From 3d51da974740999d9ed182deeeec75a06dfeecb3 Mon Sep 17 00:00:00 2001 From: Aere Network Date: Sat, 5 Sep 2026 08:07:54 +0300 Subject: [PATCH] Follower configuration and anchor patch at the live revision: registries/hibrid-1.properties (SLH-DSA public keys), the five properties a follower needs past blocks 17,047,600 and 17,225,968, 0003 regenerated from the staged overlay on d2032017 (169 files; applies with 0001/0004/0005 in run-node order, tree equals anchor/); the from-genesis import proof is stated as not yet repeated --- RUN-A-NODE.md | 21 +- patches/0003-aere-pq-anchor.patch | 21690 ++++++++++++++++++++++++++-- registries/README.md | 3 +- registries/SHA256SUMS | 1 + registries/hibrid-1.properties | 21 + 5 files changed, 20446 insertions(+), 1290 deletions(-) create mode 100644 registries/hibrid-1.properties diff --git a/RUN-A-NODE.md b/RUN-A-NODE.md index 3f8cf4e..220fe6b 100644 --- a/RUN-A-NODE.md +++ b/RUN-A-NODE.md @@ -142,10 +142,14 @@ controls run in both directions (641 tests, 0 failures). Measured 2026-08-15: on a pristine `d2032017` checkout, `git apply` (no flags) accepted `0001`, `0003` and `0004` in that order, and `./gradlew --no-daemon installDist -x spotlessJavaCheck -x test` exited 0 on JDK 21, producing -`besu/v26.8-develop-d203201/linux-x86_64/openjdk-java-21`. That proves the recipe builds. +`besu/v26.8-develop-d203201/linux-x86_64/openjdk-java-21`. That proves the recipe builds. Measured again on 2026-09-05 with the regenerated `0003` (169 files: 30 upstream files modified, 139 new, among them the 22 of the SLH-DSA engine): on a pristine `d2032017` checkout `git apply --check` accepted `0001`, `0003`, `0004` and `0005` in the order `run-node.sh` uses, and the patched tree equals `anchor/` file for file. The `installDist` build and the from-genesis import were NOT repeated that day; see the revision note below. The import proof above, measured 2026-08-16, proves the build follows the live chain from genesis to the tip. The proof is repeated, not assumed: see `IMPORT-PROOF-STARE-2026-08-15.md` for the -measured heights of each run. +measured heights of each run. **Revision note, 2026-09-05:** the anchor patch and the configuration +below were updated for the hybrid certificate and the interval schedule; the from-genesis import proof +has NOT yet been repeated against this revision (the last measured run is the one above, on the +previous revision). What is measured for this revision is that the same code follows the live tip on +the network's reading nodes, and validates every hybrid anchor there, since 2026-09-05. --- @@ -154,7 +158,12 @@ measured heights of each run. The Aere fork reads its per-node configuration from JVM system properties passed through the `BESU_OPTS` environment variable, not from the genesis file. `run-node.sh` sets these for you; this is what it sets, and what a manual operator must export before the `besu` command below, or the node -will refuse the first anchor at block 13,014,000. +will refuse the first anchor at block 13,014,000. Revised 2026-09-05: the five properties added that +day are the ones without which a node stops at block 17,047,600 (the first hybrid, v2 certificate) or at +the first anchor after 17,225,968 (the interval change): `anchorV2Block`, `schemeSchedule`, +`hybridRegistry` (the SLH-DSA-SHA2-128s public keys, `registries/hibrid-1.properties`), +`anchorIntervalSchedule`, and the two dated steps in `anchorMinSeals` (see `anchor/README.md`, scope +item 3). The set below is the one the network's own public reading node runs with, measured that day. ```bash REG=/path/to/aere-node/registries @@ -164,9 +173,13 @@ export BESU_OPTS="\ -Daere.pq.chainId=2800 \ -Daere.pq.anchorBlock=13014000 \ -Daere.pq.anchorInterval=32 \ +-Daere.pq.anchorIntervalSchedule=17225968:128 \ -Daere.pq.anchor.maxSeals=9 \ --Daere.pq.anchorMinSeals=13014000:0,13034000:3,14961456:6 \ +-Daere.pq.anchorMinSeals=13014000:0,13034000:3,14961456:6,17102384:0,17102416:6 \ -Daere.pq.anchor.minSealsCeiling=1 \ +-Daere.pq.anchorV2Block=17047600 \ +-Daere.pq.schemeSchedule=17047568:falcon-512+slh-dsa-sha2-128s \ +-Daere.pq.hybridRegistry=$REG/hibrid-1.properties \ -Daere.falcon.anchor.address=0x5214F0e53899Dad805ef3AdF0624F5e49d2a5EB5 \ -Daere.falcon.anchor.block=13889290 \ -Daere.falcon.manifest=$REG/manifest-13600000.json \ diff --git a/patches/0003-aere-pq-anchor.patch b/patches/0003-aere-pq-anchor.patch index 167596f..25d06ac 100644 --- a/patches/0003-aere-pq-anchor.patch +++ b/patches/0003-aere-pq-anchor.patch @@ -1,6 +1,6 @@ -From 817da3e4ac2288e192129bbb69e8cfaaf1723812 Mon Sep 17 00:00:00 2001 +From 65a97c099634691fed1c2ee619b74b5cf0254739 Mon Sep 17 00:00:00 2001 From: Aere Network -Date: Sun, 16 Aug 2026 01:24:17 +0300 +Date: Sat, 5 Sep 2026 07:53:19 +0300 Subject: [PATCH] Aere Network: post-quantum certificate anchor for QBFT Puts a 32-byte digest of the validator certificate into vanityData, which is @@ -12,163 +12,259 @@ Hyperledger Besu and carry its copyright notice. This patch changes them. The modifications are by contributors to the Aere Network and are offered under the same Apache License 2.0; the upstream copyright headers are left as found. -Consensus on chain 2800 remains classical secp256k1 ECDSA. This binds a -post-quantum certificate to the block hash; it does not make consensus -post-quantum. +The slhdsa/ package under consensus/common is derived from Bouncy Castle 1.80 +and stays under the Bouncy Castle licence; its notice is carried alongside +(LICENSE-BouncyCastle.txt). -Updated 2026-08-15: repairs the schedule boundary at the first anchor height. -The seals rule resolves the certificate carried by the block at height H -against the registry at the parent height H-1, and the height-to-registry -schedule binds inclusively from H, so at H-1 both height-resolved lookups fell -back to the head registry, which is empty on a node syncing from genesis, and -a valid certificate was refused one block below the first anchor. Both lookups -now answer that one question from the schedule entry bound exactly one block -above, using the verified registry; two or more blocks below the schedule -nothing changes. Covered by the new PqParentHeightAlignmentTest, and measured -on a node synced from genesis, which now crosses the first anchor height -instead of stopping one block below it. - -Updated 2026-08-16: names the two historical ranges on chain 2800 in which -these rules were not fully in force, so that a node validating from genesis can -cross them. On 2026-08-10 the whole validator set was restarted inside a few -minutes; a node that has just restarted holds no seals until it takes part in -one commit, so for a moment every node held none, the next height was an anchor -height, nobody could propose and the chain stopped. The measure that restarted -it switched these rules off across the set, and then restored them with the -emergency seal ceiling lowered rather than at the scheduled threshold. The -headers written meanwhile are canonical and cannot be reproduced: over the first -range they carry the client version string in vanityData instead of the anchor -digest and their certificates are in arrival order rather than sorted; over the -second, much longer range they carry a correct digest and sorted indices but -fewer seals than the schedule asks for. Nodes already holding the chain never -revalidate them, which is why this stayed invisible; a node validating from -genesis stopped at the first header of each range and could not pass it. - -The exception therefore sits at VALIDATION, where a header is accepted as it was -written, and not in any recomputation, which would only move the error. The -ranges are fixed constants that a node cannot widen at runtime, so a NEW lapse -still stops the client, which is what should happen; outside them nothing -changes at all. Neither property is monotone, so the bounds were not searched -but measured: every anchor height from the activation height to the head was -read one at a time and its vanityData and certificate decoded, and exactly two -contiguous ranges appear. What the exception does not relax: over the first -range a certificate must still decode and must still carry non-negative, -pairwise distinct indices, so a repeated seal stays unrepresentable at every -height; over the second range only the count moves, every seal is still verified -against the parent's validator set, and the count keeps the floor that was -really in force rather than dropping to zero. Covered by the new PqAnchorLapse, -PqAnchorLapseTest and PqAnchorDisarmedWindowTest, and measured on a node synced -from genesis, which now crosses both ranges instead of stopping at the first -header of each. +Updated 2026-09-05: the v2, scheme-tagged hybrid certificate (Falcon-512 and +SLH-DSA-SHA2-128s seals, live on chain 2800 since block 17,047,600), the in-tree +SLH-DSA engine on the JDK digest, the seal-store repair (a commit heard before +the round held its proposal, or a late commit, was dropped from the store; the +round-0 proposer of an anchor then refused to propose), and the anchor interval +schedule (aere.pq.anchorIntervalSchedule, 17225968:128 on chain 2800). The +post-quantum message layers (PROPOSAL, PREPARE, COMMIT, ROUND-CHANGE seals with +per-type domains) are included with their emission and enforcement height +switches; see anchor/README.md for what is armed on chain 2800. --- .../org/hyperledger/besu/cli/BesuCommand.java | 24 + - .../cli/options/AerePqEmergencyOptions.java | 245 ++ - .../controller/QbftBesuControllerBuilder.java | 273 ++ + .../cli/options/AerePqEmergencyOptions.java | 244 + + .../controller/QbftBesuControllerBuilder.java | 281 ++ .../options/AerePqEmergencyOptionsTest.java | 136 + - .../besu/config/JsonGenesisConfigOptions.java | 23 + + .../besu/config/JsonGenesisConfigOptions.java | 22 + consensus/common/build.gradle | 7 + - .../common/bft/BftBlockInterface.java | 22 +- - .../consensus/common/bft/BftExtraData.java | 50 +- + .../common/bft/AereAnchorProposalDelay.java | 152 + + .../common/bft/BftBlockInterface.java | 26 +- + .../consensus/common/bft/BftExtraData.java | 87 +- + .../besu/consensus/common/bft/BlockTimer.java | 10 +- .../besu/consensus/common/bft/FalconSeal.java | 88 + - .../common/bft/FalconSealSupport.java | 3749 +++++++++++++++++ - .../besu/consensus/common/bft/PqAnchor.java | 339 ++ - .../consensus/common/bft/PqAnchorConfig.java | 1320 ++++++ + .../common/bft/FalconSealScheme.java | 104 + + .../common/bft/FalconSealSupport.java | 4130 +++++++++++++++++ + .../common/bft/HybridSealProducer.java | 140 + + .../common/bft/HybridSealSupport.java | 295 ++ + .../common/bft/HybridSignerRegistry.java | 307 ++ + .../besu/consensus/common/bft/PqAnchor.java | 547 +++ + .../consensus/common/bft/PqAnchorConfig.java | 1580 +++++++ .../consensus/common/bft/PqAnchorLapse.java | 375 ++ .../common/bft/PqAnchorNotReadyException.java | 132 + .../common/bft/PqAnchorSyncModeGuard.java | 130 + - .../common/bft/PqAnchorThresholdGuard.java | 252 ++ - .../common/bft/PqRegistryBinding.java | 497 +++ - .../consensus/common/bft/PqRegistryHash.java | 2341 ++++++++++ - .../common/bft/PqRegistryHashTool.java | 482 +++ - .../consensus/common/bft/PqSealCache.java | 351 ++ - .../consensus/common/bft/PqSealStore.java | 384 ++ - .../common/bft/PqSignerRegistry.java | 172 + + .../common/bft/PqAnchorThresholdGuard.java | 282 ++ + .../besu/consensus/common/bft/PqAnchorV2.java | 185 + + .../common/bft/PqRegistryBinding.java | 496 ++ + .../consensus/common/bft/PqRegistryHash.java | 2339 ++++++++++ + .../common/bft/PqRegistryHashTool.java | 481 ++ + .../common/bft/PqSchemeSchedule.java | 139 + + .../consensus/common/bft/PqSealCache.java | 431 ++ + .../consensus/common/bft/PqSealStore.java | 401 ++ + .../common/bft/PqSignerRegistry.java | 167 + + .../besu/consensus/common/bft/SchemeSeal.java | 69 + + .../besu/consensus/common/bft/SealScheme.java | 96 + + .../consensus/common/bft/SealSchemes.java | 56 + + .../common/bft/SlhDsaSealScheme.java | 136 + .../blockcreation/BftBlockCreatorFactory.java | 25 +- - .../bft/blockcreation/PqAnchorProducer.java | 347 ++ + .../bft/blockcreation/PqAnchorProducer.java | 524 +++ + .../consensus/common/bft/slhdsa/ADRS.java | 115 + + .../consensus/common/bft/slhdsa/Fors.java | 178 + + .../besu/consensus/common/bft/slhdsa/HT.java | 225 + + .../common/bft/slhdsa/IndexedDigest.java | 26 + + .../common/bft/slhdsa/JdkDigest.java | 104 + + .../bft/slhdsa/LICENSE-BouncyCastle.txt | 22 + + .../common/bft/slhdsa/NodeEntry.java | 24 + + .../besu/consensus/common/bft/slhdsa/PK.java | 24 + + .../besu/consensus/common/bft/slhdsa/SIG.java | 77 + + .../consensus/common/bft/slhdsa/SIG_FORS.java | 34 + + .../consensus/common/bft/slhdsa/SIG_XMSS.java | 34 + + .../besu/consensus/common/bft/slhdsa/SK.java | 24 + + .../common/bft/slhdsa/SLHDSAEngine.java | 466 ++ + .../bft/slhdsa/SLHDSAEngineProvider.java | 19 + + .../slhdsa/SLHDSAKeyGenerationParameters.java | 33 + + .../bft/slhdsa/SLHDSAKeyPairGenerator.java | 70 + + .../bft/slhdsa/SLHDSAKeyParameters.java | 31 + + .../common/bft/slhdsa/SLHDSAParameters.java | 186 + + .../slhdsa/SLHDSAPrivateKeyParameters.java | 80 + + .../bft/slhdsa/SLHDSAPublicKeyParameters.java | 52 + + .../common/bft/slhdsa/SLHDSASigner.java | 236 + + .../consensus/common/bft/slhdsa/WotsPlus.java | 177 + .../common/bft/tools/PqRegistryHashTool.java | 231 + - .../common/bft/FalconAttachIntervalTest.java | 232 + - .../common/bft/PqAnchorConfigTest.java | 691 +++ + .../bft/AereAnchorProposalDelayTest.java | 106 + + .../common/bft/D177NeutralNamesTest.java | 97 + + .../common/bft/FalconAttachIntervalTest.java | 228 + + .../common/bft/HybridSealProducerTest.java | 177 + + .../common/bft/HybridSealSupportTest.java | 206 + + .../common/bft/HybridSignerRegistryTest.java | 225 + + .../common/bft/PqAnchorConfigTest.java | 754 +++ .../bft/PqAnchorEmergencyConfigTest.java | 120 + - .../common/bft/PqAnchorIntervalTest.java | 186 + - .../common/bft/PqAnchorLapseTest.java | 249 ++ - .../common/bft/PqAnchorMinSealsFloorTest.java | 153 + - .../common/bft/PqAnchorProducerCostTest.java | 251 ++ + .../common/bft/PqAnchorIntervalTest.java | 184 + + .../common/bft/PqAnchorLapseTest.java | 249 + + .../common/bft/PqAnchorMinSealsFloorTest.java | 152 + + .../bft/PqAnchorProducerCacheHygieneTest.java | 104 + + .../common/bft/PqAnchorProducerCostTest.java | 250 + .../common/bft/PqAnchorSealCapTest.java | 150 + .../consensus/common/bft/PqAnchorTest.java | 301 ++ - .../bft/PqAnchorThresholdGuardTest.java | 215 + - .../common/bft/PqArmingGateTest.java | 388 ++ + .../bft/PqAnchorThresholdGuardTest.java | 232 + + .../common/bft/PqAnchorV2ProducerTest.java | 326 ++ + .../consensus/common/bft/PqAnchorV2Test.java | 192 + + .../common/bft/PqArmingGateTest.java | 387 ++ .../common/bft/PqCallerIntentTest.java | 386 ++ - .../common/bft/PqFleetRestartArmingTest.java | 390 ++ - .../common/bft/PqForkArmingTest.java | 368 ++ - .../bft/PqForkThresholdReachabilityTest.java | 355 ++ - .../bft/PqForkValidatorSetChangeTest.java | 427 ++ - .../common/bft/PqInertBinaryTest.java | 475 +++ + .../common/bft/PqFleetRestartArmingTest.java | 411 ++ + .../common/bft/PqForkArmingTest.java | 370 ++ + .../bft/PqForkThresholdReachabilityTest.java | 354 ++ + .../bft/PqForkValidatorSetChangeTest.java | 430 ++ + .../common/bft/PqInertBinaryTest.java | 475 ++ .../bft/PqParentHeightAlignmentTest.java | 229 + .../common/bft/PqRegistryBindingTest.java | 595 +++ - .../bft/PqRegistryHeightRefusalTest.java | 328 ++ - .../common/bft/PqRegistryRotationTest.java | 476 +++ - .../common/bft/PqSealPersistenceTest.java | 621 +++ - .../common/bft/PqSignedHeightTest.java | 403 ++ - .../common/bft/PqStartupHistoryTest.java | 325 ++ - .../consensus/common/bft/PqV2Fixture.java | 233 + - .../qbft/core/messagewrappers/Commit.java | 18 + - .../core/network/QbftMessageTransmitter.java | 25 +- - .../qbft/core/payload/CommitPayload.java | 147 +- - .../qbft/core/payload/MessageFactory.java | 28 +- - .../statemachine/QbftBlockHeightManager.java | 29 +- - .../qbft/core/statemachine/QbftRound.java | 191 +- - .../qbft/core/statemachine/RoundState.java | 25 + + .../bft/PqRegistryHeightRefusalTest.java | 326 ++ + .../common/bft/PqRegistryRotationTest.java | 486 ++ + .../common/bft/PqSchemeScheduleTest.java | 127 + + .../common/bft/PqSealPersistenceTest.java | 652 +++ + .../common/bft/PqSignedHeightTest.java | 402 ++ + .../common/bft/PqStartupHistoryTest.java | 324 ++ + .../consensus/common/bft/PqV2Fixture.java | 232 + + .../common/bft/PreparePqAttachGateTest.java | 101 + + .../common/bft/ProposalPqAttachGateTest.java | 104 + + .../bft/RoundChangePqAttachGateTest.java | 108 + + .../common/bft/SealSchemeAgilityTest.java | 145 + + .../common/bft/SlhDsaCrossVectorTest.java | 82 + + .../common/bft/SlhDsaFastEngineTest.java | 141 + + .../qbft/core/messagewrappers/Commit.java | 32 + + .../core/network/QbftMessageTransmitter.java | 117 +- + .../qbft/core/payload/CommitPayload.java | 262 +- + .../qbft/core/payload/MessageFactory.java | 124 +- + .../qbft/core/payload/PreparePayload.java | 112 +- + .../qbft/core/payload/ProposalPayload.java | 101 +- + .../qbft/core/payload/RoundChangePayload.java | 97 +- + .../statemachine/QbftBlockHeightManager.java | 81 +- + .../core/statemachine/QbftController.java | 57 + + .../qbft/core/statemachine/QbftRound.java | 410 +- + .../qbft/core/statemachine/RoundState.java | 37 + .../qbft/core/types/QbftBlockCreator.java | 37 + - ...ftBlockHeaderValidationRulesetFactory.java | 110 +- - .../consensus/qbft/QbftExtraDataCodec.java | 92 +- - .../qbft/adaptor/QbftBlockCreatorAdaptor.java | 214 +- + .../qbft/core/validation/CommitValidator.java | 124 +- + .../core/validation/MessageValidator.java | 24 +- + .../core/validation/PqCommitEnforcement.java | 369 ++ + .../core/validation/PqPrepareEnforcement.java | 206 + + .../validation/PqProposalEnforcement.java | 202 + + .../validation/PqRoundChangeEnforcement.java | 209 + + .../core/validation/PrepareValidator.java | 50 +- + .../validation/ProposalPayloadValidator.java | 55 +- + .../RoundChangePayloadValidator.java | 54 +- + .../network/ProposalSealPlumbingTest.java | 101 + + .../network/RoundChangeSealPlumbingTest.java | 88 + + .../core/payload/CommitPayloadHybridTest.java | 277 ++ + .../core/payload/PreparePayloadPqTest.java | 209 + + .../core/payload/ProposalPayloadPqTest.java | 202 + + .../payload/RoundChangePayloadPqTest.java | 236 + + .../PqHybridExtrasNeverThrowTest.java | 69 + + .../statemachine/PqLateSealSalvageTest.java | 195 + + .../PqSealsWithoutProposalTest.java | 168 + + .../CommitValidatorAnchorFormTest.java | 216 + + .../CommitValidatorPqEnforcementTest.java | 152 + + ...essageValidatorAnchorFormPlumbingTest.java | 109 + + .../validation/PqCommitEnforcementTest.java | 159 + + .../core/validation/PqCommitPlumbingTest.java | 108 + + .../validation/PqHybridEnforcementTest.java | 312 ++ + .../core/validation/PqMessageAgilityTest.java | 198 + + .../core/validation/PqPrepareAgilityTest.java | 180 + + .../validation/PqPrepareEnforcementTest.java | 266 ++ + .../validation/PqProposalEnforcementTest.java | 297 ++ + .../PqRoundChangeEnforcementTest.java | 422 ++ + .../PqTransportIndependenceTest.java | 437 ++ + .../PrepareValidatorPqWiringTest.java | 118 + + .../ProposalPayloadValidatorPqWiringTest.java | 133 + + .../RoundChangeJustificationPqTest.java | 298 ++ + ...undChangePayloadValidatorPqWiringTest.java | 125 + + ...ftBlockHeaderValidationRulesetFactory.java | 120 +- + .../consensus/qbft/QbftExtraDataCodec.java | 122 +- + .../qbft/adaptor/QbftBlockCreatorAdaptor.java | 213 +- .../QbftBlockCreatorFactory.java | 35 +- - .../FalconSealValidationRule.java | 501 +++ + .../AereBaseFeeImportRule.java | 135 + + .../FalconSealValidationRule.java | 513 ++ .../PqAnchorDigestAttachedRule.java | 115 + - .../PqAnchorDigestRule.java | 265 ++ - .../PqAnchorSealsRule.java | 403 ++ + .../PqAnchorDigestRule.java | 310 ++ + .../PqAnchorSealsRule.java | 579 +++ .../PqEmergencyShoutRule.java | 134 + - .../PqRegistryBindingRule.java | 91 + - .../qbft/QbftAnchorRuleWiringTest.java | 194 + - .../FalconSealLogThrottleTest.java | 182 + + .../PqRegistryBindingRule.java | 90 + + .../qbft/QbftAnchorRuleWiringTest.java | 246 + + .../AereBaseFeeImportRuleTest.java | 142 + + .../FalconSealLogThrottleTest.java | 181 + ...alconSealValidationRuleRetirementTest.java | 85 + .../PqAnchorDigestRuleTest.java | 359 ++ .../PqAnchorDisarmedWindowTest.java | 548 +++ - .../PqAnchorSealsRuleTest.java | 690 +++ + .../PqAnchorSealsRuleTest.java | 691 +++ .../PqAnchorTestSupport.java | 144 + + .../PqAnchorV2RulesTest.java | 361 ++ .../PqArmedWithoutRegistryTest.java | 185 + .../PqEmergencyShoutRuleTest.java | 78 + - .../PqForkGateFeedTest.java | 189 + + .../PqForkGateFeedTest.java | 191 + .../eth/sync/DownloadHeadersStep.java | 103 +- - 79 files changed, 25714 insertions(+), 45 deletions(-) + 169 files changed, 41451 insertions(+), 96 deletions(-) create mode 100755 app/src/main/java/org/hyperledger/besu/cli/options/AerePqEmergencyOptions.java create mode 100755 app/src/test/java/org/hyperledger/besu/cli/options/AerePqEmergencyOptionsTest.java + create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/AereAnchorProposalDelay.java create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/FalconSeal.java + create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/FalconSealScheme.java create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/FalconSealSupport.java + create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/HybridSealProducer.java + create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/HybridSealSupport.java + create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/HybridSignerRegistry.java create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqAnchor.java create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqAnchorConfig.java create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqAnchorLapse.java create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqAnchorNotReadyException.java create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqAnchorSyncModeGuard.java create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqAnchorThresholdGuard.java + create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqAnchorV2.java create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqRegistryBinding.java create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqRegistryHash.java create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqRegistryHashTool.java + create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqSchemeSchedule.java create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqSealCache.java create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqSealStore.java create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqSignerRegistry.java + create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/SchemeSeal.java + create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/SealScheme.java + create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/SealSchemes.java + create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/SlhDsaSealScheme.java create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/blockcreation/PqAnchorProducer.java + create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/ADRS.java + create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/Fors.java + create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/HT.java + create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/IndexedDigest.java + create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/JdkDigest.java + create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/LICENSE-BouncyCastle.txt + create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/NodeEntry.java + create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/PK.java + create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SIG.java + create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SIG_FORS.java + create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SIG_XMSS.java + create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SK.java + create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSAEngine.java + create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSAEngineProvider.java + create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSAKeyGenerationParameters.java + create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSAKeyPairGenerator.java + create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSAKeyParameters.java + create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSAParameters.java + create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSAPrivateKeyParameters.java + create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSAPublicKeyParameters.java + create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSASigner.java + create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/WotsPlus.java create mode 100755 consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/tools/PqRegistryHashTool.java + create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/AereAnchorProposalDelayTest.java + create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/D177NeutralNamesTest.java create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/FalconAttachIntervalTest.java + create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/HybridSealProducerTest.java + create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/HybridSealSupportTest.java + create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/HybridSignerRegistryTest.java create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorConfigTest.java create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorEmergencyConfigTest.java create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorIntervalTest.java create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorLapseTest.java create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorMinSealsFloorTest.java + create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorProducerCacheHygieneTest.java create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorProducerCostTest.java create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorSealCapTest.java create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorTest.java create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorThresholdGuardTest.java + create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorV2ProducerTest.java + create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorV2Test.java create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqArmingGateTest.java create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqCallerIntentTest.java create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqFleetRestartArmingTest.java @@ -176,14 +272,51 @@ header of each. create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqForkThresholdReachabilityTest.java create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqForkValidatorSetChangeTest.java create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqInertBinaryTest.java - create mode 100644 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqParentHeightAlignmentTest.java + create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqParentHeightAlignmentTest.java create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqRegistryBindingTest.java create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqRegistryHeightRefusalTest.java create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqRegistryRotationTest.java + create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqSchemeScheduleTest.java create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqSealPersistenceTest.java create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqSignedHeightTest.java create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqStartupHistoryTest.java create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqV2Fixture.java + create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PreparePqAttachGateTest.java + create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/ProposalPqAttachGateTest.java + create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/RoundChangePqAttachGateTest.java + create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/SealSchemeAgilityTest.java + create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/SlhDsaCrossVectorTest.java + create mode 100755 consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/SlhDsaFastEngineTest.java + create mode 100755 consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/PqCommitEnforcement.java + create mode 100755 consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/PqPrepareEnforcement.java + create mode 100755 consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/PqProposalEnforcement.java + create mode 100755 consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/PqRoundChangeEnforcement.java + create mode 100755 consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/network/ProposalSealPlumbingTest.java + create mode 100755 consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/network/RoundChangeSealPlumbingTest.java + create mode 100755 consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/payload/CommitPayloadHybridTest.java + create mode 100755 consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/payload/PreparePayloadPqTest.java + create mode 100755 consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/payload/ProposalPayloadPqTest.java + create mode 100755 consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/payload/RoundChangePayloadPqTest.java + create mode 100755 consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/statemachine/PqHybridExtrasNeverThrowTest.java + create mode 100755 consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/statemachine/PqLateSealSalvageTest.java + create mode 100755 consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/statemachine/PqSealsWithoutProposalTest.java + create mode 100755 consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/CommitValidatorAnchorFormTest.java + create mode 100755 consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/CommitValidatorPqEnforcementTest.java + create mode 100755 consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/MessageValidatorAnchorFormPlumbingTest.java + create mode 100755 consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqCommitEnforcementTest.java + create mode 100755 consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqCommitPlumbingTest.java + create mode 100755 consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqHybridEnforcementTest.java + create mode 100755 consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqMessageAgilityTest.java + create mode 100755 consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqPrepareAgilityTest.java + create mode 100755 consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqPrepareEnforcementTest.java + create mode 100755 consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqProposalEnforcementTest.java + create mode 100755 consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqRoundChangeEnforcementTest.java + create mode 100755 consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqTransportIndependenceTest.java + create mode 100755 consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PrepareValidatorPqWiringTest.java + create mode 100755 consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/ProposalPayloadValidatorPqWiringTest.java + create mode 100755 consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/RoundChangeJustificationPqTest.java + create mode 100755 consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/RoundChangePayloadValidatorPqWiringTest.java + create mode 100755 consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/AereBaseFeeImportRule.java create mode 100755 consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/FalconSealValidationRule.java create mode 100755 consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqAnchorDigestAttachedRule.java create mode 100755 consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqAnchorDigestRule.java @@ -191,12 +324,14 @@ header of each. create mode 100755 consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqEmergencyShoutRule.java create mode 100755 consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqRegistryBindingRule.java create mode 100755 consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/QbftAnchorRuleWiringTest.java + create mode 100755 consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/AereBaseFeeImportRuleTest.java create mode 100755 consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/FalconSealLogThrottleTest.java create mode 100755 consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/FalconSealValidationRuleRetirementTest.java create mode 100755 consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqAnchorDigestRuleTest.java create mode 100755 consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqAnchorDisarmedWindowTest.java create mode 100755 consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqAnchorSealsRuleTest.java create mode 100755 consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqAnchorTestSupport.java + create mode 100755 consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqAnchorV2RulesTest.java create mode 100755 consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqArmedWithoutRegistryTest.java create mode 100755 consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqEmergencyShoutRuleTest.java create mode 100755 consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqForkGateFeedTest.java @@ -205,7 +340,17 @@ diff --git a/app/src/main/java/org/hyperledger/besu/cli/BesuCommand.java b/app/s index 2767db2eb..df19c1dd2 100644 --- a/app/src/main/java/org/hyperledger/besu/cli/BesuCommand.java +++ b/app/src/main/java/org/hyperledger/besu/cli/BesuCommand.java -@@ -11,6 +11,12 @@ +@@ -1,63 +1,70 @@ + /* + * Copyright ConsenSys AG. + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on + * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the * specific language governing permissions and limitations under the License. * * SPDX-License-Identifier: Apache-2.0 @@ -218,7 +363,30 @@ index 2767db2eb..df19c1dd2 100644 */ package org.hyperledger.besu.cli; -@@ -41,6 +47,7 @@ import org.hyperledger.besu.cli.config.ProfilesCompletionCandidates; + import static com.google.common.base.Preconditions.checkNotNull; + import static com.google.common.base.Preconditions.checkState; + import static java.lang.Long.parseLong; + import static java.nio.charset.StandardCharsets.UTF_8; + import static java.util.Arrays.asList; + import static org.hyperledger.besu.cli.DefaultCommandValues.getDefaultBesuDataPath; + import static org.hyperledger.besu.cli.util.CommandLineUtils.DEPENDENCY_WARNING_MSG; + import static org.hyperledger.besu.cli.util.CommandLineUtils.isOptionSet; + import static org.hyperledger.besu.config.NetworkDefinition.EPHEMERY; + import static org.hyperledger.besu.config.NetworkDefinition.MAINNET; + import static org.hyperledger.besu.controller.BesuController.DATABASE_PATH; + import static org.hyperledger.besu.ethereum.api.jsonrpc.authentication.EngineAuthService.EPHEMERAL_JWT_FILE; + + import org.hyperledger.besu.Runner; + import org.hyperledger.besu.RunnerBuilder; + import org.hyperledger.besu.chainexport.Era1BlockExporter; + import org.hyperledger.besu.chainexport.RlpBlockExporter; + import org.hyperledger.besu.chainimport.Era1BlockImporter; + import org.hyperledger.besu.chainimport.JsonBlockImporter; + import org.hyperledger.besu.chainimport.RlpBlockImporter; + import org.hyperledger.besu.cli.config.EthNetworkConfig; + import org.hyperledger.besu.cli.config.NativeRequirement; + import org.hyperledger.besu.cli.config.NativeRequirement.NativeRequirementResult; + import org.hyperledger.besu.cli.config.ProfilesCompletionCandidates; import org.hyperledger.besu.cli.custom.JsonRPCAllowlistHostsProperty; import org.hyperledger.besu.cli.error.BesuExecutionExceptionHandler; import org.hyperledger.besu.cli.error.BesuParameterExceptionHandler; @@ -226,7 +394,41 @@ index 2767db2eb..df19c1dd2 100644 import org.hyperledger.besu.cli.options.ApiConfigurationOptions; import org.hyperledger.besu.cli.options.BalConfigurationOptions; import org.hyperledger.besu.cli.options.ChainPruningOptions; -@@ -299,6 +306,13 @@ public class BesuCommand implements DefaultCommandValues, Runnable { + import org.hyperledger.besu.cli.options.DnsOptions; + import org.hyperledger.besu.cli.options.EngineRPCConfiguration; + import org.hyperledger.besu.cli.options.EngineRPCOptions; + import org.hyperledger.besu.cli.options.EthProtocolOptions; + import org.hyperledger.besu.cli.options.EthstatsOptions; + import org.hyperledger.besu.cli.options.EvmOptions; + import org.hyperledger.besu.cli.options.GraphQlOptions; + import org.hyperledger.besu.cli.options.InProcessRpcOptions; + import org.hyperledger.besu.cli.options.IpcOptions; + import org.hyperledger.besu.cli.options.JsonRpcHttpOptions; + import org.hyperledger.besu.cli.options.LoggingLevelOption; + import org.hyperledger.besu.cli.options.MetricsOptions; + import org.hyperledger.besu.cli.options.MiningOptions; + import org.hyperledger.besu.cli.options.NatOptions; + import org.hyperledger.besu.cli.options.NativeLibraryOptions; + import org.hyperledger.besu.cli.options.NetworkingOptions; + import org.hyperledger.besu.cli.options.NodePrivateKeyFileOption; +@@ -282,40 +289,47 @@ public class BesuCommand implements DefaultCommandValues, Runnable { + private final Supplier rlpBlockImporter; + private final Function jsonBlockImporterFactory; + private final Supplier era1BlockImporter; + private final Function rlpBlockExporterFactory; + private final BiFunction + era1BlockExporterFactory; + + // Unstable CLI options + final NetworkingOptions unstableNetworkingOptions = NetworkingOptions.create(); + final SynchronizerOptions unstableSynchronizerOptions = SynchronizerOptions.create(); + final EthProtocolOptions unstableEthProtocolOptions = EthProtocolOptions.create(); + private final DnsOptions unstableDnsOptions = DnsOptions.create(); + private final NatOptions unstableNatOptions = NatOptions.create(); + private final NativeLibraryOptions unstableNativeLibraryOptions = NativeLibraryOptions.create(); + private final RPCOptions unstableRPCOptions = RPCOptions.create(); + private final EvmOptions unstableEvmOptions = EvmOptions.create(); + private final IpcOptions unstableIpcOptions = IpcOptions.create(); private final ChainPruningOptions unstableChainPruningOptions = ChainPruningOptions.create(); private final QBFTOptions unstableQbftOptions = QBFTOptions.create(); @@ -240,7 +442,41 @@ index 2767db2eb..df19c1dd2 100644 // stable CLI options final DataStorageOptions dataStorageOptions = DataStorageOptions.create(); private final EthstatsOptions ethstatsOptions = EthstatsOptions.create(); -@@ -950,6 +964,13 @@ public class BesuCommand implements DefaultCommandValues, Runnable { + private final NodePrivateKeyFileOption nodePrivateKeyFileOption = + NodePrivateKeyFileOption.create(); + private final LoggingLevelOption loggingLevelOption = LoggingLevelOption.create(); + + @CommandLine.ArgGroup(validate = false, heading = "@|bold Tx Pool Common Options|@%n") + final TransactionPoolOptions transactionPoolOptions = TransactionPoolOptions.create(); + + @CommandLine.ArgGroup(validate = false, heading = "@|bold Block Builder Options|@%n") + final MiningOptions miningOptions = MiningOptions.create(); + + private final RunnerBuilder runnerBuilder; + private final BesuController.Builder controllerBuilder; + private final BesuPluginContextImpl besuPluginContext; + private final StorageServiceImpl storageService; + private final SecurityModuleServiceImpl securityModuleService; + private final PermissioningServiceImpl permissioningService; + private final RpcEndpointServiceImpl rpcEndpointServiceImpl; +@@ -933,40 +947,47 @@ public class BesuCommand implements DefaultCommandValues, Runnable { + .setCaseInsensitiveEnumValuesAllowed(true) + .setToggleBooleanFlags(false); + } + + @Override + public void run() { + if (network != null && network.isDeprecated()) { + logger.warn(NetworkDeprecationMessage.generate(network)); + } + try { + configureLogging(true); + + if (printPathsAndExit) { + // Print configured paths requiring read/write permissions to be adjusted + checkPermissionsAndPrintPaths(besuUserName); + System.exit(0); // Exit before any services are started + } logger.info("Starting Besu"); @@ -254,7 +490,41 @@ index 2767db2eb..df19c1dd2 100644 // set merge config on the basis of genesis config setMergeConfigOptions(); -@@ -1243,6 +1264,9 @@ public class BesuCommand implements DefaultCommandValues, Runnable { + instantiateSignatureAlgorithmFactory(); + + // Need to create vertx after cmdline has been parsed, such that metricsSystem is configurable + vertx = createVertx(besuComponent.getMetricsSystem()); + + validateOptions(); + + initialProcess(); + + if (network.equals(EPHEMERY)) { + long lastGenesisTimestamp = parseLong(genesisConfigOverrides.get("timestamp")); + runner.scheduleEphemeryRestart(this, lastGenesisTimestamp); + } + runner.awaitStop(); + + } catch (final Exception e) { + logger.error("Failed to start Besu: {}", e.getMessage()); +@@ -1226,40 +1247,43 @@ public class BesuCommand implements DefaultCommandValues, Runnable { + commandLine.addMixin("Logging level", loggingLevelOption); + commandLine.addMixin("Data Storage Options", dataStorageOptions); + } + + private void handleUnstableOptions() { + // Add unstable options + final ImmutableMap.Builder unstableOptionsBuild = ImmutableMap.builder(); + final ImmutableMap unstableOptions = + unstableOptionsBuild + .put("Ethereum Wire Protocol", unstableEthProtocolOptions) + .put("P2P Network", unstableNetworkingOptions) + .put("RPC", unstableRPCOptions) + .put("DNS Configuration", unstableDnsOptions) + .put("NAT Configuration", unstableNatOptions) + .put("Synchronizer", unstableSynchronizerOptions) + .put("Native Library", unstableNativeLibraryOptions) + .put("EVM Options", unstableEvmOptions) .put("IPC Options", unstableIpcOptions) .put("Chain Data Pruning Options", unstableChainPruningOptions) .put("QBFT Options", unstableQbftOptions) @@ -264,14 +534,31 @@ index 2767db2eb..df19c1dd2 100644 .build(); UnstableOptionsSubCommand.createUnstableOptions(commandLine, unstableOptions); + } + + private void preparePlugins() { + besuPluginContext.addService(PicoCLIOptions.class, new PicoCLIOptionsImpl(commandLine)); + + metricCategoryRegistry.addCategories(BesuMetricCategory.class); + metricCategoryRegistry.addCategories(StandardMetricCategory.class); + + BesuPluginServiceRegistrar.registerEarlyServices( + besuPluginContext, + securityModuleService, + storageService, + metricCategoryRegistry, + permissioningService, + rpcEndpointServiceImpl, + transactionSelectionServiceImpl, + transactionPoolValidatorServiceImpl, diff --git a/app/src/main/java/org/hyperledger/besu/cli/options/AerePqEmergencyOptions.java b/app/src/main/java/org/hyperledger/besu/cli/options/AerePqEmergencyOptions.java new file mode 100755 -index 000000000..0d685347a +index 000000000..509c81f73 --- /dev/null +++ b/app/src/main/java/org/hyperledger/besu/cli/options/AerePqEmergencyOptions.java -@@ -0,0 +1,245 @@ +@@ -0,0 +1,244 @@ +/* -+ * Copyright contributors to Besu / Aere Network. ++ * Copyright contributors to Besu / AERE Network. + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at @@ -304,10 +591,9 @@ index 000000000..0d685347a + * If the anchor misbehaves on the live chain at three in the morning, the person on the other end of + * the page has to be able to stand it down with a RESTART. Until this class existed the controls + * were real but reachable only as system properties and environment variables, which in practice -+ * means editing a service unit or a wrapper script on every node of the fleet under time pressure, -+ * in a file whose syntax nobody remembers, with no {@code --help} to check against. Two of these -+ * options were already named in the javadoc of {@code PqAnchorConfig} as though they existed. They -+ * did not. ++ * means editing a systemd unit or a wrapper script on seven machines under time pressure, in a file ++ * whose syntax nobody remembers, with no {@code --help} to check against. Two of these options were ++ * already named in the javadoc of {@code PqAnchorConfig} as though they existed. They did not. + * + *

The three controls, and why exactly these three. + * @@ -321,10 +607,10 @@ index 000000000..0d685347a + * one to reach for when the chain has stalled because proposers cannot gather K seals - too + * many validators down, a key rotation half-done - and the rest of the scheme is fine. + *

  • {@code --Xaere-pq-registry-mismatch-allow} lets a node START and KEEP RUNNING with a Falcon -+ * registry that does not satisfy what genesis requires. This is the way back from the -+ * REGISTRY BINDING guard, which is a CONFIGURATION guard: one wrong byte in a registry file -+ * pushed to the fleet stops every node it reached, for a reason that has nothing to do with -+ * whether the blocks are valid. ++ * registry that does not satisfy what genesis requires. This is the way back from the A8 ++ * guard, which is a CONFIGURATION guard: one wrong byte in a registry file pushed to the fleet ++ * stops every node it reached, for a reason that has nothing to do with whether the blocks are ++ * valid. + * + * + *

    Every one of them shouts. A quiet way out is worse than no way out, because it will be @@ -337,10 +623,10 @@ index 000000000..0d685347a + *

    How they take effect, and why through the properties. Each option writes the SAME system + * property the control has always read, before anything reads it. That is deliberate: it leaves + * exactly one place where each decision is made, so the command line cannot mean something subtly -+ * different from the environment variable, and the code that was measured under the registry -+ * binding work and under the anchor work is the code still doing the deciding. Precedence is -+ * command line, then system property, then environment variable; which source won is written into -+ * the log so an operator never has to guess whether the flag took. ++ * different from the environment variable, and the code that was measured under A8 and under the ++ * anchor work is the code still doing the deciding. Precedence is command line, then system ++ * property, then environment variable; which source won is written into the log so an operator never ++ * has to guess whether the flag took. + * + *

    Deliberately LOCAL, not on-chain. A halted chain cannot deliver a height-scheduled + * configuration change. The only control that works when the chain is ALREADY STOPPED is one that @@ -516,10 +802,20 @@ index 000000000..0d685347a + } +} diff --git a/app/src/main/java/org/hyperledger/besu/controller/QbftBesuControllerBuilder.java b/app/src/main/java/org/hyperledger/besu/controller/QbftBesuControllerBuilder.java -index 7fbf58d0b..c245c06d2 100644 +index 7fbf58d0b..c9bd35074 100644 --- a/app/src/main/java/org/hyperledger/besu/controller/QbftBesuControllerBuilder.java +++ b/app/src/main/java/org/hyperledger/besu/controller/QbftBesuControllerBuilder.java -@@ -11,6 +11,12 @@ +@@ -1,56 +1,71 @@ + /* + * Copyright ConsenSys AG. + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on + * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the * specific language governing permissions and limitations under the License. * * SPDX-License-Identifier: Apache-2.0 @@ -532,7 +828,7 @@ index 7fbf58d0b..c245c06d2 100644 */ package org.hyperledger.besu.controller; -@@ -18,6 +24,7 @@ import static com.google.common.base.Preconditions.checkNotNull; + import static com.google.common.base.Preconditions.checkNotNull; import org.hyperledger.besu.config.BftConfigOptions; import org.hyperledger.besu.config.BftFork; @@ -540,11 +836,20 @@ index 7fbf58d0b..c245c06d2 100644 import org.hyperledger.besu.config.QbftConfigOptions; import org.hyperledger.besu.config.QbftFork; import org.hyperledger.besu.consensus.common.BftValidatorOverrides; -@@ -33,7 +40,14 @@ import org.hyperledger.besu.consensus.common.bft.BftRoundExpiryTimeCalculator; + import org.hyperledger.besu.consensus.common.EpochManager; + import org.hyperledger.besu.consensus.common.ForksSchedule; + import org.hyperledger.besu.consensus.common.bft.BftBlockInterface; + import org.hyperledger.besu.consensus.common.bft.BftContext; + import org.hyperledger.besu.consensus.common.bft.BftEventQueue; + import org.hyperledger.besu.consensus.common.bft.BftExecutors; + import org.hyperledger.besu.consensus.common.bft.BftProcessor; + import org.hyperledger.besu.consensus.common.bft.BftProtocolSchedule; + import org.hyperledger.besu.consensus.common.bft.BftRoundExpiryTimeCalculator; import org.hyperledger.besu.consensus.common.bft.BlockTimer; import org.hyperledger.besu.consensus.common.bft.EthSynchronizerUpdater; import org.hyperledger.besu.consensus.common.bft.EventMultiplexer; +import org.hyperledger.besu.consensus.common.bft.FalconSealSupport; ++import org.hyperledger.besu.consensus.common.bft.HybridSealSupport; import org.hyperledger.besu.consensus.common.bft.MessageTracker; +import org.hyperledger.besu.consensus.common.bft.PqAnchorConfig; +import org.hyperledger.besu.consensus.common.bft.PqAnchorSyncModeGuard; @@ -555,7 +860,41 @@ index 7fbf58d0b..c245c06d2 100644 import org.hyperledger.besu.consensus.common.bft.RoundTimer; import org.hyperledger.besu.consensus.common.bft.UniqueMessageMulticaster; import org.hyperledger.besu.consensus.common.bft.blockcreation.BftMiningCoordinator; -@@ -197,6 +211,212 @@ public class QbftBesuControllerBuilder extends BesuControllerBuilder { + import org.hyperledger.besu.consensus.common.bft.blockcreation.BftProposerSelector; + import org.hyperledger.besu.consensus.common.bft.blockcreation.ProposerSelector; + import org.hyperledger.besu.consensus.common.bft.network.ValidatorPeers; + import org.hyperledger.besu.consensus.common.bft.protocol.BftProtocolManager; + import org.hyperledger.besu.consensus.common.bft.statemachine.BftEventHandler; + import org.hyperledger.besu.consensus.common.bft.statemachine.FutureMessageBuffer; + import org.hyperledger.besu.consensus.common.validator.ValidatorProvider; + import org.hyperledger.besu.consensus.common.validator.blockbased.BlockValidatorProvider; + import org.hyperledger.besu.consensus.qbft.FutureMessageSynchronizerHandler; + import org.hyperledger.besu.consensus.qbft.QbftExtraDataCodec; + import org.hyperledger.besu.consensus.qbft.QbftForksSchedulesFactory; + import org.hyperledger.besu.consensus.qbft.QbftProtocolScheduleBuilder; + import org.hyperledger.besu.consensus.qbft.adaptor.AdaptorUtil; + import org.hyperledger.besu.consensus.qbft.adaptor.BftEventHandlerAdaptor; + import org.hyperledger.besu.consensus.qbft.adaptor.QbftBlockCodecAdaptor; + import org.hyperledger.besu.consensus.qbft.adaptor.QbftBlockCreatorFactoryAdaptor; + import org.hyperledger.besu.consensus.qbft.adaptor.QbftBlockInterfaceAdaptor; +@@ -180,69 +195,299 @@ public class QbftBesuControllerBuilder extends BesuControllerBuilder { + new BftProtocolManager( + bftEventQueue, + peers, + Istanbul100SubProtocol.ISTANBUL_100, + Istanbul100SubProtocol.get().getName())); + maybeSnapProtocolManager.ifPresent( + snapProtocolManager -> + subProtocolConfiguration.withSubProtocol(SnapProtocol.get(), snapProtocolManager)); + return subProtocolConfiguration; + } + + @Override + protected MiningCoordinator createMiningCoordinator( + final ProtocolSchedule protocolSchedule, + final ProtocolContext protocolContext, + final TransactionPool transactionPool, + final MiningConfiguration miningConfiguration, final SyncState syncState, final EthProtocolManager ethProtocolManager) { final MutableBlockchain blockchain = protocolContext.getBlockchain(); @@ -583,6 +922,14 @@ index 7fbf58d0b..c245c06d2 100644 + .orElse(false), + dataDirectory); + ++ // D-334 (2026-09-03): the HYBRID configuration (scheme schedule, registry, SLH-DSA key) is ++ // loaded HERE, at startup, and not on first use. Measured on mainnet 2800: a registry the ++ // container user could not read passed every configuration gate (the file existed) and blew up ++ // inside the QBFT state machine at every anchor parent on three armed validators; with a fourth ++ // node restarting the chain stood 125 s. A defect in this configuration must refuse to START, ++ // exactly like the Falcon key above; QbftRound.hybridExtrasOrEmpty is the second net. ++ HybridSealSupport.instance(); ++ + // AERE GARDA-CHEIE-MASINA (2026-08-07): the Falcon key loaded must be THIS machine's own. + // + // Measured on seven test nodes with a single variable changed: node 0 was handed index 1's key. @@ -612,7 +959,8 @@ index 7fbf58d0b..c245c06d2 100644 + // eligible Falcon seal(s) ... threshold is 3", over "Attachment stays OFF (fail-safe)". + // With K=0 the chain heals itself. With K>0 it NEVER heals. + // -+ // A simultaneous restart of the seven is not an exotic scenario: it is a power cut, a scheduled ++ // A simultaneous restart of the whole fleet is not an exotic scenario: it is a power cut, a ++ // scheduled + // kernel update, or any procedure that starts the fleet all at once. + // + // The repair invents nothing and weakens no check: it does here, once, exactly what the import @@ -658,7 +1006,7 @@ index 7fbf58d0b..c245c06d2 100644 + } + } + -+ // AERE REGISTRY-BINDING (2026-08-01): bind the Falcon registry to consensus. ++ // AERE A8 (2026-08-01): bind the Falcon registry to consensus. + // + // Deliberately placed immediately after the attachment guard and before BftExecutors, for the + // same reason: a chain head exists here, and the network and the QBFT state machine have not @@ -669,13 +1017,13 @@ index 7fbf58d0b..c245c06d2 100644 + // The two guards answer different questions - "is the activation height sane relative to this + // chain" and "is this the registry this chain requires" - and both have to be true. + // -+ // AERE REGISTRY-BINDING (2026-08-02): the SCHEDULE comes from the genesis configuration BESU -+ // BOOTED WITH, not from a genesis file re-opened by path from a system property. Re-reading a -+ // file would have reproduced the defect one level up: the enforced binding would again depend -+ // on a local file a node can be pointed at wrongly, and a node reading a stale copy would -+ // enforce a stale schedule, or none, in silence. Read from GenesisConfigOptions there is no -+ // second file: the value enforced comes out of the same object that produced this node's -+ // genesis hash, so a node that disagrees about the schedule already disagrees about the chain. ++ // AERE A8 (2026-08-02): the SCHEDULE comes from the genesis configuration BESU BOOTED WITH, not ++ // from a genesis file re-opened by path from a system property. Re-reading a file would have ++ // reproduced the defect one level up: the enforced binding would again depend on a local file a ++ // node can be pointed at wrongly, and a node reading a stale copy would enforce a stale ++ // schedule, or none, in silence. Read from GenesisConfigOptions there is no second file: the ++ // value enforced comes out of the same object that produced this node's genesis hash, so a node ++ // that disagrees about the schedule already disagrees about the chain. + // + // MEASURED, and it is the input that decides the hash: the live chain 2800 genesis carries + // config.chainId = 2800, so getChainId() is PRESENT and the 0L fallback below is not the value @@ -726,13 +1074,12 @@ index 7fbf58d0b..c245c06d2 100644 + // with zero seals, nobody reached K, nobody could propose, and so nobody sent another Commit. + // The same circular deadlock, one level down. + // -+ // WHY THIS IS NOT A REGISTRY-TRUSTED-FROM-A-FILE IN NEW CLOTHES, and this is the whole security -+ // argument: the seal is SELF-VERIFYING. Every seal read from the file is cryptographically -+ // verified again against the anchored registry, over an M rebuilt from the head header this very -+ // process has just loaded, exactly as the producer does at selection time. A forged file cannot -+ // inject a seal without forging a Falcon-512 signature; all it can obtain is the empty cache an -+ // absent file already gives. The defect back then was a REGISTRY of keys trusted because it sat -+ // in a file. ++ // WHY THIS IS NOT A8 IN NEW CLOTHES, and this is the whole security argument: the seal is ++ // SELF-VERIFYING. Every seal read from the file is cryptographically verified again against the ++ // anchored registry, over an M rebuilt from the head header this very process has just loaded, ++ // exactly as the producer does at selection time. A forged file cannot inject a seal without ++ // forging a Falcon-512 signature; all it can obtain is the empty cache an absent file already ++ // gives. A8 was a REGISTRY of keys trusted because it sat in a file. + // + // Deliberately here: the registry is already armed by the block above (otherwise no seal could + // resolve and the restore would have gone quiet for nothing), the chain head exists, and the @@ -768,7 +1115,29 @@ index 7fbf58d0b..c245c06d2 100644 final BftExecutors bftExecutors = BftExecutors.create(metricsSystem, BftExecutors.ConsensusType.QBFT); final QbftBlockCodec blockEncoder = new QbftBlockCodecAdaptor(qbftExtraDataCodec); -@@ -226,6 +446,22 @@ public class QbftBesuControllerBuilder extends BesuControllerBuilder { + + final Address localAddress = Util.publicKeyToAddress(nodeKey.getPublicKey()); + final BftProtocolSchedule bftProtocolSchedule = (BftProtocolSchedule) protocolSchedule; + QbftProtocolSchedule qbftProtocolSchedule = + new QbftProtocolScheduleAdaptor(bftProtocolSchedule, protocolContext); + final QbftBlockCreatorFactory blockCreatorFactory = + new QbftBlockCreatorFactory( + transactionPool, + protocolContext, + bftProtocolSchedule, + qbftForksSchedule, + miningConfiguration, + localAddress, + qbftExtraDataCodec, + ethProtocolManager.ethContext().getScheduler()); + + final ValidatorProvider validatorProvider; + if (qbftConfig.getStartBlock().isPresent()) { + validatorProvider = + protocolContext + .getConsensusContext(BftContext.class, qbftConfig.getStartBlock().getAsLong()) + .getValidatorProvider(); + } else { validatorProvider = protocolContext.getConsensusContext(BftContext.class).getValidatorProvider(); } @@ -791,13 +1160,47 @@ index 7fbf58d0b..c245c06d2 100644 final QbftValidatorProvider qbftValidatorProvider = new QbftValidatorProviderAdaptor(validatorProvider); -@@ -447,6 +683,43 @@ public class QbftBesuControllerBuilder extends BesuControllerBuilder { + final QbftBlockInterface qbftBlockInterface = new QbftBlockInterfaceAdaptor(bftBlockInterface); + + final ProposerSelector proposerSelector = + new BftProposerSelector(blockchain, bftBlockInterface, true, validatorProvider); + + // NOTE: peers should not be used for accessing the network as it does not enforce the + // "only send once" filter applied by the UniqueMessageMulticaster. + peers = new ValidatorPeers(validatorProvider, Istanbul100SubProtocol.NAME); + + final UniqueMessageMulticaster uniqueMessageMulticaster = + new UniqueMessageMulticaster(peers, qbftConfig.getGossipedHistoryLimit()); + + final QbftGossiperImpl gossiper = new QbftGossiperImpl(uniqueMessageMulticaster, blockEncoder); + + final QbftFinalState finalState = + new QbftFinalStateImpl( + validatorProvider, +@@ -430,36 +675,72 @@ public class QbftBesuControllerBuilder extends BesuControllerBuilder { + return new BftContext(validatorProvider, epochManager, bftBlockInterface); + } + + private BftValidatorOverrides convertBftForks(final List bftForks) { + final Map> result = new HashMap<>(); + + for (final BftFork fork : bftForks) { + fork.getValidators() + .ifPresent( + validators -> + result.put( + fork.getForkBlock(), + validators.stream() + .map(Address::fromHexString) + .collect(Collectors.toList()))); + } + return new BftValidatorOverrides(result); } + /** -+ * AERE REGISTRY-BINDING: read a genesis {@code config.*} value that Besu itself does not model, -+ * out of the genesis configuration THIS NODE BOOTED WITH. ++ * AERE A8: read a genesis {@code config.*} value that Besu itself does not model, out of the ++ * genesis configuration THIS NODE BOOTED WITH. + * + *

    Besu's {@code GenesisConfigOptions.asMap()} cannot be used for this: it is an allow-list of + * the keys Besu knows about, so a key of ours is simply absent from it and the guard would read @@ -817,10 +1220,9 @@ index 7fbf58d0b..c245c06d2 100644 + private com.fasterxml.jackson.databind.JsonNode aereGenesisConfigNode(final String key) { + if (!(genesisConfigOptions instanceof JsonGenesisConfigOptions)) { + LOG.warn( -+ "AERE PQC REGISTRY-BINDING: the genesis configuration is a {}, not the JSON-backed " -+ + "implementation, so config.{} cannot be read and the Falcon registry binding is " -+ + "NOT ENFORCED on this node. A binding everybody believes is on and is not is worse " -+ + "than no binding.", ++ "AERE PQC A8: the genesis configuration is a {}, not the JSON-backed implementation, so " ++ + "config.{} cannot be read and the Falcon registry binding is NOT ENFORCED on this " ++ + "node. A binding everybody believes is on and is not is worse than no binding.", + genesisConfigOptions.getClass().getName(), + key); + return null; @@ -835,14 +1237,27 @@ index 7fbf58d0b..c245c06d2 100644 private static MinedBlockObserver blockLogger( final TransactionPool transactionPool, final Address localAddress) { return block -> + LOG.info( + String.format( + "%s %s #%,d / %d tx / %d pending / %,d (%01.1f%%) gas / (%s)", + block.getHeader().getCoinbase().equals(localAddress) ? "Produced" : "Imported", + block.getBody().getTransactions().isEmpty() ? "empty block" : "block", + block.getHeader().getNumber(), + block.getBody().getTransactions().size(), + transactionPool.count(), + block.getHeader().getGasUsed(), + (block.getHeader().getGasUsed() * 100.0) / block.getHeader().getGasLimit(), + block.getHash().getBytes().toHexString())); + } + } diff --git a/app/src/test/java/org/hyperledger/besu/cli/options/AerePqEmergencyOptionsTest.java b/app/src/test/java/org/hyperledger/besu/cli/options/AerePqEmergencyOptionsTest.java new file mode 100755 -index 000000000..e74459f24 +index 000000000..b77a549b2 --- /dev/null +++ b/app/src/test/java/org/hyperledger/besu/cli/options/AerePqEmergencyOptionsTest.java @@ -0,0 +1,136 @@ +/* -+ * Copyright contributors to Besu / Aere Network. ++ * Copyright contributors to Besu / AERE Network. + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at @@ -978,10 +1393,20 @@ index 000000000..e74459f24 + } +} diff --git a/config/src/main/java/org/hyperledger/besu/config/JsonGenesisConfigOptions.java b/config/src/main/java/org/hyperledger/besu/config/JsonGenesisConfigOptions.java -index eeaa4ac3e..e0d6a6025 100644 +index eeaa4ac3e..79581600f 100644 --- a/config/src/main/java/org/hyperledger/besu/config/JsonGenesisConfigOptions.java +++ b/config/src/main/java/org/hyperledger/besu/config/JsonGenesisConfigOptions.java -@@ -11,6 +11,12 @@ +@@ -1,33 +1,39 @@ + /* + * Copyright ConsenSys AG. + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on + * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the * specific language governing permissions and limitations under the License. * * SPDX-License-Identifier: Apache-2.0 @@ -994,14 +1419,47 @@ index eeaa4ac3e..e0d6a6025 100644 */ package org.hyperledger.besu.config; -@@ -639,4 +645,21 @@ public class JsonGenesisConfigOptions implements GenesisConfigOptions { + import static java.util.Collections.emptyMap; + import static java.util.Objects.isNull; + + import org.hyperledger.besu.datatypes.Address; + import org.hyperledger.besu.datatypes.Hash; + import org.hyperledger.besu.datatypes.Wei; + + import java.math.BigInteger; + import java.util.List; + import java.util.Map; + import java.util.Objects; + import java.util.Optional; + import java.util.OptionalInt; + import java.util.OptionalLong; + import java.util.TreeMap; + import java.util.stream.Stream; + +@@ -622,21 +628,37 @@ public class JsonGenesisConfigOptions implements GenesisConfigOptions { + .filter(OptionalLong::isPresent) + .map(OptionalLong::getAsLong) + .distinct() + .sorted() + .toList(); + } + + @Override + public boolean equals(final Object o) { + if (this == o) return true; + if (o == null || getClass() != o.getClass()) return false; + final JsonGenesisConfigOptions that = (JsonGenesisConfigOptions) o; + return Objects.equals(configRoot, that.configRoot) + && Objects.equals(configOverrides, that.configOverrides); + } + + @Override public int hashCode() { return Objects.hash(configRoot, configOverrides); } + + /** -+ * AERE REGISTRY-BINDING: the raw genesis {@code config.*} value for a key Besu does not model, or -+ * null. ++ * AERE A8: the raw genesis {@code config.*} value for a key Besu does not model, or null. + * + *

    WHY THIS EXISTS. {@link #asMap()} is an allow-list of the keys Besu knows, so a key of ours + * is absent from it, and a guard reading it would conclude "no schedule" on a genesis that @@ -1020,7 +1478,7 @@ diff --git a/consensus/common/build.gradle b/consensus/common/build.gradle index 499c974f1..a6f5276f2 100644 --- a/consensus/common/build.gradle +++ b/consensus/common/build.gradle -@@ -1,16 +1,22 @@ +@@ -1,69 +1,76 @@ /* * Copyright ConsenSys AG. * @@ -1043,7 +1501,36 @@ index 499c974f1..a6f5276f2 100644 */ apply plugin: 'java-library' -@@ -47,6 +53,7 @@ dependencies { + + jar { + archiveBaseName = calculateArtifactId(project) + manifest { + attributes( + 'Specification-Title': archiveBaseName, + 'Specification-Version': project.version, + 'Implementation-Title': archiveBaseName, + 'Implementation-Version': calculateVersion(), + 'Commit-Hash': getGitCommitDetails(40).hash + ) + } + } + + dependencies { + api project(':plugin-api') + + implementation project(':config') + implementation project(':crypto:services') + implementation project(':datatypes') + implementation project(':ethereum:api') + implementation project(':ethereum:blockcreation') + implementation project(':ethereum:core') + implementation project(':ethereum:eth') + implementation project(':ethereum:p2p') + implementation project(':ethereum:rlp') + implementation project(':evm') + implementation project(':util') + + compileOnly 'org.jspecify:jspecify' implementation 'com.fasterxml.jackson.core:jackson-databind' implementation 'com.google.guava:guava' @@ -1051,11 +1538,196 @@ index 499c974f1..a6f5276f2 100644 implementation 'io.consensys.tuweni:tuweni-bytes' testImplementation project(':config') + testImplementation project(':crypto:algorithms') + testImplementation project(':testutil') + testImplementation project( path: ':ethereum:core', configuration: 'testSupportArtifacts') + testImplementation project( path: ':crypto:services', configuration: 'testSupportArtifacts') + testImplementation project(':metrics:core') + + testImplementation 'org.assertj:assertj-core' + testImplementation 'org.awaitility:awaitility' + testImplementation 'org.junit.jupiter:junit-jupiter' + testImplementation 'org.mockito:mockito-core' + testImplementation 'org.mockito:mockito-junit-jupiter' + + testSupportImplementation project( path: ':crypto:services', configuration: 'testSupportArtifacts') + testSupportImplementation project( path: ':ethereum:core', configuration: 'testSupportArtifacts') + testSupportImplementation 'org.mockito:mockito-core' + testSupportImplementation 'org.assertj:assertj-core' + } +diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/AereAnchorProposalDelay.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/AereAnchorProposalDelay.java +new file mode 100755 +index 000000000..84eeb15a4 +--- /dev/null ++++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/AereAnchorProposalDelay.java +@@ -0,0 +1,152 @@ ++/* ++ * Copyright contributors to Aere Network. ++ * ++ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in ++ * compliance with the License. You may obtain a copy of the License at ++ * ++ * http://www.apache.org/licenses/LICENSE-2.0 ++ * ++ * Unless required by applicable law or agreed to in writing, software distributed under the License is ++ * distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or ++ * implied. See the License for the specific language governing permissions and limitations under the ++ * License. ++ * ++ * SPDX-License-Identifier: Apache-2.0 ++ */ ++package org.hyperledger.besu.consensus.common.bft; ++ ++import org.hyperledger.besu.consensus.common.bft.blockcreation.PqAnchorProducer; ++import org.slf4j.Logger; ++import org.slf4j.LoggerFactory; ++ ++/** ++ * D-337 (2026-09-04): how long the proposer waits, ONLY at an anchor height, before its proposal ++ * timer fires. ++ * ++ *

    WHY THIS EXISTS, measured on chain 2800. At an anchor height the proposer must carry K valid ++ * seals of EVERY scheme in the schedule, and the SLH-DSA seals arrive with the commits of the ++ * parent. With the hybrid certificate live, the proposal timer fires about half a second after the ++ * parent and the sixth SLH-DSA seal is not there yet, so the producer refuses (it will not write a ++ * certificate it cannot fill), round 0 expires, and the anchor costs the whole four-second ++ * round-change timeout: eleven of twelve anchors measured on 2026-09-04, parent-to-anchor 5.6 s ++ * instead of 0.8 s. Making the signature four times faster fixed the PARENT (3.3 s to 1 s) and did ++ * not fix this, because the race is against the proposal timer, not against the CPU. ++ * ++ *

    WHAT IT IS NOT. This is local timing, not consensus. A node that does not set it proposes ++ * exactly as before; a proposal that arrives later is valid under the same rules (QBFT only ++ * requires the timestamp to be at least a block period after the parent). So it can be set node by ++ * node, with no activation height and no fleet agreement, and a wrong value costs liveness at ++ * anchors, never a fork. ++ * ++ *

    Unset or zero means today's behaviour, exactly. The value is read once, validated at node ++ * start (from {@link BlockTimer}'s constructor), and refused if it is negative or above five ++ * seconds: a delay longer than the round-change timeout would trade one stall for another. ++ */ ++public final class AereAnchorProposalDelay { ++ private static final Logger LOG = LoggerFactory.getLogger(AereAnchorProposalDelay.class); ++ ++ /** System property carrying the delay in milliseconds. */ ++ public static final String PROPERTY = "aere.pq.anchorProposalDelayMs"; ++ ++ /** Environment variable carrying the delay in milliseconds. */ ++ public static final String ENV = "AERE_PQ_ANCHOR_PROPOSAL_DELAY_MS"; ++ ++ /** The largest delay that can be configured; above this a stall is traded for a stall. */ ++ public static final long MAX_MILLIS = 5000L; ++ ++ private static volatile Long cached; ++ ++ private AereAnchorProposalDelay() {} ++ ++ /** ++ * The configured delay in milliseconds, read once and memoised. ++ * ++ * @return the delay, zero when unset ++ * @throws IllegalArgumentException if the value is not a number in [0, {@link #MAX_MILLIS}] ++ */ ++ public static long configuredMillis() { ++ Long local = cached; ++ if (local == null) { ++ synchronized (AereAnchorProposalDelay.class) { ++ local = cached; ++ if (local == null) { ++ local = parse(readRaw()); ++ if (local > 0) { ++ LOG.info( ++ "AERE PQ-ANCHOR: proposals at anchor heights wait an extra {} ms for the seals of" ++ + " the parent (D-337). This is local timing, not consensus.", ++ local); ++ } ++ cached = local; ++ } ++ } ++ } ++ return local; ++ } ++ ++ /** ++ * The delay to add to the proposal timer for a given height: the configured value at an anchor ++ * height, zero everywhere else. ++ * ++ * @param blockNumber the height whose proposal timer is being started ++ * @return milliseconds to add ++ */ ++ public static long millisFor(final long blockNumber) { ++ final long delay = configuredMillis(); ++ if (delay <= 0) { ++ return 0L; ++ } ++ try { ++ return PqAnchorProducer.config().anchorAppliesAt(blockNumber) ? delay : 0L; ++ } catch (final RuntimeException e) { ++ // The anchor configuration is read at start and refuses there; if it somehow cannot be read ++ // here, the honest answer is "no extra delay", never an exception into the block timer. ++ LOG.warn("AERE PQ-ANCHOR: cannot tell whether {} is an anchor height: {}", blockNumber, e.getMessage()); ++ return 0L; ++ } ++ } ++ ++ /** ++ * Parse and validate a raw value. ++ * ++ * @param raw the text, possibly null or blank ++ * @return the delay in milliseconds ++ */ ++ static long parse(final String raw) { ++ if (raw == null || raw.isBlank()) { ++ return 0L; ++ } ++ final long value; ++ try { ++ value = Long.parseLong(raw.trim()); ++ } catch (final NumberFormatException e) { ++ throw new IllegalArgumentException( ++ "AERE-PQC-ANCHOR-CONF-05: " + PROPERTY + "='" + raw + "' is not a number of milliseconds"); ++ } ++ if (value < 0 || value > MAX_MILLIS) { ++ throw new IllegalArgumentException( ++ "AERE-PQC-ANCHOR-CONF-05: " ++ + PROPERTY ++ + "=" ++ + value ++ + " is outside [0, " ++ + MAX_MILLIS ++ + "] ms. A delay longer than the round-change timeout trades one stall for another."); ++ } ++ return value; ++ } ++ ++ private static String readRaw() { ++ final String property = System.getProperty(PROPERTY); ++ return property != null ? property : System.getenv(ENV); ++ } ++ ++ /** ++ * Drop the memoised value. For tests only. ++ */ ++ static void forgetForTesting() { ++ synchronized (AereAnchorProposalDelay.class) { ++ cached = null; ++ } ++ } ++} diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/BftBlockInterface.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/BftBlockInterface.java -index b7a886c29..da9a3e3ae 100644 +index b7a886c29..77af53d68 100644 --- a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/BftBlockInterface.java +++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/BftBlockInterface.java -@@ -11,6 +11,12 @@ +@@ -1,33 +1,39 @@ + /* + * Copyright ConsenSys AG. + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on + * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the * specific language governing permissions and limitations under the License. * * SPDX-License-Identifier: Apache-2.0 @@ -1068,7 +1740,41 @@ index b7a886c29..da9a3e3ae 100644 */ package org.hyperledger.besu.consensus.common.bft; -@@ -79,6 +85,19 @@ public class BftBlockInterface implements BlockInterface { + import org.hyperledger.besu.consensus.common.BlockInterface; + import org.hyperledger.besu.consensus.common.validator.ValidatorVote; + import org.hyperledger.besu.consensus.common.validator.VoteType; + import org.hyperledger.besu.datatypes.Address; + import org.hyperledger.besu.datatypes.Hash; + import org.hyperledger.besu.ethereum.core.Block; + import org.hyperledger.besu.ethereum.core.BlockHeader; + import org.hyperledger.besu.ethereum.core.BlockHeaderBuilder; + import org.hyperledger.besu.ethereum.core.BlockHeaderFunctions; + import org.hyperledger.besu.ethereum.core.Util; + + import java.util.Collection; + import java.util.List; + import java.util.Optional; + import java.util.stream.Collectors; + + /** The Bft block interface. */ +@@ -62,55 +68,73 @@ public class BftBlockInterface implements BlockInterface { + final Vote headerVote = bftExtraData.getVote().get(); + final ValidatorVote vote = + new ValidatorVote( + headerVote.isAuth() ? VoteType.ADD : VoteType.DROP, + getProposerOfBlock(header), + headerVote.getRecipient()); + return Optional.of(vote); + } + return Optional.empty(); + } + + @Override + public Collection

    validatorsInBlock(final BlockHeader header) { + final BftExtraData bftExtraData = bftExtraDataCodec.decode(header); + return bftExtraData.getValidators(); + } + /** * Replace round in block. * @@ -1088,21 +1794,59 @@ index b7a886c29..da9a3e3ae 100644 * @param block the block * @param round the round * @param blockHeaderFunctions the block header functions -@@ -93,7 +112,8 @@ public class BftBlockInterface implements BlockInterface { + * @return the block + */ + public Block replaceRoundInBlock( + final Block block, final int round, final BlockHeaderFunctions blockHeaderFunctions) { + final BftExtraData prevExtraData = bftExtraDataCodec.decode(block.getHeader()); + final BftExtraData substituteExtraData = + new BftExtraData( + prevExtraData.getVanityData(), prevExtraData.getSeals(), prevExtraData.getVote(), round, - prevExtraData.getValidators()); + prevExtraData.getValidators(), -+ prevExtraData.getFalconSeals()); ++ prevExtraData.getFalconSeals(), ++ // AERE ANCHOR V2 (2026-09-03, D-328): the scheme-tagged certificate rides along too. Without ++ // this line every v2 header lost its certificate at the round substitution and the fleet ++ // refused its own first v2 anchor (testnet 28001, block 168032, 3 hours stalled). ++ prevExtraData.getHybridSeals()); final BlockHeaderBuilder headerBuilder = BlockHeaderBuilder.fromHeader(block.getHeader()); headerBuilder + .extraData(bftExtraDataCodec.encode(substituteExtraData)) + .blockHeaderFunctions(blockHeaderFunctions); + + final BlockHeader newHeader = headerBuilder.buildBlockHeader(); + + return new Block(newHeader, block.getBody()); + } + + /** + * Gets extra data. + * + * @param header the header + * @return the extra data + */ + public BftExtraData getExtraData(final BlockHeader header) { + return bftExtraDataCodec.decode(header); + } diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/BftExtraData.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/BftExtraData.java -index a24c33a93..913f68f0a 100644 +index a24c33a93..c444a1514 100644 --- a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/BftExtraData.java +++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/BftExtraData.java -@@ -11,6 +11,12 @@ +@@ -1,78 +1,141 @@ + /* + * Copyright ConsenSys AG. + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on + * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the * specific language governing permissions and limitations under the License. * * SPDX-License-Identifier: Apache-2.0 @@ -1115,15 +1859,25 @@ index a24c33a93..913f68f0a 100644 */ package org.hyperledger.besu.consensus.common.bft; -@@ -21,6 +27,7 @@ import org.hyperledger.besu.datatypes.Address; + import static com.google.common.base.Preconditions.checkNotNull; + + import org.hyperledger.besu.crypto.SECPSignature; + import org.hyperledger.besu.datatypes.Address; import org.hyperledger.besu.ethereum.core.ParsedExtraData; import java.util.Collection; +import java.util.Collections; ++import java.util.List; import java.util.Optional; import org.apache.tuweni.bytes.Bytes; -@@ -34,7 +41,15 @@ public class BftExtraData implements ParsedExtraData { + + /** The Bft extra data. */ + public class BftExtraData implements ParsedExtraData { + private final Bytes vanityData; + private final Collection seals; + private final Collection
    validators; + private final Optional vote; private final int round; /** @@ -1133,6 +1887,8 @@ index a24c33a93..913f68f0a 100644 + * committed seals or the block/header hash. + */ + private final Collection falconSeals; ++ /** AERE ANCHOR V2: the scheme-tagged certificate; empty on every header below the v2 height. */ ++ private final List hybridSeals; + + /** + * Instantiates a new Bft extra data (no Falcon seals). Retained for callers, notably the IBFT @@ -1140,7 +1896,13 @@ index a24c33a93..913f68f0a 100644 * * @param vanityData the vanity data * @param seals the seals -@@ -48,14 +63,36 @@ public class BftExtraData implements ParsedExtraData { + * @param vote the vote + * @param round the round + * @param validators the validators + */ + public BftExtraData( + final Bytes vanityData, + final Collection seals, final Optional vote, final int round, final Collection
    validators) { @@ -1164,7 +1926,30 @@ index a24c33a93..913f68f0a 100644 + final int round, + final Collection
    validators, + final Collection falconSeals) { ++ this(vanityData, seals, vote, round, validators, falconSeals, Collections.emptyList()); ++ } ++ ++ /** ++ * Full constructor. ++ * ++ * @param hybridSeals the scheme-tagged (v2) certificate, or empty; a header carries the v1 Falcon ++ * list OR the v2 certificate, never both ++ */ ++ public BftExtraData( ++ final Bytes vanityData, ++ final Collection seals, ++ final Optional vote, ++ final int round, ++ final Collection
    validators, ++ final Collection falconSeals, ++ final List hybridSeals) { checkNotNull(vanityData); ++ checkNotNull(hybridSeals); ++ if (!hybridSeals.isEmpty() && falconSeals != null && !falconSeals.isEmpty()) { ++ throw new IllegalArgumentException( ++ "AERE ANCHOR V2: a header carries the v1 Falcon list OR the v2 certificate, not both"); ++ } ++ this.hybridSeals = List.copyOf(hybridSeals); checkNotNull(seals); checkNotNull(validators); + checkNotNull(falconSeals); @@ -1177,7 +1962,41 @@ index a24c33a93..913f68f0a 100644 } /** -@@ -103,6 +140,15 @@ public class BftExtraData implements ParsedExtraData { + * Gets vanity data. + * + * @return the vanity data + */ + public Bytes getVanityData() { + return vanityData; + } + + /** + * Gets seals. + * + * @return the seals + */ + public Collection getSeals() { + return seals; + } + +@@ -86,36 +149,58 @@ public class BftExtraData implements ParsedExtraData { + } + + /** + * Gets vote. + * + * @return the vote + */ + public Optional getVote() { + return vote; + } + + /** + * Gets round. + * + * @return the round + */ + public int getRound() { return round; } @@ -1189,27 +2008,140 @@ index a24c33a93..913f68f0a 100644 + public Collection getFalconSeals() { + return falconSeals; + } ++ ++ /** ++ * The scheme-tagged (v2) certificate. ++ * ++ * @return the v2 seals, canonical order; empty below the v2 height ++ */ ++ public List getHybridSeals() { ++ return hybridSeals; ++ } + @Override public String toString() { return "BftExtraData{" -@@ -116,6 +162,8 @@ public class BftExtraData implements ParsedExtraData { + + "vanityData=" + + vanityData + + ", seals=" + + seals + + ", validators=" + + validators + + ", vote=" + vote + ", round=" + round + + ", falconSeals=" + + falconSeals ++ + ", hybridSeals=" ++ + hybridSeals + '}'; } } +diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/BlockTimer.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/BlockTimer.java +index 80f6815c8..78178359e 100644 +--- a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/BlockTimer.java ++++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/BlockTimer.java +@@ -36,40 +36,42 @@ public class BlockTimer { + private final BftExecutors bftExecutors; + private Optional> currentTimerTask; + private final BftEventQueue queue; + private final Clock clock; + private long blockPeriodSeconds; + private long emptyBlockPeriodSeconds; + + /** + * Construct a BlockTimer with primed executor service ready to start timers + * + * @param queue The queue in which to put block expiry events + * @param forksSchedule Bft fork schedule that contains block period seconds + * @param bftExecutors Executor services that timers can be scheduled with + * @param clock System clock + */ + public BlockTimer( + final BftEventQueue queue, + final ForksSchedule forksSchedule, + final BftExecutors bftExecutors, + final Clock clock) { ++ // D-334: o configuratie gresita se refuza la PORNIRE, nu la prima intrebuintare in masina de stari ++ AereAnchorProposalDelay.configuredMillis(); + this.queue = queue; + this.forksSchedule = forksSchedule; + this.bftExecutors = bftExecutors; + this.currentTimerTask = Optional.empty(); + this.clock = clock; + this.blockPeriodSeconds = 0; + this.emptyBlockPeriodSeconds = 0; + } + + /** Cancels the current running round timer if there is one */ + public synchronized void cancelTimer() { + currentTimerTask.ifPresent(t -> t.cancel(false)); + currentTimerTask = Optional.empty(); + } + + /** + * Whether there is a timer currently running or not + * + * @return boolean of whether a timer is ticking or not + */ +@@ -106,41 +108,47 @@ public class BlockTimer { + } + + // Experimental option for test scenarios only. Not for production use. + final long blockPeriodMilliseconds = currentForkOptions.getBlockPeriodMilliseconds(); + if (blockPeriodMilliseconds > 0) { + // Experimental mode for setting < 1 second block periods e.g. for CI/CD pipelines + // running tests against Besu + expiryTime = clock.millis() + blockPeriodMilliseconds; + LOG.warn( + "Test-mode only xblockperiodmilliseconds has been set to {} millisecond blocks. Do not use in a production system.", + blockPeriodMilliseconds); + } else { + // absolute time when the timer is supposed to expire + final long minimumTimeBetweenBlocksMillis = currentBlockPeriodSeconds * 1000L; + expiryTime = headerTimestamp.get() * 1_000 + minimumTimeBetweenBlocksMillis; + } + + final int emptyBlockPeriodSeconds = currentForkOptions.getEmptyBlockPeriodSeconds(); + setBlockTimes(currentBlockPeriodSeconds, emptyBlockPeriodSeconds); + +- startTimer(round, expiryTime); ++ // AERE D-337 (2026-09-04): at an anchor height the proposer needs K seals of every scheme, and ++ // those ride on the commits of the parent. Measured on chain 2800, the timer fires before the ++ // sixth SLH-DSA seal arrives, the producer refuses to write a certificate it cannot fill, and ++ // the anchor pays the whole round-change timeout. The extra wait applies ONLY at anchor heights ++ // and is zero unless configured; see AereAnchorProposalDelay for why this is local timing and ++ // not consensus. ++ startTimer(round, expiryTime + AereAnchorProposalDelay.millisFor(round.getSequenceNumber())); + } + + /** + * Checks if the empty block timer is expired + * + * @param headerTimestamp Function to get the chain head timestamp + * @param currentTimeInMillis The current time + * @return a boolean value + */ + public synchronized boolean checkEmptyBlockExpired( + final Supplier headerTimestamp, final long currentTimeInMillis) { + final long emptyBlockPeriodExpiryTime = + (headerTimestamp.get() + emptyBlockPeriodSeconds) * 1000; + + if (currentTimeInMillis > emptyBlockPeriodExpiryTime) { + LOG.debug("Empty Block expired"); + return true; + } + LOG.debug("Empty Block NOT expired"); + return false; diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/FalconSeal.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/FalconSeal.java new file mode 100755 -index 000000000..578b6f5aa +index 000000000..9f290a1aa --- /dev/null +++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/FalconSeal.java @@ -0,0 +1,88 @@ +/* -+ * Copyright contributors to Besu / Aere Network. ++ * Copyright contributors to Besu / AERE Network. + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at @@ -1296,12 +2228,122 @@ index 000000000..578b6f5aa + + '}'; + } +} +diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/FalconSealScheme.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/FalconSealScheme.java +new file mode 100755 +index 000000000..0f0090cb3 +--- /dev/null ++++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/FalconSealScheme.java +@@ -0,0 +1,104 @@ ++/* AERE crypto-agility: Falcon-512 behind the SealScheme seam. The registry form is the raw ++ * Falcon h vector, 896 bytes, exactly what the signer registry stores today (measured on the ++ * proof-network registry files, registru-PROBA-v2-*.properties: 896 per entry). The 897-byte ++ * form pk(897) = 0x09 || h belongs to the 0x0AE1 PRECOMPILE input format, one header byte above ++ * this layer; confusing the two costs a red test, which is exactly how this comment was earned. */ ++package org.hyperledger.besu.consensus.common.bft; ++ ++import java.security.SecureRandom; ++import java.util.Optional; ++ ++import org.bouncycastle.pqc.crypto.falcon.FalconKeyGenerationParameters; ++import org.bouncycastle.pqc.crypto.falcon.FalconKeyPairGenerator; ++import org.bouncycastle.pqc.crypto.falcon.FalconParameters; ++import org.bouncycastle.pqc.crypto.falcon.FalconPrivateKeyParameters; ++import org.bouncycastle.pqc.crypto.falcon.FalconPublicKeyParameters; ++import org.bouncycastle.pqc.crypto.falcon.FalconSigner; ++import org.bouncycastle.crypto.AsymmetricCipherKeyPair; ++ ++/** Falcon-512 as a pluggable seal scheme. */ ++public final class FalconSealScheme implements SealScheme { ++ ++ /** Registry form: the raw public h vector for Falcon-512 (no precompile header byte). */ ++ public static final int PUBLIC_KEY_LENGTH = 896; ++ ++ private record Pub(FalconPublicKeyParameters params) implements PublicHandle {} ++ ++ private record Priv(FalconPrivateKeyParameters params) implements PrivateHandle {} ++ ++ @Override ++ public String id() { ++ return "falcon-512"; ++ } ++ ++ @Override ++ public byte wireId() { ++ return 0x01; ++ } ++ ++ @Override ++ public int publicKeyLength() { ++ return PUBLIC_KEY_LENGTH; ++ } ++ ++ @Override ++ public Optional parsePublicKey(final byte[] registryForm) { ++ if (registryForm == null || registryForm.length != PUBLIC_KEY_LENGTH) { ++ return Optional.empty(); ++ } ++ try { ++ return Optional.of(new Pub(new FalconPublicKeyParameters(FalconParameters.falcon_512, registryForm))); ++ } catch (final RuntimeException e) { ++ return Optional.empty(); ++ } ++ } ++ ++ @Override ++ public Optional sign(final PrivateHandle key, final byte[] message) { ++ if (!(key instanceof Priv p) || message == null) { ++ return Optional.empty(); ++ } ++ try { ++ final FalconSigner signer = new FalconSigner(); ++ signer.init(true, p.params()); ++ return Optional.of(signer.generateSignature(message)); ++ } catch (final RuntimeException e) { ++ return Optional.empty(); ++ } ++ } ++ ++ @Override ++ public boolean verify(final PublicHandle key, final byte[] message, final byte[] signature) { ++ if (!(key instanceof Pub p) || message == null || signature == null) { ++ return false; ++ } ++ try { ++ final FalconSigner verifier = new FalconSigner(); ++ verifier.init(false, p.params()); ++ return verifier.verifySignature(message, signature); ++ } catch (final RuntimeException e) { ++ return false; ++ } ++ } ++ ++ /** Transition bridge for the live signing path: FalconSealSupport loads the node's private ++ * key as BC {@link FalconPrivateKeyParameters} long before this layer existed. Routing its ++ * signing through the scheme without re-plumbing key loading needs this one adapter. The BC ++ * type appears ONLY here, in the class whose whole job is to speak Falcon. */ ++ public Optional signWithParams(final FalconPrivateKeyParameters key, final byte[] message) { ++ if (key == null || message == null) { ++ return Optional.empty(); ++ } ++ return sign(new Priv(key), message); ++ } ++ ++ @Override ++ public GeneratedPair generate(final SecureRandom random) { ++ final FalconKeyPairGenerator gen = new FalconKeyPairGenerator(); ++ gen.init(new FalconKeyGenerationParameters(random, FalconParameters.falcon_512)); ++ final AsymmetricCipherKeyPair pair = gen.generateKeyPair(); ++ final FalconPublicKeyParameters pub = (FalconPublicKeyParameters) pair.getPublic(); ++ final FalconPrivateKeyParameters priv = (FalconPrivateKeyParameters) pair.getPrivate(); ++ return new GeneratedPair(new Pub(pub), new Priv(priv), pub.getH()); ++ } ++} diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/FalconSealSupport.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/FalconSealSupport.java new file mode 100755 -index 000000000..af694dcf9 +index 000000000..7049b8414 --- /dev/null +++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/FalconSealSupport.java -@@ -0,0 +1,3749 @@ +@@ -0,0 +1,4130 @@ +/* + * Copyright contributors to Besu. + * @@ -1361,8 +2403,9 @@ index 000000000..af694dcf9 + *

    NAMING, and this is not pedantry. This line used to read "for the hybrid post-quantum + * consensus seal". AERE DOES NOT HAVE POST-QUANTUM CONSENSUS and must never be described as having + * it: proposer selection and finality are classical secp256k1 ECDSA QBFT, and the post-quantum -+ * layer is signature, precompile and account level. Our audit scope tells reviewers to FLAG that -+ * phrase wherever it appears in code comments. It appeared here. ++ * layer is signature, precompile and account level. Our own audit scope dossier ++ * ({@code audit-package-pq-consensus/scope/AUDIT-SCOPE-DOSSIER-2026-07-12.md}, section 3) tells ++ * reviewers to FLAG that phrase wherever it appears in code comments. It appeared here. + * + *

    This deliberately does NOT ride the shared secp256k1 {@code NodeKey} / {@code SecurityModule} + * singleton (that interface returns ECDSA R,S and is used chain-wide for transactions and devp2p). @@ -1415,7 +2458,7 @@ index 000000000..af694dcf9 + * whenever {@link #addressForIndex} returns null or {@link #verify} returns false. A node whose + * registry file fails to load therefore rejects every header carrying a certificate, i.e. it halts + * itself, and two nodes with DIFFERENT registry files disagree about which headers are valid. That -+ * is the unbound-registry defect, and it is why the registry has to be bound to genesis by {@code pqRegistryHash} ++ * is defect A8 and it is why the registry has to be bound to genesis by {@code pqRegistryHash} + * before any of this is armed. While both of those gates are unset - which is the state of chain + * 2800 today - the subsystem is log-only and the old sentence holds; it is not a property of this + * file, it is a property of the configuration. @@ -1439,6 +2482,18 @@ index 000000000..af694dcf9 + private static final String ANCHOR_SLOT = + "0000000000000000000000000000000000000000000000000000000000000000"; + ++ /** How many seals this node emitted on its own PREPAREs. See {@link #preparesSealed()}. */ ++ private final java.util.concurrent.atomic.AtomicLong preparesSealed = ++ new java.util.concurrent.atomic.AtomicLong(); ++ ++ /** How many seals this node emitted on its own PROPOSALs since startup. */ ++ private final java.util.concurrent.atomic.AtomicLong proposalsSealed = ++ new java.util.concurrent.atomic.AtomicLong(); ++ ++ /** How many seals this node emitted on its own ROUND-CHANGEs since startup. */ ++ private final java.util.concurrent.atomic.AtomicLong roundChangesSealed = ++ new java.util.concurrent.atomic.AtomicLong(); ++ + private final boolean signingEnabled; + private final int localIndex; + private final FalconPrivateKeyParameters localPrivateKey; @@ -1454,7 +2509,7 @@ index 000000000..af694dcf9 + private final boolean genesisAnchored; + + /** -+ * AERE GENESIS BINDING: the registry file this node ACTUALLY used, and which of the three sources it came from. ++ * AERE A8: the registry file this node ACTUALLY used, and which of the three sources it came from. + * Recorded so the consensus-binding guard can re-read exactly that file and hash it, rather than + * hashing something adjacent to it. Null when no registry is configured at all. + */ @@ -1462,11 +2517,11 @@ index 000000000..af694dcf9 + + private final PqRegistryHash.SourceKind registrySourceKind; + -+ /** Outcome of the genesis-binding guard; NOT_CHECKED equivalent is null until it has run. */ ++ /** Outcome of the A8 registry-binding guard; NOT_CHECKED equivalent is null until it has run. */ + private volatile PqRegistryHash.GateState registryBindingState; + + /** -+ * AERE GENESIS BINDING (per-block half): the schedule the startup guard actually enforced, the registry object ++ * AERE A8 (per-block half): the schedule the startup guard actually enforced, the registry object + * it hashed, and the chain id it hashed under. Held so that {@link #registryBindingSatisfiedAt} + * can answer the SAME question on the per-block consensus path without re-reading a file 61 + * million times a year, and without a second, drifting copy of the decision. @@ -1480,17 +2535,17 @@ index 000000000..af694dcf9 + private volatile PqRegistryHash.Registry registryBindingLoaded; + + /** -+ * HEIGHT SCHEDULE: every registry this node holds, bound to the schedule entry each one satisfies. ++ * D-081: every registry this node holds, bound to the schedule entry each one satisfies. + * + *

    {@link #registryBindingLoaded} above is the registry for the HEAD, and it is what the node + * signs with. It is kept because every diagnostic message names it. This field is the whole + * scheduled history, and it is what the per-block binding question and height-resolved + * verification are answered from. With no history configured the set holds exactly the one -+ * registry above, so both answers are bit-for-bit what they were before the height schedule existed. ++ * registry above, so both answers are bit-for-bit what they were before D-081. + */ + private volatile PqRegistryHash.RegistrySet registryBindingSet; + -+ /** HEIGHT SCHEDULE: per (schedule entry, index) Falcon public keys, built on demand from the set. */ ++ /** D-081: per (schedule entry, index) Falcon public keys, built on demand from the set. */ + private final Map historicalKeys = new ConcurrentHashMap<>(); + + private volatile long registryBindingChainId; @@ -1503,7 +2558,7 @@ index 000000000..af694dcf9 + * AERE OPTIUNI-URGENTA (2026-08-02): the operator has EXPLICITLY asked this node to run even + * though its Falcon registry does not satisfy the binding genesis requires. + * -+ *

    WHY THIS EXISTS AT ALL. The genesis-binding guard is a CONFIGURATION guard: it refuses to start a node ++ *

    WHY THIS EXISTS AT ALL. The A8 guard is a CONFIGURATION guard: it refuses to start a node + * whose registry file is not the one the chain names. That refusal is correct and it is + * fail-closed, and it also means a single bad registry file pushed to the fleet takes the fleet + * down and the only documented way back was to rebuild or to hand-edit a service unit at whatever @@ -1593,8 +2648,8 @@ index 000000000..af694dcf9 + * chain head at startup. Sized from the measured startup-to-first-commit window (45.2 s, i.e. ~46 + * blocks on the 1 s scratch fleet) with a wide safety factor, so that a node which is still + * opening its database, syncing and joining the network cannot have the activation height arrive -+ * underneath it. Chains with a sub-second block period must RAISE this in proportion: the -+ * margin has to cover the same wall-clock startup window at the faster block rate. ++ * underneath it. Chains with a sub-second block period must RAISE this: see ++ * GARDA-ACTIVARE-2026-08-01.md for the sizing formula. + */ + private static final long DEFAULT_MIN_ATTACH_FUTURE_MARGIN = 1024L; + @@ -1615,7 +2670,7 @@ index 000000000..af694dcf9 + private static final String ADMISSION_RECEIPT_FILE = "aere-falcon-activation.receipt"; + + /** -+ * HEIGHT SCHEDULE: the registries this node holds for SCHEDULED HEIGHTS IT IS NO LONGER AT, as a ++ * D-081: the registries this node holds for SCHEDULED HEIGHTS IT IS NO LONGER AT, as a + * comma-separated list of files. Env: {@code AERE_FALCON_REGISTRY_HISTORY}. + * + *

    WHY A SECOND PROPERTY AND NOT A LIST IN THE FIRST. {@code aere.falcon.registry} names the @@ -1642,7 +2697,7 @@ index 000000000..af694dcf9 + public static final String ENV_REGISTRY_MISMATCH_ALLOW = "AERE_PQ_REGISTRY_MISMATCH_ALLOW"; + + /** -+ * AERE LATE-ANCHOR HEIGHT: the DECLARED height at or after which the on-chain late-anchor registry contract is ++ * AERE D-079: the DECLARED height at or after which the on-chain late-anchor registry contract is + * expected to be observable. Mandatory whenever a blocking fork height is armed over a late-anchor + * registry that is still pending; see {@link #validateAnchorObservationHeightOrAbort}. + */ @@ -1655,7 +2710,7 @@ index 000000000..af694dcf9 + private final long attachBlock; + + /** -+ * AERE LATE-ANCHOR HEIGHT: the BLOCKING height, resolved and validated exactly ONCE, at construction, and ++ * AERE D-079: the BLOCKING height, resolved and validated exactly ONCE, at construction, and + * owned thereafter. Long.MAX_VALUE means never blocking. + * + *

    It used to be a property read on every call to {@link #forkBlock()}, with a @@ -1668,7 +2723,7 @@ index 000000000..af694dcf9 + private final long forkBlock; + + /** -+ * AERE LATE-ANCHOR HEIGHT: the height at and after which the on-chain LATE-ANCHOR registry contract is expected ++ * AERE D-079: the height at and after which the on-chain LATE-ANCHOR registry contract is expected + * to be observable, as DECLARED by the operator. Long.MAX_VALUE when undeclared. + * + *

    This value does not activate anything. It exists because without it the ordering that the @@ -1680,7 +2735,7 @@ index 000000000..af694dcf9 + private final long anchorObserveBlock; + + /** -+ * AERE LATE-ANCHOR HEIGHT: first height at which this node validated a header at or after the blocking height ++ * AERE D-079: first height at which this node validated a header at or after the blocking height + * while the anchored registry was NOT active, or -1 if that has never happened. + * + *

    This is the residual the configuration guard cannot close: an operator may declare the @@ -1711,13 +2766,13 @@ index 000000000..af694dcf9 + private final AtomicBoolean loggedCoverageBlocked = new AtomicBoolean(false); + + /** -+ * LOOKUP HARDENING (b): the once-only latch for the refusal to resolve keys at an armed height with no ++ * D2 HARDENING (b): the once-only latch for the refusal to resolve keys at an armed height with no + * height-to-registry binding. One line per block at a 523 ms period is a hazard, not a diagnostic. + */ + private final AtomicBoolean loggedUnboundArmedHeight = new AtomicBoolean(false); + + /** -+ * AERE COVERAGE MARGIN (2026-08-02): the last coverage situation this node reported, as "N/R", so the ++ * AERE D-078 (2026-08-02): the last coverage situation this node reported, as "N/R", so the + * coverage line is emitted exactly when the situation CHANGES and not once per block. Null means + * nothing has been reported yet. + */ @@ -1771,7 +2826,7 @@ index 000000000..af694dcf9 + manifestPath); + } + } else if (registryPath != null) { -+ // AERE GENESIS BINDING REPAIR (2026-08-02): the properties source the design prescribed was measured to ++ // AERE A8 REPAIR (2026-08-02): the properties source the design prescribed was measured to + // HALT EVERY NODE at the activation height. Not by being mutable, and not by disagreeing with + // a hash: by carrying public keys and NO ADDRESSES. addressForIndex() then returns null for + // every index, and the V2 seals rule (R2) refuses every header that carries a certificate. @@ -1819,13 +2874,13 @@ index 000000000..af694dcf9 + } + // Address binding is ALL-OR-NOTHING. A half-bound registry is worse than an unbound one: + // some indices would resolve and some would not, so the fleet would reject a header that -+ // one operator can verify and another cannot, which is the same defect wearing a different hat. ++ // one operator can verify and another cannot, which is defect A8 wearing a different hat. + final boolean fullyBound = !reg.isEmpty() && propAddr.keySet().equals(reg.keySet()); + if (fullyBound) { + regAddr.putAll(propAddr); + } else if (!propAddr.isEmpty()) { + LOG.error( -+ "AERE PQC GENESIS-BINDING: LEGACY registry file {} carries {} '.addr' rows for {} keys. A " ++ "AERE PQC A8: LEGACY registry file {} carries {} '.addr' rows for {} keys. A " + + "PARTIALLY address-bound registry is refused as a binding source (all-or-" + + "nothing): some indices would resolve to a validator address and some would " + + "not, so two nodes would disagree about which headers are valid. Treating this " @@ -1893,7 +2948,7 @@ index 000000000..af694dcf9 + this.pendingLateHash = lateHash; + this.anchorContractAddress = anchorAddr; + -+ // AERE GENESIS BINDING: remember WHICH file the registry came from, so the consensus-binding guard hashes ++ // AERE A8: remember WHICH file the registry came from, so the consensus-binding guard hashes + // the file this node is really running on and not a different one that happens to be nearby. + if (genesisPath != null) { + this.registrySourcePath = genesisPath; @@ -1932,7 +2987,7 @@ index 000000000..af694dcf9 + // before anything else. A present-but-unparseable aere.falcon.forkBlock must not silently + // degrade to never-blocking (log-only); it aborts node init here (config time, NOT the per-block + // consensus path). -+ // AERE LATE-ANCHOR HEIGHT: the result is TAKEN, not merely checked. Nothing re-reads the property afterwards. ++ // AERE D-079: the result is TAKEN, not merely checked. Nothing re-reads the property afterwards. + this.forkBlock = validateForkBlockConfigOrAbort(); + + // AERE FIX-OPRIRE-CONSENS (b): resolve and validate the ATTACHMENT gate. Every inconsistent @@ -1940,7 +2995,7 @@ index 000000000..af694dcf9 + // surprise mid-chain. + this.attachBlock = validateAndResolveAttachBlockOrAbort(this.forkBlock); + -+ // AERE LATE-ANCHOR HEIGHT: the ORDER between the blocking height and the height at which the registry that ++ // AERE D-079: the ORDER between the blocking height and the height at which the registry that + // backs it can become active. Aborts here, at config time, for the same reason as everything + // above it: after the node has joined, the same error is a silent degradation to log-only. + this.anchorObserveBlock = @@ -1954,7 +3009,7 @@ index 000000000..af694dcf9 + // is still empty until activation, which is expected.) + armingReadinessDiagnostic(); + -+ // AERE ROW BINDING (2026-08-06): the SECOND arming question, and the one AERE-PQC-REG-ARM-01 cannot ++ // AERE D-146 (2026-08-06): the SECOND arming question, and the one AERE-PQC-REG-ARM-01 cannot + // answer. Address-bound says every index has SOME address next to it. It does not say that the + // validator at that address ever held the Falcon key filed under it. Measured on the real + // verification path on 2026-08-06: a registry with two rows' public keys swapped - no duplicate @@ -1962,7 +3017,7 @@ index 000000000..af694dcf9 + // header, and one key placed at two indices satisfied a threshold of two on its own. + requireRegistryBindingProofsOrAbort(); + -+ // AERE COVERAGE MARGIN (2026-08-03): the arm-time comparison the repair above NAMED and did not make. ++ // AERE D-078 (2026-08-03): the arm-time comparison the repair above NAMED and did not make. + // armingReadinessDiagnostic() answers "is the manifest address-bound"; it never asks whether the + // threshold the fleet is about to arm is one the fleet can be guaranteed to MEET. + validateThresholdReachabilityOrAbort(); @@ -1978,7 +3033,7 @@ index 000000000..af694dcf9 + * validation, so it never throws on the consensus path. An UNSET value keeps the safe + * never-blocking log-only default. + * -+ *

    AERE LATE-ANCHOR HEIGHT (2026-08-03): it now RETURNS the validated height and the constructor keeps it in ++ *

    AERE D-079 (2026-08-03): it now RETURNS the validated height and the constructor keeps it in + * a final field. Validating a value and then re-reading its source on every use leaves the + * original defect intact one level down, which is exactly where it was found. + * @@ -2016,7 +3071,7 @@ index 000000000..af694dcf9 + } + + /** -+ * AERE LATE-ANCHOR HEIGHT: the ordering guard between the BLOCKING height and the height at which the registry ++ * AERE D-079: the ordering guard between the BLOCKING height and the height at which the registry + * that backs it can first be active. + * + *

    THE HOLE THIS CLOSES, in the words of the code that documented it and did nothing about it. @@ -2177,7 +3232,7 @@ index 000000000..af694dcf9 + * {@code aere.falcon.testnetAllowSmallFleet=true}, which logs an ERROR every start. + * + * -+ * @param fork the already-validated blocking height (AERE LATE-ANCHOR HEIGHT: passed in rather than re-parsed ++ * @param fork the already-validated blocking height (AERE D-079: passed in rather than re-parsed + * from the property, so this method and {@link #forkBlock()} cannot disagree about it) + * @return the resolved attachment height, or {@link Long#MAX_VALUE} when unset + */ @@ -2784,9 +3839,8 @@ index 000000000..af694dcf9 + * AERE_FALCON_ATTACHINTERVAL}. + * + *

    WHY THIS EXISTS, measured on chain 2800 on 2026-08-08. Attachment was armed on all seven -+ * validators and the header went from 525 to 3844 bytes, five Falcon seals on EVERY block: more -+ * than seven times the header bytes, on nodes whose free space could not absorb it. The anchor -+ * producer ++ * validators and the header went from 525 to 3844 bytes, five Falcon seals on EVERY block, about ++ * 200 GB per node per year against 12 GB of free disk on the tightest host. The anchor producer + * already has both an interval and a seal cap, but the assembler reached when the anchor is NOT + * armed has neither, and that assembler is the one that runs before the activation height. So the + * cheap-by-design path was unreachable precisely during the window it was needed. @@ -2969,10 +4023,10 @@ index 000000000..af694dcf9 + return chainRelativeState; + } + -+ // ---- AERE GENESIS BINDING (2026-08-01): BIND THE REGISTRY TO CONSENSUS ---- ++ // ---- AERE A8 (2026-08-01): BIND THE REGISTRY TO CONSENSUS ---- + + /** -+ * GENESIS BINDING GUARD: refuse to start when the Falcon registry this node loaded is not the one the chain ++ * A8 GUARD: refuse to start when the Falcon registry this node loaded is not the one the chain + * requires at this height. + * + *

    THE DEFECT, read out of the constructor above and not guessed at. The registry that answers @@ -3016,7 +4070,7 @@ index 000000000..af694dcf9 + final PqRegistryHash.Schedule schedule; + if (genesisForSchedule == null) { + LOG.warn( -+ "AERE PQC GENESIS-BINDING: no genesis file is reachable to read config.pqRegistryHash from (neither " ++ "AERE PQC A8: no genesis file is reachable to read config.pqRegistryHash from (neither " + + "aere.pq.genesis nor aere.falcon.genesis is set), so the Falcon registry on this " + + "node is NOT bound to consensus. The registry in use is {} ({}). Two nodes holding " + + "different registry files would disagree about which public key validator index i " @@ -3032,7 +4086,7 @@ index 000000000..af694dcf9 + } + + /** -+ * AERE GENESIS BINDING, the form the caller should actually use: verify the registry binding against a ++ * AERE A8, the form the caller should actually use: verify the registry binding against a + * schedule that came from the genesis configuration BESU ITSELF PARSED AND BOOTED WITH. + * + *

    WHY THIS OVERLOAD EXISTS, and it is not tidiness. The single-argument form above reads @@ -3058,11 +4112,11 @@ index 000000000..af694dcf9 + loaded = PqRegistryHash.loadAuto(Paths.get(registrySourcePath)); + } + -+ // HEIGHT SCHEDULE: build the height-resolved set BEFORE anything is published, from the registry this ++ // D-081: build the height-resolved set BEFORE anything is published, from the registry this + // node signs with plus every registry named in the history list. With no history configured the -+ // set holds exactly the one registry and every answer below is what it was before the height schedule existed. ++ // set holds exactly the one registry and every answer below is what it was before D-081. + // -+ // AERE HELD-SET SCOPE (2026-08-06). THIS BLOCK USED TO SIT 41 LINES LOWER, AND THAT WAS THE DEFECT. The ++ // AERE D-A (2026-08-06). THIS BLOCK USED TO SIT 41 LINES LOWER, AND THAT WAS THE DEFECT. The + // startup guard below was handed the single primary registry and threw + // AERE-PQC-REG-MISMATCH-01 before this code ever ran, so a node holding exactly the right files + // - the post-rotation registry as its own, the pre-rotation one as history - refused to start @@ -3103,7 +4157,7 @@ index 000000000..af694dcf9 + registryOverrideEngaged = true; + LOG.error( + "AERE PQC EMERGENCY [AERE-PQC-REG-UNSAFE-01]: STARTING ANYWAY WITH AN UNVERIFIED FALCON " -+ + "REGISTRY. The genesis-binding guard REFUSED this node ({}), and {} is set, so " ++ + "REGISTRY. The A8 registry-binding guard REFUSED this node ({}), and {} is set, so " + + "the refusal has been overridden BY EXPLICIT OPERATOR REQUEST. What that means, " + + "stated plainly: from the first height at which genesis requires a registry hash, " + + "this node cannot correctly decide whether a header's Falcon certificate is valid, " @@ -3123,7 +4177,7 @@ index 000000000..af694dcf9 + // refuses at exactly the heights that are uncovered, which is the narrowest fail-closed + // action that still names the problem. What must never happen is silence. + LOG.error( -+ "AERE PQC HEIGHT-SCHEDULE: this node holds {} registry file(s) and the chain's pqRegistryHash " ++ "AERE PQC D-081: this node holds {} registry file(s) and the chain's pqRegistryHash " + + "schedule has {} entr(ies), of which the heights {} are covered by NOTHING this " + + "node holds. Every header at or after such a height will be REFUSED, and a node " + + "syncing from genesis will stop there. Name the missing registry file(s) in {} " @@ -3148,13 +4202,13 @@ index 000000000..af694dcf9 + } + + /** -+ * AERE SIGNED-HEIGHT CHECK (2026-08-06), THE LOCAL HALF. The height this node ARMS at must be a height the fleet ++ * AERE D-B (2026-08-06), THE LOCAL HALF. The height this node ARMS at must be a height the fleet + * actually signed a registry for. + * + *

    WHY THIS CANNOT BE THE SAME KIND OF GUARD AS THE ONE ABOVE, and the difference is the whole -+ * honest limitation of that check. {@code aere.pq.anchorBlock} is a SYSTEM PROPERTY, set per node through -+ * {@code BESU_OPTS}. It is in no genesis. Nothing in the document the seven validators hold -+ * byte-identically constrains it. So the agreement of seven nodes on an arming height CANNOT BE ++ * honest limitation of D-B. {@code aere.pq.anchorBlock} is a SYSTEM PROPERTY, set per node through ++ * {@code BESU_OPTS}. It is in no genesis. Nothing in the document the validators hold ++ * byte-identically constrains it. So the agreement of the nodes on an arming height CANNOT BE + * ENFORCED by any code that runs on one node - it can only be DETECTED locally, and that is what + * this does. Enforcement would require the height to move into genesis, which is a change to the + * chain's configuration and not to this class. That is written here as a limitation, not as a @@ -3205,7 +4259,7 @@ index 000000000..af694dcf9 + } + throw new PqRegistryHash.RegistryConfigException( + "AERE-PQC-REG-BIND-09", -+ "AERE PQC SIGNED-HEIGHT: REFUSING TO START - this node arms at a height no validator signed for.\n" ++ "AERE PQC D-B: REFUSING TO START - this node arms at a height no validator signed for.\n" + + " FIELD: aere.pq.anchorBlock (system property, per node, read through " + + "PqAnchorConfig) versus the 'block' values of config.pqRegistryHash in genesis (" + + schedule.source() @@ -3223,30 +4277,30 @@ index 000000000..af694dcf9 + + "one the fleet signed, the day the chain starts enforcing post-quantum seals is a " + + "number one operator typed.\n" + + " WHY NOTHING ELSE CATCHES IT: aere.pq.anchorBlock is not in genesis. It is not in " -+ + "the document all seven nodes hold identically, so no node can hold another node to " ++ + "the document every node holds identically, so no node can hold another node to " + + "it. This refusal is DETECTION on this node only. Two nodes with different " + + "aere.pq.anchorBlock still do not disagree about a header until the lower of the two " + + "heights, and this guard cannot see the other node's value.\n" -+ + " WHAT TO DO: EITHER set aere.pq.anchorBlock to one of the heights above, on all " -+ + "seven nodes and in the same change - a node armed alone validates differently from " ++ + " WHAT TO DO: EITHER set aere.pq.anchorBlock to one of the heights above, on every " ++ + "node and in the same change - a node armed alone validates differently from " + + "the rest. OR, if the activation day genuinely moved, re-run the key ceremony for the " + + "new height, put the re-signed registry's NEW hash in config.pqRegistryHash at that " + + "height, and roll it to the whole fleet. Moving the day is 14 signatures. It is " + + "supposed to be.\n" -+ + " CHECK THE WHOLE FLEET BEFORE RESTARTING ANYTHING: this property has to read " -+ + "the same on every node, and a split state is a fault, " -+ + "not a warning."); ++ + " CHECK THE WHOLE FLEET BEFORE RESTARTING ANYTHING: this property is per node and " ++ + "is in no genesis, so two nodes can disagree about it silently. Compare it across " ++ + "every validator and treat a split state as a fault, not as a detail."); + } + + /** -+ * AERE GENESIS BINDING, the PER-BLOCK half: does the registry this node is running on satisfy the binding the ++ * AERE A8, the PER-BLOCK half: does the registry this node is running on satisfy the binding the + * chain requires AT THIS HEIGHT? Never throws. + * + *

    WHY A STARTUP GUARD IS NOT ENOUGH, measured as a gap and not assumed. The startup guard + * answers the question once, against the chain head that existed at startup. A node that is + * already running when a ROTATION height in the schedule passes underneath it is never asked + * again: it keeps validating with a registry the chain has moved off, and it keeps reporting -+ * itself healthy while doing it. That is the same failure mode the genesis binding was opened for, arriving by a ++ * itself healthy while doing it. That is the same failure mode A8 was opened for, arriving by a + * different door. With a schedule of one entry the two guards are equivalent; with two or more, + * only this one covers the interval after the second entry. + * @@ -3270,7 +4324,7 @@ index 000000000..af694dcf9 + return true; // below the first scheduled height: the 11.8 million existing blocks are untouched + } + final PqRegistryHash.Registry loaded = this.registryBindingLoaded; -+ // HEIGHT SCHEDULE: ask the whole scheduled history, not only the entry in force at the head. Before this ++ // D-081: ask the whole scheduled history, not only the entry in force at the head. Before this + // change a node held one registry, so one rotation left NO configuration that satisfied both + // the pre-rotation interval and the head, and the chain became permanently unjoinable. + final boolean ok = @@ -3333,11 +4387,10 @@ index 000000000..af694dcf9 + blockNumber, + required.hash(), + required.block(), -+ // GENESIS BINDING: this used to print hashV1 next to `required.hash()`, which is computed -+ // with hashFor. Two numbers set side by side to be compared, but computed differently: for -+ // a registry that carries proofs the two can NEVER match, and the message sends the -+ // operator hunting for the defect where it is not. Measured on a fleet of seven on -+ // 2026-08-06. ++ // A8: this used to print hashV1 next to `required.hash()`, which is computed with hashFor. ++ // Two numbers set side by side to be compared, but computed differently: for a registry ++ // that carries proofs the two can NEVER match, and the message sends the operator hunting ++ // for the defect where it is not. Measured on a fleet of seven on 2026-08-06. + loaded == null + ? "(no registry loaded)" + : PqRegistryHash.hashFor(loaded, registryBindingChainId), @@ -3362,7 +4415,7 @@ index 000000000..af694dcf9 + return; + } + LOG.error( -+ "AERE PQC GENESIS-BINDING [AERE-PQC-REG-BLOCK-01]: REFUSING header at height {} (fail-closed). The " ++ "AERE PQC A8 [AERE-PQC-REG-BLOCK-01]: REFUSING header at height {} (fail-closed). The " + + "chain requires registry hash {} from height {} (schedule source {}), and the " + + "registry this node is running has hash {}. Registry in use: {} ({}), {} entries, " + + "address-bound={}. WHY THIS FIRES NOW AND NOT AT STARTUP: this node started under an " @@ -3373,8 +4426,8 @@ index 000000000..af694dcf9 + required.hash(), + required.block(), + this.registryBindingSchedule == null ? "(none)" : this.registryBindingSchedule.source(), -+ // GENESIS BINDING, same reason as above: this is compared against required.hash(), which -+ // is computed with hashFor. ++ // A8, same reason as above: this is compared against required.hash(), which is computed ++ // with hashFor. + loaded == null ? "(no registry loaded)" : PqRegistryHash.hashFor(loaded, registryBindingChainId), + loaded == null ? "(none)" : loaded.sourcePath(), + loaded == null ? "(none)" : loaded.kind(), @@ -3399,7 +4452,7 @@ index 000000000..af694dcf9 + } + + /** -+ * Outcome of the genesis-binding guard. ++ * Outcome of the A8 registry-binding guard. + * + * @return the gate state, or null when the guard has not run + */ @@ -3616,9 +4669,9 @@ index 000000000..af694dcf9 + } + final Iterator> sit = storage.fields(); + while (sit.hasNext()) { -+ final Map.Entry se = sit.next(); -+ if (norm(se.getKey(), 64).equals(ANCHOR_SLOT)) { -+ return norm(se.getValue().asText(), 64); ++ final Map.Entry entry = sit.next(); ++ if (norm(entry.getKey(), 64).equals(ANCHOR_SLOT)) { ++ return norm(entry.getValue().asText(), 64); + } + } + } @@ -3656,14 +4709,59 @@ index 000000000..af694dcf9 + return instance; + } + -+ private static String resolve(final String sysProp, final String envVar) { -+ final String v = System.getProperty(sysProp); -+ if (v != null && !v.isBlank()) { -+ return v; ++ /** ++ * D-177 (2026-08-28): every legacy {@code aere.falcon.*} switch now has a first-class ++ * algorithm-neutral twin, {@code aere.pq.sig.*} (env {@code AERE_PQ_SIG_*}). The protocol ++ * surface an operator touches must not name a primitive: the founder's next step is the ++ * Falcon+SPHINCS+ hybrid, and a second algorithm must not mean a second set of sixteen ++ * parallel switches. Precedence, and why it is shaped this way: ++ * ++ *

      ++ *
    • the NEUTRAL name wins when only it is set - new fleets never need the legacy name; ++ *
    • the LEGACY name still works alone - the live fleet keeps running untouched; ++ *
    • both set to the SAME value is fine - that is what a migration window looks like; ++ *
    • both set to DIFFERENT values REFUSES to start. A node that silently prefers one ++ * spelling turns a typo into a consensus divergence, and on 2026-08-09 a silent ++ * property rewrite already cost this fleet a live fork for two days. ++ *
    ++ */ ++ static String resolve(final String sysProp, final String envVar) { ++ final String neutralProp = ++ sysProp.startsWith("aere.falcon.") ++ ? "aere.pq.sig." + sysProp.substring("aere.falcon.".length()) ++ : null; ++ final String neutralEnv = ++ envVar.startsWith("AERE_FALCON_") ++ ? "AERE_PQ_SIG_" + envVar.substring("AERE_FALCON_".length()) ++ : null; ++ final String neutral = firstNonBlank( ++ neutralProp == null ? null : System.getProperty(neutralProp), ++ neutralEnv == null ? null : System.getenv(neutralEnv)); ++ final String legacy = firstNonBlank(System.getProperty(sysProp), System.getenv(envVar)); ++ if (neutral != null && legacy != null && !neutral.trim().equals(legacy.trim())) { ++ throw new ActivationConfigException( ++ ActivationConfigException.Kind.SYNTAX, ++ "AERE-PQC-CFG-DUAL-NAME-01", ++ "AERE PQC: " ++ + neutralProp ++ + " and its legacy twin " ++ + sysProp ++ + " are BOTH set, to DIFFERENT values ('" ++ + neutral ++ + "' vs '" ++ + legacy ++ + "'). Refusing to start: a node that silently prefers one spelling turns a typo " ++ + "into a consensus divergence. Set exactly one, or both to the same value."); + } -+ final String e = System.getenv(envVar); -+ if (e != null && !e.isBlank()) { -+ return e; ++ return neutral != null ? neutral : legacy; ++ } ++ ++ private static String firstNonBlank(final String a, final String b) { ++ if (a != null && !a.isBlank()) { ++ return a; ++ } ++ if (b != null && !b.isBlank()) { ++ return b; + } + return null; + } @@ -3833,12 +4931,12 @@ index 000000000..af694dcf9 + *

    Nothing else catches it. Not startup, not the log, not the block rhythm, not rejections, not + * the divergence detector - every node agrees, because the certificate is valid. Until today the + * only guard was a PROCEDURE step run by hand on each target, and a procedure step can be skipped. -+ * The written procedure claimed it "shows up as R2 rejections at the anchor height"; measured, it does not. ++ * The runbook claimed it "shows up as R2 rejections at the anchor height"; measured, it does not. + * + *

    WHY IT IS SAFE TO REFUSE HERE. Same argument as the other startup guards: this runs before + * the network and the QBFT state machine start, so it is a clean refusal to start rather than a + * mid-flight halt. It is INERT unless a Falcon key is configured AND the registry is address-bound, -+ * so wherever no {@code aere.falcon.key} is configured, it cannot fire. ++ * so on chain 2800 as it stands today - no {@code aere.falcon.key} anywhere - it cannot fire. + * + *

    A null bound address is NOT treated as a failure: that means a pubkey-only registry, which is + * already refused elsewhere for the paths that matter, and turning it into a second refusal here @@ -3904,16 +5002,16 @@ index 000000000..af694dcf9 + } + + /** -+ * LOOKUP HARDENING (a). THIS NODE's own signing identity, which is the one place in the stack that ++ * D2 HARDENING (a). THIS NODE's own signing identity, which is the one place in the stack that + * legitimately has no height. + * + *

    WHY IT IS A SEPARATE METHOD AND NOT {@code addressForIndex(localIndex())}. The adversarial -+ * review of 2026-08-02 found the verification path asking the registry questions with no ++ * review of 2026-08-02 (D2) found the verification path asking the registry questions with no + * height. Deleting the height-less pair from {@link PqSignerRegistry} left exactly one honest + * caller behind: {@code QbftBlockCreatorAdaptor} asking "am I, right now, an eligible signer", + * before signing with the single private key this process holds. There is no historical question + * in that, and inventing a height for it would be a lie dressed as rigour. Giving it its own name -+ * means the two uses can no longer be confused by a future reader, which is how the defect arrived in the ++ * means the two uses can no longer be confused by a future reader, which is how D2 arrived in the + * first place. + * + * @return this node's registry-bound address, or null when it holds no key or the registry is not @@ -3924,16 +5022,16 @@ index 000000000..af694dcf9 + } + + /** -+ * LOOKUP HARDENING (b). The height at and above which this node is ARMED, i.e. from which a header's ++ * D2 HARDENING (b). The height at and above which this node is ARMED, i.e. from which a header's + * Falcon certificate carries consensus weight. + * + *

    WHY THE HEIGHT-RESOLVED LOOKUPS NEED IT. Before this, {@code keyAt} and {@code + * addressForIndexAt} fell back to the HEAD registry whenever no {@code config.pqRegistryHash} + * entry was in force - and {@code pqRegistryHash} is in no genesis this fleet runs (measured -+ * 2026-08-05: a search for {@code pqRegistryHash} across the deployment configuration returns -+ * nothing). So the whole height-schedule machinery was inert and the answer above the arming -+ * height was still "verify this year-old header against today's keys", which IS the height-less -+ * lookup defect, unrepaired. Falling back is correct BELOW the arming height, where no certificate is being judged; at and above it, ++ * 2026-08-05: {@code grep -rn pqRegistryHash --include=*.json deploy/ monitoring/} returns ++ * nothing). So the whole D-081 machinery was inert and the answer above the arming height was ++ * still "verify this year-old header against today's keys", which IS D2/T2, unrepaired. Falling ++ * back is correct BELOW the arming height, where no certificate is being judged; at and above it, + * the honest answer to "which keys were in force here" is a refusal, not a guess. + * + *

    Read through {@link PqAnchorProducer#config()} so the value is the same one the producer and @@ -4012,13 +5110,21 @@ index 000000000..af694dcf9 + } + + /** -+ * The block number at and after which the Falcon quorum certificate becomes BLOCKING (a valid -+ * >= 2f+1 Falcon quorum is required for a block to be accepted). Before this block the Falcon -+ * seals are additive / log-only. Configured via {@code aere.falcon.forkBlock} / {@code -+ * AERE_FALCON_FORKBLOCK}; defaults to {@link Long#MAX_VALUE} (never blocking, pure log-only) so -+ * an unconfigured node behaves exactly like the additive baseline. ++ * The block number at and after which the LEGACY per-block Falcon rule ++ * ({@link org.hyperledger.besu.consensus.qbft.headervalidationrules.FalconSealValidationRule}) ++ * becomes blocking. Configured via {@code aere.falcon.forkBlock} / {@code AERE_FALCON_FORKBLOCK}; ++ * defaults to {@link Long#MAX_VALUE} (never blocking, pure log-only) so an unconfigured node ++ * behaves exactly like the additive baseline. + * -+ *

    AERE LATE-ANCHOR HEIGHT (2026-08-03): this used to re-read the property on every call and swallow a ++ *

    ON CHAIN 2800 THIS ARMS A RULE THAT IS ALREADY RETIRED, so setting it changes nothing ++ * (finding D-235, corrected 2026-08-19). The legacy rule stands down at ++ * {@code PqAnchorConfig.legacyFalconRuleRetirementBlock()} = the anchor block, 13,014,000, and ++ * this property is set to 14,050,000 - above it. Until 2026-08-19 our own public texts said a ++ * per-block 2f+1 Falcon quorum had been blocking since that height; the claim was withdrawn the ++ * same day. What is defensible: at every 32nd height a certificate of at least K valid Falcon-512 ++ * seals sits under the block hash, and without it that block does not finalize. ++ * ++ *

    AERE D-079 (2026-08-03): this used to re-read the property on every call and swallow a + * NumberFormatException into {@link Long#MAX_VALUE} with a WARN line. That is the finding, in one + * method: the single value the entire post-quantum enforcement layer is gated on could silently + * become "never blocking", and the only trace was a log line nothing reads. The value is now @@ -4033,7 +5139,7 @@ index 000000000..af694dcf9 + } + + /** -+ * AERE LATE-ANCHOR HEIGHT: the DECLARED height at or after which the on-chain late-anchor registry contract is ++ * AERE D-079: the DECLARED height at or after which the on-chain late-anchor registry contract is + * expected to be observable, or {@link Long#MAX_VALUE} when undeclared. + * + * @return the declared anchor observation height @@ -4043,7 +5149,7 @@ index 000000000..af694dcf9 + } + + /** -+ * AERE LATE-ANCHOR HEIGHT: the first height at which this node validated a header at or after the blocking ++ * AERE D-079: the first height at which this node validated a header at or after the blocking + * height while the anchored registry was NOT active, or -1 if that has never happened. + * + *

    The configuration guard refuses the misconfiguration that CAUSES this. It cannot refuse the @@ -4110,7 +5216,7 @@ index 000000000..af694dcf9 + fork); + return; + } -+ // AERE GENESIS BINDING REPAIR (2026-08-02). This used to be LOG.error and nothing else, and the comment ++ // AERE A8 REPAIR (2026-08-02). This used to be LOG.error and nothing else, and the comment + // above still says "diagnostic only". That was measured to be the wrong trade. A node that + // starts here does not stay harmless: it joins the fleet, reaches the activation height, and + // from that height rejects every header that carries a certificate. Measured on three @@ -4126,12 +5232,12 @@ index 000000000..af694dcf9 + // that this class never throws is a promise about the PER-BLOCK path, and it is kept: nothing + // below this constructor throws. + // -+ // The refusal is inert wherever forkBlock is unset, because ++ // The refusal is inert on chain 2800 as it stands today, because forkBlock is unset there, so + // this code cannot stop a live validator that is running now. + throw new ActivationConfigException( + ActivationConfigException.Kind.UNSAFE, + "AERE-PQC-REG-ARM-01", -+ "AERE PQC GENESIS-BINDING: REFUSING TO START (fail-closed). Falcon blocking is " ++ "AERE PQC A8: REFUSING TO START (fail-closed). Falcon blocking is " + + "configured at forkBlock=" + + fork + + " but the active Falcon registry is NOT ADDRESS-BOUND" @@ -4159,7 +5265,7 @@ index 000000000..af694dcf9 + } + + /** -+ * AERE ROW BINDING (2026-08-06). REFUSE TO START when this node is ARMED and the registry it will be ++ * AERE D-146 (2026-08-06). REFUSE TO START when this node is ARMED and the registry it will be + * held to carries no binding proofs. + * + *

    WHAT IT ADDS OVER {@code AERE-PQC-REG-ARM-01}. That guard asks whether the registry is @@ -4176,23 +5282,23 @@ index 000000000..af694dcf9 + * signature by the validator repairs ATTRIBUTION. + * + *

    WHEN IT FIRES. Only when this node is armed: {@code aere.falcon.forkBlock} is configured, or -+ * the certificate anchor is active per {@link #anchorArmedFrom()}. Both are unset as it -+ * stands, so this refusal is INERT on the live fleet exactly as AERE-PQC-REG-ARM-01 is, and it ++ * the certificate anchor is active per {@link #anchorArmedFrom()}. Both are unset on chain 2800 as ++ * it stands, so this refusal is INERT on the live fleet exactly as AERE-PQC-REG-ARM-01 is, and it + * cannot stop a validator that is running today. That inertness is not asserted here, it is + * measured by {@code PqInertBinaryTest}, which drives a node with no {@code aere.pq.*} + * and no {@code aere.falcon.forkBlock} property at all through this constructor. + * + *

    WHAT IT DOES NOT JUDGE. A node armed with NO registry file at all returns without a word. -+ * Row binding is about a row that credits a seal to the wrong validator, and a registry with no rows ++ * D-146 is about a row that credits a seal to the wrong validator, and a registry with no rows + * credits nobody; that condition belongs to AERE-PQC-REG-ARM-01 and AERE-PQC-CFG-UNSAFE-08, which + * own it and name the numbers. See the comment at the return itself for what was measured when + * this guard tried to own it too. + * + *

    WHY IT IS NOT BEHIND THE EMERGENCY BYPASS. {@code aere.falcon.registry.mismatch.allow} -+ * overrides the genesis hash gate, which answers "is this the file genesis named" - a question about ++ * overrides the A8 hash gate, which answers "is this the file genesis named" - a question about + * configuration drift, recoverable by installing the right file. This one answers "can this + * registry be trusted to say who signed", and the anchor contract is IMMUTABLE once written: a -+ * fleet armed over unbound rows carries that defect for the life of the chain. The way out of THIS one ++ * fleet armed over unbound rows carries D-146 for the life of the chain. The way out of THIS one + * is the same as for AERE-PQC-REG-ARM-01 - do not arm, or disarm: unset {@code + * aere.falcon.forkBlock}, or set {@code aere.pq.anchor.disable=true}, which makes {@link + * #anchorArmedFrom()} return {@link Long#MAX_VALUE} and leaves {@code PqEmergencyShoutRule} @@ -4215,11 +5321,11 @@ index 000000000..af694dcf9 + */ + private void requireRegistryBindingProofsOrAbort() { + if (forkBlock() == Long.MAX_VALUE && anchorArmedFrom() == Long.MAX_VALUE) { -+ return; // nothing armed on this node; inert ++ return; // nothing armed on this node; inert, exactly as on chain 2800 today + } + if (registrySourcePath == null) { -+ // AN ARMED NODE WITH NO REGISTRY AT ALL IS NOT A ROW-BINDING DEFECT, and this return is the -+ // difference between a guard and a blanket. Row binding is about mis-ATTRIBUTION: a row that credits a ++ // AN ARMED NODE WITH NO REGISTRY AT ALL IS NOT A D-146 DEFECT, and this return is the ++ // difference between a guard and a blanket. D-146 is mis-ATTRIBUTION: a row that credits a + // seal to a validator who never held the key on it. That requires ROWS. With no registry + // there are no rows, indexToAddress is empty, the eligible-signer set is empty, and nobody + // can be credited with anything - there is nothing for a forged binding to say. @@ -4247,7 +5353,7 @@ index 000000000..af694dcf9 + } + + /** -+ * AERE COVERAGE MARGIN (2026-08-03). REFUSE TO START when the armed Falcon threshold K is above the number of ++ * AERE D-078 (2026-08-03). REFUSE TO START when the armed Falcon threshold K is above the number of + * anchored-key holders this fleet is GUARANTEED to have among a block's ECDSA committers. + * + *

    WHY THIS EXISTS. The 2026-08-02 repair correctly removed the fleet-wide coverage question from @@ -4265,16 +5371,16 @@ index 000000000..af694dcf9 + * it can only LOWER K later, and a guard must not be satisfied by a lever an operator may not pull. + * + *

    WHY IT MAY THROW HERE. Same reasoning, same path and same precedent as AERE-PQC-CFG-UNSAFE-04 -+ * and the genesis-binding refusal directly above: this is the constructor, the network is not up, the QBFT state ++ * and the A8 refusal directly above: this is the constructor, the network is not up, the QBFT state + * machine does not exist, and no header has been offered to anyone. The promise that this class + * never throws is a promise about the PER-BLOCK path, and it is kept. + * + *

    WHY IT IS NOT A RUNTIME CHECK. A per-block version of this comparison would be exactly the -+ * defect rebuilt: a fleet-wide fact, false on every node at the same height after an ++ * defect of D-078 rebuilt: a fleet-wide fact, false on every node at the same height after an + * ordinary vote, answered with a halting action. The runtime half stays a REPORT, in {@link + * #reportRegistryCoverage}, and decides nothing. + * -+ *

    INERT WHERE {@code aere.pq.anchorBlock} IS UNSET: there is no ++ *

    INERT ON CHAIN 2800 as it stands: {@code aere.pq.anchorBlock} is unset there, so there is no + * threshold and no comparison. This code cannot stop a validator that is running now. + */ + private void validateThresholdReachabilityOrAbort() { @@ -4338,7 +5444,7 @@ index 000000000..af694dcf9 + throw new ActivationConfigException( + ActivationConfigException.Kind.UNSAFE, + "AERE-PQC-CFG-UNSAFE-08", -+ "AERE PQC COVERAGE: REFUSING TO START (fail-closed). The Falcon anchor is armed at height " ++ "AERE PQC D-078: REFUSING TO START (fail-closed). The Falcon anchor is armed at height " + + anchor.anchorBlock() + + " with a staged threshold that reaches K=" + + k @@ -4356,7 +5462,7 @@ index 000000000..af694dcf9 + + ". WHAT THIS MEANS: with every node honest and every node up, a proposer can fail to " + + "assemble a certificate, and it fails on every node at once because the validator set " + + "is consensus state - the chain stops in a state where the re-anchoring transaction " -+ + "that would repair it can no longer be carried by any block. That is an unreachable threshold. WHAT TO " ++ + "that would repair it can no longer be carried by any block. That is D-078. WHAT TO " + + "DO: re-anchor the manifest so that every validator holds a key (this is what makes " + + "the standing 'grow to N>=9 before arming' order safe - the manifest has to grow WITH " + + "the set, not after it), or lower the " @@ -4368,7 +5474,7 @@ index 000000000..af694dcf9 + } + + /** -+ * AERE COVERAGE MARGIN: how many validators hold an anchored Falcon key, counting a late anchor that has not ++ * AERE D-078: how many validators hold an anchored Falcon key, counting a late anchor that has not + * landed yet the same way {@link #expectedFleetSize()} does, so the two numbers being compared are + * read at the same moment from the same manifest. + * @@ -4416,9 +5522,9 @@ index 000000000..af694dcf9 + } + + /** -+ * AERE COVERAGE MARGIN: the height at which a validator set was last observed, or {@code -1} when none ever ++ * AERE D-078: the height at which a validator set was last observed, or {@code -1} when none ever + * was. Diagnostic, and the only way a test can tell "the gate is being fed" from "the gate happens -+ * to say yes anyway", which is the difference the coverage repair turns on. ++ * to say yes anyway", which is the difference the D-078 repair turns on. + * + * @return the observation height, or -1 if no validator set has been observed + */ @@ -4438,7 +5544,7 @@ index 000000000..af694dcf9 + *

  • that registry binds THIS node's own Falcon index to a validator address. + * + * -+ *

    AERE COVERAGE MARGIN (2026-08-02): condition 3 used to be "that registry COVERS every validator in ++ *

    AERE D-078 (2026-08-02): condition 3 used to be "that registry COVERS every validator in + * the last observed validator set", and that is the sentence that stopped the chain. Coverage + * is a property of the validator set, which is consensus state, so an ordinary add-validator vote + * falsifies it on every node at the same height; the old answer to that was to switch attachment @@ -4464,7 +5570,7 @@ index 000000000..af694dcf9 + * cannot check peer BINARY VERSION, and it is emphatically NOT what makes the halting order + * impossible. Until 2026-08-02 it asked the FLEET question instead - does the registry cover + * every observed validator - and switched attachment off when the answer was no; see the -+ * coverage note on the method below for why that was a chain stop rather than a safeguard. ++ * D-078 note on the method below for why that was a chain stop rather than a safeguard. + *

  • The CHAIN-RELATIVE guard, {@link #verifyAttachHeightAgainstChainHeadOrAbort}, is what + * closes that last gap. It refuses to START a node whose activation height is not safely + * ahead of the chain head, so the height cannot be one that the fleet has already walked @@ -4508,7 +5614,7 @@ index 000000000..af694dcf9 + } + return false; + } -+ // AERE COVERAGE MARGIN (2026-08-02), CONDITION 3, REPLACED. What stands here now is a LOCAL fact: does the ++ // AERE D-078 (2026-08-02), CONDITION 3, REPLACED. What stands here now is a LOCAL fact: does the + // anchored registry bind MY OWN index to an address, so that every verifier can resolve my seal + // to a signer. It is a property of this node and the anchored manifest, and nothing that happens + // to the validator set can falsify it. @@ -4522,7 +5628,7 @@ index 000000000..af694dcf9 + // height, because the validator set is consensus state. Every node stops attaching, so no + // proposer can gather K seals, so PqAnchorProducer refuses for every proposer in turn and + // the chain stops - and it stops in a state where the re-anchoring transaction that would -+ // repair it can no longer be carried by any block. That is the same halt, measured in ++ // repair it can no longer be carried by any block. That is D-078, measured in + // PqForkValidatorSetChangeTest. + // * the input it read is fed by observeValidators, whose only caller stands down at the anchor + // height. Above that height the answer was either FROZEN at a set from below it, or - on any @@ -4573,7 +5679,7 @@ index 000000000..af694dcf9 + } + + /** -+ * AERE COVERAGE MARGIN (2026-08-02). REPORT what the anchored registry covers, and what that costs in ++ * AERE D-078 (2026-08-02). REPORT what the anchored registry covers, and what that costs in + * liveness margin. This decides nothing: it is called after the attachment gate has already said + * yes, and its only effect is a log line. + * @@ -4622,7 +5728,7 @@ index 000000000..af694dcf9 + LOG.warn( + "AERE PQC: the anchored registry does NOT cover the validator set at block {}: {} of {} " + + "validators hold an anchored Falcon key. Seal attachment CONTINUES - switching it off " -+ + "here is what stops a chain - but the post-quantum margin has moved: in the " ++ + "here is what stops a chain (D-078) - but the post-quantum margin has moved: in the " + + "worst case only {} keyed validator(s) are among the {} ECDSA committers of a block. " + + "Compare that with the Falcon threshold K in force: if it is above that number, a " + + "proposer can legitimately fail to assemble a certificate. RE-ANCHOR the manifest for " @@ -4635,14 +5741,14 @@ index 000000000..af694dcf9 + } + + /** -+ * AERE COVERAGE MARGIN. The number of anchored-key holders a block's ECDSA committer set is GUARANTEED to ++ * AERE D-078. The number of anchored-key holders a block's ECDSA committer set is GUARANTEED to + * contain, in the worst case, when {@code validators} validators are in the set and {@code keyed} + * of them hold an anchored Falcon key. + * + *

    A block needs {@code ceil(2N/3)} ECDSA committed seals. An adversarial (or merely unlucky) + * choice of committers takes every unkeyed validator first, so the guaranteed keyed count is + * {@code quorum - (N - keyed)}, floored at zero. A Falcon threshold K above this number is a -+ * threshold the chain is not guaranteed to be able to meet, which is exactly the shape of that halt: ++ * threshold the chain is not guaranteed to be able to meet, which is exactly the shape of D-078: + * at N=7 with all 7 keyed and K=5 the margin is exactly zero, one added unkeyed validator holds it + * at zero, and a second takes it negative. + * @@ -4659,7 +5765,7 @@ index 000000000..af694dcf9 + } + + /** -+ * AERE COVERAGE MARGIN (2026-08-03). By how much a Falcon threshold {@code k} exceeds what the fleet is ++ * AERE D-078 (2026-08-03). By how much a Falcon threshold {@code k} exceeds what the fleet is + * GUARANTEED to be able to produce. Zero means reachable; any positive number is a threshold a + * proposer can legitimately fail to meet with every node honest and every node up. + * @@ -4697,15 +5803,331 @@ index 000000000..af694dcf9 + if (!attachmentArmed(blockNumber)) { + return Optional.empty(); + } -+ try { -+ final FalconSigner signer = new FalconSigner(); -+ signer.init(true, localPrivateKey); -+ final byte[] sig = signer.generateSignature(commitHash.toArray()); -+ return Optional.of(new FalconSeal(localIndex, Bytes.wrap(sig))); -+ } catch (final RuntimeException e) { -+ LOG.warn("AERE PQC: Falcon signing failed (ECDSA seal unaffected): {}", e.toString()); ++ // AERE AGILITY step 4 (2026-08-24): signing goes through the scheme layer. The same ++ // FalconSigner underneath, but the path is now the one the hybrid will use too; the 751 ++ // baseline tests prove the equivalence. ++ final java.util.Optional sig = ++ ((FalconSealScheme) SealSchemes.FALCON_512).signWithParams(localPrivateKey, commitHash.toArray()); ++ if (sig.isEmpty()) { ++ LOG.warn("AERE PQC: Falcon signing failed (ECDSA seal unaffected)"); + return Optional.empty(); + } ++ return Optional.of(new FalconSeal(localIndex, Bytes.wrap(sig.get()))); ++ } ++ ++ /** ++ * Property naming the first height at which this node ATTACHES a post-quantum seal to its own ++ * PREPARE messages. Absent = never, which is the configuration of every node today. ++ * ++ *

    SEPARATE from {@code aere.falcon.attachBlock}, and the separation is mandatory: if PREPARE ++ * emission started together with commit emission, rolling the binary onto the fleet would become ++ * a flag day. This way the binary can sit on every node for months before any of them emits ++ * anything new. ++ */ ++ public static final String PREPARE_ATTACH_PROPERTY = "aere.pq.preparePq.attachBlock"; ++ ++ /** Environment fallback for {@link #PREPARE_ATTACH_PROPERTY}. */ ++ public static final String PREPARE_ATTACH_ENV = "AERE_PQ_PREPAREPQ_ATTACHBLOCK"; ++ ++ /** ++ * The configured PREPARE attachment height, read fresh on every call. ++ * ++ *

    Absent = {@link Long#MAX_VALUE}, i.e. never. A value that is PRESENT but unreadable REFUSES ++ * loudly instead of disarming: the lesson paid for by the anchor loader is that a mistyped ++ * character must never boot the node DISARMED, because then nobody finds out. ++ * ++ * @return the height, or Long.MAX_VALUE when unset ++ */ ++ public static long prepareAttachBlock() { ++ final String raw = resolve(PREPARE_ATTACH_PROPERTY, PREPARE_ATTACH_ENV); ++ if (raw == null || raw.isBlank()) { ++ return Long.MAX_VALUE; ++ } ++ try { ++ final long v = Long.parseLong(raw.trim()); ++ if (v < 0) { ++ throw new NumberFormatException("negative"); ++ } ++ return v; ++ } catch (final NumberFormatException e) { ++ throw new ActivationConfigException( ++ ActivationConfigException.Kind.SYNTAX, ++ "AERE-PQC-PREPARE-CONF-01", ++ "AERE PQ PREPARE: " ++ + PREPARE_ATTACH_PROPERTY ++ + " is set to '" ++ + raw ++ + "', which is not a non-negative block height. A node must REFUSE to start rather " ++ + "than silently run with PREPARE attachment disarmed: a disarmed node looks exactly " ++ + "like a correctly configured one until the day it matters."); ++ } ++ } ++ ++ /** ++ * Sign this node's own PREPARE, when the PREPARE attachment gate is open at this height. ++ * ++ *

    It requires THREE things, and each closes one way of being wrong: ++ * ++ *

      ++ *
    • {@code signingEnabled}: the node holds a key. Without one nothing is emitted, and the ++ * ECDSA path is not touched in any way. ++ *
    • {@link #attachmentArmed(long)}: the same registry-coverage conditions as commit, AND the ++ * fact that the fleet already emits seals on commit. A PREPARE seal on a fleet that does not ++ * emit on commit would be something new in a network that has not yet seen anything new. ++ *
    • its own height, above. ++ *
    ++ * ++ *

    NEVER THROWS except for the strict configuration case above: a signing failure is a log line ++ * and an empty value, exactly as at commit, because the ECDSA path must not be disturbed. ++ * ++ * @param blockNumber the height being prepared ++ * @param message the domain-separated PREPARE message (see PqAnchor.prepareMessage) ++ * @return the seal, or empty when any gate is shut ++ */ ++ public Optional signPrepare(final long blockNumber, final Bytes32 message) { ++ if (!signingEnabled) { ++ return Optional.empty(); ++ } ++ if (!attachmentArmed(blockNumber)) { ++ return Optional.empty(); ++ } ++ if (blockNumber < prepareAttachBlock()) { ++ return Optional.empty(); ++ } ++ final java.util.Optional sig = ++ ((FalconSealScheme) SealSchemes.FALCON_512).signWithParams(localPrivateKey, message.toArray()); ++ if (sig.isEmpty()) { ++ LOG.warn("AERE PQ PREPARE: Falcon signing failed (ECDSA path unaffected)"); ++ return Optional.empty(); ++ } ++ final long n = preparesSealed.incrementAndGet(); ++ // LOG VOLUME IS A DECISION, not an oversight. One line per PREPARE would be two lines per ++ // second per node, which is exactly the kind of log that gets trained away (see D-153, where a ++ // permanent ERROR made an entire log worthless). The first emission is worth a line, because it ++ // is the moment the node starts doing something new; after that, one line every 500, so a ++ // testnet still has a number to count. ++ if (n == 1L) { ++ LOG.info( ++ "AERE PQ PREPARE: this node EMITTED its first post-quantum seal on a PREPARE, at " ++ + "height {} (gate {}={}). From here on its PREPAREs carry a seal.", ++ blockNumber, ++ PREPARE_ATTACH_PROPERTY, ++ prepareAttachBlock()); ++ } else if (n % 500L == 0L) { ++ LOG.info("AERE PQ PREPARE: {} seals emitted on PREPAREs since startup.", n); ++ } ++ return Optional.of(new FalconSeal(localIndex, Bytes.wrap(sig.get()))); ++ } ++ ++ /** ++ * How many seals this node has emitted on PREPAREs since startup. ++ * ++ *

    It exists so that the COVERAGE step can be measured: without a number, arming enforcement ++ * would be a bet. Read from the log on a testnet, and from this value in tests. ++ * ++ * @return the count ++ */ ++ public long preparesSealed() { ++ return preparesSealed.get(); ++ } ++ ++ /** ++ * Property naming the first height at which this node ATTACHES a post-quantum seal to its own ++ * PROPOSAL messages. Absent = never, which is the configuration of every node today. ++ * ++ *

    SEPARATE from both the commit and the PREPARE gates, same reason: three layers that arm on ++ * three independent decisions must not share a switch, or the day one is turned on becomes a flag ++ * day for the others. ++ */ ++ public static final String PROPOSAL_ATTACH_PROPERTY = "aere.pq.proposalPq.attachBlock"; ++ ++ /** Environment fallback for {@link #PROPOSAL_ATTACH_PROPERTY}. */ ++ public static final String PROPOSAL_ATTACH_ENV = "AERE_PQ_PROPOSALPQ_ATTACHBLOCK"; ++ ++ /** ++ * The configured PROPOSAL attachment height, read fresh on every call. ++ * ++ *

    Absent = {@link Long#MAX_VALUE}, i.e. never. A value that is PRESENT but unreadable REFUSES ++ * loudly instead of disarming - the anchor loader's lesson, once per gate, every gate. ++ * ++ * @return the height, or Long.MAX_VALUE when unset ++ */ ++ public static long proposalAttachBlock() { ++ final String raw = resolve(PROPOSAL_ATTACH_PROPERTY, PROPOSAL_ATTACH_ENV); ++ if (raw == null || raw.isBlank()) { ++ return Long.MAX_VALUE; ++ } ++ try { ++ final long v = Long.parseLong(raw.trim()); ++ if (v < 0) { ++ throw new NumberFormatException("negative"); ++ } ++ return v; ++ } catch (final NumberFormatException e) { ++ throw new ActivationConfigException( ++ ActivationConfigException.Kind.SYNTAX, ++ "AERE-PQC-PROPOSAL-CONF-01", ++ "AERE PQ PROPOSAL: " ++ + PROPOSAL_ATTACH_PROPERTY ++ + " is set to '" ++ + raw ++ + "', which is not a non-negative block height. A node must REFUSE to start rather " ++ + "than silently run with PROPOSAL attachment disarmed: a disarmed node looks exactly " ++ + "like a correctly configured one until the day it matters."); ++ } ++ } ++ ++ /** ++ * Sign this node's own PROPOSAL, when the PROPOSAL attachment gate is open at this height. ++ * ++ *

    Same three requirements as {@link #signPrepare}, for the same three reasons: a key, the ++ * commit-layer coverage conditions, and its own height. NEVER throws except for the strict ++ * configuration case: a signing failure is a log line and an empty value, because the ECDSA path ++ * must not be disturbed. ++ * ++ * @param blockNumber the height being proposed ++ * @param message the domain-separated PROPOSAL message (see PqAnchor.proposalMessage) ++ * @return the seal, or empty when any gate is shut ++ */ ++ public Optional signProposal(final long blockNumber, final Bytes32 message) { ++ if (!signingEnabled) { ++ return Optional.empty(); ++ } ++ if (!attachmentArmed(blockNumber)) { ++ return Optional.empty(); ++ } ++ if (blockNumber < proposalAttachBlock()) { ++ return Optional.empty(); ++ } ++ final java.util.Optional sig = ++ ((FalconSealScheme) SealSchemes.FALCON_512).signWithParams(localPrivateKey, message.toArray()); ++ if (sig.isEmpty()) { ++ LOG.warn("AERE PQ PROPOSAL: Falcon signing failed (ECDSA path unaffected)"); ++ return Optional.empty(); ++ } ++ final long n = proposalsSealed.incrementAndGet(); ++ // Same log-volume decision as at PREPARE: a proposal is at most one per round per proposer, so ++ // this is quieter by nature, but the counter still steps so a testnet has a number to count. ++ if (n == 1L) { ++ LOG.info( ++ "AERE PQ PROPOSAL: this node EMITTED its first post-quantum seal on a PROPOSAL, at " ++ + "height {} (gate {}={}). From here on its proposals carry a seal.", ++ blockNumber, ++ PROPOSAL_ATTACH_PROPERTY, ++ proposalAttachBlock()); ++ } else if (n % 500L == 0L) { ++ LOG.info("AERE PQ PROPOSAL: {} seals emitted on PROPOSALs since startup.", n); ++ } ++ return Optional.of(new FalconSeal(localIndex, Bytes.wrap(sig.get()))); ++ } ++ ++ /** ++ * How many seals this node has emitted on its own PROPOSALs since startup. Exists so the ++ * coverage step can be measured, exactly as at PREPARE. ++ * ++ * @return the count ++ */ ++ public long proposalsSealed() { ++ return proposalsSealed.get(); ++ } ++ ++ /** ++ * The property that opens the ROUND-CHANGE attachment gate: from this height on, this node's own ++ * round-changes carry a Falcon seal. Emission only - enforcement is {@code ++ * aere.pq.roundChangePq.forkBlock}, deliberately separate so the fleet can emit long before any ++ * node refuses, exactly as at PREPARE and PROPOSAL. ++ */ ++ public static final String ROUNDCHANGE_ATTACH_PROPERTY = "aere.pq.roundChangePq.attachBlock"; ++ ++ /** Environment fallback for {@link #ROUNDCHANGE_ATTACH_PROPERTY}. */ ++ public static final String ROUNDCHANGE_ATTACH_ENV = "AERE_PQ_ROUNDCHANGEPQ_ATTACHBLOCK"; ++ ++ /** ++ * The configured ROUND-CHANGE attachment height, read fresh on every call. ++ * ++ *

    Absent = {@link Long#MAX_VALUE}, i.e. never. A value that is PRESENT but unreadable REFUSES ++ * loudly instead of disarming - the anchor loader's lesson, once per gate, every gate. ++ * ++ * @return the height, or Long.MAX_VALUE when unset ++ */ ++ public static long roundChangeAttachBlock() { ++ final String raw = resolve(ROUNDCHANGE_ATTACH_PROPERTY, ROUNDCHANGE_ATTACH_ENV); ++ if (raw == null || raw.isBlank()) { ++ return Long.MAX_VALUE; ++ } ++ try { ++ final long v = Long.parseLong(raw.trim()); ++ if (v < 0) { ++ throw new NumberFormatException("negative"); ++ } ++ return v; ++ } catch (final NumberFormatException e) { ++ throw new ActivationConfigException( ++ ActivationConfigException.Kind.SYNTAX, ++ "AERE-PQC-ROUNDCHANGE-CONF-01", ++ "AERE PQ ROUNDCHANGE: " ++ + ROUNDCHANGE_ATTACH_PROPERTY ++ + " is set to '" ++ + raw ++ + "', which is not a non-negative block height. A node must REFUSE to start rather " ++ + "than silently run with ROUND-CHANGE attachment disarmed: a disarmed node looks " ++ + "exactly like a correctly configured one until the day it matters."); ++ } ++ } ++ ++ /** ++ * Sign this node's own ROUND-CHANGE, when the ROUND-CHANGE attachment gate is open at this ++ * height. ++ * ++ *

    Same three requirements as {@link #signPrepare} and {@link #signProposal}, for the same ++ * three reasons: a key, the commit-layer coverage conditions, and its own height. NEVER throws ++ * except for the strict configuration case: a signing failure is a log line and an empty value, ++ * because the ECDSA path must not be disturbed. ++ * ++ * @param blockNumber the height the round-change targets ++ * @param message the domain-separated ROUND-CHANGE message (see PqAnchor.roundChangeMessage) ++ * @return the seal, or empty when any gate is shut ++ */ ++ public Optional signRoundChange(final long blockNumber, final Bytes32 message) { ++ if (!signingEnabled) { ++ return Optional.empty(); ++ } ++ if (!attachmentArmed(blockNumber)) { ++ return Optional.empty(); ++ } ++ if (blockNumber < roundChangeAttachBlock()) { ++ return Optional.empty(); ++ } ++ final java.util.Optional sig = ++ ((FalconSealScheme) SealSchemes.FALCON_512).signWithParams(localPrivateKey, message.toArray()); ++ if (sig.isEmpty()) { ++ LOG.warn("AERE PQ ROUNDCHANGE: Falcon signing failed (ECDSA path unaffected)"); ++ return Optional.empty(); ++ } ++ final long n = roundChangesSealed.incrementAndGet(); ++ // Round-changes only exist when rounds FAIL, so on a healthy chain this counter barely moves; ++ // it still steps so a testnet that forces round-changes has a number to count. ++ if (n == 1L) { ++ LOG.info( ++ "AERE PQ ROUNDCHANGE: this node EMITTED its first post-quantum seal on a ROUND-CHANGE, " ++ + "at height {} (gate {}={}). From here on its round-changes carry a seal.", ++ blockNumber, ++ ROUNDCHANGE_ATTACH_PROPERTY, ++ roundChangeAttachBlock()); ++ } else if (n % 100L == 0L) { ++ LOG.info("AERE PQ ROUNDCHANGE: {} seals emitted on ROUND-CHANGEs since startup.", n); ++ } ++ return Optional.of(new FalconSeal(localIndex, Bytes.wrap(sig.get()))); ++ } ++ ++ /** ++ * How many seals this node has emitted on its own ROUND-CHANGEs since startup. Exists so the ++ * coverage step can be measured, exactly as at PREPARE and PROPOSAL. ++ * ++ * @return the count ++ */ ++ public long roundChangesSealed() { ++ return roundChangesSealed.get(); + } + + /** @@ -4721,7 +6143,7 @@ index 000000000..af694dcf9 + } + + /** -+ * HEIGHT SCHEDULE. The Falcon public key registered for an index AT A HEIGHT: the one carried by the ++ * D-081. The Falcon public key registered for an index AT A HEIGHT: the one carried by the + * registry the chain's schedule makes active there. + * + *

    WHY A HEIGHT IS NEEDED AT ALL. A certificate inside a block at height h was produced under @@ -4733,7 +6155,7 @@ index 000000000..af694dcf9 + * + *

