PRIOR cannot heartbeat-sign R1-created 90-seat wallet storage (rollback)

[lionakhnazarov]

Summary

Offline copy of an R1-created 90-seat signer (s07-90 volumes) succeeded (hashes, no process overlap). Mounting those working copies on PRIOR v2.5.2 with the same operator keys did not produce heartbeat generated signature. R1 roll-forward was not reached.

Cutover MVP S13 reduced. Honest FAIL.

Why it matters (ops)

This is the reverse-compatibility claim for automated rollback: drain R1 → copy storage → run previous binary → come back on R1. If PRIOR cannot use R1-written tBTC signer state, a rollback playbook is not safe.

Evidence

s13-evidence.json (2026-08-13):

• s07_90_source: true
• no_overlap: true
• prior_heartbeat_sig: false
• r1_rollforward_sig: false
• pre_rollback_preserved: false (fail stopped before that assert)

Copy path itself looked fine (s07-90 → s13-pre-rollback + s13-working).

Open question

Storage/format incompatibility vs seating/window/harness (PRIOR homogeneous heartbeat on mutated copies). Needs a focused rerun that logs why PRIOR did not start/finish signing (config, group size, key material, protocol mode).

Expected

After a clean drain and offline copy:

1. PRIOR produces one homogeneous heartbeat signature on the working copies
2. R1 then signs again on the PRIOR-mutated copies
3. Untouched pre-rollback archive hashes unchanged

References

• PR Security release/candidate 1 #4109 cutover MVP S13; s07-90 volumes preserved for this path
• Findings: 20260817-pr4109-cutover-mvp-findings.md

[linear]

ENG-743