diff --git a/docs/e2e/v5.4.0-beta1-deploy/01-TESTDATA.md b/docs/e2e/v5.4.0-beta1-deploy/01-TESTDATA.md
new file mode 100644
index 00000000..c0ada4f8
--- /dev/null
+++ b/docs/e2e/v5.4.0-beta1-deploy/01-TESTDATA.md
@@ -0,0 +1,129 @@
+# 01 — TESTDATA (v5.4.0-beta.1 FRESH REDEPLOY — Sepolia mainnet rehearsal)
+
+> TX-Value-Verification framework, document 1 of 5.
+> Source of truth for every address, actor and precondition used by the live E2E run.
+> **A green receipt is not a proven feature** — this document only fixes the inputs; proof lives in 02-PLAN (L2 state assertions) and 03-RESULTS (real tx hashes).
+
+> **FRAMING — this is NOT a new version.** This run re-deploys the **same `v5.4.0-beta.1` release code** cleanly from scratch on Sepolia (`./deploy-core sepolia --fresh-deploy` → `DeployLive.s.sol`) as a **mainnet-deployment rehearsal**. **No `contracts/src/*.sol` changed** — only deploy/test scripts were hardened. The deployed contracts therefore ARE `v5.4.0-beta.1`, and the two beta.1 GA blockers disappear on a clean deploy:
+> - `SuperPaymaster.version()` now correctly returns **`SuperPaymaster-5.4.0`** (no stale literal — see §2.1).
+> - `SuperPaymaster.APNTS_TOKEN()` **== `config.aPNTs`** (no `queueSetAPNTsToken` migration, no config↔on-chain divergence — the beta.1 §2.3 reconcile items are GONE — see §2.3).
+> Companion: [`REHEARSAL-RECORD.md`](./REHEARSAL-RECORD.md) (the deploy-level summary this 5-doc suite is the evidence layer beneath).
+
+## 1. Network & Infrastructure
+
+| Item | Value |
+|---|---|
+| Network | Sepolia testnet |
+| Chain ID | `11155111` |
+| EntryPoint (ERC-4337 v0.7) | `0x0000000071727De22E5E9d8BAf0edAc6f37da032` |
+| Chainlink ETH/USD feed | `0x694AA1769357215DE4FAC081bf1f309aDC325306` |
+| Read RPC | Alchemy Sepolia endpoint (from `.env.sepolia`) — **reads only** |
+| Broadcast RPC | `https://ethereum-sepolia-rpc.publicnode.com` (`E2E_BROADCAST_RPCS`) |
+| Release tag (code) | `v5.4.0-beta.1` (fresh full redeploy 2026-06-16; deploy path = `DeployLive.s.sol`) |
+| Deploy config (canonical) | `deployments/config.sepolia.json` (`updateTime` 2026-06-16 13:20, `srcHash` `14ba1a4d…16d9`) |
+| Source-verification record | `deployments/verify.sepolia.contracts-6-16.md` (Etherscan source-verified) |
+
+**RPC split rationale**: Alchemy occasionally accepts a tx but does not propagate it (the "ghost-nonce" failure mode, 2026-06-13). The suite therefore READS via Alchemy (the production endpoint under test) but ALSO broadcasts every tx to publicnode so an accept-but-don't-propagate primary cannot strand it. Clear with `E2E_BROADCAST_RPCS=""` only when deliberately testing the primary RPC in isolation.
+
+## 2. Deployed Addresses (fresh deploy 2026-06-16)
+
+### 2.1 New / changed by the fresh deploy
+
+| Contract | Address | Version / note |
+|---|---|---|
+| SuperPaymaster (proxy) | `0x030025f40d509b1a99547bAEb3795bD27F7182b7` | impl `0x24a94572cfB6Ca6C8dE107431043556D461d8cFf`. `version()` = **`SuperPaymaster-5.4.0`** (clean — confirmed on-chain in I1, see 03). |
+| SuperPaymaster (impl) | `0x24a94572cfB6Ca6C8dE107431043556D461d8cFf` | content = v5.4.0-beta.1 |
+| Registry (proxy) | `0x3F920B25f8b65988359C372F66F036E48adFc556` | impl `0x1770338C0669d3333473a72CF0c164Ccc640Dc34`. `version()` = `Registry-5.4.0`. |
+| Registry (impl) | `0x1770338C0669d3333473a72CF0c164Ccc640Dc34` | |
+| X402Facilitator | `0x326Fc3413c8A0185b0179B971C69813B6dFD971B` | `X402Facilitator-1.0.0`, owner = deployer |
+| PolicyRegistry | `0x8c2488d46d5447418558c38AA6441720df656094` | `PolicyRegistry-1.0.0` |
+| TimelockController | `0xB734df3c0A1809bc06708512363D368Ac51dF1A2` | minDelay = 2 days |
+
+> **NO version-string deferral this run.** Unlike beta.1 (whose on-chain `version()` read `5.3.3`), the fresh deploy compiles and deploys current source, so `version()` returns the correct `5.4.0` strings. The only residual is a *test-script hygiene* item: `check-contracts.js` still carries a stale **expected-version table** (`expected Registry-4.1.0`, `SuperPaymaster-4.1.0`, …) and prints `MISMATCH` warnings — but it still PASSES, and the on-chain values are correct (see 03, group [1]).
+
+### 2.2 Core / supporting (from `deployments/config.sepolia.json`)
+
+| Contract | Address |
+|---|---|
+| GToken | `0x20a051502a7AE6e40cfFd6EBe59057538E698984` |
+| GTokenStaking | `0x3B363598746Ea57314d4869B160940948c569D48` |
+| MySBT | `0x072A0D12f4212B6baD7c6d0A633eaffbDE9105bF` |
+| xPNTsFactory | `0xCec3655525a112882E74Fb7C26AcB267a07724cb` |
+| `aPNTs` (`config.aPNTs` **== `SuperPaymaster.APNTS_TOKEN`**) | `0x9e66B457E0ABb1F139FD8A596d00f784eBA2873b` — base accounting token AND operator xPNTs gas token (see §2.3). |
+| PNTs (Mycelium xPNTs sample) | `0xC687f8a115D308ECD39658a8EE33bC3c8F75EE31` |
+| PaymasterFactory | `0x0Aa06EA5295eeD4D48c93c594Db1CBf3626971A5` |
+| PaymasterV4 impl | `0x59DCA5861aaDA602fE1BFbfcc36DFAc36C58623d` |
+| PaymasterV4 clone (active AOA) | `0x957852251f44570dc2B60Dde0954f191FF3372eE` |
+| MicroPaymentChannel | `0x405851A141Cde827E33247d4D4089Af2814c2FF5` (`MicroPaymentChannel-1.3.0`) |
+| ReputationSystem | `0x7fEd690E1663755e24a1C9d6164336809d68a578` |
+| BLSAggregator | `0x15387e161c1b3dAe7c66Fbd5c1F32837B58B2e79` |
+| DVTValidator | `0x19BA9829C784E4A41b68960b9c0bA55f83718997` |
+| AgentIdentityRegistry (`config` **== SP-wired**) | `0x8004A818BFB912233c491871b3d84c89A494BD9e` (official ERC-8004) |
+| AgentReputationRegistry (ERC-8004) | `0x8004B663056A597Dffe9eCcC1965A193B7388713` |
+| AgentValidationRegistry (ERC-8004) | `0x8004Cb1BF31DAf7788923b405b754f57acEB4272` |
+| SimpleAccountFactory | `0x91E60e0613810449d098b0b5Ec8b51A0FE8c8985` |
+
+> **Source-of-truth model.** `deployments/config.sepolia.json` is authoritative for the deployed-contract address registry and is exactly what the E2E suite reads (it SHA-256-fingerprints the whole file to key its idempotent skip-cache, so any address change forces a full re-run). On a fresh deploy there is **exactly one source of truth, and it does not split**: the two SuperPaymaster runtime pointers that DIVERGED in beta.1 now match the file (§2.3).
+
+### 2.3 On-chain runtime pointers — NO divergence on the fresh deploy
+
+The two beta.1 "reconcile-before-GA" items both vanish on a clean deploy. Verified on-chain this run:
+
+| Pointer | `config.sepolia.json` | `SuperPaymaster` getter (on-chain) | Status |
+|---|---|---|---|
+| Base accounting token | `aPNTs` = `0x9e66B457…` | `APNTS_TOKEN()` = **`0x9e66B457…`** — operator `deposit`/`withdraw`/`aPNTsBalance` move THIS token (B2 asserts `APNTS_TOKEN (0x9e66B457…) balance after withdraw`). | **MATCH** — wired directly at `initialize()`; no `pendingAPNTsToken`, no `queueSetAPNTsToken` migration, no in-flight timelock. |
+| Agent identity registry | `agentIdentityRegistry` = `0x8004A818…` | `agentIdentityRegistry()` = **`0x8004A818…`** (B4 asserts `agentIdentityRegistry restored == 0x8004a818…`). | **MATCH** — SP wired to the official ERC-8004 registry; dual-channel eligibility queries it. |
+
+> Because `APNTS_TOKEN == config.aPNTs`, the **same** token (`0x9e66B457…`) is both the protocol base accounting unit AND the operator's xPNTs gas token in this deployment. End-user balances, `burnFromWithOpHash`, `getDebt`, and operator `aPNTsBalance` all reference `0x9e66B457…`. The beta.1 "two-tokens-both-symbol-aPNTs" hazard does not exist here.
+
+## 3. Actors & Funding Gate
+
+| Role | Identity | Funding requirement (GATE — run is INVALID if unmet) |
+|---|---|---|
+| Deployer / Owner / Operator / AAStar community | EOA `0xb5600060e6de5E11D3636731964218E53caadf0E` (keystore `DEPLOYER_ACCOUNT`; signer priority keystore > `PRIVATE_KEY` > anvil key) | Sepolia ETH for admin + handleOps; is X402Facilitator owner, SP owner, Registry owner, MySBT daoMultisig, operator treasury, AAStar (`aastar.eth`) community owner. Holds `ROLE_COMMUNITY` + `ROLE_PAYMASTER_SUPER` + `ROLE_PAYMASTER_AOA`. |
+| Community (Anni / Mycelium, `mushroom.box`) | EOA `0xEcAACb915f7D92e9916f449F7ad42BD0408733c9` | Sepolia ETH; holds `ROLE_COMMUNITY` + `ROLE_PAYMASTER_SUPER`; GToken stake locked; SBT minted. Also the gasless **recipient** in TC1–TC4. |
+| End-user AA account A (sender) | SimpleAccount `0xECD9C07f648B09CFb78906302822Ec52Ab87dd70` (via factory) | xPNTs balance for balance-pay; SBT status set true (`RegisterEnduser.s.sol`). Only SimpleAccount (A) signs EIP-191-compatibly. |
+| Agent sender (ERC-8004) | registered Agent NFT holder, NO SBT | Sepolia ETH; would prove dual-channel eligibility — **not set up this run** (owed, §5 + 04). |
+| x402 payer / payee | EOAs holding USDC + xPNTs | payer holds test USDC (EIP-3009) and xPNTs (direct settle) |
+| Price keeper | any funded key | Sepolia ETH; runs price-cache update before E2E |
+
+**Funding gate is hard**: every signer must hold Sepolia ETH before the run. A zero-balance signer must SKIP (exit 2), never produce a false-green. The suite proactively mints test tokens to AA accounts during `setup-gasless.js` and is idempotent (`SKIP_PASSED=1` skips already-green tests for the current deployment fingerprint).
+
+## 4. Test Tokens
+
+| Token | Address | Use |
+|---|---|---|
+| `aPNTs` (`config.aPNTs` == `APNTS_TOKEN`) | `0x9e66B457E0ABb1F139FD8A596d00f784eBA2873b` | **Single token, dual role this deploy.** Protocol base accounting unit (operator `deposit`/`withdraw`/`aPNTsBalance`, B2) AND the operator's xPNTs gas token (user balances, `burnFromWithOpHash`, user `getDebt`). symbol `aPNTs`. |
+| PNTs (xPNTs sample, Mycelium) | `0xC687f8a115D308ECD39658a8EE33bC3c8F75EE31` | Second community gas token: burn-on-sponsor (TC3), multi-operator/multi-token proof. |
+| USDC (Sepolia) | per `.env.sepolia` / x402 test config | x402 EIP-3009 `receiveWithAuthorization` settlement |
+| GToken | `0x20a051502a7AE6e40cfFd6EBe59057538E698984` | Role stake lock / slash governance |
+
+## 5. Pre-Run Checklist (all must be ✅ before any live tx)
+
+- [ ] `deployments/config.sepolia.json` matches §2 addresses (fingerprint current; `srcHash 14ba1a4d…`).
+- [ ] `.env.sepolia` present; `DEPLOYER_ACCOUNT` keystore unlockable.
+- [ ] All actors in §3 hold Sepolia ETH (funding gate).
+- [ ] **Deployer holds `ROLE_PAYMASTER_SUPER`** — a fresh deploy grants the deployer `COMMUNITY` + `PAYMASTER_AOA` but `configureOperator` requires `PAYMASTER_SUPER`; `TestAccountPrepare.s.sol` now grants it idempotently (fresh-deploy fix, see 03 §Failures #1).
+- [ ] **Price keeper run immediately before E2E** — SuperPaymaster + PaymasterV4 caches fresh. Stale price → ops rejected. Most common false-FAIL; refresh first.
+- [ ] **Base credit tier raised for L1 representativeness** — `setCreditTier(1,300)` + `setCreditTier(2,300)` so a fresh ENDUSER's validate-time charge (~120 aPNTs on Sepolia L1) fits the credit ceiling. **L1-gas artifact only — the contract default (100) is kept; on the OP L2 mainnet target the charge is ~1–5 aPNTs so 100 is plenty (see 03 §Credit-ceiling + OP-L2 caveat).**
+- [ ] `E2E_BROADCAST_RPCS` set to publicnode (default) for redundant broadcast.
+- [ ] `node_modules` installed under `script/gasless-tests/`.
+- [ ] AA account A funded with `aPNTs`/`PNTs` and SBT status = true (`RegisterEnduser.s.sol`).
+- [ ] Operator `aPNTsBalance` funded; PaymasterV4 escrow funded via `depositFor()`.
