Mediums batch 2

[lordbutterfly-hive]

PR — go-vsc-node: MED fix batch (gateway/wasm/oracle/runtime/dids/keystore) + ecrecover host-import HIGH + EVM-bridge devnet test suite

37 files changed = 21 (5 MED commits) + 16 new devnet test/helper files.

Title

fix(go-vsc): register crypto.ecrecover_strict/canonical host imports (un-brick contract ecrecover, HIGH) + 22 review6 MEDs across gateway/wasm/oracle/runtime/dids/keystore + EVM-bridge devnet test suite

---

⚠ THE HIGH — DS-RE-1: contract ecrecover host imports were never registered

df295dc1 — The account-mapping + zk contracts import crypto.ecrecover_strict (withdrawals) and crypto.ecrecover_canonical (deposits), but go-vsc never registered these host functions. On a real gc.custom WASM build the contract bricks on every ecrecover path. It was masked locally because the !gc.custom SDK stub delegates strict→plain. FIXED: both host imports registered in modules/wasm/runtime_ipc/wasm.go; strict rejects high-S (malleability), canonical normalizes — both empirically verified against go-ethereum. This is the cross-repo lynchpin: deploy this host BEFORE any contract WASM that imports them (see Deploy Order) or the contract bricks on instantiate.

---

MED findings closed (22 numbered + round hardening)

gateway/p2p — 7e9ab539

• Bls #3 / Fixes issue of db_test.go's database growing to unbounded size during tests. #6 ValidateMessage: switch/default to drop junk message types instead of processing them.
• Fix state rollback in contract test #55 sign_response made relay-safe.
• fix: TSS channel deadlocks, session/map memory leaks #110 ParseMessage now propagates the JSON error instead of swallowing it.
• (also) electionPeerIDs rebuilt every ACTION_INTERVAL rather than only on epoch change — stale peer set fix.

gateway/multisig — 7e9ab539

• chain relay logging + code logic refactoring #54 bhMu data-race guard around storeBh/loadBh.
• Contract test util state diff, update contract #56 rotation-alone scheduling gated on Version0_2_0Active (fixes the MED-56 co-fire race; see also R2-6c below).
• Mapping bot: multi-chain support, retry logic, health status, port flag #81 per-signer telemetry in waitForSigs.
• Fix/pre launch audit #105 rotation timeout 5s → 30s.
• fix: hive.draw intent bypass, TSS dispatcher data race, UpdateRcMap m… #112 ticker-based waitCheckBh replaces a busy-wait.
• GatewayKeyFromBlsSeed defer-zeroize of key material.

wasm/sdk + host — 7e9ab539, round3/5

• Contract test util: map state store by contract id #37 additive sp1_verify_groth16_ex host fn.
• Fix/oracle deadlock #92 deterministic system.call panic rendering, gated on SdkErrorDeterminismVersion {0,2,0}.
• added btc mapping id #119 additive contracts.read_ex returning an exists bool.
• Feat/onchain gossip readiness v2 #130 WASM init-guard: host captures the _initialize result and aborts with WASM_INIT_ERROR when the gate is active; gated on WasmInitGuardVersion {0,3,0}; threaded via WasmInitGuardCtxKey through transactions.go, execution-context.go (WithInitGuard), and the GQL simulate path; currentConsensus 2→3.

oracle — 7e9ab539, round3

• fix: empty auths crash, stake double-debit, gas overflow, oracle hei… #109 / fix: DoS hardening — sleep loop, simulate bomb, pubsub flood, HTTP ti… #111 / fix: remote node crash via P2P, unsafe uint64 underflows, TSS nil dereference #113 relayDedupStore persistence interface (loadDedup/storeDedup/clearDedup); prunedRecoveryBudget 20s + prunedRecoveryPerPeerPolls=7; Warn on full-channel sig drop.
• fix: node crash via empty required_auths in Hive custom_json #114 eth-header parent-hash chain check on producer + witness, gated on Version0_2_0Active.
• C-F5 (round3) verifyEthHeaderChain guards a typed-nil *ethChainData before any field deref (a typed nil satisfies the interface assertion but panics on .ParentHash).

runtime — 7e9ab539, round2/3/4

• sign uses gossip, one gossip per height #136 / CD-1 IsSupportedAt() version-gates runtime acceptance at create/update AND at the call site (transactions.go, before w.Execute) so a contract record with an invalid runtime inserted directly into Mongo yields a deterministic tx-level failure on all nodes instead of reaching the Execute default-case panic.
• C-R24 / R2-4 Execute default branch: explicitly-commented unreachable-assertion panic with the determinism rationale (the generic signature can't build result.Err[Result]; zero-value Result[T] has IsOk()==true which would mask a wiring regression — so panic, but documented as provably-unreachable since IsSupportedAt gates create/update).
• C-RV / R2-5 SimulateContractCalls now adds WithTryCatch gated on TryCatchICCVersion, matching the four options the on-chain path sets (WithPendulumApplier, WithTryCatch, WithSdkErrorDeterminism, WithInitGuard) — Simulate was missing WithTryCatch, diverging from on-chain ICC try-semantics.
• C-RV / R2-6c assertIntervalDivisibility strengthened to require strict ordering ACTION_INTERVAL < ROTATION_INTERVAL < SYNC_INTERVAL (equal intervals pass divisibility but permanently starve actions — reintroduces MED-56).

dids — 7e9ab539

• wasm vm ipc runner #9 EthDID.Verify length guard (65 bytes) before indexing sigBytes[64] (panic-on-malformed-sig fix).

keystore — 7e9ab539

• MED-13 os.Chmod(tssKeysDir, 0700) after flatfs.CreateOrOpen — TSS key dir perms.

