G56-02+03: Update nip_proposal.md and README.md for non-replaceable kind 9999

README.md

@@ -221,18 +221,18 @@ flowchart TD
     SIGN4 --> KIND1
     MLKEM --> KIND1
 
-    SECP --> ACCT1[Account 1 - existing identity signs kind 1 and kind 11112]
+    SECP --> ACCT1[Account 1 - existing identity signs kind 1 and kind 9999]
 
     KIND1 --> OTS[OpenTimestamp the kind 1 event hash]
-    OTS --> KIND11112[Kind 11112 Wrapper Event - carries OTS proof]
-    KIND11112 --> RELAY[Published to relays NOW]
+    OTS --> KIND9999[Kind 9999 Proof Carrier - carries OTS proof]
+    KIND9999 --> RELAY[Published to relays NOW]
 
     RELAY --> CLIENT1[PQ-aware client - picks ML-DSA]
     RELAY --> CLIENT2[PQ-aware client - picks SLH-DSA]
     RELAY --> CLIENT3[Legacy client - ignores all PQ keys]
 
     style KIND1 fill:#ffa
-    style KIND11112 fill:#ffa
+    style KIND9999 fill:#ffa
     style OTS fill:#cfc
 ```
 
@@ -275,9 +275,9 @@ pending timestamp on the Bitcoin blockchain via OpenTimestamps.
 
 Each PQ signature scheme signs `TextEncoder.encode(content)` — the human-readable attestation text. The event is signed with the user's **existing** Nostr identity (Account #1) via `window.nostr.signEvent` (NIP-07).
 
-#### 2. Kind 11112 Wrapper (machine-verifiable, carries the OTS proof)
+#### 2. Kind 9999 Proof Carrier (machine-verifiable, carries the OTS proof)
 
-A replaceable event (kind 11112, in the 10000–19999 range) that wraps the kind 1 announcement and carries the OpenTimestamps proof. The content is the full kind 1 event as JSON (so verifiers don't need to fetch it from relays).
+A non-replaceable event (kind 9999, in the 0–9999 range) that wraps the kind 1 announcement and carries the OpenTimestamps proof. The content is the full kind 1 event as JSON (so verifiers don't need to fetch it from relays). Each publication is permanent — upgrades publish a new event with an `upgrade_of` tag referencing the previous one.
 
 **Content:** `JSON.stringify(kind1Event)` — the full signed kind 1 event embedded as a JSON string.
 
@@ -292,7 +292,7 @@ The wrapper is signed with the user's existing identity (Account #1) via `window
 
 **What the event proves:**
 - Each PQ signature scheme (ML-DSA-44, ML-DSA-65, SLH-DSA-128s, Falcon-512) signed the attestation text — verified by checking each PQ signature against the pubkey in its tag.
-- The user's existing Nostr identity (Account #1) authorized the migration — verified by the secp256k1 Schnorr signature on the kind 1 and kind 11112 events.
+- The user's existing Nostr identity (Account #1) authorized the migration — verified by the secp256k1 Schnorr signature on the kind 1 and kind 9999 events.
 - The event is anchored to a pre-quantum Bitcoin block via OpenTimestamps — the event with the earliest valid OTS proof wins (see Component 3).
 
 **What the event does NOT prove:**
@@ -334,7 +334,7 @@ If a specific PQ scheme is later found to be weak (like SIKE was):
 
 ## Component 3: OpenTimestamps for Pre-Quantum Anchoring
 
-NIP-03 (OpenTimestamps Attestations for Events) anchors Nostr event hashes to the Bitcoin blockchain via OpenTimestamps. The implementation submits the **SHA-256 of the full signed kind 1 event JSON** (including its `id` and `sig`) to the OpenTimestamps calendar servers, and embeds the resulting `.ots` proof in the kind 11112 wrapper's `ots` tag.
+NIP-03 (OpenTimestamps Attestations for Events) anchors Nostr event hashes to the Bitcoin blockchain via OpenTimestamps. The implementation submits the **SHA-256 of the full signed kind 1 event JSON** (including its `id` and `sig`) to the OpenTimestamps calendar servers, and embeds the resulting `.ots` proof in the kind 9999 proof carrier's `ots` tag.
 
 ### Why Bitcoin Timestamping Is Quantum-Resistant
 
@@ -364,10 +364,10 @@ The kind 1 announcement event MUST be timestamped via OpenTimestamps. This preve
 
 The implementation timestamps the **SHA-256 of the full signed kind 1 event JSON** (computed by hashing `JSON.stringify(kind1Event)`, which includes the `id` and `sig` fields). This hash is:
 1. Submitted to OpenTimestamps calendar servers to obtain a pending `.ots` proof.
-2. Recorded in the kind 11112 wrapper's `sha256` tag.
-3. The `.ots` proof is embedded in the kind 11112 wrapper's `ots` tag.
+2. Recorded in the kind 9999 proof carrier's `sha256` tag.
+3. The `.ots` proof is embedded in the kind 9999 proof carrier's `ots` tag.
 
-The kind 11112 wrapper *carries* the OTS proof; the kind 1 event *is* what's timestamped. Verifiers re-compute the hash from the embedded kind 1 event and check it matches the `sha256` tag.
+The kind 9999 proof carrier *carries* the OTS proof; the kind 1 event *is* what's timestamped. Verifiers re-compute the hash from the embedded kind 1 event and check it matches the `sha256` tag.
 
 ### Current OTS Verification Status
 
@@ -646,8 +646,8 @@ flowchart TD
         KIND1 --> SECP1[Account 1 signs kind 1 via signer]
         SECP1 --> HASH[SHA-256 of full signed kind 1 event JSON]
         HASH --> OTS[Submit hash to OpenTimestamps]
-        OTS --> KIND11112[Build kind 11112 wrapper with OTS proof]
-        KIND11112 --> SECP2[Account 1 signs kind 11112 via signer]
+        OTS --> KIND9999[Build kind 9999 proof carrier with OTS proof]
+        KIND9999 --> SECP2[Account 1 signs kind 9999 via signer]
         SECP2 --> RELAY[Publish both events to relays]
         SEED --> BACKUP[User writes down 12-word phrase]
     end
@@ -655,7 +655,7 @@ flowchart TD
     subgraph CONFIRM["Bitcoin confirmation"]
         POLL[Poll OTS upgrade service]
         POLL --> UPGRADE[Upgrade .ots proof with Bitcoin attestation]
-        UPGRADE --> REPUBLISH[Republish kind 11112 with confirmed proof]
+        UPGRADE --> REPUBLISH[Publish new kind 9999 with confirmed proof]
     end
 
     subgraph FUTURE["Post-quantum - when quantum computers arrive"]
@@ -682,10 +682,10 @@ flowchart TD
 2. Client generates a 12-word phrase, shows it to the user to write down
 3. Client derives 5 PQ keypairs from the seed via BIP32 paths
 4. Each PQ signature scheme signs the human-readable attestation text
-5. The user's signer signs the kind 1 announcement and the kind 11112 wrapper
+5. The user's signer signs the kind 1 announcement and the kind 9999 proof carrier
 6. The SHA-256 of the full signed kind 1 event is submitted to OpenTimestamps
 7. Both events are published to relays
-8. The client polls for Bitcoin confirmation and republishes the kind 11112 wrapper with the confirmed OTS proof
+8. The client polls for Bitcoin confirmation and publishes a new kind 9999 proof carrier with the confirmed OTS proof (append-only — the original remains on relays)
 9. After quantum migration: clients use PQ keys, old key retired
 
 ---
@@ -747,7 +747,7 @@ The current implementation is a static web app (`www/`) that performs the full m
 | PQ signing (ML-DSA-44, ML-DSA-65, SLH-DSA-128s, Falcon-512) | Implemented | `www/js/pq-crypto.mjs` |
 | ML-KEM-768 keygen (KEM, no signing) | Implemented | `www/js/pq-crypto.mjs` |
 | Kind 1 announcement event construction | Implemented | `www/js/pq-crypto.mjs` |
-| Kind 11112 wrapper event construction | Implemented | `www/js/pq-crypto.mjs` |
+| Kind 9999 proof carrier event construction | Implemented | `www/js/pq-crypto.mjs` |
 | NIP-01 event ID computation and Schnorr verification | Implemented | `www/js/pq-crypto.mjs` |
 | OpenTimestamps submission (pending proof) | Implemented | `www/js/pq-crypto.mjs` |
 | OTS upgrade polling (via server helper) | Implemented | `www/js/pq-crypto.mjs` |

nip_proposal.md

@@ -35,7 +35,7 @@ The PQ standardization landscape is still young. SIKE was a NIST finalist broken
 A user with an existing Nostr identity (the **attesting identity**) publishes two events:
 
 1. A **kind 1 announcement** — a human-readable attestation whose `content` is signed by each PQ signature scheme, with the PQ public keys and signatures carried in `algorithm` tags.
-2. A **kind 11112 wrapper** — a replaceable event that embeds the full signed kind 1 event as JSON content and carries an OpenTimestamps proof anchoring the kind 1 event to a Bitcoin block.
+2. A **kind 9999 proof carrier** — a non-replaceable event that embeds the full signed kind 1 event as JSON content and carries an OpenTimestamps proof anchoring the kind 1 event to a Bitcoin block. Upgrades (pending → confirmed) publish a new kind 9999 event with an `upgrade_of` tag referencing the previous one; both remain on relays permanently.
 
 The PQ keys are derived deterministically from a BIP39 seed phrase via BIP32, at fixed child indices under the NIP-06 base path. This means a user who has backed up their seed phrase can always recover the same PQ keys, on any conforming implementation.
 
@@ -46,8 +46,8 @@ flowchart TD
     SECP --> K1[Kind 1 announcement - attesting identity signs]
     PQ --> K1
     K1 --> OTS[OpenTimestamps anchor to Bitcoin block]
-    OTS --> K11112[Kind 11112 wrapper - carries OTS proof]
-    K11112 --> RELAY[Published to relays]
+    OTS --> K9999[Kind 9999 proof carrier - carries OTS proof]
+    K9999 --> RELAY[Published to relays]
 ```
 
