[Calgooon]

Pin both workspaces to the published beta.2 stack: bsv-rs =0.9.0-beta.2, bsv-wallet-toolbox-rs =0.14.0-beta.2 (registry 4cfe31ca), and bsv-tracker =0.9.0-beta.2. This includes the originator, classic ARC, reference, certificate and wire changes those packages require.

The captain's decision on #277 applies: ordinary refusal types wait in #330 (toolbox #404), and discovery trust settings wait in #331 (toolbox #388). The classifier stays. This PR adds no trust config and invents no typed class from text.

#277 checklist and intake findings

• Read The beta.2 pin: bsv-rs 0.9.0-beta.2 and the toolbox's next prerelease together on beta, with every item recorded on #140 after the beta.1 landing #277's comments, internalizeAction accepts a wallet-payment output whose transaction does not verify (a stranger's spend with an invalid unlocking script is taken as a received coin) #140's landing record, the lane rules, WIRE/GATE-VECTORS/BRC-100-EXTENSIONS/DEPENDENTS and all three registry changelogs. The uncatalogued changelog entries were posted to The beta.2 pin: bsv-rs 0.9.0-beta.2 and the toolbox's next prerelease together on beta, with every item recorded on #140 after the beta.1 landing #277 before changing code. Published dependency metadata requires the same exact bsv-rs version; each of both locks contains one bsv-rs, one toolbox and one tracker. The separate pin commit initially failed compilation on 28 originator argument sites, as anticipated; those commits are retained, not squashed or rewritten.
• 1 — pins: root Cargo.toml/Cargo.lock and the fuzz workspace's two renamed dependencies/lock move together. Workspace build and fuzz check pass after adaptation. No duplicate bsv crate remains in either cargo tree -d.
• 2 — originators and constructors: bsv-rs HANDOFF: 2026-10-27, the two tags, the restarts and the shared-binary rule, the hygiene pass, the gate on main, the CI balance, the beta.2 pin's hour #329/mcp: a typed Config of its own, --config printed redacted; the arch rules scan mcp/src (#171) #318/ci: a push runs exactly the required set; bench, differential and the macOS build on dispatch in their own workflows (the owner's word of 2026-10-27) #323: each served wallet call passes the door's required originator in Some; CLI and engine calls preserve their pre-pin names in Some, documented in src/context.rs. No empty value is silently converted to None. Existing status-helper behavior is unchanged. No shipped Transaction::verify, certificate to_binary/signing_hash, MasterCertificate::new, HttpWalletJson/HttpWalletWire constructor or removed processor API call exists. Two test-only transaction verifications pass the third None (Discovery answers nothing at the beta.2 pin: the CLI's trust settings through the typed config wait for the toolbox's trust filter (toolbox #388) #331). The requested-set ordering, auth text members, removed set_verify_responses and ScriptEvaluationDeclined have no new direct CLI caller to migrate.
• 2 — services (docs: NORTH-STAR points at the release milestones, not the Phase ones (the hygiene pass, #316) #317/At toolbox 0.14.0-beta.2: ServicesOptions::mainnet() defaults arc_url to the Arcade endpoint, so the CLI's classic branch with ARC_URL unset passes an Arcade URL to with_arc (classic ARC at an Arcade endpoint); the classic default needs its own URL or the default moves to Arcade #322/Restore precise fault and abort evidence handling when the SDK carries typed data #342/build(#338): pin bsv-rs =0.9.0-beta.3 and bsv-wallet-toolbox-rs =0.14.0-beta.3 together (the beta.3 pin, as published), the typed host map (#330) and --from (#313) #345): classic mode names the CLI's TAAL mainnet/testnet URL when ARC_URL is unset, uses with_classic_arc under a reasoned deprecation allowance, and constructs successfully with the hermetic stub. The config command reports that CLI-owned URL. Arcade supplies no classic ARC rung. GorillaPool is opt-in at this pin. The three test constructions follow the new options shape. At toolbox 0.14.0-beta.2: ServicesOptions::mainnet() defaults arc_url to the Arcade endpoint, so the CLI's classic branch with ARC_URL unset passes an Arcade URL to with_arc (classic ARC at an Arcade endpoint); the classic default needs its own URL or the default moves to Arcade #322 is hand-closed at the landing with its record.
• 3 — reference (arc-callback deadline tests encode the toolbox's two busy waits; against toolbox #205 (one wait) the typed busy answers at 5 s and two tests read it as the deadline firing early #285, bsv-rs The in-process scenario harness: the e2e scenarios driven through the engine, no HTTP #105/tracker_host: a failed check of the toolbox's proof is stored once, so failing rows never hold the adoption limit (#292) #326): render the twelve bytes as BRC-100 base64 through one helper. Incoming signAction/abortAction already accept that string; no extra decode/re-encode adapter is needed. The served unsigned-create/sign/noSend-abort round trip checks the stored handle and zero posts. The UTF-8 recovery and its three memory notes are retired. Existing reference fixture bytes remain stable once the adapter is correct.
• 4 — classes (ratchet: fuzz/ is test code, as tests/ and benches/ are (#72) #137/serve-fleet --daemon: stop the tenants' monitors under the daemon's grace (#182) #185/test(e2e, #336): E2E.24's demand clears with margin in every state of the run #339): audited every toolbox_words.rs prefix and both accepting-abort strings against the published Display and formatting sites. None of the matched texts changed. No match was widened. INVALID_BEEF and UNSPENDABLE_COIN stay; unknown signAction is 400 ERROR, abortAction 404 NOT_FOUND, proveCertificate 400 ERROR, relinquishCertificate 200/relinquished. The ordinary typed host map waits in Host map by refusal class (the typed migration of toolbox #185) waits for a published toolbox carrying WalletRefusal at the WalletInterface boundary (toolbox #404) #330. Only the actual WalletReviewActions/toolbox ReviewActions carrier maps to 409 CONFLICT; the unit test proves the same untyped sentence does not gain that class. Fixture 147 gets the real carrier by racing a stored competing spend after the host's gate read; 148 observes the resulting state.
