@forestrie/receipt-verify 0.7.0 → 0.8.0

package/dist/build-receipt-offline.d.ts

@@ -46,6 +46,16 @@ export type BuildReceiptOfflineInput = {
  * on any failure.
  */
 export declare function buildReceiptOffline(input: BuildReceiptOfflineInput): Uint8Array;
+/**
+ * Assemble a receipt from a checkpoint's pre-signed peak receipt and a
+ * caller-supplied inclusion `proof` for `mmrIndex`: pick the peak receipt the
+ * proof roots to, attach the proof at header 396 and copy the label-1000
+ * delegation cert. The checkpoint signature covers only the accumulator (peak),
+ * so the unprotected 396 header is free to carry the path — this is why a path
+ * from ANY source (massif tiles here; a tile-free consistency-proof extension in
+ * `freshenReceipt`) yields a `verify --genesis`-equivalent native receipt.
+ */
+export declare function assembleReceiptFromProof(checkpoint: ParsedCheckpoint, mmrIndex: bigint, proof: Uint8Array[]): Uint8Array;
 export type ComputedAccumulatorPeak = {
     /** Root computed from the massif's leaf value and rebuilt path. */
     peak: Uint8Array;

package/dist/build-receipt-offline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-receipt-offline.d.ts","sourceRoot":"","sources":["../src/build-receipt-offline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,OAAO,EAIL,mBAAmB,EAEnB,KAAK,eAAe,EAErB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,oBAAoB,CAAC;AAQ5B;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAC/B,YAAY,EAAE,eAAe,EAAE,CAAC;AAEhC,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,SAAS,CAAC;IACrB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,oEAAoE;IACpE,YAAY,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC/B,wEAAwE;IACxE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,cAAc,EAAE,UAAU,GAAG,IAAI,CAAC;CACnC,CAAC;AAEF,wDAAwD;AACxD,wBAAgB,eAAe,CAAC,eAAe,EAAE,UAAU,GAAG,gBAAgB,CAqB7E;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,WAAW,EAAE,UAAU,CAAC;IACxB,eAAe,EAAE,UAAU,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,wBAAwB,GAC9B,UAAU,CA2EZ;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,mEAAmE;IACnE,IAAI,EAAE,UAAU,CAAC;IACjB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,SAAS,EAAE,UAAU,CAAC;CACvB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,WAAW,EAAE,UAAU,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAwBnC"}
+{"version":3,"file":"build-receipt-offline.d.ts","sourceRoot":"","sources":["../src/build-receipt-offline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,OAAO,EAIL,mBAAmB,EAEnB,KAAK,eAAe,EAErB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,oBAAoB,CAAC;AAQ5B;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAC/B,YAAY,EAAE,eAAe,EAAE,CAAC;AAEhC,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,SAAS,CAAC;IACrB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,oEAAoE;IACpE,YAAY,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC/B,wEAAwE;IACxE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,cAAc,EAAE,UAAU,GAAG,IAAI,CAAC;CACnC,CAAC;AAEF,wDAAwD;AACxD,wBAAgB,eAAe,CAAC,eAAe,EAAE,UAAU,GAAG,gBAAgB,CAqB7E;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,WAAW,EAAE,UAAU,CAAC;IACxB,eAAe,EAAE,UAAU,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,wBAAwB,GAC9B,UAAU,CAyCZ;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,gBAAgB,EAC5B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,UAAU,EAAE,GAClB,UAAU,CA4CZ;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,mEAAmE;IACnE,IAAI,EAAE,UAAU,CAAC;IACjB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,SAAS,EAAE,UAAU,CAAC;CACvB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,WAAW,EAAE,UAAU,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAwBnC"}

package/dist/build-receipt-offline.js

@@ -79,7 +79,25 @@ export function buildReceiptOffline(input) {
             `${store.massifIndex.toString(10)}`);
     }
     const proof = inclusionProof(store.get, mmrLastIndex, mmrIndex);
-    const peakIdx = peakIndexForLeafProof(mmrSize, proof.length);
+    return assembleReceiptFromProof(checkpoint, mmrIndex, proof);
+}
+/**
+ * Assemble a receipt from a checkpoint's pre-signed peak receipt and a
+ * caller-supplied inclusion `proof` for `mmrIndex`: pick the peak receipt the
+ * proof roots to, attach the proof at header 396 and copy the label-1000
+ * delegation cert. The checkpoint signature covers only the accumulator (peak),
+ * so the unprotected 396 header is free to carry the path — this is why a path
+ * from ANY source (massif tiles here; a tile-free consistency-proof extension in
+ * `freshenReceipt`) yields a `verify --genesis`-equivalent native receipt.
+ */
+export function assembleReceiptFromProof(checkpoint, mmrIndex, proof) {
+    if (checkpoint.mmrSize === null || checkpoint.mmrSize <= 0n) {
+        throw new Error("checkpoint carries no sealed size");
+    }
+    if (!checkpoint.peakReceipts) {
+        throw new Error("checkpoint carries no pre-signed peak receipts (label -65931)");
+    }
+    const peakIdx = peakIndexForLeafProof(checkpoint.mmrSize, proof.length);
     const receiptBytes = checkpoint.peakReceipts[peakIdx];
     if (!(receiptBytes instanceof Uint8Array)) {
         throw new Error(`checkpoint peak receipt slot ${peakIdx} is missing or not bstr`);