 ## PQ key derivation from a BIP39 seed
@@ -157,9 +157,11 @@ Future NIPs may register additional `algorithm-id` values and additional BIP32 c
 }
 ```
 
-## The kind 11112 wrapper event
+## The kind 9999 proof carrier event
 
-A **replaceable** event (kind 11112, in the 10000–19999 range) that wraps the kind 1 announcement and carries the OpenTimestamps proof. It is signed with the attesting identity's secp256k1 key.
+A **non-replaceable** event (kind 9999, in the 0–9999 range) that wraps the kind 1 announcement and carries the OpenTimestamps proof. It is signed with the attesting identity's secp256k1 key.
+
+Kind 9999 is non-replaceable: each publication is permanent on relays. Upgrades (e.g. pending → confirmed OTS proof) publish a **new** kind 9999 event with an `upgrade_of` tag referencing the previous one. Both events remain on relays. Clients fetch all kind 9999 events for a pubkey and select the one with the earliest valid Bitcoin anchor.
 
 The kind number is provisional and subject to maintainer allocation.
 
@@ -177,7 +179,7 @@ The kind number is provisional and subject to maintainer allocation.
 
 ```json
 {
-  "kind": 11112,
+  "kind": 9999,
   "pubkey": "<attesting identity secp256k1 pubkey, hex>",
   "content": "<JSON string of the full signed kind 1 event>",
   "tags": [
@@ -203,7 +205,7 @@ With an OTS anchor, the real event is committed to a specific Bitcoin block befo
 
 ### Verification rule: earliest valid anchor wins
 
-When a client finds multiple kind 11112 wrappers for the same attesting identity, it verifies the OTS proof in each and selects the one whose Bitcoin attestation has the **earliest block height**. That wrapper's embedded kind 1 event is the canonical key-link for that identity. Later wrappers, even if validly signed, are treated as superseding only if they are signed by a PQ key already linked by the earliest wrapper.
+When a client finds multiple kind 9999 proof carriers for the same attesting identity, it verifies the OTS proof in each and selects the one whose Bitcoin attestation has the **earliest block height**. That proof carrier's embedded kind 1 event is the canonical key-link for that identity. Later proof carriers, even if validly signed, are treated as superseding only if they are signed by a PQ key already linked by the earliest proof carrier.
 
 ### OTS proof states
 
@@ -217,10 +219,11 @@ Clients SHOULD perform full client-side OTS verification: parse the proof, walk
 
 ### PQ-aware clients
 
-A PQ-aware client, when it encounters a kind 11112 wrapper for a pubkey it cares about:
+A PQ-aware client, when it encounters a kind 9999 proof carrier for a pubkey it cares about:
 
-1. Parses the embedded kind 1 event from the wrapper's `content`.
-2. Verifies the attesting identity's secp256k1 signature on both the kind 1 and the kind 11112 events.
+1. Parses the embedded kind 1 event from the proof carrier's `content`.
+2. Verifies the attesting identity's secp256k1 signature on both the kind 1 and the kind 9999 events.
+3. Verifies that the proof carrier's pubkey matches the embedded kind 1 event's pubkey (identity binding).
 3. Verifies the `sha256` tag matches `sha256(JSON.stringify(kind1Event))`.
 4. For each `algorithm` tag with a signature, verifies the PQ signature against the pubkey in the tag, over `TextEncoder.encode(kind1Event.content)`.
 5. Verifies the OTS proof in the `ots` tag against the `sha256` digest.
@@ -231,14 +234,14 @@ After a quantum break of secp256k1, the client trusts the PQ keys from the earli
 
 ### Legacy clients
 
-Legacy clients see the kind 1 announcement as an ordinary text note and the kind 11112 wrapper as an unknown replaceable event. They ignore both. Nothing breaks.
+Legacy clients see the kind 1 announcement as an ordinary text note and the kind 9999 proof carrier as an unknown event. They ignore both. Nothing breaks.
 
 ## What this NIP proves and does not prove
 
 **It proves:**
 
 - Each PQ signature scheme listed in the tags signed the attestation text. Verified by checking each PQ signature against its tag's pubkey.
-- The attesting identity authorized the link. Verified by the secp256k1 Schnorr signature on the kind 1 and kind 11112 events, valid pre-quantum.
+- The attesting identity authorized the link. Verified by the secp256k1 Schnorr signature on the kind 1 and kind 9999 events, valid pre-quantum.
 - The link existed at a specific pre-quantum Bitcoin block. Verified by the OTS proof.
 
 **It does not prove:**

package.json

@@ -1,6 +1,6 @@
 {
   "name": "post_quantum_nostr",
-  "version": "0.0.12",
+  "version": "0.0.15",
   "description": "A migration strategy for bringing post-quantum security to Nostr without breaking the social graph, without requiring consensus on a single post-quantum algorithm, and without forcing existing users to abandon their identities.",
   "main": "index.js",
   "scripts": {

