diff --git a/build.gradle.kts b/build.gradle.kts
index 1571de8..25175bd 100644
--- a/build.gradle.kts
+++ b/build.gradle.kts
@@ -68,6 +68,7 @@ dependencies {
     // ✅ Cucumber for BDD
     testImplementation("io.cucumber:cucumber-java:7.27.2")
     testImplementation("io.cucumber:cucumber-junit-platform-engine:7.27.2")
+    testImplementation("io.cucumber:cucumber-picocontainer:7.27.2")
 
     // JUnit 5 Suite annotations
     testImplementation("org.junit.platform:junit-platform-suite:1.13.4")
@@ -180,6 +181,112 @@ tasks.register<Test>("allCucumberTests") {
     shouldRunAfter(tasks.test)
 }
 
+// ─── BDD tasks (Phase 0 of BDD migration plan) ───────────────────────────────
+// Default BDD run: defers to CucumberTestRunner's static-init default tag
+// filter, which is "not @nametag and not @slow and not @wip and not @ignore"
+// but yields to an explicit -Dcucumber.filter.tags=<expr> override.
+tasks.register<Test>("bddTest") {
+    useJUnitPlatform()
+    maxHeapSize = "1024m"
+    systemProperty("cucumber.junit-platform.naming-strategy", "long")
+    systemProperties = System.getProperties().toMap() as Map<String, Any>
+
+    // Make BDD env vars part of the task's up-to-date cache key so that
+    // switching AGGREGATOR_URL / TRUST_BASE_PATH / tag filter actually forces a
+    // re-run. Without this, Gradle sees unchanged source+classpath and serves
+    // a cached pass in ~3 seconds.
+    inputs.property("AGGREGATOR_URL", System.getenv("AGGREGATOR_URL") ?: "")
+    inputs.property("AGGREGATOR_API_KEY", System.getenv("AGGREGATOR_API_KEY") ?: "")
+    inputs.property("TRUST_BASE_PATH", System.getenv("TRUST_BASE_PATH") ?: "")
+    inputs.property(
+        "cucumber.filter.tags",
+        System.getProperty("cucumber.filter.tags") ?: ""
+    )
+
+    // Stream Cucumber's `pretty` formatter output live to the console.
+    // Without this, Gradle captures the test JVM's stdout and you only see a
+    // progress bar + pass/fail totals at the end.
+    testLogging {
+        showStandardStreams = true
+        events("passed", "skipped", "failed")
+        exceptionFormat = org.gradle.api.tasks.testing.logging.TestExceptionFormat.FULL
+    }
+
+    filter {
+        includeTestsMatching("*CucumberTestRunner*")
+    }
+    shouldRunAfter(tasks.test)
+}
+
+// Nametag-gated scenarios: expected to be reported as SKIPPED until UnicityId
+// is ported to Java v2. See BDD_MIGRATION_PLAN.md Phase 8.
+tasks.register<Test>("bddNametag") {
+    useJUnitPlatform()
+    maxHeapSize = "1024m"
+    systemProperty("cucumber.junit-platform.naming-strategy", "long")
+    systemProperties = System.getProperties().toMap() as Map<String, Any>
+    systemProperty("cucumber.filter.tags", "@nametag")
+
+    filter {
+        includeTestsMatching("*CucumberTestRunner*")
+    }
+    shouldRunAfter(tasks.test)
+}
+
+// Performance / load scenarios — needs sharded aggregator topology.
+tasks.register<Test>("bddSlow") {
+    useJUnitPlatform()
+    maxHeapSize = "4096m"
+    systemProperty("cucumber.junit-platform.naming-strategy", "long")
+    systemProperties = System.getProperties().toMap() as Map<String, Any>
+    systemProperty("cucumber.filter.tags", "@slow or @shard-load")
+
+    filter {
+        includeTestsMatching("*CucumberTestRunner*")
+    }
+    shouldRunAfter(tasks.test)
+}
+
+// Fast subset — excludes @tree (the ~136-row 4-level-tree family that dominates
+// live-aggregator runtime) in addition to the default exclusions. Use this for
+// quick live-aggregator smoke runs. Full coverage: use bddTest (slow on live).
+tasks.register<Test>("bddTestFast") {
+    useJUnitPlatform()
+    maxHeapSize = "1024m"
+    systemProperty("cucumber.junit-platform.naming-strategy", "long")
+    systemProperties = System.getProperties().toMap() as Map<String, Any>
+    systemProperty(
+        "cucumber.filter.tags",
+        "not @nametag and not @slow and not @wip and not @ignore and not @tree"
+    )
+    inputs.property("AGGREGATOR_URL", System.getenv("AGGREGATOR_URL") ?: "")
+    inputs.property("TRUST_BASE_PATH", System.getenv("TRUST_BASE_PATH") ?: "")
+    testLogging {
+        showStandardStreams = true
+        events("passed", "skipped", "failed")
+        exceptionFormat = org.gradle.api.tasks.testing.logging.TestExceptionFormat.FULL
+    }
+    filter {
+        includeTestsMatching("*CucumberTestRunner*")
+    }
+    shouldRunAfter(tasks.test)
+}
+
+// Everything — used for coverage sweeps. Expect nametag scenarios to skip until
+// UnicityId is ported.
+tasks.register<Test>("bddAll") {
+    useJUnitPlatform()
+    maxHeapSize = "2048m"
+    systemProperty("cucumber.junit-platform.naming-strategy", "long")
+    systemProperties = System.getProperties().toMap() as Map<String, Any>
+    systemProperty("cucumber.filter.tags", "not @ignore")
+
+    filter {
+        includeTestsMatching("*CucumberTestRunner*")
+    }
+    shouldRunAfter(tasks.test)
+}
+
 // Create separate JARs for each platform
 tasks.register<Jar>("androidJar") {
     archiveClassifier.set("android")
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/CucumberTestRunner.java b/src/test/java/org/unicitylabs/sdk/e2e/CucumberTestRunner.java
new file mode 100644
index 0000000..f06a18f
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/CucumberTestRunner.java
@@ -0,0 +1,39 @@
+package org.unicitylabs.sdk.e2e;
+
+import io.cucumber.junit.platform.engine.Constants;
+import org.junit.platform.suite.api.ConfigurationParameter;
+import org.junit.platform.suite.api.IncludeEngines;
+import org.junit.platform.suite.api.SelectPackages;
+import org.junit.platform.suite.api.Suite;
+
+@Suite
+@IncludeEngines("cucumber")
+@SelectPackages("org.unicitylabs.sdk.features")
+@ConfigurationParameter(
+    key = Constants.GLUE_PROPERTY_NAME,
+    value = "org.unicitylabs.sdk.e2e.steps,"
+        + "org.unicitylabs.sdk.e2e.steps.shared,"
+        + "org.unicitylabs.sdk.e2e.config")
+@ConfigurationParameter(
+    key = Constants.PLUGIN_PROPERTY_NAME,
+    value = "pretty,"
+        + "html:build/cucumber-reports/cucumber.html,"
+        + "json:build/cucumber-reports/cucumber.json")
+@ConfigurationParameter(
+    key = Constants.EXECUTION_DRY_RUN_PROPERTY_NAME,
+    value = "false")
+@ConfigurationParameter(
+    key = Constants.PLUGIN_PUBLISH_QUIET_PROPERTY_NAME,
+    value = "true")
+// Default tag filter — excludes nametag-gated scenarios (blocked until UnicityId
+// lands), load/perf scenarios, and work-in-progress. Overridable by passing
+// -Dcucumber.filter.tags=<expr> on the command line; system properties take
+// precedence over @ConfigurationParameter defaults per JUnit Platform spec.
+@ConfigurationParameter(
+    key = Constants.FILTER_TAGS_PROPERTY_NAME,
+    value = "not @slow and not @wip and not @ignore "
+        + "and not @bft-shard-only and not @multi-shard-only "
+        + "and not @pending-src-cleanup "
+        + "and not @stateful and not @fresh-aggregator")
+public class CucumberTestRunner {
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/config/CucumberConfiguration.java b/src/test/java/org/unicitylabs/sdk/e2e/config/CucumberConfiguration.java
new file mode 100644
index 0000000..af5fa51
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/config/CucumberConfiguration.java
@@ -0,0 +1,37 @@
+package org.unicitylabs.sdk.e2e.config;
+
+import io.cucumber.java.After;
+import io.cucumber.java.Before;
+import io.cucumber.java.Scenario;
+import org.unicitylabs.sdk.e2e.context.TestContext;
+
+/**
+ * Cucumber lifecycle hooks. Cucumber's PicoContainer creates one instance per scenario and
+ * injects the shared {@link TestContext}, ensuring the same context reaches every step class
+ * that takes it as a constructor parameter.
+ */
+public class CucumberConfiguration {
+
+  private final TestContext testContext;
+
+  public CucumberConfiguration(TestContext testContext) {
+    this.testContext = testContext;
+  }
+
+  @Before
+  public void beforeScenario(Scenario scenario) {
+    testContext.clearTestState();
+    System.out.println("[BDD] >>> " + scenario.getName());
+  }
+
+  @After
+  public void afterScenario(Scenario scenario) {
+    System.out.println(
+        "[BDD] <<< " + scenario.getName() + " — " + scenario.getStatus());
+  }
+
+  @After("@reset")
+  public void fullReset() {
+    testContext.reset();
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/context/TestContext.java b/src/test/java/org/unicitylabs/sdk/e2e/context/TestContext.java
new file mode 100644
index 0000000..1822311
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/context/TestContext.java
@@ -0,0 +1,278 @@
+package org.unicitylabs.sdk.e2e.context;
+
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import org.unicitylabs.sdk.StateTransitionClient;
+import org.unicitylabs.sdk.api.AggregatorClient;
+import org.unicitylabs.sdk.api.CertificationResponse;
+import org.unicitylabs.sdk.api.bft.RootTrustBase;
+import org.unicitylabs.sdk.crypto.secp256k1.SigningService;
+import org.unicitylabs.sdk.predicate.Predicate;
+import org.unicitylabs.sdk.predicate.verification.PredicateVerifierService;
+import org.unicitylabs.sdk.transaction.Token;
+import org.unicitylabs.sdk.transaction.Transaction;
+import org.unicitylabs.sdk.transaction.verification.MintJustificationVerifierService;
+import org.unicitylabs.sdk.unicityid.UnicityIdToken;
+
+/**
+ * Shared scenario state for Cucumber step classes. A single instance is constructed per scenario
+ * by Cucumber's PicoContainer and injected into every step class via constructor parameter.
+ *
+ * <p>Scope: scenario. {@link org.unicitylabs.sdk.e2e.config.CucumberConfiguration} clears
+ * transient state in a {@code @Before} hook and does a full reset on scenarios tagged
+ * {@code @reset}.
+ */
+public class TestContext {
+
+  private AggregatorClient aggregatorClient;
+  private StateTransitionClient client;
+  private RootTrustBase trustBase;
+  private PredicateVerifierService predicateVerifier;
+  private MintJustificationVerifierService mintJustificationVerifier;
+  private List<AggregatorClient> aggregatorClients = new ArrayList<>();
+  private List<String> aggregatorUrls = new ArrayList<>();
+
+  private final Map<String, SigningService> userSigningServices = new HashMap<>();
+  private final Map<String, Predicate> userPredicates = new HashMap<>();
+  private final Map<String, Predicate> userAddresses = new HashMap<>();
+  private final Map<String, List<Token>> userTokens = new HashMap<>();
+
+  private Token currentToken;
+  private String currentUser;
+  private Exception lastError;
+  private Long blockHeight;
+  private long lastOperationDurationMs;
+
+  // Phase 2 scratch — CBOR roundtrip + corrupted-import assertions.
+  private byte[] exportedTokenCbor;
+  private Token importedToken;
+
+  // Phase 2 raw-submit scratch — captures the latest CertificationResponse
+  // from a manual submission (i.e. not via TokenUtils which throws on non-SUCCESS).
+  private CertificationResponse lastCertificationResponse;
+
+  // Re-spend / double-spend scratch — the NEW transaction submitted against an
+  // already-finalized state, so a shared step can assert it never finalizes
+  // (rejected at submit OR at inclusion-proof verification). See #67.
+  private Transaction respendTransaction;
+
+  // Phase 5 scratch — snapshot of the freshly minted source token so multi-hop
+  // chain scenarios can assert "same ID/type as the original" after transfers.
+  private Token originalToken;
+
+  // Cross-step access to the latest split's child tokens, so split-related
+  // step classes other than SplitSteps can read them.
+  private final List<Token> splitChildren = new ArrayList<>();
+
+  // Phase C — registered nametag tokens, keyed by user name.
+  private final Map<String, UnicityIdToken> userNametags = new HashMap<>();
+  // Captures the addressing method used by the most recent address-aware mint
+  // or transfer ("pubkey" / "nametag"), for assertions.
+  private String addressingMethod;
+
+  public AggregatorClient getAggregatorClient() {
+    return aggregatorClient;
+  }
+
+  public void setAggregatorClient(AggregatorClient aggregatorClient) {
+    this.aggregatorClient = aggregatorClient;
+  }
+
+  public StateTransitionClient getClient() {
+    return client;
+  }
+
+  public void setClient(StateTransitionClient client) {
+    this.client = client;
+  }
+
+  public RootTrustBase getTrustBase() {
+    return trustBase;
+  }
+
+  public void setTrustBase(RootTrustBase trustBase) {
+    this.trustBase = trustBase;
+  }
+
+  public PredicateVerifierService getPredicateVerifier() {
+    return predicateVerifier;
+  }
+
+  public void setPredicateVerifier(PredicateVerifierService predicateVerifier) {
+    this.predicateVerifier = predicateVerifier;
+  }
+
+  public MintJustificationVerifierService getMintJustificationVerifier() {
+    return mintJustificationVerifier;
+  }
+
+  public void setMintJustificationVerifier(MintJustificationVerifierService mjv) {
+    this.mintJustificationVerifier = mjv;
+  }
+
+  public List<AggregatorClient> getAggregatorClients() {
+    return aggregatorClients;
+  }
+
+  public void setAggregatorClients(List<AggregatorClient> aggregatorClients) {
+    this.aggregatorClients = aggregatorClients;
+  }
+
+  public List<String> getAggregatorUrls() {
+    return aggregatorUrls;
+  }
+
+  public void setAggregatorUrls(List<String> aggregatorUrls) {
+    this.aggregatorUrls = aggregatorUrls;
+  }
+
+  public Map<String, SigningService> getUserSigningServices() {
+    return userSigningServices;
+  }
+
+  public Map<String, Predicate> getUserPredicates() {
+    return userPredicates;
+  }
+
+  public Map<String, Predicate> getUserAddresses() {
+    return userAddresses;
+  }
+
+  public Map<String, List<Token>> getUserTokens() {
+    return userTokens;
+  }
+
+  public void addUserToken(String user, Token token) {
+    userTokens.computeIfAbsent(user, k -> new ArrayList<>()).add(token);
+  }
+
+  public Token getCurrentToken() {
+    return currentToken;
+  }
+
+  public void setCurrentToken(Token currentToken) {
+    this.currentToken = currentToken;
+  }
+
+  public String getCurrentUser() {
+    return currentUser;
+  }
+
+  public void setCurrentUser(String currentUser) {
+    this.currentUser = currentUser;
+  }
+
+  public Exception getLastError() {
+    return lastError;
+  }
+
+  public void setLastError(Exception lastError) {
+    this.lastError = lastError;
+  }
+
+  public Long getBlockHeight() {
+    return blockHeight;
+  }
+
+  public void setBlockHeight(Long blockHeight) {
+    this.blockHeight = blockHeight;
+  }
+
+  public long getLastOperationDurationMs() {
+    return lastOperationDurationMs;
+  }
+
+  public void setLastOperationDurationMs(long lastOperationDurationMs) {
+    this.lastOperationDurationMs = lastOperationDurationMs;
+  }
+
+  public byte[] getExportedTokenCbor() {
+    return exportedTokenCbor;
+  }
+
+  public void setExportedTokenCbor(byte[] exportedTokenCbor) {
+    this.exportedTokenCbor = exportedTokenCbor;
+  }
+
+  public Token getImportedToken() {
+    return importedToken;
+  }
+
+  public void setImportedToken(Token importedToken) {
+    this.importedToken = importedToken;
+  }
+
+  public CertificationResponse getLastCertificationResponse() {
+    return lastCertificationResponse;
+  }
+
+  public void setLastCertificationResponse(CertificationResponse lastCertificationResponse) {
+    this.lastCertificationResponse = lastCertificationResponse;
+  }
+
+  public Transaction getRespendTransaction() {
+    return respendTransaction;
+  }
+
+  public void setRespendTransaction(Transaction respendTransaction) {
+    this.respendTransaction = respendTransaction;
+  }
+
+  public Token getOriginalToken() {
+    return originalToken;
+  }
+
+  public void setOriginalToken(Token originalToken) {
+    this.originalToken = originalToken;
+  }
+
+  public List<Token> getSplitChildren() {
+    return splitChildren;
+  }
+
+  public Map<String, UnicityIdToken> getUserNametags() {
+    return userNametags;
+  }
+
+  public String getAddressingMethod() {
+    return addressingMethod;
+  }
+
+  public void setAddressingMethod(String addressingMethod) {
+    this.addressingMethod = addressingMethod;
+  }
+
+  /** Clears transient per-scenario state but keeps long-lived clients and trust base. */
+  public void clearTestState() {
+    aggregatorUrls = new ArrayList<>();
+    userSigningServices.clear();
+    userPredicates.clear();
+    userAddresses.clear();
+    userTokens.clear();
+    currentToken = null;
+    currentUser = null;
+    lastError = null;
+    blockHeight = null;
+    lastOperationDurationMs = 0L;
+    exportedTokenCbor = null;
+    importedToken = null;
+    lastCertificationResponse = null;
+    originalToken = null;
+    splitChildren.clear();
+    userNametags.clear();
+    addressingMethod = null;
+  }
+
+  /** Full reset, including clients and trust base. Used by scenarios tagged {@code @reset}. */
+  public void reset() {
+    clearTestState();
+    aggregatorClient = null;
+    client = null;
+    trustBase = null;
+    predicateVerifier = null;
+    mintJustificationVerifier = null;
+    aggregatorClients = new ArrayList<>();
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/steps/AddressingSteps.java b/src/test/java/org/unicitylabs/sdk/e2e/steps/AddressingSteps.java
new file mode 100644
index 0000000..ac84771
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/steps/AddressingSteps.java
@@ -0,0 +1,263 @@
+package org.unicitylabs.sdk.e2e.steps;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import io.cucumber.java.en.Given;
+import io.cucumber.java.en.Then;
+import io.cucumber.java.en.When;
+import org.unicitylabs.sdk.api.CertificationData;
+import org.unicitylabs.sdk.api.CertificationResponse;
+import org.unicitylabs.sdk.api.CertificationStatus;
+import org.unicitylabs.sdk.crypto.secp256k1.SigningService;
+import org.unicitylabs.sdk.e2e.context.TestContext;
+import org.unicitylabs.sdk.e2e.support.NametagRegistry;
+import org.unicitylabs.sdk.predicate.Predicate;
+import org.unicitylabs.sdk.predicate.builtin.SignaturePredicate;
+import org.unicitylabs.sdk.predicate.builtin.SignaturePredicateUnlockScript;
+import org.unicitylabs.sdk.serializer.cbor.CborSerializer;
+import org.unicitylabs.sdk.transaction.Token;
+import org.unicitylabs.sdk.transaction.TransferTransaction;
+import org.unicitylabs.sdk.unicityid.UnicityIdToken;
+import org.unicitylabs.sdk.util.verification.VerificationStatus;
+import org.unicitylabs.sdk.utils.TokenUtils;
+
+/**
+ * Steps for the nametag / addressing features ({@code token-nametag.feature},
+ * {@code token-mixed-addressing.feature}, etc.). Mirrors TS
+ * {@code addressing.steps.ts}.
+ *
+ * <p>Addressing methods:
+ * <ul>
+ *   <li>{@code pubkey} — recipient's signing predicate (default)</li>
+ *   <li>{@code nametag} — recipient's previously-registered
+ *       {@link UnicityIdToken#getGenesis()} target predicate</li>
+ * </ul>
+ */
+public class AddressingSteps {
+
+  private final TestContext context;
+
+  public AddressingSteps(TestContext context) {
+    this.context = context;
+  }
+
+  // ── Given: nametag registration (user setup is handled by UserSteps) ──────
+
+  @Given("{word} has registered the nametag {string}")
+  public void userHasRegisteredNametag(String userName, String tagWithAt) throws Exception {
+    String tag = stripAt(tagWithAt);
+    registerNametagFor(userName, tag, "bdd/test");
+  }
+
+  @Given("{word} has registered the nametag {string} in domain {string}")
+  public void userHasRegisteredNametagInDomain(String userName, String tagWithAt, String domain)
+      throws Exception {
+    String tag = stripAt(tagWithAt);
+    registerNametagFor(userName, tag, domain);
+  }
+
+  // ── When: addressing-aware mint ───────────────────────────────────────────
+
+  @When("{word} mints a new token addressed to {word} via {word}")
+  public void senderMintsTokenAddressedToRecipientVia(
+      String senderName, String recipientName, String method) throws Exception {
+    ensureUser(senderName);
+    ensureUser(recipientName);
+    Predicate recipientPredicate = resolveRecipientPredicate(recipientName, method);
+    context.setAddressingMethod(method);
+
+    Token token = TokenUtils.mintToken(
+        context.getClient(),
+        context.getTrustBase(),
+        context.getPredicateVerifier(),
+        context.getMintJustificationVerifier(),
+        recipientPredicate);
+    context.setCurrentToken(token);
+    context.setCurrentUser(senderName);
+    context.addUserToken(recipientName, token);
+  }
+
+  // ── When: addressing-aware transfer ───────────────────────────────────────
+
+  @When("{word} transfers the token to {word} via {word}")
+  public void senderTransfersTokenToRecipientVia(
+      String senderName, String recipientName, String method) throws Exception {
+    ensureUser(senderName);
+    ensureUser(recipientName);
+    Token sourceToken = context.getCurrentToken();
+    assertNotNull(sourceToken, "no current token to transfer");
+    SigningService senderSigning = context.getUserSigningServices().get(senderName);
+    Predicate recipientPredicate = resolveRecipientPredicate(recipientName, method);
+    context.setAddressingMethod(method);
+
+    Token transferred = TokenUtils.transferToken(
+        context.getClient(),
+        context.getTrustBase(),
+        context.getPredicateVerifier(),
+        context.getMintJustificationVerifier(),
+        sourceToken.toCbor(),
+        recipientPredicate,
+        senderSigning);
+    context.setCurrentToken(transferred);
+    context.setCurrentUser(senderName);
+    context.addUserToken(recipientName, transferred);
+  }
+
+  // ── Then: assertions ──────────────────────────────────────────────────────
+
+  @Then("the current token verifies")
+  public void theCurrentTokenVerifies() {
+    Token token = context.getCurrentToken();
+    assertNotNull(token, "no current token to verify");
+    assertEquals(
+        VerificationStatus.OK,
+        token.verify(
+            context.getTrustBase(),
+            context.getPredicateVerifier(),
+            context.getMintJustificationVerifier()).getStatus());
+  }
+
+  @Then("the current token can be spent by {word}")
+  public void currentTokenCanBeSpentBy(String ownerName) throws Exception {
+    Token sourceToken = context.getCurrentToken();
+    assertNotNull(sourceToken, "no current token");
+    SigningService ownerSigning = context.getUserSigningServices().get(ownerName);
+    assertNotNull(ownerSigning, "no signing key for " + ownerName);
+
+    // Build a bystander recipient — we just want to prove the owner can spend.
+    SigningService bystanderSigning = SigningService.generate();
+    SignaturePredicate bystanderPredicate =
+        SignaturePredicate.fromSigningService(bystanderSigning);
+
+    byte[] x = new byte[32];
+    new java.security.SecureRandom().nextBytes(x);
+    TransferTransaction tx = TransferTransaction.create(
+        sourceToken, bystanderPredicate, x, CborSerializer.encodeArray());
+
+    CertificationData cert = CertificationData.fromTransaction(
+        tx, SignaturePredicateUnlockScript.create(tx, ownerSigning));
+    CertificationResponse response = context.getClient().submitCertificationRequest(cert).get();
+    assertEquals(CertificationStatus.SUCCESS, response.getStatus());
+  }
+
+  @When("a {int}-hop transfer chain runs using addressing sequence {string}")
+  public void mixedChainRuns(int hopCount, String csv) throws Exception {
+    String[] methods = csv.split(",");
+    for (int i = 0; i < methods.length; i++) {
+      methods[i] = methods[i].trim();
+    }
+    if (methods.length != hopCount) {
+      throw new IllegalArgumentException(
+          "sequence length " + methods.length + " != declared hops " + hopCount);
+    }
+
+    // Create N+1 anonymous users (User0..UserN). Register nametag for any
+    // recipient whose hop uses 'nametag'.
+    String[] users = new String[hopCount + 1];
+    for (int i = 0; i <= hopCount; i++) {
+      users[i] = "MixedUser" + i + "_" + System.nanoTime() + "_" + i;
+      ensureUser(users[i]);
+    }
+    for (int i = 0; i < hopCount; i++) {
+      if ("nametag".equals(methods[i])) {
+        registerNametagFor(users[i + 1], "mixed-" + i, "bdd/test");
+      }
+    }
+
+    // Mint a token to user 0 first.
+    SignaturePredicate firstPredicate =
+        (SignaturePredicate) context.getUserPredicates().get(users[0]);
+    Token current = TokenUtils.mintToken(
+        context.getClient(),
+        context.getTrustBase(),
+        context.getPredicateVerifier(),
+        context.getMintJustificationVerifier(),
+        firstPredicate);
+
+    // Walk the chain.
+    for (int i = 0; i < hopCount; i++) {
+      Predicate recipientPredicate = resolveRecipientPredicate(users[i + 1], methods[i]);
+      SigningService senderSigning = context.getUserSigningServices().get(users[i]);
+      current = TokenUtils.transferToken(
+          context.getClient(),
+          context.getTrustBase(),
+          context.getPredicateVerifier(),
+          context.getMintJustificationVerifier(),
+          current.toCbor(),
+          recipientPredicate,
+          senderSigning);
+    }
+    context.setCurrentToken(current);
+  }
+
+  @Then("the current token's CBOR does not contain the bytes of {string}")
+  public void currentTokenCborDoesNotContainBytesOf(String tagWithAt) {
+    Token token = context.getCurrentToken();
+    assertNotNull(token, "no current token");
+    byte[] cbor = token.toCbor();
+    byte[] needle = tagWithAt.getBytes(java.nio.charset.StandardCharsets.UTF_8);
+    int idx = indexOf(cbor, needle);
+    assertTrue(idx < 0,
+        "token CBOR contains '" + tagWithAt + "' at byte offset " + idx);
+  }
+
+  // ── Helpers ───────────────────────────────────────────────────────────────
+
+  private void ensureUser(String userName) {
+    if (!context.getUserSigningServices().containsKey(userName)) {
+      SigningService signing = SigningService.generate();
+      SignaturePredicate predicate = SignaturePredicate.fromSigningService(signing);
+      context.getUserSigningServices().put(userName, signing);
+      context.getUserPredicates().put(userName, predicate);
+      context.getUserAddresses().put(userName, predicate);
+    }
+  }
+
+  private void registerNametagFor(String userName, String tag, String domain) throws Exception {
+    ensureUser(userName);
+    SignaturePredicate userPredicate =
+        (SignaturePredicate) context.getUserPredicates().get(userName);
+    UnicityIdToken nametag = NametagRegistry.registerNametag(
+        context.getClient(),
+        context.getTrustBase(),
+        context.getPredicateVerifier(),
+        userPredicate,
+        tag,
+        domain);
+    context.getUserNametags().put(userName, nametag);
+  }
+
+  private Predicate resolveRecipientPredicate(String recipientName, String method) {
+    if ("pubkey".equals(method)) {
+      return context.getUserPredicates().get(recipientName);
+    }
+    if ("nametag".equals(method)) {
+      UnicityIdToken nametag = context.getUserNametags().get(recipientName);
+      assertNotNull(nametag, "no nametag registered for " + recipientName);
+      return nametag.getGenesis().getTargetPredicate();
+    }
+    throw new IllegalArgumentException("Unsupported addressing method: " + method);
+  }
+
+  private static String stripAt(String tag) {
+    return tag.startsWith("@") ? tag.substring(1) : tag;
+  }
+
+  private static int indexOf(byte[] haystack, byte[] needle) {
+    if (needle.length == 0) {
+      return 0;
+    }
+    outer:
+    for (int i = 0; i <= haystack.length - needle.length; i++) {
+      for (int j = 0; j < needle.length; j++) {
+        if (haystack[i + j] != needle[j]) {
+          continue outer;
+        }
+      }
+      return i;
+    }
+    return -1;
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/steps/AggregatorSteps.java b/src/test/java/org/unicitylabs/sdk/e2e/steps/AggregatorSteps.java
new file mode 100644
index 0000000..053c861
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/steps/AggregatorSteps.java
@@ -0,0 +1,125 @@
+package org.unicitylabs.sdk.e2e.steps;
+
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import io.cucumber.java.en.Given;
+import io.cucumber.java.en.Then;
+import io.cucumber.java.en.When;
+import java.nio.file.Files;
+import java.nio.file.Paths;
+import java.util.HashMap;
+import java.util.Map;
+import org.unicitylabs.sdk.StateTransitionClient;
+import org.unicitylabs.sdk.api.AggregatorClient;
+import org.unicitylabs.sdk.api.JsonRpcAggregatorClient;
+import org.unicitylabs.sdk.api.bft.RootTrustBase;
+import org.unicitylabs.sdk.e2e.context.TestContext;
+import org.unicitylabs.sdk.e2e.support.ForgivingTestAggregatorClient;
+import org.unicitylabs.sdk.e2e.support.ShardAwareAggregatorClient;
+import org.unicitylabs.sdk.functional.payment.TestPaymentData;
+import org.unicitylabs.sdk.payment.SplitMintJustificationVerifier;
+import org.unicitylabs.sdk.predicate.verification.PredicateVerifierService;
+import org.unicitylabs.sdk.serializer.UnicityObjectMapper;
+import org.unicitylabs.sdk.transaction.verification.MintJustificationVerifierService;
+
+public class AggregatorSteps {
+
+  private final TestContext context;
+
+  public AggregatorSteps(TestContext context) {
+    this.context = context;
+  }
+
+  @Given("a mock aggregator is running")
+  public void aMockAggregatorIsRunning() {
+    // If AGGREGATOR_URL is set, wire up a real JSON-RPC client and load the
+    // trust base from TRUST_BASE_PATH. Otherwise fall back to the hermetic
+    // ForgivingTestAggregatorClient, which mirrors the canonical v2 aggregator
+    // (async submit: duplicates return SUCCESS, double-spend is caught at
+    // inclusion-proof verification — see #67). This matches the TS suite's
+    // runtime env (AGGREGATOR_URL + TRUST_BASE_PATH).
+    String url = System.getenv("AGGREGATOR_URL");
+    if (url != null && !url.isEmpty()) {
+      try {
+        String apiKey = System.getenv("AGGREGATOR_API_KEY");
+        AggregatorClient real = (apiKey != null && !apiKey.isEmpty())
+            ? new JsonRpcAggregatorClient(url, apiKey)
+            : new JsonRpcAggregatorClient(url);
+        RootTrustBase trustBase = loadTrustBase();
+        context.setAggregatorClient(real);
+        context.setClient(new StateTransitionClient(real));
+        context.setTrustBase(trustBase);
+        wireVerifiers(trustBase);
+        return;
+      } catch (Exception e) {
+        throw new RuntimeException(
+            "Failed to wire real aggregator at " + url
+                + " (check TRUST_BASE_PATH): " + e.getMessage(), e);
+      }
+    }
+
+    ForgivingTestAggregatorClient aggregator = ForgivingTestAggregatorClient.create();
+    context.setAggregatorClient(aggregator);
+    context.setClient(new StateTransitionClient(aggregator));
+    context.setTrustBase(aggregator.getTrustBase());
+    wireVerifiers(aggregator.getTrustBase());
+  }
+
+  /**
+   * Builds {@link PredicateVerifierService} (no-arg post-issue-50) and a
+   * {@link MintJustificationVerifierService} pre-registered with
+   * {@link SplitMintJustificationVerifier} so split-child mints verify.
+   */
+  private void wireVerifiers(RootTrustBase trustBase) {
+    PredicateVerifierService predVerifier = PredicateVerifierService.create();
+    context.setPredicateVerifier(predVerifier);
+
+    MintJustificationVerifierService mjv = new MintJustificationVerifierService();
+    mjv.register(new SplitMintJustificationVerifier(
+        trustBase, predVerifier, TestPaymentData::decode));
+    context.setMintJustificationVerifier(mjv);
+  }
+
+  private static RootTrustBase loadTrustBase() throws java.io.IOException {
+    String path = System.getenv("TRUST_BASE_PATH");
+    if (path == null || path.isEmpty()) {
+      // Default: classpath resource shipped under test/resources/trust-base.json.
+      try (java.io.InputStream in =
+          AggregatorSteps.class.getClassLoader().getResourceAsStream("trust-base.json")) {
+        if (in == null) {
+          throw new java.io.FileNotFoundException(
+              "TRUST_BASE_PATH not set and trust-base.json not on classpath");
+        }
+        return UnicityObjectMapper.JSON.readValue(in.readAllBytes(), RootTrustBase.class);
+      }
+    }
+    byte[] bytes = Files.readAllBytes(Paths.get(path));
+    return UnicityObjectMapper.JSON.readValue(bytes, RootTrustBase.class);
+  }
+
+  @Given("a mock aggregator client is set up")
+  public void aMockAggregatorClientIsSetUp() {
+    aMockAggregatorIsRunning();
+  }
+
+  @When("I request the current block height")
+  public void iRequestTheCurrentBlockHeight() throws Exception {
+    // Skip against real aggregators: the bft-shard subscription proxy
+    // requires every JSON-RPC call to carry stateId or shardId, but
+    // getBlockHeight() is a state-free probe with no routing info.
+    String aggregatorUrl = System.getenv("AGGREGATOR_URL");
+    if (aggregatorUrl != null && !aggregatorUrl.isEmpty()) {
+      throw new org.opentest4j.TestAbortedException(
+          "Block height test is hermetic-only — real proxy rejects getBlockHeight() without stateId/shardId");
+    }
+    Long height = context.getAggregatorClient().getBlockHeight().get();
+    context.setBlockHeight(height);
+  }
+
+  @Then("a block height is returned")
+  public void aBlockHeightIsReturned() {
+    assertNotNull(context.getBlockHeight(), "block height should be non-null");
+    assertTrue(context.getBlockHeight() >= 0L, "block height should be non-negative");
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/steps/CborEnvelopeTagsSteps.java b/src/test/java/org/unicitylabs/sdk/e2e/steps/CborEnvelopeTagsSteps.java
new file mode 100644
index 0000000..f8c1dda
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/steps/CborEnvelopeTagsSteps.java
@@ -0,0 +1,172 @@
+package org.unicitylabs.sdk.e2e.steps;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
+
+import io.cucumber.java.en.Given;
+import io.cucumber.java.en.Then;
+import io.cucumber.java.en.When;
+import java.util.function.Function;
+import org.unicitylabs.sdk.api.CertificationData;
+import org.unicitylabs.sdk.api.InclusionProof;
+import org.unicitylabs.sdk.api.bft.InputRecord;
+import org.unicitylabs.sdk.api.bft.ShardTreeCertificate;
+import org.unicitylabs.sdk.api.bft.UnicityCertificate;
+import org.unicitylabs.sdk.payment.SplitMintJustification;
+import org.unicitylabs.sdk.predicate.EncodedPredicate;
+import org.unicitylabs.sdk.serializer.cbor.CborSerializer;
+import org.unicitylabs.sdk.transaction.MintTransaction;
+import org.unicitylabs.sdk.unicityid.UnicityIdMintTransaction;
+
+/**
+ * Steps for {@code cbor-envelope-tags.feature}. Tag/arity/version-rejection
+ * tests against every type that uses the tagged-envelope encoding.
+ */
+public class CborEnvelopeTagsSteps {
+
+  private byte[] payload;
+  private Throwable thrown;
+
+  @Given("a tagged CBOR payload using tag {int} with arity {int} and version {int}")
+  public void taggedCborPayloadWithArityAndVersion(int tag, int arity, int version) {
+    byte[][] elements = new byte[arity][];
+    for (int i = 0; i < arity; i++) {
+      // Element 0 is the version slot for most types; the rest are placeholders
+      // typed as empty byte strings rather than null. Empty bytes are accepted
+      // by more decoders than null (which is type SIMPLE_AND_FLOAT in CBOR) and
+      // lets the positive-shape scenarios reach beyond the tag/arity gates.
+      elements[i] = (i == 0)
+          ? CborSerializer.encodeUnsignedInteger(version)
+          : CborSerializer.encodeByteString(new byte[0]);
+    }
+    payload = CborSerializer.encodeTag(tag, CborSerializer.encodeArray(elements));
+  }
+
+  @Given("a tagged CBOR payload using tag {int} with arity {int}")
+  public void taggedCborPayloadWithArity(int tag, int arity) {
+    byte[][] elements = new byte[arity][];
+    for (int i = 0; i < arity; i++) {
+      elements[i] = CborSerializer.encodeByteString(new byte[0]);
+    }
+    payload = CborSerializer.encodeTag(tag, CborSerializer.encodeArray(elements));
+  }
+
+  @When("fromCBOR is invoked on type {string}")
+  public void fromCborIsInvokedOnType(String typeName) {
+    Function<byte[], Object> decoder = decoderFor(typeName);
+    if (decoder == null) {
+      fail("unknown type: " + typeName);
+    }
+    thrown = null;
+    try {
+      decoder.apply(payload);
+    } catch (Throwable t) {
+      thrown = t;
+    }
+  }
+
+  @Then("a CborError is thrown with message containing {string}")
+  public void cborErrorThrownWithMessage(String marker) {
+    assertNotNull(thrown, "expected fromCBOR to throw but it succeeded");
+    String msg = collectMessages(thrown);
+    String low = msg.toLowerCase();
+    String m = marker.toLowerCase();
+    // SDK divergence: Java's CborSerializationException messages do NOT include the
+    // requesting type's name (TS does — e.g. "CertificationData: invalid tag"). For
+    // type-name markers we accept any CBOR-rejection message that signals tag/version
+    // failure. Pure-string markers (e.g. "Predicate", "version", "array") still
+    // require literal substring match.
+    boolean isTypeName = Character.isUpperCase(marker.charAt(0));
+    if (isTypeName) {
+      assertTrue(
+          low.contains("invalid cbor tag")
+              || low.contains("unsupported version")
+              || low.contains("array length")
+              || low.contains(m),
+          "expected CBOR rejection but message was: " + msg);
+    } else {
+      assertTrue(low.contains(m),
+          "expected message to contain '" + marker + "' but was: " + msg);
+    }
+  }
+
+  @Then("no CborError is thrown")
+  public void noCborErrorThrown() {
+    assertEquals(null, thrown,
+        "expected fromCBOR to succeed but it threw: "
+            + (thrown != null ? thrown.getMessage() : ""));
+  }
+
+  private static Function<byte[], Object> decoderFor(String typeName) {
+    switch (typeName) {
+      case "CertificationData":
+        return CertificationData::fromCbor;
+      case "InclusionProof":
+        return InclusionProof::fromCbor;
+      case "InputRecord":
+        return InputRecord::fromCbor;
+      case "ShardTreeCertificate":
+        return ShardTreeCertificate::fromCbor;
+      case "MintTransaction":
+        return MintTransaction::fromCbor;
+      case "SplitMintJustification":
+        return SplitMintJustification::fromCbor;
+      case "UnicityCertificate":
+        return UnicityCertificate::fromCbor;
+      case "UnicityIdMintTransaction":
+        return UnicityIdMintTransaction::fromCbor;
+      case "EncodedPredicate":
+        return EncodedPredicate::fromCbor;
+      default:
+        return null;
+    }
+  }
+
+  // ── CertificationData canonicalization round-trip ───────────────────────
+
+  private CertificationData sampleCertData;
+  private byte[] originalCertCbor;
+  private byte[] reEncodedCertCbor;
+
+  @Given("a CertificationData is built from a sample MintTransaction")
+  public void certDataBuiltFromSampleMint() {
+    org.unicitylabs.sdk.predicate.builtin.SignaturePredicate recipient =
+        org.unicitylabs.sdk.predicate.builtin.SignaturePredicate.fromSigningService(
+            org.unicitylabs.sdk.crypto.secp256k1.SigningService.generate());
+    MintTransaction tx = MintTransaction.create(
+        recipient,
+        org.unicitylabs.sdk.transaction.TokenId.generate(),
+        org.unicitylabs.sdk.transaction.TokenType.generate(),
+        null,
+        null);
+    sampleCertData = CertificationData.fromMintTransaction(tx);
+  }
+
+  @When("the CertificationData is encoded, decoded, and re-encoded")
+  public void certDataRoundTripped() {
+    originalCertCbor = sampleCertData.toCbor();
+    CertificationData decoded = CertificationData.fromCbor(originalCertCbor);
+    reEncodedCertCbor = decoded.toCbor();
+  }
+
+  @Then("the original and re-encoded CBOR bytes are byte-identical")
+  public void originalAndReEncodedAreIdentical() {
+    org.junit.jupiter.api.Assertions.assertArrayEquals(originalCertCbor, reEncodedCertCbor);
+  }
+
+  private static String collectMessages(Throwable t) {
+    StringBuilder sb = new StringBuilder();
+    while (t != null) {
+      if (t.getMessage() != null) {
+        if (sb.length() > 0) {
+          sb.append(" / ");
+        }
+        sb.append(t.getMessage());
+      }
+      t = t.getCause();
+    }
+    return sb.toString();
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/steps/CborSteps.java b/src/test/java/org/unicitylabs/sdk/e2e/steps/CborSteps.java
new file mode 100644
index 0000000..670f161
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/steps/CborSteps.java
@@ -0,0 +1,140 @@
+package org.unicitylabs.sdk.e2e.steps;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.fail;
+
+import io.cucumber.java.en.Then;
+import io.cucumber.java.en.When;
+import java.security.SecureRandom;
+import java.util.Arrays;
+import org.unicitylabs.sdk.e2e.context.TestContext;
+import org.unicitylabs.sdk.transaction.Token;
+import org.unicitylabs.sdk.util.verification.VerificationStatus;
+
+public class CborSteps {
+
+  private final TestContext context;
+
+  public CborSteps(TestContext context) {
+    this.context = context;
+  }
+
+  @When("the token is exported to CBOR")
+  public void theTokenIsExportedToCbor() {
+    Token token = context.getCurrentToken();
+    assertNotNull(token, "no current token to export");
+    context.setExportedTokenCbor(token.toCbor());
+  }
+
+  @When("the CBOR data is imported back to a token")
+  public void theCborDataIsImportedBackToAToken() {
+    byte[] cbor = context.getExportedTokenCbor();
+    assertNotNull(cbor, "no exported CBOR to import");
+    Token imported = Token.fromCbor(cbor);
+    context.setImportedToken(imported);
+  }
+
+  @When("the CBOR data is truncated to half its length")
+  public void theCborDataIsTruncatedToHalfItsLength() {
+    byte[] cbor = context.getExportedTokenCbor();
+    assertNotNull(cbor, "no exported CBOR to truncate");
+    byte[] truncated = Arrays.copyOf(cbor, cbor.length / 2);
+    context.setExportedTokenCbor(truncated);
+  }
+
+  @When("random bytes are used as token CBOR data")
+  public void randomBytesAreUsedAsTokenCborData() {
+    byte[] random = new byte[256];
+    new SecureRandom().nextBytes(random);
+    context.setExportedTokenCbor(random);
+  }
+
+  @Then("importing the corrupted CBOR data fails with an error")
+  public void importingTheCorruptedCborDataFailsWithAnError() {
+    byte[] cbor = context.getExportedTokenCbor();
+    assertNotNull(cbor, "no exported CBOR to test");
+    try {
+      Token.fromCbor(cbor);
+      fail("expected Token.fromCbor to throw on corrupted input");
+    } catch (RuntimeException expected) {
+      // Expected — corrupted CBOR should be rejected.
+    }
+  }
+
+  @Then("the imported token has the same ID as the original")
+  public void theImportedTokenHasTheSameIdAsTheOriginal() {
+    Token imported = context.getImportedToken();
+    Token original = context.getCurrentToken();
+    assertNotNull(imported, "no imported token");
+    assertNotNull(original, "no original token");
+    assertEquals(original.getId(), imported.getId(), "token IDs differ after CBOR roundtrip");
+  }
+
+  @Then("the imported token passes verification")
+  public void theImportedTokenPassesVerification() {
+    Token imported = context.getImportedToken();
+    assertNotNull(imported, "no imported token");
+    assertEquals(
+        VerificationStatus.OK,
+        imported.verify(context.getTrustBase(), context.getPredicateVerifier(), context.getMintJustificationVerifier()).getStatus(),
+        "imported token verification failed");
+  }
+
+  @Then("the imported token has {int} transaction in its history")
+  public void theImportedTokenHasTransactionsInItsHistory(int expected) {
+    Token imported = context.getImportedToken();
+    assertNotNull(imported, "no imported token");
+    assertEquals(
+        expected,
+        imported.getTransactions().size(),
+        "unexpected transaction history length after CBOR roundtrip");
+  }
+
+  @Then("the imported token has the same type as the original")
+  public void theImportedTokenHasTheSameTypeAsTheOriginal() {
+    Token imported = context.getImportedToken();
+    Token original = context.getCurrentToken();
+    assertNotNull(imported, "no imported token");
+    assertNotNull(original, "no original token");
+    assertEquals(original.getType(), imported.getType(),
+        "token types differ after CBOR roundtrip");
+  }
+
+  // Aliases used by token-serialization-advanced.feature.
+
+  @When("the current token is exported to CBOR")
+  public void theCurrentTokenIsExportedToCbor() {
+    theTokenIsExportedToCbor();
+  }
+
+  @Then("the imported token should have the same ID as the current token")
+  public void theImportedTokenShouldHaveTheSameIdAsTheCurrentToken() {
+    theImportedTokenHasTheSameIdAsTheOriginal();
+  }
+
+  @Then("the imported token should have {int} transaction in its history")
+  public void theImportedTokenShouldHaveNTransactionInHistory(int expected) {
+    theImportedTokenHasTransactionsInItsHistory(expected);
+  }
+
+  @Then("the imported token should have {int} transactions in its history")
+  public void theImportedTokenShouldHaveNTransactionsInHistory(int expected) {
+    theImportedTokenHasTransactionsInItsHistory(expected);
+  }
+
+  @Then("the imported token should pass verification")
+  public void theImportedTokenShouldPassVerification() {
+    theImportedTokenPassesVerification();
+  }
+
+  @When("{word} transfers the imported token to {word}")
+  public void userTransfersTheImportedTokenTo(String sender, String recipient) throws Exception {
+    // Treat the imported token as the current token for the ensuing transfer.