package/dist/checkpoint-chain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checkpoint-chain.d.ts","sourceRoot":"","sources":["../src/checkpoint-chain.ts"],"names":[],"mappings":"AA6BA,iEAAiE;AACjE,MAAM,MAAM,0BAA0B,GAAG;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;IACtB,uEAAuE;IACvE,UAAU,EAAE,UAAU,EAAE,CAAC;CAC1B,CAAC;AAeF,gEAAgE;AAChE,wBAAgB,0BAA0B,CACxC,eAAe,EAAE,UAAU,GAC1B,0BAA0B,CAiC5B;AAED;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,0BAA0B,EACjC,eAAe,EAAE,UAAU,EAAE,GAC5B,OAAO,CAAC,UAAU,EAAE,CAAC,CAmBvB;AAED;+DAC+D;AAC/D,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,UAAU,CAQxE;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,WAAW,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,mBAAmB,EAAE,CAAC;IAAC,WAAW,EAAE,UAAU,EAAE,CAAA;CAAE,GACrE;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EACF,aAAa,GACb,oBAAoB,GACpB,WAAW,GACX,iBAAiB,CAAC;IACtB,yCAAyC;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,mBAAmB,EAAE,CAAC;CAC9B,CAAC;AAEN;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,eAAe,EAAE,CACf,eAAe,EAAE,UAAU,EAC3B,eAAe,EAAE,UAAU,KACxB,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB,4EAA4E;IAC5E,eAAe,CAAC,EAAE,UAAU,EAAE,CAAC;CAChC,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAiGjC"}
+{"version":3,"file":"checkpoint-chain.d.ts","sourceRoot":"","sources":["../src/checkpoint-chain.ts"],"names":[],"mappings":"AA6BA,iEAAiE;AACjE,MAAM,MAAM,0BAA0B,GAAG;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;IACtB,uEAAuE;IACvE,UAAU,EAAE,UAAU,EAAE,CAAC;CAC1B,CAAC;AA2BF,gEAAgE;AAChE,wBAAgB,0BAA0B,CACxC,eAAe,EAAE,UAAU,GAC1B,0BAA0B,CA6C5B;AAED;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,0BAA0B,EACjC,eAAe,EAAE,UAAU,EAAE,GAC5B,OAAO,CAAC,UAAU,EAAE,CAAC,CAmBvB;AAED;+DAC+D;AAC/D,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,UAAU,CAQxE;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,WAAW,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,mBAAmB,EAAE,CAAC;IAAC,WAAW,EAAE,UAAU,EAAE,CAAA;CAAE,GACrE;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EACF,aAAa,GACb,oBAAoB,GACpB,WAAW,GACX,iBAAiB,CAAC;IACtB,yCAAyC;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,mBAAmB,EAAE,CAAC;CAC9B,CAAC;AAEN;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,eAAe,EAAE,CACf,eAAe,EAAE,UAAU,EAC3B,eAAe,EAAE,UAAU,KACxB,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB,4EAA4E;IAC5E,eAAe,CAAC,EAAE,UAAU,EAAE,CAAC;CAChC,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAiGjC"}

package/dist/checkpoint-chain.js

@@ -26,15 +26,23 @@ import { parseCheckpoint } from "./build-receipt-offline.js";
 const VDS_COSE_RECEIPT_PROOFS_TAG = 396;
 const VDP_CONSISTENCY_PROOF_KEY = -2;
 function asBigint(v, what) {
-    if (typeof v === "bigint")
+    // Unsigned only: a negative size flows into `peakMMRIndexes`, whose
+    // `posHeight` spins forever on a non-positive argument — a malformed `.sth`
+    // must be rejected in bounded time, before any such call (FOR-414).
+    if (typeof v === "bigint") {
+        if (v < 0n)
+            throw new Error(`${what}: must be an unsigned integer, got ${v}`);
         return v;
-    if (typeof v === "number" && Number.isSafeInteger(v))
+    }
+    if (typeof v === "number" && Number.isSafeInteger(v) && v >= 0) {
         return BigInt(v);
+    }
     throw new Error(`${what}: expected an unsigned integer`);
 }
 function asBytesArray(v, what) {
-    if (!Array.isArray(v) || v.some((e) => !(e instanceof Uint8Array))) {
-        throw new Error(`${what}: expected an array of byte strings`);
+    if (!Array.isArray(v) ||
+        v.some((e) => !(e instanceof Uint8Array) || e.length !== 32)) {
+        throw new Error(`${what}: expected an array of 32-byte strings`);
     }
     return v;
 }
@@ -58,9 +66,19 @@ export function checkpointConsistencyProof(checkpointBytes) {
         pathsRaw.some((p) => !Array.isArray(p) || p.some((n) => !(n instanceof Uint8Array)))) {
         throw new Error("consistency paths must be arrays of byte strings");
     }
+    const treeSize1 = asBigint(proof[0], "tree-size-1");
+    const treeSize2 = asBigint(proof[1], "tree-size-2");
+    // A consistency proof strictly grows the tree; enforce `0 <= ts1 < ts2`
+    // (ts1 == 0 is a legitimate base-0 first link). This is the primary guard
+    // that keeps `treeSize2 - 1` / `treeSize1 - 1` non-negative before they
+    // reach `peakMMRIndexes` (FOR-414); the unsigned check in `asBigint` and
+    // the `posHeight` guard in @forestrie/merklelog are defence-in-depth.
+    if (treeSize2 <= treeSize1) {
+        throw new Error(`consistency proof must grow the tree: tree-size-1 ${treeSize1} < tree-size-2 ${treeSize2}`);
+    }
     return {
-        treeSize1: asBigint(proof[0], "tree-size-1"),
-        treeSize2: asBigint(proof[1], "tree-size-2"),
+        treeSize1,
+        treeSize2,
         paths: pathsRaw,
         rightPeaks: asBytesArray(proof[3], "right-peaks"),
     };

