registry_root: scalable LtHash + onboarding consensus fixes

registry_root rewritten as an incremental LtHash multiset hash (new
registry_lthash.rs): O(1) maintain + O(1) per-checkpoint-head seal read,
scaling to millions of light nodes. From-scratch fallback (compute_lt_state);
one rebuild scan at boot/snapshot/reorg recomputes lt_state, prunes orphan
roster keys, and refreshes seals. Binds super+light; snapshot recompute-reject
closes the forgeable-snapshot Sybil/fork vector. registry_root carried in the
QC macroblock Checkpoint, enforced in content_ok (gate=0).

Onboarding correctness (producer-inline vs apply parity under gate=0):
- producer mirrors apply first-match-wins: skip Phase2 NodeActivation registry
  rows (closes a registry_root divergence -> finality halt)
- light eligibility bitmap indexed via one shared writer on both apply paths
  (no reward_root divergence at the emission boundary)
- reorg orphan prune: drop reg_height>target roster keys so the unbounded
  reward rosters match a from-genesis node
- NodeActivation proof-of-burn gate at verify + producer pre-filter: an
  activation must be backed by a burn-attested registration (no free identity)

Also lands prior uncommitted work: cbw fork-safety (derived reg_height-bounded
index), 2f+1 committee burn-attestation, genesis vrf_pk seeding, light on-chain
burn onboarding, finality/repair freeze fixes, reward-roster apply-time indices.

184/184 lib tests green; cargo check clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: AIQnetLab

.gitignore

@@ -673,3 +673,6 @@ transactions_export.csv
 infrastructure/nginx/ssl/*.pem
 infrastructure/nginx/ssl/*.key
 infrastructure/nginx/ssl/*.crt
+
+# overnight audit scaffolding + findings (local, do not track)
+audit-overnight/

applications/qnet-mobile/src/components/WalletManager.js

@@ -5509,7 +5509,7 @@ export class WalletManager {
   // v6.0: Create a NodeRegistration TX client-side and submit it to the current producer.
   // Called after /api/v1/light-node/register returns registration_proof.
   // Signing message: "client_node_reg:{node_id}:{wallet_address}:{registration_proof}:{timestamp}"
-  async createAndSubmitNodeRegistrationTx(nodeId, walletAddress, registrationProof, password, dilithiumKeys) {
+  async createAndSubmitNodeRegistrationTx(nodeId, walletAddress, registrationProof, password, dilithiumKeys, burnTxHash, burnAmount, burnWallet) {
     const walletData = await this.loadWallet(password);
     if (!walletData || !walletData.secretKey) {
       throw new Error('Cannot sign NodeRegistration TX: wallet not loaded');
@@ -5542,6 +5542,14 @@ export class WalletManager {
       public_key: publicKeyHex,
     };
 
+    // Option A: carry the Solana 1DEV burn so the server can build a burn-attested ON-CHAIN Light
+    // registration (without it the TX has an empty burn and is hard-rejected at the gate). The burn is
+    // already cryptographically committed by registration_proof = blake3(burn:node_id:wallet)[..32],
+    // so the server binds it by recomputing the proof — no extra signed field is needed.
+    if (burnTxHash) payload.burn_tx_hash = burnTxHash;
+    if (burnAmount) payload.burn_amount = burnAmount;
+    if (burnWallet) payload.burn_wallet = burnWallet;
+
     // Optionally add Dilithium3 signature for post-quantum security
     if (dilithiumKeys) {
       try {
@@ -5826,7 +5834,10 @@ export class WalletManager {
                 walletAddress,
                 registrationResult.registration_proof,
                 password,
-                dilithiumKeys
+                dilithiumKeys,
+                burnTxHash,   // Option A: server embeds the burn + committee attestation into the on-chain TX
+                burnAmount,
+                burnWallet
               );
               console.log('[Registration] NodeRegistration TX submitted:', txResult.tx_hash);
               if (txResult.tx_hash) {