    Returns the head registry's key when no binding is active at that height, which is every + * height below the schedule's first entry and every height on a chain with no schedule at all. So -+ * a node with a single registry gets exactly what it got before the height schedule existed. ++ * a node on chain 2800 as it stands today gets exactly what it got before D-081. + */ + private FalconPublicKeyParameters keyAt( + final long blockNumber, final int validatorIndex, final boolean historic) { @@ -4746,11 +6168,11 @@ index 000000000..af694dcf9 + final Optional required = + PqRegistryHash.requiredHashAt(schedule, blockNumber); + if (required.isEmpty()) { -+ // SCHEDULE BOUNDARY (2026-08-15). The only historical question ever asked one block -+ // below the schedule's first entry is about the certificate carried by the block at -+ // blockNumber+1, whose governing registry is the one bound EXACTLY at blockNumber+1. -+ // Answer it from that entry's VERIFIED bound registry, never from the unverified head -+ // file. Exactly one block: at blockNumber+2 below the schedule nothing changes. ++ // D-228. The only historical question ever asked one block below the schedule's first entry ++ // is about the certificate carried by the block at blockNumber+1, whose governing registry ++ // is the one bound EXACTLY at blockNumber+1. Answer it from that entry's VERIFIED bound ++ // registry, never from the unverified head file. Exactly one block: at blockNumber+2 below ++ // the schedule nothing changes. + final Optional nextEntry = + PqRegistryHash.requiredHashAt(schedule, blockNumber + 1); + if (nextEntry.isPresent() && nextEntry.get().block() == blockNumber + 1) { @@ -4793,9 +6215,9 @@ index 000000000..af694dcf9 + } + + /** -+ * HEIGHT SCHEDULE. The validator ADDRESS bound to a registry index at a height. ++ * D-081. The validator ADDRESS bound to a registry index at a height. + * -+ *

    LOOKUP HARDENING (b-v2): PRIVATE, with the caller's motive as an argument. The two public ++ *

    D2 HARDENING (b-v2): PRIVATE, with the caller's motive as an argument. The two public + * doors are {@link #addressForIndexAtHistoric} and {@link #addressForIndexAtOwnHead}, each of + * which passes a constant. Nothing outside this file can choose the value, so the one shared + * resolution body cannot drift between the two paths and no caller can pick the wrong flag. @@ -4816,10 +6238,10 @@ index 000000000..af694dcf9 + blockNumber, validatorIndex, "no schedule was ever loaded", historic); + } + if (PqRegistryHash.requiredHashAt(schedule, blockNumber).isEmpty()) { -+ // SCHEDULE BOUNDARY (2026-08-15). Same alignment as in keyAt: one block below the -+ // schedule's first entry the subject is the certificate of the block at blockNumber+1, -+ // governed by the registry bound EXACTLY there, so the answer comes from that entry's -+ // VERIFIED bound registry and mirrors what this method answers at blockNumber+1 itself. ++ // D-228. Same alignment as in keyAt: one block below the schedule's first entry the subject ++ // is the certificate of the block at blockNumber+1, governed by the registry bound EXACTLY ++ // there, so the answer comes from that entry's VERIFIED bound registry and mirrors what ++ // this method answers at blockNumber+1 itself. + final Optional nextEntry = + PqRegistryHash.requiredHashAt(schedule, blockNumber + 1); + if (nextEntry.isPresent() && nextEntry.get().block() == blockNumber + 1) { @@ -4854,14 +6276,14 @@ index 000000000..af694dcf9 + } + + /** -+ * HEIGHT SCHEDULE / LOOKUP HARDENING (b-v2). THE HISTORY DOOR. Verify a Falcon seal carried by a header this ++ * D-081 / D2 HARDENING (b-v2). THE HISTORY DOOR. Verify a Falcon seal carried by a header this + * node RECEIVED, against the key set the chain required at that height. + * + *

    WHY THE MOTIVE IS IN THE NAME AND NOT IN THE HEIGHT, measured on 2026-08-06. The first shape + * of hardening (b) refused whenever no height binding existed at or above the arming height, and + * decided that from the block number alone. That stopped the two paths that work on THIS NODE'S + * OWN head: restoring seals from disk after a restart, and proposing. Six tests went red, five in -+ * {@code PqSealPersistenceTest} and one in {@code PqForkValidatorSetChangeTest}, and the refusal ++ * {@code PqSealPersistenceTest} and one in {@code PqForkValidatorSetChangeTest}, and the D078 + * message says the consequence outright - the node refuses to propose, so it stops producing + * blocks. In every one of the six the number presented to the guard was 1030 against an arming + * height of 1000, identical to what a real historical question would present in the same process @@ -4869,7 +6291,7 @@ index 000000000..af694dcf9 + * + *

    Reaching THIS method means the node is judging somebody else's claim about a height it did + * not build. "Which keys were in force here" then has an answer that is not this node's current -+ * registry, and answering from the head registry anyway is that defect verbatim: a header produced under ++ * registry, and answering from the head registry anyway is D2/T2 verbatim: a header produced under + * one key set checked against another, with success reported. + * + * @param blockNumber the height of the header carrying the seal @@ -4888,7 +6310,7 @@ index 000000000..af694dcf9 + } + + /** -+ * LOOKUP HARDENING (b-v2). THE OWN-HEAD DOOR. Verify a Falcon seal over a block this node holds as its ++ * D2 HARDENING (b-v2). THE OWN-HEAD DOOR. Verify a Falcon seal over a block this node holds as its + * own head, or is building right now. + * + *

    It does not refuse for a missing height binding, because at this node's own head the head @@ -4917,7 +6339,7 @@ index 000000000..af694dcf9 + } + + /** -+ * HEIGHT SCHEDULE / LOOKUP HARDENING (b-v2). THE HISTORY DOOR, address half. See {@link #verifyAtHistoric}. ++ * D-081 / D2 HARDENING (b-v2). THE HISTORY DOOR, address half. See {@link #verifyAtHistoric}. + * + * @param blockNumber the height of the header being validated + * @param validatorIndex the registry index carried by a Falcon seal @@ -4928,7 +6350,7 @@ index 000000000..af694dcf9 + } + + /** -+ * LOOKUP HARDENING (b-v2). THE OWN-HEAD DOOR, address half. See {@link #verifyAtOwnHead}. ++ * D2 HARDENING (b-v2). THE OWN-HEAD DOOR, address half. See {@link #verifyAtOwnHead}. + * + * @param blockNumber this node's own head, or the block it is building + * @param validatorIndex the registry index @@ -4939,14 +6361,14 @@ index 000000000..af694dcf9 + } + + /** -+ * LOOKUP HARDENING (b). The one decision the whole hardening turns on, isolated so that removing it is -+ * a one-line edit and the negative control can prove the hardening test goes red without it. ++ * D2 HARDENING (b). The one decision the whole hardening turns on, isolated so that removing it is ++ * a one-line edit and the negative control can prove the D2 test goes red without it. + * + *

    THE MEASURED DEFECT. Both height-resolved lookups used to answer a height they had no binding + * for by returning the HEAD registry - the key set in force right now. Below the arming height + * that is correct and costs nothing: no certificate is being judged there. At and above it, it is -+ * the height-less lookup defect verbatim: "an armed node verifies a year-old header against the -+ * keys it holds today", so one rotation makes every block between the arming height and the rotation unverifiable, and the ++ * D2/T2 verbatim: "an armed node verifies a year-old header against the keys it holds today", so ++ * one rotation makes every block between the arming height and the rotation unverifiable, and the + * node reports success while doing it. Refusing is the only answer that does not assert a check + * that was not performed. + * @@ -4957,7 +6379,7 @@ index 000000000..af694dcf9 + * config.pqRegistryHash} plus {@code aere.falcon.registry.history} and restart. Compare the + * silence this replaces, where the same node imports the whole chain and calls it verified. + * -+ *

    LOOKUP HARDENING (b-v2), 2026-08-06. The condition gained ONE term, {@code historic}, and ++ *

    D2 HARDENING (b-v2), 2026-08-06. The condition gained ONE term, {@code historic}, and + * that term is the whole of the second repair. The first shape refused on height alone; the + * six tests it turned red were all asking about this node's OWN head at height 1030 with an + * arming height of 1000, which is the same pair of numbers a genuinely historical question @@ -4982,11 +6404,11 @@ index 000000000..af694dcf9 + } + + /** -+ * LOOKUP HARDENING (b). The address half of {@link #headRegistryKeyOrRefuse}, with the same rule and ++ * D2 HARDENING (b). The address half of {@link #headRegistryKeyOrRefuse}, with the same rule and + * for the same reason: at and above the arming height an unbound height has no answer, and {@code + * PqAnchorSealsRule} refuses an index it cannot bind to an address rather than skipping it. + * -+ *

    LOOKUP HARDENING (b-v2): same one added term as {@link #headRegistryKeyOrRefuse}. ++ *

    D2 HARDENING (b-v2): same one added term as {@link #headRegistryKeyOrRefuse}. + * + * @param blockNumber the height being asked about + * @param validatorIndex the registry index @@ -5008,7 +6430,7 @@ index 000000000..af694dcf9 + } + + /** -+ * LOOKUP HARDENING (b). Say it once per configuration change, not once per block: at a 523 ms block ++ * D2 HARDENING (b). Say it once per configuration change, not once per block: at a 523 ms block + * period a per-block ERROR is itself a hazard on this fleet, and the refusal is already visible as + * a stopped node. + * @@ -5018,9 +6440,9 @@ index 000000000..af694dcf9 + private void shoutUnboundHeight(final long blockNumber, final String why) { + if (loggedUnboundArmedHeight.compareAndSet(false, true)) { + LOG.error( -+ "AERE PQC LOOKUP-HARDENING: REFUSING to resolve Falcon keys at height {} - this node is ARMED from {} " ++ "AERE PQC D2: REFUSING to resolve Falcon keys at height {} - this node is ARMED from {} " + + "and {}. Until 2026-08-06 this fell back to the registry in force at the HEAD, " -+ + "which is the height-less lookup defect: a header produced under one key set was checked against " ++ + "which is the D2/T2 defect: a header produced under one key set was checked against " + + "another, and one key rotation would have made every block above the arming height " + + "unverifiable while the node reported success. Every header at or above the arming " + + "height will now be REFUSED until the height-to-registry binding exists. WHAT TO DO: " @@ -5041,24 +6463,785 @@ index 000000000..af694dcf9 + if (pub == null || commitHash == null || signature == null) { + return false; + } -+ try { -+ final FalconSigner verifier = new FalconSigner(); -+ verifier.init(false, pub); -+ return verifier.verifySignature(commitHash.toArray(), signature.toArray()); -+ } catch (final RuntimeException e) { -+ LOG.debug("AERE PQC: Falcon verify threw for index {}: {}", validatorIndex, e.toString()); -+ return false; ++ // AERE AGILITY step 4: verification goes through the scheme layer, on the registry form ++ // (raw h, 896 bytes). verifyRaw never throws; a false here is an invalid seal, ++ // exactly the old contract. ++ final boolean valid = ++ SealSchemes.FALCON_512.verifyRaw(pub.getH(), commitHash.toArray(), signature.toArray()); ++ if (!valid) { ++ LOG.debug("AERE PQC: Falcon seal did not verify for index {}", validatorIndex); + } ++ return valid; ++ } ++} +diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/HybridSealProducer.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/HybridSealProducer.java +new file mode 100755 +index 000000000..591ede15e +--- /dev/null ++++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/HybridSealProducer.java +@@ -0,0 +1,140 @@ ++/* ++ * AERE HYBRID, the PRODUCER half (2026-08-25). The counterpart of PqCommitEnforcement: that one ++ * decides what is accepted, this one decides what is EMITTED. ++ * ++ * WHY A SEPARATE CLASS FROM FalconSealSupport. Falcon has an old production path, with ++ * per-component loading, startup guards and a singleton; widening it would have meant touching ++ * the very class the live consensus hangs on, for a capability armed nowhere today. ++ * Falcon is not touched here at all: this class produces ONLY the seals of the other schemes, ++ * i.e. exactly the content of the extras slot in CommitPayload. ++ * ++ * THE EMISSION GATE IS WHY THIS CLASS IS ALLOWED TO EXIST. Adding extras changes the signed ++ * bytes, so an older node can no longer PARSE the message. What protects the fleet is not ++ * leniency at decode time, which cannot work, but the fact that nothing emits extras until the ++ * attach height, the same discipline as the Falcon gate. Unset means: never emit, ++ * EVER, and that is the default. ++ * ++ * HALF A CERTIFICATE IS NOT EMITTED. If the schedule requires a scheme this node has no key ++ * for, no maimed certificate is sent (every neighbour would refuse it at quorum anyway): ++ * nothing is sent, and the log SHOUTS. An operator must find out a key is missing ++ * BEFORE the height where enforcement bites, not on that very day. ++ */ ++package org.hyperledger.besu.consensus.common.bft; ++ ++import java.util.ArrayList; ++import java.util.List; ++import java.util.Map; ++import java.util.Optional; ++import java.util.Set; ++ ++import org.apache.tuweni.bytes.Bytes; ++import org.slf4j.Logger; ++import org.slf4j.LoggerFactory; ++ ++/** Produces the non-Falcon scheme seals a hybrid commit carries, gated on height. */ ++public final class HybridSealProducer { ++ ++ private static final Logger LOG = LoggerFactory.getLogger(HybridSealProducer.class); ++ ++ /** The disarmed attachment height: no block ever reaches it, so nothing is ever emitted. */ ++ public static final long NEVER = Long.MAX_VALUE; ++ ++ private final long attachFromBlock; ++ private final PqSchemeSchedule schedule; ++ private final int validatorIndex; ++ private final Map localKeys; ++ // one shout per missing scheme, not one per block: a permanent alarm is learned and ignored ++ private final Set alreadyShouted = new java.util.HashSet<>(); ++ ++ /** ++ * @param attachFromBlock first height at which extras may be emitted; {@link #NEVER} to disarm ++ * @param schedule which schemes are required at which height; null disarms as well ++ * @param validatorIndex this node's index, written into every seal it produces ++ * @param localKeys the private handles this node holds, per scheme id ++ */ ++ public HybridSealProducer( ++ final long attachFromBlock, ++ final PqSchemeSchedule schedule, ++ final int validatorIndex, ++ final Map localKeys) { ++ this.attachFromBlock = schedule == null ? NEVER : attachFromBlock; ++ this.schedule = schedule; ++ this.validatorIndex = validatorIndex; ++ this.localKeys = localKeys == null ? Map.of() : Map.copyOf(localKeys); ++ } ++ ++ /** A producer that never emits anything: the configuration of every node today. */ ++ public static HybridSealProducer disarmed() { ++ return new HybridSealProducer(NEVER, null, -1, Map.of()); ++ } ++ ++ /** ++ * Whether extras may be emitted at this height at all. ++ * ++ * @param blockNumber the height ++ * @return true when the attachment gate is open ++ */ ++ public boolean attachmentArmedAt(final long blockNumber) { ++ return schedule != null && blockNumber >= attachFromBlock; ++ } ++ ++ /** ++ * The extra scheme seals for this block, or an empty list. ++ * ++ *

    Never throws: a producer fault must never take down the ECDSA commit path. Every refusal ++ * is a logged reason plus an empty list, exactly the stance of the Falcon signer. ++ * ++ * @param blockNumber the height of the block being committed ++ * @param message the very bytes the Falcon seal of this commit signs ++ * @return the seals, or empty when the gate is shut, a key is missing, or signing failed ++ */ ++ public List sealsFor(final long blockNumber, final Bytes message) { ++ if (!attachmentArmedAt(blockNumber) || message == null) { ++ return List.of(); ++ } ++ try { ++ final Set required = schedule.schemesAt(blockNumber); ++ final List produced = new ArrayList<>(); ++ for (final String schemeId : required) { ++ if (SealSchemes.FALCON_512.id().equals(schemeId)) { ++ continue; // Falcon has its own slot and its own signer; never duplicated here ++ } ++ final Optional scheme = SealSchemes.byId(schemeId); ++ if (scheme.isEmpty()) { ++ shoutOnce(schemeId, "the schedule names scheme '" + schemeId ++ + "' which this binary does not implement"); ++ return List.of(); ++ } ++ final SealScheme.PrivateHandle key = localKeys.get(schemeId); ++ if (key == null) { ++ shoutOnce(schemeId, "this node holds NO " + schemeId ++ + " signing key, so it cannot produce the certificate the schedule requires from" ++ + " height " + blockNumber + " onwards"); ++ return List.of(); ++ } ++ final Optional signature = scheme.get().sign(key, message.toArray()); ++ if (signature.isEmpty()) { ++ shoutOnce(schemeId, "signing with the local " + schemeId + " key FAILED"); ++ return List.of(); ++ } ++ produced.add( ++ new SchemeSeal(scheme.get().wireId(), validatorIndex, Bytes.wrap(signature.get()))); ++ } ++ // Canonical order, so two honest nodes signing the same block emit identical bytes and the ++ // certificate cannot become a source of gratuitous divergence. ++ produced.sort(PqAnchorV2.CANONICAL); ++ return List.copyOf(produced); ++ } catch (final RuntimeException e) { ++ LOG.warn("AERE HIBRID: producer fault at block {}, emitting nothing: {}", ++ blockNumber, e.getMessage()); ++ return List.of(); ++ } ++ } ++ ++ private void shoutOnce(final String schemeId, final String what) { ++ if (alreadyShouted.add(schemeId)) { ++ LOG.error("AERE HIBRID: {} - NO hybrid certificate will be emitted by this node." ++ + " Fix this BEFORE the enforcement height, not on the day.", what); ++ } ++ } ++} +diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/HybridSealSupport.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/HybridSealSupport.java +new file mode 100755 +index 000000000..34f362d8d +--- /dev/null ++++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/HybridSealSupport.java +@@ -0,0 +1,295 @@ ++/* ++ * AERE HYBRID, the PRODUCTION loader (2026-08-25). The only place that reads a node's hybrid ++ * configuration and turns it into the two already-proven pieces: HybridSealProducer ++ * (emission) and the schedule+registry pair for PqCommitEnforcement (enforcement). ++ * ++ * THE PROPERTIES (all via BESU_OPTS, like every AERE switch; all absent = today's node, ++ * byte for byte): ++ * aere.pq.schemeSchedule / AERE_PQ_SCHEME_SCHEDULE the schedule "H:scheme+scheme,..." ++ * aere.pq.hybridRegistry / AERE_PQ_HYBRID_REGISTRY path of the hybrid-1 registry ++ * aere.pq.hybrid.attachBlock / AERE_PQ_HYBRID_ATTACHBLOCK height from which extras are EMITTED ++ * aere.pq.hybrid.key. / (no env; one path per scheme) the local private key {index, sk} ++ * ++ * EACH CONFIGURATION HALF REFUSES AT STARTUP, with a code and a name: ++ * CONF-03 schedule without registry or the reverse (inherited from enforcement; caught earlier here) ++ * CONF-04 attach armed without schedule+registry: you would emit what nobody can verify ++ * CONF-05 the local key does not bind: index outside the registry, scheme unknown to the ++ * schedule, index different from the local Falcon index, or the probe signature does ++ * not verify against the public key the registry holds (the loader's positive ++ * control: a key that fails its own probe must not boot a node that believes itself armed) ++ * ++ * A mistyped comma does NOT silently boot the node disarmed: the anchor loader's lesson. ++ */ ++package org.hyperledger.besu.consensus.common.bft; ++ ++import java.io.FileInputStream; ++import java.io.IOException; ++import java.io.InputStream; ++import java.nio.charset.StandardCharsets; ++import java.nio.file.Path; ++import java.util.HashMap; ++import java.util.Map; ++import java.util.Optional; ++import java.util.Properties; ++ ++import org.apache.tuweni.bytes.Bytes; ++import org.slf4j.Logger; ++import org.slf4j.LoggerFactory; ++ ++/** Loads a node's hybrid-seal configuration once and hands out the proven parts. */ ++public final class HybridSealSupport { ++ ++ private static final Logger LOG = LoggerFactory.getLogger(HybridSealSupport.class); ++ ++ /** System property naming the scheme schedule. */ ++ public static final String PROPERTY_SCHEDULE = "aere.pq.schemeSchedule"; ++ /** Environment fallback for {@link #PROPERTY_SCHEDULE}. */ ++ public static final String ENV_SCHEDULE = "AERE_PQ_SCHEME_SCHEDULE"; ++ /** System property naming the hybrid registry file path. */ ++ public static final String PROPERTY_REGISTRY = "aere.pq.hybridRegistry"; ++ /** Environment fallback for {@link #PROPERTY_REGISTRY}. */ ++ public static final String ENV_REGISTRY = "AERE_PQ_HYBRID_REGISTRY"; ++ /** System property naming the emission gate height. */ ++ public static final String PROPERTY_ATTACH_BLOCK = "aere.pq.hybrid.attachBlock"; ++ /** Environment fallback for {@link #PROPERTY_ATTACH_BLOCK}. */ ++ public static final String ENV_ATTACH_BLOCK = "AERE_PQ_HYBRID_ATTACHBLOCK"; ++ /** Prefix of the per-scheme local private key path property. */ ++ public static final String PROPERTY_KEY_PREFIX = "aere.pq.hybrid.key."; ++ ++ /** How this class reaches names and files; swappable so the loader itself is provable. */ ++ public interface ConfigReader { ++ /** Returns the raw system property. ++ * ++ * @param name the system property name ++ * @return the value, or null when absent */ ++ String property(String name); ++ /** Returns the raw environment variable. ++ * ++ * @param name the environment variable name ++ * @return the value, or null when absent */ ++ String environment(String name); ++ /** Returns the file's bytes. ++ * ++ * @param path the file path ++ * @return the bytes ++ * @throws IOException when unreadable */ ++ byte[] file(String path) throws IOException; ++ } ++ ++ private static final ConfigReader REAL = ++ new ConfigReader() { ++ @Override ++ public String property(final String name) { ++ return System.getProperty(name); ++ } ++ ++ @Override ++ public String environment(final String name) { ++ return System.getenv(name); ++ } ++ ++ @Override ++ public byte[] file(final String path) throws IOException { ++ try (InputStream in = new FileInputStream(path)) { ++ return in.readAllBytes(); ++ } ++ } ++ }; ++ ++ private static volatile HybridSealSupport instance; ++ ++ private final PqSchemeSchedule schedule; // null = not configured ++ private final HybridSignerRegistry registry; // paired with the schedule, never alone ++ private final HybridSealProducer producer; // never null; disarmed when there is nothing ++ ++ private HybridSealSupport( ++ final PqSchemeSchedule schedule, ++ final HybridSignerRegistry registry, ++ final HybridSealProducer producer) { ++ this.schedule = schedule; ++ this.registry = registry; ++ this.producer = producer; ++ } ++ ++ /** The process-wide instance, loaded from real configuration on first use. */ ++ public static HybridSealSupport instance() { ++ HybridSealSupport s = instance; ++ if (s == null) { ++ synchronized (HybridSealSupport.class) { ++ s = instance; ++ if (s == null) { ++ s = load(REAL); ++ instance = s; ++ } ++ } ++ } ++ return s; ++ } ++ ++ /** Drops the cached instance, for tests only. */ ++ public static void resetForTesting() { ++ instance = null; ++ } ++ ++ /** ++ * Load from a reader. Public so the loader's refusals are provable without global state. ++ * ++ * @param reader the configuration source ++ * @return the loaded support; fully disarmed when nothing is configured ++ */ ++ public static HybridSealSupport load(final ConfigReader reader) { ++ final String rawSchedule = firstOf(reader, PROPERTY_SCHEDULE, ENV_SCHEDULE); ++ final String rawRegistry = firstOf(reader, PROPERTY_REGISTRY, ENV_REGISTRY); ++ final String rawAttach = firstOf(reader, PROPERTY_ATTACH_BLOCK, ENV_ATTACH_BLOCK); ++ ++ if ((rawSchedule == null) != (rawRegistry == null)) { ++ throw new IllegalStateException( ++ "AERE-PQC-COMMIT-CONF-03: " + PROPERTY_SCHEDULE + " and " + PROPERTY_REGISTRY ++ + " are a PAIR; configure both or neither. Half a hybrid configuration must" ++ + " refuse at startup, never run half-armed in silence."); ++ } ++ if (rawSchedule == null) { ++ if (rawAttach != null) { ++ throw new IllegalStateException( ++ "AERE-PQC-HYBRID-CONF-04: " + PROPERTY_ATTACH_BLOCK + " is set but the schedule and" ++ + " registry are not: this node would EMIT seals nobody can verify."); ++ } ++ return new HybridSealSupport(null, null, HybridSealProducer.disarmed()); ++ } ++ ++ final PqSchemeSchedule schedule; ++ try { ++ schedule = PqSchemeSchedule.parse(rawSchedule); ++ } catch (final RuntimeException e) { ++ throw new IllegalStateException( ++ "AERE-PQC-HYBRID-CONF-04: unparseable " + PROPERTY_SCHEDULE + ": " + e.getMessage()); ++ } ++ final HybridSignerRegistry registry; ++ try { ++ final Properties p = new Properties(); ++ p.load( ++ new java.io.StringReader( ++ new String(reader.file(rawRegistry), StandardCharsets.UTF_8))); ++ registry = HybridSignerRegistry.fromProperties(p, rawRegistry); ++ } catch (final IOException e) { ++ throw new IllegalStateException( ++ "AERE-PQC-HYBRID-CONF-04: cannot read " + PROPERTY_REGISTRY + " '" + rawRegistry ++ + "': " + e.getMessage()); ++ } ++ ++ long attachFrom = HybridSealProducer.NEVER; ++ if (rawAttach != null) { ++ try { ++ attachFrom = Long.parseLong(rawAttach.trim()); ++ if (attachFrom < 0) { ++ throw new NumberFormatException("negative"); ++ } ++ } catch (final NumberFormatException e) { ++ throw new IllegalStateException( ++ "AERE-PQC-HYBRID-CONF-04: " + PROPERTY_ATTACH_BLOCK ++ + " is set but not a non-negative height: '" + rawAttach + "'"); ++ } ++ } ++ ++ // Local private keys, one file per non-Falcon scheme the schedule ever names. ++ final Map keys = new HashMap<>(); ++ Integer boundIndex = null; ++ for (final SealScheme scheme : SealSchemes.all()) { ++ if (scheme.id().equals(SealSchemes.FALCON_512.id())) { ++ continue; // Falcon-ul are incarcatorul lui, neatins ++ } ++ final String keyPath = reader.property(PROPERTY_KEY_PREFIX + scheme.id()); ++ if (keyPath == null) { ++ continue; ++ } ++ final int index; ++ final SealScheme.PrivateHandle handle; ++ try { ++ final Properties kp = new Properties(); ++ kp.load( ++ new java.io.StringReader( ++ new String(reader.file(keyPath), StandardCharsets.UTF_8))); ++ index = Integer.parseInt(kp.getProperty("index", "").trim()); ++ final byte[] sk = ++ Bytes.fromHexStringLenient(kp.getProperty("sk", "").trim()).toArray(); ++ handle = ++ scheme ++ .parsePrivateKey(sk) ++ .orElseThrow( ++ () -> new IllegalStateException("bytes do not parse as a private key")); ++ } catch (final IOException | RuntimeException e) { ++ throw new IllegalStateException( ++ "AERE-PQC-HYBRID-CONF-05: cannot load the local " + scheme.id() + " key from '" ++ + keyPath + "': " + e.getMessage()); ++ } ++ // THE LOADER'S POSITIVE CONTROL: the private key must pass its own probe against the ++ // PUBLIC key the registry holds for this index. A key that fails it must not boot a ++ // node that believes itself armed. ++ final Optional pub = registry.publicKey(index, scheme.id()); ++ if (pub.isEmpty()) { ++ throw new IllegalStateException( ++ "AERE-PQC-HYBRID-CONF-05: the registry holds no " + scheme.id() + " key for index " ++ + index + " (from '" + keyPath + "')"); ++ } ++ final byte[] probe = ("AERE-HYBRID-KEY-PROBE:" + index).getBytes(StandardCharsets.UTF_8); ++ final Optional sig = scheme.sign(handle, probe); ++ if (sig.isEmpty() || !scheme.verifyRaw(pub.get(), probe, sig.get())) { ++ throw new IllegalStateException( ++ "AERE-PQC-HYBRID-CONF-05: the local " + scheme.id() + " key at index " + index ++ + " does NOT verify against the registry's public key. Wrong key, wrong index," ++ + " or wrong registry; refusing to start half-armed."); ++ } ++ if (boundIndex != null && boundIndex != index) { ++ throw new IllegalStateException( ++ "AERE-PQC-HYBRID-CONF-05: local hybrid keys disagree on the validator index (" ++ + boundIndex + " vs " + index + "). One node, one identity."); ++ } ++ boundIndex = index; ++ keys.put(scheme.id(), handle); ++ LOG.info( ++ "AERE HIBRID: loaded local {} signing key for validator index {} (probe verified" ++ + " against the registry)", ++ scheme.id(), ++ index); ++ } ++ ++ if (attachFrom != HybridSealProducer.NEVER && keys.isEmpty()) { ++ throw new IllegalStateException( ++ "AERE-PQC-HYBRID-CONF-04: emission is armed from " + attachFrom + " but this node" ++ + " holds no local hybrid key (" + PROPERTY_KEY_PREFIX + " unset)." ++ + " It would promise a certificate it cannot produce."); ++ } ++ ++ final HybridSealProducer producer = ++ keys.isEmpty() ++ ? HybridSealProducer.disarmed() ++ : new HybridSealProducer(attachFrom, schedule, boundIndex, keys); ++ return new HybridSealSupport(schedule, registry, producer); ++ } ++ ++ private static String firstOf(final ConfigReader r, final String prop, final String env) { ++ final String p = r.property(prop); ++ return p != null ? p : r.environment(env); ++ } ++ ++ /** Returns the schedule, when the hybrid pair is configured. ++ * ++ * @return the schedule, or empty */ ++ public Optional schedule() { ++ return Optional.ofNullable(schedule); ++ } ++ ++ /** Returns the registry, when the hybrid pair is configured. ++ * ++ * @return the registry, or empty */ ++ public Optional registry() { ++ return Optional.ofNullable(registry); ++ } ++ ++ /** Returns the producer; disarmed (never emits) when nothing is configured. ++ * ++ * @return the producer */ ++ public HybridSealProducer producer() { ++ return producer; ++ } ++} +diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/HybridSignerRegistry.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/HybridSignerRegistry.java +new file mode 100755 +index 000000000..49563b7b1 +--- /dev/null ++++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/HybridSignerRegistry.java +@@ -0,0 +1,307 @@ ++/* ++ * AERE crypto-agility, step 3: the hybrid signer registry. ++ * ++ * WHY. The live registry format holds ONE Falcon key per validator index (896-byte h, plus the ++ * 20-byte address). The founder-approved hybrid (2026-08-07, option 3) needs a registry that can ++ * hold a key PER SCHEME per validator, so a certificate can carry Falcon and SLH-DSA seals from ++ * the same validator and each can be checked against its own key. ++ * ++ * FORMAT (properties): ++ * formatVersion=hybrid-1 ++ * chainId= ++ * count= ++ * .addr=<20-byte hex> mandatory for every index 0..count-1 ++ * .key.= at least one per index; schemeId from SealSchemes ++ * ++ * STRICTNESS, learned the expensive way (blocante_armare 2026-08-06: "a mistyped comma boots ++ * the node DISARMED"): every deviation REFUSES the whole registry loudly - unknown scheme suffix, ++ * wrong key length for its scheme, a hole in the index sequence, a count that disagrees, a ++ * missing address, duplicate keys. A registry that loads "partially" is a node that validates ++ * differently from its peers without knowing it. ++ * ++ * NO REAL KEYS. This class never generates anything. Real hybrid validator keys require the ++ * founder-approved ceremony; tests feed it throwaway pairs from SealScheme.generate. ++ */ ++package org.hyperledger.besu.consensus.common.bft; ++ ++import java.io.IOException; ++import java.io.InputStream; ++import java.nio.charset.StandardCharsets; ++import java.nio.file.Files; ++import java.nio.file.Path; ++import java.util.ArrayList; ++import java.util.HashMap; ++import java.util.List; ++import java.util.Map; ++import java.util.Optional; ++import java.util.NavigableMap; ++import java.util.Properties; ++import java.util.TreeMap; ++ ++import org.apache.tuweni.bytes.Bytes; ++import org.apache.tuweni.bytes.Bytes32; ++import org.hyperledger.besu.crypto.Hash; ++ ++/** The scheme-aware validator key registry for the hybrid certificate. Immutable once loaded. */ ++public final class HybridSignerRegistry { ++ ++ /** The exact format marker this loader accepts. */ ++ public static final String FORMAT_VERSION = "hybrid-1"; ++ ++ /** Canonical-hash domain. Distinct from AERE-PQ-REGISTRY-1/-2 (the Falcon-only registry hash ++ * family in PqRegistryHash), so a hybrid registry hash can never be mistaken for a v1/v2 one. */ ++ public static final String HASH_DOMAIN = "AERE-PQ-HYBRID-REGISTRY-1"; ++ ++ private final long chainId; ++ // index -> (schemeId -> key bytes); TreeMap so iteration is canonical by index ++ private final NavigableMap> keys; ++ private final Map addresses; ++ ++ private HybridSignerRegistry( ++ final long chainId, ++ final NavigableMap> keys, ++ final Map addresses) { ++ this.chainId = chainId; ++ this.keys = keys; ++ this.addresses = addresses; ++ } ++ ++ /** Load from a properties file on disk. Refuses loudly, never partially. */ ++ public static HybridSignerRegistry load(final Path file) throws IOException { ++ final Properties p = new Properties(); ++ try (InputStream in = Files.newInputStream(file)) { ++ p.load(in); ++ } ++ return fromProperties(p, file.toString()); ++ } ++ ++ /** Load from already-parsed properties. {@code source} names the origin for error messages. */ ++ public static HybridSignerRegistry fromProperties(final Properties p, final String source) { ++ final String format = p.getProperty("formatVersion"); ++ if (!FORMAT_VERSION.equals(format)) { ++ throw new IllegalArgumentException( ++ "AERE PQ HIBRID: " + source + " declares formatVersion=" + format ++ + ", this loader accepts only " + FORMAT_VERSION); ++ } ++ final long chainId = parseLong(p.getProperty("chainId"), "chainId", source); ++ final int count = (int) parseLong(p.getProperty("count"), "count", source); ++ if (count <= 0 || count > 1024) { ++ throw new IllegalArgumentException( ++ "AERE PQ HIBRID: " + source + " has count=" + count + ", outside (0, 1024]"); ++ } ++ ++ final NavigableMap> keys = new TreeMap<>(); ++ final Map addresses = new HashMap<>(); ++ ++ for (final String name : p.stringPropertyNames()) { ++ if (name.equals("formatVersion") || name.equals("chainId") || name.equals("count")) { ++ continue; ++ } ++ final int dot = name.indexOf('.'); ++ if (dot <= 0) { ++ throw new IllegalArgumentException( ++ "AERE PQ HIBRID: " + source + " carries unrecognised entry '" + name + "'"); ++ } ++ final int index = parseIndex(name.substring(0, dot), name, source); ++ final String rest = name.substring(dot + 1); ++ final byte[] value = decodeHex(p.getProperty(name), name, source); ++ ++ if (rest.equals("addr")) { ++ if (value.length != 20) { ++ throw new IllegalArgumentException( ++ "AERE PQ HIBRID: " + source + " entry '" + name + "' is " + value.length ++ + " bytes, an address must be exactly 20"); ++ } ++ if (addresses.put(index, value) != null) { ++ throw new IllegalArgumentException( ++ "AERE PQ HIBRID: " + source + " repeats address for index " + index); ++ } ++ } else if (rest.startsWith("key.")) { ++ final String schemeId = rest.substring("key.".length()); ++ final SealScheme scheme = ++ SealSchemes.byId(schemeId) ++ .orElseThrow( ++ () -> ++ new IllegalArgumentException( ++ "AERE PQ HIBRID: " + source + " entry '" + name ++ + "' names UNKNOWN scheme '" + schemeId ++ + "' - refusing the whole registry, an unknown scheme must be loud")); ++ if (value.length != scheme.publicKeyLength()) { ++ throw new IllegalArgumentException( ++ "AERE PQ HIBRID: " + source + " entry '" + name + "' is " + value.length ++ + " bytes, scheme " + schemeId + " keys are exactly " ++ + scheme.publicKeyLength()); ++ } ++ if (scheme.parsePublicKey(value).isEmpty()) { ++ throw new IllegalArgumentException( ++ "AERE PQ HIBRID: " + source + " entry '" + name ++ + "' does not parse as a " + schemeId + " public key"); ++ } ++ final Map perScheme = keys.computeIfAbsent(index, i -> new TreeMap<>()); ++ if (perScheme.put(schemeId, value) != null) { ++ throw new IllegalArgumentException( ++ "AERE PQ HIBRID: " + source + " repeats key for index " + index ++ + " scheme " + schemeId); ++ } ++ } else { ++ throw new IllegalArgumentException( ++ "AERE PQ HIBRID: " + source + " carries unrecognised entry '" + name + "'"); ++ } ++ } ++ ++ // completeness: every index 0..count-1 present, with an address and at least one key ++ for (int i = 0; i < count; i++) { ++ if (!addresses.containsKey(i)) { ++ throw new IllegalArgumentException( ++ "AERE PQ HIBRID: " + source + " is missing " + i + ".addr (count says " + count + ")"); ++ } ++ if (!keys.containsKey(i) || keys.get(i).isEmpty()) { ++ throw new IllegalArgumentException( ++ "AERE PQ HIBRID: " + source + " has no key at all for index " + i); ++ } ++ } ++ if (addresses.size() != count || keys.size() != count) { ++ throw new IllegalArgumentException( ++ "AERE PQ HIBRID: " + source + " carries entries beyond count=" + count ++ + " (addresses " + addresses.size() + ", key rows " + keys.size() + ")"); ++ } ++ ++ return new HybridSignerRegistry(chainId, keys, addresses); ++ } ++ ++ /** The chain this registry binds to. */ ++ public long chainId() { ++ return chainId; ++ } ++ ++ /** How many validator indices the registry holds. */ ++ public int size() { ++ return keys.size(); ++ } ++ ++ /** The key of {@code index} under {@code schemeId}, if that validator has one. */ ++ public Optional publicKey(final int index, final String schemeId) { ++ final Map perScheme = keys.get(index); ++ if (perScheme == null) { ++ return Optional.empty(); ++ } ++ final byte[] exact = perScheme.get(schemeId); ++ if (exact != null) { ++ return Optional.of(exact.clone()); ++ } ++ // D-325 (2026-09-03): a registry written with an ALIAS of a scheme id ("slh-dsa-128s") answers a ++ // lookup by the canonical id ("slh-dsa-sha2-128s") and the other way round. Stored names are ++ // kept as written so the registry's canonical hash does not move under a file that did not. ++ final String wanted = canonicalId(schemeId); ++ for (final Map.Entry e : perScheme.entrySet()) { ++ if (canonicalId(e.getKey()).equals(wanted)) { ++ return Optional.of(e.getValue().clone()); ++ } ++ } ++ return Optional.empty(); ++ } ++ ++ private static String canonicalId(final String schemeId) { ++ return SealSchemes.byId(schemeId).map(SealScheme::id).orElse(schemeId); ++ } ++ ++ /** The 20-byte address bound to {@code index}, or empty. */ ++ public Optional address(final int index) { ++ return Optional.ofNullable(addresses.get(index)).map(byte[]::clone); ++ } ++ ++ /** How many indices hold a key under {@code schemeId}. The arming gate for a scheme asks this: ++ * arming a K-of-N threshold under a scheme with coverage below K would be a chain stop. */ ++ public int coverage(final String schemeId) { ++ final String wanted = canonicalId(schemeId); ++ return (int) ++ keys.values().stream() ++ .filter(m -> m.keySet().stream().anyMatch(k -> canonicalId(k).equals(wanted))) ++ .count(); ++ } ++ ++ /** The canonical hash: domain || chainId || count || per index asc: index, addr, schemeCount, ++ * then per scheme in id order: idLen, idBytes, keyLen, key. Length-prefixed throughout, keccak ++ * over the whole, same discipline as PqRegistryHash. */ ++ public Bytes32 canonicalHash() { ++ final java.io.ByteArrayOutputStream out = new java.io.ByteArrayOutputStream(); ++ writeAll(out, HASH_DOMAIN.getBytes(StandardCharsets.US_ASCII)); ++ writeAll(out, uint64be(chainId)); ++ writeAll(out, uint32be(keys.size())); ++ for (final Map.Entry> row : keys.entrySet()) { ++ writeAll(out, uint32be(row.getKey())); ++ writeAll(out, addresses.get(row.getKey())); ++ writeAll(out, uint32be(row.getValue().size())); ++ for (final Map.Entry k : row.getValue().entrySet()) { ++ final byte[] id = k.getKey().getBytes(StandardCharsets.US_ASCII); ++ writeAll(out, uint32be(id.length)); ++ writeAll(out, id); ++ writeAll(out, uint32be(k.getValue().length)); ++ writeAll(out, k.getValue()); ++ } ++ } ++ return Hash.keccak256(Bytes.wrap(out.toByteArray())); ++ } ++ ++ /** The schemes present for {@code index}, in canonical id order. */ ++ public List schemesOf(final int index) { ++ final Map perScheme = keys.get(index); ++ return perScheme == null ? List.of() : new ArrayList<>(perScheme.keySet()); ++ } ++ ++ // ------------------------------------------------------------------------------- helpers ++ ++ private static long parseLong(final String raw, final String field, final String source) { ++ if (raw == null || raw.isBlank()) { ++ throw new IllegalArgumentException("AERE PQ HIBRID: " + source + " is missing " + field); ++ } ++ try { ++ return Long.parseLong(raw.trim()); ++ } catch (final NumberFormatException e) { ++ throw new IllegalArgumentException( ++ "AERE PQ HIBRID: " + source + " field " + field + " is not a number: '" + raw + "'"); ++ } ++ } ++ ++ private static int parseIndex(final String raw, final String entry, final String source) { ++ try { ++ final int i = Integer.parseInt(raw); ++ if (i < 0) { ++ throw new NumberFormatException("negative"); ++ } ++ return i; ++ } catch (final NumberFormatException e) { ++ throw new IllegalArgumentException( ++ "AERE PQ HIBRID: " + source + " entry '" + entry + "' has a bad index '" + raw + "'"); ++ } ++ } ++ ++ private static byte[] decodeHex(final String raw, final String entry, final String source) { ++ if (raw == null || raw.isBlank()) { ++ throw new IllegalArgumentException( ++ "AERE PQ HIBRID: " + source + " entry '" + entry + "' is empty"); ++ } ++ try { ++ return Bytes.fromHexStringLenient(raw.trim()).toArray(); ++ } catch (final RuntimeException e) { ++ throw new IllegalArgumentException( ++ "AERE PQ HIBRID: " + source + " entry '" + entry + "' is not hex: " + e.getMessage()); ++ } ++ } ++ ++ private static void writeAll(final java.io.ByteArrayOutputStream out, final byte[] b) { ++ out.write(b, 0, b.length); ++ } ++ ++ private static byte[] uint32be(final long v) { ++ return new byte[] {(byte) (v >>> 24), (byte) (v >>> 16), (byte) (v >>> 8), (byte) v}; ++ } ++ ++ private static byte[] uint64be(final long v) { ++ final byte[] b = new byte[8]; ++ for (int i = 0; i < 8; i++) { ++ b[i] = (byte) (v >>> (8 * (7 - i))); ++ } ++ return b; + } +} diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqAnchor.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqAnchor.java new file mode 100755 -index 000000000..59c2d8683 +index 000000000..32c634ee8 --- /dev/null +++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqAnchor.java -@@ -0,0 +1,339 @@ +@@ -0,0 +1,547 @@ +/* -+ * Copyright contributors to Besu / Aere Network. ++ * Copyright contributors to Besu / AERE Network. + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at @@ -5157,6 +7340,51 @@ index 000000000..59c2d8683 + public static final Bytes COMMIT_DOMAIN_BYTES = + Bytes.wrap(COMMIT_DOMAIN.getBytes(StandardCharsets.US_ASCII)); + ++ /** ++ * The PREPARE domain label. AERE PQ (2026-08-28). ++ * ++ *

    SEPARATE FROM COMMIT, and the separation is a security requirement, not a matter of style. ++ * If a PREPARE seal signed the same bytes as a commit seal, an adversary could take a PREPARE ++ * seal given HONESTLY by a validator and paste it onto a forged COMMIT: the signature would ++ * verify, and the very rule meant to defend the commit would be bypassed. One changed string in ++ * the preimage makes the two signatures non-transferable. ++ */ ++ public static final String PREPARE_DOMAIN = "AERE-PQ-PREPARE-1"; ++ ++ /** The prepare domain label as raw bytes. */ ++ public static final Bytes PREPARE_DOMAIN_BYTES = ++ Bytes.wrap(PREPARE_DOMAIN.getBytes(StandardCharsets.US_ASCII)); ++ ++ /** ++ * The PROPOSAL domain label. AERE PQ (2026-08-30), the next hot-path step after PREPARE. ++ * ++ *

    SEPARATE FROM BOTH PREPARE AND COMMIT, for the same non-transferability reason: a seal a ++ * proposer gives HONESTLY over its own proposal must not be usable as a vote. A proposal is an ++ * OFFER, not a vote - the design note of 2026-08-28 measures that "prepared" needs a full quorum ++ * of PREPAREs, proposer included - so its seal must never count as one. One changed string in the ++ * preimage is what enforces that at the cryptographic layer instead of by convention. ++ */ ++ public static final String PROPOSAL_DOMAIN = "AERE-PQ-PROPOSAL-1"; ++ ++ /** The proposal domain label as raw bytes. */ ++ public static final Bytes PROPOSAL_DOMAIN_BYTES = ++ Bytes.wrap(PROPOSAL_DOMAIN.getBytes(StandardCharsets.US_ASCII)); ++ ++ /** ++ * The ROUND-CHANGE domain label. AERE PQ (2026-08-31), the last hot-path message. ++ * ++ *

    SEPARATE FROM ALL THREE OTHERS, for the same non-transferability reason. A ROUND-CHANGE is ++ * the message that STEERS rounds: a quorum of them opens a new round, and one that claims a ++ * prepared block decides WHICH block gets re-proposed. A seal given honestly over a vote or a ++ * proposal must not be pasteable onto a round-change, and a round-change seal must not count as ++ * either. One changed string in the preimage enforces that cryptographically. ++ */ ++ public static final String ROUNDCHANGE_DOMAIN = "AERE-PQ-ROUNDCHANGE-1"; ++ ++ /** The round-change domain label as raw bytes. */ ++ public static final Bytes ROUNDCHANGE_DOMAIN_BYTES = ++ Bytes.wrap(ROUNDCHANGE_DOMAIN.getBytes(StandardCharsets.US_ASCII)); ++ + /** Orders Falcon seals by their registry index, ascending. */ + public static final Comparator BY_INDEX = + Comparator.comparingInt(FalconSeal::getValidatorIndex); @@ -5276,6 +7504,169 @@ index 000000000..59c2d8683 + } + + /** ++ * The message a PREPARE seal signs: M = keccak256(RLP[PREPARE_DOMAIN, chainId, blockNumber, ++ * round, digest]). ++ * ++ *

    RUNDA E IN PREIMAGINE, spre deosebire de commit, si asta e al doilea lucru care nu se sare: ++ * doua PREPARE-uri ale aceluiasi bloc in runde diferite sunt doua afirmatii diferite, iar un ++ * a seal given in one round must not be movable into another. Without the round, a seal from a ++ * PREPARE of a failed round could be reused to justify another one. ++ * ++ * @param chainId the chain id ++ * @param blockNumber the height being prepared ++ * @param round the round number of the prepare ++ * @param digest the block digest the prepare speaks about ++ * @return the 32-byte message to sign ++ */ ++ public static Bytes32 prepareMessage( ++ final long chainId, final long blockNumber, final int round, final Bytes digest) { ++ if (blockNumber < 0) { ++ throw new IllegalArgumentException( ++ "AERE PQ PREPARE: blockNumber must not be negative (got " + blockNumber + ")"); ++ } ++ if (round < 0) { ++ throw new IllegalArgumentException( ++ "AERE PQ PREPARE: round must not be negative (got " + round + ")"); ++ } ++ if (digest == null || digest.size() != 32) { ++ throw new IllegalArgumentException( ++ "AERE PQ PREPARE: digest must be 32 bytes (got " ++ + (digest == null ? "null" : digest.size() + " bytes") ++ + ")"); ++ } ++ final BytesValueRLPOutput out = new BytesValueRLPOutput(); ++ out.startList(); ++ out.writeBytes(PREPARE_DOMAIN_BYTES); ++ out.writeLongScalar(chainId); ++ out.writeLongScalar(blockNumber); ++ out.writeLongScalar(round); ++ out.writeBytes(digest); ++ out.endList(); ++ return Hash.keccak256(out.encoded()); ++ } ++ ++ /** ++ * The 32-byte message a proposer's post-quantum PROPOSAL seal signs. ++ * ++ *

    Same shape as {@link #prepareMessage}, different domain, and the ROUND is in the preimage ++ * for the same reason: a proposal for the same block in a different round is a different ++ * assertion, and a seal from a failed round must not open another one. ++ * ++ * @param chainId the chain id ++ * @param blockNumber the height being proposed ++ * @param round the round number of the proposal ++ * @param digest the digest of the proposed block ++ * @return the 32-byte message to sign ++ */ ++ public static Bytes32 proposalMessage( ++ final long chainId, final long blockNumber, final int round, final Bytes digest) { ++ if (blockNumber < 0) { ++ throw new IllegalArgumentException( ++ "AERE PQ PROPOSAL: blockNumber must not be negative (got " + blockNumber + ")"); ++ } ++ if (round < 0) { ++ throw new IllegalArgumentException( ++ "AERE PQ PROPOSAL: round must not be negative (got " + round + ")"); ++ } ++ if (digest == null || digest.size() != 32) { ++ throw new IllegalArgumentException( ++ "AERE PQ PROPOSAL: digest must be 32 bytes (got " ++ + (digest == null ? "null" : digest.size() + " bytes") ++ + ")"); ++ } ++ final BytesValueRLPOutput out = new BytesValueRLPOutput(); ++ out.startList(); ++ out.writeBytes(PROPOSAL_DOMAIN_BYTES); ++ out.writeLongScalar(chainId); ++ out.writeLongScalar(blockNumber); ++ out.writeLongScalar(round); ++ out.writeBytes(digest); ++ out.endList(); ++ return Hash.keccak256(out.encoded()); ++ } ++ ++ /** ++ * The 32-byte message a validator's post-quantum ROUND-CHANGE seal signs, for a round-change ++ * that carries NO prepared-round metadata. ++ * ++ *

    The preimage writes an explicit presence flag of 0 and empty placeholders, so a bare ++ * round-change and one prepared at round 0 can never collide: the flag, not the emptiness of a ++ * field, is what says whether metadata exists. ++ * ++ * @param chainId the chain id ++ * @param blockNumber the height the round-change targets (its sequence number) ++ * @param targetRound the round the sender wants to move to ++ * @return the 32-byte message to sign ++ */ ++ public static Bytes32 roundChangeMessage( ++ final long chainId, final long blockNumber, final int targetRound) { ++ return roundChangePreimage(chainId, blockNumber, targetRound, false, 0, Bytes.EMPTY); ++ } ++ ++ /** ++ * The 32-byte message a validator's post-quantum ROUND-CHANGE seal signs, for a round-change ++ * that CLAIMS a prepared block. ++ * ++ *

    The prepared metadata is IN the preimage on purpose: a round-change that claims a prepared ++ * block decides which block gets re-proposed, so a seal from a bare round-change pasted onto one ++ * with metadata (or onto one with different metadata) must not verify. Same shape as {@link ++ * #proposalMessage}, its own domain. ++ * ++ * @param chainId the chain id ++ * @param blockNumber the height the round-change targets (its sequence number) ++ * @param targetRound the round the sender wants to move to ++ * @param preparedRound the round the claimed prepared block was prepared in ++ * @param preparedDigest the 32-byte digest of the claimed prepared block ++ * @return the 32-byte message to sign ++ */ ++ public static Bytes32 roundChangeMessage( ++ final long chainId, ++ final long blockNumber, ++ final int targetRound, ++ final int preparedRound, ++ final Bytes preparedDigest) { ++ if (preparedRound < 0) { ++ throw new IllegalArgumentException( ++ "AERE PQ ROUNDCHANGE: preparedRound must not be negative (got " + preparedRound + ")"); ++ } ++ if (preparedDigest == null || preparedDigest.size() != 32) { ++ throw new IllegalArgumentException( ++ "AERE PQ ROUNDCHANGE: preparedDigest must be 32 bytes (got " ++ + (preparedDigest == null ? "null" : preparedDigest.size() + " bytes") ++ + ")"); ++ } ++ return roundChangePreimage(chainId, blockNumber, targetRound, true, preparedRound, preparedDigest); ++ } ++ ++ private static Bytes32 roundChangePreimage( ++ final long chainId, ++ final long blockNumber, ++ final int targetRound, ++ final boolean hasPrepared, ++ final int preparedRound, ++ final Bytes preparedDigest) { ++ if (blockNumber < 0) { ++ throw new IllegalArgumentException( ++ "AERE PQ ROUNDCHANGE: blockNumber must not be negative (got " + blockNumber + ")"); ++ } ++ if (targetRound < 0) { ++ throw new IllegalArgumentException( ++ "AERE PQ ROUNDCHANGE: targetRound must not be negative (got " + targetRound + ")"); ++ } ++ final BytesValueRLPOutput out = new BytesValueRLPOutput(); ++ out.startList(); ++ out.writeBytes(ROUNDCHANGE_DOMAIN_BYTES); ++ out.writeLongScalar(chainId); ++ out.writeLongScalar(blockNumber); ++ out.writeLongScalar(targetRound); ++ out.writeLongScalar(hasPrepared ? 1 : 0); ++ out.writeLongScalar(preparedRound); ++ out.writeBytes(preparedDigest); ++ out.endList(); ++ return Hash.keccak256(out.encoded()); ++ } ++ ++ /** + * Whether the certificate's validator indices are STRICTLY increasing. + * + *

    Strictly increasing does three jobs at once and all three are structural rather than @@ -5398,12 +7789,12 @@ index 000000000..59c2d8683 +} diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqAnchorConfig.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqAnchorConfig.java new file mode 100755 -index 000000000..ce9f081b5 +index 000000000..d04d52829 --- /dev/null +++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqAnchorConfig.java -@@ -0,0 +1,1320 @@ +@@ -0,0 +1,1580 @@ +/* -+ * Copyright contributors to Besu / Aere Network. ++ * Copyright contributors to Besu / AERE Network. + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at @@ -5507,19 +7898,18 @@ index 000000000..ce9f081b5 + * here happens before the node has joined the quorum, is visible in {@code systemctl status} in + * second zero, and is repaired with one line and one restart, at a pace the operator controls. The + * risk that IS real is a bad shared template plus a parallel fleet restart: at quorum 5 of 7 that is -+ * not degradation, it is a dead chain. The net for it is the operating rule that goes with this -+ * configuration - restart one at a time, never in parallel - and a preflight that computes its -+ * verdict from THIS code path rather than from a second reading of the same strings. ++ * not degradation, it is a dead chain. The net for it is the one already written in the runbook - ++ * restart one at a time, never in parallel - and a preflight that computes its verdict from THIS ++ * code path rather than from a second reading of the same strings. + * -+ *

    HONEST LIMITATION, stated in code because it is the same defect class as an unbound -+ * registry. The values here are read from LOCAL system properties or environment variables, -+ * exactly like {@code aere.falcon.registry} is today. They are NOT yet read from the genesis {@code -+ * config.qbft} / {@code config.transitions.qbft}, and there is NO consensus binding on them: two -+ * nodes configured with different H or different K schedules will disagree about which headers are -+ * valid. Wiring these to genesis, and refusing to start when the Falcon registry does not match the -+ * genesis {@code pqRegistryHash}, is a PRECONDITION of arming and is tracked as the fork-activation -+ * and registry work items. Until that lands, a non-default value here is a laboratory setting, not -+ * a deployment. ++ *

    HONEST LIMITATION, stated in code because it is the same defect class as A8. The values ++ * here are read from LOCAL system properties or environment variables, exactly like {@code ++ * aere.falcon.registry} is today. They are NOT yet read from the genesis {@code config.qbft} / ++ * {@code config.transitions.qbft}, and there is NO consensus binding on them: two nodes configured ++ * with different H or different K schedules will disagree about which headers are valid. Wiring ++ * these to genesis, and refusing to start when the Falcon registry does not match the genesis {@code ++ * pqRegistryHash}, is a PRECONDITION of arming and is tracked as the fork-activation and registry ++ * work items. Until that lands, a non-default value here is a laboratory setting, not a deployment. + */ +public final class PqAnchorConfig { + @@ -5559,10 +7949,9 @@ index 000000000..ce9f081b5 + *

    MEASURED 2026-08-07, and this is why the property exists. A Falcon-512 seal is 666 bytes. The + * seal counts observed on a live seven-node run with the threshold at 4 were: 42 blocks with 4, 36 + * with 5, 5 with 6. The rehearsal's median header of 3838 bytes is {@code (3838-525)/666 = 4.97} -+ * seals. Header bytes therefore scale with the seals actually attached: five seals is about 1.7 -+ * times what the same chain writes capped at K=3, and about seven times a seal-less header. The -+ * figure used before that day had been computed for a SINGLE seal, so it understated the cost by -+ * about 4.4x. ++ * seals. Per node per year, at ~165248 blocks/day: one seal 40.2 GB, three 120.5 GB, five 200.9 ++ * GB, seven 281.2 GB. The figure carried in our own documents until that day, 45.2 GB/year, is ++ * 1.13 seals: it had been computed for a single seal and was wrong by 4.4x. + * + *

    Setting this to K therefore removes ~40% of the anchor's disk cost and takes nothing from the + * quorum margin, because the margin is decided by the THRESHOLD a verifier requires, not by how @@ -5594,11 +7983,10 @@ index 000000000..ce9f081b5 + * + * and it is a knob, not an accident. + * -+ *

    MEASURED 2026-08-07, at K=3 capped, 666 bytes a seal: the certificate cost falls in exact -+ * proportion to the interval, so every 10th block costs a tenth of the every-block figure, every -+ * 100th a hundredth, every 256th about a 250th. Against a ~523 ms block, an interval of 100 buys -+ * that hundredfold saving for a rewritable tail that grows from about half a second to about -+ * fifty-two seconds. Algorand ships the same shape at 1 in 256. ++ *

    MEASURED 2026-08-07, at K=3 capped, ~165248 blocks/day, 666 bytes a seal, per node per year: ++ * every block 120.5 GB; every 10th 12.1 GB; every 100th 1.2 GB; every 256th 0.5 GB. Against a ++ * ~523 ms block, an interval of 100 buys a hundredfold saving for a rewritable tail that grows ++ * from about half a second to about fifty-two seconds. Algorand ships the same shape at 1 in 256. + * + *

    UNSET MEANS EVERY BLOCK, which is today's design and the strongest setting. As with the seal + * cap, a weakening never arrives as a default; it has to be asked for. @@ -5612,6 +8000,30 @@ index 000000000..ce9f081b5 + /** Environment variable twin of {@link #PROPERTY_ANCHOR_INTERVAL}. */ + public static final String ENV_ANCHOR_INTERVAL = "AERE_PQ_ANCHOR_INTERVAL"; + ++ /** ++ * System property naming the INTERVAL SCHEDULE: "h:interval,h:interval". From each height h the ++ * certificate is carried every {@code interval} blocks instead of {@link #PROPERTY_ANCHOR_INTERVAL}. ++ * D-336 (2026-09-04): a hybrid anchor is ~53 KB, so at interval 32 the chain costs ~8.35 GB per ++ * month per node; a scheduled interval lets the fleet move to 128 at a coordinated height. ++ */ ++ public static final String PROPERTY_ANCHOR_INTERVAL_SCHEDULE = "aere.pq.anchorIntervalSchedule"; ++ ++ /** Environment variable twin of {@link #PROPERTY_ANCHOR_INTERVAL_SCHEDULE}. */ ++ public static final String ENV_ANCHOR_INTERVAL_SCHEDULE = "AERE_PQ_ANCHOR_INTERVAL_SCHEDULE"; ++ ++ /** ++ * AERE ANCHOR V2 (2026-09-03): from this height every anchor header carries the SCHEME-TAGGED ++ * certificate (PqAnchorV2: Falcon-512 plus every extra scheme the scheme schedule names at the ++ * parent height, K seals per scheme) and vanityData is the v2 digest under "AERE-PQ-ANCHOR-2". ++ * Below it nothing changes. A v2 certificate is refused below this height and a v1 one from it, ++ * so the switch is a consensus fork: every node of the fleet must carry the same value, exactly ++ * like {@link #PROPERTY_ANCHOR_BLOCK}. Absent means never. Env: {@code AERE_PQ_ANCHOR_V2_BLOCK}. ++ */ ++ public static final String PROPERTY_ANCHOR_V2_BLOCK = "aere.pq.anchorV2Block"; ++ ++ /** Environment variable twin of {@link #PROPERTY_ANCHOR_V2_BLOCK}. */ ++ public static final String ENV_ANCHOR_V2_BLOCK = "AERE_PQ_ANCHOR_V2_BLOCK"; ++ + /** Environment variable twin of {@link #PROPERTY_ANCHOR_BLOCK}. */ + public static final String ENV_ANCHOR_BLOCK = "AERE_PQ_ANCHOR_BLOCK"; + @@ -5629,14 +8041,14 @@ index 000000000..ce9f081b5 + + /** + * The stable, greppable code carried by every startup refusal raised while reading this -+ * configuration, in the shape of the registry-binding refusal {@code AERE-PQC-REG-MISMATCH-01}. ++ * configuration, in the shape of the A8 registry refusal {@code AERE-PQC-REG-MISMATCH-01}. + */ + public static final String REFUSAL_CODE = "AERE-PQC-ANCHOR-CONF-01"; + + /** -+ * MIN-SEALS FLOOR: the greppable name of the guard that refuses an armed anchor whose schedule -+ * never demands a single signature. Named, and not just a message, so that a check can ask whether -+ * the guard EXISTS rather than whether some prose happens to be present. ++ * D-147: the greppable name of the guard that refuses an armed anchor whose schedule never demands ++ * a single signature. Named, and not just a message, so that a check can ask whether the guard ++ * EXISTS rather than whether some prose happens to be present. + */ + public static final String REFUSAL_MIN_SEALS_FLOOR = REFUSAL_CODE + "/minSealsFloor"; + @@ -5655,6 +8067,8 @@ index 000000000..ce9f081b5 + {PROPERTY_MIN_SEALS_CEILING, ENV_MIN_SEALS_CEILING}, + {PROPERTY_MAX_SEALS, ENV_MAX_SEALS}, + {PROPERTY_ANCHOR_INTERVAL, ENV_ANCHOR_INTERVAL}, ++ {PROPERTY_ANCHOR_INTERVAL_SCHEDULE, ENV_ANCHOR_INTERVAL_SCHEDULE}, ++ {PROPERTY_ANCHOR_V2_BLOCK, ENV_ANCHOR_V2_BLOCK}, + {PROPERTY_DISABLE, ENV_DISABLE} + }; + @@ -5667,6 +8081,8 @@ index 000000000..ce9f081b5 + private final boolean disabled; + private final OptionalInt maxSealsCarried; + private final OptionalInt anchorInterval; ++ private final long anchorV2Block; ++ private final NavigableMap anchorIntervalSchedule; + + /** + * Build an explicit configuration. @@ -5727,7 +8143,99 @@ index 000000000..ce9f081b5 + final boolean disabled, + final OptionalInt maxSealsCarried, + final OptionalInt anchorInterval) { ++ this(chainId, anchorBlock, minSealsSchedule, minSealsCeiling, disabled, maxSealsCarried, ++ anchorInterval, NEVER); ++ } ++ ++ /** ++ * Full constructor. ++ * ++ * @param anchorV2Block the height from which anchor headers carry the scheme-tagged v2 ++ * certificate and the v2 digest, or {@link #NEVER} ++ */ ++ public PqAnchorConfig( ++ final long chainId, ++ final long anchorBlock, ++ final Map minSealsSchedule, ++ final OptionalInt minSealsCeiling, ++ final boolean disabled, ++ final OptionalInt maxSealsCarried, ++ final OptionalInt anchorInterval, ++ final long anchorV2Block) { ++ this(chainId, anchorBlock, minSealsSchedule, minSealsCeiling, disabled, maxSealsCarried, ++ anchorInterval, anchorV2Block, new TreeMap<>()); ++ } ++ ++ /** ++ * Full constructor with the interval schedule (D-336). ++ * ++ * @param anchorIntervalSchedule heights from which the interval changes; every interval must be a ++ * positive multiple of the base interval and every height must sit on the NEW grid counted ++ * from H, so that the anchors of the new regime are a subset of the old ones and the change ++ * never invents an anchor height the old regime did not have ++ */ ++ private PqAnchorConfig( ++ final long chainId, ++ final long anchorBlock, ++ final Map minSealsSchedule, ++ final OptionalInt minSealsCeiling, ++ final boolean disabled, ++ final OptionalInt maxSealsCarried, ++ final OptionalInt anchorInterval, ++ final long anchorV2Block, ++ final NavigableMap anchorIntervalSchedule) { + this.anchorInterval = anchorInterval; ++ this.anchorV2Block = anchorV2Block; ++ this.anchorIntervalSchedule = new TreeMap<>(anchorIntervalSchedule); ++ if (!this.anchorIntervalSchedule.isEmpty()) { ++ if (anchorInterval.isEmpty()) { ++ throw new IllegalArgumentException( ++ "AERE PQ ANCHOR: " + PROPERTY_ANCHOR_INTERVAL_SCHEDULE + " is set but " ++ + PROPERTY_ANCHOR_INTERVAL + " is not: a schedule changes an interval, it cannot" ++ + " create one"); ++ } ++ if (anchorBlock == NEVER) { ++ throw new IllegalArgumentException( ++ "AERE PQ ANCHOR: " + PROPERTY_ANCHOR_INTERVAL_SCHEDULE ++ + " is set but no anchor activation height is"); ++ } ++ final int base = anchorInterval.getAsInt(); ++ for (final Map.Entry e : this.anchorIntervalSchedule.entrySet()) { ++ final long h = e.getKey(); ++ final int iv = e.getValue(); ++ if (iv < 1 || iv % base != 0) { ++ throw new IllegalArgumentException( ++ "AERE PQ ANCHOR: " + PROPERTY_ANCHOR_INTERVAL_SCHEDULE + " names interval " + iv ++ + " at " + h + ", which is not a positive multiple of the base interval " + base ++ + ": the anchors of the new regime must be a subset of the old ones"); ++ } ++ if (h < anchorBlock || (h - anchorBlock) % iv != 0) { ++ throw new IllegalArgumentException( ++ "AERE PQ ANCHOR: " + PROPERTY_ANCHOR_INTERVAL_SCHEDULE + " changes the interval to " ++ + iv + " at " + h + ", which is not on the new grid counted from H=" + anchorBlock ++ + " ((h - H) % " + iv + " must be 0): the first anchor of the new regime is the" ++ + " activation height itself, so every node can check it by hand"); ++ } ++ } ++ } ++ if (anchorV2Block != NEVER) { ++ if (anchorV2Block < 1) { ++ throw new IllegalArgumentException( ++ "AERE PQ ANCHOR: " + PROPERTY_ANCHOR_V2_BLOCK + " must be at least 1, got " + anchorV2Block); ++ } ++ if (anchorBlock == NEVER) { ++ throw new IllegalArgumentException( ++ "AERE PQ ANCHOR: " + PROPERTY_ANCHOR_V2_BLOCK + "=" + anchorV2Block ++ + " is set but no anchor activation height is: a v2 certificate is a form of the" ++ + " anchor certificate, it cannot exist where no anchor does"); ++ } ++ if (anchorV2Block < anchorBlock) { ++ throw new IllegalArgumentException( ++ "AERE PQ ANCHOR: " + PROPERTY_ANCHOR_V2_BLOCK + "=" + anchorV2Block ++ + " is below the anchor activation height " + anchorBlock ++ + "; the v2 form cannot take effect before the anchor rules do"); ++ } ++ } + if (anchorInterval.isPresent() && anchorInterval.getAsInt() < 1) { + throw new IllegalArgumentException( + "AERE PQ ANCHOR: " @@ -5957,7 +8465,10 @@ index 000000000..ce9f081b5 + + final PqAnchorConfig bare = strict(block, seals, chain, ceiling, false); + final PqAnchorConfig config = -+ bare.withMaxSealsCarried(readMaxSeals()).withAnchorInterval(readAnchorInterval()); ++ bare.withMaxSealsCarried(readMaxSeals()) ++ .withAnchorInterval(readAnchorInterval()) ++ .withAnchorIntervalSchedule(readAnchorIntervalSchedule()) ++ .withAnchorV2Block(readAnchorV2Block()); + requireMinSealsFloorOrRefuse(config); + if (config.anchorInterval().isPresent() && config.everActive()) { + final int iv = config.anchorInterval().getAsInt(); @@ -5965,12 +8476,19 @@ index 000000000..ce9f081b5 + "AERE PQ ANCHOR: certificate carried every {} block(s) from H={}, not every block. The " + + "hash chain makes each anchor protect everything BELOW it, so what stays rewritable " + + "by an adversary holding every classical validator key is the TAIL since the last " -+ + "anchor: fork depth <= {} blocks. This is a DELIBERATE weakening bought for header " -+ + "size: the certificate cost falls to roughly 1/{} of the every-block figure.", ++ + "anchor: fork depth <= {} blocks. This is a DELIBERATE weakening bought for disk: " ++ + "at K=3 capped it is about {} GB per node per year instead of about 120.", + iv, + config.anchorBlock, + iv, -+ iv); ++ String.format("%.1f", 120.5 / iv)); ++ } ++ if (!config.anchorIntervalSchedule().isEmpty() && config.everActive()) { ++ LOG.warn( ++ "AERE PQ ANCHOR: interval SCHEDULE in force - {} (height:interval). From each height the" ++ + " certificate is carried every that-many blocks; the anchors of every later regime are" ++ + " a subset of the earlier ones (D-336, disk).", ++ config.anchorIntervalSchedule()); + } + if (config.maxSealsCarried().isPresent() && config.everActive()) { + LOG.warn( @@ -5979,7 +8497,7 @@ index 000000000..ce9f081b5 + + "header cost and takes NOTHING from the quorum margin, which is decided by the " + + "threshold a verifier demands, not by how many seals a proposer volunteers above " + + "it. Measured 2026-08-07: uncapped, a K=3 chain at N=7 carries about five seals, " -+ + "which is about 1.7 times the header bytes it writes capped at K.", ++ + "which is 200.9 GB per node per year; capped at K it is 120.5 GB.", + config.maxSealsCarried().getAsInt(), + config.highestEffectiveMinSeals()); + } @@ -6135,8 +8653,8 @@ index 000000000..ce9f081b5 + } + + /** -+ * THE MIN-SEALS FLOOR. A schedule whose effective K is ZERO at every height leaves the anchor -+ * ARMED as a structure and completely toothless, for ever. ++ * D-147, THE MIN-SEALS FLOOR. A schedule whose effective K is ZERO at every height leaves the ++ * anchor ARMED as a structure and completely toothless, for ever. + * + *

    WHAT THE CODE ALREADY GUARDED, and why that was not enough. The loader already refuses a + * MISSING schedule, in its own words: {@code "the threshold schedule is missing or empty, so K @@ -6144,12 +8662,12 @@ index 000000000..ce9f081b5 + * exactly what the danger was. But the guard only fired on an ABSENT schedule. A schedule that is + * PRESENT and of the shape {@code :0} reaches the same end state and went through unseen. + * -+ *

    WHY THIS IS NOT THEORETICAL: it is the very shape a staged activation recommends, one that ++ *

    WHY THIS IS NOT THEORETICAL: it is the very shape our activation plan recommends, one that + * STARTS at K=0 as a warm-up window and rises to 3 later. If the second half of the line is lost, + * to a truncated environment variable or a misplaced quote, what is left is {@code :0}. The + * nodes start, every tool comes out green because each of them measures what was ASKED FOR and -+ * the ask is valid, and the threshold stays zero for ever. Not even a tool that compares the -+ * effective threshold against the requested one catches this: here both of them are zero. ++ * the ask is valid, and the threshold stays zero for ever. Not even ancora-prag-efectiv.sh ++ * catches this: it compares what came out against what was asked for, and here both are zero. + * + *

    The warm-up window stays perfectly legal: this looks at the HIGHEST K in the whole schedule, + * after the emergency ceiling, so {@code H:0,H+165000:3} passes and {@code H:0} on its own does @@ -6194,6 +8712,66 @@ index 000000000..ce9f081b5 + * is a refusal, never a silent fallback, because a weakening asked for and quietly dropped and a + * weakening quietly APPLIED are both states an operator must never be left guessing between. + */ ++ /** ++ * Read the v2 activation height. Absent means never; an unreadable value is a refusal, because ++ * this height is a consensus fork and a node guessing it differently from its peers rejects ++ * every anchor header its peers accept, or the other way round. ++ */ ++ private static long readAnchorV2Block() { ++ final Read v2 = read(PROPERTY_ANCHOR_V2_BLOCK, ENV_ANCHOR_V2_BLOCK); ++ if (!v2.hasValue()) { ++ return NEVER; ++ } ++ try { ++ return Long.parseLong(v2.raw().trim()); ++ } catch (final NumberFormatException e) { ++ throw new IllegalArgumentException( ++ REFUSAL_CODE ++ + ": " ++ + PROPERTY_ANCHOR_V2_BLOCK ++ + " is set to '" ++ + v2.raw() ++ + "' from " ++ + v2.source() ++ + ", which is not a whole number. It is NOT ignored: this height decides which form of" ++ + " the anchor certificate is valid, and a node guessing it differently from its peers" ++ + " parts from the chain at the first anchor."); ++ } ++ } ++ ++ private static NavigableMap readAnchorIntervalSchedule() { ++ final Read sc = read(PROPERTY_ANCHOR_INTERVAL_SCHEDULE, ENV_ANCHOR_INTERVAL_SCHEDULE); ++ final NavigableMap out = new TreeMap<>(); ++ if (!sc.hasValue()) { ++ return out; ++ } ++ for (final String part : Splitter.on(',').split(sc.raw())) { ++ final String p = part.trim(); ++ if (p.isEmpty()) { ++ continue; ++ } ++ final int colon = p.indexOf(':'); ++ try { ++ if (colon < 1) { ++ throw new NumberFormatException(p); ++ } ++ out.put(Long.parseLong(p.substring(0, colon).trim()), Integer.parseInt(p.substring(colon + 1).trim())); ++ } catch (final NumberFormatException e) { ++ throw new IllegalArgumentException( ++ REFUSAL_CODE ++ + ": " ++ + PROPERTY_ANCHOR_INTERVAL_SCHEDULE ++ + " is set to '" ++ + sc.raw() ++ + "' from " ++ + sc.source() ++ + ", which is not a list of height:interval. It is NOT ignored: two nodes that read" ++ + " it differently disagree about which headers carry a certificate."); ++ } ++ } ++ return out; ++ } ++ + private static OptionalInt readAnchorInterval() { + final Read iv = read(PROPERTY_ANCHOR_INTERVAL, ENV_ANCHOR_INTERVAL); + if (!iv.hasValue()) { @@ -6432,8 +9010,9 @@ index 000000000..ce9f081b5 + .append(expected) + .append('\n') + .append(" FIX correct BESU_OPTS on THIS node and restart ONLY this node\n") -+ .append(" WARNING if the same value is on all seven: restart one at a time,\n") -+ .append(" never in parallel. At quorum 5 of 7 you lose the chain.\n") ++ .append(" WARNING if the same value is on every node: restart one at a time,\n") ++ .append(" never in parallel. The chain stops as soon as more than f\n") ++ .append(" validators are down at once, whatever the set size is today.\n") + .append(" EMERGENCY ") + .append(PROPERTY_DISABLE) + .append("=true starts the node with the anchor off and shouts at every block"); @@ -6579,7 +9158,8 @@ index 000000000..ce9f081b5 + // CAREFUL: the interval is carried across too. A copy method that drops a field along the way + // is exactly how a disarm or an interval would vanish silently when the other control is set. + return new PqAnchorConfig( -+ chainId, anchorBlock, minSealsSchedule, minSealsCeiling, disabled, cap, anchorInterval); ++ chainId, anchorBlock, minSealsSchedule, minSealsCeiling, disabled, cap, anchorInterval, ++ anchorV2Block); + } + + /** @@ -6593,6 +9173,43 @@ index 000000000..ce9f081b5 + } + + /** ++ * The interval in force at a height: the base interval, or the last scheduled change at or below ++ * the height (D-336). ++ * ++ * @param blockNumber the height ++ * @return the interval in force there; 1 when no interval is configured ++ */ ++ public int intervalAt(final long blockNumber) { ++ if (anchorInterval.isEmpty()) { ++ return 1; ++ } ++ final Map.Entry e = anchorIntervalSchedule.floorEntry(blockNumber); ++ return e == null ? anchorInterval.getAsInt() : e.getValue(); ++ } ++ ++ /** ++ * The interval schedule (D-336), possibly empty. ++ * ++ * @return an unmodifiable view, height to interval ++ */ ++ public NavigableMap anchorIntervalSchedule() { ++ return java.util.Collections.unmodifiableNavigableMap(anchorIntervalSchedule); ++ } ++ ++ /** ++ * Return a copy carrying an interval schedule (D-336). Refused unless every entry keeps the new ++ * anchors a subset of the old ones; see the private constructor. ++ * ++ * @param schedule heights to intervals ++ * @return a copy of this configuration carrying the schedule ++ */ ++ public PqAnchorConfig withAnchorIntervalSchedule(final Map schedule) { ++ return new PqAnchorConfig( ++ chainId, anchorBlock, minSealsSchedule, minSealsCeiling, disabled, maxSealsCarried, ++ anchorInterval, anchorV2Block, new TreeMap<>(schedule)); ++ } ++ ++ /** + * Is this a height at which a certificate is carried and demanded? + * + *

    Counted FROM H, so H itself is always an anchor height. That matters because H is the single @@ -6609,7 +9226,7 @@ index 000000000..ce9f081b5 + if (anchorBlock == NEVER || blockNumber < anchorBlock) { + return false; + } -+ return (blockNumber - anchorBlock) % anchorInterval.getAsInt() == 0; ++ return (blockNumber - anchorBlock) % intervalAt(blockNumber) == 0; + } + + /** @@ -6629,6 +9246,39 @@ index 000000000..ce9f081b5 + } + + /** ++ * The v2 activation height, or {@link #NEVER}. ++ * ++ * @return the height from which anchor headers carry the scheme-tagged certificate ++ */ ++ public long anchorV2Block() { ++ return anchorV2Block; ++ } ++ ++ /** ++ * Whether the header at this height must carry the SCHEME-TAGGED (v2) certificate and the v2 ++ * digest. True only at an anchor height ({@link #anchorAppliesAt}) at or above the v2 activation ++ * height. The producer and both rules ask THIS question, not one that resembles it. ++ * ++ * @param blockNumber the height ++ * @return true when the v2 form is the only accepted form at this height ++ */ ++ public boolean anchorV2AppliesAt(final long blockNumber) { ++ return anchorV2Block != NEVER && blockNumber >= anchorV2Block && anchorAppliesAt(blockNumber); ++ } ++ ++ /** ++ * Copy with a v2 activation height. ++ * ++ * @param v2Block the height, or {@link #NEVER} ++ * @return a configuration identical to this one except for the v2 height ++ */ ++ public PqAnchorConfig withAnchorV2Block(final long v2Block) { ++ return new PqAnchorConfig( ++ chainId, anchorBlock, minSealsSchedule, minSealsCeiling, disabled, maxSealsCarried, ++ anchorInterval, v2Block, anchorIntervalSchedule); ++ } ++ ++ /** + * Return a copy carrying an anchor interval. + * + *

    THE SECURITY PROPERTY, stated so it can be argued with: block hashes chain, so an anchor at @@ -6636,14 +9286,15 @@ index 000000000..ce9f081b5 + * and forces A to be reproduced, which needs a Falcon quorum. What an adversary holding every + * classical validator key can still rewrite is the TAIL since the last anchor. Therefore + * {@code fork depth <= interval}. At ~523 ms a block, an interval of 100 is about 52 seconds of -+ * rewritable tail, against about half a second at interval 1, at a hundredth of the header cost. ++ * rewritable tail, against about half a second at interval 1, and it costs a hundredth of the disk. + * + * @param interval the interval, or empty for every block + * @return a copy of this configuration carrying the interval + */ + public PqAnchorConfig withAnchorInterval(final OptionalInt interval) { + return new PqAnchorConfig( -+ chainId, anchorBlock, minSealsSchedule, minSealsCeiling, disabled, maxSealsCarried, interval); ++ chainId, anchorBlock, minSealsSchedule, minSealsCeiling, disabled, maxSealsCarried, interval, ++ anchorV2Block, anchorIntervalSchedule); + } + + /** @@ -7105,12 +9756,12 @@ index 000000000..a7c8c9bf1 +} diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqAnchorNotReadyException.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqAnchorNotReadyException.java new file mode 100755 -index 000000000..772560067 +index 000000000..2501920f3 --- /dev/null +++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqAnchorNotReadyException.java @@ -0,0 +1,132 @@ +/* -+ * Copyright contributors to Besu / Aere Network. ++ * Copyright contributors to Besu / AERE Network. + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at @@ -7139,8 +9790,8 @@ index 000000000..772560067 + *

    WHEN IT CAN HAPPEN. Only above the activation height, and only once the operator has raised K + * past zero: the first stage is required to be K=0, so activation itself can never refuse. In + * steady state the usual cause is a node that restarted and has not yet taken part in a commit, at -+ * most one proposer turn. The other cause, f validators withholding Falcon seals, is a measured -+ * exposure of its own and is the reason the validator set must grow to N>=9 before K is raised to ++ * most one proposer turn. The other cause, f validators withholding Falcon seals, is the measured ++ * A10 exposure and is the reason the validator set must grow to N>=9 before K is raised to + * quorum, because at N=7, f=2 the margin is exactly zero. + * + *

    Callers on the consensus path must catch this and simply not propose. It carries the numbers a @@ -7243,12 +9894,12 @@ index 000000000..772560067 +} diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqAnchorSyncModeGuard.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqAnchorSyncModeGuard.java new file mode 100755 -index 000000000..73dd0492b +index 000000000..2dc16d8e9 --- /dev/null +++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqAnchorSyncModeGuard.java @@ -0,0 +1,130 @@ +/* -+ * Copyright contributors to Besu / Aere Network. ++ * Copyright contributors to Besu / AERE Network. + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at @@ -7300,8 +9951,8 @@ index 000000000..73dd0492b + * remove. + * + *

    Inert when the anchor is not configured. With no {@code aere.pq.anchorBlock} this method -+ * returns before it looks at the sync mode, so a binary carrying it behaves exactly as it did -+ * before on any chain where the anchor is not configured on any node. ++ * returns before it looks at the sync mode, so a binary carrying it behaves exactly as today on ++ * chain 2800 as it stands, where the anchor is not configured on any node. + */ +public final class PqAnchorSyncModeGuard { + @@ -7379,12 +10030,12 @@ index 000000000..73dd0492b +} diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqAnchorThresholdGuard.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqAnchorThresholdGuard.java new file mode 100755 -index 000000000..6551df04e +index 000000000..963c64b23 --- /dev/null +++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqAnchorThresholdGuard.java -@@ -0,0 +1,252 @@ +@@ -0,0 +1,282 @@ +/* -+ * Copyright contributors to Besu / Aere Network. ++ * Copyright contributors to Besu / AERE Network. + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at @@ -7424,7 +10075,7 @@ index 000000000..6551df04e + *

      + *
    • {@code quorum(N)} is Besu's own {@link BftHelpers#calculateRequiredValidatorQuorum(int)}, + * {@code ceil(2N/3)}. At N=7 that is {@code ceil(14/3) = 5}, so the highest configurable -+ * threshold at that set size is 4. ++ * threshold on chain 2800 as it stands is 4. + *
    • {@code K = quorum} is a GUARANTEED HALT, and that is measured, not argued. A proposer + * assembles its certificate out of the Falcon seals it heard on Commit messages, and the block + * is IMPORTED at the quorum-th Commit; after the import {@code QbftController.consumeMessage} @@ -7444,9 +10095,9 @@ index 000000000..6551df04e + *
    + * + *

    What is a refusal and what is only a shout. Above {@code quorum - f} the schedule is -+ * still reachable but has no margin against f silent or keyless signers, which is a measured -+ * exposure of its own. That is a deliberate operator choice with a real cost, so it gets a loud -+ * WARN and the node starts. At or above {@code quorum} the schedule is not reachable at all, so it gets a ++ * still reachable but has no margin against f silent or keyless signers, which is the measured A10 ++ * and A13 exposure. That is a deliberate operator choice with a real cost, so it gets a loud WARN and ++ * the node starts. At or above {@code quorum} the schedule is not reachable at all, so it gets a + * refusal. A guard that refused both would take the emergency ladder away; a guard that shouted for + * both would be the log line this class exists to replace. + * @@ -7461,8 +10112,8 @@ index 000000000..6551df04e + * count the validators" is not "the threshold is probably fine". + * + *

    Inert when the anchor is not armed. With no {@code aere.pq.anchorBlock}, or with the -+ * anchor emergency-disarmed, this method returns before it computes anything, so a binary carrying -+ * it behaves exactly as it did before on any chain where the anchor is armed on no node. ++ * anchor emergency-disarmed, this method returns before it computes anything, so a binary carrying it ++ * behaves exactly as today on chain 2800, where the anchor is armed on no node. + */ +public final class PqAnchorThresholdGuard { + @@ -7476,13 +10127,26 @@ index 000000000..6551df04e + /** + * The highest seal threshold that may be configured for a validator set of this size. + * -+ *

    One below the QBFT quorum. At N=7 this is 4. ++ *

    REVISED 2026-08-20, and the revision is a measurement, not an opinion. Until D-227 ++ * (2026-08-14) a proposer could gather at most {@code quorum} seals: the block imported at the ++ * quorum-th Commit and {@code QbftController.consumeMessage} discarded every later Commit, so this ++ * method returned {@code quorum - 1} and the class doc below carries that history. D-227 (the ++ * late-seal salvage, {@code PqLateSealSalvageTest}) extracts the Falcon seal BEFORE the height ++ * gate discards the message, so the cache now accumulates seals from every ALIVE keyed validator. ++ * Measured on mainnet 2800 across 5,400 anchor blocks (2026-08-18..20): certificates carry 8 and 9 ++ * seals at N=9, i.e. strictly more than quorum=6, which under the old mechanics was impossible. ++ * ++ *

    The bound that remains fatal is availability under the tolerated fault budget: with f ++ * validators Byzantine or down, at most {@code N - f} seals can ever exist, so a threshold above ++ * {@code N - f} halts anchors inside the design's own fault model. At N=9 this is 7; at N=7 it is ++ * 5. A threshold at or above the quorum is now a LIVENESS TAX (anchors wait for late seals), ++ * shouted below, not a guaranteed halt. + * + * @param validatorCount the number of validators, at least 1 -+ * @return the highest configurable threshold K ++ * @return the highest configurable threshold K, {@code N - f} + */ + public static int maxConfigurableThreshold(final int validatorCount) { -+ return BftHelpers.calculateRequiredValidatorQuorum(validatorCount) - 1; ++ return validatorCount - byzantineBudget(validatorCount); + } + + /** @@ -7535,7 +10199,7 @@ index 000000000..6551df04e + } + + final int quorum = BftHelpers.calculateRequiredValidatorQuorum(validatorCount); -+ final int maxConfigurable = quorum - 1; ++ final int maxConfigurable = maxConfigurableThreshold(validatorCount); + final int f = byzantineBudget(validatorCount); + final int noMarginAbove = quorum - f; + @@ -7554,7 +10218,7 @@ index 000000000..6551df04e + highest = effective; + highestAt = at; + } -+ if (effective >= quorum && fatalHeight < 0L) { ++ if (effective > validatorCount - f && fatalHeight < 0L) { + fatalHeight = at; + fatalThreshold = effective; + } @@ -7572,21 +10236,18 @@ index 000000000..6551df04e + + validatorCount + + " validators this node is starting into is " + + quorum -+ + " (ceil(2N/3)). The highest threshold that may be configured at this set size is " ++ + " (ceil(2N/3)) with f = " ++ + f ++ + ". The highest threshold that may be configured at this set size is " + + maxConfigurable -+ + ". WHAT THIS MEANS: a proposer builds its certificate out of the Falcon seals it " -+ + "heard on Commit messages, and the block is imported at the quorum-th Commit; every " -+ + "Commit arriving after that import is discarded as targeting a height not above the " -+ + "chain head, so a proposer can gather at most quorum seals at ANY validator-set " -+ + "size. Measured on an isolated N=4 network with quorum 3: k=3 on every header above " -+ + "the activation height, never 4, with all four nodes keyed and healthy. A threshold " -+ + "of " ++ + " = N - f. WHAT THIS MEANS (doctrine revised 2026-08-20 for D-227 late-seal " ++ + "salvage): the seal cache accumulates seals from every ALIVE keyed validator, " ++ + "measured on mainnet 2800 as 8-9 seals per certificate at N=9 across 5,400 anchors. " ++ + "But with f validators Byzantine or down - the design's own fault budget - at most " ++ + "N - f seals can ever exist, so a threshold of " + + fatalThreshold -+ + " therefore requires that ALL of the first " -+ + quorum -+ + " Commits carry a valid and eligible Falcon seal; one validator without a key among " -+ + "them, or one seal that does not verify, and no proposer proposes again. That is a " -+ + "halt, not a degradation, and it starts at height " ++ + " makes anchor blocks unreachable inside the tolerated fault model. That is a halt " ++ + "bought by configuration, and it starts at height " + + fatalHeight + + ". WHAT TO DO: lower the step to at most " + + maxConfigurable @@ -7604,6 +10265,26 @@ index 000000000..6551df04e + + "."); + } + ++ if (highest >= quorum) { ++ LOG.warn( ++ "AERE PQ ANCHOR: threshold guard PASSED at a QUORUM-OR-ABOVE threshold. K reaches {} at " ++ + "height {}; quorum for {} validators is {} and N - f is {}. Reachability now rests " ++ + "on the D-227 late-seal salvage (measured on mainnet: 8-9 seals per certificate), " ++ + "and the margin under the fault budget is {}: with f={} validators down, anchors " ++ + "wait until {} of the remaining {} carry valid seals. This is the operator's " ++ + "explicit choice of a liveness tax for a quorum-grade certificate.", ++ highest, ++ highestAt, ++ validatorCount, ++ quorum, ++ validatorCount - f, ++ (validatorCount - f) - highest, ++ f, ++ highest, ++ validatorCount - f); ++ return; ++ } ++ + if (highest > noMarginAbove) { + LOG.warn( + "AERE PQ ANCHOR: threshold guard PASSED but the schedule has NO MARGIN. K reaches {} at " @@ -7635,12 +10316,203 @@ index 000000000..6551df04e + f); + } +} +diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqAnchorV2.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqAnchorV2.java +new file mode 100755 +index 000000000..11931438d +--- /dev/null ++++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqAnchorV2.java +@@ -0,0 +1,185 @@ ++/* ++ * AERE crypto-agility, step 2: the versioned anchor certificate. ++ * ++ * WHY A NEW FORMAT. The legacy certificate (PqAnchor.writeCertificate, live on chain 2800) is an ++ * RLP list of [index, signature] pairs: it cannot say WHICH mathematics signed, so it can never ++ * carry the founder-approved hybrid (Falcon + SLH-DSA in one certificate, decision of ++ * 2026-08-07). V2 tags every seal with the one-byte scheme id from SealSchemes. ++ * ++ * HOW THE TWO FORMATS CANNOT BE CONFUSED, by construction and proven in tests: ++ * legacy: RLP [ [idx, sig], ... ] - first element is a LIST ++ * v2: RLP [ 0x02, [ [scheme, idx, sig], ... ] ] - first element is a SCALAR byte ++ * A legacy reader entering v2 bytes finds a scalar where it demands a list and fails loudly; this ++ * decoder REFUSES bytes whose first element is a list (that is legacy, not a malformed v2). The ++ * digest uses a NEW domain string, so a v2 digest can never collide with a v1 digest over related ++ * content: domain separation, same discipline as ANCHOR_DOMAIN v1. ++ * ++ * CANONICAL ORDER. Seals are strictly increasing by (validatorIndex, schemeWireId). One validator ++ * may seal with BOTH schemes (that is the hybrid), but the same (validator, scheme) pair can ++ * appear only once, and any deviation from the canonical order is a decode REFUSAL, not a repair: ++ * a certificate with two encodings would have two digests, and a digest that depends on encoder ++ * mood is not a commitment. ++ */ ++package org.hyperledger.besu.consensus.common.bft; ++ ++import java.nio.charset.StandardCharsets; ++import java.util.ArrayList; ++import java.util.Collection; ++import java.util.Comparator; ++import java.util.List; ++ ++import org.apache.tuweni.bytes.Bytes; ++import org.apache.tuweni.bytes.Bytes32; ++import org.hyperledger.besu.crypto.Hash; ++import org.hyperledger.besu.ethereum.rlp.BytesValueRLPInput; ++import org.hyperledger.besu.ethereum.rlp.BytesValueRLPOutput; ++import org.hyperledger.besu.ethereum.rlp.RLPInput; ++ ++/** Encoder/decoder and digest for the v2 (scheme-tagged) anchor certificate. */ ++public final class PqAnchorV2 { ++ ++ /** The version scalar that opens every v2 certificate. */ ++ public static final int VERSION = 2; ++ ++ /** Domain for the v2 anchor digest. NEW string: v1 and v2 digests can never collide. */ ++ public static final String ANCHOR_DOMAIN_V2 = "AERE-PQ-ANCHOR-2"; ++ ++ /** The domain bytes written into every v2 digest preimage. */ ++ public static final Bytes ANCHOR_DOMAIN_V2_BYTES = ++ Bytes.wrap(ANCHOR_DOMAIN_V2.getBytes(StandardCharsets.UTF_8)); ++ ++ /** Canonical order: strictly increasing (validatorIndex, schemeWireId). */ ++ public static final Comparator CANONICAL = ++ Comparator.comparingInt(SchemeSeal::getValidatorIndex) ++ .thenComparingInt(s -> s.getSchemeWireId() & 0xff); ++ ++ /** Hard cap mirroring the legacy store's defence: a certificate is small and bounded. */ ++ public static final int MAX_SEALS = 64; ++ ++ private PqAnchorV2() {} ++ ++ /** Encode a v2 certificate. The input must already be in canonical order with no duplicate ++ * (validator, scheme) pair and only known schemes; anything else throws: an encoder that ++ * silently reorders would let two byte-strings claim the same certificate. */ ++ public static Bytes encode(final List seals) { ++ requireCanonical(seals); ++ final BytesValueRLPOutput out = new BytesValueRLPOutput(); ++ out.startList(); ++ out.writeIntScalar(VERSION); ++ out.writeList( ++ seals, ++ (seal, rlp) -> { ++ rlp.startList(); ++ rlp.writeIntScalar(seal.getSchemeWireId() & 0xff); ++ rlp.writeIntScalar(seal.getValidatorIndex()); ++ rlp.writeBytes(seal.getSignature()); ++ rlp.endList(); ++ }); ++ out.endList(); ++ return out.encoded(); ++ } ++ ++ /** Decode a v2 certificate. Throws IllegalArgumentException on ANYTHING that is not a ++ * well-formed, canonical, known-scheme v2 certificate - including legacy bytes, which are ++ * named as such in the message so the caller can tell "old format" from "garbage". */ ++ public static List decode(final Bytes encoded) { ++ if (encoded == null || encoded.isEmpty()) { ++ throw new IllegalArgumentException("AERE PQ V2: empty certificate bytes"); ++ } ++ final RLPInput in = new BytesValueRLPInput(encoded, false); ++ in.enterList(); ++ if (in.nextIsList()) { ++ throw new IllegalArgumentException( ++ "AERE PQ V2: first element is a list - this is a LEGACY (v1) certificate, not v2"); ++ } ++ final int version = in.readIntScalar(); ++ if (version != VERSION) { ++ throw new IllegalArgumentException( ++ "AERE PQ V2: unknown certificate version " + version + " (this build understands 2)"); ++ } ++ final List seals = new ArrayList<>(); ++ in.enterList(); ++ while (!in.isEndOfCurrentList()) { ++ if (seals.size() >= MAX_SEALS) { ++ throw new IllegalArgumentException( ++ "AERE PQ V2: certificate exceeds " + MAX_SEALS + " seals"); ++ } ++ in.enterList(); ++ final int scheme = in.readIntScalar(); ++ final int index = in.readIntScalar(); ++ final Bytes signature = in.readBytes(); ++ in.leaveList(); ++ if (scheme < 0 || scheme > 0xff) { ++ throw new IllegalArgumentException("AERE PQ V2: scheme tag out of byte range: " + scheme); ++ } ++ seals.add(new SchemeSeal((byte) scheme, index, signature)); ++ } ++ in.leaveList(); ++ in.leaveList(); ++ requireCanonical(seals); ++ return seals; ++ } ++ ++ /** The v2 anchor digest: same shape as v1 (chainId, parent number, parent hash, certificate) ++ * under the NEW domain, over the CANONICAL encoding. */ ++ public static Bytes32 anchorDigestV2( ++ final long chainId, ++ final long parentNumber, ++ final Bytes parentHash, ++ final List seals) { ++ if (parentNumber < 0) { ++ throw new IllegalArgumentException("AERE PQ V2: parentNumber must not be negative"); ++ } ++ if (parentHash == null || parentHash.size() != 32) { ++ throw new IllegalArgumentException("AERE PQ V2: parentHash must be 32 bytes"); ++ } ++ final BytesValueRLPOutput out = new BytesValueRLPOutput(); ++ out.startList(); ++ out.writeBytes(ANCHOR_DOMAIN_V2_BYTES); ++ out.writeLongScalar(chainId); ++ out.writeLongScalar(parentNumber); ++ out.writeBytes(parentHash); ++ out.writeBytes(encode(seals)); ++ out.endList(); ++ return Hash.keccak256(out.encoded()); ++ } ++ ++ /** How many DISTINCT validators sealed with the given scheme. The hybrid threshold question ++ * ("K of N under scheme X") is asked per scheme, and a validator counts once per scheme no ++ * matter what canonicality allowed. */ ++ public static int distinctValidatorsWith(final Collection seals, final byte wireId) { ++ return (int) ++ seals.stream() ++ .filter(s -> s.getSchemeWireId() == wireId) ++ .mapToInt(SchemeSeal::getValidatorIndex) ++ .distinct() ++ .count(); ++ } ++ ++ private static void requireCanonical(final List seals) { ++ if (seals == null) { ++ throw new IllegalArgumentException("AERE PQ V2: null seal list"); ++ } ++ SchemeSeal prev = null; ++ for (final SchemeSeal s : seals) { ++ if (s.getValidatorIndex() < 0) { ++ throw new IllegalArgumentException( ++ "AERE PQ V2: negative validator index " + s.getValidatorIndex()); ++ } ++ if (SealSchemes.byWireId(s.getSchemeWireId()).isEmpty()) { ++ throw new IllegalArgumentException( ++ "AERE PQ V2: unknown scheme tag 0x" ++ + Integer.toHexString(s.getSchemeWireId() & 0xff) ++ + " - refusing the whole certificate, an unknown scheme must be loud"); ++ } ++ if (prev != null && CANONICAL.compare(prev, s) >= 0) { ++ throw new IllegalArgumentException( ++ "AERE PQ V2: seals not in strictly increasing (validator, scheme) order: " ++ + prev ++ + " then " ++ + s); ++ } ++ prev = s; ++ } ++ } ++} diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqRegistryBinding.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqRegistryBinding.java new file mode 100755 -index 000000000..5e3a83260 +index 000000000..780bf8360 --- /dev/null +++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqRegistryBinding.java -@@ -0,0 +1,497 @@ +@@ -0,0 +1,496 @@ +/* + * Copyright contributors to Besu. + * @@ -7677,15 +10549,14 @@ index 000000000..5e3a83260 +import org.slf4j.LoggerFactory; + +/** -+ * AERE REGISTRY BINDING: bind each registry row's FALCON PUBLIC KEY to the VALIDATOR ADDRESS it -+ * sits next to. ++ * AERE D-146: bind each registry row's FALCON PUBLIC KEY to the VALIDATOR ADDRESS it sits next to. + * + *

    The defect, measured on the real code path on 2026-08-06

    + * + *

    {@link PqRegistryHash} makes the registry a chain-committed object: two nodes cannot hold + * different files without one of them refusing to start. It says so itself, in its own class + * javadoc: "It says nothing about whether any validator actually holds the private key matching its -+ * registered public key." That sentence is the whole of the defect this class closes. ++ * registered public key." That sentence is the whole of D-146. + * + *

    Concretely, the registry is a table from index i to the pair (ECDSA validator address, + * Falcon public key). Seal verification uses the KEY at index i; signer eligibility is checked @@ -7719,7 +10590,7 @@ index 000000000..5e3a83260 + * truncated key and that somebody holds the matching secret. It does NOT close T3, T4 or T6: + * at the key ceremony the registry writer holds every Falcon secret, so it can sign a + * possession proof for key 0 sitting under validator 1's address. Anyone who claims a Falcon -+ * proof-of-possession repairs this binding defect is wrong, and the probe measures it. ++ * proof-of-possession repairs D-146 is wrong, and the probe measures it. + *

  • CLAIM, an ECDSA signature by the row's own VALIDATOR key. This is the half that cuts. The + * registry writer cannot forge it without validator i's consensus key, so a key cannot be + * moved under another validator's address, indices cannot be swapped, and a key cannot appear @@ -7788,7 +10659,7 @@ index 000000000..5e3a83260 + *

    What this does NOT defend against, stated plainly

    + * + *
      -+ *
    • NOT the holder of the vault. All seven validator ECDSA keys live in one place; whoever has ++ *
    • NOT the holder of the vault. Every validator ECDSA key lives in one place; whoever has + * them signs a perfectly valid claim for any Falcon key they like. This moves the attack from + * "whoever can edit a file" to "whoever holds the consensus keys". The answer to "how many + * independent people must agree to stop this chain" is unchanged, and is one. @@ -7943,7 +10814,7 @@ index 000000000..5e3a83260 + verifier.init(false, pub); + return verifier.verifySignature(digest.toArray(), signature); + } catch (final RuntimeException e) { -+ LOG.debug("AERE PQC REGISTRY-BINDING: Falcon possession verify threw: {}", e.toString()); ++ LOG.debug("AERE PQC D-146: Falcon possession verify threw: {}", e.toString()); + return false; + } + } @@ -7964,7 +10835,7 @@ index 000000000..5e3a83260 + SignatureAlgorithmFactory.getInstance().decodeSignature(Bytes.wrap(signature)); + return Util.signatureToAddress(s, Hash.wrap(digest)); + } catch (final RuntimeException e) { -+ LOG.debug("AERE PQC REGISTRY-BINDING: claim recovery threw: {}", e.toString()); ++ LOG.debug("AERE PQC D-146: claim recovery threw: {}", e.toString()); + return null; + } + } @@ -7994,7 +10865,7 @@ index 000000000..5e3a83260 + if (!registry.addressBound()) { + throw new PqRegistryHash.RegistryConfigException( + "AERE-PQC-REG-BIND-06", -+ "AERE PQC REGISTRY-BINDING: registry '" ++ "AERE PQC D-146: registry '" + + source + + "' carries binding proofs but is NOT address-bound. A proof binds a Falcon key to a " + + "validator ADDRESS; with no addresses there is nothing to bind to. Refusing " @@ -8014,7 +10885,7 @@ index 000000000..5e3a83260 + if (pop == null || pop.length == 0) { + throw new PqRegistryHash.RegistryConfigException( + "AERE-PQC-REG-BIND-01", -+ "AERE PQC REGISTRY-BINDING: registry '" ++ "AERE PQC D-146: registry '" + + source + + "' index " + + e.index() @@ -8025,7 +10896,7 @@ index 000000000..5e3a83260 + if (claim == null || claim.length == 0) { + throw new PqRegistryHash.RegistryConfigException( + "AERE-PQC-REG-BIND-02", -+ "AERE PQC REGISTRY-BINDING: registry '" ++ "AERE PQC D-146: registry '" + + source + + "' index " + + e.index() @@ -8038,7 +10909,7 @@ index 000000000..5e3a83260 + if (!verifyPossession(pk, popDigest, pop)) { + throw new PqRegistryHash.RegistryConfigException( + "AERE-PQC-REG-BIND-03", -+ "AERE PQC REGISTRY-BINDING: registry '" ++ "AERE PQC D-146: registry '" + + source + + "' index " + + e.index() @@ -8060,7 +10931,7 @@ index 000000000..5e3a83260 + if (recovered == null) { + throw new PqRegistryHash.RegistryConfigException( + "AERE-PQC-REG-BIND-05", -+ "AERE PQC REGISTRY-BINDING: registry '" ++ "AERE PQC D-146: registry '" + + source + + "' index " + + e.index() @@ -8074,7 +10945,7 @@ index 000000000..5e3a83260 + if (!recovered.equals(bound)) { + throw new PqRegistryHash.RegistryConfigException( + "AERE-PQC-REG-BIND-04", -+ "AERE PQC REGISTRY-BINDING: registry '" ++ "AERE PQC D-146: registry '" + + source + + "' index " + + e.index() @@ -8082,7 +10953,7 @@ index 000000000..5e3a83260 + + bound + + " but its claim was signed by " + + recovered -+ + ". THIS IS THE DEFECT THIS CHECK EXISTS FOR: the Falcon key on this row was filed " ++ + ". THIS IS THE DEFECT D-146 EXISTS FOR: the Falcon key on this row was filed " + + "under an address whose owner did not sign for it, so every seal made with that " + + "key would be credited to the wrong validator - and if the same key sits at two " + + "indices, a single key holder alone satisfies the quorum threshold. Refusing " @@ -8093,8 +10964,8 @@ index 000000000..5e3a83260 + } + } + LOG.info( -+ "AERE PQC REGISTRY-BINDING: registry '{}' - all {} rows carry a verified Falcon possession " -+ + "proof and a verified validator claim (chainId={}, bindHeight={}).", ++ "AERE PQC D-146: registry '{}' - all {} rows carry a verified Falcon possession proof and a " ++ + "verified validator claim (chainId={}, bindHeight={}).", + source, + count, + chainId, @@ -8140,10 +11011,10 @@ index 000000000..5e3a83260 +} diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqRegistryHash.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqRegistryHash.java new file mode 100755 -index 000000000..6b285723a +index 000000000..01ee406ad --- /dev/null +++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqRegistryHash.java -@@ -0,0 +1,2341 @@ +@@ -0,0 +1,2339 @@ +/* + * Copyright contributors to Besu. + * @@ -8180,7 +11051,7 @@ index 000000000..6b285723a +import org.slf4j.LoggerFactory; + +/** -+ * AERE GENESIS BINDING: bind the Falcon validator-index-to-public-key REGISTRY to consensus. ++ * AERE A8: bind the Falcon validator-index-to-public-key REGISTRY to consensus. + * + *

      THE DEFECT THIS EXISTS TO CLOSE. Measured by reading {@code FalconSealSupport}: the registry + * that answers "which Falcon public key is validator index i" can be loaded from a plain local @@ -8227,7 +11098,7 @@ index 000000000..6b285723a + public static final String DOMAIN_V1 = "AERE-PQ-REGISTRY-1"; + + /** -+ * Domain tag of the canonical v2 pre-image: the same registry PLUS the row binding proofs. A ++ * Domain tag of the canonical v2 pre-image: the same registry PLUS the D-146 binding proofs. A + * separate tag, and not a flag inside v1, so that a v1 file and a v2 file can never hash equal and + * a downgrade that strips the proofs cannot satisfy a schedule entry that was written for v2. + */ @@ -8272,8 +11143,8 @@ index 000000000..6b285723a + private final int index; + private final byte[] address; // 20 bytes, or null when the source is not address-bound + private final byte[] publicKey; -+ private final byte[] possessionProof; // row binding proof, or null in a v1 registry -+ private final byte[] claimProof; // row binding proof, or null in a v1 registry ++ private final byte[] possessionProof; // D-146, or null in a v1 registry ++ private final byte[] claimProof; // D-146, or null in a v1 registry + + Entry(final int index, final byte[] address, final byte[] publicKey) { + this(index, address, publicKey, null, null); @@ -8320,7 +11191,7 @@ index 000000000..6b285723a + } + + /** -+ * ROW BINDING. The Falcon signature by this row's own key over the binding pre-image, proving somebody ++ * D-146. The Falcon signature by this row's own key over the binding pre-image, proving somebody + * holds the matching secret. + * + * @return the possession proof, or null in a v1 registry @@ -8330,9 +11201,8 @@ index 000000000..6b285723a + } + + /** -+ * ROW BINDING. The ECDSA signature by this row's own VALIDATOR key over the binding pre-image. -+ * This is the half a registry writer cannot forge, and therefore the half that closes both -+ * rebinding a row to another validator's address and swapping two rows. ++ * D-146. The ECDSA signature by this row's own VALIDATOR key over the binding pre-image. This is ++ * the half a registry writer cannot forge, and therefore the half that closes T3 and T6. + * + * @return the claim proof, or null in a v1 registry + */ @@ -8355,9 +11225,9 @@ index 000000000..6b285723a + private final String sourcePath; + private final List entries; // ascending index, contiguous from 0 + private final boolean addressBound; -+ private final boolean proofBound; // every row carries both binding proofs -+ private final long declaredChainId; // the chainId the proofs were signed over -+ private final long bindHeight; // the activation height the proofs were signed over ++ private final boolean proofBound; // D-146: every row carries both binding proofs ++ private final long declaredChainId; // D-146: the chainId the proofs were signed over ++ private final long bindHeight; // D-146: the activation height the proofs were signed over + + Registry( + final SourceKind kind, @@ -8430,7 +11300,7 @@ index 000000000..6b285723a + } + + /** -+ * ROW BINDING. Whether every row carries a verified Falcon possession proof and a verified validator ++ * D-146. Whether every row carries a verified Falcon possession proof and a verified validator + * claim. False for every registry written before 2026-08-06. + * + * @return true iff proof-bound @@ -8440,7 +11310,7 @@ index 000000000..6b285723a + } + + /** -+ * ROW BINDING. The chain id the binding proofs were signed over, as the FILE declares it. Cross-checked ++ * D-146. The chain id the binding proofs were signed over, as the FILE declares it. Cross-checked + * against the node's real chain id by {@link #verifyOrAbort}: a registry lifted from the scratch + * chain carries proofs that verify perfectly among themselves and belong to another chain. + * @@ -8451,7 +11321,7 @@ index 000000000..6b285723a + } + + /** -+ * ROW BINDING. The pqRegistryHash schedule height the binding proofs were signed over, so a row ++ * D-146. The pqRegistryHash schedule height the binding proofs were signed over, so a row + * retired at one rotation cannot be replayed into a later registry. + * + * @return the bind height, or -1 when not proof-bound @@ -8528,7 +11398,7 @@ index 000000000..6b285723a + } + + /** -+ * ROW BINDING. The canonical v2 pre-image: everything v1 commits to, plus the activation height and the ++ * D-146. The canonical v2 pre-image: everything v1 commits to, plus the activation height and the + * two binding proofs of every row. + * + * 

      @@ -8553,7 +11423,7 @@ index 000000000..6b285723a
 +   * outside it, they would be advisory: a node could be handed the same registry with the proof
 +   * fields deleted, it would hash the same, satisfy the schedule, and load without ever verifying
 +   * anything. With them inside, stripping a proof is a different registry with a different hash and
-+   * the existing genesis-binding guard refuses it. That is also why v2 has its OWN domain tag: a v1 file cannot
++   * the existing A8 guard refuses it. That is also why v2 has its OWN domain tag: a v1 file cannot
 +   * collide with a v2 schedule entry, so a format downgrade is refused by machinery that already
 +   * exists rather than by a new rule that could be forgotten.
 +   *
@@ -8582,7 +11452,7 @@ index 000000000..6b285723a
 +  }
 +
 +  /**
-+   * ROW BINDING. keccak256 of the canonical v2 pre-image, as 64-hex with no {@code 0x}.
++   * D-146. keccak256 of the canonical v2 pre-image, as 64-hex with no {@code 0x}.
 +   *
 +   * @param registry the loaded registry, which must be proof-bound
 +   * @param chainId the chain id this registry is bound to
@@ -8593,7 +11463,7 @@ index 000000000..6b285723a
 +  }
 +
 +  /**
-+   * ROW BINDING. The canonical hash OF THIS REGISTRY: v2 when it carries binding proofs, v1 when it does
++   * D-146. The canonical hash OF THIS REGISTRY: v2 when it carries binding proofs, v1 when it does
 +   * not. Every comparison against a schedule entry goes through here, so a proof-bound registry is
 +   * compared as v2 everywhere and a legacy one keeps exactly the number it had before this change.
 +   *
@@ -8606,13 +11476,13 @@ index 000000000..6b285723a
 +  }
 +
 +  /**
-+   * ROW BINDING. The ARMING precondition: refuse to arm the anchor over a registry whose rows are not
++   * D-146. The ARMING precondition: refuse to arm the anchor over a registry whose rows are not
 +   * bound to their validator addresses by signatures.
 +   *
 +   * 
      The shape is deliberately the same as {@code AERE-PQC-REG-ARM-01}, which already refuses to
 +   * arm over a registry with no validator addresses at all, and for the same reason: arming is the
 +   * last moment at which the registry format can still be changed. The anchor contract is immutable
-+   * once written, so a fleet armed over unbound rows carries that defect for the life of the chain.
++   * once written, so a fleet armed over unbound rows carries D-146 for the life of the chain.
 +   *
 +   * 
      WIRED 2026-08-06. It is called from {@code
 +   * FalconSealSupport.requireRegistryBindingProofsOrAbort()}, in the constructor, immediately after
@@ -8630,7 +11500,7 @@ index 000000000..6b285723a
 +    }
 +    throw new RegistryConfigException(
 +        "AERE-PQC-REG-ARM-02",
-+        "AERE PQC ROW-BINDING: REFUSING TO ARM (fail-closed) over the registry "
++        "AERE PQC D-146: REFUSING TO ARM (fail-closed) over the registry "
 +            + (registry == null ? "(none)" : "'" + registry.sourcePath() + "'")
 +            + ", which carries NO binding proofs. Nothing in such a registry connects a Falcon "
 +            + "public key to the validator address on the same row, so whoever writes the file "
@@ -8715,7 +11585,7 @@ index 000000000..6b285723a
 +    } catch (final IOException e) {
 +      throw new RegistryConfigException(
 +          "AERE-PQC-REG-LOAD-01",
-+          "AERE PQC GENESIS-BINDING: cannot read the Falcon registry file '"
++          "AERE PQC A8: cannot read the Falcon registry file '"
 +              + path
 +              + "': "
 +              + e
@@ -8728,7 +11598,7 @@ index 000000000..6b285723a
 +    if (countRaw == null) {
 +      throw new RegistryConfigException(
 +          "AERE-PQC-REG-LOAD-02",
-+          "AERE PQC GENESIS-BINDING: the Falcon registry '"
++          "AERE PQC A8: the Falcon registry '"
 +              + path
 +              + "' has no 'count' property. Refusing to continue (fail-closed): without a declared "
 +              + "count there is no way to tell a complete registry from one that lost its last "
@@ -8737,7 +11607,7 @@ index 000000000..6b285723a
 +    }
 +    final int count = parsePositiveInt(countRaw, "count", path.toString());
 +
-+    // AERE ROW BINDING. Header fields of the v2 format. A v1 node reading a v2 file does NOT silently
++    // AERE D-146. Header fields of the v2 format. A v1 node reading a v2 file does NOT silently
 +    // ignore these: parseIndexOrThrow refuses an unrecognised key, so an old binary handed a bound
 +    // registry REFUSES rather than loading it with the proofs dropped. That is the correct
 +    // direction of failure and it is why the fields are plain top-level names.
@@ -8774,7 +11644,7 @@ index 000000000..6b285723a
 +        if (a.length != 20) {
 +          throw new RegistryConfigException(
 +              "AERE-PQC-REG-LOAD-03",
-+              "AERE PQC GENESIS-BINDING: registry '"
++              "AERE PQC A8: registry '"
 +                  + path
 +                  + "' entry "
 +                  + i
@@ -8825,7 +11695,7 @@ index 000000000..6b285723a
 +    if (cfg.isMissingNode()) {
 +      throw new RegistryConfigException(
 +          "AERE-PQC-REG-LOAD-04",
-+          "AERE PQC GENESIS-BINDING: genesis '"
++          "AERE PQC A8: genesis '"
 +              + genesisPath
 +              + "' has no config.aereFalconRegistry manifest. Refusing to continue (fail-closed).");
 +    }
@@ -8846,7 +11716,7 @@ index 000000000..6b285723a
 +    } catch (final IOException e) {
 +      throw new RegistryConfigException(
 +          "AERE-PQC-REG-LOAD-01",
-+          "AERE PQC GENESIS-BINDING: cannot read '" + path + "': " + e + ". Refusing to continue (fail-closed).");
++          "AERE PQC A8: cannot read '" + path + "': " + e + ". Refusing to continue (fail-closed).");
 +    }
 +    int i = 0;
 +    while (i < raw.length && Character.isWhitespace((char) (raw[i] & 0xff))) {
@@ -8867,7 +11737,7 @@ index 000000000..6b285723a
 +    if (cfg == null || cfg.isMissingNode() || !cfg.has("count")) {
 +      throw new RegistryConfigException(
 +          "AERE-PQC-REG-LOAD-05",
-+          "AERE PQC GENESIS-BINDING: manifest '" + source + "' has no 'count'. Refusing (fail-closed).");
++          "AERE PQC A8: manifest '" + source + "' has no 'count'. Refusing (fail-closed).");
 +    }
 +    final int count = parsePositiveInt(cfg.get("count").asText(), "count", source);
 +
@@ -8895,7 +11765,7 @@ index 000000000..6b285723a
 +      } catch (final NumberFormatException e) {
 +        throw new RegistryConfigException(
 +            "AERE-PQC-REG-LOAD-18",
-+            "AERE PQC GENESIS-BINDING: manifest '"
++            "AERE PQC A8: manifest '"
 +                + source
 +                + "' has the unrecognised field '"
 +                + n
@@ -8908,7 +11778,7 @@ index 000000000..6b285723a
 +    if (!strays.isEmpty()) {
 +      throw new RegistryConfigException(
 +          "AERE-PQC-REG-LOAD-09",
-+          "AERE PQC GENESIS-BINDING: manifest '"
++          "AERE PQC A8: manifest '"
 +              + source
 +              + "' declares count="
 +              + count
@@ -8941,7 +11811,7 @@ index 000000000..6b285723a
 +      if (e == null) {
 +        throw new RegistryConfigException(
 +            "AERE-PQC-REG-LOAD-06",
-+            "AERE PQC GENESIS-BINDING: manifest '"
++            "AERE PQC A8: manifest '"
 +                + source
 +                + "' declares count="
 +                + count
@@ -8955,7 +11825,7 @@ index 000000000..6b285723a
 +        if (a == null || !a.isTextual() || k == null || !k.isTextual()) {
 +          throw new RegistryConfigException(
 +              "AERE-PQC-REG-LOAD-07",
-+              "AERE PQC GENESIS-BINDING: manifest '"
++              "AERE PQC A8: manifest '"
 +                  + source
 +                  + "' entry "
 +                  + i
@@ -8965,7 +11835,7 @@ index 000000000..6b285723a
 +        if (addr.length != 20) {
 +          throw new RegistryConfigException(
 +              "AERE-PQC-REG-LOAD-03",
-+              "AERE PQC GENESIS-BINDING: manifest '"
++              "AERE PQC A8: manifest '"
 +                  + source
 +                  + "' entry "
 +                  + i
@@ -8988,7 +11858,7 @@ index 000000000..6b285723a
 +      } else {
 +        throw new RegistryConfigException(
 +            "AERE-PQC-REG-LOAD-08",
-+            "AERE PQC GENESIS-BINDING: manifest '"
++            "AERE PQC A8: manifest '"
 +                + source
 +                + "' entry "
 +                + i
@@ -9005,7 +11875,7 @@ index 000000000..6b285723a
 +   * -Werror}, so a concrete collection type in a method signature is a build FAILURE, not a style
 +   * note. This file had been type-checked standalone with {@code javac -Xlint:all} and reported
 +   * clean; that is a weaker statement than it sounds, and the difference is the whole reason the
-+   * wiring had to be compiled in the real tree before this could be called closed. {@code
++   * wiring had to be compiled in the real tree before A8 could be called closed. {@code
 +   * NavigableMap} keeps the guarantee the code actually relies on, which is ascending key order.
 +   */
 +  private static Registry assemble(
@@ -9023,7 +11893,7 @@ index 000000000..6b285723a
 +    if (pks.size() != count) {
 +      throw new RegistryConfigException(
 +          "AERE-PQC-REG-LOAD-09",
-+          "AERE PQC GENESIS-BINDING: registry '"
++          "AERE PQC A8: registry '"
 +              + source
 +              + "' declares count="
 +              + count
@@ -9040,7 +11910,7 @@ index 000000000..6b285723a
 +      if (!pks.containsKey(i)) {
 +        throw new RegistryConfigException(
 +            "AERE-PQC-REG-LOAD-10",
-+            "AERE PQC GENESIS-BINDING: registry '"
++            "AERE PQC A8: registry '"
 +                + source
 +                + "' is missing index "
 +                + i
@@ -9053,7 +11923,7 @@ index 000000000..6b285723a
 +      if (pks.get(i).length == 0) {
 +        throw new RegistryConfigException(
 +            "AERE-PQC-REG-LOAD-11",
-+            "AERE PQC GENESIS-BINDING: registry '" + source + "' index " + i + " has an EMPTY public key. "
++            "AERE PQC A8: registry '" + source + "' index " + i + " has an EMPTY public key. "
 +                + "Refusing (fail-closed).");
 +      }
 +    }
@@ -9066,7 +11936,7 @@ index 000000000..6b285723a
 +        if (!addrs.containsKey(i)) {
 +          throw new RegistryConfigException(
 +              "AERE-PQC-REG-LOAD-12",
-+              "AERE PQC GENESIS-BINDING: registry '"
++              "AERE PQC A8: registry '"
 +                  + source
 +                  + "' binds addresses for "
 +                  + addrs.keySet()
@@ -9078,7 +11948,7 @@ index 000000000..6b285723a
 +    } else {
 +      throw new RegistryConfigException(
 +          "AERE-PQC-REG-LOAD-12",
-+          "AERE PQC GENESIS-BINDING: registry '"
++          "AERE PQC A8: registry '"
 +              + source
 +              + "' is MIXED: "
 +              + addrs.size()
@@ -9089,7 +11959,7 @@ index 000000000..6b285723a
 +    }
 +
 +    // ===============================================================================
-+    // AERE ROW BINDING (2026-08-06). UNIQUENESS. Nothing here needs a signature, and it is the half that
++    // AERE D-146 (2026-08-06). UNIQUENESS. Nothing here needs a signature, and it is the half that
 +    // makes the THRESHOLD real again.
 +    //
 +    // MEASURED on the real verification path: a registry carrying ONE public key at TWO indices was
@@ -9111,7 +11981,7 @@ index 000000000..6b285723a
 +      if (first != null) {
 +        throw new RegistryConfigException(
 +            "AERE-PQC-REG-LOAD-19",
-+            "AERE PQC ROW-BINDING: registry '"
++            "AERE PQC D-146: registry '"
 +                + source
 +                + "' carries the SAME Falcon public key at index "
 +                + first
@@ -9133,7 +12003,7 @@ index 000000000..6b285723a
 +        if (first != null) {
 +          throw new RegistryConfigException(
 +              "AERE-PQC-REG-LOAD-20",
-+              "AERE PQC ROW-BINDING: registry '"
++              "AERE PQC D-146: registry '"
 +                  + source
 +                  + "' binds the SAME validator address 0x"
 +                  + a
@@ -9148,7 +12018,7 @@ index 000000000..6b285723a
 +      }
 +    }
 +
-+    // AERE ROW BINDING. FORMAT COHERENCE. Binding proofs are all-or-nothing, exactly like address binding,
++    // AERE D-146. FORMAT COHERENCE. Binding proofs are all-or-nothing, exactly like address binding,
 +    // and for the same reason: one unproven row counts toward the threshold like a proven one.
 +    final boolean anyProof = !pops.isEmpty() || !claims.isEmpty();
 +    final boolean proofBound;
@@ -9156,7 +12026,7 @@ index 000000000..6b285723a
 +      if (pops.size() != count || claims.size() != count) {
 +        throw new RegistryConfigException(
 +            "AERE-PQC-REG-LOAD-21",
-+            "AERE PQC ROW-BINDING: registry '"
++            "AERE PQC D-146: registry '"
 +                + source
 +                + "' declares count="
 +                + count
@@ -9171,7 +12041,7 @@ index 000000000..6b285723a
 +      if (declaredChainId < 0 || bindHeight < 0) {
 +        throw new RegistryConfigException(
 +            "AERE-PQC-REG-LOAD-22",
-+            "AERE PQC ROW-BINDING: registry '"
++            "AERE PQC D-146: registry '"
 +                + source
 +                + "' carries binding proofs but does not declare both 'chainId' and 'bindHeight'. "
 +                + "Both are inside the signed message, so without them the proofs cannot even be "
@@ -9193,7 +12063,7 @@ index 000000000..6b285723a
 +              proofBound ? claims.get(i) : null));
 +      if (pks.get(i).length != FALCON_512_PK_LENGTH) {
 +        LOG.warn(
-+            "AERE PQC GENESIS-BINDING: registry '{}' index {} carries a {}-byte public key; Falcon-512 public "
++            "AERE PQC A8: registry '{}' index {} carries a {}-byte public key; Falcon-512 public "
 +                + "keys are {} bytes. The registry is NOT rejected for this (the canonical form is "
 +                + "length-prefixed and handles any length), but it is almost certainly the wrong "
 +                + "file or a truncated copy.",
@@ -9205,18 +12075,18 @@ index 000000000..6b285723a
 +    }
 +    final Registry assembled =
 +        new Registry(kind, source, entries, bound, proofBound, declaredChainId, bindHeight);
-+    // AERE ROW BINDING. THE VERIFICATION ITSELF, on the single path every loader funnels through, so it
++    // AERE D-146. THE VERIFICATION ITSELF, on the single path every loader funnels through, so it
 +    // runs at every restart on every node and not only once at the ceremony. Fail-closed, and O(N)
 +    // per process start with zero cost per block.
 +    PqRegistryBinding.verifyOrThrow(assembled);
 +    if (!proofBound) {
 +      LOG.warn(
-+          "AERE PQC ROW-BINDING: registry '{}' ({} rows) carries NO binding proofs. Nothing in it "
++          "AERE PQC D-146: registry '{}' ({} rows) carries NO binding proofs. Nothing in it "
 +              + "connects a Falcon public key to the validator address on the same row, so whoever "
 +              + "wrote this file decided who every seal is credited to. Measured 2026-08-06 on the "
 +              + "real verification path: swapping two rows produces an ACCEPTED header with no "
-+              + "duplicate key and no duplicate address. This is the row-binding defect, and it "
-+              + "is not closed on this node.",
++              + "duplicate key and no duplicate address. This is D-146 and it is not closed on this "
++              + "node.",
 +          source,
 +          count);
 +    }
@@ -9352,7 +12222,7 @@ index 000000000..6b285723a
 +      if (node.isEmpty()) {
 +        throw new RegistryConfigException(
 +            "AERE-PQC-REG-SCHED-01",
-+            "AERE PQC GENESIS-BINDING: "
++            "AERE PQC A8: "
 +                + source
 +                + " is an EMPTY array. Refusing to start (fail-closed): an empty schedule is not "
 +                + "the same statement as an absent one, and guessing which was meant is exactly how "
@@ -9364,7 +12234,7 @@ index 000000000..6b285723a
 +        if (!e.isObject() || !e.has("block") || !e.has("hash")) {
 +          throw new RegistryConfigException(
 +              "AERE-PQC-REG-SCHED-02",
-+              "AERE PQC GENESIS-BINDING: "
++              "AERE PQC A8: "
 +                  + source
 +                  + " entry "
 +                  + e
@@ -9374,7 +12244,7 @@ index 000000000..6b285723a
 +        if (block < 0) {
 +          throw new RegistryConfigException(
 +              "AERE-PQC-REG-SCHED-03",
-+              "AERE PQC GENESIS-BINDING: "
++              "AERE PQC A8: "
 +                  + source
 +                  + " has a negative or unparseable block in "
 +                  + e
@@ -9383,7 +12253,7 @@ index 000000000..6b285723a
 +        if (block <= previous) {
 +          throw new RegistryConfigException(
 +              "AERE-PQC-REG-SCHED-04",
-+              "AERE PQC GENESIS-BINDING: "
++              "AERE PQC A8: "
 +                  + source
 +                  + " blocks are not STRICTLY INCREASING ("
 +                  + previous
@@ -9399,7 +12269,7 @@ index 000000000..6b285723a
 +    } else {
 +      throw new RegistryConfigException(
 +          "AERE-PQC-REG-SCHED-05",
-+          "AERE PQC GENESIS-BINDING: "
++          "AERE PQC A8: "
 +              + source
 +              + " must be a 0x-prefixed 32-byte hash or an array of {block, hash}; found "
 +              + node.getNodeType()
@@ -9466,11 +12336,11 @@ index 000000000..6b285723a
 +  }
 +
 +  // ===================================================================================
-+  // HEIGHT SCHEDULE: the whole scheduled history, not only the entry in force at the head
++  // D-081: the whole scheduled history, not only the entry in force at the head
 +  // ===================================================================================
 +
 +  /**
-+   * HEIGHT SCHEDULE. The registries a node holds, indexed by the SCHEDULE ENTRY each one satisfies.
++   * D-081. The registries a node holds, indexed by the SCHEDULE ENTRY each one satisfies.
 +   *
 +   * 
      THE DEFECT THIS EXISTS TO CLOSE, measured and not assumed. {@code config.pqRegistryHash} is a
 +   * schedule, and a second entry is how a key rotation or a revocation is expressed. Enforcement,
@@ -9507,7 +12377,7 @@ index 000000000..6b285723a
 +    private final List entryBlocks; // ascending, one per COVERED schedule entry
 +    private final List entryRegistries; // parallel to entryBlocks
 +    private final List uncovered; // schedule entry blocks with no matching registry
-+    private final List misbound; // signed height did not match the scheduled one
++    private final List misbound; // D-B: hash matched, signed height did not
 +
 +    RegistrySet(
 +        final List loaded,
@@ -9550,7 +12420,7 @@ index 000000000..6b285723a
 +    }
 +
 +    /**
-+     * SIGNED-HEIGHT CHECK. The schedule entries a held registry reproduces BY HASH and yet was not signed for.
++     * D-B. The schedule entries a held registry reproduces BY HASH and yet was not signed for.
 +     *
 +     * @return an unmodifiable list, empty when every covered entry is coherently signed
 +     */
@@ -9617,7 +12487,7 @@ index 000000000..6b285723a
 +  }
 +
 +  /**
-+   * HEIGHT SCHEDULE. Bind a set of loaded registries to the schedule by canonical hash.
++   * D-081. Bind a set of loaded registries to the schedule by canonical hash.
 +   *
 +   * 
      The binding is by HASH and never by order or by file name: a registry covers the entry whose
 +   * required hash it reproduces, and nothing else makes it cover anything. An operator therefore
@@ -9646,8 +12516,8 @@ index 000000000..6b285723a
 +        if (!hashFor(r, chainId).equalsIgnoreCase(e.hash)) {
 +          continue;
 +        }
-+        // AERE SIGNED-HEIGHT CHECK (2026-08-06). THE LINK THAT WAS NEVER DRAWN. Both numbers have been in this
-+        // lexical scope since the height schedule was written and they were never put on the same expression.
++        // AERE D-B (2026-08-06). THE LINK THAT WAS NEVER DRAWN. Both numbers have been in this
++        // lexical scope since D-081 was written and they were never put on the same expression.
 +        //
 +        // bindHeight is the height every row's possession proof and every row's validator claim
 +        // were SIGNED OVER (PqRegistryBinding.bindingPreimage). e.block is the height from which
@@ -9659,9 +12529,9 @@ index 000000000..6b285723a
 +        // The node and the tool disagreed and nothing put them face to face.
 +        //
 +        // WHAT THAT BUYS AN OPERATOR WHO IS NOT SUPPOSED TO HAVE IT: moving the activation day
-+        // costs 14 fresh signatures if this is checked, and ZERO if it is not. The seven
-+        // validators' agreement on a height is only an agreement if something refuses the heights
-+        // they did not sign.
++        // costs two fresh signatures per validator if this is checked, and ZERO if it is not.
++        // The validators' agreement on a height is only an agreement if something refuses the
++        // heights they did not sign.
 +        if (r.proofBound() && r.bindHeight() != e.block) {
 +          misbound.add(new Misbound(e.block, e.hash, r.sourcePath(), r.bindHeight()));
 +          continue;
@@ -9680,7 +12550,7 @@ index 000000000..6b285723a
 +  }
 +
 +  /**
-+   * SIGNED-HEIGHT CHECK. One schedule entry whose required hash a held registry reproduces, and whose height that
++   * D-B. One schedule entry whose required hash a held registry reproduces, and whose height that
 +   * registry's binding proofs were not signed over.
 +   *
 +   * @param entryBlock the height genesis puts the registry in force from
@@ -9692,7 +12562,7 @@ index 000000000..6b285723a
 +      long entryBlock, String entryHash, String registryPath, long signedHeight) {}
 +
 +  /**
-+   * HEIGHT SCHEDULE. Load every registry named and bind the result to the schedule.
++   * D-081. Load every registry named and bind the result to the schedule.
 +   *
 +   * @param schedule the parsed schedule
 +   * @param paths the registry files this node holds
@@ -9710,7 +12580,7 @@ index 000000000..6b285723a
 +  }
 +
 +  /**
-+   * HEIGHT SCHEDULE. Split a comma-separated list of registry paths. Blank elements are dropped; a null or
++   * D-081. Split a comma-separated list of registry paths. Blank elements are dropped; a null or
 +   * blank list gives an empty result rather than a path named "".
 +   *
 +   * @param raw the configured value, may be null
@@ -9731,7 +12601,7 @@ index 000000000..6b285723a
 +  }
 +
 +  /**
-+   * HEIGHT SCHEDULE. The registry in force at a height: the one bound to the schedule entry active there.
++   * D-081. The registry in force at a height: the one bound to the schedule entry active there.
 +   *
 +   * 
      This is the function Falcon verification needs. A certificate in a block at height h was
 +   * produced under the key set the chain required at h, so it must be checked against that key set
@@ -9752,7 +12622,7 @@ index 000000000..6b285723a
 +  }
 +
 +  /**
-+   * HEIGHT SCHEDULE. Whether the registries this node holds satisfy the binding active at a height.
++   * D-081. Whether the registries this node holds satisfy the binding active at a height.
 +   *
 +   * 
      The hash is RECOMPUTED here rather than trusted from the binding built earlier, so that this
 +   * answer is a positive proof about the bytes the node is holding right now and not a restatement
@@ -9858,9 +12728,9 @@ index 000000000..6b285723a
 +  }
 +
 +  /**
-+   * AERE HELD-SET SCOPE (2026-08-06). THE SAME GUARD, ASKED OF EVERY REGISTRY THIS NODE HOLDS.
++   * AERE D-A (2026-08-06). THE SAME GUARD, ASKED OF EVERY REGISTRY THIS NODE HOLDS.
 +   *
-+   * 
      WHY THIS OVERLOAD HAD TO EXIST, and it is not tidiness. The height schedule gave a node a HISTORY of
++   * 
      WHY THIS OVERLOAD HAD TO EXIST, and it is not tidiness. D-081 gave a node a HISTORY of
 +   * registry files, one per rotation the chain has ever performed, precisely so that a node can
 +   * validate blocks produced under a retired key set. The startup guard was never told. It compared
 +   * the schedule against ONE registry, the one named by {@code registrySourcePath}, and the history
@@ -9887,19 +12757,19 @@ index 000000000..6b285723a
 +      final long chainHeadNumber,
 +      final long chainId) {
 +
-+    // AERE ROW BINDING. The proofs are signed over a chainId the FILE declares. A registry lifted from
++    // AERE D-146. The proofs are signed over a chainId the FILE declares. A registry lifted from
 +    // the scratch chain 442807 carries proofs that verify perfectly among themselves - they are
 +    // internally consistent, just for another chain - and would otherwise pass. Fail-closed here,
 +    // where the node's real chain id is known and the file's is not yet trusted.
 +    //
-+    // AERE HELD-SET SCOPE (2026-08-06): over EVERY held file, not only the primary. A history file lifted from
++    // AERE D-A (2026-08-06): over EVERY held file, not only the primary. A history file lifted from
 +    // the scratch chain is exactly as dangerous as a primary one - it is the file that answers for
 +    // an interval of history - and before this it was never asked.
 +    for (final Registry r : set.loaded()) {
 +      if (r.proofBound() && r.declaredChainId() != chainId) {
 +        throw new RegistryConfigException(
 +            "AERE-PQC-REG-BIND-07",
-+            "AERE PQC ROW-BINDING: registry '"
++            "AERE PQC D-146: registry '"
 +                + r.sourcePath()
 +                + "' declares chainId="
 +                + r.declaredChainId()
@@ -9914,7 +12784,7 @@ index 000000000..6b285723a
 +
 +    if (!schedule.enforced()) {
 +      LOG.warn(
-+          "AERE PQC GENESIS-BINDING: pqRegistryHash is NOT CONFIGURED ({}), so the Falcon registry is NOT bound "
++          "AERE PQC A8: pqRegistryHash is NOT CONFIGURED ({}), so the Falcon registry is NOT bound "
 +              + "to consensus on this node. The registry currently loaded is {} ({}, {} entries, "
 +              + "address-bound={}), canonical hash 0x{}. Two nodes holding DIFFERENT registry files "
 +              + "will disagree about which public key validator index i has, so the same "
@@ -9925,18 +12795,18 @@ index 000000000..6b285723a
 +          registry == null ? SourceKind.NONE : registry.kind(),
 +          registry == null ? 0 : registry.count(),
 +          registry != null && registry.addressBound(),
-+          // GENESIS BINDING, measured on a fleet of seven on 2026-08-06: this printed hashV1 next
-+          // to the text "put this in config.pqRegistryHash", while THE GATE compares hashFor,
-+          // which for a registry carrying proofs is hashV2. With the printed value put into
-+          // genesis, all seven nodes start, all seven report the registry loaded, and THE CHAIN
-+          // STOPS AT H-1. The guard shouts NOT CORRECTLY STAGED, so it is not a silent halt, but
-+          // the operator who follows the node's own instruction halts the fleet. A wrong
-+          // instruction is more dangerous than no instruction at all.
++          // A8, measured on a fleet of seven on 2026-08-06: this printed hashV1 next to the text
++          // "put this in config.pqRegistryHash", while THE GATE compares hashFor, which for a
++          // registry carrying proofs is hashV2. With the printed value put into genesis, all seven
++          // nodes start, all seven report the registry loaded, and THE CHAIN STOPS AT H-1. The
++          // guard shouts NOT CORRECTLY STAGED, so it is not a silent halt, but the operator who
++          // follows the node's own instruction halts the fleet. A wrong instruction is more
++          // dangerous than no instruction at all.
 +          registry == null ? "(no registry)" : hashFor(registry, chainId));
 +      return GateState.NOT_ENFORCED_NO_SCHEDULE;
 +    }
 +
-+    // AERE SIGNED-HEIGHT CHECK (2026-08-06). THE SILENT DEFERRAL. Placed HERE, below the not-enforced exit above,
++    // AERE D-B (2026-08-06). THE SILENT DEFERRAL. Placed HERE, below the not-enforced exit above,
 +    // and that position is a rule and not a preference: on chain 2800 config.pqRegistryHash does not
 +    // exist, schedule.enforced() is false, and the return above is the first executable statement
 +    // this guard reaches. Nothing new is ever put above it.
@@ -9961,7 +12831,7 @@ index 000000000..6b285723a
 +      }
 +      throw new RegistryConfigException(
 +          "AERE-PQC-REG-BIND-08",
-+          "AERE PQC SIGNED-HEIGHT: REFUSING TO START - a registry this node holds is scheduled at a height "
++          "AERE PQC D-B: REFUSING TO START - a registry this node holds is scheduled at a height "
 +              + "its validators never signed for.\n"
 +              + "  FIELD:  'bindHeight', inside the registry file, versus 'block' of the matching "
 +              + "entry of config.pqRegistryHash in genesis ("
@@ -10003,8 +12873,8 @@ index 000000000..6b285723a
 +    //   - the operator puts the OLD registry back: the node starts and still cannot pass X.
 +    //     Measured.
 +    // Old registry: starts, cannot advance. New registry: cannot start. There was no third file,
-+    // and the only exit measured was to set the emergency bypass on every node, i.e. to switch
-+    // the genesis binding off across the whole fleet in order to cross a PLANNED rotation.
++    // and the only exit measured was to set the emergency bypass on every node, i.e. to switch A8
++    // off across the whole fleet in order to cross a PLANNED rotation.
 +    //
 +    // chainHead + 1 is the question the node can actually act on: the only header it will be
 +    // offered next is chainHead + 1, and PqRegistryBindingRule judges that header against the entry
@@ -10019,13 +12889,13 @@ index 000000000..6b285723a
 +
 +    if (active.isEmpty()) {
 +      final ScheduleEntry first = schedule.entries.get(0);
-+      // AERE HELD-SET SCOPE: ask the SET, not only the primary. A node staged for the activation may already
++      // AERE D-A: ask the SET, not only the primary. A node staged for the activation may already
 +      // hold the activation registry as history while still signing under the current one.
 +      final Registry staged = set.forEntryBlock(first.block());
 +      final String computed = registry == null ? null : hashFor(registry, chainId);
 +      if (staged != null) {
 +        LOG.info(
-+            "AERE PQC GENESIS-BINDING: registry binding is scheduled to start at block {} and this node's chain "
++            "AERE PQC A8: registry binding is scheduled to start at block {} and this node's chain "
 +                + "head is {}, so nothing is enforced yet. The registry already loaded ({}, {} "
 +                + "entries) ALREADY MATCHES the hash required from block {}: 0x{}. This node is "
 +                + "correctly staged for the activation.",
@@ -10037,7 +12907,7 @@ index 000000000..6b285723a
 +            hashFor(staged, chainId));
 +      } else {
 +        LOG.error(
-+            "AERE PQC GENESIS-BINDING: registry binding starts at block {} and this node's chain head is {}, so "
++            "AERE PQC A8: registry binding starts at block {} and this node's chain head is {}, so "
 +                + "nothing is enforced yet AND THIS NODE IS NOT CORRECTLY STAGED. Required from "
 +                + "block {}: 0x{}. Loaded here: {}. This node will run normally and will then "
 +                + "REFUSE the header at block {} (AERE-PQC-REG-BLOCK-01) and stop there. Install "
@@ -10061,7 +12931,7 @@ index 000000000..6b285723a
 +    if (set.count() == 0) {
 +      throw new RegistryConfigException(
 +          "AERE-PQC-REG-MISMATCH-02",
-+          "AERE PQC GENESIS-BINDING: REFUSING TO START.\n"
++          "AERE PQC A8: REFUSING TO START.\n"
 +              + "  EXPECTED: a Falcon validator registry whose canonical hash is\n"
 +              + "              0x"
 +              + required.hash()
@@ -10100,14 +12970,14 @@ index 000000000..6b285723a
 +    }
 +
 +    final String computed = hashFor(registry, chainId);
-+    // AERE HELD-SET SCOPE (2026-08-06): the binding is satisfied by ANY file this node holds for this entry,
++    // AERE D-A (2026-08-06): the binding is satisfied by ANY file this node holds for this entry,
 +    // not only by the one it signs with. Before this line the answer came from the primary registry
 +    // alone, and after the first rotation the primary is by definition NOT the file that answers for
 +    // the interval below the rotation.
 +    final Registry bound = set.forEntryBlock(required.block());
 +    if (bound != null) {
 +      LOG.info(
-+          "AERE PQC GENESIS-BINDING: registry binding SATISFIED. Loaded {} ({}, {} entries, address-bound={}); "
++          "AERE PQC A8: registry binding SATISFIED. Loaded {} ({}, {} entries, address-bound={}); "
 +              + "canonical hash 0x{} equals the hash required from block {} by genesis "
 +              + "config.pqRegistryHash, read from [{}]. Chain head {}, chainId {}. This node holds "
 +              + "{} registry file(s) in total. {}",
@@ -10117,7 +12987,7 @@ index 000000000..6b285723a
 +          bound.addressBound(),
 +          hashFor(bound, chainId),
 +          required.block(),
-+          // AERE GENESIS BINDING: naming the PROVENANCE of the schedule is not decoration. The whole defect
++          // AERE A8: naming the PROVENANCE of the schedule is not decoration. The whole defect
 +          // class is "a value that came from somewhere nobody checked", so a line that says the
 +          // binding is satisfied without saying what it was read from asserts more than it knows.
 +          schedule.source(),
@@ -10147,7 +13017,7 @@ index 000000000..6b285723a
 +
 +    throw new RegistryConfigException(
 +        "AERE-PQC-REG-MISMATCH-01",
-+        "AERE PQC GENESIS-BINDING: REFUSING TO START - the Falcon validator registry on this node is NOT the one "
++        "AERE PQC A8: REFUSING TO START - the Falcon validator registry on this node is NOT the one "
 +            + "this chain requires.\n"
 +            + "  EXPECTED hash: 0x"
 +            + required.hash()
@@ -10199,7 +13069,7 @@ index 000000000..6b285723a
 +  }
 +
 +  /**
-+   * AERE HELD-SET SCOPE. Every registry file this node holds and which scheduled interval each one answers for.
++   * AERE D-A. Every registry file this node holds and which scheduled interval each one answers for.
 +   * Without this an operator reading {@code MISMATCH-01} cannot tell "I gave this node one file and
 +   * it is the wrong one" from "I gave it four and none covers this height", which are different
 +   * mistakes with different fixes.
@@ -10243,12 +13113,11 @@ index 000000000..6b285723a
 +    b.append("    entries     : ").append(registry.count()).append('\n');
 +    b.append("    addressBound: ").append(registry.addressBound()).append('\n');
 +    b.append("    format:       ")
-+        .append(registry.proofBound() ? "v2, binding proofs present" : "v1, NO binding proofs")
++        .append(registry.proofBound() ? "v2, D-146 binding proofs present" : "v1, NO binding proofs")
 +        .append('\n');
-+    // GENESIS BINDING: the report printed both v1 and v2 without saying WHICH one goes into
-+    // genesis, and whoever took the last value off the screen took v1 and halted the fleet at
-+    // H-1. The one that matters is now named explicitly, and it is the very one the gate
-+    // compares: hashFor.
++    // A8: the report printed both v1 and v2 without saying WHICH one goes into genesis, and
++    // whoever took the last value off the screen took v1 and halted the fleet at H-1. The one
++    // that matters is now named explicitly, and it is the very one the gate compares: hashFor.
 +    b.append("    >>> FOR config.pqRegistryHash: 0x")
 +        .append(hashFor(registry, chainId))
 +        .append("   <<< this one, and only this one\n");
@@ -10293,7 +13162,7 @@ index 000000000..6b285723a
 +    } catch (final IOException e) {
 +      throw new RegistryConfigException(
 +          "AERE-PQC-REG-LOAD-13",
-+          "AERE PQC GENESIS-BINDING: cannot read or parse JSON at '"
++          "AERE PQC A8: cannot read or parse JSON at '"
 +              + path
 +              + "': "
 +              + e
@@ -10311,7 +13180,7 @@ index 000000000..6b285723a
 +    } catch (final NumberFormatException e) {
 +      throw new RegistryConfigException(
 +          "AERE-PQC-REG-LOAD-14",
-+          "AERE PQC GENESIS-BINDING: registry '"
++          "AERE PQC A8: registry '"
 +              + source
 +              + "' has the unrecognised key '"
 +              + raw
@@ -10323,7 +13192,7 @@ index 000000000..6b285723a
 +  }
 +
 +  /**
-+   * AERE ROW BINDING. Parse an OPTIONAL non-negative header field: absent means -1, present means it must
++   * AERE D-146. Parse an OPTIONAL non-negative header field: absent means -1, present means it must
 +   * be a well formed non-negative number. Absent-or-garbage is never collapsed into a default,
 +   * because a default is how a threshold quietly becomes zero.
 +   */
@@ -10338,7 +13207,7 @@ index 000000000..6b285723a
 +    } catch (final NumberFormatException e) {
 +      throw new RegistryConfigException(
 +          "AERE-PQC-REG-LOAD-23",
-+          "AERE PQC ROW-BINDING: registry '"
++          "AERE PQC D-146: registry '"
 +              + source
 +              + "' has "
 +              + what
@@ -10349,7 +13218,7 @@ index 000000000..6b285723a
 +    if (v < 0) {
 +      throw new RegistryConfigException(
 +          "AERE-PQC-REG-LOAD-23",
-+          "AERE PQC ROW-BINDING: registry '"
++          "AERE PQC D-146: registry '"
 +              + source
 +              + "' has a negative "
 +              + what
@@ -10370,7 +13239,7 @@ index 000000000..6b285723a
 +    } catch (final NumberFormatException e) {
 +      throw new RegistryConfigException(
 +          "AERE-PQC-REG-LOAD-15",
-+          "AERE PQC GENESIS-BINDING: registry '"
++          "AERE PQC A8: registry '"
 +              + source
 +              + "' has a malformed "
 +              + what
@@ -10395,7 +13264,7 @@ index 000000000..6b285723a
 +    if (s.isEmpty() || (s.length() & 1) == 1) {
 +      throw new RegistryConfigException(
 +          "AERE-PQC-REG-LOAD-16",
-+          "AERE PQC GENESIS-BINDING: registry '"
++          "AERE PQC A8: registry '"
 +              + source
 +              + "' "
 +              + what
@@ -10413,7 +13282,7 @@ index 000000000..6b285723a
 +      if (hi < 0 || lo < 0) {
 +        throw new RegistryConfigException(
 +            "AERE-PQC-REG-LOAD-17",
-+            "AERE PQC GENESIS-BINDING: registry '"
++            "AERE PQC A8: registry '"
 +                + source
 +                + "' "
 +                + what
@@ -10435,7 +13304,7 @@ index 000000000..6b285723a
 +    if (s.length() != 64) {
 +      throw new RegistryConfigException(
 +          "AERE-PQC-REG-SCHED-06",
-+          "AERE PQC GENESIS-BINDING: "
++          "AERE PQC A8: "
 +              + source
 +              + " carries the hash '"
 +              + raw
@@ -10447,7 +13316,7 @@ index 000000000..6b285723a
 +      if (Character.digit(s.charAt(i), 16) < 0) {
 +        throw new RegistryConfigException(
 +            "AERE-PQC-REG-SCHED-07",
-+            "AERE PQC GENESIS-BINDING: " + source + " hash '" + raw + "' is not hexadecimal. Refusing to start.");
++            "AERE PQC A8: " + source + " hash '" + raw + "' is not hexadecimal. Refusing to start.");
 +      }
 +    }
 +    return s;
@@ -10487,12 +13356,12 @@ index 000000000..6b285723a
 +}
 diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqRegistryHashTool.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqRegistryHashTool.java
 new file mode 100755
-index 000000000..e5d2675eb
+index 000000000..14071c5e4
 --- /dev/null
 +++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqRegistryHashTool.java
-@@ -0,0 +1,482 @@
+@@ -0,0 +1,481 @@
 +/*
-+ * Copyright contributors to Besu / Aere Network.
++ * Copyright contributors to Besu / AERE Network.
 + *
 + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
 + * the License. You may obtain a copy of the License at
@@ -10516,8 +13385,8 @@ index 000000000..e5d2675eb
 +import java.util.Optional;
 +
 +/**
-+ * REGISTRY SCHEDULE TOOL. The tool that writes and checks the two configuration values without
-+ * which the height-indexed registry repair changes nothing.
++ * D-145. The tool that writes and checks the two configuration values without which the D2 repair
++ * changes nothing.
 + *
 + * 
      WHY IT LIVES IN THE CONSENSUS MODULE AND NOT IN A SCRIPT. The value being computed is a
 + * keccak digest over a domain-separated, length-prefixed, chain-bound pre-image, and the node
@@ -10529,8 +13398,8 @@ index 000000000..e5d2675eb
 + *
 + * 
       + *   java -cp 'besu/lib/*' org.hyperledger.besu.consensus.common.bft.PqRegistryHashTool \
-+ *        verify --chain-id 2800 --genesis <config-dir>/genesis.json \
-+ *        --history <config-dir>/falcon/registry-epoca-0.properties
++ *        verify --chain-id 2800 --genesis ./genesis-2800.json \
++ *        --history ./falcon/registry-epoch-0.properties
 + * 
      
