Final Testnetexplorer K_J · Final Testnet · 48359
en

Contract

0xc6b7ba477b3d9da312a26d2008d6ef5b4392186f

Address
0xc6b7ba477b3d9da312a26d2008d6ef5b4392186f
Kind
verified contract FinalEndpointRegistry
Balance
0 vETH
Nonce
1
Code
10,873 bytes codehash 0xb29576630b86800942981b1d162dfa16e2da6241722aee9acc7107a725ad8d93

account tree

Tree
1 · accounts
Present
no leaf
Key
0xbb0afd293e95358c09b18208909b81c8113b9eb2e28af798056c7c70596fc1aa
Live root
0x6d72b53fa4ff33a006dbb1e62210da0466cea22c427258ba677493791d7c7734
This address holds no leaf in the account tree. Every Final Wallet — service identities included — has one, so an absent leaf means an ordinary account rather than a wallet.
transactionseventstoken transferscontract

source verified

Contract
FinalEndpointRegistry exact match · immutables masked
Compiler
v0.8.33+commit.64118f21
Optimizer
enabled · 200 runs
EVM version
prague
Verified
2026-09-13T13:30:48.576Z
Provenance
preverify-final-chain (forge artifact, bytecode compared against live code)

contracts/finalchain/FinalCertificate.sol

// SPDX-License-Identifier: BUSL-1.1
// Copyright (c) 2024-2026 Final DeFi
// Licensed under the Business Source License 1.1 (the "License")
//
// Change Date: 2029-01-01
// Change License: GPL-2.0-or-later
//
// Additional Use Grant:
// 1. Any person or entity may link against and call this certificate reader,
//    and may encode certificates that it accepts, as part of the Final DeFi
//    Protocol.
// 2. Operators, integrators, and end users may have their certificates parsed,
//    self-checked, and verified through any Final DeFi surface that links it.
// 3. For the avoidance of doubt, this Grant does NOT permit the commercial
//    deployment of a Fork of this certificate reader or a competing identity
//    certificate format derived from it without permission prior to the
//    Change Date.
//
// @author Final DeFi
// @version 1.0.0
pragma solidity ^0.8.20;

import {FinalChainPrecompiles} from "./FinalChainPrecompiles.sol";
import {FinalChainTime} from "./FinalChainTime.sol";

/**
 * @title Final Certificate
 * @notice Reads a Final Certificate on chain and self-checks it, so a certificate's keys can never be
 *         anything other than the keys it declares.
 * @dev Deployed only as part of this project's own reth-based state plane, and only on the reth-based chains
 *      that carry the precompiles it calls: SHA3-256 at `0x0202`, ML-DSA-87 at `0x0204` and
 *      SLH-DSA-SHAKE-256s at `0x0205`, each address being that primitive's FIPS number. The contracts it is
 *      linked into probe those precompiles at construction and refuse to exist where they are absent, so
 *      this library never runs somewhere its verdicts would be meaningless. It takes part in no CREATE2
 *      derivation, and nothing outside this directory imports it.
 *
 *      The SHA3 precompile is not a convenience: the certificate format hashes with FIPS-202 SHA3 and the
 *      EVM's `keccak256` is a DIFFERENT function, so a digest computed with the wrong one matches no
 *      certificate any issuer ever wrote.
 *
 *      ## Why the chain parses this at all
 *
 *      The alternative is taking the TBS bytes and the public keys as separate arguments and deriving
 *      `certHash` from the bytes. That looks like verification and is not: nothing compares the keys to the
 *      certificate, so a registrar could bind any certificate to any keypair, the registry would hold a key
 *      the certificate does not contain, and every signature that key produced would verify against a
 *      certificate that never authorised it.
 *
 *      So the keys are read OUT of the certificate. There is one input, and no pair of arguments that can
 *      disagree.
 *
 *      Gas is deliberately not a design constraint on the chain this runs on and must not be optimised for.
 *      Parsing and re-hashing on chain costs more than trusting a parse done elsewhere and buys a verdict
 *      that is re-derivable from public state, which is the trade this whole plane is built on.
 *
 *      ## The key-identifier check
 *
 *      A certificate declares `SubjectKeyId` as the SHA3-256 digest of its `PublicKeyBlock`. Having parsed
 *      that block, {parse} recomputes the digest and compares. The field sits inside the TBS, so it is
 *      covered by the issuer's signatures — which makes the check a statement about what the issuer
 *      attested, not merely about internal consistency of bytes the caller supplied.
 *
 *      ## Deploy-linked, not inlined
 *
 *      {parseLive}, {parseRecovery}, {parseCa} and {verifyIssuerSignatures} are `external`, so the identity
 *      registry calls them across a link boundary rather than carrying them in its own bytecode, which it
 *      has no room for. The link target is fixed at deployment: a linked library is code, not a pointer
 *      anyone can move afterwards.
 *
 *      ## What this library deliberately does not do
 *
 *      It does not verify an issuer's signatures over the TBS as part of parsing, and it does not walk a
 *      certificate chain to the root. On the registration path there is nothing to walk — a chain-attested
 *      certificate is admitted by this chain against pinned issuer constants and the holder's own proof of
 *      possession, so an issuer signature is not what makes it valid. {verifyIssuerSignatures} is here for
 *      callers verifying an off-chain issuance, and it verifies exactly what it is handed.
 *
 *      It also does not check an encapsulation key's length or structure. Those are checked where they are
 *      REGISTERED, by the precompiles that own the answer, because two checks of one thing in two shapes is
 *      how one of them ends up weaker and nobody notices which.
 */
library FinalCertificate {
    /// @notice The four magic bytes every certificate opens with, `"PQCF"`.
    uint32 internal constant MAGIC = 0x50514346;
    /// @notice The current wire generation, which encoders write.
    /// @dev A generation this parser does not know fails to parse rather than being reinterpreted: the
    ///      folded key commitment, and therefore every wallet address, derives from this exact layout, so a
    ///      layout read under the wrong generation would produce a self-consistent digest that matches
    ///      nothing.
    uint32 internal constant VERSION = 2;
    /// @notice The previous wire generation, still accepted on parse.
    /// @dev Reading an older artifact is not the same as admitting it. Whether such a certificate may be
    ///      REGISTERED is settled at admission, by the holder's proof of possession and the chain-issuer
    ///      pins, rather than by refusing to decode it.
    uint32 internal constant VERSION_V4 = 1;

    /// @notice The institution identity extension, which carries an issuer's legal name, registration
    ///         number and jurisdiction.
    uint16 internal constant EXT_INSTITUTION = 0x0102;

    /// @notice ML-KEM-1024 (FIPS 203), the lattice half of the encapsulation pair.
    /// @dev Algorithm identifiers ARE the FIPS numbers, in one space shared by signatures and encapsulation
    ///      — the same identifiers the quorum wire format uses, and the numbers the precompile addresses end
    ///      in. One space rather than two means an identifier can never be read against the wrong table.
    uint16 internal constant ALG_ML_KEM_1024 = 0x0003;
    /// @notice ML-DSA-87 (FIPS 204). Transaction class.
    uint16 internal constant ALG_ML_DSA_87 = 0x0004;
    /// @notice SLH-DSA-SHAKE-256s (FIPS 205). Access class, and the seal.
    uint16 internal constant ALG_SLH_DSA_SHAKE_256S = 0x0005;
    /// @notice FN-DSA (FIPS 206). Reserved: there is no implementation behind it and it is never accepted in
    ///         a slot.
    uint16 internal constant ALG_FN_DSA = 0x0006;
    /// @notice HQC-5 (FIPS 207), the code-based half of the encapsulation pair.
    uint16 internal constant ALG_HQC_5 = 0x0007;

    /// @notice Certificate signing, for both of an issuer's keys.
    /// @dev Says which key to verify WITH; it grants nothing on its own — capability to issue comes from the
    ///      depth pair.
    uint16 internal constant PURPOSE_CERT_SIGNING = 0x0004;

    /// @notice The live stage's transaction-class slot, ML-DSA-87.
    /// @dev A wallet holds four slots in two stages of two, and a certificate carries ONE stage, never all
    ///      four. The stage is what is issued, rotated and revoked as a unit, and a holder presenting a live
    ///      certificate presents both of that stage's keys or neither — splitting them per slot would let
    ///      half a stage be presented as if it were whole.
    /// @dev This applies to services exactly as it applies to a user's wallet. A co-signer is a Final
    ///      Wallet: same four slots, same split, same algorithms. There is no second kind of identity in
    ///      this system.
    uint16 internal constant PURPOSE_ACTIVE_TX = 0x0010;
    /// @notice The live stage's access-class slot, SLH-DSA-SHAKE-256s.
    uint16 internal constant PURPOSE_ACTIVE_ACCESS = 0x0011;
    /// @notice The recovery stage's transaction-class slot, ML-DSA-87.
    uint16 internal constant PURPOSE_RECOVERY_TX = 0x0012;
    /// @notice The recovery stage's access-class slot, SLH-DSA-SHAKE-256s.
    uint16 internal constant PURPOSE_RECOVERY_ACCESS = 0x0013;
    /// @notice The live stage's encapsulation slot.
    /// @dev Each stage's encapsulation pair is resolved alongside its signing pair, and the identity
    ///      registry stores both halves, so a sender can encapsulate to a registered party without a second
    ///      lookup somewhere less authoritative. Both halves sit under ONE purpose and are told apart by
    ///      algorithm, which is why the key loop matches on the `(purpose, algorithm)` pair.
    uint16 internal constant PURPOSE_ACTIVE_KEM = 0x0014;
    /// @notice The recovery stage's encapsulation slot, carrying the same two algorithms.
    uint16 internal constant PURPOSE_RECOVERY_KEM = 0x0015;
    /// @notice The seal purpose: a second SLH-DSA-SHAKE-256s key that co-signs membership-class quorum
    ///         decisions (the registrar quorum); operational quorum actions take the ML-DSA-87 vote alone.
    /// @dev Distinct from the access key, and carried by SERVICE certificates only — a user's wallet never
    ///      seals. Optional in the format, so a certificate without it parses unchanged.
    /// @dev Outside the folded key commitment: a seal is operational, rotated by issuing a new live
    ///      certificate, and it must not move a wallet address it plays no part in deriving.
    uint16 internal constant PURPOSE_ACTIVE_SEAL = 0x0016;

    /// @notice A sentinel purpose no certificate can carry.
    /// @dev Lets {parse} be told "this stage has no encapsulation slot" without a second boolean argument.
    ///      `0xffff` is outside the purpose registry and is reserved by being used here.
    uint16 internal constant NO_KEM_PURPOSE = 0xffff;

    /// @notice Nanoseconds per millisecond, the conversion from a certificate's validity fields to this
    ///         chain's clock.
    /// @dev A certificate stamps validity in NANOseconds and this chain's clock is MILLIseconds, so the
    ///      parser divides by 1e6 on the way in and nothing downstream ever compares across units. Getting
    ///      the divisor wrong does not fail loudly: it shifts every window by three orders of magnitude, so
    ///      every certificate reads as already valid, including one issued for the future.
    uint64 internal constant NS_PER_MILLISECOND = FinalChainTime.NS_PER_MILLISECOND;

    /**
     * @title Parsed
     * @notice What the chain keeps out of one certificate.
     * @dev Every field is read OUT of the TBS. Nothing here can be supplied alongside the bytes, which is
     *      what makes it impossible for a caller to bind a certificate to material the certificate does not
     *      contain.
     */
    struct Parsed {
        /// `SHA3-256` of the TBS bytes: the certificate's own identity, and the handle revocation is keyed
        /// on.
        bytes32 certHash;
        /// The certificate's 32-byte serial. A serial is per certificate SET, so the two stages of one
        /// wallet share it and two stages that disagree are two different wallets.
        bytes32 serial;
        /// keccak256 of the issuer-name bytes, for the chain-issuer pin: a chain-attested certificate
        /// carries the chain's own constant issuer name, and the registry compares one hash rather than two
        /// strings.
        bytes32 issuerDnHash;
        /// The subject-name bytes verbatim. Kept whole rather than hashed because the jurisdiction rule
        /// reads its country component at issuer registration.
        bytes subjectDn;
        /// The institution extension's VALUE, when present; empty otherwise. Issuer registration parses
        /// the declared jurisdiction out of it and requires it to match the subject name's country.
        bytes institutionExt;
        /// SHA3-256 of the ISSUER's public key block. Zero-length — and so
        /// `bytes32(0)` here — for exactly one certificate in the hierarchy,
        /// which is what terminates chain validation.
        bytes32 authorityKeyId;
        /// SHA3-256 of this certificate's own public key block. The child's
        /// `authorityKeyId` must equal it, which is what links the two.
        bytes32 subjectKeyId;
        /// Position on the delegation axis; 0 is the chain's own root.
        uint8 depth;
        /// Deepest level this key may issue to. `== depth` means it signs no certificates at all, which is
        /// every end entity. The pair is immutable per certificate, which is why consumers discriminate
        /// record kinds by it rather than by a role bit.
        uint8 maxDelegationDepth;
        /// MILLISECONDS, converted from the schema's nanoseconds — this chain's clock.
        uint64 notBefore;
        /// Milliseconds. Zero means never expires, which the schema allows.
        uint64 notAfter;
        /// The stage's transaction-class key. ML-DSA-87 — spending, and every
        /// high-cadence protocol action.
        bytes transactionKey;
        /// The stage's access-class key. SLH-DSA-SHAKE-256s — identity,
        /// rotation, recovery-pair promotion. A different hardness assumption,
        /// so a lattice break leaves the key that governs identity standing.
        bytes accessKey;
        /// The stage's ML-KEM-1024 encapsulation key. Empty on a CA, which has
        /// no encapsulation stage, and on any v4 certificate issued without
        /// one — see `parse` for why that is tolerated rather than refused.
        bytes kemMlKem;
        /// The stage's HQC-5 encapsulation key. Carried under the SAME purpose
        /// as the lattice half and distinguished only by algorithm, which is
        /// why the parser matches on the `(purpose, algorithm)` pair.
        bytes kemHqc;
        /// The service's seal key (`PURPOSE_ACTIVE_SEAL`, SLH-DSA-SHAKE-256s).
        /// Empty on every certificate that does not carry one — a user wallet,
        /// a recovery stage, a CA.
        bytes sealKey;
        /// Where the TBS ends, so a caller holding the whole certificate can
        /// find the `SignatureBlock` without parsing forward again.
        uint256 tbsLength;
    }

    /// @notice The bytes do not open with the certificate magic, so they are not a certificate at all.
    /// @param got The four bytes that were present.
    error BadMagic(uint32 got);
    /// @notice The wire generation is one this parser does not read.
    /// @param got The generation the certificate declares.
    error BadVersion(uint32 got);
    /// @notice The TBS ends before a field the parser was about to read.
    /// @param needed The offset the read required.
    /// @param got The length actually supplied.
    error Truncated(uint256 needed, uint256 got);
    /// @notice The recomputed key-block digest does not equal the one the certificate declares, so the keys
    ///         present are not the keys the issuer attested.
    /// @param derived The digest recomputed from the key block.
    /// @param declared The digest the certificate carries.
    error SubjectKeyIdMismatch(bytes32 derived, bytes32 declared);
    /// @notice A stage is missing a key it must carry, or carries half of a pair that is issued whole.
    /// @param purpose The purpose whose slot is unfilled.
    error MissingSlot(uint16 purpose);
    /// @notice A slot carries a key of the wrong scheme. It would verify cryptographically and mean
    ///         something else entirely, which is exactly what splitting the classes exists to prevent.
    /// @param purpose The slot's purpose.
    /// @param algorithm The algorithm identifier that was present.
    error WrongAlgorithmForSlot(uint16 purpose, uint16 algorithm);
    /// @notice Two key entries share one `(purpose, algorithm)` pair, so one would silently shadow the
    ///         other.
    /// @param purpose The repeated purpose.
    /// @param algorithm The repeated algorithm identifier.
    error DuplicateKey(uint16 purpose, uint16 algorithm);
    /// @notice The key entries are not in ascending `(purpose, algorithm)` order. The schema requires that
    ///         order so `certHash` is reproducible across implementations.
    error KeysNotSorted();
    /// @notice A signing key whose length is not the one its algorithm defines.
    /// @param algorithm The algorithm identifier the entry declares.
    /// @param length The key length that was present.
    error BadKeyLength(uint16 algorithm, uint256 length);
    /// @notice A delegation bound shallower than the certificate's own depth, which admits nothing.
    /// @param depth The certificate's position on the delegation axis.
    /// @param maxDelegationDepth The deepest level it claims to issue to.
    error InvalidDepth(uint8 depth, uint8 maxDelegationDepth);
    /// @notice A certificate that expires no later than it begins.
    /// @param notBefore The declared start, in the schema's nanoseconds.
    /// @param notAfter The declared end, in the schema's nanoseconds.
    error ValidityInverted(uint64 notBefore, uint64 notAfter);

    /**
     * @notice Parse and self-check a `TBSCertificate`.
     * @dev Checking for a CAPABILITY rather than a type is the certificate schema's own rule, and the reason
     *      there is no type field to check instead. Passing the LIVE purposes to a recovery certificate
     *      finds neither key and reverts — which is what stops a recovery certificate being registered as a
     *      live one and handing the recovery pair everyday authority.
     *
     *      Self-check means the declared `SubjectKeyId` is recomputed from the key block that follows it and
     *      compared. That field is inside the TBS and therefore covered by the issuer's signatures, so the
     *      comparison turns "these bytes decode" into "the issuer attested these exact keys". Doing it on
     *      chain costs one precompile call and buys a verdict any reader can recompute; gas is not a design
     *      constraint on the chain this runs on, and must not be traded for a check that would then have to
     *      be taken on trust from whichever process ran it.
     *
     *      A stage is issued as a unit, so both of a stage's signing keys must be present, and its
     *      encapsulation pair must be present in full or absent in full.
     * @param tbs the TBS bytes, verbatim. Not the whole certificate.
     * @param txPurpose the transaction-class purpose this stage should carry.
     * @param accessPurpose the access-class purpose for the same stage.
     * @param kemPurpose the encapsulation purpose for the same stage, or {NO_KEM_PURPOSE} for a stage that
     *        has none.
     * @return out The parsed certificate: digest, serial, names, key identifiers, depth pair, validity
     *         window, and every key slot the stage carries.
     */
    function parse(bytes calldata tbs, uint16 txPurpose, uint16 accessPurpose, uint16 kemPurpose)
        internal
        view
        returns (Parsed memory out)
    {
        _need(tbs, 58);
        if (uint32(bytes4(tbs[0:4])) != MAGIC) revert BadMagic(uint32(bytes4(tbs[0:4])));
        // Both live wire generations parse. An artifact issued under the older one is read rather than
        // refused; whether it may be ADMITTED is a separate question, settled at registration by the
        // holder's proof of possession and the chain-issuer pins.
        uint32 wireVersion = uint32(bytes4(tbs[4:8]));
        if (wireVersion != VERSION && wireVersion != VERSION_V4) revert BadVersion(wireVersion);

        out.certHash = FinalChainPrecompiles.sha3_256(tbs);
        out.serial = bytes32(tbs[8:40]);
        out.depth = uint8(tbs[40]);
        out.maxDelegationDepth = uint8(tbs[41]);

        uint64 notBeforeNs = uint64(bytes8(tbs[42:50]));
        uint64 notAfterNs = uint64(bytes8(tbs[50:58]));
        if (out.maxDelegationDepth < out.depth) {
            revert InvalidDepth(out.depth, out.maxDelegationDepth);
        }
        if (notAfterNs != 0 && notAfterNs <= notBeforeNs) {
            revert ValidityInverted(notBeforeNs, notAfterNs);
        }
        out.notBefore = notBeforeNs / NS_PER_MILLISECOND;
        out.notAfter = notAfterNs == 0 ? 0 : notAfterNs / NS_PER_MILLISECOND;

        // Four length-prefixed fields: IssuerDN, SubjectDN, AuthorityKeyId,
        // SubjectKeyId. Every field before them is fixed width, which is the
        // whole reason the schema orders them this way.
        uint256 p = 58;
        uint256 issuerDnLen;
        (p, issuerDnLen) = _skipLengthPrefixed(tbs, p);
        out.issuerDnHash = keccak256(tbs[p - issuerDnLen:p]);
        uint256 subjectDnLen;
        (p, subjectDnLen) = _skipLengthPrefixed(tbs, p);
        out.subjectDn = tbs[p - subjectDnLen:p];
        uint256 akidLen;
        (p, akidLen) = _skipLengthPrefixed(tbs, p);
        out.authorityKeyId = _bytes32At(tbs, p - akidLen, akidLen);
        uint256 skidLen;
        (p, skidLen) = _skipLengthPrefixed(tbs, p);
        uint256 skidStart = p - skidLen;

        _need(tbs, p + 2);
        uint16 keyCount = uint16(bytes2(tbs[p:p + 2]));
        p += 2;
        // AFTER the count word. `SubjectKeyId` is SHA3-256 of the KeyEntry
        // array alone — `encodeTbs` writes `PublicKeyCount` as its own field and
        // `encodePublicKeyBlock` returns only the entries. Hashing the count in
        // produces a digest that is self-consistent and matches no certificate
        // any issuer ever wrote.
        uint256 blockStart = p;

        uint32 previousSort = 0;
        for (uint256 i = 0; i < keyCount; i++) {
            _need(tbs, p + 8);
            uint16 alg = uint16(bytes2(tbs[p:p + 2]));
            uint16 purpose = uint16(bytes2(tbs[p + 2:p + 4]));
            uint32 keyLen = uint32(bytes4(tbs[p + 4:p + 8]));
            p += 8;
            _need(tbs, p + keyLen);

            // Ascending by (purpose, algorithm), duplicates invalid. The schema
            // requires the order so `certHash` is reproducible across
            // implementations; enforcing it here also means a second entry for
            // one slot cannot quietly shadow the first.
            uint32 sortKey = (uint32(purpose) << 16) | uint32(alg);
            if (i > 0) {
                if (sortKey == previousSort) revert DuplicateKey(purpose, alg);
                if (sortKey < previousSort) revert KeysNotSorted();
            }
            previousSort = sortKey;

            // The algorithm is pinned per CLASS, not merely recorded. A
            // transaction slot carrying an access-class key would verify
            // cryptographically and mean something entirely different — an
            // identity key must never authorize a transaction, or splitting the
            // classes buys nothing.
            // Matched on the PAIR, not on the purpose alone. A CA carries two
            // keys under one purpose (`0x0004`) distinguished only by
            // algorithm, so matching on purpose first would find the first of
            // them twice and the second never.
            if (purpose == txPurpose && alg == ALG_ML_DSA_87) {
                if (keyLen != FinalChainPrecompiles.ML_DSA_87_PUBLIC_KEY_LEN) {
                    revert BadKeyLength(alg, keyLen);
                }
                out.transactionKey = tbs[p:p + keyLen];
            } else if (purpose == accessPurpose && alg == ALG_SLH_DSA_SHAKE_256S) {
                if (keyLen != FinalChainPrecompiles.SLH_DSA_SHAKE_256S_PUBLIC_KEY_LEN) {
                    revert BadKeyLength(alg, keyLen);
                }
                out.accessKey = tbs[p:p + keyLen];
            } else if (purpose == kemPurpose && alg == ALG_ML_KEM_1024) {
                out.kemMlKem = tbs[p:p + keyLen];
            } else if (purpose == kemPurpose && alg == ALG_HQC_5) {
                out.kemHqc = tbs[p:p + keyLen];
            } else if (purpose == PURPOSE_ACTIVE_SEAL && alg == ALG_SLH_DSA_SHAKE_256S) {
                if (keyLen != FinalChainPrecompiles.SLH_DSA_SHAKE_256S_PUBLIC_KEY_LEN) {
                    revert BadKeyLength(alg, keyLen);
                }
                out.sealKey = tbs[p:p + keyLen];
            } else if (purpose == PURPOSE_ACTIVE_SEAL) {
                // The seal is hash-based by definition — it exists to stand on
                // the OTHER assumption from the transaction key it co-signs
                // with. A lattice seal would be two signatures on one bet.
                revert WrongAlgorithmForSlot(purpose, alg);
            } else if (purpose == txPurpose || purpose == accessPurpose) {
                // A slot the caller asked for, carrying the wrong scheme. It
                // would verify cryptographically and mean something else
                // entirely — an identity key must never authorize a
                // transaction, or splitting the classes buys nothing.
                revert WrongAlgorithmForSlot(purpose, alg);
            } else if (purpose == kemPurpose) {
                // Same rule for the encapsulation slot. A third KEM appearing
                // under this purpose is a hybrid whose second family nobody
                // agreed on, and admitting it silently is how a pair becomes a
                // trio that one reader honours and another ignores.
                revert WrongAlgorithmForSlot(purpose, alg);
            }

            // NO length check on the KEM keys here, and that is deliberate.
            // The signing slots are checked against a constant because the
            // parser's own callers depend on the length; an encapsulation key
            // is checked by `0x0203` / `0x0207` at the moment it is REGISTERED,
            // where the answer is a well-formedness verdict rather than a
            // parse failure. Two checks of the same thing in two shapes is how
            // one of them ends up weaker and nobody notices which.
            p += keyLen;
        }

        // `SubjectKeyId` is SHA3-256 of the KeyEntry array, count word
        // EXCLUDED — `blockStart` is taken after the count is consumed, for the
        // reason given where it is set. Recomputing it is what turns "these
        // bytes decode" into "the CA signed these exact keys"; the field is
        // inside the TBS, so it is covered by the signatures.
        out.subjectKeyId = FinalChainPrecompiles.sha3_256(tbs[blockStart:p]);
        bytes32 declared = _bytes32At(tbs, skidStart, skidLen);
        if (out.subjectKeyId != declared) revert SubjectKeyIdMismatch(out.subjectKeyId, declared);

        // Both or neither. A stage is issued as a unit, so a certificate
        // carrying one of its two keys is not a partial certificate — it is a
        // certificate for a stage that does not exist.
        if (out.transactionKey.length == 0) revert MissingSlot(txPurpose);
        if (out.accessKey.length == 0) revert MissingSlot(accessPurpose);

        // The encapsulation pair is both-or-neither for the same reason, and
        // the reason is louder here: a hybrid quietly reduced to one family is
        // identical on the wire, so a certificate carrying only the lattice
        // half would seal successfully and silently drop the code-based hedge.
        // Neither is the CA case and the pre-v4 case, both legitimate.
        if ((out.kemMlKem.length == 0) != (out.kemHqc.length == 0)) {
            revert MissingSlot(kemPurpose);
        }

        _need(tbs, p + 2);
        uint16 extCount = uint16(bytes2(tbs[p:p + 2]));
        p += 2;
        for (uint256 i = 0; i < extCount; i++) {
            _need(tbs, p + 7);
            uint16 extType = uint16(bytes2(tbs[p:p + 2]));
            uint32 valueLen = uint32(bytes4(tbs[p + 3:p + 7]));
            p += 7;
            _need(tbs, p + valueLen);
            // The Institution extension's VALUE, kept for the issuer
            // profile's jurisdiction rule. Everything else is skipped as
            // before — extensions are structural to certHash, semantic to
            // whichever consumer knows them.
            if (extType == EXT_INSTITUTION) out.institutionExt = tbs[p:p + valueLen];
            p += valueLen;
        }
        out.tbsLength = p;
    }

    /// @notice Parse a LIVE-stage certificate: the live transaction and access keys.
    /// @dev `external`, like the other three entry points below. The identity registry sits against the
    ///      deployed-code ceiling and this parser is its single largest inlined dependency, so the four doors
    ///      it calls are DEPLOY-LINKED: the library is one more contract in the state plane's fixed deploy
    ///      order, and its address is baked immutably into the registry's bytecode. A linked library is code,
    ///      not a key — nothing can repoint it after deployment, so the split costs a call boundary and no
    ///      trust.
    /// @param tbs The TBS bytes, verbatim.
    /// @return The parsed and self-checked certificate.
    function parseLive(bytes calldata tbs) external view returns (Parsed memory) {
        return parse(tbs, PURPOSE_ACTIVE_TX, PURPOSE_ACTIVE_ACCESS, PURPOSE_ACTIVE_KEM);
    }

    /// @notice Parse a RECOVERY-stage certificate.
    /// @dev The recovery pair authorizes rotating the wallet's own credentials and NOTHING else. Acting as a
    ///      guardian is an ordinary action for that account and uses the live access key, so keeping the two
    ///      stages in separate certificates is what makes that boundary something a verifier can see.
    /// @param tbs The TBS bytes, verbatim.
    /// @return The parsed and self-checked certificate.
    function parseRecovery(bytes calldata tbs) external view returns (Parsed memory) {
        return parse(tbs, PURPOSE_RECOVERY_TX, PURPOSE_RECOVERY_ACCESS, PURPOSE_RECOVERY_KEM);
    }

    /// @notice Parse a certificate authority's certificate, whose two keys are both cert-signing.
    /// @dev Both classes resolve to the same purpose, which is why {parse} matches on the
    ///      `(purpose, algorithm)` PAIR: an authority carries two keys under one purpose and matching on the
    ///      purpose alone would find the first of them twice and the second never.
    /// @dev No encapsulation purpose. An authority signs and is never sealed to, so {NO_KEM_PURPOSE} is
    ///      passed as a value the key loop can never match. An authority certificate carrying encapsulation
    ///      keys would parse them into slots the registry then discards, which is a shape worth refusing to
    ///      have at all.
    /// @param tbs The TBS bytes, verbatim.
    /// @return The parsed and self-checked certificate.
    function parseCa(bytes calldata tbs) external view returns (Parsed memory) {
        return parse(tbs, PURPOSE_CERT_SIGNING, PURPOSE_CERT_SIGNING, NO_KEM_PURPOSE);
    }

    /**
     * @notice Verify an issuer's dual signature over a TBS.
     * @dev Both must verify, not either. Two signatures under two different hardness assumptions is the
     *      entire reason a certificate carries two, and accepting one would collapse that to whichever
     *      family breaks first.
     *
     *      Provided for callers that verify an off-chain issuance against keys they already trust. The
     *      caller supplies the issuer's keys, so it is the caller's job to have taken them from a registered
     *      record rather than from its own calldata — a key handed in with the signature proves nothing.
     * @param tbs The signed TBS bytes.
     * @param issuerMlDsaKey The issuer's registered ML-DSA-87 cert-signing key.
     * @param issuerSlhDsaKey The issuer's registered SLH-DSA-SHAKE-256s cert-signing key.
     * @param mlDsaSignature The lattice signature over `tbs`.
     * @param slhDsaSignature The hash-based signature over `tbs`.
     * @return Whether both signatures verify.
     */
    function verifyIssuerSignatures(
        bytes memory tbs,
        bytes memory issuerMlDsaKey,
        bytes memory issuerSlhDsaKey,
        bytes memory mlDsaSignature,
        bytes memory slhDsaSignature
    ) external view returns (bool) {
        return FinalChainPrecompiles.verifyMlDsa87(issuerMlDsaKey, tbs, mlDsaSignature)
            && FinalChainPrecompiles.verifySlhDsa(issuerSlhDsaKey, tbs, slhDsaSignature);
    }

    /// @notice Refuse a TBS that is shorter than the parser is about to read.
    /// @dev Called before every read rather than once at the top, because the layout is variable-length: a
    ///      certificate can be well-formed up to its key block and truncated inside it, and a parser that
    ///      only checked the fixed header would read whatever calldata followed.
    /// @param tbs The TBS bytes.
    /// @param upto The offset the next read needs to be valid.
    function _need(bytes calldata tbs, uint256 upto) private pure {
        if (tbs.length < upto) revert Truncated(upto, tbs.length);
    }

    /// @notice Step over one four-byte-length-prefixed field and report where it was.
    /// @dev Bounds-checks the prefix before reading it and the value before returning, so a truncated
    ///      certificate cannot make the cursor run past the end of calldata. The caller recovers the value's
    ///      slice as `tbs[next - length:next]`.
    /// @param tbs The TBS bytes.
    /// @param p Offset of the length prefix.
    /// @return next Offset just past the field's value.
    /// @return length The field's declared length.
    function _skipLengthPrefixed(bytes calldata tbs, uint256 p)
        private
        pure
        returns (uint256 next, uint256 length)
    {
        _need(tbs, p + 4);
        length = uint32(bytes4(tbs[p:p + 4]));
        next = p + 4 + length;
        _need(tbs, next);
    }

    /// @notice Read a key identifier out of the TBS as one word.
    /// @dev Answers `bytes32(0)` for any length other than 32 rather than reverting. A key identifier that
    ///      is not 32 bytes is not a SHA3-256 digest, so it cannot match the value it is compared against,
    ///      and the comparison at the call site produces the correct refusal with no separate error to
    ///      define. The one legitimate short case is a zero-length authority key identifier, which the
    ///      caller must reject on its own terms.
    /// @param tbs The TBS bytes.
    /// @param start Offset of the field's value.
    /// @param length The field's declared length.
    /// @return The 32-byte value, or zero when the field is not 32 bytes long.
    function _bytes32At(bytes calldata tbs, uint256 start, uint256 length)
        private
        pure
        returns (bytes32)
    {
        // A SubjectKeyId that is not 32 bytes is not a SHA3-256 digest, so it
        // cannot match and the comparison will fail — which is the correct
        // outcome and needs no separate error.
        if (length != 32) return bytes32(0);
        return bytes32(tbs[start:start + 32]);
    }
}

contracts/finalchain/FinalChainInitializable.sol

// SPDX-License-Identifier: BUSL-1.1
// Copyright (c) 2024-2026 Final DeFi
// Licensed under the Business Source License 1.1 (the "License")
pragma solidity ^0.8.20;

import {StorageSlot} from "@openzeppelin/contracts/utils/StorageSlot.sol";

/**
 * @title Final Chain Initializable
 * @notice The once-only initializer of a Final Chain state-plane contract that stands behind `FinalChainProxy`
 *         (ruled 2026-09-12: every plane contract does).
 *
 * @dev The proxy never re-runs an implementation's constructor, so a constructor that writes STORAGE — the
 *      trees' zero-hash ladder and live roots, a bootstrap admin, the supply's 100M — would leave the proxy's
 *      storage empty: the writes land in the implementation, which nothing reads through. Such a contract
 *      moves those writes into one internal `_setUp(...)` guarded by {initializer} and calls it from BOTH
 *      places: its constructor (a direct deploy — every Foundry fixture, every test — behaves exactly as
 *      before, and the bare implementation marks its OWN storage initialized, so nobody can initialize it
 *      later) and an external `initialize(...)`, which `FinalChainProxy`'s constructor runs by `delegatecall`
 *      in the proxy's storage. Constructor immutables (`registry`, `trees`, …) need none of this: they live in
 *      the implementation's code and read as constants through the proxy.
 *
 *      The flag lives in a namespaced slot, not in Solidity storage: inheriting this contract shifts no
 *      layout, and an implementation upgraded in place can never collide with it. An upgrade that appends
 *      storage seeds it through a new guarded function of its own — `initialize` runs once per proxy, ever.
 *
 *      A proxy deployed WITHOUT its init data is a live hole: `initialize` is external and the first caller
 *      would be the admin. The deploy tool refuses to place a proxy whose implementation declares
 *      `initialize` without running it, and reads {initialized} back before it continues.
 */
abstract contract FinalChainInitializable {
    /// @dev `bytes32(uint256(keccak256("final.chain.initialized")) - 1)`.
    bytes32 private constant INITIALIZED_SLOT = 0x1bf7ff51edde3507ea8edc0d02272dc3e66fd14d0a75a234f844ee7b236829d2;

    /// @notice The contract's storage was set up — by its constructor (a direct deploy) or by `initialize`
    ///         through its proxy.
    event Initialized();

    /// @notice `initialize` ran already in this storage — the constructor's, or a proxy's, once.
    error AlreadyInitialized();

    /// @dev Guards the one function that replays the constructor's storage writes. Sets the flag BEFORE the
    ///      body so a re-entrant call from inside the body cannot run it twice.
    modifier initializer() {
        StorageSlot.BooleanSlot storage flag = StorageSlot.getBooleanSlot(INITIALIZED_SLOT);
        if (flag.value) revert AlreadyInitialized();
        flag.value = true;
        _;
        emit Initialized();
    }

    /// @notice Whether this storage was set up. False on a proxy whose init data was not run — the state the
    ///         deploy tool refuses.
    function initialized() external view returns (bool) {
        return StorageSlot.getBooleanSlot(INITIALIZED_SLOT).value;
    }
}

contracts/finalchain/FinalChainPrecompiles.sol

// SPDX-License-Identifier: BUSL-1.1
// Copyright (c) 2024-2026 Final DeFi
// Licensed under the Business Source License 1.1 (the "License")
//
// Change Date: 2029-01-01
// Change License: GPL-2.0-or-later
//
// Additional Use Grant:
// 1. Any person or entity may link this library into contracts deployed on a
//    Final DeFi Protocol chain in order to reach that chain's hash and
//    post-quantum signature-verification precompiles.
// 2. Integrators, node operators, and auditors may use it to reproduce and
//    independently re-verify any verdict those precompiles produced, as part of
//    their integration with the Final DeFi Protocol.
// 3. For the avoidance of doubt, this Grant does NOT permit the commercial
//    deployment of a Fork of this library or a competing state plane derived
//    from it without permission prior to the Change Date.
//
// @author Final DeFi
// @version 1.0.0
pragma solidity ^0.8.20;

/**
 * @title Final Chain Precompiles
 * @notice The three primitives Final Chain adds to the EVM, and the only
 *         supported way to reach them.
 *
 * @dev **These exist ONLY on Final Chain (chain id 48359).** They are provided
 * by this chain's own node binary, and
 * nothing at these addresses on Ethereum, Optimism or any other chain will
 * answer. A contract that calls them must be one that only ever runs here;
 * `assertAvailable` below is the cheap way to fail loudly rather than treat an
 * empty return as a verified signature.
 *
 * The addresses are the FIPS numbers, which is the whole allocation rule —
 * there is no local registry to consult and no way for two implementations to
 * disagree about where a primitive lives:
 *
 * | address | primitive | FIPS |
 * |---|---|---|
 * | `0x…0202` | SHA3-256 | 202 |
 * | `0x…0203` | ML-KEM-1024 key validation | 203 |
 * | `0x…0204` | ML-DSA-87 verify | 204 |
 * | `0x…0205` | SLH-DSA-SHAKE-256s verify | 205 |
 * | `0x…0207` | HQC-5 key validation | 207 |
 *
 * The two KEM addresses VALIDATE keys and do nothing else, for one reason:
 * encapsulation is a SENDER operation and decapsulation needs the secret key,
 * so neither belongs on a chain at all. Checking that a registered public key
 * is well-formed is hardening rather than a dependency, and nothing in this
 * system waits on it.
 *
 * HQC's number is 207. It had none when the KEM pair was chosen, which was the
 * one thing separating it from ML-KEM here — a primitive with no standard
 * number has no address under this rule, and inventing one would have been a
 * local convention masquerading as the global one.
 *
 * **No AEAD precompile, at any number.** The chain must never be able to
 * decrypt an intent, and checking a revealed body against its commitment is a
 * hash compare that `0x0202` already serves.
 *
 * ## Why this library refuses to take a public key from its caller
 *
 * It does take one — the primitives are pure functions and cannot do otherwise.
 * The rule lives one level up, in `FinalPqQuorum`: a key passed as an argument
 * proves nothing, because anyone holding a keypair can produce a valid
 * signature under it. Only a key read from `FinalIdentityRegistry` is evidence
 * about WHO signed. Every call site here must be able to answer "where did this
 * key come from" with "storage", never "calldata".
 *
 * ## `success` is not the answer
 *
 * A `staticcall` to a verifier returns two things and both matter. `success`
 * false means the call was malformed — usually a length bug in the caller — and
 * `success` true with a zero word means the signature did not verify. The
 * helpers below collapse both to `false` for the caller's convenience, which is
 * safe in that direction and only in that direction: treating a failed call as
 * a valid signature would be the whole security of the system.
 */
library FinalChainPrecompiles {
    /// @notice SHA3-256 (FIPS 202). NOT `keccak256`, which is the
    /// pre-standardisation padding and produces a different digest.
    address internal constant SHA3_256 = address(0x0202);
    /// @notice ML-DSA-87 verification (FIPS 204). Transaction-class keys.
    address internal constant ML_DSA_87 = address(0x0204);
    /// @notice SLH-DSA-SHAKE-256s verification (FIPS 205). Access-class keys.
    address internal constant SLH_DSA_SHAKE_256S = address(0x0205);

    /// @notice ML-KEM-1024 encapsulation-key validation (FIPS 203).
    /// @dev VALIDATES; it does not encapsulate. Runs FIPS 203 §7.2's own
    /// encapsulation-key check — the type check and the modulus check — and
    /// nothing else. Encapsulation is a sender operation and decapsulation
    /// needs the secret key, so neither belongs on a chain.
    address internal constant ML_KEM_1024 = address(0x0203);

    /// @notice HQC-5 public-key validation (FIPS 207).
    /// @dev Structural only: the length, and the three padding bits the
    /// encoding leaves beyond `n = 57637`. HQC has no cheap key-validity
    /// predicate and this does not pretend to one.
    address internal constant HQC_5 = address(0x0207);

    /// @notice ML-DSA-87 public key length. Round-3 Dilithium5 shares it.
    uint256 internal constant ML_DSA_87_PUBLIC_KEY_LEN = 2592;
    /// @notice ML-DSA-87 signature length. Round-3 Dilithium5 is 4595.
    uint256 internal constant ML_DSA_87_SIGNATURE_LEN = 4627;
    /// @notice SLH-DSA-SHAKE-256s public key length (`PK.seed ‖ PK.root`).
    uint256 internal constant SLH_DSA_SHAKE_256S_PUBLIC_KEY_LEN = 64;
    /// @notice SLH-DSA-SHAKE-256s signature length. The `f` set is 49,856.
    uint256 internal constant SLH_DSA_SHAKE_256S_SIGNATURE_LEN = 29792;

    /// @notice Thrown when a precompile is absent, i.e. this is not Final Chain
    /// or the node is stock reth rather than `final-reth`.
    error PrecompileUnavailable(address precompile);

    /**
     * @notice Reverts unless all five precompiles answer.
     * @dev Call this from a constructor. A contract whose security rests on PQ
     * verification must not deploy onto a chain that cannot perform it — the
     * failure mode otherwise is a quorum that reaches threshold with zero valid
     * signatures, discovered at the worst possible moment.
     *
     * The probe is SHA3-256 of the empty string, whose value is a published
     * FIPS 202 constant. It cannot be produced by an address with no code
     * (which returns empty) nor by `keccak256` (which gives a different digest
     * for the same input), so it distinguishes "the right precompile" from both
     * "nothing here" and "the wrong hash function".
     */
    function assertAvailable() internal view {
        bytes32 expected = 0xa7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a;
        (bool ok, bytes memory out) = SHA3_256.staticcall("");
        if (!ok || out.length != 32 || bytes32(out) != expected) {
            revert PrecompileUnavailable(SHA3_256);
        }
        // The two signature verifiers are probed by shape rather than by a
        // known-answer vector: a KAT here would put a 29,792-byte signature in
        // this contract's bytecode. A deliberately short input is a
        // *precompile error* by contract, so a FAILED call is the pass and a
        // silent success would mean something else is answering at the address.
        _probeRejectsShortInput(ML_DSA_87);
        _probeRejectsShortInput(SLH_DSA_SHAKE_256S);
        // The two KEM validators are probed the other way round, because they
        // are total by contract: a wrong length is a malformed KEY, which is
        // the question being asked, so they ANSWER rather than error. A
        // one-byte input must therefore come back as a well-formed `false`, and
        // a failed call means nothing is there.
        _probeAnswersFalse(ML_KEM_1024);
        _probeAnswersFalse(HQC_5);
    }

    /**
     * @dev A short input must make the precompile ERROR. The gas budget is the
     * whole subtlety.
     *
     * A reverting CONTRACT refunds the gas it did not use. A precompile that
     * returns an error consumes **everything forwarded to it** — and Solidity
     * forwards 63/64 of what is left by default. Two such probes in a
     * constructor therefore burn all but 1/4096 of the deployment's gas, and
     * the deploy fails with no revert data at all.
     *
     * That is not hypothetical: it is what happened the first time this ran
     * against a real `final-reth`, and no Foundry test could have caught it.
     * A mocked precompile is a contract, and a contract's `require` hands the
     * gas back.
     *
     * 5,000 is generous for a call that fails on a length check before any
     * cryptography runs, and small enough that both probes together are noise
     * against a deployment.
     */
    function _probeRejectsShortInput(address precompile) private view {
        bool ok;
        assembly ("memory-safe") {
            let ptr := mload(0x40)
            mstore8(ptr, 0x00)
            ok := staticcall(5000, precompile, ptr, 0x01, 0x00, 0x00)
        }
        if (ok) revert PrecompileUnavailable(precompile);
    }

    /**
     * @dev A one-byte input must come back as a well-formed zero word.
     *
     * The inverse of `_probeRejectsShortInput`, and the inversion is the point:
     * these two precompiles are TOTAL. Every byte string has an answer to "is
     * this a well-formed key", and for one byte the answer is no. A precompile
     * that errored here would be one that treats a malformed key as a caller
     * bug, which is the opposite of what a registry wants.
     *
     * Gas is bounded for the same reason as the other probe — an erroring
     * precompile consumes everything forwarded — even though the pass case
     * returns normally and refunds.
     */
    function _probeAnswersFalse(address precompile) private view {
        bool ok;
        bytes32 answer;
        assembly ("memory-safe") {
            let ptr := mload(0x40)
            mstore8(ptr, 0x00)
            ok := staticcall(5000, precompile, ptr, 0x01, ptr, 0x20)
            answer := mload(ptr)
        }
        if (!ok || answer != bytes32(0)) revert PrecompileUnavailable(precompile);
    }

    /**
     * @notice Is `encapsulationKey` a well-formed ML-KEM-1024 key?
     *
     * @dev The check a registry owes a sender. A malformed encapsulation key
     * stored on chain is an account whose intents cannot be sealed, and the
     * discovery happens at the first attempt to seal one — on the hybrid path,
     * as a pair silently reduced to one family, which is the failure with no
     * error attached.
     *
     * False rather than reverting on any shape, including the wrong length,
     * because the caller is asking a question and every input has an answer.
     */
    function isWellFormedMlKem1024(bytes memory encapsulationKey) internal view returns (bool) {
        return _validatesKey(ML_KEM_1024, encapsulationKey);
    }

    /// @notice Is `publicKey` a well-formed HQC-5 key?
    /// @dev Structural, and honestly partial — see the precompile. It catches a
    /// truncated key, a key from the wrong parameter set, and a tail carrying
    /// smuggled bytes, which are the three ways this goes wrong in practice.
    function isWellFormedHqc5(bytes memory publicKey) internal view returns (bool) {
        return _validatesKey(HQC_5, publicKey);
    }

    /// @dev A failed CALL is not a false answer. It means nothing is at the
    /// address — this is not Final Chain, or the node is stock reth — and
    /// reading it as "the key is malformed" would silently disable the check on
    /// exactly the deployment where it cannot run.
    function _validatesKey(address precompile, bytes memory key) private view returns (bool) {
        (bool ok, bytes memory out) = precompile.staticcall(key);
        if (!ok || out.length != 32) revert PrecompileUnavailable(precompile);
        return bytes32(out) != bytes32(0);
    }

    /// @notice FIPS 202 SHA3-256 over `data`.
    /// @dev The certificate schema hashes `TBSCertificate`, `SubjectKeyId` and
    /// `AuthorityKeyId` with this, so it is the only function that can check a
    /// `certHash` against the bytes it claims to summarise.
    function sha3_256(bytes memory data) internal view returns (bytes32 digest) {
        (bool ok, bytes memory out) = SHA3_256.staticcall(data);
        if (!ok || out.length != 32) revert PrecompileUnavailable(SHA3_256);
        digest = bytes32(out);
    }

    /// @notice Verify an ML-DSA-87 signature. False on any failure, including
    /// a malformed call.
    function verifyMlDsa87(bytes memory publicKey, bytes memory message, bytes memory signature)
        internal
        view
        returns (bool)
    {
        if (
            publicKey.length != ML_DSA_87_PUBLIC_KEY_LEN
                || signature.length != ML_DSA_87_SIGNATURE_LEN
        ) return false;
        return _verify(ML_DSA_87, publicKey, signature, message);
    }

    /// @notice Verify an SLH-DSA-SHAKE-256s signature. False on any failure.
    function verifySlhDsa(bytes memory publicKey, bytes memory message, bytes memory signature)
        internal
        view
        returns (bool)
    {
        if (
            publicKey.length != SLH_DSA_SHAKE_256S_PUBLIC_KEY_LEN
                || signature.length != SLH_DSA_SHAKE_256S_SIGNATURE_LEN
        ) return false;
        return _verify(SLH_DSA_SHAKE_256S, publicKey, signature, message);
    }

    /// @dev `publicKey ‖ signature ‖ message`, in that order. Both fixed-length
    /// fields come first so the message is unambiguously the remainder — the
    /// same reason the precompile takes no length prefix.
    function _verify(
        address precompile,
        bytes memory publicKey,
        bytes memory signature,
        bytes memory message
    ) private view returns (bool) {
        (bool ok, bytes memory out) =
            precompile.staticcall(abi.encodePacked(publicKey, signature, message));
        return ok && out.length == 32 && bytes32(out) != bytes32(0);
    }
}

contracts/finalchain/FinalChainTime.sol

// SPDX-License-Identifier: BUSL-1.1
// Copyright (c) 2024-2026 Final DeFi
// Licensed under the Business Source License 1.1 (the "License")
//
// Change Date: 2029-01-01
// Change License: GPL-2.0-or-later
//
// Additional Use Grant:
// 1. Any person or entity may link this time library into contracts deployed on
//    a Final DeFi Protocol chain, and may read its constants to interpret the
//    timestamps and durations that chain publishes.
// 2. Integrators, indexers, and operators may use it to convert between this
//    chain's clock and the units their own systems keep, as part of their
//    integration with the Final DeFi Protocol.
// 3. For the avoidance of doubt, this Grant does NOT permit the commercial
//    deployment of a Fork of this library or a competing state plane derived
//    from it without permission prior to the Change Date.
//
// @author Final DeFi
// @version 1.0.0
pragma solidity ^0.8.20;

/**
 * @title Final Chain Time
 * @notice **On this chain, `block.timestamp` is MILLISECONDS, not seconds.**
 * @dev Every other EVM chain stamps seconds. This one cannot. It mints a block every 100 ms, and the protocol
 * requires block timestamps to strictly increase, so a second-denominated clock would exhaust its distinct
 * values ten times over per second. Milliseconds is the deliberate consequence, and it is a property of the
 * CHAIN itself rather than of any contract here — nothing in this library can change it, and nothing deployed
 * beside this library may assume otherwise.
 *
 * Every duration and every instant on this chain is therefore in milliseconds. This library exists so that fact
 * is stated in one place and converted in one place, instead of being assumed independently everywhere a
 * deadline or a delay is written.
 *
 * ## The naming rule, which is a safety rule
 *
 * A field or constant carrying a duration or an instant on this chain ends in `Ms`. This is not decoration. A
 * delay field named for seconds while holding milliseconds elapses a thousand times too fast: a one-day
 * recovery delay would mature in about eighty-six seconds, and a two-year dormancy threshold in under a day.
 * Those delays are the whole of what stands between a stolen credential and an account, so a name that states
 * the wrong unit is not a cosmetic defect — it is the defect, wearing a disguise. `Seconds`-suffixed names do
 * not appear in this directory and must not be introduced.
 *
 * A test harness is not a check on this. Standard EVM tooling stamps `block.timestamp` in seconds, so a suite
 * can agree with the contracts under test and both be wrong about the chain they deploy to. The unit has to be
 * carried by the names.
 *
 * Solidity's `hours` and `days` suffixes remain the clearest way to write a duration, so durations are written
 * as `24 hours * MS_PER_SECOND` rather than as a bare literal: the intent stays readable and the unit stays
 * explicit at the point of use.
 */
library FinalChainTime {
    /// @notice Milliseconds per second — the whole conversion between this chain's clock and ordinary time,
    ///         named once.
    /// @dev Multiply a `seconds`-denominated Solidity duration literal by this to express it in this chain's
    ///      units. It is deliberately the only place the factor appears.
    uint64 internal constant MS_PER_SECOND = 1_000;

    /// @notice Nanoseconds per millisecond — the divisor for values that arrive stamped in nanoseconds.
    /// @dev The certificate schema stamps validity windows in nanoseconds, so a certificate converts DOWN to
    ///      this chain's clock. Dividing rather than multiplying is the direction that cannot overflow, and it
    ///      truncates toward the past, which for a validity window is the conservative rounding.
    uint64 internal constant NS_PER_MILLISECOND = 1_000_000;

    /// @notice This chain's current time, in milliseconds.
    /// @dev A function rather than a bare `block.timestamp` read so the unit is visible at every call site.
    ///      It performs no arithmetic and exists purely so that reading the clock is self-describing, where
    ///      `block.timestamp` on this chain is silently a thousand times what a reader would assume.
    /// @return nowInMs The current block's timestamp, in milliseconds.
    function nowMs() internal view returns (uint64) {
        return uint64(block.timestamp);
    }
}

contracts/finalchain/FinalEndpointRegistry.sol

// SPDX-License-Identifier: BUSL-1.1
// Copyright (c) 2024-2026 Final DeFi
// Licensed under the Business Source License 1.1 (the "License")
//
// Change Date: 2029-01-01
// Change License: GPL-2.0-or-later
//
// Additional Use Grant:
// 1. Any person or entity may deploy and operate this endpoint registry as
//    part of a Final DeFi Protocol chain, and may publish entries to it under
//    the quorum the chain recognises.
// 2. Integrators, node operators, and indexers may read the endpoint set and
//    the roots it publishes, as part of their integration with the Final DeFi
//    Protocol.
// 3. For the avoidance of doubt, this Grant does NOT permit the commercial
//    deployment of a Fork of this endpoint registry or a competing
//    service-discovery plane derived from it without permission prior to the
//    Change Date.
//
// @author Final DeFi
// @version 1.0.0
pragma solidity ^0.8.20;

import {FinalIdentityRegistry} from "./FinalIdentityRegistry.sol";
import {FinalPqQuorum} from "./FinalPqQuorum.sol";
import {FinalChainPrecompiles} from "./FinalChainPrecompiles.sol";
import {FinalChainTime} from "./FinalChainTime.sol";
import {FinalStateTrees, IEndpointSource} from "./FinalStateTrees.sol";
import {FinalPlaneSweep} from "./FinalPlaneSweep.sol";

/**
 * @title FinalEndpointRegistry
 * @notice The tunnel endpoints — the Final Node identities a wallet's Final
 *         Network Protocol session terminates at — as ENDPOINT certificates:
 *         parsed here, on Final Chain, and projected into tree 8's branch 4
 *         (a node certificate differs from a user certificate: it is not a user but
 *         endpoint certificate, it should still be parsed on Final Chain and
 *         put into the tree … execution chains should not parse it").
 *
 * @dev An endpoint certificate is a Final Certificate (schema v5, wire version
 * 2, chain-attested: issuer DN "CN=Final Chain,O=Final DeFi", the chain
 * authority key id) whose keys all sit under one purpose, `PURPOSE_NETWORK_AUTH`
 * (0x0001): the endpoint's live signing key(s) and the four KEM publics a client
 * encapsulates to in every handshake — ML-KEM-1024, HQC-5, Classic McEliece-
 * 8192128 and FrodoKEM-1344-SHAKE. The two ISO-track KEMs have no FIPS number
 * and no precompile, so they carry ids from a separate block (0x0201, 0x0202)
 * and are validated by LENGTH here; the chain never encapsulates to them.
 *
 * `FinalCertificate` — the library the identity registry links — parses a fixed
 * slot set (the wallet's two stages) and refuses anything else, so this
 * contract carries its own parser for the endpoint profile rather than
 * re-linking the adopted registry. Admission follows the identity registry's
 * v5 path exactly: the registrar quorum is the authority, the holder's proof of
 * possession (its live ML-DSA-87 network-authentication key over the admission
 * digest, plus SLH-DSA when the certificate carries that key) is the evidence,
 * and there is no CA signature on the certificate at all.
 *
 * A McEliece public key is 1 357 824 bytes, so a certificate is ≈1.4 MB and its
 * registration is one large transaction. The parser reads calldata in place and
 * hashes the TBS ONCE into memory, taking the subject-key-id digest from the same
 * buffer (`_sha3Slice`) — a second copy would double the memory cost and push a
 * registration past the block. Gas is not a design constraint on this chain, a
 * transaction that does not fit a block is.
 *
 * The leaf (tree 8, branch 4, key `trees.endpointKeyFor(endpointId)`):
 *   keccak256(abi.encode(DOMAIN_ENDPOINT_LEAF, certificateHash, status, notAfter, region))
 * with `endpointId` = the certificate's subject key id and `status` 1 active /
 * 2 revoked — so revocation is a leaf change a client proves against the root
 * an execution chain anchors, like an account leaf. A client pins the three
 * endpoint fingerprints in its build, verifies the first session against them,
 * then reads this leaf through the tunnel it just opened.
 */
contract FinalEndpointRegistry is IEndpointSource, FinalPlaneSweep {
    // ---------------------------------------------------------------- ids

    /// @notice Magic bytes every certificate begins with, spelling `PQCF`.
    /// @dev Checked first so a payload that is not a certificate at all is refused before any field is read.
    uint32 public constant CERT_MAGIC = 0x50514346; // "PQCF"
    /// @notice Wire version this registry parses.
    /// @dev A parser that guessed the version would read one layout's bytes under another's field names, so the
    ///       version is asserted rather than inferred.
    uint32 public constant CERT_VERSION = 2;

    /// @notice The endpoint's purpose: network authentication (FNP endpoint identity).
    uint16 public constant PURPOSE_NETWORK_AUTH = 0x0001;

