@integraledger/lcp-binding-evm-mpp 0.9.0 → 0.10.2

package/CHANGELOG.md

@@ -1,5 +1,75 @@
 # @integraledger/lcp-binding-evm-mpp
 
+## 0.10.2
+
+### Patch Changes
+
+- b2ffecc: Report the class a record actually supports, place a terms URL on UCP, and stop refusing a conformant UCP
+  profile — the remediation of the 2026-08-19 conformance re-audit.
+
+  **`verify` now computes `supportedClass` instead of echoing the claim.** It was `anyFailed ? "TC-0" :
+claimedClass`, so a record proving nothing — no settlement, no acceptance, no authority chain — reported
+  whatever class the caller named, while the field's own published docblock promised "what the record
+  honestly supports, not what the caller asked for". It is now the highest class every one of whose required
+  steps is `proved`, `TC-0` on any failure, computed from the steps alone: neither capped by the claim (rungs
+  that reach TC-3 read TC-3 where the caller claimed TC-2) nor lifted by it. White paper #4 §5 defines the
+  class of a transaction as "the highest class whose criteria it fully meets", and this is that.
+
+  The claim is not discarded — the report gains **`claimedClass`**, a required member, because `verified`
+  answers "did the record reach the class it claimed?" and cannot be read without it. The two fields are the
+  report's two halves: an input echoed, and a finding computed. Where they differ, the record did not reach
+  its own shape. An out-of-taxonomy claim now lands only in the echo and can no longer masquerade as a
+  finding.
+
+  **UCP can advertise a terms URL.** Its policy object declares `url` — "Optional link to the full policy
+  document", `format: uri` — on the very entry this placement writes, and §C.3's illustration carries `url`
+  and `atrHash` side by side there. The manifest previously said the protocol had no slot, citing `links[]`,
+  which §C.3 separates as "a standing page, not a per-transaction record". The obstacle was mechanical:
+  `termsUrlFields` addresses document paths, and a tagged-array entry's index is chosen at write time. The
+  `tagged-array` container therefore gains `termsUrlField`, written onto the same entry in the same write, and
+  read back through the same first-match rule. UCP was the last shipped protocol that refused an
+  advertisement carrying its own locator (integra-protocol#8).
+
+  **`readUcpProfile` no longer refuses a conformant business profile.** `requireHttps` mapped an ABSENT `spec`
+  to the same branch as a malformed one, and the live host requires `spec` only of a platform declaration —
+  as this repository's own README already said. It is now `requireHttpsIfDeclared`: absence is absence, and a
+  declared value is still held to the host's https MUST.
+
+  Also: `requireWritten` replaces an unchecked cast in the x402 override, so a broken postcondition throws
+  instead of returning a success carrying no document; six x402 citations move to the revision that actually
+  touches the file they name, and a new gate refuses any `owner/repo@sha` in source that `spec-pins.json` does
+  not record; four spec citations move from line anchors to section anchors; the escrow binding states why it
+  declares no §8.3.1 off-canonical variant, and asserts it; and §C.3's `policies[]` illustration is recorded as
+  invalid against the live UCP schema, which shows `description` as a bare string where the host requires an
+  object — owed upstream, not a defect here.
+
+  Corpus 844 → 847, root `ec4ad1b02a81538b…`.
+
+- Updated dependencies [b2ffecc]
+- Updated dependencies [822190a]
+  - @integraledger/lcp-binding-core@0.11.0
+  - @integraledger/lcp-binding-evm-common@0.10.2
+  - @integraledger/lcp-kernel@0.11.0
+
+## 0.10.1
+
+**0.10.0 was staged and withdrawn before approval; this is that release, re-cut.** The conformance corpus
+was re-sealed after 0.10.0 was staged — its root moved `32fa90a6…` → `28bbf4ef…` when the vector tree was
+brought inside the prose gates — so the staged `lcp-conformance` tarball carried a seal that no longer
+matched the repository. The seal is what proves corpus authenticity to an independent implementer, and a
+published version cannot be replaced, so the whole set was rejected and re-cut rather than shipping one
+package that disagreed with its own source. No version 0.10.0 exists on the registry.
+
+Released as part of a flat `0.10.1` across the whole suite. One number describes the set that was built,
+tested and sealed together, so a consumer never has to work out which combination of versions was verified.
+
+This package has no source change of its own in this release. What moved across the suite: three exported
+names were corrected before anyone depends on them — `USDC_DECIMALS` became rail-qualified after it was
+found to mean 6 on three rails and 7 on Stellar under one name, `VISA_TAP_PLACEMENT_TIER_A` lost the tier
+it had baked into an identifier, and the memo codecs were named for the carrier they encode. Two wire
+identities were respelled to match the vocabulary they are written into. Five gates were added or widened,
+and a large number of documentation claims were corrected against the host specifications at HEAD.
+
 ## 0.9.0
 
 First public release.

package/README.md

@@ -83,7 +83,8 @@ Read against the host protocol's own live specifications, not LCP's Appendix C.
 
