fractal-pqc 0.9.0 → 0.10.0

package/README.md

@@ -124,13 +124,19 @@ The SDK equivalent is `sendP2trKeyPath({ internalPriv, to, amountSats, network,
 
 The quantum protection does **not** come from a cert verifying in isolation (a cert only
 proves whoever built it held both secret keys). It comes from **anchoring**: the holder
-publishes their commitment first-seen and immutably (e.g. an on-chain Merkle leaf) BEFORE
-Q-day, and every verifier **pins that anchored factHash**. `verifySpend`/`verifyMigrationCommitment`
-take `anchoredFactHash` and reject any cert that doesn't match it. Skip the anchor and the
-kit provides no quantum protection — `verifySpend` fails closed rather than pretend otherwise.
-Providing the anchor registry (first-seen, no-duplicate, immutable) is part of the
-grant-funded roadmap below; this reference makes the anchor a **required verifier input**
-so the property is never silently over-claimed.
+publishes their commitment first-seen and immutably in an append-only transparency log
+(RFC 6962) anchored into Bitcoin (OpenTimestamps), and every verifier **pins that anchored
+factHash**. `verifySpend`/`verifyMigrationCommitment` take `anchoredFactHash` and reject any
+cert that doesn't match it. Skip the anchor and the kit provides no quantum protection —
+`verifySpend` fails closed rather than pretend otherwise. The anchor registry itself
+(first-seen, no-duplicate, immutable — `primacy.mjs` + `ots.mjs` + `verify-anchor`) is
+**delivered and published** (see the Roadmap below); this reference makes the anchor a
+**required verifier input** so the property is never silently over-claimed. One honest
+residual: this package can *verify* a `.ots` you already obtained — it has no code to
+*submit* a new digest to an OpenTimestamps calendar server or poll it to Bitcoin
+confirmation. Creating a brand-new anchor today requires an external tool (the reference
+`ots` CLI or the `python-opentimestamps` library); we deliberately don't vendor one, per
+`ots.mjs`'s own "no network" scope.
 
 ## What this is NOT
 
@@ -166,12 +172,16 @@ so the property is never silently over-claimed.
  (honest scope — do not overstate)
 
 - **Not yet confirmed in a live mempool.** The sighash is proven consensus-correct against
-  the official BIP-341 vector, and the broadcaster is built + dry-run-tested — but an actual
-  funded **testnet** broadcast (which needs tBTC from a faucet) is the operator's final step.
-- **Key-path-only (no script tree / merkle root).** `taprootTweakPrivateKey`/`signTaprootKeyPath`
+  the official BIP-341 vector, and both the key-path and script-path (M2) broadcasters are
+  built + dry-run-tested — but an actual funded **testnet** broadcast (which needs tBTC from
+  a faucet) is the operator's final step for either path.
+- **`p2trAddress`'s signer is key-path-only.** `taprootTweakPrivateKey`/`signTaprootKeyPath`
   handle key-path-only outputs — exactly what this kit's `p2trAddress` derives. Pointing the
   signer at a foreign Taproot output that commits to a script tree would produce an invalid
-  signature. Script-path (tapscript) spends ARE implemented and asserted against the official BIP-341 wallet test vectors (7/7 cases, 12/12 control blocks, byte for byte).
+  signature. Script-path (tapscript) *construction* — the policy leaf, control blocks, and the
+  BIP-341 script-path sighash the M2 policy engine signs — IS implemented and asserted against
+  the official BIP-341 wallet test vectors (7/7 cases, 12/12 control blocks, byte for byte);
+  what's missing is the step after the signature, per the point above.
 - **Secrets are not zeroized.** Private-key `Uint8Array`s are not wiped after use (best-effort
   only in JS); `keygen` prints secrets by design (testnet/experimental).
 - **Not a BIP and not consensus.** The "recovery commitment" is an application-layer
@@ -182,24 +192,64 @@ so the property is never silently over-claimed.
 
 ## Roadmap — from reference to real Bitcoin custody tooling (the grant-funded work)
 
-Each milestone is independently verifiable, open-source, and shippable on its own:
+Milestones below match the tranche structure in our funding ask (`letter/galaxy-2026-08-31.md`)
+exactly, so this table and that letter can never quietly drift apart the way this section once
+did. Each milestone is independently verifiable, open-source, and shippable on its own.
 
 1. **Bitcoin address + tx layer** — ✅ *done + vector-verified*: bech32/bech32m (BIP-173/350),
-   P2TR `bc1p…` derivation (BIP-341), segwit tx + txid (genesis-checked), a BIP-341 key-path
-   sighash **matching the official BIP-341 vector byte-for-byte**, **fees + coin selection**,
-   **BIP-174 PSBT** create→sign→finalize, and a **testnet broadcaster** (fetch UTXOs/fees →
-   build+sign → publish; dry-run tested offline) — all permanent tests.
-   **Remaining:** a funded **testnet** broadcast to confirm in a live mempool (needs tBTC),
-   and script-path (tapscript) spends.
-2. **P2QRH-style quantum-resistant output** — a concrete commitment scheme + spending
-   path a custodian can pre-register for held UTXOs, with a reference verifier.
-3. **Custodian migration CLI** — take a real (testnet) UTXO set, emit PQC recovery
-   commitments, and produce the dual-signed migration record; end-to-end on testnet.
-4. **On-chain anchoring** (first-seen, immutable) — anchor recovery commitments as
-   verifiable leaves (reusing FractalAI's Merkle-anchor pipeline) so a holder's migration
-   is publicly provable and pinnable — this is what makes the `verifySpend` anchor real.
-5. **Soft-fork integration analysis** — a PQC security review of candidate Bitcoin
-   quantum proposals at the signature-integration surface.
+   P2TR `bc1p…` derivation (BIP-341), segwit tx + txid (genesis-checked), key-path AND
+   script-path BIP-341 sighashes **matching the official vectors byte-for-byte** (7/7
+   scriptPubKey cases, 12/12 control blocks), **fees + coin selection**, **BIP-174 PSBT**
+   create→sign→finalize (key-path), and a **testnet broadcaster** (fetch UTXOs/fees →
+   build+sign → publish; dry-run tested offline, never yet run against a live network) — all
+   permanent tests.
+
+2. **M1 — Bitcoin-anchored first-seen registry** — ✅ **DELIVERED, published, $0** (see the
+   letter). `primacy.mjs` + `ots.mjs` + `verify-anchor`: an append-only transparency log
+   (RFC 6962), ML-DSA-65-signed heads, first-seen resolution by complete enumeration, and a
+   temporal frontier confirmed against a real Bitcoin block header the verifier supplies —
+   run it yourself, offline, with `npx fractal-pqc verify-anchor`. **Honest residual:** this
+   delivers *verification* of an anchor; it does not deliver *creation* of one. Submitting a
+   new digest to an OpenTimestamps calendar and polling it to Bitcoin confirmation needs an
+   external tool today (the reference `ots` CLI or `python-opentimestamps`) — not vendored
+   here, and not yet documented anywhere outside this README.
+
+3. **M2 — Exposure-relative primacy, in a real custodian's signing flow** (Tranche 1,
+   $120,000/90 days — see the letter for the full scope). The primitive is shipped and
+   enforced in `fractal-pqc@0.9.0`: `policy.mjs`'s `authorizeAndSign` computes the BIP-341
+   sighash itself, requires the prevout to be the coin the holder's anchor governs, and (opt-in
+   via `exposureHeight`) additionally requires the commitment predate the chain first revealing
+   the classical key. **What remains, concretely, is engineering a custodian around that
+   primitive — not the primitive itself:** (a) ✅ *done*, `m2-broadcast.mjs` — rebuilds the
+   witness an `authorizeAndSign` decision actually authorised (never a caller-supplied leaf,
+   which would let someone splice in a different script) and serializes/dry-run-broadcasts it;
+   the Schnorr signature is re-verified independently against a freshly recomputed BIP-342
+   sighash, not against this module's own bookkeeping; (b) ✅ *already done* (round 9,
+   before this roadmap section was last reconciled) — `buildSpendContext` takes `otherInputs`,
+   so a custodian consolidating more than one deposit per holder does not recreate the round-8
+   signing-oracle bug; the holder's independently-derived digest for a real 2-input spend
+   matches the one the engine signs, proven by `R9-holder-can-reproduce-any-digest`; (c) a thin
+   service wrapper (HTTP/RPC, structured audit logging of every authorize/refuse decision,
+   idempotent UTXO handling) around the pure library; (d) a real answer for `policyKey`
+   custody (today a single Schnorr key per custodian — losing or leaking it is custodian-wide,
+   not just holder-wide, and nothing here enforces the `singlePolicyKeyPerHolder` convention
+   callers are trusted to uphold); (e) the funded testnet broadcast itself.
+
+4. **Tranche 2, $80,000 — independent external review, multisig PSBT, key rotation.**
+   External review: scope not yet defined here, tracked separately from the two engineering
+   items. **Multisig PSBT: 0% built.** `psbt.mjs` is single-signer P2TR key-path only; no
+   BIP-174 multisig fields, no k-of-N Tapscript threshold primitive, no multi-leaf
+   `policyLeafScript` — not even listed in this package's own `UNCLAIMED_GUARDS` honesty
+   ledger yet. **Key rotation: confirmed NOT IMPLEMENTED** (`npx fractal-pqc claims --gaps`
+   says so verbatim) — a holder who loses their ML-DSA-65 secret is locked out permanently,
+   by the same first-seen-primacy logic that makes the rest of the design sound. A real fix
+   needs a pre-registered guardian quorum, a distinct anchored entry type for a rotation
+   event, a challenge window measured in confirmed blocks, and a new "current active key"
+   resolver in `policy.mjs` — comparable in scope to the original primacy/policy engine.
+
+5. **Tranche 3, $120,000 — public specification, wallet interoperability, long-term
+   maintenance of the vectors.** Not started; success is measured by independent adopters
+   running the CC0 vectors, not by our own claims.
 