---

CONSENSUS-VERSION GATING — review this carefully (determinism)

The fixes that change on-chain behavior are version-gated so nodes stay in lockstep until activation:

• Version0_2_0Active gates: fix: node crash via empty required_auths in Hive custom_json #114 oracle relay/witness, Contract test util state diff, update contract #56 BlockTick scheduling.
• SdkErrorDeterminismVersion {0,2,0} gates: Fix/oracle deadlock #92 deterministic system.call panic.
• WasmInitGuardVersion {0,3,0} gates: Feat/onchain gossip readiness v2 #130 init-guard (currentConsensus 2→3).
• TryCatchICCVersion gates: R2-5 simulate WithTryCatch.
• Ungated (off consensus path, safe to land immediately): additive host fns Contract test util: map state store by contract id #37 added btc mapping id #119, plus fix: hive.draw intent bypass, TSS dispatcher data race, UpdateRcMap m… #112 fix: DoS hardening — sleep loop, simulate bomb, pubsub flood, HTTP ti… #111 fix: remote node crash via P2P, unsafe uint64 underflows, TSS nil dereference #113 fix: empty auths crash, stake double-debit, gas overflow, oracle hei… #109 Fix/pre launch audit #105 Mapping bot: multi-chain support, retry logic, health status, port flag #81 chain relay logging + code logic refactoring #54 wasm vm ipc runner #9 fix (streamer): future block streaming, duplicate block conflict #13.
  Reviewer: confirm no behavior-changing fix is ungated, and that the gating versions match the intended activation height.

---

EVM-BRIDGE DEVNET TEST SUITE (16 new files — this is the integration proof for THIS PR and the account-mapping PR)

Real 5-node docker devnet + anvil L1. tests/devnet/: evm_anvil.go (anvil + MPT tx/receipt-trie proofs), evm_l2_sign.go (evm-DID L2 signing), evm_bot.go (bot runner), evm_bridge_setup.go (shared harness: deploy + wire mock verifier + RC bootstrap + deployWithRetry), and the waves:

Wave	Proves
W1 evm_bridge_w1	ETH deposit: ecrecover_canonical recovers L1 depositor (proves DS-RE-1 host import), tx-trie verify vs real anvil root, observed-dedup, chainId, gas-tax. FAIL→PASS demonstrates the account-mapping host-"" HIGH fix.
W2 evm_bridge_w2	Withdrawal close-out: PendingSpend JSON (H-F1), confirmSpend flat-10 + intent-bind + tx/receipt-trie (H-F2), all-zero-bloom receiptsRoot (CC-1), ecrecover_strict==vault (DS-F1), single nonce advance.
W3 evm_bridge_w3	Double-spend: Type-B drop-proof can't force-refund a SUCCEEDED withdrawal (H-SM2), Type-A status!=0 (H-SM1), no refund/no double-spend.
ZK evm_bridge_zk	zk-verifier reject paths (#85 shape gate, #65, required-fields). Accept path = Milo's SP1 proof (out of scope).
W6Neg evm_bridge_w6neg	admin/negative matrix 15/15 (pause, registerToken/setGasReserve bounds, unmapETH/map degenerate).
BotRes evm_bridge_botres	bot checkpoint persist/resume + the bot-"h" scan-height fix (see PR3); LastScannedBlock 0→74.
BotH evm_bridge_both	proves the bot-"h" contract↔bot mismatch finding.

All green; full regression re-swept (W1/W2/W3/ZK/W6Neg PASS). Status: /mnt/o/MED-FIX-2026-06-19/devnet-results/STATUS-DEVNET.md.

---

DEPLOY ORDER (mandatory — cross-repo coupling)

1. THIS host first (med/gv-develop, ecrecover_strict/canonical imports) BEFORE any contract WASM that imports them, or the contract bricks on instantiate.
2. Then account-mapping (review6) + bot (EVM #154) + zk per the campaign handoff.

Reviewer guide

1. DS-RE-1 is the headline — verify both host imports registered in runtime_ipc/wasm.go, strict rejects high-S, canonical normalizes.
2. Consensus gating (section above) — no behavior change ungated; versions correct.
3. Init-guard (Feat/onchain gossip readiness v2 #130) threads a ctx key through 3 call sites — confirm all three (transactions.go, execution-context.go, GQL simulate).
4. Devnet suite is the integration proof; it deploys the account-mapping WASM, so this PR + the account-mapping PR verify together.

NOTE — branch base

med/gv-develop is 5 commits ahead of origin/develop. If you want a tests-only or fixes-only split, say so; as-is the branch carries both the 5 MED commits and the devnet suite → one PR to develop.

Hygiene

LF line endings (verified). No .wasm/binaries staged. TODO before merge: 3 devnet test files (evm_bridge_w0/wmock/zk) hardcode a local /home/clauderfly/... WASM path — being parameterized to an env var w/ default (does not affect CI logic, but shouldn't ship a machine path).