• 4 — words and guards: Scope lineage proof reads to eligible heirs (#217) #241's named-change sentence moves in 120; the host's refused set is unchanged. Lineage follow-ups from PR 213 round four: the silent-throughout named-door test does not prove the retry ran; README/ARCHITECTURE say "each door" where respend reads once; a 105-char doc line #216 gets a 10-byte declaration/11-byte spend witness (143–146), the retained unsigned action, and a shorter successful spend; the reported N is the reference's hex length. Existing e2e scenarios do not sign past their declaration. Gate: a named outpoint the wallet does not hold is refused at the gate on every path (#166) #200/Spend gate: read the suspect mark before the word for every word (hardening); today only the mined arm reads it #211/Spend gate: a stale creator held under a header-service fault is listed with word built, not stale #212/tools/changelog: refuse a fence line in a fragment (the README says a fragment carries no code block; an unclosed fence would render the release headings below it as code) #282 guard cases remain covered by the empty/missing script and vin fixtures; fix: honor proof evidence before aborting or retiring requests #245's stored-input guards preserve the host gate's first word. e2e: relinquishOutput posts the served body; its consumer fixture records a 200 (#119) #309 check order and array limits, tracker_host: word_label's nine labels in one WORD_LABELS constant (#286) #295 change eligibility, Nightly 2026-10-27: two fuzz targets do not build on beta (explorer_bodies after the 0.18.2 probe move; brc29_remittance with two bsv-rs crates in the fuzz crate's graph); no CI job builds the fuzz crate #301 u32 sequence number, server: CORS answers before the bearer, so a browser reaches an AUTH_TOKEN wallet (#138) #307 listActions inclusion/order, A received coin named under the scoped word is offered but never selected while a proven coin covers the action: split and send need a way to spend the named coin (LOW's seat p59) #313 purpose and BRC-100: the door refuses a request with neither Origin nor Originator (400 Origin header required) where the BRC makes originator optional and the reference's validateOriginator accepts an absent one #298 synced metadata were read against the package: only observed moved answers are recorded. Certificate validator texts from arc-callback: on the SEEN, IN_BLOCK and MINED paths a busy store answers 503 after two busy timeouts (10.4 s), past Arcade's 10 s webhook timeout #249/Fix split-key case matching so resolved splits release held coins #260/Record the named-change refusal after the gate offer (#234) #261/fix: store the settling header for later invalidations #270/changelog: use per-change fragments and assemble at release #280/fix(differential): isolate concurrent scratch space and ports (#192) #283/test(wire): report toolbox message-only differences under the gate knob #291/Floors for src/server/error.rs and src/config.rs, the files handlers.rs's code moved to (the second half of #174) #311 are read in the updated certificate rows. The broadcaster config by the owner's word (2026-10-27): Arcade is the default mode, GorillaPool's ARC leaves the ladder, classic ARC only as the hermetic stub's explicit mode; the release gate ran on ARC #300's issuance nonce is library-owned. services: Arcade the default broadcaster through the typed config; main into beta (#300, beta's half) #312/#359 expiry refusals and HANDOFF: 2026-10-28, the beta.2 pin landed as published, the gate 24/24, the deferrals and the lessons #337/#371 remittance exclusivity have new fixtures 149–154.
• 4 — callback/retirement: Spend guard: a suspect creator is refused as it stands; the guard never clears the mark (#164) #205's callback witness now expects one busy_timeout, retains STORE_BUSY, Retry-After and our apply_event: prefix, with no verbatim dependency sentence assertion (Wire replay: a refusal's message-text difference prints one TEXT-DIFF line under a knob the toolbox's dependents gate sets, never a failure; status, class, offset, reason and stored state stay strict (the keeper's shape, toolbox #252) #290). The accepting-word/proof matrix, fixture 124, toolbox assess_named and check_scope look an outpoint up without the user_id: in a store with more than one user another user's output counts as held #201's MINED behavior and PR 274's Ok on a template replay without a host workaround. Bsv-rs test: give CLI test trackers mining tips for toolbox verification #240 makes child-first BEEF valid; the respend witness now expects that validity and still checks the replacement and reserved coin state. The tracker 0.10.0: the spend guard on the real coin selection; the MCP companion on rmcp 3.5 #30 recheck and Chain feed: a row that settles after a kept reorg or invalidation keeps the deactivated header's hash, so an invalidation of its new block selects nothing #258 consumer tests remain green.
• 5 — certificate JSON (fix: bound ARC callback waits before the sender timeout (#249) #268 at 83af62a, The in-process scenario harness: the e2e scenarios driven through the engine, no HTTP #105/Record the named-change refusal after the gate offer (#234) #261): all six doors use type, DER signature hex and base64 keyrings; list entries are flat. 044–052 and the brc100Type requests are migrated to valid metadata so their intended branch is still exercised. MCP acquisition/proof parameters match, and both MCP discovery tools return the same empty answer as HTTP. Key linkage results are flat byte arrays with protocolID/keyID; integration/e2e and 025/027 agree. listOutputs' BEEF is an array under the BRC field name; the e2e consumer accepts it. The host's stored InternalizeActionArgs follow-up and other serde-persisted sites were checked; no storage rewrite is needed.
• 5 — bounds and verify (main: the CLI's test chain trackers answer a mining tip (backport of PR 240, #238) #246/Reject empty carried input signers (#265) #275/ratchet: cover base checks and fail CI on record read errors #297/Hermetic e2e: the stub plays Arcade V2 (the EF submit, GET /tx/{txid}, the SSE stream and the callback), so the suite runs in the default Arcade mode and classic ARC mode leaves the CLI #299/Nightly 2026-10-27: two fuzz targets do not build on beta (explorer_bodies after the 0.18.2 probe move; brc29_remittance with two bsv-rs crates in the fuzz crate's graph); no CI job builds the fuzz crate #301/0.19.0-beta.1: the version and the assembled changelog #305): direct-acquire fixtures cover the 1 MiB boundary and the 73-byte signature input. Published direct acquisition accepts both field sizes: toolbox #374 owns the missing direct-path validation, documented rather than patched in the CLI. The separate certificate type tests prove the 1 MiB value, 16 MiB frame and 72-byte signature bounds and verify returning false. The JSON host has no certificate binary writer to unwrap. No certificate signature is silently repaired.
