Feat/poa admission

cmd/contract-deployer/main.go

@@ -35,6 +35,15 @@ func main() {
 	p2pConf := p2pInterface.NewConfig(args.dataDir)
 	sysConfig := systemconfig.FromNetwork(args.network)
 	if args.sysconfigPath != "" {
+		// L8-03 (FULL-PRUNED 2026-07-09): a -sysconfig override rewrites ConsensusParams/
+		// OracleParams, which the node repo requires to be network-baked and identical on
+		// every node (params.go:118-129). Restrict it to devnet/mocknet — the SAME guard as
+		// cmd/vsc-node/main.go — so a production -sysconfig can't silently redirect a deploy
+		// to the wrong contract id / gateway.
+		if args.network != "devnet" && args.network != "mocknet" {
+			fmt.Println("Error: sysconfig overrides only allowed on devnet/mocknet, not", args.network)
+			os.Exit(1)
+		}
 		if err := sysConfig.LoadOverrides(args.sysconfigPath); err != nil {
 			fmt.Println("Error loading sysconfig overrides:", err)
 			os.Exit(1)

cmd/genesis-elector/main.go

@@ -42,6 +42,15 @@ func main() {
 	electionDb := elections.New(vscDb)
 	sysConfig := systemconfig.FromNetwork(args.network)
 	if args.sysconfigPath != "" {
+		// L8-03 (FULL-PRUNED 2026-07-09): a -sysconfig override rewrites ConsensusParams/
+		// OracleParams, which the node repo requires to be network-baked and identical on
+		// every node (params.go:118-129). Restrict it to devnet/mocknet — the SAME guard as
+		// cmd/vsc-node/main.go — so a production -sysconfig can't silently fork this binary's
+		// view of consensus params off the network.
+		if args.network != "devnet" && args.network != "mocknet" {
+			fmt.Println("Error: sysconfig overrides only allowed on devnet/mocknet, not", args.network)
+			os.Exit(1)
+		}
 		if err := sysConfig.LoadOverrides(args.sysconfigPath); err != nil {
 			fmt.Println("Error loading sysconfig overrides:", err)
 			os.Exit(1)

cmd/mapping-bot/contract-interface/const.go

@@ -15,3 +15,21 @@ const LastHeightKey = "h"
 
 const PrimaryPublicKeyStateKey = "pubkey"
 const BackupPublicKeyStateKey = "backupkey"
+
+// ---------------------------------------------------------------------------
+// BTC vault-rotation-v2 (must stay byte-identical to the contract's
+// btc-mapping-contract/contract/constants: a mismatch silently reads the wrong
+// state key and the rotation driver goes blind).
+// ---------------------------------------------------------------------------
+
+// VaultRegistryKey holds the packed vault-generation registry (the "v" list).
+// Absent/empty on a non-vault contract and on a pre-rotation deploy — the
+// rotation driver treats both as "nothing to do".
+const VaultRegistryKey = "v"
+
+// MigrationSweepPrefix keys the per-sweep migration record ("ms-<txid>"). Its
+// presence means a migration sweep is in flight and not yet settled.
+const MigrationSweepPrefix = "ms" + DirPathDelimiter
+
+// PendingUnmapPrefix keys the per-unmap record ("us-<txid>", delete-at-confirm).
+const PendingUnmapPrefix = "us" + DirPathDelimiter

cmd/mapping-bot/main.go

@@ -42,6 +42,15 @@ func main() {
 
 	sysConfig := systemconfig.FromNetwork(args.network)
 	if args.sysconfigPath != "" {
+		// L8-03 (FULL-PRUNED 2026-07-09): a -sysconfig override rewrites ConsensusParams/
+		// OracleParams, which the node repo requires to be network-baked and identical on
+		// every node (params.go:118-129). Restrict it to devnet/mocknet — the SAME guard as
+		// cmd/vsc-node/main.go — so a production -sysconfig can't silently misdirect this
+		// privileged oracle binary (its BTC L1 endpoint / target contract id).
+		if args.network != "devnet" && args.network != "mocknet" {
+			fmt.Println("Error: sysconfig overrides only allowed on devnet/mocknet, not", args.network)
+			os.Exit(1)
+		}
 		if err := sysConfig.LoadOverrides(args.sysconfigPath); err != nil {
 			fmt.Println("Error loading sysconfig overrides:", err)
 			os.Exit(1)
@@ -187,6 +196,7 @@ func main() {
 			// At head — still run unmap/confirmations, then sleep before checking again
 			bot.HandleUnmap()
 			bot.HandleConfirmations()
+			bot.HandleVaultRotation()
 			releaseBlockLease(bot, blockHeight, instanceID)
 			time.Sleep(chainCfg.SleepInterval)
 			cancel()
@@ -219,6 +229,11 @@ func main() {
 			defer wg.Done()
 			bot.HandleUnmap()
 			bot.HandleConfirmations()
+			// Drive the vault-rotation lifecycle (build the next migration tranche /
+			// write off an un-sweepable residual / advance retire→purge). Runs after
+			// confirmations so a sweep that just settled is seen as settled. No-op on a
+			// contract with no vault registry, and internally rate-limited.
+			bot.HandleVaultRotation()
 		}()
 		wg.Wait()
 		releaseBlockLease(bot, blockHeight, instanceID)

cmd/mapping-bot/mapper/call_contract_l2.go

@@ -42,7 +42,9 @@ func (b *Bot) callContractL2(
 		return "", fmt.Errorf("fetch L2 nonce: %w", err)
 	}
 
-	rcLimit := b.BotConfig.RcLimit()
+	// Per-action: the vault-rotation ops need a far higher ceiling than the bot's
+	// configured default, which every other action keeps unchanged (see rcLimitFor).
+	rcLimit := b.rcLimitFor(action)
 	call := &transactionpool.VscContractCall{
 		ContractId: b.BotConfig.ContractId(),
 		Action:     action,