plans/g56-02-non-replaceable-proof-carrier.md

@@ -0,0 +1,183 @@
+# G56-02 Implementation Plan: Non-Replaceable Proof Carrier with Append-Only Upgrades
+
+**Date:** 2026-07-24  
+**Finding:** G56-02 — Earliest-valid-anchor rule is not implemented; relay discovery selects the latest replaceable event  
+**Approach:** Switch the proof carrier from replaceable kind 11112 to non-replaceable kind 9999, with append-only upgrade events and earliest-anchor selection  
+**No migration needed:** the project has not been publicly released
+
+## Problem summary
+
+Kind 11112 is in the 10000–19999 range, which Nostr relays treat as **replaceable** — they keep only the latest event per pubkey. This means:
+
+1. An attacker who breaks secp256k1 can publish a new kind 11112 that replaces the original on relays
+2. The code queries with `limit: 1` and selects the newest `created_at`, which is the opposite of the proposal's "earliest valid Bitcoin anchor wins" rule
+3. The original event — with its earlier Bitcoin anchor — can be hidden
+
+## Design
+
+### Two-event structure (unchanged conceptually, changed kind)
+
+**Event 1: Kind 1 Announcement** (non-replaceable, already correct)
+- Contains the human-readable attestation text and PQ keys/signatures in `algorithm` tags
+- Signed by the user's existing secp256k1 identity
+- Its full signed JSON hash is what gets submitted to OpenTimestamps
+- No changes needed — kind 1 is already in the 0–9999 non-replaceable range
+
+**Event 2: Kind 9999 Proof Carrier** (non-replaceable, changed from 11112)
+- References Event 1 by `e` tag
+- Carries the `sha256` tag (hash of Event 1's full signed JSON)
+- Carries the `ots` tag (base64 .ots proof)
+- New `ots_status` tag: `"pending"` or `"confirmed"`
+- New `upgrade_of` tag: references the previous proof carrier event ID (only on upgrade events)
+- Published as append-only — upgrades publish a NEW event, never replace
+
+### Append-only upgrade flow
+
+```
+1. User signs in → generates seed → derives PQ keys → signs kind 1 announcement
+2. Submit kind 1 hash to OTS calendars → get pending .ots proof
+3. Publish kind 1 announcement (permanent, non-replaceable)
+4. Publish kind 9999 proof carrier with ots_status="pending" (permanent, non-replaceable)
+5. Wait 10-30 min for Bitcoin confirmation
+6. Upgrade the .ots proof via /ots-upgrade helper
+7. Publish a NEW kind 9999 proof carrier with ots_status="confirmed" and upgrade_of="<pending event id>"
+8. Both proof carriers remain on relays permanently — client picks the one with the earliest valid Bitcoin anchor
+```
+
+### Re-migration flow (user lost seed, runs process again years later)
+
+```
+1. User signs in with same Nostr identity → generates new seed → derives new PQ keys
+2. Publishes a new kind 1 announcement (new PQ keys, new block height)
+3. Publishes new kind 9999 proof carriers (pending, then confirmed)
+4. Client sees multiple kind 1 announcements + multiple proof carriers
+5. Earliest valid Bitcoin anchor across all of them is the canonical root
+6. Later migrations are valid if published while secp256k1 is still trustworthy
+```
+
+### Earliest-anchor selection logic
+
+A new pure function `selectCanonicalProofCarrier(candidates, kind1Event)`:
+
+1. Input: array of kind 9999 events for a pubkey, plus the kind 1 announcement they reference
+2. Filter: only candidates whose `e` tag matches the kind 1 event ID
+3. Filter: only candidates whose `sha256` tag matches `hashFullEvent(kind1Event)`
+4. Filter: only candidates with a valid secp256k1 signature
+5. For each remaining candidate, parse and verify its OTS proof:
+   - If `ots_status` is "confirmed" and the OTS proof has a valid Bitcoin attestation → record the Bitcoin block height
+   - If `ots_status` is "pending" or the OTS proof has no Bitcoin attestation → skip (not yet anchored)
+6. Sort valid candidates by Bitcoin block height (ascending)
+7. Return the one with the earliest block height
+8. If tie, sort by event ID lexicographically (deterministic tie-break)
+9. If no candidate has a confirmed Bitcoin anchor, return the best pending candidate with a note
+
+## Files to change
+
+### 1. `www/js/pq-crypto.mjs`
+
+**Change `NIP_QR_KIND`:**
+- Line 430: change `11112` to `9999`
+- Update comment: "Kind 9999 is a non-replaceable event (0–9999 range). Each publication is permanent. Upgrades publish a new event with `upgrade_of` referencing the previous one."
+
+**Update `buildKind11112Wrapper()` → rename to `buildProofCarrier()`:**
+- Add `['ots_status', 'pending']` tag (or 'confirmed' when applicable)
+- Add optional `['upgrade_of', previousEventId]` tag when upgrading
+- Keep existing `e`, `sha256`, `ots` tags
+
+**Update `buildUpgradedEvent()`:**
+- Instead of copying tags and replacing the `ots` tag, build a completely new proof carrier event
+- Include `ots_status: 'confirmed'`
+- Include `upgrade_of: <original proof carrier event id>`
+- Keep the same `e` and `sha256` tags (they reference the same kind 1 event)
+
+**Add `selectCanonicalProofCarrier(candidates, kind1Event)`:**
+- Pure function, no network calls
+- Takes array of proof carrier events and the kind 1 announcement
+- Returns `{ canonical, allCandidates, errors }` where `canonical` is the event with the earliest valid Bitcoin anchor
+- OTS verification is async, so this function should be async and call `verifyOtsProof()` for each candidate's OTS proof
+
+### 2. `www/verify.html`
+
+**Update `queryRelayForEvent()`:**
+- Change kind from `NIP_QR_KIND` (which will be 9999) — already uses the constant, so this is automatic
+- Remove `limit: 1` — fetch all events
+- Return an array of events instead of a single event
+
+**Update `verifyEvent()`:**
+- Accept an array of proof carrier candidates
+- Call `selectCanonicalProofCarrier()` to pick the canonical one
+- Display all candidates in the UI with their OTS status and Bitcoin anchor height
+- Highlight the canonical (earliest-anchor) one
+- Still verify the kind 1 announcement and PQ signatures as before
+
+**Update the relay query tab:**
+- Query for both kind 1 and kind 9999 events for the pubkey
+- Match proof carriers to announcements by `e` tag
+- Display the full migration history
+
+### 3. `www/index.html`
+
+**Update `queryRelayForKind11112()` → rename to `queryRelayForProofCarriers()`:**
+- Remove `limit: 1`
+- Return an array
+
+**Update the sign/publish flow:**
+- After signing the kind 1 announcement and getting the pending OTS proof, publish the kind 9999 proof carrier with `ots_status: 'pending'`
+
+**Update `publishUpgradedEvent()`:**
+- Build a NEW proof carrier event (not a replacement)
+- Include `ots_status: 'confirmed'` and `upgrade_of: <pending event id>`
+- Publish it as a new event
+- Do NOT try to replace the old event
+
+**Update the resume workflow:**
+- Fetch all kind 9999 proof carriers for the pubkey
+- Find the one that matches the persisted kind 1 event hash
+- If a confirmed proof carrier already exists, the workflow is complete
+- If only a pending proof carrier exists, continue the upgrade polling
+
+**Update `savePendingOts()`:**
+- Store both the pending proof carrier event ID and the kind 1 event ID
+- Store the `sha256` target digest explicitly
+- On resume, validate that fetched events match persisted IDs
+
+### 4. `test/pq-crypto.test.mjs`
+
+**Update existing tests:**
+- Any test referencing kind 11112 → change to 9999
+
+**Add new tests:**
+- `buildProofCarrier` includes `ots_status` tag
+- `buildUpgradedEvent` includes `ots_status: 'confirmed'` and `upgrade_of` tag
+- `selectCanonicalProofCarrier` returns the event with the earliest Bitcoin anchor
+- `selectCanonicalProofCarrier` handles ties deterministically
+- `selectCanonicalProofCarrier` skips pending-only candidates when confirmed ones exist
+- `selectCanonicalProofCarrier` rejects candidates with wrong `e` tag or `sha256` tag
+- `selectCanonicalProofCarrier` rejects candidates with invalid secp signatures
+- Multiple migration attempts (re-migration) — earliest anchor wins across all
+
+### 5. `nip_proposal.md`
+
+- Change kind 11112 to kind 9999
+- Update the description: "non-replaceable event (0–9999 range)"
+- Add `ots_status` and `upgrade_of` tags to the tag specification
+- Update the verification rule: "fetch all kind 9999 events, select earliest valid Bitcoin anchor"
+- Update the proof states section: upgrades publish new events, not replacements
+
+### 6. `README.md`
+
+- Update any reference to kind 11112 → kind 9999
+- Update the migration flow description
+- Update the implementation status table
+
+## Acceptance criteria
+
+1. No event in the system is replaceable — both kind 1 and kind 9999 are in the 0–9999 range
+2. Upgrades publish new events with `upgrade_of` referencing the previous one — no event is ever replaced
+3. Relay queries fetch all candidates, not `limit: 1`
+4. `selectCanonicalProofCarrier` deterministically picks the earliest valid Bitcoin anchor
+5. A later forged proof carrier cannot hide or supersede an earlier valid one
+6. Re-migration (publishing a second migration attempt) works naturally — all events are permanent
+7. All existing tests pass (updated for kind 9999)
+8. New tests for append-only upgrades and earliest-anchor selection pass
+9. The verify page displays the full candidate history and highlights the canonical one