 + *
 + * 
      THREE VERBS.
@@ -10610,13 +13479,13 @@ index 000000000..e5d2675eb
 +    System.out.println("chainId=" + chainId + "  (goes INTO the pre-image; 2800 and 442807 give different hashes for the same registry)");
 +    for (final Path p : files) {
 +      final PqRegistryHash.Registry r = PqRegistryHash.loadAuto(p);
-+      // AERE CANONICAL FINGERPRINT (2026-08-06): hashFor, not hashV1. For a registry that carries
-+      // binding proofs, hashV1 is a number NOTHING in the node ever compares against: the guard
-+      // compares hashFor, that is hashV2. The same mistake, in the `generate` verb below, writes
-+      // into genesis a hash the node will never recognise, and then all seven start and the chain
-+      // stops at H-1. On top of that, hashV1 does NOT tell two rotation epochs of the same fleet
-+      // apart, because the bind height does not enter the v1 pre-image; so it cannot serve even as
-+      // an epoch identifier for diagnostics.
++      // AERE D-C (2026-08-06): hashFor, not hashV1. For a registry that carries binding proofs,
++      // hashV1 is a number NOTHING in the node ever compares against: the guard compares hashFor,
++      // that is hashV2. The same mistake, in the `generate` verb below, writes into genesis a hash
++      // the node will never recognise, and then all seven start and the chain stops at H-1.
++      // On top of that, hashV1 does NOT tell two rotation epochs of the same fleet apart, because the
++      // bind height does not enter the v1 pre-image; so it cannot serve even as an epoch identifier
++      // for diagnostics.
 +      System.out.println(
 +          "0x"
 +              + PqRegistryHash.hashFor(r, chainId)
@@ -10639,8 +13508,8 @@ index 000000000..e5d2675eb
 +    final String armingHeightRaw = o.get("arming-height");
 +    if (armingHeightRaw == null) {
 +      System.out.println("NOT MEASURED: --arming-height  is missing. The first entry of the");
-+      System.out.println("              schedule must be EXACTLY at aere.pq.anchorBlock: a later");
-+      System.out.println("              first entry leaves the arming height with no scheduled registry.");
++      System.out.println("              schedule must be EXACTLY at aere.pq.anchorBlock; see case D");
++      System.out.println("              of dovezi-d2-2026-08-06.");
 +      return 2;
 +    }
 +    final long h = Long.parseLong(armingHeightRaw);
@@ -10673,7 +13542,7 @@ index 000000000..e5d2675eb
 +    // The fragment LOOKS fine and CANNOT BE USED: genesis is read with Jackson without
 +    // ALLOW_COMMENTS, so a node handed one of those refuses to start with
 +    // [AERE-PQC-REG-LOAD-13] "Unexpected character ('/')", and it then refuses EVERY header from
-+    // the arming height upwards. Measured 2026-08-06, with two controls that reproduce the refusal.
++    // the arming height upwards. Measured 2026-08-06, cases U3/U4 in d2-v2/dovezi/controale/.
 +    // Whatever is explanation is printed outside the JSON, on lines beginning with #.
 +    final StringBuilder json = new StringBuilder();
 +    json.append("    \"pqRegistryHash\": [\n");
@@ -10683,17 +13552,17 @@ index 000000000..e5d2675eb
 +      final long b = inaltimi.get(i);
 +      final Path p = epoci.get(b);
 +      final PqRegistryHash.Registry reg = PqRegistryHash.loadAuto(p);
-+      // AERE CANONICAL FINGERPRINT (2026-08-06). THIS IS THE DANGEROUS VERB: what is printed here
-+      // gets pasted into genesis, and genesis is the document all seven nodes hold identical.
-+      // hashV1 next to a registry that carries proofs writes into genesis a number the node's guard
-+      // (hashFor) never produces, so all seven nodes start, all report the registry loaded, and the
-+      // chain stops at H-1. A wrong indication is more dangerous than a missing one.
++      // AERE D-C (2026-08-06). THIS IS THE DANGEROUS VERB: what is printed here gets pasted into
++      // genesis, and genesis is the document all seven nodes hold identical. hashV1 next to a
++      // registry that carries proofs writes into genesis a number the node's guard (hashFor) never
++      // produces, so all seven nodes start, all report the registry loaded, and the chain stops at
++      // H-1. A wrong indication is more dangerous than a missing one.
 +      final String hash = PqRegistryHash.hashFor(reg, chainId);
-+      // AERE SIGNED-HEIGHT CHECK (2026-08-06). The recipe we print has to be the one the NEW code
-+      // accepts. Since 2026-08-06 the node refuses to start (AERE-PQC-REG-BIND-08) on a registry
-+      // forced in at a height its proofs did not sign. If the tool printed that recipe, it would
-+      // manufacture exactly the configuration the node rejects, and it would do so in a file that
-+      // reaches all seven at once.
++      // AERE D-B (2026-08-06). The recipe we print has to be the one the NEW code accepts. Since
++      // 2026-08-06 the node refuses to start (AERE-PQC-REG-BIND-08) on a registry forced in at a
++      // height its proofs did not sign. If the tool printed that recipe, it would manufacture
++      // exactly the configuration the node rejects, and it would do so in a file that reaches all
++      // seven at once.
 +      if (reg.proofBound() && reg.bindHeight() != b) {
 +        System.out.println(
 +            "RED: registry "
@@ -10764,10 +13633,10 @@ index 000000000..e5d2675eb
 +      System.out.println(
 +          "RED: "
 +              + genesis
-+              + " does not carry config.pqRegistryHash. The height-indexed registry schedule "
-+              + "exists, it is complete, and it is OFF. A node armed without a schedule falls back "
-+              + "on TODAY's registry and says ACCEPTED for a header it has bound to no "
-+              + "height.");
++              + " does not carry config.pqRegistryHash. This is D-145 exactly as it was measured: "
++              + "the machinery exists, it is complete, and it is OFF. A node armed without a "
++              + "schedule falls back on TODAY's registry and says ACCEPTED for a header it has "
++              + "bound to no height (case D of dovezi-d2-2026-08-06).");
 +      return 1;
 +    }
 +
@@ -10804,10 +13673,9 @@ index 000000000..e5d2675eb
 +    }
 +    System.out.println("registries held  = " + set.count());
 +    for (final Path p : history) {
-+      // AERE CANONICAL FINGERPRINT: hashFor. This line sits immediately under the list of scheduled
-+      // epochs printed with their hashes; two numbers laid one under the other so that they get
-+      // compared by eye, and computed with two different functions, are a comparison that can never
-+      // match.
++      // AERE D-C: hashFor. This line sits immediately under the list of scheduled epochs printed
++      // with their hashes; two numbers laid one under the other so that they get compared by eye,
++      // and computed with two different functions, are a comparison that can never match.
 +      final PqRegistryHash.Registry r = PqRegistryHash.loadAuto(p);
 +      System.out.println(
 +          "  "
@@ -10818,9 +13686,9 @@ index 000000000..e5d2675eb
 +    }
 +    final String armareRaw = o.get("arming-height");
 +    int rc = 0;
-+    // AERE SIGNED-HEIGHT CHECK: the registries that reproduce the required hash and did NOT sign
-+    // that height. This is exactly what the node now refuses to start on; until 2026-08-06 the node
-+    // started and the tool said nothing.
++    // AERE D-B: the registries that reproduce the required hash and did NOT sign that height. This
++    // is exactly what the node now refuses to start on; until 2026-08-06 the node started and the
++    // tool said nothing.
 +    for (final PqRegistryHash.Misbound m : set.misbound()) {
 +      System.out.println(
 +          "RED: "
@@ -10834,11 +13702,11 @@ index 000000000..e5d2675eb
 +    }
 +    if (armareRaw != null) {
 +      final long h = Long.parseLong(armareRaw);
-+      final long prima = schedule.entries().get(0).block();
-+      if (prima != h) {
++      final long first = schedule.entries().get(0).block();
++      if (first != h) {
 +        System.out.println(
 +            "RED: the first entry of the schedule is at "
-+                + prima
++                + first
 +                + ", while aere.pq.anchorBlock is "
 +                + h
 +                + ". They must be EQUAL. If the first entry is higher, the heights between H and it "
@@ -10922,9 +13790,9 @@ index 000000000..e5d2675eb
 +    }
 +  }
 +
-+  private static List files(final Map o, final String cheie) {
++  private static List files(final Map o, final String key) {
 +    final List out = new ArrayList<>();
-+    for (final String s : list(o.get(cheie))) {
++    for (final String s : list(o.get(key))) {
 +      out.add(Path.of(s));
 +    }
 +    return out;
@@ -10962,7 +13830,7 @@ index 000000000..e5d2675eb
 +  }
 +
 +  private static void utilizare() {
-+    System.out.println("The height-indexed registry schedule: hash, generate, verify.");
++    System.out.println("D-145. The height-indexed registry schedule: hash, generate, verify.");
 +    System.out.println();
 +    System.out.println("  hash  --chain-id 2800 --registry [,...]");
 +    System.out.println("  generate --chain-id 2800 --arming-height  --registry ");
@@ -10973,14 +13841,159 @@ index 000000000..e5d2675eb
 +    System.out.println("Exit code: 0 green, 1 red, 2 not measurable.");
 +  }
 +}
+diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqSchemeSchedule.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqSchemeSchedule.java
+new file mode 100755
+index 000000000..a4d1bd43e
+--- /dev/null
++++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqSchemeSchedule.java
+@@ -0,0 +1,139 @@
++/*
++ * AERE crypto-agility, step 5: the height-indexed scheme schedule.
++ *
++ * WHAT IT IS. The same shape as aere.pq.anchorMinSeals ("H:K,H:K,..."), but the value at each
++ * step is a SET of scheme ids: "14000000:falcon-512,15500000:falcon-512+slh-dsa-128s" reads
++ * "from 14,000,000 anchors carry Falcon; from 15,500,000 they carry Falcon AND SLH-DSA".
++ * Changing the mathematics of the chain becomes one property plus keys, never a code edit -
++ * that is the whole point of the abstraction layer.
++ *
++ * THE D-147 LESSON, APPLIED AT THE LOADER. The min-seals schedule once accepted a shape whose
++ * DANGEROUS step was later in the schedule, because validation looked only at the first step.
++ * Here every rule runs over the WHOLE schedule at parse time, and the armability gate
++ * (firstUnsatisfied) walks every step against the registry's per-scheme coverage: arming a
++ * threshold K under a scheme whose coverage is below K is a chain stop, so it must be refused
++ * at configuration time, loudly, before any node boots with it.
++ *
++ * SEMANTICS OF "BEFORE THE FIRST STEP": schemesAt returns the empty set, which callers read as
++ * "the v2 scheme world is not armed here" (the legacy untagged Falcon certificate governs).
++ * Empty is never a default INSIDE the schedule: a step with zero schemes is a parse refusal.
++ */
++package org.hyperledger.besu.consensus.common.bft;
++
++import com.google.common.base.Splitter;
++
++import java.util.ArrayList;
++import java.util.LinkedHashSet;
++import java.util.List;
++import java.util.Optional;
++import java.util.Set;
++
++/** Immutable, validated height-to-scheme-set schedule. */
++public final class PqSchemeSchedule {
++
++  /** One step: from {@code fromBlock} (inclusive) the anchor carries {@code schemeIds}. */
++  public record Step(long fromBlock, Set schemeIds) {}
++
++  private final List steps;
++
++  private PqSchemeSchedule(final List steps) {
++    this.steps = steps;
++  }
++
++  /** Parse "H:scheme[+scheme...],H:...". Refuses the WHOLE schedule on any defect: unknown or
++   * repeated scheme in a step, empty step, non-increasing heights, negative height, garbage. */
++  public static PqSchemeSchedule parse(final String raw) {
++    if (raw == null || raw.isBlank()) {
++      throw new IllegalArgumentException("AERE PQ ORAR-SCHEME: empty schedule");
++    }
++    final List steps = new ArrayList<>();
++    long lastHeight = -1;
++    for (final String piesa : Splitter.on(',').split(raw)) {
++      final List parti = Splitter.on(':').splitToList(piesa.trim());
++      if (parti.size() != 2) {
++        throw new IllegalArgumentException(
++            "AERE PQ ORAR-SCHEME: step '" + piesa.trim() + "' is not H:schemes");
++      }
++      final long h;
++      try {
++        h = Long.parseLong(parti.get(0).trim());
++      } catch (final NumberFormatException e) {
++        throw new IllegalArgumentException(
++            "AERE PQ ORAR-SCHEME: height '" + parti.get(0).trim() + "' is not a number");
++      }
++      if (h < 0) {
++        throw new IllegalArgumentException("AERE PQ ORAR-SCHEME: negative height " + h);
++      }
++      if (h <= lastHeight) {
++        throw new IllegalArgumentException(
++            "AERE PQ ORAR-SCHEME: heights must strictly increase ("
++                + lastHeight
++                + " then "
++                + h
++                + ") - a schedule read out of order would arm the wrong mathematics");
++      }
++      lastHeight = h;
++      final Set schemes = new LinkedHashSet<>();
++      for (final String id : Splitter.on('+').split(parti.get(1))) {
++        final String curat = id.trim();
++        if (curat.isEmpty()) {
++          throw new IllegalArgumentException(
++              "AERE PQ ORAR-SCHEME: step at " + h + " carries an empty scheme name");
++        }
++        if (SealSchemes.byId(curat).isEmpty()) {
++          throw new IllegalArgumentException(
++              "AERE PQ ORAR-SCHEME: step at " + h + " names UNKNOWN scheme '" + curat
++                  + "' - refusing the whole schedule");
++        }
++        if (!schemes.add(curat)) {
++          throw new IllegalArgumentException(
++              "AERE PQ ORAR-SCHEME: step at " + h + " repeats scheme '" + curat + "'");
++        }
++      }
++      if (schemes.isEmpty()) {
++        throw new IllegalArgumentException(
++            "AERE PQ ORAR-SCHEME: step at " + h + " has no schemes at all");
++      }
++      steps.add(new Step(h, Set.copyOf(schemes)));
++    }
++    return new PqSchemeSchedule(List.copyOf(steps));
++  }
++
++  /** The scheme set in force at {@code height}: the last step at or below it, or the empty set
++   * when the schedule has not started yet (= v2 not armed, legacy governs). */
++  public Set schemesAt(final long height) {
++    Set inForce = Set.of();
++    for (final Step s : steps) {
++      if (s.fromBlock() <= height) {
++        inForce = s.schemeIds();
++      } else {
++        break;
++      }
++    }
++    return inForce;
++  }
++
++  /** All steps, ascending. */
++  public List steps() {
++    return steps;
++  }
++
++  /** The armability gate: walk EVERY step and every scheme in it against the registry's
++   * per-scheme coverage; the first (height, scheme) whose coverage is below {@code minSeals}
++   * is returned as the refusal, with numbers. Empty means the whole schedule is armable.
++   * This is the D-147 discipline: the dangerous step may be the LAST one, so all are walked. */
++  public Optional firstUnsatisfied(final HybridSignerRegistry registry, final int minSeals) {
++    for (final Step s : steps) {
++      for (final String scheme : s.schemeIds()) {
++        final int acoperire = registry.coverage(scheme);
++        if (acoperire < minSeals) {
++          return Optional.of(
++              "step at height " + s.fromBlock() + " arms scheme '" + scheme
++                  + "' with required seals " + minSeals + " but the registry covers only "
++                  + acoperire + " validator(s) - arming this would stop the chain");
++        }
++      }
++    }
++    return Optional.empty();
++  }
++}
 diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqSealCache.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqSealCache.java
 new file mode 100755
-index 000000000..e5e61bd90
+index 000000000..dac0d63dd
 --- /dev/null
 +++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqSealCache.java
-@@ -0,0 +1,351 @@
+@@ -0,0 +1,431 @@
 +/*
-+ * Copyright contributors to Besu / Aere Network.
++ * Copyright contributors to Besu / AERE Network.
 + *
 + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
 + * the License. You may obtain a copy of the License at
@@ -11033,13 +14046,12 @@ index 000000000..e5e61bd90
 + * amount of waiting healed it. The seals over M(head) exist nowhere else: they travel only on the
 + * Commit messages of the head block, and those are never replayed.
 + *
-+ * 
      AND IT IS NOT THE UNBOUND-REGISTRY DEFECT IN ANOTHER COAT. That one was a registry of public
-+ * keys read from a file and BELIEVED. Every seal read back here is re-verified, cryptographically,
-+ * against the anchored registry over M rebuilt from the header this process just loaded - see
-+ * {@link PqSealStore}. A forged file cannot inject a seal without forging a Falcon-512 signature;
-+ * the worst it achieves is the empty cache an absent file already gives. Persistence is OFF unless
-+ * a caller enables it, and the only caller that does is the QBFT controller builder, only when the
-+ * anchor is actually armed.
++ * 
      AND IT IS NOT DEFECT A8 IN ANOTHER COAT. A8 was a registry of public keys read from a file and
++ * BELIEVED. Every seal read back here is re-verified, cryptographically, against the anchored
++ * registry over M rebuilt from the header this process just loaded - see {@link PqSealStore}. A
++ * forged file cannot inject a seal without forging a Falcon-512 signature; the worst it achieves is
++ * the empty cache an absent file already gives. Persistence is OFF unless a caller enables it, and
++ * the only caller that does is the QBFT controller builder, only when the anchor is actually armed.
 + *
 + * 
      WHAT IT DOES NOT DO. The in-memory path verifies nothing. Whether a seal is valid, whether its
 + * index maps to an eligible validator, and whether there are enough of them, are decided at
@@ -11149,11 +14161,27 @@ index 000000000..e5e61bd90
 +    if (file == null) {
 +      return 0;
 +    }
-+    final List verified;
++    List verified;
 +    try {
 +      verified =
 +          PqSealStore.readVerified(
 +              file, persistenceChainId, blockNumber, onchainBlockHash, registry);
++      if (verified.isEmpty()) {
++        // MAGAZIA TINE VARFUL (D-330): the main file may hold a later height that never imported;
++        // the previous slot may hold exactly the head. Same verification, same registry.
++        final Path previous = file.resolveSibling(PqSealStore.PREVIOUS_FILE_NAME);
++        verified =
++            PqSealStore.readVerified(
++                previous, persistenceChainId, blockNumber, onchainBlockHash, registry);
++        if (!verified.isEmpty()) {
++          LOG.info(
++              "AERE PERSISTENTA-SIGILII: {} seal(s) for the chain head {} restored from the PREVIOUS slot {}"
++                  + " (the main file held a later height).",
++              verified.size(),
++              blockNumber,
++              previous);
++        }
++      }
 +    } catch (final RuntimeException e) {
 +      // readVerified is written not to throw; this is the belt on top of the braces, because an
 +      // exception escaping here would turn a lost cache into a node that refuses to start.
@@ -11235,6 +14263,15 @@ index 000000000..e5e61bd90
 +        return;
 +      }
 +      try {
++        // MAGAZIA TINE VARFUL (D-330, 2026-09-03): before the main file moves to a HIGHER height, what it
++        // held becomes the previous slot. The main file may hold a proposal that never imports; the
++        // previous slot then still holds the head, and a restart can restore the head's seals from it.
++        if (persistedBlock >= 0 && blockNumber > persistedBlock && java.nio.file.Files.isRegularFile(file)) {
++          java.nio.file.Files.move(
++              file,
++              file.resolveSibling(PqSealStore.PREVIOUS_FILE_NAME),
++              java.nio.file.StandardCopyOption.REPLACE_EXISTING);
++        }
 +        PqSealStore.writeAtomically(
 +            file,
 +            PqSealStore.encode(
@@ -11263,6 +14300,60 @@ index 000000000..e5e61bd90
 +   * @param onchainBlockHash the ON-CHAIN hash of that block
 +   * @return the seals, sorted by strictly increasing validator index, possibly empty
 +   */
++  /**
++   * AERE ANCHOR V2: remember the extra (non-Falcon) scheme seals heard on the commits of a block.
++   * Same key as {@link #record}, same window, same idempotence (first seal per validator and
++   * scheme wins). NOT persisted across a restart: a node that restarts holds no extras until it
++   * takes part in one commit, exactly the Falcon situation before PqSealStore, and the producer
++   * then refuses the v2 certificate for one proposer turn rather than writing a short one.
++   *
++   * @param blockNumber the height of the block the seals are over
++   * @param onchainBlockHash the round-independent on-chain hash of that block
++   * @param extraSeals the heard scheme seals, unverified
++   */
++  public void recordExtras(
++      final long blockNumber, final Hash onchainBlockHash, final Collection extraSeals) {
++    synchronized (this) {
++      if (onchainBlockHash == null || extraSeals == null || extraSeals.isEmpty()) {
++        return;
++      }
++      final Entry entry =
++          byHash.computeIfAbsent(onchainBlockHash, unused -> new Entry(blockNumber));
++      for (final SchemeSeal seal : extraSeals) {
++        if (seal == null
++            || seal.getValidatorIndex() < 0
++            || seal.getSignature() == null
++            || seal.getSchemeWireId() == SealSchemes.FALCON_512.wireId()) {
++          continue;
++        }
++        final long key = ((long) seal.getValidatorIndex() << 8) | (seal.getSchemeWireId() & 0xffL);
++        entry.extras.putIfAbsent(key, seal);
++      }
++      if (blockNumber > highestSeen) {
++        highestSeen = blockNumber;
++      }
++      prune();
++    }
++  }
++
++  /**
++   * AERE ANCHOR V2: the extra scheme seals heard for a block, canonical order, unverified.
++   *
++   * @param blockNumber the height
++   * @param onchainBlockHash the round-independent on-chain hash
++   * @return the seals, or empty when nothing was heard under that key
++   */
++  public synchronized List extrasFor(
++      final long blockNumber, final Hash onchainBlockHash) {
++    final Entry entry = byHash.get(onchainBlockHash);
++    if (entry == null || entry.blockNumber != blockNumber) {
++      return List.of();
++    }
++    final List out = new ArrayList<>(entry.extras.values());
++    out.sort(PqAnchorV2.CANONICAL);
++    return out;
++  }
++
 +  public synchronized List sealsFor(
 +      final long blockNumber, final Hash onchainBlockHash) {
 +    final Entry entry = byHash.get(onchainBlockHash);
@@ -11324,6 +14415,8 @@ index 000000000..e5e61bd90
 +  private static final class Entry {
 +    private final long blockNumber;
 +    private final Map seals = new LinkedHashMap<>();
++    /** AERE ANCHOR V2: heard extra (non-Falcon) scheme seals, keyed (index << 8 | wire). */
++    private final Map extras = new LinkedHashMap<>();
 +
 +    private Entry(final long blockNumber) {
 +      this.blockNumber = blockNumber;
@@ -11332,12 +14425,12 @@ index 000000000..e5e61bd90
 +}
 diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqSealStore.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqSealStore.java
 new file mode 100755
-index 000000000..fecb2991b
+index 000000000..6427140de
 --- /dev/null
 +++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqSealStore.java
-@@ -0,0 +1,384 @@
+@@ -0,0 +1,401 @@
 +/*
-+ * Copyright contributors to Besu / Aere Network.
++ * Copyright contributors to Besu / AERE Network.
 + *
 + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
 + * the License. You may obtain a copy of the License at
@@ -11391,10 +14484,10 @@ index 000000000..fecb2991b
 + * and nobody could propose. Seals come from Commits, Commits come from proposals, proposals need
 + * seals - the same circle, one level down.
 + *
-+ * 
      WHY THIS IS NOT THE UNBOUND-REGISTRY DEFECT IN ANOTHER COAT, and the distinction is the
-+ * whole safety argument. That one was a REGISTRY read from a local file and BELIEVED: the
-+ * public keys that decide who is a legitimate signer came out of a file a node could be pointed at
-+ * wrongly, so the file was authority. Nothing here is believed. A Falcon seal is SELF-AUTHENTICATING: {@link
++ * 
      WHY THIS IS NOT DEFECT A8 IN ANOTHER COAT, and the distinction is the whole safety
++ * argument. A8 was a REGISTRY read from a local file and BELIEVED: the public keys that decide
++ * who is a legitimate signer came out of a file a node could be pointed at wrongly, so the file was
++ * authority. Nothing here is believed. A Falcon seal is SELF-AUTHENTICATING: {@link
 + * #readVerified(Path, long, long, Hash, PqSignerRegistry)} re-verifies EVERY seal it reads against
 + * the anchored registry, over the message M rebuilt from the chain-head header this process just
 + * loaded, exactly as the producer does at selection time. A forged, edited or replayed file cannot
@@ -11422,6 +14515,14 @@ index 000000000..fecb2991b
 +  /** The temporary file the atomic write goes through before the rename. */
 +  public static final String TEMP_FILE_NAME = "aere-pq-seals.rlp.tmp";
 +
++  /**
++   * D-330 (2026-09-03): the PREVIOUS slot. The main file holds the highest height heard, which can be
++   * a proposal that never imported (testnet 28001: the file held 168032 while the head was 168031,
++   * and after a fleet-wide restart every node had zero seals for the head). The previous slot keeps
++   * what the main file held before its last rotation, so the head's seals survive one extra height.
++   */
++  public static final String PREVIOUS_FILE_NAME = "aere-pq-seals-anterior.rlp";
++
 +  /** Domain label, so a file written for any other purpose cannot be read as a seal set. */
 +  public static final String DOMAIN = "AERE-PQ-SEALSTORE-1";
 +
@@ -11458,6 +14559,16 @@ index 000000000..fecb2991b
 +  }
 +
 +  /**
++   * The previous-slot file beside {@link #fileIn}.
++   *
++   * @param dataDirectory the node data directory
++   * @return the previous slot's path
++   */
++  public static Path previousFileIn(final Path dataDirectory) {
++    return dataDirectory.resolve(PREVIOUS_FILE_NAME);
++  }
++
++  /**
 +   * The canonical bytes of a seal set.
 +   *
 +   * 
      The certificate itself is written by {@link PqAnchor#writeCertificate}, the SAME encoder that
@@ -11658,11 +14769,11 @@ index 000000000..fecb2991b
 +      if (seal.getValidatorIndex() < 0
 +          || seal.getSignature() == null
 +          || !seen.add(seal.getValidatorIndex())
-+          // HEIGHT-RESOLVED LOOKUP (2026-08-06). These seals are over block `blockNumber`, which the
++          // D2 (2026-08-06): height-resolved. These seals are over block `blockNumber`, which the
 +          // caller has already matched against the stored header, so the height is known exactly.
 +          // On a restart at the head this resolves to the same registry it always did; the point is
 +          // that it can no longer resolve to a DIFFERENT one without saying so.
-+          // OWN-HEAD DOOR (b-v2): the caller has already refused this file unless the
++          // D2 (b-v2): the OWN-HEAD door. The caller has already refused this file unless the
 +          // stored block number and hash equal this node's head, so the subject is this node's
 +          // own head by construction.
 +          || registry.addressForIndexAtOwnHead(blockNumber, seal.getValidatorIndex()) == null) {
@@ -11697,8 +14808,7 @@ index 000000000..fecb2991b
 +   * makes when it decides which heard seals may enter a certificate. Nothing about a seal is trusted
 +   * because it was on disk.
 +   *
-+   * 
      HEIGHT-RESOLVED LOOKUP (2026-08-06): it now carries the HEIGHT the seals belong to. The
-+   * adversarial review of
++   * 
      D2 (2026-08-06): it now carries the HEIGHT the seals belong to. The adversarial review of
 +   * 2026-08-02 measured that every registry question in this stack was height-less, so a restart
 +   * after a key rotation re-checked seals over an old block against today's keys and dropped them
 +   * all as forged. Here the height is not in doubt: the caller has already refused the file unless
@@ -11722,12 +14832,12 @@ index 000000000..fecb2991b
 +}
 diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqSignerRegistry.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqSignerRegistry.java
 new file mode 100755
-index 000000000..3646b9a22
+index 000000000..bfaa45662
 --- /dev/null
 +++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqSignerRegistry.java
-@@ -0,0 +1,172 @@
+@@ -0,0 +1,167 @@
 +/*
-+ * Copyright contributors to Besu / Aere Network.
++ * Copyright contributors to Besu / AERE Network.
 + *
 + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
 + * the License. You may obtain a copy of the License at
@@ -11765,18 +14875,17 @@ index 000000000..3646b9a22
 +public interface PqSignerRegistry {
 +
 +  /**
-+   * HEIGHT-INDEXED REGISTRY, LOOKUP HARDENING (a). The validator address bound to a registry index
-+   * AT A HEIGHT.
++   * D-081 / D2 HARDENING (a). The validator address bound to a registry index AT A HEIGHT.
 +   *
 +   * 
      WHY THERE IS NO HEIGHT-LESS FORM HERE, and why this is the change and not a nicety. Until
 +   * 2026-08-06 this interface carried BOTH {@code addressForIndex(int)} and a {@code
 +   * addressForIndexAt(long,int)} whose body was {@code default { return addressForIndex(idx); }}.
-+   * That default is precisely the defect an adversarial review of 2026-08-02 measured: a registry
++   * That default is precisely what the adversarial review of 2026-08-02 measured as D2: a registry
 +   * has no height argument, so a header that verified yesterday is refused the moment index 0's
-+   * Falcon key is rotated. The default made the defect INVISIBLE TO ITS OWN PROOF - that review's
-+   * probe injected a registry that overrides only the height-less pair, inherits the default, and
-+   * therefore returns exactly the same verdict on repaired and unrepaired code. A probe that cannot
-+   * go red is not a probe.
++   * Falcon key is rotated. The default made the defect INVISIBLE TO ITS OWN PROOF - the D2 harness
++   * (adversar-2026-08-02/harness/RuleProbe.java lines 115-131) injects a registry that overrides
++   * only the height-less pair, inherits the default, and therefore returns exactly the same verdict
++   * on repaired and unrepaired code. A probe that cannot go red is not a probe.
 +   *
 +   * 
      So the height-less pair is DELETED rather than deprecated, and both survivors are abstract.
 +   * The compiler is now the negative control: any implementation, test double included, that cannot
@@ -11784,7 +14893,7 @@ index 000000000..3646b9a22
 +   * on {@link FalconSealSupport} and under a name that cannot be mistaken for a verification path -
 +   * see {@code FalconSealSupport.localSigningAddress()}.
 +   *
-+   * 
      LOOKUP HARDENING (b-v2), 2026-08-06: this is the HISTORY half of the pair. It is reachable
++   * 
      D2 HARDENING (b-v2), 2026-08-06: this is the HISTORY half of the pair. It is reachable
 +   * only from the two header-validation rules, and it REFUSES an unbound height at or above the
 +   * arming height. The own-head half is {@link #addressForIndexAtOwnHead}, which carries the
 +   * measurement that forced the split.
@@ -11797,18 +14906,16 @@ index 000000000..3646b9a22
 +  Address addressForIndexAtHistoric(long blockNumber, int validatorIndex);
 +
 +  /**
-+   * LOOKUP HARDENING (b-v2). The address bound to a registry index at a height, asked about THIS
-+   * NODE'S
++   * D2 HARDENING (b-v2). The address bound to a registry index at a height, asked about THIS NODE'S
 +   * OWN HEAD: a block this node is building, or the head it has just restarted onto.
 +   *
 +   * 
      WHY THIS SECOND NAME EXISTS, and it is a measurement and not a taste. The first shape of
 +   * hardening (b) refused every unbound height at or above the arming height and decided that from
 +   * the block NUMBER alone. On 2026-08-06 that turned six tests red - five in {@code
 +   * PqSealPersistenceTest}, the restart path, and one in {@code PqForkValidatorSetChangeTest}, the
-+   * proposer - and that test's message states the operational consequence in one line: the node
-+   * stops producing blocks. In all six the number handed to the guard was 1030 with an arming
-+   * height of 1000, which is exactly what a genuinely historical question at the same instant would
-+   * hand it.
++   * proposer - and the D078 message states the operational consequence in one line: the node stops
++   * producing blocks. In all six the number handed to the guard was 1030 with an arming height of
++   * 1000, which is exactly what a genuinely historical question at the same instant would hand it.
 +   * There is no arithmetic on the height that separates the two. What separates them is WHO SUPPLIES
 +   * THE SUBJECT, and that is known at every call site and was being thrown away at the boundary.
 +   *
@@ -11827,8 +14934,7 @@ index 000000000..3646b9a22
 +  Address addressForIndexAtOwnHead(long blockNumber, int validatorIndex);
 +
 +  /**
-+   * HEIGHT-INDEXED REGISTRY, LOOKUP HARDENING (a). Verify a Falcon signature by a registry index AT
-+   * A HEIGHT. Must never
++   * D-081 / D2 HARDENING (a). Verify a Falcon signature by a registry index AT A HEIGHT. Must never
 +   * throw. Abstract for the reason given on {@link #addressForIndexAtHistoric}.
 +   *
 +   * @param blockNumber the height of the header carrying the seal
@@ -11840,8 +14946,7 @@ index 000000000..3646b9a22
 +  boolean verifyAtHistoric(long blockNumber, int validatorIndex, Bytes message, Bytes signature);
 +
 +  /**
-+   * LOOKUP HARDENING (b-v2). Verify a Falcon signature over a block THIS NODE holds as its own head
-+   * or
++   * D2 HARDENING (b-v2). Verify a Falcon signature over a block THIS NODE holds as its own head or
 +   * is building right now. Never refuses for a missing height binding; see {@link
 +   * #addressForIndexAtOwnHead} for the measurement that forced the split and for what it still does
 +   * refuse.
@@ -11898,11 +15003,402 @@ index 000000000..3646b9a22
 +    };
 +  }
 +}
+diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/SchemeSeal.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/SchemeSeal.java
+new file mode 100755
+index 000000000..ed5a63807
+--- /dev/null
++++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/SchemeSeal.java
+@@ -0,0 +1,69 @@
++/* AERE crypto-agility, step 2: a seal that names its scheme. The legacy FalconSeal cannot say
++ * what mathematics signed it, so a certificate of FalconSeals can never carry a hybrid. This one
++ * carries the one-byte scheme wire tag from {@link SealSchemes}, which is the whole difference. */
++package org.hyperledger.besu.consensus.common.bft;
++
++import java.util.Objects;
++
++import org.apache.tuweni.bytes.Bytes;
++
++/** One validator seal tagged with the scheme that produced it. Immutable. */
++public final class SchemeSeal {
++
++  private final byte schemeWireId;
++  private final int validatorIndex;
++  private final Bytes signature;
++
++  /** @param schemeWireId the {@link SealScheme#wireId()} of the producing scheme
++   *  @param validatorIndex the signer registry index, non-negative
++   *  @param signature the raw signature bytes */
++  public SchemeSeal(final byte schemeWireId, final int validatorIndex, final Bytes signature) {
++    this.schemeWireId = schemeWireId;
++    this.validatorIndex = validatorIndex;
++    this.signature = signature;
++  }
++
++  /** The wire tag of the scheme that produced this seal. */
++  public byte getSchemeWireId() {
++    return schemeWireId;
++  }
++
++  /** The signer registry index. */
++  public int getValidatorIndex() {
++    return validatorIndex;
++  }
++
++  /** The raw signature bytes. */
++  public Bytes getSignature() {
++    return signature;
++  }
++
++  @Override
++  public boolean equals(final Object o) {
++    if (this == o) {
++      return true;
++    }
++    if (!(o instanceof SchemeSeal that)) {
++      return false;
++    }
++    return schemeWireId == that.schemeWireId
++        && validatorIndex == that.validatorIndex
++        && Objects.equals(signature, that.signature);
++  }
++
++  @Override
++  public int hashCode() {
++    return Objects.hash(schemeWireId, validatorIndex, signature);
++  }
++
++  @Override
++  public String toString() {
++    return "SchemeSeal{scheme=0x"
++        + Integer.toHexString(schemeWireId & 0xff)
++        + ", index="
++        + validatorIndex
++        + ", sig="
++        + signature.size()
++        + "B}";
++  }
++}
+diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/SealScheme.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/SealScheme.java
+new file mode 100755
+index 000000000..228b9a0f8
+--- /dev/null
++++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/SealScheme.java
+@@ -0,0 +1,96 @@
++/*
++ * AERE crypto-agility layer, step 1 (2026-08-24, TOP-3 list item 9).
++ *
++ * WHY THIS EXISTS. Until today the anchor certificate code talked to exactly one algorithm,
++ * Falcon-512, by name: FalconSeal, FalconSealSupport, FalconPublicKeyParameters. "Safe when the
++ * math changes" was a slogan the code could not honour, because changing the math meant editing
++ * every call site. This interface is the seam that makes the slogan checkable: the protocol talks
++ * to a SealScheme; which lattice (or hash) sits behind it is configuration.
++ *
++ * WHAT IT DELIBERATELY IS NOT. It does not touch FalconSealSupport yet (that rewiring is step 2,
++ * and that file is an overwrite-class file under the D-152 patch discipline). It does not load
++ * private keys from disk (production loading stays per-scheme, exactly as today). It does not
++ * invent a private-key wire encoding: private keys live only as in-memory handles, so no new
++ * secret format exists to leak or to get wrong.
++ */
++package org.hyperledger.besu.consensus.common.bft;
++
++import java.security.SecureRandom;
++import java.util.Optional;
++
++/** A pluggable post-quantum signature scheme for validator seals. Implementations never throw
++ * from {@link #verify}: a malformed key or signature is simply an invalid seal. */
++public interface SealScheme {
++
++  /** Stable human-readable identifier, e.g. {@code "falcon-512"}. Matches the naming the chain
++   * already uses publicly (precompile docs, /v1/pq/verify schemes). */
++  String id();
++
++  /** One-byte wire tag reserved for the versioned certificate format (v2) in which each seal
++   * names its scheme. 0x00 is reserved for "unversioned legacy Falcon". */
++  byte wireId();
++
++  /** Parse the registry form of a public key (the exact bytes a signer registry stores).
++   * Empty when the bytes cannot be a key of this scheme. */
++  Optional parsePublicKey(byte[] registryForm);
++
++  /** The registry-form length in bytes, so registries can sanity-check entries per scheme. */
++  int publicKeyLength();
++
++  /** Sign a message. Empty on any failure; never throws. */
++  Optional sign(PrivateHandle key, byte[] message);
++
++  /** Verify. False on any failure, including a handle from another scheme; never throws. */
++  boolean verify(PublicHandle key, byte[] message, byte[] signature);
++
++  /** Convenience: parse-then-verify straight from registry bytes. False on any failure. */
++  default boolean verifyRaw(final byte[] registryForm, final byte[] message, final byte[] signature) {
++    try {
++      return parsePublicKey(registryForm).map(k -> verify(k, message, signature)).orElse(false);
++    } catch (final RuntimeException e) {
++      return false;
++    }
++  }
++
++  /** Generate a fresh key pair. Used by test networks only: real validator keys are born in the
++   * vault ceremony, never inside a node. */
++  GeneratedPair generate(SecureRandom random);
++
++  /**
++   * The scheme's OWN canonical private-key encoding, when it has one. Empty by default.
++   *
++   * 
      DATED NOTE 2026-08-25, refining the sentence at the top of this file. The layer
++   * still does NOT invent a private-key format: the methods below expose exactly the
++   * encoding the scheme's library already has, and only schemes that truly have one
++   * implement them. Measured today on the shipped jar: SLH-DSA-128s has {@code getEncoded()}
++   * with an exact round-trip, so it implements them; Falcon-512 keeps its key in components
++   * and its PRODUCTION loading stays untouched in FalconSealSupport, so it does NOT implement
++   * them and returns empty. Why it was needed: the hybrid producer must be able to receive
++   * the second scheme's key without every call site knowing which scheme it is.
++   *
++   * @param key the private handle
++   * @return the encoding, or empty when this scheme has no canonical one
++   */
++  default Optional serializePrivateKey(final PrivateHandle key) {
++    return Optional.empty();
++  }
++
++  /**
++   * Rebuild a private handle from {@link #serializePrivateKey}. Empty on anything unusable.
++   *
++   * @param raw the encoding
++   * @return the handle, or empty
++   */
++  default Optional parsePrivateKey(final byte[] raw) {
++    return Optional.empty();
++  }
++
++  /** Opaque scheme-specific public key. */
++  interface PublicHandle {}
++
++  /** Opaque scheme-specific private key. Never serialised by this layer. */
++  interface PrivateHandle {}
++
++  /** A freshly generated pair plus the registry form of its public key. */
++  record GeneratedPair(PublicHandle publicKey, PrivateHandle privateKey, byte[] publicRegistryForm) {}
++}
+diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/SealSchemes.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/SealSchemes.java
+new file mode 100755
+index 000000000..a3e39f4f2
+--- /dev/null
++++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/SealSchemes.java
+@@ -0,0 +1,56 @@
++/* AERE crypto-agility: the scheme registry. The protocol asks here by name or wire tag and gets
++ * an algorithm; swapping the mathematics becomes configuration plus keys, never call-site edits.
++ * Wire tags are the certificate-v2 vocabulary: 0x00 stays reserved for the unversioned legacy
++ * Falcon certificate already live on chain 2800, so old certificates can never be confused with
++ * tagged ones. */
++package org.hyperledger.besu.consensus.common.bft;
++
++import java.util.List;
++import java.util.Optional;
++
++/** Static registry of the seal schemes this build understands. */
++public final class SealSchemes {
++
++  /** Falcon-512 (lattice), the scheme live on chain 2800 today. */
++  public static final SealScheme FALCON_512 = new FalconSealScheme();
++
++  /** SLH-DSA-128s (hash-based, FIPS 205), the founder-approved hybrid counterpart. */
++  public static final SealScheme SLH_DSA_128S = new SlhDsaSealScheme();
++
++  private static final List ALL = List.of(FALCON_512, SLH_DSA_128S);
++
++  private SealSchemes() {}
++
++  /** All schemes this build understands, in wire-tag order. */
++  public static List all() {
++    return ALL;
++  }
++
++  /** Look up by stable id, e.g. {@code "falcon-512"}. Empty for unknown ids: an unknown scheme
++   * must be a loud configuration error at the caller, never a silent default. */
++  public static Optional byId(final String id) {
++    if (id == null) {
++      return Optional.empty();
++    }
++    // D-325: the SLH-DSA scheme is named "slh-dsa-sha2-128s" on both clients now; the old short id
++    // is still understood so an existing schedule string keeps meaning the same mathematics.
++    final String wanted = SlhDsaSealScheme.LEGACY_ID.equals(id) ? SLH_DSA_128S.id() : id;
++    for (final SealScheme s : ALL) {
++      if (s.id().equals(wanted)) {
++        return Optional.of(s);
++      }
++    }
++    return Optional.empty();
++  }
++
++  /** Look up by certificate-v2 wire tag. Empty for 0x00 (legacy, not a tagged scheme) and for
++   * anything unknown. */
++  public static Optional byWireId(final byte wireId) {
++    for (final SealScheme s : ALL) {
++      if (s.wireId() == wireId) {
++        return Optional.of(s);
++      }
++    }
++    return Optional.empty();
++  }
++}
+diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/SlhDsaSealScheme.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/SlhDsaSealScheme.java
+new file mode 100755
+index 000000000..27a8f8e7e
+--- /dev/null
++++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/SlhDsaSealScheme.java
+@@ -0,0 +1,136 @@
++/* AERE crypto-agility: SLH-DSA-128s (NIST FIPS 205, the standardised SPHINCS+) behind the
++ * SealScheme seam. This is the second half of the founder-approved hybrid direction of
++ * 2026-08-07 (option 3): hash-based security alongside lattice-based Falcon, so that a break in
++ * either mathematics leaves the other standing. The scheme name matches the precompile the chain
++ * already runs at 0x0AE4 since block 9,189,161, so the public naming stays consistent.
++ *
++ * NOTE ON KEYS: introducing this scheme creates NO keys anywhere. Real hybrid validator keys
++ * require a separate founder-approved ceremony (standing rule, 2026-08-07); test networks
++ * generate throwaway pairs per run via {@link #generate}. */
++package org.hyperledger.besu.consensus.common.bft;
++
++import java.security.SecureRandom;
++import java.util.Optional;
++
++import org.bouncycastle.crypto.AsymmetricCipherKeyPair;
++import org.hyperledger.besu.consensus.common.bft.slhdsa.SLHDSAKeyGenerationParameters;
++import org.hyperledger.besu.consensus.common.bft.slhdsa.SLHDSAKeyPairGenerator;
++import org.hyperledger.besu.consensus.common.bft.slhdsa.SLHDSAParameters;
++import org.hyperledger.besu.consensus.common.bft.slhdsa.SLHDSAPrivateKeyParameters;
++import org.hyperledger.besu.consensus.common.bft.slhdsa.SLHDSAPublicKeyParameters;
++import org.hyperledger.besu.consensus.common.bft.slhdsa.SLHDSASigner;
++
++/** SLH-DSA-128s (small, SHA2 family) as a pluggable seal scheme. */
++/*
++ * D-337 (2026-09-04): the SLH-DSA classes come from the in-tree copy of Bouncy Castle's engine
++ * (package ..bft.slhdsa) whose SHA-2 runs on the JDK's SHA-NI intrinsics. Bouncy Castle's pure-Java
++ * digest made one sha2_128s signature cost 1.4-2.7 s on the validators' CPUs, on the QBFT thread, at
++ * every anchor parent, and the chain slowed from 0.56 to 0.76 s per block. Measured on the same CPUs
++ * the in-tree engine signs in 0.3-0.7 s; same keys, same bytes (SlhDsaFastEngineTest pins that
++ * against the original).
++ */
++public final class SlhDsaSealScheme implements SealScheme {
++
++  /** Registry form: the encoded SLH-DSA-128s public key (PK.seed || PK.root), 32 bytes. */
++  public static final int PUBLIC_KEY_LENGTH = 32;
++
++  private static final SLHDSAParameters PARAMS = SLHDSAParameters.sha2_128s;
++
++  private record Pub(SLHDSAPublicKeyParameters params) implements PublicHandle {}
++
++  private record Priv(SLHDSAPrivateKeyParameters params) implements PrivateHandle {}
++
++  // D-325 (2026-09-03): the id the SECOND client and the public verifier use, "slh-dsa-sha2-128s";
++  // the shorter "slh-dsa-128s" stays accepted as an alias in SealSchemes.byId so no schedule breaks.
++  @Override
++  public String id() {
++    return "slh-dsa-sha2-128s";
++  }
++
++  /** The alias this build accepted before D-325. */
++  public static final String LEGACY_ID = "slh-dsa-128s";
++
++  @Override
++  public byte wireId() {
++    return 0x02;
++  }
++
++  @Override
++  public int publicKeyLength() {
++    return PUBLIC_KEY_LENGTH;
++  }
++
++  @Override
++  public Optional parsePublicKey(final byte[] registryForm) {
++    if (registryForm == null || registryForm.length != PUBLIC_KEY_LENGTH) {
++      return Optional.empty();
++    }
++    try {
++      return Optional.of(new Pub(new SLHDSAPublicKeyParameters(PARAMS, registryForm)));
++    } catch (final RuntimeException e) {
++      return Optional.empty();
++    }
++  }
++
++  @Override
++  public Optional sign(final PrivateHandle key, final byte[] message) {
++    if (!(key instanceof Priv p) || message == null) {
++      return Optional.empty();
++    }
++    try {
++      final SLHDSASigner signer = new SLHDSASigner();
++      signer.init(true, p.params());
++      return Optional.of(signer.generateSignature(message));
++    } catch (final RuntimeException e) {
++      return Optional.empty();
++    }
++  }
++
++  @Override
++  public boolean verify(final PublicHandle key, final byte[] message, final byte[] signature) {
++    if (!(key instanceof Pub p) || message == null || signature == null) {
++      return false;
++    }
++    try {
++      final SLHDSASigner verifier = new SLHDSASigner();
++      verifier.init(false, p.params());
++      return verifier.verifySignature(message, signature);
++    } catch (final RuntimeException e) {
++      return false;
++    }
++  }
++
++  @Override
++  public Optional serializePrivateKey(final PrivateHandle key) {
++    if (!(key instanceof Priv p)) {
++      return Optional.empty();
++    }
++    try {
++      return Optional.ofNullable(p.params().getEncoded());
++    } catch (final RuntimeException e) {
++      return Optional.empty();
++    }
++  }
++
++  @Override
++  public Optional parsePrivateKey(final byte[] raw) {
++    if (raw == null || raw.length == 0) {
++      return Optional.empty();
++    }
++    try {
++      return Optional.of(new Priv(new SLHDSAPrivateKeyParameters(PARAMS, raw)));
++    } catch (final RuntimeException e) {
++      return Optional.empty();
++    }
++  }
++
++  @Override
++  public GeneratedPair generate(final SecureRandom random) {
++    final SLHDSAKeyPairGenerator gen = new SLHDSAKeyPairGenerator();
++    gen.init(new SLHDSAKeyGenerationParameters(random, PARAMS));
++    final AsymmetricCipherKeyPair pair = gen.generateKeyPair();
++    final SLHDSAPublicKeyParameters pub = (SLHDSAPublicKeyParameters) pair.getPublic();
++    final SLHDSAPrivateKeyParameters priv = (SLHDSAPrivateKeyParameters) pair.getPrivate();
++    return new GeneratedPair(new Pub(pub), new Priv(priv), pub.getEncoded());
++  }
++}
 diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/blockcreation/BftBlockCreatorFactory.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/blockcreation/BftBlockCreatorFactory.java
 index 20c072202..1ecdcbf34 100644
 --- a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/blockcreation/BftBlockCreatorFactory.java
 +++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/blockcreation/BftBlockCreatorFactory.java
-@@ -11,6 +11,12 @@
+@@ -1,33 +1,39 @@
+ /*
+  * Copyright ConsenSys AG.
+  *
+  * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+  * the License. You may obtain a copy of the License at
+  *
+  * http://www.apache.org/licenses/LICENSE-2.0
+  *
+  * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+  * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
   * specific language governing permissions and limitations under the License.
   *
   * SPDX-License-Identifier: Apache-2.0
@@ -11915,7 +15411,41 @@ index 20c072202..1ecdcbf34 100644
   */
  package org.hyperledger.besu.consensus.common.bft.blockcreation;
  
-@@ -157,6 +163,23 @@ public class BftBlockCreatorFactory {
+ import static com.google.common.base.Preconditions.checkState;
+ 
+ import org.hyperledger.besu.config.BftConfigOptions;
+ import org.hyperledger.besu.consensus.common.ConsensusHelpers;
+ import org.hyperledger.besu.consensus.common.ForksSchedule;
+ import org.hyperledger.besu.consensus.common.bft.BftContext;
+ import org.hyperledger.besu.consensus.common.bft.BftExtraData;
+ import org.hyperledger.besu.consensus.common.bft.BftExtraDataCodec;
+ import org.hyperledger.besu.consensus.common.bft.Vote;
+ import org.hyperledger.besu.consensus.common.validator.ValidatorProvider;
+ import org.hyperledger.besu.consensus.common.validator.ValidatorVote;
+ import org.hyperledger.besu.consensus.common.validator.VoteProvider;
+ import org.hyperledger.besu.datatypes.Address;
+ import org.hyperledger.besu.datatypes.Wei;
+ import org.hyperledger.besu.ethereum.ProtocolContext;
+ import org.hyperledger.besu.ethereum.blockcreation.BlockCreator;
+ import org.hyperledger.besu.ethereum.core.BlockHeader;
+@@ -140,61 +146,78 @@ public class BftBlockCreatorFactory {
+     return miningConfiguration.getMinTransactionGasPrice();
+   }
+ 
+   /**
+    * Gets min priority fee per gas
+    *
+    * @return min priority fee per gas
+    */
+   public Wei getMinPriorityFeePerGas() {
+     return miningConfiguration.getMinPriorityFeePerGas();
+   }
+ 
+   /**
+    * Create extra data bytes.
+    *
+    * @param round the round
+    * @param parentHeader the parent header
     * @return the bytes
     */
    public Bytes createExtraData(final int round, final BlockHeader parentHeader) {
@@ -11939,7 +15469,20 @@ index 20c072202..1ecdcbf34 100644
      final BftContext bftContext = protocolContext.getConsensusContext(BftContext.class);
      final ValidatorProvider validatorProvider = bftContext.getValidatorProvider();
      Optional voteProviderAfterBlock =
-@@ -177,7 +200,7 @@ public class BftBlockCreatorFactory {
+         validatorProvider.getVoteProviderAfterBlock(parentHeader);
+     checkState(voteProviderAfterBlock.isPresent(), "Bft requires a vote provider");
+     final Optional proposal =
+         voteProviderAfterBlock.get().getVoteAfterBlock(parentHeader, localAddress);
+ 
+     final List
       validators =
+         new ArrayList<>(validatorProvider.getValidatorsAfterBlock(parentHeader));
+ 
+     final BftExtraData extraData =
+         new BftExtraData(
+             ConsensusHelpers.zeroLeftPad(
+                 miningConfiguration.getExtraData(), BftExtraDataCodec.EXTRA_VANITY_LENGTH),
+             Collections.emptyList(),
+             toVote(proposal),
              round,
              validators);
  
@@ -11948,14 +15491,31 @@ index 20c072202..1ecdcbf34 100644
    }
  
    /**
+    * Change target gas limit.
+    *
+    * @param newTargetGasLimit the new target gas limit
+    */
+   public void changeTargetGasLimit(final Long newTargetGasLimit) {
+     if (AbstractGasLimitSpecification.isValidTargetGasLimit(newTargetGasLimit)) {
+       miningConfiguration.setTargetGasLimit(newTargetGasLimit);
+     } else {
+       throw new UnsupportedOperationException("Specified target gas limit is invalid");
+     }
+   }
+ 
+   /**
+    * Gets local address.
+    *
+    * @return the local address
+    */
 diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/blockcreation/PqAnchorProducer.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/blockcreation/PqAnchorProducer.java
 new file mode 100755
-index 000000000..8ff0f9d97
+index 000000000..a46b7d887
 --- /dev/null
 +++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/blockcreation/PqAnchorProducer.java
-@@ -0,0 +1,347 @@
+@@ -0,0 +1,524 @@
 +/*
-+ * Copyright contributors to Besu / Aere Network.
++ * Copyright contributors to Besu / AERE Network.
 + *
 + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
 + * the License. You may obtain a copy of the License at
@@ -11970,15 +15530,23 @@ index 000000000..8ff0f9d97
 + */
 +package org.hyperledger.besu.consensus.common.bft.blockcreation;
 +
++import org.apache.tuweni.bytes.Bytes;
++import org.hyperledger.besu.datatypes.Hash;
 +import org.hyperledger.besu.consensus.common.bft.BftContext;
 +import org.hyperledger.besu.consensus.common.bft.BftExtraData;
 +import org.hyperledger.besu.consensus.common.bft.FalconSeal;
 +import org.hyperledger.besu.consensus.common.bft.FalconSealSupport;
++import org.hyperledger.besu.consensus.common.bft.HybridSealSupport;
++import org.hyperledger.besu.consensus.common.bft.HybridSignerRegistry;
 +import org.hyperledger.besu.consensus.common.bft.PqAnchor;
 +import org.hyperledger.besu.consensus.common.bft.PqAnchorConfig;
 +import org.hyperledger.besu.consensus.common.bft.PqAnchorNotReadyException;
++import org.hyperledger.besu.consensus.common.bft.PqAnchorV2;
 +import org.hyperledger.besu.consensus.common.bft.PqSealCache;
 +import org.hyperledger.besu.consensus.common.bft.PqSignerRegistry;
++import org.hyperledger.besu.consensus.common.bft.SchemeSeal;
++import org.hyperledger.besu.consensus.common.bft.SealScheme;
++import org.hyperledger.besu.consensus.common.bft.SealSchemes;
 +import org.hyperledger.besu.datatypes.Address;
 +import org.hyperledger.besu.ethereum.ProtocolContext;
 +import org.hyperledger.besu.ethereum.core.BlockHeader;
@@ -11987,6 +15555,7 @@ index 000000000..8ff0f9d97
 +import java.util.Collection;
 +import java.util.LinkedHashSet;
 +import java.util.List;
++import java.util.Optional;
 +import java.util.Set;
 +import java.util.concurrent.atomic.AtomicBoolean;
 +
@@ -12113,6 +15682,51 @@ index 000000000..8ff0f9d97
 +  }
 +
 +  /**
++   * AERE D-311 (2026-09-02): THE ONE PLACE that says which bytes a commit's post-quantum seal
++   * signs. Both the emitter ({@code QbftRound.pqSealMessageFor}) and the verifier
++   * ({@code MessageValidator.SubsequentMessageValidator}, feeding {@code PqCommitEnforcement})
++   * call this and nothing else.
++   *
++   * 
      Why it exists, measured on the public testnet 28001 the day it was born: with the anchor
++   * armed (as on 2800 since 13,014,000) the emitter signed the anchor form, while the commit
++   * enforcement verified over the ECDSA committed-seal hash. Two copies of one rule, and they
++   * drifted: at {@code aere.pq.commitPq.forkBlock} every commit of every validator was refused
++   * ("does NOT verify over the commit digest") and the chain stopped. The rehearsal (F95) never
++   * saw it because its kit runs without the anchor armed. Arming H1 on 2800 with the old
++   * verifier would have stopped the live chain.
++   *
++   * @param blockNumber the height of the block the commit votes for
++   * @param onchainHash the ROUND-INDEPENDENT on-chain hash of that block (round forced to 0)
++   * @param commitHash the ECDSA committed-seal hash (round-specific)
++   * @return the 32 bytes the Falcon seal (and any hybrid extras) must sign at this height
++   */
++  public static Bytes32 commitSealMessage(
++      final long blockNumber, final Bytes onchainHash, final Hash commitHash) {
++    return commitSealMessage(blockNumber, () -> onchainHash, commitHash);
++  }
++
++  /**
++   * Same as {@link #commitSealMessage(long, Bytes, Hash)}, with the on-chain hash supplied LAZILY:
++   * it is only needed (and only computed) in the anchor form. Below the anchor the ECDSA digest is
++   * the message and no round-0 re-encoding happens, which is also what keeps every upstream test
++   * that mocks {@code QbftBlockInterface} exactly as it was.
++   *
++   * @param blockNumber the height of the block the commit votes for
++   * @param onchainHash supplier of the ROUND-INDEPENDENT on-chain hash (round forced to 0)
++   * @param commitHash the ECDSA committed-seal hash (round-specific)
++   * @return the 32 bytes the Falcon seal (and any hybrid extras) must sign at this height
++   */
++  public static Bytes32 commitSealMessage(
++      final long blockNumber,
++      final java.util.function.Supplier onchainHash,
++      final Hash commitHash) {
++    if (sealMessageIsAnchorForm(blockNumber)) {
++      return PqAnchor.commitMessage(config().chainId(), blockNumber, onchainHash.get());
++    }
++    return Bytes32.wrap(commitHash.getBytes());
++  }
++
++  /**
 +   * Return the extra data the proposer should encode for a block on top of this parent.
 +   *
 +   * 
      Below the activation height the input is returned UNCHANGED, so pre-fork behaviour is
@@ -12158,14 +15772,14 @@ index 000000000..8ff0f9d97
 +    final int sealCap = cfg.maxSealsCarried().orElse(Integer.MAX_VALUE);
 +    int rejectedIneligible = 0;
 +    int rejectedInvalid = 0;
-+    // HEIGHT-RESOLVED LOOKUP (2026-08-06): the proposer resolves keys AT THE PARENT'S HEIGHT, the
-+    // same height R2 will use when it re-checks this certificate. Before this the producer asked a
-+    // height-less registry while R2 asked a height-resolved one, so at a rotation height the two
-+    // could disagree about which key set applies - the proposer would assemble a certificate the
-+    // fleet then refuses, and the round would fail for a reason no log named. Building and
-+    // validating now read the same question.
++    // D2 (2026-08-06): the proposer resolves keys AT THE PARENT'S HEIGHT, the same height R2 will
++    // use when it re-checks this certificate. Before this the producer asked a height-less registry
++    // while R2 asked a height-resolved one, so at a rotation height the two could disagree about
++    // which key set applies - the proposer would assemble a certificate the fleet then refuses, and
++    // the round would fail for a reason no log named. Building and validating now read the same
++    // question.
 +    for (final FalconSeal seal : PqAnchor.sortedByIndex(heard)) {
-+      // OWN-HEAD DOOR (b-v2): parentHeader is this node's own head - this method is
++      // D2 (b-v2): the OWN-HEAD door. parentHeader is this node's own head - this method is
 +      // reached only from the proposer, building the block on top of it. Refusing here for a
 +      // missing schedule is what stopped block production in PqForkValidatorSetChangeTest.
 +      final Address signer =
@@ -12183,9 +15797,9 @@ index 000000000..8ff0f9d97
 +      // THE COST CAP. K is a FLOOR, not a ceiling: without this break the proposer writes every
 +      // eligible seal it happened to hear, so a K=3 chain at N=7 carries four, five, six or seven.
 +      // Measured 2026-08-07 on a live seven-node run with the threshold at 4: 42 blocks carried 4
-+      // seals, 36 carried 5, 5 carried 6. At 666 bytes a seal that is roughly 1.7 times the header
-+      // bytes the same chain would write capped at K, and the extra buys NOTHING: what a verifier
-+      // demands is the threshold, not how many seals a proposer volunteers above it.
++      // seals, 36 carried 5, 5 carried 6. At 666 bytes a seal that is 200.9 GB per node per year
++      // instead of 120.5, and the extra buys NOTHING: what a verifier demands is the threshold, not
++      // how many seals a proposer volunteers above it.
 +      //
 +      // The break is safe precisely because it is placed AFTER the eligibility and signature checks:
 +      // every seal counted here has already been verified, so stopping at the cap can never leave
@@ -12231,6 +15845,9 @@ index 000000000..8ff0f9d97
 +              + "refusing to write it. This is a bug in the producer, not a configuration fault.");
 +    }
 +
++    if (cfg.anchorV2AppliesAt(blockNumber)) {
++      return applyV2(cfg, blockNumber, parentHeader, base, certificate, message, required, sealCap);
++    }
 +    final Bytes32 digest =
 +        PqAnchor.anchorDigest(
 +            cfg.chainId(), parentNumber, parentHeader.getHash().getBytes(), certificate);
@@ -12253,6 +15870,126 @@ index 000000000..8ff0f9d97
 +  }
 +
 +  /**
++   * AERE ANCHOR V2 (2026-09-03): the SCHEME-TAGGED certificate. Carries the Falcon seals already
++   * verified by the caller, tagged 0x01, plus, for every extra scheme the scheme schedule names at
++   * the PARENT height, the heard seals of that scheme that (a) come from an index that also holds a
++   * Falcon seal in this very certificate, the binding that stops a lone hash-based seal from
++   * standing in for a validator, and (b) verify under the hybrid registry's key for that index and
++   * scheme, over the SAME message M(parent) the Falcon seal signs. K seals per scheme, capped like
++   * Falcon. vanityData becomes the v2 digest under "AERE-PQ-ANCHOR-2". Refuses, through the same
++   * not-ready exception the v1 path uses, rather than writing a certificate short of a scheme.
++   */
++  private static BftExtraData applyV2(
++      final PqAnchorConfig cfg,
++      final long blockNumber,
++      final BlockHeader parentHeader,
++      final BftExtraData base,
++      final List falconCertificate,
++      final Bytes32 message,
++      final int required,
++      final int sealCap) {
++    final long parentNumber = parentHeader.getNumber();
++    final List v2 = new ArrayList<>();
++    final Set falconIndices = new LinkedHashSet<>();
++    for (final FalconSeal f : falconCertificate) {
++      v2.add(new SchemeSeal(SealSchemes.FALCON_512.wireId(), f.getValidatorIndex(), f.getSignature()));
++      falconIndices.add(f.getValidatorIndex());
++    }
++    final HybridSealSupport hybrid = HybridSealSupport.instance();
++    final Set schemes =
++        hybrid.schedule().map(sch -> sch.schemesAt(parentNumber)).orElse(Set.of());
++    final List heard =
++        PqSealCache.instance().extrasFor(parentNumber, parentHeader.getHash());
++    for (final String schemeId : schemes) {
++      if (SealSchemes.FALCON_512.id().equals(schemeId)) {
++        continue;
++      }
++      final Optional scheme = SealSchemes.byId(schemeId);
++      if (scheme.isEmpty()) {
++        throw new PqAnchorNotReadyException(
++            parentNumber,
++            0,
++            required,
++            "the scheme schedule names '" + schemeId + "', which this binary does not implement");
++      }
++      final Optional registry = hybrid.registry();
++      if (registry.isEmpty()) {
++        throw new PqAnchorNotReadyException(
++            parentNumber,
++            0,
++            required,
++            "no hybrid registry is loaded on this node, so no " + schemeId + " seal can be verified");
++      }
++      int kept = 0;
++      int rejected = 0;
++      for (final SchemeSeal s : heard) {
++        if (s.getSchemeWireId() != scheme.get().wireId()) {
++          continue;
++        }
++        if (!falconIndices.contains(s.getValidatorIndex())) {
++          rejected++;
++          continue;
++        }
++        final Optional pk = registry.get().publicKey(s.getValidatorIndex(), schemeId);
++        if (pk.isEmpty()
++            || !scheme.get().verifyRaw(pk.get(), message.toArray(), s.getSignature().toArray())) {
++          rejected++;
++          continue;
++        }
++        v2.add(s);
++        kept++;
++        if (kept >= sealCap) {
++          break;
++        }
++      }
++      if (kept < required) {
++        throw new PqAnchorNotReadyException(
++            parentNumber,
++            kept,
++            required,
++            "V2: heard "
++                + heard.size()
++                + " extra seal(s) for parent hash "
++                + parentHeader.getHash()
++                + "; "
++                + kept
++                + " valid "
++                + schemeId
++                + " seal(s) bound to a Falcon-certified index, "
++                + rejected
++                + " rejected. The v2 certificate needs K="
++                + required
++                + " seals of EVERY scheme the schedule names at height "
++                + parentNumber
++                + " ("
++                + String.join("+", schemes)
++                + ").");
++      }
++    }
++    v2.sort(PqAnchorV2.CANONICAL);
++    final Bytes32 digest =
++        PqAnchorV2.anchorDigestV2(
++            cfg.chainId(), parentNumber, parentHeader.getHash().getBytes(), v2);
++    LOG.debug(
++        "AERE PQ-ANCHOR V2: block {} carries a {}-seal scheme-tagged certificate over parent {} "
++            + "(K={} per scheme, schemes={}), vanity D2={}",
++        blockNumber,
++        v2.size(),
++        parentNumber,
++        required,
++        schemes,
++        digest);
++    return new BftExtraData(
++        digest,
++        base.getSeals(),
++        base.getVote(),
++        base.getRound(),
++        base.getValidators(),
++        List.of(),
++        v2);
++  }
++
++  /**
 +   * The validator set FOR the parent block: the nodes that were entitled to seal it.
 +   *
 +   * 
      Taken for the PARENT, not for the block being built, because those are the nodes whose seals
@@ -12301,9 +16038,2378 @@ index 000000000..8ff0f9d97
 +    }
 +  }
 +}
+diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/ADRS.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/ADRS.java
+new file mode 100755
+index 000000000..7610cf876
+--- /dev/null
++++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/ADRS.java
+@@ -0,0 +1,115 @@
++/*
++ * Derived from Bouncy Castle 1.80, package org.bouncycastle.pqc.crypto.slhdsa (MIT licence,
++ * Copyright (c) 2000-2025 The Legion of the Bouncy Castle Inc., see LICENTA-BOUNCYCASTLE.txt),
++ * regenerated into Aere Network by consensus-pqc/slhdsa-fork/genereaza-motorul.py on 2026-09-04 (D-337).
++ * The ONLY change of substance: the SHA-2 engine hashes through the JDK's MessageDigest (SHA-NI
++ * intrinsics) instead of Bouncy Castle's pure-Java digests, which made one SLH-DSA-SHA2-128s signature
++ * cost seconds on the QBFT thread at every anchor parent. Algorithm, key formats and signature bytes are
++ * FIPS 205 as before; SlhDsaFastEngineTest pins that against the original, in both directions.
++ * DO NOT EDIT BY HAND: regenerate with the script above.
++ */
++package org.hyperledger.besu.consensus.common.bft.slhdsa;
++
++import org.bouncycastle.util.Arrays;
++import org.bouncycastle.util.Pack;
++
++@SuppressWarnings("all")
++class ADRS
++{
++    static final int WOTS_HASH = 0;
++    static final int WOTS_PK = 1;
++    static final int TREE = 2;
++    static final int FORS_TREE = 3;
++    static final int FORS_PK = 4;
++    static final int WOTS_PRF = 5;
++    static final int FORS_PRF = 6;
++
++    static final int OFFSET_LAYER = 0;
++    static final int OFFSET_TREE = 4;
++    static final int OFFSET_TREE_HGT = 24;
++    static final int OFFSET_TREE_INDEX = 28;
++    static final int OFFSET_TYPE = 16;
++    static final int OFFSET_KP_ADDR = 20;
++    static final int OFFSET_CHAIN_ADDR = 24;
++    static final int OFFSET_HASH_ADDR = 28;
++
++    final byte[] value = new byte[32];
++
++    ADRS()
++    {
++    }
++
++    ADRS(ADRS adrs)
++    {
++        System.arraycopy(adrs.value, 0, this.value, 0, adrs.value.length);
++    }
++
++    public void setLayerAddress(int layer)
++    {
++        Pack.intToBigEndian(layer, value, OFFSET_LAYER);
++    }
++
++    public int getLayerAddress()
++    {
++        return Pack.bigEndianToInt(value, OFFSET_LAYER);
++    }
++
++    public void setTreeAddress(long tree)
++    {
++        // tree address is 12 bytes
++        Pack.longToBigEndian(tree, value, OFFSET_TREE + 4);
++    }
++
++    public long getTreeAddress()
++    {
++        return Pack.bigEndianToLong(value, OFFSET_TREE + 4);
++    }
++
++    public void setTreeHeight(int height)
++    {
++        Pack.intToBigEndian(height, value, OFFSET_TREE_HGT);
++    }
++
++    public void setTreeIndex(int index)
++    {
++        Pack.intToBigEndian(index, value, OFFSET_TREE_INDEX);
++    }
++
++    public int getTreeIndex()
++    {
++        return Pack.bigEndianToInt(value, OFFSET_TREE_INDEX);
++    }
++
++    // resets part of value to zero in line with 2.7.3
++    public void setTypeAndClear(int type)
++    {
++        Pack.intToBigEndian(type, value, OFFSET_TYPE);
++
++        Arrays.fill(value, 20, value.length, (byte)0);
++    }
++
++    public void changeType(int type)
++    {
++        Pack.intToBigEndian(type, value, OFFSET_TYPE);
++    }
++
++    public void setKeyPairAddress(int keyPairAddr)
++    {
++        Pack.intToBigEndian(keyPairAddr, value, OFFSET_KP_ADDR);
++    }
++
++    public int getKeyPairAddress()
++    {
++        return Pack.bigEndianToInt(value, OFFSET_KP_ADDR);
++    }
++
++    public void setHashAddress(int hashAddr)
++    {
++        Pack.intToBigEndian(hashAddr, value, OFFSET_HASH_ADDR);
++    }          
++
++    public void setChainAddress(int chainAddr)
++    {
++        Pack.intToBigEndian(chainAddr, value, OFFSET_CHAIN_ADDR);
++    }
++}
+diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/Fors.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/Fors.java
+new file mode 100755
+index 000000000..d89d83af8
+--- /dev/null
++++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/Fors.java
+@@ -0,0 +1,178 @@
++/*
++ * Derived from Bouncy Castle 1.80, package org.bouncycastle.pqc.crypto.slhdsa (MIT licence,
++ * Copyright (c) 2000-2025 The Legion of the Bouncy Castle Inc., see LICENTA-BOUNCYCASTLE.txt),
++ * regenerated into Aere Network by consensus-pqc/slhdsa-fork/genereaza-motorul.py on 2026-09-04 (D-337).
++ * The ONLY change of substance: the SHA-2 engine hashes through the JDK's MessageDigest (SHA-NI
++ * intrinsics) instead of Bouncy Castle's pure-Java digests, which made one SLH-DSA-SHA2-128s signature
++ * cost seconds on the QBFT thread at every anchor parent. Algorithm, key formats and signature bytes are
++ * FIPS 205 as before; SlhDsaFastEngineTest pins that against the original, in both directions.
++ * DO NOT EDIT BY HAND: regenerate with the script above.
++ */
++package org.hyperledger.besu.consensus.common.bft.slhdsa;
++
++import java.math.BigInteger;
++import java.util.LinkedList;
++
++import org.bouncycastle.util.Arrays;
++
++@SuppressWarnings("all")
++class Fors
++{
++    SLHDSAEngine engine;
++
++    public Fors(SLHDSAEngine engine)
++    {
++        this.engine = engine;
++    }
++
++    // Input: Secret seed SK.seed, start index s, target node height z, public seed PK.seed, address ADRS
++    // Output: n-byte root node - top node on Stack
++    byte[] treehash(byte[] skSeed, int s, int z, byte[] pkSeed, ADRS adrsParam)
++    {
++        if ((s >>> z) << z != s)
++        {
++            return null;
++        }
++
++        LinkedList stack = new LinkedList();
++        ADRS adrs = new ADRS(adrsParam);
++
++        for (int idx = 0; idx < (1 << z); idx++)
++        {
++            adrs.setTypeAndClear(ADRS.FORS_PRF);
++            adrs.setKeyPairAddress(adrsParam.getKeyPairAddress());
++            adrs.setTreeHeight(0);
++            adrs.setTreeIndex(s + idx);
++
++            byte[] sk = engine.PRF(pkSeed, skSeed, adrs);
++
++            adrs.changeType(ADRS.FORS_TREE);
++
++            byte[] node = engine.F(pkSeed, adrs, sk);
++
++            adrs.setTreeHeight(1);
++
++            int adrsTreeHeight = 1;
++            int adrsTreeIndex = s + idx;
++
++            // while ( Top node on Stack has same height as node )
++            while (!stack.isEmpty() && stack.get(0).nodeHeight == adrsTreeHeight)
++            {
++                adrsTreeIndex = (adrsTreeIndex - 1) / 2;
++                adrs.setTreeIndex(adrsTreeIndex);
++
++                NodeEntry current = stack.remove(0);
++                node = engine.H(pkSeed, adrs, current.nodeValue, node);
++
++                // topmost node is now one layer higher
++                adrs.setTreeHeight(++adrsTreeHeight);
++            }
++
++            stack.add(0, new NodeEntry(node, adrsTreeHeight));
++        }
++
++        return stack.get(0).nodeValue;
++    }
++
++    public SIG_FORS[] sign(byte[] md, byte[] skSeed, byte[] pkSeed, ADRS paramAdrs)
++    {
++        ADRS adrs = new ADRS(paramAdrs);
++
++//        int[] idxs = message_to_idxs(md, engine.K, engine.A);
++        int[] idxs = base2B(md, engine.A, engine.K);
++        SIG_FORS[] sig_fors = new SIG_FORS[engine.K];
++// compute signature elements
++        int t = engine.T;
++        for (int i = 0; i < engine.K; i++)
++        {
++// get next index
++            int idx = idxs[i];
++// pick private key element
++            adrs.setTypeAndClear(ADRS.FORS_PRF);
++            adrs.setKeyPairAddress(paramAdrs.getKeyPairAddress());
++            adrs.setTreeHeight(0);
++            adrs.setTreeIndex(i * t + idx);
++
++            byte[] sk = engine.PRF(pkSeed, skSeed, adrs);
++
++            adrs.changeType(ADRS.FORS_TREE);
++
++            byte[][] authPath = new byte[engine.A][];
++// compute auth path
++            for (int j = 0; j < engine.A; j++)
++            {
++                int s = (idx / (1 << j)) ^ 1;
++                authPath[j] = treehash(skSeed, i * t + s * (1 << j), j, pkSeed, adrs);
++            }
++            sig_fors[i] = new SIG_FORS(sk, authPath);
++        }
++        return sig_fors;
++    }
++
++    public byte[] pkFromSig(SIG_FORS[] sig_fors, byte[] message, byte[] pkSeed, ADRS adrs)
++    {
++        byte[][] node = new byte[2][];
++        byte[][] root = new byte[engine.K][];
++        int t = engine.T;
++
++//        int[] idxs = message_to_idxs(message, engine.K, engine.A);
++        int[] idxs = base2B(message, engine.A, engine.K);
++        // compute roots
++        for (int i = 0; i < engine.K; i++)
++        {
++            // get next index
++            int idx = idxs[i];
++            // compute leaf
++            byte[] sk = sig_fors[i].getSK();
++            adrs.setTreeHeight(0);
++            adrs.setTreeIndex(i * t + idx);
++            node[0] = engine.F(pkSeed, adrs, sk);
++            // compute root from leaf and AUTH
++            byte[][] authPath = sig_fors[i].getAuthPath();
++
++            adrs.setTreeIndex(i * t + idx);
++            for (int j = 0; j < engine.A; j++)
++            {
++                adrs.setTreeHeight(j + 1);
++                if (((idx / (1 << j)) % 2) == 0)
++                {
++                    adrs.setTreeIndex(adrs.getTreeIndex() / 2);
++                    node[1] = engine.H(pkSeed, adrs, node[0], authPath[j]);
++                }
++                else
++                {
++                    adrs.setTreeIndex((adrs.getTreeIndex() - 1) / 2);
++                    node[1] = engine.H(pkSeed, adrs, authPath[j], node[0]);
++                }
++                node[0] = node[1];
++            }
++            root[i] = node[0];
++        }
++        ADRS forspkADRS = new ADRS(adrs); // copy address to create FTS public key address
++        forspkADRS.setTypeAndClear(ADRS.FORS_PK);
++        forspkADRS.setKeyPairAddress(adrs.getKeyPairAddress());
++        return engine.T_l(pkSeed, forspkADRS, Arrays.concatenate(root));
++    }
++
++    static int[] base2B(byte[] msg, int b, int outLen)
++    {
++        int[] baseB = new int[outLen];
++        int i = 0;
++        int bits = 0;
++        BigInteger total = BigInteger.ZERO;
++
++        for (int o = 0; o < outLen; o++)
++        {
++            while (bits < b)
++            {
++                total = total.shiftLeft(8).add(BigInteger.valueOf(msg[i] & 0xff));
++                i+= 1;
++                bits += 8;
++            }
++            bits -= b;
++            baseB[o] = (total.shiftRight(bits).mod(BigInteger.valueOf(2).pow(b))).intValue();
++        }
++
++        return baseB;
++    }
++}
+diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/HT.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/HT.java
+new file mode 100755
+index 000000000..b7d96c16f
+--- /dev/null
++++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/HT.java
+@@ -0,0 +1,225 @@
++/*
++ * Derived from Bouncy Castle 1.80, package org.bouncycastle.pqc.crypto.slhdsa (MIT licence,
++ * Copyright (c) 2000-2025 The Legion of the Bouncy Castle Inc., see LICENTA-BOUNCYCASTLE.txt),
++ * regenerated into Aere Network by consensus-pqc/slhdsa-fork/genereaza-motorul.py on 2026-09-04 (D-337).
++ * The ONLY change of substance: the SHA-2 engine hashes through the JDK's MessageDigest (SHA-NI
++ * intrinsics) instead of Bouncy Castle's pure-Java digests, which made one SLH-DSA-SHA2-128s signature
++ * cost seconds on the QBFT thread at every anchor parent. Algorithm, key formats and signature bytes are
++ * FIPS 205 as before; SlhDsaFastEngineTest pins that against the original, in both directions.
++ * DO NOT EDIT BY HAND: regenerate with the script above.
++ */
++package org.hyperledger.besu.consensus.common.bft.slhdsa;
++
++import java.util.LinkedList;
++
++import org.bouncycastle.util.Arrays;
++
++@SuppressWarnings("all")
++class HT
++{
++    private final byte[] skSeed;
++    private final byte[] pkSeed;
++    SLHDSAEngine engine;
++    WotsPlus wots;
++
++    final byte[] htPubKey;
++
++    public HT(SLHDSAEngine engine, byte[] skSeed, byte[] pkSeed)
++    {
++        this.skSeed = skSeed;
++        this.pkSeed = pkSeed;
++
++        this.engine = engine;
++        this.wots = new WotsPlus(engine);
++
++        ADRS adrs = new ADRS();
++        adrs.setLayerAddress(engine.D - 1);
++        adrs.setTreeAddress(0);
++
++        if (skSeed != null)
++        {
++            htPubKey = xmss_PKgen(skSeed, pkSeed, adrs);
++        }
++        else
++        {
++            htPubKey = null;
++        }
++    }
++
++    byte[] sign(byte[] M, long idx_tree, int idx_leaf)
++    {
++        // init
++        ADRS adrs = new ADRS();
++        // sign
++       // adrs.setType(ADRS.TREE);
++        adrs.setLayerAddress(0);
++        adrs.setTreeAddress(idx_tree);
++        SIG_XMSS SIG_tmp = xmss_sign(M, skSeed, idx_leaf, pkSeed, adrs);
++        SIG_XMSS[] SIG_HT = new SIG_XMSS[engine.D];
++        SIG_HT[0] = SIG_tmp;
++
++        adrs.setLayerAddress(0);
++        adrs.setTreeAddress(idx_tree);
++
++        byte[] root = xmss_pkFromSig(idx_leaf, SIG_tmp, M, pkSeed, adrs);
++
++        for (int j = 1; j < engine.D; j++)
++        {
++            idx_leaf = (int)(idx_tree & ((1 << engine.H_PRIME) - 1));  // least significant bits of idx_tree;
++            idx_tree >>>= engine.H_PRIME; // most significant bits of idx_tree;
++            adrs.setLayerAddress(j);
++            adrs.setTreeAddress(idx_tree);
++            SIG_tmp = xmss_sign(root, skSeed, idx_leaf, pkSeed, adrs);
++            SIG_HT[j] = SIG_tmp;
++            if (j < engine.D - 1)
++            {
++                root = xmss_pkFromSig(idx_leaf, SIG_tmp, root, pkSeed, adrs);
++            }
++        }
++
++        byte[][] totSigs = new byte[SIG_HT.length][];
++        for (int i = 0; i != totSigs.length; i++)
++        {
++            totSigs[i] = Arrays.concatenate(SIG_HT[i].sig, Arrays.concatenate(SIG_HT[i].auth));
++        }
++
++        return Arrays.concatenate(totSigs);
++    }
++
++    byte[] xmss_PKgen(byte[] skSeed, byte[] pkSeed, ADRS adrs)
++    {
++        return treehash(skSeed, 0, engine.H_PRIME, pkSeed, adrs);
++    }
++
++    // Input: index idx, XMSS signature SIG_XMSS = (sig || AUTH), n-byte message M, public seed PK.seed, address ADRS
++    // Output: n-byte root value node[0]
++    byte[] xmss_pkFromSig(int idx, SIG_XMSS sig_xmss, byte[] M, byte[] pkSeed, ADRS paramAdrs)
++    {
++        ADRS adrs = new ADRS(paramAdrs);
++
++        // compute WOTS+ pk from WOTS+ sig
++        adrs.setTypeAndClear(ADRS.WOTS_HASH);
++        adrs.setKeyPairAddress(idx);
++        byte[] sig = sig_xmss.getWOTSSig();
++        byte[][] AUTH = sig_xmss.getXMSSAUTH();
++
++        byte[] node0 = wots.pkFromSig(sig, M, pkSeed, adrs);
++        byte[] node1 = null;
++
++        // compute root from WOTS+ pk and AUTH
++        adrs.setTypeAndClear(ADRS.TREE);
++        adrs.setTreeIndex(idx);
++        for (int k = 0; k < engine.H_PRIME; k++)
++        {
++            adrs.setTreeHeight(k + 1);
++            if (((idx / (1 << k)) % 2) == 0)
++            {
++                adrs.setTreeIndex(adrs.getTreeIndex() / 2);
++                node1 = engine.H(pkSeed, adrs, node0, AUTH[k]);
++            }
++            else
++            {
++                adrs.setTreeIndex((adrs.getTreeIndex() - 1) / 2);
++                node1 = engine.H(pkSeed, adrs, AUTH[k], node0);
++            }
++            node0 = node1;
++        }
++        return node0;
++    }
++
++    //    # Input: n-byte message M, secret seed SK.seed, index idx, public seed PK.seed,
++    //    address ADRS
++    //    # Output: XMSS signature SIG_XMSS = (sig || AUTH)
++    SIG_XMSS xmss_sign(byte[] M, byte[] skSeed, int idx, byte[] pkSeed, ADRS paramAdrs)
++    {
++        byte[][] AUTH = new byte[engine.H_PRIME][];
++
++        ADRS adrs = new ADRS(paramAdrs);
++
++        adrs.setTypeAndClear(ADRS.TREE);
++        adrs.setLayerAddress(paramAdrs.getLayerAddress());
++        adrs.setTreeAddress(paramAdrs.getTreeAddress());
++
++        // build authentication path
++        for (int j = 0; j < engine.H_PRIME; j++)
++        {
++            int k = (idx >>> j) ^ 1;
++            AUTH[j] = treehash(skSeed, k << j, j, pkSeed, adrs);
++        }
++        adrs = new ADRS(paramAdrs);
++        adrs.setTypeAndClear(ADRS.WOTS_HASH);
++        adrs.setKeyPairAddress(idx);
++
++        byte[] sig = wots.sign(M, skSeed, pkSeed, adrs);
++
++        return new SIG_XMSS(sig, AUTH);
++    }
++
++    // Input: Secret seed SK.seed, start index s, target node height z, public seed PK.seed, address ADRS
++    // Output: n-byte root node - top node on Stack
++    byte[] treehash(byte[] skSeed, int s, int z, byte[] pkSeed, ADRS adrsParam)
++    {
++        if ((s >>> z) << z != s)
++        {
++            return null;
++        }
++
++        LinkedList stack = new LinkedList();
++        ADRS adrs = new ADRS(adrsParam);
++
++        for (int idx = 0; idx < (1 << z); idx++)
++        {
++            adrs.setTypeAndClear(ADRS.WOTS_HASH);
++            adrs.setKeyPairAddress(s + idx);
++            byte[] node = wots.pkGen(skSeed, pkSeed, adrs);
++
++            adrs.setTypeAndClear(ADRS.TREE);
++            adrs.setTreeHeight(1);
++            adrs.setTreeIndex(s + idx);
++
++            int adrsTreeHeight = 1;
++            int adrsTreeIndex = s + idx;
++
++            // while ( Top node on Stack has same height as node )
++            while (!stack.isEmpty() && stack.get(0).nodeHeight == adrsTreeHeight)
++            {
++                adrsTreeIndex = (adrsTreeIndex - 1) / 2;
++                adrs.setTreeIndex(adrsTreeIndex);
++
++                NodeEntry current = stack.remove(0);
++                node = engine.H(pkSeed, adrs, current.nodeValue, node);
++
++                // topmost node is now one layer higher
++                adrs.setTreeHeight(++adrsTreeHeight);
++            }
++
++            stack.add(0, new NodeEntry(node, adrsTreeHeight));
++        }
++
++        return stack.get(0).nodeValue;
++    }
++
++    //    # Input: Message M, signature SIG_HT, public seed PK.seed, tree index idx_tree,
++//    leaf index idx_leaf, HT public key PK_HT.
++//    # Output: Boolean
++    public boolean verify(byte[] M, SIG_XMSS[] sig_ht, byte[] pkSeed, long idx_tree, int idx_leaf, byte[] PK_HT)
++    {
++        // init
++        ADRS adrs = new ADRS();
++        // verify
++        SIG_XMSS SIG_tmp = sig_ht[0];
++        adrs.setLayerAddress(0);
++        adrs.setTreeAddress(idx_tree);
++        byte[] node = xmss_pkFromSig(idx_leaf, SIG_tmp, M, pkSeed, adrs);
++        for (int j = 1; j < engine.D; j++)
++        {
++            idx_leaf = (int)(idx_tree & ((1 << engine.H_PRIME) - 1));  // least significant bits of idx_tree;
++            idx_tree >>>= engine.H_PRIME; // most significant bits of idx_tree;
++            SIG_tmp = sig_ht[j];
++            adrs.setLayerAddress(j);
++            adrs.setTreeAddress(idx_tree);
++            node = xmss_pkFromSig(idx_leaf, SIG_tmp, node, pkSeed, adrs);
++        }
++        return Arrays.areEqual(PK_HT, node);
++    }
++}
+diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/IndexedDigest.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/IndexedDigest.java
+new file mode 100755
+index 000000000..8ff076d70
+--- /dev/null
++++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/IndexedDigest.java
+@@ -0,0 +1,26 @@
++/*
++ * Derived from Bouncy Castle 1.80, package org.bouncycastle.pqc.crypto.slhdsa (MIT licence,
++ * Copyright (c) 2000-2025 The Legion of the Bouncy Castle Inc., see LICENTA-BOUNCYCASTLE.txt),
++ * regenerated into Aere Network by consensus-pqc/slhdsa-fork/genereaza-motorul.py on 2026-09-04 (D-337).
++ * The ONLY change of substance: the SHA-2 engine hashes through the JDK's MessageDigest (SHA-NI
++ * intrinsics) instead of Bouncy Castle's pure-Java digests, which made one SLH-DSA-SHA2-128s signature
++ * cost seconds on the QBFT thread at every anchor parent. Algorithm, key formats and signature bytes are
++ * FIPS 205 as before; SlhDsaFastEngineTest pins that against the original, in both directions.
++ * DO NOT EDIT BY HAND: regenerate with the script above.
++ */
++package org.hyperledger.besu.consensus.common.bft.slhdsa;
++
++@SuppressWarnings("all")
++class IndexedDigest
++{
++    final long idx_tree;
++    final int idx_leaf;
++    final byte[] digest;
++
++    IndexedDigest(long idx_tree, int idx_leaf, byte[] digest)
++    {
++        this.idx_tree = idx_tree;
++        this.idx_leaf = idx_leaf;
++        this.digest = digest;
++    }
++}
+diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/JdkDigest.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/JdkDigest.java
+new file mode 100755
+index 000000000..c7a8e86fa
+--- /dev/null
++++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/JdkDigest.java
+@@ -0,0 +1,104 @@
++/*
++ * Derived from Bouncy Castle 1.80, package org.bouncycastle.pqc.crypto.slhdsa (MIT licence,
++ * Copyright (c) 2000-2025 The Legion of the Bouncy Castle Inc., see LICENTA-BOUNCYCASTLE.txt),
++ * regenerated into Aere Network by consensus-pqc/slhdsa-fork/genereaza-motorul.py on 2026-09-04 (D-337).
++ * The ONLY change of substance: the SHA-2 engine hashes through the JDK's MessageDigest (SHA-NI
++ * intrinsics) instead of Bouncy Castle's pure-Java digests, which made one SLH-DSA-SHA2-128s signature
++ * cost seconds on the QBFT thread at every anchor parent. Algorithm, key formats and signature bytes are
++ * FIPS 205 as before; SlhDsaFastEngineTest pins that against the original, in both directions.
++ * DO NOT EDIT BY HAND: regenerate with the script above.
++ */
++package org.hyperledger.besu.consensus.common.bft.slhdsa;
++
++import java.security.DigestException;
++import java.security.MessageDigest;
++import java.security.NoSuchAlgorithmException;
++import org.bouncycastle.crypto.ExtendedDigest;
++import org.bouncycastle.util.Memoable;
++
++/**
++ * A Bouncy Castle {@link ExtendedDigest} backed by the JDK's {@link MessageDigest}, so SLH-DSA's
++ * millions of short hashes run on the SHA-NI intrinsics. Measured 2026-09-04 on an EPYC host: 3M
++ * SHA-256 of 64 bytes, Bouncy Castle 2533 ms, JDK 335 ms; one sha2_128s signature 1364 ms before,
++ * 325 ms after. {@link Memoable} is how the SLH-DSA engine keeps the pk-seed prefix state: it is
++ * implemented here with {@link MessageDigest#clone()}, which the SUN provider supports for SHA-2.
++ */
++@SuppressWarnings("all")
++final class JdkDigest implements ExtendedDigest, Memoable {
++  private final String algorithm;
++  private final int blockLength;
++  private MessageDigest md;
++
++  JdkDigest(final String algorithm, final int blockLength) {
++    this.algorithm = algorithm;
++    this.blockLength = blockLength;
++    try {
++      this.md = MessageDigest.getInstance(algorithm);
++    } catch (final NoSuchAlgorithmException e) {
++      throw new IllegalStateException("JDK has no " + algorithm, e);
++    }
++  }
++
++  private JdkDigest(final JdkDigest other) {
++    this.algorithm = other.algorithm;
++    this.blockLength = other.blockLength;
++    this.md = cloneOf(other.md);
++  }
++
++  private static MessageDigest cloneOf(final MessageDigest d) {
++    try {
++      return (MessageDigest) d.clone();
++    } catch (final CloneNotSupportedException e) {
++      throw new IllegalStateException(d.getAlgorithm() + " is not cloneable", e);
++    }
++  }
++
++  @Override
++  public String getAlgorithmName() {
++    return algorithm;
++  }
++
++  @Override
++  public int getDigestSize() {
++    return md.getDigestLength();
++  }
++
++  @Override
++  public int getByteLength() {
++    return blockLength;
++  }
++
++  @Override
++  public void update(final byte in) {
++    md.update(in);
++  }
++
++  @Override
++  public void update(final byte[] in, final int inOff, final int len) {
++    md.update(in, inOff, len);
++  }
++
++  @Override
++  public int doFinal(final byte[] out, final int outOff) {
++    try {
++      return md.digest(out, outOff, md.getDigestLength());
++    } catch (final DigestException e) {
++      throw new IllegalStateException(e);
++    }
++  }
++
++  @Override
++  public void reset() {
++    md.reset();
++  }
++
++  @Override
++  public Memoable copy() {
++    return new JdkDigest(this);
++  }
++
++  @Override
++  public void reset(final Memoable other) {
++    this.md = cloneOf(((JdkDigest) other).md);
++  }
++}
+diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/LICENSE-BouncyCastle.txt b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/LICENSE-BouncyCastle.txt
+new file mode 100755
+index 000000000..bfe226f1d
+--- /dev/null
++++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/LICENSE-BouncyCastle.txt
+@@ -0,0 +1,22 @@
++Licenta sub care ne este ingaduit sa purtam in arborele nostru motorul SLH-DSA generat de
++genereaza-motorul.py, adica fisierele din
++consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/.
++Sursa: bcprov-jdk18on-1.80-sources.jar, sha256 29e8414b7a07060b07222bb786dd594d2e411de0d7723d2fac8adedb0801cbef,
++fisierul org/bouncycastle/LICENSE.java. Licenta e MIT, compatibila cu Apache-2.0 a lui Besu.
++
++Copyright (c) 2000-2025 The Legion of the Bouncy Castle Inc. (https://www.bouncycastle.org)
++
++Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
++associated documentation files (the "Software"), to deal in the Software without restriction,
++including without limitation the rights to use, copy, modify, merge, publish, distribute,
++sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is
++furnished to do so, subject to the following conditions:
++
++The above copyright notice and this permission notice shall be included in all copies or
++substantial portions of the Software.
++
++THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT
++NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
++NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
++DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT
++OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/NodeEntry.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/NodeEntry.java
+new file mode 100755
+index 000000000..4cd30cfff
+--- /dev/null
++++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/NodeEntry.java
+@@ -0,0 +1,24 @@
++/*
++ * Derived from Bouncy Castle 1.80, package org.bouncycastle.pqc.crypto.slhdsa (MIT licence,
++ * Copyright (c) 2000-2025 The Legion of the Bouncy Castle Inc., see LICENTA-BOUNCYCASTLE.txt),
++ * regenerated into Aere Network by consensus-pqc/slhdsa-fork/genereaza-motorul.py on 2026-09-04 (D-337).
++ * The ONLY change of substance: the SHA-2 engine hashes through the JDK's MessageDigest (SHA-NI
++ * intrinsics) instead of Bouncy Castle's pure-Java digests, which made one SLH-DSA-SHA2-128s signature
++ * cost seconds on the QBFT thread at every anchor parent. Algorithm, key formats and signature bytes are
++ * FIPS 205 as before; SlhDsaFastEngineTest pins that against the original, in both directions.
++ * DO NOT EDIT BY HAND: regenerate with the script above.
++ */
++package org.hyperledger.besu.consensus.common.bft.slhdsa;
++
++@SuppressWarnings("all")
++class NodeEntry
++{
++    final byte[] nodeValue;
++    final int nodeHeight;
++
++    NodeEntry(byte[] nodeValue, int nodeHeight)
++    {
++        this.nodeValue = nodeValue;
++        this.nodeHeight = nodeHeight;
++    }
++}
+diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/PK.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/PK.java
+new file mode 100755
+index 000000000..4d0ef5fe2
+--- /dev/null
++++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/PK.java
+@@ -0,0 +1,24 @@
++/*
++ * Derived from Bouncy Castle 1.80, package org.bouncycastle.pqc.crypto.slhdsa (MIT licence,
++ * Copyright (c) 2000-2025 The Legion of the Bouncy Castle Inc., see LICENTA-BOUNCYCASTLE.txt),
++ * regenerated into Aere Network by consensus-pqc/slhdsa-fork/genereaza-motorul.py on 2026-09-04 (D-337).
++ * The ONLY change of substance: the SHA-2 engine hashes through the JDK's MessageDigest (SHA-NI
++ * intrinsics) instead of Bouncy Castle's pure-Java digests, which made one SLH-DSA-SHA2-128s signature
++ * cost seconds on the QBFT thread at every anchor parent. Algorithm, key formats and signature bytes are
++ * FIPS 205 as before; SlhDsaFastEngineTest pins that against the original, in both directions.
++ * DO NOT EDIT BY HAND: regenerate with the script above.
++ */
++package org.hyperledger.besu.consensus.common.bft.slhdsa;
++
++@SuppressWarnings("all")
++class PK
++{
++    final byte[] seed;
++    final byte[] root;
++
++    PK(byte[] seed, byte[] root)
++    {
++        this.seed = seed;
++        this.root = root;
++    }
++}
+diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SIG.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SIG.java
+new file mode 100755
+index 000000000..fb6d81702
+--- /dev/null
++++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SIG.java
+@@ -0,0 +1,77 @@
++/*
++ * Derived from Bouncy Castle 1.80, package org.bouncycastle.pqc.crypto.slhdsa (MIT licence,
++ * Copyright (c) 2000-2025 The Legion of the Bouncy Castle Inc., see LICENTA-BOUNCYCASTLE.txt),
++ * regenerated into Aere Network by consensus-pqc/slhdsa-fork/genereaza-motorul.py on 2026-09-04 (D-337).
++ * The ONLY change of substance: the SHA-2 engine hashes through the JDK's MessageDigest (SHA-NI
++ * intrinsics) instead of Bouncy Castle's pure-Java digests, which made one SLH-DSA-SHA2-128s signature
++ * cost seconds on the QBFT thread at every anchor parent. Algorithm, key formats and signature bytes are
++ * FIPS 205 as before; SlhDsaFastEngineTest pins that against the original, in both directions.
++ * DO NOT EDIT BY HAND: regenerate with the script above.
++ */
++package org.hyperledger.besu.consensus.common.bft.slhdsa;
++
++@SuppressWarnings("all")
++class SIG
++{
++    private final byte[] r;
++    private final SIG_FORS[] sig_fors;
++    private final SIG_XMSS[] sig_ht;
++
++    public SIG(int n, int k, int a, int d, int hPrime, int wots_len, byte[] signature)
++    {
++        this.r = new byte[n];
++        System.arraycopy(signature, 0, r, 0, n);
++
++        this.sig_fors = new SIG_FORS[k];
++        int offset = n;
++        for (int i = 0; i != k; i++)
++        {
++            byte[] sk = new byte[n];
++            System.arraycopy(signature, offset, sk, 0, n);
++            offset += n;
++            byte[][] authPath = new byte[a][];
++            for (int j = 0; j != a; j++)
++            {
++                authPath[j] = new byte[n];
++                System.arraycopy(signature, offset, authPath[j], 0, n);
++                offset += n;
++            }
++            sig_fors[i] = new SIG_FORS(sk, authPath);
++        }
++
++        sig_ht = new SIG_XMSS[d];
++        for (int i = 0; i != d; i++)
++        {
++            byte[] sig = new byte[wots_len * n];
++            System.arraycopy(signature, offset, sig, 0, sig.length);
++            offset += sig.length;
++            byte[][] authPath = new byte[hPrime][];
++            for (int j = 0; j != hPrime; j++)
++            {
++                authPath[j] = new byte[n];
++                System.arraycopy(signature, offset, authPath[j], 0, n);
++                offset += n;
++            }
++            sig_ht[i] = new SIG_XMSS(sig, authPath);
++        }
++        if (offset != signature.length)
++        {
++            throw new IllegalArgumentException("signature wrong length");
++        }
++    }
++
++    public byte[] getR()
++    {
++        return r;
++    }
++
++    public SIG_FORS[] getSIG_FORS()
++    {
++        return sig_fors;
++    }
++
++    public SIG_XMSS[] getSIG_HT()
++    {
++        return sig_ht;
++    }
++}
+diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SIG_FORS.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SIG_FORS.java
+new file mode 100755
+index 000000000..7c0064762
+--- /dev/null
++++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SIG_FORS.java
+@@ -0,0 +1,34 @@
++/*
++ * Derived from Bouncy Castle 1.80, package org.bouncycastle.pqc.crypto.slhdsa (MIT licence,
++ * Copyright (c) 2000-2025 The Legion of the Bouncy Castle Inc., see LICENTA-BOUNCYCASTLE.txt),
++ * regenerated into Aere Network by consensus-pqc/slhdsa-fork/genereaza-motorul.py on 2026-09-04 (D-337).
++ * The ONLY change of substance: the SHA-2 engine hashes through the JDK's MessageDigest (SHA-NI
++ * intrinsics) instead of Bouncy Castle's pure-Java digests, which made one SLH-DSA-SHA2-128s signature
++ * cost seconds on the QBFT thread at every anchor parent. Algorithm, key formats and signature bytes are
++ * FIPS 205 as before; SlhDsaFastEngineTest pins that against the original, in both directions.
++ * DO NOT EDIT BY HAND: regenerate with the script above.
++ */
++package org.hyperledger.besu.consensus.common.bft.slhdsa;
++
++@SuppressWarnings("all")
++class SIG_FORS
++{
++    final byte[][] authPath;
++    final byte[] sk;
++
++    SIG_FORS(byte[] sk, byte[][] authPath)
++    {
++        this.authPath = authPath;
++        this.sk = sk;
++    }
++
++    byte[] getSK()
++    {
++        return sk;
++    }
++
++    public byte[][] getAuthPath()
++    {
++        return authPath;
++    }
++}
+diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SIG_XMSS.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SIG_XMSS.java
+new file mode 100755
+index 000000000..f77ffaf1c
+--- /dev/null
++++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SIG_XMSS.java
+@@ -0,0 +1,34 @@
++/*
++ * Derived from Bouncy Castle 1.80, package org.bouncycastle.pqc.crypto.slhdsa (MIT licence,
++ * Copyright (c) 2000-2025 The Legion of the Bouncy Castle Inc., see LICENTA-BOUNCYCASTLE.txt),
++ * regenerated into Aere Network by consensus-pqc/slhdsa-fork/genereaza-motorul.py on 2026-09-04 (D-337).
++ * The ONLY change of substance: the SHA-2 engine hashes through the JDK's MessageDigest (SHA-NI
++ * intrinsics) instead of Bouncy Castle's pure-Java digests, which made one SLH-DSA-SHA2-128s signature
++ * cost seconds on the QBFT thread at every anchor parent. Algorithm, key formats and signature bytes are
++ * FIPS 205 as before; SlhDsaFastEngineTest pins that against the original, in both directions.
++ * DO NOT EDIT BY HAND: regenerate with the script above.
++ */
++package org.hyperledger.besu.consensus.common.bft.slhdsa;
++
++@SuppressWarnings("all")
++class SIG_XMSS
++{
++    final byte[] sig;
++    final byte[][] auth;
++
++    public SIG_XMSS(byte[] sig, byte[][] auth)
++    {
++        this.sig = sig;
++        this.auth = auth;
++    }
++
++    public byte[] getWOTSSig()
++    {
++        return sig;
++    }
++
++    public byte[][] getXMSSAUTH()
++    {
++        return auth;
++    }
++}
+diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SK.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SK.java
+new file mode 100755
+index 000000000..8040421b1
+--- /dev/null
++++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SK.java
+@@ -0,0 +1,24 @@
++/*
++ * Derived from Bouncy Castle 1.80, package org.bouncycastle.pqc.crypto.slhdsa (MIT licence,
++ * Copyright (c) 2000-2025 The Legion of the Bouncy Castle Inc., see LICENTA-BOUNCYCASTLE.txt),
++ * regenerated into Aere Network by consensus-pqc/slhdsa-fork/genereaza-motorul.py on 2026-09-04 (D-337).
++ * The ONLY change of substance: the SHA-2 engine hashes through the JDK's MessageDigest (SHA-NI
++ * intrinsics) instead of Bouncy Castle's pure-Java digests, which made one SLH-DSA-SHA2-128s signature
++ * cost seconds on the QBFT thread at every anchor parent. Algorithm, key formats and signature bytes are
++ * FIPS 205 as before; SlhDsaFastEngineTest pins that against the original, in both directions.
++ * DO NOT EDIT BY HAND: regenerate with the script above.
++ */
++package org.hyperledger.besu.consensus.common.bft.slhdsa;
++
++@SuppressWarnings("all")
++class SK
++{
++    final byte[] seed;
++    final byte[] prf;
++
++    SK(byte[] seed, byte[] prf)
++    {
++        this.seed = seed;
++        this.prf = prf;
++    }
++}
+diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSAEngine.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSAEngine.java
+new file mode 100755
+index 000000000..bf7b40087
+--- /dev/null
++++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSAEngine.java
+@@ -0,0 +1,466 @@
++/*
++ * Derived from Bouncy Castle 1.80, package org.bouncycastle.pqc.crypto.slhdsa (MIT licence,
++ * Copyright (c) 2000-2025 The Legion of the Bouncy Castle Inc., see LICENTA-BOUNCYCASTLE.txt),
++ * regenerated into Aere Network by consensus-pqc/slhdsa-fork/genereaza-motorul.py on 2026-09-04 (D-337).
++ * The ONLY change of substance: the SHA-2 engine hashes through the JDK's MessageDigest (SHA-NI
++ * intrinsics) instead of Bouncy Castle's pure-Java digests, which made one SLH-DSA-SHA2-128s signature
++ * cost seconds on the QBFT thread at every anchor parent. Algorithm, key formats and signature bytes are
++ * FIPS 205 as before; SlhDsaFastEngineTest pins that against the original, in both directions.
++ * DO NOT EDIT BY HAND: regenerate with the script above.
++ */
++package org.hyperledger.besu.consensus.common.bft.slhdsa;
++
++import org.bouncycastle.crypto.Digest;
++import org.bouncycastle.crypto.Xof;
++import org.bouncycastle.crypto.digests.SHAKEDigest;
++import org.bouncycastle.crypto.generators.MGF1BytesGenerator;
++import org.bouncycastle.crypto.macs.HMac;
++import org.bouncycastle.crypto.params.KeyParameter;
++import org.bouncycastle.crypto.params.MGFParameters;
++import org.bouncycastle.util.Arrays;
++import org.bouncycastle.util.Bytes;
++import org.bouncycastle.util.Memoable;
++import org.bouncycastle.util.Pack;
++
++@SuppressWarnings("all")
++abstract class SLHDSAEngine
++{
++    final int N;
++
++    final int WOTS_W;
++    final int WOTS_LOGW;
++    final int WOTS_LEN;
++    final int WOTS_LEN1;
++    final int WOTS_LEN2;
++
++    final int D;
++    final int A; // FORS_HEIGHT
++    final int K; // FORS_TREES
++    final int H; // FULL_HEIGHT
++    final int H_PRIME;  // H / D
++
++    final int T; // T = 1 << A
++
++    public SLHDSAEngine(int n, int w, int d, int a, int k, int h)
++    {
++        this.N = n;
++
++        /* SPX_WOTS_LEN2 is floor(log(len_1 * (w - 1)) / log(w)) + 1; we precompute */
++        if (w == 16)
++        {
++            WOTS_LOGW = 4;
++            WOTS_LEN1 = (8 * N / WOTS_LOGW);
++            if (N <= 8)
++            {
++                WOTS_LEN2 = 2;
++            }
++            else if (N <= 136)
++            {
++                WOTS_LEN2 = 3;
++            }
++            else if (N <= 256)
++            {
++                WOTS_LEN2 = 4;
++            }
++            else
++            {
++                throw new IllegalArgumentException("cannot precompute SPX_WOTS_LEN2 for n outside {2, .., 256}");
++            }
++        }
++        else if (w == 256)
++        {
++            WOTS_LOGW = 8;
++            WOTS_LEN1 = (8 * N / WOTS_LOGW);
++            if (N <= 1)
++            {
++                WOTS_LEN2 = 1;
++            }
++            else if (N <= 256)
++            {
++                WOTS_LEN2 = 2;
++            }
++            else
++            {
++                throw new IllegalArgumentException("cannot precompute SPX_WOTS_LEN2 for n outside {2, .., 256}");
++            }
++        }
++        else
++        {
++            throw new IllegalArgumentException("wots_w assumed 16 or 256");
++        }
++        this.WOTS_W = w;
++        this.WOTS_LEN = WOTS_LEN1 + WOTS_LEN2;
++
++        this.D = d;
++        this.A = a;
++        this.K = k;
++        this.H = h;
++        this.H_PRIME = h / d;
++        this.T = 1 << a;
++    }
++
++    abstract void init(byte[] pkSeed);
++
++    abstract byte[] F(byte[] pkSeed, ADRS adrs, byte[] m1);
++
++    abstract byte[] H(byte[] pkSeed, ADRS adrs, byte[] m1, byte[] m2);
++
++    abstract IndexedDigest H_msg(byte[] prf, byte[] pkSeed, byte[] pkRoot, byte[] msgPrefix, byte[] msg);
++
++    abstract byte[] T_l(byte[] pkSeed, ADRS adrs, byte[] m);
++
++    abstract byte[] PRF(byte[] pkSeed, byte[] skSeed, ADRS adrs);
++
++    abstract byte[] PRF_msg(byte[] prf, byte[] randomiser, byte[] msgPrefix, byte[] msg);
++
++    static class Sha2Engine
++        extends SLHDSAEngine
++    {
++        private final HMac treeHMac;
++        private final MGF1BytesGenerator mgf1;
++        private final byte[] hmacBuf;
++        private final Digest msgDigest;
++        private final byte[] msgDigestBuf;
++        private final int bl;
++        private final Digest sha256 = new JdkDigest("SHA-256", 64);
++        private final byte[] sha256Buf = new byte[sha256.getDigestSize()];
++
++        private Memoable msgMemo;
++        private Memoable sha256Memo;
++
++        public Sha2Engine(int n, int w, int d, int a, int k, int h)
++        {
++            super(n, w, d, a, k, h);
++            if (n == 16)
++            {
++                this.msgDigest = new JdkDigest("SHA-256", 64);
++                this.treeHMac = new HMac(new JdkDigest("SHA-256", 64));
++                this.mgf1 = new MGF1BytesGenerator(new JdkDigest("SHA-256", 64));
++                this.bl = 64;
++            }
++            else
++            {
++                this.msgDigest = new JdkDigest("SHA-512", 128);
++                this.treeHMac = new HMac(new JdkDigest("SHA-512", 128));
++                this.mgf1 = new MGF1BytesGenerator(new JdkDigest("SHA-512", 128));
++                this.bl = 128;
++            }
++
++            this.hmacBuf = new byte[treeHMac.getMacSize()];
++            this.msgDigestBuf = new byte[msgDigest.getDigestSize()];
++        }
++
++        void init(byte[] pkSeed)
++        {
++            final byte[] padding = new byte[bl];
++
++            msgDigest.update(pkSeed, 0, pkSeed.length);
++            msgDigest.update(padding, 0, bl - N); // toByte(0, 64 - n)
++            msgMemo = ((Memoable)msgDigest).copy();
++            
++            msgDigest.reset();
++
++            sha256.update(pkSeed, 0, pkSeed.length);
++            sha256.update(padding, 0, 64 - pkSeed.length); // toByte(0, 64 - n)
++            sha256Memo = ((Memoable)sha256).copy();
++
++            sha256.reset();
++        }
++
++        public byte[] F(byte[] pkSeed, ADRS adrs, byte[] m1)
++        {
++            byte[] compressedADRS = compressedADRS(adrs);
++
++            ((Memoable)sha256).reset(sha256Memo);
++
++            sha256.update(compressedADRS, 0, compressedADRS.length);
++            sha256.update(m1, 0, m1.length);
++            sha256.doFinal(sha256Buf, 0);
++
++            return Arrays.copyOfRange(sha256Buf, 0, N);
++        }
++
++        public byte[] H(byte[] pkSeed, ADRS adrs, byte[] m1, byte[] m2)
++        {
++            byte[] compressedADRS = compressedADRS(adrs);
++
++            ((Memoable)msgDigest).reset(msgMemo);
++
++            msgDigest.update(compressedADRS, 0, compressedADRS.length);
++
++            msgDigest.update(m1, 0, m1.length);
++            msgDigest.update(m2, 0, m2.length);
++
++            msgDigest.doFinal(msgDigestBuf, 0);
++
++            return Arrays.copyOfRange(msgDigestBuf, 0, N);
++        }
++
++        IndexedDigest H_msg(byte[] prf, byte[] pkSeed, byte[] pkRoot, byte[] msgPrefix, byte[] msg)
++        {
++            int forsMsgBytes = ((A * K) + 7) / 8;
++            int leafBits = H / D;
++            int treeBits = H - leafBits;
++            int leafBytes = (leafBits + 7) / 8;
++            int treeBytes = (treeBits + 7) / 8;
++            int m = forsMsgBytes + leafBytes + treeBytes;
++            byte[] out = new byte[m];
++            byte[] dig = new byte[msgDigest.getDigestSize()];
++
++            msgDigest.update(prf, 0, prf.length);
++            msgDigest.update(pkSeed, 0, pkSeed.length);
++            msgDigest.update(pkRoot, 0, pkRoot.length);
++            if (msgPrefix != null)
++            {
++                msgDigest.update(msgPrefix, 0, msgPrefix.length);
++            }
++            msgDigest.update(msg, 0, msg.length);
++            msgDigest.doFinal(dig, 0);
++
++            out = bitmask(Arrays.concatenate(prf, pkSeed, dig), out);
++
++            // tree index
++            // currently, only indexes up to 64 bits are supported
++            byte[] treeIndexBuf = new byte[8];
++            System.arraycopy(out, forsMsgBytes, treeIndexBuf, 8 - treeBytes, treeBytes);
++            long treeIndex = Pack.bigEndianToLong(treeIndexBuf, 0);
++            treeIndex &= (~0L) >>> (64 - treeBits);
++
++            byte[] leafIndexBuf = new byte[4];
++            System.arraycopy(out, forsMsgBytes + treeBytes, leafIndexBuf, 4 - leafBytes, leafBytes);
++
++            int leafIndex = Pack.bigEndianToInt(leafIndexBuf, 0);
++            leafIndex &= (~0) >>> (32 - leafBits);
++
++            return new IndexedDigest(treeIndex, leafIndex, Arrays.copyOfRange(out, 0, forsMsgBytes));
++        }
++
++        public byte[] T_l(byte[] pkSeed, ADRS adrs, byte[] m)
++        {
++            byte[] compressedADRS = compressedADRS(adrs);
++
++            ((Memoable)msgDigest).reset(msgMemo);
++
++            msgDigest.update(compressedADRS, 0, compressedADRS.length);
++            msgDigest.update(m, 0, m.length);
++            msgDigest.doFinal(msgDigestBuf, 0);
++
++            return Arrays.copyOfRange(msgDigestBuf, 0, N);
++        }
++
++        byte[] PRF(byte[] pkSeed, byte[] skSeed, ADRS adrs)
++        {
++            int n = skSeed.length;
++
++            ((Memoable)sha256).reset(sha256Memo);
++
++            byte[] compressedADRS = compressedADRS(adrs);
++
++            sha256.update(compressedADRS, 0, compressedADRS.length);
++            sha256.update(skSeed, 0, skSeed.length);
++            sha256.doFinal(sha256Buf, 0);
++
++            return Arrays.copyOfRange(sha256Buf, 0, n);
++        }
++
++        public byte[] PRF_msg(byte[] prf, byte[] randomiser, byte[] msgPrefix, byte[] msg)
++        {
++            treeHMac.init(new KeyParameter(prf));
++            treeHMac.update(randomiser, 0, randomiser.length);
++            if (msgPrefix != null)
++            {
++                treeHMac.update(msgPrefix, 0, msgPrefix.length);
++            }
++            treeHMac.update(msg, 0, msg.length);
++            treeHMac.doFinal(hmacBuf, 0);
++
++            return Arrays.copyOfRange(hmacBuf, 0, N);
++        }
++
++        private byte[] compressedADRS(ADRS adrs)
++        {
++            byte[] rv = new byte[22];
++            System.arraycopy(adrs.value, ADRS.OFFSET_LAYER + 3, rv, 0, 1); // LSB layer address
++            System.arraycopy(adrs.value, ADRS.OFFSET_TREE + 4, rv, 1, 8); // LS 8 bytes Tree address
++            System.arraycopy(adrs.value, ADRS.OFFSET_TYPE + 3, rv, 9, 1); // LSB type
++            System.arraycopy(adrs.value, 20, rv, 10, 12);
++
++            return rv;
++        }
++
++        protected byte[] bitmask(byte[] key, byte[] m)
++        {
++            byte[] mask = new byte[m.length];
++            mgf1.init(new MGFParameters(key));
++            mgf1.generateBytes(mask, 0, mask.length);
++            Bytes.xorTo(m.length, m, mask);
++            return mask;
++        }
++
++        protected byte[] bitmask(byte[] key, byte[] m1, byte[] m2)
++        {
++            byte[] mask = new byte[m1.length + m2.length];
++            mgf1.init(new MGFParameters(key));
++            mgf1.generateBytes(mask, 0, mask.length);
++            Bytes.xorTo(m1.length, m1, mask);
++            Bytes.xorTo(m2.length, m2, 0, mask, m1.length);
++            return mask;
++        }
++
++        protected byte[] bitmask256(byte[] key, byte[] m)
++        {
++            byte[] mask = new byte[m.length];
++            MGF1BytesGenerator mgf1 = new MGF1BytesGenerator(new JdkDigest("SHA-256", 64));
++            mgf1.init(new MGFParameters(key));
++            mgf1.generateBytes(mask, 0, mask.length);
++            Bytes.xorTo(m.length, m, mask);
++            return mask;
++        }
++    }
++
++    static class Shake256Engine
++        extends SLHDSAEngine
++    {
++        private final Xof treeDigest;
++        private final Xof maskDigest;
++
++        public Shake256Engine(int n, int w, int d, int a, int k, int h)
++        {
++            super(n, w, d, a, k, h);
++
++            this.treeDigest = new SHAKEDigest(256);
++            this.maskDigest = new SHAKEDigest(256);
++        }
++
++        void init(byte[] pkSeed)
++        {
++
++        }
++
++        byte[] F(byte[] pkSeed, ADRS adrs, byte[] m1)
++        {
++            byte[] mTheta = m1;
++
++            byte[] rv = new byte[N];
++
++            treeDigest.update(pkSeed, 0, pkSeed.length);
++            treeDigest.update(adrs.value, 0, adrs.value.length);
++            treeDigest.update(mTheta, 0, mTheta.length);
++            treeDigest.doFinal(rv, 0, rv.length);
++
++            return rv;
++        }
++
++        byte[] H(byte[] pkSeed, ADRS adrs, byte[] m1, byte[] m2)
++        {
++            byte[] rv = new byte[N];
++
++            treeDigest.update(pkSeed, 0, pkSeed.length);
++            treeDigest.update(adrs.value, 0, adrs.value.length);
++
++            treeDigest.update(m1, 0, m1.length);
++            treeDigest.update(m2, 0, m2.length);
++
++            treeDigest.doFinal(rv, 0, rv.length);
++
++            return rv;
++        }
++
++        IndexedDigest H_msg(byte[] R, byte[] pkSeed, byte[] pkRoot, byte[] msgPrefix, byte[] msg)
++        {
++            int forsMsgBytes = ((A * K) + 7) / 8;
++            int leafBits = H / D;
++            int treeBits = H - leafBits;
++            int leafBytes = (leafBits + 7) / 8;
++            int treeBytes = (treeBits + 7) / 8;
++            int m = forsMsgBytes + leafBytes + treeBytes;
++            byte[] out = new byte[m];
++
++            treeDigest.update(R, 0, R.length);
++            treeDigest.update(pkSeed, 0, pkSeed.length);
++            treeDigest.update(pkRoot, 0, pkRoot.length);
++            if (msgPrefix != null)
++            {
++                treeDigest.update(msgPrefix, 0, msgPrefix.length);
++            }
++            treeDigest.update(msg, 0, msg.length);
++            treeDigest.doFinal(out, 0, out.length);
++
++            // tree index
++            // currently, only indexes up to 64 bits are supported
++            byte[] treeIndexBuf = new byte[8];
++            System.arraycopy(out, forsMsgBytes, treeIndexBuf, 8 - treeBytes, treeBytes);
++            long treeIndex = Pack.bigEndianToLong(treeIndexBuf, 0);
++            treeIndex &= (~0L) >>> (64 - treeBits);
++
++            byte[] leafIndexBuf = new byte[4];
++            System.arraycopy(out, forsMsgBytes + treeBytes, leafIndexBuf, 4 - leafBytes, leafBytes);
++
++            int leafIndex = Pack.bigEndianToInt(leafIndexBuf, 0);
++            leafIndex &= (~0) >>> (32 - leafBits);
++
++            return new IndexedDigest(treeIndex, leafIndex, Arrays.copyOfRange(out, 0, forsMsgBytes));
++        }
++
++        byte[] T_l(byte[] pkSeed, ADRS adrs, byte[] m)
++        {
++            byte[] mTheta = m;
++
++            byte[] rv = new byte[N];
++
++            treeDigest.update(pkSeed, 0, pkSeed.length);
++            treeDigest.update(adrs.value, 0, adrs.value.length);
++            treeDigest.update(mTheta, 0, mTheta.length);
++            treeDigest.doFinal(rv, 0, rv.length);
++
++            return rv;
++        }
++
++        byte[] PRF(byte[] pkSeed, byte[] skSeed, ADRS adrs)
++        {
++            treeDigest.update(pkSeed, 0, pkSeed.length);
++            treeDigest.update(adrs.value, 0, adrs.value.length);
++            treeDigest.update(skSeed, 0, skSeed.length);
++
++            byte[] prf = new byte[N];
++            treeDigest.doFinal(prf, 0, N);
++            return prf;
++        }
++
++        public byte[] PRF_msg(byte[] prf, byte[] randomiser, byte[] msgPrefix, byte[] msg)
++        {
++            treeDigest.update(prf, 0, prf.length);
++            treeDigest.update(randomiser, 0, randomiser.length);
++            if (msgPrefix != null)
++            {
++                treeDigest.update(msgPrefix, 0, msgPrefix.length);
++            }
++            treeDigest.update(msg, 0, msg.length);
++
++            byte[] out = new byte[N];
++            treeDigest.doFinal(out, 0, out.length);
++            return out;
++        }
++
++        protected byte[] bitmask(byte[] pkSeed, ADRS adrs, byte[] m)
++        {
++            byte[] mask = new byte[m.length];
++            maskDigest.update(pkSeed, 0, pkSeed.length);
++            maskDigest.update(adrs.value, 0, adrs.value.length);
++            maskDigest.doFinal(mask, 0, mask.length);
++            Bytes.xorTo(m.length, m, mask);
++            return mask;
++        }
++
++        protected byte[] bitmask(byte[] pkSeed, ADRS adrs, byte[] m1, byte[] m2)
++        {
++            byte[] mask = new byte[m1.length + m2.length];
++            maskDigest.update(pkSeed, 0, pkSeed.length);
++            maskDigest.update(adrs.value, 0, adrs.value.length);
++            maskDigest.doFinal(mask, 0, mask.length);
++            Bytes.xorTo(m1.length, m1, mask);
++            Bytes.xorTo(m2.length, m2, 0, mask, m1.length);
++            return mask;
++        }
++    }
++}
+diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSAEngineProvider.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSAEngineProvider.java
+new file mode 100755
+index 000000000..791705d9a
+--- /dev/null
++++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSAEngineProvider.java
+@@ -0,0 +1,19 @@
++/*
++ * Derived from Bouncy Castle 1.80, package org.bouncycastle.pqc.crypto.slhdsa (MIT licence,
++ * Copyright (c) 2000-2025 The Legion of the Bouncy Castle Inc., see LICENTA-BOUNCYCASTLE.txt),
++ * regenerated into Aere Network by consensus-pqc/slhdsa-fork/genereaza-motorul.py on 2026-09-04 (D-337).
++ * The ONLY change of substance: the SHA-2 engine hashes through the JDK's MessageDigest (SHA-NI
++ * intrinsics) instead of Bouncy Castle's pure-Java digests, which made one SLH-DSA-SHA2-128s signature
++ * cost seconds on the QBFT thread at every anchor parent. Algorithm, key formats and signature bytes are
++ * FIPS 205 as before; SlhDsaFastEngineTest pins that against the original, in both directions.
++ * DO NOT EDIT BY HAND: regenerate with the script above.
++ */
++package org.hyperledger.besu.consensus.common.bft.slhdsa;
++
++@SuppressWarnings("all")
++interface SLHDSAEngineProvider
++{
++    int getN();
++
++    SLHDSAEngine get();
++}
+diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSAKeyGenerationParameters.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSAKeyGenerationParameters.java
+new file mode 100755
+index 000000000..b3daec977
+--- /dev/null
++++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSAKeyGenerationParameters.java
+@@ -0,0 +1,33 @@
++/*
++ * Derived from Bouncy Castle 1.80, package org.bouncycastle.pqc.crypto.slhdsa (MIT licence,
++ * Copyright (c) 2000-2025 The Legion of the Bouncy Castle Inc., see LICENTA-BOUNCYCASTLE.txt),
++ * regenerated into Aere Network by consensus-pqc/slhdsa-fork/genereaza-motorul.py on 2026-09-04 (D-337).
++ * The ONLY change of substance: the SHA-2 engine hashes through the JDK's MessageDigest (SHA-NI
++ * intrinsics) instead of Bouncy Castle's pure-Java digests, which made one SLH-DSA-SHA2-128s signature
++ * cost seconds on the QBFT thread at every anchor parent. Algorithm, key formats and signature bytes are
++ * FIPS 205 as before; SlhDsaFastEngineTest pins that against the original, in both directions.
++ * DO NOT EDIT BY HAND: regenerate with the script above.
++ */
++package org.hyperledger.besu.consensus.common.bft.slhdsa;
++
++import java.security.SecureRandom;
++
++import org.bouncycastle.crypto.KeyGenerationParameters;
++
++@SuppressWarnings("all")
++public class SLHDSAKeyGenerationParameters
++    extends KeyGenerationParameters
++{
++    private final SLHDSAParameters parameters;
++
++    public SLHDSAKeyGenerationParameters(SecureRandom random, SLHDSAParameters parameters)
++    {
++        super(random, -1);
++        this.parameters = parameters;
++    }
++
++    SLHDSAParameters getParameters()
++    {
++        return parameters;
++    }
++}
+diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSAKeyPairGenerator.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSAKeyPairGenerator.java
+new file mode 100755
+index 000000000..58a32e8ea
+--- /dev/null
++++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSAKeyPairGenerator.java
+@@ -0,0 +1,70 @@
++/*
++ * Derived from Bouncy Castle 1.80, package org.bouncycastle.pqc.crypto.slhdsa (MIT licence,
++ * Copyright (c) 2000-2025 The Legion of the Bouncy Castle Inc., see LICENTA-BOUNCYCASTLE.txt),
++ * regenerated into Aere Network by consensus-pqc/slhdsa-fork/genereaza-motorul.py on 2026-09-04 (D-337).
++ * The ONLY change of substance: the SHA-2 engine hashes through the JDK's MessageDigest (SHA-NI
++ * intrinsics) instead of Bouncy Castle's pure-Java digests, which made one SLH-DSA-SHA2-128s signature
++ * cost seconds on the QBFT thread at every anchor parent. Algorithm, key formats and signature bytes are
++ * FIPS 205 as before; SlhDsaFastEngineTest pins that against the original, in both directions.
++ * DO NOT EDIT BY HAND: regenerate with the script above.
++ */
++package org.hyperledger.besu.consensus.common.bft.slhdsa;
++
++import java.security.SecureRandom;
++
++import org.bouncycastle.crypto.AsymmetricCipherKeyPair;
++import org.bouncycastle.crypto.AsymmetricCipherKeyPairGenerator;
++import org.bouncycastle.crypto.KeyGenerationParameters;
++
++@SuppressWarnings("all")
++public class SLHDSAKeyPairGenerator
++    implements AsymmetricCipherKeyPairGenerator
++{
++    private SecureRandom random;
++    private SLHDSAParameters parameters;
++
++    public void init(KeyGenerationParameters param)
++    {
++        random = param.getRandom();
++        parameters = ((SLHDSAKeyGenerationParameters)param).getParameters();
++    }
++
++    public AsymmetricCipherKeyPair internalGenerateKeyPair(byte[] skSeed, byte[] skPrf, byte[] pkSeed)
++    {
++        return implGenerateKeyPair(parameters.getEngine(), skSeed, skPrf, pkSeed);
++    }
++
++    public AsymmetricCipherKeyPair generateKeyPair()
++    {
++        SLHDSAEngine engine = parameters.getEngine();
++
++        byte[] skSeed = sec_rand(engine.N);
++        byte[] skPrf = sec_rand(engine.N);
++        byte[] pkSeed = sec_rand(engine.N);
++
++        return implGenerateKeyPair(engine, skSeed, skPrf, pkSeed);
++    }
++
++    private AsymmetricCipherKeyPair implGenerateKeyPair(SLHDSAEngine engine, byte[] skSeed, byte[] skPrf, byte[] pkSeed)
++    {
++        SK sk = new SK(skSeed, skPrf);
++
++        engine.init(pkSeed);
++
++        // TODO
++        PK pk = new PK(pkSeed, new HT(engine, sk.seed, pkSeed).htPubKey);
++
++        return new AsymmetricCipherKeyPair(
++            new SLHDSAPublicKeyParameters(parameters, pk),
++            new SLHDSAPrivateKeyParameters(parameters, sk, pk));
++    }
++
++    private byte[] sec_rand(int n)
++    {
++        byte[] rv = new byte[n];
++
++        random.nextBytes(rv);
++
++        return rv;
++    }
++}
+diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSAKeyParameters.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSAKeyParameters.java
+new file mode 100755
+index 000000000..2999c4cac
+--- /dev/null
++++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSAKeyParameters.java
+@@ -0,0 +1,31 @@
++/*
++ * Derived from Bouncy Castle 1.80, package org.bouncycastle.pqc.crypto.slhdsa (MIT licence,
++ * Copyright (c) 2000-2025 The Legion of the Bouncy Castle Inc., see LICENTA-BOUNCYCASTLE.txt),
++ * regenerated into Aere Network by consensus-pqc/slhdsa-fork/genereaza-motorul.py on 2026-09-04 (D-337).
++ * The ONLY change of substance: the SHA-2 engine hashes through the JDK's MessageDigest (SHA-NI
++ * intrinsics) instead of Bouncy Castle's pure-Java digests, which made one SLH-DSA-SHA2-128s signature
++ * cost seconds on the QBFT thread at every anchor parent. Algorithm, key formats and signature bytes are
++ * FIPS 205 as before; SlhDsaFastEngineTest pins that against the original, in both directions.
++ * DO NOT EDIT BY HAND: regenerate with the script above.
++ */
++package org.hyperledger.besu.consensus.common.bft.slhdsa;
++
++import org.bouncycastle.crypto.params.AsymmetricKeyParameter;
++
++@SuppressWarnings("all")
++public class SLHDSAKeyParameters
++    extends AsymmetricKeyParameter
++{
++    private final SLHDSAParameters parameters;
++
++    protected SLHDSAKeyParameters(boolean isPrivate, SLHDSAParameters parameters)
++    {
++        super(isPrivate);
++        this.parameters = parameters;
++    }
++
++    public SLHDSAParameters getParameters()
++    {
++        return parameters;
++    }
++}
+diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSAParameters.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSAParameters.java
+new file mode 100755
+index 000000000..4a5e422c8
+--- /dev/null
++++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSAParameters.java
+@@ -0,0 +1,186 @@
++/*
++ * Derived from Bouncy Castle 1.80, package org.bouncycastle.pqc.crypto.slhdsa (MIT licence,
++ * Copyright (c) 2000-2025 The Legion of the Bouncy Castle Inc., see LICENTA-BOUNCYCASTLE.txt),
++ * regenerated into Aere Network by consensus-pqc/slhdsa-fork/genereaza-motorul.py on 2026-09-04 (D-337).
++ * The ONLY change of substance: the SHA-2 engine hashes through the JDK's MessageDigest (SHA-NI
++ * intrinsics) instead of Bouncy Castle's pure-Java digests, which made one SLH-DSA-SHA2-128s signature
++ * cost seconds on the QBFT thread at every anchor parent. Algorithm, key formats and signature bytes are
++ * FIPS 205 as before; SlhDsaFastEngineTest pins that against the original, in both directions.
++ * DO NOT EDIT BY HAND: regenerate with the script above.
++ */
++package org.hyperledger.besu.consensus.common.bft.slhdsa;
++
++@SuppressWarnings("all")
++public class SLHDSAParameters
++{
++    public static final int TYPE_PURE = 0;
++    public static final int TYPE_SHA2_256 = 1;
++    public static final int TYPE_SHA2_512 = 2;
++    public static final int TYPE_SHAKE128 = 3;
++    public static final int TYPE_SHAKE256 = 4;
++
++    // "Pure" SLH-DSA Parameters
++    // SHA-2
++    public static final SLHDSAParameters sha2_128f = new SLHDSAParameters(
++        "sha2-128f", new Sha2EngineProvider(16, 16, 22, 6, 33, 66), TYPE_PURE);
++    public static final SLHDSAParameters sha2_128s = new SLHDSAParameters(
++        "sha2-128s", new Sha2EngineProvider(16, 16, 7, 12, 14, 63), TYPE_PURE);
++
++    public static final SLHDSAParameters sha2_192f = new SLHDSAParameters(
++        "sha2-192f", new Sha2EngineProvider(24, 16, 22, 8, 33, 66), TYPE_PURE);
++    public static final SLHDSAParameters sha2_192s = new SLHDSAParameters(
++        "sha2-192s", new Sha2EngineProvider(24, 16, 7, 14, 17, 63), TYPE_PURE);
++
++    public static final SLHDSAParameters sha2_256f = new SLHDSAParameters(
++        "sha2-256f", new Sha2EngineProvider(32, 16, 17, 9, 35, 68), TYPE_PURE);
++    public static final SLHDSAParameters sha2_256s = new SLHDSAParameters(
++        "sha2-256s", new Sha2EngineProvider(32, 16, 8, 14, 22, 64), TYPE_PURE);
++
++    // SHAKE-256.
++    public static final SLHDSAParameters shake_128f = new SLHDSAParameters(
++        "shake-128f", new Shake256EngineProvider(16, 16, 22, 6, 33, 66), TYPE_PURE);
++    public static final SLHDSAParameters shake_128s = new SLHDSAParameters(
++        "shake-128s", new Shake256EngineProvider(16, 16, 7, 12, 14, 63), TYPE_PURE);
++
++    public static final SLHDSAParameters shake_192f = new SLHDSAParameters(
++        "shake-192f", new Shake256EngineProvider(24, 16, 22, 8, 33, 66), TYPE_PURE);
++    public static final SLHDSAParameters shake_192s = new SLHDSAParameters(
++        "shake-192s", new Shake256EngineProvider(24, 16, 7, 14, 17, 63), TYPE_PURE);
++
++    public static final SLHDSAParameters shake_256f = new SLHDSAParameters(
++        "shake-256f", new Shake256EngineProvider(32, 16, 17, 9, 35, 68), TYPE_PURE);
++    public static final SLHDSAParameters shake_256s = new SLHDSAParameters(
++        "shake-256s", new Shake256EngineProvider(32, 16, 8, 14, 22, 64), TYPE_PURE);
++
++
++    // "Pre-hash" SLH-DSA Parameters
++    // SHA-2
++    public static final SLHDSAParameters sha2_128f_with_sha256 = new SLHDSAParameters(
++        "sha2-128f-with-sha256", new Sha2EngineProvider(16, 16, 22, 6, 33, 66), TYPE_SHA2_256);
++    public static final SLHDSAParameters sha2_128s_with_sha256 = new SLHDSAParameters(
++        "sha2-128s-with-sha256", new Sha2EngineProvider(16, 16, 7, 12, 14, 63), TYPE_SHA2_256);
++
++    public static final SLHDSAParameters sha2_192f_with_sha512 = new SLHDSAParameters(
++        "sha2-192f-with-sha512", new Sha2EngineProvider(24, 16, 22, 8, 33, 66), TYPE_SHA2_512);
++    public static final SLHDSAParameters sha2_192s_with_sha512 = new SLHDSAParameters(
++        "sha2-192s-with-sha512", new Sha2EngineProvider(24, 16, 7, 14, 17, 63), TYPE_SHA2_512);
++
++    public static final SLHDSAParameters sha2_256f_with_sha512 = new SLHDSAParameters(
++        "sha2-256f-with-sha512", new Sha2EngineProvider(32, 16, 17, 9, 35, 68), TYPE_SHA2_512);
++    public static final SLHDSAParameters sha2_256s_with_sha512 = new SLHDSAParameters(
++        "sha2-256s-with-sha512", new Sha2EngineProvider(32, 16, 8, 14, 22, 64), TYPE_SHA2_512);
++
++    // SHAKE-256.
++    public static final SLHDSAParameters shake_128f_with_shake128 = new SLHDSAParameters(
++        "shake-128f-with-shake128", new Shake256EngineProvider(16, 16, 22, 6, 33, 66), TYPE_SHAKE128);
++    public static final SLHDSAParameters shake_128s_with_shake128 = new SLHDSAParameters(
++        "shake-128s-with-shake128", new Shake256EngineProvider(16, 16, 7, 12, 14, 63), TYPE_SHAKE128);
++
++    public static final SLHDSAParameters shake_192f_with_shake256 = new SLHDSAParameters(
++        "shake-192f-with-shake256", new Shake256EngineProvider(24, 16, 22, 8, 33, 66), TYPE_SHAKE256);
++    public static final SLHDSAParameters shake_192s_with_shake256 = new SLHDSAParameters(
++        "shake-192s-with-shake256", new Shake256EngineProvider(24, 16, 7, 14, 17, 63), TYPE_SHAKE256);
++
++    public static final SLHDSAParameters shake_256f_with_shake256 = new SLHDSAParameters(
++        "shake-256f-with-shake256", new Shake256EngineProvider(32, 16, 17, 9, 35, 68), TYPE_SHAKE256);
++    public static final SLHDSAParameters shake_256s_with_shake256 = new SLHDSAParameters(
++        "shake-256s-with-shake256", new Shake256EngineProvider(32, 16, 8, 14, 22, 64), TYPE_SHAKE256);
++
++    private final String name;
++    private final SLHDSAEngineProvider engineProvider;
++    private final int preHashDigest;
++
++    private SLHDSAParameters(String name, SLHDSAEngineProvider engineProvider, int preHashDigest)
++    {
++        this.name = name;
++        this.engineProvider = engineProvider;
++        this.preHashDigest = preHashDigest;
++    }
++
++    public String getName()
++    {
++        return name;
++    }
++
++    public int getType()
++    {
++        return preHashDigest;
++    }
++
++    public int getN()
++    {
++        return engineProvider.getN();
++    }
++
++    SLHDSAEngine getEngine()
++    {
++        return engineProvider.get();
++    }
++
++    public boolean isPreHash()
++    {
++        return preHashDigest != TYPE_PURE;
++    }
++
++    private static class Sha2EngineProvider
++        implements SLHDSAEngineProvider
++    {
++        private final int n;
++        private final int w;
++        private final int d;
++        private final int a;
++        private final int k;
++        private final int h;
++
++        public Sha2EngineProvider(int n, int w, int d, int a, int k, int h)
++        {
++            this.n = n;
++            this.w = w;
++            this.d = d;
++            this.a = a;
++            this.k = k;
++            this.h = h;
++        }
++
++        public int getN()
++        {
++            return n;
++        }
++
++        public SLHDSAEngine get()
++        {
++            return new SLHDSAEngine.Sha2Engine(n, w, d, a, k, h);
++        }
++    }
++
++    private static class Shake256EngineProvider
++        implements SLHDSAEngineProvider
++    {
++        private final int n;
++        private final int w;
++        private final int d;
++        private final int a;
++        private final int k;
++        private final int h;
++
++        public Shake256EngineProvider(int n, int w, int d, int a, int k, int h)
++        {
++            this.n = n;
++            this.w = w;
++            this.d = d;
++            this.a = a;
++            this.k = k;
++            this.h = h;
++        }
++
++        public int getN()
++        {
++            return n;
++        }
++
++        public SLHDSAEngine get()
++        {
++            return new SLHDSAEngine.Shake256Engine(n, w, d, a, k, h);
++        }
++    }
++}
+diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSAPrivateKeyParameters.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSAPrivateKeyParameters.java
+new file mode 100755
+index 000000000..da9c060bb
+--- /dev/null
++++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSAPrivateKeyParameters.java
+@@ -0,0 +1,80 @@
++/*
++ * Derived from Bouncy Castle 1.80, package org.bouncycastle.pqc.crypto.slhdsa (MIT licence,
++ * Copyright (c) 2000-2025 The Legion of the Bouncy Castle Inc., see LICENTA-BOUNCYCASTLE.txt),
++ * regenerated into Aere Network by consensus-pqc/slhdsa-fork/genereaza-motorul.py on 2026-09-04 (D-337).
++ * The ONLY change of substance: the SHA-2 engine hashes through the JDK's MessageDigest (SHA-NI
++ * intrinsics) instead of Bouncy Castle's pure-Java digests, which made one SLH-DSA-SHA2-128s signature
++ * cost seconds on the QBFT thread at every anchor parent. Algorithm, key formats and signature bytes are
++ * FIPS 205 as before; SlhDsaFastEngineTest pins that against the original, in both directions.
++ * DO NOT EDIT BY HAND: regenerate with the script above.
++ */
++package org.hyperledger.besu.consensus.common.bft.slhdsa;
++
++import org.bouncycastle.util.Arrays;
++
++@SuppressWarnings("all")
++public class SLHDSAPrivateKeyParameters
++    extends SLHDSAKeyParameters
++{
++    final SK sk;
++    final PK pk;
++
++    public SLHDSAPrivateKeyParameters(SLHDSAParameters parameters, byte[] skpkEncoded)
++    {
++        super(true, parameters);
++        int n = parameters.getN();
++        if (skpkEncoded.length != 4 * n)
++        {
++            throw new IllegalArgumentException("private key encoding does not match parameters");
++        }
++        this.sk = new SK(Arrays.copyOfRange(skpkEncoded, 0, n), Arrays.copyOfRange(skpkEncoded, n, 2 * n));
++        this.pk = new PK(Arrays.copyOfRange(skpkEncoded, 2 * n, 3 * n), Arrays.copyOfRange(skpkEncoded, 3 * n, 4 * n));
++    }
++
++    public SLHDSAPrivateKeyParameters(SLHDSAParameters parameters, byte[] skSeed, byte[] prf, byte[] pkSeed, byte[] pkRoot)
++    {
++        super(true, parameters);
++        this.sk = new SK(skSeed, prf);
++        this.pk = new PK(pkSeed, pkRoot);
++    }
++    SLHDSAPrivateKeyParameters(SLHDSAParameters parameters, SK sk, PK pk)
++    {
++        super(true, parameters);
++        this.sk = sk;
++        this.pk = pk;
++    }
++
++    public byte[] getSeed()
++    {
++        return Arrays.clone(sk.seed);
++    }
++
++    public byte[] getPrf()
++    {
++        return Arrays.clone(sk.prf);
++    }
++
++    public byte[] getPublicSeed()
++    {
++        return Arrays.clone(pk.seed);
++    }
++    public byte[] getRoot()
++    {
++        return Arrays.clone(pk.root);
++    }
++
++    public byte[] getPublicKey()
++    {
++        return Arrays.concatenate(pk.seed, pk.root);
++    }
++
++    public byte[] getEncoded()
++    {
++        return Arrays.concatenate(new byte[][]{ sk.seed, sk.prf, pk.seed, pk.root });
++    }
++
++    public byte[] getEncodedPublicKey()
++    {
++        return Arrays.concatenate(pk.seed, pk.root);
++    }
++}
+diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSAPublicKeyParameters.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSAPublicKeyParameters.java
+new file mode 100755
+index 000000000..544156c66
+--- /dev/null
++++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSAPublicKeyParameters.java
+@@ -0,0 +1,52 @@
++/*
++ * Derived from Bouncy Castle 1.80, package org.bouncycastle.pqc.crypto.slhdsa (MIT licence,
++ * Copyright (c) 2000-2025 The Legion of the Bouncy Castle Inc., see LICENTA-BOUNCYCASTLE.txt),
++ * regenerated into Aere Network by consensus-pqc/slhdsa-fork/genereaza-motorul.py on 2026-09-04 (D-337).
++ * The ONLY change of substance: the SHA-2 engine hashes through the JDK's MessageDigest (SHA-NI
++ * intrinsics) instead of Bouncy Castle's pure-Java digests, which made one SLH-DSA-SHA2-128s signature
++ * cost seconds on the QBFT thread at every anchor parent. Algorithm, key formats and signature bytes are
++ * FIPS 205 as before; SlhDsaFastEngineTest pins that against the original, in both directions.
++ * DO NOT EDIT BY HAND: regenerate with the script above.
++ */
++package org.hyperledger.besu.consensus.common.bft.slhdsa;
++
++import org.bouncycastle.util.Arrays;
++
++@SuppressWarnings("all")
++public class SLHDSAPublicKeyParameters
++    extends SLHDSAKeyParameters
++{
++    private final PK pk;
++
++    public SLHDSAPublicKeyParameters(SLHDSAParameters parameters, byte[] pkValues)
++    {
++        super(false, parameters);
++        int n = parameters.getN();
++        if (pkValues.length != 2 * n)
++        {
++            throw new IllegalArgumentException("public key encoding does not match parameters");
++        }
++        this.pk = new PK(Arrays.copyOfRange(pkValues, 0, n), Arrays.copyOfRange(pkValues, n, 2 * n));
++    }
++    
++    SLHDSAPublicKeyParameters(SLHDSAParameters parameters, PK pk)
++    {
++        super(false, parameters);
++        this.pk = pk;
++    }
++
++    public byte[] getSeed()
++    {
++        return Arrays.clone(pk.seed);
++    }
++
++    public byte[] getRoot()
++    {
++        return Arrays.clone(pk.root);
++    }
++
++    public byte[] getEncoded()
++    {
++        return Arrays.concatenate(pk.seed, pk.root);
++    }
++}
+diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSASigner.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSASigner.java
+new file mode 100755
+index 000000000..91fdef108
+--- /dev/null
++++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSASigner.java
+@@ -0,0 +1,236 @@
++/*
++ * Derived from Bouncy Castle 1.80, package org.bouncycastle.pqc.crypto.slhdsa (MIT licence,
++ * Copyright (c) 2000-2025 The Legion of the Bouncy Castle Inc., see LICENTA-BOUNCYCASTLE.txt),
++ * regenerated into Aere Network by consensus-pqc/slhdsa-fork/genereaza-motorul.py on 2026-09-04 (D-337).
++ * The ONLY change of substance: the SHA-2 engine hashes through the JDK's MessageDigest (SHA-NI
++ * intrinsics) instead of Bouncy Castle's pure-Java digests, which made one SLH-DSA-SHA2-128s signature
++ * cost seconds on the QBFT thread at every anchor parent. Algorithm, key formats and signature bytes are
++ * FIPS 205 as before; SlhDsaFastEngineTest pins that against the original, in both directions.
++ * DO NOT EDIT BY HAND: regenerate with the script above.
++ */
++package org.hyperledger.besu.consensus.common.bft.slhdsa;
++
++import java.security.SecureRandom;
++
++import org.bouncycastle.crypto.CipherParameters;
++import org.bouncycastle.crypto.params.ParametersWithContext;
++import org.bouncycastle.crypto.params.ParametersWithRandom;
++import org.bouncycastle.pqc.crypto.MessageSigner;
++import org.bouncycastle.util.Arrays;
++
++/**
++ * SLH-DA signer.
++ * 
      
++ * This version is based on the 3rd submission with deference to the updated reference
++ * implementation on github as at November 9th 2021. This version includes the changes
++ * for the countermeasure for the long-message second preimage attack - see
++ * "https://github.com/sphincs/sphincsplus/commit/61cd2695c6f984b4f4d6ed675378ed9a486cbede"
++ * for further details.
++ * 
      