    /// @notice Algorithm id: ML-KEM-1024 key encapsulation.
    uint16 public constant ALG_ML_KEM_1024 = 0x0003;
    /// @notice Algorithm id: ML-DSA-87 signatures.
    uint16 public constant ALG_ML_DSA_87 = 0x0004;
    /// @notice Algorithm id: SLH-DSA-SHAKE-256s signatures.
    uint16 public constant ALG_SLH_DSA_SHAKE_256S = 0x0005;
    /// @notice Algorithm id: FN-DSA-1024 signatures.
    uint16 public constant ALG_FN_DSA_1024 = 0x0006;
    /// @notice Algorithm id: HQC-5 key encapsulation.
    uint16 public constant ALG_HQC_5 = 0x0007;
    /// @notice ISO-track KEMs, no FIPS number, no precompile: validated by length only.
    uint16 public constant ALG_MCELIECE_8192128 = 0x0201;
    /// @notice Algorithm id: FrodoKEM-1344-SHAKE key encapsulation.
    uint16 public constant ALG_FRODO_1344_SHAKE = 0x0202;

    /// @dev Public-key length for ML-KEM-1024. Lengths are pinned per algorithm and checked, because a key of
    ///       the wrong length is a parse that silently continued into the next field.
    uint256 public constant LEN_ML_KEM_1024_PK = 1568;
    /// @dev Public-key length for HQC-5.
    uint256 public constant LEN_HQC_5_PK = 7237;
    /// @dev Public-key length for Classic McEliece 8192128.
    uint256 public constant LEN_MCELIECE_8192128_PK = 1_357_824;
    /// @dev Public-key length for FrodoKEM-1344.
    uint256 public constant LEN_FRODO_1344_PK = 21_520;
    /// @dev Public-key length for ML-DSA-87.
    uint256 public constant LEN_ML_DSA_87_PK = 2592;
    /// @dev Public-key length for FN-DSA-1024.
    uint256 public constant LEN_FN_DSA_1024_PK = 1793;
    /// @dev Public-key length for SLH-DSA.
    uint256 public constant LEN_SLH_DSA_PK = 64;
    /// @notice The size ceiling: the four KEM publics, three signing publics and the header, with room.
    uint256 public constant MAX_CERT_BYTES = 1_500_000;

    /// @notice Domain tag for an endpoint leaf.
    /// @dev Versioned rather than edited: changing it invalidates every proof already published against the tree.
    bytes32 public constant DOMAIN_ENDPOINT_LEAF = keccak256("FINAL_ENDPOINT_LEAF_v01");
    /// @notice Domain tag for an endpoint admission digest.
    /// @dev Separate from the leaf tag, so an admission approval can never be replayed as a leaf commitment.
    bytes32 public constant DOMAIN_ENDPOINT_ADMISSION = keccak256("FINAL_ENDPOINT_ADMISSION_v01");
    /// @notice Action tag for endpoint registration.
    bytes32 public constant ACTION_REGISTER_ENDPOINT = keccak256("FINAL_ENDPOINT_REGISTRY_REGISTER_v01");
    /// @notice Action tag for endpoint revocation.
    /// @dev Distinct from registration so an approval collected to add an endpoint cannot remove one.
    bytes32 public constant ACTION_REVOKE_ENDPOINT = keccak256("FINAL_ENDPOINT_REGISTRY_REVOKE_v01");
    /// @dev Must equal the schema's `CHAIN_AUTHORITY_KEY_ID` (fcert.js, FinalCertificate).
    /// @notice SHA3-256(utf8("FINAL_CHAIN_AUTHORITY_v01")) — the chain-issuer constant every
    ///         v5 TBS carries as its AuthorityKeyId (per the certificate schema,
    ///         "Chain-issuer constants"). The same literal `FinalIdentityRegistry` pins; SHA3,
    ///         not keccak — the two differ in padding and a keccak here refused every
    ///         certificate the reference encoder writes.
    bytes32 public constant CHAIN_AUTHORITY_KEY_ID =
        0x9a6a5d8139ad2d28957698330aaa691017dba7dc80eb7cbec585239fb680bbab;

    /// @notice Endpoint status: active and admitted.
    uint8 public constant STATUS_ACTIVE = 1;
    /// @notice Endpoint status: revoked.
    /// @dev Revocation is a recorded status rather than a deletion. An absent record proves nothing, and a
    ///       consumer must be able to prove that an endpoint was withdrawn rather than never registered.
    uint8 public constant STATUS_REVOKED = 2;

    /// @notice The identity registry this contract resolves quorum members and root attestation through.
    /// @dev Immutable: it decides who may register an endpoint, so a re-pointable reference would make the
    ///       admission gate only as strong as whoever could move it.
    FinalIdentityRegistry public immutable registry;
    /// @notice The state trees this registry projects endpoint leaves into.
    /// @dev Immutable for the same reason — a redirectable tree would publish endpoints where nothing reads.
    FinalStateTrees public immutable trees;

    // -------------------------------------------------------------- types

    /// @notice What the parser reads from an endpoint certificate's TBS.
    struct Parsed {
        /// @dev Hash of the certificate this endpoint was admitted under.
        bytes32 certificateHash;
        /// @dev The certificate's subject key id, re-derived from the parsed keys and checked against the value the
        ///       certificate declares. A certificate claiming a subject it does not hash to would admit one party
        ///       under another's name.
        bytes32 subjectKeyId;
        /// @dev Start of the certificate's validity window.
        uint64 notBefore;
        /// @dev End of the certificate's validity window.
        uint64 notAfter;
        /// @dev The certificate's subject distinguished name, carried so the record is self-describing.
        string subjectDn;
        /// @dev The endpoint's ML-DSA-87 public key.
        bytes mlDsaKey;
        /// @dev The endpoint's SLH-DSA public key.
        bytes slhDsaKey;
        /// @dev The endpoint's FN-DSA-1024 public key.
        bytes fnDsaKey;
        /// @dev Commitment to the endpoint's ML-KEM-1024 public key. Encapsulation keys are committed rather than
        ///       stored: nothing here verifies against them, and their full length would cost storage for no check.
        bytes32 mlKemKeyHash;
        /// @dev Commitment to the endpoint's HQC-5 public key.
        bytes32 hqcKeyHash;
        /// @dev Commitment to the endpoint's Classic McEliece public key.
        bytes32 mcelieceKeyHash;
        /// @dev Commitment to the endpoint's FrodoKEM public key.
        bytes32 frodoKeyHash;
    }

    struct Endpoint {
        /// @dev Hash of the certificate this endpoint holds.
        bytes32 certificateHash;
        /// @dev Start of its validity window.
        uint64 notBefore;
        /// @dev End of its validity window.
        uint64 notAfter;
        /// @dev When this registry admitted it.
        uint64 registeredAt;
        /// @dev The region the endpoint serves, carried so a consumer can select without an off-chain table.
        bytes32 region;
        /// @dev `STATUS_ACTIVE` or `STATUS_REVOKED`.
        uint8 status;
        /// @dev The certificate's subject distinguished name.
        string subjectDn;
    }

    /// @notice The holder's proof of possession over the admission digest: the
    ///         live ML-DSA-87 network-authentication key, and the SLH-DSA key
    ///         when the certificate carries one.
    struct EndpointProof {
        /// @dev The endpoint's ML-DSA-87 signature over the admission digest.
        bytes mlDsaSignature;
        /// @dev The endpoint's SLH-DSA signature over the same digest.
        /// @dev Both are required. One signature proves possession of one key; admission binds every signing key the
        ///       certificate declares, so a party holding only part of the material cannot register under it.
        bytes slhDsaSignature;
    }

    /// @dev Endpoint id to its record. Private: every read goes through the accessor, so a caller cannot pick up
    ///       a partially-written record.
    mapping(bytes32 endpointId => Endpoint) private _endpoints;
    /// @dev Replay domain for admission digests. Bound into every digest and advanced on use, so an admission
    ///       signature is good for exactly one registration.
    uint64 private _admissionNonce;

    /// @notice An endpoint was admitted.
    /// @param endpointId The endpoint admitted.
    /// @param certificateHash Hash of the certificate it was admitted under.
    /// @param region The region it serves.
    /// @param notAfter End of its certificate's validity window.
    event EndpointRegistered(bytes32 indexed endpointId, bytes32 certificateHash, bytes32 region, uint64 notAfter, string subjectDn);
    /// @notice An endpoint was revoked.
    /// @param endpointId The endpoint revoked.
    /// @param certificateHash Hash of the certificate it had been admitted under.
    event EndpointRevoked(bytes32 indexed endpointId, bytes32 certificateHash);

    /// @notice Thrown when a payload does not begin with the certificate magic.
    /// @param got The leading bytes found.
    error BadMagic(uint32 got);
    /// @notice Thrown when a certificate declares a wire version this registry does not parse.
    /// @param got The version declared.
    error BadVersion(uint32 got);
    /// @notice Thrown when a certificate ends before a field it declares.
    /// @dev Every read is bounds-checked before it happens, so a truncated certificate is refused rather than
    ///       parsed against whatever follows it in calldata.
    /// @param needed Offset the parse required.
    /// @param got Length actually available.
    error Truncated(uint256 needed, uint256 got);
    /// @notice Thrown when a declared length exceeds what any supported algorithm uses.
    /// @param length The rejected length.
    error TooLarge(uint256 length);
    /// @notice Thrown when a certificate's issuer is not the root this chain attests.
    /// @dev The root is a record on this chain rather than a file, so this check is against published state and
    ///       not against anything an operator supplies.
    /// @param authorityKeyId The issuer the certificate names.
    error NotChainAttested(bytes32 authorityKeyId);
    /// @notice Thrown when a certificate's declared subject key id does not match the one its keys derive.
    /// @param derived The id the parsed keys hash to.
    /// @param declared The id the certificate states.
    error SubjectKeyIdMismatch(bytes32 derived, bytes32 declared);
    /// @notice Thrown when a certificate's keys are not in ascending order.
    /// @dev Ordering makes duplicate detection a single comparison per key rather than a quadratic scan.
    error KeysNotSorted();
    /// @notice Thrown when one certificate declares the same purpose and algorithm twice.
    /// @param purpose The duplicated purpose.
    /// @param algorithm The duplicated algorithm.
    error DuplicateKey(uint16 purpose, uint16 algorithm);
    /// @notice Thrown when a key's algorithm does not belong in the slot it occupies.
    /// @param purpose The slot.
    /// @param algorithm The algorithm found in it.
    error WrongAlgorithmForSlot(uint16 purpose, uint16 algorithm);
    /// @notice Thrown when a key's length does not match its algorithm.
    /// @param algorithm The algorithm declared.
    /// @param length The length found.
    error BadKeyLength(uint16 algorithm, uint256 length);
    /// @notice Thrown when a certificate omits a key this registry requires.
    /// @param algorithm The missing algorithm.
    error MissingKey(uint16 algorithm);
    /// @notice Thrown when a certificate's validity window ends before it starts.
    /// @param notBefore Start of the window.
    /// @param notAfter End of the window.
    error ValidityInverted(uint64 notBefore, uint64 notAfter);
    /// @notice Thrown when a certificate's validity window has already closed.
    /// @param notAfter End of the window.
    error Expired(uint64 notAfter);
    /// @notice Thrown when an endpoint id is registered twice.
    /// @param endpointId The id already held.
    error AlreadyRegistered(bytes32 endpointId);
    /// @notice Thrown when an unregistered endpoint is referenced.
    /// @param endpointId The unknown id.
    error UnknownEndpoint(bytes32 endpointId);
    /// @notice Thrown when an already-revoked endpoint is revoked again.
    /// @param endpointId The id already revoked.
    error AlreadyRevoked(bytes32 endpointId);
    /// @notice Thrown when the admission signatures do not prove possession of the certificate's keys.
    /// @dev Proving possession is what stops one party registering an endpoint under a certificate they merely
    ///       obtained a copy of.
    error PossessionNotProved();

    /// @notice Binds this registry to the identity registry and the state trees.
    /// @dev Both are immutable, so the pair a deployed registry answers to cannot be changed afterwards.
    /// @param registry_ The identity registry that attests the root and holds member keys.
    /// @param trees_ The state trees this registry projects endpoint leaves into.
    constructor(FinalIdentityRegistry registry_, FinalStateTrees trees_) {
        registry = registry_;
        trees = trees_;
    }

    // ---------------------------------------------------------- admission

    /**
     * @notice Register a tunnel endpoint from its certificate TBS. Projects the
     *         leaf in the same transaction.
     * @param tbs The endpoint certificate's TBS bytes (everything before the
     *        signature block — a chain-attested certificate carries none).
     * @param region Which region this endpoint serves (a label the fleet
     *        chooses, e.g. keccak256("europe-west6")); in the leaf so a client
     *        can tell the three apart.
     * @param proof The holder's signatures over {admissionDigest}.
     * @param anchorBlock The registrar quorum's anchor.
     * @param approvals Sealed `ROLE_REGISTRAR` approvals over this action; the
     *        registry burns this contract's gate nonce, so approvals collected
     *        for one registration are spent by it alone.
     */
    function registerEndpoint(
        bytes calldata tbs,
        bytes32 region,
        EndpointProof calldata proof,
        uint64 anchorBlock,
        FinalPqQuorum.Approval[] calldata approvals
    ) external returns (bytes32 endpointId) {
        Parsed memory p = parse(tbs);
        endpointId = p.subjectKeyId;
        if (_endpoints[endpointId].status != 0) revert AlreadyRegistered(endpointId);
        if (block.timestamp > p.notAfter) revert Expired(p.notAfter);

        registry.requireRegistrarQuorum(
            ACTION_REGISTER_ENDPOINT, keccak256(abi.encode(p.certificateHash, region)), anchorBlock, approvals
        );
        _requirePossession(p, region, proof);

        _endpoints[endpointId] = Endpoint({
            certificateHash: p.certificateHash,
            notBefore: p.notBefore,
            notAfter: p.notAfter,
            registeredAt: uint64(block.timestamp),
            region: region,
            status: STATUS_ACTIVE,
            subjectDn: p.subjectDn
        });
        emit EndpointRegistered(endpointId, p.certificateHash, region, p.notAfter, p.subjectDn);
        _project(endpointId);
    }

    /// @notice Revoke an endpoint under the registrar quorum. The leaf moves to
    ///         the revoked status in the same transaction.
    function revokeEndpoint(bytes32 endpointId, uint64 anchorBlock, FinalPqQuorum.Approval[] calldata approvals)
        external
    {
        Endpoint storage e = _endpoints[endpointId];
        if (e.status == 0) revert UnknownEndpoint(endpointId);
        if (e.status == STATUS_REVOKED) revert AlreadyRevoked(endpointId);
        registry.requireRegistrarQuorum(
            ACTION_REVOKE_ENDPOINT, keccak256(abi.encode(endpointId, e.certificateHash)), anchorBlock, approvals
        );
        e.status = STATUS_REVOKED;
        emit EndpointRevoked(endpointId, e.certificateHash);
        _project(endpointId);
    }

    /// @notice Re-project an endpoint's leaf — permissionless, the value is this
    ///         contract's own verdict.
    function project(bytes32 endpointId) external {
        _project(endpointId);
    }

    // -------------------------------------------------------------- views

    /// @inheritdoc IEndpointSource
    function endpointLeafOf(bytes32 endpointId) public view returns (bytes32) {
        Endpoint storage e = _endpoints[endpointId];
        if (e.status == 0) return bytes32(0);
        return keccak256(abi.encode(DOMAIN_ENDPOINT_LEAF, e.certificateHash, e.status, e.notAfter, e.region));
    }

    /// @notice Reads one endpoint's record.
    /// @dev Returns a zeroed record for an unknown id; check `status` rather than treating a zero record as an
    ///       endpoint that exists but is inactive.
    /// @param endpointId The endpoint to read.
    /// @return The stored record.
    function endpointOf(bytes32 endpointId) external view returns (Endpoint memory) {
        return _endpoints[endpointId];
    }

    /// @notice Registered, not revoked, and inside its validity window.
    function isActive(bytes32 endpointId) external view returns (bool) {
        Endpoint storage e = _endpoints[endpointId];
        return e.status == STATUS_ACTIVE && block.timestamp >= e.notBefore && block.timestamp <= e.notAfter;
    }

    /// @notice The digest the holder signs for the NEXT registration of `certificateHash`
    ///         in `region` — bound to this chain, this contract and its admission counter.
    function admissionDigest(bytes32 certificateHash, bytes32 region) public view returns (bytes32) {
        return keccak256(
            abi.encode(DOMAIN_ENDPOINT_ADMISSION, block.chainid, address(this), certificateHash, region, _admissionNonce)
        );
    }

    /// @notice The current admission nonce.
    /// @dev Published so an endpoint can build the exact digest this registry will verify, rather than guessing
    ///       it and discovering the mismatch on a failed registration.
    /// @return The nonce the next admission digest binds.
    function admissionNonce() external view returns (uint64) {
        return _admissionNonce;
    }

    // ------------------------------------------------------------- parser

    /**
     * @notice Parse an endpoint certificate's TBS: structure, the chain issuer,
     *         the subject key id over the key block, every key under
     *         `PURPOSE_NETWORK_AUTH` with its algorithm's length, the four KEMs
     *         and the ML-DSA-87 signing key required. A view, so the fleet can
     *         check a certificate with one `eth_call` before submitting it.
     */
    function parse(bytes calldata tbs) public view returns (Parsed memory p) {
        if (tbs.length > MAX_CERT_BYTES) revert TooLarge(tbs.length);
        _need(tbs, 8);
        uint32 magic = uint32(bytes4(tbs[0:4]));
        if (magic != CERT_MAGIC) revert BadMagic(magic);
        uint32 version = uint32(bytes4(tbs[4:8]));
        if (version != CERT_VERSION) revert BadVersion(version);
        uint256 o = 8;
        // serial (32) ‖ depth (1) ‖ maxDelegationDepth (1)
        _need(tbs, o + 34);
        o += 34;
        _need(tbs, o + 16);
        // The TBS carries nanoseconds; this chain's clock is milliseconds
        // (`FinalChainTime`). Converted here, once, so `block.timestamp`
        // comparisons and the projected leaf speak the chain's unit — the same
        // division `FinalCertificate.parse` makes for identity certificates.
        p.notBefore = uint64(bytes8(tbs[o:o + 8])) / FinalChainTime.NS_PER_MILLISECOND;
        p.notAfter = uint64(bytes8(tbs[o + 8:o + 16])) / FinalChainTime.NS_PER_MILLISECOND;
        o += 16;
        if (p.notAfter <= p.notBefore) revert ValidityInverted(p.notBefore, p.notAfter);
        // issuer DN, subject DN, authorityKeyId, subjectKeyId — each u32-length-prefixed
        (uint256 issuerStart, uint256 issuerLen) = _field(tbs, o);
        o = issuerStart + issuerLen;
        (uint256 subjectStart, uint256 subjectLen) = _field(tbs, o);
        o = subjectStart + subjectLen;
        p.subjectDn = string(tbs[subjectStart:subjectStart + subjectLen]);
        (uint256 akidStart, uint256 akidLen) = _field(tbs, o);
        o = akidStart + akidLen;
        bytes32 akid = _bytes32At(tbs, akidStart, akidLen);
        if (akid != CHAIN_AUTHORITY_KEY_ID) revert NotChainAttested(akid);
        (uint256 skidStart, uint256 skidLen) = _field(tbs, o);
        o = skidStart + skidLen;
        bytes32 declaredSkid = _bytes32At(tbs, skidStart, skidLen);
        // the key block
        _need(tbs, o + 2);
        uint16 keyCount = uint16(bytes2(tbs[o:o + 2]));
        o += 2;
        uint256 blockStart = o;
        uint32 lastSort = 0;
        bool seenMlDsa;
        for (uint256 i = 0; i < keyCount; i++) {
            _need(tbs, o + 8);
            uint16 alg = uint16(bytes2(tbs[o:o + 2]));
            uint16 purpose = uint16(bytes2(tbs[o + 2:o + 4]));
            uint32 len = uint32(bytes4(tbs[o + 4:o + 8]));
            o += 8;
            _need(tbs, o + len);
            uint32 sortKey = (uint32(purpose) << 16) | alg;
            if (i > 0) {
                if (sortKey < lastSort) revert KeysNotSorted();
                if (sortKey == lastSort) revert DuplicateKey(purpose, alg);
            }
            lastSort = sortKey;
            if (purpose != PURPOSE_NETWORK_AUTH) revert WrongAlgorithmForSlot(purpose, alg);
            if (alg == ALG_ML_DSA_87) {
                if (len != LEN_ML_DSA_87_PK) revert BadKeyLength(alg, len);
                p.mlDsaKey = tbs[o:o + len];
                seenMlDsa = true;
            } else if (alg == ALG_SLH_DSA_SHAKE_256S) {
                if (len != LEN_SLH_DSA_PK) revert BadKeyLength(alg, len);
                p.slhDsaKey = tbs[o:o + len];
            } else if (alg == ALG_FN_DSA_1024) {
                if (len != LEN_FN_DSA_1024_PK) revert BadKeyLength(alg, len);
                p.fnDsaKey = tbs[o:o + len];
            } else if (alg == ALG_ML_KEM_1024) {
                if (len != LEN_ML_KEM_1024_PK) revert BadKeyLength(alg, len);
                p.mlKemKeyHash = keccak256(tbs[o:o + len]);
            } else if (alg == ALG_HQC_5) {
                if (len != LEN_HQC_5_PK) revert BadKeyLength(alg, len);
                p.hqcKeyHash = keccak256(tbs[o:o + len]);
            } else if (alg == ALG_MCELIECE_8192128) {
                if (len != LEN_MCELIECE_8192128_PK) revert BadKeyLength(alg, len);
                p.mcelieceKeyHash = keccak256(tbs[o:o + len]);
            } else if (alg == ALG_FRODO_1344_SHAKE) {
                if (len != LEN_FRODO_1344_PK) revert BadKeyLength(alg, len);
                p.frodoKeyHash = keccak256(tbs[o:o + len]);
            } else {
                revert WrongAlgorithmForSlot(purpose, alg);
            }
            o += len;
        }
        uint256 blockEnd = o;
        if (!seenMlDsa) revert MissingKey(ALG_ML_DSA_87);
        if (p.mlKemKeyHash == bytes32(0)) revert MissingKey(ALG_ML_KEM_1024);
        if (p.hqcKeyHash == bytes32(0)) revert MissingKey(ALG_HQC_5);
        if (p.mcelieceKeyHash == bytes32(0)) revert MissingKey(ALG_MCELIECE_8192128);
        if (p.frodoKeyHash == bytes32(0)) revert MissingKey(ALG_FRODO_1344_SHAKE);
        // extensions: skipped structurally (ExtensionId u16 ‖ critical u8 ‖ u32 len ‖ value)
        _need(tbs, o + 2);
        uint16 extCount = uint16(bytes2(tbs[o:o + 2]));
        o += 2;
        for (uint256 i = 0; i < extCount; i++) {
            _need(tbs, o + 7);
            uint32 len = uint32(bytes4(tbs[o + 3:o + 7]));
            o += 7;
            _need(tbs, o + len);
            o += len;
        }
        if (o != tbs.length) revert Truncated(o, tbs.length);
        // ONE copy of the TBS into memory: the certificate hash over all of it, the
        // subject key id over the key block inside it — never a second copy.
        bytes memory buf = tbs;
        p.certificateHash = _sha3Slice(buf, 0, buf.length);
        p.subjectKeyId = _sha3Slice(buf, blockStart, blockEnd - blockStart);
        if (p.subjectKeyId != declaredSkid) revert SubjectKeyIdMismatch(p.subjectKeyId, declaredSkid);
    }

    // ----------------------------------------------------------- internals

    /// @dev Verifies that the registering party holds the certificate's signing keys, by checking both
    ///       signatures over the admission digest and burning the nonce. Consuming the nonce here rather than at
    ///       the caller is what makes one collected signature good for exactly one registration.
    /// @param p The parsed certificate.
    /// @param region The region being registered for, bound into the digest.
    /// @param proof The endpoint's signatures over that digest.
    function _requirePossession(Parsed memory p, bytes32 region, EndpointProof calldata proof) private {
        bytes32 digest = admissionDigest(p.certificateHash, region);
        _admissionNonce += 1;
        bytes memory message = abi.encodePacked(digest);
        if (!FinalChainPrecompiles.verifyMlDsa87(p.mlDsaKey, message, proof.mlDsaSignature)) revert PossessionNotProved();
        if (p.slhDsaKey.length != 0) {
            if (!FinalChainPrecompiles.verifySlhDsa(p.slhDsaKey, message, proof.slhDsaSignature)) revert PossessionNotProved();
        }
    }

    /// @dev Projects an endpoint's record into its tree leaf, so the published set moves with the record and the
    ///       two cannot describe different endpoints.
    /// @param endpointId The endpoint to project.
    function _project(bytes32 endpointId) private {
        bytes32[] memory ids = new bytes32[](1);
        ids[0] = endpointId;
        trees.syncEndpointLeaves(ids);
    }

    /// @dev Bounds check before a parse step. Called ahead of every read rather than once at the top, because a
    ///       certificate declares its own field lengths and each one can push the next read past the end.
    /// @param tbs The certificate body being parsed.
    /// @param upto Offset the next read requires.
    function _need(bytes calldata tbs, uint256 upto) private pure {
        if (tbs.length < upto) revert Truncated(upto, tbs.length);
    }

    /// @dev A u32-length-prefixed field at `p`: where its bytes start and how long they are.
    function _field(bytes calldata tbs, uint256 p) private pure returns (uint256 start, uint256 length) {
        _need(tbs, p + 4);
        length = uint32(bytes4(tbs[p:p + 4]));
        start = p + 4;
        _need(tbs, start + length);
    }

    /// @dev Reads a right-aligned `bytes32` out of the certificate body.
    /// @param tbs The certificate body.
    /// @param start Offset to read from.
    /// @param length Bytes to read.
    /// @return The value, zero-padded on the left.
    function _bytes32At(bytes calldata tbs, uint256 start, uint256 length) private pure returns (bytes32) {
        if (length != 32) return bytes32(0);
        return bytes32(tbs[start:start + 32]);
    }

    /// @dev SHA3-256 (the FIPS 202 precompile at 0x0202) over `buf[off:off+len]` IN PLACE —
    ///      no copy of the slice, which for a 1.4 MB certificate is the difference between
    ///      a registration that fits a block and one that does not.
    function _sha3Slice(bytes memory buf, uint256 off, uint256 len) private view returns (bytes32 digest) {
        if (off + len > buf.length) revert Truncated(off + len, buf.length);
        address precompile = FinalChainPrecompiles.SHA3_256;
        bool ok;
        assembly ("memory-safe") {
            let ptr := mload(0x40)
            ok := staticcall(gas(), precompile, add(add(buf, 0x20), off), len, ptr, 32)
            digest := mload(ptr)
            ok := and(ok, eq(returndatasize(), 32))
        }
        if (!ok) revert FinalChainPrecompiles.PrecompileUnavailable(precompile);
    }

    // ------------------------------------------------------------------ sweep

    /// @dev This contract's configuration gate reads the membership registry it
    /// was constructed against, so the sweep authority reads the same one.
    function _sweepRegistry() internal view override returns (FinalIdentityRegistry) {
        return registry;
    }

    /// @dev Nothing is reserved because nothing is owed: this contract has no
    /// payable entrypoint and no custody line — it records, it does not hold.
    /// Anything it carries arrived by accident and is sweepable in full.
}

contracts/finalchain/FinalIdentityRegistry.sol

// SPDX-License-Identifier: BUSL-1.1
// Copyright (c) 2024-2026 Final DeFi
// Licensed under the Business Source License 1.1 (the "License")
//
// Change Date: 2029-01-01
// Change License: GPL-2.0-or-later
//
// Additional Use Grant:
// 1. Any person or entity may deploy this identity registry as part of a Final
//    DeFi Protocol state plane, and may register, rotate, and revoke identity
//    records in it under the authority this contract enforces.
// 2. Operators, integrators, and end users may read the certificates, public
//    keys, role bits, and signer bindings it holds, and may call its views to
//    resolve an identity, a sender, or a quorum roster.
// 3. For the avoidance of doubt, this Grant does NOT permit the commercial
//    deployment of a Fork of this identity registry or a competing certificate
//    authority derived from it without permission prior to the Change Date.
//
// @author Final DeFi
// @version 1.0.0
pragma solidity ^0.8.20;

import {FinalCertificate} from "./FinalCertificate.sol";
import {FinalChainTime} from "./FinalChainTime.sol";
import {FinalChainPrecompiles} from "./FinalChainPrecompiles.sol";
import {FinalPqQuorum} from "./FinalPqQuorum.sol";
import {FinalSweep} from "../utils/FinalSweep.sol";
import {FinalChainInitializable} from "./FinalChainInitializable.sol";

/// @dev Commitment space for one stage's encapsulation pair.
///      Byte-equal to `FinalWalletFactory.DOMAIN_KEM_BUNDLE` and to the certificate issuer's own preimage
/// constant. Three independent derivations of one word: a mismatch in any of them is a certificate that
/// verifies nowhere, so the value is pinned by test against the other two rather than imported.
bytes32 constant DOMAIN_KEM_BUNDLE = keccak256("FINAL_KEM_BUNDLE_v01");

/// @dev Commitment space for the identity tree's wallet leaf.
///      Byte-equal to `IdentityRootModule.DOMAIN_IDENTITY_LEAF` on every execution chain. Restated rather
/// than imported because that module lives on other chains and no import would make the two one value; a
/// cross-contract parity test pins the pair. The spelling is FROZEN: the premined certificates were mined
/// against this exact constant, and the leaf it derives is the `certHash` inside a wallet's address
/// derivation, so changing a byte here moves addresses that already exist.
bytes32 constant DOMAIN_IDENTITY_LEAF = keccak256("FINAL_IDENTITY_LEAF_PQ_v01");

/// @dev Commitment space for the identity tree's ISSUER leaf.
///      An issuer projects under its own domain — `DOMAIN_ISSUER_LEAF ‖ certHash ‖ version ‖
/// issuerTreeRoot` — so an issuer record is stapleable for offline licence verification while the distinct
/// domain keeps it out of wallet admission: an execution chain's gateway folds with the wallet domain, so an
/// issuer leaf can never satisfy an identity-certificate check there. `issuerTreeRoot` is a RESERVED word,
/// zero until an issuer's own certificate-tree anchor is wired — the only clean path to offline licence
/// revocation, since fixed-depth insertion-ordered state trees cannot prove non-inclusion.
bytes32 constant DOMAIN_ISSUER_LEAF = keccak256("FINAL_ISSUER_LEAF_v01");

/// @dev The issuer name every chain-attested certificate carries, as a keccak digest.
///      The chain is the issuer but holds no keypair, so a chain-attested certificate carries this named
/// value in its issuer field: required by the wire format, verifying nothing on its own, and covered by
/// `certHash`. The name is deliberately environment-agnostic and jurisdiction-silent — the issuer is the
/// worldwide network rather than a legal entity, and an environment-specific name would fork `certHash` per
/// environment. Compared as a hash rather than as a string, so the check costs one word.
bytes32 constant CHAIN_ISSUER_DN_HASH = keccak256("CN=Final Chain,O=Final DeFi");

/// @dev The authority key identifier every chain-attested certificate names.
///      `SHA3-256(utf8("FINAL_CHAIN_AUTHORITY_v01"))` — a DOMAIN constant rather than the digest of a key,
/// because the chain issues certificates and holds no public key block to hash. Precomputed rather than
/// derived at construction: the harness the unit tests run under does not implement the real SHA3 function,
/// and the literal is pinned by test against a reference implementation. A zero-length authority key
/// identifier is reserved and is admitted nowhere.
bytes32 constant CHAIN_AUTHORITY_KEY_ID =
    0x9a6a5d8139ad2d28957698330aaa691017dba7dc80eb7cbec585239fb680bbab;

/**
 * @title Identity Leaf Sink
 * @notice The identity tree's projection door on the state-trees contract.
 * @dev A narrow interface rather than an import, because the trees contract imports THIS file — the
 *      dependency runs that way, and this is the one call that runs the other. Declaring the single method
 *      here keeps the cycle away from the compiler without duplicating either contract's surface.
 */
interface IIdentityLeafSink {
    /// @notice Recompute and store the identity-tree leaf for each named account.
    /// @dev Called inside the same transaction as every identity mutation, so an execution chain's admission
    ///      set sees a registration, rotation or revocation the moment this chain does. The leaf VALUE is
    ///      derived by the trees contract from the registry's post-mutation state, so the caller supplies
    ///      accounts and never a leaf.
    /// @param accounts The accounts whose leaves are stale.
    function syncIdentityLeaves(address[] calldata accounts) external;
}

/**
 * @title Revocation Recorder
 * @notice The revocation log's recording door.
 * @dev Same narrow-interface reasoning as the leaf sink above. `recorded` is read first, so a fingerprint
 *      somebody already recorded through the log's permissionless door cannot revert the registry mutation
 *      that feeds it.
 */
interface IRevocationRecorder {
    /// @notice Fold a permanently retired signer fingerprint into the revocation log.
    /// @dev The log applies its own permanence gate, reading this registry back; the call states nothing the
    ///      registry has not already decided.
    /// @param signerId The fingerprint that has lost standing for good.
    function record(bytes32 signerId) external;
    /// @notice Whether the log already holds `signerId`.
    /// @param signerId The fingerprint to look up.
    /// @return Whether a leaf for it exists.
    function recorded(bytes32 signerId) external view returns (bool);
}

/**
 * @title Final Identity Registry
 * @notice Who every party in the system is, on chain: one record per party, carrying its certificate and its
 *         actual public keys.
 * @dev Every service, every co-signer, every certificate authority and every operator has one record here.
 *      The record holds the party's public keys in full rather than commitments to them, and this contract is
 *      the certificate authority as well as the roster.
 *
 *      ## Where this runs
 *
 *      Only on this project's own reth-based chains. Verification happens inside precompiles that exist
 *      nowhere else: SHA3-256 at `0x0202`, ML-DSA-87 at `0x0204` and SLH-DSA-SHAKE-256s at `0x0205`, each
 *      address being that primitive's FIPS number. The constructor probes them and refuses to deploy where
 *      they are absent, so a registry of keys the chain cannot check never comes into existence. This
 *      contract takes part in no CREATE2 derivation — its address is per chain, and nothing derives an
 *      address from it — and nothing outside this directory imports it.
 *
 *      Gas is deliberately NOT a design constraint on that chain and must not be optimised for. Where a
 *      choice below trades gas for a verdict that is re-derivable from public state, the verdict wins: a
 *      signature checked in a precompile is a fact anyone can recompute, where the same check run in a
 *      library by whichever process happened to hold the keys is only a claim.
 *
 *      ## Keys are read from STORAGE, never from calldata
 *
 *      A commitment would be a quarter of the storage and would be enough to CHECK a key someone hands you.
 *      It is not enough to VERIFY A SIGNATURE, because verification needs the key itself — and a key that
 *      arrives in calldata proves nothing, since anyone holding a keypair can produce a valid signature under
 *      it. A quorum built on caller-supplied keys is a quorum of one: whoever built the calldata.
 *
 *      So the keys live here in full. `FinalPqQuorum` resolves a member through this registry and reads that
 *      member's key from this registry's storage, and "which key is co-signer three" has exactly one answer,
 *      in exactly one place. That is the load-bearing rule of every quorum on the chain, not an optimisation.
 *
 *      ## The certificate is the record, not a pointer to one
 *
 *      `certHash` is `SHA3-256(TBSCertificate)`: the certificate's own identity, and the handle revocation is
 *      keyed on. {registerWallet} and {registerIssuer} take the certificate's TBS bytes and read everything
 *      out of them — the digest, the serial, the key identifiers, the depth pair, the validity window and
 *      every public key. Neither takes a key argument, so no two arguments can disagree and no registrar can
 *      bind a certificate to a keypair that certificate does not contain.
 *
 *      ## The root is the first record here, not a self-signed file
 *
 *      This chain is the only root certificate authority, and the root is pinned as an entry in this registry
 *      rather than distributed as a self-signed certificate somebody has to install. Chain validation
 *      terminates here BY IDENTITY. Everything registered after the root is verified on chain, inside the
 *      precompiles, against what this registry already holds: the holder's own two signatures over the
 *      admission digest, the pinned chain-issuer constants, and — for a nested issuer — lineage to a
 *      registered parent whose depth admits it. There is no path by which a key enters this registry
 *      unattested; a registrar cannot register anything else.
 *
 *      ## Roles are a bitmask
 *
 *      One party is legitimately several things: a co-signer that also publishes, an operator that is also a
 *      guardian. A single enum would force either duplicate records for one key, which is two sources of
 *      truth about one party, or a role hierarchy nobody agrees on. A mask has neither problem, and a quorum
 *      asks whether an account CARRIES a capability rather than whether it IS a type.
 *
 *      ## Membership is hybrid-gated
 *
 *      Who is in this registry, and with which roles, is the root of every quorum on the chain, so it is the
 *      one thing no single key may decide. Once bootstrap is sealed, every membership mutation — register,
 *      roles, revoke, a hash-based signing key, the registrar threshold itself — and every state-plane
 *      configuration change routed through {requireRegistrarQuorum} takes a `ROLE_REGISTRAR` quorum whose
 *      approvals carry BOTH families: the ML-DSA-87 vote and the SLH-DSA seal. A lattice break cannot then
 *      rewrite the roster, and neither can a hash-function break; only both at once.
 *
 *      The bootstrap window is the only exception. While it is open the bootstrap admin writes alone, because
 *      every roster has to be installed by someone before it can install itself. {sealBootstrap} closes it
 *      irreversibly, and refuses to close it onto a registrar quorum that cannot be met.
 *
 *      ## The sender is not the account
 *
 *      Transactions on this chain are signed by ML-DSA-87, and the node derives `msg.sender` from the key as
 *      `keccak256(0x04 ‖ publicKey)[12:]`. That address pays gas and holds no authority. {accountOfSender}
 *      binds it to the identity whose live transaction key it derives from, so a `msg.sender` gate anywhere
 *      on this chain asks {senderHasRole} and resolves to the identity — and a key rotation moves the binding
 *      instead of the roster.
 *
 *      ## What this contract deliberately does not do
 *
 *      It never un-revokes: a revoked certificate is finished, and reversing that would reopen every past
 *      verification. It never enumerates a mapping inside a mutation — the registrars supply the chain list a
 *      revocation touches, and a fingerprint an incomplete list missed stays permanently recordable through
 *      the revocation log's own permissionless door. It holds no funds, exposes no payable entrypoint, and
 *      reserves nothing against a sweep. And it grants no capability by parsing one: a certificate says which
 *      keys a party holds, `roles` says what the party may do, and the two arrive as different arguments on
 *      purpose.
 */
contract FinalIdentityRegistry is FinalSweep, FinalChainInitializable {
    // ---------------------------------------------------------------- roles

    /// @notice May co-sign account-state rounds (tree 1).
    uint256 public constant ROLE_ACCOUNT_COSIGNER = 1 << 0;
    /// @notice May co-sign MMR / bundle-log advances.
    uint256 public constant ROLE_MMR_COSIGNER = 1 << 1;
    /// @notice May publish PHI ledger state (tree 2).
    uint256 public constant ROLE_PHI_PUBLISHER = 1 << 2;
    /// @notice May publish vAsset state (tree 3).
    uint256 public constant ROLE_VASSET_PUBLISHER = 1 << 3;
    /// @notice May publish oracle data (tree 4).
    uint256 public constant ROLE_ORACLE_PUBLISHER = 1 << 4;
    /// @notice May publish settlement / asset registry roots (trees 5 and 6).
    uint256 public constant ROLE_REGISTRY_PUBLISHER = 1 << 5;
    /// @notice May act as a wallet guardian.
    uint256 public constant ROLE_GUARDIAN = 1 << 6;
    /// @notice May submit transactions on behalf of the protocol.
    uint256 public constant ROLE_RELAYER = 1 << 7;
    /// @notice May register and revoke identities once bootstrap is sealed.
    uint256 public constant ROLE_REGISTRAR = 1 << 8;
    /// @notice A certificate authority — the root, or an intermediate under it.
    uint256 public constant ROLE_CERTIFICATE_AUTHORITY = 1 << 9;
    /// @notice May co-sign `FinalSettlementLog` appends — the cross-chain
    /// settlement quorum, the same members whose LMS keys satisfy the
    /// execution chains' settlement set. A role of its own rather than a
    /// second use of `ROLE_REGISTRY_PUBLISHER`: the registries (trees 5/6)
    /// change on listing cadence and settlement leaves release custody, and
    /// one role for both would put the value plane behind the listing roster.
    uint256 public constant ROLE_SETTLEMENT_COSIGNER = 1 << 10;

    // ----------------------------------------------------- action domains

    /// @notice Action domain for registering or rotating a wallet identity.
    /// @dev One domain per membership mutation, so an approval to grant a role can never be replayed as one
    ///      to revoke. This registry is its own verifying contract for all of these, and the digest also
    ///      binds a per-contract counter, so an approval authorises exactly one action once.
    bytes32 public constant DOMAIN_REGISTER_WALLET = keccak256("FINAL_REGISTRY_REGISTER_WALLET_v01");
    /// @notice Action domain for registering or rotating an issuer.
    bytes32 public constant DOMAIN_REGISTER_ISSUER = keccak256("FINAL_REGISTRY_REGISTER_ISSUER_v01");
    /// @notice The admission proof-of-possession digest domain.
    /// @dev The HOLDER signs `keccak256(abi.encode(domain, chainid, registry, certHash, recoveryCertHash,
    ///      gateNonce))` with the live transaction key (ML-DSA-87) AND the live access key
    ///      (SLH-DSA-SHAKE-256s) — both families, in the admission transaction, verified by the precompiles.
    ///      Possession lives in the TRANSACTION, never in the artifact, so holding a copy of somebody's
    ///      public certificate admits nothing.
    bytes32 public constant DOMAIN_IDENTITY_ADMISSION = keccak256("FINAL_IDENTITY_ADMISSION_v01");
    /// @notice Action domain for root-plane global certificate revocation, by handle.
    bytes32 public constant DOMAIN_REVOKE_CERTIFICATE =
        keccak256("FINAL_REGISTRY_REVOKE_CERTIFICATE_v01");
    /// @notice Digest domain for an issuer revoking a certificate it signed off chain.
    /// @dev Signed by the issuer's own registered cert-signing keys rather than approved by a quorum, and
    ///      bound to the issuer's own gate nonce, so one issuer's revocations cannot be replayed as
    ///      another's.
    bytes32 public constant DOMAIN_ISSUER_CERT_REVOCATION =
        keccak256("FINAL_ISSUER_CERT_REVOCATION_v01");
    /// @notice Action domain for recording an account's hash-based signing key.
    bytes32 public constant DOMAIN_REGISTER_LMS_KEY = keccak256("FINAL_REGISTRY_REGISTER_LMS_KEY_v01");
    /// @notice Action domain for replacing an identity's capability bitmask.
    bytes32 public constant DOMAIN_SET_ROLES = keccak256("FINAL_REGISTRY_SET_ROLES_v01");
    /// @notice Action domain for retiring an identity.
    bytes32 public constant DOMAIN_REVOKE = keccak256("FINAL_REGISTRY_REVOKE_v01");
    /// @notice Action domain for moving the registrar threshold itself.
    bytes32 public constant DOMAIN_SET_REGISTRAR_THRESHOLD =
        keccak256("FINAL_REGISTRY_SET_REGISTRAR_THRESHOLD_v01");

    /// @notice The algorithm identifier the sender derivation is domain-separated by.
    /// @dev ML-DSA-87, FIPS 204 — the only algorithm this chain's transaction envelope admits. Prefixing it
    ///      means a key of another family can never derive the same sender address.
    uint8 private constant ENVELOPE_ALG_ML_DSA_87 = 4;

    // ------------------------------------------------------------- storage

    /**
     * @title Identity
     * @notice One party's on-chain identity.
     * @dev `version` increments on every mutation, and that increment is what a rotation IS: the record is
     *      replaced rather than appended to, and the version is how a reader on another chain knows which of
     *      two copies it has seen is newer.
     */
    struct Identity {
        /// SHA3-256 of the LIVE certificate's TBS bytes. The revocation handle.
        bytes32 certHash;
        /// SHA3-256 of the RECOVERY certificate's TBS bytes.
        bytes32 recoveryCertHash;
        /// The certificate's 32-byte serial, `16 B entropy ‖ 16 B counter`.
        bytes32 serial;
        /// SHA3-256 of this certificate's public key block. A child names it in
        /// its own `AuthorityKeyId`, which is how the chain links the two.
        bytes32 subjectKeyId;
        /// Capability bitmask. Zero for a registered-but-idle party.
        uint256 roles;
        /// Position on the delegation axis; 0 is the Final Chain root.
        uint8 depth;
        /// Deepest level this key may issue to. `== depth` means it signs no
        /// certificates at all, which is every end entity.
        uint8 maxDelegationDepth;
        /// Milliseconds since the epoch, on this chain's clock. The certificate schema stamps validity in
        /// nanoseconds and the parser converts on the way in, so nothing here ever compares across units.
        uint64 notBefore;
        /// Milliseconds since the epoch, or 0 for "never expires" — which the certificate schema allows and
        /// personal identity certificates use. The bound is exclusive.
        uint64 notAfter;
        /// Monotonic. A rotation that does not advance it is refused.
        uint64 version;
        /// Set by `revoke`. Never unset: a revoked certificate is finished, and
        /// an un-revoke would make every past verification re-openable.
        bool revoked;
        /// Distinguishes "no record" from "a record whose fields are all zero".
        bool registered;
    }

    /**
     * @title Lms Key
     * @notice A hash-based (LMS) signing key held by a registered account.
     * @dev The execution chains' quorums verify LMS rather than ML-DSA, because those chains have no
     *      post-quantum precompiles and check a keccak hash chain instead. Those keys are the authority over
     *      the post-quantum anchor, and therefore over post-quantum execution — which makes "who holds this
     *      fingerprint?" a question the state plane has to be able to answer, exactly as it answers it for
     *      every other key.
     *
     *      Recorded against an account that is ALREADY registered, so an LMS key is a capability of a known
     *      identity rather than a standalone credential. It inherits that identity's revocation: a revoked
     *      account's signer is a revoked signer, with nothing extra to remember to do.
     */
    struct LmsKey {
        /// `I`, hashed into every step of the signature.
        bytes16 keyId;
        /// Merkle tree height. Bound into the fingerprint, because the leaf
        /// commits to node `2^h + q` and a signer who could vary it could vary
        /// the numbering.
        uint8 height;
        /// `T[1]`, the LMS public key.
        bytes32 root;
        /// Monotonic. A rotation that does not advance it is refused, so a
        /// replayed registration cannot reinstate a superseded key.
        uint64 version;
        /// Distinguishes "no key" from "a key whose fields are all zero".
        bool registered;
    }

    /// @notice The hash-based (LMS) signing key an account holds, per chain.
    /// @dev One slot per account AND chain. A single-use hash-based counter is a complete defence only while
    ///      the key it names signs for ONE chain, so the roster is stored the way it is armed: the same
    ///      operator is a different signer on every chain, and a rotation on one says nothing about another.
    mapping(address account => mapping(uint64 chainId => LmsKey)) private _lmsKey;
    /**
     * @title Lms Binding
     * @notice What a signer fingerprint is bound to: the account holding it and the chain it signs for.
     * @dev Two fields in one slot, deliberately. This contract sits within a few bytes of the deployed-code
     *      ceiling, so anything added to this surface has to pay for itself in bytecode first — which is why
     *      checks that no authority consults, such as refusing a zero chain identifier, are left to the
     *      publisher off chain rather than spent here.
     */
    struct LmsBinding {
        /// The account that registered the fingerprint. Zero means no account ever did.
        address account;
        /// The chain that registration was for. Zero alongside a zero account, for a fingerprint never
        /// registered.
        uint64 chainId;
    }

    /// @notice Which account a signer fingerprint belongs to, and which chain it signs for.
    /// @dev The lookup the whole LMS record exists for: an execution chain's roster names fingerprints and
    ///      nothing else, so without this the keys behind those names are unattributable. Written once at
    ///      registration and left in place when the key is superseded, because attribution is history — a
    ///      signature made under a retired key was still made by that operator.
    ///
    ///      The chain it names is what selects the slot {lmsSignerIsLive} resolves the fingerprint against.
    mapping(bytes32 signerId => LmsBinding) private _lmsBinding;

    /// @notice The identity record for an account.
    mapping(address account => Identity) private _identity;
    /// @notice The live transaction key, ML-DSA-87: spending, and every high-cadence protocol action.
    /// @dev All four key slots are stored in FULL rather than as commitments, because the precompiles verify
    ///      against a KEY and a key that arrived in calldata proves nothing about who signed. This is the
    ///      rule every quorum on this chain rests on.
    /// @dev A certificate authority has two keys rather than four, and they live in the two active slots.
    ///      One storage shape rather than two, because every reader would otherwise have to know which kind
    ///      of party it was looking at before it could look.
    mapping(address account => bytes) private _activeTransactionKey;
    /// @notice The live access key, SLH-DSA-SHAKE-256s: identity, rotation and guardianship.
    mapping(address account => bytes) private _activeAccessKey;
    /// @notice The pre-committed recovery transaction key, ML-DSA-87. Empty for a certificate authority.
    mapping(address account => bytes) private _recoveryTransactionKey;
    /// @notice The pre-committed recovery access key, SLH-DSA-SHAKE-256s. Empty for a certificate
    ///         authority.
    mapping(address account => bytes) private _recoveryAccessKey;
    /// @notice The seal key: a service's second SLH-DSA-SHAKE-256s key, which co-signs membership-class
    ///         quorum decisions (the registrar quorum); operational quorum actions take the ML-DSA-87 vote alone.
    /// @dev Empty for every identity whose certificate carries no seal slot, which is every user wallet and
    ///      every certificate authority. An identity with no seal can never contribute to a sealed quorum,
    ///      so {sealableMemberCount} counts this rather than counting role bits.
    mapping(address account => bytes) private _activeSealKey;
    /// @notice The live stage's ML-KEM-1024 encapsulation key, the lattice half of the pair.
    /// @dev Two algorithms per stage — ML-KEM-1024 and HQC-5 — so a break in either family leaves the other
    ///      standing, the same reasoning that pairs the two signature families. The pair is written and
    ///      cleared together, so an account holds both or neither.
    /// @dev Stored as the RAW keys, like the signing keys, because a registry that held only commitments
    ///      could not answer "encapsulate to this party" without a second lookup somewhere less
    ///      authoritative.
    mapping(address account => bytes) private _activeKemMlKem;
    /// @notice The live stage's HQC-5 encapsulation key, the code-based half of the pair.
    mapping(address account => bytes) private _activeKemHqc;
    /// @notice The recovery stage's ML-KEM-1024 encapsulation key. Empty when the account has no recovery
    ///         stage.
    mapping(address account => bytes) private _recoveryKemMlKem;
    /// @notice The recovery stage's HQC-5 encapsulation key. Empty when the account has no recovery stage.
    mapping(address account => bytes) private _recoveryKemHqc;
    /// @notice Reverse index. A certificate identifies exactly one account, so
    /// presenting a `certHash` is enough to find who it belongs to.
    mapping(bytes32 certHash => address account) public accountOfCertificate;
    /// @notice Revocation by certificate, independent of the account record.
    /// A certificate stays revoked even if its account is later re-registered
    /// under a new one.
    mapping(bytes32 certHash => bool) public certificateRevoked;
    /// @notice Who revoked a certificate through the ISSUER half of the lane.
    /// Scoped by the verifier: the entry binds only when the recorded revoker
    /// is the certificate's own issuer. Never gates registration.
    mapping(bytes32 certHash => address) public certificateRevokedBy;

    /// @notice Every registered account, in registration order. Small by
    /// construction — this is services and co-signers, not wallets.
    address[] private _accounts;

    /// @notice Bootstrap authority. Zero once `sealBootstrap` has run.
    address public bootstrapAdmin;
    /// @notice Whether registration still accepts the bootstrap admin.
    bool public bootstrapSealed;

    /// @notice Where identity mutations project the tree-8 leaf, same-tx.
    /// Zero only before {wireStatePlane} — the deploy tooling wires it before
    /// the first registration, and the projection is skipped while unset so
    /// the wiring transaction itself can be ordered freely in the bootstrap
    /// window.
    address public stateTrees;
    /// @notice Where the PERMANENT standing losses — revocation and LMS-key
    /// supersession — are recorded, same-tx. Zero only before {wireStatePlane}.
    address public revocationLog;

    /// @notice Sealed `ROLE_REGISTRAR` approvals a membership mutation needs.
    /// @dev Zero until set, and bootstrap cannot be sealed while it is zero or
    /// unreachable: a registry sealed behind a threshold nobody can meet is a
    /// registry nobody can ever write to again.
    uint256 public registrarThreshold;
    /// @notice Replay counter per verifying contract — this registry for its
    /// own mutations, each state-plane contract for its configuration. Bound
    /// into every registrar digest, so an approval is for exactly one action.
    mapping(address caller => uint64) private _gateNonce;
    /// @notice The identity a Final Chain sender belongs to. See the contract
    /// notes: a sender is derived from the `activeTransaction` key and is not
    /// the account.
    mapping(address sender => address account) public accountOfSender;

    // -------------------------------------------------------------- events

    /// @notice An identity was registered, or an existing one rotated onto a new certificate set.
    /// @param account The identity written.
    /// @param certHash The live certificate's handle.
    /// @param roles The capability bitmask now in force.
    /// @param version The record's monotonic version.
    event IdentityRegistered(
        address indexed account, bytes32 indexed certHash, uint256 roles, uint64 version
    );
    /// @notice An identity's capability bitmask was replaced.
    /// @param account The identity whose roles changed.
    /// @param previousRoles The mask before the change.
    /// @param newRoles The mask now in force.
    event IdentityRolesChanged(address indexed account, uint256 previousRoles, uint256 newRoles);
    /// @notice An account's hash-based signing key for one chain was recorded or rotated.
    /// @param account The identity that holds the key.
    /// @param signerId The fingerprint an execution chain's roster names.
    /// @param chainId The chain the key is armed for.
    /// @param keyId The LMS key identifier.
    /// @param height The Merkle tree height.
    /// @param root The LMS public key.
    /// @param version The lineage counter for this account and chain.
    event LmsKeyRegistered(
        address indexed account,
        bytes32 indexed signerId,
        uint64 indexed chainId,
        bytes16 keyId,
        uint8 height,
        bytes32 root,
        uint64 version
    );
    /// @notice An identity was retired. Irreversible, and its roles are cleared in the same transaction.
    /// @param account The identity that was revoked.
    /// @param certHash The certificate it held at the time.
    event IdentityRevoked(address indexed account, bytes32 indexed certHash);
    /// @notice One revocation-lane entry.
    /// @param certHash The certificate that was revoked.
    /// @param revoker Zero for a root-plane revocation, the issuing identity for an issuer's own.
    event CertificateRevoked(bytes32 indexed certHash, address indexed revoker);
    /// @notice The bootstrap window closed. After this there is no single-caller write path left.
    /// @param sealedBy The bootstrap admin that closed it, immediately before being cleared.
    event BootstrapSealed(address indexed sealedBy);
    /// @notice The one-shot state-plane wiring landed. Emitted at most once in this contract's lifetime.
    /// @param stateTrees The state-trees contract that owns the identity tree.
    /// @param revocationLog The append-only log of retired signer fingerprints.
    event StatePlaneWired(address stateTrees, address revocationLog);
    /// @notice The number of sealed registrar approvals a membership mutation needs was set.
    /// @param threshold The new threshold.
    event RegistrarThresholdSet(uint256 threshold);
    /// @notice A registrar quorum authorized an action.
    /// @param verifyingContract The contract the approvals were collected for, and whose counter was burned.
    /// @param actionDomain The action domain the approvals bound.
    /// @param nonce The counter value the approvals were made over; the next action needs the next one.
    /// @param valid How many approvals verified.
    event RegistrarQuorumApproved(
        address indexed verifyingContract, bytes32 indexed actionDomain, uint64 nonce, uint256 valid
    );