 **Two drifts found, recorded rather than smoothed over.**
 
-- **The core draft's identifier.** LCP v1.37 §C.1 and the completion plan both cite
+- **The core draft's identifier.** (Discharged: v1.38 §C.1 now records both identities and cites
+  `draft-httpauth-payment-00` as the family's own publication.) LCP v1.37 §C.1 cited
   `draft-ryan-httpauth-payment-01` (the IETF individual submission). paymentauth.org's own document index
   publishes the core scheme as **`draft-httpauth-payment-00.html`**. Both were read for this gate; they agree
   on §5.1.1 and on the seven slots. Treat the paymentauth.org copy as the live one — it is the family's own
@@ -168,7 +169,8 @@ from it, never occupied by it.
 ## Provenance
 
 Cut against `draft-evm-charge-00` and the core `Payment` scheme at paymentauth.org, gate discharged
-2026-07-30, and reconciled against LCP v1.37 §C.1 and §8.3.5 the same day. The derivation oracles in
+2026-07-30, and reconciled against LCP v1.37 §C.1 and §8.3.5 the same day; re-read against **v1.38 §C.1** on
+2026-08-12, which adopted the identifier finding below. The derivation oracles in
 `vectors/binding/mpp-evm-id-reuse.json` were produced by two independent keccak-256 implementations
 (pycryptodome and Foundry `cast keccak`), and `abi.encodePacked`'s string semantics were confirmed against
 Foundry's own encoder — neither of them the implementation under test.

package/dist/id-reuse.d.ts

@@ -13,8 +13,8 @@
  *
  * **WHAT MAKES THAT SOUND IS NOT UNIQUENESS, AND AN EARLIER DOCBLOCK SAID IT WAS.** It argued that MPP's
  * "Unique challenge identifier" requirement (`draft-httpauth-payment` §5.1.1) was satisfied by making each
- * ATR unique per transaction. Every citation in it was exact; the sufficiency was not. LCP v1.38 §C.1
- * (:1282-1289):
+ * ATR unique per transaction. Every citation in it was exact; the sufficiency was not. LCP v1.38 §C.1,
+ * under "Id-Reuse on MPP-EVM, and its limit":
  *
  * > **It is not simply available, and §8.3.5's uniqueness advice is not sufficient for it.** MPP requires
  * > the server to bind the challenge `id` *to the challenge parameters* … expressly to prevent a client
@@ -37,7 +37,8 @@
  * its challenge-binding section. §C.1 names that inconsistency rather than resolving it, and so does this.
  *
  * **Zero-party-recoverable on-chain binding on this rail still requires an Overlay Contract per §8.3.2**
- * (§C.1:1289). Nothing here recovers an atrHash, and nothing may be added that does — see the closing note.
+ * (§C.1's own closing sentence under "Id-Reuse on MPP-EVM, and its limit"). Nothing here recovers an
+ * atrHash, and nothing may be added that does — see the closing note.
  *
  * **`abi.encodePacked` over two strings is raw UTF-8 concatenation** — no length prefix, no padding. That was
  * confirmed against Foundry's own encoder rather than assumed, and every oracle in

package/dist/id-reuse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"id-reuse.d.ts","sourceRoot":"","sources":["../src/id-reuse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,iCAAiC,CAAC;AAExE,OAAO,EAAU,KAAK,GAAG,EAA4B,MAAM,MAAM,CAAC;AAKlE,oGAAoG;AACpG,MAAM,WAAW,sBAAsB;IACrC,uFAAuF;IACvF,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC;IAC1B,mFAAmF;IACnF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,mGAAmG;IACnG,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC;CACrB;AAED,yGAAyG;AACzG,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC;IACtB,kGAAkG;IAClG,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,mDAAmD;IACnD,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,GAAG,CAU3E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GACZ,sBAAsB,CAOxB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,cAAc,EAAE,SAAS,MAAM,EAAE,GAChC,OAAO,CAAC,2BAA2B,CAAC,CAsCtC;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,IAAI,OAAO,CAQtD"}
+{"version":3,"file":"id-reuse.d.ts","sourceRoot":"","sources":["../src/id-reuse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,iCAAiC,CAAC;AAExE,OAAO,EAAU,KAAK,GAAG,EAA4B,MAAM,MAAM,CAAC;AAKlE,oGAAoG;AACpG,MAAM,WAAW,sBAAsB;IACrC,uFAAuF;IACvF,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC;IAC1B,mFAAmF;IACnF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,mGAAmG;IACnG,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC;CACrB;AAED,yGAAyG;AACzG,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC;IACtB,kGAAkG;IAClG,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,mDAAmD;IACnD,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,GAAG,CAU3E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GACZ,sBAAsB,CAOxB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,cAAc,EAAE,SAAS,MAAM,EAAE,GAChC,OAAO,CAAC,2BAA2B,CAAC,CAsCtC;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,IAAI,OAAO,CAQtD"}