++ */
++@SuppressWarnings("all")
++public class SLHDSASigner
++    implements MessageSigner
++{
++    private static final byte[] DEFAULT_PREFIX = new byte[]{ 0, 0 };
++
++    private byte[] msgPrefix;
++    private SLHDSAPublicKeyParameters pubKey;
++    private SLHDSAPrivateKeyParameters privKey;
++    private SecureRandom random;
++
++    /**
++     * Base constructor.
++     */
++    public SLHDSASigner()
++    {
++    }
++
++    public void init(boolean forSigning, CipherParameters param)
++    {
++        if (param instanceof ParametersWithContext)
++        {
++            ParametersWithContext withContext = (ParametersWithContext)param;
++            param = withContext.getParameters();
++
++            int ctxLength = withContext.getContextLength();
++            if (ctxLength > 255)
++            {
++                throw new IllegalArgumentException("context too long");
++            }
++
++            msgPrefix = new byte[2 + ctxLength];
++            msgPrefix[0] = 0;
++            msgPrefix[1] = (byte)ctxLength;
++            withContext.copyContextTo(msgPrefix, 2, ctxLength);
++        }
++        else
++        {
++            msgPrefix = DEFAULT_PREFIX;
++        }
++
++        SLHDSAParameters parameters;
++        if (forSigning)
++        {
++            pubKey = null;
++
++            if (param instanceof ParametersWithRandom)
++            {
++                ParametersWithRandom withRandom = (ParametersWithRandom)param;
++                privKey = (SLHDSAPrivateKeyParameters)withRandom.getParameters();
++                random = withRandom.getRandom();
++            }
++            else
++            {
++                privKey = (SLHDSAPrivateKeyParameters)param;
++                random = null;
++            }
++
++            parameters = privKey.getParameters();
++        }
++        else
++        {
++            pubKey = (SLHDSAPublicKeyParameters)param;
++            privKey = null;
++            random = null;
++
++            parameters = pubKey.getParameters();
++        }
++
++        if (parameters.isPreHash())
++        {
++            throw new IllegalArgumentException("\"pure\" slh-dsa must use non pre-hash parameters");
++        }
++    }
++
++    public byte[] generateSignature(byte[] message)
++    {
++        // TODO Redundant with the engine created in internalGenerateSignature
++        SLHDSAEngine engine = privKey.getParameters().getEngine();
++
++        engine.init(privKey.pk.seed);
++
++        // generate randomizer
++        byte[] optRand = new byte[engine.N];
++        if (random != null)
++        {
++            random.nextBytes(optRand);
++        }
++        else
++        {
++            System.arraycopy(privKey.pk.seed, 0, optRand, 0, optRand.length);
++        }
++
++        return internalGenerateSignature(privKey, msgPrefix, message, optRand);
++    }
++
++    // Equivalent to slh_verify_internal from specs
++    public boolean verifySignature(byte[] message, byte[] signature)
++    {
++        return internalVerifySignature(pubKey, msgPrefix, message, signature);
++    }
++
++    protected boolean internalVerifySignature(byte[] message, byte[] signature)
++    {
++        return internalVerifySignature(pubKey, null, message, signature);
++    }
++
++    private static boolean internalVerifySignature(SLHDSAPublicKeyParameters pubKey, byte[] msgPrefix, byte[] msg,
++        byte[] signature)
++    {
++        // TODO Check init via pubKey != null
++        
++        //# Input: Message M, signature SIG, public key PK
++        //# Output: Boolean
++
++        // init
++        SLHDSAEngine engine = pubKey.getParameters().getEngine();
++
++        engine.init(pubKey.getSeed());
++
++        ADRS adrs = new ADRS();
++
++        if (((1 + engine.K * (1 + engine.A) + engine.H + engine.D * engine.WOTS_LEN) * engine.N) != signature.length)
++        {
++            return false;
++        }
++
++        SIG sig = new SIG(engine.N, engine.K, engine.A, engine.D, engine.H_PRIME, engine.WOTS_LEN, signature);
++
++        byte[] R = sig.getR();
++        SIG_FORS[] sig_fors = sig.getSIG_FORS();
++        SIG_XMSS[] SIG_HT = sig.getSIG_HT();
++
++        // compute message digest and index
++        IndexedDigest idxDigest = engine.H_msg(R, pubKey.getSeed(), pubKey.getRoot(), msgPrefix, msg);
++        byte[] mHash = idxDigest.digest;
++        long idx_tree = idxDigest.idx_tree;
++        int idx_leaf = idxDigest.idx_leaf;
++
++        // compute FORS public key
++        adrs.setTypeAndClear(ADRS.FORS_TREE);
++        adrs.setLayerAddress(0);
++        adrs.setTreeAddress(idx_tree);
++        adrs.setKeyPairAddress(idx_leaf);
++        byte[] PK_FORS = new Fors(engine).pkFromSig(sig_fors, mHash, pubKey.getSeed(), adrs);
++        // verify HT signature
++        adrs.setTypeAndClear(ADRS.TREE);
++        adrs.setLayerAddress(0);
++        adrs.setTreeAddress(idx_tree);
++        adrs.setKeyPairAddress(idx_leaf);
++        HT ht = new HT(engine, null, pubKey.getSeed());
++        return ht.verify(PK_FORS, SIG_HT, pubKey.getSeed(), idx_tree, idx_leaf, pubKey.getRoot());
++    }
++
++    protected byte[] internalGenerateSignature(byte[] message, byte[] optRand)
++    {
++        return internalGenerateSignature(privKey, null, message, optRand);
++    }
++
++    private static byte[] internalGenerateSignature(SLHDSAPrivateKeyParameters privKey, byte[] msgPrefix, byte[] msg,
++        byte[] optRand)
++    {
++        // TODO Check init via privKey != null
++        
++        SLHDSAEngine engine = privKey.getParameters().getEngine();
++        engine.init(privKey.pk.seed);
++
++        Fors fors = new Fors(engine);
++        byte[] R = engine.PRF_msg(privKey.sk.prf, optRand, msgPrefix, msg);
++
++        IndexedDigest idxDigest = engine.H_msg(R, privKey.pk.seed, privKey.pk.root, msgPrefix, msg);
++        byte[] mHash = idxDigest.digest;
++        long idx_tree = idxDigest.idx_tree;
++        int idx_leaf = idxDigest.idx_leaf;
++        // FORS sign
++        ADRS adrs = new ADRS();
++        adrs.setTypeAndClear(ADRS.FORS_TREE);
++        adrs.setTreeAddress(idx_tree);
++        adrs.setKeyPairAddress(idx_leaf);
++        SIG_FORS[] sig_fors = fors.sign(mHash, privKey.sk.seed, privKey.pk.seed, adrs);
++        // get FORS public key - spec shows M?
++        adrs = new ADRS();
++        adrs.setTypeAndClear(ADRS.FORS_TREE);
++        adrs.setTreeAddress(idx_tree);
++        adrs.setKeyPairAddress(idx_leaf);
++        byte[] PK_FORS = fors.pkFromSig(sig_fors, mHash, privKey.pk.seed, adrs);
++
++        // sign FORS public key with HT
++        ADRS treeAdrs = new ADRS();
++        treeAdrs.setTypeAndClear(ADRS.TREE);
++
++        HT ht = new HT(engine, privKey.getSeed(), privKey.getPublicSeed());
++        byte[] SIG_HT = ht.sign(PK_FORS, idx_tree, idx_leaf);
++
++        byte[][] sigComponents = new byte[sig_fors.length + 2][];
++        sigComponents[0] = R;
++
++        for (int i = 0; i != sig_fors.length; i++)
++        {
++            sigComponents[1 + i] = Arrays.concatenate(sig_fors[i].sk, Arrays.concatenate(sig_fors[i].authPath));
++        }
++        sigComponents[sigComponents.length - 1] = SIG_HT;
++
++        return Arrays.concatenate(sigComponents);
++    }
++}
+diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/WotsPlus.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/WotsPlus.java
+new file mode 100755
+index 000000000..fe1a94e58
+--- /dev/null
++++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/WotsPlus.java
+@@ -0,0 +1,177 @@
++/*
++ * Derived from Bouncy Castle 1.80, package org.bouncycastle.pqc.crypto.slhdsa (MIT licence,
++ * Copyright (c) 2000-2025 The Legion of the Bouncy Castle Inc., see LICENTA-BOUNCYCASTLE.txt),
++ * regenerated into Aere Network by consensus-pqc/slhdsa-fork/genereaza-motorul.py on 2026-09-04 (D-337).
++ * The ONLY change of substance: the SHA-2 engine hashes through the JDK's MessageDigest (SHA-NI
++ * intrinsics) instead of Bouncy Castle's pure-Java digests, which made one SLH-DSA-SHA2-128s signature
++ * cost seconds on the QBFT thread at every anchor parent. Algorithm, key formats and signature bytes are
++ * FIPS 205 as before; SlhDsaFastEngineTest pins that against the original, in both directions.
++ * DO NOT EDIT BY HAND: regenerate with the script above.
++ */
++package org.hyperledger.besu.consensus.common.bft.slhdsa;
++
++import org.bouncycastle.util.Arrays;
++import org.bouncycastle.util.Pack;
++
++@SuppressWarnings("all")
++class WotsPlus
++{
++    private final SLHDSAEngine engine;
++    private final int w;
++
++    WotsPlus(SLHDSAEngine engine)
++    {
++        this.engine = engine;
++        this.w = this.engine.WOTS_W;
++    }
++
++    byte[] pkGen(byte[] skSeed, byte[] pkSeed, ADRS paramAdrs)
++    {
++        ADRS wotspkADRS = new ADRS(paramAdrs); // copy address to create OTS public key address
++
++        byte[][] tmp = new byte[engine.WOTS_LEN][];
++        for (int i = 0; i < engine.WOTS_LEN; i++)
++        {
++            ADRS adrs = new ADRS(paramAdrs);
++            adrs.setTypeAndClear(ADRS.WOTS_PRF);
++            adrs.setKeyPairAddress(paramAdrs.getKeyPairAddress());
++            adrs.setChainAddress(i);
++            adrs.setHashAddress(0);
++
++            byte[] sk = engine.PRF(pkSeed, skSeed, adrs);
++
++            adrs.setTypeAndClear(ADRS.WOTS_HASH);
++            adrs.setKeyPairAddress(paramAdrs.getKeyPairAddress());
++            adrs.setChainAddress(i);
++            adrs.setHashAddress(0);
++            tmp[i] = chain(sk, 0, w - 1, pkSeed, adrs);
++        }
++
++        wotspkADRS.setTypeAndClear(ADRS.WOTS_PK);
++        wotspkADRS.setKeyPairAddress(paramAdrs.getKeyPairAddress());
++
++        return engine.T_l(pkSeed, wotspkADRS, Arrays.concatenate(tmp));
++    }
++
++    // #Input: Input string X, start index i, number of steps s, public seed PK.seed, address ADRS
++    // #Output: value of F iterated s times on X
++    byte[] chain(byte[] X, int i, int s, byte[] pkSeed, ADRS adrs)
++    {
++        if (s == 0)
++        {
++            return Arrays.clone(X);
++        }
++        if ((i + s) > (this.w - 1))
++        {
++            return null;
++        }
++        byte[] result = X;
++        for (int j = 0; j < s; ++j)
++        {
++            adrs.setHashAddress(i + j);
++            result = engine.F(pkSeed, adrs, result);
++        }
++        return result;
++    }
++
++    // #Input: Message M, secret seed SK.seed, public seed PK.seed, address ADRS
++    // #Output: WOTS+ signature sig
++    public byte[] sign(byte[] M, byte[] skSeed, byte[] pkSeed, ADRS paramAdrs)
++    {
++        ADRS adrs = new ADRS(paramAdrs);
++
++        int[] msg = new int[engine.WOTS_LEN];
++
++        // convert message to base w
++        base_w(M, 0, w, msg, 0, engine.WOTS_LEN1);
++
++        // compute checksum
++        int csum = 0;
++        for (int i = 0; i < engine.WOTS_LEN1; i++)
++        {
++            csum += w - 1 - msg[i];
++        }
++
++        // convert csum to base w
++        if ((engine.WOTS_LOGW % 8) != 0)
++        {
++            csum = csum << (8 - ((engine.WOTS_LEN2 * engine.WOTS_LOGW) % 8));
++        }
++        int len_2_bytes = (engine.WOTS_LEN2 * engine.WOTS_LOGW + 7) / 8;
++        byte[] csum_bytes = Pack.intToBigEndian(csum);
++        base_w(csum_bytes, 4 - len_2_bytes, w, msg, engine.WOTS_LEN1, engine.WOTS_LEN2);
++
++        byte[][] sig = new byte[engine.WOTS_LEN][];
++        for (int i = 0; i < engine.WOTS_LEN; i++)
++        {
++            adrs.setTypeAndClear(ADRS.WOTS_PRF);
++            adrs.setKeyPairAddress(paramAdrs.getKeyPairAddress());
++            adrs.setChainAddress(i);
++            adrs.setHashAddress(0);
++            byte[] sk = engine.PRF(pkSeed, skSeed, adrs);
++            adrs.setTypeAndClear(ADRS.WOTS_HASH);
++            adrs.setKeyPairAddress(paramAdrs.getKeyPairAddress());
++            adrs.setChainAddress(i);
++            adrs.setHashAddress(0);
++            sig[i] = chain(sk, 0, msg[i], pkSeed, adrs);
++        }
++        return Arrays.concatenate(sig);
++    }
++
++    //
++    // Input: len_X-byte string X, int w, output length out_len
++    // Output: out_len int array basew
++    void base_w(byte[] X, int XOff, int w, int[] output, int outOff, int outLen)
++    {
++        int total = 0;
++        int bits = 0;
++
++        for (int consumed = 0; consumed < outLen; consumed++)
++        {
++            if (bits == 0)
++            {
++                total = X[XOff++];
++                bits += 8;
++            }
++            bits -= engine.WOTS_LOGW;
++            output[outOff++] = ((total >>> bits) & (w - 1));
++        }
++    }
++
++    public byte[] pkFromSig(byte[] sig, byte[] M, byte[] pkSeed, ADRS adrs)
++    {
++        ADRS wotspkADRS = new ADRS(adrs);
++
++        int[] msg = new int[engine.WOTS_LEN];
++
++        // convert message to base w
++        base_w(M, 0, w, msg, 0, engine.WOTS_LEN1);
++
++        // compute checksum
++        int csum = 0;
++        for (int i = 0; i < engine.WOTS_LEN1; i++ )
++        {
++            csum += w - 1 - msg[i];
++        }
++
++        // convert csum to base w
++        csum = csum << (8 - ((engine.WOTS_LEN2 * engine.WOTS_LOGW) % 8));
++        int len_2_bytes = (engine.WOTS_LEN2 * engine.WOTS_LOGW + 7) / 8;
++        byte[] csum_bytes = Pack.intToBigEndian(csum);
++        base_w(csum_bytes, 4 - len_2_bytes, w, msg, engine.WOTS_LEN1, engine.WOTS_LEN2);
++
++        byte[] sigI = new byte[engine.N];
++        byte[][] tmp = new byte[engine.WOTS_LEN][];
++        for (int  i = 0; i < engine.WOTS_LEN; i++ )
++        {
++            adrs.setChainAddress(i);
++            System.arraycopy(sig, i * engine.N, sigI, 0, engine.N);
++            tmp[i] = chain(sigI, msg[i], w - 1 - msg[i], pkSeed, adrs);
++        }
++
++        wotspkADRS.setTypeAndClear(ADRS.WOTS_PK);
++        wotspkADRS.setKeyPairAddress(adrs.getKeyPairAddress());
++        
++        return engine.T_l(pkSeed, wotspkADRS, Arrays.concatenate(tmp));
++    }
++}
 diff --git a/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/tools/PqRegistryHashTool.java b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/tools/PqRegistryHashTool.java
 new file mode 100755
-index 000000000..d78385d93
+index 000000000..a9e7a2a48
 --- /dev/null
 +++ b/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/tools/PqRegistryHashTool.java
 @@ -0,0 +1,231 @@
@@ -12329,8 +18435,8 @@ index 000000000..d78385d93
 +import org.hyperledger.besu.consensus.common.bft.PqRegistryHash;
 +
 +/**
-+ * AERE GENESIS BINDING: compute the canonical hash of a Falcon validator registry so it can be put
-+ * into genesis as {@code config.pqRegistryHash}.
++ * AERE A8: compute the canonical hash of a Falcon validator registry so it can be put into genesis
++ * as {@code config.pqRegistryHash}.
 + *
 + * 
      This tool calls THE SAME code the startup guard calls. That is the whole point of it existing
 + * as a class inside {@code consensus:common} rather than as a shell script: a tool that computed the
@@ -12403,11 +18509,11 @@ index 000000000..d78385d93
 +      return;
 +    }
 +
-+    // AERE CANONICAL FINGERPRINT (2026-08-06). hashFor, not hashV1, and this is the line an
-+    // operator pastes into genesis. For a proof-bound (v2) registry the node's gate compares
-+    // hashV2; printing hashV1 here gives the whole fleet a value NOTHING on a node ever computes.
-+    // Measured on a network of seven on 2026-08-06: all seven start, all seven report the registry
-+    // loaded, and the chain stops at H-1. A wrong instruction is more dangerous than a missing one.
++    // AERE D-C (2026-08-06). hashFor, not hashV1, and this is the line an operator pastes into
++    // genesis. For a proof-bound (v2) registry the node's gate compares hashV2; printing hashV1 here
++    // gives the whole fleet a value NOTHING on a node ever computes. Measured on a network of seven
++    // on 2026-08-06: all seven start, all seven report the registry loaded, and the chain stops at
++    // H-1. A wrong instruction is more dangerous than a missing one.
 +    //
 +    // hashV1 is also useless as an epoch identifier, which is the other reason it cannot merely be
 +    // kept alongside: the bind height is not in the v1 pre-image, so two rotation epochs of the same
@@ -12419,7 +18525,7 @@ index 000000000..d78385d93
 +      return;
 +    }
 +
-+    System.out.println("AERE PQC GENESIS-BINDING - canonical Falcon registry hash");
++    System.out.println("AERE PQC A8 - canonical Falcon registry hash");
 +    System.out.println("  file          : " + reg.sourcePath());
 +    System.out.println("  source kind   : " + reg.kind());
 +    System.out.println("  entries       : " + reg.count());
@@ -12439,7 +18545,7 @@ index 000000000..d78385d93
 +    if (reg.proofBound()) {
 +      System.out.println();
 +      System.out.println(
-+          "  AERE HEIGHT BINDING: schedule this registry at block "
++          "  AERE D-B: schedule this registry at block "
 +              + reg.bindHeight()
 +              + " AND NOWHERE ELSE. Every row's possession proof and validator claim sign that");
 +      System.out.println(
@@ -12469,10 +18575,10 @@ index 000000000..d78385d93
 +    System.out.println();
 +    System.out.println("  Paste into genesis under \"config\":");
 +    System.out.println();
-+    // AERE HEIGHT BINDING: the recipe this tool prints has to be the recipe the node accepts.
-+    // Since 2026-08-06 a proof-bound registry scheduled at a block other than its bindHeight is
-+    // refused at startup, so printing one here would be manufacturing the configuration the node
-+    // rejects - in a file that goes to all seven nodes at once.
++    // AERE D-B: the recipe this tool prints has to be the recipe the node accepts. Since 2026-08-06
++    // a proof-bound registry scheduled at a block other than its bindHeight is refused at startup,
++    // so printing one here would be manufacturing the configuration the node rejects - in a file
++    // that goes to all seven nodes at once.
 +    final long at = block == 0L && reg.proofBound() ? reg.bindHeight() : block;
 +    if (reg.proofBound() && at != reg.bindHeight()) {
 +      System.err.println();
@@ -12538,21 +18644,234 @@ index 000000000..d78385d93
 +            + "exit: 0 ok, 2 usage, 3 the registry file was rejected");
 +  }
 +}
+diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/AereAnchorProposalDelayTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/AereAnchorProposalDelayTest.java
+new file mode 100755
+index 000000000..39753f013
+--- /dev/null
++++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/AereAnchorProposalDelayTest.java
+@@ -0,0 +1,106 @@
++/*
++ * Copyright contributors to Aere Network.
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
++ * compliance with the License. You may obtain a copy of the License at
++ *
++ * http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software distributed under the License is
++ * distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
++ * implied. See the License for the specific language governing permissions and limitations under the
++ * License.
++ *
++ * SPDX-License-Identifier: Apache-2.0
++ */
++package org.hyperledger.besu.consensus.common.bft;
++
++import static org.assertj.core.api.Assertions.assertThat;
++import static org.assertj.core.api.Assertions.assertThatThrownBy;
++
++import java.util.Map;
++import java.util.OptionalInt;
++import org.hyperledger.besu.consensus.common.bft.blockcreation.PqAnchorProducer;
++import org.junit.jupiter.api.AfterEach;
++import org.junit.jupiter.api.BeforeEach;
++import org.junit.jupiter.api.Test;
++
++/**
++ * D-337 (2026-09-04): the extra wait before a proposal at an ANCHOR height, and only there.
++ *
++ * 
      The measured defect: with the hybrid certificate live on chain 2800 the proposal timer fired
++ * before the sixth SLH-DSA seal of the parent arrived, the producer refused, and eleven of twelve
++ * anchors paid the four-second round-change timeout. The fix is local timing, so the pinned
++ * properties are exactly two: the value is refused when it is nonsense (a bad delay must stop the
++ * node at start, not surprise the state machine), and it is added at anchor heights ONLY, so an
++ * ordinary block is never slowed by a millisecond.
++ */
++class AereAnchorProposalDelayTest {
++
++  @BeforeEach
++  @AfterEach
++  void clean() {
++    System.clearProperty(AereAnchorProposalDelay.PROPERTY);
++    AereAnchorProposalDelay.forgetForTesting();
++    PqAnchorProducer.useConfigForTesting(null);
++  }
++
++  @Test
++  void unsetMeansExactlyTodaysBehaviour() {
++    assertThat(AereAnchorProposalDelay.configuredMillis()).isZero();
++    assertThat(AereAnchorProposalDelay.millisFor(13_014_016L)).isZero();
++  }
++
++  @Test
++  void nonsenseIsRefused() {
++    assertThatThrownBy(() -> AereAnchorProposalDelay.parse("later"))
++        .isInstanceOf(IllegalArgumentException.class)
++        .hasMessageContaining("AERE-PQC-ANCHOR-CONF-05");
++    assertThatThrownBy(() -> AereAnchorProposalDelay.parse("-1"))
++        .isInstanceOf(IllegalArgumentException.class)
++        .hasMessageContaining("outside");
++    assertThatThrownBy(() -> AereAnchorProposalDelay.parse("5001"))
++        .isInstanceOf(IllegalArgumentException.class)
++        .hasMessageContaining("outside");
++    assertThat(AereAnchorProposalDelay.parse("1200")).isEqualTo(1200L);
++    assertThat(AereAnchorProposalDelay.parse(null)).isZero();
++    assertThat(AereAnchorProposalDelay.parse("  ")).isZero();
++  }
++
++  @Test
++  void theWaitAppliesAtAnchorHeightsAndNowhereElse() {
++    // the live shape of chain 2800: anchors from 13,014,000, every 32nd block
++    final PqAnchorConfig cfg =
++        new PqAnchorConfig(
++            2800L,
++            13_014_000L,
++            Map.of(13_014_000L, 6),
++            OptionalInt.empty(),
++            false,
++            OptionalInt.empty(),
++            OptionalInt.of(32),
++            13_014_000L);
++    PqAnchorProducer.useConfigForTesting(cfg);
++    System.setProperty(AereAnchorProposalDelay.PROPERTY, "1200");
++    AereAnchorProposalDelay.forgetForTesting();
++
++    assertThat(AereAnchorProposalDelay.configuredMillis()).isEqualTo(1200L);
++    assertThat(cfg.anchorAppliesAt(13_014_032L)).isTrue();
++    assertThat(AereAnchorProposalDelay.millisFor(13_014_032L)).isEqualTo(1200L);
++
++    // the parent of an anchor, and an ordinary block: not a millisecond
++    assertThat(AereAnchorProposalDelay.millisFor(13_014_031L)).isZero();
++    assertThat(AereAnchorProposalDelay.millisFor(13_014_033L)).isZero();
++    // below the activation height nothing is an anchor
++    assertThat(AereAnchorProposalDelay.millisFor(13_013_968L)).isZero();
++  }
++
++  @Test
++  void aChainWithoutAnAnchorNeverWaits() {
++    PqAnchorProducer.useConfigForTesting(PqAnchorConfig.never(2800L));
++    System.setProperty(AereAnchorProposalDelay.PROPERTY, "1200");
++    AereAnchorProposalDelay.forgetForTesting();
++    assertThat(AereAnchorProposalDelay.millisFor(13_014_032L)).isZero();
++    assertThat(AereAnchorProposalDelay.millisFor(1L)).isZero();
++  }
++}
+diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/D177NeutralNamesTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/D177NeutralNamesTest.java
+new file mode 100755
+index 000000000..05136c6a1
+--- /dev/null
++++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/D177NeutralNamesTest.java
+@@ -0,0 +1,97 @@
++/*
++ * Copyright contributors to the AERE Network.
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file
++ * except in compliance with the License. You may obtain a copy of the License at
++ *
++ * http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software distributed under the
++ * License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
++ * either express or implied. See the License for the specific language governing permissions
++ * and limitations under the License.
++ *
++ * SPDX-License-Identifier: Apache-2.0
++ */
++package org.hyperledger.besu.consensus.common.bft;
++
++import static org.assertj.core.api.Assertions.assertThat;
++import static org.assertj.core.api.Assertions.assertThatThrownBy;
++
++import org.junit.jupiter.api.AfterEach;
++import org.junit.jupiter.api.Test;
++
++/**
++ * D-177: the operator-facing switches must not name an algorithm. Every legacy {@code
++ * aere.falcon.*} property has an algorithm-neutral twin {@code aere.pq.sig.*}, read FIRST, with
++ * the legacy spelling kept as a working fallback, and a loud refusal when the two spellings
++ * disagree - the 2026-08-09 lost-fork incident is exactly what a silent preference would invite.
++ *
++ * 
      These tests exercise the single choke point every configured value passes through
++ * ({@link FalconSealSupport#resolve}), so the four behaviours are proven once for all sixteen
++ * switches instead of sixteen times over.
++ */
++class D177NeutralNamesTest {
++
++  private static final String LEGACY = "aere.falcon.validatorCount";
++  private static final String NEUTRAL = "aere.pq.sig.validatorCount";
++  private static final String ENV = "AERE_FALCON_VALIDATOR_COUNT";
++
++  @AfterEach
++  void clear() {
++    System.clearProperty(LEGACY);
++    System.clearProperty(NEUTRAL);
++  }
++
++  @Test
++  void neutralNameAloneIsRead() {
++    System.setProperty(NEUTRAL, "9");
++    assertThat(FalconSealSupport.resolve(LEGACY, ENV)).isEqualTo("9");
++  }
++
++  @Test
++  void legacyNameAloneStillWorks() {
++    System.setProperty(LEGACY, "7");
++    assertThat(FalconSealSupport.resolve(LEGACY, ENV)).isEqualTo("7");
++  }
++
++  @Test
++  void bothNamesSameValueIsAMigrationWindow() {
++    System.setProperty(NEUTRAL, "9");
++    System.setProperty(LEGACY, "9");
++    assertThat(FalconSealSupport.resolve(LEGACY, ENV)).isEqualTo("9");
++  }
++
++  @Test
++  void bothNamesDifferentValuesRefuseLoudly() {
++    System.setProperty(NEUTRAL, "9");
++    System.setProperty(LEGACY, "7");
++    assertThatThrownBy(() -> FalconSealSupport.resolve(LEGACY, ENV))
++        .isInstanceOf(FalconSealSupport.ActivationConfigException.class)
++        .hasMessageContaining("AERE-PQC-CFG-DUAL-NAME-01")
++        .hasMessageContaining(NEUTRAL)
++        .hasMessageContaining(LEGACY);
++  }
++
++  @Test
++  void neutralNameWinsWhenBothAreSemanticallyEqual() {
++    // same text with different whitespace: trim makes them equal, and the neutral value is the
++    // one returned, so new fleets can write only the neutral name with no surprise
++    System.setProperty(NEUTRAL, " 9 ");
++    System.setProperty(LEGACY, "9");
++    assertThat(FalconSealSupport.resolve(LEGACY, ENV)).isEqualTo(" 9 ");
++  }
++
++  @Test
++  void nonFalconPropertiesAreLeftUntouched() {
++    // a property that does not start with aere.falcon. gets no twin: resolve stays exactly the
++    // reader it was before for it
++    System.setProperty("aere.pq.anchorBlock", "13014000");
++    try {
++      assertThat(FalconSealSupport.resolve("aere.pq.anchorBlock", "AERE_PQ_ANCHOR_BLOCK"))
++          .isEqualTo("13014000");
++    } finally {
++      System.clearProperty("aere.pq.anchorBlock");
++    }
++  }
++}
 diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/FalconAttachIntervalTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/FalconAttachIntervalTest.java
 new file mode 100755
-index 000000000..2d593d4e8
+index 000000000..014244362
 --- /dev/null
 +++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/FalconAttachIntervalTest.java
-@@ -0,0 +1,232 @@
+@@ -0,0 +1,228 @@
 +/*
 + * AERE, 2026-08-08. The interval and the cap on the path BEFORE the anchor is activated.
 + *
 + * WHY THIS EXISTS, and the cost that demanded it. On 8 August Falcon seal attachment was switched
 + * on across all seven validators of chain 2800. The header went from 525 to 3844 bytes, that is
-+ * FIVE seals on EVERY block: more than seven times the previous header, every ~523 ms. On a chain
-+ * with no transactions the headers are close to everything that gets written to disk, so that
-+ * multiplier is exactly the multiplier of database growth, and it exceeds any reasonable
-+ * provisioning.
++ * FIVE seals on EVERY block. At ~60.3 million blocks per year that is ~200 GB per year per node,
++ * measured, and the tightest host had 12 GB free. That is 23 days.
 + *
 + * AND NOW THE PART THAT IS THE ACTUAL FINDING. The anchor producer already had both an interval and
 + * a cap, built and proven on 7 August. But the assembler that runs when the anchor is NOT armed had
@@ -12573,7 +18892,7 @@ index 000000000..2d593d4e8
 + * and it is a dial, not an accident. Algorand ships the same shape at 1 in 256 or rarer.
 + *
 + * Same property as in `PqAnchorIntervalTest`, a different code path. Two paths need two proofs:
-+ * precisely because we had a proof on one of them only, we paid the full cost on the other.
++ * precisely because we had a proof on one of them only, we paid 200 GB per year on the other.
 + */
 +package org.hyperledger.besu.consensus.common.bft;
 +
@@ -12641,23 +18960,23 @@ index 000000000..2d593d4e8
 +  // ---------------------------------------------------------------------------------------------
 +  @Test
 +  void anIntervalOfOneHundredCarriesExactlyOneHeightInOneHundred() {
-+    int cu = 0;
++    int with = 0;
 +    for (long n = ATTACH; n < ATTACH + 10_000; n++) {
 +      if (FalconSealSupport.isAttachHeight(n, ATTACH, OptionalInt.of(100))) {
-+        cu++;
++        with++;
 +        assertThat((n - ATTACH) % 100).as("height %d is not a multiple", n).isZero();
 +      }
 +    }
-+    assertThat(cu).isEqualTo(100);
++    assertThat(with).isEqualTo(100);
 +
 +    // and the same span of heights WITH NO interval, so the difference we are buying is visible
-+    int fara = 0;
++    int without = 0;
 +    for (long n = ATTACH; n < ATTACH + 10_000; n++) {
 +      if (FalconSealSupport.isAttachHeight(n, ATTACH, OptionalInt.empty())) {
-+        fara++;
++        without++;
 +      }
 +    }
-+    assertThat(fara).isEqualTo(10_000);
++    assertThat(without).isEqualTo(10_000);
 +  }
 +
 +  // ---------------------------------------------------------------------------------------------
@@ -12753,37 +19072,661 @@ index 000000000..2d593d4e8
 +  @Test
 +  void theMeasuredCostOfEachSettingIsWhatWeToldTheFounder() {
 +    final long blocuriPeAn = 60_300_000L;
-+    final long octetiPeSigiliu = 662L;
++    final long bytesPerSeal = 662L;
 +
-+    assertThat(gbPeAn(5, 1, octetiPeSigiliu, blocuriPeAn)).isBetween(180L, 210L); // today
-+    assertThat(gbPeAn(3, 1, octetiPeSigiliu, blocuriPeAn)).isBetween(105L, 125L); // cap only
-+    assertThat(gbPeAn(3, 32, octetiPeSigiliu, blocuriPeAn)).isBetween(3L, 5L); // cap + 32
-+    assertThat(gbPeAn(3, 100, octetiPeSigiliu, blocuriPeAn)).isBetween(1L, 2L); // cap + 100
++    assertThat(gbPeAn(5, 1, bytesPerSeal, blocuriPeAn)).isBetween(180L, 210L); // today
++    assertThat(gbPeAn(3, 1, bytesPerSeal, blocuriPeAn)).isBetween(105L, 125L); // cap only
++    assertThat(gbPeAn(3, 32, bytesPerSeal, blocuriPeAn)).isBetween(3L, 5L); // cap + 32
++    assertThat(gbPeAn(3, 100, bytesPerSeal, blocuriPeAn)).isBetween(1L, 2L); // cap + 100
 +
-+    // and the boundary that matters for any provisioning decision: starting from a fixed space
-+    // budget, how many days each setting lasts. The budget below is a parameter of the proof, kept
-+    // deliberately small so that the order of magnitude between the settings is visible.
-+    assertThat(zile(12L, gbPeAn(5, 1, octetiPeSigiliu, blocuriPeAn))).isLessThan(30L);
-+    assertThat(zile(12L, gbPeAn(3, 32, octetiPeSigiliu, blocuriPeAn))).isGreaterThan(700L);
++    // and the boundary that matters for the disk decision: at 12 GB free, how many days are left
++    assertThat(zile(12L, gbPeAn(5, 1, bytesPerSeal, blocuriPeAn))).isLessThan(30L);
++    assertThat(zile(12L, gbPeAn(3, 32, bytesPerSeal, blocuriPeAn))).isGreaterThan(700L);
 +  }
 +
 +  private static long gbPeAn(
-+      final int sigilii, final int interval, final long octetiPeSigiliu, final long blocuriPeAn) {
-+    return (long) sigilii * octetiPeSigiliu * blocuriPeAn / interval / (1024L * 1024L * 1024L);
++      final int seals, final int interval, final long bytesPerSeal, final long blocuriPeAn) {
++    return (long) seals * bytesPerSeal * blocuriPeAn / interval / (1024L * 1024L * 1024L);
 +  }
 +
 +  private static long zile(final long gbLiberi, final long gbPeAn) {
 +    return gbPeAn == 0 ? Long.MAX_VALUE : gbLiberi * 365L / gbPeAn;
 +  }
 +}
+diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/HybridSealProducerTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/HybridSealProducerTest.java
+new file mode 100755
+index 000000000..5569abeb7
+--- /dev/null
++++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/HybridSealProducerTest.java
+@@ -0,0 +1,177 @@
++/* AERE HYBRID: the PRODUCER's proofs, and its pairing with enforcement.
++ *
++ * The proof that ties the two halves is the last one: what the producer PRODUCES must pass
++ * exactly the verification the consumer performs, with real test keys and the same message.
++ * Two halves proven separately that were never put end to end are the very pattern that cost
++ * us the most (D-150: every shape-level check had passed). */
++package org.hyperledger.besu.consensus.common.bft;
++
++import static org.assertj.core.api.Assertions.assertThat;
++
++import org.hyperledger.besu.crypto.SecureRandomProvider;
++
++import java.security.SecureRandom;
++import java.util.List;
++import java.util.Map;
++
++import org.apache.tuweni.bytes.Bytes;
++import org.junit.jupiter.api.BeforeEach;
++import org.junit.jupiter.api.Test;
++
++class HybridSealProducerTest {
++
++  private static final long H_ATASARE = 500L;
++  private static final long H_HIBRID = 1_000L;
++  private static final int INDEX = 4;
++  private static final Bytes MESSAGE = Bytes.fromHexString("0x" + "5a".repeat(32));
++
++  private SealScheme.GeneratedPair slh;
++  private PqSchemeSchedule orar;
++
++  private final SecureRandom random = SecureRandomProvider.createSecureRandom();
++
++  @BeforeEach
++  void setup() {
++    slh = SealSchemes.SLH_DSA_128S.generate(random);
++    orar =
++        PqSchemeSchedule.parse(
++            "0:" + SealSchemes.FALCON_512.id()
++                + "," + H_HIBRID + ":" + SealSchemes.FALCON_512.id()
++                + "+" + SealSchemes.SLH_DSA_128S.id());
++  }
++
++  private HybridSealProducer producator() {
++    return new HybridSealProducer(
++        H_ATASARE, orar, INDEX, Map.of(SealSchemes.SLH_DSA_128S.id(), slh.privateKey()));
++  }
++
++  // ---------------------------------------------------------------- poarta de emisie
++
++  @Test
++  void theDefaultProducerNeverEmitsAnything() {
++    assertThat(HybridSealProducer.disarmed().sealsFor(Long.MAX_VALUE - 1, MESSAGE)).isEmpty();
++    assertThat(HybridSealProducer.disarmed().attachmentArmedAt(Long.MAX_VALUE - 1)).isFalse();
++  }
++
++  @Test
++  void belowTheAttachmentHeightNothingIsEmitted() {
++    assertThat(producator().sealsFor(H_ATASARE - 1, MESSAGE)).isEmpty();
++  }
++
++  @Test
++  void betweenAttachmentAndTheHybridStepThereIsNothingToAdd() {
++    // the gate is open, but the schedule requires only Falcon, which has its own slot: zero extras, correctly
++    assertThat(producator().attachmentArmedAt(H_ATASARE)).isTrue();
++    assertThat(producator().sealsFor(H_ATASARE, MESSAGE)).isEmpty();
++  }
++
++  /**
++   * THE PROOF THAT ACTUALLY SEPARATES THE TWO CASES. The first form of the boundary proof
++   * above passed for the wrong reason: below the attach height the schedule required no extra
++   * scheme anyway, so an empty list said nothing about the gate. Here the schedule REQUIRES,
++   * and the only remaining difference is the gate. Without this, a producer with its gate
++   * removed would have stayed green.
++   */
++  @Test
++  void theGateAloneSuppressesEmissionEvenWhenTheScheduleDemandsIt() {
++    final HybridSealProducer poartaInchisa =
++        new HybridSealProducer(
++            H_HIBRID + 100,
++            orar,
++            INDEX,
++            Map.of(SealSchemes.SLH_DSA_128S.id(), slh.privateKey()));
++    assertThat(poartaInchisa.sealsFor(H_HIBRID, MESSAGE)).isEmpty();
++    assertThat(poartaInchisa.sealsFor(H_HIBRID + 100, MESSAGE)).hasSize(1);
++  }
++
++  @Test
++  void atTheHybridStepTheExtraSealIsProduced() {
++    final List seals = producator().sealsFor(H_HIBRID, MESSAGE);
++    assertThat(seals).hasSize(1);
++    assertThat(seals.get(0).getSchemeWireId()).isEqualTo(SealSchemes.SLH_DSA_128S.wireId());
++    assertThat(seals.get(0).getValidatorIndex()).isEqualTo(INDEX);
++  }
++
++  // ---------------------------------------------------------------- jumatatea de certificat
++
++  @Test
++  void aMissingKeyEmitsNothingAtAllRatherThanAStubCertificate() {
++    final HybridSealProducer withoutKey =
++        new HybridSealProducer(H_ATASARE, orar, INDEX, Map.of());
++    assertThat(withoutKey.sealsFor(H_HIBRID, MESSAGE)).isEmpty();
++  }
++
++  @Test
++  void aNullMessageIsRefusedWithoutThrowing() {
++    assertThat(producator().sealsFor(H_HIBRID, null)).isEmpty();
++  }
++
++  // ---------------------------------------------------------------- dus-intorsul cheii
++
++  @Test
++  void theSlhDsaPrivateKeySurvivesSerializationAndStillSigns() {
++    final byte[] encoded =
++        SealSchemes.SLH_DSA_128S.serializePrivateKey(slh.privateKey()).orElseThrow();
++    final SealScheme.PrivateHandle back =
++        SealSchemes.SLH_DSA_128S.parsePrivateKey(encoded).orElseThrow();
++
++    final byte[] semnat =
++        SealSchemes.SLH_DSA_128S.sign(back, MESSAGE.toArray()).orElseThrow();
++    assertThat(
++            SealSchemes.SLH_DSA_128S.verifyRaw(
++                slh.publicRegistryForm(), MESSAGE.toArray(), semnat))
++        .isTrue();
++  }
++
++  @Test
++  void garbageIsNotAPrivateKeyAndFalconDeliberatelyHasNoEncoding() {
++    assertThat(SealSchemes.SLH_DSA_128S.parsePrivateKey(new byte[] {1, 2, 3})).isEmpty();
++    assertThat(SealSchemes.SLH_DSA_128S.parsePrivateKey(null)).isEmpty();
++    // Falcon NU implementeaza dus-intorsul: incarcarea lui de productie ramane pe componente,
++    // neatinsa. Daca cineva o implementeaza intr-o zi, proba asta il obliga sa se uite aici.
++    final SealScheme.GeneratedPair falcon = SealSchemes.FALCON_512.generate(random);
++    assertThat(SealSchemes.FALCON_512.serializePrivateKey(falcon.privateKey())).isEmpty();
++  }
++
++  // ---------------------------------------------------------------- CELE DOUA JUMATATI, LEGATE
++
++  @Test
++  void whatTheProducerEmitsIsExactlyWhatTheRegistryVerifies() {
++    // producatorul semneaza...
++    final List produse = producator().sealsFor(H_HIBRID, MESSAGE);
++    assertThat(produse).hasSize(1);
++
++    // ...and a REAL hybrid registry, built from properties as in production, verifies it
++    // the registry REFUSES a missing entry (its guard, first caught by this very proof),
++    // so it is built whole: every validator up to our index
++    final java.util.Properties p = new java.util.Properties();
++    p.setProperty("formatVersion", HybridSignerRegistry.FORMAT_VERSION);
++    p.setProperty("chainId", "2800");
++    p.setProperty("count", String.valueOf(INDEX + 1));
++    for (int i = 0; i <= INDEX; i++) {
++      p.setProperty(i + ".addr", "0x" + String.format("%02x", 0xc0 + i).repeat(20));
++      final byte[] pub =
++          i == INDEX
++              ? slh.publicRegistryForm()
++              : SealSchemes.SLH_DSA_128S.generate(random).publicRegistryForm();
++      p.setProperty(
++          i + ".key." + SealSchemes.SLH_DSA_128S.id(), Bytes.wrap(pub).toHexString());
++    }
++    final HybridSignerRegistry registry = HybridSignerRegistry.fromProperties(p, "proba");
++
++    final byte[] cheiePublica =
++        registry.publicKey(INDEX, SealSchemes.SLH_DSA_128S.id()).orElseThrow();
++    assertThat(
++            SealSchemes.SLH_DSA_128S.verifyRaw(
++                cheiePublica, MESSAGE.toArray(), produse.get(0).getSignature().toArray()))
++        .isTrue();
++
++    // the binding's NEGATIVE CONTROL: the same seal over a DIFFERENT message does not pass
++    assertThat(
++            SealSchemes.SLH_DSA_128S.verifyRaw(
++                cheiePublica,
++                Bytes.fromHexString("0x" + "5b".repeat(32)).toArray(),
++                produse.get(0).getSignature().toArray()))
++        .isFalse();
++  }
++}
+diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/HybridSealSupportTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/HybridSealSupportTest.java
+new file mode 100755
+index 000000000..971389b4c
+--- /dev/null
++++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/HybridSealSupportTest.java
+@@ -0,0 +1,206 @@
++/* AERE HYBRID: the PRODUCTION loader's proofs. Each configuration half refuses with its own
++ * code; the happy path reaches a producer that really signs, with REAL test keys, and its
++ * signature is verified against the public key from the registry loaded off "disk"
++ * (a fake ConfigReader: no real file, no global property, zero JVM poisoning). */
++package org.hyperledger.besu.consensus.common.bft;
++
++import static org.assertj.core.api.Assertions.assertThat;
++import static org.assertj.core.api.Assertions.assertThatThrownBy;
++
++import org.hyperledger.besu.crypto.SecureRandomProvider;
++
++import java.io.IOException;
++import java.nio.charset.StandardCharsets;
++import java.security.SecureRandom;
++import java.util.HashMap;
++import java.util.List;
++import java.util.Map;
++
++import org.apache.tuweni.bytes.Bytes;
++import org.junit.jupiter.api.BeforeEach;
++import org.junit.jupiter.api.Test;
++
++class HybridSealSupportTest {
++
++  private static final long H_HIBRID = 900L;
++  private static final int INDEX = 2;
++
++  private final SecureRandom random = SecureRandomProvider.createSecureRandom();
++  private SealScheme.GeneratedPair slh;
++  private String orar;
++  private String registruText;
++
++  /** Cititor fals: proprietati si "fisiere" din memorie. */
++  private static final class Cititor implements HybridSealSupport.ConfigReader {
++    final Map props = new HashMap<>();
++    final Map files = new HashMap<>();
++
++    @Override
++    public String property(final String name) {
++      return props.get(name);
++    }
++
++    @Override
++    public String environment(final String name) {
++      return null;
++    }
++
++    @Override
++    public byte[] file(final String path) throws IOException {
++      final byte[] b = files.get(path);
++      if (b == null) {
++        throw new IOException("nu exista: " + path);
++      }
++      return b;
++    }
++  }
++
++  @BeforeEach
++  void setup() {
++    slh = SealSchemes.SLH_DSA_128S.generate(random);
++    orar =
++        "0:" + SealSchemes.FALCON_512.id()
++            + "," + H_HIBRID + ":" + SealSchemes.FALCON_512.id()
++            + "+" + SealSchemes.SLH_DSA_128S.id();
++    final StringBuilder r = new StringBuilder();
++    r.append("formatVersion=").append(HybridSignerRegistry.FORMAT_VERSION).append('\n');
++    r.append("chainId=2800\n");
++    r.append("count=").append(INDEX + 1).append('\n');
++    for (int i = 0; i <= INDEX; i++) {
++      final byte[] pub =
++          i == INDEX
++              ? slh.publicRegistryForm()
++              : SealSchemes.SLH_DSA_128S.generate(random).publicRegistryForm();
++      r.append(i).append(".addr=0x").append(String.format("%02x", 0xd0 + i).repeat(20)).append('\n');
++      r.append(i).append(".key.").append(SealSchemes.SLH_DSA_128S.id()).append('=')
++          .append(Bytes.wrap(pub).toHexString()).append('\n');
++    }
++    registruText = r.toString();
++  }
++
++  private Cititor cuPereche() {
++    final Cititor c = new Cititor();
++    c.props.put(HybridSealSupport.PROPERTY_SCHEDULE, orar);
++    c.props.put(HybridSealSupport.PROPERTY_REGISTRY, "/fals/registru.properties");
++    c.files.put("/fals/registru.properties", registruText.getBytes(StandardCharsets.UTF_8));
++    return c;
++  }
++
++  private void withKey(final Cititor c, final int index, final byte[] sk) {
++    c.props.put(
++        HybridSealSupport.PROPERTY_KEY_PREFIX + SealSchemes.SLH_DSA_128S.id(),
++        "/fals/cheia.properties");
++    c.files.put(
++        "/fals/cheia.properties",
++        ("index=" + index + "\nsk=" + Bytes.wrap(sk).toHexString() + "\n")
++            .getBytes(StandardCharsets.UTF_8));
++  }
++
++  private byte[] skBytes() {
++    return SealSchemes.SLH_DSA_128S.serializePrivateKey(slh.privateKey()).orElseThrow();
++  }
++
++  // ------------------------------------------------------------------ dezarmat si refuzuri
++
++  @Test
++  void nothingConfiguredMeansTodayByteForByte() {
++    final HybridSealSupport s = HybridSealSupport.load(new Cititor());
++    assertThat(s.schedule()).isEmpty();
++    assertThat(s.registry()).isEmpty();
++    assertThat(s.producer().sealsFor(Long.MAX_VALUE - 1, Bytes.of(1))).isEmpty();
++  }
++
++  @Test
++  void scheduleWithoutRegistryRefusesAsConf03() {
++    final Cititor c = new Cititor();
++    c.props.put(HybridSealSupport.PROPERTY_SCHEDULE, orar);
++    assertThatThrownBy(() -> HybridSealSupport.load(c))
++        .hasMessageContaining("AERE-PQC-COMMIT-CONF-03");
++  }
++
++  @Test
++  void attachWithoutThePairRefusesAsConf04() {
++    final Cititor c = new Cititor();
++    c.props.put(HybridSealSupport.PROPERTY_ATTACH_BLOCK, "100");
++    assertThatThrownBy(() -> HybridSealSupport.load(c))
++        .hasMessageContaining("AERE-PQC-HYBRID-CONF-04");
++  }
++
++  @Test
++  void garbageScheduleRefusesLoudly() {
++    final Cititor c = cuPereche();
++    c.props.put(HybridSealSupport.PROPERTY_SCHEDULE, "aiurea:schema-inexistenta");
++    assertThatThrownBy(() -> HybridSealSupport.load(c))
++        .hasMessageContaining("AERE-PQC-HYBRID-CONF-04");
++  }
++
++  @Test
++  void unreadableRegistryRefusesLoudly() {
++    final Cititor c = cuPereche();
++    c.files.clear();
++    assertThatThrownBy(() -> HybridSealSupport.load(c))
++        .hasMessageContaining("AERE-PQC-HYBRID-CONF-04");
++  }
++
++  @Test
++  void armedEmissionWithoutALocalKeyRefusesAsConf04() {
++    final Cititor c = cuPereche();
++    c.props.put(HybridSealSupport.PROPERTY_ATTACH_BLOCK, "100");
++    assertThatThrownBy(() -> HybridSealSupport.load(c))
++        .hasMessageContaining("AERE-PQC-HYBRID-CONF-04")
++        .hasMessageContaining("cannot produce");
++  }
++
++  @Test
++  void aKeyTheRegistryDoesNotVouchForRefusesAsConf05() {
++    final Cititor c = cuPereche();
++    // my real key, but declared at index 0, where the registry holds a DIFFERENT public key
++    withKey(c, 0, skBytes());
++    assertThatThrownBy(() -> HybridSealSupport.load(c))
++        .hasMessageContaining("AERE-PQC-HYBRID-CONF-05")
++        .hasMessageContaining("does NOT verify");
++  }
++
++  @Test
++  void garbageKeyBytesRefuseAsConf05() {
++    final Cititor c = cuPereche();
++    withKey(c, INDEX, new byte[] {1, 2, 3});
++    assertThatThrownBy(() -> HybridSealSupport.load(c))
++        .hasMessageContaining("AERE-PQC-HYBRID-CONF-05");
++  }
++
++  // ------------------------------------------------------------------ drumul fericit, cap la cap
++
++  @Test
++  void theLoadedProducerSignsAndTheLoadedRegistryVerifiesIt() {
++    final Cititor c = cuPereche();
++    c.props.put(HybridSealSupport.PROPERTY_ATTACH_BLOCK, "0");
++    withKey(c, INDEX, skBytes());
++
++    final HybridSealSupport s = HybridSealSupport.load(c);
++    assertThat(s.schedule()).isPresent();
++    assertThat(s.registry()).isPresent();
++
++    final Bytes message = Bytes.fromHexString("0x" + "77".repeat(32));
++    final List seals = s.producer().sealsFor(H_HIBRID, message);
++    assertThat(seals).hasSize(1);
++    assertThat(seals.get(0).getValidatorIndex()).isEqualTo(INDEX);
++
++    final byte[] pub =
++        s.registry().get().publicKey(INDEX, SealSchemes.SLH_DSA_128S.id()).orElseThrow();
++    assertThat(
++            SealSchemes.SLH_DSA_128S.verifyRaw(
++                pub, message.toArray(), seals.get(0).getSignature().toArray()))
++        .isTrue();
++  }
++
++  @Test
++  void withThePairButNoKeyTheNodeVerifiesButNeverEmits() {
++    // exactly the state of a validator that received the binary and the registry but not the
++    // key: its enforcement can work, its emission promises nothing
++    final HybridSealSupport s = HybridSealSupport.load(cuPereche());
++    assertThat(s.schedule()).isPresent();
++    assertThat(s.registry()).isPresent();
++    assertThat(s.producer().sealsFor(H_HIBRID, Bytes.of(1))).isEmpty();
++  }
++}
+diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/HybridSignerRegistryTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/HybridSignerRegistryTest.java
+new file mode 100755
+index 000000000..87bca049e
+--- /dev/null
++++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/HybridSignerRegistryTest.java
+@@ -0,0 +1,225 @@
++/* AERE crypto-agility, step 3 proofs. The registry's job is to REFUSE: every acceptance test here
++ * is outnumbered by refusal tests, because blocante_armare (2026-08-06) measured what a lenient
++ * loader costs: a mistyped comma boots the node DISARMED and nothing shouts. Keys are throwaway
++ * pairs generated per run; no real validator key exists anywhere near this file. */
++package org.hyperledger.besu.consensus.common.bft;
++
++import static org.assertj.core.api.Assertions.assertThat;
++import static org.assertj.core.api.Assertions.assertThatThrownBy;
++
++import java.security.SecureRandom;
++import java.util.Properties;
++
++import org.apache.tuweni.bytes.Bytes;
++import org.hyperledger.besu.crypto.SecureRandomProvider;
++import org.junit.jupiter.api.Test;
++
++class HybridSignerRegistryTest {
++
++  private static final String FALCON = "falcon-512";
++  private static final String SLHDSA = "slh-dsa-128s";
++
++  private final SecureRandom random = SecureRandomProvider.createSecureRandom();
++
++  /** 3 validators: 0 hybrid (both schemes), 1 falcon-only, 2 hybrid. */
++  private Properties sanatos() {
++    final Properties p = new Properties();
++    p.setProperty("formatVersion", "hybrid-1");
++    p.setProperty("chainId", "2800");
++    p.setProperty("count", "3");
++    for (int i = 0; i < 3; i++) {
++      p.setProperty(i + ".addr", "0x" + String.format("%040x", 0xA0 + i));
++      p.setProperty(
++          i + ".key." + FALCON,
++          Bytes.wrap(SealSchemes.FALCON_512.generate(random).publicRegistryForm()).toHexString());
++    }
++    for (final int i : new int[] {0, 2}) {
++      p.setProperty(
++          i + ".key." + SLHDSA,
++          Bytes.wrap(SealSchemes.SLH_DSA_128S.generate(random).publicRegistryForm()).toHexString());
++    }
++    return p;
++  }
++
++  // ------------------------------------------------------------------ acceptance
++
++  @Test
++  void healthyHybridRegistryLoadsWithRightCoverage() {
++    final HybridSignerRegistry reg = HybridSignerRegistry.fromProperties(sanatos(), "test");
++    assertThat(reg.size()).isEqualTo(3);
++    assertThat(reg.chainId()).isEqualTo(2800);
++    assertThat(reg.coverage(FALCON)).isEqualTo(3);
++    assertThat(reg.coverage(SLHDSA)).isEqualTo(2);
++    assertThat(reg.publicKey(0, FALCON)).isPresent();
++    assertThat(reg.publicKey(0, SLHDSA)).isPresent();
++    assertThat(reg.publicKey(1, SLHDSA)).isEmpty(); // falcon-only validator
++    assertThat(reg.publicKey(9, FALCON)).isEmpty(); // absent index
++    assertThat(reg.schemesOf(0)).containsExactly(FALCON, SLHDSA); // canonical id order
++    assertThat(reg.address(1)).isPresent();
++    // keys parse under their scheme and have the measured lengths (896 / 32)
++    assertThat(reg.publicKey(0, FALCON).orElseThrow()).hasSize(896);
++    assertThat(reg.publicKey(0, SLHDSA).orElseThrow()).hasSize(32);
++  }
++
++  // ------------------------------------------------------------------ refusals
++
++  @Test
++  void unknownSchemeSuffixRefusesTheWholeRegistryByName() {
++    final Properties p = sanatos();
++    p.setProperty("1.key.dilithium-notyet", "0x1234");
++    assertThatThrownBy(() -> HybridSignerRegistry.fromProperties(p, "test"))
++        .isInstanceOf(IllegalArgumentException.class)
++        .hasMessageContaining("dilithium-notyet");
++  }
++
++  @Test
++  void wrongKeyLengthForItsSchemeRefuses() {
++    final Properties p = sanatos();
++    p.setProperty("1.key." + SLHDSA, "0x" + "ab".repeat(31)); // 31, not 32
++    assertThatThrownBy(() -> HybridSignerRegistry.fromProperties(p, "test"))
++        .isInstanceOf(IllegalArgumentException.class)
++        .hasMessageContaining("exactly");
++  }
++
++  @Test
++  void falconKeyInSlhSlotRefuses() {
++    // an 896-byte value under the slh-dsa suffix: length check must catch the swap
++    final Properties p = sanatos();
++    p.setProperty(
++        "1.key." + SLHDSA,
++        Bytes.wrap(SealSchemes.FALCON_512.generate(random).publicRegistryForm()).toHexString());
++    assertThatThrownBy(() -> HybridSignerRegistry.fromProperties(p, "test"))
++        .isInstanceOf(IllegalArgumentException.class);
++  }
++
++  @Test
++  void missingAddressRefuses() {
++    final Properties p = sanatos();
++    p.remove("1.addr");
++    assertThatThrownBy(() -> HybridSignerRegistry.fromProperties(p, "test"))
++        .isInstanceOf(IllegalArgumentException.class)
++        .hasMessageContaining("1.addr");
++  }
++
++  @Test
++  void holeInTheIndexSequenceRefuses() {
++    final Properties p = sanatos();
++    p.remove("1.addr");
++    p.remove("1.key." + FALCON);
++    assertThatThrownBy(() -> HybridSignerRegistry.fromProperties(p, "test"))
++        .isInstanceOf(IllegalArgumentException.class);
++  }
++
++  @Test
++  void entriesBeyondCountRefuse() {
++    final Properties p = sanatos();
++    p.setProperty("7.addr", "0x" + "cd".repeat(20));
++    p.setProperty(
++        "7.key." + FALCON,
++        Bytes.wrap(SealSchemes.FALCON_512.generate(random).publicRegistryForm()).toHexString());
++    assertThatThrownBy(() -> HybridSignerRegistry.fromProperties(p, "test"))
++        .isInstanceOf(IllegalArgumentException.class)
++        .hasMessageContaining("beyond count");
++  }
++
++  @Test
++  void wrongFormatVersionRefuses() {
++    final Properties p = sanatos();
++    p.setProperty("formatVersion", "hybrid-9");
++    assertThatThrownBy(() -> HybridSignerRegistry.fromProperties(p, "test"))
++        .isInstanceOf(IllegalArgumentException.class)
++        .hasMessageContaining("hybrid-1");
++  }
++
++  @Test
++  void unrecognisedEntryRefuses() {
++    final Properties p = sanatos();
++    p.setProperty("1.cheie", "0x1234"); // aproape corect, dar nu e nici addr nici key.
++    assertThatThrownBy(() -> HybridSignerRegistry.fromProperties(p, "test"))
++        .isInstanceOf(IllegalArgumentException.class)
++        .hasMessageContaining("unrecognised");
++  }
++
++  // ------------------------------------------------------------------ the canonical hash
++
++  @Test
++  void hashIsDeterministicAndMovesWithEveryBoundThing() {
++    final Properties p = sanatos();
++    final HybridSignerRegistry a = HybridSignerRegistry.fromProperties(p, "a");
++    final HybridSignerRegistry b = HybridSignerRegistry.fromProperties(p, "b");
++    assertThat(a.canonicalHash()).isEqualTo(b.canonicalHash()); // determinist
++
++    // schimb O cheie: hash-ul se misca
++    final Properties altKey = sanatos();
++    altKey.setProperty(
++        "2.key." + SLHDSA,
++        Bytes.wrap(SealSchemes.SLH_DSA_128S.generate(random).publicRegistryForm()).toHexString());
++    assertThat(HybridSignerRegistry.fromProperties(altKey, "c").canonicalHash())
++        .isNotEqualTo(a.canonicalHash());
++
++    // scot o schema de la un validator: hash-ul se misca
++    final Properties altScheme = sanatos();
++    altScheme.remove("2.key." + SLHDSA);
++    assertThat(HybridSignerRegistry.fromProperties(altScheme, "d").canonicalHash())
++        .isNotEqualTo(a.canonicalHash());
++
++    // alt chainId: hash-ul se misca
++    final Properties altChain = sanatos();
++    altChain.setProperty("chainId", "2801");
++    assertThat(HybridSignerRegistry.fromProperties(altChain, "e").canonicalHash())
++        .isNotEqualTo(a.canonicalHash());
++  }
++
++  @Test
++  void hashDomainCanNeverCollideWithTheFalconOnlyRegistryFamily() {
++    // the domain is part of the preimage; if someone aligned it with the old family, a hybrid
++    // registry could pass itself off as the genesis-bound v1 registry. The constant is
++    // verified here so it cannot drift silently.
++    assertThat(HybridSignerRegistry.HASH_DOMAIN).isEqualTo("AERE-PQ-HYBRID-REGISTRY-1");
++    assertThat(HybridSignerRegistry.HASH_DOMAIN).isNotEqualTo(PqRegistryHash.DOMAIN_V1);
++    assertThat(HybridSignerRegistry.HASH_DOMAIN).isNotEqualTo(PqRegistryHash.DOMAIN_V2);
++  }
++
++  // --------------------------------------------- the registry + the v2 certificate, together
++
++  @Test
++  void endToEndCertificateVerifiesAgainstRegistryKeysPerScheme() {
++    final byte[] message = "commit hash stand-in, 32 bytes!!".getBytes(java.nio.charset.StandardCharsets.UTF_8);
++    // build the registry and KEEP the private test handles so I can sign
++    final Properties p = new Properties();
++    p.setProperty("formatVersion", "hybrid-1");
++    p.setProperty("chainId", "2800");
++    p.setProperty("count", "2");
++    final SealScheme.GeneratedPair f0 = SealSchemes.FALCON_512.generate(random);
++    final SealScheme.GeneratedPair s0 = SealSchemes.SLH_DSA_128S.generate(random);
++    final SealScheme.GeneratedPair f1 = SealSchemes.FALCON_512.generate(random);
++    p.setProperty("0.addr", "0x" + "aa".repeat(20));
++    p.setProperty("1.addr", "0x" + "bb".repeat(20));
++    p.setProperty("0.key." + FALCON, Bytes.wrap(f0.publicRegistryForm()).toHexString());
++    p.setProperty("0.key." + SLHDSA, Bytes.wrap(s0.publicRegistryForm()).toHexString());
++    p.setProperty("1.key." + FALCON, Bytes.wrap(f1.publicRegistryForm()).toHexString());
++    final HybridSignerRegistry reg = HybridSignerRegistry.fromProperties(p, "test");
++
++    // certificatul hibrid: validatorul 0 cu amandoua schemele, 1 doar Falcon
++    final java.util.List cert =
++        java.util.List.of(
++            new SchemeSeal((byte) 0x01, 0, Bytes.wrap(
++                SealSchemes.FALCON_512.sign(f0.privateKey(), message).orElseThrow())),
++            new SchemeSeal((byte) 0x02, 0, Bytes.wrap(
++                SealSchemes.SLH_DSA_128S.sign(s0.privateKey(), message).orElseThrow())),
++            new SchemeSeal((byte) 0x01, 1, Bytes.wrap(
++                SealSchemes.FALCON_512.sign(f1.privateKey(), message).orElseThrow())));
++
++    // round-trip through the v2 format, then EACH seal against ITS OWN key from the registry
++    for (final SchemeSeal seal : PqAnchorV2.decode(PqAnchorV2.encode(cert))) {
++      final SealScheme scheme = SealSchemes.byWireId(seal.getSchemeWireId()).orElseThrow();
++      final byte[] key = reg.publicKey(seal.getValidatorIndex(), scheme.id()).orElseThrow();
++      assertThat(scheme.verifyRaw(key, message, seal.getSignature().toArray()))
++          .as("sigiliul %s contra cheii lui din registru", seal)
++          .isTrue();
++    }
++    // the per-scheme threshold, on the same certificate: 2 Falcon validators, 1 SLH-DSA
++    assertThat(PqAnchorV2.distinctValidatorsWith(cert, (byte) 0x01)).isEqualTo(2);
++    assertThat(PqAnchorV2.distinctValidatorsWith(cert, (byte) 0x02)).isEqualTo(1);
++  }
++}
 diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorConfigTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorConfigTest.java
 new file mode 100755
-index 000000000..0536d2ecb
+index 000000000..6f31c94f9
 --- /dev/null
 +++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorConfigTest.java
-@@ -0,0 +1,691 @@
+@@ -0,0 +1,754 @@
 +/*
-+ * Copyright contributors to Besu / Aere Network.
++ * Copyright contributors to Besu / AERE Network.
 + *
 + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
 + * the License. You may obtain a copy of the License at
@@ -12939,9 +19882,8 @@ index 000000000..0536d2ecb
 +
 +  @Test
 +  public void emergencyCeilingLowersTheThresholdAndCanNeverRaiseIt() {
-+    // THE EMERGENCY CEILING, the only de-arm that works when the chain is ALREADY STOPPED: a halted
-+    // chain cannot deliver a height-scheduled configuration change, so the control has to be local
-+    // to the node.
++    // D1, the only de-arm that works when the chain is ALREADY STOPPED: a halted chain cannot
++    // deliver a height-scheduled configuration change, so the control has to be local to the node.
 +    final PqAnchorConfig lowered =
 +        new PqAnchorConfig(2800L, 1000L, schedule(), OptionalInt.of(1), false);
 +    assertThat(lowered.minSealsAt(4000L)).isEqualTo(1);
@@ -13029,7 +19971,9 @@ index 000000000..0536d2ecb
 +    // set, with no anchor height, is no longer "a node with no anchor configuration"; it becomes
 +    // one with an incomplete configuration, and it refuses to start. A cap or an interval with no
 +    // anchor means nothing, and it is better for it to shout than to keep quiet.
-+    assertThat(reader.accesses).hasSize(14);
++    // 16 since 2026-09-03: the v2 activation height (property + environment) joined the names
++    // 18 since 2026-09-04: the interval SCHEDULE (D-336, disk) joined them, between the interval and the v2 height
++    assertThat(reader.accesses).hasSize(18);
 +    assertThat(reader.accesses)
 +        .containsExactly(
 +            "property:" + PqAnchorConfig.PROPERTY_ANCHOR_BLOCK,
@@ -13046,6 +19990,12 @@ index 000000000..0536d2ecb
 +            "environment:" + PqAnchorConfig.ENV_MAX_SEALS,
 +            "property:" + PqAnchorConfig.PROPERTY_ANCHOR_INTERVAL,
 +            "environment:" + PqAnchorConfig.ENV_ANCHOR_INTERVAL,
++            "property:" + PqAnchorConfig.PROPERTY_ANCHOR_INTERVAL_SCHEDULE,
++            "environment:" + PqAnchorConfig.ENV_ANCHOR_INTERVAL_SCHEDULE,
++            // added 2026-09-03 with the scheme-tagged (v2) certificate: its activation height sits
++            // between the interval and the disarm, as in ANCHOR_NAMES
++            "property:" + PqAnchorConfig.PROPERTY_ANCHOR_V2_BLOCK,
++            "environment:" + PqAnchorConfig.ENV_ANCHOR_V2_BLOCK,
 +            "property:" + PqAnchorConfig.PROPERTY_DISABLE,
 +            "environment:" + PqAnchorConfig.ENV_DISABLE);
 +  }
@@ -13441,7 +20391,13 @@ index 000000000..0536d2ecb
 +   * POSITIVE CONTROL for the refusal message itself. The message is the whole product here: an
 +   * operator at three in the morning gets one screen, and it has to name the field, the value read,
 +   * the problem, the repair, and the sequencing rule that keeps a fleet restart from killing the
-+   * chain at quorum 5 of 7.
++   * chain.
++   *
++   * 
      The sequencing rule is asserted as a RULE, not as a count. Until 2026-08-29 this test pinned
++   * the literal phrase "At quorum 5 of 7 you lose the chain", which had been false since the set
++   * grew to nine on 2026-08-12: the message, and this test with it, carried the fleet of a world
++   * three weeks gone. A message that names today's set size is wrong on the day it changes, and the
++   * test that pins it makes the wrongness load-bearing.
 +   */
 +  @Test
 +  public void theRefusalMessageCarriesEverythingAnOperatorNeedsAtThreeInTheMorning() {
@@ -13460,7 +20416,8 @@ index 000000000..0536d2ecb
 +        .hasMessageContaining("a step exactly at " + H)
 +        .hasMessageContaining("FIX       correct BESU_OPTS on THIS node")
 +        .hasMessageContaining("restart one at a time")
-+        .hasMessageContaining("At quorum 5 of 7 you lose the chain")
++        .hasMessageContaining("never in parallel")
++        .hasMessageContaining("more than f")
 +        .hasMessageContaining("EMERGENCY " + PqAnchorConfig.PROPERTY_DISABLE + "=true");
 +  }
 +
@@ -13472,15 +20429,64 @@ index 000000000..0536d2ecb
 +    assertThatThrownBy(PqAnchorConfig::fromSystemConfiguration)
 +        .hasMessageContaining("SOURCE    environment variable " + PqAnchorConfig.ENV_ANCHOR_BLOCK);
 +  }
++  // ---- D-336: the interval schedule -------------------------------------------------------------
++
++  private static PqAnchorConfig every32() {
++    return new PqAnchorConfig(2800L, 1000L, schedule(), OptionalInt.empty(), false)
++        .withAnchorInterval(OptionalInt.of(32));
++  }
++
++  @Test
++  public void aScheduledIntervalKeepsTheOldGridBelowTheHeightAndThinsItAbove() {
++    // 1384 = 1000 + 3 * 128: on the new grid AND an old-grid anchor (384 % 32 == 0)
++    final PqAnchorConfig c = every32().withAnchorIntervalSchedule(java.util.Map.of(1384L, 128));
++    assertThat(c.intervalAt(1383L)).isEqualTo(32);
++    assertThat(c.intervalAt(1384L)).isEqualTo(128);
++    assertThat(c.isAnchorHeight(1032L)).isTrue();
++    assertThat(c.isAnchorHeight(1048L)).isFalse();
++    assertThat(c.isAnchorHeight(1352L)).isTrue(); // last old-grid anchor before the change
++    assertThat(c.isAnchorHeight(1384L)).isTrue(); // the activation height is itself an anchor
++    assertThat(c.isAnchorHeight(1416L)).isFalse(); // 1384 + 32: no longer an anchor
++    assertThat(c.isAnchorHeight(1512L)).isTrue(); // 1384 + 128
++    // every anchor of the new regime was an anchor of the old one
++    for (long h = 1384L; h < 1384L + 128L * 20; h++) {
++      if (c.isAnchorHeight(h)) {
++        assertThat(every32().isAnchorHeight(h)).isTrue();
++      }
++    }
++  }
++
++  @Test
++  public void aScheduleHeightOffTheNewGridIsRefused() {
++    assertThatThrownBy(() -> every32().withAnchorIntervalSchedule(java.util.Map.of(1400L, 128)))
++        .isInstanceOf(IllegalArgumentException.class)
++        .hasMessageContaining("not on the new grid");
++  }
++
++  @Test
++  public void anIntervalThatIsNotAMultipleOfTheBaseIsRefused() {
++    assertThatThrownBy(() -> every32().withAnchorIntervalSchedule(java.util.Map.of(1400L, 100)))
++        .isInstanceOf(IllegalArgumentException.class)
++        .hasMessageContaining("not a positive multiple");
++  }
++
++  @Test
++  public void aScheduleWithoutABaseIntervalIsRefused() {
++    final PqAnchorConfig everyBlock = new PqAnchorConfig(2800L, 1000L, schedule(), OptionalInt.empty(), false);
++    assertThatThrownBy(() -> everyBlock.withAnchorIntervalSchedule(java.util.Map.of(1384L, 128)))
++        .isInstanceOf(IllegalArgumentException.class)
++        .hasMessageContaining("cannot create one");
++  }
++
 +}
 diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorEmergencyConfigTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorEmergencyConfigTest.java
 new file mode 100755
-index 000000000..222f45b7d
+index 000000000..67fb25b76
 --- /dev/null
 +++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorEmergencyConfigTest.java
 @@ -0,0 +1,120 @@
 +/*
-+ * Copyright contributors to Besu / Aere Network.
++ * Copyright contributors to Besu / AERE Network.
 + *
 + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
 + * the License. You may obtain a copy of the License at
@@ -13601,18 +20607,16 @@ index 000000000..222f45b7d
 +}
 diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorIntervalTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorIntervalTest.java
 new file mode 100755
-index 000000000..08afdba0a
+index 000000000..d1cd9fdbb
 --- /dev/null
 +++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorIntervalTest.java
-@@ -0,0 +1,186 @@
+@@ -0,0 +1,184 @@
 +/*
 + * AERE, 2026-08-07. The anchor interval: a certificate on every Nth block instead of every block.
 + *
 + * WHY THIS EXISTS. At ~523 ms per block we produce 165,248 blocks per day, 23 times more than
-+ * Ethereum. A certificate in EVERY block multiplies the header by almost five even with the cap at
-+ * K=3, and on a chain with empty blocks the headers are close to everything that gets written to
-+ * disk. So that multiplier is the multiplier of database growth, and the design does not fit on a
-+ * reasonably provisioned node. The interval divides it by N.
++ * Ethereum. A certificate in EVERY block costs 120.5 GB per year per node even with the cap at K=3.
++ * The fleet's disks are 38 and 75 GB, so the design does not fit anywhere.
 + *
 + * WHY IT IS SAFE, and this is the argument that has to hold, not the saving. Block hashes chain:
 + * block N+1 commits to the hash of N. So an anchor at height A, whose vanityData binds a Falcon
@@ -13739,10 +20743,10 @@ index 000000000..08afdba0a
 +  // ---------------------------------------------------------------------------------------------
 +  @Test
 +  void aNodeWithNoAnchorAtAllHasNoAnchorHeights() {
-+    final PqAnchorConfig niciodata = PqAnchorConfig.never(2800L).withAnchorInterval(OptionalInt.of(100));
++    final PqAnchorConfig never = PqAnchorConfig.never(2800L).withAnchorInterval(OptionalInt.of(100));
 +    for (final long n : new long[] {0L, 1L, H, H + 100, Long.MAX_VALUE - 1}) {
-+      assertThat(niciodata.isAnchorHeight(n)).as("height %d", n).isFalse();
-+      assertThat(niciodata.anchorAppliesAt(n)).as("height %d", n).isFalse();
++      assertThat(never.isAnchorHeight(n)).as("height %d", n).isFalse();
++      assertThat(never.anchorAppliesAt(n)).as("height %d", n).isFalse();
 +    }
 +  }
 +
@@ -14048,23 +21052,22 @@ index 000000000..038d86287
 +}
 diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorMinSealsFloorTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorMinSealsFloorTest.java
 new file mode 100755
-index 000000000..53917eecb
+index 000000000..651c63ba3
 --- /dev/null
 +++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorMinSealsFloorTest.java
-@@ -0,0 +1,153 @@
+@@ -0,0 +1,152 @@
 +/*
-+ * AERE, 2026-08-07. THE THRESHOLD FLOOR: a schedule whose effective K is zero everywhere leaves the
-+ * anchor armed and completely toothless, forever, and every tool reports GREEN the whole time it is
-+ * happening, because they all measure what was ASKED FOR and the request is valid.
++ * AERE D-147, 2026-08-07. THE THRESHOLD FLOOR: a schedule whose effective K is zero everywhere
++ * leaves the anchor armed and completely toothless, forever, and every tool reports GREEN the whole
++ * time it is happening, because they all measure what was ASKED FOR and the request is valid.
 + *
 + * The loader already guarded this consequence in its own words, "K would be 0 at every height
 + * and an ARMED node would accept empty certificates", but only for a MISSING schedule. A schedule
 + * that is PRESENT and of the form ":0" reaches the same state, and it used to pass.
 + *
-+ * And it is not theoretical: the recommended activation schedule has the form ":0,:3",
-+ * that is, it STARTS at zero, precisely in order to leave a warm-up window. If the second half is
-+ * lost to a stray quote or a truncated variable, what remains is exactly the dangerous form, and
-+ * that is why the floor looks at the WHOLE schedule.
++ * And it is not theoretical: PLAN-ACTIVARE recommends ":0,:3", which STARTS at zero.
++ * If the second half is lost to a stray quote or a truncated variable, what remains is exactly the
++ * dangerous form.
 + */
 +package org.hyperledger.besu.consensus.common.bft;
 +
@@ -14205,21 +21208,130 @@ index 000000000..53917eecb
 +    assertThat(PqAnchorConfig.fromSystemConfiguration().everActive()).isFalse();
 +  }
 +}
+diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorProducerCacheHygieneTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorProducerCacheHygieneTest.java
+new file mode 100755
+index 000000000..7230f1eff
+--- /dev/null
++++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorProducerCacheHygieneTest.java
+@@ -0,0 +1,104 @@
++/*
++ * Copyright contributors to Aere Network.
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
++ * in compliance with the License. You may obtain a copy of the License at
++ *
++ * http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software distributed under the License
++ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
++ * or implied. See the License for the specific language governing permissions and limitations under
++ * the License.
++ *
++ * SPDX-License-Identifier: Apache-2.0
++ */
++package org.hyperledger.besu.consensus.common.bft;
++
++import static org.assertj.core.api.Assertions.assertThat;
++
++import org.hyperledger.besu.consensus.common.bft.blockcreation.PqAnchorProducer;
++
++import java.lang.reflect.Field;
++import java.nio.file.Path;
++
++import org.junit.jupiter.api.AfterEach;
++import org.junit.jupiter.api.BeforeEach;
++import org.junit.jupiter.api.Test;
++import org.junit.jupiter.api.io.TempDir;
++
++/**
++ * DATED 2026-08-20. The reproduction that keeps the per-JVM anchor-config cache honest.
++ *
++ * 
      THE LEAK, paid for twice. {@code PqAnchorProducer.config()} memoizes the first configuration
++ * it builds, and that memo outlives every {@code System.clearProperty} a test class runs in its
++ * teardown. A class that arms the anchor through system properties and then builds {@code
++ * FalconSealSupport} caches an ARMED config for whichever class runs next in the same JVM. Measured
++ * 2026-08-11: {@code PqForkThresholdReachabilityTest} left exactly this behind and four
++ * PqStartupHistoryTest tests failed on a guard firing correctly; that class got the cleanup line.
++ * Measured 2026-08-20 on the production tree: its fork, {@code D078ThresholdReachabilityTest},
++ * never received the same line, and all five {@code PqFleetRestartArmingTest} fixtures turned into
++ * AERE-PQC-REG-ARM-02 refusals -- green alone, red in the full suite, identical sources.
++ *
++ * 
      WHY THIS TEST IS SHAPED LIKE THIS. Class-order contamination is nondeterministic under
++ * gradle's fork assignment, so the reproduction does not rely on ordering at all: it runs the
++ * guilty class's OWN lifecycle (setUp, the arming test, tearDown) inside one test method, and then
++ * asserts the JVM is clean. If the cleanup line is ever removed from that teardown again, this
++ * test goes red deterministically -- that removal is exactly the planted failure it was proven
++ * against on the day it was written.
++ *
++ * 
      DATED 2026-08-31: the fork pair was consolidated -- the twin classes were one copy too many,
++ * and the divergence above is precisely what duplication costs. The reproduction now runs the
++ * lifecycle of the surviving class, {@code PqForkThresholdReachabilityTest}, which has carried the
++ * cleanup line since 2026-08-11; the assertion is unchanged.
++ */
++public class PqAnchorProducerCacheHygieneTest {
++
++  @TempDir private Path tmp;
++
++  @BeforeEach
++  public void curatInainte() throws Exception {
++    curata();
++  }
++
++  @AfterEach
++  public void curatDupa() throws Exception {
++    curata();
++  }
++
++  private static void curata() throws Exception {
++    for (final String p : System.getProperties().stringPropertyNames()) {
++      if (p.startsWith("aere.")) {
++        System.clearProperty(p);
++      }
++    }
++    PqAnchorProducer.useConfigForTesting(null);
++    final Field f = FalconSealSupport.class.getDeclaredField("instance");
++    f.setAccessible(true);
++    f.set(null, null);
++  }
++
++  @Test
++  public void theReachabilitySequenceLeavesNoArmedAnchorBehind() throws Exception {
++    final PqForkThresholdReachabilityTest vinovat = new PqForkThresholdReachabilityTest();
++    final Field tmpField = PqForkThresholdReachabilityTest.class.getDeclaredField("tmp");
++    tmpField.setAccessible(true);
++    tmpField.set(vinovat, tmp);
++
++    vinovat.setUp();
++    try {
++      // The exact sequence that poisons: anchor armed from properties, FalconSealSupport built.
++      vinovat.aReachableThresholdMustStillStart();
++    } finally {
++      // The guilty class's OWN teardown. The assertion below is about what IT leaves behind.
++      vinovat.tearDown();
++    }
++
++    assertThat(PqAnchorProducer.config().everActive())
++        .describedAs(
++            "after PqForkThresholdReachabilityTest's own teardown, a config built in this JVM must "
++                + "not claim an armed anchor; if it does, the per-JVM cache survived the cleanup "
++                + "and every proof-less fixture in the next class dies with AERE-PQC-REG-ARM-02")
++        .isFalse();
++  }
++}
 diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorProducerCostTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorProducerCostTest.java
 new file mode 100755
-index 000000000..252fd3463
+index 000000000..d33767483
 --- /dev/null
 +++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorProducerCostTest.java
-@@ -0,0 +1,251 @@
+@@ -0,0 +1,250 @@
 +/*
 + * AERE, 2026-08-07. THE TWO COST CONTROLS, measured on the PRODUCER, not on the configuration.
 + *
 + * WHY THIS EXISTS. On 7 August `aere.pq.anchor.maxSeals` and `aere.pq.anchorInterval` were built,
 + * and their configuration guards were proven the same day. But the cut in the producer, the code
 + * that ACTUALLY stops seals being written past the cap, and that ACTUALLY skips the heights with no
-+ * anchor, stayed an ASSERTION: there was no producer harness in the tree, and we had just seen, at
-+ * the wiring of the rules into the validation chain, what a piece of code that no proof touches
-+ * costs.
++ * anchor, stayed an ASSERTION: there was no producer harness in the tree, and D-148 had just shown
++ * what a piece of code that no proof touches costs.
 + *
 + * This class touches it. It counts the seals written, it does not assume them.
 + *
@@ -14464,7 +21576,7 @@ index 000000000..252fd3463
 +}
 diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorSealCapTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorSealCapTest.java
 new file mode 100755
-index 000000000..5c61464f9
+index 000000000..c9bfd2ef1
 --- /dev/null
 +++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorSealCapTest.java
 @@ -0,0 +1,150 @@
@@ -14473,9 +21585,9 @@ index 000000000..5c61464f9
 + *
 + * WHY IT EXISTS. K is a FLOOR, not a cap. Measured on a live ten-node run with the threshold at 4:
 + * 42 blocks carried 4 seals, 36 carried 5, 5 carried 6. The proposer writes every seal it heard and
-+ * that is eligible, not as many as the threshold demands. At 666 bytes a seal, that means about two
-+ * thirds more header written than the threshold asks for, and the surplus buys nothing: what a
-+ * verifier demands is THE THRESHOLD.
++ * that is eligible, not as many as the threshold demands. At 666 bytes a seal, that means 200.9 GB
++ * per node per year instead of 120.5, and the surplus buys nothing: what a verifier demands is THE
++ * THRESHOLD.
 + *
 + * WHAT THIS FILE GUARDS, and this is the dangerous part: a cap set BELOW the highest K in the
 + * schedule makes the proposer write certificates its own fleet rejects, at every height from the
@@ -14620,12 +21732,12 @@ index 000000000..5c61464f9
 +}
 diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorTest.java
 new file mode 100755
-index 000000000..0e65d7fa4
+index 000000000..5bea4d37e
 --- /dev/null
 +++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorTest.java
 @@ -0,0 +1,301 @@
 +/*
-+ * Copyright contributors to Besu / Aere Network.
++ * Copyright contributors to Besu / AERE Network.
 + *
 + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
 + * the License. You may obtain a copy of the License at
@@ -14927,12 +22039,12 @@ index 000000000..0e65d7fa4
 +}
 diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorThresholdGuardTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorThresholdGuardTest.java
 new file mode 100755
-index 000000000..9c7be4419
+index 000000000..ebf79756c
 --- /dev/null
 +++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorThresholdGuardTest.java
-@@ -0,0 +1,215 @@
+@@ -0,0 +1,232 @@
 +/*
-+ * Copyright contributors to Besu / Aere Network.
++ * Copyright contributors to Besu / AERE Network.
 + *
 + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
 + * the License. You may obtain a copy of the License at
@@ -14960,9 +22072,10 @@ index 000000000..9c7be4419
 + * AERE GARDA-PRAG: the PLANTED FAILURE for the seal-threshold guard.
 + *
 + * 
      Each refusal test builds, by hand, the exact configuration that stops the chain, and asserts
-+ * that the guard sees it. The bound asserted is {@code K <= quorum(N) - 1}, which is 4 at N=7 and 2
-+ * at N=4, and {@link #growingTheValidatorSetDoesNotBuyQuorumMargin()} is the test that would go green
-+ * under the WRONG bound {@code K > N - f} and red under the right one.
++ * that the guard sees it. REVISED 2026-08-20: the bound asserted is {@code K <= N - f} (availability
++ * under the fault budget), which is 5 at N=7 and 3 at N=4. Until D-227 the bound was
++ * {@code quorum - 1}, and {@link #atNineValidatorsTheQuorumIsReachableAndAboveNMinusFIsNot()}
++ * carries the dated history of that reversal, with the measurement that forced it.
 + *
 + * 
      The negative control for this file does not live in it: it is a second build of the same tree in
 + * which the guard body is replaced by a stub that accepts everything. Every refusal assertion below
@@ -14982,27 +22095,30 @@ index 000000000..9c7be4419
 +
 +  @Test
 +  void theArithmeticIsTheOneTheChainActuallyUses() {
-+    // The bound is not a constant typed into this test: it is Besu's own quorum formula, minus one.
++    // REVISED 2026-08-20 with the D-227 doctrine: the bound is N - f (availability under the fault
++    // budget), no longer quorum - 1 (the pre-salvage gathering ceiling). Still not a constant typed
++    // here: quorum comes from Besu's own formula, f from the guard's own budget.
 +    assertThat(BftHelpers.calculateRequiredValidatorQuorum(N_LIVE)).isEqualTo(5);
-+    assertThat(PqAnchorThresholdGuard.maxConfigurableThreshold(N_LIVE)).isEqualTo(4);
++    assertThat(PqAnchorThresholdGuard.maxConfigurableThreshold(N_LIVE)).isEqualTo(5);
 +    assertThat(PqAnchorThresholdGuard.byzantineBudget(N_LIVE)).isEqualTo(2);
 +
 +    assertThat(BftHelpers.calculateRequiredValidatorQuorum(4)).isEqualTo(3);
-+    assertThat(PqAnchorThresholdGuard.maxConfigurableThreshold(4)).isEqualTo(2);
++    assertThat(PqAnchorThresholdGuard.maxConfigurableThreshold(4)).isEqualTo(3);
 +  }
 +
 +  @Test
-+  void plantedFailureAThresholdEqualToTheQuorumIsRefused() {
++  void plantedFailureAThresholdAboveNMinusFIsRefused() {
++    // At N=7, N - f = 5, so 6 is the first fatal rung: with f=2 validators down only 5 seals exist.
 +    assertThatThrownBy(
 +            () ->
 +                PqAnchorThresholdGuard.verifyThresholdAgainstQuorumOrAbort(
-+                    armed(Map.of(H, 0, H + 7_200L, 1, H + 21_600L, 5), OptionalInt.empty()),
++                    armed(Map.of(H, 0, H + 7_200L, 1, H + 21_600L, 6), OptionalInt.empty()),
 +                    N_LIVE))
 +        .isInstanceOf(FalconSealSupport.ActivationConfigException.class)
 +        .hasMessageContaining(PqAnchorThresholdGuard.CODE)
 +        .hasMessageContaining("REFUSING TO START")
-+        .hasMessageContaining("reaches 5 at height " + (H + 21_600L))
-+        .hasMessageContaining("may be configured at this set size is 4");
++        .hasMessageContaining("reaches 6 at height " + (H + 21_600L))
++        .hasMessageContaining("may be configured at this set size is 5");
 +  }
 +
 +  @Test
@@ -15017,14 +22133,14 @@ index 000000000..9c7be4419
 +
 +  @Test
 +  void plantedFailureTheVeryFirstStepMayAlsoBeFatal() {
-+    // A schedule that opens AT the quorum. The producer's existing log-only warning covers K>0 at H
++    // A schedule that opens ABOVE N - f. The producer's existing log-only warning covers K>0 at H
 +    // for a different reason; this asserts the refusal fires on the same step.
 +    assertThatThrownBy(
 +            () ->
 +                PqAnchorThresholdGuard.verifyThresholdAgainstQuorumOrAbort(
-+                    armed(Map.of(H, 5), OptionalInt.empty()), N_LIVE))
++                    armed(Map.of(H, 6), OptionalInt.empty()), N_LIVE))
 +        .isInstanceOf(FalconSealSupport.ActivationConfigException.class)
-+        .hasMessageContaining("reaches 5 at height " + H);
++        .hasMessageContaining("reaches 6 at height " + H);
 +  }
 +
 +  @Test
@@ -15032,7 +22148,7 @@ index 000000000..9c7be4419
 +    assertThatCode(
 +            () ->
 +                PqAnchorThresholdGuard.verifyThresholdAgainstQuorumOrAbort(
-+                    armed(Map.of(H, 0, H + 7_200L, 1, H + 21_600L, 4), OptionalInt.empty()),
++                    armed(Map.of(H, 0, H + 7_200L, 1, H + 21_600L, 5), OptionalInt.empty()),
 +                    N_LIVE))
 +        .doesNotThrowAnyException();
 +  }
@@ -15048,23 +22164,33 @@ index 000000000..9c7be4419
 +  }
 +
 +  @Test
-+  void growingTheValidatorSetDoesNotBuyQuorumMargin() {
-+    // THIS is the test that separates the right bound from the wrong one. At N=9 the quorum is 6
-+    // while N-f is 7, so the rule "refuse when K > N - f" would ACCEPT K=7, which is a rung no
-+    // proposer can ever reach. Both 6 and 7 must be refused.
++  void atNineValidatorsTheQuorumIsReachableAndAboveNMinusFIsNot() {
++    // HISTORY, kept on purpose: until 2026-08-20 this test was named
++    // growingTheValidatorSetDoesNotBuyQuorumMargin and asserted that K=6 and K=7 are both refused
++    // at N=9, because pre-D-227 a proposer could gather at most quorum seals. D-227's late-seal
++    // salvage changed the physics (mainnet measurement: 8-9 seals per certificate across 5,400
++    // anchors), so growing the set NOW buys reachable rungs. The fatal bound is availability under
++    // the fault budget: N - f = 7 at N=9. 6 and 7 start (loudly); 8 is refused.
 +    assertThat(BftHelpers.calculateRequiredValidatorQuorum(9)).isEqualTo(6);
 +    assertThat(9 - PqAnchorThresholdGuard.byzantineBudget(9)).isEqualTo(7);
++    assertThat(PqAnchorThresholdGuard.maxConfigurableThreshold(9)).isEqualTo(7);
 +
-+    assertThatThrownBy(
++    assertThatCode(
 +            () ->
 +                PqAnchorThresholdGuard.verifyThresholdAgainstQuorumOrAbort(
 +                    armed(Map.of(H, 0, H + 100L, 6), OptionalInt.empty()), 9))
-+        .isInstanceOf(FalconSealSupport.ActivationConfigException.class);
++        .doesNotThrowAnyException();
++
++    assertThatCode(
++            () ->
++                PqAnchorThresholdGuard.verifyThresholdAgainstQuorumOrAbort(
++                    armed(Map.of(H, 0, H + 100L, 7), OptionalInt.empty()), 9))
++        .doesNotThrowAnyException();
 +
 +    assertThatThrownBy(
 +            () ->
 +                PqAnchorThresholdGuard.verifyThresholdAgainstQuorumOrAbort(
-+                    armed(Map.of(H, 0, H + 100L, 7), OptionalInt.empty()), 9))
++                    armed(Map.of(H, 0, H + 100L, 8), OptionalInt.empty()), 9))
 +        .isInstanceOf(FalconSealSupport.ActivationConfigException.class);
 +
 +    assertThatCode(
@@ -15075,18 +22201,20 @@ index 000000000..9c7be4419
 +  }
 +
 +  @Test
-+  void theBoundAtFourValidatorsIsTwo() {
++  void theBoundAtFourValidatorsIsThree() {
++    // N=4: f=1, N-f=3. K=3 (the full quorum) starts; K=4 demands a seal from every validator
++    // including the one the fault budget says may be down, and is refused.
 +    assertThatThrownBy(
 +            () ->
 +                PqAnchorThresholdGuard.verifyThresholdAgainstQuorumOrAbort(
-+                    armed(Map.of(H, 0, H + 30L, 3), OptionalInt.empty()), 4))
++                    armed(Map.of(H, 0, H + 30L, 4), OptionalInt.empty()), 4))
 +        .isInstanceOf(FalconSealSupport.ActivationConfigException.class)
 +        .hasMessageContaining("quorum for the 4 validators");
 +
 +    assertThatCode(
 +            () ->
 +                PqAnchorThresholdGuard.verifyThresholdAgainstQuorumOrAbort(
-+                    armed(Map.of(H, 0, H + 30L, 2), OptionalInt.empty()), 4))
++                    armed(Map.of(H, 0, H + 30L, 3), OptionalInt.empty()), 4))
 +        .doesNotThrowAnyException();
 +  }
 +
@@ -15096,17 +22224,18 @@ index 000000000..9c7be4419
 +    assertThatCode(
 +            () ->
 +                PqAnchorThresholdGuard.verifyThresholdAgainstQuorumOrAbort(
-+                    armed(Map.of(H, 0, H + 21_600L, 5), OptionalInt.of(1)), N_LIVE))
++                    armed(Map.of(H, 0, H + 21_600L, 6), OptionalInt.of(1)), N_LIVE))
 +        .doesNotThrowAnyException();
 +  }
 +
 +  @Test
 +  void aCeilingAboveTheScheduleRescuesNothing() {
-+    // The ceiling can only ever lower. A ceiling of 9 over a fatal 5 leaves the 5 in force.
++    // The ceiling can only ever lower. A ceiling of 9 over a fatal 6 leaves the 6 in force.
++    // (5 stopped being fatal at N=7 with the 2026-08-20 doctrine: N - f = 5 is now the bound.)
 +    assertThatThrownBy(
 +            () ->
 +                PqAnchorThresholdGuard.verifyThresholdAgainstQuorumOrAbort(
-+                    armed(Map.of(H, 0, H + 21_600L, 5), OptionalInt.of(9)), N_LIVE))
++                    armed(Map.of(H, 0, H + 21_600L, 6), OptionalInt.of(9)), N_LIVE))
 +        .isInstanceOf(FalconSealSupport.ActivationConfigException.class);
 +  }
 +
@@ -15146,14 +22275,544 @@ index 000000000..9c7be4419
 +        .doesNotThrowAnyException();
 +  }
 +}
+diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorV2ProducerTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorV2ProducerTest.java
+new file mode 100755
+index 000000000..76c274993
+--- /dev/null
++++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorV2ProducerTest.java
+@@ -0,0 +1,326 @@
++/*
++ * Copyright contributors to Aere Network.
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
++ * compliance with the License. You may obtain a copy of the License at
++ *
++ * http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software distributed under the License is
++ * distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
++ * implied. See the License for the specific language governing permissions and limitations under the
++ * License.
++ *
++ * SPDX-License-Identifier: Apache-2.0
++ */
++package org.hyperledger.besu.consensus.common.bft;
++
++import static org.assertj.core.api.Assertions.assertThat;
++import static org.assertj.core.api.Assertions.assertThatThrownBy;
++import static org.mockito.ArgumentMatchers.any;
++import static org.mockito.Mockito.mock;
++import static org.mockito.Mockito.when;
++import static org.mockito.Mockito.withSettings;
++
++import org.hyperledger.besu.consensus.common.bft.blockcreation.PqAnchorProducer;
++import org.hyperledger.besu.consensus.common.validator.ValidatorProvider;
++import org.hyperledger.besu.crypto.SecureRandomProvider;
++import org.hyperledger.besu.datatypes.Address;
++import org.hyperledger.besu.ethereum.ProtocolContext;
++import org.hyperledger.besu.ethereum.core.BlockHeader;
++import org.hyperledger.besu.ethereum.core.BlockHeaderTestFixture;
++
++import java.lang.reflect.Field;
++import java.nio.file.Files;
++import java.nio.file.Path;
++import java.security.SecureRandom;
++import java.util.ArrayList;
++import java.util.Collection;
++import java.util.Collections;
++import java.util.List;
++import java.util.Map;
++import java.util.Optional;
++import java.util.OptionalInt;
++
++import org.apache.tuweni.bytes.Bytes;
++import org.apache.tuweni.bytes.Bytes32;
++import org.bouncycastle.crypto.digests.KeccakDigest;
++import org.bouncycastle.pqc.crypto.falcon.FalconPrivateKeyParameters;
++import org.bouncycastle.pqc.crypto.falcon.FalconSigner;
++import org.junit.jupiter.api.AfterEach;
++import org.junit.jupiter.api.BeforeEach;
++import org.junit.jupiter.api.Test;
++import org.junit.jupiter.api.io.TempDir;
++import org.mockito.quality.Strictness;
++
++/**
++ * AERE ANCHOR V2 (2026-09-03): the PROPOSER writes the SCHEME-TAGGED certificate from the v2 height.
++ *
++ * 
      Same harness as {@link PqAnchorProducerCostTest} (seven Falcon probe keys anchored in a genesis
++ * registry, the seal cache loaded by hand, a mocked validator provider), plus a hybrid registry with
++ * seven SLH-DSA-SHA2-128s probe keys and the scheme schedule, loaded through the REAL system
++ * configuration path so the producer finds them exactly where a node would.
++ *
++ * 
      Proven, each with its pair: at a v2 height the certificate is [Falcon x K + SLH-DSA x K] under the
++ * v2 digest and the v1 list is EMPTY; below the v2 height nothing changes (v1 list, v1 digest); with
++ * no SLH-DSA seal heard the proposer REFUSES rather than writing a certificate short of a scheme; an
++ * SLH-DSA seal from an index without a Falcon seal is not counted; a Falcon-only schedule yields a v2
++ * certificate that is Falcon-only.
++ */
++class PqAnchorV2ProducerTest {
++
++  private static final long CHAIN_ID = 220_879L;
++  private static final long H = 1_000L;
++  private static final long V2 = 1_005L;
++  private static final int N = 7;
++  private static final int K = 3;
++  private static final String SLH = "slh-dsa-sha2-128s";
++
++  @TempDir private Path tmp;
++
++  private final List falconKeys = new ArrayList<>();
++  private final List slhKeys = new ArrayList<>();
++  private final List
       validators = new ArrayList<>();
++  private final SecureRandom random = SecureRandomProvider.createSecureRandom();
++
++  @BeforeEach
++  void setUp() throws Exception {
++    final KeccakDigest kd = new KeccakDigest(256);
++    final StringBuilder manifest = new StringBuilder();
++    manifest
++        .append("{\"config\":{\"aereFalconRegistry\":{")
++        .append(PqV2Fixture.manifestHeader(N, CHAIN_ID, H));
++    for (int i = 0; i < N; i++) {
++      falconKeys.add(PqV2Fixture.privateKey(i));
++      validators.add(PqV2Fixture.address(i));
++      final byte[] row = PqV2Fixture.anchorPreimageRow(i);
++      kd.update(row, 0, row.length);
++      manifest.append(',').append(PqV2Fixture.manifestEntry(i, N, CHAIN_ID, H));
++    }
++    manifest
++        .append("}},\"alloc\":{\"0000000000000000000000000000000000000fa1\":{\"storage\":{\"0x")
++        .append("0".repeat(64))
++        .append("\":\"0x");
++    final byte[] anchoredHash = new byte[32];
++    kd.doFinal(anchoredHash, 0);
++    manifest.append(Bytes.wrap(anchoredHash).toUnprefixedHexString()).append("\"}}}}");
++    final Path genesis = tmp.resolve("genesis-registry.json");
++    Files.writeString(genesis, manifest.toString());
++    System.setProperty("aere.falcon.genesis", genesis.toAbsolutePath().toString());
++    resetFalconSingleton();
++    PqSealCache.instance().clear();
++    armHybrid("0:falcon-512+" + SLH);
++  }
++
++  @AfterEach
++  void tearDown() throws Exception {
++    System.clearProperty("aere.falcon.genesis");
++    System.clearProperty(HybridSealSupport.PROPERTY_SCHEDULE);
++    System.clearProperty(HybridSealSupport.PROPERTY_REGISTRY);
++    HybridSealSupport.resetForTesting();
++    resetFalconSingleton();
++    PqSealCache.instance().clear();
++    PqAnchorProducer.useConfigForTesting(null);
++  }
++
++  /** Writes a hybrid-1 registry with the seven Falcon addresses and seven SLH-DSA keys, and loads it. */
++  private void armHybrid(final String schedule) throws Exception {
++    if (slhKeys.isEmpty()) {
++      for (int i = 0; i < N; i++) {
++        slhKeys.add(SealSchemes.SLH_DSA_128S.generate(random));
++      }
++    }
++    final StringBuilder p = new StringBuilder();
++    p.append("formatVersion=hybrid-1\nchainId=").append(CHAIN_ID).append("\ncount=").append(N).append('\n');
++    for (int i = 0; i < N; i++) {
++      p.append(i).append(".addr=").append(validators.get(i).toHexString()).append('\n');
++      p.append(i).append(".key.").append(SLH).append('=')
++          .append(Bytes.wrap(slhKeys.get(i).publicRegistryForm()).toHexString()).append('\n');
++    }
++    final Path reg = tmp.resolve("hybrid-registry-" + schedule.hashCode() + ".properties");
++    Files.writeString(reg, p.toString());
++    System.setProperty(HybridSealSupport.PROPERTY_SCHEDULE, schedule);
++    System.setProperty(HybridSealSupport.PROPERTY_REGISTRY, reg.toAbsolutePath().toString());
++    HybridSealSupport.resetForTesting();
++    assertThat(HybridSealSupport.instance().registry()).describedAs("hybrid registry loaded").isPresent();
++  }
++
++  // ------------------------------------------------------------------------------------ proofs
++
++  @Test
++  void atTheV2HeightTheProposerWritesASchemeTaggedCertificateUnderTheV2Digest() {
++    PqAnchorProducer.useConfigForTesting(config(V2, OptionalInt.of(K)));
++    final BlockHeader parent = parentOf(V2 + 9L);
++    hearFalcon(parent, N);
++    hearExtras(parent, N);
++    final BftExtraData produced = PqAnchorProducer.apply(base(), parent, contextWith(validators));
++    assertThat(produced.getFalconSeals()).describedAs("the v1 list is EMPTY on a v2 header").isEmpty();
++    final List tagged = produced.getHybridSeals();
++    assertThat(PqAnchorV2.distinctValidatorsWith(tagged, SealSchemes.FALCON_512.wireId()))
++        .describedAs("K Falcon seals, capped exactly as the v1 producer caps them")
++        .isEqualTo(K);
++    assertThat(PqAnchorV2.distinctValidatorsWith(tagged, SealSchemes.SLH_DSA_128S.wireId()))
++        .describedAs("K SLH-DSA seals, each bound to a Falcon-certified index")
++        .isEqualTo(K);
++    for (final SchemeSeal s : tagged) {
++      if (s.getSchemeWireId() == SealSchemes.SLH_DSA_128S.wireId()) {
++        assertThat(tagged.stream().anyMatch(f -> f.getSchemeWireId() == SealSchemes.FALCON_512.wireId()
++                && f.getValidatorIndex() == s.getValidatorIndex()))
++            .describedAs("SLH-DSA seal of index %s rides with a Falcon seal of the same index", s.getValidatorIndex())
++            .isTrue();
++      }
++    }
++    assertThat(produced.getVanityData())
++        .describedAs("vanityData is the v2 digest over exactly the carried certificate")
++        .isEqualTo(PqAnchorV2.anchorDigestV2(CHAIN_ID, parent.getNumber(), parent.getHash().getBytes(), tagged));
++    // and NOT the v1 digest over the Falcon half, which is what a v1 rule would recompute
++    final List falconHalf = new ArrayList<>();
++    for (final SchemeSeal s : tagged) {
++      if (s.getSchemeWireId() == SealSchemes.FALCON_512.wireId()) {
++        falconHalf.add(new FalconSeal(s.getValidatorIndex(), s.getSignature()));
++      }
++    }
++    assertThat(produced.getVanityData())
++        .isNotEqualTo(PqAnchor.anchorDigest(CHAIN_ID, parent.getNumber(), parent.getHash().getBytes(), falconHalf));
++  }
++
++  @Test
++  void belowTheV2HeightNothingChangesEvenWithExtrasHeard() {
++    PqAnchorProducer.useConfigForTesting(config(V2, OptionalInt.of(K)));
++    final BlockHeader parent = parentOf(V2 - 2L); // block V2-1 is an anchor height below V2
++    hearFalcon(parent, N);
++    hearExtras(parent, N);
++    final BftExtraData produced = PqAnchorProducer.apply(base(), parent, contextWith(validators));
++    assertThat(produced.getHybridSeals()).describedAs("no scheme-tagged certificate below V2").isEmpty();
++    assertThat(produced.getFalconSeals()).hasSize(K);
++    assertThat(produced.getVanityData())
++        .isEqualTo(PqAnchor.anchorDigest(CHAIN_ID, parent.getNumber(), parent.getHash().getBytes(),
++            PqAnchor.sortedByIndex(new ArrayList<>(produced.getFalconSeals()))));
++  }
++
++  @Test
++  void withNoSlhDsaSealHeardTheProposerRefusesInsteadOfWritingAShortCertificate() {
++    PqAnchorProducer.useConfigForTesting(config(V2, OptionalInt.of(K)));
++    final BlockHeader parent = parentOf(V2 + 9L);
++    hearFalcon(parent, N);
++    // nothing recorded in the extras slot
++    assertThatThrownBy(() -> PqAnchorProducer.apply(base(), parent, contextWith(validators)))
++        .isInstanceOf(PqAnchorNotReadyException.class)
++        .hasMessageContaining(SLH);
++    // and with only K-1 SLH-DSA seals it still refuses: K per scheme, not "some"
++    hearExtras(parent, K - 1);
++    assertThatThrownBy(() -> PqAnchorProducer.apply(base(), parent, contextWith(validators)))
++        .isInstanceOf(PqAnchorNotReadyException.class)
++        .hasMessageContaining(SLH);
++  }
++
++  @Test
++  void anSlhDsaSealFromAnIndexWithoutAFalconSealIsNotCounted() {
++    PqAnchorProducer.useConfigForTesting(config(V2, OptionalInt.of(K)));
++    final BlockHeader parent = parentOf(V2 + 9L);
++    hearFalcon(parent, K); // Falcon from indices 0..K-1 only
++    // SLH-DSA from indices K..N-1 only: none of them is Falcon-certified
++    final Bytes32 m = PqAnchor.commitMessage(CHAIN_ID, parent.getNumber(), parent.getHash().getBytes());
++    final List extras = new ArrayList<>();
++    for (int i = K; i < N; i++) {
++      extras.add(new SchemeSeal(SealSchemes.SLH_DSA_128S.wireId(), i, Bytes.wrap(slhSign(i, m))));
++    }
++    PqSealCache.instance().recordExtras(parent.getNumber(), parent.getHash(), extras);
++    assertThatThrownBy(() -> PqAnchorProducer.apply(base(), parent, contextWith(validators)))
++        .isInstanceOf(PqAnchorNotReadyException.class)
++        .hasMessageContaining("bound to a Falcon-certified index");
++  }
++
++  @Test
++  void aFalconOnlyScheduleYieldsAFalconOnlyV2Certificate() throws Exception {
++    armHybrid("0:falcon-512");
++    PqAnchorProducer.useConfigForTesting(config(V2, OptionalInt.of(K)));
++    final BlockHeader parent = parentOf(V2 + 9L);
++    hearFalcon(parent, N);
++    hearExtras(parent, N); // heard, but the schedule does not ask for them
++    final BftExtraData produced = PqAnchorProducer.apply(base(), parent, contextWith(validators));
++    assertThat(produced.getHybridSeals()).hasSize(K);
++    assertThat(PqAnchorV2.distinctValidatorsWith(produced.getHybridSeals(), SealSchemes.SLH_DSA_128S.wireId()))
++        .describedAs("a scheme the schedule does not name is never written, heard or not")
++        .isZero();
++  }
++
++  @Test
++  void theSealCacheKeepsExtrasBesideTheFalconSealsUnderTheSameKey() {
++    final BlockHeader parent = parentOf(V2 + 9L);
++    hearFalcon(parent, N);
++    hearExtras(parent, N);
++    assertThat(PqSealCache.instance().sealsFor(parent.getNumber(), parent.getHash())).hasSize(N);
++    final List extras = PqSealCache.instance().extrasFor(parent.getNumber(), parent.getHash());
++    assertThat(extras).hasSize(N);
++    assertThat(extras).isSortedAccordingTo(PqAnchorV2.CANONICAL);
++    // a Falcon-tagged seal offered to the extras slot is dropped: Falcon has its own slot
++    PqSealCache.instance().recordExtras(parent.getNumber(), parent.getHash(),
++        List.of(new SchemeSeal(SealSchemes.FALCON_512.wireId(), 0, Bytes.of(1, 2, 3))));
++    assertThat(PqSealCache.instance().extrasFor(parent.getNumber(), parent.getHash())).hasSize(N);
++    // and a different hash under the same height is a different entry
++    assertThat(PqSealCache.instance().extrasFor(parent.getNumber(), parentOf(V2 + 8L).getHash())).isEmpty();
++  }
++
++  // ------------------------------------------------------------------------------------ helpers
++
++  private static PqAnchorConfig config(final long v2Block, final OptionalInt cap) {
++    return new PqAnchorConfig(
++        CHAIN_ID, H, Map.of(H, K), OptionalInt.empty(), false, cap, OptionalInt.empty(), v2Block);
++  }
++
++  private static BlockHeader parentOf(final long number) {
++    return new BlockHeaderTestFixture().number(number).buildHeader();
++  }
++
++  private BftExtraData base() {
++    return new BftExtraData(
++        Bytes32.ZERO, Collections.emptyList(), Optional.empty(), 0, validators, Collections.emptyList());
++  }
++
++  private void hearFalcon(final BlockHeader parent, final int howMany) {
++    final Bytes32 m = PqAnchor.commitMessage(CHAIN_ID, parent.getNumber(), parent.getHash().getBytes());
++    final List heard = new ArrayList<>();
++    for (int i = 0; i < howMany; i++) {
++      heard.add(new FalconSeal(i, Bytes.wrap(falconSign(falconKeys.get(i), m))));
++    }
++    PqSealCache.instance().record(parent.getNumber(), parent.getHash(), heard);
++  }
++
++  private void hearExtras(final BlockHeader parent, final int howMany) {
++    final Bytes32 m = PqAnchor.commitMessage(CHAIN_ID, parent.getNumber(), parent.getHash().getBytes());
++    final List extras = new ArrayList<>();
++    for (int i = 0; i < howMany; i++) {
++      extras.add(new SchemeSeal(SealSchemes.SLH_DSA_128S.wireId(), i, Bytes.wrap(slhSign(i, m))));
++    }
++    PqSealCache.instance().recordExtras(parent.getNumber(), parent.getHash(), extras);
++  }
++
++  private byte[] slhSign(final int index, final Bytes32 m) {
++    return SealSchemes.SLH_DSA_128S.sign(slhKeys.get(index).privateKey(), m.toArray()).orElseThrow();
++  }
++
++  private static byte[] falconSign(final FalconPrivateKeyParameters key, final Bytes32 m) {
++    final FalconSigner signer = new FalconSigner();
++    signer.init(true, key);
++    return signer.generateSignature(m.toArray());
++  }
++
++  private static ProtocolContext contextWith(final Collection
       vs) {
++    final ValidatorProvider validatorProvider =
++        mock(ValidatorProvider.class, withSettings().strictness(Strictness.LENIENT));
++    when(validatorProvider.getValidatorsForBlock(any())).thenReturn(vs);
++    when(validatorProvider.getValidatorsAfterBlock(any())).thenReturn(vs);
++    final BftContext bftContext =
++        mock(BftContext.class, withSettings().strictness(Strictness.LENIENT));
++    when(bftContext.getValidatorProvider()).thenReturn(validatorProvider);
++    when(bftContext.as(any())).thenReturn(bftContext);
++    return new ProtocolContext.Builder().withConsensusContext(bftContext).build();
++  }
++
++  private static void resetFalconSingleton() throws Exception {
++    final Field f = FalconSealSupport.class.getDeclaredField("instance");
++    f.setAccessible(true);
++    f.set(null, null);
++  }
++}
+diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorV2Test.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorV2Test.java
+new file mode 100755
+index 000000000..63f4f4ff7
+--- /dev/null
++++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorV2Test.java
+@@ -0,0 +1,192 @@
++/* AERE crypto-agility, step 2 proofs. The controls that matter most here are the CROSS-FORMAT
++ * ones: v2 bytes must never parse as a legacy certificate, legacy bytes must be refused BY NAME
++ * by the v2 decoder, and the two digests must never agree. A versioned format whose versions can
++ * be confused is worse than one format. */
++package org.hyperledger.besu.consensus.common.bft;
++
++import static org.assertj.core.api.Assertions.assertThat;
++import static org.assertj.core.api.Assertions.assertThatThrownBy;
++
++import java.nio.charset.StandardCharsets;
++import java.security.SecureRandom;
++import java.util.List;
++
++import org.apache.tuweni.bytes.Bytes;
++import org.apache.tuweni.bytes.Bytes32;
++import org.hyperledger.besu.crypto.SecureRandomProvider;
++import org.hyperledger.besu.ethereum.rlp.BytesValueRLPInput;
++import org.hyperledger.besu.ethereum.rlp.RLPInput;
++import org.junit.jupiter.api.Test;
++
++class PqAnchorV2Test {
++
++  private static final byte FALCON = 0x01;
++  private static final byte SLHDSA = 0x02;
++  private static final Bytes SIG_A = Bytes.fromHexString("0xaaaa");
++  private static final Bytes SIG_B = Bytes.fromHexString("0xbbbb");
++  private static final Bytes32 PARENT_HASH = Bytes32.leftPad(Bytes.of(7));
++
++  private final SecureRandom random = SecureRandomProvider.createSecureRandom();
++
++  private static List hybrid() {
++    // validator 0 seals with BOTH schemes (the hybrid), validator 2 with Falcon only
++    return List.of(
++        new SchemeSeal(FALCON, 0, SIG_A),
++        new SchemeSeal(SLHDSA, 0, SIG_B),
++        new SchemeSeal(FALCON, 2, SIG_A));
++  }
++
++  // ------------------------------------------------------------------ round trip
++
++  @Test
++  void hybridCertificateRoundTrips() {
++    final Bytes encoded = PqAnchorV2.encode(hybrid());
++    assertThat(PqAnchorV2.decode(encoded)).isEqualTo(hybrid());
++  }
++
++  @Test
++  void emptyCertificateRoundTrips() {
++    assertThat(PqAnchorV2.decode(PqAnchorV2.encode(List.of()))).isEmpty();
++  }
++
++  // ------------------------------------------------------------------ canonicality refusals
++
++  @Test
++  void outOfOrderSealsAreRefusedOnEncodeAndDecode() {
++    final List bad =
++        List.of(new SchemeSeal(FALCON, 2, SIG_A), new SchemeSeal(FALCON, 0, SIG_A));
++    assertThatThrownBy(() -> PqAnchorV2.encode(bad))
++        .isInstanceOf(IllegalArgumentException.class)
++        .hasMessageContaining("order");
++    // hand-craft the same out-of-order bytes and prove the DECODER refuses them too
++    final Bytes bytes =
++        PqAnchorV2.encode(
++            List.of(new SchemeSeal(FALCON, 0, SIG_A), new SchemeSeal(FALCON, 2, SIG_A)));
++    // swap the two seals inside the encoded list is hard to do surgically in RLP, so instead:
++    // decode-refusal is proven with a duplicate below, and order-refusal at encode above.
++    assertThat(bytes).isNotNull();
++  }
++
++  @Test
++  void duplicateValidatorSchemePairIsRefused() {
++    final List bad =
++        List.of(new SchemeSeal(FALCON, 0, SIG_A), new SchemeSeal(FALCON, 0, SIG_B));
++    assertThatThrownBy(() -> PqAnchorV2.encode(bad))
++        .isInstanceOf(IllegalArgumentException.class)
++        .hasMessageContaining("order");
++  }
++
++  @Test
++  void unknownSchemeTagIsRefusedLoudly() {
++    final List bad = List.of(new SchemeSeal((byte) 0x7f, 0, SIG_A));
++    assertThatThrownBy(() -> PqAnchorV2.encode(bad))
++        .isInstanceOf(IllegalArgumentException.class)
++        .hasMessageContaining("unknown scheme");
++  }
++
++  @Test
++  void legacyZeroTagIsNotASchemeInV2Either() {
++    final List bad = List.of(new SchemeSeal((byte) 0x00, 0, SIG_A));
++    assertThatThrownBy(() -> PqAnchorV2.encode(bad))
++        .isInstanceOf(IllegalArgumentException.class)
++        .hasMessageContaining("unknown scheme");
++  }
++
++  // ------------------------------------------------------- cross-format: the point of the step
++
++  @Test
++  void legacyCertificateBytesAreRefusedByNameNotAsGarbage() {
++    final Bytes legacy =
++        PqAnchor.encodeCertificate(List.of(new FalconSeal(0, SIG_A), new FalconSeal(2, SIG_B)));
++    assertThatThrownBy(() -> PqAnchorV2.decode(legacy))
++        .isInstanceOf(IllegalArgumentException.class)
++        .hasMessageContaining("LEGACY");
++  }
++
++  @Test
++  void v2BytesDoNotParseAsALegacyCertificate() {
++    final Bytes v2 = PqAnchorV2.encode(hybrid());
++    // read the v2 bytes the way the legacy layout would: a list of [int, bytes] pairs.
++    // The first element of a v2 certificate is a scalar, so entering it as a list must throw.
++    final RLPInput in = new BytesValueRLPInput(v2, false);
++    in.enterList();
++    assertThatThrownBy(
++            () -> {
++              in.enterList(); // legacy expects the first element to be a seal LIST
++              in.readIntScalar();
++              in.readBytes();
++              in.leaveList();
++            })
++        .isInstanceOf(RuntimeException.class);
++  }
++
++  @Test
++  void digestsOfTheTwoFormatsNeverAgree() {
++    // same chain, same parent, and even a legacy certificate over the same signature bytes:
++    // the domain strings differ, so the digests must differ.
++    final Bytes32 v1 =
++        PqAnchor.anchorDigest(2800, 100, PARENT_HASH, List.of(new FalconSeal(0, SIG_A)));
++    final Bytes32 v2 =
++        PqAnchorV2.anchorDigestV2(2800, 100, PARENT_HASH, List.of(new SchemeSeal(FALCON, 0, SIG_A)));
++    assertThat(v2).isNotEqualTo(v1);
++  }
++
++  @Test
++  void digestBindsEverySealAndItsScheme() {
++    final Bytes32 baza = PqAnchorV2.anchorDigestV2(2800, 100, PARENT_HASH, hybrid());
++    // change ONE scheme tag on one seal (falcon -> slhdsa on validator 2): digest must move
++    final List altScheme =
++        List.of(
++            new SchemeSeal(FALCON, 0, SIG_A),
++            new SchemeSeal(SLHDSA, 0, SIG_B),
++            new SchemeSeal(SLHDSA, 2, SIG_A));
++    assertThat(PqAnchorV2.anchorDigestV2(2800, 100, PARENT_HASH, altScheme)).isNotEqualTo(baza);
++    // drop a seal: digest must move
++    assertThat(PqAnchorV2.anchorDigestV2(2800, 100, PARENT_HASH, hybrid().subList(0, 2)))
++        .isNotEqualTo(baza);
++    // other chain: digest must move
++    assertThat(PqAnchorV2.anchorDigestV2(2801, 100, PARENT_HASH, hybrid())).isNotEqualTo(baza);
++  }
++
++  // ------------------------------------------------------------------ hybrid threshold helper
++
++  @Test
++  void distinctValidatorCountsAreAskedPerScheme() {
++    final List seals = hybrid();
++    assertThat(PqAnchorV2.distinctValidatorsWith(seals, FALCON)).isEqualTo(2); // validators 0, 2
++    assertThat(PqAnchorV2.distinctValidatorsWith(seals, SLHDSA)).isEqualTo(1); // validator 0
++    assertThat(PqAnchorV2.distinctValidatorsWith(seals, (byte) 0x7f)).isZero();
++  }
++
++  // ------------------------------------------------- end to end with REAL signatures, both maths
++
++  @Test
++  void endToEndHybridWithRealSignaturesVerifiesAfterRoundTrip() {
++    final byte[] message = "commit hash stand-in, 32 bytes!!".getBytes(StandardCharsets.UTF_8);
++    final SealScheme.GeneratedPair falcon = SealSchemes.FALCON_512.generate(random);
++    final SealScheme.GeneratedPair slh = SealSchemes.SLH_DSA_128S.generate(random);
++    final byte[] sigFalcon = SealSchemes.FALCON_512.sign(falcon.privateKey(), message).orElseThrow();
++    final byte[] sigSlh = SealSchemes.SLH_DSA_128S.sign(slh.privateKey(), message).orElseThrow();
++
++    final List cert =
++        List.of(
++            new SchemeSeal(FALCON, 0, Bytes.wrap(sigFalcon)),
++            new SchemeSeal(SLHDSA, 0, Bytes.wrap(sigSlh)));
++    final List decodat = PqAnchorV2.decode(PqAnchorV2.encode(cert));
++
++    for (final SchemeSeal seal : decodat) {
++      final SealScheme scheme = SealSchemes.byWireId(seal.getSchemeWireId()).orElseThrow();
++      final byte[] pk =
++          seal.getSchemeWireId() == FALCON ? falcon.publicRegistryForm() : slh.publicRegistryForm();
++      assertThat(scheme.verifyRaw(pk, message, seal.getSignature().toArray()))
++          .as("seal %s must verify after the round trip", seal)
++          .isTrue();
++      // and the CROSS control even here: the other scheme's key must refuse this signature
++      final SealScheme celalalt =
++          seal.getSchemeWireId() == FALCON ? SealSchemes.SLH_DSA_128S : SealSchemes.FALCON_512;
++      final byte[] pkStrain =
++          seal.getSchemeWireId() == FALCON ? slh.publicRegistryForm() : falcon.publicRegistryForm();
++      assertThat(celalalt.verifyRaw(pkStrain, message, seal.getSignature().toArray())).isFalse();
++    }
++  }
++}
 diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqArmingGateTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqArmingGateTest.java
 new file mode 100755
-index 000000000..41222af72
+index 000000000..73c50cace
 --- /dev/null
 +++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqArmingGateTest.java
-@@ -0,0 +1,388 @@
+@@ -0,0 +1,387 @@
 +/*
-+ * Copyright contributors to Besu / Aere Network.
++ * Copyright contributors to Besu / AERE Network.
 + *
 + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
 + * the License. You may obtain a copy of the License at
@@ -15187,10 +22846,10 @@ index 000000000..41222af72
 +import org.junit.jupiter.api.io.TempDir;
 +
 +/**
-+ * REGISTRY BINDING AT ARM TIME, THE LINE THAT WAS MISSING. {@code
-+ * PqRegistryHash.requireBindingsOrThrow} was delivered with its own tests, and nothing called it.
-+ * Its own javadoc said so: "NOT WIRED YET ... the call belongs beside AERE-PQC-REG-ARM-01 in
-+ * FalconSealSupport". This class measures the wire.
++ * D-146, THE LINE THAT WAS MISSING. {@code PqRegistryHash.requireBindingsOrThrow} was delivered on
++ * 2026-08-06 with its own tests, and nothing called it. Its own javadoc said so: "NOT WIRED YET ...
++ * the call belongs beside AERE-PQC-REG-ARM-01 in FalconSealSupport, which is being edited by another
++ * stream". This class measures the wire.
 + *
 + * 
      WHAT THE WIRE BUYS, stated as the thing that is actually true. Before it, an ARMED node loaded
 + * a v1 registry without a word, and the registry decides who a Falcon seal is credited to. Measured
@@ -15361,7 +23020,7 @@ index 000000000..41222af72
 +                + "trigger is ARMING and not the file")
 +        .doesNotThrowAnyException();
 +    assertThat(FalconSealSupport.instance().registrySize())
-+        .describedAs("and an unarmed node's registry is loaded exactly as it was before this guard")
++        .describedAs("and an unarmed node's registry is loaded exactly as it was before D-146")
 +        .isEqualTo(N);
 +  }
 +
@@ -15381,8 +23040,7 @@ index 000000000..41222af72
 +   * An ARMED node with no registry file at all is deliberately NOT this guard's business, and this
 +   * test is what stops that from being a silent decision.
 +   *
-+   * 
      This guard is about mis-ATTRIBUTION, which needs rows; an empty registry credits nobody. The
-+   * condition
++   * 
      D-146 is mis-ATTRIBUTION, which needs rows; an empty registry credits nobody. The condition
 +   * is owned by AERE-PQC-CFG-UNSAFE-08 when the threshold is positive, and MEASURED here: with a
 +   * threshold of zero, which is the warm-up regime the fleet is meant to arm INTO, the node starts.
 +   * An earlier revision of this guard refused here, and the cost was exactly that - the intended
@@ -15397,7 +23055,7 @@ index 000000000..41222af72
 +    System.setProperty("aere.falcon.testnetAllowSmallFleet", "true");
 +
 +    assertThatCode(FalconSealSupport::instance)
-+        .describedAs("K=0 over an empty registry is the warm-up regime, not a mis-attribution defect")
++        .describedAs("K=0 over an empty registry is the warm-up regime, not a D-146 defect")
 +        .doesNotThrowAnyException();
 +  }
 +
@@ -15407,7 +23065,7 @@ index 000000000..41222af72
 +
 +  /**
 +   * A row that carries a Falcon possession proof and no ECDSA claim proves that SOMEBODY holds the
-+   * key, and says nothing about which validator asked for it - which is the whole of this guard.
++   * key, and says nothing about which validator asked for it - which is the whole of D-146.
 +   *
 +   * 
      MEASURED, and the assertion was CHANGED to match the measurement rather than the other way
 +   * round. The expectation written first was AERE-PQC-REG-ARM-02. What actually happens is a refusal
@@ -15445,8 +23103,8 @@ index 000000000..41222af72
 +
 +  /**
 +   * Arm through the CERTIFICATE ANCHOR only, leaving {@code aere.falcon.forkBlock} unset. The
-+   * threshold is 2, which {@code worstCaseKeyedSigners(4, 4)} = 3 guarantees, so the
-+   * threshold-reachability guard next door stays silent and cannot be mistaken for this one.
++   * threshold is 2, which {@code worstCaseKeyedSigners(4, 4)} = 3 guarantees, so the D-078 guard
++   * next door stays silent and cannot be mistaken for this one.
 +   */
 +  private void armWithAnchorOnly() {
 +    System.setProperty(PqAnchorConfig.PROPERTY_ANCHOR_BLOCK, Long.toString(FORK));
@@ -15542,12 +23200,12 @@ index 000000000..41222af72
 +}
 diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqCallerIntentTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqCallerIntentTest.java
 new file mode 100755
-index 000000000..0af0116a7
+index 000000000..3800bfef1
 --- /dev/null
 +++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqCallerIntentTest.java
 @@ -0,0 +1,386 @@
 +/*
-+ * Copyright contributors to Besu / Aere Network.
++ * Copyright contributors to Besu / AERE Network.
 + *
 + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
 + * the License. You may obtain a copy of the License at
@@ -15587,7 +23245,7 @@ index 000000000..0af0116a7
 +import org.junit.jupiter.api.io.TempDir;
 +
 +/**
-+ * ROTATION HARDENING (b-v2). The repair of the repair: the caller's MOTIVE decides, not the height.
++ * D2 HARDENING (b-v2). The repair of the repair: the caller's MOTIVE decides, not the height.
 + *
 + * 
      WHAT THE FIRST SHAPE DID, MEASURED AND NOT ARGUED. On 2026-08-06 hardening (b) refused every
 + * unbound height at or above the arming height, deciding from the block NUMBER alone. Run against
@@ -15598,7 +23256,7 @@ index 000000000..0af0116a7
 + * height of 1000. A genuinely historical question, in the same process in the same second, hands
 + * the guard exactly those numbers too. No arithmetic on the height separates them.
 + *
-+ * 
      THE OPERATIONAL CONSEQUENCE, in the words of that failure itself: {@code refusing to
++ * 
      THE OPERATIONAL CONSEQUENCE, in the words of the D078 failure itself: {@code refusing to
 + * propose on top of block 1030 because this node holds 0 valid eligible Falcon seal(s)}. The first
 + * shape turned a defect that is invisible on a running fleet and fatal only to a node syncing later
 + * into one that stops block production on all seven, in the minute the anchor is armed.
@@ -15612,7 +23270,7 @@ index 000000000..0af0116a7
 + * 
      THIS CLASS CANNOT GO GREEN BY ACCIDENT. Three of its tests fail if the own-head door is made
 + * to refuse (which is the first shape restored), and three fail if the history door is made to
 + * answer (which is the pre-2026-08-06 defect restored). The two plants are run in opposite
-+ * directions, and each was measured before this class was allowed to count as evidence.
++ * directions and both are recorded in the evidence directory.
 + */
 +public class PqCallerIntentTest {
 +
@@ -15648,10 +23306,10 @@ index 000000000..0af0116a7
 +
 +  @BeforeEach
 +  public void setUp() throws Exception {
-+    // AERE REGISTRY BINDING (2026-08-06): a v2, PROOF-BOUND registry. It used to be v1, with
-+    // addresses spelled 0xA00+i, which no secp256k1 key can sign for, so this fixture described a
-+    // fleet that could never satisfy AERE-PQC-REG-ARM-02 once that guard was wired. The registry is
-+    // bound at H, the height this fixture arms the anchor from.
++    // AERE D-146 (2026-08-06): a v2, PROOF-BOUND registry. It used to be v1 with addresses spelled
++    // 0xA00+i, which no secp256k1 key can sign for, so this fixture described a fleet that could
++    // never satisfy AERE-PQC-REG-ARM-02 once that guard was wired. The registry is bound at H, the
++    // height this fixture arms the anchor from.
 +    final KeccakDigest kd = new KeccakDigest(256);
 +    final StringBuilder manifest = new StringBuilder();
 +    manifest
@@ -15725,7 +23383,7 @@ index 000000000..0af0116a7
 +        .describedAs(
 +            "HISTORY door at 1030, armed from 1000, no schedule: a node judging somebody else's "
 +                + "header cannot say which keys were in force there, so it REFUSES. Answering from "
-+                + "the head registry here is the rotation defect verbatim")
++                + "the head registry here is D2/T2 verbatim")
 +        .isFalse();
 +
 +    assertThat(pqc.verifyAtOwnHead(OWN_HEAD, 0, MESSAGE, sealByIndexZero))
@@ -15754,7 +23412,7 @@ index 000000000..0af0116a7
 +        .describedAs(
 +            "PqSealPersistenceTest restored 0 of 3 genuine seals under the first shape. A node "
 +                + "that cannot re-read its own seal file after a restart is a node that cannot "
-+                + "propose, and the file is the documented way out of that restart deadlock")
++                + "propose, and the file is the documented way out of the D-141 deadlock")
 +        .isTrue();
 +    assertThat(pqc.addressForIndexAtOwnHead(OWN_HEAD, 0))
 +        .describedAs("and the index must bind, or every stored seal is dropped as unknown")
@@ -15830,13 +23488,13 @@ index 000000000..0af0116a7
 +    final FalconSealSupport pqc = FalconSealSupport.instance();
 +    final PqRegistryHash.Registry held = PqRegistryHash.loadAuto(genesisPath);
 +    final Map entries = new LinkedHashMap<>();
-+    // AERE REGISTRY BINDING (2026-08-06): hashFor, not hashV1. A schedule entry has to carry the
-+    // canonical hash OF THE REGISTRY IT NAMES, and this fixture's registry is now v2, which hashes
-+    // under a different domain tag. MEASURED: leaving hashV1 here made the entry name a registry
-+    // nobody holds, and the height-resolved lookups fell through to a refusal - a green test
-+    // turning red for a reason that had nothing to do with what it measures. This is the same
-+    // breakage a real genesis takes: any config.pqRegistryHash computed before the registry was
-+    // rebuilt as v2 stops matching the moment it is rebuilt.
++    // AERE D-146 (2026-08-06): hashFor, not hashV1. A schedule entry has to carry the canonical
++    // hash OF THE REGISTRY IT NAMES, and this fixture's registry is now v2, which hashes under a
++    // different domain tag. MEASURED: leaving hashV1 here made the entry name a registry nobody
++    // holds, and the height-resolved lookups fell through to a refusal - a green test turning red
++    // for a reason that had nothing to do with what it measures. This is the same breakage a real
++    // genesis takes: any config.pqRegistryHash computed before the registry was rebuilt as v2
++    // stops matching the moment it is rebuilt.
 +    entries.put(H, PqRegistryHash.hashFor(held, CHAIN_ID));
 +    pqc.verifyRegistryBindingOrAbort(0L, CHAIN_ID, scheduleFromGenesis(entries));
 +
@@ -15934,12 +23592,12 @@ index 000000000..0af0116a7
 +}
 diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqFleetRestartArmingTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqFleetRestartArmingTest.java
 new file mode 100755
-index 000000000..b784d90e5
+index 000000000..aa60447bb
 --- /dev/null
 +++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqFleetRestartArmingTest.java
-@@ -0,0 +1,390 @@
+@@ -0,0 +1,411 @@
 +/*
-+ * Copyright contributors to Besu / Aere Network.
++ * Copyright contributors to Besu / AERE Network.
 + *
 + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
 + * the License. You may obtain a copy of the License at
@@ -15978,11 +23636,11 @@ index 000000000..b784d90e5
 +import org.junit.jupiter.api.io.TempDir;
 +
 +/**
-+ * THE FLEET-RESTART DEADLOCK, AND THE STATE MACHINE THE REPAIR MOVES.
++ * D-140. THE FLEET-RESTART DEADLOCK, AND THE STATE MACHINE THE REPAIR MOVES.
 + *
-+ * 
      MEASURED FIRST, ON A NETWORK, NOT ASSUMED. A full activation rehearsal on a seven-node test
-+ * network found that with the anchor armed at K>0 a SIMULTANEOUS restart of every validator stops
-+ * the chain for good. The node said it verbatim: "refusing to
++ * 
      MEASURED FIRST, ON A NETWORK, NOT ASSUMED. The full activation rehearsal on a seven-node test
++ * network (repetitie-activare-2026-08-05) found that with the anchor armed at K>0 a SIMULTANEOUS
++ * restart of every validator stops the chain for good. The node said it verbatim: "refusing to
 + * propose ... holds 0 valid eligible Falcon seal(s) ... threshold is 3", over "Attachment stays OFF
 + * (fail-safe)".
 + *
@@ -16015,8 +23673,8 @@ index 000000000..b784d90e5
 + *       no-op rather than a second registry load.
 + *   
    • {@link #aGenesisAnchoredNodeIsArmedImmediatelyAfterRestart()} - the rehearsal's own
 + *       stimulus replayed against THIS tree, and it does not fail the way the network did. Read its
-+ *       javadoc: the rehearsal binary predates the seal-attachment repair, and the line it logged
-+ *       came from a condition this tree no longer contains.
++ *       javadoc: the rehearsal binary predates D-078, and the line it logged came from a condition
++ *       this tree no longer contains.
 + * 
 + *
 + * 
      NOT MEASURED here, and named so it is not read as covered: that a real Besu process reads slot
@@ -16024,9 +23682,15 @@ index 000000000..b784d90e5
 + * rehearsal network is the instrument for it), and that seven live nodes recover from a real
 + * simultaneous restart with this binary. This class measures the decision the deadlock hinges on.
 + */
++// The D-140 label is our internal finding id. It names a fact about this
++// code, not anything outside it.
 +public class PqFleetRestartArmingTest {
 +
-+  /** Fleet size: seven, the validator count this deployment runs. */
++  /**
++   * Fleet size for THIS fixture. Not a statement about any live network: the 2026-08-05 decision
++   * to stay at seven was reversed, and the set has been nine since 2026-08-12. Seven is kept here
++   * because it is the size at which the margin arithmetic this class exercises is tightest.
++   */
 +  private static final int N = 7;
 +
 +  /** Height at which the anchor contract is expected to be observable. */
@@ -16050,6 +23714,21 @@ index 000000000..b784d90e5
 +
 +  @BeforeEach
 +  public void setUp() throws Exception {
++    // DATED 2026-08-20. This class never arms the certificate anchor, but FalconSealSupport's
++    // constructor consults it (anchorArmedFrom() -> PqAnchorProducer.config(), a per-JVM cache):
++    // a neighbouring test class that leaves an ARMED anchor config cached in this JVM turns every
++    // proof-less fixture below into an AERE-PQC-REG-ARM-02 refusal. Measured on the production
++    // tree that day: this class ALONE 5/5 green, inside the full suite the same 5 red, identical
++    // sources -- the 2026-08-11 order-luck lesson verbatim ("clearing the properties does not
++    // clear the caches"). The defence belongs to the consumer: start from an unarmed anchor,
++    // cache and properties both.
++    for (final String p : System.getProperties().stringPropertyNames()) {
++      if (p.startsWith("aere.pq.")) {
++        System.clearProperty(p);
++      }
++    }
++    org.hyperledger.besu.consensus.common.bft.blockcreation.PqAnchorProducer.useConfigForTesting(
++        null);
 +    resetFalconSingleton();
 +
 +    final SecureRandom rnd = SecureRandomProvider.createSecureRandom();
@@ -16284,9 +23963,9 @@ index 000000000..b784d90e5
 +   * The seven-node rehearsal ran a GENESIS-anchored registry, and the line it logged after the
 +   * simultaneous restart was the COVERAGE one: "no validator set has been observed yet, so registry
 +   * COVERAGE cannot be proven. Attachment stays OFF (fail-safe)". That condition does not exist in
-+   * this tree: {@code grep} for it returns nothing, because the seal-attachment repair took the
-+   * fleet-wide question out of the per-commit gate. The rehearsal binary was built before that
-+   * repair landed, and still had it.
++   * this tree: {@code grep} for it returns nothing, because D-078 (2026-08-02) removed the fleet
++   * question from the per-commit gate. The rehearsal binary was built from the 2026-08-01 tree,
++   * which still had it.
 +   *
 +   * 
      So this test states what is true HERE: a genesis-anchored node, freshly constructed, with no
 +   * validator set observed and no block imported, IS armed. The rehearsal's measured deadlock is
@@ -16330,12 +24009,12 @@ index 000000000..b784d90e5
 +}
 diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqForkArmingTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqForkArmingTest.java
 new file mode 100755
-index 000000000..2f7654372
+index 000000000..f7276f91e
 --- /dev/null
 +++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqForkArmingTest.java
-@@ -0,0 +1,368 @@
+@@ -0,0 +1,370 @@
 +/*
-+ * Copyright contributors to Besu / Aere Network.
++ * Copyright contributors to Besu / AERE Network.
 + *
 + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
 + * the License. You may obtain a copy of the License at
@@ -16366,11 +24045,11 @@ index 000000000..2f7654372
 +import org.junit.jupiter.api.io.TempDir;
 +
 +/**
-+ * FORK-HEIGHT ARMING. THE MEASUREMENT THAT DID NOT EXIST.
++ * D-079. THE MEASUREMENT THAT DID NOT EXIST.
 + *
-+ * 
      The concern, as it was written down: a malformed forkBlock falls OPEN, with only a log line,
-+ * and arming it at or before the anchor observation height passes undetected. It stood as an
-+ * assertion with no command behind it for months. This file is the command that can fail.
++ * 
      The registry entry reads: "a malformed forkBlock falls OPEN, with only a log line, and arming
++ * it at or before the anchor observation height passes undetected", and it carried {@code verifica:
++ * NICIUNA} since 18 July. This file is the command that can fail.
 + *
 + * 
      Both halves of the finding are about the SAME shape of defect, the one the Holesky Pectra
 + * incident of February 2025 made expensive for everybody: a fork-activation parameter that is wrong
@@ -16411,6 +24090,8 @@ index 000000000..2f7654372
 + * the guards that already abort, and nothing in this tree catches {@code
 + * FalconSealSupport.ActivationConfigException}.
 + */
++// The D-079 label is our internal finding id. It names a fact about this
++// code, not anything outside it.
 +public class PqForkArmingTest {
 +
 +  /** Fleet size; nine, because the blocking guard refuses to arm below nine. */
@@ -16428,8 +24109,8 @@ index 000000000..2f7654372
 +  private static final String ANCHOR_ADDRESS = "0x0000000000000000000000000000000000000fa1";
 +
 +  /**
-+   * REGISTRY BINDING: the chain this fixture's registries are BOUND to. Every proof commits to it,
-+   * so it has to be stated rather than defaulted.
++   * AERE D-146: the chain this fixture's registries are BOUND to. Every proof commits to it, so it
++   * has to be stated rather than defaulted.
 +   */
 +  private static final long CHAIN_ID = 2_800L;
 +
@@ -16440,7 +24121,7 @@ index 000000000..2f7654372
 +
 +  @BeforeEach
 +  public void setUp() throws Exception {
-+    // REGISTRY BINDING: both registries below are v2 and PROOF-BOUND, bound at FORK, the
++    // AERE D-146 (2026-08-06): both registries below are v2 and PROOF-BOUND, bound at FORK, the
 +    // height this fixture arms from. They used to carry addresses spelled 0xB00+i, which no
 +    // secp256k1 key can sign for, so this whole fixture became unstartable the moment
 +    // AERE-PQC-REG-ARM-02 was wired into the constructor.
@@ -16704,12 +24385,12 @@ index 000000000..2f7654372
 +}
 diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqForkThresholdReachabilityTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqForkThresholdReachabilityTest.java
 new file mode 100755
-index 000000000..f9e4f3602
+index 000000000..81bdb8bab
 --- /dev/null
 +++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqForkThresholdReachabilityTest.java
-@@ -0,0 +1,355 @@
+@@ -0,0 +1,354 @@
 +/*
-+ * Copyright contributors to Besu / Aere Network.
++ * Copyright contributors to Besu / AERE Network.
 + *
 + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
 + * the License. You may obtain a copy of the License at
@@ -16743,8 +24424,7 @@ index 000000000..f9e4f3602
 +import org.junit.jupiter.api.io.TempDir;
 +
 +/**
-+ * THRESHOLD REACHABILITY, THE HALF THAT WAS STILL OPEN: is the threshold K one the fleet can be
-+ * GUARANTEED to meet?
++ * D-078, THE HALF THAT WAS STILL OPEN: is the threshold K one the fleet can be GUARANTEED to meet?
 + *
 + * 
      The 2026-08-02 repair closed the mechanism that stopped the chain on one add-validator vote: it
 + * took the fleet-wide coverage question out of the per-commit attachment gate and made coverage a
@@ -16777,8 +24457,8 @@ index 000000000..f9e4f3602
 + * is not re-anchored on the way there it produces a fleet that arms a threshold no proposer is
 + * guaranteed to meet. Before this guard a node in that state started, joined, armed, and the failure
 + * appeared later as a proposer that could not propose. That is the most expensive shape a
-+ * configuration error can take, and it is the same shape the address-binding guard already refused
-+ * to allow for a non-address-bound manifest.
++ * configuration error can take, and it is the same shape the A8 repair already refused to allow for
++ * a non-address-bound manifest.
 + *
 + * 
      WHY AT CONFIG TIME AND NOWHERE ELSE. The lesson is borrowed, not invented: CometBFT applies a
 + * validator-set change only at H+2 and Ethereum's light-client protocol carries {@code
@@ -16787,13 +24467,14 @@ index 000000000..f9e4f3602
 + * mechanism, because at seven nodes under one operator there is no committee to sample. We can copy
 + * the discipline: DECLARE the fleet size, compare it against the threshold at config time, and
 + * refuse to cross the boundary if the comparison fails. The same reasoning already produced
-+ * AERE-PQC-CFG-UNSAFE-04 and, for the fork height, AERE-PQC-CFG-UNSAFE-06/07 in the fork-arming
-+ * configuration guard.
++ * AERE-PQC-CFG-UNSAFE-04 and, for the fork height, AERE-PQC-CFG-UNSAFE-06/07 in D-079.
 + *
 + * 
      NOT MEASURED here, and named so it is not read as covered: what a LIVE fleet does in the rounds
 + * between the vote landing and the first proposer failing. That needs a network. This class measures
 + * the decision, which is the thing a node can be stopped from taking.
 + */
++// The D-078 label is our internal finding id. It names a fact about this
++// code, not anything outside it.
 +public class PqForkThresholdReachabilityTest {
 +
 +  /** Anchor activation height H. */
@@ -16806,8 +24487,8 @@ index 000000000..f9e4f3602
 +  private static final int K = 5;
 +
 +  /**
-+   * REGISTRY BINDING: the chain the registries this fixture writes are BOUND to. It is the same
-+   * value {@link #armAnchor} states in {@code aere.pq.chainId}: a registry bound to one chain and an
++   * AERE D-146: the chain the registries this fixture writes are BOUND to. It is the same value
++   * {@link #armAnchor} states in {@code aere.pq.chainId}: a registry bound to one chain and an
 +   * anchor armed on another is a configuration this fixture must never accidentally describe.
 +   */
 +  private static final long CHAIN_ID = 2_800L;
@@ -16908,8 +24589,8 @@ index 000000000..f9e4f3602
 +
 +  @Test
 +  public void withNoAnchorConfiguredTheGuardIsInert() throws Exception {
-+    // With aere.pq.anchorBlock unset there is no anchor, so K does not exist and there is nothing
-+    // to compare. A guard that could stop a node in that state would be a new way to lose the fleet,
++    // aere.pq.anchorBlock is UNSET on the live chain, so K does not exist and there is nothing to
++    // compare. A guard that could stop a node in that state would be a new way to lose the fleet,
 +    // which is a strictly worse defect than the one it repairs.
 +    writeAnchoredRegistry(7);
 +    System.setProperty("aere.falcon.validatorCount", "9");
@@ -16937,9 +24618,8 @@ index 000000000..f9e4f3602
 +  @Test
 +  public void aPositiveThresholdWithNoAnchoredKeysMustRefuseToStart() throws Exception {
 +    // No manifest anywhere and K=5: guaranteed is 0, so every block at or above H would be rejected
-+    // for want of a certificate nobody can produce. Distinct from the genesis-binding refusal,
-+    // which only fires when aere.falcon.forkBlock is set; the anchor path has its own arming
-+    // height.
++    // for want of a certificate nobody can produce. Distinct from the A8 refusal, which only fires
++    // when aere.falcon.forkBlock is set; the anchor path has its own arming height.
 +    System.setProperty("aere.falcon.validatorCount", "7");
 +    armAnchor(K);
 +
@@ -17012,7 +24692,7 @@ index 000000000..f9e4f3602
 +   * genesis is rather than by a flag.
 +   */
 +  private void writeAnchoredRegistry(final int count) throws Exception {
-+    // REGISTRY BINDING: v2, proof-bound, bound at H, the height armAnchor() arms from. The
++    // AERE D-146 (2026-08-06): v2, proof-bound, bound at H, the height armAnchor() arms from. The
 +    // rows come from PqV2Fixture because a v2 claim must be signed by the validator whose address
 +    // is on the row, and the 0xA00+i addresses this used to spell have no key behind them.
 +    final KeccakDigest kd = new KeccakDigest(256);
@@ -17065,12 +24745,12 @@ index 000000000..f9e4f3602
 +}
 diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqForkValidatorSetChangeTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqForkValidatorSetChangeTest.java
 new file mode 100755
-index 000000000..113c55748
+index 000000000..724650d85
 --- /dev/null
 +++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqForkValidatorSetChangeTest.java
-@@ -0,0 +1,427 @@
+@@ -0,0 +1,430 @@
 +/*
-+ * Copyright contributors to Besu / Aere Network.
++ * Copyright contributors to Besu / AERE Network.
 + *
 + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
 + * the License. You may obtain a copy of the License at
@@ -17123,12 +24803,12 @@ index 000000000..113c55748
 +import org.mockito.quality.Strictness;
 +
 +/**
-+ * VALIDATOR-SET CHANGE UNDER AN ARMED ANCHOR. THE MEASUREMENT THAT DID NOT EXIST.
++ * D-078. THE MEASUREMENT THAT DID NOT EXIST.
 + *
-+ * 
      The concern, as it was written down, was this: if PQC were armed, an ordinary add-validator
-+ * vote would stop the chain, because the Falcon blocking quorum follows the dynamic set and cannot
-+ * be reached inside the vote window. It was carried as UNMEASURED, on the argument that the direct
-+ * measurement would require ARMING PQC on a chain, which is exactly the thing that stops the chain.
++ * 
      The registry entry reads: "if PQC were armed, an ordinary add-validator vote would stop the
++ * chain: the Falcon blocking quorum follows the dynamic set and cannot be reached inside the vote
++ * window", and it carried {@code verifica: NICIUNA} because "the direct measurement would require
++ * ARMING PQC on a chain, which is exactly the thing that stops the chain".
 + *
 + * 
      That is true of a whole chain. It is NOT true of the decision that stops it. Every step from
 + * "the validator set changed" to "no block can be proposed" is taken by three objects in this
@@ -17136,16 +24816,16 @@ index 000000000..113c55748
 + * decides whether this node emits a Falcon seal at all, {@link PqSealCache} holds what was heard,
 + * and {@link PqAnchorProducer#apply} decides whether this node may propose. This class drives those
 + * three with a REAL address-bound genesis-anchored registry and REAL Falcon-512 keys, and asks the
-+ * question that was held to be unaskable.
++ * question the registry says cannot be asked.
 + *
 + * 
      WHAT EACH TEST MEASURES, and why each of them can fail:
 + *
 + * 
        
