cold-join: fix sync throughput + unify height/sync oracle to one source

- block_pipeline: sync-aware apply horizon (DEFERRED_MAX while syncing,
  GOSSIP_HORIZON live) — closes the dispatch(2000)/drop(200) mismatch that
  throttled cold-join catch-up to a rolling-200 crawl
- node: drop residual frontier+180 sync-target ceiling (keep frontier floor)
- collapse sync_blockchain_height to get_max_peer_height (drop TTL/median
  staleness oracle that could collapse to local height)
- remove dead NODE_IS_SYNCHRONIZED atomic + is_node_synchronized/SYNC_SLACK;
  the coordinator FSM is the sole synced authority
- self_synced peer-eviction heuristic -> coordinator_is_synchronized
- remove redundant legacy desync monitor (SyncManager.check_desync covers it)
- identity: fail-closed BIP39 word-count guard (derivation bytes unchanged)
- install-super-node.sh: plumb optional QNET_BURN_TX_HASH

185/185 lib tests, bins build.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: AIQnetLab

development/qnet-integration/src/block_pipeline.rs

@@ -1518,6 +1518,12 @@ impl BlockPipeline {
         const GOSSIP_HORIZON: u64 = 200;
         let mut horizon_cache_h: u64 = 0;
         let mut horizon_cache_age: u32 = 0;
+        // During active sync the dispatcher fills its in-flight window up to
+        // MAX_INFLIGHT (== DEFERRED_MAX). Admit that far ahead so served blocks
+        // land in the deferred buffer instead of being dropped + refetched; on
+        // the live gossip path keep the tight horizon so far-future spam cannot
+        // grow the buffer. Refreshed alongside horizon_cache_h.
+        let mut horizon_cache_syncing = false;
 
         'outer: while let Some(decoded) = rx.recv().await {
             // v15.4 DIAG: a fresh block has just arrived — between recv()
@@ -1536,17 +1542,22 @@ impl BlockPipeline {
             // amortises storage reads while keeping the horizon close to real.
             if horizon_cache_age == 0 {
                 horizon_cache_h = storage.get_chain_height().unwrap_or(0);
+                horizon_cache_syncing = coordinator.snapshot().is_syncing();
             }
             horizon_cache_age = (horizon_cache_age + 1) & 0xF;
 
             // Apply horizon filter at the entry point — never enters deferred
-            // buffer. Drops are non-failure (sync will refetch).
-            if decoded.microblock.height > horizon_cache_h.saturating_add(GOSSIP_HORIZON) {
+            // buffer. Drops are non-failure (sync will refetch). Sync widens the
+            // horizon to DEFERRED_MAX so the dispatcher's in-flight window is
+            // admitted, not dropped — closes the apply-horizon/dispatch mismatch
+            // that throttled cold-join catch-up to a rolling-200 crawl.
+            let horizon = if horizon_cache_syncing { DEFERRED_MAX as u64 } else { GOSSIP_HORIZON };
+            if decoded.microblock.height > horizon_cache_h.saturating_add(horizon) {
                 metrics.future_dropped.fetch_add(1, Ordering::Relaxed);
                 if is_debug() {
                     println!(
-                        "[DBG][PIPELINE] gossip_horizon_drop h={} local_tip={} horizon={}",
-                        decoded.microblock.height, horizon_cache_h, GOSSIP_HORIZON,
+                        "[DBG][PIPELINE] horizon_drop h={} local_tip={} horizon={} syncing={}",
+                        decoded.microblock.height, horizon_cache_h, horizon, horizon_cache_syncing,
                     );
                 }
                 continue;

development/qnet-integration/src/crypto/solana_derivation.rs

@@ -133,6 +133,20 @@ pub fn bip39_seed64(mnemonic: &str) -> [u8; 64] {
     bip39_mnemonic_to_seed(mnemonic)
 }
 
+/// Structural BIP39 guard: reject a seed whose word count is not a valid BIP39
+/// length (12/15/18/21/24) — a paste/typo that would otherwise silently derive
+/// a valid-but-wrong identity (non-genesis nodes have no anchor to catch it).
+/// A correctly-formed mnemonic always has a valid count, so this never rejects
+/// a real seed, and derivation reads the original bytes unchanged (genesis-safe).
+/// Per-word wordlist+checksum validation needs the 2048-word list (follow-up).
+pub fn validate_bip39_structure(mnemonic: &str) -> Result<(), String> {
+    let n = mnemonic.split_whitespace().count();
+    match n {
+        12 | 15 | 18 | 21 | 24 => Ok(()),
+        _ => Err(format!("bip39_word_count={} (expected 12/15/18/21/24)", n)),
+    }
+}
+
 /// PBKDF2-HMAC-SHA512 implementation (RFC 8018).
 fn pbkdf2_hmac_sha512(password: &[u8], salt: &[u8], iterations: u32, output: &mut [u8]) {
     let hlen = 64usize; // SHA-512 output = 64 bytes