core/qnet-consensus/src/checkpoint_bft.rs

@@ -227,6 +227,12 @@ pub struct Checkpoint {
     /// QC-signed ⇒ 2f+1 certify it ⇒ nodes adopt this root for claims, never a single
     /// producer's unverified value (no Byzantine/lag reward divergence).
     pub reward_root: Hash,
+    /// Deterministic digest of the chain-confirmed Super/genesis registry identity
+    /// (node_id, wallet, reg_height, burn, sha3(vrf_pk)) as of the window head. QC-signed ⇒ 2f+1
+    /// certify the registry, so a node joining via an UNTRUSTED snapshot verifies the restored
+    /// node_registry — the source of cbw and attestor VRF keys — against this committed root,
+    /// closing the forgeable-snapshot Sybil/fork vector.
+    pub registry_root: Hash,
     /// Proposer's wall-clock for this window (the head microblock's timestamp).
     /// In the QC-signed hash ⇒ agreed by the committee ⇒ every node seals an
     /// identical MacroBlock from the checkpoint (no producer dependency, no fork).
@@ -251,6 +257,7 @@ impl Checkpoint {
         h.update(self.beacon);
         h.update(self.epoch_commitment);
         h.update(self.reward_root);
+        h.update(self.registry_root);
         h.update(self.timestamp.to_le_bytes());
         h.update(self.proposer.as_bytes());
         h.finalize().into()
@@ -420,7 +427,7 @@ mod tests {
         let mut c = Checkpoint {
             index: 1, parent_qc: None, window_head_height: 90,
             window_mb_hashes: vec![h(1), h(2)], state_root: h(3),
-            beacon: h(4), epoch_commitment: h(0), reward_root: h(0), timestamp: 0, proposer: "n1".into(), proposer_sig: vec![1,2,3],
+            beacon: h(4), epoch_commitment: h(0), reward_root: h(0), registry_root: h(0), timestamp: 0, proposer: "n1".into(), proposer_sig: vec![1,2,3],
         };
         let x = c.hash();
         c.proposer_sig = vec![9, 9, 9];   // sig change must NOT change hash
@@ -602,7 +609,7 @@ mod tests {
         let child = Checkpoint {
             index: 5, parent_qc: Some(parent_qc), window_head_height: 450,
             window_mb_hashes: vec![h(1)], state_root: h(2), beacon: h(3),
-            epoch_commitment: h(0), reward_root: h(0), timestamp: 0, proposer: "n0".into(), proposer_sig: vec![],
+            epoch_commitment: h(0), reward_root: h(0), registry_root: h(0), timestamp: 0, proposer: "n0".into(), proposer_sig: vec![],
         };
         let child_qc = mk_qc(&committee, child.hash(), 5, 3);
         assert_eq!(commits_parent(&child, &child_qc), Some(4)); // C4 final
@@ -618,7 +625,7 @@ mod tests {
         let c = Checkpoint {
             index: 7, parent_qc: Some(qc.clone()), window_head_height: 630,
             window_mb_hashes: vec![h(1), h(2)], state_root: h(3), beacon: h(4),
-            epoch_commitment: h(0), reward_root: h(0), timestamp: 0, proposer: "n1".into(), proposer_sig: vec![1,2,3],
+            epoch_commitment: h(0), reward_root: h(0), registry_root: h(0), timestamp: 0, proposer: "n1".into(), proposer_sig: vec![1,2,3],
         };
         let bytes = bincode::serialize(&c).unwrap();
         let back: Checkpoint = bincode::deserialize(&bytes).unwrap();

core/qnet-consensus/src/checkpoint_consensus.rs

@@ -229,7 +229,7 @@ mod tests {
         Checkpoint {
             index, parent_qc, window_head_height: index * 10,
             window_mb_hashes: vec![hh(index as u8)], state_root: hh(index as u8),
-            beacon: hh(0), epoch_commitment: hh(0), reward_root: hh(0), timestamp: 0, proposer: c[li].clone(), proposer_sig: Vec::new(),
+            beacon: hh(0), epoch_commitment: hh(0), reward_root: hh(0), registry_root: hh(0), timestamp: 0, proposer: c[li].clone(), proposer_sig: Vec::new(),
         }
     }
 

