[heifner]

Summary

Completes SEC-107 by flipping the depot's inbound envelope-chain verification from staged to enforced, now that both outposts self-chain per stream (wire-ethereum #128/#132 and wire-solana #364, all merged).

sysio.msgch::apply_consensus records each accepted envelope's canonical epoch digest as the per-outpost chain tip and verifies continuity, but it previously:

• STAGED an empty previous_envelope_hash (accepted + logged) because not every outpost chained yet, and
• carried an INTERIM SVM-only cross-stream fallback that accepted the Solana outpost's pre-SEC-114 link to the depot's own last outbound emit.

Both are removed. Once a tip is recorded for an outpost, previous_envelope_hash must be exactly the 32-byte tip; an empty (non-genesis), wrong-length, all-zero, or non-matching value is a chain break and the envelope is dropped before dispatch, consensus record, or cleanup (delivery rows stay for audit/dispute), per the never-throw convention. to_checksum256_exact already rejects any non-32-byte field, so wrong-length and all-zero values are breaks too, matching the outposts' canonical-form enforcement. An empty prev is valid only at genesis (no tip yet), and an outpost's first accepted envelope still bootstraps.

Validation

• sysio_msgch_chain_tests (7), sysio_dispatch_tests (39), sysio_dispute_tests (19) pass under sys-vm. The chain suite's staged-empty-accept case flips to a rejection and the SVM cross-stream-accept case flips to a rejection (both now drop, tip unmoved).
• flow-swap-from-wire passes 15/15 against the enforced depot with the merged ETH and Solana outposts; zero DROP envelope chain break. SOL->WIRE and ETH->WIRE both verified chaining per stream (genesis-empty, then keccak256 of the prior emit).

ABI unchanged; no reference-data regen (msgch is not in the deep-mind/snapshot reference chains).

Follow-ups

• SEC-118 (per-digest consensus counting on both outposts) remains open.
• SEC-106 finalizeEpoch gating (ETH legacy path) remains open.