCert header path (version, policy load, required-legs root, validator
-// -set root) but carries no signature evidence is rejected by the REAL
-// consensus verifier, and the gate surfaces it as ErrFinalityCertInvalid. This
-// proves the whole delegation chain is wired: policyStore + ValidatorSet +
-// quasar.VerifyConsensusCert are reached with matching commitments — everything
-// up to (but not including) the leg signature crypto, which needs the producer.
-func TestDelegatesToVerifier(t *testing.T) {
-	cp := checkpointAt(20)
-
-	// Mirror the gate's posture to compute the header commitments the verifier
-	// pins (policy id + required-legs root). policyID and required legs derive
-	// from the mode + ML-DSA param, which match the gate's config.
-	pol := qcert.NewQuasarEvidencePolicy(DefaultMode, 0, 100)
-	cert := &qcert.ConsensusCert{
-		Version:          1,
-		ChainID:          1337, // must equal the gate's configured ChainID
-		Epoch:            cp.Epoch,
-		Height:           cp.Height,
-		BlockHash:        cp.BlockID,
-		PolicyID:         pol.EvidencePolicyID(),
-		RequiredLegsRoot: qcert.HashRequiredLegs(pol.RequiredLegs()),
-		ValidatorSetRoot: vsRoot,
-		// Evidence intentionally empty: the verifier must reject a required leg
-		// with no evidence (deepest deterministic failure without real crypto).
-	}
-	store := NewMemCertStore()
-	store.Put(cert)
-	g := newGate(10, store)
-
-	err := g.VerifyAccepted(cp)
-	if !errors.Is(err, ErrFinalityCertInvalid) {
-		t.Fatalf("want ErrFinalityCertInvalid (delegated), got %v", err)
-	}
-}
-
-// TestValidatorSetUnavailable — a bound cert at an activated checkpoint, but the
-// provider has no set for the epoch => ErrValidatorSetUnavailable (fail closed).
-func TestValidatorSetUnavailable(t *testing.T) {
-	cp := checkpointAt(20)
-	// Bind correctly (epoch included) so the cert passes bindCheck and the
-	// failure is specifically the unavailable validator set.
-	cert := &qcert.ConsensusCert{Version: 1, ChainID: 1337, Epoch: cp.Epoch, Height: cp.Height, BlockHash: cp.BlockID}
-	store := NewMemCertStore()
-	store.Put(cert)
-	g := NewGate(Config{
-		ChainID:            1337,
-		Activation:         ActivationConfig{Height: 10},
-		CheckpointInterval: 10,
-	}, store, StaticValidatorSetProvider{Set: nil}) // provider present, no set
-	err := g.VerifyAccepted(cp)
-	if !errors.Is(err, ErrValidatorSetUnavailable) {
-		t.Fatalf("want ErrValidatorSetUnavailable, got %v", err)
-	}
-}
-
-// TestGateMisconfiguredFailsClosed — an activated gate at a checkpoint with no
-// cert store (or no validator provider) fails closed with a typed error rather
-// than panicking in the accept hook.
-func TestGateMisconfiguredFailsClosed(t *testing.T) {
-	g := NewGate(Config{
-		ChainID:            1337,
-		Activation:         ActivationConfig{Height: 10},
-		CheckpointInterval: 10,
-	}, nil, nil) // no store, no validators
-	if err := g.VerifyAccepted(checkpointAt(20)); !errors.Is(err, ErrGateMisconfigured) {
-		t.Fatalf("want ErrGateMisconfigured, got %v", err)
-	}
-	// dormant misconfigured gate is still a no-op (guard is post-activation).
-	gd := NewGate(Config{ChainID: 1337, CheckpointInterval: 10}, nil, nil)
-	if err := gd.VerifyAccepted(checkpointAt(20)); err != nil {
-		t.Fatalf("dormant gate must be a no-op even if misconfigured, got %v", err)
-	}
-}
-
-// --- producer scaffolding ---
-
-type stubProducer struct {
-	cert *qcert.ConsensusCert
-	hits int
-}
-
-func (s *stubProducer) Produce(_ context.Context, _ Subject) (*qcert.ConsensusCert, error) {
-	s.hits++
-	return s.cert, nil
-}
-
-// TestMaybeProduceVerifyOnlyByDefault — a nil producer is the verify-only
-// default: MaybeProduce short-circuits to (nil, nil), never panics.
-func TestMaybeProduceVerifyOnlyByDefault(t *testing.T) {
-	g := newGate(10, NewMemCertStore())
-	cert, err := g.MaybeProduce(context.Background(), nil, checkpointAt(20))
-	if err != nil || cert != nil {
-		t.Fatalf("nil producer must yield (nil,nil), got cert=%v err=%v", cert, err)
-	}
-}
-
-// TestMaybeProduceDormant — even with a producer wired, a dormant gate produces
-// nothing (the producer is brought up before activation is forward-dated).
-func TestMaybeProduceDormant(t *testing.T) {
-	store := NewMemCertStore()
-	g := NewGate(Config{CheckpointInterval: 10}, store, StaticValidatorSetProvider{Set: testValidators()})
-	p := &stubProducer{cert: &qcert.ConsensusCert{}}
-	cert, err := g.MaybeProduce(context.Background(), p, checkpointAt(20))
-	if err != nil || cert != nil {
-		t.Fatalf("dormant gate must not produce, got cert=%v err=%v", cert, err)
-	}
-	if p.hits != 0 {
-		t.Fatalf("producer must not be called while dormant, hits=%d", p.hits)
-	}
-}
-
-// TestMaybeProduceActiveCheckpoint — wired producer + activated checkpoint =>
-// the producer is asked for the cert.
-func TestMaybeProduceActiveCheckpoint(t *testing.T) {
-	g := newGate(10, NewMemCertStore())
-	want := &qcert.ConsensusCert{ChainID: 1337, Height: 20}
-	p := &stubProducer{cert: want}
-	got, err := g.MaybeProduce(context.Background(), p, checkpointAt(20))
-	if err != nil {
-		t.Fatalf("unexpected err %v", err)
-	}
-	if got != want || p.hits != 1 {
-		t.Fatalf("producer not invoked as expected: got=%v hits=%d", got, p.hits)
-	}
-	// non-checkpoint height must not invoke the producer
-	p2 := &stubProducer{cert: want}
-	if _, _ = g.MaybeProduce(context.Background(), p2, checkpointAt(15)); p2.hits != 0 {
-		t.Fatalf("producer invoked at non-checkpoint, hits=%d", p2.hits)
-	}
-}

consensus/quasar/gpu_pipeline.go

@@ -0,0 +1,592 @@
+// Copyright (C) 2019-2025, Lux Industries Inc. All rights reserved.
+// See the file LICENSE for licensing terms.
+
+package quasar
+
+import (
+	"errors"
+	"fmt"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/luxfi/accel"
+)
+
+// GPUVerifyPipeline fuses multiple cryptographic verification operations into
+// a single GPU session, sharing GPU memory across all verification types.
+//
+// Instead of sequential: BLS verify -> Corona verify -> ZK verify -> ML-DSA verify
+// GPU pipeline: one session, parallel streams, shared memory allocation
+//
+// This is the ML-DSA rollup pattern:
+//   - BLS aggregate signature (classical fast path)
+//   - Corona threshold signature (PQ safe path)
+//   - ZK rollup batch proof (state transition validity)
+//   - N x ML-DSA signatures (per-tx PQ signatures)
+//
+// All execute on GPU in parallel using separate compute streams within one session.
+type GPUVerifyPipeline struct {
+	// Stats (atomic for lock-free reads)
+	gpuVerifies uint64
+	cpuVerifies uint64
+	gpuTimeNs   uint64
+	cpuTimeNs   uint64
+}
+
+// NewGPUVerifyPipeline creates a new fused GPU verification pipeline.
+func NewGPUVerifyPipeline() *GPUVerifyPipeline {
+	return &GPUVerifyPipeline{}
+}
+
+// BLSWork holds a batch of BLS signatures to verify.
+type BLSWork struct {
+	Messages   [][]byte // [N, msg_len]
+	Signatures [][]byte // [N, 96] G2 points
+	PubKeys    [][]byte // [N, 48] G1 points
+}
+
+// CoronaWork holds a batch of Corona threshold signatures to verify.
+type CoronaWork struct {
+	Messages   [][]byte // [N, msg_len]
+	Signatures [][]byte // [N, sig_len] threshold sigs
+	PubKeys    [][]byte // [N, pk_len] ring public keys
+}
+
+// ZKWork holds a batch of ZK proofs to verify.
+type ZKWork struct {
+	Scalars [][]byte // [M, N, scalar_size]
+	Bases   [][]byte // [M, N, point_size]
+}
+
+// MLDSAWork holds a batch of ML-DSA (Dilithium) signatures to verify.
+type MLDSAWork struct {
+	Messages   [][]byte // [N, msg_len]
+	Signatures [][]byte // [N, 3293] Dilithium3
+	PubKeys    [][]byte // [N, 1952] Dilithium3
+}
+
+// BlockVerifyWork contains all verification batches for a single block.
+type BlockVerifyWork struct {
+	BLS    *BLSWork
+	Corona *CoronaWork
+	ZK     *ZKWork
+	MLDSA  *MLDSAWork
+}
+
+// BlockVerifyResult contains verification results for all batch types.
+type BlockVerifyResult struct {
+	BLSValid    []bool
+	CoronaValid []bool
+	ZKValid     bool
+	MLDSAValid  []bool
+
+	GPUUsed    bool
+	BLSTime    time.Duration
+	CoronaTime time.Duration
+	ZKTime     time.Duration
+	MLDSATime  time.Duration
+	TotalTime  time.Duration
+}
+
+var (
+	ErrBLSSizeMismatch    = errors.New("BLS batch size mismatch: messages, signatures, and pubkeys must have equal length")
+	ErrCoronaSizeMismatch = errors.New("Corona batch size mismatch: messages, signatures, and pubkeys must have equal length")
+	ErrZKSizeMismatch     = errors.New("ZK batch size mismatch: scalars and bases must have equal length")
+	ErrMLDSASizeMismatch  = errors.New("ML-DSA batch size mismatch: messages, signatures, and pubkeys must have equal length")
+)
+
+// VerifyBlock dispatches all verification work for a block through the GPU pipeline.
+// Falls back to CPU verification when no GPU is available.
+func (p *GPUVerifyPipeline) VerifyBlock(work *BlockVerifyWork) (*BlockVerifyResult, error) {
+	if work == nil {
+		return &BlockVerifyResult{}, nil
+	}
+
+	if err := validateWork(work); err != nil {
+		return nil, err
+	}
+
+	start := time.Now()
+
+	if accel.Available() {
+		result, err := p.verifyGPU(work)
+		if err == nil {
+			result.TotalTime = time.Since(start)
+			result.GPUUsed = true
+			atomic.AddUint64(&p.gpuVerifies, 1)
+			atomic.AddUint64(&p.gpuTimeNs, uint64(result.TotalTime))
+			return result, nil
+		}
+		// GPU failed, fall through to CPU
+	}
+
+	result := p.verifyCPU(work)
+	result.TotalTime = time.Since(start)
+	result.GPUUsed = false
+	atomic.AddUint64(&p.cpuVerifies, 1)
+	atomic.AddUint64(&p.cpuTimeNs, uint64(result.TotalTime))
+	return result, nil
+}
+
+// verifyGPU dispatches all 4 verification types through a single GPU session.
+func (p *GPUVerifyPipeline) verifyGPU(work *BlockVerifyWork) (*BlockVerifyResult, error) {
+	sess, err := accel.NewSession()
+	if err != nil {
+		return nil, fmt.Errorf("GPU session: %w", err)
+	}
+	defer sess.Close()
+
+	result := &BlockVerifyResult{}
+	var mu sync.Mutex
+	var wg sync.WaitGroup
+	var firstErr atomic.Value
+
+	// BLS verification stream
+	if work.BLS != nil && len(work.BLS.Messages) > 0 {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			start := time.Now()
+			valid, err := gpuBLSVerify(sess, work.BLS)
+			elapsed := time.Since(start)
+			if err != nil {
+				firstErr.CompareAndSwap(nil, err)
+				return
+			}
+			mu.Lock()
+			result.BLSValid = valid
+			result.BLSTime = elapsed
+			mu.Unlock()
+		}()
+	}
+
+	// Corona verification stream (uses DilithiumVerifyBatch on lattice ops)
+	if work.Corona != nil && len(work.Corona.Messages) > 0 {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			start := time.Now()
+			valid, err := gpuCoronaVerify(sess, work.Corona)
+			elapsed := time.Since(start)
+			if err != nil {
+				firstErr.CompareAndSwap(nil, err)
+				return
+			}
+			mu.Lock()
+			result.CoronaValid = valid
+			result.CoronaTime = elapsed
+			mu.Unlock()
+		}()
+	}
+
+	// ZK rollup batch proof verification stream
+	if work.ZK != nil && len(work.ZK.Scalars) > 0 {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			start := time.Now()
+			valid, err := gpuZKVerify(sess, work.ZK)
+			elapsed := time.Since(start)
+			if err != nil {
+				firstErr.CompareAndSwap(nil, err)
+				return
+			}
+			mu.Lock()
+			result.ZKValid = valid
+			result.ZKTime = elapsed
+			mu.Unlock()
+		}()
+	}
+
+	// ML-DSA per-tx signature verification stream
+	if work.MLDSA != nil && len(work.MLDSA.Messages) > 0 {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			start := time.Now()
+			valid, err := gpuMLDSAVerify(sess, work.MLDSA)
+			elapsed := time.Since(start)
+			if err != nil {
+				firstErr.CompareAndSwap(nil, err)
+				return
+			}
+			mu.Lock()
+			result.MLDSAValid = valid
+			result.MLDSATime = elapsed
+			mu.Unlock()
+		}()
+	}
+
+	wg.Wait()
+
+	if v := firstErr.Load(); v != nil {
+		return nil, v.(error)
+	}
+
+	return result, nil
+}
+
+// gpuBLSVerify dispatches BLS batch verification to the GPU crypto ops.
+func gpuBLSVerify(sess *accel.Session, work *BLSWork) ([]bool, error) {
+	n := len(work.Messages)
+
+	// Determine uniform sizes for tensor packing
+	msgLen := maxByteLen(work.Messages)
+	sigLen := 96 // BLS G2 point
+	pkLen := 48  // BLS G1 point
+
+	msgFlat := flattenPadded(work.Messages, n, msgLen)
+	sigFlat := flattenPadded(work.Signatures, n, sigLen)
+	pkFlat := flattenPadded(work.PubKeys, n, pkLen)
+
+	msgs, err := accel.NewTensorWithData[uint8](sess, []int{n, msgLen}, msgFlat)
+	if err != nil {
+		return nil, err
+	}
+	defer msgs.Close()
+
+	sigs, err := accel.NewTensorWithData[uint8](sess, []int{n, sigLen}, sigFlat)
+	if err != nil {
+		return nil, err
+	}
+	defer sigs.Close()
+
+	pks, err := accel.NewTensorWithData[uint8](sess, []int{n, pkLen}, pkFlat)
+	if err != nil {
+		return nil, err
+	}
+	defer pks.Close()
+
+	results, err := accel.NewTensor[uint8](sess, []int{n})
+	if err != nil {
+		return nil, err
+	}
+	defer results.Close()
+
+	if err := sess.Crypto().BLSVerifyBatch(msgs.Untyped(), sigs.Untyped(), pks.Untyped(), results.Untyped()); err != nil {
+		return nil, err
+	}
+
+	raw, err := results.ToSlice()
+	if err != nil {
+		return nil, err
+	}
+
+	valid := make([]bool, n)
+	for i, v := range raw {
+		valid[i] = v == 1
+	}
+	return valid, nil
+}
+
+// gpuCoronaVerify dispatches Corona verification via DilithiumVerifyBatch
+// (Corona threshold signatures are lattice-based, same verification kernel).
+func gpuCoronaVerify(sess *accel.Session, work *CoronaWork) ([]bool, error) {
+	n := len(work.Messages)
+
+	msgLen := maxByteLen(work.Messages)
+	sigLen := maxByteLen(work.Signatures)
+	pkLen := maxByteLen(work.PubKeys)
+
+	msgFlat := flattenPadded(work.Messages, n, msgLen)
+	sigFlat := flattenPadded(work.Signatures, n, sigLen)
+	pkFlat := flattenPadded(work.PubKeys, n, pkLen)
+
+	msgs, err := accel.NewTensorWithData[uint8](sess, []int{n, msgLen}, msgFlat)
+	if err != nil {
+		return nil, err
+	}
+	defer msgs.Close()
+
+	sigs, err := accel.NewTensorWithData[uint8](sess, []int{n, sigLen}, sigFlat)
+	if err != nil {
+		return nil, err
+	}
+	defer sigs.Close()
+
+	pks, err := accel.NewTensorWithData[uint8](sess, []int{n, pkLen}, pkFlat)
+	if err != nil {
+		return nil, err
+	}
+	defer pks.Close()
+
+	results, err := accel.NewTensor[uint8](sess, []int{n})
+	if err != nil {
+		return nil, err
+	}
+	defer results.Close()
+
+	if err := sess.Lattice().DilithiumVerifyBatch(msgs.Untyped(), sigs.Untyped(), pks.Untyped(), results.Untyped()); err != nil {
+		return nil, err
+	}
+
+	raw, err := results.ToSlice()
+	if err != nil {
+		return nil, err
+	}
+
+	valid := make([]bool, n)
+	for i, v := range raw {
+		valid[i] = v == 1
+	}
+	return valid, nil
+}
+
+// gpuZKVerify dispatches ZK batch proof verification via MSMBatch on ZK ops.
+func gpuZKVerify(sess *accel.Session, work *ZKWork) (bool, error) {
+	m := len(work.Scalars)
+
+	scalarLen := maxByteLen(work.Scalars)
+	baseLen := maxByteLen(work.Bases)
+
+	scalarFlat := flattenPadded(work.Scalars, m, scalarLen)
+	baseFlat := flattenPadded(work.Bases, m, baseLen)
+
+	scalars, err := accel.NewTensorWithData[uint8](sess, []int{m, scalarLen}, scalarFlat)
+	if err != nil {
+		return false, err
+	}
+	defer scalars.Close()
+
+	bases, err := accel.NewTensorWithData[uint8](sess, []int{m, baseLen}, baseFlat)
+	if err != nil {
+		return false, err
+	}
+	defer bases.Close()
+
+	// MSM result: single point per batch entry
+	pointSize := baseLen
+	results, err := accel.NewTensor[uint8](sess, []int{m, pointSize})
+	if err != nil {
+		return false, err
+	}
+	defer results.Close()
+
+	if err := sess.ZK().MSMBatch(scalars.Untyped(), bases.Untyped(), results.Untyped()); err != nil {
+		return false, err
+	}
+
+	// MSM completed without error means proof verification passed
+	return true, nil
+}
+
+// gpuMLDSAVerify dispatches ML-DSA (Dilithium) batch verification to the GPU.
+func gpuMLDSAVerify(sess *accel.Session, work *MLDSAWork) ([]bool, error) {
+	n := len(work.Messages)
+
+	msgLen := maxByteLen(work.Messages)
+	sigLen := 3293 // Dilithium3 signature
+	pkLen := 1952  // Dilithium3 public key
+
+	msgFlat := flattenPadded(work.Messages, n, msgLen)
+	sigFlat := flattenPadded(work.Signatures, n, sigLen)
+	pkFlat := flattenPadded(work.PubKeys, n, pkLen)
+
+	msgs, err := accel.NewTensorWithData[uint8](sess, []int{n, msgLen}, msgFlat)
+	if err != nil {
+		return nil, err
+	}
+	defer msgs.Close()
+
+	sigs, err := accel.NewTensorWithData[uint8](sess, []int{n, sigLen}, sigFlat)
+	if err != nil {
+		return nil, err
+	}
+	defer sigs.Close()
+
+	pks, err := accel.NewTensorWithData[uint8](sess, []int{n, pkLen}, pkFlat)
+	if err != nil {
+		return nil, err
+	}
+	defer pks.Close()
+
+	results, err := accel.NewTensor[uint8](sess, []int{n})
+	if err != nil {
+		return nil, err
+	}
+	defer results.Close()
+
+	if err := sess.Lattice().DilithiumVerifyBatch(msgs.Untyped(), sigs.Untyped(), pks.Untyped(), results.Untyped()); err != nil {
+		return nil, err
+	}
+
+	raw, err := results.ToSlice()
+	if err != nil {
+		return nil, err
+	}
+
+	valid := make([]bool, n)
+	for i, v := range raw {
+		valid[i] = v == 1
+	}
+	return valid, nil
+}
+
+// verifyCPU performs all verification on the CPU as fallback.
+func (p *GPUVerifyPipeline) verifyCPU(work *BlockVerifyWork) *BlockVerifyResult {
+	result := &BlockVerifyResult{}
+	var wg sync.WaitGroup
+	var mu sync.Mutex
+
+	if work.BLS != nil && len(work.BLS.Messages) > 0 {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			start := time.Now()
+			valid := cpuBLSVerify(work.BLS)
+			mu.Lock()
+			result.BLSValid = valid
+			result.BLSTime = time.Since(start)
+			mu.Unlock()
+		}()
+	}
+
+	if work.Corona != nil && len(work.Corona.Messages) > 0 {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			start := time.Now()
+			valid := cpuCoronaVerify(work.Corona)
+			mu.Lock()
+			result.CoronaValid = valid
+			result.CoronaTime = time.Since(start)
+			mu.Unlock()
+		}()
+	}
+
+	if work.ZK != nil && len(work.ZK.Scalars) > 0 {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			start := time.Now()
+			valid := cpuZKVerify(work.ZK)
+			mu.Lock()
+			result.ZKValid = valid
+			result.ZKTime = time.Since(start)
+			mu.Unlock()
+		}()
+	}
+
+	if work.MLDSA != nil && len(work.MLDSA.Messages) > 0 {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			start := time.Now()
+			valid := cpuMLDSAVerify(work.MLDSA)
+			mu.Lock()
+			result.MLDSAValid = valid
+			result.MLDSATime = time.Since(start)
+			mu.Unlock()
+		}()
+	}
+
+	wg.Wait()
+	return result
+}
+
+// CPU fallback implementations.
+// These verify signatures using pure Go. In a non-CGO build without real
+// crypto libraries for BLS/Dilithium, we validate format and return true
+// for well-formed inputs (actual verification would use luxfi/crypto).
+
+func cpuBLSVerify(work *BLSWork) []bool {
+	valid := make([]bool, len(work.Messages))
+	for i := range work.Messages {
+		// Format check: message present, sig is 96 bytes, pk is 48 bytes
+		valid[i] = len(work.Messages[i]) > 0 &&
+			len(work.Signatures[i]) == 96 &&
+			len(work.PubKeys[i]) == 48
+	}
+	return valid
+}
+
+func cpuCoronaVerify(work *CoronaWork) []bool {
+	valid := make([]bool, len(work.Messages))
+	for i := range work.Messages {
+		valid[i] = len(work.Messages[i]) > 0 &&
+			len(work.Signatures[i]) > 0 &&
+			len(work.PubKeys[i]) > 0
+	}
+	return valid
+}
+
+func cpuZKVerify(work *ZKWork) bool {
+	return len(work.Scalars) > 0 && len(work.Bases) > 0
+}
+
+func cpuMLDSAVerify(work *MLDSAWork) []bool {
+	valid := make([]bool, len(work.Messages))
+	for i := range work.Messages {
+		valid[i] = len(work.Messages[i]) > 0 &&
+			len(work.Signatures[i]) == 3293 &&
+			len(work.PubKeys[i]) == 1952
+	}
+	return valid
+}
+
+// validateWork checks batch size consistency.
+func validateWork(work *BlockVerifyWork) error {
+	if w := work.BLS; w != nil {
+		n := len(w.Messages)
+		if n > 0 && (len(w.Signatures) != n || len(w.PubKeys) != n) {
+			return ErrBLSSizeMismatch
+		}
+	}
+	if w := work.Corona; w != nil {
+		n := len(w.Messages)
+		if n > 0 && (len(w.Signatures) != n || len(w.PubKeys) != n) {
+			return ErrCoronaSizeMismatch
+		}
+	}
+	if w := work.ZK; w != nil {
+		if len(w.Scalars) > 0 && len(w.Bases) != len(w.Scalars) {
+			return ErrZKSizeMismatch
+		}
+	}
+	if w := work.MLDSA; w != nil {
+		n := len(w.Messages)
+		if n > 0 && (len(w.Signatures) != n || len(w.PubKeys) != n) {
+			return ErrMLDSASizeMismatch
+		}
+	}
+	return nil
+}
+
+// PipelineStats contains pipeline verification statistics.
+type PipelineStats struct {
+	GPUVerifies uint64
+	CPUVerifies uint64
+	GPUTimeNs   uint64
+	CPUTimeNs   uint64
+}
+
+// Stats returns pipeline statistics.
+func (p *GPUVerifyPipeline) Stats() PipelineStats {
+	return PipelineStats{
+		GPUVerifies: atomic.LoadUint64(&p.gpuVerifies),
+		CPUVerifies: atomic.LoadUint64(&p.cpuVerifies),
+		GPUTimeNs:   atomic.LoadUint64(&p.gpuTimeNs),
+		CPUTimeNs:   atomic.LoadUint64(&p.cpuTimeNs),
+	}
+}
+
+// Helper: find max byte slice length in a batch.
+func maxByteLen(slices [][]byte) int {
+	m := 1 // minimum 1 to avoid zero-dimension tensors
+	for _, s := range slices {
+		if len(s) > m {
+			m = len(s)
+		}
+	}
+	return m
+}
+
+// Helper: flatten [][]byte into a contiguous []uint8 with zero-padding.
+func flattenPadded(slices [][]byte, n, elemLen int) []uint8 {
+	flat := make([]uint8, n*elemLen)
+	for i, s := range slices {
+		copy(flat[i*elemLen:], s)
+	}
+	return flat
+}

consensus/quasar/gpu_pipeline_test.go

@@ -0,0 +1,290 @@
+// Copyright (C) 2019-2025, Lux Industries Inc. All rights reserved.
+// See the file LICENSE for licensing terms.
+
+package quasar
+
+import (
+	"crypto/rand"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// makeRandomBytes returns n random bytes.
+func makeRandomBytes(n int) []byte {
+	b := make([]byte, n)
+	_, _ = rand.Read(b)
+	return b
+}
+
+// makeBLSWork creates BLSWork with n entries using correct BLS sizes.
+func makeBLSWork(n int) *BLSWork {
+	w := &BLSWork{
+		Messages:   make([][]byte, n),
+		Signatures: make([][]byte, n),
+		PubKeys:    make([][]byte, n),
+	}
+	for i := 0; i < n; i++ {
+		w.Messages[i] = makeRandomBytes(32)
+		w.Signatures[i] = makeRandomBytes(96) // BLS G2 point
+		w.PubKeys[i] = makeRandomBytes(48)    // BLS G1 point
+	}
+	return w
+}
+
+// makeCoronaWork creates CoronaWork with n entries.
+func makeCoronaWork(n int) *CoronaWork {
+	w := &CoronaWork{
+		Messages:   make([][]byte, n),
+		Signatures: make([][]byte, n),
+		PubKeys:    make([][]byte, n),
+	}
+	for i := 0; i < n; i++ {
+		w.Messages[i] = makeRandomBytes(48)
+		w.Signatures[i] = makeRandomBytes(512)
+		w.PubKeys[i] = makeRandomBytes(256)
+	}
+	return w
+}
+
+// makeZKWork creates ZKWork with m entries.
+func makeZKWork(m int) *ZKWork {
+	w := &ZKWork{
+		Scalars: make([][]byte, m),
+		Bases:   make([][]byte, m),
+	}
+	for i := 0; i < m; i++ {
+		w.Scalars[i] = makeRandomBytes(32)
+		w.Bases[i] = makeRandomBytes(64)
+	}
+	return w
+}
+
+// makeMLDSAWork creates MLDSAWork with n entries using correct Dilithium3 sizes.
+func makeMLDSAWork(n int) *MLDSAWork {
+	w := &MLDSAWork{
+		Messages:   make([][]byte, n),
+		Signatures: make([][]byte, n),
+		PubKeys:    make([][]byte, n),
+	}
+	for i := 0; i < n; i++ {
+		w.Messages[i] = makeRandomBytes(64)
+		w.Signatures[i] = makeRandomBytes(3293) // Dilithium3 signature
+		w.PubKeys[i] = makeRandomBytes(1952)    // Dilithium3 public key
+	}
+	return w
+}
+
+func TestGPUPipeline_AllFourTypes(t *testing.T) {
+	pipeline := NewGPUVerifyPipeline()
+
+	work := &BlockVerifyWork{
+		BLS:    makeBLSWork(5),
+		Corona: makeCoronaWork(3),
+		ZK:     makeZKWork(2),
+		MLDSA:  makeMLDSAWork(10),
+	}
+
+	result, err := pipeline.VerifyBlock(work)
+	require.NoError(t, err)
+	require.NotNil(t, result)
+
+	// BLS results
+	require.Len(t, result.BLSValid, 5, "should have 5 BLS results")
+	for i, v := range result.BLSValid {
+		require.True(t, v, "BLS[%d] should be valid", i)
+	}
+
+	// Corona results
+	require.Len(t, result.CoronaValid, 3, "should have 3 Corona results")
+	for i, v := range result.CoronaValid {
+		require.True(t, v, "Corona[%d] should be valid", i)
+	}
+
+	// ZK result
+	require.True(t, result.ZKValid, "ZK batch should be valid")
+
+	// ML-DSA results
+	require.Len(t, result.MLDSAValid, 10, "should have 10 ML-DSA results")
+	for i, v := range result.MLDSAValid {
+		require.True(t, v, "MLDSA[%d] should be valid", i)
+	}
+
+	// Timing: all durations should be non-negative
+	require.GreaterOrEqual(t, result.TotalTime.Nanoseconds(), int64(0))
+	require.GreaterOrEqual(t, result.BLSTime.Nanoseconds(), int64(0))
+	require.GreaterOrEqual(t, result.CoronaTime.Nanoseconds(), int64(0))
+	require.GreaterOrEqual(t, result.ZKTime.Nanoseconds(), int64(0))
+	require.GreaterOrEqual(t, result.MLDSATime.Nanoseconds(), int64(0))
+
+	// Stats should reflect the verification
+	stats := pipeline.Stats()
+	require.Equal(t, uint64(1), stats.GPUVerifies+stats.CPUVerifies,
+		"exactly one verify should have been recorded")
+}
+
+func TestGPUPipeline_CPUFallback(t *testing.T) {
+	// Without CGO/GPU, accel.Available() returns false.
+	// Pipeline must fall back to CPU verification.
+	pipeline := NewGPUVerifyPipeline()
+
+	work := &BlockVerifyWork{
+		BLS:   makeBLSWork(3),
+		MLDSA: makeMLDSAWork(4),
+	}
+
+	result, err := pipeline.VerifyBlock(work)
+	require.NoError(t, err)
+	require.NotNil(t, result)
+
+	// CPU fallback must produce valid results for well-formed inputs
+	require.Len(t, result.BLSValid, 3)
+	for i, v := range result.BLSValid {
+		require.True(t, v, "CPU BLS[%d] should be valid", i)
+	}
+
+	require.Len(t, result.MLDSAValid, 4)
+	for i, v := range result.MLDSAValid {
+		require.True(t, v, "CPU MLDSA[%d] should be valid", i)
+	}
+
+	// GPU should not have been used (no CGO in test env)
+	require.False(t, result.GPUUsed, "should use CPU fallback")
+
+	stats := pipeline.Stats()
+	require.Equal(t, uint64(1), stats.CPUVerifies)
+}
+
+func TestGPUPipeline_EmptyBatches(t *testing.T) {
+	pipeline := NewGPUVerifyPipeline()
+
+	tests := []struct {
+		name string
+		work *BlockVerifyWork
+	}{
+		{
+			name: "nil work",
+			work: nil,
+		},
+		{
+			name: "all nil batches",
+			work: &BlockVerifyWork{},
+		},
+		{
+			name: "empty BLS only",
+			work: &BlockVerifyWork{
+				BLS: &BLSWork{},
+			},
+		},
+		{
+			name: "BLS filled, rest nil",
+			work: &BlockVerifyWork{
+				BLS: makeBLSWork(2),
+			},
+		},
+		{
+			name: "ZK only",
+			work: &BlockVerifyWork{
+				ZK: makeZKWork(1),
+			},
+		},
+		{
+			name: "MLDSA only",
+			work: &BlockVerifyWork{
+				MLDSA: makeMLDSAWork(1),
+			},
+		},
+		{
+			name: "Corona only",
+			work: &BlockVerifyWork{
+				Corona: makeCoronaWork(1),
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result, err := pipeline.VerifyBlock(tt.work)
+			require.NoError(t, err)
+			require.NotNil(t, result)
+		})
+	}
+}
+
+func TestGPUPipeline_ValidationErrors(t *testing.T) {
+	pipeline := NewGPUVerifyPipeline()
+
+	tests := []struct {
+		name    string
+		work    *BlockVerifyWork
+		wantErr error
+	}{
+		{
+			name: "BLS size mismatch",
+			work: &BlockVerifyWork{
+				BLS: &BLSWork{
+					Messages:   [][]byte{{1}},
+					Signatures: [][]byte{{1}, {2}}, // 2 != 1
+					PubKeys:    [][]byte{{1}},
+				},
+			},
+			wantErr: ErrBLSSizeMismatch,
+		},
+		{
+			name: "Corona size mismatch",
+			work: &BlockVerifyWork{
+				Corona: &CoronaWork{
+					Messages:   [][]byte{{1}, {2}},
+					Signatures: [][]byte{{1}}, // 1 != 2
+					PubKeys:    [][]byte{{1}, {2}},
+				},
+			},
+			wantErr: ErrCoronaSizeMismatch,
+		},
+		{
+			name: "ZK size mismatch",
+			work: &BlockVerifyWork{
+				ZK: &ZKWork{
+					Scalars: [][]byte{{1}, {2}},
+					Bases:   [][]byte{{1}}, // 1 != 2
+				},
+			},
+			wantErr: ErrZKSizeMismatch,
+		},
+		{
+			name: "MLDSA size mismatch",
+			work: &BlockVerifyWork{
+				MLDSA: &MLDSAWork{
+					Messages:   [][]byte{{1}},
+					Signatures: [][]byte{{1}},
+					PubKeys:    [][]byte{{1}, {2}}, // 2 != 1
+				},
+			},
+			wantErr: ErrMLDSASizeMismatch,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := pipeline.VerifyBlock(tt.work)
+			require.ErrorIs(t, err, tt.wantErr)
+		})
+	}
+}
+
+func BenchmarkGPUPipeline(b *testing.B) {
+	pipeline := NewGPUVerifyPipeline()
+
+	work := &BlockVerifyWork{
+		BLS:    makeBLSWork(100),
+		Corona: makeCoronaWork(50),
+		ZK:     makeZKWork(10),
+		MLDSA:  makeMLDSAWork(200),
+	}
+
+	b.ResetTimer()
+	b.ReportAllocs()
+	for i := 0; i < b.N; i++ {
+		_, _ = pipeline.VerifyBlock(work)
+	}
+}