• 5 — one-off and re-issue: bsv-wallet certificates --reverify explicitly invokes the library's stored-certificate audit; it is repeatable and leaves stored rows unchanged. A good/bad signature test runs it twice and gets checked=2/failed=1 both times. We chose an explicit flag so ordinary startup does not gain a scan. The local certifier sends x-bsv-auth-identity-key (ci: the macOS build on push and the tag's run, Ubuntu alone on a pull request (main) #269); scenario 6 imports its signed BRC-52 certificate, proves one field, decrypts it with the Host routes /tx/{txid} and /chain-feed/status serve a store busy as 500, not 503 STORE_BUSY #203 symmetric key, verifies the signature, discovers and relinquishes it. The published issuance URL guard requires public HTTPS, so the hermetic test imports via direct acquisition and makes no external issuance request. Pre-Host routes /tx/{txid} and /chain-feed/status serve a store busy as 500, not 503 STORE_BUSY #203 toolbox-issued certificates must be re-issued: the old field-encryption scheme is incompatible with the corrected scheme. The owner-reported 46 production certificates, one certifier, 2026-03-29..31, are [D] supplied facts, not a production read by this lane. README and changelog carry the re-issue instruction; the owner decides the production operation.
• 5 — discovery deferral: no trust config added. HTTP, MCP and the hermetic assertions pin [] with the reason toolbox #388 (CLI Discovery answers nothing at the beta.2 pin: the CLI's trust settings through the typed config wait for the toolbox's trust filter (toolbox #388) #331). The six discovery bodies 053/054/137–140 were already empty and remain byte-identical; their recording manifest names the reason. The host still enforces the 1..=10000 page bound. The three library-owned overlay hosts are explicitly counted/refused by the hermetic proxy, with zero new wall targets or unserved routes.
• 6 — corpus: dedicated recording commit cc438d6 records all 157 rows after the product changes; the full strict replay passes after recording. The moved/new files and causes are enumerated below. 086, 094–098, 100, 101 and 106 are byte-identical after the correct base64 adapter; 103 retains INVALID_BEEF, offset 176 and OP_EQUALVERIFY with no stored invalid spend (Host map by refusal class (the typed migration of toolbox #185) waits for a published toolbox carrying WalletRefusal at the WalletInterface boundary (toolbox #404) #330). Every other old wire fixture and all 48 consumer fixtures are byte-identical. Every gate-vector byte is unchanged; 490 rows, 486 expressed and 4 explicitly unexpressed, zero divergences with every one recorded. WIRE's stale 103 defect is closed at the beta.1 landing. No silent divergence was added.
• 7 — records: README/CLAUDE/changelog now describe the published pin and the two numbered deferrals, with no blocked-checkpoint text. BRC originator semantics cite the keeper's BRC-100: the door refuses a request with neither Origin nor Originator (400 Origin header required) where the BRC makes originator optional and the reference's validateOriginator accepts an absent one #298 reading; certificate/discovery rows and dependent versions are current. NORTH-STAR is re-rendered to 157 wire fixtures. ARCHITECTURE needed no repin: all 266 citations and 69 line-count rows check. The issue's continuation record links the evidence and carry-forward items.
• Additional changelog findings: bsv-rs Carry the 0.18.2 main patch into beta and record fixture 123 #272/Spend gate: the lineage walk, the rule labels and the frozen set are the user's (#221) #252/test: keep retirement seed valid across toolbox D1 #255/respend: refuse a replacement when a proof is present, through the retire guard's shared reader, not the request's label list #247/Structure: typed errors end to end, status by variant; A8 no error classified by prefix (#81) #167/tests: three tests made version-agnostic for the toolbox's dependents gate (toolbox #163) #251/ratchet: a unit test for check() against a base record, and the base path exercised in CI (follow-up to #72) #126/Gate: a coin the store marks not spendable is held by the gate with its word, before allocation (#165) #189/Oracle: the differential harness, the base build against the head on the hermetic suite (#70) #152/BRC-100: privileged: true is refused (501 PRIVILEGED_NOT_SUPPORTED), never answered with the everyday key (#145) #190/mcp/ reads WALLET_URL, WALLET_ORIGIN, RELAY_URL and RELAY_ADMIN_TOKEN itself, outside the Config and the arch rules' scan #171/Chain feed: an invalidated block's own recheck reads the header the alert invalidated, so the suspect mark can clear at delivery #206/docs(gate): align hold reasons, named inputs, and retry guarantees #236 and toolbox Relay poller: an ingest that fails on a busy store still advances last_id, so the payload is dropped; hold the cursor on a typed busy #248/docs(gate): align hold reasons, named inputs, and retry guarantees #236/serve-fleet --daemon stops its monitors with no grace: a hung monitor holds the fleet's exit forever #182 were posted to The beta.2 pin: bsv-rs 0.9.0-beta.2 and the toolbox's next prerelease together on beta, with every item recorded on #140 after the beta.1 landing #277 before edits. Their surfaces were read: binary/auth/backend/build/test changes need no new served adapter; tests: three tests made version-agnostic for the toolbox's dependents gate (toolbox #163) #251/Gate: a coin the store marks not spendable is held by the gate with its word, before allocation (#165) #189's certificate rules are exercised above, BRC-100: privileged: true is refused (501 PRIVILEGED_NOT_SUPPORTED), never answered with the everyday key (#145) #190's response shape by the certificate corpus, and Chain feed: an invalidated block's own recheck reads the header the alert invalidated, so the suspect mark can clear at delivery #206's abort by existing fixtures. No foreign library implementation is changed here.

