From cdac0d0755f29a7dd420e91e331bf3efde45f180 Mon Sep 17 00:00:00 2001
From: keegreil <keegreil@gmail.com>
Date: Tue, 18 Aug 2026 23:44:20 -0400
Subject: [PATCH 01/10] security: harden post-critical appliance candidate

---
 .github/workflows/build.yml                   |  27 +-
 Dockerfile                                    |   6 +-
 boot.tests/BitcoinRpcRecoveryPlannerTests.cs  |   6 +-
 boot.tests/BitcoinZmqNotificationTests.cs     |  20 +-
 boot.tests/PoolConfigValidatorTests.cs        |  24 +-
 boot.tests/SecurityHardeningTests.cs          |  94 ++++++
 boot.tests/ShareAttributionTests.cs           |  76 +++--
 boot.tests/boot.tests.csproj                  |   2 +
 boot.tests/packages.lock.json                 | 296 ++++++++++++++++++
 .../Controllers/BootNetworkController.cs      | 136 +++++---
 .../BitcoinRpcReconciliationService.cs        |  13 +-
 .../HostedServices/BootPeerSyncService.cs     |  31 +-
 boot_portal/HostedServices/DatumServer.cs     |  11 +
 boot_portal/Pages/Index.cshtml                |  12 +-
 boot_portal/Program.cs                        |  69 +++-
 .../Services/BitcoinNotificationHealth.cs     |   5 +-
 .../Services/BitcoinRpcRecoveryPlanner.cs     |  16 +-
 .../Services/BootPeerUdpRelayService.cs       | 197 ------------
 .../Services/BootProtocolStateService.cs      | 143 +++------
 boot_portal/Services/BootShareVerifier.cs     |  22 +-
 .../Services/PeerBundleFetchLimiter.cs        |  52 +++
 boot_portal/Utils/PoolConfigValidator.cs      |  25 +-
 boot_portal/boot_portal.csproj                |   6 +
 boot_portal/packages.lock.json                |  97 ++++++
 docker/boot_portal_config.sample.json         |   5 +-
 .../boot_portal_config.testnet4.sample.json   |   5 +-
 docs/security-hardening-rt-043-049.md         |  48 +++
 update_server.sh                              |  29 +-
 28 files changed, 1053 insertions(+), 420 deletions(-)
 create mode 100644 boot.tests/SecurityHardeningTests.cs
 create mode 100644 boot.tests/packages.lock.json
 create mode 100644 boot_portal/Services/PeerBundleFetchLimiter.cs
 create mode 100644 boot_portal/packages.lock.json
 create mode 100644 docs/security-hardening-rt-043-049.md

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 4130c3b..4fc419b 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -29,13 +29,13 @@ jobs:
           dotnet-version: 9.0.x
 
       - name: Restore app
-        run: dotnet restore boot_portal/boot_portal.csproj
+        run: dotnet restore boot_portal/boot_portal.csproj --locked-mode
 
       - name: Build app
         run: dotnet build boot_portal/boot_portal.csproj --configuration Release --no-restore
 
       - name: Restore tests
-        run: dotnet restore boot.tests/boot.tests.csproj
+        run: dotnet restore boot.tests/boot.tests.csproj --locked-mode
 
       - name: Build tests
         run: dotnet build boot.tests/boot.tests.csproj --configuration Release --no-restore
@@ -43,6 +43,29 @@ jobs:
       - name: Run tests
         run: dotnet test boot.tests/boot.tests.csproj --configuration Release --no-build
 
+      - name: Dependency advisory report
+        run: dotnet list boot_portal/boot_portal.csproj package --vulnerable --include-transitive
+
+      - name: Filesystem vulnerability scan
+        uses: aquasecurity/trivy-action@0.30.0
+        with:
+          scan-type: fs
+          scan-ref: .
+          severity: CRITICAL,HIGH
+          ignore-unfixed: true
+          exit-code: '1'
+
+  secrets:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
   docker:
     runs-on: ubuntu-latest
     needs: dotnet
diff --git a/Dockerfile b/Dockerfile
index 39d15bf..c9e0798 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,13 +1,13 @@
-FROM mcr.microsoft.com/dotnet/sdk:9.0 AS build
+FROM mcr.microsoft.com/dotnet/sdk:9.0@sha256:35048e3a81e6a07c316e7bbbd80d80d2ba705fe5f23a8ed42b6638c8f4c20d30 AS build
 WORKDIR /src
 
 COPY boot_portal/boot_portal.csproj boot_portal/
-RUN dotnet restore boot_portal/boot_portal.csproj
+RUN dotnet restore boot_portal/boot_portal.csproj --locked-mode
 
 COPY . .
 RUN dotnet publish boot_portal/boot_portal.csproj -c Release -o /app/publish /p:UseAppHost=false
 
-FROM mcr.microsoft.com/dotnet/aspnet:9.0-bookworm-slim AS runtime
+FROM mcr.microsoft.com/dotnet/aspnet:9.0-bookworm-slim@sha256:4e376dd15bbc8437d4892367ab0ea06a3ac9fea482d10f92f3c493fe1a2219ad AS runtime
 RUN apt-get update \
     && apt-get install -y --no-install-recommends libsodium23 ca-certificates curl \
     && rm -rf /var/lib/apt/lists/* \
diff --git a/boot.tests/BitcoinRpcRecoveryPlannerTests.cs b/boot.tests/BitcoinRpcRecoveryPlannerTests.cs
index 4c19912..19cd633 100644
--- a/boot.tests/BitcoinRpcRecoveryPlannerTests.cs
+++ b/boot.tests/BitcoinRpcRecoveryPlannerTests.cs
@@ -42,12 +42,12 @@ public void SameHeightReplacementUsesReorganizationPath()
             100,
             "new-block-100");
 
-        CollectionAssert.AreEqual(new long[] { 100 }, plan.Heights.ToArray());
+        CollectionAssert.AreEqual(new long[] { 99, 100 }, plan.Heights.ToArray());
         Assert.IsTrue(plan.Reorganization);
     }
 
     [TestMethod]
-    public void LowerRpcHeightPausesUntilReplacementChainCatchesUp()
+    public void LowerRpcHeightReplaysReplacementTipAndParent()
     {
         BitcoinRpcRecoveryPlan plan = BitcoinRpcRecoveryPlanner.Build(
             101,
@@ -55,7 +55,7 @@ public void LowerRpcHeightPausesUntilReplacementChainCatchesUp()
             100,
             "replacement-block-100");
 
-        Assert.AreEqual(0, plan.Heights.Count);
+        CollectionAssert.AreEqual(new long[] { 99, 100 }, plan.Heights.ToArray());
         Assert.IsTrue(plan.Reorganization);
     }
 
diff --git a/boot.tests/BitcoinZmqNotificationTests.cs b/boot.tests/BitcoinZmqNotificationTests.cs
index ab832d3..d3f6aa0 100644
--- a/boot.tests/BitcoinZmqNotificationTests.cs
+++ b/boot.tests/BitcoinZmqNotificationTests.cs
@@ -128,7 +128,7 @@ public void AttachedNodeRequiresSynchronizedRpcAndRedactsErrors()
             BitcoinRpcUrl = "http://bitcoin:8332",
             BitcoinRpcLagGraceSeconds = 1
         });
-        DateTime nowUtc = DateTime.UtcNow;
+        DateTime nowUtc = DateTime.UtcNow.AddSeconds(2);
         health.RecordRpcFailure(
             "failed http://alice:secret@bitcoin:8332/wallet/private?token=secret",
             nowUtc.AddSeconds(-2));
@@ -171,4 +171,22 @@ public void AttachedNodeReportsDuplicateZmqPublishersWithoutFailingReadiness()
         Assert.IsTrue(snapshot.DegradedReason.Contains("duplicate", StringComparison.OrdinalIgnoreCase));
         Assert.AreEqual(2, snapshot.ZmqTopics.Single(topic => topic.Topic == "hashblock").PublisherCount);
     }
+
+    [TestMethod]
+    public void RepeatedRpcFailuresCannotRenewMiningSafetyGracePeriod()
+    {
+        var health = new BitcoinNotificationHealth(new PoolConfig
+        {
+            BitcoinNotificationMode = BitcoinNotificationModes.AttachedNode,
+            BitcoinRpcUrl = "http://bitcoin:8332",
+            BitcoinRpcLagGraceSeconds = 1
+        });
+        DateTime afterGrace = DateTime.UtcNow.AddSeconds(2);
+
+        health.RecordRpcFailure("warmup", afterGrace.AddMilliseconds(-500));
+        health.RecordRpcFailure("still warming up", afterGrace);
+
+        Assert.IsFalse(health.IsMiningSafe(afterGrace, out string reason));
+        StringAssert.Contains(reason, "unreachable");
+    }
 }
diff --git a/boot.tests/PoolConfigValidatorTests.cs b/boot.tests/PoolConfigValidatorTests.cs
index 83be840..1709894 100644
--- a/boot.tests/PoolConfigValidatorTests.cs
+++ b/boot.tests/PoolConfigValidatorTests.cs
@@ -6,13 +6,16 @@ namespace boot.tests;
 [TestClass]
 public sealed class PoolConfigValidatorTests
 {
+    private const string MainnetPayoutAddress = "bc1qd9m04z95mglaxd9e9accmhyjdlmkfmzjprkq4p";
+
     [TestMethod]
-    public void DefaultCoinbaseTagIsGridPool()
+    public void DefaultConfigurationRequiresExplicitPayoutAddress()
     {
         var config = new PoolConfig();
 
         Assert.AreEqual("Grid Pool", config.CoinbaseTag);
-        CollectionAssert.AreEqual(Array.Empty<string>(), PoolConfigValidator.Validate(config));
+        Assert.IsTrue(PoolConfigValidator.Validate(config).Any(error =>
+            error.Contains("pool_payout_script", StringComparison.OrdinalIgnoreCase)));
     }
 
     [TestMethod]
@@ -120,7 +123,9 @@ public void EmptyCoinbaseTagIsAllowed()
     {
         var config = new PoolConfig
         {
-            CoinbaseTag = string.Empty
+            CoinbaseTag = string.Empty,
+            PoolPayoutScript = MainnetPayoutAddress,
+            EnableAdminApi = false
         };
 
         CollectionAssert.AreEqual(Array.Empty<string>(), PoolConfigValidator.Validate(config));
@@ -196,7 +201,8 @@ public void Testnet4AcceptsTestnetPayoutAddressAndRejectsMainnetAddress()
         var validConfig = new PoolConfig
         {
             BitcoinNetwork = BitcoinScript.Testnet4,
-            PoolPayoutScript = testnetAddress
+            PoolPayoutScript = testnetAddress,
+            EnableAdminApi = false
         };
 
         CollectionAssert.AreEqual(Array.Empty<string>(), PoolConfigValidator.Validate(validConfig));
@@ -240,7 +246,9 @@ public void SovereignModeIsAcceptedForInstallerNodes()
         {
             NodeMode = "sovereign",
             PublicBaseUrl = "http://edge-node.local:5000",
-            DatumPublicHost = "edge-node.local"
+            DatumPublicHost = "edge-node.local",
+            PoolPayoutScript = MainnetPayoutAddress,
+            EnableAdminApi = false
         };
 
         CollectionAssert.AreEqual(Array.Empty<string>(), PoolConfigValidator.Validate(config));
@@ -291,7 +299,8 @@ public void ProductionAcceptsExplicitPublicEndpoints()
             PublicBaseUrl = "https://use1.gridlabs.science",
             DatumPublicHost = "datum-use1.gridlabs.science",
             EnableAdminApi = false,
-            TestingRoundResetMode = "none"
+            TestingRoundResetMode = "none",
+            PoolPayoutScript = MainnetPayoutAddress
         };
 
         CollectionAssert.AreEqual(Array.Empty<string>(), PoolConfigValidator.Validate(config));
@@ -325,7 +334,8 @@ public void ProductionAcceptsStrongAdminKeyWhenAdminApiIsEnabled()
             DatumPublicHost = "datum-use1.gridlabs.science",
             EnableAdminApi = true,
             AdminApiKey = new string('a', 32),
-            TestingRoundResetMode = "none"
+            TestingRoundResetMode = "none",
+            PoolPayoutScript = MainnetPayoutAddress
         };
 
         CollectionAssert.AreEqual(Array.Empty<string>(), PoolConfigValidator.Validate(config));
diff --git a/boot.tests/SecurityHardeningTests.cs b/boot.tests/SecurityHardeningTests.cs
new file mode 100644
index 0000000..d09a50d
--- /dev/null
+++ b/boot.tests/SecurityHardeningTests.cs
@@ -0,0 +1,94 @@
+using System.Net;
+using boot_portal.Controllers;
+using boot_portal.Services;
+using boot_portal.Utils;
+
+namespace boot.tests;
+
+[TestClass]
+public sealed class SecurityHardeningTests
+{
+    private const string MainnetPayoutAddress = "bc1qd9m04z95mglaxd9e9accmhyjdlmkfmzjprkq4p";
+
+    [TestMethod]
+    public void DatumResourceBoundsAreValidated()
+    {
+        var config = ValidConfig();
+        config.DatumMaxConnections = 0;
+        config.DatumReadTimeoutSeconds = 0;
+
+        List<string> errors = PoolConfigValidator.Validate(config);
+
+        Assert.IsTrue(errors.Any(error => error.Contains("datum_max_connections", StringComparison.OrdinalIgnoreCase)));
+        Assert.IsTrue(errors.Any(error => error.Contains("datum_read_timeout_seconds", StringComparison.OrdinalIgnoreCase)));
+    }
+
+    [TestMethod]
+    public void AdminApiRequiresStrongKeyInSovereignMode()
+    {
+        var config = ValidConfig();
+        config.EnableAdminApi = true;
+        config.AdminApiKey = "change-this-admin-key";
+
+        Assert.IsTrue(PoolConfigValidator.Validate(config).Any(error =>
+            error.Contains("admin_api_key", StringComparison.OrdinalIgnoreCase)));
+    }
+
+    [TestMethod]
+    public void StoredMinerLabelIsBoundedAndMarkupFree()
+    {
+        string normalized = BootShareVerifier.NormalizeUsernameForStorage(
+            "<img src=x onerror=alert(1)>worker/../../" + new string('x', 256),
+            MainnetPayoutAddress);
+
+        Assert.IsTrue(normalized.Length <= 128);
+        Assert.IsFalse(normalized.Contains('<'));
+        Assert.IsFalse(normalized.Contains('>'));
+        Assert.IsFalse(normalized.Contains('/'));
+        Assert.IsTrue(normalized.All(value => char.IsAsciiLetterOrDigit(value) || value is '.' or '_' or '-' or ':'));
+    }
+
+    [DataTestMethod]
+    [DataRow("127.0.0.1")]
+    [DataRow("10.1.2.3")]
+    [DataRow("172.16.0.1")]
+    [DataRow("192.168.1.1")]
+    [DataRow("169.254.1.1")]
+    [DataRow("100.64.0.1")]
+    [DataRow("224.0.0.1")]
+    [DataRow("::1")]
+    [DataRow("fe80::1")]
+    [DataRow("fc00::1")]
+    public void ReachabilityProbeRejectsNonPublicDestinations(string value)
+    {
+        Assert.IsTrue(BootNetworkController.IsNonPublicAddress(IPAddress.Parse(value)));
+    }
+
+    [TestMethod]
+    public void ReachabilityProbeAcceptsPublicUnicastDestination()
+    {
+        Assert.IsFalse(BootNetworkController.IsNonPublicAddress(IPAddress.Parse("1.1.1.1")));
+    }
+
+    [TestMethod]
+    public void PeerBundleFetchLimiterBoundsChangingStateIdsPerPeer()
+    {
+        var limiter = new PeerBundleFetchLimiter(2, TimeSpan.FromMinutes(1));
+        DateTime start = new(2026, 8, 19, 0, 0, 0, DateTimeKind.Utc);
+
+        Assert.IsTrue(limiter.TryAcquire("https://peer.example", start));
+        Assert.IsTrue(limiter.TryAcquire("https://peer.example", start.AddSeconds(1)));
+        Assert.IsFalse(limiter.TryAcquire("https://peer.example", start.AddSeconds(2)));
+        Assert.IsTrue(limiter.TryAcquire("https://other.example", start.AddSeconds(2)));
+        Assert.IsTrue(limiter.TryAcquire("https://peer.example", start.AddMinutes(1).AddSeconds(1)));
+    }
+
+    private static PoolConfig ValidConfig()
+    {
+        return new PoolConfig
+        {
+            PoolPayoutScript = MainnetPayoutAddress,
+            EnableAdminApi = false
+        };
+    }
+}
diff --git a/boot.tests/ShareAttributionTests.cs b/boot.tests/ShareAttributionTests.cs
index 56d8c9a..b985572 100644
--- a/boot.tests/ShareAttributionTests.cs
+++ b/boot.tests/ShareAttributionTests.cs
@@ -588,23 +588,23 @@ public async Task ProoflessBootstrapCannotInstallRemoteWinnersOrPaidLineageAsync
     [TestMethod]
     public async Task ProofBackedRemoteStateCannotRewriteUnverifiedPaidLineageAsync()
     {
-        using var remoteHarness = TestHarness.Create(currentTipBlockHash: OlderTipBlockHash);
-        ShareRecordingResult shareResult = await remoteHarness.StateService.SubmitShareAsync(
-            new RecordedShareSubmission
-            {
-                MinerAddress = AlternateAddress,
-                Username = string.Empty,
-                HeaderHex = SampleHeaderHex,
-                CoinbaseHex = SampleCoinbaseHex,
-                MerklePath = SampleMerklePath.ToList(),
-                PrevBlockHash = SamplePrevBlockHash,
-                Source = "datum"
-            },
-            "datum-block");
-        Assert.IsTrue(shareResult.Accepted, shareResult.RejectionReason);
+        byte[] header = Convert.FromHexString(SampleHeaderHex);
+        var proofSet = new List<BootShareProof>();
+        for (uint nonce = 0; nonce < 16; nonce++)
+        {
+            BinaryPrimitives.WriteUInt32LittleEndian(header.AsSpan(76, 4), nonce);
+            proofSet.Add(CreateValidatedProof(
+                Convert.ToHexString(header).ToLowerInvariant(),
+                SamplePrevBlockHash,
+                "seed-current"));
+        }
+
+        using var remoteHarness = TestHarness.Create(
+            currentTipBlockHash: SamplePrevBlockHash,
+            onDeckProofs: proofSet);
 
         RoundRotationResult rotation = await remoteHarness.StateService.RotateToNextRoundAsync(
-            SamplePrevBlockHash,
+            OlderTipBlockHash,
             "test-rotation",
             manual: false,
             blockHeight: 945001,
@@ -613,11 +613,11 @@ public async Task ProofBackedRemoteStateCannotRewriteUnverifiedPaidLineageAsync(
         Assert.IsTrue(remoteBundle.WorkSetProofs.Count > 0);
 
         using var localHarness = TestHarness.Create(
-            currentTipBlockHash: SamplePrevBlockHash,
+            currentTipBlockHash: OlderTipBlockHash,
             currentRoundNumber: remoteBundle.CurrentRoundNumber);
         bool adopted = await localHarness.StateService.TryAdoptCurrentStateAsync(
             remoteBundle,
-            SamplePrevBlockHash,
+            OlderTipBlockHash,
             945001,
             "https://peer.example");
 
@@ -628,7 +628,7 @@ public async Task ProofBackedRemoteStateCannotRewriteUnverifiedPaidLineageAsync(
     }
 
     [TestMethod]
-    public async Task DatumShareOnFreshParentIsAcceptedAndLearnsParentWithoutTipAdvanceAsync()
+    public async Task DatumShareCannotTeachNodeAnUnvalidatedFreshParentAsync()
     {
         using var harness = TestHarness.Create(currentTipBlockHash: OlderTipBlockHash);
 
@@ -643,17 +643,17 @@ public async Task DatumShareOnFreshParentIsAcceptedAndLearnsParentWithoutTipAdva
             Source = "datum"
         }, "datum-block");
 
-        Assert.IsTrue(result.Accepted, result.RejectionReason);
-        Assert.AreEqual(SamplePrevBlockHash, result.AcceptedProof?.PrevBlockHash);
+        Assert.IsFalse(result.Accepted);
+        StringAssert.Contains(result.RejectionReason, "outside the active Bitcoin tip");
 
         BootNetworkStatusDto status = harness.StateService.GetNetworkStatus();
         Assert.AreEqual(OlderTipBlockHash, status.CurrentTipBlockHash);
-        Assert.AreEqual(1, harness.StateService.GetOnDeckList().Count);
+        Assert.AreEqual(0, harness.StateService.GetOnDeckList().Count);
 
         Thread.Sleep(1200);
         PoolState persisted = JsonSerializer.Deserialize<PoolState>(File.ReadAllText(harness.StatePath))!;
         CollectionAssert.Contains(persisted.AcceptedParentBlockHashes, OlderTipBlockHash);
-        CollectionAssert.Contains(persisted.AcceptedParentBlockHashes, SamplePrevBlockHash);
+        CollectionAssert.DoesNotContain(persisted.AcceptedParentBlockHashes, SamplePrevBlockHash);
     }
 
     [TestMethod]
@@ -1360,7 +1360,7 @@ await harness.StateService.ObserveChainTipAsync(
             "test");
 
         Assert.IsFalse(result.Accepted);
-        Assert.AreEqual("New previous-parent proof rejected after the local snapshot boundary.", result.RejectionReason);
+        StringAssert.Contains(result.RejectionReason, "outside the active Bitcoin tip");
         Assert.AreEqual(0, harness.StateService.GetNetworkStatus().WorkSetCount);
     }
 
@@ -1528,6 +1528,36 @@ public async Task V22OneBlockReorgCreatesIsolatedReplacementFamilyAndRestoresLin
         Assert.AreEqual(2, replacement.CurrentRoundNumber);
     }
 