 ## License
 

package/bin/cli.mjs

@@ -237,7 +237,7 @@ switch (cmd) {
   case "selftest": {
     const r = spawnSync(process.execPath, [join(__dirname, "..", "test", "vectors.mjs")], { stdio: "inherit" });
     if ((r.status ?? 1) !== 0) process.exit(r.status ?? 1);
-    for (const f of ["transparency.mjs", "primacy.mjs", "anchoring.mjs", "conformance.mjs", "m2-policy.mjs", "bip341-scriptpath.mjs", "claims.mjs", "demo.mjs", "letter-claims.mjs"]) {
+    for (const f of ["transparency.mjs", "primacy.mjs", "anchoring.mjs", "conformance.mjs", "m2-policy.mjs", "m2-broadcast.mjs", "bip341-scriptpath.mjs", "claims.mjs", "demo.mjs", "letter-claims.mjs"]) {
       const t = spawnSync(process.execPath, [join(__dirname, "..", "test", f)],
         { stdio: "inherit", env: { ...process.env, FRACTAL_SELFTEST_DEPTH: "1" } });
       if ((t.status ?? 1) !== 0) process.exit(t.status ?? 1);
@@ -468,7 +468,7 @@ Usage:
   fractal-pqc verify-letter [file]         Check every factual assertion in our letter
                                            against this package. Exits non-zero if any fails.
   fractal-pqc verify-vector                Check the official BIP-340 test vector
-  fractal-pqc selftest                     Run everything: 331 real checks, no mocks
+  fractal-pqc selftest                     Run everything: 357 real checks, no mocks
 
 Docs: integrations/pqc-migration-kit/README.md`);
     process.exit(cmd ? 1 : 0);

package/letter/galaxy-2026-08-31.md

@@ -37,12 +37,12 @@ I built that tool because of the disease in section 5, and I built it for this l
 specifically. It found three false numbers in my own draft before you saw it.
 
 ```
-npm i fractal-pqc@0.9.0
+npm i fractal-pqc@0.10.0
 npx fractal-pqc demo            # the whole path, offline, in 20 seconds — see below
 npx fractal-pqc claims          # every security claim we make, each with an attack
 npx fractal-pqc claims --gaps   # and what the green does NOT cover
 npx fractal-pqc claims --mutate # break the code, watch the sentences die
-npx fractal-pqc selftest        # 331 checks, no mocks
+npx fractal-pqc selftest        # 357 checks, no mocks
 ```
 
 **Start with `demo`.** It is the answer to your question, executed rather than described.
@@ -134,7 +134,7 @@ We are not the standard, and anyone claiming to be one at this stage is selling.
 
 **Ours is the only package I know of that will tell you, on your machine, which of its own security claims it cannot back.** A claim is admissible only with three things: an executable proof, an executable *attack* that must fail, and a **mutation** of the code it names under which the claim must fail. A sentence no mutation can kill is reported as vacuous and the build breaks.
 