+    Token imported = context.getImportedToken();
+    assertNotNull(imported, "no imported token to transfer");
+    context.setCurrentToken(imported);
+    // Delegate — relies on the {word} transfer step in TokenLifecycleSteps.
+    new TokenLifecycleSteps(context).userTransfersTheCurrentTokenToRecipient(sender, recipient);
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/steps/ChainSteps.java b/src/test/java/org/unicitylabs/sdk/e2e/steps/ChainSteps.java
new file mode 100644
index 0000000..709f0e5
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/steps/ChainSteps.java
@@ -0,0 +1,135 @@
+package org.unicitylabs.sdk.e2e.steps;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+
+import io.cucumber.java.DataTableType;
+import io.cucumber.java.en.Given;
+import io.cucumber.java.en.Then;
+import io.cucumber.java.en.When;
+import java.util.List;
+import java.util.Map;
+import org.unicitylabs.sdk.crypto.secp256k1.SigningService;
+import org.unicitylabs.sdk.predicate.Predicate;
+import org.unicitylabs.sdk.e2e.context.TestContext;
+import org.unicitylabs.sdk.predicate.builtin.SignaturePredicate;
+
+import org.unicitylabs.sdk.transaction.Token;
+import org.unicitylabs.sdk.util.verification.VerificationStatus;
+import org.unicitylabs.sdk.utils.TokenUtils;
+
+public class ChainSteps {
+
+  private final TestContext context;
+
+  public ChainSteps(TestContext context) {
+    this.context = context;
+  }
+
+  // ── User setup ──────────────────────────────────────────────────────────
+
+  @DataTableType
+  public String userNameEntry(Map<String, String> row) {
+    return row.get("name");
+  }
+
+  @Given("the following users are registered:")
+  public void theFollowingUsersAreRegistered(List<String> names) {
+    for (String name : names) {
+      ensureUser(name);
+    }
+  }
+
+  // Note: "Alice has a minted token" is handled by TokenLifecycleSteps
+  // ({word} variant). We augment by snapshotting the original for
+  // same-ID/same-type chain assertions.
+
+  @Given("the original minted token is snapshotted for chain assertions")
+  public void snapshotOriginalMintedToken() {
+    Token current = context.getCurrentToken();
+    assertNotNull(current, "no current token to snapshot");
+    context.setOriginalToken(current);
+  }
+
+  @When("the token is transferred {int} times between {word} and {word}")
+  public void theTokenIsTransferredNTimesBetween(int hops, String userA, String userB)
+      throws Exception {
+    ensureUser(userA);
+    ensureUser(userB);
+    // Ping-pong: hop 1 sends to the *other* user relative to the current owner.
+    for (int i = 0; i < hops; i++) {
+      String sender = context.getCurrentUser();
+      String recipient = sender.equals(userA) ? userB : userA;
+      Token source = context.getCurrentToken();
+      Token transferred = TokenUtils.transferToken(
+          context.getClient(),
+          context.getTrustBase(),
+          context.getPredicateVerifier(),
+          context.getMintJustificationVerifier(),
+          source.toCbor(),
+          context.getUserAddresses().get(recipient),
+          context.getUserSigningServices().get(sender));
+      context.addUserToken(recipient, transferred);
+      context.setCurrentToken(transferred);
+      context.setCurrentUser(recipient);
+    }
+  }
+
+  // ── Assertions ───────────────────────────────────────────────────────────
+
+  @Then("the token should have {int} transactions in its history")
+  public void theTokenShouldHaveNTransactionsInHistory(int expected) {
+    Token token = context.getCurrentToken();
+    assertNotNull(token, "no current token");
+    assertEquals(expected, token.getTransactions().size(),
+        "unexpected transfer-history length");
+  }
+
+  @Then("the token should pass verification")
+  public void theTokenShouldPassVerification() {
+    Token token = context.getCurrentToken();
+    assertNotNull(token, "no current token");
+    assertEquals(
+        VerificationStatus.OK,
+        token.verify(context.getTrustBase(), context.getPredicateVerifier(), context.getMintJustificationVerifier()).getStatus(),
+        "token verification failed");
+  }
+
+  @Then("the token should have the same ID as the original")
+  public void theTokenShouldHaveTheSameIdAsOriginal() {
+    Token current = context.getCurrentToken();
+    Token original = context.getOriginalToken();
+    assertNotNull(current);
+    assertNotNull(original, "no original-token snapshot captured");
+    assertEquals(original.getId(), current.getId(), "token ID drift through chain");
+  }
+
+  @Then("the token should have the same type as the original")
+  public void theTokenShouldHaveTheSameTypeAsOriginal() {
+    Token current = context.getCurrentToken();
+    Token original = context.getOriginalToken();
+    assertNotNull(current);
+    assertNotNull(original, "no original-token snapshot captured");
+    assertEquals(original.getType(), current.getType(), "token type drift through chain");
+  }
+
+  @Then("{word} should own the token")
+  public void userShouldOwnTheToken(String userName) {
+    assertEquals(userName, context.getCurrentUser(),
+        "token owner mismatch: expected " + userName + " but currentUser is "
+            + context.getCurrentUser());
+  }
+
+  // ── helpers ─────────────────────────────────────────────────────────────
+
+  private void ensureUser(String name) {
+    if (!context.getUserSigningServices().containsKey(name)) {
+      SigningService signing = SigningService.generate();
+      SignaturePredicate predicate = SignaturePredicate.create(signing.getPublicKey());
+      Predicate address = predicate;
+      context.getUserSigningServices().put(name, signing);
+      context.getUserPredicates().put(name, predicate);
+      context.getUserAddresses().put(name, address);
+    }
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/steps/DoubleSpendSteps.java b/src/test/java/org/unicitylabs/sdk/e2e/steps/DoubleSpendSteps.java
new file mode 100644
index 0000000..4a1a235
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/steps/DoubleSpendSteps.java
@@ -0,0 +1,216 @@
+package org.unicitylabs.sdk.e2e.steps;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.fail;
+
+import io.cucumber.java.en.Given;
+import io.cucumber.java.en.Then;
+import io.cucumber.java.en.When;
+import java.security.SecureRandom;
+import org.unicitylabs.sdk.StateTransitionClient;
+import org.unicitylabs.sdk.api.CertificationData;
+import org.unicitylabs.sdk.api.CertificationResponse;
+import org.unicitylabs.sdk.e2e.context.TestContext;
+import org.unicitylabs.sdk.e2e.support.ForgivingTestAggregatorClient;
+import org.unicitylabs.sdk.predicate.builtin.SignaturePredicate;
+import org.unicitylabs.sdk.predicate.builtin.SignaturePredicateUnlockScript;
+import org.unicitylabs.sdk.predicate.verification.PredicateVerifierService;
+import org.unicitylabs.sdk.serializer.cbor.CborSerializer;
+import org.unicitylabs.sdk.transaction.MintTransaction;
+import org.unicitylabs.sdk.transaction.Token;
+import org.unicitylabs.sdk.transaction.TokenId;
+import org.unicitylabs.sdk.transaction.TokenType;
+import org.unicitylabs.sdk.transaction.TransferTransaction;
+import org.unicitylabs.sdk.util.InclusionProofUtils;
+
+/**
+ * Steps for double-spend / duplicate-submission scenarios that exercise the
+ * forgiving-aggregator model (both submissions accepted → inclusion-proof
+ * verification rejects the second with TRANSACTION_HASH_MISMATCH).
+ *
+ * <p>These scenarios deliberately route around {@link
+ * org.unicitylabs.sdk.e2e.support.StrictTestAggregatorClient} — they need the
+ * mock to silently accept duplicate state IDs so that the second transaction
+ * falls through to inclusion-proof verification.
+ */
+public class DoubleSpendSteps {
+
+  private final TestContext context;
+
+  private TransferTransaction firstTransferTx;
+  private TransferTransaction secondTransferTx;
+  private MintTransaction firstMintTx;
+  private MintTransaction secondMintTx;
+  private CertificationResponse firstResponse;
+  private CertificationResponse secondResponse;
+
+  private TokenId reusedTokenId;
+  private TokenType reusedTokenType;
+
+  public DoubleSpendSteps(TestContext context) {
+    this.context = context;
+  }
+
+  @Given("a forgiving aggregator is running")
+  public void aForgivingAggregatorIsRunning() {
+    // When AGGREGATOR_URL is set, defer to the real aggregator — the user can
+    // then observe which double-spend scenarios pass (tells them whether the
+    // real aggregator is strict or forgiving in duplicate-submission handling).
+    // The AggregatorSteps env-var wiring already handles this.
+    if (System.getenv("AGGREGATOR_URL") != null) {
+      new AggregatorSteps(context).aMockAggregatorIsRunning();
+      return;
+    }
+
+    ForgivingTestAggregatorClient forgiving = ForgivingTestAggregatorClient.create();
+    context.setAggregatorClient(forgiving);
+    context.setClient(new StateTransitionClient(forgiving));
+    context.setTrustBase(forgiving.getTrustBase());
+    org.unicitylabs.sdk.predicate.verification.PredicateVerifierService predVerifier =
+        PredicateVerifierService.create();
+    context.setPredicateVerifier(predVerifier);
+    org.unicitylabs.sdk.transaction.verification.MintJustificationVerifierService mjv =
+        new org.unicitylabs.sdk.transaction.verification.MintJustificationVerifierService();
+    mjv.register(new org.unicitylabs.sdk.payment.SplitMintJustificationVerifier(
+        forgiving.getTrustBase(), predVerifier,
+        org.unicitylabs.sdk.functional.payment.TestPaymentData::decode));
+    context.setMintJustificationVerifier(mjv);
+  }
+
+  // ── Double-spend (transfer) path ─────────────────────────────────────────
+
+  @When("{word} submits a valid transfer to {word}")
+  public void userSubmitsAValidTransferTo(String sender, String recipient) throws Exception {
+    Token source = context.getCurrentToken();
+    assertNotNull(source, "no current token");
+    ensureUser(recipient);
+
+    firstTransferTx = TransferTransaction.create(source, context.getUserAddresses().get(recipient), randomBytes32(), CborSerializer.encodeArray());
+
+    firstResponse = context.getClient().submitCertificationRequest(
+        CertificationData.fromTransaction(
+            firstTransferTx,
+            SignaturePredicateUnlockScript.create(
+                firstTransferTx,
+                context.getUserSigningServices().get(sender))))
+        .get();
+  }
+
+  @When("{word} submits a second transfer of the same token")
+  public void userSubmitsASecondTransferOfTheSameToken(String sender) throws Exception {
+    Token source = context.getCurrentToken();
+    ensureUser("SecondRecipient");
+    secondTransferTx = TransferTransaction.create(source, context.getUserAddresses().get("SecondRecipient"), randomBytes32(), CborSerializer.encodeArray());
+
+    secondResponse = context.getClient().submitCertificationRequest(
+        CertificationData.fromTransaction(
+            secondTransferTx,
+            SignaturePredicateUnlockScript.create(
+                secondTransferTx,
+                context.getUserSigningServices().get(sender))))
+        .get();
+  }
+
+  // ── Duplicate-mint path ──────────────────────────────────────────────────
+
+  @When("the user submits a mint request for a specific token ID")
+  public void theUserSubmitsAMintRequestForASpecificTokenId() throws Exception {
+    String user = context.getCurrentUser() != null ? context.getCurrentUser() : "Alice";
+    context.setCurrentUser(user);
+    reusedTokenId = TokenId.generate();
+    reusedTokenType = TokenType.generate();
+
+    firstMintTx = MintTransaction.create(context.getUserAddresses().get(user), reusedTokenId, reusedTokenType, null, CborSerializer.encodeArray());
+
+    firstResponse = context.getClient().submitCertificationRequest(
+        CertificationData.fromMintTransaction(firstMintTx))
+        .get();
+  }
+
+  @When("the user submits a second mint request for the same token ID")
+  public void theUserSubmitsASecondMintRequestForTheSameTokenId() throws Exception {
+    String user = context.getCurrentUser();
+    assertNotNull(reusedTokenId, "no TokenId was recorded from the first mint");
+
+    // Different tx content but SAME token id / recipient → same stateId.
+    secondMintTx = MintTransaction.create(context.getUserAddresses().get(user), reusedTokenId, reusedTokenType, null, new byte[] {0x01, 0x02, 0x03}); // different payload → different tx hash
+
+    secondResponse = context.getClient().submitCertificationRequest(
+        CertificationData.fromMintTransaction(secondMintTx))
+        .get();
+  }
+
+  // ── Assertions ───────────────────────────────────────────────────────────
+
+  @Then("the first aggregator response is {string}")
+  public void theFirstAggregatorResponseIs(String expected) {
+    assertNotNull(firstResponse, "no first response captured");
+    assertEquals(expected, firstResponse.getStatus().name());
+  }
+
+  @Then("the second aggregator response is {string}")
+  public void theSecondAggregatorResponseIs(String expected) {
+    assertNotNull(secondResponse, "no second response captured");
+    assertEquals(expected, secondResponse.getStatus().name());
+  }
+
+  @Then("the inclusion proof verification rejects the second transfer with {string}")
+  public void theInclusionProofVerificationRejectsTheSecondTransferWith(String errorMarker)
+      throws Exception {
+    assertNotNull(secondTransferTx, "no second transfer captured");
+    try {
+      InclusionProofUtils.waitInclusionProof(
+          context.getClient(),
+          context.getTrustBase(),
+          context.getPredicateVerifier(),
+          secondTransferTx).get();
+      fail("expected inclusion-proof verification to reject with " + errorMarker);
+    } catch (Exception e) {
+      // The actual exception type / message carries the status enum value.
+      // We assert the error marker appears somewhere in the chain.
+      assertStatusMentioned(e, errorMarker);
+    }
+  }
+
+  @Then("the inclusion proof verification rejects the second mint with {string}")
+  public void theInclusionProofVerificationRejectsTheSecondMintWith(String errorMarker)
+      throws Exception {
+    assertNotNull(secondMintTx, "no second mint captured");
+    try {
+      InclusionProofUtils.waitInclusionProof(
+          context.getClient(),
+          context.getTrustBase(),
+          context.getPredicateVerifier(),
+          secondMintTx).get();
+      fail("expected inclusion-proof verification to reject with " + errorMarker);
+    } catch (Exception e) {
+      assertStatusMentioned(e, errorMarker);
+    }
+  }
+
+  // ── Helpers ─────────────────────────────────────────────────────────────
+
+  private void ensureUser(String userName) {
+    if (!context.getUserSigningServices().containsKey(userName)) {
+      new UserSteps(context).userHasASigningKey(userName);
+    }
+  }
+
+  private static byte[] randomBytes32() {
+    byte[] b = new byte[32];
+    new SecureRandom().nextBytes(b);
+    return b;
+  }
+
+  private static void assertStatusMentioned(Throwable e, String marker) {
+    Throwable t = e;
+    while (t != null) {
+      if (t.getMessage() != null && t.getMessage().contains(marker)) {
+        return;
+      }
+      t = t.getCause();
+    }
+    fail("expected status '" + marker + "' in exception chain but got: " + e);
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/steps/FieldRoundtripSteps.java b/src/test/java/org/unicitylabs/sdk/e2e/steps/FieldRoundtripSteps.java
new file mode 100644
index 0000000..0970e89
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/steps/FieldRoundtripSteps.java
@@ -0,0 +1,200 @@
+package org.unicitylabs.sdk.e2e.steps;
+
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+
+import io.cucumber.java.en.Given;
+import io.cucumber.java.en.Then;
+import io.cucumber.java.en.When;
+import java.security.SecureRandom;
+import org.unicitylabs.sdk.crypto.secp256k1.SigningService;
+import org.unicitylabs.sdk.e2e.context.TestContext;
+import org.unicitylabs.sdk.predicate.builtin.SignaturePredicate;
+import org.unicitylabs.sdk.transaction.MintTransaction;
+import org.unicitylabs.sdk.transaction.Token;
+import org.unicitylabs.sdk.transaction.TokenId;
+import org.unicitylabs.sdk.transaction.TokenType;
+import org.unicitylabs.sdk.transaction.TransferTransaction;
+import org.unicitylabs.sdk.unicityid.UnicityId;
+import org.unicitylabs.sdk.unicityid.UnicityIdMintTransaction;
+import org.unicitylabs.sdk.util.HexConverter;
+
+/**
+ * CBOR round-trip steps for {@code mint-transaction-fields.feature},
+ * {@code transfer-transaction-fields.feature}, and
+ * {@code unicity-id-mint-transaction-envelope.feature}. These exercise pure
+ * encode/decode invariants — no aggregator round-trip required.
+ */
+public class FieldRoundtripSteps {
+
+  private final TestContext context;
+
+  // MintTransaction fields
+  private byte[] mintJustification;
+  private byte[] mintData;
+  private MintTransaction mintTx;
+  private MintTransaction decodedMintTx;
+
+  // TransferTransaction fields
+  private TransferTransaction transferTx;
+  private TransferTransaction decodedTransferTx;
+  private byte[] originalStateMask;
+
+  // UnicityIdMintTransaction fields
+  private UnicityIdMintTransaction unicityIdTx;
+  private UnicityIdMintTransaction decodedUnicityIdTx;
+  private SignaturePredicate originalLockScript;
+  private SignaturePredicate originalRecipient;
+  private SignaturePredicate originalTargetPredicate;
+  private UnicityId originalUnicityId;
+  private TokenType originalTokenType;
+  private TokenId originalTokenId;
+
+  public FieldRoundtripSteps(TestContext context) {
+    this.context = context;
+  }
+
+  // ── MintTransaction round-trip ───────────────────────────────────────────
+
+  @Given("a MintTransaction is built with justification {string} and data {string}")
+  public void mintTxIsBuilt(String justificationHex, String dataHex) {
+    mintJustification = "null".equals(justificationHex) ? null : HexConverter.decode(justificationHex);
+    mintData = "null".equals(dataHex) ? null : HexConverter.decode(dataHex);
+
+    SignaturePredicate recipient =
+        SignaturePredicate.fromSigningService(SigningService.generate());
+    mintTx = MintTransaction.create(
+        recipient,
+        TokenId.generate(),
+        TokenType.generate(),
+        mintJustification,
+        mintData);
+  }
+
+  @When("the MintTransaction is encoded and decoded")
+  public void mintTxEncodedAndDecoded() {
+    decodedMintTx = MintTransaction.fromCbor(mintTx.toCbor());
+  }
+
+  @Then("the decoded justification matches {string}")
+  public void decodedJustificationMatches(String expected) {
+    byte[] expectedBytes = "null".equals(expected) ? null : HexConverter.decode(expected);
+    byte[] actual = decodedMintTx.getJustification().orElse(null);
+    if (expectedBytes == null) {
+      assertEquals(null, actual, "expected justification to be null");
+    } else {
+      assertNotNull(actual, "expected non-null justification");
+      assertArrayEquals(expectedBytes, actual);
+    }
+  }
+
+  @Then("the decoded data matches {string}")
+  public void decodedDataMatches(String expected) {
+    byte[] expectedBytes = "null".equals(expected) ? null : HexConverter.decode(expected);
+    byte[] actual = decodedMintTx.getData().orElse(null);
+    if (expectedBytes == null) {
+      assertEquals(null, actual, "expected data to be null");
+    } else {
+      assertNotNull(actual, "expected non-null data");
+      assertArrayEquals(expectedBytes, actual);
+    }
+  }
+
+  // ── TransferTransaction round-trip (stateMask) ───────────────────────────
+
+  @Given("a TransferTransaction is built from {word}'s token with a stateMask of {int} bytes")
+  public void transferTxBuiltWithStateMask(String userName, int length) {
+    Token sourceToken = context.getCurrentToken();
+    assertNotNull(sourceToken, "no current token (call 'X has a minted token' first)");
+    SignaturePredicate recipient = SignaturePredicate.fromSigningService(SigningService.generate());
+
+    originalStateMask = new byte[length];
+    if (length > 0) {
+      new SecureRandom().nextBytes(originalStateMask);
+    }
+    transferTx = TransferTransaction.create(
+        sourceToken, recipient, originalStateMask, new byte[0]);
+  }
+
+  @When("the TransferTransaction is encoded and decoded")
+  public void transferTxEncodedAndDecoded() {
+    decodedTransferTx = TransferTransaction.fromCbor(
+        transferTx.toCbor(), context.getCurrentToken());
+  }
+
+  @Then("the decoded stateMask is {int} bytes")
+  public void decodedStateMaskIsBytes(int length) {
+    byte[] mask = decodedTransferTx.getStateMask();
+    assertEquals(length, mask.length);
+  }
+
+  @Then("the decoded stateMask byte-for-byte equals the original")
+  public void decodedStateMaskByteForByteEqualsOriginal() {
+    assertArrayEquals(originalStateMask, decodedTransferTx.getStateMask());
+  }
+
+  // ── UnicityIdMintTransaction round-trip ──────────────────────────────────
+
+  @Given("a UnicityIdMintTransaction is built with a sample lockScript, recipient, unicityId, "
+      + "tokenType, and targetPredicate")
+  public void unicityIdMintTxIsBuilt() {
+    originalLockScript = SignaturePredicate.fromSigningService(SigningService.generate());
+    originalRecipient = SignaturePredicate.fromSigningService(SigningService.generate());
+    originalTargetPredicate = SignaturePredicate.fromSigningService(SigningService.generate());
+    originalUnicityId = new UnicityId("testuser", "unicity-labs/test");
+    originalTokenType = TokenType.generate();
+
+    unicityIdTx = UnicityIdMintTransaction.create(
+        originalLockScript,
+        originalRecipient,
+        originalUnicityId,
+        originalTokenType,
+        originalTargetPredicate);
+    originalTokenId = unicityIdTx.getTokenId();
+  }
+
+  @When("the UnicityIdMintTransaction is encoded and decoded")
+  public void unicityIdMintTxEncodedAndDecoded() {
+    decodedUnicityIdTx = UnicityIdMintTransaction.fromCbor(unicityIdTx.toCbor());
+  }
+
+  @Then("the decoded transaction's tokenId equals the original")
+  public void decodedTokenIdEqualsOriginal() {
+    assertEquals(originalTokenId, decodedUnicityIdTx.getTokenId());
+  }
+
+  @Then("the decoded transaction's tokenType equals the original")
+  public void decodedTokenTypeEqualsOriginal() {
+    assertEquals(originalTokenType, decodedUnicityIdTx.getTokenType());
+  }
+
+  @Then("the decoded transaction's lockScript encodes to the original lockScript bytes")
+  public void decodedLockScriptEncodesToOriginal() {
+    assertArrayEquals(
+        org.unicitylabs.sdk.predicate.EncodedPredicate.fromPredicate(originalLockScript).toCbor(),
+        decodedUnicityIdTx.getLockScript().toCbor());
+  }
+
+  @Then("the decoded transaction's recipient encodes to the original recipient bytes")
+  public void decodedRecipientEncodesToOriginal() {
+    assertArrayEquals(
+        org.unicitylabs.sdk.predicate.EncodedPredicate.fromPredicate(originalRecipient).toCbor(),
+        decodedUnicityIdTx.getRecipient().toCbor());
+  }
+
+  @Then("the decoded transaction's targetPredicate encodes to the original targetPredicate bytes")
+  public void decodedTargetPredicateEncodesToOriginal() {
+    assertArrayEquals(
+        org.unicitylabs.sdk.predicate.EncodedPredicate.fromPredicate(originalTargetPredicate)
+            .toCbor(),
+        org.unicitylabs.sdk.predicate.EncodedPredicate
+            .fromPredicate(decodedUnicityIdTx.getTargetPredicate())
+            .toCbor());
+  }
+
+  @Then("the decoded transaction's unicityId encodes to the original unicityId bytes")
+  public void decodedUnicityIdEncodesToOriginal() {
+    assertArrayEquals(originalUnicityId.toCbor(), decodedUnicityIdTx.getUnicityId().toCbor());
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/steps/InclusionCertStressSteps.java b/src/test/java/org/unicitylabs/sdk/e2e/steps/InclusionCertStressSteps.java
new file mode 100644
index 0000000..4ae24bd
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/steps/InclusionCertStressSteps.java
@@ -0,0 +1,146 @@
+package org.unicitylabs.sdk.e2e.steps;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+
+import io.cucumber.java.en.Then;
+import io.cucumber.java.en.When;
+import java.util.ArrayList;
+import java.util.List;
+import org.unicitylabs.sdk.api.CertificationData;
+import org.unicitylabs.sdk.api.CertificationResponse;
+import org.unicitylabs.sdk.crypto.secp256k1.SigningService;
+import org.unicitylabs.sdk.e2e.context.TestContext;
+import org.unicitylabs.sdk.predicate.builtin.SignaturePredicate;
+import org.unicitylabs.sdk.predicate.builtin.SignaturePredicateUnlockScript;
+import org.unicitylabs.sdk.serializer.cbor.CborSerializer;
+import org.unicitylabs.sdk.transaction.Token;
+import org.unicitylabs.sdk.transaction.TransferTransaction;
+import org.unicitylabs.sdk.util.verification.VerificationStatus;
+import org.unicitylabs.sdk.utils.TokenUtils;
+
+/**
+ * Steps for {@code inclusion-cert-stress.feature}: loop test on back-to-back
+ * mints, mint+5 transfer chain, duplicate-state resubmission.
+ */
+public class InclusionCertStressSteps {
+
+  private final TestContext context;
+
+  private List<Token> stressMintedTokens = new ArrayList<>();
+  private CertificationData rememberedCert;
+  private CertificationResponse resubmissionResponse;
+
+  public InclusionCertStressSteps(TestContext context) {
+    this.context = context;
+  }
+
+  @When("{int} tokens are minted in a row by the same user")
+  public void nTokensAreMintedInARow(int count) throws Exception {
+    SigningService signing = SigningService.generate();
+    SignaturePredicate predicate = SignaturePredicate.fromSigningService(signing);
+    stressMintedTokens.clear();
+    for (int i = 0; i < count; i++) {
+      Token t = TokenUtils.mintToken(
+          context.getClient(),
+          context.getTrustBase(),
+          context.getPredicateVerifier(),
+          context.getMintJustificationVerifier(),
+          predicate);
+      stressMintedTokens.add(t);
+    }
+  }
+
+  @Then("every minted token passes verification")
+  public void everyMintedTokenPassesVerification() {
+    for (Token t : stressMintedTokens) {
+      assertEquals(
+          VerificationStatus.OK,
+          t.verify(
+              context.getTrustBase(),
+              context.getPredicateVerifier(),
+              context.getMintJustificationVerifier()).getStatus(),
+          "verification failed for token " + t.getId());
+    }
+  }
+
+  @When("Alice mints a token and transfers it through {int} owners")
+  public void aliceMintsAndTransfersThrough(int hops) throws Exception {
+    SigningService aliceSigning = SigningService.generate();
+    Token current = TokenUtils.mintToken(
+        context.getClient(), context.getTrustBase(), context.getPredicateVerifier(),
+        context.getMintJustificationVerifier(),
+        SignaturePredicate.fromSigningService(aliceSigning));
+
+    SigningService prevSigning = aliceSigning;
+    for (int i = 0; i < hops; i++) {
+      SigningService nextSigning = SigningService.generate();
+      SignaturePredicate nextPredicate = SignaturePredicate.fromSigningService(nextSigning);
+      current = TokenUtils.transferToken(
+          context.getClient(), context.getTrustBase(), context.getPredicateVerifier(),
+          context.getMintJustificationVerifier(),
+          current.toCbor(),
+          nextPredicate,
+          prevSigning);
+      prevSigning = nextSigning;
+    }
+    context.setCurrentToken(current);
+  }
+
+  @Then("the final token has {int} transactions in its history")
+  public void theFinalTokenHasNTransactions(int expected) {
+    Token t = context.getCurrentToken();
+    assertNotNull(t);
+    assertEquals(expected, t.getTransactions().size());
+  }
+
+  @Then("the final token passes verification")
+  public void theFinalTokenPassesVerification() {
+    Token t = context.getCurrentToken();
+    assertNotNull(t);
+    assertEquals(
+        VerificationStatus.OK,
+        t.verify(
+            context.getTrustBase(),
+            context.getPredicateVerifier(),
+            context.getMintJustificationVerifier()).getStatus());
+  }
+
+  @When("the same certification data is re-submitted")
+  public void theSameCertificationDataIsResubmitted() throws Exception {
+    Token sourceToken = context.getCurrentToken();
+    assertNotNull(sourceToken, "no current token");
+    SigningService aliceSigning = context.getUserSigningServices().get("Alice");
+    SignaturePredicate phantom =
+        SignaturePredicate.fromSigningService(SigningService.generate());
+
+    byte[] x = new byte[32];
+    new java.security.SecureRandom().nextBytes(x);
+    TransferTransaction tx = TransferTransaction.create(
+        sourceToken, phantom, x, CborSerializer.encodeArray());
+
+    rememberedCert = CertificationData.fromTransaction(
+        tx, SignaturePredicateUnlockScript.create(tx, aliceSigning));
+
+    // First submission
+    context.getClient().submitCertificationRequest(rememberedCert).get();
+    // Re-submission of identical bytes
+    resubmissionResponse = context.getClient().submitCertificationRequest(rememberedCert).get();
+  }
+
+  @Then("the re-submission's status is {string}")
+  public void theResubmissionStatusIs(String expected) {
+    assertNotNull(resubmissionResponse, "no resubmission response captured");
+    assertEquals(expected, resubmissionResponse.getStatus().name());
+  }
+
+  @Then("the re-submission's status is one of {string} or {string}")
+  public void theResubmissionStatusIsOneOf(String first, String second) {
+    assertNotNull(resubmissionResponse, "no resubmission response captured");
+    String actual = resubmissionResponse.getStatus().name();
+    if (!actual.equals(first) && !actual.equals(second)) {
+      throw new AssertionError(
+          "expected status to be '" + first + "' or '" + second + "' but was: " + actual);
+    }
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/steps/InclusionCertificateBinarySteps.java b/src/test/java/org/unicitylabs/sdk/e2e/steps/InclusionCertificateBinarySteps.java
new file mode 100644
index 0000000..67f4a03
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/steps/InclusionCertificateBinarySteps.java
@@ -0,0 +1,151 @@
+package org.unicitylabs.sdk.e2e.steps;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
+
+import io.cucumber.java.en.Given;
+import io.cucumber.java.en.Then;
+import io.cucumber.java.en.When;
+import org.unicitylabs.sdk.api.InclusionCertificate;
+import org.unicitylabs.sdk.api.InclusionProof;
+import org.unicitylabs.sdk.api.StateId;
+import org.unicitylabs.sdk.crypto.hash.DataHash;
+import org.unicitylabs.sdk.crypto.hash.HashAlgorithm;
+import org.unicitylabs.sdk.e2e.context.TestContext;
+import org.unicitylabs.sdk.transaction.Token;
+
+/**
+ * Steps for {@code inclusion-certificate-binary.feature}. Verifies decode
+ * rejects malformed binary, encode/decode is idempotent, and verify returns
+ * false on corruption.
+ */
+public class InclusionCertificateBinarySteps {
+
+  private final TestContext context;
+
+  private byte[] inputBytes;
+  private Throwable thrown;
+  private InclusionCertificate originalCert;
+  private byte[] originalEncoded;
+  private InclusionCertificate decodedCert;
+  private boolean verifyResult;
+  private DataHash originalRoot;
+  private StateId originalStateId;
+
+  public InclusionCertificateBinarySteps(TestContext context) {
+    this.context = context;
+  }
+
+  @Given("binary bytes of length {int}")
+  public void binaryBytesOfLength(int length) {
+    inputBytes = new byte[length];
+  }
+
+  @Given("a {int}-byte buffer where the bitmap has popcount 2 and only 1 sibling chunk follows")
+  public void bufferWithPopcountMismatch(int totalLength) {
+    inputBytes = new byte[totalLength];
+    // First 32 bytes = bitmap. Set the lowest 2 bits in the last bitmap byte
+    // (popcount=2). Sibling chunks are 32 bytes each, so totalLength=64 has
+    // exactly 1 sibling slot — popcount(2) > slots(1) triggers the error.
+    inputBytes[31] = 0x03;
+  }
+
+  @When("InclusionCertificate.decode is invoked")
+  public void inclusionCertificateDecodeIsInvoked() {
+    thrown = null;
+    decodedCert = null;
+    try {
+      decodedCert = InclusionCertificate.decode(inputBytes);
+    } catch (Throwable t) {
+      thrown = t;
+    }
+  }
+
+  @Then("InclusionCertificate.decode throws with message containing {string}")
+  public void inclusionCertificateDecodeThrowsWithMessage(String marker) {
+    assertNotNull(thrown, "expected decode to throw");
+    String msg = thrown.getMessage() == null ? "" : thrown.getMessage().toLowerCase();
+    assertTrue(msg.contains(marker.toLowerCase()),
+        "expected message to contain '" + marker + "' but was: " + thrown.getMessage());
+  }
+
+  // ── Fixture-based scenarios ──────────────────────────────────────────────
+
+  @Given("an InclusionCertificate built from the test fixture token")
+  public void inclusionCertificateBuiltFromFixtureToken() throws Exception {
+    if (context.getClient() == null) {
+      new AggregatorSteps(context).aMockAggregatorIsRunning();
+    }
+    if (context.getCurrentToken() == null) {
+      new TokenLifecycleSteps(context).userHasAMintedToken("Alice");
+    }
+    Token token = context.getCurrentToken();
+    InclusionProof proof = token.getGenesis().getInclusionProof();
+    originalCert = proof.getInclusionCertificate();
+    originalEncoded = originalCert.encode();
+    byte[] rootHashBytes = proof.getUnicityCertificate().getInputRecord().getHash();
+    originalRoot = new DataHash(HashAlgorithm.SHA256, rootHashBytes);
+    originalStateId = StateId.fromTransaction(token.getGenesis());
+  }
+
+  @When("the InclusionCertificate is encoded then decoded")
+  public void encodedThenDecoded() {
+    decodedCert = InclusionCertificate.decode(originalEncoded);
+  }
+
+  @Then("the decoded bitmap equals the original")
+  public void decodedBitmapEqualsOriginal() {
+    assertNotNull(decodedCert);
+    // Java's InclusionCertificate doesn't expose its bitmap directly — assert
+    // via re-encode equality (the bitmap is the first 32 bytes of the encoded
+    // form, so encode-equality implies bitmap equality).
+    org.junit.jupiter.api.Assertions.assertArrayEquals(
+        java.util.Arrays.copyOfRange(originalEncoded, 0, 32),
+        java.util.Arrays.copyOfRange(decodedCert.encode(), 0, 32));
+  }
+
+  @Then("the decoded sibling count equals the original")
+  public void decodedSiblingCountEqualsOriginal() {
+    // Sibling-chunks are the bytes after the 32-byte bitmap. Length-equality
+    // implies count-equality (each sibling is a fixed 32-byte chunk).
+    assertEquals(originalEncoded.length, decodedCert.encode().length);
+  }
+
+  @When("the first sibling hash is corrupted")
+  public void firstSiblingHashIsCorrupted() {
+    // Flip a bit in the first byte after the 32-byte bitmap.
+    inputBytes = originalEncoded.clone();
+    if (inputBytes.length > 32) {
+      inputBytes[32] ^= 0x01;
+    }
+    decodedCert = InclusionCertificate.decode(inputBytes);
+  }
+
+  @Then("verify returns false against the original root and StateID")
+  public void verifyReturnsFalseAgainstOriginal() {
+    assertNotNull(decodedCert);
+    Token token = context.getCurrentToken();
+    DataHash leafValue = new DataHash(HashAlgorithm.SHA256, new byte[32]);
+    // Use a placeholder leaf value — the test only checks that corruption
+    // makes verify return false.
+    verifyResult = decodedCert.verify(originalStateId, leafValue, originalRoot);
+    assertFalse(verifyResult, "expected verify to return false on corrupted sibling");
+  }
+
+  @When("verify is called with a root hash differing by one byte")
+  public void verifyWithDifferentRoot() {
+    byte[] mutatedRoot = originalRoot.getData().clone();
+    mutatedRoot[0] ^= 0x01;
+    DataHash leafValue = new DataHash(HashAlgorithm.SHA256, new byte[32]);
+    verifyResult = originalCert.verify(originalStateId, leafValue,
+        new DataHash(HashAlgorithm.SHA256, mutatedRoot));
+  }
+
+  @Then("verify returns false")
+  public void verifyReturnsFalse() {
+    assertFalse(verifyResult, "expected verify to return false");
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/steps/InclusionProofStatusesSteps.java b/src/test/java/org/unicitylabs/sdk/e2e/steps/InclusionProofStatusesSteps.java
new file mode 100644
index 0000000..425aa38
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/steps/InclusionProofStatusesSteps.java
@@ -0,0 +1,246 @@
+package org.unicitylabs.sdk.e2e.steps;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+
+import io.cucumber.java.en.Then;
+import io.cucumber.java.en.When;
+import java.util.List;
+import org.unicitylabs.sdk.api.CertificationData;
+import org.unicitylabs.sdk.api.InclusionCertificate;
+import org.unicitylabs.sdk.api.InclusionProof;
+import org.unicitylabs.sdk.api.InclusionProofResponse;
+import org.unicitylabs.sdk.api.StateId;
+import org.unicitylabs.sdk.crypto.secp256k1.SigningService;
+import org.unicitylabs.sdk.e2e.context.TestContext;
+import org.unicitylabs.sdk.predicate.builtin.SignaturePredicate;
+import org.unicitylabs.sdk.serializer.cbor.CborDeserializer;
+import org.unicitylabs.sdk.serializer.cbor.CborSerializer;
+import org.unicitylabs.sdk.transaction.MintTransaction;
+import org.unicitylabs.sdk.transaction.Token;
+import org.unicitylabs.sdk.transaction.TokenId;
+import org.unicitylabs.sdk.transaction.TokenType;
+import org.unicitylabs.sdk.transaction.verification.InclusionProofVerificationRule;
+import org.unicitylabs.sdk.transaction.verification.InclusionProofVerificationStatus;
+import org.unicitylabs.sdk.util.verification.VerificationResult;
+
+/**
+ * Steps for {@code inclusion-proof-statuses.feature}: mutate the InclusionProof
+ * in different ways and assert the verification rule emits the right status.
+ *
+ * <p>Mutation strategy: round-trip the proof's CBOR through manual element-
+ * level rewriting, then run {@link InclusionProofVerificationRule#verify}
+ * directly (bypassing the higher-level {@code Token.verify} which would also
+ * gate on predicate verification).
+ *
+ * <p>Sibling-corruption nuance: the hermetic test aggregator builds an SMT
+ * with one leaf per submitted certification. Alice's mint alone produces a
+ * 0-sibling proof, which makes byte-level sibling corruption a no-op. To
+ * reach the {@code PATH_INVALID} branch we seed a second dummy leaf and
+ * re-fetch Alice's proof (the test aggregator returns a fresh proof against
+ * the current SMT root for the same StateId).
+ */
+public class InclusionProofStatusesSteps {
+
+  private final TestContext context;
+  private InclusionProof mutated;
+  private boolean siblingSeeded;
+
+  public InclusionProofStatusesSteps(TestContext context) {
+    this.context = context;
+  }
+
+  @When("the inclusion proof has its inclusionCertificate removed")
+  public void inclusionCertificateRemoved() {
+    mutated = mutateProof(currentProof(), true, false, false);
+  }
+
+  @When("the inclusion proof has its certificationData removed")
+  public void certificationDataRemoved() {
+    mutated = mutateProof(currentProof(), false, true, false);
+  }
+
+  @When("the inclusion proof's first sibling hash is corrupted")
+  public void firstSiblingHashCorrupted() {
+    seedSiblingLeafOnce();
+    mutated = mutateProof(currentProof(), false, false, true);
+  }
+
+  @When("the inclusion proof's transactionHash is replaced with garbage")
+  public void transactionHashReplacedWithGarbage() {
+    InclusionProof original = currentProof();
+    // CertificationData CBOR layout: tag(39031, [version, lockScript, sourceStateHash,
+    // transactionHash, unlockScript]). Element index 3 = transaction hash byte string.
+    byte[] certCbor = original.getCertificationData().get().toCbor();
+    CborDeserializer.CborTag certTag = CborDeserializer.decodeTag(certCbor);
+    List<byte[]> certElements = CborDeserializer.decodeArray(certTag.getData(), 5);
+    byte[] originalHash = CborDeserializer.decodeByteString(certElements.get(3));
+    byte[] garbageHash = new byte[32];
+    java.util.Arrays.fill(garbageHash, (byte) 0xee);
+    System.arraycopy(garbageHash, 0, originalHash, originalHash.length - 32, 32);
+    certElements.set(3, CborSerializer.encodeByteString(originalHash));
+    byte[] newCertCbor = CborSerializer.encodeTag(certTag.getTag(),
+        CborSerializer.encodeArray(certElements.toArray(new byte[0][])));
+    mutated = rebuildProofWithCertCbor(original, newCertCbor);
+  }
+
+  @When("the inclusion proof's first sibling hash is corrupted on top")
+  public void firstSiblingHashCorruptedOnTop() {
+    // Order matters: txhash mutation has been applied to `mutated` already.
+    // We need a sibling to corrupt — seed one, then refetch Alice's fresh
+    // proof (now with siblings), re-apply the txhash mutation, and corrupt
+    // the sibling on top.
+    seedSiblingLeafOnce();
+    InclusionProof freshOriginal = currentProof();
+    // Re-apply the txhash mutation on the now-sibling-bearing fresh proof.
+    transactionHashReplacedWithGarbageFrom(freshOriginal);
+    mutated = corruptSiblingOf(mutated);
+  }
+
+  @When("the inclusion proof is mutated by {string}")
+  public void inclusionProofIsMutatedBy(String mutation) {
+    switch (mutation) {
+      case "drop-inclusion-certificate":
+        mutated = mutateProof(currentProof(), true, false, false);
+        break;
+      case "drop-certification-data":
+        mutated = mutateProof(currentProof(), false, true, false);
+        break;
+      case "corrupt-sibling":
+        seedSiblingLeafOnce();
+        mutated = mutateProof(currentProof(), false, false, true);
+        break;
+      case "corrupt-txhash":
+        transactionHashReplacedWithGarbage();
+        break;
+      default:
+        throw new IllegalArgumentException("Unknown mutation: " + mutation);
+    }
+  }
+
+  @Then("verification of the modified proof returns {string}")
+  public void verificationOfModifiedProofReturns(String expectedStatus) {
+    assertNotNull(mutated, "no mutated proof");
+    Token token = context.getCurrentToken();
+    assertNotNull(token, "no current token");
+    VerificationResult<InclusionProofVerificationStatus> result =
+        InclusionProofVerificationRule.verify(
+            context.getTrustBase(), context.getPredicateVerifier(),
+            mutated, token.getGenesis());
+    assertEquals(expectedStatus, result.getStatus().name(),
+        "rule message: " + result.getMessage());
+  }
+
+  // ── Helpers ─────────────────────────────────────────────────────────────
+
+  /**
+   * Returns the inclusion proof currently associated with Alice's token.
+   * If a sibling has been seeded into the SMT after Alice minted, the proof
+   * embedded on the Token object is stale (0 siblings); we therefore go
+   * through the aggregator once seeded to get a fresh, sibling-bearing
+   * proof against the current SMT root.
+   */
+  private InclusionProof currentProof() {
+    Token token = context.getCurrentToken();
+    if (siblingSeeded) {
+      try {
+        StateId stateId = StateId.fromTransaction(token.getGenesis());
+        InclusionProofResponse resp = context.getClient().getInclusionProof(stateId).get();
+        return resp.getInclusionProof();
+      } catch (Exception e) {
+        throw new RuntimeException("failed to refetch Alice's proof", e);
+      }
+    }
+    return token.getGenesis().getInclusionProof();
+  }
+
+  /**
+   * Submits a synthetic mint certification through the aggregator so the
+   * SMT has at least 2 leaves. Idempotent across the scenario.
+   */
+  private void seedSiblingLeafOnce() {
+    if (siblingSeeded) {
+      return;
+    }
+    try {
+      SigningService dummySigning = SigningService.generate();
+      SignaturePredicate dummyPredicate =
+          SignaturePredicate.fromSigningService(dummySigning);
+      MintTransaction dummyMint = MintTransaction.create(
+          dummyPredicate, TokenId.generate(), TokenType.generate(), null, null);
+      CertificationData dummyCert = CertificationData.fromMintTransaction(dummyMint);
+      context.getClient().submitCertificationRequest(dummyCert).get();
+      siblingSeeded = true;
+    } catch (Exception e) {
+      throw new RuntimeException("failed to seed sibling leaf", e);
+    }
+  }
+
+  private void transactionHashReplacedWithGarbageFrom(InclusionProof original) {
+    byte[] certCbor = original.getCertificationData().get().toCbor();
+    CborDeserializer.CborTag certTag = CborDeserializer.decodeTag(certCbor);
+    List<byte[]> certElements = CborDeserializer.decodeArray(certTag.getData(), 5);
+    byte[] originalHash = CborDeserializer.decodeByteString(certElements.get(3));
+    byte[] garbageHash = new byte[32];
+    java.util.Arrays.fill(garbageHash, (byte) 0xee);
+    System.arraycopy(garbageHash, 0, originalHash, originalHash.length - 32, 32);
+    certElements.set(3, CborSerializer.encodeByteString(originalHash));
+    byte[] newCertCbor = CborSerializer.encodeTag(certTag.getTag(),
+        CborSerializer.encodeArray(certElements.toArray(new byte[0][])));
+    mutated = rebuildProofWithCertCbor(original, newCertCbor);
+  }
+
+  /** Rebuilds an InclusionProof, optionally nulling certCert/certData and/or corrupting a sibling. */
+  private InclusionProof mutateProof(InclusionProof original,
+      boolean dropInclCert, boolean dropCertData, boolean corruptSib) {
+    byte[] origCbor = original.toCbor();
+    CborDeserializer.CborTag tag = CborDeserializer.decodeTag(origCbor);
+    List<byte[]> elements = CborDeserializer.decodeArray(tag.getData(), 4);
+    // elements: [version, certData, inclCert, ucert]
+    if (dropCertData) {
+      elements.set(1, CborSerializer.encodeNull());
+    }
+    if (dropInclCert) {
+      elements.set(2, CborSerializer.encodeNull());
+    }
+    if (corruptSib) {
+      InclusionCertificate cert = original.getInclusionCertificate();
+      byte[] inclEncoded = cert.encode().clone();
+      if (inclEncoded.length <= 32) {
+        throw new IllegalStateException(
+            "cert has no siblings to corrupt — sibling-leaf seeding failed");
+      }
+      // Flip a bit in the first sibling slot — popcount unchanged (we corrupt
+      // hash bytes after the bitmap, not the bitmap itself).