+    [TestMethod]
+    public async Task V22TwoBlockReorgRollsBackRemovedFamiliesBeforeReplacementAsync()
+    {
+        BootShareProof proof = CreateValidatedProof(SampleHeaderHex, SamplePrevBlockHash, "seed-current");
+        BootPayoutSnapshotContext predecessor = CreateSnapshotContext("seed-current", SampleExpectedWinners);
+        using var harness = TestHarness.Create(
+            sharedWinnerSlotCount: 1,
+            onDeckProofs: [proof],
+            snapshotContexts: [predecessor]);
+        string removedFirst = "0000000000000000000000000000000000000000000000000000000000a00601";
+        string removedSecond = "0000000000000000000000000000000000000000000000000000000000a00602";
+        string replacementFirst = "0000000000000000000000000000000000000000000000000000000000b00601";
+
+        await harness.StateService.ObserveChainTipAsync(removedFirst, "local-bitcoin", 945001);
+        BootNetworkStatusDto removed = await harness.StateService.ObserveChainTipAsync(
+            removedSecond,
+            "local-bitcoin",
+            945002);
+        BootNetworkStatusDto replacement = await harness.StateService.ObserveChainTipAsync(
+            replacementFirst,
+            "local-bitcoin-reorg",
+            945001);
+
+        Assert.AreNotEqual(removed.ActiveSnapshotFamilyId, replacement.ActiveSnapshotFamilyId);
+        Assert.AreEqual(replacementFirst, replacement.CurrentTipBlockHash);
+        Assert.AreEqual(945001L, replacement.CurrentTipBlockHeight);
+        Assert.AreEqual(1, replacement.WorkSetCount);
+        Assert.AreEqual(2, replacement.CurrentRoundNumber);
+    }
+
     [TestMethod]
     public async Task V22ReserveOnlySiblingAdditionDoesNotChangeActivePayoutSnapshotAsync()
     {
diff --git a/boot.tests/boot.tests.csproj b/boot.tests/boot.tests.csproj
index d9f7cc2..b350538 100644
--- a/boot.tests/boot.tests.csproj
+++ b/boot.tests/boot.tests.csproj
@@ -5,6 +5,8 @@
         <LangVersion>latest</LangVersion>
         <ImplicitUsings>enable</ImplicitUsings>
         <Nullable>enable</Nullable>
+        <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
+        <RestoreLockedMode Condition="'$(ContinuousIntegrationBuild)' == 'true'">true</RestoreLockedMode>
         <!--
           Displays error on console in addition to the log file. Note that this feature comes with a performance impact.
           For more information, visit https://learn.microsoft.com/dotnet/core/testing/unit-testing-platform-integration-dotnet-test#show-failure-per-test
diff --git a/boot.tests/packages.lock.json b/boot.tests/packages.lock.json
new file mode 100644
index 0000000..5a2fd61
--- /dev/null
+++ b/boot.tests/packages.lock.json
@@ -0,0 +1,296 @@
+{
+  "version": 1,
+  "dependencies": {
+    "net9.0": {
+      "Microsoft.NET.Test.Sdk": {
+        "type": "Direct",
+        "requested": "[17.11.1, )",
+        "resolved": "17.11.1",
+        "contentHash": "U3Ty4BaGoEu+T2bwSko9tWqWUOU16WzSFkq6U8zve75oRBMSLTBdMAZrVNNz1Tq12aCdDom9fcOcM9QZaFHqFg==",
+        "dependencies": {
+          "Microsoft.CodeCoverage": "17.11.1",
+          "Microsoft.TestPlatform.TestHost": "17.11.1"
+        }
+      },
+      "Microsoft.Testing.Extensions.CodeCoverage": {
+        "type": "Direct",
+        "requested": "[17.13.1, )",
+        "resolved": "17.13.1",
+        "contentHash": "Ok2HWJdOTzErMqLlWQZ/i2Fw05VWmgh1yhUWFYJAtUmCv6uJSgz/qAiriRgpTjZRWaKbb7HDaGfMgKSNcmaVfw==",
+        "dependencies": {
+          "Microsoft.DiaSymReader": "2.0.0",
+          "Microsoft.Extensions.DependencyModel": "6.0.1",
+          "Microsoft.Testing.Platform": "1.4.3",
+          "Newtonsoft.Json": "13.0.3",
+          "System.Reflection.Metadata": "8.0.0"
+        }
+      },
+      "Microsoft.Testing.Extensions.TrxReport": {
+        "type": "Direct",
+        "requested": "[1.4.3, )",
+        "resolved": "1.4.3",
+        "contentHash": "JSy1dY8ZpNWV00NZBVAQuqJmC18LOszwRsIz4VSROK06FxoPOz5N19D6FHz9ZKJxn3XieoHWhbvuLFWdz9UJiw==",
+        "dependencies": {
+          "Microsoft.Testing.Extensions.TrxReport.Abstractions": "1.4.3",
+          "Microsoft.Testing.Platform": "1.4.3"
+        }
+      },
+      "MSTest.Analyzers": {
+        "type": "Direct",
+        "requested": "[3.6.4, )",
+        "resolved": "3.6.4",
+        "contentHash": "4gU/VdItLebmE2+UkOaqffVmVa/in0VeIF9fmN/fG0tj5AHAasjasJcZa9U2uXBNX03cKCWlgWenlhKLz343NQ=="
+      },
+      "MSTest.TestAdapter": {
+        "type": "Direct",
+        "requested": "[3.6.4, )",
+        "resolved": "3.6.4",
+        "contentHash": "YdwseRA+nDhRqD2oPHjCE4KzLEN5B10A61lOslE3N3OvUwHJ6ezyZZjYWf7mrZ8jckCcx/UlBclTzgWUpMpPQw==",
+        "dependencies": {
+          "Microsoft.Testing.Extensions.VSTestBridge": "1.4.3",
+          "Microsoft.Testing.Platform.MSBuild": "1.4.3"
+        }
+      },
+      "MSTest.TestFramework": {
+        "type": "Direct",
+        "requested": "[3.6.4, )",
+        "resolved": "3.6.4",
+        "contentHash": "3nV+2CJluKmiJpCSqQfXu5idCq35+vqFywjScyauTIz0Zk7KJw7Qpzv8gtwow0To7pxIlIvwkq9rbMB+V6eOow=="
+      },
+      "AsyncIO": {
+        "type": "Transitive",
+        "resolved": "0.1.69",
+        "contentHash": "xyXJLi+wjy6AtIyWXHXJkPS0gItqVT4lg5w++7bA5YEjugYKdrFMGxCo6KUJ1yYwjriLQJ1g35LDljZs3Q90XQ=="
+      },
+      "BouncyCastle.Cryptography": {
+        "type": "Transitive",
+        "resolved": "2.6.1",
+        "contentHash": "vZsG2YILhthgRqO+ZVgRff4ZFKKTl0v7kqaVBLCtRvpREhfBP33pcWrdA3PRYgWuFL1RxiUFvjMUHTdBZlJcoA=="
+      },
+      "libsodium": {
+        "type": "Transitive",
+        "resolved": "1.0.20.1",
+        "contentHash": "pkiceEqJDQFHjbga3k/oPfTVX9g+GKJZ1VrkuiLhaymt9YNw1Dr7cX9hNuZuNaWcr9WD0moW55k4pMwzQ7JaZQ=="
+      },
+      "LibSodium.Net": {
+        "type": "Transitive",
+        "resolved": "0.16.0-alpha",
+        "contentHash": "uNW5uuT2QEu5zUSDAbNyXM/RPZjnLjMEp88uYMCkH2yr9+jX7LpZsV9JZimdIABKiHivfGqSJAXmj3Bd2tmJUQ==",
+        "dependencies": {
+          "System.Memory": "4.6.0",
+          "libsodium": "1.0.20.1"
+        }
+      },
+      "Microsoft.ApplicationInsights": {
+        "type": "Transitive",
+        "resolved": "2.22.0",
+        "contentHash": "3AOM9bZtku7RQwHyMEY3tQMrHIgjcfRDa6YQpd/QG2LDGvMydSlL9Di+8LLMt7J2RDdfJ7/2jdYv6yHcMJAnNw==",
+        "dependencies": {
+          "System.Diagnostics.DiagnosticSource": "5.0.0"
+        }
+      },
+      "Microsoft.CodeCoverage": {
+        "type": "Transitive",
+        "resolved": "17.11.1",
+        "contentHash": "nPJqrcA5iX+Y0kqoT3a+pD/8lrW/V7ayqnEJQsTonSoPz59J8bmoQhcSN4G8+UJ64Hkuf0zuxnfuj2lkHOq4cA=="
+      },
+      "Microsoft.DiaSymReader": {
+        "type": "Transitive",
+        "resolved": "2.0.0",
+        "contentHash": "QcZrCETsBJqy/vQpFtJc+jSXQ0K5sucQ6NUFbTNVHD4vfZZOwjZ/3sBzczkC4DityhD3AVO/+K/+9ioLs1AgRA=="
+      },
+      "Microsoft.Extensions.DependencyModel": {
+        "type": "Transitive",
+        "resolved": "6.0.1",
+        "contentHash": "AdvrtrqZpMgW4tIAQ/8gE1LAM/FjFY8JrFdyiolOf9WLEfN3WuFG1Hje6n0jqaOs3ldZFGWhatJQHJRrIOd++w==",
+        "dependencies": {
+          "System.Buffers": "4.5.1",
+          "System.Memory": "4.5.4",
+          "System.Runtime.CompilerServices.Unsafe": "6.0.0",
+          "System.Text.Encodings.Web": "6.0.0",
+          "System.Text.Json": "6.0.10"
+        }
+      },
+      "Microsoft.Extensions.ObjectPool": {
+        "type": "Transitive",
+        "resolved": "8.0.10",
+        "contentHash": "u7gAG7JgxF8VSJUGPSudAcPxOt+ymJKQCSxNRxiuKV+klCQbHljQR75SilpedCTfhPWDhtUwIJpnDVtspr9nMg=="
+      },
+      "Microsoft.Testing.Extensions.Telemetry": {
+        "type": "Transitive",
+        "resolved": "1.4.3",
+        "contentHash": "dh8jnqWikxQXJ4kWy8B82PtSAlQCnvDKh1128arDmSW5OU5xWA84HwruV3TanXi3ZjIHn1wWFCgtMOhcDNwBow==",
+        "dependencies": {
+          "Microsoft.ApplicationInsights": "2.22.0",
+          "Microsoft.Testing.Platform": "1.4.3"
+        }
+      },
+      "Microsoft.Testing.Extensions.TrxReport.Abstractions": {
+        "type": "Transitive",
+        "resolved": "1.4.3",
+        "contentHash": "16sWznD6ZMok/zgW+vrO6zerCFMD9N+ey9bi1iV/e9xxsQb4V4y/aW6cY/Y7E9jA7pc+aZ6ffZby43yxQOoYZA==",
+        "dependencies": {
+          "Microsoft.Testing.Platform": "1.4.3"
+        }
+      },
+      "Microsoft.Testing.Extensions.VSTestBridge": {
+        "type": "Transitive",
+        "resolved": "1.4.3",
+        "contentHash": "xZ6oyNYh2aM5Wb+HJAy1fj2C4CNRVhINXHCjlWs/2C8hEIpdqVSpP3y6HWUN40KpFqyGD4myHGR1Rflm28UpcQ==",
+        "dependencies": {
+          "Microsoft.ApplicationInsights": "2.22.0",
+          "Microsoft.TestPlatform.ObjectModel": "17.11.1",
+          "Microsoft.Testing.Extensions.Telemetry": "1.4.3",
+          "Microsoft.Testing.Extensions.TrxReport.Abstractions": "1.4.3",
+          "Microsoft.Testing.Platform": "1.4.3"
+        }
+      },
+      "Microsoft.Testing.Platform": {
+        "type": "Transitive",
+        "resolved": "1.4.3",
+        "contentHash": "NedIbwl1T7+ZMeg7gwk0Db8/RFLf0siyVpeTcRMMOle6Xl/ujaYOM4Aduo8rEfVqNj3kcQ7blegpyT3dHi+0PA=="
+      },
+      "Microsoft.Testing.Platform.MSBuild": {
+        "type": "Transitive",
+        "resolved": "1.4.3",
+        "contentHash": "1gGqgHtiZ6tZn/6Tby+qlKpNe5Ye/5LnxlSsyl4XMZ4m4V+Cu1K1m+gD1zxoxHIvLjgX8mCnQRK95MGBBFuumw==",
+        "dependencies": {
+          "Microsoft.Testing.Platform": "1.4.3"
+        }
+      },
+      "Microsoft.TestPlatform.ObjectModel": {
+        "type": "Transitive",
+        "resolved": "17.11.1",
+        "contentHash": "E2jZqAU6JeWEVsyOEOrSW1o1bpHLgb25ypvKNB/moBXPVsFYBPd/Jwi7OrYahG50J83LfHzezYI+GaEkpAotiA==",
+        "dependencies": {
+          "System.Reflection.Metadata": "1.6.0"
+        }
+      },
+      "Microsoft.TestPlatform.TestHost": {
+        "type": "Transitive",
+        "resolved": "17.11.1",
+        "contentHash": "DnG+GOqJXO/CkoqlJWeDFTgPhqD/V6VqUIL3vINizCWZ3X+HshCtbbyDdSHQQEjrc2Sl/K3yaxX6s+5LFEdYuw==",
+        "dependencies": {
+          "Microsoft.TestPlatform.ObjectModel": "17.11.1",
+          "Newtonsoft.Json": "13.0.1"
+        }
+      },
+      "NaCl.Net": {
+        "type": "Transitive",
+        "resolved": "0.1.13",
+        "contentHash": "AVg1455RQnyTy6tiessudruZHvbl70QWRPyx3og2I1Fei17LDNc7Z3DRgqN2+PsySBui/1EDP4A7adhQXydi6g=="
+      },
+      "NetMQ": {
+        "type": "Transitive",
+        "resolved": "4.0.2.2",
+        "contentHash": "G2dNt5Fcv/wdZOwTkUksJBe8RUc4wJn38FTZw8UmH5tcEkPi3KM8ME8igJ1fR+1msNpEKfLzEfgJOA6RpOE1jA==",
+        "dependencies": {
+          "AsyncIO": "0.1.69",
+          "NaCl.Net": "0.1.13",
+          "System.ServiceModel.Primitives": "8.1.2"
+        }
+      },
+      "Newtonsoft.Json": {
+        "type": "Transitive",
+        "resolved": "13.0.3",
+        "contentHash": "HrC5BXdl00IP9zeV+0Z848QWPAoCr9P3bDEZguI+gkLcBKAOxix/tLEAAHC+UvDNPv4a2d18lOReHMOagPa+zQ=="
+      },
+      "NSec.Cryptography": {
+        "type": "Transitive",
+        "resolved": "25.4.0",
+        "contentHash": "Z3wPpG0xefMLmhn9T+Ka/EzAmMQPT0THL/5E4lf9cXI/N9rbGH0G23ZFpRcPnD0ast2k7ieG6QSVNIjmfPCXBQ==",
+        "dependencies": {
+          "libsodium": "[1.0.20.1, 1.0.21)"
+        }
+      },
+      "System.Buffers": {
+        "type": "Transitive",
+        "resolved": "4.5.1",
+        "contentHash": "Rw7ijyl1qqRS0YQD/WycNst8hUUMgrMH4FCn1nNm27M4VxchZ1js3fVjQaANHO5f3sN4isvP4a+Met9Y4YomAg=="
+      },
+      "System.Collections.Immutable": {
+        "type": "Transitive",
+        "resolved": "8.0.0",
+        "contentHash": "AurL6Y5BA1WotzlEvVaIDpqzpIPvYnnldxru8oXJU2yFxFUy3+pNXjXd1ymO+RA0rq0+590Q8gaz2l3Sr7fmqg=="
+      },
+      "System.CommandLine": {
+        "type": "Transitive",
+        "resolved": "2.0.0-beta4.22272.1",
+        "contentHash": "1uqED/q2H0kKoLJ4+hI2iPSBSEdTuhfCYADeJrAqERmiGQ2NNacYKRNEQ+gFbU4glgVyK8rxI+ZOe1onEtr/Pg=="
+      },
+      "System.Diagnostics.DiagnosticSource": {
+        "type": "Transitive",
+        "resolved": "5.0.0",
+        "contentHash": "tCQTzPsGZh/A9LhhA6zrqCRV4hOHsK90/G7q3Khxmn6tnB1PuNU0cRaKANP2AWcF9bn0zsuOoZOSrHuJk6oNBA=="
+      },
+      "System.Memory": {
+        "type": "Transitive",
+        "resolved": "4.6.0",
+        "contentHash": "OEkbBQoklHngJ8UD8ez2AERSk2g+/qpAaSWWCBFbpH727HxDq5ydVkuncBaKcKfwRqXGWx64dS6G1SUScMsitg=="
+      },
+      "System.Reflection.Metadata": {
+        "type": "Transitive",
+        "resolved": "8.0.0",
+        "contentHash": "ptvgrFh7PvWI8bcVqG5rsA/weWM09EnthFHR5SCnS6IN+P4mj6rE1lBDC4U8HL9/57htKAqy4KQ3bBj84cfYyQ==",
+        "dependencies": {
+          "System.Collections.Immutable": "8.0.0"
+        }
+      },
+      "System.Runtime.CompilerServices.Unsafe": {
+        "type": "Transitive",
+        "resolved": "6.0.0",
+        "contentHash": "/iUeP3tq1S0XdNNoMz5C9twLSrM/TH+qElHkXWaPvuNOt+99G75NrV0OS2EqHx5wMN7popYjpc8oTjC1y16DLg=="
+      },
+      "System.Security.Cryptography.Pkcs": {
+        "type": "Transitive",
+        "resolved": "9.0.18",
+        "contentHash": "NKMKhUdLGNZryY9GXXTF5dXyP6S37EYXhiA2JYvwshJbd4DRq07IOS9it8Opi9atadvv5rlNkD76Mio+5Oo2aQ=="
+      },
+      "System.Security.Cryptography.Xml": {
+        "type": "Transitive",
+        "resolved": "9.0.18",
+        "contentHash": "UoE37brJoIJPMds6wqDaweVrORmdM3XDPGLRU01Mg6Koh3SjgogSfz4+zDsriaEluHMRCx/Qc7yeEw7F9QMcJA==",
+        "dependencies": {
+          "System.Security.Cryptography.Pkcs": "9.0.18"
+        }
+      },
+      "System.ServiceModel.Primitives": {
+        "type": "Transitive",
+        "resolved": "8.1.2",
+        "contentHash": "xlJ07FAUSDjPL/GhvVY1/KVPWn2ce056X4nHPwqAa5rkNLiNN5rqh6VcgMUoF6J7ckwhkVJ1vVx/K/47nyyR9g==",
+        "dependencies": {
+          "Microsoft.Extensions.ObjectPool": "8.0.10",
+          "System.Security.Cryptography.Xml": "8.0.2"
+        }
+      },
+      "System.Text.Encodings.Web": {
+        "type": "Transitive",
+        "resolved": "6.0.0",
+        "contentHash": "Vg8eB5Tawm1IFqj4TVK1czJX89rhFxJo9ELqc/Eiq0eXy13RK00eubyU6TJE6y+GQXjyV5gSfiewDUZjQgSE0w==",
+        "dependencies": {
+          "System.Runtime.CompilerServices.Unsafe": "6.0.0"
+        }
+      },
+      "System.Text.Json": {
+        "type": "Transitive",
+        "resolved": "6.0.10",
+        "contentHash": "NSB0kDipxn2ychp88NXWfFRFlmi1bst/xynOutbnpEfRCT9JZkZ7KOmF/I/hNKo2dILiMGnqblm+j1sggdLB9g==",
+        "dependencies": {
+          "System.Runtime.CompilerServices.Unsafe": "6.0.0",
+          "System.Text.Encodings.Web": "6.0.0"
+        }
+      },
+      "boot_portal": {
+        "type": "Project",
+        "dependencies": {
+          "BouncyCastle.Cryptography": "[2.6.1, )",
+          "LibSodium.Net": "[0.16.0-alpha, )",
+          "NSec.Cryptography": "[25.4.0, )",
+          "NetMQ": "[4.0.2.2, )",
+          "System.CommandLine": "[2.0.0-beta4.22272.1, )",
+          "System.Security.Cryptography.Xml": "[9.0.18, )"
+        }
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/boot_portal/Controllers/BootNetworkController.cs b/boot_portal/Controllers/BootNetworkController.cs
index 52163df..542a22d 100644
--- a/boot_portal/Controllers/BootNetworkController.cs
+++ b/boot_portal/Controllers/BootNetworkController.cs
@@ -2,7 +2,7 @@
 using boot_portal.Models;
 using System.Diagnostics;
 using System.Net;
-using System.Security.Cryptography;
+using System.Net.Sockets;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.RateLimiting;
 
@@ -68,6 +68,17 @@ public IActionResult GetPeerAddresses([FromQuery] int limit = 128)
     [HttpPost("reachability-test")]
     public async Task<IActionResult> RunReachabilityTest([FromBody] BootReachabilityProbeRequest? request, CancellationToken cancellationToken)
     {
+        if (!_poolConfig.EnableAdminApi)
+        {
+            return NotFound();
+        }
+
+        string? apiKey = Request.Headers["X-Boot-Admin-Key"].FirstOrDefault();
+        if (!_stateService.IsAdminAuthorized(apiKey))
+        {
+            return Unauthorized(new { status = "rejected", reason = "Missing or invalid admin key" });
+        }
+
         if (request == null || string.IsNullOrWhiteSpace(request.TargetBaseUrl))
         {
             return BadRequest(new { status = "rejected", reason = "targetBaseUrl is required" });
@@ -79,14 +90,19 @@ public async Task<IActionResult> RunReachabilityTest([FromBody] BootReachability
             return BadRequest(new { status = "rejected", reason = rejectionReason });
         }
 
+        if (!await IsPublicReachabilityTargetAsync(targetBaseUri, cancellationToken))
+        {
+            return BadRequest(new { status = "rejected", reason = "targetBaseUrl must resolve only to public unicast addresses" });
+        }
+
         var result = new BootReachabilityProbeResult
         {
             TargetBaseUrl = targetBaseUri.ToString().TrimEnd('/'),
             TestedAtUtc = DateTime.UtcNow,
-            ObservedRequesterIp = HttpContext.Connection.RemoteIpAddress?.ToString() ?? string.Empty
+            ObservedRequesterIp = string.Empty
         };
 
-        using HttpClient client = _httpClientFactory.CreateClient("BootPeerClient");
+        using HttpClient client = _httpClientFactory.CreateClient("ReachabilityProbeClient");
         await ProbeHttpAsync(client, new Uri(targetBaseUri, "/health"), cancellationToken, (status, latency, warning) =>
         {
             result.HttpStatusCode = status;
@@ -123,37 +139,8 @@ public async Task<IActionResult> RunReachabilityTest([FromBody] BootReachability
         if (request.IncludeUdpProbe && request.UdpPort is > 0 and <= 65535)
         {
             result.UdpProbeAttempted = true;
-            result.UdpHost = string.IsNullOrWhiteSpace(request.UdpHost)
-                ? targetBaseUri.Host
-                : request.UdpHost.Trim();
             result.UdpPort = request.UdpPort.Value;
-            string nonce = string.IsNullOrWhiteSpace(request.UdpChallengeNonce)
-                ? Convert.ToHexString(RandomNumberGenerator.GetBytes(16)).ToLowerInvariant()
-                : request.UdpChallengeNonce.Trim();
-            result.UdpChallengeNonce = nonce;
-            _udpRelayService.RegisterReachabilityChallenge(nonce, result.TargetBaseUrl);
-            string ackUrl = $"{Request.Scheme}://{Request.Host}/api/network/reachability-ack";
-            result.UdpProbeSent = await _udpRelayService.SendReachabilityProbeAsync(
-                result.UdpHost,
-                request.UdpPort.Value,
-                nonce,
-                ackUrl,
-                result.TargetBaseUrl,
-                cancellationToken);
-            if (result.UdpProbeSent)
-            {
-                await Task.Delay(TimeSpan.FromMilliseconds(500), cancellationToken);
-                result.UdpChallengeAcknowledged = _udpRelayService.WasReachabilityChallengeAcknowledged(nonce);
-            }
-
-            if (!result.UdpProbeSent)
-            {
-                result.Warnings.Add("UDP probe could not be sent. This does not prove the UDP relay is unreachable.");
-            }
-            else if (!result.UdpChallengeAcknowledged)
-            {
-                result.Warnings.Add("UDP probe was sent, but no challenge ack was observed before the short timeout.");
-            }
+            result.Warnings.Add("Plaintext UDP reachability probes are disabled; use authenticated peer-session telemetry.");
         }
 
         result.Summary = BuildReachabilitySummary(result);
@@ -169,15 +156,7 @@ public async Task<IActionResult> RunReachabilityTest([FromBody] BootReachability
     [HttpPost("reachability-ack")]
     public IActionResult AckReachabilityProbe([FromBody] BootUdpReachabilityAckRequest? request)
     {
-        if (request == null || string.IsNullOrWhiteSpace(request.Nonce))
-        {
-            return BadRequest(new { status = "rejected", reason = "nonce is required" });
-        }
-
-        bool accepted = _udpRelayService.AcknowledgeReachabilityChallenge(
-            request.Nonce,
-            request.TargetBaseUrl);
-        return Ok(new { status = accepted ? "accepted" : "unknown", accepted });
+        return NotFound();
     }
 
     [EnableRateLimiting("admin-write")]
@@ -227,6 +206,79 @@ private static bool TryNormalizeReachabilityTarget(string target, out Uri? norma
         return true;
     }
 