-We built that because we needed it. Ten adversarial siege rounds against our own code — roughly 1,150 executed exploits — found the same disease every time and never once in the mathematics: an English sentence and a code path written separately, with a fully green test suite in between hiding the gap. Round 5 deleted a single line binding an anchor to the head it timestamps; the ledger printed all-green and 263 assertions passed, because no claim named that guard. Round 7 — run against the very paragraph in section 3b, in the days before this email — found the cross-client signature described in section 1, and found a frozen scope string still telling auditors that the M2 gate did not exist while the gate was refusing signatures. Round 10, run against this exact letter before it was sent: `cutoffBlockHeight`, `blockMerkleRoots` and `knownHeads` were each read straight off the request at every point they were needed, instead of being snapshotted once the way `anchorEvidence` already was — and for `knownHeads` that was not a theoretical gap. An accessor that shows a genuinely conflicting log head to the length check and an empty array to the loop that actually runs equivocation detection produced a real, verifiable ML-DSA-gated Schnorr signature in exactly the case section 4's limit #4 promises a refusal for. All three fields now get the same snapshot-once discipline. The `knownHeads` and `cutoffBlockHeight` exploits are each closed and covered by a mutation that turns the ledger red if either regresses. `blockMerkleRoots` got the identical fix on the identical reasoning, but we could not construct an attack that flips authorisation through it alone — every consumer looks the anchor height up by key, so a divergent read fails closed rather than open — and we are not shipping a mutation we cannot honestly make fail; that field's hardening is disclosed as defense-in-depth, not as the closure of a demonstrated bypass. Every mutation in the matrix reintroduces a bug that really shipped in this package, tagged with the round that caught it. **The matrix is simultaneously our test harness and the public record of our own failures.**
+We built that because we needed it. Eleven adversarial siege rounds against our own code — ten of them found a real defect, roughly 1,150 executed exploits between those ten — found the same disease every time and never once in the mathematics: an English sentence and a code path written separately, with a fully green test suite in between hiding the gap. Round 5 deleted a single line binding an anchor to the head it timestamps; the ledger printed all-green and 263 assertions passed, because no claim named that guard. Round 7 — run against the very paragraph in section 3b, in the days before this email — found the cross-client signature described in section 1, and found a frozen scope string still telling auditors that the M2 gate did not exist while the gate was refusing signatures. Round 10, run against this exact letter before it was sent: `cutoffBlockHeight`, `blockMerkleRoots` and `knownHeads` were each read straight off the request at every point they were needed, instead of being snapshotted once the way `anchorEvidence` already was — and for `knownHeads` that was not a theoretical gap. An accessor that shows a genuinely conflicting log head to the length check and an empty array to the loop that actually runs equivocation detection produced a real, verifiable ML-DSA-gated Schnorr signature in exactly the case section 4's limit #4 promises a refusal for. All three fields now get the same snapshot-once discipline. The `knownHeads` and `cutoffBlockHeight` exploits are each closed and covered by a mutation that turns the ledger red if either regresses. `blockMerkleRoots` got the identical fix on the identical reasoning, but we could not construct an attack that flips authorisation through it alone — every consumer looks the anchor height up by key, so a divergent read fails closed rather than open — and we are not shipping a mutation we cannot honestly make fail; that field's hardening is disclosed as defense-in-depth, not as the closure of a demonstrated bypass. Round 11 is the odd one out and we say so rather than pad the count: it found no defect in existing code, because the code it tests did not exist yet. `authorizeAndSign` returned a raw signature and nothing else in the package ever turned it into a broadcastable transaction — the custodian integration this letter's M2 section describes as remaining. `m2-broadcast.mjs` is that missing step, admitted to the same matrix: it rebuilds the exact witness a decision authorised, never a caller-supplied one, and the signature is re-verified independently against a freshly recomputed sighash before anything is finalized. Every mutation in the matrix reintroduces a bug that really shipped in this package, tagged with the round that caught it. **The matrix is simultaneously our test harness and the public record of our own failures.**
 
 I am telling you about round 7 in the letter that asks you for money, before you could possibly have found it yourself, because the alternative is a commitment on the next page that would be worth nothing.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fractal-pqc",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Runnable reference for quantum-safe migration of a Bitcoin-style key: bind secp256k1/Taproot to ML-DSA-65 (FIPS-204), derive P2TR addresses, build+sign BIP-341 key-path spends (official-vector-verified), and broadcast on testnet. Real primitives, honest scope.",
   "type": "module",
   "license": "MIT",
@@ -20,6 +20,7 @@
     "./transparency": "./src/transparency.mjs",
     "./primacy": "./src/primacy.mjs",
     "./policy": "./src/policy.mjs",
+    "./m2-broadcast": "./src/m2-broadcast.mjs",
     "./tapscript": "./src/tapscript.mjs",
     "./ots": "./src/ots.mjs",
     "./address": "./src/address.mjs",
@@ -42,7 +43,7 @@
     "vectors"
   ],
   "scripts": {
-    "test": "node test/vectors.mjs && node test/transparency.mjs && node test/primacy.mjs && node test/anchoring.mjs && node test/conformance.mjs && node test/m2-policy.mjs && node test/bip341-scriptpath.mjs && node test/claims.mjs && node test/demo.mjs && node test/letter-claims.mjs",
+    "test": "node test/vectors.mjs && node test/transparency.mjs && node test/primacy.mjs && node test/anchoring.mjs && node test/conformance.mjs && node test/m2-policy.mjs && node test/m2-broadcast.mjs && node test/bip341-scriptpath.mjs && node test/claims.mjs && node test/demo.mjs && node test/letter-claims.mjs",
     "selftest": "node bin/cli.mjs selftest",
     "conformance": "node test/conformance.mjs",
     "claims": "node bin/cli.mjs claims",

package/src/claims-registry.mjs

@@ -15,6 +15,8 @@ const toHexLocal = (b) => Array.from(b, (x) => x.toString(16).padStart(2, "0")).
 import * as TS from "./tapscript.mjs";
 import * as OTS from "./ots.mjs";
 import { POLICY_SCOPE, authorizeAndSign, REFUSED, policyOutputScriptPubKey, buildSpendContext } from "./policy.mjs";
+import { rebuildM2Witness } from "./m2-broadcast.mjs";
+import { taprootScriptPathSighash } from "./tx.mjs";
 import { schnorr } from "@noble/curves/secp256k1.js";
 import { generateMigrationIdentity, createMigrationCommitment, authorizeSpend } from "./migration-envelope.mjs";
 
