[FINDING-067] Qualify RIP-25 asset phase for 4.8.1

[ALENOC]

Scope

• Enforce the bit-13 PQ-only rule for new asset and owner-token outputs through a matching native RVN witness-v2 input signed with ML-DSA-44. Historical outputs retain voluntary migration under their original spending rules.
• Set the approved bit-12 and bit-13 activation windows, document the incompatible 8 to 12 to 16 MWU upgrade, and set release version 4.8.1.
• Repair the wallet, raw transaction, Qt, dependency, and CI issues recorded in the remediation register. Keep the final release gate mandatory.

Evidence

• An unpruned testnet node replayed chainstate from genesis with assumevalid=0. The active-chain scan through height 2,554,504 covered 2,554,505 blocks and 2,774,899 transactions, with no historical witness-v2 outputs or spends. A repeated verifychain 4 2016 passed at height 2,555,987.
• At source SHA 77d8f4c65791fb53351f1b318e7f593cfe7559b0, Build Raven 38853895481 and Final Gate 38853895080 passed. All five downloaded packages passed their SHA-256 manifests, provenance, embedded source commit, and common-source digest checks. The Linux pinned-Qt package passed both wallet-disabled GUI smokes without a diagnostic shim.
• Local make -j4 check and the release contract check passed on the current register-only commit 1e58379df7c3ede470f8562711070d2b8152d10a. The dbus fallback passed a forced-primary-failure fetch and rejected altered bytes; the ARM64 CI job used the primary source.
• Build Raven 38805823946 exposed missing Linux Qt runtime and ARM64 dbus fallback dependencies on a synthetic PR merge. FINDING-182 and FINDING-183 record the red evidence and local remedies.

Exact-source CI and package review

• Source SHA: 1e58379df7c3ede470f8562711070d2b8152d10a.
• Build Raven 38885751826 and RIP-25 v4.8 Final Gate 38885752445 both completed successfully on that exact SHA. Both required security jobs passed mandatory make check and 33 of 33 required functional tests. All five release artifact jobs and seven Final Gate build configurations passed.
• All five downloaded Build Raven bundles passed their SHA-256 manifests, provenance checks, embedded source commit checks, and common source archive digest ecc323108253549a6728521aedaf7bb2c9ffc9d62259c9423555392bed661b73. Binary-format and archive-path checks also passed. The packages are unsigned CI outputs.
• Both PR-triggered workflow runs on the same head SHA also passed: Build Raven 38885746538 and Final Gate 38885746301.
• The exact final Linux package binary repeated both FINDING-160 two-binary regtest proofs against Core 4.8.0: the old node rejected an 8,801,324-WU block with bad-blk-length and a PQ block weighing 8,000,697 WU by old accounting with bad-blk-weight; 4.8.1 accepted both. The separate baseline binary and packaged candidate hashes were recorded.
• The exact packaged Linux GUI passed a fresh-wallet regtest startup, local RPC and address ownership checks, and clean shutdown under Xvfb. The exact packaged Windows daemon and CLI passed the same focused checks under Wine. Native Windows and macOS GUI testing remains for release systems. The repeated BIP39 hdseedid metadata value is the inherited, still-open FINDING-036; distinct fresh wallets had distinct files and address ownership.
• The private English LaTeX audit report compiled to a 15-page PDF outside the repository and includes all findings with final status and SHA-bound evidence.

Release gates still open

• Operator readiness and a recorded go/no-go decision before bit 12 STARTED; manual Windows and macOS GUI exercise on release systems; release signatures and signed checksum publication.
• Obtain separate owner approval before creating a tag or publishing a GitHub release.

The status source of truth is doc/RIP-0025-v4.8-security-remediation-register.md. FINDING-067 remains HIGH and OPEN. This PR remains a draft.