package/dist/freshen-receipt.d.ts

@@ -0,0 +1,32 @@
+import { type CheckpointConsistencyProof } from "./checkpoint-chain.js";
+export type FreshenReceiptInput = {
+    /** The stale receipt (COSE Sign1 with a 396 inclusion proof). */
+    oldReceiptBytes: Uint8Array;
+    /** The leaf's committed value: `SHA-256(idtimestamp ‖ inner)` — the same
+     * value `verify` recomputes from the entry (caller derives it). */
+    leafValue: Uint8Array;
+    /** Consistency-proof chain covering [0 or a trusted seed] → the latest sealed
+     * size, in ascending contiguous order (the raw per-checkpoint proofs, with
+     * `paths`). The chain's last link must end at the checkpoint's sealed size. */
+    consistencyProofs: readonly CheckpointConsistencyProof[];
+    /** Trusted accumulator seed for a suffix chain; omit for a chain from base 0.
+     * Its peak count must match the first link's tree-size-1. */
+    accumulatorFrom?: Uint8Array[];
+    /** The latest checkpoint (`.sth`): its pre-signed peak receipts + delegation
+     * cert become the freshened receipt's signature. */
+    latestCheckpointBytes: Uint8Array;
+};
+export type FreshenReceiptResult = {
+    /** The freshened native receipt (verifies against the latest state). */
+    receipt: Uint8Array;
+    /** Sealed size the freshened receipt is anchored at. */
+    sealedSize: bigint;
+};
+/**
+ * Freshen a stale receipt to the latest sealed state. Throws if the chain is
+ * not a contiguous cover from the trusted base to the checkpoint's sealed size,
+ * if a climb node is missing from the supplied proofs, or if the recomputed
+ * peak does not match the folded latest accumulator.
+ */
+export declare function freshenReceipt(input: FreshenReceiptInput): Promise<FreshenReceiptResult>;
+//# sourceMappingURL=freshen-receipt.d.ts.map

package/dist/freshen-receipt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"freshen-receipt.d.ts","sourceRoot":"","sources":["../src/freshen-receipt.ts"],"names":[],"mappings":"AA+CA,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,uBAAuB,CAAC;AAI/B,MAAM,MAAM,mBAAmB,GAAG;IAChC,iEAAiE;IACjE,eAAe,EAAE,UAAU,CAAC;IAC5B;uEACmE;IACnE,SAAS,EAAE,UAAU,CAAC;IACtB;;mFAE+E;IAC/E,iBAAiB,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACzD;iEAC6D;IAC7D,eAAe,CAAC,EAAE,UAAU,EAAE,CAAC;IAC/B;wDACoD;IACpD,qBAAqB,EAAE,UAAU,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,wEAAwE;IACxE,OAAO,EAAE,UAAU,CAAC;IACpB,wDAAwD;IACxD,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AASF;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,oBAAoB,CAAC,CAmJ/B"}