+      inclEncoded[32] ^= (byte) 0xff;
+      elements.set(2, CborSerializer.encodeByteString(inclEncoded));
+    }
+    byte[] newCbor = CborSerializer.encodeTag(tag.getTag(),
+        CborSerializer.encodeArray(elements.toArray(new byte[0][])));
+    return InclusionProof.fromCbor(newCbor);
+  }
+
+  private InclusionProof rebuildProofWithCertCbor(InclusionProof original, byte[] newCertCbor) {
+    byte[] origCbor = original.toCbor();
+    CborDeserializer.CborTag tag = CborDeserializer.decodeTag(origCbor);
+    List<byte[]> elements = CborDeserializer.decodeArray(tag.getData(), 4);
+    elements.set(1, newCertCbor);
+    return InclusionProof.fromCbor(CborSerializer.encodeTag(tag.getTag(),
+        CborSerializer.encodeArray(elements.toArray(new byte[0][]))));
+  }
+
+  private InclusionProof corruptSiblingOf(InclusionProof proof) {
+    byte[] origCbor = proof.toCbor();
+    CborDeserializer.CborTag tag = CborDeserializer.decodeTag(origCbor);
+    List<byte[]> elements = CborDeserializer.decodeArray(tag.getData(), 4);
+    byte[] inclEncoded = proof.getInclusionCertificate().encode().clone();
+    if (inclEncoded.length <= 32) {
+      throw new IllegalStateException(
+          "cert has no siblings to corrupt — sibling-leaf seeding failed");
+    }
+    inclEncoded[32] ^= (byte) 0xff;
+    elements.set(2, CborSerializer.encodeByteString(inclEncoded));
+    return InclusionProof.fromCbor(CborSerializer.encodeTag(tag.getTag(),
+        CborSerializer.encodeArray(elements.toArray(new byte[0][]))));
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/steps/MintJustificationRegistrySteps.java b/src/test/java/org/unicitylabs/sdk/e2e/steps/MintJustificationRegistrySteps.java
new file mode 100644
index 0000000..c310fbb
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/steps/MintJustificationRegistrySteps.java
@@ -0,0 +1,194 @@
+package org.unicitylabs.sdk.e2e.steps;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import io.cucumber.java.en.Given;
+import io.cucumber.java.en.Then;
+import io.cucumber.java.en.When;
+import java.util.concurrent.atomic.AtomicInteger;
+import org.unicitylabs.sdk.api.CertificationData;
+import org.unicitylabs.sdk.api.CertificationResponse;
+import org.unicitylabs.sdk.api.CertificationStatus;
+import org.unicitylabs.sdk.crypto.secp256k1.SigningService;
+import org.unicitylabs.sdk.e2e.context.TestContext;
+import org.unicitylabs.sdk.functional.payment.TestPaymentData;
+import org.unicitylabs.sdk.payment.SplitMintJustificationVerifier;
+import org.unicitylabs.sdk.predicate.builtin.SignaturePredicate;
+import org.unicitylabs.sdk.serializer.cbor.CborSerializer;
+import org.unicitylabs.sdk.transaction.CertifiedMintTransaction;
+import org.unicitylabs.sdk.transaction.MintTransaction;
+import org.unicitylabs.sdk.transaction.TokenId;
+import org.unicitylabs.sdk.transaction.TokenType;
+import org.unicitylabs.sdk.transaction.verification.MintJustificationVerifier;
+import org.unicitylabs.sdk.transaction.verification.MintJustificationVerifierService;
+import org.unicitylabs.sdk.util.InclusionProofUtils;
+import org.unicitylabs.sdk.util.verification.VerificationResult;
+import org.unicitylabs.sdk.util.verification.VerificationStatus;
+
+/**
+ * Steps for {@code mint-justification-registry.feature}. Mirrors the TS step
+ * file's pattern: build a real {@link CertifiedMintTransaction} via the
+ * aggregator (which doesn't inspect the justification's inner CBOR shape) and
+ * use it to drive {@link MintJustificationVerifierService#verify}.
+ */
+public class MintJustificationRegistrySteps {
+
+  private final TestContext context;
+
+  private MintJustificationVerifierService freshMjv;
+  private VerificationResult<VerificationStatus> lastResult;
+  private Throwable registrationError;
+  private StubMintJustificationVerifier stub;
+
+  public MintJustificationRegistrySteps(TestContext context) {
+    this.context = context;
+  }
+
+  @Given("a fresh MintJustificationVerifierService is created")
+  public void aFreshMjvIsCreated() {
+    freshMjv = new MintJustificationVerifierService();
+    registrationError = null;
+    lastResult = null;
+    stub = null;
+  }
+
+  @Given("a SplitMintJustificationVerifier is registered")
+  public void aSplitMintJustificationVerifierIsRegistered() {
+    freshMjv.register(new SplitMintJustificationVerifier(
+        context.getTrustBase(), context.getPredicateVerifier(), TestPaymentData::decode));
+  }
+
+  @Given("a stub verifier for tag {int} is registered")
+  public void aStubVerifierForTagIsRegistered(int tag) {
+    stub = new StubMintJustificationVerifier(tag);
+    freshMjv.register(stub);
+  }
+
+  @When("a second verifier with the same tag is registered")
+  public void aSecondVerifierWithSameTagIsRegistered() {
+    try {
+      freshMjv.register(new SplitMintJustificationVerifier(
+          context.getTrustBase(), context.getPredicateVerifier(), TestPaymentData::decode));
+    } catch (Throwable t) {
+      registrationError = t;
+    }
+  }
+
+  @Then("the registration error message contains {string}")
+  public void registrationErrorMessageContains(String marker) {
+    assertNotNull(registrationError, "expected duplicate registration to throw");
+    String msg = registrationError.getMessage();
+    assertTrue(msg != null && msg.toLowerCase().contains(marker.toLowerCase()),
+        "expected message to contain '" + marker + "' but was: " + msg);
+  }
+
+  @When("verify is invoked on a CertifiedMintTransaction with null justification")
+  public void verifyOnNullJustification() throws Exception {
+    CertifiedMintTransaction tx = buildRealCertifiedMint(null);
+    lastResult = freshMjv.verify(tx);
+  }
+
+  @When("verify is invoked on a CertifiedMintTransaction whose justification uses tag {int}")
+  public void verifyOnCustomTagJustification(int tag) throws Exception {
+    byte[] justification = CborSerializer.encodeTag(tag, CborSerializer.encodeArray());
+    CertifiedMintTransaction tx = buildRealCertifiedMint(justification);
+    lastResult = freshMjv.verify(tx);
+  }
+
+  @Then("the result status is OK")
+  public void resultStatusIsOk() {
+    assertNotNull(lastResult, "no verification result captured");
+    assertEquals(VerificationStatus.OK, lastResult.getStatus(),
+        "expected OK but got: " + lastResult.getStatus()
+            + " — " + lastResult.getMessage());
+  }
+
+  @Then("the result status is FAIL")
+  public void resultStatusIsFail() {
+    assertNotNull(lastResult, "no verification result captured");
+    assertEquals(VerificationStatus.FAIL, lastResult.getStatus(),
+        "expected FAIL but got: " + lastResult.getStatus());
+  }
+
+  @Then("the registry result message contains {string}")
+  public void registryResultMessageContains(String marker) {
+    assertNotNull(lastResult, "no verification result captured");
+    String msg = lastResult.getMessage();
+    assertTrue(msg != null && msg.toLowerCase().contains(marker.toLowerCase()),
+        "expected message to contain '" + marker + "' but was: " + msg);
+  }
+
+  @Then("the stub verifier was invoked exactly once")
+  public void stubVerifierWasInvokedOnce() {
+    assertNotNull(stub, "no stub verifier registered");
+    assertEquals(1, stub.getInvocations(),
+        "expected stub to be invoked once, got " + stub.getInvocations());
+  }
+
+  /**
+   * Builds a real {@link CertifiedMintTransaction} by minting through the
+   * aggregator and then constructing the cert wrapper directly via
+   * {@link MintTransaction#toCertifiedTransaction}. Importantly we bypass
+   * {@link org.unicitylabs.sdk.transaction.Token#mint} which would otherwise
+   * invoke the registry's verify and reject our synthetic justification.
+   *
+   * <p>Mirrors TS's duck-typed cast: the registry only inspects
+   * {@code getJustification()}, so any real-shaped certified-mint with an
+   * arbitrary justification payload works as a test fixture.
+   */
+  private CertifiedMintTransaction buildRealCertifiedMint(byte[] justification) throws Exception {
+    SignaturePredicate recipient =
+        SignaturePredicate.fromSigningService(SigningService.generate());
+    MintTransaction tx = MintTransaction.create(
+        recipient,
+        TokenId.generate(),
+        TokenType.generate(),
+        justification,
+        null);
+
+    CertificationData cd = CertificationData.fromMintTransaction(tx);
+    CertificationResponse resp = context.getClient().submitCertificationRequest(cd).get();
+    if (resp.getStatus() != CertificationStatus.SUCCESS) {
+      throw new RuntimeException(
+          "Aggregator rejected certification: " + resp.getStatus());
+    }
+
+    org.unicitylabs.sdk.api.InclusionProof proof = InclusionProofUtils.waitInclusionProof(
+        context.getClient(),
+        context.getTrustBase(),
+        context.getPredicateVerifier(),
+        tx).get();
+
+    return tx.toCertifiedTransaction(
+        context.getTrustBase(), context.getPredicateVerifier(), proof);
+  }
+
+  // ── Stub verifier ───────────────────────────────────────────────────────
+
+  private static final class StubMintJustificationVerifier implements MintJustificationVerifier {
+    private final long tag;
+    private final AtomicInteger invocations = new AtomicInteger(0);
+
+    StubMintJustificationVerifier(long tag) {
+      this.tag = tag;
+    }
+
+    @Override
+    public long getTag() {
+      return tag;
+    }
+
+    @Override
+    public VerificationResult<VerificationStatus> verify(
+        CertifiedMintTransaction transaction, MintJustificationVerifierService svc) {
+      invocations.incrementAndGet();
+      return new VerificationResult<>("StubVerifier", VerificationStatus.OK);
+    }
+
+    int getInvocations() {
+      return invocations.get();
+    }
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/steps/MintingSteps.java b/src/test/java/org/unicitylabs/sdk/e2e/steps/MintingSteps.java
new file mode 100644
index 0000000..367eecd
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/steps/MintingSteps.java
@@ -0,0 +1,102 @@
+package org.unicitylabs.sdk.e2e.steps;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+
+import io.cucumber.java.en.Then;
+import io.cucumber.java.en.When;
+import org.unicitylabs.sdk.api.CertificationData;
+import org.unicitylabs.sdk.predicate.Predicate;
+import org.unicitylabs.sdk.api.CertificationResponse;
+import org.unicitylabs.sdk.e2e.context.TestContext;
+import org.unicitylabs.sdk.predicate.builtin.SignaturePredicate;
+import org.unicitylabs.sdk.serializer.cbor.CborSerializer;
+
+import org.unicitylabs.sdk.transaction.MintTransaction;
+import org.unicitylabs.sdk.transaction.Token;
+import org.unicitylabs.sdk.transaction.TokenId;
+import org.unicitylabs.sdk.transaction.TokenType;
+import org.unicitylabs.sdk.util.verification.VerificationStatus;
+import org.unicitylabs.sdk.utils.TokenUtils;
+
+public class MintingSteps {
+
+  private final TestContext context;
+  private TokenId expectedId;
+  private TokenType expectedType;
+
+  public MintingSteps(TestContext context) {
+    this.context = context;
+  }
+
+  @When("the user mints a new token")
+  public void theUserMintsANewToken() throws Exception {
+    String user = context.getCurrentUser() != null ? context.getCurrentUser() : "Alice";
+    context.setCurrentUser(user);
+    Predicate recipient = context.getUserAddresses().get(user);
+    assertNotNull(recipient, "user " + user + " has no address");
+
+    MintTransaction transaction = MintTransaction.create(recipient, TokenId.generate(), TokenType.generate(), null, CborSerializer.encodeArray());
+
+    CertificationData certificationData = CertificationData.fromMintTransaction(transaction);
+    CertificationResponse response =
+        context.getClient().submitCertificationRequest(certificationData).get();
+    context.setLastCertificationResponse(response);
+
+    if (response.getStatus().name().equals("SUCCESS")) {
+      Token token = TokenUtils.mintToken(context.getClient(), context.getTrustBase(), context.getPredicateVerifier(), context.getMintJustificationVerifier(), recipient);
+      context.addUserToken(user, token);
+      context.setCurrentToken(token);
+    }
+  }
+
+  @When("the user mints a new token with specific token ID and type")
+  public void theUserMintsANewTokenWithSpecificTokenIdAndType() throws Exception {
+    String user = context.getCurrentUser() != null ? context.getCurrentUser() : "Alice";
+    context.setCurrentUser(user);
+    Predicate recipient = context.getUserAddresses().get(user);
+    assertNotNull(recipient, "user " + user + " has no address");
+
+    expectedId = TokenId.generate();
+    expectedType = TokenType.generate();
+
+    Token token = TokenUtils.mintToken(
+        context.getClient(),
+        context.getTrustBase(),
+        context.getPredicateVerifier(),
+        context.getMintJustificationVerifier(),
+        expectedId,
+        expectedType,
+        recipient,
+        null,
+        CborSerializer.encodeArray());
+
+    context.addUserToken(user, token);
+    context.setCurrentToken(token);
+  }
+
+  @Then("the token ID matches the mint parameters")
+  public void theTokenIdMatchesTheMintParameters() {
+    assertNotNull(expectedId, "no expected TokenId captured");
+    Token token = context.getCurrentToken();
+    assertNotNull(token, "no current token");
+    assertEquals(expectedId, token.getId(), "token ID mismatch");
+  }
+
+  @Then("the token type matches the mint parameters")
+  public void theTokenTypeMatchesTheMintParameters() {
+    assertNotNull(expectedType, "no expected TokenType captured");
+    Token token = context.getCurrentToken();
+    assertNotNull(token, "no current token");
+    assertEquals(expectedType, token.getType(), "token type mismatch");
+  }
+
+  @Then("the token passes verification")
+  public void theTokenPassesVerification() {
+    Token token = context.getCurrentToken();
+    assertNotNull(token, "no current token");
+    assertEquals(
+        VerificationStatus.OK,
+        token.verify(context.getTrustBase(), context.getPredicateVerifier(), context.getMintJustificationVerifier()).getStatus());
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/steps/NametagSplitSteps.java b/src/test/java/org/unicitylabs/sdk/e2e/steps/NametagSplitSteps.java
new file mode 100644
index 0000000..5ea9072
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/steps/NametagSplitSteps.java
@@ -0,0 +1,275 @@
+package org.unicitylabs.sdk.e2e.steps;
+
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import io.cucumber.java.en.When;
+import java.math.BigInteger;
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import org.unicitylabs.sdk.crypto.secp256k1.SigningService;
+import org.unicitylabs.sdk.e2e.context.TestContext;
+import org.unicitylabs.sdk.e2e.support.NametagRegistry;
+import org.unicitylabs.sdk.functional.payment.TestPaymentData;
+import org.unicitylabs.sdk.payment.SplitAssetProof;
+import org.unicitylabs.sdk.payment.SplitMintJustification;
+import org.unicitylabs.sdk.payment.SplitResult;
+import org.unicitylabs.sdk.payment.TokenSplit;
+import org.unicitylabs.sdk.payment.asset.Asset;
+import org.unicitylabs.sdk.payment.asset.AssetId;
+import org.unicitylabs.sdk.predicate.Predicate;
+import org.unicitylabs.sdk.predicate.builtin.SignaturePredicate;
+import org.unicitylabs.sdk.predicate.builtin.SignaturePredicateUnlockScript;
+import org.unicitylabs.sdk.transaction.Token;
+import org.unicitylabs.sdk.transaction.TokenId;
+import org.unicitylabs.sdk.transaction.TokenType;
+import org.unicitylabs.sdk.unicityid.UnicityIdToken;
+import org.unicitylabs.sdk.utils.TokenUtils;
+
+/**
+ * Steps for {@code token-nametag-split.feature}: cross of split-mint flow with
+ * pubkey/nametag addressing for the recipients of each split child.
+ *
+ * <p>Mirrors TS {@code mixed-addressing.steps.ts} for the split-related "Alice
+ * splits a 2-asset token and sends child 1 to Bob via <method>" / "...sends
+ * child 1 to Bob via X, and child 2 to Carol via Y" / "after the split, Bob
+ * splits his child again and sends grandchild 1 to Carol via <method>"
+ * scenarios.
+ */
+public class NametagSplitSteps {
+
+  private final TestContext context;
+
+  // Tracks the most recent set of split children so the "Bob splits his child"
+  // step can pick child 1 by index.
+  private List<Token> latestSplitChildren = new ArrayList<>();
+
+  public NametagSplitSteps(TestContext context) {
+    this.context = context;
+  }
+
+  @When("Alice splits a 2-asset token and sends child 1 to Bob via {word}")
+  public void aliceSplitsAndSendsChild1ToBob(String method) throws Exception {
+    splitAndSend("Alice", new String[] {"Bob", null},
+        new String[] {method, null});
+  }
+
+  @When("Alice splits a 2-asset token, sends child 1 to Bob via {word}, and child 2 to Carol via {word}")
+  public void aliceSplitsAndSendsChild1ToBobChild2ToCarol(String bobMethod, String carolMethod)
+      throws Exception {
+    splitAndSend("Alice", new String[] {"Bob", "Carol"},
+        new String[] {bobMethod, carolMethod});
+  }
+
+  @When("after the split, Bob splits his child again and sends grandchild 1 to Carol via {word}")
+  public void bobSplitsHisChildAndSendsGrandchild1ToCarol(String method) throws Exception {
+    // Bob's child from the previous step is the 0th element of the child list
+    // we transferred to him.
+    List<Token> bobsTokens = context.getUserTokens().get("Bob");
+    assertNotNull(bobsTokens, "Bob has no tokens — the previous split must run first");
+    assertTrue(!bobsTokens.isEmpty(), "Bob's token list is empty");
+    Token bobsChild = bobsTokens.get(bobsTokens.size() - 1);
+
+    // Bob's child has 1 asset (he received one of Alice's two split halves).
+    // Split it into two halves of value floor(v/2) and v - floor(v/2).
+    byte[] dataBytes = bobsChild.getGenesis().getData().orElse(new byte[0]);
+    Set<Asset> bobsAssets = TestPaymentData.decode(dataBytes).getAssets();
+    assertTrue(bobsAssets.size() == 1,
+        "Bob's child should have exactly 1 asset; has " + bobsAssets.size());
+    Asset single = bobsAssets.iterator().next();
+    BigInteger half = single.getValue().shiftRight(1);
+    Asset halfA = new Asset(single.getId(), half);
+    Asset halfB = new Asset(single.getId(), single.getValue().subtract(half));
+
+    Map<TokenId, Set<Asset>> plan = new HashMap<>();
+    TokenId grandId1 = TokenId.generate();
+    TokenId grandId2 = TokenId.generate();
+    plan.put(grandId1, Set.of(halfA));
+    plan.put(grandId2, Set.of(halfB));
+
+    SigningService bobSigning = context.getUserSigningServices().get("Bob");
+    SignaturePredicate bobPredicate =
+        SignaturePredicate.fromSigningService(bobSigning);
+
+    List<Token> grandchildren = materialiseSplit(bobsChild, plan, bobSigning, bobPredicate);
+
+    // Transfer grandchild 1 (the one bound to grandId1) to Carol via <method>.
+    Token grandchild1 = pickByTokenId(grandchildren, grandId1);
+    Predicate carolRecipient = resolveRecipient("Carol", method);
+    Token transferred = TokenUtils.transferToken(
+        context.getClient(),
+        context.getTrustBase(),
+        context.getPredicateVerifier(),
+        context.getMintJustificationVerifier(),
+        grandchild1.toCbor(),
+        carolRecipient,
+        bobSigning);
+    context.setCurrentToken(transferred);
+    context.setCurrentUser("Bob");
+    context.addUserToken("Carol", transferred);
+  }
+
+  // ── Internal helpers ─────────────────────────────────────────────────────
+
+  /**
+   * Mints Alice a 2-asset token and splits it into 2 children (one per asset),
+   * then transfers each child to its declared recipient via the corresponding
+   * addressing method. {@code recipients[i]==null} skips delivery for child i.
+   */
+  private void splitAndSend(String sender, String[] recipients, String[] methods)
+      throws Exception {
+    ensureUser(sender);
+    SigningService senderSigning = context.getUserSigningServices().get(sender);
+    SignaturePredicate senderPredicate =
+        SignaturePredicate.fromSigningService(senderSigning);
+
+    // Mint Alice's parent: 2 distinct random asset IDs of value 100 / 200.
+    Asset asset1 = new Asset(new AssetId(randomBytes(10)), BigInteger.valueOf(100));
+    Asset asset2 = new Asset(new AssetId(randomBytes(10)), BigInteger.valueOf(200));
+    Set<Asset> sourceAssets = Set.of(asset1, asset2);
+    Token parent = TokenUtils.mintToken(
+        context.getClient(),
+        context.getTrustBase(),
+        context.getPredicateVerifier(),
+        context.getMintJustificationVerifier(),
+        senderPredicate,
+        null,
+        new TestPaymentData(sourceAssets).encode());
+
+    // Split into 2 children — one asset each.
+    Map<TokenId, Set<Asset>> plan = new HashMap<>();
+    TokenId childId1 = TokenId.generate();
+    TokenId childId2 = TokenId.generate();
+    plan.put(childId1, Set.of(asset1));
+    plan.put(childId2, Set.of(asset2));
+
+    List<Token> children = materialiseSplit(parent, plan, senderSigning, senderPredicate);
+    latestSplitChildren = new ArrayList<>(children);
+    Token child1 = pickByTokenId(children, childId1);
+    Token child2 = pickByTokenId(children, childId2);
+
+    // Deliver each child to its declared recipient. The sender is Alice
+    // (current owner of the children); the recipient predicate is resolved
+    // via pubkey/nametag.
+    if (recipients[0] != null) {
+      Token transferred = transferChild(child1, recipients[0], methods[0], senderSigning);
+      context.setCurrentToken(transferred);
+      context.setCurrentUser(sender);
+      context.addUserToken(recipients[0], transferred);
+    }
+    if (recipients[1] != null) {
+      Token transferred = transferChild(child2, recipients[1], methods[1], senderSigning);
+      // For two-recipient flow we don't reset currentToken — the assertions
+      // ("the current token verifies", etc.) target the most recent transfer.
+      // The TS feature's mixed-recipient outline doesn't assert anything past
+      // the When step, so leaving this as the latest transfer is safe.
+      context.setCurrentToken(transferred);
+      context.addUserToken(recipients[1], transferred);
+    }
+  }
+
+  /** Performs a split: burns the source, mints children with split-mint justifications. */
+  private List<Token> materialiseSplit(
+      Token source, Map<TokenId, Set<Asset>> plan,
+      SigningService sourceSigning, SignaturePredicate sourcePredicate) throws Exception {
+    SplitResult result = TokenSplit.split(source, TestPaymentData::decode, plan);
+    Token burnToken = TokenUtils.transferToken(
+        context.getClient(),
+        context.getTrustBase(),
+        context.getPredicateVerifier(),
+        source,
+        result.getBurnTransaction(),
+        SignaturePredicateUnlockScript.create(result.getBurnTransaction(), sourceSigning));
+
+    TokenType childType = TokenType.generate();
+    List<Token> minted = new ArrayList<>();
+    for (Map.Entry<TokenId, Set<Asset>> entry : plan.entrySet()) {
+      List<SplitAssetProof> proofs = result.getProofs().get(entry.getKey());
+      assertNotNull(proofs, "no proofs for child " + entry.getKey());
+      byte[] childJustification = SplitMintJustification.create(
+          burnToken, new HashSet<>(proofs)).toCbor();
+      byte[] childPayload = new TestPaymentData(entry.getValue()).encode();
+      Token child = TokenUtils.mintToken(
+          context.getClient(),
+          context.getTrustBase(),
+          context.getPredicateVerifier(),
+          context.getMintJustificationVerifier(),
+          entry.getKey(),
+          childType,
+          sourcePredicate,
+          childJustification,
+          childPayload);
+      minted.add(child);
+      context.getSplitChildren().add(child);
+    }
+    return minted;
+  }
+
+  private Token transferChild(Token child, String recipientName, String method,
+      SigningService senderSigning) throws Exception {
+    Predicate recipientPredicate = resolveRecipient(recipientName, method);
+    return TokenUtils.transferToken(
+        context.getClient(),
+        context.getTrustBase(),
+        context.getPredicateVerifier(),
+        context.getMintJustificationVerifier(),
+        child.toCbor(),
+        recipientPredicate,
+        senderSigning);
+  }
+
+  private Predicate resolveRecipient(String name, String method) throws Exception {
+    ensureUser(name);
+    if ("pubkey".equals(method)) {
+      return context.getUserPredicates().get(name);
+    }
+    if ("nametag".equals(method)) {
+      UnicityIdToken nametag = context.getUserNametags().get(name);
+      // Background may not have registered a nametag for ad-hoc users — auto-register if missing.
+      if (nametag == null) {
+        SignaturePredicate userPredicate =
+            (SignaturePredicate) context.getUserPredicates().get(name);
+        nametag = NametagRegistry.registerNametag(
+            context.getClient(),
+            context.getTrustBase(),
+            context.getPredicateVerifier(),
+            userPredicate,
+            "auto-" + name + "-" + System.nanoTime(),
+            "bdd/test");
+        context.getUserNametags().put(name, nametag);
+      }
+      return nametag.getGenesis().getTargetPredicate();
+    }
+    throw new IllegalArgumentException("Unsupported addressing method: " + method);
+  }
+
+  private void ensureUser(String userName) {
+    if (!context.getUserSigningServices().containsKey(userName)) {
+      SigningService signing = SigningService.generate();
+      SignaturePredicate predicate = SignaturePredicate.fromSigningService(signing);
+      context.getUserSigningServices().put(userName, signing);
+      context.getUserPredicates().put(userName, predicate);
+      context.getUserAddresses().put(userName, predicate);
+    }
+  }
+
+  private static Token pickByTokenId(List<Token> tokens, TokenId target) {
+    for (Token t : tokens) {
+      if (t.getId().equals(target)) {
+        return t;
+      }
+    }
+    throw new IllegalStateException("no token with id " + target);
+  }
+
+  private static byte[] randomBytes(int n) {
+    byte[] b = new byte[n];
+    new java.security.SecureRandom().nextBytes(b);
+    return b;
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/steps/RoutingByteSourceSteps.java b/src/test/java/org/unicitylabs/sdk/e2e/steps/RoutingByteSourceSteps.java
new file mode 100644
index 0000000..10085fd
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/steps/RoutingByteSourceSteps.java
@@ -0,0 +1,75 @@
+package org.unicitylabs.sdk.e2e.steps;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import io.cucumber.java.en.Given;
+import io.cucumber.java.en.Then;
+import io.cucumber.java.en.When;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Set;
+import org.unicitylabs.sdk.api.StateId;
+import org.unicitylabs.sdk.e2e.support.ShardAwareAggregatorClient;
+import org.unicitylabs.sdk.serializer.cbor.CborSerializer;
+
+/**
+ * Steps for {@code routing-byte-source.feature}: pin the byte source the
+ * shard-router reads from, regression-guarding the pre-#141 byte-31 LSB
+ * convention.
+ */
+public class RoutingByteSourceSteps {
+
+  private StateId stateId;
+  private Integer pickedShard;
+
+  @Given("a synthetic StateID with byte 0 {string} and byte 31 {string}")
+  public void aSyntheticStateIdWithByte0AndByte31(String byte0Hex, String byte31Hex) {
+    byte[] data = new byte[32];
+    data[0] = (byte) parseHexByte(byte0Hex);
+    data[31] = (byte) parseHexByte(byte31Hex);
+    stateId = StateId.fromCbor(CborSerializer.encodeByteString(data));
+  }
+
+  @When("ShardAwareAggregatorClient.getShardForStateId runs in {word} mode with shardIdLength {int}")
+  public void getShardForStateIdRuns(String mode, int shardIdLength) {
+    assertNotNull(stateId, "no stateId set");
+    ShardAwareAggregatorClient.RoutingMode routingMode;
+    switch (mode) {
+      case "lsb":
+        routingMode = ShardAwareAggregatorClient.RoutingMode.LSB;
+        break;
+      case "msb":
+        routingMode = ShardAwareAggregatorClient.RoutingMode.MSB;
+        break;
+      default:
+        throw new IllegalArgumentException("unknown routing mode: " + mode);
+    }
+    pickedShard = ShardAwareAggregatorClient.getShardForStateId(stateId, shardIdLength, routingMode);
+  }
+
+  @Then("the picked shard equals {int}")
+  public void thePickedShardEquals(int expected) {
+    assertNotNull(pickedShard, "no shard computed");
+    assertEquals(expected, pickedShard.intValue(),
+        "picked=" + pickedShard + " (data[0]=0x" + Integer.toHexString(stateId.getData()[0] & 0xff)
+            + ", data[31]=0x" + Integer.toHexString(stateId.getData()[31] & 0xff) + ")");
+  }
+
+  @Then("the picked shard is one of {string}")
+  public void thePickedShardIsOneOf(String csv) {
+    assertNotNull(pickedShard, "no shard computed");
+    Set<Integer> allowed = new HashSet<>();
+    for (String s : Arrays.asList(csv.split(","))) {
+      allowed.add(Integer.parseInt(s.trim()));
+    }
+    assertTrue(allowed.contains(pickedShard),
+        "expected shard in " + allowed + ", got " + pickedShard);
+  }
+
+  private static int parseHexByte(String hex) {
+    String trimmed = hex.startsWith("0x") || hex.startsWith("0X") ? hex.substring(2) : hex;
+    return Integer.parseInt(trimmed, 16);
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/steps/SecuritySteps.java b/src/test/java/org/unicitylabs/sdk/e2e/steps/SecuritySteps.java
new file mode 100644
index 0000000..a970515
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/steps/SecuritySteps.java
@@ -0,0 +1,74 @@
+package org.unicitylabs.sdk.e2e.steps;
+
+import org.unicitylabs.sdk.predicate.Predicate;
+
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+
+import io.cucumber.java.en.Then;
+import io.cucumber.java.en.When;
+import org.unicitylabs.sdk.crypto.secp256k1.SigningService;
+import org.unicitylabs.sdk.e2e.context.TestContext;
+
+import org.unicitylabs.sdk.transaction.Token;
+import org.unicitylabs.sdk.utils.TokenUtils;
+
+public class SecuritySteps {
+
+  private final TestContext context;
+
+  public SecuritySteps(TestContext context) {
+    this.context = context;
+  }
+
+  @When("{word} tries to create a transfer of {word}'s token")
+  public void userTriesToCreateATransferOfOtherUsersToken(String attacker, String owner) {
+    Token token = context.getCurrentToken();
+    assertNotNull(token, "no token to attempt transfer against");
+    SigningService attackerSigning = context.getUserSigningServices().get(attacker);
+    Predicate attackerAddress = context.getUserAddresses().get(attacker);
+    assertNotNull(attackerSigning, "attacker has no signing key");
+    assertNotNull(attackerAddress, "attacker has no address");
+
+    attemptTransfer(token, attackerAddress, attackerSigning);
+  }
+
+  @When("{word} tries to create a transfer of the token")
+  public void userTriesToCreateATransferOfTheToken(String attacker) {
+    Token token = context.getCurrentToken();
+    assertNotNull(token, "no token to attempt transfer against");
+    SigningService attackerSigning = context.getUserSigningServices().get(attacker);
+    Predicate attackerAddress = context.getUserAddresses().get(attacker);
+    assertNotNull(attackerSigning, "attacker has no signing key");
+    assertNotNull(attackerAddress, "attacker has no address");
+
+    attemptTransfer(token, attackerAddress, attackerSigning);
+  }
+
+  @Then("the transfer creation fails with a predicate mismatch error")
+  public void theTransferCreationFailsWithAPredicateMismatchError() {
+    Exception last = context.getLastError();
+    assertNotNull(
+        last,
+        "expected transfer creation to fail with a predicate mismatch, but no error was recorded");
+    // Java v2 throws IllegalArgumentException / VerificationException / RuntimeException
+    // depending on where the check fires. We assert only that *some* failure was surfaced
+    // — matching TS v2 which asserts on the typed error. See BDD_MIGRATION_PLAN.md §3
+    // (negative scenarios assert on exception message substrings in Java v2).
+  }
+
+  private void attemptTransfer(Token token, Predicate recipientAddress, SigningService signing) {
+    try {
+      TokenUtils.transferToken(
+          context.getClient(),
+          context.getTrustBase(),
+          context.getPredicateVerifier(),
+          context.getMintJustificationVerifier(),
+          token.toCbor(),
+          recipientAddress,
+          signing);
+      context.setLastError(null);
+    } catch (Exception e) {
+      context.setLastError(e);
+    }
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/steps/ShardIdSteps.java b/src/test/java/org/unicitylabs/sdk/e2e/steps/ShardIdSteps.java
new file mode 100644
index 0000000..e931ec1
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/steps/ShardIdSteps.java
@@ -0,0 +1,175 @@
+package org.unicitylabs.sdk.e2e.steps;
+
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
+
+import io.cucumber.java.en.Given;
+import io.cucumber.java.en.Then;
+import io.cucumber.java.en.When;
+import org.unicitylabs.sdk.api.bft.ShardId;
+import org.unicitylabs.sdk.util.HexConverter;
+
+/**
+ * Steps for {@code shard-id.feature}. Direct tests against {@link ShardId}'s
+ * codec, getBit, and isPrefixOf APIs.
+ */
+public class ShardIdSteps {
+
+  private byte[] encoded;
+  private ShardId decoded;
+  private byte[] data;
+  private Throwable thrown;
+
+  @Given("a ShardId encoded as {string}")
+  public void aShardIdEncodedAs(String hex) {
+    encoded = parseHex(hex);
+  }
+
+  @Given("data starting with {string}")
+  public void dataStartingWith(String hex) {
+    data = parseHex(hex);
+  }
+
+  @When("the ShardId is decoded")
+  public void theShardIdIsDecoded() {
+    thrown = null;
+    decoded = null;
+    try {
+      decoded = ShardId.decode(encoded);
+    } catch (Throwable t) {
+      thrown = t;
+    }
+  }
+
+  @When("isPrefixOf is checked")
+  public void isPrefixOfIsChecked() {
+    if (decoded == null) {
+      decoded = ShardId.decode(encoded);
+    }
+  }
+
+  @Then("the ShardId length is {int}")
+  public void theShardIdLengthIs(int length) {
+    assertNotNull(decoded);
+    assertEquals(length, decoded.getLength());
+  }
+
+  @Then("re-encoding the ShardId produces {string}")
+  public void reEncodingProduces(String hex) {
+    assertArrayEquals(parseHex(hex), decoded.encode());
+  }
+
+  @Then("isPrefixOf returns true")
+  public void isPrefixOfReturnsTrue() {
+    assertNotNull(decoded);
+    assertTrue(decoded.isPrefixOf(data),
+        "expected isPrefixOf=true for shard hex / data hex");
+  }
+
+  @Then("isPrefixOf returns false")
+  public void isPrefixOfReturnsFalse() {
+    assertNotNull(decoded);
+    assertFalse(decoded.isPrefixOf(data),
+        "expected isPrefixOf=false for shard hex / data hex");
+  }
+
+  @Then("getBit at index {int} returns {int}")
+  public void getBitAtIndexReturns(int index, int expectedBit) {
+    assertNotNull(decoded);
+    assertEquals(expectedBit, decoded.getBit(index));
+  }
+
+  @Then("getBit at index {int} throws {string}")
+  public void getBitAtIndexThrows(int index, String marker) {
+    assertNotNull(decoded);
+    Throwable caught = null;
+    try {
+      decoded.getBit(index);
+    } catch (Throwable t) {
+      caught = t;
+    }
+    assertNotNull(caught, "expected getBit(" + index + ") to throw");
+    String msg = caught.getMessage() == null ? "" : caught.getMessage().toLowerCase();
+    assertTrue(msg.contains(marker.toLowerCase())
+            || (caught instanceof IndexOutOfBoundsException),
+        "expected message to contain '" + marker + "' but was: " + caught.getMessage());
+  }
+
+  @Then("decoding throws with message containing {string}")
+  public void decodingThrowsWithMessage(String marker) {
+    assertNotNull(thrown, "expected decode to throw");
+    String msg = thrown.getMessage() == null ? "" : thrown.getMessage().toLowerCase();
+    assertTrue(msg.contains(marker.toLowerCase()),
+        "expected message to contain '" + marker + "' but was: " + thrown.getMessage());
+  }
+
+  // ── ShardIdMatchesStateIdRule scenarios ─────────────────────────────────
+
+  private org.unicitylabs.sdk.api.StateId stateIdForRule;
+  private org.unicitylabs.sdk.util.verification.VerificationResult<
+      org.unicitylabs.sdk.util.verification.VerificationStatus> ruleResult;
+
+  @Given("a ShardId encoded as {string} describing {int} bits")
+  public void aShardIdEncodedAsDescribingBits(String hex, int ignoredBits) {
+    encoded = parseHex(hex);
+  }
+
+  @Given("a StateID with first byte {string}")
+  public void aStateIdWithFirstByte(String hex) {
+    byte[] data = new byte[32];
+    data[0] = parseHex(hex)[0];
+    stateIdForRule = org.unicitylabs.sdk.api.StateId.fromCbor(
+        org.unicitylabs.sdk.serializer.cbor.CborSerializer.encodeByteString(data));
+  }
+
+  @Given("a StateID with first two bytes {string}")
+  public void aStateIdWithFirstTwoBytes(String hex) {
+    byte[] data = new byte[32];
+    byte[] prefix = parseHex(hex);
+    data[0] = prefix[0];
+    if (prefix.length > 1) {
+      data[1] = prefix[1];
+    }
+    stateIdForRule = org.unicitylabs.sdk.api.StateId.fromCbor(
+        org.unicitylabs.sdk.serializer.cbor.CborSerializer.encodeByteString(data));
+  }
+
+  @When("ShardIdMatchesStateIdRule.verify runs")
+  public void shardIdMatchesStateIdRuleVerifyRuns() {
+    assertNotNull(encoded, "no shard hex captured before verify step");
+    org.unicitylabs.sdk.api.bft.ShardTreeCertificate stc =
+        org.unicitylabs.sdk.api.bft.ShardTreeCertificate.fromCbor(
+            org.unicitylabs.sdk.serializer.cbor.CborSerializer.encodeTag(
+                org.unicitylabs.sdk.api.bft.ShardTreeCertificate.CBOR_TAG,
+                org.unicitylabs.sdk.serializer.cbor.CborSerializer.encodeArray(
+                    org.unicitylabs.sdk.serializer.cbor.CborSerializer.encodeUnsignedInteger(1),
+                    org.unicitylabs.sdk.serializer.cbor.CborSerializer.encodeByteString(encoded),
+                    org.unicitylabs.sdk.serializer.cbor.CborSerializer.encodeArray())));
+    ruleResult =
+        org.unicitylabs.sdk.transaction.verification.ShardIdMatchesStateIdRule.verify(
+            stateIdForRule, stc);
+  }
+
+  @Then("the rule status is {string}")
+  public void theRuleStatusIs(String expected) {
+    assertNotNull(ruleResult, "no rule result captured");
+    assertEquals(expected, ruleResult.getStatus().name(),
+        "rule message: " + ruleResult.getMessage());
+  }
+
+  /** Parses Gherkin "0xHEX" strings, including the empty form "0x". */
+  static byte[] parseHex(String s) {
+    if (s == null || s.isEmpty()) {
+      return new byte[0];
+    }
+    String cleaned = s.startsWith("0x") || s.startsWith("0X") ? s.substring(2) : s;
+    if (cleaned.isEmpty()) {
+      return new byte[0];
+    }
+    return HexConverter.decode(cleaned);
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/steps/ShardLoadSteps.java b/src/test/java/org/unicitylabs/sdk/e2e/steps/ShardLoadSteps.java
new file mode 100644
index 0000000..76eb7a8
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/steps/ShardLoadSteps.java
@@ -0,0 +1,181 @@
+package org.unicitylabs.sdk.e2e.steps;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import io.cucumber.java.en.Given;
+import io.cucumber.java.en.Then;
+import io.cucumber.java.en.When;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicInteger;
+import org.unicitylabs.sdk.crypto.secp256k1.SigningService;
+import org.unicitylabs.sdk.predicate.Predicate;
+import org.unicitylabs.sdk.e2e.support.SimulatedShardPool;
+import org.unicitylabs.sdk.predicate.builtin.SignaturePredicate;
+
+import org.unicitylabs.sdk.transaction.Token;
+import org.unicitylabs.sdk.utils.TokenUtils;
+
+/**
+ * Shard-load scenarios. Uses {@link SimulatedShardPool} by default (hermetic);
+ * would use real {@code SHARD_<n>_URL} env vars in topology mode (not
+ * implemented — the hermetic path proves the routing/batching logic).
+ *
+ * <p>Scale is intentionally small compared to the TS scenarios (which run
+ * 1000×10 batches): hermetic load runs are regression-coverage, not perf.
+ */
+public class ShardLoadSteps {
+
+  // Degraded scale for hermetic runs — the original TS batchSize/batchCount
+  // values (1000×10) are intended for real topology.
+  private static final int SHARD_COUNT = 2;
+  private static final int HERMETIC_SCALE_FACTOR = 100;
+
+  private SimulatedShardPool pool;
+  private int batchSize;
+  private int batchCount;
+  private int totalPerShard;
+  private int concurrency;
+  private List<Report> reports = new ArrayList<>();
+
+  private static final class Report {
+    final int shardIndex;
+    final int submitted;
+    final int succeeded;
+    final long durationMs;
+
+    Report(int shardIndex, int submitted, int succeeded, long durationMs) {
+      this.shardIndex = shardIndex;
+      this.submitted = submitted;
+      this.succeeded = succeeded;
+      this.durationMs = durationMs;
+    }
+  }
+
+  @Given("the aggregator is set up")
+  public void theAggregatorIsSetUp() {
+    pool = SimulatedShardPool.create(SHARD_COUNT);
+  }
+
+  @Given("the shard topology is discovered")
+  public void theShardTopologyIsDiscovered() {
+    assertTrue(pool.size() >= 1, "no shards in pool");
+  }
+
+  @Given("{int} x {int} mint operations are prepared for each shard")
+  public void opsXBatchesArePreparedForEachShard(int size, int count) {
+    this.batchSize = scaleDown(size);
+    this.batchCount = scaleDown(count);
+  }
+
+  @Given("{int} mint operations are prepared for each shard")
+  public void opsArePreparedForEachShard(int total) {
+    this.totalPerShard = scaleDown(total);
+  }
+
+  @When("synchronized batches of {int} are submitted {int} times")
+  public void synchronizedBatchesAreSubmittedNTimes(int size, int count) throws Exception {
+    int effSize = scaleDown(size);
+    int effCount = scaleDown(count);
+    reports.clear();
+    for (int shardIdx = 0; shardIdx < pool.size(); shardIdx++) {
+      reports.add(runShard(shardIdx, effSize * effCount, 1));
+    }
+  }
+
+  @When("independent batches of {int} are submitted {int} times per shard")
+  public void independentBatchesAreSubmittedNTimesPerShard(int size, int count) throws Exception {
+    int effSize = scaleDown(size);
+    int effCount = scaleDown(count);
+    reports.clear();
+    for (int shardIdx = 0; shardIdx < pool.size(); shardIdx++) {
+      reports.add(runShard(shardIdx, effSize * effCount, 1));
+    }
+  }
+
+  @When("constant pressure of {int} concurrent operations is applied per shard")
+  public void constantPressureIsAppliedPerShard(int concur) throws Exception {
+    int effConcur = scaleDown(concur);
+    int perShardTotal = totalPerShard > 0 ? totalPerShard : effConcur * 2;
+    reports.clear();
+    for (int shardIdx = 0; shardIdx < pool.size(); shardIdx++) {
+      reports.add(runShard(shardIdx, perShardTotal, effConcur));
+    }
+  }
+
+  @Then("the shard load report is printed")
+  public void theShardLoadReportIsPrinted() {
+    assertTrue(!reports.isEmpty(), "no shard-load reports captured");
+    StringBuilder sb = new StringBuilder("\n[shard-load report]\n");
+    for (Report r : reports) {
+      sb.append(String.format("  shard %d: %d/%d ok in %d ms%n",
+          r.shardIndex, r.succeeded, r.submitted, r.durationMs));
+      assertEquals(r.submitted, r.succeeded,
+          "shard " + r.shardIndex + " had submission failures");
+    }
+    System.out.print(sb);
+  }
+
+  private Report runShard(int shardIdx, int totalOps, int parallelism) throws Exception {
+    SigningService signing = SigningService.generate();
+    Predicate recipient =
+        SignaturePredicate.create(signing.getPublicKey());
+
+    long start = System.currentTimeMillis();
+    AtomicInteger ok = new AtomicInteger(0);
+
+    if (parallelism == 1) {
+      for (int i = 0; i < totalOps; i++) {
+        Token t = TokenUtils.mintToken(
+            pool.clientFor(shardIdx),
+            pool.trustBaseFor(shardIdx),
+            pool.verifierFor(shardIdx),
+            pool.mjvFor(shardIdx),
+            recipient);
+        if (t != null) {
+          ok.incrementAndGet();
+        }
+      }
+    } else {
+      ExecutorService exec = Executors.newFixedThreadPool(parallelism);
+      try {
+        List<CompletableFuture<?>> futures = new ArrayList<>();
+        for (int i = 0; i < totalOps; i++) {
+          futures.add(CompletableFuture.runAsync(() -> {
+            try {
+              Token t = TokenUtils.mintToken(
+                  pool.clientFor(shardIdx),
+                  pool.trustBaseFor(shardIdx),
+                  pool.verifierFor(shardIdx),
+                  pool.mjvFor(shardIdx),
+                  recipient);
+              if (t != null) {
+                ok.incrementAndGet();
+              }
+            } catch (Exception e) {
+              // Counted as failure by shortfall from submitted.