test/pq-crypto.test.mjs

@@ -494,3 +494,205 @@ describe('G56-01: strict PQ algorithm policy (verifyNIPQRContent)', () => {
     assert.ok(Array.isArray(result.errors), 'errors should be an array');
   });
 });
+
+// ============================================================================
+// G56-02: NON-REPLACEABLE PROOF CARRIER (kind 9999) AND EARLIEST-ANCHOR SELECTION
+// ============================================================================
+//
+// Tests for the new non-replaceable proof carrier event kind, append-only
+// upgrades, and the selectCanonicalProofCarrier function.
+
+describe('G56-02: non-replaceable proof carrier (kind 9999)', () => {
+  const sk = new Uint8Array(32);
+  sk[31] = 1;
+  const pkHex = m.bytesToHex(schnorr.getPublicKey(sk));
+
+  async function signedKind1(content, tags) {
+    const event = {
+      pubkey: pkHex,
+      created_at: 1700000000,
+      kind: 1,
+      tags: tags || [],
+      content: content || 'test attestation'
+    };
+    event.id = m.computeEventId(event);
+    event.sig = m.bytesToHex(schnorr.sign(m.hexToBytes(event.id), sk));
+    return event;
+  }
+
+  async function validKind1WithAllPQKeys() {
+    const mnemonic = 'abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about';
+    const seed = m.mnemonicToSeed(mnemonic);
+    const keys = m.derivePQKeysFromSeed(seed);
+    const event = m.buildKind1Announcement(pkHex, 958927, keys);
+    event.id = m.computeEventId(event);
+    event.sig = m.bytesToHex(schnorr.sign(m.hexToBytes(event.id), sk));
+    return event;
+  }
+
+  async function signedProofCarrier(kind1Event, otsProof, options = {}) {
+    const template = m.buildProofCarrier(kind1Event, otsProof, options);
+    template.id = m.computeEventId(template);
+    template.sig = m.bytesToHex(schnorr.sign(m.hexToBytes(template.id), sk));
+    return template;
+  }
+
+  test('NIP_QR_KIND is 9999 (non-replaceable range)', () => {
+    assert.equal(m.NIP_QR_KIND, 9999, 'kind should be 9999 (0-9999 non-replaceable range)');
+  });
+
+  test('buildProofCarrier includes ots_status tag', async () => {
+    const kind1 = await validKind1WithAllPQKeys();
+    const carrier = m.buildProofCarrier(kind1, new Uint8Array(100), { otsStatus: 'pending' });
+    assert.equal(carrier.kind, 9999);
+    const otsStatusTag = carrier.tags.find(t => t[0] === 'ots_status');
+    assert.ok(otsStatusTag, 'should have ots_status tag');
+    assert.equal(otsStatusTag[1], 'pending');
+  });
+
+  test('buildProofCarrier includes upgrade_of tag when provided', async () => {
+    const kind1 = await validKind1WithAllPQKeys();
+    const carrier = m.buildProofCarrier(kind1, new Uint8Array(100), {
+      otsStatus: 'confirmed',
+      upgradeOf: 'abc123'
+    });
+    const upgradeTag = carrier.tags.find(t => t[0] === 'upgrade_of');
+    assert.ok(upgradeTag, 'should have upgrade_of tag');
+    assert.equal(upgradeTag[1], 'abc123');
+  });
+
+  test('buildUpgradedEvent creates append-only event with upgrade_of', async () => {
+    const kind1 = await validKind1WithAllPQKeys();
+    const pendingCarrier = await signedProofCarrier(kind1, new Uint8Array(100), { otsStatus: 'pending' });
+    const upgraded = m.buildUpgradedEvent(pendingCarrier, new Uint8Array(200));
+
+    // Should be a new event, not a replacement
+    assert.equal(upgraded.kind, 9999);
+    const otsStatusTag = upgraded.tags.find(t => t[0] === 'ots_status');
+    assert.equal(otsStatusTag[1], 'confirmed', 'upgraded event should have ots_status confirmed');
+
+    const upgradeTag = upgraded.tags.find(t => t[0] === 'upgrade_of');
+    assert.ok(upgradeTag, 'should have upgrade_of tag');
+    assert.equal(upgradeTag[1], pendingCarrier.id, 'upgrade_of should reference original event ID');
+
+    // e and sha256 tags should be the same as the original
+    const eTag = upgraded.tags.find(t => t[0] === 'e');
+    const origETag = pendingCarrier.tags.find(t => t[0] === 'e');
+    assert.equal(eTag[1], origETag[1], 'e tag should be preserved');
+  });
+
+  test('selectCanonicalProofCarrier returns null for empty candidates', async () => {
+    const kind1 = await validKind1WithAllPQKeys();
+    const result = await m.selectCanonicalProofCarrier([], kind1);
+    assert.equal(result.canonical, null);
+  });
+
+  test('selectCanonicalProofCarrier rejects wrong e tag', async () => {
+    const kind1 = await validKind1WithAllPQKeys();
+    const carrier = await signedProofCarrier(kind1, new Uint8Array(100));
+    // Tamper the e tag
+    carrier.tags = carrier.tags.map(t => t[0] === 'e' ? ['e', '0'.repeat(64)] : t);
+    carrier.id = m.computeEventId(carrier);
+    carrier.sig = m.bytesToHex(schnorr.sign(m.hexToBytes(carrier.id), sk));
+    const result = await m.selectCanonicalProofCarrier([carrier], kind1);
+    assert.equal(result.canonical, null);
+    assert.ok(result.errors.some(e => e.includes('e tag')), 'should report e tag mismatch');
+  });
+
+  test('selectCanonicalProofCarrier rejects wrong sha256 tag', async () => {
+    const kind1 = await validKind1WithAllPQKeys();
+    const carrier = await signedProofCarrier(kind1, new Uint8Array(100));
+    // Tamper the sha256 tag
+    carrier.tags = carrier.tags.map(t => t[0] === 'sha256' ? ['sha256', '0'.repeat(64)] : t);
+    carrier.id = m.computeEventId(carrier);
+    carrier.sig = m.bytesToHex(schnorr.sign(m.hexToBytes(carrier.id), sk));
+    const result = await m.selectCanonicalProofCarrier([carrier], kind1);
+    assert.equal(result.canonical, null);
+    assert.ok(result.errors.some(e => e.includes('sha256')), 'should report sha256 mismatch');
+  });
+
+  test('selectCanonicalProofCarrier rejects wrong expected author', async () => {
+    const kind1 = await validKind1WithAllPQKeys();
+    const carrier = await signedProofCarrier(kind1, new Uint8Array(100));
+    const otherKey = '0'.repeat(64);
+    const result = await m.selectCanonicalProofCarrier([carrier], kind1, otherKey);
+    assert.equal(result.canonical, null);
+    assert.ok(result.errors.some(e => e.includes('expected author')), 'should report author mismatch');
+  });
+});
+
+// ============================================================================
+// G56-03: IDENTITY BINDING (outer.pubkey === embedded.pubkey === expectedAuthor)
+// ============================================================================
+
+describe('G56-03: identity binding (verifyNIPQRContent)', () => {
+  const skA = new Uint8Array(32);
+  skA[31] = 1;
+  const pkA = m.bytesToHex(schnorr.getPublicKey(skA));
+  const skB = new Uint8Array(32);
+  skB[31] = 2;
+  const pkB = m.bytesToHex(schnorr.getPublicKey(skB));
+
+  async function signedKind1(pubkey, sk, content, tags) {
+    const event = {
+      pubkey,
+      created_at: 1700000000,
+      kind: 1,
+      tags: tags || [],
+      content: content || 'test attestation'
+    };
+    event.id = m.computeEventId(event);
+    event.sig = m.bytesToHex(schnorr.sign(m.hexToBytes(event.id), sk));
+    return event;
+  }
+
+  test('G56-03: matching identities pass identity binding', async () => {
+    const kind1 = await signedKind1(pkA, skA, 'test', []);
+    const tags = [
+      ['e', kind1.id],
+      ['sha256', m.hashFullEvent(kind1)]
+    ];
+    const result = m.verifyNIPQRContent(JSON.stringify(kind1), tags, {
+      outerPubkey: pkA,
+      expectedAuthor: pkA
+    });
+    assert.equal(result.identityBound, true, 'matching identities should pass');
+  });
+
+  test('G56-03: mismatched outer/embedded identity fails', async () => {
+    // Kind 1 signed by A, but outer pubkey is B
+    const kind1 = await signedKind1(pkA, skA, 'test', []);
+    const tags = [
+      ['e', kind1.id],
+      ['sha256', m.hashFullEvent(kind1)]
+    ];
+    const result = m.verifyNIPQRContent(JSON.stringify(kind1), tags, {
+      outerPubkey: pkB
+    });
+    assert.equal(result.identityBound, false, 'mismatched outer/embedded should fail');
+    assert.equal(result.validForMigration, false, 'should not be valid for migration');
+  });
+
+  test('G56-03: mismatched expected author fails', async () => {
+    const kind1 = await signedKind1(pkA, skA, 'test', []);
+    const tags = [
+      ['e', kind1.id],
+      ['sha256', m.hashFullEvent(kind1)]
+    ];
+    const result = m.verifyNIPQRContent(JSON.stringify(kind1), tags, {
+      expectedAuthor: pkB
+    });
+    assert.equal(result.identityBound, false, 'mismatched expected author should fail');
+    assert.equal(result.validForMigration, false);
+  });
+
+  test('G56-03: no identity options → identityBound is true (backward compatible)', async () => {
+    const kind1 = await signedKind1(pkA, skA, 'test', []);
+    const tags = [
+      ['e', kind1.id],
+      ['sha256', m.hashFullEvent(kind1)]
+    ];
+    const result = m.verifyNIPQRContent(JSON.stringify(kind1), tags);
+    assert.equal(result.identityBound, true, 'without options, identity binding should pass');
+  });
+});

www/index.html

@@ -189,6 +189,7 @@
       background: transparent;
       display: inline-grid;
       place-content: center;
+      box-sizing: border-box;
     }
     .pq-checkbox-row input::before {
       content: "";
@@ -196,12 +197,14 @@
       transform: scale(0);
       transition: transform 0.1s ease-in-out;
       background: #d00;
+      border-radius: 1px;
     }
     .pq-checkbox-row input:checked::before {
       transform: scale(1);
     }
     .pq-checkbox-row input:checked {
       border-color: #d00;
+      background: #d00;
     }
 
     .pq-seed-toggle {
@@ -600,6 +603,7 @@
       derivePQKeysFromSeed,
       buildKind1Announcement,
       buildKind11112Wrapper,
+      buildProofCarrier,
       computeEventId,
       hashFullEvent,
       verifyNIPQRContent,
@@ -610,6 +614,7 @@
       PQ_KEY_INFO,
       NIP_QR_KIND,
       buildUpgradedEvent,
+      selectCanonicalProofCarrier,
       timestampEvent,
       upgradeOts,
       isOtsConfirmed,
@@ -746,24 +751,38 @@
           e.preventDefault();
           for (let i = 1; i <= 5; i++) setStepDone(i);
           setStepActive(6);
-          // Fetch the full kind 11112 event from relays so that pqEvent has
-          // the tags and content needed for buildUpgradedEvent() when the
-          // Bitcoin attestation is confirmed and we republish.
+          // G56-02: Fetch ALL proof carrier events from relays and select
+          // the canonical one (earliest valid Bitcoin anchor)
           if (!pqEvent.tags || !pqEvent.content) {
-            otsLog('Resuming OTS workflow: fetching full event from relays...');
+            otsLog('Resuming OTS workflow: fetching proof carrier events from relays...');
             const relayUrls = getRelayUrls();
-            let fetched = null;
+            let allCandidates = [];
             await Promise.all(relayUrls.map(async (url) => {
               try {
-                const ev = await queryRelayForKind11112(currentPubkey, url);
-                if (ev && (!fetched || ev.created_at > fetched.created_at)) fetched = ev;
+                const events = await queryRelayForProofCarriers(currentPubkey, url);
+                if (events && events.length > 0) allCandidates.push(...events);
               } catch (e) { /* ignore */ }
             }));
-            if (fetched) {
-              pqEvent = fetched;
-              otsLog(`Resuming OTS workflow: fetched event ${pqEvent.id.substring(0, 16)}... from relays.`);
+            // Deduplicate by event ID
+            const seenIds = new Set();
+            allCandidates = allCandidates.filter(e => {
+              if (!e || !e.id || seenIds.has(e.id)) return false;
+              seenIds.add(e.id);
+              return true;
+            });
+            if (allCandidates.length > 0) {
+              // Try to find the one matching our persisted event ID
+              const matching = allCandidates.find(e => e.id === pqEvent.id);
+              if (matching) {
+                pqEvent = matching;
+                otsLog(`Resuming OTS workflow: fetched event ${pqEvent.id.substring(0, 16)}... from relays (${allCandidates.length} total candidates).`);
+              } else {
+                // Use the first candidate as fallback
+                pqEvent = allCandidates[0];
+                otsLog(`Resuming OTS workflow: persisted event not found, using ${pqEvent.id.substring(0, 16)}... (${allCandidates.length} total candidates).`);
+              }
             } else {
-              otsLog('WARNING: Could not fetch the full event from relays. Republishing may fail.');
+              otsLog('WARNING: Could not fetch any proof carrier events from relays. Republishing may fail.');
             }
           }
           await startOtsFlow();
@@ -1102,31 +1121,31 @@
           otsLog(`WARNING: OTS submission failed: ${otsError.message}. Kind 11112 event will not have OTS proof yet.`);
         }
 