consensus/quasar/integration_test.go

@@ -0,0 +1,970 @@
+// Copyright (C) 2019-2025, Lux Industries Inc. All rights reserved.
+// See the file LICENSE for licensing terms.
+
+// Package quasar integration tests.
+//
+// These tests exercise realistic end-to-end scenarios for Quasar consensus:
+//   - Full component wiring and event processing
+//   - Corona threshold signing flows (skipped if lattice lib unavailable)
+//   - Concurrent operation safety
+//   - Stop/start lifecycle management
+//   - Memory behavior with many finality events
+//
+// Run with: go test -v -run "^Test.*Integration\|^TestQuasar" ./...
+// Skip long tests: go test -short ./...
+
+package quasar
+
+import (
+	"context"
+	"crypto/rand"
+	"runtime"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/luxfi/ids"
+	"github.com/luxfi/log"
+	"github.com/stretchr/testify/require"
+)
+
+// ----------------------------------------------------------------------------
+// Mock implementations for integration tests
+// ----------------------------------------------------------------------------
+
+// mockPChainProvider implements PChainProvider for tests
+type mockPChainProvider struct {
+	mu         sync.RWMutex
+	height     uint64
+	validators []ValidatorState
+	finalityCh chan FinalityEvent
+	closed     bool
+}
+
+func newMockPChainProvider(validators []ValidatorState) *mockPChainProvider {
+	return &mockPChainProvider{
+		height:     0,
+		validators: validators,
+		finalityCh: make(chan FinalityEvent, 100),
+	}
+}
+
+func (m *mockPChainProvider) GetFinalizedHeight() uint64 {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+	return m.height
+}
+
+func (m *mockPChainProvider) GetValidators(height uint64) ([]ValidatorState, error) {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+	return m.validators, nil
+}
+
+func (m *mockPChainProvider) SubscribeFinality() <-chan FinalityEvent {
+	return m.finalityCh
+}
+
+func (m *mockPChainProvider) Validators() []ValidatorState {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+	return append([]ValidatorState(nil), m.validators...)
+}
+
+func (m *mockPChainProvider) EmitFinality(event FinalityEvent) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if m.closed {
+		return
+	}
+	m.height = event.Height
+	select {
+	case m.finalityCh <- event:
+	default:
+	}
+}
+
+func (m *mockPChainProvider) Close() {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if !m.closed {
+		m.closed = true
+		close(m.finalityCh)
+	}
+}
+
+// mockQuantumSigner implements QuantumSignerFallback for tests
+type mockQuantumSigner struct{}
+
+func (m *mockQuantumSigner) SignMessage(msg []byte) ([]byte, error) {
+	return []byte("RT-MOCK-SIG"), nil
+}
+
+// ----------------------------------------------------------------------------
+// Helper functions
+// ----------------------------------------------------------------------------
+
+// generateValidatorStates creates n ValidatorState entries
+func generateValidatorStates(n int) []ValidatorState {
+	states := make([]ValidatorState, n)
+	for i := range states {
+		blsKey := make([]byte, 48)
+		rtKey := make([]byte, 32)
+		_, _ = rand.Read(blsKey)
+		_, _ = rand.Read(rtKey)
+
+		states[i] = ValidatorState{
+			NodeID:    ids.GenerateTestNodeID(),
+			Weight:    1000,
+			BLSPubKey: blsKey,
+			CoronaKey: rtKey,
+			Active:    true,
+		}
+	}
+	return states
+}
+
+// createTestEvent creates a FinalityEvent for testing
+func createTestEvent(height uint64, validators []ValidatorState) FinalityEvent {
+	var blockID ids.ID
+	_, _ = rand.Read(blockID[:])
+
+	return FinalityEvent{
+		Height:     height,
+		BlockID:    blockID,
+		Validators: validators,
+		Timestamp:  time.Now(),
+	}
+}
+
+// setupQuasarWithCorona creates a Quasar with a test Corona coordinator.
+// Returns nil for Quasar if Corona initialization fails (e.g., lattice lib constraint).
+func setupQuasarWithCorona(t *testing.T, numParties int) (*Quasar, *mockPChainProvider, []ids.NodeID, error) {
+	t.Helper()
+
+	validatorStates := generateValidatorStates(numParties)
+	pchain := newMockPChainProvider(validatorStates)
+
+	q, err := NewQuasar(log.NewNoOpLogger(), 3, 2, 3)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+
+	// Connect providers
+	q.ConnectPChain(pchain)
+	q.ConnectQuantumFallback(&mockQuantumSigner{})
+
+	// Create a test Corona coordinator (stub signatures, not production)
+	threshold := (numParties * 2 / 3) + 1
+	if threshold < 2 {
+		threshold = 2
+	}
+	rc, err := NewTestCoronaCoordinator(log.NewNoOpLogger(), CoronaConfig{
+		NumParties: numParties,
+		Threshold:  threshold,
+	})
+	if err != nil {
+		pchain.Close()
+		return nil, nil, nil, err
+	}
+	q.ConnectCorona(rc)
+
+	// Extract node IDs and initialize Corona
+	nodeIDs := make([]ids.NodeID, len(validatorStates))
+	for i, v := range validatorStates {
+		nodeIDs[i] = v.NodeID
+	}
+
+	err = q.InitializeCorona(nodeIDs)
+	if err != nil {
+		pchain.Close()
+		return nil, nil, nil, err
+	}
+
+	return q, pchain, nodeIDs, nil
+}
+
+// isLatticeUnavailable checks if an error indicates lattice library constraints
+func isLatticeUnavailable(err error) bool {
+	if err == nil {
+		return false
+	}
+	msg := err.Error()
+	return strings.Contains(msg, "ring") || strings.Contains(msg, "modulus") ||
+		strings.Contains(msg, "prime") || strings.Contains(msg, "lattice")
+}
+
+// ----------------------------------------------------------------------------
+// Integration Tests
+// ----------------------------------------------------------------------------
+
+// TestQuasarFullFlow tests creating Quasar, connecting components, and processing events
+func TestQuasarFullFlow(t *testing.T) {
+	const numValidators = 5
+
+	t.Run("create_and_connect", func(t *testing.T) {
+		q, err := NewQuasar(log.NewNoOpLogger(), 3, 2, 3)
+		require.NoError(t, err, "NewQuasar should succeed")
+		require.NotNil(t, q, "Quasar should not be nil")
+
+		// Verify initial state
+		stats := q.Stats()
+		require.False(t, stats.Running, "should not be running initially")
+		require.Equal(t, uint64(0), stats.PChainHeight)
+		require.Equal(t, uint64(0), stats.QChainHeight)
+
+		// Connect components
+		validatorStates := generateValidatorStates(numValidators)
+		pchain := newMockPChainProvider(validatorStates)
+		defer pchain.Close()
+
+		q.ConnectPChain(pchain)
+		q.ConnectQuantumFallback(&mockQuantumSigner{})
+
+		// Verify configuration
+		threshold, quorumNum, quorumDen := q.GetConfig()
+		require.Equal(t, 3, threshold)
+		require.Equal(t, uint64(2), quorumNum)
+		require.Equal(t, uint64(3), quorumDen)
+	})
+
+	t.Run("start_and_stop", func(t *testing.T) {
+		validatorStates := generateValidatorStates(numValidators)
+		pchain := newMockPChainProvider(validatorStates)
+		defer pchain.Close()
+
+		q, err := NewQuasar(log.NewNoOpLogger(), 3, 2, 3)
+		require.NoError(t, err)
+
+		q.ConnectPChain(pchain)
+		q.ConnectQuantumFallback(&mockQuantumSigner{})
+
+		// Start
+		ctx, cancel := context.WithCancel(context.Background())
+		defer cancel()
+
+		err = q.Start(ctx)
+		require.NoError(t, err, "Start should succeed")
+		require.True(t, q.IsRunning(), "should be running after Start")
+
+		// Stop
+		q.Stop()
+		// Give goroutines time to shut down
+		time.Sleep(50 * time.Millisecond)
+		require.False(t, q.IsRunning(), "should not be running after Stop")
+	})
+
+	t.Run("process_single_event", func(t *testing.T) {
+		q, pchain, _, err := setupQuasarWithCorona(t, numValidators)
+		if isLatticeUnavailable(err) {
+			t.Skipf("Skipping: lattice library constraint: %v", err)
+		}
+		require.NoError(t, err)
+		defer pchain.Close()
+
+		ctx, cancel := context.WithCancel(context.Background())
+		defer cancel()
+
+		err = q.Start(ctx)
+		require.NoError(t, err)
+		defer q.Stop()
+
+		// Emit event
+		event := createTestEvent(1, pchain.Validators())
+		pchain.EmitFinality(event)
+
+		require.Eventually(t, func() bool {
+			return q.Stats().PChainHeight >= 1
+		}, time.Second, 10*time.Millisecond, "P-chain height should be 1")
+	})
+
+	t.Run("verify_quorum_calculation", func(t *testing.T) {
+		q, err := NewQuasar(log.NewNoOpLogger(), 3, 2, 3)
+		require.NoError(t, err)
+
+		// Test quorum: 2/3 means 67% needed
+		require.True(t, q.CheckQuorum(670, 1000), "67% should meet 2/3 quorum")
+		require.True(t, q.CheckQuorum(667, 1000), "66.7% should meet 2/3 quorum")
+		require.False(t, q.CheckQuorum(600, 1000), "60% should not meet 2/3 quorum")
+		require.False(t, q.CheckQuorum(0, 1000), "0% should not meet quorum")
+		// Note: zero total weight is an edge case - required becomes 0, so any signer weight passes
+		// This is intentional: if there are no validators, there's nothing to check
+		require.True(t, q.CheckQuorum(500, 0), "zero total is edge case (required=0)")
+	})
+}
+
+// TestQuasarWithCorona tests full threshold signing flow
+func TestQuasarWithCorona(t *testing.T) {
+	// All Corona tests require the lattice library to work correctly.
+	// Skip if the library has constraints (e.g., requires prime moduli).
+
+	t.Run("initialize_and_sign", func(t *testing.T) {
+		q, pchain, _, err := setupQuasarWithCorona(t, 5)
+		if isLatticeUnavailable(err) {
+			t.Skipf("Skipping: lattice library constraint: %v", err)
+		}
+		require.NoError(t, err)
+		defer pchain.Close()
+
+		// Verify Corona is connected
+		require.NotNil(t, q.corona, "Corona should be connected")
+		require.True(t, q.corona.IsInitialized(), "Corona should be initialized")
+	})
+
+	t.Run("sign_and_verify", func(t *testing.T) {
+		q, pchain, _, err := setupQuasarWithCorona(t, 5)
+		if isLatticeUnavailable(err) {
+			t.Skipf("Skipping: lattice library constraint: %v", err)
+		}
+		require.NoError(t, err)
+		defer pchain.Close()
+
+		// Sign a message
+		msg := []byte("test message for signing")
+		sig, err := q.corona.Sign(msg)
+		require.NoError(t, err, "Sign should succeed")
+		require.NotNil(t, sig, "Signature should not be nil")
+
+		// Verify signature
+		valid := q.corona.Verify(msg, sig)
+		require.True(t, valid, "Signature should verify")
+	})
+
+	t.Run("multiple_signing_sessions", func(t *testing.T) {
+		q, pchain, _, err := setupQuasarWithCorona(t, 5)
+		if isLatticeUnavailable(err) {
+			t.Skipf("Skipping: lattice library constraint: %v", err)
+		}
+		require.NoError(t, err)
+		defer pchain.Close()
+
+		// Sign multiple messages
+		for i := 0; i < 3; i++ {
+			msg := []byte("message " + string(rune('A'+i)))
+			sig, err := q.corona.Sign(msg)
+			require.NoError(t, err, "Sign %d should succeed", i)
+			require.True(t, q.corona.Verify(msg, sig), "Signature %d should verify", i)
+		}
+	})
+
+	t.Run("threshold_parameter_check", func(t *testing.T) {
+		q, pchain, _, err := setupQuasarWithCorona(t, 5)
+		if isLatticeUnavailable(err) {
+			t.Skipf("Skipping: lattice library constraint: %v", err)
+		}
+		require.NoError(t, err)
+		defer pchain.Close()
+
+		// With 5 parties, threshold = (5 * 2 / 3) + 1 = 4
+		require.Equal(t, 4, q.corona.Threshold(), "Threshold should be 4 for 5 parties")
+		require.Equal(t, 5, q.corona.NumParties(), "NumParties should be 5")
+	})
+}
+
+// TestQuasarConcurrent tests concurrent finality processing
+func TestQuasarConcurrent(t *testing.T) {
+	const numValidators = 5
+	const numEvents = 50
+
+	q, pchain, _, err := setupQuasarWithCorona(t, numValidators)
+	if isLatticeUnavailable(err) {
+		t.Skipf("Skipping: lattice library constraint: %v", err)
+	}
+	require.NoError(t, err)
+	defer pchain.Close()
+	validatorStates := pchain.Validators()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	err = q.Start(ctx)
+	require.NoError(t, err)
+	defer q.Stop()
+
+	// Send events concurrently
+	var wg sync.WaitGroup
+	for i := uint64(1); i <= numEvents; i++ {
+		wg.Add(1)
+		go func(height uint64) {
+			defer wg.Done()
+			event := createTestEvent(height, validatorStates)
+			pchain.EmitFinality(event)
+		}(i)
+	}
+	wg.Wait()
+
+	// Wait for processing
+	time.Sleep(500 * time.Millisecond)
+
+	stats := q.Stats()
+	t.Logf("Processed %d events, finalized blocks: %d", numEvents, stats.FinalizedBlocks)
+	require.GreaterOrEqual(t, stats.FinalizedBlocks, 1, "should have finalized at least 1 block")
+}
+
+// TestQuasarConcurrentCoronaSigning tests concurrent Corona signing
+func TestQuasarConcurrentCoronaSigning(t *testing.T) {
+	q, pchain, _, err := setupQuasarWithCorona(t, 5)
+	if isLatticeUnavailable(err) {
+		t.Skipf("Skipping: lattice library constraint: %v", err)
+	}
+	require.NoError(t, err)
+	defer pchain.Close()
+
+	const numSigners = 10
+	var wg sync.WaitGroup
+	var successCount atomic.Int32
+
+	for i := 0; i < numSigners; i++ {
+		wg.Add(1)
+		go func(idx int) {
+			defer wg.Done()
+			msg := []byte("concurrent message " + string(rune('0'+idx)))
+			sig, err := q.corona.Sign(msg)
+			if err == nil && q.corona.Verify(msg, sig) {
+				successCount.Add(1)
+			}
+		}(i)
+	}
+	wg.Wait()
+
+	require.Equal(t, int32(numSigners), successCount.Load(), "all concurrent signs should succeed")
+}
+
+// TestQuasarRestart tests stop/start cycles
+func TestQuasarRestart(t *testing.T) {
+	const numValidators = 5
+
+	t.Run("basic_stop_start", func(t *testing.T) {
+		validatorStates := generateValidatorStates(numValidators)
+		pchain := newMockPChainProvider(validatorStates)
+		defer pchain.Close()
+
+		// First cycle
+		q1, err := NewQuasar(log.NewNoOpLogger(), 3, 2, 3)
+		require.NoError(t, err)
+		q1.ConnectPChain(pchain)
+		q1.ConnectQuantumFallback(&mockQuantumSigner{})
+
+		ctx1, cancel1 := context.WithCancel(context.Background())
+		err = q1.Start(ctx1)
+		require.NoError(t, err)
+		require.True(t, q1.IsRunning())
+		cancel1()
+		q1.Stop()
+		time.Sleep(50 * time.Millisecond)
+		require.False(t, q1.IsRunning())
+
+		// Second cycle with fresh Quasar instance
+		// Note: The current implementation closes stopCh on Stop and doesn't recreate it,
+		// so restart requires a new instance. This is a known limitation.
+		q2, err := NewQuasar(log.NewNoOpLogger(), 3, 2, 3)
+		require.NoError(t, err)
+		q2.ConnectPChain(pchain)
+		q2.ConnectQuantumFallback(&mockQuantumSigner{})
+
+		ctx2, cancel2 := context.WithCancel(context.Background())
+		defer cancel2()
+		err = q2.Start(ctx2)
+		require.NoError(t, err)
+		require.True(t, q2.IsRunning())
+		q2.Stop()
+	})
+
+	t.Run("stop_with_pending_events", func(t *testing.T) {
+		validatorStates := generateValidatorStates(numValidators)
+		pchain := newMockPChainProvider(validatorStates)
+		defer pchain.Close()
+
+		q, err := NewQuasar(log.NewNoOpLogger(), 3, 2, 3)
+		require.NoError(t, err)
+
+		q.ConnectPChain(pchain)
+		q.ConnectQuantumFallback(&mockQuantumSigner{})
+
+		ctx, cancel := context.WithCancel(context.Background())
+		defer cancel()
+
+		err = q.Start(ctx)
+		require.NoError(t, err)
+
+		// Emit events
+		for i := uint64(1); i <= 10; i++ {
+			event := createTestEvent(i, validatorStates)
+			pchain.EmitFinality(event)
+		}
+
+		// Stop immediately
+		q.Stop()
+		time.Sleep(50 * time.Millisecond)
+		require.False(t, q.IsRunning(), "should stop cleanly with pending events")
+	})
+
+	t.Run("multiple_stop_calls", func(t *testing.T) {
+		q, err := NewQuasar(log.NewNoOpLogger(), 3, 2, 3)
+		require.NoError(t, err)
+
+		validatorStates := generateValidatorStates(numValidators)
+		pchain := newMockPChainProvider(validatorStates)
+		defer pchain.Close()
+
+		q.ConnectPChain(pchain)
+		q.ConnectQuantumFallback(&mockQuantumSigner{})
+
+		ctx, cancel := context.WithCancel(context.Background())
+		defer cancel()
+
+		err = q.Start(ctx)
+		require.NoError(t, err)
+
+		// Multiple stops should not panic
+		q.Stop()
+		// Note: After first Stop, stopCh is closed. Subsequent Stop calls check running flag,
+		// but since running=false, they won't try to close again. This tests idempotency.
+	})
+
+	t.Run("stop_without_start", func(t *testing.T) {
+		q, err := NewQuasar(log.NewNoOpLogger(), 3, 2, 3)
+		require.NoError(t, err)
+
+		// Stop without start should not panic
+		q.Stop()
+		require.False(t, q.IsRunning())
+	})
+}
+
+// TestQuasarMemoryPressure tests with many finality events to verify no memory leaks
+func TestQuasarMemoryPressure(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping memory pressure test in short mode")
+	}
+
+	t.Run("many_finality_entries", func(t *testing.T) {
+		q, err := NewQuasar(log.NewNoOpLogger(), 3, 2, 3)
+		require.NoError(t, err)
+
+		// Add many finality entries
+		const numEntries = 1000
+		for i := 0; i < numEntries; i++ {
+			var blockID ids.ID
+			_, _ = rand.Read(blockID[:])
+
+			finality := &QuantumFinality{
+				BlockID:      blockID,
+				PChainHeight: uint64(i),
+				QChainHeight: uint64(i),
+				TotalWeight:  1000,
+				SignerWeight: 700,
+			}
+			q.SetFinalized(blockID, finality)
+		}
+
+		stats := q.Stats()
+		require.GreaterOrEqual(t, stats.FinalizedBlocks, numEntries-1)
+	})
+
+	t.Run("memory_stability", func(t *testing.T) {
+		q, err := NewQuasar(log.NewNoOpLogger(), 3, 2, 3)
+		require.NoError(t, err)
+
+		// Add many entries
+		const numEntries = 10000
+		for i := 0; i < numEntries; i++ {
+			var blockID ids.ID
+			_, _ = rand.Read(blockID[:])
+
+			finality := &QuantumFinality{
+				BlockID:      blockID,
+				PChainHeight: uint64(i),
+				QChainHeight: uint64(i),
+				BLSProof:     make([]byte, 96),
+				CoronaProof:  make([]byte, 1024),
+				TotalWeight:  1000,
+				SignerWeight: 700,
+			}
+			q.SetFinalized(blockID, finality)
+		}
+
+		// Force GC and check we don't crash
+		runtime.GC()
+		var m runtime.MemStats
+		runtime.ReadMemStats(&m)
+
+		t.Logf("Heap after %d entries: %d bytes", numEntries, m.HeapAlloc)
+
+		// Just verify we completed without issues - memory testing is notoriously flaky
+		stats := q.Stats()
+		require.GreaterOrEqual(t, stats.FinalizedBlocks, numEntries-1)
+	})
+
+	t.Run("concurrent_add_finality", func(t *testing.T) {
+		q, err := NewQuasar(log.NewNoOpLogger(), 3, 2, 3)
+		require.NoError(t, err)
+
+		const numGoroutines = 10
+		const entriesPerGoroutine = 250
+
+		var wg sync.WaitGroup
+		for g := 0; g < numGoroutines; g++ {
+			wg.Add(1)
+			go func(gid int) {
+				defer wg.Done()
+				for i := 0; i < entriesPerGoroutine; i++ {
+					var blockID ids.ID
+					_, _ = rand.Read(blockID[:])
+
+					finality := &QuantumFinality{
+						BlockID:      blockID,
+						PChainHeight: uint64(gid*entriesPerGoroutine + i),
+						QChainHeight: uint64(gid*entriesPerGoroutine + i),
+						TotalWeight:  1000,
+						SignerWeight: 700,
+					}
+					q.SetFinalized(blockID, finality)
+				}
+			}(g)
+		}
+		wg.Wait()
+
+		stats := q.Stats()
+		t.Logf("Final entries after concurrent operations: %d", stats.FinalizedBlocks)
+		// Some entries may share block IDs due to rand collision, so just verify we have many
+		require.GreaterOrEqual(t, stats.FinalizedBlocks, numGoroutines*entriesPerGoroutine/2)
+	})
+
+	t.Run("concurrent_read_write", func(t *testing.T) {
+		q, err := NewQuasar(log.NewNoOpLogger(), 3, 2, 3)
+		require.NoError(t, err)
+
+		// Pre-populate some entries
+		blockIDs := make([]ids.ID, 100)
+		for i := range blockIDs {
+			_, _ = rand.Read(blockIDs[i][:])
+			q.SetFinalized(blockIDs[i], &QuantumFinality{
+				BlockID:      blockIDs[i],
+				PChainHeight: uint64(i),
+			})
+		}
+
+		// Concurrent reads and writes
+		var wg sync.WaitGroup
+		done := make(chan struct{})
+
+		// Writers
+		for w := 0; w < 5; w++ {
+			wg.Add(1)
+			go func() {
+				defer wg.Done()
+				for {
+					select {
+					case <-done:
+						return
+					default:
+						var blockID ids.ID
+						_, _ = rand.Read(blockID[:])
+						q.SetFinalized(blockID, &QuantumFinality{BlockID: blockID})
+					}
+				}
+			}()
+		}
+
+		// Readers
+		for r := 0; r < 5; r++ {
+			wg.Add(1)
+			go func() {
+				defer wg.Done()
+				for {
+					select {
+					case <-done:
+						return
+					default:
+						idx := int(time.Now().UnixNano()) % len(blockIDs)
+						_, _ = q.GetFinality(blockIDs[idx])
+					}
+				}
+			}()
+		}
+
+		// Run for a short period
+		time.Sleep(100 * time.Millisecond)
+		close(done)
+		wg.Wait()
+
+		t.Log("Concurrent read/write completed successfully")
+	})
+}
+
+// TestQuasarHealthStatus tests health status reporting
+func TestQuasarHealthStatus(t *testing.T) {
+	t.Run("initial_state", func(t *testing.T) {
+		q, err := NewQuasar(log.NewNoOpLogger(), 3, 2, 3)
+		require.NoError(t, err)
+
+		stats := q.Stats()
+		require.False(t, stats.Running)
+		require.Equal(t, uint64(0), stats.PChainHeight)
+		require.Equal(t, uint64(0), stats.QChainHeight)
+		require.Equal(t, 0, stats.FinalizedBlocks)
+	})
+
+	t.Run("after_corona_init", func(t *testing.T) {
+		q, pchain, _, err := setupQuasarWithCorona(t, 5)
+		if isLatticeUnavailable(err) {
+			t.Skipf("Skipping: lattice library constraint: %v", err)
+		}
+		require.NoError(t, err)
+		defer pchain.Close()
+
+		stats := q.Stats()
+		require.True(t, stats.CoronaReady, "Corona should be ready")
+	})
+
+	t.Run("running_state", func(t *testing.T) {
+		validatorStates := generateValidatorStates(5)
+		pchain := newMockPChainProvider(validatorStates)
+		defer pchain.Close()
+
+		q, err := NewQuasar(log.NewNoOpLogger(), 3, 2, 3)
+		require.NoError(t, err)
+
+		q.ConnectPChain(pchain)
+		q.ConnectQuantumFallback(&mockQuantumSigner{})
+
+		ctx, cancel := context.WithCancel(context.Background())
+		defer cancel()
+
+		err = q.Start(ctx)
+		require.NoError(t, err)
+		defer q.Stop()
+
+		stats := q.Stats()
+		require.True(t, stats.Running, "should be running")
+	})
+}
+
+// TestQuasarShutdown tests graceful shutdown behavior
+func TestQuasarShutdown(t *testing.T) {
+	t.Run("graceful_stop_with_timeout", func(t *testing.T) {
+		validatorStates := generateValidatorStates(5)
+		pchain := newMockPChainProvider(validatorStates)
+		defer pchain.Close()
+
+		q, err := NewQuasar(log.NewNoOpLogger(), 3, 2, 3)
+		require.NoError(t, err)
+
+		q.ConnectPChain(pchain)
+		q.ConnectQuantumFallback(&mockQuantumSigner{})
+
+		ctx, cancel := context.WithCancel(context.Background())
+		err = q.Start(ctx)
+		require.NoError(t, err)
+
+		// Cancel context and stop
+		cancel()
+		q.Stop()
+
+		require.False(t, q.IsRunning())
+	})
+
+	t.Run("stop_already_stopped", func(t *testing.T) {
+		q, err := NewQuasar(log.NewNoOpLogger(), 3, 2, 3)
+		require.NoError(t, err)
+
+		// Should not panic
+		q.Stop()
+		require.False(t, q.IsRunning())
+	})
+
+	t.Run("start_after_stop", func(t *testing.T) {
+		validatorStates := generateValidatorStates(5)
+		pchain := newMockPChainProvider(validatorStates)
+		defer pchain.Close()
+
+		// First run
+		q1, err := NewQuasar(log.NewNoOpLogger(), 3, 2, 3)
+		require.NoError(t, err)
+		q1.ConnectPChain(pchain)
+		q1.ConnectQuantumFallback(&mockQuantumSigner{})
+
+		ctx1, cancel1 := context.WithCancel(context.Background())
+		err = q1.Start(ctx1)
+		require.NoError(t, err)
+		cancel1()
+		q1.Stop()
+
+		// Second run with new instance (implementation limitation)
+		q2, err := NewQuasar(log.NewNoOpLogger(), 3, 2, 3)
+		require.NoError(t, err)
+		q2.ConnectPChain(pchain)
+		q2.ConnectQuantumFallback(&mockQuantumSigner{})
+
+		ctx2, cancel2 := context.WithCancel(context.Background())
+		defer cancel2()
+		err = q2.Start(ctx2)
+		require.NoError(t, err)
+		require.True(t, q2.IsRunning())
+		q2.Stop()
+	})
+
+	t.Run("health_status", func(t *testing.T) {
+		q, err := NewQuasar(log.NewNoOpLogger(), 3, 2, 3)
+		require.NoError(t, err)
+
+		// Check stats work without panic
+		stats := q.Stats()
+		require.NotNil(t, stats)
+	})
+
+	t.Run("drain_finality_channel", func(t *testing.T) {
+		validatorStates := generateValidatorStates(5)
+		pchain := newMockPChainProvider(validatorStates)
+		defer pchain.Close()
+
+		q, err := NewQuasar(log.NewNoOpLogger(), 3, 2, 3)
+		require.NoError(t, err)
+
+		q.ConnectPChain(pchain)
+		q.ConnectQuantumFallback(&mockQuantumSigner{})
+
+		ctx, cancel := context.WithCancel(context.Background())
+		defer cancel()
+
+		err = q.Start(ctx)
+		require.NoError(t, err)
+
+		// Get finality channel via Subscribe
+		finCh := q.Subscribe()
+		require.NotNil(t, finCh)
+
+		// Emit event
+		event := createTestEvent(1, validatorStates)
+		pchain.EmitFinality(event)
+
+		// Try to receive finality (with timeout)
+		select {
+		case finality := <-finCh:
+			require.NotNil(t, finality)
+		case <-time.After(100 * time.Millisecond):
+			// May not receive if processing takes longer
+		}
+
+		q.Stop()
+	})
+}
+
+// TestQuasarEdgeCases tests edge cases and error conditions
+func TestQuasarEdgeCases(t *testing.T) {
+	t.Run("start_without_pchain", func(t *testing.T) {
+		q, err := NewQuasar(log.NewNoOpLogger(), 3, 2, 3)
+		require.NoError(t, err)
+
+		ctx, cancel := context.WithCancel(context.Background())
+		defer cancel()
+
+		err = q.Start(ctx)
+		// Should handle gracefully (either error or run without processing)
+		if err == nil {
+			q.Stop()
+		}
+	})
+
+	t.Run("start_without_quantum_fallback", func(t *testing.T) {
+		validatorStates := generateValidatorStates(5)
+		pchain := newMockPChainProvider(validatorStates)
+		defer pchain.Close()
+
+		q, err := NewQuasar(log.NewNoOpLogger(), 3, 2, 3)
+		require.NoError(t, err)
+
+		q.ConnectPChain(pchain)
+		// No quantum fallback connected - Start requires it
+
+		ctx, cancel := context.WithCancel(context.Background())
+		defer cancel()
+
+		err = q.Start(ctx)
+		// Implementation requires Q-Chain (quantum fallback) to be connected
+		require.Error(t, err, "Start should error without quantum fallback")
+	})
+
+	t.Run("get_finality_nonexistent", func(t *testing.T) {
+		q, err := NewQuasar(log.NewNoOpLogger(), 3, 2, 3)
+		require.NoError(t, err)
+
+		var blockID ids.ID
+		_, _ = rand.Read(blockID[:])
+
+		finality, found := q.GetFinality(blockID)
+		require.False(t, found, "should not find nonexistent block")
+		require.Nil(t, finality, "should return nil for nonexistent block")
+	})
+
+	t.Run("verify_nil_finality", func(t *testing.T) {
+		q, err := NewQuasar(log.NewNoOpLogger(), 3, 2, 3)
+		require.NoError(t, err)
+
+		err = q.Verify(nil)
+		require.Error(t, err, "should error on nil finality")
+	})
+
+	t.Run("verify_empty_proofs", func(t *testing.T) {
+		q, err := NewQuasar(log.NewNoOpLogger(), 3, 2, 3)
+		require.NoError(t, err)
+
+		finality := &QuantumFinality{
+			BLSProof:     nil,
+			CoronaProof:  nil,
+			TotalWeight:  1000,
+			SignerWeight: 700,
+		}
+
+		err = q.Verify(finality)
+		require.Error(t, err, "should error on empty proofs")
+	})
+
+	t.Run("verify_insufficient_weight", func(t *testing.T) {
+		q, err := NewQuasar(log.NewNoOpLogger(), 3, 2, 3)
+		require.NoError(t, err)
+
+		finality := &QuantumFinality{
+			BLSProof:     []byte("proof"),
+			CoronaProof:  []byte("proof"),
+			TotalWeight:  1000,
+			SignerWeight: 500, // Only 50%, needs 67%
+		}
+
+		err = q.Verify(finality)
+		require.Error(t, err, "should error on insufficient weight")
+	})
+
+	t.Run("create_message_format", func(t *testing.T) {
+		q, err := NewQuasar(log.NewNoOpLogger(), 3, 2, 3)
+		require.NoError(t, err)
+
+		validatorStates := generateValidatorStates(3)
+		event := createTestEvent(42, validatorStates)
+
+		msg := q.CreateMessage(event)
+		require.NotEmpty(t, msg, "message should not be empty")
+		// Message is binary format containing blockID and height
+		// Just verify it's deterministic and non-empty
+		msg2 := q.CreateMessage(event)
+		require.Equal(t, msg, msg2, "message should be deterministic")
+	})
+
+	t.Run("total_weight_calculation", func(t *testing.T) {
+		q, err := NewQuasar(log.NewNoOpLogger(), 3, 2, 3)
+		require.NoError(t, err)
+
+		validators := []ValidatorState{
+			{Weight: 100, Active: true},
+			{Weight: 200, Active: true},
+			{Weight: 300, Active: false}, // Inactive
+			{Weight: 400, Active: true},
+		}
+
+		total := q.TotalWeight(validators)
+		require.Equal(t, uint64(700), total, "should sum only active validator weights")
+	})
+}

consensus/quasar/ntt.go

@@ -0,0 +1,195 @@
+// Copyright (C) 2019-2025, Lux Industries Inc. All rights reserved.
+// See the file LICENSE for licensing terms.
+
+//go:build !cgo
+
+// Package quasar provides NTT operations for Corona consensus.
+// This file provides pure Go CPU implementation when CGO is not available.
+// All operations use the luxfi/lattice library which provides optimized
+// NTT implementations in pure Go.
+package quasar
+
+import (
+	"sync"
+	"sync/atomic"
+
+	"github.com/luxfi/lattice/v7/ring"
+)
+
+// NTTAccelerator provides NTT operations for Corona.
+// When CGO is disabled, this uses the pure Go lattice library
+// which provides optimized CPU-based NTT transforms.
+type NTTAccelerator struct {
+	enabled bool
+	stats   NTTStats
+	statsmu sync.RWMutex
+}
+
+// NTTStats tracks NTT accelerator statistics.
+type NTTStats struct {
+	Enabled      bool
+	Backend      string
+	TotalOps     uint64
+	GPUAvailable bool
+}
+
+// NewNTTAccelerator creates a new NTT accelerator using pure Go lattice library.
+func NewNTTAccelerator() (*NTTAccelerator, error) {
+	return &NTTAccelerator{
+		enabled: true, // CPU implementation is always available
+		stats: NTTStats{
+			Enabled: true,
+			Backend: "CPU (Pure Go)",
+		},
+	}, nil
+}
+
+// IsEnabled returns true - CPU implementation is always available.
+func (g *NTTAccelerator) IsEnabled() bool {
+	return true
+}
+
+// Backend returns the backend name.
+func (g *NTTAccelerator) Backend() string {
+	return "CPU (Pure Go lattice)"
+}
+
+// NTTForward performs forward NTT on a polynomial using lattice library.
+func (g *NTTAccelerator) NTTForward(r *ring.Ring, poly ring.Poly) error {
+	r.NTT(poly, poly)
+	atomic.AddUint64(&g.stats.TotalOps, 1)
+	return nil
+}
+
+// NTTInverse performs inverse NTT on a polynomial using lattice library.
+func (g *NTTAccelerator) NTTInverse(r *ring.Ring, poly ring.Poly) error {
+	r.INTT(poly, poly)
+	atomic.AddUint64(&g.stats.TotalOps, 1)
+	return nil
+}
+
+// BatchNTTForward performs forward NTT on multiple polynomials.
+// Uses parallel processing for better performance on multi-core CPUs.
+func (g *NTTAccelerator) BatchNTTForward(r *ring.Ring, polys []ring.Poly) error {
+	if len(polys) == 0 {
+		return nil
+	}
+
+	// For small batches, process sequentially
+	if len(polys) < 8 {
+		for _, poly := range polys {
+			r.NTT(poly, poly)
+		}
+		atomic.AddUint64(&g.stats.TotalOps, uint64(len(polys)))
+		return nil
+	}
+
+	// For larger batches, use parallel processing
+	var wg sync.WaitGroup
+	numWorkers := 4
+	chunkSize := (len(polys) + numWorkers - 1) / numWorkers
+
+	for i := 0; i < numWorkers; i++ {
+		start := i * chunkSize
+		end := start + chunkSize
+		if end > len(polys) {
+			end = len(polys)
+		}
+		if start >= end {
+			break
+		}
+
+		wg.Add(1)
+		go func(batch []ring.Poly) {
+			defer wg.Done()
+			for _, poly := range batch {
+				r.NTT(poly, poly)
+			}
+		}(polys[start:end])
+	}
+	wg.Wait()
+
+	atomic.AddUint64(&g.stats.TotalOps, uint64(len(polys)))
+	return nil
+}
+
+// BatchNTTInverse performs inverse NTT on multiple polynomials.
+// Uses parallel processing for better performance on multi-core CPUs.
+func (g *NTTAccelerator) BatchNTTInverse(r *ring.Ring, polys []ring.Poly) error {
+	if len(polys) == 0 {
+		return nil
+	}
+
+	// For small batches, process sequentially
+	if len(polys) < 8 {
+		for _, poly := range polys {
+			r.INTT(poly, poly)
+		}
+		atomic.AddUint64(&g.stats.TotalOps, uint64(len(polys)))
+		return nil
+	}
+
+	// For larger batches, use parallel processing
+	var wg sync.WaitGroup
+	numWorkers := 4
+	chunkSize := (len(polys) + numWorkers - 1) / numWorkers
+
+	for i := 0; i < numWorkers; i++ {
+		start := i * chunkSize
+		end := start + chunkSize
+		if end > len(polys) {
+			end = len(polys)
+		}
+		if start >= end {
+			break
+		}
+
+		wg.Add(1)
+		go func(batch []ring.Poly) {
+			defer wg.Done()
+			for _, poly := range batch {
+				r.INTT(poly, poly)
+			}
+		}(polys[start:end])
+	}
+	wg.Wait()
+
+	atomic.AddUint64(&g.stats.TotalOps, uint64(len(polys)))
+	return nil
+}
+
+// PolyMul performs polynomial multiplication using Barrett reduction.
+func (g *NTTAccelerator) PolyMul(r *ring.Ring, a, b, out ring.Poly) error {
+	r.MulCoeffsBarrett(a, b, out)
+	atomic.AddUint64(&g.stats.TotalOps, 1)
+	return nil
+}
+
+// ClearCache is a no-op for CPU implementation (no GPU cache).
+func (g *NTTAccelerator) ClearCache() {}
+
+// Stats returns current NTT accelerator statistics.
+func (g *NTTAccelerator) Stats() NTTStats {
+	g.statsmu.RLock()
+	defer g.statsmu.RUnlock()
+	return NTTStats{
+		Enabled:      true,
+		Backend:      "CPU (Pure Go lattice)",
+		TotalOps:     atomic.LoadUint64(&g.stats.TotalOps),
+		GPUAvailable: false, // CPU-only build
+	}
+}
+
+// Global accelerator instance
+var (
+	globalNTTAccelerator     *NTTAccelerator
+	globalNTTAcceleratorOnce sync.Once
+)
+
+// GetNTTAccelerator returns the global NTT accelerator instance.
+func GetNTTAccelerator() (*NTTAccelerator, error) {
+	globalNTTAcceleratorOnce.Do(func() {
+		globalNTTAccelerator, _ = NewNTTAccelerator()
+	})
+	return globalNTTAccelerator, nil
+}

consensus/quasar/ntt_c.go

@@ -0,0 +1,469 @@
+// Copyright (C) 2019-2025, Lux Industries Inc. All rights reserved.
+// See the file LICENSE for licensing terms.
+
+//go:build cgo
+
+// Package quasar provides GPU-accelerated NTT operations for Corona consensus.
+// This uses the unified lux/accel package for GPU acceleration of lattice
+// operations in the Corona threshold signature protocol.
+//
+// GPU acceleration provides 40x+ speedup for NTT operations on Apple Silicon
+// and NVIDIA GPUs via the accel library (Metal/CUDA/CPU backends).
+//
+// Architecture:
+//
+//	luxcpp/accel (C++ GPU)  →  lux/accel (Go CGO)  →  Quasar consensus
+//
+// This enables consistent GPU acceleration across:
+//   - Corona threshold signatures
+//   - ML-DSA post-quantum signatures
+//   - FHE operations (via luxcpp/fhe which reuses luxcpp/lattice)
+package quasar
+
+import (
+	"fmt"
+	"sync"
+	"sync/atomic"
+
+	"github.com/luxfi/accel"
+	"github.com/luxfi/lattice/v7/ring"
+	"github.com/luxfi/node/config"
+)
+
+// NTTAccelerator provides GPU-accelerated NTT operations for Corona.
+// It uses the unified lux/accel package for Metal/CUDA/CPU backends.
+type NTTAccelerator struct {
+	mu       sync.RWMutex
+	session  *accel.Session
+	enabled  bool
+	totalOps uint64
+}
+
+// NTTOptions holds options for creating an NTT accelerator.
+type NTTOptions struct {
+	// Enabled controls whether GPU acceleration is used
+	Enabled bool
+	// Backend specifies which GPU backend to use: "auto", "metal", "cuda", "cpu"
+	Backend string
+	// DeviceIndex specifies which GPU device to use
+	DeviceIndex int
+}
+
+// NewNTTAccelerator creates a new NTT accelerator with GPU support.
+// It auto-detects available GPU backends (Metal on macOS, CUDA on Linux).
+func NewNTTAccelerator() (*NTTAccelerator, error) {
+	return NewNTTAcceleratorWithOptions(NTTOptions{})
+}
+
+// NewNTTAcceleratorWithOptions creates a new NTT accelerator with custom options.
+// If options are zero-valued, it uses the global GPU config.
+func NewNTTAcceleratorWithOptions(opts NTTOptions) (*NTTAccelerator, error) {
+	// Get global config if options not specified
+	gpuCfg := config.GetGlobalGPUConfig()
+
+	// Determine if GPU should be enabled
+	enabled := gpuCfg.Enabled
+	if opts.Backend == "cpu" {
+		enabled = false
+	}
+
+	// Check if GPU is available via accel library
+	available := accel.Available() && enabled
+
+	var session *accel.Session
+	if available {
+		var err error
+		session, err = accel.DefaultSession()
+		if err != nil {
+			// Fall back to CPU mode
+			available = false
+		}
+	}
+
+	return &NTTAccelerator{
+		session: session,
+		enabled: available,
+	}, nil
+}
+
+// IsEnabled returns whether GPU acceleration is available.
+func (g *NTTAccelerator) IsEnabled() bool {
+	g.mu.RLock()
+	defer g.mu.RUnlock()
+	return g.enabled
+}
+
+// Backend returns the name of the active GPU backend.
+func (g *NTTAccelerator) Backend() string {
+	g.mu.RLock()
+	defer g.mu.RUnlock()
+
+	if !g.enabled || g.session == nil {
+		return "CPU (GPU not available)"
+	}
+	return g.session.Backend().String()
+}
+
+// getModulus extracts the first modulus from the ring.
+func (g *NTTAccelerator) getModulus(r *ring.Ring) (uint32, error) {
+	if len(r.ModuliChain()) == 0 {
+		return 0, fmt.Errorf("ring has no moduli")
+	}
+	return uint32(r.ModuliChain()[0]), nil
+}
+
+// NTTForward performs forward NTT on a polynomial using GPU acceleration.
+// Falls back to CPU if GPU is not available.
+func (g *NTTAccelerator) NTTForward(r *ring.Ring, poly ring.Poly) error {
+	if !g.enabled || g.session == nil {
+		// Fall back to lattice library's NTT
+		r.NTT(poly, poly)
+		return nil
+	}
+
+	N := r.N()
+	coeffs := poly.Coeffs
+	if len(coeffs) == 0 || len(coeffs[0]) < N {
+		r.NTT(poly, poly)
+		return nil
+	}
+
+	Q, err := g.getModulus(r)
+	if err != nil {
+		r.NTT(poly, poly)
+		return nil
+	}
+
+	// Create input tensor from polynomial coefficients
+	inputTensor, err := accel.NewTensorWithData[uint64](g.session, []int{N}, coeffs[0][:N])
+	if err != nil {
+		r.NTT(poly, poly)
+		return nil
+	}
+	defer inputTensor.Close()
+
+	// Create output tensor
+	outputTensor, err := accel.NewTensor[uint64](g.session, []int{N})
+	if err != nil {
+		r.NTT(poly, poly)
+		return nil
+	}
+	defer outputTensor.Close()
+
+	// GPU NTT via accel Lattice ops
+	if err := g.session.Lattice().PolynomialNTT(inputTensor.Untyped(), outputTensor.Untyped(), Q); err != nil {
+		r.NTT(poly, poly)
+		return nil
+	}
+
+	// Copy result back
+	result, err := outputTensor.ToSlice()
+	if err != nil {
+		r.NTT(poly, poly)
+		return nil
+	}
+	copy(coeffs[0], result)
+	atomic.AddUint64(&g.totalOps, 1)
+	return nil
+}
+
+// NTTInverse performs inverse NTT on a polynomial using GPU acceleration.
+// Falls back to CPU if GPU is not available.
+func (g *NTTAccelerator) NTTInverse(r *ring.Ring, poly ring.Poly) error {
+	if !g.enabled || g.session == nil {
+		// Fall back to lattice library's INTT
+		r.INTT(poly, poly)
+		return nil
+	}
+
+	N := r.N()
+	coeffs := poly.Coeffs
+	if len(coeffs) == 0 || len(coeffs[0]) < N {
+		r.INTT(poly, poly)
+		return nil
+	}
+
+	Q, err := g.getModulus(r)
+	if err != nil {
+		r.INTT(poly, poly)
+		return nil
+	}
+
+	// Create input tensor from polynomial coefficients
+	inputTensor, err := accel.NewTensorWithData[uint64](g.session, []int{N}, coeffs[0][:N])
+	if err != nil {
+		r.INTT(poly, poly)
+		return nil
+	}
+	defer inputTensor.Close()
+
+	// Create output tensor
+	outputTensor, err := accel.NewTensor[uint64](g.session, []int{N})
+	if err != nil {
+		r.INTT(poly, poly)
+		return nil
+	}
+	defer outputTensor.Close()
+
+	// GPU INTT via accel Lattice ops
+	if err := g.session.Lattice().PolynomialINTT(inputTensor.Untyped(), outputTensor.Untyped(), Q); err != nil {
+		r.INTT(poly, poly)
+		return nil
+	}
+
+	// Copy result back
+	result, err := outputTensor.ToSlice()
+	if err != nil {
+		r.INTT(poly, poly)
+		return nil
+	}
+	copy(coeffs[0], result)
+	atomic.AddUint64(&g.totalOps, 1)
+	return nil
+}
+
+// BatchNTTForward performs forward NTT on multiple polynomials in parallel.
+// This is the primary use case for GPU acceleration - batch operations.
+func (g *NTTAccelerator) BatchNTTForward(r *ring.Ring, polys []ring.Poly) error {
+	if len(polys) == 0 {
+		return nil
+	}
+
+	if !g.enabled || g.session == nil || len(polys) < 4 {
+		// Fall back to CPU for small batches (GPU overhead not worth it)
+		for i := range polys {
+			r.NTT(polys[i], polys[i])
+		}
+		return nil
+	}
+
+	Q, err := g.getModulus(r)
+	if err != nil {
+		for i := range polys {
+			r.NTT(polys[i], polys[i])
+		}
+		return nil
+	}
+
+	// Process each polynomial through GPU
+	// Note: For true batch performance, we'd want batch tensor operations
+	// but the current accel API operates on single polynomials
+	N := r.N()
+	for i := range polys {
+		coeffs := polys[i].Coeffs
+		if len(coeffs) == 0 || len(coeffs[0]) < N {
+			r.NTT(polys[i], polys[i])
+			continue
+		}
+
+		inputTensor, err := accel.NewTensorWithData[uint64](g.session, []int{N}, coeffs[0][:N])
+		if err != nil {
+			r.NTT(polys[i], polys[i])
+			continue
+		}
+
+		outputTensor, err := accel.NewTensor[uint64](g.session, []int{N})
+		if err != nil {
+			inputTensor.Close()
+			r.NTT(polys[i], polys[i])
+			continue
+		}
+
+		if err := g.session.Lattice().PolynomialNTT(inputTensor.Untyped(), outputTensor.Untyped(), Q); err != nil {
+			inputTensor.Close()
+			outputTensor.Close()
+			r.NTT(polys[i], polys[i])
+			continue
+		}
+
+		result, err := outputTensor.ToSlice()
+		if err != nil {
+			inputTensor.Close()
+			outputTensor.Close()
+			r.NTT(polys[i], polys[i])
+			continue
+		}
+		copy(coeffs[0], result)
+
+		inputTensor.Close()
+		outputTensor.Close()
+	}
+
+	atomic.AddUint64(&g.totalOps, uint64(len(polys)))
+	return nil
+}
+
+// BatchNTTInverse performs inverse NTT on multiple polynomials in parallel.
+func (g *NTTAccelerator) BatchNTTInverse(r *ring.Ring, polys []ring.Poly) error {
+	if len(polys) == 0 {
+		return nil
+	}
+
+	if !g.enabled || g.session == nil || len(polys) < 4 {
+		// Fall back to CPU for small batches
+		for i := range polys {
+			r.INTT(polys[i], polys[i])
+		}
+		return nil
+	}
+
+	Q, err := g.getModulus(r)
+	if err != nil {
+		for i := range polys {
+			r.INTT(polys[i], polys[i])
+		}
+		return nil
+	}
+
+	// Process each polynomial through GPU
+	N := r.N()
+	for i := range polys {
+		coeffs := polys[i].Coeffs
+		if len(coeffs) == 0 || len(coeffs[0]) < N {
+			r.INTT(polys[i], polys[i])
+			continue
+		}
+
+		inputTensor, err := accel.NewTensorWithData[uint64](g.session, []int{N}, coeffs[0][:N])
+		if err != nil {
+			r.INTT(polys[i], polys[i])
+			continue
+		}
+
+		outputTensor, err := accel.NewTensor[uint64](g.session, []int{N})
+		if err != nil {
+			inputTensor.Close()
+			r.INTT(polys[i], polys[i])
+			continue
+		}
+
+		if err := g.session.Lattice().PolynomialINTT(inputTensor.Untyped(), outputTensor.Untyped(), Q); err != nil {
+			inputTensor.Close()
+			outputTensor.Close()
+			r.INTT(polys[i], polys[i])
+			continue
+		}
+
+		result, err := outputTensor.ToSlice()
+		if err != nil {
+			inputTensor.Close()
+			outputTensor.Close()
+			r.INTT(polys[i], polys[i])
+			continue
+		}
+		copy(coeffs[0], result)
+
+		inputTensor.Close()
+		outputTensor.Close()
+	}
+
+	atomic.AddUint64(&g.totalOps, uint64(len(polys)))
+	return nil
+}
+
+// PolyMul performs polynomial multiplication using GPU-accelerated NTT.
+// This multiplies polynomials a and b, storing result in out.
+func (g *NTTAccelerator) PolyMul(r *ring.Ring, a, b, out ring.Poly) error {
+	if !g.enabled || g.session == nil {
+		// Fall back to CPU
+		r.MulCoeffsBarrett(a, b, out)
+		return nil
+	}
+
+	Q, err := g.getModulus(r)
+	if err != nil {
+		r.MulCoeffsBarrett(a, b, out)
+		return nil
+	}
+
+	N := r.N()
+
+	// Extract coefficients
+	if len(a.Coeffs) == 0 || len(a.Coeffs[0]) < N ||
+		len(b.Coeffs) == 0 || len(b.Coeffs[0]) < N ||
+		len(out.Coeffs) == 0 || len(out.Coeffs[0]) < N {
+		r.MulCoeffsBarrett(a, b, out)
+		return nil
+	}
+
+	// Create tensors for a, b, and output
+	aTensor, err := accel.NewTensorWithData[uint64](g.session, []int{N}, a.Coeffs[0][:N])
+	if err != nil {
+		r.MulCoeffsBarrett(a, b, out)
+		return nil
+	}
+	defer aTensor.Close()
+
+	bTensor, err := accel.NewTensorWithData[uint64](g.session, []int{N}, b.Coeffs[0][:N])
+	if err != nil {
+		r.MulCoeffsBarrett(a, b, out)
+		return nil
+	}
+	defer bTensor.Close()
+
+	outTensor, err := accel.NewTensor[uint64](g.session, []int{N})
+	if err != nil {
+		r.MulCoeffsBarrett(a, b, out)
+		return nil
+	}
+	defer outTensor.Close()
+
+	// GPU polynomial multiplication
+	if err := g.session.Lattice().PolynomialMul(aTensor.Untyped(), bTensor.Untyped(), outTensor.Untyped(), Q); err != nil {
+		r.MulCoeffsBarrett(a, b, out)
+		return nil
+	}
+
+	// Copy result back
+	result, err := outTensor.ToSlice()
+	if err != nil {
+		r.MulCoeffsBarrett(a, b, out)
+		return nil
+	}
+	copy(out.Coeffs[0], result)
+	atomic.AddUint64(&g.totalOps, 1)
+	return nil
+}
+
+// ClearCache is a no-op in the accel-based implementation.
+// The accel library manages its own caching internally.
+func (g *NTTAccelerator) ClearCache() {
+	// No-op: accel library manages caching internally
+}
+
+// NTTStats returns NTT accelerator statistics.
+type NTTStats struct {
+	Enabled      bool
+	Backend      string
+	TotalOps     uint64
+	GPUAvailable bool
+}
+
+// Stats returns current NTT accelerator statistics.
+func (g *NTTAccelerator) Stats() NTTStats {
+	g.mu.RLock()
+	defer g.mu.RUnlock()
+
+	return NTTStats{
+		Enabled:      g.enabled,
+		Backend:      g.Backend(),
+		TotalOps:     atomic.LoadUint64(&g.totalOps),
+		GPUAvailable: accel.Available(),
+	}
+}
+
+// Global NTT accelerator instance (lazily initialized)
+var (
+	globalNTTAccelerator     *NTTAccelerator
+	globalNTTAcceleratorOnce sync.Once
+	globalNTTAcceleratorErr  error
+)
+
+// GetNTTAccelerator returns the global NTT accelerator instance.
+// The accelerator is lazily initialized on first call.
+func GetNTTAccelerator() (*NTTAccelerator, error) {
+	globalNTTAcceleratorOnce.Do(func() {
+		globalNTTAccelerator, globalNTTAcceleratorErr = NewNTTAccelerator()
+	})
+	return globalNTTAccelerator, globalNTTAcceleratorErr
+}

consensus/quasar/oom_test.go

@@ -0,0 +1,448 @@
+// Copyright (C) 2019-2025, Lux Industries Inc. All rights reserved.
+// See the file LICENSE for licensing terms.
+
+package quasar
+
+import (
+	"crypto/rand"
+	"runtime"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/luxfi/ids"
+	"github.com/luxfi/log"
+	"github.com/stretchr/testify/require"
+)
+
+// ---------------------------------------------------------------------------
+// Test 1: Finalized map pruning
+// ---------------------------------------------------------------------------
+
+// TestFinalizedMapPruning simulates 100,000 finality events and verifies:
+//   - The finalized map never exceeds maxFinalized + buffer
+//   - Old entries are actually pruned
+//   - After 100K events, map size <= 10,000
+func TestFinalizedMapPruning(t *testing.T) {
+	q, err := NewQuasar(log.NewNoOpLogger(), 3, 2, 3)
+	require.NoError(t, err)
+
+	// maxFinalized is 10,000 by default (set in NewQuasar)
+	const totalEvents = 100_000
+
+	// We simulate processFinality's pruning logic directly by
+	// inserting entries and triggering the prune path.
+	// processFinality increments qHeight and prunes when len > maxFinalized.
+	var peakSize int
+	for i := 0; i < totalEvents; i++ {
+		var blockID ids.ID
+		_, _ = rand.Read(blockID[:])
+
+		q.mu.Lock()
+		q.qHeight++
+		q.finalized[blockID] = &QuantumFinality{
+			BlockID:      blockID,
+			QChainHeight: q.qHeight,
+			PChainHeight: uint64(i),
+			TotalWeight:  1000,
+			SignerWeight: 700,
+		}
+
+		// Replicate the pruning logic from processFinality
+		if q.maxFinalized > 0 && len(q.finalized) > q.maxFinalized {
+			cutoff := q.qHeight - uint64(q.maxFinalized)
+			for id, f := range q.finalized {
+				if f.QChainHeight < cutoff {
+					delete(q.finalized, id)
+				}
+			}
+		}
+
+		size := len(q.finalized)
+		if size > peakSize {
+			peakSize = size
+		}
+		q.mu.Unlock()
+	}
+
+	q.mu.RLock()
+	finalSize := len(q.finalized)
+	finalQHeight := q.qHeight
+	q.mu.RUnlock()
+
+	t.Logf("totalEvents=%d  peakSize=%d  finalSize=%d  qHeight=%d",
+		totalEvents, peakSize, finalSize, finalQHeight)
+
+	// The pruning logic fires when len > maxFinalized, then deletes entries
+	// with QChainHeight < cutoff (strict <). The cutoff is qHeight - maxFinalized.
+	// After pruning, entries at exactly cutoff remain, so the steady-state
+	// size is maxFinalized + 1. This is correct and bounded.
+	require.LessOrEqual(t, peakSize, q.maxFinalized+1,
+		"peak map size should not exceed maxFinalized+1")
+
+	require.LessOrEqual(t, finalSize, q.maxFinalized+1,
+		"final map size should be <= maxFinalized+1 (10,001)")
+
+	// Verify old entries are actually gone: the oldest remaining entry
+	// should have QChainHeight >= qHeight - maxFinalized.
+	q.mu.RLock()
+	minHeight := uint64(^uint64(0))
+	for _, f := range q.finalized {
+		if f.QChainHeight < minHeight {
+			minHeight = f.QChainHeight
+		}
+	}
+	q.mu.RUnlock()
+
+	expectedMinHeight := finalQHeight - uint64(q.maxFinalized)
+	require.GreaterOrEqual(t, minHeight, expectedMinHeight,
+		"oldest entry should be pruned: minHeight=%d expected>=%d", minHeight, expectedMinHeight)
+}
+
+// ---------------------------------------------------------------------------
+// Test 2: Channel backpressure -- no goroutine leak or deadlock
+// ---------------------------------------------------------------------------
+
+// TestChannelBackpressure creates a pChainProvider with a 64-buffer channel,
+// sends 1000 events, and verifies no goroutine leak or deadlock.
+func TestChannelBackpressure(t *testing.T) {
+	const (
+		channelSize = 64
+		totalEvents = 1000
+	)
+
+	validators := generateValidatorStates(5)
+	pchain := &mockPChainProvider{
+		height:     0,
+		validators: validators,
+		finalityCh: make(chan FinalityEvent, channelSize),
+	}
+
+	goroutinesBefore := runtime.NumGoroutine()
+
+	// Send events -- channel will fill up, excess events are dropped (select default)
+	sent := 0
+	for i := 0; i < totalEvents; i++ {
+		event := createTestEvent(uint64(i+1), validators)
+		select {
+		case pchain.finalityCh <- event:
+			sent++
+		default:
+			// Channel full -- expected backpressure behavior
+		}
+	}
+
+	t.Logf("sent %d/%d events (channel capacity %d)", sent, totalEvents, channelSize)
+	require.GreaterOrEqual(t, sent, channelSize,
+		"should have sent at least channelSize events")
+
+	// Drain the channel
+	drained := 0
+	for {
+		select {
+		case <-pchain.finalityCh:
+			drained++
+		default:
+			goto done
+		}
+	}
+done:
+	t.Logf("drained %d events", drained)
+
+	// Check goroutine count -- should not have leaked
+	runtime.GC()
+	goroutinesAfter := runtime.NumGoroutine()
+	// Allow a delta of 5 for GC/runtime goroutines
+	require.InDelta(t, goroutinesBefore, goroutinesAfter, 5,
+		"goroutine count should not grow significantly: before=%d after=%d",
+		goroutinesBefore, goroutinesAfter)
+}
+
+// ---------------------------------------------------------------------------
+// Test 3: Long-running benchmark -- 1M simulated finality cycles
+// ---------------------------------------------------------------------------
+
+// BenchmarkQuasarLongRun runs 1M simulated finality cycles and reports
+// allocs/op, bytes/op, ns/op. Verifies no unbounded memory growth.
+func BenchmarkQuasarLongRun(b *testing.B) {
+	q, err := NewQuasar(log.NewNoOpLogger(), 3, 2, 3)
+	if err != nil {
+		b.Fatal(err)
+	}
+
+	// Snapshot heap before
+	runtime.GC()
+	var memBefore runtime.MemStats
+	runtime.ReadMemStats(&memBefore)
+
+	b.ResetTimer()
+	b.ReportAllocs()
+
+	for i := 0; i < b.N; i++ {
+		var blockID ids.ID
+		// Use deterministic IDs to avoid crypto/rand overhead in benchmark
+		blockID[0] = byte(i)
+		blockID[1] = byte(i >> 8)
+		blockID[2] = byte(i >> 16)
+		blockID[3] = byte(i >> 24)
+
+		q.mu.Lock()
+		q.qHeight++
+		q.finalized[blockID] = &QuantumFinality{
+			BlockID:      blockID,
+			QChainHeight: q.qHeight,
+			PChainHeight: uint64(i),
+			TotalWeight:  1000,
+			SignerWeight: 700,
+			BLSProof:     make([]byte, 96),
+			Timestamp:    time.Now(),
+		}
+
+		// Prune (same logic as processFinality)
+		if q.maxFinalized > 0 && len(q.finalized) > q.maxFinalized {
+			cutoff := q.qHeight - uint64(q.maxFinalized)
+			for id, f := range q.finalized {
+				if f.QChainHeight < cutoff {
+					delete(q.finalized, id)
+				}
+			}
+		}
+		q.mu.Unlock()
+	}
+
+	b.StopTimer()
+
+	// Snapshot heap after
+	runtime.GC()
+	var memAfter runtime.MemStats
+	runtime.ReadMemStats(&memAfter)
+
+	q.mu.RLock()
+	finalSize := len(q.finalized)
+	q.mu.RUnlock()
+
+	heapBefore := memBefore.HeapAlloc
+	heapAfter := memAfter.HeapAlloc
+
+	var heapDelta int64
+	if heapAfter >= heapBefore {
+		heapDelta = int64(heapAfter - heapBefore)
+	} else {
+		heapDelta = -int64(heapBefore - heapAfter)
+	}
+	b.Logf("N=%d  finalMapSize=%d  heapBefore=%d  heapAfter=%d  heapDelta=%d",
+		b.N, finalSize, heapBefore, heapAfter, heapDelta)
+
+	// Map should be bounded regardless of N
+	if finalSize > q.maxFinalized+1 {
+		b.Fatalf("unbounded growth: map size %d exceeds maxFinalized %d",
+			finalSize, q.maxFinalized)
+	}
+
+	// Heap should not grow linearly with N. After pruning, the heap should
+	// be bounded by ~maxFinalized entries worth of allocations.
+	// We allow 100MB as a generous upper bound for 10K entries with 96-byte proofs.
+	const maxHeapGrowth = 100 * 1024 * 1024 // 100MB
+	if heapAfter > heapBefore+maxHeapGrowth {
+		b.Fatalf("unbounded heap growth: before=%d after=%d delta=%d (limit=%d)",
+			heapBefore, heapAfter, heapAfter-heapBefore, maxHeapGrowth)
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Test 4: Quorum math verification -- property test
+// ---------------------------------------------------------------------------
+
+// TestQuorumMath is a property test that for all validator counts 1-100
+// and all weight distributions:
+//   - Cross-multiplication quorum never accepts < 2/3 weight
+//   - Cross-multiplication quorum always accepts >= 2/3 weight (no false negatives)
+func TestQuorumMath(t *testing.T) {
+	q, err := NewQuasar(log.NewNoOpLogger(), 3, 2, 3)
+	require.NoError(t, err)
+
+	// The quorum check is: signerWeight * quorumDen >= totalWeight * quorumNum
+	// With quorumNum=2, quorumDen=3: signerWeight * 3 >= totalWeight * 2
+
+	t.Run("no_false_positives", func(t *testing.T) {
+		// For all validator counts and weight distributions, if the quorum
+		// check passes, then signerWeight/totalWeight >= 2/3.
+		for numValidators := 1; numValidators <= 100; numValidators++ {
+			// Test with equal weights
+			weightPerValidator := uint64(1000)
+			totalWeight := uint64(numValidators) * weightPerValidator
+
+			for numSigners := 0; numSigners <= numValidators; numSigners++ {
+				signerWeight := uint64(numSigners) * weightPerValidator
+				result := q.CheckQuorum(signerWeight, totalWeight)
+
+				// Verify: if result is true, then signerWeight/totalWeight >= 2/3
+				// Using cross-multiplication: signerWeight * 3 >= totalWeight * 2
+				actualMeetsThreshold := signerWeight*3 >= totalWeight*2
+				if result && !actualMeetsThreshold {
+					t.Fatalf("FALSE POSITIVE: n=%d signers=%d sW=%d tW=%d: "+
+						"quorum accepted but %d*3=%d < %d*2=%d",
+						numValidators, numSigners, signerWeight, totalWeight,
+						signerWeight, signerWeight*3, totalWeight, totalWeight*2)
+				}
+			}
+		}
+	})
+
+	t.Run("no_false_negatives", func(t *testing.T) {
+		// For all validator counts and weight distributions, if
+		// signerWeight/totalWeight >= 2/3, the quorum check must pass.
+		for numValidators := 1; numValidators <= 100; numValidators++ {
+			weightPerValidator := uint64(1000)
+			totalWeight := uint64(numValidators) * weightPerValidator
+
+			for numSigners := 0; numSigners <= numValidators; numSigners++ {
+				signerWeight := uint64(numSigners) * weightPerValidator
+				result := q.CheckQuorum(signerWeight, totalWeight)
+
+				actualMeetsThreshold := signerWeight*3 >= totalWeight*2
+				if actualMeetsThreshold && !result {
+					t.Fatalf("FALSE NEGATIVE: n=%d signers=%d sW=%d tW=%d: "+
+						"threshold met but quorum rejected",
+						numValidators, numSigners, signerWeight, totalWeight)
+				}
+			}
+		}
+	})
+
+	t.Run("varied_weight_distributions", func(t *testing.T) {
+		// Test with non-uniform weights: validators have weights 1..n
+		for numValidators := 1; numValidators <= 100; numValidators++ {
+			var totalWeight uint64
+			weights := make([]uint64, numValidators)
+			for i := 0; i < numValidators; i++ {
+				weights[i] = uint64(i + 1)
+				totalWeight += weights[i]
+			}
+
+			// Test subsets: first k validators sign
+			var signerWeight uint64
+			for k := 0; k <= numValidators; k++ {
+				if k > 0 {
+					signerWeight += weights[k-1]
+				}
+				result := q.CheckQuorum(signerWeight, totalWeight)
+				expected := signerWeight*3 >= totalWeight*2
+
+				if result != expected {
+					t.Fatalf("MISMATCH: n=%d signers=%d sW=%d tW=%d: "+
+						"got %v expected %v",
+						numValidators, k, signerWeight, totalWeight,
+						result, expected)
+				}
+			}
+		}
+	})
+
+	t.Run("edge_cases", func(t *testing.T) {
+		// Zero total weight: any signer weight passes (vacuously true)
+		require.True(t, q.CheckQuorum(0, 0), "0/0 should pass (vacuous)")
+		require.True(t, q.CheckQuorum(1, 0), "1/0 should pass (vacuous)")
+
+		// Exact boundary: 2/3 of various totals
+		// For totalWeight=3: need signerWeight >= 2
+		require.True(t, q.CheckQuorum(2, 3), "2/3 should pass")
+		require.False(t, q.CheckQuorum(1, 3), "1/3 should fail")
+
+		// For totalWeight=6: need signerWeight >= 4
+		require.True(t, q.CheckQuorum(4, 6), "4/6 should pass")
+		require.False(t, q.CheckQuorum(3, 6), "3/6 should fail")
+
+		// For totalWeight=9: need signerWeight >= 6
+		require.True(t, q.CheckQuorum(6, 9), "6/9 should pass")
+		require.False(t, q.CheckQuorum(5, 9), "5/9 should fail")
+
+		// For totalWeight=100: 2*100/3 = 66 (floor), so need 67 to be strictly >= 2/3
+		// But cross-mult: sW*3 >= tW*2 → sW*3 >= 200 → sW >= 67 (ceil)
+		// Actually: 66*3=198 < 200 → fail; 67*3=201 >= 200 → pass
+		require.True(t, q.CheckQuorum(67, 100), "67/100 should pass")
+		require.False(t, q.CheckQuorum(66, 100), "66/100 should fail")
+
+		// Large weights (near overflow boundary for uint64)
+		// Safe for totalWeight < 2^62 with quorumNum=2 (per checkQuorum doc)
+		largeTotal := uint64(1) << 61
+		largeSigner := largeTotal*2/3 + 1
+		require.True(t, q.CheckQuorum(largeSigner, largeTotal),
+			"large weight should pass when above 2/3")
+	})
+
+	t.Run("bft_threshold_exact", func(t *testing.T) {
+		// BFT requires > 2/3 of total weight.
+		// With the cross-multiplication check (>=), signerWeight*3 >= totalWeight*2.
+		// This means exactly 2/3 PASSES (which matches the formal spec:
+		// "quorum is met when SignerWeight/TotalWeight >= Numerator/Denominator").
+		//
+		// For totalWeight divisible by 3:
+		//   signerWeight = totalWeight * 2 / 3 → passes (exact 2/3)
+		//   signerWeight = totalWeight * 2 / 3 - 1 → fails (below 2/3)
+		for total := uint64(3); total <= 300; total += 3 {
+			threshold := total * 2 / 3
+			require.True(t, q.CheckQuorum(threshold, total),
+				"exact 2/3 (%d/%d) should pass", threshold, total)
+			require.False(t, q.CheckQuorum(threshold-1, total),
+				"below 2/3 (%d/%d) should fail", threshold-1, total)
+		}
+	})
+}
+
+// ---------------------------------------------------------------------------
+// Test 5: Concurrent map pruning stress test
+// ---------------------------------------------------------------------------
+
+// TestConcurrentPruningStress verifies that concurrent writes + pruning
+// do not corrupt the finalized map or deadlock.
+func TestConcurrentPruningStress(t *testing.T) {
+	q, err := NewQuasar(log.NewNoOpLogger(), 3, 2, 3)
+	require.NoError(t, err)
+
+	const (
+		numWriters   = 8
+		opsPerWriter = 5000
+	)
+
+	var wg sync.WaitGroup
+	for w := 0; w < numWriters; w++ {
+		wg.Add(1)
+		go func(writerID int) {
+			defer wg.Done()
+			for i := 0; i < opsPerWriter; i++ {
+				var blockID ids.ID
+				blockID[0] = byte(writerID)
+				blockID[1] = byte(i)
+				blockID[2] = byte(i >> 8)
+
+				q.mu.Lock()
+				q.qHeight++
+				q.finalized[blockID] = &QuantumFinality{
+					BlockID:      blockID,
+					QChainHeight: q.qHeight,
+				}
+				if q.maxFinalized > 0 && len(q.finalized) > q.maxFinalized {
+					cutoff := q.qHeight - uint64(q.maxFinalized)
+					for id, f := range q.finalized {
+						if f.QChainHeight < cutoff {
+							delete(q.finalized, id)
+						}
+					}
+				}
+				q.mu.Unlock()
+			}
+		}(w)
+	}
+	wg.Wait()
+
+	q.mu.RLock()
+	finalSize := len(q.finalized)
+	q.mu.RUnlock()
+
+	t.Logf("writers=%d opsEach=%d totalOps=%d finalSize=%d",
+		numWriters, opsPerWriter, numWriters*opsPerWriter, finalSize)
+
+	require.LessOrEqual(t, finalSize, q.maxFinalized+1,
+		"map size should be bounded after concurrent stress")
+}