+    internal static async Task<bool> IsPublicReachabilityTargetAsync(Uri target, CancellationToken cancellationToken)
+    {
+        IPAddress[] addresses;
+        try
+        {
+            addresses = await Dns.GetHostAddressesAsync(target.Host, cancellationToken);
+        }
+        catch (Exception ex) when (ex is SocketException or OperationCanceledException or ArgumentException)
+        {
+            return false;
+        }
+
+        return addresses.Length > 0 && addresses.All(address => !IsNonPublicAddress(address));
+    }
+
+    internal static bool IsNonPublicAddress(IPAddress address)
+    {
+        if (address.IsIPv4MappedToIPv6)
+        {
+            address = address.MapToIPv4();
+        }
+
+        if (IPAddress.IsLoopback(address) || address.Equals(IPAddress.Any) || address.Equals(IPAddress.IPv6Any))
+        {
+            return true;
+        }
+
+        byte[] bytes = address.GetAddressBytes();
+        if (address.AddressFamily == System.Net.Sockets.AddressFamily.InterNetwork)
+        {
+            return bytes[0] == 0 || bytes[0] == 10 || bytes[0] == 127 || bytes[0] >= 224 ||
+                   (bytes[0] == 100 && bytes[1] is >= 64 and <= 127) ||
+                   (bytes[0] == 169 && bytes[1] == 254) ||
+                   (bytes[0] == 172 && bytes[1] is >= 16 and <= 31) ||
+                   (bytes[0] == 192 && bytes[1] == 168);
+        }
+
+        return address.IsIPv6LinkLocal || address.IsIPv6Multicast || address.IsIPv6SiteLocal ||
+               (bytes.Length == 16 && (bytes[0] & 0xfe) == 0xfc);
+    }
+
+    internal static async ValueTask<Stream> ConnectToPublicHostAsync(
+        SocketsHttpConnectionContext context,
+        CancellationToken cancellationToken)
+    {
+        IPAddress[] addresses = await Dns.GetHostAddressesAsync(context.DnsEndPoint.Host, cancellationToken);
+        IPAddress[] publicAddresses = addresses.Where(address => !IsNonPublicAddress(address)).ToArray();
+        if (publicAddresses.Length == 0 || publicAddresses.Length != addresses.Length)
+        {
+            throw new HttpRequestException("Reachability target resolved to a non-public address.");
+        }
+
+        Exception? lastError = null;
+        foreach (IPAddress address in publicAddresses)
+        {
+            var socket = new Socket(address.AddressFamily, SocketType.Stream, ProtocolType.Tcp);
+            try
+            {
+                await socket.ConnectAsync(
+                    new IPEndPoint(address, context.DnsEndPoint.Port),
+                    cancellationToken);
+                return new NetworkStream(socket, ownsSocket: true);
+            }
+            catch (Exception ex) when (ex is SocketException or OperationCanceledException)
+            {
+                socket.Dispose();
+                lastError = ex;
+            }
+        }
+
+        throw new HttpRequestException("Reachability target connection failed.", lastError);
+    }
+
     private static async Task ProbeHttpAsync(
         HttpClient client,
         Uri uri,
diff --git a/boot_portal/HostedServices/BitcoinRpcReconciliationService.cs b/boot_portal/HostedServices/BitcoinRpcReconciliationService.cs
index 21f5451..0273409 100644
--- a/boot_portal/HostedServices/BitcoinRpcReconciliationService.cs
+++ b/boot_portal/HostedServices/BitcoinRpcReconciliationService.cs
@@ -124,21 +124,13 @@ private async Task<int> ReconcileTipAsync(
             localHash,
             rpcHeight,
             rpcBestHash);
-        if (plan.Reorganization && plan.Heights.Count == 0)
-        {
-            _health.RecordRpcTipMismatch(
-                $"Bitcoin RPC active height {rpcHeight} is behind GridPool observed height {localHeight}; waiting for the replacement chain before resuming mining.",
-                DateTime.UtcNow);
-            return 0;
-        }
-
         int recovered = 0;
         foreach (long height in plan.Heights)
         {
             string hash = height == rpcHeight
                 ? rpcBestHash
                 : await _rpcClient.GetBlockHashAsync(height, cancellationToken);
-            await ObserveRpcBlockAsync(height, hash, cancellationToken);
+            await ObserveRpcBlockAsync(height, hash, plan.Reorganization, cancellationToken);
             if (!plan.EstablishesBaseline)
             {
                 recovered++;
@@ -151,6 +143,7 @@ private async Task<int> ReconcileTipAsync(
     private async Task ObserveRpcBlockAsync(
         long height,
         string blockHash,
+        bool reorganization,
         CancellationToken cancellationToken)
     {
         string headerHex = await _rpcClient.GetBlockHeaderHexAsync(blockHash, cancellationToken);
@@ -162,7 +155,7 @@ private async Task ObserveRpcBlockAsync(
             height);
         await _stateService.ObserveChainTipAsync(
             blockHash,
-            "rpc-reconcile",
+            reorganization ? "rpc-reconcile-reorg" : "rpc-reconcile",
             height);
     }
 
diff --git a/boot_portal/HostedServices/BootPeerSyncService.cs b/boot_portal/HostedServices/BootPeerSyncService.cs
index 1eee8a0..508b25f 100644
--- a/boot_portal/HostedServices/BootPeerSyncService.cs
+++ b/boot_portal/HostedServices/BootPeerSyncService.cs
@@ -18,6 +18,7 @@ public class BootPeerSyncService : BackgroundService
     private readonly IHttpClientFactory _httpClientFactory;
     private readonly ILogger<BootPeerSyncService> _logger;
     private readonly BootPeerLoopHealth _loopHealth;
+    private readonly PeerBundleFetchLimiter _bundleFetchLimiter;
 
     public BootPeerSyncService(
         PoolConfig poolConfig,
@@ -35,6 +36,9 @@ public BootPeerSyncService(
         _httpClientFactory = httpClientFactory;
         _logger = logger;
         _loopHealth = loopHealth;
+        _bundleFetchLimiter = new PeerBundleFetchLimiter(
+            Math.Max(1, poolConfig.PeerStateBundleFetchRateLimitPerMinute),
+            TimeSpan.FromMinutes(1));
     }
 
     protected override async Task ExecuteAsync(CancellationToken stoppingToken)
@@ -306,6 +310,12 @@ private async Task PollPeerAsync(string peer, CancellationToken stoppingToken)
             !string.Equals(remote.CurrentStateId, local.CurrentStateId, StringComparison.OrdinalIgnoreCase) &&
             ShouldFetchRemoteCurrentState(local, remote))
         {
+            if (!_bundleFetchLimiter.TryAcquire(remoteEndpoint, DateTime.UtcNow))
+            {
+                RecordBundleFetchRateLimit(remoteEndpoint, remote.CurrentStateId);
+                return;
+            }
+
             BootStateBundle? lockedBundle = await client.GetFromJsonAsync<BootStateBundle>(
                 $"{remoteEndpoint}/api/network/state/{remote.CurrentStateId}",
                 stoppingToken);
@@ -349,12 +359,17 @@ await _stateService.TrySyncCurrentRoundMetadataAsync(
         }
 
         if (string.IsNullOrWhiteSpace(remote.CandidateStateId) ||
-            string.Equals(remote.CandidateStateId, local.CandidateStateId, StringComparison.OrdinalIgnoreCase) ||
-            remote.OnDeckTotalDifficulty <= local.OnDeckTotalDifficulty)
+            string.Equals(remote.CandidateStateId, local.CandidateStateId, StringComparison.OrdinalIgnoreCase))
         {
             return;
         }
 
+        if (!_bundleFetchLimiter.TryAcquire(remoteEndpoint, DateTime.UtcNow))
+        {
+            RecordBundleFetchRateLimit(remoteEndpoint, remote.CandidateStateId);
+            return;
+        }
+
         using HttpResponseMessage bundleResponse = await client.GetAsync(
             $"{remoteEndpoint}/api/network/state/{remote.CandidateStateId}",
             stoppingToken);
@@ -377,6 +392,18 @@ await _stateService.TrySyncCurrentRoundMetadataAsync(
         await _stateService.TryImportCandidateStateAsync(bundle, remoteEndpoint);
     }
 
+    private void RecordBundleFetchRateLimit(string remoteEndpoint, string stateId)
+    {
+        _logger.LogWarning(
+            "Deferred state bundle {StateId} from {Peer}: per-peer fetch budget exhausted.",
+            stateId,
+            remoteEndpoint);
+        _stateService.RecordExternalNetworkEvent(
+            "peer-state-bundle-fetch-rate-limited",
+            remoteEndpoint,
+            "Deferred outbound state bundle fetch because the peer exhausted its per-minute budget.");
+    }
+
     private async Task FetchPeerAddressesAsync(HttpClient client, string remoteEndpoint, CancellationToken stoppingToken)
     {
         try
diff --git a/boot_portal/HostedServices/DatumServer.cs b/boot_portal/HostedServices/DatumServer.cs
index 1587962..63ea938 100644
--- a/boot_portal/HostedServices/DatumServer.cs
+++ b/boot_portal/HostedServices/DatumServer.cs
@@ -16,6 +16,7 @@ public class DatumServer : BackgroundService
     private readonly BootProtocolStateService _stateService;
     private readonly ILogger<DatumServer> _logger;
     private readonly ConcurrentDictionary<int, (TcpClient Client, ClientHandler Handler)> _activeClients = new();
+    private readonly SemaphoreSlim _connectionSlots;
     private int _nextClientId;
 
     public static BootProtocolStateService StateService { get; private set; } = null!;
@@ -42,6 +43,7 @@ public DatumServer(
         _poolConfig = poolConfig;
         _stateService = stateService;
         _logger = logger;
+        _connectionSlots = new SemaphoreSlim(poolConfig.DatumMaxConnections, poolConfig.DatumMaxConnections);
         StateService = stateService;
         PoolPort = port;
         _stateService.WinnersListChanged += HandleWinnersListChangedAsync;
@@ -69,6 +71,14 @@ protected override async Task ExecuteAsync(CancellationToken stoppingToken)
         while (!stoppingToken.IsCancellationRequested)
         {
             var client = await _listener.AcceptTcpClientAsync(stoppingToken);
+            if (!_connectionSlots.Wait(0))
+            {
+                _logger.LogWarning(
+                    "Rejected DATUM connection because the configured limit of {Limit} active sessions was reached.",
+                    _poolConfig.DatumMaxConnections);
+                client.Dispose();
+                continue;
+            }
             int clientId = Interlocked.Increment(ref _nextClientId);
             var clientHandler = new ClientHandler(client, _serverKey, _serverXKey, _poolConfig, _stateService, stoppingToken);
             _activeClients[clientId] = (client, clientHandler);
@@ -82,6 +92,7 @@ protected override async Task ExecuteAsync(CancellationToken stoppingToken)
                 {
                     _activeClients.TryRemove(clientId, out _);
                     client.Dispose();
+                    _connectionSlots.Release();
                 }
             }, stoppingToken);
         }
diff --git a/boot_portal/Pages/Index.cshtml b/boot_portal/Pages/Index.cshtml
index 01e8248..8ba9968 100644
--- a/boot_portal/Pages/Index.cshtml
+++ b/boot_portal/Pages/Index.cshtml
@@ -2202,9 +2202,9 @@
         const submittedBase = getBaseMinerAddress(submitted);
         const credited = getAttributionAddress(item);
         if (submitted && submittedBase && credited && normalizeSearchValue(submittedBase) !== normalizeSearchValue(credited)) {
-            return `Credited to ${label}; submitted username ${submitted}`;
+            return escapeHtml(`Credited to ${label}; submitted username ${submitted}`);
         }
-        return label;
+        return escapeHtml(label);
     }
 
     function minerMatchesSearch(item, term = currentSearchValue()) {
@@ -3449,7 +3449,7 @@
         if (kind === "manual-reset") return "manual";
         if (kind.startsWith("adopted-state:")) return "adopted";
         if (kind.startsWith("bootstrap-state:")) return "bootstrap";
-        return kind.replace(/[:_]/g, " ");
+        return String(kind).replace(/[^A-Za-z0-9 :_.-]/g, "_").replace(/[:_]/g, " ");
     }
 
     function roundHistoryDisplayOrder(history) {
@@ -4051,7 +4051,7 @@
         if (!recipients || recipients.length === 0) return "No payouts";
         return recipients.slice(0, 3).map(entry => {
             const label = formatAttributionLabel(entry);
-            return `${label} ${formatPercent(entry.totalValue, totalValue)}`;
+            return `${escapeHtml(label)} ${escapeHtml(formatPercent(entry.totalValue, totalValue))}`;
         }).join(" · ");
     }
 
@@ -4264,7 +4264,7 @@
 
             return recipients.map(item => `
                 <tr class="${recipientMatchesSearch(item) ? 'highlight-row' : ''}">
-                    <td class="${isLottery || isBusiness ? 'full-label' : 'compact-label'}" title="${attributionTitle(item)}">${formatAttributionLabel(item, isLottery || isBusiness)}</td>
+                    <td class="${isLottery || isBusiness ? 'full-label' : 'compact-label'}" title="${attributionTitle(item)}">${escapeHtml(formatAttributionLabel(item, isLottery || isBusiness))}</td>
                     <td>${item.slotCount}</td>
                     <td>${formatBtcFromSats(item.totalValue)}</td>
                     <td>${formatPercent(item.totalValue, totalValue)}</td>
@@ -4693,7 +4693,7 @@
 
             const btcValue = payout.value / 100000000.0;
             const useFullLabel = listViewModes[tableId] === 'full';
-            const formattedAddr = formatAttributionLabel(payout, useFullLabel);
+            const formattedAddr = escapeHtml(formatAttributionLabel(payout, useFullLabel));
             const diffVal = payout.difficulty || 0;
             const diffDisplay = payout.diffString || diffVal.toLocaleString(undefined, {maximumFractionDigits: 2});
 
diff --git a/boot_portal/Program.cs b/boot_portal/Program.cs
index 0eda198..554c590 100644
--- a/boot_portal/Program.cs
+++ b/boot_portal/Program.cs
@@ -15,6 +15,7 @@
 using boot_portal.HostedServices;
 using boot_portal.Services;
 using boot_portal.Utils;
+using boot_portal.Controllers;
 using Microsoft.AspNetCore.RateLimiting;
 using NSec.Cryptography;
 using Microsoft.AspNetCore.SignalR;
@@ -55,7 +56,7 @@ public class PoolConfig
     public string BitcoinNetwork { get; set; } = BitcoinScript.Mainnet;
 
     [JsonPropertyName("pool_payout_script")]
-    public string PoolPayoutScript { get; set; } = "bc1qrwsx8fs0l6z7ugp5cvzy6lhss7jlyru3kg9s8y"; //TODO: hard coded default address? 
+    public string PoolPayoutScript { get; set; } = string.Empty;
 
     [JsonPropertyName("winners_list_size")]
     public int WinnersListSize { get; set; } = 299;
@@ -216,6 +217,9 @@ public class PoolConfig
     [JsonPropertyName("peer_write_rate_limit_per_minute")]
     public int PeerWriteRateLimitPerMinute { get; set; } = 3000;
 
+    [JsonPropertyName("peer_state_bundle_fetch_rate_limit_per_minute")]
+    public int PeerStateBundleFetchRateLimitPerMinute { get; set; } = 12;
+
     [JsonPropertyName("enable_peer_persistent_sessions")]
     public bool EnablePeerPersistentSessions { get; set; } = true;
 
@@ -338,6 +342,12 @@ public class PoolConfig
     [JsonPropertyName("max_share_request_bytes")]
     public int MaxShareRequestBytes { get; set; } = 262144;
 
+    [JsonPropertyName("datum_max_connections")]
+    public int DatumMaxConnections { get; set; } = 32;
+
+    [JsonPropertyName("datum_read_timeout_seconds")]
+    public int DatumReadTimeoutSeconds { get; set; } = 15;
+
     [JsonPropertyName("max_coinbase_hex_chars")]
     public int MaxCoinbaseHexChars { get; set; } = 100000;
 
@@ -755,6 +765,14 @@ public static async Task Main(string[] args)
             {
                 client.Timeout = TimeSpan.FromSeconds(Math.Max(2, _poolConfig.PeerRequestTimeoutSeconds));
             });
+            builder.Services.AddHttpClient("ReachabilityProbeClient", client =>
+            {
+                client.Timeout = TimeSpan.FromSeconds(Math.Max(2, _poolConfig.PeerRequestTimeoutSeconds));
+            }).ConfigurePrimaryHttpMessageHandler(() => new SocketsHttpHandler
+            {
+                AllowAutoRedirect = false,
+                ConnectCallback = BootNetworkController.ConnectToPublicHostAsync
+            });
             builder.Services.AddHttpClient<BitcoinRpcClient>(client =>
             {
                 client.Timeout = TimeSpan.FromSeconds(Math.Max(1, _poolConfig.BitcoinRpcTimeoutSeconds));
@@ -842,6 +860,19 @@ await context.HttpContext.Response.WriteAsJsonAsync(
             // 2. Configure the web app
             app.Use(async (context, next) =>
             {
+                context.Response.OnStarting(() =>
+                {
+                    context.Response.Headers["Content-Security-Policy"] =
+                        "default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; " +
+                        "script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://cdnjs.cloudflare.com; " +
+                        "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; " +
+                        "font-src 'self' https://fonts.gstatic.com data:; img-src 'self' data:; " +
+                        "connect-src 'self' ws: wss: https://mempool.space";
+                    context.Response.Headers["X-Content-Type-Options"] = "nosniff";
+                    context.Response.Headers["Referrer-Policy"] = "no-referrer";
+                    return Task.CompletedTask;
+                });
+
                 if (IsPeerOnlyListenerRequest(context, _poolConfig) &&
                     !IsAllowedPeerOnlyPath(context.Request.Path))
                 {
@@ -1159,11 +1190,17 @@ public ClientHandler(
         _x25519KeyLongTerm = serverLongTermXKey;
         _poolConfig = poolConfig;
         _stateService = stateService;
-        _clientPayoutAddress = BootProtocolStateService.GetGenesisFoundationAddress(_poolConfig.BitcoinNetwork);
+        _clientPayoutAddress = BitcoinScript.NormalizeAddress(_poolConfig.PoolPayoutScript);
+        _sessionPayoutAddressLocked = IsValidAddress(_clientPayoutAddress);
         _stoppingToken = st;
         _sessionStartedUtc = DateTime.UtcNow;
         _sessionId = $"datum-{Interlocked.Increment(ref _nextSessionId)}";
         _stateService.RecordDatumSessionOpened(_sessionId, RemoteEndpointLabel, _sessionStartedUtc);
+        if (_sessionPayoutAddressLocked)
+        {
+            RememberClientPayoutAddress(_clientPayoutAddress);
+            _stateService.RecordDatumSessionPayoutLock(_sessionId, _clientPayoutAddress);
+        }
         RecordDatumProtocolEvent(new BootDatumProtocolEvent
         {
             Direction = "internal",
@@ -1286,10 +1323,12 @@ private void RecordPowSubmitProtocolOutcome(
 
     private async Task<int> ReadExactOrUntilClosedAsync(byte[] buffer, int length)
     {
+        using var timeout = CancellationTokenSource.CreateLinkedTokenSource(_stoppingToken);
+        timeout.CancelAfter(TimeSpan.FromSeconds(Math.Max(1, _poolConfig.DatumReadTimeoutSeconds)));
         int offset = 0;
         while (offset < length)
         {
-            int read = await _stream.ReadAsync(buffer, offset, length - offset);
+            int read = await _stream.ReadAsync(buffer.AsMemory(offset, length - offset), timeout.Token);
             if (read == 0)
             {
                 break;
@@ -1421,6 +1460,15 @@ public async Task HandleClientAsync()
                 //Console.WriteLine($"📋 Parsed header: Cmd={header.ProtoCmd}, Len={header.CmdLen}, Signed={header.IsSigned}, EncryptedPubKey={header.IsEncryptedPubKey}, EncryptedChannel={header.IsEncryptedChannel}");
 
                 // Step 2: Read in the message body
+                if (header.CmdLen > _poolConfig.MaxShareRequestBytes)
+                {
+                    MarkSessionClose(
+                        "message-too-large",
+                        $"DATUM message declared {header.CmdLen} bytes; maximum is {_poolConfig.MaxShareRequestBytes}.");
+                    ScheduleServerInitiatedClose(
+                        $"Closing DATUM session {RemoteEndpointLabel} after an oversized message header.");
+                    break;
+                }
                 var bodyBuffer = new byte[header.CmdLen];
                 bytesRead = await ReadExactOrUntilClosedAsync(bodyBuffer, bodyBuffer.Length);
                 if (bytesRead == 0)
@@ -1657,6 +1705,11 @@ public async Task HandleClientAsync()
                 //Finally back to the top of the loop and await the next incoming message
             }
         }
+        catch (OperationCanceledException) when (!_stoppingToken.IsCancellationRequested)
+        {
+            MarkSessionClose("read-timeout", "DATUM header or body was not received before the read deadline.");
+            ScheduleServerInitiatedClose($"Closing DATUM session {RemoteEndpointLabel} after a read timeout.");
+        }
         catch (IOException ex)
         {
             MarkSessionClose("client-disconnected-io", $"I/O exception while handling DATUM session: {ex.Message}");
@@ -2375,6 +2428,16 @@ private async Task HandleCoinbaserFetchAsync(byte[] payload)
             fetchRequest = CoinbaserFetchMessage.FromBytes(payload);
             parseDurationMs = stageStopwatch.Elapsed.TotalMilliseconds;
 
+            if (!_sessionPayoutAddressLocked || string.IsNullOrWhiteSpace(_clientPayoutAddress))
+            {
+                MarkSessionClose(
+                    "payout-address-required",
+                    "DATUM coinbase work is unavailable until the miner locks a valid payout address.");
+                ScheduleServerInitiatedClose(
+                    $"Closing DATUM session {RemoteEndpointLabel} because no valid slot-0 payout address is locked.");
+                return;
+            }
+
             stageStopwatch.Restart();
             DatumCoinbaseTemplate coinbaseTemplate = _stateService.GetDatumCoinbaseTemplate();
             winnersList = coinbaseTemplate.WinnersList;
diff --git a/boot_portal/Services/BitcoinNotificationHealth.cs b/boot_portal/Services/BitcoinNotificationHealth.cs
index 4d42d06..9c36d97 100644
--- a/boot_portal/Services/BitcoinNotificationHealth.cs
+++ b/boot_portal/Services/BitcoinNotificationHealth.cs
@@ -278,7 +278,8 @@ public bool IsMiningSafe(DateTime nowUtc, out string reason)
                 return false;
             }
 
-            DateTime reference = _lastRpcSuccessUtc ?? _lastRpcCheckUtc ?? _startedUtc;
+            // Repeated failed polls must not renew the grace period indefinitely.
+            DateTime reference = _lastRpcSuccessUtc ?? _startedUtc;
             if (!_rpcReachable && nowUtc - reference >= TimeSpan.FromSeconds(_lagGraceSeconds))
             {
                 reason = string.IsNullOrWhiteSpace(_lastRpcError)
@@ -376,7 +377,7 @@ private bool IsMiningSafeNoLock(DateTime nowUtc, out string reason)
             return false;
         }
 
-        DateTime reference = _lastRpcSuccessUtc ?? _lastRpcCheckUtc ?? _startedUtc;
+        DateTime reference = _lastRpcSuccessUtc ?? _startedUtc;
         if (!_rpcReachable && nowUtc - reference >= TimeSpan.FromSeconds(_lagGraceSeconds))
         {
             reason = string.IsNullOrWhiteSpace(_lastRpcError)
diff --git a/boot_portal/Services/BitcoinRpcRecoveryPlanner.cs b/boot_portal/Services/BitcoinRpcRecoveryPlanner.cs
index 9b50c3c..6b5244b 100644
--- a/boot_portal/Services/BitcoinRpcRecoveryPlanner.cs
+++ b/boot_portal/Services/BitcoinRpcRecoveryPlanner.cs
@@ -7,6 +7,8 @@ public sealed record BitcoinRpcRecoveryPlan(
 
 public static class BitcoinRpcRecoveryPlanner
 {
+    private const int ShallowReorganizationLookback = 1;
+
     public static BitcoinRpcRecoveryPlan Build(
         long? localHeight,
         string? localHash,
@@ -26,12 +28,12 @@ public static BitcoinRpcRecoveryPlan Build(
 
         if (localHeight.Value > rpcHeight)
         {
-            return new BitcoinRpcRecoveryPlan([], false, true);
+            return new BitcoinRpcRecoveryPlan(ReorganizationHeights(rpcHeight), false, true);
         }
 
         if (localHeight.Value == rpcHeight)
         {
-            return new BitcoinRpcRecoveryPlan([rpcHeight], false, true);
+            return new BitcoinRpcRecoveryPlan(ReorganizationHeights(rpcHeight), false, true);
         }
 
         return new BitcoinRpcRecoveryPlan(
@@ -43,4 +45,14 @@ public static BitcoinRpcRecoveryPlan Build(
             false,
             false);
     }
+
+    private static IReadOnlyList<long> ReorganizationHeights(long tipHeight)
+    {
+        long firstHeight = Math.Max(0, tipHeight - ShallowReorganizationLookback);
+        return Enumerable.Range(
+                checked((int)firstHeight),
+                checked((int)(tipHeight - firstHeight + 1)))
+            .Select(height => (long)height)
+            .ToList();
+    }
 }
diff --git a/boot_portal/Services/BootPeerUdpRelayService.cs b/boot_portal/Services/BootPeerUdpRelayService.cs
index 799606a..69b72e3 100644
--- a/boot_portal/Services/BootPeerUdpRelayService.cs
+++ b/boot_portal/Services/BootPeerUdpRelayService.cs
@@ -1,22 +1,15 @@
 using System.Net;
-using System.Net.Http.Json;
 using System.Net.Sockets;
-using System.Text;
-using System.Collections.Concurrent;
 using boot_portal.Models;
 
 namespace boot_portal.Services;
 
 public sealed class BootPeerUdpRelayService : BackgroundService
 {
-    private const string ReachabilityProbePrefix = "GP_REACHABILITY_PROBE:";
-    private const string ReachabilityAckPrefix = "GP_REACHABILITY_ACK:";
-    private static readonly TimeSpan ReachabilityChallengeTtl = TimeSpan.FromMinutes(2);
     private readonly PoolConfig _poolConfig;
     private readonly BootProtocolStateService _stateService;
     private readonly BootPeerSessionManager _sessionManager;
     private readonly ILogger<BootPeerUdpRelayService> _logger;
-    private readonly ConcurrentDictionary<string, BootUdpReachabilityChallenge> _reachabilityChallenges = new(StringComparer.Ordinal);
     private UdpClient? _udpClient;
 
     public BootPeerUdpRelayService(
@@ -193,96 +186,6 @@ private void RecordChainTipSendTelemetry(
             target.Datagram.Length);
     }
 
