The first witness run caught a real gap: the proposal was signed twice - once for the
local copy, once for the wire - and only the local copy carried the proposer's Falcon
seal. Locally sealed, unsealed on the wire: with enforcement armed, the fleet stopped at
the enforcement height even though every node was emitting. Falcon signatures are
randomised, so the fix is structural rather than cosmetic: the proposal is built once,
seal included, and the transmitter sends that same object - two signings would produce
two valid and different proposals from the same proposer.
A new plumbing test refuses the defect's return: it fails if the transmitter's wire path
ever builds its own payload again. On the test network after the fix: emission covered
seven of seven proposers, each sealing exactly its first proposal past the gate; with
enforcement armed and emission on, the chain crossed the enforcement height with zero
refusals; with emission off it stopped exactly one block short of the height, every
refusal logged; and one unarmed node could not keep the chain alive.
Still armed nowhere: the properties are unset, and unset means never.
a9af2de488