    // -------------------------------------------------------------- errors

    /// @notice The caller holds none of the authority the entry point requires.
    /// @param caller The address that called.
    error NotAuthorized(address caller);
    /// @notice The bootstrap window is already closed. Closing it is irreversible.
    error BootstrapAlreadySealed();
    /// @notice No record claims this account, or a zero address was offered as one.
    /// @param account The address that was named.
    error UnknownAccount(address account);
    /// @notice A certificate's encapsulation key failed the chain's own well-formedness check.
    /// @dev Names the algorithm, because the pair is stored together and "one of these two" is not an
    ///      actionable answer.
    /// @param account The account being registered.
    /// @param algorithmId The algorithm whose key was malformed.
    error MalformedEncapsulationKey(address account, uint16 algorithmId);
    /// @notice The certificate is already bound to a different account. One certificate identifies exactly
    ///         one party.
    /// @param certHash The certificate's handle.
    /// @param boundTo The account that already holds it.
    error CertificateAlreadyBound(bytes32 certHash, address boundTo);
    /// @notice The certificate has been revoked, or the account's own certificate has. Revocation is never
    ///         undone, so this is terminal for that handle.
    /// @param certHash The revoked certificate's handle.
    error CertificateIsRevoked(bytes32 certHash);
    /// @notice A registration or rotation did not advance the record's version. Monotonicity is what stops a
    ///         replayed transaction reinstating credentials their holder has moved off.
    /// @param current The version on record.
    /// @param offered The version the caller presented.
    error VersionNotNewer(uint64 current, uint64 offered);
    /// @notice The named account does not carry `ROLE_CERTIFICATE_AUTHORITY`, or does not currently stand.
    /// @param issuer The account that was named.
    error IssuerNotACertificateAuthority(address issuer);
    /// @notice The named parent has reached its own delegation bound and may issue nothing further.
    /// @param issuer The parent account.
    /// @param depth The parent's depth.
    /// @param maxDelegationDepth The deepest level the parent may issue to.
    error IssuerMayNotSign(address issuer, uint8 depth, uint8 maxDelegationDepth);
    /// @notice A certificate sits at a depth its lineage does not put it at. Levels cannot be skipped,
    ///         because skipping one is how an issuer escapes its own delegation bound.
    /// @param got The depth the certificate declares.
    /// @param want The depth its lineage requires.
    error WrongDepth(uint8 got, uint8 want);
    /// @notice A child certificate claims a deeper delegation bound than the parent that admits it.
    /// @param child The child's `maxDelegationDepth`.
    /// @param issuer The parent's `maxDelegationDepth`.
    error DelegationWidened(uint8 child, uint8 issuer);
    /// @notice The certificate names an authority key that is not its declared parent's subject key.
    /// @param got The authority key identifier the certificate carries.
    /// @param want The parent's subject key identifier.
    error AuthorityKeyIdMismatch(bytes32 got, bytes32 want);
    /// @notice The live and recovery certificates carry different serials, so they describe two different
    ///         certificate sets rather than two stages of one.
    /// @param liveSerial The live certificate's serial.
    /// @param recoverySerial The recovery certificate's serial.
    error StagesDisagree(bytes32 liveSerial, bytes32 recoverySerial);
    /// @notice An LMS tree height outside 1 through 24, the range the verifier admits.
    /// @param height The height offered.
    error LmsHeightOutOfRange(uint8 height);
    /// @notice A zero LMS root commits to no tree and is refused.
    error LmsRootIsZero();
    /// @notice This signer fingerprint already belongs to a different account.
    /// @param signerId The fingerprint offered.
    /// @param boundTo The account that already holds it.
    error LmsKeyAlreadyBound(bytes32 signerId, address boundTo);
    /// @notice Two identities cannot share a transaction key: the sender it derives would be attributable to
    ///         both.
    /// @param sender The derived sender address.
    /// @param boundTo The account that already claims it.
    error SenderAlreadyBound(address sender, address boundTo);
    /// @notice Fewer registrars able to seal than the threshold asks for.
    /// @param sealable How many standing registrars hold a seal key.
    /// @param threshold How many approvals a membership mutation needs.
    error RegistrarThresholdUnreachable(uint256 sealable, uint256 threshold);
    /// @notice A zero registrar threshold was offered, or a quorum was demanded before one was set. A zero
    ///         threshold is a registry with no authority behind its membership.
    error RegistrarThresholdIsZero();
    /// @notice {wireStatePlane} has already run. Both pointers are trust topology and are written once.
    error StatePlaneAlreadyWired();
    /// @notice {wireStatePlane} was handed a zero address for the trees or for the revocation log.
    error ZeroStatePlane();
    /// @notice The holder's proof of possession did not verify: one family failed, or the digest was built
    ///         over the wrong nonce.
    /// @param account The account the admission was for.
    error AdmissionProofInvalid(address account);
    /// @notice The certificate does not name the chain's authority key, so it is not chain-attested.
    /// @param authorityKeyId The authority key identifier that was presented.
    error NotChainAttested(bytes32 authorityKeyId);
    /// @notice The certificate's issuer name is not the chain's own.
    /// @param issuerDnHash The digest of the name that was presented.
    error WrongIssuerDn(bytes32 issuerDnHash);
    /// @notice A chain-attested end entity sits at depth 1 with `maxDelegationDepth == depth`; anything else
    ///         is not an end entity.
    /// @param depth The certificate's position on the delegation axis.
    /// @param maxDelegationDepth The deepest level it may issue to.
    error NotAnEndEntity(uint8 depth, uint8 maxDelegationDepth);
    /// @notice An issuer that cannot sign is an end entity wearing an issuer profile, and belongs in
    ///         {registerWallet}.
    /// @param depth The certificate's position on the delegation axis.
    /// @param maxDelegationDepth The deepest level it may issue to.
    error IssuerCannotSign(uint8 depth, uint8 maxDelegationDepth);
    /// @notice A registered issuer's certificate never expires.
    /// @dev Expiry is the passive half of an issuer's lifecycle, so a zero `NotAfter` is refused here even
    ///      though the certificate schema allows one for an end entity.
    error IssuerMustExpire();
    /// @notice An issuer validity window past {MAX_ISSUER_VALIDITY_MS}.
    /// @param notBefore The certificate's start, in this chain's milliseconds.
    /// @param notAfter The certificate's end, in this chain's milliseconds.
    error IssuerValidityTooLong(uint64 notBefore, uint64 notAfter);
    /// @notice An institution registration whose subject name carries no ISO 3166 country component, or
    ///         whose institution extension is too short to hold one.
    /// @dev Only the trust root is jurisdiction-silent; a registered institution names where it answers for
    ///      itself.
    error JurisdictionMissing();
    /// @notice The subject name's country and the institution extension's `jurisdiction` field disagree, or
    ///         the extension's jurisdiction is not a two-byte country code.
    error JurisdictionMismatch();

    // --------------------------------------------------------- constructor

    /**
     * @notice Deploy the registry with a bootstrap registrar in place.
     * @dev The precompile probe is the point of the constructor. This contract is meaningless on a chain
     *      that cannot verify post-quantum signatures, and deploying it there would produce a registry full
     *      of keys nothing on that chain can check — so it refuses to exist where the precompiles are
     *      absent rather than existing and being trusted.
     *
     *      The admin is the whole authority until {sealBootstrap} runs, because every roster has to be
     *      installed by someone before it can install itself.
     * @param admin The bootstrap registrar. Genesis names the chain deployer.
     */
    constructor(address admin) {
        FinalChainPrecompiles.assertAvailable();
        _setUp(admin);
    }

    /**
     * @notice The constructor's storage write, for a registry behind `FinalChainProxy` — whose upgrade
     *         authority is this registry itself: the proxy is built with its own address as `registry`.
     *         Runs once, in the proxy's constructor; `AlreadyInitialized` afterwards and on a direct deploy.
     * @param admin The bootstrap registrar.
     */
    function initialize(address admin) external {
        _setUp(admin);
    }

    /// @dev The bootstrap admin is storage (cleared by {sealBootstrap}), so a proxy needs it replayed.
    function _setUp(address admin) internal initializer {
        bootstrapAdmin = admin;
    }

    // ----------------------------------------------------------- authority

    /**
     * @notice The authority gate on every membership mutation this registry performs.
     * @dev Bootstrap is a real window, not a formality: every roster in this system has to be installed by
     *      someone before it can install itself, and a design that pretends otherwise ends up with a roster
     *      that cannot be brought into existence at all. It is closed by {sealBootstrap}, irreversibly.
     *
     *      While the window is open the admin writes alone. Once it is closed there is no single-caller path
     *      left — not for a registrar, not for anyone — and every mutation goes through the sealed registrar
     *      quorum, whose approvals carry both signature families.
     * @param actionDomain One of the `DOMAIN_*` constants naming the mutation.
     * @param payloadDigest The mutation's own arguments, folded.
     * @param anchorBlock The block the registrars read the roster at. Ignored while bootstrap is open.
     * @param approvals The sealed registrar quorum. Empty while bootstrap is open.
     */
    function _requireMembershipAuthority(
        bytes32 actionDomain,
        bytes32 payloadDigest,
        uint64 anchorBlock,
        FinalPqQuorum.Approval[] calldata approvals
    ) private {
        if (!bootstrapSealed && msg.sender == bootstrapAdmin) return;
        _requireRegistrarQuorum(address(this), actionDomain, payloadDigest, anchorBlock, approvals);
    }

    /**
     * @notice The sealed registrar quorum, for the other contracts in the state plane.
     * @dev `msg.sender` — the calling contract — is the verifying contract the digest binds and the counter
     *      it burns, so an approval collected for one contract's configuration cannot be spent on another's.
     *      The caller decides its own bootstrap exemption before calling; this function knows no caller's
     *      admin and applies none.
     *
     *      Anyone may SUBMIT such a transaction. Authority is the approvals, not the sender, which is the
     *      whole point of a quorum.
     * @param actionDomain The caller's own action domain for the change being authorised.
     * @param payloadDigest The change's arguments, folded by the caller.
     * @param anchorBlock The block the registrars read the roster at.
     * @param approvals The registrar approvals, each carrying both families.
     */
    function requireRegistrarQuorum(
        bytes32 actionDomain,
        bytes32 payloadDigest,
        uint64 anchorBlock,
        FinalPqQuorum.Approval[] calldata approvals
    ) external {
        _requireRegistrarQuorum(msg.sender, actionDomain, payloadDigest, anchorBlock, approvals);
    }

    /// @notice Burn one gate nonce and require a sealed registrar quorum over the action.
    /// @dev The digest is `FinalPqQuorum.digest(verifyingContract, actionDomain, anchorBlock,
    ///      keccak256(abi.encode(nonce, payloadDigest)))`. The counter is burned BEFORE verification, so an
    ///      approval set is spent whether or not it turns out to be sufficient.
    ///
    ///      The seal is required rather than optional: membership is the hybrid class, and an approval
    ///      carrying only the lattice vote is not an approval here.
    /// @param verifyingContract The contract the approvals are for, and whose counter is burned.
    /// @param actionDomain One of the `DOMAIN_*` constants, so an approval to grant cannot be replayed to
    ///        revoke.
    /// @param payloadDigest The action's own arguments, folded.
    /// @param anchorBlock The block the registrars read the roster at.
    /// @param approvals The registrar approvals, each carrying both families.
    function _requireRegistrarQuorum(
        address verifyingContract,
        bytes32 actionDomain,
        bytes32 payloadDigest,
        uint64 anchorBlock,
        FinalPqQuorum.Approval[] calldata approvals
    ) private {
        if (registrarThreshold == 0) revert RegistrarThresholdIsZero();
        uint64 nonce = _gateNonce[verifyingContract];
        _gateNonce[verifyingContract] = nonce + 1;
        bytes32 quorumDigest = FinalPqQuorum.digest(
            verifyingContract, actionDomain, anchorBlock, keccak256(abi.encode(nonce, payloadDigest))
        );
        uint256 valid = FinalPqQuorum.require_(
            this,
            approvals,
            quorumDigest,
            ROLE_REGISTRAR,
            registrarThreshold,
            FinalPqQuorum.ALG_ML_DSA_87,
            anchorBlock,
            true
        );
        emit RegistrarQuorumApproved(verifyingContract, actionDomain, nonce, valid);
    }

    /**
     * @notice Set how many sealed registrar approvals a membership mutation needs.
     * @dev The bootstrap admin while the window is open; the current registrar quorum afterwards, so a
     *      registrar set that grows or shrinks can move the threshold to match itself.
     *
     *      Refuses a threshold the sealable registrars cannot meet, and refuses zero. Both are a registry
     *      that can never be written to again, and the way that presents is every membership mutation
     *      reverting forever with nothing naming the threshold as the cause.
     * @param threshold How many sealed approvals a mutation needs. Must be reachable and non-zero.
     * @param anchorBlock The block the registrars read the roster at. Ignored while bootstrap is open.
     * @param approvals The sealed registrar quorum. Empty while bootstrap is open.
     */
    function setRegistrarThreshold(
        uint256 threshold,
        uint64 anchorBlock,
        FinalPqQuorum.Approval[] calldata approvals
    ) external {
        _requireMembershipAuthority(
            DOMAIN_SET_REGISTRAR_THRESHOLD, keccak256(abi.encode(threshold)), anchorBlock, approvals
        );
        if (threshold == 0) revert RegistrarThresholdIsZero();
        uint256 sealable = sealableMemberCount(ROLE_REGISTRAR);
        if (sealable < threshold) revert RegistrarThresholdUnreachable(sealable, threshold);
        registrarThreshold = threshold;
        emit RegistrarThresholdSet(threshold);
    }

    /// @notice The replay counter the next registrar approval for `caller` must be made over.
    /// @dev One counter per verifying contract, so an approval collected for one contract's configuration
    ///      cannot be spent on another's. A caller reads this to build the digest its registrars will sign.
    /// @param caller The verifying contract the approvals will name — this registry for its own mutations.
    /// @return The value the next approval must bind.
    function gateNonceOf(address caller) external view returns (uint64) {
        return _gateNonce[caller];
    }

    // -------------------------------------------------------- LMS signers

    /**
     * @notice The roster identity of an LMS public key.
     * @dev Byte-identical to `FinalRootAuthority.signerId` on the execution chains. Restated rather than
     *      imported because the two live on different chains and no import would make them one value —
     *      which is precisely why a test pins them together. A drift here would make every lookup miss while
     *      looking perfectly well-formed.
     *
     *      The height is bound into the fingerprint as well as the root, because a leaf commits to a node
     *      number derived from it, so a signer free to vary the height could vary the numbering.
     * @param keyId The LMS key identifier.
     * @param height The Merkle tree height.
     * @param root The LMS public key.
     * @return The fingerprint an execution chain's roster names.
     */
    function lmsSignerId(bytes16 keyId, uint8 height, bytes32 root) public pure returns (bytes32) {
        return keccak256(abi.encode(keyId, height, root));
    }

    /**
     * @notice Record the hash-based (LMS) signing key an already-registered account holds for one chain.
     * @dev Membership-gated, like every other write here.
     *
     *      Deliberately NOT a certificate: an LMS key is a capability of an existing identity, not an
     *      identity of its own. Binding it to an account means it inherits that account's revocation, so
     *      retiring a compromised operator is one action rather than one action per key they hold.
     *
     *      A rotation records the SUPERSEDED fingerprint into the revocation log in the same transaction, so
     *      the execution chains' suspension lane never depends on someone noticing. The superseded
     *      fingerprint is left BOUND to this account rather than cleared, because attribution is history.
     *
     *      A zero `chainId` is a tooling mistake rather than an attack — the slot it occupies is
     *      self-consistent and no authority consults it — so the publisher refuses it off chain and this
     *      contract spends no bytecode on the check.
     * @param account Must already be registered and not revoked.
     * @param chainId The execution chain this key is armed for.
     * @param keyId The LMS key identifier, hashed into every step of a signature under it.
     * @param height The Merkle tree height, 1 through 24.
     * @param root The LMS public key. Zero commits to no tree and is refused.
     * @param version Strictly increasing per account and chain. A rotation that does not advance it is
     *        refused, so a replayed registration cannot reinstate a key the operator has moved off.
     * @param anchorBlock The block the registrars read the roster at. Ignored while bootstrap is open.
     * @param approvals The sealed registrar quorum. Empty while bootstrap is open.
     */
    function registerLmsKey(
        address account,
        uint64 chainId,
        bytes16 keyId,
        uint8 height,
        bytes32 root,
        uint64 version,
        uint64 anchorBlock,
        FinalPqQuorum.Approval[] calldata approvals
    ) external {
        _requireMembershipAuthority(
            DOMAIN_REGISTER_LMS_KEY,
            keccak256(abi.encode(account, chainId, keyId, height, root, version)),
            anchorBlock,
            approvals
        );
        Identity storage id = _identity[account];
        if (!id.registered) revert UnknownAccount(account);
        if (id.revoked) revert CertificateIsRevoked(id.certHash);
        // A zero chain id is a tooling mistake, not an attack: the slot it
        // would occupy is self-consistent and no authority consults it. The
        // publisher refuses it; EIP-170 pressure keeps the check off-chain.
        if (height == 0 || height > 24) revert LmsHeightOutOfRange(height);
        if (root == bytes32(0)) revert LmsRootIsZero();

        // Version lineage is PER account and chain: the same operator is a different signer on every chain,
        // so one chain starting at version 1 says nothing about another already being at version 3.
        LmsKey storage existing = _lmsKey[account][chainId];
        // An empty slot holds version 0, so this alone also refuses a version-0
        // registration — versions start at 1.
        if (version <= existing.version) {
            revert VersionNotNewer(existing.version, version);
        }

        bytes32 signerId = lmsSignerId(keyId, height, root);
        address boundTo = _lmsBinding[signerId].account;
        if (boundTo != address(0) && boundTo != account) {
            revert LmsKeyAlreadyBound(signerId, boundTo);
        }

        // The fingerprint being superseded, captured before the slot moves —
        // `existing` is a storage pointer and reads the NEW key afterwards.
        bytes32 superseded = existing.registered
            ? lmsSignerId(existing.keyId, existing.height, existing.root)
            : bytes32(0);

        // The superseded fingerprint is left bound to this account rather than
        // cleared. It is history: a signature made under the old key was made
        // by this operator, and a lookup that stopped resolving would make that
        // unprovable after the fact.
        _lmsKey[account][chainId] = LmsKey(keyId, height, root, version, true);
        _lmsBinding[signerId] = LmsBinding(account, chainId);
        emit LmsKeyRegistered(account, signerId, chainId, keyId, height, root, version);

        // Supersession is a PERMANENT transition — the old fingerprint stops
        // being this slot's current key and nothing re-registers it (a
        // re-registration of the same material is the same fingerprint, which
        // the guard below leaves alone). Recorded same-tx so the execution
        // chains' suspension lane never depends on someone noticing.
        if (superseded != bytes32(0) && superseded != signerId) {
            _recordRevokedSigner(superseded);
        }
        _projectIdentity(account);
    }

    /// @notice The LMS key an account holds for one chain, if any.
    /// @dev Keyed per account AND per chain, because a single-use hash-based counter is only complete while
    ///      the key it names signs for one chain. `registered` is the field to branch on; the zero struct
    ///      means no key rather than a key of zeroes.
    /// @param account The identity to read.
    /// @param chainId The chain the key is armed for.
    /// @return The stored key, copied to memory.
    function lmsKeyOf(address account, uint64 chainId) external view returns (LmsKey memory) {
        return _lmsKey[account][chainId];
    }

    /// @notice What a fingerprint is bound to: the account that registered it and the chain it signs for.
    /// @dev The binding survives supersession, because attribution is history: a signature made under a
    ///      retired key was still made by that operator, and a lookup that stopped resolving would make that
    ///      unprovable after the fact. Standing is a separate question, answered by {lmsSignerIsLive}.
    ///
    ///      The revocation log's permanence gate reads this to find the slot a fingerprint belongs to; that
    ///      slot's current key is what separates a superseded fingerprint, which is permanent and
    ///      recordable, from a merely lapsed one, which renewal undoes.
    /// @param signerId The fingerprint to resolve.
    /// @return account The account that registered it, or zero for a fingerprint never registered.
    /// @return chainId The chain that registration was for, or zero alongside a zero account.
    function lmsBindingOf(bytes32 signerId) external view returns (address account, uint64 chainId) {
        LmsBinding storage binding = _lmsBinding[signerId];
        return (binding.account, binding.chainId);
    }

    /**
     * @notice Whether a signer fingerprint is held by a standing, unrevoked account.
     * @dev The question a verifier actually has. An execution chain's authority roster names fingerprints
     *      and learns nothing else about them, so without this the keys behind those names are
     *      unanswerable from the state plane.
     *
     *      Standing is asked through {isActive} rather than by spelling the conditions out again, because a
     *      second spelling is how two answers drift: an expired identity already holds no role, and a signer
     *      lookup that disagreed would leave a roster satisfiable by an operator the rest of the registry
     *      has stopped honouring.
     *
     *      Live means the CURRENT key of the fingerprint's own account-and-chain slot, not merely one this
     *      account ever held. A superseded fingerprint stays attributable but stops being live, and a
     *      rotation on one chain says nothing about the same operator's key on another.
     * @param signerId The fingerprint an authority roster names.
     * @return live Whether the fingerprint is that slot's current key and the account still stands.
     * @return account The account the fingerprint is bound to, or zero when none ever registered it.
     */
    function lmsSignerIsLive(bytes32 signerId) external view returns (bool live, address account) {
        LmsBinding storage binding = _lmsBinding[signerId];
        account = binding.account;
        if (account == address(0)) return (false, address(0));
        // `isActive`, not a registered/revoked pair spelled out here. The
        // certificate validity window is part of standing: an expired identity
        // already holds no role, and a signer lookup that disagreed would leave
        // a roster satisfiable by an operator the rest of the registry has
        // stopped honouring. Spelling the condition out a second time is how
        // the two drift apart.
        if (!isActive(account)) return (false, account);
        // The CURRENT key of the fingerprint's own (account, chain) slot, not
        // merely one this account ever held: a superseded fingerprint stays
        // attributable but stops being live, and a rotation on one chain says
        // nothing about the same operator's key on another.
        LmsKey storage k = _lmsKey[account][binding.chainId];
        live = k.registered && lmsSignerId(k.keyId, k.height, k.root) == signerId;
    }

    /// @notice Close the bootstrap window. Irreversible.
    /// @dev Refuses while the registrar quorum is unset or unreachable, because sealing then would leave a
    ///      registry nobody can ever write to again — including to fix the threshold that locked it. The
    ///      count is of registrars that can SEAL: a certificate authority carrying the registrar role is
    ///      registered from a certificate with no seal slot and can never contribute an approval, so
    ///      counting role bits alone would seal onto a quorum that looks reachable and is not.
    ///
    ///      Clears the admin as well as setting the flag, so no single-caller path survives the seal.
    function sealBootstrap() external {
        if (msg.sender != bootstrapAdmin) revert NotAuthorized(msg.sender);
        if (bootstrapSealed) revert BootstrapAlreadySealed();
        if (registrarThreshold == 0) revert RegistrarThresholdIsZero();
        uint256 sealable = sealableMemberCount(ROLE_REGISTRAR);
        if (sealable < registrarThreshold) {
            revert RegistrarThresholdUnreachable(sealable, registrarThreshold);
        }
        bootstrapSealed = true;
        bootstrapAdmin = address(0);
        emit BootstrapSealed(msg.sender);
    }

    // ------------------------------------------------- state-plane wiring

    /**
     * @notice Wire the state trees and the revocation log, once, inside the bootstrap window.
     * @dev One-shot because both pointers are TRUST TOPOLOGY: the trees pointer decides where the
     *      wallet-creation admission set is written, and the log pointer decides where permanent standing
     *      losses are recorded. A re-wireable pointer would be a key over both.
     *
     *      It cannot be a constructor argument, because both of those contracts take THIS registry as one of
     *      theirs. The deploy tooling calls it in the same nonce-fixed block that deploys them, before any
     *      identity is registered, which is why the projection is silently skipped while the pointers are
     *      zero rather than reverting.
     * @param stateTrees_ The state-trees contract that owns tree 8. Zero is refused.
     * @param revocationLog_ The append-only log of retired signer fingerprints. Zero is refused.
     */
    function wireStatePlane(address stateTrees_, address revocationLog_) external {
        if (bootstrapSealed || msg.sender != bootstrapAdmin) revert NotAuthorized(msg.sender);
        if (stateTrees != address(0) || revocationLog != address(0)) revert StatePlaneAlreadyWired();
        if (stateTrees_ == address(0) || revocationLog_ == address(0)) revert ZeroStatePlane();
        stateTrees = stateTrees_;
        revocationLog = revocationLog_;
        emit StatePlaneWired(stateTrees_, revocationLog_);
    }

    /// @notice Refresh `account`'s tree-8 leaf in the state trees, same transaction.
    /// @dev Skipped while the plane is unwired, which is a bootstrap-window state the deploy tooling closes
    ///      before the first registration, and never otherwise. The leaf VALUE is derived by the trees
    ///      contract from this registry's post-mutation state, so there is nothing here to get wrong beyond
    ///      forgetting to call it — which is why every mutation calls it, including the one that cannot
    ///      change the leaf.
    /// @param account The identity whose leaf is stale.
    function _projectIdentity(address account) private {
        address trees = stateTrees;
        if (trees == address(0)) return;
        address[] memory one = new address[](1);
        one[0] = account;
        IIdentityLeafSink(trees).syncIdentityLeaves(one);
    }

    /// @notice Record a permanently retired signer fingerprint into the revocation log, same transaction.
    /// @dev Skipped while the log is unwired, and skipped when somebody already recorded the fingerprint
    ///      through the log's permissionless door — the log refuses a duplicate, and a membership mutation
    ///      must not be revertible by a stranger who front-ran its bookkeeping.
    /// @param signerId The fingerprint that has lost standing for good.
    function _recordRevokedSigner(bytes32 signerId) private {
        address log = revocationLog;
        if (log == address(0)) return;
        if (IRevocationRecorder(log).recorded(signerId)) return;
        IRevocationRecorder(log).record(signerId);
    }

    // -------------------------------------------------------- registration

    /**
     * @title Admission Proof
     * @notice The holder's proof of possession at admission: both live-stage families over the admission
     *         digest.
     * @dev There is no root keypair and no issuer signature on this path. The chain admits, and the two
     *      signatures presented at creation are the HOLDER's, verified by the precompiles inside the same
     *      transaction that writes the record. Possession lives in the TRANSACTION, never in the artifact:
     *      a public certificate is a document anyone may hold, so presenting one proves nothing.
     */
    struct AdmissionProof {
        /// The holder's ML-DSA-87 signature under the live TRANSACTION key, over the admission digest.
        bytes mlDsaSignature;
        /// The holder's SLH-DSA-SHAKE-256s signature under the live ACCESS key, over the same digest. Two
        /// families over one message, so neither a lattice break nor a hash-function break alone admits an
        /// identity.
        bytes slhDsaSignature;
    }

    /**
     * @notice Register or rotate a Final Wallet identity from its two public certificates.
     * @dev **Both stages, together.** A wallet has four keys in two stages and the recovery pair is
     *      PRE-COMMITTED — written at wallet initialization from the same certificate set that determined
     *      the wallet's address, which is why enabling post-quantum mode later takes no key arguments. The
     *      two certificates must share a serial: a serial is per certificate SET, so two stages that
     *      disagree about it are two different wallets.
     *
     *      **Chain-attested means pinned, per stage:** the chain's issuer name and authority key, depth
     *      exactly 1 so the certificate hangs directly under the chain, and `maxDelegationDepth == depth` so
     *      the holder issues nothing. That immutable pair is what {identityTreeLeafOf} discriminates record
     *      kinds by.
     *
     *      Issuance authority is the registrar quorum and possession is the holder's own proof; there is no
     *      root keypair anywhere and no certificate-authority signature over this admission.
     * @param account The wallet address the certificate set derives.
     * @param liveTbs The live certificate's TBS bytes: the live transaction and access keys.
     * @param recoveryTbs The recovery certificate's TBS bytes: the pre-committed recovery pair.
     * @param proof The holder's two signatures over the admission digest — the live transaction key
     *        (ML-DSA-87) and the live access key (SLH-DSA-SHAKE-256s), both verified in the precompiles
     *        inside this transaction.
     * @param roles Capability bitmask. The one thing the certificates do not say, because capability is this
     *        system's decision rather than the certificate's.
     * @param version Monotonic. A rotation that does not advance it is refused.
     * @param anchorBlock The block the registrars read the roster at. Ignored while bootstrap is open.
     * @param approvals The sealed registrar quorum. Empty while bootstrap is open. The digest binds the
     *        account, both certificates' bytes, the roles and the version.
     * @return certHash The handle the live certificate is now known by.
     */
    function registerWallet(
        address account,
        bytes calldata liveTbs,
        bytes calldata recoveryTbs,
        AdmissionProof calldata proof,
        uint256 roles,
        uint64 version,
        uint64 anchorBlock,
        FinalPqQuorum.Approval[] calldata approvals
    ) external returns (bytes32 certHash) {
        // Read BEFORE the authority check: the quorum path burns this counter
        // inside `_requireRegistrarQuorum`, and the proof must bind the value
        // the round was built over. The bootstrap path burns it explicitly in
        // `_requireAdmissionProof`, so an admission is one-shot in both regimes.
        uint64 admissionNonce = _gateNonce[address(this)];
        _requireMembershipAuthority(
            DOMAIN_REGISTER_WALLET,
            keccak256(
                abi.encode(account, keccak256(liveTbs), keccak256(recoveryTbs), roles, version)
            ),
            anchorBlock,
            approvals
        );

        FinalCertificate.Parsed memory l = FinalCertificate.parseLive(liveTbs);
        FinalCertificate.Parsed memory r = FinalCertificate.parseRecovery(recoveryTbs);
        if (l.serial != r.serial) revert StagesDisagree(l.serial, r.serial);

        _requireChainAttestedEndEntity(l);
        _requireChainAttestedEndEntity(r);
        _requireAdmissionProof(account, l, r.certHash, proof, admissionNonce);

        certHash = l.certHash;
        _write(account, l, r, roles, version, false);
    }

    /**
     * @notice Register or rotate an ISSUER: a third party, or one of this system's own intermediates, that
     *         signs certificates off chain with the keys registered here.
     * @dev Admission is chain-native like any identity — the registrar quorum authorises, and the holder's
     *      own proof of possession establishes that the party controls the keys it is claiming. The
     *      delegation rules survive as LINEAGE: a nested issuer's depth, delegation bound and
     *      `AuthorityKeyId` must chain to its registered parent. No parent signs anything; this chain's
     *      admission IS the issuance.
     *
     *      A registered issuer always expires, and its window is bounded by {MAX_ISSUER_VALIDITY_MS}.
     *
     *      An institution must carry its real ISO 3166 country in its subject name, matching the
     *      `jurisdiction` field of its institution extension. That is enforced at the door because a
     *      verifier's legal recourse starts with knowing where an issuer answers for itself.
     *
     *      `ROLE_CERTIFICATE_AUTHORITY` is added to whatever `roles` asks for, rather than being required in
     *      it: the capability is what this entry point means, so it cannot be forgotten in an argument.
     * @param account The issuer's account on this chain.
     * @param tbs The issuer certificate's TBS bytes: two cert-signing keys, ML-DSA-87 and
     *        SLH-DSA-SHAKE-256s, and no recovery stage — renewing an issuer is re-issuing, a governance act
     *        rather than a key rotation.
     * @param parent The registered parent issuer for a nested intermediate; zero for an issuer hanging
     *        directly under the chain.
     * @param proof The issuer's own two cert-signing keys over the admission digest. The recovery-handle
     *        slot in that digest is zero, because there is no recovery stage to bind.
     * @param roles Capability bitmask, over and above the certificate-authority bit this call adds.
     * @param version Monotonic. A rotation that does not advance it is refused.
     * @param anchorBlock The block the registrars read the roster at. Ignored while bootstrap is open.
     * @param approvals The sealed registrar quorum. Empty while bootstrap is open. The digest binds the
     *        account, the certificate bytes, the parent, the roles and the version.
     * @return certHash The handle the registered certificate is now known by.
     */
    function registerIssuer(
        address account,
        bytes calldata tbs,
        address parent,
        AdmissionProof calldata proof,
        uint256 roles,
        uint64 version,
        uint64 anchorBlock,
        FinalPqQuorum.Approval[] calldata approvals
    ) external returns (bytes32 certHash) {
        uint64 admissionNonce = _gateNonce[address(this)];
        _requireMembershipAuthority(
            DOMAIN_REGISTER_ISSUER,
            keccak256(abi.encode(account, keccak256(tbs), parent, roles, version)),
            anchorBlock,
            approvals
        );

        FinalCertificate.Parsed memory c = FinalCertificate.parseCa(tbs);
        // An issuer that cannot sign is an end entity wearing a profile —
        // and an end entity belongs in `registerWallet`.
        if (c.depth == 0 || c.maxDelegationDepth <= c.depth) {
            revert IssuerCannotSign(c.depth, c.maxDelegationDepth);
        }
        if (c.notAfter == 0) revert IssuerMustExpire();
        if (c.notAfter - c.notBefore > MAX_ISSUER_VALIDITY_MS) {
            revert IssuerValidityTooLong(c.notBefore, c.notAfter);
        }
        if (c.issuerDnHash != CHAIN_ISSUER_DN_HASH) revert WrongIssuerDn(c.issuerDnHash);
        _requireLineage(parent, c);
        _requireJurisdiction(c);
        _requireAdmissionProof(account, c, bytes32(0), proof, admissionNonce);

        certHash = c.certHash;
        _write(account, c, c, roles | ROLE_CERTIFICATE_AUTHORITY, version, true);
    }

    /// @notice The validity ceiling a registered issuer's certificate may not exceed, in this chain's
    ///         milliseconds: two 366-day years.
    /// @dev Expiry is the passive half of an issuer's lifecycle — the touchpoint that proves an issuer is
    ///      still there without anyone having to act — so a registered issuer always carries a real
    ///      `NotAfter` and a bounded window. Renewal re-issues under the same registered keys with a version
    ///      bump rather than extending a certificate in place.
    uint64 public constant MAX_ISSUER_VALIDITY_MS = 2 * 366 days * 1000;

    /// @notice Pin one stage of a chain-attested end-entity certificate.
    /// @dev Three checks, run once per stage: the certificate names the chain's authority key, it carries the
    ///      chain's issuer name, and its depth pair is exactly that of an end entity — depth 1, directly
    ///      under the chain, issuing nothing. The depth pair is immutable per version, which is why
    ///      {identityTreeLeafOf} discriminates record kinds by it rather than by a role bit.
    /// @param c The parsed certificate stage.
    function _requireChainAttestedEndEntity(FinalCertificate.Parsed memory c) private pure {
        if (c.authorityKeyId != CHAIN_AUTHORITY_KEY_ID) revert NotChainAttested(c.authorityKeyId);
        if (c.issuerDnHash != CHAIN_ISSUER_DN_HASH) revert WrongIssuerDn(c.issuerDnHash);
        if (c.depth != 1 || c.maxDelegationDepth != c.depth) {
            revert NotAnEndEntity(c.depth, c.maxDelegationDepth);
        }
    }

    /// @notice Check a nested issuer's lineage to its registered parent.
    /// @dev Delegation is governed by DEPTH, not by a boolean: a parent may sign only while
    ///      `depth < maxDelegationDepth`, a child sits exactly one level down so it cannot skip levels to
    ///      escape that bound, and its own bound may never widen past its parent's. The child's
    ///      `AuthorityKeyId` must equal the parent's `SubjectKeyId`, which is the link the chain follows.
    ///
    ///      A zero `parent` means the issuer hangs directly under the chain: it must then name the chain's
    ///      own authority key and sit at depth 1. No parent SIGNS anything here — admission by this chain is
    ///      the issuance, and lineage is what keeps the delegation bounds honest across it.
    /// @param parent The registered parent issuer, or zero for one directly under the chain.
    /// @param c The parsed issuer certificate.
    function _requireLineage(address parent, FinalCertificate.Parsed memory c) private view {
        if (parent == address(0)) {
            if (c.authorityKeyId != CHAIN_AUTHORITY_KEY_ID) {
                revert NotChainAttested(c.authorityKeyId);
            }
            if (c.depth != 1) revert WrongDepth(c.depth, 1);
            return;
        }
        Identity storage ca = _identity[parent];
        if (!hasRole(parent, ROLE_CERTIFICATE_AUTHORITY)) {
            revert IssuerNotACertificateAuthority(parent);
        }
        // Delegation is governed by depth, not by a boolean. `Depth <
        // MaxDelegationDepth` permits signing, and a child sits exactly one
        // level down — an issuer cannot skip levels to escape its own bound.
        if (ca.depth >= ca.maxDelegationDepth) {
            revert IssuerMayNotSign(parent, ca.depth, ca.maxDelegationDepth);
        }
        if (c.depth != ca.depth + 1) revert WrongDepth(c.depth, ca.depth + 1);
        if (c.maxDelegationDepth > ca.maxDelegationDepth) {
            revert DelegationWidened(c.maxDelegationDepth, ca.maxDelegationDepth);
        }
        if (c.authorityKeyId != ca.subjectKeyId) {
            revert AuthorityKeyIdMismatch(c.authorityKeyId, ca.subjectKeyId);
        }
    }

    /// @notice Refuse an issuer whose subject name carries no jurisdiction, or one that disagrees with its
    ///         institution extension.
    /// @dev An issuer that answers for itself somewhere is an issuer a verifier has recourse against, so a
    ///      registered institution must name its jurisdiction and must name it once. Only the trust root is
    ///      jurisdiction-silent, because the root is the worldwide network rather than a legal entity.
    ///
    ///      The rule is a real ISO 3166 alpha-2 `C=` component in the subject name, equal to the
    ///      `jurisdiction` field of the certificate's institution extension. The name is in canonical
    ///      comma-separated form, so `C=` matches at the start or immediately after a comma, and the
    ///      component value is exactly two bytes — a longer one is a different component that happens to
    ///      start with the same letter.
    /// @param c The parsed issuer certificate.
    function _requireJurisdiction(FinalCertificate.Parsed memory c) private pure {
        bytes memory dn = c.subjectDn;
        bytes2 country;
        bool found = false;
        for (uint256 i = 0; i + 4 <= dn.length; i++) {
            if ((i == 0 || dn[i - 1] == ",") && dn[i] == "C" && dn[i + 1] == "=") {
                // Exactly two bytes, then end-of-DN or the next component.
                if (i + 4 < dn.length && dn[i + 4] != ",") revert JurisdictionMissing();
                country = bytes2(bytes.concat(dn[i + 2], dn[i + 3]));
                found = true;
                break;
            }
        }
        if (!found) revert JurisdictionMissing();

        // Institution extension: legalNameLength ‖ legalName ‖
        // registrationNoLength ‖ registrationNo ‖ jurisdictionLength ‖
        // jurisdiction. The jurisdiction must EQUAL the DN's country.
        bytes memory ext = c.institutionExt;
        if (ext.length < 6) revert JurisdictionMissing();
        uint256 q = 2 + (uint256(uint8(ext[0])) << 8 | uint256(uint8(ext[1])));
        if (ext.length < q + 2) revert JurisdictionMissing();
        q += 2 + (uint256(uint8(ext[q])) << 8 | uint256(uint8(ext[q + 1])));
        if (ext.length < q + 2) revert JurisdictionMissing();
        uint256 jLen = uint256(uint8(ext[q])) << 8 | uint256(uint8(ext[q + 1]));
        q += 2;
        if (jLen != 2 || ext.length < q + 2) revert JurisdictionMismatch();
        if (bytes2(bytes.concat(ext[q], ext[q + 1])) != country) revert JurisdictionMismatch();
    }

    /// @notice Verify the holder's proof of possession over the admission digest.
    /// @dev Both live-stage families, in the precompiles, inside this transaction: an ML-DSA-87 signature
    ///      under the certificate's transaction key and an SLH-DSA-SHAKE-256s signature under its access
    ///      key. Possession lives in the TRANSACTION rather than in the artifact, so holding a copy of
    ///      somebody's public certificate proves nothing.
    ///
    ///      The keys come out of the certificate being admitted, not out of calldata, which is what makes
    ///      this a proof rather than a self-signed assertion.
    ///
    ///      Burns the gate nonce on the bootstrap path — the quorum path burned it already — so an admission
    ///      is one-shot in both regimes and a captured proof cannot be replayed into a second registration.
    /// @param account The account being admitted; named in the revert so a failure is attributable.
    /// @param live The parsed live-stage certificate whose keys verify the proof.
    /// @param recoveryCertHash The recovery certificate's handle, bound into the digest; zero for an issuer.
    /// @param proof The holder's two signatures.
    /// @param admissionNonce The gate-nonce value the digest was built over.
    function _requireAdmissionProof(
        address account,
        FinalCertificate.Parsed memory live,
        bytes32 recoveryCertHash,
        AdmissionProof calldata proof,
        uint64 admissionNonce
    ) private {
        bytes memory message = abi.encodePacked(
            keccak256(
                abi.encode(
                    DOMAIN_IDENTITY_ADMISSION,
                    block.chainid,
                    address(this),
                    live.certHash,
                    recoveryCertHash,
                    admissionNonce
                )
            )
        );
        if (
            !FinalChainPrecompiles.verifyMlDsa87(live.transactionKey, message, proof.mlDsaSignature)
                || !FinalChainPrecompiles.verifySlhDsa(live.accessKey, message, proof.slhDsaSignature)
        ) revert AdmissionProofInvalid(account);
        if (_gateNonce[address(this)] == admissionNonce) {
            _gateNonce[address(this)] = admissionNonce + 1;
        }
    }

    /**
     * @notice Commit one parsed certificate set to storage and project the result.
     * @dev The single write path behind both registration entry points, so a wallet record and an issuer
     *      record cannot diverge in how they are stored. Every authorization, parse and pin has already run;
     *      what is left is the ordering that keeps the record consistent with its indexes.
     *
     *      A rotation RELEASES the previous certificate's binding rather than revoking it: a superseded
     *      certificate and a compromised one are different facts, and revocation is the louder of the two.
     *      The sender binding moves with the transaction key for the same reason — a rotation is the account
     *      disowning that key, and a gate that still resolved the old sender would honour a retired key.
     *
     *      A certificate already bound to another account is refused, and so is a version that does not
     *      advance, so neither a replayed registration nor a stolen certificate can take a record over.
     * @param account The identity being written. Zero is refused.
     * @param live The parsed live-stage certificate; for an issuer, its single certificate.
     * @param recovery The parsed recovery-stage certificate; for an issuer, the same value, discarded.
     * @param roles The complete capability bitmask to store.
     * @param version Monotonic per account. Must exceed the stored value.
     * @param isCa Whether this is a certificate authority, which stores no recovery, seal or
     *        encapsulation material.
     */
    function _write(
        address account,
        FinalCertificate.Parsed memory live,
        FinalCertificate.Parsed memory recovery,
        uint256 roles,
        uint64 version,
        bool isCa
    ) private {
        if (account == address(0)) revert UnknownAccount(account);
        if (certificateRevoked[live.certHash]) revert CertificateIsRevoked(live.certHash);

        address boundTo = accountOfCertificate[live.certHash];
        if (boundTo != address(0) && boundTo != account) {
            revert CertificateAlreadyBound(live.certHash, boundTo);
        }

        Identity storage id = _identity[account];
        if (!id.registered) {
            _accounts.push(account);
            id.registered = true;
        } else {
            if (version <= id.version) revert VersionNotNewer(id.version, version);
            if (id.revoked) revert CertificateIsRevoked(id.certHash);
            // A rotation releases the previous certificate's binding. It is NOT
            // revoked — a superseded certificate and a compromised one are
            // different facts and revocation is the louder of the two.
            if (id.certHash != live.certHash) delete accountOfCertificate[id.certHash];
        }

        id.certHash = live.certHash;
        id.recoveryCertHash = recovery.certHash;
        id.serial = live.serial;
        id.subjectKeyId = live.subjectKeyId;
        id.roles = roles;
        id.depth = live.depth;
        id.maxDelegationDepth = live.maxDelegationDepth;
        id.notBefore = live.notBefore;
        id.notAfter = live.notAfter;
        id.version = version;

        // The sender binding moves with the transaction key. The old sender is
        // released rather than kept: a rotation is the account disowning that
        // key, and a gate that still resolved it would honour a retired key.
        address sender = senderFor(live.transactionKey);
        address senderBoundTo = accountOfSender[sender];
        if (senderBoundTo != address(0) && senderBoundTo != account) {
            revert SenderAlreadyBound(sender, senderBoundTo);
        }
        if (_activeTransactionKey[account].length != 0) {
            address previousSender = senderFor(_activeTransactionKey[account]);
            if (previousSender != sender) delete accountOfSender[previousSender];
        }
        accountOfSender[sender] = account;

        _activeTransactionKey[account] = live.transactionKey;
        _activeAccessKey[account] = live.accessKey;
        // A CA has no recovery pair; the two active slots are all it has.
        _recoveryTransactionKey[account] = isCa ? bytes("") : recovery.transactionKey;
        _recoveryAccessKey[account] = isCa ? bytes("") : recovery.accessKey;
        // Cleared on a rotation to a certificate without one, for the same
        // reason the encapsulation pair is: a stale seal surviving a rotation
        // would let a retired key keep co-signing execution.
        _activeSealKey[account] = isCa ? bytes("") : live.sealKey;

        // The encapsulation pair, validated before it is stored.
        //
        // **The registry is where a sender looks up "encapsulate to this
        // party", so a malformed key here is not a bad record — it is an
        // account nobody can seal an intent to.** The discovery would happen at
        // the first attempt, and on the hybrid path it would happen as a pair
        // silently reduced to one family, which is identical on the wire. The
        // precompiles make it a refusal at registration instead.
        //
        // Neither is a re-implementation of the KEM: `0x0203` runs FIPS 203
        // §7.2's own encapsulation-key check and `0x0207` runs the structural
        // check HQC-5's encoding admits. Encapsulation is a sender operation
        // and decapsulation needs the secret key, so nothing more belongs here.
        //
        // A CA is sealed to by nobody and carries no encapsulation stage, so
        // its slots are cleared rather than checked.
        _storeKemPair(account, isCa, live.kemMlKem, live.kemHqc, true);
        _storeKemPair(account, isCa, recovery.kemMlKem, recovery.kemHqc, false);

        accountOfCertificate[live.certHash] = account;

        emit IdentityRegistered(account, live.certHash, roles, version);
        // Same-tx: a registration or rotation is visible to every execution
        // chain's admission set the moment it is visible here.
        _projectIdentity(account);
    }

    /**
     * @notice Store one stage's encapsulation pair, or clear it.
     * @dev Empty is legitimate and is not the same as absent-and-wrong: a certificate authority has no
     *      encapsulation stage, and a certificate may be issued without one. The parser has already refused
     *      the half-populated case, so by here the pair is both or neither.
     *
     *      Cleared rather than left alone on a rotation to an empty pair. A stale key surviving a rotation is
     *      a sender encapsulating to a credential the account has disowned, and the message then never
     *      decrypts — the failure mode with no error attached, and the one this pairing exists to avoid.
     * @param account The identity being written.
     * @param isCa Whether the record is a certificate authority, which carries no encapsulation stage.
     * @param mlKem The stage's ML-KEM-1024 key, or empty.
     * @param hqc The stage's HQC-5 key, or empty.
     * @param isLive Whether this is the live stage; false selects the recovery slots.
     */
    function _storeKemPair(address account, bool isCa, bytes memory mlKem, bytes memory hqc, bool isLive)
        private
    {
        if (isCa || mlKem.length == 0) {
            delete (isLive ? _activeKemMlKem : _recoveryKemMlKem)[account];
            delete (isLive ? _activeKemHqc : _recoveryKemHqc)[account];
            return;
        }
        if (!FinalChainPrecompiles.isWellFormedMlKem1024(mlKem)) {
            revert MalformedEncapsulationKey(account, FinalCertificate.ALG_ML_KEM_1024);
        }
        if (!FinalChainPrecompiles.isWellFormedHqc5(hqc)) {
            revert MalformedEncapsulationKey(account, FinalCertificate.ALG_HQC_5);
        }
        if (isLive) {
            _activeKemMlKem[account] = mlKem;
            _activeKemHqc[account] = hqc;
        } else {
            _recoveryKemMlKem[account] = mlKem;
            _recoveryKemHqc[account] = hqc;
        }
    }

    /// @notice Grant or withdraw capabilities without rotating keys.
    /// @dev Separate from registration because the two have different cadences: a role changes when a
    ///      service's job changes, a key changes when it is compromised or aged out. Folding them together
    ///      would force a key rotation to express a role change, which is the more dangerous of the two
    ///      operations doing the work of the safer one.
    /// @param account Must already be registered and not revoked.
    /// @param roles The complete new capability bitmask; it replaces the old one rather than merging.
    /// @param anchorBlock The block the registrars read the roster at.
    /// @param approvals The sealed registrar quorum. Empty while bootstrap is open.
    function setRoles(
        address account,
        uint256 roles,
        uint64 anchorBlock,
        FinalPqQuorum.Approval[] calldata approvals
    ) external {
        _requireMembershipAuthority(
            DOMAIN_SET_ROLES, keccak256(abi.encode(account, roles)), anchorBlock, approvals
        );
        Identity storage id = _identity[account];
        if (!id.registered) revert UnknownAccount(account);
        if (id.revoked) revert CertificateIsRevoked(id.certHash);
        uint256 previous = id.roles;
        id.roles = roles;
        _requireRegistrarQuorumReachable();
        emit IdentityRolesChanged(account, previous, roles);
        // Roles are not in the tree-8 leaf, so this rewrites the same value —
        // kept anyway so "every identity mutation projects" has no exceptions
        // to remember.
        _projectIdentity(account);
    }

    /// @notice Refuse a mutation that would leave the registrar quorum unreachable.
    /// @dev Once bootstrap is sealed, that is the one change nothing could ever undo: a registry whose
    ///      threshold exceeds its sealable membership can never be written to again, including to fix
    ///      itself. Checked AFTER the write so the count reflects the mutation being attempted.
    function _requireRegistrarQuorumReachable() private view {
        if (!bootstrapSealed) return;
        uint256 sealable = sealableMemberCount(ROLE_REGISTRAR);
        if (sealable < registrarThreshold) {
            revert RegistrarThresholdUnreachable(sealable, registrarThreshold);
        }
    }

    /// @notice Revoke an identity and its certificate. Irreversible.
    /// @dev Clears the roles as well as setting the flag. Both are checked everywhere, but leaving a revoked
    ///      record carrying roles invites a future reader that checks only one of them. The fingerprints of
    ///      the named LMS slots are recorded into the revocation log after the flag lands, so the log's own
    ///      permanence gate sees the transition it requires.
    /// @param account The identity to retire.
    /// @param chainIds The chains whose LMS-key slots this account holds. The registrars supply the list and
    ///        the approval digest binds it, because a mapping cannot enumerate its own keys. A chain with no
    ///        slot is skipped, and a fingerprint an incomplete list missed stays permanently recordable
    ///        through the revocation log's permissionless door, since a revoked account never regains
    ///        standing.
    /// @param anchorBlock The block the registrars read the roster at.
    /// @param approvals The sealed registrar quorum. Empty while bootstrap is open.
    function revoke(
        address account,
        uint64[] calldata chainIds,
        uint64 anchorBlock,
        FinalPqQuorum.Approval[] calldata approvals
    ) external {
        _requireMembershipAuthority(
            DOMAIN_REVOKE, keccak256(abi.encode(account, chainIds)), anchorBlock, approvals
        );
        Identity storage id = _identity[account];
        if (!id.registered) revert UnknownAccount(account);
        id.revoked = true;
        id.roles = 0;
        certificateRevoked[id.certHash] = true;
        _requireRegistrarQuorumReachable();
        emit IdentityRevoked(account, id.certHash);
        // AFTER the flag lands, so the log's own gate sees the permanent
        // transition it requires.
        for (uint256 i = 0; i < chainIds.length; i++) {
            LmsKey storage k = _lmsKey[account][chainIds[i]];
            if (k.registered) _recordRevokedSigner(lmsSignerId(k.keyId, k.height, k.root));
        }
        _projectIdentity(account);
    }

    /**
     * @notice Root-plane GLOBAL certificate revocation, by `certHash`.
     * @dev The half of the revocation lane that gates registration and covers break-glass: any certificate —
     *      registered here, issued off chain, or never seen — can be killed by handle under the registrar
     *      quorum, because the handle is all a break-glass caller may have.
     *
     *      When the handle is a registered identity's CURRENT certificate the identity falls with it: flag,
     *      roles cleared, same-transaction projection. So revoking by handle is never weaker than {revoke};
     *      it only skips the LMS-slot enumeration, and those fingerprints stay permanently recordable
     *      through the revocation log's own permissionless door.
     * @param certHash The certificate to revoke. Need not correspond to any record.
     * @param anchorBlock The block the registrars read the roster at.
     * @param approvals The sealed registrar quorum. Empty while bootstrap is open.
     */
    function revokeCertificate(
        bytes32 certHash,
        uint64 anchorBlock,
        FinalPqQuorum.Approval[] calldata approvals
    ) external {
        _requireMembershipAuthority(
            DOMAIN_REVOKE_CERTIFICATE, keccak256(abi.encode(certHash)), anchorBlock, approvals
        );
        certificateRevoked[certHash] = true;
        address bound = accountOfCertificate[certHash];
        if (bound != address(0)) {
            Identity storage id = _identity[bound];
            if (!id.revoked) {
                id.revoked = true;
                id.roles = 0;
                _requireRegistrarQuorumReachable();
                emit IdentityRevoked(bound, certHash);
                _projectIdentity(bound);
            }
        }
        emit CertificateRevoked(certHash, address(0));
    }

    /**
     * @notice The issuing identity's half of the revocation lane: a registered issuer revokes a certificate
     *         it signed off chain, by `certHash`.
     * @dev This records WHO revoked, and a verifier honours the entry only when the recorded revoker is the
     *      certificate's own issuer — which the verifier knows, because it holds the certificate. It
     *      deliberately does NOT set the global `certificateRevoked` flag: that flag gates registration, and
     *      letting any registered issuer set it for an arbitrary handle would be a griefing lane over other
     *      people's certificates.
     *
     *      Anyone may SUBMIT. Authority is the two signatures — the issuer's registered cert-signing keys
     *      over a digest binding this registry, this chain, the handle and the issuer's own gate nonce, both
     *      verified in the precompiles inside this transaction. The keys come from storage, so a submitter
     *      cannot supply the pair its own signatures verify under.
     *
     *      One-way: the first revoker of a handle is recorded and a second write is refused, because
     *      "revoked twice by two parties" is two facts where this lane models one.
     * @param issuer The registered certificate authority making the statement.
     * @param certHash The certificate being revoked.
     * @param proof The issuer's own ML-DSA-87 and SLH-DSA-SHAKE-256s signatures over the revocation digest.
     */
    function revokeIssuedCertificate(
        address issuer,
        bytes32 certHash,
        AdmissionProof calldata proof
    ) external {
        if (!hasRole(issuer, ROLE_CERTIFICATE_AUTHORITY)) {
            revert IssuerNotACertificateAuthority(issuer);
        }
        if (certificateRevokedBy[certHash] != address(0)) revert CertificateIsRevoked(certHash);
        uint64 nonce = _gateNonce[issuer];
        _gateNonce[issuer] = nonce + 1;
        bytes memory message = abi.encodePacked(
            keccak256(
                abi.encode(
                    DOMAIN_ISSUER_CERT_REVOCATION,
                    block.chainid,
                    address(this),
                    issuer,
                    certHash,
                    nonce
                )
            )
        );
        if (
            !FinalChainPrecompiles.verifyMlDsa87(
                _activeTransactionKey[issuer], message, proof.mlDsaSignature
            )
                || !FinalChainPrecompiles.verifySlhDsa(
                    _activeAccessKey[issuer], message, proof.slhDsaSignature
                )
        ) revert AdmissionProofInvalid(issuer);
        certificateRevokedBy[certHash] = issuer;
        emit CertificateRevoked(certHash, issuer);
    }

    // ---------------------------------------------------------------- views

    /// @notice The full identity record.
    /// @dev Returns the zero struct for an address no record claims, so `registered` is the field to branch
    ///      on rather than any of the hashes.
    /// @param account The identity to read.
    /// @return The stored record, copied to memory.
    function identityOf(address account) external view returns (Identity memory) {
        return _identity[account];
    }

    /// @notice The live transaction key, ML-DSA-87: what a quorum vote is verified against.
    /// @dev Read from STORAGE by every quorum on this chain, never from a caller's argument — a key supplied
    ///      as calldata proves nothing, because anyone holding a keypair can sign under it.
    /// @param account The identity to read.
    /// @return The raw public key, or empty when the account holds none.
    function activeTransactionKeyOf(address account) external view returns (bytes memory) {
        return _activeTransactionKey[account];
    }

    /// @notice The live access key, SLH-DSA-SHAKE-256s: identity, rotation, and guardianship.
    /// @dev A different hardness assumption from the transaction key, so a lattice break leaves the key that
    ///      governs identity standing intact.
    /// @param account The identity to read.
    /// @return The raw public key, or empty when the account holds none.
    function activeAccessKeyOf(address account) external view returns (bytes memory) {
        return _activeAccessKey[account];
    }

    /// @notice The seal key, SLH-DSA-SHAKE-256s: what `FinalPqQuorum` verifies an approval's seal against.
    /// @dev A service's second hash-based key, distinct from its access key, so a quorum decision carries
    ///      one signature from each hardness assumption. Empty when the identity carries no seal, in which
    ///      case it cannot take part in a sealed quorum at all — which is why {sealableMemberCount} counts
    ///      this rather than counting role bits.
    /// @param account The identity to read.
    /// @return The raw public key, or empty when the account holds no seal.
    function activeSealKeyOf(address account) external view returns (bytes memory) {
        return _activeSealKey[account];
    }

    /// @notice The recovery-stage transaction key, ML-DSA-87.
    /// @dev Authorizes rotating this account's own credentials and nothing else — acting as a guardian is an
    ///      ordinary action for an account and uses the live keys. Empty for a certificate authority.
    /// @param account The identity to read.
    /// @return The raw public key, or empty when the account holds none.
    function recoveryTransactionKeyOf(address account) external view returns (bytes memory) {
        return _recoveryTransactionKey[account];
    }

    /// @notice The recovery-stage access key, SLH-DSA-SHAKE-256s.
    /// @dev The other half of the pre-committed recovery stage. Empty for a certificate authority, which has
    ///      no recovery stage at all.
    /// @param account The identity to read.
    /// @return The raw public key, or empty when the account holds none.
    function recoveryAccessKeyOf(address account) external view returns (bytes memory) {
        return _recoveryAccessKey[account];
    }

    /// @notice The four signing-key commitments, in the order tree 1's leaf wants them.
    /// @dev keccak, not SHA3: these feed `FinalWalletFactory.accountStateLeafHash`, which every execution
    ///      chain verifies with, and that one hashes with keccak. An account missing a slot commits to the
    ///      hash of the empty string rather than reverting, so the leaf stays buildable for a certificate
    ///      authority, which holds no recovery pair.
    /// @param account The identity to commit to.
    /// @return liveAccess Commitment to the live access key.
    /// @return liveTransaction Commitment to the live transaction key.
    /// @return recoveryAccess Commitment to the recovery access key.
    /// @return recoveryTransaction Commitment to the recovery transaction key.
    function keyCommitments(address account)
        external
        view
        returns (
            bytes32 liveAccess,
            bytes32 liveTransaction,
            bytes32 recoveryAccess,
            bytes32 recoveryTransaction
        )
    {
        liveAccess = keccak256(_activeAccessKey[account]);
        liveTransaction = keccak256(_activeTransactionKey[account]);
        recoveryAccess = keccak256(_recoveryAccessKey[account]);
        recoveryTransaction = keccak256(_recoveryTransactionKey[account]);
    }