@@ -355,6 +357,68 @@ export const CLAIMS = [
           "with the warning that this engine constrains WHOSE coin is spent and never WHERE " +
           "the value goes.",
   },
+  {
+    id: "R11-finalized-witness-independently-verifies",
+    module: "m2-broadcast.mjs",
+    statement: "The witness this package assembles for an authorised M2 (script-path) spend " +
+               "is genuinely valid: rebuilding it from nothing but the authorizeAndSign() " +
+               "receipt reproduces the policy leaf that was actually committed into the " +
+               "Taproot output key, and the Schnorr signature verifies against an INDEPENDENTLY " +
+               "recomputed BIP-342 sighash — not merely against this module's own bookkeeping. " +
+               "finalizeAndBroadcastM2Spend refuses to finalize anything authorizeAndSign did " +
+               "not actually authorise.",
+    proof: () => {
+      const result = authorizeAndSign(goodReq());
+      if (result.authorized !== true) return false;
+      const { witness } = rebuildM2Witness(result);
+      if (witness.length !== 3) return false;
+      // Independent re-derivation: recompute the sighash ourselves from the spend context,
+      // not from anything m2-broadcast.mjs asserts, and verify against THAT.
+      const leafHash = TS.tapLeafHash(witness[1]);
+      const digest = taprootScriptPathSighash(SC.spendContext.tx, SC.spendContext.inputIndex,
+        SC.spendContext.prevoutValues, SC.spendContext.prevoutScriptPubKeys, leafHash);
+      if (toHexLocal(digest) !== result.evidence.digestSigned) return false;
+      return schnorr.verify(witness[0], digest, Buffer.from(result.policyPublicKeyHex, "hex")) === true;
+    },
+    attack: () => {
+      // 1. A refused authorization must never yield a witness. Isolate EXACTLY the
+      // authorized-flag guard: take a GENUINELY authorized result (real evidence, real
+      // signature — everything downstream would happily accept it) and spoof only
+      // `authorized` to false, rather than using a naturally-refused object, which is
+      // ALSO missing evidence.anchoredFactHash and would be caught by the second guard
+      // regardless of whether the first one still works — that would leave this mutation
+      // untestable. rebuildM2Witness (sync) is finalizeAndBroadcastM2Spend's (async) first
+      // internal step and throws for the exact same reason — this claims runner calls
+      // proof/attack synchronously, so we test the sync half directly rather than let an
+      // unawaited async throw become an unhandled rejection no try/catch here would ever see.
+      const spoofed = { ...authorizeAndSign(goodReq()), authorized: false };
+      let threw1 = false;
+      try { rebuildM2Witness(spoofed); } catch { threw1 = true; }
+      if (!threw1) return false;
+      // 2. A fabricated result with no real evidence must never yield a witness.
+      let threw2 = false;
+      try {
+        rebuildM2Witness({ authorized: true, policySignatureHex: "00".repeat(64),
+          policyPublicKeyHex: toHexLocal(schnorr.getPublicKey(POLICY_KEY)), evidence: {} });
+      } catch { threw2 = true; }
+      if (!threw2) return false;
+      // 3. A tampered signature byte must fail independent verification.
+      const result = authorizeAndSign(goodReq());
+      const { witness } = rebuildM2Witness(result);
+      const leafHash = TS.tapLeafHash(witness[1]);
+      const digest = taprootScriptPathSighash(SC.spendContext.tx, SC.spendContext.inputIndex,
+        SC.spendContext.prevoutValues, SC.spendContext.prevoutScriptPubKeys, leafHash);
+      const tampered = Uint8Array.from(witness[0]); tampered[0] ^= 0xff;
+      return schnorr.verify(tampered, digest, Buffer.from(result.policyPublicKeyHex, "hex")) === false;
+    },
+    note: "Round 11 (this audit): authorizeAndSign() returned a raw signature and nothing else " +
+          "in the package ever turned it into a broadcastable transaction — scriptPathWitness() " +
+          "was called exactly once in the whole repo, in one test, only to check its shape. A " +
+          "custodian could not attempt a real M2 spend, even in dry-run. m2-broadcast.mjs closes " +
+          "that: it rebuilds the leaf/control block from the receipt's own fields (never from a " +
+          "caller-supplied leaf, which would let someone splice in a different script), and " +
+          "refuses outright unless authorized===true.",
+  },
   {
     id: "R10-every-caller-field-read-once",
     module: "policy.mjs",
@@ -728,15 +792,14 @@ export const UNCLAIMED_GUARDS = Object.freeze([
          "blocks) — again stronger than a claim, again not in the ledger" },
   { where: "policy.mjs", guard: "the ORDER of the refusal guards",
     why: "each guard is claimed individually; nothing claims that reordering them is safe" },
-  { where: "policy.mjs", guard: "buildSpendContext is single-input; the engine is not",
-    why: "ROUND 9. The helper we ship — the only one the package documents so that 'the holder " +
-         "signs what the custodian will sign' — hardcodes one input and inputIndex 0, while " +
-         "authorizeAndSign accepts and authorises multi-input transactions. For those the " +
-         "holder cannot reproduce the digest with anything we gave them, so they must sign one " +
-         "the custodian computed. Measured: engine authorises the 2-input tx, the other input " +
-         "is not named in the receipt, and the holder's helper-derived digest differs from the " +
-         "one signed. The oracle moved rather than vanished, and until the helper covers the " +
-         "multi-input case this is the honest boundary" },
+  // REMOVED (post-round-9): "buildSpendContext is single-input; the engine is not" used to
+  // live here. It described a real gap — the helper hardcoded one input while the engine
+  // accepted multi-input transactions, so a consolidating custodian would recreate the
+  // signing-oracle bug. Round 9 closed it: buildSpendContext now accepts `otherInputs`, and
+  // R9-holder-can-reproduce-any-digest (below) proves a 2-input case end to end — the holder's
+  // independently-derived digest matches the one the engine signs. Leaving a fixed gap listed
+  // as unclaimed would itself be a prose-vs-code drift, the exact disease this file exists to
+  // catch, so it's removed rather than left to rot.
   { where: "policy.mjs", guard: "WHERE THE MONEY GOES — the engine imposes nothing on the outputs",
     why: "the engine verifies the coin being SPENT belongs to this holder, and computes the " +
          "sighash itself, so no one can be made to sign for someone else's coin. It says " +
@@ -760,4 +823,36 @@ export const UNCLAIMED_GUARDS = Object.freeze([
   { where: "primacy.mjs", guard: "key rotation / revocation",
     why: "NOT IMPLEMENTED. A holder who loses their ML-DSA secret is locked out permanently " +
          "and the old certificate keeps authorising. This is a known gap, not a covered one." },
+  { where: "psbt.mjs / tapscript.mjs / policy.mjs", guard: "multisig PSBT",
+    why: "NOT IMPLEMENTED, and until this entry, not even LISTED — the package's own honesty " +
+         "ledger had no line item for a promise the funding letter makes. psbt.mjs is " +
+         "single-signer P2TR key-path only: no BIP-174 multisig fields, no k-of-N Tapscript " +
+         "threshold primitive, and policyLeafScript hardcodes exactly one policy public key. " +
+         "Multisig and key rotation (above) are related but DISTINCT problems — rotation asks " +
+         "which key is valid NOW, multisig asks how many keys must agree — and a design that " +
+         "supports both together (replace one of N signers without invalidating the others) " +
+         "does not exist yet in prose or code." },
+  { where: "policy.mjs (nothing downstream of it exists yet)", guard: "finalize + broadcast for a script-path (M2) spend",
+    why: "NOT IMPLEMENTED. authorizeAndSign returns a raw Schnorr signature over a digest it " +
+         "computed; nothing in this package assembles that signature, the policy leaf, and the " +
+         "control block into a witness, serializes the transaction, or hands it to " +
+         "broadcast.mjs. scriptPathWitness() (tapscript.mjs) is called exactly once in the " +
+         "whole repo, in one test, only to check its shape — its output never reaches a " +
+         "serializer. A custodian cannot attempt a real M2 spend, even in dry-run, until this " +
+         "exists; it is the first thing anyone integrating M2 needs." },
+  { where: "policy.mjs", guard: "policyKey custody, and singlePolicyKeyPerHolder is not enforced",
+    why: "The Taproot internal key is the unspendable NUMS point, so policyPub in the leaf " +
+         "script is the ONLY spending path — and it is the SAME Schnorr key for every holder " +
+         "under one custodian. Losing or leaking it freezes or drains everyone that custodian " +
+         "serves, not just one holder; the letter's Tranche 2 discusses only holder-side key " +
+         "loss. Separately, every call site passes singlePolicyKeyPerHolder: true, but " +
+         "authorizeAndSign never reads that field — verified live, calling it with or without " +
+         "the field produces byte-identical behaviour. The 'concentration, not elimination' " +
+         "security story this whole package tells depends on one policy key mapping to " +
+         "exactly one holder, and today that is pure operator convention outside the library, " +
+         "with no detection if it's violated. The receipt used to echo a fake acknowledgement " +
+         "of the caller's assertion (`singlePolicyKeyPerHolderAsserted: true`) on a code path " +
+         "that turned out to be dead (spendContext has been mandatory since round 8, so the " +
+         "branch that built that field could never run) — removed rather than left as prose " +
+         "describing a possibility the code cannot reach. See POLICY_SCOPE.policyKeyCustody." },
 ]);

package/src/letter-claims.mjs

@@ -166,7 +166,7 @@ async function mount() {
   return _mount;
 }
 
-const WORD_NUM = { one: 1, two: 2, three: 3, four: 4, five: 5, six: 6, seven: 7, eight: 8, nine: 9, ten: 10 };
+const WORD_NUM = { one: 1, two: 2, three: 3, four: 4, five: 5, six: 6, seven: 7, eight: 8, nine: 9, ten: 10, eleven: 11 };
 