package/dist/freshen-receipt.js

@@ -0,0 +1,171 @@
+/**
+ * Freshen a stale receipt (FOR-418 Phase 3, plan-2607-32).
+ *
+ * A receipt goes stale when log growth buries the peak it commits to. Freshening
+ * re-anchors it to the CURRENT sealed state without tiles: extend the leaf's
+ * inclusion path from its old peak up to the latest accumulator using the
+ * checkpoint chain's consistency proofs (the tile-free source of the climb
+ * nodes), then attach that fresh path at header 396 to the LATEST checkpoint's
+ * pre-signed peak receipt. The result is a native receipt that verifies with
+ * plain `verify --genesis` against the current state — the latest checkpoint
+ * carries the genesis-verifiable delegation cert (see plan-2607-32's Phase 3
+ * finding: the calldata provider supplies the climb material tile-free, but the
+ * signature/cert comes from the latest `.sth`).
+ *
+ * Trust note: the freshened receipt is defined SOLELY by the latest checkpoint —
+ * its label-1000 delegation cert and its pre-signed peak receipt. Owner-rooting
+ * is established by the verify step's trust anchor: `verify --genesis` rejects a
+ * cert whose delegator is not the genesis owner (a hard failure, not a warning).
+ * A rotation of the delegated-TO sealer key is routine and within the owner's
+ * authority, so freshen does NOT flag it — there is no signer-change gate (this
+ * supersedes the earlier `--allow-new-signer` sketch; see the plan-2607-32 F2
+ * note). The old receipt's cert is irrelevant to the emitted artifact.
+ *
+ * Two independent fail-closed guards keep a bad assembly from ever minting:
+ *  - Cross-checks against the checkpoint being borrowed from: the supplied
+ *    chain must reach the checkpoint's sealed size and fold to exactly the
+ *    number of peaks the checkpoint pre-signed (freshen holds no signing key, so
+ *    the cryptographic peak↔signature tie stays with downstream verify; these
+ *    structural checks turn a chain/checkpoint mismatch into a mint-time error
+ *    instead of an unverifiable receipt).
+ *  - The path self-check: `calculateRoot(leaf, freshPath)` must equal the
+ *    covering peak of the folded latest accumulator.
+ *
+ * The climb arithmetic is `@forestrie/merklelog`'s `inclusionProofPath` (a
+ * tested go-merklelog port); this module only assembles node values by index
+ * from the old receipt path + the consistency proofs.
+ */
+import { calculateRoot, inclusionProofPath, peakIndexForLeafProof, peakMMRIndexes, } from "@forestrie/merklelog";
+import { assembleReceiptFromProof, parseCheckpoint, } from "./build-receipt-offline.js";
+import { computeCheckpointAccumulator, } from "./checkpoint-chain.js";
+import { parseReceipt } from "./parse-receipt.js";
+import { SubtleHasher } from "./subtle-hasher.js";
+function bytesEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let x = 0;
+    for (let i = 0; i < a.length; i++)
+        x |= a[i] ^ b[i];
+    return x === 0;
+}
+/**
+ * Freshen a stale receipt to the latest sealed state. Throws if the chain is
+ * not a contiguous cover from the trusted base to the checkpoint's sealed size,
+ * if a climb node is missing from the supplied proofs, or if the recomputed
+ * peak does not match the folded latest accumulator.
+ */
+export async function freshenReceipt(input) {
+    const { proof } = parseReceipt(input.oldReceiptBytes);
+    // `parseReceipt` addresses the leaf by MMR index (396 proof entry key 1);
+    // `inclusionProofPath` below needs exactly that MMR index. (`Proof.leafIndex`
+    // is a distinct leaf-ordinal field that parseReceipt never sets — do not use
+    // it here, or a future producer that populated it would feed a non-MMR-index
+    // into the climb.)
+    const leafMmrIndex = proof.mmrIndex;
+    if (leafMmrIndex === undefined) {
+        throw new Error("receipt inclusion proof carries no mmr index");
+    }
+    const oldPath = proof.path;
+    const latest = parseCheckpoint(input.latestCheckpointBytes);
+    if (latest.mmrSize === null || latest.mmrSize <= 0n) {
+        throw new Error("latest checkpoint carries no sealed size");
+    }
+    const sealedSize = latest.mmrSize;
+    if (leafMmrIndex >= sealedSize) {
+        throw new Error(`receipt entry ${leafMmrIndex} is newer than the latest sealed size ${sealedSize}`);
+    }
+    // --- validate the supplied chain shape before folding (F5) ---
+    const links = input.consistencyProofs;
+    if (links.length === 0) {
+        throw new Error("freshen requires at least one consistency proof linking the receipt's era to the checkpoint");
+    }
+    const firstLink = links[0];
+    // Base: a base-0 chain starts from an empty accumulator; a suffix chain's
+    // trusted seed must have the peak count of its tree-size-1.
+    const baseCount = input.accumulatorFrom?.length ?? 0;
+    if (firstLink.treeSize1 === 0n) {
+        if (baseCount !== 0) {
+            throw new Error("base-0 consistency chain must start from an empty accumulator seed");
+        }
+    }
+    else {
+        const wanted = peakMMRIndexes(firstLink.treeSize1 - 1n).length;
+        if (baseCount !== wanted) {
+            throw new Error(`base accumulator has ${baseCount} peaks; first link size ${firstLink.treeSize1} requires ${wanted}`);
+        }
+    }
+    // Contiguity: each link continues where the previous one sealed.
+    for (let i = 1; i < links.length; i++) {
+        if (links[i].treeSize1 !== links[i - 1].treeSize2) {
+            throw new Error(`consistency chain is not contiguous at link ${i}: base ${links[i].treeSize1} != previous sealed size ${links[i - 1].treeSize2}`);
+        }
+    }
+    // Endpoint: the chain must reach exactly the checkpoint's sealed size (F1).
+    const lastLink = links[links.length - 1];
+    if (lastLink.treeSize2 !== sealedSize) {
+        throw new Error(`consistency chain ends at size ${lastLink.treeSize2} but the checkpoint sealed size ${sealedSize}`);
+    }
+    // Fold the chain to the latest accumulator (self-check target).
+    let accumulator = input.accumulatorFrom ?? [];
+    for (const p of links) {
+        accumulator = await computeCheckpointAccumulator(p, accumulator);
+    }
+    const aLatest = accumulator;
+    // Cross-check the fold against the checkpoint we are borrowing from (F1): the
+    // folded accumulator must have the structural peak count for the sealed size
+    // AND match the number of pre-signed peak receipts the checkpoint carries.
+    // (The cryptographic peak↔signature tie is enforced by downstream verify;
+    // freshen holds no key.)
+    const structuralPeaks = peakMMRIndexes(sealedSize - 1n).length;
+    if (aLatest.length !== structuralPeaks) {
+        throw new Error(`folded accumulator has ${aLatest.length} peaks; sealed size ${sealedSize} requires ${structuralPeaks}`);
+    }
+    if (!latest.peakReceipts) {
+        throw new Error("latest checkpoint carries no pre-signed peak receipts (label -65931)");
+    }
+    if (latest.peakReceipts.length !== aLatest.length) {
+        throw new Error(`checkpoint carries ${latest.peakReceipts.length} peak receipts but the folded accumulator has ${aLatest.length} peaks — chain does not match this checkpoint`);
+    }
+    // Assemble the leaf's inclusion path at the latest size from index-addressed
+    // node values: the old receipt path (leaf → old peak, a prefix by MMR
+    // prefix-composability) + the consistency proofs (the climb extension).
+    const fullIndices = inclusionProofPath(sealedSize - 1n, leafMmrIndex);
+    if (fullIndices.length < oldPath.length) {
+        throw new Error("receipt path is longer than the latest inclusion path — stale/forged receipt");
+    }
+    const store = new Map();
+    for (let k = 0; k < oldPath.length; k++) {
+        store.set(fullIndices[k], oldPath[k]);
+    }
+    for (const link of links) {
+        const fromPeaks = peakMMRIndexes(link.treeSize1 - 1n);
+        fromPeaks.forEach((peakIndex, j) => {
+            const climb = link.paths[j];
+            if (climb === undefined)
+                return;
+            const climbIndices = inclusionProofPath(link.treeSize2 - 1n, peakIndex);
+            climbIndices.forEach((ix, e) => {
+                const v = climb[e];
+                if (v !== undefined)
+                    store.set(ix, v);
+            });
+        });
+    }
+    const freshPath = fullIndices.map((ix) => {
+        const v = store.get(ix);
+        if (v === undefined) {
+            throw new Error(`checkpoint chain does not cover the extension node at ${ix} — supply the full chain from the receipt's era`);
+        }
+        return v;
+    });
+    // Self-check: the fresh path must recompute the covering peak of the latest
+    // accumulator. Fails closed rather than emitting a bad receipt.
+    const hasher = new SubtleHasher();
+    const root = await calculateRoot(hasher, input.leafValue, { path: freshPath, mmrIndex: leafMmrIndex }, leafMmrIndex);
+    const peakIdx = peakIndexForLeafProof(sealedSize, freshPath.length);
+    if (peakIdx >= aLatest.length || !bytesEqual(root, aLatest[peakIdx])) {
+        throw new Error("freshened path does not recompute the latest accumulator peak — chain/leaf mismatch");
+    }
+    const receipt = assembleReceiptFromProof(latest, leafMmrIndex, freshPath);
+    return { receipt, sealedSize };
+}