package/dist/id-reuse.js

@@ -13,8 +13,8 @@
  *
  * **WHAT MAKES THAT SOUND IS NOT UNIQUENESS, AND AN EARLIER DOCBLOCK SAID IT WAS.** It argued that MPP's
  * "Unique challenge identifier" requirement (`draft-httpauth-payment` §5.1.1) was satisfied by making each
- * ATR unique per transaction. Every citation in it was exact; the sufficiency was not. LCP v1.38 §C.1
- * (:1282-1289):
+ * ATR unique per transaction. Every citation in it was exact; the sufficiency was not. LCP v1.38 §C.1,
+ * under "Id-Reuse on MPP-EVM, and its limit":
  *
  * > **It is not simply available, and §8.3.5's uniqueness advice is not sufficient for it.** MPP requires
  * > the server to bind the challenge `id` *to the challenge parameters* … expressly to prevent a client
@@ -37,7 +37,8 @@
  * its challenge-binding section. §C.1 names that inconsistency rather than resolving it, and so does this.
  *
  * **Zero-party-recoverable on-chain binding on this rail still requires an Overlay Contract per §8.3.2**
- * (§C.1:1289). Nothing here recovers an atrHash, and nothing may be added that does — see the closing note.
+ * (§C.1's own closing sentence under "Id-Reuse on MPP-EVM, and its limit"). Nothing here recovers an
+ * atrHash, and nothing may be added that does — see the closing note.
  *
  * **`abi.encodePacked` over two strings is raw UTF-8 concatenation** — no length prefix, no padding. That was
  * confirmed against Foundry's own encoder rather than assumed, and every oracle in