 // ── the registry ───────────────────────────────────────────────────────────
 export const LETTER_CLAIMS = [
@@ -230,7 +230,7 @@ export const LETTER_CLAIMS = [
   {
     id: "L8-siege-rounds",
     what: "how many adversarial rounds the letter claims, vs how many the mutation matrix records",
-    extract: (t) => extract(t, /(Seven|Six|Eight|Five|Nine|Ten) adversarial siege rounds/, "rounds"),
+    extract: (t) => extract(t, /(Seven|Six|Eight|Five|Nine|Ten|Eleven) adversarial siege rounds/, "rounds"),
     measure: () => siegeRounds(),
     compare: (a, m) => WORD_NUM[String(a).toLowerCase()] === m,
     falsify: (a) => (String(a).toLowerCase() === "seven" ? "Eight" : "Seven"),

package/src/m2-broadcast.mjs

@@ -0,0 +1,111 @@
+// SPDX-License-Identifier: MIT
+//
+// Finalize + (optionally) broadcast the M2 policy-governed (script-path) spend that
+// authorizeAndSign() already decided. This is deliberately a SEPARATE module from
+// policy.mjs: the decision engine has zero network I/O and zero transaction-assembly
+// code, and nothing here can influence what it decided — this module can only serialize
+// a decision already made, never make one.
+//
+// WHY THIS EXISTS. authorizeAndSign() returns a raw 64-byte Schnorr signature over a
+// digest it computed itself. Until this file, nothing in the package turned that into a
+// broadcastable transaction: scriptPathWitness() (tapscript.mjs) was called exactly once
+// in the whole repo, in one test, only to check its shape — its output never reached a
+// serializer. A custodian could not attempt a real M2 spend, even in dry-run. This is
+// that missing step, for the letter's M2 milestone ("a custodian running it against
+// funded testnet spends").
+//
+// TRUST MODEL: this module REBUILDS the policy leaf from fields the receipt itself
+// carries (policyPublicKeyHex, evidence.anchoredFactHash) rather than accepting a leaf
+// script from the caller — a caller-supplied leaf would let someone splice a different
+// script into the witness than the one the engine actually authorised. It also refuses
+// outright unless authorizeResult.authorized === true, so a caller cannot broadcast an
+// unauthorised decision by constructing a fake result object with the right shape.
+
+import { policyLeafScript } from "./policy.mjs";
+import { tapLeafHash, taprootOutputKeyWithTree, NUMS_INTERNAL_KEY, controlBlock, scriptPathWitness, verifyControlBlock } from "./tapscript.mjs";
+import { serializeSegwit, txid as computeTxid } from "./tx.mjs";
+import { broadcastTx, explorerTxUrl } from "./broadcast.mjs";
+
+const fromHex = (h) => Uint8Array.from(Buffer.from(h, "hex"));
+const toHex = (b) => Buffer.from(b).toString("hex");
+
+/**
+ * Rebuild the exact witness `authorizeAndSign` authorised — script, control block, and
+ * signature — without trusting anything the caller supplies beyond the receipt itself.
+ * Exported separately from the broadcast step so a caller can inspect/serialize the
+ * witness before deciding whether to publish it.
+ *
+ * @param {object} authorizeResult  what authorizeAndSign() returned; must have
+ *                                  authorized === true
+ * @returns {{ leaf: Uint8Array, control: Uint8Array, witness: Uint8Array[] }}
+ */
+export function rebuildM2Witness(authorizeResult) {
+  if (!authorizeResult || authorizeResult.authorized !== true) {
+    throw new Error("rebuildM2Witness refuses: authorizeResult.authorized is not true — this " +
+      "module only serializes a decision the policy engine actually made, never one it refused.");
+  }
+  const { policySignatureHex, policyPublicKeyHex, evidence } = authorizeResult;
+  if (!evidence || typeof evidence.anchoredFactHash !== "string") {
+    throw new Error("authorizeResult has no evidence.anchoredFactHash — refusing to guess the policy leaf.");
+  }
+  const policyXOnly = fromHex(policyPublicKeyHex);
+  const leaf = policyLeafScript(evidence.anchoredFactHash, policyXOnly);
+  if (!leaf) throw new Error("could not rebuild the policy leaf from the receipt's own fields.");
+  const leafHash = tapLeafHash(leaf);
+  // Single-leaf tree (the only shape policy.mjs ever produces): the leaf hash IS the
+  // tree root, so the Merkle path in the control block is empty.
+  const { outputKey, parity } = taprootOutputKeyWithTree(NUMS_INTERNAL_KEY, leafHash);
+  const control = controlBlock({ internalXOnly: NUMS_INTERNAL_KEY, parity, path: [] });
+  // Verify our OWN construction before handing it back, the same check a verifier would
+  // run — if this ever failed it means this module's assembly diverged from the leaf
+  // policy.mjs actually committed to, and broadcasting would just be a wasted fee.
+  const check = verifyControlBlock(control, leaf, outputKey);
+  if (!check.valid) throw new Error(`internal error: rebuilt control block does not verify (${check.reason})`);
+  const witness = scriptPathWitness({ stack: [fromHex(policySignatureHex)], script: leaf, control });
+  return { leaf, control, witness, outputKeyHex: toHex(outputKey) };
+}
+
+/**
+ * Finalize the M2 spend `authorizeAndSign` authorised into a signed, serialized
+ * transaction, and (optionally) broadcast it.
+ *
+ * @param {object} authorizeResult  what authorizeAndSign() returned (authorized === true)
+ * @param {object} spendContext     the SAME { tx, inputIndex, prevoutValues,
+ *                                  prevoutScriptPubKeys } object passed to
+ *                                  authorizeAndSign — never re-derived, so this can never
+ *                                  finalize a transaction other than the one authorised
+ * @param {object} [opts]
+ * @param {boolean} [opts.broadcast=false]  actually publish (default: dry-run)
+ * @param {"tb"|"bc"|"signet"|"mutinynet"} [opts.network="tb"]
+ * @param {string} [opts.apiBase]  override the Esplora API base
+ * @returns {Promise<{hex, txid, broadcasted, explorer}>}
+ */
+export async function finalizeAndBroadcastM2Spend(authorizeResult, spendContext, opts = {}) {
+  const { witness } = rebuildM2Witness(authorizeResult);
+  const { tx, inputIndex } = spendContext || {};
+  if (!tx || !Array.isArray(tx.inputs) || !Number.isSafeInteger(inputIndex) ||
+      inputIndex < 0 || inputIndex >= tx.inputs.length) {
+    throw new Error("spendContext must be the exact { tx, inputIndex, ... } object that was " +
+      "passed to authorizeAndSign — this module never re-derives it.");
+  }
+  if (tx.inputs[inputIndex].witness) {
+    throw new Error(`tx.inputs[${inputIndex}] already carries a witness — refusing to overwrite ` +
+      "one this module did not produce.");
+  }
+  const finalTx = {
+    ...tx,
+    inputs: tx.inputs.map((inp, i) => (i === inputIndex ? { ...inp, witness } : inp)),
+  };
+  const hex = toHex(serializeSegwit(finalTx));
+  const finalTxid = computeTxid(finalTx);
+
+  let broadcasted = false;
+  if (opts.broadcast) {
+    await broadcastTx(hex, { network: opts.network ?? "tb", apiBase: opts.apiBase });
+    broadcasted = true;
+  }
+  return {
+    hex, txid: finalTxid, broadcasted,
+    explorer: broadcasted ? explorerTxUrl(finalTxid, opts.network ?? "tb") : null,
+  };
+}