Fixture recording (cc438d6)

WIRE_RECORD=1 records 157 fixtures after the code. Moved or new rows:

• 025-revealCounterpartyKeyLinkage.ok.json: bsv-rs The in-process scenario harness: the e2e scenarios driven through the engine, no HTTP #105: flat key linkage, byte fields and protocolID/keyID.
• 027-revealSpecificKeyLinkage.ok.json: bsv-rs The in-process scenario harness: the e2e scenarios driven through the engine, no HTTP #105: flat key linkage, byte fields and protocolID/keyID.
• 044-acquireCertificate.brc100Type.json: bsv-rs fix: bound ARC callback waits before the sender timeout (#249) #268/The in-process scenario harness: the e2e scenarios driven through the engine, no HTTP #105 and toolbox Floors for src/server/error.rs and src/config.rs, the files handlers.rs's code moved to (the second half of #174) #311/arc-callback: on the SEEN, IN_BLOCK and MINED paths a busy store answers 503 after two busy timeouts (10.4 s), past Arcade's 10 s webhook timeout #249/Fix split-key case matching so resolved splits release held coins #260/fix: store the settling header for later invalidations #270: certificate JSON and validated metadata.
• 045-relinquishCertificate.brc100Type.json: bsv-rs fix: bound ARC callback waits before the sender timeout (#249) #268/The in-process scenario harness: the e2e scenarios driven through the engine, no HTTP #105 and toolbox Floors for src/server/error.rs and src/config.rs, the files handlers.rs's code moved to (the second half of #174) #311/arc-callback: on the SEEN, IN_BLOCK and MINED paths a busy store answers 503 after two busy timeouts (10.4 s), past Arcade's 10 s webhook timeout #249/Fix split-key case matching so resolved splits release held coins #260/fix: store the settling header for later invalidations #270: certificate JSON and validated metadata.
• 046-proveCertificate.brc100Type.json: bsv-rs fix: bound ARC callback waits before the sender timeout (#249) #268/The in-process scenario harness: the e2e scenarios driven through the engine, no HTTP #105 and toolbox Floors for src/server/error.rs and src/config.rs, the files handlers.rs's code moved to (the second half of #174) #311/arc-callback: on the SEEN, IN_BLOCK and MINED paths a busy store answers 503 after two busy timeouts (10.4 s), past Arcade's 10 s webhook timeout #249/Fix split-key case matching so resolved splits release held coins #260/fix: store the settling header for later invalidations #270: certificate JSON and validated metadata.
• 047-acquireCertificate.direct.json: bsv-rs fix: bound ARC callback waits before the sender timeout (#249) #268/The in-process scenario harness: the e2e scenarios driven through the engine, no HTTP #105 and toolbox Floors for src/server/error.rs and src/config.rs, the files handlers.rs's code moved to (the second half of #174) #311/arc-callback: on the SEEN, IN_BLOCK and MINED paths a busy store answers 503 after two busy timeouts (10.4 s), past Arcade's 10 s webhook timeout #249/Fix split-key case matching so resolved splits release held coins #260/fix: store the settling header for later invalidations #270: certificate JSON and validated metadata.
• 048-listCertificates.one.json: bsv-rs fix: bound ARC callback waits before the sender timeout (#249) #268/The in-process scenario harness: the e2e scenarios driven through the engine, no HTTP #105 and toolbox Floors for src/server/error.rs and src/config.rs, the files handlers.rs's code moved to (the second half of #174) #311/arc-callback: on the SEEN, IN_BLOCK and MINED paths a busy store answers 503 after two busy timeouts (10.4 s), past Arcade's 10 s webhook timeout #249/Fix split-key case matching so resolved splits release held coins #260/fix: store the settling header for later invalidations #270: certificate JSON and validated metadata.
• 049-proveCertificate.held.json: bsv-rs fix: bound ARC callback waits before the sender timeout (#249) #268/The in-process scenario harness: the e2e scenarios driven through the engine, no HTTP #105 and toolbox Floors for src/server/error.rs and src/config.rs, the files handlers.rs's code moved to (the second half of #174) #311/arc-callback: on the SEEN, IN_BLOCK and MINED paths a busy store answers 503 after two busy timeouts (10.4 s), past Arcade's 10 s webhook timeout #249/Fix split-key case matching so resolved splits release held coins #260/fix: store the settling header for later invalidations #270: certificate JSON and validated metadata.
• 050-relinquishCertificate.held.json: bsv-rs fix: bound ARC callback waits before the sender timeout (#249) #268/The in-process scenario harness: the e2e scenarios driven through the engine, no HTTP #105 and toolbox Floors for src/server/error.rs and src/config.rs, the files handlers.rs's code moved to (the second half of #174) #311/arc-callback: on the SEEN, IN_BLOCK and MINED paths a busy store answers 503 after two busy timeouts (10.4 s), past Arcade's 10 s webhook timeout #249/Fix split-key case matching so resolved splits release held coins #260/fix: store the settling header for later invalidations #270: certificate JSON and validated metadata.
• 051-relinquishCertificate.unknown.json: bsv-rs fix: bound ARC callback waits before the sender timeout (#249) #268/The in-process scenario harness: the e2e scenarios driven through the engine, no HTTP #105 and toolbox Floors for src/server/error.rs and src/config.rs, the files handlers.rs's code moved to (the second half of #174) #311/arc-callback: on the SEEN, IN_BLOCK and MINED paths a busy store answers 503 after two busy timeouts (10.4 s), past Arcade's 10 s webhook timeout #249/Fix split-key case matching so resolved splits release held coins #260/fix: store the settling header for later invalidations #270: certificate JSON and validated metadata.