-    public async Task<bool> SendReachabilityProbeAsync(
-        string host,
-        int port,
-        string nonce,
-        string ackUrl,
-        string targetBaseUrl,
-        CancellationToken cancellationToken)
-    {
-        if (string.IsNullOrWhiteSpace(host) ||
-            port is <= 0 or > 65535 ||
-            string.IsNullOrWhiteSpace(nonce))
-        {
-            return false;
-        }
-
-        try
-        {
-            IPAddress[] addresses = await Dns.GetHostAddressesAsync(host, cancellationToken);
-            IPAddress? address = addresses.FirstOrDefault(candidate => candidate.AddressFamily == AddressFamily.InterNetwork);
-            if (address == null)
-            {
-                return false;
-            }
-
-            string payloadText = $"{ReachabilityProbePrefix}{nonce}|{ackUrl}|{targetBaseUrl}";
-            byte[] payload = Encoding.ASCII.GetBytes(payloadText);
-            using var udp = new UdpClient(AddressFamily.InterNetwork);
-            await udp.SendAsync(payload, payload.Length, new IPEndPoint(address, port));
-            return true;
-        }
-        catch (Exception ex) when (ex is SocketException or ObjectDisposedException or ArgumentException or InvalidOperationException)
-        {
-            _logger.LogDebug(ex, "Failed to send UDP reachability probe to {Host}:{Port}.", host, port);
-            return false;
-        }
-    }
-
-    public void RegisterReachabilityChallenge(string nonce, string targetBaseUrl)
-    {
-        if (string.IsNullOrWhiteSpace(nonce))
-        {
-            return;
-        }
-
-        PruneReachabilityChallenges();
-        _reachabilityChallenges[nonce.Trim()] = new BootUdpReachabilityChallenge
-        {
-            Nonce = nonce.Trim(),
-            TargetBaseUrl = targetBaseUrl.Trim(),
-            CreatedAtUtc = DateTime.UtcNow
-        };
-    }
-
-    public bool AcknowledgeReachabilityChallenge(string nonce, string targetBaseUrl)
-    {
-        if (string.IsNullOrWhiteSpace(nonce))
-        {
-            return false;
-        }
-
-        PruneReachabilityChallenges();
-        string key = nonce.Trim();
-        if (!_reachabilityChallenges.TryGetValue(key, out BootUdpReachabilityChallenge? challenge))
-        {
-            return false;
-        }
-
-        if (!string.IsNullOrWhiteSpace(challenge.TargetBaseUrl) &&
-            !string.IsNullOrWhiteSpace(targetBaseUrl) &&
-            !string.Equals(challenge.TargetBaseUrl.Trim().TrimEnd('/'), targetBaseUrl.Trim().TrimEnd('/'), StringComparison.OrdinalIgnoreCase))
-        {
-            return false;
-        }
-
-        challenge.AcknowledgedAtUtc = DateTime.UtcNow;
-        return true;
-    }
-
-    public bool WasReachabilityChallengeAcknowledged(string nonce)
-    {
-        if (string.IsNullOrWhiteSpace(nonce))
-        {
-            return false;
-        }
-
-        PruneReachabilityChallenges();
-        return _reachabilityChallenges.TryGetValue(nonce.Trim(), out BootUdpReachabilityChallenge? challenge) &&
-            challenge.AcknowledgedAtUtc.HasValue;
-    }
-
     private async Task HandleDatagramAsync(
         byte[] datagram,
         IPEndPoint remoteEndPoint,
@@ -298,11 +201,6 @@ private async Task HandleDatagramAsync(
             return;
         }
 
-        if (TryHandleReachabilityProbe(datagram, remoteEndPoint))
-        {
-            return;
-        }
-
         if (!_sessionManager.TryDecryptUdpDatagram(datagram, out BootPeerUdpReceivedPayload received, out string decryptReason))
         {
             _logger.LogDebug("Ignored unauthenticated V3 UDP datagram from {RemoteEndPoint}: {Reason}", remoteEndPoint, decryptReason);
@@ -365,105 +263,10 @@ await _stateService.ObservePeerChainTipAsync(
         _stateService.UpdatePeerUdpHeartbeat(received.RemoteEndpoint, received.RemoteNodeId, "udp-invalid", success: false, DateTime.UtcNow);
     }
 
-    private bool TryHandleReachabilityProbe(byte[] datagram, IPEndPoint remoteEndPoint)
-    {
-        string text;
-        try
-        {
-            text = Encoding.ASCII.GetString(datagram);
-        }
-        catch
-        {
-            return false;
-        }
-
-        if (!text.StartsWith(ReachabilityProbePrefix, StringComparison.Ordinal))
-        {
-            return false;
-        }
-
-        string payload = text[ReachabilityProbePrefix.Length..].Trim();
-        string[] parts = payload.Split('|', 3);
-        string nonce = parts.ElementAtOrDefault(0)?.Trim() ?? string.Empty;
-        string ackUrl = parts.ElementAtOrDefault(1)?.Trim() ?? string.Empty;
-        string targetBaseUrl = parts.ElementAtOrDefault(2)?.Trim() ?? string.Empty;
-        if (string.IsNullOrWhiteSpace(nonce))
-        {
-            return true;
-        }
-
-        _ = Task.Run(async () =>
-        {
-            try
-            {
-                byte[] ack = Encoding.ASCII.GetBytes($"{ReachabilityAckPrefix}{nonce}");
-                using var udp = new UdpClient(AddressFamily.InterNetwork);
-                await udp.SendAsync(ack, ack.Length, remoteEndPoint);
-                await PostReachabilityAckAsync(ackUrl, nonce, targetBaseUrl);
-            }
-            catch (Exception ex) when (ex is SocketException or ObjectDisposedException)
-            {
-                _logger.LogDebug(ex, "Failed to send UDP reachability ack to {RemoteEndPoint}.", remoteEndPoint);
-            }
-        });
-
-        _stateService.RecordExternalNetworkEvent(
-            "udp-reachability-probe",
-            remoteEndPoint.ToString(),
-            "Received UDP reachability probe and attempted ack.");
-        return true;
-    }
-
-    private async Task PostReachabilityAckAsync(string ackUrl, string nonce, string targetBaseUrl)
-    {
-        if (string.IsNullOrWhiteSpace(ackUrl) ||
-            !Uri.TryCreate(ackUrl, UriKind.Absolute, out Uri? uri) ||
-            (uri.Scheme != Uri.UriSchemeHttp && uri.Scheme != Uri.UriSchemeHttps))
-        {
-            return;
-        }
-
-        try
-        {
-            using var client = new HttpClient
-            {
-                Timeout = TimeSpan.FromSeconds(2)
-            };
-            using var response = await client.PostAsJsonAsync(uri, new BootUdpReachabilityAckRequest
-            {
-                Nonce = nonce,
-                TargetBaseUrl = targetBaseUrl
-            });
-        }
-        catch (Exception ex) when (ex is HttpRequestException or TaskCanceledException or InvalidOperationException)
-        {
-            _logger.LogDebug(ex, "Failed to POST UDP reachability ack to {AckUrl}.", ackUrl);
-        }
-    }
-
-    private void PruneReachabilityChallenges()
-    {
-        DateTime cutoff = DateTime.UtcNow - ReachabilityChallengeTtl;
-        foreach (var item in _reachabilityChallenges)
-        {
-            if (item.Value.CreatedAtUtc < cutoff)
-            {
-                _reachabilityChallenges.TryRemove(item.Key, out _);
-            }
-        }
-    }
-
     public override void Dispose()
     {
         _udpClient?.Dispose();
         base.Dispose();
     }
 
-    private sealed class BootUdpReachabilityChallenge
-    {
-        public string Nonce { get; init; } = string.Empty;
-        public string TargetBaseUrl { get; init; } = string.Empty;
-        public DateTime CreatedAtUtc { get; init; }
-        public DateTime? AcknowledgedAtUtc { get; set; }
-    }
 }
diff --git a/boot_portal/Services/BootProtocolStateService.cs b/boot_portal/Services/BootProtocolStateService.cs
index 13c0de7..9dd5c5f 100644
--- a/boot_portal/Services/BootProtocolStateService.cs
+++ b/boot_portal/Services/BootProtocolStateService.cs
@@ -82,7 +82,7 @@ public static string GetGridLabsSupportAddress(string? bitcoinNetwork)
     private const double SlowStateLockWaitWarningMs = 250;
     private const double SlowStateSaveWarningMs = 250;
     private const int MaxSeenShareIds = 20000;
-    private const int MaxAcceptedParentBlockHashes = 100000;
+    private const int MaxAcceptedParentBlockHashes = 128;
     private const int MaxRecentRejectedShareDiagnostics = 1000;
     private const int MaxRecentCoinbaserDiagnostics = 1000;
     private const int MaxRecentDatumShareResponses = 2000;
@@ -2036,18 +2036,16 @@ public async Task<ShareRecordingResult> RecordShareAsync(RecordedShareSubmission
                         $"Fresh-parent retry validated but computed difficulty {freshParentValidation.Difficulty.ToString("F2", CultureInfo.InvariantCulture)} was below the floor.");
                     validation = freshParentValidation;
                 }
-                else if (TryLearnFreshParentFromTrustedShare(share.Source, freshParentValidation, currentStateSnapshot))
-                {
-                    validation = freshParentValidation;
-                    matchedSnapshotId = freshParentSnapshotValidation.SnapshotId;
-                }
                 else
                 {
                     RecordFreshParentRetryEvent(
-                        "fresh-parent-learn-failed",
+                        "fresh-parent-rejected",
                         share.Source,
                         freshParentValidation.PrevBlockHash,
-                        "Fresh-parent retry validated, but the parent could not be learned before the state changed.");
+                        "A mining share cannot establish a new Bitcoin parent; local Bitcoin notification authority must validate the tip first.");
+                    validation = RejectValidatedShare(
+                        freshParentValidation,
+                        "Fresh proof parent is outside the active Bitcoin tip; the attached Bitcoin source must validate it before direct ingress.");
                 }
             }
         }
@@ -2061,11 +2059,11 @@ public async Task<ShareRecordingResult> RecordShareAsync(RecordedShareSubmission
                     "Previous-parent proof quarantined after the provisional peer-tip boundary.");
             }
             else if (validation.IsValid &&
-                     IsNewDirectIngressPreviousParentProofNoLock(validation.ShareId, validation.PrevBlockHash))
+                     IsNewDirectIngressOutsideActiveParentNoLock(validation.ShareId, validation.PrevBlockHash))
             {
                 validation = RejectValidatedShare(
                     validation,
-                    "New previous-parent proof rejected after the local snapshot boundary.");
+                    "Fresh proof parent is outside the active Bitcoin tip; retained proofs may be revalidated only through state reconciliation.");
             }
         }
         shareCoreValidationDurationMs = stageStopwatch.Elapsed.TotalMilliseconds;
@@ -2213,11 +2211,6 @@ ShareRecordingResult AttachTimings(ShareRecordingResult result)
             });
         }
 
-        if (IsTrustedFreshParentSource(share.Source))
-        {
-            TryLearnFreshParentFromTrustedShare(share.Source, validation, currentStateSnapshot);
-        }
-
         ShareRecordingResult result;
         bool shouldRelay = false;
         bool shouldNotifyNetwork = false;
@@ -2943,12 +2936,6 @@ private List<List<PayoutInfo>> GetSnapshotPayoutVariants(BootPayoutSnapshotConte
             variants.Add(ClonePayouts(context.WinnersList));
         }
 
-        if (context.FeeFreeWinnersList.Count > 0 &&
-            !variants.Any(existing => WinnersMatch(existing, context.FeeFreeWinnersList)))
-        {
-            variants.Add(ClonePayouts(context.FeeFreeWinnersList));
-        }
-
         return variants;
     }
 
@@ -3694,7 +3681,8 @@ public async Task<BootNetworkStatusDto> ObserveChainTipAsync(string blockHash, s
                 }
             }
 
-            if (IsStaleTipObservationNoLock(
+            bool trustedReorganization = source.Contains("reorg", StringComparison.OrdinalIgnoreCase);
+            if (!trustedReorganization && IsStaleTipObservationNoLock(
                 normalizedBlockHash,
                 effectiveBlockHeight,
                 _state.CurrentTipBlockHash,
@@ -3713,7 +3701,7 @@ public async Task<BootNetworkStatusDto> ObserveChainTipAsync(string blockHash, s
 
             bool oneBlockReorg = GetActiveConsensusVersionNoLock() >= BootProtocolVersions.ConsensusVersion &&
                 effectiveBlockHeight.HasValue &&
-                _state.CurrentTipBlockHeight == effectiveBlockHeight &&
+                (_state.CurrentTipBlockHeight == effectiveBlockHeight || trustedReorganization) &&
                 !BitcoinHashes.AreEquivalent(normalizedBlockHash, _state.CurrentTipBlockHash);
             if (oneBlockReorg)
             {
@@ -5591,24 +5579,22 @@ private void PruneSnapshotFamiliesNoLock()
         };
     }
 
-    private bool IsNewDirectIngressPreviousParentProofNoLock(string? shareId, string? parentBlockHash)
+    private bool IsNewDirectIngressOutsideActiveParentNoLock(string? shareId, string? parentBlockHash)
     {
         if (string.IsNullOrWhiteSpace(parentBlockHash))
         {
             return false;
         }
 
-        BootPayoutSnapshotContext? active = GetSnapshotContextNoLock(_state.ActiveSnapshotId);
-        BootPayoutSnapshotContext? predecessor = GetSnapshotContextNoLock(active?.PreviousSnapshotId);
-        string? finalizedPreviousParent = NormalizeCanonicalBlockHash(predecessor?.LockedByBlockHash);
-        if (string.IsNullOrWhiteSpace(finalizedPreviousParent) ||
-            !BitcoinHashes.AreEquivalent(parentBlockHash, finalizedPreviousParent))
+        if (_state.OnDeckProofs.Any(proof =>
+                string.Equals(proof.ShareId, shareId, StringComparison.OrdinalIgnoreCase)))
         {
             return false;
         }
 
-        return !_state.OnDeckProofs.Any(proof =>
-            string.Equals(proof.ShareId, shareId, StringComparison.OrdinalIgnoreCase));
+        string? currentTip = NormalizeCanonicalBlockHash(_state.CurrentTipBlockHash);
+        return !string.IsNullOrWhiteSpace(currentTip) &&
+               !BitcoinHashes.AreEquivalent(parentBlockHash, currentTip);
     }
 
     private void RestorePredecessorForRemovedBoundaryNoLock(
@@ -5616,19 +5602,25 @@ private void RestorePredecessorForRemovedBoundaryNoLock(
         string replacementBlockHash,
         long replacementBlockHeight)
     {
-        BootSnapshotFamilyState? removedFamily = GetActiveSnapshotFamilyNoLock();
-        if (removedFamily == null ||
-            removedFamily.BoundaryBlockHeight != replacementBlockHeight ||
-            BitcoinHashes.AreEquivalent(removedFamily.BoundaryBlockHash, replacementBlockHash))
+        while (true)
         {
-            return;
-        }
+            BootSnapshotFamilyState? removedFamily = GetActiveSnapshotFamilyNoLock();
+            if (removedFamily == null ||
+                removedFamily.BoundaryBlockHeight < replacementBlockHeight ||
+                (removedFamily.BoundaryBlockHeight == replacementBlockHeight &&
+                 BitcoinHashes.AreEquivalent(removedFamily.BoundaryBlockHash, replacementBlockHash)))
+            {
+                return;
+            }
+
+            removedFamily.IsOpen = false;
+            removedFamily.BoundaryOnActiveChain = false;
+            BootPayoutSnapshotContext? predecessor = GetSnapshotContextNoLock(removedFamily.PredecessorSnapshotId);
+            if (predecessor == null)
+            {
+                return;
+            }
 
-        removedFamily.IsOpen = false;
-        removedFamily.BoundaryOnActiveChain = false;
-        BootPayoutSnapshotContext? predecessor = GetSnapshotContextNoLock(removedFamily.PredecessorSnapshotId);
-        if (predecessor != null)
-        {
             _state.ActiveSnapshotId = predecessor.SnapshotId;
             _state.ActiveSnapshotProofIds = predecessor.ProofIds.ToList();
             _state.WinnersList = ClonePayouts(predecessor.WinnersList);
@@ -5636,14 +5628,14 @@ private void RestorePredecessorForRemovedBoundaryNoLock(
             _state.CurrentRoundNumber = Math.Max(0, predecessor.CurrentRoundNumber);
             _state.CurrentTipBlockHash = NormalizeCanonicalBlockHash(predecessor.LockedByBlockHash);
             _state.CurrentTipBlockHeight = predecessor.LockedByBlockHeight;
-        }
 
-        RecordNetworkEventNoLock(
-            "snapshot-family-reorg",
-            source,
-            $"Deactivated snapshot family {removedFamily.FamilyId} after boundary {removedFamily.BoundaryBlockHash} left the active chain.",
-            replacementBlockHash,
-            replacementBlockHeight);
+            RecordNetworkEventNoLock(
+                "snapshot-family-reorg",
+                source,
+                $"Deactivated snapshot family {removedFamily.FamilyId} after boundary {removedFamily.BoundaryBlockHash} left the active chain.",
+                replacementBlockHash,
+                replacementBlockHeight);
+        }
     }
 
     private void EnsureActiveSnapshotNoLock(DateTime nowUtc)
@@ -10429,59 +10421,6 @@ private void RecordFreshParentRetryEvent(
         }
     }
 
-    private bool TryLearnFreshParentFromTrustedShare(
-        string source,
-        BootShareValidationResult validation,
-        string expectedStateId)
-    {
-        if (!IsTrustedFreshParentSource(source) ||
-            string.IsNullOrWhiteSpace(validation.PrevBlockHash))
-        {
-            return false;
-        }
-
-        lock (_sync)
-        {
-            if (!string.Equals(expectedStateId, _state.CurrentStateId, StringComparison.OrdinalIgnoreCase))
-            {
-                return false;
-            }
-
-            if (IsAcceptedParentBlockHashNoLock(validation.PrevBlockHash))
-            {
-                return true;
-            }
-
-            if (_poolConfig.EnablePeerTipStaleProtection && _state.ProvisionalTip != null)
-            {
-                RecordNetworkEventNoLock(
-                    "fresh-parent-deferred",
-                    source,
-                    "Did not learn a new parent from DATUM while a peer-tip boundary awaited local Bitcoin validation.",
-                    validation.PrevBlockHash,
-                    blockHeight: null);
-                RequestDeferredHistorySaveNoLock();
-                return false;
-            }
-
-            RememberAcceptedParentBlockHashNoLock(validation.PrevBlockHash);
-            if (string.IsNullOrWhiteSpace(_state.CurrentTipBlockHash))
-            {
-                _state.CurrentTipBlockHash = validation.PrevBlockHash;
-                _state.CandidateStateId = ComputeCandidateStateIdNoLock();
-            }
-            RecordNetworkEventNoLock(
-                "fresh-parent-learned",
-                source,
-                $"Learned fresh parent from otherwise-valid local share at difficulty {ClientHandler.FormatDifficulty(validation.Difficulty)}.",
-                validation.PrevBlockHash,
-                blockHeight: null);
-            RequestDeferredSaveNoLock();
-            RequestDeferredHistorySaveNoLock();
-            return true;
-        }
-    }
-
     private static bool IsTrustedFreshParentSource(string source)
     {
         return string.Equals(source, "datum", StringComparison.OrdinalIgnoreCase);
diff --git a/boot_portal/Services/BootShareVerifier.cs b/boot_portal/Services/BootShareVerifier.cs
index 6e3e1aa..f9c852f 100644
--- a/boot_portal/Services/BootShareVerifier.cs
+++ b/boot_portal/Services/BootShareVerifier.cs
@@ -286,7 +286,7 @@ private BootShareValidationResult ValidateCore(
                 IsValid = true,
                 ShareId = shareId,
                 MinerAddress = normalizedMinerAddress,
-                Username = string.IsNullOrWhiteSpace(username) ? normalizedMinerAddress : username,
+                Username = NormalizeUsernameForStorage(username, normalizedMinerAddress),
                 ScriptPubKeyHex = scriptPubKeyHex,
                 HeaderHex = normalizedHeaderHex,
                 CoinbaseHex = normalizedCoinbaseHex,
@@ -307,6 +307,26 @@ private BootShareValidationResult ValidateCore(
         }
     }
 
+    internal static string NormalizeUsernameForStorage(string? username, string fallbackAddress)
+    {
+        if (string.IsNullOrWhiteSpace(username))
+        {
+            return fallbackAddress;
+        }
+
+        string trimmed = username.Trim();
+        var safe = new StringBuilder(Math.Min(trimmed.Length, 128));
+        foreach (char value in trimmed.Take(128))
+        {
+            safe.Append(char.IsAsciiLetterOrDigit(value) || value is '.' or '_' or '-' or ':'
+                ? value
+                : '_');
+        }
+
+        string normalized = safe.ToString().Trim('_');
+        return string.IsNullOrWhiteSpace(normalized) ? fallbackAddress : normalized;
+    }
+
     private string ExtractSlotZeroAddress(byte[] scriptPubKey)
     {
         string address = BitcoinScript.ScriptToAddress(scriptPubKey, _bitcoinNetwork);
diff --git a/boot_portal/Services/PeerBundleFetchLimiter.cs b/boot_portal/Services/PeerBundleFetchLimiter.cs
new file mode 100644
index 0000000..93365e4
--- /dev/null
+++ b/boot_portal/Services/PeerBundleFetchLimiter.cs
@@ -0,0 +1,52 @@
+namespace boot_portal.Services;
+
+public sealed class PeerBundleFetchLimiter
+{
+    private readonly int _limit;
+    private readonly TimeSpan _window;
+    private readonly object _sync = new();
+    private readonly Dictionary<string, Queue<DateTime>> _attempts = new(StringComparer.OrdinalIgnoreCase);
+
+    public PeerBundleFetchLimiter(int limit, TimeSpan window)
+    {
+        ArgumentOutOfRangeException.ThrowIfLessThan(limit, 1);
+        if (window <= TimeSpan.Zero)
+        {
+            throw new ArgumentOutOfRangeException(nameof(window));
+        }
+
+        _limit = limit;
+        _window = window;
+    }
+
+    public bool TryAcquire(string peerEndpoint, DateTime nowUtc)
+    {
+        if (string.IsNullOrWhiteSpace(peerEndpoint))
+        {
+            return false;
+        }
+
+        lock (_sync)
+        {
+            if (!_attempts.TryGetValue(peerEndpoint, out Queue<DateTime>? attempts))
+            {
+                attempts = new Queue<DateTime>();
+                _attempts[peerEndpoint] = attempts;
+            }
+
+            DateTime cutoff = nowUtc - _window;
+            while (attempts.TryPeek(out DateTime attempt) && attempt <= cutoff)
+            {
+                attempts.Dequeue();
+            }
+
+            if (attempts.Count >= _limit)
+            {
+                return false;
+            }
+
+            attempts.Enqueue(nowUtc);
+            return true;
+        }
+    }
+}
diff --git a/boot_portal/Utils/PoolConfigValidator.cs b/boot_portal/Utils/PoolConfigValidator.cs
index b26f90f..3443812 100644
--- a/boot_portal/Utils/PoolConfigValidator.cs
+++ b/boot_portal/Utils/PoolConfigValidator.cs
@@ -74,8 +74,12 @@ public static List<string> Validate(PoolConfig config)
             errors.Add(ex.Message);
         }
 