+- [ ] Genesis communities present: AAStar (`aastar.eth`, deployer-owned) and Mycelium/MushroomDAO (`mushroom.box`, Anni-owned), xPNTs deployed + `propagateSuperPaymaster` done.
+
+## 6. How To Run
+
+```bash
+# fresh full deploy (mainnet rehearsal path):
+./deploy-core sepolia --fresh-deploy        # → DeployLive.s.sol
+./prepare-test sepolia                       # grants roles, configures operator (idempotent)
+forge script contracts/script/v3/RegisterEnduser.s.sol ...   # SBT status for AA-A
+
+cd script/gasless-tests
+./run-all-e2e-tests.sh                        # full suite (37 groups, dependency-ordered)
+SKIP_PASSED=1 ./run-all-e2e-tests.sh          # idempotent re-run
+ONLY="x402" ./run-all-e2e-tests.sh            # single phase
+```
+
+Exit-code convention: `0` = clean pass (all executed + asserted), `1` = FAIL (revert/assert), `2` = SKIP/inconclusive (precondition unmet). Exit 2 must NOT be treated as a pass.
diff --git a/docs/e2e/v5.4.0-beta1-deploy/02-PLAN.md b/docs/e2e/v5.4.0-beta1-deploy/02-PLAN.md
new file mode 100644
index 00000000..cfc2781d
--- /dev/null
+++ b/docs/e2e/v5.4.0-beta1-deploy/02-PLAN.md
@@ -0,0 +1,98 @@
+# 02 — PLAN (v5.4.0-beta.1 fresh-redeploy E2E Scenario ↔ TX Matrix)
+
+> TX-Value-Verification framework, document 2 of 5.
+> Each row maps one scenario to one intended on-chain call, with a **3-layer Verification** spec.
+> Same release code as `docs/e2e/v5.4.0-beta.1/` — this matrix is re-applied against the **fresh-deploy addresses** (01-TESTDATA §2).
+>
+> **Core principle — a green receipt ≠ a proven feature.** Every row's Verification column carries:
+> - **L1 Receipt**: tx mined, `status = 1` (or, for ⛔, mined-revert / `eth_call`-revert with the named selector).
+> - **L2 State**: the precise on-chain delta that proves the feature actually happened (the load-bearing assertion).
+> - **L3 Feature**: the user-facing business outcome the L2 delta implies.
+>
+> **Negatives (⛔) are first-class.** A ⛔ row passes ONLY if it reverts with the EXACT named reason/selector. Any other revert (or success) = FAIL.
+>
+> Script names reference `script/gasless-tests/` (see `run-all-e2e-tests.sh`). Group numbers `[N]` are the suite's execution order (03-RESULTS).
+
+## Tier A — Headline scenarios (MUST be 1:1 live, real tx)
+
+| ID | TX (intended call) | Feature | Actor | Params | Business expectation | Verification (L1 Receipt / L2 State / L3 Feature) | Type |
+|---|---|---|---|---|---|---|---|
+| 1.1 | `EntryPoint.handleOps` → SP `validatePaymasterUserOp` + `postOp` + `burnFromWithOpHash` | AOA+ gasless via xPNTs (balance-pay) | Operator + AA-A | userOp, xPNTs token, opHash | User pays gas in xPNTs, no ETH | L1: handleOps status=1, `TransactionSponsored`. L2: user xPNTs balance ↓ (burn), `operators[op].aPNTsBalance` accounting, `totalTxSponsored`++. L3: gasless tx settled in community token. Group [27] (aPNTs) / [28] (PNTs). | ✅ |
+| 1.2 | SP `validatePaymasterUserOp`+`postOp` → burn branch / `recordDebtWithOpHash` | Credit/debt path | Operator + AA-A | userOp, opHash, credit ceiling | Sponsor user; burn if balance, else accrue debt to ceiling | L1: handleOps status=1. L2: balance>0 → xPNTs burned, `debts[user]` unchanged; balance==0 → `DebtRecorded`, `debts[user]` ↑. L3: onboarding without prefunding. Group [29] (TC4). | ✅ |
+| 1.5 | `EntryPoint.handleOps` → PaymasterV4 `validatePaymasterUserOp`+`postOp`; escrow via `depositFor` | AOA independent paymaster (pre-funded escrow) | Operator + AA-A | userOp, token, escrow | Independent per-community paymaster pays from escrow | L1: handleOps status=1. L2: `balances[user][token]` ↓ by cost, `balances[treasury][token]` ↑. L3: standalone AOA works without shared pool. Group [26]. | ✅ |
+| 2.1 | `X402Facilitator.settleX402Payment` (EIP-3009 `receiveWithAuthorization`, USDC) | x402 native USDC settlement | Facilitator (deployer) | payer auth sig, recipient, amount, nonce | Off-chain-signed USDC payment settled on-chain, fee taken | L1: status=1, `X402PaymentSettled`. L2: payer USDC ↓, recipient ↑ (amount − fee), `facilitatorEarnings` ↑, `x402SettlementNonces[key]` set. L3: agent pays USDC gaslessly. Group [31]. | ✅ |
+| 2.2 | `X402Facilitator.settleX402PaymentDirect` (`transferFrom` xPNTs, C-02 signed auth) | x402 direct xPNTs settlement | Facilitator + payer | C-02 auth sig, payer, recipient, amount, nonce | Settle xPNTs payment with payer's signed authorization | L1: status=1, `X402PaymentSettled`. L2: payer xPNTs ↓, recipient ↑, nonce consumed (triple-key). L3: community-token x402 micropayment. Group [32]. | ✅ |
+| 3.3 | `Registry.registerRole(ENDUSER)` / `MySBT.safeMintForRole` + `updateSBTStatus` | End-user onboarding + SBT status gate | Community | enduser addr, role, SBT status | Onboard end-user so they qualify for sponsorship | L1: status=1, role + SBT mint events. L2: `sbtHolders[user]=true`; `isEligibleForSponsorship==true`. L3: only onboarded users get sponsored. Group [3] A1 + `RegisterEnduser.s.sol`. | ✅ |
+| 3.4 | `EntryPoint.handleOps` with agent sender (no SBT) → SP `isEligibleForSponsorship` (`isRegisteredAgent`) | Dual-channel eligibility (SBT OR ERC-8004 Agent NFT) | Operator + agent sender | userOp from agent, no SBT | Registered agents sponsored without an SBT | L1: handleOps status=1, `TransactionSponsored`. L2: agent sender `sbtHolders==false` yet `isEligibleForSponsorship==true` via `isRegisteredAgent`; tx settled. L3: agent economy gets gasless access. Group [22] G2. **Deferred-live this run — read-only logic only (see Tier C / 04).** | ✅ (read-only this run) |
+| 8.3 | SP-internal `burnFromWithOpHash` then replay same opHash | Burn replay protection | SP (caller) | opHash, token, amount | One opHash → one burn, ever | L1: first burn status=1; replay reverts. L2: `usedOpHashes[opHash]=true`; replay reverts **`OperationAlreadyProcessed`**. L3: no double-charge. Group [27]–[29] + C1. | ⛔ (replay leg) |
+| 7.1 | SP `configureOperator` / `deposit` / `withdraw` / `setOperatorPaused` | Operator config & funding lifecycle | Operator | aPNTs amount, exchangeRate, pause, treasury, limits | Operator manages its own pool | L1: each call status=1. L2: `aPNTsBalance` ↑ deposit / ↓ withdraw; `isPaused` toggles; treasury/minTxInterval stored. L3: self-service operator treasury. Groups [5] B1 / [6] B2 / [7] B3. | ✅ |
+
+## Tier B — Supporting scenarios (live E2E)
+
+| ID | TX (intended call) | Feature | Actor | Params | Business expectation | Verification (L1 / L2 / L3) | Type |
+|---|---|---|---|---|---|---|---|
+| 1.3 | SP `repayDebt` | Debt repayment & exchange-rate settlement | User / payer | debt amount, xPNTs | User clears accrued debt | L1: status=1, repay event. L2: `debts[user]` ↓; xPNTs burned at rate. L3: credit revolves. Group [17] E4. **No-op this run (deployer/AA-A debt==0 — burn branch was taken).** | ✅ (no-op) |
+| 1.4 | SP `postOp` over-charge refund branch | postOp over-charge refund | Operator (in postOp) | actual vs prepaid gas | Operator not over-debited when actual < prepaid | L1: handleOps status=1. L2: buffer recovered. L3: accurate accounting. Covered indirectly in [27]–[29]. | ✅ |
+| 1.6 | SP `validatePaymasterUserOp` with `exchangeRate > maxRate` | Rate-commitment / rug-pull guard | Operator + AA | userOp with rate commitment, maxRate | Reject if operator's rate exceeds user-committed max | L1: validation returns SIG_FAILURE / mined-revert. L2: **`DRYRUN_RATE_COMMITMENT_VIOLATED`** / SIG_FAILURE; no burn, no debt. L3: user protected. Group [9] B5 dry-run + C1. | ⛔ |
+| 2.3 | `X402Facilitator.settleX402Payment*` re-submit same nonce | x402 replay protection (triple-key nonce) | Facilitator | used nonce | Same authorization cannot settle twice | L1: replay reverts. L2: **`NonceAlreadyUsed`**; no balance change. L3: no double-settlement. Groups [31]/[32]. | ⛔ |
+| 2.4 | SP `setFacilitatorFeeBPS` + `withdrawFacilitatorEarnings` | Facilitator fee config & earnings withdraw | Owner / facilitator | feeBPS, withdraw | Facilitator configures and collects fees | L1: status=1. L2: `facilitatorFeeBPS` set; on withdraw `facilitatorEarnings[op]`→0. L3: facilitator monetization. **Withdraw not exercised — earnings==0** (footnote). Group [8] B4. | ✅ (partial) |
+| 2.5 | `MicroPaymentChannel.open` / `settle` / `close` | Streaming micropayment channel | Payer / payee | deposit, settle amount | Off-chain streaming with on-chain escrow | L1: each call status=1. L2: open→settled→closed; escrow moves payer→payee; remainder refunded. L3: pay-per-use streaming. Group [30]. | ✅ |
+| 3.1 | `Registry.registerRole(ROLE_COMMUNITY)` + `lockStake` + `mintForRole` | Community registration | Community | role, stake, SBT | Community joins protocol | L1: status=1, `RoleRegistered`. L2: `hasRole(community, ROLE_COMMUNITY)==true`; stake locked; SBT minted. L3: community can sponsor. Group [3] A1. | ✅ |
+| 3.2 | `Registry.registerRole(ROLE_PAYMASTER_*)` + `_requireCommunityForPaymaster` + `configureOperator` | Operator registration | Operator | role, community link | Operator registered under a community | L1: status=1. L2: `hasRole(op, ROLE_PAYMASTER_SUPER/AOA)==true`; operator config created. L3: community-backed operators sponsor. Groups [4] A2 / [5] B1 / [7] B3. | ✅ |
+| 3.5 | `Registry.exitRole` + `unlockAndTransfer` + `burnSBT` | Role exit / SBT burn / stake unlock | Role holder | role | Clean exit returns stake net fee | L1: status=1, `RoleExited`. L2: GToken returned = locked − exitFee; SBT burned; role revoked. L3: reversible membership. Group [20] F3 (admin surface). | ✅ |
+| 4.1 | `GTokenStaking.lockStakeWithTicket` / `topUpStake` | Role stake lock + min-stake floor | Role holder | ticket, amount | Stake meets/exceeds role floor | L1: status=1. L2: `roleLocks[holder][role].amount` ↑; rejects below floor. L3: skin-in-the-game. Groups [18] F1 / [20] F3. | ✅ |
+| 4.4 | `BLSValidator.registerBLSPublicKey` / `setPermissionlessBLSRegistration` | BLS key registration + permissionless toggle | Validator / owner | BLS pubkey, toggle | Validators register; owner toggles open registration | L1: status=1. L2: pubkey stored; permissionless flag gates. L3: DVT onboarding. Group [33]. | ✅ (+⛔ gate leg) |
+| 6.1 | ReputationSystem `setRule` / `setCommunityReputation` / `setNFTBoost` | Reputation scoring & community rules | Community / owner | rule, score, boost | Configure reputation inputs | L1: status=1. L2: rule/score/boost stored & readable. L3: reputation drives credit tiers. Groups [12] D1 / [21] G1 / [25] H2. | ✅ |
+| 6.2 | SP credit-tier gating + ERC-8004 `giveFeedback` in postOp | Reputation-gated sponsorship + agent feedback | Operator + agent | reputation, agent feedback | Higher reputation → higher credit; agents get feedback | L1: handleOps status=1. L2: credit tier applied per reputation; **agent feedback emission NOT asserted** (no live agent op). L3: reputation economy. Groups [21] G1 / [23] G3 / [29]. | ✅ (partial) |
+| 7.2 | SP `setProtocolFee` / `setAPNTSPrice` / `withdrawProtocolRevenue` | Protocol economics | Owner | feeBPS, price, withdraw | Owner tunes economics, collects revenue | L1: status=1. L2: `protocolFeeBPS`, `aPNTsPriceUSD` within bounds; `protocolRevenue`→0 on withdraw. L3: sustainable protocol. Groups [8] B4 / [15] E2. | ✅ |
+| 7.3 | SP `updatePrice` / `setCachedPrice`; query with stale cache | Oracle price update & staleness | Keeper / owner | price, timestamp | Fresh price required for ops | L1: update status=1. L2: cached price+timestamp updated; stale → **`DRYRUN_STALE_PRICE`**. L3: no mispriced sponsorship. Group [14] E1. | ✅ (+⛔ stale leg) |
+| 7.6 | SP `_creditExceeded` (C-01) + H-1 `isBlocked` | Credit ceiling enforcement (anti-drain) | Operator + user | accrued debt vs ceiling | Stop sponsoring past credit ceiling | L1: over-ceiling op mined-revert / `AA34` at validate. L2: H-1 `isBlocked`; `debts[user]` ≤ ceiling; `availableCredit = limit − totalDebt`. L3: anti-drain. Group [36] I1. **Read-only state this run; the L1-charge>ceiling artifact surfaced live in [27]–[29] (see 03 §Credit-ceiling).** | ⛔ |
+| 7.7 | SP `retryPendingDebt` / `clearPendingDebt` | Pending-debt recovery | Owner | user, debt | Owner recovers/clears stuck debt | L1: status=1. L2: pending debt re-applied/cleared. L3: debt hygiene. Group [9] B5. **No-op (no pending debt).** | ✅ (no-op) |
+| 7.9 | PaymasterFactory `deployPaymaster` + Registry `activate/deactivate` + `addStake` + `pause` | PaymasterV4 lifecycle | Operator | salt, config | Full AOA paymaster lifecycle | L1: each call status=1. L2: clone active in Registry; pause toggles; escrow ±. L3: independent paymaster ops. Group [34] P2. | ✅ |
+| 8.1 | xPNTsFactory `deployxPNTsToken` + SP `propagateSuperPaymaster` | xPNTs deployment by community | Community | name/symbol, SP addr | Community mints its own gas token | L1: status=1. L2: clone deployed; `isXPNTs[token]==true`; SP propagated as burner. L3: per-community gas token. setup + Group [35] X1. | ✅ |
+| 8.2 | xPNTsToken `transferFrom` firewall + caps | xPNTs transferFrom firewall + caps | User / spender | from, to, amount | Token movement constrained to firewall rules | L1: violating txs revert; allowed status=1. L2: non-self/non-SP → **`UnauthorizedRecipient`**; over-cap → **`SingleTxLimitExceeded`**. L3: anti-abuse firewall. Group [35] X1. **Caps set; firewall revert legs not run live** (footnote). | ⛔ (firewall legs) |
+| 8.4 | `X402Facilitator.settleX402PaymentDirect` without `addApprovedFacilitator` | Approved-facilitator whitelist | Facilitator (not approved) | unapproved facilitator | Only community-approved facilitators settle direct | L1: unapproved reverts; approved status=1. L2: absent approval → **`Unauthorized`**. L3: community controls who pulls its token. Group [32]. **Ran with approved facilitator; unapproved leg not run live** (footnote). | ⛔ |
+| 7.5 | xPNTsToken `emergencyRevokePaymaster` then burn/transferFrom | Emergency halt | Owner | token | Kill-switch freezes token operations | L1: revoke status=1; subsequent burn/transferFrom revert. L2: `emergencyDisabled==true`; revert **`EmergencyStop`** (`0x4e97bcfc`). L3: incident containment. Group [37] I2. | ⛔ |
+
+## Negative (⛔) assertions — consolidated checklist
+
+Each must revert with the EXACT selector below; any other outcome = FAIL.