• 052-proveCertificate.unknown.json: bsv-rs fix: bound ARC callback waits before the sender timeout (#249) #268/The in-process scenario harness: the e2e scenarios driven through the engine, no HTTP #105 and toolbox Floors for src/server/error.rs and src/config.rs, the files handlers.rs's code moved to (the second half of #174) #311/arc-callback: on the SEEN, IN_BLOCK and MINED paths a busy store answers 503 after two busy timeouts (10.4 s), past Arcade's 10 s webhook timeout #249/Fix split-key case matching so resolved splits release held coins #260/fix: store the settling header for later invalidations #270: certificate JSON and validated metadata.
• 120-createAction.namedChange.json: toolbox Scope lineage proof reads to eligible heirs (#217) #241: named-change words.
• 143-createAction.tenByteDeclaration.json: toolbox Lineage follow-ups from PR 213 round four: the silent-throughout named-door test does not prove the retry ran; README/ARCHITECTURE say "each door" where respend reads once; a 105-char doc line #216: overlong spend refused, stored unsigned action retained, shorter spend succeeds.
• 144-signAction.spendLongerThanDeclared.json: toolbox Lineage follow-ups from PR 213 round four: the silent-throughout named-door test does not prove the retry ran; README/ARCHITECTURE say "each door" where respend reads once; a 105-char doc line #216: overlong spend refused, stored unsigned action retained, shorter spend succeeds.
• 145-listActions.afterOverlongSpend.json: toolbox Lineage follow-ups from PR 213 round four: the silent-throughout named-door test does not prove the retry ran; README/ARCHITECTURE say "each door" where respend reads once; a 105-char doc line #216: overlong spend refused, stored unsigned action retained, shorter spend succeeds.
• 146-signAction.shorterThanDeclared.json: toolbox Lineage follow-ups from PR 213 round four: the silent-throughout named-door test does not prove the retry ran; README/ARCHITECTURE say "each door" where respend reads once; a 105-char doc line #216: overlong spend refused, stored unsigned action retained, shorter spend succeeds.
• 147-createAction.doubleSpendReview.json: toolbox fix: honor proof evidence before aborting or retiring requests #245/0.18.2: bsv-rs =0.8.3, toolbox =0.13.1, the probe's one-pass move (#196), the customInstructions bound (#157) #264, bsv-rs test(e2e, #336): E2E.24's demand clears with margin in every state of the run #339: typed double-spend review and stored-state witness.
• 148-listActions.afterDoubleSpendReview.json: toolbox fix: honor proof evidence before aborting or retiring requests #245/0.18.2: bsv-rs =0.8.3, toolbox =0.13.1, the probe's one-pass move (#196), the customInstructions bound (#157) #264, bsv-rs test(e2e, #336): E2E.24's demand clears with margin in every state of the run #339: typed double-spend review and stored-state witness.
• 149-createAction.expiryUnsupported.json: toolbox services: Arcade the default broadcaster through the typed config; main into beta (#300, beta's half) #312/#359: BRC-177 capability and grammar refusals.
• 150-createAction.expiryBatch.json: toolbox services: Arcade the default broadcaster through the typed config; main into beta (#300, beta's half) #312/#359: BRC-177 capability and grammar refusals.
• 151-createAction.expiryNever.json: toolbox services: Arcade the default broadcaster through the typed config; main into beta (#300, beta's half) #312/#359: BRC-177 capability and grammar refusals.
• 152-createAction.expiryDuplicate.json: toolbox services: Arcade the default broadcaster through the typed config; main into beta (#300, beta's half) #312/#359: BRC-177 capability and grammar refusals.
• 153-internalizeAction.missingRemittance.json: toolbox HANDOFF: 2026-10-28, the beta.2 pin landed as published, the gate 24/24, the deferrals and the lessons #337/#371: remittance exclusivity before BEEF.
• 154-internalizeAction.exclusiveRemittance.json: toolbox HANDOFF: 2026-10-28, the beta.2 pin landed as published, the gate 24/24, the deferrals and the lessons #337/#371: remittance exclusivity before BEEF.
• 155-acquireCertificate.fieldAtBound.json: bsv-rs Reject empty carried input signers (#265) #275/Nightly 2026-10-27: two fuzz targets do not build on beta (explorer_bodies after the 0.18.2 probe move; brc29_remittance with two bsv-rs crates in the fuzz crate's graph); no CI job builds the fuzz crate #301 and toolbox #374: direct-acquire bound boundary as published.
• 156-acquireCertificate.fieldAboveBound.json: bsv-rs Reject empty carried input signers (#265) #275/Nightly 2026-10-27: two fuzz targets do not build on beta (explorer_bodies after the 0.18.2 probe move; brc29_remittance with two bsv-rs crates in the fuzz crate's graph); no CI job builds the fuzz crate #301 and toolbox #374: direct-acquire bound boundary as published.
• 157-acquireCertificate.signatureAboveBound.json: bsv-rs Reject empty carried input signers (#265) #275/Nightly 2026-10-27: two fuzz targets do not build on beta (explorer_bodies after the 0.18.2 probe move; brc29_remittance with two bsv-rs crates in the fuzz crate's graph); no CI job builds the fuzz crate #301 and toolbox #374: direct-acquire bound boundary as published.