-        if (!string.IsNullOrWhiteSpace(bitcoinNetwork) &&
-            !BitcoinScript.TryAddressToScriptPubKey(config.PoolPayoutScript, bitcoinNetwork, out _))
+        if (string.IsNullOrWhiteSpace(config.PoolPayoutScript))
+        {
+            errors.Add("pool_payout_script must be explicitly configured; GridPool has no vendor payout fallback");
+        }
+        else if (!string.IsNullOrWhiteSpace(bitcoinNetwork) &&
+                 !BitcoinScript.TryAddressToScriptPubKey(config.PoolPayoutScript, bitcoinNetwork, out _))
         {
             errors.Add($"pool_payout_script must be a supported Bitcoin payout address for bitcoin_network {bitcoinNetwork}");
         }
@@ -152,6 +156,7 @@ public static List<string> Validate(PoolConfig config)
         ValidatePositive(errors, config.PeerPruneFailureCount, "peer_prune_failure_count");
         ValidatePositive(errors, config.NetworkReadRateLimitPerMinute, "network_read_rate_limit_per_minute");
         ValidatePositive(errors, config.PeerWriteRateLimitPerMinute, "peer_write_rate_limit_per_minute");
+        ValidatePositive(errors, config.PeerStateBundleFetchRateLimitPerMinute, "peer_state_bundle_fetch_rate_limit_per_minute");
         ValidatePositive(errors, config.PeerSessionTarget, "peer_session_target");
         ValidatePositive(errors, config.PeerSessionConnectIntervalSeconds, "peer_session_connect_interval_seconds");
         ValidatePositive(errors, config.PeerSessionIdleTimeoutSeconds, "peer_session_idle_timeout_seconds");
@@ -189,6 +194,12 @@ public static List<string> Validate(PoolConfig config)
         }
         ValidatePositive(errors, config.AdminRateLimitPerMinute, "admin_rate_limit_per_minute");
         ValidatePositive(errors, config.MaxShareRequestBytes, "max_share_request_bytes");
+        ValidatePositive(errors, config.DatumMaxConnections, "datum_max_connections");
+        ValidatePositive(errors, config.DatumReadTimeoutSeconds, "datum_read_timeout_seconds");
+        if (config.DatumMaxConnections > 1024)
+        {
+            errors.Add("datum_max_connections must be 1024 or less");
+        }
         ValidatePositive(errors, config.MaxCoinbaseHexChars, "max_coinbase_hex_chars");
         ValidatePositive(errors, config.MaxMerklePathEntries, "max_merkle_path_entries");
         ValidatePositive(errors, config.HashrateSampleIntervalSeconds, "hashrate_sample_interval_seconds");
@@ -255,11 +266,6 @@ public static List<string> Validate(PoolConfig config)
                 errors.Add("testing_round_reset_mode must be none when node_mode is production");
             }
 
-            if (config.EnableAdminApi && !HasStrongAdminKey(config.AdminApiKey))
-            {
-                errors.Add("admin_api_key must be a strong non-placeholder value when enable_admin_api is true in production");
-            }
-
             if (string.Equals(bitcoinNetwork, BitcoinScript.Mainnet, StringComparison.OrdinalIgnoreCase) &&
                 config.BootProtocolVersion >= 22 &&
                 config.V22ActivationBlockHeight == 0)
@@ -268,6 +274,11 @@ public static List<string> Validate(PoolConfig config)
             }
         }
 
+        if (config.EnableAdminApi && !HasStrongAdminKey(config.AdminApiKey))
+        {
+            errors.Add("admin_api_key must be a strong non-placeholder value whenever enable_admin_api is true");
+        }
+
         return errors;
     }
 
diff --git a/boot_portal/boot_portal.csproj b/boot_portal/boot_portal.csproj
index b0cdab0..b4d9318 100644
--- a/boot_portal/boot_portal.csproj
+++ b/boot_portal/boot_portal.csproj
@@ -4,6 +4,8 @@
     <TargetFramework>net9.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
+    <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
+    <RestoreLockedMode Condition="'$(ContinuousIntegrationBuild)' == 'true'">true</RestoreLockedMode>
   </PropertyGroup>
 
   <ItemGroup>
@@ -20,4 +22,8 @@
     <None Remove="publish/**;**/pool_state*.json;boot_portal_config.json;boot_portal_config.local.json" />
   </ItemGroup>
 
+  <ItemGroup>
+    <InternalsVisibleTo Include="boot.tests" />
+  </ItemGroup>
+
 </Project>
diff --git a/boot_portal/packages.lock.json b/boot_portal/packages.lock.json
new file mode 100644
index 0000000..6db0e93
--- /dev/null
+++ b/boot_portal/packages.lock.json
@@ -0,0 +1,97 @@
+{
+  "version": 1,
+  "dependencies": {
+    "net9.0": {
+      "BouncyCastle.Cryptography": {
+        "type": "Direct",
+        "requested": "[2.6.1, )",
+        "resolved": "2.6.1",
+        "contentHash": "vZsG2YILhthgRqO+ZVgRff4ZFKKTl0v7kqaVBLCtRvpREhfBP33pcWrdA3PRYgWuFL1RxiUFvjMUHTdBZlJcoA=="
+      },
+      "LibSodium.Net": {
+        "type": "Direct",
+        "requested": "[0.16.0-alpha, )",
+        "resolved": "0.16.0-alpha",
+        "contentHash": "uNW5uuT2QEu5zUSDAbNyXM/RPZjnLjMEp88uYMCkH2yr9+jX7LpZsV9JZimdIABKiHivfGqSJAXmj3Bd2tmJUQ==",
+        "dependencies": {
+          "System.Memory": "4.6.0",
+          "libsodium": "1.0.20.1"
+        }
+      },
+      "NetMQ": {
+        "type": "Direct",
+        "requested": "[4.0.2.2, )",
+        "resolved": "4.0.2.2",
+        "contentHash": "G2dNt5Fcv/wdZOwTkUksJBe8RUc4wJn38FTZw8UmH5tcEkPi3KM8ME8igJ1fR+1msNpEKfLzEfgJOA6RpOE1jA==",
+        "dependencies": {
+          "AsyncIO": "0.1.69",
+          "NaCl.Net": "0.1.13",
+          "System.ServiceModel.Primitives": "8.1.2"
+        }
+      },
+      "NSec.Cryptography": {
+        "type": "Direct",
+        "requested": "[25.4.0, )",
+        "resolved": "25.4.0",
+        "contentHash": "Z3wPpG0xefMLmhn9T+Ka/EzAmMQPT0THL/5E4lf9cXI/N9rbGH0G23ZFpRcPnD0ast2k7ieG6QSVNIjmfPCXBQ==",
+        "dependencies": {
+          "libsodium": "[1.0.20.1, 1.0.21)"
+        }
+      },
+      "System.CommandLine": {
+        "type": "Direct",
+        "requested": "[2.0.0-beta4.22272.1, )",
+        "resolved": "2.0.0-beta4.22272.1",
+        "contentHash": "1uqED/q2H0kKoLJ4+hI2iPSBSEdTuhfCYADeJrAqERmiGQ2NNacYKRNEQ+gFbU4glgVyK8rxI+ZOe1onEtr/Pg=="
+      },
+      "System.Security.Cryptography.Xml": {
+        "type": "Direct",
+        "requested": "[9.0.18, )",
+        "resolved": "9.0.18",
+        "contentHash": "UoE37brJoIJPMds6wqDaweVrORmdM3XDPGLRU01Mg6Koh3SjgogSfz4+zDsriaEluHMRCx/Qc7yeEw7F9QMcJA==",
+        "dependencies": {
+          "System.Security.Cryptography.Pkcs": "9.0.18"
+        }
+      },
+      "AsyncIO": {
+        "type": "Transitive",
+        "resolved": "0.1.69",
+        "contentHash": "xyXJLi+wjy6AtIyWXHXJkPS0gItqVT4lg5w++7bA5YEjugYKdrFMGxCo6KUJ1yYwjriLQJ1g35LDljZs3Q90XQ=="
+      },
+      "libsodium": {
+        "type": "Transitive",
+        "resolved": "1.0.20.1",
+        "contentHash": "pkiceEqJDQFHjbga3k/oPfTVX9g+GKJZ1VrkuiLhaymt9YNw1Dr7cX9hNuZuNaWcr9WD0moW55k4pMwzQ7JaZQ=="
+      },
+      "Microsoft.Extensions.ObjectPool": {
+        "type": "Transitive",
+        "resolved": "8.0.10",
+        "contentHash": "u7gAG7JgxF8VSJUGPSudAcPxOt+ymJKQCSxNRxiuKV+klCQbHljQR75SilpedCTfhPWDhtUwIJpnDVtspr9nMg=="
+      },
+      "NaCl.Net": {
+        "type": "Transitive",
+        "resolved": "0.1.13",
+        "contentHash": "AVg1455RQnyTy6tiessudruZHvbl70QWRPyx3og2I1Fei17LDNc7Z3DRgqN2+PsySBui/1EDP4A7adhQXydi6g=="
+      },
+      "System.Memory": {
+        "type": "Transitive",
+        "resolved": "4.6.0",
+        "contentHash": "OEkbBQoklHngJ8UD8ez2AERSk2g+/qpAaSWWCBFbpH727HxDq5ydVkuncBaKcKfwRqXGWx64dS6G1SUScMsitg=="
+      },
+      "System.Security.Cryptography.Pkcs": {
+        "type": "Transitive",
+        "resolved": "9.0.18",
+        "contentHash": "NKMKhUdLGNZryY9GXXTF5dXyP6S37EYXhiA2JYvwshJbd4DRq07IOS9it8Opi9atadvv5rlNkD76Mio+5Oo2aQ=="
+      },
+      "System.ServiceModel.Primitives": {
+        "type": "Transitive",
+        "resolved": "8.1.2",
+        "contentHash": "xlJ07FAUSDjPL/GhvVY1/KVPWn2ce056X4nHPwqAa5rkNLiNN5rqh6VcgMUoF6J7ckwhkVJ1vVx/K/47nyyR9g==",
+        "dependencies": {
+          "Microsoft.Extensions.ObjectPool": "8.0.10",
+          "System.Security.Cryptography.Xml": "8.0.2"
+        }
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/docker/boot_portal_config.sample.json b/docker/boot_portal_config.sample.json
index abae5d5..24f76a0 100644
--- a/docker/boot_portal_config.sample.json
+++ b/docker/boot_portal_config.sample.json
@@ -68,9 +68,12 @@
   "peer_tip_max_future_seconds": 7200,
   "network_read_rate_limit_per_minute": 180,
   "peer_write_rate_limit_per_minute": 90,
+  "peer_state_bundle_fetch_rate_limit_per_minute": 12,
   "mining_api_share_rate_limit_per_minute": 120,
   "admin_rate_limit_per_minute": 12,
   "max_share_request_bytes": 262144,
+  "datum_max_connections": 32,
+  "datum_read_timeout_seconds": 15,
   "max_coinbase_hex_chars": 20000,
   "max_merkle_path_entries": 64,
   "testing_round_reset_mode": "none",
@@ -80,7 +83,7 @@
   "v22_activation_block_height": 959500,
   "enable_admin_api": false,
   "admin_api_key": "change-this-admin-key",
-  "pool_payout_script": "bc1qrwsx8fs0l6z7ugp5cvzy6lhss7jlyru3kg9s8y",
+  "pool_payout_script": "",
   "winners_list_size": 299,
   "grid_labs_support_fee_enabled": true,
   "work_set_reserve_multiplier": 3,
diff --git a/docker/boot_portal_config.testnet4.sample.json b/docker/boot_portal_config.testnet4.sample.json
index 568870b..32084f8 100644
--- a/docker/boot_portal_config.testnet4.sample.json
+++ b/docker/boot_portal_config.testnet4.sample.json
@@ -68,9 +68,12 @@
   "peer_tip_max_future_seconds": 7200,
   "network_read_rate_limit_per_minute": 180,
   "peer_write_rate_limit_per_minute": 90,
+  "peer_state_bundle_fetch_rate_limit_per_minute": 12,
   "mining_api_share_rate_limit_per_minute": 120,
   "admin_rate_limit_per_minute": 12,
   "max_share_request_bytes": 262144,
+  "datum_max_connections": 32,
+  "datum_read_timeout_seconds": 15,
   "max_coinbase_hex_chars": 20000,
   "max_merkle_path_entries": 64,
   "testing_round_reset_mode": "none",
@@ -80,7 +83,7 @@
   "v22_activation_block_height": 0,
   "enable_admin_api": false,
   "admin_api_key": "change-this-admin-key",
-  "pool_payout_script": "mxt9bYPtfBdzoTeZcHr23QgL4Un45PVvF5",
+  "pool_payout_script": "",
   "winners_list_size": 299,
   "grid_labs_support_fee_enabled": true,
   "work_set_reserve_multiplier": 3,
diff --git a/docs/security-hardening-rt-043-049.md b/docs/security-hardening-rt-043-049.md
new file mode 100644
index 0000000..5bcf2ed
--- /dev/null
+++ b/docs/security-hardening-rt-043-049.md
@@ -0,0 +1,48 @@
+# Follow-on Security Hardening Candidate
+
+This branch is intentionally separate from
+`codex/security-rt-041-042@400fc6e`. Commit `400fc6e` remains immutable for the
+independent retest of RT-2026-041 and RT-2026-042. The controls below are a
+follow-on candidate and must not be described as independently verified until
+that review is recorded and the branches are deliberately integrated.
+
+## Implemented Controls
+
+- DATUM connections, declared message length, and read time are bounded before
+  allocating or waiting for a message body.
+- Miner labels are bounded and normalized before storage; legacy dynamic HTML
+  output escapes miner-controlled labels and responses carry a restrictive CSP.
+- Reachability tests require authenticated administration, reject non-public
+  destinations, disable redirects, validate the actual connection address, and
+  no longer implement unauthenticated UDP callbacks.
+- A fresh mining proof cannot teach the node a Bitcoin parent. Parent authority
+  comes from the attached Bitcoin source; retained proof recovery remains in the
+  validating state reconciliation path.
+- Payout configuration fails closed. DATUM work is unavailable without a valid,
+  explicitly configured payout identity.
+- Snapshot payout validation accepts the canonical configured variant only.
+- Candidate-state fetch decisions do not trust peer-claimed total difficulty,
+  and outbound state-bundle fetches have a per-peer budget.
+- One- and two-block RPC reconciliation use the reorganization path and unwind
+  removed snapshot families before applying a replacement boundary.
+- Repeated failed RPC polls cannot renew the attached-node safety grace period;
+  mining becomes unsafe after the configured grace until synchronized RPC
+  authority returns.
+- NuGet restores are locked, container bases are digest-pinned, mutable-branch
+  live updates are refused, and CI performs dependency, secret, and filesystem
+  vulnerability checks.
+
+## Verification
+
+Run:
+
+```bash
+dotnet restore boot_portal.slnx --locked-mode
+dotnet test boot_portal.slnx --no-restore
+dotnet list boot_portal/boot_portal.csproj package --vulnerable --include-transitive
+dotnet list boot.tests/boot.tests.csproj package --vulnerable --include-transitive
+```
+
+Package deployment and the public soak remain blocked on the exact `400fc6e`
+retest, review of this follow-on branch, deliberate integration into the current
+runtime line, and appliance acceptance against digest-locked images.
diff --git a/update_server.sh b/update_server.sh
index 7036316..1e75413 100755
--- a/update_server.sh
+++ b/update_server.sh
@@ -12,14 +12,33 @@ sed_escape() {
     printf '%s' "$1" | sed -e 's/[&|]/\\&/g'
 }
 
-echo "--- Starting Update Process ---"
+RELEASE_REF="${GRIDPOOL_RELEASE_REF:-${1:-}}"
+if [[ -z "$RELEASE_REF" ]]; then
+    echo "usage: GRIDPOOL_RELEASE_REF=<signed-tag-or-40-char-commit> $0" >&2
+    echo "Refusing to update a live node from a mutable branch." >&2
+    exit 2
+fi
+
+echo "--- Starting revision-pinned update ---"
 
 echo "Stopping service..."
 sudo systemctl stop $SERVICE_NAME
 
-echo "Pulling from Git..."
-cd $APP_DIR
-git pull origin main
+echo "Fetching selected release revision..."
+cd "$ROOT_DIR"
+git fetch --tags origin
+if [[ "$RELEASE_REF" == refs/tags/* || "$RELEASE_REF" == v* ]]; then
+    TAG="${RELEASE_REF#refs/tags/}"
+    git verify-tag "$TAG"
+    RESOLVED_REF="$TAG^{commit}"
+elif [[ "$RELEASE_REF" =~ ^[0-9a-fA-F]{40}$ ]]; then
+    RESOLVED_REF="$RELEASE_REF"
+else
+    echo "release ref must be a signed v* tag or full 40-character commit" >&2
+    exit 2
+fi
+git checkout --detach "$RESOLVED_REF"
+cd "$APP_DIR"
 
 echo "Rebuilding..."
 dotnet publish boot_portal.csproj -c Release -o "$TEMP_PUBLISH_DIR"
@@ -40,4 +59,4 @@ sudo systemctl daemon-reload
 echo "Restarting service..."
 sudo systemctl start $SERVICE_NAME
 
-echo "--- Update Complete ---"
+echo "--- Revision-pinned update complete: $(git rev-parse HEAD) ---"

From 7510bab59dc1918c34c384d0cb6e12f01e51b5f7 Mon Sep 17 00:00:00 2001
From: keegreil <keegreil@gmail.com>
Date: Tue, 18 Aug 2026 23:48:44 -0400
Subject: [PATCH 02/10] ci: use license-free pinned security scanners

---
 .github/workflows/build.yml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 4fc419b..84ba331 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -47,7 +47,7 @@ jobs:
         run: dotnet list boot_portal/boot_portal.csproj package --vulnerable --include-transitive
 
       - name: Filesystem vulnerability scan
-        uses: aquasecurity/trivy-action@0.30.0
+        uses: aquasecurity/trivy-action@v0.36.0
         with:
           scan-type: fs
           scan-ref: .
@@ -62,9 +62,11 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: gitleaks/gitleaks-action@v2
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Scan repository history for secrets
+        run: >-
+          docker run --rm -v "$PWD:/repo"
+          ghcr.io/gitleaks/gitleaks@sha256:c00b6bd0aeb3071cbcb79009cb16a60dd9e0a7c60e2be9ab65d25e6bc8abbb7f
+          detect --source=/repo --redact --no-banner
 
   docker:
     runs-on: ubuntu-latest

From 4c6cb3dab82fb6cf3e20718b01a0f97940e1675e Mon Sep 17 00:00:00 2001
From: keegreil <keegreil@gmail.com>
Date: Tue, 18 Aug 2026 23:49:31 -0400
Subject: [PATCH 03/10] ci: attest runtime image provenance and SBOM

---
 .github/workflows/build.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 84ba331..7692b47 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -75,6 +75,8 @@ jobs:
     permissions:
       contents: read
       packages: write
+      id-token: write
+      attestations: write
 
     steps:
       - name: Checkout
@@ -113,5 +115,7 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          sbom: true
+          provenance: mode=max
           cache-from: type=gha
           cache-to: type=gha,mode=max

From 608150f758fc3c5210349a74e2079bf66b768f10 Mon Sep 17 00:00:00 2001
From: keegreil <keegreil@gmail.com>
Date: Tue, 18 Aug 2026 23:53:59 -0400
Subject: [PATCH 04/10] docs: record appliance candidate acceptance progress

---
 docs/umbrel-start9-launch-checklist.md | 30 ++++++++++++++++++++++----
 1 file changed, 26 insertions(+), 4 deletions(-)

diff --git a/docs/umbrel-start9-launch-checklist.md b/docs/umbrel-start9-launch-checklist.md
index 9218c28..85c8a13 100644
--- a/docs/umbrel-start9-launch-checklist.md
+++ b/docs/umbrel-start9-launch-checklist.md
@@ -301,7 +301,7 @@ Goal: make installation boring and reversible.
 - [x] Provide safe default ports for UI, peer HTTP/WebSocket, UDP relay, and the
   optional experimental DATUM listener.
 - [ ] Provide migration scripts for state files.
-- [ ] Provide backup and restore docs for node identity keys and pool state.
+- [x] Provide backup and restore docs for node identity keys and pool state.
 - [ ] Test fresh install on a clean Linux VM.
 - [ ] Test fresh install on Raspberry Pi 5 or equivalent ARM64 host.
 - [ ] Test upgrade from previous release without wiping state.
@@ -322,6 +322,20 @@ Completion criteria:
 
 Current evidence:
 
+- A private acceptance orchestrator now provides StartOS, Umbrel-dev, regtest,
+  and operator-assisted Umbrel backends with smoke, lifecycle, destructive, and
+  release profiles plus sanitized JSON/Markdown evidence.
+- StartOS `0.1.0:17` upgraded from `0.1.0:13`; a package-generation bug that
+  replaced node identity keys was found and fixed. Identity then survived a
+  package restart and full StartOS reboot. Encrypted uninstall/restore remains
+  blocked until the operator supplies the existing server backup password.
+- Umbrel-dev upgraded through Umbrel's package RPC with state persistence and
+  correct private-port exposure. Its Bitcoin dependency remains in IBD, so the
+  synchronized-SV2 gate cannot pass yet.
+- Candidate workflows build both package architectures, produce checksums,
+  SPDX SBOMs and provenance, and verify digest-locked image inputs. A real
+  ARM64 install remains a separate gate from a successful ARM64 build.
+
 - Docker sample config exists at `docker/boot_portal_config.sample.json`.
 - Testnet4 sample config exists at `docker/boot_portal_config.testnet4.sample.json`.
 - GitHub Actions publishes branch, tag, SHA, and `latest` images to GHCR; `develop` is available for staging once that branch exists.
@@ -531,9 +545,9 @@ or cryptographic secrets.
 - [x] Keep duplicate share suppression tested.
 - [x] Keep firmware coinbase truncation detection tested.
 - [x] Keep DATUM quickdiff reconstruction observable through diagnostics.
-- [ ] Add malformed peer bundle tests.
+- [x] Add malformed and proofless peer bundle tests.
 - [ ] Add rate limits for low-difficulty peer spam.
-- [ ] Add rate limits for state bundle fetches.
+- [x] Add per-peer rate limits for outbound state bundle fetches.
 - [x] Add health-monitor checks for GridPool block found, service down, peer divergence, version mismatch, coinbase stress mode, and DATUM acceptance drops.
 - [x] Add alert suppression so ordinary snapshot transitions and brief
   different-height propagation lag do not page the operator as consensus forks.
@@ -562,6 +576,11 @@ or cryptographic secrets.
   regtest confirms that declared-target candidates cannot rotate payout state
   and proofless bundles cannot alter winners or paid lineage. See
   [security-release-rt-2026-041-042.md](security-release-rt-2026-041-042.md).
+- [ ] Review and integrate the separate RT-2026-043 through RT-2026-049
+  hardening candidate after the exact `400fc6e` critical retest is recorded.
+  The candidate adds DATUM bounds, fail-closed payout and parent authority,
+  SSRF/UDP protections, canonical payout validation, shallow-reorg coverage,
+  locked dependencies, and package supply-chain gates.
 - [ ] Design an independently verifiable paid-lineage bootstrap format before
   treating node-less `external-fallback` peers as payout-state authorities.
 
@@ -580,7 +599,10 @@ Current evidence:
 - Duplicate and firmware-truncation regression tests live in `boot.tests/ShareAttributionTests.cs`.
 - Multi-node monitoring lives in `scripts/gridpool-health-monitor.mjs` and writes compact JSONL logs for review.
 - `coinbase_uncondensed_outputs_enabled` is available for non-production firmware stress testing and rejected in production configs.
-- Low-difficulty peer-spam policy and state-bundle fetch abuse tests still need dedicated implementation.
+- Low-difficulty peer submissions are bounded by proof validation and the
+  peer-write limiter; a dedicated middleware integration test remains open.
+- Outbound state-bundle fetch abuse now has a deterministic per-peer limiter
+  test. Proofless and malformed bundle rejection is covered in the state tests.
 - The active audit and disclosure model are tracked in
   [security-privacy-review.md](security-privacy-review.md).
 

