[Jainakin]

Node moves the maintained beta.5 boundary to the focused rgb-lib-bfa graph and complete authenticated invoice/proxy-1.0 transfers. The original invoice retains recipient keys, encryption and expiry. External/watch-only signing, signer shutdown with outstanding-clone revocation, task/session cleanup, BIP-322 and durable default-on VSS remain available. Iris stays on-chain only.

Candidate source: 3b1bd68049f6a827508d6f762a0a155ae6d8876a, unpublished version 0.2.0-bfa.1. Previous binaries and sidecars are not relabeled. Preparation and final read-only admission verify exact source, compiled runtime literals, wrapper/adapter/lock hashes and platform binary identities.

Component	Exact source
RLN #212	89ebe9fdb1be94cbba0b2bd722cea9af297399f1
RGB #4	abd41d3afff6d8fb11461e26e843301650e22df3
Canonical merged LDK #59	17f2fb56f8d96d0ec512c715d2ebc65f829eb2c2

Both maintained bindings use identical adapter SHA-256 4a730e3036e1197b2d9cd2d2584de722745f35e74dd1707dfe9b08e251b8b12b and C-FFI lock SHA-256 741bd3d0f81b28c1f40e426b44f5c9ae152d777269934d7c0dc919d74f908da9.

The accepted graph restores native fixed-zero channel funding and protected prepared sweeps. All six newly reachable mutation sites durably admit snapshot intent; unsupported nonzero locktimes reject before admission, and prepared-sweep inspection remains read-only. The complete output-operation writer retains its raw inner guards and lock ordering, preserving reservation/journal coherence without recursive-lock deadlocks. Native confirmed-consumption, canonical receipt checks and uncancellable financial session ownership remain intact.

The final follow-up limits Git’s Docker ownership exception to the exact checkout and a single source-receipt command. A simulated different-owner regression verifies rejection without that exception, successful exact-root reads and unchanged persistent Git configuration. Native graph, adapter, wrapper, build-recipe and lock identities are byte-for-byte unchanged.

Validation

• Final maintained library: 453 passed, zero failed. Four default-run ignores are one subprocess helper and three owned funded cases; all three funded cases were separately executed and passed.
• Actual funded fixtures cover watch-only output creation, signer failure/SQL-journal recovery, independent funding despite legacy reservations, exact txids/fees/output counts, fixed-zero BTC/RGB builders, protected prepare/cancel/recovery/handoff, zero-confirmation rejection, confirmed idempotent consumption and exact 100-unit self-receive. Paused and enabled upload-failure modes retain pending state and preserve successful financial results.
• Real encrypted protobuf VSS client/server cases cover backup/reopen/fresh restore, legacy-record preservation, canceled-caller lock barriers, default-on automatic backup, paused mutations, re-enable catch-up before acknowledgement, canceled UI waiters and durable paused choice. No status read or local acknowledgement invents a cloud completion.
• The exact 639-byte Dev-USDT public contract imports on native Signet with Bridged USDT / BUSDT / precision 6 and zero allocated balance; a different native chain rejects it. This is metadata registration, not funded hosted mint acceptance.
• 19 C-FFI tests, 112 Bare installer/contract tests, 47 Node host contract tests and both TypeScript checks pass. Maintained signer lifecycle and BIP-322 are included in the native library run. Initial diagnostics are retained; test fixtures now explicitly create private signer directories without weakening production permission checks.

Current candidate producers: Android ARM64 and Node Darwin ARM64. The superseded cc8 producer was cancelled after a three-file payload expected-contract correction; no artifact was relabeled. The earlier Node b516 producer is historical; its Docker matrix completed native and packed-consumer tests but failed source-receipt generation on Git ownership, corrected by the focused qualification-only follow-up. The final Android ARM64 original upload is admitted: exact source/hash/ABI, 16 KiB ELF/TLS and protected DYNAMIC/GOT all pass, and the staged addon retains original bytes. Original ZIP SHA-256 is aef86af108632e634daeb1feec7555f4354a2803bdbdb7464477b827537d8228; addon SHA-256 is b6723a9c679da6a37d7c833434b9fd224c5b9ea71980b3ec37b00afdbf6a1bb2. The final Node Darwin ARM64 upload also passes exact provenance/Mach-O admission and an actual clean installed native consumer on the local Mac (VSS admission, signer reopen and lifecycle). Its original ZIP SHA-256 is b033700b00ab32229b86ef2d7a5127a6111a4237aa01d9297ca8178e106bae7d; native SHA-256 is 17fb8ee34ca5dcf074c1565a5f68f1eea597a2effdc9c88cdad2f5e43c66cfc5. A fresh exact-head build independently reproduces that native binary; no historical artifact was relabeled. Final source CI and the Docker release matrix pass. Actual Android APK runtime acceptance remains a separate gate; upstream CI success is not used as mobile qualification. Other platform builds and complete distribution assembly remain deferred; strict all-target publication gates remain unchanged. See BFA-MIGRATION.md.

Scope and remaining qualification

No merge, publication or hosted dev bridge operation. Published beta.5, older qualified artifacts, running apps and shared baseline stacks remain separate.

• Android artifact collection, actual clean packed consumers, WDK/Iris integration and final Release APK acceptance are separate gates on these exact sources. The Node producer explicitly selects one target; all remains available for final platform qualification.
• The inherited LDK legacy full test-harness limitation remains documented; this PR does not claim it is fixed.
• Legacy IFA link-right metadata/API parity is unavailable in the new library and fails explicitly. Generic Lightning/public-network/physical-device acceptance is not inferred from the funded host fixtures.
• External-signer VSS credential derivation still uses public bootstrap material. Functional encrypted backup/restore does not establish private signer-derived confidentiality or exclusive authorization; that upstream signer API limitation remains. No mnemonic fallback is introduced.
• New-graph BFA funded mint/burn and hosted Signet bridge acceptance require their own evidence. Older graph transfers and mobile artifacts do not qualify this candidate.