package/dist/index.d.ts

@@ -5,7 +5,10 @@ export type { VerifyGrantReceiptOfflineInput } from "./verify-grant-receipt-offl
 export type { VerifyReceiptOfflineInput } from "./verify-grant-receipt-offline.js";
 export { parseReceipt } from "./parse-receipt.js";
 export type { BuildReceiptOfflineInput, ComputedAccumulatorPeak, MassifNodeStore, ParsedCheckpoint, } from "./build-receipt-offline.js";
-export { buildReceiptOffline, computeAccumulatorPeak, openMassifNodeStore, parseCheckpoint, } from "./build-receipt-offline.js";
+export { assembleReceiptFromProof, buildReceiptOffline, computeAccumulatorPeak, openMassifNodeStore, parseCheckpoint, } from "./build-receipt-offline.js";
+/** Freshen a stale receipt to the latest sealed state, tile-free (FOR-418). */
+export { freshenReceipt } from "./freshen-receipt.js";
+export type { FreshenReceiptInput, FreshenReceiptResult, } from "./freshen-receipt.js";
 /**
  * MMR proof math now lives in @forestrie/merklelog (plan-2607-15 §4 hoist);
  * re-exported here to preserve the receipt-verify public surface.

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,oFAAoF;AACpF,YAAY,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,YAAY,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AACxF,YAAY,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EACV,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,GAChB,MAAM,4BAA4B,CAAC;AACpC;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE;;;;GAIG;AACH,OAAO,EACL,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACV,sCAAsC,EACtC,iCAAiC,GAClC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,YAAY,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,yEAAyE;AACzE,OAAO,EAAE,qCAAqC,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE3E,0EAA0E;AAC1E,OAAO,EACL,cAAc,EACd,iDAAiD,GAClD,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC7E,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,6EAA6E;AAC7E,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,oEAAoE;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,8EAA8E;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,4BAA4B,EAC5B,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,GAChC,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,oFAAoF;AACpF,YAAY,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,YAAY,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AACxF,YAAY,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EACV,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,GAChB,MAAM,4BAA4B,CAAC;AACpC,+EAA+E;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EACV,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE;;;;GAIG;AACH,OAAO,EACL,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACV,sCAAsC,EACtC,iCAAiC,GAClC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,YAAY,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,yEAAyE;AACzE,OAAO,EAAE,qCAAqC,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE3E,0EAA0E;AAC1E,OAAO,EACL,cAAc,EACd,iDAAiD,GAClD,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC7E,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,6EAA6E;AAC7E,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,oEAAoE;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,8EAA8E;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,4BAA4B,EAC5B,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,GAChC,MAAM,uBAAuB,CAAC"}

package/dist/index.js

@@ -1,5 +1,7 @@
 export { parseReceipt } from "./parse-receipt.js";
-export { buildReceiptOffline, computeAccumulatorPeak, openMassifNodeStore, parseCheckpoint, } from "./build-receipt-offline.js";
+export { assembleReceiptFromProof, buildReceiptOffline, computeAccumulatorPeak, openMassifNodeStore, parseCheckpoint, } from "./build-receipt-offline.js";
+/** Freshen a stale receipt to the latest sealed state, tile-free (FOR-418). */
+export { freshenReceipt } from "./freshen-receipt.js";
 /**
  * MMR proof math now lives in @forestrie/merklelog (plan-2607-15 §4 hoist);
  * re-exported here to preserve the receipt-verify public surface.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forestrie/receipt-verify",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "license": "MIT",
   "type": "module",
   "description": "Offline SCITT grant receipt verification (ADR-0045)",
@@ -29,7 +29,7 @@
   "dependencies": {
     "@noble/hashes": "^1.7.1",
     "@forestrie/encoding": "0.5.0",
-    "@forestrie/merklelog": "0.2.0"
+    "@forestrie/merklelog": "0.3.0"
   },
   "devDependencies": {
     "esbuild": "^0.24.0",