From bb8b47174f5ac90e30b70d1161fd3aa6ee20d0e7 Mon Sep 17 00:00:00 2001
From: keegreil <keegreil@gmail.com>
Date: Wed, 19 Aug 2026 00:01:05 -0400
Subject: [PATCH 05/10] ci: baseline audited historical secret findings

---
 .gitleaks.toml                        | 15 +++++++++++++++
 docs/security-hardening-rt-043-049.md |  6 ++++++
 2 files changed, 21 insertions(+)
 create mode 100644 .gitleaks.toml

diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..6938530
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,15 @@
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Audited historical fixtures and retired prototype identities; new findings remain blocking"
+fingerprints = [
+  "7ded520203d0c6859e1de70892651e12be8605c0:scripts/main-beta-status.sh:curl-auth-user:36",
+  "428a84391ec4bc119cb32391ce933cfd318ca8e4:boot.tests/PoolConfigValidatorTests.cs:generic-api-key:142",
+  "a636ac92f856e35fff3c7438d5d3acbfdf24b7d4:boot_portal/boot_portal_config.json:generic-api-key:3",
+  "07f8da37b297264cbc349ecc695c705e59392f6a:boot_portal/boot_portal_config.json:generic-api-key:2",
+  "07f8da37b297264cbc349ecc695c705e59392f6a:boot_portal/boot_portal_config.json:generic-api-key:3",
+  "2df39a9959680f42455d178d661912af37a627ac:boot_portal/boot_portal_config.json:generic-api-key:3",
+  "f8d788e4b771aea87f39a9b6ba9b19e86eb90dd3:boot_portal/boot_portal_config.json:generic-api-key:3",
+  "f8d788e4b771aea87f39a9b6ba9b19e86eb90dd3:boot_portal/boot_portal_config.json:generic-api-key:2",
+]
diff --git a/docs/security-hardening-rt-043-049.md b/docs/security-hardening-rt-043-049.md
index 5bcf2ed..8e75d02 100644
--- a/docs/security-hardening-rt-043-049.md
+++ b/docs/security-hardening-rt-043-049.md
@@ -32,6 +32,12 @@ that review is recorded and the branches are deliberately integrated.
   live updates are refused, and CI performs dependency, secret, and filesystem
   vulnerability checks.
 
+The repository history contains retired prototype node identities from early
+tracked configuration files, plus audited test/command false positives. Their
+exact Gitleaks fingerprints are baselined in `.gitleaks.toml`; those historical
+identities are considered compromised and must never be used by an active
+node. Any finding outside that immutable baseline fails CI.
+
 ## Verification
 
 Run:

From fc8dfd3d02c25ddafca6becca4b1ac3847cd4be8 Mon Sep 17 00:00:00 2001
From: keegreil <keegreil@gmail.com>
Date: Wed, 19 Aug 2026 00:05:43 -0400
Subject: [PATCH 06/10] ci: use exact gitleaks historical fingerprints

---
 .gitleaks.toml                        | 15 ---------------
 .gitleaksignore                       |  9 +++++++++
 docs/security-hardening-rt-043-049.md |  2 +-
 3 files changed, 10 insertions(+), 16 deletions(-)
 delete mode 100644 .gitleaks.toml
 create mode 100644 .gitleaksignore

diff --git a/.gitleaks.toml b/.gitleaks.toml
deleted file mode 100644
index 6938530..0000000
--- a/.gitleaks.toml
+++ /dev/null
@@ -1,15 +0,0 @@
-[extend]
-useDefault = true
-
-[allowlist]
-description = "Audited historical fixtures and retired prototype identities; new findings remain blocking"
-fingerprints = [
-  "7ded520203d0c6859e1de70892651e12be8605c0:scripts/main-beta-status.sh:curl-auth-user:36",
-  "428a84391ec4bc119cb32391ce933cfd318ca8e4:boot.tests/PoolConfigValidatorTests.cs:generic-api-key:142",
-  "a636ac92f856e35fff3c7438d5d3acbfdf24b7d4:boot_portal/boot_portal_config.json:generic-api-key:3",
-  "07f8da37b297264cbc349ecc695c705e59392f6a:boot_portal/boot_portal_config.json:generic-api-key:2",
-  "07f8da37b297264cbc349ecc695c705e59392f6a:boot_portal/boot_portal_config.json:generic-api-key:3",
-  "2df39a9959680f42455d178d661912af37a627ac:boot_portal/boot_portal_config.json:generic-api-key:3",
-  "f8d788e4b771aea87f39a9b6ba9b19e86eb90dd3:boot_portal/boot_portal_config.json:generic-api-key:3",
-  "f8d788e4b771aea87f39a9b6ba9b19e86eb90dd3:boot_portal/boot_portal_config.json:generic-api-key:2",
-]
diff --git a/.gitleaksignore b/.gitleaksignore
new file mode 100644
index 0000000..5407cef
--- /dev/null
+++ b/.gitleaksignore
@@ -0,0 +1,9 @@
+# Audited historical fixtures and retired prototype identities.
+7ded520203d0c6859e1de70892651e12be8605c0:scripts/main-beta-status.sh:curl-auth-user:36
+428a84391ec4bc119cb32391ce933cfd318ca8e4:boot.tests/PoolConfigValidatorTests.cs:generic-api-key:142
+a636ac92f856e35fff3c7438d5d3acbfdf24b7d4:boot_portal/boot_portal_config.json:generic-api-key:3
+07f8da37b297264cbc349ecc695c705e59392f6a:boot_portal/boot_portal_config.json:generic-api-key:2
+07f8da37b297264cbc349ecc695c705e59392f6a:boot_portal/boot_portal_config.json:generic-api-key:3
+2df39a9959680f42455d178d661912af37a627ac:boot_portal/boot_portal_config.json:generic-api-key:3
+f8d788e4b771aea87f39a9b6ba9b19e86eb90dd3:boot_portal/boot_portal_config.json:generic-api-key:3
+f8d788e4b771aea87f39a9b6ba9b19e86eb90dd3:boot_portal/boot_portal_config.json:generic-api-key:2
diff --git a/docs/security-hardening-rt-043-049.md b/docs/security-hardening-rt-043-049.md
index 8e75d02..c99c7f8 100644
--- a/docs/security-hardening-rt-043-049.md
+++ b/docs/security-hardening-rt-043-049.md
@@ -34,7 +34,7 @@ that review is recorded and the branches are deliberately integrated.
 
 The repository history contains retired prototype node identities from early
 tracked configuration files, plus audited test/command false positives. Their
-exact Gitleaks fingerprints are baselined in `.gitleaks.toml`; those historical
+exact Gitleaks fingerprints are baselined in `.gitleaksignore`; those historical
 identities are considered compromised and must never be used by an active
 node. Any finding outside that immutable baseline fails CI.
 

From cfa07eef41331d9cc4b0c115a8063c8bf52b130a Mon Sep 17 00:00:00 2001
From: keegreil <keegreil@gmail.com>
Date: Wed, 19 Aug 2026 00:15:11 -0400
Subject: [PATCH 07/10] docs: update appliance candidate evidence and gates

---
 docs/umbrel-start9-launch-checklist.md | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/docs/umbrel-start9-launch-checklist.md b/docs/umbrel-start9-launch-checklist.md
index 85c8a13..523c8ea 100644
--- a/docs/umbrel-start9-launch-checklist.md
+++ b/docs/umbrel-start9-launch-checklist.md
@@ -302,9 +302,12 @@ Goal: make installation boring and reversible.
   optional experimental DATUM listener.
 - [ ] Provide migration scripts for state files.
 - [x] Provide backup and restore docs for node identity keys and pool state.
-- [ ] Test fresh install on a clean Linux VM.
+- [x] Test the Umbrel wrapper's fresh-install and UI-driven payout flow in the
+  isolated Umbrel-dev VM/container environment.
 - [ ] Test fresh install on Raspberry Pi 5 or equivalent ARM64 host.
-- [ ] Test upgrade from previous release without wiping state.
+- [x] Test StartOS upgrade from `0.1.0:13` through `0.1.0:17` without wiping
+  state; the candidate harness retains node, payout, token, and SV2 authority
+  fingerprints for the final release run.
 - [ ] Test uninstall leaves keys/state backed up or clearly prompts before deletion.
 - [ ] Run the Umbrel and StartOS package builds for seven days overlapping the
   protocol soak, including at least one planned restart and one upgrade.
@@ -329,6 +332,11 @@ Current evidence:
   replaced node identity keys was found and fixed. Identity then survived a
   package restart and full StartOS reboot. Encrypted uninstall/restore remains
   blocked until the operator supplies the existing server backup password.
+- The StartOS Bitcoin Knots dependency is not undergoing ordinary IBD: it is
+  configured with `consensusrules="rdts"` and remains on height 961636 while
+  non-RDTS peers advertise a longer chain. Full mining acceptance requires an
+  explicit operator chain-policy decision; package automation must not change
+  Bitcoin consensus policy.
 - Umbrel-dev upgraded through Umbrel's package RPC with state persistence and
   correct private-port exposure. Its Bitcoin dependency remains in IBD, so the
   synchronized-SV2 gate cannot pass yet.
@@ -347,11 +355,12 @@ Current evidence:
   and upgrade/backup tests pass.
 - `gridpool-sv2-pool` RPC mode passed unit tests, the wider SRI miner-workspace
   compile, and a live Core 31 mainnet template/tip-transition smoke test.
-- The StartOS package passes TypeScript checking and JavaScript bundling. Final
-  `.s9pk` packing and sideload testing require a reachable StartOS build target.
-- The Umbrel wrapper passes structural/template checks. Its first-run shell
-  configuration is acceptable for sideload testing but must become an in-app
-  payout-address setup screen before official app-store submission.
+- The StartOS package passes TypeScript checking, bundling, x86_64/aarch64
+  packing, upgrade, restart, and reboot checks. Final digest-pinned artifacts
+  must be rebuilt after security integration.
+- The Umbrel wrapper passes structural/template checks and uses an in-app,
+  one-time payout-address setup flow. Final uninstall/copied-data restore and a
+  real-operator candidate run remain open.
 
 ## G5.5: Miner Firmware, Rental, And Stratum V2 Compatibility
 

From f09ce5e6e2f90cf85c009a586b2d02db792ea4c4 Mon Sep 17 00:00:00 2001
From: keegreil <keegreil@gmail.com>
Date: Thu, 20 Aug 2026 21:53:40 -0400
Subject: [PATCH 08/10] docs: record Core 31 appliance acceptance

---
 docs/umbrel-start9-launch-checklist.md | 27 +++++++++++++-------------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/docs/umbrel-start9-launch-checklist.md b/docs/umbrel-start9-launch-checklist.md
index 523c8ea..9fb248d 100644
--- a/docs/umbrel-start9-launch-checklist.md
+++ b/docs/umbrel-start9-launch-checklist.md
@@ -328,17 +328,18 @@ Current evidence:
 - A private acceptance orchestrator now provides StartOS, Umbrel-dev, regtest,
   and operator-assisted Umbrel backends with smoke, lifecycle, destructive, and
   release profiles plus sanitized JSON/Markdown evidence.
-- StartOS `0.1.0:17` upgraded from `0.1.0:13`; a package-generation bug that
+- StartOS `0.1.0:19` upgraded from `0.1.0:13`; a package-generation bug that
   replaced node identity keys was found and fixed. Identity then survived a
-  package restart and full StartOS reboot. Encrypted uninstall/restore remains
-  blocked until the operator supplies the existing server backup password.
-- The StartOS Bitcoin Knots dependency is not undergoing ordinary IBD: it is
-  configured with `consensusrules="rdts"` and remains on height 961636 while
-  non-RDTS peers advertise a longer chain. Full mining acceptance requires an
-  explicit operator chain-policy decision; package automation must not change
-  Bitcoin consensus policy.
-- Umbrel-dev upgraded through Umbrel's package RPC with state persistence and
-  correct private-port exposure. Its Bitcoin dependency remains in IBD, so the
+  package restart and full StartOS reboot. The operator explicitly replaced
+  the earlier RDTS Knots dependency with synchronized main-chain Core 31. RPC,
+  both ZMQ topics, native SV2, per-channel slot-0 attribution, named Bitaxe
+  mining, interfaces, and restart persistence now pass. Encrypted
+  uninstall/restore remains blocked until the operator supplies the existing
+  server backup password.
+- Umbrel-dev `0.1.0-beta.7` upgraded through Umbrel's package RPC with state
+  persistence and correct private-port exposure. A copied-data recovery
+  preserved node identity, payout, adapter-token, and SV2-authority
+  fingerprints. Its disposable Bitcoin dependency remains in IBD, so the
   synchronized-SV2 gate cannot pass yet.
 - Candidate workflows build both package architectures, produce checksums,
   SPDX SBOMs and provenance, and verify digest-locked image inputs. A real
@@ -358,9 +359,9 @@ Current evidence:
 - The StartOS package passes TypeScript checking, bundling, x86_64/aarch64
   packing, upgrade, restart, and reboot checks. Final digest-pinned artifacts
   must be rebuilt after security integration.
-- The Umbrel wrapper passes structural/template checks and uses an in-app,
-  one-time payout-address setup flow. Final uninstall/copied-data restore and a
-  real-operator candidate run remain open.
+- The Umbrel wrapper passes structural/template checks, uses an in-app one-time
+  payout-address setup flow, and passed a copied-data recovery in Umbrel-dev. A
+  real-operator candidate run remains open.
 
 ## G5.5: Miner Firmware, Rental, And Stratum V2 Compatibility
 

From b4c92a9090c11efd74298e06b02cfe56727373ea Mon Sep 17 00:00:00 2001
From: keegreil <keegreil@gmail.com>
Date: Wed, 26 Aug 2026 23:23:24 -0400
Subject: [PATCH 09/10] Harden regtest sibling reconciliation

---
 boot.tests/BitcoinHashesTests.cs              |  35 +++
 boot.tests/BitcoinRpcClientTests.cs           |   3 +-
 boot.tests/PoolConfigValidatorTests.cs        |  53 +++-
 boot.tests/ShareAttributionTests.cs           | 111 +++++++-
 .../BitcoinRpcReconciliationService.cs        |  21 ++
 boot_portal/Models/PoolConfig.cs              |   3 +
 boot_portal/Services/BitcoinRpcClient.cs      |   6 +-
 .../Services/BootProtocolStateService.cs      | 129 ++++++++-
 boot_portal/Utils/Bech32.cs                   |   6 +-
 boot_portal/Utils/BitcoinHashes.cs            |  13 +-
 boot_portal/Utils/BitcoinScript.cs            |  31 ++-
 boot_portal/Utils/PoolConfigValidator.cs      |   7 +
 docs/README.md                                |   2 +
 docs/regtest-release-retest.md                | 259 ++++++++++++++++++
 docs/security-release-rt-2026-041-042.md      |  42 ++-
 docs/umbrel-start9-launch-checklist.md        |   8 +-
 16 files changed, 683 insertions(+), 46 deletions(-)
 create mode 100644 boot.tests/BitcoinHashesTests.cs
 create mode 100644 docs/regtest-release-retest.md

diff --git a/boot.tests/BitcoinHashesTests.cs b/boot.tests/BitcoinHashesTests.cs
new file mode 100644
index 0000000..f508c67
--- /dev/null
+++ b/boot.tests/BitcoinHashesTests.cs
@@ -0,0 +1,35 @@
+using boot_portal.Utils;
+
+namespace boot.tests;
+
+[TestClass]
+public sealed class BitcoinHashesTests
+{
+    private const string RegtestGenesisHeader =
+        "01000000" +
+        "0000000000000000000000000000000000000000000000000000000000000000" +
+        "3ba3edfd7a7b12b27ac72c3e67768f617fc81bc3888a51323a9fb8aa4b1e5e4a" +
+        "dae5494d" +
+        "ffff7f20" +
+        "02000000";
+
+    [TestMethod]
+    public void RegtestPowLimitAcceptsRegtestGenesisAndMainnetRejectsIt()
+    {
+        BitcoinHeaderEvaluation regtest = BitcoinHashes.EvaluateHeader(
+            RegtestGenesisHeader,
+            DateTime.UtcNow,
+            BitcoinScript.Regtest);
+        BitcoinHeaderEvaluation mainnet = BitcoinHashes.EvaluateHeader(
+            RegtestGenesisHeader,
+            DateTime.UtcNow,
+            BitcoinScript.Mainnet);
+
+        Assert.IsTrue(regtest.IsValid, regtest.RejectionReason);
+        Assert.AreEqual(
+            "0f9188f13cb7b2c71f2a335e3a4fc328bf5beb436012afca590b1a11466e2206",
+            regtest.BlockHash);
+        Assert.IsFalse(mainnet.IsValid);
+        StringAssert.Contains(mainnet.RejectionReason, "proof-of-work limit");
+    }
+}
diff --git a/boot.tests/BitcoinRpcClientTests.cs b/boot.tests/BitcoinRpcClientTests.cs
index 911f564..a655f4c 100644
--- a/boot.tests/BitcoinRpcClientTests.cs
+++ b/boot.tests/BitcoinRpcClientTests.cs
@@ -23,7 +23,7 @@ public async Task ClientParsesBlockchainAndZmqResponsesWithoutEmbeddingCredentia
             string result = method switch
             {
                 "getblockchaininfo" => """
-                    {"blocks":100,"headers":100,"bestblockhash":"block-100","initialblockdownload":false,"verificationprogress":1.0}
+                    {"chain":"regtest","blocks":100,"headers":100,"bestblockhash":"block-100","initialblockdownload":false,"verificationprogress":1.0}
                     """,
                 "getzmqnotifications" => """
                     [{"type":"pubhashblock","address":"tcp://0.0.0.0:28332"},{"type":"pubrawblock","address":"tcp://0.0.0.0:28333"}]
@@ -46,6 +46,7 @@ public async Task ClientParsesBlockchainAndZmqResponsesWithoutEmbeddingCredentia
 
         Assert.AreEqual(100L, info.Blocks);
         Assert.AreEqual("block-100", info.BestBlockHash);
+        Assert.AreEqual("regtest", info.Chain);
         CollectionAssert.AreEquivalent(
             new[] { "pubhashblock", "pubrawblock" },
             topics.Select(topic => topic.Topic).ToArray());
diff --git a/boot.tests/PoolConfigValidatorTests.cs b/boot.tests/PoolConfigValidatorTests.cs
index 3e8f0dd..46b16e5 100644
--- a/boot.tests/PoolConfigValidatorTests.cs
+++ b/boot.tests/PoolConfigValidatorTests.cs
@@ -222,7 +222,7 @@ public void UnsupportedBitcoinNetworkFailsValidation()
     {
         var config = new PoolConfig
         {
-            BitcoinNetwork = "regtest"
+            BitcoinNetwork = "signet"
         };
 
         List<string> errors = PoolConfigValidator.Validate(config);
@@ -230,6 +230,57 @@ public void UnsupportedBitcoinNetworkFailsValidation()
         Assert.IsTrue(errors.Any(error => error.Contains("bitcoin_network", StringComparison.OrdinalIgnoreCase)));
     }
 
+    [TestMethod]
+    public void RegtestUsesBcrtAddressesAndRejectsMainnetAddresses()
+    {
+        byte[] script = Enumerable.Range(0, 22).Select(i => (byte)i).ToArray();
+        script[0] = 0x00;
+        script[1] = 0x14;
+        string regtestAddress = BitcoinScript.ScriptToAddress(script, BitcoinScript.Regtest);
+        var config = new PoolConfig
+        {
+            BitcoinNetwork = BitcoinScript.Regtest,
+            PoolPayoutScript = regtestAddress
+        };
+
+        Assert.IsTrue(regtestAddress.StartsWith("bcrt1", StringComparison.OrdinalIgnoreCase));
+        CollectionAssert.AreEqual(Array.Empty<string>(), PoolConfigValidator.Validate(config));
+
+        config.PoolPayoutScript = "bc1qrwsx8fs0l6z7ugp5cvzy6lhss7jlyru3kg9s8y";
+        Assert.IsTrue(PoolConfigValidator.Validate(config).Any(error =>
+            error.Contains("pool_payout_script", StringComparison.OrdinalIgnoreCase)));
+    }
+
+    [TestMethod]
+    public void EmptySnapshotBootstrapIsRestrictedToNonProductionRegtest()
+    {
+        var regtest = new PoolConfig
+        {
+            BitcoinNetwork = BitcoinScript.Regtest,
+            NodeMode = "development",
+            AllowEmptySnapshotBootstrap = true
+        };
+        var mainnet = new PoolConfig
+        {
+            BitcoinNetwork = BitcoinScript.Mainnet,
+            NodeMode = "development",
+            AllowEmptySnapshotBootstrap = true
+        };
+        var productionRegtest = new PoolConfig
+        {
+            BitcoinNetwork = BitcoinScript.Regtest,
+            NodeMode = "production",
+            AllowEmptySnapshotBootstrap = true
+        };
+
+        Assert.IsFalse(PoolConfigValidator.Validate(regtest).Any(error =>
+            error.Contains("allow_empty_snapshot_bootstrap", StringComparison.OrdinalIgnoreCase)));
+        Assert.IsTrue(PoolConfigValidator.Validate(mainnet).Any(error =>
+            error.Contains("allow_empty_snapshot_bootstrap", StringComparison.OrdinalIgnoreCase)));
+        Assert.IsTrue(PoolConfigValidator.Validate(productionRegtest).Any(error =>
+            error.Contains("allow_empty_snapshot_bootstrap", StringComparison.OrdinalIgnoreCase)));
+    }
+
     [TestMethod]
     public void BadRateLimitFailsValidation()
     {
diff --git a/boot.tests/ShareAttributionTests.cs b/boot.tests/ShareAttributionTests.cs
index 0d17927..8a2428b 100644
--- a/boot.tests/ShareAttributionTests.cs
+++ b/boot.tests/ShareAttributionTests.cs
@@ -397,6 +397,38 @@ public async Task LocalBitcoinConfirmationPromotesStoredCandidateExactlyOnceAsyn
         Assert.AreEqual(confirmed.CurrentStateId, duplicate.CurrentStateId);
     }
 
+    [TestMethod]
+    public async Task NotificationFirstExceptionRequiresExactLocallyValidatedActiveChainBlockAsync()
+    {
+        using var harness = TestHarness.Create(currentTipBlockHash: RecentBlockParentHash);
+        harness.Config.BitcoinNotificationMode = BitcoinNotificationModes.AttachedNode;
+        Assert.IsTrue(harness.StateService.ObserveLocalChainTipHeader(
+            RecentBlockHeaderHex,
+            "rpc-reconcile",
+            DateTime.UtcNow,
+            945001));
+        await harness.StateService.ObserveChainTipAsync(RecentBlockHash, "rpc-reconcile", 945001);
+
+        var method = typeof(BootProtocolStateService).GetMethod(
+            "IsLocallyConfirmedCurrentBlockShareNoLock",
+            System.Reflection.BindingFlags.Instance | System.Reflection.BindingFlags.NonPublic)!;
+        bool exactMatch = (bool)method.Invoke(harness.StateService, [new BootShareHeaderEvaluationResult
+        {
+            IsValid = true,
+            IsBlock = true,
+            BlockHash = RecentBlockHash
+        }])!;
+        bool differentHash = (bool)method.Invoke(harness.StateService, [new BootShareHeaderEvaluationResult
+        {
+            IsValid = true,
+            IsBlock = true,
+            BlockHash = "0000000000000000000000000000000000000000000000000000000000000076"
+        }])!;
+
+        Assert.IsTrue(exactMatch);
+        Assert.IsFalse(differentHash);
+    }
+
     [TestMethod]
     public async Task PeerShareWithForgedMinerAddressIsAcceptedAndAttributedToSlotZeroAsync()
     {
@@ -1431,6 +1463,73 @@ public async Task V22SiblingBoundaryRaceConvergesWithoutBranchVotingAndV21DoesNo
         Assert.AreNotEqual(v21Alice.StateService.GetNetworkStatus().ActiveSnapshotId, v21Bob.StateService.GetNetworkStatus().ActiveSnapshotId);
     }
 