core/qnet-consensus/src/consensus_crypto.rs

@@ -2094,6 +2094,46 @@ async fn verify_with_real_dilithium(
     }
 }
 
+/// Verify a consensus Dilithium3 signature against an EXPLICIT expected public key, bypassing the
+/// in-RAM CONSENSUS_PK_REGISTRY identity binding. Burn-attestation validation MUST be a pure
+/// function of on-chain state: the registry is RAM-resident + idle-evicted (non-deterministic across
+/// nodes → fork) and its Tier-3 path TOFV-accepts a first-seen PK (forge surface for non-genesis).
+/// Here the PK embedded in the signature MUST equal `expected_pk` (the caller's on-chain key:
+/// load_vrf_public_key, or a pinned genesis anchor); only then is the ML-DSA-65 math run. Same
+/// signature wire format as verify_with_real_dilithium; identity binding is the explicit PK match.
+pub async fn verify_consensus_signature_bound(
+    node_id: &str, message: &str, signature: &str, expected_pk: &[u8],
+) -> bool {
+    use pqcrypto_mldsa::mldsa65 as dilithium3;
+    if !signature.starts_with("dilithium_sig_") { return false; }
+    let part = &signature["dilithium_sig_".len()..];
+    let sep = match part.rfind('_') { Some(p) => p, None => return false };
+    if &part[..sep] != node_id { return false; } // sig carries its claimed id; must match
+    let bytes = match general_purpose::STANDARD.decode(&part[sep + 1..]) { Ok(b) => b, Err(_) => return false };
+    if bytes.len() < 8 { return false; }
+    // Combined format: [sig_len(4)] + [SignedMessage] + [pk_len(4)] + [pk(1952)] (same as verify path).
+    let signed_len = u32::from_le_bytes([bytes[0], bytes[1], bytes[2], bytes[3]]) as usize;
+    if signed_len <= 3309 || 4 + signed_len >= bytes.len() { return false; }
+    let pk_len_start = 4 + signed_len;
+    if pk_len_start + 4 > bytes.len() { return false; }
+    let pk_len = u32::from_le_bytes([
+        bytes[pk_len_start], bytes[pk_len_start + 1], bytes[pk_len_start + 2], bytes[pk_len_start + 3],
+    ]) as usize;
+    let pk_start = pk_len_start + 4;
+    if pk_len != dilithium3::public_key_bytes() || pk_start + pk_len != bytes.len() { return false; }
+    let signed_message_bytes = &bytes[4..4 + signed_len];
+    let public_key_bytes = &bytes[pk_start..pk_start + pk_len];
+    // On-chain identity binding: the embedded PK MUST be the node's registered key. Deterministic
+    // (expected_pk comes from finalized state) and forge-proof (wrong PK rejected before open).
+    if public_key_bytes != expected_pk { return false; }
+    let public_key = match dilithium3::PublicKey::from_bytes(public_key_bytes) { Ok(p) => p, Err(_) => return false };
+    let signed_message = match dilithium3::SignedMessage::from_bytes(signed_message_bytes) { Ok(s) => s, Err(_) => return false };
+    match dilithium3::open(&signed_message, &public_key) {
+        Ok(recovered) => ct_eq(recovered.as_slice(), message.as_bytes()),
+        Err(_) => false,
+    }
+}
+
 /// Constant-time byte slice comparison -- prevents timing side-channel attacks.
 /// Returns true only if slices are equal in length and content.
 /// FIX L-C2ct: Also constant-time for length to prevent length-based timing leaks.

core/qnet-state/src/feature_gates.rs

@@ -11,9 +11,36 @@
 //!   3. deploy the binary to all nodes BEFORE `activation_height`.
 //! Genesis-active rules need no entry — the default is active.
 