MANIFEST.json records empty discovery with the exact reason
"toolbox #388 (CLI #331)" for 053-discoverByIdentityKey.ok.json,
054-discoverByAttributes.ok.json, 137-discoverByIdentityKey.limitAtBound.json,
138-discoverByIdentityKey.limitAboveBound.json,
139-discoverByAttributes.limitAtBound.json and
140-discoverByAttributes.limitAboveBound.json. Those six fixture bodies
remain byte-identical: the host bound still refuses above 10000.

086, 094-098, 100, 101 and 106 are byte-identical after the correct base64
translation; 103 retains INVALID_BEEF, offset 176 and the script reason,
with no stored invalid action, under CLI #330. The WIRE defect row is now
closed at beta.1 rather than claiming the invalid spend was accepted.
All other old wire files, the consumers and gate-vector bytes are unchanged.

Proof

All commands use the lane's private target directory and foreground execution. Final published-package proof:

Check	Tail/result	Log
workspace build --locked	Finished dev	final-build.log
root/workspace and fuzz fmt	exit 0	proof-format-ready.log
workspace/all-target Clippy --locked -D warnings	Finished dev	proof-clippy-ready.log
workspace cargo test --locked	887 passed, 0 failed, 0 ignored over 31 suites	proof-tests-green.log
fuzz check --locked	Finished dev	proof-fuzz-ready.log
root/fuzz cargo tree -d + lock inventory	one each of the three bsv crates	proof-tree-root.log, proof-tree-fuzz.log, lock-inventory.txt
wire + consumer + BRC replay after recording	18 + 1 + 5 tests pass; 157 wire, 48 consumer fixtures	proof-wire-consumers-brc.log
architecture rules	8 suites / 15 tests pass, included above	proof-tests-green.log
gate vectors --nocapture	490 rows; 0 divergences, every one recorded: true	proof-gate-vectors.log
final hermetic suite	24/24, 0 skipped, 180 known walls, 0 new, 0 unserved; no real sats	proof-hermetic-final-ready.log
differential vs origin/beta build	10 named differences / 365 calls / 35 commands, both 24/24	differential-complete/report.txt
--same floor	0 differences / 365 calls / 35 commands, both 24/24	differential-same/report.txt
differential / scoreboard unit tests	49 tests (1 skipped) / 89 tests pass	proof-test-differential.log, proof-test-scoreboard.log
CI Python ratchet/link/cite/changelog tests	78 / 10 / 62 / 114 pass	proof-ci-python.log
changelog --check --base origin/beta	added changelog.d/277.md	proof-records-ready.log
scoreboard --check with base's own rendered JSON	current; no wrong-way move, 35 values	proof-records-ready.log
check-links / check-cites	25 files, 0 broken; 266 citations / 69 line rows, 0 findings	proof-records-ready.log
pinned cargo-deny 0.20.2 + adopted template hash	advisories, bans, licenses, sources all ok	proof-deny-pinned.log, proof-deny-full.log
final fetch / Rust 1.98.1 ratchet	no number above record or base	final-fetch.log, proof-ratchet-final.log

Final ratchet: pedantic 823 (base 825); unwrap 4; large shipped files 10; large test files 3; long functions 86; complexity 19; duplicated tokens 32287 (base 32486); missing docs 148. The tool and recorded ceilings are unchanged.

Cross-pin comparison: DIFFERENTIAL: 10 differences over 365 calls and 35 commands; both builds pass 24/24. These are the five certificate/discovery changes (#105/#268/#388), two earlier remittance refusals (#371, not a widening of INVALID_BEEF), two linkage changes (#105), and the listOutputs BEEF field/array (#105). The same-binary floor is DIFFERENTIAL: 0 differences over 365 calls and 35 commands. No differential exclusion changed. During the comparison only, the acquisition request includes both old/new type keys so the same signed certificate is exercised on both libraries; the normal beta.2 scenario sends only type.