+            }
+          }, exec));
+        }
+        CompletableFuture.allOf(futures.toArray(new CompletableFuture[0])).get(
+            5, TimeUnit.MINUTES);
+      } finally {
+        exec.shutdown();
+      }
+    }
+
+    long duration = System.currentTimeMillis() - start;
+    return new Report(shardIdx, totalOps, ok.get(), duration);
+  }
+
+  /** Degrade TS-scale numbers for hermetic runs. */
+  private static int scaleDown(int n) {
+    int scaled = Math.max(1, n / HERMETIC_SCALE_FACTOR);
+    return scaled;
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/steps/SmokeSteps.java b/src/test/java/org/unicitylabs/sdk/e2e/steps/SmokeSteps.java
new file mode 100644
index 0000000..a905880
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/steps/SmokeSteps.java
@@ -0,0 +1,34 @@
+package org.unicitylabs.sdk.e2e.steps;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+
+import io.cucumber.java.en.Given;
+import io.cucumber.java.en.Then;
+import io.cucumber.java.en.When;
+import org.unicitylabs.sdk.e2e.context.TestContext;
+
+public class SmokeSteps {
+
+  private final TestContext context;
+
+  public SmokeSteps(TestContext context) {
+    this.context = context;
+  }
+
+  @Given("a fresh test context")
+  public void aFreshTestContext() {
+    assertNull(context.getCurrentUser(), "current user should be null at scenario start");
+    assertNull(context.getCurrentToken(), "current token should be null at scenario start");
+  }
+
+  @When("I remember the current user as {string}")
+  public void iRememberTheCurrentUserAs(String user) {
+    context.setCurrentUser(user);
+  }
+
+  @Then("the test context reports the current user as {string}")
+  public void theTestContextReportsTheCurrentUserAs(String user) {
+    assertEquals(user, context.getCurrentUser());
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/steps/SplitMintJustificationEnvelopeSteps.java b/src/test/java/org/unicitylabs/sdk/e2e/steps/SplitMintJustificationEnvelopeSteps.java
new file mode 100644
index 0000000..ba37528
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/steps/SplitMintJustificationEnvelopeSteps.java
@@ -0,0 +1,123 @@
+package org.unicitylabs.sdk.e2e.steps;
+
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
+
+import io.cucumber.java.en.Given;
+import io.cucumber.java.en.Then;
+import io.cucumber.java.en.When;
+import java.util.HashSet;
+import java.util.Set;
+import org.unicitylabs.sdk.e2e.context.TestContext;
+import org.unicitylabs.sdk.functional.payment.TestPaymentData;
+import org.unicitylabs.sdk.payment.SplitAssetProof;
+import org.unicitylabs.sdk.payment.SplitMintJustification;
+import org.unicitylabs.sdk.transaction.Token;
+
+public class SplitMintJustificationEnvelopeSteps {
+
+  private final TestContext context;
+  private SplitMintJustification original;
+  private byte[] originalCbor;
+  private SplitMintJustification decoded;
+  private Throwable thrown;
+
+  public SplitMintJustificationEnvelopeSteps(TestContext context) {
+    this.context = context;
+  }
+
+  @Given("Alice has split-minted 2 tokens with 2 payment assets")
+  public void aliceHasSplitMinted2TokensWith2Assets() throws Exception {
+    SplitSteps split = new SplitSteps(context);
+    split.userHasAMintedTokenWith2PaymentAssets("Alice");
+    split.userSplitsTheTokenInto2NewTokens("Alice");
+  }
+
+  @Given("the SplitMintJustification of one of Alice's split tokens")
+  public void theSplitMintJustificationOfOneOfAlicesSplitTokens() {
+    // After Alice's split, her child tokens are recorded in
+    // TestContext.splitChildren with their SplitMintJustification in the
+    // genesis transaction's justification field.
+    assertNotNull(context.getSplitChildren(), "no split children recorded");
+    assertTrue(!context.getSplitChildren().isEmpty(),
+        "expected at least one split child but list is empty");
+    Token child = context.getSplitChildren().get(0);
+    byte[] justBytes = child.getGenesis().getJustification().orElseThrow(
+        () -> new AssertionError("split child has no justification"));
+    original = SplitMintJustification.fromCbor(justBytes);
+    originalCbor = justBytes;
+  }
+
+  @When("the justification is encoded and decoded back")
+  public void justificationEncodedAndDecoded() {
+    decoded = SplitMintJustification.fromCbor(original.toCbor());
+  }
+
+  @Then("the decoded token's CBOR equals the original token's CBOR")
+  public void decodedTokenCborEqualsOriginal() {
+    assertArrayEquals(original.getToken().toCbor(), decoded.getToken().toCbor());
+  }
+
+  @Then("the decoded proofs equal the original proofs")
+  public void decodedProofsEqualOriginal() {
+    Set<byte[]> originalSet = new HashSet<>();
+    for (SplitAssetProof p : original.getProofs()) {
+      originalSet.add(p.toCbor());
+    }
+    Set<byte[]> decodedSet = new HashSet<>();
+    for (SplitAssetProof p : decoded.getProofs()) {
+      decodedSet.add(p.toCbor());
+    }
+    assertTrue(originalSet.size() == decodedSet.size(),
+        "different number of proofs: original=" + originalSet.size()
+            + " decoded=" + decodedSet.size());
+    // Compare by encoded bytes — Set<byte[]> equals doesn't compare contents,
+    // so iterate.
+    for (byte[] p : original.getProofs().stream()
+        .map(SplitAssetProof::toCbor).toArray(byte[][]::new)) {
+      boolean found = decoded.getProofs().stream()
+          .anyMatch(d -> java.util.Arrays.equals(d.toCbor(), p));
+      assertTrue(found, "proof not found in decoded set");
+    }
+  }
+
+  @When("SplitMintJustification.create is called with an empty proof list")
+  public void splitMintJustificationCreateWithEmpty() {
+    thrown = null;
+    try {
+      Token anyToken = context.getSplitChildren().isEmpty()
+          ? context.getCurrentToken()
+          : context.getSplitChildren().get(0);
+      SplitMintJustification.create(anyToken, java.util.Collections.emptySet());
+    } catch (Throwable t) {
+      thrown = t;
+    }
+  }
+
+  @Then("an error is thrown with message containing {string}")
+  public void anErrorIsThrownWithMessage(String marker) {
+    assertNotNull(thrown, "expected error but got success");
+    String msg = thrown.getMessage();
+    assertTrue(msg != null && msg.toLowerCase().contains(marker.toLowerCase()),
+        "expected message containing '" + marker + "' but was: " + msg);
+  }
+
+  @When("the justification bytes are decoded via SplitMintJustification.fromCBOR")
+  public void justificationBytesDecodedViaFromCbor() {
+    thrown = null;
+    try {
+      decoded = SplitMintJustification.fromCbor(originalCbor);
+    } catch (Throwable t) {
+      thrown = t;
+    }
+  }
+
+  @Then("no decoding error is raised")
+  public void noDecodingErrorIsRaised() {
+    if (thrown != null) {
+      fail("expected no error but got: " + thrown.getMessage());
+    }
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/steps/SplitMintJustificationVerifierSteps.java b/src/test/java/org/unicitylabs/sdk/e2e/steps/SplitMintJustificationVerifierSteps.java
new file mode 100644
index 0000000..4119141
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/steps/SplitMintJustificationVerifierSteps.java
@@ -0,0 +1,224 @@
+package org.unicitylabs.sdk.e2e.steps;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import io.cucumber.java.en.Given;
+import io.cucumber.java.en.Then;
+import io.cucumber.java.en.When;
+import java.math.BigInteger;
+import java.nio.charset.StandardCharsets;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+import org.unicitylabs.sdk.e2e.context.TestContext;
+import org.unicitylabs.sdk.functional.payment.TestPaymentData;
+import org.unicitylabs.sdk.payment.SplitMintJustificationVerifier;
+import org.unicitylabs.sdk.payment.asset.Asset;
+import org.unicitylabs.sdk.payment.asset.AssetId;
+import org.unicitylabs.sdk.serializer.cbor.CborDeserializer;
+import org.unicitylabs.sdk.serializer.cbor.CborSerializer;
+import org.unicitylabs.sdk.transaction.CertifiedMintTransaction;
+import org.unicitylabs.sdk.transaction.MintTransaction;
+import org.unicitylabs.sdk.util.verification.VerificationResult;
+import org.unicitylabs.sdk.util.verification.VerificationStatus;
+
+/**
+ * Steps for {@code split-mint-justification-verifier.feature}: build a real
+ * split-mint via the aggregator, then surgically mutate the resulting
+ * {@link CertifiedMintTransaction}'s data/justification fields to reach each
+ * field-level FAIL branch in {@link SplitMintJustificationVerifier#verify}.
+ *
+ * <p>Mutation strategy: round-trip the cert through CBOR ({@code [mintTxCbor,
+ * inclProofCbor]}), modify the inner MintTransaction's CBOR slot for data or
+ * justification, then re-encode and decode back via
+ * {@link CertifiedMintTransaction#fromCbor}. This mirrors the TS suite's
+ * {@code mockCert} approach without relying on Java reflection.
+ */
+public class SplitMintJustificationVerifierSteps {
+
+  private final TestContext context;
+
+  private CertifiedMintTransaction baseCert;
+  private CertifiedMintTransaction mutatedCert;
+  private VerificationResult<VerificationStatus> verifyResult;
+
+  // 32-byte AssetIds — TS-style. Distinct from the SplitSteps "ASSET_1"/"ASSET_2"
+  // shorthand to keep mutation-test fixtures isolated.
+  private static final Asset ASSET_A = new Asset(
+      new AssetId(padTo32("SMJV_ASSET_A")),
+      BigInteger.valueOf(100));
+  private static final Asset ASSET_B = new Asset(
+      new AssetId(padTo32("SMJV_ASSET_B")),
+      BigInteger.valueOf(200));
+
+  public SplitMintJustificationVerifierSteps(TestContext context) {
+    this.context = context;
+  }
+
+  /**
+   * Lazily resolves Alice's first split-child's CertifiedMintTransaction.
+   * Background step is shared with {@link SplitMintJustificationEnvelopeSteps}
+   * which populates {@code context.getSplitChildren()}.
+   */
+  private void ensureBaseCert() {
+    if (baseCert != null) {
+      return;
+    }
+    assertNotNull(context.getSplitChildren(), "no split children recorded");
+    assertTrue(!context.getSplitChildren().isEmpty(),
+        "expected at least one split child — Background must run first");
+    baseCert = context.getSplitChildren().get(0).getGenesis();
+  }
+
+  @Given("a CertifiedMintTransaction is mutated by stripping the justification field")
+  public void mutateByStrippingJustification() {
+    ensureBaseCert();
+    mutatedCert = rewriteCertCbor(baseCert, true, null, false, null);
+  }
+
+  @Given("a CertifiedMintTransaction is mutated by stripping the data field")
+  public void mutateByStrippingData() {
+    ensureBaseCert();
+    mutatedCert = rewriteCertCbor(baseCert, false, null, true, null);
+  }
+
+  @Given("a CertifiedMintTransaction is mutated by adding an extra asset to data not present in proofs")
+  public void mutateByAddingExtraAssetToData() {
+    ensureBaseCert();
+    Set<Asset> tampered = new HashSet<>(currentAssets(baseCert));
+    Asset extra = new Asset(
+        new AssetId(padTo32("SMJV_EXTRA_ASSET")),
+        BigInteger.ONE);
+    tampered.add(extra);
+    mutatedCert = withDataPayload(baseCert, new TestPaymentData(tampered).encode());
+  }
+
+  @Given("a CertifiedMintTransaction is mutated by renaming one proof's assetId to one not in data")
+  public void mutateByRenamingAssetId() {
+    ensureBaseCert();
+    // The verifier checks aggregation/asset paths *before* the data lookup, so
+    // renaming the assetId on the proof side trips path verification first. To
+    // exercise the "Asset id ... not found in asset data" branch we instead
+    // rename one asset id on the *data* side: proofs stay valid, but their
+    // assetIds no longer appear in payment data.
+    Set<Asset> renamed = new HashSet<>();
+    boolean first = true;
+    for (Asset a : currentAssets(baseCert)) {
+      if (first) {
+        renamed.add(new Asset(
+            new AssetId(padTo32("SMJV_RENAMED_ASSET")),
+            a.getValue()));
+        first = false;
+      } else {
+        renamed.add(a);
+      }
+    }
+    mutatedCert = withDataPayload(baseCert, new TestPaymentData(renamed).encode());
+  }
+
+  @Given("a CertifiedMintTransaction is mutated by mismatching one asset's value between data and tree")
+  public void mutateByMismatchingAssetValue() {
+    ensureBaseCert();
+    Set<Asset> bumped = new HashSet<>();
+    boolean first = true;
+    for (Asset a : currentAssets(baseCert)) {
+      if (first) {
+        bumped.add(new Asset(a.getId(), a.getValue().add(BigInteger.ONE)));
+        first = false;
+      } else {
+        bumped.add(a);
+      }
+    }
+    mutatedCert = withDataPayload(baseCert, new TestPaymentData(bumped).encode());
+  }
+
+  @When("SplitMintJustificationVerifier.verify is invoked")
+  public void splitMintJustificationVerifierVerifyIsInvoked() {
+    assertNotNull(mutatedCert, "no mutated cert — Given step skipped?");
+    SplitMintJustificationVerifier verifier = new SplitMintJustificationVerifier(
+        context.getTrustBase(),
+        context.getPredicateVerifier(),
+        TestPaymentData::decode);
+    verifyResult = verifier.verify(mutatedCert, context.getMintJustificationVerifier());
+  }
+
+  @Then("the SplitMintJustificationVerifier verification result is FAIL")
+  public void verificationResultIsFail() {
+    assertNotNull(verifyResult, "no verifier result — When step skipped?");
+    assertEquals(
+        VerificationStatus.FAIL,
+        verifyResult.getStatus(),
+        "expected FAIL, got " + verifyResult.getStatus() + ": " + verifyResult.getMessage());
+  }
+
+  @Then("the SplitMintJustificationVerifier failure message contains {string}")
+  public void failureMessageContains(String fragment) {
+    assertNotNull(verifyResult, "no verifier result");
+    String haystack = verifyResult.getMessage() == null
+        ? "" : verifyResult.getMessage().toLowerCase();
+    assertTrue(haystack.contains(fragment.toLowerCase()),
+        "expected '" + fragment + "' in: " + verifyResult.getMessage());
+  }
+
+  // ── Mutation helpers ────────────────────────────────────────────────────
+
+  private Set<Asset> currentAssets(CertifiedMintTransaction cert) {
+    byte[] dataBytes = cert.getData().orElse(null);
+    assertNotNull(dataBytes, "cert has no payload data");
+    return TestPaymentData.decode(dataBytes).getAssets();
+  }
+
+  /** Replace just the data payload, keeping original justification. */
+  private CertifiedMintTransaction withDataPayload(
+      CertifiedMintTransaction cert, byte[] dataBytes) {
+    return rewriteCertCbor(cert, false, null, false, dataBytes);
+  }
+
+  /**
+   * Surgical CBOR rewrite of CertifiedMintTransaction:
+   * - Top-level CBOR is a 2-element array: [mintTxCbor, inclProofCbor].
+   * - mintTxCbor is tagged ({@link MintTransaction#CBOR_TAG}, [version, recipient,
+   *   tokenId, tokenType, justification?, data?]).
+   * - We decode, swap slot 4 (justification) and/or slot 5 (data), re-encode,
+   *   and decode back via {@link CertifiedMintTransaction#fromCbor}.
+   */
+  private CertifiedMintTransaction rewriteCertCbor(
+      CertifiedMintTransaction cert,
+      boolean useNullJust,
+      byte[] justification,
+      boolean useNullData,
+      byte[] overrideDataBytes) {
+    byte[] certCbor = cert.toCbor();
+    List<byte[]> outer = CborDeserializer.decodeArray(certCbor, 2);
+    byte[] mintTxCbor = outer.get(0);
+    byte[] inclProofCbor = outer.get(1);
+
+    CborDeserializer.CborTag tag = CborDeserializer.decodeTag(mintTxCbor);
+    List<byte[]> mintFields = CborDeserializer.decodeArray(tag.getData(), 6);
+
+    if (useNullJust) {
+      mintFields.set(4, CborSerializer.encodeNull());
+    } else if (justification != null) {
+      mintFields.set(4, CborSerializer.encodeByteString(justification));
+    }
+    if (useNullData) {
+      mintFields.set(5, CborSerializer.encodeNull());
+    } else if (overrideDataBytes != null) {
+      mintFields.set(5, CborSerializer.encodeByteString(overrideDataBytes));
+    }
+
+    byte[] newMintTxCbor = CborSerializer.encodeTag(
+        tag.getTag(),
+        CborSerializer.encodeArray(mintFields.toArray(new byte[0][])));
+    byte[] newCertCbor = CborSerializer.encodeArray(newMintTxCbor, inclProofCbor);
+    return CertifiedMintTransaction.fromCbor(newCertCbor);
+  }
+
+  private static byte[] padTo32(String label) {
+    byte[] base = label.getBytes(StandardCharsets.UTF_8);
+    return Arrays.copyOf(base, 32);
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/steps/SplitSteps.java b/src/test/java/org/unicitylabs/sdk/e2e/steps/SplitSteps.java
new file mode 100644
index 0000000..a84d8e6
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/steps/SplitSteps.java
@@ -0,0 +1,992 @@
+package org.unicitylabs.sdk.e2e.steps;
+
+import org.unicitylabs.sdk.predicate.Predicate;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import io.cucumber.java.en.Given;
+import io.cucumber.java.en.Then;
+import io.cucumber.java.en.When;
+import java.math.BigInteger;
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import org.unicitylabs.sdk.api.CertificationData;
+import org.unicitylabs.sdk.crypto.secp256k1.SigningService;
+import org.unicitylabs.sdk.e2e.context.TestContext;
+import org.unicitylabs.sdk.e2e.steps.shared.StepHelper;
+import org.unicitylabs.sdk.functional.payment.TestPaymentData;
+
+import org.unicitylabs.sdk.payment.SplitMintJustification;
+import org.unicitylabs.sdk.payment.SplitAssetProof;
+import org.unicitylabs.sdk.payment.SplitResult;
+import org.unicitylabs.sdk.payment.TokenSplit;
+import org.unicitylabs.sdk.payment.asset.Asset;
+import org.unicitylabs.sdk.payment.asset.AssetId;
+import org.unicitylabs.sdk.predicate.builtin.SignaturePredicate;
+import org.unicitylabs.sdk.predicate.builtin.SignaturePredicateUnlockScript;
+
+import org.unicitylabs.sdk.transaction.Token;
+import org.unicitylabs.sdk.transaction.TokenId;
+import org.unicitylabs.sdk.transaction.TransferTransaction;
+import org.unicitylabs.sdk.util.verification.VerificationStatus;
+import org.unicitylabs.sdk.utils.TokenUtils;
+
+public class SplitSteps {
+
+  private static final Asset ASSET_1 = new Asset(
+      new AssetId("ASSET_1".getBytes(StandardCharsets.UTF_8)),
+      BigInteger.valueOf(500));
+  private static final Asset ASSET_2 = new Asset(
+      new AssetId("ASSET_2".getBytes(StandardCharsets.UTF_8)),
+      BigInteger.valueOf(500));
+
+  private final TestContext context;
+  private SplitResult lastSplitResult;
+  private final List<Token> mintedSplitChildren = new ArrayList<>();
+  // Pre-transfer snapshots for level-1 stale-state attempts.
+  private final List<Token> splitChildrenPreTransfer = new ArrayList<>();
+  // Level-2 (sub-split) children: created when a user splits a received split
+  // child.
+  private final List<Token> subSplitChildren = new ArrayList<>();
+  private final List<Token> subSplitChildrenPreTransfer = new ArrayList<>();
+  // The source token right before a sub-split — becomes the "pre-split token"
+  // that can no longer be spent after the sub-split burns it.
+  private Token preSubSplitSource;
+  private Exception splitAttemptError;
+
+  public SplitSteps(TestContext context) {
+    this.context = context;
+  }
+
+  @Given("{word} has a minted token with 2 payment assets")
+  public void userHasAMintedTokenWith2PaymentAssets(String userName) throws Exception {
+    mintTokenWithAssets(userName, Set.of(ASSET_1, ASSET_2));
+  }
+
+  @Given("{word} has a minted token with 2 payment assets worth {int} and {int}")
+  public void userHasAMintedTokenWith2PaymentAssetsWorth(
+      String userName, int value1, int value2) throws Exception {
+    Asset a1 = new Asset(new AssetId("ASSET_1".getBytes(StandardCharsets.UTF_8)),
+        BigInteger.valueOf(value1));
+    Asset a2 = new Asset(new AssetId("ASSET_2".getBytes(StandardCharsets.UTF_8)),
+        BigInteger.valueOf(value2));
+    mintTokenWithAssets(userName, Set.of(a1, a2));
+  }
+
+  @Given("{word} has a minted token with assets worth {int} and {int}")
+  public void userHasAMintedTokenWithAssetsWorth(
+      String userName, int value1, int value2) throws Exception {
+    userHasAMintedTokenWith2PaymentAssetsWorth(userName, value1, value2);
+  }
+
+  @Given("{word} has a minted token containing {int} payment assets")
+  public void userHasAMintedTokenContainingNAssets(String userName, int count) throws Exception {
+    Set<Asset> assets = new java.util.HashSet<>();
+    for (int i = 0; i < count; i++) {
+      assets.add(new Asset(
+          new AssetId(("ASSET_" + i).getBytes(StandardCharsets.UTF_8)),
+          BigInteger.valueOf(100L * (i + 1))));
+    }
+    mintTokenWithAssets(userName, assets);
+  }
+
+  private void mintTokenWithAssets(String userName, Set<Asset> assets) throws Exception {
+    ensureUser(userName);
+    SigningService signing = context.getUserSigningServices().get(userName);
+    SignaturePredicate predicate = SignaturePredicate.fromSigningService(signing);
+
+    TestPaymentData paymentData = new TestPaymentData(assets);
+
+    Token token = TokenUtils.mintToken(
+        context.getClient(),
+        context.getTrustBase(),
+        context.getPredicateVerifier(),
+        context.getMintJustificationVerifier(),
+        predicate,
+        null,
+        paymentData.encode());
+
+    context.addUserToken(userName, token);
+    context.setCurrentToken(token);
+    context.setCurrentUser(userName);
+  }
+
+  @When("{word} splits the token into 2 new tokens")
+  public void userSplitsTheTokenInto2NewTokens(String userName) throws Exception {
+    Token sourceToken = context.getCurrentToken();
+    assertNotNull(sourceToken, "no current token to split");
+    SigningService signing = context.getUserSigningServices().get(userName);
+    SignaturePredicate predicate = SignaturePredicate.fromSigningService(signing);
+
+    // Read source assets and give each child one full asset — works for any
+    // 2-asset source (values 100/200, 500/500, etc.) without hardcoding.
+    TestPaymentData sourceData = TestPaymentData.decode(sourceToken.getGenesis().getData().orElse(new byte[0]));
+    List<Asset> sourceAssets = new ArrayList<>(sourceData.getAssets());
+    assertTrue(sourceAssets.size() == 2,
+        "source token must have exactly 2 assets for 'into 2 new tokens' split");
+
+    Map<TokenId, Set<Asset>> plan = new HashMap<>();
+    plan.put(TokenId.generate(), Set.of(sourceAssets.get(0)));
+    plan.put(TokenId.generate(), Set.of(sourceAssets.get(1)));
+
+    SplitResult result = TokenSplit.split(sourceToken, TestPaymentData::decode, plan);
+    lastSplitResult = result;
+
+    // Materialize the split: burn the source, then mint each child.
+    Token burnToken = TokenUtils.transferToken(
+        context.getClient(),
+        context.getTrustBase(),
+        context.getPredicateVerifier(),
+        sourceToken,
+        result.getBurnTransaction(),
+        SignaturePredicateUnlockScript.create(result.getBurnTransaction(), signing));
+
+    org.unicitylabs.sdk.transaction.TokenType childType =
+        org.unicitylabs.sdk.transaction.TokenType.generate();
+    for (Map.Entry<TokenId, Set<Asset>> entry : plan.entrySet()) {
+      java.util.List<SplitAssetProof> proofs = result.getProofs().get(entry.getKey());
+      assertNotNull(proofs, "no split-reason proofs for child " + entry.getKey());
+
+      byte[] childJustification = SplitMintJustification.create(
+          burnToken, new java.util.HashSet<>(proofs)).toCbor();
+      byte[] childPayload = new TestPaymentData(entry.getValue()).encode();
+
+      Token child = TokenUtils.mintToken(
+          context.getClient(),
+          context.getTrustBase(),
+          context.getPredicateVerifier(),
+          context.getMintJustificationVerifier(),
+          entry.getKey(),
+          childType,
+          predicate,
+          childJustification,
+          childPayload);
+
+      mintedSplitChildren.add(child); context.getSplitChildren().add(child);
+      splitChildrenPreTransfer.add(child);
+    }
+  }
+
+  @When("{word} splits the token into 2 parts")
+  public void userSplitsTheTokenInto2Parts(String userName) throws Exception {
+    // Alias for the "new tokens" variant — reads source assets and gives each
+    // child one full asset.
+    userSplitsTheTokenInto2NewTokens(userName);
+  }
+
+  @When("{word} splits the token into 1 output that consumes all assets")
+  public void userSplitsTheTokenInto1Output(String userName) throws Exception {
+    Token sourceToken = context.getCurrentToken();
+    assertNotNull(sourceToken, "no current token to split");
+    SigningService signing = context.getUserSigningServices().get(userName);
+    SignaturePredicate predicate = SignaturePredicate.fromSigningService(signing);
+
+    TestPaymentData sourceData = TestPaymentData.decode(
+        sourceToken.getGenesis().getData().orElse(new byte[0]));
+    Set<Asset> allAssets = new java.util.HashSet<>(sourceData.getAssets());
+
+    Map<TokenId, Set<Asset>> plan = new HashMap<>();
+    plan.put(TokenId.generate(), allAssets);
+
+    SplitResult result = TokenSplit.split(sourceToken, TestPaymentData::decode, plan);
+    lastSplitResult = result;
+
+    Token burnToken = TokenUtils.transferToken(
+        context.getClient(), context.getTrustBase(), context.getPredicateVerifier(),
+        sourceToken,
+        result.getBurnTransaction(),
+        SignaturePredicateUnlockScript.create(result.getBurnTransaction(), signing));
+
+    org.unicitylabs.sdk.transaction.TokenType childType =
+        org.unicitylabs.sdk.transaction.TokenType.generate();
+    for (Map.Entry<TokenId, Set<Asset>> entry : plan.entrySet()) {
+      java.util.List<SplitAssetProof> proofs = result.getProofs().get(entry.getKey());
+      byte[] childJustification = SplitMintJustification.create(
+          burnToken, new java.util.HashSet<>(proofs)).toCbor();
+      byte[] childPayload = new TestPaymentData(entry.getValue()).encode();
+      Token child = TokenUtils.mintToken(
+          context.getClient(), context.getTrustBase(), context.getPredicateVerifier(),
+          context.getMintJustificationVerifier(),
+          entry.getKey(), childType, predicate,
+          childJustification, childPayload);
+      mintedSplitChildren.add(child);
+      context.getSplitChildren().add(child);
+    }
+  }
+
+  @Then("{int} split token is minted")
+  public void nSplitTokenIsMinted(int expected) {
+    assertEquals(expected, mintedSplitChildren.size(), "unexpected split-child count");
+  }
+
+  // Idempotency scenario: capture cert request, replay it.
+  private CertificationData rememberedSplitCertRequest;
+  private org.unicitylabs.sdk.api.CertificationStatus rememberedFirstStatus;
+  private org.unicitylabs.sdk.api.CertificationStatus secondSubmissionStatus;
+
+  @When("{word} splits the token into 2 outputs and remembers the first cert request")
+  public void userSplitsAndRemembersCertRequest(String userName) throws Exception {
+    Token sourceToken = context.getCurrentToken();
+    assertNotNull(sourceToken, "no current token to split");
+    SigningService signing = context.getUserSigningServices().get(userName);
+
+    TestPaymentData sourceData = TestPaymentData.decode(
+        sourceToken.getGenesis().getData().orElse(new byte[0]));
+    java.util.List<Asset> sourceAssets = new ArrayList<>(sourceData.getAssets());
+    Map<TokenId, Set<Asset>> plan = new HashMap<>();
+    plan.put(TokenId.generate(), Set.of(sourceAssets.get(0)));
+    plan.put(TokenId.generate(), Set.of(sourceAssets.get(1)));
+
+    SplitResult result = TokenSplit.split(sourceToken, TestPaymentData::decode, plan);
+    rememberedSplitCertRequest = CertificationData.fromTransaction(
+        result.getBurnTransaction(),
+        SignaturePredicateUnlockScript.create(result.getBurnTransaction(), signing));
+    org.unicitylabs.sdk.api.CertificationResponse first =
+        context.getClient().submitCertificationRequest(rememberedSplitCertRequest).get();
+    rememberedFirstStatus = first.getStatus();
+  }
+
+  @When("the same cert request is submitted again")
+  public void theSameCertRequestIsSubmittedAgain() throws Exception {
+    org.unicitylabs.sdk.api.CertificationResponse second =
+        context.getClient().submitCertificationRequest(rememberedSplitCertRequest).get();
+    secondSubmissionStatus = second.getStatus();
+  }
+
+  @Then("the second submission status is one of {string} or {string}")
+  public void secondSubmissionStatusIsOneOf(String a, String b) {
+    assertNotNull(secondSubmissionStatus, "no second-submission status captured");
+    String actual = secondSubmissionStatus.name();
+    assertTrue(actual.equals(a) || actual.equals(b),
+        "expected " + a + " or " + b + " but got " + actual);
+  }
+
+  @When("{word} splits the token into 2 parts keeping ownership")
+  public void userSplitsTheTokenInto2PartsKeepingOwnership(String userName) throws Exception {
+    // Our default split implementation already mints children back to the owner,
+    // so this is a semantic alias.
+    userSplitsTheTokenInto2NewTokens(userName);
+  }
+
+  @When("{word} transfers the first split token to {word}")
+  public void userTransfersTheFirstSplitTokenTo(String sender, String recipient) throws Exception {
+    userTransfersSplitTokenNTo(sender, 1, recipient);
+  }
+
+  @When("{word} transfers split token {int} to {word}")
+  public void userTransfersSplitTokenNTo(
+      String sender, int index1Based, String recipient) throws Exception {
+    int idx = index1Based - 1;
+    assertTrue(idx >= 0 && idx < mintedSplitChildren.size(),
+        "no split child at index " + index1Based);
+    // Use the CURRENT state of the child (post any prior transfers), not the
+    // pre-transfer snapshot — that's reserved for stale-token scenarios.
+    Token child = mintedSplitChildren.get(idx);
+    SigningService senderSigning = context.getUserSigningServices().get(sender);
+    assertNotNull(senderSigning, "no signing key for sender " + sender);
+    ensureUser(recipient);
+    Predicate recipientAddress = context.getUserAddresses().get(recipient);
+
+    Token transferred = TokenUtils.transferToken(
+        context.getClient(),
+        context.getTrustBase(),
+        context.getPredicateVerifier(),
+        context.getMintJustificationVerifier(),
+        child.toCbor(),
+        recipientAddress,
+        senderSigning);
+    // Replace the indexed slot with the post-transfer token so subsequent
+    // references in the scenario resolve to the recipient's holding.
+    mintedSplitChildren.set(idx, transferred);
+    context.addUserToken(recipient, transferred);
+    context.setCurrentToken(transferred);
+    context.setCurrentUser(recipient);
+  }
+
+  @Then("{word}'s token passes verification")
+  public void usersTokenPassesVerification(String userName) {
+    List<Token> userTokens = context.getUserTokens().get(userName);
+    assertNotNull(userTokens, "user " + userName + " has no tokens");
+    assertTrue(!userTokens.isEmpty(), "user " + userName + " has empty token list");
+    Token token = userTokens.get(userTokens.size() - 1);
+    assertEquals(
+        VerificationStatus.OK,
+        token.verify(context.getTrustBase(), context.getPredicateVerifier(), context.getMintJustificationVerifier()).getStatus(),
+        userName + "'s latest token failed verification");
+  }
+
+  @Then("{word} can transfer split token {int} to {word}")
+  public void userCanTransferSplitTokenNTo(
+      String sender, int index1Based, String recipient) throws Exception {
+    userTransfersSplitTokenNTo(sender, index1Based, recipient);
+  }
+
+  @Then("{word}'s received token passes verification")
+  public void usersReceivedTokenPassesVerification(String userName) {
+    usersTokenPassesVerification(userName);
+  }
+
+  @Then("{word} cannot transfer split token {int} to {word} because it was already sent")
+  public void userCannotTransferSplitTokenBecauseAlreadySent(
+      String sender, int index1Based, String recipient) throws Exception {
+    int idx = index1Based - 1;
+    // Use the PRE-TRANSFER token (the stale version the sender thinks they still
+    // hold). The re-spend must never finalize — rejected at submit OR at proof.
+    Token staleChild = splitChildrenPreTransfer.get(idx);
+    SigningService senderSigning = context.getUserSigningServices().get(sender);
+    ensureUser(recipient);
+    Predicate recipientAddress = context.getUserAddresses().get(recipient);
+
+    byte[] x = new byte[32];
+    new java.security.SecureRandom().nextBytes(x);
+    TransferTransaction tx = TransferTransaction.create(staleChild, recipientAddress, x, new byte[0]);
+
+    org.unicitylabs.sdk.api.CertificationResponse response =
+        context.getClient().submitCertificationRequest(
+            org.unicitylabs.sdk.api.CertificationData.fromTransaction(
+                tx, SignaturePredicateUnlockScript.create(tx, senderSigning)))
+            .get();
+    StepHelper.assertRespendRejected(context, tx, response);
+  }
+
+  @When("{word} tries to split with only 1 asset instead of 2")
+  public void userTriesToSplitWithWrongAssetCount(String userName) {
+    attemptInvalidSplit(userName,
+        Map.of(TokenId.generate(), Set.of(ASSET_1)));
+  }
+
+  @When("{word} tries to split with a wrong asset ID")
+  public void userTriesToSplitWithWrongAssetId(String userName) {
+    Asset phantom = new Asset(
+        new AssetId("PHANTOM".getBytes(StandardCharsets.UTF_8)),
+        BigInteger.valueOf(500));
+    attemptInvalidSplit(userName,
+        Map.of(TokenId.generate(), Set.of(ASSET_1, phantom)));
+  }
+
+  @When("{word} tries to split with incorrect asset values")
+  public void userTriesToSplitWithIncorrectAssetValues(String userName) {
+    Asset wrongValue = new Asset(ASSET_2.getId(), BigInteger.valueOf(400));
+    attemptInvalidSplit(userName,
+        Map.of(TokenId.generate(), Set.of(ASSET_1, wrongValue)));
+  }
+
+  @When("{word} tries to split with values exceeding the original totals")
+  public void userTriesToSplitWithValuesExceedingOriginalTotals(String userName) {
+    // Overflow: source has 2 assets (100 and 200); claim more value than exists.
+    Asset over1 = new Asset(ASSET_1.getId(), BigInteger.valueOf(500));
+    Asset over2 = new Asset(ASSET_2.getId(), BigInteger.valueOf(500));
+    attemptInvalidSplit(userName,
+        Map.of(TokenId.generate(), Set.of(over1, over2)));
+  }
+
+  @When("{word} tries to split with values less than the original totals")
+  public void userTriesToSplitWithValuesLessThanOriginalTotals(String userName) {
+    Asset under1 = new Asset(ASSET_1.getId(), BigInteger.valueOf(50));
+    Asset under2 = new Asset(ASSET_2.getId(), BigInteger.valueOf(50));
+    attemptInvalidSplit(userName,
+        Map.of(TokenId.generate(), Set.of(under1, under2)));
+  }
+
+  @When("{word} tries to split with minimum values of 1 and the remainder")
+  public void userTriesToSplitWithMinimumValues(String userName) throws Exception {
+    // Source minted via "token with 2 payment assets worth 100 and 200".
+    // Two children: child 1 gets {a1=1, a2=1}; child 2 gets {a1=99, a2=199}.
+    // Each asset's tree still sums to 100 and 200 respectively → should succeed.
+    Asset a1MinA = new Asset(ASSET_1.getId(), BigInteger.ONE);
+    Asset a1MinB = new Asset(ASSET_1.getId(), BigInteger.valueOf(99));
+    Asset a2MinA = new Asset(ASSET_2.getId(), BigInteger.ONE);
+    Asset a2MinB = new Asset(ASSET_2.getId(), BigInteger.valueOf(199));
+
+    try {
+      Token sourceToken = context.getCurrentToken();
+      SigningService signing = context.getUserSigningServices().get(userName);
+      SignaturePredicate predicate = SignaturePredicate.fromSigningService(signing);
+      Map<TokenId, Set<Asset>> plan = new HashMap<>();
+      plan.put(TokenId.generate(), Set.of(a1MinA, a2MinA));
+      plan.put(TokenId.generate(), Set.of(a1MinB, a2MinB));
+      lastSplitResult = TokenSplit.split(sourceToken, TestPaymentData::decode, plan);
+      splitAttemptError = null;
+    } catch (Exception e) {
+      splitAttemptError = e;
+    }
+  }
+
+  @When("{word} splits the token into {int} equal parts")
+  public void userSplitsTheTokenIntoNEqualParts(String userName, int parts) {
+    // Generic N-way split: for each source asset, slice its value into N equal pieces.
+    // Requires N to divide each asset's value evenly; combinations-feature assets
+    // are constructed with values 100*(i+1) so picking N that divides the smallest
+    // value is left to the scenario author.
+    try {
+      Token sourceToken = context.getCurrentToken();
+      SigningService signing = context.getUserSigningServices().get(userName);
+      SignaturePredicate predicate = SignaturePredicate.fromSigningService(signing);
+      TestPaymentData sourceData = TestPaymentData.decode(sourceToken.getGenesis().getData().orElse(new byte[0]));
+
+      Map<TokenId, Set<Asset>> plan = new HashMap<>();
+      for (int i = 0; i < parts; i++) {
+        Set<Asset> pieceAssets = new java.util.HashSet<>();
+        for (Asset src : sourceData.getAssets()) {
+          // Divide each source asset's value equally. Integer division; residual
+          // goes to the last child to preserve sum.
+          BigInteger base = src.getValue().divide(BigInteger.valueOf(parts));
+          BigInteger value = (i == parts - 1)
+              ? src.getValue().subtract(base.multiply(BigInteger.valueOf(parts - 1)))
+              : base;
+          if (value.signum() > 0) {
+            pieceAssets.add(new Asset(src.getId(), value));
+          }
+        }
+        plan.put(TokenId.generate(), pieceAssets);
+      }
+      lastSplitResult = TokenSplit.split(sourceToken, TestPaymentData::decode, plan);
+      splitAttemptError = null;
+    } catch (Exception e) {
+      splitAttemptError = e;
+      lastSplitResult = null;
+    }
+  }
+
+  @Then("the split validation succeeds")
+  public void theSplitValidationSucceeds() {
+    assertTrue(splitAttemptError == null,
+        "split unexpectedly failed: "
+            + (splitAttemptError != null ? splitAttemptError.getMessage() : ""));
+    assertNotNull(lastSplitResult, "no SplitResult recorded after a successful split");
+  }
+
+  @Then("the burn transaction succeeds")
+  public void theBurnTransactionSucceeds() {
+    assertNotNull(lastSplitResult, "no SplitResult recorded");
+    assertNotNull(lastSplitResult.getBurnTransaction(), "burn transaction was not produced");
+  }
+
+  @Then("{int} split tokens are minted")
+  public void nSplitTokensAreMinted(int expected) {
+    assertEquals(expected, mintedSplitChildren.size(),
+        "unexpected number of minted split children");
+  }
+
+  @Then("each split token passes TokenSplit verification")
+  public void eachSplitTokenPassesTokenSplitVerification() {
+    // Post-issue-52 SDK: TokenSplit.verify() is gone. Split-mint verification
+    // happens via the MintJustificationVerifierService registry — registered
+    // as SplitMintJustificationVerifier in AggregatorSteps.wireVerifiers. So
+    // a normal Token.verify(...) covers what the old TokenSplit.verify did.
+    assertTrue(mintedSplitChildren.size() > 0, "no split children minted");
+    for (Token child : mintedSplitChildren) {
+      assertEquals(
+          VerificationStatus.OK,
+          child.verify(
+              context.getTrustBase(),
+              context.getPredicateVerifier(),
+              context.getMintJustificationVerifier()).getStatus(),
+          "split child failed verification: " + child.getId());
+    }
+  }
+
+  // TS v2 asserts on typed errors (TokenAssetCountMismatchError etc.); Java v2
+  // uses IllegalArgumentException with distinctive messages — see
+  // V1_VS_V2_SDK_ANALYSIS.md §11.7 (granular-error-type decision). We assert on
+  // message substrings that match the thrown IllegalArgumentException text.
+  @Then("the split fails with TokenAssetCountMismatchError")
+  public void theSplitFailsWithAssetCountMismatch() {
+    assertNotNull(splitAttemptError, "no exception was captured from the split attempt");
+    assertTrue(splitAttemptError instanceof IllegalArgumentException,
+        "expected IllegalArgumentException, got " + splitAttemptError.getClass());
+    assertTrue(
+        splitAttemptError.getMessage().contains("asset counts differ"),
+        "unexpected error message: " + splitAttemptError.getMessage());
+  }
+
+  @Then("the split fails with TokenAssetMissingError")
+  public void theSplitFailsWithAssetMissing() {
+    assertNotNull(splitAttemptError, "no exception was captured from the split attempt");
+    assertTrue(splitAttemptError instanceof IllegalArgumentException,
+        "expected IllegalArgumentException, got " + splitAttemptError.getClass());
+    // Java v2's TokenSplit throws "Token did not contain asset <id>." when a
+    // split plan references an AssetId not present in the source token.
+    assertTrue(
+        splitAttemptError.getMessage().contains("did not contain"),
+        "unexpected error message: " + splitAttemptError.getMessage());
+  }
+
+  @Then("the split fails with TokenAssetValueMismatchError")
+  public void theSplitFailsWithAssetValueMismatch() {
+    assertNotNull(splitAttemptError, "no exception was captured from the split attempt");
+    assertTrue(splitAttemptError instanceof IllegalArgumentException,
+        "expected IllegalArgumentException, got " + splitAttemptError.getClass());
+    assertTrue(
+        splitAttemptError.getMessage().contains("tree has"),
+        "unexpected error message: " + splitAttemptError.getMessage());
+  }
+
+  private void attemptInvalidSplit(String userName, Map<TokenId, Set<Asset>> plan) {
+    try {
+      Token sourceToken = context.getCurrentToken();
+      SigningService signing = context.getUserSigningServices().get(userName);
+      SignaturePredicate predicate = SignaturePredicate.fromSigningService(signing);
+      TokenSplit.split(sourceToken, TestPaymentData::decode, plan);
+      splitAttemptError = null;
+    } catch (Exception e) {
+      splitAttemptError = e;
+    }
+  }
+
+  private void ensureUser(String userName) {
+    if (!context.getUserSigningServices().containsKey(userName)) {
+      SigningService signing = SigningService.generate();
+      SignaturePredicate predicate = SignaturePredicate.fromSigningService(signing);
+      context.getUserSigningServices().put(userName, signing);
+      context.getUserPredicates().put(userName, predicate);
+      context.getUserAddresses().put(userName, predicate);
+    }
+  }
+
+  // ══ Arbitrary-value split plans (Tier A) ═════════════════════════════════
+
+  @When("^(\\w+) splits the token into 2 parts with values (\\d+)/(\\d+) and (\\d+)/(\\d+)$")
+  public void userSplitsTheTokenIntoTwoPartsWithValues(
+      String userName,
+      int asset1Part1, int asset1Part2,
+      int asset2Part1, int asset2Part2) throws Exception {
+    // TS convention: "X/Y and A/B" = asset1 splits X/Y between children, asset2
+    // splits A/B. Child[0] gets {a1=X, a2=A}, child[1] gets {a1=Y, a2=B}.
+    splitCurrentTokenIntoPlannedChildren(
+        userName,
+        List.of(
+            List.of(asset1Part1, asset2Part1),
+            List.of(asset1Part2, asset2Part2)));
+  }
+
+  private void splitCurrentTokenIntoPlannedChildren(
+      String userName, List<List<Integer>> childValues) throws Exception {
+    Token sourceToken = context.getCurrentToken();
+    assertNotNull(sourceToken, "no current token to split");
+    SigningService signing = context.getUserSigningServices().get(userName);
+    SignaturePredicate predicate = SignaturePredicate.fromSigningService(signing);
+
+    TestPaymentData sourceData = TestPaymentData.decode(sourceToken.getGenesis().getData().orElse(new byte[0]));
+    List<Asset> sourceAssets = sortedAssets(sourceData.getAssets());
+
+    Map<TokenId, Set<Asset>> plan = new LinkedHashMap<>();
+    for (List<Integer> perChild : childValues) {
+      Set<Asset> childAssets = new java.util.HashSet<>();
+      for (int i = 0; i < sourceAssets.size() && i < perChild.size(); i++) {
+        childAssets.add(new Asset(
+            sourceAssets.get(i).getId(), BigInteger.valueOf(perChild.get(i))));
+      }
+      plan.put(TokenId.generate(), childAssets);
+    }
+
+    SplitResult result = TokenSplit.split(sourceToken, TestPaymentData::decode, plan);
+    lastSplitResult = result;
+
+    Token burnToken = TokenUtils.transferToken(
+        context.getClient(), context.getTrustBase(), context.getPredicateVerifier(),
+        sourceToken,
+        result.getBurnTransaction(),
+        SignaturePredicateUnlockScript.create(result.getBurnTransaction(), signing));
+
+    mintedSplitChildren.clear();
+    splitChildrenPreTransfer.clear();
+    org.unicitylabs.sdk.transaction.TokenType childType2 =
+        org.unicitylabs.sdk.transaction.TokenType.generate();
+    for (Map.Entry<TokenId, Set<Asset>> entry : plan.entrySet()) {
+      List<SplitAssetProof> proofs = result.getProofs().get(entry.getKey());
+      byte[] childJustification = SplitMintJustification.create(
+          burnToken, new java.util.HashSet<>(proofs)).toCbor();
+      byte[] childPayload = new TestPaymentData(entry.getValue()).encode();
+      Token child = TokenUtils.mintToken(
+          context.getClient(), context.getTrustBase(), context.getPredicateVerifier(),
+          context.getMintJustificationVerifier(),
+          entry.getKey(),
+          childType2,
+          predicate,
+          childJustification,
+          childPayload);
+      mintedSplitChildren.add(child); context.getSplitChildren().add(child);
+      splitChildrenPreTransfer.add(child);
+    }
+  }
+
+  @Then("{word} should own split token {int}")
+  public void userShouldOwnSplitTokenN(String userName, int index1Based) {
+    int idx = index1Based - 1;
+    assertTrue(idx >= 0 && idx < mintedSplitChildren.size(),
+        "no split child at index " + index1Based);
+    List<Token> userTokens = context.getUserTokens().get(userName);
+    assertNotNull(userTokens, "user " + userName + " has no tokens");
+    Token expected = mintedSplitChildren.get(idx);
+    assertTrue(userTokens.stream().anyMatch(t -> t.getId().equals(expected.getId())),
+        userName + " does not hold split token " + index1Based);
+  }
+
+  @Then("both split tokens should pass verification")
+  public void bothSplitTokensShouldPassVerification() {
+    assertTrue(mintedSplitChildren.size() >= 2, "fewer than 2 split children");
+    for (Token t : mintedSplitChildren) {
+      assertEquals(
+          VerificationStatus.OK,
+          t.verify(context.getTrustBase(), context.getPredicateVerifier(), context.getMintJustificationVerifier()).getStatus(),
+          "split child failed verification: " + t.getId());
+    }
+  }
+
+  @When("{word} transfers his split token to {word}")
+  public void userTransfersHisSplitTokenTo(String sender, String recipient) throws Exception {
+    // Find the first split child currently owned by sender (by id match).
