[valthon]

Verify every Solana genesis binary against the strict-build manifest immediately before validator startup. A stale .so left in gitignored target/deploy after a checkout or rebase now fails with a build remediation error instead of being deployed.

The check covers liqsol_core, liqsol_token, transfer_hook, and validator_leaderboard:

• Validate manifest schema version 1, provenance, and the requested program entries at runtime. Missing or malformed fields and unsupported versions fail before deployment.
• Check each binary's byte length and SHA256 against one manifest snapshot. Write verified bytes to a private directory and deploy those copies, so a concurrent rebuild cannot replace the bytes between verification and load.
• Resolve the recorded source stamp to a full commit ID and compare dirty status separately. Different abbreviations and long-describe tag inventories do not invalidate the same commit.
• Generated start.sh scripts perform the same validation and snapshotting at execution time. Rendering requires no local build artifacts. Execution requires Node, Git, and the wire-solana checkout, but no installed tools-ts package or additional Node dependencies.

Dirty builds are allowed with a warning: a describe stamp cannot distinguish two different dirty trees at the same commit. A bare-tag stamp also requires that tag to resolve on the deployment host. The manifest producer is already on wire-solana next.

One focused commit on master, a2d75509. The final implementation exposes the production byte-verification path directly; test-only manifest readers and mutable-path assertion helpers are excluded.

Validation on a2d75509:

• Restored raw source: pnpm install, pnpm build, pnpm install, pnpm run build, full pnpm run lint, changed-file Prettier and diff checks passed. A final raw workspace build passed after removing the temporary test workaround.
• Raw focused verifier suite: 27/27 passed, with open-handle detection. The malformed-manifest matrix covers 24 variants through managed verification and both clean/dirty executed start scripts.
• Full pnpm run test:ci with only Register source-map-support only in the debugging server CLI #132’s barrel-import removal applied temporarily: 456 Jest suites / 4,491 tests passed, plus every package test:unit lane. The temporary change was restored byte-for-byte and is excluded from this PR.
• UNVERIFIED locally: complete raw-head Jest lane. That attempt was interrupted after observing a synchronous jsdom XHR child. No base comparison or base attribution is claimed here.
• The published commit tree matches the restored tested tree. History and whitespace checks passed; original authorship is preserved.
• Exact-head hosted CI on a2d75509 passed: Build and test and Jest results completed successfully on the published raw head, with no temporary Register source-map-support only in the debugging server CLI #132 workaround.

The malformed-manifest regression matrix exercises the production verifier and executed generated scripts, including clean and dirty provenance. Coverage also checks every genesis program, stale siblings, source-commit mismatches, differing Git display settings, replacement of shared outputs after verification, and fixture isolation from signing/hooks configuration.

UNVERIFIED: live validator or settlement flow on this head. Executed-script tests use a validator stub and verify the bytes supplied to it.

Earlier-head validation on 98a8b8b9:

• Hosted Build and test / Jest results passed.
• Local full tests reported in the previous description applied Register source-map-support only in the debugging server CLI #132 only during the test step. Those results belong to the earlier head.