[joshglogau]

Changes

Implements the admin-approved WIRE-439 policy: node-owner registration creates new accounts only. Copying an existing account's public active key cannot authorize an Ethereum link.

• ROA rejects existing names with audited ACCOUNT_EXISTS (7); preserves duplicate, invalid-name, link-conflict and tier-cap outcomes.
• MSGCH submits one nodeownreg. ROA atomically creates the account, allocates its tier through forcereg, and records the depositor's AuthEx link.
• Updates regression coverage, registration fixtures and subsystem documentation. Includes rebuilt ROA/MSGCH WASMs; ABIs and stored-row layouts are unchanged.

No BAR, protobuf or SDK change. Previously bound links and escrowed NFTs are not remediated by this patch.

Rollout

Deploy ROA and MSGCH together, or quiesce inbound dispatch until both are installed; mixed revisions are incompatible. Hub name checks cannot reserve a name, so a later collision can still reject and leave the NFT escrowed.

Companions: Wire-Network/wire-tools-ts#188 and Wire-Network/wire-hub-webapp#242 (stacked on Wire-Network/wire-hub-webapp#241).

Verification

• Linux contracts_project build passed with CDT 4d36a654; both ABIs are unchanged.
• 128 ROA/dispatch tests, 3,273 assertions passed, covering copied keys, fresh registration across all three tiers, unchanged victim state and rejection followed by a valid claim in one envelope.
• Negative control reproduces unauthorized registration/linkage with the old ROA WASM; restoring the candidate passes the suite.
• Linux CI passed on Ubuntu, GCC, ASan, UBSan and assertions-enabled builds; macOS CI also passed. Final commit c0a27c981b changes comments only; its CI rerun remains pending.
• No live deployment or full BAR→OPP acceptance run; those remain rollout checks.