package/src/mutations.mjs

@@ -336,6 +336,16 @@ export const MUTATIONS = [
   // demonstrated bypass — and a mutation we cannot honestly make kill anything is exactly the
   // vacuous-claim disease this file exists to catch. Said so in the letter and in the claim's
   // own note, rather than shipping a mutation that always reads "detected: false".
+  {
+    id: "M-R11-finalize-accepts-unauthorised",
+    describes: "R11: rebuildM2Witness stops refusing an unauthorised result, so " +
+               "finalizeAndBroadcastM2Spend could be handed a fabricated {authorized:true} " +
+               "object and produce a witness for a spend the policy engine never actually authorised",
+    file: "src/m2-broadcast.mjs",
+    from: `  if (!authorizeResult || authorizeResult.authorized !== true) {`,
+    to: `  if (false) {`,
+    mustKill: ["R11-finalized-witness-independently-verifies"],
+  },
 ];
 
 /**

package/src/policy.mjs

@@ -475,9 +475,10 @@ export function authorizeAndSign(req) {
     }
     const spendContextOutputs = (tx.outputs || []).map((o) =>
       o.scriptPubKey instanceof Uint8Array ? o.scriptPubKey : (fromHexP(o.scriptPubKey) || new Uint8Array()));
-    const outputBinding = { bound: true, scriptPubKeyHex: toHex(expectedSpk),
-                            computedDigestHex: toHex(digest), inputIndex,
-                            txid: null };
+    // Only scriptPubKeyHex is ever read from this below — no txid exists yet (the transaction
+    // isn't broadcast at signing time) and computedDigestHex/inputIndex are already on the
+    // receipt as digestSigned/spendContext, so we don't construct fields nobody consumes.
+    const outputBinding = { bound: true, scriptPubKeyHex: toHex(expectedSpk) };
 
     const spend = verifySpend(cert, digest, pqSignatureHex, {
       anchoredFactHash: anchor.anchoredFactHash,
@@ -521,9 +522,14 @@ export function authorizeAndSign(req) {
             `public key. Only the SECOND of those depends on no Q-day estimate. It is an ` +
             `extra condition, not a replacement for the first.`,
         } : {}),
-        // Stated on EVERY receipt, true or false, so its absence can never be mistaken for
-        // a guarantee that was never given.
-        outputBound: outputBinding !== null,
+        // Stated on EVERY receipt: true, unconditionally, since round 8 made spendContext
+        // mandatory — there is no path through authorizeAndSign any more that reaches this
+        // line without one. (An earlier version of this field, and a whole caveat branch
+        // beside it for the no-spendContext case, described a possibility that could not
+        // happen — dead code masquerading as an open question. Removed rather than kept
+        // "just in case": a `singlePolicyKeyPerHolder` flag some callers still pass is not
+        // read here or anywhere else in this file; see POLICY_SCOPE.policyKeyCustody.)
+        outputBound: true,
         // WHAT THIS RECEIPT DOES NOT SAY, printed on every one so its absence is never read
         // as a guarantee: nothing here constrains the DESTINATIONS. The engine proved whose
         // coin is being spent and who authorised it. Where the money goes is the holder's
@@ -535,15 +541,7 @@ export function authorizeAndSign(req) {
           "the transaction before producing the ML-DSA authorisation; signing a digest you " +
           "did not derive yourself is the same mistake this engine stopped making in 0.9.0.",
         outputScriptPubKeys: (spendContextOutputs || []).map((o) => toHex(o)),
-        ...(outputBinding ? { boundScriptPubKeyHex: outputBinding.scriptPubKeyHex } : {
-          outputBindingCaveat:
-            "no spendContext was supplied. This receipt identifies the HOLDER, not the COIN: " +
-            "it records who was authorised to make the policy key sign SOMETHING. It is only " +
-            "sound because the caller ASSERTED singlePolicyKeyPerHolder — an assertion this " +
-            "engine cannot verify. If that assertion is false, this receipt does not mean " +
-            "what it appears to mean.",
-          singlePolicyKeyPerHolderAsserted: true,
-        }),
+        boundScriptPubKeyHex: outputBinding.scriptPubKeyHex,
         digestSigned: toHex(digest),
         logId: anchor.logId,
         logPinned: true,
@@ -628,11 +626,24 @@ export const POLICY_SCOPE = Object.freeze({
     "ML-DSA signature is the only thing standing there, so the holder must INSPECT THE " +
     "TRANSACTION rather than sign the digest they were handed.",
   helperIsSingleInputOnly:
-    "RESIDUAL 2, found by round 9. `buildSpendContext` builds a SINGLE-input transaction while " +
-    "authorizeAndSign accepts multi-input ones. For a multi-input spend the holder cannot " +
-    "re-derive the digest with the only helper we ship, so they would be signing a digest the " +
-    "CUSTODIAN computed — which is word for word the mistake this engine stopped making in " +
-    "0.9.0. The oracle did not disappear; for that case it moved to the holder's desk.",
+    "CLOSED (round 9). This string used to describe `buildSpendContext` as single-input " +
+    "while authorizeAndSign accepted multi-input transactions, leaving the holder unable to " +
+    "re-derive a multi-input digest with the only helper shipped. `buildSpendContext` now " +
+    "takes `otherInputs`, and R9-holder-can-reproduce-any-digest proves a real 2-input case " +
+    "end to end: the holder's independently-derived digest matches what the engine signs. " +
+    "Left the name and the round number rather than deleting the field outright, so a reader " +
+    "who remembers the old caveat can find where it went.",
+  policyKeyCustody:
+    "NOT THIS FILE'S PROBLEM TO SOLVE, AND WE SAY SO. `policyKey` is a single Schnorr secret " +
+    "per custodian — the ONE spending path once the internal key is the unspendable NUMS " +
+    "point (see consensusCaveat) — so losing or leaking it is custodian-WIDE, not just " +
+    "holder-wide: every holder under that key is frozen or drained together. Some callers " +
+    "pass `singlePolicyKeyPerHolder: true` into authorizeAndSign; this file has never read " +
+    "that field (a stateless function call cannot verify a claim about OTHER calls it never " +
+    "sees), and no longer even echoes it back in the receipt as if it had been checked. " +
+    "'One policy key per holder' is real only if the CALLER enforces it externally (e.g. a " +
+    "database uniqueness constraint) — that discipline, and HSM/multisig custody of the key " +
+    "itself, belong to the custodian integration this package does not build.",
   limitFour_historyNotPinned:
     "pinning the log IDENTITY does not pin its HISTORY. Two same-size heads under the same " +
     "logId both satisfy every check here. Split view is DETECTABLE (transparency." +