package/dist/id-reuse.js.map

@@ -1 +1 @@
-{"version":3,"file":"id-reuse.js","sourceRoot":"","sources":["../src/id-reuse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAY,SAAS,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAElE,iGAAiG;AACjG,MAAM,OAAO,GAAG,qBAAqB,CAAC;AAuBtC;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAmB,EAAE,KAAa;IACpE,IAAI,WAAW,KAAK,EAAE;QACpB,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;IACJ,IAAI,KAAK,KAAK,EAAE;QACd,MAAM,IAAI,KAAK,CACb,wHAAwH,CACzH,CAAC;IACJ,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CACzB,OAAe,EACf,KAAa;IAEb,MAAM,WAAW,GAAG,gBAAgB,CAClC,OAAO,EACP,aAAa,EACb,iIAAiI,CAC3H,CAAC;IACT,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC;AAChF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAe,EACf,KAAa,EACb,cAAiC;IAEjC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QACxB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,sBAAsB;YACjC,IAAI,EAAE,6BAA6B;YACnC,MAAM,EAAE,gGAAgG,OAAO,GAAG;SACnH,CAAC;IACJ,KAAK,MAAM,QAAQ,IAAI,cAAc;QACnC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;YACzB,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,sBAAsB;gBACjC,IAAI,EAAE,yBAAyB;gBAC/B,MAAM,EAAE,wEAAwE,QAAQ,GAAG;aAC5F,CAAC;IACN,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAC7B,OAAO;YACL,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,sBAAsB;YACjC,IAAI,EAAE,6BAA6B;YACnC,MAAM,EACJ,2GAA2G;SAC9G,CAAC;IACJ,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,CAAQ,CAAC;IACrE,MAAM,KAAK,GAAG,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;IACtE,IAAI,OAAO,KAAK,SAAS;QACvB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,sBAAsB;YACjC,IAAI,EAAE,4BAA4B;YAClC,MAAM,EAAE,8CAA8C,SAAS,OAAO,KAAK,SAAS,KAAK,EAAE;SAC5F,CAAC;IACJ,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE;KAC7D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B;IAC1C,OAAO;QACL,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,sBAAsB;QACjC,IAAI,EAAE,yCAAyC;QAC/C,MAAM,EACJ,8NAA8N;KACjO,CAAC;AACJ,CAAC"}
+{"version":3,"file":"id-reuse.js","sourceRoot":"","sources":["../src/id-reuse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAY,SAAS,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAElE,iGAAiG;AACjG,MAAM,OAAO,GAAG,qBAAqB,CAAC;AAuBtC;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAmB,EAAE,KAAa;IACpE,IAAI,WAAW,KAAK,EAAE;QACpB,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;IACJ,IAAI,KAAK,KAAK,EAAE;QACd,MAAM,IAAI,KAAK,CACb,wHAAwH,CACzH,CAAC;IACJ,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CACzB,OAAe,EACf,KAAa;IAEb,MAAM,WAAW,GAAG,gBAAgB,CAClC,OAAO,EACP,aAAa,EACb,iIAAiI,CAC3H,CAAC;IACT,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC;AAChF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAe,EACf,KAAa,EACb,cAAiC;IAEjC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QACxB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,sBAAsB;YACjC,IAAI,EAAE,6BAA6B;YACnC,MAAM,EAAE,gGAAgG,OAAO,GAAG;SACnH,CAAC;IACJ,KAAK,MAAM,QAAQ,IAAI,cAAc;QACnC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;YACzB,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,sBAAsB;gBACjC,IAAI,EAAE,yBAAyB;gBAC/B,MAAM,EAAE,wEAAwE,QAAQ,GAAG;aAC5F,CAAC;IACN,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAC7B,OAAO;YACL,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,sBAAsB;YACjC,IAAI,EAAE,6BAA6B;YACnC,MAAM,EACJ,2GAA2G;SAC9G,CAAC;IACJ,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,CAAQ,CAAC;IACrE,MAAM,KAAK,GAAG,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;IACtE,IAAI,OAAO,KAAK,SAAS;QACvB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,sBAAsB;YACjC,IAAI,EAAE,4BAA4B;YAClC,MAAM,EAAE,8CAA8C,SAAS,OAAO,KAAK,SAAS,KAAK,EAAE;SAC5F,CAAC;IACJ,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE;KAC7D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B;IAC1C,OAAO;QACL,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,sBAAsB;QACjC,IAAI,EAAE,yCAAyC;QAC/C,MAAM,EACJ,8NAA8N;KACjO,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integraledger/lcp-binding-evm-mpp",
-  "version": "0.9.0",
+  "version": "0.10.2",
   "description": "Welds an LCP record into an MPP settlement on EVM by Id-Reuse (LCP §8.3.5).",
   "keywords": [
     "lcp",
@@ -43,9 +43,9 @@
   "homepage": "https://github.com/IntegraLedger/integra-protocol/tree/main/packages/binding-evm-mpp#readme",
   "dependencies": {
     "viem": "2.55.11",
-    "@integraledger/lcp-binding-core": "0.9.0",
-    "@integraledger/lcp-binding-evm-common": "0.9.0",
-    "@integraledger/lcp-kernel": "0.9.0"
+    "@integraledger/lcp-binding-core": "0.11.0",
+    "@integraledger/lcp-binding-evm-common": "0.10.2",
+    "@integraledger/lcp-kernel": "0.11.0"
   },
   "devDependencies": {
     "@types/node": "24.13.3",

package/src/id-reuse.ts

@@ -13,8 +13,8 @@
  *
  * **WHAT MAKES THAT SOUND IS NOT UNIQUENESS, AND AN EARLIER DOCBLOCK SAID IT WAS.** It argued that MPP's
  * "Unique challenge identifier" requirement (`draft-httpauth-payment` §5.1.1) was satisfied by making each
- * ATR unique per transaction. Every citation in it was exact; the sufficiency was not. LCP v1.38 §C.1
- * (:1282-1289):
+ * ATR unique per transaction. Every citation in it was exact; the sufficiency was not. LCP v1.38 §C.1,
+ * under "Id-Reuse on MPP-EVM, and its limit":
  *
  * > **It is not simply available, and §8.3.5's uniqueness advice is not sufficient for it.** MPP requires
  * > the server to bind the challenge `id` *to the challenge parameters* … expressly to prevent a client
@@ -37,7 +37,8 @@
  * its challenge-binding section. §C.1 names that inconsistency rather than resolving it, and so does this.
  *
  * **Zero-party-recoverable on-chain binding on this rail still requires an Overlay Contract per §8.3.2**
- * (§C.1:1289). Nothing here recovers an atrHash, and nothing may be added that does — see the closing note.
+ * (§C.1's own closing sentence under "Id-Reuse on MPP-EVM, and its limit"). Nothing here recovers an
+ * atrHash, and nothing may be added that does — see the closing note.
  *
  * **`abi.encodePacked` over two strings is raw UTF-8 concatenation** — no length prefix, no padding. That was
  * confirmed against Foundry's own encoder rather than assumed, and every oracle in