+
+| ⛔ | Trigger | Required revert |
+|---|---|---|
+| 1.6 | exchangeRate > user maxRate | `DRYRUN_RATE_COMMITMENT_VIOLATED` / SIG_FAILURE |
+| 2.3 | x402 replay (used nonce) | `NonceAlreadyUsed` |
+| 8.4 | x402 direct settle by unapproved facilitator | `Unauthorized` |
+| 8.2a | xPNTs transferFrom to non-self/non-SP | `UnauthorizedRecipient` |
+| 8.2b | xPNTs transfer over per-spender / single-tx cap | `SingleTxLimitExceeded` |
+| 7.6 | credit ceiling exceeded (C-01/H-1) | credit-exceeded revert / `AA34` at validate / H-1 blocked |
+| 8.3 | burn replay (reused opHash) | `OperationAlreadyProcessed` |
+| 7.5 | op after emergency halt | `EmergencyStop` (`0x4e97bcfc`) |
+| 2.2 | x402 redirect / tampered recipient binding (C-02) | `InvalidX402Signature` |
+| 7.3 | op against stale price cache | `DRYRUN_STALE_PRICE` |
+| 4.4 | non-owner `registerBLSPublicKey` with switch off | `PermissionlessRegistrationDisabled` |
+
+## Deliberately deferred (Tier C) — NOT a silent gap
+
+Intentionally not run live on-chain this rehearsal. Each has a stated reason and an existing alternative coverage. MUST be revisited before GA.
+
+| ID | Scenario | Reason deferred | Existing coverage |
+|---|---|---|---|
+| 3.4 | Dual-channel agent `handleOps` (no-SBT agent) | No no-SBT account registered as an agent + no live agent-channel op this run | Read-only eligibility logic verified (G2); registry deployed & wired (`0x8004A818…`). Test-fixture gap, NOT a deployment gap. |
+| 1.3 | `repayDebt` reduction cycle | TC4 took the BURN branch (AA-A had balance); debt-accrual + repay not driven live this run | Math verified read-only (E4); proven live in beta.1 via a drain fixture. |
+| 4.2 | DVT slash of operator aPNTs (Tier-1, `executeSlashWithBLS`) | Needs BLS threshold from multiple validators; no live multi-validator fixture | Foundry unit tests under `contracts/test/modules/` |
+| 4.3 | DVT slash of GToken stake (Tier-2, `slashByDVT`) | Same multi-validator BLS fixture requirement | Foundry unit tests |
+| 5.1 | PolicyRegistry spend policy (`checkPolicy`/`recordSpend`) | Standalone — not wired into paymaster validate path on main | `PolicyRegistry-1.0.0` deployed but unconsumed; decision pending |
+| 5.2 | Policy governance freeze/unfreeze/guardian/timelock | Unfreeze needs real 2-day timelock; needs fork time-warp | Timelock unit tests; fork simulation |
+| 5.3 | DVT proposal lifecycle (`createProposal`/`markProposalExecuted`) | Needs multi-validator quorum | Foundry unit tests |
+| 7.4 | Timelocked aPNTs migration / emergency price | Needs timelock minDelay (2 days) to elapse | Fork time-warp test |
+| 7.5 (gov) | BLS aggregator queue/apply | Timelock delay | Fork time-warp test |
+| 7.8 | UUPS upgrade of Registry / SuperPaymaster | Deploy-time op, not a runtime user flow | `UUPSUpgrade.t.sol` + `MigrateToUUPS.s.sol` |
+| 8.5 | Community ownership transfer / factory renounce | Low centrality, one-way op | Foundry unit tests |
+
+## Row counts
+
+- Tier A: **9** rows (1.1, 1.2, 1.5, 2.1, 2.2, 3.3, 3.4, 8.3, 7.1)
+- Tier B: **22** rows (1.3, 1.4, 1.6, 2.3, 2.4, 2.5, 3.1, 3.2, 3.5, 4.1, 4.4, 6.1, 6.2, 7.2, 7.3, 7.6, 7.7, 7.9, 8.1, 8.2, 8.4, 7.5)
+- Negative (⛔) assertions: **11** (consolidated checklist above)
+- Deferred (Tier C): **11** rows
diff --git a/docs/e2e/v5.4.0-beta1-deploy/03-RESULTS.md b/docs/e2e/v5.4.0-beta1-deploy/03-RESULTS.md
new file mode 100644
index 00000000..13ccf31a
--- /dev/null
+++ b/docs/e2e/v5.4.0-beta1-deploy/03-RESULTS.md
@@ -0,0 +1,139 @@
+# 03 — RESULTS (v5.4.0-beta.1 fresh-redeploy E2E chronological log)
+
+> TX-Value-Verification framework, document 3 of 5.
+> Chronological record of the live run. One row per executed scenario group.
+> Status legend: ✅ PASS (executed + L2 state asserted) · ⛔ PASS (reverted with the EXACT expected selector) · ❌ FAIL→✅ (failed first pass, root-caused, re-run green) · ⏭️ SKIP (precondition unmet, inconclusive — NOT a pass).
+>
+> Reminder: a green L1 receipt alone is NOT a pass — the Notes column records the L2 state delta (or, for ⛔ rows, the exact revert selector).
+
+## Run metadata
+
+| Field | Value |
+|---|---|
+| Release (code) | v5.4.0-beta.1 (same code; **fresh full redeploy** — mainnet rehearsal) |
+| Network | Sepolia (chainId 11155111) |
+| SuperPaymaster | `0x030025f40d509b1a99547bAEb3795bD27F7182b7` (impl `0x24a94572…`) |
+| Registry | `0x3F920B25f8b65988359C372F66F036E48adFc556` |
+| X402Facilitator | `0x326Fc3413c8A0185b0179B971C69813B6dFD971B` |
+| MicroPaymentChannel | `0x405851A141Cde827E33247d4D4089Af2814c2FF5` (v1.3.0) |
+| Deploy fingerprint | `srcHash` = `14ba1a4daa1670e28b31f3a905a49a7808cc89c14277b904b5e9b47df12016d9` |
+| Price keeper run before suite? | YES — gasless pre-flight reported cache fresh |
+| Run started | Full suite 2026-06-16 14:01:29; isolated re-runs 14:45–15:02 |
+| **Final tally (full suite)** | **37 groups · 33 PASS · 4 FAIL** → **37/37 effective** after fixes (all 4 root-caused, none a SuperPaymaster contract bug — see §Full-suite failures). |
+| Independent RPC verification (axis-1) | **90/90 unique TXs REAL, all `status = 1`** — independently re-derived via `cast receipt` on `ethereum-sepolia-rpc.publicnode.com` (a different RPC than the suite). The 86-set (admin/config/x402/channel) **plus** the 4 gasless-rerun fix-txs (`0x7b015620…`, `0x2756e812…`, `0xaa9268a5…`, `0x23b807e2…`) are now all independently RPC-confirmed status=1 (appended to `logs/rpc-independent-verify.txt`). Zero NOT_FOUND, zero status=0. Evidence: `logs/rpc-independent-verify.txt`. |
+| GA blockers (eth_call-verified) | **Both beta.1 GA blockers independently eth_call-confirmed** (not just doc claims): `SuperPaymaster.version()` → `"SuperPaymaster-5.4.0"`; `SuperPaymaster.APNTS_TOKEN()` → `0x9e66B457E0ABb1F139FD8A596d00f784eBA2873b` == `config.aPNTs` (identical, no divergence). Recorded as `ETH_CALL` lines in `logs/rpc-independent-verify.txt`. |
+| No src/ change this session (git-evidenced) | The last 6 `main` commits touched **0** `contracts/src/*.sol` files (scripts/tests/docs/config only) — recorded as `GIT_EVIDENCE` in `logs/rpc-independent-verify.txt`. Confirms this rehearsal validated deploy mechanics, not a code change. |
+| On-chain `version()` | SuperPaymaster / Registry both return **`5.4.0`** (clean — confirmed live in I1 rerun **and** independently eth_call-verified). No version deferral this run. |
+
+## Chronological log
+
+Group `[N]` = suite execution order. Each tx links via `https://sepolia.etherscan.io/tx/<hash>`.