+    [TestMethod]
+    public async Task RegtestSiblingImportAcceptsProofRecordedAgainstExplicitEmptyBootstrapSnapshotAsync()
+    {
+        using var bootstrap = TestHarness.Create(
+            bitcoinNetwork: BitcoinScript.Regtest,
+            allowEmptySnapshotBootstrap: true);
+        var computeStateId = typeof(BootProtocolStateService).GetMethod(
+            "ComputeStateIdNoLock",
+            System.Reflection.BindingFlags.Instance | System.Reflection.BindingFlags.NonPublic)!;
+        string emptySnapshotId = (string)computeStateId.Invoke(
+            bootstrap.StateService,
+            [Array.Empty<BootShareProof>(), SamplePrevBlockHash])!;
+        var emptyContext = new BootPayoutSnapshotContext
+        {
+            SnapshotId = emptySnapshotId,
+            CurrentRoundNumber = 1,
+            LockedByBlockHash = SamplePrevBlockHash,
+            LockedByBlockHeight = 945000,
+            CreatedAtUtc = DateTime.UtcNow,
+            SupportFeeEnabled = false,
+            PayoutVariant = "fee-free:shared=299:snapshot=299:reserve=897",
+            ProofIds = [],
+            WinnersList = [],
+            FeeFreeWinnersList = []
+        };
+
+        string emptyPlanCoinbase = BuildCoinbaseWithWinnerPrefix(SampleCoinbaseHex, positiveWinnerCount: 0);
+        string emptyPlanHeader = RewriteHeaderMerkleRoot(SampleHeaderHex, emptyPlanCoinbase);
+        BootShareProof firstProof = CreateValidatedProofForSnapshot(
+            emptyPlanHeader,
+            emptyPlanCoinbase,
+            SamplePrevBlockHash,
+            emptySnapshotId,
+            []);
+        string boundary = "0000000000000000000000000000000000000000000000000000000000b07601";
+
+        using var online = TestHarness.Create(
+            currentStateId: emptySnapshotId,
+            winnersList: [],
+            onDeckProofs: [firstProof],
+            snapshotContexts: [emptyContext],
+            activeSnapshotId: emptySnapshotId,
+            bitcoinNetwork: BitcoinScript.Regtest,
+            allowEmptySnapshotBootstrap: true);
+        using var rejoining = TestHarness.Create(
+            currentStateId: emptySnapshotId,
+            winnersList: [],
+            snapshotContexts: [emptyContext],
+            activeSnapshotId: emptySnapshotId,
+            bitcoinNetwork: BitcoinScript.Regtest,
+            allowEmptySnapshotBootstrap: true);
+
+        await online.StateService.ObserveChainTipAsync(boundary, "local-bitcoin", 945001);
+        await rejoining.StateService.ObserveChainTipAsync(boundary, "local-bitcoin", 945001);
+        BootStateBundle sibling = online.StateService.GetStateBundle(
+            online.StateService.GetNetworkStatus().CurrentStateId)!;
+
+        Assert.IsTrue(await rejoining.StateService.TryAdoptCurrentStateAsync(
+            sibling,
+            boundary,
+            945001,
+            "online-regtest-peer"));
+        Assert.AreEqual(
+            online.StateService.GetNetworkStatus().ActiveSnapshotId,
+            rejoining.StateService.GetNetworkStatus().ActiveSnapshotId);
+    }
+
     [TestMethod]
     public async Task V22HeightActivationUsesV21BelowHeightAndMsrAtAndAboveHeightAsync()
     {
@@ -3140,7 +3239,9 @@ public static TestHarness Create(
             bool seedUnknownTipHeight = false,
             bool seedUnknownTrustedTip = false,
             bool enablePeerTipStaleProtection = false,
-            int peerTipGraceSeconds = 3)
+            int peerTipGraceSeconds = 3,
+            string bitcoinNetwork = BitcoinScript.Mainnet,
+            bool allowEmptySnapshotBootstrap = false)
         {
             string? previousStatePath = Environment.GetEnvironmentVariable("BOOT_PORTAL_STATE_PATH");
             string? previousHistoryPath = Environment.GetEnvironmentVariable("BOOT_PORTAL_HISTORY_PATH");
@@ -3154,10 +3255,14 @@ public static TestHarness Create(
             var config = new PoolConfig
             {
                 BootNetworkId = "testnet",
+                BitcoinNetwork = bitcoinNetwork,
                 BootProtocolVersion = protocolVersion ?? BootProtocolVersions.ConsensusVersion,
                 V22ActivationBlockHeight = v22ActivationBlockHeight,
                 WinnersListSize = sharedWinnerSlotCount ?? Math.Max(8, SampleExpectedWinners.Count),
-                PoolPayoutScript = SampleSlotZeroAddress,
+                PoolPayoutScript = BitcoinScript.ScriptToAddress(
+                    BitcoinScript.AddressToScriptPubKey(SampleSlotZeroAddress),
+                    bitcoinNetwork),
+                AllowEmptySnapshotBootstrap = allowEmptySnapshotBootstrap,
                 GridLabsSupportFeeEnabled = supportFeeEnabled,
                 WorkSetReserveMultiplier = workSetReserveMultiplier ?? 3,
                 EnablePeerTipStaleProtection = enablePeerTipStaleProtection,
@@ -3198,7 +3303,7 @@ public static TestHarness Create(
             var dashboardVisualization = new DashboardVisualizationJournalService();
             var stateService = new BootProtocolStateService(
                 config,
-                new BootShareVerifier(),
+                new BootShareVerifier(config),
                 new NoOpHubContext(),
                 NullLogger<BootProtocolStateService>.Instance,
                 dashboardVisualization: dashboardVisualization);
diff --git a/boot_portal/HostedServices/BitcoinRpcReconciliationService.cs b/boot_portal/HostedServices/BitcoinRpcReconciliationService.cs
index 64171c7..89dfc45 100644
--- a/boot_portal/HostedServices/BitcoinRpcReconciliationService.cs
+++ b/boot_portal/HostedServices/BitcoinRpcReconciliationService.cs
@@ -69,6 +69,14 @@ internal async Task ReconcileAsync(CancellationToken cancellationToken)
         {
             BitcoinBlockchainInfo info = await _rpcClient.GetBlockchainInfoAsync(cancellationToken);
             string bestHash = await _rpcClient.GetBestBlockHashAsync(cancellationToken);
+            if (!string.IsNullOrWhiteSpace(info.Chain) && !RpcChainMatchesConfiguredNetwork(info.Chain))
+            {
+                _health.RecordRpcFailure(
+                    $"Attached Bitcoin RPC chain '{Sanitize(info.Chain)}' does not match configured bitcoin_network '{BitcoinScript.NormalizeNetwork(_config.BitcoinNetwork)}'.",
+                    checkUtc);
+                return;
+            }
+
             _health.RecordRpcSuccess(
                 info.Blocks,
                 info.Headers,
@@ -125,6 +133,19 @@ internal async Task ReconcileAsync(CancellationToken cancellationToken)
         }
     }
 
+    private bool RpcChainMatchesConfiguredNetwork(string rpcChain)
+    {
+        string configured = BitcoinScript.NormalizeNetwork(_config.BitcoinNetwork);
+        string actual = rpcChain.Trim().ToLowerInvariant();
+        return configured switch
+        {
+            BitcoinScript.Mainnet => actual == "main",
+            BitcoinScript.Testnet4 => actual is "testnet4" or "test",
+            BitcoinScript.Regtest => actual == "regtest",
+            _ => false
+        };
+    }
+
     private async Task InspectPeerNetworkAsync(DateTime checkUtc, CancellationToken cancellationToken)
     {
         try
diff --git a/boot_portal/Models/PoolConfig.cs b/boot_portal/Models/PoolConfig.cs
index 087945a..19aa533 100644
--- a/boot_portal/Models/PoolConfig.cs
+++ b/boot_portal/Models/PoolConfig.cs
@@ -17,6 +17,9 @@ public class PoolConfig
     [JsonPropertyName("bitcoin_network")]
     public string BitcoinNetwork { get; set; } = BitcoinScript.Mainnet;
 
+    [JsonPropertyName("allow_empty_snapshot_bootstrap")]
+    public bool AllowEmptySnapshotBootstrap { get; set; } = false;
+
     [JsonPropertyName("pool_payout_script")]
     public string PoolPayoutScript { get; set; } = string.Empty;
 
diff --git a/boot_portal/Services/BitcoinRpcClient.cs b/boot_portal/Services/BitcoinRpcClient.cs
index 8254620..75a2a33 100644
--- a/boot_portal/Services/BitcoinRpcClient.cs
+++ b/boot_portal/Services/BitcoinRpcClient.cs
@@ -10,7 +10,8 @@ public sealed record BitcoinBlockchainInfo(
     long Headers,
     string BestBlockHash,
     bool InitialBlockDownload,
-    double? VerificationProgress);
+    double? VerificationProgress,
+    string Chain = "");
 
 public sealed record BitcoinZmqPublisher(string Topic, string Address);
 public sealed record BitcoinNetworkInfo(int Connections, int ConnectionsIn, int ConnectionsOut);
@@ -54,7 +55,8 @@ public async Task<BitcoinBlockchainInfo> GetBlockchainInfoAsync(CancellationToke
             result.GetProperty("headers").GetInt64(),
             result.GetProperty("bestblockhash").GetString() ?? string.Empty,
             result.TryGetProperty("initialblockdownload", out JsonElement ibd) && ibd.GetBoolean(),
-            result.TryGetProperty("verificationprogress", out JsonElement progress) ? progress.GetDouble() : null);
+            result.TryGetProperty("verificationprogress", out JsonElement progress) ? progress.GetDouble() : null,
+            result.TryGetProperty("chain", out JsonElement chain) ? chain.GetString() ?? string.Empty : string.Empty);
     }
 
     public async Task<string> GetBestBlockHashAsync(CancellationToken cancellationToken)
diff --git a/boot_portal/Services/BootProtocolStateService.cs b/boot_portal/Services/BootProtocolStateService.cs
index 797e868..20ca3b7 100644
--- a/boot_portal/Services/BootProtocolStateService.cs
+++ b/boot_portal/Services/BootProtocolStateService.cs
@@ -24,23 +24,23 @@ public class BootProtocolStateService
 
     public static string GetGenesisFoundationAddress(string? bitcoinNetwork)
     {
-        return BitcoinScript.NormalizeNetwork(bitcoinNetwork) == BitcoinScript.Testnet4
-            ? TestnetGenesisFoundationAddress
-            : GenesisFoundationAddress;
+        return BitcoinScript.NormalizeNetwork(bitcoinNetwork) == BitcoinScript.Mainnet
+            ? GenesisFoundationAddress
+            : TestnetGenesisFoundationAddress;
     }
 
     public static ulong GetCurrentBlockSubsidySats(string? bitcoinNetwork)
     {
-        return BitcoinScript.NormalizeNetwork(bitcoinNetwork) == BitcoinScript.Testnet4
-            ? Testnet4CurrentSubsidySats
-            : MainnetCurrentSubsidySats;
+        return BitcoinScript.NormalizeNetwork(bitcoinNetwork) == BitcoinScript.Mainnet
+            ? MainnetCurrentSubsidySats
+            : Testnet4CurrentSubsidySats;
     }
 
     public static string GetGridLabsSupportAddress(string? bitcoinNetwork)
     {
-        return BitcoinScript.NormalizeNetwork(bitcoinNetwork) == BitcoinScript.Testnet4
-            ? TestnetGridLabsSupportAddress
-            : GridLabsSupportAddress;
+        return BitcoinScript.NormalizeNetwork(bitcoinNetwork) == BitcoinScript.Mainnet
+            ? GridLabsSupportAddress
+            : TestnetGridLabsSupportAddress;
     }
 
     private readonly DateTime _serviceStartedUtc = DateTime.UtcNow;
@@ -149,7 +149,8 @@ public BootProtocolStateService(
             {
                 BitcoinHeaderEvaluation restoredHeader = BitcoinHashes.EvaluateHeader(
                     _state.ProvisionalTip.HeaderHex,
-                    _state.ProvisionalTip.ObservedUtc);
+                    _state.ProvisionalTip.ObservedUtc,
+                    _poolConfig.BitcoinNetwork);
                 if (!restoredHeader.IsValid ||
                     !BitcoinHashes.AreEquivalent(restoredHeader.BlockHash, _state.ProvisionalTip.BlockHash) ||
                     !BitcoinHashes.AreEquivalent(restoredHeader.ParentBlockHash, _state.CurrentTipBlockHash))
@@ -2090,15 +2091,41 @@ public async Task<ShareRecordingResult> RecordShareAsync(RecordedShareSubmission
             }
         }
 
+        bool locallyConfirmedCurrentBlockShare;
         lock (_sync)
         {
-            if (validation.IsValid && ShouldQuarantinePreviousParentNoLock(validation.PrevBlockHash, DateTime.UtcNow))
+            locallyConfirmedCurrentBlockShare =
+                IsLocallyConfirmedCurrentBlockShareNoLock(headerEvaluation);
+        }
+
+        if (!validation.IsValid && locallyConfirmedCurrentBlockShare)
+        {
+            lock (_sync)
+            {
+                snapshotContextsSnapshot = _state.SnapshotContexts.Select(CloneSnapshotContext).ToList();
+            }
+
+            SnapshotValidationResult confirmedBlockValidation =
+                ValidateConfirmedBlockShareAgainstRetainedSnapshots(share, snapshotContextsSnapshot);
+            if (confirmedBlockValidation.Validation.IsValid)
+            {
+                validation = confirmedBlockValidation.Validation;
+                matchedSnapshotId = confirmedBlockValidation.SnapshotId;
+            }
+        }
+
+        lock (_sync)
+        {
+            if (validation.IsValid &&
+                !locallyConfirmedCurrentBlockShare &&
+                ShouldQuarantinePreviousParentNoLock(validation.PrevBlockHash, DateTime.UtcNow))
             {
                 validation = RejectValidatedShare(
                     validation,
                     "Previous-parent proof quarantined after the provisional peer-tip boundary.");
             }
             else if (validation.IsValid &&
+                     !locallyConfirmedCurrentBlockShare &&
                      IsNewDirectIngressPreviousParentProofNoLock(validation.ShareId, validation.PrevBlockHash))
             {
                 validation = RejectValidatedShare(
@@ -2303,7 +2330,8 @@ ShareRecordingResult AttachTimings(ShareRecordingResult result)
                 });
             }
 
-            if (!IsAcceptedParentBlockHashNoLock(validation.PrevBlockHash))
+            if (!locallyConfirmedCurrentBlockShare &&
+                !IsAcceptedParentBlockHashNoLock(validation.PrevBlockHash))
             {
                 RecordShareDiagnosticNoLock(
                     share.Source,
@@ -3022,6 +3050,36 @@ private SnapshotValidationResult ValidateShareAgainstKnownSnapshotsIgnoringParen
         return ValidateShareAgainstKnownSnapshots(share, currentWinners, snapshotContexts, []);
     }
 
+    private SnapshotValidationResult ValidateConfirmedBlockShareAgainstRetainedSnapshots(
+        RecordedShareSubmission share,
+        IReadOnlyCollection<BootPayoutSnapshotContext> snapshotContexts)
+    {
+        BootShareValidationResult firstFailure = InvalidValidationResult();
+        IEnumerable<BootPayoutSnapshotContext> orderedContexts = snapshotContexts
+            .Where(context => !string.IsNullOrWhiteSpace(context.SnapshotId))
+            .OrderByDescending(context => string.Equals(
+                context.SnapshotId,
+                share.PayoutSnapshotId,
+                StringComparison.OrdinalIgnoreCase))
+            .ThenByDescending(context => context.CreatedAtUtc);
+
+        foreach (BootPayoutSnapshotContext context in orderedContexts)
+        {
+            foreach (List<PayoutInfo> payoutVariant in GetSnapshotPayoutVariants(context))
+            {
+                BootShareValidationResult validation = _shareVerifier.ValidateShare(share, payoutVariant, []);
+                if (validation.IsValid)
+                {
+                    return new SnapshotValidationResult(validation, context.SnapshotId);
+                }
+
+                firstFailure = PreferInformativeFailure(firstFailure, validation);
+            }
+        }
+
+        return new SnapshotValidationResult(firstFailure, string.Empty);
+    }
+
     private SnapshotValidationResult ValidateProofAgainstKnownSnapshots(
         BootShareProof proof,
         IReadOnlyList<PayoutInfo> currentWinners,
@@ -3114,6 +3172,11 @@ private static BootShareValidationResult PreferInformativeFailure(
     private List<List<PayoutInfo>> GetSnapshotPayoutVariants(BootPayoutSnapshotContext context)
     {
         var variants = new List<List<PayoutInfo>>();
+        if (IsExplicitEmptySnapshotBootstrapContext(context))
+        {
+            variants.Add([]);
+        }
+
         if (context.WinnersList.Count > 0)
         {
             variants.Add(ClonePayouts(context.WinnersList));
@@ -3128,6 +3191,21 @@ private List<List<PayoutInfo>> GetSnapshotPayoutVariants(BootPayoutSnapshotConte
         return variants;
     }
 
+    private bool IsExplicitEmptySnapshotBootstrapContext(BootPayoutSnapshotContext context)
+    {
+        if (!_poolConfig.AllowEmptySnapshotBootstrap ||
+            BitcoinScript.NormalizeNetwork(_poolConfig.BitcoinNetwork) != BitcoinScript.Regtest ||
+            context.WinnersList.Count != 0 ||
+            context.FeeFreeWinnersList.Count != 0 ||
+            context.ProofIds.Count != 0)
+        {
+            return false;
+        }
+
+        string expectedSnapshotId = ComputeStateIdNoLock([], context.LockedByBlockHash);
+        return string.Equals(context.SnapshotId, expectedSnapshotId, StringComparison.OrdinalIgnoreCase);
+    }
+
     private static List<BootShareProof> SortAndTrimProofs(IEnumerable<BootShareProof> proofs, int limit)
     {
         return proofs
@@ -3751,7 +3829,10 @@ public bool ObserveLocalChainTipHeader(
         DateTime transportReceivedUtc,
         long? blockHeight = null)
     {
-        BitcoinHeaderEvaluation evaluation = BitcoinHashes.EvaluateHeader(headerHex, transportReceivedUtc);
+        BitcoinHeaderEvaluation evaluation = BitcoinHashes.EvaluateHeader(
+            headerHex,
+            transportReceivedUtc,
+            _poolConfig.BitcoinNetwork);
         if (!evaluation.IsValid)
         {
             _logger.LogWarning(
@@ -4039,7 +4120,10 @@ public async Task<BootNetworkStatusDto> ObservePeerChainTipAsync(
         DateTime? transportReceivedUtc = null)
     {
         DateTime receivedUtc = transportReceivedUtc ?? DateTime.UtcNow;
-        BitcoinHeaderEvaluation evaluation = BitcoinHashes.EvaluateHeader(announcement.HeaderHex, receivedUtc);
+        BitcoinHeaderEvaluation evaluation = BitcoinHashes.EvaluateHeader(
+            announcement.HeaderHex,
+            receivedUtc,
+            _poolConfig.BitcoinNetwork);
         string diagramPeerId = !string.IsNullOrWhiteSpace(remoteNodeId) ? remoteNodeId : remoteEndpoint;
         void RecordHeaderRejection(string reason, string? blockHash)
         {
@@ -5860,6 +5944,23 @@ private bool IsNewDirectIngressPreviousParentProofNoLock(string? shareId, string
             string.Equals(proof.ShareId, shareId, StringComparison.OrdinalIgnoreCase));
     }
 
+    private bool IsLocallyConfirmedCurrentBlockShareNoLock(BootShareHeaderEvaluationResult headerEvaluation)
+    {
+        if (!headerEvaluation.IsValid ||
+            !headerEvaluation.IsBlock ||
+            BitcoinNotificationModes.Resolve(_poolConfig) != BitcoinNotificationModes.AttachedNode ||
+            string.IsNullOrWhiteSpace(headerEvaluation.BlockHash) ||
+            !BitcoinHashes.AreEquivalent(headerEvaluation.BlockHash, _state.CurrentTipBlockHash) ||
+            !BitcoinHashes.AreEquivalent(headerEvaluation.BlockHash, _state.TrustedLocalTipBlockHash) ||
+            !_localChainTipHeaders.TryGetValue(headerEvaluation.BlockHash, out BitcoinHeaderEvaluation? localHeader))
+        {
+            return false;
+        }
+
+        return localHeader.IsValid &&
+               BitcoinHashes.AreEquivalent(localHeader.BlockHash, headerEvaluation.BlockHash);
+    }
+
     private void RestorePredecessorForRemovedBoundaryNoLock(
         string source,
         string replacementBlockHash,
diff --git a/boot_portal/Utils/Bech32.cs b/boot_portal/Utils/Bech32.cs
index b1ae3cf..45a01cd 100644
--- a/boot_portal/Utils/Bech32.cs
+++ b/boot_portal/Utils/Bech32.cs
@@ -10,7 +10,7 @@ public static (string hrp, int version, byte[] program) Decode(string address)
         int sepIndex = address.LastIndexOf('1');
         if (sepIndex < 1) throw new FormatException("Invalid Bech32 address: no separator");
         string hrp = address.Substring(0, sepIndex).ToLower();
-        if (hrp != "bc" && hrp != "tb") throw new FormatException($"Invalid HRP: {hrp}");
+        if (hrp != "bc" && hrp != "tb" && hrp != "bcrt") throw new FormatException($"Invalid HRP: {hrp}");
 
         string dataPart = address.Substring(sepIndex + 1);
         if (dataPart.Length < 6) throw new FormatException("Bech32 data too short");
@@ -76,7 +76,7 @@ public static (string hrp, int version, byte[] program) Decode(string address)
 
     public static string Encode(string hrp, int version, byte[] program)
     {
-        if (hrp != "bc" && hrp != "tb") throw new ArgumentException($"Invalid HRP: {hrp}");
+        if (hrp != "bc" && hrp != "tb" && hrp != "bcrt") throw new ArgumentException($"Invalid HRP: {hrp}");
         if (version < 0 || version > 16) throw new ArgumentException($"Invalid witness version: {version}");
         if (program.Length < 2 || program.Length > 40) throw new ArgumentException($"Invalid program length: {program.Length}");
         
@@ -198,4 +198,4 @@ private static byte[] ConvertBits(byte[] data, int fromBits, int toBits, bool pa
         }
         return ret.ToArray();
     }
-}
\ No newline at end of file
+}
diff --git a/boot_portal/Utils/BitcoinHashes.cs b/boot_portal/Utils/BitcoinHashes.cs
index 407cbfc..5df7106 100644
--- a/boot_portal/Utils/BitcoinHashes.cs
+++ b/boot_portal/Utils/BitcoinHashes.cs
@@ -7,6 +7,7 @@ namespace boot_portal.Utils;
 public static class BitcoinHashes
 {
     private static readonly BigInteger BitcoinPowLimit = DecodeCompactTarget(0x1d00ffff);
+    private static readonly BigInteger RegtestPowLimit = DecodeCompactTarget(0x207fffff);
     public static string NormalizeHex(string? hex)
     {
         if (string.IsNullOrWhiteSpace(hex))
@@ -120,7 +121,10 @@ public static string ComputeBlockHashFromHeader(string? headerHex)
         return ToDisplayHashHex(second);
     }
 
-    public static BitcoinHeaderEvaluation EvaluateHeader(string? headerHex, DateTime receivedUtc)
+    public static BitcoinHeaderEvaluation EvaluateHeader(
+        string? headerHex,
+        DateTime receivedUtc,
+        string? bitcoinNetwork = BitcoinScript.Mainnet)
     {
         try
         {
@@ -138,7 +142,10 @@ public static BitcoinHeaderEvaluation EvaluateHeader(string? headerHex, DateTime
             uint timestamp = BinaryPrimitives.ReadUInt32LittleEndian(header.AsSpan(68, 4));
             uint compactTarget = BinaryPrimitives.ReadUInt32LittleEndian(header.AsSpan(72, 4));
             BigInteger target = DecodeCompactTarget(compactTarget);
-            if (target <= BigInteger.Zero || target > BitcoinPowLimit)
+            BigInteger proofOfWorkLimit = BitcoinScript.NormalizeNetwork(bitcoinNetwork) == BitcoinScript.Regtest
+                ? RegtestPowLimit
+                : BitcoinPowLimit;
+            if (target <= BigInteger.Zero || target > proofOfWorkLimit)
             {
                 return BitcoinHeaderEvaluation.Invalid("Header target is outside the Bitcoin proof-of-work limit.");
             }
@@ -160,7 +167,7 @@ public static BitcoinHeaderEvaluation EvaluateHeader(string? headerHex, DateTime
                 ReceivedUtc = receivedUtc
             };
         }
-        catch (Exception ex) when (ex is ArgumentException or FormatException or ArgumentOutOfRangeException)
+        catch (Exception ex) when (ex is ArgumentException or FormatException or ArgumentOutOfRangeException or InvalidOperationException)
         {
             return BitcoinHeaderEvaluation.Invalid(ex.Message);
         }
diff --git a/boot_portal/Utils/BitcoinScript.cs b/boot_portal/Utils/BitcoinScript.cs
index a294179..e4fdb34 100644
--- a/boot_portal/Utils/BitcoinScript.cs
+++ b/boot_portal/Utils/BitcoinScript.cs
@@ -6,6 +6,7 @@ public static class BitcoinScript
 {
     public const string Mainnet = "mainnet";
     public const string Testnet4 = "testnet4";
+    public const string Regtest = "regtest";
 
     public static string NormalizeNetwork(string? network)
     {
@@ -14,7 +15,8 @@ public static string NormalizeNetwork(string? network)
         {
             "" or "main" or "mainnet" => Mainnet,
             "test" or "testnet" or "testnet3" or "testnet4" => Testnet4,
-            _ => throw new InvalidOperationException($"Unsupported bitcoin_network '{network}'. Expected mainnet or testnet4.")
+            "regtest" => Regtest,
+            _ => throw new InvalidOperationException($"Unsupported bitcoin_network '{network}'. Expected mainnet, testnet4, or regtest.")
         };
     }
 