Upstream gates (the captain's ruling)

• The toolbox's Dependents workflow takes no branch input (toolbox #405, filed by the lane: the dispatch gh workflow run dependents.yml --ref beta -f cli_ref=lane/p1-277-pin-beta2 answered HTTP 422, Unexpected inputs provided: ["cli_ref"], and no run was created), so a Dependents run against this exact branch is not possible and is not a condition of this PR. A Dependents run against this branch exists since toolbox #405 landed their cli_ref input: run 40679043409 (11:19Z, at bb9266b, the clone line right) fails the build on create_action_offering's fourth argument, the must-spend list of toolbox ci(#352): a hyphenated tag's release object is a prerelease #353 (#399) landed on their beta behind the tag; the published beta.2 takes three, so that run and the plain beta dispatch after the landing are red by construction until the CLI pin that carries ci(#352): a hyphenated tag's release object is a prerelease #353 (A received coin named under the scoped word is offered but never selected while a proven coin covers the action: split and send need a way to spend the named coin (LOW's seat p59) #313's), recorded on The beta.2 pin: bsv-rs 0.9.0-beta.2 and the toolbox's next prerelease together on beta, with every item recorded on #140 after the beta.1 landing #277 and in the toolbox's docs/DEPENDENTS.md as the expected red beside this PR's green CI on the published crates.
• The lane's patched-tip proof (all three dependencies patched to their current beta tips in a scratch copy, no library edits) found the toolbox's beta tip does not compile against bsv-rs's beta tip: 18 E0308 errors inside the toolbox's certificate maps, HashMap where bsv-rs's beta carries IndexMap (#385/#394), before any CLI test (toolbox #406). That is a finding on the toolbox's side at their next bsv-rs pin, outside this PR's pins, and nothing of it is fixed here.

Fix round on the cold review

The following lines supplement the earlier landing record. Finding 1 replaces its 409 review-action mapping with the pinned HTTP 400/code-5 carrier and preserves every present member. Finding 2 reads planted beta.1 hex follow-ups without rewriting stored rows. Finding 3 adds the missed changelog intake and toolbox #240 privacy/serial witnesses. Finding 5 restores scenario 08's INVALID_BEEF assertions with valid remittance. Finding 6 names toolbox #216 in changelog.d/277.md. The ordinary classifier and empty discovery remain as published.

• bsv-rs Refuse carried inputs without a consistent caller signer (#237) #262: re-read direct acquisition: it validates and stores a WalletCertificate; it never calls auth::Certificate::sign on the already signed input. Certificate construction in tests signs once. The immutable-signature rule needs no host workaround.
• bsv-rs changelog: use per-change fragments and assemble at release #280: retained signed certificate/request text belongs to AuthMessage/Peer and their transports. The CLI has no AuthMessage reconstruction; certificate JSON at its HTTP door is not a signed Peer envelope. The pinned toolbox owns the authenticated storage client. No received signed text is round-tripped through a host Value.
• bsv-rs arc-callback deadline tests encode the toolbox's two busy waits; against toolbox #205 (one wait) the typed busy answers at 5 s and two tests read it as the deadline firing early #285 (not toolbox arc-callback deadline tests encode the toolbox's two busy waits; against toolbox #205 (one wait) the typed busy answers at 5 s and two tests read it as the deadline firing early #285): re-read numeric fields in the host and directly served SDK types: satoshis/sourceSatoshis, version, lockTime, vout/outputIndex, unlockingScriptLength, sequenceNumber, limits/offsets/totals, heights, protocol security level, proofType and certifier trust. They retain integer types and bounds; JSON Value passthrough shares the pin's float_roundtrip feature. No host f64-to-integer adapter was added. Out-of-range sequenceNumber/offset and page limits remain recorded. The earlier reference bullet names toolbox arc-callback deadline tests encode the toolbox's two busy waits; against toolbox #205 (one wait) the typed busy answers at 5 s and two tests read it as the deadline firing early #285, a different item.
• toolbox abortAction's pre-check answers the store busy as 503 STORE_BUSY (#168) #202: local StorageSqlx is the CLI's storage; no StorageClient is constructed by the CLI. The pin's remote client now sends inputBEEF, partial filters, canonical UTXO field names and input/output type; local entity serialization remains unchanged.
• bsv-rs test: give CLI test trackers mining tips for toolbox verification #240 wildcard arms: the CLI has no match on Stop, Verdict or AsyncVerifyError to update. The pinned toolbox's non-exhaustive spend-verdict fallback refuses as ServiceError. The valid child-first BEEF witness remains accepted.
• bsv-rs main: the CLI's test chain trackers answer a mining tip (backport of PR 240, #238) #246, which path: this is the wallet binary certificate writer's field-count/value/frame bounds and signed order, not direct HTTP acquisition. The CLI serves JSON and has no WireWriter; tests/certificate_pin.rs separately exercises auth::Certificate's writer. Direct acquisition still lacks the field-size check tracked in toolbox #374, and rows 155/156 keep that reading.
• bsv-rs The in-process scenario harness: the e2e scenarios driven through the engine, no HTTP #105, any byte moving away from the MetaNet Client: read each changed encoding against the pinned HTTPWalletJSON and Wallet.interfaces rows. type, flat entries/linkages, protocolID/keyID, hex txids, base64 references/keyrings, number-array tx/inputBEEF/BEEF and the public-key keyringRevealer move toward those shapes; no away-moving served byte was found. Existing host adapters already serve the action, crypto and BEEF shapes. The stored hex follow-up is a separate persistence compatibility fix (finding 2).
• bsv-rs The Nightly's baseline runs past cargo-mutants' 300 s per-test limit on beta: a shard that times out judges nothing and still shows green #310/Document the change floor: a spend needs change of at least a quarter of the basket's minimum desired UTXO value (2,500 sat by default) or the allocator pulls another coin #315 reveal question: no IdentityClient::publicly_reveal_attributes/createAction disclosure path is called by the CLI. Those identity publication argument/order fixes stay in the library. Direct proveCertificate is our served path; toolbox test: give CLI test trackers mining tips for toolbox verification #240's empty fieldsToReveal now has its own empty-keyring witness, and nonempty disclosure stays in scenario 06.
• toolbox #395: internalize's verify_stream_two_pass runs scripts uncapped in the published beta.2; the host supplies no memory-limit parameter because this API has none. The bounded stream parameter is the later bsv-rs #373/toolbox #395 work. This pin preserves the published behavior, without a host cap or a later library patch.