package/test/letter-claims.mjs

@@ -82,7 +82,7 @@ console.log("\nAdversarial: a tampered letter must be refused");
     // ROUND 9: this hardcoded "Seven", so when the letter honestly moved to "Nine" the tamper
     // stopped tampering and the suite reported it as refused. A perturbation that does not
     // perturb is a false green — the same disease, in the test that guards against it.
-    ["inflated siege rounds",      (t) => t.replace(/\b(Five|Six|Seven|Eight|Nine|Ten) adversarial siege rounds/,
+    ["inflated siege rounds",      (t) => t.replace(/\b(Five|Six|Seven|Eight|Nine|Ten|Eleven) adversarial siege rounds/,
                                                     "Twenty adversarial siege rounds")],
     ["wrong version",              (t) => t.replace(/fractal-pqc@[\d.]+/g, "fractal-pqc@9.9.9")],
     ["inflated BIP-341 cases",     (t) => t.replace(/7\/7 scriptPubKey/, "9/9 scriptPubKey")],

package/test/m2-broadcast.mjs

@@ -0,0 +1,185 @@
+// M2 finalize+broadcast — the step after authorizeAndSign() that nothing else in this
+// package performs: assembling the witness for a script-path spend the policy engine
+// already authorised, serializing it, and (in dry-run) producing a real txid. Real keys,
+// real ML-DSA-65 + Schnorr signatures, no mocks — and the signature is re-verified
+// INDEPENDENTLY of rebuildM2Witness, against a digest this test recomputes itself, so a
+// bug that made both sides agree with each other (rather than with the spec) would still
+// be caught.
+
+import { schnorr } from "@noble/curves/secp256k1.js";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { ml_dsa65 } from "@noble/post-quantum/ml-dsa.js";
+import * as T from "./../src/transparency.mjs";
+import * as P from "./../src/primacy.mjs";
+import * as OTS from "./../src/ots.mjs";
+import { tapLeafHash } from "./../src/tapscript.mjs";
+import { taprootScriptPathSighash } from "./../src/tx.mjs";
+import { generateMigrationIdentity, createMigrationCommitment, authorizeSpend } from "./../src/migration-envelope.mjs";
+import { authorizeAndSign, buildSpendContext } from "./../src/policy.mjs";
+import { rebuildM2Witness, finalizeAndBroadcastM2Spend } from "./../src/m2-broadcast.mjs";
+
+let pass = 0, fail = 0;
+function check(name, cond) {
+  if (cond) { pass++; console.log(`  ✓ ${name}`); }
+  else { fail++; console.log(`  ✗ ${name}`); }
+}
+const hex = (b) => Buffer.from(b).toString("hex");
+const te = new TextEncoder();
+
+console.log("M2 finalize+broadcast — the piece after authorizeAndSign that nothing else performs\n");
+
+const kp = ml_dsa65.keygen(new Uint8Array(32).fill(0x9c));
+const leaves = (n) => Array.from({ length: n }, (_, i) => T.hashLeaf(te.encode(`c-${i}`)));
+const ident = generateMigrationIdentity();
+const cert = createMigrationCommitment(ident);
+const entry = { classicalPub: cert.classicalPub, pqPublic: cert.pqPublic, classicalSig: cert.classicalSig, pqSig: cert.pqSig };
+const other = createMigrationCommitment(generateMigrationIdentity());
+const ENTRIES = [{ classicalPub: other.classicalPub, pqPublic: other.pqPublic, classicalSig: other.classicalSig, pqSig: other.pqSig }, entry];
+const LEAVES = ENTRIES.map(P.entryLeaf);
+const STH = T.signTreeHead({ secretKey: kp.secretKey, publicKey: kp.publicKey, treeSize: ENTRIES.length, rootHash: T.merkleRoot(LEAVES), timestampMs: 1_756_000_000_000 });
+const HEAD_BYTES = T.sthSignedBytes({ version: STH.version, logId: STH.logId, treeSize: STH.treeSize, rootHash: T.fromHex(STH.rootHash), timestampMs: STH.timestampMs });
+const OTS_DIGEST = OTS.otsSha256(HEAD_BYTES);
+const ANCHOR_HEIGHT = 800_000;
+const OTS_HEX = T.toHex(OTS.encodeOtsFile({ majorVersion: OTS.OTS_MAJOR_VERSION, fileHashOp: "sha256", fileDigest: OTS_DIGEST, timestamp: OTS.timestampWithAttestation(OTS_DIGEST, { kind: "bitcoin", height: ANCHOR_HEIGHT }) }));
+const REAL_ROOT = (() => { const a = OTS.evaluateOts(OTS.decodeOtsFile(T.fromHex(OTS_HEX))).blockAttestations[0]; return a.merkleRootInternalHex.match(/../g).reverse().join(""); })();
+const HEADERS = { [ANCHOR_HEIGHT]: REAL_ROOT };
+const CUTOFF = 900_000;
+const POLICY_KEY = new Uint8Array(32).fill(0x2b);
+const ANCHORED_FH = P.certIsFirstSeen({ cert, entries: ENTRIES, sth: STH, expectedLogId: STH.logId,
+  cutoffBlockHeight: CUTOFF, otsHex: OTS_HEX, blockMerkleRoots: HEADERS, requireTemporalFrontier: true }).anchoredFactHash;
+const SC = buildSpendContext({ anchoredFactHash: ANCHORED_FH, policyPublicKey: schnorr.getPublicKey(POLICY_KEY),
+  txid: "11".repeat(32), valueSats: 100_000n, outputs: [{ valueSats: 90_000n, scriptPubKey: new Uint8Array(34) }] });
+const SPEND_SIG = authorizeSpend(ident, SC.digest);
+const goodReq = (overrides = {}) => ({ cert, pqSignatureHex: SPEND_SIG,
+  anchorEvidence: { sth: STH, entries: ENTRIES, otsHex: OTS_HEX }, expectedLogId: STH.logId,
+  policyKey: POLICY_KEY, cutoffBlockHeight: CUTOFF, blockMerkleRoots: HEADERS,
+  spendContext: SC.spendContext, ...overrides });
+
+console.log("A real authorization, finalized into a witness:");
+{
+  const result = authorizeAndSign(goodReq());
+  check("baseline authorises (the control is not vacuous)", result.authorized === true);
+
+  const { witness, outputKeyHex } = rebuildM2Witness(result);
+  check("witness is [sig, leaf, control] — 3 items", witness.length === 3);
+  check("rebuildM2Witness's own outputKey matches the receipt's bound scriptPubKey",
+    result.evidence.boundScriptPubKeyHex.slice(4) === outputKeyHex); // strip OP_1 PUSH32 (0x5120)
+
+  // INDEPENDENT re-verification: recompute the BIP-342 sighash ourselves, the same way
+  // policy.mjs does internally, and check the signature against THAT — not against
+  // anything rebuildM2Witness itself asserts. A bug that made witness assembly and
+  // signature verification agree with each other but not with the spec would still fail
+  // this check.
+  const leafHash = tapLeafHash(witness[1]);
+  const expectedDigest = taprootScriptPathSighash(SC.spendContext.tx, SC.spendContext.inputIndex,
+    SC.spendContext.prevoutValues, SC.spendContext.prevoutScriptPubKeys, leafHash);
+  check("recomputed digest matches the receipt's digestSigned",
