[Jainakin]

The Node binding migrates the maintained beta.5 boundary to rgb-lib-bfa and complete-invoice proxy-1.0 sends. Recipient keys, encryption and deadlines are retained; nullable legacy metadata is preserved without fabricated IDs. External/watch-only signing, signer shutdown/session cleanup, BIP-322 and VSS are retained.

Source: ce1032cc0ece3171e1e6cc17870733c2751a6045. All 41 JavaScript contract/installer tests and types pass; current PR contract CI is green. Shared registry versions remain pinned. The current five-target Release/runtime matrix and actual packed consumer pass; exact producer checkout/owner identities are recorded below. See BFA-MIGRATION.md.

The maintained refresh repair compares complete snapshot content, including private proxy keys, rather than forcing a backup for every refresh. Real mutation, missing receipt, pending/failed backup and both sync modes remain covered.

Component	Exact source
Focused RLN	c29d1b2dfe43ba95c25ced8984f09e42c789d6af (#212)
rgb-lib-bfa	962730a211f0f7569d7ad8ae777052f433d87655 (#4)
LDK	510189d5700a6d1406229ce7523e181c3838715e (#59)

Maintained adapter SHA-256: ae0b1f29d2f81b8b5d219b9e749f97238ce1cc86777cb07a9c01d5e7fdfd88f9.

Qualification scope: historical adapter cf92a461… actual Darwin Debug consumers passed strict contract import controls, signer/session teardown, BIP-322, VSS fresh-directory restoration, funded BTC round trips and a genuine local 100 BUSDT mint followed by four ordinary acknowledged blind/witness transfers. Restoring a snapshot retained the private key for an invoice created before backup. The subsequent fixed-tip stable-poll check exposed repeated VSS uploads despite identical complete snapshot content; that failed evidence is retained, and burn/redemption was not invoked.

The current maintained adapter ae0b1f29… passes 116 Rust and 18 C-FFI cases. Actual normally admitted Darwin Debug Bare/Node consumers pass lifecycle, signer teardown, BIP-322 and local encrypted VSS restore/policy/fault controls. Separate funded qualification retains BTC/BFA transfers, pre-backup invoice-key restoration and unchanged fixed-tip backup generations. Both runtimes import the supplied 639-byte Signet BUSDT contract with exact identity, zero ownership and idempotent reimport; those checks are public reads, not funded Signet or hosted-bridge acceptance.

RGB configuration must supply a protocol-1.0 unlockRequest.proxy_endpoint. The inherited omitted-field default still points to a legacy 0.2 public proxy; manager-level proxyEndpoint alone is not injected into native unlock. Iris migration profiles explicitly configure the new endpoint. Receive fails closed when no valid protocol-1.0 endpoint is available.

Concrete limits:

• Ordinary locally funded BTC/RGB Lightning channel opening needs missing library-owned final-zero-locktime construction APIs. Guards stop before signing; incoming/existing channels remain separately unqualified. Iris stays on-chain only.
• External-signer VSS currently derives authentication/encryption material from public bootstrap data, while snapshots include private proxy-operation keys. Functional encrypted transport/CAS/restore does not establish cloud confidentiality; private signer-derived material requires an upstream API.
• Cold ambiguous burn recovery requires durable exact intent-to-native-operation correlation and independent proof/anchor validation. Completed-result replay is separate; an unresolved intent must block another burn.

All five current Node Release targets passed run 39481022002, including actual native runtime tests. Producer checkout 95bd5b82f405e6a527c2627f291531b7606c03a7 has the complete tree of owner ce1032cc0ece3171e1e6cc17870733c2751a6045; the owner adds CI only over runtime owner 3339951b…. Downloaded source/native bytes, normal release packaging, and an actual optimized Darwin Node+WDK 12d7ace1 packed consumer pass. Current local Iris Simulator BTC/BUSDT acceptance consumes the qualified optimized graph; mobile BIP-322 and funded Node reopen/persistence also pass. The current mobile 1 BUSDT burn is natively Settled with 99 BUSDT remaining. Saved consignment/.utexoburn, six-confirmed anchor and official typed TS_BURN operation identity match. The local software/mock-TEE path passed dry verification and one canonical 1,000,000-base-unit payout to the fresh reviewed recipient; identical-proof replay returned HTTP 409/code 65535 (already redeemed), with recipient balance, consumed-burn flag and exactly-one payout/event counts unchanged. Root independently checked actual canonical RPC captures; the full receipt verifier passed. This is local software functional qualification, not independent RGB-consensus/enclave-signature verification or hosted/hardware acceptance. RLN submodule-ancestry CI still awaits unmerged LDK #59; the check remains intact.

Unpublished 0.2.0-bfa.0 migration candidate. No hosted dev-bridge operation, merge or publication. Published beta.5 and the shared baseline remain preserved. Testing used the existing iOS 27 Simulator after explicit user-authorized takeover/reset; unrelated running processes remain preserved. RLN #211 is unchanged.