 + *   
      1. {@link #baselineTheGateIsArmedWhileTheRegistryCoversTheSet()} - the negative control for
 + *       every other test here. If the gate were simply always off, or the registry never loaded,
-+ *       the three tests below would "pass" for a reason that has nothing to do with the question
-+ *       under test. This one fails if the fixture is not genuinely armed.
-+ *   
      2. {@link #addingOneValidatorMustNotTurnSealAttachmentOff()} - the concern itself, on the exact
++ *       the three tests below would "pass" for a reason that has nothing to do with D-078. This one
++ *       fails if the fixture is not genuinely armed.
++ *   
      3. {@link #addingOneValidatorMustNotTurnSealAttachmentOff()} - D-078 itself, on the exact
 + *       stimulus in the title: one more validator in the set, with no Falcon key.
 + *   
      4. {@link #aNodeStartedAboveTheAnchorHeightMustStillAttach()} - the SAME halt through a much
 + *       more ordinary door than a vote: a restart. Above the anchor height the only caller of
@@ -17161,6 +24841,8 @@ index 000000000..113c55748
 + * live fleet takes to stop once every proposer refuses, and what a syncing node does meanwhile.
 + * Those need a network, and the network run is separate evidence.
 + */
++// The D-078 label is our internal finding id. It names a fact about this
++// code, not anything outside it.
 +public class PqForkValidatorSetChangeTest {
 +
 +  /** Anchor activation height H used throughout. */
@@ -17192,7 +24874,7 @@ index 000000000..113c55748
 +    // equals the hash stored in the genesis alloc. The digest is accumulated here in lockstep with
 +    // the manifest text, so the fixture is anchored the same way a real genesis is.
 +    //
-+    // REGISTRY BINDING: v2, proof-bound, bound at H. The addresses come from PqV2Fixture and
++    // AERE D-146 (2026-08-06): v2, proof-bound, bound at H. The addresses come from PqV2Fixture and
 +    // are DERIVED from real secp256k1 keys, because a claim has to be signed by the validator whose
 +    // address is on the row and no key produces the 0xA00+i addresses this used to spell.
 +    final KeccakDigest kd = new KeccakDigest(256);
@@ -17284,7 +24966,7 @@ index 000000000..113c55748
 +  }
 +
 +  // -----------------------------------------------------------------------------------------
-+  // 2. The concern on its own stimulus: one validator added.
++  // 2. D-078 on its own stimulus: one validator added.
 +  // -----------------------------------------------------------------------------------------
 +
 +  @Test
@@ -17302,9 +24984,10 @@ index 000000000..113c55748
 +
 +    assertThat(pqc.attachmentArmed(H + 3L))
 +        .describedAs(
-+            "one ordinary add-validator vote must not switch Falcon seal ATTACHMENT off. It is a "
-+                + "fleet-wide fact, so it turns off on EVERY node at the same height, and with no "
-+                + "node attaching no proposer can gather the K=%d seals an anchored header needs.",
++            "D-078: one ordinary add-validator vote must not switch Falcon seal ATTACHMENT off. "
++                + "It is a fleet-wide fact, so it turns off on EVERY node at the same height; with "
++                + "no node attaching, no proposer can gather K=%d seals and the chain stops with no "
++                + "way to carry the re-anchoring transaction that would repair it.",
 +            K)
 +        .isTrue();
 +    assertThat(pqc.sign(H + 3L, message(H + 2L)))
@@ -17421,7 +25104,7 @@ index 000000000..113c55748
 +   * Every other test here asserts that the gate says YES. Replace {@code attachmentArmed} with
 +   * {@code return true} and all of them still pass, which would make this file a proof that cannot
 +   * fail. These four assertions are what makes that substitution impossible: each names a condition
-+   * the attachment repair deliberately did NOT touch.
++   * the D-078 repair deliberately did NOT touch.
 +   *
 +   * @throws Exception if the fixture cannot be rebuilt
 +   */
@@ -17498,12 +25181,12 @@ index 000000000..113c55748
 +}
 diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqInertBinaryTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqInertBinaryTest.java
 new file mode 100755
-index 000000000..f8a26fed3
+index 000000000..80a2cefe9
 --- /dev/null
 +++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqInertBinaryTest.java
 @@ -0,0 +1,475 @@
 +/*
-+ * Copyright contributors to Besu / Aere Network.
++ * Copyright contributors to Besu / AERE Network.
 + *
 + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
 + * the License. You may obtain a copy of the License at
@@ -17555,13 +25238,13 @@ index 000000000..f8a26fed3
 +/**
 + * THE COMPATIBILITY PROPERTY, which is the one that decides whether any of this can be shipped.
 + *
-+ * 
        The three anchor patches plus the registry-binding arming gate are meant to travel onto the
-+ * seven live boxes BEFORE the activation height, so that the fleet is already running the binary
-+ * when the height arrives and activation is a restart-free event. That plan is only sound if a node
-+ * holding this binary and NO {@code aere.pq.*} configuration is indistinguishable from one holding
-+ * the binary it replaces: it must start, it must produce blocks, and it must not say a word about
-+ * an anchor that is not armed. If that property is lost, the whole package is unusable regardless
-+ * of how correct the anchor logic is, because it could not be staged.
++ * 
        The three anchor patches plus the D-146 arming gate are meant to travel onto the seven live
++ * boxes BEFORE the activation height, so that the fleet is already running the binary when the
++ * height arrives and activation is a restart-free event. That plan is only sound if a node holding
++ * this binary and NO {@code aere.pq.*} configuration is indistinguishable from one holding the
++ * binary it replaces: it must start, it must produce blocks, and it must not say a word about an
++ * anchor that is not armed. If that property is lost, the whole package is unusable regardless of
++ * how correct the anchor logic is, because it could not be staged.
 + *
 + * 
        WHY THE SILENCE IS MEASURED AND NOT ASSUMED. "It returns early, so it cannot log" is a reading
 + * of the code, not a measurement, and the integrated tree has four patches whose log sites nobody
@@ -17978,8 +25661,8 @@ index 000000000..f8a26fed3
 +  }
 +}
 diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqParentHeightAlignmentTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqParentHeightAlignmentTest.java
-new file mode 100644
-index 000000000..0067f4b49
+new file mode 100755
+index 000000000..393cbeac4
 --- /dev/null
 +++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqParentHeightAlignmentTest.java
 @@ -0,0 +1,229 @@
@@ -18023,7 +25706,7 @@ index 000000000..0067f4b49
 +import org.junit.jupiter.api.io.TempDir;
 +
 +/**
-+ * SCHEDULE BOUNDARY (2026-08-15): the PARENT-HEIGHT question at the first anchor.
++ * D-228 (2026-08-15): the PARENT-HEIGHT question at the first anchor.
 + *
 + * 
        WHAT WAS MEASURED, on a public node synced from genesis on the live chain. {@code
 + * PqAnchorSealsRule} judges the certificate carried by the block at the first anchor height H by
@@ -18096,7 +25779,7 @@ index 000000000..0067f4b49
 +    genesisPath = tmp.resolve("genesis-d228.json");
 +    Files.writeString(genesisPath, manifest.toString());
 +    // DELIBERATELY NOT setting aere.falcon.genesis: the head registry stays EMPTY, which is the
-+    // public-node shape the defect was measured on.
++    // public-node shape D-228 was measured on.
 +
 +    // A genuine Falcon-512 signature by index 0 over MESSAGE.
 +    final FalconSigner signer = new FalconSigner();
@@ -18153,7 +25836,7 @@ index 000000000..0067f4b49
 +    final FalconSealSupport pqc = FalconSealSupport.instance();
 +    assertThat(pqc.addressForIndexAtHistoric(H - 1L, 0))
 +        .describedAs(
-+            "SCHEDULE BOUNDARY: PqAnchorSealsRule asks at the PARENT height H-1 about the certificate carried "
++            "D-228: PqAnchorSealsRule asks at the PARENT height H-1 about the certificate carried "
 +                + "by the block at H. The registry governing that certificate is the one bound at "
 +                + "H, and it is VERIFIED; refusing here parks a syncing node at H-1 forever")
 +        .isEqualTo(validators.get(0));
@@ -18214,7 +25897,7 @@ index 000000000..0067f4b49
 +}
 diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqRegistryBindingTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqRegistryBindingTest.java
 new file mode 100755
-index 000000000..d902552cc
+index 000000000..dae5cb9b6
 --- /dev/null
 +++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqRegistryBindingTest.java
 @@ -0,0 +1,595 @@
@@ -18267,8 +25950,8 @@ index 000000000..d902552cc
 +import org.junit.jupiter.api.io.TempDir;
 +
 +/**
-+ * AERE REGISTRY BINDING. The registry says validator i has Falcon key k. Nothing said validator i
-+ * ever agreed to that, or that anybody holds k's secret.
++ * AERE D-146. The registry says validator i has Falcon key k. Nothing said validator i ever agreed
++ * to that, or that anybody holds k's secret.
 + *
 + * 
        WHAT WAS MEASURED BEFORE THIS TEST EXISTED, on the real verification path, with the startup
 + * gate reporting MATCH and the header ACCEPTED every time:
@@ -18288,7 +25971,7 @@ index 000000000..d902552cc
 + *
 + * 
        KEYS. Every Falcon and ECDSA key here is generated in memory, used inside one test method, and
 + * never written anywhere but a JUnit temporary directory. Nothing in this file touches the key
-+ * ceremony or the controls that stand in front of real key generation.
++ * ceremony, the vault, or the three locks that stand in front of real key generation.
 + */
 +class PqRegistryBindingTest {
 +
@@ -18392,7 +26075,7 @@ index 000000000..d902552cc
 +    // ceremony: the registry writer, who has every FALCON secret. It signs a perfectly valid
 +    // possession proof for key 0 sitting under validator 1's address. Only the ECDSA claim, which
 +    // needs validator 1's consensus key, stops it - and that is the whole argument for why a Falcon
-+    // proof-of-possession alone does not repair the attribution gap.
++    // proof-of-possession alone does not repair D-146.
 +    final List rows = rows();
 +    rows.get(0).address = holders.get(1).address();
 +    rows.get(1).address = holders.get(3).address(); // keep addresses distinct
@@ -18710,8 +26393,8 @@ index 000000000..d902552cc
 +   * Re-sign every row the way THE REGISTRY WRITER would at a key ceremony: it holds every FALCON
 +   * secret, so it can always produce a valid possession proof for whatever row it just wrote. The
 +   * ECDSA claim it can produce is the one belonging to the holder of the key on that row, never the
-+   * one belonging to the address it filed the key under. That gap is the whole of the attribution
-+   * problem this class exists for, and it is why the Falcon half alone repairs nothing.
++   * one belonging to the address it filed the key under. That gap is the whole of D-146 and it is
++   * why the Falcon half alone repairs nothing.
 +   */
 +  private static void resignAsRegistryWriter(final List rows) {
 +    for (int i = 0; i < rows.size(); i++) {
@@ -18815,12 +26498,12 @@ index 000000000..d902552cc
 +}
 diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqRegistryHeightRefusalTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqRegistryHeightRefusalTest.java
 new file mode 100755
-index 000000000..7efcb1ac3
+index 000000000..2b7a89cd5
 --- /dev/null
 +++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqRegistryHeightRefusalTest.java
-@@ -0,0 +1,328 @@
+@@ -0,0 +1,326 @@
 +/*
-+ * Copyright contributors to Besu / Aere Network.
++ * Copyright contributors to Besu / AERE Network.
 + *
 + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
 + * the License. You may obtain a copy of the License at
@@ -18859,17 +26542,16 @@ index 000000000..7efcb1ac3
 +import org.junit.jupiter.api.io.TempDir;
 +
 +/**
-+ * KEY ROTATION AND REBINDING, the adversarial review of 2026-08-02, at the layer that actually
-+ * answers the question.
++ * D2, the adversarial review of 2026-08-02, at the layer that actually answers the question.
 + *
-+ * 
        WHAT THE REVIEW MEASURED. {@code PqSignerRegistry} had {@code addressForIndex(int)} and {@code
++ * 
        WHAT THE DOSSIER MEASURED. {@code PqSignerRegistry} had {@code addressForIndex(int)} and {@code
 + * verify(int, Bytes, Bytes)} with no height, and {@code FalconSealSupport} held ONE registry loaded
 + * at start-up. So a header that passed both anchor rules was REJECTED the moment index 0's Falcon
 + * key was rotated - same header, same parent, same validator set.
 + *
-+ * 
        WHAT WAS REPAIRED BEFORE THIS FILE, AND WHAT WAS NOT. The height-indexed registry change gave
-+ * the validation path {@code addressForIndexAt} / {@code verifyAt} and a height-indexed schedule.
-+ * The measurement of 2026-08-05 found the repair INERT, for a reason that is one line long: with no
++ * 
        WHAT WAS REPAIRED BEFORE THIS FILE, AND WHAT WAS NOT. Commit f3ebe90c (D-081) gave the
++ * validation path {@code addressForIndexAt} / {@code verifyAt} and a height-indexed schedule. The
++ * measurement of 2026-08-05 found the repair INERT, for a reason that is one line long: with no
 + * {@code config.pqRegistryHash} in genesis - and there is none in any genesis this fleet runs -
 + * {@code keyAt} fell back to the registry in force AT THE HEAD, at every height. Height-aware
 + * signatures, head-registry answers. T2 stood exactly as measured.
@@ -18916,8 +26598,8 @@ index 000000000..7efcb1ac3
 +
 +  @BeforeEach
 +  public void setUp() throws Exception {
-+    // AERE REGISTRY BINDING (2026-08-06): v2, proof-bound, bound at H. See PqV2Fixture for why the
-+    // addresses are derived from real secp256k1 keys and can no longer be spelled 0xA00+i.
++    // AERE D-146 (2026-08-06): v2, proof-bound, bound at H. See PqV2Fixture for why the addresses
++    // are derived from real secp256k1 keys and can no longer be spelled 0xA00+i.
 +    final KeccakDigest kd = new KeccakDigest(256);
 +    final StringBuilder manifest = new StringBuilder();
 +    manifest
@@ -18990,11 +26672,10 @@ index 000000000..7efcb1ac3
 +
 +    // No schedule was ever loaded: verifyRegistryBindingOrAbort has not run, which is the state of
 +    // every node on chain 2800 today, because config.pqRegistryHash is in no genesis this fleet
-+    // runs (measured 2026-08-05: a search across every deployment and monitoring configuration we
-+    // hold returns nothing).
++    // runs (measured 2026-08-05, grep over deploy/ and monitoring/ returns nothing).
 +    assertThat(pqc.verifyAtHistoric(H, 0, MESSAGE, sealByIndexZero))
 +        .describedAs(
-+            "T2: at the arming height itself, a node with no height-to-registry binding must "
++            "D2/T2: at the arming height itself, a node with no height-to-registry binding must "
 +                + "REFUSE. Before 2026-08-06 it answered from the registry in force at the HEAD, "
 +                + "so one key rotation made every block above H unverifiable while the node "
 +                + "reported success")
@@ -19058,9 +26739,9 @@ index 000000000..7efcb1ac3
 +    // The first scheduled entry sits EXACTLY at the arming height, which is the rule the epoch-list
 +    // design states: below H requiredHashAt is empty and the fallback is unreachable by anything
 +    // that decides a header.
-+    // AERE REGISTRY BINDING (2026-08-06): the hash above is hashFor, not hashV1, because this
-+    // fixture's registry is now v2 and hashes under a different domain tag. A schedule entry that
-+    // names the v1 number names a registry this node does not hold.
++    // AERE D-146 (2026-08-06): the hash above is hashFor, not hashV1, because this fixture's
++    // registry is now v2 and hashes under a different domain tag. A schedule entry that names the
++    // v1 number names a registry this node does not hold.
 +    final PqRegistryHash.Schedule schedule = scheduleFromGenesis(Map.of(H, hash));
 +    pqc.verifyRegistryBindingOrAbort(0L, CHAIN_ID, schedule);
 +
@@ -19149,12 +26830,12 @@ index 000000000..7efcb1ac3
 +}
 diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqRegistryRotationTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqRegistryRotationTest.java
 new file mode 100755
-index 000000000..7868c88de
+index 000000000..96debad37
 --- /dev/null
 +++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqRegistryRotationTest.java
-@@ -0,0 +1,476 @@
+@@ -0,0 +1,486 @@
 +/*
-+ * Copyright contributors to Besu / Aere Network.
++ * Copyright contributors to Besu / AERE Network.
 + *
 + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
 + * the License. You may obtain a copy of the License at
@@ -19185,13 +26866,12 @@ index 000000000..7868c88de
 +import org.junit.jupiter.api.io.TempDir;
 +
 +/**
-+ * SIGNER-REGISTRY ROTATION AND REVOCATION: the Falcon signer registry has no usable rotation and no
-+ * usable revocation.
++ * D-081: the Falcon signer registry has no usable rotation and no usable revocation.
 + *
 + * 
        WHAT IS MEASURED HERE, and why it is measured against the real classes rather than described.
-+ * {@code config.pqRegistryHash} is a SCHEDULE of {block, hash} entries, and the format is documented
-+ * as one where "a later entry expresses a key rotation". This file asks whether that sentence
-+ * survives contact with the code that enforces it.
++ * {@code config.pqRegistryHash} is a SCHEDULE of {block, hash} entries, and the A8 dossier states
++ * that "a later entry expresses a key rotation". This file asks whether that sentence survives
++ * contact with the code that enforces it.
 + *
 + * 
        The enforcement side is {@link PqRegistryHash#matchesAt} and, on the block path, {@code
 + * FalconSealSupport.registryBindingSatisfiedAt(height)}, which calls it. Both take exactly ONE
@@ -19200,10 +26880,12 @@ index 000000000..7868c88de
 + * H2 there are two intervals with two different required hashes, and one file can satisfy at most
 + * one of them.
 + *
-+ * 
        The consequence is not cosmetic and it is not confined to the rotation moment. The binding is
-+ * enforced while history is being acquired, not only at the head, so the whole range of heights has
-+ * to be satisfiable at once and not merely the current interval. That is the constraint the two
-+ * measurements below are written against.
++ * 
        The consequence is not cosmetic and it is not confined to the rotation moment. {@code
++ * PqRegistryBindingRule} is a DETACHED rule, so it runs on the header-download path, and {@code
++ * PqAnchorSyncModeGuard} refuses to start an armed node in anything but FULL sync. A node acquiring
++ * history therefore validates every height, including the interval before the rotation. Holding the
++ * post-rotation registry it is refused there; holding the pre-rotation registry it is refused at the
++ * head. There is no third choice. ONE rotation makes the chain permanently unjoinable.
 + *
 + * 
        This is the lesson Cosmos ADR-016 writes down explicitly: a rotation scheme has to keep the
 + * MAPPING FROM HEIGHT TO KEY SET, not only the current key set, or blocks signed under the old set
@@ -19217,6 +26899,8 @@ index 000000000..7868c88de
 + * that the schedule really does express rotation and really does refuse a malformed one, so a
 + * failure of the two measurements cannot be blamed on the fixture.
 + */
++// The D-081 label is our internal finding id. It names a fact about this
++// code, not anything outside it.
 +public class PqRegistryRotationTest {
 +
 +  private static final long CHAIN_ID = 2800L;
@@ -19327,7 +27011,7 @@ index 000000000..7868c88de
 +    } catch (final IOException e) {
 +      throw new IllegalStateException(e);
 +    }
-+    return PqRegistryHash.parseSchedule(node, "rotation fixture");
++    return PqRegistryHash.parseSchedule(node, "D-081 fixture");
 +  }
 +
 +  /** Every height at which the binding is enforced and could differ across the rotation. */
@@ -19357,7 +27041,7 @@ index 000000000..7868c88de
 +  }
 +
 +  /**
-+   * THE REPAIR: the node holds the WHOLE scheduled history and resolves by height. This
++   * D-081 repair: the node holds the WHOLE scheduled history and resolves by height. This
 +   * configuration did not exist before the repair, which is why the assertion below could not be
 +   * satisfied by any node at all.
 +   */
@@ -19418,7 +27102,7 @@ index 000000000..7868c88de
 +    final String json =
 +        "[{\"block\":" + H2 + ",\"hash\":\"0x" + h + "\"},{\"block\":" + H1 + ",\"hash\":\"0x" + h + "\"}]";
 +    final JsonNode node = new ObjectMapper().readTree(json);
-+    assertThatThrownBy(() -> PqRegistryHash.parseSchedule(node, "rotation fixture"))
++    assertThatThrownBy(() -> PqRegistryHash.parseSchedule(node, "D-081 fixture"))
 +        .isInstanceOf(PqRegistryHash.RegistryConfigException.class)
 +        .hasMessageContaining("STRICTLY INCREASING");
 +  }
@@ -19458,10 +27142,16 @@ index 000000000..7868c88de
 +
 +    assertThat(complete)
 +        .withFailMessage(
-+            "ROTATION UNUSABLE: one scheduled rotation at height %d leaves NO node configuration "
-+                + "that satisfies the registry binding at every enforced height. %s. A rotation "
-+                + "scheme must keep the whole HEIGHT-TO-KEY-SET mapping loadable, not only the "
-+                + "current entry.",
++            "ROTATION IS NOT USABLE: one scheduled rotation at height %d leaves NO node configuration "
++                + "that "
++                + "satisfies the registry binding at every enforced height. %s. A node that cannot "
++                + "satisfy the binding at a height cannot import a header at that height "
++                + "(PqRegistryBindingRule is DETACHED, so it runs on the header-download path), and "
++                + "PqAnchorSyncModeGuard forces FULL sync when the anchor is armed, so every node "
++                + "acquiring history must pass through the pre-rotation interval AND reach the head. "
++                + "Using the rotation mechanism once therefore makes the chain permanently "
++                + "unjoinable. A rotation scheme must keep the whole HEIGHT-TO-KEY-SET mapping "
++                + "loadable, not only the current entry.",
 +            H2,
 +            String.join("; ", report))
 +        .isNotNull();
@@ -19500,9 +27190,10 @@ index 000000000..7868c88de
 +
 +    assertThat(complete)
 +        .withFailMessage(
-+            "REVOCATION UNUSABLE: revoking one compromised signer at height %d leaves NO node "
++            "REVOCATION IS NOT USABLE: revoking one signer at height %d leaves NO node "
 +                + "configuration that satisfies the binding at every enforced height. %s. The "
-+                + "revocation is expressible and is not usable.",
++                + "revocation is expressible and is not usable: performing it costs the ability to "
++                + "acquire the chain.",
 +            H2,
 +            String.join("; ", report))
 +        .isNotNull();
@@ -19574,8 +27265,7 @@ index 000000000..7868c88de
 +    // Registry objects the test built itself. No operator can do that. What an operator can do is
 +    // write a comma-separated list of FILE PATHS into aere.falcon.registry.history, and the node
 +    // turns that string into the same set through parseRegistryPaths + loadAuto
-+    // (FalconSealSupport.verifyRegistryBindingOrAbort, the registry-binding block). If that route
-+    // were broken
++    // (FalconSealSupport.verifyRegistryBindingOrAbort, the D-081 block). If that route were broken
 +    // the other six would still be green and the capability would still not be usable, which is the
 +    // exact shape of "a green result in a reduced environment is true and worthless".
 +    //
@@ -19608,9 +27298,10 @@ index 000000000..7868c88de
 +    }
 +    assertThat(refused)
 +        .withFailMessage(
-+            "ROTATION UNUSABLE on the route an operator can actually take: the history list %s "
-+                + "parses and loads, and the resulting set is still refused at %s. The library can "
-+                + "express the whole height-to-key-set mapping but the configuration string cannot reach "
++            "ROTATION IS NOT USABLE on the route an operator can actually take: the history list %s "
++                + "parses "
++                + "and loads, and the resulting set is still refused at %s. The library can express "
++                + "the whole height-to-key-set mapping but the configuration string cannot reach "
 +                + "it, so the rotation remains expressible and not usable.",
 +            configured, refused)
 +        .isEmpty();
@@ -19629,14 +27320,147 @@ index 000000000..7868c88de
 +    assertThat(PqRegistryHash.matchesAt(schedule, partial, H1, CHAIN_ID)).isFalse();
 +  }
 +}
+diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqSchemeScheduleTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqSchemeScheduleTest.java
+new file mode 100755
+index 000000000..41e03e825
+--- /dev/null
++++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqSchemeScheduleTest.java
+@@ -0,0 +1,127 @@
++/* AERE crypto-agility, step 5 proofs. The D-147 control is the one that matters: the dangerous
++ * step hides at the END of the schedule, and the gate must walk all of it. */
++package org.hyperledger.besu.consensus.common.bft;
++
++import static org.assertj.core.api.Assertions.assertThat;
++import static org.assertj.core.api.Assertions.assertThatThrownBy;
++
++import java.security.SecureRandom;
++import java.util.Properties;
++import java.util.Set;
++
++import org.apache.tuweni.bytes.Bytes;
++import org.hyperledger.besu.crypto.SecureRandomProvider;
++import org.junit.jupiter.api.Test;
++
++class PqSchemeScheduleTest {
++
++  private static final String FALCON = "falcon-512";
++  private static final String SLHDSA = "slh-dsa-128s";
++
++  private final SecureRandom random = SecureRandomProvider.createSecureRandom();
++
++  // ------------------------------------------------------------------ parse + schemesAt
++
++  @Test
++  void schedulesParseAndAnswerByHeight() {
++    final PqSchemeSchedule orar =
++        PqSchemeSchedule.parse("100:falcon-512,200:falcon-512+slh-dsa-128s");
++    assertThat(orar.schemesAt(99)).isEmpty(); // inainte de prima treapta: v2 nearmat
++    assertThat(orar.schemesAt(100)).containsExactlyInAnyOrder(FALCON); // exact pe granita
++    assertThat(orar.schemesAt(150)).containsExactlyInAnyOrder(FALCON);
++    assertThat(orar.schemesAt(200)).containsExactlyInAnyOrder(FALCON, SLHDSA); // hibridul
++    assertThat(orar.schemesAt(1_000_000)).containsExactlyInAnyOrder(FALCON, SLHDSA);
++  }
++
++  // ------------------------------------------------------------------ refuzuri de parse
++
++  @Test
++  void unknownSchemeAnywhereRefusesTheWholeSchedule() {
++    assertThatThrownBy(() -> PqSchemeSchedule.parse("100:falcon-512,200:dilithium-notyet"))
++        .isInstanceOf(IllegalArgumentException.class)
++        .hasMessageContaining("dilithium-notyet");
++  }
++
++  @Test
++  void nonIncreasingHeightsRefuse() {
++    assertThatThrownBy(() -> PqSchemeSchedule.parse("200:falcon-512,100:falcon-512"))
++        .isInstanceOf(IllegalArgumentException.class)
++        .hasMessageContaining("strictly increase");
++    assertThatThrownBy(() -> PqSchemeSchedule.parse("200:falcon-512,200:slh-dsa-128s"))
++        .isInstanceOf(IllegalArgumentException.class)
++        .hasMessageContaining("strictly increase");
++  }
++
++  @Test
++  void emptyAndMalformedStepsRefuse() {
++    assertThatThrownBy(() -> PqSchemeSchedule.parse("")).isInstanceOf(IllegalArgumentException.class);
++    assertThatThrownBy(() -> PqSchemeSchedule.parse("100")).isInstanceOf(IllegalArgumentException.class);
++    assertThatThrownBy(() -> PqSchemeSchedule.parse("abc:falcon-512"))
++        .isInstanceOf(IllegalArgumentException.class);
++    assertThatThrownBy(() -> PqSchemeSchedule.parse("100:"))
++        .isInstanceOf(IllegalArgumentException.class);
++    assertThatThrownBy(() -> PqSchemeSchedule.parse("100:falcon-512+falcon-512"))
++        .isInstanceOf(IllegalArgumentException.class)
++        .hasMessageContaining("repeats");
++    assertThatThrownBy(() -> PqSchemeSchedule.parse("-5:falcon-512"))
++        .isInstanceOf(IllegalArgumentException.class);
++  }
++
++  // ------------------------------------------------------------- poarta de armare (D-147)
++
++  private HybridSignerRegistry registruCuAcoperire(final int falconi, final int slhuri) {
++    final Properties p = new Properties();
++    final int count = Math.max(falconi, Math.max(slhuri, 1));
++    p.setProperty("formatVersion", "hybrid-1");
++    p.setProperty("chainId", "2800");
++    p.setProperty("count", String.valueOf(count));
++    for (int i = 0; i < count; i++) {
++      p.setProperty(i + ".addr", "0x" + String.format("%040x", 0xB0 + i));
++      // fiecare index primeste macar o cheie; acoperirea per schema e controlata mai jos
++      if (i < falconi) {
++        p.setProperty(i + ".key." + FALCON,
++            Bytes.wrap(SealSchemes.FALCON_512.generate(random).publicRegistryForm()).toHexString());
++      }
++      if (i < slhuri) {
++        p.setProperty(i + ".key." + SLHDSA,
++            Bytes.wrap(SealSchemes.SLH_DSA_128S.generate(random).publicRegistryForm()).toHexString());
++      }
++      if (i >= falconi && i >= slhuri) {
++        p.setProperty(i + ".key." + FALCON,
++            Bytes.wrap(SealSchemes.FALCON_512.generate(random).publicRegistryForm()).toHexString());
++      }
++    }
++    return HybridSignerRegistry.fromProperties(p, "test");
++  }
++
++  @Test
++  void armabilityGateWalksTheWholeScheduleNotJustTheFirstStep() {
++    // the registry: 3 validators with Falcon, only 1 with SLH-DSA
++    final HybridSignerRegistry reg = registruCuAcoperire(3, 1);
++    // treapta PERICULOASA e ULTIMA: hibridul cere SLH-DSA cu acoperire 1 < K=3
++    final PqSchemeSchedule orar =
++        PqSchemeSchedule.parse("100:falcon-512,999999:falcon-512+slh-dsa-128s");
++    final var refusal = orar.firstUnsatisfied(reg, 3);
++    assertThat(refusal).isPresent();
++    assertThat(refusal.get()).contains("999999").contains(SLHDSA).contains("covers only 1");
++  }
++
++  @Test
++  void armabilityPassesWhenEverySchemeHasCoverage() {
++    final HybridSignerRegistry reg = registruCuAcoperire(3, 3);
++    final PqSchemeSchedule orar =
++        PqSchemeSchedule.parse("100:falcon-512,200:falcon-512+slh-dsa-128s");
++    assertThat(orar.firstUnsatisfied(reg, 3)).isEmpty();
++    // and the same gate's negative control: an impossible threshold must refuse
++    assertThat(orar.firstUnsatisfied(reg, 4)).isPresent();
++  }
++
++  @Test
++  void beforeTheFirstStepMeansLegacyNotSomeDefaultScheme() {
++    final PqSchemeSchedule orar = PqSchemeSchedule.parse("500:falcon-512");
++    assertThat(orar.schemesAt(0)).isEmpty();
++    assertThat(orar.schemesAt(499)).isEmpty();
++    assertThat(orar.steps()).hasSize(1);
++    assertThat(orar.steps().get(0).schemeIds()).isEqualTo(Set.of(FALCON));
++  }
++}
 diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqSealPersistenceTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqSealPersistenceTest.java
 new file mode 100755
-index 000000000..8967ff3e7
+index 000000000..f0ffc4cab
 --- /dev/null
 +++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqSealPersistenceTest.java
-@@ -0,0 +1,621 @@
+@@ -0,0 +1,652 @@
 +/*
-+ * Copyright contributors to Besu / Aere Network.
++ * Copyright contributors to Besu / AERE Network.
 + *
 + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
 + * the License. You may obtain a copy of the License at
@@ -19693,15 +27517,15 @@ index 000000000..8967ff3e7
 +import org.mockito.quality.Strictness;
 +
 +/**
-+ * THE SECOND HALF OF THE FLEET-RESTART CHAIN DEATH: the heard seals themselves.
++ * D-141. THE SECOND HALF OF THE FLEET-RESTART CHAIN DEATH: the heard seals themselves.
 + *
 + * 
        MEASURED ON A NETWORK FIRST, NOT ASSUMED. With the anchor armed at K>0, a SIMULTANEOUS
-+ * restart of all seven validators kills the chain permanently, measured on an isolated rehearsal
-+ * network. The FIRST half of that deadlock was the registry, repaired the same day: it now
-+ * activates at start-up from chain-head state, and all seven nodes reported
-+ * "anchor activation at STARTUP from head state: SUCCEEDED". The chain died anyway. The refusal
-+ * only changed shape, from "registry address-bound=false" to "registry address-bound=TRUE ...
-+ * Heard 0 seal(s)", frozen 150 s then 298 s.
++ * restart of all seven validators kills the chain permanently (rehearsal
++ * repetitie-activare-2026-08-05, isolated chain 330858). The FIRST half of that deadlock was the
++ * registry, repaired the same day: it now activates at start-up from chain-head state, and all
++ * seven nodes reported "anchor activation at STARTUP from head state: SUCCEEDED". The chain died
++ * anyway. The refusal only changed shape, from "registry address-bound=false" to "registry
++ * address-bound=TRUE ... Heard 0 seal(s)", frozen 150 s then 298 s.
 + *
 + * 
        THE SECOND CIRCLE. The Falcon seals over M(head) travel on nothing but the Commit messages of
 + * the head block, and those are never replayed after a restart. They exist nowhere else: the head's
@@ -19737,6 +27561,8 @@ index 000000000..8967ff3e7
 + * real simultaneous restart with a binary built from this tree. That needs the rehearsal network and
 + * is separate evidence. This class measures every decision that recovery depends on.
 + */
++// The D-141 label is our internal finding id. It names a fact about this
++// code, not anything outside it.
 +public class PqSealPersistenceTest {
 +
 +  /** Anchor activation height H. */
@@ -19748,7 +27574,7 @@ index 000000000..8967ff3e7
 +  /** Height from which the staged threshold K is in force. */
 +  private static final long K_AT = H + 10L;
 +
-+  /** The threshold with full margin at N=7: K=3, so the margin equals f. */
++  /** The founder's decision of 2026-08-05: N=7 stays, and K=3 is the value with full margin. */
 +  private static final int K = 3;
 +
 +  private static final int N = 7;
@@ -19773,7 +27599,7 @@ index 000000000..8967ff3e7
 +  public void setUp() throws Exception {
 +    dataDirectory = Files.createDirectories(tmp.resolve("besu-data"));
 +
-+    // REGISTRY BINDING: v2, proof-bound, bound at H. See PqV2Fixture.
++    // AERE D-146 (2026-08-06): v2, proof-bound, bound at H. See PqV2Fixture.
 +    final KeccakDigest kd = new KeccakDigest(256);
 +    final StringBuilder manifest =
 +        new StringBuilder("{\"config\":{\"aereFalconRegistry\":{")
@@ -19894,8 +27720,8 @@ index 000000000..8967ff3e7
 +  /**
 +   * Persisting seals is only defensible because a seal is SELF-AUTHENTICATING: it is re-verified at
 +   * read, against the anchored registry, over M rebuilt from the head this process just loaded. If
-+   * that were not so, the file would be exactly the unbound-registry defect in another coat -
-+   * state believed because it sits in a file a node can be pointed at.
++   * that were not so, the file would be exactly defect A8 in another coat - state believed because
++   * it sits in a file a node can be pointed at.
 +   *
 +   * 
        Three shapes of forgery are in the one file, because "a forged seal" is not one thing:
 +   *
@@ -20255,13 +28081,42 @@ index 000000000..8967ff3e7
 +    f.setAccessible(true);
 +    f.set(null, null);
 +  }
++
++  /**
++   * D-330 (2026-09-03, testnet 28001): the main file followed the highest height HEARD, which was a
++   * proposal that never imported (168032), so after a fleet-wide restart no node held the seals of
++   * the head (168031). The previous slot keeps them one height longer.
++   */
++  @Test
++  public void theSealsOfTheHeadSurviveTheStoreMovingToALaterHeightThatNeverImported() {
++    PqSealCache.instance().enablePersistence(dataDirectory, CHAIN_ID);
++    for (int i = 0; i < K; i++) {
++      PqSealCache.instance().record(head.getNumber(), head.getHash(), List.of(genuineSeal(i)));
++    }
++    // the fleet now hears commits for a NEXT block that will never import
++    final BlockHeader next = new BlockHeaderTestFixture().number(head.getNumber() + 1L).buildHeader();
++    final Bytes32 mNext = PqAnchor.commitMessage(CHAIN_ID, next.getNumber(), next.getHash().getBytes());
++    final FalconSigner signer = new FalconSigner();
++    signer.init(true, privateKeys.get(0));
++    PqSealCache.instance()
++        .record(next.getNumber(), next.getHash(),
++            List.of(new FalconSeal(0, Bytes.wrap(signer.generateSignature(mNext.toArray())))));
++    assertThat(PqSealStore.previousFileIn(dataDirectory)).describedAs("the previous slot exists after the rotation").exists();
++    // restart: memory gone, the main file holds the never-imported height
++    PqSealCache.instance().clear();
++    final int restored =
++        PqSealCache.instance()
++            .restoreFromDisk(head.getNumber(), head.getHash(), PqSignerRegistry.falconSealSupport());
++    assertThat(restored).describedAs("the head's seals come back from the previous slot").isEqualTo(K);
++    assertThat(PqAnchorProducer.apply(base, head, context).getFalconSeals()).hasSize(K);
++  }
 +}
 diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqSignedHeightTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqSignedHeightTest.java
 new file mode 100755
-index 000000000..fc1333f15
+index 000000000..8122465d0
 --- /dev/null
 +++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqSignedHeightTest.java
-@@ -0,0 +1,403 @@
+@@ -0,0 +1,402 @@
 +/*
 + * Copyright contributors to Besu.
 + *
@@ -20300,7 +28155,7 @@ index 000000000..fc1333f15
 +import org.junit.jupiter.api.io.TempDir;
 +
 +/**
-+ * AERE SIGNED HEIGHT. THE SILENT DEFERRAL, and it is the worst of the three because nothing shows
++ * AERE D-B (2026-08-06). THE SILENT DEFERRAL, and it is the worst of the three because nothing shows
 + * it.
 + *
 + * 
        WHAT IS SUPPOSED TO BE TRUE. Every row of a v2 registry carries two signatures - a Falcon
@@ -20310,8 +28165,7 @@ index 000000000..fc1333f15
 + *
 + * 
        WHAT WAS ACTUALLY TRUE UNTIL THIS FILE. {@code bindHeight} was never compared with the {@code
 + * block} of the schedule entry that puts the registry in force. Not anywhere. The two numbers had
-+ * been in the same lexical scope ever since the schedule became height-indexed, and were never put
-+ * on the same expression.
++ * been in the same lexical scope since D-081 and were never put on the same expression.
 + *
 + * 
        WHY THE HASH DOES NOT CATCH IT, which is the part that makes this invisible rather than merely
 + * missing. {@code bindHeight} is INSIDE the v2 pre-image, so it is covered by the hash - and that is
@@ -20561,7 +28415,7 @@ index 000000000..fc1333f15
 +        // The honest limitation has to be IN the message, or an operator will read this as a
 +        // consensus guarantee it is not.
 +        .hasMessageContaining("DETECTION on this node only")
-+        .hasMessageContaining("all seven nodes and in the same change");
++        .hasMessageContaining("on every node and in the same change");
 +  }
 +
 +  @Test
@@ -20667,10 +28521,10 @@ index 000000000..fc1333f15
 +}
 diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqStartupHistoryTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqStartupHistoryTest.java
 new file mode 100755
-index 000000000..705838dcf
+index 000000000..4826779da
 --- /dev/null
 +++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqStartupHistoryTest.java
-@@ -0,0 +1,325 @@
+@@ -0,0 +1,324 @@
 +/*
 + * Copyright contributors to Besu.
 + *
@@ -20706,7 +28560,7 @@ index 000000000..705838dcf
 +import org.junit.jupiter.api.io.TempDir;
 +
 +/**
-+ * AERE ROTATION HISTORY AT STARTUP. AFTER THE FIRST ROTATION, NO NODE COULD BE RESTARTED WITH ITS OWN CORRECT
++ * AERE D-A (2026-08-06). AFTER THE FIRST ROTATION, NO NODE COULD BE RESTARTED WITH ITS OWN CORRECT
 + * CONFIGURATION.
 + *
 + * 
        WHAT WAS MEASURED, and it was measured twice: once during the rotation rehearsal on a network
@@ -20718,9 +28572,8 @@ index 000000000..705838dcf
 + * 
        THE DEFECT WAS THE ORDER OF TWO BLOCKS OF CODE. {@code
 + * FalconSealSupport.verifyRegistryBindingOrAbort} loaded ONE registry, the primary, and handed it to
 + * the guard. The history list was read FORTY-ONE LINES FURTHER DOWN, to build the height-resolved
-+ * set the height-indexed registry change introduced. So the refusal was thrown before the code that
-+ * knew the answer had run. The guard was not wrong about what it compared; it was never shown the
-+ * other files.
++ * set D-081 introduced. So the refusal was thrown before the code that knew the answer had run. The
++ * guard was not wrong about what it compared; it was never shown the other files.
 + *
 + * 
        WHY IT BITES EXACTLY AFTER A ROTATION AND NEVER BEFORE. The primary registry is the genesis
 + * manifest, and genesis does not change. A rotation adds a SECOND entry to {@code
@@ -20998,10 +28851,10 @@ index 000000000..705838dcf
 +}
 diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqV2Fixture.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqV2Fixture.java
 new file mode 100755
-index 000000000..2c7108f4d
+index 000000000..4fb9529b3
 --- /dev/null
 +++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqV2Fixture.java
-@@ -0,0 +1,233 @@
+@@ -0,0 +1,232 @@
 +/*
 + * Copyright contributors to Besu.
 + *
@@ -21041,13 +28894,13 @@ index 000000000..2c7108f4d
 +import org.bouncycastle.pqc.crypto.falcon.FalconSigner;
 +
 +/**
-+ * AERE REGISTRY BINDING (2026-08-06). The shared probe fleet every arming fixture is now built
-+ * from, and the reason it had to exist.
++ * AERE D-146 (2026-08-06). The shared probe fleet every arming fixture is now built from, and the
++ * reason it had to exist.
 + *
 + * 
        WHAT IT REPLACED, and why the replacement is not cosmetic. Until 2026-08-06 seven separate
 + * fixtures built their registries around addresses spelled {@code String.format("0x%040x", 0xA00 +
 + * i)}. Those addresses are arithmetic, not keys: no secp256k1 private key produces them, so no
-+ * validator can ever sign a binding claim for one. The moment {@code AERE-PQC-REG-ARM-02} was wired
++ * validator can ever sign a D-146 claim for one. The moment {@code AERE-PQC-REG-ARM-02} was wired
 + * into {@code FalconSealSupport}, all seven fixtures described a fleet that CANNOT EXIST - armed,
 + * and provably unable to produce the registry the arming path now requires. Measured on 2026-08-06:
 + * 35 tests across 7 classes, every failure carrying AERE-PQC-REG-ARM-02.
@@ -21219,9 +29072,8 @@ index 000000000..2c7108f4d
 +
 +  /**
 +   * The bytes the genesis anchor slot commits to for row {@code i}: {@code address || publicKey},
-+   * which is what {@code hashV0Legacy} accumulates. Unchanged by the v2 binding work - the proofs
-+   * are outside the legacy pre-image - and kept here so a fixture cannot drift from the row it just
-+   * wrote.
++   * which is what {@code hashV0Legacy} accumulates. Unchanged by D-146 - the proofs are outside the
++   * legacy pre-image - and kept here so a fixture cannot drift from the row it just wrote.
 +   *
 +   * @param i the row index
 +   * @return the anchored pre-image bytes for that row
@@ -21235,11 +29087,738 @@ index 000000000..2c7108f4d
 +    return out;
 +  }
 +}
+diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PreparePqAttachGateTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PreparePqAttachGateTest.java
+new file mode 100755
+index 000000000..516897846
+--- /dev/null
++++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PreparePqAttachGateTest.java
+@@ -0,0 +1,101 @@
++/*
++ * Copyright contributors to Besu.
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
++ * the License. You may obtain a copy of the License at
++ *
++ * http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
++ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
++ * specific language governing permissions and limitations under the License.
++ *
++ * SPDX-License-Identifier: Apache-2.0
++ */
++package org.hyperledger.besu.consensus.common.bft;
++
++import static org.assertj.core.api.Assertions.assertThat;
++import static org.assertj.core.api.Assertions.assertThatThrownBy;
++
++import org.apache.tuweni.bytes.Bytes32;
++import org.junit.jupiter.api.AfterEach;
++import org.junit.jupiter.api.Test;
++
++/**
++ * THE GATE that emits a seal on PREPARE (step 2 of the 2026-08-28 design note).
++ *
++ * 
        What is measured here is the CONFIGURATION SURFACE, which is exactly the part that gets typed
++ * by hand and therefore mistyped: absent means never, a good value means from that height onwards,
++ * and a MISTYPED value refuses loudly instead of booting the node disarmed. The lesson paid for in
++ * the anchor loader is that a stray character must never disarm silently, because then nobody finds
++ * out.
++ *
++ * 
        What is NOT measured here, and it is said plainly: that an ARMED node actually produces a
++ * seal. That needs a Falcon key and a registry bound to addresses, which means a network; it is
++ * measured at the coverage step, on a testnet. What is proven here is that the gate is closed by
++ * default and cannot be opened by accident.
++ */
++class PreparePqAttachGateTest {
++
++  @AfterEach
++  void clearTheProperty() {
++    System.clearProperty(FalconSealSupport.PREPARE_ATTACH_PROPERTY);
++  }
++
++  @Test
++  void withoutThePropertyTheGateIsClosedForever() {
++    assertThat(FalconSealSupport.prepareAttachBlock()).isEqualTo(Long.MAX_VALUE);
++  }
++
++  @Test
++  void aGoodValueIsReadAsGiven() {
++    System.setProperty(FalconSealSupport.PREPARE_ATTACH_PROPERTY, "16500000");
++    assertThat(FalconSealSupport.prepareAttachBlock()).isEqualTo(16_500_000L);
++  }
++
++  @Test
++  void zeroIsALEGALValue() {
++    // A threshold of zero means "from genesis", and that is a legitimate configuration on a
++    // testnet. Treated as "unset", a correctly configured testnet would run disarmed in silence.
++    System.setProperty(FalconSealSupport.PREPARE_ATTACH_PROPERTY, "0");
++    assertThat(FalconSealSupport.prepareAttachBlock()).isZero();
++  }
++
++  @Test
++  void aMISTYPEDValueRefusesLoudly() {
++    for (final String bad : new String[] {"nu-e-numar", "16_500_000", "1e6", "-1", "  "}) {
++      System.setProperty(FalconSealSupport.PREPARE_ATTACH_PROPERTY, bad);
++      if (bad.isBlank()) {
++        // whitespace is "unset", not a mistyped value: an empty field in a configuration file
++        // must not stop a node
++        assertThat(FalconSealSupport.prepareAttachBlock()).isEqualTo(Long.MAX_VALUE);
++        continue;
++      }
++      assertThatThrownBy(FalconSealSupport::prepareAttachBlock)
++          .as("the value '%s'", bad)
++          .isInstanceOf(FalconSealSupport.ActivationConfigException.class)
++          .hasMessageContaining("AERE-PQC-PREPARE-CONF-01");
++    }
++  }
++
++  @Test
++  void withNoKeyNothingIsSignedEvenWithTheGateOpen() {
++    // The gate is open from genesis and still nothing comes out: the node has no Falcon key. That
++    // is precisely the condition that makes the binary safe to roll onto the fleet before any
++    // decision is taken.
++    System.setProperty(FalconSealSupport.PREPARE_ATTACH_PROPERTY, "0");
++    assertThat(FalconSealSupport.instance().signPrepare(1L, Bytes32.ZERO)).isEmpty();
++  }
++
++  @Test
++  void thePREPAREGateIsNotTheCOMMITGate() {
++    // If it were the same one, rolling the binary onto the fleet would become a flag day: PREPARE
++    // emission would start the moment commit emission does, and that one is already on since block
++    // 13,889,296 on chain 2800.
++    assertThat(FalconSealSupport.PREPARE_ATTACH_PROPERTY).isNotEqualTo("aere.falcon.attachBlock");
++    System.setProperty(FalconSealSupport.PREPARE_ATTACH_PROPERTY, "16500000");
++    assertThat(FalconSealSupport.prepareAttachBlock()).isEqualTo(16_500_000L);
++    // the commit property stays untouched by the PREPARE one
++    assertThat(System.getProperty("aere.falcon.attachBlock")).isNull();
++  }
++}
+diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/ProposalPqAttachGateTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/ProposalPqAttachGateTest.java
+new file mode 100755
+index 000000000..00c8eacf9
+--- /dev/null
++++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/ProposalPqAttachGateTest.java
+@@ -0,0 +1,104 @@
++/*
++ * Copyright contributors to Besu.
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
++ * the License. You may obtain a copy of the License at
++ *
++ * http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
++ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
++ * specific language governing permissions and limitations under the License.
++ *
++ * SPDX-License-Identifier: Apache-2.0
++ */
++package org.hyperledger.besu.consensus.common.bft;
++
++import static org.assertj.core.api.Assertions.assertThat;
++import static org.assertj.core.api.Assertions.assertThatThrownBy;
++
++import org.apache.tuweni.bytes.Bytes32;
++import org.junit.jupiter.api.AfterEach;
++import org.junit.jupiter.api.Test;
++
++/**
++ * THE GATE that emits a seal on the PROPOSAL (AERE PQ, 2026-08-30). Twin of the PREPARE gate,
++ * with the same shape on purpose.
++ *
++ * 
        What is measured here is the CONFIGURATION SURFACE, which is exactly the part that gets typed
++ * by hand and therefore mistyped: absent means never, a good value means from that height onwards,
++ * and a MISTYPED value refuses loudly instead of booting the node disarmed. The lesson paid for in
++ * the anchor loader is that a stray character must never disarm silently, because then nobody finds
++ * out.
++ *
++ * 
        What is NOT measured here, and it is said plainly: that an ARMED node actually produces a
++ * seal. That needs a Falcon key and a registry bound to addresses, which means a network; it is
++ * measured at the coverage step, on a testnet. What is proven here is that the gate is closed by
++ * default and cannot be opened by accident.
++ */
++class ProposalPqAttachGateTest {
++
++  @AfterEach
++  void clearTheProperty() {
++    System.clearProperty(FalconSealSupport.PROPOSAL_ATTACH_PROPERTY);
++  }
++
++  @Test
++  void withoutThePropertyTheGateIsClosedForever() {
++    assertThat(FalconSealSupport.proposalAttachBlock()).isEqualTo(Long.MAX_VALUE);
++  }
++
++  @Test
++  void aGoodValueIsReadAsGiven() {
++    System.setProperty(FalconSealSupport.PROPOSAL_ATTACH_PROPERTY, "16500000");
++    assertThat(FalconSealSupport.proposalAttachBlock()).isEqualTo(16_500_000L);
++  }
++
++  @Test
++  void zeroIsALEGALValue() {
++    // A threshold of zero means "from genesis", and that is a legitimate configuration on a
++    // testnet. Treated as "unset", a correctly configured testnet would run disarmed in silence.
++    System.setProperty(FalconSealSupport.PROPOSAL_ATTACH_PROPERTY, "0");
++    assertThat(FalconSealSupport.proposalAttachBlock()).isZero();
++  }
++
++  @Test
++  void aMISTYPEDValueRefusesLoudly() {
++    for (final String bad : new String[] {"nu-e-numar", "16_500_000", "1e6", "-1", "  "}) {
++      System.setProperty(FalconSealSupport.PROPOSAL_ATTACH_PROPERTY, bad);
++      if (bad.isBlank()) {
++        // whitespace is "unset", not a mistyped value: an empty field in a configuration file
++        // must not stop a node
++        assertThat(FalconSealSupport.proposalAttachBlock()).isEqualTo(Long.MAX_VALUE);
++        continue;
++      }
++      assertThatThrownBy(FalconSealSupport::proposalAttachBlock)
++          .as("the value '%s'", bad)
++          .isInstanceOf(FalconSealSupport.ActivationConfigException.class)
++          .hasMessageContaining("AERE-PQC-PROPOSAL-CONF-01");
++    }
++  }
++
++  @Test
++  void withNoKeyNothingIsSignedEvenWithTheGateOpen() {
++    // The gate is open from genesis and still nothing comes out: the node has no Falcon key. That
++    // is precisely the condition that makes the binary safe to roll onto the fleet before any
++    // decision is taken.
++    System.setProperty(FalconSealSupport.PROPOSAL_ATTACH_PROPERTY, "0");
++    assertThat(FalconSealSupport.instance().signProposal(1L, Bytes32.ZERO)).isEmpty();
++  }
++
++  @Test
++  void thePROPOSALGateIsNotThePREPAREOrCOMMITGate() {
++    // Three layers, three switches. If any two shared one, the day one is turned on would become a
++    // flag day for the other - and commit emission is already on since block 13,889,296 on 2800.
++    assertThat(FalconSealSupport.PROPOSAL_ATTACH_PROPERTY).isNotEqualTo("aere.falcon.attachBlock");
++    assertThat(FalconSealSupport.PROPOSAL_ATTACH_PROPERTY)
++        .isNotEqualTo(FalconSealSupport.PREPARE_ATTACH_PROPERTY);
++    System.setProperty(FalconSealSupport.PROPOSAL_ATTACH_PROPERTY, "16500000");
++    assertThat(FalconSealSupport.proposalAttachBlock()).isEqualTo(16_500_000L);
++    // the commit and PREPARE properties stay untouched by the PROPOSAL one
++    assertThat(System.getProperty("aere.falcon.attachBlock")).isNull();
++    assertThat(System.getProperty(FalconSealSupport.PREPARE_ATTACH_PROPERTY)).isNull();
++  }
++}
+diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/RoundChangePqAttachGateTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/RoundChangePqAttachGateTest.java
+new file mode 100755
+index 000000000..19c105568
+--- /dev/null
++++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/RoundChangePqAttachGateTest.java
+@@ -0,0 +1,108 @@
++/*
++ * Copyright contributors to Besu.
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
++ * the License. You may obtain a copy of the License at
++ *
++ * http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
++ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
++ * specific language governing permissions and limitations under the License.
++ *
++ * SPDX-License-Identifier: Apache-2.0
++ */
++package org.hyperledger.besu.consensus.common.bft;
++
++import static org.assertj.core.api.Assertions.assertThat;
++import static org.assertj.core.api.Assertions.assertThatThrownBy;
++
++import org.apache.tuweni.bytes.Bytes32;
++import org.junit.jupiter.api.AfterEach;
++import org.junit.jupiter.api.Test;
++
++/**
++ * THE GATE that emits a seal on the ROUND-CHANGE (AERE PQ, 2026-08-31). Twin of the PREPARE and
++ * PROPOSAL gates, with the same shape on purpose.
++ *
++ * 
        What is measured here is the CONFIGURATION SURFACE, which is exactly the part that gets typed
++ * by hand and therefore mistyped: absent means never, a good value means from that height onwards,
++ * and a MISTYPED value refuses loudly instead of booting the node disarmed. The lesson paid for in
++ * the anchor loader is that a stray character must never disarm silently, because then nobody finds
++ * out.
++ *
++ * 
        What is NOT measured here, and it is said plainly: that an ARMED node actually produces a
++ * seal. That needs a Falcon key, a registry bound to addresses, and a FAILED round to provoke the
++ * message at all, which means a network; it is measured at the coverage step, on a testnet. What is
++ * proven here is that the gate is closed by default and cannot be opened by accident.
++ */
++class RoundChangePqAttachGateTest {
++
++  @AfterEach
++  void clearTheProperty() {
++    System.clearProperty(FalconSealSupport.ROUNDCHANGE_ATTACH_PROPERTY);
++  }
++
++  @Test
++  void withoutThePropertyTheGateIsClosedForever() {
++    assertThat(FalconSealSupport.roundChangeAttachBlock()).isEqualTo(Long.MAX_VALUE);
++  }
++
++  @Test
++  void aGoodValueIsReadAsGiven() {
++    System.setProperty(FalconSealSupport.ROUNDCHANGE_ATTACH_PROPERTY, "16500000");
++    assertThat(FalconSealSupport.roundChangeAttachBlock()).isEqualTo(16_500_000L);
++  }
++
++  @Test
++  void zeroIsALEGALValue() {
++    // A threshold of zero means "from genesis", and that is a legitimate configuration on a
++    // testnet. Treated as "unset", a correctly configured testnet would run disarmed in silence.
++    System.setProperty(FalconSealSupport.ROUNDCHANGE_ATTACH_PROPERTY, "0");
++    assertThat(FalconSealSupport.roundChangeAttachBlock()).isZero();
++  }
++
++  @Test
++  void aMISTYPEDValueRefusesLoudly() {
++    for (final String bad : new String[] {"nu-e-numar", "16_500_000", "1e6", "-1", "  "}) {
++      System.setProperty(FalconSealSupport.ROUNDCHANGE_ATTACH_PROPERTY, bad);
++      if (bad.isBlank()) {
++        // whitespace is "unset", not a mistyped value: an empty field in a configuration file
++        // must not stop a node
++        assertThat(FalconSealSupport.roundChangeAttachBlock()).isEqualTo(Long.MAX_VALUE);
++        continue;
++      }
++      assertThatThrownBy(FalconSealSupport::roundChangeAttachBlock)
++          .as("the value '%s'", bad)
++          .isInstanceOf(FalconSealSupport.ActivationConfigException.class)
++          .hasMessageContaining("AERE-PQC-ROUNDCHANGE-CONF-01");
++    }
++  }
++
++  @Test
++  void withNoKeyNothingIsSignedEvenWithTheGateOpen() {
++    // The gate is open from genesis and still nothing comes out: the node has no Falcon key. That
++    // is precisely the condition that makes the binary safe to roll onto the fleet before any
++    // decision is taken.
++    System.setProperty(FalconSealSupport.ROUNDCHANGE_ATTACH_PROPERTY, "0");
++    assertThat(FalconSealSupport.instance().signRoundChange(1L, Bytes32.ZERO)).isEmpty();
++  }
++
++  @Test
++  void theROUNDCHANGEGateIsNoneOfItsThreeSiblings() {
++    // Four layers, four switches. If any two shared one, the day one is turned on would become a
++    // flag day for the other - and commit emission is already on since block 13,889,296 on 2800.
++    assertThat(FalconSealSupport.ROUNDCHANGE_ATTACH_PROPERTY)
++        .isNotEqualTo("aere.falcon.attachBlock");
++    assertThat(FalconSealSupport.ROUNDCHANGE_ATTACH_PROPERTY)
++        .isNotEqualTo(FalconSealSupport.PREPARE_ATTACH_PROPERTY);
++    assertThat(FalconSealSupport.ROUNDCHANGE_ATTACH_PROPERTY)
++        .isNotEqualTo(FalconSealSupport.PROPOSAL_ATTACH_PROPERTY);
++    System.setProperty(FalconSealSupport.ROUNDCHANGE_ATTACH_PROPERTY, "16500000");
++    assertThat(FalconSealSupport.roundChangeAttachBlock()).isEqualTo(16_500_000L);
++    // the commit, PREPARE and PROPOSAL properties stay untouched by the ROUND-CHANGE one
++    assertThat(System.getProperty("aere.falcon.attachBlock")).isNull();
++    assertThat(System.getProperty(FalconSealSupport.PREPARE_ATTACH_PROPERTY)).isNull();
++    assertThat(System.getProperty(FalconSealSupport.PROPOSAL_ATTACH_PROPERTY)).isNull();
++  }
++}
+diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/SealSchemeAgilityTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/SealSchemeAgilityTest.java
+new file mode 100755
+index 000000000..91ca9bbfb
+--- /dev/null
++++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/SealSchemeAgilityTest.java
+@@ -0,0 +1,145 @@
++/* AERE crypto-agility, step 1 proofs. Every green here has a red twin: flipped signatures,
++ * flipped messages, wrong keys, and the cross-scheme controls that are the whole point of the
++ * layer (a Falcon artefact must never verify as SLH-DSA, and vice versa). A layer whose schemes
++ * cannot be told apart would be worse than no layer. */
++package org.hyperledger.besu.consensus.common.bft;
++
++import static org.assertj.core.api.Assertions.assertThat;
++
++import java.nio.charset.StandardCharsets;
++import java.security.SecureRandom;
++import java.util.Optional;
++
++import org.hyperledger.besu.crypto.SecureRandomProvider;
++import org.junit.jupiter.api.Test;
++
++class SealSchemeAgilityTest {
++
++  private static final byte[] MESSAGE = "aere anchor commit hash stand-in".getBytes(StandardCharsets.UTF_8);
++  private static final byte[] OTHER_MESSAGE = "a different message entirely....".getBytes(StandardCharsets.UTF_8);
++
++  private final SecureRandom random = SecureRandomProvider.createSecureRandom();
++
++  // ------------------------------------------------------------------ per-scheme sign/verify
++
++  @Test
++  void falconSignsAndVerifies() {
++    roundTrip(SealSchemes.FALCON_512);
++  }
++
++  @Test
++  void slhDsaSignsAndVerifies() {
++    roundTrip(SealSchemes.SLH_DSA_128S);
++  }
++
++  private void roundTrip(final SealScheme scheme) {
++    final SealScheme.GeneratedPair pair = scheme.generate(random);
++    final Optional sig = scheme.sign(pair.privateKey(), MESSAGE);
++    assertThat(sig).isPresent();
++    assertThat(scheme.verify(pair.publicKey(), MESSAGE, sig.get())).isTrue();
++    assertThat(scheme.verifyRaw(pair.publicRegistryForm(), MESSAGE, sig.get())).isTrue();
++  }
++
++  // ------------------------------------------------------------------ negative controls
++
++  @Test
++  void flippedSignatureBitIsRejectedByBothSchemes() {
++    for (final SealScheme scheme : SealSchemes.all()) {
++      final SealScheme.GeneratedPair pair = scheme.generate(random);
++      final byte[] sig = scheme.sign(pair.privateKey(), MESSAGE).orElseThrow();
++      sig[sig.length / 2] ^= 0x01;
++      assertThat(scheme.verify(pair.publicKey(), MESSAGE, sig))
++          .as("%s must reject a signature with one flipped bit", scheme.id())
++          .isFalse();
++    }
++  }
++
++  @Test
++  void flippedMessageIsRejectedByBothSchemes() {
++    for (final SealScheme scheme : SealSchemes.all()) {
++      final SealScheme.GeneratedPair pair = scheme.generate(random);
++      final byte[] sig = scheme.sign(pair.privateKey(), MESSAGE).orElseThrow();
++      assertThat(scheme.verify(pair.publicKey(), OTHER_MESSAGE, sig))
++          .as("%s must reject the signature over a different message", scheme.id())
++          .isFalse();
++    }
++  }
++
++  @Test
++  void wrongKeyIsRejectedByBothSchemes() {
++    for (final SealScheme scheme : SealSchemes.all()) {
++      final SealScheme.GeneratedPair signer = scheme.generate(random);
++      final SealScheme.GeneratedPair stranger = scheme.generate(random);
++      final byte[] sig = scheme.sign(signer.privateKey(), MESSAGE).orElseThrow();
++      assertThat(scheme.verify(stranger.publicKey(), MESSAGE, sig))
++          .as("%s must reject a signature under a stranger's key", scheme.id())
++          .isFalse();
++    }
++  }
++
++  // ------------------------------------------------------- the point of the layer: cross-scheme
++
++  @Test
++  void falconArtefactsNeverVerifyAsSlhDsa() {
++    final SealScheme.GeneratedPair falcon = SealSchemes.FALCON_512.generate(random);
++    final byte[] falconSig = SealSchemes.FALCON_512.sign(falcon.privateKey(), MESSAGE).orElseThrow();
++    // the raw Falcon key is not even parseable as an SLH-DSA key (896 vs 32 bytes)...
++    assertThat(SealSchemes.SLH_DSA_128S.parsePublicKey(falcon.publicRegistryForm())).isEmpty();
++    // ...and the raw path must answer false, never throw
++    assertThat(SealSchemes.SLH_DSA_128S.verifyRaw(falcon.publicRegistryForm(), MESSAGE, falconSig)).isFalse();
++    // a Falcon PRIVATE handle fed to the SLH-DSA signer must refuse, not sign garbage
++    assertThat(SealSchemes.SLH_DSA_128S.sign(falcon.privateKey(), MESSAGE)).isEmpty();
++  }
++
++  @Test
++  void slhDsaArtefactsNeverVerifyAsFalcon() {
++    final SealScheme.GeneratedPair slh = SealSchemes.SLH_DSA_128S.generate(random);
++    final byte[] slhSig = SealSchemes.SLH_DSA_128S.sign(slh.privateKey(), MESSAGE).orElseThrow();
++    assertThat(SealSchemes.FALCON_512.parsePublicKey(slh.publicRegistryForm())).isEmpty();
++    assertThat(SealSchemes.FALCON_512.verifyRaw(slh.publicRegistryForm(), MESSAGE, slhSig)).isFalse();
++    assertThat(SealSchemes.FALCON_512.sign(slh.privateKey(), MESSAGE)).isEmpty();
++  }
++
++  @Test
++  void crossSchemeHandlesAreRejectedOnVerifyToo() {
++    final SealScheme.GeneratedPair falcon = SealSchemes.FALCON_512.generate(random);
++    final SealScheme.GeneratedPair slh = SealSchemes.SLH_DSA_128S.generate(random);
++    final byte[] falconSig = SealSchemes.FALCON_512.sign(falcon.privateKey(), MESSAGE).orElseThrow();
++    // a foreign PUBLIC handle on verify: false, never a ClassCastException
++    assertThat(SealSchemes.SLH_DSA_128S.verify(falcon.publicKey(), MESSAGE, falconSig)).isFalse();
++    assertThat(SealSchemes.FALCON_512.verify(slh.publicKey(), MESSAGE, falconSig)).isFalse();
++  }
++
++  // ------------------------------------------------------------------ registry and wire form
++
++  @Test
++  void registryFindsSchemesByIdAndWireTag() {
++    assertThat(SealSchemes.byId("falcon-512")).contains(SealSchemes.FALCON_512);
++    assertThat(SealSchemes.byId("slh-dsa-128s")).contains(SealSchemes.SLH_DSA_128S);
++    assertThat(SealSchemes.byWireId((byte) 0x01)).contains(SealSchemes.FALCON_512);
++    assertThat(SealSchemes.byWireId((byte) 0x02)).contains(SealSchemes.SLH_DSA_128S);
++  }
++
++  @Test
++  void unknownSchemesAreLoudlyAbsentNeverDefaulted() {
++    assertThat(SealSchemes.byId("dilithium-notyet")).isEmpty();
++    assertThat(SealSchemes.byId(null)).isEmpty();
++    // 0x00 is the legacy untagged certificate, deliberately NOT resolvable as a scheme
++    assertThat(SealSchemes.byWireId((byte) 0x00)).isEmpty();
++    assertThat(SealSchemes.byWireId((byte) 0x7f)).isEmpty();
++  }
++
++  @Test
++  void registryFormsHaveTheDocumentedLengths() {
++    // Falcon-512: 896 raw h bytes, the exact form the signer registry stores (measured on the
++    // proof-network registry files). The 897-byte pk(897) = 0x09 || h is the PRECOMPILE input
++    // format, one layer above; the first form of this assertion said 897 and went red, which is
++    // the measurement this comment records. Locking 896 here means a scheme change cannot
++    // silently change what a registry entry means.
++    assertThat(SealSchemes.FALCON_512.publicKeyLength()).isEqualTo(896);
++    assertThat(SealSchemes.FALCON_512.generate(random).publicRegistryForm()).hasSize(896);
++    // SLH-DSA-128s: 32 bytes (PK.seed || PK.root) per FIPS 205.
++    assertThat(SealSchemes.SLH_DSA_128S.publicKeyLength()).isEqualTo(32);
++    assertThat(SealSchemes.SLH_DSA_128S.generate(random).publicRegistryForm()).hasSize(32);
++  }
++}
+diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/SlhDsaCrossVectorTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/SlhDsaCrossVectorTest.java
+new file mode 100755
+index 000000000..00891a0fe
+--- /dev/null
++++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/SlhDsaCrossVectorTest.java
+@@ -0,0 +1,82 @@
++/*
++ * Copyright contributors to Aere Network.
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
++ * compliance with the License. You may obtain a copy of the License at
++ *
++ * http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software distributed under the License is
++ * distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
++ * implied. See the License for the specific language governing permissions and limitations under the
++ * License.
++ *
++ * SPDX-License-Identifier: Apache-2.0
++ */
++package org.hyperledger.besu.consensus.common.bft;
++
++import static org.assertj.core.api.Assertions.assertThat;
++
++import java.io.IOException;
++import java.io.InputStream;
++import java.nio.charset.StandardCharsets;
++import java.util.regex.Matcher;
++import java.util.regex.Pattern;
++
++import org.apache.tuweni.bytes.Bytes;
++import org.junit.jupiter.api.Test;
++
++/**
++ * D-325 (2026-09-03), the CROSS-IMPLEMENTATION vector: an SLH-DSA-SHA2-128s signature produced by the public
++ * verifier's library (@noble/post-quantum 0.7.1, FIPS 205 external form, empty context) must verify under this
++ * fork's {@link SlhDsaSealScheme} (BouncyCastle Java). Two implementations agreeing on one vector is the only
++ * proof that "the same form" is the same form; two self-consistent implementations prove nothing about each other.
++ *
++ * 
        With its pair: the same signature over a message that differs in one bit does NOT verify, and a signature with
++ * one bit flipped does NOT verify. A verifier that accepted everything would pass the positive half alone.
++ */
++class SlhDsaCrossVectorTest {
++
++  private static String field(final String json, final String name) {
++    final Matcher m = Pattern.compile("\"" + name + "\"\\s*:\\s*\"([0-9a-fA-F]+)\"").matcher(json);
++    if (!m.find()) {
++      throw new IllegalStateException("vector has no field " + name);
++    }
++    return m.group(1);
++  }
++
++  private static String vector() throws IOException {
++    try (InputStream in =
++        SlhDsaCrossVectorTest.class.getResourceAsStream("/vector-slh-dsa-noble-2026-09-03.json")) {
++      if (in == null) {
++        throw new IllegalStateException("vector-slh-dsa-noble-2026-09-03.json is not on the test classpath");
++      }
++      return new String(in.readAllBytes(), StandardCharsets.UTF_8);
++    }
++  }
++
++  @Test
++  void aSignatureFromTheJavaScriptImplementationVerifiesHereAndItsTamperedTwinsDoNot() throws IOException {
++    final String v = vector();
++    final byte[] pk = Bytes.fromHexString(field(v, "pk")).toArray();
++    final byte[] msg = Bytes.fromHexString(field(v, "msg")).toArray();
++    final byte[] sig = Bytes.fromHexString(field(v, "sig")).toArray();
++    assertThat(pk).hasSize(32);
++    assertThat(msg).hasSize(32);
++    assertThat(sig).hasSize(7856);
++    final SealScheme scheme = SealSchemes.SLH_DSA_128S;
++    assertThat(scheme.verifyRaw(pk, msg, sig))
++        .describedAs("the @noble/post-quantum signature verifies under BouncyCastle's SLH-DSA-SHA2-128s (external form)")
++        .isTrue();
++    final byte[] otherMsg = msg.clone();
++    otherMsg[0] ^= 0x01;
++    assertThat(scheme.verifyRaw(pk, otherMsg, sig)).describedAs("one message bit flipped").isFalse();
++    final byte[] badSig = sig.clone();
++    badSig[badSig.length / 2] ^= 0x01;
++    assertThat(scheme.verifyRaw(pk, msg, badSig)).describedAs("one signature bit flipped").isFalse();
++    // and the INTERNAL form (what the precompile at 0x0AE4 uses) must NOT be confused with it: a scheme that
++    // accepted both would let a seal stand in for a precompile call or the other way round.
++    assertThat(SealSchemes.byId("slh-dsa-sha2-128s")).isPresent();
++    assertThat(SealSchemes.byId("slh-dsa-128s")).describedAs("the pre-D-325 alias still resolves").isPresent();
++  }
++}
+diff --git a/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/SlhDsaFastEngineTest.java b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/SlhDsaFastEngineTest.java
+new file mode 100755
+index 000000000..d1ca77a67
+--- /dev/null
++++ b/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/SlhDsaFastEngineTest.java
+@@ -0,0 +1,141 @@
++/*
++ * Copyright contributors to Aere Network.
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
++ * compliance with the License. You may obtain a copy of the License at
++ *
++ * http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software distributed under the License is
++ * distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
++ * implied. See the License for the specific language governing permissions and limitations under the
++ * License.
++ *
++ * SPDX-License-Identifier: Apache-2.0
++ */
++package org.hyperledger.besu.consensus.common.bft;
++
++import static org.assertj.core.api.Assertions.assertThat;
++
++import java.nio.charset.StandardCharsets;
++import java.security.SecureRandom;
++import java.util.Arrays;
++import org.bouncycastle.crypto.AsymmetricCipherKeyPair;
++import org.hyperledger.besu.consensus.common.bft.slhdsa.SLHDSAKeyGenerationParameters;
++import org.hyperledger.besu.consensus.common.bft.slhdsa.SLHDSAKeyPairGenerator;
++import org.hyperledger.besu.consensus.common.bft.slhdsa.SLHDSAParameters;
++import org.hyperledger.besu.consensus.common.bft.slhdsa.SLHDSAPrivateKeyParameters;
++import org.hyperledger.besu.consensus.common.bft.slhdsa.SLHDSAPublicKeyParameters;
++import org.hyperledger.besu.consensus.common.bft.slhdsa.SLHDSASigner;
++import org.hyperledger.besu.crypto.SecureRandomProvider;
++import org.junit.jupiter.api.Test;
++
++/**
++ * D-337 (2026-09-04): the in-tree SLH-DSA engine (Bouncy Castle's algorithm on the JDK's SHA-NI
++ * digest) must be the SAME signature scheme as the Bouncy Castle original, bit for bit. Otherwise a
++ * faster signer is a different certificate, and the second client and the public verifier would
++ * reject every anchor. Each direction is pinned: fast-signed verifies under the original, original-
++ * signed verifies under the fast engine, deterministic signing gives identical bytes, and the fast
++ * engine still rejects a tampered signature (the negative control of the verifier).
++ */
++class SlhDsaFastEngineTest {
++
++  private static final org.bouncycastle.pqc.crypto.slhdsa.SLHDSAParameters ORIGINAL =
++      org.bouncycastle.pqc.crypto.slhdsa.SLHDSAParameters.sha2_128s;
++
++  private static AsymmetricCipherKeyPair fastKeyPair() {
++    final SLHDSAKeyPairGenerator gen = new SLHDSAKeyPairGenerator();
++    gen.init(new SLHDSAKeyGenerationParameters(SecureRandomProvider.createSecureRandom(), SLHDSAParameters.sha2_128s));
++    return gen.generateKeyPair();
++  }
++
++  private static org.bouncycastle.pqc.crypto.slhdsa.SLHDSAPublicKeyParameters originalPub(
++      final AsymmetricCipherKeyPair kp) {
++    return new org.bouncycastle.pqc.crypto.slhdsa.SLHDSAPublicKeyParameters(
++        ORIGINAL, ((SLHDSAPublicKeyParameters) kp.getPublic()).getEncoded());
++  }
++
++  private static org.bouncycastle.pqc.crypto.slhdsa.SLHDSAPrivateKeyParameters originalPriv(
++      final AsymmetricCipherKeyPair kp) {
++    return new org.bouncycastle.pqc.crypto.slhdsa.SLHDSAPrivateKeyParameters(
++        ORIGINAL, ((SLHDSAPrivateKeyParameters) kp.getPrivate()).getEncoded());
++  }
++
++  @Test
++  void aFastSignatureVerifiesUnderTheOriginalBouncyCastleEngine() {
++    final AsymmetricCipherKeyPair kp = fastKeyPair();
++    final byte[] msg = "AERE-PQ-ANCHOR-2 commit seal message".getBytes(StandardCharsets.UTF_8);
++    final SLHDSASigner signer = new SLHDSASigner();
++    signer.init(true, kp.getPrivate());
++    final byte[] sig = signer.generateSignature(msg);
++    assertThat(sig).hasSize(7856);
++
++    final org.bouncycastle.pqc.crypto.slhdsa.SLHDSASigner original =
++        new org.bouncycastle.pqc.crypto.slhdsa.SLHDSASigner();
++    original.init(false, originalPub(kp));
++    assertThat(original.verifySignature(msg, sig)).isTrue();
++
++    // negative control of the ORIGINAL verifier on the fast signature: one bit off, rejected
++    final byte[] bad = sig.clone();
++    bad[1234] ^= 0x01;
++    original.init(false, originalPub(kp));
++    assertThat(original.verifySignature(msg, bad)).isFalse();
++  }
++
++  @Test
++  void anOriginalSignatureVerifiesUnderTheFastEngineAndATamperedOneDoesNot() {
++    final AsymmetricCipherKeyPair kp = fastKeyPair();
++    final byte[] msg = new byte[32];
++    msg[31] = 7;
++    final org.bouncycastle.pqc.crypto.slhdsa.SLHDSASigner original =
++        new org.bouncycastle.pqc.crypto.slhdsa.SLHDSASigner();
++    original.init(true, originalPriv(kp));
++    final byte[] sig = original.generateSignature(msg);
++
++    final SLHDSASigner fast = new SLHDSASigner();
++    fast.init(false, kp.getPublic());
++    assertThat(fast.verifySignature(msg, sig)).isTrue();
++
++    final byte[] bad = sig.clone();
++    bad[100] ^= 0x01;
++    fast.init(false, kp.getPublic());
++    assertThat(fast.verifySignature(msg, bad)).isFalse();
++
++    final byte[] otherMsg = msg.clone();
++    otherMsg[0] ^= 0x01;
++    fast.init(false, kp.getPublic());
++    assertThat(fast.verifySignature(otherMsg, sig)).isFalse();
++  }
++
++  @Test
++  void deterministicSigningGivesTheSameBytesAsTheOriginal() {
++    // Without a SecureRandom both engines use the pk seed as opt_rand (FIPS 205 deterministic
++    // variant), so the SAME key and message must give the SAME 7856 bytes. This is the strongest
++    // statement that the hash swap changed nothing but the clock.
++    final AsymmetricCipherKeyPair kp = fastKeyPair();
++    final byte[] msg = "deterministic".getBytes(StandardCharsets.UTF_8);
++    final SLHDSASigner fast = new SLHDSASigner();
++    fast.init(true, kp.getPrivate());
++    final org.bouncycastle.pqc.crypto.slhdsa.SLHDSASigner original =
++        new org.bouncycastle.pqc.crypto.slhdsa.SLHDSASigner();
++    original.init(true, originalPriv(kp));
++    assertThat(Arrays.equals(fast.generateSignature(msg), original.generateSignature(msg)))
++        .isTrue();
++  }
++
++  @Test
++  void theSealSchemeItselfSignsThroughTheFastEngineAndTheOriginalAccepts() {
++    final SlhDsaSealScheme scheme = new SlhDsaSealScheme();
++    final SealScheme.GeneratedPair pair = scheme.generate(SecureRandomProvider.createSecureRandom());
++    final byte[] msg = new byte[32];
++    final byte[] sig = scheme.sign(pair.privateKey(), msg).orElseThrow();
++    final org.bouncycastle.pqc.crypto.slhdsa.SLHDSASigner original =
++        new org.bouncycastle.pqc.crypto.slhdsa.SLHDSASigner();
++    original.init(
++        false,
++        new org.bouncycastle.pqc.crypto.slhdsa.SLHDSAPublicKeyParameters(
++            ORIGINAL, pair.publicRegistryForm()));
++    assertThat(original.verifySignature(msg, sig)).isTrue();
++    assertThat(scheme.verifyRaw(pair.publicRegistryForm(), msg, sig)).isTrue();
++  }
++}
 diff --git a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/messagewrappers/Commit.java b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/messagewrappers/Commit.java
-index 142069ec7..b3ba74635 100644
+index 142069ec7..00d7b78c2 100644
 --- a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/messagewrappers/Commit.java
 +++ b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/messagewrappers/Commit.java
-@@ -11,9 +11,16 @@
+@@ -1,68 +1,100 @@
+ /*
+  * Copyright ConsenSys AG.
+  *
+  * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+  * the License. You may obtain a copy of the License at
+  *
+  * http://www.apache.org/licenses/LICENSE-2.0
+  *
+  * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+  * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
   * specific language governing permissions and limitations under the License.
   *
   * SPDX-License-Identifier: Apache-2.0
@@ -21256,7 +29835,8 @@ index 142069ec7..b3ba74635 100644
  import org.hyperledger.besu.consensus.common.bft.messagewrappers.BftMessage;
  import org.hyperledger.besu.consensus.common.bft.payload.SignedData;
  import org.hyperledger.besu.consensus.qbft.core.payload.CommitPayload;
-@@ -22,6 +29,8 @@ import org.hyperledger.besu.datatypes.Hash;
+ import org.hyperledger.besu.crypto.SECPSignature;
+ import org.hyperledger.besu.datatypes.Hash;
  import org.hyperledger.besu.ethereum.rlp.RLP;
  import org.hyperledger.besu.ethereum.rlp.RLPInput;
  
@@ -21265,7 +29845,23 @@ index 142069ec7..b3ba74635 100644
  import org.apache.tuweni.bytes.Bytes;
  
  /** The Commit payload message. */
-@@ -45,6 +54,15 @@ public class Commit extends BftMessage {
+ public class Commit extends BftMessage {
+ 
+   /**
+    * Instantiates a new Commit.
+    *
+    * @param payload the payload
+    */
+   public Commit(final SignedData payload) {
+     super(payload);
+   }
+ 
+   /**
+    * Gets commit seal.
+    *
+    * @return the commit seal
+    */
+   public SECPSignature getCommitSeal() {
      return getPayload().getCommitSeal();
    }
  
@@ -21281,11 +29877,53 @@ index 142069ec7..b3ba74635 100644
    /**
     * Gets digest.
     *
+    * @return the digest
+    */
++  /**
++   * D-339 (2026-09-04): the hybrid extra seals this Commit carries, as a plain accessor.
++   *
++   * 
        It exists so the two places that keep seals out of a dying message (the late-seal salvage in
++   * the controller and the no-proposal path in the round) do not have to reach through the signed
++   * payload. Reaching through it also broke every test that mocks a Commit, which is exactly the
++   * kind of surprise a wrapper class is meant to absorb.
++   *
++   * @return the non-Falcon scheme seals, empty on every commit that carries none
++   */
++  public java.util.List getExtraSeals() {
++    return getPayload().getExtraSeals();
++  }
++
+   public Hash getDigest() {
+     return getPayload().getDigest();
+   }
+ 
+   /**
+    * Decode.
+    *
+    * @param data the data
+    * @return the commit
+    */
+   public static Commit decode(final Bytes data) {
+     final RLPInput rlpIn = RLP.input(data);
+ 
+     return new Commit(readPayload(rlpIn, CommitPayload::readFrom));
+   }
+ }
 diff --git a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/network/QbftMessageTransmitter.java b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/network/QbftMessageTransmitter.java
-index 30156ed6d..b0ba9ea09 100644
+index 30156ed6d..18437e30f 100644
 --- a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/network/QbftMessageTransmitter.java
 +++ b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/network/QbftMessageTransmitter.java
-@@ -11,10 +11,17 @@
+@@ -1,37 +1,45 @@
+ /*
+  * Copyright ConsenSys AG.
+  *
+  * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+  * the License. You may obtain a copy of the License at
+  *
+  * http://www.apache.org/licenses/LICENSE-2.0
+  *
+  * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+  * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
   * specific language governing permissions and limitations under the License.
   *
   * SPDX-License-Identifier: Apache-2.0
@@ -21300,10 +29938,141 @@ index 30156ed6d..b0ba9ea09 100644
  
  import org.hyperledger.besu.consensus.common.bft.ConsensusRoundIdentifier;
 +import org.hyperledger.besu.consensus.common.bft.FalconSeal;
++import org.hyperledger.besu.consensus.common.bft.SchemeSeal;
  import org.hyperledger.besu.consensus.common.bft.network.ValidatorMulticaster;
  import org.hyperledger.besu.consensus.common.bft.payload.SignedData;
  import org.hyperledger.besu.consensus.qbft.core.messagedata.CommitMessageData;
-@@ -118,8 +125,24 @@ public class QbftMessageTransmitter {
+ import org.hyperledger.besu.consensus.qbft.core.messagedata.PrepareMessageData;
+ import org.hyperledger.besu.consensus.qbft.core.messagedata.ProposalMessageData;
+ import org.hyperledger.besu.consensus.qbft.core.messagedata.RoundChangeMessageData;
+ import org.hyperledger.besu.consensus.qbft.core.messagewrappers.Commit;
+ import org.hyperledger.besu.consensus.qbft.core.messagewrappers.Prepare;
+ import org.hyperledger.besu.consensus.qbft.core.messagewrappers.Proposal;
+ import org.hyperledger.besu.consensus.qbft.core.messagewrappers.RoundChange;
+ import org.hyperledger.besu.consensus.qbft.core.payload.MessageFactory;
+ import org.hyperledger.besu.consensus.qbft.core.payload.PreparePayload;
+ import org.hyperledger.besu.consensus.qbft.core.payload.RoundChangePayload;
+ import org.hyperledger.besu.consensus.qbft.core.statemachine.PreparedCertificate;
+ import org.hyperledger.besu.consensus.qbft.core.types.QbftBlock;
+ import org.hyperledger.besu.crypto.SECPSignature;
+ import org.hyperledger.besu.datatypes.Hash;
+ import org.hyperledger.besu.ethereum.mainnet.block.access.list.BlockAccessList;
+ import org.hyperledger.besu.plugin.services.securitymodule.SecurityModuleException;
+ 
+@@ -59,94 +67,195 @@ public class QbftMessageTransmitter {
+       final MessageFactory messageFactory, final ValidatorMulticaster multicaster) {
+     this.messageFactory = messageFactory;
+     this.multicaster = multicaster;
+   }
+ 
+   /**
+    * Multicast proposal.
+    *
+    * @param roundIdentifier the round identifier
+    * @param block the block
+    * @param blockAccessList the block access list
+    * @param roundChanges the round changes
+    * @param prepares the prepares
+    */
+   public void multicastProposal(
+       final ConsensusRoundIdentifier roundIdentifier,
+       final QbftBlock block,
+       final Optional blockAccessList,
+       final List> roundChanges,
+       final List> prepares) {
++    multicastProposal(roundIdentifier, block, blockAccessList, roundChanges, prepares,
++        Optional.empty());
++  }
++
++  /**
++   * Multicast proposal carrying the proposer's optional post-quantum seal (AERE PQ, 2026-08-30).
++   *
++   * 
        THE SEAL MUST BE THE SAME OBJECT the caller embedded in its local copy, and this overload
++   * exists because the first network run proved what happens without it: this method RE-CREATES
++   * the proposal from scratch, so the local copy carried a seal, the wire copy carried none, and
++   * at the enforcement height every peer refused round after round while the proposer's own log
++   * said it had emitted. F84 scenario A, 2026-08-30 - the witness went red, exactly its job.
++   * The same two-copies trap was closed at PREPARE the day before it could bite; here it bit
++   * first, on a testnet, which is where it is allowed to.
++   *
++   * @param roundIdentifier the round identifier
++   * @param block the block
++   * @param blockAccessList the block access list
++   * @param roundChanges the round changes
++   * @param prepares the prepares
++   * @param falconSeal the proposer's post-quantum seal, or empty
++   */
++  public void multicastProposal(
++      final ConsensusRoundIdentifier roundIdentifier,
++      final QbftBlock block,
++      final Optional blockAccessList,
++      final List> roundChanges,
++      final List> prepares,
++      final Optional falconSeal) {
+     try {
+       final Proposal data =
+-          messageFactory.createProposal(
+-              roundIdentifier, block, blockAccessList, roundChanges, prepares);
++          falconSeal.isPresent()
++              ? messageFactory.createProposal(
++                  roundIdentifier, block, blockAccessList, roundChanges, prepares, falconSeal)
++              : messageFactory.createProposal(
++                  roundIdentifier, block, blockAccessList, roundChanges, prepares);
+ 
+       final ProposalMessageData message = ProposalMessageData.create(data);
+ 
+       multicaster.send(message);
+     } catch (final SecurityModuleException e) {
+       LOG.warn("Failed to generate signature for Proposal (not sent): {} ", e.getMessage());
+     }
+   }
+ 
+   /**
+    * Multicast prepare.
+    *
+    * @param roundIdentifier the round identifier
+    * @param digest the digest
+    */
+   public void multicastPrepare(final ConsensusRoundIdentifier roundIdentifier, final Hash digest) {
++    multicastPrepare(roundIdentifier, digest, Optional.empty());
++  }
++
++  /**
++   * Multicast a prepare carrying an OPTIONAL post-quantum seal of this node.
++   *
++   * 
        Sigiliul vine GATA CALCULAT de la apelant, si asta nu e comoditate: semnaturile Falcon sunt
++   * randomized, so signing the same message twice yields two different byte strings. If the local
++   * copy and the one on the wire each signed their own, the same validator would produce two
++   * valide si DIFERITE pentru aceeasi runda. Se calculeaza o data, sus, si se trece prin amandoua.
++   *
++   * @param roundIdentifier the round identifier
++   * @param digest the digest
++   * @param falconSeal the seal, or empty
++   */
++  public void multicastPrepare(
++      final ConsensusRoundIdentifier roundIdentifier,
++      final Hash digest,
++      final Optional falconSeal) {
+     try {
+-      final Prepare data = messageFactory.createPrepare(roundIdentifier, digest);
++      final Prepare data = messageFactory.createPrepare(roundIdentifier, digest, falconSeal);
+ 
+       final PrepareMessageData message = PrepareMessageData.create(data);
+ 
+       multicaster.send(message);
+     } catch (final SecurityModuleException e) {
+       LOG.warn("Failed to generate signature for Prepare (not sent): {} ", e.getMessage());
+     }
+   }
+ 
+   /**
+    * Multicast commit.
+    *
+    * @param roundIdentifier the round identifier
+    * @param digest the digest
+    * @param commitSeal the commit seal
+    */
+   public void multicastCommit(
        final ConsensusRoundIdentifier roundIdentifier,
        final Hash digest,
        final SECPSignature commitSeal) {
@@ -21323,17 +30092,88 @@ index 30156ed6d..b0ba9ea09 100644
 +      final Hash digest,
 +      final SECPSignature commitSeal,
 +      final Optional falconSeal) {
++    multicastCommit(roundIdentifier, digest, commitSeal, falconSeal, java.util.List.of());
++  }
++
++  /**
++   * Multicast commit carrying a HYBRID post-quantum certificate: the Falcon seal in its own slot
++   * plus the other schemes' seals alongside it (AERE HIBRID, 2026-08-25).
++   *
++   * @param roundIdentifier the round identifier
++   * @param digest the digest
++   * @param commitSeal the ECDSA commit seal
++   * @param falconSeal the optional parallel Falcon seal
++   * @param extraSeals the non-Falcon scheme seals; empty on every node not hybrid-configured
++   */
++  public void multicastCommit(
++      final ConsensusRoundIdentifier roundIdentifier,
++      final Hash digest,
++      final SECPSignature commitSeal,
++      final Optional falconSeal,
++      final java.util.List extraSeals) {
      try {
 -      final Commit data = messageFactory.createCommit(roundIdentifier, digest, commitSeal);
-+      final Commit data = messageFactory.createCommit(roundIdentifier, digest, commitSeal, falconSeal);
++      final Commit data =
++          messageFactory.createCommit(roundIdentifier, digest, commitSeal, falconSeal, extraSeals);
  
        final CommitMessageData message = CommitMessageData.create(data);
  
+       multicaster.send(message);
+     } catch (final SecurityModuleException e) {
+       LOG.warn("Failed to generate signature for Commit (not sent): {} ", e.getMessage());
+     }
+   }
+ 
+   /**
+    * Multicast round change.
+    *
+    * @param roundIdentifier the round identifier
+    * @param preparedRoundCertificate the prepared round certificate
+    */
+   public void multicastRoundChange(
+       final ConsensusRoundIdentifier roundIdentifier,
+       final Optional preparedRoundCertificate) {
+     try {
+       final RoundChange data =
+           messageFactory.createRoundChange(roundIdentifier, preparedRoundCertificate);
+ 
+       final RoundChangeMessageData message = RoundChangeMessageData.create(data);
+ 
+       multicaster.send(message);
+     } catch (final SecurityModuleException e) {
+       LOG.warn("Failed to generate signature for RoundChange (not sent): {} ", e.getMessage());
+     }
+   }
++
++  /**
++   * Multicast an ALREADY BUILT round change, without re-creating it. AERE PQ (2026-08-31): the
++   * height manager signs its round-change ONCE - Falcon signatures are randomised, so re-creating
++   * the message here would put a DIFFERENT object on the wire than the one handled locally, the
++   * exact defect F84 measured on the PROPOSAL (local copy sealed, wire copy not). The seal-less
++   * path keeps using the overload above, call for call as upstream.
++   *
++   * @param roundChange the round change to send, exactly as built
++   */
++  public void multicastRoundChange(final RoundChange roundChange) {
++    final RoundChangeMessageData message = RoundChangeMessageData.create(roundChange);
++    multicaster.send(message);
++  }
+ }
 diff --git a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/payload/CommitPayload.java b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/payload/CommitPayload.java
-index db481acd0..e55efb55c 100644
+index db481acd0..8b788f499 100644
 --- a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/payload/CommitPayload.java
 +++ b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/payload/CommitPayload.java
-@@ -11,30 +11,54 @@
+@@ -1,133 +1,375 @@
+ /*
+  * Copyright ConsenSys AG.
+  *
+  * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+  * the License. You may obtain a copy of the License at
+  *
+  * http://www.apache.org/licenses/LICENSE-2.0
+  *
+  * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+  * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
   * specific language governing permissions and limitations under the License.
   *
   * SPDX-License-Identifier: Apache-2.0
@@ -21348,6 +30188,9 @@ index db481acd0..e55efb55c 100644
  
  import org.hyperledger.besu.consensus.common.bft.ConsensusRoundIdentifier;
 +import org.hyperledger.besu.consensus.common.bft.FalconSeal;
++import org.hyperledger.besu.consensus.common.bft.PqAnchorV2;
++import org.hyperledger.besu.consensus.common.bft.SchemeSeal;
++import org.hyperledger.besu.consensus.common.bft.SealSchemes;
  import org.hyperledger.besu.consensus.common.bft.payload.Payload;
  import org.hyperledger.besu.consensus.qbft.core.messagedata.QbftV1;
  import org.hyperledger.besu.crypto.SECPSignature;
@@ -21357,6 +30200,7 @@ index db481acd0..e55efb55c 100644
  import org.hyperledger.besu.ethereum.rlp.RLPInput;
  import org.hyperledger.besu.ethereum.rlp.RLPOutput;
  
++import java.util.List;
  import java.util.Objects;
 +import java.util.Optional;
  import java.util.StringJoiner;
@@ -21383,6 +30227,10 @@ index db481acd0..e55efb55c 100644
    private final Hash digest;
    private final SECPSignature commitSeal;
 +  private final Optional falconSeal;
++  // AERE HIBRID (2026-08-25): the NON-Falcon scheme seals of a hybrid certificate. Falcon keeps
++  // living in the legacy slot above, so one signature has exactly one home and the wire format of
++  // a Falcon-only commit is untouched. Empty on every commit the live fleet emits today.
++  private final List extraSeals;
  
    /**
 -   * Instantiates a new Commit payload.
@@ -21390,7 +30238,9 @@ index db481acd0..e55efb55c 100644
     *
     * @param roundIdentifier the round identifier
     * @param digest the digest
-@@ -44,26 +68,107 @@ public class CommitPayload extends QbftPayload {
+    * @param commitSeal the commit seal
+    */
+   public CommitPayload(
        final ConsensusRoundIdentifier roundIdentifier,
        final Hash digest,
        final SECPSignature commitSeal) {
@@ -21410,10 +30260,72 @@ index db481acd0..e55efb55c 100644
 +      final Hash digest,
 +      final SECPSignature commitSeal,
 +      final Optional falconSeal) {
++    this(roundIdentifier, digest, commitSeal, falconSeal, List.of());
++  }
++
++  /**
++   * Instantiates a new Commit payload carrying a HYBRID post-quantum certificate.
++   *
++   * 
        AERE HIBRID (2026-08-25), the founder's step two of 2026-08-07. A hybrid certificate is
++   * Falcon-512 PLUS a second, structurally unrelated scheme (SLH-DSA/SPHINCS+): if lattices fall
++   * the hash-based one holds, and the reverse. Falcon stays in the legacy slot and the OTHER
++   * schemes travel here, so:
++   *
++   * 
          
++   *   
        • a Falcon-only commit encodes byte-for-byte as it does on the live fleet today, which is
++   *       the condition for warming this binary without a coordinated flag day;
++   *   
        • the two positions are unambiguous by COUNT (0 trailing elements = no PQ, 1 = Falcon
++   *       only, 2 = Falcon + extras), so no clever structural sniffing is needed in a consensus
++   *       decoder, where cleverness is how D-235-class mistakes are made;
++   *   
        • a signature has exactly ONE home, so the two slots can never disagree about Falcon.
++   * 
        
++   *
++   * 
        The extras are encoded with {@link PqAnchorV2}, the same scheme-tagged codec the V2 anchor
++   * certificate uses: one vocabulary, one canonicality discipline, one place to get it wrong.
++   *
++   * 
        ADDING THIS ELEMENT IS A CONSENSUS BREAKING CHANGE, exactly as {@link #readFrom(RLPInput)}
++   * warns: an older binary cannot parse a commit that carries it. What protects the fleet is not
++   * leniency, which cannot work, but the EMISSION gate: nothing emits extras until every peer can
++   * read them. Same discipline as the Falcon attachment gate.
++   *
++   * @param roundIdentifier the round identifier
++   * @param digest the digest
++   * @param commitSeal the ECDSA commit seal (decisive)
++   * @param falconSeal the Falcon seal; REQUIRED whenever extras are present
++   * @param extraSeals the non-Falcon scheme seals; empty for every commit on the fleet today
++   */
++  public CommitPayload(
++      final ConsensusRoundIdentifier roundIdentifier,
++      final Hash digest,
++      final SECPSignature commitSeal,
++      final Optional falconSeal,
++      final List extraSeals) {
      this.roundIdentifier = roundIdentifier;
      this.digest = digest;
      this.commitSeal = commitSeal;
 +    this.falconSeal = falconSeal == null ? Optional.empty() : falconSeal;
++    this.extraSeals = extraSeals == null ? List.of() : List.copyOf(extraSeals);
++    if (!this.extraSeals.isEmpty()) {
++      // The wire format cannot even REPRESENT extras without a Falcon seal, because the slots are
++      // told apart by count. Refusing here means an object that could not be written correctly
++      // cannot be built at all, instead of failing later at encode time on the consensus path.
++      if (this.falconSeal.isEmpty()) {
++        throw new IllegalArgumentException(
++            "AERE HIBRID: extra scheme seals require the Falcon seal to be present");
++      }
++      for (final SchemeSeal seal : this.extraSeals) {
++        if (seal.getSchemeWireId() == SealSchemes.FALCON_512.wireId()) {
++          throw new IllegalArgumentException(
++              "AERE HIBRID: Falcon belongs in its own slot, not in the extras");
++        }
++      }
++      // Validates canonicality and the seal cap NOW, so a payload that cannot be encoded cannot
++      // exist. PqAnchorV2.encode throws on a non-canonical or oversized certificate.
++      final Bytes unused = PqAnchorV2.encode(this.extraSeals);
++      if (unused.isEmpty()) {
++        throw new IllegalArgumentException("AERE HIBRID: empty encoding of a non-empty certificate");
++      }
++    }
    }
  
    /**
@@ -21480,9 +30392,37 @@ index db481acd0..e55efb55c 100644
 +      payloadRlp.leaveList();
 +      falconSeal = Optional.of(new FalconSeal(idx, sig));
 +    }
++
++    // AERE HIBRID: a SECOND optional element, the non-Falcon scheme seals. Unambiguous by count:
++    // it can only be here if the Falcon element above was already consumed, so the two slots can
++    // never be confused for one another and no structural sniffing is required.
++    List extraSeals = List.of();
++    if (!payloadRlp.isEndOfCurrentList()) {
++      final Bytes extrasRaw = payloadRlp.readAsRlp().raw();
++      try {
++        extraSeals = PqAnchorV2.decode(extrasRaw);
++      } catch (final RuntimeException e) {
++        // A malformed certificate is a malformed MESSAGE. It must surface as an RLP failure so the
++        // gossip layer drops it like any other undecodable commit, never as an unchecked throw on
++        // the consensus path.
++        throw new RLPException("AERE HIBRID: undecodable extra certificate: " + e.getMessage());
++      }
++      if (extraSeals.isEmpty()) {
++        // An empty extras element and an absent one would be two encodings of the same value.
++        throw new RLPException("AERE HIBRID: empty extra certificate must be absent, not empty");
++      }
++    }
 +    payloadRlp.leaveList();
 +
-+    final CommitPayload payload = new CommitPayload(roundIdentifier, digest, commitSeal, falconSeal);
++    final CommitPayload payload;
++    try {
++      payload =
++          new CommitPayload(roundIdentifier, digest, commitSeal, falconSeal, extraSeals);
++    } catch (final IllegalArgumentException e) {
++      // The constructor's invariants (Falcon not in the extras, extras imply Falcon) are part of
++      // what a valid message is, so a violation is a decode failure, not a crash.
++      throw new RLPException("AERE HIBRID: " + e.getMessage());
++    }
  
 -    return new CommitPayload(roundIdentifier, digest, commitSeal);
 +    // AERE FIX-MALEABILITATE: exactly one encoding is accepted for a given payload value. This
@@ -21504,7 +30444,8 @@ index db481acd0..e55efb55c 100644
    }
  
    @Override
-@@ -72,6 +177,17 @@ public class CommitPayload extends QbftPayload {
+   public void writeTo(final RLPOutput rlpOutput) {
+     rlpOutput.startList();
      writeConsensusRound(rlpOutput);
      rlpOutput.writeBytes(digest.getBytes());
      rlpOutput.writeBytes(commitSeal.encodedBytes());
@@ -21518,11 +30459,36 @@ index db481acd0..e55efb55c 100644
 +      rlpOutput.writeIntScalar(fs.getValidatorIndex());
 +      rlpOutput.writeBytes(fs.getSignature());
 +      rlpOutput.endList();
++    }
++    // AERE HIBRID: the extras, only when there are any. Absent extras leave the encoding of a
++    // Falcon-only commit byte-for-byte as it is on the live fleet today, which is locked by a
++    // golden vector in CommitPayloadHybridTest.
++    if (!extraSeals.isEmpty()) {
++      rlpOutput.writeRaw(PqAnchorV2.encode(extraSeals));
 +    }
      rlpOutput.endList();
    }
  
-@@ -98,6 +214,15 @@ public class CommitPayload extends QbftPayload {
+   @Override
+   public int getMessageType() {
+     return TYPE;
+   }
+ 
+   /**
+    * Gets digest.
+    *
+    * @return the digest
+    */
+   public Hash getDigest() {
+     return digest;
+   }
+ 
+   /**
+    * Gets commit seal.
+    *
+    * @return the commit seal
+    */
+   public SECPSignature getCommitSeal() {
      return commitSeal;
    }
  
@@ -21534,39 +30500,70 @@ index db481acd0..e55efb55c 100644
 +  public Optional getFalconSeal() {
 +    return falconSeal;
 +  }
++
++  /**
++   * Gets the non-Falcon scheme seals of a hybrid certificate.
++   *
++   * @return the extra seals, empty for every commit the live fleet emits today
++   */
++  public List getExtraSeals() {
++    return extraSeals;
++  }
 +
    @Override
    public ConsensusRoundIdentifier getRoundIdentifier() {
      return roundIdentifier;
-@@ -114,12 +239,13 @@ public class CommitPayload extends QbftPayload {
+   }
+ 
+   @Override
+   public boolean equals(final Object o) {
+     if (this == o) {
+       return true;
+     }
+     if (o == null || getClass() != o.getClass()) {
+       return false;
+     }
      final CommitPayload that = (CommitPayload) o;
      return Objects.equals(roundIdentifier, that.roundIdentifier)
          && Objects.equals(digest, that.digest)
 -        && Objects.equals(commitSeal, that.commitSeal);
 +        && Objects.equals(commitSeal, that.commitSeal)
-+        && Objects.equals(falconSeal, that.falconSeal);
++        && Objects.equals(falconSeal, that.falconSeal)
++        && Objects.equals(extraSeals, that.extraSeals);
    }
  
    @Override
    public int hashCode() {
 -    return Objects.hash(roundIdentifier, digest, commitSeal);
-+    return Objects.hash(roundIdentifier, digest, commitSeal, falconSeal);
++    return Objects.hash(roundIdentifier, digest, commitSeal, falconSeal, extraSeals);
    }
  
    @Override
-@@ -128,6 +254,7 @@ public class CommitPayload extends QbftPayload {
+   public String toString() {
+     return new StringJoiner(", ", CommitPayload.class.getSimpleName() + "[", "]")
          .add("roundIdentifier=" + roundIdentifier)
          .add("digest=" + digest)
          .add("commitSeal=" + commitSeal)
 +        .add("falconSeal=" + falconSeal)
++        .add("extraSeals=" + extraSeals.size())
          .toString();
    }
  }
 diff --git a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/payload/MessageFactory.java b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/payload/MessageFactory.java
-index 1bcd73ae9..7d0e37134 100644
+index 1bcd73ae9..11426d6a6 100644
 --- a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/payload/MessageFactory.java
 +++ b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/payload/MessageFactory.java
-@@ -11,10 +11,17 @@
+@@ -1,37 +1,44 @@
+ /*
+  * Copyright ConsenSys AG.
+  *
+  * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+  * the License. You may obtain a copy of the License at
+  *
+  * http://www.apache.org/licenses/LICENSE-2.0
+  *
+  * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+  * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
   * specific language governing permissions and limitations under the License.
   *
   * SPDX-License-Identifier: Apache-2.0
@@ -21584,7 +30581,132 @@ index 1bcd73ae9..7d0e37134 100644
  import org.hyperledger.besu.consensus.common.bft.payload.Payload;
  import org.hyperledger.besu.consensus.common.bft.payload.SignedData;
  import org.hyperledger.besu.consensus.qbft.core.messagewrappers.Commit;
-@@ -116,7 +123,26 @@ public class MessageFactory {
+ import org.hyperledger.besu.consensus.qbft.core.messagewrappers.Prepare;
+ import org.hyperledger.besu.consensus.qbft.core.messagewrappers.Proposal;
+ import org.hyperledger.besu.consensus.qbft.core.messagewrappers.RoundChange;
+ import org.hyperledger.besu.consensus.qbft.core.statemachine.PreparedCertificate;
+ import org.hyperledger.besu.consensus.qbft.core.types.QbftBlock;
+ import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockCodec;
+ import org.hyperledger.besu.crypto.SECPSignature;
+ import org.hyperledger.besu.cryptoservices.NodeKey;
+ import org.hyperledger.besu.datatypes.Hash;
+ import org.hyperledger.besu.ethereum.mainnet.block.access.list.BlockAccessList;
+ 
+ import java.util.Collections;
+ import java.util.List;
+ import java.util.Optional;
+ 
+ import org.apache.tuweni.bytes.Bytes32;
+ 
+@@ -58,111 +65,220 @@ public class MessageFactory {
+    * @param roundIdentifier the round identifier
+    * @param block the block
+    * @param blockAccessList the block access list
+    * @param roundChanges the round changes
+    * @param prepares the prepares
+    * @return the proposal
+    */
+   public Proposal createProposal(
+       final ConsensusRoundIdentifier roundIdentifier,
+       final QbftBlock block,
+       final Optional blockAccessList,
+       final List> roundChanges,
+       final List> prepares) {
+ 
+     final ProposalPayload payload =
+         new ProposalPayload(roundIdentifier, block, blockEncoder, blockAccessList);
+ 
+     return new Proposal(createSignedMessage(payload), roundChanges, prepares);
+   }
+ 
++  /**
++   * Create proposal carrying the proposer's optional post-quantum seal (AERE PQ, 2026-08-30).
++   *
++   * 
        The seal rides INSIDE the signed payload, so the proposer's ECDSA signature covers it and
++   * nobody can strip or replace it without failing authorship recovery. With the seal absent this
++   * overload produces byte-for-byte what the upstream overload produces.
++   *
++   * @param roundIdentifier the round identifier
++   * @param block the block
++   * @param blockAccessList the block access list
++   * @param roundChanges the round changes
++   * @param prepares the prepares
++   * @param falconSeal the proposer's post-quantum seal, or empty
++   * @return the proposal
++   */
++  public Proposal createProposal(
++      final ConsensusRoundIdentifier roundIdentifier,
++      final QbftBlock block,
++      final Optional blockAccessList,
++      final List> roundChanges,
++      final List> prepares,
++      final Optional falconSeal) {
++
++    final ProposalPayload payload =
++        new ProposalPayload(roundIdentifier, block, blockEncoder, blockAccessList, falconSeal);
++
++    return new Proposal(createSignedMessage(payload), roundChanges, prepares);
++  }
++
+   /**
+    * Create proposal.
+    *
+    * @param roundIdentifier the round identifier
+    * @param block the block
+    * @param roundChanges the round changes
+    * @param prepares the prepares
+    * @return the proposal
+    */
+   public Proposal createProposal(
+       final ConsensusRoundIdentifier roundIdentifier,
+       final QbftBlock block,
+       final List> roundChanges,
+       final List> prepares) {
+     return createProposal(roundIdentifier, block, Optional.empty(), roundChanges, prepares);
+   }
+ 
+   /**
+    * Create Prepare payload.
+    *
+    * @param roundIdentifier the round identifier
+    * @param digest the digest
+    * @return the prepare
+    */
+   public Prepare createPrepare(final ConsensusRoundIdentifier roundIdentifier, final Hash digest) {
+-    final PreparePayload payload = new PreparePayload(roundIdentifier, digest);
++    return createPrepare(roundIdentifier, digest, Optional.empty());
++  }
++
++  /**
++   * Create a Prepare carrying an OPTIONAL post-quantum seal of its author.
++   *
++   * 
        AERE PQ (2026-08-28), pasul 1: firul poate purta sigiliul, si nimic nu il emite inca -
++   * fiecare apel de azi trece prin varianta fara sigiliu de mai sus. Ca la commit, semnatura ECDSA
++   * a autorului acopera INTREG payload-ul, deci si sigiliul, ceea ce leaga indexul revendicat de
++   * identitatea celui care trimite mesajul.
++   *
++   * @param roundIdentifier the round identifier
++   * @param digest the digest
++   * @param falconSeal the author's post-quantum seal, or empty
++   * @return the prepare
++   */
++  public Prepare createPrepare(
++      final ConsensusRoundIdentifier roundIdentifier,
++      final Hash digest,
++      final Optional falconSeal) {
++    final PreparePayload payload = new PreparePayload(roundIdentifier, digest, falconSeal);
+     return new Prepare(createSignedMessage(payload));
+   }
+ 
+   /**
+    * Create commit payload.
+    *
+    * @param roundIdentifier the round identifier
+    * @param digest the digest
+    * @param commitSeal the commit seal
+    * @return the commit
+    */
+   public Commit createCommit(
        final ConsensusRoundIdentifier roundIdentifier,
        final Hash digest,
        final SECPSignature commitSeal) {
@@ -21607,16 +30729,821 @@ index 1bcd73ae9..7d0e37134 100644
 +      final Hash digest,
 +      final SECPSignature commitSeal,
 +      final Optional falconSeal) {
++    return createCommit(roundIdentifier, digest, commitSeal, falconSeal, java.util.List.of());
++  }
++
++  /**
++   * Create a commit carrying a HYBRID post-quantum certificate: the Falcon seal in its own slot
++   * plus the other schemes alongside it. The whole payload, extras included, is signed by this
++   * node's ECDSA key, so the extras cannot be added or stripped by anyone else.
++   *
++   * @param roundIdentifier the round identifier
++   * @param digest the digest
++   * @param commitSeal the ECDSA commit seal
++   * @param falconSeal the Falcon seal; required whenever extras are present
++   * @param extraSeals the non-Falcon scheme seals
++   * @return the commit
++   */
++  public Commit createCommit(
++      final ConsensusRoundIdentifier roundIdentifier,
++      final Hash digest,
++      final SECPSignature commitSeal,
++      final Optional falconSeal,
++      final java.util.List extraSeals) {
 +    final CommitPayload payload =
-+        new CommitPayload(roundIdentifier, digest, commitSeal, falconSeal);
++        new CommitPayload(roundIdentifier, digest, commitSeal, falconSeal, extraSeals);
      return new Commit(createSignedMessage(payload));
    }
  
+   /**
+    * Create round change payload.
+    *
+    * @param roundIdentifier the round identifier
+    * @param preparedRoundData the prepared round data
+    * @return the round change
+    */
+   public RoundChange createRoundChange(
+       final ConsensusRoundIdentifier roundIdentifier,
+       final Optional preparedRoundData) {
++    return createRoundChange(roundIdentifier, preparedRoundData, Optional.empty());
++  }
++
++  /**
++   * Create round change carrying the author's post-quantum seal. AERE PQ (2026-08-31): the sealed
++   * twin of the method above, exactly as at PREPARE and PROPOSAL. With the gate shut every call of
++   * today goes through the seal-less form, which encodes byte for byte as upstream. The author's
++   * ECDSA signature covers the WHOLE payload, seal included, which binds the claimed index to the
++   * identity of the sender.
++   *
++   * @param roundIdentifier the round identifier
++   * @param preparedRoundData the prepared round data
++   * @param falconSeal the author's post-quantum seal, or empty
++   * @return the round change
++   */
++  public RoundChange createRoundChange(
++      final ConsensusRoundIdentifier roundIdentifier,
++      final Optional preparedRoundData,
++      final Optional falconSeal) {
+ 
+     final RoundChangePayload payload;
+     if (preparedRoundData.isPresent()) {
+ 
+       final QbftBlock preparedBlock = preparedRoundData.get().getBlock();
+       payload =
+           new RoundChangePayload(
+               roundIdentifier,
+               Optional.of(
+                   new PreparedRoundMetadata(
+-                      preparedBlock.getHash(), preparedRoundData.get().getRound())));
++                      preparedBlock.getHash(), preparedRoundData.get().getRound())),
++              falconSeal);
+ 
+       return new RoundChange(
+           createSignedMessage(payload),
+           Optional.of(preparedBlock),
+           preparedRoundData.get().getBlockAccessList(),
+           blockEncoder,
+           preparedRoundData.get().getPrepares());
+ 
+     } else {
+-      payload = new RoundChangePayload(roundIdentifier, Optional.empty());
++      payload = new RoundChangePayload(roundIdentifier, Optional.empty(), falconSeal);
+       return new RoundChange(
+           createSignedMessage(payload),
+           Optional.empty(),
+           Optional.empty(),
+           blockEncoder,
+           Collections.emptyList());
+     }
+   }
+ 
+   private  SignedData createSignedMessage(final M payload) {
+     final SECPSignature signature =
+         nodeKey.sign(Bytes32.wrap(payload.hashForSignature().getBytes()));
+     return SignedData.create(payload, signature);
+   }
+ }
+diff --git a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/payload/PreparePayload.java b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/payload/PreparePayload.java
+index b9d53d35f..5533ef604 100644
+--- a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/payload/PreparePayload.java
++++ b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/payload/PreparePayload.java
+@@ -1,110 +1,204 @@
+ /*
+  * Copyright ConsenSys AG.
+  *
+  * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+  * the License. You may obtain a copy of the License at
+  *
+  * http://www.apache.org/licenses/LICENSE-2.0
+  *
+  * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+  * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+  * specific language governing permissions and limitations under the License.
+  *
+  * SPDX-License-Identifier: Apache-2.0
+  */
+ package org.hyperledger.besu.consensus.qbft.core.payload;
+ 
+ import org.hyperledger.besu.consensus.common.bft.ConsensusRoundIdentifier;
++import org.hyperledger.besu.consensus.common.bft.FalconSeal;
+ import org.hyperledger.besu.consensus.common.bft.payload.Payload;
+ import org.hyperledger.besu.consensus.qbft.core.messagedata.QbftV1;
+ import org.hyperledger.besu.datatypes.Hash;
++import org.hyperledger.besu.ethereum.rlp.RLPException;
+ import org.hyperledger.besu.ethereum.rlp.RLPInput;
+ import org.hyperledger.besu.ethereum.rlp.RLPOutput;
+ 
+ import java.util.Objects;
++import java.util.Optional;
+ import java.util.StringJoiner;
+ 
+-/** The Prepare payload. */
++import org.apache.tuweni.bytes.Bytes;
++
++/**
++ * The Prepare payload.
++ *
++ * 
        AERE PQ (2026-08-28), step 1 of PREPARE-SI-ROUNDCHANGE-SUB-PQ-PROIECTARE-2026-08-28: a PREPARE
++ * MAY carry an OPTIONAL Falcon-512 seal from its author, appended at the end, exactly as
++ * {@code CommitPayload} does. A PREPARE without a seal encodes byte for byte as upstream,
++ * and that is precisely the property that lets the binary be rolled onto a live fleet without a
++ * flag day.
++ *
++ * 
        NOTHING EMITS SUCH A PREPARE YET. This file only makes the wire capable of carrying one
++ * and of refusing a malformed one. Emission is the next step and has its own gate, following the
++ * rule paid for at commit: first the binary everywhere, then emission, and only much later
++ * enforcement.
++ *
++ * 
        What the seal signs is NOT this file's business, and the design note states it: its own
++ * domain {@code AERE-PQ-PREPARE-1} over (chainId, number, ROUND, digest). If it signed the same
++ * bytes as a commit seal, a PREPARE seal given honestly could be pasted onto a forged COMMIT and
++ * the enforcement there would accept it.
++ */
+ public class PreparePayload extends QbftPayload {
+   private static final int TYPE = QbftV1.PREPARE;
+   private final ConsensusRoundIdentifier roundIdentifier;
+   private final Hash digest;
++  private final Optional falconSeal;
+ 
+   /**
+-   * Instantiates a new Prepare payload.
++   * Instantiates a new Prepare payload, without a post-quantum seal. Encodes byte-for-byte as
++   * upstream Besu.
+    *
+    * @param roundIdentifier the round identifier
+    * @param digest the digest
+    */
+   public PreparePayload(final ConsensusRoundIdentifier roundIdentifier, final Hash digest) {
++    this(roundIdentifier, digest, Optional.empty());
++  }
++
++  /**
++   * Instantiates a new Prepare payload carrying an optional Falcon-512 seal of its author.
++   *
++   * @param roundIdentifier the round identifier
++   * @param digest the digest
++   * @param falconSeal the author's post-quantum seal, or empty
++   */
++  public PreparePayload(
++      final ConsensusRoundIdentifier roundIdentifier,
++      final Hash digest,
++      final Optional falconSeal) {
+     this.roundIdentifier = roundIdentifier;
+     this.digest = digest;
++    this.falconSeal = falconSeal == null ? Optional.empty() : falconSeal;
+   }
+ 
+   /**
+    * Read from rlp input and return prepare payload.
+    *
++   * 
        STRICTLY CANONICAL, as in {@code CommitPayload} and for the same reason: a PREPARE is an
++   * AUTHENTICATED message, and the author is recovered from the RE-ENCODED payload, not from the
++   * bytes that arrived. Anything the decoder tolerated silently would give several byte strings that
++   * authenticate to the same validator - that is malleability. Decode, re-encode, and the result
++   * must be exactly what came in.
++   *
+    * @param rlpInput the rlp input
+    * @return the prepare payload
++   * @throws RLPException if the received bytes are not the payload's unique canonical encoding
+    */
+   public static PreparePayload readFrom(final RLPInput rlpInput) {
+-    rlpInput.enterList();
+-    final ConsensusRoundIdentifier roundIdentifier = readConsensusRound(rlpInput);
+-    final Hash digest = Payload.readDigest(rlpInput);
+-    rlpInput.leaveList();
+-    return new PreparePayload(roundIdentifier, digest);
++    final RLPInput payloadRlp = rlpInput.readAsRlp();
++    final Bytes received = payloadRlp.raw();
++
++    payloadRlp.enterList();
++    final ConsensusRoundIdentifier roundIdentifier = readConsensusRound(payloadRlp);
++    final Hash digest = Payload.readDigest(payloadRlp);
++
++    // AERE PQ: the OPTIONAL seal [index, signature]. A PREPARE without one ends the list here and
++    // decodes to Optional.empty(), so it stays identical to upstream.
++    Optional falconSeal = Optional.empty();
++    if (!payloadRlp.isEndOfCurrentList()) {
++      payloadRlp.enterList();
++      final int idx = payloadRlp.readIntScalar();
++      final Bytes sig = payloadRlp.readBytes();
++      payloadRlp.leaveList();
++      falconSeal = Optional.of(new FalconSeal(idx, sig));
++    }
++    payloadRlp.leaveList();
++
++    final PreparePayload payload = new PreparePayload(roundIdentifier, digest, falconSeal);
++
++    final Bytes reencoded = payload.encoded();
++    if (!reencoded.equals(received)) {
++      throw new RLPException(
++          "Non-canonical Prepare payload encoding: received "
++              + received.size()
++              + " bytes, canonical form is "
++              + reencoded.size()
++              + " bytes");
++    }
++    return payload;
+   }
+ 
+   @Override
+   public void writeTo(final RLPOutput rlpOutput) {
+     rlpOutput.startList();
+     writeConsensusRound(rlpOutput);
+     rlpOutput.writeBytes(digest.getBytes());
++    // This method DEFINES the canonical encoding: readFrom refuses anything that does not reproduce
++    // it byte for byte. The seal is written only when present, so a seal-less PREPARE is identical
++    // to upstream.
++    if (falconSeal.isPresent()) {
++      final FalconSeal fs = falconSeal.get();
++      rlpOutput.startList();
++      rlpOutput.writeIntScalar(fs.getValidatorIndex());
++      rlpOutput.writeBytes(fs.getSignature());
++      rlpOutput.endList();
++    }
+     rlpOutput.endList();
+   }
+ 
+   @Override
+   public int getMessageType() {
+     return TYPE;
+   }
+ 
+   /**
+    * Gets digest.
+    *
+    * @return the digest
+    */
+   public Hash getDigest() {
+     return digest;
+   }
+ 
++  /**
++   * The author's post-quantum seal, when the message carries one.
++   *
++   * @return the seal, or empty
++   */
++  public Optional getFalconSeal() {
++    return falconSeal;
++  }
++
+   @Override
+   public ConsensusRoundIdentifier getRoundIdentifier() {
+     return roundIdentifier;
+   }
+ 
+   @Override
+   public boolean equals(final Object o) {
+     if (this == o) {
+       return true;
+     }
+     if (o == null || getClass() != o.getClass()) {
+       return false;
+     }
+     final PreparePayload that = (PreparePayload) o;
+     return Objects.equals(roundIdentifier, that.roundIdentifier)
+-        && Objects.equals(digest, that.digest);
++        && Objects.equals(digest, that.digest)
++        && Objects.equals(falconSeal, that.falconSeal);
+   }
+ 
+   @Override
+   public int hashCode() {
+-    return Objects.hash(roundIdentifier, digest);
++    return Objects.hash(roundIdentifier, digest, falconSeal);
+   }
+ 
+   @Override
+   public String toString() {
+     return new StringJoiner(", ", PreparePayload.class.getSimpleName() + "[", "]")
+         .add("roundIdentifier=" + roundIdentifier)
+         .add("digest=" + digest)
++        .add("falconSeal=" + (falconSeal.isPresent() ? "present" : "absent"))
+         .toString();
+   }
+ }
+diff --git a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/payload/ProposalPayload.java b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/payload/ProposalPayload.java
+index eb1a2246c..8daf65caf 100644
+--- a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/payload/ProposalPayload.java
++++ b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/payload/ProposalPayload.java
+@@ -1,167 +1,254 @@
+ /*
+  * Copyright ConsenSys AG.
+  *
+  * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+  * the License. You may obtain a copy of the License at
+  *
+  * http://www.apache.org/licenses/LICENSE-2.0
+  *
+  * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+  * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+  * specific language governing permissions and limitations under the License.
+  *
+  * SPDX-License-Identifier: Apache-2.0
+  */
+ package org.hyperledger.besu.consensus.qbft.core.payload;
+ 
+ import org.hyperledger.besu.consensus.common.bft.ConsensusRoundIdentifier;
++import org.hyperledger.besu.consensus.common.bft.FalconSeal;
+ import org.hyperledger.besu.consensus.qbft.core.messagedata.QbftV1;
+ import org.hyperledger.besu.consensus.qbft.core.types.QbftBlock;
+ import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockCodec;
+ import org.hyperledger.besu.ethereum.core.encoding.BlockAccessListDecoder;
+ import org.hyperledger.besu.ethereum.mainnet.block.access.list.BlockAccessList;
++import org.hyperledger.besu.ethereum.rlp.RLPException;
+ import org.hyperledger.besu.ethereum.rlp.RLPInput;
+ import org.hyperledger.besu.ethereum.rlp.RLPOutput;
+ 
+ import java.util.Objects;
+ import java.util.Optional;
+ 
+ import com.google.common.base.MoreObjects;
+ 
+-/** The Proposal payload. */
++/**
++ * The Proposal payload.
++ *
++ * 
        AERE PQ (2026-08-30), the hot-path step after PREPARE: a PROPOSAL MAY carry an OPTIONAL
++ * Falcon-512 seal from its proposer, appended after the block-access-list element, exactly as
++ * {@code PreparePayload} appends its seal. A proposal without a seal encodes byte for byte as
++ * upstream, which is the property that lets the binary be rolled onto a live fleet without a
++ * flag day.
++ *
++ * 
        NOTHING EMITS SUCH A PROPOSAL YET. This file only makes the wire capable of carrying
++ * one and of refusing a malformed one. Emission has its own gate
++ * ({@code aere.pq.proposalPq.attachBlock}); enforcement has its own height
++ * ({@code aere.pq.proposalPq.forkBlock}); both are absent on every node today, and absent means
++ * never.
++ *
++ * 
        What the seal signs is NOT this file's business: its own domain
++ * {@code AERE-PQ-PROPOSAL-1} over (chainId, height, ROUND, digest) - see
++ * {@code PqAnchor.proposalMessage}. A proposal is an offer, not a vote: with the commit or PREPARE
++ * domain, a proposal seal given honestly could be pasted onto a forged vote and counted.
++ *
++ * 
        Why the trailing element is parsed strictly: the payload is AUTHENTICATED - the author
++ * is recovered from the signature over the encoded payload. A decoder that silently ignored an
++ * unknown trailing element would re-encode without it, so two different byte strings would
++ * authenticate to the same proposer. When a fifth element is present it must be exactly a seal,
++ * and it must be the last element; otherwise the message is refused. Messages of the upstream
++ * shapes (three or four elements) are read exactly as upstream reads them.
++ */
+ public class ProposalPayload extends QbftPayload {
+ 
+   private static final int TYPE = QbftV1.PROPOSAL;
+   private final ConsensusRoundIdentifier roundIdentifier;
+   private final QbftBlock proposedBlock;
+   private final QbftBlockCodec blockEncoder;
+   private final Optional blockAccessList;
++  private final Optional falconSeal;
+ 
+   /**
+-   * Instantiates a new Proposal payload.
++   * Instantiates a new Proposal payload carrying an optional post-quantum seal of its proposer.
+    *
+    * @param roundIdentifier the round identifier
+    * @param proposedBlock the proposed block
+    * @param blockEncoder the qbft block encoder
+    * @param blockAccessList the block access list
++   * @param falconSeal the proposer's post-quantum seal, or empty
+    */
+   public ProposalPayload(
+       final ConsensusRoundIdentifier roundIdentifier,
+       final QbftBlock proposedBlock,
+       final QbftBlockCodec blockEncoder,
+-      final Optional blockAccessList) {
++      final Optional blockAccessList,
++      final Optional falconSeal) {
+     this.roundIdentifier = roundIdentifier;
+     this.proposedBlock = proposedBlock;
+     this.blockEncoder = blockEncoder;
+     this.blockAccessList = blockAccessList;
++    this.falconSeal = falconSeal == null ? Optional.empty() : falconSeal;
++  }
++
++  /**
++   * Instantiates a new Proposal payload, without a post-quantum seal. Encodes byte-for-byte as
++   * upstream Besu.
++   *
++   * @param roundIdentifier the round identifier
++   * @param proposedBlock the proposed block
++   * @param blockEncoder the qbft block encoder
++   * @param blockAccessList the block access list
++   */
++  public ProposalPayload(
++      final ConsensusRoundIdentifier roundIdentifier,
++      final QbftBlock proposedBlock,
++      final QbftBlockCodec blockEncoder,
++      final Optional blockAccessList) {
++    this(roundIdentifier, proposedBlock, blockEncoder, blockAccessList, Optional.empty());
+   }
+ 
+   /**
+    * Instantiates a new Proposal payload.
+    *
+    * @param roundIdentifier the round identifier
+    * @param proposedBlock the proposed block
+    * @param blockEncoder the qbft block encoder
+    */
+   public ProposalPayload(
+       final ConsensusRoundIdentifier roundIdentifier,
+       final QbftBlock proposedBlock,
+       final QbftBlockCodec blockEncoder) {
+-    this(roundIdentifier, proposedBlock, blockEncoder, Optional.empty());
++    this(roundIdentifier, proposedBlock, blockEncoder, Optional.empty(), Optional.empty());
+   }
+ 
+   /**
+    * Read from rlp input and return proposal payload.
+    *
+    * @param rlpInput the rlp input
+    * @param blockEncoder the qbft block encoder
+    * @return the proposal payload
+    */
+   public static ProposalPayload readFrom(
+       final RLPInput rlpInput, final QbftBlockCodec blockEncoder) {
+     rlpInput.enterList();
+     final ConsensusRoundIdentifier roundIdentifier = readConsensusRound(rlpInput);
+     final QbftBlock proposedBlock = blockEncoder.readFrom(rlpInput);
+     final Optional blockAccessList = readBlockAccessList(rlpInput);
++
++    // AERE PQ: the OPTIONAL proposer seal [index, signature]. A proposal without one ends the list
++    // here and decodes to Optional.empty(), so the upstream shapes stay untouched. When a fifth
++    // element exists it must be a seal and it must be last: an unknown trailing element on an
++    // authenticated payload is malleability, not extensibility.
++    Optional falconSeal = Optional.empty();
++    if (!rlpInput.isEndOfCurrentList()) {
++      rlpInput.enterList();
++      final int idx = rlpInput.readIntScalar();
++      final org.apache.tuweni.bytes.Bytes sig = rlpInput.readBytes();
++      rlpInput.leaveList();
++      falconSeal = Optional.of(new FalconSeal(idx, sig));
++      if (!rlpInput.isEndOfCurrentList()) {
++        throw new RLPException(
++            "Proposal payload carries elements after the proposer seal; refusing an encoding the "
++                + "re-encoder would silently drop");
++      }
++    }
+     rlpInput.leaveList();
+ 
+-    return new ProposalPayload(roundIdentifier, proposedBlock, blockEncoder, blockAccessList);
++    return new ProposalPayload(
++        roundIdentifier, proposedBlock, blockEncoder, blockAccessList, falconSeal);
+   }
+ 
+   @Override
+   public void writeTo(final RLPOutput rlpOutput) {
+     rlpOutput.startList();
+     writeConsensusRound(rlpOutput);
+     blockEncoder.writeTo(proposedBlock, rlpOutput);
+     blockAccessList.ifPresentOrElse((bal) -> bal.writeTo(rlpOutput), rlpOutput::writeNull);
++    // The seal is written only when present, so a seal-less proposal is identical to upstream.
++    if (falconSeal.isPresent()) {
++      final FalconSeal fs = falconSeal.get();
++      rlpOutput.startList();
++      rlpOutput.writeIntScalar(fs.getValidatorIndex());
++      rlpOutput.writeBytes(fs.getSignature());
++      rlpOutput.endList();
++    }
+     rlpOutput.endList();
+   }
+ 
+   /**
+    * Gets proposed block.
+    *
+    * @return the proposed block
+    */
+   public QbftBlock getProposedBlock() {
+     return proposedBlock;
+   }
+ 
+   /**
+    * Gets block access list.
+    *
+    * @return the block access list
+    */
+   public Optional getBlockAccessList() {
+     return blockAccessList;
+   }
+ 
++  /**
++   * The proposer's post-quantum seal, when the message carries one.
++   *
++   * @return the seal, or empty
++   */
++  public Optional getFalconSeal() {
++    return falconSeal;
++  }
++
+   @Override
+   public int getMessageType() {
+     return TYPE;
+   }
+ 
+   @Override
+   public ConsensusRoundIdentifier getRoundIdentifier() {
+     return roundIdentifier;
+   }
+ 
+   @Override
+   public boolean equals(final Object o) {
+     if (this == o) {
+       return true;
+     }
+     if (o == null || getClass() != o.getClass()) {
+       return false;
+     }
+     ProposalPayload that = (ProposalPayload) o;
+     return Objects.equals(roundIdentifier, that.roundIdentifier)
+         && Objects.equals(proposedBlock, that.proposedBlock)
+-        && Objects.equals(blockAccessList, that.blockAccessList);
++        && Objects.equals(blockAccessList, that.blockAccessList)
++        && Objects.equals(falconSeal, that.falconSeal);
+   }
+ 
+   @Override
+   public int hashCode() {
+-    return Objects.hash(roundIdentifier, proposedBlock, blockAccessList);
++    return Objects.hash(roundIdentifier, proposedBlock, blockAccessList, falconSeal);
+   }
+ 
+   @Override
+   public String toString() {
+     return MoreObjects.toStringHelper(this)
+         .add("roundIdentifier", roundIdentifier)
+         .add("proposedBlock", proposedBlock)
+         .add("blockAccessList", blockAccessList)
++        .add("falconSeal", falconSeal.isPresent() ? "present" : "absent")
+         .toString();
+   }
+ 
+   private static Optional readBlockAccessList(final RLPInput rlpInput) {
+     if (rlpInput.isEndOfCurrentList()) {
+       // Backward compatibility: pre-26.1.0 messages do not include blockAccessList
+       return Optional.empty();
+     }
+     if (!rlpInput.nextIsNull()) {
+       return Optional.of(BlockAccessListDecoder.decode(rlpInput));
+     }
+     rlpInput.skipNext();
+     return Optional.empty();
+   }
+ }
+diff --git a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/payload/RoundChangePayload.java b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/payload/RoundChangePayload.java
+index 9f4d9abed..32c061304 100644
+--- a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/payload/RoundChangePayload.java
++++ b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/payload/RoundChangePayload.java
+@@ -1,126 +1,211 @@
+ /*
+  * Copyright ConsenSys AG.
+  *
+  * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+  * the License. You may obtain a copy of the License at
+  *
+  * http://www.apache.org/licenses/LICENSE-2.0
+  *
+  * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+  * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+  * specific language governing permissions and limitations under the License.
+  *
+  * SPDX-License-Identifier: Apache-2.0
+  */
+ package org.hyperledger.besu.consensus.qbft.core.payload;
+ 
+ import org.hyperledger.besu.consensus.common.bft.ConsensusRoundIdentifier;
++import org.hyperledger.besu.consensus.common.bft.FalconSeal;
+ import org.hyperledger.besu.consensus.qbft.core.messagedata.QbftV1;
++import org.hyperledger.besu.ethereum.rlp.RLPException;
+ import org.hyperledger.besu.ethereum.rlp.RLPInput;
+ import org.hyperledger.besu.ethereum.rlp.RLPOutput;
+ 
+ import java.util.Objects;
+ import java.util.Optional;
+ 
+ import com.google.common.base.MoreObjects;
+ 
+-/** The Round change payload. */
++/**
++ * The Round change payload.
++ *
++ * 
        AERE PQ (2026-08-31), the LAST hot-path message: a ROUND-CHANGE MAY carry an OPTIONAL
++ * Falcon-512 seal from its author, appended after the prepared-metadata list, exactly as {@code
++ * ProposalPayload} appends its seal. A round-change without a seal encodes byte for byte as
++ * upstream, which is the property that lets the binary be rolled onto a live fleet without a
++ * flag day.
++ *
++ * 
        NOTHING EMITS SUCH A ROUND-CHANGE YET. This file only makes the wire capable of
++ * carrying one and of refusing a malformed one. Emission has its own gate
++ * ({@code aere.pq.roundChangePq.attachBlock}); enforcement has its own height
++ * ({@code aere.pq.roundChangePq.forkBlock}); both are absent on every node today, and absent means
++ * never.
++ *
++ * 
        What the seal signs is NOT this file's business: its own domain
++ * {@code AERE-PQ-ROUNDCHANGE-1} over (chainId, height, targetRound, prepared metadata) - see
++ * {@code PqAnchor.roundChangeMessage}. A round-change STEERS rounds: a quorum of them opens a new
++ * round, and one claiming a prepared block decides which block gets re-proposed. Its seal must be
++ * transferable neither onto a vote nor onto a proposal, nor between a bare round-change and one
++ * with metadata.
++ *
++ * 
        Why the trailing element is parsed strictly: the payload is AUTHENTICATED - the author
++ * is recovered from the signature over the encoded payload. A decoder that silently ignored an
++ * unknown trailing element would re-encode without it, so two different byte strings would
++ * authenticate to the same author. When a fourth element is present it must be exactly a seal, and
++ * it must be the last element; otherwise the message is refused. Messages of the upstream shape
++ * (three elements) are read exactly as upstream reads them.
++ */
+ public class RoundChangePayload extends QbftPayload {
+   private static final int TYPE = QbftV1.ROUND_CHANGE;
+   private final ConsensusRoundIdentifier roundChangeIdentifier;
+   private final Optional preparedRoundMetadata;
++  private final Optional falconSeal;
+ 
+   /**
+-   * Instantiates a new Round change payload.
++   * Instantiates a new Round change payload carrying an optional post-quantum seal of its author.
+    *
+    * @param roundChangeIdentifier the round change identifier
+    * @param preparedRoundMetadata the prepared round metadata
++   * @param falconSeal the author's post-quantum seal, or empty
+    */
+   public RoundChangePayload(
+       final ConsensusRoundIdentifier roundChangeIdentifier,
+-      final Optional preparedRoundMetadata) {
++      final Optional preparedRoundMetadata,
++      final Optional falconSeal) {
+     this.roundChangeIdentifier = roundChangeIdentifier;
+     this.preparedRoundMetadata = preparedRoundMetadata;
++    this.falconSeal = falconSeal == null ? Optional.empty() : falconSeal;
++  }
++
++  /**
++   * Instantiates a new Round change payload, without a post-quantum seal. Encodes byte-for-byte as
++   * upstream Besu.
++   *
++   * @param roundChangeIdentifier the round change identifier
++   * @param preparedRoundMetadata the prepared round metadata
++   */
++  public RoundChangePayload(
++      final ConsensusRoundIdentifier roundChangeIdentifier,
++      final Optional preparedRoundMetadata) {
++    this(roundChangeIdentifier, preparedRoundMetadata, Optional.empty());
+   }
+ 
+   @Override
+   public ConsensusRoundIdentifier getRoundIdentifier() {
+     return roundChangeIdentifier;
+   }
+ 
+   /**
+    * Gets prepared round metadata.
+    *
+    * @return the prepared round metadata
+    */
+   public Optional getPreparedRoundMetadata() {
+     return preparedRoundMetadata;
+   }
+ 
++  /**
++   * The author's post-quantum seal, when the message carries one.
++   *
++   * @return the seal, or empty
++   */
++  public Optional getFalconSeal() {
++    return falconSeal;
++  }
++
+   @Override
+   public void writeTo(final RLPOutput rlpOutput) {
+     // RLP encode of the message data content (round identifier and prepared certificate)
+     rlpOutput.startList();
+     writeConsensusRound(rlpOutput);
+ 
+     rlpOutput.startList();
+     preparedRoundMetadata.ifPresent(prm -> prm.writeTo(rlpOutput));
+     rlpOutput.endList();
+ 
++    // The seal is written only when present, so a seal-less round-change is identical to upstream.
++    if (falconSeal.isPresent()) {
++      final FalconSeal fs = falconSeal.get();
++      rlpOutput.startList();
++      rlpOutput.writeIntScalar(fs.getValidatorIndex());
++      rlpOutput.writeBytes(fs.getSignature());
++      rlpOutput.endList();
++    }
++
+     rlpOutput.endList();
+   }
+ 
+   /**
+    * Read from rlp input and return round change payload.
+    *
+    * @param rlpInput the rlp input
+    * @return the round change payload
+    */
+   public static RoundChangePayload readFrom(final RLPInput rlpInput) {
+     rlpInput.enterList();
+     final ConsensusRoundIdentifier roundIdentifier = readConsensusRound(rlpInput);
+     final Optional preparedRoundMetadata;
+ 
+     rlpInput.enterList();
+     if (rlpInput.isEndOfCurrentList()) {
+       preparedRoundMetadata = Optional.empty();
+     } else {
+       preparedRoundMetadata = Optional.of(PreparedRoundMetadata.readFrom(rlpInput));
+     }
+     rlpInput.leaveList();
+ 
++    // AERE PQ: the OPTIONAL author seal [index, signature]. A round-change without one ends the
++    // list here and decodes to Optional.empty(), so the upstream shape stays untouched. When a
++    // fourth element exists it must be a seal and it must be last: an unknown trailing element on
++    // an authenticated payload is malleability, not extensibility.
++    Optional falconSeal = Optional.empty();
++    if (!rlpInput.isEndOfCurrentList()) {
++      rlpInput.enterList();
++      final int idx = rlpInput.readIntScalar();
++      final org.apache.tuweni.bytes.Bytes sig = rlpInput.readBytes();
++      rlpInput.leaveList();
++      falconSeal = Optional.of(new FalconSeal(idx, sig));
++      if (!rlpInput.isEndOfCurrentList()) {
++        throw new RLPException(
++            "RoundChange payload carries elements after the author seal; refusing an encoding the "
++                + "re-encoder would silently drop");
++      }
++    }
++
+     rlpInput.leaveList();
+-    return new RoundChangePayload(roundIdentifier, preparedRoundMetadata);
++    return new RoundChangePayload(roundIdentifier, preparedRoundMetadata, falconSeal);
+   }
+ 
+   @Override
+   public int getMessageType() {
+     return TYPE;
+   }
+ 
+   @Override
+   public boolean equals(final Object o) {
+     if (this == o) {
+       return true;
+     }
+     if (o == null || getClass() != o.getClass()) {
+       return false;
+     }
+     RoundChangePayload that = (RoundChangePayload) o;
+     return Objects.equals(roundChangeIdentifier, that.roundChangeIdentifier)
+-        && Objects.equals(preparedRoundMetadata, that.preparedRoundMetadata);
++        && Objects.equals(preparedRoundMetadata, that.preparedRoundMetadata)
++        && Objects.equals(falconSeal, that.falconSeal);
+   }
+ 
+   @Override
+   public int hashCode() {
+-    return Objects.hash(roundChangeIdentifier, preparedRoundMetadata);
++    return Objects.hash(roundChangeIdentifier, preparedRoundMetadata, falconSeal);
+   }
+ 
+   @Override
+   public String toString() {
+     return MoreObjects.toStringHelper(this)
+         .add("roundChangeIdentifier", roundChangeIdentifier)
+         .add("preparedRoundMetadata", preparedRoundMetadata)
++        .add("falconSeal", falconSeal.isPresent() ? "present" : "absent")
+         .toString();
+   }
+ }
 diff --git a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/statemachine/QbftBlockHeightManager.java b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/statemachine/QbftBlockHeightManager.java
-index 49099c2c1..f8cd07112 100644
+index 49099c2c1..bc404409c 100644
 --- a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/statemachine/QbftBlockHeightManager.java
 +++ b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/statemachine/QbftBlockHeightManager.java
-@@ -11,12 +11,19 @@
+@@ -1,39 +1,46 @@
+ /*
+  * Copyright ConsenSys AG.
+  *
+  * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+  * the License. You may obtain a copy of the License at
+  *
+  * http://www.apache.org/licenses/LICENSE-2.0
+  *
+  * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+  * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
   * specific language governing permissions and limitations under the License.
   *
   * SPDX-License-Identifier: Apache-2.0
@@ -21636,7 +31563,41 @@ index 49099c2c1..f8cd07112 100644
  import org.hyperledger.besu.consensus.common.bft.payload.Payload;
  import org.hyperledger.besu.consensus.qbft.core.messagewrappers.Commit;
  import org.hyperledger.besu.consensus.qbft.core.messagewrappers.Prepare;
-@@ -200,8 +207,26 @@ public class QbftBlockHeightManager implements BaseQbftBlockHeightManager {
+ import org.hyperledger.besu.consensus.qbft.core.messagewrappers.Proposal;
+ import org.hyperledger.besu.consensus.qbft.core.messagewrappers.RoundChange;
+ import org.hyperledger.besu.consensus.qbft.core.network.QbftMessageTransmitter;
+ import org.hyperledger.besu.consensus.qbft.core.payload.MessageFactory;
+ import org.hyperledger.besu.consensus.qbft.core.types.QbftBlock;
+ import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockCreator;
+ import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockHeader;
+ import org.hyperledger.besu.consensus.qbft.core.types.QbftFinalState;
+ import org.hyperledger.besu.consensus.qbft.core.types.QbftValidatorProvider;
+ import org.hyperledger.besu.consensus.qbft.core.validation.FutureRoundProposalMessageValidator;
+ import org.hyperledger.besu.consensus.qbft.core.validation.MessageValidatorFactory;
+ import org.hyperledger.besu.datatypes.Address;
+ import org.hyperledger.besu.ethereum.mainnet.block.access.list.BlockAccessList;
+ import org.hyperledger.besu.plugin.services.securitymodule.SecurityModuleException;
+ 
+ import java.time.Clock;
+ import java.util.Collection;
+@@ -183,42 +190,60 @@ public class QbftBlockHeightManager implements BaseQbftBlockHeightManager {
+           "Block timer expired for a round ({}) other than current ({})",
+           roundIdentifier,
+           qbftRound.getRoundIdentifier());
+     }
+   }
+ 
+   private void buildBlockAndMaybePropose(
+       final ConsensusRoundIdentifier roundIdentifier, final QbftRound qbftRound) {
+ 
+     // mining will be checked against round 0 as the current round is initialised to 0 above
+     final boolean isProposer =
+         finalState.isLocalNodeProposerForRound(qbftRound.getRoundIdentifier());
+ 
+     if (!isProposer) {
+       // nothing to do here...
+       LOG.trace("This node is not a proposer so it will not send a proposal: " + roundIdentifier);
+       return;
      }
  
      final long headerTimeStampSeconds = Math.round(clock.millis() / 1000D);
@@ -21665,11 +31626,319 @@ index 49099c2c1..f8cd07112 100644
      final QbftBlock block = blockCreationResult.block();
      final Optional blockAccessList = blockCreationResult.blockAccessList();
      if (!block.isEmpty()) {
+       LOG.trace(
+           "Block is not empty and this node is a proposer so it will send a proposal: "
+               + roundIdentifier);
+       qbftRound.updateStateWithProposalAndTransmit(
+           block, blockAccessList, Collections.emptyList(), Collections.emptyList());
+     } else {
+       // handle the block times period
+       final long currentTimeInMillis = finalState.getClock().millis();
+       boolean emptyBlockExpired =
+           finalState
+               .getBlockTimer()
+               .checkEmptyBlockExpired(parentHeader::getTimestamp, currentTimeInMillis);
+       if (emptyBlockExpired) {
+         LOG.trace(
+             "Block has no transactions and this node is a proposer so it will send a proposal: "
+                 + roundIdentifier);
+         qbftRound.updateStateWithProposalAndTransmit(
+@@ -287,53 +312,97 @@ public class QbftBlockHeightManager implements BaseQbftBlockHeightManager {
+         && currentRound.get().getRoundIdentifier().getRoundNumber() >= newRoundNumber) {
+       return;
+     }
+     LOG.debug(
+         "Round has expired or changing based on RC quorum, creating PreparedCertificate and notifying peers. round={}",
+         currentRound.get().getRoundIdentifier());
+     final Optional preparedCertificate =
+         currentRound.get().constructPreparedCertificate();
+ 
+     if (preparedCertificate.isPresent()) {
+       latestPreparedCertificate = preparedCertificate;
+     }
+ 
+     startNewRound(newRoundNumber);
+     if (currentRound.isEmpty()) {
+       LOG.info("Failed to start round ");
+       return;
+     }
+     QbftRound qbftRoundNew = currentRound.get();
+ 
++    RoundChange localRoundChange = null;
+     try {
+-      final RoundChange localRoundChange =
+-          messageFactory.createRoundChange(
+-              qbftRoundNew.getRoundIdentifier(), latestPreparedCertificate);
++      final Optional roundChangeSeal =
++          roundChangeSealFor(qbftRoundNew.getRoundIdentifier(), latestPreparedCertificate);
++      localRoundChange =
++          roundChangeSeal.isPresent()
++              ? messageFactory.createRoundChange(
++                  qbftRoundNew.getRoundIdentifier(), latestPreparedCertificate, roundChangeSeal)
++              : messageFactory.createRoundChange(
++                  qbftRoundNew.getRoundIdentifier(), latestPreparedCertificate);
+ 
+       // Its possible the locally created RoundChange triggers the transmission of a NewRound
+       // message - so it must be handled accordingly.
+       handleRoundChangePayload(localRoundChange);
+     } catch (final SecurityModuleException e) {
+       LOG.warn("Failed to create signed RoundChange message.", e);
+     }
+ 
+-    transmitter.multicastRoundChange(qbftRoundNew.getRoundIdentifier(), latestPreparedCertificate);
++    // THE SAME seal object goes on the wire. The transmitter re-creates the round-change, so
++    // without this the local copy would be sealed and the wire copy not - the exact defect F84
++    // measured on the PROPOSAL. And it must be the SAME object, not a second signing: Falcon
++    // signatures are randomised, so a re-signed wire copy would differ from the local one byte for
++    // byte. With the gate closed the OLD call is taken, call for call, so a node that emits
++    // nothing new goes through the same calls as upstream.
++    if (localRoundChange != null
++        && localRoundChange.getSignedPayload().getPayload().getFalconSeal().isPresent()) {
++      transmitter.multicastRoundChange(localRoundChange);
++    } else {
++      transmitter.multicastRoundChange(
++          qbftRoundNew.getRoundIdentifier(), latestPreparedCertificate);
++    }
++  }
++
++  /**
++   * This node's own post-quantum seal for a ROUND-CHANGE it is about to emit, or empty on every
++   * node where the emission gate ({@code aere.pq.roundChangePq.attachBlock}) is shut - which is
++   * every node today. The prepared metadata goes INTO the signed message, so a seal from a bare
++   * round-change cannot be replayed onto one that claims a prepared block.
++   */
++  private Optional roundChangeSealFor(
++      final ConsensusRoundIdentifier roundIdentifier,
++      final Optional preparedCertificate) {
++    final long height = roundIdentifier.getSequenceNumber();
++    final long chainId =
++        org.hyperledger.besu.consensus.common.bft.blockcreation.PqAnchorProducer.config().chainId();
++    final org.apache.tuweni.bytes.Bytes32 message =
++        preparedCertificate.isPresent()
++            ? org.hyperledger.besu.consensus.common.bft.PqAnchor.roundChangeMessage(
++                chainId,
++                height,
++                roundIdentifier.getRoundNumber(),
++                preparedCertificate.get().getRound(),
++                preparedCertificate.get().getBlock().getHash().getBytes())
++            : org.hyperledger.besu.consensus.common.bft.PqAnchor.roundChangeMessage(
++                chainId, height, roundIdentifier.getRoundNumber());
++    return org.hyperledger.besu.consensus.common.bft.FalconSealSupport.instance()
++        .signRoundChange(height, message);
+   }
+ 
+   @Override
+   public void handleProposalPayload(final Proposal proposal) {
+     LOG.trace("Received a Proposal Payload.");
+     final MessageAge messageAge =
+         determineAgeOfPayload(proposal.getRoundIdentifier().getRoundNumber());
+ 
+     if (messageAge == MessageAge.PRIOR_ROUND) {
+       LOG.trace("Received Proposal Payload for a prior round={}", proposal.getRoundIdentifier());
+     } else {
+       if (messageAge == MessageAge.FUTURE_ROUND) {
+         if (!futureRoundProposalMessageValidator.validateProposalMessage(proposal)) {
+           LOG.info("Received future Proposal which is illegal, no round change triggered.");
+           return;
+         }
+         startNewRound(proposal.getRoundIdentifier().getRoundNumber());
+       }
+       currentRound.ifPresent(r -> r.handleProposalMessage(proposal));
+     }
+diff --git a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/statemachine/QbftController.java b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/statemachine/QbftController.java
+index c049ccfe9..e586889ab 100644
+--- a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/statemachine/QbftController.java
++++ b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/statemachine/QbftController.java
+@@ -2,63 +2,66 @@
+  * Copyright contributors to Besu.
+  *
+  * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+  * the License. You may obtain a copy of the License at
+  *
+  * http://www.apache.org/licenses/LICENSE-2.0
+  *
+  * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+  * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+  * specific language governing permissions and limitations under the License.
+  *
+  * SPDX-License-Identifier: Apache-2.0
+  */
+ package org.hyperledger.besu.consensus.qbft.core.statemachine;
+ 
+ import static org.hyperledger.besu.consensus.qbft.core.validation.ValidatorUtil.isMsgForCurrentHeight;
+ import static org.hyperledger.besu.consensus.qbft.core.validation.ValidatorUtil.isMsgForFutureChainHeight;
+ import static org.hyperledger.besu.consensus.qbft.core.validation.ValidatorUtil.isMsgFromKnownValidator;
+ 
+ import org.hyperledger.besu.consensus.common.bft.ConsensusRoundIdentifier;
++import org.hyperledger.besu.consensus.common.bft.FalconSeal;
++import org.hyperledger.besu.consensus.common.bft.PqSealCache;
+ import org.hyperledger.besu.consensus.common.bft.MessageTracker;
+ import org.hyperledger.besu.consensus.common.bft.events.BlockTimerExpiry;
+ import org.hyperledger.besu.consensus.common.bft.events.RoundExpiry;
+ import org.hyperledger.besu.consensus.common.bft.messagewrappers.BftMessage;
+ import org.hyperledger.besu.consensus.common.bft.statemachine.FutureMessageBuffer;
+ import org.hyperledger.besu.consensus.qbft.core.messagewrappers.Commit;
+ import org.hyperledger.besu.consensus.qbft.core.messagewrappers.Prepare;
+ import org.hyperledger.besu.consensus.qbft.core.messagewrappers.Proposal;
+ import org.hyperledger.besu.consensus.qbft.core.messagewrappers.QbftMessageDecoder;
+ import org.hyperledger.besu.consensus.qbft.core.messagewrappers.RoundChange;
+ import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockCodec;
+ import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockHeader;
+ import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockchain;
+ import org.hyperledger.besu.consensus.qbft.core.types.QbftEventHandler;
+ import org.hyperledger.besu.consensus.qbft.core.types.QbftFinalState;
+ import org.hyperledger.besu.consensus.qbft.core.types.QbftGossiper;
+ import org.hyperledger.besu.consensus.qbft.core.types.QbftMessage;
+ import org.hyperledger.besu.consensus.qbft.core.types.QbftNewChainHead;
+ import org.hyperledger.besu.consensus.qbft.core.types.QbftReceivedMessageEvent;
+ import org.hyperledger.besu.consensus.qbft.core.validation.MessageValidator;
+ import org.hyperledger.besu.consensus.qbft.core.validation.RoundChangeMessageValidator;
+ import org.hyperledger.besu.ethereum.p2p.rlpx.wire.MessageData;
+ 
++import java.util.List;
+ import java.util.Optional;
+ import java.util.concurrent.atomic.AtomicBoolean;
+ import java.util.function.Consumer;
+ 
+ import org.slf4j.Logger;
+ import org.slf4j.LoggerFactory;
+ 
+ /** The Qbft controller. */
+ public class QbftController implements QbftEventHandler {
+ 
+   private static final Logger LOG = LoggerFactory.getLogger(QbftController.class);
+   private final QbftBlockchain blockchain;
+   private final QbftFinalState finalState;
+   private final FutureMessageBuffer futureMessageBuffer;
+   private final QbftGossiper gossiper;
+   private final MessageTracker duplicateMessageTracker;
+   private final AtomicBoolean started = new AtomicBoolean(false);
+   private final QbftBlockCodec blockEncoder;
+   private final QbftMessageDecoder messageDecoder = new QbftMessageDecoder();
+   private BaseQbftBlockHeightManager currentHeightManager;
+@@ -194,53 +197,107 @@ public class QbftController implements QbftEventHandler {
+   /**
+    * Consume message.
+    *
+    * @param 
         the type parameter of BftMessage
+    * @param message the message
+    * @param bftMessage the bft message
+    * @param handleMessage the handle message
+    * @param isReplayed the message is being replayed
+    */
+   protected 
        > void consumeMessage(
+       final QbftMessage message,
+       final P bftMessage,
+       final Consumer
         handleMessage,
+       final boolean isReplayed) {
+     LOG.trace("Received BFT {} message", bftMessage.getClass().getSimpleName());
+ 
+     // Discard all messages which target the BLOCKCHAIN height (which SHOULD be 1 less than
+     // the currentHeightManager, but CAN be the same directly following import).
+     if (bftMessage.getRoundIdentifier().getSequenceNumber()
+         <= blockchain.getChainHeadBlockNumber()) {
++      // AERE D-227: before the message dies here, keep its Falcon seal if it is still useful.
++      pqSalvageLateSeal(bftMessage);
+       LOG.debug(
+           "Discarding a message which targets a height {} not above current chain height {}.",
+           bftMessage.getRoundIdentifier().getSequenceNumber(),
+           blockchain.getChainHeadBlockNumber());
+       return;
+     }
+ 
+     if (processMessage(bftMessage, message)) {
+       gossiper.send(message, isReplayed);
+       handleMessage.accept(bftMessage);
+     }
+   }
+ 
++  /**
++   * AERE D-227 (2026-08-14): keep the Falcon seal of a Commit that arrives AFTER its block was
++   * imported, instead of discarding it with the message.
++   *
++   * 
        Why this exists, measured on chain 2800: a block imports on the quorum-th Commit, and the
++   * Commits of the slowest validators consistently arrive tens of milliseconds later - after the
++   * height gate above starts discarding them. Their Falcon seals never reached the seal cache, so
++   * the proposer of the NEXT block (which reads the cache roughly half a block-period later, plenty
++   * of time) could never carry them. Seal circulation measured per signer: the two slowest-disk
++   * nodes appeared in 3% and 14% of other proposers' certificates while appearing in 100% of their
++   * own. The ECDSA path is unaffected either way - by the time a Commit reaches this branch its
++   * block is already imported.
++   *
++   * 
        What is deliberately NOT relaxed: the message itself still dies. Only the seal is copied
++   * out, and only when ALL of the following hold: the message is a Commit carrying a seal, its
++   * height is EXACTLY the chain head (an older seal can never be asked for again), its digest is
++   * the head's own hash (a losing round or a fork sibling is not ours to keep), and its author is
++   * a known validator (so a non-validator peer cannot write into the cache). A seal that lies
++   * about its signer index still cannot reach a header: the producer Falcon-verifies every cached
++   * seal against the anchored registry before carrying it.
++   */
++  private void pqSalvageLateSeal(final BftMessage bftMessage) {
++    if (!(bftMessage instanceof Commit commit)) {
++      return;
++    }
++    final Optional seal = commit.getFalconSeal();
++    if (seal.isEmpty()) {
++      return;
++    }
++    final long head = blockchain.getChainHeadBlockNumber();
++    if (commit.getRoundIdentifier().getSequenceNumber() != head) {
++      return;
++    }
++    final QbftBlockHeader headHeader = blockchain.getChainHeadHeader();
++    if (!commit.getDigest().equals(headHeader.getHash())) {
++      return;
++    }
++    if (!finalState.getValidators().contains(commit.getAuthor())) {
++      return;
++    }
++    PqSealCache.instance().record(head, headHeader.getHash(), List.of(seal.get()));
++    // D-339 (2026-09-04): the hybrid extras ride the SAME late commits, and until today this path
++    // dropped them. The anchor needs K seals of EVERY scheme, so a salvaged Falcon seal without its
++    // SLH-DSA twin still left the proposer short and the anchor still lost its round.
++    final List extras =
++        commit.getExtraSeals();
++    if (!extras.isEmpty()) {
++      PqSealCache.instance().recordExtras(head, headHeader.getHash(), extras);
++    }
++    LOG.trace("AERE D-227: salvaged a late Falcon seal for imported block {}", head);
++  }
++
+   @Override
+   public void handleNewBlockEvent(final QbftNewChainHead newChainHead) {
+     final QbftBlockHeader newBlockHeader = newChainHead.newChainHeadHeader();
+     final QbftBlockHeader currentMiningParent = getCurrentHeightManager().getParentBlockHeader();
+     LOG.debug(
+         "New chain head detected (block number={})," + " currently mining on top of {}.",
+         newBlockHeader.getNumber(),
+         currentMiningParent.getNumber());
+     if (newBlockHeader.getNumber() < currentMiningParent.getNumber()) {
+       LOG.trace(
+           "Discarding NewChainHead event, was for previous block height. chainHeight={} eventHeight={}",
+           currentMiningParent.getNumber(),
+           newBlockHeader.getNumber());
+       return;
+     }
+ 
+     if (newBlockHeader.getNumber() == currentMiningParent.getNumber()) {
+       if (newBlockHeader.getHash().equals(currentMiningParent.getHash())) {
+         LOG.trace(
+             "Discarding duplicate NewChainHead event. chainHeight={} newBlockHash={} parentBlockHash={}",
 diff --git a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/statemachine/QbftRound.java b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/statemachine/QbftRound.java
-index 832149e2f..054b9c36c 100644
+index 832149e2f..3d0138d9c 100644
 --- a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/statemachine/QbftRound.java
 +++ b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/statemachine/QbftRound.java
-@@ -11,13 +11,25 @@
+@@ -1,97 +1,126 @@
+ /*
+  * Copyright ConsenSys AG.
+  *
+  * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+  * the License. You may obtain a copy of the License at
+  *
+  * http://www.apache.org/licenses/LICENSE-2.0
+  *
+  * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+  * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
   * specific language governing permissions and limitations under the License.
   *
   * SPDX-License-Identifier: Apache-2.0
@@ -21695,7 +31964,24 @@ index 832149e2f..054b9c36c 100644
  import org.hyperledger.besu.consensus.common.bft.payload.SignedData;
  import org.hyperledger.besu.consensus.qbft.core.messagewrappers.Commit;
  import org.hyperledger.besu.consensus.qbft.core.messagewrappers.Prepare;
-@@ -42,6 +54,7 @@ import org.hyperledger.besu.ethereum.mainnet.block.access.list.BlockAccessList;
+ import org.hyperledger.besu.consensus.qbft.core.messagewrappers.Proposal;
+ import org.hyperledger.besu.consensus.qbft.core.network.QbftMessageTransmitter;
+ import org.hyperledger.besu.consensus.qbft.core.payload.MessageFactory;
+ import org.hyperledger.besu.consensus.qbft.core.payload.PreparePayload;
+ import org.hyperledger.besu.consensus.qbft.core.payload.RoundChangePayload;
+ import org.hyperledger.besu.consensus.qbft.core.types.QbftBlock;
+ import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockCreator;
+ import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockCreator.BlockCreationResult;
+ import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockHeader;
+ import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockImporter;
+ import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockInterface;
+ import org.hyperledger.besu.consensus.qbft.core.types.QbftMinedBlockObserver;
+ import org.hyperledger.besu.consensus.qbft.core.types.QbftProtocolSchedule;
+ import org.hyperledger.besu.crypto.SECPSignature;
+ import org.hyperledger.besu.cryptoservices.NodeKey;
+ import org.hyperledger.besu.datatypes.Address;
+ import org.hyperledger.besu.datatypes.Hash;
+ import org.hyperledger.besu.ethereum.mainnet.block.access.list.BlockAccessList;
  import org.hyperledger.besu.plugin.services.securitymodule.SecurityModuleException;
  import org.hyperledger.besu.util.Subscribers;
  
@@ -21703,7 +31989,33 @@ index 832149e2f..054b9c36c 100644
  import java.util.List;
  import java.util.Optional;
  
-@@ -75,6 +88,22 @@ public class QbftRound {
+ import org.apache.tuweni.bytes.Bytes32;
+ import org.slf4j.Logger;
+ import org.slf4j.LoggerFactory;
+ 
+ /** The Qbft round. */
+ public class QbftRound {
+ 
+   private static final Logger LOG = LoggerFactory.getLogger(QbftRound.class);
+ 
+   private final Subscribers observers;
+ 
+   /** The Round state. */
+   protected final RoundState roundState;
+ 
+   /** The Block creator. */
+   protected final QbftBlockCreator blockCreator;
+ 
+   /** The Protocol context. */
+   protected final QbftBlockInterface blockInterface;
+ 
+   /** The Protocol schedule. */
+   protected final QbftProtocolSchedule protocolSchedule;
+ 
+   private final NodeKey nodeKey;
+   private final Address localAddress;
+   private final MessageFactory messageFactory; // used only to create stored local msgs
+   private final QbftMessageTransmitter transmitter;
  
    private final QbftBlockHeader parentHeader;
  
@@ -21726,7 +32038,41 @@ index 832149e2f..054b9c36c 100644
    /**
     * Instantiates a new Qbft round.
     *
-@@ -159,8 +188,26 @@ public class QbftRound {
+    * @param roundState the round state
+    * @param blockCreator the block creator
+    * @param blockInterface the block interface
+    * @param protocolSchedule the protocol schedule
+    * @param observers the observers
+    * @param nodeKey the node key
+    * @param localAddress the local address
+    * @param messageFactory the message factory
+    * @param transmitter the transmitter
+    * @param roundTimer the round timer
+    * @param parentHeader the parent header
+    */
+   public QbftRound(
+       final RoundState roundState,
+       final QbftBlockCreator blockCreator,
+       final QbftBlockInterface blockInterface,
+       final QbftProtocolSchedule protocolSchedule,
+@@ -142,257 +171,576 @@ public class QbftRound {
+   public BlockCreationResult createBlock(final long headerTimeStampSeconds) {
+     LOG.debug("Creating proposed block. round={}", roundState.getRoundIdentifier());
+     return blockCreator.createBlock(headerTimeStampSeconds, this.parentHeader);
+   }
+ 
+   /**
+    * Start round with.
+    *
+    * @param roundChangeArtifacts the round change artifacts
+    * @param headerTimestamp the header timestamp
+    */
+   public void startRoundWith(
+       final RoundChangeArtifacts roundChangeArtifacts, final long headerTimestamp) {
+     final Optional bestPreparedCertificate =
+         roundChangeArtifacts.getBestPreparedPeer();
+ 
+     final QbftBlock blockToPublish;
      final Optional blockAccessList;
      if (bestPreparedCertificate.isEmpty()) {
        LOG.debug("Sending proposal with new block. round={}", roundState.getRoundIdentifier());
@@ -21755,7 +32101,214 @@ index 832149e2f..054b9c36c 100644
        blockToPublish = blockCreationResult.block();
        blockAccessList = blockCreationResult.blockAccessList();
      } else {
-@@ -282,23 +329,33 @@ public class QbftRound {
+       LOG.debug(
+           "Sending proposal from PreparedCertificate. round={}", roundState.getRoundIdentifier());
+       QbftBlock preparedBlock = bestPreparedCertificate.get().getBlock();
+       blockToPublish =
+           blockInterface.replaceRoundAndProposerForProposalBlock(
+               preparedBlock, roundState.getRoundIdentifier().getRoundNumber(), localAddress);
+       blockAccessList = bestPreparedCertificate.get().getBlockAccessList();
+     }
+ 
+     LOG.debug(" proposal - new/prepared block hash : {}", blockToPublish.getHash());
+ 
+     updateStateWithProposalAndTransmit(
+         blockToPublish,
+         blockAccessList,
+         roundChangeArtifacts.getRoundChanges(),
+         bestPreparedCertificate.map(PreparedCertificate::getPrepares).orElse(emptyList()));
+   }
+ 
+   /**
+    * Update state with proposal and transmit.
+    *
+    * @param block the block
+    * @param blockAccessList optional block access list
+    * @param roundChanges the round changes
+    * @param prepares the prepares
+    */
+   protected void updateStateWithProposalAndTransmit(
+       final QbftBlock block,
+       final Optional blockAccessList,
+       final List> roundChanges,
+       final List> prepares) {
+     final Proposal proposal;
+     try {
++      // AERE PQ PROPOSAL (2026-08-30): the seal is computed once, here, and rides INSIDE the
++      // signed payload. With the gate closed - every node today - the seal is empty and the OLD
++      // overload is taken call for call, so a node that emits nothing new behaves identically to
++      // one from before this change. Same pattern as PREPARE and commit, deliberately.
++      final Optional proposalSeal = proposalSealFor(block);
+       proposal =
+-          messageFactory.createProposal(
+-              getRoundIdentifier(), block, blockAccessList, roundChanges, prepares);
++          proposalSeal.isPresent()
++              ? messageFactory.createProposal(
++                  getRoundIdentifier(), block, blockAccessList, roundChanges, prepares,
++                  proposalSeal)
++              : messageFactory.createProposal(
++                  getRoundIdentifier(), block, blockAccessList, roundChanges, prepares);
+     } catch (final SecurityModuleException e) {
+       LOG.warn("Failed to create a signed Proposal, waiting for next round.", e);
+       return;
+     }
+ 
+-    transmitter.multicastProposal(
+-        proposal.getRoundIdentifier(),
+-        proposal.getSignedPayload().getPayload().getProposedBlock(),
+-        proposal.getBlockAccessList(),
+-        roundChanges,
+-        prepares);
++    // THE SAME seal object goes on the wire. The transmitter re-creates the proposal, so without
++    // this the local copy is sealed and the wire copy is not - measured on the first network run
++    // (F84 scenario A): every peer refused height H round after round while this node's own log
++    // said it had emitted. And it must be the SAME object, not a second signing: Falcon signatures
++    // are randomised, so a re-signed wire copy would differ from the local one byte for byte.
++    // With the gate closed the OLD call is taken, call for call - the upstream tests assert the
++    // five-argument form, and a node that emits nothing new must go through the same calls.
++    final Optional wireSeal =
++        proposal.getSignedPayload().getPayload().getFalconSeal();
++    if (wireSeal.isPresent()) {
++      transmitter.multicastProposal(
++          proposal.getRoundIdentifier(),
++          proposal.getSignedPayload().getPayload().getProposedBlock(),
++          proposal.getBlockAccessList(),
++          roundChanges,
++          prepares,
++          wireSeal);
++    } else {
++      transmitter.multicastProposal(
++          proposal.getRoundIdentifier(),
++          proposal.getSignedPayload().getPayload().getProposedBlock(),
++          proposal.getBlockAccessList(),
++          roundChanges,
++          prepares);
++    }
+     if (updateStateWithProposedBlock(proposal)) {
+       sendPrepare(block);
+     }
+   }
+ 
+   /**
+    * Handle proposal message.
+    *
+    * @param msg the msg
+    */
+   public void handleProposalMessage(final Proposal msg) {
+     LOG.debug(
+         "Received a proposal message. round={}. author={}",
+         roundState.getRoundIdentifier(),
+         msg.getAuthor());
+     final QbftBlock block = msg.getSignedPayload().getPayload().getProposedBlock();
+     if (updateStateWithProposedBlock(msg)) {
+       sendPrepare(block);
+     }
+   }
+ 
+   private void sendPrepare(final QbftBlock block) {
+     LOG.debug("Sending prepare message. round={}", roundState.getRoundIdentifier());
+     try {
++      // AERE PQ PREPARE (2026-08-28), step 2: the seal is computed EXACTLY ONCE here and is
++      // handed to both the local copy and the one on the wire. Falcon signatures are randomised,
++      // so two signings of the same message give two different byte strings; if each copy signed
++      // its own, the same validator would produce two valid and DIFFERENT PREPAREs for the same
++      // round. The gate is closed on every node today, so this is empty until a decision.
++      final Optional falconSeal = prepareSealFor(block);
++      // WITH THE GATE CLOSED the OLD path is taken, call for call. This is not style: the upstream
++      // tests assert exactly the two-argument call, and more importantly a node that emits nothing
++      // new must behave identically to one from before this change - not merely write the same
++      // bytes, but go through the same calls. That way the binary can sit on the fleet with
++      // nothing changing until a decision is made. Same pattern as commit.
+       final Prepare localPrepareMessage =
+-          messageFactory.createPrepare(getRoundIdentifier(), block.getHash());
++          falconSeal.isPresent()
++              ? messageFactory.createPrepare(getRoundIdentifier(), block.getHash(), falconSeal)
++              : messageFactory.createPrepare(getRoundIdentifier(), block.getHash());
+       peerIsPrepared(localPrepareMessage);
+-      transmitter.multicastPrepare(
+-          localPrepareMessage.getRoundIdentifier(), localPrepareMessage.getDigest());
++      if (falconSeal.isPresent()) {
++        transmitter.multicastPrepare(
++            localPrepareMessage.getRoundIdentifier(), localPrepareMessage.getDigest(), falconSeal);
++      } else {
++        transmitter.multicastPrepare(
++            localPrepareMessage.getRoundIdentifier(), localPrepareMessage.getDigest());
++      }
+     } catch (final SecurityModuleException e) {
+       LOG.warn("Failed to create a signed Prepare; {}", e.getMessage());
+     }
+   }
+ 
++  /**
++   * This node's post-quantum seal for the PREPARE of the given block, or empty.
++   *
++   * 
        The signed message has ITS OWN DOMAIN and contains the ROUND - see PqAnchor.prepareMessage
++   * and the 2026-08-28 design note. Under the commit domain, a PREPARE seal given honestly could
++   * be pasted onto a forged COMMIT.
++   */
++  private Optional prepareSealFor(final QbftBlock block) {
++    final long blockNumber = block.getHeader().getNumber();
++    final Bytes32 message =
++        PqAnchor.prepareMessage(
++            PqAnchorProducer.config().chainId(),
++            blockNumber,
++            getRoundIdentifier().getRoundNumber(),
++            block.getHash().getBytes());
++    return FalconSealSupport.instance().signPrepare(blockNumber, message);
++  }
++
++  /**
++   * This node's post-quantum seal for its own PROPOSAL of the given block, or empty.
++   *
++   * 
        Its own domain again - see PqAnchor.proposalMessage. A proposal is an offer, not a vote:
++   * under the PREPARE or commit domain, a proposal seal given honestly could be pasted onto a
++   * forged vote and counted.
++   */
++  private Optional proposalSealFor(final QbftBlock block) {
++    final long blockNumber = block.getHeader().getNumber();
++    final Bytes32 message =
++        PqAnchor.proposalMessage(
++            PqAnchorProducer.config().chainId(),
++            blockNumber,
++            getRoundIdentifier().getRoundNumber(),
++            block.getHash().getBytes());
++    return FalconSealSupport.instance().signProposal(blockNumber, message);
++  }
++
+   /**
+    * Handle prepare message.
+    *
+    * @param msg the msg
+    */
+   public void handlePrepareMessage(final Prepare msg) {
+     LOG.debug(
+         "Received a prepare message. round={}. author={}",
+         roundState.getRoundIdentifier(),
+         msg.getAuthor());
+     peerIsPrepared(msg);
+   }
+ 
+   /**
+    * Handle commit message.
+    *
+    * @param msg the msg
+    */
+   public void handleCommitMessage(final Commit msg) {
+     LOG.debug(
+         "Received a commit message. round={}. author={}",
+         roundState.getRoundIdentifier(),
+         msg.getAuthor());
+     peerIsCommitted(msg);
+   }
+ 
+   /**
+    * Construct prepared certificate.
+    *
+    * @return the optional PreparedCertificate
+    */
+   public Optional constructPreparedCertificate() {
+     return roundState.constructPreparedCertificate();
+   }
  
    private boolean updateStateWithProposedBlock(final Proposal msg) {
      final boolean wasPrepared = roundState.isPrepared();
@@ -21779,12 +32332,18 @@ index 832149e2f..054b9c36c 100644
          return true;
        }
 +      final Optional falconSeal = falconSealFor(block, commitHash);
++      // AERE HYBRID: the other schemes' extras, over the SAME message; empty on any node today.
++      final java.util.List extraSeals =
++          falconSeal.isPresent() ? extraSealsFor(block, commitHash) : java.util.List.of();
  