-        // ---- Phase 3: Build and sign the kind 11112 wrapper event ----
-        setStatus(pqSignStatus, 'info', ' Requesting secp256k1 signature for kind 11112 wrapper...');
+        // ---- Phase 3: Build and sign the proof carrier event (kind 9999) ----
+        setStatus(pqSignStatus, 'info', ' Requesting secp256k1 signature for proof carrier...');
 
-        let kind11112Template;
+        let proofCarrierTemplate;
         if (otsProof && otsProof.length > 0) {
-          kind11112Template = buildKind11112Wrapper(kind1Event, otsProof);
+          proofCarrierTemplate = buildProofCarrier(kind1Event, otsProof, { otsStatus: 'pending' });
         } else {
-          // No OTS proof — build wrapper without ots tag (will be added later)
-          kind11112Template = buildKind11112Wrapper(kind1Event, new Uint8Array(0));
+          // No OTS proof — build carrier without ots/ots_status tags (will be added later)
+          proofCarrierTemplate = buildProofCarrier(kind1Event, new Uint8Array(0), { otsStatus: 'pending' });
           // Remove the empty ots tag
-          kind11112Template.tags = kind11112Template.tags.filter(t => t[0] !== 'ots');
+          proofCarrierTemplate.tags = proofCarrierTemplate.tags.filter(t => t[0] !== 'ots');
         }
 
-        const kind11112Signed = await window.nostr.signEvent(kind11112Template);
+        const proofCarrierSigned = await window.nostr.signEvent(proofCarrierTemplate);
 
         pqEvent = {
-          id: kind11112Signed.id,
-          pubkey: kind11112Signed.pubkey,
-          created_at: kind11112Template.created_at,
+          id: proofCarrierSigned.id,
+          pubkey: proofCarrierSigned.pubkey,
+          created_at: proofCarrierTemplate.created_at,
           kind: NIP_QR_KIND,
-          content: kind11112Template.content,
-          tags: kind11112Template.tags,
-          sig: kind11112Signed.sig
+          content: proofCarrierTemplate.content,
+          tags: proofCarrierTemplate.tags,
+          sig: proofCarrierSigned.sig
         };
-        otsLog(`Kind 11112 wrapper signed. Event ID: ${pqEvent.id.substring(0, 32)}...`);
+        otsLog(`Proof carrier signed. Event ID: ${pqEvent.id.substring(0, 32)}...`);
 
         // Save the pending OTS proof for the OTS step
         if (otsProof && otsProof.length > 0) {
@@ -1187,27 +1206,29 @@
     }
 
     /* ================================================================
-       RELAY QUERY (fetch kind 11112 event for OTS resume)
+       RELAY QUERY (fetch ALL proof carrier events for OTS resume)
+       G56-02: fetch all candidates, not limit: 1
        ================================================================ */
-    function queryRelayForKind11112(pubkeyHex, relayUrl) {
+    function queryRelayForProofCarriers(pubkeyHex, relayUrl) {
       return new Promise((resolve, reject) => {
         try {
           const ws = new WebSocket(relayUrl);
           let resolved = false;
+          const events = [];
           const timeout = setTimeout(() => {
-            if (!resolved) { resolved = true; try { ws.close(); } catch (e) {} reject(new Error('timeout')); }
+            if (!resolved) { resolved = true; try { ws.close(); } catch (e) {} resolve(events); }
           }, 15000);
           ws.onopen = () => {
             const subId = 'pq_resume_' + Math.random().toString(36).substring(7);
-            ws.send(JSON.stringify(['REQ', subId, { kinds: [NIP_QR_KIND], authors: [pubkeyHex], limit: 1 }]));
+            ws.send(JSON.stringify(['REQ', subId, { kinds: [NIP_QR_KIND], authors: [pubkeyHex] }]));
           };
           ws.onmessage = (msg) => {
             try {
               const data = JSON.parse(msg.data);
               if (data[0] === 'EVENT') {
-                if (!resolved) { resolved = true; clearTimeout(timeout); try { ws.close(); } catch (e) {} resolve(data[2]); }
+                if (data[2]) events.push(data[2]);
               } else if (data[0] === 'EOSE') {
-                if (!resolved) { resolved = true; clearTimeout(timeout); try { ws.close(); } catch (e) {} resolve(null); }
+                if (!resolved) { resolved = true; clearTimeout(timeout); try { ws.close(); } catch (e) {} resolve(events); }
               }
             } catch (e) {}
           };

www/js/pq-crypto.mjs

@@ -423,11 +423,14 @@ export function verifyNostrEvent(event) {
 // ============================================================================
 
 /**
- * NIP-QR event kind. Kind 11112 is a replaceable event (10000-19999 range),
- * so each pubkey can have only one event of this kind. No `d` tag needed.
- * Publishing a new kind 11112 event automatically replaces the old one on relays.
+ * NIP-QR proof carrier event kind. Kind 9999 is a non-replaceable event
+ * (0–9999 range). Each publication is permanent — relays cannot replace it.
+ * Upgrades (e.g. pending → confirmed OTS proof) publish a NEW kind 9999 event
+ * with an `upgrade_of` tag referencing the previous one. Clients fetch all
+ * kind 9999 events for a pubkey and select the one with the earliest valid
+ * Bitcoin anchor.
  */
-export const NIP_QR_KIND = 11112;
+export const NIP_QR_KIND = 9999;
 
 /**
  * Build the kind 1 announcement event (unsigned template).
@@ -533,74 +536,122 @@ export function hashFullEvent(signedEvent) {
 }
 
 /**
- * Build the kind 11112 wrapper event (unsigned template).
+ * Build the kind 9999 proof carrier event (unsigned template).
  *
  * This event wraps the kind 1 announcement and carries the OpenTimestamps proof.
  * The content is the full kind 1 event as JSON (so verifiers don't need to fetch
  * it from relays). The tags reference the kind 1 event ID and contain the OTS proof.
  *
+ * Kind 9999 is non-replaceable. Each publication is permanent. Upgrades publish
+ * a new event with `upgrade_of` referencing the previous one.
+ *
  * Tags:
  *   - ['e', '<kind1_event_id>'] — reference to the kind 1 announcement
  *   - ['sha256', '<hex hash of full kind 1 event JSON>'] — what was timestamped
  *   - ['ots', '<base64 .ots proof>'] — the OpenTimestamps proof
+ *   - ['ots_status', 'pending'|'confirmed'] — quick UI indicator
+ *   - ['upgrade_of', '<previous_proof_carrier_event_id>'] — only on upgrade events
  *
  * @param {object} kind1Event - The fully signed kind 1 event
  * @param {Uint8Array} otsProof - The OTS proof bytes (pending or confirmed)
+ * @param {object} [options] - Optional parameters
+ * @param {string} [options.otsStatus='pending'] - 'pending' or 'confirmed'
+ * @param {string} [options.upgradeOf] - Previous proof carrier event ID (for upgrades)
  * @returns {{kind: number, content: string, tags: Array, pubkey: string, created_at: number}}
  */
-export function buildKind11112Wrapper(kind1Event, otsProof) {
+export function buildProofCarrier(kind1Event, otsProof, options = {}) {
     const fullHash = hashFullEvent(kind1Event);
+    const otsStatus = options.otsStatus || 'pending';
+
+    const tags = [
+        ['e', kind1Event.id],
+        ['sha256', fullHash],
+        ['ots', bytesToBase64(otsProof)],
+        ['ots_status', otsStatus]
+    ];
+
+    if (options.upgradeOf) {
+        tags.push(['upgrade_of', options.upgradeOf]);
+    }
 
     return {
         kind: NIP_QR_KIND,
         content: JSON.stringify(kind1Event),
-        tags: [
-            ['e', kind1Event.id],
-            ['sha256', fullHash],
-            ['ots', bytesToBase64(otsProof)]
-        ],
+        tags,
         pubkey: kind1Event.pubkey,
         created_at: Math.floor(Date.now() / 1000)
     };
 }
 