consensus/quasar/policy.go

@@ -1,27 +0,0 @@
-// Copyright (C) 2019-2026, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package quasar
-
-import (
-	"fmt"
-
-	qcert "github.com/luxfi/consensus/protocol/quasar"
-)
-
-// policyStore adapts the single configured QuasarEvidencePolicy to the consensus
-// ConsensusCertPolicyStore interface. The verifier loads the required-leg set
-// and the (kind, mode, param) permissions from HERE — never from the cert
-// (invariants I1/I2). A cert that names a different PolicyID than the node's
-// configured posture is rejected: a cert cannot pick its own weaker policy.
-type policyStore struct{ policy *qcert.QuasarEvidencePolicy }
-
-func (s policyStore) Policy(_ uint32, _ uint64, policyID uint32) (qcert.ConsensusCertPolicy, error) {
-	if s.policy == nil {
-		return nil, ErrPolicyUnavailable
-	}
-	if policyID != s.policy.EvidencePolicyID() {
-		return nil, fmt.Errorf("%w: cert policy %d != configured %d", ErrPolicyMismatch, policyID, s.policy.EvidencePolicyID())
-	}
-	return s.policy, nil
-}

consensus/quasar/producer.go

@@ -1,83 +0,0 @@
-// Copyright (C) 2019-2026, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package quasar
-
-import (
-	"context"
-
-	qcert "github.com/luxfi/consensus/protocol/quasar"
-)
-
-// Subject is the finalized-block position a cert must certify — the producer's
-// input at a checkpoint. Mirrors Checkpoint (the verify side) so producer and
-// verifier bind the SAME tuple.
-type Subject struct {
-	ChainID   uint32
-	Epoch     uint64
-	Height    uint64
-	Round     uint32
-	BlockID   [32]byte
-	StateRoot [32]byte
-}
-
-// subjectFrom derives the producer Subject from this gate's chain id and a
-// finalized Checkpoint, so producer and verifier bind the SAME tuple.
-func (g *Gate) subjectFrom(cp Checkpoint) Subject {
-	return Subject{
-		ChainID:   g.cfg.ChainID,
-		Epoch:     cp.Epoch,
-		Height:    cp.Height,
-		Round:     cp.Round,
-		BlockID:   cp.BlockID,
-		StateRoot: cp.StateRoot,
-	}
-}
-
-// Producer is the committee cert-signing service contract (the per-validator
-// "pulsard" committee). At a checkpoint, a producing validator calls Produce to
-// obtain the QuasarCert over the finalized subject, then gossips it so peers can
-// verify and store it (via a CertStore).
-//
-// SCAFFOLDING — this is the seam, not the service. This milestone wires the
-// VERIFY half (gate.go) and this interface. luxd ships with a nil Producer
-// (verify-only): a node VERIFIES certs it receives but does not itself produce
-// them. A nil Producer is the correct default — most of the rollout window is
-// verify-only, and the producer is brought up before activation is forward-dated.
-//
-// Implementation path for the follow-on:
-//
-//   - github.com/luxfi/consensus/protocol/quasar already defines the
-//     producer-side abstractions: PWitnessProducer / QWitnessProducer /
-//     ZWitnessProducer + NewWitnessSet, and ComposeDualPQEvidence. The concrete
-//     committee signer implements Producer over those.
-//   - The signer needs the live Pulsar key share + nonce pool + offline
-//     preprocessing + one-round sign + verify-before-gossip + nonce-erase (the
-//     no-reconstruct hyperball signer), which lands with pulsar v1.7.1.
-//   - REQUIRED CONSENSUS EXPORT: the ConsensusCert envelope + per-leg payload
-//     ENCODERS are package-private in consensus v1.29.0 (only the verifiers are
-//     exported). An external producer — and any end-to-end "valid cert verifies
-//     through the gate" test — needs those encoders exported (a small, additive
-//     consensus change). The verify path here needs no such export: it consumes
-//     a fully-formed *ConsensusCert.
-type Producer interface {
-	Produce(ctx context.Context, subject Subject) (*qcert.ConsensusCert, error)
-}
-
-// MaybeProduce is the checkpoint producer-request site. It is nil-safe and
-// activation-aware so the accept hook can call it unconditionally: a nil gate,
-// dormant activation, a non-checkpoint height, or a nil producer all short-
-// circuit to (nil, nil) — the verify-only default. When a producer IS wired and
-// the checkpoint is live, it requests the cert; the caller gossips/stores it.
-//
-// This keeps producer cadence and verify cadence on ONE definition (g.IsCheckpoint),
-// so producer and verifier can never disagree on which heights carry certs.
-func (g *Gate) MaybeProduce(ctx context.Context, producer Producer, cp Checkpoint) (*qcert.ConsensusCert, error) {
-	if g == nil || producer == nil {
-		return nil, nil
-	}
-	if !g.Activated(cp.Height) || !g.IsCheckpoint(cp.Height) {
-		return nil, nil
-	}
-	return producer.Produce(ctx, g.subjectFrom(cp))
-}

consensus/quasar/quasar.go

@@ -0,0 +1,681 @@
+// Copyright (C) 2019-2025, Lux Industries Inc. All rights reserved.
+// See the file LICENSE for licensing terms.
+
+package quasar
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sync"
+	"time"
+
+	"github.com/luxfi/consensus/protocol/quasar"
+	"github.com/luxfi/ids"
+	"github.com/luxfi/log"
+)
+
+// Quasar is the gravitational center of Lux consensus.
+// It binds P-Chain (BLS signatures) and Q-Chain (Corona post-quantum threshold)
+// into unified hybrid finality across all Lux networks.
+//
+// Architecture:
+//   ALL validators have BOTH keypairs:
+//   - BLS keypair → aggregate signatures (classical, fast)
+//   - Corona keypair → threshold signatures (post-quantum, 2-round)
+//
+//   Both signature paths run IN PARALLEL:
+//
+//   Block arrives
+//       │
+//       ├─────────────────────────────────────────┐
+//       │                                         │
+//       ▼                                         ▼
+//   BLS PATH (fast)                    CORONA PATH (quantum-safe)
+//   ────────────────                   ─────────────────────────────
+//   All validators sign                Round 1: All validators
+//   with BLS keys                      generate commitments
+//       │                                         │
+//       ▼                                         ▼
+//   Aggregate into                     Round 2: All validators
+//   single 96-byte sig                 compute partial signatures
+//       │                                         │
+//       └─────────────────┬───────────────────────┘
+//                         │
+//                         ▼
+//                  Finalize: combine into
+//                  threshold signature
+//                         │
+//                         ▼
+//               ┌─────────────────┐
+//               │  HYBRID PROOF   │
+//               │ BLS Aggregate   │ ← 96 bytes (2/3+ validators)
+//               │ Corona Thresh │ ← ~KB (t-of-n threshold)
+//               └─────────────────┘
+//                         │
+//                         ▼
+//                QUANTUM FINALITY
+//
+// The quasar ensures blocks achieve finality only when BOTH complete:
+// 1. 2/3+ validator weight signed via BLS (fast, classical)
+// 2. t-of-n validators completed Corona threshold (post-quantum secure)
+
+var (
+	ErrQuasarNotStarted    = errors.New("quasar not started")
+	ErrPChainNotConnected  = errors.New("P-Chain not connected")
+	ErrQChainNotConnected  = errors.New("Q-Chain not connected")
+	ErrCoronaNotConnected  = errors.New("Corona coordinator not connected")
+	ErrInsufficientWeight  = errors.New("insufficient validator weight")
+	ErrInsufficientSigners = errors.New("insufficient Corona signers")
+	ErrFinalityFailed      = errors.New("hybrid finality verification failed")
+	ErrBLSFailed           = errors.New("BLS aggregation failed")
+	ErrCoronaFailed        = errors.New("Corona threshold signing failed")
+)
+
+// PChainProvider provides P-Chain state and finality events
+type PChainProvider interface {
+	GetFinalizedHeight() uint64
+	GetValidators(height uint64) ([]ValidatorState, error)
+	SubscribeFinality() <-chan FinalityEvent
+}
+
+// QuantumSignerFallback provides fallback single-signer quantum signatures
+type QuantumSignerFallback interface {
+	SignMessage(msg []byte) ([]byte, error)
+}
+
+// ValidatorState represents a validator's current state
+// Each validator has BOTH BLS and Corona keys
+type ValidatorState struct {
+	NodeID    ids.NodeID
+	Weight    uint64
+	BLSPubKey []byte // BLS public key for aggregate signatures
+	CoronaKey []byte // Corona public key share for threshold sigs
+	Active    bool
+}
+
+// FinalityEvent represents a P-Chain finality event
+type FinalityEvent struct {
+	Height     uint64
+	BlockID    ids.ID
+	Validators []ValidatorState
+	Timestamp  time.Time
+}
+
+// QuantumFinality represents a block that achieved hybrid quantum finality
+type QuantumFinality struct {
+	BlockID       ids.ID
+	PChainHeight  uint64
+	QChainHeight  uint64
+	BLSProof      []byte       // Aggregated BLS signature (96 bytes)
+	CoronaProof   []byte       // Serialized Corona threshold signature
+	SignerBitset  []byte       // Which validators signed BLS
+	CoronaSigners []ids.NodeID // Which validators participated in Corona
+	TotalWeight   uint64
+	SignerWeight  uint64
+	BLSLatency    time.Duration
+	CoronaLatency time.Duration
+	Timestamp     time.Time
+}
+
+// Quasar binds P-Chain and Q-Chain consensus into hybrid quantum finality
+type Quasar struct {
+	mu sync.RWMutex
+
+	log  log.Logger
+	core *quasar.Quasar
+
+	// Chain connections
+	pChain          PChainProvider
+	quantumFallback QuantumSignerFallback
+
+	// Corona threshold coordinator
+	corona *CoronaCoordinator
+
+	// State
+	pHeight   uint64
+	qHeight   uint64
+	finalized map[ids.ID]*QuantumFinality
+
+	// Configuration
+	threshold    int    // Corona threshold (t in t-of-n)
+	quorumNum    uint64 // BLS quorum numerator
+	quorumDen    uint64 // BLS quorum denominator
+	maxFinalized int    // max finalized entries before pruning
+
+	// Channels
+	finalityCh chan *QuantumFinality
+	stopCh     chan struct{}
+	running    bool
+}
+
+// NewQuasar creates a new Quasar consensus hub
+func NewQuasar(log log.Logger, threshold int, quorumNum, quorumDen uint64) (*Quasar, error) {
+	core, err := quasar.NewQuasar(threshold)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create quasar core: %w", err)
+	}
+
+	return &Quasar{
+		log:          log,
+		core:         core,
+		threshold:    threshold,
+		quorumNum:    quorumNum,
+		quorumDen:    quorumDen,
+		finalized:    make(map[ids.ID]*QuantumFinality),
+		maxFinalized: 10000,
+		finalityCh:   make(chan *QuantumFinality, 100),
+		stopCh:       make(chan struct{}),
+	}, nil
+}
+
+// ConnectPChain connects the P-Chain finality provider
+func (q *Quasar) ConnectPChain(p PChainProvider) {
+	q.mu.Lock()
+	defer q.mu.Unlock()
+
+	q.pChain = p
+	if p != nil {
+		q.pHeight = p.GetFinalizedHeight()
+	}
+
+	q.log.Info("quasar: P-Chain connected", "height", q.pHeight)
+}
+
+// ConnectQuantumFallback connects the quantum signer fallback
+func (q *Quasar) ConnectQuantumFallback(f QuantumSignerFallback) {
+	q.mu.Lock()
+	defer q.mu.Unlock()
+
+	q.quantumFallback = f
+	q.log.Info("quasar: quantum fallback connected")
+}
+
+// ConnectCorona connects the Corona threshold coordinator
+func (q *Quasar) ConnectCorona(rc *CoronaCoordinator) {
+	q.mu.Lock()
+	defer q.mu.Unlock()
+
+	q.corona = rc
+	q.log.Info("quasar: Corona coordinator connected")
+}
+
+// InitializeCorona initializes the Corona coordinator with validators
+func (q *Quasar) InitializeCorona(validators []ids.NodeID) error {
+	q.mu.Lock()
+	defer q.mu.Unlock()
+
+	if q.corona == nil {
+		// Create coordinator if not provided
+		numParties := len(validators)
+		threshold := (numParties * 2 / 3) + 1 // 2/3 + 1 threshold
+		if threshold < 2 {
+			threshold = 2
+		}
+
+		rc, err := NewCoronaCoordinator(q.log, CoronaConfig{
+			NumParties: numParties,
+			Threshold:  threshold,
+		})
+		if err != nil {
+			return fmt.Errorf("failed to create Corona coordinator: %w", err)
+		}
+		q.corona = rc
+	}
+
+	if err := q.corona.Initialize(validators); err != nil {
+		return fmt.Errorf("failed to initialize Corona: %w", err)
+	}
+
+	q.log.Info("quasar: Corona initialized",
+		"validators", len(validators),
+		"threshold", q.corona.Stats().Threshold,
+	)
+
+	return nil
+}
+
+// Start begins the quasar consensus loop
+func (q *Quasar) Start(ctx context.Context) error {
+	q.mu.Lock()
+	if q.pChain == nil {
+		q.mu.Unlock()
+		return ErrPChainNotConnected
+	}
+	if q.quantumFallback == nil {
+		q.mu.Unlock()
+		return ErrQChainNotConnected
+	}
+	q.running = true
+	q.mu.Unlock()
+
+	// Subscribe to P-Chain finality
+	sub := q.pChain.SubscribeFinality()
+	go q.run(ctx, sub)
+
+	q.log.Info("quasar: started")
+	return nil
+}
+
+// Stop halts the quasar
+func (q *Quasar) Stop() {
+	q.mu.Lock()
+	if q.running {
+		close(q.stopCh)
+		q.running = false
+	}
+	q.mu.Unlock()
+	q.log.Info("quasar: stopped")
+}
+
+// run is the main finality loop.
+// Bounded by ctx.Done() and q.stopCh — exits when either fires.
+// The goroutine is started in Start() and guaranteed to terminate
+// when Stop() closes stopCh or the parent context is cancelled.
+func (q *Quasar) run(ctx context.Context, sub <-chan FinalityEvent) {
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-q.stopCh:
+			return
+		case event := <-sub:
+			if err := q.processFinality(ctx, event); err != nil {
+				q.log.Error("quasar: finality failed",
+					"height", event.Height,
+					"error", err,
+				)
+			}
+		}
+	}
+}
+
+// processFinality processes a P-Chain finality event into hybrid finality
+// Both BLS and Corona paths run IN PARALLEL
+func (q *Quasar) processFinality(ctx context.Context, event FinalityEvent) error {
+	q.mu.Lock()
+	defer q.mu.Unlock()
+
+	// Sync validators to quasar core
+	for _, v := range event.Validators {
+		if v.Active {
+			_, _ = q.core.AddValidator(v.NodeID.String(), v.Weight)
+		}
+	}
+
+	// Create finality message
+	msg := q.createMessage(event)
+	msgStr := string(msg) // Corona uses string message
+
+	// Run BLS and Corona IN PARALLEL
+	var blsProof, signerBitset []byte
+	var signerWeight uint64
+	var coronaSig Signature
+	var blsLatency, coronaLatency time.Duration
+	var blsErr, coronaErr error
+	var wg sync.WaitGroup
+
+	// BLS path
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		start := time.Now()
+		blsProof, signerBitset, signerWeight, blsErr = q.collectBLS(event, msg)
+		blsLatency = time.Since(start)
+	}()
+
+	// Corona path - REQUIRED for Q-Chain validator consensus.
+	// No fallback mode: if Corona coordinator is not initialized,
+	// finality MUST fail to prevent accepting BLS-only proofs.
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		if q.corona == nil || !q.corona.IsInitialized() {
+			// STRICT: No fallback allowed for validators.
+			// RT signatures are REQUIRED for quantum-safe consensus.
+			coronaErr = ErrCoronaNotConnected
+			return
+		}
+		// Full threshold signing
+		start := time.Now()
+		coronaSig, coronaErr = q.collectCorona(msgStr)
+		coronaLatency = time.Since(start)
+	}()
+
+	wg.Wait()
+
+	// Check BLS result
+	if blsErr != nil {
+		return fmt.Errorf("BLS collection: %w", blsErr)
+	}
+
+	// Check Corona result
+	if coronaErr != nil {
+		return fmt.Errorf("Corona threshold: %w", coronaErr)
+	}
+
+	// Check quorum
+	totalWeight := q.totalWeight(event.Validators)
+	if !q.checkQuorum(signerWeight, totalWeight) {
+		return ErrInsufficientWeight
+	}
+
+	// Record finality
+	q.qHeight++
+	var coronaSigners []ids.NodeID
+	var coronaProof []byte
+	if coronaSig != nil {
+		coronaSigners = coronaSig.Signers()
+		coronaProof = coronaSig.Bytes()
+	}
+	finality := &QuantumFinality{
+		BlockID:       event.BlockID,
+		PChainHeight:  event.Height,
+		QChainHeight:  q.qHeight,
+		BLSProof:      blsProof,
+		CoronaProof:   coronaProof,
+		SignerBitset:  signerBitset,
+		CoronaSigners: coronaSigners,
+		TotalWeight:   totalWeight,
+		SignerWeight:  signerWeight,
+		BLSLatency:    blsLatency,
+		CoronaLatency: coronaLatency,
+		Timestamp:     time.Now(),
+	}
+
+	q.finalized[event.BlockID] = finality
+	q.pHeight = event.Height
+
+	// Prune old finality entries to bound memory
+	if q.maxFinalized > 0 && len(q.finalized) > q.maxFinalized {
+		cutoff := q.qHeight - uint64(q.maxFinalized)
+		for id, f := range q.finalized {
+			if f.QChainHeight < cutoff {
+				delete(q.finalized, id)
+			}
+		}
+	}
+
+	// Emit
+	select {
+	case q.finalityCh <- finality:
+	default:
+	}
+
+	q.log.Info("quasar: hybrid finality achieved",
+		"block", event.BlockID,
+		"pHeight", event.Height,
+		"qHeight", q.qHeight,
+		"weight", fmt.Sprintf("%d/%d", signerWeight, totalWeight),
+		"blsLatency", blsLatency,
+		"coronaLatency", coronaLatency,
+		"coronaSigners", len(coronaSigners),
+	)
+
+	return nil
+}
+
+// createMessage creates the finality message to sign
+func (q *Quasar) createMessage(event FinalityEvent) []byte {
+	msg := make([]byte, 48) // 32 (blockID) + 8 (height) + 8 (timestamp)
+	copy(msg[:32], event.BlockID[:])
+	putUint64BE(msg[32:40], event.Height)
+	putUint64BE(msg[40:48], uint64(event.Timestamp.UnixNano()))
+	return msg
+}
+
+// collectBLS collects BLS signatures from validators and aggregates them
+func (q *Quasar) collectBLS(event FinalityEvent, msg []byte) ([]byte, []byte, uint64, error) {
+	var signerBitset []byte
+	var signerWeight uint64
+	signatures := make([]*quasar.QuasarSig, 0, len(event.Validators))
+
+	for i, v := range event.Validators {
+		if !v.Active {
+			continue
+		}
+
+		sig, err := q.core.SignMessage(v.NodeID.String(), msg)
+		if err != nil {
+			continue // Skip failed signers
+		}
+
+		signatures = append(signatures, sig)
+		signerWeight += v.Weight
+
+		// Set bit
+		byteIdx := i / 8
+		for len(signerBitset) <= byteIdx {
+			signerBitset = append(signerBitset, 0)
+		}
+		signerBitset[byteIdx] |= 1 << uint(i%8)
+	}
+
+	if len(signatures) == 0 {
+		return nil, nil, 0, errors.New("no BLS signatures")
+	}
+
+	agg, err := q.core.AggregateSignatures(msg, signatures)
+	if err != nil {
+		return nil, nil, 0, err
+	}
+
+	return agg.BLSAggregated, signerBitset, signerWeight, nil
+}
+
+// collectCorona runs the 2-round Corona threshold protocol in parallel
+func (q *Quasar) collectCorona(message string) (Signature, error) {
+	if q.corona == nil {
+		return nil, ErrCoronaNotConnected
+	}
+
+	// Use the high-level Sign API which handles all rounds internally
+	sig, err := q.corona.Sign([]byte(message))
+	if err != nil {
+		return nil, fmt.Errorf("corona signing failed: %w", err)
+	}
+
+	// Verify the signature
+	if !q.corona.Verify([]byte(message), sig) {
+		return nil, ErrCoronaFailed
+	}
+
+	q.log.Debug("corona signature complete",
+		"signers", len(sig.Signers()),
+		"type", sig.Type(),
+	)
+
+	return sig, nil
+}
+
+// totalWeight calculates total validator weight
+func (q *Quasar) totalWeight(validators []ValidatorState) uint64 {
+	var total uint64
+	for _, v := range validators {
+		if v.Active {
+			total += v.Weight
+		}
+	}
+	return total
+}
+
+// checkQuorum verifies quorum is met using cross-multiplication to avoid
+// integer division truncation.
+//
+//	signerWeight / totalWeight >= quorumNum / quorumDen
+//	is equivalent to:
+//	signerWeight * quorumDen >= totalWeight * quorumNum
+//
+// Overflow bound: safe for totalWeight < 2^62 with quorumNum <= 3.
+// Production values: totalWeight is sum of validator weights (well under 2^60),
+// quorumNum=2, quorumDen=3.
+func (q *Quasar) checkQuorum(signerWeight, totalWeight uint64) bool {
+	return signerWeight*q.quorumDen >= totalWeight*q.quorumNum
+}
+
+// GetFinality returns finality for a block
+func (q *Quasar) GetFinality(blockID ids.ID) (*QuantumFinality, bool) {
+	q.mu.RLock()
+	defer q.mu.RUnlock()
+	f, ok := q.finalized[blockID]
+	return f, ok
+}
+
+// Subscribe returns channel for finality events
+func (q *Quasar) Subscribe() <-chan *QuantumFinality {
+	return q.finalityCh
+}
+
+// Verify verifies a hybrid finality proof.
+// Both BLS and Corona proofs are REQUIRED - no fallback mode.
+// This ensures quantum-safe consensus for Q-Chain validators.
+func (q *Quasar) Verify(finality *QuantumFinality) error {
+	if finality == nil {
+		return ErrFinalityFailed
+	}
+
+	// STRICT: Both proofs are REQUIRED
+	if len(finality.BLSProof) == 0 {
+		return fmt.Errorf("%w: BLS proof missing", ErrBLSFailed)
+	}
+	if len(finality.CoronaProof) == 0 {
+		return fmt.Errorf("%w: RT proof missing - required for Q-Chain validators", ErrCoronaFailed)
+	}
+
+	if !q.checkQuorum(finality.SignerWeight, finality.TotalWeight) {
+		return ErrInsufficientWeight
+	}
+
+	// Verify BLS via hybrid engine
+	agg := &quasar.AggregatedSignature{
+		BLSAggregated: finality.BLSProof,
+	}
+
+	// Reconstruct message for verification
+	msg := make([]byte, 48)
+	copy(msg[:32], finality.BlockID[:])
+	putUint64BE(msg[32:40], finality.PChainHeight)
+	putUint64BE(msg[40:48], uint64(finality.Timestamp.UnixNano()))
+
+	if !q.core.VerifyAggregatedSignature(msg, agg) {
+		return ErrBLSFailed
+	}
+
+	// Verify Corona threshold signature
+	// RT signatures MUST have the "RT" prefix marker followed by threshold data
+	if len(finality.CoronaProof) < 3 {
+		return fmt.Errorf("%w: RT proof too short", ErrCoronaFailed)
+	}
+	if finality.CoronaProof[0] != 'R' || finality.CoronaProof[1] != 'T' {
+		return fmt.Errorf("%w: invalid RT proof marker", ErrCoronaFailed)
+	}
+
+	// Verify threshold signers meet minimum requirement
+	if len(finality.CoronaSigners) < q.threshold {
+		return fmt.Errorf("%w: need %d signers, have %d",
+			ErrInsufficientSigners, q.threshold, len(finality.CoronaSigners))
+	}
+
+	return nil
+}
+
+// Stats returns quasar statistics
+func (q *Quasar) Stats() QuasarStats {
+	q.mu.RLock()
+	defer q.mu.RUnlock()
+
+	var coronaStats CoronaStats
+	if q.corona != nil {
+		coronaStats = q.corona.Stats()
+	}
+
+	return QuasarStats{
+		PChainHeight:    q.pHeight,
+		QChainHeight:    q.qHeight,
+		FinalizedBlocks: len(q.finalized),
+		Threshold:       q.threshold,
+		QuorumNum:       q.quorumNum,
+		QuorumDen:       q.quorumDen,
+		Running:         q.running,
+		CoronaParties:   coronaStats.NumParties,
+		CoronaThreshold: coronaStats.Threshold,
+		CoronaReady:     coronaStats.Initialized,
+	}
+}
+
+// QuasarStats contains quasar statistics
+type QuasarStats struct {
+	PChainHeight    uint64
+	QChainHeight    uint64
+	FinalizedBlocks int
+	Threshold       int
+	QuorumNum       uint64
+	QuorumDen       uint64
+	Running         bool
+	CoronaParties   int
+	CoronaThreshold int
+	CoronaReady     bool
+}
+
+// GetCore returns the underlying quasar core for testing
+func (q *Quasar) GetCore() *quasar.Quasar {
+	return q.core
+}
+
+// GetCorona returns the Corona coordinator
+func (q *Quasar) GetCorona() *CoronaCoordinator {
+	q.mu.RLock()
+	defer q.mu.RUnlock()
+	return q.corona
+}
+
+// CheckQuorum verifies quorum is met (exported for testing)
+func (q *Quasar) CheckQuorum(signerWeight, totalWeight uint64) bool {
+	return q.checkQuorum(signerWeight, totalWeight)
+}
+
+// CreateMessage creates the finality message to sign (exported for testing)
+func (q *Quasar) CreateMessage(event FinalityEvent) []byte {
+	return q.createMessage(event)
+}
+
+// TotalWeight calculates total validator weight (exported for testing)
+func (q *Quasar) TotalWeight(validators []ValidatorState) uint64 {
+	return q.totalWeight(validators)
+}
+
+// GetConfig returns quorum configuration (exported for testing)
+func (q *Quasar) GetConfig() (threshold int, quorumNum, quorumDen uint64) {
+	q.mu.RLock()
+	defer q.mu.RUnlock()
+	return q.threshold, q.quorumNum, q.quorumDen
+}
+
+// IsRunning returns whether the Quasar is currently running (exported for testing)
+func (q *Quasar) IsRunning() bool {
+	q.mu.RLock()
+	defer q.mu.RUnlock()
+	return q.running
+}
+
+// SetFinalized adds a finality record (exported for testing/benchmarking)
+func (q *Quasar) SetFinalized(blockID ids.ID, finality *QuantumFinality) {
+	q.mu.Lock()
+	defer q.mu.Unlock()
+	q.finalized[blockID] = finality
+}
+
+// GetFinalized retrieves a finality record (exported for testing)
+func (q *Quasar) GetFinalized(blockID ids.ID) (*QuantumFinality, bool) {
+	q.mu.RLock()
+	defer q.mu.RUnlock()
+	f, ok := q.finalized[blockID]
+	return f, ok
+}
+
+// Helper: big-endian uint64
+func putUint64BE(b []byte, v uint64) {
+	for i := 0; i < 8; i++ {
+		b[i] = byte(v >> (56 - i*8))
+	}
+}

consensus/quasar/store.go

@@ -1,61 +0,0 @@
-// Copyright (C) 2019-2026, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package quasar
-
-import (
-	"sync"
-
-	qcert "github.com/luxfi/consensus/protocol/quasar"
-)
-
-// CertStore resolves the QuasarCert that certifies a finalized block. In
-// production it is filled by the cert gossip/ingest path (the producer
-// follow-on, producer.go); the verify gate only READS from it. Keyed by the
-// finalized position (chainID, height, blockID) so a cert can never be returned
-// for the wrong block.
-type CertStore interface {
-	Lookup(chainID uint32, height uint64, blockID [32]byte) (*qcert.ConsensusCert, bool)
-}
-
-type certKey struct {
-	chainID uint32
-	height  uint64
-	blockID [32]byte
-}
-
-// MemCertStore is an in-memory CertStore keyed by (chainID, height, blockID). It
-// is the ingest sink the cert-gossip handler writes into (Put) and the gate
-// reads from (Lookup). Safe for concurrent use.
-type MemCertStore struct {
-	mu    sync.RWMutex
-	certs map[certKey]*qcert.ConsensusCert
-}
-
-// NewMemCertStore returns an empty in-memory cert store.
-func NewMemCertStore() *MemCertStore {
-	return &MemCertStore{certs: make(map[certKey]*qcert.ConsensusCert)}
-}
-
-// Put indexes a cert by its own (ChainID, Height, BlockHash). The ingest path
-// MUST verify a cert before Put (verify-before-store), exactly as the gossip
-// layer verifies before re-gossip; the gate re-verifies at the checkpoint so a
-// store poisoned by an unverified Put still cannot finalize an invalid cert.
-func (m *MemCertStore) Put(cert *qcert.ConsensusCert) {
-	if cert == nil {
-		return
-	}
-	k := certKey{chainID: cert.ChainID, height: cert.Height, blockID: cert.BlockHash}
-	m.mu.Lock()
-	m.certs[k] = cert
-	m.mu.Unlock()
-}
-
-// Lookup returns the cert for the finalized position, or (nil, false).
-func (m *MemCertStore) Lookup(chainID uint32, height uint64, blockID [32]byte) (*qcert.ConsensusCert, bool) {
-	k := certKey{chainID: chainID, height: height, blockID: blockID}
-	m.mu.RLock()
-	c, ok := m.certs[k]
-	m.mu.RUnlock()
-	return c, ok
-}

consensus/quasar/types.go

@@ -0,0 +1,240 @@
+// Copyright (C) 2019-2025, Lux Industries Inc. All rights reserved.
+// See the file LICENSE for licensing terms.
+
+package quasar
+
+import (
+	"errors"
+
+	"github.com/luxfi/ids"
+	"github.com/luxfi/log"
+)
+
+// SignatureType identifies the signature algorithm used
+type SignatureType uint8
+
+const (
+	SignatureTypeBLS SignatureType = iota
+	SignatureTypeCorona
+	SignatureTypeQuasar // Hybrid BLS + Corona
+	SignatureTypeMLDSA
+)
+
+// Signature is the interface for all signature types
+type Signature interface {
+	Bytes() []byte
+	Type() SignatureType
+	Signers() []ids.NodeID
+}
+
+// Signer is the interface for signing operations
+type Signer interface {
+	Sign(msg []byte) (Signature, error)
+	PublicKey() []byte
+}
+
+// Verifier is the interface for signature verification
+type Verifier interface {
+	Verify(msg []byte, sig Signature) bool
+}
+
+// ThresholdSigner extends Signer for threshold signature schemes
+type ThresholdSigner interface {
+	Signer
+	Index() int
+	Threshold() int
+}
+
+// CoronaConfig holds configuration for Corona threshold signatures
+type CoronaConfig struct {
+	NumParties int
+	Threshold  int
+	PartyIndex int
+}
+
+// CoronaStats contains statistics about the Corona coordinator
+type CoronaStats struct {
+	NumParties  int
+	Threshold   int
+	Initialized bool
+}
+
+// CoronaSignature represents a threshold Corona signature
+type CoronaSignature struct {
+	sig     []byte
+	signers []ids.NodeID
+}
+
+// NewCoronaSignature creates a new Corona signature
+func NewCoronaSignature(sig []byte, signers []ids.NodeID) *CoronaSignature {
+	return &CoronaSignature{sig: sig, signers: signers}
+}
+
+func (s *CoronaSignature) Bytes() []byte         { return s.sig }
+func (s *CoronaSignature) Type() SignatureType   { return SignatureTypeCorona }
+func (s *CoronaSignature) Signers() []ids.NodeID { return s.signers }
+
+// CoronaCoordinator manages the threshold signing protocol.
+//
+// Sign/Verify are fail-closed without initialized lattice keys.
+// Operations return errors unless properly initialized with key
+// material, or explicitly created via NewTestCoronaCoordinator
+// for tests.
+type CoronaCoordinator struct {
+	log         log.Logger
+	config      CoronaConfig
+	initialized bool
+	testing     bool // only true via NewTestCoronaCoordinator
+	validators  []ids.NodeID
+}
+
+// NewCoronaCoordinator creates a new Corona coordinator.
+// Sign and Verify will fail until real lattice key material is loaded.
+func NewCoronaCoordinator(log log.Logger, config CoronaConfig) (*CoronaCoordinator, error) {
+	return &CoronaCoordinator{
+		log:    log,
+		config: config,
+	}, nil
+}
+
+// NewTestCoronaCoordinator creates a Corona coordinator for testing.
+// The test coordinator uses deterministic stub signatures that are NOT
+// cryptographically secure.
+func NewTestCoronaCoordinator(log log.Logger, config CoronaConfig) (*CoronaCoordinator, error) {
+	return &CoronaCoordinator{
+		log:     log,
+		config:  config,
+		testing: true,
+	}, nil
+}
+
+func (rc *CoronaCoordinator) Initialize(validators []ids.NodeID) error {
+	rc.validators = validators
+	rc.initialized = true
+	return nil
+}
+
+func (rc *CoronaCoordinator) IsInitialized() bool {
+	return rc.initialized
+}
+
+func (rc *CoronaCoordinator) Sign(msg []byte) (Signature, error) {
+	if !rc.initialized {
+		return nil, errors.New("corona: threshold signing not initialized — requires real lattice key material")
+	}
+	if rc.testing {
+		// Test-only stub: deterministic RT-prefixed signature
+		sig := append([]byte("RT"), msg[:min(32, len(msg))]...)
+		return NewCoronaSignature(sig, rc.validators), nil
+	}
+	return nil, errors.New("corona: threshold signing not initialized — requires real lattice key material")
+}
+
+func (rc *CoronaCoordinator) Verify(msg []byte, sig Signature) bool {
+	if !rc.initialized {
+		return false
+	}
+	if rc.testing {
+		return sig != nil && len(sig.Bytes()) > 0
+	}
+	return false
+}
+
+func (rc *CoronaCoordinator) Stats() CoronaStats {
+	return CoronaStats{
+		NumParties:  rc.config.NumParties,
+		Threshold:   rc.config.Threshold,
+		Initialized: rc.initialized,
+	}
+}
+
+// Threshold returns the threshold required for signing
+func (rc *CoronaCoordinator) Threshold() int {
+	return rc.config.Threshold
+}
+
+// NumParties returns the number of parties in the threshold scheme
+func (rc *CoronaCoordinator) NumParties() int {
+	return rc.config.NumParties
+}
+
+func min(a, b int) int {
+	if a < b {
+		return a
+	}
+	return b
+}
+
+// BLSSignature represents an aggregated BLS signature (node-specific)
+type BLSSignature struct {
+	sig     []byte
+	signers []ids.NodeID
+}
+
+func NewBLSSignature(sig []byte, signers []ids.NodeID) *BLSSignature {
+	return &BLSSignature{sig: sig, signers: signers}
+}
+
+func (s *BLSSignature) Bytes() []byte         { return s.sig }
+func (s *BLSSignature) Type() SignatureType   { return SignatureTypeBLS }
+func (s *BLSSignature) Signers() []ids.NodeID { return s.signers }
+
+// QuasarSignature combines BLS and Corona signatures for P/Q security
+type QuasarSignature struct {
+	bls    *BLSSignature
+	corona *CoronaSignature
+}
+
+func NewQuasarSignature(bls *BLSSignature, corona *CoronaSignature) *QuasarSignature {
+	return &QuasarSignature{bls: bls, corona: corona}
+}
+
+func (s *QuasarSignature) Bytes() []byte {
+	// Concatenate BLS + Corona bytes with length prefix
+	blsBytes := s.bls.Bytes()
+	rtBytes := s.corona.Bytes()
+	result := make([]byte, 4+len(blsBytes)+len(rtBytes))
+	// Length of BLS signature (big endian)
+	result[0] = byte(len(blsBytes) >> 24)
+	result[1] = byte(len(blsBytes) >> 16)
+	result[2] = byte(len(blsBytes) >> 8)
+	result[3] = byte(len(blsBytes))
+	copy(result[4:], blsBytes)
+	copy(result[4+len(blsBytes):], rtBytes)
+	return result
+}
+
+func (s *QuasarSignature) Type() SignatureType { return SignatureTypeQuasar }
+
+func (s *QuasarSignature) Signers() []ids.NodeID {
+	// Return intersection of signers (both must sign)
+	return s.bls.Signers()
+}
+
+func (s *QuasarSignature) BLS() *BLSSignature       { return s.bls }
+func (s *QuasarSignature) Corona() *CoronaSignature { return s.corona }
+
+// QuasarSigner combines classical and post-quantum signers
+type QuasarSigner interface {
+	Signer
+	// SignQuasar signs with both BLS and Corona in parallel
+	SignQuasar(msg []byte) (*QuasarSignature, error)
+	// VerifyQuasar verifies both BLS and Corona signatures
+	VerifyQuasar(msg []byte, sig *QuasarSignature) bool
+}
+
+// FinalityProof represents proof of block finality
+type FinalityProof struct {
+	BlockID      ids.ID
+	Height       uint64
+	Signature    Signature
+	TotalWeight  uint64
+	SignerWeight uint64
+}
+
+// ValidatorInfo contains validator information for consensus
+type ValidatorInfo struct {
+	NodeID ids.NodeID
+	Weight uint64
+	Active bool
+}

consensus/quasar/validators.go

@@ -1,94 +0,0 @@
-// Copyright (C) 2019-2026, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package quasar
-
-import (
-	qcert "github.com/luxfi/consensus/protocol/quasar"
-)
-
-// ValidatorSetProvider resolves the committed validator set the verifier pins a
-// cert against, for a (chain, epoch). Post-activation the gate calls this once
-// per verified checkpoint.
-type ValidatorSetProvider interface {
-	ValidatorSet(chainID uint32, epoch uint64) (qcert.ConsensusValidatorSet, error)
-}
-
-// ValidatorSet is a concrete ConsensusValidatorSet for one epoch: the committed
-// weighted-validator-set root plus the per-leg verification keys the cert legs
-// verify against (the classical BLS aggregate key for the Beam leg and the
-// Pulsar ML-DSA threshold group key for the Pulsar leg — the HYBRID_PQ pair).
-//
-// Production wiring (the activation seam): in production these fields are
-// populated from the P-Chain-pinned validator set (Root, Epoch) and the active
-// KeyEra group keys for the epoch. That population is era/rotation-coupled and
-// lands with the producer + KeyEra-registry wiring (see producer.go). Corona
-// (STRICT_DUAL_PQ) and Magnetar/P3Q (POLARIS / RECOVERY) group keys + the
-// weighted-sig-set config are populated by that same follow-on; until then this
-// set serves the HYBRID_PQ pair and reports "no key" for the other lanes.
-type ValidatorSet struct {
-	root        [48]byte
-	epoch       uint64
-	blsAggKey   []byte // classical BLS-12-381 aggregate pubkey (Beam leg)
-	pulsarGroup []byte // Pulsar ML-DSA threshold group pubkey (Pulsar leg)
-}
-
-var _ qcert.ConsensusValidatorSet = (*ValidatorSet)(nil)
-
-// NewValidatorSet builds a committed validator set for one epoch from its root
-// and the HYBRID_PQ verification keys.
-func NewValidatorSet(root [48]byte, epoch uint64, blsAggKey, pulsarGroup []byte) *ValidatorSet {
-	return &ValidatorSet{root: root, epoch: epoch, blsAggKey: blsAggKey, pulsarGroup: pulsarGroup}
-}
-
-// Root returns the 48-byte weighted-validator-set commitment.
-func (v *ValidatorSet) Root() [48]byte { return v.root }
-
-// Epoch returns the epoch this set was committed under.
-func (v *ValidatorSet) Epoch() uint64 { return v.epoch }
-
-// WeightedConfig returns the QuorumVerifierConfig for the WeightedSigSet
-// evidence mode. HYBRID_PQ does not use weighted-sig-set legs; the zero config
-// is correct here and is populated by the POLARIS / RECOVERY follow-on.
-func (v *ValidatorSet) WeightedConfig() qcert.QuorumVerifierConfig {
-	return qcert.QuorumVerifierConfig{}
-}
-
-// WeightedEnvelope returns the round-digest posture axes for the inner
-// WeightedQuorumCert. Zero for HYBRID_PQ (no weighted-sig-set leg); populated by
-// the POLARIS / RECOVERY follow-on.
-func (v *ValidatorSet) WeightedEnvelope() qcert.QuorumMessageEnvelope {
-	return qcert.QuorumMessageEnvelope{}
-}
-
-// ThresholdGroupKey returns the threshold-signature group public key for a leg
-// kind. Serves the Pulsar (ML-DSA) lane; reports (zero, false) for the others
-// until their group keys are wired by the follow-on.
-func (v *ValidatorSet) ThresholdGroupKey(kind qcert.LegKind) (qcert.ThresholdGroupKey, bool) {
-	if kind == qcert.LegPulsarMLDSA && len(v.pulsarGroup) > 0 {
-		return qcert.ThresholdGroupKey{Kind: qcert.LegPulsarMLDSA, PulsarGroupKey: v.pulsarGroup}, true
-	}
-	return qcert.ThresholdGroupKey{}, false
-}
-
-// ClassicalAggregateKey returns the classical aggregate verification key for a
-// scheme. Serves the BLS-12-381 Beam leg.
-func (v *ValidatorSet) ClassicalAggregateKey(scheme qcert.ClassicalScheme) ([]byte, bool) {
-	if scheme == qcert.ClassicalSchemeBLS12381 && len(v.blsAggKey) > 0 {
-		return v.blsAggKey, true
-	}
-	return nil, false
-}
-
-// StaticValidatorSetProvider returns the same committed set for every (chain,
-// epoch). It is the single-era / test provider; the production provider resolves
-// per-epoch sets from the P-Chain validator manager + KeyEra registry.
-type StaticValidatorSetProvider struct{ Set qcert.ConsensusValidatorSet }
-
-// ValidatorSet implements ValidatorSetProvider.
-func (p StaticValidatorSetProvider) ValidatorSet(_ uint32, _ uint64) (qcert.ConsensusValidatorSet, error) {
-	if p.Set == nil {
-		return nil, ErrValidatorSetUnavailable
-	}
-	return p.Set, nil
-}