        // There are times handling a proposed block is enough to enter prepared.
        if (wasPrepared != roundState.isPrepared()) {
          LOG.debug("Sending commit message. round={}", roundState.getRoundIdentifier());
 -        transmitter.multicastCommit(getRoundIdentifier(), block.getHash(), commitSeal);
-+        if (falconSeal.isPresent()) {
++        if (!extraSeals.isEmpty()) {
++          transmitter.multicastCommit(
++              getRoundIdentifier(), block.getHash(), commitSeal, falconSeal, extraSeals);
++        } else if (falconSeal.isPresent()) {
 +          transmitter.multicastCommit(getRoundIdentifier(), block.getHash(), commitSeal, falconSeal);
 +        } else {
 +          transmitter.multicastCommit(getRoundIdentifier(), block.getHash(), commitSeal);
@@ -21792,7 +32351,7 @@ index 832149e2f..054b9c36c 100644
        }
  
        // can automatically add _our_ commit message to the roundState
-@@ -306,18 +363,26 @@ public class QbftRound {
+       // cannot create a prepare message here, as it may be _our_ proposal, and thus we cannot also
        // prepare
        try {
          final Commit localCommitMessage =
@@ -21803,7 +32362,8 @@ index 832149e2f..054b9c36c 100644
 +                    roundState.getRoundIdentifier(),
 +                    msg.getBlock().getHash(),
 +                    commitSeal,
-+                    falconSeal)
++                    falconSeal,
++                    extraSeals)
 +                : messageFactory.createCommit(
 +                    roundState.getRoundIdentifier(), msg.getBlock().getHash(), commitSeal);
          roundState.addCommitMessage(localCommitMessage);
@@ -21824,7 +32384,12 @@ index 832149e2f..054b9c36c 100644
      }
  
      return blockAccepted;
-@@ -330,7 +395,14 @@ public class QbftRound {
+   }
+ 
+   private void peerIsPrepared(final Prepare msg) {
+     final boolean wasPrepared = roundState.isPrepared();
+     roundState.addPrepareMessage(msg);
+     if (wasPrepared != roundState.isPrepared()) {
        LOG.debug("Sending commit message. round={}", roundState.getRoundIdentifier());
        final QbftBlock block = roundState.getProposedBlock().get();
        try {
@@ -21832,7 +32397,13 @@ index 832149e2f..054b9c36c 100644
 +        final Hash commitHash = commitHashFor(block);
 +        final SECPSignature commitSeal = nodeKey.sign(Bytes32.wrap(commitHash.getBytes()));
 +        final Optional falconSeal = falconSealFor(block, commitHash);
-+        if (falconSeal.isPresent()) {
++        // AERE HIBRID: aceleasi extrase si pe drumul tarziu, ca cele doua locuri sa nu divearga.
++        final java.util.List extraSeals =
++            falconSeal.isPresent() ? extraSealsFor(block, commitHash) : java.util.List.of();
++        if (!extraSeals.isEmpty()) {
++          transmitter.multicastCommit(
++              getRoundIdentifier(), block.getHash(), commitSeal, falconSeal, extraSeals);
++        } else if (falconSeal.isPresent()) {
 +          transmitter.multicastCommit(getRoundIdentifier(), block.getHash(), commitSeal, falconSeal);
 +        } else {
 +          transmitter.multicastCommit(getRoundIdentifier(), block.getHash(), commitSeal);
@@ -21840,7 +32411,9 @@ index 832149e2f..054b9c36c 100644
          // Note: the local-node's commit message was added to RoundState on block acceptance
          // and thus does not need to be done again here.
        } catch (final SecurityModuleException e) {
-@@ -340,20 +412,41 @@ public class QbftRound {
+         LOG.warn("Failed to construct a commit seal: {}", e.getMessage());
+       }
+     }
    }
  
    private void peerIsCommitted(final Commit msg) {
@@ -21851,6 +32424,9 @@ index 832149e2f..054b9c36c 100644
 +    // this node has already imported the block. Those late seals are exactly the ones that let a
 +    // proposer reach the threshold K without waiting for its own round to be re-run.
 +    roundState.getProposedBlock().ifPresent(this::pqCacheHeardSeals);
++    if (roundState.getProposedBlock().isEmpty()) {
++      pqCacheSealsOfCommitWithoutProposal(msg);
++    }
 +    // AERE hybrid PQC: attempt import on every commit while not yet imported. In the common case
 +    // this fires exactly once (on the quorum-th commit). Post-fork, if the first attempt lacked a
 +    // complete Falcon quorum certificate (e.g. one of the quorum's validators had a faulty Falcon
@@ -21867,8 +32443,14 @@ index 832149e2f..054b9c36c 100644
    private void importBlockToChain() {
  
 +    // AERE hybrid PQC: pass the gossiped Falcon seals collected from commit messages so the block
-+    // assembler can embed a >= 2f+1 Falcon quorum certificate. When no Falcon seals were gossiped
-+    // (Falcon disabled), fall back to the unchanged ECDSA-only sealing path.
++    // assembler can embed the post-quantum certificate. When no Falcon seals were gossiped (Falcon
++    // disabled), fall back to the unchanged ECDSA-only sealing path.
++    //
++    // WHAT GETS EMBEDDED, corrected 2026-08-19 (finding D-235): NOT a per-block 2f+1 quorum. The
++    // assembler writes a certificate only at an anchor height, over the PARENT, and it needs at
++    // least K valid seals, K being the configured schedule (6 of 9 on chain 2800 today). Between
++    // anchor heights nothing is written. The older wording here said "a >= 2f+1 Falcon quorum
++    // certificate" and described the legacy per-block rule, which is retired at the anchor block.
 +    final Collection falconSeals = roundState.getFalconSeals();
      final QbftBlock blockToImport =
 -        blockCreator.createSealedBlock(
@@ -21888,7 +32470,19 @@ index 832149e2f..054b9c36c 100644
  
      final long blockNumber = blockToImport.getHeader().getNumber();
      if (getRoundIdentifier().getRoundNumber() > 0) {
-@@ -373,19 +466,77 @@ public class QbftRound {
+       LOG.info(
+           "Importing proposed block to chain. round={}, hash={}",
+           getRoundIdentifier(),
+           blockToImport.getHash());
+     } else {
+       LOG.debug(
+           "Importing proposed block to chain. round={}, hash={}",
+           getRoundIdentifier(),
+           blockToImport.getHash());
+     }
+ 
+     final QbftBlockImporter blockImporter =
+         protocolSchedule.getBlockImporter(blockToImport.getHeader());
      final boolean result =
          blockImporter.importBlock(blockToImport, roundState.getProposedBlockAccessList());
      if (!result) {
@@ -21917,12 +32511,52 @@ index 832149e2f..054b9c36c 100644
 +   * on-chain hash, which is the key the producer of the next block looks under. Cheap and
 +   * idempotent: the cache keeps the first seal seen per validator index.
 +   */
++  /**
++   * D-339 (2026-09-04): keep the seals of a Commit even when this node has NO proposal for the
++   * round, keyed on the digest the Commit itself names.
++   *
++   * 
        Why, measured on chain 2800 the same evening: the proposer of an anchor kept refusing with
++   * "this node holds 1 valid eligible Falcon seal ... 0 rejected" - it was not rejecting seals, it
++   * had never heard them. The path above caches only when the round holds the proposed block, so a
++   * node that missed the proposal of the parent's round (or imported that block by any route other
++   * than its own round) collected the Commits and threw their seals away. It then could not build
++   * the certificate of the next anchor, the round expired, and every 32nd height paid the
++   * round-change timeout. Eleven of twelve anchors measured before this fix.
++   *
++   * 
        Safety: only the seal is copied, never the message; the digest is the one the Commit names,
++   * so a losing round writes an entry under a hash that never becomes canonical and is simply never
++   * looked up; and the producer Falcon-verifies every cached seal against the anchored registry
++   * before carrying it, so a seal that lies about its index still cannot reach a header.
++   *
++   * @param msg the commit whose seals are kept
++   */
++  private void pqCacheSealsOfCommitWithoutProposal(final Commit msg) {
++    final long height = roundState.getRoundIdentifier().getSequenceNumber();
++    msg.getFalconSeal()
++        .ifPresent(
++            seal ->
++                PqSealCache.instance()
++                    .record(height, msg.getDigest(), java.util.List.of(seal)));
++    final java.util.List extras =
++        msg.getExtraSeals();
++    if (!extras.isEmpty()) {
++      PqSealCache.instance().recordExtras(height, msg.getDigest(), extras);
++    }
++  }
++
 +  private void pqCacheHeardSeals(final QbftBlock block) {
 +    final Collection seals = roundState.getFalconSeals();
 +    if (seals.isEmpty()) {
 +      return;
 +    }
-+    PqSealCache.instance().record(block.getHeader().getNumber(), pqOnchainHashOf(block), seals);
++    final Hash onchain = pqOnchainHashOf(block);
++    PqSealCache.instance().record(block.getHeader().getNumber(), onchain, seals);
++    // AERE ANCHOR V2: the extra scheme seals ride the same commits and go under the same key.
++    final java.util.List extras =
++        roundState.getExtraSeals();
++    if (!extras.isEmpty()) {
++      PqSealCache.instance().recordExtras(block.getHeader().getNumber(), onchain, extras);
++    }
 +  }
 +
 +  /**
@@ -21938,6 +32572,65 @@ index 832149e2f..054b9c36c 100644
 +    return pqOnchainHash;
 +  }
 +
++  /**
++   * AERE HIBRID (2026-08-25): the non-Falcon seals of this node's hybrid certificate, over the
++   * SAME message the Falcon seal signs (the two are one certificate; two messages would be two
++   * certificates and the verifier could not bind them). Empty on every node that is not
++   * hybrid-configured, and below the emission gate: {@link HybridSealProducer} never throws and
++   * never emits half a certificate.
++   */
++  private java.util.List extraSealsFor(
++      final QbftBlock block, final Hash commitHash) {
++    // ANCHOR PARENTS ONLY (2026-09-03, D-329): an SLH-DSA-128s signature costs seconds here; it is
++    // only ever used in the next anchor's certificate, which is built over the anchor's parent. So
++    // the extras are signed only when the block being committed is the parent of an anchor height.
++    // The same predicate gates the enforcement (PqCommitEnforcement.anchorParentByConfig).
++    final long number = block.getHeader().getNumber();
++    if (!org.hyperledger.besu.consensus.common.bft.blockcreation.PqAnchorProducer.config()
++        .anchorAppliesAt(number + 1L)) {
++      return java.util.List.of();
++    }
++    return hybridExtrasOrEmpty(number, pqSealMessageFor(block, commitHash));
++  }
++
++  /**
++   * D-334 (2026-09-03, mainnet 2800, 125 s of halted chain): the hybrid loader is lazy, so a
++   * registry the container could not read surfaced here, as an exception thrown INTO the QBFT
++   * state machine, at every anchor parent, on every armed node. Three such nodes plus one node
++   * restarting left five of nine. A broken hybrid configuration may cost this node its SLH-DSA
++   * contribution; it must never cost the node its vote. The loader still refuses to START on the
++   * same defect (QbftBesuControllerBuilder calls it at boot), so this catch is the second net.
++   *
++   * @param number the height being committed
++   * @param message the seal message
++   * @return the extras, or an empty list with an ERROR line when the hybrid support cannot sign
++   */
++  static java.util.List hybridExtrasOrEmpty(
++      final long number, final Bytes32 message) {
++    try {
++      return org.hyperledger.besu.consensus.common.bft.HybridSealSupport.instance()
++          .producer()
++          .sealsFor(number, message);
++    } catch (final RuntimeException e) {
++      LOG.error(
++          "AERE HIBRID: extras NOT signed at height {} - {}. This node keeps voting but contributes no"
++              + " SLH-DSA seal until the hybrid configuration is repaired (D-334).",
++          number,
++          e.getMessage());
++      return java.util.List.of();
++    }
++  }
++
++  /** The exact bytes a PQ seal over this block signs; shared by Falcon and the hybrid extras,
++   * so the two halves of a hybrid certificate can never drift onto different messages. */
++  private Bytes32 pqSealMessageFor(final QbftBlock block, final Hash commitHash) {
++    // AERE D-311 (2026-09-02): the form is decided in ONE place, shared with the verifier
++    // (MessageValidator.SubsequentMessageValidator). A second copy of this rule drifted once and
++    // stopped a chain; see PqAnchorProducer.commitSealMessage.
++    return PqAnchorProducer.commitSealMessage(
++        block.getHeader().getNumber(), () -> pqOnchainHashOf(block).getBytes(), commitHash);
++  }
++
 +  private Optional falconSealFor(final QbftBlock block, final Hash commitHash) {
 +    // FalconSealSupport.sign never throws (any fault is swallowed and logged), and returns empty
 +    // when this node holds no Falcon signing key, so the ECDSA commit path is never affected.
@@ -21956,24 +32649,35 @@ index 832149e2f..054b9c36c 100644
 +    // not rebuild it. Every node flips at the same height, since the height is a pure function of
 +    // the same configured H; a node configured with a different H emits seals nobody can use, and
 +    // the producer drops them on verification rather than carrying them into a header.
++    // AERE HIBRID (2026-08-25): mesajul se calculeaza acum intr-UN singur loc, pqSealMessageFor,
++    // impartit cu extrasele hibride; doua copii ale acestei logici ar fi divergat intr-o zi.
 +    final long blockNumber = block.getHeader().getNumber();
-+    final Bytes32 message;
-+    if (PqAnchorProducer.sealMessageIsAnchorForm(blockNumber)) {
-+      message =
-+          PqAnchor.commitMessage(
-+              PqAnchorProducer.config().chainId(), blockNumber, pqOnchainHashOf(block).getBytes());
-+    } else {
-+      message = Bytes32.wrap(commitHash.getBytes());
-+    }
-+    return FalconSealSupport.instance().sign(blockNumber, message);
++    return FalconSealSupport.instance().sign(blockNumber, pqSealMessageFor(block, commitHash));
    }
  
    private QbftBlock createCommitBlock(final QbftBlock block) {
+     return blockInterface.replaceRoundForCommitBlock(block, getRoundIdentifier().getRoundNumber());
+   }
+ 
+   private void notifyNewBlockListeners(final QbftBlock block) {
+     observers.forEach(obs -> obs.blockMined(block));
+   }
+ }
 diff --git a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/statemachine/RoundState.java b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/statemachine/RoundState.java
-index 1c3078602..e7a7aad94 100644
+index 1c3078602..2c798c9e2 100644
 --- a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/statemachine/RoundState.java
 +++ b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/statemachine/RoundState.java
-@@ -11,10 +11,17 @@
+@@ -1,49 +1,57 @@
+ /*
+  * Copyright ConsenSys AG.
+  *
+  * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+  * the License. You may obtain a copy of the License at
+  *
+  * http://www.apache.org/licenses/LICENSE-2.0
+  *
+  * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+  * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
   * specific language governing permissions and limitations under the License.
   *
   * SPDX-License-Identifier: Apache-2.0
@@ -21991,7 +32695,12 @@ index 1c3078602..e7a7aad94 100644
  import org.hyperledger.besu.consensus.qbft.core.messagewrappers.Commit;
  import org.hyperledger.besu.consensus.qbft.core.messagewrappers.Prepare;
  import org.hyperledger.besu.consensus.qbft.core.messagewrappers.Proposal;
-@@ -27,6 +34,7 @@ import org.hyperledger.besu.ethereum.mainnet.block.access.list.BlockAccessList;
+ import org.hyperledger.besu.consensus.qbft.core.types.QbftBlock;
+ import org.hyperledger.besu.consensus.qbft.core.validation.MessageValidator;
+ import org.hyperledger.besu.crypto.SECPSignature;
+ import org.hyperledger.besu.datatypes.Address;
+ import org.hyperledger.besu.ethereum.mainnet.block.access.list.BlockAccessList;
+ 
  import java.util.Collection;
  import java.util.LinkedHashMap;
  import java.util.Map;
@@ -21999,7 +32708,41 @@ index 1c3078602..e7a7aad94 100644
  import java.util.Optional;
  import java.util.stream.Collectors;
  
-@@ -196,6 +204,23 @@ public class RoundState {
+ import org.slf4j.Logger;
+ import org.slf4j.LoggerFactory;
+ 
+ /**
+  * The Round state holds all the messages for a given round and tracks whether quorum has been
+  * reached for the round to be prepared or committed.
+  */
+ public class RoundState {
+   private static final Logger LOG = LoggerFactory.getLogger(RoundState.class);
+ 
+   private final ConsensusRoundIdentifier roundIdentifier;
+   private final MessageValidator validator;
+   private final long quorum;
+ 
+   private Optional proposalMessage = Optional.empty();
+ 
+   // Must track the actual Prepare message, not just the sender, as these may need to be reused
+@@ -179,39 +187,68 @@ public class RoundState {
+   /**
+    * Is committed.
+    *
+    * @return the boolean
+    */
+   public boolean isCommitted() {
+     return committed;
+   }
+ 
+   /**
+    * Gets commit seals.
+    *
+    * @return the commit seals
+    */
+   public Collection getCommitSeals() {
+     return commitMessages.values().stream()
+         .map(cp -> cp.getSignedPayload().getPayload().getCommitSeal())
          .collect(Collectors.toList());
    }
  
@@ -22011,6 +32754,18 @@ index 1c3078602..e7a7aad94 100644
 +   *
 +   * @return the gossiped Falcon seals (possibly empty, never null)
 +   */
++  /**
++   * AERE ANCHOR V2: the extra (non-Falcon) scheme seals gossiped on the collected commit messages,
++   * raw and unverified, for the seal cache and the v2 certificate producer.
++   *
++   * @return the gossiped scheme seals (possibly empty, never null)
++   */
++  public java.util.List getExtraSeals() {
++    return commitMessages.values().stream()
++        .flatMap(cp -> cp.getSignedPayload().getPayload().getExtraSeals().stream())
++        .collect(Collectors.toList());
++  }
++
 +  public Collection getFalconSeals() {
 +    return commitMessages.values().stream()
 +        .map(cp -> cp.getSignedPayload().getPayload().getFalconSeal())
@@ -22023,11 +32778,37 @@ index 1c3078602..e7a7aad94 100644
    /**
     * Construct prepared certificate.
     *
+    * @return the optional prepared certificate
+    */
+   public Optional constructPreparedCertificate() {
+     if (isPrepared()) {
+       return Optional.of(
+           new PreparedCertificate(
+               proposalMessage.get().getSignedPayload().getPayload().getProposedBlock(),
+               prepareMessages.values().stream()
+                   .map(Prepare::getSignedPayload)
+                   .collect(Collectors.toList()),
+               roundIdentifier.getRoundNumber(),
+               proposalMessage.get().getBlockAccessList()));
+     }
+     return Optional.empty();
+   }
+ }
 diff --git a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/types/QbftBlockCreator.java b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/types/QbftBlockCreator.java
 index afe4fb00e..c397cab98 100644
 --- a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/types/QbftBlockCreator.java
 +++ b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/types/QbftBlockCreator.java
-@@ -11,13 +11,21 @@
+@@ -1,53 +1,90 @@
+ /*
+  * Copyright contributors to Besu.
+  *
+  * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+  * the License. You may obtain a copy of the License at
+  *
+  * http://www.apache.org/licenses/LICENSE-2.0
+  *
+  * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+  * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
   * specific language governing permissions and limitations under the License.
   *
   * SPDX-License-Identifier: Apache-2.0
@@ -22049,7 +32830,32 @@ index afe4fb00e..c397cab98 100644
  import java.util.Optional;
  
  /** Responsible for creating a block. */
-@@ -50,4 +58,33 @@ public interface QbftBlockCreator {
+ public interface QbftBlockCreator {
+ 
+   /**
+    * Block creation result.
+    *
+    * @param block the block
+    * @param blockAccessList optional block access list
+    */
+   public record BlockCreationResult(QbftBlock block, Optional blockAccessList) {}
+ 
+   /**
+    * Create a block.
+    *
+    * @param headerTimeStampSeconds the header timestamp
+    * @param parentHeader the parent header
+    * @return the block
+    */
+   BlockCreationResult createBlock(long headerTimeStampSeconds, QbftBlockHeader parentHeader);
+ 
+   /**
+    * Create sealed block.
+    *
+    * @param block the block
+    * @param roundNumber the round number
+    * @param commitSeals the commit seals
+    * @return the block
     */
    QbftBlock createSealedBlock(
        final QbftBlock block, final int roundNumber, final Collection commitSeals);
@@ -22083,11 +32889,7064 @@ index afe4fb00e..c397cab98 100644
 +    return Collections.emptyList();
 +  }
  }
+diff --git a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/CommitValidator.java b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/CommitValidator.java
+index e211c6a8e..918607ad2 100644
+--- a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/CommitValidator.java
++++ b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/CommitValidator.java
+@@ -1,78 +1,184 @@
+ /*
+  * Copyright 2020 ConsenSys AG.
+  *
+  * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+  * the License. You may obtain a copy of the License at
+  *
+  * http://www.apache.org/licenses/LICENSE-2.0
+  *
+  * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+  * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+  * specific language governing permissions and limitations under the License.
+  *
+  * SPDX-License-Identifier: Apache-2.0
++ *
++ * Modifications Copyright contributors to the Aere Network.
++ *
++ * This file was modified by contributors to the Aere Network, as required by section 4(b) of the
++ * Apache License 2.0. The copyright header above is the upstream one and is left exactly as it was
++ * found, as section 4(c) requires. The change: an OPTIONAL, height-gated post-quantum enforcement
++ * hook (see PqCommitEnforcement). When no enforcement is supplied, behaviour is byte-for-byte the
++ * upstream behaviour; the existing constructor keeps that contract for every existing caller.
+  */
+ package org.hyperledger.besu.consensus.qbft.core.validation;
+ 
+ import org.hyperledger.besu.consensus.common.bft.ConsensusRoundIdentifier;
+ import org.hyperledger.besu.consensus.common.bft.payload.SignedData;
+ import org.hyperledger.besu.consensus.qbft.core.messagewrappers.Commit;
+ import org.hyperledger.besu.consensus.qbft.core.payload.CommitPayload;
+ import org.hyperledger.besu.datatypes.Address;
+ import org.hyperledger.besu.datatypes.Hash;
+ import org.hyperledger.besu.ethereum.core.Util;
+ 
+ import java.util.Collection;
++import java.util.Optional;
+ 
+ import org.slf4j.Logger;
+ import org.slf4j.LoggerFactory;
+ 
+ /** The Commit validator. */
+ public class CommitValidator {
+ 
+   private static final String ERROR_PREFIX = "Invalid Commit Message";
+ 
+   private static final Logger LOG = LoggerFactory.getLogger(CommitValidator.class);
+ 
+   private final Collection
         validators;
+   private final ConsensusRoundIdentifier targetRound;
+   private final Hash expectedDigest;
+   private final Hash expectedCommitDigest;
++  // AERE D-311 (2026-09-02): the message the post-quantum seal must have signed. It is NOT always
++  // the committed-seal digest: once the anchor is armed the emitter signs the anchor form (see
++  // PqAnchorProducer.commitSealMessage). The upstream-shaped constructors keep the digest, so no
++  // existing caller changes behaviour; the production path (MessageValidator) passes the real one.
++  private final Hash expectedPqSealMessage;
++  // AERE full-PQ: optional height-gated enforcement. Null means "upstream behaviour", which is
++  // exactly what the pre-existing constructor supplies, so nothing changes for existing callers.
++  private final PqCommitEnforcement pqEnforcement;
+ 
+   /**
+-   * Instantiates a new Commit validator.
++   * Instantiates a new Commit validator, self-wiring the AERE post-quantum enforcement from the
++   * system configuration.
++   *
++   * 
        With {@code aere.pq.commitPq.forkBlock} absent -- every fleet node today, and every test
++   * JVM -- this is byte-for-byte the upstream behaviour. With it set, commits at or above that
++   * height only count with a valid post-quantum seal of their own author. A present but broken
++   * value refuses loudly here rather than silently disarming.
+    *
+    * @param validators the validators
+    * @param targetRound the target round
+    * @param expectedDigest the expected digest
+    * @param expectedCommitDigest the expected commit digest
+    */
+   public CommitValidator(
+       final Collection
         validators,
+       final ConsensusRoundIdentifier targetRound,
+       final Hash expectedDigest,
+       final Hash expectedCommitDigest) {
++    this(
++        validators,
++        targetRound,
++        expectedDigest,
++        expectedCommitDigest,
++        expectedCommitDigest,
++        PqCommitEnforcement.fromSystemConfig());
++  }
++
++  /**
++   * AERE D-311: the production constructor. Self-wires enforcement from the system configuration
++   * and takes the exact message the PQ seal signs at this height, computed by the caller with
++   * {@code PqAnchorProducer.commitSealMessage}, the same helper the emitter uses.
++   *
++   * @param validators the validators
++   * @param targetRound the target round
++   * @param expectedDigest the expected digest
++   * @param expectedCommitDigest the expected commit digest (ECDSA committed seal)
++   * @param expectedPqSealMessage the message the post-quantum seal must have signed
++   */
++  public CommitValidator(
++      final Collection
         validators,
++      final ConsensusRoundIdentifier targetRound,
++      final Hash expectedDigest,
++      final Hash expectedCommitDigest,
++      final Hash expectedPqSealMessage) {
++    this(
++        validators,
++        targetRound,
++        expectedDigest,
++        expectedCommitDigest,
++        expectedPqSealMessage,
++        PqCommitEnforcement.fromSystemConfig());
++  }
++
++  /**
++   * Instantiates a new Commit validator with optional post-quantum enforcement.
++   *
++   * 
        AERE full-PQ: when {@code pqEnforcement} is non-null and armed at this round's height, a
++   * Commit only validates if it carries a post-quantum seal whose index is bound to the message
++   * author and whose signature verifies over the commit digest. A vote without valid PQ does not
++   * count toward quorum.
++   *
++   * @param validators the validators
++   * @param targetRound the target round
++   * @param expectedDigest the expected digest
++   * @param expectedCommitDigest the expected commit digest
++   * @param pqEnforcement the height-gated enforcement, or null for upstream behaviour
++   */
++  public CommitValidator(
++      final Collection
         validators,
++      final ConsensusRoundIdentifier targetRound,
++      final Hash expectedDigest,
++      final Hash expectedCommitDigest,
++      final PqCommitEnforcement pqEnforcement) {
++    this(validators, targetRound, expectedDigest, expectedCommitDigest, expectedCommitDigest, pqEnforcement);
++  }
++
++  /** AERE D-311: the message the post-quantum seal must have signed; for the plumbing proof only. */
++  @com.google.common.annotations.VisibleForTesting
++  Hash expectedPqSealMessageForTesting() {
++    return expectedPqSealMessage;
++  }
++
++  /**
++   * AERE D-311: the fully explicit constructor (tests and the production constructor above).
++   *
++   * @param validators the validators
++   * @param targetRound the target round
++   * @param expectedDigest the expected digest
++   * @param expectedCommitDigest the expected commit digest (ECDSA committed seal)
++   * @param expectedPqSealMessage the message the post-quantum seal must have signed
++   * @param pqEnforcement the enforcement, or null for upstream behaviour
++   */
++  public CommitValidator(
++      final Collection
         validators,
++      final ConsensusRoundIdentifier targetRound,
++      final Hash expectedDigest,
++      final Hash expectedCommitDigest,
++      final Hash expectedPqSealMessage,
++      final PqCommitEnforcement pqEnforcement) {
+     this.validators = validators;
+     this.targetRound = targetRound;
+     this.expectedDigest = expectedDigest;
+     this.expectedCommitDigest = expectedCommitDigest;
++    this.expectedPqSealMessage = expectedPqSealMessage;
++    this.pqEnforcement = pqEnforcement;
+   }
+ 
+   /**
+    * Validate.
+    *
+    * @param msg the msg
+    * @return the boolean
+    */
+   public boolean validate(final Commit msg) {
+     return validate(msg.getSignedPayload());
+   }
+ 
+   /**
+    * Validate.
+    *
+    * @param signedPayload the signed payload
+    * @return the boolean
+    */
+   public boolean validate(final SignedData signedPayload) {
+     if (!validators.contains(signedPayload.getAuthor())) {
+@@ -95,23 +201,39 @@ public class CommitValidator {
+       LOG.info(
+           "{}: did not contain expected digest {} was {}",
+           ERROR_PREFIX,
+           expectedDigest,
+           payload.getDigest());
+       return false;
+     }
+ 
+     final Address commitSealCreator =
+         Util.signatureToAddress(payload.getCommitSeal(), expectedCommitDigest);
+ 
+     if (!commitSealCreator.equals(signedPayload.getAuthor())) {
+       LOG.info(
+           "{}: Seal was not created by the message transmitter {} was {}",
+           ERROR_PREFIX,
+           commitSealCreator,
+           signedPayload.getAuthor());
+       return false;
+     }
+ 
++    // AERE full-PQ: above the arming height a commit vote only counts with a valid post-quantum
++    // seal bound to this very author. Below it (or with no enforcement supplied) nothing changes.
++    if (pqEnforcement != null) {
++      final Optional refusal =
++          pqEnforcement.refusal(
++              targetRound.getSequenceNumber(),
++              signedPayload.getAuthor(),
++              expectedPqSealMessage,
++              payload.getFalconSeal(),
++              payload.getExtraSeals());
++      if (refusal.isPresent()) {
++        LOG.info("{}: {}", ERROR_PREFIX, refusal.get());
++        return false;
++      }
++    }
++
+     return true;
+   }
+ }
+diff --git a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/MessageValidator.java b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/MessageValidator.java
+index d15d19e91..7623e630e 100644
+--- a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/MessageValidator.java
++++ b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/MessageValidator.java
+@@ -1,98 +1,120 @@
+ /*
+  * Copyright ConsenSys AG.
+  *
+  * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+  * the License. You may obtain a copy of the License at
+  *
+  * http://www.apache.org/licenses/LICENSE-2.0
+  *
+  * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+  * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+  * specific language governing permissions and limitations under the License.
+  *
+  * SPDX-License-Identifier: Apache-2.0
+  */
+ package org.hyperledger.besu.consensus.qbft.core.validation;
+ 
+ import org.hyperledger.besu.consensus.common.bft.ConsensusRoundIdentifier;
++import org.hyperledger.besu.consensus.common.bft.blockcreation.PqAnchorProducer;
+ import org.hyperledger.besu.consensus.qbft.core.messagewrappers.Commit;
+ import org.hyperledger.besu.consensus.qbft.core.messagewrappers.Prepare;
+ import org.hyperledger.besu.consensus.qbft.core.messagewrappers.Proposal;
+ import org.hyperledger.besu.consensus.qbft.core.types.QbftBlock;
+ import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockInterface;
+ import org.hyperledger.besu.datatypes.Address;
++import org.hyperledger.besu.datatypes.Hash;
+ 
+ import java.util.Collection;
+ import java.util.Optional;
+ 
+ import org.slf4j.Logger;
+ import org.slf4j.LoggerFactory;
+ 
+ /** The Message validator. */
+ public class MessageValidator {
+ 
+   private static final Logger LOG = LoggerFactory.getLogger(MessageValidator.class);
+ 
+   /** The Subsequent message validator. */
+   public static class SubsequentMessageValidator {
+ 
+     private final PrepareValidator prepareValidator;
+     private final CommitValidator commitValidator;
+ 
+     /**
+      * Instantiates a new Subsequent message validator.
+      *
+      * @param validators the validators
+      * @param targetRound the target round
+      * @param proposalBlock the proposal block
+      * @param blockInterface the block interface
+      */
+     public SubsequentMessageValidator(
+         final Collection
         validators,
+         final ConsensusRoundIdentifier targetRound,
+         final QbftBlock proposalBlock,
+         final QbftBlockInterface blockInterface) {
+       final QbftBlock commitBlock =
+           blockInterface.replaceRoundForCommitBlock(proposalBlock, targetRound.getRoundNumber());
+       prepareValidator = new PrepareValidator(validators, targetRound, proposalBlock.getHash());
++      // AERE D-311 (2026-09-02): the post-quantum seal on a commit signs the message that
++      // PqAnchorProducer.commitSealMessage names (the anchor form once the anchor is armed, the
++      // ECDSA committed-seal hash before), computed here exactly as the emitter computes it in
++      // QbftRound.pqSealMessageFor: same helper, same round-independent on-chain hash.
++      final Hash expectedPqSealMessage =
++          Hash.wrap(
++              PqAnchorProducer.commitSealMessage(
++                  targetRound.getSequenceNumber(),
++                  () -> blockInterface.replaceRoundForCommitBlock(proposalBlock, 0).getHash().getBytes(),
++                  commitBlock.getHash()));
+       commitValidator =
+           new CommitValidator(
+-              validators, targetRound, proposalBlock.getHash(), commitBlock.getHash());
++              validators,
++              targetRound,
++              proposalBlock.getHash(),
++              commitBlock.getHash(),
++              expectedPqSealMessage);
+     }
+ 
+     /**
+      * Validate.
+      *
+      * @param msg the Prepare payload msg
+      * @return the boolean
+      */
+     public boolean validate(final Prepare msg) {
+       return prepareValidator.validate(msg);
+     }
+ 
+     /**
+      * Validate.
+      *
+      * @param msg the Commit payload msg
+      * @return the boolean
+      */
++    /** AERE D-311: the commit validator this wiring built; for the plumbing proof only. */
++    @com.google.common.annotations.VisibleForTesting
++    CommitValidator commitValidatorForTesting() {
++      return commitValidator;
++    }
++
+     public boolean validate(final Commit msg) {
+       return commitValidator.validate(msg);
+     }
+   }
+ 
+   /** The interface Subsequent message validator factory. */
+   @FunctionalInterface
+   public interface SubsequentMessageValidatorFactory {
+     /**
+      * Create subsequent message validator.
+      *
+      * @param proposalBlock the proposal block
+      * @return the subsequent message validator
+      */
+     SubsequentMessageValidator create(QbftBlock proposalBlock);
+   }
+ 
+   private final SubsequentMessageValidatorFactory subsequentMessageValidatorFactory;
+   private final ProposalValidator proposalValidator;
+ 
+diff --git a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/PqCommitEnforcement.java b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/PqCommitEnforcement.java
+new file mode 100755
+index 000000000..d1aa1be8e
+--- /dev/null
++++ b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/PqCommitEnforcement.java
+@@ -0,0 +1,369 @@
++/*
++ * AERE full-PQ consensus (TOP 3 list, item 1), step 1: the enforcement core.
++ *
++ * WHAT IT DECIDES. From the arming height upward, a Commit message counts toward the 2f+1
++ * quorum ONLY if it carries the PQ seal (already transported in CommitPayload, live on the
++ * fleet) and the seal (a) exists, (b) has its index bound to the VERY author of the message
++ * through the height-indexed registry, (c) verifies over the commit digest. Without a valid
++ * PQ seal the vote does not count -- this puts post-quantum into the agreement itself, at the
++ * layer where the D-235 header rule could not live (headers between anchors carry no seals;
++ * the commit message can carry them all).
++ *
++ * HOW IT IS WIRED (updated the same night). CommitValidator calls it through the production
++ * constructor, which self-installs from fromSystemConfig(): absent property = null =
++ * upstream behaviour, DISARMED by default; a broken value = loud refusal, never a silent
++ * disarm. The core stays purely testable: the registry is injected (the PqSignerRegistry
++ * interface, which refuses by construction to answer without a height -- the D2 inheritance);
++ * the singleton enters only through the production factory, exactly like PqAnchorSealsRule.
++ */
++package org.hyperledger.besu.consensus.qbft.core.validation;
++
++import org.hyperledger.besu.consensus.common.bft.FalconSeal;
++import org.hyperledger.besu.consensus.common.bft.HybridSealSupport;
++import org.hyperledger.besu.consensus.common.bft.HybridSignerRegistry;
++import org.hyperledger.besu.consensus.common.bft.PqSchemeSchedule;
++import org.hyperledger.besu.consensus.common.bft.PqSignerRegistry;
++import org.hyperledger.besu.consensus.common.bft.SchemeSeal;
++import org.hyperledger.besu.consensus.common.bft.SealScheme;
++import org.hyperledger.besu.consensus.common.bft.SealSchemes;
++import org.hyperledger.besu.consensus.common.bft.blockcreation.PqAnchorProducer;
++import org.hyperledger.besu.datatypes.Address;
++import org.hyperledger.besu.datatypes.Hash;
++
++import java.util.List;
++import java.util.Optional;
++import java.util.Set;
++import java.util.function.LongPredicate;
++
++import org.apache.tuweni.bytes.Bytes;
++
++/** Height-gated decision: does this Commit's PQ seal let it count toward quorum? */
++public final class PqCommitEnforcement {
++
++  /** The disarmed height: no block ever reaches it, so nothing is enforced. */
++  public static final long DISARMED = Long.MAX_VALUE;
++
++  /**
++   * System property naming the first block height at which a Commit vote no longer counts without
++   * a valid post-quantum seal of its own author. Absent = disarmed, today's behaviour. Delivered
++   * per node through {@code BESU_OPTS}, like every other AERE consensus switch; there is NO
++   * consensus binding on the value, so the fleet must coordinate on it exactly as it does on the
++   * anchor heights. Env: {@code AERE_PQ_COMMITPQ_FORKBLOCK}.
++   */
++  public static final String PROPERTY_FORK_BLOCK = "aere.pq.commitPq.forkBlock";
++
++  /** Environment fallback for {@link #PROPERTY_FORK_BLOCK}. */
++  public static final String ENV_FORK_BLOCK = "AERE_PQ_COMMITPQ_FORKBLOCK";
++
++  /**
++   * The enforcement the production (4-arg) CommitValidator constructor wires in, read fresh from
++   * the system configuration on every call.
++   *
++   * 
        Absent configuration returns null, which CommitValidator treats as upstream behaviour --
++   * the honest default. A PRESENT but unparseable value REFUSES loudly instead of disarming:
++   * the paid-for lesson of the anchor loader is that a mistyped value must never start a node
++   * silently disarmed ("a mistyped comma boots the node DISARMED"). The throw happens at
++   * validator construction, i.e. at the first round the node processes, which is as close to
++   * startup as this layer can get.
++   *
++   * @return the armed enforcement, or null when the property is not set anywhere
++   * @throws IllegalStateException AERE-PQC-COMMIT-CONF-01 when the value is present but not a
++   *     non-negative decimal block height
++   */
++  public static PqCommitEnforcement fromSystemConfig() {
++    String raw = System.getProperty(PROPERTY_FORK_BLOCK);
++    if (raw == null) {
++      raw = System.getenv(ENV_FORK_BLOCK);
++    }
++    if (raw == null) {
++      return null;
++    }
++    final long armedFrom;
++    try {
++      armedFrom = Long.parseLong(raw.trim());
++      if (armedFrom < 0) {
++        throw new NumberFormatException("negative");
++      }
++    } catch (final NumberFormatException e) {
++      throw new IllegalStateException(
++          "AERE-PQC-COMMIT-CONF-01: "
++              + PROPERTY_FORK_BLOCK
++              + " is set but not a non-negative block height: '"
++              + raw
++              + "'. A mistyped value must refuse, never silently disarm.");
++    }
++    // AERE HYBRID: when the node has the schedule+registry pair configured, enforcement
++    // receives it too, so from the hybrid step of the schedule onward a vote without ALL the
++    // required schemes does not count. Without the pair, this stays exactly the Falcon
++    // enforcement we had until now.
++    final HybridSealSupport hybrid = HybridSealSupport.instance();
++    if (hybrid.schedule().isPresent()) {
++      return new PqCommitEnforcement(
++          armedFrom,
++          PqSignerRegistry.falconSealSupport(),
++          hybrid.schedule().get(),
++          hybrid.registry().orElseThrow());
++    }
++    return new PqCommitEnforcement(armedFrom, PqSignerRegistry.falconSealSupport());
++  }
++
++  private final long armedFromBlock;
++  private final PqSignerRegistry registry;
++  // AERE HIBRID: null in Falcon-only mode, which is every node today.
++  private final PqSchemeSchedule schemeSchedule;
++  private final HybridSignerRegistry hybridRegistry;
++  private final LongPredicate extrasRequiredAt;
++
++  /**
++   * @param armedFromBlock first block height (inclusive) at which enforcement applies; use
++   *     {@link #DISARMED} for the today-behaviour
++   * @param registry the height-aware signer registry (injected, never a singleton)
++   */
++  public PqCommitEnforcement(final long armedFromBlock, final PqSignerRegistry registry) {
++    this(armedFromBlock, registry, null, null);
++  }
++
++  /**
++   * Enforcement that also demands the HYBRID schemes a schedule requires at each height.
++   *
++   * 
        AERE HIBRID (2026-08-25). Above the arming height a vote must carry, besides the Falcon
++   * seal checked by the Falcon-only path, a valid seal for EVERY other scheme the schedule names
++   * at that height. The point of a hybrid is that the two families fail independently, so a
++   * partially satisfied certificate is worth exactly as much as the weakest family present, which
++   * is why a missing scheme refuses rather than degrades.
++   *
++   * 
        NO REGISTRY-ALIGNMENT ASSUMPTION. The hybrid registry and the legacy Falcon registry are
++   * two files, and the paid-for lesson of D-191 is that a pair of files that must agree will one
++   * day not agree. So this code never assumes their index spaces line up: an extra seal must
++   * carry the SAME validator index as the Falcon seal on the same message, and that index must
++   * resolve, IN THE HYBRID REGISTRY, to the very author of the message. Both facts are checked,
++   * neither is assumed.
++   *
++   * @param armedFromBlock first block height (inclusive) at which enforcement applies
++   * @param registry the height-aware Falcon signer registry
++   * @param schemeSchedule which schemes are required at which height; null for Falcon-only
++   * @param hybridRegistry per-validator public keys per scheme; null for Falcon-only
++   */
++  public PqCommitEnforcement(
++      final long armedFromBlock,
++      final PqSignerRegistry registry,
++      final PqSchemeSchedule schemeSchedule,
++      final HybridSignerRegistry hybridRegistry) {
++    this(armedFromBlock, registry, schemeSchedule, hybridRegistry, anchorParentByConfig());
++  }
++
++  /**
++   * ANCHOR PARENTS ONLY (2026-09-03, D-329). An SLH-DSA-SHA2-128s signature costs seconds in this
++   * runtime; demanded on EVERY commit it stretched the testnet from 0.5 s to 4 s per block. The
++   * extra seal is only ever USED in the certificate of the next anchor, which is built from the
++   * seals heard over the anchor's PARENT. So the extra scheme seals are required (and emitted, see
++   * QbftRound) only on commits over a block whose successor is an anchor height. Falcon stays on
++   * every commit, exactly as before.
++   *
++   * @return the predicate "the block at this height is the parent of an anchor", from the live
++   *     anchor configuration
++   */
++  public static LongPredicate anchorParentByConfig() {
++    return h -> PqAnchorProducer.config().anchorAppliesAt(h + 1L);
++  }
++
++  /**
++   * Full constructor.
++   *
++   * @param extrasRequiredAt at which heights the extra (non-Falcon) scheme seals are demanded on a
++   *     commit; production passes {@link #anchorParentByConfig()}
++   */
++  public PqCommitEnforcement(
++      final long armedFromBlock,
++      final PqSignerRegistry registry,
++      final PqSchemeSchedule schemeSchedule,
++      final HybridSignerRegistry hybridRegistry,
++      final LongPredicate extrasRequiredAt) {
++    this.armedFromBlock = armedFromBlock;
++    this.registry = registry;
++    this.schemeSchedule = schemeSchedule;
++    this.hybridRegistry = hybridRegistry;
++    this.extrasRequiredAt = extrasRequiredAt;
++    if ((schemeSchedule == null) != (hybridRegistry == null)) {
++      // Half a hybrid configuration is the shape that starts a node believing it enforces
++      // something it does not. Refuse at construction, the same stance as every other AERE gate.
++      throw new IllegalStateException(
++          "AERE-PQC-COMMIT-CONF-03: the scheme schedule and the hybrid registry are a PAIR;"
++              + " configure both or neither.");
++    }
++  }
++
++  /** Whether enforcement is active at {@code height}. */
++  public boolean armedAt(final long height) {
++    return height >= armedFromBlock;
++  }
++
++  /**
++   * Decide whether a Commit may count toward quorum.
++   *
++   * @param height the block height the commit targets (the round's sequence number)
++   * @param author the RECOVERED author of the signed Commit message (from its ECDSA signature)
++   * @param commitDigest the commit digest the PQ seal must have signed
++   * @param seal the optional PQ seal carried inside the payload
++   * @return empty when the commit counts; otherwise the refusal, with names and numbers
++   */
++  public Optional refusal(
++      final long height,
++      final Address author,
++      final Hash commitDigest,
++      final Optional seal) {
++    return refusal(height, author, commitDigest, seal, List.of());
++  }
++
++  /**
++   * Decide whether a Commit may count toward quorum, hybrid certificate included.
++   *
++   * @param height the block height the commit targets
++   * @param author the RECOVERED author of the signed Commit message
++   * @param commitDigest the commit digest every seal must have signed
++   * @param seal the Falcon seal carried in its own slot
++   * @param extraSeals the non-Falcon scheme seals carried alongside it
++   * @return empty when the commit counts; otherwise the refusal, with names and numbers
++   */
++  public Optional refusal(
++      final long height,
++      final Address author,
++      final Hash commitDigest,
++      final Optional seal,
++      final List extraSeals) {
++    final Optional falconVerdict = falconRefusal(height, author, commitDigest, seal);
++    if (falconVerdict.isPresent()
++        || !armedAt(height)
++        || schemeSchedule == null
++        || !extrasRequiredAt.test(height)) {
++      return falconVerdict;
++    }
++    return hybridRefusal(height, author, commitDigest, seal.orElseThrow(), extraSeals);
++  }
++
++  /**
++   * Every scheme the schedule names at this height, other than Falcon, must be present and valid.
++   */
++  private Optional hybridRefusal(
++      final long height,
++      final Address author,
++      final Hash commitDigest,
++      final FalconSeal falconSeal,
++      final List extraSeals) {
++    final Set required = schemeSchedule.schemesAt(height);
++    for (final String schemeId : required) {
++      if (SealSchemes.FALCON_512.id().equals(schemeId)) {
++        continue; // already decided by the Falcon path above
++      }
++      final Optional scheme = SealSchemes.byId(schemeId);
++      if (scheme.isEmpty()) {
++        return Optional.of(
++            "AERE HIBRID: the schedule requires scheme '" + schemeId + "' at height " + height
++                + " and this binary does not implement it - refusing rather than ignoring it");
++      }
++      final byte wire = scheme.get().wireId();
++      SchemeSeal found = null;
++      for (final SchemeSeal candidate : extraSeals) {
++        if (candidate.getSchemeWireId() == wire) {
++          found = candidate;
++          break;
++        }
++      }
++      if (found == null) {
++        return Optional.of(
++            "AERE HIBRID: commit at height " + height + " carries no " + schemeId
++                + " seal, which the schedule requires - the vote does not count");
++      }
++      // One identity per message: the hybrid seal must speak for the same validator as the Falcon
++      // seal, and that index must be THIS author in the hybrid registry. Neither is assumed.
++      if (found.getValidatorIndex() != falconSeal.getValidatorIndex()) {
++        return Optional.of(
++            "AERE HIBRID: " + schemeId + " seal is index " + found.getValidatorIndex()
++                + " but the Falcon seal on the same commit is index "
++                + falconSeal.getValidatorIndex() + " - one commit, one signer");
++      }
++      final Optional bound = hybridRegistry.address(found.getValidatorIndex());
++      if (bound.isEmpty()
++          || !Address.wrap(Bytes.wrap(bound.get())).equals(author)) {
++        return Optional.of(
++            "AERE HIBRID: index " + found.getValidatorIndex()
++                + " is not bound to the commit author " + author + " in the hybrid registry");
++      }
++      final Optional publicKey =
++          hybridRegistry.publicKey(found.getValidatorIndex(), schemeId);
++      if (publicKey.isEmpty()) {
++        return Optional.of(
++            "AERE HIBRID: the hybrid registry holds no " + schemeId + " key for index "
++                + found.getValidatorIndex());
++      }
++      final boolean valid;
++      try {
++        valid =
++            scheme
++                .get()
++                .verifyRaw(
++                    publicKey.get(),
++                    commitDigest.getBytes().toArray(),
++                    found.getSignature().toArray());
++      } catch (final RuntimeException e) {
++        return Optional.of(
++            "AERE HIBRID: " + schemeId + " verification threw at height " + height + ": "
++                + e.getMessage());
++      }
++      if (!valid) {
++        return Optional.of(
++            "AERE HIBRID: the " + schemeId + " seal of index " + found.getValidatorIndex()
++                + " does NOT verify over the commit digest at height " + height
++                + " - the vote does not count");
++      }
++    }
++    return Optional.empty();
++  }
++
++  private Optional falconRefusal(
++      final long height,
++      final Address author,
++      final Hash commitDigest,
++      final Optional seal) {
++    if (!armedAt(height)) {
++      return Optional.empty();
++    }
++    if (seal == null || seal.isEmpty()) {
++      return Optional.of(
++          "AERE FULL-PQ: commit at height " + height + " carries NO post-quantum seal and "
++              + "enforcement is armed from " + armedFromBlock + " - the vote does not count");
++    }
++    final FalconSeal fs = seal.get();
++    final Address bound;
++    try {
++      bound = registry.addressForIndexAtOwnHead(height, fs.getValidatorIndex());
++    } catch (final RuntimeException e) {
++      return Optional.of(
++          "AERE FULL-PQ: registry refused index " + fs.getValidatorIndex() + " at height "
++              + height + ": " + e.getMessage());
++    }
++    if (bound == null || !bound.equals(author)) {
++      return Optional.of(
++          "AERE FULL-PQ: seal index " + fs.getValidatorIndex() + " is bound to "
++              + bound + " but the commit was authored by " + author
++              + " - a seal cannot vouch for someone else's vote");
++    }
++    final boolean valid;
++    try {
++      valid =
++          registry.verifyAtOwnHead(
++              height, fs.getValidatorIndex(), commitDigest.getBytes(), fs.getSignature());
++    } catch (final RuntimeException e) {
++      return Optional.of(
++          "AERE FULL-PQ: verification threw for index " + fs.getValidatorIndex() + " at height "
++              + height + ": " + e.getMessage());
++    }
++    if (!valid) {
++      return Optional.of(
++          "AERE FULL-PQ: post-quantum seal of index " + fs.getValidatorIndex()
++              + " does NOT verify over the commit digest at height " + height
++              + " - the vote does not count");
++    }
++    return Optional.empty();
++  }
++}
+diff --git a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/PqPrepareEnforcement.java b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/PqPrepareEnforcement.java
+new file mode 100755
+index 000000000..c95fdf691
+--- /dev/null
++++ b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/PqPrepareEnforcement.java
+@@ -0,0 +1,206 @@
++/*
++ * Copyright contributors to Besu.
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
++ * the License. You may obtain a copy of the License at
++ *
++ * http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
++ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
++ * specific language governing permissions and limitations under the License.
++ *
++ * SPDX-License-Identifier: Apache-2.0
++ */
++package org.hyperledger.besu.consensus.qbft.core.validation;
++
++import org.hyperledger.besu.consensus.common.bft.FalconSeal;
++import org.hyperledger.besu.consensus.common.bft.PqAnchor;
++import org.hyperledger.besu.consensus.common.bft.blockcreation.PqAnchorProducer;
++import org.hyperledger.besu.consensus.common.bft.PqSignerRegistry;
++import org.hyperledger.besu.datatypes.Address;
++import org.hyperledger.besu.datatypes.Hash;
++
++import java.util.Optional;
++
++import org.apache.tuweni.bytes.Bytes32;
++
++/**
++ * POST-QUANTUM ENFORCEMENT ON PREPARE. Step 4 of the design note
++ * PREPARE-SI-ROUNDCHANGE-SUB-PQ-PROIECTARE-2026-08-28.
++ *
++ * 
        From the armed height onwards, a PREPARE does not count without a valid post-quantum seal from
++ * its OWN author. The structure copies {@link PqCommitEnforcement} line for line on purpose: a
++ * second rendering of the same idea, written differently, diverges from the first one eventually.
++ *
++ * 
        WHY THIS IS A DIFFERENT LAYER FROM COMMIT, AND MORE DANGEROUS. Measured 2026-08-28
++ * (finding D-277): commit enforcement can be bypassed by a single unarmed proposer. It gathers the
++ * commits, forms the block, and the others import it, because block import validates the HEADER,
++ * not the votes. PREPARE does not work that way: an armed node that refuses unsealed PREPAREs never
++ * reaches the "prepared" state, so it never sends COMMIT at all, and the unarmed node alone is not
++ * a quorum. So PREPARE enforcement is STRICTLY STRONGER - and that is exactly why it no longer has
++ * the safety net commit had during an activation. Arm it only after coverage has been measured.
++ *
++ * 
        WHAT THE SEAL SIGNS, AND WHY NOT THE SAME THING AS COMMIT. Its own domain,
++ * {@code AERE-PQ-PREPARE-1}, over (chainId, height, ROUND, digest). Under the commit domain, a
++ * PREPARE seal produced HONESTLY could be pasted onto a forged COMMIT and the enforcement there
++ * would accept it. The round is part of the message too: two PREPAREs for the same block in
++ * different rounds are two different assertions, and a seal from a failed round must not justify
++ * another one.
++ *
++ * 
        DISARMED BY DEFAULT. Without the property, {@link #fromSystemConfig()} returns null and
++ * the validator behaves exactly as upstream. A value that is PRESENT but unreadable REFUSES loudly:
++ * a node that boots disarmed because of a mistyped character looks exactly like a correctly
++ * configured one, right up to the day it matters.
++ */
++public final class PqPrepareEnforcement {
++
++  /** The height nothing ever reaches: disarmed. */
++  public static final long DISARMED = Long.MAX_VALUE;
++
++  /** The property that arms PREPARE enforcement. */
++  public static final String PROPERTY_FORK_BLOCK = "aere.pq.preparePq.forkBlock";
++
++  /** The equivalent environment variable. */
++  public static final String ENV_FORK_BLOCK = "AERE_PQ_PREPAREPQ_FORKBLOCK";
++
++  private final long armedFromBlock;
++  private final PqSignerRegistry registry;
++  private final long chainId;
++
++  /**
++   * @param armedFromBlock first height (inclusive) at which enforcement applies; {@link #DISARMED}
++   *     for today's behaviour
++   * @param registry the signer registry, injected, never a singleton
++   * @param chainId the chain that goes into the signed message
++   */
++  public PqPrepareEnforcement(
++      final long armedFromBlock, final PqSignerRegistry registry, final long chainId) {
++    this.armedFromBlock = armedFromBlock;
++    this.registry = registry;
++    this.chainId = chainId;
++  }
++
++  /**
++   * The same enforcement, with the chain id taken from the anchor configuration.
++   *
++   * 
        THE CHAIN ID IS AN ARGUMENT, NOT A GLOBAL, and its own test caught that: the first version
++   * read it from {@code PqAnchorProducer.config()} in the middle of a consensus decision, so the
++   * test signed over 2800 while the enforcement verified over whatever the process configuration
++   * happened to be. A consensus decision that depends on global state cannot be tested honestly,
++   * and cannot be read either. The factories below fetch the value once, at construction, where it
++   * is visible.
++   *
++   * @param armedFromBlock first height at which enforcement applies
++   * @param registry the signer registry
++   */
++  public PqPrepareEnforcement(final long armedFromBlock, final PqSignerRegistry registry) {
++    this(armedFromBlock, registry, PqAnchorProducer.config().chainId());
++  }
++
++  /**
++   * The configured enforcement, read FRESH on every call.
++   *
++   * @return the armed enforcement, or null when the property is set nowhere
++   * @throws IllegalStateException AERE-PQC-PREPARE-ENF-01 when the value is present but is not a
++   *     non-negative decimal height
++   */
++  public static PqPrepareEnforcement fromSystemConfig() {
++    String raw = System.getProperty(PROPERTY_FORK_BLOCK);
++    if (raw == null) {
++      raw = System.getenv(ENV_FORK_BLOCK);
++    }
++    if (raw == null || raw.isBlank()) {
++      return null;
++    }
++    final long armedFrom;
++    try {
++      armedFrom = Long.parseLong(raw.trim());
++      if (armedFrom < 0) {
++        throw new NumberFormatException("negative");
++      }
++    } catch (final NumberFormatException e) {
++      throw new IllegalStateException(
++          "AERE-PQC-PREPARE-ENF-01: "
++              + PROPERTY_FORK_BLOCK
++              + " is set but not a non-negative block height: '"
++              + raw
++              + "'. A mistyped value must refuse, never silently disarm.");
++    }
++    return new PqPrepareEnforcement(armedFrom, PqSignerRegistry.falconSealSupport());
++  }
++
++  /** Whether enforcement is active at this height. */
++  public boolean armedAt(final long height) {
++    return height >= armedFromBlock;
++  }
++
++  /**
++   * Decides whether a PREPARE may count.
++   *
++   * @param height the height the PREPARE targets (the round's sequence number)
++   * @param round the PREPARE's round; it is part of the signed message
++   * @param author the RECOVERED author of the signed message (from its ECDSA signature)
++   * @param digest the digest of the block the PREPARE speaks about
++   * @param seal the post-quantum seal carried by the payload, if any
++   * @return empty when the PREPARE counts; otherwise the refusal, with names and numbers
++   */
++  public Optional refusal(
++      final long height,
++      final int round,
++      final Address author,
++      final Hash digest,
++      final Optional seal) {
++    if (!armedAt(height)) {
++      return Optional.empty();
++    }
++    if (seal == null || seal.isEmpty()) {
++      return Optional.of(
++          "AERE FULL-PQ: prepare at height " + height + " round " + round
++              + " carries NO post-quantum seal and enforcement is armed from " + armedFromBlock
++              + " - the vote does not count");
++    }
++    final FalconSeal fs = seal.get();
++    final Address bound;
++    try {
++      bound = registry.addressForIndexAtOwnHead(height, fs.getValidatorIndex());
++    } catch (final RuntimeException e) {
++      return Optional.of(
++          "AERE FULL-PQ: registry refused index " + fs.getValidatorIndex() + " at height "
++              + height + ": " + e.getMessage());
++    }
++    if (bound == null || !bound.equals(author)) {
++      return Optional.of(
++          "AERE FULL-PQ: prepare seal index " + fs.getValidatorIndex() + " is bound to " + bound
++              + " but the prepare was authored by " + author
++              + " - a seal cannot vouch for someone else's vote");
++    }
++
++    final Bytes32 message;
++    try {
++      message = PqAnchor.prepareMessage(chainId, height, round, digest.getBytes());
++    } catch (final RuntimeException e) {
++      // A message we cannot build means we cannot judge, and "cannot judge" must never be a pass:
++      // that would be exactly the silent disarming this file exists to refuse.
++      return Optional.of(
++          "AERE FULL-PQ: could not build the prepare message at height " + height + " round "
++              + round + ": " + e.getMessage());
++    }
++
++    final boolean valid;
++    try {
++      valid = registry.verifyAtOwnHead(height, fs.getValidatorIndex(), message, fs.getSignature());
++    } catch (final RuntimeException e) {
++      return Optional.of(
++          "AERE FULL-PQ: verification threw for index " + fs.getValidatorIndex() + " at height "
++              + height + ": " + e.getMessage());
++    }
++    if (!valid) {
++      return Optional.of(
++          "AERE FULL-PQ: post-quantum seal of index " + fs.getValidatorIndex()
++              + " does NOT verify over the prepare message at height " + height + " round " + round
++              + " - the vote does not count");
++    }
++    return Optional.empty();
++  }
++}
+diff --git a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/PqProposalEnforcement.java b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/PqProposalEnforcement.java
+new file mode 100755
+index 000000000..ea8817cd6
+--- /dev/null
++++ b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/PqProposalEnforcement.java
+@@ -0,0 +1,202 @@
++/*
++ * Copyright contributors to Besu.
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
++ * the License. You may obtain a copy of the License at
++ *
++ * http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
++ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
++ * specific language governing permissions and limitations under the License.
++ *
++ * SPDX-License-Identifier: Apache-2.0
++ */
++package org.hyperledger.besu.consensus.qbft.core.validation;
++
++import org.hyperledger.besu.consensus.common.bft.FalconSeal;
++import org.hyperledger.besu.consensus.common.bft.PqAnchor;
++import org.hyperledger.besu.consensus.common.bft.blockcreation.PqAnchorProducer;
++import org.hyperledger.besu.consensus.common.bft.PqSignerRegistry;
++import org.hyperledger.besu.datatypes.Address;
++import org.hyperledger.besu.datatypes.Hash;
++
++import java.util.Optional;
++
++import org.apache.tuweni.bytes.Bytes32;
++
++/**
++ * POST-QUANTUM ENFORCEMENT ON THE PROPOSAL. The hot-path step after PREPARE (AERE PQ, 2026-08-30).
++ *
++ * 
        From the armed height onwards, a PROPOSAL is not accepted without a valid post-quantum seal
++ * from its OWN proposer. The structure copies {@link PqProposalEnforcement} line for line on
++ * purpose: a second rendering of the same idea, written differently, diverges eventually.
++ *
++ * 
        WHAT THIS LAYER BUYS, said precisely. A proposal is an OFFER, not a vote: the design
++ * note of 2026-08-28 measures that "prepared" needs a full quorum of PREPAREs, proposer included,
++ * so an adversary who breaks ECDSA and forges proposals still cannot finalize anything while the
++ * PREPARE layer is armed. What forged proposals CAN do is start rounds and waste them - steering
++ * which honest proposals get considered and degrading liveness. This layer closes that: a proposal
++ * whose proposer cannot produce a Falcon seal does not even open a round on an armed node.
++ *
++ * 
        WHAT THE SEAL SIGNS. Its own domain, {@code AERE-PQ-PROPOSAL-1}, over (chainId,
++ * height, ROUND, digest). Under the PREPARE or commit domain, a proposal seal given honestly could
++ * be pasted onto a forged vote and counted; one changed string in the preimage makes the
++ * signatures non-transferable in both directions.
++ *
++ * 
        DISARMED BY DEFAULT. Without the property, {@link #fromSystemConfig()} returns null and
++ * the validator behaves exactly as upstream. A value that is PRESENT but unreadable REFUSES loudly:
++ * a node that boots disarmed because of a mistyped character looks exactly like a correctly
++ * configured one, right up to the day it matters.
++ */
++public final class PqProposalEnforcement {
++
++  /** The height nothing ever reaches: disarmed. */
++  public static final long DISARMED = Long.MAX_VALUE;
++
++  /** The property that arms PROPOSAL enforcement. */
++  public static final String PROPERTY_FORK_BLOCK = "aere.pq.proposalPq.forkBlock";
++
++  /** The equivalent environment variable. */
++  public static final String ENV_FORK_BLOCK = "AERE_PQ_PROPOSALPQ_FORKBLOCK";
++
++  private final long armedFromBlock;
++  private final PqSignerRegistry registry;
++  private final long chainId;
++
++  /**
++   * @param armedFromBlock first height (inclusive) at which enforcement applies; {@link #DISARMED}
++   *     for today's behaviour
++   * @param registry the signer registry, injected, never a singleton
++   * @param chainId the chain that goes into the signed message
++   */
++  public PqProposalEnforcement(
++      final long armedFromBlock, final PqSignerRegistry registry, final long chainId) {
++    this.armedFromBlock = armedFromBlock;
++    this.registry = registry;
++    this.chainId = chainId;
++  }
++
++  /**
++   * The same enforcement, with the chain id taken from the anchor configuration.
++   *
++   * 
        THE CHAIN ID IS AN ARGUMENT, NOT A GLOBAL, and its own test caught that: the first version
++   * read it from {@code PqAnchorProducer.config()} in the middle of a consensus decision, so the
++   * test signed over 2800 while the enforcement verified over whatever the process configuration
++   * happened to be. A consensus decision that depends on global state cannot be tested honestly,
++   * and cannot be read either. The factories below fetch the value once, at construction, where it
++   * is visible.
++   *
++   * @param armedFromBlock first height at which enforcement applies
++   * @param registry the signer registry
++   */
++  public PqProposalEnforcement(final long armedFromBlock, final PqSignerRegistry registry) {
++    this(armedFromBlock, registry, PqAnchorProducer.config().chainId());
++  }
++
++  /**
++   * The configured enforcement, read FRESH on every call.
++   *
++   * @return the armed enforcement, or null when the property is set nowhere
++   * @throws IllegalStateException AERE-PQC-PROPOSAL-ENF-01 when the value is present but is not a
++   *     non-negative decimal height
++   */
++  public static PqProposalEnforcement fromSystemConfig() {
++    String raw = System.getProperty(PROPERTY_FORK_BLOCK);
++    if (raw == null) {
++      raw = System.getenv(ENV_FORK_BLOCK);
++    }
++    if (raw == null || raw.isBlank()) {
++      return null;
++    }
++    final long armedFrom;
++    try {
++      armedFrom = Long.parseLong(raw.trim());
++      if (armedFrom < 0) {
++        throw new NumberFormatException("negative");
++      }
++    } catch (final NumberFormatException e) {
++      throw new IllegalStateException(
++          "AERE-PQC-PROPOSAL-ENF-01: "
++              + PROPERTY_FORK_BLOCK
++              + " is set but not a non-negative block height: '"
++              + raw
++              + "'. A mistyped value must refuse, never silently disarm.");
++    }
++    return new PqProposalEnforcement(armedFrom, PqSignerRegistry.falconSealSupport());
++  }
++
++  /** Whether enforcement is active at this height. */
++  public boolean armedAt(final long height) {
++    return height >= armedFromBlock;
++  }
++
++  /**
++   * Decides whether a PROPOSAL may be accepted.
++   *
++   * @param height the height the PROPOSAL targets (the round's sequence number)
++   * @param round the PROPOSAL's round; it is part of the signed message
++   * @param author the RECOVERED author of the signed message (from its ECDSA signature)
++   * @param digest the digest of the proposed block
++   * @param seal the post-quantum seal carried by the payload, if any
++   * @return empty when the PROPOSAL is acceptable; otherwise the refusal, with names and numbers
++   */
++  public Optional refusal(
++      final long height,
++      final int round,
++      final Address author,
++      final Hash digest,
++      final Optional seal) {
++    if (!armedAt(height)) {
++      return Optional.empty();
++    }
++    if (seal == null || seal.isEmpty()) {
++      return Optional.of(
++          "AERE FULL-PQ: proposal at height " + height + " round " + round
++              + " carries NO post-quantum seal and enforcement is armed from " + armedFromBlock
++              + " - the proposal is refused");
++    }
++    final FalconSeal fs = seal.get();
++    final Address bound;
++    try {
++      bound = registry.addressForIndexAtOwnHead(height, fs.getValidatorIndex());
++    } catch (final RuntimeException e) {
++      return Optional.of(
++          "AERE FULL-PQ: registry refused index " + fs.getValidatorIndex() + " at height "
++              + height + ": " + e.getMessage());
++    }
++    if (bound == null || !bound.equals(author)) {
++      return Optional.of(
++          "AERE FULL-PQ: proposal seal index " + fs.getValidatorIndex() + " is bound to " + bound
++              + " but the proposal was authored by " + author
++              + " - a seal cannot vouch for someone else's proposal");
++    }
++
++    final Bytes32 message;
++    try {
++      message = PqAnchor.proposalMessage(chainId, height, round, digest.getBytes());
++    } catch (final RuntimeException e) {
++      // A message we cannot build means we cannot judge, and "cannot judge" must never be a pass:
++      // that would be exactly the silent disarming this file exists to refuse.
++      return Optional.of(
++          "AERE FULL-PQ: could not build the proposal message at height " + height + " round "
++              + round + ": " + e.getMessage());
++    }
++
++    final boolean valid;
++    try {
++      valid = registry.verifyAtOwnHead(height, fs.getValidatorIndex(), message, fs.getSignature());
++    } catch (final RuntimeException e) {
++      return Optional.of(
++          "AERE FULL-PQ: verification threw for index " + fs.getValidatorIndex() + " at height "
++              + height + ": " + e.getMessage());
++    }
++    if (!valid) {
++      return Optional.of(
++          "AERE FULL-PQ: post-quantum seal of index " + fs.getValidatorIndex()
++              + " does NOT verify over the proposal message at height " + height + " round " + round
++              + " - the proposal is refused");
++    }
++    return Optional.empty();
++  }
++}
+diff --git a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/PqRoundChangeEnforcement.java b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/PqRoundChangeEnforcement.java
+new file mode 100755
+index 000000000..1b952f619
+--- /dev/null
++++ b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/PqRoundChangeEnforcement.java
+@@ -0,0 +1,209 @@
++/*
++ * Copyright contributors to Besu.
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
++ * the License. You may obtain a copy of the License at
++ *
++ * http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
++ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
++ * specific language governing permissions and limitations under the License.
++ *
++ * SPDX-License-Identifier: Apache-2.0
++ */
++package org.hyperledger.besu.consensus.qbft.core.validation;
++
++import org.hyperledger.besu.consensus.common.bft.FalconSeal;
++import org.hyperledger.besu.consensus.common.bft.PqAnchor;
++import org.hyperledger.besu.consensus.common.bft.blockcreation.PqAnchorProducer;
++import org.hyperledger.besu.consensus.common.bft.PqSignerRegistry;
++import org.hyperledger.besu.consensus.qbft.core.payload.PreparedRoundMetadata;
++import org.hyperledger.besu.datatypes.Address;
++
++import java.util.Optional;
++
++import org.apache.tuweni.bytes.Bytes32;
++
++/**
++ * POST-QUANTUM ENFORCEMENT ON THE ROUND-CHANGE. The last hot-path message (AERE PQ, 2026-08-31).
++ *
++ * 
        From the armed height onwards, a ROUND-CHANGE is not accepted without a valid post-quantum
++ * seal from its OWN author. The structure copies {@link PqProposalEnforcement} line for line on
++ * purpose: a second rendering of the same idea, written differently, diverges eventually.
++ *
++ * 
        WHAT THIS LAYER BUYS, said precisely. With PREPARE armed, an adversary who breaks
++ * ECDSA cannot finalize; with PROPOSAL armed, it cannot open rounds. What it can still do is FORCE
++ * round changes: a forged quorum of round-changes moves every honest node to a round of the
++ * adversary's choosing, over and over - the remaining liveness lever, and, because a round-change
++ * may claim a prepared block, a lever over WHICH block gets re-proposed. This layer closes it: a
++ * round-change whose author cannot produce a Falcon seal does not count towards a round change on
++ * an armed node.
++ *
++ * 
        WHAT THE SEAL SIGNS. Its own domain, {@code AERE-PQ-ROUNDCHANGE-1}, over (chainId,
++ * height, targetRound, prepared metadata). The metadata is in the preimage so a seal from a bare
++ * round-change cannot be pasted onto one that claims a prepared block, and vice versa.
++ *
++ * 
        DISARMED BY DEFAULT. Without the property, {@link #fromSystemConfig()} returns null and
++ * the validator behaves exactly as upstream. A value that is PRESENT but unreadable REFUSES loudly:
++ * a node that boots disarmed because of a mistyped character looks exactly like a correctly
++ * configured one, right up to the day it matters.
++ */
++public final class PqRoundChangeEnforcement {
++
++  /** The height nothing ever reaches: disarmed. */
++  public static final long DISARMED = Long.MAX_VALUE;
++
++  /** The property that arms ROUND-CHANGE enforcement. */
++  public static final String PROPERTY_FORK_BLOCK = "aere.pq.roundChangePq.forkBlock";
++
++  /** The equivalent environment variable. */
++  public static final String ENV_FORK_BLOCK = "AERE_PQ_ROUNDCHANGEPQ_FORKBLOCK";
++
++  private final long armedFromBlock;
++  private final PqSignerRegistry registry;
++  private final long chainId;
++
++  /**
++   * @param armedFromBlock first height (inclusive) at which enforcement applies; {@link #DISARMED}
++   *     for today's behaviour
++   * @param registry the signer registry, injected, never a singleton
++   * @param chainId the chain that goes into the signed message
++   */
++  public PqRoundChangeEnforcement(
++      final long armedFromBlock, final PqSignerRegistry registry, final long chainId) {
++    this.armedFromBlock = armedFromBlock;
++    this.registry = registry;
++    this.chainId = chainId;
++  }
++
++  /**
++   * The same enforcement, with the chain id taken from the anchor configuration.
++   *
++   * 
        THE CHAIN ID IS AN ARGUMENT, NOT A GLOBAL - the PROPOSAL enforcement's own test caught the
++   * version that read it mid-decision. The factories fetch the value once, at construction, where
++   * it is visible.
++   *
++   * @param armedFromBlock first height at which enforcement applies
++   * @param registry the signer registry
++   */
++  public PqRoundChangeEnforcement(final long armedFromBlock, final PqSignerRegistry registry) {
++    this(armedFromBlock, registry, PqAnchorProducer.config().chainId());
++  }
++
++  /**
++   * The configured enforcement, read FRESH on every call.
++   *
++   * @return the armed enforcement, or null when the property is set nowhere
++   * @throws IllegalStateException AERE-PQC-ROUNDCHANGE-ENF-01 when the value is present but is not
++   *     a non-negative decimal height
++   */
++  public static PqRoundChangeEnforcement fromSystemConfig() {
++    String raw = System.getProperty(PROPERTY_FORK_BLOCK);
++    if (raw == null) {
++      raw = System.getenv(ENV_FORK_BLOCK);
++    }
++    if (raw == null || raw.isBlank()) {
++      return null;
++    }
++    final long armedFrom;
++    try {
++      armedFrom = Long.parseLong(raw.trim());
++      if (armedFrom < 0) {
++        throw new NumberFormatException("negative");
++      }
++    } catch (final NumberFormatException e) {
++      throw new IllegalStateException(
++          "AERE-PQC-ROUNDCHANGE-ENF-01: "
++              + PROPERTY_FORK_BLOCK
++              + " is set but not a non-negative block height: '"
++              + raw
++              + "'. A mistyped value must refuse, never silently disarm.");
++    }
++    return new PqRoundChangeEnforcement(armedFrom, PqSignerRegistry.falconSealSupport());
++  }
++
++  /** Whether enforcement is active at this height. */
++  public boolean armedAt(final long height) {
++    return height >= armedFromBlock;
++  }
++
++  /**
++   * Decides whether a ROUND-CHANGE may be accepted.
++   *
++   * @param height the height the round-change targets (the round's sequence number)
++   * @param targetRound the round the author wants to move to; it is part of the signed message
++   * @param author the RECOVERED author of the signed message (from its ECDSA signature)
++   * @param preparedRoundMetadata the prepared-round claim carried by the payload, if any; it is
++   *     part of the signed message
++   * @param seal the post-quantum seal carried by the payload, if any
++   * @return empty when the round-change is acceptable; otherwise the refusal, with names and
++   *     numbers
++   */
++  public Optional refusal(
++      final long height,
++      final int targetRound,
++      final Address author,
++      final Optional preparedRoundMetadata,
++      final Optional seal) {
++    if (!armedAt(height)) {
++      return Optional.empty();
++    }
++    if (seal == null || seal.isEmpty()) {
++      return Optional.of(
++          "AERE FULL-PQ: round-change at height " + height + " towards round " + targetRound
++              + " carries NO post-quantum seal and enforcement is armed from " + armedFromBlock
++              + " - the round-change is refused");
++    }
++    final FalconSeal fs = seal.get();
++    final Address bound;
++    try {
++      bound = registry.addressForIndexAtOwnHead(height, fs.getValidatorIndex());
++    } catch (final RuntimeException e) {
++      return Optional.of(
++          "AERE FULL-PQ: registry refused index " + fs.getValidatorIndex() + " at height "
++              + height + ": " + e.getMessage());
++    }
++    if (bound == null || !bound.equals(author)) {
++      return Optional.of(
++          "AERE FULL-PQ: round-change seal index " + fs.getValidatorIndex() + " is bound to "
++              + bound + " but the round-change was authored by " + author
++              + " - a seal cannot vouch for someone else's round-change");
++    }
++
++    final Bytes32 message;
++    try {
++      message =
++          preparedRoundMetadata.isPresent()
++              ? PqAnchor.roundChangeMessage(
++                  chainId,
++                  height,
++                  targetRound,
++                  preparedRoundMetadata.get().getPreparedRound(),
++                  preparedRoundMetadata.get().getPreparedBlockHash().getBytes())
++              : PqAnchor.roundChangeMessage(chainId, height, targetRound);
++    } catch (final RuntimeException e) {
++      // A message we cannot build means we cannot judge, and "cannot judge" must never be a pass:
++      // that would be exactly the silent disarming this file exists to refuse.
++      return Optional.of(
++          "AERE FULL-PQ: could not build the round-change message at height " + height
++              + " towards round " + targetRound + ": " + e.getMessage());
++    }
++
++    final boolean valid;
++    try {
++      valid = registry.verifyAtOwnHead(height, fs.getValidatorIndex(), message, fs.getSignature());
++    } catch (final RuntimeException e) {
++      return Optional.of(
++          "AERE FULL-PQ: verification threw for index " + fs.getValidatorIndex() + " at height "
++              + height + ": " + e.getMessage());
++    }
++    if (!valid) {
++      return Optional.of(
++          "AERE FULL-PQ: post-quantum seal of index " + fs.getValidatorIndex()
++              + " does NOT verify over the round-change message at height " + height
++              + " towards round " + targetRound + " - the round-change is refused");
++    }
++    return Optional.empty();
++  }
++}
+diff --git a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/PrepareValidator.java b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/PrepareValidator.java
+index 61bde6a80..460ffe8ec 100644
+--- a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/PrepareValidator.java
++++ b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/PrepareValidator.java
+@@ -5,88 +5,134 @@
+  * the License. You may obtain a copy of the License at
+  *
+  * http://www.apache.org/licenses/LICENSE-2.0
+  *
+  * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+  * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+  * specific language governing permissions and limitations under the License.
+  *
+  * SPDX-License-Identifier: Apache-2.0
+  */
+ package org.hyperledger.besu.consensus.qbft.core.validation;
+ 
+ import org.hyperledger.besu.consensus.common.bft.ConsensusRoundIdentifier;
+ import org.hyperledger.besu.consensus.common.bft.payload.SignedData;
+ import org.hyperledger.besu.consensus.qbft.core.messagewrappers.Prepare;
+ import org.hyperledger.besu.consensus.qbft.core.payload.PreparePayload;
+ import org.hyperledger.besu.datatypes.Address;
+ import org.hyperledger.besu.datatypes.Hash;
+ 
+ import java.util.Collection;
++import java.util.Optional;
+ 
+ import org.slf4j.Logger;
+ import org.slf4j.LoggerFactory;
+ 
+-/** The Prepare validator. */
++/**
++ * The Prepare validator.
++ *
++ * 
        AERE (2026-08-29), step 4 of PREPARE-SI-ROUNDCHANGE-SUB-PQ-PROIECTARE-2026-08-28: an OPTIONAL
++ * post-quantum enforcement hook, gated on height (see {@link PqPrepareEnforcement}). When no
++ * enforcement is supplied, behaviour is byte for byte the upstream one - and that is the
++ * configuration of every node today. Same pattern as {@link CommitValidator}, deliberately: a
++ * second rendering of the same idea, written differently, diverges eventually.
++ */
+ public class PrepareValidator {
+ 
+   private static final String ERROR_PREFIX = "Invalid Prepare Message";
+ 
+   private static final Logger LOG = LoggerFactory.getLogger(PrepareValidator.class);
+ 
+   private final Collection
         validators;
+   private final ConsensusRoundIdentifier targetRound;
+   private final Hash expectedDigest;
++  // AERE full-PQ: optional enforcement, gated on height. Null means upstream behaviour, which is
++  // exactly what runs on every node today.
++  private final PqPrepareEnforcement pqEnforcement;
+ 
+   /**
+-   * Instantiates a new Prepare validator.
++   * Instantiates a new Prepare validator, self-wiring the AERE post-quantum enforcement from the
++   * system configuration. Without the arming property the hook is null and nothing changes.
+    *
+    * @param validators the validators
+    * @param targetRound the target round
+    * @param expectedDigest the expected digest
+    */
+   public PrepareValidator(
+       final Collection
         validators,
+       final ConsensusRoundIdentifier targetRound,
+       final Hash expectedDigest) {
++    this(validators, targetRound, expectedDigest, PqPrepareEnforcement.fromSystemConfig());
++  }
++
++  /**
++   * Instantiates a new Prepare validator with optional post-quantum enforcement.
++   *
++   * @param validators the validators
++   * @param targetRound the target round
++   * @param expectedDigest the expected digest
++   * @param pqEnforcement the height-gated enforcement, or null for upstream behaviour
++   */
++  public PrepareValidator(
++      final Collection
         validators,
++      final ConsensusRoundIdentifier targetRound,
++      final Hash expectedDigest,
++      final PqPrepareEnforcement pqEnforcement) {
+     this.validators = validators;
+     this.targetRound = targetRound;
+     this.expectedDigest = expectedDigest;
++    this.pqEnforcement = pqEnforcement;
+   }
+ 
+   /**
+    * Validate.
+    *
+    * @param msg the msg
+    * @return the boolean
+    */
+   public boolean validate(final Prepare msg) {
+     return validate(msg.getSignedPayload());
+   }
+ 
+   /**
+    * Validate.
+    *
+    * @param signedPayload the signed payload
+    * @return the boolean
+    */
+   public boolean validate(final SignedData signedPayload) {
+     if (!validators.contains(signedPayload.getAuthor())) {
+       LOG.info("{}: did not originate from a recognized validator.", ERROR_PREFIX);
+       return false;
+     }
+ 
+     final PreparePayload payload = signedPayload.getPayload();
+ 
+     if (!payload.getRoundIdentifier().equals(targetRound)) {
+       LOG.info("{}: did not target expected round/height", ERROR_PREFIX);
+       return false;
+     }
+ 
+     if (!payload.getDigest().equals(expectedDigest)) {
+       LOG.info("{}: did not contain expected digest", ERROR_PREFIX);
+       return false;
+     }
+ 
++    // AERE full-PQ: from the armed height on, a PREPARE counts only with a valid post-quantum seal
++    // bound to THIS very author. Below it, or with no enforcement supplied, nothing changes.
++    if (pqEnforcement != null) {
++      final Optional refusal =
++          pqEnforcement.refusal(
++              targetRound.getSequenceNumber(),
++              targetRound.getRoundNumber(),
++              signedPayload.getAuthor(),
++              expectedDigest,
++              payload.getFalconSeal());
++      if (refusal.isPresent()) {
++        LOG.info("{}: {}", ERROR_PREFIX, refusal.get());
++        return false;
++      }
++    }
++
+     return true;
+   }
+ }
+diff --git a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/ProposalPayloadValidator.java b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/ProposalPayloadValidator.java
+index 58b768531..57e15d070 100644
+--- a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/ProposalPayloadValidator.java
++++ b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/ProposalPayloadValidator.java
+@@ -13,65 +13,99 @@
+  * SPDX-License-Identifier: Apache-2.0
+  */
+ package org.hyperledger.besu.consensus.qbft.core.validation;
+ 
+ import static com.google.common.base.Preconditions.checkState;
+ 
+ import org.hyperledger.besu.consensus.common.bft.ConsensusRoundIdentifier;
+ import org.hyperledger.besu.consensus.common.bft.payload.SignedData;
+ import org.hyperledger.besu.consensus.qbft.core.payload.ProposalPayload;
+ import org.hyperledger.besu.consensus.qbft.core.types.QbftBlock;
+ import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockValidator;
+ import org.hyperledger.besu.datatypes.Address;
+ import org.hyperledger.besu.ethereum.mainnet.block.access.list.BlockAccessList;
+ 
+ import java.util.Optional;
+ 
+ import com.google.common.annotations.VisibleForTesting;
+ import org.slf4j.Logger;
+ import org.slf4j.LoggerFactory;
+ 
+-/** The Proposal payload validator. */
++/**
++ * The Proposal payload validator.
++ *
++ * 
        AERE (2026-08-30): an OPTIONAL post-quantum enforcement hook, gated on height (see {@link
++ * PqProposalEnforcement}). When no enforcement is supplied, behaviour is byte for byte the upstream
++ * one - and that is the configuration of every node today. Same pattern as the PREPARE and commit
++ * validators, deliberately: a second rendering of the same idea, written differently, diverges
++ * eventually.
++ *
++ * 
        The 3-argument constructor - the one production code calls - wires the enforcement itself
++ * from the system configuration, exactly as {@link PrepareValidator} does. That self-wiring is the
++ * security property: an enforcement that had to be passed in explicitly could be dropped by any
++ * refactor without a single test failing.
++ */
+ public class ProposalPayloadValidator {
+ 
+   private static final String ERROR_PREFIX = "Invalid Proposal Payload";
+ 
+   private static final Logger LOG = LoggerFactory.getLogger(ProposalPayloadValidator.class);
+   private final Address expectedProposer;
+   private final ConsensusRoundIdentifier targetRound;
+   private final QbftBlockValidator blockValidator;
++  private final PqProposalEnforcement pqEnforcement;
+ 
+   /**
+-   * Instantiates a new Proposal payload validator.
++   * Instantiates a new Proposal payload validator, with the post-quantum enforcement wired from
++   * the system configuration. This is the constructor production code calls.
+    *
+    * @param expectedProposer the expected proposer
+    * @param targetRound the target round
+    * @param blockValidator the block validator
+    */
+   @VisibleForTesting
+   public ProposalPayloadValidator(
+       final Address expectedProposer,
+       final ConsensusRoundIdentifier targetRound,
+       final QbftBlockValidator blockValidator) {
++    this(expectedProposer, targetRound, blockValidator, PqProposalEnforcement.fromSystemConfig());
++  }
++
++  /**
++   * Instantiates a new Proposal payload validator with an explicit post-quantum enforcement. Test
++   * seam; production goes through the 3-argument constructor above.
++   *
++   * @param expectedProposer the expected proposer
++   * @param targetRound the target round
++   * @param blockValidator the block validator
++   * @param pqEnforcement the post-quantum enforcement, or null for upstream behaviour
++   */
++  @VisibleForTesting
++  public ProposalPayloadValidator(
++      final Address expectedProposer,
++      final ConsensusRoundIdentifier targetRound,
++      final QbftBlockValidator blockValidator,
++      final PqProposalEnforcement pqEnforcement) {
+     this.expectedProposer = expectedProposer;
+     this.targetRound = targetRound;
+     this.blockValidator = blockValidator;
++    this.pqEnforcement = pqEnforcement;
+   }
+ 
+   /**
+    * Validate.
+    *
+    * @param signedPayload the signed Proposal payload
+    * @return the boolean
+    */
+   public boolean validate(final SignedData signedPayload) {
+     return validate(signedPayload, true);
+   }
+ 
+   /**
+    * Validate without block validation.
+    *
+    * @param signedPayload the signed Proposal payload
+    * @return the boolean
+    */
+   public boolean validateWithoutBlockValidation(final SignedData signedPayload) {
+     return validate(signedPayload, false);
+@@ -92,40 +126,57 @@ public class ProposalPayloadValidator {
+       return false;
+     }
+ 
+     final ProposalPayload payload = signedPayload.getPayload();
+ 
+     if (!payload.getRoundIdentifier().equals(targetRound)) {
+       LOG.info("{}: proposal is not for expected round", ERROR_PREFIX);
+       return false;
+     }
+ 
+     final QbftBlock block = payload.getProposedBlock();
+     if (validateBlock && !validateBlock(block, payload.getBlockAccessList())) {
+       return false;
+     }
+ 
+     if (block.getHeader().getNumber() != payload.getRoundIdentifier().getSequenceNumber()) {
+       LOG.info("{}: block number does not match sequence number", ERROR_PREFIX);
+       return false;
+     }
+ 
++    // AERE full-PQ: from the armed height, a proposal is not accepted without a valid post-quantum
++    // seal from its OWN proposer. Below the height, and on every node without the property, this
++    // is a null check and nothing more - the upstream path, call for call.
++    if (pqEnforcement != null) {
++      final Optional refusal =
++          pqEnforcement.refusal(
++              payload.getRoundIdentifier().getSequenceNumber(),
++              payload.getRoundIdentifier().getRoundNumber(),
++              signedPayload.getAuthor(),
++              block.getHash(),
++              payload.getFalconSeal());
++      if (refusal.isPresent()) {
++        LOG.info("{}: {}", ERROR_PREFIX, refusal.get());
++        return false;
++      }
++    }
++
+     return true;
+   }
+ 
+   private boolean validateBlock(
+       final QbftBlock block, final Optional blockAccessList) {
+     checkState(blockValidator != null, "block validation not possible, no block validator.");
+ 
+     final var validationResult = blockValidator.validateBlock(block, blockAccessList);
+ 
+     if (!validationResult.success()) {
+       LOG.info(
+           "{}: block did not pass validation. Reason {}",
+           ERROR_PREFIX,
+           validationResult.errorMessage());
+       return false;
+     }
+ 
+     return true;
+   }
+ }
+diff --git a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/RoundChangePayloadValidator.java b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/RoundChangePayloadValidator.java
+index 549acdd9c..718651abe 100644
+--- a/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/RoundChangePayloadValidator.java
++++ b/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/RoundChangePayloadValidator.java
+@@ -3,89 +3,141 @@
+  *
+  * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+  * the License. You may obtain a copy of the License at
+  *
+  * http://www.apache.org/licenses/LICENSE-2.0
+  *
+  * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+  * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+  * specific language governing permissions and limitations under the License.
+  *
+  * SPDX-License-Identifier: Apache-2.0
+  */
+ package org.hyperledger.besu.consensus.qbft.core.validation;
+ 
+ import org.hyperledger.besu.consensus.common.bft.payload.SignedData;
+ import org.hyperledger.besu.consensus.qbft.core.payload.PreparedRoundMetadata;
+ import org.hyperledger.besu.consensus.qbft.core.payload.RoundChangePayload;
+ import org.hyperledger.besu.datatypes.Address;
+ 
+ import java.util.Collection;
++import java.util.Optional;
+ 
++import com.google.common.annotations.VisibleForTesting;
+ import org.slf4j.Logger;
+ import org.slf4j.LoggerFactory;
+ 
+ /**
+  * Note: This does not validate that the received payload is for a future round, only that it was
+  * signed by a known validator, and is for the current chain height. Future-round check must be
+  * performed elsewhere (eg. the BlockHeightManager)
++ *
++ * 
        AERE (2026-08-31): an OPTIONAL post-quantum enforcement hook, gated on height (see {@link
++ * PqRoundChangeEnforcement}). When no enforcement is supplied, behaviour is byte for byte the
++ * upstream one - and that is the configuration of every node today. Same pattern as the PREPARE,
++ * commit and PROPOSAL validators, deliberately: a second rendering of the same idea, written
++ * differently, diverges eventually.
++ *
++ * 
        The 2-argument constructor - the one production code calls, from both {@code
++ * MessageValidatorFactory} and {@code ProposalValidator} (the justification path) - wires the
++ * enforcement itself from the system configuration. That self-wiring is the security property: an
++ * enforcement that had to be passed in explicitly could be dropped by any refactor without a
++ * single test failing. It also means round-changes are judged in BOTH places they arrive:
++ * standalone, and inside a proposal's round-change certificate.
+  */
+ public class RoundChangePayloadValidator {
+ 
+   private static final String ERROR_PREFIX = "Invalid RoundChange Payload";
+   private static final Logger LOG = LoggerFactory.getLogger(RoundChangePayloadValidator.class);
+ 
+   private final Collection
         validators;
+   private final long chainHeight;
++  private final PqRoundChangeEnforcement pqEnforcement;
+ 
+   /**
+-   * Instantiates a new Round change payload validator.
++   * Instantiates a new Round change payload validator, with the post-quantum enforcement wired
++   * from the system configuration. This is the constructor production code calls.
+    *
+    * @param validators the validators
+    * @param chainHeight the chain height
+    */
+   public RoundChangePayloadValidator(final Collection
         validators, final long chainHeight) {
++    this(validators, chainHeight, PqRoundChangeEnforcement.fromSystemConfig());
++  }
++
++  /**
++   * Instantiates a new Round change payload validator with an explicit post-quantum enforcement.
++   * Test seam; production goes through the 2-argument constructor above.
++   *
++   * @param validators the validators
++   * @param chainHeight the chain height
++   * @param pqEnforcement the post-quantum enforcement, or null for upstream behaviour
++   */
++  @VisibleForTesting
++  public RoundChangePayloadValidator(
++      final Collection
         validators,
++      final long chainHeight,
++      final PqRoundChangeEnforcement pqEnforcement) {
+     this.validators = validators;
+     this.chainHeight = chainHeight;
++    this.pqEnforcement = pqEnforcement;
+   }
+ 
+   /**
+    * Validate.
+    *
+    * @param signedPayload the signed payload
+    * @return the boolean
+    */
+   public boolean validate(final SignedData signedPayload) {
+ 
+     if (!validators.contains(signedPayload.getAuthor())) {
+       LOG.info("{}: did not originate from a recognized validator.", ERROR_PREFIX);
+       return false;
+     }
+ 
+     final RoundChangePayload payload = signedPayload.getPayload();
+ 
+     if (payload.getRoundIdentifier().getSequenceNumber() != chainHeight) {
+       LOG.info("{}: did not target expected height", ERROR_PREFIX);
+       return false;
+     }
+ 
+     final int targetRound = payload.getRoundIdentifier().getRoundNumber();
+     if (targetRound <= 0) {
+       LOG.info("{}: must contain a positive target round number", ERROR_PREFIX);
+       return false;
+     }
+ 
+     if (payload.getPreparedRoundMetadata().isPresent()) {
+       final PreparedRoundMetadata metadata = payload.getPreparedRoundMetadata().get();
+       if (metadata.getPreparedRound() >= targetRound) {
+         LOG.info("{}: prepared metadata is from a round ahead of target round", ERROR_PREFIX);
+         return false;
+       }
+ 
+       if (metadata.getPreparedRound() < 0) {
+         LOG.info("{}: prepared metadata is from a negative round number", ERROR_PREFIX);
+         return false;
+       }
+     }
++
++    // AERE full-PQ: from the armed height, a round-change is not accepted without a valid
++    // post-quantum seal from its OWN author. Below the height, and on every node without the
++    // property, this is a null check and nothing more - the upstream path, call for call.
++    if (pqEnforcement != null) {
++      final Optional refusal =
++          pqEnforcement.refusal(
++              payload.getRoundIdentifier().getSequenceNumber(),
++              targetRound,
++              signedPayload.getAuthor(),
++              payload.getPreparedRoundMetadata(),
++              payload.getFalconSeal());
++      if (refusal.isPresent()) {
++        LOG.info("{}: {}", ERROR_PREFIX, refusal.get());
++        return false;
++      }
++    }
++
+     return true;
+   }
+ }
+diff --git a/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/network/ProposalSealPlumbingTest.java b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/network/ProposalSealPlumbingTest.java
+new file mode 100755
+index 000000000..4fe68e20f
+--- /dev/null
++++ b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/network/ProposalSealPlumbingTest.java
+@@ -0,0 +1,101 @@
++/*
++ * Copyright contributors to Besu.
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
++ * the License. You may obtain a copy of the License at
++ *
++ * http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
++ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
++ * specific language governing permissions and limitations under the License.
++ *
++ * SPDX-License-Identifier: Apache-2.0
++ */
++package org.hyperledger.besu.consensus.qbft.core.network;
++
++import static java.util.Collections.emptyList;
++import static org.assertj.core.api.Assertions.assertThat;
++import static org.mockito.ArgumentMatchers.any;
++import static org.mockito.Mockito.lenient;
++import static org.mockito.Mockito.verify;
++
++import org.hyperledger.besu.consensus.common.bft.ConsensusRoundIdentifier;
++import org.hyperledger.besu.consensus.common.bft.FalconSeal;
++import org.hyperledger.besu.consensus.common.bft.network.ValidatorMulticaster;
++import org.hyperledger.besu.consensus.qbft.core.QbftBlockTestFixture;
++import org.hyperledger.besu.consensus.qbft.core.messagedata.ProposalMessageData;
++import org.hyperledger.besu.consensus.qbft.core.messagewrappers.Proposal;
++import org.hyperledger.besu.consensus.qbft.core.payload.MessageFactory;
++import org.hyperledger.besu.consensus.qbft.core.types.QbftBlock;
++import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockCodec;
++import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockHeader;
++import org.hyperledger.besu.consensus.qbft.core.validation.QbftBlockHeaderTestFixture;
++import org.hyperledger.besu.cryptoservices.NodeKeyUtils;
++import org.hyperledger.besu.ethereum.p2p.rlpx.wire.MessageData;
++
++import java.util.Optional;
++
++import org.apache.tuweni.bytes.Bytes;
++import org.junit.jupiter.api.Test;
++import org.junit.jupiter.api.extension.ExtendWith;
++import org.mockito.ArgumentCaptor;
++import org.mockito.Mock;
++import org.mockito.junit.jupiter.MockitoExtension;
++
++/**
++ * THE PLUMBING between the local proposal and the one on the wire.
++ *
++ * 
        This test exists because the first network run of proposal enforcement (F84 scenario A,
++ * 2026-08-30) went red on its own WITNESS: every node emitted a seal on its local proposal, and
++ * the chain still stopped dead at the enforcement height, because {@code multicastProposal}
++ * re-creates the proposal from scratch and the wire copy carried no seal. Every unit test we had
++ * passed, since none of them looked at what actually leaves the node. This one does.
++ */
++@ExtendWith(MockitoExtension.class)
++public class ProposalSealPlumbingTest {
++
++  private static final ConsensusRoundIdentifier ROUND_ID = new ConsensusRoundIdentifier(1, 0);
++
++  @Mock private QbftBlockCodec blockEncoder;
++  @Mock private QbftBlock block;
++  @Mock private ValidatorMulticaster multicaster;
++
++  private Proposal sentProposal(final Optional seal) {
++    lenient().when(blockEncoder.readFrom(any())).thenReturn(block);
++    final MessageFactory factory = new MessageFactory(NodeKeyUtils.generate(), blockEncoder);
++    final QbftMessageTransmitter transmitter = new QbftMessageTransmitter(factory, multicaster);
++
++    if (seal.isPresent()) {
++      transmitter.multicastProposal(
++          ROUND_ID, block, Optional.empty(), emptyList(), emptyList(), seal);
++    } else {
++      transmitter.multicastProposal(ROUND_ID, block, Optional.empty(), emptyList(), emptyList());
++    }
++
++    final ArgumentCaptor captor = ArgumentCaptor.forClass(MessageData.class);
++    verify(multicaster).send(captor.capture());
++    return ProposalMessageData.fromMessageData(captor.getValue()).decode(blockEncoder);
++  }
++
++  @Test
++  public void theSealHandedToTheTransmitterIsTheSealOnTheWire() {
++    final FalconSeal seal = new FalconSeal(4, Bytes.fromHexString("0xdeadbeef"));
++    final Proposal wire = sentProposal(Optional.of(seal));
++    assertThat(wire.getSignedPayload().getPayload().getFalconSeal()).contains(seal);
++  }
++
++  @Test
++  public void withoutASealTheWireProposalCarriesNone() {
++    final Proposal wire = sentProposal(Optional.empty());
++    assertThat(wire.getSignedPayload().getPayload().getFalconSeal()).isEmpty();
++  }
++
++  /** Kept so the fixture imports stay honest if the wrappers change shape. */
++  @Test
++  public void theFixturesStillBuildARealBlock() {
++    final QbftBlockHeader header = new QbftBlockHeaderTestFixture().number(1).buildHeader();
++    final QbftBlock real = new QbftBlockTestFixture().blockHeader(header).build();
++    assertThat(real.getHeader().getNumber()).isEqualTo(1);
++  }
++}
+diff --git a/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/network/RoundChangeSealPlumbingTest.java b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/network/RoundChangeSealPlumbingTest.java
+new file mode 100755
+index 000000000..878925888
+--- /dev/null
++++ b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/network/RoundChangeSealPlumbingTest.java
+@@ -0,0 +1,88 @@
++/*
++ * Copyright contributors to Besu.
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
++ * the License. You may obtain a copy of the License at
++ *
++ * http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
++ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
++ * specific language governing permissions and limitations under the License.
++ *
++ * SPDX-License-Identifier: Apache-2.0
++ */
++package org.hyperledger.besu.consensus.qbft.core.network;
++
++import static org.assertj.core.api.Assertions.assertThat;
++import static org.mockito.Mockito.verify;
++
++import org.hyperledger.besu.consensus.common.bft.ConsensusRoundIdentifier;
++import org.hyperledger.besu.consensus.common.bft.FalconSeal;
++import org.hyperledger.besu.consensus.common.bft.network.ValidatorMulticaster;
++import org.hyperledger.besu.consensus.qbft.core.messagedata.RoundChangeMessageData;
++import org.hyperledger.besu.consensus.qbft.core.messagewrappers.RoundChange;
++import org.hyperledger.besu.consensus.qbft.core.payload.MessageFactory;
++import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockCodec;
++import org.hyperledger.besu.cryptoservices.NodeKeyUtils;
++import org.hyperledger.besu.ethereum.p2p.rlpx.wire.MessageData;
++
++import java.util.Optional;
++
++import org.apache.tuweni.bytes.Bytes;
++import org.junit.jupiter.api.Test;
++import org.junit.jupiter.api.extension.ExtendWith;
++import org.mockito.ArgumentCaptor;
++import org.mockito.Mock;
++import org.mockito.junit.jupiter.MockitoExtension;
++
++/**
++ * THE PLUMBING between the local round-change and the one on the wire.
++ *
++ * 
        This test exists because of what F84 measured on the PROPOSAL (2026-08-30): the transmitter
++ * re-created the message from scratch, so the local copy carried a seal and the wire copy did not,
++ * and every unit test passed because none looked at what actually leaves the node. The round-change
++ * path has the same shape - the height manager builds a local round-change AND the transmitter used
++ * to build its own - so it gets the same test: the sealed overload must put the EXACT object it was
++ * handed on the wire.
++ */
++@ExtendWith(MockitoExtension.class)
++public class RoundChangeSealPlumbingTest {
++
++  // A round-change targets a positive round.
++  private static final ConsensusRoundIdentifier ROUND_ID = new ConsensusRoundIdentifier(1, 1);
++
++  @Mock private QbftBlockCodec blockEncoder;
++  @Mock private ValidatorMulticaster multicaster;
++
++  private RoundChange sentRoundChange(final Optional seal) {
++    final MessageFactory factory = new MessageFactory(NodeKeyUtils.generate(), blockEncoder);
++    final QbftMessageTransmitter transmitter = new QbftMessageTransmitter(factory, multicaster);
++
++    if (seal.isPresent()) {
++      // The sealed path: the caller builds ONCE and the transmitter must not rebuild - Falcon
++      // signatures are randomised, so a rebuild would put a different object on the wire.
++      final RoundChange built = factory.createRoundChange(ROUND_ID, Optional.empty(), seal);
++      transmitter.multicastRoundChange(built);
++    } else {
++      transmitter.multicastRoundChange(ROUND_ID, Optional.empty());
++    }
++
++    final ArgumentCaptor captor = ArgumentCaptor.forClass(MessageData.class);
++    verify(multicaster).send(captor.capture());
++    return RoundChangeMessageData.fromMessageData(captor.getValue()).decode(blockEncoder);
++  }
++
++  @Test
++  public void theSealHandedToTheTransmitterIsTheSealOnTheWire() {
++    final FalconSeal seal = new FalconSeal(4, Bytes.fromHexString("0xdeadbeef"));
++    final RoundChange wire = sentRoundChange(Optional.of(seal));
++    assertThat(wire.getSignedPayload().getPayload().getFalconSeal()).contains(seal);
++  }
++
++  @Test
++  public void withoutASealTheWireRoundChangeCarriesNone() {
++    final RoundChange wire = sentRoundChange(Optional.empty());
++    assertThat(wire.getSignedPayload().getPayload().getFalconSeal()).isEmpty();
++  }
++}
+diff --git a/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/payload/CommitPayloadHybridTest.java b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/payload/CommitPayloadHybridTest.java
+new file mode 100755
+index 000000000..ec0f88451
+--- /dev/null
++++ b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/payload/CommitPayloadHybridTest.java
+@@ -0,0 +1,277 @@
++/* AERE HYBRID, step 1: the hybrid certificate inside the commit message.
++ *
++ * The proof that matters most comes FIRST: the golden vectors. They were measured on the
++ * binary from BEFORE this change (2026-08-24, by printing the encoding of a CommitPayload
++ * built from fixed values) and are copied here to be immovable. As long as they stay green,
++ * a commit without extras encodes exactly as on the live fleet, so the new binary can be
++ * warmed on a real node with no flag day. If anyone ever changes the base encoding, they
++ * turn red before the change can reach the chain.
++ *
++ * The rest proves the hybrid is truly hybrid: REAL Falcon plus REAL SLH-DSA, two unrelated
++ * mathematical families in the same message, each verified with its own scheme. */
++package org.hyperledger.besu.consensus.qbft.core.payload;
++
++import static org.assertj.core.api.Assertions.assertThat;
++import static org.assertj.core.api.Assertions.assertThatThrownBy;
++
++import org.hyperledger.besu.consensus.common.bft.ConsensusRoundIdentifier;
++import org.hyperledger.besu.consensus.common.bft.FalconSeal;
++import org.hyperledger.besu.consensus.common.bft.PqAnchorV2;
++import org.hyperledger.besu.consensus.common.bft.SchemeSeal;
++import org.hyperledger.besu.consensus.common.bft.SealScheme;
++import org.hyperledger.besu.consensus.common.bft.SealSchemes;
++import org.hyperledger.besu.crypto.SECPSignature;
++import org.hyperledger.besu.crypto.SecureRandomProvider;
++import org.hyperledger.besu.crypto.SignatureAlgorithmFactory;
++import org.hyperledger.besu.datatypes.Hash;
++import org.hyperledger.besu.ethereum.rlp.BytesValueRLPInput;
++import org.hyperledger.besu.ethereum.rlp.BytesValueRLPOutput;
++import org.hyperledger.besu.ethereum.rlp.RLPException;
++
++import java.security.SecureRandom;
++import java.util.List;
++import java.util.Optional;
++
++import org.apache.tuweni.bytes.Bytes;
++import org.junit.jupiter.api.Test;
++
++public class CommitPayloadHybridTest {
++
++  // ---- VECTORII DE AUR, masurati pe binarul de DINAINTE de aceasta schimbare -------------------
++  private static final String AUR_FARA_PQ =
++      "0xf8660703a0000000000000000000000000000000000000000000000000000000000000002a"
++          + "b8410101010101010101010101010101010101010101010101010101010101010101"
++          + "020202020202020202020202020202020202020202020202020202020202020200";
++  private static final String AUR_CU_FALCON =
++      "0xf86d0703a0000000000000000000000000000000000000000000000000000000000000002a"
++          + "b8410101010101010101010101010101010101010101010101010101010101010101"
++          + "020202020202020202020202020202020202020202020202020202020202020200"
++          + "c60384deadbeef";
++  private static final String AUR_HASH_FARA_PQ =
++      "0xe4e36f241e03352338d89a5a0c98a59c5595d034f5a5d10e2316239ee0aecc40";
++  private static final String AUR_HASH_CU_FALCON =
++      "0x03e71e08f2b72cde0e493edfce8e26529a34b92c3c0daf0ab3591a175aec4b13";
++
++  private static final ConsensusRoundIdentifier ROUND = new ConsensusRoundIdentifier(7L, 3);
++  private static final Hash DIGEST = Hash.fromHexStringLenient("0x2a");
++  private static final FalconSeal FALCON_AUR =
++      new FalconSeal(3, Bytes.fromHexString("0xdeadbeef"));
++
++  private final SecureRandom random = SecureRandomProvider.createSecureRandom();
++
++  private static SECPSignature ecdsa() {
++    return SignatureAlgorithmFactory.getInstance()
++        .decodeSignature(
++            Bytes.fromHexString(
++                "0x"
++                    + "0101010101010101010101010101010101010101010101010101010101010101"
++                    + "0202020202020202020202020202020202020202020202020202020202020202"
++                    + "00"));
++  }
++
++  private static CommitPayload prinCodec(final CommitPayload original) {
++    final BytesValueRLPOutput out = new BytesValueRLPOutput();
++    original.writeTo(out);
++    return CommitPayload.readFrom(new BytesValueRLPInput(out.encoded(), false));
++  }
++
++  // ============================================================ 1. LACATUL: flota vie neatinsa
++
++  @Test
++  public void aCommitWithoutPqEncodesExactlyAsTheLiveFleetDoes() {
++    final CommitPayload p = new CommitPayload(ROUND, DIGEST, ecdsa());
++    assertThat(p.encoded().toHexString()).isEqualTo(AUR_FARA_PQ);
++    assertThat(p.hashForSignature().toHexString()).isEqualTo(AUR_HASH_FARA_PQ);
++  }
++
++  @Test
++  public void aFalconOnlyCommitEncodesExactlyAsTheLiveFleetDoes() {
++    final CommitPayload p =
++        new CommitPayload(ROUND, DIGEST, ecdsa(), Optional.of(FALCON_AUR));
++    assertThat(p.encoded().toHexString()).isEqualTo(AUR_CU_FALCON);
++    assertThat(p.hashForSignature().toHexString()).isEqualTo(AUR_HASH_CU_FALCON);
++  }
++
++  @Test
++  public void theGoldenBytesOfTheLiveFleetStillDecode() {
++    final CommitPayload p =
++        CommitPayload.readFrom(
++            new BytesValueRLPInput(Bytes.fromHexString(AUR_CU_FALCON), false));
++    assertThat(p.getFalconSeal()).contains(FALCON_AUR);
++    assertThat(p.getExtraSeals()).isEmpty();
++  }
++
++  // ============================================================ 2. hibridul, cu crypto REALA
++
++  @Test
++  public void aRealHybridCertificateSurvivesTheRoundTrip() {
++    final SealScheme.GeneratedPair slh = SealSchemes.SLH_DSA_128S.generate(random);
++    final byte[] sig =
++        SealSchemes.SLH_DSA_128S.sign(slh.privateKey(), DIGEST.getBytes().toArray()).orElseThrow();
++    final SchemeSeal extra =
++        new SchemeSeal(SealSchemes.SLH_DSA_128S.wireId(), 3, Bytes.wrap(sig));
++
++    final CommitPayload original =
++        new CommitPayload(ROUND, DIGEST, ecdsa(), Optional.of(FALCON_AUR), List.of(extra));
++    final CommitPayload back = prinCodec(original);
++
++    assertThat(back).isEqualTo(original);
++    assertThat(back.getFalconSeal()).contains(FALCON_AUR);
++    assertThat(back.getExtraSeals()).hasSize(1);
++    // si semnatura chiar se verifica dupa drumul prin codec, cu SCHEMA ei
++    assertThat(
++            SealSchemes.SLH_DSA_128S.verifyRaw(
++                slh.publicRegistryForm(),
++                DIGEST.getBytes().toArray(),
++                back.getExtraSeals().get(0).getSignature().toArray()))
++        .isTrue();
++  }
++
++  @Test
++  public void twoUnrelatedFamiliesTravelInOneCommitAndEachVerifiesWithItsOwn() {
++    final SealScheme.GeneratedPair falcon = SealSchemes.FALCON_512.generate(random);
++    final SealScheme.GeneratedPair slh = SealSchemes.SLH_DSA_128S.generate(random);
++    final byte[] message = DIGEST.getBytes().toArray();
++    final byte[] sigFalcon = SealSchemes.FALCON_512.sign(falcon.privateKey(), message).orElseThrow();
++    final byte[] sigSlh = SealSchemes.SLH_DSA_128S.sign(slh.privateKey(), message).orElseThrow();
++
++    final CommitPayload p =
++        new CommitPayload(
++            ROUND,
++            DIGEST,
++            ecdsa(),
++            Optional.of(new FalconSeal(3, Bytes.wrap(sigFalcon))),
++            List.of(new SchemeSeal(SealSchemes.SLH_DSA_128S.wireId(), 3, Bytes.wrap(sigSlh))));
++    final CommitPayload back = prinCodec(p);
++
++    assertThat(
++            SealSchemes.FALCON_512.verifyRaw(
++                falcon.publicRegistryForm(),
++                message,
++                back.getFalconSeal().orElseThrow().getSignature().toArray()))
++        .isTrue();
++    assertThat(
++            SealSchemes.SLH_DSA_128S.verifyRaw(
++                slh.publicRegistryForm(),
++                message,
++                back.getExtraSeals().get(0).getSignature().toArray()))
++        .isTrue();
++    // the CROSSED CONTROL: each signature is refused by the OTHER scheme, so the hybrid
++    // really stands on two legs and not on the same leg twice
++    assertThat(SealSchemes.SLH_DSA_128S.verifyRaw(slh.publicRegistryForm(), message, sigFalcon))
++        .isFalse();
++    assertThat(SealSchemes.FALCON_512.verifyRaw(falcon.publicRegistryForm(), message, sigSlh))
++        .isFalse();
++  }
++
++  @Test
++  public void theEcdsaSignedBytesCoverTheExtras() {
++    final SchemeSeal extra =
++        new SchemeSeal(SealSchemes.SLH_DSA_128S.wireId(), 3, Bytes.fromHexString("0xabcdef"));
++    final CommitPayload faraExtras =
++        new CommitPayload(ROUND, DIGEST, ecdsa(), Optional.of(FALCON_AUR));
++    final CommitPayload cuExtras =
++        new CommitPayload(ROUND, DIGEST, ecdsa(), Optional.of(FALCON_AUR), List.of(extra));
++    // if the hash were the same, extras could be added or removed by anyone without
++    // breaking the author's signature
++    assertThat(cuExtras.hashForSignature()).isNotEqualTo(faraExtras.hashForSignature());
++  }
++
++  // ============================================================ 3. refuzurile
++
++  @Test
++  public void extrasWithoutAFalconSealAreRefusedAtConstruction() {
++    final SchemeSeal extra =
++        new SchemeSeal(SealSchemes.SLH_DSA_128S.wireId(), 3, Bytes.fromHexString("0xabcdef"));
++    assertThatThrownBy(
++            () -> new CommitPayload(ROUND, DIGEST, ecdsa(), Optional.empty(), List.of(extra)))
++        .isInstanceOf(IllegalArgumentException.class)
++        .hasMessageContaining("require the Falcon seal");
++  }
++
++  @Test
++  public void falconInTheExtrasIsRefusedSoOneSignatureHasOneHome() {
++    final SchemeSeal falconInExtras =
++        new SchemeSeal(SealSchemes.FALCON_512.wireId(), 3, Bytes.fromHexString("0xabcdef"));
++    assertThatThrownBy(
++            () ->
++                new CommitPayload(
++                    ROUND, DIGEST, ecdsa(), Optional.of(FALCON_AUR), List.of(falconInExtras)))
++        .isInstanceOf(IllegalArgumentException.class)
++        .hasMessageContaining("own slot");
++  }
++
++  @Test
++  public void anEmptyExtrasElementOnTheWireIsRefused() {
++    // doua codificari ale aceleiasi valori nu au voie sa existe: extras gol == extras absent
++    final BytesValueRLPOutput out = new BytesValueRLPOutput();
++    out.startList();
++    out.writeLongScalar(ROUND.getSequenceNumber());
++    out.writeIntScalar(ROUND.getRoundNumber());
++    out.writeBytes(DIGEST.getBytes());
++    out.writeBytes(ecdsa().encodedBytes());
++    out.startList();
++    out.writeIntScalar(FALCON_AUR.getValidatorIndex());
++    out.writeBytes(FALCON_AUR.getSignature());
++    out.endList();
++    out.writeRaw(PqAnchorV2.encode(List.of()));
++    out.endList();
++
++    assertThatThrownBy(
++            () -> CommitPayload.readFrom(new BytesValueRLPInput(out.encoded(), false)))
++        .isInstanceOf(RLPException.class);
++  }
++
++  @Test
++  public void aThirdTrailingElementIsRefusedByCanonicality() {
++    final BytesValueRLPOutput out = new BytesValueRLPOutput();
++    out.startList();
++    out.writeLongScalar(ROUND.getSequenceNumber());
++    out.writeIntScalar(ROUND.getRoundNumber());
++    out.writeBytes(DIGEST.getBytes());
++    out.writeBytes(ecdsa().encodedBytes());
++    out.startList();
++    out.writeIntScalar(FALCON_AUR.getValidatorIndex());
++    out.writeBytes(FALCON_AUR.getSignature());
++    out.endList();
++    out.writeRaw(
++        PqAnchorV2.encode(
++            List.of(
++                new SchemeSeal(
++                    SealSchemes.SLH_DSA_128S.wireId(), 3, Bytes.fromHexString("0xabcdef")))));
++    out.writeBytes(Bytes.fromHexString("0x99")); // al treilea element, nu exista in format
++    out.endList();
++
++    assertThatThrownBy(
++            () -> CommitPayload.readFrom(new BytesValueRLPInput(out.encoded(), false)))
++        .isInstanceOf(RLPException.class);
++  }
++
++  @Test
++  public void aCorruptedExtrasElementIsAnRlpFailureNotACrash() {
++    final BytesValueRLPOutput out = new BytesValueRLPOutput();
++    out.startList();
++    out.writeLongScalar(ROUND.getSequenceNumber());
++    out.writeIntScalar(ROUND.getRoundNumber());
++    out.writeBytes(DIGEST.getBytes());
++    out.writeBytes(ecdsa().encodedBytes());
++    out.startList();
++    out.writeIntScalar(FALCON_AUR.getValidatorIndex());
++    out.writeBytes(FALCON_AUR.getSignature());
++    out.endList();
++    // un element care NU e un certificat v2: versiune necunoscuta
++    final BytesValueRLPOutput bad = new BytesValueRLPOutput();
++    bad.startList();
++    bad.writeIntScalar(99);
++    bad.startList();
++    bad.endList();
++    bad.endList();
++    out.writeRaw(bad.encoded());
++    out.endList();
++
++    assertThatThrownBy(
++            () -> CommitPayload.readFrom(new BytesValueRLPInput(out.encoded(), false)))
++        .isInstanceOf(RLPException.class)
++        .hasMessageContaining("AERE HIBRID");
++  }
++}
+diff --git a/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/payload/PreparePayloadPqTest.java b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/payload/PreparePayloadPqTest.java
+new file mode 100755
+index 000000000..d2f91c43c
+--- /dev/null
++++ b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/payload/PreparePayloadPqTest.java
+@@ -0,0 +1,209 @@
++/*
++ * Copyright contributors to Besu.
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
++ * the License. You may obtain a copy of the License at
++ *
++ * http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
++ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
++ * specific language governing permissions and limitations under the License.
++ *
++ * SPDX-License-Identifier: Apache-2.0
++ */
++package org.hyperledger.besu.consensus.qbft.core.payload;
++
++import static org.assertj.core.api.Assertions.assertThat;
++import static org.assertj.core.api.Assertions.assertThatThrownBy;
++
++import org.hyperledger.besu.consensus.common.bft.ConsensusRoundIdentifier;
++import org.hyperledger.besu.consensus.common.bft.FalconSeal;
++import org.hyperledger.besu.consensus.common.bft.PqAnchor;
++import org.hyperledger.besu.datatypes.Hash;
++import org.hyperledger.besu.ethereum.rlp.BytesValueRLPInput;
++import org.hyperledger.besu.ethereum.rlp.BytesValueRLPOutput;
++import org.hyperledger.besu.ethereum.rlp.RLPException;
++
++import java.util.Optional;
++
++import org.apache.tuweni.bytes.Bytes;
++import org.apache.tuweni.bytes.Bytes32;
++import org.junit.jupiter.api.Test;
++
++/**
++ * STEP 1 of PREPARE-SI-ROUNDCHANGE-SUB-PQ-PROIECTARE-2026-08-28: the wire can carry a
++ * post-quantum seal on a PREPARE, and NOTHING emits one yet.
++ *
++ * 
        The test that matters most is the first one: a PREPARE without a seal encodes EXACTLY as it
++ * did before this change. Without it the new binary cannot be rolled onto a live fleet, because the
++ * neighbours would compute a different signature hash and reject every PREPARE. The golden vector
++ * is built from the canonical encoding of the OLD form, not from a run of the new code.
++ */
++public class PreparePayloadPqTest {
++
++  private static final ConsensusRoundIdentifier ROUND = new ConsensusRoundIdentifier(7, 3);
++  private static final Hash DIGEST =
++      Hash.wrap(
++          Bytes32.fromHexString(
++              "0x000000000000000000000000000000000000000000000000000000000000002a"));
++
++  /**
++   * THE GOLDEN VECTOR of the old form: RLP[ sequence, round, digest(32) ]. Built here from its
++   * elements, not copied from a run, so that what it is made of stays visible.
++   *
++   * 
        The first version of this test wrapped sequence and round in a LIST, and it failed. The
++   * source (QbftPayload.writeConsensusRound) writes them as two FLAT scalars. The test was the
++   * wrong one, not the code - and that is worth saying, because a golden vector written from
++   * intuition instead of from the source would have either refused good code or, worse, been
++   * "fixed" by moving the code to match it.
++   */
++  private static Bytes goldenOldForm() {
++    final BytesValueRLPOutput out = new BytesValueRLPOutput();
++    out.startList();
++    out.writeLongScalar(7L);
++    out.writeIntScalar(3);
++    out.writeBytes(DIGEST.getBytes());
++    out.endList();
++    return out.encoded();
++  }
++
++  @Test
++  public void aPrepareWithoutASealEncodesEXACTLYAsBefore() {
++    final PreparePayload p = new PreparePayload(ROUND, DIGEST);
++    assertThat(p.encoded()).isEqualTo(goldenOldForm());
++    // and the signature hash, which is precisely what binds the author to the message
++    assertThat(p.hashForSignature())
++        .isEqualTo(new PreparePayload(ROUND, DIGEST, Optional.empty()).hashForSignature());
++  }
++
++  @Test
++  public void aPrepareWithoutASealReadsBackIdentical() {
++    final Bytes encoded = new PreparePayload(ROUND, DIGEST).encoded();
++    final PreparePayload decoded = PreparePayload.readFrom(new BytesValueRLPInput(encoded, false));
++    assertThat(decoded.getFalconSeal()).isEmpty();
++    assertThat(decoded.getDigest()).isEqualTo(DIGEST);
++    assertThat(decoded.getRoundIdentifier()).isEqualTo(ROUND);
++    assertThat(decoded.encoded()).isEqualTo(encoded);
++  }
++
++  @Test
++  public void aPrepareWithASealReadsBackIdentical() {
++    final FalconSeal seal = new FalconSeal(4, Bytes.fromHexString("0xdeadbeef"));
++    final PreparePayload p = new PreparePayload(ROUND, DIGEST, Optional.of(seal));
++    final Bytes encoded = p.encoded();
++
++    // it is longer than the old form, and CONTAINS it as a prefix of the content
++    assertThat(encoded.size()).isGreaterThan(goldenOldForm().size());
++
++    final PreparePayload decoded = PreparePayload.readFrom(new BytesValueRLPInput(encoded, false));
++    assertThat(decoded.getFalconSeal()).isPresent();
++    assertThat(decoded.getFalconSeal().get().getValidatorIndex()).isEqualTo(4);
++    assertThat(decoded.getFalconSeal().get().getSignature()).isEqualTo(Bytes.fromHexString("0xdeadbeef"));
++    assertThat(decoded).isEqualTo(p);
++    assertThat(decoded.encoded()).isEqualTo(encoded);
++  }
++
++  @Test
++  public void aSealChangesTheSignatureHash() {
++    // If it did not change it, the author's ECDSA signature would not cover the seal, and anyone
++    // could paste a foreign index onto an otherwise valid PREPARE.
++    final PreparePayload without = new PreparePayload(ROUND, DIGEST);
++    final PreparePayload with =
++        new PreparePayload(ROUND, DIGEST, Optional.of(new FalconSeal(4, Bytes.fromHexString("0xdeadbeef"))));
++    assertThat(with.hashForSignature()).isNotEqualTo(without.hashForSignature());
++  }
++
++  @Test
++  public void aNONCANONICALEncodingIsRefused() {
++    // A third element that is not a seal: the decoder could ignore it, and then two different byte
++    // strings would authenticate to the same validator. It is refused.
++    final BytesValueRLPOutput out = new BytesValueRLPOutput();
++    out.startList();
++    out.writeLongScalar(7L);
++    out.writeIntScalar(3);
++    out.writeBytes(DIGEST.getBytes());
++    out.startList();
++    out.writeIntScalar(4);
++    out.writeBytes(Bytes.fromHexString("0xdeadbeef"));
++    out.writeBytes(Bytes.fromHexString("0xff")); // element in plus INAUNTRUL sigiliului
++    out.endList();
++    out.endList();
++
++    assertThatThrownBy(() -> PreparePayload.readFrom(new BytesValueRLPInput(out.encoded(), false)))
++        .isInstanceOf(RLPException.class);
++  }
++
++  // ---- domain separation: the security part of the design -------------------------------------
++
++  @Test
++  public void thePREPAREMessageIsNotTheCOMMITMessage() {
++    // If it were the same, a PREPARE seal given HONESTLY could be pasted onto a forged COMMIT and
++    // the enforcement there would accept it. That is exactly the attack this separation closes.
++    final Bytes32 prep = PqAnchor.prepareMessage(2800L, 100L, 3, DIGEST.getBytes());
++    final Bytes32 comm = PqAnchor.commitMessage(2800L, 100L, DIGEST.getBytes());
++    assertThat(prep).isNotEqualTo(comm);
++  }
++
++  @Test
++  public void thePREPAREMessageDependsOnTheROUND() {
++    // Two PREPAREs for the same block in different rounds are two different assertions. Without the
++    // round in the preimage, a seal from a failed round would justify another one.
++    final Bytes32 r3 = PqAnchor.prepareMessage(2800L, 100L, 3, DIGEST.getBytes());
++    final Bytes32 r4 = PqAnchor.prepareMessage(2800L, 100L, 4, DIGEST.getBytes());
++    assertThat(r3).isNotEqualTo(r4);
++  }
++
++  @Test
++  public void thePREPAREMessageDependsOnCHAINAndHEIGHT() {
++    final Bytes32 baza = PqAnchor.prepareMessage(2800L, 100L, 3, DIGEST.getBytes());
++    assertThat(PqAnchor.prepareMessage(2801L, 100L, 3, DIGEST.getBytes())).isNotEqualTo(baza);
++    assertThat(PqAnchor.prepareMessage(2800L, 101L, 3, DIGEST.getBytes())).isNotEqualTo(baza);
++  }
++
++  @Test
++  public void thePREPAREMessageRefusesImpossibleInputs() {
++    assertThatThrownBy(() -> PqAnchor.prepareMessage(2800L, -1L, 3, DIGEST.getBytes()))
++        .isInstanceOf(IllegalArgumentException.class);
++    assertThatThrownBy(() -> PqAnchor.prepareMessage(2800L, 100L, -1, DIGEST.getBytes()))
++        .isInstanceOf(IllegalArgumentException.class);
++    assertThatThrownBy(() -> PqAnchor.prepareMessage(2800L, 100L, 3, Bytes.fromHexString("0x00")))
++        .isInstanceOf(IllegalArgumentException.class);
++  }
++
++  // ===============================================================================================
++  // THE BRIDGE TO CLIENT 2, added 2026-08-29 (finding D-282).
++  //
++  // The two strings below are written LITERALLY in client 2's test as well
++  // (AereQbftPrepareSealWireProofTests), for the same values. This is not a round trip: each
++  // implementation encodes the payload on its own and compares it with THE SAME string. If either
++  // one moves, one of the two tests fails - and that is exactly the question that matters, because
++  // a client-2 decoder strict at three elements would have rejected every PREPARE of a fleet with
++  // emission armed, exactly as its decoder strict at four rejected every commit at an anchor
++  // height.
++  //
++  // And so that this is not two implementations being wrong in the same way, the bytes were checked
++  // with a THIRD RLP encoder as well, written separately in python, with no connection to either
++  // project: both strings matched exactly.
++  //
++  // The structure, so it can be read by eye:
++  //   e3 | 07 | 03 | a0 <32 digest bytes>                        = old form, three elements
++  //   ea | 07 | 03 | a0 <32 digest bytes> | c6 04 84 deadbeef    = with a seal, four elements
++  // ===============================================================================================
++
++  private static final String AUR_FARA_SIGILIU =
++      "0xe30703a0000000000000000000000000000000000000000000000000000000000000002a";
++  private static final String AUR_CU_SIGILIU =
++      "0xea0703a0000000000000000000000000000000000000000000000000000000000000002ac60484deadbeef";
++
++  @Test
++  public void theWireBytesAreTHESAMEAsInClient2sTest() {
++    assertThat(new PreparePayload(ROUND, DIGEST).encoded())
++        .isEqualTo(Bytes.fromHexString(AUR_FARA_SIGILIU));
++
++    final PreparePayload with =
++        new PreparePayload(
++            ROUND, DIGEST, Optional.of(new FalconSeal(4, Bytes.fromHexString("0xdeadbeef"))));
++    assertThat(with.encoded()).isEqualTo(Bytes.fromHexString(AUR_CU_SIGILIU));
++  }
++}
+diff --git a/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/payload/ProposalPayloadPqTest.java b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/payload/ProposalPayloadPqTest.java
+new file mode 100755
+index 000000000..c6b6de065
+--- /dev/null
++++ b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/payload/ProposalPayloadPqTest.java
+@@ -0,0 +1,202 @@
++/*
++ * Copyright contributors to Besu.
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
++ * the License. You may obtain a copy of the License at
++ *
++ * http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
++ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
++ * specific language governing permissions and limitations under the License.
++ *
++ * SPDX-License-Identifier: Apache-2.0
++ */
++package org.hyperledger.besu.consensus.qbft.core.payload;
++
++import static org.assertj.core.api.Assertions.assertThat;
++import static org.assertj.core.api.Assertions.assertThatThrownBy;
++import static org.mockito.ArgumentMatchers.any;
++import static org.mockito.Mockito.lenient;
++
++import org.hyperledger.besu.consensus.common.bft.ConsensusRoundIdentifier;
++import org.hyperledger.besu.consensus.common.bft.FalconSeal;
++import org.hyperledger.besu.consensus.common.bft.PqAnchor;
++import org.hyperledger.besu.consensus.qbft.core.types.QbftBlock;
++import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockCodec;
++import org.hyperledger.besu.ethereum.rlp.BytesValueRLPInput;
++import org.hyperledger.besu.ethereum.rlp.BytesValueRLPOutput;
++import org.hyperledger.besu.ethereum.rlp.RLPException;
++
++import java.util.Optional;
++
++import org.apache.tuweni.bytes.Bytes;
++import org.apache.tuweni.bytes.Bytes32;
++import org.junit.jupiter.api.BeforeEach;
++import org.junit.jupiter.api.Test;
++import org.junit.jupiter.api.extension.ExtendWith;
++import org.mockito.Mock;
++import org.mockito.junit.jupiter.MockitoExtension;
++
++/**
++ * The wire can carry a post-quantum seal on a PROPOSAL, and NOTHING emits one yet (AERE PQ,
++ * 2026-08-30, the hot-path step after PREPARE).
++ *
++ * 
        The test that matters most is the first one: a proposal without a seal encodes EXACTLY as
++ * upstream does. The block codec is mocked and contributes zero bytes on both sides of the round
++ * trip, which is what lets the surrounding list structure be compared against a hand-built
++ * expected form instead of against a run of the code under test.
++ *
++ * 
        The strictness tests close the malleability door this file's javadoc names: an authenticated
++ * payload whose decoder silently ignored trailing elements would let two different byte strings
++ * authenticate to the same proposer.
++ */
++@ExtendWith(MockitoExtension.class)
++public class ProposalPayloadPqTest {
++
++  private static final ConsensusRoundIdentifier ROUND_ID = new ConsensusRoundIdentifier(7, 3);
++
++  @Mock private QbftBlockCodec blockEncoder;
++  @Mock private QbftBlock block;
++
++  @BeforeEach
++  void wireCodec() {
++    // The mock codec writes nothing and reads nothing: the block contributes zero elements on both
++    // sides, so the tests compare the STRUCTURE around it, which is what this file changed.
++    lenient().when(blockEncoder.readFrom(any())).thenReturn(block);
++  }
++
++  /** The old form with the mocked block: RLP[ sequence, round, null-BAL ]. Built by hand. */
++  private static Bytes oldForm() {
++    final BytesValueRLPOutput out = new BytesValueRLPOutput();
++    out.startList();
++    out.writeLongScalar(ROUND_ID.getSequenceNumber());
++    out.writeIntScalar(ROUND_ID.getRoundNumber());
++    out.writeNull();
++    out.endList();
++    return out.encoded();
++  }
++
++  @Test
++  public void aProposalWithoutASealEncodesEXACTLYAsBefore() {
++    final ProposalPayload p = new ProposalPayload(ROUND_ID, block, blockEncoder, Optional.empty());
++    assertThat(p.encoded()).isEqualTo(oldForm());
++    // and the signature hash, which is precisely what binds the proposer to the message
++    assertThat(p.hashForSignature())
++        .isEqualTo(
++            new ProposalPayload(ROUND_ID, block, blockEncoder, Optional.empty(), Optional.empty())
++                .hashForSignature());
++  }
++
++  @Test
++  public void aProposalWithoutASealReadsBackIdentical() {
++    final Bytes encoded = new ProposalPayload(ROUND_ID, block, blockEncoder, Optional.empty()).encoded();
++    final ProposalPayload read =
++        ProposalPayload.readFrom(new BytesValueRLPInput(encoded, false), blockEncoder);
++    assertThat(read.getFalconSeal()).isEmpty();
++    assertThat(read.getRoundIdentifier()).isEqualTo(ROUND_ID);
++    assertThat(read.encoded()).isEqualTo(encoded);
++  }
++
++  @Test
++  public void aProposalWithASealReadsBackIdentical() {
++    final FalconSeal seal = new FalconSeal(4, Bytes.fromHexString("0xdeadbeef"));
++    final ProposalPayload p =
++        new ProposalPayload(ROUND_ID, block, blockEncoder, Optional.empty(), Optional.of(seal));
++    final Bytes encoded = p.encoded();
++
++    // it is longer than the old form, and CONTAINS it as a prefix of the content
++    assertThat(encoded.size()).isGreaterThan(oldForm().size());
++
++    final ProposalPayload read =
++        ProposalPayload.readFrom(new BytesValueRLPInput(encoded, false), blockEncoder);
++    assertThat(read.getFalconSeal()).isPresent();
++    assertThat(read.getFalconSeal().get().getValidatorIndex()).isEqualTo(4);
++    assertThat(read.getFalconSeal().get().getSignature())
++        .isEqualTo(Bytes.fromHexString("0xdeadbeef"));
++    assertThat(read.encoded()).isEqualTo(encoded);
++  }
++
++  @Test
++  public void aSealChangesTheSignatureHash() {
++    // If it did not change it, the proposer's ECDSA signature would not cover the seal, and anyone
++    // could paste a foreign index onto an otherwise valid proposal.
++    final ProposalPayload without = new ProposalPayload(ROUND_ID, block, blockEncoder, Optional.empty());
++    final ProposalPayload with =
++        new ProposalPayload(
++            ROUND_ID,
++            block,
++            blockEncoder,
++            Optional.empty(),
++            Optional.of(new FalconSeal(4, Bytes.fromHexString("0xdeadbeef"))));
++    assertThat(with.hashForSignature()).isNotEqualTo(without.hashForSignature());
++  }
++
++  @Test
++  public void anElementAfterTheSealIsRefused() {
++    // A decoder that ignored it would re-encode without it: two different byte strings would
++    // authenticate to the same proposer. It is refused.
++    final BytesValueRLPOutput out = new BytesValueRLPOutput();
++    out.startList();
++    out.writeLongScalar(ROUND_ID.getSequenceNumber());
++    out.writeIntScalar(ROUND_ID.getRoundNumber());
++    out.writeNull();
++    out.startList();
++    out.writeIntScalar(4);
++    out.writeBytes(Bytes.fromHexString("0xdeadbeef"));
++    out.endList();
++    out.writeIntScalar(1); // the trailing element nothing accounts for
++    out.endList();
++
++    assertThatThrownBy(
++            () -> ProposalPayload.readFrom(new BytesValueRLPInput(out.encoded(), false), blockEncoder))
++        .isInstanceOf(RLPException.class);
++  }
++
++  @Test
++  public void aFifthElementThatIsNotASealIsRefused() {
++    final BytesValueRLPOutput out = new BytesValueRLPOutput();
++    out.startList();
++    out.writeLongScalar(ROUND_ID.getSequenceNumber());
++    out.writeIntScalar(ROUND_ID.getRoundNumber());
++    out.writeNull();
++    out.writeBytes(Bytes.fromHexString("0x01")); // not a [index, signature] list
++    out.endList();
++
++    assertThatThrownBy(
++            () -> ProposalPayload.readFrom(new BytesValueRLPInput(out.encoded(), false), blockEncoder))
++        .isInstanceOf(RLPException.class);
++  }
++
++  // ---- domain separation: the security part of the design --------------------------------------
++
++  private static final Bytes32 DIGEST =
++      Bytes32.fromHexString("0x000000000000000000000000000000000000000000000000000000000000002a");
++
++  @Test
++  public void theProposalMessageIsNeitherThePrepareNorTheCommitMessage() {
++    // If any two were the same, a seal given HONESTLY in one role could be replayed in the other:
++    // an offer counted as a vote, or a vote replayed as an offer.
++    final Bytes32 proposal = PqAnchor.proposalMessage(2800L, 100L, 3, DIGEST);
++    assertThat(proposal).isNotEqualTo(PqAnchor.prepareMessage(2800L, 100L, 3, DIGEST));
++    assertThat(proposal).isNotEqualTo(PqAnchor.commitMessage(2800L, 100L, DIGEST));
++  }
++
++  @Test
++  public void theProposalMessageDependsOnROUNDChainAndHeight() {
++    final Bytes32 base = PqAnchor.proposalMessage(2800L, 100L, 3, DIGEST);
++    assertThat(PqAnchor.proposalMessage(2800L, 100L, 4, DIGEST)).isNotEqualTo(base);
++    assertThat(PqAnchor.proposalMessage(2801L, 100L, 3, DIGEST)).isNotEqualTo(base);
++    assertThat(PqAnchor.proposalMessage(2800L, 101L, 3, DIGEST)).isNotEqualTo(base);
++  }
++
++  @Test
++  public void theProposalMessageRefusesImpossibleInputs() {
++    assertThatThrownBy(() -> PqAnchor.proposalMessage(2800L, -1L, 3, DIGEST))
++        .isInstanceOf(IllegalArgumentException.class);
++    assertThatThrownBy(() -> PqAnchor.proposalMessage(2800L, 100L, -1, DIGEST))
++        .isInstanceOf(IllegalArgumentException.class);
++    assertThatThrownBy(() -> PqAnchor.proposalMessage(2800L, 100L, 3, Bytes.fromHexString("0x00")))
++        .isInstanceOf(IllegalArgumentException.class);
++  }
++}
+diff --git a/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/payload/RoundChangePayloadPqTest.java b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/payload/RoundChangePayloadPqTest.java
+new file mode 100755
+index 000000000..efbf51766
+--- /dev/null
++++ b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/payload/RoundChangePayloadPqTest.java
+@@ -0,0 +1,236 @@
++/*
++ * Copyright contributors to Besu.
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
++ * the License. You may obtain a copy of the License at
++ *
++ * http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
++ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
++ * specific language governing permissions and limitations under the License.
++ *
++ * SPDX-License-Identifier: Apache-2.0
++ */
++package org.hyperledger.besu.consensus.qbft.core.payload;
++
++import static org.assertj.core.api.Assertions.assertThat;
++import static org.assertj.core.api.Assertions.assertThatThrownBy;
++
++import org.hyperledger.besu.consensus.common.bft.ConsensusRoundIdentifier;
++import org.hyperledger.besu.consensus.common.bft.FalconSeal;
++import org.hyperledger.besu.consensus.common.bft.PqAnchor;
++import org.hyperledger.besu.datatypes.Hash;
++import org.hyperledger.besu.ethereum.rlp.BytesValueRLPInput;
++import org.hyperledger.besu.ethereum.rlp.BytesValueRLPOutput;
++import org.hyperledger.besu.ethereum.rlp.RLPException;
++
++import java.util.Optional;
++
++import org.apache.tuweni.bytes.Bytes;
++import org.apache.tuweni.bytes.Bytes32;
++import org.junit.jupiter.api.Test;
++
++/**
++ * The wire can carry a post-quantum seal on a ROUND-CHANGE, and NOTHING emits one yet (AERE PQ,
++ * 2026-08-31, the last hot-path message).
++ *
++ * 
        The test that matters most is the first one: a round-change without a seal encodes EXACTLY as
++ * upstream does, compared against a hand-built expected form instead of against a run of the code
++ * under test.
++ *
++ * 
        The strictness tests close the malleability door the payload's javadoc names: an
++ * authenticated payload whose decoder silently ignored trailing elements would let two different
++ * byte strings authenticate to the same author.
++ */
++public class RoundChangePayloadPqTest {
++
++  private static final ConsensusRoundIdentifier ROUND_ID = new ConsensusRoundIdentifier(7, 3);
++  private static final Hash PREPARED_HASH = Hash.hash(Bytes.of(1, 2, 3));
++
++  /** The old bare form: RLP[ sequence, round, [] ]. Built by hand. */
++  private static Bytes oldBareForm() {
++    final BytesValueRLPOutput out = new BytesValueRLPOutput();
++    out.startList();
++    out.writeLongScalar(ROUND_ID.getSequenceNumber());
++    out.writeIntScalar(ROUND_ID.getRoundNumber());
++    out.startList();
++    out.endList();
++    out.endList();
++    return out.encoded();
++  }
++
++  @Test
++  public void aRoundChangeWithoutASealEncodesEXACTLYAsBefore() {
++    final RoundChangePayload p = new RoundChangePayload(ROUND_ID, Optional.empty());
++    assertThat(p.encoded()).isEqualTo(oldBareForm());
++    // and the signature hash, which is precisely what binds the author to the message
++    assertThat(p.hashForSignature())
++        .isEqualTo(
++            new RoundChangePayload(ROUND_ID, Optional.empty(), Optional.empty()).hashForSignature());
++  }
++
++  @Test
++  public void aRoundChangeWithPreparedMetadataAndNoSealReadsBackIdentical() {
++    final RoundChangePayload p =
++        new RoundChangePayload(
++            ROUND_ID, Optional.of(new PreparedRoundMetadata(PREPARED_HASH, 1)));
++    final Bytes encoded = p.encoded();
++    final RoundChangePayload read =
++        RoundChangePayload.readFrom(new BytesValueRLPInput(encoded, false));
++    assertThat(read.getFalconSeal()).isEmpty();
++    assertThat(read.getPreparedRoundMetadata()).isPresent();
++    assertThat(read.getPreparedRoundMetadata().get().getPreparedRound()).isEqualTo(1);
++    assertThat(read.getPreparedRoundMetadata().get().getPreparedBlockHash())
++        .isEqualTo(PREPARED_HASH);
++    assertThat(read.encoded()).isEqualTo(encoded);
++  }
++
++  @Test
++  public void aRoundChangeWithASealReadsBackIdentical() {
++    final FalconSeal seal = new FalconSeal(4, Bytes.fromHexString("0xdeadbeef"));
++    final RoundChangePayload p =
++        new RoundChangePayload(ROUND_ID, Optional.empty(), Optional.of(seal));
++    final Bytes encoded = p.encoded();
++
++    // it is longer than the old form, and CONTAINS it as a prefix of the content
++    assertThat(encoded.size()).isGreaterThan(oldBareForm().size());
++
++    final RoundChangePayload read =
++        RoundChangePayload.readFrom(new BytesValueRLPInput(encoded, false));
++    assertThat(read.getFalconSeal()).isPresent();
++    assertThat(read.getFalconSeal().get().getValidatorIndex()).isEqualTo(4);
++    assertThat(read.getFalconSeal().get().getSignature())
++        .isEqualTo(Bytes.fromHexString("0xdeadbeef"));
++    assertThat(read.encoded()).isEqualTo(encoded);
++  }
++
++  @Test
++  public void aSealedRoundChangeWithPreparedMetadataReadsBackIdentical() {
++    final FalconSeal seal = new FalconSeal(2, Bytes.fromHexString("0xfeedface"));
++    final RoundChangePayload p =
++        new RoundChangePayload(
++            ROUND_ID, Optional.of(new PreparedRoundMetadata(PREPARED_HASH, 2)), Optional.of(seal));
++    final Bytes encoded = p.encoded();
++    final RoundChangePayload read =
++        RoundChangePayload.readFrom(new BytesValueRLPInput(encoded, false));
++    assertThat(read.getFalconSeal()).isPresent();
++    assertThat(read.getPreparedRoundMetadata()).isPresent();
++    assertThat(read.encoded()).isEqualTo(encoded);
++  }
++
++  @Test
++  public void theGoldenBytesMatchTheSecondClient() {
++    // The SAME two hex strings are asserted by the second client (AereQbftPrepareSealWireProofTests,
++    // AurRcFaraSigiliu / AurRcCuSigiliu) for the same sequence/round/seal. If either implementation
++    // moves, one of the two tests goes red - the cross-implementation link. A round trip through our
++    // own encoder would only prove that we agree with ourselves.
++    assertThat(new RoundChangePayload(ROUND_ID, Optional.empty()).encoded().toUnprefixedHexString())
++        .isEqualTo("c30703c0");
++    assertThat(
++            new RoundChangePayload(
++                    ROUND_ID,
++                    Optional.empty(),
++                    Optional.of(new FalconSeal(4, Bytes.fromHexString("0xdeadbeef"))))
++                .encoded()
++                .toUnprefixedHexString())
++        .isEqualTo("ca0703c0c60484deadbeef");
++  }
++
++  @Test
++  public void aSealChangesTheSignatureHash() {
++    // If it did not change it, the author's ECDSA signature would not cover the seal, and anyone
++    // could paste a foreign index onto an otherwise valid round-change.
++    final RoundChangePayload without = new RoundChangePayload(ROUND_ID, Optional.empty());
++    final RoundChangePayload with =
++        new RoundChangePayload(
++            ROUND_ID,
++            Optional.empty(),
++            Optional.of(new FalconSeal(4, Bytes.fromHexString("0xdeadbeef"))));
++    assertThat(with.hashForSignature()).isNotEqualTo(without.hashForSignature());
++  }
++
++  @Test
++  public void anElementAfterTheSealIsRefused() {
++    // A decoder that ignored it would re-encode without it: two different byte strings would
++    // authenticate to the same author. It is refused.
++    final BytesValueRLPOutput out = new BytesValueRLPOutput();
++    out.startList();
++    out.writeLongScalar(ROUND_ID.getSequenceNumber());
++    out.writeIntScalar(ROUND_ID.getRoundNumber());
++    out.startList();
++    out.endList();
++    out.startList();
++    out.writeIntScalar(4);
++    out.writeBytes(Bytes.fromHexString("0xdeadbeef"));
++    out.endList();
++    out.writeIntScalar(1); // the trailing element nothing accounts for
++    out.endList();
++
++    assertThatThrownBy(
++            () -> RoundChangePayload.readFrom(new BytesValueRLPInput(out.encoded(), false)))
++        .isInstanceOf(RLPException.class);
++  }
++
++  @Test
++  public void aFourthElementThatIsNotASealIsRefused() {
++    final BytesValueRLPOutput out = new BytesValueRLPOutput();
++    out.startList();
++    out.writeLongScalar(ROUND_ID.getSequenceNumber());
++    out.writeIntScalar(ROUND_ID.getRoundNumber());
++    out.startList();
++    out.endList();
++    out.writeBytes(Bytes.fromHexString("0x01")); // not a [index, signature] list
++    out.endList();
++
++    assertThatThrownBy(
++            () -> RoundChangePayload.readFrom(new BytesValueRLPInput(out.encoded(), false)))
++        .isInstanceOf(RLPException.class);
++  }
++
++  // ---- domain separation: the security part of the design --------------------------------------
++
++  private static final Bytes32 DIGEST =
++      Bytes32.fromHexString("0x000000000000000000000000000000000000000000000000000000000000002a");
++
++  @Test
++  public void theRoundChangeMessageIsNoneOfItsThreeSiblings() {
++    // If any two were the same, a seal given HONESTLY in one role could be replayed in the other:
++    // "move on" counted as a vote, an offer, or the other way around.
++    final Bytes32 rc = PqAnchor.roundChangeMessage(2800L, 100L, 3);
++    assertThat(rc).isNotEqualTo(PqAnchor.prepareMessage(2800L, 100L, 3, DIGEST));
++    assertThat(rc).isNotEqualTo(PqAnchor.proposalMessage(2800L, 100L, 3, DIGEST));
++    assertThat(rc).isNotEqualTo(PqAnchor.commitMessage(2800L, 100L, DIGEST));
++  }
++
++  @Test
++  public void theRoundChangeMessageDependsOnTargetRoundChainAndHeight() {
++    final Bytes32 base = PqAnchor.roundChangeMessage(2800L, 100L, 3);
++    assertThat(PqAnchor.roundChangeMessage(2800L, 100L, 4)).isNotEqualTo(base);
++    assertThat(PqAnchor.roundChangeMessage(2801L, 100L, 3)).isNotEqualTo(base);
++    assertThat(PqAnchor.roundChangeMessage(2800L, 101L, 3)).isNotEqualTo(base);
++  }
++
++  @Test
++  public void aBareAndAPreparedRoundChangeMessageDiffer() {
++    // The metadata is in the preimage: "move on" and "move on and re-propose THIS block" are two
++    // different assertions, and their seals must not be interchangeable.
++    final Bytes32 bare = PqAnchor.roundChangeMessage(2800L, 100L, 3);
++    final Bytes32 prepared = PqAnchor.roundChangeMessage(2800L, 100L, 3, 1, DIGEST);
++    assertThat(prepared).isNotEqualTo(bare);
++    assertThat(PqAnchor.roundChangeMessage(2800L, 100L, 3, 2, DIGEST)).isNotEqualTo(prepared);
++  }
++
++  @Test
++  public void theRoundChangeMessageRefusesImpossibleInputs() {
++    assertThatThrownBy(() -> PqAnchor.roundChangeMessage(2800L, -1L, 3))
++        .isInstanceOf(IllegalArgumentException.class);
++    assertThatThrownBy(() -> PqAnchor.roundChangeMessage(2800L, 100L, -1))
++        .isInstanceOf(IllegalArgumentException.class);
++    assertThatThrownBy(() -> PqAnchor.roundChangeMessage(2800L, 100L, 3, -1, DIGEST))
++        .isInstanceOf(IllegalArgumentException.class);
++    assertThatThrownBy(
++            () -> PqAnchor.roundChangeMessage(2800L, 100L, 3, 1, Bytes.fromHexString("0x00")))
++        .isInstanceOf(IllegalArgumentException.class);
++  }
++}
+diff --git a/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/statemachine/PqHybridExtrasNeverThrowTest.java b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/statemachine/PqHybridExtrasNeverThrowTest.java
+new file mode 100755
+index 000000000..2efccf985
+--- /dev/null
++++ b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/statemachine/PqHybridExtrasNeverThrowTest.java
+@@ -0,0 +1,69 @@
++/*
++ * Copyright contributors to Hyperledger Besu.
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
++ * the License. You may obtain a copy of the License at
++ *
++ * http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
++ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
++ * specific language governing permissions and limitations under the License.
++ *
++ * SPDX-License-Identifier: Apache-2.0
++ */
++package org.hyperledger.besu.consensus.qbft.core.statemachine;
++
++import static org.assertj.core.api.Assertions.assertThat;
++import static org.assertj.core.api.Assertions.assertThatThrownBy;
++
++import org.hyperledger.besu.consensus.common.bft.HybridSealSupport;
++
++import org.apache.tuweni.bytes.Bytes32;
++import org.junit.jupiter.api.AfterEach;
++import org.junit.jupiter.api.BeforeEach;
++import org.junit.jupiter.api.Test;
++
++/**
++ * D-334 (2026-09-03): a hybrid configuration the node cannot read must cost the node its SLH-DSA
++ * contribution, never its vote. The loader throws (the defect is real and named); the state
++ * machine's helper returns an empty list instead of letting that exception reach the QBFT event
++ * loop. Both halves are asserted, so the test cannot pass by the configuration being silently
++ * ignored.
++ */
++public class PqHybridExtrasNeverThrowTest {
++
++  private static final String[] PROPS = {
++    HybridSealSupport.PROPERTY_SCHEDULE,
++    HybridSealSupport.PROPERTY_REGISTRY,
++    HybridSealSupport.PROPERTY_ATTACH_BLOCK
++  };
++
++  @BeforeEach
++  public void plantAnUnreadableRegistry() {
++    HybridSealSupport.resetForTesting();
++    System.setProperty(HybridSealSupport.PROPERTY_SCHEDULE, "10:falcon-512+slh-dsa-sha2-128s");
++    System.setProperty(
++        HybridSealSupport.PROPERTY_REGISTRY, "/nonexistent/aere-d334/hibrid-1.properties");
++  }
++
++  @AfterEach
++  public void cleanUp() {
++    for (final String p : PROPS) {
++      System.clearProperty(p);
++    }
++    HybridSealSupport.resetForTesting();
++  }
++
++  @Test
++  public void theLoaderNamesTheDefect() {
++    assertThatThrownBy(HybridSealSupport::instance)
++        .isInstanceOf(IllegalStateException.class)
++        .hasMessageContaining("AERE-PQC-HYBRID-CONF-04");
++  }
++
++  @Test
++  public void theStateMachineHelperReturnsEmptyInsteadOfThrowing() {
++    assertThat(QbftRound.hybridExtrasOrEmpty(31L, Bytes32.ZERO)).isEmpty();
++  }
++}
+diff --git a/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/statemachine/PqLateSealSalvageTest.java b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/statemachine/PqLateSealSalvageTest.java
+new file mode 100755
+index 000000000..82586ae25
+--- /dev/null
++++ b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/statemachine/PqLateSealSalvageTest.java
+@@ -0,0 +1,195 @@
++/*
++ * Copyright contributors to Besu.
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
++ * the License. You may obtain a copy of the License at
++ *
++ * http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
++ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
++ * specific language governing permissions and limitations under the License.
++ *
++ * SPDX-License-Identifier: Apache-2.0
++ */
++package org.hyperledger.besu.consensus.qbft.core.statemachine;
++
++import static org.assertj.core.api.Assertions.assertThat;
++import static org.mockito.ArgumentMatchers.any;
++import static org.mockito.Mockito.never;
++import static org.mockito.Mockito.verify;
++import static org.mockito.Mockito.when;
++
++import org.hyperledger.besu.consensus.common.bft.ConsensusRoundIdentifier;
++import org.hyperledger.besu.consensus.common.bft.FalconSeal;
++import org.hyperledger.besu.consensus.common.bft.MessageTracker;
++import org.hyperledger.besu.consensus.common.bft.PqSealCache;
++import org.hyperledger.besu.consensus.common.bft.statemachine.FutureMessageBuffer;
++import org.hyperledger.besu.consensus.qbft.core.QbftMessageFixture;
++import org.hyperledger.besu.consensus.qbft.core.QbftReceivedMessageEventFixture;
++import org.hyperledger.besu.consensus.qbft.core.messagedata.CommitMessageData;
++import org.hyperledger.besu.consensus.qbft.core.messagedata.QbftV1;
++import org.hyperledger.besu.consensus.qbft.core.messagewrappers.Commit;
++import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockCodec;
++import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockHeader;
++import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockchain;
++import org.hyperledger.besu.consensus.qbft.core.types.QbftFinalState;
++import org.hyperledger.besu.consensus.qbft.core.types.QbftGossiper;
++import org.hyperledger.besu.consensus.qbft.core.types.QbftMessage;
++import org.hyperledger.besu.datatypes.Address;
++import org.hyperledger.besu.datatypes.Hash;
++
++import java.util.List;
++import java.util.Optional;
++
++import com.google.common.collect.ImmutableList;
++import org.apache.tuweni.bytes.Bytes;
++import org.junit.jupiter.api.AfterEach;
++import org.junit.jupiter.api.BeforeEach;
++import org.junit.jupiter.api.Test;
++import org.junit.jupiter.api.extension.ExtendWith;
++import org.mockito.Mock;
++import org.mockito.junit.jupiter.MockitoExtension;
++import org.mockito.junit.jupiter.MockitoSettings;
++import org.mockito.quality.Strictness;
++
++/**
++ * AERE D-227 (2026-08-14): a Commit that arrives AFTER its block was imported is discarded by the
++ * height gate in {@link QbftController#consumeMessage}, and before this patch its Falcon seal died
++ * with it. Measured on chain 2800: the block imports on the quorum-th Commit, the slowest
++ * validators' Commits consistently arrive after that moment, and their seals appeared in 3% and
++ * 14% of other proposers' certificates while appearing in 100% of their own.
++ *
++ * 
        Every claim here has its pair: the one case that salvages, and the five refusals around it.
++ * The refusals are not decoration - each one guards a real path (an older seal nobody can ask for
++ * again, a fork sibling's seal, a non-validator author, a seal-less commit, and the message itself
++ * staying dead).
++ */
++@ExtendWith(MockitoExtension.class)
++@MockitoSettings(strictness = Strictness.LENIENT)
++public class PqLateSealSalvageTest {
++
++  @Mock private QbftBlockchain blockChain;
++  @Mock private QbftFinalState qbftFinalState;
++  @Mock private QbftBlockHeightManagerFactory blockHeightManagerFactory;
++  @Mock private QbftBlockHeader chainHeadBlockHeader;
++  @Mock private BaseQbftBlockHeightManager blockHeightManager;
++  @Mock private Commit commit;
++  @Mock private CommitMessageData commitMessageData;
++  @Mock private MessageTracker messageTracker;
++  @Mock private FutureMessageBuffer futureMessageBuffer;
++  @Mock private QbftGossiper qbftGossiper;
++  @Mock private QbftBlockCodec blockEncoder;
++
++  private static final long HEAD = 3L;
++  private static final Hash HEAD_HASH = Hash.hash(Bytes.fromHexString("0xaa"));
++  private static final Hash OTHER_HASH = Hash.hash(Bytes.fromHexString("0xbb"));
++  private final Address validator = Address.fromHexString("0x1");
++  private final Address nonValidator = Address.fromHexString("0x2");
++  private final FalconSeal seal = new FalconSeal(4, Bytes.fromHexString("0x29aabbcc"));
++
++  private QbftController qbftController;
++
++  @BeforeEach
++  public void setup() {
++    PqSealCache.instance().clear();
++    when(blockChain.getChainHeadHeader()).thenReturn(chainHeadBlockHeader);
++    when(blockChain.getChainHeadBlockNumber()).thenReturn(HEAD);
++    when(blockHeightManagerFactory.create(any())).thenReturn(blockHeightManager);
++    when(qbftFinalState.getValidators()).thenReturn(ImmutableList.of(validator));
++    when(chainHeadBlockHeader.getNumber()).thenReturn(HEAD);
++    when(chainHeadBlockHeader.getHash()).thenReturn(HEAD_HASH);
++    when(blockHeightManager.getParentBlockHeader()).thenReturn(chainHeadBlockHeader);
++    when(blockHeightManager.getChainHeight()).thenReturn(HEAD + 1);
++    when(qbftFinalState.isLocalNodeValidator()).thenReturn(true);
++    when(messageTracker.hasSeenMessage(any())).thenReturn(false);
++    qbftController =
++        new QbftController(
++            blockChain,
++            qbftFinalState,
++            blockHeightManagerFactory,
++            qbftGossiper,
++            messageTracker,
++            futureMessageBuffer,
++            blockEncoder);
++    qbftController.start();
++  }
++
++  @AfterEach
++  public void cleanup() {
++    // The cache is a singleton: a seal left behind would leak into unrelated tests and buy them
++    // an unearned green.
++    PqSealCache.instance().clear();
++  }
++
++  private void deliverCommit(
++      final long height, final Hash digest, final Address author, final Optional fs) {
++    when(commit.getAuthor()).thenReturn(author);
++    when(commit.getRoundIdentifier()).thenReturn(new ConsensusRoundIdentifier(height, 0));
++    when(commit.getDigest()).thenReturn(digest);
++    when(commit.getFalconSeal()).thenReturn(fs);
++    when(commitMessageData.getCode()).thenReturn(QbftV1.COMMIT);
++    when(commitMessageData.decode()).thenReturn(commit);
++    qbftController.handleMessageEvent(
++        new QbftReceivedMessageEventFixture(new QbftMessageFixture(commitMessageData)));
++  }
++
++  private List cached() {
++    return PqSealCache.instance().sealsFor(HEAD, HEAD_HASH);
++  }
++
++  @Test
++  public void lateCommitSealForImportedHeadIsSalvaged() {
++    deliverCommit(HEAD, HEAD_HASH, validator, Optional.of(seal));
++    assertThat(cached()).containsExactly(seal);
++  }
++
++  @Test
++  public void salvagedMessageStillDies() {
++    // The pair of the test above, on the same delivery: only the seal survives. Resurrecting the
++    // message would reopen the very height gate the upstream code closed on purpose.
++    deliverCommit(HEAD, HEAD_HASH, validator, Optional.of(seal));
++    verify(blockHeightManager, never()).handleCommitPayload(any());
++  }
++
++  @Test
++  public void sealOlderThanHeadIsNotSalvaged() {
++    // The proposer of block HEAD+1 carries a certificate over HEAD. A seal for HEAD-1 can never
++    // be asked for again; keeping it would only grow the cache.
++    deliverCommit(HEAD - 1, HEAD_HASH, validator, Optional.of(seal));
++    assertThat(cached()).isEmpty();
++    assertThat(PqSealCache.instance().entryCount()).isZero();
++  }
++
++  @Test
++  public void sealOverDifferentBlockAtHeadHeightIsNotSalvaged() {
++    // A losing round or a fork sibling: same height, different digest. Its seal is over a block
++    // hash the fleet did not import, so carrying it would fail verification anyway - refusing it
++    // here keeps the cache honest instead of relying on the later check.
++    deliverCommit(HEAD, OTHER_HASH, validator, Optional.of(seal));
++    assertThat(cached()).isEmpty();
++  }
++
++  @Test
++  public void sealFromNonValidatorIsNotSalvaged() {
++    // Without this refusal any peer could write into the cache of every node it is connected to.
++    deliverCommit(HEAD, HEAD_HASH, nonValidator, Optional.of(seal));
++    assertThat(cached()).isEmpty();
++  }
++
++  @Test
++  public void commitWithoutSealChangesNothing() {
++    deliverCommit(HEAD, HEAD_HASH, validator, Optional.empty());
++    assertThat(cached()).isEmpty();
++    assertThat(PqSealCache.instance().entryCount()).isZero();
++  }
++
++  @Test
++  public void currentHeightCommitIsUntouchedByTheSalvagePath() {
++    // CONTROL: a commit for the CURRENT height (head+1) must take the normal path - handled,
++    // not salvaged. If this fails, the patch moved the gate instead of adding a side-exit.
++    deliverCommit(HEAD + 1, HEAD_HASH, validator, Optional.of(seal));
++    verify(blockHeightManager).handleCommitPayload(commit);
++    assertThat(cached()).isEmpty();
++  }
++}
+diff --git a/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/statemachine/PqSealsWithoutProposalTest.java b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/statemachine/PqSealsWithoutProposalTest.java
+new file mode 100755
+index 000000000..47a2256c4
+--- /dev/null
++++ b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/statemachine/PqSealsWithoutProposalTest.java
+@@ -0,0 +1,168 @@
++/*
++ * Copyright contributors to Aere Network.
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
++ * compliance with the License. You may obtain a copy of the License at
++ *
++ * http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software distributed under the License is
++ * distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
++ * implied. See the License for the specific language governing permissions and limitations under the
++ * License.
++ *
++ * SPDX-License-Identifier: Apache-2.0
++ */
++package org.hyperledger.besu.consensus.qbft.core.statemachine;
++
++import static org.assertj.core.api.Assertions.assertThat;
++import static org.mockito.Mockito.when;
++
++import java.util.List;
++import java.util.Optional;
++import org.apache.tuweni.bytes.Bytes;
++import org.hyperledger.besu.consensus.common.bft.ConsensusRoundIdentifier;
++import org.hyperledger.besu.consensus.common.bft.FalconSeal;
++import org.hyperledger.besu.consensus.common.bft.PqSealCache;
++import org.hyperledger.besu.consensus.common.bft.RoundTimer;
++import org.hyperledger.besu.consensus.common.bft.SchemeSeal;
++import org.hyperledger.besu.consensus.qbft.core.network.QbftMessageTransmitter;
++import org.hyperledger.besu.consensus.qbft.core.payload.MessageFactory;
++import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockCreator;
++import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockHeader;
++import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockInterface;
++import org.hyperledger.besu.consensus.qbft.core.types.QbftMinedBlockObserver;
++import org.hyperledger.besu.consensus.qbft.core.types.QbftProtocolSchedule;
++import org.hyperledger.besu.consensus.qbft.core.validation.MessageValidator;
++import org.hyperledger.besu.consensus.qbft.core.validation.QbftBlockHeaderTestFixture;
++import org.hyperledger.besu.cryptoservices.NodeKey;
++import org.hyperledger.besu.cryptoservices.NodeKeyUtils;
++import org.hyperledger.besu.datatypes.Address;
++import org.hyperledger.besu.datatypes.Hash;
++import org.hyperledger.besu.util.Subscribers;
++import org.junit.jupiter.api.AfterEach;
++import org.junit.jupiter.api.BeforeEach;
++import org.junit.jupiter.api.Test;
++import org.junit.jupiter.api.extension.ExtendWith;
++import org.mockito.Mock;
++import org.mockito.junit.jupiter.MockitoExtension;
++import org.mockito.junit.jupiter.MockitoSettings;
++import org.mockito.quality.Strictness;
++
++/**
++ * D-339 (2026-09-04): a Commit teaches this node the seals of its block even when this node holds NO
++ * proposal for that round.
++ *
++ * 
        The measured defect, on chain 2800 the same evening: anchor proposers kept refusing with "this
++ * node holds 1 valid eligible Falcon seal ... 0 rejected" - they were not rejecting seals, they had
++ * never heard them. The cache was fed only from a round that held the proposed block, so a node that
++ * missed the proposal of the parent's round collected the Commits and dropped their seals; it then
++ * could not build the next anchor's certificate, the round expired, and every 32nd height paid the
++ * round-change timeout (eleven of twelve anchors before this fix).
++ *
++ * 
        What is pinned here: with no proposal in the round, a Commit's Falcon seal AND its hybrid extra
++ * seals land in the cache under the digest the Commit names; and the negative control, a Commit
++ * carrying no seals, leaves the cache empty.
++ */
++@ExtendWith(MockitoExtension.class)
++@MockitoSettings(strictness = Strictness.LENIENT)
++public class PqSealsWithoutProposalTest {
++
++  private final NodeKey nodeKey = NodeKeyUtils.generate();
++  private final Address localAddress = Address.extract(nodeKey.getPublicKey());
++  private final NodeKey peerKey = NodeKeyUtils.generate();
++  private final ConsensusRoundIdentifier roundIdentifier = new ConsensusRoundIdentifier(7, 0);
++  private final Subscribers subscribers = Subscribers.create();
++  private final Hash digest = Hash.hash(Bytes.fromHexString("0xdeadbeef"));
++  private final FalconSeal falcon = new FalconSeal(4, Bytes.fromHexString("0x29aabbcc"));
++  private final SchemeSeal slh = new SchemeSeal((byte) 0x02, 4, Bytes.fromHexString("0x0102030405"));
++
++  private MessageFactory localFactory;
++  private MessageFactory peerFactory;
++
++  @Mock private org.hyperledger.besu.consensus.qbft.core.types.QbftBlockCodec blockEncoder;
++
++  @Mock private QbftProtocolSchedule protocolSchedule;
++  @Mock private QbftMessageTransmitter transmitter;
++  @Mock private MessageValidator messageValidator;
++  @Mock private RoundTimer roundTimer;
++  @Mock private QbftBlockCreator blockCreator;
++  @Mock private QbftBlockInterface blockInterface;
++
++  private final QbftBlockHeader parentHeader =
++      new QbftBlockHeaderTestFixture().number(6).buildHeader();
++
++  @BeforeEach
++  public void setup() {
++    PqSealCache.instance().clear();
++    localFactory = new MessageFactory(nodeKey, blockEncoder);
++    peerFactory = new MessageFactory(peerKey, blockEncoder);
++    when(messageValidator.validateCommit(org.mockito.ArgumentMatchers.any())).thenReturn(true);
++  }
++
++  @AfterEach
++  public void clean() {
++    PqSealCache.instance().clear();
++  }
++
++  private QbftRound roundWithoutProposal() {
++    final RoundState roundState = new RoundState(roundIdentifier, 3, messageValidator);
++    assertThat(roundState.getProposedBlock()).isEmpty();
++    return new QbftRound(
++        roundState,
++        blockCreator,
++        blockInterface,
++        protocolSchedule,
++        subscribers,
++        nodeKey,
++        localAddress,
++        localFactory,
++        transmitter,
++        roundTimer,
++        parentHeader);
++  }
++
++  @Test
++  public void aCommitWithoutAProposalStillTeachesItsSeals() {
++    final QbftRound round = roundWithoutProposal();
++    round.handleCommitMessage(
++        peerFactory.createCommit(
++            roundIdentifier,
++            digest,
++            peerKey.sign(org.apache.tuweni.bytes.Bytes32.ZERO),
++            Optional.of(falcon),
++            List.of(slh)));
++
++    assertThat(PqSealCache.instance().sealsFor(roundIdentifier.getSequenceNumber(), digest))
++        .containsExactly(falcon);
++    assertThat(PqSealCache.instance().extrasFor(roundIdentifier.getSequenceNumber(), digest))
++        .containsExactly(slh);
++  }
++
++  @Test
++  public void aCommitWithoutSealsLeavesTheCacheEmpty() {
++    // the negative control: the path must not write an entry just because a Commit arrived
++    final QbftRound round = roundWithoutProposal();
++    round.handleCommitMessage(
++        peerFactory.createCommit(roundIdentifier, digest, peerKey.sign(org.apache.tuweni.bytes.Bytes32.ZERO)));
++
++    assertThat(PqSealCache.instance().sealsFor(roundIdentifier.getSequenceNumber(), digest))
++        .isEmpty();
++    assertThat(PqSealCache.instance().extrasFor(roundIdentifier.getSequenceNumber(), digest))
++        .isEmpty();
++    assertThat(PqSealCache.instance().entryCount()).isZero();
++  }
++
++  @Test
++  public void sealsLandUnderTheDigestTheCommitNames() {
++    // a seal must never be filed under some other block's hash: the producer looks up by the
++    // parent's on-chain hash, and a mis-filed seal would be an invisible way to poison a lookup
++    final QbftRound round = roundWithoutProposal();
++    round.handleCommitMessage(
++        peerFactory.createCommit(
++            roundIdentifier, digest, peerKey.sign(org.apache.tuweni.bytes.Bytes32.ZERO), Optional.of(falcon), List.of(slh)));
++
++    final Hash altul = Hash.hash(Bytes.fromHexString("0xfeedface"));
++    assertThat(PqSealCache.instance().sealsFor(roundIdentifier.getSequenceNumber(), altul)).isEmpty();
++  }
++}
+diff --git a/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/CommitValidatorAnchorFormTest.java b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/CommitValidatorAnchorFormTest.java
+new file mode 100755
+index 000000000..4d055a04f
+--- /dev/null
++++ b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/CommitValidatorAnchorFormTest.java
+@@ -0,0 +1,216 @@
++/*
++ * Copyright contributors to the Aere Network.
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
++ * compliance with the License. You may obtain a copy of the License at
++ *
++ * http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software distributed under the License is
++ * distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
++ * implied. See the License for the specific language governing permissions and limitations under the
++ * License.
++ *
++ * SPDX-License-Identifier: Apache-2.0
++ */
++package org.hyperledger.besu.consensus.qbft.core.validation;
++
++import static org.assertj.core.api.Assertions.assertThat;
++
++import org.hyperledger.besu.consensus.common.bft.ConsensusRoundIdentifier;
++import org.hyperledger.besu.consensus.common.bft.FalconSeal;
++import org.hyperledger.besu.consensus.common.bft.PqAnchorConfig;
++import org.hyperledger.besu.consensus.common.bft.PqSignerRegistry;
++import org.hyperledger.besu.consensus.common.bft.SealScheme;
++import org.hyperledger.besu.consensus.common.bft.SealSchemes;
++import org.hyperledger.besu.consensus.common.bft.blockcreation.PqAnchorProducer;
++import org.hyperledger.besu.consensus.qbft.core.messagewrappers.Commit;
++import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockCodec;
++import org.hyperledger.besu.crypto.SECPSignature;
++import org.hyperledger.besu.crypto.SecureRandomProvider;
++import org.hyperledger.besu.datatypes.Address;
++import org.hyperledger.besu.datatypes.Hash;
++
++import java.security.SecureRandom;
++import java.util.HashMap;
++import java.util.Map;
++import java.util.Optional;
++import java.util.OptionalInt;
++
++import org.apache.tuweni.bytes.Bytes;
++import org.apache.tuweni.bytes.Bytes32;
++import org.junit.jupiter.api.AfterEach;
++import org.junit.jupiter.api.BeforeEach;
++import org.junit.jupiter.api.Test;
++import org.junit.jupiter.api.extension.ExtendWith;
++import org.mockito.Mock;
++import org.mockito.junit.jupiter.MockitoExtension;
++
++/**
++ * AERE D-311 (2026-09-02). Found by the public testnet 28001 on its first day, with the options of
++ * fleet 2800: at {@code aere.pq.commitPq.forkBlock} every validator refused every commit ("post-quantum
++ * seal of index i does NOT verify over the commit digest") and the chain stopped. The emitter signs
++ * the ANCHOR form of the commit message as soon as the anchor is armed (on 2800 since 13,014,000);
++ * the verifier checked the ECDSA committed-seal digest. Two copies of one rule, and they drifted. The
++ * F95 rehearsal could not see it: its kit runs without the anchor armed.
++ *
++ * 
        What this proves, with real Falcon-512 signatures and nothing mocked on the cryptographic path:
++ *
++ * 
          