+
+| Group | Scenario ID | Status | Tx hash (etherscan) | Gas | Notes (L2 delta / exact revert selector for ⛔) |
+|---|---|---|---|---|---|
+| [1] Check Contracts | infra | ✅ PASS | (read-only) | — | 19 contracts + EntryPoint present. **Version-string MISMATCH warnings** printed (stale expected-version constants in `check-contracts.js`: expected `Registry-4.1.0`/`SuperPaymaster-4.1.0`/… vs on-chain `5.4.0`/`5.4.0`). On-chain values are CORRECT; preflight still PASSED. Test-script hygiene item. |
+| [2] Check Balances | infra | ✅ PASS | approve `0x1e7ab565…` | 29169 | GToken 1873; deployer SBT≥1; all token balances sufficient. |
+| [3] A1 | 3.1 / 3.3 | ✅ PASS | (idempotent — SKIP) | — | Genesis communities present: AAStar (deployer, `aastar.eth`) + Mycelium (Anni, `mushroom.box`). `deployer hasRole COMMUNITY`; `sbtHolders(AA_A)==true`; COMMUNITY members=2; ENDUSER count=3. |
+| [4] A2 | 3.2 (read) | ✅ PASS | (read-only) | — | 7 ROLE keccak constants match; wiring `GTOKEN_STAKING/MYSBT/SUPER_PAYMASTER` == config.json. |
+| [5] B1 | 7.1 | ✅ PASS | setOpLimits `0xfa8bbb5d…`; pause `0x9d1c303a…`; unpause `0x3e565454…` | 45390 / 36705 / 36694 | `minTxInterval==60`, pause/unpause asserted. **`nonce/in-flight conflict — draining mempool & retrying 1/2…` then succeeded** — validates the #295 harness fix (retry instead of skip). B1 PASSED in-suite (no isolated rerun needed). |
+| [6] B2 | 7.1 (deposit/withdraw) | ✅ PASS | deposit `0x3af6e111…`; depositFor `0x8c8cba95…`; withdraw(3) `0x2842fdac…`; withdraw(12) `0xbcc29449…` | 82776 / 82175 / 62544 / 62544 | `aPNTsBalance` 10→15 (depositFor +5)→12 (withdraw −3); **`APNTS_TOKEN (0x9e66B457…) balance` asserted == `config.aPNTs`** (no divergence). Restored to 0. B2 PASSED in-suite (#295 fix held). |
+| [6] B2 | 8.2 (withdraw excess ⛔) | ⛔ PASS | (eth_call revert) | — | `withdraw` over balance reverted (`execution reverted (unknown custom error)`). |
+| [7] B3 | 7.1 / 3.2 | ✅ PASS | configureOperator(2-arg) (in 86-set) | 58–59k | PR#200 2-arg: `xPNTsToken == 0x9e66B457…` + treasury stored; `operators()` returns 9 fields (no exchangeRate); live rate read from token; idempotent re-configure. |
+| [8] B4 | 7.2 / 2.4 | ✅ PASS | setTreasury / setAgentRegistries(+restore) / withdrawProtocolRevenue / setFacilitatorFeeBPS(100)+restore / setOperatorFacilitatorFee(50)+restore / queueBLSAggregator (all in 86-set) | 24–62k | `agentIdentityRegistry restored == 0x8004A818…` (== config, no divergence). feeBPS 0→100→0; op fee 0→50→0; `queueBLSAggregator` set pending+ETA. **SKIPs (legit):** `updateSBTStatus`/`updateBlockedStatus` (`onlyRegistry`); `withdrawFacilitatorEarnings` (`facilitatorEarnings==0`); `withdrawProtocolRevenue` skipped (`protocolRevenue ≤ buffer`). B4 PASSED in-suite (#295 fix). |
+| [9] B5 | 1.6 (dry-run) / 7.7 | ✅ PASS | (read / static-call) | — | `dryRunValidation` returned `ok=false` reason `INSUFFICIENT_BALANCE` (minimal UserOp — not asserted; NOT the rate-commitment leg). `pendingDebts==0`; retry/clearPendingDebt SKIP (no pending debt). |
+| [10] C1 | negatives | ⛔ PASS | (eth_call reverts) | — | No-SBT sender → `missing revert data`; paused operator → `unknown custom error`; unconfigured operator → `unknown custom error`. |
+| [11] C2 | 1.5 (V4 negative) | ⛔ PASS | (eth_call revert) | — | Found PaymasterV4 `0x957852…`; zero-balance V4 user → `missing revert data`; `getSupportedTokens` returned. |
+| [12] D1 | 6.1 | ✅ PASS | setRule / setEntropyFactor(+restore) / setCommunityReputation / removeRule (in 86-set) | 28–153k | Rule `E2E_ACTIVITY` base=20/bonus=5/max=200 stored & read; entropy→score 70+; communityReputation set; rule cleaned up. |
+| [13] D2 | 6.1 / 7.6 (read) | ✅ PASS | setCreditTier / reset (in 86-set) | 52k / 30k | `creditTierConfig[1] == 100.0` (default); getCreditLimit(rep=0)→tier-1 100 aPNTs. (Default base tier — see §Credit-ceiling.) |
+| [14] E1 | 7.3 | ✅ PASS | SP updatePrice / setAPNTSPrice(+restore) / V4 updatePrice (in 86-set) | 36–70k | Cache refreshed; aPNTsPrice tuned/restored. **`DRYRUN_STALE_PRICE` leg NOT executed** (cache kept fresh). |
+| [15] E2 | 7.2 | ⛔+✅ PASS | setProtocolFee(500)+restore (in 86-set) | 32717 ea | protocolFeeBPS 500 set/restored; **setProtocolFee(2001) reverted** (over MAX=2000). |
+| [16] E3 | (read, PR#200) | ✅ PASS | (read-only) | — | `operators()` 9-tuple; live rate from xPNTsToken; getDebt=0; availableCredit denominated in aPNTs. |
+| [17] E4 | 1.3 (debt repay) | ✅ PASS (no-op) | (read / SKIP) | — | `getDebt()` returns aPNTs denomination; deployer debt==0 → `repayDebt` TX **SKIPPED (no-op)**; ceil/floor math verified read-only. (Repay cycle owed — §Owed.) |
+| [18] F1 | 4.1 (read) | ✅ PASS | (read-only) | — | totalStaked / stakes / wiring REGISTRY/GTOKEN/treasury verified. |
+| [19] F2 | slash (supporting) | ✅ PASS | slashOperator(WARNING,0) / updateReputation (in 86-set) | 124k / 37k | Slash record level=WARNING amount=0 (no stake burned); reputation restored. (Tier-1/2 DVT slash NOT exercised — 04 footnote.) |
+| [20] F3 | 3.5 / 4.1 (admin) | ✅ PASS | exit-fee / slasher / rep-source / level-thresholds / creditTier set+restore (in 86-set) | 25–63k | Full Registry/Staking admin surface written, asserted, restored. `creditTierConfig[3]` before=300; set 350→restored 300. `topUpStake`/`batchUpdateGlobalReputation` SKIP (onlyRegistry / needs BLS). |
+| [21] G1 | 6.2 (read) | ✅ PASS | (read-only) | — | sbtHolders / isEligibleForSponsorship / isRegisteredAgent / globalReputation / getCreditLimit read & asserted. **Agent feedback emission NOT asserted** (no live agent op). |
+| [22] G2 | 3.4 (read) | ✅ PASS (read-only) | (read-only) | — | Dual-channel logic `sbtHolders \|\| isRegisteredAgent` verified by query. **No agent NFT registered → no live agent-sender `handleOps`** this run (owed, §Owed + 04). |
+| [23] G3 | 1.2 / 6.2 (read) | ✅ PASS | setCreditTier(7,5000) / reset (in 86-set) | 52k / 30k | Tier ceiling expand/reset; fresh user (rep=0)→tier-1 100 aPNTs. Live escalation needs BLS-signed reputation (not run). |
+| [24] H1 | DVT/BLS (read) | ✅ PASS | (read-only) | — | DVT/BLS wiring + thresholds; addValidator SKIP (deployer lacks ROLE_DVT). |
+| [25] H2 | reputation (read) | ✅ PASS | (read-only) | — | ReputationSystem wiring/getters; syncToRegistry SKIP (needs ≥3 DVT BLS cluster). |
+| [26] Gasless | 1.5 (PaymasterV4 escrow) | ✅ PASS | handleOps `0x7b015620014e5c45bb4b23008ace0f132a5261d27563acc77d032baff5a327c1` | confirmed | AOA independent path: gas paid from PaymasterV4 token escrow, no ETH from user. UserOp hash `0x5b07e6ee…`. |
+| [27] Gasless | 1.1 (SP aPNTs balance-pay) | ❌ FAIL→✅ rerun | rerun `0x2756e8122a8c26965df4bc5f8bb08bd7f335adc7355a8c0ddba8e42f9f9e31e4` | confirmed | First pass `AA34 signature error` at validate (credit ceiling — see §Credit-ceiling). After `setCreditTier(1,300)`: rerun green, sender `0x9e66B457` xPNTs ↓ (−1 transfer + gas burn), recipient +1. |
+| [28] Gasless | 1.1 (SP PNTs / Mycelium op) | ❌ FAIL→✅ rerun | rerun `0xaa9268a527470d4d11177511b963073ba0e28683fa76a4ad792fae421e2704f4` | confirmed | Same `AA34` first pass; after credit-tier fix, rerun green on the **PNTs** token: sender PNTs 1000→… (−1 transfer + gas burn), recipient +1. Confirms multi-operator/multi-token sponsorship. |
+| [29] Gasless | 1.2 (SP credit/debt) | ❌ FAIL→✅ rerun | rerun `0x23b807e2b5e7dccccaf7595fb570ecd09df6e461ab40e0b91d7ab9aa446c9e32` | confirmed | Same `AA34` first pass. Rerun **BURN branch** (AA-A held 943.80 aPNTs): xPNTs 943.80→895.32 (**burned 48.47 aPNTs**), `debts[user]` unchanged at 0. **Pure-credit/DEBT branch + repay NOT exercised this run** (AA-A had balance — owed, §Owed). |
+| [30] Channel | 2.5 (MicroPaymentChannel) | ✅ PASS | open `0xd5d1b440b3566657dc1861d1a8bf7241142d87d33ff6b939cf29de0152b2181d`; settle `0xbf9db46d9e3c50e717949162b74d476677930e60f7c7b1f15fd0b01dc50c72b0`; close `0x6ab1c648a9ecda2cd706c59d1241d30a8efa978c45d641602fa48c5b7b70ceac` | 168825 / 72378 / 111376 | Open 10 → settle cumulative → close; payee credited; channel struct deleted; finalized channel rejects re-settle. |
+| [31] x402 | 2.1 (EIP-3009 USDC) | ✅⛔ PASS | settle `0x3581742cec28c64f50c19118555949e4e045d54577907c4f1fe063e5b19f398b` | 153491 | `settleX402Payment` (receiveWithAuthorization): payee +1.0 USDC; fee 0 (feeBPS=0); nonce consumed; **replay rejected** (2.3 `NonceAlreadyUsed`). |
+| [32] x402 | 2.2 (direct xPNTs, C-02) | ✅⛔ PASS | settle `0x3bff8eb5f63e4db05e0c68c35ba5561c4e46286965e4e4ae088eb65714790cac`; binding-isolated `0x8f246bb00fd98dc61775dba0da72bf19976d08b3f46cd689be1b2843c40159c4` | 168433 / 132710 | `settleX402PaymentDirect`: payee +1.0 xPNTs; nonce consumed. **Tampered-recipient redirect → `InvalidX402Signature`**; unmodified sig settles only to AUTHORIZED recipient. |
+| [33] BLS | 4.4 (permissionless ⛔, H-02) | ⛔ PASS | (eth_call revert) | — | `permissionlessBLSRegistration==false`; non-owner `registerBLSPublicKey` → **`PermissionlessRegistrationDisabled`**. |
+| [34] P2 | 7.9 (PaymasterV4 lifecycle) | ✅ PASS | deactivate / activate / depositFor / withdraw / updatePrice (in 86-set) | 29–61k | paused toggle; depositFor +1 / withdraw −1 asserted; price cache synced on clone `0x957852…`. |
+| [35] X1 | 8.1 / 8.2 (xPNTs admin) | ✅ PASS | setMaxSingleTxLimit / setSpenderDailyCap / autoApproved / facilitator-whitelist / burn / updateExchangeRate (+restores, in 86-set) | 28–53k | Caps + spender/facilitator whitelists set/restored; self-burn; exchangeRate +1%. **8.2 firewall REVERT legs (`UnauthorizedRecipient`/`SingleTxLimitExceeded`) NOT run live** — only cap *config* (footnote, 04). |
+| [36] I1 | 7.6 (credit ceiling H-1) | ❌ FAIL→✅ rerun | (read-only) | — | First pass **FAILED** — hard-coded version assertion expected `SuperPaymaster-5.3.3`; on-chain is `5.4.0`. After updating the asserted string to `5.4.0`: rerun **13/13 PASS** — `version()=="SuperPaymaster-5.4.0"`, credit limit 300, `availableCredit=300−0`, H-1 `isBlocked` readable. |
+| [37] I2 | 7.5 (emergency halt H-2) | ⛔ PASS | emergencyRevoke / addAutoApproved(+restore) (in 86-set) | 31–62k | `emergencyDisabled` flipped true; self-pull `transferFrom` reverted **`0x4e97bcfc` == `EmergencyStop()`** (clean named selector); SP carve-out succeeded; state restored. |
+
+## ⚠️ The 4 first-pass failures — honest root-cause → fix → re-run green
+
+The full suite reported **33 PASS / 4 FAIL**. **None is a SuperPaymaster contract bug.** All 4 root-caused and resolved → **37/37 effective**. (A 5th issue, the `prepare-test` `Unauthorized()`, occurred during *setup* before the 37-group suite — included below for completeness.)
+
+| # | Symptom | Root cause | Resolution | Kind |
+|---|---|---|---|---|
+| 1 | `prepare-test` reverts `Unauthorized()` at "Configure deployer as SP operator" (pre-suite) | `configureOperator` requires `hasRole(PAYMASTER_SUPER, msg.sender)`; a **fresh** deployer holds `COMMUNITY` + `PAYMASTER_AOA` but **not** `PAYMASTER_SUPER` (an upgrade-accumulated chain already had it). | Added an idempotent `PAYMASTER_SUPER` grant for the deployer in `TestAccountPrepare.s.sol` (log now shows `PAYMASTER_SUPER granted to deployer`). | Test-infra fix (committed) |
+| 2 | Groups **[27] [28] [29]** (3 SP gasless cases) fail with **`AA34` (paymaster signature error)** at validate time | The `_creditExceeded` credit ceiling — see the dedicated analysis below. A fresh ENDUSER sits at base credit tier (100 aPNTs); the validate-time charge on Sepolia **L1** (~120 aPNTs buffered) exceeds 100 → rejected before it can pay by balance. | Raised `setCreditTier(1,300)` + `setCreditTier(2,300)` live on Sepolia (covers the L1 charge, keeps tier monotonicity ≤ tier3=300). **NOT changed in contract code** — economic/product parameter. Reruns [27]/[28]/[29] green. | Config decision (live; **contract default kept**) |
+| 3 | Group **[36] I1** fails its version assertion | Test hard-coded `expected SuperPaymaster-5.3.3`; the fresh contract correctly returns `5.4.0`. (Same stale-table root cause as the `check-contracts.js` warnings in [1].) | Updated the asserted/expected version strings to `5.4.0`. I1 rerun 13/13 PASS, `version()=="SuperPaymaster-5.4.0"`. | Test-hygiene fix (committed) |
+
+**Re-run evidence (status=1, confirmed in `logs/rerun-*.log` AND now independently RPC-verified in `logs/rpc-independent-verify.txt` → part of the 90/90 set):**
+- [27] SP aPNTs balance-pay: `0x2756e8122a8c26965df4bc5f8bb08bd7f335adc7355a8c0ddba8e42f9f9e31e4`
+- [28] SP PNTs: `0xaa9268a527470d4d11177511b963073ba0e28683fa76a4ad792fae421e2704f4`
+- [29] SP credit/debt (burn branch): `0x23b807e2b5e7dccccaf7595fb570ecd09df6e461ab40e0b91d7ab9aa446c9e32`
+- [36] I1: read-only group, `version()=="SuperPaymaster-5.4.0"`, credit limit 300, 13/13 PASS.
+
+> **B1/B2/B4 did NOT fail this run** (unlike beta.1). The full-suite log shows `nonce/in-flight conflict — draining mempool & retrying 1/2…` for `setOperatorLimits` and `Unpause`, after which the txs confirmed and the groups PASSED in-suite. This **validates the #295 harness nonce-retry fix** end-to-end: a nonce/in-flight conflict is now retried (mempool drained, nonce re-synced) instead of skipping a critical tx.
+
+## Credit-ceiling analysis (the `AA34` root cause — precise)
+
+The 3 SP gasless failures ([27]/[28]/[29]) all rejected at validate with `AA34 signature error`. The mechanism:
+
+1. **Credit limit is GLOBAL-reputation-derived, not per-community.** `Registry.getCreditLimit(user) = creditTierConfig[level]`, where `level` is derived from **`globalReputation[user]`** (GLOBAL across all communities) via `levelThresholds = [13, 34, 89, 233, 610]`. A **fresh** user has `globalReputation == 0` → **level 1** → default `creditTierConfig[1]` = **100 aPNTs**.
+2. **Validate-time charge exceeds 100 on L1.** SuperPaymaster's validate-time charge is `maxCost × 1.1 buffer × fee`, which on Sepolia **L1** gas comes to **~120 aPNTs** (the actual postOp burn was only **~48 aPNTs** — TC4 burned 48.47). The buffered validate charge therefore exceeds the 100-aPNTs base ceiling.
+3. **The ceiling has NO user-balance short-circuit (by design — H-1 anti-drain).** The credit-ceiling check bounds *worst-case debt* if a user drains their xPNTs between validate and postOp; it deliberately does NOT exempt balance-paying users (otherwise the anti-drain guarantee breaks). So a 100-aPNTs base user is blocked **even when they hold ample xPNTs**. Hence: a brand-new ENDUSER with a healthy xPNTs balance still cannot be SP-sponsored for a normal L1 tx out of the box.