    /**
     * @notice The tree-8 leaf `account` currently earns: the execution chains' identity leaf while the
     *         identity stands, zero once it does not.
     * @dev The leaf VALUE is `keccak256(DOMAIN_IDENTITY_LEAF ‖ serial ‖ keysHash)` — byte-identical to
     *      `IdentityRootModule.identityLeafHash`, which is also the `certHash` inside a wallet's address
     *      derivation — with `keysHash` folded exactly as the certificate issuer folds it:
     *      `keccak256(activeAccess ‖ activeTransaction ‖ recoveryAccess ‖ recoveryTransaction ‖ activeKem ‖
     *      recoveryKem)`, six commitment words packed in slot order. The issuing tooling and this function
     *      are pinned against each other by test over the premined certificate fixtures, because a wallet
     *      whose address was derived from a different fold is a wallet no chain can admit.
     *
     *      Zero — the empty slot's own value, unprovable as a leaf because no certificate hashes to it — for
     *      anything that must not admit a wallet creation: a revoked identity, one outside its validity
     *      window, and any certificate authority. The authority exclusion is STRUCTURAL rather than a role
     *      read: an end entity has `depth == maxDelegationDepth` because it issues nothing, an authority
     *      never does, and that pair is immutable per version where `roles` is not.
     *
     *      Lives here rather than on the state-trees contract that consumes it because every input is this
     *      contract's storage, and the trees contract has no bytecode headroom to spare.
     * @param account The identity to project. Reverts for an account with no record at all.
     * @return The tree-8 leaf value, or zero while the identity does not stand.
     */
    function identityTreeLeafOf(address account) external view returns (bytes32) {
        Identity storage id = _identity[account];
        if (!id.registered) revert UnknownAccount(account);
        if (id.revoked || !_withinValidity(id)) return bytes32(0);
        if (id.depth != id.maxDelegationDepth) {
            // An ISSUER exists in tree 8 under its own domain, so its record is stapleable for offline
            // licence verification while the distinct domain keeps it out of wallet admission. `certHash`
            // suffices — it covers the whole TBS and the verifier holds the certificate — `version` makes
            // supersession move the leaf, and the third word RESERVES the issuer's own certificate-tree
            // anchor, zero until one is wired. Zero-on-revoke above is load-bearing for both record kinds:
            // a fresh staple is an unrevoked statement.
            return keccak256(
                abi.encodePacked(DOMAIN_ISSUER_LEAF, id.certHash, uint64(id.version), bytes32(0))
            );
        }
        bytes32 liveKem = keccak256(
            abi.encodePacked(DOMAIN_KEM_BUNDLE, _activeKemMlKem[account], _activeKemHqc[account]));
        bytes32 recoveryKem = keccak256(
            abi.encodePacked(DOMAIN_KEM_BUNDLE, _recoveryKemMlKem[account], _recoveryKemHqc[account]));
        bytes32 keysHash = keccak256(
            abi.encodePacked(
                keccak256(_activeAccessKey[account]),
                keccak256(_activeTransactionKey[account]),
                keccak256(_recoveryAccessKey[account]),
                keccak256(_recoveryTransactionKey[account]),
                liveKem,
                recoveryKem
            )
        );
        return keccak256(abi.encodePacked(DOMAIN_IDENTITY_LEAF, id.serial, keysHash));
    }

    /// @notice Per-stage encapsulation commitments, in the order the account-state leaf wants them.
    /// @dev One word per STAGE, folded over both of that stage's encapsulation public keys under
    ///      `DOMAIN_KEM_BUNDLE`. The pair is the unit — an account holds both keys or neither — so
    ///      committing to them separately would model a state the protocol does not recognise, and every
    ///      downstream record would carry two words where one says the same thing.
    ///
    ///      An account whose certificate carries no encapsulation stage folds the empty string here rather
    ///      than reverting: the projection into the state trees must keep succeeding for it, and a leaf that
    ///      cannot be built is a party that cannot be revoked.
    /// @param account The identity to commit to.
    /// @return liveKem The live stage's encapsulation commitment.
    /// @return recoveryKem The recovery stage's encapsulation commitment.
    function kemCommitments(address account)
        external
        view
        returns (bytes32 liveKem, bytes32 recoveryKem)
    {
        liveKem = keccak256(
            abi.encodePacked(DOMAIN_KEM_BUNDLE, _activeKemMlKem[account], _activeKemHqc[account]));
        recoveryKem = keccak256(
            abi.encodePacked(DOMAIN_KEM_BUNDLE, _recoveryKemMlKem[account], _recoveryKemHqc[account]));
    }

    /// @notice The live-stage encapsulation keys themselves, for a party composing a sealed message.
    /// @dev Returns both halves of the pair together because the pair is the unit: encapsulating to one
    ///      family alone is indistinguishable on the wire from a hybrid, and silently dropping the hedge is
    ///      the failure this pairing exists to prevent. Empty for an account with no encapsulation stage.
    /// @param account The party to encapsulate to.
    /// @return activeMlKem The lattice half, ML-KEM-1024.
    /// @return activeHqc The code-based half, HQC-5.
    function kemKeysOf(address account)
        external
        view
        returns (bytes memory activeMlKem, bytes memory activeHqc)
    {
        return (_activeKemMlKem[account], _activeKemHqc[account]);
    }

    // ------------------------------------------------------------- senders

    /**
     * @notice The sender address a transaction key produces on this chain.
     * @dev `keccak256(uint8(4) ‖ publicKey)[12:]` — byte-identical to what the node derives from a
     *      post-quantum transaction envelope and to the backend's own derivation. The leading algorithm byte
     *      is what domain-separates it, so a key of another family can never derive the same address.
     *
     *      Pure, so a client can compute the address from a certificate before the identity is registered —
     *      which is what lets an admission transaction be funded and submitted from the very sender it is
     *      about to bind.
     * @param transactionKey The raw ML-DSA-87 public key.
     * @return The sender address that key signs from.
     */
    function senderFor(bytes memory transactionKey) public pure returns (address) {
        return address(uint160(uint256(keccak256(abi.encodePacked(ENVELOPE_ALG_ML_DSA_87, transactionKey)))));
    }

    /// @notice The sender `account`'s transactions arrive from.
    /// @dev The forward direction of {accountOfSender}, derived rather than stored, so it cannot disagree
    ///      with the transaction key on record.
    /// @param account The identity to resolve.
    /// @return The derived sender, or zero for an account with no transaction key on record.
    function senderOf(address account) external view returns (address) {
        bytes storage key = _activeTransactionKey[account];
        if (key.length == 0) return address(0);
        return senderFor(key);
    }

    /// @notice {hasRole} for a `msg.sender`: resolves the sender to its identity first.
    /// @dev The form every `msg.sender` gate on this chain uses. A sender is derived from a transaction key
    ///      and holds no authority itself, so asking it directly would be asking the wrong address. False for
    ///      a sender no identity claims.
    /// @param sender The address a transaction arrived from.
    /// @param roleMask The capability required.
    /// @return Whether the identity behind that sender stands and carries the whole mask.
    function senderHasRole(address sender, uint256 roleMask) external view returns (bool) {
        address account = accountOfSender[sender];
        return account != address(0) && hasRole(account, roleMask);
    }

    /// @notice How many accounts carrying `roleMask` also hold a seal key — the members that can take part
    ///         in a sealed quorum.
    /// @dev The count every membership threshold is checked against, because membership approvals are the
    ///      hybrid class and a member with no seal can never contribute one. A certificate authority
    ///      carrying `ROLE_REGISTRAR` is registered from a certificate with no seal slot, so it is counted
    ///      out here rather than being discovered at the first quorum that fails to reach its threshold.
    /// @param roleMask The capability the quorum is over.
    /// @return sealable How many standing accounts carry the mask and hold a seal key.
    function sealableMemberCount(uint256 roleMask) public view returns (uint256 sealable) {
        uint256 n = _accounts.length;
        for (uint256 i = 0; i < n; i++) {
            address a = _accounts[i];
            if (hasRole(a, roleMask) && _activeSealKey[a].length != 0) sealable++;
        }
    }

    /// @notice Number of registered accounts.
    /// @dev Never decreases: revocation clears a record's roles and sets its flag but leaves it in the list,
    ///      so an index handed out once keeps pointing at the same account for good.
    /// @return How many accounts have ever been registered.
    function accountCount() external view returns (uint256) {
        return _accounts.length;
    }

    /// @notice Registered account by index, in registration order.
    /// @dev Reverts on an out-of-range index rather than answering zero, so a caller paging the list cannot
    ///      mistake the end of it for a hole in the middle.
    /// @param index Position in the registration-ordered list, below {accountCount}.
    /// @return The account at that position.
    function accountAt(uint256 index) external view returns (address) {
        return _accounts[index];
    }

    /// @notice Every account carrying every bit in `roleMask`.
    /// @dev A view, so the linear scan over the account list costs nothing to a caller reading off chain.
    ///      Callers that need a roster inside a transaction pass the member list explicitly instead — see
    ///      `FinalPqQuorum`, which takes signers rather than searching for them, so a quorum's cost does not
    ///      grow with the size of the registry.
    /// @param roleMask The capability to filter on.
    /// @return found The matching accounts, in registration order.
    function accountsWithRole(uint256 roleMask) external view returns (address[] memory found) {
        uint256 n = _accounts.length;
        address[] memory buf = new address[](n);
        uint256 count;
        for (uint256 i = 0; i < n; i++) {
            if (hasRole(_accounts[i], roleMask)) {
                buf[count++] = _accounts[i];
            }
        }
        found = new address[](count);
        for (uint256 i = 0; i < count; i++) {
            found[i] = buf[i];
        }
    }

    /**
     * @notice How many accounts could satisfy a quorum for `roleMask` right now.
     * @dev The number a threshold has to be reachable against. A threshold above it is not a strict quorum,
     *      it is a quorum that cannot be met — and the way that presents is an operation reverting forever
     *      with nothing naming the roster as the cause. Counts standing alone; use {sealableMemberCount} for
     *      a quorum that also needs a seal.
     * @param roleMask The capability the quorum is over.
     * @return live How many standing accounts carry the whole mask.
     */
    function liveMemberCount(uint256 roleMask) public view returns (uint256 live) {
        uint256 n = _accounts.length;
        for (uint256 i = 0; i < n; i++) {
            if (hasRole(_accounts[i], roleMask)) live++;
        }
    }

    /**
     * @notice Whether `account` currently carries every bit in `roleMask`.
     * @dev Every gate in this system asks this one question, so every gate gets the same answer: registered,
     *      not revoked, inside its validity window, and holding the capability. A caller that checked only
     *      the role bit would accept an expired certificate.
     *
     *      `roleMask == 0` is false. A zero mask asks nothing and must not read as "yes" — that is the shape
     *      of an uninitialised configuration variable, and the one reading it must not be a universal pass.
     *
     *      Every bit in the mask must be present, so a mask naming two capabilities asks for both rather than
     *      either.
     * @param account The account to test.
     * @param roleMask One or more `ROLE_*` bits, OR-ed together.
     * @return Whether the account stands and carries the whole mask.
     */
    function hasRole(address account, uint256 roleMask) public view returns (bool) {
        if (roleMask == 0) return false;
        Identity storage id = _identity[account];
        if (!id.registered || id.revoked) return false;
        if (id.roles & roleMask != roleMask) return false;
        return _withinValidity(id);
    }

    /// @notice Whether `account` is registered, unrevoked and in date, regardless of capability.
    /// @dev The standing half of {hasRole}, for callers that care that a party is honoured at all rather
    ///      than that it holds a particular capability. {lmsSignerIsLive} asks this rather than spelling the
    ///      three conditions out a second time, because a second spelling is how two answers drift apart.
    /// @param account The account to test. An address no record claims answers false.
    /// @return Whether the identity currently stands.
    function isActive(address account) public view returns (bool) {
        Identity storage id = _identity[account];
        return id.registered && !id.revoked && _withinValidity(id);
    }

    /// @notice Whether a record's certificate is inside its validity window right now.
    /// @dev Both bounds are milliseconds on this chain's clock and both are optional: a zero `notBefore`
    ///      means valid from issuance and a zero `notAfter` means never expires, which the certificate
    ///      schema allows and personal identity certificates use. The upper bound is exclusive, so a
    ///      certificate stops being honoured on the millisecond it names rather than after it.
    /// @param id The record to test, taken as a storage pointer so no copy of a multi-word struct is made.
    /// @return Whether the window admits the current block time.
    function _withinValidity(Identity storage id) private view returns (bool) {
        if (id.notBefore != 0 && FinalChainTime.nowMs() < id.notBefore) return false;
        if (id.notAfter != 0 && FinalChainTime.nowMs() >= id.notAfter) return false;
        return true;
    }


    // ------------------------------------------------------------------ sweep

    /// @inheritdoc FinalSweep
    /// @dev The registry's own configuration gate, in the `msg.sender` form a no-argument seam can express:
    ///      the bootstrap admin alone while the window is open, a live registrar afterwards.
    ///
    ///      The rest of the state plane inherits this rule from `FinalPlaneSweep`, which reads it off a
    ///      registry pointer. This contract answers it from its own storage because it IS that registry, and
    ///      importing the shared mixin here would make this file import a file that imports it back.
    ///
    ///      The sealed half of the gate is a K-of-N over `ROLE_REGISTRAR` whose approvals arrive in calldata,
    ///      which `sweepAsset`'s shared signature has no room for; what survives is membership in that same
    ///      roster. The narrowing is safe because the other two gates hold regardless: a sweep moves surplus
    ///      only, this contract owes nothing, so there is nothing behind the line to reach — and the
    ///      destination is not the caller's to invent.
    function _requireSweepAuthority() internal view override {
        if (!bootstrapSealed && msg.sender == bootstrapAdmin) return;
        if (hasRole(msg.sender, ROLE_REGISTRAR)) return;
        revert SweepUnauthorized(msg.sender);
    }

    /// @inheritdoc FinalSweep
    /// @dev The bootstrap admin, and the proven authority that called. The first of those is zero once the
    ///      window is sealed, which `FinalSweep` refuses as a destination, so a sealed registry can only
    ///      sweep to the registrar that authorised the sweep.
    function _sweepDestinations() internal view override returns (address, address) {
        return (bootstrapAdmin, msg.sender);
    }

    /// @dev Nothing is reserved because nothing is owed: the registry holds
    /// certificates and role bits, has no payable entrypoint and no custody
    /// line. Anything it carries arrived by accident.
}

contracts/finalchain/FinalPlaneSweep.sol

// SPDX-License-Identifier: BUSL-1.1
// Copyright (c) 2024-2026 Final DeFi
// Licensed under the Business Source License 1.1 (the "License")
//
// Change Date: 2029-01-01
// Change License: GPL-2.0-or-later
//
// Additional Use Grant:
// 1. Any person or entity may inherit this mixin from a contract deployed as
//    part of a Final DeFi Protocol state plane, and may operate the asset-rescue
//    surface it completes.
// 2. Integrators, indexers and operators may call the resulting rescue surface
//    where the state plane's own configuration authority permits it, and may
//    read the authority and destination answers it gives.
// 3. For the avoidance of doubt, this Grant does NOT permit the commercial
//    deployment of a Fork of this mixin or a competing state-plane rescue
//    authority without permission prior to the Change Date.
//
// @author Final DeFi
// @version 1.0.0
pragma solidity ^0.8.20;

import {FinalSweep} from "../utils/FinalSweep.sol";
import {FinalIdentityRegistry} from "./FinalIdentityRegistry.sol";

/**
 * @title Final Plane Sweep
 * @notice The authority and destination halves of the shared asset-rescue surface, answered once for every
 *         contract of the protocol's own state plane.
 * @dev `FinalSweep` gives every contract that can end up holding a stray asset one rescue surface and leaves two
 *      questions for the inheritor: who may call it, and where the value may go. Every contract on this state
 *      plane answers both the same way — the registry's bootstrap admin alone while that window is open, and the
 *      sealed registrar authority afterwards — and stating that once per contract would be one chance per
 *      contract to state it differently. An inheritor of this mixin answers a single question instead: which
 *      registry is mine.
 *
 *      **The authority is the plane's own configuration gate, narrowed to what a fixed signature can carry.**
 *      The sealed half of that gate is a K-of-N over the registrar role, and its approvals arrive in CALLDATA.
 *      The rescue entrypoint's signature is shared across every contract on the plane and cannot grow a
 *      per-contract quorum argument, so what survives into a no-argument `internal view` is MEMBERSHIP: the
 *      bootstrap admin while the window is open, and afterwards any account the registry currently attests as a
 *      live registrar.
 *
 *      That is a narrowing — one registrar rather than K of them — and it is deliberate rather than overlooked.
 *      Two other gates make it safe, and a registrar can widen neither:
 *
 *        - a rescue moves SURPLUS only. Every contract that owes something declares the debt as a reservation,
 *          and no key reaches behind that line: an intent log's bonds, a billing plane's prepaid credit and a gas
 *          well's entire float are all unreachable by this surface however it is called.
 *        - the destination is not the caller's to invent.
 *
 *      A registrar already configures tree writers, thresholds and consumers. An account that can decide who may
 *      write the account tree is not meaningfully restrained from moving a stray token, so demanding a quorum
 *      ceremony for the rescue lane would buy nothing and would instead guarantee the lane is never used when it
 *      is needed. No new role and no new authority pointer is introduced here: the registrar role is the
 *      registry's own, and membership in it moves in the registry rather than in any contract that reads it.
 *
 *      **The destination is the authority that ordered the rescue.** This state plane has no treasury pointer,
 *      and adding one would be exactly the new authority this mixin is not allowed to invent — a per-contract
 *      treasury setter would need its own quorum action on every contract of the plane, to configure something
 *      the plane has never needed. So the two legitimate destinations are the two addresses already proven: the
 *      bootstrap admin, and the caller.
 *
 *      The caller is not a free parameter. The rescue entrypoint proves the authority BEFORE it resolves
 *      destinations, so by the time this mixin is asked, the sender is already either the bootstrap admin or a
 *      live registrar. Every service on this chain is a Final Wallet with a registered identity and no EOA
 *      signing key, so the value lands on an account the chain itself attests to. What the gate rules out is the
 *      thing worth ruling out: a rescue paying an address the plane knows nothing about.
 *
 *      Once the bootstrap window is sealed the admin address is zero, and the base contract refuses a zero
 *      destination, so the pair collapses to the caller alone — one legitimate destination, which is the case the
 *      base contract already handles.
 */
abstract contract FinalPlaneSweep is FinalSweep {
    /// @notice The membership registry an inheriting contract's configuration gate reads.
    /// @dev The one question this mixin leaves open, and the only line an inheritor has to supply. It exists
    ///      because some contracts of the plane hold the registry directly while others reach it through another
    ///      contract they already hold, and both must resolve to the SAME registry their configuration answers
    ///      to — a rescue authority read from a different source would be a second authority in disguise.
    /// @return The registry whose bootstrap admin and registrar membership decide this contract's rescue
    ///         authority and destinations.
    function _sweepRegistry() internal view virtual returns (FinalIdentityRegistry);

    /// @notice The plane's configuration gate, in the caller-only form the shared rescue surface can express.
    /// @dev Two accepting branches, checked in order: the bootstrap admin while the window is open, and any live
    ///      registrar once it is sealed. The bootstrap branch is guarded on the seal as well as on the address,
    ///      so it closes the moment the window does rather than depending on the admin field being cleared.
    ///      Membership is read live from the registry on every call, so revoking a registrar there revokes this
    ///      authority everywhere on the plane at once. Anything else reverts.
    function _requireSweepAuthority() internal view virtual override {
        FinalIdentityRegistry reg = _sweepRegistry();
        if (!reg.bootstrapSealed() && msg.sender == reg.bootstrapAdmin()) return;
        if (reg.hasRole(msg.sender, reg.ROLE_REGISTRAR())) return;
        revert SweepUnauthorized(msg.sender);
    }

    /// @notice The two addresses a rescue on this plane may pay.
    /// @dev The bootstrap admin, and the authority that called — which the base contract has already proven by
    ///      the time this is read, so the second is never an address of the caller's choosing. After the seal the
    ///      admin half is the zero address, which the base contract refuses as a destination, leaving the proven
    ///      caller as the single legitimate target.
    /// @return The bootstrap admin, and the proven caller.
    function _sweepDestinations() internal view virtual override returns (address, address) {
        return (_sweepRegistry().bootstrapAdmin(), msg.sender);
    }
}

contracts/finalchain/FinalPqQuorum.sol

// SPDX-License-Identifier: BUSL-1.1
// Copyright (c) 2024-2026 Final DeFi
// Licensed under the Business Source License 1.1 (the "License")
//
// Change Date: 2029-01-01
// Change License: GPL-2.0-or-later
//
// Additional Use Grant:
// 1. Any person or entity may deploy and operate this quorum as part of a
//    Final DeFi Protocol chain, and may inherit it to gate an action behind a
//    post-quantum K-of-N.
// 2. Integrators, auditors, and node operators may read its membership and
//    thresholds and independently re-verify any approval it recorded, as part
//    of their integration with the Final DeFi Protocol.
// 3. For the avoidance of doubt, this Grant does NOT permit the commercial
//    deployment of a Fork of this quorum or a competing identity or
//    authorization plane derived from it without permission prior to the
//    Change Date.
//
// @author Final DeFi
// @version 1.0.0
pragma solidity ^0.8.20;

import {FinalChainPrecompiles} from "./FinalChainPrecompiles.sol";
import {FinalIdentityRegistry} from "./FinalIdentityRegistry.sol";

/**
 * @title FinalPqQuorum
 * @notice K-of-N approval where the signatures are post-quantum and the chain
 *         is what checks them.
 *
 * @dev This library is the reason Final Chain exists in this design.
 *
 * `FinalBackend/src/pq/credential.js` carries a rule it had to enforce in code
 * because nothing else could: **a surface whose signature is verified on chain
 * cannot be PQ.** A co-signer approval reaching `FinalRootAuthority` is checked
 * by ECDSA/ERC-1271 in Solidity, so a PQ co-signer would produce approvals the
 * contract cannot read, and the quorum would stop reaching threshold with
 * nothing in any log naming the cause. `PQ_SURFACE` and `assertBackendVerified`
 * exist to keep anyone from crossing that line by accident.
 *
 * Here the line is gone. The precompiles verify ML-DSA-87 and
 * SLH-DSA-SHAKE-256s natively, so a quorum can be PQ *and* on chain, and
 * "the backend says these four signatures verified" becomes "these four
 * signatures verify, and any node re-derives that independently".
 *
 * ## Three rules, each closing a specific hole
 *
 * 1. **Keys come from the registry, never from calldata.** A key passed as an
 *    argument proves nothing — anyone with a keypair can sign under it. This is
 *    the difference between a 4-of-5 quorum and a 1-of-1 held by whoever built
 *    the transaction.
 *
 * 2. **Signers strictly ascending.** One comparison per entry rejects duplicates
 *    outright, so a single member cannot supply four approvals and satisfy a
 *    threshold of four. The alternative — an O(n²) seen-check — is the same
 *    guarantee with more ways to get it wrong.
 *
 * 3. **The digest binds chain id and verifying contract.** Without both, an
 *    approval collected for one contract is replayable against another with the
 *    same payload shape, and an approval from the test chain is replayable on
 *    the production one. These co-signers hold one key across environments.
 *
 * ## Which algorithm
 *
 * The stack splits its keys by hardness assumption, not by convenience:
 * ML-DSA-87 (lattice) signs transactions, SLH-DSA-SHAKE-256s (hash-based) signs
 * identity. Two families, so one cryptanalytic result cannot take both.
 *
 * So an action inherits the class of what it authorizes. Advancing a state root
 * is operational and high-cadence: transaction class. Registering or revoking
 * an identity is the thing the access class exists for. `ALG_ANY` is available
 * and should be used sparingly — accepting either means a break in one family
 * takes the quorum.
 *
 * A MEMBERSHIP action — the registrar quorum that admits, re-roles or revokes
 * an identity and upgrades a plane contract — takes both: the ML-DSA-87
 * approval and a `seal`, an SLH-DSA-SHAKE-256s signature over the same digest
 * by the member's `activeSeal` key. The seal key is its own slot — never the
 * access key — so the process that seals cannot also rotate the identity it
 * seals for. Every OPERATIONAL action — a bundle root or payload appended to
 * the log, a settlement leaf, an account-state write, a tree write, a PHI
 * movement — takes the ML-DSA-87 approval alone (the user's ruling of 12 Sep
 * 2026, arch/quorum-signing-ml-dsa.md Q1/Q4): the SLH-DSA family is exercised
 * at the boundary where a member JOINS — the joiner's own proof of possession
 * over the admission digest, verified here through `0x0205` — and by a holder
 * on its ledger actions, not on every bundle. An SLH-DSA seal costs a Cloud Run
 * co-signer about forty seconds per digest, and the fleet paid it once per
 * member per bundle; ML-DSA-87 signs in milliseconds under the key the member
 * already votes with.
 *
 * Every digest binds an `anchorBlock`: the block at which the members read
 * tree 1 to decide who is in the round. Binding it means every approval in a
 * round was made against ONE roster view, and the window in `require_` means a
 * view older than `ANCHOR_WINDOW` blocks is refused rather than honoured.
 *
 * The practical cost is worth stating: an SLH-DSA signature is 29,792 bytes, so
 * a 4-of-5 membership-class quorum is ~119 KB of calldata. That is affordable
 * here only because this is our own chain and membership changes are rare. Do
 * not carry this pattern to a chain where it is not.
 */
library FinalPqQuorum {
    /// @notice ML-DSA-87 — FIPS 204. Algorithm ids are the FIPS numbers: the
    /// same ids `FinalCertificate` and the backend registry use, and the numbers
    /// the precompile addresses end in (`0x0204`).
    uint8 internal constant ALG_ML_DSA_87 = 4;
    /// @notice SLH-DSA-SHAKE-256s — FIPS 205 (`0x0205`).
    uint8 internal constant ALG_SLH_DSA_SHAKE_256S = 5;
    /// @notice Either scheme is acceptable for this action.
    uint8 internal constant ALG_ANY = 0;

    /// @notice How far behind the chain head an approval's anchor may sit.
    /// @dev Members evaluate roster membership against tree 1 AT the anchor
    /// block. 600 blocks is ten minutes at the chain's one-second cadence —
    /// generous against a round that takes seconds, and short enough that a
    /// roster rotated away is refused rather than counted.
    uint64 internal constant ANCHOR_WINDOW = 600;

    /// @dev Domain separator for every quorum digest. Distinct from any
    /// EIP-712 domain in the stack: these are not typed-data signatures and
    /// must not be confusable with one.
    bytes32 internal constant DOMAIN_PQ_QUORUM = keccak256("FINAL_CHAIN_PQ_QUORUM_v01");

    /// @notice One member's approval.
    struct Approval {
        /// The member's account, which is also the key it is looked up by.
        address signer;
        /// `ALG_ML_DSA_87` or `ALG_SLH_DSA_SHAKE_256S`.
        uint8 algorithm;
        /// Over the 32-byte digest from `digest()`, verbatim. Both schemes
        /// hash internally, so the digest is not re-hashed before signing.
        bytes signature;
        /// SLH-DSA-SHAKE-256s over the same digest, by the member's `activeSeal`
        /// key. Required by the membership class (the registrar quorum); an
        /// operational action never reads it, so it is empty there.
        bytes seal;
    }

    /// @notice Thrown when fewer valid approvals were supplied than the action requires.
    /// @param valid Approvals that verified.
    /// @param required Approvals the action demands.
    error ThresholdNotMet(uint256 valid, uint256 required);
    /// @notice Thrown when approvals are not in strictly ascending signer order.
    /// @dev Ascending order is what makes duplicate detection a single comparison instead of a quadratic scan,
    ///      so it is the rule that stops one signer being counted twice toward a threshold.
    /// @param previous The preceding signer.
    /// @param next The signer that failed to exceed it.
    error SignersNotAscending(address previous, address next);
    /// @notice Thrown when an approving signer does not hold the role this action is gated on.
    /// @param signer The approving signer.
    /// @param roleMask The role the action requires.
    error SignerLacksRole(address signer, uint256 roleMask);
    /// @notice Thrown when an approval is signed under an algorithm this action does not accept.
    /// @param signer The approving signer.
    /// @param got The algorithm the approval declared.
    /// @param required The algorithm the action demands.
    error WrongAlgorithm(address signer, uint8 got, uint8 required);
    /// @notice Thrown when an approval's signature fails verification in the precompile.
    /// @param signer The approving signer.
    /// @param algorithm The algorithm it was verified under.
    error BadSignature(address signer, uint8 algorithm);
    /// @notice Thrown when an approval's access seal fails verification.
    /// @param signer The approving signer.
    error BadSeal(address signer);
    /// @notice Thrown when an approval anchors to a block this chain has not reached.
    /// @param anchorBlock The block the approval anchored to.
    /// @param blockNumber The current block.
    error AnchorAhead(uint64 anchorBlock, uint256 blockNumber);
    /// @notice Thrown when an approval's anchor is older than the accepted window.
    /// @dev Bounding the window is what stops an approval collected once being replayed indefinitely later.
    /// @param anchorBlock The block the approval anchored to.
    /// @param blockNumber The current block.
    error AnchorStale(uint64 anchorBlock, uint256 blockNumber);
    /// @notice Thrown when an action is gated on a threshold of zero.
    /// @dev Refused rather than treated as "no approvals needed": a zero threshold is always a
    ///      misconfiguration, and reading it as permissive would silently remove the quorum.
    error ThresholdIsZero();

    /**
     * @notice The message every member of this quorum signs.
     * @param verifyingContract The contract consuming the approvals. Binding it
     *        stops an approval collected for one contract being replayed
     *        against another with the same payload shape.
     * @param actionDomain What is being authorized — a per-action constant, so
     *        an approval for "advance the accounts tree" cannot be replayed as
     *        one for "revoke an identity".
     * @param anchorBlock The Final Chain block the members read tree 1 at to
     *        decide the roster. Bound here so every approval in a round names
     *        the same view; checked against `ANCHOR_WINDOW` by `require_`.
     * @param payloadDigest The action's own committed content. Callers MUST
     *        include a nonce or a monotonic counter in it; nothing here can
     *        tell a replay of round 7 from a fresh round 7.
     */
    function digest(
        address verifyingContract,
        bytes32 actionDomain,
        uint64 anchorBlock,
        bytes32 payloadDigest
    ) internal view returns (bytes32) {
        return keccak256(
            abi.encode(
                DOMAIN_PQ_QUORUM,
                block.chainid,
                verifyingContract,
                actionDomain,
                anchorBlock,
                payloadDigest
            )
        );
    }

    /**
     * @notice Reverts unless at least `threshold` distinct members holding
     *         `roleMask` have signed `quorumDigest`.
     * @param registry Where public keys and roles come from. Not a parameter
     *        for flexibility — a parameter so the caller's own immutable
     *        registry address is what is used, rather than one from calldata.
     * @param requiredAlgorithm `ALG_ANY` to accept either scheme.
     * @param anchorBlock The anchor the digest was built over. Refused if it is
     *        ahead of this block or more than `ANCHOR_WINDOW` behind it.
     * @param requireSeal Whether every approval must also carry a valid `seal`
     *        by the member's `activeSeal` key — the membership class (the
     *        registrar quorum). Operational actions pass `false`.
     * @return valid The number of approvals that verified, which is at least
     *         `threshold` if this returns at all.
     *
     * @dev Every failure reverts with the offending signer named. A quorum that
     * silently skipped bad approvals and counted the rest would let a
     * misconfigured co-signer sit broken indefinitely: the threshold would keep
     * being met by the others and nothing would say one member had stopped
     * contributing. That is exactly the failure this program has already had,
     * in `fanOut`, where a per-chain advance failure was recorded and execution
     * continued.
     */
    function require_(
        FinalIdentityRegistry registry,
        Approval[] calldata approvals,
        bytes32 quorumDigest,
        uint256 roleMask,
        uint256 threshold,
        uint8 requiredAlgorithm,
        uint64 anchorBlock,
        bool requireSeal
    ) internal view returns (uint256 valid) {
        if (threshold == 0) revert ThresholdIsZero();
        if (anchorBlock > block.number) revert AnchorAhead(anchorBlock, block.number);
        if (block.number - anchorBlock > ANCHOR_WINDOW) revert AnchorStale(anchorBlock, block.number);

        bytes memory message = abi.encodePacked(quorumDigest);
        address previous = address(0);

        uint256 n = approvals.length;
        for (uint256 i = 0; i < n; i++) {
            Approval calldata a = approvals[i];

            // Strictly ascending. `address(0)` as the initial value works
            // because it can never be a registered signer.
            if (a.signer <= previous) revert SignersNotAscending(previous, a.signer);
            previous = a.signer;

            if (!registry.hasRole(a.signer, roleMask)) revert SignerLacksRole(a.signer, roleMask);

            if (requiredAlgorithm != ALG_ANY && a.algorithm != requiredAlgorithm) {
                revert WrongAlgorithm(a.signer, a.algorithm, requiredAlgorithm);
            }

            if (!_verify(registry, a, message)) revert BadSignature(a.signer, a.algorithm);
            if (requireSeal && !_verifySeal(registry, a, message)) revert BadSeal(a.signer);

            valid++;
        }

        if (valid < threshold) revert ThresholdNotMet(valid, threshold);
    }

    /// @notice Non-reverting form, for views and for callers that want to
    /// report rather than refuse.
    function count(
        FinalIdentityRegistry registry,
        Approval[] calldata approvals,
        bytes32 quorumDigest,
        uint256 roleMask,
        uint8 requiredAlgorithm,
        uint64 anchorBlock,
        bool requireSeal
    ) internal view returns (uint256 valid) {
        if (anchorBlock > block.number || block.number - anchorBlock > ANCHOR_WINDOW) return 0;
        bytes memory message = abi.encodePacked(quorumDigest);
        address previous = address(0);
        uint256 n = approvals.length;
        for (uint256 i = 0; i < n; i++) {
            Approval calldata a = approvals[i];
            if (a.signer <= previous) return valid;
            previous = a.signer;
            if (!registry.hasRole(a.signer, roleMask)) continue;
            if (requiredAlgorithm != ALG_ANY && a.algorithm != requiredAlgorithm) continue;
            if (!_verify(registry, a, message)) continue;
            if (requireSeal && !_verifySeal(registry, a, message)) continue;
            valid++;
        }
    }

    /// @dev The seal: SLH-DSA-SHAKE-256s by the member's `activeSeal` key over
    /// the same digest. A member with no seal key on record cannot seal, and an
    /// approval with no seal bytes is not one.
    function _verifySeal(
        FinalIdentityRegistry registry,
        Approval calldata a,
        bytes memory message
    ) private view returns (bool) {
        bytes memory key = registry.activeSealKeyOf(a.signer);
        if (key.length == 0 || a.seal.length == 0) return false;
        return FinalChainPrecompiles.verifySlhDsa(key, message, a.seal);
    }

    /// @dev Verifies one approval against the key the REGISTRY holds for that signer, never against a key
    ///      supplied in the approval. A key passed as an argument proves nothing, because anyone holding a
    ///      keypair can sign under it; reading from storage is what makes the verdict re-derivable from public
    ///      state rather than a claim by whoever assembled the call.
    /// @param registry The identity registry that holds each signer's live keys.
    /// @param a The approval being verified.
    /// @param message The exact bytes the approval must cover.
    /// @return valid True when the signature verifies under the signer's live key for the declared algorithm.
    function _verify(
        FinalIdentityRegistry registry,
        Approval calldata a,
        bytes memory message
    ) private view returns (bool) {
        // The LIVE pair, always. The recovery pair authorizes rotating this
        // account's own credentials and NOTHING else — a quorum that accepted
        // it would hand the recovery keys everyday authority, which is exactly
        // the separation the two stages exist to draw.
        if (a.algorithm == ALG_ML_DSA_87) {
            return FinalChainPrecompiles.verifyMlDsa87(
                registry.activeTransactionKeyOf(a.signer), message, a.signature
            );
        }
        if (a.algorithm == ALG_SLH_DSA_SHAKE_256S) {
            return FinalChainPrecompiles.verifySlhDsa(
                registry.activeAccessKeyOf(a.signer), message, a.signature
            );
        }
        // Any other id is a refusal, never a default — including the KEM ids
        // (3, 7) and the reserved FN-DSA id (6), none of which is a signature
        // scheme this quorum verifies.
        return false;
    }
}

contracts/finalchain/FinalStateTrees.sol

// SPDX-License-Identifier: BUSL-1.1
// Copyright (c) 2024-2026 Final DeFi
// Licensed under the Business Source License 1.1 (the "License")
//
// Change Date: 2029-01-01
// Change License: GPL-2.0-or-later
//
// Additional Use Grant:
// 1. Any person or entity may deploy this state-tree contract as the state
//    plane of a Final DeFi Protocol chain, and may operate that chain.
// 2. Integrators, indexers, operators and end users may read every tree, take
//    inclusion proofs, branch roots, tree roots and round roots from it, and
//    write into a tree they hold the quorum, the writer seat or the
//    configuration authority for, as part of their integration with the Final
//    DeFi Protocol.
// 3. For the avoidance of doubt, this Grant does NOT permit the commercial
//    deployment of a Fork of this state-tree contract or a competing state
//    plane derived from it without permission prior to the Change Date.
//
// @author Final DeFi
// @version 1.0.0
pragma solidity ^0.8.20;

import {FinalIdentityRegistry} from "./FinalIdentityRegistry.sol";
import {FinalChainTime} from "./FinalChainTime.sol";
import {FinalPqQuorum} from "./FinalPqQuorum.sol";
import {FinalPlaneSweep} from "./FinalPlaneSweep.sol";
import {FinalChainInitializable} from "./FinalChainInitializable.sol";

/// @title Chain Source
/// @notice The one question `syncIdentities` asks the asset registry.
/// @dev An interface rather than an import of `FinalAssetRegistry`, which
///      imports this file: the registry is tree 6's writer and holds the trees
///      as an immutable, so the dependency runs that way and this is the one
///      read that runs the other.
interface IChainSource {
    /// @notice Every chain reference the asset registry currently has enabled.
    /// @dev Read once per `syncIdentities` batch, so a service account's
    ///      `deployedChains` table is DERIVED from registry state instead of
    ///      being supplied by the caller. A caller-chosen table would let
    ///      anyone place a service identity on a chain of their choosing,
    ///      which is why the projection reads and never accepts.
    /// @return The enabled chain references, in the registry's own order.
    function enabledChainRefs() external view returns (bytes32[] memory);
}

/// @title Slot Key Source
/// @notice The one question {FinalStateTrees.syncSlotKeyLeaves} asks the
///         slot-key registry: the leaf value for one member's slot — the
///         registry's own verdict, zero when the slot holds nothing usable.
interface ISlotKeySource {
    /// @notice The leaf value one member's slot-key ring position carries.
    /// @dev The registry decides; this contract only copies. Zero is the
    ///      answer for a slot that never held a key and for one whose window
    ///      has passed, so re-projecting a lapsed slot retires its leaf.
    /// @param member The co-signer whose slot key is being read.
    /// @param slotIndex The slot the key belongs to, before the ring modulus.
    /// @return The registry's leaf value, or zero when the slot holds nothing usable.
    function slotKeyLeafOf(address member, uint64 slotIndex) external view returns (bytes32);
}

/// @title Endpoint Source
/// @notice The one question {FinalStateTrees.syncEndpointLeaves} asks the
///         endpoint registry: the leaf value for one tunnel endpoint — the
///         registry's own verdict (certificate hash, status, expiry, region),
///         zero when nothing is registered under the id.
interface IEndpointSource {
    /// @notice The leaf value one tunnel endpoint carries.
    /// @dev The registry admitted the certificate under its own quorum with
    ///      the holder's proof of possession, so this read carries a verdict
    ///      rather than a claim. Zero means nothing stands under the id.
    /// @param endpointId The endpoint's certificate subject key id.
    /// @return The registry's leaf value, or zero when nothing is registered under the id.
    function endpointLeafOf(bytes32 endpointId) external view returns (bytes32);
}

/**
 * @title Final State Trees
 * @notice Final Chain's state plane: eight fixed-depth Merkle trees, and the rounds that publish all
 *         eight of their roots as one contemporaneous snapshot.
 *
 * @dev This contract runs on the project's own reth-based chains and nowhere else. Every signer is
 * resolved through an identity registry that verifies post-quantum signatures in precompiles those chains
 * alone provide, so a deployment anywhere else cannot authorize a single write. Nothing under
 * `contracts/` outside the Final Chain directory imports it, and it takes part in no CREATE2 derivation —
 * its address is whatever its deploy transaction produced, never a mined constant that other code pins.
 * Gas is deliberately NOT a design constraint here and must not be optimised for: full sibling paths are
 * stored, every branch enumerates on chain, and a configuration row keeps its value beside its hash,
 * precisely so that no reader ever has to rebuild anything off chain to be sure of it.
 *
 * **Immutable, and behind no proxy.** There is no upgrade path and no authority that can replace this
 * code. Any change to the surface below is a REDEPLOY at a new address, and everything holding the old
 * address — the account ledger, the registries, the records contract, every service configured against
 * it, every consumer pinning a root — is orphaned the moment that happens and has to be repointed. The
 * registry projections into trees 1 and 8 do not travel with a redeploy either: they are derived from the
 * registry, so a fresh deployment re-derives them rather than migrating anything.
 *
 * ## What each tree carries
 *
 * One tree per domain, because they change at unrelated cadences and a combined tree invalidates every
 * outstanding proof on every tick:
 *
 * | # | tree | holds | cadence |
 * |---|---|---|---|
 * | 1 | accounts | every Final Wallet's public state | per rotation / creation |
 * | 2 | phi | the PHI record: per (wallet, chain) balances, the lock, exposures | per publisher round |
 * | 3 | vasset | issued vAsset supply and backing, per (asset, chain) | per settlement |
 * | 4 | oracle | published prices and their inputs | ~10 s; 1 s for morph and fee assets |
 * | 5 | settlement | chain and asset registry roots | rarely |
 * | 6 | allowlist | assets, chains, policy, price sources, DEX deployments | rarely |
 * | 7 | intents | intent status, ring-keyed over the posting sequence | per posting |
 * | 8 | identity | the wallet-creation admission set, projected from the registry | per identity mutation |
 *
 * ## Tree 1 is READ, never rebuilt
 *
 * Tree 1 is a Final Wallet's public state and the SOURCE OF TRUTH every execution chain projects from.
 * The sanctioned way to ask it a question is {proofFor} for the sibling path and {liveRoot} for the root
 * each chain republishes — {branchProofFor} with {branchRoot} to prove against a branch instead,
 * {roundProofFor} with {roundRootAt} to prove against a published round. Those entrypoints are the whole
 * interface, and their answers are the only ones that verify.
 *
 * Do NOT fold the same leaves off chain. This tree is FIXED DEPTH — `DEPTH` levels, with a branch subtree
 * at `BRANCH_DEPTH` — zero-padded to that depth, and INSERTION-ORDERED: a key keeps the slot it was first
 * handed, permanently, and empty slots hash as the empty subtree rather than being skipped. A rebuild
 * that sorts its leaves, or sizes itself `log2(n)` to the number of leaves present, is a DIFFERENT tree.
 * Its root is not this root, no proof against it verifies anywhere, and nothing in the failure names the
 * cause: the execution chain simply refuses a proof that looks perfectly well formed.
 *
 * ## Who may write which tree
 *
 * Four kinds of door, and every tree sits on exactly one of the first three:
 *
 * - **A service quorum.** {setLeaves} for trees 5 and 6, {setAccountStates} for tree 1: at least
 *   `threshold[treeId]` approvals from members holding `writerRole[treeId]`, each an ML-DSA-87 vote over
 *   a digest binding the tree, its nonce and the whole batch. Tree 1's round additionally carries each
 *   member's SLH-DSA seal, because a leaf there states who an account IS on every chain.
 * - **A typed writer.** Trees 2, 3 and 4 are reachable only through {writeTyped}, from the records
 *   contract, which holds the preimage behind each leaf and computes the hash from it. {setLeaves}
 *   refuses those three outright, so a stored value can never drift from the commitment beside it.
 * - **A writer contract.** `treeWriter[treeId]` writes its tree with no quorum at all: the account ledger
 *   for tree 1, the intent log for tree 7, the ledger again for tree 8's user admissions. Trees 7 and 8
 *   have no quorum path whatsoever — {setLeaves} refuses both.
 * - **The configuration authority.** Branch 0 of every tree through {setConfig}, plus the pointers,
 *   rosters and thresholds themselves. Never a tree's own writer or quorum: what a service states is not
 *   authority over how that service is configured.
 *
 * `treeWriter[1]` being the account ledger, with no service quorum layered on top, is the design and not
 * a gap. A writer contract is not a key: its rules are its bytecode, it has no owner and no proxy, and it
 * authorizes every transition by verifying the ACCOUNT HOLDER'S own SLH-DSA credential against the
 * commitment this chain holds. That is stronger evidence than a K-of-N of our own services attesting to
 * what they read. A quorum on top would be strictly worse than nothing — it would let operators withhold
 * approval from a user rotating a stolen key, which is a censorship power over the exact operation the
 * account plane exists to make possible.
 *
 * ## Seeding the chain and asset trees
 *
 * Trees 5 and 6 are the two a fresh plane cannot infer. Tree 5 carries the settlement chain and asset
 * registry roots; tree 6 carries the allowlist those roots stand over — supported chains, supported
 * assets, policy, price sources, DEX deployments. Both are quorum-written, and both are expected to be
 * SEEDED before the plane is usable: an execution chain copies its chain set and its asset set from these
 * roots, so an unseeded pair means every settlement toward a chain is refused at the source and no vAsset
 * ever registers. A test plane seeds the test chains; a production plane seeds the production chains and
 * their assets. `chainSource` belongs in the same window, because `syncIdentities` derives a service
 * account's `deployedChains` table from the enabled chain set, and an unset source quietly produces
 * service leaves that exist on Final Chain alone.
 *
 * The bootstrap ordering is load bearing in one more place: {configureTree} refuses a threshold no live
 * roster can meet, so members are registered first and trees configured after. A plane whose trees were
 * never configured accepts no quorum write at all while looking perfectly healthy from outside.
 *
 * ## The hash shape is not a choice
 *
 * Leaves hash as `keccak256(0x00 ‖ leaf)` and internal nodes as
 * `keccak256(0x01 ‖ lo ‖ hi)` with the pair sorted. That is
 * `FinalMerkle.verifyTaggedSortedProof`, verbatim, which is what
 * `FinalWalletFactory.syncAccountState` and `FinalSettlement` already run on
 * every supported chain. A proof produced here is consumed there with no
 * translation and no contract change, and tree 1's leaf preimage is exactly
 * `FinalWalletFactory.accountStateLeafHash` — same fields, same order, the
 * `deployedChains` table `abi.encode`d like every other field.
 *
 * Getting this wrong is not a compile error anywhere. It is a root every chain
 * silently rejects, with nothing pointing at the cause.
 *
 * ## Positional slots under a sorted-pair tree
 *
 * Sorted pairs make a proof position-agnostic, which is why it carries no
 * direction bits. That does not stop the TREE from being positional, and here
 * it is: every key gets a permanent slot, so a single leaf update is `DEPTH`
 * hashes instead of a rebuild over every leaf. The verifier neither knows nor
 * needs to know that a slot exists.
 *
 * ## Branches
 *
 * The slot space of every tree is cut into `BRANCH_COUNT` branches by the top
 * `BRANCH_BITS` of the slot: a branch is a subtree with a permanent place, its
 * root is one internal node, and a leaf's path to the tree root passes through
 * it. Branches hold what belongs to the same domain but not to the same rows
 * — branch 0 is the owning service's CONFIGURATION on every tree, tree 8 adds
 * the owner → wallets index and the co-signers' slot keys beside the admission
 * set — and they are chosen over more trees because a branch shares its
 * tree's authority doors and writer, while a tree would need its own. A leaf
 * proves against its branch root with `BRANCH_DEPTH` siblings, against the
 * tree root with `DEPTH`, against the round root with `ROUND_DEPTH`: one path,
 * cut at three heights, one verifier.
 *
 * ## Rounds, and why the live roots are not the product
 *
 * `setLeaves` moves a tree. It does not publish one. A consumer that fetched
 * eight roots one at a time would get a price proof from one moment and a
 * roster proof from another, and something delisted in between would still
 * verify.
 *
 * `publishRound` snapshots all eight together, and folds them into ONE round
 * root — the tree roots as the level-`DEPTH` nodes of a depth-`ROUND_DEPTH`
 * tree, tree `t` at position `t` — so a single word commits to the whole
 * plane and any leaf in it proves against that word with four more siblings.
 * A round is the unit a consumer pins, and it is the only thing this contract
 * promises is contemporaneous. The execution chains keep anchoring per-tree
 * roots (identity, account state, registry roots): those must move at their
 * own cadence, not at the oracle's.
 */
contract FinalStateTrees is FinalPlaneSweep, FinalChainInitializable {
    // ---------------------------------------------------------------- trees

    /// @notice Every Final Wallet's public state. The source of truth other
    /// chains copy through `syncAccountState`.
    uint8 public constant TREE_ACCOUNTS = 1;
    /// @notice The PHI record, per `(wallet, chain)`: balances, the lock, its
    /// terms, the exposures carved from it and the accrual between reconciliations.
    uint8 public constant TREE_PHI = 2;
    /// @notice vAsset supply and backing.
    uint8 public constant TREE_VASSET = 3;
    /// @notice Oracle prices and their inputs.
    uint8 public constant TREE_ORACLE = 4;
    /// @notice Settlement chain and asset registry roots.
    uint8 public constant TREE_SETTLEMENT = 5;
    /// @notice Which assets and chains are supported.
    uint8 public constant TREE_ALLOWLIST = 6;
    /// @notice Intent status, keyed by a RING over the posting sequence.
    /// @dev The search structure beside `FinalBundleLog`'s permanent record.
    /// Written only by `FinalIntentLog` through `treeWriter[7]` — the tree-1
    /// argument verbatim: the log verified the bond, the commitment, the
    /// approval and the consume itself, and a service quorum on top would be a
    /// censorship point over posting. Slots are permanent and intents are
    /// unbounded flow, so the log recycles keys modulo `CAPACITY`: the tree is
    /// an index with a ~1M-posting retention window, never the record.
    uint8 public constant TREE_INTENTS = 7;
    /// @notice The wallet-creation admission set — the identity leaves
    /// (`keccak256(DOMAIN_IDENTITY_LEAF ‖ serial ‖ keysHash)`) every execution
    /// chain's gateway verifies certificates against.
    /// @dev The root the gateways anchor as `currentIdentityRoot`, CONTINUOUS
    /// over this tree: an admission or a revocation is live the moment it
    /// lands here, with no off-chain folding step standing between the two.
    /// Two feeders, one per identity plane, and NO quorum door for either:
    ///
    /// - SERVICE identities: {syncIdentityLeaves}, the permissionless
    ///   projection of `FinalIdentityRegistry`'s own verdict — the registry
    ///   calls it same-tx on every identity mutation, and anyone may call it
    ///   to retire a leaf whose standing lapsed by TIME (expiry moves no
    ///   registry storage, so only a projection pass can zero it).
    /// - USER identities: `treeWriter[8]` — `FinalAccountLedger`, which
    ///   computes the leaf from the genesis certificate fields it verified
    ///   under its opener quorum and writes it once at `openAccount`. A user
    ///   admission leaf is permanent by construction: the certificate IS the
    ///   address, rotation never changes it, and a post-rotation creation on
    ///   a new chain reads PUBLISHED account state out of tree 1, never the
    ///   certificate's genesis keys.
    ///
    /// A quorum of service signatures must not be able to state an identity
    /// neither ruler decided, so `setLeaves` refuses this tree outright.
    uint8 public constant TREE_IDENTITY = 8;
    /// @notice Count, for iteration. Trees are 1-indexed; 0 is not a tree.
    /// @notice Tree 9 — compliance: the approved set (branch 1), revocations (2), per-jurisdiction
    ///         counters (3) and minutes-lived action attestations (4); branch 0 pins the jurisdiction
    ///         policy in force and the attestation life. Typed-only: `FinalStateRecords` writes it under
    ///         the REGISTRAR quorum (an attestation is an admission) through `writeTypedInBranch`, and
    ///         the presale ledger mirrors its counters through the same companion; no `setLeaves` door
    ///         — no set of service signatures may attest what the provider and the screening did not
    ///         decide. Leaves are `FinalComplianceLeaves`; nothing in them names a person.
    uint8 public constant TREE_COMPLIANCE = 9;
    /// @notice Number of trees. The round root has room for 2**FOREST_BITS; a new tree is a redeploy.
    uint8 public constant TREE_COUNT = 9;

    /// @notice Tree height: 2^`DEPTH` slots per tree, laid out as 16 BRANCHES
    /// of 2^20. The top `BRANCH_BITS` of a slot name the branch, the rest its
    /// position inside it.
    /// @dev FIXED, and baked into every root this contract produces. A tree is
    /// padded to this height with the empty-subtree hash whether it holds one
    /// leaf or a million, which is why an off-chain rebuild must use this
    /// depth verbatim: a `log2(n)` tree over the same leaves is a different
    /// tree and proves nothing here. Raising it is a migration and not a
    /// parameter change — every outstanding proof and every root anchored on
    /// another chain would have to be replaced in the same instant.
    uint256 public constant DEPTH = 24;
    /// @notice How many of a slot's top bits name the branch it lives in.
    /// @dev `BRANCH_COUNT` is `1 << BRANCH_BITS` and `BRANCH_DEPTH` is
    /// `DEPTH - BRANCH_BITS`; the three move together, or the branch a slot
    /// belongs to stops matching the subtree its proof passes through.
    uint256 public constant BRANCH_BITS = 4;
    /// @notice Branches per tree. Ids run `0 .. BRANCH_COUNT - 1`.
    /// @dev Sixteen is deliberately generous: an unused branch costs only the
    /// empty-subtree hash it contributes, so a domain can grow a new family of
    /// rows without a new tree, a new writer or a new authority.
    uint8 public constant BRANCH_COUNT = 16;
    /// @notice Height of a branch: a leaf proves against its branch root with
    /// this many siblings.
    uint256 public constant BRANCH_DEPTH = DEPTH - BRANCH_BITS;
    /// @notice Slots per branch.
    /// @dev The hard ceiling `_set` enforces: a branch that runs out of slots
    /// reverts `BranchFull` rather than spilling into its neighbour, because a
    /// key in the wrong branch would prove against the wrong branch root.
    uint256 public constant BRANCH_CAPACITY = 1 << BRANCH_DEPTH;
    /// @notice Slots per tree, all branches together.
    uint256 public constant CAPACITY = 1 << DEPTH;
    /// @notice How many of the round root's levels sit above the tree roots.
    /// @dev The round root is a tree over the tree roots — position `t` holds
    /// tree `t`'s root, positions 0 and 9..15 the empty tree — folded with the
    /// same node hash. It is literally the root of a depth-`ROUND_DEPTH` tree
    /// whose level-`DEPTH` nodes are the eight tree roots, which is what lets
    /// one path prove a leaf against it.
    uint256 public constant FOREST_BITS = 4;
    /// @notice Height of the round tree: a leaf proves against a round root
    /// with this many siblings, the last `FOREST_BITS` of them from
    /// {roundProofFor}.
    uint256 public constant ROUND_DEPTH = DEPTH + FOREST_BITS;

    /// @notice Branch 0 of EVERY tree: the configuration of the service that
    /// owns the tree — key → one word, the VALUE stored so a contract on this
    /// chain reads it directly (`configValue`), the hash in the tree so it is
    /// provable wherever a round root is. Written only by {setConfig} under
    /// the configuration authority; every other door refuses the branch.
    uint8 public constant BRANCH_CONFIG = 0;
    /// @notice Branch 1 of every tree: the domain's own rows — accounts, PHI
    /// records, vAssets, prices, registry roots, the allowlist, the intent
    /// ring, the identity admission set.
    uint8 public constant BRANCH_MAIN = 1;
    /// @notice Tree 8, branch 2: the owner → wallets index. Key = the owner
    /// (`ownerIndexKeyFor`), leaf = {ownerIndexLeafHash} over the ledger's
    /// `walletsByOwner(owner)`. Written by tree 8's writer, the ledger, beside
    /// every open and every owner transfer — the tree is the search structure,
    /// the ledger holds the readable array it proves.
    uint8 public constant BRANCH_OWNER_INDEX = 2;
    /// @notice Tree 8, branch 3: the co-signers' per-slot KEM publics — a RING
    /// of `SLOT_KEY_RING` positions per member, projected from
    /// `slotKeySource` by {syncSlotKeyLeaves} exactly as identities are.
    uint8 public constant BRANCH_SLOT_KEYS = 3;
    /// @notice Tree 8, branch 4: the tunnel endpoints — the Final Node
    /// identities a wallet's FNP session terminates at. Key = the endpoint id
    /// (`endpointKeyFor`, the certificate's subject key id), leaf = the
    /// endpoint registry's verdict, projected from `endpointSource` by
    /// {syncEndpointLeaves} exactly as slot keys are. An execution chain never
    /// parses an endpoint certificate; it anchors this tree's root and a client
    /// proves the leaf against it.
    uint8 public constant BRANCH_ENDPOINTS = 4;
    /// @notice Slot-key positions per member. A slot index wraps modulo this,
    /// so the branch is an index over the recent slots and never fills; 1024
    /// members × 1024 positions is the branch exactly.
    uint64 public constant SLOT_KEY_RING = 1024;

    /// @notice The domain every tree-1 leaf is hashed under.
    /// @dev Must equal `FinalWalletFactory.DOMAIN_ACCOUNT_STATE_LEAF` byte for
    /// byte, and the leaf's fields must be encoded in the same order on both
    /// sides. A field reordered on one side only is not a compile error
    /// anywhere: it is a root every execution chain rejects, with nothing
    /// pointing at the cause.
    ///
    /// The version suffix is part of the domain, so a leaf built under a
    /// different account-state shape hashes into a different domain and cannot
    /// verify against this one by accident.
    bytes32 public constant DOMAIN_ACCOUNT_STATE_LEAF =
        keccak256("FINAL_ACCOUNT_STATE_LEAF_v03");

    /// @dev The quorum action every leaf write is approved under — {setLeaves},
    /// {setAccountStates} and {writeTyped} share it, so a member recomputes one
    /// digest whichever door a batch came through and there is no second
    /// approval shape to get wrong.
    bytes32 private constant ACTION_SET_LEAVES = keccak256("FinalStateTrees.setLeaves.v01");
    /// @notice Configuration action: set a tree's writer role and threshold.
    /// @dev Registrar-quorum actions, verified by the registry with this
    /// contract as the verifying contract. See `FinalIdentityRegistry.requireRegistrarQuorum`.
    bytes32 public constant ACTION_CONFIGURE_TREE = keccak256("FINAL_STATE_TREES_CONFIGURE_TREE_v01");
    /// @notice Configuration action: point a tree at its writer contract.
    bytes32 public constant ACTION_SET_TREE_WRITER = keccak256("FINAL_STATE_TREES_SET_TREE_WRITER_v01");
    /// @notice Configuration action: point `syncIdentities` at the chain set.
    bytes32 public constant ACTION_SET_CHAIN_SOURCE = keccak256("FINAL_STATE_TREES_SET_CHAIN_SOURCE_v01");
    /// @notice Configuration action: point tree 8's branch 3 at the slot-key registry.
    bytes32 public constant ACTION_SET_SLOT_KEY_SOURCE = keccak256("FINAL_STATE_TREES_SET_SLOT_KEY_SOURCE_v01");
    /// @notice Configuration action: point tree 8's branch 4 at the endpoint registry.
    bytes32 public constant ACTION_SET_ENDPOINT_SOURCE = keccak256("FINAL_STATE_TREES_SET_ENDPOINT_SOURCE_v01");
    /// @notice Configuration action: adopt a preceding plane's version and round counters.
    bytes32 public constant ACTION_SEED_COUNTERS = keccak256("FINAL_STATE_TREES_SEED_COUNTERS_v01");
    /// @notice Configuration action: install the records contract that writes the typed trees.
    bytes32 public constant ACTION_SET_TYPED_WRITER = keccak256("FINAL_STATE_TREES_SET_TYPED_WRITER_v01");
    /// @notice Configuration action: write rows into a tree's branch 0.
    bytes32 public constant ACTION_SET_CONFIG = keccak256("FINAL_STATE_TREES_SET_CONFIG_v01");