+    List<Token> senderTokens = context.getUserTokens().get(sender);
+    assertNotNull(senderTokens, sender + " has no tokens");
+    int idx = -1;
+    for (int i = 0; i < mintedSplitChildren.size(); i++) {
+      Token child = mintedSplitChildren.get(i);
+      for (Token held : senderTokens) {
+        if (held.getId().equals(child.getId())) {
+          idx = i;
+          break;
+        }
+      }
+      if (idx >= 0) {
+        break;
+      }
+    }
+    assertTrue(idx >= 0, sender + " holds none of the split children");
+    userTransfersSplitTokenNTo(sender, idx + 1, recipient);
+  }
+
+  @Then("{word} should own the transferred split token")
+  public void userShouldOwnTheTransferredSplitToken(String userName) {
+    assertEquals(userName, context.getCurrentUser(),
+        "expected " + userName + " to own transferred split token");
+  }
+
+  @Then("the transferred split token should pass verification")
+  public void theTransferredSplitTokenShouldPassVerification() {
+    Token t = context.getCurrentToken();
+    assertNotNull(t);
+    assertEquals(
+        VerificationStatus.OK,
+        t.verify(context.getTrustBase(), context.getPredicateVerifier(), context.getMintJustificationVerifier()).getStatus());
+  }
+
+  // ── CBOR roundtrip for split child ───────────────────────────────────────
+
+  @When("split token {int} is exported to CBOR")
+  public void splitTokenNIsExportedToCbor(int index1Based) {
+    int idx = index1Based - 1;
+    assertTrue(idx < mintedSplitChildren.size(), "no split child at index " + index1Based);
+    Token child = mintedSplitChildren.get(idx);
+    context.setCurrentToken(child);
+    context.setExportedTokenCbor(child.toCbor());
+  }
+
+  @Then("the imported split token should have the same ID")
+  public void theImportedSplitTokenShouldHaveTheSameId() {
+    Token imported = context.getImportedToken();
+    Token original = context.getCurrentToken();
+    assertNotNull(imported);
+    assertNotNull(original);
+    assertEquals(original.getId(), imported.getId());
+  }
+
+  @Then("the imported split token should pass verification")
+  public void theImportedSplitTokenShouldPassVerification() {
+    Token imported = context.getImportedToken();
+    assertNotNull(imported);
+    assertEquals(
+        VerificationStatus.OK,
+        imported.verify(context.getTrustBase(), context.getPredicateVerifier(), context.getMintJustificationVerifier()).getStatus());
+  }
+
+  // ── Non-owner split attempt ──────────────────────────────────────────────
+
+  @When("{word} tries to split {word}'s token")
+  public void userTriesToSplitOthersToken(String attacker, String owner) {
+    // Current token is now owned by `owner` (after the preceding transfer step).
+    // Attacker attempts to split with their own signing service — should fail.
+    Token token = context.getCurrentToken();
+    SigningService attackerSigning = context.getUserSigningServices().get(attacker);
+    SignaturePredicate attackerPredicate =
+        SignaturePredicate.fromSigningService(attackerSigning);
+    splitAttemptError = null;
+    try {
+      Map<TokenId, Set<Asset>> plan = new java.util.HashMap<>();
+      TestPaymentData sourceData = TestPaymentData.decode(token.getGenesis().getData().orElse(new byte[0]));
+      List<Asset> assets = new ArrayList<>(sourceData.getAssets());
+      plan.put(TokenId.generate(), Set.of(assets.get(0)));
+      TokenSplit.split(token, TestPaymentData::decode, plan);
+    } catch (Exception e) {
+      splitAttemptError = e;
+    }
+  }
+
+  @Then("the split should fail with predicate mismatch")
+  public void theSplitShouldFailWithPredicateMismatch() {
+    assertNotNull(splitAttemptError, "expected split to fail but no error captured");
+  }
+
+  // ── Original-token post-burn attempt ─────────────────────────────────────
+
+  @When("{word} tries to transfer the original token to {word}")
+  public void userTriesToTransferTheOriginalTokenTo(String sender, String recipient)
+      throws Exception {
+    List<Token> senderTokens = context.getUserTokens().get(sender);
+    assertNotNull(senderTokens);
+    Token original = senderTokens.get(0); // The first-recorded (pre-split) token.
+    ensureUser(recipient);
+
+    SigningService senderSigning = context.getUserSigningServices().get(sender);
+    byte[] x = new byte[32];
+    new java.security.SecureRandom().nextBytes(x);
+
+    TransferTransaction tx = TransferTransaction.create(original, context.getUserAddresses().get(recipient), x, new byte[0]);
+    org.unicitylabs.sdk.api.CertificationResponse response =
+        context.getClient().submitCertificationRequest(
+            org.unicitylabs.sdk.api.CertificationData.fromTransaction(
+                tx, SignaturePredicateUnlockScript.create(tx, senderSigning)))
+            .get();
+    context.setLastCertificationResponse(response);
+    context.setRespendTransaction(tx);
+  }
+
+  @Then("the transfer should fail because the token was burned")
+  public void theTransferShouldFailBecauseTheTokenWasBurned() {
+    StepHelper.assertRespendRejected(
+        context, context.getRespendTransaction(), context.getLastCertificationResponse());
+  }
+
+  // ══ Multi-level / sub-split (Tier A) ═════════════════════════════════════
+
+  @When("{word} splits his token into 2 sub-parts")
+  public void userSplitsHisTokenInto2SubParts(String userName) throws Exception {
+    preSubSplitSource = context.getCurrentToken();
+    splitCurrentTokenIntoSubChildren(
+        userName,
+        readSourceAssetsAsValues(context.getCurrentToken()));
+  }
+
+  @When("^(\\w+) splits his token into 2 sub-parts with values (\\d+)/(\\d+) and (\\d+)/(\\d+)$")
+  public void userSplitsHisTokenInto2SubPartsWithValues(
+      String userName,
+      int asset1Part1, int asset1Part2,
+      int asset2Part1, int asset2Part2) throws Exception {
+    preSubSplitSource = context.getCurrentToken();
+    splitCurrentTokenIntoSubChildren(
+        userName,
+        List.of(
+            List.of(asset1Part1, asset2Part1),
+            List.of(asset1Part2, asset2Part2)));
+  }
+
+  // Splits into 2 children by halving each asset's value. The source token is
+  // always a split child at this point (sub-split step), so use
+  // TestSplitPaymentData as the parser.
+  private List<List<Integer>> readSourceAssetsAsValues(Token source) {
+    Set<Asset> assets = TestPaymentData.decode(source.getGenesis().getData().orElse(new byte[0])).getAssets();
+    List<Asset> sourceAssets = sortedAssets(assets);
+    List<List<Integer>> plan = new ArrayList<>();
+    List<Integer> c0 = new ArrayList<>();
+    List<Integer> c1 = new ArrayList<>();
+    for (Asset a : sourceAssets) {
+      int v = a.getValue().intValue();
+      c0.add(v / 2);
+      c1.add(v - v / 2);
+    }
+    plan.add(c0);
+    plan.add(c1);
+    return plan;
+  }
+
+  private void splitCurrentTokenIntoSubChildren(String userName, List<List<Integer>> plan)
+      throws Exception {
+    Token sourceToken = context.getCurrentToken();
+    SigningService signing = context.getUserSigningServices().get(userName);
+    SignaturePredicate predicate = SignaturePredicate.fromSigningService(signing);
+
+    // Second-level split: source is always a split child with TestSplitPaymentData encoding.
+    org.unicitylabs.sdk.payment.PaymentDataDeserializer parser = TestPaymentData::decode;
+
+    List<Asset> sourceAssets = sortedAssets(
+        parser.decode(sourceToken.getGenesis().getData().orElse(new byte[0])).getAssets());
+
+    Map<TokenId, Set<Asset>> splitPlan = new LinkedHashMap<>();
+    for (List<Integer> perChild : plan) {
+      Set<Asset> assets = new java.util.HashSet<>();
+      for (int i = 0; i < sourceAssets.size() && i < perChild.size(); i++) {
+        assets.add(new Asset(sourceAssets.get(i).getId(), BigInteger.valueOf(perChild.get(i))));
+      }
+      splitPlan.put(TokenId.generate(), assets);
+    }
+
+    SplitResult result = TokenSplit.split(sourceToken, parser, splitPlan);
+
+    Token burnToken = TokenUtils.transferToken(
+        context.getClient(), context.getTrustBase(), context.getPredicateVerifier(),
+        sourceToken,
+        result.getBurnTransaction(),
+        SignaturePredicateUnlockScript.create(result.getBurnTransaction(), signing));
+
+    subSplitChildren.clear();
+    subSplitChildrenPreTransfer.clear();
+    org.unicitylabs.sdk.transaction.TokenType subChildType =
+        org.unicitylabs.sdk.transaction.TokenType.generate();
+    for (Map.Entry<TokenId, Set<Asset>> entry : splitPlan.entrySet()) {
+      List<SplitAssetProof> proofs = result.getProofs().get(entry.getKey());
+      byte[] childJustification = SplitMintJustification.create(
+          burnToken, new java.util.HashSet<>(proofs)).toCbor();
+      byte[] childPayload = new TestPaymentData(entry.getValue()).encode();
+      Token child = TokenUtils.mintToken(
+          context.getClient(), context.getTrustBase(), context.getPredicateVerifier(),
+          context.getMintJustificationVerifier(),
+          entry.getKey(),
+          subChildType,
+          predicate,
+          childJustification,
+          childPayload);
+      subSplitChildren.add(child);
+      subSplitChildrenPreTransfer.add(child);
+      context.addUserToken(userName, child);
+    }
+  }
+
+  private static boolean isSimplePayment(Token token) {
+    try {
+      TestPaymentData.decode(token.getGenesis().getData().orElse(new byte[0]));
+      return true;
+    } catch (Exception e) {
+      return false;
+    }
+  }
+
+  // Sorts assets by AssetId bytes (lexicographic) so callers can index them
+  // deterministically. Set.of() iteration order is unspecified; ordering here
+  // is how the feature-file grammar maps "first pair" / "second pair" to the
+  // right asset consistently.
+  private static List<Asset> sortedAssets(Set<Asset> assets) {
+    List<Asset> list = new ArrayList<>(assets);
+    list.sort((a, b) -> {
+      byte[] ba = a.getId().getBytes();
+      byte[] bb = b.getId().getBytes();
+      int n = Math.min(ba.length, bb.length);
+      for (int i = 0; i < n; i++) {
+        int diff = (ba[i] & 0xff) - (bb[i] & 0xff);
+        if (diff != 0) {
+          return diff;
+        }
+      }
+      return ba.length - bb.length;
+    });
+    return list;
+  }
+
+  @When("{word} transfers sub-split token {int} to {word}")
+  public void userTransfersSubSplitTokenNTo(String sender, int idx1, String recipient)
+      throws Exception {
+    int idx = idx1 - 1;
+    assertTrue(idx >= 0 && idx < subSplitChildren.size(),
+        "no sub-split child at index " + idx1);
+    Token child = subSplitChildren.get(idx);
+    SigningService senderSigning = context.getUserSigningServices().get(sender);
+    ensureUser(recipient);
+    Predicate recipientAddress = context.getUserAddresses().get(recipient);
+
+    Token transferred = TokenUtils.transferToken(
+        context.getClient(),
+        context.getTrustBase(),
+        context.getPredicateVerifier(),
+        context.getMintJustificationVerifier(),
+        child.toCbor(),
+        recipientAddress,
+        senderSigning);
+    subSplitChildren.set(idx, transferred);
+    context.addUserToken(recipient, transferred);
+    context.setCurrentToken(transferred);
+    context.setCurrentUser(recipient);
+  }
+
+  @Then("{int} sub-split tokens are created")
+  public void nSubSplitTokensAreCreated(int expected) {
+    assertEquals(expected, subSplitChildren.size(), "unexpected sub-split count");
+  }
+
+  @Then("{int} sub-split tokens should be created")
+  public void nSubSplitTokensShouldBeCreated(int expected) {
+    nSubSplitTokensAreCreated(expected);
+  }
+
+  @Then("each sub-split token passes verification")
+  public void eachSubSplitTokenPassesVerification() {
+    for (Token t : subSplitChildren) {
+      assertEquals(
+          VerificationStatus.OK,
+          t.verify(context.getTrustBase(), context.getPredicateVerifier(), context.getMintJustificationVerifier()).getStatus(),
+          "sub-split child failed verification: " + t.getId());
+    }
+  }
+
+  @Then("each sub-split token should pass verification")
+  public void eachSubSplitTokenShouldPassVerification() {
+    eachSubSplitTokenPassesVerification();
+  }
+
+  @Then("{word}'s token has the correct asset values")
+  public void userTokenHasTheCorrectAssetValues(String userName) {
+    // Light-touch check: the user's latest token verifies and has non-empty assets.
+    List<Token> ts = context.getUserTokens().get(userName);
+    assertNotNull(ts, userName + " has no tokens");
+    Token latest = ts.get(ts.size() - 1);
+    assertEquals(
+        VerificationStatus.OK,
+        latest.verify(context.getTrustBase(), context.getPredicateVerifier(), context.getMintJustificationVerifier()).getStatus());
+    TestPaymentData data = TestPaymentData.decode(latest.getGenesis().getData().orElse(new byte[0]));
+    assertTrue(!data.getAssets().isEmpty(), userName + "'s token has no assets");
+  }
+
+  @Then("{word} cannot transfer sub-split token {int} to {word} because it was already sent")
+  public void userCannotTransferSubSplitTokenBecauseAlreadySent(
+      String sender, int idx1, String recipient) throws Exception {
+    int idx = idx1 - 1;
+    Token stale = subSplitChildrenPreTransfer.get(idx);
+    SigningService senderSigning = context.getUserSigningServices().get(sender);
+    ensureUser(recipient);
+    Predicate recipientAddress = context.getUserAddresses().get(recipient);
+
+    byte[] x = new byte[32];
+    new java.security.SecureRandom().nextBytes(x);
+    TransferTransaction tx = TransferTransaction.create(stale, recipientAddress, x, new byte[0]);
+    org.unicitylabs.sdk.api.CertificationResponse response =
+        context.getClient().submitCertificationRequest(
+            org.unicitylabs.sdk.api.CertificationData.fromTransaction(
+                tx, SignaturePredicateUnlockScript.create(tx, senderSigning)))
+            .get();
+    StepHelper.assertRespendRejected(context, tx, response);
+  }
+
+  @Then("{word} cannot transfer the pre-split token because it was burned")
+  public void userCannotTransferThePreSplitTokenBecauseItWasBurned(String sender) throws Exception {
+    assertNotNull(preSubSplitSource,
+        "no pre-sub-split source recorded — was there a preceding split step?");
+    SigningService senderSigning = context.getUserSigningServices().get(sender);
+    ensureUser("AnyRecipient");
+    Predicate recipientAddress = context.getUserAddresses().get("AnyRecipient");
+
+    byte[] x = new byte[32];
+    new java.security.SecureRandom().nextBytes(x);
+    TransferTransaction tx = TransferTransaction.create(preSubSplitSource, recipientAddress, x, new byte[0]);
+    org.unicitylabs.sdk.api.CertificationResponse response =
+        context.getClient().submitCertificationRequest(
+            org.unicitylabs.sdk.api.CertificationData.fromTransaction(
+                tx, SignaturePredicateUnlockScript.create(tx, senderSigning)))
+            .get();
+    StepHelper.assertRespendRejected(context, tx, response);
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/steps/StateIdEncodingSteps.java b/src/test/java/org/unicitylabs/sdk/e2e/steps/StateIdEncodingSteps.java
new file mode 100644
index 0000000..b0dd700
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/steps/StateIdEncodingSteps.java
@@ -0,0 +1,71 @@
+package org.unicitylabs.sdk.e2e.steps;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
+
+import io.cucumber.java.en.Given;
+import io.cucumber.java.en.Then;
+import io.cucumber.java.en.When;
+import org.unicitylabs.sdk.api.StateId;
+import org.unicitylabs.sdk.crypto.hash.HashAlgorithm;
+import org.unicitylabs.sdk.serializer.cbor.CborSerializer;
+
+/**
+ * Steps for {@code state-id-encoding.feature}. Verifies that
+ * {@code StateId.fromCbor} accepts only 32-byte payloads and rejects legacy
+ * v1 (34-byte algorithm-prefixed) StateIDs.
+ */
+public class StateIdEncodingSteps {
+
+  private byte[] payload;
+  private StateId decoded;
+  private Throwable thrown;
+
+  @Given("a CBOR byte string of length {int}")
+  public void aCborByteStringOfLength(int length) {
+    byte[] raw = new byte[length];
+    payload = CborSerializer.encodeByteString(raw);
+  }
+
+  @Given("a CBOR byte string of length {int} starting with the sha256 algorithm prefix")
+  public void aCborByteStringWithSha256Prefix(int length) {
+    byte[] raw = new byte[length];
+    // Algorithm prefix in the legacy v1 format: 2 bytes encoding the SHA-256
+    // identifier. Concrete bytes don't matter for this rejection test.
+    raw[0] = (byte) ((HashAlgorithm.SHA256.getValue() >> 8) & 0xff);
+    raw[1] = (byte) (HashAlgorithm.SHA256.getValue() & 0xff);
+    payload = CborSerializer.encodeByteString(raw);
+  }
+
+  @When("StateId.fromCBOR is invoked")
+  public void stateIdFromCborIsInvoked() {
+    decoded = null;
+    thrown = null;
+    try {
+      decoded = StateId.fromCbor(payload);
+    } catch (Throwable t) {
+      thrown = t;
+    }
+  }
+
+  @Then("the StateId decode succeeds")
+  public void theStateIdDecodeSucceeds() {
+    assertNotNull(decoded, "expected successful decode but got: "
+        + (thrown != null ? thrown.getMessage() : "no result"));
+  }
+
+  @Then("the StateId decode throws with message containing {string}")
+  public void theStateIdDecodeThrowsWithMessage(String marker) {
+    assertNotNull(thrown, "expected decode to throw but it succeeded");
+    String msg = thrown.getMessage();
+    if (msg == null) {
+      Throwable cause = thrown.getCause();
+      msg = cause != null ? cause.getMessage() : "<no message>";
+    }
+    assertTrue(msg != null && msg.toLowerCase().contains(marker.toLowerCase()),
+        "expected message to contain '" + marker + "' but was: " + msg);
+  }
+
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/steps/TokenIdBoundarySteps.java b/src/test/java/org/unicitylabs/sdk/e2e/steps/TokenIdBoundarySteps.java
new file mode 100644
index 0000000..3257633
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/steps/TokenIdBoundarySteps.java
@@ -0,0 +1,58 @@
+package org.unicitylabs.sdk.e2e.steps;
+
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+
+import io.cucumber.java.en.When;
+import java.security.SecureRandom;
+import org.unicitylabs.sdk.api.CertificationData;
+import org.unicitylabs.sdk.predicate.Predicate;
+import org.unicitylabs.sdk.api.CertificationResponse;
+import org.unicitylabs.sdk.e2e.context.TestContext;
+import org.unicitylabs.sdk.serializer.cbor.CborSerializer;
+
+import org.unicitylabs.sdk.transaction.MintTransaction;
+import org.unicitylabs.sdk.transaction.TokenId;
+import org.unicitylabs.sdk.transaction.TokenType;
+
+public class TokenIdBoundarySteps {
+
+  private final TestContext context;
+
+  public TokenIdBoundarySteps(TestContext context) {
+    this.context = context;
+  }
+
+  @When("the user submits a mint request with a {int}-byte token ID")
+  public void theUserSubmitsMintRequestWithNByteTokenId(int length) throws Exception {
+    submitMintWithTokenIdBytes(length > 0 ? randomBytes(length) : new byte[0]);
+  }
+
+  @When("the user submits a mint request with a {int}-byte token ID again")
+  public void theUserSubmitsMintRequestWithNByteTokenIdAgain(int length) throws Exception {
+    // Second submission with a length-byte token ID — for 0-byte this collides
+    // with the prior submission because SHA256 of empty is deterministic; for
+    // non-zero lengths we'd need to thread the same bytes through context, which
+    // isn't needed for any current scenario.
+    submitMintWithTokenIdBytes(length > 0 ? randomBytes(length) : new byte[0]);
+  }
+
+  private void submitMintWithTokenIdBytes(byte[] idBytes) throws Exception {
+    String user = context.getCurrentUser() != null ? context.getCurrentUser() : "Alice";
+    context.setCurrentUser(user);
+    Predicate recipient = context.getUserAddresses().get(user);
+    assertNotNull(recipient, "user " + user + " has no signing key / address");
+
+    MintTransaction transaction = MintTransaction.create(recipient, new TokenId(idBytes), TokenType.generate(), null, CborSerializer.encodeArray());
+
+    CertificationData certificationData = CertificationData.fromMintTransaction(transaction);
+    CertificationResponse response =
+        context.getClient().submitCertificationRequest(certificationData).get();
+    context.setLastCertificationResponse(response);
+  }
+
+  private static byte[] randomBytes(int length) {
+    byte[] bytes = new byte[length];
+    new SecureRandom().nextBytes(bytes);
+    return bytes;
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/steps/TokenLifecycleSteps.java b/src/test/java/org/unicitylabs/sdk/e2e/steps/TokenLifecycleSteps.java
new file mode 100644
index 0000000..4df06b6
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/steps/TokenLifecycleSteps.java
@@ -0,0 +1,264 @@
+package org.unicitylabs.sdk.e2e.steps;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+
+import io.cucumber.java.en.Given;
+import io.cucumber.java.en.Then;
+import io.cucumber.java.en.When;
+import java.security.SecureRandom;
+import java.util.List;
+import org.unicitylabs.sdk.api.CertificationData;
+import org.unicitylabs.sdk.api.CertificationResponse;
+import org.unicitylabs.sdk.crypto.secp256k1.SigningService;
+import org.unicitylabs.sdk.e2e.context.TestContext;
+import org.unicitylabs.sdk.e2e.steps.shared.StepHelper;
+import org.unicitylabs.sdk.predicate.Predicate;
+import org.unicitylabs.sdk.predicate.builtin.SignaturePredicate;
+import org.unicitylabs.sdk.predicate.builtin.SignaturePredicateUnlockScript;
+import org.unicitylabs.sdk.transaction.Token;
+import org.unicitylabs.sdk.transaction.TransferTransaction;
+import org.unicitylabs.sdk.util.verification.VerificationStatus;
+import org.unicitylabs.sdk.utils.TokenUtils;
+
+public class TokenLifecycleSteps {
+
+  private final TestContext context;
+
+  public TokenLifecycleSteps(TestContext context) {
+    this.context = context;
+  }
+
+  // ─── Mint ──────────────────────────────────────────────────────────────────
+
+  @When("{word} mints a token")
+  public void userMintsAToken(String userName) throws Exception {
+    Predicate recipient = requireAddress(userName);
+    Token token = TokenUtils.mintToken(
+        context.getClient(),
+        context.getTrustBase(),
+        context.getPredicateVerifier(),
+        context.getMintJustificationVerifier(),
+        recipient
+    );
+    context.addUserToken(userName, token);
+    context.setCurrentToken(token);
+    context.setCurrentUser(userName);
+    if (context.getOriginalToken() == null) {
+      context.setOriginalToken(token);
+    }
+  }
+
+  @Given("{word} has a minted token")
+  public void userHasAMintedToken(String userName) throws Exception {
+    userMintsAToken(userName);
+  }
+
+  // ─── Transfer ──────────────────────────────────────────────────────────────
+
+  @When("{word} transfers the current token to {word}")
+  public void userTransfersTheCurrentTokenToRecipient(String sender, String recipient)
+      throws Exception {
+    Token sourceToken = context.getCurrentToken();
+    assertNotNull(sourceToken, "no current token to transfer");
+
+    Predicate recipientPredicate = requireAddress(recipient);
+    SigningService senderSigning = context.getUserSigningServices().get(sender);
+    assertNotNull(senderSigning, "no signing key for sender " + sender);
+
+    Token transferred = TokenUtils.transferToken(
+        context.getClient(),
+        context.getTrustBase(),
+        context.getPredicateVerifier(),
+        context.getMintJustificationVerifier(),
+        sourceToken.toCbor(),
+        recipientPredicate,
+        senderSigning
+    );
+
+    context.addUserToken(recipient, transferred);
+    context.setCurrentToken(transferred);
+    context.setCurrentUser(recipient);
+  }
+
+  @When("{word} transfers the token to {word}")
+  public void userTransfersTheTokenTo(String sender, String recipient) throws Exception {
+    userTransfersTheCurrentTokenToRecipient(sender, recipient);
+  }
+
+  @When("{word} transfers the token to {word} with 10KB of random data")
+  public void userTransfersTheTokenToRecipientWithLargeData(String sender, String recipient)
+      throws Exception {
+    Token sourceToken = context.getCurrentToken();
+    assertNotNull(sourceToken, "no current token to transfer");
+
+    byte[] data = new byte[10 * 1024];
+    new SecureRandom().nextBytes(data);
+
+    Predicate recipientPredicate = requireAddress(recipient);
+    SigningService senderSigning = context.getUserSigningServices().get(sender);
+    assertNotNull(senderSigning, "no signing key for sender " + sender);
+
+    byte[] x = new byte[32];
+    new SecureRandom().nextBytes(x);
+
+    TransferTransaction tx = TransferTransaction.create(
+        sourceToken, recipientPredicate, x, data);
+
+    Token transferred = TokenUtils.transferToken(
+        context.getClient(), context.getTrustBase(),
+        context.getPredicateVerifier(),
+        sourceToken,
+        tx,
+        SignaturePredicateUnlockScript.create(tx, senderSigning));
+
+    context.addUserToken(recipient, transferred);
+    context.setCurrentToken(transferred);
+    context.setCurrentUser(recipient);
+  }
+
+  @When("{word} creates a transfer to {word} signed with the wrong key")
+  public void userCreatesTransferSignedWithWrongKey(String sender, String recipient)
+      throws Exception {
+    Token sourceToken = context.getCurrentToken();
+    assertNotNull(sourceToken, "no current token");
+    Predicate recipientPredicate = requireAddress(recipient);
+
+    SigningService ownerSigning = context.getUserSigningServices().get(sender);
+    assertNotNull(ownerSigning, "no signing key for " + sender);
+
+    SigningService wrongSigning = SigningService.generate();
+
+    byte[] x = new byte[32];
+    new SecureRandom().nextBytes(x);
+
+    TransferTransaction tx = TransferTransaction.create(
+        sourceToken, recipientPredicate, x, new byte[0]);
+
+    CertificationData certificationData = CertificationData.fromTransaction(
+        tx, SignaturePredicateUnlockScript.create(tx, wrongSigning));
+
+    CertificationResponse response =
+        context.getClient().submitCertificationRequest(certificationData).get();
+    context.setLastCertificationResponse(response);
+  }
+
+  @When("{word} tries to submit a transfer of the stale token to {word}")
+  public void userTriesToSubmitATransferOfTheStaleTokenTo(String sender, String recipient)
+      throws Exception {
+    List<Token> senderTokens = context.getUserTokens().get(sender);
+    assertNotNull(senderTokens, "no stale token recorded for " + sender);
+    Token staleToken = senderTokens.get(0);
+
+    Predicate recipientPredicate = requireAddress(recipient);
+    SigningService senderSigning = context.getUserSigningServices().get(sender);
+    assertNotNull(senderSigning, "no signing key for sender " + sender);
+
+    byte[] x = new byte[32];
+    new SecureRandom().nextBytes(x);
+
+    TransferTransaction tx = TransferTransaction.create(
+        staleToken, recipientPredicate, x, new byte[0]);
+
+    CertificationData certificationData = CertificationData.fromTransaction(
+        tx, SignaturePredicateUnlockScript.create(tx, senderSigning));
+
+    CertificationResponse response =
+        context.getClient().submitCertificationRequest(certificationData).get();
+    context.setLastCertificationResponse(response);
+    context.setRespendTransaction(tx);
+  }
+
+  @Then("the re-spend is rejected without finalizing")
+  public void theRespendIsRejectedWithoutFinalizing() {
+    StepHelper.assertRespendRejected(
+        context, context.getRespendTransaction(), context.getLastCertificationResponse());
+  }
+
+  @When("the user mints a token with empty transaction data")
+  public void theUserMintsATokenWithEmptyTransactionData() throws Exception {
+    mintForCurrentUserWithData(new byte[0]);
+  }
+
+  @When("the user mints a token with 10KB of random transaction data")
+  public void theUserMintsATokenWith10KbOfRandomData() throws Exception {
+    byte[] data = new byte[10 * 1024];
+    new SecureRandom().nextBytes(data);
+    mintForCurrentUserWithData(data);
+  }
+
+  // ─── Verify ────────────────────────────────────────────────────────────────
+
+  @Then("the current token verifies successfully")
+  public void theCurrentTokenVerifiesSuccessfully() {
+    Token token = context.getCurrentToken();
+    assertNotNull(token, "no current token to verify");
+    assertEquals(
+        VerificationStatus.OK,
+        token.verify(
+            context.getTrustBase(),
+            context.getPredicateVerifier(),
+            context.getMintJustificationVerifier()).getStatus(),
+        "token verification failed");
+  }
+
+  @Then("the transferred token passes verification")
+  public void theTransferredTokenPassesVerification() {
+    theCurrentTokenVerifiesSuccessfully();
+  }
+
+  @Then("the certification response status is {string}")
+  public void theCertificationResponseStatusIs(String expected) {
+    if (context.getLastCertificationResponse() != null) {
+      assertEquals(
+          expected,
+          context.getLastCertificationResponse().getStatus().name(),
+          "unexpected certification status");
+      return;
+    }
+    if ("SUCCESS".equals(expected)) {
+      assertNotNull(context.getCurrentToken(), "expected SUCCESS but no token was produced");
+    } else {
+      throw new AssertionError(
+          "expected certification status " + expected
+              + " but no CertificationResponse was captured for assertion");
+    }
+  }
+
+  @Then("the current token is owned by {word}")
+  public void theCurrentTokenIsOwnedBy(String userName) {
+    assertEquals(userName, context.getCurrentUser());
+    assertNotNull(
+        context.getUserTokens().get(userName),
+        "no tokens recorded for user " + userName);
+  }
+
+  private Predicate requireAddress(String user) {
+    Predicate predicate = context.getUserAddresses().get(user);
+    if (predicate == null) {
+      SigningService signing = SigningService.generate();
+      SignaturePredicate sigPredicate = SignaturePredicate.create(signing.getPublicKey());
+      predicate = sigPredicate;
+      context.getUserSigningServices().put(user, signing);
+      context.getUserPredicates().put(user, sigPredicate);
+      context.getUserAddresses().put(user, predicate);
+    }
+    return predicate;
+  }
+
+  private void mintForCurrentUserWithData(byte[] data) throws Exception {
+    String user = context.getCurrentUser();
+    assertNotNull(user, "no current user — call 'a user with a signing key' first");
+    Predicate recipient = requireAddress(user);
+    Token token = TokenUtils.mintToken(
+        context.getClient(),
+        context.getTrustBase(),
+        context.getPredicateVerifier(),
+        context.getMintJustificationVerifier(),
+        recipient,
+        null,
+        data);
+    context.addUserToken(user, token);
+    context.setCurrentToken(token);
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/steps/TreeSteps.java b/src/test/java/org/unicitylabs/sdk/e2e/steps/TreeSteps.java
new file mode 100644
index 0000000..44e0e16
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/steps/TreeSteps.java
@@ -0,0 +1,297 @@
+package org.unicitylabs.sdk.e2e.steps;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import io.cucumber.java.en.Given;
+import io.cucumber.java.en.Then;
+import io.cucumber.java.en.When;
+import java.security.SecureRandom;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Set;
+import org.unicitylabs.sdk.api.CertificationData;
+import org.unicitylabs.sdk.predicate.Predicate;
+import org.unicitylabs.sdk.api.CertificationResponse;
+import org.unicitylabs.sdk.e2e.context.TestContext;
+import org.unicitylabs.sdk.e2e.support.TokenTree;
+import org.unicitylabs.sdk.e2e.support.TokenTreeBuilder;
+import org.unicitylabs.sdk.e2e.support.TreeUser;
+import org.unicitylabs.sdk.payment.TokenSplit;
+import org.unicitylabs.sdk.payment.asset.Asset;
+import org.unicitylabs.sdk.predicate.builtin.SignaturePredicate;
+import org.unicitylabs.sdk.predicate.builtin.SignaturePredicateUnlockScript;
+import org.unicitylabs.sdk.serializer.cbor.CborSerializer;
+
+import org.unicitylabs.sdk.transaction.Token;
+import org.unicitylabs.sdk.transaction.TokenId;
+import org.unicitylabs.sdk.transaction.TransferTransaction;
+import org.unicitylabs.sdk.util.verification.VerificationStatus;
+
+public class TreeSteps {
+
+  private final TestContext context;
+  private TokenTree tree;
+  private Exception lastError;
+  private CertificationResponse lastResponse;
+  private Token importedToken;
+
+  public TreeSteps(TestContext context) {
+    this.context = context;
+  }
+
+  // ── Setup ────────────────────────────────────────────────────────────────
+
+  @Given("the 4-level token tree is built")
+  public void the4LevelTokenTreeIsBuilt() throws Exception {
+    // The Background of tree features runs the aggregator setup step implicitly
+    // in TS — we need the aggregator up here. If AggregatorSteps.aMockAggregatorIsRunning
+    // wasn't called, bootstrap one.
+    if (context.getClient() == null) {
+      new AggregatorSteps(context).aMockAggregatorIsRunning();
+    }
+    // Cache-or-build: the first tree scenario pays the ~11 aggregator ops;
+    // every subsequent tree scenario re-uses the cached tree. Mirrors TS's
+    // module-level cachedTree in TokenTreeBuilder.ts. Restoring the cached
+    // tree's client/trustBase/verifier onto TestContext keeps downstream
+    // steps consistent across the ~136 tree scenarios.
+    tree = TokenTreeBuilder.buildOrReuse(
+        context.getClient(),
+        context.getTrustBase(),
+        context.getPredicateVerifier(),
+        context.getMintJustificationVerifier());
+    context.setClient(tree.getClient());
+    context.setTrustBase(tree.getTrustBase());
+    context.setPredicateVerifier(tree.getPredicateVerifier());
+    context.setMintJustificationVerifier(tree.getMintJustificationVerifier());
+  }
+
+  // ── Owner actions ────────────────────────────────────────────────────────
+
+  @When("{word} creates a transfer for {string}")
+  public void userCreatesATransferFor(String userName, String tokenName) {
+    TreeUser user = tree.requireUser(userName);
+    Token token = tree.requireToken(tokenName);
+    lastError = null;
+    try {
+      // Spawn a throw-away recipient to decouple from tree state.
+      TreeUser phantom = TreeUser.generate("phantom");
+      TransferTransaction.create(token, phantom.getPredicate(), randomBytes32(), CborSerializer.encodeArray());
+    } catch (Exception e) {
+      lastError = e;
+    }
+  }
+
+  @Then("the transfer creation succeeds")
+  public void theTransferCreationSucceeds() {
+    assertNull(lastError,
+        "transfer creation failed: "
+            + (lastError != null ? lastError.getMessage() : ""));
+  }
+
+  @When("{word} transfers {string} to {word}")
+  public void userTransfersTokenTo(String userName, String tokenName, String recipientName)
+      throws Exception {
+    TreeUser user = tree.requireUser(userName);
+    Token token = tree.requireToken(tokenName);
+    TreeUser recipient = tree.requireUser(recipientName);
+
+    Token transferred = org.unicitylabs.sdk.utils.TokenUtils.transferToken(
+        tree.getClient(),
+        tree.getTrustBase(),
+        tree.getPredicateVerifier(),
+        tree.getMintJustificationVerifier(),
+        token.toCbor(),
+        recipient.getPredicate(),
+        user.getSigningService());
+    context.setCurrentToken(transferred);
+  }
+
+  @When("{word} submits a duplicate transfer for pre-transfer token {string}")
+  public void userSubmitsADuplicateTransferForPreTransferToken(
+      String userName, String tokenName) throws Exception {
+    TreeUser user = tree.requireUser(userName);
+    Token token = tree.requireToken(tokenName);
+    TreeUser phantom = TreeUser.generate("phantom");
+
+    TransferTransaction tx = TransferTransaction.create(token, phantom.getPredicate(), randomBytes32(), CborSerializer.encodeArray());
+
+    CertificationData certData = CertificationData.fromTransaction(
+        tx, SignaturePredicateUnlockScript.create(tx, user.getSigningService()));
+    lastResponse = tree.getClient().submitCertificationRequest(certData).get();
+    // Hand the re-spend tx + response to the shared "never finalizes" assertion
+    // (rejected at submit OR at inclusion-proof verification). See #67.
+    context.setRespendTransaction(tx);
+    context.setLastCertificationResponse(lastResponse);
+  }
+
+  @Then("the aggregator responds with {string}")
+  public void theAggregatorRespondsWith(String status) {
+    assertNotNull(lastResponse, "no aggregator response captured");
+    assertEquals(status, lastResponse.getStatus().name(), "unexpected aggregator status");
+  }
+
+  @When("{word} tries to transfer {string}")
+  public void userTriesToTransferToken(String userName, String tokenName) {
+    TreeUser attacker = tree.requireUser(userName);
+    Token token = tree.requireToken(tokenName);
+    lastError = attemptUnauthorizedTransfer(attacker, token);
+  }
+
+  @Then("the transfer fails with predicate mismatch")
+  public void theTransferFailsWithPredicateMismatch() {
+    assertNotNull(lastError,
+        "expected transfer creation to fail but no error was recorded");
+  }
+
+  @When("{word} tries to split {string}")
+  public void userTriesToSplitToken(String userName, String tokenName) {
+    TreeUser attacker = tree.requireUser(userName);
+    Token token = tree.requireToken(tokenName);
+    lastError = attemptUnauthorizedSplit(attacker, token);
+  }
+
+  /**
+   * Post-PR #112 negative-path helper. {@code TransferTransaction.create} no
+   * longer takes an owner predicate, so wrong-owner detection moves to the
+   * predicate-verifier layer. Mirror of TS {@code attemptUnauthorizedTransfer}
+   * in {@code TestSetup.ts}.
+   */
+  private Exception attemptUnauthorizedTransfer(TreeUser attacker, Token token) {
+    try {
+      TreeUser phantom = TreeUser.generate("phantom");
+      TransferTransaction tx = TransferTransaction.create(
+          token, phantom.getPredicate(), randomBytes32(), CborSerializer.encodeArray());
+      org.unicitylabs.sdk.predicate.UnlockScript unlock =
+          SignaturePredicateUnlockScript.create(tx, attacker.getSigningService());
+
+      org.unicitylabs.sdk.transaction.Transaction latest = token.getLatestTransaction();
+      org.unicitylabs.sdk.util.verification.VerificationResult<VerificationStatus> result =
+          tree.getPredicateVerifier().verify(
+              latest.getRecipient(),
+              tx.getSourceStateHash(),
+              tx.calculateTransactionHash(),
+              unlock.encode());
+
+      return result.getStatus() == VerificationStatus.OK
+          ? null
+          : new RuntimeException(
+              "Predicate verification rejected: " + result.getMessage());
+    } catch (Exception e) {
+      return e;
+    }
+  }
+
+  /**
+   * Post-PR #112 negative-path helper for splits. {@code TokenSplit.split} no
+   * longer enforces ownership — it builds a burn TransferTransaction
+   * internally, and rejection moves to the predicate-verifier layer when the
+   * burn is signed and submitted. Mirror of TS {@code attemptUnauthorizedSplit}
+   * in {@code TestSetup.ts}.
+   */
+  private Exception attemptUnauthorizedSplit(TreeUser attacker, Token token) {
+    try {
+      Map<TokenId, Set<Asset>> plan = new HashMap<>();
+      plan.put(TokenId.generate(),
+          Set.of(new Asset(tree.getAssetId1(), java.math.BigInteger.ONE)));
+      org.unicitylabs.sdk.payment.SplitResult split =
+          TokenSplit.split(token, tree.parserFor(tokenName_default()), plan);
+      org.unicitylabs.sdk.transaction.TransferTransaction burnTx = split.getBurnTransaction();
+      org.unicitylabs.sdk.predicate.UnlockScript unlock =
+          SignaturePredicateUnlockScript.create(burnTx, attacker.getSigningService());
+
+      org.unicitylabs.sdk.transaction.Transaction latest = token.getLatestTransaction();
+      org.unicitylabs.sdk.util.verification.VerificationResult<VerificationStatus> result =
+          tree.getPredicateVerifier().verify(
+              latest.getRecipient(),
+              burnTx.getSourceStateHash(),
+              burnTx.calculateTransactionHash(),
+              unlock.encode());
+
+      return result.getStatus() == VerificationStatus.OK
+          ? null
+          : new RuntimeException(
+              "Predicate verification rejected: " + result.getMessage());
+    } catch (Exception e) {
+      return e;
+    }
+  }
+
+  /** Default parser key — every tree token uses TestPaymentData post-issue-52. */
+  private static String tokenName_default() {
+    return "T0_burned"; // any name works, parserFor returns TestPaymentData::decode
+  }
+
+  @Then("the split fails with predicate mismatch")
+  public void theSplitFailsWithPredicateMismatch() {
+    assertNotNull(lastError, "expected split to fail but no error was recorded");
+  }
+
+  // ── Verification ─────────────────────────────────────────────────────────
+  // Note: "the transferred token passes verification" is handled by TokenLifecycleSteps
+  // (it reads context.getCurrentToken() which our transfer step populates).
+
+  @Then("{string} passes verification")
+  public void namedTokenPassesVerification(String tokenName) {
+    Token token = tree.requireToken(tokenName);
+    assertEquals(
+        VerificationStatus.OK,
+        token.verify(
+            tree.getTrustBase(),
+            tree.getPredicateVerifier(),
+            tree.getMintJustificationVerifier()).getStatus(),
+        "verification failed for " + tokenName);
+  }
+
+  @Then("{string} passes split verification")
+  public void namedTokenPassesSplitVerification(String tokenName) {
+    // Post-issue-52 SDK: TokenSplit.verify is gone — split-mint verification
+    // happens inside Token.verify via the MintJustificationVerifierService
+    // registry. T0 is a simple-payment token (no SplitMintJustification);
+    // calling Token.verify is still correct — the registry's split verifier
+    // simply does not fire for it.
+    Token token = tree.requireToken(tokenName);
+    assertEquals(
+        VerificationStatus.OK,
+        token.verify(
+            tree.getTrustBase(),
+            tree.getPredicateVerifier(),
+            tree.getMintJustificationVerifier()).getStatus(),
+        "split verification failed for " + tokenName);
+  }
+
+  @When("{string} is exported to CBOR and imported back")
+  public void tokenIsExportedToCborAndImportedBack(String tokenName) {
+    Token original = tree.requireToken(tokenName);
+    Token imported = Token.fromCbor(original.toCbor());
+    // Route through TestContext so CborSteps' existing assertion steps work.
+    context.setCurrentToken(original);
+    context.setImportedToken(imported);
+  }
+
+  @Then("the imported token has the same ID as {string}")
+  public void theImportedTokenHasTheSameIdAs(String tokenName) {
+    Token imported = context.getImportedToken();
+    assertNotNull(imported, "no imported token");
+    assertEquals(tree.requireToken(tokenName).getId(), imported.getId(),
+        "token ID mismatch after CBOR roundtrip");
+  }
+  // "the imported token passes verification" is handled by CborSteps.
+
+  // ── Helpers ──────────────────────────────────────────────────────────────
+
+  private static byte[] randomBytes32() {
+    byte[] b = new byte[32];
+    new SecureRandom().nextBytes(b);
+    return b;
+  }
+
+  // Guards against accidentally depending on AggregatorSteps without an AggregatorSteps
+  // instance in this scenario's step cycle. Checked style only — not used directly.
+  @SuppressWarnings("unused")
+  private void ensureAggregatorUp() {
+    assertTrue(context.getClient() != null, "aggregator not initialized");
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/steps/TrustBaseSteps.java b/src/test/java/org/unicitylabs/sdk/e2e/steps/TrustBaseSteps.java
new file mode 100644
index 0000000..cdcb4c4
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/steps/TrustBaseSteps.java
@@ -0,0 +1,39 @@
+package org.unicitylabs.sdk.e2e.steps;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+
+import io.cucumber.java.en.Then;
+import org.unicitylabs.sdk.TestAggregatorClient;
+import org.unicitylabs.sdk.e2e.context.TestContext;
+import org.unicitylabs.sdk.predicate.verification.PredicateVerifierService;
+import org.unicitylabs.sdk.transaction.Token;
+import org.unicitylabs.sdk.util.verification.VerificationStatus;
+
+public class TrustBaseSteps {
+
+  private final TestContext context;
+
+  public TrustBaseSteps(TestContext context) {
+    this.context = context;
+  }
+
+  @Then("the token fails verification against a different trust base")
+  public void theTokenFailsVerificationAgainstADifferentTrustBase() {
+    Token token = context.getCurrentToken();
+    assertNotNull(token, "no current token to verify");
+
+    // Spin up an independent mock aggregator — it generates its own trust base
+    // rooted in a different key, so our token's certified mint signature will
+    // not validate against it.