+
+**Fix applied for the rehearsal (Sepolia only):** `setCreditTier(1,300)` + `setCreditTier(2,300)` (live; keeps monotonicity ≤ tier3=300). This raises the base ceiling above the ~120-aPNTs L1 charge so a fresh user is sponsorable.
+
+> ### ⚠️ KEY OPEN ITEM — the OP base-credit value is NOT measured; "keep 100" is an UNRESOLVED GA decision
+> Codex confirmed the H-1 credit-ceiling mechanism above is accurate (it DOES block balance-payers — verified in `SuperPaymaster.sol` lines 1102–1106 + `_creditExceeded` 812–814; there is no balance short-circuit by design). **But our earlier claim that "on OP the charge drops to ~1–5 aPNTs so the default 100 is sufficient and needs no change" is an UNVERIFIED hypothesis — it was downgraded by Codex as RISKY/UNPROVEN.** No OP receipt, no OP gas model, and no L1-data-fee calculation was produced this rehearsal.
+> - **KEEP (directional reasoning only):** OP L2 execution gas is ~100× cheaper than Sepolia L1, so the per-tx aPNTs validate-charge is *expected* to be far lower on OP. This is a plausible direction, not a measurement.
+> - **NOT MEASURED:** no OP transaction or gas model was run this rehearsal. The OP L1-data-fee component in particular was never computed. So the actual OP validate-time charge is **unknown**.
+> - **Therefore "keep base credit 100" is an OPEN GA DECISION, NOT a resolved item.** Before relying on `creditTierConfig[1]=100` for OP mainnet, the **actual sponsored-tx validate-charge MUST be measured on OP** and confirmed `< 100` aPNTs. If it is not (or for any higher-gas chain), the base tier MUST be raised via `setCreditTier`. Do **not** present 100 as proven-fine.
+> - The Sepolia `setCreditTier(1/2,300)` was applied purely to make the L1 E2E representative; it is neither a proof for nor a recommendation against the OP mainnet value — that value remains owed pending an OP gas measurement.
+
+## Independent RPC verification (axis-1)
+
+The **86 unique TX hashes** in `logs/all-tx-inventory.txt` **plus the 4 gasless-rerun fix-txs** ([26] `0x7b015620…`, [27] `0x2756e812…`, [28] `0xaa9268a5…`, [29] `0x23b807e2…`) were independently re-derived via `cast receipt <hash>` against `https://ethereum-sepolia-rpc.publicnode.com` (a different RPC than the suite used).
+
+**Result: 90/90 REAL, all `status = 1`.** Zero NOT_FOUND, zero status=0. (The 4 rerun fix-txs are now folded into the independent set — they were previously only suite/`logs/rerun-*.log`-confirmed; they are now RPC-confirmed status=1, appended to `logs/rpc-independent-verify.txt`.) Block range 11071076→11071279; total gas (86-set) 4,913,548. Evidence: `logs/rpc-independent-verify.txt`.
+
+In addition, two GA blockers were independently **eth_call-verified** (recorded as `ETH_CALL` lines in the same file): `SuperPaymaster.version()` → `"SuperPaymaster-5.4.0"`, and `SuperPaymaster.APNTS_TOKEN()` → `0x9e66B457E0ABb1F139FD8A596d00f784eBA2873b` == `config.aPNTs`. The "no `src/` change this session" claim is `GIT_EVIDENCE`-recorded: the last 6 `main` commits touched 0 `contracts/src/*.sol` files.
+
+> **Why every mined tx is status=1 (not a contradiction):** the ⛔ negatives are probed via read-only `eth_call`/staticcall, which revert *without* producing a mined transaction — they never become `status=0` receipts. The headline x402 ([31]/[32]), channel ([30]), gasless `handleOps` headline ([26]) and the 4 rerun fix-txs are all now inside the 90-set RPC re-derivation; I1 is a read-only group (`version()=="SuperPaymaster-5.4.0"`).
+
+## Negative (⛔) coverage gaps this run (honest)
+
+These plan ⛔ legs were NOT executed as live mined txns this run (covered by Foundry unit tests / `eth_call`-observed instead):
+- **1.6 `DRYRUN_RATE_COMMITMENT_VIOLATED`** — B5 dry-run returned `INSUFFICIENT_BALANCE`, not the rate-commitment revert.
+- **7.3 `DRYRUN_STALE_PRICE`** — price cache kept fresh; stale leg not triggered.
+- **7.6 credit-ceiling revert** — I1 verified ceiling *state* read-only; the live over-ceiling rejection surfaced as the [27]–[29] `AA34` (then fixed), not as an explicit isolated ⛔ assertion.
+- **8.2 `UnauthorizedRecipient` / `SingleTxLimitExceeded`** — X1 set/restored caps but did not run the firewall reverts.
+- **8.3 `OperationAlreadyProcessed`** (burn replay) — not re-run as an explicit same-opHash replay this suite.
+- **8.4 `Unauthorized`** (unapproved facilitator) — x402 direct ran with an already-approved facilitator.
+
+> **7.5 `EmergencyStop` is NOT a gap** — [37] I2 reverted live with `0x4e97bcfc` == `EmergencyStop()`; clean ⛔ PASS.
+
+## Owed items (not-yet-live-exercised this run)
+
+Mirrors beta.1's honesty. Each is a test-fixture/coverage gap, NOT a deployment gap:
+1. **Dual-channel agent `handleOps`** — `agentIdentityRegistry` is wired to the official `0x8004A818…`, but no no-SBT account is registered as an agent and no live agent-channel op was run. Only read-only eligibility (G2) proven.
+2. **`repayDebt` cycle** — [29]/TC4 took the BURN branch (AA-A held balance); the debt-accrual + repay cycle was not driven live (would need draining AA-A to 0 first, as beta.1 did).
+3. **Live ⛔ negatives** — most were observed via `eth_call` / unit tests, not as live mined failed txns (see §Negative coverage gaps).
+
+## Deferred (Tier C) — not executed live (see 02-PLAN)
+
+3.4, 1.3(repay), 4.2, 4.3, 5.1, 5.2, 5.3, 7.4, 7.5(gov), 7.8, 8.5 — intentionally deferred; covered by Foundry unit / fork tests. See 04-CAPABILITY-MAP footnotes.
diff --git a/docs/e2e/v5.4.0-beta1-deploy/04-CAPABILITY-MAP.md b/docs/e2e/v5.4.0-beta1-deploy/04-CAPABILITY-MAP.md
new file mode 100644
index 00000000..ecd7511b
--- /dev/null
+++ b/docs/e2e/v5.4.0-beta1-deploy/04-CAPABILITY-MAP.md
@@ -0,0 +1,74 @@
+# 04 — CAPABILITY MAP (v5.4.0-beta.1 fresh redeploy)
+
+> TX-Value-Verification framework, document 4 of 5.
+> Maps each proven on-chain tx to the capability it demonstrates and the user value it delivers.
+> Only txs with a real hash and an asserted L2 state delta count as "proven". Everything else lives in the footnote section, never silently claimed.
+>
+> **Adversarial scoping rule (applied below):** each "user value" claim is held to EXACTLY what the tx mutates on-chain. Read-only queries are labelled `(read-only)` and claim nothing about a live sponsored UserOp. State mutations name the precise delta. Revert (⛔) rows claim only the exact selector observed.
+>
+> Reminder: same release code as `docs/e2e/v5.4.0-beta.1/`, **fresh-deploy addresses** (01-TESTDATA §2). Etherscan: `https://sepolia.etherscan.io/tx/<hash>`.
+
+## Proven on-chain (real tx + asserted state)
+
+| # | TX (hash + ✅/⛔) | What it proves (scoped to the on-chain delta) | User value (no overstatement) |
+|---|---|---|---|
+| 1 | `0x7b015620014e5c45bb4b23008ace0f132a5261d27563acc77d032baff5a327c1` ✅ | One `handleOps` via PaymasterV4 (AOA independent): a sponsored op mined end-to-end, gas drawn from the PaymasterV4 token escrow (`depositFor`). | A user with zero ETH moved a community token; gas paid from the community's prefunded escrow. |
+| 2 | `0x2756e8122a8c26965df4bc5f8bb08bd7f335adc7355a8c0ddba8e42f9f9e31e4` ✅ (rerun) | One `handleOps` via SuperPaymaster (AOA+): sender `aPNTs` (`0x9e66B457…`) ↓ = −1 transfer **+ gas burned in postOp** (`burnFromWithOpHash`); recipient +1. Proves shared-pool xPNTs balance-pay + burn accounting. | A user pays Ethereum gas in xPNTs through the shared paymaster, holding no ETH. |
+| 3 | `0xaa9268a527470d4d11177511b963073ba0e28683fa76a4ad792fae421e2704f4` ✅ (rerun) | Second SuperPaymaster op on a *different* token (PNTs `0xC687f8a1…`, Mycelium operator): sender PNTs ↓, recipient +1. Proves multi-operator / multi-token sponsorship on one SP. | Multiple communities each run their own gas token on one shared paymaster. |
+| 4 | `0x23b807e2b5e7dccccaf7595fb570ecd09df6e461ab40e0b91d7ab9aa446c9e32` ✅ (rerun) | Credit/debt entry path, **burn branch**: xPNTs 943.80→895.32 (**burned 48.47 aPNTs**), `debts[user]` stayed 0. Proves postOp burns when the user holds a balance. **Scoped exactly to the burn branch** — the 0-balance→`DebtRecorded` branch was NOT taken this run (footnote 7). | A sponsored tx settles by burning the user's token when they hold a balance. |
+| 5 | `0x3581742cec28c64f50c19118555949e4e045d54577907c4f1fe063e5b19f398b` ✅⛔ | `settleX402Payment` (EIP-3009 USDC): payee +1.0 USDC, fee 0 (feeBPS=0), nonce consumed; replay re-submit rejected. Proves native-USDC x402 settlement + nonce replay guard. | An off-chain-signed USDC payment settles on-chain once and cannot be replayed. |
+| 6 | `0x3bff8eb5f63e4db05e0c68c35ba5561c4e46286965e4e4ae088eb65714790cac` ✅ | `settleX402PaymentDirect` (xPNTs `transferFrom`, C-02 signed auth): payee +1.0 xPNTs, nonce consumed. Proves community-token x402 direct settle. | A signed xPNTs micropayment settles via the facilitator without the payer sending a tx. |
+| 7 | replay leg of #5/#6 ⛔ | Re-submitting a used nonce reverts **`NonceAlreadyUsed`**. | An authorization cannot be double-settled. |
+| 8 | C-02 leg of #6 ⛔ + `0x8f246bb00fd98dc61775dba0da72bf19976d08b3f46cd689be1b2843c40159c4` ✅ | Redirecting the same signature to a different recipient reverts **`InvalidX402Signature`**; the unmodified signature settles only to the authorized recipient. Proves recipient is bound into the signed payload. | A signed payment cannot be hijacked to a different recipient. |
+| 9 | `0xd5d1b440…` (open) / `0xbf9db46d…` (settle) / `0x6ab1c648…` (close) ✅ | MicroPaymentChannel lifecycle: open 10 → settle cumulative → close; payee credited, channel struct deleted; re-settle on finalized channel rejected. | Pay-per-use streaming with on-chain escrow and a clean refund-on-close. |
+| 10 | permissionless-BLS leg ⛔ | Non-owner `registerBLSPublicKey` with the switch off reverts **`PermissionlessRegistrationDisabled`** (H-02 gate). | Validator registration stays owner-gated until explicitly opened. |
+| 11 | [37] I2 `emergencyRevokePaymaster` ✅ + emergency revert ⛔ | `emergencyRevokePaymaster` set `emergencyDisabled=true`; a subsequent self-pull `transferFrom` reverted with **`0x4e97bcfc` == `EmergencyStop()`**; SP carve-out path still succeeded. Clean ⛔ PASS — named selector matched. | A community can flip an emergency kill-switch on its token; the exact `EmergencyStop()` revert is verified on-chain. |
+| 12 | E2 over-fee leg ⛔ + setProtocolFee(500)/restore ✅ | `setProtocolFee(500)` set & restored; `setProtocolFee(2001)` reverts (over MAX=2000). Proves protocol-fee setter with an upper bound. | Protocol fee is owner-tunable but cannot exceed the hard cap. |
+| 13 | E1 SP/V4 `updatePrice` + `setAPNTSPrice`/restore ✅ | `updatePrice` refreshed the Chainlink-backed cache; `setAPNTSPrice` tuned/restored. Proves the price cache is writable and bounded. **Does NOT prove stale-price rejection** (cache kept fresh). | Sponsorship is priced off a refreshable oracle cache. (Staleness guard not exercised — footnote 13.) |
+| 14 | F2 slashOperator(WARNING,0)/restore ✅ | Slash record level=WARNING, amount=0 (no stake burned), reputation restored. Proves the slash-record path for a zero-penalty warning. **Does NOT prove value-bearing DVT slash** (footnote 2). | Operators accrue an on-chain disciplinary record. |
+| 15 | F3 admin set (exit-fee / slasher / rep-source / level-thresholds / creditTier, +restores) ✅ | Each written, asserted, and restored. Proves the Registry/Staking admin surface. | Governance can tune membership economics and reputation wiring. |
+| 16 | D1 setRule + communityRep ✅ | Reputation rule `E2E_ACTIVITY` (base 20 / bonus 5 / max 200) stored & read; entropy factor → score; communityReputation set. Proves reputation-rule configuration + score compute. | Communities define reputation inputs that drive credit tiers. |
+| 17 | D2/G3 setCreditTier(+resets) ✅ | `setCreditTier(7, 5000)` written & reset; `getCreditLimit(rep=0)`→tier-1 **100** aPNTs (default). Proves the credit-ceiling config and the rep→tier read mapping. | Admin can expand the credit ceiling; users get a tier by reputation. (Live escalation needs BLS rep update — footnote 5.) |
+| 18 | B4 setFacilitatorFeeBPS / setOperatorFacilitatorFee (+restores) ✅ | `setFacilitatorFeeBPS` 0→100→0; `setOperatorFacilitatorFee` 0→50→0. Proves the facilitator-fee config setters. **Withdraw NOT exercised** — `facilitatorEarnings==0` (footnote 8). | Facilitators/operators can set a fee rate. Earnings-withdraw path unproven this run. |
+| 19 | B4 setTreasury + setAgentRegistries (+restore) ✅ | `setTreasury` and `setAgentRegistries` written, asserted, restored; `agentIdentityRegistry restored == 0x8004A818…` (== config — **no divergence**). Proves SP governance setters. | Operator can repoint treasury and agent-identity/reputation registries. |
+| 20 | B4 queueBLSAggregator ✅ | `queueBLSAggregator` set `pendingBLSAgg` + ETA (timelock). Proves the *queue* step. **`applyBLSAggregator` NOT run** (timelock) (footnote 3). | Critical wiring changes go through a timelock queue. |
+| 21 | B1/B2/B3 operator config/funding ✅ | setOpLimits / pause / unpause / deposit / depositFor / withdraw / configureOperator(2-arg). `aPNTsBalance` 10→15→12; `APNTS_TOKEN (0x9e66B457…) == config.aPNTs` asserted on withdraw. Proves operator self-service pool management + #295 nonce-retry (mempool drain in-suite). | An operator funds, configures, pauses, and drains its own shared-pool position; the base token has no config↔chain split. |
+| 22 | P2 lifecycle (deactivate/activate/depositFor/withdraw/updatePrice) ✅ | PaymasterV4 lifecycle on clone `0x957852…`: pause toggle, escrow ±1, price cache synced. | Independent AOA paymaster can be paused/funded/drained at runtime. |
+| 23 | X1 xPNTs admin (caps / spenders / facilitator-whitelist / burn / exchange-rate, +restores) ✅ | Token-admin config surface set & restored. **Firewall REVERT legs NOT run** (footnote 10). | Community owner tunes its token's caps, spenders, and rate. |
+| 24 | I1 read-only (after version fix) ✅ | creditTierConfig / getCreditLimit (300 after the L1 fix) / pendingDebts / userOpState(isBlocked) readable; `availableCredit = 300−0`; **`version()`=="SuperPaymaster-5.4.0"** asserted. **(read-only — no over-ceiling tx).** | Confirms H-1 ceiling state is on-chain & queryable, and the clean v5.4.0 version literal. |
+| 25 | A1/A2/E3/F1/G1/G2/H1/H2 read-only ✅ | Role grants, SBT-holder flag, dual-channel eligibility logic (`sbtHolders \|\| isRegisteredAgent`), 9-tuple operator struct, staking state, DVT/BLS wiring, reputation getters — queried & asserted. **(read-only).** | Confirms deployed wiring and gating logic match spec. No live UserOp claimed by these rows. |
+
+## Fresh-deploy provenance (capabilities the clean redeploy proves that beta.1 could not)
+
+- **Clean `version()` = 5.4.0** (#24) — beta.1's on-chain `version()` read `5.3.3` (a GA blocker). The fresh deploy compiles current source, so the literal is correct. **This GA blocker is resolved by the deploy path itself, and is now independently `eth_call`-verified** (`version()`→`"SuperPaymaster-5.4.0"`, recorded as an `ETH_CALL` line in `logs/rpc-independent-verify.txt`).
