[Jainakin]

The dev USDT contract and authenticated proxy protocol 1.0 require UTEXO-Protocol/rgb-lib-bfa. This focused migration supplies complete-invoice transfers, real public-contract registration and compatible wallet/indexer/EVM configuration while retaining external signing, VSS and the caller-selected on-chain profile. Research PR #211 stays unchanged.

Component	Exact candidate source
RLN	89ebe9fdb1be94cbba0b2bd722cea9af297399f1
rgb-lib-bfa, RGB #4	abd41d3afff6d8fb11461e26e843301650e22df3
LDK, LDK #59	17f2fb56f8d96d0ec512c715d2ebc65f829eb2c2

Resulting behavior

• Single and batch sends retain complete invoices, including recipient keys, encryption and expiry. Network, asset, assignment, witness data, duplicate recipients and aggregate bounds are checked before wallet admission. One batch uses one native send and Bitcoin fee. Legacy keyless proxy requests reject explicitly; out-of-band transfers retain their separate path.
• Public-contract import validates the real contract and expected asset before registration and creates no allocations. Public-network startup requires an explicit validated protocol-1.0 proxy. EVM endpoints remain explicit, with params: [] for empty-argument RPC calls.
• Channel funding uses dedicated library-owned final-zero-locktime builders before transaction-bound persistence. Standard and virtual funding carry proofs/media over their existing encrypted peer transport, with matching out-of-band native recipients. Both funding paths read fascia using the library’s canonical bounded binary decoder and propagate decoding errors before consumption/signing. Public proxy recipient-key admission stays strict.
• Protected sweeps persist exact native PSBT/proofs and a recovery receipt, validate canonical identity, mark handoff before signing and consume only the exact independently confirmed witness. Orphans recover by exact input set; partial overlap rejects. Self-receives cannot advance stock ahead of canonical consumption.
• REST receive reserves invoices on a blocking worker while retaining session admission. SDK sends retain that admission across the full begin/sign/end pipeline; SDK receive retains it through its worker even if the caller stops waiting. Three regressions cover cancellation, queued mutations, actual wallet locking and worker error/panic cleanup. This specifically repairs RGB send/receive ownership; it is not a claim that all SDK futures are cancellation-safe.
• VSS retains encrypted immutable generations, manifest CAS/readback, content-bound acknowledgements and bounded authenticated staged restore. SQLite pools are created and closed on their owning database runtime, including staged restore. ZIP admission rejects ambiguous legacy filename encodings. Dependency alignment does not add an application wallet-data migration.
• Android transfer fixtures retain the genuine complete receive invoice and use sendrgbinvoice, including keys and encryption. Their original amounts, fees and 127 assertions are retained; the native legacy proxy rejection is unchanged.
• C binding invoice JSON supports the absent deprecated proxy ID plus public key/encryption metadata. Genuine test exports convert private validated cache files into standard public contracts; receiver validation stays strict. Batch fixtures register their contracts before requesting asset-constrained invoices. Regtest pins proxy 0.4.0 by image digest and checks protocol 1.0. Diagnostic uploads archive colon-bearing native paths without renaming wallet files.

Fresh-address mode is supported. reuse_addresses=true rejects before wallet creation/access rather than silently emulating a missing native capability. The migration scope and recovery contract are documented in docs/rgb-lib-bfa-migration.txt.

Validation

Final commit 89ebe9fdb1be94cbba0b2bd722cea9af297399f1 has 52 successful checks, one intentionally skipped AI review, and no pending or failed checks. All eleven workflows completed (ten successful, one skipped); the PR remains a draft requiring human review.

The final test workflow recorded these separate scopes; overlapping suites are not summed:

Scope	Passed	Failed	Ignored	Filtered
Library	330	0	2	0
Main integration suite	444	0	2	2
SDK integration suite	29	0	7	0
Separate UniFFI smoke	14	0	0	335

VSS actually executed the full fresh-device BTC/assets/channel restore (131.79 seconds) and consignment re-import (348.01 seconds), both passing with zero ignored tests and no skip markers. The named VSS suite passed 31 tests with two existing ignored helpers; durability, teardown, fresh-address, unreachable-service and process-kill scopes also passed.

The final generated SDK E2E workflow passed, including the actual Android PaymentTest, colored Kotlin payment/close/return flows and Python signer/restart cases. Android exercised the exact 400-unit funding projection, payments, close settlement and complete-invoice on-chain sends. All seven host/toolchain builds, both canonical ancestry checks, feature/parity checks, external-signer regressions, AddressSanitizer and ThreadSanitizer passed. Swift iOS XCFramework, Android JNI and Kotlin JVM artifacts, WASM, lint, formatting and CodeQL also passed. These upstream CI artifacts do not replace maintained Bare/Node distribution qualification.

The financial fixtures distinguish the closing transaction from its later RGB sweeps. Only explicit close fixtures confirm observed descendants of the exact v1 P2WSH funding outpoint. Generic balance waits do not mine. Known trusted virtual channels use their explicit metadata; real and unknown funded modes retain strict Bitcoin observation. The Python/Docker read-only probe retries only timed-out reads, at most three attempts within its existing eight-second total/two-second attempt limits; RPC errors, invalid identity and malformed data still fail. Original deadlines are rechecked before success or mining.

Android waits for the real 400-unit native RGB funding projection after LDK usability, within the original shared 120-second readiness window. Its local nonmining poll is capped at 70 seconds or the remaining original window, whichever is shorter. All 127 original assertions and financial amounts remain. The full Kotlin host fixture and four Android classes compile against the actual generated binding; eleven pure JVM helper cases pass. Sixteen Python probe cases and four close-context semantic cases in each actual Rust harness pass; those four vectors are not eight distinct cases.

Earlier source-bound runs and failed diagnostics remain in the qualification records; they are not relabeled as final-head acceptance. The final results above belong to the exact final commit.

The pinned RGB source passed 145 distinct local tests, zero ignored, and all seven CI jobs. LDK #59 was squash merged as 17f2fb5, with the exact tree of reviewed 191c8b8; canonical ancestry passes. Electrum/Esplora workspace checks, four public configuration tests per feature and workflow-pinned Rust 1.63 formatting passed. The inherited full LDK legacy unit-test harness compilation failure is recorded separately; no full LDK unit-test pass is claimed.

Scope and remaining acceptance

This supplies source prerequisites. Maintained Bare/Node overlays must be rebased with their signer shutdown/session cleanup, BIP-322 and VSS policy preserved, including explicit admission for the new native mutation paths. Native artifacts, WDK consumers and Iris require exact-source updates and rebuilding. Existing published beta.5 and historical mobile BFA mint/burn use older graphs. Current dev-USDT contract import and IFA burn tests do not establish new-graph BFA mint/burn, every bridge destination/preimage protocol, or hosted Signet acceptance. Iris remains on-chain only.

• Legacy IFA link-right/link metadata APIs are absent from the new library; explicit rejection/no-mutation tests do not provide parity.
• External-signer VSS credentials still derive from public bootstrap material. Functional encrypted restore does not establish confidentiality or exclusive authorization against someone with that material. Secret-backed credentials require a separate signer API change; no mnemonic fallback is introduced.
• General Lightning/VSS cross-handle serialization, arbitrary crash/reorg recovery, physical devices and public-network qualification remain separate acceptance scopes.

The remaining merge order is RGB #4 into bfa, then this PR into dev after review and final gates. LDK #59 is already merged and pinned by its canonical squash identity. Preserve reviewed RGB abd41d3 when merging, or update and requalify dependent pins after squash/rebase. No merge, publication, hosted bridge operation or repository administration change is part of this repair.