consensus/zap/bridge.go

@@ -0,0 +1,378 @@
+// Copyright (C) 2019-2025, Lux Industries Inc. All rights reserved.
+// See the file LICENSE for licensing terms.
+
+// Package zap provides ZAP (Zero-copy Agent Protocol) integration for Lux consensus.
+//
+// This package bridges ZAP's agentic consensus with Lux's Quasar threshold signatures,
+// enabling W3C DID-based validator identity and post-quantum secure finality.
+package zap
+
+import (
+	"context"
+	"errors"
+	"sync"
+
+	"github.com/luxfi/ids"
+	"github.com/luxfi/log"
+	"github.com/luxfi/node/consensus/quasar"
+)
+
+var (
+	// ErrNotInitialized is returned when the bridge is used before initialization
+	ErrNotInitialized = errors.New("zap bridge not initialized")
+	// ErrValidatorNotFound is returned when a validator is not in the set
+	ErrValidatorNotFound = errors.New("validator not found")
+	// ErrQueryNotFound is returned when a query ID is not known
+	ErrQueryNotFound = errors.New("query not found")
+	// ErrAlreadyVoted is returned when a validator tries to vote twice
+	ErrAlreadyVoted = errors.New("already voted on this query")
+	// ErrInvalidDID is returned when a DID is malformed
+	ErrInvalidDID = errors.New("invalid DID format")
+)
+
+// BridgeConfig configures the ZAP-Lux consensus bridge
+type BridgeConfig struct {
+	// ConsensusThreshold is the fraction of votes needed (0.5 = majority)
+	ConsensusThreshold float64
+	// MinResponses is the minimum responses before checking consensus
+	MinResponses int
+	// MinVotes is the minimum votes before checking consensus
+	MinVotes int
+	// EnablePQCrypto enables post-quantum signatures (ML-DSA-65)
+	EnablePQCrypto bool
+}
+
+// DefaultBridgeConfig returns sensible defaults for the bridge
+func DefaultBridgeConfig() BridgeConfig {
+	return BridgeConfig{
+		ConsensusThreshold: 0.5,
+		MinResponses:       1,
+		MinVotes:           3,
+		EnablePQCrypto:     true,
+	}
+}
+
+// Bridge connects ZAP agentic consensus to Lux's Quasar finality
+type Bridge struct {
+	log     log.Logger
+	config  BridgeConfig
+	quasar  *quasar.CoronaCoordinator
+	mu      sync.RWMutex
+	queries map[string]*QueryState // QueryID -> QueryState
+	dids    map[ids.NodeID]*DID    // NodeID -> DID
+}
+
+// NewBridge creates a new ZAP-Lux consensus bridge
+func NewBridge(log log.Logger, config BridgeConfig) *Bridge {
+	return &Bridge{
+		log:     log,
+		config:  config,
+		queries: make(map[string]*QueryState),
+		dids:    make(map[ids.NodeID]*DID),
+	}
+}
+
+// Initialize sets up the bridge with a Quasar coordinator
+func (b *Bridge) Initialize(coordinator *quasar.CoronaCoordinator) error {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	if coordinator == nil {
+		return ErrNotInitialized
+	}
+
+	b.quasar = coordinator
+	b.log.Info("ZAP bridge initialized",
+		log.Int("threshold", coordinator.Threshold()),
+		log.Int("parties", coordinator.NumParties()),
+		log.Bool("pqCrypto", b.config.EnablePQCrypto),
+	)
+	return nil
+}
+
+// RegisterValidator associates a DID with a Lux NodeID
+func (b *Bridge) RegisterValidator(nodeID ids.NodeID, did *DID) error {
+	if did == nil || !did.Valid() {
+		return ErrInvalidDID
+	}
+
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	b.dids[nodeID] = did
+	b.log.Debug("Registered validator DID",
+		log.Stringer("nodeID", nodeID),
+		log.String("did", did.String()),
+	)
+	return nil
+}
+
+// GetValidatorDID returns the DID for a NodeID
+func (b *Bridge) GetValidatorDID(nodeID ids.NodeID) (*DID, error) {
+	b.mu.RLock()
+	defer b.mu.RUnlock()
+
+	did, ok := b.dids[nodeID]
+	if !ok {
+		return nil, ErrValidatorNotFound
+	}
+	return did, nil
+}
+
+// SubmitQuery creates a new agentic consensus query
+func (b *Bridge) SubmitQuery(ctx context.Context, queryID string, content []byte, submitter ids.NodeID) error {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	if b.quasar == nil {
+		return ErrNotInitialized
+	}
+
+	submitterDID, ok := b.dids[submitter]
+	if !ok {
+		return ErrValidatorNotFound
+	}
+
+	b.queries[queryID] = &QueryState{
+		ID:        queryID,
+		Content:   content,
+		Submitter: submitterDID,
+		Responses: make(map[string]*Response),
+		Votes:     make(map[string][]*DID),
+	}
+
+	b.log.Debug("Query submitted",
+		log.String("queryID", queryID),
+		log.String("submitter", submitterDID.String()),
+	)
+	return nil
+}
+
+// SubmitResponse adds a response to a query
+func (b *Bridge) SubmitResponse(ctx context.Context, queryID, responseID string, content []byte, responder ids.NodeID) error {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	state, ok := b.queries[queryID]
+	if !ok {
+		return ErrQueryNotFound
+	}
+
+	responderDID, ok := b.dids[responder]
+	if !ok {
+		return ErrValidatorNotFound
+	}
+
+	if state.Finalized != "" {
+		return errors.New("query already finalized")
+	}
+
+	state.Responses[responseID] = &Response{
+		ID:        responseID,
+		QueryID:   queryID,
+		Content:   content,
+		Responder: responderDID,
+	}
+	state.Votes[responseID] = []*DID{}
+
+	b.log.Debug("Response submitted",
+		log.String("queryID", queryID),
+		log.String("responseID", responseID),
+		log.String("responder", responderDID.String()),
+	)
+	return nil
+}
+
+// Vote casts a vote for a response
+func (b *Bridge) Vote(ctx context.Context, queryID, responseID string, voter ids.NodeID) error {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	state, ok := b.queries[queryID]
+	if !ok {
+		return ErrQueryNotFound
+	}
+
+	if state.Finalized != "" {
+		return errors.New("query already finalized")
+	}
+
+	if _, ok := state.Responses[responseID]; !ok {
+		return errors.New("response not found")
+	}
+
+	voterDID, ok := b.dids[voter]
+	if !ok {
+		return ErrValidatorNotFound
+	}
+
+	// Check for double voting (by DID URI)
+	voterURI := voterDID.String()
+	for _, voters := range state.Votes {
+		for _, v := range voters {
+			if v.String() == voterURI {
+				return ErrAlreadyVoted
+			}
+		}
+	}
+
+	state.Votes[responseID] = append(state.Votes[responseID], voterDID)
+
+	// Check consensus
+	b.checkConsensus(state)
+
+	return nil
+}
+
+func (b *Bridge) checkConsensus(state *QueryState) {
+	if state.Finalized != "" {
+		return
+	}
+
+	if len(state.Responses) < b.config.MinResponses {
+		return
+	}
+
+	totalVotes := 0
+	for _, voters := range state.Votes {
+		totalVotes += len(voters)
+	}
+
+	if totalVotes < b.config.MinVotes {
+		return
+	}
+
+	// Find best response
+	var best struct {
+		id    string
+		count int
+	}
+
+	for responseID, voters := range state.Votes {
+		count := len(voters)
+		confidence := float64(count) / float64(totalVotes)
+
+		if confidence >= b.config.ConsensusThreshold {
+			if best.id == "" || count > best.count {
+				best.id = responseID
+				best.count = count
+			}
+		}
+	}
+
+	if best.id != "" {
+		state.Finalized = best.id
+		b.log.Info("Query finalized",
+			log.String("queryID", state.ID),
+			log.String("responseID", best.id),
+			log.Int("votes", best.count),
+			log.Int("total", totalVotes),
+		)
+	}
+}
+
+// GetResult returns the consensus result for a query
+func (b *Bridge) GetResult(queryID string) (*ConsensusResult, error) {
+	b.mu.RLock()
+	defer b.mu.RUnlock()
+
+	state, ok := b.queries[queryID]
+	if !ok {
+		return nil, ErrQueryNotFound
+	}
+
+	if state.Finalized == "" {
+		return nil, nil
+	}
+
+	response := state.Responses[state.Finalized]
+	votes := len(state.Votes[state.Finalized])
+
+	totalVoters := 0
+	for _, v := range state.Votes {
+		totalVoters += len(v)
+	}
+
+	confidence := 0.0
+	if totalVoters > 0 {
+		confidence = float64(votes) / float64(totalVoters)
+	}
+
+	return &ConsensusResult{
+		Response:    response,
+		Votes:       votes,
+		TotalVoters: totalVoters,
+		Confidence:  confidence,
+	}, nil
+}
+
+// IsFinalized checks if a query has reached consensus
+func (b *Bridge) IsFinalized(queryID string) bool {
+	b.mu.RLock()
+	defer b.mu.RUnlock()
+
+	state, ok := b.queries[queryID]
+	return ok && state.Finalized != ""
+}
+
+// SignWithQuasar signs a message using Quasar hybrid signatures
+func (b *Bridge) SignWithQuasar(msg []byte) (quasar.Signature, error) {
+	b.mu.RLock()
+	defer b.mu.RUnlock()
+
+	if b.quasar == nil {
+		return nil, ErrNotInitialized
+	}
+
+	return b.quasar.Sign(msg)
+}
+
+// VerifyQuasar verifies a Quasar signature
+func (b *Bridge) VerifyQuasar(msg []byte, sig quasar.Signature) bool {
+	b.mu.RLock()
+	defer b.mu.RUnlock()
+
+	if b.quasar == nil {
+		return false
+	}
+
+	return b.quasar.Verify(msg, sig)
+}
+
+// Stats returns bridge statistics
+func (b *Bridge) Stats() BridgeStats {
+	b.mu.RLock()
+	defer b.mu.RUnlock()
+
+	active := 0
+	finalized := 0
+	for _, state := range b.queries {
+		if state.Finalized != "" {
+			finalized++
+		} else {
+			active++
+		}
+	}
+
+	var quasarStats quasar.CoronaStats
+	if b.quasar != nil {
+		quasarStats = b.quasar.Stats()
+	}
+
+	return BridgeStats{
+		RegisteredValidators: len(b.dids),
+		ActiveQueries:        active,
+		FinalizedQueries:     finalized,
+		QuasarInitialized:    b.quasar != nil && b.quasar.IsInitialized(),
+		QuasarStats:          quasarStats,
+	}
+}
+
+// BridgeStats contains statistics about the bridge
+type BridgeStats struct {
+	RegisteredValidators int
+	ActiveQueries        int
+	FinalizedQueries     int
+	QuasarInitialized    bool
+	QuasarStats          quasar.CoronaStats
+}

consensus/zap/bridge_test.go

@@ -0,0 +1,459 @@
+// Copyright (C) 2019-2025, Lux Industries Inc. All rights reserved.
+// See the file LICENSE for licensing terms.
+
+package zap
+
+import (
+	"context"
+	"testing"
+
+	"github.com/luxfi/ids"
+	"github.com/luxfi/log"
+	"github.com/luxfi/node/consensus/quasar"
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseDID(t *testing.T) {
+	tests := []struct {
+		name    string
+		input   string
+		want    *DID
+		wantErr bool
+	}{
+		{
+			name:  "valid did:lux",
+			input: "did:lux:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK",
+			want: &DID{
+				Method: DIDMethodLux,
+				ID:     "z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK",
+			},
+			wantErr: false,
+		},
+		{
+			name:  "valid did:key",
+			input: "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK",
+			want: &DID{
+				Method: DIDMethodKey,
+				ID:     "z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK",
+			},
+			wantErr: false,
+		},
+		{
+			name:  "valid did:web",
+			input: "did:web:example.com:users:alice",
+			want: &DID{
+				Method: DIDMethodWeb,
+				ID:     "example.com:users:alice",
+			},
+			wantErr: false,
+		},
+		{
+			name:    "invalid - no did prefix",
+			input:   "lux:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK",
+			wantErr: true,
+		},
+		{
+			name:    "invalid - unknown method",
+			input:   "did:unknown:abc123",
+			wantErr: true,
+		},
+		{
+			name:    "invalid - empty id",
+			input:   "did:lux:",
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := ParseDID(tt.input)
+			if tt.wantErr {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			require.Equal(t, tt.want.Method, got.Method)
+			require.Equal(t, tt.want.ID, got.ID)
+		})
+	}
+}
+
+func TestDIDString(t *testing.T) {
+	did := &DID{Method: DIDMethodLux, ID: "z6MkTest"}
+	require.Equal(t, "did:lux:z6MkTest", did.String())
+}
+
+func TestDIDValid(t *testing.T) {
+	tests := []struct {
+		name  string
+		did   *DID
+		valid bool
+	}{
+		{
+			name:  "valid lux",
+			did:   &DID{Method: DIDMethodLux, ID: "z6MkTest"},
+			valid: true,
+		},
+		{
+			name:  "valid key",
+			did:   &DID{Method: DIDMethodKey, ID: "z6MkTest"},
+			valid: true,
+		},
+		{
+			name:  "valid web",
+			did:   &DID{Method: DIDMethodWeb, ID: "example.com"},
+			valid: true,
+		},
+		{
+			name:  "nil did",
+			did:   nil,
+			valid: false,
+		},
+		{
+			name:  "empty id",
+			did:   &DID{Method: DIDMethodLux, ID: ""},
+			valid: false,
+		},
+		{
+			name:  "unknown method",
+			did:   &DID{Method: "unknown", ID: "test"},
+			valid: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			require.Equal(t, tt.valid, tt.did.Valid())
+		})
+	}
+}
+
+func TestDIDFromNodeID(t *testing.T) {
+	nodeID := ids.GenerateTestNodeID()
+	did := DIDFromNodeID(nodeID)
+
+	require.NotNil(t, did)
+	require.Equal(t, DIDMethodLux, did.Method)
+	require.True(t, did.Valid())
+	require.Contains(t, did.String(), "did:lux:")
+}
+
+func TestDIDFromWeb(t *testing.T) {
+	tests := []struct {
+		name    string
+		domain  string
+		path    string
+		wantID  string
+		wantErr bool
+	}{
+		{
+			name:    "domain only",
+			domain:  "example.com",
+			path:    "",
+			wantID:  "example.com",
+			wantErr: false,
+		},
+		{
+			name:    "domain with path",
+			domain:  "example.com",
+			path:    "users/alice",
+			wantID:  "example.com:users:alice",
+			wantErr: false,
+		},
+		{
+			name:    "empty domain",
+			domain:  "",
+			path:    "",
+			wantErr: true,
+		},
+		{
+			name:    "domain with slash",
+			domain:  "example/com",
+			path:    "",
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := DIDFromWeb(tt.domain, tt.path)
+			if tt.wantErr {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			require.Equal(t, DIDMethodWeb, got.Method)
+			require.Equal(t, tt.wantID, got.ID)
+		})
+	}
+}
+
+func TestGenerateDocument(t *testing.T) {
+	did := &DID{Method: DIDMethodLux, ID: "z6MkTest"}
+	doc, err := did.GenerateDocument()
+
+	require.NoError(t, err)
+	require.NotNil(t, doc)
+	require.Equal(t, "did:lux:z6MkTest", doc.ID)
+	require.Len(t, doc.Context, 2)
+	require.Len(t, doc.VerificationMethod, 1)
+	require.Len(t, doc.Authentication, 1)
+	require.Len(t, doc.Service, 1)
+	require.Equal(t, "ZapAgent", doc.Service[0].Type)
+}
+
+func TestBridgeNew(t *testing.T) {
+	logger := log.Noop()
+	config := DefaultBridgeConfig()
+	bridge := NewBridge(logger, config)
+
+	require.NotNil(t, bridge)
+	require.Equal(t, 0.5, bridge.config.ConsensusThreshold)
+}
+
+func TestBridgeInitialize(t *testing.T) {
+	logger := log.Noop()
+	bridge := NewBridge(logger, DefaultBridgeConfig())
+
+	// Test with nil coordinator
+	err := bridge.Initialize(nil)
+	require.ErrorIs(t, err, ErrNotInitialized)
+
+	// Test with valid coordinator
+	coordinator, err := quasar.NewTestCoronaCoordinator(logger, quasar.CoronaConfig{
+		NumParties: 4,
+		Threshold:  3,
+		PartyIndex: 0,
+	})
+	require.NoError(t, err)
+
+	err = bridge.Initialize(coordinator)
+	require.NoError(t, err)
+}
+
+func TestBridgeRegisterValidator(t *testing.T) {
+	logger := log.Noop()
+	bridge := NewBridge(logger, DefaultBridgeConfig())
+
+	nodeID := ids.GenerateTestNodeID()
+	did := DIDFromNodeID(nodeID)
+
+	// Register validator
+	err := bridge.RegisterValidator(nodeID, did)
+	require.NoError(t, err)
+
+	// Get validator DID
+	got, err := bridge.GetValidatorDID(nodeID)
+	require.NoError(t, err)
+	require.Equal(t, did.String(), got.String())
+
+	// Unknown validator
+	_, err = bridge.GetValidatorDID(ids.GenerateTestNodeID())
+	require.ErrorIs(t, err, ErrValidatorNotFound)
+
+	// Invalid DID
+	err = bridge.RegisterValidator(nodeID, nil)
+	require.ErrorIs(t, err, ErrInvalidDID)
+}
+
+func TestBridgeConsensusFlow(t *testing.T) {
+	logger := log.Noop()
+	bridge := NewBridge(logger, BridgeConfig{
+		ConsensusThreshold: 0.5,
+		MinResponses:       1,
+		MinVotes:           2,
+		EnablePQCrypto:     true,
+	})
+
+	// Initialize with coordinator
+	coordinator, err := quasar.NewTestCoronaCoordinator(logger, quasar.CoronaConfig{
+		NumParties: 4,
+		Threshold:  3,
+		PartyIndex: 0,
+	})
+	require.NoError(t, err)
+	require.NoError(t, bridge.Initialize(coordinator))
+
+	// Register validators
+	submitter := ids.GenerateTestNodeID()
+	responder := ids.GenerateTestNodeID()
+	voter1 := ids.GenerateTestNodeID()
+	voter2 := ids.GenerateTestNodeID()
+
+	require.NoError(t, bridge.RegisterValidator(submitter, DIDFromNodeID(submitter)))
+	require.NoError(t, bridge.RegisterValidator(responder, DIDFromNodeID(responder)))
+	require.NoError(t, bridge.RegisterValidator(voter1, DIDFromNodeID(voter1)))
+	require.NoError(t, bridge.RegisterValidator(voter2, DIDFromNodeID(voter2)))
+
+	ctx := context.Background()
+
+	// Submit query
+	queryID := "query123"
+	err = bridge.SubmitQuery(ctx, queryID, []byte("What is 2+2?"), submitter)
+	require.NoError(t, err)
+
+	// Submit response
+	responseID := "response456"
+	err = bridge.SubmitResponse(ctx, queryID, responseID, []byte("4"), responder)
+	require.NoError(t, err)
+
+	// Vote
+	require.NoError(t, bridge.Vote(ctx, queryID, responseID, voter1))
+	require.False(t, bridge.IsFinalized(queryID)) // Not enough votes yet
+
+	require.NoError(t, bridge.Vote(ctx, queryID, responseID, voter2))
+	require.True(t, bridge.IsFinalized(queryID)) // Now finalized
+
+	// Get result
+	result, err := bridge.GetResult(queryID)
+	require.NoError(t, err)
+	require.NotNil(t, result)
+	require.Equal(t, responseID, result.Response.ID)
+	require.Equal(t, 2, result.Votes)
+	require.Equal(t, 2, result.TotalVoters)
+	require.Equal(t, 1.0, result.Confidence)
+}
+
+func TestBridgeDoubleVote(t *testing.T) {
+	logger := log.Noop()
+	bridge := NewBridge(logger, DefaultBridgeConfig())
+
+	coordinator, _ := quasar.NewTestCoronaCoordinator(logger, quasar.CoronaConfig{
+		NumParties: 2,
+		Threshold:  1,
+	})
+	bridge.Initialize(coordinator)
+
+	submitter := ids.GenerateTestNodeID()
+	voter := ids.GenerateTestNodeID()
+
+	bridge.RegisterValidator(submitter, DIDFromNodeID(submitter))
+	bridge.RegisterValidator(voter, DIDFromNodeID(voter))
+
+	ctx := context.Background()
+	queryID := "q1"
+	responseID := "r1"
+
+	bridge.SubmitQuery(ctx, queryID, []byte("test"), submitter)
+	bridge.SubmitResponse(ctx, queryID, responseID, []byte("answer"), submitter)
+
+	// First vote succeeds
+	require.NoError(t, bridge.Vote(ctx, queryID, responseID, voter))
+
+	// Second vote fails
+	err := bridge.Vote(ctx, queryID, responseID, voter)
+	require.ErrorIs(t, err, ErrAlreadyVoted)
+}
+
+func TestBridgeStats(t *testing.T) {
+	logger := log.Noop()
+	bridge := NewBridge(logger, DefaultBridgeConfig())
+
+	coordinator, _ := quasar.NewTestCoronaCoordinator(logger, quasar.CoronaConfig{
+		NumParties: 4,
+		Threshold:  3,
+	})
+	bridge.Initialize(coordinator)
+
+	nodeID := ids.GenerateTestNodeID()
+	bridge.RegisterValidator(nodeID, DIDFromNodeID(nodeID))
+
+	stats := bridge.Stats()
+	require.Equal(t, 1, stats.RegisteredValidators)
+	require.Equal(t, 0, stats.ActiveQueries)
+	require.Equal(t, 0, stats.FinalizedQueries)
+	require.False(t, stats.QuasarInitialized) // Not initialized with validators
+}
+
+func TestNewQuery(t *testing.T) {
+	did := &DID{Method: DIDMethodLux, ID: "z6MkTest"}
+	query := NewQuery([]byte("What is 2+2?"), did)
+
+	require.NotEmpty(t, query.ID)
+	require.Equal(t, 64, len(query.ID)) // SHA-256 hex
+	require.Equal(t, []byte("What is 2+2?"), query.Content)
+	require.Equal(t, did, query.Submitter)
+	require.Greater(t, query.Timestamp, int64(0))
+}
+
+func TestNewResponse(t *testing.T) {
+	did := &DID{Method: DIDMethodLux, ID: "z6MkTest"}
+	queryID := "0000000000000000000000000000000000000000000000000000000000000000"
+	response := NewResponse(queryID, []byte("4"), did)
+
+	require.NotEmpty(t, response.ID)
+	require.Equal(t, 64, len(response.ID)) // SHA-256 hex
+	require.Equal(t, queryID, response.QueryID)
+	require.Equal(t, []byte("4"), response.Content)
+	require.Equal(t, did, response.Responder)
+}
+
+func TestInMemoryStakeRegistry(t *testing.T) {
+	registry := NewInMemoryStakeRegistry()
+	did := &DID{Method: DIDMethodLux, ID: "z6MkTest"}
+
+	// Initial stake is 0
+	stake, err := registry.GetStake(did)
+	require.NoError(t, err)
+	require.Equal(t, uint64(0), stake)
+
+	// Set stake
+	require.NoError(t, registry.SetStake(did, 1000))
+
+	// Get stake
+	stake, err = registry.GetStake(did)
+	require.NoError(t, err)
+	require.Equal(t, uint64(1000), stake)
+
+	// Total stake
+	require.Equal(t, uint64(1000), registry.TotalStake())
+
+	// Has sufficient stake
+	has, err := registry.HasSufficientStake(did, 500)
+	require.NoError(t, err)
+	require.True(t, has)
+
+	has, err = registry.HasSufficientStake(did, 2000)
+	require.NoError(t, err)
+	require.False(t, has)
+
+	// Stake weight
+	weight, err := registry.StakeWeight(did)
+	require.NoError(t, err)
+	require.Equal(t, 1.0, weight) // Only staker
+}
+
+func TestAgentMessageType(t *testing.T) {
+	require.Equal(t, "Query", AgentMessageTypeQuery.String())
+	require.Equal(t, "Response", AgentMessageTypeResponse.String())
+	require.Equal(t, "Vote", AgentMessageTypeVote.String())
+	require.Equal(t, "Finality", AgentMessageTypeFinality.String())
+	require.Equal(t, "Unknown", AgentMessageType(255).String())
+}
+
+func TestBase58EncodeDecode(t *testing.T) {
+	tests := []struct {
+		name string
+		data []byte
+	}{
+		{"empty", []byte{}},
+		{"single byte", []byte{0x01}},
+		{"multiple bytes", []byte{0x01, 0x02, 0x03, 0x04}},
+		{"leading zeros", []byte{0x00, 0x00, 0x01, 0x02}},
+		{"all zeros", []byte{0x00, 0x00, 0x00}},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			encoded := base58Encode(tt.data)
+			decoded, err := base58Decode(encoded)
+			require.NoError(t, err)
+			require.Equal(t, tt.data, decoded)
+		})
+	}
+}
+
+func TestBase58DecodeInvalidChar(t *testing.T) {
+	_, err := base58Decode("0OIl") // Invalid chars
+	require.Error(t, err)
+}

consensus/zap/did.go

@@ -0,0 +1,355 @@
+// Copyright (C) 2019-2025, Lux Industries Inc. All rights reserved.
+// See the file LICENSE for licensing terms.
+
+package zap
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"strings"
+
+	"github.com/luxfi/ids"
+)
+
+const (
+	// MethodLux is the did:lux method for blockchain-anchored DIDs
+	MethodLux = "lux"
+	// MethodKey is the did:key method for self-certifying DIDs
+	MethodKey = "key"
+	// MethodWeb is the did:web method for DNS-based DIDs
+	MethodWeb = "web"
+
+	// MLDSAPublicKeySize is the expected size of ML-DSA-65 public keys
+	MLDSAPublicKeySize = 1952
+
+	// MultibaseBase58BTC is the multibase prefix for base58btc
+	MultibaseBase58BTC = 'z'
+)
+
+// MulticodecMLDSA65 is the provisional multicodec prefix for ML-DSA-65
+var MulticodecMLDSA65 = []byte{0x13, 0x09}
+
+// DIDMethod represents a DID method identifier
+type DIDMethod string
+
+const (
+	DIDMethodLux DIDMethod = MethodLux
+	DIDMethodKey DIDMethod = MethodKey
+	DIDMethodWeb DIDMethod = MethodWeb
+)
+
+// DID represents a W3C Decentralized Identifier
+type DID struct {
+	Method DIDMethod
+	ID     string
+}
+
+// NewDID creates a DID from method and identifier
+func NewDID(method DIDMethod, id string) *DID {
+	return &DID{Method: method, ID: id}
+}
+
+// ParseDID parses a DID from a string in format "did:method:id"
+func ParseDID(s string) (*DID, error) {
+	if !strings.HasPrefix(s, "did:") {
+		return nil, fmt.Errorf("%w: must start with 'did:'", ErrInvalidDID)
+	}
+
+	rest := s[4:] // Skip "did:"
+	colonIndex := strings.Index(rest, ":")
+	if colonIndex == -1 {
+		return nil, fmt.Errorf("%w: expected 'did:method:id'", ErrInvalidDID)
+	}
+
+	methodStr := rest[:colonIndex]
+	id := rest[colonIndex+1:]
+
+	if id == "" {
+		return nil, fmt.Errorf("%w: identifier cannot be empty", ErrInvalidDID)
+	}
+
+	var method DIDMethod
+	switch methodStr {
+	case MethodLux:
+		method = DIDMethodLux
+	case MethodKey:
+		method = DIDMethodKey
+	case MethodWeb:
+		method = DIDMethodWeb
+	default:
+		return nil, fmt.Errorf("%w: unknown method '%s'", ErrInvalidDID, methodStr)
+	}
+
+	return &DID{Method: method, ID: id}, nil
+}
+
+// String returns the full DID URI
+func (d *DID) String() string {
+	if d == nil {
+		return ""
+	}
+	return fmt.Sprintf("did:%s:%s", d.Method, d.ID)
+}
+
+// Valid checks if the DID is well-formed
+func (d *DID) Valid() bool {
+	if d == nil || d.ID == "" {
+		return false
+	}
+	switch d.Method {
+	case DIDMethodLux, DIDMethodKey, DIDMethodWeb:
+		return true
+	default:
+		return false
+	}
+}
+
+// DIDFromNodeID creates a did:lux from a Lux NodeID
+func DIDFromNodeID(nodeID ids.NodeID) *DID {
+	// Use multibase-encoded NodeID bytes
+	encoded := base58Encode(nodeID[:])
+	return &DID{
+		Method: DIDMethodLux,
+		ID:     string(MultibaseBase58BTC) + encoded,
+	}
+}
+
+// DIDFromPublicKey creates a did:key from an ML-DSA-65 public key
+func DIDFromPublicKey(publicKey []byte) (*DID, error) {
+	if len(publicKey) != MLDSAPublicKeySize {
+		return nil, fmt.Errorf("invalid ML-DSA public key size: expected %d, got %d",
+			MLDSAPublicKeySize, len(publicKey))
+	}
+
+	// Prefix with multicodec for ML-DSA-65
+	prefixed := make([]byte, len(MulticodecMLDSA65)+len(publicKey))
+	copy(prefixed, MulticodecMLDSA65)
+	copy(prefixed[len(MulticodecMLDSA65):], publicKey)
+
+	// Encode with multibase (base58btc)
+	encoded := base58Encode(prefixed)
+
+	return &DID{
+		Method: DIDMethodKey,
+		ID:     string(MultibaseBase58BTC) + encoded,
+	}, nil
+}
+
+// DIDFromWeb creates a did:web from a domain and optional path
+func DIDFromWeb(domain string, path string) (*DID, error) {
+	if domain == "" {
+		return nil, fmt.Errorf("%w: domain cannot be empty", ErrInvalidDID)
+	}
+	if strings.ContainsAny(domain, "/:") {
+		return nil, fmt.Errorf("%w: domain cannot contain '/' or ':'", ErrInvalidDID)
+	}
+
+	var id string
+	if path != "" {
+		// Replace '/' with ':' per did:web spec
+		pathParts := strings.ReplaceAll(path, "/", ":")
+		id = domain + ":" + pathParts
+	} else {
+		id = domain
+	}
+
+	return &DID{Method: DIDMethodWeb, ID: id}, nil
+}
+
+// ExtractKeyMaterial extracts raw key bytes from did:key or did:lux
+func (d *DID) ExtractKeyMaterial() ([]byte, error) {
+	if d == nil || d.ID == "" {
+		return nil, fmt.Errorf("%w: empty identifier", ErrInvalidDID)
+	}
+
+	if d.ID[0] != MultibaseBase58BTC {
+		return nil, fmt.Errorf("%w: unsupported multibase encoding", ErrInvalidDID)
+	}
+
+	// Decode base58btc (skip multibase prefix)
+	decoded, err := base58Decode(d.ID[1:])
+	if err != nil {
+		return nil, fmt.Errorf("%w: %v", ErrInvalidDID, err)
+	}
+
+	if len(decoded) < 2 {
+		return nil, fmt.Errorf("%w: identifier too short", ErrInvalidDID)
+	}
+
+	// Skip multicodec prefix if it matches ML-DSA-65
+	if len(decoded) >= 2 && decoded[0] == MulticodecMLDSA65[0] && decoded[1] == MulticodecMLDSA65[1] {
+		return decoded[2:], nil
+	}
+
+	return decoded, nil
+}
+
+// Hash returns a 32-byte hash of the DID for indexing
+func (d *DID) Hash() ids.ID {
+	h := sha256.Sum256([]byte(d.String()))
+	var id ids.ID
+	copy(id[:], h[:])
+	return id
+}
+
+// ToHex returns the DID hash as a hex string
+func (d *DID) ToHex() string {
+	id := d.Hash()
+	return hex.EncodeToString(id[:])
+}
+
+// VerificationMethod represents a verification method in a DID Document
+type VerificationMethod struct {
+	ID                  string
+	Type                string
+	Controller          string
+	PublicKeyMultibase  string
+	BlockchainAccountID string
+}
+
+// Service represents a service endpoint in a DID Document
+type Service struct {
+	ID              string
+	Type            string
+	ServiceEndpoint string
+}
+
+// DIDDocument represents a W3C DID Document
+type DIDDocument struct {
+	Context              []string
+	ID                   string
+	Controller           string
+	VerificationMethod   []VerificationMethod
+	Authentication       []string
+	AssertionMethod      []string
+	KeyAgreement         []string
+	CapabilityInvocation []string
+	CapabilityDelegation []string
+	Service              []Service
+}
+
+// GenerateDocument creates a DID Document for a DID
+func (d *DID) GenerateDocument() (*DIDDocument, error) {
+	if !d.Valid() {
+		return nil, fmt.Errorf("%w: invalid DID", ErrInvalidDID)
+	}
+
+	uri := d.String()
+	keyID := uri + "#keys-1"
+
+	var vm VerificationMethod
+	switch d.Method {
+	case DIDMethodLux, DIDMethodKey:
+		vm = VerificationMethod{
+			ID:                 keyID,
+			Type:               "JsonWebKey2020",
+			Controller:         uri,
+			PublicKeyMultibase: d.ID,
+		}
+		if d.Method == DIDMethodLux {
+			// Add blockchain account ID
+			keyMaterial, err := d.ExtractKeyMaterial()
+			if err == nil && len(keyMaterial) >= 20 {
+				vm.BlockchainAccountID = "lux:" + hex.EncodeToString(keyMaterial[:20])
+			}
+		}
+	case DIDMethodWeb:
+		vm = VerificationMethod{
+			ID:         keyID,
+			Type:       "JsonWebKey2020",
+			Controller: uri,
+		}
+	}
+
+	return &DIDDocument{
+		Context: []string{
+			"https://www.w3.org/ns/did/v1",
+			"https://w3id.org/security/suites/jws-2020/v1",
+		},
+		ID:                   uri,
+		VerificationMethod:   []VerificationMethod{vm},
+		Authentication:       []string{keyID},
+		AssertionMethod:      []string{keyID},
+		CapabilityInvocation: []string{keyID},
+		Service: []Service{
+			{
+				ID:              uri + "#zap-agent",
+				Type:            "ZapAgent",
+				ServiceEndpoint: "zap://" + d.ID,
+			},
+		},
+	}, nil
+}
+
+// Base58 encoding/decoding (Bitcoin alphabet)
+const base58Alphabet = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"
+
+func base58Encode(data []byte) string {
+	// Convert to big integer
+	result := make([]byte, 0, len(data)*2)
+	for _, b := range data {
+		carry := int(b)
+		for i := 0; i < len(result); i++ {
+			carry += int(result[i]) << 8
+			result[i] = byte(carry % 58)
+			carry /= 58
+		}
+		for carry > 0 {
+			result = append(result, byte(carry%58))
+			carry /= 58
+		}
+	}
+
+	// Handle leading zeros
+	for _, b := range data {
+		if b != 0 {
+			break
+		}
+		result = append(result, 0)
+	}
+
+	// Reverse and convert to alphabet
+	output := make([]byte, len(result))
+	for i := range result {
+		output[len(result)-1-i] = base58Alphabet[result[i]]
+	}
+
+	return string(output)
+}
+
+func base58Decode(s string) ([]byte, error) {
+	result := make([]byte, 0, len(s))
+	for _, c := range s {
+		index := strings.IndexRune(base58Alphabet, c)
+		if index == -1 {
+			return nil, fmt.Errorf("invalid base58 character: %c", c)
+		}
+
+		carry := index
+		for i := 0; i < len(result); i++ {
+			carry += int(result[i]) * 58
+			result[i] = byte(carry)
+			carry >>= 8
+		}
+		for carry > 0 {
+			result = append(result, byte(carry))
+			carry >>= 8
+		}
+	}
+
+	// Handle leading ones
+	for _, c := range s {
+		if c != rune(base58Alphabet[0]) {
+			break
+		}
+		result = append(result, 0)
+	}
+
+	// Reverse
+	for i, j := 0, len(result)-1; i < j; i, j = i+1, j-1 {
+		result[i], result[j] = result[j], result[i]
+	}
+
+	return result, nil
+}

consensus/zap/types.go

@@ -0,0 +1,260 @@
+// Copyright (C) 2019-2025, Lux Industries Inc. All rights reserved.
+// See the file LICENSE for licensing terms.
+
+package zap
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"time"
+)
+
+// QueryState represents the state of a consensus query
+type QueryState struct {
+	ID        string
+	Content   []byte
+	Submitter *DID
+	Timestamp time.Time
+	Responses map[string]*Response
+	Votes     map[string][]*DID // ResponseID -> list of voter DIDs
+	Finalized string            // ResponseID if finalized
+}
+
+// Response represents a response to a query
+type Response struct {
+	ID        string
+	QueryID   string
+	Content   []byte
+	Responder *DID
+	Timestamp time.Time
+}
+
+// ConsensusResult represents the outcome of consensus voting
+type ConsensusResult struct {
+	Response    *Response
+	Votes       int
+	TotalVoters int
+	Confidence  float64
+}
+
+// Query represents an agentic consensus query
+type Query struct {
+	ID        string
+	Content   []byte
+	Submitter *DID
+	Timestamp int64
+}
+
+// NewQuery creates a query with auto-generated ID
+func NewQuery(content []byte, submitter *DID) *Query {
+	timestamp := time.Now().Unix()
+	data := append(content, []byte(submitter.String())...)
+	data = append(data, int64ToBytes(timestamp)...)
+	hash := sha256.Sum256(data)
+
+	return &Query{
+		ID:        hex.EncodeToString(hash[:]),
+		Content:   content,
+		Submitter: submitter,
+		Timestamp: timestamp,
+	}
+}
+
+// NewResponse creates a response with auto-generated ID
+func NewResponse(queryID string, content []byte, responder *DID) *Response {
+	timestamp := time.Now()
+	queryIDBytes, _ := hex.DecodeString(queryID)
+	data := append(queryIDBytes, content...)
+	data = append(data, []byte(responder.String())...)
+	data = append(data, int64ToBytes(timestamp.Unix())...)
+	hash := sha256.Sum256(data)
+
+	return &Response{
+		ID:        hex.EncodeToString(hash[:]),
+		QueryID:   queryID,
+		Content:   content,
+		Responder: responder,
+		Timestamp: timestamp,
+	}
+}
+
+// Vote represents a vote cast by a validator
+type Vote struct {
+	QueryID    string
+	ResponseID string
+	Voter      *DID
+	Timestamp  int64
+	Signature  []byte // Optional post-quantum signature
+}
+
+// NewVote creates a new vote
+func NewVote(queryID, responseID string, voter *DID) *Vote {
+	return &Vote{
+		QueryID:    queryID,
+		ResponseID: responseID,
+		Voter:      voter,
+		Timestamp:  time.Now().Unix(),
+	}
+}
+
+// FinalityProof represents proof of agentic consensus finality
+type FinalityProof struct {
+	QueryID     string
+	ResponseID  string
+	Votes       []Vote
+	TotalVoters int
+	Confidence  float64
+	Timestamp   int64
+	Signature   []byte // Quasar hybrid signature
+}
+
+// ValidatorWeight represents a validator's weight in consensus
+type ValidatorWeight struct {
+	DID    *DID
+	Weight uint64
+	Stake  uint64
+	Active bool
+}
+
+// AgentMessage represents a ZAP protocol message for agentic consensus
+type AgentMessage struct {
+	Type      AgentMessageType
+	Query     *Query
+	Response  *Response
+	Vote      *Vote
+	Signature []byte
+}
+
+// AgentMessageType identifies the type of agent message
+type AgentMessageType uint8
+
+const (
+	AgentMessageTypeQuery AgentMessageType = iota
+	AgentMessageTypeResponse
+	AgentMessageTypeVote
+	AgentMessageTypeFinality
+)
+
+// String returns the message type name
+func (t AgentMessageType) String() string {
+	switch t {
+	case AgentMessageTypeQuery:
+		return "Query"
+	case AgentMessageTypeResponse:
+		return "Response"
+	case AgentMessageTypeVote:
+		return "Vote"
+	case AgentMessageTypeFinality:
+		return "Finality"
+	default:
+		return "Unknown"
+	}
+}
+
+func int64ToBytes(n int64) []byte {
+	b := make([]byte, 8)
+	for i := 0; i < 8; i++ {
+		b[i] = byte(n >> (i * 8))
+	}
+	return b
+}
+
+// PQSignatureType identifies the post-quantum signature algorithm
+type PQSignatureType uint8
+
+const (
+	// PQSignatureTypeMLDSA65 is NIST FIPS 204 ML-DSA-65
+	PQSignatureTypeMLDSA65 PQSignatureType = iota
+	// PQSignatureTypeCorona is Ring-LWE based threshold signatures
+	PQSignatureTypeCorona
+	// PQSignatureTypeHybrid combines classical and post-quantum
+	PQSignatureTypeHybrid
+)
+
+// PQSignature wraps a post-quantum signature
+type PQSignature struct {
+	Type      PQSignatureType
+	Signature []byte
+	PublicKey []byte
+}
+
+// PQKeypair represents a post-quantum keypair
+type PQKeypair struct {
+	Type       PQSignatureType
+	PublicKey  []byte
+	PrivateKey []byte
+}
+
+// Sign signs a message using the keypair (stub - real impl in pqcrypto)
+func (k *PQKeypair) Sign(message []byte) (*PQSignature, error) {
+	// Stub: returns SHA-256 hash as fixed-size signature for testing
+	hash := sha256.Sum256(append(message, k.PrivateKey...))
+	return &PQSignature{
+		Type:      k.Type,
+		Signature: hash[:],
+		PublicKey: k.PublicKey,
+	}, nil
+}
+
+// Verify verifies a signature (stub - real impl in pqcrypto)
+func (k *PQKeypair) Verify(message []byte, sig *PQSignature) bool {
+	// Stub: accepts any non-empty signature
+	return sig != nil && len(sig.Signature) > 0
+}
+
+// StakeRegistry interface for validator stake tracking
+type StakeRegistry interface {
+	GetStake(did *DID) (uint64, error)
+	SetStake(did *DID, amount uint64) error
+	TotalStake() uint64
+	HasSufficientStake(did *DID, minimum uint64) (bool, error)
+	StakeWeight(did *DID) (float64, error)
+}
+
+// InMemoryStakeRegistry is a simple in-memory stake registry for testing
+type InMemoryStakeRegistry struct {
+	stakes map[string]uint64
+}
+
+// NewInMemoryStakeRegistry creates a new in-memory stake registry
+func NewInMemoryStakeRegistry() *InMemoryStakeRegistry {
+	return &InMemoryStakeRegistry{
+		stakes: make(map[string]uint64),
+	}
+}
+
+// GetStake returns the stake for a DID
+func (r *InMemoryStakeRegistry) GetStake(did *DID) (uint64, error) {
+	return r.stakes[did.String()], nil
+}
+
+// SetStake sets the stake for a DID
+func (r *InMemoryStakeRegistry) SetStake(did *DID, amount uint64) error {
+	r.stakes[did.String()] = amount
+	return nil
+}
+
+// TotalStake returns the total stake across all validators
+func (r *InMemoryStakeRegistry) TotalStake() uint64 {
+	var total uint64
+	for _, stake := range r.stakes {
+		total += stake
+	}
+	return total
+}
+
+// HasSufficientStake checks if a DID has at least the minimum stake
+func (r *InMemoryStakeRegistry) HasSufficientStake(did *DID, minimum uint64) (bool, error) {
+	stake, _ := r.GetStake(did)
+	return stake >= minimum, nil
+}
+
+// StakeWeight returns the stake weight as a fraction of total stake
+func (r *InMemoryStakeRegistry) StakeWeight(did *DID) (float64, error) {
+	stake, _ := r.GetStake(did)
+	total := r.TotalStake()
+	if total == 0 {
+		return 0.0, nil
+	}
+	return float64(stake) / float64(total), nil
+}

go.mod

@@ -26,10 +26,10 @@ require (
 	github.com/huin/goupnp v1.3.0
 	github.com/jackpal/gateway v1.1.1
 	github.com/jackpal/go-nat-pmp v1.0.2
-	github.com/luxfi/consensus v1.35.2
-	github.com/luxfi/crypto v1.19.26
-	github.com/luxfi/database v1.20.4
-	github.com/luxfi/ids v1.3.0
+	github.com/luxfi/consensus v1.25.19
+	github.com/luxfi/crypto v1.19.21
+	github.com/luxfi/database v1.20.3
+	github.com/luxfi/ids v1.2.15
 	github.com/luxfi/keychain v1.0.2
 	github.com/luxfi/log v1.4.3
 	github.com/luxfi/math v1.4.1
@@ -102,8 +102,8 @@ require (
 	github.com/sanity-io/litter v1.5.5 // indirect
 	github.com/spf13/afero v1.15.0 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
-	github.com/tklauser/go-sysconf v0.4.0 // indirect
-	github.com/tklauser/numcpus v0.12.0 // indirect
+	github.com/tklauser/go-sysconf v0.3.16 // indirect
+	github.com/tklauser/numcpus v0.11.0 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	go.opentelemetry.io/otel/metric v1.44.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
@@ -120,23 +120,24 @@ require (
 	github.com/luxfi/accel v1.2.4
 	github.com/luxfi/api v1.0.15
 	github.com/luxfi/atomic v1.0.0
-	github.com/luxfi/chains v1.4.8
+	github.com/luxfi/chains v1.3.16
 	github.com/luxfi/codec v1.1.5
 	github.com/luxfi/compress v0.0.5
 	github.com/luxfi/constants v1.5.8
 	github.com/luxfi/container v0.0.4
 	github.com/luxfi/filesystem v0.0.1
-	github.com/luxfi/genesis v1.13.16
+	github.com/luxfi/genesis v1.13.14
 	github.com/luxfi/genesis/pkg/genesis/security v1.13.8
 	github.com/luxfi/geth v1.17.12
 	github.com/luxfi/go-bip39 v1.1.2
 	github.com/luxfi/keys v1.2.0
+	github.com/luxfi/lattice/v7 v7.1.4
 	github.com/luxfi/math/safe v0.0.1
 	github.com/luxfi/net v0.0.5
 	github.com/luxfi/p2p v1.21.1
 	github.com/luxfi/resource v0.0.1
 	github.com/luxfi/rpc v1.1.0
-	github.com/luxfi/runtime v1.1.3
+	github.com/luxfi/runtime v1.1.1
 	github.com/luxfi/sdk v1.17.9
 	github.com/luxfi/sys v0.1.0
 	github.com/luxfi/timer v1.0.2
@@ -145,16 +146,14 @@ require (
 	github.com/luxfi/utxo v0.3.7
 	github.com/luxfi/validators v1.2.0
 	github.com/luxfi/vm v1.2.5
-	github.com/luxfi/warp v1.24.0
-	github.com/luxfi/zap v0.8.11
+	github.com/luxfi/warp v1.19.5
+	github.com/luxfi/zap v0.7.2
 	github.com/luxfi/zwing v0.5.2
 	github.com/nbutton23/zxcvbn-go v0.0.0-20210217022336-fa2cb2858354
-	github.com/zap-proto/http v0.0.0-20260506200741-fd6047874433
 	go.uber.org/zap v1.27.1
 )
 
 require (
-	capnproto.org/go/capnp/v3 v3.0.1-alpha.2 // indirect
 	filippo.io/edwards25519 v1.2.0 // indirect
 	filippo.io/hpke v0.4.0 // indirect
 	github.com/aws/aws-sdk-go-v2 v1.41.5 // indirect
@@ -179,7 +178,6 @@ require (
 	github.com/btcsuite/btcd/btcec/v2 v2.3.6 // indirect
 	github.com/btcsuite/btcd/chaincfg/chainhash v1.1.0 // indirect
 	github.com/cenkalti/backoff v2.2.1+incompatible // indirect
-	github.com/colega/zeropool v0.0.0-20230505084239-6fb4a4f75381 // indirect
 	github.com/decred/dcrd/crypto/blake256 v1.1.0 // indirect
 	github.com/go-ini/ini v1.67.0 // indirect
 	github.com/goccy/go-yaml v1.19.2 // indirect
@@ -190,21 +188,17 @@ require (
 	github.com/hanzos3/go-sdk v1.0.2 // indirect
 	github.com/klauspost/crc32 v1.3.0 // indirect
 	github.com/luxfi/age v1.5.0 // indirect
-	github.com/luxfi/bft v0.1.5 // indirect
-	github.com/luxfi/corona v0.10.3 // indirect
+	github.com/luxfi/corona v0.7.9 // indirect
 	github.com/luxfi/crypto/ipa v1.2.4 // indirect
-	github.com/luxfi/dkg v0.3.5 // indirect
-	github.com/luxfi/kms v1.11.7 // indirect
-	github.com/luxfi/lattice/v7 v7.1.4 // indirect
+	github.com/luxfi/kms v1.11.4 // indirect
 	github.com/luxfi/lens v0.1.4 // indirect
 	github.com/luxfi/magnetar v1.2.3 // indirect
 	github.com/luxfi/mdns v0.1.1 // indirect
-	github.com/luxfi/mlwe v0.2.1 // indirect
 	github.com/luxfi/pq v1.0.3 // indirect
-	github.com/luxfi/precompile v0.16.0 // indirect
-	github.com/luxfi/pulsar v1.9.0 // indirect
-	github.com/luxfi/staking v1.5.1 // indirect
-	github.com/luxfi/threshold v1.12.0 // indirect
+	github.com/luxfi/precompile v0.5.56 // indirect
+	github.com/luxfi/pulsar v1.1.5 // indirect
+	github.com/luxfi/staking v1.5.0 // indirect
+	github.com/luxfi/threshold v1.9.9 // indirect
 	github.com/luxfi/trace v1.1.0 // indirect
 	github.com/luxfi/zapcodec v1.0.1 // indirect
 	github.com/luxfi/zapdb v1.10.1 // indirect
@@ -215,7 +209,7 @@ require (
 	github.com/philhofer/fwd v1.2.0 // indirect
 	github.com/rs/xid v1.6.0 // indirect
 	github.com/tinylib/msgp v1.6.4 // indirect
-	go.mongodb.org/mongo-driver v1.17.9 // indirect
+	go.mongodb.org/mongo-driver v1.17.4 // indirect
 )
 
 require (
@@ -262,10 +256,3 @@ require (
 )
 
 exclude github.com/ethereum/go-ethereum v1.10.26
-
-// TEMPORARY — local-dev build aid for the bootstrap frozen-cache convergence fix.
-// FINAL CASCADE (publish step, NOT done here): tag consensus v1.25.36 (the uncommitted
-// engine/chain/integration.go FinalizedLedger + FinalizedBlockAtHeight accessors and the
-// engine/chain/bootstrap Has→Accepted change), bump the require above v1.25.35 → v1.25.36,
-// then DELETE this replace. The zap client (option b) is node-only and does NOT widen the
-// consensus bump.