 /**
- * Build an upgraded kind 11112 event from an existing one.
- * Copies all tags and content from the original event, replaces the OTS proof tag
- * with the upgraded proof, and updates the timestamp. The content (the kind 1
- * event JSON) and the 'e' and 'sha256' tags stay the same — only the 'ots' tag
- * changes.
+ * Backward-compatible alias for buildProofCarrier.
+ * @deprecated Use buildProofCarrier() instead.
+ */
+export function buildKind11112Wrapper(kind1Event, otsProof) {
+    return buildProofCarrier(kind1Event, otsProof);
+}
+
+/**
+ * Build an upgraded proof carrier event (append-only, non-replacing).
  *
- * @param {object} originalEvent - The original kind 11112 event
+ * Instead of replacing the original event, this builds a NEW kind 9999 event
+ * with the upgraded OTS proof. The new event references the original via the
+ * `upgrade_of` tag. Both events remain on relays permanently.
+ *
+ * The `e` and `sha256` tags stay the same — they reference the same kind 1
+ * announcement. Only the `ots` proof and `ots_status` change.
+ *
+ * @param {object} originalEvent - The original proof carrier event (pending)
  * @param {Uint8Array} upgradedOtsProof - The upgraded/confirmed OTS proof bytes
  * @returns {{kind: number, created_at: number, tags: Array, content: string, pubkey: string}}
  */
 export function buildUpgradedEvent(originalEvent, upgradedOtsProof) {
-    // Copy all tags except 'ots', then add the upgraded 'ots' tag
-    const tags = originalEvent.tags.filter(tag => tag[0] !== 'ots');
-    tags.push(['ots', bytesToBase64(upgradedOtsProof)]);
+    // Extract the kind 1 event from the original content to rebuild tags cleanly
+    let kind1Event;
+    try {
+        kind1Event = JSON.parse(originalEvent.content);
+    } catch (e) {
+        // If we can't parse, fall back to copying tags (shouldn't happen in practice)
+        const tags = originalEvent.tags
+            .filter(t => t[0] !== 'ots' && t[0] !== 'ots_status' && t[0] !== 'upgrade_of')
+            .map(t => [...t]);
+        tags.push(['ots', bytesToBase64(upgradedOtsProof)]);
+        tags.push(['ots_status', 'confirmed']);
+        tags.push(['upgrade_of', originalEvent.id]);
+        return {
+            kind: NIP_QR_KIND,
+            created_at: Math.floor(Date.now() / 1000),
+            tags,
+            content: originalEvent.content,
+            pubkey: originalEvent.pubkey
+        };
+    }
 
-    return {
-        kind: NIP_QR_KIND,
-        created_at: Math.floor(Date.now() / 1000),
-        tags: tags,
-        content: originalEvent.content,
-        pubkey: originalEvent.pubkey
-    };
+    // Build a clean new proof carrier with the upgraded proof
+    return buildProofCarrier(kind1Event, upgradedOtsProof, {
+        otsStatus: 'confirmed',
+        upgradeOf: originalEvent.id
+    });
 }
 
 /**
- * Verify a NIP-QR kind 11112 event.
+ * Verify a NIP-QR proof carrier event's content and tags.
  *
- * The kind 11112 content is the full kind 1 event as JSON. This function:
+ * The proof carrier content is the full kind 1 event as JSON. This function:
  *   1. Parses the kind 1 event from the content
  *   2. Verifies the kind 1 secp256k1 signature
  *   3. Verifies the 'e' tag matches the kind 1 event ID
  *   4. Verifies the 'sha256' tag matches SHA-256 of the full kind 1 event JSON
  *   5. Verifies each PQ signature in the kind 1 tags against the content text
+ *   6. (G56-03) If expectedAuthor is provided, verifies identity binding:
+ *      the proof carrier pubkey, embedded kind 1 pubkey, and expected author
+ *      must all be equal.
  *
- * @param {string} kind11112Content - The kind 11112 content (JSON string of kind 1 event)
- * @param {Array} kind11112Tags - The kind 11112 tags array
+ * @param {string} kind11112Content - The proof carrier content (JSON string of kind 1 event)
+ * @param {Array} kind11112Tags - The proof carrier tags array
+ * @param {object} [options] - Optional parameters
+ * @param {string} [options.expectedAuthor] - Expected author pubkey (hex) for G56-03 identity binding
+ * @param {string} [options.outerPubkey] - The proof carrier event's pubkey (for G56-03 identity binding)
  * @returns {{
  *   valid: boolean,
  *   results: Array,
@@ -611,17 +662,20 @@ export function buildUpgradedEvent(originalEvent, upgradedOtsProof) {
  *   pqProofsValid: boolean,
  *   policySufficient: boolean,
  *   validForMigration: boolean,
+ *   identityBound: boolean,
  *   errors: Array
  * }}
  *
  * `valid` is retained for backward compatibility and means "every individual
  * check that ran passed". `validForMigration` is the strict policy-gated
  * result: it is true only when the secp signature, e tag, sha256 tag, all
- * present PQ proofs, AND the mandatory algorithm policy are all satisfied.
+ * present PQ proofs, the mandatory algorithm policy, AND identity binding
+ * are all satisfied.
  */
-export function verifyNIPQRContent(kind11112Content, kind11112Tags) {
+export function verifyNIPQRContent(kind11112Content, kind11112Tags, options = {}) {
     const results = [];
     const errors = [];
+    const { expectedAuthor, outerPubkey } = options;
 
     // --- Helper: push a result entry and track failures ---
     function pushResult(algorithm, valid, note) {
@@ -652,6 +706,7 @@ export function verifyNIPQRContent(kind11112Content, kind11112Tags) {
             pqProofsValid: false,
             policySufficient: false,
             validForMigration: false,
+            identityBound: false,
             errors: ['Content is not valid JSON']
         };
     }
@@ -669,6 +724,7 @@ export function verifyNIPQRContent(kind11112Content, kind11112Tags) {
             pqProofsValid: false,
             policySufficient: false,
             validForMigration: false,
+            identityBound: false,
             errors: ['Embedded event is not a valid kind 1 event']
         };
     }
@@ -683,6 +739,31 @@ export function verifyNIPQRContent(kind11112Content, kind11112Tags) {
     }
     pushResult('secp256k1 (kind 1 announcement)', kind1SigValid, kind1SigValid ? 'valid' : 'INVALID');
 
+    // 2b. G56-03: Identity binding check
+    //
+    // The proof carrier pubkey, the embedded kind 1 pubkey, and (if
+    // provided) the expected author must all be equal. Without this,
+    // identity A can wrap identity B's announcement and the verifier
+    // would say "valid" for both.
+    let identityBound = true;
+    const embeddedPubkey = kind1Event.pubkey.toLowerCase();
+
+    if (outerPubkey && outerPubkey.toLowerCase() !== embeddedPubkey) {
+        identityBound = false;
+        errors.push(`identity binding: outer pubkey ${outerPubkey.substring(0, 16)}... does not match embedded pubkey ${embeddedPubkey.substring(0, 16)}...`);
+    }
+
+    if (expectedAuthor && expectedAuthor.toLowerCase() !== embeddedPubkey) {
+        identityBound = false;
+        errors.push(`identity binding: expected author ${expectedAuthor.substring(0, 16)}... does not match embedded pubkey ${embeddedPubkey.substring(0, 16)}...`);
+    }
+
+    pushResult(
+        'identity binding (outer = embedded = author)',
+        identityBound,
+        identityBound ? 'all identities match' : 'identity mismatch'
+    );
+
     // 3. Verify the 'e' tag matches the kind 1 event ID
     const computedKind1Id = computeEventId(kind1Event);
     const eTags = (Array.isArray(kind11112Tags) ? kind11112Tags : []).filter(t => Array.isArray(t) && t[0] === 'e');
@@ -879,7 +960,7 @@ export function verifyNIPQRContent(kind11112Content, kind11112Tags) {
 
     // 7. Compute final results
     const allChecksPassed = results.every(r => r.valid);
-    const validForMigration = kind1SigValid && eTagValid && sha256Valid && pqProofsValid && policySufficient;
+    const validForMigration = kind1SigValid && eTagValid && sha256Valid && pqProofsValid && policySufficient && identityBound;
 