Missed changelog intake: bsv-rs #249/#258/#228/#192/#356, both toolbox #240 entries.

Fix-round final proof (bb9266b)

All six cold-review findings are addressed on the existing branch. The exact published pins, ordinary refusal classifier and empty discovery answers are retained. Every fix is an added commit with its model trailer.

• Finding 1: HTTP 400, isError and numeric code 5 preserve the typed review evidence and all present action members. The pinned HttpWalletJson reads the served complete carrier back as WalletReviewActions; absent optional members are omitted.
• Finding 2: one serde helper reads beta.1 hex and beta.2 byte-array tx values. The planted old row crosses re-announcement and records its transaction and output in wallet storage, without migration.
• Finding 3: the two crate intake comments above cover every missed entry. Fixtures 158/159/160 cover a stored encrypted field, an empty verifier keyring for fieldsToReveal [] and the 31-byte serial refusal. The isolated certificate world avoids the dependency's two-row lookup page.
• Finding 4: the nine per-item checklist lines above include the numeric-field and direct-acquisition re-reads.
• Finding 5: scenario 08 supplies canonical payment remittance and asserts INVALID_BEEF for both malformed inputs. Its two previous INVALID_BEEF-to-VALIDATION_ERROR differential rows are gone.
• Finding 6: changelog.d/277.md names toolbox Lineage follow-ups from PR 213 round four: the silent-throughout named-door test does not prove the retry ran; README/ARCHITECTURE say "each door" where respend reads once; a 105-char doc line #216.

Fixture commit bbebcc5 is the single final recording commit: 147 changes to the code-5 carrier, 158/159/160 are new, and MANIFEST records each reason. All 156 other existing fixtures, all 48 consumer fixtures and the gate-vector files are byte-identical to 3cbc445. The scoreboard is rendered to 160 rows.

Command / proof	Result
cargo fmt --all -- --check	pass
cargo clippy --workspace --all-targets --locked -- -D warnings	pass
cargo test --workspace --locked	890 passed, 0 failed, 0 ignored across 31 suites
wire / consumer / BRC replay	18 / 1 / 5 tests pass; 160 wire and 48 consumer fixtures, 0 differences or coverage gaps
gate vectors --nocapture	490 rows: 486 expressed, 4 named unexpressed; 0 divergences, every one recorded: true
plain hermetic suite, once	24/24, 0 skipped; 180 known walls, 0 new, 0 unserved
origin/beta build at 3d0cd8e	both wallet and MCP release binaries built from a temporary worktree, then removed
differential against that build	DIFFERENTIAL: 8 differences over 365 calls and 35 commands; both 24/24
same-build floor	DIFFERENTIAL: 0 differences over 365 calls and 35 commands; both 24/24
ratchet, unchanged instrument and ceilings	824 pedantic (ceiling 825), 32391 duplicate tokens (ceiling 32486); all eight pass against own and base records
cargo-deny 0.20.2 --locked check	advisories, bans, licenses and sources ok
check-links / check-cites	25 files, 0 broken; 266 citations and 69 line-count rows, 0 findings
changelog --check --base origin/beta / scoreboard --check	pass / current

All Rust checks use 1.98.1 and the private lane target. Evidence and logs are under /Volumes/Lanes/out/bsv-wallet-cli/p1-277-pin-fix. No production wallet was contacted. Every server and listener started by these checks is stopped before the lane's report. The captain's landing record remains the next action for #277 and #322.

For #277 (hand-closed with the landing record, never auto-closed) and #322.

🤖 Generated with Claude Code

[Calgooon]

Toolbox Dependents against this branch (2026-10-28 11:19:24Z, run 40679043409, the first with the cli_ref input of toolbox #405): the clone line is right, cloning … at its lane/p1-277-pin-beta2 branch (the line under test) … at bb9266b (no fallback, toolbox #412 read). The build fails on one signature: error[E0061]: this method takes 4 arguments but 3 arguments were supplied (--locked first, then retried unlocked, the same), bsv-wallet-cli build: FAIL, test: not run. The method is create_action_offering, whose fourth parameter is the must-spend list of toolbox #353 (their #399), landed on their beta behind the v0.14.0-beta.2 tag as an api-break with its migration noted on #277; the published 0.14.0-beta.2 this PR pins takes three. So the Dependents run against the toolbox's beta tip is red by construction until the CLI pin that carries #353 (the same pin #313's --from waits for), and this run says nothing against PR 332, whose own CI on the published crates is green on all ten required checks. The same red is expected of a plain --ref beta dispatch after the landing until that pin; the PR body's line that it reads green is folded after the re-check's verdict.