+    hex(expectedDigest) === result.evidence.digestSigned);
+  check("★ INDEPENDENT schnorr.verify(sig, digest, policyPubkey) — not rebuildM2Witness's own opinion",
+    schnorr.verify(witness[0], expectedDigest, Buffer.from(result.policyPublicKeyHex, "hex")) === true);
+
+  const fin = await finalizeAndBroadcastM2Spend(result, SC.spendContext, { broadcast: false });
+  check("dry-run finalize does NOT broadcast", fin.broadcasted === false);
+  check("dry-run finalize returns a real hex-serialized transaction", /^[0-9a-f]+$/.test(fin.hex) && fin.hex.length > 0);
+  check("dry-run finalize returns a 64-hex-char txid", /^[0-9a-f]{64}$/.test(fin.txid));
+}
+
+console.log("\nRefusals — finalize is only as trustworthy as what it refuses to finalize:");
+{
+  const refused = authorizeAndSign(goodReq({ cutoffBlockHeight: 1 }));
+  check("setup: this variant is genuinely refused", refused.authorized === false);
+  let threw = false;
+  try { await finalizeAndBroadcastM2Spend(refused, SC.spendContext); }
+  catch { threw = true; }
+  check("★ refuses to finalize an UNAUTHORISED result", threw);
+
+  let threwFake = false;
+  try {
+    rebuildM2Witness({ authorized: true, policySignatureHex: "00".repeat(64),
+      policyPublicKeyHex: hex(schnorr.getPublicKey(POLICY_KEY)), evidence: {} });
+  } catch { threwFake = true; }
+  check("★ refuses a fabricated result with no evidence.anchoredFactHash", threwFake);
+
+  const result = authorizeAndSign(goodReq());
+  let threwBadCtx = false;
+  try { await finalizeAndBroadcastM2Spend(result, { tx: SC.spendContext.tx, inputIndex: 99 }); }
+  catch { threwBadCtx = true; }
+  check("★ refuses a spendContext with an out-of-range inputIndex", threwBadCtx);
+
+  let threwOverwrite = false;
+  try {
+    const alreadyWitnessed = { ...SC.spendContext,
+      tx: { ...SC.spendContext.tx, inputs: SC.spendContext.tx.inputs.map((i, idx) =>
+        idx === SC.spendContext.inputIndex ? { ...i, witness: [new Uint8Array(1)] } : i) } };
+    await finalizeAndBroadcastM2Spend(result, alreadyWitnessed);
+  } catch { threwOverwrite = true; }
+  check("★ refuses to overwrite a witness this module did not produce", threwOverwrite);
+}
+
+console.log("\nTampering — a modified signature must not independently verify:");
+{
+  const result = authorizeAndSign(goodReq());
+  const { witness } = rebuildM2Witness(result);
+  const leafHash = tapLeafHash(witness[1]);
+  const digest = taprootScriptPathSighash(SC.spendContext.tx, SC.spendContext.inputIndex,
+    SC.spendContext.prevoutValues, SC.spendContext.prevoutScriptPubKeys, leafHash);
+  const tampered = Uint8Array.from(witness[0]); tampered[0] ^= 0xff;
+  check("★ a flipped signature byte fails independent schnorr.verify",
+    schnorr.verify(tampered, digest, Buffer.from(result.policyPublicKeyHex, "hex")) === false);
+}
+
+console.log("\nByte-level round-trip — hand-parse the serialized tx, no reuse of tx.mjs internals:");
+{
+  const result = authorizeAndSign(goodReq());
+  const fin = await finalizeAndBroadcastM2Spend(result, SC.spendContext, { broadcast: false });
+  const rawTx = Buffer.from(fin.hex, "hex");
+  let off = 0;
+  const readU32 = () => { const v = rawTx.readUInt32LE(off); off += 4; return v; };
+  const readVarint = () => { const b = rawTx[off]; off += 1; if (b < 0xfd) return b;
+    if (b === 0xfd) { const v = rawTx.readUInt16LE(off); off += 2; return v; } throw new Error("varint too large for this test"); };
+  const readBytes = (n) => { const v = rawTx.subarray(off, off + n); off += n; return v; };
+
+  check("version == 2", readU32() === 2);
+  const marker = rawTx[off]; off += 1; const flag = rawTx[off]; off += 1;
+  check("segwit marker/flag == 0x00/0x01", marker === 0x00 && flag === 0x01);
+  const nIn = readVarint();
+  check("1 input", nIn === 1);
+  readBytes(32); readU32();
+  check("empty scriptSig (segwit)", readVarint() === 0);
+  readU32(); // sequence
+  const nOut = readVarint();
+  check("output count matches spendContext", nOut === SC.spendContext.tx.outputs.length);
+  for (let i = 0; i < nOut; i++) { readU32(); readU32(); readBytes(readVarint()); }
+  const nItems = readVarint();
+  check("witness has exactly 3 items [sig, script, control]", nItems === 3);
+  const sig = readBytes(readVarint());
+  const script = readBytes(readVarint());
+  const control = readBytes(readVarint());
+  check("signature is 64 bytes (SIGHASH_DEFAULT, no appended sighash byte)", sig.length === 64);
+  check("control block is 33 bytes (single-leaf tree)", control.length === 33);
+  check("locktime == 0", readU32() === 0);
+  check("consumed the entire buffer (no trailing garbage, no truncation)", off === rawTx.length);
+
+  // The strongest check in this file: recompute the Taproot output key from RAW BYTES,
+  // hand-rolling the TapLeaf/TapTweak tagged-hash construction rather than calling
+  // tapLeafHash/taprootOutputKeyWithTree — so a bug shared between this test and the
+  // module under test (both calling the same helper) cannot hide from it.
+  const taggedHash = (tag, ...parts) => {
+    const th = sha256(new TextEncoder().encode(tag));
+    return sha256(Buffer.concat([th, th, ...parts]));
+  };
+  const leafHash = taggedHash("TapLeaf", Buffer.from([control[0] & 0xfe]), Buffer.from([script.length]), script);
+  const internalKey = control.subarray(1, 33);
+  const tweak = taggedHash("TapTweak", internalKey, leafHash);
+  let t = 0n; for (const b of tweak) t = (t << 8n) | BigInt(b);
+  const n = schnorr.utils.secp256k1?.CURVE?.n ?? schnorr.Point?.Fn?.ORDER;
+  let ix = 0n; for (const b of internalKey) ix = (ix << 8n) | BigInt(b);
+  const Q = schnorr.utils.lift_x(ix).add(schnorr.Point.BASE.multiply(t % n));
+  const outputKeyIndependent = Buffer.from(Q.toBytes(true).subarray(1));
+  check("★ hand-rolled TapLeaf+TapTweak (no shared code with m2-broadcast.mjs) recomputes " +
+    "the EXACT scriptPubKey being spent — the check Bitcoin consensus itself performs",
+    hex(SC.spendContext.prevoutScriptPubKeys[0]).slice(4) === outputKeyIndependent.toString("hex"));
+}
+
+console.log(`\n${pass} passed, ${fail} failed`);
+process.exit(fail === 0 ? 0 : 1);