    /// @dev Tree-1 key domain. A full-width hash rather than the packed address
    /// it came from, which matters: an address key occupies only the low 160
    /// bits, so a hashed key colliding with one needs ~2^96 work rather than a
    /// full collision. That is expensive but not comfortable, and the
    /// consequence would be a service identity landing in a wallet's slot.
    bytes32 private constant DOMAIN_ACCOUNT_KEY = keccak256("FinalStateTrees.key.account.v01");
    /// @dev Tree-8 admission key domain, separated from the tree-1 domain for
    /// the same reason: one account's two keys must never be the same word.
    bytes32 private constant DOMAIN_IDENTITY_TREE_KEY = keccak256("FinalStateTrees.key.identity.v01");
    /// @dev Tree 8, branches 2 and 3, and branch 0 of every tree. Each is its
    ///      own domain so a key can never land in another branch's slot by
    ///      construction — `_set` refuses a key whose slot sits in a different
    ///      branch, and the domain is what makes that refusal unreachable.
    bytes32 private constant DOMAIN_OWNER_INDEX_KEY = keccak256("FinalStateTrees.key.ownerIndex.v01");
    /// @dev Tree 8, branch 3: one key per `(member, ring position)` pair.
    bytes32 private constant DOMAIN_SLOT_KEY = keccak256("FinalStateTrees.key.slotKey.v01");
    /// @dev Tree 8, branch 4: one key per tunnel endpoint id.
    bytes32 private constant DOMAIN_ENDPOINT_KEY = keccak256("FinalStateTrees.key.endpoint.v01");
    /// @dev Branch 0 of every tree: one key per `(name, sub)` configuration row.
    bytes32 private constant DOMAIN_CONFIG_KEY = keccak256("FinalStateTrees.key.config.v01");

    /// @notice Leaf domain for the owner index in tree 8, branch 2.
    /// @dev Separate from the key domain above so the leaf and the slot it
    /// occupies can never be confused for one another by a reader that has
    /// only one of the two.
    bytes32 public constant DOMAIN_OWNER_INDEX_LEAF = keccak256("FINAL_OWNER_INDEX_LEAF_v01");
    /// @notice Leaf domain for configuration rows in branch 0 of every tree.
    /// @dev The leaf binds the tree id as well as the key and value, so the
    /// same row written into two trees produces two different leaves and a
    /// proof cannot be carried from one tree's branch 0 to another's.
    bytes32 public constant DOMAIN_CONFIG_LEAF = keccak256("FINAL_CONFIG_LEAF_v01");

    // -------------------------------------------------------------- storage

    /// @notice The registry every signer is resolved through. Immutable so the
    /// quorum can never be pointed at a registry supplied in calldata.
    FinalIdentityRegistry public immutable registry;

    /// @notice Approvals required per tree.
    ///
    /// @dev Per-tree and not a scalar, because each tree is gated by a
    ///      DIFFERENT role — account co-signers, PHI, vAsset and oracle
    ///      publishers, registry publishers — so K is a property of that
    ///      tree's roster, not of the contract. All six read 2 today; that is
    ///      a deploy-time default, not an invariant, and collapsing them would
    ///      put the oracle roster's quorum on the account co-signers'.
    ///
    ///      The VALUE is a full word: it is a quantity compared against a live
    ///      member count, and every other threshold in the system is `uint256`.
    ///      The KEY is `uint8` because that is what a tree id is here — six
    ///      `uint8` constants, every parameter, every event, every error,
    ///      `_assertTree`, and the ten sibling mappings below. Widening it
    ///      would buy nothing (a narrow key is padded to 32 bytes before
    ///      hashing, so the slot is identical) and cost the getter's selector
    ///      on a contract that is live on both Final Chains.
    mapping(uint8 treeId => uint256) public threshold;
    /// @notice Role a signer must hold to write to a tree.
    mapping(uint8 treeId => uint256) public writerRole;

    /// @notice Raw (untagged) leaf value by tree and slot.
    /// @dev The tag is applied when the leaf is hashed, never when it is
    ///      stored, so what a caller wrote is what {leafOf} hands back.
    mapping(uint8 => mapping(uint256 => bytes32)) private _leaf;
    /// @notice Internal nodes, levels 1..`DEPTH`, by tree, level and index.
    /// @dev Level 0 is DERIVED from `_leaf` rather than duplicated here, so a
    ///      leaf lives in exactly one place and the two can never disagree. An
    ///      unwritten position reads zero and falls through to `_zero[level]`.
    mapping(uint8 => mapping(uint256 => mapping(uint256 => bytes32))) private _node;
    /// @notice Empty-subtree hash per level, computed once at construction.
    /// @dev Sized to the ROUND root's height, not the tree's, because the
    ///      round tree's unused positions are themselves empty trees. Built in
    ///      the constructor rather than declared as constants: it depends on
    ///      the tagging, and a constant table that drifted from the tagging
    ///      would produce roots nothing can verify, silently, since both sides
    ///      would still be internally consistent.
    bytes32[ROUND_DEPTH + 1] private _zero;

    /// @notice Permanent slot for a key, stored 1-based so 0 means unassigned.
    /// @dev The slot's top `BRANCH_BITS` are the branch the key lives in, and
    ///      the assignment is permanent: a key handed a slot keeps it for the
    ///      life of the contract. This is what makes an update `DEPTH` hashes
    ///      rather than a rebuild, and what makes the tree insertion-ordered.
    mapping(uint8 => mapping(bytes32 => uint256)) private _slotPlusOne;
    /// @notice The key a slot was handed to — the reverse of `_slotPlusOne`.
    /// @dev Lets any branch enumerate on chain ({keyAt} over
    ///      `0 .. branchSlotsUsed`) with no log window and no indexer. Costs
    ///      one extra word per NEW key, never one per update.
    mapping(uint8 => mapping(uint256 => bytes32)) private _keyAt;
    /// @notice Slots handed out per tree, all branches together.
    mapping(uint8 => uint256) public slotsUsed;
    /// @notice Slots handed out per branch — the next free position in it.
    /// @dev Per branch and not per tree, because a branch is a fixed region of
    ///      the slot space: positions are allocated from the branch's own base
    ///      so a key can never be handed a slot outside the branch it belongs
    ///      to, and `BranchFull` is raised rather than spilling into the next.
    mapping(uint8 => mapping(uint8 => uint256)) private _branchSlotsUsed;
    /// @notice The VALUE behind a configuration row (branch 0), by tree and key.
    /// @dev Kept beside the leaf hash so a contract on this chain reads the row
    ///      directly through {configValue} while the same row stays provable
    ///      off chain against a round root — one source for the fleet, the
    ///      contracts and any explorer, rather than one per reader.
    mapping(uint8 => mapping(bytes32 => bytes32)) private _configValue;

    /// @notice Live root per tree. Moves on every `setLeaves`.
    mapping(uint8 treeId => bytes32) public liveRoot;
    /// @notice Writes applied per tree, for change detection between rounds.
    mapping(uint8 treeId => uint64) public treeVersion;

    /// @notice A contemporaneous snapshot of all eight roots, and the one
    /// round root that folds them.
    struct Round {
        /// @dev Live root per tree at the instant of the snapshot, indexed by
        ///      the `TREE_*` constants. Index 0 is unused, so a tree id needs
        ///      no translation.
        bytes32[TREE_COUNT + 1] roots;
        /// @dev The single word committing to all eight — the roots folded as
        ///      the level-`DEPTH` nodes of a depth-`ROUND_DEPTH` tree.
        bytes32 roundRoot;
        /// @dev Block the snapshot was taken in, for a consumer reconciling a
        ///      round against chain history.
        uint64 blockNumber;
        /// @dev Snapshot instant in MILLISECONDS, like every instant on this
        ///      chain, so a reader never has to guess the unit.
        uint64 timestamp;
    }

    /// @notice Published rounds, 1-indexed. Round 0 is "nothing published".
    /// @dev Kept forever: a consumer pinning an old round can still fetch the
    ///      roots it verified against. Only rounds this deployment published
    ///      are here — {seedCounters} moves the counter, never the history.
    mapping(uint64 => Round) private _rounds;
    /// @notice Highest published round.
    uint64 public round;
    /// @notice Tree versions as of the last published round.
    /// @dev The change detector {publishRound} reads: a round that would carry
    ///      nothing new is refused, so the round number cannot be advanced by
    ///      anyone with gas to spend.
    mapping(uint8 => uint64) private _publishedVersion;

    /// @notice Per-tree nonce, bound into every quorum digest.
    mapping(uint8 treeId => uint64) public nonce;

    /**
     * @notice A CONTRACT allowed to write one tree without a quorum.
     *
     * @dev Exactly one per tree, and today exactly one exists: tree 1's is
     * `FinalAccountLedger`.
     *
     * This looks like a hole and is the opposite. The quorum on `setLeaves`
     * exists because a tree's writer is otherwise one key deciding what the
     * chain states. A writer contract is not a key — its rules are its
     * bytecode, it has no owner and no proxy, and tree 1's writer authorizes
     * every change by verifying the ACCOUNT HOLDER'S own post-quantum signature
     * in this chain's precompiles. That is strictly stronger evidence than a
     * K-of-N of our own services attesting to what they read.
     *
     * Keeping the quorum on top of it would be actively worse: our fleet could
     * then withhold approval from a user rotating a stolen key, which is a
     * censorship power over the exact operation the account plane exists to
     * make possible.
     *
     * The writer is set on the same bootstrap window as `configureTree` and can
     * be moved by a registrar afterwards — an immutable pointer would mean a
     * ledger upgrade abandons the tree it writes.
     */
    mapping(uint8 treeId => address) public treeWriter;

    /**
     * @notice Where `syncIdentities` reads the chain set from — the asset
     *         registry, which is also tree 6's writer.
     *
     * @dev A service identity is a Final Wallet whose address is the same on
     * every EVM chain, so its tree-1 `deployedChains` table is derivable: one
     * `(chainRef, itself)` row per chain the registry has enabled. The table
     * is DERIVED from state rather than supplied by the caller precisely so
     * that `syncIdentities` can stay permissionless — a caller-chosen table
     * would let anyone place a service identity on a chain of their choosing.
     *
     * Unset (zero) means services carry an empty table and exist on Final
     * Chain alone, which is what a plane looks like before its registry is
     * seeded. Same configuration gate as `setTreeWriter`, because pointing this
     * at a different contract changes what every service leaf says.
     */
    address public chainSource;
    /// @notice Where {syncSlotKeyLeaves} reads the co-signers' slot keys from
    ///         — the slot-key registry, whose verdict tree 8's branch 3
    ///         projects. Same configuration gate as `chainSource`; unset means
    ///         the branch cannot be written.
    address public slotKeySource;
    /// @notice The endpoint registry whose verdict tree 8's branch 4 projects.
    address public endpointSource;
    /// @notice The one contract admitted to {writeTyped}: `FinalStateRecords`,
    ///         which holds the preimages behind trees 2, 3 and 4 and computes
    ///         their keys and hashes. Same configuration gate as `treeWriter`.
    address public typedWriter;

    // --------------------------------------------------------------- events

    /// @notice A batch of leaves landed in a tree and moved its live root.
    /// @dev Emitted once per write door call, not once per leaf, and always
    ///      after the root has settled — so `newRoot` is the value {liveRoot}
    ///      answers from that block onward.
    /// @param treeId The tree that moved.
    /// @param count Leaves in the batch. Zero is possible for an empty call.
    /// @param newRoot The tree's live root after the batch.
    /// @param treeVersion The tree's write counter after the batch.
    event LeavesSet(uint8 indexed treeId, uint256 count, bytes32 newRoot, uint64 treeVersion);
    /// @notice Every tree's root was snapshotted into a new round.
    /// @param round The round number, one above its predecessor.
    /// @param blockNumber Block the snapshot was taken in.
    /// @param timestamp Snapshot instant, in milliseconds.
    event RoundPublished(uint64 indexed round, uint64 blockNumber, uint64 timestamp);
    /// @notice A tree's writer role and approval threshold were installed.
    /// @param treeId The tree configured.
    /// @param writerRole Role a signer must hold to approve a write to it.
    /// @param threshold Approvals a write needs; zero leaves the tree closed.
    event TreeConfigured(uint8 indexed treeId, uint256 writerRole, uint256 threshold);
    /// @notice A tree's quorum-free writer contract was installed or moved.
    /// @param treeId The tree whose writer changed.
    /// @param writer The contract now allowed to write it; zero removes the path.
    event TreeWriterSet(uint8 indexed treeId, address writer);
    /// @notice The contract `syncIdentities` reads the enabled chain set from was set.
    /// @param source The asset registry now consulted; zero means no chain set.
    event ChainSourceSet(address source);
    /// @notice The registry tree 8's branch 3 projects slot keys from was set.
    /// @param source The slot-key registry now consulted; zero closes the branch.
    event SlotKeySourceSet(address source);
    /// @notice The registry tree 8's branch 4 projects endpoints from was set.
    /// @param source The endpoint registry now consulted; zero closes the branch.
    event EndpointSourceSet(address source);
    /// @notice A fresh plane adopted a preceding plane's counters.
    /// @dev Carries the counters only. The roots behind those rounds stay with
    ///      the plane that published them, so {roundRootAt} below the seed
    ///      answers zero on this one.
    /// @param round The round number this plane continues from.
    /// @param versions Per-tree write counters, indexed by tree id; index 0 unused.
    event CountersSeeded(uint64 round, uint64[] versions);
    /// @notice The records contract admitted to the typed trees was installed.
    /// @param writer The contract now allowed through {writeTyped}.
    event TypedWriterSet(address writer);
    /// @notice One configuration row was written into a tree's branch 0.
    /// @param treeId The tree whose owning service the row configures.
    /// @param key The row's branch-0 key, as {configKey} computes it.
    /// @param value The row's single word of value.
    event ConfigSet(uint8 indexed treeId, bytes32 indexed key, bytes32 value);

    // --------------------------------------------------------------- errors

    /// @notice A tree id outside `1 .. TREE_COUNT` was supplied. Zero is not a tree.
    /// @param treeId The rejected id.
    error UnknownTree(uint8 treeId);
    /// @notice Two parallel arrays did not have the same length, or a batch was empty
    ///         where at least one row is required.
    /// @param keys Length of the key array.
    /// @param leaves Length of the value array.
    error LengthMismatch(uint256 keys, uint256 leaves);
    /// @notice A branch has handed out every slot it owns and cannot take a new key.
    /// @dev Raised rather than spilling into the neighbouring branch: a key in
    ///      the wrong branch would prove against the wrong branch root.
    /// @param treeId The tree the branch belongs to.
    /// @param branch The exhausted branch.
    error BranchFull(uint8 treeId, uint8 branch);
    /// @notice A branch id at or above `BRANCH_COUNT` was supplied.
    /// @param branch The rejected id.
    error UnknownBranch(uint8 branch);
    /// @notice A key already holds a slot in another branch of this tree.
    /// @dev Slots are permanent, so a key cannot be moved between branches.
    ///      Reaching this means two callers disagree about where a row lives.
    /// @param treeId The tree involved.
    /// @param key The key whose slot is already assigned.
    /// @param have The branch the key's slot actually sits in.
    /// @param want The branch the caller tried to write it into.
    error BranchMismatch(uint8 treeId, bytes32 key, uint8 have, uint8 want);
    /// @notice Branch 0 is written by `setConfig` alone.
    /// @dev Every other door refuses it, so a tree's writer or quorum can never
    ///      restate the configuration of the service that feeds it.
    /// @param treeId The tree whose branch 0 was targeted.
    error ConfigBranchReserved(uint8 treeId);
    /// @notice Tree 8's branch 3 was written while no slot-key registry is installed.
    error SlotKeySourceUnset();
    /// @notice Tree 8's branch 4 was written while no endpoint registry is installed.
    error EndpointSourceUnset();
    /// @notice Counters can be seeded only into a plane that has published nothing.
    /// @dev Seeding a plane that already moved would rewind counters consumers
    ///      have compared against, so it is refused rather than reconciled.
    error NotFresh();
    /// @notice The seeded version array was not one entry per tree plus the unused index 0.
    /// @param given The length supplied.
    error VersionCountMismatch(uint256 given);
    /// @notice The tree has no threshold installed, so no quorum write can be authorized.
    /// @param treeId The unconfigured tree.
    error TreeNotConfigured(uint8 treeId);
    /// @notice A round was requested while no tree has moved since the last one.
    /// @dev The round number is therefore not advanceable by anyone with gas
    ///      to spend, and a round always means something changed.
    error NothingToPublish();
    /// @notice The key holds no slot in this tree, so there is nothing to prove or read.
    /// @param treeId The tree searched.
    /// @param key The key with no slot.
    error UnknownKey(uint8 treeId, bytes32 key);
    /// @notice The caller is not the writer seat or typed writer this door requires.
    /// @param caller The rejected address.
    error NotAuthorized(address caller);
    /// @notice A round was asked for on a plane that has published none, or one above the latest.
    error NoRounds();
    /// @notice A threshold was configured above the number of members who could meet it.
    /// @dev Refused at configuration time so a tree is never installed already
    ///      unwritable. Register the roster first; that ordering is the point.
    ///      Revocation can still walk a live tree into this state later, which
    ///      is what {quorumHealth} exists for — revocation must never be
    ///      blocked on quorum arithmetic.
    /// @param treeId The tree being configured.
    /// @param live Members currently holding the role.
    /// @param required Approvals the rejected configuration would demand.
    error ThresholdUnreachable(uint8 treeId, uint256 live, uint256 required);
    /// @notice Trees 7 and 8 take no quorum writes — only their writer
    /// contract (and, for tree 8, the registry projection).
    /// @dev An intent's status is what the intent log verified and an identity
    ///      is what the registry or the ledger verified. No set of service
    ///      signatures can make a different answer true, so there is no quorum
    ///      door to refuse at — the door does not exist.
    /// @param treeId The writer-only tree a quorum write was aimed at.
    error WriterOnlyTree(uint8 treeId);
    /// @notice `setLeaves` was called on a tree that has a typed writer.
    /// @dev Trees 2, 3 and 4 keep the leaf's preimage beside its hash so a
    ///      consumer can read the VALUE. An untyped write sets the hash and
    ///      cannot set the preimage — the pair would disagree, and the stored
    ///      value would look authoritative while committing to nothing. The
    ///      typed entrypoint is not a convenience over this one; it is the
    ///      only door.
    /// @param treeId The typed tree an untyped write was aimed at.
    error TypedTreeOnly(uint8 treeId);
    /// @notice A `deployedChains` row names the zero chain or the zero account,
    ///         or repeats a chain. A table with either proves nothing about
    ///         where the account exists.
    /// @dev Checked wherever the leaf is hashed, so no door — quorum, writer
    ///      contract, identity projection — can publish a table a resolver on
    ///      another chain would read two ways.
    /// @param chainRef The offending row's chain reference.
    /// @param account The offending row's account on that chain.
    error InvalidChainAccount(bytes32 chainRef, bytes32 account);

    // ---------------------------------------------------------- constructor

    /**
     * @notice Pin the identity registry and bring all eight trees up empty.
     * @param registry_ The identity registry. Every signer, key and role is
     *        resolved through it.
     * @dev The registry is `immutable`, so no later call can point the quorum
     * at a registry supplied in calldata — a roster chosen by the caller is a
     * roster that approves whatever the caller wants.
     *
     * The empty-subtree table is built here rather than as constants because it
     * depends on the tagging, and a constant table that drifted from the
     * tagging would produce roots nothing can verify — silently, since both
     * sides would still be self-consistent.
     *
     * Every tree starts at the empty root rather than zero, so a consumer can
     * tell "this tree holds nothing" from "this contract has never run".
     */
    constructor(FinalIdentityRegistry registry_) {
        registry = registry_;
        _setUp();
    }

    /**
     * @notice The constructor's storage writes, for a deployment behind `FinalChainProxy`: the proxy's
     *         constructor runs this once in the proxy's storage. Reverts `AlreadyInitialized` on a direct
     *         deploy (its constructor ran it) and on a second call.
     */
    function initialize() external {
        _setUp();
    }

    /// @dev The empty-subtree ladder and every tree's empty root — storage, so a proxy needs it replayed.
    function _setUp() internal initializer {
        // Level 0: the tagged hash of an empty (zero) leaf.
        _zero[0] = keccak256(abi.encodePacked(bytes1(0x00), bytes32(0)));
        for (uint256 l = 0; l < ROUND_DEPTH; l++) {
            // Both children equal, so the sort is a no-op and the order is
            // irrelevant — which is the only reason this table is one value per
            // level rather than one per position.
            _zero[l + 1] = keccak256(abi.encodePacked(bytes1(0x01), _zero[l], _zero[l]));
        }

        for (uint8 t = 1; t <= TREE_COUNT; t++) {
            liveRoot[t] = _zero[DEPTH];
        }
    }

    // ------------------------------------------------------- configuration

    /**
     * @notice The gate every configuration entrypoint on this contract passes through.
     * @dev The registry's bootstrap admin alone while its window is open, the
     * sealed `ROLE_REGISTRAR` quorum afterwards. The same window the registry
     * uses, for the same reason — every roster has to be installed by someone
     * before it can install itself — and the same quorum, because a threshold
     * is membership by another name: whoever can set K to one owns the tree.
     *
     * Not `view`: the registrar path burns the registry's own nonce, so an
     * approved configuration payload cannot be replayed at a later block.
     * @param actionDomain The `ACTION_*` constant naming what is being configured.
     * @param payloadDigest Hash of the arguments this call would apply.
     * @param anchorBlock The registrars' roster anchor. Ignored during bootstrap.
     * @param approvals The sealed registrar quorum. Empty during bootstrap.
     */
    function _requireConfigurationAuthority(
        bytes32 actionDomain,
        bytes32 payloadDigest,
        uint64 anchorBlock,
        FinalPqQuorum.Approval[] calldata approvals
    ) private {
        if (!registry.bootstrapSealed() && msg.sender == registry.bootstrapAdmin()) return;
        registry.requireRegistrarQuorum(actionDomain, payloadDigest, anchorBlock, approvals);
    }

    /**
     * @notice Set which role may write a tree and how many approvals it needs.
     * @dev The configuration authority, never the tree's own quorum: a roster
     * that could raise or lower its own threshold is a roster with no
     * threshold. A tree left at `k == 0` refuses every quorum write with
     * `TreeNotConfigured`, which is the state a fresh plane starts in.
     * @param treeId The tree being configured.
     * @param role Role a signer must hold for an approval to count.
     * @param k Approvals a write needs; `0` leaves the tree unconfigured.
     * @param anchorBlock The registrars' roster anchor. Ignored during bootstrap.
     * @param approvals The sealed registrar quorum. Empty during bootstrap.
     */
    function configureTree(
        uint8 treeId,
        uint256 role,
        uint256 k,
        uint64 anchorBlock,
        FinalPqQuorum.Approval[] calldata approvals
    ) external {
        _assertTree(treeId);
        _requireConfigurationAuthority(
            ACTION_CONFIGURE_TREE, keccak256(abi.encode(treeId, role, k)), anchorBlock, approvals
        );
        // Refuse a threshold nobody can meet. Register the members first; that
        // ordering is the point, not an inconvenience. A 4-of-5 configured
        // against three registered co-signers is a tree that reverts on every
        // write, and the revert names the threshold rather than the roster.
        if (k != 0) {
            uint256 live = registry.liveMemberCount(role);
            if (live < k) revert ThresholdUnreachable(treeId, live, k);
        }
        writerRole[treeId] = role;
        threshold[treeId] = k;
        emit TreeConfigured(treeId, role, k);
    }

    /**
     * @notice Point a tree at the contract allowed to write it directly.
     * @dev Same gate as `configureTree`, for the same reason. Setting it to the
     * zero address removes the path entirely and leaves the tree quorum-only.
     *
     * Point this at a CONTRACT, never at an externally owned account. The whole
     * argument for a quorum-free writer is that its rules are its bytecode; an
     * account holding a key is exactly the single-key authority the quorum on
     * {setLeaves} exists to prevent.
     *
     * Movable rather than immutable on purpose: an immutable pointer would mean
     * a ledger redeploy abandons the tree it writes, with no way back.
     * @param treeId The tree whose writer seat is being set.
     * @param writer The contract admitted to it; zero removes the seat.
     * @param anchorBlock The registrars' roster anchor. Ignored during bootstrap.
     * @param approvals The sealed registrar quorum. Empty during bootstrap.
     */
    function setTreeWriter(
        uint8 treeId,
        address writer,
        uint64 anchorBlock,
        FinalPqQuorum.Approval[] calldata approvals
    ) external {
        _assertTree(treeId);
        _requireConfigurationAuthority(
            ACTION_SET_TREE_WRITER, keccak256(abi.encode(treeId, writer)), anchorBlock, approvals
        );
        treeWriter[treeId] = writer;
        emit TreeWriterSet(treeId, writer);
    }

    /**
     * @notice Point `syncIdentities` at the contract that knows the chain set.
     * @dev Same gate as `setTreeWriter`. Zero removes the source, after which
     * service leaves carry an empty `deployedChains` table — which is what a
     * plane looks like before its asset registry is seeded, and is why this
     * pointer belongs in the same bootstrap window as the seed itself.
     * @param source The asset registry to read the enabled chain set from.
     * @param anchorBlock The registrars' roster anchor. Ignored during bootstrap.
     * @param approvals The sealed registrar quorum. Empty during bootstrap.
     */
    function setChainSource(
        address source,
        uint64 anchorBlock,
        FinalPqQuorum.Approval[] calldata approvals
    ) external {
        _requireConfigurationAuthority(
            ACTION_SET_CHAIN_SOURCE, keccak256(abi.encode(source)), anchorBlock, approvals
        );
        chainSource = source;
        emit ChainSourceSet(source);
    }

    /// @notice Point tree 8's branch 3 at the slot-key registry it projects.
    /// @dev Same gate as `setChainSource`. Zero closes the branch entirely:
    ///      {syncSlotKeyLeaves} reverts `SlotKeySourceUnset` rather than
    ///      writing leaves whose value nothing vouched for.
    /// @param source The slot-key registry whose verdict the branch projects.
    /// @param anchorBlock The registrars' roster anchor. Ignored during bootstrap.
    /// @param approvals The sealed registrar quorum. Empty during bootstrap.
    function setSlotKeySource(
        address source,
        uint64 anchorBlock,
        FinalPqQuorum.Approval[] calldata approvals
    ) external {
        _requireConfigurationAuthority(
            ACTION_SET_SLOT_KEY_SOURCE, keccak256(abi.encode(source)), anchorBlock, approvals
        );
        slotKeySource = source;
        emit SlotKeySourceSet(source);
    }

    /// @notice Point tree 8's branch 4 at the endpoint registry it projects.
    /// @dev Same gate as `setSlotKeySource`, and the same fail-closed shape:
    ///      zero makes {syncEndpointLeaves} revert `EndpointSourceUnset`.
    /// @param source The endpoint registry whose verdict the branch projects.
    /// @param anchorBlock The registrars' roster anchor. Ignored during bootstrap.
    /// @param approvals The sealed registrar quorum. Empty during bootstrap.
    function setEndpointSource(
        address source,
        uint64 anchorBlock,
        FinalPqQuorum.Approval[] calldata approvals
    ) external {
        _requireConfigurationAuthority(
            ACTION_SET_ENDPOINT_SOURCE, keccak256(abi.encode(source)), anchorBlock, approvals
        );
        endpointSource = source;
        emit EndpointSourceSet(source);
    }

    /**
     * @notice Adopt a preceding plane's counters — one `treeVersion` per tree
     *         (index = treeId, 0 unused) and the published `round` — so a
     *         redeploy stays monotonic for every consumer that compares them:
     *         rings, explorers, the round feed.
     * @dev This contract is immutable, so replacing it means a new address, and
     * a fresh address would otherwise restart every counter at zero. A consumer
     * that treats a counter as monotonic would then read the new plane as
     * older than the state it already holds, and quietly ignore live data.
     *
     * It carries the counters and nothing else. The roots behind those rounds
     * stay with the plane that published them, so {roundRootAt} below the seed
     * answers zero here — pin a round on the plane that produced it.
     *
     * Configuration authority (bootstrap admin before the seal, registrar
     * quorum after), and only while this plane has published nothing:
     * `NotFresh` otherwise, because rewinding a counter a consumer has already
     * compared against is worse than never seeding at all.
     * @param versions Per-tree write counters to adopt, indexed by tree id;
     *        index 0 is unused and must still be present.
     * @param round_ The round number this plane continues from.
     * @param anchorBlock The registrars' roster anchor. Ignored during bootstrap.
     * @param approvals The sealed registrar quorum. Empty during bootstrap.
     */
    function seedCounters(
        uint64[] calldata versions,
        uint64 round_,
        uint64 anchorBlock,
        FinalPqQuorum.Approval[] calldata approvals
    ) external {
        _requireConfigurationAuthority(
            ACTION_SEED_COUNTERS, keccak256(abi.encode(versions, round_)), anchorBlock, approvals
        );
        if (versions.length != TREE_COUNT + 1) revert VersionCountMismatch(versions.length);
        if (round != 0) revert NotFresh();
        for (uint8 t = 1; t <= TREE_COUNT; t++) {
            if (treeVersion[t] != 0) revert NotFresh();
        }
        for (uint8 t = 1; t <= TREE_COUNT; t++) {
            treeVersion[t] = versions[t];
        }
        round = round_;
        emit CountersSeeded(round_, versions);
    }

    /// @notice Install the records contract that writes the typed trees.
    /// @dev Trees 2, 3 and 4 have no other door at all — {setLeaves} refuses
    ///      them outright — so leaving this unset closes those three
    ///      completely. Same gate as `setTreeWriter`, and the same rule: a
    ///      contract, never an account holding a key.
    /// @param writer The records contract admitted to {writeTyped}.
    /// @param anchorBlock The registrars' roster anchor. Ignored during bootstrap.
    /// @param approvals The sealed registrar quorum. Empty during bootstrap.
    function setTypedWriter(
        address writer,
        uint64 anchorBlock,
        FinalPqQuorum.Approval[] calldata approvals
    ) external {
        _requireConfigurationAuthority(
            ACTION_SET_TYPED_WRITER, keccak256(abi.encode(writer)), anchorBlock, approvals
        );
        typedWriter = writer;
        emit TypedWriterSet(writer);
    }

    /**
     * @notice Write configuration rows into a tree's branch 0.
     * @param treeId The tree whose owning service the rows configure.
     * @param keys `configKey(name, sub)` per row.
     * @param values One word per row — a duration, a count, an address, a
     *        flag; the reader knows the shape from the name.
     * @param anchorBlock The registrars' roster anchor. Ignored during bootstrap.
     * @param approvals The sealed registrar quorum. Empty during bootstrap.
     *
     * @dev The configuration authority, not the tree's writer or quorum: a
     * tree's writer states what its domain verified, its quorum attests to
     * what it read, and neither is the authority over how the service that
     * feeds it is configured.
     *
     * The value is stored beside the hash so a contract on this chain reads it
     * in one call ({configValue}) while the same row is provable off chain
     * against a round root. That is one source of truth for the fleet, the
     * contracts and any explorer at once — a service reading its own
     * environment instead would be a second source, free to disagree with this
     * one and with nothing on chain able to notice.
     */
    function setConfig(
        uint8 treeId,
        bytes32[] calldata keys,
        bytes32[] calldata values,
        uint64 anchorBlock,
        FinalPqQuorum.Approval[] calldata approvals
    ) external {
        _assertTree(treeId);
        if (keys.length != values.length || keys.length == 0) revert LengthMismatch(keys.length, values.length);
        _requireConfigurationAuthority(
            ACTION_SET_CONFIG, keccak256(abi.encode(treeId, keys, values)), anchorBlock, approvals
        );
        for (uint256 i = 0; i < keys.length; i++) {
            _configValue[treeId][keys[i]] = values[i];
            _set(treeId, BRANCH_CONFIG, keys[i], configLeafHash(treeId, keys[i], values[i]));
            emit ConfigSet(treeId, keys[i], values[i]);
        }
        _bump(treeId, keys.length);
    }

    // ------------------------------------------------------------- writing

    /**
     * @notice Write leaves into one branch of one tree under a PQ quorum.
     * @param treeId Which tree.
     * @param branch Which branch — never 0, which `setConfig` alone writes.
     * @param keys Domain keys — a wallet address for accounts, an asset id for
     *        the allowlist, whatever identifies a row in that domain. Each gets
     *        a permanent slot in the branch on first write.
     * @param leaves The raw (untagged) leaf values.
     * @param anchorBlock The block the approving roster is read as of.
     * @param approvals At least `threshold[treeId]` of them, ascending by signer.
     *
     * @dev The digest binds the tree, its nonce, and the full batch. Binding the
     * nonce is what stops the same approved batch being replayed: without it,
     * an approval to set a price is an approval to set that price again at any
     * later block, which for an oracle is the whole attack.
     *
     * ML-DSA-87 is required rather than accepted. These are operational,
     * high-cadence writes — the transaction class — and leaving the choice open
     * would mean a break in either scheme takes the tree.
     *
     * Three tree classes are refused here outright, each with its own error:
     * the typed trees (2, 3 and 4) because their preimage has to be built by
     * the records contract, and the writer-only trees (7 and 8) because no set
     * of service signatures can make a different answer true about an intent's
     * status or an identity's standing.
     */
    function setLeaves(
        uint8 treeId,
        uint8 branch,
        bytes32[] calldata keys,
        bytes32[] calldata leaves,
        uint64 anchorBlock,
        FinalPqQuorum.Approval[] calldata approvals
    ) external {
        _assertTree(treeId);
        _assertDataBranch(treeId, branch);
        if (treeId == TREE_PHI || treeId == TREE_VASSET || treeId == TREE_ORACLE || treeId == TREE_COMPLIANCE) {
            revert TypedTreeOnly(treeId);
        }
        // Trees 7 and 8 have their own rulers and NO quorum path at all: an
        // intent's status is what `FinalIntentLog` verified, an identity is
        // what the registry or the ledger verified, and no set of service
        // signatures can make a different answer true.
        if (treeId == TREE_INTENTS || treeId == TREE_IDENTITY) revert WriterOnlyTree(treeId);
        if (keys.length != leaves.length) revert LengthMismatch(keys.length, leaves.length);
        uint256 k = threshold[treeId];
        if (k == 0) revert TreeNotConfigured(treeId);

        uint64 n = nonce[treeId];
        FinalPqQuorum.require_(
            registry,
            approvals,
            FinalPqQuorum.digest(
                address(this),
                ACTION_SET_LEAVES,
                anchorBlock,
                keccak256(abi.encode(treeId, branch, n, keys, leaves))
            ),
            writerRole[treeId],
            k,
            FinalPqQuorum.ALG_ML_DSA_87,
            anchorBlock,
            false
        );
        nonce[treeId] = n + 1;

        for (uint256 i = 0; i < keys.length; i++) {
            _set(treeId, branch, keys[i], leaves[i]);
        }

        _bump(treeId, keys.length);
    }

    /// @notice One chain an account exists on, and as what.
    /// @dev `chainRef` is the registry's CAIP-derived chain reference — the one
    ///      identifier that names an EVM chain and a non-EVM one alike — and
    ///      `account` is the wallet's account there, in that chain's own account
    ///      space (an EVM address right-aligned, a 32-byte key filling the
    ///      width). Field-for-field with `IWalletTypes.ChainAccount`.
    struct ChainAccount {
        /// @dev The registry's CAIP-derived reference for the chain.
        bytes32 chainRef;
        /// @dev The account on that chain, in that chain's own account space.
        bytes32 account;
    }

    /// @notice `FinalWalletFactory.AccountStateLeaf`, field for field.
    /// @dev The preimage of every tree-1 leaf. The field set, the field ORDER
    ///      and the domain must match the factory's exactly on every supported
    ///      chain; a field added, removed or reordered on one side alone is a
    ///      root every execution chain rejects with nothing naming the cause.
    struct AccountStateLeaf {
        /// @dev The Final Wallet this leaf describes. Also what `accountKeyFor`
        ///      hashes into the tree-1 key, so one wallet holds one slot.
        address wallet;
        /// @dev Active-stage access-key commitment — the credential the account
        ///      ledger checks a state transition against.
        bytes32 liveAccess;
        /// @dev Active-stage transaction-key commitment.
        bytes32 liveTransaction;
        /// @dev Pre-committed successor to `liveAccess`, so a rotation reveals a
        ///      key that was already committed rather than one chosen after.
        bytes32 recoveryAccess;
        /// @dev Pre-committed successor to `liveTransaction`.
        bytes32 recoveryTransaction;
        /// @dev Active-stage encapsulation commitment and its pre-committed
        /// successor. Field-for-field with `FinalWalletFactory.AccountStateLeaf`;
        /// a field added on one side and not the other is a root every execution
        /// chain rejects, with nothing pointing at the cause.
        bytes32 liveKem;
        /// @dev Pre-committed successor to `liveKem`.
        bytes32 recoveryKem;
        /// @dev Who may authorize for this account. This is the PROVEN owner an
        ///      execution chain resolves authority from; a copy stored there is
        ///      wrong for as long as nobody has pushed to that chain, and
        ///      nothing there can tell.
        address owner;
        /// @dev Whether the account authorizes post-quantum. One-way once set.
        bool pqEnabled;
        /// @dev Whether the account is frozen. Returned to a resolver rather
        ///      than enforced by it, so a reader can still learn who owns a
        ///      frozen account; the wallet refuses on this PROVEN value rather
        ///      than on a synced copy, so a chain behind on the fan-out cannot
        ///      let a frozen account transact.
        bool frozen;
        /// @dev The chains this account exists on, and its account on each —
        /// including chains whose accounts are not EVM addresses. Decided HERE
        /// (set by the holder through the ledger) and enforced there: an
        /// execution chain refuses to create the account unless the table has a
        /// row for it, and a settlement toward a chain with no row is refused at
        /// the source. This is also what a zero beneficiary resolves through: a
        /// table naming the account on each chain answers "as what", which a
        /// bare membership flag never could. `_assertChainAccounts` rejects a
        /// zero chain, a zero account and a repeated chain, so no door can
        /// publish a table a resolver would read two ways.
        ChainAccount[] deployedChains;
        /// @dev Per-chain dormancy verdict, one bit per asset-registry chain
        /// slot, so the bit positions are the registry's slot numbering rather
        /// than this table's row order.
        uint32 dormantChains;
        /// @dev Commitment to the recovery credential the account enrols at creation
        ///      (`keccak256(abi.encode(FINAL_RECOVERY_ENROLMENT_v01, validator, keccak256(registrationData)))`);
        ///      zero = none. Declared through the ledger, bound here so creation cannot be front-run with another
        ///      credential. Field-for-field with `FinalWalletFactory.AccountStateLeaf`.
        bytes32 recoveryCredential;
        /// @dev Which `deployedChains` ROWS are created with that credential enrolled: bit i is row i (not the
        ///      registry slot `dormantChains` uses). A set bit needs a non-zero `recoveryCredential`.
        uint32 guardedChains;
        /// @dev Monotonic per-account revision. Lets a reader holding two
        ///      proofs tell which one is newer without consulting a round.
        uint64 version;
    }

    /**
     * @notice Write account state into tree 1 from the typed leaf.
     * @dev The typed form exists so the leaf preimage is built HERE rather than
     * by whoever assembles the calldata. Tree 1 is the source of truth for every
     * other chain, and `syncAccountState` will accept any 32 bytes that carry a
     * valid proof — so if the publisher chose the preimage, the publisher could
     * write an account state that no wallet record on this chain agrees with,
     * and the proof would still verify everywhere.
     *
     * The round takes the ML-DSA-87 vote alone, as every tree write does (the
     * user's ruling of 12 Sep 2026, arch/quorum-signing-ml-dsa.md). Who an
     * account IS is decided by the holder's own SLH-DSA credential in
     * `FinalAccountLedger` — the ledger is `treeWriter[1]` and writes tree 1
     * with no service quorum at all — so a quorum round here re-publishes state
     * the holder already authorized; it is the roster's membership, not the
     * account's, that keeps the SLH-DSA seal (the registrar quorum).
     * @param leaves The account states to write, one per wallet.
     * @param anchorBlock The block the approving roster is read as of.
     * @param approvals At least `threshold[TREE_ACCOUNTS]` of them, ascending by signer.
     */
    function setAccountStates(
        AccountStateLeaf[] calldata leaves,
        uint64 anchorBlock,
        FinalPqQuorum.Approval[] calldata approvals
    ) external {
        uint256 k = threshold[TREE_ACCOUNTS];
        if (k == 0) revert TreeNotConfigured(TREE_ACCOUNTS);

        bytes32[] memory keys = new bytes32[](leaves.length);
        bytes32[] memory hashes = new bytes32[](leaves.length);
        for (uint256 i = 0; i < leaves.length; i++) {
            keys[i] = accountKeyFor(leaves[i].wallet);
            hashes[i] = accountStateLeafHash(leaves[i]);
        }

        uint64 n = nonce[TREE_ACCOUNTS];
        FinalPqQuorum.require_(
            registry,
            approvals,
            FinalPqQuorum.digest(
                address(this),
                ACTION_SET_LEAVES,
                anchorBlock,
                keccak256(abi.encode(TREE_ACCOUNTS, n, keys, hashes))
            ),
            writerRole[TREE_ACCOUNTS],
            k,
            FinalPqQuorum.ALG_ML_DSA_87,
            anchorBlock,
            false
        );
        nonce[TREE_ACCOUNTS] = n + 1;

        for (uint256 i = 0; i < leaves.length; i++) {
            _set(TREE_ACCOUNTS, BRANCH_MAIN, keys[i], hashes[i]);
        }

        _bump(TREE_ACCOUNTS, leaves.length);
    }

    /**
     * @notice Write account state into tree 1 from the contract that owns it.
     * @dev No quorum, and no nonce burned: `treeWriter[1]` is the ledger, and
     * the ledger already verified the holder's own signature before it called
     * here. See {treeWriter} for why adding a service quorum on top would be a
     * censorship power rather than a safeguard.
     *
     * Typed, exactly as `setAccountStates` is: the preimage is built HERE, so
     * even the writer contract cannot publish a leaf whose meaning no record on
     * this chain agrees with.
     * @param leaves The account states to write, one per wallet.
     */
    function setAccountStatesAsWriter(AccountStateLeaf[] calldata leaves) external {
        if (msg.sender != treeWriter[TREE_ACCOUNTS]) revert NotAuthorized(msg.sender);
        for (uint256 i = 0; i < leaves.length; i++) {
            _set(TREE_ACCOUNTS, BRANCH_MAIN, accountKeyFor(leaves[i].wallet), accountStateLeafHash(leaves[i]));
        }
        _bump(TREE_ACCOUNTS, leaves.length);
    }

    /**
     * @notice Write raw leaves into any tree from the contract that owns it.
     * @dev The generic sibling of {setAccountStatesAsWriter}, for a tree whose
     * writer is a contract rather than a service quorum. Same authorization —
     * `treeWriter[treeId]` and nothing else — and the same reasoning: the
     * writer has already verified whatever its domain requires, and layering a
     * quorum on top of a contract's own rules is a censorship power rather
     * than a safeguard.
     *
     * UNTYPED, unlike the account path, and that is the trade. Tree 1's
     * preimage is built here so even the ledger cannot publish a leaf whose
     * meaning no record agrees with; a generic writer supplies its own hash,
     * so the leaf means whatever that contract says it means. Acceptable only
     * because the writer is a specific contract this chain's operators
     * installed — its rules are its bytecode, it has no owner and no proxy —
     * and NOT acceptable for a role-gated key. Point `treeWriter` at a
     * contract, never at an externally owned account.
     * @param treeId The tree to write.
     * @param branch The branch within it. Never 0, which `setConfig` alone writes.
     * @param keys Domain keys, one per leaf. Each takes a permanent slot in the
     *        branch on first write.
     * @param leaves The raw (untagged) leaf values.
     */
    function setLeavesAsWriter(uint8 treeId, uint8 branch, bytes32[] calldata keys, bytes32[] calldata leaves)
        external
    {
        if (msg.sender != treeWriter[treeId]) revert NotAuthorized(msg.sender);
        _assertDataBranch(treeId, branch);
        if (keys.length != leaves.length) revert LengthMismatch(keys.length, leaves.length);
        for (uint256 i = 0; i < keys.length; i++) {
            _set(treeId, branch, keys[i], leaves[i]);
        }
        _bump(treeId, keys.length);
    }

    /// @notice The leaf hash `FinalWalletFactory.accountStateLeafHash` computes.
    /// @dev Identical `abi.encode`, identical field order, identical domain, and
    /// that identity is the whole contract between this chain and every
    /// execution chain. `deployedChains` rides through `abi.encode` like every
    /// other field — head offset, then length and rows — so the table is
    /// committed whole and in order. The table is validated here rather than at
    /// each door, so every path into tree 1 gets the same refusal.
    /// @param leaf The account state to commit to.
    /// @return The tagged leaf hash, ready to be placed in tree 1.
    function accountStateLeafHash(AccountStateLeaf memory leaf) public pure returns (bytes32) {
        _assertChainAccounts(leaf.deployedChains);
        return keccak256(
            abi.encode(
                DOMAIN_ACCOUNT_STATE_LEAF,
                leaf.wallet,
                leaf.liveAccess,
                leaf.liveTransaction,
                leaf.recoveryAccess,
                leaf.recoveryTransaction,
                leaf.liveKem,
                leaf.recoveryKem,
                leaf.owner,
                leaf.pqEnabled,
                leaf.frozen,
                leaf.deployedChains,
                leaf.dormantChains,
                leaf.recoveryCredential,
                leaf.guardedChains,
                leaf.version
            )
        );
    }

    /// @notice Reject a `deployedChains` table a resolver could not read.
    /// @dev A well-formed table: no zero chain, no zero account, no chain twice.
    ///      Checked where the leaf is hashed so no door — quorum, writer
    ///      contract, identity projection — can publish a table a resolver
    ///      would read two ways. The duplicate scan is quadratic in the row
    ///      count, which is deliberate: gas is not a constraint on this chain,
    ///      and a sort or a seen-set would cost correctness or storage to save
    ///      something nobody is paying for.
    /// @param rows The table to validate.
    function _assertChainAccounts(ChainAccount[] memory rows) private pure {
        for (uint256 i = 0; i < rows.length; i++) {
            if (rows[i].chainRef == bytes32(0) || rows[i].account == bytes32(0)) {
                revert InvalidChainAccount(rows[i].chainRef, rows[i].account);
            }
            for (uint256 j = 0; j < i; j++) {
                if (rows[j].chainRef == rows[i].chainRef) {
                    revert InvalidChainAccount(rows[i].chainRef, rows[i].account);
                }
            }
        }
    }

    /// @notice The account `wallet`'s published table names on `chainRef`, or
    ///         zero if it has no row there.
    /// @dev A convenience over `accountStateLeafHash`'s input for readers on
    /// this chain; execution chains answer the same question from their synced
    /// record (`FinalWalletFactory.addressOn`). Pure, so it reads the leaf it is
    /// handed and never this contract's storage — the caller is responsible for
    /// having proved that leaf first.
    /// @param leaf The account state to search.
    /// @param chainRef The chain being asked about.
    /// @return The account on that chain, or zero when the table has no row for it.
    function accountOn(AccountStateLeaf memory leaf, bytes32 chainRef) public pure returns (bytes32) {
        for (uint256 i = 0; i < leaf.deployedChains.length; i++) {
            if (leaf.deployedChains[i].chainRef == chainRef) return leaf.deployedChains[i].account;
        }
        return bytes32(0);
    }

    /**
     * @notice The typed trees' write door — `FinalStateRecords` alone.
     * @dev The quorum, the nonce and the write, shared by every typed record.
     * The records contract computed the keys and hashes from the structs it
     * stores; this contract admits nobody else to trees 2, 3 and 4
     * (`setLeaves` refuses them), so the value there can never drift from
     * the commitment here.
     *
     * The digest is byte-identical to `setLeaves`' over the same keys and
     * hashes, deliberately: the typed entrypoints choose the PREIMAGE, not the
     * authorization. A member recomputes one digest whichever door the batch
     * came through, and there is no second approval shape to get wrong.
     *
     * Always branch 1: a typed record is a domain row, and branch 0 belongs to
     * the configuration authority on every tree without exception.
     * @param treeId The typed tree being written.
     * @param keys Domain keys the records contract computed, one per leaf.
     * @param hashes Leaf hashes the records contract computed from its structs.
     * @param anchorBlock The block the approving roster is read as of.
     * @param approvals At least `threshold[treeId]` of them, ascending by signer.
     */
    function writeTyped(
        uint8 treeId,
        bytes32[] memory keys,
        bytes32[] memory hashes,
        uint64 anchorBlock,
        FinalPqQuorum.Approval[] calldata approvals
    ) external {
        if (msg.sender != typedWriter) revert NotAuthorized(msg.sender);
        uint256 k = threshold[treeId];
        if (k == 0) revert TreeNotConfigured(treeId);

        uint64 n = nonce[treeId];
        FinalPqQuorum.require_(
            registry,
            approvals,
            FinalPqQuorum.digest(
                address(this),
                ACTION_SET_LEAVES,
                anchorBlock,
                keccak256(abi.encode(treeId, n, keys, hashes))
            ),
            writerRole[treeId],
            k,
            FinalPqQuorum.ALG_ML_DSA_87,
            anchorBlock,
            false
        );
        nonce[treeId] = n + 1;

        for (uint256 i = 0; i < keys.length; i++) {
            _set(treeId, BRANCH_MAIN, keys[i], hashes[i]);
        }

        _bump(treeId, keys.length);
    }

    /**
     * @notice The typed door for a tree whose leaves live in SEVERAL data branches — tree 9, whose
     *         approvals, revocations, counters and attestations are four key families, each with a
     *         permanent branch. Same writer, same role, same threshold and the same per-tree nonce as
     *         `writeTyped`; the branch is folded into the signed payload so a quorum that approved a
     *         revocation cannot be replayed as an approval.
     * @dev `writeTyped` stays byte-for-byte what it is (trees 2–4 write `BRANCH_MAIN` and their lanes
     *      sign `(treeId, n, keys, hashes)`); this door signs `(treeId, branch, n, keys, hashes)`.
     *      Branch 0 is `setConfig`'s alone.
     * @param treeId The tree.
     * @param branch The data branch every key of this write lives in (`1 .. BRANCH_COUNT - 1`).
     * @param keys Domain keys, as the companion derived them.
     * @param hashes The leaf hashes, one per key.
     * @param anchorBlock The roster anchor the approvals were made against.
     * @param approvals `threshold[treeId]` ML-DSA-87 votes from `writerRole[treeId]` members.
     */
    function writeTypedInBranch(
        uint8 treeId,
        uint8 branch,
        bytes32[] memory keys,
        bytes32[] memory hashes,
        uint64 anchorBlock,
        FinalPqQuorum.Approval[] calldata approvals
    ) external {
        if (msg.sender != typedWriter) revert NotAuthorized(msg.sender);
        _assertDataBranch(treeId, branch);
        if (keys.length != hashes.length) revert LengthMismatch(keys.length, hashes.length);
        uint256 k = threshold[treeId];
        if (k == 0) revert TreeNotConfigured(treeId);
        uint64 n = nonce[treeId];
        FinalPqQuorum.require_(
            registry,
            approvals,
            FinalPqQuorum.digest(
                address(this),
                ACTION_SET_LEAVES,
                anchorBlock,
                keccak256(abi.encode(treeId, branch, n, keys, hashes))
            ),
            writerRole[treeId],
            k,
            FinalPqQuorum.ALG_ML_DSA_87,
            anchorBlock,
            false
        );
        nonce[treeId] = n + 1;
        for (uint256 i = 0; i < keys.length; i++) {
            _set(treeId, branch, keys[i], hashes[i]);
        }
        _bump(treeId, keys.length);
    }

    /**
     * @notice Snapshot every tree's root into a new round.
     * @dev Permissionless, deliberately. Every root being snapshotted was
     * already authorized by its tree's quorum, so this adds no authority — it
     * only fixes a moment. Requiring a signature would put a liveness
     * dependency in front of publication for no security gain.
     *
     * A round that would change nothing is refused, so the round number cannot
     * be advanced by anyone with gas to spend.
     * @return published The round number just written.
     */
    function publishRound() external returns (uint64 published) {
        bool changed;
        for (uint8 t = 1; t <= TREE_COUNT; t++) {
            if (treeVersion[t] != _publishedVersion[t]) {
                changed = true;
                break;
            }
        }
        if (!changed) revert NothingToPublish();

        published = round + 1;
        Round storage r = _rounds[published];
        for (uint8 t = 1; t <= TREE_COUNT; t++) {
            r.roots[t] = liveRoot[t];
            _publishedVersion[t] = treeVersion[t];
        }
        r.roundRoot = _foldForest(_forestLeaves(r.roots));
        r.blockNumber = uint64(block.number);
        // MILLISECONDS, like every instant on this chain.
        r.timestamp = FinalChainTime.nowMs();
        round = published;
        emit RoundPublished(published, r.blockNumber, r.timestamp);
    }

    // ---------------------------------------------------------------- views

    /// @notice Every root from one round. Index by the `TREE_*` constants;
    /// index 0 is unused.
    /// @dev An unpublished round answers all zeros rather than reverting, so a
    ///      caller scanning forward can tell where the history ends.
    /// @param which The round number.
    /// @return The eight tree roots at that round, indexed by tree id.
    function rootsAt(uint64 which) external view returns (bytes32[TREE_COUNT + 1] memory) {
        return _rounds[which].roots;
    }

    /// @notice One tree's root at one round.
    /// @param which The round number.
    /// @param treeId The tree to read.
    /// @return That tree's root at that round; zero if the round is unpublished.
    function rootAt(uint64 which, uint8 treeId) external view returns (bytes32) {
        _assertTree(treeId);
        return _rounds[which].roots[treeId];
    }

    /// @notice The one word that commits to every tree at one round.
    /// @dev The value a consumer pins. Everything in the plane at that instant
    ///      proves against it, which is the only contemporaneity this contract
    ///      offers — the live roots move independently and do not.
    /// @param which The round number.
    /// @return The round root; zero if the round is unpublished on this plane.
    function roundRootAt(uint64 which) external view returns (bytes32) {
        return _rounds[which].roundRoot;
    }

    /**
     * @notice The `FOREST_BITS` siblings that take a tree's root at one round
     *         up to that round's root — appended to `proofFor`, they make a
     *         leaf provable against `roundRootAt(which)` by the same verifier.
     * @dev Folds the round's stored roots in memory rather than keeping the
     * upper levels in storage: the fold is cheap, and one stored copy of a
     * value is one fewer place for two copies to disagree.
     * @param which The round number. Must be published on this plane.
     * @param treeId The tree whose root is being lifted to the round root.
     * @return path The `FOREST_BITS` siblings, lowest level first.
     */
    function roundProofFor(uint64 which, uint8 treeId) external view returns (bytes32[] memory path) {
        _assertTree(treeId);
        if (which == 0 || which > round) revert NoRounds();
        bytes32[] memory level = _forestLeaves(_rounds[which].roots);
        path = new bytes32[](FOREST_BITS);
        uint256 idx = treeId;
        uint256 n = level.length;
        for (uint256 l = 0; l < FOREST_BITS; l++) {
            path[l] = level[idx ^ 1];
            n >>= 1;
            for (uint256 i = 0; i < n; i++) {
                level[i] = _pair(level[2 * i], level[2 * i + 1]);
            }
            idx >>= 1;
        }
    }

    /// @notice The latest round's roots, with the block it was taken at.
    /// @dev Reverts `NoRounds` on a plane that has published nothing, rather
    ///      than answering an empty round that a caller could mistake for a
    ///      real snapshot of an empty plane.
    /// @return which The round number.
    /// @return roots The eight tree roots, indexed by tree id; index 0 unused.
    /// @return blockNumber Block the snapshot was taken in.
    /// @return timestamp Snapshot instant, in milliseconds.
    function latestRound()
        external
        view
        returns (uint64 which, bytes32[TREE_COUNT + 1] memory roots, uint64 blockNumber, uint64 timestamp)
    {
        which = round;
        if (which == 0) revert NoRounds();
        Round storage r = _rounds[which];
        return (which, r.roots, r.blockNumber, r.timestamp);
    }

    /// @notice The raw leaf stored for a key, and whether it has a slot.
    /// @dev The UNTAGGED value, as it was written. The tag is applied when the
    ///      leaf is hashed into the tree, so a caller reproducing a leaf hash
    ///      applies it themselves. A key with no slot answers `(0, false)`
    ///      rather than reverting, so presence is a question this view can be
    ///      asked directly.
    /// @param treeId The tree to read.
    /// @param key The domain key.
    /// @return leaf The stored value, or zero when the key has no slot.
    /// @return present Whether the key holds a slot in this tree.
    function leafOf(uint8 treeId, bytes32 key) external view returns (bytes32 leaf, bool present) {
        uint256 s = _slotPlusOne[treeId][key];
        if (s == 0) return (bytes32(0), false);
        return (_leaf[treeId][s - 1], true);
    }

    /// @notice The permanent slot for a key. Reverts if it has none. The
    /// slot's top `BRANCH_BITS` are its branch.
    /// @dev Stored one-based internally so an unassigned key is distinguishable
    ///      from slot 0, and returned zero-based here — slot 0 of branch 0 is a
    ///      real position.
    /// @param treeId The tree to read.
    /// @param key The domain key.
    /// @return The key's zero-based slot index within the tree.
    function slotOf(uint8 treeId, bytes32 key) public view returns (uint256) {
        uint256 s = _slotPlusOne[treeId][key];
        if (s == 0) revert UnknownKey(treeId, key);
        return s - 1;
    }