package/src/build-receipt-offline.ts

@@ -137,7 +137,32 @@ export function buildReceiptOffline(
   }
 
   const proof = inclusionProof(store.get, mmrLastIndex, mmrIndex);
-  const peakIdx = peakIndexForLeafProof(mmrSize, proof.length);
+  return assembleReceiptFromProof(checkpoint, mmrIndex, proof);
+}
+
+/**
+ * Assemble a receipt from a checkpoint's pre-signed peak receipt and a
+ * caller-supplied inclusion `proof` for `mmrIndex`: pick the peak receipt the
+ * proof roots to, attach the proof at header 396 and copy the label-1000
+ * delegation cert. The checkpoint signature covers only the accumulator (peak),
+ * so the unprotected 396 header is free to carry the path — this is why a path
+ * from ANY source (massif tiles here; a tile-free consistency-proof extension in
+ * `freshenReceipt`) yields a `verify --genesis`-equivalent native receipt.
+ */
+export function assembleReceiptFromProof(
+  checkpoint: ParsedCheckpoint,
+  mmrIndex: bigint,
+  proof: Uint8Array[],
+): Uint8Array {
+  if (checkpoint.mmrSize === null || checkpoint.mmrSize <= 0n) {
+    throw new Error("checkpoint carries no sealed size");
+  }
+  if (!checkpoint.peakReceipts) {
+    throw new Error(
+      "checkpoint carries no pre-signed peak receipts (label -65931)",
+    );
+  }
+  const peakIdx = peakIndexForLeafProof(checkpoint.mmrSize, proof.length);
   const receiptBytes = checkpoint.peakReceipts[peakIdx];
   if (!(receiptBytes instanceof Uint8Array)) {
     throw new Error(

package/src/checkpoint-chain.ts

@@ -38,14 +38,26 @@ export type CheckpointConsistencyProof = {
 };
 
 function asBigint(v: unknown, what: string): bigint {
-  if (typeof v === "bigint") return v;
-  if (typeof v === "number" && Number.isSafeInteger(v)) return BigInt(v);
+  // Unsigned only: a negative size flows into `peakMMRIndexes`, whose
+  // `posHeight` spins forever on a non-positive argument — a malformed `.sth`
+  // must be rejected in bounded time, before any such call (FOR-414).
+  if (typeof v === "bigint") {
+    if (v < 0n)
+      throw new Error(`${what}: must be an unsigned integer, got ${v}`);
+    return v;
+  }
+  if (typeof v === "number" && Number.isSafeInteger(v) && v >= 0) {
+    return BigInt(v);
+  }
   throw new Error(`${what}: expected an unsigned integer`);
 }
 
 function asBytesArray(v: unknown, what: string): Uint8Array[] {
-  if (!Array.isArray(v) || v.some((e) => !(e instanceof Uint8Array))) {
-    throw new Error(`${what}: expected an array of byte strings`);
+  if (
+    !Array.isArray(v) ||
+    v.some((e) => !(e instanceof Uint8Array) || e.length !== 32)
+  ) {
+    throw new Error(`${what}: expected an array of 32-byte strings`);
   }
   return v as Uint8Array[];
 }
@@ -80,9 +92,21 @@ export function checkpointConsistencyProof(
   ) {
     throw new Error("consistency paths must be arrays of byte strings");
   }
+  const treeSize1 = asBigint(proof[0], "tree-size-1");
+  const treeSize2 = asBigint(proof[1], "tree-size-2");
+  // A consistency proof strictly grows the tree; enforce `0 <= ts1 < ts2`
+  // (ts1 == 0 is a legitimate base-0 first link). This is the primary guard
+  // that keeps `treeSize2 - 1` / `treeSize1 - 1` non-negative before they
+  // reach `peakMMRIndexes` (FOR-414); the unsigned check in `asBigint` and
+  // the `posHeight` guard in @forestrie/merklelog are defence-in-depth.
+  if (treeSize2 <= treeSize1) {
+    throw new Error(
+      `consistency proof must grow the tree: tree-size-1 ${treeSize1} < tree-size-2 ${treeSize2}`,
+    );
+  }
   return {
-    treeSize1: asBigint(proof[0], "tree-size-1"),
-    treeSize2: asBigint(proof[1], "tree-size-2"),
+    treeSize1,
+    treeSize2,
     paths: pathsRaw as Uint8Array[][],
     rightPeaks: asBytesArray(proof[3], "right-peaks"),
   };