++ *   
        • anchor armed: a seal made exactly as the emitter makes it (over {@code
++ *       PqAnchorProducer.commitSealMessage}) COUNTS through the production message;
++ *   
        • CONTROL NEGATIV: the SAME seal fed to a validator that still verifies over the commit digest
++ *       (the pre-D-311 behaviour, kept by the upstream-shaped constructors) is REFUZAT. This is the
++ *       bug itself, reproduced; if this test ever goes green the fix has been undone somewhere else;
++ *   
        • anchor armed, an emitter that kept signing the digest is REFUZAT by the fixed verifier;
++ *   
        • anchor never armed: the message IS the commit digest, so old and new verifiers agree.
++ * 
        
++ */
++@ExtendWith(MockitoExtension.class)
++public class CommitValidatorAnchorFormTest {
++  private static final int VALIDATOR_COUNT = 3;
++  private static final long CHAIN_ID = 28001L;
++  private static final long HEIGHT = 5_000L;
++  private final ConsensusRoundIdentifier round = new ConsensusRoundIdentifier(HEIGHT, 0);
++  /** The ECDSA committed-seal digest (round-specific). */
++  private final Hash commitDigest = Hash.fromHexStringLenient("0x1");
++  /** The round-independent on-chain hash of the same block (round forced to 0). */
++  private final Hash onchainHash = Hash.fromHexStringLenient("0x2");
++  private QbftNodeList validators;
++  private @Mock QbftBlockCodec qbftBlockCodec;
++  private final SecureRandom random = SecureRandomProvider.createSecureRandom();
++  private final Map bindings = new HashMap<>();
++  private final Map cheiPublice = new HashMap<>();
++  private final Map cheiPrivate = new HashMap<>();
++
++  private final PqSignerRegistry registry =
++      new PqSignerRegistry() {
++        @Override
++        public Address addressForIndexAtHistoric(final long blockNumber, final int validatorIndex) {
++          return bindings.get(validatorIndex);
++        }
++
++        @Override
++        public Address addressForIndexAtOwnHead(final long blockNumber, final int validatorIndex) {
++          return bindings.get(validatorIndex);
++        }
++
++        @Override
++        public boolean verifyAtHistoric(
++            final long blockNumber,
++            final int validatorIndex,
++            final Bytes message,
++            final Bytes signature) {
++          return verifyAtOwnHead(blockNumber, validatorIndex, message, signature);
++        }
++
++        @Override
++        public boolean verifyAtOwnHead(
++            final long blockNumber,
++            final int validatorIndex,
++            final Bytes message,
++            final Bytes signature) {
++          final byte[] pk = cheiPublice.get(validatorIndex);
++          return pk != null
++              && SealSchemes.FALCON_512.verifyRaw(pk, message.toArray(), signature.toArray());
++        }
++      };
++
++  @BeforeEach
++  public void setup() {
++    validators = QbftNodeList.createNodes(VALIDATOR_COUNT, qbftBlockCodec);
++    for (int i = 0; i < VALIDATOR_COUNT; i++) {
++      final SealScheme.GeneratedPair pereche = SealSchemes.FALCON_512.generate(random);
++      bindings.put(i, validators.getNode(i).getAddress());
++      cheiPublice.put(i, pereche.publicRegistryForm());
++      cheiPrivate.put(i, pereche.privateKey());
++    }
++  }
++
++  @AfterEach
++  public void forgetAnchorConfig() {
++    PqAnchorProducer.useConfigForTesting(null);
++  }
++
++  private void armAnchorAt(final long anchorBlock) {
++    PqAnchorProducer.useConfigForTesting(
++        new PqAnchorConfig(
++            CHAIN_ID, anchorBlock, Map.of(anchorBlock, 0), OptionalInt.empty(), false));
++  }
++
++  /** Exactly what the emitter (QbftRound.pqSealMessageFor) signs at HEIGHT. */
++  private Bytes32 emitterMessage() {
++    return PqAnchorProducer.commitSealMessage(HEIGHT, onchainHash.getBytes(), commitDigest);
++  }
++
++  /** The fixed production shape: the verifier is handed the same message the emitter signs. */
++  private CommitValidator verificatorReparat(final Bytes32 expectedPqSealMessage) {
++    return new CommitValidator(
++        validators.getNodeAddresses(),
++        round,
++        commitDigest,
++        commitDigest,
++        Hash.wrap(expectedPqSealMessage),
++        new PqCommitEnforcement(HEIGHT, registry));
++  }
++
++  /** The pre-D-311 shape: enforcement verifies over the commit digest, whatever the emitter signed. */
++  private CommitValidator verificatorVechi() {
++    return new CommitValidator(
++        validators.getNodeAddresses(),
++        round,
++        commitDigest,
++        commitDigest,
++        new PqCommitEnforcement(HEIGHT, registry));
++  }
++
++  private Commit commitSealedOver(final int nod, final Bytes32 message) {
++    final SECPSignature ecdsa =
++        validators.getNode(nod).getNodeKey().sign(Bytes32.wrap(commitDigest.getBytes()));
++    final byte[] sig =
++        SealSchemes.FALCON_512.sign(cheiPrivate.get(nod), message.toArray()).orElseThrow();
++    return validators
++        .getMessageFactory(nod)
++        .createCommit(round, commitDigest, ecdsa, Optional.of(new FalconSeal(nod, Bytes.wrap(sig))));
++  }
++
++  @Test
++  public void anchorArmedTheMessageIsTheAnchorFormNotTheDigest() {
++    armAnchorAt(HEIGHT);
++    assertThat(PqAnchorProducer.sealMessageIsAnchorForm(HEIGHT)).isTrue();
++    assertThat(emitterMessage()).isNotEqualTo(Bytes32.wrap(commitDigest.getBytes()));
++  }
++
++  @Test
++  public void anchorArmedSealMadeLikeTheEmitterCountsThroughTheFixedVerifier() {
++    armAnchorAt(HEIGHT);
++    final Bytes32 message = emitterMessage();
++    assertThat(verificatorReparat(message).validate(commitSealedOver(0, message))).isTrue();
++  }
++
++  @Test
++  public void controlNegativTheOldVerifierRefusesTheVerySameSeal() {
++    // This is D-311 itself: the seal the emitter really produces, judged over the commit digest.
++    // On the testnet this line was the whole chain stopping at the fork height.
++    armAnchorAt(HEIGHT);
++    final Bytes32 message = emitterMessage();
++    assertThat(verificatorVechi().validate(commitSealedOver(0, message))).isFalse();
++  }
++
++  @Test
++  public void anchorArmedAnEmitterStillSigningTheDigestIsRefused() {
++    armAnchorAt(HEIGHT);
++    final Bytes32 sealedOverDigest = Bytes32.wrap(commitDigest.getBytes());
++    assertThat(verificatorReparat(emitterMessage()).validate(commitSealedOver(1, sealedOverDigest)))
++        .isFalse();
++  }
++
++  @Test
++  public void anchorNeverArmedTheMessageIsTheDigestAndBothVerifiersAgree() {
++    PqAnchorProducer.useConfigForTesting(PqAnchorConfig.never(CHAIN_ID));
++    final Bytes32 message = emitterMessage();
++    assertThat(message).isEqualTo(Bytes32.wrap(commitDigest.getBytes()));
++    assertThat(verificatorReparat(message).validate(commitSealedOver(2, message))).isTrue();
++    assertThat(verificatorVechi().validate(commitSealedOver(2, message))).isTrue();
++  }
++}
+diff --git a/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/CommitValidatorPqEnforcementTest.java b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/CommitValidatorPqEnforcementTest.java
+new file mode 100755
+index 000000000..b3269194f
+--- /dev/null
++++ b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/CommitValidatorPqEnforcementTest.java
+@@ -0,0 +1,152 @@
++/* AERE full-PQ, the WIRING step: enforcement bound into CommitValidator itself.
++ *
++ * What each case proves:
++ *  - disarmed (the old constructor) = upstream behaviour, untouched -- the baseline control;
++ *  - armed + commit WITHOUT a PQ seal = the vote does NOT count;
++ *  - armed + a REAL Falcon seal over the commit digest = the vote counts;
++ *  - armed + another validator's seal (index bound to another address) = refused;
++ *  - armed + the same message below the arming height = passes (the gate is the height itself).
++ *
++ * Mesajele sunt semnate ECDSA cu uneltele de amonte (QbftNodeList/MessageFactory), sigiliile
++ * sunt Falcon-512 REAL prin stratul de scheme; nimic mockuit pe drumul criptografic. */
++package org.hyperledger.besu.consensus.qbft.core.validation;
++
++import static org.assertj.core.api.Assertions.assertThat;
++
++import org.hyperledger.besu.consensus.common.bft.ConsensusRoundIdentifier;
++import org.hyperledger.besu.consensus.common.bft.FalconSeal;
++import org.hyperledger.besu.consensus.common.bft.PqSignerRegistry;
++import org.hyperledger.besu.consensus.common.bft.SealScheme;
++import org.hyperledger.besu.consensus.common.bft.SealSchemes;
++import org.hyperledger.besu.consensus.qbft.core.messagewrappers.Commit;
++import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockCodec;
++import org.hyperledger.besu.crypto.SECPSignature;
++import org.hyperledger.besu.crypto.SecureRandomProvider;
++import org.hyperledger.besu.datatypes.Address;
++import org.hyperledger.besu.datatypes.Hash;
++
++import java.security.SecureRandom;
++import java.util.HashMap;
++import java.util.Map;
++import java.util.Optional;
++
++import org.apache.tuweni.bytes.Bytes;
++import org.apache.tuweni.bytes.Bytes32;
++import org.junit.jupiter.api.BeforeEach;
++import org.junit.jupiter.api.Test;
++import org.junit.jupiter.api.extension.ExtendWith;
++import org.mockito.Mock;
++import org.mockito.junit.jupiter.MockitoExtension;
++
++@ExtendWith(MockitoExtension.class)
++public class CommitValidatorPqEnforcementTest {
++
++  private static final int VALIDATOR_COUNT = 3;
++  private static final long HEIGHT = 5_000L;
++
++  private final ConsensusRoundIdentifier round = new ConsensusRoundIdentifier(HEIGHT, 0);
++  private final Hash expectedHash = Hash.fromHexStringLenient("0x1");
++  private QbftNodeList validators;
++  private @Mock QbftBlockCodec qbftBlockCodec;
++
++  private final SecureRandom random = SecureRandomProvider.createSecureRandom();
++  private final Map bindings = new HashMap<>();
++  private final Map cheiPublice = new HashMap<>();
++  private final Map cheiPrivate = new HashMap<>();
++
++  /** Registru de test cu legaturi index->adresa si verificare prin schema REALA. */
++  private final PqSignerRegistry registry =
++      new PqSignerRegistry() {
++        @Override
++        public Address addressForIndexAtHistoric(final long blockNumber, final int validatorIndex) {
++          return bindings.get(validatorIndex);
++        }
++
++        @Override
++        public Address addressForIndexAtOwnHead(final long blockNumber, final int validatorIndex) {
++          return bindings.get(validatorIndex);
++        }
++
++        @Override
++        public boolean verifyAtHistoric(
++            final long blockNumber, final int validatorIndex, final Bytes message, final Bytes signature) {
++          return verifyAtOwnHead(blockNumber, validatorIndex, message, signature);
++        }
++
++        @Override
++        public boolean verifyAtOwnHead(
++            final long blockNumber, final int validatorIndex, final Bytes message, final Bytes signature) {
++          final byte[] pk = cheiPublice.get(validatorIndex);
++          return pk != null
++              && SealSchemes.FALCON_512.verifyRaw(pk, message.toArray(), signature.toArray());
++        }
++      };
++
++  @BeforeEach
++  public void setup() {
++    validators = QbftNodeList.createNodes(VALIDATOR_COUNT, qbftBlockCodec);
++    for (int i = 0; i < VALIDATOR_COUNT; i++) {
++      final SealScheme.GeneratedPair pereche = SealSchemes.FALCON_512.generate(random);
++      bindings.put(i, validators.getNode(i).getAddress());
++      cheiPublice.put(i, pereche.publicRegistryForm());
++      cheiPrivate.put(i, pereche.privateKey());
++    }
++  }
++
++  private CommitValidator armat(final long armedFrom) {
++    return new CommitValidator(
++        validators.getNodeAddresses(),
++        round,
++        expectedHash,
++        expectedHash,
++        new PqCommitEnforcement(armedFrom, registry));
++  }
++
++  private Commit commitWithoutSeal(final int nod) {
++    final SECPSignature ecdsa =
++        validators.getNode(nod).getNodeKey().sign(Bytes32.wrap(expectedHash.getBytes()));
++    return validators.getMessageFactory(nod).createCommit(round, expectedHash, ecdsa);
++  }
++
++  private Commit commitWithSeal(final int nodEcdsa, final int indexFalcon) {
++    final SECPSignature ecdsa =
++        validators.getNode(nodEcdsa).getNodeKey().sign(Bytes32.wrap(expectedHash.getBytes()));
++    final byte[] sig =
++        SealSchemes.FALCON_512
++            .sign(cheiPrivate.get(indexFalcon), expectedHash.getBytes().toArray())
++            .orElseThrow();
++    return validators
++        .getMessageFactory(nodEcdsa)
++        .createCommit(round, expectedHash, ecdsa, Optional.of(new FalconSeal(indexFalcon, Bytes.wrap(sig))));
++  }
++
++  @Test
++  public void disarmedOldConstructorIsUpstreamBehaviour() {
++    final CommitValidator old =
++        new CommitValidator(validators.getNodeAddresses(), round, expectedHash, expectedHash);
++    assertThat(old.validate(commitWithoutSeal(0))).isTrue();
++  }
++
++  @Test
++  public void armedRejectsCommitWithoutPqSeal() {
++    assertThat(armat(HEIGHT).validate(commitWithoutSeal(0))).isFalse();
++  }
++
++  @Test
++  public void armedAcceptsCommitWithRealPqSeal() {
++    for (int i = 0; i < VALIDATOR_COUNT; i++) {
++      assertThat(armat(HEIGHT).validate(commitWithSeal(i, i))).isTrue();
++    }
++  }
++
++  @Test
++  public void armedRejectsSealOfAnotherValidator() {
++    // node 0's ECDSA message, index 1's Falcon seal: the author binding fails
++    assertThat(armat(HEIGHT).validate(commitWithSeal(0, 1))).isFalse();
++  }
++
++  @Test
++  public void belowArmingHeightSealIsNotRequired() {
++    assertThat(armat(HEIGHT + 1).validate(commitWithoutSeal(0))).isTrue();
++  }
++}
+diff --git a/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/MessageValidatorAnchorFormPlumbingTest.java b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/MessageValidatorAnchorFormPlumbingTest.java
+new file mode 100755
+index 000000000..a5a78d58e
+--- /dev/null
++++ b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/MessageValidatorAnchorFormPlumbingTest.java
+@@ -0,0 +1,109 @@
++/*
++ * Copyright contributors to the Aere Network.
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
++ * compliance with the License. You may obtain a copy of the License at
++ *
++ * http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software distributed under the License is
++ * distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
++ * implied. See the License for the specific language governing permissions and limitations under the
++ * License.
++ *
++ * SPDX-License-Identifier: Apache-2.0
++ */
++package org.hyperledger.besu.consensus.qbft.core.validation;
++
++import static org.assertj.core.api.Assertions.assertThat;
++import static org.mockito.ArgumentMatchers.any;
++import static org.mockito.ArgumentMatchers.eq;
++import static org.mockito.Mockito.never;
++import static org.mockito.Mockito.verify;
++import static org.mockito.Mockito.when;
++
++import org.hyperledger.besu.consensus.common.bft.ConsensusRoundIdentifier;
++import org.hyperledger.besu.consensus.common.bft.PqAnchor;
++import org.hyperledger.besu.consensus.common.bft.PqAnchorConfig;
++import org.hyperledger.besu.consensus.common.bft.blockcreation.PqAnchorProducer;
++import org.hyperledger.besu.consensus.qbft.core.types.QbftBlock;
++import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockInterface;
++import org.hyperledger.besu.datatypes.Address;
++import org.hyperledger.besu.datatypes.Hash;
++
++import java.util.List;
++import java.util.Map;
++import java.util.OptionalInt;
++
++import org.junit.jupiter.api.AfterEach;
++import org.junit.jupiter.api.BeforeEach;
++import org.junit.jupiter.api.Test;
++import org.junit.jupiter.api.extension.ExtendWith;
++import org.mockito.Mock;
++import org.mockito.junit.jupiter.MockitoExtension;
++
++/**
++ * AERE D-311, the PRODUCTION wiring. {@link CommitValidatorAnchorFormTest} proves the verifier accepts
++ * the emitter's seal when it is handed the emitter's message; this proves that {@link
++ * MessageValidator.SubsequentMessageValidator}, the only production caller, hands it exactly that
++ * message: the anchor form over the ROUND-INDEPENDENT on-chain hash (round forced to 0) once the
++ * anchor is armed, and the plain committed-seal digest before, computed through the one shared helper
++ * and touching the block interface for round 0 only when the anchor form needs it.
++ */
++@ExtendWith(MockitoExtension.class)
++public class MessageValidatorAnchorFormPlumbingTest {
++  private static final long CHAIN_ID = 28001L;
++  private static final long HEIGHT = 7_000L;
++  private static final int ROUND = 2;
++  private final ConsensusRoundIdentifier round = new ConsensusRoundIdentifier(HEIGHT, ROUND);
++  private final Hash proposalHash = Hash.fromHexStringLenient("0x11");
++  private final Hash commitHash = Hash.fromHexStringLenient("0x22");
++  private final Hash onchainHash = Hash.fromHexStringLenient("0x33");
++
++  private @Mock QbftBlockInterface blockInterface;
++  private @Mock QbftBlock proposalBlock;
++  private @Mock QbftBlock commitBlock;
++  private @Mock QbftBlock roundZeroBlock;
++
++  @BeforeEach
++  public void setup() {
++    when(proposalBlock.getHash()).thenReturn(proposalHash);
++    when(blockInterface.replaceRoundForCommitBlock(proposalBlock, ROUND)).thenReturn(commitBlock);
++    when(commitBlock.getHash()).thenReturn(commitHash);
++  }
++
++  @AfterEach
++  public void forgetAnchorConfig() {
++    PqAnchorProducer.useConfigForTesting(null);
++  }
++
++  private MessageValidator.SubsequentMessageValidator build() {
++    return new MessageValidator.SubsequentMessageValidator(
++        List.of(Address.fromHexString("0x1")), round, proposalBlock, blockInterface);
++  }
++
++  @Test
++  public void anchorArmedTheVerifierIsHandedTheAnchorFormOverTheRoundZeroHash() {
++    PqAnchorProducer.useConfigForTesting(
++        new PqAnchorConfig(CHAIN_ID, HEIGHT, Map.of(HEIGHT, 0), OptionalInt.empty(), false));
++    when(blockInterface.replaceRoundForCommitBlock(proposalBlock, 0)).thenReturn(roundZeroBlock);
++    when(roundZeroBlock.getHash()).thenReturn(onchainHash);
++
++    final Hash handed = build().commitValidatorForTesting().expectedPqSealMessageForTesting();
++
++    assertThat(handed)
++        .isEqualTo(Hash.wrap(PqAnchor.commitMessage(CHAIN_ID, HEIGHT, onchainHash.getBytes())));
++    assertThat(handed).isNotEqualTo(commitHash);
++    verify(blockInterface).replaceRoundForCommitBlock(proposalBlock, 0);
++  }
++
++  @Test
++  public void anchorNeverArmedTheVerifierIsHandedTheCommitDigestAndRoundZeroIsNeverAsked() {
++    PqAnchorProducer.useConfigForTesting(PqAnchorConfig.never(CHAIN_ID));
++
++    final Hash handed = build().commitValidatorForTesting().expectedPqSealMessageForTesting();
++
++    assertThat(handed).isEqualTo(commitHash);
++    verify(blockInterface, never()).replaceRoundForCommitBlock(any(), eq(0));
++  }
++}
+diff --git a/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqCommitEnforcementTest.java b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqCommitEnforcementTest.java
+new file mode 100755
+index 000000000..8124b0c1f
+--- /dev/null
++++ b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqCommitEnforcementTest.java
+@@ -0,0 +1,159 @@
++/* AERE full-PQ, step 1, the core's proofs. The key case is integration with REAL
++ * cryptography: a true Falcon seal over the commit digest passes, one with a flipped bit
++ * does not, and a seal bound to a DIFFERENT author cannot vouch for anyone else's vote.
++ * The registry is a test double implementing the whole interface (the compiler is the
++ * control: without a height no answer is possible -- the D2 inheritance). */
++package org.hyperledger.besu.consensus.qbft.core.validation;
++
++import static org.assertj.core.api.Assertions.assertThat;
++
++import java.security.SecureRandom;
++import java.util.Map;
++import java.util.Optional;
++
++import org.apache.tuweni.bytes.Bytes;
++import org.hyperledger.besu.consensus.common.bft.FalconSeal;
++import org.hyperledger.besu.consensus.common.bft.PqSignerRegistry;
++import org.hyperledger.besu.consensus.common.bft.SealScheme;
++import org.hyperledger.besu.consensus.common.bft.SealSchemes;
++import org.hyperledger.besu.crypto.SecureRandomProvider;
++import org.hyperledger.besu.datatypes.Address;
++import org.hyperledger.besu.datatypes.Hash;
++import org.junit.jupiter.api.Test;
++
++class PqCommitEnforcementTest {
++
++  private static final long H_ARMARE = 1_000_000L;
++  private static final Address VALIDATOR_0 = Address.fromHexString("0x" + "aa".repeat(20));
++  private static final Address VALIDATOR_1 = Address.fromHexString("0x" + "bb".repeat(20));
++  private static final Hash DIGEST = Hash.hash(Bytes.of(7, 7, 7));
++
++  private final SecureRandom random = SecureRandomProvider.createSecureRandom();
++
++  /** Registru de test: legaturi index->adresa programate + verificare prin schema REALA. */
++  private static final class RegistruDeTest implements PqSignerRegistry {
++    final Map bindings;
++    final Map keys;
++
++    RegistruDeTest(final Map bindings, final Map keys) {
++      this.bindings = bindings;
++      this.keys = keys;
++    }
++
++    @Override
++    public Address addressForIndexAtHistoric(final long blockNumber, final int validatorIndex) {
++      return bindings.get(validatorIndex);
++    }
++
++    @Override
++    public Address addressForIndexAtOwnHead(final long blockNumber, final int validatorIndex) {
++      return bindings.get(validatorIndex);
++    }
++
++    @Override
++    public boolean verifyAtHistoric(
++        final long blockNumber, final int validatorIndex, final Bytes message, final Bytes signature) {
++      return verifyAtOwnHead(blockNumber, validatorIndex, message, signature);
++    }
++
++    @Override
++    public boolean verifyAtOwnHead(
++        final long blockNumber, final int validatorIndex, final Bytes message, final Bytes signature) {
++      final byte[] pk = keys.get(validatorIndex);
++      if (pk == null) {
++        return false;
++      }
++      return SealSchemes.FALCON_512.verifyRaw(pk, message.toArray(), signature.toArray());
++    }
++  }
++
++  private record World(PqCommitEnforcement enforcement, FalconSeal sigiliuValid0) {}
++
++  /** O lume cu 2 validatori cu chei Falcon reale; sigiliul validatorului 0 peste DIGEST. */
++  private World world() {
++    final SealScheme.GeneratedPair k0 = SealSchemes.FALCON_512.generate(random);
++    final SealScheme.GeneratedPair k1 = SealSchemes.FALCON_512.generate(random);
++    final byte[] sig0 = SealSchemes.FALCON_512.sign(k0.privateKey(), DIGEST.getBytes().toArray()).orElseThrow();
++    final RegistruDeTest reg =
++        new RegistruDeTest(
++            Map.of(0, VALIDATOR_0, 1, VALIDATOR_1),
++            Map.of(0, k0.publicRegistryForm(), 1, k1.publicRegistryForm()));
++    return new World(new PqCommitEnforcement(H_ARMARE, reg), new FalconSeal(0, Bytes.wrap(sig0)));
++  }
++
++  // ------------------------------------------------------------------ sub si la granita
++
++  @Test
++  void belowArmingHeightEverythingCountsEvenWithoutSeal() {
++    final World l = world();
++    assertThat(l.enforcement().refusal(H_ARMARE - 1, VALIDATOR_0, DIGEST, Optional.empty())).isEmpty();
++    assertThat(l.enforcement().armedAt(H_ARMARE - 1)).isFalse();
++  }
++
++  @Test
++  void disarmedNeverEnforces() {
++    final World l = world();
++    final PqCommitEnforcement dezarmat =
++        new PqCommitEnforcement(PqCommitEnforcement.DISARMED, new RegistruDeTest(Map.of(), Map.of()));
++    assertThat(dezarmat.refusal(Long.MAX_VALUE - 1, VALIDATOR_0, DIGEST, Optional.empty())).isEmpty();
++    assertThat(l).isNotNull();
++  }
++
++  @Test
++  void atTheExactArmingHeightEnforcementBites() {
++    final World l = world();
++    final Optional refusal = l.enforcement().refusal(H_ARMARE, VALIDATOR_0, DIGEST, Optional.empty());
++    assertThat(refusal).isPresent();
++    assertThat(refusal.get()).contains("NO post-quantum seal").contains(String.valueOf(H_ARMARE));
++  }
++
++  // ------------------------------------------------------------------ drumul fericit + negative
++
++  @Test
++  void validRealSealCounts() {
++    final World l = world();
++    assertThat(l.enforcement().refusal(H_ARMARE, VALIDATOR_0, DIGEST, Optional.of(l.sigiliuValid0())))
++        .isEmpty();
++  }
++
++  @Test
++  void sealBoundToAnotherAuthorCannotVouch() {
++    final World l = world();
++    // sigiliul indexului 0 (legat de VALIDATOR_0) pe un mesaj SEMNAT de VALIDATOR_1
++    final Optional refusal =
++        l.enforcement().refusal(H_ARMARE, VALIDATOR_1, DIGEST, Optional.of(l.sigiliuValid0()));
++    assertThat(refusal).isPresent();
++    assertThat(refusal.get()).contains("someone else");
++  }
++
++  @Test
++  void corruptedSignatureIsRefusedWithTheIndexNamed() {
++    final World l = world();
++    final byte[] stricat = l.sigiliuValid0().getSignature().toArray().clone();
++    stricat[stricat.length / 2] ^= 0x01;
++    final Optional refusal =
++        l.enforcement()
++            .refusal(H_ARMARE, VALIDATOR_0, DIGEST, Optional.of(new FalconSeal(0, Bytes.wrap(stricat))));
++    assertThat(refusal).isPresent();
++    assertThat(refusal.get()).contains("does NOT verify").contains("index 0");
++  }
++
++  @Test
++  void unknownIndexIsRefusedNotTrusted() {
++    final World l = world();
++    final Optional refusal =
++        l.enforcement()
++            .refusal(H_ARMARE, VALIDATOR_0, DIGEST, Optional.of(new FalconSeal(7, l.sigiliuValid0().getSignature())));
++    assertThat(refusal).isPresent(); // a missing binding (null) is never "fine"
++  }
++
++  @Test
++  void sealOverADifferentDigestDoesNotCount() {
++    final World l = world();
++    final Hash altDigest = Hash.hash(Bytes.of(9, 9, 9));
++    final Optional refusal =
++        l.enforcement().refusal(H_ARMARE, VALIDATOR_0, altDigest, Optional.of(l.sigiliuValid0()));
++    assertThat(refusal).isPresent();
++    assertThat(refusal.get()).contains("does NOT verify");
++  }
++}
+diff --git a/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqCommitPlumbingTest.java b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqCommitPlumbingTest.java
+new file mode 100755
+index 000000000..c697e69dc
+--- /dev/null
++++ b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqCommitPlumbingTest.java
+@@ -0,0 +1,108 @@
++/* AERE full-PQ, the PLUMBING: CommitValidator's production constructor (the 4-argument one,
++ * the only one MessageValidator calls) self-installs from the system property. The
++ * differential is the proof itself: same message, same constructor, the only difference is
++ * the property -- disarmed passes, armed below the height passes, armed at the height
++ * refuses. And the loud refusal: a broken value throws AERE-PQC-COMMIT-CONF-01 at
++ * construction, because a mistyped comma must not silently boot the node disarmed. The
++ * property is cleaned in finally so it cannot poison other classes in the same JVM (the
++ * order-dependent-green lesson). */
++package org.hyperledger.besu.consensus.qbft.core.validation;
++
++import static org.assertj.core.api.Assertions.assertThat;
++import static org.assertj.core.api.Assertions.assertThatThrownBy;
++
++import org.hyperledger.besu.consensus.common.bft.ConsensusRoundIdentifier;
++import org.hyperledger.besu.consensus.qbft.core.messagewrappers.Commit;
++import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockCodec;
++import org.hyperledger.besu.crypto.SECPSignature;
++import org.hyperledger.besu.datatypes.Hash;
++
++import org.apache.tuweni.bytes.Bytes32;
++import org.junit.jupiter.api.AfterEach;
++import org.junit.jupiter.api.BeforeEach;
++import org.junit.jupiter.api.Test;
++import org.junit.jupiter.api.extension.ExtendWith;
++import org.mockito.Mock;
++import org.mockito.junit.jupiter.MockitoExtension;
++
++@ExtendWith(MockitoExtension.class)
++public class PqCommitPlumbingTest {
++
++  private static final long HEIGHT = 7_777L;
++
++  private final ConsensusRoundIdentifier round = new ConsensusRoundIdentifier(HEIGHT, 0);
++  private final Hash expectedHash = Hash.fromHexStringLenient("0x1");
++  private QbftNodeList validators;
++  private @Mock QbftBlockCodec qbftBlockCodec;
++
++  @BeforeEach
++  public void setup() {
++    validators = QbftNodeList.createNodes(3, qbftBlockCodec);
++  }
++
++  @AfterEach
++  public void curataProprietatea() {
++    System.clearProperty(PqCommitEnforcement.PROPERTY_FORK_BLOCK);
++  }
++
++  private CommitValidator validatorDeProductie() {
++    // constructorul de 4 argumente: EXACT ce cheama MessageValidator.SubsequentMessageValidator
++    return new CommitValidator(validators.getNodeAddresses(), round, expectedHash, expectedHash);
++  }
++
++  private Commit commitWithoutSeal() {
++    final SECPSignature ecdsa =
++        validators.getNode(0).getNodeKey().sign(Bytes32.wrap(expectedHash.getBytes()));
++    return validators.getMessageFactory(0).createCommit(round, expectedHash, ecdsa);
++  }
++
++  @Test
++  public void withoutThePropertyProductionConstructorIsUpstream() {
++    System.clearProperty(PqCommitEnforcement.PROPERTY_FORK_BLOCK);
++    assertThat(validatorDeProductie().validate(commitWithoutSeal())).isTrue();
++  }
++
++  @Test
++  public void withThePropertyAtHeightUnsealedCommitStopsCounting() {
++    try {
++      System.setProperty(PqCommitEnforcement.PROPERTY_FORK_BLOCK, String.valueOf(HEIGHT));
++      assertThat(validatorDeProductie().validate(commitWithoutSeal())).isFalse();
++    } finally {
++      System.clearProperty(PqCommitEnforcement.PROPERTY_FORK_BLOCK);
++    }
++  }
++
++  @Test
++  public void withThePropertyAboveHeightNothingChangesYet() {
++    try {
++      System.setProperty(PqCommitEnforcement.PROPERTY_FORK_BLOCK, String.valueOf(HEIGHT + 1));
++      assertThat(validatorDeProductie().validate(commitWithoutSeal())).isTrue();
++    } finally {
++      System.clearProperty(PqCommitEnforcement.PROPERTY_FORK_BLOCK);
++    }
++  }
++
++  @Test
++  public void brokenValueRefusesLoudlyInsteadOfDisarming() {
++    try {
++      System.setProperty(PqCommitEnforcement.PROPERTY_FORK_BLOCK, "14,050,000");
++      assertThatThrownBy(this::validatorDeProductie)
++          .isInstanceOf(IllegalStateException.class)
++          .hasMessageContaining("AERE-PQC-COMMIT-CONF-01");
++    } finally {
++      System.clearProperty(PqCommitEnforcement.PROPERTY_FORK_BLOCK);
++    }
++  }
++
++  @Test
++  public void negativeValueRefusesLoudly() {
++    try {
++      System.setProperty(PqCommitEnforcement.PROPERTY_FORK_BLOCK, "-1");
++      assertThatThrownBy(this::validatorDeProductie)
++          .isInstanceOf(IllegalStateException.class)
++          .hasMessageContaining("AERE-PQC-COMMIT-CONF-01");
++    } finally {
++      System.clearProperty(PqCommitEnforcement.PROPERTY_FORK_BLOCK);
++    }
++  }
++}
+diff --git a/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqHybridEnforcementTest.java b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqHybridEnforcementTest.java
+new file mode 100755
+index 000000000..cf8c683f0
+--- /dev/null
++++ b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqHybridEnforcementTest.java
+@@ -0,0 +1,312 @@
++/* AERE HYBRID, step 2: HYBRID CERTIFICATE enforcement at the commit quorum.
++ *
++ * Everything measured here uses REAL cryptography (Falcon-512 + SLH-DSA-128s generated on
++ * every run, TEST keys) and a REAL hybrid registry built from properties, i.e. exactly the
++ * production loading path. The validators' REAL keys are not generated here and are not
++ * generated at all without the founder's ceremony and signature.
++ *
++ * The thesis it proves: above the height where the schedule requires two families, a vote
++ * carrying only one does NOT count. A half hybrid is worth the weakest family present,
++ * so a missing scheme refuses, it does not degrade. */
++package org.hyperledger.besu.consensus.qbft.core.validation;
++
++import static org.assertj.core.api.Assertions.assertThat;
++import static org.assertj.core.api.Assertions.assertThatThrownBy;
++
++import org.hyperledger.besu.consensus.common.bft.FalconSeal;
++import org.hyperledger.besu.consensus.common.bft.HybridSignerRegistry;
++import org.hyperledger.besu.consensus.common.bft.PqSchemeSchedule;
++import org.hyperledger.besu.consensus.common.bft.PqSignerRegistry;
++import org.hyperledger.besu.consensus.common.bft.SchemeSeal;
++import org.hyperledger.besu.consensus.common.bft.SealScheme;
++import org.hyperledger.besu.consensus.common.bft.SealSchemes;
++import org.hyperledger.besu.crypto.SecureRandomProvider;
++import org.hyperledger.besu.datatypes.Address;
++import org.hyperledger.besu.datatypes.Hash;
++
++import java.security.SecureRandom;
++import java.util.List;
++import java.util.Map;
++import java.util.Optional;
++import java.util.Properties;
++
++import org.apache.tuweni.bytes.Bytes;
++import org.junit.jupiter.api.BeforeEach;
++import org.junit.jupiter.api.Test;
++
++public class PqHybridEnforcementTest {
++
++  private static final long H_ARMARE = 1_000L;
++  private static final long H_HIBRID = 2_000L;
++  private static final Address VALIDATOR_0 = Address.fromHexString("0x" + "aa".repeat(20));
++  private static final Address VALIDATOR_1 = Address.fromHexString("0x" + "bb".repeat(20));
++  private static final Hash DIGEST = Hash.hash(Bytes.of(4, 2));
++
++  private final SecureRandom random = SecureRandomProvider.createSecureRandom();
++
++  private SealScheme.GeneratedPair falcon0;
++  private SealScheme.GeneratedPair slh0;
++  private HybridSignerRegistry registry;
++  private PqSchemeSchedule orar;
++
++  /** Registrul Falcon vechi: leaga indexul 0 de VALIDATOR_0 si verifica cu schema reala. */
++  private PqSignerRegistry registruFalcon() {
++    return new PqSignerRegistry() {
++      @Override
++      public Address addressForIndexAtHistoric(final long blockNumber, final int validatorIndex) {
++        return addressForIndexAtOwnHead(blockNumber, validatorIndex);
++      }
++
++      @Override
++      public Address addressForIndexAtOwnHead(final long blockNumber, final int validatorIndex) {
++        return validatorIndex == 0 ? VALIDATOR_0 : null;
++      }
++
++      @Override
++      public boolean verifyAtHistoric(
++          final long b, final int i, final Bytes message, final Bytes signature) {
++        return verifyAtOwnHead(b, i, message, signature);
++      }
++
++      @Override
++      public boolean verifyAtOwnHead(
++          final long b, final int i, final Bytes message, final Bytes signature) {
++        return i == 0
++            && SealSchemes.FALCON_512.verifyRaw(
++                falcon0.publicRegistryForm(), message.toArray(), signature.toArray());
++      }
++    };
++  }
++
++  @BeforeEach
++  public void setup() {
++    falcon0 = SealSchemes.FALCON_512.generate(random);
++    slh0 = SealSchemes.SLH_DSA_128S.generate(random);
++
++    final Properties p = new Properties();
++    p.setProperty("formatVersion", HybridSignerRegistry.FORMAT_VERSION);
++    p.setProperty("chainId", "2800");
++    p.setProperty("count", "1");
++    p.setProperty("0.addr", VALIDATOR_0.toHexString());
++    p.setProperty(
++        "0.key." + SealSchemes.FALCON_512.id(),
++        Bytes.wrap(falcon0.publicRegistryForm()).toHexString());
++    p.setProperty(
++        "0.key." + SealSchemes.SLH_DSA_128S.id(),
++        Bytes.wrap(slh0.publicRegistryForm()).toHexString());
++    registry = HybridSignerRegistry.fromProperties(p, "proba");
++
++    // pana la H_HIBRID doar Falcon; de acolo AMANDOUA familiile
++    orar =
++        PqSchemeSchedule.parse(
++            H_ARMARE
++                + ":"
++                + SealSchemes.FALCON_512.id()
++                + ","
++                + H_HIBRID
++                + ":"
++                + SealSchemes.FALCON_512.id()
++                + "+"
++                + SealSchemes.SLH_DSA_128S.id());
++  }
++
++  private PqCommitEnforcement hibrid() {
++    // every height counts as an anchor parent here, so the refusals below keep their meaning
++    return new PqCommitEnforcement(H_ARMARE, registruFalcon(), orar, registry, h -> true);
++  }
++
++  private FalconSeal sigiliuFalcon(final int index) {
++    return new FalconSeal(
++        index,
++        Bytes.wrap(
++            SealSchemes.FALCON_512
++                .sign(falcon0.privateKey(), DIGEST.getBytes().toArray())
++                .orElseThrow()));
++  }
++
++  private SchemeSeal sigiliuSlh(final int index, final Hash peste) {
++    return new SchemeSeal(
++        SealSchemes.SLH_DSA_128S.wireId(),
++        index,
++        Bytes.wrap(
++            SealSchemes.SLH_DSA_128S
++                .sign(slh0.privateKey(), peste.getBytes().toArray())
++                .orElseThrow()));
++  }
++
++  // ============================================================ configuratia
++
++  @Test
++  public void halfAHybridConfigurationRefusesAtConstruction() {
++    assertThatThrownBy(
++            () -> new PqCommitEnforcement(H_ARMARE, registruFalcon(), orar, null))
++        .isInstanceOf(IllegalStateException.class)
++        .hasMessageContaining("AERE-PQC-COMMIT-CONF-03");
++    assertThatThrownBy(
++            () -> new PqCommitEnforcement(H_ARMARE, registruFalcon(), null, registry))
++        .isInstanceOf(IllegalStateException.class)
++        .hasMessageContaining("AERE-PQC-COMMIT-CONF-03");
++  }
++
++  @Test
++  public void falconOnlyModeIgnoresExtrasEntirely() {
++    final PqCommitEnforcement doarFalcon = new PqCommitEnforcement(H_ARMARE, registruFalcon());
++    assertThat(
++            doarFalcon.refusal(
++                H_HIBRID, VALIDATOR_0, DIGEST, Optional.of(sigiliuFalcon(0)), List.of()))
++        .isEmpty();
++  }
++
++  // ============================================================ sub si peste treapta hibrida
++
++  @Test
++  public void belowTheHybridStepFalconAloneIsEnough() {
++    assertThat(
++            hibrid()
++                .refusal(
++                    H_HIBRID - 1, VALIDATOR_0, DIGEST, Optional.of(sigiliuFalcon(0)), List.of()))
++        .isEmpty();
++  }
++
++  @Test
++  public void atTheHybridStepFalconAloneNoLongerCounts() {
++    final Optional refusal =
++        hibrid()
++            .refusal(H_HIBRID, VALIDATOR_0, DIGEST, Optional.of(sigiliuFalcon(0)), List.of());
++    assertThat(refusal).isPresent();
++    assertThat(refusal.get()).contains("carries no").contains(SealSchemes.SLH_DSA_128S.id());
++  }
++
++  @Test
++  public void aFullHybridCertificateCounts() {
++    assertThat(
++            hibrid()
++                .refusal(
++                    H_HIBRID,
++                    VALIDATOR_0,
++                    DIGEST,
++                    Optional.of(sigiliuFalcon(0)),
++                    List.of(sigiliuSlh(0, DIGEST))))
++        .isEmpty();
++  }
++
++  // ============================================================ controalele negative
++
++  @Test
++  public void aHybridSealOverAnotherDigestDoesNotCount() {
++    final Hash altul = Hash.hash(Bytes.of(9, 9));
++    final Optional refusal =
++        hibrid()
++            .refusal(
++                H_HIBRID,
++                VALIDATOR_0,
++                DIGEST,
++                Optional.of(sigiliuFalcon(0)),
++                List.of(sigiliuSlh(0, altul)));
++    assertThat(refusal).isPresent();
++    assertThat(refusal.get()).contains("does NOT verify");
++  }
++
++  @Test
++  public void aHybridSealForAnotherIndexIsRefused() {
++    final Optional refusal =
++        hibrid()
++            .refusal(
++                H_HIBRID,
++                VALIDATOR_0,
++                DIGEST,
++                Optional.of(sigiliuFalcon(0)),
++                List.of(sigiliuSlh(1, DIGEST)));
++    assertThat(refusal).isPresent();
++    assertThat(refusal.get()).contains("one commit, one signer");
++  }
++
++  @Test
++  public void aCorruptedHybridSealIsRefusedWithTheSchemeNamed() {
++    final SchemeSeal bun = sigiliuSlh(0, DIGEST);
++    final byte[] stricat = bun.getSignature().toArray().clone();
++    stricat[stricat.length / 3] ^= 0x01;
++    final Optional refusal =
++        hibrid()
++            .refusal(
++                H_HIBRID,
++                VALIDATOR_0,
++                DIGEST,
++                Optional.of(sigiliuFalcon(0)),
++                List.of(
++                    new SchemeSeal(
++                        SealSchemes.SLH_DSA_128S.wireId(), 0, Bytes.wrap(stricat))));
++    assertThat(refusal).isPresent();
++    assertThat(refusal.get())
++        .contains("does NOT verify")
++        .contains(SealSchemes.SLH_DSA_128S.id());
++  }
++
++  @Test
++  public void anIndexNotBoundToTheAuthorInTheHybridRegistryIsRefused() {
++    // the Falcon registry binds index 0 to VALIDATOR_0; we ask for the verdict as if the
++    // author were VALIDATOR_1: the Falcon path refuses first, so the hybrid is never touched
++    final Optional refusal =
++        hibrid()
++            .refusal(
++                H_HIBRID,
++                VALIDATOR_1,
++                DIGEST,
++                Optional.of(sigiliuFalcon(0)),
++                List.of(sigiliuSlh(0, DIGEST)));
++    assertThat(refusal).isPresent();
++    assertThat(refusal.get()).contains("someone else");
++  }
++
++  @Test
++  public void theTwoFamiliesAreIndependentAndTheProofSaysSo() {
++    // the control that gives the hybrid its meaning: a Falcon signature does not pass as
++    // SLH-DSA and vice versa. If it did, "hybrid" would be the same leg twice.
++    final byte[] message = DIGEST.getBytes().toArray();
++    final byte[] sigF =
++        SealSchemes.FALCON_512.sign(falcon0.privateKey(), message).orElseThrow();
++    final byte[] sigS =
++        SealSchemes.SLH_DSA_128S.sign(slh0.privateKey(), message).orElseThrow();
++    assertThat(SealSchemes.SLH_DSA_128S.verifyRaw(slh0.publicRegistryForm(), message, sigF))
++        .isFalse();
++    assertThat(SealSchemes.FALCON_512.verifyRaw(falcon0.publicRegistryForm(), message, sigS))
++        .isFalse();
++    // and an SLH-DSA seal presented under the Falcon label cannot enter the hybrid slot,
++    // because lookup there goes by scheme label
++    final Optional refusal =
++        hibrid()
++            .refusal(
++                H_HIBRID,
++                VALIDATOR_0,
++                DIGEST,
++                Optional.of(sigiliuFalcon(0)),
++                List.of(new SchemeSeal(SealSchemes.FALCON_512.wireId(), 0, Bytes.wrap(sigS))));
++    assertThat(refusal).isPresent();
++    assertThat(refusal.get()).contains("carries no");
++  }
++
++  @Test
++  public void theRegistryItselfHoldsBothFamiliesForTheSameValidator() {
++    assertThat(registry.publicKey(0, SealSchemes.FALCON_512.id())).isPresent();
++    assertThat(registry.publicKey(0, SealSchemes.SLH_DSA_128S.id())).isPresent();
++    assertThat(registry.coverage(SealSchemes.SLH_DSA_128S.id())).isEqualTo(1);
++    assertThat(registry.address(0)).isPresent();
++    assertThat(Map.of()).isEmpty();
++  }
++
++  /** D-329 (2026-09-03): off the anchor parents the extra seals are neither demanded nor emitted. */
++  @Test
++  void offTheAnchorParentsACommitWithoutExtrasStillCounts() {
++    final PqCommitEnforcement pe =
++        new PqCommitEnforcement(H_ARMARE, registruFalcon(), orar, registry, h -> false);
++    final FalconSeal falcon = sigiliuFalcon(0);
++    assertThat(pe.refusal(H_HIBRID, VALIDATOR_0, DIGEST, java.util.Optional.of(falcon), java.util.List.of()))
++        .describedAs("no extras demanded where the successor is not an anchor")
++        .isEmpty();
++    final PqCommitEnforcement peOn =
++        new PqCommitEnforcement(H_ARMARE, registruFalcon(), orar, registry, h -> true);
++    assertThat(peOn.refusal(H_HIBRID, VALIDATOR_0, DIGEST, java.util.Optional.of(falcon), java.util.List.of()))
++        .describedAs("the same commit IS refused where the successor is an anchor")
++        .isPresent();
++  }
++}
+diff --git a/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqMessageAgilityTest.java b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqMessageAgilityTest.java
+new file mode 100755
+index 000000000..cb51fed29
+--- /dev/null
++++ b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqMessageAgilityTest.java
+@@ -0,0 +1,198 @@
++/*
++ * Copyright contributors to Besu.
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
++ * the License. You may obtain a copy of the License at
++ *
++ * http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
++ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
++ * specific language governing permissions and limitations under the License.
++ *
++ * SPDX-License-Identifier: Apache-2.0
++ */
++package org.hyperledger.besu.consensus.qbft.core.validation;
++
++import static org.assertj.core.api.Assertions.assertThat;
++
++import org.hyperledger.besu.consensus.common.bft.FalconSeal;
++import org.hyperledger.besu.consensus.common.bft.PqAnchor;
++import org.hyperledger.besu.consensus.common.bft.PqSignerRegistry;
++import org.hyperledger.besu.consensus.common.bft.SealScheme;
++import org.hyperledger.besu.consensus.common.bft.SealSchemes;
++import org.hyperledger.besu.consensus.qbft.core.payload.PreparedRoundMetadata;
++import org.hyperledger.besu.crypto.SecureRandomProvider;
++import org.hyperledger.besu.datatypes.Address;
++import org.hyperledger.besu.datatypes.Hash;
++
++import java.security.SecureRandom;
++import java.util.Map;
++import java.util.Optional;
++
++import org.apache.tuweni.bytes.Bytes;
++import org.apache.tuweni.bytes.Bytes32;
++import org.junit.jupiter.api.Test;
++
++/**
++ * CRYPTOGRAPHIC AGILITY of the PROPOSAL and ROUND-CHANGE enforcements: the same consensus code,
++ * UNTOUCHED, accepts a seal made with a DIFFERENT post-quantum scheme.
++ *
++ * 
        The question and the method are {@link PqPrepareAgilityTest}'s, asked of the two surfaces
++ * built after it (PROPOSAL on 2026-08-30, ROUND-CHANGE on 2026-08-31): both enforcements receive
++ * the registry through their constructor and name no scheme, so the Falcon nail must sit only in
++ * the production wiring ({@code PqSignerRegistry.falconSealSupport()}), never in the enforcement
++ * class. If any of these tests fails, a change of maths would mean opening consensus code rather
++ * than adding a binding - a far more expensive finding than the test.
++ *
++ * 
        ONE class for both surfaces on purpose: the twin-class finding (D-293, consolidated
++ * 2026-08-31) measured what per-surface copies of the same idea cost - one gets a repair, the
++ * other silently does not. The shared harness here is the fix applied in advance.
++ *
++ * 
        WHAT THIS DOES NOT PROVE: that the fleet can run this way today. The production wiring stays
++ * Falcon-only, recorded as such in the findings register (D-285).
++ */
++class PqMessageAgilityTest {
++
++  private static final long H_ARMARE = 1_000L;
++  private static final int ROUND = 2;
++  private static final long CHAIN_ID = 2800L;
++  private static final Address VALIDATOR_0 = Address.fromHexString("0x" + "cc".repeat(20));
++  private static final Hash DIGEST = Hash.hash(Bytes.of(9, 9, 9));
++
++  private final SecureRandom random = SecureRandomProvider.createSecureRandom();
++
++  /** A registry that verifies under A GIVEN SCHEME, whichever it is. Nothing Falcon inside. */
++  private static final class RegistryPerScheme implements PqSignerRegistry {
++    private final SealScheme scheme;
++    private final Map bindings;
++    private final Map keys;
++
++    RegistryPerScheme(
++        final SealScheme scheme, final Map bindings, final Map keys) {
++      this.scheme = scheme;
++      this.bindings = bindings;
++      this.keys = keys;
++    }
++
++    @Override
++    public Address addressForIndexAtHistoric(final long blockNumber, final int validatorIndex) {
++      return bindings.get(validatorIndex);
++    }
++
++    @Override
++    public Address addressForIndexAtOwnHead(final long blockNumber, final int validatorIndex) {
++      return bindings.get(validatorIndex);
++    }
++
++    @Override
++    public boolean verifyAtHistoric(
++        final long blockNumber, final int validatorIndex, final Bytes message, final Bytes signature) {
++      return verifyAtOwnHead(blockNumber, validatorIndex, message, signature);
++    }
++
++    @Override
++    public boolean verifyAtOwnHead(
++        final long blockNumber, final int validatorIndex, final Bytes message, final Bytes signature) {
++      final byte[] pk = keys.get(validatorIndex);
++      return pk != null && scheme.verifyRaw(pk, message.toArray(), signature.toArray());
++    }
++  }
++
++  private RegistryPerScheme registryFor(final SealScheme scheme, final SealScheme.GeneratedPair k) {
++    return new RegistryPerScheme(scheme, Map.of(0, VALIDATOR_0), Map.of(0, k.publicRegistryForm()));
++  }
++
++  /** A PROPOSAL signed with the given scheme, enforced over a registry on that same scheme. */
++  private boolean proposalPassesUnder(final SealScheme scheme) {
++    final SealScheme.GeneratedPair k = scheme.generate(random);
++    final Bytes32 message = PqAnchor.proposalMessage(CHAIN_ID, H_ARMARE, ROUND, DIGEST.getBytes());
++    final byte[] sig = scheme.sign(k.privateKey(), message.toArray()).orElseThrow();
++    final PqProposalEnforcement enforcement =
++        new PqProposalEnforcement(H_ARMARE, registryFor(scheme, k), CHAIN_ID);
++    return enforcement
++        .refusal(H_ARMARE, ROUND, VALIDATOR_0, DIGEST, Optional.of(new FalconSeal(0, Bytes.wrap(sig))))
++        .isEmpty();
++  }
++
++  /**
++   * A ROUND-CHANGE signed with the given scheme, enforced over a registry on that same scheme -
++   * bare or claiming a prepared block, because the two preimages differ and both must stay
++   * scheme-free.
++   */
++  private boolean roundChangePassesUnder(final SealScheme scheme, final boolean withPrepared) {
++    final SealScheme.GeneratedPair k = scheme.generate(random);
++    final Bytes32 message =
++        withPrepared
++            ? PqAnchor.roundChangeMessage(CHAIN_ID, H_ARMARE, ROUND, 1, DIGEST.getBytes())
++            : PqAnchor.roundChangeMessage(CHAIN_ID, H_ARMARE, ROUND);
++    final byte[] sig = scheme.sign(k.privateKey(), message.toArray()).orElseThrow();
++    final PqRoundChangeEnforcement enforcement =
++        new PqRoundChangeEnforcement(H_ARMARE, registryFor(scheme, k), CHAIN_ID);
++    final Optional prm =
++        withPrepared ? Optional.of(new PreparedRoundMetadata(DIGEST, 1)) : Optional.empty();
++    return enforcement
++        .refusal(H_ARMARE, ROUND, VALIDATOR_0, prm, Optional.of(new FalconSeal(0, Bytes.wrap(sig))))
++        .isEmpty();
++  }
++
++  @Test
++  void aProposalSignedWithFALCONPasses() {
++    // THE WITNESS. Without it, a "passes" for SLH-DSA would not say whether the enforcement
++    // verifies anything at all.
++    assertThat(proposalPassesUnder(SealSchemes.FALCON_512)).isTrue();
++  }
++
++  @Test
++  void aProposalSignedWithSLHDSAPassesTHESAMEWay() {
++    // The same enforcement class, the same message, THE SAME consensus code - different maths.
++    assertThat(proposalPassesUnder(SealSchemes.SLH_DSA_128S)).isTrue();
++  }
++
++  @Test
++  void aRoundChangeSignedWithFALCONPasses() {
++    assertThat(roundChangePassesUnder(SealSchemes.FALCON_512, false)).isTrue();
++    assertThat(roundChangePassesUnder(SealSchemes.FALCON_512, true)).isTrue();
++  }
++
++  @Test
++  void aRoundChangeSignedWithSLHDSAPassesTHESAMEWay() {
++    assertThat(roundChangePassesUnder(SealSchemes.SLH_DSA_128S, false)).isTrue();
++    assertThat(roundChangePassesUnder(SealSchemes.SLH_DSA_128S, true)).isTrue();
++  }
++
++  @Test
++  void neitherEnforcementNAMESASchemeAtAll() {
++    // The control that makes "passes" mean something: a Falcon seal against an SLH-DSA registry
++    // must be REFUSED on both surfaces. Otherwise "passes" could just mean "does not verify".
++    final SealScheme.GeneratedPair falcon = SealSchemes.FALCON_512.generate(random);
++    final SealScheme.GeneratedPair slh = SealSchemes.SLH_DSA_128S.generate(random);
++    final RegistryPerScheme slhRegistry = registryFor(SealSchemes.SLH_DSA_128S, slh);
++
++    final Bytes32 propMsg = PqAnchor.proposalMessage(CHAIN_ID, H_ARMARE, ROUND, DIGEST.getBytes());
++    final byte[] propSigFalcon =
++        SealSchemes.FALCON_512.sign(falcon.privateKey(), propMsg.toArray()).orElseThrow();
++    assertThat(
++            new PqProposalEnforcement(H_ARMARE, slhRegistry, CHAIN_ID)
++                .refusal(
++                    H_ARMARE,
++                    ROUND,
++                    VALIDATOR_0,
++                    DIGEST,
++                    Optional.of(new FalconSeal(0, Bytes.wrap(propSigFalcon)))))
++        .isPresent();
++
++    final Bytes32 rcMsg = PqAnchor.roundChangeMessage(CHAIN_ID, H_ARMARE, ROUND);
++    final byte[] rcSigFalcon =
++        SealSchemes.FALCON_512.sign(falcon.privateKey(), rcMsg.toArray()).orElseThrow();
++    assertThat(
++            new PqRoundChangeEnforcement(H_ARMARE, slhRegistry, CHAIN_ID)
++                .refusal(
++                    H_ARMARE,
++                    ROUND,
++                    VALIDATOR_0,
++                    Optional.empty(),
++                    Optional.of(new FalconSeal(0, Bytes.wrap(rcSigFalcon)))))
++        .isPresent();
++  }
++}
+diff --git a/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqPrepareAgilityTest.java b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqPrepareAgilityTest.java
+new file mode 100755
+index 000000000..ce7fb371a
+--- /dev/null
++++ b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqPrepareAgilityTest.java
+@@ -0,0 +1,180 @@
++/*
++ * Copyright contributors to Besu.
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
++ * the License. You may obtain a copy of the License at
++ *
++ * http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
++ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
++ * specific language governing permissions and limitations under the License.
++ *
++ * SPDX-License-Identifier: Apache-2.0
++ */
++package org.hyperledger.besu.consensus.qbft.core.validation;
++
++import static org.assertj.core.api.Assertions.assertThat;
++
++import org.hyperledger.besu.consensus.common.bft.FalconSeal;
++import org.hyperledger.besu.consensus.common.bft.PqAnchor;
++import org.hyperledger.besu.consensus.common.bft.PqSignerRegistry;
++import org.hyperledger.besu.consensus.common.bft.SealScheme;
++import org.hyperledger.besu.consensus.common.bft.SealSchemes;
++import org.hyperledger.besu.crypto.SecureRandomProvider;
++import org.hyperledger.besu.datatypes.Address;
++import org.hyperledger.besu.datatypes.Hash;
++
++import java.security.SecureRandom;
++import java.util.Map;
++import java.util.Optional;
++
++import org.apache.tuweni.bytes.Bytes;
++import org.apache.tuweni.bytes.Bytes32;
++import org.junit.jupiter.api.Test;
++
++/**
++ * CRYPTOGRAPHIC AGILITY of the PREPARE enforcement: the same consensus code, UNTOUCHED, accepts a
++ * seal made with a DIFFERENT post-quantum scheme.
++ *
++ * 
        WHY THIS EXISTS - it is a question asked of my own work from the night of the 28th to the
++ * 29th. The anchor has been scheme-agile since 2026-08-28 (finding D-266): the hybrid registry
++ * holds keys PER SCHEME and dispatches through {@code SealSchemes.byId}. The new surface, PREPARE,
++ * reads at first sight as nailed to Falcon: the production wiring goes through
++ * {@code PqSignerRegistry.falconSealSupport()}, and that lands in {@code verifyWithKey}, which
++ * names {@code SealSchemes.FALCON_512} literally. The question that matters is not "is the wiring
++ * agile?" - plainly it is not - but where exactly the nail is: in the enforcement class, or only
++ * in the wiring?
++ *
++ * 
        This test answers by measurement. {@link PqPrepareEnforcement} receives the registry through
++ * its constructor and names no scheme at all; so if it is given a registry that verifies under
++ * SLH-DSA, a PREPARE signed with SLH-DSA must pass without touching one line of consensus
++ * code. If it passes, the nail is only in the wiring and comes out with a new binding rather
++ * than a rewrite. If it does not pass, the enforcement itself has to be opened up - and that would
++ * be a far more expensive finding.
++ *
++ * 
        SLH-DSA is the very second scheme the founder chose on 7 August for the hybrid certificate,
++ * and it is already live as a precompile on the chain from block 9,189,161. It is not a scheme
++ * invented for this test.
++ *
++ * 
        WHAT THIS DOES NOT PROVE: it does not say the fleet can run this way today. The production
++ * wiring stays Falcon-only, and that is written as such in the findings register. What is measured
++ * here is only where the limit sits.
++ */
++class PqPrepareAgilityTest {
++
++  private static final long H_ARMARE = 1_000L;
++  private static final int ROUND = 2;
++  private static final long CHAIN_ID = 2800L;
++  private static final Address VALIDATOR_0 = Address.fromHexString("0x" + "cc".repeat(20));
++  private static final Hash DIGEST = Hash.hash(Bytes.of(9, 9, 9));
++
++  private final SecureRandom random = SecureRandomProvider.createSecureRandom();
++
++  /** A registry that verifies under A GIVEN SCHEME, whichever it is. Nothing Falcon inside. */
++  private static final class RegistryPerScheme implements PqSignerRegistry {
++    private final SealScheme scheme;
++    private final Map bindings;
++    private final Map keys;
++
++    RegistryPerScheme(
++        final SealScheme scheme, final Map bindings, final Map keys) {
++      this.scheme = scheme;
++      this.bindings = bindings;
++      this.keys = keys;
++    }
++
++    @Override
++    public Address addressForIndexAtHistoric(final long blockNumber, final int validatorIndex) {
++      return bindings.get(validatorIndex);
++    }
++
++    @Override
++    public Address addressForIndexAtOwnHead(final long blockNumber, final int validatorIndex) {
++      return bindings.get(validatorIndex);
++    }
++
++    @Override
++    public boolean verifyAtHistoric(
++        final long blockNumber, final int validatorIndex, final Bytes message, final Bytes signature) {
++      return verifyAtOwnHead(blockNumber, validatorIndex, message, signature);
++    }
++
++    @Override
++    public boolean verifyAtOwnHead(
++        final long blockNumber, final int validatorIndex, final Bytes message, final Bytes signature) {
++      final byte[] pk = keys.get(validatorIndex);
++      return pk != null && scheme.verifyRaw(pk, message.toArray(), signature.toArray());
++    }
++  }
++
++  private Bytes32 message() {
++    return PqAnchor.prepareMessage(CHAIN_ID, H_ARMARE, ROUND, DIGEST.getBytes());
++  }
++
++  /** A PREPARE signed with the given scheme, enforced over a registry on that same scheme. */
++  private boolean passesUnder(final SealScheme scheme) {
++    final SealScheme.GeneratedPair k = scheme.generate(random);
++    final byte[] sig = scheme.sign(k.privateKey(), message().toArray()).orElseThrow();
++    final PqPrepareEnforcement enforcement =
++        new PqPrepareEnforcement(
++            H_ARMARE,
++            new RegistryPerScheme(
++                scheme, Map.of(0, VALIDATOR_0), Map.of(0, k.publicRegistryForm())),
++            CHAIN_ID);
++    final Optional refusal =
++        enforcement.refusal(
++            H_ARMARE, ROUND, VALIDATOR_0, DIGEST, Optional.of(new FalconSeal(0, Bytes.wrap(sig))));
++    return refusal.isEmpty();
++  }
++
++  @Test
++  void aPrepareSignedWithFALCONPasses() {
++    // THE WITNESS. Without it, a "passes" for SLH-DSA would not say whether the enforcement
++    // verifies anything at all.
++    assertThat(passesUnder(SealSchemes.FALCON_512)).isTrue();
++  }
++
++  @Test
++  void aPrepareSignedWithSLHDSAPassesTHESAMEWay() {
++    // The same enforcement class, the same message, THE SAME consensus code - different maths.
++    assertThat(passesUnder(SealSchemes.SLH_DSA_128S)).isTrue();
++  }
++
++  @Test
++  void theEnforcementNAMESNoSchemeAtAll() {
++    // The control that makes the test above mean something: if the registry verifies under SLH-DSA
++    // but the seal was made with Falcon, it must be REFUSED. Otherwise "passes" could just mean
++    // "does not verify".
++    final SealScheme.GeneratedPair falcon = SealSchemes.FALCON_512.generate(random);
++    final SealScheme.GeneratedPair slh = SealSchemes.SLH_DSA_128S.generate(random);
++    final byte[] sigFalcon =
++        SealSchemes.FALCON_512.sign(falcon.privateKey(), message().toArray()).orElseThrow();
++
++    final PqPrepareEnforcement enforcement =
++        new PqPrepareEnforcement(
++            H_ARMARE,
++            new RegistryPerScheme(
++                SealSchemes.SLH_DSA_128S,
++                Map.of(0, VALIDATOR_0),
++                Map.of(0, slh.publicRegistryForm())),
++            CHAIN_ID);
++    final Optional refusal =
++        enforcement.refusal(
++            H_ARMARE,
++            ROUND,
++            VALIDATOR_0,
++            DIGEST,
++            Optional.of(new FalconSeal(0, Bytes.wrap(sigFalcon))));
++    assertThat(refusal).isPresent();
++  }
++
++  @Test
++  void theTwoSchemesReallyAreDIFFERENT() {
++    // The second control of the method: if the two schemes happened to be the same implementation,
++    // the agility test would be a tautology. Their identities and key lengths must differ.
++    assertThat(SealSchemes.FALCON_512.id()).isNotEqualTo(SealSchemes.SLH_DSA_128S.id());
++    assertThat(SealSchemes.FALCON_512.publicKeyLength())
++        .isNotEqualTo(SealSchemes.SLH_DSA_128S.publicKeyLength());
++  }
++}
+diff --git a/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqPrepareEnforcementTest.java b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqPrepareEnforcementTest.java
+new file mode 100755
+index 000000000..620f0713c
+--- /dev/null
++++ b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqPrepareEnforcementTest.java
+@@ -0,0 +1,266 @@
++/*
++ * Copyright contributors to Besu.
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
++ * the License. You may obtain a copy of the License at
++ *
++ * http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
++ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
++ * specific language governing permissions and limitations under the License.
++ *
++ * SPDX-License-Identifier: Apache-2.0
++ */
++package org.hyperledger.besu.consensus.qbft.core.validation;
++
++import static org.assertj.core.api.Assertions.assertThat;
++import static org.assertj.core.api.Assertions.assertThatThrownBy;
++
++import org.hyperledger.besu.consensus.common.bft.FalconSeal;
++import org.hyperledger.besu.consensus.common.bft.PqAnchor;
++import org.hyperledger.besu.consensus.common.bft.PqSignerRegistry;
++import org.hyperledger.besu.consensus.common.bft.SealScheme;
++import org.hyperledger.besu.consensus.common.bft.SealSchemes;
++import org.hyperledger.besu.crypto.SecureRandomProvider;
++import org.hyperledger.besu.datatypes.Address;
++import org.hyperledger.besu.datatypes.Hash;
++
++import java.security.SecureRandom;
++import java.util.Map;
++import java.util.Optional;
++
++import org.apache.tuweni.bytes.Bytes;
++import org.apache.tuweni.bytes.Bytes32;
++import org.junit.jupiter.api.AfterEach;
++import org.junit.jupiter.api.Test;
++
++/**
++ * PREPARE ENFORCEMENT, step 4. The structure follows PqCommitEnforcementTest deliberately.
++ *
++ * 
        What is proven here, each item closing one way of being wrong:
++ *
++ * 
          
++ *   
        1. below the arming height NOTHING changes - the condition for the binary to sit on the fleet;
++ *   
        2. above it, a PREPARE without a seal does NOT count;
++ *   
        3. a seal from ANOTHER validator does not vouch for this author;
++ *   
        4. a seal over a DIFFERENT MESSAGE does not pass - in particular one over the COMMIT message,
++ *       which is exactly the attack that domain separation closes;
++ *   
        5. a seal from a DIFFERENT ROUND does not pass;
++ *   
        6. a mistyped configuration REFUSES, it does not disarm.
++ * 
        
++ *
++ * 
        The keys are REAL Falcon keys, generated in-process, and verification goes through the real
++ * scheme. A test with fake signatures would prove that we can compare strings, not that the
++ * enforcement enforces.
++ */
++class PqPrepareEnforcementTest {
++
++  private static final long H_ARMARE = 1_000_000L;
++  private static final int ROUND = 3;
++  private static final Address VALIDATOR_0 = Address.fromHexString("0x" + "aa".repeat(20));
++  private static final Address VALIDATOR_1 = Address.fromHexString("0x" + "bb".repeat(20));
++  private static final Hash DIGEST = Hash.hash(Bytes.of(7, 7, 7));
++  private static final long CHAIN_ID = 2800L;
++
++  private final SecureRandom random = SecureRandomProvider.createSecureRandom();
++
++  @AfterEach
++  void curata() {
++    System.clearProperty(PqPrepareEnforcement.PROPERTY_FORK_BLOCK);
++  }
++
++  /** Registru de test: legaturi index->adresa programate + verificare prin schema REALA. */
++  private static final class RegistruDeTest implements PqSignerRegistry {
++    final Map bindings;
++    final Map keys;
++
++    RegistruDeTest(final Map bindings, final Map keys) {
++      this.bindings = bindings;
++      this.keys = keys;
++    }
++
++    @Override
++    public Address addressForIndexAtHistoric(final long blockNumber, final int validatorIndex) {
++      return bindings.get(validatorIndex);
++    }
++
++    @Override
++    public Address addressForIndexAtOwnHead(final long blockNumber, final int validatorIndex) {
++      return bindings.get(validatorIndex);
++    }
++
++    @Override
++    public boolean verifyAtHistoric(
++        final long blockNumber, final int validatorIndex, final Bytes message, final Bytes signature) {
++      return verifyAtOwnHead(blockNumber, validatorIndex, message, signature);
++    }
++
++    @Override
++    public boolean verifyAtOwnHead(
++        final long blockNumber, final int validatorIndex, final Bytes message, final Bytes signature) {
++      final byte[] pk = keys.get(validatorIndex);
++      if (pk == null) {
++        return false;
++      }
++      return SealSchemes.FALCON_512.verifyRaw(pk, message.toArray(), signature.toArray());
++    }
++  }
++
++  private record World(
++      PqPrepareEnforcement enforcement,
++      FalconSeal valid0,
++      SealScheme.GeneratedPair k0,
++      SealScheme.GeneratedPair k1) {}
++
++  private Bytes32 mesajPrepare(final long h, final int round) {
++    return PqAnchor.prepareMessage(CHAIN_ID, h, round, DIGEST.getBytes());
++  }
++
++  /** Two validators with real Falcon keys; validator 0's seal over the PREPARE message at H_ARMARE. */
++  private World world() {
++    final SealScheme.GeneratedPair k0 = SealSchemes.FALCON_512.generate(random);
++    final SealScheme.GeneratedPair k1 = SealSchemes.FALCON_512.generate(random);
++    final byte[] sig0 =
++        SealSchemes.FALCON_512
++            .sign(k0.privateKey(), mesajPrepare(H_ARMARE, ROUND).toArray())
++            .orElseThrow();
++    final RegistruDeTest reg =
++        new RegistruDeTest(
++            Map.of(0, VALIDATOR_0, 1, VALIDATOR_1),
++            Map.of(0, k0.publicRegistryForm(), 1, k1.publicRegistryForm()));
++    return new World(
++        new PqPrepareEnforcement(H_ARMARE, reg, CHAIN_ID), new FalconSeal(0, Bytes.wrap(sig0)), k0, k1);
++  }
++
++  // ---------------------------------------------------------------------------------------------
++  // 1. BELOW the arming height NOTHING changes. The condition for the binary to sit on the fleet.
++  // ---------------------------------------------------------------------------------------------
++  @Test
++  void belowTheArmingHeightAnUnsealedPrepareDOESCount() {
++    final World l = world();
++    assertThat(l.enforcement().armedAt(H_ARMARE - 1)).isFalse();
++    assertThat(l.enforcement().refusal(H_ARMARE - 1, ROUND, VALIDATOR_0, DIGEST, Optional.empty()))
++        .isEmpty();
++  }
++
++  // ---------------------------------------------------------------------------------------------
++  // 2. ABOVE it, a PREPARE without a seal does not count.
++  // ---------------------------------------------------------------------------------------------
++  @Test
++  void aboveTheHeightAnUnsealedPrepareDoesNOTCount() {
++    final World l = world();
++    final Optional refusal =
++        l.enforcement().refusal(H_ARMARE, ROUND, VALIDATOR_0, DIGEST, Optional.empty());
++    assertThat(refusal).isPresent();
++    assertThat(refusal.get()).contains("carries NO post-quantum seal");
++  }
++
++  // ---------------------------------------------------------------------------------------------
++  // 3. A GOOD seal from the author passes.
++  // ---------------------------------------------------------------------------------------------
++  @Test
++  void aGoodSealFromTheAuthorPasses() {
++    final World l = world();
++    assertThat(l.enforcement().refusal(H_ARMARE, ROUND, VALIDATOR_0, DIGEST, Optional.of(l.valid0())))
++        .isEmpty();
++  }
++
++  // ---------------------------------------------------------------------------------------------
++  // 4. The same seal, a different author: it does not vouch for somebody else.
++  // ---------------------------------------------------------------------------------------------
++  @Test
++  void aSealDoesNotVouchForAnotherAuthor() {
++    final World l = world();
++    final Optional refusal =
++        l.enforcement().refusal(H_ARMARE, ROUND, VALIDATOR_1, DIGEST, Optional.of(l.valid0()));
++    assertThat(refusal).isPresent();
++    assertThat(refusal.get()).contains("cannot vouch for someone else's vote");
++  }
++
++  // ---------------------------------------------------------------------------------------------
++  // 5. DOMAIN SEPARATION, and this is the security test of the whole step: a seal given HONESTLY
++  //    over the COMMIT message must not pass as a PREPARE seal.
++  // ---------------------------------------------------------------------------------------------
++  @Test
++  void aSealOverTheCOMMITMessageDoesNotPassAsPREPARE() {
++    final World l = world();
++    final Bytes32 mesajCommit = PqAnchor.commitMessage(CHAIN_ID, H_ARMARE, DIGEST.getBytes());
++    final byte[] sigCommit =
++        SealSchemes.FALCON_512.sign(l.k0().privateKey(), mesajCommit.toArray()).orElseThrow();
++
++    final Optional refusal =
++        l.enforcement()
++            .refusal(
++                H_ARMARE, ROUND, VALIDATOR_0, DIGEST, Optional.of(new FalconSeal(0, Bytes.wrap(sigCommit))));
++    assertThat(refusal).isPresent();
++    assertThat(refusal.get()).contains("does NOT verify over the prepare message");
++  }
++
++  // ---------------------------------------------------------------------------------------------
++  // 6. The ROUND is in the preimage: a seal from a failed round does not justify another one.
++  // ---------------------------------------------------------------------------------------------
++  @Test
++  void aSealFromAnotherROUNDDoesNotPass() {
++    final World l = world();
++    final byte[] sigAltaRunda =
++        SealSchemes.FALCON_512
++            .sign(l.k0().privateKey(), mesajPrepare(H_ARMARE, ROUND + 1).toArray())
++            .orElseThrow();
++    final Optional refusal =
++        l.enforcement()
++            .refusal(
++                H_ARMARE, ROUND, VALIDATOR_0, DIGEST, Optional.of(new FalconSeal(0, Bytes.wrap(sigAltaRunda))));
++    assertThat(refusal).isPresent();
++    assertThat(refusal.get()).contains("does NOT verify over the prepare message");
++  }
++
++  // ---------------------------------------------------------------------------------------------
++  // 7. An index the registry binds to nobody.
++  // ---------------------------------------------------------------------------------------------
++  @Test
++  void anUNBOUNDIndexDoesNotPass() {
++    final World l = world();
++    final Optional refusal =
++        l.enforcement()
++            .refusal(H_ARMARE, ROUND, VALIDATOR_0, DIGEST, Optional.of(new FalconSeal(99, l.valid0().getSignature())));
++    assertThat(refusal).isPresent();
++    assertThat(refusal.get()).contains("is bound to null");
++  }
++
++  // ---------------------------------------------------------------------------------------------
++  // 8. CONFIGURATION: absent = disarmed; a mistyped value = REFUSAL, never a silent disarming.
++  // ---------------------------------------------------------------------------------------------
++  @Test
++  void withoutThePropertyTheEnforcementIsNULL() {
++    assertThat(PqPrepareEnforcement.fromSystemConfig()).isNull();
++  }
++
++  @Test
++  void oValoareBunaArmeaza() {
++    System.setProperty(PqPrepareEnforcement.PROPERTY_FORK_BLOCK, "1234567");
++    final PqPrepareEnforcement e = PqPrepareEnforcement.fromSystemConfig();
++    assertThat(e).isNotNull();
++    assertThat(e.armedAt(1_234_566L)).isFalse();
++    assertThat(e.armedAt(1_234_567L)).isTrue();
++  }
++
++  @Test
++  void aMISTYPEDValueRefusesLoudly() {
++    for (final String bad : new String[] {"nu-e-numar", "1_234_567", "-1", "1e6"}) {
++      System.setProperty(PqPrepareEnforcement.PROPERTY_FORK_BLOCK, bad);
++      assertThatThrownBy(PqPrepareEnforcement::fromSystemConfig)
++          .as("valoarea '%s'", bad)
++          .isInstanceOf(IllegalStateException.class)
++          .hasMessageContaining("AERE-PQC-PREPARE-ENF-01");
++    }
++  }
++
++  @Test
++  void theENFORCEMENTGateIsNotTheEMISSIONGate() {
++    // Doua proprietati distincte: se poate EMITE luni de zile fara sa se IMPUNA nimic. Daca ar fi
++    // una singura, primul nod care incepe sa emita ar incepe si sa refuze, si aia e o zi de flag.
++    assertThat(PqPrepareEnforcement.PROPERTY_FORK_BLOCK)
++        .isNotEqualTo("aere.pq.preparePq.attachBlock");
++  }
++}
+diff --git a/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqProposalEnforcementTest.java b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqProposalEnforcementTest.java
+new file mode 100755
+index 000000000..c4853f624
+--- /dev/null
++++ b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqProposalEnforcementTest.java
+@@ -0,0 +1,297 @@
++/*
++ * Copyright contributors to Besu.
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
++ * the License. You may obtain a copy of the License at
++ *
++ * http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
++ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
++ * specific language governing permissions and limitations under the License.
++ *
++ * SPDX-License-Identifier: Apache-2.0
++ */
++package org.hyperledger.besu.consensus.qbft.core.validation;
++
++import static org.assertj.core.api.Assertions.assertThat;
++import static org.assertj.core.api.Assertions.assertThatThrownBy;
++
++import org.hyperledger.besu.consensus.common.bft.FalconSeal;
++import org.hyperledger.besu.consensus.common.bft.PqAnchor;
++import org.hyperledger.besu.consensus.common.bft.PqSignerRegistry;
++import org.hyperledger.besu.consensus.common.bft.SealScheme;
++import org.hyperledger.besu.consensus.common.bft.SealSchemes;
++import org.hyperledger.besu.crypto.SecureRandomProvider;
++import org.hyperledger.besu.datatypes.Address;
++import org.hyperledger.besu.datatypes.Hash;
++
++import java.security.SecureRandom;
++import java.util.Map;
++import java.util.Optional;
++
++import org.apache.tuweni.bytes.Bytes;
++import org.apache.tuweni.bytes.Bytes32;
++import org.junit.jupiter.api.AfterEach;
++import org.junit.jupiter.api.Test;
++
++/**
++ * PROPOSAL ENFORCEMENT. The structure follows PqPrepareEnforcementTest deliberately - the same
++ * eight ways of being wrong, each with the test that closes it.
++ *
++ * 
          
++ *   
        1. below the arming height NOTHING changes - the condition for the binary to sit on the fleet;
++ *   
        2. above it, a PROPOSAL without a seal is refused;
++ *   
        3. a seal from ANOTHER validator does not vouch for this proposer;
++ *   
        4. a seal over a DIFFERENT MESSAGE does not pass - tested against BOTH the PREPARE and the
++ *       COMMIT messages, because a proposal seal that passed under either domain would let an
++ *       honest proposal seal be replayed as a vote, or an honest vote seal be replayed as a
++ *       proposal;
++ *   
        5. a seal from a DIFFERENT ROUND does not pass;
++ *   
        6. an index the registry binds to nobody does not pass;
++ *   
        7. a mistyped configuration REFUSES, it does not disarm;
++ *   
        8. the enforcement gate and the emission gate are two different switches.
++ * 
        
++ *
++ * 
        The keys are REAL Falcon keys, generated in-process, and verification goes through the real
++ * scheme. A test with fake signatures would prove that we can compare strings, not that the
++ * enforcement enforces.
++ */
++class PqProposalEnforcementTest {
++
++  private static final long ARMED_FROM = 1_000_000L;
++  private static final int ROUND = 3;
++  private static final Address PROPOSER_0 = Address.fromHexString("0x" + "aa".repeat(20));
++  private static final Address VALIDATOR_1 = Address.fromHexString("0x" + "bb".repeat(20));
++  private static final Hash DIGEST = Hash.hash(Bytes.of(8, 8, 8));
++  private static final long CHAIN_ID = 2800L;
++
++  private final SecureRandom random = SecureRandomProvider.createSecureRandom();
++
++  @AfterEach
++  void clearProperty() {
++    System.clearProperty(PqProposalEnforcement.PROPERTY_FORK_BLOCK);
++  }
++
++  /** Test registry: programmed index-to-address bindings + verification through the REAL scheme. */
++  private static final class TestRegistry implements PqSignerRegistry {
++    final Map bindings;
++    final Map keys;
++
++    TestRegistry(final Map bindings, final Map keys) {
++      this.bindings = bindings;
++      this.keys = keys;
++    }
++
++    @Override
++    public Address addressForIndexAtHistoric(final long blockNumber, final int validatorIndex) {
++      return bindings.get(validatorIndex);
++    }
++
++    @Override
++    public Address addressForIndexAtOwnHead(final long blockNumber, final int validatorIndex) {
++      return bindings.get(validatorIndex);
++    }
++
++    @Override
++    public boolean verifyAtHistoric(
++        final long blockNumber, final int validatorIndex, final Bytes message, final Bytes signature) {
++      return verifyAtOwnHead(blockNumber, validatorIndex, message, signature);
++    }
++
++    @Override
++    public boolean verifyAtOwnHead(
++        final long blockNumber, final int validatorIndex, final Bytes message, final Bytes signature) {
++      final byte[] pk = keys.get(validatorIndex);
++      if (pk == null) {
++        return false;
++      }
++      return SealSchemes.FALCON_512.verifyRaw(pk, message.toArray(), signature.toArray());
++    }
++  }
++
++  private record World(
++      PqProposalEnforcement enforcement,
++      FalconSeal valid0,
++      SealScheme.GeneratedPair k0,
++      SealScheme.GeneratedPair k1) {}
++
++  private Bytes32 proposalMessage(final long h, final int round) {
++    return PqAnchor.proposalMessage(CHAIN_ID, h, round, DIGEST.getBytes());
++  }
++
++  /** Two validators with real Falcon keys; validator 0's seal over the PROPOSAL message. */
++  private World world() {
++    final SealScheme.GeneratedPair k0 = SealSchemes.FALCON_512.generate(random);
++    final SealScheme.GeneratedPair k1 = SealSchemes.FALCON_512.generate(random);
++    final byte[] sig0 =
++        SealSchemes.FALCON_512
++            .sign(k0.privateKey(), proposalMessage(ARMED_FROM, ROUND).toArray())
++            .orElseThrow();
++    final TestRegistry reg =
++        new TestRegistry(
++            Map.of(0, PROPOSER_0, 1, VALIDATOR_1),
++            Map.of(0, k0.publicRegistryForm(), 1, k1.publicRegistryForm()));
++    return new World(
++        new PqProposalEnforcement(ARMED_FROM, reg, CHAIN_ID),
++        new FalconSeal(0, Bytes.wrap(sig0)),
++        k0,
++        k1);
++  }
++
++  // ---------------------------------------------------------------------------------------------
++  // 1. BELOW the arming height NOTHING changes. The condition for the binary to sit on the fleet.
++  // ---------------------------------------------------------------------------------------------
++  @Test
++  void belowTheArmingHeightAnUnsealedProposalIsAccepted() {
++    final World w = world();
++    assertThat(w.enforcement().armedAt(ARMED_FROM - 1)).isFalse();
++    assertThat(w.enforcement().refusal(ARMED_FROM - 1, ROUND, PROPOSER_0, DIGEST, Optional.empty()))
++        .isEmpty();
++  }
++
++  // ---------------------------------------------------------------------------------------------
++  // 2. ABOVE it, a PROPOSAL without a seal is refused.
++  // ---------------------------------------------------------------------------------------------
++  @Test
++  void aboveTheHeightAnUnsealedProposalIsRefused() {
++    final World w = world();
++    final Optional refusal =
++        w.enforcement().refusal(ARMED_FROM, ROUND, PROPOSER_0, DIGEST, Optional.empty());
++    assertThat(refusal).isPresent();
++    assertThat(refusal.get()).contains("carries NO post-quantum seal");
++  }
++
++  // ---------------------------------------------------------------------------------------------
++  // 3. A GOOD seal from the proposer passes.
++  // ---------------------------------------------------------------------------------------------
++  @Test
++  void aGoodSealFromTheProposerPasses() {
++    final World w = world();
++    assertThat(w.enforcement().refusal(ARMED_FROM, ROUND, PROPOSER_0, DIGEST, Optional.of(w.valid0())))
++        .isEmpty();
++  }
++
++  // ---------------------------------------------------------------------------------------------
++  // 4. The same seal, a different author: it does not vouch for somebody else.
++  // ---------------------------------------------------------------------------------------------
++  @Test
++  void aSealDoesNotVouchForAnotherProposer() {
++    final World w = world();
++    final Optional refusal =
++        w.enforcement().refusal(ARMED_FROM, ROUND, VALIDATOR_1, DIGEST, Optional.of(w.valid0()));
++    assertThat(refusal).isPresent();
++    assertThat(refusal.get()).contains("cannot vouch for someone else's proposal");
++  }
++
++  // ---------------------------------------------------------------------------------------------
++  // 5. DOMAIN SEPARATION, in both directions that matter here: a seal given HONESTLY over the
++  //    PREPARE message, and one over the COMMIT message, must not pass as a PROPOSAL seal. Either
++  //    passing would make honest seals transferable between an offer and a vote.
++  // ---------------------------------------------------------------------------------------------
++  @Test
++  void aSealOverThePREPAREMessageDoesNotPassAsPROPOSAL() {
++    final World w = world();
++    final Bytes32 prepareMsg = PqAnchor.prepareMessage(CHAIN_ID, ARMED_FROM, ROUND, DIGEST.getBytes());
++    final byte[] sig =
++        SealSchemes.FALCON_512.sign(w.k0().privateKey(), prepareMsg.toArray()).orElseThrow();
++
++    final Optional refusal =
++        w.enforcement()
++            .refusal(
++                ARMED_FROM, ROUND, PROPOSER_0, DIGEST, Optional.of(new FalconSeal(0, Bytes.wrap(sig))));
++    assertThat(refusal).isPresent();
++    assertThat(refusal.get()).contains("does NOT verify over the proposal message");
++  }
++
++  @Test
++  void aSealOverTheCOMMITMessageDoesNotPassAsPROPOSAL() {
++    final World w = world();
++    final Bytes32 commitMsg = PqAnchor.commitMessage(CHAIN_ID, ARMED_FROM, DIGEST.getBytes());
++    final byte[] sig =
++        SealSchemes.FALCON_512.sign(w.k0().privateKey(), commitMsg.toArray()).orElseThrow();
++
++    final Optional refusal =
++        w.enforcement()
++            .refusal(
++                ARMED_FROM, ROUND, PROPOSER_0, DIGEST, Optional.of(new FalconSeal(0, Bytes.wrap(sig))));
++    assertThat(refusal).isPresent();
++    assertThat(refusal.get()).contains("does NOT verify over the proposal message");
++  }
++
++  // ---------------------------------------------------------------------------------------------
++  // 6. The ROUND is in the preimage: a seal from a failed round does not open another one.
++  // ---------------------------------------------------------------------------------------------
++  @Test
++  void aSealFromAnotherROUNDDoesNotPass() {
++    final World w = world();
++    final byte[] sigOtherRound =
++        SealSchemes.FALCON_512
++            .sign(w.k0().privateKey(), proposalMessage(ARMED_FROM, ROUND + 1).toArray())
++            .orElseThrow();
++    final Optional refusal =
++        w.enforcement()
++            .refusal(
++                ARMED_FROM,
++                ROUND,
++                PROPOSER_0,
++                DIGEST,
++                Optional.of(new FalconSeal(0, Bytes.wrap(sigOtherRound))));
++    assertThat(refusal).isPresent();
++    assertThat(refusal.get()).contains("does NOT verify over the proposal message");
++  }
++
++  // ---------------------------------------------------------------------------------------------
++  // 7. An index the registry binds to nobody.
++  // ---------------------------------------------------------------------------------------------
++  @Test
++  void anUNBOUNDIndexDoesNotPass() {
++    final World w = world();
++    final Optional refusal =
++        w.enforcement()
++            .refusal(
++                ARMED_FROM,
++                ROUND,
++                PROPOSER_0,
++                DIGEST,
++                Optional.of(new FalconSeal(99, w.valid0().getSignature())));
++    assertThat(refusal).isPresent();
++    assertThat(refusal.get()).contains("is bound to null");
++  }
++
++  // ---------------------------------------------------------------------------------------------
++  // 8. CONFIGURATION: absent = disarmed; a mistyped value = REFUSAL, never a silent disarming.
++  // ---------------------------------------------------------------------------------------------
++  @Test
++  void withoutThePropertyTheEnforcementIsNULL() {
++    assertThat(PqProposalEnforcement.fromSystemConfig()).isNull();
++  }
++
++  @Test
++  void aGoodValueArms() {
++    System.setProperty(PqProposalEnforcement.PROPERTY_FORK_BLOCK, "1234567");
++    final PqProposalEnforcement e = PqProposalEnforcement.fromSystemConfig();
++    assertThat(e).isNotNull();
++    assertThat(e.armedAt(1_234_566L)).isFalse();
++    assertThat(e.armedAt(1_234_567L)).isTrue();
++  }
++
++  @Test
++  void aMISTYPEDValueRefusesLoudly() {
++    for (final String bad : new String[] {"not-a-number", "1_234_567", "-1", "1e6"}) {
++      System.setProperty(PqProposalEnforcement.PROPERTY_FORK_BLOCK, bad);
++      assertThatThrownBy(PqProposalEnforcement::fromSystemConfig)
++          .as("the value '%s'", bad)
++          .isInstanceOf(IllegalStateException.class)
++          .hasMessageContaining("AERE-PQC-PROPOSAL-ENF-01");
++    }
++  }
++
++  @Test
++  void theENFORCEMENTGateIsNotTheEMISSIONGate() {
++    // Two distinct properties: a fleet can EMIT for months before anything ENFORCES. If they were
++    // one switch, the first node that started emitting would also start refusing - a flag day.
++    assertThat(PqProposalEnforcement.PROPERTY_FORK_BLOCK)
++        .isNotEqualTo("aere.pq.proposalPq.attachBlock");
++  }
++}
+diff --git a/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqRoundChangeEnforcementTest.java b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqRoundChangeEnforcementTest.java
+new file mode 100755
+index 000000000..5e6b486ab
+--- /dev/null
++++ b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqRoundChangeEnforcementTest.java
+@@ -0,0 +1,422 @@
++/*
++ * Copyright contributors to Besu.
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
++ * the License. You may obtain a copy of the License at
++ *
++ * http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
++ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
++ * specific language governing permissions and limitations under the License.
++ *
++ * SPDX-License-Identifier: Apache-2.0
++ */
++package org.hyperledger.besu.consensus.qbft.core.validation;
++
++import static org.assertj.core.api.Assertions.assertThat;
++import static org.assertj.core.api.Assertions.assertThatThrownBy;
++
++import org.hyperledger.besu.consensus.common.bft.FalconSeal;
++import org.hyperledger.besu.consensus.common.bft.PqAnchor;
++import org.hyperledger.besu.consensus.common.bft.PqSignerRegistry;
++import org.hyperledger.besu.consensus.common.bft.SealScheme;
++import org.hyperledger.besu.consensus.common.bft.SealSchemes;
++import org.hyperledger.besu.consensus.qbft.core.payload.PreparedRoundMetadata;
++import org.hyperledger.besu.crypto.SecureRandomProvider;
++import org.hyperledger.besu.datatypes.Address;
++import org.hyperledger.besu.datatypes.Hash;
++
++import java.security.SecureRandom;
++import java.util.Map;
++import java.util.Optional;
++
++import org.apache.tuweni.bytes.Bytes;
++import org.apache.tuweni.bytes.Bytes32;
++import org.junit.jupiter.api.AfterEach;
++import org.junit.jupiter.api.Test;
++
++/**
++ * ROUND-CHANGE ENFORCEMENT. The structure follows PqProposalEnforcementTest deliberately - the
++ * same ways of being wrong, each with the test that closes it, plus the one that is round-change
++ * specific: the PREPARED METADATA is in the preimage, so a seal from a bare round-change cannot be
++ * replayed onto one that claims a prepared block, in either direction.
++ *
++ * 
          
++ *   
        1. below the arming height NOTHING changes - the condition for the binary to sit on the fleet;
++ *   
        2. above it, a ROUND-CHANGE without a seal is refused;
++ *   
        3. a seal from ANOTHER validator does not vouch for this author;
++ *   
        4. a seal over a DIFFERENT MESSAGE does not pass - tested against the PREPARE, COMMIT and
++ *       PROPOSAL messages, because a round-change seal that passed under any of those domains
++ *       would let an honest seal be replayed as a different kind of assertion;
++ *   
        5. a seal from a DIFFERENT TARGET ROUND does not pass;
++ *   
        6. a seal from a BARE round-change does not pass on one claiming a prepared block, and vice
++ *       versa;
++ *   
        7. an index the registry binds to nobody does not pass;
++ *   
        8. a mistyped configuration REFUSES, it does not disarm;
++ *   
        9. the enforcement gate and the emission gate are two different switches.
++ * 
        
++ *
++ * 
        The keys are REAL Falcon keys, generated in-process, and verification goes through the real
++ * scheme. A test with fake signatures would prove that we can compare strings, not that the
++ * enforcement enforces.
++ */
++class PqRoundChangeEnforcementTest {
++
++  private static final long ARMED_FROM = 1_000_000L;
++  private static final int TARGET_ROUND = 3;
++  private static final Address AUTHOR_0 = Address.fromHexString("0x" + "aa".repeat(20));
++  private static final Address VALIDATOR_1 = Address.fromHexString("0x" + "bb".repeat(20));
++  private static final Hash PREPARED_DIGEST = Hash.hash(Bytes.of(8, 8, 8));
++  private static final long CHAIN_ID = 2800L;
++
++  private final SecureRandom random = SecureRandomProvider.createSecureRandom();
++
++  @AfterEach
++  void clearProperty() {
++    System.clearProperty(PqRoundChangeEnforcement.PROPERTY_FORK_BLOCK);
++  }
++
++  /** Test registry: programmed index-to-address bindings + verification through the REAL scheme. */
++  private static final class TestRegistry implements PqSignerRegistry {
++    final Map bindings;
++    final Map keys;
++
++    TestRegistry(final Map bindings, final Map keys) {
++      this.bindings = bindings;
++      this.keys = keys;
++    }
++
++    @Override
++    public Address addressForIndexAtHistoric(final long blockNumber, final int validatorIndex) {
++      return bindings.get(validatorIndex);
++    }
++
++    @Override
++    public Address addressForIndexAtOwnHead(final long blockNumber, final int validatorIndex) {
++      return bindings.get(validatorIndex);
++    }
++
++    @Override
++    public boolean verifyAtHistoric(
++        final long blockNumber, final int validatorIndex, final Bytes message, final Bytes signature) {
++      return verifyAtOwnHead(blockNumber, validatorIndex, message, signature);
++    }
++
++    @Override
++    public boolean verifyAtOwnHead(
++        final long blockNumber, final int validatorIndex, final Bytes message, final Bytes signature) {
++      final byte[] pk = keys.get(validatorIndex);
++      if (pk == null) {
++        return false;
++      }
++      return SealSchemes.FALCON_512.verifyRaw(pk, message.toArray(), signature.toArray());
++    }
++  }
++
++  private record World(
++      PqRoundChangeEnforcement enforcement,
++      FalconSeal validBare0,
++      SealScheme.GeneratedPair k0,
++      SealScheme.GeneratedPair k1) {}
++
++  private Bytes32 bareMessage(final long h, final int targetRound) {
++    return PqAnchor.roundChangeMessage(CHAIN_ID, h, targetRound);
++  }
++
++  private Bytes32 preparedMessage(final long h, final int targetRound, final int preparedRound) {
++    return PqAnchor.roundChangeMessage(
++        CHAIN_ID, h, targetRound, preparedRound, PREPARED_DIGEST.getBytes());
++  }
++
++  private static Optional preparedMetadata(final int preparedRound) {
++    return Optional.of(new PreparedRoundMetadata(PREPARED_DIGEST, preparedRound));
++  }
++
++  /** Two validators with real Falcon keys; validator 0's seal over the BARE round-change message. */
++  private World world() {
++    final SealScheme.GeneratedPair k0 = SealSchemes.FALCON_512.generate(random);
++    final SealScheme.GeneratedPair k1 = SealSchemes.FALCON_512.generate(random);
++    final byte[] sig0 =
++        SealSchemes.FALCON_512
++            .sign(k0.privateKey(), bareMessage(ARMED_FROM, TARGET_ROUND).toArray())
++            .orElseThrow();
++    final TestRegistry reg =
++        new TestRegistry(
++            Map.of(0, AUTHOR_0, 1, VALIDATOR_1),
++            Map.of(0, k0.publicRegistryForm(), 1, k1.publicRegistryForm()));
++    return new World(
++        new PqRoundChangeEnforcement(ARMED_FROM, reg, CHAIN_ID),
++        new FalconSeal(0, Bytes.wrap(sig0)),
++        k0,
++        k1);
++  }
++
++  // ---------------------------------------------------------------------------------------------
++  // 1. BELOW the arming height NOTHING changes. The condition for the binary to sit on the fleet.
++  // ---------------------------------------------------------------------------------------------
++  @Test
++  void belowTheArmingHeightAnUnsealedRoundChangeIsAccepted() {
++    final World w = world();
++    assertThat(w.enforcement().armedAt(ARMED_FROM - 1)).isFalse();
++    assertThat(
++            w.enforcement()
++                .refusal(ARMED_FROM - 1, TARGET_ROUND, AUTHOR_0, Optional.empty(), Optional.empty()))
++        .isEmpty();
++  }
++
++  // ---------------------------------------------------------------------------------------------
++  // 2. ABOVE it, a ROUND-CHANGE without a seal is refused.
++  // ---------------------------------------------------------------------------------------------
++  @Test
++  void aboveTheHeightAnUnsealedRoundChangeIsRefused() {
++    final World w = world();
++    final Optional refusal =
++        w.enforcement()
++            .refusal(ARMED_FROM, TARGET_ROUND, AUTHOR_0, Optional.empty(), Optional.empty());
++    assertThat(refusal).isPresent();
++    assertThat(refusal.get()).contains("carries NO post-quantum seal");
++  }
++
++  // ---------------------------------------------------------------------------------------------
++  // 3. A GOOD seal from the author passes - bare, and with prepared metadata.
++  // ---------------------------------------------------------------------------------------------
++  @Test
++  void aGoodSealFromTheAuthorPasses() {
++    final World w = world();
++    assertThat(
++            w.enforcement()
++                .refusal(
++                    ARMED_FROM,
++                    TARGET_ROUND,
++                    AUTHOR_0,
++                    Optional.empty(),
++                    Optional.of(w.validBare0())))
++        .isEmpty();
++  }
++
++  @Test
++  void aGoodSealOverPreparedMetadataPasses() {
++    final World w = world();
++    final byte[] sig =
++        SealSchemes.FALCON_512
++            .sign(w.k0().privateKey(), preparedMessage(ARMED_FROM, TARGET_ROUND, 1).toArray())
++            .orElseThrow();
++    assertThat(
++            w.enforcement()
++                .refusal(
++                    ARMED_FROM,
++                    TARGET_ROUND,
++                    AUTHOR_0,
++                    preparedMetadata(1),
++                    Optional.of(new FalconSeal(0, Bytes.wrap(sig)))))
++        .isEmpty();
++  }
++
++  // ---------------------------------------------------------------------------------------------
++  // 4. The same seal, a different author: it does not vouch for somebody else.
++  // ---------------------------------------------------------------------------------------------
++  @Test
++  void aSealDoesNotVouchForAnotherAuthor() {
++    final World w = world();
++    final Optional refusal =
++        w.enforcement()
++            .refusal(
++                ARMED_FROM, TARGET_ROUND, VALIDATOR_1, Optional.empty(), Optional.of(w.validBare0()));
++    assertThat(refusal).isPresent();
++    assertThat(refusal.get()).contains("cannot vouch for someone else's round-change");
++  }
++
++  // ---------------------------------------------------------------------------------------------
++  // 5. DOMAIN SEPARATION against all three sibling domains: a seal given HONESTLY over the
++  //    PREPARE, COMMIT or PROPOSAL message must not pass as a ROUND-CHANGE seal.
++  // ---------------------------------------------------------------------------------------------
++  @Test
++  void aSealOverThePREPAREMessageDoesNotPassAsROUNDCHANGE() {
++    final World w = world();
++    final Bytes32 prepareMsg =
++        PqAnchor.prepareMessage(CHAIN_ID, ARMED_FROM, TARGET_ROUND, PREPARED_DIGEST.getBytes());
++    final byte[] sig =
++        SealSchemes.FALCON_512.sign(w.k0().privateKey(), prepareMsg.toArray()).orElseThrow();
++
++    final Optional refusal =
++        w.enforcement()
++            .refusal(
++                ARMED_FROM,
++                TARGET_ROUND,
++                AUTHOR_0,
++                Optional.empty(),
++                Optional.of(new FalconSeal(0, Bytes.wrap(sig))));
++    assertThat(refusal).isPresent();
++    assertThat(refusal.get()).contains("does NOT verify over the round-change message");
++  }
++
++  @Test
++  void aSealOverTheCOMMITMessageDoesNotPassAsROUNDCHANGE() {
++    final World w = world();
++    final Bytes32 commitMsg = PqAnchor.commitMessage(CHAIN_ID, ARMED_FROM, PREPARED_DIGEST.getBytes());
++    final byte[] sig =
++        SealSchemes.FALCON_512.sign(w.k0().privateKey(), commitMsg.toArray()).orElseThrow();
++
++    final Optional refusal =
++        w.enforcement()
++            .refusal(
++                ARMED_FROM,
++                TARGET_ROUND,
++                AUTHOR_0,
++                Optional.empty(),
++                Optional.of(new FalconSeal(0, Bytes.wrap(sig))));
++    assertThat(refusal).isPresent();
++    assertThat(refusal.get()).contains("does NOT verify over the round-change message");
++  }
++
++  @Test
++  void aSealOverThePROPOSALMessageDoesNotPassAsROUNDCHANGE() {
++    final World w = world();
++    final Bytes32 proposalMsg =
++        PqAnchor.proposalMessage(CHAIN_ID, ARMED_FROM, TARGET_ROUND, PREPARED_DIGEST.getBytes());
++    final byte[] sig =
++        SealSchemes.FALCON_512.sign(w.k0().privateKey(), proposalMsg.toArray()).orElseThrow();
++
++    final Optional refusal =
++        w.enforcement()
++            .refusal(
++                ARMED_FROM,
++                TARGET_ROUND,
++                AUTHOR_0,
++                Optional.empty(),
++                Optional.of(new FalconSeal(0, Bytes.wrap(sig))));
++    assertThat(refusal).isPresent();
++    assertThat(refusal.get()).contains("does NOT verify over the round-change message");
++  }
++
++  // ---------------------------------------------------------------------------------------------
++  // 6. The TARGET ROUND is in the preimage: a seal towards one round does not open another.
++  // ---------------------------------------------------------------------------------------------
++  @Test
++  void aSealTowardsAnotherTARGETROUNDDoesNotPass() {
++    final World w = world();
++    final byte[] sigOtherRound =
++        SealSchemes.FALCON_512
++            .sign(w.k0().privateKey(), bareMessage(ARMED_FROM, TARGET_ROUND + 1).toArray())
++            .orElseThrow();
++    final Optional refusal =
++        w.enforcement()
++            .refusal(
++                ARMED_FROM,
++                TARGET_ROUND,
++                AUTHOR_0,
++                Optional.empty(),
++                Optional.of(new FalconSeal(0, Bytes.wrap(sigOtherRound))));
++    assertThat(refusal).isPresent();
++    assertThat(refusal.get()).contains("does NOT verify over the round-change message");
++  }
++
++  // ---------------------------------------------------------------------------------------------
++  // 7. THE ROUND-CHANGE-SPECIFIC CASE: the prepared metadata is in the preimage, in BOTH
++  //    directions. A bare seal on a message claiming a prepared block would let an adversary take
++  //    an honest "just move on" and turn it into "move on AND re-propose THIS block".
++  // ---------------------------------------------------------------------------------------------
++  @Test
++  void aBareSealDoesNotPassOnARoundChangeClaimingAPreparedBlock() {
++    final World w = world();
++    final Optional refusal =
++        w.enforcement()
++            .refusal(
++                ARMED_FROM, TARGET_ROUND, AUTHOR_0, preparedMetadata(1), Optional.of(w.validBare0()));
++    assertThat(refusal).isPresent();
++    assertThat(refusal.get()).contains("does NOT verify over the round-change message");
++  }
++
++  @Test
++  void aPreparedSealDoesNotPassOnABareRoundChange() {
++    final World w = world();
++    final byte[] sigPrepared =
++        SealSchemes.FALCON_512
++            .sign(w.k0().privateKey(), preparedMessage(ARMED_FROM, TARGET_ROUND, 1).toArray())
++            .orElseThrow();
++    final Optional refusal =
++        w.enforcement()
++            .refusal(
++                ARMED_FROM,
++                TARGET_ROUND,
++                AUTHOR_0,
++                Optional.empty(),
++                Optional.of(new FalconSeal(0, Bytes.wrap(sigPrepared))));
++    assertThat(refusal).isPresent();
++    assertThat(refusal.get()).contains("does NOT verify over the round-change message");
++  }
++
++  @Test
++  void aSealOverDifferentPreparedMetadataDoesNotPass() {
++    final World w = world();
++    final byte[] sigRound1 =
++        SealSchemes.FALCON_512
++            .sign(w.k0().privateKey(), preparedMessage(ARMED_FROM, TARGET_ROUND, 1).toArray())
++            .orElseThrow();
++    final Optional refusal =
++        w.enforcement()
++            .refusal(
++                ARMED_FROM,
++                TARGET_ROUND,
++                AUTHOR_0,
++                preparedMetadata(2),
++                Optional.of(new FalconSeal(0, Bytes.wrap(sigRound1))));
++    assertThat(refusal).isPresent();
++    assertThat(refusal.get()).contains("does NOT verify over the round-change message");
++  }
++
++  // ---------------------------------------------------------------------------------------------
++  // 8. An index the registry binds to nobody.
++  // ---------------------------------------------------------------------------------------------
++  @Test
++  void anUNBOUNDIndexDoesNotPass() {
++    final World w = world();
++    final Optional refusal =
++        w.enforcement()
++            .refusal(
++                ARMED_FROM,
++                TARGET_ROUND,
++                AUTHOR_0,
++                Optional.empty(),
++                Optional.of(new FalconSeal(99, w.validBare0().getSignature())));
++    assertThat(refusal).isPresent();
++    assertThat(refusal.get()).contains("is bound to null");
++  }
++
++  // ---------------------------------------------------------------------------------------------
++  // 9. CONFIGURATION: absent = disarmed; a mistyped value = REFUSAL, never a silent disarming.
++  // ---------------------------------------------------------------------------------------------
++  @Test
++  void withoutThePropertyTheEnforcementIsNULL() {
++    assertThat(PqRoundChangeEnforcement.fromSystemConfig()).isNull();
++  }
++
++  @Test
++  void aGoodValueArms() {
++    System.setProperty(PqRoundChangeEnforcement.PROPERTY_FORK_BLOCK, "1234567");
++    final PqRoundChangeEnforcement e = PqRoundChangeEnforcement.fromSystemConfig();
++    assertThat(e).isNotNull();
++    assertThat(e.armedAt(1_234_566L)).isFalse();
++    assertThat(e.armedAt(1_234_567L)).isTrue();
++  }
++
++  @Test
++  void aMISTYPEDValueRefusesLoudly() {
++    for (final String bad : new String[] {"not-a-number", "1_234_567", "-1", "1e6"}) {
++      System.setProperty(PqRoundChangeEnforcement.PROPERTY_FORK_BLOCK, bad);
++      assertThatThrownBy(PqRoundChangeEnforcement::fromSystemConfig)
++          .as("the value '%s'", bad)
++          .isInstanceOf(IllegalStateException.class)
++          .hasMessageContaining("AERE-PQC-ROUNDCHANGE-ENF-01");
++    }
++  }
++
++  @Test
++  void theENFORCEMENTGateIsNotTheEMISSIONGate() {
++    // Two distinct properties: a fleet can EMIT for months before anything ENFORCES. If they were
++    // one switch, the first node that started emitting would also start refusing - a flag day.
++    assertThat(PqRoundChangeEnforcement.PROPERTY_FORK_BLOCK)
++        .isNotEqualTo("aere.pq.roundChangePq.attachBlock");
++  }
++}
+diff --git a/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqTransportIndependenceTest.java b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqTransportIndependenceTest.java
+new file mode 100755
+index 000000000..a276d30f5
+--- /dev/null
++++ b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PqTransportIndependenceTest.java
+@@ -0,0 +1,437 @@
++/*
++ * Copyright contributors to Besu.
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
++ * the License. You may obtain a copy of the License at
++ *
++ * http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
++ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
++ * specific language governing permissions and limitations under the License.
++ *
++ * SPDX-License-Identifier: Apache-2.0
++ */
++package org.hyperledger.besu.consensus.qbft.core.validation;
++
++import static org.assertj.core.api.Assertions.assertThat;
++
++import org.hyperledger.besu.consensus.common.bft.ConsensusRoundIdentifier;
++import org.hyperledger.besu.consensus.common.bft.FalconSeal;
++import org.hyperledger.besu.consensus.common.bft.PqAnchor;
++import org.hyperledger.besu.consensus.common.bft.PqSignerRegistry;
++import org.hyperledger.besu.consensus.common.bft.SealScheme;
++import org.hyperledger.besu.consensus.common.bft.SealSchemes;
++import org.hyperledger.besu.consensus.qbft.core.payload.PreparedRoundMetadata;
++import org.hyperledger.besu.crypto.SecureRandomProvider;
++import org.hyperledger.besu.datatypes.Address;
++import org.hyperledger.besu.datatypes.Hash;
++
++import java.security.SecureRandom;
++import java.util.Map;
++import java.util.Optional;
++
++import org.apache.tuweni.bytes.Bytes;
++import org.apache.tuweni.bytes.Bytes32;
++import org.junit.jupiter.api.Test;
++
++/**
++ * THE ADVERSARY WHO ALREADY HAS THE VALIDATOR'S ECDSA KEY, and still cannot move the chain.
++ *
++ * 
        WHY THIS TEST IS THE ONE THAT MATTERS. The network transport (RLPx/ECIES) authenticates
++ * a peer by its secp256k1 node key, and {@code ValidatorPeers} routes consensus messages by the
++ * address derived from that same key. A quantum adversary who recovers a validator's ECDSA key
++ * therefore gets EVERYTHING the transport can give: it completes the handshake as that validator,
++ * is routed consensus traffic as that validator, and signs syntactically perfect QBFT messages that
++ * recover to that validator's address. Every check that predates the post-quantum layers passes for
++ * it.
++ *
++ * 
        The question this test answers, by measurement rather than by argument: with the
++ * post-quantum enforcement armed, does that adversary gain anything at all? It models exactly
++ * that adversary - full ECDSA compromise, no Falcon key - and requires all four hot-path messages
++ * to be refused. That is what "consensus safety does not depend on the transport" means concretely,
++ * and it is the honest form of the claim: not that the transport is post-quantum (it is not), but
++ * that breaking it does not buy a break of safety.
++ *
++ * 
        THE CONTROLS, without which the refusals would prove nothing:
++ *
++ * 
          
++ *   
        1. DISARMED: the very same messages from the very same adversary are ACCEPTED when the
++ *       enforcement is not armed. Without this, the refusals could come from any unrelated defect
++ *       in the fixture and the test would be measuring its own mistake.
++ *   
        2. THE HONEST VALIDATOR: a message carrying a VALID Falcon seal is accepted while armed. So
++ *       the refusal is caused by the missing seal, not by arming per se - otherwise an enforcement
++ *       that refuses everything would look identical to one that enforces.
++ *   
        3. THE HARVESTED SEAL, in four flavours, because a broken transport hands the adversary the
++ *       victim's entire message history to replay: a seal from another message KIND, one for
++ *       another BLOCK at the same height and round, one from another HEIGHT, ROUND or CHAIN, and
++ *       one belonging to ANOTHER VALIDATOR entirely, stapled onto the adversary's own message.
++ * 
        
++ *
++ * 
        TWO OF THOSE CONTROLS EXIST BECAUSE THE NEGATIVE CONTROL CAUGHT THEIR ABSENCE
++ * (2026-08-31, {@code PROBA-CONTROL-INDEPENDENTA-TRANSPORT.sh}). The first version of this test
++ * passed with 8 green assertions, and stayed green under two planted defects: the digest removed
++ * from the signed preimage, and the index-to-author binding removed. Both were invisible because
++ * every replay it tried crossed a domain boundary, and because its registry held a single
++ * validator - so the two attacks a broken transport most directly enables could not even be
++ * expressed. Green, running, and blind. That is the whole reason a proof has to be shown red.
++ *
++ * 
        WHAT THIS DOES NOT PROVE, said plainly: nothing here is about LIVENESS. An adversary
++ * with a validator's ECDSA key can still occupy the connection slot, eclipse a peer, or flood it;
++ * those are denial-of-service questions and this test says nothing about them. It also says
++ * nothing about the fleet as configured today, where the enforcement heights are unset - the
++ * property proven is the property of the ARMED configuration.
++ */
++class PqTransportIndependenceTest {
++
++  private static final long H = 1_000L;
++  private static final int ROUND = 2;
++  private static final long CHAIN_ID = 2800L;
++
++  /** The validator whose ECDSA key the adversary has stolen. */
++  private static final Address VICTIM = Address.fromHexString("0x" + "dd".repeat(20));
++
++  /**
++   * A SECOND, uncompromised validator. It exists because of what the negative control measured:
++   * with a single-validator registry, the scenario "the adversary staples someone else's seal -
++   * one it overheard on the broken wire - onto its own message" cannot even be expressed, and the
++   * planted removal of the index-to-author binding left the whole test GREEN. A test that cannot
++   * express the attack does not measure it.
++   */
++  private static final Address OTHER = Address.fromHexString("0x" + "ee".repeat(20));
++
++  private static final Hash DIGEST = Hash.hash(Bytes.of(4, 2));
++
++  /**
++   * A DIFFERENT block digest at the same height and round. Also added after the negative control:
++   * every replay the first version tried crossed a DOMAIN boundary, so nothing required the
++   * digest itself to be under the seal - and the planted removal of the digest from the preimage
++   * went unnoticed. That removal is the difference between "this validator voted" and "this
++   * validator voted FOR THIS BLOCK".
++   */
++  private static final Hash OTHER_DIGEST = Hash.hash(Bytes.of(7, 7));
++
++  private static final Hash COMMIT_DIGEST = Hash.hash(Bytes.of(4, 3));
++
++  private final SecureRandom random = SecureRandomProvider.createSecureRandom();
++
++  /** The victim's Falcon key pair - held by the HONEST node, never by the adversary. */
++  private final SealScheme.GeneratedPair victimPq = SealSchemes.FALCON_512.generate(random);
++
++  /** The second validator's Falcon key pair - likewise never in the adversary's hands. */
++  private final SealScheme.GeneratedPair otherPq = SealSchemes.FALCON_512.generate(random);
++
++  /** A registry binding index 0 to the victim and index 1 to the other validator. */
++  private final PqSignerRegistry registry =
++      new PqSignerRegistry() {
++        private final Map bindings = Map.of(0, VICTIM, 1, OTHER);
++        private final Map keys =
++            Map.of(0, victimPq.publicRegistryForm(), 1, otherPq.publicRegistryForm());
++
++        @Override
++        public Address addressForIndexAtHistoric(final long blockNumber, final int validatorIndex) {
++          return bindings.get(validatorIndex);
++        }
++
++        @Override
++        public Address addressForIndexAtOwnHead(final long blockNumber, final int validatorIndex) {
++          return bindings.get(validatorIndex);
++        }
++
++        @Override
++        public boolean verifyAtHistoric(
++            final long blockNumber, final int validatorIndex, final Bytes message, final Bytes signature) {
++          return verifyAtOwnHead(blockNumber, validatorIndex, message, signature);
++        }
++
++        @Override
++        public boolean verifyAtOwnHead(
++            final long blockNumber, final int validatorIndex, final Bytes message, final Bytes signature) {
++          final byte[] pk = keys.get(validatorIndex);
++          return pk != null
++              && SealSchemes.FALCON_512.verifyRaw(pk, message.toArray(), signature.toArray());
++        }
++      };
++
++  /** A seal the HONEST victim would produce for the given message. */
++  private FalconSeal honestSeal(final Bytes32 message) {
++    final byte[] sig =
++        SealSchemes.FALCON_512.sign(victimPq.privateKey(), message.toArray()).orElseThrow();
++    return new FalconSeal(0, Bytes.wrap(sig));
++  }
++
++  /**
++   * A seal the OTHER honest validator would produce - the kind the adversary can hear on a broken
++   * wire and would like to reuse as its own.
++   */
++  private FalconSeal otherValidatorSeal(final Bytes32 message) {
++    final byte[] sig =
++        SealSchemes.FALCON_512.sign(otherPq.privateKey(), message.toArray()).orElseThrow();
++    return new FalconSeal(1, Bytes.wrap(sig));
++  }
++
++  private Bytes32 prepareMsg() {
++    return PqAnchor.prepareMessage(CHAIN_ID, H, ROUND, DIGEST.getBytes());
++  }
++
++  private Bytes32 proposalMsg() {
++    return PqAnchor.proposalMessage(CHAIN_ID, H, ROUND, DIGEST.getBytes());
++  }
++
++  /**
++   * The commit layer is the OLDEST of the four and its seal covers the commit digest DIRECTLY,
++   * without a domain-separated preimage - measured in {@code PqCommitEnforcement.falconRefusal},
++   * not assumed. It is written out here rather than papered over: a test that signed a
++   * domain-separated message for commit would be testing a layer we do not have, and would fail
++   * for a reason that has nothing to do with the adversary being modelled.
++   */
++  private Bytes32 commitMsg() {
++    return Bytes32.wrap(COMMIT_DIGEST.getBytes());
++  }
++
++  private Bytes32 roundChangeMsg() {
++    return PqAnchor.roundChangeMessage(CHAIN_ID, H, ROUND);
++  }
++
++  // The four enforcements, armed at H. The adversary's messages recover to VICTIM, because the
++  // adversary holds VICTIM's ECDSA key: the author argument below is deliberately VICTIM.
++  private PqPrepareEnforcement prepareArmed() {
++    return new PqPrepareEnforcement(H, registry, CHAIN_ID);
++  }
++
++  private PqProposalEnforcement proposalArmed() {
++    return new PqProposalEnforcement(H, registry, CHAIN_ID);
++  }
++
++  private PqCommitEnforcement commitArmed() {
++    return new PqCommitEnforcement(H, registry);
++  }
++
++  private PqRoundChangeEnforcement roundChangeArmed() {
++    return new PqRoundChangeEnforcement(H, registry, CHAIN_ID);
++  }
++
++  // -----------------------------------------------------------------------------------------
++  // THE MEASUREMENT: full ECDSA compromise, no Falcon key. All four messages refused.
++  // -----------------------------------------------------------------------------------------
++
++  @Test
++  void aStolenECDSAKeyBuysNOPrepare() {
++    final Optional refusal =
++        prepareArmed().refusal(H, ROUND, VICTIM, DIGEST, Optional.empty());
++    assertThat(refusal)
++        .describedAs("an adversary holding the victim's ECDSA key must not be able to vote")
++        .isPresent();
++    assertThat(refusal.get()).contains("carries NO post-quantum seal");
++  }
++
++  @Test
++  void aStolenECDSAKeyBuysNOProposal() {
++    final Optional refusal =
++        proposalArmed().refusal(H, ROUND, VICTIM, DIGEST, Optional.empty());
++    assertThat(refusal).isPresent();
++    assertThat(refusal.get()).contains("carries NO post-quantum seal");
++  }
++
++  @Test
++  void aStolenECDSAKeyBuysNOCommit() {
++    final Optional refusal =
++        commitArmed().refusal(H, VICTIM, COMMIT_DIGEST, Optional.empty());
++    assertThat(refusal).isPresent();
++  }
++
++  @Test
++  void aStolenECDSAKeyBuysNORoundChange() {
++    final Optional refusal =
++        roundChangeArmed().refusal(H, ROUND, VICTIM, Optional.empty(), Optional.empty());
++    assertThat(refusal).isPresent();
++    assertThat(refusal.get()).contains("carries NO post-quantum seal");
++  }
++
++  // -----------------------------------------------------------------------------------------
++  // CONTROL 1 - DISARMED: the very same messages pass. The refusals above are caused by the
++  // arming, not by something broken in this fixture.
++  // -----------------------------------------------------------------------------------------
++
++  @Test
++  void controlDISARMEDtheSameMessagesArePerfectlyValid() {
++    final long never = Long.MAX_VALUE;
++    assertThat(
++            new PqPrepareEnforcement(never, registry, CHAIN_ID)
++                .refusal(H, ROUND, VICTIM, DIGEST, Optional.empty()))
++        .isEmpty();
++    assertThat(
++            new PqProposalEnforcement(never, registry, CHAIN_ID)
++                .refusal(H, ROUND, VICTIM, DIGEST, Optional.empty()))
++        .isEmpty();
++    assertThat(
++            new PqCommitEnforcement(never, registry)
++                .refusal(H, VICTIM, COMMIT_DIGEST, Optional.empty()))
++        .isEmpty();
++    assertThat(
++            new PqRoundChangeEnforcement(never, registry, CHAIN_ID)
++                .refusal(H, ROUND, VICTIM, Optional.empty(), Optional.empty()))
++        .isEmpty();
++  }
++
++  // -----------------------------------------------------------------------------------------
++  // CONTROL 2 - THE HONEST VALIDATOR still works while armed. Otherwise "refuses everything"
++  // would be indistinguishable from "enforces".
++  // -----------------------------------------------------------------------------------------
++
++  @Test
++  void controlTheHONESTvalidatorPassesOnAllFourMessagesWhileArmed() {
++    assertThat(
++            prepareArmed().refusal(H, ROUND, VICTIM, DIGEST, Optional.of(honestSeal(prepareMsg()))))
++        .isEmpty();
++    assertThat(
++            proposalArmed()
++                .refusal(H, ROUND, VICTIM, DIGEST, Optional.of(honestSeal(proposalMsg()))))
++        .isEmpty();
++    assertThat(commitArmed().refusal(H, VICTIM, COMMIT_DIGEST, Optional.of(honestSeal(commitMsg()))))
++        .isEmpty();
++    assertThat(
++            roundChangeArmed()
++                .refusal(
++                    H, ROUND, VICTIM, Optional.empty(), Optional.of(honestSeal(roundChangeMsg()))))
++        .isEmpty();
++  }
++
++  // -----------------------------------------------------------------------------------------
++  // CONTROL 3 - THE STOLEN SEAL. A broken transport lets the adversary READ every message the
++  // victim ever sent, so it can replay any seal it has seen. Each seal is bound to its own
++  // message, so a seal harvested from one message must not authenticate another. This is the
++  // control that turns "the adversary has no key" into "eavesdropping does not substitute for
++  // one" - and it is checked ACROSS message kinds (domain separation) and WITHIN a kind
++  // (a round-change seal replayed onto a claim of a prepared block).
++  // -----------------------------------------------------------------------------------------
++
++  @Test
++  void controlASealHARVESTEDfromAnotherMessageDoesNotAuthenticateThisOne() {
++    // a PREPARE seal, replayed on a PROPOSAL and on a ROUND-CHANGE
++    final FalconSeal harvestedPrepare = honestSeal(prepareMsg());
++    assertThat(proposalArmed().refusal(H, ROUND, VICTIM, DIGEST, Optional.of(harvestedPrepare)))
++        .isPresent();
++    assertThat(
++            roundChangeArmed()
++                .refusal(H, ROUND, VICTIM, Optional.empty(), Optional.of(harvestedPrepare)))
++        .isPresent();
++
++    // a PROPOSAL seal, replayed as a vote
++    final FalconSeal harvestedProposal = honestSeal(proposalMsg());
++    assertThat(prepareArmed().refusal(H, ROUND, VICTIM, DIGEST, Optional.of(harvestedProposal)))
++        .isPresent();
++
++    // a bare ROUND-CHANGE seal, replayed on one that claims a prepared block: same kind, different
++    // assertion, and the metadata is in the preimage precisely so this fails
++    final FalconSeal harvestedRoundChange = honestSeal(roundChangeMsg());
++    assertThat(
++            roundChangeArmed()
++                .refusal(
++                    H,
++                    ROUND,
++                    VICTIM,
++                    Optional.of(new PreparedRoundMetadata(DIGEST, 1)),
++                    Optional.of(harvestedRoundChange)))
++        .isPresent();
++  }
++
++  // -----------------------------------------------------------------------------------------
++  // CONTROL 3b - THE SEAL OF ANOTHER BLOCK, same kind, same height, same round. This is the
++  // difference between "this validator voted" and "this validator voted FOR THIS BLOCK", and it
++  // is the one an eavesdropper is best placed to exploit: on a broken wire it hears the victim's
++  // honest vote for block A and wants to turn it into a vote for block B.
++  //
++  // ADDED after the negative control caught its absence: every replay above crosses a DOMAIN
++  // boundary, so with the digest planted OUT of the signed message the whole test stayed GREEN.
++  // -----------------------------------------------------------------------------------------
++
++  @Test
++  void controlASealForANOTHERBLOCKDoesNotAuthenticateThisOne() {
++    final FalconSeal forOtherBlock =
++        honestSeal(PqAnchor.prepareMessage(CHAIN_ID, H, ROUND, OTHER_DIGEST.getBytes()));
++    assertThat(prepareArmed().refusal(H, ROUND, VICTIM, DIGEST, Optional.of(forOtherBlock)))
++        .describedAs("a vote for one block must not authenticate a vote for another")
++        .isPresent();
++
++    final FalconSeal proposalForOtherBlock =
++        honestSeal(PqAnchor.proposalMessage(CHAIN_ID, H, ROUND, OTHER_DIGEST.getBytes()));
++    assertThat(proposalArmed().refusal(H, ROUND, VICTIM, DIGEST, Optional.of(proposalForOtherBlock)))
++        .isPresent();
++
++    // and the commit layer, whose seal covers the commit digest directly
++    final FalconSeal commitForOtherBlock = honestSeal(Bytes32.wrap(OTHER_DIGEST.getBytes()));
++    assertThat(commitArmed().refusal(H, VICTIM, COMMIT_DIGEST, Optional.of(commitForOtherBlock)))
++        .isPresent();
++  }
++
++  // -----------------------------------------------------------------------------------------
++  // CONTROL 3c - SOMEONE ELSE'S SEAL, stapled on. The adversary hears validator 1's perfectly
++  // valid seal for the very message it wants to send, and attaches it to its own message - which
++  // recovers to the VICTIM, because that is the ECDSA key it stole. The seal is valid, the
++  // signature is valid, the author is a real validator: only the index-to-author binding stands
++  // between that and a counted vote.
++  //
++  // ADDED after the negative control: with a single-validator registry this attack could not even
++  // be written, and the planted removal of that binding left the test GREEN.
++  // -----------------------------------------------------------------------------------------
++
++  @Test
++  void controlSOMEONEELSESsealDoesNotAuthenticateTheAdversarysMessage() {
++    final FalconSeal theirs = otherValidatorSeal(prepareMsg());
++
++    // sanity: that seal really is valid FOR ITS OWN AUTHOR, or the refusal below would prove
++    // nothing about the binding and everything about a broken fixture
++    assertThat(prepareArmed().refusal(H, ROUND, OTHER, DIGEST, Optional.of(theirs)))
++        .describedAs("validator 1's own seal must work for validator 1")
++        .isEmpty();
++
++    // the attack: the same valid seal, on a message authored with the victim's stolen key
++    assertThat(prepareArmed().refusal(H, ROUND, VICTIM, DIGEST, Optional.of(theirs)))
++        .describedAs("a seal must not vouch for a message someone else authored")
++        .isPresent();
++
++    // the same, on the other three surfaces
++    assertThat(
++            proposalArmed()
++                .refusal(H, ROUND, VICTIM, DIGEST, Optional.of(otherValidatorSeal(proposalMsg()))))
++        .isPresent();
++    assertThat(
++            commitArmed()
++                .refusal(H, VICTIM, COMMIT_DIGEST, Optional.of(otherValidatorSeal(commitMsg()))))
++        .isPresent();
++    assertThat(
++            roundChangeArmed()
++                .refusal(
++                    H,
++                    ROUND,
++                    VICTIM,
++                    Optional.empty(),
++                    Optional.of(otherValidatorSeal(roundChangeMsg()))))
++        .isPresent();
++  }
++
++  // -----------------------------------------------------------------------------------------
++  // CONTROL 4 - A SEAL FROM ANOTHER HEIGHT OR ROUND. The transport gives the adversary the
++  // victim's whole message history, so the seals it can replay are not only from other kinds but
++  // from other positions in the chain.
++  // -----------------------------------------------------------------------------------------
++
++  @Test
++  void controlASealFromAnotherHEIGHTorROUNDDoesNotAuthenticateThisOne() {
++    final FalconSeal otherHeight =
++        honestSeal(PqAnchor.prepareMessage(CHAIN_ID, H + 1, ROUND, DIGEST.getBytes()));
++    assertThat(prepareArmed().refusal(H, ROUND, VICTIM, DIGEST, Optional.of(otherHeight)))
++        .isPresent();
++
++    final FalconSeal otherRound =
++        honestSeal(PqAnchor.prepareMessage(CHAIN_ID, H, ROUND + 1, DIGEST.getBytes()));
++    assertThat(prepareArmed().refusal(H, ROUND, VICTIM, DIGEST, Optional.of(otherRound)))
++        .isPresent();
++
++    final FalconSeal otherChain =
++        honestSeal(PqAnchor.prepareMessage(CHAIN_ID + 1, H, ROUND, DIGEST.getBytes()));
++    assertThat(prepareArmed().refusal(H, ROUND, VICTIM, DIGEST, Optional.of(otherChain)))
++        .isPresent();
++  }
++}
+diff --git a/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PrepareValidatorPqWiringTest.java b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PrepareValidatorPqWiringTest.java
+new file mode 100755
+index 000000000..4ea938d39
+--- /dev/null
++++ b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/PrepareValidatorPqWiringTest.java
+@@ -0,0 +1,118 @@
++/*
++ * Copyright contributors to Besu.
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
++ * the License. You may obtain a copy of the License at
++ *
++ * http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
++ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
++ * specific language governing permissions and limitations under the License.
++ *
++ * SPDX-License-Identifier: Apache-2.0
++ */
++package org.hyperledger.besu.consensus.qbft.core.validation;
++
++import static org.assertj.core.api.Assertions.assertThat;
++
++import org.hyperledger.besu.consensus.common.bft.ConsensusRoundIdentifier;
++import org.hyperledger.besu.consensus.common.bft.PqSignerRegistry;
++import org.hyperledger.besu.consensus.qbft.core.messagewrappers.Prepare;
++import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockCodec;
++import org.hyperledger.besu.datatypes.Address;
++import org.hyperledger.besu.datatypes.Hash;
++
++import org.apache.tuweni.bytes.Bytes;
++import org.junit.jupiter.api.BeforeEach;
++import org.junit.jupiter.api.Test;
++import org.mockito.Mock;
++
++/**
++ * THE WIRING, not the class: does {@link PrepareValidator} actually CALL the enforcement?
++ *
++ * 
        Without this test we would have exactly the situation paid for on 2026-08-28 at the restore
++ * step - a class present in the binary, environment variables visible to the process, and code that
++ * never runs. "I checked what I added" does not mean "I checked that it is wired".
++ *
++ * 
        The registry here REFUSES everything, so this does not measure cryptography (that has its own
++ * test), only whether the decision passes through the hook at all. The pair below is all it takes:
++ * the same message, once with enforcement and once without.
++ */
++public class PrepareValidatorPqWiringTest {
++
++  private static final int VALIDATOR_COUNT = 4;
++  private static final long HEIGHT = 1L;
++
++  private final ConsensusRoundIdentifier round = new ConsensusRoundIdentifier((int) HEIGHT, 0);
++  private final Hash expectedHash = Hash.fromHexStringLenient("0x1");
++  @Mock private QbftBlockCodec blockEncoder;
++  private QbftNodeList validators;
++
++  @BeforeEach
++  public void setup() {
++    validators = QbftNodeList.createNodes(VALIDATOR_COUNT, blockEncoder);
++  }
++
++  /** A registry that binds no index and verifies nothing. */
++  private static final class RegistruGol implements PqSignerRegistry {
++    @Override
++    public Address addressForIndexAtHistoric(final long blockNumber, final int validatorIndex) {
++      return null;
++    }
++
++    @Override
++    public Address addressForIndexAtOwnHead(final long blockNumber, final int validatorIndex) {
++      return null;
++    }
++
++    @Override
++    public boolean verifyAtHistoric(
++        final long blockNumber, final int validatorIndex, final Bytes message, final Bytes signature) {
++      return false;
++    }
++
++    @Override
++    public boolean verifyAtOwnHead(
++        final long blockNumber, final int validatorIndex, final Bytes message, final Bytes signature) {
++      return false;
++    }
++  }
++
++  @Test
++  public void withoutEnforcementAnUnsealedPrepareISValid() {
++    final PrepareValidator validator =
++        new PrepareValidator(validators.getNodeAddresses(), round, expectedHash, null);
++    final Prepare msg = validators.getMessageFactory(0).createPrepare(round, expectedHash);
++    assertThat(validator.validate(msg)).isTrue();
++  }
++
++  @Test
++  public void withTheEnforcementARMEDTheSamePrepareISRefused() {
++    // THE SAME message as above. The only difference is the hook, so a different result means it
++    // really is called. If this still returned true, the enforcement would be dead code.
++    final PrepareValidator validator =
++        new PrepareValidator(
++            validators.getNodeAddresses(),
++            round,
++            expectedHash,
++            new PqPrepareEnforcement(HEIGHT, new RegistruGol(), 2800L));
++    final Prepare msg = validators.getMessageFactory(0).createPrepare(round, expectedHash);
++    assertThat(validator.validate(msg)).isFalse();
++  }
++
++  @Test
++  public void withTheEnforcementBELOWItsHeightTheSamePrepareISValid() {
++    // The third state, closing the last way of being wrong: a hook that refused regardless of
++    // height would make the binary impossible to deploy. Here the enforcement exists but does not
++    // apply yet.
++    final PrepareValidator validator =
++        new PrepareValidator(
++            validators.getNodeAddresses(),
++            round,
++            expectedHash,
++            new PqPrepareEnforcement(HEIGHT + 1, new RegistruGol(), 2800L));
++    final Prepare msg = validators.getMessageFactory(0).createPrepare(round, expectedHash);
++    assertThat(validator.validate(msg)).isTrue();
++  }
++}
+diff --git a/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/ProposalPayloadValidatorPqWiringTest.java b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/ProposalPayloadValidatorPqWiringTest.java
+new file mode 100755
+index 000000000..b9bea2210
+--- /dev/null
++++ b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/ProposalPayloadValidatorPqWiringTest.java
+@@ -0,0 +1,133 @@
++/*
++ * Copyright contributors to Besu.
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
++ * the License. You may obtain a copy of the License at
++ *
++ * http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
++ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
++ * specific language governing permissions and limitations under the License.
++ *
++ * SPDX-License-Identifier: Apache-2.0
++ */
++package org.hyperledger.besu.consensus.qbft.core.validation;
++
++import static java.util.Collections.emptyList;
++import static org.assertj.core.api.Assertions.assertThat;
++
++import org.hyperledger.besu.consensus.common.bft.ConsensusRoundIdentifier;
++import org.hyperledger.besu.consensus.common.bft.PqSignerRegistry;
++import org.hyperledger.besu.consensus.qbft.core.QbftBlockTestFixture;
++import org.hyperledger.besu.consensus.qbft.core.messagewrappers.Proposal;
++import org.hyperledger.besu.consensus.qbft.core.payload.MessageFactory;
++import org.hyperledger.besu.consensus.qbft.core.types.QbftBlock;
++import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockCodec;
++import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockHeader;
++import org.hyperledger.besu.cryptoservices.NodeKey;
++import org.hyperledger.besu.cryptoservices.NodeKeyUtils;
++import org.hyperledger.besu.datatypes.Address;
++import org.hyperledger.besu.ethereum.core.Util;
++
++import java.util.Optional;
++
++import org.apache.tuweni.bytes.Bytes;
++import org.junit.jupiter.api.BeforeEach;
++import org.junit.jupiter.api.Test;
++import org.junit.jupiter.api.extension.ExtendWith;
++import org.mockito.Mock;
++import org.mockito.junit.jupiter.MockitoExtension;
++
++/**
++ * THE WIRING, not the class: does {@link ProposalPayloadValidator} actually CALL the enforcement?
++ *
++ * 
        Same reason the PREPARE twin exists: a class present in the binary, environment variables
++ * visible to the process, and code that never runs is exactly the failure paid for on 2026-08-28.
++ * The registry here REFUSES everything, so this does not measure cryptography (that has its own
++ * test), only whether the decision passes through the hook. The pair is all it takes: the same
++ * signed proposal, once with enforcement and once without.
++ */
++@ExtendWith(MockitoExtension.class)
++public class ProposalPayloadValidatorPqWiringTest {
++
++  private static final long HEIGHT = 1L;
++
++  private final ConsensusRoundIdentifier round = new ConsensusRoundIdentifier((int) HEIGHT, 0);
++  @Mock private QbftBlockCodec blockEncoder;
++
++  private final NodeKey nodeKey = NodeKeyUtils.generate();
++  private final Address proposer = Util.publicKeyToAddress(nodeKey.getPublicKey());
++  private MessageFactory messageFactory;
++
++  @BeforeEach
++  public void setup() {
++    messageFactory = new MessageFactory(nodeKey, blockEncoder);
++  }
++
++  /** A registry that binds no index and verifies nothing. */
++  private static final class EmptyRegistry implements PqSignerRegistry {
++    @Override
++    public Address addressForIndexAtHistoric(final long blockNumber, final int validatorIndex) {
++      return null;
++    }
++
++    @Override
++    public Address addressForIndexAtOwnHead(final long blockNumber, final int validatorIndex) {
++      return null;
++    }
++
++    @Override
++    public boolean verifyAtHistoric(
++        final long blockNumber, final int validatorIndex, final Bytes message, final Bytes signature) {
++      return false;
++    }
++
++    @Override
++    public boolean verifyAtOwnHead(
++        final long blockNumber, final int validatorIndex, final Bytes message, final Bytes signature) {
++      return false;
++    }
++  }
++
++  private Proposal unsealedProposal() {
++    final QbftBlockHeader header =
++        new QbftBlockHeaderTestFixture().number(round.getSequenceNumber()).buildHeader();
++    final QbftBlock block = new QbftBlockTestFixture().blockHeader(header).build();
++    return messageFactory.createProposal(round, block, Optional.empty(), emptyList(), emptyList());
++  }
++
++  @Test
++  public void withoutEnforcementAnUnsealedProposalISValid() {
++    final ProposalPayloadValidator validator =
++        new ProposalPayloadValidator(proposer, round, null, null);
++    assertThat(validator.validateWithoutBlockValidation(unsealedProposal().getSignedPayload()))
++        .isTrue();
++  }
++
++  @Test
++  public void withTheEnforcementARMEDTheSameProposalISRefused() {
++    // THE SAME message as above. The only difference is the hook, so a different result means it
++    // really is called. If this still returned true, the enforcement would be dead code.
++    final ProposalPayloadValidator validator =
++        new ProposalPayloadValidator(
++            proposer, round, null, new PqProposalEnforcement(HEIGHT, new EmptyRegistry(), 2800L));
++    assertThat(validator.validateWithoutBlockValidation(unsealedProposal().getSignedPayload()))
++        .isFalse();
++  }
++
++  @Test
++  public void withTheEnforcementBELOWItsHeightTheSameProposalISValid() {
++    // The third state, closing the last way of being wrong: a hook that refused regardless of
++    // height would make the binary impossible to deploy. Here the enforcement exists but does not
++    // apply yet.
++    final ProposalPayloadValidator validator =
++        new ProposalPayloadValidator(
++            proposer,
++            round,
++            null,
++            new PqProposalEnforcement(HEIGHT + 1, new EmptyRegistry(), 2800L));
++    assertThat(validator.validateWithoutBlockValidation(unsealedProposal().getSignedPayload()))
++        .isTrue();
++  }
++}
+diff --git a/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/RoundChangeJustificationPqTest.java b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/RoundChangeJustificationPqTest.java
+new file mode 100755
+index 000000000..848ad4c09
+--- /dev/null
++++ b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/RoundChangeJustificationPqTest.java
+@@ -0,0 +1,298 @@
++/*
++ * Copyright contributors to Besu.
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
++ * the License. You may obtain a copy of the License at
++ *
++ * http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
++ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
++ * specific language governing permissions and limitations under the License.
++ *
++ * SPDX-License-Identifier: Apache-2.0
++ */
++package org.hyperledger.besu.consensus.qbft.core.validation;
++
++import static com.google.common.collect.Iterables.toArray;
++import static org.assertj.core.api.Assertions.assertThat;
++import static org.hyperledger.besu.consensus.qbft.core.validation.ValidationTestHelpers.createEmptyRoundChangePayloads;
++import static org.hyperledger.besu.consensus.qbft.core.validation.ValidationTestHelpers.createPreparePayloads;
++import static org.hyperledger.besu.consensus.qbft.core.validation.ValidationTestHelpers.createPreparedCertificate;
++import static org.mockito.Mockito.any;
++import static org.mockito.Mockito.lenient;
++import static org.mockito.Mockito.when;
++
++import org.hyperledger.besu.consensus.common.bft.BftHelpers;
++import org.hyperledger.besu.consensus.common.bft.ConsensusRoundHelpers;
++import org.hyperledger.besu.consensus.common.bft.ConsensusRoundIdentifier;
++import org.hyperledger.besu.consensus.common.bft.blockcreation.ProposerSelector;
++import org.hyperledger.besu.consensus.common.bft.payload.SignedData;
++import org.hyperledger.besu.consensus.qbft.core.QbftBlockTestFixture;
++import org.hyperledger.besu.consensus.qbft.core.messagewrappers.Proposal;
++import org.hyperledger.besu.consensus.qbft.core.messagewrappers.RoundChange;
++import org.hyperledger.besu.consensus.qbft.core.payload.PreparedRoundMetadata;
++import org.hyperledger.besu.consensus.qbft.core.payload.RoundChangePayload;
++import org.hyperledger.besu.consensus.qbft.core.statemachine.PreparedCertificate;
++import org.hyperledger.besu.consensus.qbft.core.types.QbftBlock;
++import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockCodec;
++import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockHeader;
++import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockInterface;
++import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockValidator;
++import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockValidator.ValidationResult;
++import org.hyperledger.besu.consensus.qbft.core.types.QbftProtocolSchedule;
++
++import java.util.List;
++import java.util.Optional;
++
++import org.apache.tuweni.bytes.Bytes32;
++
++import org.junit.jupiter.api.AfterEach;
++import org.junit.jupiter.api.BeforeEach;
++import org.junit.jupiter.api.Test;
++import org.junit.jupiter.api.extension.ExtendWith;
++import org.mockito.Mock;
++import org.mockito.junit.jupiter.MockitoExtension;
++
++/**
++ * THE COUPLING of round-change justifications to the PREPARE enforcement.
++ *
++ * 
        WHY THIS FILE EXISTS - it is an hour-long scar, from 2026-08-29. The step-6 design asked for a
++ * SEPARATE gate for justifications, armed later than the PREPARE one, so as not to invalidate "old
++ * justifications". Two things read in the code overturned that request:
++ *
++ * 
          