    /// @notice The key a slot was handed to, or zero if it is still free —
    /// the enumeration every branch offers: slots `branch << BRANCH_DEPTH`
    /// through `+ branchSlotsUsed(treeId, branch) - 1`.
    /// @dev Because slots are handed out in order and never reused, that range
    ///      is exactly the branch's contents: a reader enumerates a branch on
    ///      chain without an event window and without an indexer.
    /// @param treeId The tree to read.
    /// @param slot The slot index.
    /// @return The key holding that slot, or zero when it was never handed out.
    function keyAt(uint8 treeId, uint256 slot) external view returns (bytes32) {
        return _keyAt[treeId][slot];
    }

    /// @notice Slots handed out in one branch.
    /// @param treeId The tree to read.
    /// @param branch The branch to read.
    /// @return How many slots of that branch are in use — its enumeration bound.
    function branchSlotsUsed(uint8 treeId, uint8 branch) external view returns (uint256) {
        return _branchSlotsUsed[treeId][branch];
    }

    /// @notice One branch's root: the level-`BRANCH_DEPTH` node at its position.
    /// @dev A branch that has never been written answers the empty-subtree hash
    ///      at that level, not zero, because that is genuinely its root.
    /// @param treeId The tree the branch belongs to.
    /// @param branch The branch to read.
    /// @return The branch's root node.
    function branchRoot(uint8 treeId, uint8 branch) external view returns (bytes32) {
        _assertTree(treeId);
        _assertBranch(branch);
        return _nodeAt(treeId, BRANCH_DEPTH, branch);
    }

    /// @notice The first `BRANCH_DEPTH` siblings of `proofFor` — a proof
    /// against the leaf's branch root rather than the tree root.
    /// @dev The same path cut lower. A consumer that only ever needs one
    ///      branch can pin `branchRoot` and verify with fewer siblings; the
    ///      verifier is unchanged, since sorted pairs carry no direction bits.
    /// @param treeId The tree to read.
    /// @param key The domain key. Must already hold a slot.
    /// @return The sibling path from the leaf up to its branch root.
    function branchProofFor(uint8 treeId, bytes32 key) external view returns (bytes32[] memory) {
        _assertTree(treeId);
        return _path(treeId, slotOf(treeId, key), BRANCH_DEPTH);
    }

    /// @notice A configuration row's value, and whether the row exists.
    /// @dev Presence is read from the slot table, not from the value: a row
    ///      deliberately set to zero exists and answers `present`.
    /// @param treeId The tree whose branch 0 holds the row.
    /// @param key The row key, as {configKey} computes it.
    /// @return value The row's single word of value.
    /// @return present Whether the row has ever been written.
    function configValue(uint8 treeId, bytes32 key) external view returns (bytes32 value, bool present) {
        present = _slotPlusOne[treeId][key] != 0;
        value = _configValue[treeId][key];
    }

    /// @notice The branch-0 key of a configuration row: a name the owning
    /// service defines, and a sub-key (a chain reference, an asset, zero).
    /// @dev Its own key domain, so a configuration row can never be handed a
    ///      slot that a domain row of the same tree would want.
    /// @param name The row's name, defined by the service that owns the tree.
    /// @param sub The row's sub-key, or zero when the name stands alone.
    /// @return The branch-0 key.
    function configKey(bytes32 name, bytes32 sub) public pure returns (bytes32) {
        return keccak256(abi.encode(DOMAIN_CONFIG_KEY, name, sub));
    }

    /// @notice The leaf a configuration row hashes to.
    /// @dev Binds the tree id as well as the key and the value, so the same row
    ///      in two trees is two different leaves and a proof cannot be carried
    ///      from one tree's branch 0 to another's.
    /// @param treeId The tree the row belongs to.
    /// @param key The row key.
    /// @param value The row value.
    /// @return The untagged leaf value for that row.
    function configLeafHash(uint8 treeId, bytes32 key, bytes32 value) public pure returns (bytes32) {
        return keccak256(abi.encode(DOMAIN_CONFIG_LEAF, treeId, key, value));
    }

    /// @notice The tree-8 branch-2 key an owner occupies.
    /// @param owner The owner whose wallet list the row indexes.
    /// @return The branch-2 key.
    function ownerIndexKeyFor(address owner) public pure returns (bytes32) {
        return keccak256(abi.encode(DOMAIN_OWNER_INDEX_KEY, owner));
    }

    /// @notice The owner-index leaf: a commitment to the ledger's ordered
    /// `walletsByOwner(owner)`.
    /// @dev A commitment, not the list. The tree is the search structure; the
    ///      ledger holds the readable array this leaf proves, so ORDER matters
    ///      — the same wallets in a different order are a different leaf.
    /// @param owner The owner the index row belongs to.
    /// @param wallets The owner's wallets, in the ledger's own order.
    /// @return The untagged leaf value for that row.
    function ownerIndexLeafHash(address owner, address[] memory wallets) public pure returns (bytes32) {
        return keccak256(abi.encode(DOMAIN_OWNER_INDEX_LEAF, owner, wallets));
    }

    /// @notice The tree-8 branch-3 key of one member's slot — a ring position.
    /// @dev The index is reduced modulo `SLOT_KEY_RING` here, so the branch is
    ///      an index over the recent slots and never fills. A caller passes the
    ///      real slot number and does not do the reduction itself.
    /// @param member The co-signer the slot key belongs to.
    /// @param slotIndex The slot number, before the ring modulus.
    /// @return The branch-3 key.
    function slotKeyFor(address member, uint64 slotIndex) public pure returns (bytes32) {
        return keccak256(abi.encode(DOMAIN_SLOT_KEY, member, slotIndex % SLOT_KEY_RING));
    }

    /**
     * @notice Project slot keys into tree 8's branch 3 — the co-signers'
     *         per-slot KEM publics the private option seals to.
     * @dev Permissionless, for {syncIdentityLeaves}' reason: the leaf VALUE
     * is `slotKeySource`'s own verdict (the registry verified the member's
     * signature when the key was published, and answers zero once the slot's
     * window has passed), so this adds no authority and only projects. The
     * registry calls it same-tx on publication; anyone may call it to retire a
     * slot that lapsed by time.
     * @param member The co-signer whose ring positions are being projected.
     * @param slotIndexes The slots to project. Reduced modulo `SLOT_KEY_RING`.
     */
    function syncSlotKeyLeaves(address member, uint64[] calldata slotIndexes) external {
        address source = slotKeySource;
        if (source == address(0)) revert SlotKeySourceUnset();
        for (uint256 i = 0; i < slotIndexes.length; i++) {
            _set(
                TREE_IDENTITY,
                BRANCH_SLOT_KEYS,
                slotKeyFor(member, slotIndexes[i]),
                ISlotKeySource(source).slotKeyLeafOf(member, slotIndexes[i])
            );
        }
        _bump(TREE_IDENTITY, slotIndexes.length);
    }

    /// @notice The tree-8 branch-4 key of one tunnel endpoint.
    /// @param endpointId The endpoint's certificate subject key id.
    /// @return The branch-4 key.
    function endpointKeyFor(bytes32 endpointId) public pure returns (bytes32) {
        return keccak256(abi.encode(DOMAIN_ENDPOINT_KEY, endpointId));
    }

    /**
     * @notice Project tunnel endpoints into tree 8's branch 4.
     * @dev Permissionless, for {syncSlotKeyLeaves}' reason: the leaf VALUE is
     * `endpointSource`'s own verdict — the registry admitted the certificate
     * under the registrar quorum with the holder's proof of possession, and
     * answers the revoked status once it is revoked — so this adds no authority
     * and only projects. The registry calls it same-tx on registration and
     * revocation; anyone may call it to re-project.
     * @param endpointIds The endpoint ids to project.
     */
    function syncEndpointLeaves(bytes32[] calldata endpointIds) external {
        address source = endpointSource;
        if (source == address(0)) revert EndpointSourceUnset();
        for (uint256 i = 0; i < endpointIds.length; i++) {
            _set(
                TREE_IDENTITY,
                BRANCH_ENDPOINTS,
                endpointKeyFor(endpointIds[i]),
                IEndpointSource(source).endpointLeafOf(endpointIds[i])
            );
        }
        _bump(TREE_IDENTITY, endpointIds.length);
    }

    /**
     * @notice The sibling path for a key, ready for
     *         `FinalMerkle.verifyTaggedSortedProof` on any chain.
     * @dev The sanctioned way to ask any tree a question, tree 1 above all: a
     * view, so a caller fetches a proof with one `eth_call` and never rebuilds
     * the tree off chain. Rebuilding is where a divergence between what the
     * chain holds and what a service believes it holds would come from, and
     * this removes the second implementation entirely.
     *
     * A rebuild is not merely redundant, it is wrong. This tree is fixed depth,
     * zero-padded and insertion-ordered; a fold that sorts its leaves or sizes
     * itself to the leaf count produces a different root, and a proof against
     * that root verifies nowhere while looking perfectly well formed.
     *
     * Pair the path with {liveRoot} for the current root, or append
     * {roundProofFor} and verify against {roundRootAt} to pin a whole round.
     * @param treeId The tree to read.
     * @param key The domain key. Must already hold a slot.
     * @return The `DEPTH` siblings from the leaf up to the tree root, lowest first.
     */
    function proofFor(uint8 treeId, bytes32 key) external view returns (bytes32[] memory) {
        _assertTree(treeId);
        return _path(treeId, slotOf(treeId, key), DEPTH);
    }

    /// @notice The empty-subtree hash at a level. Level `DEPTH` is the root of
    /// a tree with nothing in it.
    /// @dev What an off-chain verifier needs to reproduce the padding this tree
    ///      uses. Levels run `0 .. ROUND_DEPTH`; anything above reverts on the
    ///      array bound.
    /// @param level The level to read.
    /// @return The hash of an empty subtree of that height.
    function emptyRoot(uint256 level) external view returns (bytes32) {
        return _zero[level];
    }

    /// @notice The tree-1 key a wallet occupies.
    /// @dev A full-width hash rather than the packed address, so a hashed key
    ///      cannot be steered onto a slot an address key would take.
    /// @param wallet The Final Wallet.
    /// @return The tree-1 key.
    function accountKeyFor(address wallet) public pure returns (bytes32) {
        return keccak256(abi.encode(DOMAIN_ACCOUNT_KEY, wallet));
    }

    /**
     * @notice Copy a registered identity into tree 1 as an account-state leaf.
     * @dev Services are Final Wallets, so a service's leaf is the SAME leaf a
     * user's wallet gets — `FinalWalletFactory.AccountStateLeaf`, four key
     * commitments and all. There is no second shape and no second domain,
     * which is what lets every chain that already consumes account state
     * consume a co-signer's identity with no contract change.
     *
     * `owner` is the account itself: a service wallet is its own owner, having
     * no separate holder to speak for it.
     *
     * Permissionless, and for the same reason `publishRound` is: every fact it
     * writes was already authorized when it entered the registry, so this adds
     * no authority and only projects. Gating it would put a liveness dependency
     * in front of publishing a revocation, which is the one thing that must
     * never wait.
     * @param accounts The registered service identities to project. Each must
     *        already be registered; an unknown account reverts `UnknownKey`.
     */
    function syncIdentities(address[] calldata accounts) external {
        // One table for the batch: a service is its own canonical address on
        // every enabled chain, so the rows differ only in `account`.
        bytes32[] memory chainRefs = _enabledChainRefs();
        for (uint256 i = 0; i < accounts.length; i++) {
            address who = accounts[i];
            FinalIdentityRegistry.Identity memory id = registry.identityOf(who);
            if (!id.registered) revert UnknownKey(TREE_ACCOUNTS, accountKeyFor(who));
            (bytes32 la, bytes32 lt, bytes32 ra, bytes32 rt) = registry.keyCommitments(who);
            (bytes32 lk, bytes32 rk) = registry.kemCommitments(who);
            ChainAccount[] memory table = new ChainAccount[](chainRefs.length);
            for (uint256 c = 0; c < chainRefs.length; c++) {
                table[c] = ChainAccount({chainRef: chainRefs[c], account: bytes32(uint256(uint160(who)))});
            }
            AccountStateLeaf memory leaf = AccountStateLeaf({
                wallet: who,
                liveAccess: la,
                liveTransaction: lt,
                recoveryAccess: ra,
                recoveryTransaction: rt,
                liveKem: lk,
                recoveryKem: rk,
                // A service reaches every chain the registry has enabled, at
                // its own address, and is never dormant: dormancy measures an
                // ABSENT holder, and these identities have no holder to be
                // absent.
                deployedChains: table,
                dormantChains: 0,
                recoveryCredential: bytes32(0),
                guardedChains: 0,
                owner: who,
                // Every identity here is PQ by construction — there is no other
                // kind of key in this registry.
                pqEnabled: true,
                // Revocation is a leaf that CHANGES, not one that disappears.
                // A consumer holding an old proof gets a stale `false`, which is
                // why the round is the thing to pin.
                frozen: id.revoked,
                version: id.version
            });
            _set(TREE_ACCOUNTS, BRANCH_MAIN, accountKeyFor(who), accountStateLeafHash(leaf));
        }
        _bump(TREE_ACCOUNTS, accounts.length);
    }

    /// @notice The tree-8 slot key an identity occupies.
    /// @dev Its own domain, separate from the tree-1 account key, so one
    ///      account's admission row and its state row can never collide.
    /// @param account The identity.
    /// @return The tree-8 branch-1 key.
    function identityKeyFor(address account) public pure returns (bytes32) {
        return keccak256(abi.encode(DOMAIN_IDENTITY_TREE_KEY, account));
    }

    /**
     * @notice Project identities into tree 8 — the wallet-creation admission
     *         set whose live root every execution chain anchors as its
     *         `currentIdentityRoot`.
     *
     * @dev The leaf VALUE is the registry's own verdict —
     * `FinalIdentityRegistry.identityTreeLeafOf`: the execution chains'
     * identity leaf while the identity stands, zero once it does not. Derived
     * there rather than here because every input (serial, the six key
     * commitments, standing, the CA depth pair) is registry storage, and this
     * contract sits against EIP-170 while the registry does not.
     *
     * Permissionless, for exactly {syncIdentities}' reason: every fact
     * written here was authorized when it entered the registry, so this adds
     * no authority and only projects. The registry itself calls it same-tx on
     * every identity mutation (register, rotate, roles, revoke, LMS-key ops),
     * which is what makes the root CONTINUOUS; the open door additionally lets
     * anyone retire a leaf whose standing lapsed by TIME — expiry moves no
     * registry storage, so no mutation hook can ever fire for it.
     *
     * There is no quorum door and no writer seat (both raw doors refuse this
     * tree), so the strongest thing any caller can do here is copy the
     * registry's own verdict.
     * @param accounts The identities to project. An unregistered account
     *        projects the registry's zero verdict, which retires its leaf.
     */
    function syncIdentityLeaves(address[] calldata accounts) external {
        for (uint256 i = 0; i < accounts.length; i++) {
            _set(TREE_IDENTITY, BRANCH_MAIN, identityKeyFor(accounts[i]), registry.identityTreeLeafOf(accounts[i]));
        }
        _bump(TREE_IDENTITY, accounts.length);
    }

    /**
     * @notice Per-tree quorum health: can each configured tree still be written?
     * @dev A threshold above the live member count is not a strict quorum, it is
     * a tree that reverts forever with nothing naming the roster as the cause.
     * `configureTree` refuses to create that state, but revocation can arrive at
     * it later — revocation must never be blocked on quorum arithmetic, so the
     * check has to be something monitoring reads rather than something the
     * contract enforces after the fact.
     * @return live Members currently holding each tree's writer role; zero for
     *         an unconfigured tree, which is not the same as a starved one.
     * @return required Each tree's threshold, indexed by tree id.
     * @return ok Whether each tree can still be written. An unconfigured tree
     *         reports `true`: it is closed, not starved.
     */
    function quorumHealth()
        external
        view
        returns (uint256[] memory live, uint256[] memory required, bool[] memory ok)
    {
        live = new uint256[](TREE_COUNT + 1);
        required = new uint256[](TREE_COUNT + 1);
        ok = new bool[](TREE_COUNT + 1);
        for (uint8 t = 1; t <= TREE_COUNT; t++) {
            required[t] = threshold[t];
            live[t] = required[t] == 0 ? 0 : registry.liveMemberCount(writerRole[t]);
            ok[t] = required[t] == 0 || live[t] >= required[t];
        }
    }

    // -------------------------------------------------------------- internal

    /// @notice The chain set a service account's `deployedChains` table is built from.
    /// @dev The enabled chain references `chainSource` knows, or none if it is
    ///      unset. Read through the narrow interface so this contract need not
    ///      import the registry that imports it. An unset source answers an
    ///      empty list rather than reverting, because a plane whose registry is
    ///      not yet seeded must still be able to project its identities.
    /// @return The enabled chain references, or an empty list when unset.
    function _enabledChainRefs() private view returns (bytes32[] memory) {
        address source = chainSource;
        if (source == address(0)) return new bytes32[](0);
        return IChainSource(source).enabledChainRefs();
    }

    /// @notice Refuse a tree id outside `1 .. TREE_COUNT`.
    /// @dev Trees are 1-indexed so a tree id doubles as its position in the
    ///      round tree; id 0 is the unused position there and not a tree here.
    /// @param treeId The id to check.
    function _assertTree(uint8 treeId) private pure {
        if (treeId == 0 || treeId > TREE_COUNT) revert UnknownTree(treeId);
    }

    /// @notice Refuse a branch id no slot can encode.
    /// @dev The bound is the branch COUNT, not the count of branches in use: an
    ///      unused branch is a legal, empty subtree.
    /// @param branch The id to check.
    function _assertBranch(uint8 branch) private pure {
        if (branch >= BRANCH_COUNT) revert UnknownBranch(branch);
    }

    /// @notice Refuse a branch a quorum or a writer contract may not write.
    /// @dev A branch a quorum or a writer may write: any but the config branch.
    ///      Branch 0 belongs to the configuration authority on every tree, so
    ///      the refusal is structural rather than per-tree.
    /// @param treeId The tree, carried so the revert names it.
    /// @param branch The branch being written.
    function _assertDataBranch(uint8 treeId, uint8 branch) private pure {
        _assertBranch(branch);
        if (branch == BRANCH_CONFIG) revert ConfigBranchReserved(treeId);
    }

    /// @notice Advance a tree's write counter and announce the new root.
    /// @dev Version + event, the tail of every write door. Called AFTER the
    ///      leaves have settled, so the event carries the root a reader will
    ///      see, and the counter is what {publishRound} compares to decide
    ///      whether a round would carry anything new.
    /// @param treeId The tree that moved.
    /// @param count Leaves in the batch, for the event.
    function _bump(uint8 treeId, uint256 count) private {
        uint64 v = treeVersion[treeId] + 1;
        treeVersion[treeId] = v;
        emit LeavesSet(treeId, count, liveRoot[treeId], v);
    }

    /// @notice The one internal-node hash every tree, branch and round shares.
    /// @dev `keccak256(0x01 ‖ lo ‖ hi)`, the pair sorted — the one node hash.
    ///      Sorting is what makes a proof position-agnostic, so it carries no
    ///      direction bits; the 0x01 tag is what keeps an internal node from
    ///      ever colliding with a leaf, which is hashed under 0x00.
    /// @param a One child.
    /// @param b The other child.
    /// @return The parent node.
    function _pair(bytes32 a, bytes32 b) private pure returns (bytes32) {
        (bytes32 lo, bytes32 hi) = a < b ? (a, b) : (b, a);
        return keccak256(abi.encodePacked(bytes1(0x01), lo, hi));
    }

    /// @notice Collect the siblings from a slot up a given number of levels.
    /// @dev The sibling path from a slot up `height` levels. One routine serves
    ///      the branch proof and the tree proof; only the height differs, which
    ///      is why the two can never disagree about a shared prefix.
    /// @param treeId The tree to read.
    /// @param idx The starting slot. Consumed as the walk climbs.
    /// @param height How many levels to climb.
    /// @return path The siblings, lowest level first.
    function _path(uint8 treeId, uint256 idx, uint256 height) private view returns (bytes32[] memory path) {
        path = new bytes32[](height);
        for (uint256 l = 0; l < height; l++) {
            path[l] = _nodeAt(treeId, l, idx ^ 1);
            idx >>= 1;
        }
    }

    /// @notice Lay the tree roots out as the leaves of the round tree.
    /// @dev The forest's leaves: the tree roots at their positions, the
    ///      empty tree at the rest. Tree `t` sits at position `t`, so the
    ///      round proof's index is the tree id with no translation, and the
    ///      unused positions hold the empty TREE root rather than zero — they
    ///      are genuinely empty trees, and hashing them as zero would make the
    ///      round root unreproducible off chain.
    /// @param roots The round's tree roots, indexed by tree id.
    /// @return level The `1 << FOREST_BITS` leaves of the round tree.
    function _forestLeaves(bytes32[TREE_COUNT + 1] memory roots) private view returns (bytes32[] memory level) {
        level = new bytes32[](1 << FOREST_BITS);
        for (uint256 p = 0; p < level.length; p++) {
            level[p] = (p >= 1 && p <= TREE_COUNT) ? roots[p] : _zero[DEPTH];
        }
    }

    /// @notice Fold the round tree's leaves down to the round root.
    /// @dev Fold a power-of-two level to its root, in place. The input array is
    ///      overwritten, so the caller must not reuse it afterwards.
    /// @param level The level to fold. Length must be a power of two.
    /// @return The root of that level.
    function _foldForest(bytes32[] memory level) private pure returns (bytes32) {
        for (uint256 n = level.length; n > 1; n >>= 1) {
            for (uint256 i = 0; i < n / 2; i++) {
                level[i] = _pair(level[2 * i], level[2 * i + 1]);
            }
        }
        return level[0];
    }

    /// @notice Place one leaf, assigning the key a permanent slot on first sight.
    /// @dev The single point every write door funnels through, which is what
    ///      makes the slot discipline unconditional: a key is handed the next
    ///      free position in its branch, remembered in both directions, and
    ///      keeps it for the life of the contract. A key that already holds a
    ///      slot in a DIFFERENT branch is refused rather than moved — moving it
    ///      would silently invalidate every proof anyone holds for it.
    ///
    ///      The update then rehashes exactly `DEPTH` nodes up the leaf's own
    ///      path, so the cost of a write is the height of the tree and not the
    ///      number of leaves in it. This is also where the tree's shape comes
    ///      from: fixed height, zero-padded siblings, insertion-ordered slots.
    /// @param treeId The tree to write.
    /// @param branch The branch the key belongs to.
    /// @param key The domain key.
    /// @param leaf The raw (untagged) value to store.
    function _set(uint8 treeId, uint8 branch, bytes32 key, bytes32 leaf) private {
        uint256 s = _slotPlusOne[treeId][key];
        uint256 idx;
        if (s == 0) {
            uint256 used = _branchSlotsUsed[treeId][branch];
            if (used >= BRANCH_CAPACITY) revert BranchFull(treeId, branch);
            idx = (uint256(branch) << BRANCH_DEPTH) | used;
            _branchSlotsUsed[treeId][branch] = used + 1;
            slotsUsed[treeId] += 1;
            _slotPlusOne[treeId][key] = idx + 1;
            _keyAt[treeId][idx] = key;
        } else {
            idx = s - 1;
            uint8 have = uint8(idx >> BRANCH_DEPTH);
            if (have != branch) revert BranchMismatch(treeId, key, have, branch);
        }

        _leaf[treeId][idx] = leaf;

        bytes32 cursor = keccak256(abi.encodePacked(bytes1(0x00), leaf));
        for (uint256 l = 0; l < DEPTH; l++) {
            cursor = _pair(cursor, _nodeAt(treeId, l, idx ^ 1));
            idx >>= 1;
            _node[treeId][l + 1][idx] = cursor;
        }
        liveRoot[treeId] = cursor;
    }

    /// @notice One node of a tree, at any level, with empty positions filled in.
    /// @dev Level 0 is derived from the leaf store rather than duplicated into
    /// `_node`, so there is one place a leaf lives and no way for the two to
    /// disagree. Unset positions fall through to the empty-subtree hash — the
    /// zero padding that gives the tree its fixed height, and the reason an
    /// off-chain rebuild must pad to the same height to reach the same root.
    /// @param treeId The tree to read.
    /// @param level The level, 0 being the leaves.
    /// @param index The position at that level.
    /// @return The node, or the empty-subtree hash when nothing was written there.
    function _nodeAt(uint8 treeId, uint256 level, uint256 index) private view returns (bytes32) {
        if (level == 0) {
            return keccak256(abi.encodePacked(bytes1(0x00), _leaf[treeId][index]));
        }
        bytes32 v = _node[treeId][level][index];
        return v == bytes32(0) ? _zero[level] : v;
    }

    // ------------------------------------------------------------------ sweep

    /// @notice The registry the inherited sweep authority resolves members through.
    /// @dev This contract's configuration gate reads the membership registry it
    /// was constructed against, so the sweep authority reads the same one. One
    /// registry for both means a member removed from the roster loses the sweep
    /// at the same instant it loses everything else.
    /// @return The immutable identity registry pinned at construction.
    function _sweepRegistry() internal view override returns (FinalIdentityRegistry) {
        return registry;
    }

    /// @dev Nothing is reserved because nothing is owed: this contract has no
    /// payable entrypoint and no custody line — it records, it does not hold.
    /// Anything it carries arrived by accident and is sweepable in full.
}

contracts/utils/FinalSweep.sol

// SPDX-License-Identifier: BUSL-1.1
// Copyright (c) 2024-2026 Final DeFi
// Licensed under the Business Source License 1.1 (the "License")
//
// Change Date: 2029-01-01
// Change License: GPL-2.0-or-later
//
// Additional Use Grant:
// 1. Any person or entity may inherit this sweep surface into contracts that
//    integrate with the Final DeFi Protocol, in order to recover assets sent to
//    them by mistake.
// 2. Protocol operators and integrators may call the sweep entrypoints it
//    declares, subject to each inheriting contract's own authority and reserved
//    balance rules, as part of their integration with the Final DeFi Protocol.
// 3. For the avoidance of doubt, this Grant does NOT permit the commercial
//    deployment of a Fork of this sweep surface or a competing asset-recovery
//    plane derived from it without permission prior to the Change Date.
//
// @author Final DeFi
// @version 1.0.0
pragma solidity ^0.8.20;

/// @notice The asset kinds a sweep can move. `Native` ignores `asset` and
/// `id`; `Erc20` ignores `id`; `Erc721` reads `id` as the token id and moves
/// exactly one; `Erc1155` reads both.
enum SweepKind { Native, Erc20, Erc721, Erc1155 }

/**
 * @title Final Sweep
 * @notice One sweep surface, on every contract of ours that can end up holding
 *         an asset it does not owe to anybody.
 *
 * @dev Assets arrive at protocol contracts that were never meant to hold them:
 * a bridge delivers to the wrong leg, a user sends an ERC-20 to a registry, an
 * airdrop lands on the gateway, an NFT is safe-transferred into the vault. Left
 * alone that value is destroyed. The sweep is how it comes back — and the
 * single rule it must never break is that a sweep moves SURPLUS and nothing
 * else.
 *
 * Three seams make that rule per-contract:
 *
 *  - `_requireSweepAuthority()` — the treasury role, expressed in whatever
 *    access plane the host contract already has (`FinalAccessController` roles,
 *    a cross-chain authority, a quorum). No new authority is introduced.
 *  - `_sweepDestinations()` — where a sweep may pay. Ours is a two-address
 *    answer because a contract normally has exactly two legitimate ones (the
 *    gateway and the treasury); a contract with one returns it twice.
 *    `FinalGateway` overrides `_requireSweepDestination` outright: the gateway
 *    is the drain of the whole system and sweeps ONWARD to anywhere.
 *  - `_sweepReserved(kind, asset, id)` — the part of the raw balance that is
 *    NOT surplus: fee deposits, the pending-settlement bucket, searcher
 *    collateral, settlement custody, vaulted entries, locked PHI. The default
 *    is zero, which is correct for a contract that custodies nothing; every
 *    contract that custodies something overrides it and is the one place the
 *    liability is stated.
 *
 * The surplus is measured LIVE against the raw balance at call time, so a
 * re-entrant destination re-measures against a balance that already fell —
 * there is no cached figure to double-spend. Nothing here writes storage, so
 * there is no state for a callback to observe half-updated either.
 *
 * The three ERC-721/ERC-1155 receiver hooks are part of the same surface and
 * for the same reason: `safeTransferFrom` reverts into a contract that does not
 * answer them, so without these an NFT sent to one of ours does not land at
 * all — which is not safety, it is a different way to lose it.
 */
abstract contract FinalSweep {
    /// @notice `msg.sender` does not hold this contract's sweep authority.
    error SweepUnauthorized(address caller);
    /// @notice `to` is neither of this contract's sweep destinations.
    error SweepDestinationNotAllowed(address to);
    /// @notice The requested amount is above the surplus: the difference is
    /// owed to somebody (a deposit, a custody total, a vaulted entry).
    error SweepAboveSurplus(address asset, uint256 requested, uint256 surplus);
    /// @notice A sweep of nothing.
    error SweepZeroAmount();
    /// @notice The transfer leg failed, or the token returned `false`.
    error SweepTransferFailed(address asset);

    /// @notice `amount` of `asset` (`id` for the non-fungible kinds) left this
    /// contract for `to` under the sweep authority.
    event AssetSwept(SweepKind indexed kind, address indexed asset, address indexed to, uint256 id, uint256 amount);

    // ─────────────────────────────── seams ───────────────────────────────

    /// @dev Reverts unless `msg.sender` may sweep. The host contract's own
    /// treasury role — never a new one.
    function _requireSweepAuthority() internal view virtual;

    /// @dev The (at most two) addresses a sweep may pay. A contract with one
    /// legitimate destination returns it twice.
    function _sweepDestinations() internal view virtual returns (address a, address b);

    /// @dev The part of the raw balance that is owed and therefore never
    /// sweepable. Zero for a contract that custodies nothing.
    function _sweepReserved(SweepKind, address, uint256) internal view virtual returns (uint256) {
        return 0;
    }

    /// @dev Destination policy. Overridden by `FinalGateway`, which may sweep
    /// onward to anywhere.
    function _requireSweepDestination(address to) internal view virtual {
        (address a, address b) = _sweepDestinations();
        if (to == address(0) || (to != a && to != b)) revert SweepDestinationNotAllowed(to);
    }

    // ────────────────────────────── surface ──────────────────────────────

    /// @notice The surplus of `asset` (`id` for the non-fungible kinds) — the
    /// raw balance above everything this contract owes. What a sweep may move,
    /// readable before calling one.
    function sweepableSurplus(SweepKind kind, address asset, uint256 id) public view returns (uint256 surplus) {
        uint256 raw = _rawBalance(kind, asset, id);
        uint256 reserved = _sweepReserved(kind, asset, id);
        return raw > reserved ? raw - reserved : 0;
    }

    /// @notice Move `amount` of an asset this contract does not owe to `to`.
    /// @dev Role-gated, destination-gated and bounded by the live surplus. The
    /// three gates are independent: a treasury key cannot pay a destination
    /// the contract does not recognize, and neither key nor destination can
    /// reach a wei that backs a liability.
    /// @param kind Which asset kind is being moved.
    /// @param asset Token contract; ignored for `Native`.
    /// @param id Token id for `Erc721` / `Erc1155`; ignored otherwise.
    /// @param amount Amount to move. `type(uint256).max` means the whole
    ///   surplus, which is what an operator draining a stray balance wants and
    ///   what avoids a race with an inflow landing between the read and the call.
    /// @param to Destination.
    /// @return moved Amount actually moved.
    function sweepAsset(SweepKind kind, address asset, uint256 id, uint256 amount, address to)
        external
        returns (uint256 moved)
    {
        _requireSweepAuthority();
        _requireSweepDestination(to);

        uint256 surplus = sweepableSurplus(kind, asset, id);
        moved = amount == type(uint256).max ? surplus : amount;
        if (moved == 0) revert SweepZeroAmount();
        if (moved > surplus) revert SweepAboveSurplus(asset, moved, surplus);

        if (kind == SweepKind.Native) {
            (bool ok,) = payable(to).call{value: moved}("");
            if (!ok) revert SweepTransferFailed(address(0));
        } else if (kind == SweepKind.Erc20) {
            _callToken(asset, abi.encodeWithSelector(0xa9059cbb, to, moved)); // transfer(address,uint256)
        } else if (kind == SweepKind.Erc721) {
            // `transferFrom`, not `safeTransferFrom`: a rescue must not fail
            // because the treasury destination declines a hook. Which
            // destination is legitimate is already decided above.
            moved = 1;
            _callToken(asset, abi.encodeWithSelector(0x23b872dd, address(this), to, id)); // transferFrom
        } else {
            _callToken(
                asset,
                abi.encodeWithSelector(0xf242432a, address(this), to, id, moved, "") // safeTransferFrom(...)
            );
        }
        emit AssetSwept(kind, asset, to, id, moved);
    }

    // ───────────────────────────── receivers ─────────────────────────────

    /// @notice Accept safe ERC-721 transfers, so one sent here is recoverable
    /// rather than rejected at the door.
    function onERC721Received(address, address, uint256, bytes calldata) external pure virtual returns (bytes4) {
        return 0x150b7a02;
    }

    /// @notice Accept safe ERC-1155 single transfers.
    function onERC1155Received(address, address, uint256, uint256, bytes calldata)
        external
        pure
        virtual
        returns (bytes4)
    {
        return 0xf23a6e61;
    }

    /// @notice Accept safe ERC-1155 batch transfers.
    function onERC1155BatchReceived(address, address, uint256[] calldata, uint256[] calldata, bytes calldata)
        external
        pure
        virtual
        returns (bytes4)
    {
        return 0xbc197c81;
    }

    // ───────────────────────────── internals ─────────────────────────────

    /// @dev The raw held amount, before anything owed is subtracted.
    function _rawBalance(SweepKind kind, address asset, uint256 id) internal view returns (uint256) {
        if (kind == SweepKind.Native) return address(this).balance;
        if (kind == SweepKind.Erc20) {
            (bool ok, bytes memory ret) = asset.staticcall(abi.encodeWithSelector(0x70a08231, address(this)));
            return (ok && ret.length >= 32) ? abi.decode(ret, (uint256)) : 0;
        }
        if (kind == SweepKind.Erc721) {
            (bool ok, bytes memory ret) = asset.staticcall(abi.encodeWithSelector(0x6352211e, id)); // ownerOf
            return (ok && ret.length >= 32 && abi.decode(ret, (address)) == address(this)) ? 1 : 0;
        }
        (bool ok1155, bytes memory ret1155) =
            asset.staticcall(abi.encodeWithSelector(0x00fdd58e, address(this), id)); // balanceOf(address,uint256)
        return (ok1155 && ret1155.length >= 32) ? abi.decode(ret1155, (uint256)) : 0;
    }

    /// @dev One transfer leg, tolerant of the legacy no-return ERC-20 shape the
    /// way `FinalDeployer`'s rescue helpers are: success is "the call did not
    /// revert AND it did not return `false`".
    function _callToken(address token, bytes memory data) private {
        if (token.code.length == 0) revert SweepTransferFailed(token);
        (bool ok, bytes memory ret) = token.call(data);
        if (!ok || (ret.length != 0 && !abi.decode(ret, (bool)))) revert SweepTransferFailed(token);
    }
}

node_modules/@openzeppelin/contracts/utils/StorageSlot.sol

// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts (last updated v5.1.0) (utils/StorageSlot.sol)
// This file was procedurally generated from scripts/generate/templates/StorageSlot.js.

pragma solidity ^0.8.20;

/**
 * @dev Library for reading and writing primitive types to specific storage slots.
 *
 * Storage slots are often used to avoid storage conflict when dealing with upgradeable contracts.
 * This library helps with reading and writing to such slots without the need for inline assembly.
 *
 * The functions in this library return Slot structs that contain a `value` member that can be used to read or write.
 *
 * Example usage to set ERC-1967 implementation slot:
 * ```solidity
 * contract ERC1967 {
 *     // Define the slot. Alternatively, use the SlotDerivation library to derive the slot.
 *     bytes32 internal constant _IMPLEMENTATION_SLOT = 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc;
 *
 *     function _getImplementation() internal view returns (address) {
 *         return StorageSlot.getAddressSlot(_IMPLEMENTATION_SLOT).value;
 *     }
 *
 *     function _setImplementation(address newImplementation) internal {
 *         require(newImplementation.code.length > 0);
 *         StorageSlot.getAddressSlot(_IMPLEMENTATION_SLOT).value = newImplementation;
 *     }
 * }
 * ```
 *
 * TIP: Consider using this library along with {SlotDerivation}.
 */
library StorageSlot {
    struct AddressSlot {
        address value;
    }

    struct BooleanSlot {
        bool value;
    }

    struct Bytes32Slot {
        bytes32 value;
    }

    struct Uint256Slot {
        uint256 value;
    }

    struct Int256Slot {
        int256 value;
    }

    struct StringSlot {
        string value;
    }

    struct BytesSlot {
        bytes value;
    }

    /**
     * @dev Returns an `AddressSlot` with member `value` located at `slot`.
     */
    function getAddressSlot(bytes32 slot) internal pure returns (AddressSlot storage r) {
        assembly ("memory-safe") {
            r.slot := slot
        }
    }

    /**
     * @dev Returns a `BooleanSlot` with member `value` located at `slot`.
     */
    function getBooleanSlot(bytes32 slot) internal pure returns (BooleanSlot storage r) {
        assembly ("memory-safe") {
            r.slot := slot
        }
    }

    /**
     * @dev Returns a `Bytes32Slot` with member `value` located at `slot`.
     */
    function getBytes32Slot(bytes32 slot) internal pure returns (Bytes32Slot storage r) {
        assembly ("memory-safe") {
            r.slot := slot
        }
    }

    /**
     * @dev Returns a `Uint256Slot` with member `value` located at `slot`.
     */
    function getUint256Slot(bytes32 slot) internal pure returns (Uint256Slot storage r) {
        assembly ("memory-safe") {
            r.slot := slot
        }
    }

    /**
     * @dev Returns a `Int256Slot` with member `value` located at `slot`.
     */
    function getInt256Slot(bytes32 slot) internal pure returns (Int256Slot storage r) {
        assembly ("memory-safe") {
            r.slot := slot
        }
    }

    /**
     * @dev Returns a `StringSlot` with member `value` located at `slot`.
     */
    function getStringSlot(bytes32 slot) internal pure returns (StringSlot storage r) {
        assembly ("memory-safe") {
            r.slot := slot
        }
    }

    /**
     * @dev Returns an `StringSlot` representation of the string storage pointer `store`.
     */
    function getStringSlot(string storage store) internal pure returns (StringSlot storage r) {
        assembly ("memory-safe") {
            r.slot := store.slot
        }
    }

    /**
     * @dev Returns a `BytesSlot` with member `value` located at `slot`.
     */
    function getBytesSlot(bytes32 slot) internal pure returns (BytesSlot storage r) {
        assembly ("memory-safe") {
            r.slot := slot
        }
    }

    /**
     * @dev Returns an `BytesSlot` representation of the bytes storage pointer `store`.
     */
    function getBytesSlot(bytes storage store) internal pure returns (BytesSlot storage r) {
        assembly ("memory-safe") {
            r.slot := store.slot
        }
    }
}

abi

[
  {
    "type": "constructor",
    "inputs": [
      {
        "name": "registry_",
        "type": "address",
        "internalType": "contract FinalIdentityRegistry"
      },
      {
        "name": "trees_",
        "type": "address",
        "internalType": "contract FinalStateTrees"
      }
    ],
    "stateMutability": "nonpayable"
  },
  {
    "type": "function",
    "name": "ACTION_REGISTER_ENDPOINT",
    "inputs": [],
    "outputs": [
      {
        "name": "",
        "type": "bytes32",
        "internalType": "bytes32"
      }
    ],
    "stateMutability": "view"
  },
  {
    "type": "function",
    "name": "ACTION_REVOKE_ENDPOINT",
    "inputs": [],
    "outputs": [
      {
        "name": "",
        "type": "bytes32",
        "internalType": "bytes32"
      }
    ],
    "stateMutability": "view"
  },
  {
    "type": "function",
    "name": "ALG_FN_DSA_1024",
    "inputs": [],
    "outputs": [
      {
        "name": "",
        "type": "uint16",
        "internalType": "uint16"
      }
    ],
    "stateMutability": "view"
  },
  {
    "type": "function",
    "name": "ALG_FRODO_1344_SHAKE",
    "inputs": [],
    "outputs": [
      {
        "name": "",
        "type": "uint16",
        "internalType": "uint16"
      }
    ],
    "stateMutability": "view"
  },
  {
    "type": "function",
    "name": "ALG_HQC_5",
    "inputs": [],
    "outputs": [
      {
        "name": "",
        "type": "uint16",
        "internalType": "uint16"
      }
    ],
    "stateMutability": "view"
  },
  {
    "type": "function",
    "name": "ALG_MCELIECE_8192128",
    "inputs": [],
    "outputs": [
      {
        "name": "",
        "type": "uint16",
        "internalType": "uint16"
      }
    ],
    "stateMutability": "view"
  },
  {
    "type": "function",
    "name": "ALG_ML_DSA_87",
    "inputs": [],
    "outputs": [
      {
        "name": "",
        "type": "uint16",
        "internalType": "uint16"
      }
    ],
    "stateMutability": "view"
  },
  {
    "type": "function",
    "name": "ALG_ML_KEM_1024",
    "inputs": [],
    "outputs": [
      {
        "name": "",
        "type": "uint16",
        "internalType": "uint16"
      }
    ],
    "stateMutability": "view"
  },
  {
    "type": "function",
    "name": "ALG_SLH_DSA_SHAKE_256S",
    "inputs": [],
    "outputs": [
      {
        "name": "",
        "type": "uint16",
        "internalType": "uint16"
      }
    ],
    "stateMutability": "view"
  },
  {
    "type": "function",
    "name": "CERT_MAGIC",
    "inputs": [],
    "outputs": [
      {
        "name": "",
        "type": "uint32",
        "internalType": "uint32"
      }
    ],
    "stateMutability": "view"
  },
  {
    "type": "function",
    "name": "CERT_VERSION",
    "inputs": [],
    "outputs": [
      {
        "name": "",
        "type": "uint32",
        "internalType": "uint32"
      }
    ],
    "stateMutability": "view"
  },
  {
    "type": "function",
    "name": "CHAIN_AUTHORITY_KEY_ID",
    "inputs": [],
    "outputs": [
      {
        "name": "",
        "type": "bytes32",
        "internalType": "bytes32"
      }
    ],
    "stateMutability": "view"
  },
  {
    "type": "function",
    "name": "DOMAIN_ENDPOINT_ADMISSION",
    "inputs": [],
    "outputs": [
      {
        "name": "",
        "type": "bytes32",
        "internalType": "bytes32"
      }
    ],
    "stateMutability": "view"
  },
  {
    "type": "function",
    "name": "DOMAIN_ENDPOINT_LEAF",
    "inputs": [],
    "outputs": [
      {
        "name": "",
        "type": "bytes32",
        "internalType": "bytes32"
      }
    ],
    "stateMutability": "view"
  },
  {
    "type": "function",
    "name": "LEN_FN_DSA_1024_PK",
    "inputs": [],
    "outputs": [
      {
        "name": "",
        "type": "uint256",
        "internalType": "uint256"
      }
    ],
    "stateMutability": "view"
  },
  {
    "type": "function",
    "name": "LEN_FRODO_1344_PK",
    "inputs": [],
    "outputs": [
      {
        "name": "",
        "type": "uint256",
        "internalType": "uint256"
      }
    ],
    "stateMutability": "view"
  },
  {
    "type": "function",
    "name": "LEN_HQC_5_PK",
    "inputs": [],
    "outputs": [
      {
        "name": "",
        "type": "uint256",
        "internalType": "uint256"
      }
    ],
    "stateMutability": "view"
  },
  {
    "type": "function",
    "name": "LEN_MCELIECE_8192128_PK",
    "inputs": [],
    "outputs": [
      {
        "name": "",
        "type": "uint256",
        "internalType": "uint256"
      }
    ],
    "stateMutability": "view"
  },
  {
    "type": "function",
    "name": "LEN_ML_DSA_87_PK",
    "inputs": [],
    "outputs": [
      {
        "name": "",
        "type": "uint256",
        "internalType": "uint256"
      }
    ],
    "stateMutability": "view"
  },
  {
    "type": "function",
    "name": "LEN_ML_KEM_1024_PK",
    "inputs": [],
    "outputs": [
      {
        "name": "",
        "type": "uint256",
        "internalType": "uint256"
      }
    ],
    "stateMutability": "view"
  },
  {
    "type": "function",
    "name": "LEN_SLH_DSA_PK",
    "inputs": [],
    "outputs": [
      {
        "name": "",
        "type": "uint256",
        "internalType": "uint256"
      }
    ],
    "stateMutability": "view"
  },
  {
    "type": "function",
    "name": "MAX_CERT_BYTES",
    "inputs": [],
    "outputs": [
      {
        "name": "",
        "type": "uint256",
        "internalType": "uint256"
      }
    ],
    "stateMutability": "view"
  },
  {
    "type": "function",
    "name": "PURPOSE_NETWORK_AUTH",
    "inputs": [],
    "outputs": [
      {
        "name": "",
        "type": "uint16",
        "internalType": "uint16"
      }
    ],
    "stateMutability": "view"
  },
  {
    "type": "function",
    "name": "STATUS_ACTIVE",
    "inputs": [],
    "outputs": [
      {
        "name": "",
        "type": "uint8",
        "internalType": "uint8"
      }
    ],
    "stateMutability": "view"
  },
  {
    "type": "function",
    "name": "STATUS_REVOKED",
    "inputs": [],
    "outputs": [
      {
        "name": "",
        "type": "uint8",
        "internalType": "uint8"
      }
    ],
    "stateMutability": "view"
  },
  {
    "type": "function",
    "name": "admissionDigest",
    "inputs": [
      {
        "name": "certificateHash",
        "type": "bytes32",
        "internalType": "bytes32"
      },
      {
        "name": "region",
        "type": "bytes32",
        "internalType": "bytes32"
      }
    ],
    "outputs": [
      {
        "name": "",
        "type": "bytes32",
        "internalType": "bytes32"
      }
    ],
    "stateMutability": "view"
  },
  {
    "type": "function",
    "name": "admissionNonce",
    "inputs": [],
    "outputs": [
      {
        "name": "",
        "type": "uint64",
        "internalType": "uint64"
      }
    ],
    "stateMutability": "view"
  },
  {
    "type": "function",
    "name": "endpointLeafOf",
    "inputs": [
      {
        "name": "endpointId",
        "type": "bytes32",
        "internalType": "bytes32"
      }
    ],
    "outputs": [
      {
        "name": "",
        "type": "bytes32",
        "internalType": "bytes32"
      }
    ],
    "stateMutability": "view"
  },
  {
    "type": "function",
    "name": "endpointOf",
    "inputs": [
      {
        "name": "endpointId",
        "type": "bytes32",
        "internalType": "bytes32"
      }
    ],
    "outputs": [
      {
        "name": "",
        "type": "tuple",
        "internalType": "struct FinalEndpointRegistry.Endpoint",
        "components": [
          {
            "name": "certificateHash",
            "type": "bytes32",
            "internalType": "bytes32"
          },
          {
            "name": "notBefore",
            "type": "uint64",
            "internalType": "uint64"
          },
          {
            "name": "notAfter",
            "type": "uint64",
            "internalType": "uint64"
          },
          {
            "name": "registeredAt",
            "type": "uint64",
            "internalType": "uint64"
          },
          {
            "name": "region",
            "type": "bytes32",
            "internalType": "bytes32"
          },
          {
            "name": "status",
            "type": "uint8",
            "internalType": "uint8"
          },
          {
            "name": "subjectDn",
            "type": "string",
            "internalType": "string"
          }
        ]
      }
    ],
    "stateMutability": "view"
  },
  {
    "type": "function",
    "name": "isActive",
    "inputs": [
      {
        "name": "endpointId",
        "type": "bytes32",
        "internalType": "bytes32"
      }
    ],
    "outputs": [
      {
        "name": "",
        "type": "bool",
        "internalType": "bool"
      }
    ],
    "stateMutability": "view"
  },
  {
    "type": "function",
    "name": "onERC1155BatchReceived",
    "inputs": [
      {
        "name": "",
        "type": "address",
        "internalType": "address"
      },
      {
        "name": "",
        "type": "address",
        "internalType": "address"
      },
      {
        "name": "",
        "type": "uint256[]",
        "internalType": "uint256[]"
      },
      {
        "name": "",
        "type": "uint256[]",
        "internalType": "uint256[]"
      },
      {
        "name": "",
        "type": "bytes",
        "internalType": "bytes"
      }
    ],
    "outputs": [
      {
        "name": "",
        "type": "bytes4",
        "internalType": "bytes4"
      }
    ],
    "stateMutability": "pure"
  },
  {
    "type": "function",
    "name": "onERC1155Received",
    "inputs": [
      {
        "name": "",
        "type": "address",
        "internalType": "address"
      },
      {
        "name": "",
        "type": "address",
        "internalType": "address"
      },
      {
        "name": "",
        "type": "uint256",
        "internalType": "uint256"
      },
      {
        "name": "",
        "type": "uint256",
        "internalType": "uint256"
      },
      {
        "name": "",
        "type": "bytes",
        "internalType": "bytes"
      }
    ],
    "outputs": [
      {
        "name": "",
        "type": "bytes4",
        "internalType": "bytes4"
      }
    ],
    "stateMutability": "pure"
  },
  {
    "type": "function",
    "name": "onERC721Received",
    "inputs": [
      {
        "name": "",
        "type": "address",
        "internalType": "address"
      },
      {
        "name": "",
        "type": "address",
        "internalType": "address"
      },
      {
        "name": "",
        "type": "uint256",
        "internalType": "uint256"
      },
      {
        "name": "",
        "type": "bytes",
        "internalType": "bytes"
      }
    ],
    "outputs": [
      {
        "name": "",
        "type": "bytes4",
        "internalType": "bytes4"
      }
    ],
    "stateMutability": "pure"
  },
  {
    "type": "function",
    "name": "parse",
    "inputs": [
      {
        "name": "tbs",
        "type": "bytes",
        "internalType": "bytes"
      }
    ],
    "outputs": [
      {
        "name": "p",
        "type": "tuple",
        "internalType": "struct FinalEndpointRegistry.Parsed",
        "components": [
          {
            "name": "certificateHash",
            "type": "bytes32",
            "internalType": "bytes32"
          },
          {
            "name": "subjectKeyId",
            "type": "bytes32",
            "internalType": "bytes32"
          },
          {
            "name": "notBefore",
            "type": "uint64",
            "internalType": "uint64"
          },
          {
            "name": "notAfter",
            "type": "uint64",
            "internalType": "uint64"
          },
          {
            "name": "subjectDn",
            "type": "string",
            "internalType": "string"
          },
          {
            "name": "mlDsaKey",
            "type": "bytes",
            "internalType": "bytes"
          },
          {
            "name": "slhDsaKey",
            "type": "bytes",
            "internalType": "bytes"
          },
          {
            "name": "fnDsaKey",
            "type": "bytes",
            "internalType": "bytes"
          },
          {
            "name": "mlKemKeyHash",
            "type": "bytes32",
            "internalType": "bytes32"
          },
          {
            "name": "hqcKeyHash",
            "type": "bytes32",
            "internalType": "bytes32"
          },
          {
            "name": "mcelieceKeyHash",
            "type": "bytes32",
            "internalType": "bytes32"
          },
          {
            "name": "frodoKeyHash",
            "type": "bytes32",
            "internalType": "bytes32"
          }
        ]
      }
    ],
    "stateMutability": "view"
  },
  {
    "type": "function",
    "name": "project",
    "inputs": [
      {
        "name": "endpointId",
        "type": "bytes32",
        "internalType": "bytes32"
      }
    ],
    "outputs": [],
    "stateMutability": "nonpayable"
  },
  {
    "type": "function",
    "name": "registerEndpoint",
    "inputs": [
      {
        "name": "tbs",
        "type": "bytes",
        "internalType": "bytes"
      },
      {
        "name": "region",
        "type": "bytes32",
        "internalType": "bytes32"
      },
      {
        "name": "proof",
        "type": "tuple",
        "internalType": "struct FinalEndpointRegistry.EndpointProof",
        "components": [
          {
            "name": "mlDsaSignature",
            "type": "bytes",
            "internalType": "bytes"
          },
          {
            "name": "slhDsaSignature",
            "type": "bytes",
            "internalType": "bytes"
          }
        ]
      },
      {
        "name": "anchorBlock",
        "type": "uint64",
        "internalType": "uint64"
      },
      {
        "name": "approvals",
        "type": "tuple[]",
        "internalType": "struct FinalPqQuorum.Approval[]",
        "components": [
          {
            "name": "signer",
            "type": "address",
            "internalType": "address"
          },
          {
            "name": "algorithm",
            "type": "uint8",
            "internalType": "uint8"
          },
          {
            "name": "signature",
            "type": "bytes",
            "internalType": "bytes"
          },
          {
            "name": "seal",
            "type": "bytes",
            "internalType": "bytes"
          }
        ]
      }
    ],
    "outputs": [
      {
        "name": "endpointId",
        "type": "bytes32",
        "internalType": "bytes32"
      }
    ],
    "stateMutability": "nonpayable"
  },
  {
    "type": "function",
    "name": "registry",
    "inputs": [],
    "outputs": [
      {
        "name": "",
        "type": "address",
        "internalType": "contract FinalIdentityRegistry"
      }
    ],
    "stateMutability": "view"
  },
  {
    "type": "function",
    "name": "revokeEndpoint",
    "inputs": [
      {
        "name": "endpointId",
        "type": "bytes32",
        "internalType": "bytes32"
      },
      {
        "name": "anchorBlock",
        "type": "uint64",
        "internalType": "uint64"
      },
      {
        "name": "approvals",
        "type": "tuple[]",
        "internalType": "struct FinalPqQuorum.Approval[]",
        "components": [
          {
            "name": "signer",
            "type": "address",
            "internalType": "address"
          },
          {
            "name": "algorithm",
            "type": "uint8",
            "internalType": "uint8"
          },
          {
            "name": "signature",
            "type": "bytes",
            "internalType": "bytes"
          },
          {
            "name": "seal",
            "type": "bytes",
            "internalType": "bytes"
          }
        ]
      }
    ],
    "outputs": [],
    "stateMutability": "nonpayable"
  },
  {
    "type": "function",
    "name": "sweepAsset",
    "inputs": [
      {
        "name": "kind",
        "type": "uint8",
        "internalType": "enum SweepKind"
      },
      {
        "name": "asset",
        "type": "address",
        "internalType": "address"
      },
      {
        "name": "id",
        "type": "uint256",
        "internalType": "uint256"
      },
      {
        "name": "amount",
        "type": "uint256",
        "internalType": "uint256"
      },
      {
        "name": "to",
        "type": "address",
        "internalType": "address"
      }
    ],
    "outputs": [
      {
        "name": "moved",
        "type": "uint256",
        "internalType": "uint256"
      }
    ],
    "stateMutability": "nonpayable"
  },
  {
    "type": "function",
    "name": "sweepableSurplus",
    "inputs": [
      {
        "name": "kind",
        "type": "uint8",
        "internalType": "enum SweepKind"
      },
      {
        "name": "asset",
        "type": "address",
        "internalType": "address"
      },
      {
        "name": "id",
        "type": "uint256",
        "internalType": "uint256"
      }
    ],
    "outputs": [
      {
        "name": "surplus",
        "type": "uint256",
        "internalType": "uint256"
      }
    ],
    "stateMutability": "view"
  },
  {
    "type": "function",
    "name": "trees",
    "inputs": [],
    "outputs": [
      {
        "name": "",
        "type": "address",
        "internalType": "contract FinalStateTrees"
      }
    ],
    "stateMutability": "view"
  },
  {
    "type": "event",
    "name": "AssetSwept",
    "inputs": [
      {
        "name": "kind",
        "type": "uint8",
        "indexed": true,
        "internalType": "enum SweepKind"
      },
      {
        "name": "asset",
        "type": "address",
        "indexed": true,
        "internalType": "address"
      },
      {
        "name": "to",
        "type": "address",
        "indexed": true,
        "internalType": "address"
      },
      {
        "name": "id",
        "type": "uint256",
        "indexed": false,
        "internalType": "uint256"
      },
      {
        "name": "amount",
        "type": "uint256",
        "indexed": false,
        "internalType": "uint256"
      }
    ],
    "anonymous": false
  },
  {
    "type": "event",
    "name": "EndpointRegistered",
    "inputs": [
      {
        "name": "endpointId",
        "type": "bytes32",
        "indexed": true,
        "internalType": "bytes32"
      },
      {
        "name": "certificateHash",
        "type": "bytes32",
        "indexed": false,
        "internalType": "bytes32"
      },
      {
        "name": "region",
        "type": "bytes32",
        "indexed": false,
        "internalType": "bytes32"
      },
      {
        "name": "notAfter",
        "type": "uint64",
        "indexed": false,
        "internalType": "uint64"
      },
      {
        "name": "subjectDn",
        "type": "string",
        "indexed": false,
        "internalType": "string"
      }
    ],
    "anonymous": false
  },
  {
    "type": "event",
    "name": "EndpointRevoked",
    "inputs": [
      {
        "name": "endpointId",
        "type": "bytes32",
        "indexed": true,
        "internalType": "bytes32"
      },
      {
        "name": "certificateHash",
        "type": "bytes32",
        "indexed": false,
        "internalType": "bytes32"
      }
    ],
    "anonymous": false
  },
  {
    "type": "error",
    "name": "AlreadyRegistered",
    "inputs": [
      {
        "name": "endpointId",
        "type": "bytes32",
        "internalType": "bytes32"
      }
    ]
  },
  {
    "type": "error",
    "name": "AlreadyRevoked",
    "inputs": [
      {
        "name": "endpointId",
        "type": "bytes32",
        "internalType": "bytes32"
      }
    ]
  },
  {
    "type": "error",
    "name": "BadKeyLength",
    "inputs": [
      {
        "name": "algorithm",
        "type": "uint16",
        "internalType": "uint16"
      },
      {
        "name": "length",
        "type": "uint256",
        "internalType": "uint256"
      }
    ]
  },
  {
    "type": "error",
    "name": "BadMagic",
    "inputs": [
      {
        "name": "got",
        "type": "uint32",
        "internalType": "uint32"
      }
    ]
  },
  {
    "type": "error",
    "name": "BadVersion",
    "inputs": [
      {
        "name": "got",
        "type": "uint32",
        "internalType": "uint32"
      }
    ]
  },
  {
    "type": "error",
    "name": "DuplicateKey",
    "inputs": [
      {
        "name": "purpose",
        "type": "uint16",
        "internalType": "uint16"
      },
      {
        "name": "algorithm",
        "type": "uint16",
        "internalType": "uint16"
      }
    ]
  },
  {
    "type": "error",
    "name": "Expired",
    "inputs": [
      {
        "name": "notAfter",
        "type": "uint64",
        "internalType": "uint64"
      }
    ]
  },
  {
    "type": "error",
    "name": "KeysNotSorted",
    "inputs": []
  },
  {
    "type": "error",
    "name": "MissingKey",
    "inputs": [
      {
        "name": "algorithm",
        "type": "uint16",
        "internalType": "uint16"
      }
    ]
  },
  {
    "type": "error",
    "name": "NotChainAttested",
    "inputs": [
      {
        "name": "authorityKeyId",
        "type": "bytes32",
        "internalType": "bytes32"
      }
    ]
  },
  {
    "type": "error",
    "name": "PossessionNotProved",
    "inputs": []
  },
  {
    "type": "error",
    "name": "PrecompileUnavailable",
    "inputs": [
      {
        "name": "precompile",
        "type": "address",
        "internalType": "address"
      }
    ]
  },
  {
    "type": "error",
    "name": "SubjectKeyIdMismatch",
    "inputs": [
      {
        "name": "derived",
        "type": "bytes32",
        "internalType": "bytes32"
      },
      {
        "name": "declared",
        "type": "bytes32",
        "internalType": "bytes32"
      }
    ]
  },
  {
    "type": "error",
    "name": "SweepAboveSurplus",
    "inputs": [
      {
        "name": "asset",
        "type": "address",
        "internalType": "address"
      },
      {
        "name": "requested",
        "type": "uint256",
        "internalType": "uint256"
      },
      {
        "name": "surplus",
        "type": "uint256",
        "internalType": "uint256"
      }
    ]
  },
  {
    "type": "error",
    "name": "SweepDestinationNotAllowed",
    "inputs": [
      {
        "name": "to",
        "type": "address",
        "internalType": "address"
      }
    ]
  },
  {
    "type": "error",
    "name": "SweepTransferFailed",
    "inputs": [
      {
        "name": "asset",
        "type": "address",
        "internalType": "address"
      }
    ]
  },
  {
    "type": "error",
    "name": "SweepUnauthorized",
    "inputs": [
      {
        "name": "caller",
        "type": "address",
        "internalType": "address"
      }
    ]
  },
  {
    "type": "error",
    "name": "SweepZeroAmount",
    "inputs": []
  },
  {
    "type": "error",
    "name": "TooLarge",
    "inputs": [
      {
        "name": "length",
        "type": "uint256",
        "internalType": "uint256"
      }
    ]
  },
  {
    "type": "error",
    "name": "Truncated",
    "inputs": [
      {
        "name": "needed",
        "type": "uint256",
        "internalType": "uint256"
      },
      {
        "name": "got",
        "type": "uint256",
        "internalType": "uint256"
      }
    ]
  },
  {
    "type": "error",
    "name": "UnknownEndpoint",
    "inputs": [
      {
        "name": "endpointId",
        "type": "bytes32",
        "internalType": "bytes32"
      }
    ]
  },
  {
    "type": "error",
    "name": "ValidityInverted",
    "inputs": [
      {
        "name": "notBefore",
        "type": "uint64",
        "internalType": "uint64"
      },
      {
        "name": "notAfter",
        "type": "uint64",
        "internalType": "uint64"
      }
    ]
  },
  {
    "type": "error",
    "name": "WrongAlgorithmForSlot",
    "inputs": [
      {
        "name": "purpose",
        "type": "uint16",
        "internalType": "uint16"
      },
      {
        "name": "algorithm",
        "type": "uint16",
        "internalType": "uint16"
      }
    ]
  }
]