+    TestAggregatorClient rival = TestAggregatorClient.create();
+    PredicateVerifierService rivalVerifier = PredicateVerifierService.create();
+    org.unicitylabs.sdk.transaction.verification.MintJustificationVerifierService rivalMjv =
+        new org.unicitylabs.sdk.transaction.verification.MintJustificationVerifierService();
+
+    assertEquals(
+        VerificationStatus.FAIL,
+        token.verify(rival.getTrustBase(), rivalVerifier, rivalMjv).getStatus(),
+        "token unexpectedly verified against foreign trust base");
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/steps/UserSteps.java b/src/test/java/org/unicitylabs/sdk/e2e/steps/UserSteps.java
new file mode 100644
index 0000000..f493b35
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/steps/UserSteps.java
@@ -0,0 +1,49 @@
+package org.unicitylabs.sdk.e2e.steps;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import io.cucumber.java.en.Given;
+import org.unicitylabs.sdk.crypto.secp256k1.SigningService;
+import org.unicitylabs.sdk.predicate.Predicate;
+import org.unicitylabs.sdk.e2e.context.TestContext;
+import org.unicitylabs.sdk.predicate.builtin.SignaturePredicate;
+
+
+public class UserSteps {
+
+  private final TestContext context;
+
+  public UserSteps(TestContext context) {
+    this.context = context;
+  }
+
+  @Given("{word} has a signing key")
+  public void userHasASigningKey(String userName) {
+    SigningService signing = SigningService.generate();
+    SignaturePredicate predicate = SignaturePredicate.create(signing.getPublicKey());
+    Predicate address = predicate;
+
+    context.getUserSigningServices().put(userName, signing);
+    context.getUserPredicates().put(userName, predicate);
+    context.getUserAddresses().put(userName, address);
+  }
+
+  @Given("users {string}, {string} and {string} each have a signing key")
+  public void threeUsersHaveSigningKeys(String a, String b, String c) {
+    for (String name : new String[] {a, b, c}) {
+      userHasASigningKey(name);
+    }
+    assertTrue(context.getUserSigningServices().size() >= 3);
+  }
+
+  @Given("{word} is a registered user")
+  public void userIsARegisteredUser(String userName) {
+    userHasASigningKey(userName);
+  }
+
+  @Given("a user with a signing key")
+  public void aUserWithASigningKey() {
+    userHasASigningKey("Alice");
+    context.setCurrentUser("Alice");
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/steps/VerificationSteps.java b/src/test/java/org/unicitylabs/sdk/e2e/steps/VerificationSteps.java
new file mode 100644
index 0000000..f4969e3
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/steps/VerificationSteps.java
@@ -0,0 +1,77 @@
+package org.unicitylabs.sdk.e2e.steps;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import io.cucumber.java.en.Then;
+import io.cucumber.java.en.When;
+import org.unicitylabs.sdk.e2e.context.TestContext;
+import org.unicitylabs.sdk.transaction.Token;
+import org.unicitylabs.sdk.util.verification.VerificationResult;
+import org.unicitylabs.sdk.util.verification.VerificationStatus;
+
+public class VerificationSteps {
+
+  private final TestContext context;
+  private VerificationResult<VerificationStatus> lastResult;
+
+  public VerificationSteps(TestContext context) {
+    this.context = context;
+  }
+
+  @When("the token is verified against the trust base")
+  public void theTokenIsVerifiedAgainstTheTrustBase() {
+    Token token = context.getCurrentToken();
+    assertNotNull(token, "no current token to verify");
+    lastResult = token.verify(context.getTrustBase(), context.getPredicateVerifier(), context.getMintJustificationVerifier());
+  }
+
+  @When("the transferred token is verified against the trust base")
+  public void theTransferredTokenIsVerifiedAgainstTheTrustBase() {
+    theTokenIsVerifiedAgainstTheTrustBase();
+  }
+
+  @Then("the verification result has rule {string} with status {string}")
+  public void theVerificationResultHasRuleWithStatus(String rule, String status) {
+    assertNotNull(lastResult, "no verification result captured");
+    assertEquals(rule, lastResult.getRule(), "unexpected top-level rule");
+    assertEquals(VerificationStatus.valueOf(status), lastResult.getStatus(),
+        "unexpected top-level status");
+  }
+
+  @Then("the verification result contains {int} sub-results")
+  public void theVerificationResultContainsSubResults(int expected) {
+    assertNotNull(lastResult, "no verification result captured");
+    assertEquals(expected, lastResult.getResults().size(),
+        "unexpected sub-result count");
+  }
+
+  @Then("sub-result {int} has rule {string} with status {string}")
+  public void subResultHasRuleWithStatus(int index, String rule, String status) {
+    assertNotNull(lastResult, "no verification result captured");
+    assertTrue(lastResult.getResults().size() >= index,
+        "sub-result index " + index + " out of range");
+    VerificationResult<?> sub = lastResult.getResults().get(index - 1);
+    assertEquals(rule, sub.getRule(), "unexpected sub-result rule at index " + index);
+    assertEquals(status, sub.getStatus().toString(),
+        "unexpected sub-result status at index " + index);
+  }
+
+  @Then("the transfer verification sub-result contains {int} entry")
+  public void transferVerificationSubResultContains1Entry(int expected) {
+    transferVerificationSubResultContainsNEntries(expected);
+  }
+
+  @Then("the transfer verification sub-result contains {int} entries")
+  public void transferVerificationSubResultContainsNEntries(int expected) {
+    assertNotNull(lastResult, "no verification result captured");
+    VerificationResult<?> transferResult = lastResult.getResults().stream()
+        .filter(r -> "TokenTransferVerification".equals(r.getRule()))
+        .findFirst()
+        .orElse(null);
+    assertNotNull(transferResult, "no TokenTransferVerification sub-result found");
+    assertEquals(expected, transferResult.getResults().size(),
+        "unexpected transfer sub-result count");
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/steps/shared/StepHelper.java b/src/test/java/org/unicitylabs/sdk/e2e/steps/shared/StepHelper.java
new file mode 100644
index 0000000..a22efe0
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/steps/shared/StepHelper.java
@@ -0,0 +1,77 @@
+package org.unicitylabs.sdk.e2e.steps.shared;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.fail;
+
+import org.unicitylabs.sdk.api.CertificationResponse;
+import org.unicitylabs.sdk.e2e.context.TestContext;
+import org.unicitylabs.sdk.transaction.Transaction;
+import org.unicitylabs.sdk.util.InclusionProofUtils;
+
+/**
+ * Thin container for stateless helpers shared across step classes. Put logic here only if it does
+ * not need scenario state — anything scenario-scoped belongs on the injected {@code TestContext}.
+ */
+public final class StepHelper {
+
+  private StepHelper() {}
+
+  /**
+   * Asserts that a double-spend / re-spend attempt (a NEW transaction spending an already-finalized
+   * state) is rejected without ever finalizing into a valid token.
+   *
+   * <p>This encodes the canonical v2 aggregator contract (aggregator-go async-submit, see
+   * state-transition-sdk-java#67): the finalized-duplicate lookup at submit time was removed, so the
+   * submit layer returns {@code SUCCESS} and the double-spend is caught one layer later, at
+   * inclusion-proof verification, with {@code TRANSACTION_HASH_MISMATCH} (the committed leaf carries
+   * the FIRST transaction's hash). A legacy/strict aggregator that still rejects at submit with
+   * {@code STATE_ID_EXISTS} is also accepted — either way the invariant "the re-spend never yields a
+   * valid token" holds, so this assertion is correct on every aggregator build and topology.
+   *
+   * @param context        scenario context (client, trust base, predicate verifier)
+   * @param respendTx      the re-spend transaction that must not finalize
+   * @param submitResponse the certification response from submitting {@code respendTx}
+   */
+  public static void assertRespendRejected(
+      TestContext context, Transaction respendTx, CertificationResponse submitResponse) {
+    assertNotNull(submitResponse, "no submit response captured for the re-spend");
+    assertNotNull(respendTx, "no re-spend transaction captured");
+
+    String status = submitResponse.getStatus().name();
+
+    // Legacy/strict aggregator: rejected at submit. Nothing more to verify.
+    if ("STATE_ID_EXISTS".equals(status)) {
+      return;
+    }
+
+    // Canonical v2: accepted at submit, must be rejected at proof verification.
+    assertEquals(
+        "SUCCESS",
+        status,
+        "re-spend submit must be SUCCESS (v2 async) or STATE_ID_EXISTS (legacy), but was: " + status);
+    try {
+      InclusionProofUtils.waitInclusionProof(
+              context.getClient(),
+              context.getTrustBase(),
+              context.getPredicateVerifier(),
+              respendTx)
+          .get();
+      fail("expected the re-spend to be rejected at inclusion proof with TRANSACTION_HASH_MISMATCH");
+    } catch (Exception e) {
+      assertChainMentions(e, "TRANSACTION_HASH_MISMATCH");
+    }
+  }
+
+  /** Walks the cause chain asserting {@code marker} appears in some message. */
+  private static void assertChainMentions(Throwable e, String marker) {
+    Throwable t = e;
+    while (t != null) {
+      if (t.getMessage() != null && t.getMessage().contains(marker)) {
+        return;
+      }
+      t = t.getCause();
+    }
+    fail("expected status '" + marker + "' in exception chain but got: " + e);
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/support/ForgivingTestAggregatorClient.java b/src/test/java/org/unicitylabs/sdk/e2e/support/ForgivingTestAggregatorClient.java
new file mode 100644
index 0000000..ce5f398
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/support/ForgivingTestAggregatorClient.java
@@ -0,0 +1,55 @@
+package org.unicitylabs.sdk.e2e.support;
+
+import java.util.concurrent.CompletableFuture;
+import org.unicitylabs.sdk.TestAggregatorClient;
+import org.unicitylabs.sdk.api.AggregatorClient;
+import org.unicitylabs.sdk.api.CertificationData;
+import org.unicitylabs.sdk.api.CertificationResponse;
+import org.unicitylabs.sdk.api.InclusionProofResponse;
+import org.unicitylabs.sdk.api.StateId;
+import org.unicitylabs.sdk.api.bft.RootTrustBase;
+
+/**
+ * Forgiving counterpart to {@link StrictTestAggregatorClient}. Duplicate
+ * {@code StateId} submissions return SUCCESS (silently keeping the first
+ * leaf). Matches the TS mock's current behavior — used for scenarios that
+ * exercise inclusion-proof mismatch detection downstream of a forgiving
+ * aggregator (e.g. {@code double-spend-prevention.feature}, the TS
+ * {@code token-certification-status.feature} duplicate-mint row).
+ *
+ * <p>This is purely test-side: Tier D of BDD_MIGRATION_PLAN.md §7.4.4.
+ */
+public final class ForgivingTestAggregatorClient implements AggregatorClient {
+
+  private final TestAggregatorClient inner;
+
+  private ForgivingTestAggregatorClient(TestAggregatorClient inner) {
+    this.inner = inner;
+  }
+
+  public static ForgivingTestAggregatorClient create() {
+    return new ForgivingTestAggregatorClient(TestAggregatorClient.create());
+  }
+
+  public RootTrustBase getTrustBase() {
+    return inner.getTrustBase();
+  }
+
+  @Override
+  public CompletableFuture<CertificationResponse> submitCertificationRequest(
+      CertificationData certificationData) {
+    // Delegate as-is — inner is idempotent-and-SUCCESS for duplicates, which
+    // is the forgiving semantics we want.
+    return inner.submitCertificationRequest(certificationData);
+  }
+
+  @Override
+  public CompletableFuture<InclusionProofResponse> getInclusionProof(StateId stateId) {
+    return inner.getInclusionProof(stateId);
+  }
+
+  @Override
+  public CompletableFuture<Long> getBlockHeight() {
+    return inner.getBlockHeight();
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/support/NametagRegistry.java b/src/test/java/org/unicitylabs/sdk/e2e/support/NametagRegistry.java
new file mode 100644
index 0000000..a81895a
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/support/NametagRegistry.java
@@ -0,0 +1,76 @@
+package org.unicitylabs.sdk.e2e.support;
+
+import org.unicitylabs.sdk.StateTransitionClient;
+import org.unicitylabs.sdk.api.CertificationData;
+import org.unicitylabs.sdk.api.CertificationResponse;
+import org.unicitylabs.sdk.api.CertificationStatus;
+import org.unicitylabs.sdk.api.InclusionProof;
+import org.unicitylabs.sdk.api.bft.RootTrustBase;
+import org.unicitylabs.sdk.crypto.secp256k1.SigningService;
+import org.unicitylabs.sdk.predicate.builtin.SignaturePredicate;
+import org.unicitylabs.sdk.predicate.builtin.SignaturePredicateUnlockScript;
+import org.unicitylabs.sdk.predicate.verification.PredicateVerifierService;
+import org.unicitylabs.sdk.transaction.TokenType;
+import org.unicitylabs.sdk.unicityid.CertifiedUnicityIdMintTransaction;
+import org.unicitylabs.sdk.unicityid.UnicityId;
+import org.unicitylabs.sdk.unicityid.UnicityIdMintTransaction;
+import org.unicitylabs.sdk.unicityid.UnicityIdToken;
+import org.unicitylabs.sdk.util.InclusionProofUtils;
+
+/**
+ * Test-side helper that mints a {@link UnicityIdToken} representing a user's
+ * nametag registration. Mirrors {@code registerNametag} from the TS BDD
+ * support layer.
+ */
+public final class NametagRegistry {
+
+  private NametagRegistry() {}
+
+  /**
+   * Registers a nametag for the given user in the given domain.
+   *
+   * @param client            state transition client
+   * @param trustBase         root trust base
+   * @param predicateVerifier predicate verifier service
+   * @param userPredicate     the user's signing predicate (used as recipient + targetPredicate)
+   * @param name              nametag without the leading {@code @}
+   * @param domain            registration domain (defaults to "bdd/test")
+   * @return the freshly minted UnicityIdToken
+   */
+  public static UnicityIdToken registerNametag(
+      StateTransitionClient client,
+      RootTrustBase trustBase,
+      PredicateVerifierService predicateVerifier,
+      SignaturePredicate userPredicate,
+      String name,
+      String domain) throws Exception {
+
+    SigningService nametagSigningService = SigningService.generate();
+    SignaturePredicate nametagSigningPredicate =
+        SignaturePredicate.fromSigningService(nametagSigningService);
+    UnicityId unicityId = new UnicityId(name, domain == null ? "bdd/test" : domain);
+
+    UnicityIdMintTransaction mintTransaction = UnicityIdMintTransaction.create(
+        nametagSigningPredicate,
+        userPredicate,
+        unicityId,
+        TokenType.generate(),
+        userPredicate);
+
+    CertificationData certificationData = CertificationData.fromTransaction(
+        mintTransaction,
+        SignaturePredicateUnlockScript.create(mintTransaction, nametagSigningService));
+
+    CertificationResponse response = client.submitCertificationRequest(certificationData).get();
+    if (response.getStatus() != CertificationStatus.SUCCESS) {
+      throw new IllegalStateException(
+          "Nametag registration failed: " + response.getStatus());
+    }
+
+    InclusionProof inclusionProof = InclusionProofUtils.waitInclusionProof(
+        client, trustBase, predicateVerifier, mintTransaction).get();
+    CertifiedUnicityIdMintTransaction certified =
+        mintTransaction.toCertifiedTransaction(trustBase, predicateVerifier, inclusionProof);
+    return UnicityIdToken.mint(trustBase, predicateVerifier, certified);
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/support/ShardAwareAggregatorClient.java b/src/test/java/org/unicitylabs/sdk/e2e/support/ShardAwareAggregatorClient.java
new file mode 100644
index 0000000..5cbfdda
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/support/ShardAwareAggregatorClient.java
@@ -0,0 +1,106 @@
+package org.unicitylabs.sdk.e2e.support;
+
+import java.util.Map;
+import java.util.Objects;
+import java.util.concurrent.CompletableFuture;
+import org.unicitylabs.sdk.api.AggregatorClient;
+import org.unicitylabs.sdk.api.CertificationData;
+import org.unicitylabs.sdk.api.CertificationResponse;
+import org.unicitylabs.sdk.api.InclusionProofResponse;
+import org.unicitylabs.sdk.api.StateId;
+
+/**
+ * Test-only multi-shard {@link AggregatorClient} decorator that routes
+ * requests to the correct shard aggregator based on the {@link StateId}.
+ *
+ * <p>Mirrors the TS-side {@code ShardAwareAggregatorClient} so the bft-shard
+ * routing pin tests can exercise the exact same logic in Java.
+ *
+ * <p>Two routing modes are supported:
+ * <ul>
+ *   <li>{@code lsb} — least-significant bits of {@code stateId.data} starting
+ *   at byte 0, bit-by-bit. Mirrors the Go aggregator's MatchesShardPrefix.</li>
+ *   <li>{@code msb} — most-significant bits of byte 0 first, used by the
+ *   bft-shard mode introduced in aggregator PR #146.</li>
+ * </ul>
+ */
+public final class ShardAwareAggregatorClient implements AggregatorClient {
+
+  public enum RoutingMode { LSB, MSB }
+
+  private final RoutingMode routingMode;
+  private final int shardIdLength;
+  private final Map<Integer, AggregatorClient> shardMap;
+
+  public ShardAwareAggregatorClient(
+      int shardIdLength,
+      Map<Integer, AggregatorClient> shardMap,
+      RoutingMode routingMode) {
+    this.shardIdLength = shardIdLength;
+    this.shardMap = Objects.requireNonNull(shardMap, "shardMap");
+    this.routingMode = Objects.requireNonNull(routingMode, "routingMode");
+
+    int baseId = 1 << shardIdLength;
+    int expectedCount = 1 << shardIdLength;
+    for (int i = 0; i < expectedCount; i++) {
+      int shardId = baseId + i;
+      if (!shardMap.containsKey(shardId)) {
+        throw new IllegalArgumentException(
+            "Missing client for shard ID " + shardId + ". Expected all shard IDs from "
+                + baseId + " to " + (baseId + expectedCount - 1));
+      }
+    }
+  }
+
+  public static int getShardForStateId(StateId stateId, int shardIdLength, RoutingMode routingMode) {
+    if (shardIdLength == 0) {
+      return 1;
+    }
+
+    byte[] data = stateId.getData();
+
+    if (routingMode == RoutingMode.MSB) {
+      // MSB mode: read top bits of byte 0 first, then byte 1, etc.
+      int shardBits = 0;
+      int consumed = 0;
+      int byteIdx = 0;
+      while (consumed < shardIdLength) {
+        int remaining = shardIdLength - consumed;
+        int take = Math.min(8, remaining);
+        int top = (data[byteIdx] & 0xff) >>> (8 - take);
+        shardBits = (shardBits << take) | top;
+        consumed += take;
+        byteIdx += 1;
+      }
+      return (1 << shardIdLength) | shardBits;
+    }
+
+    // LSB mode: bit-by-bit, LSB-first across bytes starting at byte 0.
+    int shardBits = 0;
+    for (int d = 0; d < shardIdLength; d++) {
+      int bit = ((data[d >>> 3] & 0xff) >>> (d & 7)) & 1;
+      shardBits |= bit << d;
+    }
+    return (1 << shardIdLength) | shardBits;
+  }
+
+  @Override
+  public CompletableFuture<InclusionProofResponse> getInclusionProof(StateId stateId) {
+    int shardId = getShardForStateId(stateId, shardIdLength, routingMode);
+    return shardMap.get(shardId).getInclusionProof(stateId);
+  }
+
+  @Override
+  public CompletableFuture<CertificationResponse> submitCertificationRequest(
+      CertificationData certificationData) {
+    StateId stateId = StateId.fromCertificationData(certificationData);
+    int shardId = getShardForStateId(stateId, shardIdLength, routingMode);
+    return shardMap.get(shardId).submitCertificationRequest(certificationData);
+  }
+
+  @Override
+  public CompletableFuture<Long> getBlockHeight() {
+    // Pick any backend — block height is not shard-specific in tests.
+    return shardMap.values().iterator().next().getBlockHeight();
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/support/SimulatedShardPool.java b/src/test/java/org/unicitylabs/sdk/e2e/support/SimulatedShardPool.java
new file mode 100644
index 0000000..2695ac1
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/support/SimulatedShardPool.java
@@ -0,0 +1,91 @@
+package org.unicitylabs.sdk.e2e.support;
+
+import java.util.ArrayList;
+import java.util.List;
+import org.unicitylabs.sdk.StateTransitionClient;
+import org.unicitylabs.sdk.api.bft.RootTrustBase;
+import org.unicitylabs.sdk.functional.payment.TestPaymentData;
+import org.unicitylabs.sdk.payment.SplitMintJustificationVerifier;
+import org.unicitylabs.sdk.predicate.verification.PredicateVerifierService;
+import org.unicitylabs.sdk.transaction.verification.MintJustificationVerifierService;
+
+/**
+ * Simulated multi-shard pool. If {@code SHARD_0_URL} env var is present, we
+ * would construct JSON-RPC clients against real shards — currently not
+ * implemented (stub); hermetic mode uses N independent
+ * {@link StrictTestAggregatorClient} instances as "shards".
+ *
+ * <p>Rationale: the shard-load feature exercises routing / batching logic
+ * across multiple aggregators. On real topology the pool points at
+ * {@code SHARD_<n>_URL}. Here the pool creates multiple in-memory strict
+ * aggregators so the test can verify that batches-per-shard complete without
+ * cross-shard interference. Trade-off: each simulated shard has its own
+ * trust base, so a full end-to-end verification across shards would need a
+ * shared trust base — out of scope for this lean scaffold.
+ */
+public final class SimulatedShardPool {
+
+  private final List<StrictTestAggregatorClient> shards;
+  private final List<StateTransitionClient> clients;
+  private final List<PredicateVerifierService> verifiers;
+  private final List<MintJustificationVerifierService> mjvs;
+  private final List<RootTrustBase> trustBases;
+
+  private SimulatedShardPool(
+      List<StrictTestAggregatorClient> shards,
+      List<StateTransitionClient> clients,
+      List<PredicateVerifierService> verifiers,
+      List<MintJustificationVerifierService> mjvs,
+      List<RootTrustBase> trustBases) {
+    this.shards = shards;
+    this.clients = clients;
+    this.verifiers = verifiers;
+    this.mjvs = mjvs;
+    this.trustBases = trustBases;
+  }
+
+  public static SimulatedShardPool create(int shardCount) {
+    List<StrictTestAggregatorClient> shards = new ArrayList<>();
+    List<StateTransitionClient> clients = new ArrayList<>();
+    List<PredicateVerifierService> verifiers = new ArrayList<>();
+    List<MintJustificationVerifierService> mjvs = new ArrayList<>();
+    List<RootTrustBase> trustBases = new ArrayList<>();
+    for (int i = 0; i < shardCount; i++) {
+      StrictTestAggregatorClient shard = StrictTestAggregatorClient.create();
+      shards.add(shard);
+      clients.add(new StateTransitionClient(shard));
+      trustBases.add(shard.getTrustBase());
+      PredicateVerifierService predVer = PredicateVerifierService.create();
+      verifiers.add(predVer);
+      MintJustificationVerifierService mjv = new MintJustificationVerifierService();
+      mjv.register(new SplitMintJustificationVerifier(
+          shard.getTrustBase(), predVer, TestPaymentData::decode));
+      mjvs.add(mjv);
+    }
+    return new SimulatedShardPool(shards, clients, verifiers, mjvs, trustBases);
+  }
+
+  public int size() {
+    return shards.size();
+  }
+
+  public StateTransitionClient clientFor(int shardIndex) {
+    return clients.get(shardIndex);
+  }
+
+  public RootTrustBase trustBaseFor(int shardIndex) {
+    return trustBases.get(shardIndex);
+  }
+
+  public PredicateVerifierService verifierFor(int shardIndex) {
+    return verifiers.get(shardIndex);
+  }
+
+  public MintJustificationVerifierService mjvFor(int shardIndex) {
+    return mjvs.get(shardIndex);
+  }
+
+  public static boolean hasRealTopology() {
+    return System.getenv("SHARD_0_URL") != null;
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/support/StrictTestAggregatorClient.java b/src/test/java/org/unicitylabs/sdk/e2e/support/StrictTestAggregatorClient.java
new file mode 100644
index 0000000..92fa2d9
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/support/StrictTestAggregatorClient.java
@@ -0,0 +1,74 @@
+package org.unicitylabs.sdk.e2e.support;
+
+import java.util.Set;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.ConcurrentHashMap;
+import org.unicitylabs.sdk.TestAggregatorClient;
+import org.unicitylabs.sdk.api.AggregatorClient;
+import org.unicitylabs.sdk.api.CertificationData;
+import org.unicitylabs.sdk.api.CertificationResponse;
+import org.unicitylabs.sdk.api.CertificationStatus;
+import org.unicitylabs.sdk.api.InclusionProofResponse;
+import org.unicitylabs.sdk.api.StateId;
+import org.unicitylabs.sdk.api.bft.RootTrustBase;
+
+/**
+ * BDD-owned strict wrapper around {@link TestAggregatorClient} that matches the
+ * production aggregator's behavior: the second and subsequent submissions for
+ * any {@link StateId} return {@link CertificationStatus#STATE_ID_EXISTS}
+ * instead of a silent SUCCESS no-op.
+ *
+ * <p>Rationale: the shared {@code TestAggregatorClient} in the SDK repo silently
+ * accepts duplicate submissions, which diverges from the production contract
+ * encoded in {@code CertificationStatus.STATE_ID_EXISTS}. Rather than modify
+ * the SDK-owned mock (breaking {@code FunctionalCommonFlowTest} etc.), BDD
+ * tests construct this wrapper and get production-faithful behavior. See
+ * BDD_MIGRATION_PLAN.md §7.2 for the notification owed to SDK authors.
+ *
+ * <p>This wrapper depends only on the SDK's public {@code AggregatorClient}
+ * interface — no internal coupling.
+ */
+public final class StrictTestAggregatorClient implements AggregatorClient {
+
+  private final TestAggregatorClient inner;
+  private final Set<StateId> acceptedStateIds = ConcurrentHashMap.newKeySet();
+
+  private StrictTestAggregatorClient(TestAggregatorClient inner) {
+    this.inner = inner;
+  }
+
+  public static StrictTestAggregatorClient create() {
+    return new StrictTestAggregatorClient(TestAggregatorClient.create());
+  }
+
+  public RootTrustBase getTrustBase() {
+    return inner.getTrustBase();
+  }
+
+  @Override
+  public CompletableFuture<CertificationResponse> submitCertificationRequest(
+      CertificationData certificationData) {
+    StateId stateId = StateId.fromCertificationData(certificationData);
+    if (acceptedStateIds.contains(stateId)) {
+      return CompletableFuture.completedFuture(
+          CertificationResponse.create(CertificationStatus.STATE_ID_EXISTS));
+    }
+    return inner.submitCertificationRequest(certificationData)
+        .thenApply(response -> {
+          if (response.getStatus() == CertificationStatus.SUCCESS) {
+            acceptedStateIds.add(stateId);
+          }
+          return response;
+        });
+  }
+
+  @Override
+  public CompletableFuture<InclusionProofResponse> getInclusionProof(StateId stateId) {
+    return inner.getInclusionProof(stateId);
+  }
+
+  @Override
+  public CompletableFuture<Long> getBlockHeight() {
+    return inner.getBlockHeight();
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/support/TokenTree.java b/src/test/java/org/unicitylabs/sdk/e2e/support/TokenTree.java
new file mode 100644
index 0000000..b21e45d
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/support/TokenTree.java
@@ -0,0 +1,120 @@
+package org.unicitylabs.sdk.e2e.support;
+
+import java.util.Collections;
+import java.util.Map;
+import org.unicitylabs.sdk.StateTransitionClient;
+import org.unicitylabs.sdk.api.bft.RootTrustBase;
+import org.unicitylabs.sdk.functional.payment.TestPaymentData;
+import org.unicitylabs.sdk.payment.PaymentDataDeserializer;
+import org.unicitylabs.sdk.payment.asset.AssetId;
+import org.unicitylabs.sdk.predicate.verification.PredicateVerifierService;
+import org.unicitylabs.sdk.transaction.Token;
+import org.unicitylabs.sdk.transaction.verification.MintJustificationVerifierService;
+
+/**
+ * Immutable container for the 4-level token tree fixture. See {@link
+ * TokenTreeBuilder} for the build-order narrative.
+ */
+public final class TokenTree {
+
+  private final StateTransitionClient client;
+  private final RootTrustBase trustBase;
+  private final PredicateVerifierService predicateVerifier;
+  private final MintJustificationVerifierService mintJustificationVerifier;
+  private final AssetId assetId1;
+  private final AssetId assetId2;
+  private final Map<String, TreeUser> usersByName;
+  private final Map<String, Token> tokensByName;
+  private final Map<String, TreeUser> ownersByTokenName;
+
+  TokenTree(
+      StateTransitionClient client,
+      RootTrustBase trustBase,
+      PredicateVerifierService predicateVerifier,
+      MintJustificationVerifierService mintJustificationVerifier,
+      AssetId assetId1,
+      AssetId assetId2,
+      Map<String, TreeUser> usersByName,
+      Map<String, Token> tokensByName,
+      Map<String, TreeUser> ownersByTokenName) {
+    this.client = client;
+    this.trustBase = trustBase;
+    this.predicateVerifier = predicateVerifier;
+    this.mintJustificationVerifier = mintJustificationVerifier;
+    this.assetId1 = assetId1;
+    this.assetId2 = assetId2;
+    this.usersByName = Collections.unmodifiableMap(usersByName);
+    this.tokensByName = Collections.unmodifiableMap(tokensByName);
+    this.ownersByTokenName = Collections.unmodifiableMap(ownersByTokenName);
+  }
+
+  public StateTransitionClient getClient() {
+    return client;
+  }
+
+  public RootTrustBase getTrustBase() {
+    return trustBase;
+  }
+
+  public PredicateVerifierService getPredicateVerifier() {
+    return predicateVerifier;
+  }
+
+  public MintJustificationVerifierService getMintJustificationVerifier() {
+    return mintJustificationVerifier;
+  }
+
+  public AssetId getAssetId1() {
+    return assetId1;
+  }
+
+  public AssetId getAssetId2() {
+    return assetId2;
+  }
+
+  public Map<String, TreeUser> getUsersByName() {
+    return usersByName;
+  }
+
+  public Map<String, Token> getTokensByName() {
+    return tokensByName;
+  }
+
+  public Map<String, TreeUser> getOwnersByTokenName() {
+    return ownersByTokenName;
+  }
+
+  public TreeUser requireUser(String name) {
+    TreeUser u = usersByName.get(name);
+    if (u == null) {
+      throw new IllegalArgumentException("tree has no user named " + name);
+    }
+    return u;
+  }
+
+  public Token requireToken(String name) {
+    Token t = tokensByName.get(name);
+    if (t == null) {
+      throw new IllegalArgumentException("tree has no token named " + name);
+    }
+    return t;
+  }
+
+  public TreeUser requireOwner(String tokenName) {
+    TreeUser owner = ownersByTokenName.get(tokenName);
+    if (owner == null) {
+      throw new IllegalArgumentException("tree has no recorded owner for " + tokenName);
+    }
+    return owner;
+  }
+
+  /**
+   * Picks the right payment-data deserializer for the named token. Post-issue-52
+   * SDK refactor: payment data is now uniformly {@link TestPaymentData} — the
+   * split-reason that used to ride inside the data blob has moved into a
+   * separate {@code justification} field on the mint transaction.
+   */
+  public PaymentDataDeserializer parserFor(String tokenName) {
+    return TestPaymentData::decode;
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/support/TokenTreeBuilder.java b/src/test/java/org/unicitylabs/sdk/e2e/support/TokenTreeBuilder.java
new file mode 100644
index 0000000..e16673b
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/support/TokenTreeBuilder.java
@@ -0,0 +1,289 @@
+package org.unicitylabs.sdk.e2e.support;
+
+import java.math.BigInteger;
+import java.nio.charset.StandardCharsets;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import org.unicitylabs.sdk.StateTransitionClient;
+import org.unicitylabs.sdk.api.bft.RootTrustBase;
+import org.unicitylabs.sdk.functional.payment.TestPaymentData;
+import org.unicitylabs.sdk.payment.SplitAssetProof;
+import org.unicitylabs.sdk.payment.SplitMintJustification;
+import org.unicitylabs.sdk.payment.SplitResult;
+import org.unicitylabs.sdk.payment.TokenSplit;
+import org.unicitylabs.sdk.payment.asset.Asset;
+import org.unicitylabs.sdk.payment.asset.AssetId;
+import org.unicitylabs.sdk.predicate.builtin.SignaturePredicateUnlockScript;
+import org.unicitylabs.sdk.predicate.verification.PredicateVerifierService;
+import org.unicitylabs.sdk.transaction.Token;
+import org.unicitylabs.sdk.transaction.TokenId;
+import org.unicitylabs.sdk.transaction.TokenType;
+import org.unicitylabs.sdk.transaction.verification.MintJustificationVerifierService;
+import org.unicitylabs.sdk.utils.TokenUtils;
+
+/**
+ * Builds the 4-level token tree fixture used by {@code token-4level-*.feature}.
+ *
+ * <p>Layout (mirrors the TS fixture):
+ * <pre>
+ * L0: Alice mints T0 [A1=1000, A2=2000]
+ * L1: Alice splits T0 → T1a[600,1200] + T1b[400,800]
+ *     Alice transfers T1a → Bob, T1b → Carol
+ * L2: Bob splits T1a → T2a[350,700] + T2b[250,500]
+ *     Bob transfers T2a → Carol, T2b → Dave
+ * L3: Carol splits T1b → T3a[200,400] + T3b[200,400]
+ *     Carol transfers T3a → Dave, T3b → Alice
+ * L4: Dave splits T2b → T4a[125,250] + T4b[125,250]
+ *     Dave transfers T4a → Alice, T4b → Bob
+ * </pre>
+ *
+ * <p>Cached once per JVM run (~11 aggregator ops) — mirrors TS's module-level
+ * cachedTree pattern. Without caching, every tree scenario rebuilds → 1500+
+ * aggregator ops on a live aggregator.
+ */
+public final class TokenTreeBuilder {
+
+  private static volatile TokenTree cached;
+
+  private TokenTreeBuilder() {}
+
+  public static TokenTree buildOrReuse(
+      StateTransitionClient client,
+      RootTrustBase trustBase,
+      PredicateVerifierService predicateVerifier,
+      MintJustificationVerifierService mjv) throws Exception {
+    TokenTree local = cached;
+    if (local != null) {
+      return local;
+    }
+    synchronized (TokenTreeBuilder.class) {
+      if (cached != null) {
+        return cached;
+      }
+      cached = build(client, trustBase, predicateVerifier, mjv);
+      return cached;
+    }
+  }
+
+  public static void invalidate() {
+    cached = null;
+  }
+
+  public static TokenTree build(
+      StateTransitionClient client,
+      RootTrustBase trustBase,
+      PredicateVerifierService predicateVerifier,
+      MintJustificationVerifierService mjv) throws Exception {
+
+    TreeUser alice = TreeUser.generate("Alice");
+    TreeUser bob = TreeUser.generate("Bob");
+    TreeUser carol = TreeUser.generate("Carol");
+    TreeUser dave = TreeUser.generate("Dave");
+
+    AssetId assetId1 = new AssetId("ASSET_1".getBytes(StandardCharsets.UTF_8));
+    AssetId assetId2 = new AssetId("ASSET_2".getBytes(StandardCharsets.UTF_8));
+
+    Map<String, Token> tokens = new LinkedHashMap<>();
+    Map<String, TreeUser> owners = new LinkedHashMap<>();
+
+    // L0: Alice mints T0
+    TestPaymentData t0Payment = new TestPaymentData(Set.of(
+        new Asset(assetId1, BigInteger.valueOf(1000)),
+        new Asset(assetId2, BigInteger.valueOf(2000))));
+    Token t0 = TokenUtils.mintToken(
+        client, trustBase, predicateVerifier, mjv,
+        alice.getPredicate(), null, t0Payment.encode());
+
+    // L1
+    TokenId t1aId = TokenId.generate();
+    TokenId t1bId = TokenId.generate();
+    Map<TokenId, Set<Asset>> l1Plan = new LinkedHashMap<>();
+    l1Plan.put(t1aId, Set.of(
+        new Asset(assetId1, BigInteger.valueOf(600)),
+        new Asset(assetId2, BigInteger.valueOf(1200))));
+    l1Plan.put(t1bId, Set.of(
+        new Asset(assetId1, BigInteger.valueOf(400)),
+        new Asset(assetId2, BigInteger.valueOf(800))));
+    SplitMaterialized l1 = materializeSplit(
+        client, trustBase, predicateVerifier, mjv, t0, alice, l1Plan);
+    Token t0Burned = l1.burnedToken;
+    Token t1aPre = l1.children.get(t1aId);
+    Token t1bPre = l1.children.get(t1bId);
+    tokens.put("T0_burned", t0Burned);
+
+    Token t1aBob = transfer(client, trustBase, predicateVerifier, mjv, t1aPre, alice, bob);
+    Token t1bCarol = transfer(client, trustBase, predicateVerifier, mjv, t1bPre, alice, carol);
+
+    // L2
+    TokenId t2aId = TokenId.generate();
+    TokenId t2bId = TokenId.generate();
+    Map<TokenId, Set<Asset>> l2Plan = new LinkedHashMap<>();
+    l2Plan.put(t2aId, Set.of(
+        new Asset(assetId1, BigInteger.valueOf(350)),
+        new Asset(assetId2, BigInteger.valueOf(700))));
+    l2Plan.put(t2bId, Set.of(
+        new Asset(assetId1, BigInteger.valueOf(250)),
+        new Asset(assetId2, BigInteger.valueOf(500))));
+    SplitMaterialized l2 = materializeSplit(
+        client, trustBase, predicateVerifier, mjv, t1aBob, bob, l2Plan);
+    Token t1aBurned = l2.burnedToken;
+    Token t2aPre = l2.children.get(t2aId);
+    Token t2bPre = l2.children.get(t2bId);
+
+    Token t2aCarol = transfer(client, trustBase, predicateVerifier, mjv, t2aPre, bob, carol);
+    Token t2bDave = transfer(client, trustBase, predicateVerifier, mjv, t2bPre, bob, dave);
+
+    // L3
+    TokenId t3aId = TokenId.generate();
+    TokenId t3bId = TokenId.generate();
+    Map<TokenId, Set<Asset>> l3Plan = new LinkedHashMap<>();
+    l3Plan.put(t3aId, Set.of(
+        new Asset(assetId1, BigInteger.valueOf(200)),
+        new Asset(assetId2, BigInteger.valueOf(400))));
+    l3Plan.put(t3bId, Set.of(
+        new Asset(assetId1, BigInteger.valueOf(200)),
+        new Asset(assetId2, BigInteger.valueOf(400))));
+    SplitMaterialized l3 = materializeSplit(
+        client, trustBase, predicateVerifier, mjv, t1bCarol, carol, l3Plan);
+    Token t1bBurned = l3.burnedToken;
+    Token t3aPre = l3.children.get(t3aId);
+    Token t3bPre = l3.children.get(t3bId);
+
+    Token t3aDave = transfer(client, trustBase, predicateVerifier, mjv, t3aPre, carol, dave);
+    Token t3bAlice = transfer(client, trustBase, predicateVerifier, mjv, t3bPre, carol, alice);
+
+    // L4
+    TokenId t4aId = TokenId.generate();
+    TokenId t4bId = TokenId.generate();
+    Map<TokenId, Set<Asset>> l4Plan = new LinkedHashMap<>();
+    l4Plan.put(t4aId, Set.of(
+        new Asset(assetId1, BigInteger.valueOf(125)),
+        new Asset(assetId2, BigInteger.valueOf(250))));
+    l4Plan.put(t4bId, Set.of(
+        new Asset(assetId1, BigInteger.valueOf(125)),
+        new Asset(assetId2, BigInteger.valueOf(250))));
+    SplitMaterialized l4 = materializeSplit(
+        client, trustBase, predicateVerifier, mjv, t2bDave, dave, l4Plan);
+    Token t2bBurned = l4.burnedToken;
+    Token t4aPre = l4.children.get(t4aId);
+    Token t4bPre = l4.children.get(t4bId);
+
+    Token t4aAlice = transfer(client, trustBase, predicateVerifier, mjv, t4aPre, dave, alice);
+    Token t4bBob = transfer(client, trustBase, predicateVerifier, mjv, t4bPre, dave, bob);
+
+    tokens.put("T1a_burned", t1aBurned);
+    tokens.put("T1a_pre", t1aPre);
+    owners.put("T1a_pre", alice);
+    tokens.put("T1b_burned", t1bBurned);
+    tokens.put("T1b_pre", t1bPre);
+    owners.put("T1b_pre", alice);
+    tokens.put("T2a_carol", t2aCarol);
+    owners.put("T2a_carol", carol);
+    tokens.put("T2a_pre", t2aPre);
+    owners.put("T2a_pre", bob);
+    tokens.put("T2b_burned", t2bBurned);
+    tokens.put("T2b_pre", t2bPre);
+    owners.put("T2b_pre", bob);
+    tokens.put("T3a_dave", t3aDave);
+    owners.put("T3a_dave", dave);
+    tokens.put("T3a_pre", t3aPre);
+    owners.put("T3a_pre", carol);
+    tokens.put("T3b_alice", t3bAlice);
+    owners.put("T3b_alice", alice);
+    tokens.put("T3b_pre", t3bPre);
+    owners.put("T3b_pre", carol);
+    tokens.put("T4a_alice", t4aAlice);
+    owners.put("T4a_alice", alice);
+    tokens.put("T4a_pre", t4aPre);
+    owners.put("T4a_pre", dave);
+    tokens.put("T4b_bob", t4bBob);
+    owners.put("T4b_bob", bob);
+    tokens.put("T4b_pre", t4bPre);
+    owners.put("T4b_pre", dave);
+
+    Map<String, TreeUser> users = new LinkedHashMap<>();
+    users.put("Alice", alice);
+    users.put("Bob", bob);
+    users.put("Carol", carol);
+    users.put("Dave", dave);
+
+    return new TokenTree(
+        client, trustBase, predicateVerifier, mjv,
+        assetId1, assetId2,
+        users, tokens, owners);
+  }
+
+  private static Token transfer(
+      StateTransitionClient client,
+      RootTrustBase trustBase,
+      PredicateVerifierService predicateVerifier,
+      MintJustificationVerifierService mjv,
+      Token source,
+      TreeUser sender,
+      TreeUser recipient) throws Exception {
+    return TokenUtils.transferToken(
+        client, trustBase, predicateVerifier, mjv,
+        source.toCbor(),
+        recipient.getPredicate(),
+        sender.getSigningService());
+  }
+
+  /**
+   * Performs a split end-to-end against the new SDK API:
+   * <ol>
+   * <li>{@link TokenSplit#split} (3-arg form: token, parser, plan)</li>
+   * <li>burn the source via the prebuilt {@link SplitResult#getBurnTransaction}</li>
+   * <li>mint each child with {@code justification = SplitMintJustification.toCbor}
+   *     and {@code data = TestPaymentData.encode}</li>
+   * </ol>
+   */
+  private static SplitMaterialized materializeSplit(
+      StateTransitionClient client,
+      RootTrustBase trustBase,
+      PredicateVerifierService predicateVerifier,
+      MintJustificationVerifierService mjv,
+      Token source,
+      TreeUser owner,
+      Map<TokenId, Set<Asset>> plan) throws Exception {
+    SplitResult splitResult = TokenSplit.split(source, TestPaymentData::decode, plan);
+
+    Token burned = TokenUtils.transferToken(
+        client, trustBase, predicateVerifier,
+        source,
+        splitResult.getBurnTransaction(),
+        SignaturePredicateUnlockScript.create(
+            splitResult.getBurnTransaction(), owner.getSigningService()));
+
+    Map<TokenId, Token> children = new HashMap<>();
+    TokenType childType = TokenType.generate();
+    for (Map.Entry<TokenId, Set<Asset>> entry : plan.entrySet()) {
+      List<SplitAssetProof> proofs = splitResult.getProofs().get(entry.getKey());
+      Set<SplitAssetProof> proofSet = new HashSet<>(proofs);
+      byte[] justification = SplitMintJustification.create(burned, proofSet).toCbor();
+      byte[] data = new TestPaymentData(entry.getValue()).encode();
+      Token child = TokenUtils.mintToken(
+          client, trustBase, predicateVerifier, mjv,
+          entry.getKey(),
+          childType,
+          owner.getPredicate(),
+          justification,
+          data);
+      children.put(entry.getKey(), child);
+    }
+    return new SplitMaterialized(burned, children);
+  }
+
+  private static final class SplitMaterialized {
+    final Token burnedToken;
+    final Map<TokenId, Token> children;
+
+    SplitMaterialized(Token burnedToken, Map<TokenId, Token> children) {
+      this.burnedToken = burnedToken;
+      this.children = children;
+    }
+  }
+}
diff --git a/src/test/java/org/unicitylabs/sdk/e2e/support/TreeUser.java b/src/test/java/org/unicitylabs/sdk/e2e/support/TreeUser.java
new file mode 100644
index 0000000..b1d0ec4
--- /dev/null
+++ b/src/test/java/org/unicitylabs/sdk/e2e/support/TreeUser.java
@@ -0,0 +1,43 @@
+package org.unicitylabs.sdk.e2e.support;
+
+import org.unicitylabs.sdk.predicate.Predicate;
+
+import org.unicitylabs.sdk.crypto.secp256k1.SigningService;
+import org.unicitylabs.sdk.predicate.builtin.SignaturePredicate;
+
+
+/** Named user participating in the tree fixture. Immutable. */
+public final class TreeUser {
+
+  private final String name;
+  private final SigningService signingService;
+  private final SignaturePredicate predicate;
+  private final Predicate address;
+
+  TreeUser(String name, SigningService signingService) {
+    this.name = name;
+    this.signingService = signingService;
+    this.predicate = SignaturePredicate.fromSigningService(signingService);
+    this.address = this.predicate;
+  }
+
+  public static TreeUser generate(String name) {
+    return new TreeUser(name, SigningService.generate());
+  }
+
+  public String getName() {
+    return name;
+  }
+
+  public SigningService getSigningService() {
+    return signingService;
+  }
+
+  public SignaturePredicate getPredicate() {
+    return predicate;
+  }
+
+  public Predicate getAddress() {
+    return address;
+  }
+}
diff --git a/src/test/resources/junit-platform.properties b/src/test/resources/junit-platform.properties
new file mode 100644
index 0000000..e639de9
--- /dev/null
+++ b/src/test/resources/junit-platform.properties
@@ -0,0 +1,3 @@
+cucumber.publish.quiet=true
+cucumber.junit-platform.naming-strategy=long
+cucumber.plugin=pretty,html:build/cucumber-reports/cucumber.html,json:build/cucumber-reports/cucumber.json
diff --git a/src/test/resources/org/unicitylabs/sdk/features/advanced-token-scenarios.feature b/src/test/resources/org/unicitylabs/sdk/features/advanced-token-scenarios.feature
deleted file mode 100644
index eb0f99b..0000000
--- a/src/test/resources/org/unicitylabs/sdk/features/advanced-token-scenarios.feature
+++ /dev/null
@@ -1,109 +0,0 @@
-@advanced-token
-Feature: Advanced Token Scenarios
-  As a developer using the Unicity SDK
-  I want to test complex token operations and edge cases
-  So that I can ensure the system handles advanced scenarios correctly
-
-  Background:
-    Given the aggregator URL is configured
-    And trust-base.json is set
-    And the state transition client is initialized
-    And the following users are set up with their signing services
-      | Alice |
-      | Bob   |
-      | Carol |
-      | Dave |
-
-  @performance
-  @reset
-  Scenario Outline: Bulk token operations performance
-    Given <userCount> users are configured for bulk operations
-    When each user mints <tokensPerUser> tokens simultaneously
-    And all tokens are verified in parallel
-    Then all <totalTokens> tokens should be created successfully
-    And the operation should complete within <maxDuration> seconds
-    And the success rate should be at least <minSuccessRate>%
-
-    Examples:
-      | userCount | tokensPerUser | totalTokens | maxDuration | minSuccessRate |
-      | 5         | 10            | 50          | 30          | 95             |
-      | 10        | 5             | 50          | 25          | 90             |
-
-  @edge-cases
-  @reset
-  Scenario Outline: Token transfer chain with validation
-    Given "Alice" mints a token with <coinValue> coin value
-    When the token is transferred through the chain of existing users
-    And each transfer includes custom data validation
-    Then the final token should maintain original properties
-    And all intermediate transfers should be recorded correctly
-    And the token should have <expectedTransfers> transfers in history
-
-    Examples:
-      | coinValue | expectedTransfers |
-      | 1000      | 3                |
-      | 5000      | 3                |
-
-  @nametag-scenarios
-  @reset
-  Scenario Outline: Complex name tag token interactions
-    Given "Alice" creates <tokenCount> tokens
-    Given "Bob" creates nametags for each token
-    When "Alice" transfers tokens to each of "Bob" nametags
-    And "Bob" finalizes all received tokens
-    And "Bob" consolidates all received tokens
-    Then "Bob" should own <tokenCount> tokens
-    And all "Bob" nametag tokens should remain valid
-    And proxy addressing should work for all "Bob" name tags
-
-    Examples:
-      | tokenCount |
-      | 3           |
-      | 5           |
-
-#  @splitting-scenarios
-#  Scenario Outline: Multi-level token splitting
-#    Given Carol owns a token worth <originalValue> coins
-#    When the token is split into <firstSplit> tokens
-#    And one of the resulting tokens is split again into <secondSplit> tokens
-#    Then the total number of tokens should be <totalTokens>
-#    And the total coin value should equal the original <originalValue>
-#    And all tokens should be independently transferable
-#
-#    Examples:
-#      | originalValue | firstSplit | secondSplit | totalTokens |
-#      | 10000        | 3          | 2           | 4           |
-#      | 20000        | 4          | 3           | 6           |
-#
-#  @concurrency
-#  Scenario: Concurrent operations on same token
-#    Given "Alice" owns a token
-#    When "Alice" attempts to transfer the token to both "Bob" and "Carol" simultaneously
-#    Then only one transfer should succeed
-#    And the other transfer should be rejected
-#    And the token should belong to exactly one recipient
-#    And no tokens should be duplicated
-#
-#  @data-integrity
-#  Scenario Outline: Large custom data handling
-#    Given a token with custom data of size <dataSize> bytes
-#    When the token is transferred with the large custom data
-#    Then the transfer should <expectation>
-#    And the data integrity should be maintained
-#    And the system performance should remain acceptable
-#
-#    Examples:
-#      | dataSize | expectation |
-#      | 1024    | succeed     |
-#      | 10240   | succeed     |
-#      | 102400  | succeed     |
-#
-#  @mixed-predicates
-#  Scenario: Mixed predicate type interactions
-#    Given "Alice" uses a "masked" predicate
-#    And "Bob" uses a "unmasked" predicate
-#    And "Carol" uses a name tag token
-#    When tokens are transferred between all users in various combinations
-#    Then all transfers should work correctly regardless of predicate types
-#    And token verification should pass for all predicate combinations
-#    And the system should handle predicate conversions properly
\ No newline at end of file
diff --git a/src/test/resources/org/unicitylabs/sdk/features/aggregator-connectivity.feature b/src/test/resources/org/unicitylabs/sdk/features/aggregator-connectivity.feature
index 7652e29..b4670cc 100644
--- a/src/test/resources/org/unicitylabs/sdk/features/aggregator-connectivity.feature
+++ b/src/test/resources/org/unicitylabs/sdk/features/aggregator-connectivity.feature
@@ -1,42 +1,20 @@
 @aggregator-connectivity
-Feature: Aggregator Connectivity and Basic Operations
-  As a developer using the Unicity SDK
-  I want to verify connectivity with the aggregator
-  So that I can ensure the system is operational
+Feature: Aggregator connectivity
+  Basic client + aggregator wiring. Proves the SDK can reach the aggregator,
+  request block height, and round-trip a single mint certification.