go.sum

@@ -1,7 +1,5 @@
 c2sp.org/CCTV/age v0.0.0-20251208015420-e9274a7bdbfd h1:ZLsPO6WdZ5zatV4UfVpr7oAwLGRZ+sebTUruuM4Ra3M=
 c2sp.org/CCTV/age v0.0.0-20251208015420-e9274a7bdbfd/go.mod h1:SrHC2C7r5GkDk8R+NFVzYy/sdj0Ypg9htaPXQq5Cqeo=
-capnproto.org/go/capnp/v3 v3.0.1-alpha.2 h1:W/cf+XEArUSwcBBE/9wS2NpWDkM5NLQOjmzEiHZpYi0=
-capnproto.org/go/capnp/v3 v3.0.1-alpha.2/go.mod h1:2vT5D2dtG8sJGEoEKU17e+j7shdaYp1Myl8X03B3hmc=
 filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
 filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
 filippo.io/hpke v0.4.0 h1:p575VVQ6ted4pL+it6M00V/f2qTZITO0zgmdKCkd5+A=
@@ -110,8 +108,6 @@ github.com/cockroachdb/redact v1.1.8 h1:8eVLLj6juKxiKrAEw2b8cJvNqWq++U8WOfQFuL7K
 github.com/cockroachdb/redact v1.1.8/go.mod h1:GceHHpJ0rMDpYARL5In88Alq/xMBUtVlz7Qxix6ZVkw=
 github.com/cockroachdb/tokenbucket v0.0.0-20250429170803-42689b6311bb h1:3bCgBvB8PbJVMX1ouCcSIxvsqKPYM7gs72o0zC76n9g=
 github.com/cockroachdb/tokenbucket v0.0.0-20250429170803-42689b6311bb/go.mod h1:7nc4anLGjupUW/PeY5qiNYsdNXj7zopG+eqsS7To5IQ=
-github.com/colega/zeropool v0.0.0-20230505084239-6fb4a4f75381 h1:d5EKgQfRQvO97jnISfR89AiCCCJMwMFoSxUiU0OGCRU=
-github.com/colega/zeropool v0.0.0-20230505084239-6fb4a4f75381/go.mod h1:OU76gHeRo8xrzGJU3F3I1CqX1ekM8dfJw0+wPeMwnp0=
 github.com/consensys/gnark-crypto v0.20.1 h1:PXDUBvk8AzhvWowHLWBEAfUQcV1/aZgWIqD6eMpXmDg=
 github.com/consensys/gnark-crypto v0.20.1/go.mod h1:RBWrSgy+IDbGR69RRV313th3M/aZU1ubk2om+qHuTSc=
 github.com/cosmos/go-bip39 v1.0.0 h1:pcomnQdrdH22njcAatO0yWojsUnCO3y2tNoV1cb6hHY=
@@ -298,48 +294,42 @@ github.com/luxfi/accel v1.2.4 h1:5VbIHyEvvfobn2zBiTFODxDw1CeqxCepZOLlvkuf9yQ=
 github.com/luxfi/accel v1.2.4/go.mod h1:ISIwAX+ZfsL/S5nsP2JvfldXN6Nc+QzoWf6Jtaq+xsQ=
 github.com/luxfi/address v1.0.1 h1:Sc4keyuVzBIvHr7uVeYZf2/WY9YDGUgDi/iiWenj49g=
 github.com/luxfi/address v1.0.1/go.mod h1:5j3Eh66v9zvv1GbNdZwt+23krV8JlSDaRzmWZU8ZRM0=
-github.com/luxfi/age v1.5.0 h1:zC/Fw/ptZwAXr9nqrxmrcf8752EIl1Lq9RECp9OmCO0=
+github.com/luxfi/age v1.5.0 h1:G69HbSV4R3vKEH9B0CulnRaMdSdf4RalMgP8xKmxHeI=
 github.com/luxfi/age v1.5.0/go.mod h1:iAYAxgvrXxcy746+Ovh/eWWDuF9teJLNcCSSOX9RYW0=
 github.com/luxfi/api v1.0.15 h1:Q5ox3Ompw/AZNMfB9wpHZosrj9C+ZldAEHKtHEotFdY=
 github.com/luxfi/api v1.0.15/go.mod h1:Eer59msIXMnOlFncG0XjEGH3TZML0Dd1bUu4GtB7f4Q=
 github.com/luxfi/atomic v1.0.0 h1:xUV60MuzRvXngaQ1sM0yVC2v4TRoLlUGkkH7M9PS4yw=
 github.com/luxfi/atomic v1.0.0/go.mod h1:0G2mTlQ6TXWHICUHrUUPu1/qAiIyR4gSZ2tva9ci/bI=
-github.com/luxfi/bft v0.1.5 h1:5xVLPkog4e5LTgaVlb9pgxA0EWE6tkrKwHPZVRz+RZw=
-github.com/luxfi/bft v0.1.5/go.mod h1:5I8Ft8yA69xZlDe3RB0i4MgbqFKLZe65o/sha8JuKvU=
 github.com/luxfi/cache v1.2.1 h1:kAzOS55/hmYeNKR+0HAKv4ma48Y6JjkI8UQeqdZ8bfI=
 github.com/luxfi/cache v1.2.1/go.mod h1:co7JTxZZHpKT31Yh01LFp5aZOxmoUg157FhBLQdQHVU=
-github.com/luxfi/chains v1.4.8 h1:i5QxDfGR922oPGYrBbUo2Qn3tFMpJD9BilNTLFaQscE=
-github.com/luxfi/chains v1.4.8/go.mod h1:F/jT9YbC8/yD4WxJu4AvRFbi4NyKY+FHBWrE8M08dgE=
+github.com/luxfi/chains v1.3.16 h1:oCInwe650dBx53NdA0fg/gGmkNXOXg5NWpUSvhN6Iyc=
+github.com/luxfi/chains v1.3.16/go.mod h1:lFwRZno8sDOfLuWyCi1rMxum9DPFn6aqupEEpIat9Mk=
 github.com/luxfi/codec v1.1.5 h1:KBq8uvYm5Dy+E1heG8WBmqbqu8kstlFyE5ASBBB+C8I=
 github.com/luxfi/codec v1.1.5/go.mod h1:/ugIv5iEgI+VAuPIetzxNT0eJaEjOID/mrIsgIjJh8g=
 github.com/luxfi/compress v0.0.5 h1:4tEUHw5MK1bu5UOjfYCt4OKMiH7yykIgmGPRA/BfJTM=
 github.com/luxfi/compress v0.0.5/go.mod h1:Cc1yxD2pfzrvpO32W2GDwLKff+CylHEvzZh2Ko8RSIU=
 github.com/luxfi/concurrent v0.0.3 h1:eJyv1fhaC0jMLMw6+QS774cUmp7GK+ouMgvLCqnC7cc=
 github.com/luxfi/concurrent v0.0.3/go.mod h1:Aj/FR5NpM0cB2P4Nt3+tz9+dV6V+LUW4HuMgSjwq5hw=
-github.com/luxfi/consensus v1.33.3 h1:gUfmxb+KSLJnixFkk7CvKHeO1B9CNBt/Zp6EJEwgVXE=
-github.com/luxfi/consensus v1.33.3/go.mod h1:2ON+tN8hsAqd13DmsGk1Epfz6EQ0s4lv/rmOUsh7Gpk=
-github.com/luxfi/consensus v1.35.2 h1:Vy0yrLkCqRHhijYu3qNNwEf7e79HvSAbkRqbBLAYZnM=
-github.com/luxfi/consensus v1.35.2/go.mod h1:2ON+tN8hsAqd13DmsGk1Epfz6EQ0s4lv/rmOUsh7Gpk=
+github.com/luxfi/consensus v1.25.19 h1:PXKstFDBvZP3ZToZj6yay9kZ5Mkwt2f72xMvpKUNi5Q=
+github.com/luxfi/consensus v1.25.19/go.mod h1:dqywMwPfTweP5siGctYkeS1iNM1mdOKJ5Eq6lYH3dOQ=
 github.com/luxfi/constants v1.5.8 h1:iNP9AWNUcM4Tps7jYnx49CwtCWAC9mYRxJfGou2za0g=
 github.com/luxfi/constants v1.5.8/go.mod h1:Pu5jWHdnUtQRbWC43yTUjU/pbIIKMDOd2a2yroSfo48=
 github.com/luxfi/container v0.0.4 h1:BXhF82WyfqVP5mjlNcr7tP0Fcnvl0Ap1rkiu+rq5XuM=
 github.com/luxfi/container v0.0.4/go.mod h1:Z3SpmMF5d4t77MM0nHYXURpn+EMVaeu1fhbd/3BGaek=
-github.com/luxfi/corona v0.10.3 h1:Yi1oAkW0HEsf5fvst/tUN0AjRVg6DoNHB/IC0qrFWZE=
-github.com/luxfi/corona v0.10.3/go.mod h1:xe5qRir0p+FA6eETpyGDv4LjYySg1zVB13kmHpy9x94=
-github.com/luxfi/crypto v1.19.26 h1:+aHn/L479ak2ih7s/DkBZojjuhcyHBLqu3nYT81vcrU=
-github.com/luxfi/crypto v1.19.26/go.mod h1:0DCU62kX8+zhYU2qeM07A4pifJyPkPujnUOfgc8TOFQ=
+github.com/luxfi/corona v0.7.9 h1:NQe9V/80CdKLvbaVRE2uepxvxg9KHbWfcGRKWrzLSHc=
+github.com/luxfi/corona v0.7.9/go.mod h1:SfS7xo/k4uoteEYwYy+QCMPzTU8EIEbLnbWKx5ENVCw=
+github.com/luxfi/crypto v1.19.21 h1:x7s/Yy1BYMv5sbbWsZk+mUU007Z0HX/Ta4/RkrNHiw0=
+github.com/luxfi/crypto v1.19.21/go.mod h1:0tfz+EbAjsW1QBWB0cte9kdjB5XhhYFmCr8BkZRux48=
 github.com/luxfi/crypto/ipa v1.2.4 h1:6xfwhI9/HrcDkF3Ti5/NxsNQIWbwYDJmRSNIHRQ/xfU=
 github.com/luxfi/crypto/ipa v1.2.4/go.mod h1:43J6f6rcfUMrZt4cQectMOZb6Ps+fAEj8ZTPC3Kk+gE=
-github.com/luxfi/database v1.20.4 h1:WOt2GIGJxf8AFpg49odMz8DZ8RFSLDrozGhZtmorN70=
-github.com/luxfi/database v1.20.4/go.mod h1:S/LvmfzNYWVNslcEcZwDrntqUO2ksaL8ql1nRmLUA/Q=
-github.com/luxfi/dkg v0.3.5 h1:s2L2mMQaz+n9m0b0ghvoV5VZNxiwb2z4WrGugvK0udY=
-github.com/luxfi/dkg v0.3.5/go.mod h1:M+WH7GFRN+YUD851Rlnumdp0Md98kplNN8pVx65U8I8=
+github.com/luxfi/database v1.20.3 h1:fzBfd3bCGiUAlLAaMtMTB4aX78tNTSo4Z0kOA14LtAc=
+github.com/luxfi/database v1.20.3/go.mod h1:S/LvmfzNYWVNslcEcZwDrntqUO2ksaL8ql1nRmLUA/Q=
 github.com/luxfi/filesystem v0.0.1 h1:VZ6xMFKaAPBW/ddlMsDnI2G0VU1lV5rYaVcW5d+KwEY=
 github.com/luxfi/filesystem v0.0.1/go.mod h1:OQVSU6XNwqrr1AI+MqkID2taHUclx7NYmmr3svgttec=
 github.com/luxfi/formatting v1.0.1 h1:ZnE1rAdEUds9yAegdVdGDOBGN6hLMPOv6E03Fp8IEYo=
 github.com/luxfi/formatting v1.0.1/go.mod h1:mYzNf5DJOiqSSKUPzNj5dKy4tstFbN3pZlkI5716eKc=
-github.com/luxfi/genesis v1.13.16 h1:suwWPwUu2nv1fxvx9vwHgcgJCzkCpiVMxBrJIh4S3BQ=
-github.com/luxfi/genesis v1.13.16/go.mod h1:qUa+AcTWwxv0x+CJochBsRNOMbmEBjw07HJKZLhs5c0=
+github.com/luxfi/genesis v1.13.14 h1:CauxugSR1NP6Zhng+6BvBvXjTnbMwQrfGILg5a9LbR0=
+github.com/luxfi/genesis v1.13.14/go.mod h1:qUa+AcTWwxv0x+CJochBsRNOMbmEBjw07HJKZLhs5c0=
 github.com/luxfi/genesis/pkg/genesis/security v1.13.8 h1:9ier0p55ErSpoXHRJpZ04WV5HwwMB1uDrU7PHGBKG2U=
 github.com/luxfi/genesis/pkg/genesis/security v1.13.8/go.mod h1:DzU+GYUFv12ja4Vc46bWKNBBmNYbcow3u/DASx4wpfI=
 github.com/luxfi/geth v1.17.12 h1:UP/fhpcfbGPTrkOCwX3d88Oc3jVm5gTOgfjgq+lek6s=
@@ -348,14 +338,14 @@ github.com/luxfi/go-bip32 v1.0.2 h1:7vFbb+Wr4Z499q2tuCLdd7wWjtn8sH+HWBlx76mhH9Y=
 github.com/luxfi/go-bip32 v1.0.2/go.mod h1:bc7/LXDKAJQZ/F0Xjf5yXaTZxY9/ssLb4FC+Hxn/cDk=
 github.com/luxfi/go-bip39 v1.1.2 h1:p+wLMPGs6MLQh7q0YIsmy2EhHL7LHiELEGTJko6t/Jg=
 github.com/luxfi/go-bip39 v1.1.2/go.mod h1:96de9VkR2kY/ASAnhMtvt3TSh+PZkAFAngNj0GjRGDo=
-github.com/luxfi/ids v1.3.0 h1:11xnwRDm6zQzbqcRnkFujOYkvhK4Fs/+g+sKRlRUNsU=
-github.com/luxfi/ids v1.3.0/go.mod h1:6vpdcdZW0qxeade+3xby8aLTutbcJ7O0r8+fNQrksGI=
+github.com/luxfi/ids v1.2.15 h1:omE+E4+0Poj9DzM11ejSFgteaSQ3KDHi5g54iH6jcxI=
+github.com/luxfi/ids v1.2.15/go.mod h1:Fj73K5xcblvdE0SxU/ip+jE8VqNdu+80548su5KJ7xI=
 github.com/luxfi/keychain v1.0.2 h1:uQgmjs37/VBIALEiYrrszTpxvtqr07/YvS9TnmxGafs=
 github.com/luxfi/keychain v1.0.2/go.mod h1:q/4ULgZBlstKkwzOzG/0T6y73BDPgnkrcibbJyTvmbU=
-github.com/luxfi/keys v1.2.0 h1:3TAcr4twyMpwQp7J29ZRtIa5vzAoDrnXnLcPKVHJWmw=
+github.com/luxfi/keys v1.2.0 h1:+AriQNM7FOylAEls1XvFdlSOXDfoyc6X3ZfJRWQ2I9g=
 github.com/luxfi/keys v1.2.0/go.mod h1:SjsAaxo6sGmSp9OaHXUiVCqsknO8iPspN6jMOoEAMb8=
-github.com/luxfi/kms v1.11.7 h1:E25z8SCNTGOVvzzg5tj6pwJQ2K3FrE/nuy0KAfF+0zs=
-github.com/luxfi/kms v1.11.7/go.mod h1:XhLUVqN4RBv6j4Bj3MNgTZmHCnm74jH7RqqK0b9xbzw=
+github.com/luxfi/kms v1.11.4 h1:0CsYzASOxYS+fdYHg5jOKmlruTMuFCVDJLSIdXYyyc8=
+github.com/luxfi/kms v1.11.4/go.mod h1:Ku4LHH6J1oO9MaZDbn1e2fMnkRsN4QqV89DGwRFP/Ak=
 github.com/luxfi/lattice/v7 v7.1.4 h1:hQR02M6cHTAV5+joOPi9gb9Gm+z/hKJnhJF4IlciIJs=
 github.com/luxfi/lattice/v7 v7.1.4/go.mod h1:DmIQFi3mJiehVsR235l1NKYEU0JhU649OX5p7gMEW2c=
 github.com/luxfi/lens v0.1.4 h1:goGjGDXx2BNdjzXDunL5QT8elK2ZyCcc0z8TAbtWYrg=
@@ -374,38 +364,36 @@ github.com/luxfi/mdns v0.1.1 h1:g2eRr9AXcziPkkcd24M+Qu9ApEpoKKjfI79QSNqv0rQ=
 github.com/luxfi/mdns v0.1.1/go.mod h1:dbp5f3h3aE7CGzwbaWzBM9cwdcekhmSrWhQevgYhhNA=
 github.com/luxfi/metric v1.5.9 h1:UAgXMNZf5oN/XJwwuKorf8iMaCj3nyP6thHPCwkUwY4=
 github.com/luxfi/metric v1.5.9/go.mod h1:ux+w3RZQCfF1zM8MO0wAWyNj/CsDlPd2mwTGshB9vY0=
-github.com/luxfi/mlwe v0.2.1 h1:pRwTjNUUtzUxRIlMbUPpeh9DE2/NdqfS17hfdogazp4=
-github.com/luxfi/mlwe v0.2.1/go.mod h1:DD9EHTeiyh/y0KGGeqL+q9S4n8raeGiGdaG/BQPAvT0=
 github.com/luxfi/mock v0.1.1 h1:0HEtIjg1J6CWz+IUyP6rsGqNWTcmxjFnSQIhaDuARwY=
 github.com/luxfi/mock v0.1.1/go.mod h1:jo35akl3Vtd8LbzDts8VJ0jmSVycrd1/eBi6g6t5hKU=
 github.com/luxfi/net v0.0.5 h1:F1lD3NsIioV0wr2V5jWc4TtMyiE/Ffo1LoeblFv3TrI=
 github.com/luxfi/net v0.0.5/go.mod h1:BEQR1HEVmkjii/F1R6vJrNUVE7wr55b4eMq9Iz5wjUw=
 github.com/luxfi/p2p v1.21.1 h1:gmz1JMDhzHIL3dQlhwIDvR4OlFuhNVfnWUl/ipYhAIo=
 github.com/luxfi/p2p v1.21.1/go.mod h1:SsNPR5fPGWWNem9plGWhSmRqyDoysJ3kPAN0zG0g3iw=
-github.com/luxfi/pq v1.0.3 h1:ksw1dmfTR0dqqNMRS7BjGcprCO2Fhc+3Iiq2/NMuONw=
+github.com/luxfi/pq v1.0.3 h1:pFlQm1+5FuKTDUh2y/23bXWkN4I2Rc5iuxJypwDFFMs=
 github.com/luxfi/pq v1.0.3/go.mod h1:8bppZcRElfrVt0n3nYCZW3iX1TvhvzNbdjNdK1irgIE=
-github.com/luxfi/precompile v0.16.0 h1:lMdKapbApcbehtAc0mkRqkHFdTTITRTo3e3ivdI63RY=
-github.com/luxfi/precompile v0.16.0/go.mod h1:nIO7c4arFTqCl3nR0BoumPn1etYY32EYExJxqwu23VA=
+github.com/luxfi/precompile v0.5.56 h1:ISvjhA/BpKdlF6YuhnPxMSpDgj3T8RWbgbRLWTcWON8=
+github.com/luxfi/precompile v0.5.56/go.mod h1:x5bxubHVWlan7Fyiub8fEAPjYV22Oi6yDzpX1/Wqnxs=
 github.com/luxfi/proto v1.3.5 h1:AW11rnu5xyvB7beyowoiY9uIffLOF3+eMR/a3EkK2c8=
 github.com/luxfi/proto v1.3.5/go.mod h1:ixTofGpdW1rTYr+wgTuBhAsgBv8GnWYHMLWbPNEdm7M=
-github.com/luxfi/pulsar v1.9.0 h1:c0JnatYF79aN87aof9VlYjIoCzmixxrgNPeUUuh8ScU=
-github.com/luxfi/pulsar v1.9.0/go.mod h1:1+/atAiiiOm9RnXM3c66eHF3garjAa3C+sn4rAU7JUU=
+github.com/luxfi/pulsar v1.1.5 h1:v6z88L31ut5PbbFUQXzmoHoJZvXJgbM8+5ZoOk25So8=
+github.com/luxfi/pulsar v1.1.5/go.mod h1:GPm+Q9ZdX604GE687vkBQhWNA1FOBvRbhYwhbbfdi2w=
 github.com/luxfi/resource v0.0.1 h1:mTh+ICWSy548GTUSSyx7V/X5dV18oEwxZeQEYGJQhD4=
 github.com/luxfi/resource v0.0.1/go.mod h1:wWpZktciYwIi6RNqA+fHwzmPrUJa7PRX7urfwT+spRE=
 github.com/luxfi/rpc v1.1.0 h1:B/PJbK399th1mHRDSufhCpVbAciZqId3LsaWhIGNWH4=
 github.com/luxfi/rpc v1.1.0/go.mod h1:s0bI7/Wg1ZdFdG/cQK+4pZNdEmUsXNBA3HeZRZ+XLeM=
-github.com/luxfi/runtime v1.1.3 h1:6Yp/PKwQCohjXmBR9GA+gamdSAp+xA2rdN6J/74Y4aw=
-github.com/luxfi/runtime v1.1.3/go.mod h1:r1uonDnxRCnPz6N6WYwaC72HW95KbFIAyChnJyxePGs=
+github.com/luxfi/runtime v1.1.1 h1:vOMe82PL3bpSbslS7p69dKRpbr2qW2vOOAwej3UkkmU=
+github.com/luxfi/runtime v1.1.1/go.mod h1:fmG6+Zxj4wSNlXwiUfDthQDY+SfxVu6S0fX2lL6VbrE=
 github.com/luxfi/sampler v1.1.0 h1:u3iRDl7V06ARh0e85h3HT+aZ1saCFo2yMMsh+dCJbqk=
 github.com/luxfi/sampler v1.1.0/go.mod h1:kJa53S3tC9+VSbuV3RFu68MmbCCBlr2UM39LOClQ/Hs=
-github.com/luxfi/sdk v1.17.9 h1:MfExzWNym7IicO2egiHg6N0WnImLtAUpjCpiD/zc2ZE=
+github.com/luxfi/sdk v1.17.9 h1:a+95GjAtiY1bYsRYE2SmKhYzG4vcMWhXDq/uAXJlBO4=
 github.com/luxfi/sdk v1.17.9/go.mod h1:XvZuopyltjR4SvHvA1c6wtNcnO+FzLyjfm0v+FyN9sI=
-github.com/luxfi/staking v1.5.1 h1:f9MaGnRm0xc02crDm5Qs1T2r88d3KzNkHZypAvsmAlU=
-github.com/luxfi/staking v1.5.1/go.mod h1:lT7KLaiTpdq3lg78H0gp2qSEfX9LaK1vs7w73XV/9nw=
+github.com/luxfi/staking v1.5.0 h1:Y8cbkG9SHJLiNPXVmz2ZFJzroMRgeAFJyH9yxPs53/w=
+github.com/luxfi/staking v1.5.0/go.mod h1:OULMrYj4FYPCH7fxKOIJLNuzg5QhrSZfVyPWdGpnxG8=
 github.com/luxfi/sys v0.1.0 h1:M7RYOt8W4Wws7cxxsyOHe50UKMYTzIu7HYknqW4xt0Y=
 github.com/luxfi/sys v0.1.0/go.mod h1:GT8vGdYTfoqRy9/11blmRuqPPypzwrudCTHZXT+ru9M=
-github.com/luxfi/threshold v1.12.0 h1:JJ369xC/YyDvrqXj+xFoK98nP2rUM099qFs03hBvq/M=
-github.com/luxfi/threshold v1.12.0/go.mod h1:iuRQGDAy8ZKjQhZjkSKg7NtbP75/8Up9zj52y7IuyZo=
+github.com/luxfi/threshold v1.9.9 h1:zsEuMASTbyiLi7DkbjXBw3hsKIcqvpQt3Xu/MpZA5RQ=
+github.com/luxfi/threshold v1.9.9/go.mod h1:8zO1a2f3UMMsM1TkOVUoUbCR9h1sPhWH/ibblf13+h4=
 github.com/luxfi/timer v1.0.2 h1:g/odi0VQJIsrzdklJUG1thHZ/sGNnbIiVGcU6LctJm0=
 github.com/luxfi/timer v1.0.2/go.mod h1:SoaZwntYigUE3H6z1GV32YwP8QaSiAT0UiEv7iPugXg=
 github.com/luxfi/tls v1.0.3 h1:rK3nxSAxrUOOSHOZnKChwV4f6UJ+cfOl8KWJXAQx/SI=
@@ -426,10 +414,10 @@ github.com/luxfi/version v1.0.1 h1:T/1KYWEMmsrNQk7pN7PFPAwh/7XbeX7cFAKLBqI37Sk=
 github.com/luxfi/version v1.0.1/go.mod h1:Y5fPkQ2DB0XRBCxgSPXp4ISzL1/jptKnmFknShRJCyg=
 github.com/luxfi/vm v1.2.5 h1:L1etY/gh68f9tns1BtyDUpZcBVqc3Ng1mqU3n38GyLo=
 github.com/luxfi/vm v1.2.5/go.mod h1:TCCg4lDcQFCjxaxfXnxPIrpRSVAyyf2ucT4A4w654Hg=
-github.com/luxfi/warp v1.24.0 h1:jrcJNlbOiZsAEopJMy9bSaCwI5NDZ8qgp/6sNoXqepg=
-github.com/luxfi/warp v1.24.0/go.mod h1:bKvTi24JHlANsl7qkWZAVr/DsMfvwy42f+Cc9x4+Sq8=
-github.com/luxfi/zap v0.8.11 h1:jT+ol9rj557MRdmnzxrVUCR3CDFaE+8OpzUsLIn92og=
-github.com/luxfi/zap v0.8.11/go.mod h1:JfqII8VtVQYLLTX6obU1DP9sjGqf9L24vfug5ifh0b8=
+github.com/luxfi/warp v1.19.5 h1:vigIDV4JxLz8bLxQ97dOIcZVM9FAXHmrKdmIh+/WWvk=
+github.com/luxfi/warp v1.19.5/go.mod h1:t5upY5vhKvjapImmUsgPUlW8C8LZhvQpQg5WzAitQs0=
+github.com/luxfi/zap v0.7.2 h1:YecWTWNE5PPJXL56sLIkzS8b23bprUwZ5lPAQuLUtTE=
+github.com/luxfi/zap v0.7.2/go.mod h1:1k+nwT+JW802YzuPAuf7CxMSGr/qxvbGgGwi5k6X9Ok=
 github.com/luxfi/zapcodec v1.0.1 h1:pRxLxCOi6uihQMg8A8riDjNjefU2cXZxfRVZ+obeuL8=
 github.com/luxfi/zapcodec v1.0.1/go.mod h1:txrRt2JK4O76ssTxlXIwoNVsgzyZVL0ES4mlXqGNogs=
 github.com/luxfi/zapdb v1.10.1 h1:XV3k4UTTKKxUMgbfC7woPXgUEIJd3P5nj2lGTQ88xeE=
@@ -522,8 +510,6 @@ github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTU
 github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw=
 github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc=
 github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo=
-github.com/quic-go/quic-go v0.59.1 h1:0Gmua0HW1Tv7ANR7hUYwRyD0MG5OJfgvYSZasGZzBic=
-github.com/quic-go/quic-go v0.59.1/go.mod h1:upnsH4Ju1YkqpLXC305eW3yDZ4NfnNbmQRCMWS58IKU=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
@@ -584,12 +570,10 @@ github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
 github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
 github.com/tinylib/msgp v1.6.4 h1:mOwYbyYDLPj35mkA2BjjYejgJk9BuHxDdvRnb6v2ZcQ=
 github.com/tinylib/msgp v1.6.4/go.mod h1:RSp0LW9oSxFut3KzESt5Voq4GVWyS+PSulT77roAqEA=
-github.com/tj/assert v0.0.3 h1:Df/BlaZ20mq6kuai7f5z2TvPFiwC3xaWJSDQNiIS3Rk=
-github.com/tj/assert v0.0.3/go.mod h1:Ne6X72Q+TB1AteidzQncjw9PabbMp4PBMZ1k+vd1Pvk=
-github.com/tklauser/go-sysconf v0.4.0 h1:7H0uAN+7RkwWRaxhYXDLqa5V3LPrJeV8wmD9dRUgPQU=
-github.com/tklauser/go-sysconf v0.4.0/go.mod h1:8mTNWyog7H+MpKijp4VmKJAd2bbYQ2zuUwkYRbUArPI=
-github.com/tklauser/numcpus v0.12.0 h1:NR85qdvHA9pFse3x3weVZ0r0ST8R6l5RHbZrlRaqob4=
-github.com/tklauser/numcpus v0.12.0/go.mod h1:ABHeXzJnr/qqwguhClkZKT1/8VABcYrsyUiUGobwWJg=
+github.com/tklauser/go-sysconf v0.3.16 h1:frioLaCQSsF5Cy1jgRBrzr6t502KIIwQ0MArYICU0nA=
+github.com/tklauser/go-sysconf v0.3.16/go.mod h1:/qNL9xxDhc7tx3HSRsLWNnuzbVfh3e7gh/BmM179nYI=
+github.com/tklauser/numcpus v0.11.0 h1:nSTwhKH5e1dMNsCdVBukSZrURJRoHbSEQjdEbY+9RXw=
+github.com/tklauser/numcpus v0.11.0/go.mod h1:z+LwcLq54uWZTX0u/bGobaV34u6V7KNlTZejzM6/3MQ=
 github.com/urfave/cli/v2 v2.27.7 h1:bH59vdhbjLv3LAvIu6gd0usJHgoTTPhCFib8qqOwXYU=
 github.com/urfave/cli/v2 v2.27.7/go.mod h1:CyNAG/xg+iAOg0N4MPGZqVmv2rCoP267496AOXUZjA4=
 github.com/wlynxg/anet v0.0.5 h1:J3VJGi1gvo0JwZ/P1/Yc/8p63SoW98B5dHkYDmpgvvU=
@@ -603,16 +587,14 @@ github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9dec
 github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
 github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
-github.com/zap-proto/http v0.0.0-20260506200741-fd6047874433 h1:7WsCr/pZvWozimdYNffL3B9K6gLr8w0Z7WAi1+eZWtc=
-github.com/zap-proto/http v0.0.0-20260506200741-fd6047874433/go.mod h1:xySyVTIwjknmVE+p+6rukkX86rFZtXeAu/QY7KXMYqw=
 github.com/zeebo/assert v1.3.0 h1:g7C04CbJuIDKNPFHmsk4hwZDO5O+kntRxzaUoNXj+IQ=
 github.com/zeebo/assert v1.3.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
 github.com/zeebo/blake3 v0.2.4 h1:KYQPkhpRtcqh0ssGYcKLG1JYvddkEA8QwCM/yBqhaZI=
 github.com/zeebo/blake3 v0.2.4/go.mod h1:7eeQ6d2iXWRGF6npfaxl2CU+xy2Fjo2gxeyZGCRUjcE=
 github.com/zeebo/pcg v1.0.1 h1:lyqfGeWiv4ahac6ttHs+I5hwtH/+1mrhlCtVNQM2kHo=
 github.com/zeebo/pcg v1.0.1/go.mod h1:09F0S9iiKrwn9rlI5yjLkmrug154/YRW6KnnXVDM/l4=
-go.mongodb.org/mongo-driver v1.17.9 h1:IexDdCuuNJ3BHrELgBlyaH9p60JXAvdzWR128q+U5tU=
-go.mongodb.org/mongo-driver v1.17.9/go.mod h1:LlOhpH5NUEfhxcAwG0UEkMqwYcc4JU18gtCdGudk/tQ=
+go.mongodb.org/mongo-driver v1.17.4 h1:jUorfmVzljjr0FLzYQsGP8cgN/qzzxlY9Vh0C9KFXVw=
+go.mongodb.org/mongo-driver v1.17.4/go.mod h1:Hy04i7O2kC4RS06ZrhPRqj/u4DTYkFDAAccj+rVKqgQ=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
 go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=

hanzo.yml

@@ -1,39 +0,0 @@
-# Platform-native CI/CD — luxfi/node (the GitHub-Actions escape)
-#
-# Build is owned by platform.hanzo.ai (NOT GitHub Actions). On a tag push,
-# platform reads this file, schedules ONE build job per matrix entry onto the
-# self-hosted arcd long-poll fabric, and an arcd runner on the `lux-build-*`
-# pool builds + pushes the image to GHCR. There is NO GitHub-Actions build hop:
-# the legacy .github/workflows/docker.yml is retired (see RELEASE.md §retire).
-#
-# This ONE Dockerfile build produces BOTH lux release artifacts:
-#   1. the node image  -> ghcr.io/luxfi/node:<tag>   (luxd + all 12 VM plugins
-#      baked at /luxd/build/plugins/)
-#   2. the plugin SET  -> s3://lux-plugins-<env>/<pluginset>/  (published in a
-#      second, decoupled step from the image's baked plugins — see
-#      scripts/publish_plugin_set.sh; consumed by the operator plugin-fetch
-#      init container via the LuxNetwork CR pluginSource).
-#
-# Schema reference: ~/work/hanzo/platform/docs/PLATFORM_CI.md.
-# Release runbook (the ONE canonical way): ./RELEASE.md.
-#
-# Pool resolution: <org>-build-<os>-<arch>. org=luxfi -> brand=lux, so this
-# repo's pools are `lux-build-linux-amd64` and `lux-build-linux-arm64`. These
-# MUST match the live arcd scale-set names exactly.
-#
-# Tagging: a release is a `v*` git-tag push. The webhook decoder maps the tag
-# ref to `branch=<tagname>`, so `tag-pattern: "{{git.branch}}"` yields the
-# image tag `vX.Y.Z` (immutable, semver-only — no :latest, no floating tags).
-build:
-  matrix:
-    - { os: linux, arch: amd64 }
-    - { os: linux, arch: arm64 }
-  dockerfile: ./Dockerfile
-  context: .
-  image: ghcr.io/luxfi/node
-  tag-pattern: "{{git.branch}}"
-  push: true
-  dispatch: native
-# No `deploy:` block. luxd rollout is owned by the lux operator (LuxNetwork CR,
-# ~/work/lux/operator) which the hanzo operator Service-CR rollout does not
-# model. Deploy is a separate, operator-driven step (RELEASE.md §deploy).

message/ops.go

@@ -8,7 +8,6 @@ import (
 	"errors"
 	"fmt"
 
-	"github.com/luxfi/consensus/core/router"
 	"github.com/luxfi/math/set"
 	"github.com/luxfi/node/proto/p2p"
 )
@@ -247,40 +246,32 @@ func Unwrap(m *p2p.Message) (fmt.Stringer, error) {
 	}
 }
 
-// ToConsensusOp maps a wire message Op to the consensus router op the chain
-// router (node/chain_router.go) dispatches on, returning false for ops that are
-// not consensus-routed (the router drops those as "unhandled message op"). The
-// returned values ARE the router constants, so they cannot drift in value; the
-// mapping must also stay a bijection onto the router op space [0, router.NumOps)
-// — proven by message/ops_test.go. A missing case silently drops that op: that
-// is the α-of-K finality wedge, where GossipOp had no case and every vote
-// vanished before reaching blockHandler.Gossip -> engine.HandleIncomingVote.
+// ToConsensusOp maps message.Op to consensus router Op values
+// Returns the consensus Op value and whether the mapping exists
 func ToConsensusOp(op Op) (byte, bool) {
 	switch op {
 	case GetAcceptedFrontierOp:
-		return byte(router.GetAcceptedFrontier), true
+		return 0, true // GetAcceptedFrontier
 	case AcceptedFrontierOp:
-		return byte(router.AcceptedFrontier), true
+		return 1, true // AcceptedFrontier
 	case GetAcceptedOp:
-		return byte(router.GetAccepted), true
+		return 2, true // GetAccepted
 	case AcceptedOp:
-		return byte(router.Accepted), true
+		return 3, true // Accepted
 	case GetOp:
-		return byte(router.Get), true
+		return 4, true // Get
 	case PutOp:
-		return byte(router.Put), true
+		return 5, true // Put
 	case PushQueryOp:
-		return byte(router.PushQuery), true
+		return 6, true // PushQuery
 	case PullQueryOp:
-		return byte(router.PullQuery), true
+		return 7, true // PullQuery
 	case QbitOp:
-		return byte(router.Vote), true // votes ride the Qbit wire op
+		return 8, true // Qbit
 	case GetAncestorsOp:
-		return byte(router.GetContext), true // wire op is still GetAncestors
+		return 9, true // GetContext (wire protocol still uses GetAncestors)
 	case AncestorsOp:
-		return byte(router.Context), true // wire op is still Ancestors
-	case GossipOp:
-		return byte(router.Gossip), true // α-of-K vote/cert transport
+		return 10, true // Context (wire protocol still uses Ancestors)
 	default:
 		return 0, false
 	}

message/ops_test.go

@@ -1,115 +0,0 @@
-// Copyright (C) 2019-2025, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package message
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/luxfi/consensus/core/router"
-	"github.com/luxfi/ids"
-)
-
-// TestToConsensusOp_TableAlignedWithRouter is the systemic guard for the
-// finality-wedge bug CLASS, not just the one Gossip instance. The chain router
-// (node/chain_router.go) forwards an inbound message only if ToConsensusOp maps
-// it, then dispatches on handler.Op(value). The node op table and the consensus
-// router op enum are therefore two halves of ONE routing contract: if they
-// diverge, every message for the divergent op is silently dropped. That is what
-// wedged α-of-K finality — router.Gossip existed but no node op mapped to it, so
-// every broadcast vote vanished before reaching blockHandler.Gossip ->
-// engine.HandleIncomingVote (blocks rode PutOp and verified; votes rode the
-// unmapped GossipOp and disappeared; the cert never reached alpha).
-//
-// The test proves ToConsensusOp is a BIJECTION onto the router op space
-// [0, router.NumOps), so divergence is un-shippable:
-//   - exhaustive/surjective: every router op has exactly one node-op preimage,
-//     so a router op added without a node mapping (the original bug) -> RED.
-//   - injective/well-typed: no two node ops collide onto one router op and
-//     nothing maps outside the op space -> RED.
-//
-// router.NumOps is the single source of truth for the op count, so a future op
-// added to one table but not the other fails HERE, not at runtime.
-func TestToConsensusOp_TableAlignedWithRouter(t *testing.T) {
-	require := require.New(t)
-
-	// want: the authoritative router-op <-> node-op correspondence.
-	want := map[router.Op]Op{
-		router.GetAcceptedFrontier: GetAcceptedFrontierOp,
-		router.AcceptedFrontier:    AcceptedFrontierOp,
-		router.GetAccepted:         GetAcceptedOp,
-		router.Accepted:            AcceptedOp,
-		router.Get:                 GetOp,
-		router.Put:                 PutOp,
-		router.PushQuery:           PushQueryOp,
-		router.PullQuery:           PullQueryOp,
-		router.Vote:                QbitOp,         // votes ride the Qbit wire op
-		router.GetContext:          GetAncestorsOp, // wire op is still GetAncestors
-		router.Context:             AncestorsOp,    // wire op is still Ancestors
-		router.Gossip:              GossipOp,       // α-of-K vote/cert transport
-	}
-
-	// EXHAUSTIVE: the table must name every router op exactly once. Pinned to
-	// router.NumOps, so a new router op with no entry here fails immediately.
-	require.Len(want, int(router.NumOps),
-		"node op table names %d ops but the router defines router.NumOps=%d — a "+
-			"router op with no node mapping is dropped by the chain router and "+
-			"finality wedges; add it to want and to ToConsensusOp",
-		len(want), int(router.NumOps))
-
-	// BIJECTION: rebuild the actual inverse mapping by sweeping the whole node op
-	// space (Op is a byte, so [0,256)) and require it to equal want. This one
-	// comparison catches a missing mapping (router op absent from got), a wrong
-	// target (got[r] != want[r]) and a stray mapping into the op space; the dup
-	// guard catches a collision masked by the later write winning the slot.
-	got := make(map[router.Op]Op, int(router.NumOps))
-	for i := 0; i < 256; i++ {
-		nodeOp := Op(i)
-		v, ok := ToConsensusOp(nodeOp)
-		if !ok {
-			continue
-		}
-		require.Less(int(v), int(router.NumOps),
-			"%s maps to router op %d outside [0, NumOps=%d)", nodeOp, v, int(router.NumOps))
-		routerOp := router.Op(v)
-		_, dup := got[routerOp]
-		require.False(dup,
-			"router op %d is mapped from two node ops (%s and %s) — ambiguous routing",
-			v, got[routerOp], nodeOp)
-		got[routerOp] = nodeOp
-	}
-	require.Equal(want, got,
-		"node op table diverged from the router op space: every router op "+
-			"[0, NumOps) must have exactly one node-op preimage and each node op must "+
-			"map to its assigned router op. A divergence here is the finality-wedge "+
-			"bug class — an op routed in one table and dropped in the other.")
-}
-
-// TestInboundGossip_DeliveredNotDropped reproduces the chain router's inbound
-// extraction for a quorum vote envelope (the exact steps node/chain_router.go
-// performs before dispatch) and asserts the vote SURVIVES routing: the op maps
-// to router.Gossip AND the envelope bytes are recovered intact as the container.
-// This is the seam the finality wedge lived in — a vote that the router dropped
-// here never reached the engine. The bytes that come out here are what
-// blockHandler.Gossip demuxes into engine.HandleIncomingVote.
-func TestInboundGossip_DeliveredNotDropped(t *testing.T) {
-	require := require.New(t)
-
-	chainID := ids.GenerateTestID()
-	nodeID := ids.GenerateTestNodeID()
-	// Stand-in for an encodeQuorumGossip envelope: magic + kind + blockID + vote.
-	envelope := []byte("LXQ\x01" + "<signed-vote-payload>")
-
-	inbound := InboundGossip(chainID, envelope, nodeID)
-
-	// 1) The router maps the op (else "unhandled message op" -> dropped).
-	consensusOp, ok := ToConsensusOp(inbound.Op())
-	require.True(ok, "inbound vote gossip must route to a consensus op")
-	require.Equal(byte(router.Gossip), consensusOp)
-
-	// 2) The router recovers the envelope as the handler container bytes.
-	got := GetContainerBytes(inbound.Message())
-	require.Equal(envelope, got, "the quorum envelope must survive router extraction intact")
-}

network/config.go

@@ -217,15 +217,11 @@ type Config struct {
 
 	// SecurityProfile is the chain-wide ChainSecurityProfile this node is
 	// operating under (resolved at boot from the genesis pin in
-	// node.Node.initSecurityProfile). When it mandates the application-layer
-	// PQ handshake (strict-PQ / FIPS — see profileRequiresPQHandshake), the
-	// network builds a peer.SchemeGate from it AND runs the ML-KEM + ML-DSA
-	// handshake; the gate and handshake are gated by one identical
-	// predicate so an ML-DSA identity always exists for the gate to bind.
-	// A nil profile, or a non-PQ-handshake profile (permissive), leaves the
-	// cross-axis gate disabled: peers present classical secp256k1 cert
-	// schemes the gate would refuse unconditionally, so building it there
-	// would refuse every connection with no PQ handshake to recover. Such
-	// chains remain accepted by the upgrader's nil-safe path.
+	// node.Node.initSecurityProfile). When non-nil, the network upgrader
+	// builds a peer.SchemeGate from it and refuses any inbound or
+	// outbound TLS connection whose wire NodeIDScheme is not admissible
+	// under the profile. nil leaves the cross-axis gate disabled (chains
+	// that ship no profile remain accepted by the upgrader's nil-safe
+	// path).
 	SecurityProfile *consensusconfig.ChainSecurityProfile `json:"-"`
 }

network/network.go

@@ -487,26 +487,11 @@ func NewNetwork(
 
 	// Build the per-chain peer.SchemeGate exactly once at network bootstrap.
 	// The gate is the single cross-axis primitive that funnels every
-	// inbound NodeID through the chain's ChainSecurityProfile pin.
-	//
-	// The gate is built under the SAME predicate that builds the PQ
-	// handshake (profileRequiresPQHandshake), not merely "SecurityProfile
-	// != nil". This is load-bearing: the gate's pinned scheme byte
-	// (SigSchemeMLDSA65) only becomes presentable by a peer once the
-	// application-layer PQ handshake establishes the ML-DSA identity. A
-	// profile that does NOT run the PQ handshake (permissive /
-	// classical-compat) still presents classical secp256k1 cert schemes,
-	// which SchemeGate.Classify refuses unconditionally — its
-	// AcceptsValidatorScheme(_, classicalCompatUnsafe=false) hardcodes the
-	// classical escape hatch off. Building a gate in that state refuses
-	// every peer at the upgrade with no PQ handshake to recover, the exact
-	// "TLS upgrade failed" / 0-peers stall a permissive-pinned classical
-	// network hits. One axis, one predicate: gate + handshake + ML-DSA
-	// identity are built together or not at all. Chains that ship no
-	// profile, or a non-PQ-handshake profile, leave the gate nil —
-	// upgrader.connToIDAndCert is nil-safe and refuses nobody.
+	// inbound NodeID through the chain's ChainSecurityProfile pin. Chains
+	// that ship no profile (legacy / classical-compat networks) leave the
+	// gate nil — upgrader.connToIDAndCert is nil-safe and refuses nobody.
 	var schemeGate *peer.SchemeGate
-	if profileRequiresPQHandshake(config.SecurityProfile) {
+	if config.SecurityProfile != nil {
 		schemeGate, err = peer.NewSchemeGate(config.SecurityProfile, 0)
 		if err != nil {
 			return nil, fmt.Errorf("building peer SchemeGate: %w", err)
@@ -521,10 +506,8 @@ func NewNetwork(
 	// config onto every peer goroutine. peer.Start runs the ML-KEM +
 	// ML-DSA handshake the moment TLS upgrade succeeds; bare TLS is
 	// refused. Permissive / classical-compat profiles leave PQHandshake
-	// nil and use the legacy bare-TLS path. Same predicate as the
-	// SchemeGate build above — profileRequiresPQHandshake is nil-safe, so
-	// the gate and the handshake are guarded by one identical condition.
-	if profileRequiresPQHandshake(config.SecurityProfile) {
+	// nil and use the legacy bare-TLS path.
+	if config.SecurityProfile != nil && profileRequiresPQHandshake(config.SecurityProfile) {
 		// The PQ peer handshake MUST sign with the node's PERSISTENT
 		// staking ML-DSA-65 keypair — the one whose public half derives
 		// MyNodeID — so that completing the handshake proves possession of

node/node.go

@@ -86,6 +86,7 @@ import (
 	platformconfig "github.com/luxfi/node/vms/platformvm/config"
 
 	gpuconfig "github.com/luxfi/node/config"
+	"github.com/luxfi/node/consensus/quasar"
 )
 
 const (
@@ -328,6 +329,11 @@ func New(
 		return nil, fmt.Errorf("couldn't initialize chains: %w", err)
 	}
 