read contract

bytecode · 10,873 bytes

0x6080806040526004361015610012575f80fd5b5f905f3560e01c90816307a6bec21461169b5750806311f4028d14611675578063150b7a021461161f578063178bcc93146115db5780631c06f04b146115bf57806324ce0c20146115a4578063306f0d92146115895780633d8f78181461156d5780634389cc2214611536578063534491c61461155157806355b40092146115365780635a97cf34146115195780635bbd6c74146114fe5780635c36901c146114885780635fa062d71461144e57806360a180081461141a57806363ddda1f146113ff5780636abb04e114610dd35780637870a34d14610db55780637b10399914610d7057806384e570a714610d5457806386011a8b14610d32578063880518b114610d1557806388091b6e14610cf65780638a46da1414610cd95780638b44ceac14610c9e57806392880ad014610c8257806396f51f3a146109855780639d9e1e01146106e55780639ecfde84146106c8578063a9218f90146106ac578063ab091871146104dd578063b4095a0f146104c0578063b6efac9d14610485578063bc197c81146103ec578063c93a78b7146103cf578063cb9943bb14610394578063ccdf6bf81461036d578063cf5b579e14610351578063f23a6e61146102f65763fab4087a146101e1575f80fd5b346102f35760203660031901126102f357600435906001600160401b0382116102f35761021a6102143660048501611713565b90611ad1565b60405180916020825280516020830152602081015160408301526001600160401b0360408201511660608301526001600160401b0360608201511660808301526101606102c46102ad610297610281608086015161018060a08901526101a0880190611770565b60a0860151878203601f190160c0890152611770565b60c0850151868203601f190160e0880152611770565b60e0840151858203601f1901610100870152611770565b916101008101516101208501526101208101516101408501526101408101518285015201516101808301520390f35b80fd5b50346102f35760a03660031901126102f3576103106116d3565b506103196116e9565b506084356001600160401b03811161034d57610339903690600401611713565b505060405163f23a6e6160e01b8152602090f35b5080fd5b50346102f357806003193601126102f357602060405160408152f35b50346102f35760203660031901126102f357602061038c600435611939565b604051908152f35b50346102f357806003193601126102f35760206040517f9a6a5d8139ad2d28957698330aaa691017dba7dc80eb7cbec585239fb680bbab8152f35b50346102f357806003193601126102f35760206040516107018152f35b50346102f35760a03660031901126102f3576104066116d3565b5061040f6116e9565b506044356001600160401b03811161034d5761042f903690600401611740565b50506064356001600160401b03811161034d57610450903690600401611740565b50506084356001600160401b03811161034d57610471903690600401611713565b505060405163bc197c8160e01b8152602090f35b50346102f357806003193601126102f35760206040517f0b5c16cf405bd568bea860ce2c3d0d2b1ee7f9e8d5713a2f78d5e0a5c0bfe6e28152f35b50346102f357806003193601126102f3576020604051610a208152f35b50346102f35760203660031901126102f357606060c06040516104ff816117ad565b83815283602082015283604082015283838201528360808201528360a0820152015260043581528060205260408120906040519061053c826117ad565b8254825260018301549260208301936001600160401b038116855260408401906001600160401b038160401c1682526001600160401b03606086019160801c16815260028301549160808601928352600460ff6003860154169460a08801958652019460405195818154916105b08361184e565b808a52926001811690811561067c575060011461063a575b5050508594926001600160401b0360ff95936105ea61063699839503896117dc565b60c08a01978852816040519b8c9b60208d525160208d0152511660408b015251166060890152511660808701525160a0860152511660c08401525160e080840152610100830190611770565b0390f35b9080935052602082205b8183106106625750508501602001826001600160401b0360ff6105c8565b6001816020929493945483858c0101520191019190610644565b60ff19166020808c019190915293151560051b8a0190930193508592506001600160401b03915060ff90506105c8565b50346102f357806003193601126102f357602060405160028152f35b50346102f357806003193601126102f3576020604051611c458152f35b50346102f35760603660031901126102f357600435602435906001600160401b038216809203610981576044356001600160401b0381116108965761072e903690600401611740565b9092828552846020526040852093600385019260ff845416801561096d576002146109595760018060a01b037f000000000000000000000000c19d888a2f7ba65a8dcf8d03ad8f1af5cdc6643016918654604051602081019188835260408201526040815261079e6060826117dc565b519020833b156109555790828995949392604051956322f3f44760e11b875260848701917f0b5c16cf405bd568bea860ce2c3d0d2b1ee7f9e8d5713a2f78d5e0a5c0bfe6e2600489015260248801526044870152608060648701525260a4840160a060048460051b8701010192828790607e19813603015b8383106108a55750505050505083918383818481955003925af1801561089a57610881575b50507fc3d98c8e03300e61427ccfbbaf7524b9b9977b1d377eca3f7a98ccad29b79690602061087e948493600260ff1982541617905554604051908152a261252c565b80f35b8161088b916117dc565b61089657835f61083b565b8380fd5b6040513d84823e3d90fd5b91939590929496979850609f196003198a8303010186528635828112156109515783016001600160a01b036108d9826116ff565b16825260208101359160ff831680930361094d5761093960209282600195858095015261092b61092061090f60408501856117fd565b60806040860152608085019161182e565b9260608101906117fd565b91606081850391015261182e565b98019601930190918c989796959492610816565b8e80fd5b8d80fd5b8880fd5b6390315de160e01b87526004859052602487fd5b632e7bb98160e21b88526004869052602488fd5b8280fd5b50346102f35760a03660031901126102f357600435600481101561034d576109ab6116e9565b91606435916084356001600160a01b03811692604435929184810361034d576109d2612648565b60405163f5778b0360e01b81526020816004817f000000000000000000000000c19d888a2f7ba65a8dcf8d03ad8f1af5cdc664306001600160a01b03165afa908115610c77578391610c48575b508515908115610c24575b50610c1057610a3a848885611794565b955f198103610c0b5750855b80968115610bfc57808211610bd75750829184610ae95750508180808089895af1610a6f61190a565b5015610ad5575b610ac15750604080519283526020838101869052956001600160a01b0316927f7643c83e539cea2f6bf506545392e52cfd5f917e327efbcd0ba28f29c28d042e9190a4604051908152f35b634e487b7160e01b81526021600452602490fd5b6365f4a9ef60e11b82526004829052602482fd5b8392509060018503610b43575060405163a9059cbb60e01b60208201526001600160a01b03909116602482015260448101879052610b3e90610b3881606481015b03601f1981018352826117dc565b886127f4565b610a76565b969150508195600284145f14610b8c575050600194610b3e6040516323b872dd60e01b602082015230602482015286604482015285606482015260648152610b386084826117dc565b610b3e9060409792975190637921219560e11b6020830152306024830152876044830152866064830152608482015260a060a48201528360c482015260c48152610b3860e4826117dc565b632190968160e01b84526001600160a01b038916600452602491909152604452606482fd5b637c2e506f60e11b8452600484fd5b610a46565b6315150d4d60e31b82526004859052602482fd5b6001600160a01b0316861415905080610c3e575b5f610a2a565b5033851415610c38565b610c6a915060203d602011610c70575b610c6281836117dc565b810190612629565b5f610a1f565b503d610c58565b6040513d85823e3d90fd5b50346102f357806003193601126102f357602060405160058152f35b50346102f357806003193601126102f35760206040517fab38cc1669d86f8735cbdca240ab730ca375c29f9052ec2d582d5d125313c78e8152f35b50346102f357806003193601126102f35760206040516106208152f35b50346102f357806003193601126102f357602060405163505143468152f35b50346102f35760203660031901126102f35761087e60043561252c565b50346102f35760403660031901126102f357602061038c602435600435611886565b50346102f357806003193601126102f357602060405160068152f35b50346102f357806003193601126102f3576040517f000000000000000000000000c19d888a2f7ba65a8dcf8d03ad8f1af5cdc664306001600160a01b03168152602090f35b50346102f357806003193601126102f35760206040516216e3608152f35b50346113d65760a03660031901126113d6576004356001600160401b0381116113d657610e04903690600401611713565b602435604435916001600160401b0383116113d6578260040192604060031982360301126113d657606435936001600160401b0385168095036113d6576084356001600160401b0381116113d657610e63610e6b913690600401611740565b949097611ad1565b94602086015196875f525f60205260ff600360405f200154166113ec5760608701946001600160401b038651168042116113da575060018060a01b037f000000000000000000000000c19d888a2f7ba65a8dcf8d03ad8f1af5cdc66430169188516040516020810191825289604082015260408152610eeb6060826117dc565b519020833b156113d657939190816040519586946322f3f44760e11b865260848601917f0fa658c1d006b02df1932f538d6a2916c308c2b37e7c48bc739709d89cceb357600488015260248701526044860152608060648601525260a4830160a060048460051b8601010192825f90607e19813603015b83831061135e5750505050505091815f818582965003925af180156113535761133e575b50610f92848651611886565b60015460016001600160401b038216016001600160401b03811161132a576001600160401b0316906001600160401b0319161760015560405190602082015260208152610fe06040826117dc565b61100360a087015182610ffd610ff686806124fa565b3691611a65565b9161293b565b1561131b5760c08601519182516112e4575b5050505082516001600160401b036040850151169060046001600160401b0384511691878960808901958651956040519461104f866117ad565b8552602085019182526040850190815260608501906001600160401b0342168252604060808701948c865260a08801966001885260c089019a8b5281528060205220955186556001600160401b03600187019351166001600160401b031984541617835551906fffffffffffffffff00000000000000008354916001600160401b0360801b905160801b169260401b169077ffffffffffffffffffffffffffffffff000000000000000019161717905551600283015560ff6003830191511660ff19825416179055019051968751906001600160401b0382116112d057611136835461184e565b601f811161127e575b50602098889695949392918a91906001601f8511146111e75792807fdc71a128d817a5fcb36848826c0ac6080d65382df7a4a5a725db9c8b6cb7bb35999a936111d09796936001600160401b0396926111dc575b50508160011b915f199060031b1c19161790555b519351169051906040519485948552898501526040840152608060608401526080830190611770565b0390a261038c8161252c565b015190505f80611193565b9893929190601f198316848b52828b209a5b8181106112645750927fdc71a128d817a5fcb36848826c0ac6080d65382df7a4a5a725db9c8b6cb7bb35999a6001600160401b039593600193836111d09a99971061124c575b505050811b0190556111a7565b01515f1960f88460031b161c191690555f808061123f565b838301518c556001909b019a8c9a50928d01928d016111f9565b8281111561113f579883825260208220601f840160051c90602085106112c8575b81019a601f0160051c03825b8181106112ba5750509861113f565b80846001928e0155016112ab565b83915061129f565b634e487b7160e01b81526041600452602490fd5b610ff66112f89160246112fe9601906124fa565b916129fd565b1561130c575f808080611015565b6349b6b5bb60e11b8552600485fd5b6349b6b5bb60e11b8852600488fd5b634e487b7160e01b8a52601160045260248afd5b61134b9197505f906117dc565b5f955f610f86565b6040513d5f823e3d90fd5b60a3198a8803018552949650929491939092918635828112156113d65783016001600160a01b0361138e826116ff565b16825260208101359160ff83168093036113d6576113c460209282600195858095015261092b61092061090f60408501856117fd565b98019601930190918896959492610f62565b5f80fd5b639569365360e01b5f5260045260245ffd5b87633be57b3960e11b5f5260045260245ffd5b346113d6575f3660031901126113d657602060405160048152f35b346113d65760603660031901126113d65760043560048110156113d65761038c6020916114456116e9565b60443591611794565b346113d6575f3660031901126113d65760206040517f4692dd1ea4cf3c6195d8e589aa4fc670450b78e39a818a4516a117f9b388ae698152f35b346113d65760203660031901126113d6576004355f525f602052602060405f20600160ff6003830154161490816114e6575b816114cb575b506040519015158152f35b6001600160401b0391506001015460401c16421115826114c0565b60018101546001600160401b031642101591506114ba565b346113d6575f3660031901126113d657602060405160078152f35b346113d6575f3660031901126113d65760206040516214b8008152f35b346113d6575f3660031901126113d657602060405160018152f35b346113d6575f3660031901126113d65760206040516102028152f35b346113d6575f3660031901126113d65760206040516154108152f35b346113d6575f3660031901126113d657602060405160028152f35b346113d6575f3660031901126113d657602060405160038152f35b346113d6575f3660031901126113d65760206040516102018152f35b346113d6575f3660031901126113d6576040517f000000000000000000000000e604b1cf1ae764636263e394c206508b9e9a965e6001600160a01b03168152602090f35b346113d65760803660031901126113d6576116386116d3565b506116416116e9565b506064356001600160401b0381116113d657611661903690600401611713565b5050604051630a85bd0160e11b8152602090f35b346113d6575f3660031901126113d65760206001600160401b0360015416604051908152f35b346113d6575f3660031901126113d657807f0fa658c1d006b02df1932f538d6a2916c308c2b37e7c48bc739709d89cceb35760209252f35b600435906001600160a01b03821682036113d657565b602435906001600160a01b03821682036113d657565b35906001600160a01b03821682036113d657565b9181601f840112156113d6578235916001600160401b0383116113d657602083818601950101116113d657565b9181601f840112156113d6578235916001600160401b0383116113d6576020808501948460051b0101116113d657565b805180835260209291819084018484015e5f828201840152601f01601f1916010190565b9061179f92916123a3565b80156117a85790565b505f90565b60e081019081106001600160401b038211176117c857604052565b634e487b7160e01b5f52604160045260245ffd5b90601f801991011681019081106001600160401b038211176117c857604052565b9035601e19823603018112156113d65701602081359101916001600160401b0382116113d65781360383136113d657565b908060209392818452848401375f828201840152601f01601f1916010190565b90600182811c9216801561187c575b602083101461186857565b634e487b7160e01b5f52602260045260245ffd5b91607f169161185d565b906001600160401b03600154166040519160208301937fab38cc1669d86f8735cbdca240ab730ca375c29f9052ec2d582d5d125313c78e8552466040850152306060850152608084015260a083015260c082015260c081526118e960e0826117dc565b51902090565b6001600160401b0381116117c857601f01601f191660200190565b3d15611934573d9061191b826118ef565b9161192960405193846117dc565b82523d5f602084013e565b606090565b5f525f60205260405f2060ff60038201541680156119ba5781549160026001600160401b03600183015460401c16910154906040519260208401947f4692dd1ea4cf3c6195d8e589aa4fc670450b78e39a818a4516a117f9b388ae69865260408501526060840152608083015260a082015260a081526118e960c0826117dc565b50505f90565b909392938483116113d65784116113d6578101920390565b356001600160e01b03198116929190600482106119f3575050565b6001600160e01b031960049290920360031b82901b16169150565b91908201809211611a1b57565b634e487b7160e01b5f52601160045260245ffd5b356001600160c01b0319811692919060088210611a4a575050565b6001600160c01b031960089290920360031b82901b16169150565b929192611a71826118ef565b91611a7f60405193846117dc565b8294818452818301116113d6578281602093845f960137010152565b356001600160f01b0319811692919060028210611ab6575050565b6001600160f01b031960029290920360031b82901b16169150565b91906040519261018084018481106001600160401b038211176117c8576040525f84525f6020850152604084015f815260608501945f8652608081019160608352606060a0830152606060c0830152606060e08301525f6101008301525f6101208301525f6101408301525f61016083015281966216e3608611612390576008861061237857856004116113d657843560e01c63505143451981016123665750856008116113d657600485013560e01c600119810161235457506008602a871061233c57603a871061232457866032116113d6576001600160401b03620f4240611bbe83602a8a01611a2f565b60c01c0416835286603a116113d6576001600160401b039182620f4240611be9829460328b01611a2f565b60c01c0416815251169151168082111561230f575050603e84106122f75783603e116113d657600491611c1f83603a86016119d8565b60e01c603e0180603e116122e457611c38818787612894565b80603e116122e457610ff6611c9392611c76611c58611c7f948a8a6128b6565b9390611c6e611c678683611a0e565b9582611a0e565b908b8b6119c0565b905286866128b6565b611c8b81839493611a0e565b9287876128f6565b7f9a6a5d8139ad2d28957698330aaa691017dba7dc80eb7cbec585239fb680bbab81036122d3575090611ccb611cdf939286866128b6565b611cd781839693611a0e565b9487876128f6565b936002840184116122c057611cf8600285018783612894565b611d10611d0a600286018689856119c0565b90611a9b565b60f01c95600285015f5f985f915b818310611f8e57505050809715611f7c5761010084015115611f695761012084015115611f565761014084015115611f425761016084015115611f2e576002810190818111611f1b57611d0a82611d8192611d7a828789612894565b85876119c0565b60f01c5f905b808210611ea4575050818103611e90575090611da4913691611a65565b80515f9690602060405180928286016102025afa90519060203d141615611e7c57835284810360011901908111611e6957611de28160028701611a0e565b825110611e445760405194602092869291016022016102025afa92519260203d141615611e3057602083910152828203611e1c5750505050565b637d76d56b60e01b84525260245260449150fd5b634e6f9bdf60e11b85526102028252602485fd5b83604492611e56899360028901611a0e565b905163076c85eb60e51b84529152602452fd5b634e487b7160e01b875260118452602487fd5b634e6f9bdf60e11b88526102028552602488fd5b8463076c85eb60e51b5f525260245260445ffd5b90916007810190818111611f0857611ebd828688612894565b60038101809111611f085781611ee3611edd600194611f0094898b6119c0565b906119d8565b60e01c90611efb611ef48383611a0e565b888a612894565b611a0e565b920190611d87565b601188634e487b7160e01b5f525260245ffd5b601186634e487b7160e01b5f525260245ffd5b6102028563055022b560e41b5f525260245ffd5b6102018563055022b560e41b5f525260245ffd5b60078563055022b560e41b5f525260245ffd5b60038563055022b560e41b5f525260245ffd5b8463055022b560e41b5f52805260245ffd5b9091929960088b018b11611f0857611faa60088c018688612894565b60028b018b11611f0857611fc6611d0a60028d018d888a6119c0565b60f01c91888c018c116122ad579160089186949361201f6120188f61200c611edd8f8e611fff611d0a8e848801906002890190856119c0565b9c8b8601928601916119c0565b60e01c96879101611a0e565b898b612894565b8263ffff00008760e01c1617908761226c575b509460018160f01c0361225257828b036120a2575050610a20820361208e575061208681612076610ff68e600861206d600197828401611a0e565b91018a8c6119c0565b60a08a01526008839d5b01611a0e565b930191611d1e565b88638710198360e01b5f525260245260445ffd5b600583929e93145f146120fe5750604083036120e85750816008826120de610ff66120d4600197856120869801611a0e565b8385018c8e6119c0565b60c08c0152612080565b905088638710198360e01b5f525260245260445ffd5b60068203612136575061070183036120e857508160088261212c610ff66120d4600197856120869801611a0e565b60e08c0152612080565b60038203612176575061062083036120e8575081600882612164610ff66120d4600197856120869801611a0e565b602081519101206101008c0152612080565b600782036121b65750611c4583036120e85750816008826121a4610ff66120d4600197856120869801611a0e565b602081519101206101208c0152612080565b61020182036121f857506214b80083036120e85750816008826121e6610ff66120d4600197856120869801611a0e565b602081519101206101408c0152612080565b6102028203612239575061541083036120e8575081600882612227610ff66120d4600197856120869801611a0e565b602081519101206101608c0152612080565b8a90633620691760e01b5f5260f01c905260245260445ffd5b8a9150633620691760e01b5f5260f01c905260245260445ffd5b63ffffffff1680821061229f578114612285575f612032565b828b876312250c6160e31b5f5260f01c905260245260445ffd5b8b63272bfea360e01b5f525ffd5b601189634e487b7160e01b5f525260245ffd5b601183634e487b7160e01b5f525260245ffd5b83637557fe2160e11b5f525260245ffd5b601184634e487b7160e01b5f525260245ffd5b8363076c85eb60e51b5f52603e60045260245260445ffd5b6323eff18360e21b5f5260045260245260445ffd5b8663076c85eb60e51b5f52603a60045260245260445ffd5b8663076c85eb60e51b5f52602a60045260245260445ffd5b6391aefaa760e01b5f5260045260245ffd5b633782d09760e21b5f5260045260245ffd5b8563076c85eb60e51b5f52600860045260245260445ffd5b85630fa6ad5f60e11b5f5260045260245ffd5b9060048210156124e65781156124df575f928392600181146124b65760021461242e57604051627eeac760e11b6020820190815230602483015260448201929092526123f28160648101610b2a565b51915afa6123fe61190a565b9080612422575b156117a857602081519181808201938492010103126113d6575190565b50602081511015612405565b60405160208101916331a9108f60e11b83526024820152602481526124546044826117dc565b51915afa61246061190a565b816124a8575b8161247b575b501561247757600190565b5f90565b90506020818051810103126113d657602001516001600160a01b038116908190036113d65730145f61246c565b905060208151101590612466565b505060405160208101906370a0823160e01b8252306024820152602481526123f26044826117dc565b5050504790565b634e487b7160e01b5f52602160045260245ffd5b903590601e19813603018212156113d657018035906001600160401b0382116113d6576020019181360383136113d657565b604080519161253b82846117dc565b600183526020830190601f1983013683378351156125fd5781527f000000000000000000000000e604b1cf1ae764636263e394c206508b9e9a965e6001600160a01b031690813b156113d657825163113eaebd60e11b815260206004820152935160248501819052849160448301915f5b8181106125e45750505091815f81819503925af19081156125db57506125cf5750565b5f6125d9916117dc565b565b513d5f823e3d90fd5b82518452879450602093840193909201916001016125ac565b634e487b7160e01b5f52603260045260245ffd5b908160209103126113d6575180151581036113d65790565b908160209103126113d657516001600160a01b03811681036113d65790565b6040516328305db160e21b81527f000000000000000000000000c19d888a2f7ba65a8dcf8d03ad8f1af5cdc664306001600160a01b031690602081600481855afa908115611353575f916127d5575b501580612780575b61277d5760405163e14c465b60e01b8152602081600481855afa908115611353575f91612749575b50604051632e4bfa5160e11b815233600482015260248101919091529060209082908180604481015b03915afa908115611353575f9161271a575b506125d95763321cbc0960e21b5f523360045260245ffd5b61273c915060203d602011612742575b61273481836117dc565b810190612611565b5f612702565b503d61272a565b90506020813d602011612775575b81612764602093836117dc565b810103126113d657516126f06126c7565b3d9150612757565b50565b5060405163f5778b0360e01b8152602081600481855afa908115611353575f916127b6575b506001600160a01b0316331461269f565b6127cf915060203d602011610c7057610c6281836117dc565b5f6127a5565b6127ee915060203d6020116127425761273481836117dc565b5f612697565b90813b15612873575f816020829351910182855af161281161190a565b9015908115612843575b506128235750565b6365f4a9ef60e11b5f9081526001600160a01b0391909116600452602490fd5b8051801515925082612858575b50505f61281b565b61286b9250602080918301019101612611565b155f80612850565b506365f4a9ef60e11b5f9081526001600160a01b0391909116600452602490fd5b50908082106128a1575050565b63076c85eb60e51b5f5260045260245260445ffd5b9290916004810193848211611a1b576128e2611edd866125d9946128db828987612894565b87856119c0565b60e01c936128f08587611a0e565b91612894565b92909190601f1901612934576020810191828211611a1b57612917936119c0565b90359060208110612926575090565b5f199060200360031b1b1690565b5050505f90565b610a208151148015906129f0575b61293457602061299c5f948286958160405195869481808701998051918291018b5e8601908282018b8152815193849201905e010190878252805192839101825e0185815203601f1981018352826117dc565b51906102045afa6129ab61190a565b816129e4575b816129ba575090565b90506020815191015190602081106129d3575b50151590565b5f199060200360031b1b165f6129cd565b805160201491506129b1565b5061121383511415612949565b6040815114801590612a6c575b612934576020612a5d5f948286958160405195869481808701998051918291018b5e8601908282018b8152815193849201905e010190878252805192839101825e0185815203601f1981018352826117dc565b51906102055afa6129ab61190a565b5061746083511415612a0a56
No CBOR metadata tail — this bytecode was built with cbor_metadata off, the setting our own contracts pin for CREATE2 address invariance.

disassembly (first 4,000 ops)