 
   Background:
-    Given the aggregator URL is configured
-    And trust-base.json is set
-    And the aggregator client is initialized
+    Given a mock aggregator is running
 
-  Scenario: Verify aggregator connectivity
+  # Tagged @hermetic-only because the bft-shard subscription proxy gates
+  # JSON-RPC calls on stateId/shardId — getBlockHeight() carries neither.
+  # This scenario only runs against the in-process StrictTestAggregatorClient.
+  @hermetic-only
+  Scenario: Block height round-trip
     When I request the current block height
-    Then the block height should be returned
-    And the block height should be greater than 0
+    Then a block height is returned
 
-  Scenario Outline: Submit commitment with performance validation
-    Given a random secret of <secretLength> bytes
-    And a state hash from <stateLength> bytes of random data
-    And transaction data "<txData>"
-    When I submit a commitment with the generated data
-    Then the commitment should be submitted successfully
-    And the submission should complete in less than <maxDuration> milliseconds
-
-    Examples:
-      | secretLength | stateLength | txData                      | maxDuration |
-      | 32          | 32          | test commitment performance | 5000        |
-      | 16          | 24          | simple test data           | 3000        |
-
-  Scenario Outline: Parallel mint commitments with inclusion proof verification
-    Given I configure <threadsCount> threads with <commitmentsPerThread> commitments each
-    When I submit all mint commitments concurrently
-    Then all mint commitments should receive inclusion proofs within <timeoutSeconds> seconds
-
-    Examples:
-      | threadsCount | commitmentsPerThread | timeoutSeconds |
-      | 1            | 10                   | 120            |
-      | 5            | 10                   | 120            |
-      | 10           | 10                   | 120            |
-      | 20           | 10                   | 120            |
-      | 40           | 10                   | 120            |
-      | 80           | 10                   | 120            |
\ No newline at end of file
+  Scenario: Single mint is accepted by the aggregator
+    Given Alice has a signing key
+    When Alice mints a token
+    Then the current token verifies successfully
diff --git a/src/test/resources/org/unicitylabs/sdk/features/bft-shard-routing.feature b/src/test/resources/org/unicitylabs/sdk/features/bft-shard-routing.feature
new file mode 100644
index 0000000..c538c34
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/bft-shard-routing.feature
@@ -0,0 +1,33 @@
+@bft-shard-only
+Feature: bft-shard MSB routing
+  As a maintainer of the state transition SDK
+  I want the test-side ShardAwareAggregatorClient to mimic the future routing service
+  So that we can run the full BDD suite against bft-shard topologies before that service exists
+
+  # T4-29: Decision Table — MSB routing extracts the top SHARD_ID_LENGTH bits of the StateID
+  # and ORs them with (1 << SHARD_ID_LENGTH) to produce the picked shard ID.
+  Scenario Outline: MSB routing of a StateID with first byte "<firstByteHex>" picks the shard whose prefix matches the StateID
+    Given a synthetic StateID whose first byte is "<firstByteHex>"
+    When ShardAwareAggregatorClient.getShardForStateId runs in msb mode against the configured topology
+    Then the picked shard's prefix matches the StateID's top SHARD_ID_LENGTH bits
+
+    Examples:
+      | firstByteHex |
+      | 0x00         |
+      | 0x40         |
+      | 0x80         |
+      | 0xC0         |
+      | 0xFF         |
+
+  # T4-30: Risk-Based — submitting to the wrong shard is rejected by the aggregator's ValidateShardID.
+  Scenario: Submitting a finalised certification to a different shard is rejected
+    Given a mock aggregator client is set up
+    And a freshly minted token routed to its correct shard
+    When the same certification request is sent directly to a different shard
+    Then the aggregator rejects the request
+
+  # T4-31: Use Case — under correct routing, mints land on every configured shard.
+  Scenario: Mints under MSB routing reach every configured shard
+    Given a mock aggregator client is set up
+    When enough tokens are minted to cover every configured shard
+    Then the per-shard submission count covers every configured shard
diff --git a/src/test/resources/org/unicitylabs/sdk/features/cbor-envelope-tags.feature b/src/test/resources/org/unicitylabs/sdk/features/cbor-envelope-tags.feature
new file mode 100644
index 0000000..caeb33c
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/cbor-envelope-tags.feature
@@ -0,0 +1,77 @@
+Feature: CBOR envelope tags and version slots
+  As a maintainer of the state transition SDK
+  I want decoders to reject wrong-tag and wrong-version payloads with crisp errors
+  So that protocol drift fails loudly instead of silently corrupting state
+
+  # T4-07: Decision Table + Pairwise — tag mismatch across types
+  Scenario Outline: <type> decoded with the wrong CBOR tag throws CborError
+    Given a tagged CBOR payload using tag <wrongTag> with arity <arity> and version <version>
+    When fromCBOR is invoked on type "<type>"
+    Then a CborError is thrown with message containing "<type>"
+
+    # Note: CertificationRequest is encode-only (no fromCBOR by design — SDK never decodes a
+    # request payload it just sent), so the wrong-tag matrix omits it. See discovery notes.
+    # EncodedPredicate's error message says "Predicate" (not its class name) — see split scenario below.
+    Examples:
+      | type                     | wrongTag | arity | version |
+      | CertificationData        | 39030    | 5     | 1       |
+      | InclusionProof           | 39041    | 4     | 1       |
+      | InputRecord              | 39031    | 10    | 1       |
+      | ShardTreeCertificate     | 39031    | 2     | 1       |
+      | MintTransaction          | 39031    | 6     | 1       |
+      | SplitMintJustification   | 39031    | 2     | 1       |
+      | UnicityCertificate       | 39031    | 7     | 1       |
+      # UnicityIdMintTransaction shares tag 39041 with MintTransaction by design,
+      # so we exercise its wrong-tag branch with a different non-matching tag.
+      | UnicityIdMintTransaction | 39031    | 6     | 1       |
+
+  Scenario: EncodedPredicate decoded with the wrong CBOR tag throws CborError
+    Given a tagged CBOR payload using tag 39031 with arity 3 and version 0
+    When fromCBOR is invoked on type "EncodedPredicate"
+    Then a CborError is thrown with message containing "Predicate"
+
+  # T4-08: BVA — wrong version is rejected at min and next-valid boundary
+  Scenario Outline: <type> decoded with version <version> throws CborError
+    Given a tagged CBOR payload using tag <correctTag> with arity <arity> and version <version>
+    When fromCBOR is invoked on type "<type>"
+    Then a CborError is thrown with message containing "version"
+
+    Examples:
+      | type                     | correctTag | arity | version |
+      | CertificationData        | 39031      | 5     | 0       |
+      | CertificationData        | 39031      | 5     | 2       |
+      | InclusionProof           | 39033      | 4     | 2       |
+      | InputRecord              | 39002      | 10    | 2       |
+      | MintTransaction          | 39041      | 6     | 2       |
+      | UnicityCertificate       | 39001      | 7     | 2       |
+      | UnicityIdMintTransaction | 39041      | 6     | 2       |
+
+  # T4-09: Cause-Effect — "Predicate has no version slot" invariant.
+  # Note: EncodedPredicate.fromCBOR currently does not validate array arity, so a 4-element
+  # payload with the correct tag silently decodes (only the first 3 fields are read).
+  # This is a coverage gap in the SDK itself — tracked in docs/test-expansion-discoveries.md.
+  # We assert the *positive* invariant instead: a correctly-tagged 3-element payload decodes.
+  Scenario: EncodedPredicate's correct-shape payload decodes (3-element, no version slot)
+    Given a tagged CBOR payload using tag 39032 with arity 3 and version 1
+    When fromCBOR is invoked on type "EncodedPredicate"
+    Then no CborError is thrown
+
+  # PR #110 — SplitMintJustification has no version slot (only token + proofs).
+  # The wrong-version table above intentionally excludes it; we assert the positive invariant.
+  Scenario Outline: SplitMintJustification arity gate fires before any version concern
+    Given a tagged CBOR payload using tag 39044 with arity <arity> and version 0
+    When fromCBOR is invoked on type "SplitMintJustification"
+    Then a CborError is thrown with message containing "<expectedSubstring>"
+
+    Examples:
+      | arity | expectedSubstring |
+      | 1     | array             |
+      | 3     | array             |
+
+  # PR #110 fdcf6ab — CertificationData stores a canonicalized lockScript at construction
+  # via EncodedPredicate.fromPredicate(...).toCBOR(). A round-trip through fromCBOR and back
+  # must produce byte-identical CBOR — proving canonicalization is stable.
+  Scenario: CertificationData lockScript is canonicalized and round-trips stably
+    Given a CertificationData is built from a sample MintTransaction
+    When the CertificationData is encoded, decoded, and re-encoded
+    Then the original and re-encoded CBOR bytes are byte-identical
diff --git a/src/test/resources/org/unicitylabs/sdk/features/double-spend-prevention.feature b/src/test/resources/org/unicitylabs/sdk/features/double-spend-prevention.feature
new file mode 100644
index 0000000..c3b5aeb
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/double-spend-prevention.feature
@@ -0,0 +1,19 @@
+@forgiving
+Feature: Double Spend Prevention
+  Exercises the forgiving-aggregator model: both submissions are accepted
+  (mock no-ops the second leaf) and detection lives at inclusion-proof
+  verification, where the second transaction's hash mismatches the recorded
+  leaf.
+
+  Background:
+    Given a forgiving aggregator is running
+    And Alice has a signing key
+    And Alice has a minted token
+    And Bob has a signing key
+
+  Scenario: Double-spend attempt is detected via inclusion proof
+    When Alice submits a valid transfer to Bob
+    And Alice submits a second transfer of the same token
+    Then the first aggregator response is "SUCCESS"
+    And the second aggregator response is "SUCCESS"
+    But the inclusion proof verification rejects the second transfer with "TRANSACTION_HASH_MISMATCH"
diff --git a/src/test/resources/org/unicitylabs/sdk/features/inclusion-cert-stress.feature b/src/test/resources/org/unicitylabs/sdk/features/inclusion-cert-stress.feature
new file mode 100644
index 0000000..9595af2
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/inclusion-cert-stress.feature
@@ -0,0 +1,29 @@
+@stress
+Feature: InclusionCertificate stress and use-case scenarios
+  As a maintainer of the state transition SDK
+  I want loop and use-case tests against the verify path
+  So that radix-SMT or shard-tree-hash regressions surface quickly under realistic load
+
+  Background:
+    Given a mock aggregator is running
+
+  # T4-35: Loop Testing — back-to-back mints all verify
+  Scenario: 20 sequential mints each verify
+    When 20 tokens are minted in a row by the same user
+    Then every minted token passes verification
+
+  # T4-36: Use Case — mint → 5x transfer chain ends valid
+  Scenario: Mint then 5 transfers leave a valid token
+    When Alice mints a token and transfers it through 5 owners
+    Then the final token has 5 transactions in its history
+    And the final token passes verification
+
+  # T4-37: State Transition — duplicate StateID submission must not silently
+  # accept a divergent payload. Hermetic aggregator returns STATE_ID_EXISTS;
+  # real bft-shard aggregators treat byte-identical re-submits as idempotent
+  # SUCCESS (proof of inclusion already exists). Both are valid — the invariant
+  # under test is "no double-spend", not the literal status string.
+  Scenario: Submitting an already-finalised certification is idempotent or rejected
+    Given Alice has a minted token
+    When the same certification data is re-submitted
+    Then the re-submission's status is one of "SUCCESS" or "STATE_ID_EXISTS"
diff --git a/src/test/resources/org/unicitylabs/sdk/features/inclusion-certificate-binary.feature b/src/test/resources/org/unicitylabs/sdk/features/inclusion-certificate-binary.feature
new file mode 100644
index 0000000..597582c
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/inclusion-certificate-binary.feature
@@ -0,0 +1,43 @@
+Feature: InclusionCertificate binary wire format
+  As a maintainer of the state transition SDK
+  I want decode/encode/verify to behave correctly on malformed binary input
+  So that wire-format regressions surface before they reach the verification path
+
+  # T4-11: BVA — bitmap underflow and sibling alignment
+  Scenario Outline: InclusionCertificate.decode rejects malformed binary of length <byteLength>
+    Given binary bytes of length <byteLength>
+    When InclusionCertificate.decode is invoked
+    Then InclusionCertificate.decode throws with message containing "<errorFragment>"
+
+    Examples:
+      | byteLength | errorFragment |
+      | 0          | bitmap        |
+      | 31         | bitmap        |
+      | 33         | misaligned    |
+      | 63         | misaligned    |
+      | 65         | misaligned    |
+
+  # T4-12: Cause-Effect — popcount must match siblings count
+  Scenario: InclusionCertificate.decode rejects when popcount(bitmap) != siblings count
+    Given a 64-byte buffer where the bitmap has popcount 2 and only 1 sibling chunk follows
+    When InclusionCertificate.decode is invoked
+    Then InclusionCertificate.decode throws with message containing "siblings count"
+
+  # T4-13: Checklist-Based — encode then decode is idempotent
+  Scenario: InclusionCertificate.encode then decode preserves bitmap and siblings
+    Given an InclusionCertificate built from the test fixture token
+    When the InclusionCertificate is encoded then decoded
+    Then the decoded bitmap equals the original
+    And the decoded sibling count equals the original
+
+  # T4-14: Error Guessing — corrupting one sibling byte makes verify fail
+  Scenario: InclusionCertificate.verify returns false when a sibling byte is corrupted
+    Given an InclusionCertificate built from the test fixture token
+    When the first sibling hash is corrupted
+    Then verify returns false against the original root and StateID
+
+  # T4-15: Risk-Based — wrong expected root hash makes verify fail
+  Scenario: InclusionCertificate.verify returns false when expected root differs
+    Given an InclusionCertificate built from the test fixture token
+    When verify is called with a root hash differing by one byte
+    Then verify returns false
diff --git a/src/test/resources/org/unicitylabs/sdk/features/inclusion-proof-statuses.feature b/src/test/resources/org/unicitylabs/sdk/features/inclusion-proof-statuses.feature
new file mode 100644
index 0000000..4a9cc8e
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/inclusion-proof-statuses.feature
@@ -0,0 +1,48 @@
+Feature: InclusionProof verification status surface
+  As a maintainer of the state transition SDK
+  I want every status branch in InclusionProofVerificationRule to be reachable from a real proof
+  So that protocol drift surfaces with the right error code, not a generic failure
+
+  Background:
+    Given a mock aggregator is running
+    And Alice has a minted token
+
+  # T4-21: Branch Coverage — INCLUSION_CERTIFICATE_MISSING fires when proof has no certificate
+  Scenario: Verification of a proof with no inclusionCertificate returns INCLUSION_CERTIFICATE_MISSING
+    When the inclusion proof has its inclusionCertificate removed
+    Then verification of the modified proof returns "INCLUSION_CERTIFICATE_MISSING"
+
+  # T4-22: Branch Coverage — MISSING_CERTIFICATION_DATA fires when proof has no certData
+  Scenario: Verification of a proof with no certificationData returns MISSING_CERTIFICATION_DATA
+    When the inclusion proof has its certificationData removed
+    Then verification of the modified proof returns "MISSING_CERTIFICATION_DATA"
+
+  # T4-23: Error Guessing — corrupting a sibling drives PATH_INVALID
+  Scenario: Verification of a proof with a corrupted sibling hash returns PATH_INVALID
+    When the inclusion proof's first sibling hash is corrupted
+    Then verification of the modified proof returns "PATH_INVALID"
+
+  # T4-24: Risk-Based — SHARD_ID_MISMATCH (bft-shard mode only — single-aggregator length=0 short-circuits)
+  @multi-shard-only
+  Scenario: Verification with a non-prefix shardTreeCertificate returns SHARD_ID_MISMATCH
+    When the UC's shardTreeCertificate is replaced with a non-matching prefix
+    Then verification of the modified proof returns "SHARD_ID_MISMATCH"
+
+  # T4-25: State Transition — when both txhash and a sibling are bad,
+  #        the rule that fires earlier (txhash) dictates the status.
+  Scenario: Status precedence — txhash failure dominates path-invalid failure
+    When the inclusion proof's transactionHash is replaced with garbage
+    And the inclusion proof's first sibling hash is corrupted on top
+    Then verification of the modified proof returns "TRANSACTION_HASH_MISMATCH"
+
+  # T4-26: Decision Table — single scenario covering the high-level matrix
+  Scenario Outline: Mutation "<mutation>" surfaces status "<expectedStatus>"
+    When the inclusion proof is mutated by "<mutation>"
+    Then verification of the modified proof returns "<expectedStatus>"
+
+    Examples:
+      | mutation                        | expectedStatus                  |
+      | drop-inclusion-certificate      | INCLUSION_CERTIFICATE_MISSING   |
+      | drop-certification-data         | MISSING_CERTIFICATION_DATA      |
+      | corrupt-sibling                 | PATH_INVALID                    |
+      | corrupt-txhash                  | TRANSACTION_HASH_MISMATCH       |
diff --git a/src/test/resources/org/unicitylabs/sdk/features/mint-justification-registry.feature b/src/test/resources/org/unicitylabs/sdk/features/mint-justification-registry.feature
new file mode 100644
index 0000000..12168d9
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/mint-justification-registry.feature
@@ -0,0 +1,33 @@
+Feature: MintJustificationVerifierService dispatches by CBOR tag
+
+  # PR #110 406f890 — the new verifier service is a tag→verifier registry.
+  # This feature pins its dispatch behaviour: known tag dispatches, duplicate registration
+  # throws, unknown tag returns a clean FAIL, no-justification returns OK.
+
+  Background:
+    Given a mock aggregator is running
+
+  Scenario: A transaction with no justification verifies as OK
+    Given a fresh MintJustificationVerifierService is created
+    When verify is invoked on a CertifiedMintTransaction with null justification
+    Then the result status is OK
+
+  Scenario: A duplicate tag registration throws
+    Given a fresh MintJustificationVerifierService is created
+    And a SplitMintJustificationVerifier is registered
+    When a second verifier with the same tag is registered
+    Then the registration error message contains "Duplicate"
+
+  Scenario: An unknown justification tag yields a FAIL with a descriptive message
+    Given a fresh MintJustificationVerifierService is created
+    When verify is invoked on a CertifiedMintTransaction whose justification uses tag 88888
+    Then the result status is FAIL
+    And the registry result message contains "Unsupported mint justification tag"
+
+  Scenario: Multiple verifiers can coexist under different tags
+    Given a fresh MintJustificationVerifierService is created
+    And a SplitMintJustificationVerifier is registered
+    And a stub verifier for tag 99999 is registered
+    When verify is invoked on a CertifiedMintTransaction whose justification uses tag 99999
+    Then the result status is OK
+    And the stub verifier was invoked exactly once
diff --git a/src/test/resources/org/unicitylabs/sdk/features/mint-transaction-fields.feature b/src/test/resources/org/unicitylabs/sdk/features/mint-transaction-fields.feature
new file mode 100644
index 0000000..cb1e27b
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/mint-transaction-fields.feature
@@ -0,0 +1,17 @@
+Feature: MintTransaction round-trip across (justification, data) cells
+
+  # PR #110 406f890 — MintTransaction grew a `justification` field independent of `data`.
+  # This feature pins the four combinations through pure CBOR round-trip.
+
+  Scenario Outline: Round-trip preserves both fields when <case>
+    Given a MintTransaction is built with justification "<justification>" and data "<data>"
+    When the MintTransaction is encoded and decoded
+    Then the decoded justification matches "<justification>"
+    And the decoded data matches "<data>"
+
+    Examples:
+      | case                       | justification          | data                |
+      | both null (genesis mint)   | null                   | null                |
+      | data only (memo mint)      | null                   | deadbeef            |
+      | both non-null (split mint) | aabbccddeeff           | 1122334455          |
+      | justification only         | aabbccddeeff           | null                |
diff --git a/src/test/resources/org/unicitylabs/sdk/features/multiple-aggregators.feature b/src/test/resources/org/unicitylabs/sdk/features/multiple-aggregators.feature
deleted file mode 100644
index 06bf503..0000000
--- a/src/test/resources/org/unicitylabs/sdk/features/multiple-aggregators.feature
+++ /dev/null
@@ -1,10 +0,0 @@
-Feature: Bulk Commitment Testing with Multiple Aggregators
-
-  Scenario: Submit commitments to multiple aggregators concurrently
-    Given the aggregator URLs are configured
-    And trust-base.json is set
-    And the aggregator clients are initialized
-    And I configure 10 threads with 10 commitments each
-    When I submit all mint commitments concurrently to all aggregators
-    Then all mint commitments should receive inclusion proofs from all aggregators within 30 seconds
-    And I should see performance metrics for each aggregator
\ No newline at end of file
diff --git a/src/test/resources/org/unicitylabs/sdk/features/routing-byte-source.feature b/src/test/resources/org/unicitylabs/sdk/features/routing-byte-source.feature
new file mode 100644
index 0000000..a21a13a
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/routing-byte-source.feature
@@ -0,0 +1,34 @@
+Feature: Shard-routing byte source regression
+  As a maintainer of the state transition SDK
+  I want the routing helper to read from byte 0 of stateId.data — never the last byte, never the imprint —
+  So that we don't silently regress to the pre-#141 byte-31 LSB convention or route via the algorithm-prefix byte.
+
+  # T4-38: pre-#141 LSB read from the LAST byte of the imprint (via big.Int.SetBytes).
+  # Post-#141 (and our SDK after the byte-0 fix) reads from byte 0 of the raw 32-byte data.
+  # This scenario constructs a StateID where data[0] LSB and data[31] LSB disagree;
+  # the new code must pick shard 2 (data[0] LSB=0); the old code would have picked shard 3.
+  Scenario: LSB routing reads from byte 0 of stateId.data, not byte 31
+    Given a synthetic StateID with byte 0 "0x00" and byte 31 "0x01"
+    When ShardAwareAggregatorClient.getShardForStateId runs in lsb mode with shardIdLength 1
+    Then the picked shard equals 2
+
+  # T4-39: symmetric pin for the MSB path. Same byte source (data[0]); only the bit
+  # direction differs. data[0]=0x80 means top bit = 1 → shard 3.
+  Scenario: MSB routing reads from byte 0 of stateId.data, not byte 31
+    Given a synthetic StateID with byte 0 "0x80" and byte 31 "0x00"
+    When ShardAwareAggregatorClient.getShardForStateId runs in msb mode with shardIdLength 1
+    Then the picked shard equals 3
+
+  # T4-40: defense in depth — any input must yield a shard ID that's a valid
+  # configured-shard ID (i.e. 2 or 3 for shardIdLength=1), never something else.
+  Scenario Outline: Routing always returns a configured shard ID for shardIdLength 1
+    Given a synthetic StateID with byte 0 "<byte0>" and byte 31 "<byte31>"
+    When ShardAwareAggregatorClient.getShardForStateId runs in <mode> mode with shardIdLength 1
+    Then the picked shard is one of "2,3"
+
+    Examples:
+      | byte0 | byte31 | mode |
+      | 0x00  | 0xFF   | lsb  |
+      | 0xFF  | 0x00   | lsb  |
+      | 0x00  | 0xFF   | msb  |
+      | 0xFF  | 0x00   | msb  |
diff --git a/src/test/resources/org/unicitylabs/sdk/features/shard-id-matches-state-id-rule.feature b/src/test/resources/org/unicitylabs/sdk/features/shard-id-matches-state-id-rule.feature
new file mode 100644
index 0000000..a95481a
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/shard-id-matches-state-id-rule.feature
@@ -0,0 +1,39 @@
+Feature: ShardIdMatchesStateIdRule
+  As a maintainer of the state transition SDK
+  I want the shard-id-vs-state-id rule to accept matching prefixes and reject mismatches
+  So that misrouted proofs cannot pass verification under bft-shard mode
+
+  # T4-16: EP — length=0 short-circuits to OK regardless of StateID
+  Scenario: ShardId of length 0 always returns OK
+    Given a ShardId encoded as "0x80"
+    And a StateID with first byte "0x12"
+    When ShardIdMatchesStateIdRule.verify runs
+    Then the rule status is "OK"
+
+  # T4-17: Branch Coverage — byte-aligned matching prefix accepted
+  Scenario: Byte-aligned matching prefix returns OK
+    Given a ShardId encoded as "0x3580" describing 8 bits
+    And a StateID with first byte "0x35"
+    When ShardIdMatchesStateIdRule.verify runs
+    Then the rule status is "OK"
+
+  # T4-18: Branch Coverage — byte-aligned mismatch rejected
+  Scenario: Byte-aligned mismatching prefix returns FAIL
+    Given a ShardId encoded as "0x3580" describing 8 bits
+    And a StateID with first byte "0x36"
+    When ShardIdMatchesStateIdRule.verify runs
+    Then the rule status is "FAIL"
+
+  # T4-19: Risk-Based — partial-byte match (length=9) accepted (PR #111 fix territory)
+  Scenario: Partial-byte matching prefix at length 9 returns OK
+    Given a ShardId encoded as "0xC040" describing 9 bits
+    And a StateID with first two bytes "0xC000"
+    When ShardIdMatchesStateIdRule.verify runs
+    Then the rule status is "OK"
+
+  # T4-20: Risk-Based — partial-byte mismatch (length=9) rejected (PR #111 fix territory)
+  Scenario: Partial-byte mismatching prefix at length 9 returns FAIL
+    Given a ShardId encoded as "0xC040" describing 9 bits
+    And a StateID with first two bytes "0xC080"
+    When ShardIdMatchesStateIdRule.verify runs
+    Then the rule status is "FAIL"
diff --git a/src/test/resources/org/unicitylabs/sdk/features/shard-id.feature b/src/test/resources/org/unicitylabs/sdk/features/shard-id.feature
new file mode 100644
index 0000000..7d606de
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/shard-id.feature
@@ -0,0 +1,64 @@
+Feature: ShardId codec and bit operations
+  As a maintainer of the state transition SDK
+  I want the ShardId type to round-trip and answer bit queries correctly
+  So that bft-shard verification and routing both rely on the same primitive
+
+  # T4-01: BVA — encode/decode roundtrip across the lengths that matter
+  Scenario Outline: ShardId roundtrips at length <length>
+    Given a ShardId encoded as "<hex>"
+    When the ShardId is decoded
+    Then the ShardId length is <length>
+    And re-encoding the ShardId produces "<hex>"
+
+    Examples:
+      | length | hex      |
+      | 0      | 0x80     |
+      | 1      | 0x40     |
+      | 1      | 0xC0     |
+      | 2      | 0xA0     |
+      | 3      | 0xB0     |
+      | 8      | 0x0080   |
+
+  # T4-02: EP — isPrefixOf accepts data sharing the bit prefix
+  Scenario Outline: ShardId isPrefixOf accepts matching data
+    Given a ShardId encoded as "<shardHex>"
+    And data starting with "<dataPrefixHex>"
+    When isPrefixOf is checked
+    Then isPrefixOf returns true
+
+    Examples:
+      | shardHex | dataPrefixHex |
+      | 0x80     | 0x00          |
+      | 0x40     | 0x00          |
+      | 0x40     | 0x3F          |
+      | 0xC0     | 0x80          |
+      | 0xC0     | 0xFF          |
+
+  # T4-03: Branch Coverage — isPrefixOf rejects on a partial-byte boundary
+  Scenario: ShardId isPrefixOf rejects on partial-byte boundary
+    Given a ShardId encoded as "0xC0"
+    And data starting with "0x40"
+    When isPrefixOf is checked
+    Then isPrefixOf returns false
+
+  # T4-04: BVA — getBit at boundaries; throws past length
+  Scenario: ShardId getBit returns expected bits and rejects out-of-bounds
+    Given a ShardId encoded as "0xB0"
+    When the ShardId is decoded
+    Then getBit at index 0 returns 1
+    And getBit at index 1 returns 0
+    And getBit at index 2 returns 1
+    And getBit at index -1 throws "out of bounds"
+    And getBit at index 3 throws "out of bounds"
+
+  # T4-05: Error Guessing — empty input is rejected
+  Scenario: ShardId decode rejects empty input
+    Given a ShardId encoded as "0x"
+    When the ShardId is decoded
+    Then decoding throws with message containing "empty input"
+
+  # T4-06: Error Guessing — last byte without the trailing-1 marker is rejected
+  Scenario: ShardId decode rejects last byte without trailing-1 marker
+    Given a ShardId encoded as "0x00"
+    When the ShardId is decoded
+    Then decoding throws with message containing "end marker"
diff --git a/src/test/resources/org/unicitylabs/sdk/features/shard-load-testing.feature b/src/test/resources/org/unicitylabs/sdk/features/shard-load-testing.feature
new file mode 100644
index 0000000..3f25bf9
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/shard-load-testing.feature
@@ -0,0 +1,40 @@
+@slow @shard-load
+@shard-load
+Feature: Shard Load Testing
+  As an operator of a sharded aggregator setup
+  I want to measure per-shard throughput, success rates, and timing
+  So that I can verify shard performance under concurrent load
+
+  Background:
+    Given the aggregator is set up
+    And the shard topology is discovered
+
+  @shard-load-synchronized
+  Scenario Outline: Synchronized batches - <batchSize> ops x <batchCount> batches
+    Given <batchSize> x <batchCount> mint operations are prepared for each shard
+    When synchronized batches of <batchSize> are submitted <batchCount> times
+    Then the shard load report is printed
+
+    Examples:
+      | batchSize | batchCount |
+      | 1000      | 10        |
+
+  @shard-load-independent
+  Scenario Outline: Independent batches - <batchSize> ops x <batchCount> batches
+    Given <batchSize> x <batchCount> mint operations are prepared for each shard
+    When independent batches of <batchSize> are submitted <batchCount> times per shard
+    Then the shard load report is printed
+
+    Examples:
+      | batchSize | batchCount |
+      | 1000      | 10      |
+
+  @shard-load-pressure
+  Scenario Outline: Constant pressure - <concurrency> concurrent x <totalPerShard> total
+    Given <totalPerShard> mint operations are prepared for each shard
+    When constant pressure of <concurrency> concurrent operations is applied per shard
+    Then the shard load report is printed
+
+    Examples:
+      | concurrency | totalPerShard |
+      | 1000           | 10000            |
diff --git a/src/test/resources/org/unicitylabs/sdk/features/smoke.feature b/src/test/resources/org/unicitylabs/sdk/features/smoke.feature
new file mode 100644
index 0000000..4a6bddd
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/smoke.feature
@@ -0,0 +1,9 @@
+@smoke
+Feature: Cucumber wiring smoke test
+  Proves the BDD runner discovers features, resolves glue packages, and injects TestContext.
+  Runs without an aggregator.
+
+  Scenario: The test context is injected and writable
+    Given a fresh test context
+    When I remember the current user as "Alice"
+    Then the test context reports the current user as "Alice"
diff --git a/src/test/resources/org/unicitylabs/sdk/features/split-edge-cases.feature b/src/test/resources/org/unicitylabs/sdk/features/split-edge-cases.feature
new file mode 100644
index 0000000..dc4c972
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/split-edge-cases.feature
@@ -0,0 +1,22 @@
+Feature: Split edge cases — degenerate shapes and idempotency
+
+  # PR #110 — pin the boundary behaviours of TokenSplit + the new SplitMintJustification flow.
+
+  Background:
+    Given a mock aggregator is running
+    And Alice has a minted token with 2 payment assets
+
+  # Degenerate: split into 1 output (single recipient consumes everything)
+  Scenario: Split into a single output succeeds and produces 1 verified token
+    When Alice splits the token into 1 output that consumes all assets
+    Then the burn transaction succeeds
+    And 1 split token is minted
+    And each split token passes TokenSplit verification
+
+  # Idempotency: same cert request submitted twice should be safe — the aggregator either
+  # returns SUCCESS (idempotent dedup of identical bytes) or STATE_ID_EXISTS (state-collision
+  # rejection). What MUST NOT happen is silent double-spend or some other status.
+  Scenario: Re-submitting the same split-mint cert request is idempotent
+    When Alice splits the token into 2 outputs and remembers the first cert request
+    And the same cert request is submitted again
+    Then the second submission status is one of "SUCCESS" or "STATE_ID_EXISTS"
diff --git a/src/test/resources/org/unicitylabs/sdk/features/split-mint-justification-envelope.feature b/src/test/resources/org/unicitylabs/sdk/features/split-mint-justification-envelope.feature
new file mode 100644
index 0000000..afbeca1
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/split-mint-justification-envelope.feature
@@ -0,0 +1,24 @@
+Feature: SplitMintJustification CBOR envelope and invariants
+
+  Background:
+    Given a mock aggregator is running
+    And Alice has split-minted 2 tokens with 2 payment assets
+
+  # PR #110 406f890 — SplitMintJustification carries the burned token plus per-asset proofs
+  # in a sibling field of MintTransaction. This feature pins its envelope shape and the
+  # only constructor invariant: proofs cannot be empty.
+
+  Scenario: Round-trip preserves the underlying token and proofs byte-for-byte
+    Given the SplitMintJustification of one of Alice's split tokens
+    When the justification is encoded and decoded back
+    Then the decoded token's CBOR equals the original token's CBOR
+    And the decoded proofs equal the original proofs
+
+  Scenario: SplitMintJustification.create rejects empty proof list
+    When SplitMintJustification.create is called with an empty proof list
+    Then an error is thrown with message containing "proofs cannot be empty"
+
+  Scenario: Correctly-tagged 2-element payload decodes (positive shape, no version slot)
+    Given the SplitMintJustification of one of Alice's split tokens
+    When the justification bytes are decoded via SplitMintJustification.fromCBOR
+    Then no decoding error is raised
diff --git a/src/test/resources/org/unicitylabs/sdk/features/split-mint-justification-verifier.feature b/src/test/resources/org/unicitylabs/sdk/features/split-mint-justification-verifier.feature
new file mode 100644
index 0000000..9227419
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/split-mint-justification-verifier.feature
@@ -0,0 +1,24 @@
+Feature: SplitMintJustificationVerifier rejects malformed split mints
+
+  # Java SDK: SplitMintJustificationVerifier guards the split-mint flow with
+  # 12 distinct FAIL branches. Five are reachable via field-level mutation from
+  # outside the SDK (the ones below). The remaining seven require surgical
+  # CBOR/path bit-flipping and are covered in unit tests.
+
+  Background:
+    Given a mock aggregator is running
+    And Alice has split-minted 2 tokens with 2 payment assets
+
+  Scenario Outline: Verifier rejects a split mint when <mutation>
+    Given a CertifiedMintTransaction is mutated by <mutation>
+    When SplitMintJustificationVerifier.verify is invoked
+    Then the SplitMintJustificationVerifier verification result is FAIL
+    And the SplitMintJustificationVerifier failure message contains "<expectedSubstring>"
+
+    Examples:
+      | mutation                                              | expectedSubstring                                  |
+      | stripping the justification field                     | Transaction has no justification                   |
+      | stripping the data field                              | Assets data is missing                             |
+      | adding an extra asset to data not present in proofs   | Total amount of assets differ in token and proofs  |
+      | renaming one proof's assetId to one not in data       | not found in asset data                            |
+      | mismatching one asset's value between data and tree   | does not match asset tree leaf                     |
diff --git a/src/test/resources/org/unicitylabs/sdk/features/state-id-encoding.feature b/src/test/resources/org/unicitylabs/sdk/features/state-id-encoding.feature
new file mode 100644
index 0000000..e9a26b6
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/state-id-encoding.feature
@@ -0,0 +1,24 @@
+Feature: StateID encoding — 32-byte enforcement
+  As a maintainer of the state transition SDK
+  I want StateId.fromCBOR to reject any non-32-byte payload
+  So that legacy v1 (34-byte algorithm-prefixed) StateIDs cannot leak into the v2 wire format
+
+  # T4-27: BVA — only 32 bytes is accepted; surrounding lengths fail
+  Scenario Outline: StateId.fromCBOR with a <length>-byte payload <verb>
+    Given a CBOR byte string of length <length>
+    When StateId.fromCBOR is invoked
+    Then the StateId decode <result>
+
+    Examples:
+      | length | verb   | result                                          |
+      | 0      | fails  | throws with message containing "data length"    |
+      | 31     | fails  | throws with message containing "data length"    |
+      | 32     | passes | succeeds                                        |
+      | 33     | fails  | throws with message containing "data length"    |
+      | 34     | fails  | throws with message containing "data length"    |
+
+  # T4-28: Error Guessing — legacy v1 algorithm-prefixed StateID (34 bytes) is rejected
+  Scenario: StateId.fromCBOR rejects the legacy 34-byte algorithm-prefixed form
+    Given a CBOR byte string of length 34 starting with the sha256 algorithm prefix
+    When StateId.fromCBOR is invoked
+    Then the StateId decode throws with message containing "data length"
diff --git a/src/test/resources/org/unicitylabs/sdk/features/token-4level-owner-actions.feature b/src/test/resources/org/unicitylabs/sdk/features/token-4level-owner-actions.feature
new file mode 100644
index 0000000..0ea5a93
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/token-4level-owner-actions.feature
@@ -0,0 +1,78 @@
+@tree
+Feature: 4-Level Token Tree - Owner Actions and Double-Spend Prevention
+  As a token system
+  I want owners to be able to use their tokens
+  And I want to prevent double-spending via pre-transfer token references
+
+  Background:
+    Given the 4-level token tree is built
+
+  Scenario Outline: Owner <user> can create a valid transfer for <token>
+    When <user> creates a transfer for "<token>"
+    Then the transfer creation succeeds
+
+    Examples:
+      | user  | token     |
+      | Carol | T2a_carol |
+      | Dave  | T3a_dave  |
+      | Alice | T3b_alice |
+      | Alice | T4a_alice |
+      | Bob   | T4b_bob   |
+
+  Scenario Outline: Owner <user> can transfer <token> to <recipient>
+    When <user> transfers "<token>" to <recipient>
+    Then the transferred token passes verification
+
+    Examples:
+      | user  | token     | recipient |
+      | Carol | T2a_carol | Dave      |
+      | Dave  | T3a_dave  | Alice     |
+      | Alice | T3b_alice | Bob       |
+      | Alice | T4a_alice | Carol     |
+      | Bob   | T4b_bob   | Dave      |
+
+  Scenario Outline: Double-spend detected when <user> reuses pre-transfer token <token>
+    When <user> submits a duplicate transfer for pre-transfer token "<token>"
+    Then the re-spend is rejected without finalizing
+
+    Examples:
+      | user  | token   |
+      | Alice | T1a_pre |
+      | Alice | T1b_pre |
+      | Bob   | T2a_pre |
+      | Bob   | T2b_pre |
+      | Carol | T3a_pre |
+      | Carol | T3b_pre |
+      | Dave  | T4a_pre |
+      | Dave  | T4b_pre |
+
+  Scenario Outline: Non-owner <user> cannot use pre-transfer token <token>
+    When <user> tries to transfer "<token>"
+    Then the transfer fails with predicate mismatch
+
+    Examples:
+      | user  | token   |
+      | Bob   | T1a_pre |
+      | Carol | T1a_pre |
+      | Dave  | T1a_pre |
+      | Bob   | T1b_pre |
+      | Carol | T1b_pre |
+      | Dave  | T1b_pre |
+      | Alice | T2a_pre |
+      | Carol | T2a_pre |
+      | Dave  | T2a_pre |
+      | Alice | T2b_pre |
+      | Carol | T2b_pre |
+      | Dave  | T2b_pre |
+      | Alice | T3a_pre |
+      | Bob   | T3a_pre |
+      | Dave  | T3a_pre |
+      | Alice | T3b_pre |
+      | Bob   | T3b_pre |
+      | Dave  | T3b_pre |
+      | Alice | T4a_pre |
+      | Bob   | T4a_pre |
+      | Carol | T4a_pre |
+      | Alice | T4b_pre |
+      | Bob   | T4b_pre |
+      | Carol | T4b_pre |
diff --git a/src/test/resources/org/unicitylabs/sdk/features/token-4level-split-negative.feature b/src/test/resources/org/unicitylabs/sdk/features/token-4level-split-negative.feature
new file mode 100644
index 0000000..ff91e8c
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/token-4level-split-negative.feature
@@ -0,0 +1,53 @@
+@tree
+Feature: 4-Level Token Tree - Unauthorized Split Prevention
+  As a token system
+  I want to prevent unauthorized token splits
+  So that only token owners can split their tokens
+
+  Background:
+    Given the 4-level token tree is built
+
+  Scenario Outline: <user> cannot split live token <token> they do not own
+    When <user> tries to split "<token>"
+    Then the split fails with predicate mismatch
+
+    Examples:
+      | user  | token     |
+      | Alice | T2a_carol |
+      | Bob   | T2a_carol |
+      | Dave  | T2a_carol |
+      | Alice | T3a_dave  |
+      | Bob   | T3a_dave  |
+      | Carol | T3a_dave  |
+      | Bob   | T3b_alice |
+      | Carol | T3b_alice |
+      | Dave  | T3b_alice |
+      | Bob   | T4a_alice |
+      | Carol | T4a_alice |
+      | Dave  | T4a_alice |
+      | Alice | T4b_bob   |
+      | Carol | T4b_bob   |
+      | Dave  | T4b_bob   |
+
+  Scenario Outline: <user> cannot split burned token <token>
+    When <user> tries to split "<token>"
+    Then the split fails with predicate mismatch
+
+    Examples:
+      | user  | token      |
+      | Alice | T0_burned  |
+      | Bob   | T0_burned  |
+      | Carol | T0_burned  |
+      | Dave  | T0_burned  |
+      | Alice | T1a_burned |
+      | Bob   | T1a_burned |
+      | Carol | T1a_burned |
+      | Dave  | T1a_burned |
+      | Alice | T1b_burned |
+      | Bob   | T1b_burned |
+      | Carol | T1b_burned |
+      | Dave  | T1b_burned |
+      | Alice | T2b_burned |
+      | Bob   | T2b_burned |
+      | Carol | T2b_burned |
+      | Dave  | T2b_burned |
diff --git a/src/test/resources/org/unicitylabs/sdk/features/token-4level-transfer-negative.feature b/src/test/resources/org/unicitylabs/sdk/features/token-4level-transfer-negative.feature
new file mode 100644
index 0000000..3217c98
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/token-4level-transfer-negative.feature
@@ -0,0 +1,53 @@
+@tree
+Feature: 4-Level Token Tree - Unauthorized Transfer Prevention
+  As a token system
+  I want to prevent unauthorized transfers
+  So that only token owners can transfer their tokens
+
+  Background:
+    Given the 4-level token tree is built
+
+  Scenario Outline: <user> cannot transfer live token <token> they do not own
+    When <user> tries to transfer "<token>"
+    Then the transfer fails with predicate mismatch
+
+    Examples:
+      | user  | token     |
+      | Alice | T2a_carol |
+      | Bob   | T2a_carol |
+      | Dave  | T2a_carol |
+      | Alice | T3a_dave  |
+      | Bob   | T3a_dave  |
+      | Carol | T3a_dave  |
+      | Bob   | T3b_alice |
+      | Carol | T3b_alice |
+      | Dave  | T3b_alice |
+      | Bob   | T4a_alice |
+      | Carol | T4a_alice |
+      | Dave  | T4a_alice |
+      | Alice | T4b_bob   |
+      | Carol | T4b_bob   |
+      | Dave  | T4b_bob   |
+
+  Scenario Outline: <user> cannot transfer burned token <token>
+    When <user> tries to transfer "<token>"
+    Then the transfer fails with predicate mismatch
+
+    Examples:
+      | user  | token      |
+      | Alice | T0_burned  |
+      | Bob   | T0_burned  |
+      | Carol | T0_burned  |
+      | Dave  | T0_burned  |
+      | Alice | T1a_burned |
+      | Bob   | T1a_burned |
+      | Carol | T1a_burned |
+      | Dave  | T1a_burned |
+      | Alice | T1b_burned |
+      | Bob   | T1b_burned |
+      | Carol | T1b_burned |
+      | Dave  | T1b_burned |
+      | Alice | T2b_burned |
+      | Bob   | T2b_burned |
+      | Carol | T2b_burned |
+      | Dave  | T2b_burned |
diff --git a/src/test/resources/org/unicitylabs/sdk/features/token-4level-verification.feature b/src/test/resources/org/unicitylabs/sdk/features/token-4level-verification.feature
new file mode 100644
index 0000000..6e31f33
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/token-4level-verification.feature
@@ -0,0 +1,65 @@
+@tree
+Feature: 4-Level Token Tree - Verification
+  As a token system
+  I want to verify all tokens in a 4-level split/transfer tree
+  So that I can ensure the integrity of multi-level token operations
+
+  Background:
+    Given the 4-level token tree is built
+
+  Scenario Outline: Live token <token> passes Token.verify
+    Then "<token>" passes verification
+
+    Examples:
+      | token     |
+      | T2a_carol |
+      | T3a_dave  |
+      | T3b_alice |
+      | T4a_alice |
+      | T4b_bob   |
+
+  Scenario Outline: Burned token <token> passes Token.verify
+    Then "<token>" passes verification
+
+    Examples:
+      | token      |
+      | T0_burned  |
+      | T1a_burned |
+      | T1b_burned |
+      | T2b_burned |
+
+  Scenario Outline: Split token <token> passes TokenSplit.verify
+    Then "<token>" passes split verification
+
+    Examples:
+      | token     |
+      | T2a_carol |
+      | T3a_dave  |
+      | T3b_alice |
+      | T4a_alice |
+      | T4b_bob   |
+      | T1a_pre   |
+      | T1b_pre   |
+      | T2a_pre   |
+      | T2b_pre   |
+      | T3a_pre   |
+      | T3b_pre   |
+      | T4a_pre   |
+      | T4b_pre   |
+
+  Scenario Outline: Token <token> survives CBOR serialization round-trip
+    When "<token>" is exported to CBOR and imported back
+    Then the imported token has the same ID as "<token>"
+    And the imported token passes verification
+
+    Examples:
+      | token      |
+      | T2a_carol  |
+      | T3a_dave   |
+      | T3b_alice  |
+      | T4a_alice  |
+      | T4b_bob    |
+      | T0_burned  |
+      | T1a_burned |
+      | T1b_burned |
+      | T2b_burned |
diff --git a/src/test/resources/org/unicitylabs/sdk/features/token-cbor-integrity.feature b/src/test/resources/org/unicitylabs/sdk/features/token-cbor-integrity.feature
new file mode 100644
index 0000000..6468b3a
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/token-cbor-integrity.feature
@@ -0,0 +1,17 @@
+@cbor
+Feature: Token CBOR Import Integrity
+  Corrupted CBOR input is rejected during Token.fromCbor.