-/// (feature id, activation height). Empty on this chain — all current rules are genesis-active.
-/// Heights are hardcoded in the binary, so every node agrees without on-chain governance.
-const ACTIVATIONS: &[(&str, u64)] = &[];
+/// Coordinated activation height for the burn-attestation rule (`burn_attestation_required`):
+/// at/after this height a NON-genesis NodeRegistration must carry a 2f+1 genesis burn-attestation
+/// quorum (verify_burn_attestation_quorum); genesis identities are always exempt (is_legacy_genesis_node).
+/// 0 = active from genesis — correct for a fresh genesis: no Sybil-free window, only the 5 genesis
+/// bypass. Raise to a future height ONLY for a rolling upgrade of a live network, or to defer
+/// activation until the burn flow (live Solana burn + reachable genesis RPC) is ready for non-genesis
+/// onboarding; genesis bootstrap never needs it.
+pub const BURN_ATTESTATION_GATE_HEIGHT: u64 = 0;
+
+/// Coordinated activation height for the registry-root rule (`registry_root_required`): at/after this
+/// height a checkpoint's `registry_root` (deterministic Super/genesis burn-registry digest over
+/// {node_id,wallet,reg_height,burn}) MUST match the validator's independent recompute (consensus
+/// content_ok) AND a snapshot's restored node_registry MUST match the anchor macroblock's committed
+/// registry_root (snapshot binding). This closes the forgeable-snapshot vector for the burn→wallet
+/// binding (an untrusted snapshot server rebinding a burn to its wallet in a transported node_registry).
+/// 0 = ACTIVE FROM GENESIS, symmetric with BURN_ATTESTATION_GATE_HEIGHT — full production from the first
+/// block, no staging window. Safe because registry_root is a pure function of the single chain-apply
+/// writer (save_node_registration_inner: node_id/wallet/reg_height/burn are byte-identical on every
+/// node); it deliberately does NOT hash vrf_pk (that key is not co-resident with the srtr_ row, so
+/// hashing it would split the digest per node). Binding VRF-key integrity into the digest is a separate
+/// follow-up (make vrf_pk_ co-resident with srtr_ first), not a reason to delay the burn-binding defence.
+pub const REGISTRY_ROOT_GATE_HEIGHT: u64 = 0;
+
+/// (feature id, activation height). Heights are hardcoded in the binary, so every node agrees
+/// without on-chain governance. Genesis-active rules need no entry (the default is active);
+/// only rules that must stay dormant until a coordinated height are listed.
+const ACTIVATIONS: &[(&str, u64)] = &[
+    ("burn_attestation_required", BURN_ATTESTATION_GATE_HEIGHT),
+    ("registry_root_required", REGISTRY_ROOT_GATE_HEIGHT),
+];
 
 /// Core gate: active iff `feature` is unlisted (genesis-active default) or `height` has reached
 /// its scheduled activation. Pure ⇒ identical on every node at the same height.
@@ -49,7 +76,21 @@ mod tests {
 
     #[test]
     fn production_registry_all_active() {
-        // No scheduled features on this chain ⇒ every gate active from height 0.
+        // Unlisted rules are genesis-active (default) from height 0.
         assert!(super::is_active("any_current_rule", 0));
     }
+
+    #[test]
+    fn burn_attestation_active_from_genesis() {
+        // gate=0 ⇒ active from block 0: a non-genesis NodeRegistration needs a 2f+1 genesis
+        // burn-attestation immediately. Genesis identities bypass at the call site
+        // (is_legacy_genesis_node), not here. (If re-gated to a future height for a rolling
+        // upgrade, is_active would be false below it — covered by gate_switches_at_activation_height.)
+        assert_eq!(super::BURN_ATTESTATION_GATE_HEIGHT, 0, "active-from-genesis on fresh genesis");
+        assert!(super::is_active("burn_attestation_required", 0), "active from genesis");
+        assert!(super::is_active("burn_attestation_required", 1), "active just after genesis");
+        // No upper bound — the rule stays active at every block height (this is a HEIGHT, not any
+        // registration cap; the network has no limit on the number of registrations).
+        assert!(super::is_active("burn_attestation_required", u64::MAX), "active at the highest possible height");
+    }
 }