     return {
         valid: allChecksPassed,
@@ -891,6 +972,189 @@ export function verifyNIPQRContent(kind11112Content, kind11112Tags) {
         pqProofsValid,
         policySufficient,
         validForMigration,
+        identityBound,
+        errors
+    };
+}
+
+// ============================================================================
+// CANONICAL PROOF CARRIER SELECTION (G56-02)
+// ============================================================================
+//
+// When multiple proof carrier events exist for the same pubkey (e.g. a
+// pending one and a later confirmed one, or multiple migration attempts),
+// the client must select the one with the earliest valid Bitcoin anchor.
+// This implements the "earliest valid anchor wins" rule from the NIP proposal.
+
+/**
+ * Select the canonical proof carrier from an array of candidates.
+ *
+ * This function:
+ *   1. Filters candidates whose `e` tag matches the kind 1 event ID
+ *   2. Filters candidates whose `sha256` tag matches the kind 1 event hash
+ *   3. Filters candidates with a valid secp256k1 signature
+ *   4. For each remaining candidate, verifies its OTS proof against the
+ *      expected digest (the sha256 tag)
+ *   5. Among candidates with a verified Bitcoin attestation, selects the
+ *      one with the earliest block height (deterministic tie-break by
+ *      event ID lexicographically)
+ *   6. If no candidate has a confirmed Bitcoin anchor, returns the best
+ *      pending candidate
+ *
+ * @param {Array} candidates - Array of proof carrier events (kind 9999)
+ * @param {object} kind1Event - The kind 1 announcement event they reference
+ * @param {string} [expectedAuthor] - Expected author pubkey (hex) for identity binding
+ * @returns {Promise<{canonical: object|null, allCandidates: Array, confirmedCandidates: Array, pendingCandidates: Array, errors: Array}>}
+ */
+export async function selectCanonicalProofCarrier(candidates, kind1Event, expectedAuthor) {
+    const errors = [];
+    if (!Array.isArray(candidates) || candidates.length === 0) {
+        return { canonical: null, allCandidates: [], confirmedCandidates: [], pendingCandidates: [], errors: ['No candidates provided'] };
+    }
+    if (!kind1Event || !kind1Event.id) {
+        return { canonical: null, allCandidates: candidates, confirmedCandidates: [], pendingCandidates: [], errors: ['No kind 1 event provided'] };
+    }
+
+    const expectedKind1Id = kind1Event.id.toLowerCase();
+    const expectedHash = hashFullEvent(kind1Event).toLowerCase();
+
+    // Step 1-3: Filter candidates by e tag, sha256 tag, and secp signature
+    const validCandidates = [];
+    for (const candidate of candidates) {
+        if (!candidate || typeof candidate !== 'object') continue;
+        if (candidate.kind !== NIP_QR_KIND) {
+            errors.push(`candidate ${candidate.id || '?'}: wrong kind ${candidate.kind}`);
+            continue;
+        }
+
+        // Check e tag matches kind 1 event ID
+        const eTag = (candidate.tags || []).find(t => Array.isArray(t) && t[0] === 'e');
+        if (!eTag || !eTag[1] || eTag[1].toLowerCase() !== expectedKind1Id) {
+            errors.push(`candidate ${candidate.id || '?'}: e tag does not match kind 1 event ID`);
+            continue;
+        }
+
+        // Check sha256 tag matches kind 1 event hash
+        const sha256Tag = (candidate.tags || []).find(t => Array.isArray(t) && t[0] === 'sha256');
+        if (!sha256Tag || !sha256Tag[1] || sha256Tag[1].toLowerCase() !== expectedHash) {
+            errors.push(`candidate ${candidate.id || '?'}: sha256 tag does not match kind 1 event hash`);
+            continue;
+        }
+
+        // Check secp signature
+        let secpValid = false;
+        try {
+            secpValid = verifyNostrEvent(candidate);
+        } catch (e) {
+            secpValid = false;
+        }
+        if (!secpValid) {
+            errors.push(`candidate ${candidate.id || '?'}: invalid secp256k1 signature`);
+            continue;
+        }
+
+        // G56-03: Check identity binding if expectedAuthor is provided
+        if (expectedAuthor && candidate.pubkey && candidate.pubkey.toLowerCase() !== expectedAuthor.toLowerCase()) {
+            errors.push(`candidate ${candidate.id || '?'}: pubkey does not match expected author`);
+            continue;
+        }
+
+        validCandidates.push(candidate);
+    }
+
+    if (validCandidates.length === 0) {
+        return { canonical: null, allCandidates: candidates, confirmedCandidates: [], pendingCandidates: [], errors };
+    }
+
+    // Step 4: Verify OTS proof for each valid candidate
+    const confirmedCandidates = [];
+    const pendingCandidates = [];
+
+    for (const candidate of validCandidates) {
+        const otsTag = (candidate.tags || []).find(t => Array.isArray(t) && t[0] === 'ots');
+        if (!otsTag || !otsTag[1]) {
+            pendingCandidates.push({ event: candidate, bitcoinHeight: null, errors: ['no ots tag'] });
+            continue;
+        }
+
+        let otsBytes;
+        try {
+            otsBytes = base64ToBytes(otsTag[1]);
+        } catch (e) {
+            pendingCandidates.push({ event: candidate, bitcoinHeight: null, errors: [`ots decode failed: ${e.message}`] });
+            continue;
+        }
+
+        try {
+            const verifyResult = await verifyOtsProof(otsBytes, expectedHash);
+            if (verifyResult.verified && verifyResult.bitcoinAttestations.length > 0) {
+                confirmedCandidates.push({
+                    event: candidate,
+                    bitcoinHeight: verifyResult.bitcoinAttestations[0].height,
+                    bitcoinTime: verifyResult.bitcoinAttestations[0].time,
+                    errors: []
+                });
+            } else {
+                pendingCandidates.push({
+                    event: candidate,
+                    bitcoinHeight: null,
+                    errors: verifyResult.errors
+                });
+            }
+        } catch (e) {
+            pendingCandidates.push({ event: candidate, bitcoinHeight: null, errors: [`ots verification threw: ${e.message}`] });
+        }
+    }
+
+    // Step 5: Among confirmed candidates, select earliest Bitcoin block height
+    if (confirmedCandidates.length > 0) {
+        confirmedCandidates.sort((a, b) => {
+            // Primary sort: lowest Bitcoin block height
+            if (a.bitcoinHeight !== b.bitcoinHeight) {
+                return a.bitcoinHeight - b.bitcoinHeight;
+            }
+            // Tie-break: lowest event ID lexicographically (deterministic)
+            return (a.event.id || '').localeCompare(b.event.id || '');
+        });
+
+        return {
+            canonical: confirmedCandidates[0].event,
+            canonicalBitcoinHeight: confirmedCandidates[0].bitcoinHeight,
+            canonicalBitcoinTime: confirmedCandidates[0].bitcoinTime,
+            allCandidates: candidates,
+            confirmedCandidates,
+            pendingCandidates,
+            errors
+        };
+    }
+
+    // Step 6: No confirmed candidates — return the best pending one
+    // (earliest created_at, tie-break by event ID)
+    if (pendingCandidates.length > 0) {
+        pendingCandidates.sort((a, b) => {
+            if (a.event.created_at !== b.event.created_at) {
+                return a.event.created_at - b.event.created_at;
+            }
+            return (a.event.id || '').localeCompare(b.event.id || '');
+        });
+        return {
+            canonical: pendingCandidates[0].event,
+            canonicalBitcoinHeight: null,
+            canonicalBitcoinTime: null,
+            allCandidates: candidates,
+            confirmedCandidates: [],
+            pendingCandidates,
+            errors
+        };
+    }
+
+    return {
+        canonical: null,
+        canonicalBitcoinHeight: null,
+        canonicalBitcoinTime: null,
+        allCandidates: candidates,
+        confirmedCandidates: [],
+        pendingCandidates: [],
         errors
     };
 }

www/js/version.json

@@ -1,5 +1,5 @@
 {
-  "VERSION": "v0.0.12",
-  "VERSION_NUMBER": "0.0.12",
-  "BUILD_DATE": "2026-07-23T17:34:38.425Z"
+  "VERSION": "v0.0.15",
+  "VERSION_NUMBER": "0.0.15",
+  "BUILD_DATE": "2026-07-24T11:17:37.498Z"
 }