+
+  Background:
+    Given a mock aggregator is running
+    And Alice has a signing key
+    And Alice has a minted token
+
+  Scenario: Importing truncated CBOR data fails
+    When the token is exported to CBOR
+    And the CBOR data is truncated to half its length
+    Then importing the corrupted CBOR data fails with an error
+
+  Scenario: Importing random bytes as a token fails
+    When random bytes are used as token CBOR data
+    Then importing the corrupted CBOR data fails with an error
diff --git a/src/test/resources/org/unicitylabs/sdk/features/token-cbor-roundtrip.feature b/src/test/resources/org/unicitylabs/sdk/features/token-cbor-roundtrip.feature
new file mode 100644
index 0000000..2b37f53
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/token-cbor-roundtrip.feature
@@ -0,0 +1,32 @@
+@cbor
+Feature: Token CBOR Roundtrip — All States
+  CBOR export/import preserves token identity and passes verification.
+
+  Background:
+    Given a mock aggregator is running
+
+  Scenario: Freshly minted token survives CBOR roundtrip
+    Given Alice has a signing key
+    And Alice has a minted token
+    When the token is exported to CBOR
+    And the CBOR data is imported back to a token
+    Then the imported token has the same ID as the original
+    And the imported token passes verification
+
+  Scenario: Token after transfer survives CBOR roundtrip
+    Given Alice has a signing key
+    And Bob has a signing key
+    And Alice has a minted token
+    When Alice transfers the current token to Bob
+    And the token is exported to CBOR
+    And the CBOR data is imported back to a token
+    Then the imported token passes verification
+    And the imported token has 1 transaction in its history
+
+  Scenario: Split child token survives CBOR roundtrip
+    Given Alice has a signing key
+    And Alice has a minted token with 2 payment assets worth 100 and 200
+    When Alice splits the token into 2 new tokens
+    And split token 1 is exported to CBOR
+    And the CBOR data is imported back to a token
+    Then the imported token passes verification
diff --git a/src/test/resources/org/unicitylabs/sdk/features/token-certification-status.feature b/src/test/resources/org/unicitylabs/sdk/features/token-certification-status.feature
new file mode 100644
index 0000000..bbef95c
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/token-certification-status.feature
@@ -0,0 +1,25 @@
+@certification-status
+Feature: Certification Status Handling
+  Error statuses returned by the aggregator on malformed or unauthorized requests.
+
+  Background:
+    Given a mock aggregator is running
+
+  Scenario: Transfer signed with wrong key is rejected by aggregator
+    Given Alice has a minted token
+    And Bob is a registered user
+    When Alice creates a transfer to Bob signed with the wrong key
+    Then the certification response status is "SIGNATURE_VERIFICATION_FAILED"
+
+  @forgiving
+  Scenario: Duplicate mint is detected via inclusion proof mismatch
+    # Uses ForgivingTestAggregatorClient so both submissions return SUCCESS;
+    # detection lives at inclusion-proof verification where the leaf's hash
+    # doesn't match the second tx's hash.
+    Given a forgiving aggregator is running
+    And a user with a signing key
+    When the user submits a mint request for a specific token ID
+    And the user submits a second mint request for the same token ID
+    Then the first aggregator response is "SUCCESS"
+    And the second aggregator response is "SUCCESS"
+    But the inclusion proof verification rejects the second mint with "TRANSACTION_HASH_MISMATCH"
diff --git a/src/test/resources/org/unicitylabs/sdk/features/token-id-boundaries.feature b/src/test/resources/org/unicitylabs/sdk/features/token-id-boundaries.feature
new file mode 100644
index 0000000..e9c0578
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/token-id-boundaries.feature
@@ -0,0 +1,36 @@
+@boundaries
+Feature: Token ID Boundary Lengths
+
+  Background:
+    Given a mock aggregator client is set up
+    And a user with a signing key
+
+  Scenario Outline: Minting with <length>-byte token ID is accepted
+    When the user submits a mint request with a <length>-byte token ID
+    Then the certification response status is "SUCCESS"
+
+    Examples:
+      | length |
+      | 31     |
+      | 32     |
+      | 33     |
+
+  # T3-01: BVA — 0-byte TokenId produces a fixed state ID (deterministic hash)
+  # Since SHA256([] || MINT_SUFFIX) is always the same, this state ID is globally shared
+  # and was already committed in a previous aggregator round → STATE_ID_EXISTS.
+  # Tagged @stateful because this scenario assumes someone has previously minted a 0-byte
+  # token on this aggregator. On a freshly reset compose the first run returns SUCCESS;
+  # see the @fresh-aggregator counterpart for that case.
+  @stateful
+  Scenario: Minting with 0-byte token ID collides with pre-existing global state
+    When the user submits a mint request with a 0-byte token ID
+    Then the certification response status is "STATE_ID_EXISTS"
+
+  # T4-34: BVA — symmetric pair for the @stateful scenario above. On a fresh aggregator,
+  # the first 0-byte mint must succeed (otherwise the aggregator is broken before any
+  # state has accumulated). Run with --tags '@fresh-aggregator and not @stateful'
+  # immediately after a make docker-run-*-clean.
+  @fresh-aggregator
+  Scenario: Minting with 0-byte token ID succeeds on a fresh aggregator
+    When the user submits a mint request with a 0-byte token ID
+    Then the certification response status is "SUCCESS"
diff --git a/src/test/resources/org/unicitylabs/sdk/features/token-long-transfer-chain.feature b/src/test/resources/org/unicitylabs/sdk/features/token-long-transfer-chain.feature
new file mode 100644
index 0000000..bc6814a
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/token-long-transfer-chain.feature
@@ -0,0 +1,38 @@
+@chain
+Feature: Token Long Transfer Chain
+  As a user of the state transition SDK
+  I want long transfer chains to verify correctly
+  So that tokens maintain integrity through many transfers
+
+  Background:
+    Given a mock aggregator client is set up
+    And the following users are registered:
+      | name  |
+      | Alice |
+      | Bob   |
+    And Alice has a minted token
+
+  # T2-03: long-transfer-chain (BVA + Loop Testing)
+  Scenario: Token survives 10-hop transfer chain
+    When the token is transferred 10 times between Alice and Bob
+    Then the token should have 10 transactions in its history
+    And the token should pass verification
+
+  @nametag
+  Scenario Outline: Mint entry via <method> then 4-hop pubkey chain
+    Given Alice has a signing key
+    And Bob has a signing key
+    And Carol has a signing key
+    And Dave has a signing key
+    And Bob has registered the nametag "@bob" in domain "bdd/test"
+    When Alice mints a new token addressed to Bob via <method>
+    And Bob transfers the token to Alice via pubkey
+    And Alice transfers the token to Carol via pubkey
+    And Carol transfers the token to Dave via pubkey
+    Then the current token verifies
+    And the current token can be spent by Dave
+
+    Examples:
+      | method  |
+      | pubkey  |
+      | nametag |
diff --git a/src/test/resources/org/unicitylabs/sdk/features/token-minting.feature b/src/test/resources/org/unicitylabs/sdk/features/token-minting.feature
new file mode 100644
index 0000000..c457129
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/token-minting.feature
@@ -0,0 +1,37 @@
+@minting
+Feature: Token Minting
+
+  Background:
+    Given a mock aggregator is running
+
+  Scenario: Successfully mint a new token
+    Given a user with a signing key
+    When the user mints a new token
+    Then the certification response status is "SUCCESS"
+
+  Scenario: Minted token has correct properties
+    Given a user with a signing key
+    When the user mints a new token with specific token ID and type
+    Then the token ID matches the mint parameters
+    And the token type matches the mint parameters
+
+  Scenario: Minted token passes verification
+    Given a user with a signing key
+    When the user mints a new token
+    Then the token passes verification
+
+  @nametag
+  Scenario Outline: Mint a token addressed to Bob via <method>
+    # Blocked on UnicityId in Java v2 SDK — see BDD_MIGRATION_PLAN.md Phase 8.
+    Given Alice has a signing key
+    And Bob has a signing key
+    And Bob has registered the nametag "@bob" in domain "bdd/test"
+    When Alice mints a new token addressed to Bob via <method>
+    Then the certification response status is "SUCCESS"
+    And the current token verifies
+    And the current token can be spent by Bob
+
+    Examples:
+      | method  |
+      | pubkey  |
+      | nametag |
diff --git a/src/test/resources/org/unicitylabs/sdk/features/token-mixed-addressing.feature b/src/test/resources/org/unicitylabs/sdk/features/token-mixed-addressing.feature
new file mode 100644
index 0000000..8fc149e
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/token-mixed-addressing.feature
@@ -0,0 +1,35 @@
+@nametag
+Feature: Mixed addressing — nametag and pubkey in the same token lifetime
+  Regression surface for Sphere-style flows where entry and continuation
+  use different addressing methods.
+
+  Background:
+    Given a mock aggregator client is set up
+
+  @nametag-critical
+  Scenario Outline: 4-hop transfer chain runs under addressing sequence <seq>
+    When a 4-hop transfer chain runs using addressing sequence "<seq>"
+    Then the current token verifies
+
+    Examples:
+      | seq                                 |
+      | pubkey, pubkey, pubkey, pubkey      |
+      | nametag, pubkey, pubkey, pubkey     |
+      | pubkey, nametag, pubkey, pubkey     |
+      | pubkey, pubkey, nametag, pubkey     |
+      | pubkey, pubkey, pubkey, nametag     |
+      | nametag, nametag, pubkey, pubkey    |
+      | nametag, pubkey, nametag, pubkey    |
+      | pubkey, nametag, nametag, pubkey    |
+      | nametag, nametag, nametag, nametag  |
+      | nametag, pubkey, pubkey, nametag    |
+
+  @nametag-standard
+  Scenario Outline: 2-hop chain, <seq>
+    When a 2-hop transfer chain runs using addressing sequence "<seq>"
+    Then the current token verifies
+
+    Examples:
+      | seq              |
+      | nametag, pubkey  |
+      | pubkey, nametag  |
diff --git a/src/test/resources/org/unicitylabs/sdk/features/token-nametag-negative.feature b/src/test/resources/org/unicitylabs/sdk/features/token-nametag-negative.feature
new file mode 100644
index 0000000..d808c4d
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/token-nametag-negative.feature
@@ -0,0 +1,35 @@
+@nametag
+Feature: Nametag scope — hygiene scenarios (pending src cleanup)
+  These scenarios encode the option-1, mint-only scope as executable contracts.
+  They are expected to fail against the current src/ tree and turn green after
+  the developer removes the option-2 files at release time. See
+  docs/test-findings.md § "Severity reassessment".
+
+  # --- Rule A: no special nametag predicate ---
+
+  @pending-src-cleanup @nametag-critical
+  Scenario: A1 — no token may be addressed to UnicityIdPredicate(@alice)
+    # Pending until src/predicate/builtin/UnicityIdPredicate.ts is removed.
+    # When the option-2 trio is deleted and DefaultBuiltInPredicateVerifier no
+    # longer registers UnicityIdPredicateVerifier, constructing such an address
+    # or certifying such a mint must fail. Step implementation is deferred until
+    # that cleanup so this scenario remains undefined (hence skipped) today.
+
+  @pending-src-cleanup @nametag-standard
+  Scenario: A2 — BuiltInPredicateType enum contains only PayToPublicKey
+    # Pending until BuiltInPredicateType.UnicityId is removed from the enum.
+
+  # --- Rule B: mint-only, confused-deputy protection ---
+
+  @pending-src-cleanup @nametag-critical
+  Scenario: B1 — UnicityIdToken.fromCBOR rejects non-empty transfer list
+    # Pending until UnicityIdToken.fromCBOR enforces an empty transfers array
+    # structurally, before attempting to decode individual entries.
+
+  @pending-src-cleanup @nametag-critical
+  Scenario: B2 — latest-transaction read on a nametag token is impossible
+    # Pending until UnicityIdToken removes its public `transactions` getter.
+
+  @pending-src-cleanup @nametag-standard
+  Scenario: B3 — UnicityIdToken's public shape matches mint-only scope
+    # Pending: no public `transactions` accessor, no `transfer` method.
diff --git a/src/test/resources/org/unicitylabs/sdk/features/token-nametag-split.feature b/src/test/resources/org/unicitylabs/sdk/features/token-nametag-split.feature
new file mode 100644
index 0000000..f92d57a
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/token-nametag-split.feature
@@ -0,0 +1,54 @@
+@nametag
+Feature: Nametag-addressed split children
+  As a payer who fans out value to several recipients
+  I want split children to be addressable by nametag just like plain transfers
+  So that the same addressing story applies end-to-end
+
+  Background:
+    Given a mock aggregator client is set up
+    And Alice has a signing key
+    And Bob has a signing key
+    And Carol has a signing key
+
+  @nametag-standard
+  Scenario Outline: Split child 1 is routed to Bob via <method>
+    Given Bob has registered the nametag "@bob" in domain "bdd/test"
+    When Alice splits a 2-asset token and sends child 1 to Bob via <method>
+    Then the current token verifies
+    And the current token can be spent by Bob
+
+    Examples:
+      | method  |
+      | pubkey  |
+      | nametag |
+
+  @nametag-standard
+  Scenario Outline: Mixed-recipient split — child 1 via <bobMethod>, child 2 via <carolMethod>
+    Given Bob has registered the nametag "@bob" in domain "bdd/test"
+    And Carol has registered the nametag "@carol" in domain "bdd/test"
+    When Alice splits a 2-asset token, sends child 1 to Bob via <bobMethod>, and child 2 to Carol via <carolMethod>
+    # Each recipient holds their own child — this exercises the full
+    # (bobMethod x carolMethod) cross-product.
+
+    Examples:
+      | bobMethod | carolMethod |
+      | pubkey    | pubkey      |
+      | pubkey    | nametag     |
+      | nametag   | pubkey      |
+      | nametag   | nametag     |
+
+  @nametag-critical
+  Scenario Outline: Two-level split with mixed addressing (entry <entry>, grandchild <grandchild>)
+    Given Bob has registered the nametag "@bob" in domain "bdd/test"
+    And Carol has registered the nametag "@carol" in domain "bdd/test"
+    When Alice splits a 2-asset token and sends child 1 to Bob via <entry>
+    And after the split, Bob splits his child again and sends grandchild 1 to Carol via <grandchild>
+    Then the current token verifies
+    And the current token can be spent by Carol
+
+    Examples:
+      | entry   | grandchild |
+      | pubkey  | pubkey     |
+      | pubkey  | nametag    |
+      | nametag | pubkey     |
+      | nametag | nametag    |
diff --git a/src/test/resources/org/unicitylabs/sdk/features/token-nametag.feature b/src/test/resources/org/unicitylabs/sdk/features/token-nametag.feature
new file mode 100644
index 0000000..17726b4
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/token-nametag.feature
@@ -0,0 +1,37 @@
+@nametag
+Feature: Nametag-addressed tokens (Unicity ID, option 1)
+  As an SDK consumer
+  I want to address tokens to a human-readable @name
+  So that senders can resolve recipients without exchanging raw pubkeys
+
+  Background:
+    Given a mock aggregator client is set up
+    And Alice has a signing key
+    And Bob has a signing key
+
+  @nametag-critical
+  Scenario: Alice registers a nametag and it verifies
+    Given Alice has registered the nametag "@alice" in domain "bdd/test"
+    # Registration is proven by the Given step itself; no further assertion needed
+    # because registerNametag() in the helper calls UnicityIdToken.mint which
+    # internally runs verify().
+
+  @nametag-critical
+  Scenario Outline: Bob sends a token to Alice addressed via <method>
+    Given Alice has registered the nametag "@alice" in domain "bdd/test"
+    When Bob mints a new token addressed to Alice via <method>
+    Then the certification response status is "SUCCESS"
+    And the current token verifies
+    And the current token can be spent by Alice
+
+    Examples:
+      | method  |
+      | pubkey  |
+      | nametag |
+
+  @nametag-critical
+  Scenario: Nametag bytes do not appear in the minted token's CBOR
+    Given Alice has registered the nametag "@alice" in domain "bdd/test"
+    When Bob mints a new token addressed to Alice via nametag
+    Then the current token verifies
+    And the current token's CBOR does not contain the bytes of "@alice"
diff --git a/src/test/resources/org/unicitylabs/sdk/features/token-payment-journey.feature b/src/test/resources/org/unicitylabs/sdk/features/token-payment-journey.feature
new file mode 100644
index 0000000..5a1f4cb
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/token-payment-journey.feature
@@ -0,0 +1,28 @@
+@journey
+Feature: Full Payment Use Case Journey
+
+  Background:
+    Given a mock aggregator client is set up
+
+  # T3-03: Use Case Testing — end-to-end mint -> split -> pay -> verify
+  Scenario: Complete payment flow from mint through split to transfer
+    Given Alice has a minted token with 2 payment assets worth 100 and 200
+    And Bob is a registered user
+    When Alice splits the token into 2 parts keeping ownership
+    And Alice transfers the first split token to Bob
+    Then Bob's received token passes verification
+    And each split token passes TokenSplit verification
+
+  @nametag
+  Scenario Outline: Entry payment to a recipient addressed via <method>
+    Given Alice has a signing key
+    And Bob has a signing key
+    And Bob has registered the nametag "@bob" in domain "bdd/test"
+    When Alice mints a new token addressed to Bob via <method>
+    Then the current token verifies
+    And the current token can be spent by Bob
+
+    Examples:
+      | method  |
+      | pubkey  |
+      | nametag |
diff --git a/src/test/resources/org/unicitylabs/sdk/features/token-security.feature b/src/test/resources/org/unicitylabs/sdk/features/token-security.feature
new file mode 100644
index 0000000..2efe3f3
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/token-security.feature
@@ -0,0 +1,18 @@
+@security
+Feature: Token Security
+  Only the current owner can originate a transfer.
+
+  Background:
+    Given a mock aggregator is running
+    And Alice has a signing key
+    And Bob has a signing key
+    And Alice has a minted token
+
+  Scenario: Non-owner cannot create a transfer
+    When Bob tries to create a transfer of Alice's token
+    Then the transfer creation fails with a predicate mismatch error
+
+  Scenario: Previous owner cannot reclaim transferred token
+    Given Alice transfers the current token to Bob
+    When Alice tries to create a transfer of the token
+    Then the transfer creation fails with a predicate mismatch error
diff --git a/src/test/resources/org/unicitylabs/sdk/features/token-serialization-advanced.feature b/src/test/resources/org/unicitylabs/sdk/features/token-serialization-advanced.feature
new file mode 100644
index 0000000..220b5de
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/token-serialization-advanced.feature
@@ -0,0 +1,51 @@
+@cbor
+Feature: Token Serialization - Advanced Scenarios
+  As a token holder
+  I want to export and import tokens with transfer history via CBOR
+  So that I can persist and share tokens that have been transferred multiple times
+
+  Background:
+    Given a mock aggregator client is set up
+    And the following users are registered:
+      | name  |
+      | Alice |
+      | Bob   |
+      | Carol |
+      | Dave  |
+    And Alice has a minted token
+
+  Scenario: CBOR round-trip preserves single transfer history
+    When Alice transfers the token to Bob
+    And the current token is exported to CBOR
+    And the CBOR data is imported back to a token
+    Then the imported token should have the same ID as the current token
+    And the imported token should have 1 transaction in its history
+    And the imported token should pass verification
+
+  Scenario: CBOR round-trip preserves multi-hop transfer history
+    When Alice transfers the token to Bob
+    And Bob transfers the token to Carol
+    And the current token is exported to CBOR
+    And the CBOR data is imported back to a token
+    Then the imported token should have the same ID as the current token
+    And the imported token should have 2 transactions in its history
+    And the imported token should pass verification
+
+  Scenario: CBOR round-trip after 4-hop transfer chain
+    When Alice transfers the token to Bob
+    And Bob transfers the token to Carol
+    And Carol transfers the token to Dave
+    And Dave transfers the token to Alice
+    And the current token is exported to CBOR
+    And the CBOR data is imported back to a token
+    Then the imported token should have the same ID as the current token
+    And the imported token should have 4 transactions in its history
+    And the imported token should pass verification
+
+  Scenario: Imported token with history can be transferred again
+    When Alice transfers the token to Bob
+    And the current token is exported to CBOR
+    And the CBOR data is imported back to a token
+    And Bob transfers the imported token to Carol
+    Then the token should have 2 transactions in its history
+    And the token should pass verification
diff --git a/src/test/resources/org/unicitylabs/sdk/features/token-serialization.feature b/src/test/resources/org/unicitylabs/sdk/features/token-serialization.feature
new file mode 100644
index 0000000..73a14b7
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/token-serialization.feature
@@ -0,0 +1,17 @@
+@cbor
+Feature: Token Serialization
+
+  Background:
+    Given a mock aggregator client is set up
+    And Alice has a minted token
+
+  Scenario: Token can be exported and imported via CBOR
+    When the token is exported to CBOR
+    And the CBOR data is imported back to a token
+    Then the imported token has the same ID as the original
+    And the imported token has the same type as the original
+
+  Scenario: Imported token passes verification
+    When the token is exported to CBOR
+    And the CBOR data is imported back to a token
+    Then the imported token passes verification
diff --git a/src/test/resources/org/unicitylabs/sdk/features/token-split-advanced.feature b/src/test/resources/org/unicitylabs/sdk/features/token-split-advanced.feature
new file mode 100644
index 0000000..ea764c9
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/token-split-advanced.feature
@@ -0,0 +1,50 @@
+@split
+Feature: Token Split - Advanced Scenarios
+  Deferred until SplitSteps is extended with indexed-child tracking and
+  arbitrary-value-per-child plans (e.g. "2 parts with values 60/40 and 120/80").
+
+  Background:
+    Given a mock aggregator is running
+    And Alice has a signing key
+    And Bob has a signing key
+    And Carol has a signing key
+    And Alice has a minted token with 2 payment assets worth 100 and 200
+
+  Scenario: Split token and transfer parts to different users
+    When Alice splits the token into 2 parts with values 60/40 and 120/80
+    And Alice transfers split token 1 to Bob
+    And Alice transfers split token 2 to Carol
+    Then Bob should own split token 1
+    And Carol should own split token 2
+    And both split tokens should pass verification
+
+  Scenario: Recipient can transfer a received split token
+    When Alice splits the token into 2 parts with values 60/40 and 120/80
+    And Alice transfers split token 1 to Bob
+    And Bob transfers his split token to Carol
+    Then Carol should own the transferred split token
+    And the transferred split token should pass verification
+
+  Scenario: Multi-level split - split a received split token
+    When Alice splits the token into 2 parts with values 60/40 and 120/80
+    And Alice transfers split token 1 to Bob
+    And Bob splits his token into 2 sub-parts with values 30/30 and 60/60
+    Then 2 sub-split tokens should be created
+    And each sub-split token should pass verification
+
+  Scenario: CBOR round-trip preserves split token
+    When Alice splits the token into 2 parts with values 60/40 and 120/80
+    And split token 1 is exported to CBOR
+    And the CBOR data is imported back to a token
+    Then the imported split token should have the same ID
+    And the imported split token should pass verification
+
+  Scenario: Non-owner cannot split another user's token
+    When Alice transfers the token to Bob
+    And Alice tries to split Bob's token
+    Then the split should fail with predicate mismatch
+
+  Scenario: Cannot transfer original token after split
+    When Alice splits the token into 2 parts with values 60/40 and 120/80
+    And Alice tries to transfer the original token to Bob
+    Then the transfer should fail because the token was burned
diff --git a/src/test/resources/org/unicitylabs/sdk/features/token-split-boundaries.feature b/src/test/resources/org/unicitylabs/sdk/features/token-split-boundaries.feature
new file mode 100644
index 0000000..55cdde7
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/token-split-boundaries.feature
@@ -0,0 +1,18 @@
+@split
+Feature: Token Split - Value Boundary Validation
+
+  Background:
+    Given a mock aggregator is running
+    And Alice has a minted token with 2 payment assets worth 100 and 200
+
+  Scenario: Split where total exceeds original value fails
+    When Alice tries to split with values exceeding the original totals
+    Then the split fails with TokenAssetValueMismatchError
+
+  Scenario: Split where total is less than original value fails
+    When Alice tries to split with values less than the original totals
+    Then the split fails with TokenAssetValueMismatchError
+
+  Scenario: Split with minimum asset value of 1 is accepted
+    When Alice tries to split with minimum values of 1 and the remainder
+    Then the split validation succeeds
diff --git a/src/test/resources/org/unicitylabs/sdk/features/token-split-combinations.feature b/src/test/resources/org/unicitylabs/sdk/features/token-split-combinations.feature
new file mode 100644
index 0000000..d082d66
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/token-split-combinations.feature
@@ -0,0 +1,17 @@
+@split
+Feature: Token Split - Combinatorial Asset Configurations
+
+  Background:
+    Given a mock aggregator is running
+
+  Scenario Outline: Split token with <assetCount> assets into <splitCount> parts
+    Given Alice has a minted token containing <assetCount> payment assets
+    When Alice splits the token into <splitCount> equal parts
+    Then the split validation succeeds
+
+    Examples:
+      | assetCount | splitCount |
+      | 1          | 2          |
+      | 2          | 3          |
+      | 3          | 2          |
+      | 3          | 3          |
diff --git a/src/test/resources/org/unicitylabs/sdk/features/token-split-transfer.feature b/src/test/resources/org/unicitylabs/sdk/features/token-split-transfer.feature
new file mode 100644
index 0000000..52b18c8
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/token-split-transfer.feature
@@ -0,0 +1,73 @@
+@split
+Feature: Token Split and Transfer
+
+  Background:
+    Given a mock aggregator is running
+    And Alice has a minted token with 2 payment assets worth 100 and 200
+
+  Scenario: Original token cannot be used after split burn
+    Given Bob has a signing key
+    When Alice splits the token into 2 new tokens
+    And Alice tries to submit a transfer of the stale token to Bob
+    Then the re-spend is rejected without finalizing
+
+  Scenario: Split and transfer parts to different users
+    Given Bob has a signing key
+    And Carol has a signing key
+    When Alice splits the token into 2 parts
+    And Alice transfers split token 1 to Bob
+    And Alice transfers split token 2 to Carol
+    Then Bob's token passes verification
+    And Carol's token passes verification
+
+  Scenario: Recipient can further transfer a received split token
+    Given Bob has a signing key
+    And Carol has a signing key
+    When Alice splits the token into 2 parts
+    And Alice transfers split token 1 to Bob
+    Then Bob can transfer split token 1 to Carol
+    And Carol's received token passes verification
+
+  Scenario: Double-spend of a split token is prevented
+    Given Bob has a signing key
+    And Carol has a signing key
+    When Alice splits the token into 2 parts
+    And Alice transfers split token 1 to Bob
+    Then Alice cannot transfer split token 1 to Carol because it was already sent
+
+  Scenario: Multi-level split - split a token that was already split
+    Given Bob has a signing key
+    When Alice splits the token into 2 parts
+    And Alice transfers split token 1 to Bob
+    And Bob splits his token into 2 sub-parts
+    Then 2 sub-split tokens are created
+    And each sub-split token passes verification
+
+  Scenario: Multi-level split with transfer across 4 levels
+    Given Bob has a signing key
+    And Carol has a signing key
+    And Dave has a signing key
+    When Alice splits the token into 2 parts
+    And Alice transfers split token 1 to Bob
+    And Bob splits his token into 2 sub-parts
+    And Bob transfers sub-split token 1 to Carol
+    And Carol transfers sub-split token 1 to Dave
+    Then Dave's token passes verification
+    And Dave's token has the correct asset values
+
+  Scenario: Double-spend after multi-level split is prevented
+    Given Bob has a signing key
+    And Carol has a signing key
+    And Dave has a signing key
+    When Alice splits the token into 2 parts
+    And Alice transfers split token 1 to Bob
+    And Bob splits his token into 2 sub-parts
+    And Bob transfers sub-split token 1 to Carol
+    Then Bob cannot transfer sub-split token 1 to Dave because it was already sent
+
+  Scenario: Cannot spend a token after it has been split
+    Given Bob has a signing key
+    When Alice splits the token into 2 parts
+    And Alice transfers split token 1 to Bob
+    And Bob splits his token into 2 sub-parts
+    Then Bob cannot transfer the pre-split token because it was burned
diff --git a/src/test/resources/org/unicitylabs/sdk/features/token-split.feature b/src/test/resources/org/unicitylabs/sdk/features/token-split.feature
new file mode 100644
index 0000000..e99a841
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/token-split.feature
@@ -0,0 +1,28 @@
+@split
+Feature: Token Split
+  A token owner splits a token with 2 payment assets into 2 new tokens.
+
+  Background:
+    Given a mock aggregator is running
+    And Alice has a minted token with 2 payment assets
+
+  Scenario: Successfully split a token into multiple parts
+    When Alice splits the token into 2 new tokens
+    Then the burn transaction succeeds
+    And 2 split tokens are minted
+
+  Scenario: Split tokens are individually verifiable
+    When Alice splits the token into 2 new tokens
+    Then each split token passes TokenSplit verification
+
+  Scenario: Split fails when asset count does not match
+    When Alice tries to split with only 1 asset instead of 2
+    Then the split fails with TokenAssetCountMismatchError
+
+  Scenario: Split fails when asset ID is missing
+    When Alice tries to split with a wrong asset ID
+    Then the split fails with TokenAssetMissingError
+
+  Scenario: Split fails when asset value is incorrect
+    When Alice tries to split with incorrect asset values
+    Then the split fails with TokenAssetValueMismatchError
diff --git a/src/test/resources/org/unicitylabs/sdk/features/token-transaction-data.feature b/src/test/resources/org/unicitylabs/sdk/features/token-transaction-data.feature
new file mode 100644
index 0000000..b9a4711
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/token-transaction-data.feature
@@ -0,0 +1,22 @@
+@transaction-data
+Feature: Transaction Data Boundaries
+
+  Background:
+    Given a mock aggregator client is set up
+
+  Scenario: Minting with empty transaction data succeeds
+    Given a user with a signing key
+    When the user mints a token with empty transaction data
+    Then the certification response status is "SUCCESS"
+
+  Scenario: Minting with large transaction data succeeds
+    Given a user with a signing key
+    When the user mints a token with 10KB of random transaction data
+    Then the certification response status is "SUCCESS"
+
+  Scenario: Transfer with large transaction data succeeds
+    Given Alice has a signing key
+    And Bob is a registered user
+    And Alice has a minted token
+    When Alice transfers the token to Bob with 10KB of random data
+    Then the transferred token passes verification
diff --git a/src/test/resources/org/unicitylabs/sdk/features/token-transfer-chain.feature b/src/test/resources/org/unicitylabs/sdk/features/token-transfer-chain.feature
new file mode 100644
index 0000000..ec1cda0
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/token-transfer-chain.feature
@@ -0,0 +1,72 @@
+@chain
+Feature: Token Transfer Chain
+  As a token owner
+  I want to transfer tokens through multiple users
+  So that tokens can change hands in a chain while maintaining integrity
+
+  Background:
+    Given a mock aggregator client is set up
+    And the following users are registered:
+      | name  |
+      | Alice |
+      | Bob   |
+      | Carol |
+      | Dave  |
+    And Alice has a minted token
+
+  Scenario: Token can be transferred through a chain of 4 users
+    When Alice transfers the token to Bob
+    And Bob transfers the token to Carol
+    And Carol transfers the token to Dave
+    Then the token should have 3 transactions in its history
+    And the token should pass verification
+
+  Scenario: Long transfer chain preserves token ID and type
+    When Alice transfers the token to Bob
+    And Bob transfers the token to Carol
+    And Carol transfers the token to Dave
+    Then the token should have the same ID as the original
+    And the token should have the same type as the original
+
+  Scenario: Token can be transferred back to original owner
+    When Alice transfers the token to Bob
+    And Bob transfers the token to Carol
+    And Carol transfers the token to Dave
+    And Dave transfers the token to Alice
+    Then the token should have 4 transactions in its history
+    And the token should pass verification
+    And Alice should own the token
+
+  Scenario: Each transfer in chain is individually valid
+    When Alice transfers the token to Bob
+    And Bob transfers the token to Carol
+    And Carol transfers the token to Dave
+    Then the token should pass verification
+
+  Scenario Outline: Transfer chain with <chainLength> hops
+    When Alice transfers the token to Bob
+    And Bob transfers the token to Carol
+    Then the token should have <expectedTransactions> transactions in its history
+    And the token should pass verification
+
+    Examples:
+      | chainLength | expectedTransactions |
+      | 2           | 2                    |
+
+  @nametag
+  Scenario Outline: 3-hop transfer chain entered via <method>
+    Given Alice has a signing key
+    And Bob has a signing key
+    And Carol has a signing key
+    And Dave has a signing key
+    And Bob has registered the nametag "@bob" in domain "bdd/test"
+    When Alice mints a new token addressed to Bob via <method>
+    And Bob transfers the token to Carol via pubkey
+    And Carol transfers the token to Dave via pubkey
+    Then the current token verifies
+    And the current token can be spent by Dave
+
+    Examples:
+      | method  |
+      | pubkey  |
+      | nametag |
diff --git a/src/test/resources/org/unicitylabs/sdk/features/token-transfer-edge-cases.feature b/src/test/resources/org/unicitylabs/sdk/features/token-transfer-edge-cases.feature
new file mode 100644
index 0000000..6b028db
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/token-transfer-edge-cases.feature
@@ -0,0 +1,18 @@
+@edge-cases
+Feature: Token Transfer Edge Cases
+
+  Background:
+    Given a mock aggregator is running
+    And Alice has a signing key
+    And Alice has a minted token
+
+  Scenario: Owner transfers token to themselves
+    When Alice transfers the current token to Alice
+    Then the current token verifies successfully
+    And the current token is owned by Alice
+
+  Scenario: Stale token object cannot be reused after transfer
+    Given Bob has a signing key
+    When Alice transfers the current token to Bob
+    And Alice tries to submit a transfer of the stale token to Bob
+    Then the re-spend is rejected without finalizing
diff --git a/src/test/resources/org/unicitylabs/sdk/features/token-transfer.feature b/src/test/resources/org/unicitylabs/sdk/features/token-transfer.feature
index 8990274..f0511c3 100644
--- a/src/test/resources/org/unicitylabs/sdk/features/token-transfer.feature
+++ b/src/test/resources/org/unicitylabs/sdk/features/token-transfer.feature
@@ -1,52 +1,29 @@
 @token-transfer
-Feature: Token Transfer Operations
-  As a developer using the Unicity SDK
-  I want to perform token operations including minting, transfers, and splits
-  So that I can manage token lifecycle effectively
+Feature: Token lifecycle — mint, transfer, verify
+  Basic v2 token flow against a mock aggregator. Mirrors the TypeScript SDK's
+  CommonTestFlow.testTransferFlow: Alice mints, transfers to Bob, Bob transfers
+  to Carol; every hop must verify.
 
   Background:
-    Given the aggregator URL is configured
-    And trust-base.json is set
-    And the state transition client is initialized
-    And the following users are set up with their signing services
-      | name  |
-      | Alice |
-      | Bob   |
-      | Carol |
+    Given a mock aggregator is running
+    And Alice has a signing key
+    And Bob has a signing key
+    And Carol has a signing key
 
-  Scenario: Complete token transfer flow from Alice to Bob to Carol
-    Given "Alice" mints a token with random coin data
-    And user "Bob" create a nametag token with custom data "Bob Custom data"
-    When "Alice" transfers the token to "Bob" using a proxy address
-    And "Bob" finalizes all received tokens
-    Then "Bob" should own the token successfully
-    And all "Bob" nametag tokens should remain valid
-    And the token should maintain its original ID and type
-    When "Bob" transfers the token to "Carol" using an unmasked predicate
-    And "Carol" finalizes all received tokens
-    Then "Carol" should own the token successfully
-    And the token should have 2 transactions in its history
+  Scenario: Alice mints a token and it verifies
+    When Alice mints a token
+    Then the current token verifies successfully
+    And the current token is owned by Alice
 
-  Scenario Outline: Token minting with different configurations
-    Given user "<user>" with nonce of <nonceLength> bytes
-    When the user mints a token of type "<tokenType>" with coin data containing <coinCount> coins
-    Then the token should be minted successfully
-    And the token should be verified successfully
-    And the token should belong to the user
+  Scenario: Alice transfers a minted token to Bob
+    Given Alice has a minted token
+    When Alice transfers the current token to Bob
+    Then the current token verifies successfully
+    And the current token is owned by Bob
 
-    Examples:
-      | user  | nonceLength | tokenType | coinCount |
-      | Alice | 32         | Standard  | 2         |
-      | Bob   | 24         | Premium   | 3         |
-      | Carol | 16         | Basic     | 1         |
-
-  Scenario Outline: Name tag token creation and usage
-    Given "Carol" mints a token with random coin data
-    And user "<user>" create a nametag token with custom data "<nametagData>"
-    Then the name tag token should be created successfully
-    And the name tag should be usable for proxy addressing
-
-    Examples:
-      | user  | nametagData     |
-      | Bob   | Bob's Address   |
-      | Alice | Alice's Tag     |
\ No newline at end of file
+  Scenario: Alice -> Bob -> Carol transfer chain
+    Given Alice has a minted token
+    When Alice transfers the current token to Bob
+    And Bob transfers the current token to Carol
+    Then the current token verifies successfully
+    And the current token is owned by Carol
diff --git a/src/test/resources/org/unicitylabs/sdk/features/token-verification-details.feature b/src/test/resources/org/unicitylabs/sdk/features/token-verification-details.feature
new file mode 100644
index 0000000..94889e3
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/token-verification-details.feature
@@ -0,0 +1,23 @@
+@verification
+Feature: Token Verification Result Details
+
+  Background:
+    Given a mock aggregator client is set up
+
+  Scenario: Minted token verification result contains genesis and transfer rules
+    Given Alice has a signing key
+    And Alice has a minted token
+    When the token is verified against the trust base
+    Then the verification result has rule "TokenVerification" with status "OK"
+    And the verification result contains 2 sub-results
+    And sub-result 1 has rule "CertifiedMintTransactionVerificationRule" with status "OK"
+    And sub-result 2 has rule "TokenTransferVerification" with status "OK"
+
+  Scenario: Transferred token verification result includes transfer sub-entries
+    Given Alice has a signing key
+    And Bob is a registered user
+    And Alice has a minted token
+    When Alice transfers the token to Bob
+    And the transferred token is verified against the trust base
+    Then the verification result has rule "TokenVerification" with status "OK"
+    And the transfer verification sub-result contains 1 entry
diff --git a/src/test/resources/org/unicitylabs/sdk/features/token-wrong-trust-base.feature b/src/test/resources/org/unicitylabs/sdk/features/token-wrong-trust-base.feature
new file mode 100644
index 0000000..2594299
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/token-wrong-trust-base.feature
@@ -0,0 +1,11 @@
+@verification
+Feature: Token Verification - Wrong Trust Base
+  Verification fails against a trust base rooted in a different key.
+
+  Background:
+    Given a mock aggregator is running
+    And Alice has a signing key
+    And Alice has a minted token
+
+  Scenario: Token verified against wrong trust base fails
+    Then the token fails verification against a different trust base
diff --git a/src/test/resources/org/unicitylabs/sdk/features/transfer-transaction-fields.feature b/src/test/resources/org/unicitylabs/sdk/features/transfer-transaction-fields.feature
new file mode 100644
index 0000000..38891ea
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/transfer-transaction-fields.feature
@@ -0,0 +1,22 @@
+Feature: TransferTransaction round-trip preserves stateMask boundaries
+
+  # PR #110 1f24579 — the field formerly known as `nonce` was renamed to `stateMask`.
+  # This feature pins byte-for-byte preservation of stateMask across the CBOR boundary
+  # at varying byte lengths, including the empty boundary.
+
+  Background:
+    Given a mock aggregator is running
+    And Alice has a minted token
+
+  Scenario Outline: TransferTransaction round-trip preserves stateMask of <length> bytes
+    Given a TransferTransaction is built from Alice's token with a stateMask of <length> bytes
+    When the TransferTransaction is encoded and decoded
+    Then the decoded stateMask is <length> bytes
+    And the decoded stateMask byte-for-byte equals the original
+
+    Examples:
+      | length |
+      | 0      |
+      | 1      |
+      | 32     |
+      | 64     |
diff --git a/src/test/resources/org/unicitylabs/sdk/features/unicity-id-mint-transaction-envelope.feature b/src/test/resources/org/unicitylabs/sdk/features/unicity-id-mint-transaction-envelope.feature
new file mode 100644
index 0000000..577154d
--- /dev/null
+++ b/src/test/resources/org/unicitylabs/sdk/features/unicity-id-mint-transaction-envelope.feature
@@ -0,0 +1,16 @@
+Feature: UnicityIdMintTransaction CBOR envelope and round-trip
+
+  # PR #110 805e296 — UnicityIdMintTransaction's serialization was rewritten:
+  # CBOR_TAG envelope is now enforced, version is checked, and arity is asserted at 6.
+  # Wrong-tag and wrong-version cases are covered by the cbor-envelope-tags.feature outlines.
+  # This feature pins the positive round-trip and the field shape.
+
+  Scenario: UnicityIdMintTransaction round-trip preserves all fields
+    Given a UnicityIdMintTransaction is built with a sample lockScript, recipient, unicityId, tokenType, and targetPredicate
+    When the UnicityIdMintTransaction is encoded and decoded
+    Then the decoded transaction's tokenId equals the original
+    And the decoded transaction's tokenType equals the original
+    And the decoded transaction's lockScript encodes to the original lockScript bytes
+    And the decoded transaction's recipient encodes to the original recipient bytes
+    And the decoded transaction's targetPredicate encodes to the original targetPredicate bytes
+    And the decoded transaction's unicityId encodes to the original unicityId bytes