pcopoperand
0000PUSH10x80
0002DUP1
0003PUSH10x40
0005MSTORE
0006PUSH10x04
0008CALLDATASIZE
0009LT
000aISZERO
000bPUSH20x0012
000eJUMPI
000fPUSH0
0010DUP1
0011REVERT
0012JUMPDEST
0013PUSH0
0014SWAP1
0015PUSH0
0016CALLDATALOAD
0017PUSH10xe0
0019SHR
001aSWAP1
001bDUP2
001cPUSH40x07a6bec2
0021EQ
0022PUSH20x169b
0025JUMPI
0026POP
0027DUP1
0028PUSH40x11f4028d
002dEQ
002ePUSH20x1675
0031JUMPI
0032DUP1
0033PUSH40x150b7a02
0038EQ
0039PUSH20x161f
003cJUMPI
003dDUP1
003ePUSH40x178bcc93
0043EQ
0044PUSH20x15db
0047JUMPI
0048DUP1
0049PUSH40x1c06f04b
004eEQ
004fPUSH20x15bf
0052JUMPI
0053DUP1
0054PUSH40x24ce0c20
0059EQ
005aPUSH20x15a4
005dJUMPI
005eDUP1
005fPUSH40x306f0d92
0064EQ
0065PUSH20x1589
0068JUMPI
0069DUP1
006aPUSH40x3d8f7818
006fEQ
0070PUSH20x156d
0073JUMPI
0074DUP1
0075PUSH40x4389cc22
007aEQ
007bPUSH20x1536
007eJUMPI
007fDUP1
0080PUSH40x534491c6
0085EQ
0086PUSH20x1551
0089JUMPI
008aDUP1
008bPUSH40x55b40092
0090EQ
0091PUSH20x1536
0094JUMPI
0095DUP1
0096PUSH40x5a97cf34
009bEQ
009cPUSH20x1519
009fJUMPI
00a0DUP1
00a1PUSH40x5bbd6c74
00a6EQ
00a7PUSH20x14fe
00aaJUMPI
00abDUP1
00acPUSH40x5c36901c
00b1EQ
00b2PUSH20x1488
00b5JUMPI
00b6DUP1
00b7PUSH40x5fa062d7
00bcEQ
00bdPUSH20x144e
00c0JUMPI
00c1DUP1
00c2PUSH40x60a18008
00c7EQ
00c8PUSH20x141a
00cbJUMPI
00ccDUP1
00cdPUSH40x63ddda1f
00d2EQ
00d3PUSH20x13ff
00d6JUMPI
00d7DUP1
00d8PUSH40x6abb04e1
00ddEQ
00dePUSH20x0dd3
00e1JUMPI
00e2DUP1
00e3PUSH40x7870a34d
00e8EQ
00e9PUSH20x0db5
00ecJUMPI
00edDUP1
00eePUSH40x7b103999
00f3EQ
00f4PUSH20x0d70
00f7JUMPI
00f8DUP1
00f9PUSH40x84e570a7
00feEQ
00ffPUSH20x0d54
0102JUMPI
0103DUP1
0104PUSH40x86011a8b
0109EQ
010aPUSH20x0d32
010dJUMPI
010eDUP1
010fPUSH40x880518b1
0114EQ
0115PUSH20x0d15
0118JUMPI
0119DUP1
011aPUSH40x88091b6e
011fEQ
0120PUSH20x0cf6
0123JUMPI
0124DUP1
0125PUSH40x8a46da14
012aEQ
012bPUSH20x0cd9
012eJUMPI
012fDUP1
0130PUSH40x8b44ceac
0135EQ
0136PUSH20x0c9e
0139JUMPI
013aDUP1
013bPUSH40x92880ad0
0140EQ
0141PUSH20x0c82
0144JUMPI
0145DUP1
0146PUSH40x96f51f3a
014bEQ
014cPUSH20x0985
014fJUMPI
0150DUP1
0151PUSH40x9d9e1e01
0156EQ
0157PUSH20x06e5
015aJUMPI
015bDUP1
015cPUSH40x9ecfde84
0161EQ
0162PUSH20x06c8
0165JUMPI
0166DUP1
0167PUSH40xa9218f90
016cEQ
016dPUSH20x06ac
0170JUMPI
0171DUP1
0172PUSH40xab091871
0177EQ
0178PUSH20x04dd
017bJUMPI
017cDUP1
017dPUSH40xb4095a0f
0182EQ
0183PUSH20x04c0
0186JUMPI
0187DUP1
0188PUSH40xb6efac9d
018dEQ
018ePUSH20x0485
0191JUMPI
0192DUP1
0193PUSH40xbc197c81
0198EQ
0199PUSH20x03ec
019cJUMPI
019dDUP1
019ePUSH40xc93a78b7
01a3EQ
01a4PUSH20x03cf
01a7JUMPI
01a8DUP1
01a9PUSH40xcb9943bb
01aeEQ
01afPUSH20x0394
01b2JUMPI
01b3DUP1
01b4PUSH40xccdf6bf8
01b9EQ
01baPUSH20x036d
01bdJUMPI
01beDUP1
01bfPUSH40xcf5b579e
01c4EQ
01c5PUSH20x0351
01c8JUMPI
01c9DUP1
01caPUSH40xf23a6e61
01cfEQ
01d0PUSH20x02f6
01d3JUMPI
01d4PUSH40xfab4087a
01d9EQ
01daPUSH20x01e1
01ddJUMPI
01dePUSH0
01dfDUP1
01e0REVERT
01e1JUMPDEST
01e2CALLVALUE
01e3PUSH20x02f3
01e6JUMPI
01e7PUSH10x20
01e9CALLDATASIZE
01eaPUSH10x03
01ecNOT
01edADD
01eeSLT
01efPUSH20x02f3
01f2JUMPI
01f3PUSH10x04
01f5CALLDATALOAD
01f6SWAP1
01f7PUSH10x01
01f9PUSH10x01
01fbPUSH10x40
01fdSHL
01feSUB
01ffDUP3
0200GT
0201PUSH20x02f3
0204JUMPI
0205PUSH20x021a
0208PUSH20x0214
020bCALLDATASIZE
020cPUSH10x04
020eDUP6
020fADD
0210PUSH20x1713
0213JUMP
0214JUMPDEST
0215SWAP1
0216PUSH20x1ad1
0219JUMP
021aJUMPDEST
021bPUSH10x40
021dMLOAD
021eDUP1
021fSWAP2
0220PUSH10x20
0222DUP3
0223MSTORE
0224DUP1
0225MLOAD
0226PUSH10x20
0228DUP4
0229ADD
022aMSTORE
022bPUSH10x20
022dDUP2
022eADD
022fMLOAD
0230PUSH10x40
0232DUP4
0233ADD
0234MSTORE
0235PUSH10x01
0237PUSH10x01
0239PUSH10x40
023bSHL
023cSUB
023dPUSH10x40
023fDUP3
0240ADD
0241MLOAD
0242AND
0243PUSH10x60
0245DUP4
0246ADD
0247MSTORE
0248PUSH10x01
024aPUSH10x01
024cPUSH10x40
024eSHL
024fSUB
0250PUSH10x60
0252DUP3
0253ADD
0254MLOAD
0255AND
0256PUSH10x80
0258DUP4
0259ADD
025aMSTORE
025bPUSH20x0160
025ePUSH20x02c4
0261PUSH20x02ad
0264PUSH20x0297
0267PUSH20x0281
026aPUSH10x80
026cDUP7
026dADD
026eMLOAD
026fPUSH20x0180
0272PUSH10xa0
0274DUP10
0275ADD
0276MSTORE
0277PUSH20x01a0
027aDUP9
027bADD
027cSWAP1
027dPUSH20x1770
0280JUMP
0281JUMPDEST
0282PUSH10xa0
0284DUP7
0285ADD
0286MLOAD
0287DUP8
0288DUP3
0289SUB
028aPUSH10x1f
028cNOT
028dADD
028ePUSH10xc0
0290DUP10
0291ADD
0292MSTORE
0293PUSH20x1770
0296JUMP
0297JUMPDEST
0298PUSH10xc0
029aDUP6
029bADD
029cMLOAD
029dDUP7
029eDUP3
029fSUB
02a0PUSH10x1f
02a2NOT
02a3ADD
02a4PUSH10xe0
02a6DUP9
02a7ADD
02a8MSTORE
02a9PUSH20x1770
02acJUMP
02adJUMPDEST
02aePUSH10xe0
02b0DUP5
02b1ADD
02b2MLOAD
02b3DUP6
02b4DUP3
02b5SUB
02b6PUSH10x1f
02b8NOT
02b9ADD
02baPUSH20x0100
02bdDUP8
02beADD
02bfMSTORE
02c0PUSH20x1770
02c3JUMP
02c4JUMPDEST
02c5SWAP2
02c6PUSH20x0100
02c9DUP2
02caADD
02cbMLOAD
02ccPUSH20x0120
02cfDUP6
02d0ADD
02d1MSTORE
02d2PUSH20x0120
02d5DUP2
02d6ADD
02d7MLOAD
02d8PUSH20x0140
02dbDUP6
02dcADD
02ddMSTORE
02dePUSH20x0140
02e1DUP2
02e2ADD
02e3MLOAD
02e4DUP3
02e5DUP6
02e6ADD
02e7MSTORE
02e8ADD
02e9MLOAD
02eaPUSH20x0180
02edDUP4
02eeADD
02efMSTORE
02f0SUB
02f1SWAP1
02f2RETURN
02f3JUMPDEST
02f4DUP1
02f5REVERT
02f6JUMPDEST
02f7POP
02f8CALLVALUE
02f9PUSH20x02f3
02fcJUMPI
02fdPUSH10xa0
02ffCALLDATASIZE
0300PUSH10x03
0302NOT
0303ADD
0304SLT
0305PUSH20x02f3
0308JUMPI
0309PUSH20x0310
030cPUSH20x16d3
030fJUMP
0310JUMPDEST
0311POP
0312PUSH20x0319
0315PUSH20x16e9
0318JUMP
0319JUMPDEST
031aPOP
031bPUSH10x84
031dCALLDATALOAD
031ePUSH10x01
0320PUSH10x01
0322PUSH10x40
0324SHL
0325SUB
0326DUP2
0327GT
0328PUSH20x034d
032bJUMPI
032cPUSH20x0339
032fSWAP1
0330CALLDATASIZE
0331SWAP1
0332PUSH10x04
0334ADD
0335PUSH20x1713
0338JUMP
0339JUMPDEST
033aPOP
033bPOP
033cPUSH10x40
033eMLOAD
033fPUSH40xf23a6e61
0344PUSH10xe0
0346SHL
0347DUP2
0348MSTORE
0349PUSH10x20
034bSWAP1
034cRETURN
034dJUMPDEST
034ePOP
034fDUP1
0350REVERT
0351JUMPDEST
0352POP
0353CALLVALUE
0354PUSH20x02f3
0357JUMPI
0358DUP1
0359PUSH10x03
035bNOT
035cCALLDATASIZE
035dADD
035eSLT
035fPUSH20x02f3
0362JUMPI
0363PUSH10x20
0365PUSH10x40
0367MLOAD
0368PUSH10x40
036aDUP2
036bMSTORE
036cRETURN
036dJUMPDEST
036ePOP
036fCALLVALUE
0370PUSH20x02f3
0373JUMPI
0374PUSH10x20
0376CALLDATASIZE
0377PUSH10x03
0379NOT
037aADD
037bSLT
037cPUSH20x02f3
037fJUMPI
0380PUSH10x20
0382PUSH20x038c
0385PUSH10x04
0387CALLDATALOAD
0388PUSH20x1939
038bJUMP
038cJUMPDEST
038dPUSH10x40
038fMLOAD
0390SWAP1
0391DUP2
0392MSTORE
0393RETURN
0394JUMPDEST
0395POP
0396CALLVALUE
0397PUSH20x02f3
039aJUMPI
039bDUP1
039cPUSH10x03
039eNOT
039fCALLDATASIZE
03a0ADD
03a1SLT
03a2PUSH20x02f3
03a5JUMPI
03a6PUSH10x20
03a8PUSH10x40
03aaMLOAD
03abPUSH320x9a6a5d8139ad2d28957698330aaa691017dba7dc80eb7cbec585239fb680bbab
03ccDUP2
03cdMSTORE
03ceRETURN
03cfJUMPDEST
03d0POP
03d1CALLVALUE
03d2PUSH20x02f3
03d5JUMPI
03d6DUP1
03d7PUSH10x03
03d9NOT
03daCALLDATASIZE
03dbADD
03dcSLT
03ddPUSH20x02f3
03e0JUMPI
03e1PUSH10x20
03e3PUSH10x40
03e5MLOAD
03e6PUSH20x0701
03e9DUP2
03eaMSTORE
03ebRETURN
03ecJUMPDEST
03edPOP
03eeCALLVALUE
03efPUSH20x02f3
03f2JUMPI
03f3PUSH10xa0
03f5CALLDATASIZE
03f6PUSH10x03
03f8NOT
03f9ADD
03faSLT
03fbPUSH20x02f3
03feJUMPI
03ffPUSH20x0406
0402PUSH20x16d3
0405JUMP
0406JUMPDEST
0407POP
0408PUSH20x040f
040bPUSH20x16e9
040eJUMP
040fJUMPDEST
0410POP
0411PUSH10x44
0413CALLDATALOAD
0414PUSH10x01
0416PUSH10x01
0418PUSH10x40
041aSHL
041bSUB
041cDUP2
041dGT
041ePUSH20x034d
0421JUMPI
0422PUSH20x042f
0425SWAP1
0426CALLDATASIZE
0427SWAP1
0428PUSH10x04
042aADD
042bPUSH20x1740
042eJUMP
042fJUMPDEST
0430POP
0431POP
0432PUSH10x64
0434CALLDATALOAD
0435PUSH10x01
0437PUSH10x01
0439PUSH10x40
043bSHL
043cSUB
043dDUP2
043eGT
043fPUSH20x034d
0442JUMPI
0443PUSH20x0450
0446SWAP1
0447CALLDATASIZE
0448SWAP1
0449PUSH10x04
044bADD
044cPUSH20x1740
044fJUMP
0450JUMPDEST
0451POP
0452POP
0453PUSH10x84
0455CALLDATALOAD
0456PUSH10x01
0458PUSH10x01
045aPUSH10x40
045cSHL
045dSUB
045eDUP2
045fGT
0460PUSH20x034d
0463JUMPI
0464PUSH20x0471
0467SWAP1
0468CALLDATASIZE
0469SWAP1
046aPUSH10x04
046cADD
046dPUSH20x1713
0470JUMP
0471JUMPDEST
0472POP
0473POP
0474PUSH10x40
0476MLOAD
0477PUSH40xbc197c81
047cPUSH10xe0
047eSHL
047fDUP2
0480MSTORE
0481PUSH10x20
0483SWAP1
0484RETURN
0485JUMPDEST
0486POP
0487CALLVALUE
0488PUSH20x02f3
048bJUMPI
048cDUP1
048dPUSH10x03
048fNOT
0490CALLDATASIZE
0491ADD
0492SLT
0493PUSH20x02f3
0496JUMPI
0497PUSH10x20
0499PUSH10x40
049bMLOAD
049cPUSH320x0b5c16cf405bd568bea860ce2c3d0d2b1ee7f9e8d5713a2f78d5e0a5c0bfe6e2
04bdDUP2
04beMSTORE
04bfRETURN
04c0JUMPDEST
04c1POP
04c2CALLVALUE
04c3PUSH20x02f3
04c6JUMPI
04c7DUP1
04c8PUSH10x03
04caNOT
04cbCALLDATASIZE
04ccADD
04cdSLT
04cePUSH20x02f3
04d1JUMPI
04d2PUSH10x20
04d4PUSH10x40
04d6MLOAD
04d7PUSH20x0a20
04daDUP2
04dbMSTORE
04dcRETURN
04ddJUMPDEST
04dePOP
04dfCALLVALUE
04e0PUSH20x02f3
04e3JUMPI
04e4PUSH10x20
04e6CALLDATASIZE
04e7PUSH10x03
04e9NOT
04eaADD
04ebSLT
04ecPUSH20x02f3
04efJUMPI
04f0PUSH10x60
04f2PUSH10xc0
04f4PUSH10x40
04f6MLOAD
04f7PUSH20x04ff
04faDUP2
04fbPUSH20x17ad
04feJUMP
04ffJUMPDEST
0500DUP4
0501DUP2
0502MSTORE
0503DUP4
0504PUSH10x20
0506DUP3
0507ADD
0508MSTORE
0509DUP4
050aPUSH10x40
050cDUP3
050dADD
050eMSTORE
050fDUP4
0510DUP4
0511DUP3
0512ADD
0513MSTORE
0514DUP4
0515PUSH10x80
0517DUP3
0518ADD
0519MSTORE
051aDUP4
051bPUSH10xa0
051dDUP3
051eADD
051fMSTORE
0520ADD
0521MSTORE
0522PUSH10x04
0524CALLDATALOAD
0525DUP2
0526MSTORE
0527DUP1
0528PUSH10x20
052aMSTORE
052bPUSH10x40
052dDUP2
052eKECCAK256
052fSWAP1
0530PUSH10x40
0532MLOAD
0533SWAP1
0534PUSH20x053c
0537DUP3
0538PUSH20x17ad
053bJUMP
053cJUMPDEST
053dDUP3
053eSLOAD
053fDUP3
0540MSTORE
0541PUSH10x01
0543DUP4
0544ADD
0545SLOAD
0546SWAP3
0547PUSH10x20
0549DUP4
054aADD
054bSWAP4
054cPUSH10x01
054ePUSH10x01
0550PUSH10x40
0552SHL
0553SUB
0554DUP2
0555AND
0556DUP6
0557MSTORE
0558PUSH10x40
055aDUP5
055bADD
055cSWAP1
055dPUSH10x01
055fPUSH10x01
0561PUSH10x40
0563SHL
0564SUB
0565DUP2
0566PUSH10x40
0568SHR
0569AND
056aDUP3
056bMSTORE
056cPUSH10x01
056ePUSH10x01
0570PUSH10x40
0572SHL
0573SUB
0574PUSH10x60
0576DUP7
0577ADD
0578SWAP2
0579PUSH10x80
057bSHR
057cAND
057dDUP2
057eMSTORE
057fPUSH10x02
0581DUP4
0582ADD
0583SLOAD
0584SWAP2
0585PUSH10x80
0587DUP7
0588ADD
0589SWAP3
058aDUP4
058bMSTORE
058cPUSH10x04
058ePUSH10xff
0590PUSH10x03
0592DUP7
0593ADD
0594SLOAD
0595AND
0596SWAP5
0597PUSH10xa0
0599DUP9
059aADD
059bSWAP6
059cDUP7
059dMSTORE
059eADD
059fSWAP5
05a0PUSH10x40
05a2MLOAD
05a3SWAP6
05a4DUP2
05a5DUP2
05a6SLOAD
05a7SWAP2
05a8PUSH20x05b0
05abDUP4
05acPUSH20x184e
05afJUMP
05b0JUMPDEST
05b1DUP1
05b2DUP11
05b3MSTORE
05b4SWAP3
05b5PUSH10x01
05b7DUP2
05b8AND
05b9SWAP1
05baDUP2
05bbISZERO
05bcPUSH20x067c
05bfJUMPI
05c0POP
05c1PUSH10x01
05c3EQ
05c4PUSH20x063a
05c7JUMPI
05c8JUMPDEST
05c9POP
05caPOP
05cbPOP
05ccDUP6
05cdSWAP5
05ceSWAP3
05cfPUSH10x01
05d1PUSH10x01
05d3PUSH10x40
05d5SHL
05d6SUB
05d7PUSH10xff
05d9SWAP6
05daSWAP4
05dbPUSH20x05ea
05dePUSH20x0636
05e1SWAP10
05e2DUP4
05e3SWAP6
05e4SUB
05e5DUP10
05e6PUSH20x17dc
05e9JUMP
05eaJUMPDEST
05ebPUSH10xc0
05edDUP11
05eeADD
05efSWAP8
05f0DUP9
05f1MSTORE
05f2DUP2
05f3PUSH10x40
05f5MLOAD
05f6SWAP12
05f7DUP13
05f8SWAP12
05f9PUSH10x20
05fbDUP14
05fcMSTORE
05fdMLOAD
05fePUSH10x20
0600DUP14
0601ADD
0602MSTORE
0603MLOAD
0604AND
0605PUSH10x40
0607DUP12
0608ADD
0609MSTORE
060aMLOAD
060bAND
060cPUSH10x60
060eDUP10
060fADD
0610MSTORE
0611MLOAD
0612AND
0613PUSH10x80
0615DUP8
0616ADD
0617MSTORE
0618MLOAD
0619PUSH10xa0
061bDUP7
061cADD
061dMSTORE
061eMLOAD
061fAND
0620PUSH10xc0
0622DUP5
0623ADD
0624MSTORE
0625MLOAD
0626PUSH10xe0
0628DUP1
0629DUP5
062aADD
062bMSTORE
062cPUSH20x0100
062fDUP4
0630ADD
0631SWAP1
0632PUSH20x1770
0635JUMP
0636JUMPDEST
0637SUB
0638SWAP1
0639RETURN
063aJUMPDEST
063bSWAP1
063cDUP1
063dSWAP4
063ePOP
063fMSTORE
0640PUSH10x20
0642DUP3
0643KECCAK256
0644JUMPDEST
0645DUP2
0646DUP4
0647LT
0648PUSH20x0662
064bJUMPI
064cPOP
064dPOP
064eDUP6
064fADD
0650PUSH10x20
0652ADD
0653DUP3
0654PUSH10x01
0656PUSH10x01
0658PUSH10x40
065aSHL
065bSUB
065cPUSH10xff
065ePUSH20x05c8
0661JUMP
0662JUMPDEST
0663PUSH10x01
0665DUP2
0666PUSH10x20
0668SWAP3
0669SWAP5
066aSWAP4
066bSWAP5
066cSLOAD
066dDUP4
066eDUP6
066fDUP13
0670ADD
0671ADD
0672MSTORE
0673ADD
0674SWAP2
0675ADD
0676SWAP2
0677SWAP1
0678PUSH20x0644
067bJUMP
067cJUMPDEST
067dPUSH10xff
067fNOT
0680AND
0681PUSH10x20
0683DUP1
0684DUP13
0685ADD
0686SWAP2
0687SWAP1
0688SWAP2
0689MSTORE
068aSWAP4
068bISZERO
068cISZERO
068dPUSH10x05
068fSHL
0690DUP11
0691ADD
0692SWAP1
0693SWAP4
0694ADD
0695SWAP4
0696POP
0697DUP6
0698SWAP3
0699POP
069aPUSH10x01
069cPUSH10x01
069ePUSH10x40
06a0SHL
06a1SUB
06a2SWAP2
06a3POP
06a4PUSH10xff
06a6SWAP1
06a7POP
06a8PUSH20x05c8
06abJUMP
06acJUMPDEST
06adPOP
06aeCALLVALUE
06afPUSH20x02f3
06b2JUMPI
06b3DUP1
06b4PUSH10x03
06b6NOT
06b7CALLDATASIZE
06b8ADD
06b9SLT
06baPUSH20x02f3
06bdJUMPI
06bePUSH10x20
06c0PUSH10x40
06c2MLOAD
06c3PUSH10x02
06c5DUP2
06c6MSTORE
06c7RETURN
06c8JUMPDEST
06c9POP
06caCALLVALUE
06cbPUSH20x02f3
06ceJUMPI
06cfDUP1
06d0PUSH10x03
06d2NOT
06d3CALLDATASIZE
06d4ADD
06d5SLT
06d6PUSH20x02f3
06d9JUMPI
06daPUSH10x20
06dcPUSH10x40
06deMLOAD
06dfPUSH20x1c45
06e2DUP2
06e3MSTORE
06e4RETURN
06e5JUMPDEST
06e6POP
06e7CALLVALUE
06e8PUSH20x02f3
06ebJUMPI
06ecPUSH10x60
06eeCALLDATASIZE
06efPUSH10x03
06f1NOT
06f2ADD
06f3SLT
06f4PUSH20x02f3
06f7JUMPI
06f8PUSH10x04
06faCALLDATALOAD
06fbPUSH10x24
06fdCALLDATALOAD
06feSWAP1
06ffPUSH10x01
0701PUSH10x01
0703PUSH10x40
0705SHL
0706SUB
0707DUP3
0708AND
0709DUP1
070aSWAP3
070bSUB
070cPUSH20x0981
070fJUMPI
0710PUSH10x44
0712CALLDATALOAD
0713PUSH10x01
0715PUSH10x01
0717PUSH10x40
0719SHL
071aSUB
071bDUP2
071cGT
071dPUSH20x0896
0720JUMPI
0721PUSH20x072e
0724SWAP1
0725CALLDATASIZE
0726SWAP1
0727PUSH10x04
0729ADD
072aPUSH20x1740
072dJUMP
072eJUMPDEST
072fSWAP1
0730SWAP3
0731DUP3
0732DUP6
0733MSTORE
0734DUP5
0735PUSH10x20
0737MSTORE
0738PUSH10x40
073aDUP6
073bKECCAK256
073cSWAP4
073dPUSH10x03
073fDUP6
0740ADD
0741SWAP3
0742PUSH10xff
0744DUP5
0745SLOAD
0746AND
0747DUP1
0748ISZERO
0749PUSH20x096d
074cJUMPI
074dPUSH10x02
074fEQ
0750PUSH20x0959
0753JUMPI
0754PUSH10x01
0756DUP1
0757PUSH10xa0
0759SHL
075aSUB
075bPUSH320x000000000000000000000000c19d888a2f7ba65a8dcf8d03ad8f1af5cdc66430
077cAND
077dSWAP2
077eDUP7
077fSLOAD
0780PUSH10x40
0782MLOAD
0783PUSH10x20
0785DUP2
0786ADD
0787SWAP2
0788DUP9
0789DUP4
078aMSTORE
078bPUSH10x40
078dDUP3
078eADD
078fMSTORE
0790PUSH10x40
0792DUP2
0793MSTORE
0794PUSH20x079e
0797PUSH10x60
0799DUP3
079aPUSH20x17dc
079dJUMP
079eJUMPDEST
079fMLOAD
07a0SWAP1
07a1KECCAK256
07a2DUP4
07a3EXTCODESIZE
07a4ISZERO
07a5PUSH20x0955
07a8JUMPI
07a9SWAP1
07aaDUP3
07abDUP10
07acSWAP6
07adSWAP5
07aeSWAP4
07afSWAP3
07b0PUSH10x40
07b2MLOAD
07b3SWAP6
07b4PUSH40x22f3f447
07b9PUSH10xe1
07bbSHL
07bcDUP8
07bdMSTORE
07bePUSH10x84
07c0DUP8
07c1ADD
07c2SWAP2
07c3PUSH320x0b5c16cf405bd568bea860ce2c3d0d2b1ee7f9e8d5713a2f78d5e0a5c0bfe6e2
07e4PUSH10x04
07e6DUP10
07e7ADD
07e8MSTORE
07e9PUSH10x24
07ebDUP9
07ecADD
07edMSTORE
07eePUSH10x44
07f0DUP8
07f1ADD
07f2MSTORE
07f3PUSH10x80
07f5PUSH10x64
07f7DUP8
07f8ADD
07f9MSTORE
07faMSTORE
07fbPUSH10xa4
07fdDUP5
07feADD
07ffPUSH10xa0
0801PUSH10x04
0803DUP5
0804PUSH10x05
0806SHL
0807DUP8
0808ADD
0809ADD
080aADD
080bSWAP3
080cDUP3
080dDUP8
080eSWAP1
080fPUSH10x7e
0811NOT
0812DUP2
0813CALLDATASIZE
0814SUB
0815ADD
0816JUMPDEST
0817DUP4
0818DUP4
0819LT
081aPUSH20x08a5
081dJUMPI
081ePOP
081fPOP
0820POP
0821POP
0822POP
0823POP
0824DUP4
0825SWAP2
0826DUP4
0827DUP4
0828DUP2
0829DUP5
082aDUP2
082bSWAP6
082cPOP
082dSUB
082eSWAP3
082fGAS
0830CALL
0831DUP1
0832ISZERO
0833PUSH20x089a
0836JUMPI
0837PUSH20x0881
083aJUMPI
083bJUMPDEST
083cPOP
083dPOP
083ePUSH320xc3d98c8e03300e61427ccfbbaf7524b9b9977b1d377eca3f7a98ccad29b79690
085fPUSH10x20
0861PUSH20x087e
0864SWAP5
0865DUP5
0866SWAP4
0867PUSH10x02
0869PUSH10xff
086bNOT
086cDUP3
086dSLOAD
086eAND
086fOR
0870SWAP1
0871SSTORE
0872SLOAD
0873PUSH10x40
0875MLOAD
0876SWAP1
0877DUP2
0878MSTORE
0879LOG2
087aPUSH20x252c
087dJUMP
087eJUMPDEST
087fDUP1
0880RETURN
0881JUMPDEST
0882DUP2
0883PUSH20x088b
0886SWAP2
0887PUSH20x17dc
088aJUMP
088bJUMPDEST
088cPUSH20x0896
088fJUMPI
0890DUP4
0891PUSH0
0892PUSH20x083b
0895JUMP
0896JUMPDEST
0897DUP4
0898DUP1
0899REVERT
089aJUMPDEST
089bPUSH10x40
089dMLOAD
089eRETURNDATASIZE
089fDUP5
08a0DUP3
08a1RETURNDATACOPY
08a2RETURNDATASIZE
08a3SWAP1
08a4REVERT
08a5JUMPDEST
08a6SWAP2
08a7SWAP4
08a8SWAP6
08a9SWAP1
08aaSWAP3
08abSWAP5
08acSWAP7
08adSWAP8
08aeSWAP9
08afPOP
08b0PUSH10x9f
08b2NOT
08b3PUSH10x03
08b5NOT
08b6DUP11
08b7DUP4
08b8SUB
08b9ADD
08baADD
08bbDUP7
08bcMSTORE
08bdDUP7
08beCALLDATALOAD
08bfDUP3
08c0DUP2
08c1SLT
08c2ISZERO
08c3PUSH20x0951
08c6JUMPI
08c7DUP4
08c8ADD
08c9PUSH10x01
08cbPUSH10x01
08cdPUSH10xa0
08cfSHL
08d0SUB
08d1PUSH20x08d9
08d4DUP3
08d5PUSH20x16ff
08d8JUMP
08d9JUMPDEST
08daAND
08dbDUP3
08dcMSTORE
08ddPUSH10x20
08dfDUP2
08e0ADD
08e1CALLDATALOAD
08e2SWAP2
08e3PUSH10xff
08e5DUP4
08e6AND
08e7DUP1
08e8SWAP4
08e9SUB
08eaPUSH20x094d
08edJUMPI
08eePUSH20x0939
08f1PUSH10x20
08f3SWAP3
08f4DUP3
08f5PUSH10x01
08f7SWAP6
08f8DUP6
08f9DUP1
08faSWAP6
08fbADD
08fcMSTORE
08fdPUSH20x092b
0900PUSH20x0920
0903PUSH20x090f
0906PUSH10x40
0908DUP6
0909ADD
090aDUP6
090bPUSH20x17fd
090eJUMP
090fJUMPDEST
0910PUSH10x80
0912PUSH10x40
0914DUP7
0915ADD
0916MSTORE
0917PUSH10x80
0919DUP6
091aADD
091bSWAP2
091cPUSH20x182e
091fJUMP
0920JUMPDEST
0921SWAP3
0922PUSH10x60
0924DUP2
0925ADD
0926SWAP1
0927PUSH20x17fd
092aJUMP
092bJUMPDEST
092cSWAP2
092dPUSH10x60
092fDUP2
0930DUP6
0931SUB
0932SWAP2
0933ADD
0934MSTORE
0935PUSH20x182e
0938JUMP
0939JUMPDEST
093aSWAP9
093bADD
093cSWAP7
093dADD
093eSWAP4
093fADD
0940SWAP1
0941SWAP2
0942DUP13
0943SWAP9
0944SWAP8
0945SWAP7
0946SWAP6
0947SWAP5
0948SWAP3
0949PUSH20x0816
094cJUMP
094dJUMPDEST
094eDUP15
094fDUP1
0950REVERT
0951JUMPDEST
0952DUP14
0953DUP1
0954REVERT
0955JUMPDEST
0956DUP9
0957DUP1
0958REVERT
0959JUMPDEST
095aPUSH40x90315de1
095fPUSH10xe0
0961SHL
0962DUP8
0963MSTORE
0964PUSH10x04
0966DUP6
0967SWAP1
0968MSTORE
0969PUSH10x24
096bDUP8
096cREVERT
096dJUMPDEST
096ePUSH40x2e7bb981
0973PUSH10xe2
0975SHL
0976DUP9
0977MSTORE
0978PUSH10x04
097aDUP7
097bSWAP1
097cMSTORE
097dPUSH10x24
097fDUP9
0980REVERT
0981JUMPDEST
0982DUP3
0983DUP1
0984REVERT
0985JUMPDEST
0986POP
0987CALLVALUE
0988PUSH20x02f3
098bJUMPI
098cPUSH10xa0
098eCALLDATASIZE
098fPUSH10x03
0991NOT
0992ADD
0993SLT
0994PUSH20x02f3
0997JUMPI
0998PUSH10x04
099aCALLDATALOAD
099bPUSH10x04
099dDUP2
099eLT
099fISZERO
09a0PUSH20x034d
09a3JUMPI
09a4PUSH20x09ab
09a7PUSH20x16e9
09aaJUMP
09abJUMPDEST
09acSWAP2
09adPUSH10x64
09afCALLDATALOAD
09b0SWAP2
09b1PUSH10x84
09b3CALLDATALOAD
09b4PUSH10x01
09b6PUSH10x01
09b8PUSH10xa0
09baSHL
09bbSUB
09bcDUP2
09bdAND
09beSWAP3
09bfPUSH10x44
09c1CALLDATALOAD
09c2SWAP3
09c3SWAP2
09c4DUP5
09c5DUP2
09c6SUB
09c7PUSH20x034d
09caJUMPI
09cbPUSH20x09d2
09cePUSH20x2648
09d1JUMP
09d2JUMPDEST
09d3PUSH10x40
09d5MLOAD
09d6PUSH40xf5778b03
09dbPUSH10xe0
09ddSHL
09deDUP2
09dfMSTORE
09e0PUSH10x20
09e2DUP2
09e3PUSH10x04
09e5DUP2
09e6PUSH320x000000000000000000000000c19d888a2f7ba65a8dcf8d03ad8f1af5cdc66430
0a07PUSH10x01
0a09PUSH10x01
0a0bPUSH10xa0
0a0dSHL
0a0eSUB
0a0fAND
0a10GAS
0a11STATICCALL
0a12SWAP1
0a13DUP2
0a14ISZERO
0a15PUSH20x0c77
0a18JUMPI
0a19DUP4
0a1aSWAP2
0a1bPUSH20x0c48
0a1eJUMPI
0a1fJUMPDEST
0a20POP
0a21DUP6
0a22ISZERO
0a23SWAP1
0a24DUP2
0a25ISZERO
0a26PUSH20x0c24
0a29JUMPI
0a2aJUMPDEST
0a2bPOP
0a2cPUSH20x0c10
0a2fJUMPI
0a30PUSH20x0a3a
0a33DUP5
0a34DUP9
0a35DUP6
0a36PUSH20x1794
0a39JUMP
0a3aJUMPDEST
0a3bSWAP6
0a3cPUSH0
0a3dNOT
0a3eDUP2
0a3fSUB
0a40PUSH20x0c0b
0a43JUMPI
0a44POP
0a45DUP6
0a46JUMPDEST
0a47DUP1
0a48SWAP7
0a49DUP2
0a4aISZERO
0a4bPUSH20x0bfc
0a4eJUMPI
0a4fDUP1
0a50DUP3
0a51GT
0a52PUSH20x0bd7
0a55JUMPI
0a56POP
0a57DUP3
0a58SWAP2
0a59DUP5
0a5aPUSH20x0ae9
0a5dJUMPI
0a5ePOP
0a5fPOP
0a60DUP2
0a61DUP1
0a62DUP1
0a63DUP1
0a64DUP10
0a65DUP10
0a66GAS
0a67CALL
0a68PUSH20x0a6f
0a6bPUSH20x190a
0a6eJUMP
0a6fJUMPDEST
0a70POP
0a71ISZERO
0a72PUSH20x0ad5
0a75JUMPI
0a76JUMPDEST
0a77PUSH20x0ac1
0a7aJUMPI
0a7bPOP
0a7cPUSH10x40
0a7eDUP1
0a7fMLOAD
0a80SWAP3
0a81DUP4
0a82MSTORE
0a83PUSH10x20
0a85DUP4
0a86DUP2
0a87ADD
0a88DUP7
0a89SWAP1
0a8aMSTORE
0a8bSWAP6
0a8cPUSH10x01
0a8ePUSH10x01
0a90PUSH10xa0
0a92SHL
0a93SUB
0a94AND
0a95SWAP3
0a96PUSH320x7643c83e539cea2f6bf506545392e52cfd5f917e327efbcd0ba28f29c28d042e
0ab7SWAP2
0ab8SWAP1
0ab9LOG4
0abaPUSH10x40
0abcMLOAD
0abdSWAP1
0abeDUP2
0abfMSTORE
0ac0RETURN
0ac1JUMPDEST
0ac2PUSH40x4e487b71
0ac7PUSH10xe0
0ac9SHL
0acaDUP2
0acbMSTORE
0accPUSH10x21
0acePUSH10x04
0ad0MSTORE
0ad1PUSH10x24
0ad3SWAP1
0ad4REVERT
0ad5JUMPDEST
0ad6PUSH40x65f4a9ef
0adbPUSH10xe1
0addSHL
0adeDUP3
0adfMSTORE
0ae0PUSH10x04
0ae2DUP3
0ae3SWAP1
0ae4MSTORE
0ae5PUSH10x24
0ae7DUP3
0ae8REVERT
0ae9JUMPDEST
0aeaDUP4
0aebSWAP3
0aecPOP
0aedSWAP1
0aeePUSH10x01
0af0DUP6
0af1SUB
0af2PUSH20x0b43
0af5JUMPI
0af6POP
0af7PUSH10x40
0af9MLOAD
0afaPUSH40xa9059cbb
0affPUSH10xe0
0b01SHL
0b02PUSH10x20
0b04DUP3
0b05ADD
0b06MSTORE
0b07PUSH10x01
0b09PUSH10x01
0b0bPUSH10xa0
0b0dSHL
0b0eSUB
0b0fSWAP1
0b10SWAP2
0b11AND
0b12PUSH10x24
0b14DUP3
0b15ADD
0b16MSTORE
0b17PUSH10x44
0b19DUP2
0b1aADD
0b1bDUP8
0b1cSWAP1
0b1dMSTORE
0b1ePUSH20x0b3e
0b21SWAP1
0b22PUSH20x0b38
0b25DUP2
0b26PUSH10x64
0b28DUP2
0b29ADD
0b2aJUMPDEST
0b2bSUB
0b2cPUSH10x1f
0b2eNOT
0b2fDUP2
0b30ADD
0b31DUP4
0b32MSTORE
0b33DUP3
0b34PUSH20x17dc
0b37JUMP
0b38JUMPDEST
0b39DUP9
0b3aPUSH20x27f4
0b3dJUMP
0b3eJUMPDEST
0b3fPUSH20x0a76
0b42JUMP
0b43JUMPDEST
0b44SWAP7
0b45SWAP2
0b46POP
0b47POP
0b48DUP2
0b49SWAP6
0b4aPUSH10x02
0b4cDUP5
0b4dEQ
0b4ePUSH0
0b4fEQ
0b50PUSH20x0b8c
0b53JUMPI
0b54POP
0b55POP
0b56PUSH10x01
0b58SWAP5
0b59PUSH20x0b3e
0b5cPUSH10x40
0b5eMLOAD
0b5fPUSH40x23b872dd
0b64PUSH10xe0
0b66SHL
0b67PUSH10x20
0b69DUP3
0b6aADD
0b6bMSTORE
0b6cADDRESS
0b6dPUSH10x24
0b6fDUP3
0b70ADD
0b71MSTORE
0b72DUP7
0b73PUSH10x44
0b75DUP3
0b76ADD
0b77MSTORE
0b78DUP6
0b79PUSH10x64
0b7bDUP3
0b7cADD
0b7dMSTORE
0b7ePUSH10x64
0b80DUP2
0b81MSTORE
0b82PUSH20x0b38
0b85PUSH10x84
0b87DUP3
0b88PUSH20x17dc
0b8bJUMP
0b8cJUMPDEST
0b8dPUSH20x0b3e
0b90SWAP1
0b91PUSH10x40
0b93SWAP8
0b94SWAP3
0b95SWAP8
0b96MLOAD
0b97SWAP1
0b98PUSH40x79212195
0b9dPUSH10xe1
0b9fSHL
0ba0PUSH10x20
0ba2DUP4
0ba3ADD
0ba4MSTORE
0ba5ADDRESS
0ba6PUSH10x24
0ba8DUP4
0ba9ADD
0baaMSTORE
0babDUP8
0bacPUSH10x44
0baeDUP4
0bafADD
0bb0MSTORE
0bb1DUP7
0bb2PUSH10x64
0bb4DUP4
0bb5ADD
0bb6MSTORE
0bb7PUSH10x84
0bb9DUP3
0bbaADD
0bbbMSTORE
0bbcPUSH10xa0
0bbePUSH10xa4
0bc0DUP3
0bc1ADD
0bc2MSTORE
0bc3DUP4
0bc4PUSH10xc4
0bc6DUP3
0bc7ADD
0bc8MSTORE
0bc9PUSH10xc4
0bcbDUP2
0bccMSTORE
0bcdPUSH20x0b38
0bd0PUSH10xe4
0bd2DUP3
0bd3PUSH20x17dc
0bd6JUMP
0bd7JUMPDEST
0bd8PUSH40x21909681
0bddPUSH10xe0
0bdfSHL
0be0DUP5
0be1MSTORE
0be2PUSH10x01
0be4PUSH10x01
0be6PUSH10xa0
0be8SHL
0be9SUB
0beaDUP10
0bebAND
0becPUSH10x04
0beeMSTORE
0befPUSH10x24
0bf1SWAP2
0bf2SWAP1
0bf3SWAP2
0bf4MSTORE
0bf5PUSH10x44
0bf7MSTORE
0bf8PUSH10x64
0bfaDUP3
0bfbREVERT
0bfcJUMPDEST
0bfdPUSH40x7c2e506f
0c02PUSH10xe1
0c04SHL
0c05DUP5
0c06MSTORE
0c07PUSH10x04
0c09DUP5
0c0aREVERT
0c0bJUMPDEST
0c0cPUSH20x0a46
0c0fJUMP
0c10JUMPDEST
0c11PUSH40x15150d4d
0c16PUSH10xe3
0c18SHL
0c19DUP3
0c1aMSTORE
0c1bPUSH10x04
0c1dDUP6
0c1eSWAP1
0c1fMSTORE
0c20PUSH10x24
0c22DUP3
0c23REVERT
0c24JUMPDEST
0c25PUSH10x01
0c27PUSH10x01
0c29PUSH10xa0
0c2bSHL
0c2cSUB
0c2dAND
0c2eDUP7
0c2fEQ
0c30ISZERO
0c31SWAP1
0c32POP
0c33DUP1
0c34PUSH20x0c3e
0c37JUMPI
0c38JUMPDEST
0c39PUSH0
0c3aPUSH20x0a2a
0c3dJUMP
0c3eJUMPDEST
0c3fPOP
0c40CALLER
0c41DUP6
0c42EQ
0c43ISZERO
0c44PUSH20x0c38
0c47JUMP
0c48JUMPDEST
0c49PUSH20x0c6a
0c4cSWAP2
0c4dPOP
0c4ePUSH10x20
0c50RETURNDATASIZE
0c51PUSH10x20
0c53GT
0c54PUSH20x0c70
0c57JUMPI
0c58JUMPDEST
0c59PUSH20x0c62
0c5cDUP2
0c5dDUP4
0c5ePUSH20x17dc
0c61JUMP
0c62JUMPDEST
0c63DUP2
0c64ADD
0c65SWAP1
0c66PUSH20x2629
0c69JUMP
0c6aJUMPDEST
0c6bPUSH0
0c6cPUSH20x0a1f
0c6fJUMP
0c70JUMPDEST
0c71POP
0c72RETURNDATASIZE
0c73PUSH20x0c58
0c76JUMP
0c77JUMPDEST
0c78PUSH10x40
0c7aMLOAD
0c7bRETURNDATASIZE
0c7cDUP6
0c7dDUP3
0c7eRETURNDATACOPY
0c7fRETURNDATASIZE
0c80SWAP1
0c81REVERT
0c82JUMPDEST
0c83POP
0c84CALLVALUE
0c85PUSH20x02f3
0c88JUMPI
0c89DUP1
0c8aPUSH10x03
0c8cNOT
0c8dCALLDATASIZE
0c8eADD
0c8fSLT
0c90PUSH20x02f3
0c93JUMPI
0c94PUSH10x20
0c96PUSH10x40
0c98MLOAD
0c99PUSH10x05
0c9bDUP2
0c9cMSTORE
0c9dRETURN
0c9eJUMPDEST
0c9fPOP
0ca0CALLVALUE
0ca1PUSH20x02f3
0ca4JUMPI
0ca5DUP1
0ca6PUSH10x03
0ca8NOT
0ca9CALLDATASIZE
0caaADD
0cabSLT
0cacPUSH20x02f3
0cafJUMPI
0cb0PUSH10x20
0cb2PUSH10x40
0cb4MLOAD
0cb5PUSH320xab38cc1669d86f8735cbdca240ab730ca375c29f9052ec2d582d5d125313c78e
0cd6DUP2
0cd7MSTORE
0cd8RETURN
0cd9JUMPDEST
0cdaPOP
0cdbCALLVALUE
0cdcPUSH20x02f3
0cdfJUMPI
0ce0DUP1
0ce1PUSH10x03
0ce3NOT
0ce4CALLDATASIZE
0ce5ADD
0ce6SLT
0ce7PUSH20x02f3
0ceaJUMPI
0cebPUSH10x20
0cedPUSH10x40
0cefMLOAD
0cf0PUSH20x0620
0cf3DUP2
0cf4MSTORE
0cf5RETURN
0cf6JUMPDEST
0cf7POP
0cf8CALLVALUE
0cf9PUSH20x02f3
0cfcJUMPI
0cfdDUP1
0cfePUSH10x03
0d00NOT
0d01CALLDATASIZE
0d02ADD
0d03SLT
0d04PUSH20x02f3
0d07JUMPI
0d08PUSH10x20
0d0aPUSH10x40
0d0cMLOAD
0d0dPUSH40x50514346
0d12DUP2
0d13MSTORE
0d14RETURN
0d15JUMPDEST
0d16POP
0d17CALLVALUE
0d18PUSH20x02f3
0d1bJUMPI
0d1cPUSH10x20
0d1eCALLDATASIZE
0d1fPUSH10x03
0d21NOT
0d22ADD
0d23SLT
0d24PUSH20x02f3
0d27JUMPI
0d28PUSH20x087e
0d2bPUSH10x04
0d2dCALLDATALOAD
0d2ePUSH20x252c
0d31JUMP
0d32JUMPDEST
0d33POP
0d34CALLVALUE
0d35PUSH20x02f3
0d38JUMPI
0d39PUSH10x40
0d3bCALLDATASIZE
0d3cPUSH10x03
0d3eNOT
0d3fADD
0d40SLT
0d41PUSH20x02f3
0d44JUMPI
0d45PUSH10x20
0d47PUSH20x038c
0d4aPUSH10x24
0d4cCALLDATALOAD
0d4dPUSH10x04
0d4fCALLDATALOAD
0d50PUSH20x1886
0d53JUMP
0d54JUMPDEST
0d55POP
0d56CALLVALUE
0d57PUSH20x02f3
0d5aJUMPI
0d5bDUP1
0d5cPUSH10x03
0d5eNOT
0d5fCALLDATASIZE
0d60ADD
0d61SLT
0d62PUSH20x02f3
0d65JUMPI
0d66PUSH10x20
0d68PUSH10x40
0d6aMLOAD
0d6bPUSH10x06
0d6dDUP2
0d6eMSTORE
0d6fRETURN
0d70JUMPDEST
0d71POP
0d72CALLVALUE
0d73PUSH20x02f3
0d76JUMPI
0d77DUP1
0d78PUSH10x03
0d7aNOT
0d7bCALLDATASIZE
0d7cADD
0d7dSLT
0d7ePUSH20x02f3
0d81JUMPI
0d82PUSH10x40
0d84MLOAD
0d85PUSH320x000000000000000000000000c19d888a2f7ba65a8dcf8d03ad8f1af5cdc66430
0da6PUSH10x01
0da8PUSH10x01
0daaPUSH10xa0
0dacSHL
0dadSUB
0daeAND
0dafDUP2
0db0MSTORE
0db1PUSH10x20
0db3SWAP1
0db4RETURN
0db5JUMPDEST
0db6POP
0db7CALLVALUE
0db8PUSH20x02f3
0dbbJUMPI
0dbcDUP1
0dbdPUSH10x03
0dbfNOT
0dc0CALLDATASIZE
0dc1ADD
0dc2SLT
0dc3PUSH20x02f3
0dc6JUMPI
0dc7PUSH10x20
0dc9PUSH10x40
0dcbMLOAD
0dccPUSH30x16e360
0dd0DUP2
0dd1MSTORE
0dd2RETURN
0dd3JUMPDEST
0dd4POP
0dd5CALLVALUE
0dd6PUSH20x13d6
0dd9JUMPI
0ddaPUSH10xa0
0ddcCALLDATASIZE
0dddPUSH10x03
0ddfNOT
0de0ADD
0de1SLT
0de2PUSH20x13d6
0de5JUMPI
0de6PUSH10x04
0de8CALLDATALOAD
0de9PUSH10x01
0debPUSH10x01
0dedPUSH10x40
0defSHL
0df0SUB
0df1DUP2
0df2GT
0df3PUSH20x13d6
0df6JUMPI
0df7PUSH20x0e04
0dfaSWAP1
0dfbCALLDATASIZE
0dfcSWAP1
0dfdPUSH10x04
0dffADD
0e00PUSH20x1713
0e03JUMP
0e04JUMPDEST
0e05PUSH10x24
0e07CALLDATALOAD
0e08PUSH10x44
0e0aCALLDATALOAD
0e0bSWAP2
0e0cPUSH10x01
0e0ePUSH10x01
0e10PUSH10x40
0e12SHL
0e13SUB
0e14DUP4
0e15GT
0e16PUSH20x13d6
0e19JUMPI
0e1aDUP3
0e1bPUSH10x04
0e1dADD
0e1eSWAP3
0e1fPUSH10x40
0e21PUSH10x03
0e23NOT
0e24DUP3
0e25CALLDATASIZE
0e26SUB
0e27ADD
0e28SLT
0e29PUSH20x13d6
0e2cJUMPI
0e2dPUSH10x64
0e2fCALLDATALOAD
0e30SWAP4
0e31PUSH10x01
0e33PUSH10x01
0e35PUSH10x40
0e37SHL
0e38SUB
0e39DUP6
0e3aAND
0e3bDUP1
0e3cSWAP6
0e3dSUB
0e3ePUSH20x13d6
0e41JUMPI
0e42PUSH10x84
0e44CALLDATALOAD
0e45PUSH10x01
0e47PUSH10x01
0e49PUSH10x40
0e4bSHL
0e4cSUB
0e4dDUP2
0e4eGT
0e4fPUSH20x13d6
0e52JUMPI
0e53PUSH20x0e63
0e56PUSH20x0e6b
0e59SWAP2
0e5aCALLDATASIZE
0e5bSWAP1
0e5cPUSH10x04
0e5eADD
0e5fPUSH20x1740
0e62JUMP
0e63JUMPDEST
0e64SWAP5
0e65SWAP1
0e66SWAP8
0e67PUSH20x1ad1
0e6aJUMP
0e6bJUMPDEST
0e6cSWAP5
0e6dPUSH10x20
0e6fDUP7
0e70ADD
0e71MLOAD
0e72SWAP7
0e73DUP8
0e74PUSH0
0e75MSTORE
0e76PUSH0
0e77PUSH10x20
0e79MSTORE
0e7aPUSH10xff
0e7cPUSH10x03
0e7ePUSH10x40
0e80PUSH0
0e81KECCAK256
0e82ADD
0e83SLOAD
0e84AND
0e85PUSH20x13ec
0e88JUMPI
0e89PUSH10x60
0e8bDUP8
0e8cADD
0e8dSWAP5
0e8ePUSH10x01
0e90PUSH10x01
0e92PUSH10x40
0e94SHL
0e95SUB
0e96DUP7
0e97MLOAD
0e98AND
0e99DUP1
0e9aTIMESTAMP
0e9bGT
0e9cPUSH20x13da
0e9fJUMPI
0ea0POP
0ea1PUSH10x01
0ea3DUP1
0ea4PUSH10xa0
0ea6SHL
0ea7SUB
0ea8PUSH320x000000000000000000000000c19d888a2f7ba65a8dcf8d03ad8f1af5cdc66430
0ec9AND
0ecaSWAP2
0ecbDUP9
0eccMLOAD
0ecdPUSH10x40
0ecfMLOAD
0ed0PUSH10x20
0ed2DUP2
0ed3ADD
0ed4SWAP2
0ed5DUP3
0ed6MSTORE
0ed7DUP10
0ed8PUSH10x40
0edaDUP3
0edbADD
0edcMSTORE
0eddPUSH10x40
0edfDUP2
0ee0MSTORE
0ee1PUSH20x0eeb
0ee4PUSH10x60
0ee6DUP3
0ee7PUSH20x17dc
0eeaJUMP
0eebJUMPDEST
0eecMLOAD
0eedSWAP1
0eeeKECCAK256
0eefDUP4
0ef0EXTCODESIZE
0ef1ISZERO
0ef2PUSH20x13d6
0ef5JUMPI
0ef6SWAP4
0ef7SWAP2
0ef8SWAP1
0ef9DUP2
0efaPUSH10x40
0efcMLOAD
0efdSWAP6
0efeDUP7
0effSWAP5
0f00PUSH40x22f3f447
0f05PUSH10xe1
0f07SHL
0f08DUP7
0f09MSTORE
0f0aPUSH10x84
0f0cDUP7
0f0dADD
0f0eSWAP2
0f0fPUSH320x0fa658c1d006b02df1932f538d6a2916c308c2b37e7c48bc739709d89cceb357
0f30PUSH10x04
0f32DUP9
0f33ADD
0f34MSTORE
0f35PUSH10x24
0f37DUP8
0f38ADD
0f39MSTORE
0f3aPUSH10x44
0f3cDUP7
0f3dADD
0f3eMSTORE
0f3fPUSH10x80
0f41PUSH10x64
0f43DUP7
0f44ADD
0f45MSTORE
0f46MSTORE
0f47PUSH10xa4
0f49DUP4
0f4aADD
0f4bPUSH10xa0
0f4dPUSH10x04
0f4fDUP5
0f50PUSH10x05
0f52SHL
0f53DUP7
0f54ADD
0f55ADD
0f56ADD
0f57SWAP3
0f58DUP3
0f59PUSH0
0f5aSWAP1
0f5bPUSH10x7e
0f5dNOT
0f5eDUP2
0f5fCALLDATASIZE
0f60SUB
0f61ADD
0f62JUMPDEST
0f63DUP4
0f64DUP4
0f65LT
0f66PUSH20x135e
0f69JUMPI
0f6aPOP
0f6bPOP
0f6cPOP
0f6dPOP
0f6ePOP
0f6fPOP
0f70SWAP2
0f71DUP2
0f72PUSH0
0f73DUP2
0f74DUP6
0f75DUP3
0f76SWAP7
0f77POP
0f78SUB
0f79SWAP3
0f7aGAS
0f7bCALL
0f7cDUP1
0f7dISZERO
0f7ePUSH20x1353
0f81JUMPI
0f82PUSH20x133e
0f85JUMPI
0f86JUMPDEST
0f87POP
0f88PUSH20x0f92
0f8bDUP5
0f8cDUP7
0f8dMLOAD
0f8ePUSH20x1886
0f91JUMP
0f92JUMPDEST
0f93PUSH10x01
0f95SLOAD
0f96PUSH10x01
0f98PUSH10x01
0f9aPUSH10x01
0f9cPUSH10x40
0f9eSHL
0f9fSUB
0fa0DUP3
0fa1AND
0fa2ADD
0fa3PUSH10x01
0fa5PUSH10x01
0fa7PUSH10x40
0fa9SHL
0faaSUB
0fabDUP2
0facGT
0fadPUSH20x132a
0fb0JUMPI
0fb1PUSH10x01
0fb3PUSH10x01
0fb5PUSH10x40
0fb7SHL
0fb8SUB
0fb9AND
0fbaSWAP1
0fbbPUSH10x01
0fbdPUSH10x01
0fbfPUSH10x40
0fc1SHL
0fc2SUB
0fc3NOT
0fc4AND
0fc5OR
0fc6PUSH10x01
0fc8SSTORE
0fc9PUSH10x40
0fcbMLOAD
0fccSWAP1
0fcdPUSH10x20
0fcfDUP3
0fd0ADD
0fd1MSTORE
0fd2PUSH10x20
0fd4DUP2
0fd5MSTORE
0fd6PUSH20x0fe0
0fd9PUSH10x40
0fdbDUP3
0fdcPUSH20x17dc
0fdfJUMP
0fe0JUMPDEST
0fe1PUSH20x1003
0fe4PUSH10xa0
0fe6DUP8
0fe7ADD
0fe8MLOAD
0fe9DUP3
0feaPUSH20x0ffd
0fedPUSH20x0ff6
0ff0DUP7
0ff1DUP1
0ff2PUSH20x24fa
0ff5JUMP
0ff6JUMPDEST
0ff7CALLDATASIZE
0ff8SWAP2
0ff9PUSH20x1a65
0ffcJUMP
0ffdJUMPDEST
0ffeSWAP2
0fffPUSH20x293b
1002JUMP
1003JUMPDEST
1004ISZERO
1005PUSH20x131b
1008JUMPI
1009PUSH10xc0
100bDUP7
100cADD
100dMLOAD
100eSWAP2
100fDUP3
1010MLOAD
1011PUSH20x12e4
1014JUMPI
1015JUMPDEST
1016POP
1017POP
1018POP
1019POP
101aDUP3
101bMLOAD
101cPUSH10x01
101ePUSH10x01
1020PUSH10x40
1022SHL
1023SUB
1024PUSH10x40
1026DUP6
1027ADD
1028MLOAD
1029AND
102aSWAP1
102bPUSH10x04
102dPUSH10x01
102fPUSH10x01
1031PUSH10x40
1033SHL
1034SUB
1035DUP5
1036MLOAD
1037AND
1038SWAP2
1039DUP8
103aDUP10
103bPUSH10x80
103dDUP10
103eADD
103fSWAP6
1040DUP7
1041MLOAD
1042SWAP6
1043PUSH10x40
1045MLOAD
1046SWAP5
1047PUSH20x104f
104aDUP7
104bPUSH20x17ad
104eJUMP
104fJUMPDEST
1050DUP6
1051MSTORE
1052PUSH10x20
1054DUP6
1055ADD
1056SWAP2
1057DUP3
1058MSTORE
1059PUSH10x40
105bDUP6
105cADD
105dSWAP1
105eDUP2
105fMSTORE
1060PUSH10x60
1062DUP6
1063ADD
1064SWAP1
1065PUSH10x01
1067PUSH10x01
1069PUSH10x40
106bSHL
106cSUB
106dTIMESTAMP
106eAND
106fDUP3
1070MSTORE
1071PUSH10x40
1073PUSH10x80
1075DUP8
1076ADD
1077SWAP5
1078DUP13
1079DUP7
107aMSTORE
107bPUSH10xa0
107dDUP9
107eADD
107fSWAP7
1080PUSH10x01
1082DUP9
1083MSTORE
1084PUSH10xc0
1086DUP10
1087ADD
1088SWAP11
1089DUP12
108aMSTORE
108bDUP2
108cMSTORE
108dDUP1
108ePUSH10x20
1090MSTORE
1091KECCAK256
1092SWAP6
1093MLOAD
1094DUP7
1095SSTORE
1096PUSH10x01
1098PUSH10x01
109aPUSH10x40
109cSHL
109dSUB
109ePUSH10x01
10a0DUP8
10a1ADD
10a2SWAP4
10a3MLOAD
10a4AND
10a5PUSH10x01
10a7PUSH10x01
10a9PUSH10x40
10abSHL
10acSUB
10adNOT
10aeDUP5
10afSLOAD
10b0AND
10b1OR
10b2DUP4
10b3SSTORE
10b4MLOAD
10b5SWAP1
10b6PUSH160xffffffffffffffff0000000000000000
10c7DUP4
10c8SLOAD
10c9SWAP2
10caPUSH10x01
10ccPUSH10x01
10cePUSH10x40
10d0SHL
10d1SUB
10d2PUSH10x80
10d4SHL
10d5SWAP1
10d6MLOAD
10d7PUSH10x80
10d9SHL
10daAND
10dbSWAP3
10dcPUSH10x40
10deSHL
10dfAND
10e0SWAP1
10e1PUSH240xffffffffffffffffffffffffffffffff0000000000000000
10faNOT
10fbAND
10fcOR
10fdOR
10feSWAP1
10ffSSTORE
1100MLOAD
1101PUSH10x02
1103DUP4
1104ADD
1105SSTORE
1106PUSH10xff
1108PUSH10x03
110aDUP4
110bADD
110cSWAP2
110dMLOAD
110eAND
110fPUSH10xff
1111NOT
1112DUP3
1113SLOAD
1114AND
1115OR
1116SWAP1
1117SSTORE
1118ADD
1119SWAP1
111aMLOAD
111bSWAP7
111cDUP8
111dMLOAD
111eSWAP1
111fPUSH10x01
1121PUSH10x01
1123PUSH10x40
1125SHL
1126SUB
1127DUP3
1128GT
1129PUSH20x12d0
112cJUMPI
112dPUSH20x1136
1130DUP4
1131SLOAD
1132PUSH20x184e
1135JUMP
1136JUMPDEST
1137PUSH10x1f
1139DUP2
113aGT
113bPUSH20x127e
113eJUMPI
113fJUMPDEST
1140POP
1141PUSH10x20
1143SWAP9
1144DUP9
1145SWAP7
1146SWAP6
1147SWAP5
1148SWAP4
1149SWAP3
114aSWAP2
114bDUP11
114cSWAP2
114dSWAP1
114ePUSH10x01
1150PUSH10x1f
1152DUP6
1153GT
1154EQ
1155PUSH20x11e7
1158JUMPI
1159SWAP3
115aDUP1
115bPUSH320xdc71a128d817a5fcb36848826c0ac6080d65382df7a4a5a725db9c8b6cb7bb35
117cSWAP10
117dSWAP11
117eSWAP4
117fPUSH20x11d0
1182SWAP8
1183SWAP7
1184SWAP4
1185PUSH10x01
1187PUSH10x01
1189PUSH10x40
118bSHL
118cSUB
118dSWAP7
118eSWAP3
118fPUSH20x11dc
1192JUMPI
1193JUMPDEST
1194POP
1195POP
1196DUP2
1197PUSH10x01
1199SHL
119aSWAP2
119bPUSH0
119cNOT
119dSWAP1
119ePUSH10x03
11a0SHL
11a1SHR
11a2NOT
11a3AND
11a4OR
11a5SWAP1
11a6SSTORE
11a7JUMPDEST
11a8MLOAD
11a9SWAP4
11aaMLOAD
11abAND
11acSWAP1
11adMLOAD
11aeSWAP1
11afPUSH10x40
11b1MLOAD
11b2SWAP5
11b3DUP6
11b4SWAP5
11b5DUP6
11b6MSTORE
11b7DUP10
11b8DUP6
11b9ADD
11baMSTORE
11bbPUSH10x40
11bdDUP5
11beADD
11bfMSTORE
11c0PUSH10x80
11c2PUSH10x60
11c4DUP5
11c5ADD
11c6MSTORE
11c7PUSH10x80
11c9DUP4
11caADD
11cbSWAP1
11ccPUSH20x1770
11cfJUMP
11d0JUMPDEST
11d1SUB
11d2SWAP1
11d3LOG2
11d4PUSH20x038c
11d7DUP2
11d8PUSH20x252c
11dbJUMP
11dcJUMPDEST
11ddADD
11deMLOAD
11dfSWAP1
11e0POP
11e1PUSH0
11e2DUP1
11e3PUSH20x1193
11e6JUMP
11e7JUMPDEST
11e8SWAP9
11e9SWAP4
11eaSWAP3
11ebSWAP2
11ecSWAP1
11edPUSH10x1f
11efNOT
11f0DUP4
11f1AND
11f2DUP5
11f3DUP12
11f4MSTORE
11f5DUP3
11f6DUP12
11f7KECCAK256
11f8SWAP11
11f9JUMPDEST
11faDUP2
11fbDUP2
11fcLT
11fdPUSH20x1264
1200JUMPI
1201POP
1202SWAP3
1203PUSH320xdc71a128d817a5fcb36848826c0ac6080d65382df7a4a5a725db9c8b6cb7bb35
1224SWAP10
1225SWAP11
1226PUSH10x01
1228PUSH10x01
122aPUSH10x40
122cSHL
122dSUB
122eSWAP6
122fSWAP4
1230PUSH10x01
1232SWAP4
1233DUP4
1234PUSH20x11d0
1237SWAP11
1238SWAP10
1239SWAP8
123aLT
123bPUSH20x124c
123eJUMPI
123fJUMPDEST
1240POP
1241POP
1242POP
1243DUP2
1244SHL
1245ADD
1246SWAP1
1247SSTORE
1248PUSH20x11a7
124bJUMP
124cJUMPDEST
124dADD
124eMLOAD
124fPUSH0
1250NOT
1251PUSH10xf8
1253DUP5
1254PUSH10x03
1256SHL
1257AND
1258SHR
1259NOT
125aAND
125bSWAP1
125cSSTORE
125dPUSH0
125eDUP1
125fDUP1
1260PUSH20x123f
1263JUMP
1264JUMPDEST
1265DUP4
1266DUP4
1267ADD
1268MLOAD
1269DUP13
126aSSTORE
126bPUSH10x01
126dSWAP1
126eSWAP12
126fADD
1270SWAP11
1271DUP13
1272SWAP11
1273POP
1274SWAP3
1275DUP14
1276ADD
1277SWAP3
1278DUP14
1279ADD
127aPUSH20x11f9
127dJUMP
127eJUMPDEST
127fDUP3
1280DUP2
1281GT
1282ISZERO
1283PUSH20x113f
1286JUMPI
1287SWAP9
1288DUP4
1289DUP3
128aMSTORE
128bPUSH10x20
128dDUP3
128eKECCAK256
128fPUSH10x1f
1291DUP5
1292ADD
1293PUSH10x05
1295SHR
1296SWAP1
1297PUSH10x20
1299DUP6
129aLT
129bPUSH20x12c8
129eJUMPI
129fJUMPDEST
12a0DUP2
12a1ADD
12a2SWAP11
12a3PUSH10x1f
12a5ADD
12a6PUSH10x05
12a8SHR
12a9SUB
12aaDUP3
12abJUMPDEST
12acDUP2
12adDUP2
12aeLT
12afPUSH20x12ba
12b2JUMPI
12b3POP
12b4POP
12b5SWAP9
12b6PUSH20x113f
12b9JUMP
12baJUMPDEST
12bbDUP1
12bcDUP5
12bdPUSH10x01
12bfSWAP3
12c0DUP15
12c1ADD
12c2SSTORE
12c3ADD
12c4PUSH20x12ab
12c7JUMP
12c8JUMPDEST
12c9DUP4
12caSWAP2
12cbPOP
12ccPUSH20x129f
12cfJUMP
12d0JUMPDEST
12d1PUSH40x4e487b71
12d6PUSH10xe0
12d8SHL
12d9DUP2
12daMSTORE
12dbPUSH10x41
12ddPUSH10x04
12dfMSTORE
12e0PUSH10x24
12e2SWAP1
12e3REVERT
12e4JUMPDEST
12e5PUSH20x0ff6
12e8PUSH20x12f8
12ebSWAP2
12ecPUSH10x24
12eePUSH20x12fe
12f1SWAP7
12f2ADD
12f3SWAP1
12f4PUSH20x24fa
12f7JUMP
12f8JUMPDEST
12f9SWAP2
12faPUSH20x29fd
12fdJUMP
12feJUMPDEST
12ffISZERO
1300PUSH20x130c
1303JUMPI
1304PUSH0
1305DUP1
1306DUP1
1307DUP1
1308PUSH20x1015
130bJUMP
130cJUMPDEST
130dPUSH40x49b6b5bb
1312PUSH10xe1
1314SHL
1315DUP6
1316MSTORE
1317PUSH10x04
1319DUP6
131aREVERT
131bJUMPDEST
131cPUSH40x49b6b5bb
1321PUSH10xe1
1323SHL
1324DUP9
1325MSTORE
1326PUSH10x04
1328DUP9
1329REVERT
132aJUMPDEST
132bPUSH40x4e487b71
1330PUSH10xe0
1332SHL
1333DUP11
1334MSTORE
1335PUSH10x11
1337PUSH10x04
1339MSTORE
133aPUSH10x24
133cDUP11
133dREVERT
133eJUMPDEST
133fPUSH20x134b
1342SWAP2
1343SWAP8
1344POP
1345PUSH0
1346SWAP1
1347PUSH20x17dc
134aJUMP
134bJUMPDEST
134cPUSH0
134dSWAP6
134ePUSH0
134fPUSH20x0f86
1352JUMP
1353JUMPDEST
1354PUSH10x40
1356MLOAD
1357RETURNDATASIZE
1358PUSH0
1359DUP3
135aRETURNDATACOPY
135bRETURNDATASIZE
135cSWAP1
135dREVERT
135eJUMPDEST
135fPUSH10xa3
1361NOT
1362DUP11
1363DUP9
1364SUB
1365ADD
1366DUP6
1367MSTORE
1368SWAP5
1369SWAP7
136aPOP
136bSWAP3
136cSWAP5
136dSWAP2
136eSWAP4
136fSWAP1
1370SWAP3
1371SWAP2
1372DUP7
1373CALLDATALOAD
1374DUP3
1375DUP2
1376SLT
1377ISZERO
1378PUSH20x13d6
137bJUMPI
137cDUP4
137dADD
137ePUSH10x01
1380PUSH10x01
1382PUSH10xa0
1384SHL
1385SUB
1386PUSH20x138e
1389DUP3
138aPUSH20x16ff
138dJUMP
138eJUMPDEST
138fAND
1390DUP3
1391MSTORE
1392PUSH10x20
1394DUP2
1395ADD
1396CALLDATALOAD
1397SWAP2
1398PUSH10xff
139aDUP4
139bAND
139cDUP1
139dSWAP4
139eSUB
139fPUSH20x13d6
13a2JUMPI
13a3PUSH20x13c4
13a6PUSH10x20
13a8SWAP3
13a9DUP3
13aaPUSH10x01
13acSWAP6
13adDUP6
13aeDUP1
13afSWAP6
13b0ADD
13b1MSTORE
13b2PUSH20x092b
13b5PUSH20x0920
13b8PUSH20x090f
13bbPUSH10x40
13bdDUP6
13beADD
13bfDUP6
13c0PUSH20x17fd
13c3JUMP
13c4JUMPDEST
13c5SWAP9
13c6ADD
13c7SWAP7
13c8ADD
13c9SWAP4
13caADD
13cbSWAP1
13ccSWAP2
13cdDUP9
13ceSWAP7
13cfSWAP6
13d0SWAP5
13d1SWAP3
13d2PUSH20x0f62
13d5JUMP
13d6JUMPDEST
13d7PUSH0
13d8DUP1
13d9REVERT
13daJUMPDEST
13dbPUSH40x95693653
13e0PUSH10xe0
13e2SHL
13e3PUSH0
13e4MSTORE
13e5PUSH10x04
13e7MSTORE
13e8PUSH10x24
13eaPUSH0
13ebREVERT
13ecJUMPDEST
13edDUP8
13eePUSH40x3be57b39
13f3PUSH10xe1
13f5SHL
13f6PUSH0
13f7MSTORE
13f8PUSH10x04
13faMSTORE
13fbPUSH10x24
13fdPUSH0
13feREVERT
13ffJUMPDEST
1400CALLVALUE
1401PUSH20x13d6
1404JUMPI
1405PUSH0
1406CALLDATASIZE
1407PUSH10x03
1409NOT
140aADD
140bSLT
140cPUSH20x13d6
140fJUMPI
1410PUSH10x20
1412PUSH10x40
1414MLOAD
1415PUSH10x04
1417DUP2
1418MSTORE
1419RETURN
141aJUMPDEST
141bCALLVALUE
141cPUSH20x13d6
141fJUMPI
1420PUSH10x60
1422CALLDATASIZE
1423PUSH10x03
1425NOT
1426ADD
1427SLT
1428PUSH20x13d6
142bJUMPI
142cPUSH10x04
142eCALLDATALOAD
142fPUSH10x04
1431DUP2
1432LT
1433ISZERO
1434PUSH20x13d6
1437JUMPI
1438PUSH20x038c
143bPUSH10x20
143dSWAP2
143ePUSH20x1445
1441PUSH20x16e9
1444JUMP
1445JUMPDEST
1446PUSH10x44
1448CALLDATALOAD
1449SWAP2
144aPUSH20x1794
144dJUMP
144eJUMPDEST
144fCALLVALUE
1450PUSH20x13d6
1453JUMPI
1454PUSH0
1455CALLDATASIZE
1456PUSH10x03
1458NOT
1459ADD
145aSLT
145bPUSH20x13d6
145eJUMPI
145fPUSH10x20
1461PUSH10x40
1463MLOAD
1464PUSH320x4692dd1ea4cf3c6195d8e589aa4fc670450b78e39a818a4516a117f9b388ae69
1485DUP2
1486MSTORE
1487RETURN
1488JUMPDEST
1489CALLVALUE
148aPUSH20x13d6
148dJUMPI
148ePUSH10x20
1490CALLDATASIZE
1491PUSH10x03
1493NOT
1494ADD
1495SLT
1496PUSH20x13d6
1499JUMPI
149aPUSH10x04
149cCALLDATALOAD
149dPUSH0
149eMSTORE
149fPUSH0
14a0PUSH10x20
14a2MSTORE
14a3PUSH10x20
14a5PUSH10x40
14a7PUSH0
14a8KECCAK256
14a9PUSH10x01
14abPUSH10xff
14adPUSH10x03
14afDUP4
14b0ADD
14b1SLOAD
14b2AND
14b3EQ
14b4SWAP1
14b5DUP2
14b6PUSH20x14e6
14b9JUMPI
14baJUMPDEST
14bbDUP2
14bcPUSH20x14cb
14bfJUMPI
14c0JUMPDEST
14c1POP
14c2PUSH10x40
14c4MLOAD
14c5SWAP1
14c6ISZERO
14c7ISZERO
14c8DUP2
14c9MSTORE
14caRETURN
14cbJUMPDEST
14ccPUSH10x01
14cePUSH10x01
14d0PUSH10x40
14d2SHL
14d3SUB
14d4SWAP2
14d5POP
14d6PUSH10x01
14d8ADD
14d9SLOAD
14daPUSH10x40
14dcSHR
14ddAND
14deTIMESTAMP
14dfGT
14e0ISZERO
14e1DUP3
14e2PUSH20x14c0
14e5JUMP
14e6JUMPDEST
14e7PUSH10x01
14e9DUP2
14eaADD
14ebSLOAD
14ecPUSH10x01
14eePUSH10x01
14f0PUSH10x40
14f2SHL
14f3SUB
14f4AND
14f5TIMESTAMP
14f6LT
14f7ISZERO
14f8SWAP2
14f9POP
14faPUSH20x14ba
14fdJUMP
14feJUMPDEST
14ffCALLVALUE
1500PUSH20x13d6
1503JUMPI
1504PUSH0
1505CALLDATASIZE
1506PUSH10x03
1508NOT
1509ADD
150aSLT
150bPUSH20x13d6
150eJUMPI
150fPUSH10x20
1511PUSH10x40
1513MLOAD
1514PUSH10x07
1516DUP2
1517MSTORE
1518RETURN
1519JUMPDEST
151aCALLVALUE
151bPUSH20x13d6
151eJUMPI
151fPUSH0
1520CALLDATASIZE
1521PUSH10x03
1523NOT
1524ADD
1525SLT
1526PUSH20x13d6
1529JUMPI
152aPUSH10x20
152cPUSH10x40
152eMLOAD
152fPUSH30x14b800
1533DUP2
1534MSTORE
1535RETURN
1536JUMPDEST
1537CALLVALUE
1538PUSH20x13d6
153bJUMPI
153cPUSH0
153dCALLDATASIZE
153ePUSH10x03
1540NOT
1541ADD
1542SLT
1543PUSH20x13d6
1546JUMPI
1547PUSH10x20
1549PUSH10x40
154bMLOAD
154cPUSH10x01
154eDUP2
154fMSTORE
1550RETURN
1551JUMPDEST
1552CALLVALUE
1553PUSH20x13d6
1556JUMPI
1557PUSH0
1558CALLDATASIZE
1559PUSH10x03
155bNOT
155cADD
155dSLT
155ePUSH20x13d6
1561JUMPI
1562PUSH10x20
1564PUSH10x40
1566MLOAD
1567PUSH20x0202
156aDUP2
156bMSTORE
156cRETURN
156dJUMPDEST
156eCALLVALUE
156fPUSH20x13d6
1572JUMPI
1573PUSH0
1574CALLDATASIZE
1575PUSH10x03
1577NOT
1578ADD
1579SLT
157aPUSH20x13d6
157dJUMPI
157ePUSH10x20
1580PUSH10x40
1582MLOAD
1583PUSH20x5410
1586DUP2
1587MSTORE
1588RETURN
1589JUMPDEST
158aCALLVALUE
158bPUSH20x13d6
158eJUMPI
158fPUSH0
1590CALLDATASIZE
1591PUSH10x03
1593NOT
1594ADD
1595SLT
1596PUSH20x13d6
1599JUMPI
159aPUSH10x20
159cPUSH10x40
159eMLOAD
159fPUSH10x02
15a1DUP2
15a2MSTORE
15a3RETURN
15a4JUMPDEST
15a5CALLVALUE
15a6PUSH20x13d6
15a9JUMPI
15aaPUSH0
15abCALLDATASIZE
15acPUSH10x03
15aeNOT
15afADD
15b0SLT
15b1PUSH20x13d6
15b4JUMPI
15b5PUSH10x20
15b7PUSH10x40
15b9MLOAD
15baPUSH10x03
15bcDUP2
15bdMSTORE
15beRETURN
15bfJUMPDEST
15c0CALLVALUE
15c1PUSH20x13d6
15c4JUMPI
15c5PUSH0
15c6CALLDATASIZE
15c7PUSH10x03
15c9NOT
15caADD
15cbSLT
15ccPUSH20x13d6
15cfJUMPI
15d0PUSH10x20
15d2PUSH10x40
15d4MLOAD
15d5PUSH20x0201
15d8DUP2
15d9MSTORE
15daRETURN
15dbJUMPDEST
15dcCALLVALUE
15ddPUSH20x13d6
15e0JUMPI
15e1PUSH0
15e2CALLDATASIZE
15e3PUSH10x03
15e5NOT
15e6ADD
15e7SLT
15e8PUSH20x13d6
15ebJUMPI
15ecPUSH10x40
15eeMLOAD
15efPUSH320x000000000000000000000000e604b1cf1ae764636263e394c206508b9e9a965e
1610PUSH10x01
1612PUSH10x01
1614PUSH10xa0
1616SHL
1617SUB
1618AND
1619DUP2
161aMSTORE
161bPUSH10x20
161dSWAP1
161eRETURN
161fJUMPDEST
1620CALLVALUE
1621PUSH20x13d6
1624JUMPI
1625PUSH10x80
1627CALLDATASIZE
1628PUSH10x03
162aNOT
162bADD
162cSLT
162dPUSH20x13d6
1630JUMPI
1631PUSH20x1638
1634PUSH20x16d3
1637JUMP
1638JUMPDEST
1639POP
163aPUSH20x1641
163dPUSH20x16e9
1640JUMP
1641JUMPDEST
1642POP
1643PUSH10x64
1645CALLDATALOAD
1646PUSH10x01
1648PUSH10x01
164aPUSH10x40
164cSHL
164dSUB
164eDUP2
164fGT
1650PUSH20x13d6
1653JUMPI
1654PUSH20x1661
1657SWAP1
1658CALLDATASIZE
1659SWAP1
165aPUSH10x04
165cADD
165dPUSH20x1713
1660JUMP
1661JUMPDEST
1662POP
1663POP
1664PUSH10x40
1666MLOAD
1667PUSH40x0a85bd01
166cPUSH10xe1
166eSHL
166fDUP2
1670MSTORE
1671PUSH10x20
1673SWAP1
1674RETURN
1675JUMPDEST
1676CALLVALUE
1677PUSH20x13d6
167aJUMPI
167bPUSH0
167cCALLDATASIZE
167dPUSH10x03
167fNOT
1680ADD
1681SLT
1682PUSH20x13d6
1685JUMPI
1686PUSH10x20
1688PUSH10x01
168aPUSH10x01
168cPUSH10x40
168eSHL
168fSUB
1690PUSH10x01
1692SLOAD
1693AND
1694PUSH10x40
1696MLOAD
1697SWAP1
1698DUP2
1699MSTORE
169aRETURN
169bJUMPDEST
169cCALLVALUE
169dPUSH20x13d6
16a0JUMPI
16a1PUSH0
16a2CALLDATASIZE
16a3PUSH10x03
16a5NOT
16a6ADD
16a7SLT
16a8PUSH20x13d6
16abJUMPI
16acDUP1
16adPUSH320x0fa658c1d006b02df1932f538d6a2916c308c2b37e7c48bc739709d89cceb357
16cePUSH10x20
16d0SWAP3
16d1MSTORE
16d2RETURN
16d3JUMPDEST
16d4PUSH10x04
16d6CALLDATALOAD
16d7SWAP1
16d8PUSH10x01
16daPUSH10x01
16dcPUSH10xa0
16deSHL
16dfSUB
16e0DUP3
16e1AND
16e2DUP3
16e3SUB
16e4PUSH20x13d6
16e7JUMPI
16e8JUMP
16e9JUMPDEST
16eaPUSH10x24
16ecCALLDATALOAD
16edSWAP1
16eePUSH10x01
16f0PUSH10x01
16f2PUSH10xa0
16f4SHL
16f5SUB
16f6DUP3
16f7AND
16f8DUP3
16f9SUB
16faPUSH20x13d6
16fdJUMPI
16feJUMP
16ffJUMPDEST
1700CALLDATALOAD
1701SWAP1
1702PUSH10x01
1704PUSH10x01
1706PUSH10xa0
1708SHL
1709SUB
170aDUP3
170bAND
170cDUP3
170dSUB
170ePUSH20x13d6
1711JUMPI
1712JUMP
1713JUMPDEST
1714SWAP2
1715DUP2
1716PUSH10x1f
1718DUP5
1719ADD
171aSLT
171bISZERO
171cPUSH20x13d6
171fJUMPI
1720DUP3
1721CALLDATALOAD
1722SWAP2
1723PUSH10x01
1725PUSH10x01
1727PUSH10x40
1729SHL
172aSUB
172bDUP4
172cGT
172dPUSH20x13d6
1730JUMPI
1731PUSH10x20
1733DUP4
1734DUP2
1735DUP7
1736ADD
1737SWAP6
1738ADD
1739ADD
173aGT
173bPUSH20x13d6
173eJUMPI
173fJUMP
1740JUMPDEST
1741SWAP2
1742DUP2
1743PUSH10x1f
1745DUP5
1746ADD
1747SLT
1748ISZERO
1749PUSH20x13d6
174cJUMPI
174dDUP3
174eCALLDATALOAD
174fSWAP2
1750PUSH10x01
1752PUSH10x01
1754PUSH10x40
1756SHL
1757SUB
1758DUP4
1759GT
175aPUSH20x13d6
175dJUMPI
175ePUSH10x20
1760DUP1
1761DUP6
1762ADD
1763SWAP5
1764DUP5
1765PUSH10x05
1767SHL
1768ADD
1769ADD
176aGT
176bPUSH20x13d6
176eJUMPI
176fJUMP
1770JUMPDEST
1771DUP1
1772MLOAD
1773DUP1
1774DUP4
1775MSTORE
1776PUSH10x20
1778SWAP3
1779SWAP2
177aDUP2
177bSWAP1
177cDUP5
177dADD
177eDUP5
177fDUP5
1780ADD
1781MCOPY
1782PUSH0
1783DUP3
1784DUP3
1785ADD
1786DUP5
1787ADD
1788MSTORE
1789PUSH10x1f
178bADD
178cPUSH10x1f
178eNOT
178fAND
1790ADD
1791ADD
1792SWAP1
1793JUMP
1794JUMPDEST
1795SWAP1
1796PUSH20x179f
1799SWAP3
179aSWAP2
179bPUSH20x23a3
179eJUMP
179fJUMPDEST
17a0DUP1
17a1ISZERO
17a2PUSH20x17a8
17a5JUMPI
17a6SWAP1
17a7JUMP
17a8JUMPDEST
17a9POP
17aaPUSH0
17abSWAP1
17acJUMP
17adJUMPDEST
17aePUSH10xe0
17b0DUP2
17b1ADD
17b2SWAP1
17b3DUP2
17b4LT
17b5PUSH10x01
17b7PUSH10x01
17b9PUSH10x40
17bbSHL
17bcSUB
17bdDUP3
17beGT
17bfOR
17c0PUSH20x17c8
17c3JUMPI
17c4PUSH10x40
17c6MSTORE
17c7JUMP
17c8JUMPDEST
17c9PUSH40x4e487b71
17cePUSH10xe0
17d0SHL
17d1PUSH0
17d2MSTORE
17d3PUSH10x41
17d5PUSH10x04
17d7MSTORE
17d8PUSH10x24
17daPUSH0
17dbREVERT
17dcJUMPDEST
17ddSWAP1
17dePUSH10x1f
17e0DUP1
17e1NOT
17e2SWAP2
17e3ADD
17e4AND
17e5DUP2
17e6ADD
17e7SWAP1
17e8DUP2
17e9LT
17eaPUSH10x01
17ecPUSH10x01
17eePUSH10x40
17f0SHL
17f1SUB
17f2DUP3
17f3GT
17f4OR
17f5PUSH20x17c8
17f8JUMPI
17f9PUSH10x40
17fbMSTORE
17fcJUMP
17fdJUMPDEST
17feSWAP1
17ffCALLDATALOAD
1800PUSH10x1e
1802NOT
1803DUP3
1804CALLDATASIZE
1805SUB
1806ADD
1807DUP2
1808SLT
1809ISZERO
180aPUSH20x13d6
180dJUMPI
180eADD
180fPUSH10x20
1811DUP2
1812CALLDATALOAD
1813SWAP2
1814ADD
1815SWAP2
1816PUSH10x01
1818PUSH10x01
181aPUSH10x40
181cSHL
181dSUB
181eDUP3
181fGT
1820PUSH20x13d6
1823JUMPI
1824DUP2
1825CALLDATASIZE
1826SUB
1827DUP4
1828SGT
1829PUSH20x13d6
182cJUMPI
182dJUMP
182eJUMPDEST
182fSWAP1
1830DUP1
1831PUSH10x20
1833SWAP4
1834SWAP3
1835DUP2
1836DUP5
1837MSTORE
1838DUP5
1839DUP5
183aADD
183bCALLDATACOPY
183cPUSH0
183dDUP3
183eDUP3
183fADD
1840DUP5
1841ADD
1842MSTORE
1843PUSH10x1f
1845ADD
1846PUSH10x1f
1848NOT
1849AND
184aADD
184bADD
184cSWAP1
184dJUMP
184eJUMPDEST