+- **No base-token divergence** (#19, #21) — `SuperPaymaster.APNTS_TOKEN() == config.aPNTs == 0x9e66B457…`, now independently `eth_call`-verified (identical, `ETH_CALL` line in the verify file). beta.1 carried an in-flight `queueSetAPNTsToken` migration and a config↔chain split; a fresh deploy wires the base token at `initialize()` with no migration.
+- **Agent registry matches config** (#19) — `agentIdentityRegistry() == 0x8004A818…` (the official ERC-8004), identical to `config`. beta.1's SP was wired to a different registry.
+
+## Notable scope-downs (what we did NOT prove, despite a green/effective-green run)
+
+> **OWED headline items** (test-fixture gaps, NOT deployment gaps): the dual-channel-agent `handleOps` AND the 0-balance debt-accrual + `repayDebt` cycle. Both were proven live in beta.1; this rehearsal did not re-drive them (AA-A held a balance → burn branch; no no-SBT agent registered).
+
+- **[OWED] 1.2 credit/debt DEBT branch + 1.3 repay** — #4 proved only the BURN branch live (AA-A held 943.80 aPNTs). The 0-balance→`recordDebtWithOpHash` branch and the subsequent `repayDebt` reduction were not driven this run. (beta.1 proved the debt branch via a drain fixture: debt 0→+39.76 aPNTs.)
+- **[OWED] 3.4 Dual-channel agent sponsorship** — G2 verified the eligibility *logic* by query only. The agent identity registry **IS deployed and wired** (`agentIdentityRegistry() == 0x8004A818…`). What is owed is a no-SBT account *registered as an agent* there **plus** a live agent-sender `handleOps` (sbt==false yet sponsored). Claim limited to the read-only eligibility check.
+- **6.2 agent feedback emission** — G1/G3 ran the rep path but did NOT assert an `AgentReputationRegistry.giveFeedback` event.
+
+## Code-has-it but NOT yet E2E-proven on-chain (footnote — no silent claims)
+
+These capabilities exist in the deployed bytecode but are NOT proven by a live tx in this run.
+
+1. **PolicyRegistry spend policy** (`checkPolicy`/`recordSpend`) — `PolicyRegistry-1.0.0` deployed but NOT wired into the paymaster validate path on main; no consumer exercises it on-chain. (02-PLAN 5.1/5.2)
+2. **DVT slashing** (Tier-1 `executeSlashWithBLS` → aPNTs; Tier-2 `slashByDVT` → GToken stake) — requires multi-validator BLS threshold; Foundry unit tests only. F2 proved only a zero-penalty WARNING record. (4.2/4.3)
+3. **Timelock-gated governance apply steps** (`applyBLSAggregator`, emergency price) — the *queue* step was proven (#20); apply needs the timelock minDelay (2 days) to elapse; fork time-warp only. (5.2/7.4/7.5gov)
+4. **DVT proposal lifecycle** (`createProposal`/`markProposalExecuted`) — needs multi-validator quorum; unit-tested. (5.3)
+5. **BLS aggregator apply + `batchUpdateGlobalReputation`** — needs an aggregate BLS-12-381 signature from ≥3 DVT validators; F3/H2 SKIP these. Reputation→credit-tier escalation therefore unproven live. (7.5gov)
+6. **UUPS upgrade** of Registry/SuperPaymaster — deploy-time op; `UUPSUpgrade.t.sol` + `MigrateToUUPS.s.sol`. (7.8)
+7. **Credit/debt DEBT branch + `repayDebt`** — #4 proved only the burn branch; the 0-balance debt-accrual + repay were not driven live this run (OWED — see scope-downs; proven in beta.1). (1.2/1.3)
+8. **Standalone facilitator earnings withdraw** — `withdrawFacilitatorEarnings` SKIP'd in B4 (`facilitatorEarnings==0`, suite fee 0%); a dedicated accrue-then-withdraw script is still owed. (2.4)
+9. **xPNTs firewall reverts** (`UnauthorizedRecipient`, `SingleTxLimitExceeded`) — X1 set caps but did not execute the violating transfers; unit-tested only. (8.2)
+10. **Unapproved-facilitator revert** (`Unauthorized`) — x402 direct ran with an already-approved facilitator. (8.4)
+11. **Burn replay `OperationAlreadyProcessed`** — not re-run as an explicit same-opHash replay (unit-tested). (8.3)
+12. **Rate-commitment / stale-price dry-run reverts** (`DRYRUN_RATE_COMMITMENT_VIOLATED`, `DRYRUN_STALE_PRICE`) — B5 dry-run returned `INSUFFICIENT_BALANCE`; the rate/stale legs were not triggered live. (1.6/7.3)
+13. **Community ownership transfer / factory renounce** — low centrality; unit-tested. (8.5)
+14. **Credit-ceiling over-drain rejection (live)** — I1 verified the ceiling *state* read-only; the live over-ceiling rejection surfaced incidentally as the [27]–[29] `AA34` (an L1-gas artifact, then fixed via `setCreditTier`), not as an isolated ⛔ assertion. See 03 §Credit-ceiling. **OPEN GA ITEM (downgraded per Codex):** the OP base-credit value is NOT measured — the earlier "keep 100 on OP, no change needed" wording was an UNVERIFIED hypothesis (no OP receipt / no OP gas model / no L1-data-fee calc). Directional reasoning (OP execution gas ≈100× cheaper) is kept, but "keep base credit 100" remains an **open GA decision pending an actual OP validate-charge measurement < 100 aPNTs**; if not met, raise the base tier via `setCreditTier`. (7.6)
+
+> **NOT owed (resolved by the fresh deploy):** the beta.1 GA blockers — on-chain `version()`==5.3.3 and the `APNTS_TOKEN`↔`config.aPNTs` divergence — are both GONE on this clean redeploy (see "Fresh-deploy provenance"). `EmergencyStop` exact selector is a clean ⛔ PASS (#11).
diff --git a/docs/e2e/v5.4.0-beta1-deploy/05-CODEX-CHALLENGE.md b/docs/e2e/v5.4.0-beta1-deploy/05-CODEX-CHALLENGE.md
new file mode 100644
index 00000000..42117aa9
--- /dev/null
+++ b/docs/e2e/v5.4.0-beta1-deploy/05-CODEX-CHALLENGE.md
@@ -0,0 +1,168 @@
+# 05 — CODEX CHALLENGE (v5.4.0-beta.1 fresh redeploy — adversarial verification)
+
+> TX-Value-Verification framework, document 5 of 5.
+> Independent 2-axis adversarial sign-off. The framework's whole point: **a green receipt is not a proven feature** — each tx is judged separately on (1) is it REAL on-chain, and (2) was the intended feature actually MET by the resulting state.
+>
+> This run is a **fresh full redeploy of the same `v5.4.0-beta.1` code** (mainnet rehearsal). The two beta.1 GA blockers (`version()`==5.3.3 and the `APNTS_TOKEN`↔`config` divergence) are RESOLVED by the clean deploy — so this challenge does not need to re-litigate them; it focuses on the headline value + the owed items.
+
+## A. Method & two axes
+
+- **Axis 1 — REAL vs FABRICATED**: does the tx hash exist on-chain, mined, with a receipt (block/gas)?
+- **Axis 2 — FEATURE-MET vs NOT-MET**: did the load-bearing L2 state delta asserted in 02-PLAN actually occur (balance/debt/nonce/role/flag), and for ⛔ rows did it revert with the EXACT named selector?
+
+**Network limitation (carried over from beta.1).** The Codex CLI sandbox has **no outbound network** — `cast`/`fetch` against any RPC returns `Operation not permitted`, so Codex cannot independently confirm tx existence (AXIS-1). To compensate, **AXIS-1 was performed human-side in a network-enabled shell** and is **pre-filled below (section B)**; Codex's contribution is scoped to the **AXIS-2 / document-consistency adversarial challenge (section C)**, whose verdicts are now **FILLED** (see §C). The independently-re-derived AXIS-1 set is now **90** (the 86-set below + the 4 gasless-rerun fix-txs, which were previously suite-only and are now RPC-confirmed status=1).
+
+## B. AXIS-1 (REAL vs FABRICATED) — independent RPC re-derivation (human-side, network-enabled) ✅ PRE-FILLED
+
+All **86 unique TX hashes** in `logs/all-tx-inventory.txt` were independently checked via `cast receipt <hash>` against `https://ethereum-sepolia-rpc.publicnode.com` (a different RPC than the suite used, to avoid trusting the harness's own provider).
+
+**Result: 86/86 REAL, all `status = 1`** (this table), **+ 4 gasless-rerun fix-txs now also RPC-verified status=1 → 90/90 independent total.** Zero `NOT_FOUND`, zero `status = 0`. Block range 11071076→11071279; total gas (86-set) 4,913,548. Source: `logs/rpc-independent-verify.txt`.
+
+> **Why every mined tx is status=1 (not a contradiction):** the ⛔ negatives are probed via read-only `eth_call`/staticcall, which revert *without* producing a mined transaction — they never become `status=0` receipts. The absence of any `status=0` row is expected and correct, not evidence that negatives were skipped. The ⛔ legs are accounted for in section C and in 03/04.
+>
+> **Scope note (updated):** the 86-set covers the admin/config/governance/x402/channel/state surface. The 4 first-pass-failure **rerun fix-txs** ([26] gasless `0x7b015620…`, [27] `0x2756e812…`, [28] `0xaa9268a5…`, [29] `0x23b807e2…`) are now **also independently RPC-re-derived status=1** and appended to `logs/rpc-independent-verify.txt`, bringing the independent set to **90/90 REAL**. [36] I1 is a read-only group (`version()=="SuperPaymaster-5.4.0"`, now also eth_call-verified).
+
+### AXIS-1 per-tx (REAL re-derived) — AXIS-2 adjudicated by capability category in §C
+
+> The 86 admin/config/governance/x402/channel txs below are feature-met-judged **at the capability level in section C** (per-tx feature-met for 86 config-surface txs collapses to the category verdicts there: MET / PARTIAL / NOT-MET). The AXIS-2 column therefore points to §C rather than repeating a verdict per row. The 4 gasless-rerun fix-txs are now also RPC-verified status=1 (the independent set is **90**); see 03 §Independent RPC verification.