@@ -63,10 +65,11 @@ public static byte[] AddressToScriptPubKey(string address, string? network)
         }
 
         if (normalized.StartsWith("bc1", StringComparison.OrdinalIgnoreCase) ||
-            normalized.StartsWith("tb1", StringComparison.OrdinalIgnoreCase))
+            normalized.StartsWith("tb1", StringComparison.OrdinalIgnoreCase) ||
+            normalized.StartsWith("bcrt1", StringComparison.OrdinalIgnoreCase))
         {
             var (hrp, version, program) = Bech32.Decode(normalized);
-            string expectedHrp = normalizedNetwork == Testnet4 ? "tb" : "bc";
+            string expectedHrp = GetBech32Hrp(normalizedNetwork);
             if (!string.Equals(hrp, expectedHrp, StringComparison.OrdinalIgnoreCase))
             {
                 throw new InvalidOperationException($"Address {address} is not valid for bitcoin_network {normalizedNetwork}.");
@@ -96,8 +99,8 @@ public static byte[] AddressToScriptPubKey(string address, string? network)
         {
             0x00 when normalizedNetwork == Mainnet => BuildP2PkhScript(payload),
             0x05 when normalizedNetwork == Mainnet => BuildP2ShScript(payload),
-            0x6f when normalizedNetwork == Testnet4 => BuildP2PkhScript(payload),
-            0xc4 when normalizedNetwork == Testnet4 => BuildP2ShScript(payload),
+            0x6f when normalizedNetwork != Mainnet => BuildP2PkhScript(payload),
+            0xc4 when normalizedNetwork != Mainnet => BuildP2ShScript(payload),
             _ => throw new InvalidOperationException($"Unsupported Base58 version 0x{payload[0]:X2} for address {address}.")
         };
     }
@@ -128,7 +131,7 @@ public static string ScriptToAddress(byte[] script, string? network)
             script[24] == 0xAC)
         {
             byte[] payload = new byte[21];
-            payload[0] = normalizedNetwork == Testnet4 ? (byte)0x6f : (byte)0x00;
+            payload[0] = normalizedNetwork == Mainnet ? (byte)0x00 : (byte)0x6f;
             Array.Copy(script, 3, payload, 1, 20);
             return Base58Check.Encode(payload);
         }
@@ -139,7 +142,7 @@ public static string ScriptToAddress(byte[] script, string? network)
             script[22] == 0x87)
         {
             byte[] payload = new byte[21];
-            payload[0] = normalizedNetwork == Testnet4 ? (byte)0xc4 : (byte)0x05;
+            payload[0] = normalizedNetwork == Mainnet ? (byte)0x05 : (byte)0xc4;
             Array.Copy(script, 2, payload, 1, 20);
             return Base58Check.Encode(payload);
         }
@@ -147,24 +150,32 @@ public static string ScriptToAddress(byte[] script, string? network)
         if (script.Length == 22 && script[0] == 0x00 && script[1] == 0x14)
         {
             byte[] program = script.Skip(2).Take(20).ToArray();
-            return Bech32.Encode(normalizedNetwork == Testnet4 ? "tb" : "bc", 0, program);
+            return Bech32.Encode(GetBech32Hrp(normalizedNetwork), 0, program);
         }
 
         if (script.Length == 34 && script[0] == 0x00 && script[1] == 0x20)
         {
             byte[] program = script.Skip(2).Take(32).ToArray();
-            return Bech32.Encode(normalizedNetwork == Testnet4 ? "tb" : "bc", 0, program);
+            return Bech32.Encode(GetBech32Hrp(normalizedNetwork), 0, program);
         }
 
         if (script.Length == 34 && script[0] == 0x51 && script[1] == 0x20)
         {
             byte[] program = script.Skip(2).Take(32).ToArray();
-            return Bech32.Encode(normalizedNetwork == Testnet4 ? "tb" : "bc", 1, program);
+            return Bech32.Encode(GetBech32Hrp(normalizedNetwork), 1, program);
         }
 
         return "UNKNOWN";
     }
 
+    private static string GetBech32Hrp(string normalizedNetwork) => normalizedNetwork switch
+    {
+        Mainnet => "bc",
+        Testnet4 => "tb",
+        Regtest => "bcrt",
+        _ => throw new InvalidOperationException($"Unsupported bitcoin network '{normalizedNetwork}'.")
+    };
+
     private static byte[] BuildP2PkhScript(byte[] payload)
     {
         byte[] script = new byte[25];
diff --git a/boot_portal/Utils/PoolConfigValidator.cs b/boot_portal/Utils/PoolConfigValidator.cs
index a6022e7..d503df4 100644
--- a/boot_portal/Utils/PoolConfigValidator.cs
+++ b/boot_portal/Utils/PoolConfigValidator.cs
@@ -77,6 +77,13 @@ public static List<string> Validate(PoolConfig config)
             errors.Add(ex.Message);
         }
 
+        if (config.AllowEmptySnapshotBootstrap &&
+            (!string.Equals(bitcoinNetwork, BitcoinScript.Regtest, StringComparison.OrdinalIgnoreCase) ||
+             IsProduction(config)))
+        {
+            errors.Add("allow_empty_snapshot_bootstrap is restricted to non-production regtest labs");
+        }
+
         if (!string.IsNullOrWhiteSpace(config.PoolPayoutScript) &&
             !BitcoinScript.TryAddressToScriptPubKey(config.PoolPayoutScript, bitcoinNetwork, out _))
         {
diff --git a/docs/README.md b/docs/README.md
index 58f8702..23aff8e 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -35,6 +35,8 @@ documentation.
 - [Critical State-Validation Security Release](security-release-rt-2026-041-042.md):
   release-candidate behavior and retest gate for proof-backed state sync and
   locally confirmed GridPool block payments.
+- [Regtest Release-Retest Lab](regtest-release-retest.md): isolated two-node
+  setup, normal lifecycle checks, convergence verification, and evidence capture.
 
 ## Operators
 
diff --git a/docs/regtest-release-retest.md b/docs/regtest-release-retest.md
new file mode 100644
index 0000000..9231386
--- /dev/null
+++ b/docs/regtest-release-retest.md
@@ -0,0 +1,259 @@
+# GridPool Regtest Release-Retest Lab
+
+This guide builds a disposable two-node GridPool lab backed by one Bitcoin Core
+regtest node. It covers setup, normal operation, lifecycle checks, convergence,
+and evidence collection. It does not describe exploit traffic or offensive
+testing.
+
+## Safety Boundary
+
+- Use a dedicated host, VM, or private CI runner.
+- Keep the Docker network internal and bind observer ports to `127.0.0.1`.
+- Do not use public GridPool peers or production credentials.
+- Generate disposable RPC credentials, payout addresses, identities, and state.
+- Record exact GridPool commits and Bitcoin Core image digests.
+- Never copy identity or state files between GridPool nodes.
+
+## 1. Pin The Candidate
+
+Requirements: Docker Engine with Compose v2, Git, `curl`, `jq`, `openssl`, and
+a verified Bitcoin Core release. Recommended host capacity is four CPU threads,
+8 GB RAM, and 20 GB free.
+
+```bash
+export LAB_ROOT="$HOME/gridpool-release-lab"
+export GRIDPOOL_REPO="$HOME/src/boot-protocol"
+export CANDIDATE_COMMIT="REPLACE_WITH_IMMUTABLE_COMMIT"
+
+mkdir -p "$LAB_ROOT/worktrees"
+git -C "$GRIDPOOL_REPO" fetch --all --tags --prune
+git -C "$GRIDPOOL_REPO" worktree add --detach \
+  "$LAB_ROOT/worktrees/candidate" "$CANDIDATE_COMMIT"
+git -C "$LAB_ROOT/worktrees/candidate" rev-parse HEAD
+```
+
+Do not move this worktree to another revision during the run.
+
+## 2. Private Inputs
+
+Place verified `bitcoind` and `bitcoin-cli` binaries under
+`$LAB_ROOT/core-dist/bin/`, then create disposable inputs:
+
+```bash
+cd "$LAB_ROOT"
+mkdir -p node-a node-b artifacts core-dist/bin
+chmod 700 node-a node-b artifacts
+umask 077
+cat > .env <<EOF
+GRIDPOOL_SOURCE=$LAB_ROOT/worktrees/candidate
+GRIDPOOL_TAG=rt076-candidate
+RPC_USER=gridpool_regtest
+RPC_PASSWORD=$(openssl rand -hex 32)
+LAB_NETWORK_ID=gridpool-regtest-$(openssl rand -hex 6)
+EOF
+chmod 600 .env
+```
+
+Create `Dockerfile.bitcoin`:
+
+```dockerfile
+FROM debian:bookworm-slim
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates libevent-2.1-7 && rm -rf /var/lib/apt/lists/*
+COPY core-dist/bin/bitcoind /usr/local/bin/bitcoind
+COPY core-dist/bin/bitcoin-cli /usr/local/bin/bitcoin-cli
+RUN chmod 0755 /usr/local/bin/bitcoind /usr/local/bin/bitcoin-cli
+ENTRYPOINT ["bitcoind"]
+```
+
+## 3. Compose Topology
+
+Create `compose.yaml`:
+
+```yaml
+name: gridpool-release-lab
+services:
+  bitcoin:
+    build:
+      context: .
+      dockerfile: Dockerfile.bitcoin
+    command:
+      - -regtest=1
+      - -server=1
+      - -printtoconsole=1
+      - -fallbackfee=0.00001
+      - -rpcbind=0.0.0.0
+      - -rpcallowip=172.16.0.0/12
+      - -rpcuser=${RPC_USER}
+      - -rpcpassword=${RPC_PASSWORD}
+      - -zmqpubhashblock=tcp://0.0.0.0:28332
+      - -zmqpubrawblock=tcp://0.0.0.0:28333
+    volumes: ["bitcoin-data:/root/.bitcoin"]
+    networks: [lab]
+
+  node-a:
+    build:
+      context: ${GRIDPOOL_SOURCE}
+      dockerfile: Dockerfile
+    image: gridpool-release-lab:${GRIDPOOL_TAG}
+    environment:
+      BOOT_PORTAL_CONFIG_PATH: /data/config.json
+      BOOT_PORTAL_STATE_PATH: /data/pool_state.json
+      GRIDPOOL_RELEASE_VERSION: release-lab-${GRIDPOOL_TAG}
+    volumes: ["./node-a:/data"]
+    ports: ["127.0.0.1:15001:5000"]
+    networks: [lab]
+
+  node-b:
+    image: gridpool-release-lab:${GRIDPOOL_TAG}
+    environment:
+      BOOT_PORTAL_CONFIG_PATH: /data/config.json
+      BOOT_PORTAL_STATE_PATH: /data/pool_state.json
+      GRIDPOOL_RELEASE_VERSION: release-lab-${GRIDPOOL_TAG}
+    volumes: ["./node-b:/data"]
+    ports: ["127.0.0.1:15002:5000"]
+    networks: [lab]
+
+networks:
+  lab:
+    internal: true
+volumes:
+  bitcoin-data:
+```
+
+RPC and ZMQ are reachable only inside the private Compose network.
+
+## 4. Initialize Regtest
+
+```bash
+set -a; source "$LAB_ROOT/.env"; set +a
+docker compose --env-file .env up -d --build bitcoin
+until docker compose exec -T bitcoin bitcoin-cli \
+  -regtest -rpcuser="$RPC_USER" -rpcpassword="$RPC_PASSWORD" \
+  getblockchaininfo >/dev/null 2>&1; do sleep 1; done
+
+docker compose exec -T bitcoin bitcoin-cli \
+  -regtest -rpcuser="$RPC_USER" -rpcpassword="$RPC_PASSWORD" \
+  -named createwallet wallet_name=lab load_on_startup=true
+
+export LAB_PAYOUT_ADDRESS="$(docker compose exec -T bitcoin bitcoin-cli \
+  -regtest -rpcuser="$RPC_USER" -rpcpassword="$RPC_PASSWORD" \
+  -rpcwallet=lab getnewaddress "" bech32 | tr -d '\r')"
+case "$LAB_PAYOUT_ADDRESS" in bcrt1*) ;; *) exit 1 ;; esac
+
+docker compose exec -T bitcoin bitcoin-cli \
+  -regtest -rpcuser="$RPC_USER" -rpcpassword="$RPC_PASSWORD" \
+  -rpcwallet=lab generatetoaddress 101 "$LAB_PAYOUT_ADDRESS"
+```
+
+## 5. Node Configuration
+
+Render a mode-600 `/data/config.json` for each node. Use the `.env` values for
+credentials and network ID rather than literal placeholders:
+
+```json
+{
+  "NotificationSource": "BitcoinZmq",
+  "bitcoin_notification_mode": "attached-node",
+  "bitcoin_rpc_url": "http://bitcoin:18443",
+  "bitcoin_rpc_username": "FROM_ENV",
+  "bitcoin_rpc_password": "FROM_ENV",
+  "bitcoin_zmq_endpoint": "tcp://bitcoin:28332",
+  "bitcoin_zmq_rawblock_endpoint": "tcp://bitcoin:28333",
+  "bitcoin_network": "regtest",
+  "boot_network_id": "UNIQUE_SHARED_LAB_ID",
+  "boot_protocol_version": 22,
+  "v22_activation_block_height": 0,
+  "node_mode": "development",
+  "pool_payout_script": "DISPOSABLE_BCRT1_ADDRESS",
+  "grid_labs_support_fee_enabled": false,
+  "enable_web_ui": false,
+  "enable_admin_api": false,
+  "enable_peer_sync": true,
+  "peer_allow_private_advertisements": true,
+  "enable_peer_persistent_sessions": true,
+  "enable_peer_udp_fast_relay": false,
+  "enable_peer_tip_stale_protection": false,
+  "pause_mining_on_outbound_relay_stale": false,
+  "min_diff": 1,
+  "allow_empty_snapshot_bootstrap": true
+}
+```
+
+Use `http://node-a:5000` and `http://node-b:5000` as their respective
+`public_base_url` values. Configure `bootstrap_peers` with only the other node.
+Set file ownership to the image user, currently UID/GID `1000:1000`.
+
+`allow_empty_snapshot_bootstrap` is required only for the RT-2026-076
+completeness regression. It is rejected outside non-production regtest and
+must never appear in mainnet or appliance configuration.
+
+## 6. Start And Baseline
+
+```bash
+docker compose --env-file .env build --no-cache node-a
+docker compose --env-file .env up -d node-a node-b
+until curl -fsS http://127.0.0.1:15001/api/network/summary >/dev/null; do sleep 1; done
+until curl -fsS http://127.0.0.1:15002/api/network/summary >/dev/null; do sleep 1; done
+
+for port in 15001 15002; do
+  curl -fsS "http://127.0.0.1:${port}/api/network/summary" |
+    jq '{nodeId,networkId,bitcoinNetwork,currentTipBlockHeight,
+         currentTipBlockHash,currentStateId,candidateStateId,activeSnapshotId,
+         peerCount,miningWorkSafe,bitcoinNotification}'
+done
+```
+
+Expected baseline: `bitcoinNetwork=regtest`, synchronized RPC, both ZMQ topics
+active, one private peer per node, and matching tip/state identifiers. Generate
+one ordinary block and confirm both nodes advance exactly once:
+
+```bash
+docker compose exec -T bitcoin bitcoin-cli \
+  -regtest -rpcuser="$RPC_USER" -rpcpassword="$RPC_PASSWORD" \
+  -rpcwallet=lab generatetoaddress 1 "$LAB_PAYOUT_ADDRESS"
+sleep 3
+```
+
+## 7. Defensive Release Checks
+
+Using ordinary valid lab traffic, verify:
+
+1. Share-first and notification-first valid block orderings each record one
+   payment transition, never two.
+2. Paid proof IDs are removed once and absent from later payout plans.
+3. A node stopped across an ordinary boundary rejoins and converges from a
+   complete proof-backed sibling bundle.
+4. The explicit empty-bootstrap variant converges while enabled.
+5. Restarting either node preserves identity, state, and paid lineage.
+6. A one-block regtest reorganization follows the V2.2 rollback path and both
+   nodes reconverge.
+
+These are outcome checks, not instructions for malformed or hostile inputs.
+
+## 8. Evidence And Reset
+
+```bash
+export RUN_DIR="$LAB_ROOT/artifacts/$(date -u +%Y%m%dT%H%M%SZ)"
+mkdir -p "$RUN_DIR"; chmod 700 "$RUN_DIR"
+git -C "$GRIDPOOL_SOURCE" rev-parse HEAD > "$RUN_DIR/gridpool-commit.txt"
+docker compose images --format json > "$RUN_DIR/images.json"
+docker compose ps --format json > "$RUN_DIR/compose-ps.json"
+docker compose logs --no-color > "$RUN_DIR/compose.log" 2>&1
+curl -fsS http://127.0.0.1:15001/api/network/summary > "$RUN_DIR/node-a.json"
+curl -fsS http://127.0.0.1:15002/api/network/summary > "$RUN_DIR/node-b.json"
+sha256sum "$RUN_DIR"/* > "$RUN_DIR/SHA256SUMS"
+```
+
+Review artifacts for credentials before sharing. Reset only after preserving
+evidence:
+
+```bash
+docker compose --env-file .env down -v --remove-orphans
+rm -rf "$LAB_ROOT/node-a" "$LAB_ROOT/node-b"
+mkdir -p "$LAB_ROOT/node-a" "$LAB_ROOT/node-b"
+chmod 700 "$LAB_ROOT/node-a" "$LAB_ROOT/node-b"
+```
+
+Every candidate run must start from a documented clean state. Never reuse a
+baseline state volume with a candidate image.
diff --git a/docs/security-release-rt-2026-041-042.md b/docs/security-release-rt-2026-041-042.md
index df2bf0c..010218a 100644
--- a/docs/security-release-rt-2026-041-042.md
+++ b/docs/security-release-rt-2026-041-042.md
@@ -1,13 +1,16 @@
 # GridPool Critical State-Validation Security Release
 
-Status: release candidate for independent red-team verification.
+Status: original critical findings independently verified; follow-up candidate
+required for RT-2026-076 and complete regtest transition coverage.
 
 Integration note (2026-08-24): the exact candidate `400fc6e` is preserved at
 tag `security-rt-041-042-retest-candidate` and has been merged into `develop`
 through `d542af6` so feature work can proceed from the intended defensive
-behavior. Independent verification remains pending; development builds that
-contain it are not security-certified releases and must not be promoted to
-`main` or deployed as the public release candidate yet.
+behavior. Independent verification on 2026-08-26 confirmed RT-2026-041 and
+RT-2026-042 are closed. The same run surfaced RT-2026-076, a false rejection of
+complete sibling bundles containing a proof recorded against an empty
+bootstrap plan, plus regtest transition gaps. Development builds must not be
+promoted to `main` until the follow-up candidate passes the remaining gates.
 
 This release closes two critical state-transition classes found during the
 pre-beta security review. It does not change the V2.2 consensus version or
@@ -30,6 +33,11 @@ already intended to require.
 This handles both event orders: share before Bitcoin notification, and Bitcoin
 notification before share.
 
+The follow-up candidate additionally preserves a notification-first block
+share when the attached node has already validated that exact block onto its
+active chain. This is not a general stale-share exception: the block hash must
+match the locally retained header, current tip, and trusted local tip.
+
 ## State-Bundle Validation
 
 - Current-state and bootstrap bundles with a non-empty Winners List and no
@@ -57,18 +65,40 @@ A future bootstrap format may restore late-join synchronization after paid
 rounds by carrying independently verifiable block/payment lineage. Until then,
 the implementation fails closed rather than trusting peer assertions.
 
+## RT-2026-076 Completeness Path
+
+Production GridPool is not expected to have an empty payout plan: mainnet
+already has a populated Winners List, and an intentional restart must seed at
+least one shared payout address. Empty-plan support is therefore an explicit
+lab compatibility path, not a mainnet bootstrap mechanism.
+
+- `allow_empty_snapshot_bootstrap` defaults to `false`.
+- It is accepted only with `bitcoin_network: regtest` in a non-production mode.
+- The context must have zero proof IDs, empty normal and fee-free Winners Lists,
+  and the canonical state ID for that zero-proof plan.
+- Arbitrary empty peer contexts remain invalid; production/mainnet nodes remain
+  fail-closed.
+
+The runtime also supports the regtest PoW limit, `bcrt1` addresses, and explicit
+RPC chain-name matching. Do not use the historical testnet4-over-regtest shim.
+
 ## Verification Gate
 
 Before promotion to `main` or deployment:
 
 1. Run the full `boot.tests` suite.
-2. Repeat RT-2026-041 against the exact release-candidate commit and verify that
+2. Preserve the completed RT-2026-041 verdict and verify on the follow-up that
    the candidate share cannot change current state, round, trusted tip, Winners
    List, or paid lineage.
-3. Repeat RT-2026-042 through both HTTP polling and persistent peer gossip and
+3. Preserve the completed RT-2026-042 verdict and verify through both HTTP
+   polling and persistent peer gossip that
    verify that every node rejects the proofless bundle without state mutation.
 4. Verify one legitimate attached-node GridPool block transition on regtest,
    including both share-first and notification-first event orderings.
 5. Verify a valid V2.2 sibling merge still succeeds with complete proofs.
+6. In the isolated regtest profile only, enable
+   `allow_empty_snapshot_bootstrap`, retain a first proof tied to the canonical
+   empty context, cross a boundary while a sibling is offline, and verify the
+   rejoining sibling converges without deleting state.
 
 Do not publish a stable tag until the independent retest passes.
diff --git a/docs/umbrel-start9-launch-checklist.md b/docs/umbrel-start9-launch-checklist.md
index 596aa5a..3f00f48 100644
--- a/docs/umbrel-start9-launch-checklist.md
+++ b/docs/umbrel-start9-launch-checklist.md
@@ -570,9 +570,11 @@ or cryptographic secrets.
   bindings, log retention, and support-bundle sanitization.
 - [ ] Obtain a second-developer review of the threat inventory and high-risk
   findings before one-click package launch.
-- [ ] Promote the RT-2026-041/042 security release only after independent
-  regtest confirms that declared-target candidates cannot rotate payout state
-  and proofless bundles cannot alter winners or paid lineage. See
+- [ ] Promote the RT-2026-041/042 security release only after the follow-up
+  candidate closes RT-2026-076 and independently confirms regtest paid-once,
+  notification-first, and complete-proof sibling convergence. The 2026-08-26
+  retest already confirmed that declared-target candidates cannot rotate payout
+  state and proofless bundles cannot alter winners or paid lineage. See
   [security-release-rt-2026-041-042.md](security-release-rt-2026-041-042.md).
 - [ ] Design an independently verifiable paid-lineage bootstrap format before
   treating node-less `external-fallback` peers as payout-state authorities.

From c368f160fead03cd153a5744a057380c181f3d8d Mon Sep 17 00:00:00 2001
From: keegreil <keegreil@gmail.com>
Date: Wed, 9 Sep 2026 07:09:20 -0400
Subject: [PATCH 10/10] ci: stabilize security-updated release validation

---
 boot_portal/ui/src/components/SystemMap.test.tsx | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/boot_portal/ui/src/components/SystemMap.test.tsx b/boot_portal/ui/src/components/SystemMap.test.tsx
index 55db036..b89ad57 100644
--- a/boot_portal/ui/src/components/SystemMap.test.tsx
+++ b/boot_portal/ui/src/components/SystemMap.test.tsx
@@ -354,7 +354,11 @@ describe("GridPool system map", () => {
 
   it("settles motion immediately for reduced-motion observers", () => {
     vi.useFakeTimers();
-    const matchMedia = vi.spyOn(window, "matchMedia").mockImplementation((query) => ({
+    const originalMatchMedia = Object.getOwnPropertyDescriptor(window, "matchMedia");
+    Object.defineProperty(window, "matchMedia", {
+      configurable: true,
+      writable: true,
+      value: vi.fn((query: string) => ({
       matches: query.includes("prefers-reduced-motion"),
       media: query,
       onchange: null,
@@ -363,7 +367,8 @@ describe("GridPool system map", () => {
       addEventListener: vi.fn(),
       removeEventListener: vi.fn(),
       dispatchEvent: vi.fn()
-    }));
+      }))
+    });
     const complete = vi.fn();
     render(
       <SystemMap
@@ -376,7 +381,11 @@ describe("GridPool system map", () => {
 
     act(() => vi.advanceTimersByTime(180));
     expect(complete).toHaveBeenCalledOnce();
-    matchMedia.mockRestore();
+    if (originalMatchMedia) {
+      Object.defineProperty(window, "matchMedia", originalMatchMedia);
+    } else {
+      delete (window as unknown as { matchMedia?: unknown }).matchMedia;
+    }
     vi.useRealTimers();
   });
 });