core/qnet-state/src/transaction.rs

@@ -352,6 +352,19 @@ pub enum TransactionType {
         /// Light nodes: always empty (privacy protection - mobile apps!)
         #[serde(default)]
         api_endpoint: String,
+        /// Phase-1 proof-of-burn carrier. The external Solana 1DEV burn is non-deterministic (live
+        /// RPC) and cannot be re-checked in apply, so the burn fact is brought ON-CHAIN as a genesis
+        /// quorum: `burn_attestors` carries ≥2f+1 distinct genesis Dilithium signatures over
+        /// `burn_attestation_message(burn_tx, wallet_address, burn_amount, node_type)`, re-verified
+        /// from these bytes at block validation (deterministic, snapshot-independent). Empty for
+        /// genesis identities (registration_proof=="genesis") and when the gate is inactive.
+        #[serde(default)]
+        burn_tx: String,
+        #[serde(default)]
+        burn_amount: u64,
+        /// (genesis_id, dilithium_sig) attestation quorum. Verified, never trusted blindly.
+        #[serde(default)]
+        burn_attestors: Vec<(String, String)>,
     },
 
     /// Create new account
@@ -863,6 +876,19 @@ impl Transaction {
     /// Consistent with `compute_gas_used() == 0` for every variant listed
     /// below (except NodeActivation which uses `gas_limits::NODE_ACTIVATION`
     /// for metering purposes but is still a system TX).
+    /// Canonical message a genesis node signs to attest a Phase-1 Solana 1DEV burn backing a node
+    /// registration. FIXED format (pipe-joined, node_type as a stable integer) so all genesis sign
+    /// identical bytes and every validator recomputes the identical message at block validation —
+    /// no float / locale / map-iteration input. Binds the burn tx, beneficiary wallet, amount and
+    /// node type, so a quorum signature is valid for exactly one (burn, wallet, amount, type) tuple.
+    pub fn burn_attestation_message(burn_tx: &str, wallet: &str, amount: u64, node_type: &NodeType) -> String {
+        let nt: u8 = match node_type {
+            NodeType::Super => 0,
+            NodeType::Light => 1,
+        };
+        format!("burn_attest:{}:{}:{}:{}", burn_tx, wallet, amount, nt)
+    }
+
     pub fn is_system_tx(&self) -> bool {
         matches!(
             &self.tx_type,
@@ -3418,6 +3444,22 @@ mod tests_v34_heartbeat {
         assert_eq!(accts.get("super_y").unwrap().heartbeat_slots.count_ones(), 9);
     }
 
+    // Burn-attestation canonical message: FIXED, deterministic, type-distinct — every genesis signs
+    // identical bytes and every validator recomputes the identical message, so the quorum verdict is
+    // byte-identical network-wide. Drift here would split the genesis signatures ⇒ no quorum forms.
+    #[test]
+    fn burn_attestation_message_is_canonical_and_type_distinct() {
+        let m = Transaction::burn_attestation_message("solSig", "walletA", 1500, &NodeType::Super);
+        assert_eq!(m, Transaction::burn_attestation_message("solSig", "walletA", 1500, &NodeType::Super), "deterministic");
+        assert_eq!(m, "burn_attest:solSig:walletA:1500:0", "fixed format, Super=0");
+        // Every bound field (incl. node_type) changes the signed message.
+        assert_ne!(m, Transaction::burn_attestation_message("solSig", "walletA", 1500, &NodeType::Light));
+        assert_ne!(m, Transaction::burn_attestation_message("solSig", "walletA", 1501, &NodeType::Super));
+        assert_ne!(m, Transaction::burn_attestation_message("solSig", "walletB", 1500, &NodeType::Super));
+        assert_ne!(m, Transaction::burn_attestation_message("solSig2", "walletA", 1500, &NodeType::Super));
+        assert_eq!(Transaction::burn_attestation_message("x", "y", 0, &NodeType::Light), "burn_attest:x:y:0:1", "Light=1");
+    }
+
     // Structural validation (the pure part; anchor/sig are checked at block validation).
     #[test]
     fn validate_structural_accepts_valid_rejects_malformed() {