+
+| TX hash | AXIS-1 (RPC re-derived) | status | block | gas | AXIS-2 (feature-met) |
+|---|---|---|---|---|---|
+| `0x002b5efefedb9efe99f4d1b2de509a6b4a23c820a713ffc05911cfed1a6aadcf` | REAL | 1 | 11071204 | 60864 | see §C (by capability) |
+| `0x032dc3b6e9048f5d716828e3bf2d2e49c2403879975a052c853d173e58636819` | REAL | 1 | 11071273 | 29005 | see §C (by capability) |
+| `0x085619b2358aca0c93c937e885185b3b1901591e70f4c43325da5ba62dd28bb8` | REAL | 1 | 11071231 | 60852 | see §C (by capability) |
+| `0x0d2f92e983b43c5a2a2b2040f81fd0121f2d5415eb03c4149224956418c45ebd` | REAL | 1 | 11071169 | 62955 | see §C (by capability) |
+| `0x0f3702269e6a28a4410b74397155dab673675523538ea2be801565b6e84dc6da` | REAL | 1 | 11071107 | 25059 | see §C (by capability) |
+| `0x14ac938129c609b90227f1c22069dc944e78d82a1337cf906cc9d82c4d30aa60` | REAL | 1 | 11071103 | 41517 | see §C (by capability) |
+| `0x1c2615325a092c8788362e2b01ebde55a2ea78bf589e152065172c157d71a3cf` | REAL | 1 | 11071171 | 34932 | see §C (by capability) |
+| `0x1e7ab565e193116b05dbefefa2a6c4ceec951edc5184ae4380b98e5c7854ba37` | REAL | 1 | 11071076 | 29169 | see §C (by capability) |
+| `0x1e7fa93960668170f3b008fda72a49d305f723c3b92b7e0f371e74f71bd1371a` | REAL | 1 | 11071261 | 58233 | see §C (by capability) |
+| `0x2271a4cff387b9ac1b40643736531991c95144209030f49a5aadd4a732a43901` | REAL | 1 | 11071185 | 115284 | see §C (by capability) |
+| `0x22c156b05f6ecd9ea05f95a6883f57ade005995bfb267e261bb0028c6f70509c` | REAL | 1 | 11071254 | 32717 | see §C (by capability) |
+| `0x26d14619b950eca294a19441bdb9b617046789fbc76062d261cc5b8466ac5541` | REAL | 1 | 11071170 | 62931 | see §C (by capability) |
+| `0x2842fdac23924cab3d3898c8796a3aead67148f307469c7b8304a64a8a5a8e30` | REAL | 1 | 11071094 | 62544 | see §C (by capability) |
+| `0x293192cd6a508aed68add24ed789d1644a516c717ca42c682dc6f023a84b1baa` | REAL | 1 | 11071108 | 46410 | see §C (by capability) |
+| `0x2bc3f97f361c3673b7c8c4a2b8323186e4181e2882f86fb6d8926067f2b087bb` | REAL | 1 | 11071101 | 34089 | see §C (by capability) |
+| `0x2bd1c181c66356e0edd0cfb76fbc93be9ad4c1d5e349f620c5f050043a10cecb` | REAL | 1 | 11071113 | 53491 | see §C (by capability) |
+| `0x2d0db1cd494bcbe58592d18ce3561f3b2ea5f7fce95ae53f6ea80cab41f4170e` | REAL | 1 | 11071146 | 54493 | see §C (by capability) |
+| `0x3299bbfe7d82085fd76c43e3fe2cd20dafd3d75df109ed4150d653342e52eef3` | REAL | 1 | 11071106 | 46971 | see §C (by capability) |
+| `0x355f89edee6181f3d11c6a26aaefe01684c34ccbc8c14dc10f20a6eff2f753ec` | REAL | 1 | 11071166 | 30810 | see §C (by capability) |
+| `0x3581742cec28c64f50c19118555949e4e045d54577907c4f1fe063e5b19f398b` | REAL | 1 | 11071228 | 153491 | see §C (by capability) |
+| `0x388fb325998b03bd55d0a32031e9de294d15ee49dc0d536c877bf4cc29a26f57` | REAL | 1 | 11071110 | 24498 | see §C (by capability) |
+| `0x39ad4ca8884b7f0474abc31ec3216e316f2932967a987084a70e754585bde11f` | REAL | 1 | 11071144 | 36549 | see §C (by capability) |
+| `0x39e7c8dc4e0359fde70713a1f38216faaf01ed64a45c04a1fa38f93da332ce7c` | REAL | 1 | 11071179 | 52044 | see §C (by capability) |
+| `0x3af6e1118650f6c93373e21eaf6e20d5312ea14d7cac5be57b2ade972fe04f4f` | REAL | 1 | 11071092 | 82776 | see §C (by capability) |
+| `0x3bff8eb5f63e4db05e0c68c35ba5561c4e46286965e4e4ae088eb65714790cac` | REAL | 1 | 11071234 | 168433 | see §C (by capability) |
+| `0x3e54a36a41c01395eb8b8bd4dfcac4be77d55979ded191b02634148519020c48` | REAL | 1 | 11071163 | 47655 | see §C (by capability) |
+| `0x3e5654548498bd02acc67c69ec25834e636bebe275c94d00d21becdb84d020f3` | REAL | 1 | 11071088 | 36694 | see §C (by capability) |
+| `0x455f0c772977e5ea6242887e99eed36e63bb4ff40bd1709b8bfaf9b8aae5ba93` | REAL | 1 | 11071233 | 50596 | see §C (by capability) |
+| `0x480aca5c7ce94d14623fbc4f4b99b850699c2cd31fb0f366ca7d4e4982d0bca1` | REAL | 1 | 11071159 | 37068 | see §C (by capability) |
+| `0x48e6f1f3bdfa4fe2eb8eb3ab6f9a2dcb69c1bd75b979af5f77e4c06dcbfbfaa0` | REAL | 1 | 11071257 | 28687 | see §C (by capability) |
+| `0x4b180329ddb95dc94d41423dea5ab5fc89209249fc5a59f51e16aa12f03f2077` | REAL | 1 | 11071145 | 36537 | see §C (by capability) |
+| `0x4c4e777ecc1138b8abba72e7a37bae86904ea51438e244fd51b583d532f6bb53` | REAL | 1 | 11071162 | 29205 | see §C (by capability) |
+| `0x4f466949ef38c12c1de3fa1d55c7e40d6ddea52c9ea96b09932047223a2fc06c` | REAL | 1 | 11071279 | 62743 | see §C (by capability) |
+| `0x50cc95b5bef66c9b301e38a0214d5d84b52731314063bbe0df75bfa79f1864a3` | REAL | 1 | 11071132 | 48430 | see §C (by capability) |
+| `0x56c7d13354e3624f040a989f3f24a3d02d5c5d0826bf0d71ffb1e77e67b599e3` | REAL | 1 | 11071116 | 36705 | see §C (by capability) |
+| `0x5771b1f0f915cc1bb19572f54bf0568161006139f9e56f7329579eca1f5ce93b` | REAL | 1 | 11071167 | 52722 | see §C (by capability) |
+| `0x58a8af7f5a374b650ab29c57bf5ff6959cbff34a5cadd20661c0640de031c580` | REAL | 1 | 11071244 | 56957 | see §C (by capability) |
+| `0x5a479081706ee9167541eefa3033ae32a9e4c0d4612fce5f1dbe1cdf896e2298` | REAL | 1 | 11071126 | 47705 | see §C (by capability) |
+| `0x5c9c68f41e6fb65ebe45208967cbf8d86d249bc00a20eaeae6be42f6ccc66356` | REAL | 1 | 11071134 | 45408 | see §C (by capability) |
+| `0x6ab1c648a9ecda2cd706c59d1241d30a8efa978c45d641602fa48c5b7b70ceac` | REAL | 1 | 11071226 | 111376 | see §C (by capability) |
+| `0x72a826662dd5a9ae98a02da5636205951750f183735722ed166b9cb7b6ccd1cc` | REAL | 1 | 11071105 | 46541 | see §C (by capability) |
+| `0x7456c7f98914321831a87b8a96546c7279a6466c01d17817c3b8e1baf09f9938` | REAL | 1 | 11071154 | 35457 | see §C (by capability) |
+| `0x76c79a94f79864649824cf9705693c050890701d53db1aa769b9ddd4b18462f5` | REAL | 1 | 11071124 | 170232 | see §C (by capability) |
+| `0x7a5f45603034138ad1cc716059efa12206a18d1cd2796726bd31e3771ee0ffbd` | REAL | 1 | 11071215 | 49038 | see §C (by capability) |
+| `0x7f18f43b7f202a302be88fe74ba7b391b3f167bbf44d7e1fbcd890b05c5ab27e` | REAL | 1 | 11071188 | 82788 | see §C (by capability) |
+| `0x80f287d9a26b45f04aa200e8a6e162837f925c43adb188f14f95639a24e0981a` | REAL | 1 | 11071276 | 31674 | see §C (by capability) |
+| `0x853919953001b7d83a70a2c53409f1a20fa4b05d8b0024195eda52e0331ee460` | REAL | 1 | 11071270 | 52917 | see §C (by capability) |
+| `0x899d841d98f997ae5ef37a16deb564e993c0b05128eaffea9a0f17a2e3dcdbee` | REAL | 1 | 11071143 | 60895 | see §C (by capability) |
+| `0x89ba1a1e101a97f901b31475768aea174e892e45d5a338005bd0156acc68936f` | REAL | 1 | 11071197 | 60864 | see §C (by capability) |
+| `0x8c8cba950981607e61dac051f34586b18cf23f8d4a69d06580894272f24714ee` | REAL | 1 | 11071093 | 82175 | see §C (by capability) |
+| `0x8d808d759b4dbf7567f6028e3c65ebaec39fbf20fbe6d1c2557a27e7095ade1f` | REAL | 1 | 11071243 | 61172 | see §C (by capability) |
+| `0x8f246bb00fd98dc61775dba0da72bf19976d08b3f46cd689be1b2843c40159c4` | REAL | 1 | 11071237 | 132710 | see §C (by capability) |
+| `0x904d833481ac04577cf9e3a6bd937038fe349f7e0795d5ffb4a79c16ce26b502` | REAL | 1 | 11071194 | 60864 | see §C (by capability) |
+| `0x933c2c458af74a99f9b458987c6817275a8f6a9c0c31adad10c6965115ec2b36` | REAL | 1 | 11071173 | 34932 | see §C (by capability) |
+| `0x9578c77ea85e7980eb403309459fa6e4ec33cff9d365309760e63045cd494b80` | REAL | 1 | 11071099 | 58854 | see §C (by capability) |
+| `0x9923c682c2762559b1f74891753937b7fc4a27b77517abfdd0d9a89491acd84d` | REAL | 1 | 11071256 | 29017 | see §C (by capability) |
+| `0x9d1c303a088147ef4dfc74905dcde5e0a3ad3a9ada20fc89b50c3b913269e2e9` | REAL | 1 | 11071084 | 36705 | see §C (by capability) |
+| `0xa0ee356a30e4432f2d2476919b1e99e17d4635c5f5c18955dc65b605f99dba8a` | REAL | 1 | 11071240 | 50631 | see §C (by capability) |
+| `0xa367dc1e59e73d38796f2e2f492f24009707e8c977f75273bc435b29ca35d834` | REAL | 1 | 11071140 | 52044 | see §C (by capability) |
+| `0xa9d28d807c142c40ce4cdeae4de30af072a40d3ec971ab2baed40cf8182f0ca0` | REAL | 1 | 11071158 | 155715 | see §C (by capability) |
+| `0xaba63ca47551c462ddcadeff24c3d06332f60e17cea567662d8e351db3b568a9` | REAL | 1 | 11071196 | 60864 | see §C (by capability) |
+| `0xae7ae365d7498139aae23a655e3ac8fd89aca79e0c905a8a1077321fcdba574b` | REAL | 1 | 11071249 | 33113 | see §C (by capability) |
+| `0xb348df670aea29ec9533db5032a02cfdceec85dee32a39e1b93b29adcc332fae` | REAL | 1 | 11071129 | 30605 | see §C (by capability) |
+| `0xb7b2a6a2a4ba39a14e305f734bf28424619e85e06166d5c3252ca543f12a8bbf` | REAL | 1 | 11071155 | 35457 | see §C (by capability) |
+| `0xb9df8305aaaba06a9a5ab4e02b848fe60caada3f8e5da2faca18e48f781c5102` | REAL | 1 | 11071192 | 60864 | see §C (by capability) |
+| `0xbcc29449e396ef1661bae4173ac022ff245749b329c59c51eb72eb9223ad87bb` | REAL | 1 | 11071095 | 62544 | see §C (by capability) |
+| `0xbcc9e00b51441a629df0c83c7d61ccc3f846a4eea4f1d67b120756dd1a841460` | REAL | 1 | 11071164 | 25743 | see §C (by capability) |
+| `0xbd6f3e2626c87512bea605ed760c3532e320d93ed3be8d624d693ad36e1c5b13` | REAL | 1 | 11071181 | 30048 | see §C (by capability) |
+| `0xbf9db46d9e3c50e717949162b74d476677930e60f7c7b1f15fd0b01dc50c72b0` | REAL | 1 | 11071224 | 72378 | see §C (by capability) |
+| `0xc44fccf6053dc133e136a6e4648a84d33057197618f898d9d3947eb5c26de2ba` | REAL | 1 | 11071259 | 50596 | see §C (by capability) |
+| `0xca520191bde57c4247627f9ac8f08e2a63d57284c522502c6fb6e6e7626bada7` | REAL | 1 | 11071275 | 61142 | see §C (by capability) |
+| `0xcfbeacff799ccf264ef782db39646268675901e4eb058a5ca83f1a292285f117` | REAL | 1 | 11071241 | 29586 | see §C (by capability) |
+| `0xd5d1b440b3566657dc1861d1a8bf7241142d87d33ff6b939cf29de0152b2181d` | REAL | 1 | 11071220 | 168825 | see §C (by capability) |
+| `0xd60ebac08941cee9bb79bc578321b9c977381fec61baf42b79d17c7f025e6cc8` | REAL | 1 | 11071255 | 52929 | see §C (by capability) |
+| `0xd77bc9da79e0843b98bca92ce819ac06416f12b23e0d6bd68b2792fe951da4b3` | REAL | 1 | 11071142 | 30048 | see §C (by capability) |
+| `0xda3c37572cb041c2d8162bba7f19b0159d0cba78180d1c74aa10bf18f9428515` | REAL | 1 | 11071184 | 49038 | see §C (by capability) |
+| `0xe4cfdfd94e98d491f9f489d51dfa806c9176a874625db219926080238f27589b` | REAL | 1 | 11071160 | 70790 | see §C (by capability) |
+| `0xe65c14ef673e6bcd8a26d780436c38055eb0afe02cce05c037cfefebd1ef7a07` | REAL | 1 | 11071246 | 54493 | see §C (by capability) |
+| `0xe853e883e976e27ac6e59804ba454ad73ad3fbfbad90c0120e2609c7298104d4` | REAL | 1 | 11071250 | 33113 | see §C (by capability) |
+| `0xe8d5ff66ef79e77bffb819a845557fb6b12e093ff5ab95860ed4361def32a575` | REAL | 1 | 11071195 | 60864 | see §C (by capability) |
+| `0xedf964362c76bc1d2e9448cace7c73fca0f1cfe905d5ecb8497339748ff3fcef` | REAL | 1 | 11071097 | 58854 | see §C (by capability) |
+| `0xf12479efb88810ac8d3a246ba2d7db8385a69ebb9680900fced31b8cb6d38ab9` | REAL | 1 | 11071122 | 36694 | see §C (by capability) |
+| `0xf89b7f26c0e6516e5823460437ad12783347586820055a2ef471adde47adbe22` | REAL | 1 | 11071253 | 32717 | see §C (by capability) |
+| `0xf9487f89cc9f2f5a5cc79d5430952c1d82c86aabd5c6af76034065dc53edc23a` | REAL | 1 | 11071260 | 36714 | see §C (by capability) |
+| `0xfa8bbb5d9a3834cc94b25893002594494d372066b8d2ec3677dff0e4d72b7f36` | REAL | 1 | 11071083 | 45390 | see §C (by capability) |
+| `0xfe0340741a743e3edef1c5078d161cd27a4248c5a98417236a047881ce3b457f` | REAL | 1 | 11071265 | 96309 | see §C (by capability) |
+
+**AXIS-1 tally: 86/86 REAL in this table; with the 4 RPC-verified gasless-rerun fix-txs the full independent set is 90/90 REAL, all status=1.**
+
+## C. AXIS-2 (FEATURE-MET vs NOT-MET) — challenge areas — Codex verdicts FILLED
+
+Codex adversarially challenged each area below (a green/effective-green group is NOT automatically a proven feature). The Codex verdict column is now filled. Legend: **MET** = tx-proven on-chain; **PARTIAL** = real tx but post-state/selector inferred or suite-asserted, not independently re-derived this run; **NOT-MET** = not exercised live this run (owed); **CONFIRMED** = Codex independently corroborated the human-side claim.