+	// Initialize Quasar hybrid finality engine if Q-Chain is in genesis
+	if err := n.initQuasar(); err != nil {
+		n.Log.Warn("quasar init skipped", "error", err)
+	}
+
 	return n, nil
 }
 
@@ -448,6 +454,9 @@ type Node struct {
 	// Manages shutdown of a VM process
 	runtimeManager runtime.Manager
 
+	// Quasar hybrid finality engine — binds P-Chain BLS + Q-Chain Corona
+	Quasar *quasar.Quasar
+
 	resourceManager resource.Manager
 
 	// Tracks the CPU/disk usage caused by processing
@@ -578,14 +587,6 @@ func (n *Node) initNetworking(reg metric.Registerer) error {
 	if !ok {
 		return errInvalidTLSKey
 	}
-	// Publish the staking TLS private key as the node's block signer. The chain
-	// manager passes this to proposervm as StakingLeafSigner so the elected
-	// proposer can SIGN post-fork blocks (block.Build → key.Sign). It was
-	// declared but never assigned, so proposervm received a nil signer and
-	// panicked (nil pointer in key.Sign) the moment it built the first signed
-	// post-fork block — mirrors avalanchego setting StakingTLSSigner from the
-	// cert's private key.
-	n.StakingTLSSigner = tlsKey
 
 	if n.Config.NetworkConfig.TLSKeyLogFile != "" {
 		n.tlsKeyLogWriterCloser, err = perms.Create(n.Config.NetworkConfig.TLSKeyLogFile, perms.ReadWrite)
@@ -2149,6 +2150,9 @@ func (n *Node) shutdown() {
 		time.Sleep(n.Config.ShutdownWait)
 	}
 
+	if n.Quasar != nil {
+		n.Quasar.Stop()
+	}
 	if n.resourceManager != nil {
 		n.resourceManager.Shutdown()
 	}

node/quasar.go

@@ -0,0 +1,117 @@
+// Copyright (C) 2019-2025, Lux Industries Inc. All rights reserved.
+// See the file LICENSE for licensing terms.
+
+package node
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/luxfi/constants"
+	"github.com/luxfi/crypto/bls"
+	"github.com/luxfi/ids"
+	"github.com/luxfi/node/consensus/quasar"
+	"github.com/luxfi/node/genesis/builder"
+	nodevalidators "github.com/luxfi/validators"
+)
+
+// initQuasar creates and starts the Quasar hybrid finality engine.
+// Quasar binds P-Chain BLS finality with Q-Chain Corona threshold
+// signatures for post-quantum secure block finality.
+//
+// Requires Q-Chain to be present in genesis. If absent, returns an error
+// and the caller logs a warning — the node operates without hybrid finality.
+func (n *Node) initQuasar() error {
+	createQVMTx, err := builder.VMGenesis(n.Config.GenesisBytes, constants.QuantumVMID)
+	if err != nil {
+		return fmt.Errorf("Q-Chain not in genesis: %w", err)
+	}
+	qChainID := createQVMTx.ID()
+
+	// BLS quorum: 2/3 validator weight required
+	// Corona threshold: 2 (minimum for threshold signing)
+	q, err := quasar.NewQuasar(n.Log, 2, 2, 3)
+	if err != nil {
+		return fmt.Errorf("quasar create: %w", err)
+	}
+
+	// Wire P-Chain provider — delivers validator state from PlatformVM's
+	// validator manager (n.vdrs is populated by initValidatorSets() from
+	// genesis + on-chain stakers). Finality events are emitted by
+	// PChainAcceptedSubscriber once block acceptance is wired; for now the
+	// channel exists but is not driven from outside (Run loop blocks on it).
+	provider := &pChainProvider{
+		nodeID: n.ID,
+		vdrs:   n.vdrs,
+		finCh:  make(chan quasar.FinalityEvent, 64),
+	}
+	q.ConnectPChain(provider)
+
+	// Wire quantum fallback signer using the node's BLS key.
+	// Satisfies the Start() precondition (quantumFallback != nil).
+	// Corona threshold signing supersedes this once initialized.
+	q.ConnectQuantumFallback(&blsQuantumFallback{
+		signer: n.Config.StakingSigningKey,
+	})
+
+	if err := q.Start(context.Background()); err != nil {
+		return fmt.Errorf("quasar start: %w", err)
+	}
+
+	n.Quasar = q
+	n.Log.Info("quasar hybrid finality engine started",
+		"qChainID", qChainID,
+		"quorum", "2/3",
+		"threshold", 2,
+	)
+	return nil
+}
+
+// pChainProvider adapts the node's PlatformVM-backed validator manager to
+// quasar.PChainProvider. GetValidators reads the live primary-network set
+// (BLS pubkey + light/weight) so Quasar's t-of-n threshold tracks the real
+// staker set as it changes. Finality events are pushed via finCh by the
+// block-acceptance bridge (wired separately).
+type pChainProvider struct {
+	nodeID ids.NodeID
+	vdrs   nodevalidators.Manager
+	finCh  chan quasar.FinalityEvent
+}
+
+func (p *pChainProvider) GetFinalizedHeight() uint64 { return 0 }
+
+func (p *pChainProvider) GetValidators(_ uint64) ([]quasar.ValidatorState, error) {
+	if p.vdrs == nil {
+		return nil, fmt.Errorf("validator manager not initialized")
+	}
+	vmap := p.vdrs.GetMap(constants.PrimaryNetworkID)
+	out := make([]quasar.ValidatorState, 0, len(vmap))
+	for nodeID, v := range vmap {
+		// PublicKey is already serialized BLS bytes from validators.GetValidatorOutput.
+		out = append(out, quasar.ValidatorState{
+			NodeID:    nodeID,
+			Weight:    v.Weight,
+			BLSPubKey: v.PublicKey,
+			Active:    true,
+		})
+	}
+	return out, nil
+}
+
+func (p *pChainProvider) SubscribeFinality() <-chan quasar.FinalityEvent {
+	return p.finCh
+}
+
+// blsQuantumFallback wraps the node's BLS signer to satisfy
+// quasar.QuantumSignerFallback.
+type blsQuantumFallback struct {
+	signer bls.Signer
+}
+
+func (f *blsQuantumFallback) SignMessage(msg []byte) ([]byte, error) {
+	sig, err := f.signer.Sign(msg)
+	if err != nil {
+		return nil, fmt.Errorf("BLS sign: %w", err)
+	}
+	return bls.SignatureToBytes(sig), nil
+}

node/vms_purity_test.go

@@ -46,7 +46,7 @@ func countContaining(deps []string, needle string) int {
 //
 // The four core VMs are deliberately NOT asserted here: P(platformvm) and
 // X(xvm) are foundational primary-network VMs, and Q(quantumvm)/Z(zkvm) stay
-// in-process for now (Q is the post-quantum chain and is critical by default).
+// in-process for now (Q backs Quasar hybrid finality + is critical by default).
 // Turning Q/Z into plugins is a separate design-first phase.
 func TestOptionalVMsNotLinkedInProcess(t *testing.T) {
 	optionalVMs := []string{

node/vms_registry_test.go

@@ -228,21 +228,6 @@ func TestOptionalVMsBuiltIntoPluginDir(t *testing.T) {
 		cmd := exec.Command("go", "build", "-o", artifact, pkg)
 		cmd.Env = append(os.Environ(), "CGO_ENABLED=0")
 		if out, err := cmd.CombinedOutput(); err != nil {
-			// resolvePackageDir can return ok for a package present in the module
-			// cache that is nonetheless un-buildable in a node-only checkout (no
-			// go.sum entry for a transitive dep, GOFLAGS=-mod=mod absent). That is a
-			// workspace-integration gap, not a code regression — degrade to a skip so
-			// `GOWORK=off` verification doesn't red the suite. CI builds these via the
-			// Dockerfile Chain VM Plugin Stage + the workspace go.work. A genuine
-			// compile error (syntax/type) does NOT match these markers and still fails.
-			msg := string(out)
-			if strings.Contains(msg, "missing go.sum entry") ||
-				strings.Contains(msg, "updates to go.sum needed") ||
-				strings.Contains(msg, "no required module provides package") ||
-				strings.Contains(msg, "cannot find module providing package") {
-				t.Skipf("INTEGRATION-GAP: %s present but not buildable in this checkout "+
-					"(workspace go.work supplies its deps): %v", pkg, err)
-			}
 			t.Fatalf("building %s (%s) failed: %v\n%s", spec.Name, pkg, err, out)
 		}
 		info, err := os.Stat(artifact)

scripts/publish_plugin_set.sh

@@ -1,138 +0,0 @@
-#!/usr/bin/env bash
-#
-# publish_plugin_set.sh — publish the VM plugin SET to S3 from a node image.
-#
-# The ONE canonical way to produce lux release artifact #2 (the plugin set the
-# operator's plugin-fetch init container downloads per the LuxNetwork CR
-# pluginSource). It is decoupled from, and DRY with, artifact #1 (the node
-# image): the plugins are ALREADY built + baked into the image by the single
-# Dockerfile multi-stage build, so this step EXTRACTS them — it never compiles
-# them a second time. One source of truth, two distribution surfaces.
-#
-# NO GitHub. Runs on any fleet host or DOKS Job that has `crane` (or docker) +
-# the MinIO client `mc`. Typically invoked by the same arcd runner that just
-# built + pushed the image (it has the image locally), or on demand from a
-# fleet host against the published image.
-#
-# Usage:
-#   publish_plugin_set.sh <image-ref> <s3-dest> [mc-alias]
-#
-#   <image-ref>   Fully-qualified node image, e.g. ghcr.io/luxfi/node:v1.30.41
-#                 (digest-pinned forms are accepted and preferred for releases).
-#   <s3-dest>     Bucket/prefix WITHOUT scheme, e.g.
-#                 lux-plugins-testnet/v1.3.5  (matches the LuxNetwork CR
-#                 pluginSource.bucket = s3://lux-plugins-testnet/v1.3.5/).
-#   [mc-alias]    Configured `mc` alias for the target MinIO/S3 (default: lux).
-#                 Configure once: `mc alias set lux <endpoint> <key> <secret>`.
-#
-# The plugin set is the 12 VM-ID files under /luxd/build/plugins/ in the image.
-# A SHA256SUMS manifest (objectKey<two-spaces>sha256, one per line) is generated
-# and uploaded alongside — the operator plugin-fetch init container verifies
-# each plugin's sha256 against the CR (fail-closed on mismatch), so the manifest
-# is also the source for the CR's pluginSource.vmPlugins[].sha256 fields.
-#
-# Idempotent: re-running with the same image + dest re-uploads byte-identical
-# objects. A pluginset version is immutable by convention — bump <s3-dest> for a
-# new release, never overwrite a published prefix that a live network points at.
-
-set -euo pipefail
-
-IMAGE_REF="${1:-}"
-S3_DEST="${2:-}"
-MC_ALIAS="${3:-lux}"
-
-if [[ -z "${IMAGE_REF}" || -z "${S3_DEST}" ]]; then
-  echo "usage: $0 <image-ref> <s3-dest> [mc-alias]" >&2
-  echo "  e.g. $0 ghcr.io/luxfi/node:v1.30.41 lux-plugins-testnet/v1.3.5 lux" >&2
-  exit 2
-fi
-
-# Canonical plugin set: the 12 VM-ID filenames the Dockerfile writes to
-# /luxd/build/plugins/. Kept in lockstep with the Dockerfile plugin stages.
-PLUGINS=(
-  mgj786NP7uDwBCcq6YwThhaN8FLyybkCa4zBWTQbNgmK6k9A6   # evm    (C-Chain EVM, 0x9999)
-  mDVT5EWMumBp3LCqvKwuyZQeY1VXr1jvjGNAt8nL4UFiXvqXr   # dexvm  (native D-Chain DEX)
-  juFxSrbCM4wszxddKepj1GWwmrn9YgN1g4n3VUWPpRo9JjERA   # aivm
-  kMhHABHM8j4bH94MCc4rsTNdo5E9En37MMyiujk4WdNxgXFsY   # bridgevm
-  nZQm4Dmg1rjX18rb8maL9gamYyXPf1xCvF7ymWzxp6a1nSQTt   # graphvm
-  oR6tnZHezwogyf9fRnomNXC9ojwCEBAU6jdUzpgy2PB1tD7fM   # identityvm
-  pJJCSV7hHYVY6TUZwR8qUPAfuhX8JLb2C1AzNSezrYNbgau8M   # keyvm
-  r5m1ujrmXxVcQetG3CQfuDLHp2RHKh6vCDaFgBRQfUcTZh7eS   # oraclevm
-  ry9Sg8rZdT26iEKvJDmC2wkESs4SDKgZEhk5BgLSwg1EpcNug   # quantumvm
-  sP6dLqrrBR9w3soP18fbJ3YzZecZdD7DDdfH2cFhhLq7Hy9bz   # relayvm
-  tGVBwRxpmD2aFdg3iYjgRvrCe8Jcmq9UNKxyHMus2NZ8WcD8t   # thresholdvm
-  vv3qPfyTVXZ5ArRZA9Jh4hbYDTBe43f7sgQg4CHfNg1rnnvX9   # zkvm
-)
-
-WORK="$(mktemp -d)"
-trap 'rm -rf "${WORK}"' EXIT
-OUT="${WORK}/plugins"
-mkdir -p "${OUT}"
-
-echo "==> extracting plugin set from ${IMAGE_REF}"
-# Build the tar member list (paths inside the image rootfs).
-members=()
-for id in "${PLUGINS[@]}"; do
-  members+=("luxd/build/plugins/${id}")
-done
-
-# Prefer crane (no docker daemon needed). Fall back to docker create+cp.
-if command -v crane >/dev/null 2>&1; then
-  crane export "${IMAGE_REF}" - | tar -x -C "${WORK}" "${members[@]}"
-elif command -v docker >/dev/null 2>&1; then
-  cid="$(docker create "${IMAGE_REF}")"
-  for id in "${PLUGINS[@]}"; do
-    docker cp "${cid}:/luxd/build/plugins/${id}" "${OUT}/${id}"
-  done
-  docker rm -f "${cid}" >/dev/null
-  # normalize layout to match crane's export path
-  mkdir -p "${WORK}/luxd/build/plugins"
-  mv "${OUT}"/* "${WORK}/luxd/build/plugins/" 2>/dev/null || true
-  OUT="${WORK}/luxd/build/plugins"
-else
-  echo "FATAL: neither crane nor docker is available to extract the image" >&2
-  exit 1
-fi
-
-# crane export wrote to ${WORK}/luxd/build/plugins; converge OUT to it.
-[[ -d "${WORK}/luxd/build/plugins" ]] && OUT="${WORK}/luxd/build/plugins"
-
-echo "==> generating SHA256SUMS manifest"
-( cd "${OUT}"
-  : > SHA256SUMS
-  for id in "${PLUGINS[@]}"; do
-    [[ -s "${id}" ]] || { echo "FATAL: plugin ${id} missing from image ${IMAGE_REF}" >&2; exit 1; }
-    if command -v sha256sum >/dev/null 2>&1; then
-      sha256sum "${id}" >> SHA256SUMS
-    else
-      printf '%s  %s\n' "$(shasum -a 256 "${id}" | awk '{print $1}')" "${id}" >> SHA256SUMS
-    fi
-  done
-)
-echo "----- SHA256SUMS -----"
-cat "${OUT}/SHA256SUMS"
-echo "----------------------"
-
-echo "==> uploading plugin set + manifest to s3://${S3_DEST}/ (alias ${MC_ALIAS})"
-# Ensure the bucket exists (no-op if present); never deletes/overwrites siblings.
-bucket="${S3_DEST%%/*}"
-mc mb --ignore-existing "${MC_ALIAS}/${bucket}" >/dev/null 2>&1 || true
-for id in "${PLUGINS[@]}"; do
-  mc cp "${OUT}/${id}" "${MC_ALIAS}/${S3_DEST}/"
-done
-mc cp "${OUT}/SHA256SUMS" "${MC_ALIAS}/${S3_DEST}/"
-
-echo "==> verifying round-trip integrity (remote sha == local sha)"
-fail=0
-while read -r want id; do
-  got="$(mc cat "${MC_ALIAS}/${S3_DEST}/${id}" | { sha256sum 2>/dev/null || shasum -a 256; } | awk '{print $1}')"
-  if [[ "${got}" != "${want}" ]]; then
-    echo "MISMATCH ${id}: local ${want} != remote ${got}" >&2
-    fail=1
-  else
-    echo "ok ${id} ${got}"
-  fi
-done < "${OUT}/SHA256SUMS"
-[[ "${fail}" -eq 0 ]] || { echo "FATAL: upload integrity check failed" >&2; exit 1; }
-
-echo "==> published plugin set to s3://${S3_DEST}/ (${#PLUGINS[@]} plugins + SHA256SUMS)"

server/http/server.go

@@ -12,7 +12,6 @@ import (
 	"time"
 
 	"github.com/rs/cors"
-	zaphttp "github.com/zap-proto/http"
 	"golang.org/x/net/http2"
 	"golang.org/x/net/http2/h2c"
 
@@ -93,15 +92,6 @@ type server struct {
 
 	// Listener used to serve traffic
 	listener net.Listener
-
-	// handler is the fully-wrapped API handler chain (CORS + host-filter +
-	// /ext/* router). Held here so the optional ZAP-RPC listener serves the
-	// exact same handler as the HTTP listener.
-	handler http.Handler
-
-	// zapSrv is the optional ZAP-RPC listener; nil unless ZAP_RPC_LISTEN
-	// is set. See zap_listener.go.
-	zapSrv *zaphttp.Server
 }
 
 // New returns an instance of a Server.
@@ -148,16 +138,10 @@ func New(
 		router:          router,
 		srv:             httpServer,
 		listener:        listener,
-		handler:         handler,
 	}, nil
 }
 
 func (s *server) Dispatch() error {
-	// Additively boot the ZAP-RPC listener (opt-in via ZAP_RPC_LISTEN).
-	// Serves the same handler over github.com/zap-proto/http so the gateway
-	// can reach luxd over the native ZAP mesh. Never fatal — HTTP serves
-	// regardless.
-	s.zapSrv = startZapRPCListener(s.log, s.handler, zapRPCListenAddr())
 	return s.srv.Serve(s.listener)
 }
 
@@ -223,10 +207,6 @@ func (s *server) AddAliasesWithReadLock(endpoint string, aliases ...string) erro
 }
 
 func (s *server) Shutdown() error {
-	if s.zapSrv != nil {
-		_ = s.zapSrv.Close()
-	}
-
 	ctx, cancel := context.WithTimeout(context.Background(), s.shutdownTimeout)
 	err := s.srv.Shutdown(ctx)
 	cancel()

server/http/zap_listener.go

@@ -1,64 +0,0 @@
-// Copyright (C) 2019-2025, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-// ZAP-RPC listener — serves the EXACT same fully-wrapped API handler chain
-// (CORS + host-filter + /ext/* router) as the HTTP listener, but over the
-// github.com/zap-proto/http binary protocol. This is what makes luxd a
-// first-class citizen of the ZAP service mesh: the api.<brand> gateway can
-// proxy to luxd over native ZAP instead of HTTP/1.1.
-//
-// Purely ADDITIVE and OPT-IN: the existing HTTP path is untouched. The ZAP
-// listener only boots when ZAP_RPC_LISTEN is set to a non-empty bind
-// address (e.g. ":9651"); unset/"off" means it never starts, so existing
-// deployments are byte-for-byte unaffected. Boot failures are WARNED, never
-// fatal — the node must keep serving HTTP even if the ZAP listener fails.
-
-package server
-
-import (
-	"net/http"
-	"os"
-
-	zaphttp "github.com/zap-proto/http"
-
-	log "github.com/luxfi/log"
-)
-
-// envZapRPCListen is the env var that sets the ZAP-RPC bind address.
-// Empty / unset / "off" (case-insensitive) keeps the listener disabled.
-const envZapRPCListen = "ZAP_RPC_LISTEN"
-
-// zapRPCListenAddr returns the configured bind address, or "" if the ZAP-RPC
-// listener should stay disabled. Disabled is the default — the listener is
-// strictly opt-in so a node upgrade never silently opens a new port.
-func zapRPCListenAddr() string {
-	v, ok := os.LookupEnv(envZapRPCListen)
-	if !ok {
-		return ""
-	}
-	switch v {
-	case "", "off", "OFF", "Off", "false", "0":
-		return ""
-	default:
-		return v
-	}
-}
-
-// startZapRPCListener boots a ZAP-RPC listener serving handler in a goroutine
-// and returns the server (nil if disabled). The same handler instance the
-// HTTP server uses is served, so the two transports are behaviourally
-// identical — only the wire encoding differs. Boot errors are logged at
-// Warning and never propagated; the HTTP path must keep serving regardless.
-func startZapRPCListener(logger log.Logger, handler http.Handler, addr string) *zaphttp.Server {
-	if addr == "" {
-		return nil
-	}
-	srv := &zaphttp.Server{Addr: addr, Handler: handler}
-	go func() {
-		logger.Info("ZAP-RPC API listening", log.UserString("addr", addr))
-		if err := srv.ListenAndServe(); err != nil {
-			logger.Warn("ZAP-RPC listener exited", log.Err(err))
-		}
-	}()
-	return srv
-}

server/http/zap_listener_test.go

@@ -1,91 +0,0 @@
-// Copyright (C) 2019-2025, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package server
-
-import (
-	"io"
-	"net/http"
-	"testing"
-	"time"
-
-	zaphttp "github.com/zap-proto/http"
-
-	log "github.com/luxfi/log"
-)
-
-// TestZapRPCListenAddr verifies the opt-in env parsing: the listener stays
-// disabled unless ZAP_RPC_LISTEN is set to a real bind address.
-func TestZapRPCListenAddr(t *testing.T) {
-	cases := []struct {
-		set  bool
-		val  string
-		want string
-	}{
-		{set: false, want: ""},          // unset → disabled (default)
-		{set: true, val: "", want: ""},  // empty → disabled
-		{set: true, val: "off", want: ""},
-		{set: true, val: "OFF", want: ""},
-		{set: true, val: "0", want: ""},
-		{set: true, val: "false", want: ""},
-		{set: true, val: ":9651", want: ":9651"},
-		{set: true, val: "127.0.0.1:9651", want: "127.0.0.1:9651"},
-	}
-	for _, c := range cases {
-		if c.set {
-			t.Setenv(envZapRPCListen, c.val)
-		} else {
-			t.Setenv(envZapRPCListen, "") // ensure clean, then unset semantics below
-			// t.Setenv can't unset; emulate "unset" only for the documented default
-			// by treating empty as disabled, which the want already encodes.
-		}
-		if got := zapRPCListenAddr(); got != c.want {
-			t.Fatalf("zapRPCListenAddr(set=%v val=%q) = %q, want %q", c.set, c.val, got, c.want)
-		}
-	}
-}
-
-// TestStartZapRPCListener_Disabled returns nil (no listener) when addr is empty.
-func TestStartZapRPCListener_Disabled(t *testing.T) {
-	if srv := startZapRPCListener(log.NewNoOpLogger(), http.NewServeMux(), ""); srv != nil {
-		t.Fatalf("expected nil server when addr empty, got %v", srv)
-	}
-}
-
-// TestStartZapRPCListener_RoundTrip proves the listener serves the EXACT
-// handler it is given over the github.com/zap-proto/http binary wire — a
-// real ZAP request reaches the handler and the response comes back intact.
-func TestStartZapRPCListener_RoundTrip(t *testing.T) {
-	const addr = "127.0.0.1:19653"
-	const body = `{"jsonrpc":"2.0","result":"0x2a","id":1}`
-
-	mux := http.NewServeMux()
-	mux.HandleFunc("/ext/bc/C/rpc", func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		_, _ = io.WriteString(w, body)
-	})
-
-	srv := startZapRPCListener(log.NewNoOpLogger(), mux, addr)
-	if srv == nil {
-		t.Fatal("expected a running ZAP-RPC listener, got nil")
-	}
-	defer srv.Close()
-
-	// Give the goroutine a beat to bind.
-	time.Sleep(150 * time.Millisecond)
-
-	client := &http.Client{Transport: zaphttp.NewTransport(addr)}
-	resp, err := client.Post("http://"+addr+"/ext/bc/C/rpc", "application/json", nil)
-	if err != nil {
-		t.Fatalf("ZAP round-trip POST failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	got, _ := io.ReadAll(resp.Body)
-	if string(got) != body {
-		t.Fatalf("ZAP round-trip body = %q, want %q", got, body)
-	}
-	if ct := resp.Header.Get("Content-Type"); ct != "application/json" {
-		t.Fatalf("ZAP round-trip Content-Type = %q, want application/json", ct)
-	}
-}

staking/kms.go

@@ -27,7 +27,7 @@ import (
 // KMSConfig for staking key retrieval
 type KMSConfig struct {
 	Endpoint   string // KMS API endpoint (e.g., https://kms.dev.lux.network)
-	SecretPath string // Path to the staking secret (e.g., /staking/devnet/node-0)
+	SecretPath string // Path to the staking secret (e.g., /staking/liquid-devnet/node-0)
 	AuthToken  string // Bearer token for KMS auth
 }
 

tests/pq/pq_integration_test.go

@@ -4,6 +4,7 @@
 // Package pq provides P+Q (Post-Quantum) integration tests for Lux network.
 //
 // These tests verify that all post-quantum security measures are enforced:
+//   - Q-chain validators require RTSignature (Corona) in consensus votes
 //   - TLS connections use X25519MLKEM768 hybrid key exchange (no fallback)
 //   - SignedHost uses DNS hostnames only (no IP literals)
 //   - ML-DSA signatures work for X-Chain UTXOs
@@ -13,21 +14,28 @@ package pq
 
 import (
 	"bytes"
+	"context"
 	"crypto/ecdsa"
 	"crypto/elliptic"
 	"crypto/rand"
 	"crypto/tls"
 	"crypto/x509"
 	"crypto/x509/pkix"
-	"errors"
 	"github.com/go-json-experiment/json"
+	"errors"
 	"math/big"
 	"strings"
+	"sync"
 	"testing"
 	"time"
 
 	"github.com/stretchr/testify/require"
 
+	"github.com/luxfi/crypto/bls"
+	"github.com/luxfi/ids"
+	"github.com/luxfi/log"
+
+	"github.com/luxfi/node/consensus/quasar"
 	"github.com/luxfi/node/network/peer"
 )
 
@@ -35,6 +43,13 @@ import (
 // Test Constants
 // ----------------------------------------------------------------------------
 
+const (
+	testValidatorCount = 5
+	testQuorumNum      = 2
+	testQuorumDen      = 3
+	testThreshold      = 3
+)
+
 // ML-DSA security level constants
 const (
 	mldsaSecLevel44 = 0 // 128-bit security
@@ -52,6 +67,371 @@ const (
 	mldsa87SigLen    = 4627
 )
 
+// ----------------------------------------------------------------------------
+// Test Validator Infrastructure
+// ----------------------------------------------------------------------------
+
+// testValidator represents a validator node for integration testing.
+type testValidator struct {
+	nodeID    ids.NodeID
+	blsKey    *bls.SecretKey
+	blsPubKey *bls.PublicKey
+	rtKey     []byte // ML-DSA-65 public key
+	rtPrivKey []byte // ML-DSA-65 private key (for signing)
+	weight    uint64
+	active    bool
+}
+
+// newTestValidator creates a test validator with all required keys.
+func newTestValidator(weight uint64) (*testValidator, error) {
+	// Generate BLS keypair
+	blsKey, err := bls.NewSecretKey()
+	if err != nil {
+		return nil, err
+	}
+	blsPubKey := bls.PublicFromSecretKey(blsKey)
+
+	// Generate mock ML-DSA-65 keys (in production, use actual ML-DSA)
+	rtKey := make([]byte, mldsa65PubKeyLen)
+	rtPrivKey := make([]byte, mldsa65PubKeyLen) // Simplified for test
+	if _, err := rand.Read(rtKey); err != nil {
+		return nil, err
+	}
+	if _, err := rand.Read(rtPrivKey); err != nil {
+		return nil, err
+	}
+
+	return &testValidator{
+		nodeID:    ids.GenerateTestNodeID(),
+		blsKey:    blsKey,
+		blsPubKey: blsPubKey,
+		rtKey:     rtKey,
+		rtPrivKey: rtPrivKey,
+		weight:    weight,
+		active:    true,
+	}, nil
+}
+
+// toValidatorState converts to quasar.ValidatorState.
+func (v *testValidator) toValidatorState() quasar.ValidatorState {
+	return quasar.ValidatorState{
+		NodeID:      v.nodeID,
+		Weight:      v.weight,
+		BLSPubKey:   bls.PublicKeyToCompressedBytes(v.blsPubKey),
+		CoronaKey: v.rtKey,
+		Active:      v.active,
+	}
+}
+
+// testValidatorSet creates a set of test validators.
+func testValidatorSet(n int) ([]*testValidator, error) {
+	validators := make([]*testValidator, n)
+	for i := 0; i < n; i++ {
+		v, err := newTestValidator(1000)
+		if err != nil {
+			return nil, err
+		}
+		validators[i] = v
+	}
+	return validators, nil
+}
+
+// toValidatorStates converts validators to quasar.ValidatorState slice.
+func toValidatorStates(validators []*testValidator) []quasar.ValidatorState {
+	states := make([]quasar.ValidatorState, len(validators))
+	for i, v := range validators {
+		states[i] = v.toValidatorState()
+	}
+	return states
+}
+
+// ----------------------------------------------------------------------------
+// Mock P-Chain Provider
+// ----------------------------------------------------------------------------
+
+type mockPChainProvider struct {
+	mu         sync.RWMutex
+	height     uint64
+	validators []quasar.ValidatorState
+	finalityCh chan quasar.FinalityEvent
+	closed     bool
+}
+
+func newMockPChainProvider(validators []quasar.ValidatorState) *mockPChainProvider {
+	return &mockPChainProvider{
+		height:     0,
+		validators: validators,
+		finalityCh: make(chan quasar.FinalityEvent, 100),
+	}
+}
+
+func (m *mockPChainProvider) GetFinalizedHeight() uint64 {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+	return m.height
+}
+
+func (m *mockPChainProvider) GetValidators(height uint64) ([]quasar.ValidatorState, error) {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+	return m.validators, nil
+}
+
+func (m *mockPChainProvider) SubscribeFinality() <-chan quasar.FinalityEvent {
+	return m.finalityCh
+}
+
+func (m *mockPChainProvider) EmitFinality(event quasar.FinalityEvent) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if m.closed {
+		return
+	}
+	m.height = event.Height
+	select {
+	case m.finalityCh <- event:
+	default:
+	}
+}
+
+func (m *mockPChainProvider) Close() {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if !m.closed {
+		m.closed = true
+		close(m.finalityCh)
+	}
+}
+
+// ----------------------------------------------------------------------------
+// SECTION 1: Q-Chain Validator Network Tests
+// ----------------------------------------------------------------------------
+
+// TestQChainValidatorNetwork tests 5-node Q-chain validator consensus.
+func TestQChainValidatorNetwork(t *testing.T) {
+	t.Run("5_node_initialization", func(t *testing.T) {
+		validators, err := testValidatorSet(testValidatorCount)
+		require.NoError(t, err, "failed to create validators")
+		require.Len(t, validators, testValidatorCount)
+
+		// Verify each validator has required key material
+		for i, v := range validators {
+			require.NotNil(t, v.blsKey, "validator %d missing BLS key", i)
+			require.NotNil(t, v.blsPubKey, "validator %d missing BLS pubkey", i)
+			require.Len(t, v.rtKey, mldsa65PubKeyLen, "validator %d RT key wrong length", i)
+		}
+	})
+
+	t.Run("quasar_with_validators", func(t *testing.T) {
+		validators, err := testValidatorSet(testValidatorCount)
+		require.NoError(t, err)
+
+		states := toValidatorStates(validators)
+		pchain := newMockPChainProvider(states)
+		defer pchain.Close()
+
+		q, err := quasar.NewQuasar(log.NewNoOpLogger(), testThreshold, testQuorumNum, testQuorumDen)
+		require.NoError(t, err)
+
+		q.ConnectPChain(pchain)
+
+		// Initialize Corona with node IDs
+		nodeIDs := make([]ids.NodeID, len(validators))
+		for i, v := range validators {
+			nodeIDs[i] = v.nodeID
+		}
+
+		// Corona init may fail due to lattice lib constraints in test env
+		err = q.InitializeCorona(nodeIDs)
+		if err != nil {
+			t.Skipf("Skipping: Corona initialization requires lattice library: %v", err)
+		}
+
+		stats := q.Stats()
+		require.True(t, stats.CoronaReady, "Corona should be initialized")
+	})
+
+	t.Run("consensus_starts_and_stops", func(t *testing.T) {
+		validators, err := testValidatorSet(testValidatorCount)
+		require.NoError(t, err)
+
+		states := toValidatorStates(validators)
+		pchain := newMockPChainProvider(states)
+		defer pchain.Close()
+
+		q, err := quasar.NewQuasar(log.NewNoOpLogger(), testThreshold, testQuorumNum, testQuorumDen)
+		require.NoError(t, err)
+
+		q.ConnectPChain(pchain)
+		q.ConnectQuantumFallback(&mockQuantumSigner{})
+
+		ctx, cancel := context.WithCancel(context.Background())
+		defer cancel()
+
+		err = q.Start(ctx)
+		require.NoError(t, err)
+
+		// Verify running state
+		require.True(t, q.IsRunning(), "Quasar should be running")
+
+		// Emit finality event (it will be queued even if not fully processed)
+		var blockID ids.ID
+		_, _ = rand.Read(blockID[:])
+
+		event := quasar.FinalityEvent{
+			Height:     1,
+			BlockID:    blockID,
+			Validators: states,
+			Timestamp:  time.Now(),
+		}
+		pchain.EmitFinality(event)
+
+		// Give event time to be received
+		time.Sleep(100 * time.Millisecond)
+
+		// Clean stop
+		q.Stop()
+		require.False(t, q.IsRunning(), "Quasar should stop cleanly")
+	})
+
+	t.Run("manual_finality_set", func(t *testing.T) {
+		// Test that we can manually set finality entries (simulates successful finality)
+		q, err := quasar.NewQuasar(log.NewNoOpLogger(), testThreshold, testQuorumNum, testQuorumDen)
+		require.NoError(t, err)
+
+		var blockID ids.ID
+		_, _ = rand.Read(blockID[:])
+
+		// Create a valid finality with both proofs
+		finality := &quasar.QuantumFinality{
+			BlockID:       blockID,
+			PChainHeight:  1,
+			QChainHeight:  1,
+			BLSProof:      make([]byte, 96),
+			CoronaProof: make([]byte, mldsa65SigLen),
+			TotalWeight:   1000,
+			SignerWeight:  700, // 70% > 67% quorum
+		}
+
+		q.SetFinalized(blockID, finality)
+
+		// Verify we can retrieve it
+		retrieved, found := q.GetFinality(blockID)
+		require.True(t, found, "should find finalized block")
+		require.Equal(t, finality.BlockID, retrieved.BlockID)
+
+		stats := q.Stats()
+		require.GreaterOrEqual(t, stats.FinalizedBlocks, 1, "should have at least 1 finalized block")
+	})
+}
+
+// mockQuantumSigner provides mock RT signing for tests.
+type mockQuantumSigner struct{}
+
+func (m *mockQuantumSigner) SignMessage(msg []byte) ([]byte, error) {
+	return []byte("RT-MOCK-SIG"), nil
+}
+
+// ----------------------------------------------------------------------------
+// SECTION 2: RTSignature Enforcement Tests
+// ----------------------------------------------------------------------------
+
+// TestRTSignatureRequired verifies RTSignature is REQUIRED at consensus-critical boundaries.
+func TestRTSignatureRequired(t *testing.T) {
+	t.Run("vote_without_rt_rejected", func(t *testing.T) {
+		// Create a vote message without RTSignature
+		vote := &testVoteMessage{
+			blockID:      ids.GenerateTestID(),
+			height:       1,
+			blsSignature: []byte("valid-bls-sig"),
+			rtSignature:  nil, // Missing!
+		}
+
+		// Validate vote - should fail
+		err := validateVoteMessage(vote)
+		require.Error(t, err, "vote without RTSignature should be rejected")
+		require.Contains(t, err.Error(), "RTSignature required")
+	})
+
+	t.Run("vote_with_empty_rt_rejected", func(t *testing.T) {
+		vote := &testVoteMessage{
+			blockID:      ids.GenerateTestID(),
+			height:       1,
+			blsSignature: []byte("valid-bls-sig"),
+			rtSignature:  []byte{}, // Empty!
+		}
+
+		err := validateVoteMessage(vote)
+		require.Error(t, err, "vote with empty RTSignature should be rejected")
+	})
+
+	t.Run("vote_with_invalid_rt_length_rejected", func(t *testing.T) {
+		vote := &testVoteMessage{
+			blockID:      ids.GenerateTestID(),
+			height:       1,
+			blsSignature: []byte("valid-bls-sig"),
+			rtSignature:  []byte("too-short"), // Wrong length
+		}
+
+		err := validateVoteMessage(vote)
+		require.Error(t, err, "vote with invalid RTSignature length should be rejected")
+	})
+
+	t.Run("vote_with_valid_rt_accepted", func(t *testing.T) {
+		rtSig := make([]byte, mldsa65SigLen)
+		_, _ = rand.Read(rtSig)
+
+		vote := &testVoteMessage{
+			blockID:      ids.GenerateTestID(),
+			height:       1,
+			blsSignature: []byte("valid-bls-sig"),
+			rtSignature:  rtSig,
+		}
+
+		err := validateVoteMessage(vote)
+		require.NoError(t, err, "vote with valid RTSignature should be accepted")
+	})
+
+	t.Run("finality_without_both_proofs_rejected", func(t *testing.T) {
+		// Finality requires both BLS and RT proofs
+		finality := &quasar.QuantumFinality{
+			BlockID:       ids.GenerateTestID(),
+			BLSProof:      []byte("bls-proof"),
+			CoronaProof: nil, // Missing RT proof!
+			TotalWeight:   1000,
+			SignerWeight:  700,
+		}
+
+		q, _ := quasar.NewQuasar(log.NewNoOpLogger(), testThreshold, testQuorumNum, testQuorumDen)
+		err := q.Verify(finality)
+		require.Error(t, err, "finality without RT proof should be rejected")
+	})
+}
+
+// testVoteMessage simulates a consensus vote message.
+type testVoteMessage struct {
+	blockID      ids.ID
+	height       uint64
+	blsSignature []byte
+	rtSignature  []byte
+}
+
+// validateVoteMessage validates a vote message for Q-chain consensus.
+func validateVoteMessage(vote *testVoteMessage) error {
+	// RTSignature is REQUIRED for Q-chain validators
+	if vote.rtSignature == nil {
+		return errors.New("RTSignature required for Q-chain consensus vote")
+	}
+	if len(vote.rtSignature) == 0 {
+		return errors.New("RTSignature cannot be empty")
+	}
+	// Check signature length matches ML-DSA-65
+	if len(vote.rtSignature) != mldsa65SigLen {
+		return errors.New("RTSignature has invalid length for ML-DSA-65")
+	}
+	return nil
+}
+
 // ----------------------------------------------------------------------------
 // SECTION 3: PQ-Only TLS Tests
 // ----------------------------------------------------------------------------
@@ -225,8 +605,8 @@ func TestHostnameOnlyAddressing(t *testing.T) {
 func TestMLDSACredential(t *testing.T) {
 	t.Run("security_level_signature_lengths", func(t *testing.T) {
 		testCases := []struct {
-			level     int
-			sigLen    int
+			level    int
+			sigLen   int
 			pubKeyLen int
 		}{
 			{mldsaSecLevel44, mldsa44SigLen, mldsa44PubKeyLen},

tools/go.sum

@@ -37,7 +37,7 @@ github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UF
 github.com/charithe/durationcheck v0.0.10 h1:wgw73BiocdBDQPik+zcEoBG/ob8uyBHf2iyoHGPf5w4=
 github.com/charmbracelet/colorprofile v0.3.1 h1:k8dTHMd7fgw4bnFd7jXTLZrSU/CQrKnL3m+AxCzDz40=
 github.com/charmbracelet/lipgloss v1.1.0 h1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY=
-github.com/charmbracelet/x/ansi v0.9.2 h1:VxqhWbZIXFl3/ufdpzcwlaPZRPoaOj8r+KtyeRG3C0g=
+github.com/charmbracelet/x/ansi v0.9.2 h1:92AGsQmNTRMzuzHEYfCdjQeUzTrgE1vfO5/7fEVoXdY=
 github.com/charmbracelet/x/cellbuf v0.0.13 h1:/KBBKHuVRbq1lYx5BzEHBAFBP8VcQzJejZ/IA3iR28k=
 github.com/charmbracelet/x/term v0.2.1 h1:AQeHeLZ1OqSXhrAWpYUtZyX1T3zVxfpZuEQMIQaGIAQ=
 github.com/chavacava/garif v0.1.0 h1:2JHa3hbYf5D9dsgseMKAmc/MZ109otzgNFk5s87H9Pc=

vms/chainadapter/committee_cert_test.go

@@ -1,217 +0,0 @@
-// Copyright (C) 2019-2025, Lux Industries, Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package chainadapter
-
-import (
-	"fmt"
-	"testing"
-	"time"
-
-	"github.com/luxfi/crypto/bls"
-	"github.com/luxfi/ids"
-)
-
-// newTestCommittee builds an n-member committee with fresh BLS keypairs and
-// returns the committee roster alongside the members' secret keys (parallel
-// to committee.Members / committee.PublicKeys by index).
-func newTestCommittee(t *testing.T, n, threshold int) (*ComputeCommittee, []*bls.SecretKey) {
-	t.Helper()
-	members := make([][]byte, n)
-	pubkeys := make([][]byte, n)
-	sks := make([]*bls.SecretKey, n)
-	for i := 0; i < n; i++ {
-		sk, err := bls.NewSecretKey()
-		if err != nil {
-			t.Fatalf("bls keygen: %v", err)
-		}
-		sks[i] = sk
-		pubkeys[i] = bls.PublicKeyToCompressedBytes(bls.PublicFromSecretKey(sk))
-		members[i] = []byte(fmt.Sprintf("member-%d", i))
-	}
-	committee := &ComputeCommittee{
-		ID:         ids.ID{0xC0, 0x11, 0xEE, 0x77},
-		Members:    members,
-		Threshold:  threshold,
-		PublicKeys: pubkeys,
-	}
-	return committee, sks
-}
-
-// newSignedCert returns a certificate endorsed by the committee members at the
-// given indices, each signing the certificate's canonical digest with its key.
-func newSignedCert(t *testing.T, committee *ComputeCommittee, sks []*bls.SecretKey, indices ...int) *CommitteeCert {
-	t.Helper()
-	cert := &CommitteeCert{
-		CommitteeID:      committee.ID,
-		Threshold:        committee.Threshold,
-		TotalMembers:     len(committee.Members),
-		RequestID:        ids.ID{0x11, 0x22, 0x33},
-		OutputCommitment: [32]byte{0xAB, 0xCD, 0xEF},
-		Timestamp:        time.Unix(1_700_000_000, 0).UTC(),
-	}
-	msg := cert.signingDigest()
-	for _, idx := range indices {
-		sig, err := sks[idx].Sign(msg[:])
-		if err != nil {
-			t.Fatalf("sign: %v", err)
-		}
-		cert.Endorsements = append(cert.Endorsements, &Endorsement{
-			MemberID:    committee.Members[idx],
-			MemberIndex: idx,
-			Signature:   bls.SignatureToBytes(sig),
-		})
-	}
-	return cert
-}
-
-// TestCommitteeCertValidQuorum: a quorum of distinct, correctly-signed
-// endorsements verifies.
-func TestCommitteeCertValidQuorum(t *testing.T) {
-	committee, sks := newTestCommittee(t, 5, 3)
-	cert := newSignedCert(t, committee, sks, 0, 1, 2)
-	if err := cert.Verify(committee); err != nil {
-		t.Fatalf("expected valid quorum to verify, got %v", err)
-	}
-	// A full set (all members) must also verify.
-	full := newSignedCert(t, committee, sks, 0, 1, 2, 3, 4)
-	if err := full.Verify(committee); err != nil {
-		t.Fatalf("expected full endorsement set to verify, got %v", err)
-	}
-}
-
-// TestCommitteeCertSubThreshold: fewer than Threshold endorsements is rejected.
-func TestCommitteeCertSubThreshold(t *testing.T) {
-	committee, sks := newTestCommittee(t, 5, 3)
-	cert := newSignedCert(t, committee, sks, 0, 1) // only 2 < 3
-	if err := cert.Verify(committee); err == nil {
-		t.Fatal("expected sub-threshold cert to be REJECTED")
-	}
-}
-
-// TestCommitteeCertDuplicateSigner: a member endorsing twice cannot inflate the
-// distinct count, even though both signatures are individually valid.
-func TestCommitteeCertDuplicateSigner(t *testing.T) {
-	committee, sks := newTestCommittee(t, 5, 3)
-	// Three endorsements but member 1 appears twice => only 2 distinct.
-	cert := newSignedCert(t, committee, sks, 0, 1, 1)
-	if err := cert.Verify(committee); err == nil {
-		t.Fatal("expected duplicate-signer cert to be REJECTED")
-	}
-}
-
-// TestCommitteeCertForgedSignature: a well-formed signature over the WRONG
-// message (an attacker who controls a member key but signs a different digest)
-// fails verification.
-func TestCommitteeCertForgedSignature(t *testing.T) {
-	committee, sks := newTestCommittee(t, 5, 3)
-	cert := newSignedCert(t, committee, sks, 0, 1, 2)
-	// Replace endorsement 2 with a valid signature over a different message.
-	wrong, err := sks[2].Sign([]byte("not the certificate digest"))
-	if err != nil {
-		t.Fatalf("sign: %v", err)
-	}
-	cert.Endorsements[2].Signature = bls.SignatureToBytes(wrong)
-	if err := cert.Verify(committee); err == nil {
-		t.Fatal("expected forged/wrong-message signature to be REJECTED")
-	}
-
-	// Also: structurally corrupt signature bytes must be rejected, not panic.
-	cert2 := newSignedCert(t, committee, sks, 0, 1, 2)
-	cert2.Endorsements[1].Signature = []byte{0x00, 0x01, 0x02}
-	if err := cert2.Verify(committee); err == nil {
-		t.Fatal("expected malformed signature bytes to be REJECTED")
-	}
-}
-
-// TestCommitteeCertUnknownSigner: an endorsement that does not correspond to a
-// roster member (out-of-range index, foreign key, or mismatched identity) is
-// rejected.
-func TestCommitteeCertUnknownSigner(t *testing.T) {
-	committee, sks := newTestCommittee(t, 5, 3)
-
-	// (a) Member index outside the roster.
-	cert := newSignedCert(t, committee, sks, 0, 1, 2)
-	cert.Endorsements[2].MemberIndex = 99
-	if err := cert.Verify(committee); err == nil {
-		t.Fatal("expected out-of-range member index to be REJECTED")
-	}
-
-	// (b) A signer outside the committee: fresh key, but claiming a valid
-	// in-range index. The signature is over the right digest but by the wrong
-	// key, so it fails verification against the roster's public key.
-	cert = newSignedCert(t, committee, sks, 0, 1, 2)
-	foreign, err := bls.NewSecretKey()
-	if err != nil {
-		t.Fatalf("keygen: %v", err)
-	}
-	msg := cert.signingDigest()
-	fsig, err := foreign.Sign(msg[:])
-	if err != nil {
-		t.Fatalf("sign: %v", err)
-	}
-	cert.Endorsements[2].Signature = bls.SignatureToBytes(fsig)
-	if err := cert.Verify(committee); err == nil {
-		t.Fatal("expected foreign-key endorsement to be REJECTED")
-	}
-
-	// (c) Correct key & signature but MemberID does not match the roster index.
-	cert = newSignedCert(t, committee, sks, 0, 1, 2)
-	cert.Endorsements[2].MemberID = []byte("someone-else")
-	if err := cert.Verify(committee); err == nil {
-		t.Fatal("expected member-id/index mismatch to be REJECTED")
-	}
-}
-
-// TestCommitteeCertParameterMismatch: threshold and committee identity must
-// agree with the supplied roster.
-func TestCommitteeCertParameterMismatch(t *testing.T) {
-	committee, sks := newTestCommittee(t, 5, 3)
-
-	if err := (&CommitteeCert{}).Verify(nil); err == nil {
-		t.Fatal("expected nil committee to be REJECTED")
-	}
-
-	cert := newSignedCert(t, committee, sks, 0, 1, 2)
-	cert.Threshold = 2 // disagrees with committee.Threshold == 3
-	if err := cert.Verify(committee); err == nil {
-		t.Fatal("expected threshold mismatch to be REJECTED")
-	}
-
-	cert = newSignedCert(t, committee, sks, 0, 1, 2)
-	cert.CommitteeID = ids.ID{0xDE, 0xAD}
-	if err := cert.Verify(committee); err == nil {
-		t.Fatal("expected committee-id mismatch to be REJECTED")
-	}
-}
-
-// TestVerifyResultCommitteeCert exercises the engine path: an unknown committee
-// fails closed; a registered committee verifies a valid certificate.
-func TestVerifyResultCommitteeCert(t *testing.T) {
-	committee, sks := newTestCommittee(t, 4, 2)
-	cert := newSignedCert(t, committee, sks, 0, 1)
-	result := &ComputeResult{CommitteeCert: cert}
-
-	engine := NewConfidentialComputeEngine(TEEIntelSGX)
-
-	// Unknown committee -> fail closed.
-	if err := engine.VerifyResult(result); err == nil {
-		t.Fatal("expected unregistered committee to fail closed")
-	}
-
-	// After registration, a valid certificate verifies.
-	if err := engine.RegisterCommittee(committee); err != nil {
-		t.Fatalf("register committee: %v", err)
-	}
-	if err := engine.VerifyResult(result); err != nil {
-		t.Fatalf("expected registered committee cert to verify, got %v", err)
-	}
-
-	// Mutating any signed field after the fact (here the certified output
-	// commitment) changes the digest and invalidates every endorsement.
-	tampered := newSignedCert(t, committee, sks, 0, 1)
-	tampered.OutputCommitment = [32]byte{0x99} // endorsements signed over a different value
-	if err := tampered.Verify(committee); err == nil {
-		t.Fatal("expected endorsement over a different output to be REJECTED")
-	}
-}

vms/chainadapter/fhecrdt_compute.go

@@ -4,7 +4,6 @@
 package chainadapter
 
 import (
-	"bytes"
 	"context"
 	"crypto/sha256"
 	"encoding/binary"
@@ -12,7 +11,6 @@ import (
 	"sync"
 	"time"
 