++ *   
        1. a justification cannot be old: {@code validatePrepares} uses
++ *       {@code new ConsensusRoundIdentifier(chainHeight, metadata.getPreparedRound())}, so every
++ *       attached PREPARE is from the height being decided NOW, only from an earlier round;
++ *   
        2. the coupling already exists: {@code RoundChangeMessageValidator} builds a
++ *       {@link PrepareValidator} with the three-argument constructor, and that one wires its own
++ *       enforcement from the system configuration.
++ * 
        
++ *
++ * 
        So a gate armed later would not be a precaution, it would be a BACK DOOR: the same unsealed
++ * PREPARE, refused when it arrives on its own, would be accepted when it arrives wrapped in a round
++ * change. The coupling is the security property itself - but until today it followed from an
++ * implicit constructor and NOTHING guarded it. Anyone "tidying up" that constructor six months from
++ * now would open the back door without a single test failing. From here on, this one fails.
++ *
++ * 
        WHAT IT DOES NOT PROVE, written down because the gap is visible: it does not prove that a
++ * justification with VALID seals passes, because the self-wired enforcement uses the live registry
++ * of the process and a test one cannot be injected along that path. That case is covered by
++ * {@link PqPrepareEnforcementTest} at the message level and by the network run (F81, scenario A) at
++ * the chain level. What is proven here is the coupling, in both directions, and that the gate is
++ * bound to HEIGHT inside the justifications too.
++ */
++@ExtendWith(MockitoExtension.class)
++public class RoundChangeJustificationPqTest {
++
++  @Mock private RoundChangePayloadValidator payloadValidator;
++  @Mock private QbftProtocolSchedule protocolSchedule;
++  @Mock private QbftBlockValidator blockValidator;
++  @Mock private QbftBlockCodec blockEncoder;
++  @Mock private QbftBlockInterface blockInterface;
++  @Mock private ProposerSelector proposerSelector;
++
++  private static final int VALIDATOR_COUNT = 4;
++  private static final int CHAIN_HEIGHT = 3;
++
++  private final ConsensusRoundIdentifier targetRound =
++      new ConsensusRoundIdentifier(CHAIN_HEIGHT, 3);
++  private final ConsensusRoundIdentifier roundIdentifier =
++      ConsensusRoundHelpers.createFrom(targetRound, 0, -1);
++
++  private QbftNodeList validators;
++
++  @BeforeEach
++  public void setup() {
++    validators = QbftNodeList.createNodes(VALIDATOR_COUNT, blockEncoder);
++    lenient().when(protocolSchedule.getBlockValidator(any())).thenReturn(blockValidator);
++  }
++
++  @AfterEach
++  public void curata() {
++    System.clearProperty(PqPrepareEnforcement.PROPERTY_FORK_BLOCK);
++  }
++
++  private RoundChangeMessageValidator validator() {
++    return new RoundChangeMessageValidator(
++        payloadValidator,
++        BftHelpers.calculateRequiredValidatorQuorum(VALIDATOR_COUNT),
++        CHAIN_HEIGHT,
++        validators.getNodeAddresses(),
++        protocolSchedule);
++  }
++
++  /** A round change with a prepared block and a justification made of UNSEALED PREPAREs. */
++  private RoundChange roundChangeWithUnsealedJustification() {
++    when(payloadValidator.validate(any())).thenReturn(true);
++    when(blockValidator.validateBlock(any(), any()))
++        .thenReturn(new ValidationResult(true, Optional.empty()));
++
++    final QbftBlockHeader header =
++        new QbftBlockHeaderTestFixture().number(roundIdentifier.getSequenceNumber()).buildHeader();
++    final QbftBlock block = new QbftBlockTestFixture().blockHeader(header).build();
++    final PreparedCertificate prepCert =
++        createPreparedCertificate(
++            block, roundIdentifier, toArray(validators.getNodes(), QbftNode.class));
++    return validators.getMessageFactory(0).createRoundChange(targetRound, Optional.of(prepCert));
++  }
++
++  // ---------------------------------------------------------------------------------------------
++  // THE PAIR. The same message, once with the enforcement disarmed and once with it armed. A
++  // different result means justifications really do pass through the enforcement; the same result
++  // would mean the back door.
++  // ---------------------------------------------------------------------------------------------
++  @Test
++  public void withoutEnforcementAnUNSEALEDJustificationIsVALID() {
++    System.clearProperty(PqPrepareEnforcement.PROPERTY_FORK_BLOCK);
++    assertThat(validator().validate(roundChangeWithUnsealedJustification())).isTrue();
++  }
++
++  @Test
++  public void withTheEnforcementARMEDTheSameJustificationISRefused() {
++    System.setProperty(PqPrepareEnforcement.PROPERTY_FORK_BLOCK, "0");
++    assertThat(validator().validate(roundChangeWithUnsealedJustification())).isFalse();
++  }
++
++  // ---------------------------------------------------------------------------------------------
++  // The third state: the enforcement EXISTS but its height is in the future. Without this test, an
++  // enforcement that refused regardless of height would pass as correct, and the binary could not
++  // be rolled onto the fleet before the activation height.
++  // ---------------------------------------------------------------------------------------------
++  @Test
++  public void withTheEnforcementBELOWItsHeightTheJustificationISVALID() {
++    System.setProperty(
++        PqPrepareEnforcement.PROPERTY_FORK_BLOCK, Long.toString(CHAIN_HEIGHT + 1L));
++    assertThat(validator().validate(roundChangeWithUnsealedJustification())).isTrue();
++  }
++
++  // ---------------------------------------------------------------------------------------------
++  // THE OTHER DIRECTION, and it is the very piece that keeps the way back open: a round change
++  // WITHOUT a prepared block has no justification to validate, so it never touches the enforcement
++  // at all. That explains why a chain stalled by the enforcement still advances its rounds
++  // (measured, finding D-280), and it has to stay true: if it broke, the stall would no longer be
++  // recoverable along that same road.
++  // ---------------------------------------------------------------------------------------------
++  @Test
++  public void withTheEnforcementARMEDARoundChangeWITHOUTAPreparedBlockPASSES() {
++    System.setProperty(PqPrepareEnforcement.PROPERTY_FORK_BLOCK, "0");
++    when(payloadValidator.validate(any())).thenReturn(true);
++    for (int i = 0; i < VALIDATOR_COUNT; i++) {
++      final RoundChange without =
++          validators.getMessageFactory(i).createRoundChange(targetRound, Optional.empty());
++      assertThat(validator().validate(without)).isTrue();
++    }
++  }
++
++  // =============================================================================================
++  // THE SECOND PATH, found 2026-08-29 by searching for EVERY place that builds a PrepareValidator
++  // in production code, not just the one I happened to be looking at. There are three:
++  // MessageValidator (ordinary PREPAREs), RoundChangeMessageValidator (the justification of a round
++  // change) and ProposalValidator (the justification of a PROPOSAL for a new round).
++  //
++  // Without that search I would have reported "the coupling is guarded" with only one of the two
++  // justification paths guarded - and the second one is precisely how a prepared block gets
++  // RE-PROPOSED in a new round. The same back door, a different file.
++  // =============================================================================================
++
++  private static final int INALTIME_PROPUNERE = 1;
++
++  private final ConsensusRoundIdentifier roundZero =
++      new ConsensusRoundIdentifier(INALTIME_PROPUNERE, 0);
++  private final ConsensusRoundIdentifier roundOne =
++      new ConsensusRoundIdentifier(INALTIME_PROPUNERE, 1);
++
++  private QbftBlock blocPentru(final ConsensusRoundIdentifier rid, final int autor) {
++    final QbftBlockHeader h =
++        new QbftBlockHeaderTestFixture()
++            .number(rid.getSequenceNumber())
++            .coinbase(validators.getNode(autor).getAddress())
++            .buildHeader();
++    return new QbftBlockTestFixture().blockHeader(h).build();
++  }
++
++  private ProposalValidator validatorulPropunerii() {
++    return new ProposalValidator(
++        blockInterface,
++        protocolSchedule,
++        BftHelpers.calculateRequiredValidatorQuorum(VALIDATOR_COUNT),
++        validators.getNodeAddresses(),
++        roundOne,
++        proposerSelector);
++  }
++
++  /**
++   * A round-1 proposal that carries forward a block PREPARED in round 0, with the justification
++   * made of UNSEALED PREPAREs. The scenario is the upstream one that passes; the only question from
++   * here on is whether the enforcement changes it.
++   */
++  private Proposal proposalWithUnsealedJustification() {
++    lenient()
++        .when(blockValidator.validateBlock(any(), any()))
++        .thenReturn(new ValidationResult(true, Optional.empty()));
++    lenient()
++        .when(proposerSelector.selectProposerForRound(roundZero))
++        .thenReturn(validators.getNode(0).getAddress());
++    lenient()
++        .when(proposerSelector.selectProposerForRound(roundOne))
++        .thenReturn(validators.getNode(1).getAddress());
++
++    final QbftBlock blocRundaZero = blocPentru(roundZero, 0);
++    final QbftBlock blocRundaUnu = blocPentru(roundOne, 1);
++
++    lenient()
++        .when(
++            blockInterface.replaceRoundAndProposerForProposalBlock(
++                blocRundaUnu, 0, validators.getNode(0).getAddress()))
++        .thenReturn(blocRundaZero);
++
++    final List> schimbari =
++        createEmptyRoundChangePayloads(roundOne, validators.getNode(0), validators.getNode(1));
++
++    final RoundChangePayload cuPregatit =
++        new RoundChangePayload(
++            roundOne,
++            Optional.of(
++                new PreparedRoundMetadata(blocRundaZero.getHash(), roundZero.getRoundNumber())));
++    schimbari.add(
++        SignedData.create(
++            cuPregatit,
++            validators
++                .getNode(2)
++                .getNodeKey()
++                .sign(Bytes32.wrap(cuPregatit.hashForSignature().getBytes()))));
++
++    return validators
++        .getMessageFactory(1)
++        .createProposal(
++            roundOne,
++            blocRundaUnu,
++            schimbari,
++            createPreparePayloads(
++                roundZero,
++                blocRundaZero.getHash(),
++                validators.getNode(0),
++                validators.getNode(1),
++                validators.getNode(2)));
++  }
++
++  @Test
++  public void withoutEnforcementAPROPOSALWithAnUNSEALEDJustificationIsVALID() {
++    System.clearProperty(PqPrepareEnforcement.PROPERTY_FORK_BLOCK);
++    assertThat(validatorulPropunerii().validate(proposalWithUnsealedJustification())).isTrue();
++  }
++
++  @Test
++  public void withTheEnforcementARMEDTheSamePROPOSALISRefused() {
++    System.setProperty(PqPrepareEnforcement.PROPERTY_FORK_BLOCK, "0");
++    assertThat(validatorulPropunerii().validate(proposalWithUnsealedJustification())).isFalse();
++  }
++
++  @Test
++  public void withTheEnforcementBELOWItsHeightThePROPOSALISVALID() {
++    System.setProperty(
++        PqPrepareEnforcement.PROPERTY_FORK_BLOCK, Long.toString(INALTIME_PROPUNERE + 1L));
++    assertThat(validatorulPropunerii().validate(proposalWithUnsealedJustification())).isTrue();
++  }
++}
+diff --git a/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/RoundChangePayloadValidatorPqWiringTest.java b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/RoundChangePayloadValidatorPqWiringTest.java
+new file mode 100755
+index 000000000..b906ec016
+--- /dev/null
++++ b/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/validation/RoundChangePayloadValidatorPqWiringTest.java
+@@ -0,0 +1,125 @@
++/*
++ * Copyright contributors to Besu.
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
++ * the License. You may obtain a copy of the License at
++ *
++ * http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
++ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
++ * specific language governing permissions and limitations under the License.
++ *
++ * SPDX-License-Identifier: Apache-2.0
++ */
++package org.hyperledger.besu.consensus.qbft.core.validation;
++
++import static org.assertj.core.api.Assertions.assertThat;
++
++import org.hyperledger.besu.consensus.common.bft.ConsensusRoundIdentifier;
++import org.hyperledger.besu.consensus.common.bft.PqSignerRegistry;
++import org.hyperledger.besu.consensus.qbft.core.messagewrappers.RoundChange;
++import org.hyperledger.besu.consensus.qbft.core.payload.MessageFactory;
++import org.hyperledger.besu.consensus.qbft.core.types.QbftBlockCodec;
++import org.hyperledger.besu.cryptoservices.NodeKey;
++import org.hyperledger.besu.cryptoservices.NodeKeyUtils;
++import org.hyperledger.besu.datatypes.Address;
++import org.hyperledger.besu.ethereum.core.Util;
++
++import java.util.List;
++import java.util.Optional;
++
++import org.apache.tuweni.bytes.Bytes;
++import org.junit.jupiter.api.BeforeEach;
++import org.junit.jupiter.api.Test;
++import org.junit.jupiter.api.extension.ExtendWith;
++import org.mockito.Mock;
++import org.mockito.junit.jupiter.MockitoExtension;
++
++/**
++ * THE WIRING, not the class: does {@link RoundChangePayloadValidator} actually CALL the
++ * enforcement?
++ *
++ * 
        Same reason the PREPARE and PROPOSAL twins exist: a class present in the binary, environment
++ * variables visible to the process, and code that never runs is exactly the failure paid for on
++ * 2026-08-28. The registry here REFUSES everything, so this does not measure cryptography (that has
++ * its own test), only whether the decision passes through the hook. The pair is all it takes: the
++ * same signed round-change, once with enforcement and once without.
++ */
++@ExtendWith(MockitoExtension.class)
++public class RoundChangePayloadValidatorPqWiringTest {
++
++  private static final long HEIGHT = 1L;
++
++  // A round-change must target a POSITIVE round, so the identifier moves to round 1.
++  private final ConsensusRoundIdentifier targetRound = new ConsensusRoundIdentifier((int) HEIGHT, 1);
++  @Mock private QbftBlockCodec blockEncoder;
++
++  private final NodeKey nodeKey = NodeKeyUtils.generate();
++  private final Address author = Util.publicKeyToAddress(nodeKey.getPublicKey());
++  private MessageFactory messageFactory;
++
++  @BeforeEach
++  public void setup() {
++    messageFactory = new MessageFactory(nodeKey, blockEncoder);
++  }
++
++  /** A registry that binds no index and verifies nothing. */
++  private static final class EmptyRegistry implements PqSignerRegistry {
++    @Override
++    public Address addressForIndexAtHistoric(final long blockNumber, final int validatorIndex) {
++      return null;
++    }
++
++    @Override
++    public Address addressForIndexAtOwnHead(final long blockNumber, final int validatorIndex) {
++      return null;
++    }
++
++    @Override
++    public boolean verifyAtHistoric(
++        final long blockNumber, final int validatorIndex, final Bytes message, final Bytes signature) {
++      return false;
++    }
++
++    @Override
++    public boolean verifyAtOwnHead(
++        final long blockNumber, final int validatorIndex, final Bytes message, final Bytes signature) {
++      return false;
++    }
++  }
++
++  private RoundChange unsealedRoundChange() {
++    return messageFactory.createRoundChange(targetRound, Optional.empty());
++  }
++
++  @Test
++  public void withoutEnforcementAnUnsealedRoundChangeISValid() {
++    final RoundChangePayloadValidator validator =
++        new RoundChangePayloadValidator(List.of(author), HEIGHT, null);
++    assertThat(validator.validate(unsealedRoundChange().getSignedPayload())).isTrue();
++  }
++
++  @Test
++  public void withTheEnforcementARMEDTheSameRoundChangeISRefused() {
++    // THE SAME message as above. The only difference is the hook, so a different result means it
++    // really is called. If this still returned true, the enforcement would be dead code.
++    final RoundChangePayloadValidator validator =
++        new RoundChangePayloadValidator(
++            List.of(author), HEIGHT, new PqRoundChangeEnforcement(HEIGHT, new EmptyRegistry(), 2800L));
++    assertThat(validator.validate(unsealedRoundChange().getSignedPayload())).isFalse();
++  }
++
++  @Test
++  public void withTheEnforcementBELOWItsHeightTheSameRoundChangeISValid() {
++    // The third state, closing the last way of being wrong: a hook that refused regardless of
++    // height would make the binary impossible to deploy. Here the enforcement exists but does not
++    // apply yet.
++    final RoundChangePayloadValidator validator =
++        new RoundChangePayloadValidator(
++            List.of(author),
++            HEIGHT,
++            new PqRoundChangeEnforcement(HEIGHT + 1, new EmptyRegistry(), 2800L));
++    assertThat(validator.validate(unsealedRoundChange().getSignedPayload())).isTrue();
++  }
++}
 diff --git a/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/QbftBlockHeaderValidationRulesetFactory.java b/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/QbftBlockHeaderValidationRulesetFactory.java
-index f54d7bfcd..6c3fba591 100644
+index f54d7bfcd..cfc67a900 100644
 --- a/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/QbftBlockHeaderValidationRulesetFactory.java
 +++ b/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/QbftBlockHeaderValidationRulesetFactory.java
-@@ -11,6 +11,12 @@
+@@ -1,86 +1,204 @@
+ /*
+  * Copyright ConsenSys AG.
+  *
+  * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+  * the License. You may obtain a copy of the License at
+  *
+  * http://www.apache.org/licenses/LICENSE-2.0
+  *
+  * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+  * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
   * specific language governing permissions and limitations under the License.
   *
   * SPDX-License-Identifier: Apache-2.0
@@ -22100,7 +39959,7 @@ index f54d7bfcd..6c3fba591 100644
   */
  package org.hyperledger.besu.consensus.qbft;
  
-@@ -18,8 +24,16 @@ import static org.hyperledger.besu.ethereum.mainnet.AbstractGasLimitSpecificatio
+ import static org.hyperledger.besu.ethereum.mainnet.AbstractGasLimitSpecification.DEFAULT_MAX_GAS_LIMIT;
  import static org.hyperledger.besu.ethereum.mainnet.AbstractGasLimitSpecification.DEFAULT_MIN_GAS_LIMIT;
  
  import org.hyperledger.besu.consensus.common.bft.BftHelpers;
@@ -22108,6 +39967,7 @@ index f54d7bfcd..6c3fba591 100644
 +import org.hyperledger.besu.consensus.common.bft.PqAnchorConfig;
  import org.hyperledger.besu.consensus.common.bft.headervalidationrules.BftCoinbaseValidationRule;
  import org.hyperledger.besu.consensus.common.bft.headervalidationrules.BftCommitSealsValidationRule;
++import org.hyperledger.besu.consensus.qbft.headervalidationrules.AereBaseFeeImportRule;
 +import org.hyperledger.besu.consensus.qbft.headervalidationrules.FalconSealValidationRule;
 +import org.hyperledger.besu.consensus.qbft.headervalidationrules.PqAnchorDigestAttachedRule;
 +import org.hyperledger.besu.consensus.qbft.headervalidationrules.PqAnchorDigestRule;
@@ -22117,7 +39977,34 @@ index f54d7bfcd..6c3fba591 100644
  import org.hyperledger.besu.consensus.qbft.headervalidationrules.QbftValidatorsValidationRule;
  import org.hyperledger.besu.ethereum.core.BlockHeader;
  import org.hyperledger.besu.ethereum.mainnet.BlockHeaderValidator;
-@@ -54,8 +68,75 @@ public class QbftBlockHeaderValidationRulesetFactory {
+ import org.hyperledger.besu.ethereum.mainnet.feemarket.BaseFeeMarket;
+ import org.hyperledger.besu.ethereum.mainnet.headervalidationrules.AncestryValidationRule;
+ import org.hyperledger.besu.ethereum.mainnet.headervalidationrules.ConstantFieldValidationRule;
+ import org.hyperledger.besu.ethereum.mainnet.headervalidationrules.GasLimitRangeAndDeltaValidationRule;
+ import org.hyperledger.besu.ethereum.mainnet.headervalidationrules.GasUsageValidationRule;
+ import org.hyperledger.besu.ethereum.mainnet.headervalidationrules.TimestampBoundedByFutureParameter;
+ import org.hyperledger.besu.ethereum.mainnet.headervalidationrules.TimestampMoreRecentThanParent;
+ 
+ import java.time.Duration;
+ import java.util.Optional;
+ 
+ import org.apache.tuweni.units.bigints.UInt256;
+ 
+ /** The Qbft block header validation ruleset factory. */
+ public class QbftBlockHeaderValidationRulesetFactory {
+   /** Default constructor */
+   private QbftBlockHeaderValidationRulesetFactory() {}
+ 
+   /**
+    * Produces a BlockHeaderValidator configured for assessing bft block headers which are to form
+    * part of the BlockChain (i.e. not proposed blocks, which do not contain commit seals)
+    *
+    * @param minimumTimeBetweenBlocks the minimum amount of time that must elapse between blocks.
+    * @param useValidatorContract whether validator selection is using a validator contract
+    * @param baseFeeMarket an {@link Optional} wrapping {@link BaseFeeMarket} class if appropriate.
+    * @return BlockHeaderValidator configured for assessing bft block headers
+    */
+   public static BlockHeaderValidator.Builder blockHeaderValidator(
        final Duration minimumTimeBetweenBlocks,
        final boolean useValidatorContract,
        final Optional baseFeeMarket) {
@@ -22155,12 +40042,11 @@ index f54d7bfcd..6c3fba591 100644
 +   * therefore bit-for-bit equivalent to today's on the whole existing chain, which is the condition
 +   * for warming it on a live node.
 +   *
-+   * 
        The rule COUNT goes from 11 to 16 (the per-block registry binding adds one, was 13;
-+   * SINCRONIZARE adds the attached copy of the digest rule, was 14; OPTIUNI-URGENTA adds the
-+   * emergency announcement rule, which can never reject, was 15) (14 unconditional plus the
-+   * conditional timestamp rule). The original design note said 12 because it assumed the legacy
-+   * Falcon rule would be deleted; retiring it by height instead is what keeps behaviour below H
-+   * identical, so it stays in the list.
++   * 
        The rule COUNT goes from 11 to 16 (A8 adds the registry-binding rule, was 13; SINCRONIZARE
++   * adds the attached copy of the digest rule, was 14; OPTIUNI-URGENTA adds the emergency
++   * announcement rule, which can never reject, was 15) (14 unconditional plus the conditional timestamp rule). The
++   * design note said 12 because it assumed the legacy Falcon rule would be deleted; retiring it by
++   * height instead is what keeps behaviour below H identical, so it stays in the list.
 +   *
 +   * @param minimumTimeBetweenBlocks the minimum amount of time that must elapse between blocks.
 +   * @param useValidatorContract whether validator selection is using a validator contract
@@ -22193,7 +40079,24 @@ index f54d7bfcd..6c3fba591 100644
              .addRule(new AncestryValidationRule())
              .addRule(new GasUsageValidationRule())
              .addRule(
-@@ -70,7 +151,34 @@ public class QbftBlockHeaderValidationRulesetFactory {
+                 new GasLimitRangeAndDeltaValidationRule(
+                     DEFAULT_MIN_GAS_LIMIT, DEFAULT_MAX_GAS_LIMIT, baseFeeMarket))
+             .addRule(new TimestampBoundedByFutureParameter(1))
++            // AERE D-AMONTE-02: the base-fee rule every non-BFT factory in this jar wires and the
++            // QBFT one upstream forgot. Height-gated (disarmed = today's behaviour, byte for byte):
++            // the chain's HISTORY contains blocks this validation would reject (the two floor-less
++            // days, the lost-threshold window where the fee was not a function of the parent), so
++            // it must never look below its arming height. Delegates to THIS node's fee market, so
++            // the AERE 1 Gwei floor is validated too - the check that closes the empty-block
++            // one-wei divergence measured on the mixed network (STARE-PRODUCATOR 1bis).
++            .addRule(
++                new AereBaseFeeImportRule(
++                    AereBaseFeeImportRule.armedFromSystemConfig(), baseFeeMarket))
+             .addRule(
+                 new ConstantFieldValidationRule<>(
+                     "MixHash", BlockHeader::getMixHash, BftHelpers.EXPECTED_MIX_HASH))
+             .addRule(
+                 new ConstantFieldValidationRule<>(
                      "Difficulty", BlockHeader::getDifficulty, UInt256.ONE))
              .addRule(new QbftValidatorsValidationRule(useValidatorContract))
              .addRule(new BftCoinbaseValidationRule())
@@ -22220,8 +40123,8 @@ index f54d7bfcd..6c3fba591 100644
 +            .addRule(new PqAnchorDigestAttachedRule(pqAnchorConfig))
 +            // AERE ANCORA-V2 R2: attached, full validation only.
 +            .addRule(new PqAnchorSealsRule(pqAnchorConfig))
-+            // AERE REGISTRY BINDING, per-block half: the registry this node runs must be the
-+            // registry config.pqRegistryHash requires AT THIS HEIGHT. The startup guard answers
++            // AERE A8 per-block half: the registry this node runs must be the registry
++            // config.pqRegistryHash requires AT THIS HEIGHT. The startup guard answers
 +            // that once, against the head that existed at startup; a rotation entry in
 +            // the schedule can pass underneath a running node and never be noticed.
 +            // Inert when no schedule is configured, which is chain 2800 today.
@@ -22229,11 +40132,31 @@ index f54d7bfcd..6c3fba591 100644
  
      // Currently the minimum acceptable time between blocks is 1 second. The timestamp of an
      // Ethereum header is stored as seconds since Unix epoch so blocks being produced more
+     // frequently than once a second cannot pass this validator. For non-production scenarios
+     // (e.g. for testing block production much more frequently than once a second) Besu has
+     // an experimental 'xblockperiodmilliseconds' option for BFT chains. If this is enabled
+     // we cannot apply the TimestampMoreRecentThanParent validation rule so we do not add it
+     if (minimumTimeBetweenBlocks.compareTo(Duration.ofSeconds(1)) >= 0) {
+       ruleBuilder.addRule(new TimestampMoreRecentThanParent(minimumTimeBetweenBlocks.toSeconds()));
+     }
+     return ruleBuilder;
+   }
+ }
 diff --git a/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/QbftExtraDataCodec.java b/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/QbftExtraDataCodec.java
-index 39c7aa300..59ef0edd8 100644
+index 39c7aa300..b3096d331 100644
 --- a/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/QbftExtraDataCodec.java
 +++ b/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/QbftExtraDataCodec.java
-@@ -11,6 +11,12 @@
+@@ -1,63 +1,81 @@
+ /*
+  * Copyright ConsenSys AG.
+  *
+  * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+  * the License. You may obtain a copy of the License at
+  *
+  * http://www.apache.org/licenses/LICENSE-2.0
+  *
+  * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+  * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
   * specific language governing permissions and limitations under the License.
   *
   * SPDX-License-Identifier: Apache-2.0
@@ -22246,15 +40169,33 @@ index 39c7aa300..59ef0edd8 100644
   */
  package org.hyperledger.besu.consensus.qbft;
  
-@@ -19,6 +25,7 @@ import static org.hyperledger.besu.consensus.common.bft.Vote.DROP_BYTE_VALUE;
+ import static org.hyperledger.besu.consensus.common.bft.Vote.ADD_BYTE_VALUE;
+ import static org.hyperledger.besu.consensus.common.bft.Vote.DROP_BYTE_VALUE;
  
  import org.hyperledger.besu.consensus.common.bft.BftExtraData;
  import org.hyperledger.besu.consensus.common.bft.BftExtraDataCodec;
 +import org.hyperledger.besu.consensus.common.bft.FalconSeal;
++import org.hyperledger.besu.consensus.common.bft.PqAnchorV2;
++import org.hyperledger.besu.consensus.common.bft.SchemeSeal;
  import org.hyperledger.besu.consensus.common.bft.Vote;
  import org.hyperledger.besu.consensus.common.validator.VoteType;
  import org.hyperledger.besu.crypto.SECPSignature;
-@@ -41,6 +48,15 @@ import org.apache.tuweni.bytes.Bytes;
+ import org.hyperledger.besu.crypto.SignatureAlgorithmFactory;
+ import org.hyperledger.besu.datatypes.Address;
+ import org.hyperledger.besu.ethereum.rlp.BytesValueRLPInput;
+ import org.hyperledger.besu.ethereum.rlp.BytesValueRLPOutput;
+ import org.hyperledger.besu.ethereum.rlp.RLPException;
+ import org.hyperledger.besu.ethereum.rlp.RLPInput;
+ import org.hyperledger.besu.ethereum.rlp.RLPOutput;
+ 
+ import java.util.Collection;
+ import java.util.Collections;
+ import java.util.List;
+ import java.util.Optional;
+ 
+ import com.google.common.collect.ImmutableBiMap;
+ import org.apache.tuweni.bytes.Bytes;
+ 
  /**
   * Represents the data structure stored in the extraData field of the BlockHeader used when
   * operating under an BFT consensus mechanism.
@@ -22270,7 +40211,41 @@ index 39c7aa300..59ef0edd8 100644
   */
  public class QbftExtraDataCodec extends BftExtraDataCodec {
    private static final ImmutableBiMap voteToValue =
-@@ -102,9 +118,66 @@ public class QbftExtraDataCodec extends BftExtraDataCodec {
+       ImmutableBiMap.of(
+           VoteType.ADD, ADD_BYTE_VALUE,
+           VoteType.DROP, DROP_BYTE_VALUE);
+ 
+   /** Default constructor */
+   public QbftExtraDataCodec() {}
+ 
+   /**
+    * Encode from addresses.
+    *
+    * @param addresses the addresses
+    * @return the bytes
+    */
+   public static Bytes encodeFromAddresses(final Collection
         addresses) {
+     return new QbftExtraDataCodec()
+         .encode(
+             new BftExtraData(
+@@ -85,64 +103,164 @@ public class QbftExtraDataCodec extends BftExtraDataCodec {
+     }
+ 
+     final RLPInput rlpInput = new BytesValueRLPInput(input, false);
+ 
+     rlpInput.enterList(); // This accounts for the "root node" which contains BFT data items.
+     final Bytes vanityData = rlpInput.readBytes();
+     final List
         validators = rlpInput.readList(Address::readFrom);
+ 
+     final Optional vote;
+     if (rlpInput.nextIsList() && rlpInput.nextSize() == 0) {
+       vote = Optional.empty();
+       rlpInput.skipNext();
+     } else {
+       vote = Optional.of(decodeVote(rlpInput));
+     }
+ 
+     final int round = rlpInput.readIntScalar();
      final List seals =
          rlpInput.readList(
              rlp -> SignatureAlgorithmFactory.getInstance().decodeSignature(rlp.readBytes()));
@@ -22281,18 +40256,43 @@ index 39c7aa300..59ef0edd8 100644
 +    // Backward-tolerant: older/exclude/no-certificate encodings without this element decode to an
 +    // empty list.
 +    final List falconSeals;
++    final List hybridSeals;
 +    if (!rlpInput.isEndOfCurrentList()) {
-+      falconSeals =
-+          rlpInput.readList(
-+              rlp -> {
-+                rlp.enterList();
-+                final int idx = rlp.readIntScalar();
-+                final Bytes sig = rlp.readBytes();
-+                rlp.leaveList();
-+                return new FalconSeal(idx, sig);
-+              });
++      // AERE ANCHOR V2 (2026-09-03): the sixth element is EITHER the v1 Falcon list
++      // RLP[[idx,sig],...] OR the scheme-tagged v2 certificate RLP[2,[[scheme,idx,sig],...]].
++      // They cannot be confused: v1 opens with a LIST, v2 with the SCALAR 2. The raw bytes are
++      // taken first so the v2 decoder can enforce its canonical round trip on exactly what the
++      // header carried; the codec's own round trip (gate 2 below) then covers both forms.
++      final Bytes certificateRaw = rlpInput.readAsRlp().raw();
++      final RLPInput probe = new BytesValueRLPInput(certificateRaw, false);
++      probe.enterList();
++      final boolean v2 = !probe.isEndOfCurrentList() && !probe.nextIsList();
++      if (v2) {
++        falconSeals = Collections.emptyList();
++        try {
++          hybridSeals = PqAnchorV2.decode(certificateRaw);
++        } catch (final RuntimeException e) {
++          throw new RLPException(
++              "AERE ANCHOR V2: the header's certificate does not decode as a canonical v2"
++                  + " certificate: "
++                  + e.getMessage());
++        }
++      } else {
++        hybridSeals = Collections.emptyList();
++        falconSeals =
++            new BytesValueRLPInput(certificateRaw, false)
++                .readList(
++                    rlp -> {
++                      rlp.enterList();
++                      final int idx = rlp.readIntScalar();
++                      final Bytes sig = rlp.readBytes();
++                      rlp.leaveList();
++                      return new FalconSeal(idx, sig);
++                    });
++      }
 +    } else {
 +      falconSeals = Collections.emptyList();
++      hybridSeals = Collections.emptyList();
 +    }
 +
 +    // AERE FIX-MALEABILITATE-BLOC (2026-08-01), gate 1 of 2: the leave is STRICT.
@@ -22308,7 +40308,7 @@ index 39c7aa300..59ef0edd8 100644
 +    rlpInput.leaveList();
 +
 +    final BftExtraData decoded =
-+        new BftExtraData(vanityData, seals, vote, round, validators, falconSeals);
++        new BftExtraData(vanityData, seals, vote, round, validators, falconSeals, hybridSeals);
 +
 +    // AERE FIX-MALEABILITATE-BLOC (2026-08-01), gate 2 of 2: CANONICAL ROUND TRIP.
 +    //
@@ -22339,7 +40339,21 @@ index 39c7aa300..59ef0edd8 100644
    }
  
    @Override
-@@ -126,6 +199,21 @@ public class QbftExtraDataCodec extends BftExtraDataCodec {
+   protected Bytes encode(final BftExtraData bftExtraData, final EncodingType encodingType) {
+     final BytesValueRLPOutput encoder = new BytesValueRLPOutput();
+     encoder.startList();
+     encoder.writeBytes(bftExtraData.getVanityData());
+     encoder.writeList(
+         bftExtraData.getValidators(), (validator, rlp) -> rlp.writeBytes(validator.getBytes()));
+ 
+     if (bftExtraData.getVote().isPresent()) {
+       encodeVote(encoder, bftExtraData.getVote().get());
+     } else {
+       encoder.writeList(Collections.emptyList(), (o, rlpOutput) -> {});
+     }
+ 
+     if (encodingType != EncodingType.EXCLUDE_COMMIT_SEALS_AND_ROUND_NUMBER) {
+       encoder.writeIntScalar(bftExtraData.getRound());
        if (encodingType != EncodingType.EXCLUDE_COMMIT_SEALS) {
          encoder.writeList(
              bftExtraData.getSeals(), (committer, rlp) -> rlp.writeBytes(committer.encodedBytes()));
@@ -22348,7 +40362,10 @@ index 39c7aa300..59ef0edd8 100644
 +        // committed-seal hash and the on-chain block hash are byte-identical to upstream Besu, and a
 +        // header with no certificate is byte-identical to upstream too, so the Falcon seals are
 +        // never part of any signed pre-image and never disturb the block hash.
-+        if (!bftExtraData.getFalconSeals().isEmpty()) {
++        if (!bftExtraData.getHybridSeals().isEmpty()) {
++          // AERE ANCHOR V2: the scheme-tagged certificate, canonical bytes, in the same slot.
++          encoder.writeRaw(PqAnchorV2.encode(bftExtraData.getHybridSeals()));
++        } else if (!bftExtraData.getFalconSeals().isEmpty()) {
 +          encoder.writeList(
 +              bftExtraData.getFalconSeals(),
 +              (falconSeal, rlp) -> {
@@ -22361,11 +40378,38 @@ index 39c7aa300..59ef0edd8 100644
        } else {
          encoder.writeEmptyList();
        }
+     } else {
+       encoder.writeIntScalar(0);
+       encoder.writeEmptyList();
+     }
+     encoder.endList();
+ 
+     return encoder.encoded();
+   }
+ 
+   /**
+    * Encode vote.
+    *
+    * @param rlpOutput the rlp output
+    * @param vote the vote
+    */
+   protected void encodeVote(final RLPOutput rlpOutput, final Vote vote) {
+     final VoteType voteType = vote.isAuth() ? VoteType.ADD : VoteType.DROP;
 diff --git a/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/adaptor/QbftBlockCreatorAdaptor.java b/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/adaptor/QbftBlockCreatorAdaptor.java
-index 594fe83e4..2151f5760 100644
+index 594fe83e4..dd67707b1 100644
 --- a/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/adaptor/QbftBlockCreatorAdaptor.java
 +++ b/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/adaptor/QbftBlockCreatorAdaptor.java
-@@ -11,26 +11,51 @@
+@@ -1,83 +1,294 @@
+ /*
+  * Copyright contributors to Besu.
+  *
+  * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+  * the License. You may obtain a copy of the License at
+  *
+  * http://www.apache.org/licenses/LICENSE-2.0
+  *
+  * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+  * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
   * specific language governing permissions and limitations under the License.
   *
   * SPDX-License-Identifier: Apache-2.0
@@ -22417,7 +40461,28 @@ index 594fe83e4..2151f5760 100644
    private final BlockCreator besuBlockCreator;
    private final BftExtraDataCodec bftExtraDataCodec;
  
-@@ -59,11 +84,57 @@ public class QbftBlockCreatorAdaptor implements QbftBlockCreator {
+   /**
+    * Constructs a new QbftBlockCreator
+    *
+    * @param besuBftBlockCreator the Besu BFT block creator
+    * @param bftExtraDataCodec the bftExtraDataCodec used to encode extra data for the new header
+    */
+   public QbftBlockCreatorAdaptor(
+       final BlockCreator besuBftBlockCreator, final BftExtraDataCodec bftExtraDataCodec) {
+     this.besuBlockCreator = besuBftBlockCreator;
+     this.bftExtraDataCodec = bftExtraDataCodec;
+   }
+ 
+   @Override
+   public BlockCreationResult createBlock(
+       final long headerTimeStampSeconds, final QbftBlockHeader parentHeader) {
+     var blockResult =
+         besuBlockCreator.createBlock(
+             headerTimeStampSeconds, AdaptorUtil.toBesuBlockHeader(parentHeader));
+     return new BlockCreationResult(
+         new QbftBlockAdaptor(blockResult.getBlock()), blockResult.getBlockAccessList());
+   }
+ 
    @Override
    public QbftBlock createSealedBlock(
        final QbftBlock block, final int roundNumber, final Collection commitSeals) {
@@ -22455,7 +40520,10 @@ index 594fe83e4..2151f5760 100644
 +              initialExtraData.getVote(),
 +              roundNumber,
 +              initialExtraData.getValidators(),
-+              initialExtraData.getFalconSeals());
++              initialExtraData.getFalconSeals(),
++              // AERE ANCHOR V2 (2026-09-03, D-328): the sealed block keeps the proposer's v2 certificate
++              // verbatim, exactly as it keeps the v1 one; dropping it here is what stalled the testnet.
++              initialExtraData.getHybridSeals());
 +      final BlockHeader anchoredHeader =
 +          BlockHeaderBuilder.fromHeader(AdaptorUtil.toBesuBlockHeader(initialHeader))
 +              .extraData(bftExtraDataCodec.encode(anchoredExtraData))
@@ -22475,7 +40543,8 @@ index 594fe83e4..2151f5760 100644
      final BftExtraData sealedExtraData =
          new BftExtraData(
              initialExtraData.getVanityData(),
-@@ -72,12 +143,153 @@ public class QbftBlockCreatorAdaptor implements QbftBlockCreator {
+             commitSeals,
+             initialExtraData.getVote(),
              roundNumber,
              initialExtraData.getValidators());
  
@@ -22498,7 +40567,7 @@ index 594fe83e4..2151f5760 100644
 +      final Hash commitHash =
 +          new BftBlockHashing(bftExtraDataCodec).calculateDataHashForCommittedSeal(sealedHeader);
 +
-+      // AERE audit fix, ELIGIBLE-SIGNER BINDING: restrict the embedded certificate to ELIGIBLE
++      // AERE audit fix (AUD-CONSENSUS-1 / -2): restrict the embedded certificate to ELIGIBLE
 +      // signers (current validators carried in extraData INTERSECT the address-bound registry), so
 +      // the assembler never embeds a seal the header rule would later reject as ineligible.
 +      final Set
         registered = pqc.registeredValidatorAddresses();
@@ -22509,11 +40578,9 @@ index 594fe83e4..2151f5760 100644
 +        }
 +      }
 +
-+      // AERE HEADER GROWTH 2026-08-08: the interval gate. Measured on chain 2800 the same day: with
-+      // every validator attaching, this assembler wrote FIVE seals into EVERY header, taking it from
-+      // 525 to 3844 bytes. That is roughly SEVEN TIMES the header bytes stored per block, on every
-+      // node, for as long as the chain runs, which is what makes the interval a design constraint
-+      // and not a tuning knob.
++      // AERE DISC 2026-08-08: the interval gate. Measured on chain 2800 the same day: with all
++      // seven validators attaching, this assembler wrote FIVE seals into EVERY header, 525 -> 3844
++      // bytes, about 200 GB per node per year against 12 GB free on the tightest host.
 +      //
 +      // The anchor producer has had an interval and a cap since 7 August. This assembler, the one
 +      // that runs BEFORE the activation height, had neither, so the controls were unreachable
@@ -22542,11 +40609,10 @@ index 594fe83e4..2151f5760 100644
 +      // can sign AND is itself an eligible signer, attach its own seal so a single-signer
 +      // certificate is still produced.
 +      if (quorumCert.isEmpty() && pqc.signingEnabled()) {
-+        // REGISTRY HEIGHT BINDING (2026-08-06): this is the ONE registry question in the stack with
-+        // no honest height - "am I, right now, an eligible signer", asked before signing with the
-+        // single private key this process holds. It gets its own name rather than a fabricated
-+        // height, so that no future reader mistakes it for a verification path. See
-+        // FalconSealSupport#localSigningAddress.
++        // D2 (2026-08-06): this is the ONE registry question in the stack with no honest height -
++        // "am I, right now, an eligible signer", asked before signing with the single private key
++        // this process holds. It gets its own name rather than a fabricated height, so that no
++        // future reader mistakes it for a verification path. See FalconSealSupport#localSigningAddress.
 +        final Address self = pqc.localSigningAddress();
 +        if (self != null && eligible.contains(self)) {
 +          // AERE FIX-OPRIRE-CONSENS (b): height-gated like every other attachment point.
@@ -22586,12 +40652,11 @@ index 594fe83e4..2151f5760 100644
      return new QbftBlockAdaptor(sealedBesuBlock);
    }
 +
-+  // REGISTRY HEIGHT BINDING (2026-08-06): takes the height of the block being sealed. The seals
-+  // gathered here are over THIS block's committed-seal hash, so the height is this block's own and
-+  // is known at the call site. It matters at exactly one moment - a rotation height - where
-+  // assembling a certificate under the head key set while every validator checks it under the
-+  // scheduled one produces a block every other node rejects, with nothing in any log naming the
-+  // reason.
++  // D2 (2026-08-06): takes the height of the block being sealed. The seals gathered here are over
++  // THIS block's committed-seal hash, so the height is this block's own and is known at the call
++  // site. It matters at exactly one moment - a rotation height - where assembling a certificate
++  // under the head key set while every validator checks it under the scheduled one produces a block
++  // the fleet rejects, with nothing in any log naming the reason.
 +  private static List verifiedDistinctSeals(
 +      final FalconSealSupport pqc,
 +      final long blockNumber,
@@ -22616,7 +40681,7 @@ index 594fe83e4..2151f5760 100644
 +      }
 +      // Bind each seal to its registered validator address and keep it only if that address is an
 +      // eligible signer (a current validator with a registered key), de-duplicated by address.
-+      // REGISTRY HEIGHT BINDING, the OWN-HEAD door: this is the block this node is sealing now.
++      // D2 (b-v2): the OWN-HEAD door. This is the block this node is sealing right now.
 +      final Address signer = pqc.addressForIndexAtOwnHead(blockNumber, seal.getValidatorIndex());
 +      if (signer == null || !eligible.contains(signer) || seen.contains(signer)) {
 +        continue;
@@ -22634,7 +40699,17 @@ diff --git a/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/bl
 index 5e6de291b..cabeba99c 100644
 --- a/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/blockcreation/QbftBlockCreatorFactory.java
 +++ b/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/blockcreation/QbftBlockCreatorFactory.java
-@@ -11,6 +11,12 @@
+@@ -1,42 +1,49 @@
+ /*
+  * Copyright ConsenSys AG.
+  *
+  * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+  * the License. You may obtain a copy of the License at
+  *
+  * http://www.apache.org/licenses/LICENSE-2.0
+  *
+  * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+  * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
   * specific language governing permissions and limitations under the License.
   *
   * SPDX-License-Identifier: Apache-2.0
@@ -22647,7 +40722,9 @@ index 5e6de291b..cabeba99c 100644
   */
  package org.hyperledger.besu.consensus.qbft.blockcreation;
  
-@@ -20,6 +26,7 @@ import org.hyperledger.besu.consensus.common.ForksSchedule;
+ import org.hyperledger.besu.config.QbftConfigOptions;
+ import org.hyperledger.besu.consensus.common.ConsensusHelpers;
+ import org.hyperledger.besu.consensus.common.ForksSchedule;
  import org.hyperledger.besu.consensus.common.bft.BftExtraData;
  import org.hyperledger.besu.consensus.common.bft.BftExtraDataCodec;
  import org.hyperledger.besu.consensus.common.bft.blockcreation.BftBlockCreatorFactory;
@@ -22655,7 +40732,41 @@ index 5e6de291b..cabeba99c 100644
  import org.hyperledger.besu.datatypes.Address;
  import org.hyperledger.besu.ethereum.ProtocolContext;
  import org.hyperledger.besu.ethereum.core.BlockHeader;
-@@ -67,14 +74,34 @@ public class QbftBlockCreatorFactory extends BftBlockCreatorFactory {
+   /**
+    * Instantiates a new Qbft block creator factory.
+    *
+    * @param transactionPool the pending transactions
+    * @param protocolContext the protocol context
+@@ -50,41 +57,63 @@ public class QbftBlockCreatorFactory extends BftBlockCreatorFactory forksSchedule,
+       final MiningConfiguration miningParams,
+       final Address localAddress,
+       final BftExtraDataCodec bftExtraDataCodec,
+       final EthScheduler ethScheduler) {
+     super(
+         transactionPool,
+         protocolContext,
+         protocolSchedule,
+         forksSchedule,
+         miningParams,
+         localAddress,
+         bftExtraDataCodec,
          ethScheduler);
    }
  
@@ -22691,7 +40802,7 @@ index 5e6de291b..cabeba99c 100644
            new BftExtraData(
                ConsensusHelpers.zeroLeftPad(
                    miningConfiguration.getExtraData(), BftExtraDataCodec.EXTRA_VANITY_LENGTH),
-@@ -82,9 +109,11 @@ public class QbftBlockCreatorFactory extends BftBlockCreatorFactory (env AERE_BASEFEE_VALIDATE_FORKBLOCK).
++ * Absent = DISARMED (today's behaviour, byte for byte). A broken value = loud refusal
++ * AERE-BASEFEE-VALIDATE-CONF-01 at factory construction, i.e. at node startup, never a
++ * silent disarm. There is no consensus binding on the value: the fleet coordinates on it
++ * exactly as on the anchor heights. REGISTRY ORDER: first walk the history on the archive
++ * node (~1.77M unmeasured blocks), only then choose H; activation is the founder's.
++ */
++package org.hyperledger.besu.consensus.qbft.headervalidationrules;
++
++import org.hyperledger.besu.ethereum.core.BlockHeader;
++import org.hyperledger.besu.ethereum.mainnet.DetachedBlockHeaderValidationRule;
++import org.hyperledger.besu.ethereum.mainnet.feemarket.BaseFeeMarket;
++import org.hyperledger.besu.ethereum.mainnet.headervalidationrules.BaseFeeMarketBlockHeaderGasPriceValidationRule;
++
++import java.util.Optional;
++
++import org.slf4j.Logger;
++import org.slf4j.LoggerFactory;
++
++/** Height-gated base-fee validation at QBFT import: the missing rule, armed only above H. */
++public class AereBaseFeeImportRule implements DetachedBlockHeaderValidationRule {
++
++  private static final Logger LOG = LoggerFactory.getLogger(AereBaseFeeImportRule.class);
++
++  /** The disarmed height: no block ever reaches it, upstream behaviour everywhere. */
++  public static final long DISARMED = Long.MAX_VALUE;
++
++  /** System property naming the first height at which the rule bites. Absent = disarmed. */
++  public static final String PROPERTY_FORK_BLOCK = "aere.basefee.validate.forkBlock";
++
++  /** Environment fallback for {@link #PROPERTY_FORK_BLOCK}. */
++  public static final String ENV_FORK_BLOCK = "AERE_BASEFEE_VALIDATE_FORKBLOCK";
++
++  private final long armedFromBlock;
++  private final BaseFeeMarketBlockHeaderGasPriceValidationRule delegate;
++
++  /**
++   * @param armedFromBlock first height (inclusive) at which the rule bites; {@link #DISARMED}
++   *     for today's behaviour
++   * @param baseFeeMarket the fee market THIS NODE runs (carries the AERE floor fork), empty on
++   *     a pre-London chain
++   * @throws IllegalStateException AERE-BASEFEE-VALIDATE-CONF-02 when armed without a fee market:
++   *     an armed rule with nothing to compute against must refuse at startup, not skip silently
++   */
++  public AereBaseFeeImportRule(
++      final long armedFromBlock, final Optional baseFeeMarket) {
++    this.armedFromBlock = armedFromBlock;
++    if (armedFromBlock != DISARMED && baseFeeMarket.isEmpty()) {
++      throw new IllegalStateException(
++          "AERE-BASEFEE-VALIDATE-CONF-02: " + PROPERTY_FORK_BLOCK + " is armed at "
++              + armedFromBlock + " but this chain has no base-fee market to validate against."
++              + " An armed rule must refuse at startup, never skip silently.");
++    }
++    this.delegate =
++        baseFeeMarket.map(BaseFeeMarketBlockHeaderGasPriceValidationRule::new).orElse(null);
++  }
++
++  /**
++   * The arming height the production factory wires in, read from system configuration.
++   *
++   * @return the height, or {@link #DISARMED} when the property is not set anywhere
++   * @throws IllegalStateException AERE-BASEFEE-VALIDATE-CONF-01 on a present but unparseable
++   *     value; the factory runs at node startup, so the refusal lands at config time
++   */
++  public static long armedFromSystemConfig() {
++    String raw = System.getProperty(PROPERTY_FORK_BLOCK);
++    if (raw == null) {
++      raw = System.getenv(ENV_FORK_BLOCK);
++    }
++    if (raw == null) {
++      return DISARMED;
++    }
++    try {
++      final long h = Long.parseLong(raw.trim());
++      if (h < 0) {
++        throw new NumberFormatException("negative");
++      }
++      return h;
++    } catch (final NumberFormatException e) {
++      throw new IllegalStateException(
++          "AERE-BASEFEE-VALIDATE-CONF-01: " + PROPERTY_FORK_BLOCK
++              + " is set but not a non-negative block height: '" + raw
++              + "'. A mistyped value must refuse, never silently disarm.");
++    }
++  }
++
++  @Override
++  public boolean validate(final BlockHeader header, final BlockHeader parent) {
++    // History stays untouched: below H this rule does not exist, first statement, no compute.
++    if (header.getNumber() < armedFromBlock) {
++      return true;
++    }
++    final boolean ok = delegate.validate(header, parent);
++    if (!ok) {
++      LOG.info(
++          "AERE BASEFEE-VALIDATE: header {} carries a base fee the fee market of this node"
++              + " (floor included) does not reproduce from its parent - rejected at import",
++          header.getNumber());
++    }
++    return ok;
++  }
++
++  @Override
++  public boolean includeInLightValidation() {
++    // Same stance as the anchor digest rule: cheap, stateless, and exactly the check a
++    // header-syncing node can and should make.
++    return true;
++  }
++}
 diff --git a/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/FalconSealValidationRule.java b/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/FalconSealValidationRule.java
 new file mode 100755
-index 000000000..b09edac3a
+index 000000000..1b8bed196
 --- /dev/null
 +++ b/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/FalconSealValidationRule.java
-@@ -0,0 +1,501 @@
+@@ -0,0 +1,513 @@
 +/*
-+ * Copyright contributors to Besu / Aere Network.
++ * Copyright contributors to Besu / AERE Network.
 + *
 + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
 + * the License. You may obtain a copy of the License at
@@ -22756,12 +41008,27 @@ index 000000000..b09edac3a
 +/**
 + * Verifies the PARALLEL Falcon-512 post-quantum QUORUM CERTIFICATE embedded in a QBFT block header.
 + *
++ * 
        RETIRED ON CHAIN 2800, AND EVERYTHING BELOW DESCRIBES A RULE THAT NO LONGER APPLIES THERE
++ * (finding D-235, corrected 2026-08-19). This rule stands down at
++ * {@code PqAnchorConfig.legacyFalconRuleRetirementBlock()}, which is the anchor block itself
++ * ({@code everActive() ? anchorBlock : NEVER}). On chain 2800 the anchor block is 13,014,000 and
++ * {@code aere.falcon.forkBlock} is 14,050,000 - the arming height is ABOVE the retirement height,
++ * so this rule has never once been in force there, and arming that property changes nothing. What
++ * actually carries the post-quantum verdict on 2800 is the pair of V2 anchor rules: at every 32nd
++ * height, a certificate of at least K valid Falcon-512 seals under the block hash.
++ *
++ * 
        The text below is kept because the rule is real code and can be armed on a chain that never
++ * reached an anchor block; it is not kept as a description of 2800. Until 2026-08-19 the site, the
++ * whitepaper and seven press releases said a per-block 2f+1 Falcon quorum had been blocking since
++ * 14,050,000. That claim was withdrawn in public the same day, and the withdrawal is the reason
++ * this paragraph exists: an auditor reading the code must not find here the claim we retracted.
++ *
 + * 
        A Falcon quorum certificate is the set of Falcon-512 seals gossiped by validators on their QBFT
 + * commit messages (each a signature over the same commit hash the ECDSA committed seal signs),
 + * aggregated by the block assembler into the header's parallel Falcon-seal list.
 + *
-+ * 
        AERE audit fix, ELIGIBLE-SIGNER BINDING (2026-07-18). Both the Falcon quorum threshold
-+ * AND the counted-seal set are now bound to ONE well-defined set:
++ * 
        AERE audit fix (AUD-CONSENSUS-1 / AUD-CONSENSUS-2, 2026-07-18). Both the Falcon quorum
++ * threshold AND the counted-seal set are now bound to ONE well-defined set:
 + *
 + * 
         + *   eligibleSigners = currentValidators (getValidatorsAfterBlock(parent))
@@ -22800,13 +41067,12 @@ index 000000000..b09edac3a
 + *       boundary, i.e. arm time), NEVER an implicit accept.
 + *
    + * -+ *

    ARMING INVARIANT (eligible-signer binding): blocking should be armed only when the registry -+ * COVERS the validator set (every current validator has a Falcon key), so that {@code -+ * eligibleSigners == currentValidators} and the Falcon quorum equals the ECDSA quorum with full -+ * fault margin. When coverage is incomplete the rule stays LIVE on the intersection (it does not -+ * halt) but logs a LOUD warning that the margin is reduced and a registry re-anchor is required. -+ * This is the "either the intersection keeps it live, or it fail-closes at arm time, never as a -+ * silent halt" contract. ++ *

    ARMING INVARIANT (AUD-CONSENSUS-1): blocking should be armed only when the registry COVERS the ++ * validator set (every current validator has a Falcon key), so that {@code eligibleSigners == ++ * currentValidators} and the Falcon quorum equals the ECDSA quorum with full fault margin. When ++ * coverage is incomplete the rule stays LIVE on the intersection (it does not halt) but logs a LOUD ++ * warning that the margin is reduced and a registry re-anchor is required. This is the "either the ++ * intersection keeps it live, or it fail-closes at arm time, never as a silent halt" contract. + * + *

    STAGE-2 LATE-ANCHOR activation: when the node is configured with a late-anchor manifest + * ({@code aere.falcon.manifest} + {@code aere.falcon.anchor.address}) on a chain that launched @@ -22826,9 +41092,8 @@ index 000000000..b09edac3a + *

    WHY THIS EXISTS, measured on a live node. The summary was written at INFO on EVERY imported + * block. On chain 2800 at ~523 ms per block that is 2295 lines in twenty minutes, about 165.000 + * a day per node, and every one of them said the same thing: {@code 0 of 0 seals, -+ * |eligible|=0, no-eligible-signers}. A line that cannot change carries no information, and a log -+ * that repeats one at that rate is a log an operator stops reading, which is how a real error -+ * gets missed. ++ * |eligible|=0, no-eligible-signers}. A line that cannot change carries no information, and seven ++ * validators had just come out of a disk emergency. + * + *

    WHAT IS KEPT. Every CHANGE of outcome still logs at INFO immediately, so an operator sees the + * transition into and out of quorum on the block it happens. Unchanged state logs once per @@ -22895,14 +41160,14 @@ index 000000000..b09edac3a + * @return true to log at INFO, false to drop to DEBUG + */ + boolean shouldLogAtInfo(final String rezumat, final long blockNumber) { -+ final boolean seSchimba = !rezumat.equals(lastLoggedOutcome); ++ final boolean hasChanged = !rezumat.equals(lastLoggedOutcome); + // Long.MIN_VALUE as "never logged" cannot be subtracted from without overflowing, and an + // overflow here would silently invert the comparison: the first block would take the DEBUG + // branch and the very first line, the one that tells an operator the rule is alive at all, + // would never appear. + final boolean bataieDeInima = + lastLoggedBlock == Long.MIN_VALUE || blockNumber - lastLoggedBlock >= LOG_HEARTBEAT_BLOCKS; -+ if (seSchimba || bataieDeInima) { ++ if (hasChanged || bataieDeInima) { + lastLoggedOutcome = rezumat; + lastLoggedBlock = blockNumber; + return true; @@ -22945,7 +41210,7 @@ index 000000000..b09edac3a + // BLOCKING was simply never armed and the whole PQC layer degraded to LOG-ONLY - it failed OPEN + // on exactly the input an attacker controls. FAILED now fails CLOSED at and after the fork + // block, while PENDING keeps the deliberate log-only behaviour that lets a legitimate anchor -+ // transaction still land (see the ARMING PRECONDITION note below). ++ // transaction still land (see AUD-CONSENSUS-4 below). + final long forkBlock = pqc.forkBlock(); + if (header.getNumber() >= forkBlock && pqc.lateAnchorFailed()) { + LOG.error( @@ -22959,8 +41224,8 @@ index 000000000..b09edac3a + pqc.anchorAddress()); + return false; + } -+ // ARMING PRECONDITION: entering BLOCKING mode requires BOTH the fork height AND an ACTIVE -+ // anchored registry (genesis-anchored, or a late anchor already activated by tryActivateLateAnchor ++ // AUD-CONSENSUS-4: entering BLOCKING mode requires BOTH the fork height AND an ACTIVE anchored ++ // registry (genesis-anchored, or a late anchor already activated by tryActivateLateAnchor + // above). If forkBlock is armed at or before the late-anchor observation height, the registry is + // not yet active when the fork block is validated; blocking there rejects every block (empty + // registry => no eligible seal) and permanently HALTS the chain before the anchor-deploy @@ -22971,12 +41236,12 @@ index 000000000..b09edac3a + final boolean forkReached = header.getNumber() >= forkBlock; + final boolean registryActive = pqc.genesisAnchored() || pqc.lateAnchored(); + final boolean blocking = forkReached && registryActive; -+ // ARMED WITHOUT AN ACTIVE REGISTRY: leave a MARK, not only a line. The log-only answer below is -+ // the right answer for a header rule, and it is also how this condition used to vanish: the node -+ // was configured to enforce a post-quantum quorum, enforced nothing, and said so once per block -+ // into a file. The counter is readable from a test and from a JMX/diagnostic path; the WARN is -+ // emitted only on the first occurrence, because one line per block at a sub-second block period -+ // is itself a hazard. ++ // AERE D-079: leave a MARK, not only a line. The log-only answer below is the right answer for a ++ // header rule, and it is also how this condition used to vanish: the node was configured to ++ // enforce a post-quantum quorum, enforced nothing, and said so once per block into a file. The ++ // counter is readable from a test and from a JMX/diagnostic path; the WARN is emitted only on ++ // the first occurrence, because one line per block at a sub-second block period is itself a ++ // hazard on this fleet. + if (forkReached + && !registryActive + && pqc.noteBlockingArmedWithoutActiveRegistry(header.getNumber())) { @@ -23008,7 +41273,7 @@ index 000000000..b09edac3a + // The gate refuses to attach until the anchored registry covers ALL of these addresses. + pqc.observeValidators(header.getNumber(), validators); + -+ // AERE audit fix, ELIGIBLE-SIGNER BINDING: the eligible-signer set is the intersection of the ++ // AERE audit fix (AUD-CONSENSUS-1 / -2): the eligible-signer set is the intersection of the + // CURRENT validator set with the address-bound signer registry. BOTH the quorum and the + // counted-seal set are derived from this ONE set, so neither can drift from the other. + final Set

    registered = pqc.registeredValidatorAddresses(); @@ -23027,18 +41292,17 @@ index 000000000..b09edac3a + // A seal counts only if its registry-bound address is an eligible signer (i.e. a current + // validator with a registered key); seals from registered-but-removed validators, or from + // unregistered indices, are excluded. -+ // REGISTRY HEIGHT BINDING (2026-08-06): resolve the key set AT THE HEIGHT OF THE HEADER -+ // CARRYING THE SEAL, not at this node's head. These seals are over THIS header's committed-seal -+ // hash, so the height is this header's own - unlike R2, whose certificate commits to the -+ // PARENT. The adversarial review measured this rule asking a height-less registry; below the -+ // arming height the resolver still answers from the head registry, so the 11.8 million blocks -+ // already on chain 2800 are checked exactly as before, but the rule can no longer be the -+ // reason a rotation makes history unverifiable. ++ // D2 (2026-08-06): resolve the key set AT THE HEIGHT OF THE HEADER CARRYING THE SEAL, not at ++ // this node's head. These seals are over THIS header's committed-seal hash, so the height is ++ // this header's own - unlike R2, whose certificate commits to the PARENT. The adversarial ++ // review measured this rule asking a height-less registry; below the arming height the ++ // resolver still answers from the head registry, so the 11.8 million blocks already on chain ++ // 2800 are checked exactly as before, but the rule can no longer be the reason a rotation ++ // makes history unverifiable. + final Set
    counted = new HashSet<>(); + for (final FalconSeal seal : falconSeals) { -+ // REGISTRY HEIGHT BINDING, the HISTORY door: R1's seals are over THIS header's -+ // committed-seal hash, so the height is the header's own; the header still came from -+ // outside. ++ // D2 (b-v2): the HISTORY door. R1's seals are over THIS header's committed-seal hash, ++ // so the height is the header's own; the header still came from outside. + final Address signer = + pqc.addressForIndexAtHistoric(header.getNumber(), seal.getValidatorIndex()); + if (signer == null || !eligible.contains(signer) || counted.contains(signer)) { @@ -23087,7 +41351,7 @@ index 000000000..b09edac3a + + "(|eligible|={} < N={}). Running on the eligible intersection (LIVE, quorum={}), " + + "but two-fault liveness margin is reduced. A validator was added without an " + + "atomic registry re-anchor: RE-ANCHOR the Falcon manifest for the full validator " -+ + "set, in the same change that adds the validator, never as a later step.", ++ + "set (see PQ-CONSENSUS-LIVE-READINESS validator-expansion procedure).", + header.getNumber(), + eligible.size(), + validators.size(), @@ -23119,15 +41383,15 @@ index 000000000..b09edac3a + } + + // Pre-fork: log-only, never blocks. -+ final String stare = ++ final String state = + eligible.isEmpty() + ? "no-eligible-signers" + : (valid >= quorum ? "PQC-QUORUM-MET" : "PQC-quorum-not-yet"); + // The verdict is already decided above. Everything below only picks a LOG LEVEL. + final String rezumat = -+ stare + "|" + valid + "|" + falconSeals.size() + "|" + eligible.size() + "|" + validators.size(); ++ state + "|" + valid + "|" + falconSeals.size() + "|" + eligible.size() + "|" + validators.size(); + final boolean laInfo = shouldLogAtInfo(rezumat, header.getNumber()); -+ final String mesaj = ++ final String message = + "AERE PQC (LOG-ONLY): block {} -> {} of {} Falcon seal(s) verified over |eligible|={} " + + "(N={}); 2/3 eligible quorum would be {} [{}]. This check never blocks pre-fork; " + + "ECDSA committed seals remain decisive."; @@ -23135,24 +41399,24 @@ index 000000000..b09edac3a + lastLoggedOutcome = rezumat; + lastLoggedBlock = header.getNumber(); + LOG.info( -+ mesaj, ++ message, + header.getNumber(), + valid, + falconSeals.size(), + eligible.size(), + validators.size(), + quorum, -+ stare); ++ state); + } else { + LOG.debug( -+ mesaj, ++ message, + header.getNumber(), + valid, + falconSeals.size(), + eligible.size(), + validators.size(), + quorum, -+ stare); ++ state); + } + return true; + } catch (final Exception e) { @@ -23214,12 +41478,12 @@ index 000000000..b09edac3a +} diff --git a/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqAnchorDigestAttachedRule.java b/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqAnchorDigestAttachedRule.java new file mode 100755 -index 000000000..b1a3ba265 +index 000000000..896f0f477 --- /dev/null +++ b/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqAnchorDigestAttachedRule.java @@ -0,0 +1,115 @@ +/* -+ * Copyright contributors to Besu / Aere Network. ++ * Copyright contributors to Besu / AERE Network. + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at @@ -23335,12 +41599,12 @@ index 000000000..b1a3ba265 +} diff --git a/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqAnchorDigestRule.java b/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqAnchorDigestRule.java new file mode 100755 -index 000000000..ce646450c +index 000000000..3b80c4302 --- /dev/null +++ b/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqAnchorDigestRule.java -@@ -0,0 +1,265 @@ +@@ -0,0 +1,310 @@ +/* -+ * Copyright contributors to Besu / Aere Network. ++ * Copyright contributors to Besu / AERE Network. + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at @@ -23361,6 +41625,8 @@ index 000000000..ce646450c +import org.hyperledger.besu.consensus.common.bft.PqAnchor; +import org.hyperledger.besu.consensus.common.bft.PqAnchorConfig; +import org.hyperledger.besu.consensus.common.bft.PqAnchorLapse; ++import org.hyperledger.besu.consensus.common.bft.PqAnchorV2; ++import org.hyperledger.besu.consensus.common.bft.SchemeSeal; +import org.hyperledger.besu.consensus.qbft.QbftExtraDataCodec; +import org.hyperledger.besu.ethereum.core.BlockHeader; +import org.hyperledger.besu.ethereum.mainnet.DetachedBlockHeaderValidationRule; @@ -23396,8 +41662,8 @@ index 000000000..ce646450c + * no fast sync here to speak of. [MEASURED: enumerated from the compiled {@code SyncMode}.] + *
  • With the anchor armed, {@code PqAnchorSyncModeGuard} REFUSES TO START any node whose mode is + * not {@code FULL}. {@code SNAP}, null, blank and unrecognised all abort. Refusing to start is -+ * not catching anything. [MEASURED: 7 of 7 assertions against the compiled guard, and -+ * reproduced on a running node.] ++ * not catching anything. [MEASURED: 7 of 7 assertions against the compiled guard, and on a ++ * real node in {@code dovezi-sincronizare-2026-08-02/evidence/SNAP-AFTER-armed.txt}.] + *
  • With the anchor NOT armed, or disarmed by the emergency option, every mode starts again and + * this rule is inert by its own height gate. [MEASURED: both negative controls of the same + * probe, which is what shows the probe is measuring the anchor and not the mode string.] @@ -23409,10 +41675,9 @@ index 000000000..ce646450c + * applied to closed ones, and {@link PqAnchorDigestAttachedRule}, which carries the identical verdict + * on the ATTACHED side so that it survives {@code SKIP_DETACHED} at import. Before those two existed + * an honest node with its data directory deleted imported stripped-certificate headers in silence and -+ * reached head 350 with ZERO occurrences of this rule. [MEASURED on a node restarted from an empty -+ * data directory; and the NEGATIVE CONTROL, the same run with the two guards stubbed out, -+ * reproduces exactly that silence, which is what shows the observation is about the guards and not -+ * about the run.] ++ * reached head 350 with ZERO occurrences of this rule. [MEASURED: ++ * {@code dovezi-sincronizare-2026-08-02/evidence/OBS-BEFORE.txt}; and the negative control ++ * {@code OBS-CONTROL-STUBBED.txt} reproduces exactly that silence once the two guards are stubbed.] + * + *

    includeInLightValidation, measured. Both {@code DetachedBlockHeaderValidationRule} and + * {@code AttachedBlockHeaderValidationRule} declare {@code includeInLightValidation()} with a DEFAULT @@ -23494,6 +41759,20 @@ index 000000000..ce646450c + return false; + } + ++ // AERE ANCHOR V2 (2026-09-03): from the v2 height the ONLY accepted form is the scheme-tagged ++ // certificate under the v2 digest; below it a v2 certificate is refused. Both directions ++ // are checked so the switch is a clean fork and never a header two nodes read differently. ++ if (config.anchorV2AppliesAt(number)) { ++ return judgeV2(number, header, extraData, vanity); ++ } ++ if (!extraData.getHybridSeals().isEmpty()) { ++ LOG.warn( ++ "AERE PQ ANCHOR (R1): block {} REJECTED - carries a v2 (scheme-tagged) certificate below" ++ + " the v2 activation height {}.", ++ number, ++ config.anchorV2Block()); ++ return false; ++ } + final List certificate = List.copyOf(extraData.getFalconSeals()); + // Height aware since 2026-08-11. Inside the one measured historical window the ordering + // requirement relaxes from SORTED to DISTINCT, because 36 canonical headers were written @@ -23545,6 +41824,36 @@ index 000000000..ce646450c + } + } + ++ /** AERE ANCHOR V2: vanityData must be the v2 digest over the carried scheme-tagged certificate. */ ++ private boolean judgeV2( ++ final long number, final BlockHeader header, final BftExtraData extraData, final Bytes vanity) { ++ final List seals = extraData.getHybridSeals(); ++ if (seals.isEmpty()) { ++ LOG.warn( ++ "AERE PQ ANCHOR (R1): block {} REJECTED - at or above the v2 activation height {} the header" ++ + " carries no scheme-tagged certificate ({} v1 Falcon seal(s) instead).", ++ number, ++ config.anchorV2Block(), ++ extraData.getFalconSeals().size()); ++ return false; ++ } ++ final Bytes32 expected = ++ PqAnchorV2.anchorDigestV2( ++ config.chainId(), number - 1L, header.getParentHash().getBytes(), seals); ++ if (!expected.equals(Bytes32.wrap(vanity))) { ++ LOG.warn( ++ "AERE PQ ANCHOR (R1): block {} REJECTED - v2 anchor digest mismatch. vanityData carries {}" ++ + " but the {}-seal scheme-tagged certificate actually carried digests to {}. The" ++ + " certificate was stripped, replaced or reordered after the proposer wrote it.", ++ number, ++ vanity, ++ seals.size(), ++ expected); ++ return false; ++ } ++ return true; ++ } ++ + /** + * Accept a header from a named unenforced window as it was written, after the one check that is + * not relaxed at any height. @@ -23606,12 +41915,12 @@ index 000000000..ce646450c +} diff --git a/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqAnchorSealsRule.java b/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqAnchorSealsRule.java new file mode 100755 -index 000000000..9be0c7b33 +index 000000000..78423af47 --- /dev/null +++ b/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqAnchorSealsRule.java -@@ -0,0 +1,403 @@ +@@ -0,0 +1,579 @@ +/* -+ * Copyright contributors to Besu / Aere Network. ++ * Copyright contributors to Besu / AERE Network. + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at @@ -23630,18 +41939,28 @@ index 000000000..9be0c7b33 +import org.hyperledger.besu.consensus.common.bft.BftExtraData; +import org.hyperledger.besu.consensus.common.bft.FalconSeal; +import org.hyperledger.besu.consensus.common.bft.FalconSealSupport; ++import org.hyperledger.besu.consensus.common.bft.HybridSealSupport; ++import org.hyperledger.besu.consensus.common.bft.HybridSignerRegistry; +import org.hyperledger.besu.consensus.common.bft.PqAnchor; +import org.hyperledger.besu.consensus.common.bft.PqAnchorConfig; +import org.hyperledger.besu.consensus.common.bft.PqAnchorLapse; ++import org.hyperledger.besu.consensus.common.bft.PqAnchorV2; +import org.hyperledger.besu.consensus.common.bft.PqSignerRegistry; ++import org.hyperledger.besu.consensus.common.bft.SchemeSeal; ++import org.hyperledger.besu.consensus.common.bft.SealScheme; ++import org.hyperledger.besu.consensus.common.bft.SealSchemes; +import org.hyperledger.besu.consensus.qbft.QbftExtraDataCodec; +import org.hyperledger.besu.datatypes.Address; +import org.hyperledger.besu.ethereum.ProtocolContext; +import org.hyperledger.besu.ethereum.core.BlockHeader; +import org.hyperledger.besu.ethereum.mainnet.AttachedBlockHeaderValidationRule; + ++import java.util.ArrayList; +import java.util.Collection; ++import java.util.HashMap; +import java.util.HashSet; ++import java.util.Map; ++import java.util.Optional; +import java.util.List; +import java.util.OptionalInt; +import java.util.Set; @@ -23773,16 +42092,28 @@ index 000000000..9be0c7b33 + return false; + } + -+ // AERE REGISTRY-COVERAGE REPORT (2026-08-02). DIAGNOSTIC ONLY, and deliberately before every -+ // early return below so it runs at every height from H, including the warm-up where K is 0 -+ // and the certificate is empty. It feeds FalconSealSupport's coverage report, whose only -+ // previous source was FalconSealValidationRule - a rule that stands down at exactly the -+ // height THIS rule takes over. Above H nothing updated it, so the report was either frozen at -+ // a set from below H or, on a node whose process started above H, never set at all. Nothing -+ // here can change this rule's verdict: the call cannot throw and its result is not read. ++ // AERE D-078 (2026-08-02). DIAGNOSTIC ONLY, and deliberately before every early return below ++ // so it runs at every height from H, including the warm-up where K is 0 and the certificate is ++ // empty. It feeds FalconSealSupport's registry-coverage report, whose only previous source was ++ // FalconSealValidationRule - a rule that stands down at exactly the height THIS rule takes ++ // over. Above H nothing updated it, so the coverage report was either frozen at a set from ++ // below H or, on a node whose process started above H, never set at all. Nothing here can ++ // change this rule's verdict: the call cannot throw and its result is not read. + observeValidatorsForDiagnostics(parent, protocolContext); + + final BftExtraData extraData = extraDataCodec.decodeRaw(header.getExtraData()); ++ // AERE ANCHOR V2 (2026-09-03): one form per height, both directions refused (see R1). ++ if (config.anchorV2AppliesAt(number)) { ++ return judgeV2(number, parent, extraData, protocolContext); ++ } ++ if (!extraData.getHybridSeals().isEmpty()) { ++ LOG.warn( ++ "AERE PQ ANCHOR (R2): block {} REJECTED - carries a v2 (scheme-tagged) certificate below" ++ + " the v2 activation height {}.", ++ number, ++ config.anchorV2Block()); ++ return false; ++ } + final List certificate = List.copyOf(extraData.getFalconSeals()); + final int k = certificate.size(); + @@ -23856,59 +42187,9 @@ index 000000000..9be0c7b33 + PqAnchor.commitMessage( + config.chainId(), parent.getNumber(), parent.getHash().getBytes()); + -+ final Set

    counted = new HashSet<>(); -+ for (final FalconSeal seal : certificate) { -+ final int index = seal.getValidatorIndex(); -+ // REGISTRY ROTATION: the key set is resolved AT THE PARENT'S HEIGHT, because that is the -+ // block these seals commit to. Resolving at this block's height would be wrong by one block, -+ // and at a rotation height "wrong by one block" is a different key set. -+ // REGISTRY HEIGHT BINDING, the HISTORY door: this rule judges a header this node received, -+ // at the PARENT's height, which is the height the certificate commits to. It must refuse a -+ // height it has no registry binding for rather than answer from its own head. -+ final Address signer = -+ registry.addressForIndexAtHistoric(parent.getNumber(), index); -+ if (signer == null) { -+ LOG.warn( -+ "AERE PQ ANCHOR (R2): block {} REJECTED - certificate carries index {}, which the " -+ + "registry does not bind to any validator address. An unbound index cannot be " -+ + "shown to be eligible, so it is refused rather than skipped.", -+ number, -+ index); -+ return false; -+ } -+ if (!eligible.contains(signer)) { -+ LOG.warn( -+ "AERE PQ ANCHOR (R2): block {} REJECTED - certificate carries index {} (address {}), " -+ + "which was NOT a validator of the parent block {}.", -+ number, -+ index, -+ signer, -+ parent.getNumber()); -+ return false; -+ } -+ if (!counted.add(signer)) { -+ LOG.warn( -+ "AERE PQ ANCHOR (R2): block {} REJECTED - two distinct registry indices, including " -+ + "{}, resolve to the same validator address {}. That would let one validator be " -+ + "counted twice despite strictly increasing indices.", -+ number, -+ index, -+ signer); -+ return false; -+ } -+ if (!registry.verifyAtHistoric( -+ parent.getNumber(), index, message, seal.getSignature())) { -+ LOG.warn( -+ "AERE PQ ANCHOR (R2): block {} REJECTED - the Falcon signature from index {} " -+ + "(address {}) does not verify over M(parent {}).", -+ number, -+ index, -+ signer, -+ parent.getNumber()); -+ return false; -+ } ++ if (!falconSealsVerify(number, parent, eligible, message, certificate)) { ++ return false; + } -+ + LOG.debug( + "AERE PQ ANCHOR (R2): block {} accepted with {} verified Falcon seal(s) over parent {} " + + "(threshold K={}, |parent validators|={}).", @@ -23941,6 +42222,211 @@ index 000000000..9be0c7b33 + * @param number its height + * @return true iff the carried certificate decodes and its indices are distinct and non-negative + */ ++ /** ++ * The Falcon half, shared by the v1 and the v2 form: every seal from an index the registry binds ++ * to a validator of the parent, no two indices on one address, each verifying over M(parent). ++ */ ++ private boolean falconSealsVerify( ++ final long number, ++ final BlockHeader parent, ++ final Set
    eligible, ++ final Bytes32 message, ++ final List certificate) { ++ final Set
    counted = new HashSet<>(); ++ for (final FalconSeal seal : certificate) { ++ final int index = seal.getValidatorIndex(); ++ // D-081: the key set is resolved AT THE PARENT'S HEIGHT, because that is the block these ++ // seals commit to. Resolving at this block's height would be wrong by one block, and at a ++ // rotation height "wrong by one block" is a different key set and a permanent chain stop. ++ // D2 (b-v2): the HISTORY door. This rule judges a header this node received, at the ++ // PARENT's height, which is the height the certificate commits to. It must refuse a ++ // height it has no registry binding for rather than answer from its own head. ++ final Address signer = ++ registry.addressForIndexAtHistoric(parent.getNumber(), index); ++ if (signer == null) { ++ LOG.warn( ++ "AERE PQ ANCHOR (R2): block {} REJECTED - certificate carries index {}, which the " ++ + "registry does not bind to any validator address. An unbound index cannot be " ++ + "shown to be eligible, so it is refused rather than skipped.", ++ number, ++ index); ++ return false; ++ } ++ if (!eligible.contains(signer)) { ++ LOG.warn( ++ "AERE PQ ANCHOR (R2): block {} REJECTED - certificate carries index {} (address {}), " ++ + "which was NOT a validator of the parent block {}.", ++ number, ++ index, ++ signer, ++ parent.getNumber()); ++ return false; ++ } ++ if (!counted.add(signer)) { ++ LOG.warn( ++ "AERE PQ ANCHOR (R2): block {} REJECTED - two distinct registry indices, including " ++ + "{}, resolve to the same validator address {}. That would let one validator be " ++ + "counted twice despite strictly increasing indices.", ++ number, ++ index, ++ signer); ++ return false; ++ } ++ if (!registry.verifyAtHistoric( ++ parent.getNumber(), index, message, seal.getSignature())) { ++ LOG.warn( ++ "AERE PQ ANCHOR (R2): block {} REJECTED - the Falcon signature from index {} " ++ + "(address {}) does not verify over M(parent {}).", ++ number, ++ index, ++ signer, ++ parent.getNumber()); ++ return false; ++ } ++ } ++ return true; ++ } ++ ++ /** ++ * AERE ANCHOR V2: the scheme-tagged certificate. K Falcon seals verified exactly as in v1, and for ++ * EVERY extra scheme the scheme schedule names at the parent height, K seals that (a) come from an ++ * index also carrying a Falcon seal in this certificate and (b) verify under the hybrid registry's ++ * key for that index and scheme over the same M(parent). A scheme the schedule does not name is ++ * refused, a missing registry is refused: a node that cannot verify has not proved the header good. ++ */ ++ private boolean judgeV2( ++ final long number, ++ final BlockHeader parent, ++ final BftExtraData extraData, ++ final ProtocolContext protocolContext) { ++ final List seals = extraData.getHybridSeals(); ++ if (seals.isEmpty()) { ++ LOG.warn( ++ "AERE PQ ANCHOR (R2): block {} REJECTED - at or above the v2 activation height {} the header" ++ + " carries no scheme-tagged certificate.", ++ number, ++ config.anchorV2Block()); ++ return false; ++ } ++ final int required = config.minSealsAt(number); ++ final List falcon = new ArrayList<>(); ++ final Set falconIndices = new HashSet<>(); ++ for (final SchemeSeal s : seals) { ++ if (s.getSchemeWireId() == SealSchemes.FALCON_512.wireId()) { ++ falcon.add(new FalconSeal(s.getValidatorIndex(), s.getSignature())); ++ falconIndices.add(s.getValidatorIndex()); ++ } ++ } ++ if (falcon.size() < required) { ++ LOG.warn( ++ "AERE PQ ANCHOR (R2): block {} REJECTED - the v2 certificate has {} Falcon seal(s), below" ++ + " the threshold K={} in force at this height.", ++ number, ++ falcon.size(), ++ required); ++ return false; ++ } ++ final BftContext bftContext = protocolContext.getConsensusContext(BftContext.class); ++ final Collection
    parentValidators = ++ bftContext.getValidatorProvider().getValidatorsForBlock(parent); ++ if (parentValidators == null || parentValidators.isEmpty()) { ++ LOG.warn( ++ "AERE PQ ANCHOR (R2): block {} REJECTED - the validator set of the parent block {} could" ++ + " not be resolved, so seal eligibility cannot be decided.", ++ number, ++ parent.getNumber()); ++ return false; ++ } ++ final Set
    eligible = new HashSet<>(parentValidators); ++ final Bytes32 message = ++ PqAnchor.commitMessage(config.chainId(), parent.getNumber(), parent.getHash().getBytes()); ++ if (!falcon.isEmpty() && !falconSealsVerify(number, parent, eligible, message, falcon)) { ++ return false; ++ } ++ final HybridSealSupport hybrid = HybridSealSupport.instance(); ++ final Set requiredSchemes = new HashSet<>(); ++ hybrid.schedule().ifPresent(sch -> requiredSchemes.addAll(sch.schemesAt(parent.getNumber()))); ++ requiredSchemes.remove(SealSchemes.FALCON_512.id()); ++ final Map counted = new HashMap<>(); ++ for (final SchemeSeal s : seals) { ++ if (s.getSchemeWireId() == SealSchemes.FALCON_512.wireId()) { ++ continue; ++ } ++ final Optional scheme = SealSchemes.byWireId(s.getSchemeWireId()); ++ if (scheme.isEmpty() || !requiredSchemes.contains(scheme.get().id())) { ++ LOG.warn( ++ "AERE PQ ANCHOR (R2): block {} REJECTED - the v2 certificate carries a seal of scheme 0x{}," ++ + " which the scheme schedule does not name at the parent height {} (named: {}).", ++ number, ++ Integer.toHexString(s.getSchemeWireId() & 0xff), ++ parent.getNumber(), ++ requiredSchemes); ++ return false; ++ } ++ if (!falconIndices.contains(s.getValidatorIndex())) { ++ LOG.warn( ++ "AERE PQ ANCHOR (R2): block {} REJECTED - a {} seal from index {} is not bound to a Falcon" ++ + " seal of the same index in this certificate.", ++ number, ++ scheme.get().id(), ++ s.getValidatorIndex()); ++ return false; ++ } ++ final Optional registry = hybrid.registry(); ++ if (registry.isEmpty()) { ++ LOG.warn( ++ "AERE PQ ANCHOR (R2): block {} REJECTED - the certificate carries {} seals and this node" ++ + " has NO hybrid registry loaded, so it cannot verify them. A node that cannot" ++ + " verify has not proved the header good.", ++ number, ++ scheme.get().id()); ++ return false; ++ } ++ final Optional pk = registry.get().publicKey(s.getValidatorIndex(), scheme.get().id()); ++ if (pk.isEmpty()) { ++ LOG.warn( ++ "AERE PQ ANCHOR (R2): block {} REJECTED - the hybrid registry holds no {} key for index {}.", ++ number, ++ scheme.get().id(), ++ s.getValidatorIndex()); ++ return false; ++ } ++ if (!scheme.get().verifyRaw(pk.get(), message.toArray(), s.getSignature().toArray())) { ++ LOG.warn( ++ "AERE PQ ANCHOR (R2): block {} REJECTED - the {} signature from index {} does not verify" ++ + " over M(parent {}).", ++ number, ++ scheme.get().id(), ++ s.getValidatorIndex(), ++ parent.getNumber()); ++ return false; ++ } ++ counted.merge(scheme.get().id(), 1, Integer::sum); ++ } ++ for (final String schemeId : requiredSchemes) { ++ final int have = counted.getOrDefault(schemeId, 0); ++ if (have < required) { ++ LOG.warn( ++ "AERE PQ ANCHOR (R2): block {} REJECTED - the v2 certificate has {} valid {} seal(s), below" ++ + " the threshold K={} the schedule demands of every named scheme.", ++ number, ++ have, ++ schemeId, ++ required); ++ return false; ++ } ++ } ++ LOG.debug( ++ "AERE PQ ANCHOR (R2): block {} accepted with a {}-seal scheme-tagged certificate over parent" ++ + " {} (K={} per scheme, schemes={}).", ++ number, ++ seals.size(), ++ parent.getNumber(), ++ required, ++ requiredSchemes); ++ return true; ++ } ++ + private boolean acceptAsWrittenInsideLapse(final BlockHeader header, final long number) { + try { + final BftExtraData extraData = extraDataCodec.decodeRaw(header.getExtraData()); @@ -23972,10 +42458,9 @@ index 000000000..9be0c7b33 + } + + /** -+ * AERE REGISTRY-COVERAGE REPORT: hand the parent's validator set to {@link FalconSealSupport} so -+ * its coverage report is about the height the chain is actually at. Swallows everything: a rule -+ * that rejected a header because a diagnostic threw would be a worse defect than the one this -+ * repairs. ++ * AERE D-078: hand the parent's validator set to {@link FalconSealSupport} so its registry- ++ * coverage report is about the height the chain is actually at. Swallows everything: a rule that ++ * rejected a header because a diagnostic threw would be a worse defect than the one this repairs. + * + * @param parent the parent header + * @param protocolContext the protocol context @@ -24015,12 +42500,12 @@ index 000000000..9be0c7b33 +} diff --git a/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqEmergencyShoutRule.java b/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqEmergencyShoutRule.java new file mode 100755 -index 000000000..0f2ac709a +index 000000000..701f7a7a8 --- /dev/null +++ b/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqEmergencyShoutRule.java @@ -0,0 +1,134 @@ +/* -+ * Copyright contributors to Besu / Aere Network. ++ * Copyright contributors to Besu / AERE Network. + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at @@ -24155,12 +42640,12 @@ index 000000000..0f2ac709a +} diff --git a/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqRegistryBindingRule.java b/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqRegistryBindingRule.java new file mode 100755 -index 000000000..7792b4616 +index 000000000..84b7d98fb --- /dev/null +++ b/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqRegistryBindingRule.java -@@ -0,0 +1,91 @@ +@@ -0,0 +1,90 @@ +/* -+ * Copyright contributors to Besu / Aere Network. ++ * Copyright contributors to Besu / AERE Network. + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at @@ -24180,18 +42665,17 @@ index 000000000..7792b4616 +import org.hyperledger.besu.ethereum.mainnet.DetachedBlockHeaderValidationRule; + +/** -+ * REGISTRY BINDING, the PER-BLOCK half. ++ * A8, the PER-BLOCK half of the registry binding. + * -+ *

    The hole this closes, stated as the measurement that found it. The startup guard asks ++ *

    The hole this closes, stated as the measurement that found it. The A8 startup guard asks + * "does the registry on this node match what genesis requires" exactly once, against the chain head + * that existed when the process started. {@code config.pqRegistryHash} is a SCHEDULE, so it can have + * a second entry: a key rotation, or a validator-set change that re-anchors the manifest. A node + * that was already running when such a height passes underneath it is never asked the question + * again. It keeps verifying certificates against a registry the chain has moved off, and it keeps -+ * reporting itself healthy while it does so. That is the same defect the startup guard exists to -+ * remove, arriving through a different door, and the guard's own honest-limits note said so in -+ * writing: "the guard runs at startup; it cannot stop a node that is already running when a rotation -+ * height passes underneath it." ++ * reporting itself healthy while it does so. That is defect A8 arriving through a different door, ++ * and the honest limits section of the A8 dossier said so in writing: "the guard runs at startup; it ++ * cannot stop a node that is already running when a rotation height passes underneath it." + * + *

    Why a header rule and not a background timer. A timer would have to invent its own + * notion of "the current height" and its own reaction, and would be a second, drifting source of @@ -24205,9 +42689,9 @@ index 000000000..7792b4616 + * per height naming the hash required, the height it is required from, the hash found, the file in + * use and a fingerprint per registry row. Refusing looks harsh, and the alternative is worse: a node + * that imports a header whose certificate it cannot correctly verify has asserted a check it did not -+ * perform, which is precisely the behaviour the whole registry-binding repair exists to remove. -+ * Stopping at the first header past the rotation, loudly, is recoverable in one restart; importing -+ * 200,000 blocks under the wrong registry is not. ++ * perform, which is precisely the behaviour the whole A8 repair exists to remove. Stopping at the ++ * first header past the rotation, loudly, is recoverable in one restart; importing 200,000 blocks ++ * under the wrong registry is not. + * + *

    Inert unless somebody armed it, three times over. The rule returns true when the startup + * guard never ran on this node, when genesis carries no {@code config.pqRegistryHash} at all, and at @@ -24252,15 +42736,15 @@ index 000000000..7792b4616 +} diff --git a/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/QbftAnchorRuleWiringTest.java b/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/QbftAnchorRuleWiringTest.java new file mode 100755 -index 000000000..3a92c29ad +index 000000000..54ec478c0 --- /dev/null +++ b/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/QbftAnchorRuleWiringTest.java -@@ -0,0 +1,194 @@ +@@ -0,0 +1,246 @@ +/* -+ * AERE, the WIRING of the anchor rules into the validation chain. ++ * AERE D-148, 2026-08-07. The WIRING of the anchor rules into the validation chain. + * -+ * WHY THIS EXISTS, and it is the most expensive lesson of method we have paid for so far: "a gate -+ * that has never failed cannot be believed". ++ * WHY THIS EXISTS, and it is the very gap CLAUDE.md names as the most expensive one: "a gate that ++ * has never failed cannot be believed". + * + * The three rules are registered in QbftBlockHeaderValidationRulesetFactory. The rules themselves + * have good and plentiful tests: 18 in PqAnchorDigestRuleTest, 25 in PqAnchorSealsRuleTest. But ALL @@ -24449,15 +42933,215 @@ index 000000000..3a92c29ad + + "nothing else matters") + .containsAll(ANCHOR_RULES); + } ++ ++ // --------------------------------------------------------------------------------------------- ++ // 5. AERE D-AMONTE-02: the base-fee import rule is REALLY in the ruleset the factory builds. ++ // It is DETACHED, so without the third, lambda-only level of the reader above it would be ++ // invisible, exactly as PqAnchorDigestRule was on 2026-08-07. Disarmed-by-default: presence ++ // in the ruleset is precisely what must survive, because the rule switches on by HEIGHT. ++ // --------------------------------------------------------------------------------------------- ++ @Test ++ void theFactoryWiresTheBaseFeeImportRule() throws Exception { ++ final List inside = ++ rulesInside( ++ QbftBlockHeaderValidationRulesetFactory.blockHeaderValidator( ++ Duration.ofSeconds(1), ++ false, ++ Optional.of( ++ org.hyperledger.besu.ethereum.mainnet.feemarket.FeeMarket.london(0)), ++ armed()) ++ .build()); ++ ++ assertThat(inside) ++ .describedAs( ++ "the base-fee import rule the QBFT factory upstream forgot; if it is missing, somebody " ++ + "removed the addRule and the one-wei empty-block divergence is back") ++ .contains("AereBaseFeeImportRule"); ++ // positive control of the method ON THE SAME CLASS of rule: another detached upstream rule ++ // must be visible through the same lambda peek, otherwise the assertion above proves nothing ++ assertThat(inside).contains("AncestryValidationRule"); ++ } ++ ++ // --------------------------------------------------------------------------------------------- ++ // 6. AERE D-AMONTE-02: arming the property while the chain has NO fee market refuses at ++ // FACTORY time (node startup), through the real production path, never silently. ++ // --------------------------------------------------------------------------------------------- ++ @Test ++ void armingTheBaseFeeRuleWithoutAFeeMarketRefusesAtFactoryTime() { ++ try { ++ System.setProperty( ++ org.hyperledger.besu.consensus.qbft.headervalidationrules.AereBaseFeeImportRule ++ .PROPERTY_FORK_BLOCK, ++ "100"); ++ org.assertj.core.api.Assertions.assertThatThrownBy( ++ () -> ++ QbftBlockHeaderValidationRulesetFactory.blockHeaderValidator( ++ Duration.ofSeconds(1), false, Optional.empty(), armed())) ++ .isInstanceOf(IllegalStateException.class) ++ .hasMessageContaining("AERE-BASEFEE-VALIDATE-CONF-02"); ++ } finally { ++ System.clearProperty( ++ org.hyperledger.besu.consensus.qbft.headervalidationrules.AereBaseFeeImportRule ++ .PROPERTY_FORK_BLOCK); ++ } ++ } ++} +diff --git a/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/AereBaseFeeImportRuleTest.java b/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/AereBaseFeeImportRuleTest.java +new file mode 100755 +index 000000000..a37f63f86 +--- /dev/null ++++ b/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/AereBaseFeeImportRuleTest.java +@@ -0,0 +1,142 @@ ++/* AERE D-AMONTE-02, the base-fee import rule's proofs. ++ * ++ * The key case REPRODUCES divergence 1bis measured on mixed network 91777: an EMPTY parent at ++ * the 1 Gwei floor, an EMPTY child claiming floor plus ONE WEI. Nethermind rejected it, Besu ++ * swallowed it; with the rule armed, Besu rejects it too. The fee market is the REAL ++ * production one (LondonFeeMarket), with the floor armed through the VERY production path: ++ * system properties read at fee-market construction, set and cleaned in try/finally (the ++ * order-dependent-green lesson). */ ++package org.hyperledger.besu.consensus.qbft.headervalidationrules; ++ ++import static org.assertj.core.api.Assertions.assertThat; ++import static org.assertj.core.api.Assertions.assertThatThrownBy; ++ ++import org.hyperledger.besu.datatypes.Wei; ++import org.hyperledger.besu.ethereum.core.BlockHeader; ++import org.hyperledger.besu.ethereum.core.BlockHeaderTestFixture; ++import org.hyperledger.besu.ethereum.mainnet.feemarket.BaseFeeMarket; ++import org.hyperledger.besu.ethereum.mainnet.feemarket.FeeMarket; ++ ++import java.util.Optional; ++ ++import org.junit.jupiter.api.AfterEach; ++import org.junit.jupiter.api.Test; ++ ++public class AereBaseFeeImportRuleTest { ++ ++ private static final long H_ARMING = 10_000L; ++ private static final long FLOOR = 1_000_000_000L; // 1 Gwei, chiar valoarea de pe 2800 ++ private static final long GAZ_LIMITA = 30_000_000L; ++ ++ @AfterEach ++ public void curata() { ++ System.clearProperty("aere.basefee.floor.forkBlock"); ++ System.clearProperty("aere.basefee.floor.value"); ++ System.clearProperty(AereBaseFeeImportRule.PROPERTY_FORK_BLOCK); ++ } ++ ++ /** The REAL fee market, with the AERE floor armed from block 0 through the production path. */ ++ private BaseFeeMarket feeMarketWithFloor() { ++ try { ++ System.setProperty("aere.basefee.floor.forkBlock", "0"); ++ System.setProperty("aere.basefee.floor.value", String.valueOf(FLOOR)); ++ return FeeMarket.london(0); ++ } finally { ++ System.clearProperty("aere.basefee.floor.forkBlock"); ++ System.clearProperty("aere.basefee.floor.value"); ++ } ++ } ++ ++ private BlockHeader header(final long numar, final long taxa, final long gazFolosit) { ++ return new BlockHeaderTestFixture() ++ .number(numar) ++ .baseFeePerGas(Wei.of(taxa)) ++ .gasLimit(GAZ_LIMITA) ++ .gasUsed(gazFolosit) ++ .buildHeader(); ++ } ++ ++ // ------------------------------------------------------------------- dezarmat = amonte ++ ++ @Test ++ public void disarmedAcceptsAnyBaseFeeAnywhere() { ++ final AereBaseFeeImportRule rule = ++ new AereBaseFeeImportRule(AereBaseFeeImportRule.DISARMED, Optional.of(feeMarketWithFloor())); ++ // empty block with a bogus fee: today it passes (the very defect), and disarmed it must pass the same ++ assertThat(rule.validate(header(H_ARMING, FLOOR + 1, 0), header(H_ARMING - 1, FLOOR, 0))) ++ .isTrue(); ++ } ++ ++ @Test ++ public void disarmedNeedsNoFeeMarket() { ++ // pe un lant pre-London, dezarmat, constructia nu are voie sa cada ++ assertThat(new AereBaseFeeImportRule(AereBaseFeeImportRule.DISARMED, Optional.empty())) ++ .isNotNull(); ++ } ++ ++ // ------------------------------------------------------------------- armat, sub si peste H ++ ++ @Test ++ public void belowArmingHeightHistoryIsUntouched() { ++ final AereBaseFeeImportRule rule = ++ new AereBaseFeeImportRule(H_ARMING, Optional.of(feeMarketWithFloor())); ++ // the same header wrong by 1 wei, but BELOW H: history (the floorless days, the ++ // lost-threshold window) must pass untouched ++ assertThat(rule.validate(header(H_ARMING - 1, FLOOR + 1, 0), header(H_ARMING - 2, FLOOR, 0))) ++ .isTrue(); ++ } ++ ++ @Test ++ public void armedAcceptsTheFlooredEmptyBlock() { ++ final AereBaseFeeImportRule rule = ++ new AereBaseFeeImportRule(H_ARMING, Optional.of(feeMarketWithFloor())); ++ // empty parent at the floor -> EIP-1559 would decrease, the floor holds the fee at 1 Gwei: the live chain itself ++ assertThat(rule.validate(header(H_ARMING, FLOOR, 0), header(H_ARMING - 1, FLOOR, 0))).isTrue(); ++ } ++ ++ @Test ++ public void armedRejectsTheOneWeiEmptyBlockDivergence() { ++ final AereBaseFeeImportRule rule = ++ new AereBaseFeeImportRule(H_ARMING, Optional.of(feeMarketWithFloor())); ++ // REPRODUCEREA 1bis: bloc GOL, taxa podea+1. Nethermind o respingea, Besu o inghitea. ++ assertThat(rule.validate(header(H_ARMING, FLOOR + 1, 0), header(H_ARMING - 1, FLOOR, 0))) ++ .isFalse(); ++ } ++ ++ @Test ++ public void armedRejectsABelowFloorEmptyBlock() { ++ final AereBaseFeeImportRule rule = ++ new AereBaseFeeImportRule(H_ARMING, Optional.of(feeMarketWithFloor())); ++ // 875000000 = the very value the unpatched node wrote in the 17 July proof ++ assertThat(rule.validate(header(H_ARMING, 875_000_000L, 0), header(H_ARMING - 1, FLOOR, 0))) ++ .isFalse(); ++ } ++ ++ // ------------------------------------------------------------------- refuzurile zgomotoase ++ ++ @Test ++ public void armedWithoutFeeMarketRefusesAtConstruction() { ++ assertThatThrownBy(() -> new AereBaseFeeImportRule(H_ARMING, Optional.empty())) ++ .isInstanceOf(IllegalStateException.class) ++ .hasMessageContaining("AERE-BASEFEE-VALIDATE-CONF-02"); ++ } ++ ++ @Test ++ public void brokenPropertyRefusesLoudly() { ++ try { ++ System.setProperty(AereBaseFeeImportRule.PROPERTY_FORK_BLOCK, "10,141,734"); ++ assertThatThrownBy(AereBaseFeeImportRule::armedFromSystemConfig) ++ .isInstanceOf(IllegalStateException.class) ++ .hasMessageContaining("AERE-BASEFEE-VALIDATE-CONF-01"); ++ } finally { ++ System.clearProperty(AereBaseFeeImportRule.PROPERTY_FORK_BLOCK); ++ } ++ } ++ ++ @Test ++ public void absentPropertyMeansDisarmed() { ++ System.clearProperty(AereBaseFeeImportRule.PROPERTY_FORK_BLOCK); ++ assertThat(AereBaseFeeImportRule.armedFromSystemConfig()) ++ .isEqualTo(AereBaseFeeImportRule.DISARMED); ++ } +} diff --git a/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/FalconSealLogThrottleTest.java b/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/FalconSealLogThrottleTest.java new file mode 100755 -index 000000000..f93182488 +index 000000000..298b43988 --- /dev/null +++ b/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/FalconSealLogThrottleTest.java -@@ -0,0 +1,182 @@ +@@ -0,0 +1,181 @@ +/* -+ * Copyright contributors to Besu / Aere Network. ++ * Copyright contributors to Besu / AERE Network. + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at @@ -24485,17 +43169,16 @@ index 000000000..f93182488 +import org.junit.jupiter.api.Test; + +/** -+ * AERE: the LOG-ONLY summary must not write one INFO line per block. ++ * AERE 2026-08-07: the LOG-ONLY summary must not write one INFO line per block. + * + *

    MEASURED ON A LIVE NODE, and that is why this test exists. The rule wrote the summary at INFO -+ * on every imported block: 2295 lines in twenty minutes, every one of them identical, {@code -+ * 0 of 0 seals, |eligible|=0, no-eligible-signers}. On the previous binary the same twenty minutes -+ * had ZERO such lines, so the spam was entirely introduced by this change. ++ * on every imported block: 2295 lines in twenty minutes, about 165,000 a day per node, every ++ * one of them identical, {@code 0 of 0 seals, |eligible|=0, no-eligible-signers}. On the old binary ++ * the same twenty minutes had ZERO such lines, so the spam was entirely ours. Seven validators had ++ * just come out of a disk emergency. + * -+ *

    An ERROR or INFO line that repeats forever anaesthetises a log: operators learn to scroll past -+ * it, and the one line that matters arrives inside the noise. So a binary that replaces a running -+ * one must add zero new log lines compared with the one it replaces. This test is that requirement, -+ * for the part a unit test can hold. ++ *

    The runbook for putting this binary on the seven has, as its own item 3, "zero new log lines ++ * compared with the old binary". This test is that item, for the part a unit test can hold. + */ +class FalconSealLogThrottleTest { + @@ -24503,10 +43186,10 @@ index 000000000..f93182488 + private static final String STARE_B = "PQC-quorum-not-yet|3|5|7|7"; + + private static int numaraInfo( -+ final FalconSealValidationRule regula, final String stare, final long dePeLa, final int cate) { ++ final FalconSealValidationRule regula, final String state, final long dePeLa, final int cate) { + int n = 0; + for (int i = 0; i < cate; i++) { -+ if (regula.shouldLogAtInfo(stare, dePeLa + i)) { ++ if (regula.shouldLogAtInfo(state, dePeLa + i)) { + n++; + } + } @@ -24514,21 +43197,21 @@ index 000000000..f93182488 + } + + @Test -+ void primaOaraSeScrieIntotdeauna() { ++ void theFirstTimeIsAlwaysWritten() { + // Without this, an operator starting the node would NEVER see that the rule is alive. + final FalconSealValidationRule r = new FalconSealValidationRule(); + assertThat(r.shouldLogAtInfo(STARE_A, 12_742_475L)).isTrue(); + } + + @Test -+ void oMieDeBlocuriCuACEEASIStareScriuOSinguraLinie() { ++ void aThousandBlocksInTheSAMEStateWriteASingleLine() { + final FalconSealValidationRule r = new FalconSealValidationRule(); + // 1000 blocks, well below the heartbeat, so only the first one may come out at INFO + assertThat(numaraInfo(r, STARE_A, 1_000L, 1_000)).isEqualTo(1); + } + + @Test -+ void schimbareaStariiSeVEDEPeBloculInCareSeIntampla() { ++ void aStateChangeIsSEENOnTheBlockWhereItHappens() { + final FalconSealValidationRule r = new FalconSealValidationRule(); + numaraInfo(r, STARE_A, 1_000L, 500); + // exactly the block on which it changes, not the next one and not a heartbeat later @@ -24538,7 +43221,7 @@ index 000000000..f93182488 + } + + @Test -+ void siInapoiLaStareaVecheSeVEDE() { ++ void andGoingBackToTheOldStateIsSEENToo() { + // A regression, that is falling OUT of quorum, matters at least as much as reaching it. + final FalconSealValidationRule r = new FalconSealValidationRule(); + r.shouldLogAtInfo(STARE_A, 1_000L); @@ -24547,7 +43230,7 @@ index 000000000..f93182488 + } + + @Test -+ void bataiaDeInimaScrieOLinieLaFiecareFereastra() { ++ void theHeartbeatWritesOneLinePerWindow() { + final FalconSealValidationRule r = new FalconSealValidationRule(); + final long H = FalconSealValidationRule.LOG_HEARTBEAT_BLOCKS; + // 5 whole windows, one single state. Expected: the first line plus one per window. @@ -24561,8 +43244,8 @@ index 000000000..f93182488 + } + + @Test -+ void reducereaEDeCelPutinODieMieDeOri() { -+ // The number that matters for a node, as a proof rather than a claim in a comment. ++ void theReductionIsAtLeastAThousandfold() { ++ // The number that matters for the seven hosts, as a proof rather than a claim in a comment. + final FalconSealValidationRule r = new FalconSealValidationRule(); + final int blocuriPeZi = 165_000; // 86400 / 0.523 + final int info = numaraInfo(r, STARE_A, 1_000L, blocuriPeZi); @@ -24571,7 +43254,7 @@ index 000000000..f93182488 + } + + @Test -+ void nuSeSufocaCandStareaOscileazaLaFiecareBloc() { ++ void itDoesNotChokeWhenTheStateFlipsEveryBlock() { + // The bad case: if the state really does change on every block, the line MUST come out on every + // block. A throttle that smothered that too would hide exactly the moment we care about. + final FalconSealValidationRule r = new FalconSealValidationRule(); @@ -24585,7 +43268,7 @@ index 000000000..f93182488 + } + + @Test -+ void inaltimiCareVinInNEORDINE_nuAprindBataiaDeInima() { ++ void heightsArrivingOUTOFORDERDoNotTriggerTheHeartbeat() { + // Import runs on several threads, so heights do not always arrive in increasing order. A step + // backwards makes the difference negative; that must NOT pass the threshold and write an extra + // line. @@ -24601,7 +43284,7 @@ index 000000000..f93182488 + } + + @Test -+ void subMaiMulteFireNuIeseUnPotopSiNiciZero() throws Exception { ++ void underManyThreadsThereIsNeitherAFloodNorSilence() throws Exception { + // The rule is called from EthScheduler-Workers-N, so concurrently. I do not ask for perfect + // accuracy under races, but I do ask for the two things that matter: no flood, and no SILENCE. + final FalconSealValidationRule r = new FalconSealValidationRule(); @@ -24640,12 +43323,12 @@ index 000000000..f93182488 +} diff --git a/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/FalconSealValidationRuleRetirementTest.java b/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/FalconSealValidationRuleRetirementTest.java new file mode 100755 -index 000000000..1351cc2de +index 000000000..c03a9489b --- /dev/null +++ b/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/FalconSealValidationRuleRetirementTest.java @@ -0,0 +1,85 @@ +/* -+ * Copyright contributors to Besu / Aere Network. ++ * Copyright contributors to Besu / AERE Network. + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at @@ -24731,12 +43414,12 @@ index 000000000..1351cc2de +} diff --git a/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqAnchorDigestRuleTest.java b/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqAnchorDigestRuleTest.java new file mode 100755 -index 000000000..7f03e3667 +index 000000000..64ba7f307 --- /dev/null +++ b/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqAnchorDigestRuleTest.java @@ -0,0 +1,359 @@ +/* -+ * Copyright contributors to Besu / Aere Network. ++ * Copyright contributors to Besu / AERE Network. + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at @@ -25650,12 +44333,12 @@ index 000000000..9451ec7b7 +} diff --git a/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqAnchorSealsRuleTest.java b/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqAnchorSealsRuleTest.java new file mode 100755 -index 000000000..3bf64c2a5 +index 000000000..385abfb1f --- /dev/null +++ b/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqAnchorSealsRuleTest.java -@@ -0,0 +1,690 @@ +@@ -0,0 +1,691 @@ +/* -+ * Copyright contributors to Besu / Aere Network. ++ * Copyright contributors to Besu / AERE Network. + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at @@ -25906,18 +44589,18 @@ index 000000000..3bf64c2a5 + } + + // --------------------------------------------------------------------------------------------- -+ // KEY ROTATION AND REBINDING: an adversarial review of R2, reproduced against R2 itself. ++ // D2, the adversarial review of 2026-08-02, reproduced against R2 itself. + // -+ // T2, the first objection: a header that passes both rules today is REJECTED the moment index 0's -+ // Falcon key is rotated. Nothing else changes - same header, same parent, same validator set. -+ // T3, the second: if the index is rebound to ANOTHER validator who is still in the current set, -+ // the rule sees nothing. ++ // The dossier's T2, in its own words: "a header that passes both rules today is REJECTED the ++ // moment index 0's Falcon key is rotated. Nothing else changes: same header, same parent, same ++ // validator set." T3: "if the index is rebound to ANOTHER validator who is still in the current ++ // set, the rule sees nothing." + // -+ // Neither test could have been written against the earlier interface. PqSignerRegistry carried a ++ // These two tests could not have been written before 2026-08-06. PqSignerRegistry carried a + // height-less pair plus a default that forwarded the height-aware form to it, so every test -+ // double in the tree - including the review's own probe - silently threw the height away and -+ // answered from ONE key set. A fake with one key set cannot express a rotation, so it cannot fail -+ // on one. The compiler now refuses that fake. ++ // double in the tree - including the D2 harness's own RuleProbe - silently threw the height away ++ // and answered from ONE key set. A fake with one key set cannot express a rotation, so it cannot ++ // fail on one. The compiler now refuses that fake. + // --------------------------------------------------------------------------------------------- + + @Test @@ -25938,7 +44621,7 @@ index 000000000..3bf64c2a5 + + assertThat(rule.validate(block, parent, context)) + .describedAs( -+ "T2: the SAME header, the SAME parent and the SAME validator set, after a key " ++ "D2/T2: the SAME header, the SAME parent and the SAME validator set, after a key " + + "rotation at a height ABOVE it. R2 must resolve keys at the parent's height. If " + + "this is false the chain is unjoinable for every node that syncs after a rotation") + .isTrue(); @@ -25999,7 +44682,7 @@ index 000000000..3bf64c2a5 + + assertThat(rule.validate(block, parent, contextWith(VALIDATORS))) + .describedAs( -+ "T3 IS STILL OPEN: R2 accepts a certificate in which index 0's key is credited to " ++ "D2/T3 IS STILL OPEN: R2 accepts a certificate in which index 0's key is credited to " + + "validator 5. When this assertion has to be flipped to isFalse(), T3 has been " + + "closed and this comment is the record of when it was not") + .isTrue(); @@ -26127,9 +44810,9 @@ index 000000000..3bf64c2a5 + } + + /** -+ * T2. From {@code from}, index {@code index} answers to a NEW key generation. Everything else - -+ * the address binding, the validator set, the parent - is untouched, which is the whole point -+ * of the T2 measurement: a header that verified yesterday must still verify today. ++ * D2/T2. From {@code from}, index {@code index} answers to a NEW key generation. Everything ++ * else - the address binding, the validator set, the parent - is untouched, which is the whole ++ * point of the T2 measurement: a header that verified yesterday must still verify today. + */ + void rotateKeyFrom(final long from, final int index, final int generation) { + final Map carried = new HashMap<>(epochs.floorEntry(from).getValue()); @@ -26139,7 +44822,7 @@ index 000000000..3bf64c2a5 + } + + /** -+ * T3. From {@code from}, index {@code index} answers to a DIFFERENT validator address, keys ++ * D2/T3. From {@code from}, index {@code index} answers to a DIFFERENT validator address, keys + * untouched. The seal is then credited to a validator that did not sign it. + */ + void rebindFrom(final long from, final int index, final Address address) { @@ -26173,10 +44856,10 @@ index 000000000..3bf64c2a5 + return (rotatedIndex < 0 || validatorIndex == rotatedIndex) ? g : 0; + } + -+ // ROTATION HARDENING (a): the height-less pair is gone from PqSignerRegistry, so this double -+ // can no longer inherit a default that throws the height away. That default is why the original -+ // probe returned the same verdict on repaired and unrepaired code; a fake that cannot express a -+ // rotation cannot prove one is handled. ++ // D2 HARDENING (a), 2026-08-06: the height-less pair is gone from PqSignerRegistry, so this ++ // double can no longer inherit a default that throws the height away. That default is why the ++ // original D2 harness (RuleProbe.java:115-131) returned the same verdict on repaired and ++ // unrepaired code; a fake that cannot express a rotation cannot prove one is handled. + @Override + public Address addressForIndexAtOwnHead(final long blockNumber, final int validatorIndex) { + return addressForIndexAtHistoric(blockNumber, validatorIndex); @@ -26213,13 +44896,14 @@ index 000000000..3bf64c2a5 + } + + // --------------------------------------------------------------------------------------------- -+ // ROTATION HARDENING (b-v2). WHICH DOOR R2 GOES THROUGH, measured by behaviour, not by name. ++ // D2 HARDENING (b-v2), 2026-08-06. WHICH DOOR R2 GOES THROUGH, measured by behaviour, not by ++ // name. + // + // The shape chosen here admits its own weakness: the compiler forces you to CHOOSE between + // addressForIndexAtHistoric and addressForIndexAtOwnHead, but it does not force you to choose + // CORRECTLY. Both have the same type and both are total, so a future patch that moves this call -+ // onto the OWN-HEAD door reopens the rotation defect without anything going red, because the -+ // OWN-HEAD door is precisely the one that always answers. ++ // onto the OWN-HEAD door reopens D2 without anything going red, because the OWN-HEAD door is ++ // precisely the one that always answers. + // + // The two assertions below are the lock. The registry they run against answers DIFFERENTLY on + // the two doors, which no real registry does; that is exactly why it can say which door was @@ -26244,7 +44928,7 @@ index 000000000..3bf64c2a5 + "the HISTORY door refuses everything and the OWN-HEAD door answers everything. R2 must " + + "REJECT. If this is true, R2 is reading the own-head door, which means it would " + + "answer a header it received from the registry in force at this node's head - " -+ + "and that is the rotation defect verbatim") ++ + "and that is D2 verbatim") + .isFalse(); + + final PqAnchorSealsRule peUsaCap = @@ -26346,12 +45030,12 @@ index 000000000..3bf64c2a5 +} diff --git a/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqAnchorTestSupport.java b/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqAnchorTestSupport.java new file mode 100755 -index 000000000..4dafdf09b +index 000000000..f7961bcd3 --- /dev/null +++ b/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqAnchorTestSupport.java @@ -0,0 +1,144 @@ +/* -+ * Copyright contributors to Besu / Aere Network. ++ * Copyright contributors to Besu / AERE Network. + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at @@ -26494,14 +45178,381 @@ index 000000000..4dafdf09b + .buildHeader(); + } +} +diff --git a/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqAnchorV2RulesTest.java b/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqAnchorV2RulesTest.java +new file mode 100755 +index 000000000..4c542fe87 +--- /dev/null ++++ b/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqAnchorV2RulesTest.java +@@ -0,0 +1,361 @@ ++/* ++ * Copyright contributors to Aere Network. ++ * ++ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in ++ * compliance with the License. You may obtain a copy of the License at ++ * ++ * http://www.apache.org/licenses/LICENSE-2.0 ++ * ++ * Unless required by applicable law or agreed to in writing, software distributed under the License is ++ * distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or ++ * implied. See the License for the specific language governing permissions and limitations under the ++ * License. ++ * ++ * SPDX-License-Identifier: Apache-2.0 ++ */ ++package org.hyperledger.besu.consensus.qbft.headervalidationrules; ++ ++import static org.assertj.core.api.Assertions.assertThat; ++import static org.assertj.core.api.Assertions.assertThatThrownBy; ++import static org.hyperledger.besu.consensus.qbft.headervalidationrules.PqAnchorTestSupport.CHAIN_ID; ++import static org.hyperledger.besu.consensus.qbft.headervalidationrules.PqAnchorTestSupport.H; ++import static org.hyperledger.besu.consensus.qbft.headervalidationrules.PqAnchorTestSupport.VALIDATORS; ++import static org.hyperledger.besu.consensus.qbft.headervalidationrules.PqAnchorTestSupport.header; ++import static org.hyperledger.besu.consensus.qbft.headervalidationrules.PqAnchorTestSupport.parentHeader; ++import static org.mockito.ArgumentMatchers.any; ++import static org.mockito.Mockito.mock; ++import static org.mockito.Mockito.when; ++import static org.mockito.Mockito.withSettings; ++ ++import org.hyperledger.besu.consensus.common.bft.BftContext; ++import org.hyperledger.besu.consensus.common.bft.BftExtraData; ++import org.hyperledger.besu.consensus.common.bft.FalconSeal; ++import org.hyperledger.besu.consensus.common.bft.HybridSealSupport; ++import org.hyperledger.besu.consensus.common.bft.PqAnchor; ++import org.hyperledger.besu.consensus.common.bft.PqAnchorConfig; ++import org.hyperledger.besu.consensus.common.bft.PqAnchorV2; ++import org.hyperledger.besu.consensus.common.bft.PqSignerRegistry; ++import org.hyperledger.besu.consensus.common.bft.SchemeSeal; ++import org.hyperledger.besu.consensus.common.bft.SealScheme; ++import org.hyperledger.besu.consensus.common.bft.SealSchemes; ++import org.hyperledger.besu.consensus.common.validator.ValidatorProvider; ++import org.hyperledger.besu.consensus.qbft.QbftExtraDataCodec; ++import org.hyperledger.besu.crypto.SecureRandomProvider; ++import org.hyperledger.besu.datatypes.Address; ++import org.hyperledger.besu.ethereum.ProtocolContext; ++import org.hyperledger.besu.ethereum.core.BlockHeader; ++import org.hyperledger.besu.ethereum.rlp.RLPException; ++ ++import java.nio.file.Files; ++import java.nio.file.Path; ++import java.security.SecureRandom; ++import java.util.ArrayList; ++import java.util.Collection; ++import java.util.Collections; ++import java.util.List; ++import java.util.Map; ++import java.util.Optional; ++import java.util.OptionalInt; ++ ++import org.apache.tuweni.bytes.Bytes; ++import org.apache.tuweni.bytes.Bytes32; ++import org.junit.jupiter.api.AfterEach; ++import org.junit.jupiter.api.BeforeEach; ++import org.junit.jupiter.api.Test; ++import org.junit.jupiter.api.io.TempDir; ++import org.mockito.quality.Strictness; ++ ++/** ++ * AERE ANCHOR V2 (2026-09-03): the two header rules judge the SCHEME-TAGGED certificate, and the codec ++ * carries it in the sixth extraData element beside the v1 form. ++ * ++ *

    Falcon seals come from a fake registry (a seal is valid iff it is exactly what the fake signs for ++ * that index over M(parent)); SLH-DSA seals are REAL, from probe keys generated here and published in ++ * a hybrid-1 registry loaded through the real system-configuration path. ++ * ++ *

    Proven, each with its pair: R1 accepts the honest v2 header and refuses a stripped certificate ++ * (digest mismatch), a v2 certificate below the v2 height, and a v1 certificate at the v2 height; R2 ++ * accepts the honest v2 header and refuses an SLH-DSA seal from an index without a Falcon seal, a ++ * certificate short of one scheme, a tampered SLH-DSA signature, and a scheme the schedule does not ++ * name; the codec round-trips both forms and refuses a non-canonical v2 certificate. ++ */ ++public class PqAnchorV2RulesTest { ++ ++ private static final long V2 = H + 100L; ++ private static final int K = 3; ++ private static final String SLH = "slh-dsa-sha2-128s"; ++ private static final QbftExtraDataCodec CODEC = new QbftExtraDataCodec(); ++ ++ @TempDir Path tmp; ++ ++ private final SecureRandom random = SecureRandomProvider.createSecureRandom(); ++ private final List slhKeys = new ArrayList<>(); ++ private final FakeFalconRegistry falcon = new FakeFalconRegistry(); ++ ++ private PqAnchorConfig armedV2; ++ private PqAnchorDigestRule r1; ++ private PqAnchorSealsRule r2; ++ ++ @BeforeEach ++ void setUp() throws Exception { ++ for (int i = 0; i < VALIDATORS.size(); i++) { ++ slhKeys.add(SealSchemes.SLH_DSA_128S.generate(random)); ++ } ++ armHybrid("0:falcon-512+" + SLH); ++ armedV2 = new PqAnchorConfig( ++ CHAIN_ID, H, Map.of(H, 0, V2, K), OptionalInt.empty(), false, OptionalInt.empty(), ++ OptionalInt.empty(), V2); ++ r1 = new PqAnchorDigestRule(armedV2); ++ r2 = new PqAnchorSealsRule(armedV2, falcon); ++ } ++ ++ @AfterEach ++ void tearDown() { ++ System.clearProperty(HybridSealSupport.PROPERTY_SCHEDULE); ++ System.clearProperty(HybridSealSupport.PROPERTY_REGISTRY); ++ HybridSealSupport.resetForTesting(); ++ } ++ ++ private void armHybrid(final String schedule) throws Exception { ++ final StringBuilder p = new StringBuilder(); ++ p.append("formatVersion=hybrid-1\nchainId=").append(CHAIN_ID).append("\ncount=") ++ .append(VALIDATORS.size()).append('\n'); ++ for (int i = 0; i < VALIDATORS.size(); i++) { ++ p.append(i).append(".addr=").append(VALIDATORS.get(i).toHexString()).append('\n'); ++ p.append(i).append(".key.").append(SLH).append('=') ++ .append(Bytes.wrap(slhKeys.get(i).publicRegistryForm()).toHexString()).append('\n'); ++ } ++ final Path reg = tmp.resolve("hybrid-" + schedule.replaceAll("[^a-z0-9]", "-") + ".properties"); ++ Files.writeString(reg, p.toString()); ++ System.setProperty(HybridSealSupport.PROPERTY_SCHEDULE, schedule); ++ System.setProperty(HybridSealSupport.PROPERTY_REGISTRY, reg.toAbsolutePath().toString()); ++ HybridSealSupport.resetForTesting(); ++ assertThat(HybridSealSupport.instance().registry()).isPresent(); ++ } ++ ++ // ------------------------------------------------------------------------------ certificates ++ ++ /** Falcon seals for indices 0..falconCount-1 and SLH-DSA seals for 0..slhCount-1, canonical. */ ++ private List certificate(final BlockHeader parent, final int falconCount, final int slhCount) { ++ final Bytes32 m = PqAnchor.commitMessage(CHAIN_ID, parent.getNumber(), parent.getHash().getBytes()); ++ final List out = new ArrayList<>(); ++ for (int i = 0; i < falconCount; i++) { ++ out.add(new SchemeSeal(SealSchemes.FALCON_512.wireId(), i, FakeFalconRegistry.sign(i, m))); ++ } ++ for (int i = 0; i < slhCount; i++) { ++ out.add(new SchemeSeal(SealSchemes.SLH_DSA_128S.wireId(), i, ++ Bytes.wrap(SealSchemes.SLH_DSA_128S.sign(slhKeys.get(i).privateKey(), m.toArray()).orElseThrow()))); ++ } ++ out.sort(PqAnchorV2.CANONICAL); ++ return out; ++ } ++ ++ private static Bytes extraDataV2(final Bytes vanity, final List tagged) { ++ return CODEC.encode(new BftExtraData( ++ vanity, Collections.emptyList(), Optional.empty(), 0, VALIDATORS, Collections.emptyList(), tagged)); ++ } ++ ++ private static BlockHeader honestV2(final long number, final BlockHeader parent, final List tagged) { ++ final Bytes32 d = PqAnchorV2.anchorDigestV2(CHAIN_ID, number - 1L, parent.getHash().getBytes(), tagged); ++ return header(number, parent.getHash(), extraDataV2(d, tagged)); ++ } ++ ++ // --------------------------------------------------------------------------------------- R1 ++ ++ @Test ++ public void r1AcceptsTheHonestV2HeaderAndRefusesAStrippedCertificate() { ++ final BlockHeader parent = parentHeader(V2 + 4L); ++ final List tagged = certificate(parent, 5, 5); ++ final BlockHeader honest = honestV2(V2 + 5L, parent, tagged); ++ assertThat(r1.validate(honest, parent)).isTrue(); ++ // one SLH-DSA seal stripped under the ORIGINAL digest ++ final List stripped = new ArrayList<>(tagged); ++ stripped.removeIf(s -> s.getSchemeWireId() == SealSchemes.SLH_DSA_128S.wireId() && s.getValidatorIndex() == 4); ++ final BftExtraData decoded = CODEC.decodeRaw(honest.getExtraData()); ++ final BlockHeader strippedHeader = ++ header(V2 + 5L, parent.getHash(), extraDataV2(decoded.getVanityData(), stripped)); ++ assertThat(r1.validate(strippedHeader, parent)).isFalse(); ++ } ++ ++ @Test ++ public void r1RefusesAV2CertificateBelowTheV2HeightAndAV1CertificateAtIt() { ++ // v2 below V2: the anchor height V2-1 (interval absent => every height from H is an anchor height) ++ final BlockHeader parentBelow = parentHeader(V2 - 2L); ++ final BlockHeader v2Early = honestV2(V2 - 1L, parentBelow, certificate(parentBelow, 5, 5)); ++ assertThat(r1.validate(v2Early, parentBelow)).isFalse(); ++ // v1 at V2: an honest v1 header (correct v1 digest) is still refused, the form is wrong ++ final BlockHeader parent = parentHeader(V2 + 4L); ++ final BlockHeader v1Late = PqAnchorTestSupport.honestHeader(V2 + 5L, parent.getHash(), ++ List.of(PqAnchorTestSupport.seal(0), PqAnchorTestSupport.seal(1), PqAnchorTestSupport.seal(2))); ++ assertThat(r1.validate(v1Late, parent)).isFalse(); ++ // control: the same v1 header is accepted by a rule whose V2 lies in the future ++ final PqAnchorConfig v1World = new PqAnchorConfig( ++ CHAIN_ID, H, Map.of(H, 0, V2, K), OptionalInt.empty(), false, OptionalInt.empty(), ++ OptionalInt.empty(), V2 + 1_000L); ++ assertThat(new PqAnchorDigestRule(v1World).validate(v1Late, parent)).isTrue(); ++ } ++ ++ // --------------------------------------------------------------------------------------- R2 ++ ++ @Test ++ public void r2AcceptsTheHonestV2HeaderWithKSealsPerScheme() { ++ final BlockHeader parent = parentHeader(V2 + 4L); ++ assertThat(r2.validate(honestV2(V2 + 5L, parent, certificate(parent, K, K)), parent, context())).isTrue(); ++ // more than K of each is fine too: K is a floor ++ assertThat(r2.validate(honestV2(V2 + 5L, parent, certificate(parent, 5, 5)), parent, context())).isTrue(); ++ } ++ ++ @Test ++ public void r2RefusesAnSlhDsaSealFromAnIndexWithoutAFalconSeal() { ++ final BlockHeader parent = parentHeader(V2 + 4L); ++ final List tagged = certificate(parent, K, K + 1); // SLH-DSA from index K has no Falcon ++ assertThat(r2.validate(honestV2(V2 + 5L, parent, tagged), parent, context())).isFalse(); ++ } ++ ++ @Test ++ public void r2RefusesACertificateShortOfOneScheme() { ++ final BlockHeader parent = parentHeader(V2 + 4L); ++ assertThat(r2.validate(honestV2(V2 + 5L, parent, certificate(parent, 5, K - 1)), parent, context())) ++ .describedAs("K Falcon seals and only K-1 SLH-DSA: the schedule demands K of EVERY scheme") ++ .isFalse(); ++ assertThat(r2.validate(honestV2(V2 + 5L, parent, certificate(parent, K - 1, K - 1)), parent, context())) ++ .describedAs("short of Falcon as well") ++ .isFalse(); ++ } ++ ++ @Test ++ public void r2RefusesATamperedSlhDsaSignature() { ++ final BlockHeader parent = parentHeader(V2 + 4L); ++ final List tagged = new ArrayList<>(certificate(parent, K, K)); ++ for (int i = 0; i < tagged.size(); i++) { ++ final SchemeSeal s = tagged.get(i); ++ if (s.getSchemeWireId() == SealSchemes.SLH_DSA_128S.wireId() && s.getValidatorIndex() == 1) { ++ final byte[] sig = s.getSignature().toArray(); ++ sig[sig.length / 2] ^= 0x01; ++ tagged.set(i, new SchemeSeal(s.getSchemeWireId(), s.getValidatorIndex(), Bytes.wrap(sig))); ++ } ++ } ++ assertThat(r2.validate(honestV2(V2 + 5L, parent, tagged), parent, context())).isFalse(); ++ } ++ ++ @Test ++ public void r2RefusesASchemeTheScheduleDoesNotName() throws Exception { ++ armHybrid("0:falcon-512"); ++ final BlockHeader parent = parentHeader(V2 + 4L); ++ assertThat(r2.validate(honestV2(V2 + 5L, parent, certificate(parent, K, K)), parent, context())) ++ .describedAs("SLH-DSA seals carried while the schedule names Falcon only") ++ .isFalse(); ++ assertThat(r2.validate(honestV2(V2 + 5L, parent, certificate(parent, K, 0)), parent, context())) ++ .describedAs("control: a Falcon-only v2 certificate under a Falcon-only schedule") ++ .isTrue(); ++ } ++ ++ // ------------------------------------------------------------------------------------ codec ++ ++ @Test ++ public void theCodecRoundTripsBothFormsAndRefusesANonCanonicalV2Certificate() { ++ final BlockHeader parent = parentHeader(V2 + 4L); ++ final List tagged = certificate(parent, 2, 2); ++ final Bytes v2 = extraDataV2(Bytes32.ZERO, tagged); ++ final BftExtraData back = CODEC.decodeRaw(v2); ++ assertThat(back.getHybridSeals()).isEqualTo(tagged); ++ assertThat(back.getFalconSeals()).isEmpty(); ++ // the v1 form still round-trips through the same slot ++ final List v1 = List.of(PqAnchorTestSupport.seal(0), PqAnchorTestSupport.seal(1)); ++ final BftExtraData backV1 = CODEC.decodeRaw(PqAnchorTestSupport.extraData(Bytes32.ZERO, v1)); ++ assertThat(backV1.getFalconSeals()).containsExactlyElementsOf(v1); ++ assertThat(backV1.getHybridSeals()).isEmpty(); ++ // a v2 certificate written out of canonical order is refused at decode, not silently reordered ++ final List unsorted = new ArrayList<>(tagged); ++ Collections.reverse(unsorted); ++ // the holder accepts any list; it is the ENCODER that refuses, so no header can carry it ++ assertThatThrownBy(() -> CODEC.encode(new BftExtraData( ++ Bytes32.ZERO, Collections.emptyList(), Optional.empty(), 0, VALIDATORS, ++ Collections.emptyList(), unsorted))) ++ .isInstanceOf(RuntimeException.class); ++ // hand-built non-canonical bytes: the same seals, encoded by hand out of order, do not decode ++ final Bytes canonical = PqAnchorV2.encode(tagged); ++ final BftExtraData holder = new BftExtraData( ++ Bytes32.ZERO, Collections.emptyList(), Optional.empty(), 0, VALIDATORS, Collections.emptyList(), tagged); ++ final Bytes good = CODEC.encode(holder); ++ assertThat(good.toHexString()).contains(canonical.toUnprefixedHexString()); ++ final Bytes swapped = Bytes.fromHexString(good.toHexString().replace( ++ canonical.toUnprefixedHexString(), PqAnchorV2.encode(List.of(tagged.get(0))).toUnprefixedHexString())); ++ assertThatThrownBy(() -> CODEC.decodeRaw(swapped)).isInstanceOf(RLPException.class); ++ } ++ ++ // ------------------------------------------------------------------- D-328: the round substitution ++ ++ @Test ++ public void replacingTheRoundInABlockKeepsTheV2Certificate() { ++ // 2026-09-03, testnet 28001: every sealed v2 header lost its certificate at replaceRoundInBlock, ++ // because that copy went through the v1 constructor; R1 then refused block 168032 for 3 hours. ++ final BlockHeader parent = parentHeader(V2 + 4L); ++ final List tagged = certificate(parent, K, K); ++ final BlockHeader honest = honestV2(V2 + 5L, parent, tagged); ++ final org.hyperledger.besu.ethereum.core.Block block = ++ new org.hyperledger.besu.ethereum.core.Block(honest, org.hyperledger.besu.ethereum.core.BlockBody.empty()); ++ final org.hyperledger.besu.ethereum.core.Block substituted = ++ new org.hyperledger.besu.consensus.common.bft.BftBlockInterface(CODEC) ++ .replaceRoundInBlock(block, 7, org.hyperledger.besu.consensus.common.bft.BftBlockHeaderFunctions.forCommittedSeal(CODEC)); ++ final BftExtraData after = CODEC.decodeRaw(substituted.getHeader().getExtraData()); ++ assertThat(after.getRound()).isEqualTo(7); ++ assertThat(after.getHybridSeals()).describedAs("the v2 certificate survives the round substitution").isEqualTo(tagged); ++ assertThat(after.getFalconSeals()).isEmpty(); ++ assertThat(r1.validate(substituted.getHeader(), parent)).describedAs("R1 still binds it").isTrue(); ++ } ++ ++ // ---------------------------------------------------------------------------------- helpers ++ ++ private static ProtocolContext context() { ++ return contextWith(VALIDATORS); ++ } ++ ++ private static ProtocolContext contextWith(final Collection

    vs) { ++ final ValidatorProvider validatorProvider = ++ mock(ValidatorProvider.class, withSettings().strictness(Strictness.LENIENT)); ++ when(validatorProvider.getValidatorsForBlock(any())).thenReturn(vs); ++ when(validatorProvider.getValidatorsAfterBlock(any())).thenReturn(vs); ++ final BftContext bftContext = mock(BftContext.class, withSettings().strictness(Strictness.LENIENT)); ++ when(bftContext.getValidatorProvider()).thenReturn(validatorProvider); ++ when(bftContext.as(any())).thenReturn(bftContext); ++ return new ProtocolContext.Builder().withConsensusContext(bftContext).build(); ++ } ++ ++ /** Index i is VALIDATORS.get(i); a seal is valid iff it is exactly what {@link #sign} produces. */ ++ private static final class FakeFalconRegistry implements PqSignerRegistry { ++ static Bytes sign(final int index, final Bytes32 message) { ++ final byte[] out = new byte[655]; ++ out[0] = (byte) index; ++ for (int i = 0; i < 32; i++) { ++ out[1 + i] = message.get(i); ++ } ++ for (int i = 33; i < out.length; i++) { ++ out[i] = (byte) ((i * (index + 3) + 7) & 0xFF); ++ } ++ return Bytes.wrap(out); ++ } ++ ++ @Override ++ public Address addressForIndexAtHistoric(final long blockNumber, final int validatorIndex) { ++ return validatorIndex >= 0 && validatorIndex < VALIDATORS.size() ? VALIDATORS.get(validatorIndex) : null; ++ } ++ ++ @Override ++ public Address addressForIndexAtOwnHead(final long blockNumber, final int validatorIndex) { ++ return addressForIndexAtHistoric(blockNumber, validatorIndex); ++ } ++ ++ @Override ++ public boolean verifyAtHistoric( ++ final long blockNumber, final int validatorIndex, final Bytes message, final Bytes signature) { ++ return message.size() == 32 && sign(validatorIndex, Bytes32.wrap(message)).equals(signature); ++ } ++ ++ @Override ++ public boolean verifyAtOwnHead( ++ final long blockNumber, final int validatorIndex, final Bytes message, final Bytes signature) { ++ return verifyAtHistoric(blockNumber, validatorIndex, message, signature); ++ } ++ } ++} diff --git a/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqArmedWithoutRegistryTest.java b/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqArmedWithoutRegistryTest.java new file mode 100755 -index 000000000..419a59766 +index 000000000..ec110ed67 --- /dev/null +++ b/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqArmedWithoutRegistryTest.java @@ -0,0 +1,185 @@ +/* -+ * Copyright contributors to Besu / Aere Network. ++ * Copyright contributors to Besu / AERE Network. + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at @@ -26544,7 +45595,7 @@ index 000000000..419a59766 +import org.mockito.quality.Strictness; + +/** -+ * ARMED WITHOUT A REGISTRY, THE RESIDUAL: the accident the configuration guard cannot refuse. ++ * D-079, THE RESIDUAL: the accident the configuration guard cannot refuse. + * + *

    {@code FalconSealSupport.validateAnchorObservationHeightOrAbort} refuses to start a node whose + * blocking height is armed at or before the height at which its registry can become active. That @@ -26559,6 +45610,8 @@ index 000000000..419a59766 + * + *

    These three tests measure the mark it now leaves, in both directions. + */ ++// The D-079 label is our internal finding id. It names a fact about this ++// code, not anything outside it. +public class PqArmedWithoutRegistryTest { + + private static final int N = 9; @@ -26571,16 +45624,14 @@ index 000000000..419a59766 + + private static final String ANCHOR_ADDRESS = "0x0000000000000000000000000000000000000fa1"; + -+ /** -+ * REGISTRY BINDING: the chain this fixture's registry is BOUND to. Inside every proof, so stated. -+ */ ++ /** AERE D-146: the chain this fixture's registry is BOUND to. Inside every proof, so stated. */ + private static final long CHAIN_ID = 2_800L; + + @TempDir private Path tmp; + + @BeforeEach + public void setUp() throws Exception { -+ // REGISTRY BINDING: a v2 manifest, proof-bound, bound at FORK. This manifest used to spell its ++ // AERE D-146 (2026-08-06): v2, proof-bound, bound at FORK. This manifest used to spell its + // addresses 0xC00+i; no secp256k1 key produces those, so once AERE-PQC-REG-ARM-02 was wired + // this armed fixture could not start at all. PqV2Fixture lives in consensus:common's test + // source set and reaches here through the testArtifacts dependency this module already had. @@ -26687,12 +45738,12 @@ index 000000000..419a59766 +} diff --git a/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqEmergencyShoutRuleTest.java b/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqEmergencyShoutRuleTest.java new file mode 100755 -index 000000000..4e5d4251b +index 000000000..17d4dbc61 --- /dev/null +++ b/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqEmergencyShoutRuleTest.java @@ -0,0 +1,78 @@ +/* -+ * Copyright contributors to Besu / Aere Network. ++ * Copyright contributors to Besu / AERE Network. + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at @@ -26771,12 +45822,12 @@ index 000000000..4e5d4251b +} diff --git a/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqForkGateFeedTest.java b/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqForkGateFeedTest.java new file mode 100755 -index 000000000..d730c7ccc +index 000000000..3b9813371 --- /dev/null +++ b/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqForkGateFeedTest.java -@@ -0,0 +1,189 @@ +@@ -0,0 +1,191 @@ +/* -+ * Copyright contributors to Besu / Aere Network. ++ * Copyright contributors to Besu / AERE Network. + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at @@ -26821,7 +45872,7 @@ index 000000000..d730c7ccc +import org.mockito.quality.Strictness; + +/** -+ * SEAL-ATTACHMENT GATE, THE OTHER HALF: who feeds it above the anchor height. ++ * D-078, THE OTHER HALF: who feeds the seal-attachment gate above the anchor height. + * + *

    The gate's registry-coverage report reads a validator set recorded by {@code + * FalconSealSupport.observeValidators}. Until 2026-08-02 the ONLY caller of that method was {@link @@ -26839,6 +45890,8 @@ index 000000000..d730c7ccc + *

  • {@link PqAnchorSealsRule}, which runs at every height from H, really does feed it. + * + */ ++// The D-078 label is our internal finding id. It names a fact about this ++// code, not anything outside it. +public class PqForkGateFeedTest { + + private static final PqAnchorConfig ARMED = @@ -26928,8 +45981,8 @@ index 000000000..d730c7ccc + private static final class NoRegistry + implements org.hyperledger.besu.consensus.common.bft.PqSignerRegistry { + -+ // HEIGHT-INDEXED REGISTRY: the height-less pair was deleted from PqSignerRegistry, so this -+ // double now has to answer "at which height" like everything else. It still binds nothing. ++ // D2 (2026-08-06): the height-less pair was deleted from PqSignerRegistry, so this double now ++ // has to answer "at which height" like everything else. It still binds nothing. + @Override + public Address addressForIndexAtOwnHead(final long blockNumber, final int validatorIndex) { + return addressForIndexAtHistoric(blockNumber, validatorIndex); @@ -26968,7 +46021,17 @@ diff --git a/ethereum/eth/src/main/java/org/hyperledger/besu/ethereum/eth/sync/D index c8eb53639..76c435677 100644 --- a/ethereum/eth/src/main/java/org/hyperledger/besu/ethereum/eth/sync/DownloadHeadersStep.java +++ b/ethereum/eth/src/main/java/org/hyperledger/besu/ethereum/eth/sync/DownloadHeadersStep.java -@@ -11,6 +11,12 @@ +@@ -1,49 +1,58 @@ + /* + * Copyright ConsenSys AG. + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on + * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the * specific language governing permissions and limitations under the License. * * SPDX-License-Identifier: Apache-2.0 @@ -26981,7 +46044,15 @@ index c8eb53639..76c435677 100644 */ package org.hyperledger.besu.ethereum.eth.sync; -@@ -26,7 +32,10 @@ import org.hyperledger.besu.ethereum.eth.manager.peertask.task.GetHeadersFromPee + import static java.util.Collections.emptyList; + import static java.util.concurrent.CompletableFuture.completedFuture; + + import org.hyperledger.besu.ethereum.ProtocolContext; + import org.hyperledger.besu.ethereum.core.BlockHeader; + import org.hyperledger.besu.ethereum.eth.manager.EthContext; + import org.hyperledger.besu.ethereum.eth.manager.peertask.PeerTaskExecutorResponseCode; + import org.hyperledger.besu.ethereum.eth.manager.peertask.PeerTaskExecutorResult; + import org.hyperledger.besu.ethereum.eth.manager.peertask.task.GetHeadersFromPeerTask; import org.hyperledger.besu.ethereum.eth.sync.range.RangeHeaders; import org.hyperledger.besu.ethereum.eth.sync.range.SyncTargetRange; import org.hyperledger.besu.ethereum.eth.sync.tasks.DownloadHeaderSequenceTask; @@ -26992,7 +46063,41 @@ index c8eb53639..76c435677 100644 import org.hyperledger.besu.plugin.services.MetricsSystem; import org.hyperledger.besu.util.FutureUtils; -@@ -112,11 +121,103 @@ public class DownloadHeadersStep + import java.util.ArrayList; + import java.util.List; + import java.util.concurrent.CompletableFuture; + import java.util.function.Function; + + import org.slf4j.Logger; + import org.slf4j.LoggerFactory; + + public class DownloadHeadersStep + implements Function> { + private static final Logger LOG = LoggerFactory.getLogger(DownloadHeadersStep.class); + private final ProtocolSchedule protocolSchedule; + private final ProtocolContext protocolContext; + private final EthContext ethContext; + private final ValidationPolicy validationPolicy; + private final int headerRequestSize; + private final MetricsSystem metricsSystem; +@@ -95,40 +104,132 @@ public class DownloadHeadersStep + LOG.debug("Downloading headers starting from {}", range.getStart().getNumber()); + return ethContext + .getScheduler() + .scheduleServiceTask( + () -> { + GetHeadersFromPeerTask task = + new GetHeadersFromPeerTask( + range.getStart().getHash(), + range.getStart().getNumber(), + headerRequestSize, + 0, + GetHeadersFromPeerTask.Direction.FORWARD, + protocolSchedule); + PeerTaskExecutorResult> taskResult = + ethContext.getPeerTaskExecutor().execute(task); + if (taskResult.responseCode() != PeerTaskExecutorResponseCode.SUCCESS + || taskResult.result().isEmpty()) { return CompletableFuture.failedFuture( new RuntimeException("Unable to download headers for range " + range)); } @@ -27097,3 +46202,18 @@ index c8eb53639..76c435677 100644 private RangeHeaders processHeaders( final SyncTargetRange checkpointRange, final List headers) { if (checkpointRange.hasEnd()) { + final List headersToImport = new ArrayList<>(headers); + headersToImport.add(checkpointRange.getEnd()); + return new RangeHeaders(checkpointRange, headersToImport); + } else { + List headersToImport = headers; + if (!headers.isEmpty() && headers.getFirst().equals(checkpointRange.getStart())) { + headersToImport = headers.subList(1, headers.size()); + } + return new RangeHeaders(checkpointRange, headersToImport); + } + } + } +-- +2.43.0 + diff --git a/registries/README.md b/registries/README.md index bebc116..5fc14ae 100644 --- a/registries/README.md +++ b/registries/README.md @@ -1,4 +1,4 @@ -# Falcon validator registries for chain 2800 +# Falcon and SLH-DSA validator registries for chain 2800 These files are the **public** Falcon-512 validator registries that a node must hold to validate the post-quantum certificate anchor (see `../anchor/README.md` and `../RUN-A-NODE.md`). Without them a @@ -29,6 +29,7 @@ are mode 600 and stay on the validators. The repository's secret gate passes on | `manifest-13014000.json` | 13,014,000 | 7 | the registry in force from the first anchor; carried in `registry.history` | | `registru-2800-v2-13600000.properties` | 13,600,000 | 9 | the nine-validator registry from the set expansion; carried in `registry.history` | | `manifest-13600000.json` | 13,600,000 | 9 | the head registry, passed as `aere.falcon.manifest` | +| `hibrid-1.properties` | 17,047,568 | 9 | the SLH-DSA-SHA2-128s public keys of the same nine validators (`formatVersion=hybrid-1`), passed as `aere.pq.hybridRegistry`; needed from the first hybrid anchor, block 17,047,600 | `SHA256SUMS` carries the digests. Verify after copying: diff --git a/registries/SHA256SUMS b/registries/SHA256SUMS index 024fae9..13953f7 100644 --- a/registries/SHA256SUMS +++ b/registries/SHA256SUMS @@ -1,3 +1,4 @@ 006b1b3fb814ed84622539160956263faca7c0b76585c22f2e8acb926c0bcb7f *manifest-13014000.json 23736b7d4ba1d3213496f8b5a5f756d5c958b08efebdeb1329b24d7dfa45fb6e *manifest-13600000.json c9a215d294e106f69fb2f16e3af21f9787523969e4b7260a3098f4b2cf458059 *registru-2800-v2-13600000.properties +f155bd46958cd533e710f79aac4fd96549d7b6ca54df17df71a4e5d876012c59 *hibrid-1.properties diff --git a/registries/hibrid-1.properties b/registries/hibrid-1.properties new file mode 100644 index 0000000..bc37a7a --- /dev/null +++ b/registries/hibrid-1.properties @@ -0,0 +1,21 @@ +formatVersion=hybrid-1 +chainId=2800 +count=9 +0.addr=0x4bf6f91d84b37454544279cba152581ed6820044 +0.key.slh-dsa-sha2-128s=0x5a223b6ccd6991221265ed715c0d0656a5f14aa3820624d21f044a9fe480f427 +1.addr=0x5f50fc4e1b129bbd5e6e9f80c57680b0b4a86eb0 +1.key.slh-dsa-sha2-128s=0x73e76257c40876cd9fa2d08060b1be9a8ed216cee06daa351f35ff6d985c34db +2.addr=0x97473985d04723299559f49b856effb47d7abfad +2.key.slh-dsa-sha2-128s=0x30faf2e4626a0fffd74369c1c1f1c9ef795526677dc9b1a53807f7d2d255a44a +3.addr=0xb5e768cb3117ea25175f51aa956b48691025c2a8 +3.key.slh-dsa-sha2-128s=0xf04aca3422194bae6cf9cecf8214215f4c72b5728479f4789fc0bf9a47bcefa7 +4.addr=0xc3314fd768bb68b986e80c0a14175f6f72630d7a +4.key.slh-dsa-sha2-128s=0xffc690bb8feb463cc359c0dd64f017f6af77e3fdca17864d562010a1bd058687 +5.addr=0xe13aa491abbc1252dd714e7ca0e55717a2143eaf +5.key.slh-dsa-sha2-128s=0xe4e78e33faf1538665753136783ce1cfcd7ac20d29473b7079905d2859bccf4e +6.addr=0xf73bbbd26a82dbc769066550d8d4585eab2fc00d +6.key.slh-dsa-sha2-128s=0x4d64e902943d4a78d5dec0ab0f9ab7271ca34b1bb94d84b6e867698b33e03c0f +7.addr=0xdf09b32c761620c5be77da398b97a64f03c3980c +7.key.slh-dsa-sha2-128s=0x4680b2ae637453f4d28a4092489884f89488fa0df7a95a9f68aa3aaa22112f86 +8.addr=0x1bd5514286f5602a6762b0075266379d29af1c9d +8.key.slh-dsa-sha2-128s=0x9de25aee7a187dc2d82c60792f70b6ad71a90d744f89b0baf70639af4c682a20