+
+| Item | Human-side position (to be challenged) | Codex verdict |
+|---|---|---|
+| **The 4 first-pass failures = harness/L1/test, not contract bug** | [27]/[28]/[29] `AA34` is the **L1-gas credit-ceiling artifact** (fresh user tier-1 = 100 aPNTs < ~120 aPNTs L1 validate charge; H-1 anti-drain has no balance short-circuit by design). Fixed via `setCreditTier(1/2,300)` live; **contract default kept**. [36] I1 + `check-contracts.js` = stale hard-coded `5.3.3` expected strings; on-chain is `5.4.0`. Failure #1 (`prepare-test Unauthorized`) = fresh deployer lacked `PAYMASTER_SUPER`, fixed idempotently in `TestAccountPrepare.s.sol`. **None is a SuperPaymaster contract bug.** | **CONFIRMED.** Codex verified the H-1 credit-ceiling analysis is accurate — it DOES block balance-payers (`SuperPaymaster.sol` 1102–1106 + `_creditExceeded` 812–814, no balance short-circuit). All 4 first-pass failures are harness/L1/test-hygiene, not a contract bug. |
+| **Credit-ceiling OP-L2 caveat** | (original wording claimed the 100-aPNTs default is "plenty" on OP and "mainnet/OP needs no change"). | **DOWNGRADED — RISKY/UNPROVEN.** The directional reasoning (OP execution gas ≈100× cheaper than Sepolia L1 → lower per-tx aPNTs charge) is kept, but "keep 100 on OP, no change needed" is an **UNVERIFIED hypothesis**: no OP receipt, no OP gas model, no L1-data-fee calc was produced. **"Keep base credit 100" is an OPEN GA decision, NOT resolved.** Before relying on 100 for OP, the actual sponsored-tx validate-charge MUST be measured on OP and confirmed < 100 aPNTs; else raise the base tier via `setCreditTier`. |
+| **#295 nonce-retry validated** | B1/B2/B4 PASSED in-suite (beta.1 saw them fail). Log shows `nonce/in-flight conflict — draining mempool & retrying 1/2…` then confirm. | **PARTIAL.** Operator config/funding txs are real (status=1) and the retry path executed in-suite, but the post-state deltas are suite-asserted, not independently re-derived this run. |
+| **SP gasless burn-path (1.1/1.2)** | [27]/[28] (reruns) prove SP xPNTs balance-pay + burn on two tokens (aPNTs, PNTs). [29] proves the BURN branch (burned 48.47 aPNTs, debt stayed 0). | **PARTIAL.** The 3 rerun hashes are now status=1-verified (part of the 90-set), but the post-state balance/burn deltas are suite-asserted, not independently re-derived. SP aPNTs balance-pay + PNTs multi-token + burn branch are inferred/state-delta-claimed, not fully independently post-state-proven. |
+| **PaymasterV4 independent gasless (1.5)** | [26] `0x7b015620…` proves AOA escrow path. | **PARTIAL.** Tx is status=1-verified, but the escrow post-state delta is suite-asserted, not independently re-derived. |
+| **x402 EIP-3009 + direct + C-02 (2.1/2.2)** | [31] USDC settle + replay-reject `NonceAlreadyUsed`; [32] direct xPNTs + redirect-reject `InvalidX402Signature`. | **MET (tx-proven)** for the EIP-3009 USDC settle and the direct xPNTs settle (hashes in verify file). **PARTIAL** for the replay/C-02 negatives — the selector is claimed but not independently decoded (eth_call/unit, not a live-failed mined tx). |
+| **MicroPaymentChannel (2.5)** | [30] open/settle/close lifecycle. | **MET (tx-proven).** Open/settle/close are real mined txs (hashes in verify file). |
+| **Emergency halt (7.5)** | [37] I2 reverted `0x4e97bcfc == EmergencyStop()` — clean ⛔ named-selector match. | **PARTIAL.** The `emergencyRevoke`/`addAutoApproved` flag-flip txs are status=1 (admin surface, state-delta suite-asserted). The `EmergencyStop()` revert is selector-level — eth_call/decoded, not a live-failed mined tx. |
+| **Fresh-deploy provenance** | `version()`=="SuperPaymaster-5.4.0" (I1, clean — beta.1 GA blocker resolved); `APNTS_TOKEN==config.aPNTs==0x9e66B457…` (B2, no migration/divergence); `agentIdentityRegistry==0x8004A818…` (B4, == config). | **CONFIRMED (eth_call-verified).** Both GA blockers are now independently eth_call-confirmed (not just doc-claimed): `version()`→`"SuperPaymaster-5.4.0"`; `APNTS_TOKEN()`→`0x9e66B457…` == `config.aPNTs` (identical). Recorded as `ETH_CALL` lines in `logs/rpc-independent-verify.txt`. |
+| **[OWED] Dual-channel agent `handleOps` (3.4)** | G2 verified eligibility LOGIC read-only only. Registry IS deployed & wired (`0x8004A818…`). Owed = register a no-SBT agent + run a live agent-channel op. **Test-fixture gap, NOT a deployment gap.** | **NOT-MET (read-only only).** No no-SBT agent registered, no live agent-channel `handleOps`; agent-feedback emission not asserted. Owed, honestly. |
+| **[OWED] credit/debt DEBT branch + `repayDebt` (1.2/1.3)** | [29]/TC4 took the BURN branch (AA-A held balance). The 0-balance→`recordDebtWithOpHash` branch + repay cycle NOT driven live this run (proven in beta.1 via a drain fixture). | **NOT-MET (not exercised live).** Only the burn branch ran; credit/debt accrual + `repayDebt` cycle was not driven this run. Owed. |
+| **Negatives unit-tested-only** | Rate-commitment, stale-price, credit-ceiling drain (isolated), xPNTs firewall, burn replay, unapproved-facilitator: not live mined txns this run (unit-tested / `eth_call`-observed). | **NOT-MET / NOT-EXERCISED-LIVE.** These remain eth_call/unit-tested, not live-failed mined txs. Also owed: value-bearing DVT slash, timelock apply steps, BLS aggregate reputation update, UUPS upgrade, facilitator earnings withdraw, isolated credit-ceiling over-limit reject. |
+
+## C-bis. Resolution of Codex findings
+
+Recording how the Codex pass changed this document:
+
+- **(a) AXIS-1 gap closed.** The 4 gasless-rerun fix-txs (`0x7b015620…`, `0x2756e812…`, `0xaa9268a5…`, `0x23b807e2…`) are now independently RPC-verified status=1 and appended to `logs/rpc-independent-verify.txt`, so the independently-re-derived set is **90/90 REAL, all status=1** (was 86; the 4 reruns were previously only suite/`rerun-*.log`-confirmed). Both GA blockers are now `ETH_CALL`-confirmed in the same file (`version()`→`"SuperPaymaster-5.4.0"`; `APNTS_TOKEN()`→`0x9e66B457…` == `config.aPNTs`), and "no `src/` change this session" is `GIT_EVIDENCE`-recorded (last 6 `main` commits touched 0 `contracts/src/*.sol`).
+- **(b) OP-100 claim downgraded.** The "keep base credit 100 on OP, no change needed" claim is downgraded from a settled conclusion to an **OPEN GA item** (Codex: RISKY/UNPROVEN — no OP receipt / gas model / L1-data-fee calc). Directional reasoning kept; the OP value must be measured before GA. (03 §Credit-ceiling KEY OPEN ITEM + 04 footnote 14.)
+- **(c) Honest coverage scope.** The PARTIAL items (SP aPNTs balance-pay, SP PNTs multi-token, PaymasterV4 gasless, operator config/funding, V4 lifecycle, reputation/credit-tier config, oracle update, protocol-/facilitator-fee config, admin surfaces, x402 replay/C-02 negatives) are real txs with suite-asserted (not independently re-derived) post-states. The NOT-MET items (credit/debt accrual + repayDebt, dual-channel agent `handleOps`, agent-feedback emission, value-bearing DVT slash, timelock apply, BLS aggregate reputation, UUPS upgrade, facilitator earnings withdraw, xPNTs firewall reverts, unapproved-facilitator revert, burn-replay, rate-commitment/stale-price reverts, isolated credit-ceiling over-limit reject) are owed.
+- **(d) Selector-level negatives** (x402 replay/C-02, EmergencyStop, firewall, burn-replay, unapproved-facilitator) remain **eth_call / unit-tested, not live-failed mined txs** — not independently decoded this run.
+
+## D. Release-level verdict — did the fresh redeploy reproduce v5.4.0-beta.1's proven value? (Codex AXIS-2 verdicts FILLED)
+
+Honest scorecard, scoped to what is proven on-chain (AXIS-1 independently RPC-verified REAL 90/90; AXIS-2 per Codex categories in §C):
+
+| Capability | Codex AXIS-2 verdict (on-chain proof status) |
+|---|---|
+| x402 EIP-3009 settlement (native USDC) | **MET (tx-proven)** |
+| x402 direct settle (xPNTs, C-02) | **MET (tx-proven)** |
+| MicroPaymentChannel lifecycle | **MET (tx-proven)** |
+| SP xPNTs gasless sponsorship (burn path, 2 tokens) | **PARTIAL** — rerun txs status=1-verified, but burn/balance deltas suite-asserted, not independently re-derived |
+| PaymasterV4 independent gasless | **PARTIAL** — tx status=1, escrow delta suite-asserted |
+| Operator funding / config / governance (B1–B5, #295 nonce-retry) | **PARTIAL** — real txs, post-state suite-asserted |
+| V4 lifecycle / reputation-rule + credit-tier config / oracle price cache / protocol- & facilitator-fee config / admin surfaces | **PARTIAL** — real txs, post-state suite-asserted |
+| x402 replay (`NonceAlreadyUsed`) / C-02 redirect (`InvalidX402Signature`) / Emergency halt (`EmergencyStop()`) | **PARTIAL** — selector claimed, eth_call/decoded, not a live-failed mined tx |
+| Fresh-deploy provenance (clean `version()` 5.4.0, `APNTS_TOKEN==config.aPNTs`) | **CONFIRMED (eth_call-verified)** — both beta.1 GA blockers independently eth_call-confirmed |
+| **Credit/debt DEBT branch + `repayDebt`** | **NOT-MET — not driven live this run** (burn branch only; proven in beta.1) |
+| **Dual-channel agent `handleOps` + agent-feedback emission** | **NOT-MET — read-only only** (registry wired `0x8004A818…`; no live agent op) |
+| ⛔ negatives (rate-commitment, stale-price, credit-ceiling drain, firewall, burn replay, unapproved-facilitator) + value-bearing DVT slash, timelock apply, BLS aggregate rep, UUPS upgrade, facilitator earnings withdraw | **NOT-MET / NOT-EXERCISED-LIVE** — unit-tested / `eth_call`-observed, not live this run |
+| **Base credit-tier value for OP** | **OPEN GA DECISION — UNPROVEN** (no OP gas measurement; "keep 100" is a hypothesis, not a result) |
+
+**Bottom line (Codex AXIS-2 verdicts folded in).** This fresh redeploy of the **same `v5.4.0-beta.1` code** **faithfully validated the mainnet DEPLOY MECHANICS of v5.4.0-beta.1**: wiring is correct, both GA blockers are now **eth_call-confirmed** (`version()`==5.4.0; `APNTS_TOKEN==config.aPNTs`), the deploy/test-script gaps were found and fixed, and **90/90 txs are independently RPC-verified REAL (all status=1)**. The 4 first-pass failures are all non-contract (L1 credit-ceiling artifact + stale test version strings + fresh-deploy role grant). **However, several business capabilities remain PARTIAL or owed** — dual-channel agent `handleOps`, the 0-balance debt-accrual + `repayDebt` cycle, and the live ⛔ negatives are not proven live this run — and **the base-credit-tier value for OP is an UNRESOLVED GA decision pending an actual OP gas measurement** (it was NOT proven by this L1 rehearsal; the earlier "keep 100, no change needed" claim is downgraded to an open item). Do not read this rehearsal as a full business-capability sign-off; it is a deploy-mechanics validation with an honest PARTIAL/owed tail.
diff --git a/docs/e2e/v5.4.0-final/REHEARSAL-RECORD.md b/docs/e2e/v5.4.0-beta1-deploy/REHEARSAL-RECORD.md
similarity index 100%
rename from docs/e2e/v5.4.0-final/REHEARSAL-RECORD.md
rename to docs/e2e/v5.4.0-beta1-deploy/REHEARSAL-RECORD.md