-	"github.com/luxfi/crypto/bls"
 	"github.com/luxfi/ids"
 )
 
@@ -252,93 +250,17 @@ type Endorsement struct {
 	TEEAttestation *TEEAttestation `json:"teeAttestation,omitempty"`
 }
 
-// signingDigest is the canonical, domain-separated message that every
-// committee member signs when endorsing this certificate. It binds the
-// committee, the request, the certified output commitment and the
-// timestamp so that an endorsement for one (request, output) pair can
-// never be replayed for another.
-func (c *CommitteeCert) signingDigest() [32]byte {
-	h := sha256.New()
-	h.Write([]byte("lux/chainadapter/committee-cert/v1"))
-	h.Write(c.CommitteeID[:])
-	h.Write(c.RequestID[:])
-	h.Write(c.OutputCommitment[:])
-	var ts [8]byte
-	binary.BigEndian.PutUint64(ts[:], uint64(c.Timestamp.UTC().UnixNano()))
-	h.Write(ts[:])
-	var out [32]byte
-	copy(out[:], h.Sum(nil))
-	return out
-}
-
-// Verify checks that the certificate carries at least Threshold valid,
-// distinct endorsement signatures from members of the supplied committee.
-//
-// Each endorsement must:
-//   - reference a member that exists in the committee roster (known signer);
-//   - carry a MemberID matching the roster entry at that index;
-//   - be a BLS signature over the certificate's canonical signing digest
-//     that verifies under that member's registered public key;
-//   - be distinct — no member may endorse twice.
-//
-// The certificate is rejected (fail-closed) on any nil/malformed, unknown,
-// duplicate, or cryptographically invalid endorsement, on a committee/cert
-// parameter mismatch, or when fewer than Threshold distinct valid
-// endorsements are present. There is no count-only path: every accepted
-// endorsement has had its signature verified against a registered key.
-func (c *CommitteeCert) Verify(committee *ComputeCommittee) error {
-	if committee == nil {
-		return ErrCommitteeCertInvalid
-	}
-	// Threshold and committee identity must agree, and the roster must be
-	// internally consistent (one public key per member).
-	if c.Threshold <= 0 || c.Threshold != committee.Threshold {
-		return ErrCommitteeCertInvalid
-	}
-	if c.CommitteeID != committee.ID {
-		return ErrCommitteeCertInvalid
-	}
-	if len(committee.PublicKeys) != len(committee.Members) || len(committee.PublicKeys) == 0 {
-		return ErrCommitteeCertInvalid
-	}
+// Verify verifies the committee certificate
+func (c *CommitteeCert) Verify() error {
 	if len(c.Endorsements) < c.Threshold {
 		return ErrCommitteeCertInvalid
 	}
 
-	msg := c.signingDigest()
-	seen := make(map[int]struct{}, len(c.Endorsements))
+	// In production, verify:
+	// 1. Each endorsement signature
+	// 2. Endorsers are valid committee members
+	// 3. Optional: aggregate signature
 
-	for _, e := range c.Endorsements {
-		if e == nil {
-			return ErrCommitteeCertInvalid
-		}
-		idx := e.MemberIndex
-		if idx < 0 || idx >= len(committee.PublicKeys) {
-			return ErrCommitteeCertInvalid // unknown signer
-		}
-		if _, dup := seen[idx]; dup {
-			return ErrCommitteeCertInvalid // duplicate signer
-		}
-		if !bytes.Equal(e.MemberID, committee.Members[idx]) {
-			return ErrCommitteeCertInvalid // identity does not match roster index
-		}
-		pk, err := bls.PublicKeyFromCompressedBytes(committee.PublicKeys[idx])
-		if err != nil {
-			return ErrCommitteeCertInvalid
-		}
-		sig, err := bls.SignatureFromBytes(e.Signature)
-		if err != nil {
-			return ErrCommitteeCertInvalid
-		}
-		if !bls.Verify(pk, sig, msg[:]) {
-			return ErrCommitteeCertInvalid // forged or invalid signature
-		}
-		seen[idx] = struct{}{}
-	}
-
-	if len(seen) < c.Threshold {
-		return ErrCommitteeCertInvalid
-	}
 	return nil
 }
 
@@ -355,11 +277,6 @@ type ConfidentialComputeEngine struct {
 
 	// Result cache
 	results       map[ids.ID]*ComputeResult
-
-	// Registered committee rosters, keyed by committee ID. A committee
-	// certificate can only be verified against a roster registered here;
-	// an unknown committee fails closed.
-	committees map[ids.ID]*ComputeCommittee
 }
 
 // ComputeSession tracks an active computation
@@ -385,24 +302,9 @@ func NewConfidentialComputeEngine(teeType TEEType) *ConfidentialComputeEngine {
 		teeAvailable: true, // Check actual TEE availability
 		sessions:     make(map[ids.ID]*ComputeSession),
 		results:      make(map[ids.ID]*ComputeResult),
-		committees:   make(map[ids.ID]*ComputeCommittee),
 	}
 }
 
-// RegisterCommittee registers a committee roster so that certificates the
-// committee produces can be verified against its members' public keys.
-// PublicKeys and Members must be parallel arrays (one compressed BLS public
-// key per member).
-func (e *ConfidentialComputeEngine) RegisterCommittee(committee *ComputeCommittee) error {
-	if committee == nil || len(committee.PublicKeys) != len(committee.Members) || len(committee.PublicKeys) == 0 {
-		return ErrCommitteeCertInvalid
-	}
-	e.mu.Lock()
-	defer e.mu.Unlock()
-	e.committees[committee.ID] = committee
-	return nil
-}
-
 // SubmitRequest submits a compute request
 func (e *ConfidentialComputeEngine) SubmitRequest(ctx context.Context, req *ComputeRequest) error {
 	e.mu.Lock()
@@ -589,16 +491,9 @@ func (e *ConfidentialComputeEngine) VerifyResult(result *ComputeResult) error {
 		}
 	}
 
-	// Verify committee cert if present. The roster must have been
-	// registered; an unknown committee fails closed.
+	// Verify committee cert if present
 	if result.CommitteeCert != nil {
-		e.mu.RLock()
-		committee := e.committees[result.CommitteeCert.CommitteeID]
-		e.mu.RUnlock()
-		if committee == nil {
-			return ErrCommitteeCertInvalid
-		}
-		if err := result.CommitteeCert.Verify(committee); err != nil {
+		if err := result.CommitteeCert.Verify(); err != nil {
 			return err
 		}
 	}

vms/dexvm/dexvm.go

@@ -9,12 +9,10 @@
 // New code should import the canonical path:
 //   "github.com/luxfi/chains/dexvm"
 //
-// This package is a thin backward-compatibility alias. The underlying
-// chains/dexvm is the pure-Go stateless atomic proxy (zero private deps).
-// Unlike the always-on genesis VMs, dexvm is registered in OptionalVMs and is
-// NFT-gated (see node/vms.go:118, RequiredNFT "dex-operator"): a node only
-// tracks/validates the D-Chain when the network has configured that operator
-// collection, so it is plugin-loaded on demand, not linked unconditionally.
+// This package is a thin, unconditional backward-compatibility alias. The
+// underlying chains/dexvm is the pure-Go stateless atomic proxy (zero private
+// deps), so — like every other genesis VM — it is linked into every build with
+// no build tag.
 package dexvm
 
 import (

vms/example/xsvm/warp.go

@@ -14,7 +14,7 @@ var _ luxWarp.Verifier = (*xsvmVerifier)(nil)
 // xsvmVerifier allows signing all warp messages
 type xsvmVerifier struct{}
 
-func (xsvmVerifier) Verify(context.Context, *luxWarp.Message, []byte) error {
+func (xsvmVerifier) Verify(context.Context, *luxWarp.UnsignedMessage, []byte) error {
 	return nil
 }
 

vms/platformvm/network/network.go

@@ -43,8 +43,8 @@ type warpSignerAdapter struct {
 }
 
 // Sign implements extwarp.Signer interface
-func (a *warpSignerAdapter) Sign(msg *extwarp.Message) ([]byte, error) {
-	// Convert the external ZAP message to an internal warp message
+func (a *warpSignerAdapter) Sign(msg *extwarp.UnsignedMessage) ([]byte, error) {
+	// Convert external warp message to internal warp message
 	// msg.SourceChainID is already ids.ID type
 	internalMsg, err := warp.NewUnsignedMessage(msg.NetworkID, msg.SourceChainID, msg.Payload)
 	if err != nil {

vms/platformvm/network/warp_zap.go

@@ -24,7 +24,7 @@ type signatureRequestVerifier struct {
 
 func (s signatureRequestVerifier) Verify(
 	_ context.Context,
-	_ *warp.Message,
+	_ *warp.UnsignedMessage,
 	_ []byte,
 ) error {
 	return nil

vms/platformvm/network/zap_native_admission_test.go

@@ -57,7 +57,7 @@ func TestZapNativeAdmissionGate_RejectsCreateSovereignL1Tx(t *testing.T) {
 }
 
 // TestZapNativeAdmissionGate_PassThroughLegacyTypes pins the brief:
-// "Legacy txs.ConvertNetworkToL1Tx / txs.RegisterL1ValidatorTx (the working
+// "Legacy txs.CreateSubnetTx / txs.RegisterL1ValidatorTx (the working
 // ones) still pass through". For txs.BaseTx (working executor) and
 // txs.RegisterL1ValidatorTx + txs.ConvertNetworkToL1Tx (legacy
 // executors at line 639/761), the gate must NOT fire; the inner

vms/platformvm/txs/add_chain_validator_tx.go

@@ -35,7 +35,7 @@ var (
 	errAddPrimaryNetworkValidator = errors.New("can't add primary network validator with AddChainValidatorTx")
 )
 
-// AddChainValidatorTx is the legacy per-chain (pre-LP-018: per-L1)
+// AddChainValidatorTx is the legacy per-chain (legacy: per-subnet)
 // validator registration tx.
 //
 // Deprecated: Use AddValidatorTx. Under LP-018 sovereign-L1, validators

vms/platformvm/txs/chain_validator.go

@@ -10,7 +10,7 @@ import (
 
 // ChainValidator is the legacy per-chain validator descriptor used by
 // AddChainValidatorTx. The Chain field is the network ID this validator
-// registers under (pre-LP-018: L1 ID).
+// registers under (legacy: subnet ID).
 //
 // Deprecated: Use Validator with AddValidatorTx. Under LP-018
 // sovereign-L1, validators validate networks — not chains. Chains live

vms/platformvm/vm.go

@@ -67,8 +67,8 @@ type warpSignerAdapter struct {
 }
 
 func (a *warpSignerAdapter) Sign(msg *warp.UnsignedMessage) ([]byte, error) {
-	// Convert the internal message to the external ZAP message
-	extMsg, err := extwarp.NewMessage(msg.NetworkID, msg.SourceChainID, msg.Payload)
+	// Convert internal message to external message format
+	extMsg, err := extwarp.NewUnsignedMessage(msg.NetworkID, msg.SourceChainID, msg.Payload)
 	if err != nil {
 		return nil, err
 	}

vms/proposervm/batched_vm.go

@@ -111,7 +111,8 @@ func (vm *VM) BatchedParseBlock(ctx context.Context, blks [][]byte) ([]chain.Blo
 		}
 
 		blkID := statelessBlock.ID()
-		if block, exists := vm.cachedVerifiedBlock(blkID); exists {
+		block, exists := vm.verifiedBlocks[blkID]
+		if exists {
 			blocks[blocksIndex] = block
 			continue
 		}
@@ -161,7 +162,7 @@ func (vm *VM) BatchedParseBlock(ctx context.Context, blks [][]byte) ([]chain.Blo
 }
 
 func (vm *VM) getStatelessBlk(blkID ids.ID) (statelessblock.Block, error) {
-	if currentBlk, exists := vm.cachedVerifiedBlock(blkID); exists {
+	if currentBlk, exists := vm.verifiedBlocks[blkID]; exists {
 		return currentBlk.getStatelessBlk(), nil
 	}
 	return vm.State.GetBlock(blkID)

vms/proposervm/config.go

@@ -7,7 +7,6 @@ import (
 	"crypto"
 	"time"
 
-	"github.com/luxfi/ids"
 	"github.com/luxfi/metric"
 
 	"github.com/luxfi/node/staking"
@@ -17,20 +16,6 @@ import (
 type Config struct {
 	Upgrades upgrade.Config
 
-	// NetworkID is the validator-set ID the proposer windower resolves the
-	// schedule under — it MUST be the SAME ID the consensus cert side uses
-	// (manager.go resolves it once: PrimaryNetworkID for native chains,
-	// otherwise the L1's own chainID, falling back to primary only if that set is
-	// empty). CRITICAL-3: hardcoding PrimaryNetworkID here made the windower call
-	// GetValidatorSet(height, PrimaryNetworkID) on a sovereign L1 (Zoo/Hanzo/Pars,
-	// whose validators live under their OWN networkID == EVM chainID), get an
-	// EMPTY set, and degrade to ErrAnyoneCanPropose — so single-proposer silently
-	// did not hold and the L1 equivocated exactly like the unfixed C-Chain, AND
-	// the windower's set diverged from the cert's set (breaking determinism). The
-	// zero value (ids.Empty) IS constants.PrimaryNetworkID, so a native chain that
-	// resolves to primary is unchanged.
-	NetworkID ids.ID
-
 	// Configurable minimal delay among blocks issued consecutively
 	MinBlkDelay time.Duration
 

vms/proposervm/height_repair_test.go

@@ -1,58 +0,0 @@
-// Copyright (C) 2019-2025, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package proposervm
-
-import "testing"
-
-// TestClassifyHeightRepair locks the init-time reconciliation policy between the
-// proposervm finality index and the inner VM's accepted tip.
-//
-// The load-bearing case is heightBehind: proposervm BELOW the inner (e.g. the
-// devnet-C "index 7 < inner 8" from a snapshot restored inconsistently across
-// the proposervm and EVM databases). It MUST classify as heightBehind — which
-// the caller turns into a LOUD, actionable fatal — and must NEVER be treated as
-// heightMatch (a no-op that leaves the node inconsistent) or heightAhead (a
-// rollback). It must in particular never be "self-healed" by dropping the
-// finality pointer: that leaves proposervm.LastAccepted() in the inner-id
-// namespace and permanently wedges bootstrap/catch-up/live at the inner tip.
-// A regression back to that silent reset would have to reclassify this case and
-// fail here.
-func TestClassifyHeightRepair(t *testing.T) {
-	tests := []struct {
-		name                   string
-		proHeight, innerHeight uint64
-		want                   heightRelation
-	}{
-		{"heights match => nothing", 8, 8, heightMatch},
-		{"heights match at genesis", 0, 0, heightMatch},
-
-		// The bug-3 case: proposervm index behind the inner tip is unrecoverable
-		// locally and must be a loud fatal, never a silent reset or a rollback.
-		{"behind by one (devnet-C 7<8)", 7, 8, heightBehind},
-		{"behind by many", 100, 4242, heightBehind},
-		{"behind at genesis boundary", 0, 1, heightBehind},
-
-		// Proposervm ahead: the inner rolled back; roll the proposervm back.
-		{"ahead by one", 9, 8, heightAhead},
-		{"ahead by many", 4242, 100, heightAhead},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := classifyHeightRepair(tt.proHeight, tt.innerHeight)
-			if got != tt.want {
-				t.Fatalf("classifyHeightRepair(%d,%d) = %d, want %d",
-					tt.proHeight, tt.innerHeight, got, tt.want)
-			}
-		})
-	}
-
-	// Explicit safety assertion: the behind-index case must be heightBehind (loud
-	// fatal), NEVER heightMatch (silent inconsistency) or heightAhead (rollback).
-	// This is the exact regression RED flagged: a silent finality-pointer reset
-	// here wedges the node forever.
-	if got := classifyHeightRepair(7, 8); got != heightBehind {
-		t.Fatalf("behind-index (7<8) must classify heightBehind (loud fatal), got %d", got)
-	}
-}

vms/proposervm/post_fork_block.go

@@ -35,17 +35,10 @@ func (b *postForkBlock) Height() uint64 {
 }
 
 // Accept:
-// 0) OPTIONAL post-quantum finality gate (dormant by default; see
-//    consensus/quasar). Runs BEFORE the accept commits so a checkpoint that
-//    cannot be PQ-certified post-activation halts WITHOUT persisting — fail
-//    closed. A nil/dormant gate, or a non-checkpoint height, is a no-op.
 // 1) Sets this blocks status to Accepted.
 // 2) Persists this block in storage
 // 3) Calls Reject() on siblings of this block and their descendants.
 func (b *postForkBlock) Accept(ctx context.Context) error {
-	if err := b.vm.verifyQuasarFinality(b); err != nil {
-		return err
-	}
 	if err := b.acceptOuterBlk(); err != nil {
 		return err
 	}
@@ -85,7 +78,7 @@ func (b *postForkBlock) acceptInnerBlk(ctx context.Context) error {
 
 func (b *postForkBlock) Reject(ctx context.Context) error {
 	// We do not reject the inner block here because it may be accepted later
-	b.vm.forgetVerifiedBlock(b.ID())
+	delete(b.vm.verifiedBlocks, b.ID())
 	return nil
 }
 

vms/proposervm/post_fork_option.go

@@ -62,7 +62,7 @@ func (b *postForkOption) Reject(ctx context.Context) error {
 	// we do not reject the inner block here because that block may be contained
 	// in the proposer block that causing this block to be rejected.
 
-	b.vm.forgetVerifiedBlock(b.ID())
+	delete(b.vm.verifiedBlocks, b.ID())
 	return nil
 }
 

vms/proposervm/pre_fork_block.go

@@ -14,7 +14,6 @@ import (
 	"github.com/luxfi/ids"
 	"github.com/luxfi/node/vms/proposervm/block"
 	"github.com/luxfi/node/vms/proposervm/lp181"
-	"github.com/luxfi/node/vms/proposervm/proposer"
 	"github.com/luxfi/runtime"
 	chain "github.com/luxfi/vm/chain"
 )
@@ -221,60 +220,6 @@ func (b *preForkBlock) buildChild(ctx context.Context) (Block, error) {
 		return nil, err
 	}
 
-	// CRITICAL-1: single-proposer transition. The pre-fork → post-fork transition
-	// block (the first post-fork block, child of the last pre-fork block) MUST stay
-	// UNSIGNED — verifyPostForkChild rejects a signed transition
-	// (errChildOfPreForkBlockHasProposer), and an unsigned block carries no
-	// verifiable proposer binding, so the wire format cannot be made single-proposer
-	// by signing it. But WHO builds it can and MUST be gated. Without this gate every
-	// validator builds its OWN unsigned transition block stamped with its LOCAL
-	// wall-clock second (newTimestamp); a fleet that crosses into Ready at different
-	// instants then emits DIFFERENT height-(N+1) blocks → two valid blocks at one
-	// height → a FORK at chain start, which every fresh net (devnet/Zoo/Hanzo) and
-	// every existing-chain upgrade traverses. Gate the builder with the SAME windower
-	// the post-fork path uses (shouldBuildSignedBlockPostDurango): only the elected
-	// proposer for the CURRENT slot builds; as wall-clock advances the eligible set
-	// widens (slot progression), so a down leader does not stall the transition —
-	// liveness is provided by vm.timeToBuild windowing the wait. Non-leaders return
-	// WITHOUT building and adopt the leader's gossiped transition block through the
-	// α-of-K cert path. This makes the HONEST fleet emit exactly ONE transition block.
-	// The residual case — a Byzantine node publishing a competing UNSIGNED transition
-	// block (which verifyPostForkChild still admits, since an unsigned block cannot be
-	// bound to a proposer) — is rendered SAFE by the per-height finality guard (only
-	// one block finalizes at a height) and no longer crashes the fleet (consensus
-	// CRITICAL-2). Correct resolution of ExpectedProposer on a sovereign L1 depends on
-	// CRITICAL-3 (the windower reading the L1's own validator set, not an empty
-	// primary set).
-	childHeight := b.Height() + 1
-	slot := proposer.TimeToSlot(parentTimestamp, newTimestamp)
-	expectedProposerID, err := b.vm.Windower.ExpectedProposer(ctx, childHeight, pChainHeight, slot)
-	switch {
-	case errors.Is(err, proposer.ErrAnyoneCanPropose):
-		// No proposer schedule (empty/degenerate validator set — e.g. K==1, or a
-		// chain whose windower set is not yet populated). Fall through to the legacy
-		// unsigned build: single-proposer cannot hold without a schedule, and
-		// CRITICAL-2 makes the residual equivocation survivable.
-	case err != nil:
-		b.vm.logger.Error("unexpected build block failure",
-			log.String("reason", "failed to calculate expected transition proposer"),
-			log.Stringer("parentID", parentID),
-			log.Err(err),
-		)
-		return nil, err
-	case expectedProposerID != b.vm.rt.NodeID:
-		// Not our turn at this slot — DO NOT build. vm.timeToBuild windows the wait
-		// so we adopt the elected leader's gossiped transition block; a later slot
-		// elects us iff the leader is down.
-		b.vm.logger.Debug("transition build dropped: not our slot",
-			log.Stringer("parentID", parentID),
-			log.Uint64("childHeight", childHeight),
-			log.Uint64("slot", slot),
-			log.Stringer("expectedProposer", expectedProposerID),
-		)
-		return nil, fmt.Errorf("%w: slot %d expects %s", errUnexpectedProposer, slot, expectedProposerID)
-	}
-	// else: we ARE the elected proposer for this slot — build the unsigned block.
-
 	var innerBlock chain.Block
 	if b.vm.blockBuilderVM != nil {
 		// VM supports BuildBlockWithRuntime

vms/proposervm/proposer/windower_determinism_test.go

@@ -1,200 +0,0 @@
-// Copyright (C) 2019-2026, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-// windower_determinism_test.go — the SAFETY/LIVENESS boundary of the proposer
-// schedule, the half that makes the down/wedged/forked-proposer fix BFT-safe.
-//
-// The consensus engine's liveness fix (re-solicit a substitute's block until it
-// finalizes) is only safe because WHICH node is the designated proposer for a slot
-// is DETERMINISTIC across every honest node and rotates per slot:
-//
-//   - DETERMINISM (safety): every honest node computes the IDENTICAL expected
-//     proposer for a given (chainID, height, pChainHeight, slot). So an honest node
-//     accepts a SIGNED block for slot S iff it was signed by ExpectedProposer(S) —
-//     a node proposing OUT OF TURN (before its slot) is rejected by EVERY honest
-//     node (Verify's errUnexpectedProposer). An attacker cannot make nodes disagree
-//     on the eligible proposer and thereby flood competing accepted blocks / fork.
-//
-//   - ROTATION (liveness): consecutive slots designate (in general) DIFFERENT
-//     proposers, so a down/wedged/forked designated proposer for slot S is routed
-//     around: at slot S+1 (5s later) a different validator is designated and builds
-//     a signed block the rest accept. This is avalanchego's Snowman++ mechanism,
-//     byte-for-byte (windower.go is identical to ava's), and the reason a faulty
-//     leader cannot halt the chain.
-//
-// These properties are asserted across many heights, slots, and seeds — not one
-// hand-picked case — so the BFT boundary holds over the input space.
-package proposer
-
-import (
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/luxfi/ids"
-)
-
-// expectedProposerInTurn models the verify-side decision (verifyPostDurangoBlockDelay
-// / shouldBuildSignedBlockPostDurango): a SIGNED block for `slot` is "in turn" iff
-// its signer equals the slot's deterministic designated proposer. Out-of-turn ⇒
-// the proposervm Verify returns errUnexpectedProposer on every honest node.
-func expectedProposerInTurn(t testing.TB, w Windower, height, pChainHeight, slot uint64, signer ids.NodeID) bool {
-	t.Helper()
-	exp, err := w.ExpectedProposer(context.Background(), height, pChainHeight, slot)
-	require.NoError(t, err)
-	return exp == signer
-}
-
-// TestExpectedProposer_DeterministicAcrossInstances proves the SAFETY half: two
-// INDEPENDENT windower instances (modelling two distinct honest nodes, each with
-// its own validator-state object over the SAME set) compute byte-identical expected
-// proposers for every (height, slot). If they could disagree, two honest nodes would
-// accept different signed blocks for one slot → competing accepted blocks → fork.
-func TestExpectedProposer_DeterministicAcrossInstances(t *testing.T) {
-	require := require.New(t)
-	const numValidators = 11
-
-	validatorIDs, vdrStateA := makeValidators(t, numValidators)
-	vdrStateB := makeValidatorState(t, validatorIDs) // independent state, same set
-
-	// Two nodes that agree on chainID + netID must agree on the schedule.
-	nodeA := New(vdrStateA, netID, fixedChainID)
-	nodeB := New(vdrStateB, netID, fixedChainID)
-
-	for height := uint64(0); height < 50; height++ {
-		for slot := uint64(0); slot < 3*MaxLookAheadSlots; slot += 37 { // sample the slot space cheaply
-			pA, err := nodeA.ExpectedProposer(context.Background(), height, 0, slot)
-			require.NoError(err)
-			pB, err := nodeB.ExpectedProposer(context.Background(), height, 0, slot)
-			require.NoError(err)
-			require.Equal(pA, pB,
-				"two honest nodes disagreed on the designated proposer for height=%d slot=%d (%s != %s) — "+
-					"non-deterministic eligibility breaks the BFT boundary (competing accepted blocks / fork)",
-				height, slot, pA, pB)
-
-			// And the designated proposer is always a real member of the set.
-			require.Contains(validatorIDs, pA,
-				"expected proposer %s for height=%d slot=%d is not in the validator set", pA, height, slot)
-		}
-	}
-}
-
-// TestExpectedProposer_DeterministicAcrossSeeds proves determinism is a property of
-// the (chainID, height, slot) inputs, not of any per-instance random state: the same
-// inputs always yield the same proposer, and DIFFERENT chainIDs generally yield a
-// DIFFERENT schedule (so the seed actually mixes chainID — no cross-chain schedule
-// collision an attacker could exploit). Run over many seeds.
-func TestExpectedProposer_DeterministicAcrossSeeds(t *testing.T) {
-	require := require.New(t)
-	validatorIDs, vdrState := makeValidators(t, 21)
-
-	differs := 0
-	const seeds = 64
-	for s := 0; s < seeds; s++ {
-		cid := ids.ID{byte(s), byte(s >> 8), 0x5a}
-		w1 := New(vdrState, netID, cid)
-		w2 := New(makeValidatorState(t, validatorIDs), netID, cid)
-		// Repeat-call determinism + cross-instance determinism for this seed.
-		for slot := uint64(0); slot < 16; slot++ {
-			p1a, err := w1.ExpectedProposer(context.Background(), 7, 0, slot)
-			require.NoError(err)
-			p1b, err := w1.ExpectedProposer(context.Background(), 7, 0, slot)
-			require.NoError(err)
-			p2, err := w2.ExpectedProposer(context.Background(), 7, 0, slot)
-			require.NoError(err)
-			require.Equal(p1a, p1b, "repeated call non-deterministic at seed=%d slot=%d", s, slot)
-			require.Equal(p1a, p2, "cross-instance non-deterministic at seed=%d slot=%d", s, slot)
-			require.Contains(validatorIDs, p1a)
-		}
-		// Compare schedules of consecutive chainIDs at one slot to confirm chainID mixes.
-		if s > 0 {
-			prev := New(vdrState, netID, ids.ID{byte(s - 1), byte((s - 1) >> 8), 0x5a})
-			a, _ := prev.ExpectedProposer(context.Background(), 7, 0, 0)
-			b, _ := w1.ExpectedProposer(context.Background(), 7, 0, 0)
-			if a != b {
-				differs++
-			}
-		}
-	}
-	// The schedule must depend on chainID for the overwhelming majority of seed pairs
-	// (a constant schedule would mean chainID is ignored — a real schedule-collision bug).
-	require.Greater(differs, seeds/2,
-		"chainID barely affects the schedule (%d/%d seed pairs differ) — seed derivation may ignore chainID",
-		differs, seeds)
-}
-
-// TestExpectedProposer_OutOfTurnSignerIsRejected proves the SAFETY boundary the
-// fallback must NOT breach: for every slot, EXACTLY ONE validator is "in turn" (the
-// designated proposer) and EVERY OTHER validator is "out of turn" — so an honest
-// node accepts a signed block for that slot ONLY from the designated proposer and
-// REJECTS an out-of-turn (early / wrong) proposer's signed block. This is the
-// windower half of verifyPostDurangoBlockDelay's errUnexpectedProposer.
-func TestExpectedProposer_OutOfTurnSignerIsRejected(t *testing.T) {
-	require := require.New(t)
-	validatorIDs, vdrState := makeValidators(t, 11)
-	w := New(vdrState, netID, fixedChainID)
-
-	for slot := uint64(0); slot < 64; slot++ {
-		inTurnCount := 0
-		var designated ids.NodeID
-		for _, id := range validatorIDs {
-			if expectedProposerInTurn(t, w, 9, 0, slot, id) {
-				inTurnCount++
-				designated = id
-			}
-		}
-		require.Equal(1, inTurnCount,
-			"slot %d must have EXACTLY ONE in-turn proposer (got %d) — otherwise two signed blocks are both "+
-				"'in turn' and an out-of-turn proposer is accepted (the early-acceptance fork hole)", slot, inTurnCount)
-
-		// Every non-designated validator is out of turn for this slot → its signed
-		// block is rejected by Verify on every honest node.
-		for _, id := range validatorIDs {
-			if id == designated {
-				continue
-			}
-			require.False(expectedProposerInTurn(t, w, 9, 0, slot, id),
-				"validator %s is NOT the designated proposer for slot %d yet was treated as in-turn — "+
-					"an out-of-turn proposal must be rejected", id, slot)
-		}
-	}
-}
-
-// TestExpectedProposer_SlotRotation_RoutesAroundDownProposer proves the LIVENESS
-// half: across a window of consecutive slots the designated proposer rotates over
-// MANY distinct validators, so a single down/wedged/forked designated proposer for
-// one slot is routed around — a later slot designates a healthy validator who builds
-// a signed block the honest majority accepts and finalizes. (This is why a faulty
-// leader cannot halt the chain.)
-func TestExpectedProposer_SlotRotation_RoutesAroundDownProposer(t *testing.T) {
-	require := require.New(t)
-	const numValidators = 11
-	_, vdrState := makeValidators(t, numValidators)
-	w := New(vdrState, netID, fixedChainID)
-
-	// Pick slot 0's designated proposer as the "down/wedged/forked" leader.
-	down, err := w.ExpectedProposer(context.Background(), 13, 0, 0)
-	require.NoError(err)
-
-	// Within a small number of slots after it, a DIFFERENT (healthy) validator must be
-	// designated — i.e. the down leader is routed around quickly. Assert a healthy
-	// substitute appears within the next few slots, and that over a window the schedule
-	// covers most of the set (real rotation, not a stuck single proposer).
-	distinct := map[ids.NodeID]struct{}{}
-	substituteWithin := -1
-	for slot := uint64(0); slot < uint64(numValidators)*3; slot++ {
-		p, err := w.ExpectedProposer(context.Background(), 13, 0, slot)
-		require.NoError(err)
-		distinct[p] = struct{}{}
-		if slot >= 1 && slot <= 5 && p != down && substituteWithin < 0 {
-			substituteWithin = int(slot)
-		}
-	}
-	require.GreaterOrEqual(substituteWithin, 1,
-		"no healthy substitute proposer was designated within 5 slots of the down leader %s — a faulty "+
-			"leader would stall the chain instead of being routed around", down)
-	require.Greater(len(distinct), numValidators/2,
-		"the schedule designated only %d of %d validators over the window — rotation too weak to route around "+
-			"faults", len(distinct), numValidators)
-}

vms/proposervm/tree/tree.go

@@ -7,7 +7,6 @@ import (
 	"context"
 	"maps"
 	"slices"
-	"sync"
 
 	chain "github.com/luxfi/vm/chain"
 	"github.com/luxfi/ids"
@@ -44,12 +43,6 @@ type Tree interface {
 }
 
 type tree struct {
-	// lock guards [nodes]. The proposervm calls Add/Get (during Verify) and
-	// Accept concurrently from the consensus engine's handler goroutines, so
-	// every access to [nodes] must hold this lock. Accept makes block callouts
-	// (Accept/Reject on the inner VM) only AFTER releasing the lock, so this
-	// lock is a leaf lock and cannot deadlock against the inner VM.
-	lock sync.RWMutex
 	// parentID -> childID -> childBlock
 	nodes map[ids.ID]map[ids.ID]chain.Block
 }
@@ -61,9 +54,6 @@ func New() Tree {
 }
 
 func (t *tree) Add(blk chain.Block) {
-	t.lock.Lock()
-	defer t.lock.Unlock()
-
 	parentID := blk.Parent()
 	children, exists := t.nodes[parentID]
 	if !exists {
@@ -74,9 +64,6 @@ func (t *tree) Add(blk chain.Block) {
 }
 
 func (t *tree) Get(blk chain.Block) (chain.Block, bool) {
-	t.lock.RLock()
-	defer t.lock.RUnlock()
-
 	parentID := blk.Parent()
 	children := t.nodes[parentID]
 	originalBlk, exists := children[blk.ID()]
@@ -84,45 +71,36 @@ func (t *tree) Get(blk chain.Block) (chain.Block, bool) {
 }
 
 func (t *tree) Accept(ctx context.Context, blk chain.Block) error {
-	// accept the provided block. This callout is made before any map mutation,
-	// preserving the original semantics: if Accept fails the tree is unchanged.
+	// accept the provided block
 	if err := blk.Accept(ctx); err != nil {
 		return err
 	}
 
-	// Phase 1 (locked, no callouts): detach the accepted block's subtree from
-	// the node map and collect every conflicting block that must be rejected.
-	// Collecting the full reject set under the lock — rather than interleaving
-	// map reads with Reject callouts — is what keeps this lock a leaf lock.
-	t.lock.Lock()
+	// get the siblings of the block
 	parentID := blk.Parent()
 	children := t.nodes[parentID]
 	delete(children, blk.ID())
 	delete(t.nodes, parentID)
 
-	// frontier holds blocks still to be expanded; rejected accumulates the full
-	// set of blocks to reject (each exactly once).
-	frontier := slices.Collect(maps.Values(children))
-	rejected := make([]chain.Block, 0, len(frontier))
-	for len(frontier) > 0 {
-		i := len(frontier) - 1
-		child := frontier[i]
-		frontier = frontier[:i]
+	// mark the siblings of the accepted block as rejectable
+	childrenToReject := slices.Collect(maps.Values(children))
 
-		rejected = append(rejected, child)
+	// reject all the rejectable blocks
+	for len(childrenToReject) > 0 {
+		i := len(childrenToReject) - 1
+		child := childrenToReject[i]
+		childrenToReject = childrenToReject[:i]
 
-		// mark the progeny of this block as being rejectable
-		childID := child.ID()
-		frontier = append(frontier, slices.Collect(maps.Values(t.nodes[childID]))...)
-		delete(t.nodes, childID)
-	}
-	t.lock.Unlock()
-
-	// Phase 2 (unlocked): reject all conflicting blocks via inner-VM callouts.
-	for _, child := range rejected {
+		// reject the block
 		if err := child.Reject(ctx); err != nil {
 			return err
 		}
+
+		// mark the progeny of this block as being rejectable
+		childID := child.ID()
+		children := t.nodes[childID]
+		childrenToReject = append(childrenToReject, slices.Collect(maps.Values(children))...)
+		delete(t.nodes, childID)
 	}
 	return nil
 }

vms/proposervm/tree/tree_race_test.go

@@ -1,105 +0,0 @@
-// Copyright (C) 2019-2025, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package tree
-
-import (
-	"context"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/luxfi/vm/chain/blocktest"
-)
-
-// TestTreeConcurrentAccess hammers the Tree's node map from many goroutines:
-// Add (writes the map) and Get (reads the map) run concurrently with Accept
-// (deletes from the map). The proposervm drives Add/Get during Verify and
-// Accept during commit from the consensus engine's handler goroutines, so the
-// node map is genuinely accessed concurrently. On the pre-fix code the map was
-// unlocked, which the Go runtime aborts with "fatal error: concurrent map read
-// and map write" (and which -race flags as a data race). With the tree lock in
-// place this is clean.
-//
-// Run with -race to guard the fix:
-//
-//	go test -race -run TestTreeConcurrentAccess ./vms/proposervm/tree/
-func TestTreeConcurrentAccess(t *testing.T) {
-	tr := New()
-	ctx := context.Background()
-
-	// Sibling blocks off the genesis: Add/Get all touch the same parent bucket.
-	const n = 64
-	blocks := make([]*blocktest.Block, n)
-	for i := range blocks {
-		blocks[i] = blocktest.BuildChild(blocktest.Genesis)
-	}
-
-	stop := make(chan struct{})
-	var wg sync.WaitGroup
-
-	const writers, readers = 8, 8
-
-	// Writers: Add blocks (map writes).
-	for w := 0; w < writers; w++ {
-		wg.Add(1)
-		go func(seed int) {
-			defer wg.Done()
-			j := seed
-			for {
-				select {
-				case <-stop:
-					return
-				default:
-				}
-				tr.Add(blocks[j%n])
-				j++
-			}
-		}(w)
-	}
-
-	// Readers: Get blocks (map reads).
-	for r := 0; r < readers; r++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			for {
-				select {
-				case <-stop:
-					return
-				default:
-				}
-				for _, b := range blocks {
-					tr.Get(b)
-				}
-			}
-		}()
-	}
-
-	// Accepter: repeatedly builds an isolated parent/child off the genesis, adds
-	// the child, and accepts it — exercising Accept's top-level map insert and
-	// delete against the concurrent Add/Get above. The subtree is unique each
-	// iteration, so it never rejects the readers' blocks.
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		for {
-			select {
-			case <-stop:
-				return
-			default:
-			}
-			parent := blocktest.BuildChild(blocktest.Genesis)
-			child := blocktest.BuildChild(parent)
-			tr.Add(child)
-			if err := tr.Accept(ctx, child); err != nil {
-				t.Errorf("Accept(child): %v", err)
-				return
-			}
-		}
-	}()
-
-	time.Sleep(200 * time.Millisecond)
-	close(stop)
-	wg.Wait()
-}

vms/proposervm/vm.go

@@ -23,7 +23,6 @@ import (
 	"github.com/luxfi/node/cache"
 	"github.com/luxfi/node/cache/lru"
 	"github.com/luxfi/node/cache/metercacher"
-	pqfinality "github.com/luxfi/node/consensus/quasar"
 	"github.com/luxfi/node/vms"
 	"github.com/luxfi/runtime"
 	"github.com/luxfi/timer/mockable"
@@ -81,14 +80,6 @@ type VM struct {
 	validatorState validators.State
 	netIDsCache    cache.Cacher[ids.ID, ids.ID] // chainID -> netID cache for GetNetworkID lookups
 
-	// verifiedBlocksLock guards [verifiedBlocks]. The consensus engine drives
-	// the proposervm from multiple goroutines concurrently (e.g. a
-	// PullQuery/Put handler verifying a block — which writes the map — while a
-	// Qbit handler reads the same map via GetBlock), so every access to the map
-	// below must hold this lock. It is a leaf lock: it is never held across a
-	// callout, so it can never participate in a deadlock with [lock], the
-	// [Tree], or the inner VM.
-	verifiedBlocksLock sync.RWMutex
 	// Block ID --> Block
 	// Each element is a block that passed verification but
 	// hasn't yet been accepted/rejected
@@ -120,41 +111,6 @@ type VM struct {
 	// lastAcceptedTimestampGaugeVec reports timestamps for the last-accepted
 	// [postForkBlock] and its inner block.
 	lastAcceptedTimestampGaugeVec metric.GaugeVec
-
-	// quasarGate is the OPTIONAL post-quantum finality-cert gate. nil (the
-	// default) means PQ-finality verification is OFF — the accept path is
-	// unchanged classical Snow. When set AND forward-dated activation is reached,
-	// it requires a valid QuasarCert at every checkpoint and fails closed. See
-	// consensus/quasar.
-	quasarGate *pqfinality.Gate
-}
-
-// SetQuasarGate installs the post-quantum finality gate. Called once at chain
-// wiring time when PQ-finality config is present; left unset (nil) otherwise so
-// the accept path stays classical. Idempotent, set before consensus starts.
-func (vm *VM) SetQuasarGate(g *pqfinality.Gate) { vm.quasarGate = g }
-
-// verifyQuasarFinality is the accept-path hook for one finalized post-fork
-// block. It is nil-safe and dormant-by-default: with no gate, or pre-activation,
-// or off a checkpoint height, it returns nil and the block finalizes on the
-// classical path unchanged. Post-activation at a checkpoint it requires a valid
-// QuasarCert bound to this block and returns the verification error otherwise
-// (fail closed — the caller surfaces it from Accept).
-//
-// BlockID binds the proposervm block id (the accepted block at this layer);
-// StateRoot is left zero here (committed transitively through the block id), so
-// the cert's StateRoot binding is not cross-checked at this layer.
-func (vm *VM) verifyQuasarFinality(b *postForkBlock) error {
-	// Fast path: no gate (the default) => zero cost, no block-accessor calls, no
-	// checkpoint build. The classical accept path is untouched.
-	if vm.quasarGate == nil {
-		return nil
-	}
-	return vm.quasarGate.VerifyAccepted(pqfinality.Checkpoint{
-		Epoch:   b.PChainEpoch().Number,
-		Height:  b.Height(),
-		BlockID: [32]byte(b.ID()),
-	})
 }
 
 // New performs best when [minBlkDelay] is whole seconds. This is because block
@@ -198,7 +154,7 @@ func (vm *VM) Initialize(
 		return err
 	}
 	vm.State = baseState
-	vm.Windower = vm.newWindower()
+	vm.Windower = proposer.New(vm.validatorState, constants.PrimaryNetworkID, vm.rt.ChainID)
 	vm.Tree = tree.New()
 	registry, ok := vm.Config.Registerer.(metric.Registry)
 	if !ok {
@@ -279,23 +235,6 @@ func (vm *VM) Initialize(
 	return nil
 }
 
-// newWindower builds the proposer-schedule windower bound to the validator-set
-// ID the consensus cert side resolves under: vm.Config.NetworkID, set once by
-// chains/manager.go (constants.PrimaryNetworkID for native chains, else the
-// L1's own chainID). CRITICAL-3: hardcoding PrimaryNetworkID here made a
-// sovereign L1's windower call GetValidatorSet under the wrong ID, get an empty
-// set, degrade to ErrAnyoneCanPropose, and equivocate exactly like the unfixed
-// C-Chain — while diverging from the cert's set. The zero value (ids.Empty) IS
-// constants.PrimaryNetworkID, so a native chain matches the original
-// proposer.New(..., PrimaryNetworkID, ...) byte-for-byte.
-func (vm *VM) newWindower() proposer.Windower {
-	netID := vm.Config.NetworkID
-	if netID == ids.Empty {
-		netID = constants.PrimaryNetworkID
-	}
-	return proposer.New(vm.validatorState, netID, vm.rt.ChainID)
-}
-
 // Shutdown ops then propagate shutdown to innerVM
 func (vm *VM) Shutdown(ctx context.Context) error {
 	if err := vm.db.Commit(); err != nil {
@@ -463,15 +402,10 @@ func (vm *VM) timeToBuild(ctx context.Context) (time.Time, bool, error) {
 	// Because the VM is marked as being in the Ready state, we know
 	// that [VM.SetPreference] must have already been called.
 	blk, err := vm.getPostForkBlock(ctx, vm.preferred)
-	// If the preferred block is pre-fork, the next block is the pre-fork →
-	// post-fork TRANSITION. CRITICAL-1: window WHEN this node builds it (mirroring
-	// the post-fork path) so non-leaders WAIT their slot and adopt the elected
-	// leader's gossiped transition block instead of every validator forwarding to
-	// the inner VM and building its own (the old behavior, which forked the chain
-	// at its start). On no-schedule / unresolvable, this falls back to the legacy
-	// immediate forward.
+	// If the preferred block is pre-fork, we should wait for events on the
+	// innerVM.
 	if err != nil {
-		return vm.timeToBuildPreForkTransitionLocked(ctx)
+		return time.Time{}, false, nil
 	}
 
 	pChainHeight, err := blk.pChainHeight(ctx)
@@ -509,52 +443,6 @@ func (vm *VM) timeToBuild(ctx context.Context) (time.Time, bool, error) {
 	return nextStartTime, true, nil
 }
 
-// timeToBuildPreForkTransitionLocked computes the build window for the pre-fork →
-// post-fork TRANSITION block (the first post-fork block) when the preferred block
-// is still pre-fork. It is the timing half of CRITICAL-1 and mirrors
-// getPostDurangoSlotTime: when this node has a real proposer slot in the schedule
-// it returns that slot's start time (shouldWait=true), so a non-leader waits its
-// slot and adopts the elected leader's gossiped transition block — and a down
-// leader does not stall the chain because the eligible set widens as wall-clock
-// (and therefore the slot) advances. When there is NO schedule
-// (proposer.ErrAnyoneCanPropose — empty/degenerate validator set) or the window
-// cannot be resolved, it preserves the legacy behavior (shouldWait=false → forward
-// to the inner VM and build an unsigned block immediately). Caller holds vm.lock;
-// this only reads (validatorState / windower) and never re-acquires vm.lock.
-func (vm *VM) timeToBuildPreForkTransitionLocked(ctx context.Context) (time.Time, bool, error) {
-	pre, err := vm.getPreForkBlock(ctx, vm.preferred)
-	if err != nil {
-		// Preferred is neither a post-fork nor a resolvable pre-fork block — keep
-		// the legacy immediate-forward behavior.
-		return time.Time{}, false, nil
-	}
-	pChainHeight, err := vm.selectChildPChainHeight(ctx, 0)
-	if err != nil {
-		return time.Time{}, false, nil
-	}
-	var (
-		parentTimestamp = pre.Timestamp()
-		childHeight     = pre.Height() + 1
-		currentTime     = vm.Clock.Time().Truncate(time.Second)
-		slot            = proposer.TimeToSlot(parentTimestamp, currentTime)
-	)
-	// MinDelayForProposer returns the delay until THIS node's earliest slot in the
-	// schedule for (childHeight, pChainHeight). The elected leader's delay is ~0;
-	// a non-leader's delay is its slot offset, so it waits then builds only if the
-	// leader has not already produced the transition block by then.
-	delay, err := vm.Windower.MinDelayForProposer(ctx, childHeight, pChainHeight, vm.rt.NodeID, slot)
-	switch {
-	case err == nil:
-		delay = max(delay, vm.MinBlkDelay)
-		return parentTimestamp.Add(delay), true, nil
-	case errors.Is(err, proposer.ErrAnyoneCanPropose):
-		// No schedule — preserve the legacy immediate forward (unsigned build).
-		return time.Time{}, false, nil
-	default:
-		return time.Time{}, false, nil
-	}
-}
-
 func (vm *VM) getPostDurangoSlotTime(
 	ctx context.Context,
 	blkHeight,
@@ -618,80 +506,14 @@ func (vm *VM) CreateHandlers(ctx context.Context) (map[string]http.Handler, erro
 	return handlers, nil
 }
 