package/src/freshen-receipt.ts

@@ -0,0 +1,242 @@
+/**
+ * Freshen a stale receipt (FOR-418 Phase 3, plan-2607-32).
+ *
+ * A receipt goes stale when log growth buries the peak it commits to. Freshening
+ * re-anchors it to the CURRENT sealed state without tiles: extend the leaf's
+ * inclusion path from its old peak up to the latest accumulator using the
+ * checkpoint chain's consistency proofs (the tile-free source of the climb
+ * nodes), then attach that fresh path at header 396 to the LATEST checkpoint's
+ * pre-signed peak receipt. The result is a native receipt that verifies with
+ * plain `verify --genesis` against the current state — the latest checkpoint
+ * carries the genesis-verifiable delegation cert (see plan-2607-32's Phase 3
+ * finding: the calldata provider supplies the climb material tile-free, but the
+ * signature/cert comes from the latest `.sth`).
+ *
+ * Trust note: the freshened receipt is defined SOLELY by the latest checkpoint —
+ * its label-1000 delegation cert and its pre-signed peak receipt. Owner-rooting
+ * is established by the verify step's trust anchor: `verify --genesis` rejects a
+ * cert whose delegator is not the genesis owner (a hard failure, not a warning).
+ * A rotation of the delegated-TO sealer key is routine and within the owner's
+ * authority, so freshen does NOT flag it — there is no signer-change gate (this
+ * supersedes the earlier `--allow-new-signer` sketch; see the plan-2607-32 F2
+ * note). The old receipt's cert is irrelevant to the emitted artifact.
+ *
+ * Two independent fail-closed guards keep a bad assembly from ever minting:
+ *  - Cross-checks against the checkpoint being borrowed from: the supplied
+ *    chain must reach the checkpoint's sealed size and fold to exactly the
+ *    number of peaks the checkpoint pre-signed (freshen holds no signing key, so
+ *    the cryptographic peak↔signature tie stays with downstream verify; these
+ *    structural checks turn a chain/checkpoint mismatch into a mint-time error
+ *    instead of an unverifiable receipt).
+ *  - The path self-check: `calculateRoot(leaf, freshPath)` must equal the
+ *    covering peak of the folded latest accumulator.
+ *
+ * The climb arithmetic is `@forestrie/merklelog`'s `inclusionProofPath` (a
+ * tested go-merklelog port); this module only assembles node values by index
+ * from the old receipt path + the consistency proofs.
+ */
+import {
+  calculateRoot,
+  inclusionProofPath,
+  peakIndexForLeafProof,
+  peakMMRIndexes,
+} from "@forestrie/merklelog";
+import {
+  assembleReceiptFromProof,
+  parseCheckpoint,
+} from "./build-receipt-offline.js";
+import {
+  computeCheckpointAccumulator,
+  type CheckpointConsistencyProof,
+} from "./checkpoint-chain.js";
+import { parseReceipt } from "./parse-receipt.js";
+import { SubtleHasher } from "./subtle-hasher.js";
+
+export type FreshenReceiptInput = {
+  /** The stale receipt (COSE Sign1 with a 396 inclusion proof). */
+  oldReceiptBytes: Uint8Array;
+  /** The leaf's committed value: `SHA-256(idtimestamp ‖ inner)` — the same
+   * value `verify` recomputes from the entry (caller derives it). */
+  leafValue: Uint8Array;
+  /** Consistency-proof chain covering [0 or a trusted seed] → the latest sealed
+   * size, in ascending contiguous order (the raw per-checkpoint proofs, with
+   * `paths`). The chain's last link must end at the checkpoint's sealed size. */
+  consistencyProofs: readonly CheckpointConsistencyProof[];
+  /** Trusted accumulator seed for a suffix chain; omit for a chain from base 0.
+   * Its peak count must match the first link's tree-size-1. */
+  accumulatorFrom?: Uint8Array[];
+  /** The latest checkpoint (`.sth`): its pre-signed peak receipts + delegation
+   * cert become the freshened receipt's signature. */
+  latestCheckpointBytes: Uint8Array;
+};
+
+export type FreshenReceiptResult = {
+  /** The freshened native receipt (verifies against the latest state). */
+  receipt: Uint8Array;
+  /** Sealed size the freshened receipt is anchored at. */
+  sealedSize: bigint;
+};
+
+function bytesEqual(a: Uint8Array, b: Uint8Array): boolean {
+  if (a.length !== b.length) return false;
+  let x = 0;
+  for (let i = 0; i < a.length; i++) x |= a[i]! ^ b[i]!;
+  return x === 0;
+}
+
+/**
+ * Freshen a stale receipt to the latest sealed state. Throws if the chain is
+ * not a contiguous cover from the trusted base to the checkpoint's sealed size,
+ * if a climb node is missing from the supplied proofs, or if the recomputed
+ * peak does not match the folded latest accumulator.
+ */
+export async function freshenReceipt(
+  input: FreshenReceiptInput,
+): Promise<FreshenReceiptResult> {
+  const { proof } = parseReceipt(input.oldReceiptBytes);
+  // `parseReceipt` addresses the leaf by MMR index (396 proof entry key 1);
+  // `inclusionProofPath` below needs exactly that MMR index. (`Proof.leafIndex`
+  // is a distinct leaf-ordinal field that parseReceipt never sets — do not use
+  // it here, or a future producer that populated it would feed a non-MMR-index
+  // into the climb.)
+  const leafMmrIndex = proof.mmrIndex;
+  if (leafMmrIndex === undefined) {
+    throw new Error("receipt inclusion proof carries no mmr index");
+  }
+  const oldPath = proof.path;
+
+  const latest = parseCheckpoint(input.latestCheckpointBytes);
+  if (latest.mmrSize === null || latest.mmrSize <= 0n) {
+    throw new Error("latest checkpoint carries no sealed size");
+  }
+  const sealedSize = latest.mmrSize;
+  if (leafMmrIndex >= sealedSize) {
+    throw new Error(
+      `receipt entry ${leafMmrIndex} is newer than the latest sealed size ${sealedSize}`,
+    );