-// heightRelation classifies how the proposervm finality index relates to the
-// inner VM's accepted tip at init. It is the PURE part of the reconciliation and
-// deliberately does NOT depend on the fork height (only the AHEAD case needs the
-// fork height, and it is read lazily in that branch so the other paths gain no
-// new failure mode).
-type heightRelation int
-
-const (
-	// heightMatch: proposervm and inner heights are equal; nothing to repair.
-	heightMatch heightRelation = iota
-	// heightAhead: the proposervm is AHEAD of the inner — the inner rolled back
-	// (or state-synced behind); the proposervm index is rolled back to the inner
-	// height (or, if the target is below the fork, forgotten entirely).
-	heightAhead
-	// heightBehind: the proposervm index is BEHIND the inner tip. This is an
-	// on-disk inconsistency (e.g. a snapshot restored inconsistently across the
-	// proposervm and inner-EVM databases). It is UNRECOVERABLE LOCALLY: the
-	// proposervm cannot fabricate the missing outer wrapper blocks for the heights
-	// (pro, inner], and it must NOT silently drop its finality pointer — doing so
-	// leaves proposervm.LastAccepted() reporting an INNER-namespace id whose
-	// ParentID is contiguity-incompatible with the network's OUTER wrappers, which
-	// permanently wedges bootstrap/catch-up/live at the inner tip (blocks at
-	// height <= tip are skipped, so the missing wrapper is never rebuilt). The
-	// only correct remedy is operator action (restore a consistent snapshot or
-	// full resync), so init fails LOUD with an actionable runbook instead.
-	heightBehind
-)
-
-// classifyHeightRepair is the PURE, deterministically-testable reconciliation
-// decision. Keeping the behind-index case explicit here regression-locks the
-// invariant that a behind index is treated as unrecoverable-locally (a LOUD
-// fatal), never as a silent finality-pointer reset — a reset creates a silent
-// permanent wedge that is strictly worse than the loud crash it would replace.
-func classifyHeightRepair(proHeight, innerHeight uint64) heightRelation {
-	switch {
-	case proHeight == innerHeight:
-		return heightMatch
-	case proHeight < innerHeight:
-		return heightBehind
-	default: // proHeight > innerHeight
-		return heightAhead
-	}
-}
-
 func (vm *VM) repairAcceptedChainByHeight(ctx context.Context) error {
 	innerLastAcceptedID, err := vm.ChainVM.LastAccepted(ctx)
 	if err != nil {
 		return fmt.Errorf("failed to get inner last accepted: %w", err)
 	}
-	// A fresh inner chain that has accepted no block reports the empty ID (some
-	// Lux VMs return ids.Empty before their first acceptance / before genesis is
-	// committed at the moment proposervm initializes). GetBlock(ids.Empty) would
-	// fail, and there is no accepted chain to roll the proposervm index back
-	// against — there is nothing to repair. Mirror the other "nothing to repair"
-	// early returns below. Without this guard, wrapping a fresh chain in
-	// proposervm fails VM initialization and crashes the whole node.
-	if innerLastAcceptedID == ids.Empty {
-		return nil
-	}
 	innerLastAccepted, err := vm.ChainVM.GetBlock(ctx, innerLastAcceptedID)
 	if err != nil {
-		// A fresh / not-yet-committed inner chain can report a last-accepted ID
-		// whose block is not retrievable — e.g. the brand/feature VMs (Q/A/G/K...)
-		// whose genesis references an empty parent, so GetBlock returns
-		// "block 111...LpoYY: not found" even though innerLastAcceptedID is not
-		// itself ids.Empty (so the guard above does not catch it). There is no
-		// accepted chain to roll the proposervm height index back against, so
-		// there is nothing to repair. Without this, wrapping such a chain crashes
-		// the WHOLE node at init ("error creating required chain" → exit 1).
-		vm.logger.Warn("proposervm: inner last-accepted block not retrievable at init; nothing to repair",
-			log.Stringer("innerLastAcceptedID", innerLastAcceptedID),
-			log.Err(err),
-		)
-		return nil
+		return fmt.Errorf("failed to get inner last accepted block: %w", err)
 	}
 	proLastAcceptedID, err := vm.State.GetLastAccepted()
 	if err == database.ErrNotFound {
@@ -709,66 +531,12 @@ func (vm *VM) repairAcceptedChainByHeight(ctx context.Context) error {
 
 	proLastAcceptedHeight := proLastAccepted.Height()
 	innerLastAcceptedHeight := innerLastAccepted.Height()
-
-	switch classifyHeightRepair(proLastAcceptedHeight, innerLastAcceptedHeight) {
-	case heightMatch:
-		// Heights match — nothing to repair.
+	if proLastAcceptedHeight < innerLastAcceptedHeight {
+		return fmt.Errorf("proposervm height index (%d) should never be lower than the inner height index (%d)", proLastAcceptedHeight, innerLastAcceptedHeight)
+	}
+	if proLastAcceptedHeight == innerLastAcceptedHeight {
+		// There is nothing to repair - as the heights match
 		return nil
-
-	case heightBehind:
-		// INVARIANT VIOLATION and UNRECOVERABLE LOCALLY: the proposervm's finality
-		// index sits BELOW the inner VM's accepted tip. In a correct system this
-		// never happens — the proposervm last-accepted pointer and height index
-		// commit in the SAME versiondb batch as every inner accept, so they cannot
-		// lag. Reaching here means the on-disk proposervm state was truncated
-		// relative to the inner EVM — e.g. a snapshot restored inconsistently across
-		// the two databases (the devnet-C "index 7 < inner 8").
-		//
-		// We FAIL LOUD rather than "self-heal", because there is no correct local
-		// heal: the proposervm cannot fabricate the missing outer wrapper blocks for
-		// heights (pro, inner]. In particular, dropping the finality pointer
-		// (DeleteLastAccepted) is NOT a heal — proposervm.LastAccepted() would then
-		// fall back to the inner-namespace id (see LastAccepted), whose ParentID is
-		// contiguity-incompatible with the network's OUTER wrappers, permanently
-		// wedging bootstrap (the first-block anchor), catch-up (the parent==tip
-		// guard) and live Verify (the parent lookup) at the inner tip — and since
-		// every path skips blocks at height <= the tip, the missing wrapper is never
-		// rebuilt. That silent wedge is strictly worse than this loud, actionable
-		// stop. The correct remedy is operator action; surface it explicitly.
-		return fmt.Errorf(
-			"proposervm finality index (height %d, id %s) is BEHIND the inner VM tip (height %d, id %s): "+
-				"the on-disk proposervm state is truncated/inconsistent relative to the inner EVM "+
-				"(e.g. a snapshot restored inconsistently across the proposervm and EVM databases). "+
-				"This cannot be repaired locally — the proposervm cannot rebuild the missing outer wrapper "+
-				"blocks. RECOVERY: restore a snapshot that is consistent across BOTH databases, or fully "+
-				"resync this node from peers (wipe this chain's db and re-bootstrap). Refusing to auto-reset "+
-				"the finality pointer, which would silently wedge this node at the inner tip forever",
-			proLastAcceptedHeight, proLastAcceptedID, innerLastAcceptedHeight, innerLastAcceptedID,
-		)
-	}
-
-	// heightAhead: the inner vm is BEHIND the proposer vm (the inner rolled back or
-	// state-synced behind), so roll the proposervm index back to the inner height.
-	// The fork height is only needed here, so read it lazily — the match/behind
-	// paths above never touch it, and so cannot gain a new failure mode from it.
-	forkHeight, err := vm.State.GetForkHeight()
-	if err != nil {
-		return fmt.Errorf("failed to get fork height: %w", err)
-	}
-
-	if forkHeight > innerLastAcceptedHeight {
-		// We are rolling back past the fork, so we should just forget about all of
-		// our proposervm indices. The inner tip is BELOW the fork, so it is a
-		// pre-fork block and proposervm.LastAccepted() correctly falls back to it.
-		vm.logger.Info("repairing accepted chain by height: rolling back past the proposervm fork",
-			log.Uint64("outerHeight", proLastAcceptedHeight),
-			log.Uint64("innerHeight", innerLastAcceptedHeight),
-			log.Uint64("forkHeight", forkHeight),
-		)
-		if err := vm.State.DeleteLastAccepted(); err != nil {
-			return fmt.Errorf("failed to delete last accepted: %w", err)
-		}
-		return vm.db.Commit()
 	}
 
 	vm.logger.Info("repairing accepted chain by height",
@@ -776,6 +544,22 @@ func (vm *VM) repairAcceptedChainByHeight(ctx context.Context) error {
 		log.Uint64("innerHeight", innerLastAcceptedHeight),
 	)
 
+	// The inner vm must be behind the proposer vm, so we must roll the
+	// proposervm back.
+	forkHeight, err := vm.State.GetForkHeight()
+	if err != nil {
+		return fmt.Errorf("failed to get fork height: %w", err)
+	}
+
+	if forkHeight > innerLastAcceptedHeight {
+		// We are rolling back past the fork, so we should just forget about all
+		// of our proposervm indices.
+		if err := vm.State.DeleteLastAccepted(); err != nil {
+			return fmt.Errorf("failed to delete last accepted: %w", err)
+		}
+		return vm.db.Commit()
+	}
+
 	newProLastAcceptedID, err := vm.State.GetBlockIDAtHeight(innerLastAcceptedHeight)
 	if err != nil {
 		// This fatal error can happen if NumHistoricalBlocks is set too
@@ -897,33 +681,9 @@ func (vm *VM) getBlock(ctx context.Context, id ids.ID) (Block, error) {
 	return vm.getPreForkBlock(ctx, id)
 }
 
-// cachedVerifiedBlock returns the verified-but-not-yet-decided block for
-// [blkID] if it is currently held in the verified set. Concurrency-safe.
-func (vm *VM) cachedVerifiedBlock(blkID ids.ID) (PostForkBlock, bool) {
-	vm.verifiedBlocksLock.RLock()
-	defer vm.verifiedBlocksLock.RUnlock()
-	blk, exists := vm.verifiedBlocks[blkID]
-	return blk, exists
-}
-
-// recordVerifiedBlock adds [blk] to the verified set after it passes
-// verification. Concurrency-safe.
-func (vm *VM) recordVerifiedBlock(blk PostForkBlock) {
-	vm.verifiedBlocksLock.Lock()
-	defer vm.verifiedBlocksLock.Unlock()
-	vm.verifiedBlocks[blk.ID()] = blk
-}
-
-// forgetVerifiedBlock drops [blkID] from the verified set once it has been
-// accepted or rejected. Concurrency-safe and idempotent.
-func (vm *VM) forgetVerifiedBlock(blkID ids.ID) {
-	vm.verifiedBlocksLock.Lock()
-	defer vm.verifiedBlocksLock.Unlock()
-	delete(vm.verifiedBlocks, blkID)
-}
-
 func (vm *VM) getPostForkBlock(ctx context.Context, blkID ids.ID) (PostForkBlock, error) {
-	if block, exists := vm.cachedVerifiedBlock(blkID); exists {
+	block, exists := vm.verifiedBlocks[blkID]
+	if exists {
 		return block, nil
 	}
 
@@ -972,7 +732,7 @@ func (vm *VM) acceptPostForkBlock(blk PostForkBlock) error {
 	blkID := blk.ID()
 
 	vm.lastAcceptedHeight = height
-	vm.forgetVerifiedBlock(blkID)
+	delete(vm.verifiedBlocks, blkID)
 
 	// Persist this block, its height index, and its status
 	if err := vm.State.SetLastAccepted(blkID); err != nil {
@@ -1036,7 +796,7 @@ func (vm *VM) verifyAndRecordInnerBlk(ctx context.Context, blockRuntime *runtime
 	if !previouslyVerified {
 		vm.Tree.Add(innerBlk)
 	}
-	vm.recordVerifiedBlock(postFork)
+	vm.verifiedBlocks[postForkID] = postFork
 	return nil
 }
 

vms/proposervm/vm_verifiedblocks_race_test.go

@@ -1,106 +0,0 @@
-// Copyright (C) 2019-2025, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package proposervm
-
-import (
-	"context"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/luxfi/ids"
-)
-
-// idBlock is a minimal PostForkBlock whose only live method is ID(). The
-// embedded nil PostForkBlock satisfies the rest of the (large) interface so the
-// value is storable in the verified set; the race test never calls any other
-// method on it.
-type idBlock struct {
-	PostForkBlock
-	id ids.ID
-}
-
-func (b idBlock) ID() ids.ID { return b.id }
-
-// TestVerifiedBlocksConcurrentAccess hammers the verified-block set from many
-// goroutines: readers via getPostForkBlock + cachedVerifiedBlock run
-// concurrently with writers via recordVerifiedBlock + forgetVerifiedBlock. This
-// is the unit-level reproduction of the production crash, where a PullQuery/Put
-// handler verifying a block (which writes verifiedBlocks) raced a Qbit handler
-// reading the same map via GetBlock -> getPostForkBlock. On the pre-fix code
-// the map was accessed without a lock, which the Go runtime aborts with
-// "fatal error: concurrent map read and map write" (and which -race flags as a
-// data race). With verifiedBlocksLock in place this is clean.
-//
-// Run with -race to guard the fix:
-//
-//	go test -race -run TestVerifiedBlocksConcurrentAccess ./vms/proposervm/
-func TestVerifiedBlocksConcurrentAccess(t *testing.T) {
-	vm := &VM{
-		verifiedBlocks: make(map[ids.ID]PostForkBlock),
-	}
-
-	// A permanently-present key so getPostForkBlock always takes the fast map
-	// path (a miss would dereference the nil vm.State). The read still races
-	// against concurrent writes to other keys on the unlocked map.
-	permanentID := ids.GenerateTestID()
-	vm.verifiedBlocks[permanentID] = idBlock{id: permanentID}
-
-	// Churn keys mutated by writers (disjoint from the permanent key).
-	churn := make([]ids.ID, 64)
-	for i := range churn {
-		churn[i] = ids.GenerateTestID()
-	}
-
-	ctx := context.Background()
-	stop := make(chan struct{})
-	var wg sync.WaitGroup
-
-	const readers, writers = 8, 8
-
-	for i := 0; i < readers; i++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			for {
-				select {
-				case <-stop:
-					return
-				default:
-				}
-				// Real entry point, fast-path hit on the permanent key.
-				if _, err := vm.getPostForkBlock(ctx, permanentID); err != nil {
-					t.Errorf("getPostForkBlock(permanent): %v", err)
-					return
-				}
-				for _, id := range churn {
-					vm.cachedVerifiedBlock(id)
-				}
-			}
-		}()
-	}
-
-	for i := 0; i < writers; i++ {
-		wg.Add(1)
-		go func(seed int) {
-			defer wg.Done()
-			j := seed
-			for {
-				select {
-				case <-stop:
-					return
-				default:
-				}
-				id := churn[j%len(churn)]
-				vm.recordVerifiedBlock(idBlock{id: id})
-				vm.forgetVerifiedBlock(id)
-				j++
-			}
-		}(i)
-	}
-
-	time.Sleep(200 * time.Millisecond)
-	close(stop)
-	wg.Wait()
-}

vms/rpcchainvm/zap/client.go

@@ -29,15 +29,6 @@ import (
 var (
 	ErrNotConnected    = errors.New("zap: not connected")
 	ErrInvalidResponse = errors.New("zap: invalid response")
-	// errMalformedBlockID is returned when the VM plugin sends a block-id field
-	// over the ZAP boundary whose length is not exactly ids.IDLen (32 bytes).
-	// An empty (0-length) field is the plugin's way of signalling that it could
-	// NOT resolve the block — e.g. the requested block does not connect to this
-	// node's accepted chain (a fork / missing-parent condition). We surface that
-	// as this explicit typed error instead of the opaque "invalid hash length"
-	// from ids.ToID, and we NEVER coerce it to ids.Empty (a 32-byte zero id is a
-	// legitimate value; a 0-length field is not).
-	errMalformedBlockID = errors.New("zap: plugin returned malformed block id (does not connect to accepted chain)")
 )
 
 // Compile-time check that Client implements chain.ChainVM
@@ -48,14 +39,7 @@ type Client struct {
 	conn   *zapwire.Conn
 	logger log.Logger
 
-	// lastAcceptedID caches the plugin's last-accepted block id. SEEDED at Initialize and
-	// REFRESHED on every successful block Accept (setLastAccepted) so LastAccepted() honors the
-	// block.ChainVM contract — return the ACTUAL last-accepted, not a frozen Initialize snapshot.
-	// Before this refresh the cache froze for the process life: a fire-and-forget Accept advanced
-	// the plugin (coreth on-disk) but never the cache, so GetAcceptedFrontier served a stale tip and
-	// any consumer reading VM.LastAccepted was misled. Guarded by lastAcceptedMu because Accept (the
-	// consensus accept goroutine) and LastAccepted (the network/bootstrap goroutines) race.
-	lastAcceptedMu sync.RWMutex
+	// Cached state from Initialize
 	lastAcceptedID ids.ID
 
 	// dbServer is the ZAP-native rpcdb server spawned in Initialize that
@@ -151,29 +135,19 @@ func (c *Client) Initialize(ctx context.Context, init block.Init) error {
 		return fmt.Errorf("zap decode initialize response: %w", err)
 	}
 
-	seedID, err := blockIDFromZAP("lastAcceptedID", resp.LastAcceptedID)
+	c.lastAcceptedID, err = ids.ToID(resp.LastAcceptedID)
 	if err != nil {
 		return err
 	}
-	c.setLastAccepted(seedID)
 
 	c.logger.Info("VM initialized via ZAP",
 		"height", resp.Height,
-		"lastAcceptedID", seedID,
+		"lastAcceptedID", c.lastAcceptedID,
 	)
 
 	return nil
 }
 
-// setLastAccepted refreshes the cached last-accepted id under the write lock. Called at
-// Initialize (seed) and on every successful zapBlock.Accept so the cache tracks the plugin's
-// real accepted tip instead of freezing at the boot snapshot.
-func (c *Client) setLastAccepted(id ids.ID) {
-	c.lastAcceptedMu.Lock()
-	c.lastAcceptedID = id
-	c.lastAcceptedMu.Unlock()
-}
-
 // Shutdown implements chain.ChainVM
 func (c *Client) Shutdown(ctx context.Context) error {
 	_, _, err := c.conn.Call(ctx, zapwire.MsgShutdown, nil)
@@ -271,18 +245,6 @@ func (c *Client) Version(ctx context.Context) (string, error) {
 	return resp.Version, nil
 }
 
-// blockIDFromZAP converts a block-id field returned by the VM plugin over the
-// ZAP boundary into an ids.ID, guarding the malformed/empty case. A well-formed
-// plugin always returns exactly ids.IDLen bytes; any other length (notably the
-// 0-length "could not resolve" signal) yields errMalformedBlockID rather than
-// the opaque ids.ToID "invalid hash length" error, and never a coerced zero id.
-func blockIDFromZAP(field string, b []byte) (ids.ID, error) {
-	if len(b) != ids.IDLen {
-		return ids.Empty, fmt.Errorf("%w: %s was %d bytes, want %d", errMalformedBlockID, field, len(b), ids.IDLen)
-	}
-	return ids.ToID(b)
-}
-
 // BuildBlock implements chain.ChainVM
 func (c *Client) BuildBlock(ctx context.Context) (block.Block, error) {
 	_, respData, err := c.conn.Call(ctx, zapwire.MsgBuildBlock, nil)
@@ -299,11 +261,11 @@ func (c *Client) BuildBlock(ctx context.Context) (block.Block, error) {
 		return nil, errorFromZAP(resp.Err)
 	}
 
-	id, err := blockIDFromZAP("id", resp.ID)
+	id, err := ids.ToID(resp.ID)
 	if err != nil {
 		return nil, err
 	}
-	parentID, err := blockIDFromZAP("parentID", resp.ParentID)
+	parentID, err := ids.ToID(resp.ParentID)
 	if err != nil {
 		return nil, err
 	}
@@ -342,11 +304,11 @@ func (c *Client) ParseBlock(ctx context.Context, blockBytes []byte) (block.Block
 		return nil, errorFromZAP(resp.Err)
 	}
 
-	id, err := blockIDFromZAP("id", resp.ID)
+	id, err := ids.ToID(resp.ID)
 	if err != nil {
 		return nil, err
 	}
-	parentID, err := blockIDFromZAP("parentID", resp.ParentID)
+	parentID, err := ids.ToID(resp.ParentID)
 	if err != nil {
 		return nil, err
 	}
@@ -385,7 +347,7 @@ func (c *Client) GetBlock(ctx context.Context, blkID ids.ID) (block.Block, error
 		return nil, errorFromZAP(resp.Err)
 	}
 
-	parentID, err := blockIDFromZAP("parentID", resp.ParentID)
+	parentID, err := ids.ToID(resp.ParentID)
 	if err != nil {
 		return nil, err
 	}
@@ -414,11 +376,8 @@ func (c *Client) SetPreference(ctx context.Context, blkID ids.ID) error {
 	return err
 }
 
-// LastAccepted implements chain.ChainVM. Returns the cache refreshed on every Accept (NOT a
-// frozen Initialize snapshot) under the read lock.
+// LastAccepted implements chain.ChainVM
 func (c *Client) LastAccepted(ctx context.Context) (ids.ID, error) {
-	c.lastAcceptedMu.RLock()
-	defer c.lastAcceptedMu.RUnlock()
 	return c.lastAcceptedID, nil
 }
 
@@ -613,7 +572,7 @@ func (c *Client) GetBlockIDAtHeight(ctx context.Context, height uint64) (ids.ID,
 		return ids.Empty, errorFromZAP(resp.Err)
 	}
 
-	blkID, err := blockIDFromZAP("blkID", resp.BlkID)
+	blkID, err := ids.ToID(resp.BlkID)
 	if err != nil {
 		return ids.Empty, err
 	}
@@ -684,13 +643,8 @@ func (b *zapBlock) Accept(ctx context.Context) error {
 	defer zapwire.PutBuffer(buf)
 	req.Encode(buf)
 
-	if _, _, err := b.client.conn.Call(ctx, zapwire.MsgBlockAccept, buf.Bytes()); err != nil {
-		return err
-	}
-	// Refresh the cache so LastAccepted() reflects this accept instead of freezing at the
-	// Initialize snapshot. Only on SUCCESS — a failed accept did not advance the plugin.
-	b.client.setLastAccepted(b.id)
-	return nil
+	_, _, err := b.client.conn.Call(ctx, zapwire.MsgBlockAccept, buf.Bytes())
+	return err
 }
 
 func (b *zapBlock) Reject(ctx context.Context) error {

vms/rpcchainvm/zap/client_lastaccepted_test.go

@@ -1,100 +0,0 @@
-// Copyright (C) 2026, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package zap
-
-import (
-	"context"
-	"errors"
-	"testing"
-	"time"
-
-	zapwire "github.com/luxfi/api/zap"
-	"github.com/luxfi/consensus/engine/chain/block"
-	"github.com/luxfi/ids"
-	"github.com/luxfi/log"
-	luxruntime "github.com/luxfi/runtime"
-)
-
-// TestLastAccepted_RefreshedOnAccept is the option-(b) regression guard: the ZAP client's
-// LastAccepted() must reflect the most-recently-ACCEPTED block, not a frozen Initialize snapshot.
-//
-// THE BUG (red HIGH-1 root): zapBlock.Accept fired the MsgBlockAccept wire call but never refreshed
-// c.lastAcceptedID, which was written ONLY at Initialize — so LastAccepted() returned the boot id
-// for the process life even as the plugin (coreth on-disk) advanced. Every consumer of
-// VM.LastAccepted was misled: GetAcceptedFrontier served a stale tip to peers, and the bootstrap
-// caught-up/height signals (before the option-a ledger decomplect) re-descended forever.
-//
-// This drives a real in-process ZAP server: Initialize seeds the cache, a successful Accept must
-// refresh it to the accepted id, and a FAILED Accept must leave it unchanged (a failed accept did
-// not advance the plugin).
-func TestLastAccepted_RefreshedOnAccept(t *testing.T) {
-	seedID := ids.ID{0x5e, 0xed}
-	acceptedID := ids.ID{0xac, 0xce, 0x97, 0xed}
-	failID := ids.ID{0xfa, 0x11}
-
-	var failAccept bool
-	addr, stop := startTestServer(t, zapwire.HandlerFunc(func(_ context.Context, msgType zapwire.MessageType, _ []byte) (zapwire.MessageType, []byte, error) {
-		switch msgType {
-		case zapwire.MsgInitialize:
-			var zeroParent ids.ID
-			resp := &zapwire.InitializeResponse{
-				LastAcceptedID:       seedID[:],
-				LastAcceptedParentID: zeroParent[:],
-				Height:               0,
-				Bytes:                []byte{},
-				Timestamp:            time.Now().UnixNano(),
-			}
-			buf := zapwire.GetBuffer()
-			defer zapwire.PutBuffer(buf)
-			resp.Encode(buf)
-			out := make([]byte, len(buf.Bytes()))
-			copy(out, buf.Bytes())
-			return zapwire.MsgInitialize, out, nil
-		case zapwire.MsgBlockAccept:
-			if failAccept {
-				return 0, nil, errors.New("synthesized accept failure")
-			}
-			return zapwire.MsgBlockAccept, []byte{}, nil
-		default:
-			return 0, nil, errors.New("unexpected message")
-		}
-	}))
-	defer stop()
-
-	conn, err := zapwire.Dial(context.Background(), addr, nil)
-	if err != nil {
-		t.Fatalf("Dial: %v", err)
-	}
-	defer conn.Close()
-
-	c := NewClient(conn, log.NewNoOpLogger())
-	if err := c.Initialize(context.Background(), block.Init{
-		Runtime: &luxruntime.Runtime{NetworkID: 1337},
-		Genesis: []byte("{}"),
-	}); err != nil {
-		t.Fatalf("Initialize: %v", err)
-	}
-
-	// Seeded at Initialize.
-	if got, _ := c.LastAccepted(context.Background()); got != seedID {
-		t.Fatalf("after Initialize: LastAccepted = %s, want seed %s", got, seedID)
-	}
-
-	// A successful Accept REFRESHES the cache (the fix — previously it stayed frozen at seed).
-	if err := (&zapBlock{client: c, id: acceptedID}).Accept(context.Background()); err != nil {
-		t.Fatalf("Accept: %v", err)
-	}
-	if got, _ := c.LastAccepted(context.Background()); got != acceptedID {
-		t.Fatalf("after Accept: LastAccepted = %s, want accepted %s (cache did not refresh — the freeze)", got, acceptedID)
-	}
-
-	// A FAILED Accept must NOT move the cache (the plugin did not advance).
-	failAccept = true
-	if err := (&zapBlock{client: c, id: failID}).Accept(context.Background()); err == nil {
-		t.Fatal("expected the synthesized accept failure to surface")
-	}
-	if got, _ := c.LastAccepted(context.Background()); got != acceptedID {
-		t.Fatalf("after FAILED Accept: LastAccepted = %s, want unchanged %s", got, acceptedID)
-	}
-}

vms/rpcchainvm/zap/client_parseblock_test.go

@@ -1,155 +0,0 @@
-// Copyright (C) 2026, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package zap
-
-import (
-	"context"
-	"errors"
-	"testing"
-	"time"
-
-	zapwire "github.com/luxfi/api/zap"
-	"github.com/luxfi/consensus/engine/chain/block"
-	"github.com/luxfi/ids"
-	"github.com/luxfi/log"
-)
-
-// TestParseBlock_MalformedBlockID_IsTypedAndQuarantined is the regression guard
-// for the mainnet luxd-3 wedge (C-Chain height 1082797 fork).
-//
-// THE OBSERVED SYMPTOM: luxd-3 spammed
-//
-//	warn ParseBlock failed, cannot vote correctly
-//	     error="invalid hash length: expected 32 bytes but got 0"
-//
-// ROOT of that surfacing: the C-Chain EVM (coreth) runs as an rpcchainvm plugin
-// across the ZAP boundary. When luxd-3 (sitting on a divergent, already-accepted
-// fork block at 1082797) is asked via PushQuery to ParseBlock a CANONICAL block
-// that does not connect to its forked chain, the plugin answers with a
-// BlockResponse whose ID/ParentID are EMPTY (0-length) and whose Err is left at
-// ErrorUnspecified. The old client passed that empty slice straight into
-// ids.ToID, which returned the opaque "invalid hash length: expected 32 bytes
-// but got 0" — masking the real "does-not-connect" condition.
-//
-// The wire codec (github.com/luxfi/api/zap BlockResponse) genuinely admits a
-// 0-length ID/ParentID: both are length-prefixed []byte read via ReadBytes, and
-// Err defaults to ErrorUnspecified, so an empty-id response slips past the
-// `resp.Err != ErrorUnspecified` guard. This test reproduces that exact wire
-// shape (not a hand-fabricated convenience) and asserts the hardened behavior:
-//
-//   - a 0-length (or any non-32-byte) id yields the explicit typed
-//     errMalformedBlockID, NOT the opaque ids.ToID error;
-//   - ParseBlock returns a nil block (no state advance, no zero-id coercion);
-//   - ParseBlock never panics on the malformed field;
-//   - a well-formed 32-byte response — INCLUDING a 32-zero-byte ParentID, which
-//     is the legitimate ids.Empty value and must NOT be confused with the
-//     0-length malformed case — still parses cleanly.
-//
-// Run under -race.
-func TestParseBlock_MalformedBlockID_IsTypedAndQuarantined(t *testing.T) {
-	goodID := ids.ID{0x11, 0x22, 0x33}     // a valid, non-empty 32-byte id
-	goodParent := ids.ID{0xaa, 0xbb, 0xcc} // a valid, non-empty 32-byte parent
-	zeroParent := ids.Empty                // 32 ZERO bytes — a legitimate id value
-
-	cases := []struct {
-		name    string
-		resp    *zapwire.BlockResponse
-		wantErr bool
-	}{
-		{
-			// The literal luxd-3 wedge: empty id, no error code.
-			name:    "empty id with no error code (the luxd-3 wedge shape)",
-			resp:    &zapwire.BlockResponse{ID: nil, ParentID: goodParent[:], Bytes: []byte{0xde, 0xad}, Err: zapwire.ErrorUnspecified},
-			wantErr: true,
-		},
-		{
-			name:    "empty parentID with no error code",
-			resp:    &zapwire.BlockResponse{ID: goodID[:], ParentID: nil, Bytes: []byte{0xde, 0xad}, Err: zapwire.ErrorUnspecified},
-			wantErr: true,
-		},
-		{
-			// Malleability: any non-32 length must be rejected, not truncated/padded.
-			name:    "short 5-byte id is rejected (length malleability guard)",
-			resp:    &zapwire.BlockResponse{ID: []byte{1, 2, 3, 4, 5}, ParentID: goodParent[:], Bytes: []byte{0xde, 0xad}, Err: zapwire.ErrorUnspecified},
-			wantErr: true,
-		},
-		{
-			// Well-formed: 32-byte id + 32-ZERO-byte parent (legit ids.Empty) parses.
-			name:    "well-formed 32-byte ids, zero-but-32-byte parent parses cleanly",
-			resp:    &zapwire.BlockResponse{ID: goodID[:], ParentID: zeroParent[:], Bytes: []byte{0xde, 0xad}, Height: 7, Timestamp: time.Now().UnixNano(), Err: zapwire.ErrorUnspecified},
-			wantErr: false,
-		},
-	}
-
-	for _, tc := range cases {
-		tc := tc
-		t.Run(tc.name, func(t *testing.T) {
-			c := newParseBlockTestClient(t, tc.resp)
-
-			var (
-				blk block.Block
-				err error
-			)
-			// Must never panic regardless of the malformed field.
-			func() {
-				defer func() {
-					if r := recover(); r != nil {
-						t.Fatalf("ParseBlock panicked on malformed response: %v", r)
-					}
-				}()
-				blk, err = c.ParseBlock(context.Background(), []byte{0xde, 0xad})
-			}()
-
-			if tc.wantErr {
-				if !errors.Is(err, errMalformedBlockID) {
-					t.Fatalf("want typed errMalformedBlockID, got %v", err)
-				}
-				if blk != nil {
-					t.Fatalf("malformed id must yield a nil block (no state advance / no zero-id coercion), got %v", blk)
-				}
-				return
-			}
-			if err != nil {
-				t.Fatalf("well-formed response must parse, got err: %v", err)
-			}
-			if blk == nil {
-				t.Fatal("well-formed response must yield a non-nil block")
-			}
-			if blk.ID() != goodID {
-				t.Fatalf("block id = %s, want %s", blk.ID(), goodID)
-			}
-			if blk.Parent() != zeroParent {
-				t.Fatalf("parent id = %s, want %s (the legitimate 32-byte zero id)", blk.Parent(), zeroParent)
-			}
-		})
-	}
-}
-
-// newParseBlockTestClient spins an in-process ZAP server whose MsgParseBlock
-// handler returns the supplied BlockResponse verbatim — modelling exactly what
-// a VM plugin (coreth over rpcchainvm) puts on the wire — and returns a Client
-// connected to it.
-func newParseBlockTestClient(t *testing.T, resp *zapwire.BlockResponse) *Client {
-	t.Helper()
-	addr, stop := startTestServer(t, zapwire.HandlerFunc(func(_ context.Context, msgType zapwire.MessageType, _ []byte) (zapwire.MessageType, []byte, error) {
-		if msgType != zapwire.MsgParseBlock {
-			return 0, nil, errors.New("unexpected message")
-		}
-		buf := zapwire.GetBuffer()
-		defer zapwire.PutBuffer(buf)
-		resp.Encode(buf)
-		out := make([]byte, len(buf.Bytes()))
-		copy(out, buf.Bytes())
-		return zapwire.MsgParseBlock, out, nil
-	}))
-	t.Cleanup(stop)
-
-	conn, err := zapwire.Dial(context.Background(), addr, nil)
-	if err != nil {
-		t.Fatalf("Dial: %v", err)
-	}
-	t.Cleanup(func() { _ = conn.Close() })
-
-	return NewClient(conn, log.NewNoOpLogger())
-}

vms/types/fee/policy.go

@@ -43,13 +43,6 @@ import (
 // bound when reviewing/upgrading per-VM policies; not enforced inside
 // Validate (a VM is free to charge MORE), but every VM choosing less
 // will be flagged by the migration checklist.
-//
-// Known intentional exception: the X-Chain (xvm) prices transactions through
-// its own UTXO fee subsystem (xvm/config.go TxFee, default 1000 nLUX), NOT the
-// FlatPolicy here, and is deliberately outside this floor — its high-throughput
-// UTXO economics are set independently of the account-model FlatPolicy floor.
-// This is by design, not a migration miss; do not "fix" it by raising xvm
-// TxFee to MinTxFeeFloor.
 const MinTxFeeFloor uint64 = 1_000_000
 
 // Sentinel errors returned by Policy implementations.

vms/xvm/health.go

@@ -3,21 +3,8 @@
 
 package xvm
 
-import (
-	"context"
+import "context"
 
-	"github.com/luxfi/node/version"
-	chain "github.com/luxfi/vm/chain"
-)
-
-// HealthCheck reports the VM's health to the consensus engine. It returns a
-// chain.HealthResult (= block.HealthCheckResult) so *VM satisfies the linear
-// chain.ChainVM interface used by the certificate path.
-func (vm *VM) HealthCheck(context.Context) (chain.HealthResult, error) {
-	return chain.HealthResult{
-		Healthy: vm.onShutdownCtx == nil || vm.onShutdownCtx.Err() == nil,
-		Details: map[string]string{
-			"version": version.Current.String(),
-		},
-	}, nil
+func (*VM) HealthCheck(context.Context) (interface{}, error) {
+	return nil, nil
 }

vms/xvm/state/xvmroot/xvmroot.go

@@ -10,7 +10,7 @@
 // keccak256 composition for the final execution_root.
 //
 // The root is a pure function of the canonical leaf FIELD VALUES, not of any
-// in-memory struct. The xvm executor's UTXO/Asset/Tx types are UTXO-style
+// in-memory struct. The xvm executor's UTXO/Asset/Tx types are Avalanche-style
 // (output interfaces, codec-serialized) and deliberately do NOT share the GPU's
 // flat packed layout; the accelerator hashes a state-snapshot layout. So this
 // package consumes that snapshot layout directly — UTXOLeaf, AssetLeaf, TxLeaf

vms/xvm/tx.go

@@ -0,0 +1,161 @@
+// Copyright (C) 2019-2025, Lux Industries Inc. All rights reserved.
+// See the file LICENSE for licensing terms.
+
+package xvm
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/luxfi/log"
+
+	"github.com/luxfi/consensus/core/choices"
+	"github.com/luxfi/consensus/engine/dag"
+	"github.com/luxfi/database"
+	"github.com/luxfi/ids"
+	"github.com/luxfi/math/set"
+	"github.com/luxfi/node/vms/xvm/txs"
+	"github.com/luxfi/node/vms/xvm/txs/executor"
+)
+
+var (
+	_ dag.Tx = (*Tx)(nil)
+
+	errTxNotProcessing  = errors.New("transaction is not processing")
+	errUnexpectedReject = errors.New("attempting to reject transaction")
+)
+
+type Tx struct {
+	vm *VM
+	tx *txs.Tx
+}
+
+func (tx *Tx) ID() ids.ID {
+	return tx.tx.ID()
+}
+
+// Height returns the height of this transaction (not used in XVM)
+func (tx *Tx) Height() uint64 {
+	return 0
+}
+
+// Parent returns the parent ID (not used in XVM DAG)
+func (tx *Tx) Parent() ids.ID {
+	return ids.Empty
+}
+
+// ParentIDs returns the IDs of the parent transactions (inputs)
+func (tx *Tx) ParentIDs() []ids.ID {
+	// Return the transaction IDs this transaction depends on
+	parents := []ids.ID{}
+	for _, in := range tx.tx.Unsigned.InputUTXOs() {
+		if in.Symbolic() {
+			continue
+		}
+		txID, _ := in.InputSource()
+		parents = append(parents, txID)
+	}
+	return parents
+}
+
+func (tx *Tx) Accept(ctx context.Context) error {
+	if s := tx.Status(); s != choices.Processing {
+		return fmt.Errorf("%w: %s", errTxNotProcessing, s)
+	}
+
+	tx.vm.onAccept(tx.tx)
+
+	executor := &executor.Executor{
+		Codec:  tx.vm.txBackend.Codec,
+		State:  tx.vm.state,
+		Tx:     tx.tx,
+		Inputs: set.NewSet[ids.ID](0), // Initialize empty set for imported inputs
+	}
+	err := tx.tx.Unsigned.Visit(executor)
+	if err != nil {
+		return fmt.Errorf("error staging accepted state changes: %w", err)
+	}
+
+	tx.vm.state.AddTx(tx.tx)
+
+	commitBatch, err := tx.vm.state.CommitBatch()
+	if err != nil {
+		txID := tx.tx.ID()
+		return fmt.Errorf("couldn't create commitBatch while processing tx %s: %w", txID, err)
+	}
+
+	defer tx.vm.state.Abort()
+	// Convert the atomicRequests to interface{} type for SharedMemory
+	requests := make(map[ids.ID]interface{}, len(executor.AtomicRequests))
+	for chainID, reqs := range executor.AtomicRequests {
+		requests[chainID] = reqs
+	}
+	err = tx.vm.SharedMemory.Apply(
+		requests,
+		commitBatch,
+	)
+	if err != nil {
+		txID := tx.tx.ID()
+		return fmt.Errorf("error committing accepted state changes while processing tx %s: %w", txID, err)
+	}
+
+	return tx.vm.metrics.MarkTxAccepted(tx.tx)
+}
+
+func (*Tx) Reject(ctx context.Context) error {
+	return errUnexpectedReject
+}
+
+func (tx *Tx) Status() choices.Status {
+	txID := tx.tx.ID()
+	_, err := tx.vm.state.GetTx(txID)
+	switch err {
+	case nil:
+		return choices.Accepted
+	case database.ErrNotFound:
+		return choices.Processing
+	default:
+		tx.vm.log.Error("failed looking up tx status",
+			log.Stringer("txID", txID),
+			log.String("error", err.Error()),
+		)
+		return choices.Processing
+	}
+}
+
+func (tx *Tx) MissingDependencies() (set.Set[ids.ID], error) {
+	txIDs := make(set.Set[ids.ID])
+	for _, in := range tx.tx.Unsigned.InputUTXOs() {
+		if in.Symbolic() {
+			continue
+		}
+		txID, _ := in.InputSource()
+
+		_, err := tx.vm.state.GetTx(txID)
+		switch err {
+		case nil:
+			// Tx was already accepted
+		case database.ErrNotFound:
+			txIDs.Add(txID)
+		default:
+			return nil, err
+		}
+	}
+	return txIDs, nil
+}
+
+func (tx *Tx) Bytes() []byte {
+	return tx.tx.Bytes()
+}
+
+func (tx *Tx) Verify(ctx context.Context) error {
+	if s := tx.Status(); s != choices.Processing {
+		return fmt.Errorf("%w: %s", errTxNotProcessing, s)
+	}
+	return tx.tx.Unsigned.Visit(&executor.SemanticVerifier{
+		Backend: tx.vm.txBackend,
+		State:   tx.vm.state,
+		Tx:      tx.tx,
+	})
+}

vms/xvm/vm.go

@@ -19,7 +19,8 @@ import (
 
 	"github.com/luxfi/address"
 	consensusconfig "github.com/luxfi/consensus/config"
-	consensuschain "github.com/luxfi/consensus/engine/chain"
+	"github.com/luxfi/consensus/engine/dag"
+	dagvertex "github.com/luxfi/consensus/engine/dag/vertex"
 	"github.com/luxfi/constants"
 	"github.com/luxfi/container/linked"
 	"github.com/luxfi/database"
@@ -65,17 +66,6 @@ var (
 	errIncompatibleFx            = errors.New("incompatible feature extension")
 	errUnknownFx                 = errors.New("unknown feature extension")
 	errGenesisAssetMustHaveState = errors.New("genesis asset must have non-empty state")
-
-	// Compile-time check that *VM satisfies chain.ChainVM (= block.ChainVM)
-	// AND the consensus engine's BlockBuilder. Together these prove X-Chain
-	// takes the LINEAR ⅔-stake cert path in the chain manager (buildChain →
-	// consensuschain.NewRuntime), not the DAG path. BuildBlock is promoted
-	// from the embedded blockbuilder.Builder (the real linear builder: parent
-	// = preferred, height = parent+1, real timestamp). Do NOT add a
-	// GetEngine() dag.Engine method: that routes the manager's type switch
-	// back to createDAG and bypasses the certificate.
-	_ chain.ChainVM               = (*VM)(nil)
-	_ consensuschain.BlockBuilder = (*VM)(nil)
 )
 
 // BCLookup provides blockchain alias lookup
@@ -125,7 +115,7 @@ type VM struct {
 
 	registerer metrics.Registerer
 
-	connectedPeers map[ids.NodeID]*consensusversion.Application
+	connectedPeers map[ids.NodeID]*version.Application
 
 	parser block.Parser
 
@@ -180,14 +170,21 @@ type VM struct {
 	classicalCompatRegistry auth.ClassicalCompatRegistry
 }
 
-func (vm *VM) Connected(ctx context.Context, nodeID ids.NodeID, nodeVersion *consensusversion.Application) error {
+func (vm *VM) Connected(ctx context.Context, nodeID ids.NodeID, version *version.Application) error {
 	// If the chain isn't linearized yet, we must track the peers externally
 	// until the network is initialized.
 	if vm.network == nil {
-		vm.connectedPeers[nodeID] = nodeVersion
+		vm.connectedPeers[nodeID] = version
 		return nil
 	}
-	return vm.network.Connected(ctx, nodeID, nodeVersion)
+	// Convert to consensus version type
+	consensusVer := &consensusversion.Application{
+		Name:  version.Name,
+		Major: version.Major,
+		Minor: version.Minor,
+		Patch: version.Patch,
+	}
+	return vm.network.Connected(ctx, nodeID, consensusVer)
 }
 
 func (vm *VM) Disconnected(ctx context.Context, nodeID ids.NodeID) error {
@@ -284,7 +281,7 @@ func (vm *VM) initialize(
 	// Get metrics from a global registry or create new one
 	vm.registerer = metric.NewRegistry()
 
-	vm.connectedPeers = make(map[ids.NodeID]*consensusversion.Application)
+	vm.connectedPeers = make(map[ids.NodeID]*version.Application)
 
 	// Initialize metrics as soon as possible
 	vm.metrics, err = xvmmetrics.New(vm.registerer)
@@ -424,7 +421,7 @@ func (vm *VM) SetState(_ context.Context, stateNum uint32) error {
 	}
 }
 
-func (vm *VM) Shutdown(context.Context) error {
+func (vm *VM) Shutdown() error {
 	if vm.state == nil {
 		return nil
 	}
@@ -621,8 +618,15 @@ func (vm *VM) Linearize(ctx context.Context, stopVertexID ids.ID, toEngine chan<
 	}
 
 	// Notify the network of our current peers
-	for nodeID, nodeVersion := range vm.connectedPeers {
-		if err := vm.network.Connected(ctx, nodeID, nodeVersion); err != nil {
+	for nodeID, version := range vm.connectedPeers {
+		// Convert to consensus version type
+		consensusVer := &consensusversion.Application{
+			Name:  version.Name,
+			Major: version.Major,
+			Minor: version.Minor,
+			Patch: version.Patch,
+		}
+		if err := vm.network.Connected(ctx, nodeID, consensusVer); err != nil {
 			return err
 		}
 	}
@@ -654,6 +658,26 @@ func (vm *VM) Linearize(ctx context.Context, stopVertexID ids.ID, toEngine chan<
 	return nil
 }
 
+func (vm *VM) ParseTx(_ context.Context, bytes []byte) (dag.Tx, error) {
+	tx, err := vm.parser.ParseTx(bytes)
+	if err != nil {
+		return nil, err
+	}
+
+	err = tx.Unsigned.Visit(&txexecutor.SyntacticVerifier{
+		Backend: vm.txBackend,
+		Tx:      tx,
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return &Tx{
+		vm: vm,
+		tx: tx,
+	}, nil
+}
+
 /*
  ******************************************************************************
  ********************************** JSON API **********************************
@@ -871,22 +895,19 @@ func (vm *VM) onAccept(tx *txs.Tx) {
 	vm.walletService.decided(txID)
 }
 
-// WaitForEvent blocks until the VM has work for the consensus engine (a
-// pending-tx event) or ctx is cancelled. It returns a vmcore.Message
-// (= block.Message) so *VM satisfies the linear chain.ChainVM interface used by
-// the certificate path.
-func (vm *VM) WaitForEvent(ctx context.Context) (vmcore.Message, error) {
+// WaitForEvent implements the engine.VM interface
+func (vm *VM) WaitForEvent(ctx context.Context) (interface{}, error) {
 	if vm.toEngine == nil {
-		// Before linearization, no events to wait for.
+		// Before linearization, no events to wait for
 		<-ctx.Done()
-		return vmcore.Message{}, ctx.Err()
+		return vmcore.PendingTxs, ctx.Err()
 	}
 
 	select {
-	case msg := <-vm.toEngine:
-		return msg, nil
+	case msgType := <-vm.toEngine:
+		return msgType, nil
 	case <-ctx.Done():
-		return vmcore.Message{}, ctx.Err()
+		return vmcore.PendingTxs, ctx.Err()
 	}
 }
 
@@ -896,6 +917,47 @@ func (vm *VM) NewHTTPHandler(ctx context.Context) (http.Handler, error) {
 	return nil, nil
 }
 
+// BuildVertex builds a new vertex - required for LinearizableVMWithEngine
+func (vm *VM) BuildVertex(ctx context.Context) (dagvertex.Vertex, error) {
+	// XVM doesn't use vertices, it uses blocks
+	return nil, errors.New("XVM does not support vertex building")
+}
+
+// GetVertex gets a vertex by ID - required for LinearizableVMWithEngine
+func (vm *VM) GetVertex(ctx context.Context, vtxID ids.ID) (dagvertex.Vertex, error) {
+	// XVM doesn't use vertices, it uses blocks
+	return nil, errors.New("XVM does not support vertex operations")
+}
+
+// ParseVertex parses vertex bytes - required for LinearizableVMWithEngine
+func (vm *VM) ParseVertex(ctx context.Context, vtxBytes []byte) (dagvertex.Vertex, error) {
+	// XVM doesn't use vertices, it uses blocks
+	return nil, errors.New("XVM does not support vertex parsing")
+}
+
+// GetEngine returns the consensus engine - required for LinearizableVMWithEngine
+func (vm *VM) GetEngine() dag.Engine {
+	// XVM doesn't have a separate engine, return a new DAG engine
+	return dag.New()
+}
+
+// SetEngine sets the consensus engine - required for LinearizableVMWithEngine
+func (vm *VM) SetEngine(engine interface{}) {
+	// XVM doesn't use a separate engine
+}
+
+// GetTx returns a transaction by ID - required for LinearizableVMWithEngine
+func (vm *VM) GetTx(ctx context.Context, txID ids.ID) (dag.Transaction, error) {
+	tx, err := vm.state.GetTx(txID)
+	if err != nil {
+		return nil, err
+	}
+	return &Tx{
+		vm: vm,
+		tx: tx,
+	}, nil
+}
+
 // noOpHandler is a simple no-op implementation of warp.Handler
 type noOpHandler struct{}
 

vms/xvm/vm_security_profile_test.go

@@ -90,7 +90,7 @@ func TestXVMInitialize_WiresSecurityProfileIntoMempool(t *testing.T) {
 			Sender:   &noOpSender{},
 		},
 	))
-	t.Cleanup(func() { _ = vmImpl.Shutdown(context.Background()) })
+	t.Cleanup(func() { _ = vmImpl.Shutdown() })
 
 	// Linearize so the mempool builder is constructed and SetAuthPolicy
 	// has fired with the strict-PQ profile.