+  }
+
+  // --- validate the supplied chain shape before folding (F5) ---
+  const links = input.consistencyProofs;
+  if (links.length === 0) {
+    throw new Error(
+      "freshen requires at least one consistency proof linking the receipt's era to the checkpoint",
+    );
+  }
+  const firstLink = links[0]!;
+  // Base: a base-0 chain starts from an empty accumulator; a suffix chain's
+  // trusted seed must have the peak count of its tree-size-1.
+  const baseCount = input.accumulatorFrom?.length ?? 0;
+  if (firstLink.treeSize1 === 0n) {
+    if (baseCount !== 0) {
+      throw new Error(
+        "base-0 consistency chain must start from an empty accumulator seed",
+      );
+    }
+  } else {
+    const wanted = peakMMRIndexes(firstLink.treeSize1 - 1n).length;
+    if (baseCount !== wanted) {
+      throw new Error(
+        `base accumulator has ${baseCount} peaks; first link size ${firstLink.treeSize1} requires ${wanted}`,
+      );
+    }
+  }
+  // Contiguity: each link continues where the previous one sealed.
+  for (let i = 1; i < links.length; i++) {
+    if (links[i]!.treeSize1 !== links[i - 1]!.treeSize2) {
+      throw new Error(
+        `consistency chain is not contiguous at link ${i}: base ${links[i]!.treeSize1} != previous sealed size ${links[i - 1]!.treeSize2}`,
+      );
+    }
+  }
+  // Endpoint: the chain must reach exactly the checkpoint's sealed size (F1).
+  const lastLink = links[links.length - 1]!;
+  if (lastLink.treeSize2 !== sealedSize) {
+    throw new Error(
+      `consistency chain ends at size ${lastLink.treeSize2} but the checkpoint sealed size ${sealedSize}`,
+    );
+  }
+
+  // Fold the chain to the latest accumulator (self-check target).
+  let accumulator = input.accumulatorFrom ?? [];
+  for (const p of links) {
+    accumulator = await computeCheckpointAccumulator(p, accumulator);
+  }
+  const aLatest = accumulator;
+
+  // Cross-check the fold against the checkpoint we are borrowing from (F1): the
+  // folded accumulator must have the structural peak count for the sealed size
+  // AND match the number of pre-signed peak receipts the checkpoint carries.
+  // (The cryptographic peak↔signature tie is enforced by downstream verify;
+  // freshen holds no key.)
+  const structuralPeaks = peakMMRIndexes(sealedSize - 1n).length;
+  if (aLatest.length !== structuralPeaks) {
+    throw new Error(
+      `folded accumulator has ${aLatest.length} peaks; sealed size ${sealedSize} requires ${structuralPeaks}`,
+    );
+  }
+  if (!latest.peakReceipts) {
+    throw new Error(
+      "latest checkpoint carries no pre-signed peak receipts (label -65931)",
+    );
+  }
+  if (latest.peakReceipts.length !== aLatest.length) {
+    throw new Error(
+      `checkpoint carries ${latest.peakReceipts.length} peak receipts but the folded accumulator has ${aLatest.length} peaks — chain does not match this checkpoint`,
+    );
+  }
+
+  // Assemble the leaf's inclusion path at the latest size from index-addressed
+  // node values: the old receipt path (leaf → old peak, a prefix by MMR
+  // prefix-composability) + the consistency proofs (the climb extension).
+  const fullIndices = inclusionProofPath(sealedSize - 1n, leafMmrIndex);
+  if (fullIndices.length < oldPath.length) {
+    throw new Error(
+      "receipt path is longer than the latest inclusion path — stale/forged receipt",
+    );
+  }
+  const store = new Map<bigint, Uint8Array>();
+  for (let k = 0; k < oldPath.length; k++) {
+    store.set(fullIndices[k]!, oldPath[k]!);
+  }
+  for (const link of links) {
+    const fromPeaks = peakMMRIndexes(link.treeSize1 - 1n);
+    fromPeaks.forEach((peakIndex, j) => {
+      const climb = link.paths[j];
+      if (climb === undefined) return;
+      const climbIndices = inclusionProofPath(link.treeSize2 - 1n, peakIndex);
+      climbIndices.forEach((ix, e) => {
+        const v = climb[e];
+        if (v !== undefined) store.set(ix, v);
+      });
+    });
+  }
+  const freshPath = fullIndices.map((ix) => {
+    const v = store.get(ix);
+    if (v === undefined) {
+      throw new Error(
+        `checkpoint chain does not cover the extension node at ${ix} — supply the full chain from the receipt's era`,
+      );
+    }
+    return v;
+  });
+
+  // Self-check: the fresh path must recompute the covering peak of the latest
+  // accumulator. Fails closed rather than emitting a bad receipt.
+  const hasher = new SubtleHasher();
+  const root = await calculateRoot(
+    hasher,
+    input.leafValue,
+    { path: freshPath, mmrIndex: leafMmrIndex },
+    leafMmrIndex,
+  );
+  const peakIdx = peakIndexForLeafProof(sealedSize, freshPath.length);
+  if (peakIdx >= aLatest.length || !bytesEqual(root, aLatest[peakIdx]!)) {
+    throw new Error(
+      "freshened path does not recompute the latest accumulator peak — chain/leaf mismatch",
+    );
+  }
+
+  const receipt = assembleReceiptFromProof(latest, leafMmrIndex, freshPath);
+  return { receipt, sealedSize };
+}

package/src/index.ts

@@ -14,11 +14,18 @@ export type {
   ParsedCheckpoint,
 } from "./build-receipt-offline.js";
 export {
+  assembleReceiptFromProof,
   buildReceiptOffline,
   computeAccumulatorPeak,
   openMassifNodeStore,
   parseCheckpoint,
 } from "./build-receipt-offline.js";
+/** Freshen a stale receipt to the latest sealed state, tile-free (FOR-418). */
+export { freshenReceipt } from "./freshen-receipt.js";
+export type {
+  FreshenReceiptInput,
+  FreshenReceiptResult,
+} from "./freshen-receipt.js";
 /**
  * MMR proof math now lives in @forestrie/merklelog (plan-2607-15 §4 hoist);
  * re-exported here to preserve the receipt-verify public surface.