www/pq-crypto.bundle.js

@@ -9771,7 +9771,7 @@ function verifyNostrEvent(event) {
   const pubkey = hexToBytes3(event.pubkey);
   return schnorr.verify(sig, hash, pubkey);
 }
-var NIP_QR_KIND = 11112;
+var NIP_QR_KIND = 9999;
 function buildKind1Announcement(hexPubkey, blockHeight, pqKeys) {
   const npub = hexToNpub(hexPubkey);
   const content = `I am signaling that the post-quantum public keys listed in the tags of this event were generated by me and I hold the private keys. I may use these keys in the future as successors to my current Nostr identity.
@@ -9830,34 +9830,55 @@ function hashFullEvent(signedEvent) {
   const json = JSON.stringify(signedEvent);
   return bytesToHex3(sha256(new TextEncoder().encode(json)));
 }
-function buildKind11112Wrapper(kind1Event, otsProof) {
+function buildProofCarrier(kind1Event, otsProof, options = {}) {
   const fullHash = hashFullEvent(kind1Event);
+  const otsStatus = options.otsStatus || "pending";
+  const tags = [
+    ["e", kind1Event.id],
+    ["sha256", fullHash],
+    ["ots", bytesToBase64(otsProof)],
+    ["ots_status", otsStatus]
+  ];
+  if (options.upgradeOf) {
+    tags.push(["upgrade_of", options.upgradeOf]);
+  }
   return {
     kind: NIP_QR_KIND,
     content: JSON.stringify(kind1Event),
-    tags: [
-      ["e", kind1Event.id],
-      ["sha256", fullHash],
-      ["ots", bytesToBase64(otsProof)]
-    ],
+    tags,
     pubkey: kind1Event.pubkey,
     created_at: Math.floor(Date.now() / 1e3)
   };
 }
-function buildUpgradedEvent(originalEvent, upgradedOtsProof) {
-  const tags = originalEvent.tags.filter((tag) => tag[0] !== "ots");
-  tags.push(["ots", bytesToBase64(upgradedOtsProof)]);
-  return {
-    kind: NIP_QR_KIND,
-    created_at: Math.floor(Date.now() / 1e3),
-    tags,
-    content: originalEvent.content,
-    pubkey: originalEvent.pubkey
-  };
+function buildKind11112Wrapper(kind1Event, otsProof) {
+  return buildProofCarrier(kind1Event, otsProof);
 }
-function verifyNIPQRContent(kind11112Content, kind11112Tags) {
+function buildUpgradedEvent(originalEvent, upgradedOtsProof) {
+  let kind1Event;
+  try {
+    kind1Event = JSON.parse(originalEvent.content);
+  } catch (e) {
+    const tags = originalEvent.tags.filter((t) => t[0] !== "ots" && t[0] !== "ots_status" && t[0] !== "upgrade_of").map((t) => [...t]);
+    tags.push(["ots", bytesToBase64(upgradedOtsProof)]);
+    tags.push(["ots_status", "confirmed"]);
+    tags.push(["upgrade_of", originalEvent.id]);
+    return {
+      kind: NIP_QR_KIND,
+      created_at: Math.floor(Date.now() / 1e3),
+      tags,
+      content: originalEvent.content,
+      pubkey: originalEvent.pubkey
+    };
+  }
+  return buildProofCarrier(kind1Event, upgradedOtsProof, {
+    otsStatus: "confirmed",
+    upgradeOf: originalEvent.id
+  });
+}
+function verifyNIPQRContent(kind11112Content, kind11112Tags, options = {}) {
   const results = [];
   const errors = [];
+  const { expectedAuthor, outerPubkey } = options;
   function pushResult(algorithm, valid, note) {
     results.push({ algorithm, valid, note });
     if (!valid) errors.push(`${algorithm}: ${note || "INVALID"}`);
@@ -9882,6 +9903,7 @@ function verifyNIPQRContent(kind11112Content, kind11112Tags) {
       pqProofsValid: false,
       policySufficient: false,
       validForMigration: false,
+      identityBound: false,
       errors: ["Content is not valid JSON"]
     };
   }
@@ -9896,6 +9918,7 @@ function verifyNIPQRContent(kind11112Content, kind11112Tags) {
       pqProofsValid: false,
       policySufficient: false,
       validForMigration: false,
+      identityBound: false,
       errors: ["Embedded event is not a valid kind 1 event"]
     };
   }
@@ -9907,6 +9930,21 @@ function verifyNIPQRContent(kind11112Content, kind11112Tags) {
     errors.push(`secp256k1 (kind 1): ${e.message}`);
   }
   pushResult("secp256k1 (kind 1 announcement)", kind1SigValid, kind1SigValid ? "valid" : "INVALID");
+  let identityBound = true;
+  const embeddedPubkey = kind1Event.pubkey.toLowerCase();
+  if (outerPubkey && outerPubkey.toLowerCase() !== embeddedPubkey) {
+    identityBound = false;
+    errors.push(`identity binding: outer pubkey ${outerPubkey.substring(0, 16)}... does not match embedded pubkey ${embeddedPubkey.substring(0, 16)}...`);
+  }
+  if (expectedAuthor && expectedAuthor.toLowerCase() !== embeddedPubkey) {
+    identityBound = false;
+    errors.push(`identity binding: expected author ${expectedAuthor.substring(0, 16)}... does not match embedded pubkey ${embeddedPubkey.substring(0, 16)}...`);
+  }
+  pushResult(
+    "identity binding (outer = embedded = author)",
+    identityBound,
+    identityBound ? "all identities match" : "identity mismatch"
+  );
   const computedKind1Id = computeEventId(kind1Event);
   const eTags = (Array.isArray(kind11112Tags) ? kind11112Tags : []).filter((t) => Array.isArray(t) && t[0] === "e");
   let eTagValid = false;
@@ -10056,7 +10094,7 @@ function verifyNIPQRContent(kind11112Content, kind11112Tags) {
     for (const e of policyErrors) errors.push(e);
   }
   const allChecksPassed = results.every((r) => r.valid);
-  const validForMigration = kind1SigValid && eTagValid && sha256Valid && pqProofsValid && policySufficient;
+  const validForMigration = kind1SigValid && eTagValid && sha256Valid && pqProofsValid && policySufficient && identityBound;
   return {
     valid: allChecksPassed,
     results,
@@ -10067,6 +10105,132 @@ function verifyNIPQRContent(kind11112Content, kind11112Tags) {
     pqProofsValid,
     policySufficient,
     validForMigration,
+    identityBound,
+    errors
+  };
+}
+async function selectCanonicalProofCarrier(candidates, kind1Event, expectedAuthor) {
+  const errors = [];
+  if (!Array.isArray(candidates) || candidates.length === 0) {
+    return { canonical: null, allCandidates: [], confirmedCandidates: [], pendingCandidates: [], errors: ["No candidates provided"] };
+  }
+  if (!kind1Event || !kind1Event.id) {
+    return { canonical: null, allCandidates: candidates, confirmedCandidates: [], pendingCandidates: [], errors: ["No kind 1 event provided"] };
+  }
+  const expectedKind1Id = kind1Event.id.toLowerCase();
+  const expectedHash = hashFullEvent(kind1Event).toLowerCase();
+  const validCandidates = [];
+  for (const candidate of candidates) {
+    if (!candidate || typeof candidate !== "object") continue;
+    if (candidate.kind !== NIP_QR_KIND) {
+      errors.push(`candidate ${candidate.id || "?"}: wrong kind ${candidate.kind}`);
+      continue;
+    }
+    const eTag = (candidate.tags || []).find((t) => Array.isArray(t) && t[0] === "e");
+    if (!eTag || !eTag[1] || eTag[1].toLowerCase() !== expectedKind1Id) {
+      errors.push(`candidate ${candidate.id || "?"}: e tag does not match kind 1 event ID`);
+      continue;
+    }
+    const sha256Tag = (candidate.tags || []).find((t) => Array.isArray(t) && t[0] === "sha256");
+    if (!sha256Tag || !sha256Tag[1] || sha256Tag[1].toLowerCase() !== expectedHash) {
+      errors.push(`candidate ${candidate.id || "?"}: sha256 tag does not match kind 1 event hash`);
+      continue;
+    }
+    let secpValid = false;
+    try {
+      secpValid = verifyNostrEvent(candidate);
+    } catch (e) {
+      secpValid = false;
+    }
+    if (!secpValid) {
+      errors.push(`candidate ${candidate.id || "?"}: invalid secp256k1 signature`);
+      continue;
+    }
+    if (expectedAuthor && candidate.pubkey && candidate.pubkey.toLowerCase() !== expectedAuthor.toLowerCase()) {
+      errors.push(`candidate ${candidate.id || "?"}: pubkey does not match expected author`);
+      continue;
+    }
+    validCandidates.push(candidate);
+  }
+  if (validCandidates.length === 0) {
+    return { canonical: null, allCandidates: candidates, confirmedCandidates: [], pendingCandidates: [], errors };
+  }
+  const confirmedCandidates = [];
+  const pendingCandidates = [];
+  for (const candidate of validCandidates) {
+    const otsTag = (candidate.tags || []).find((t) => Array.isArray(t) && t[0] === "ots");
+    if (!otsTag || !otsTag[1]) {
+      pendingCandidates.push({ event: candidate, bitcoinHeight: null, errors: ["no ots tag"] });
+      continue;
+    }
+    let otsBytes;
+    try {
+      otsBytes = base64ToBytes(otsTag[1]);
+    } catch (e) {
+      pendingCandidates.push({ event: candidate, bitcoinHeight: null, errors: [`ots decode failed: ${e.message}`] });
+      continue;
+    }
+    try {
+      const verifyResult = await verifyOtsProof(otsBytes, expectedHash);
+      if (verifyResult.verified && verifyResult.bitcoinAttestations.length > 0) {
+        confirmedCandidates.push({
+          event: candidate,
+          bitcoinHeight: verifyResult.bitcoinAttestations[0].height,
+          bitcoinTime: verifyResult.bitcoinAttestations[0].time,
+          errors: []
+        });
+      } else {
+        pendingCandidates.push({
+          event: candidate,
+          bitcoinHeight: null,
+          errors: verifyResult.errors
+        });
+      }
+    } catch (e) {
+      pendingCandidates.push({ event: candidate, bitcoinHeight: null, errors: [`ots verification threw: ${e.message}`] });
+    }
+  }
+  if (confirmedCandidates.length > 0) {
+    confirmedCandidates.sort((a, b) => {
+      if (a.bitcoinHeight !== b.bitcoinHeight) {
+        return a.bitcoinHeight - b.bitcoinHeight;
+      }
+      return (a.event.id || "").localeCompare(b.event.id || "");
+    });
+    return {
+      canonical: confirmedCandidates[0].event,
+      canonicalBitcoinHeight: confirmedCandidates[0].bitcoinHeight,
+      canonicalBitcoinTime: confirmedCandidates[0].bitcoinTime,
+      allCandidates: candidates,
+      confirmedCandidates,
+      pendingCandidates,
+      errors
+    };
+  }
+  if (pendingCandidates.length > 0) {
+    pendingCandidates.sort((a, b) => {
+      if (a.event.created_at !== b.event.created_at) {
+        return a.event.created_at - b.event.created_at;
+      }
+      return (a.event.id || "").localeCompare(b.event.id || "");
+    });
+    return {
+      canonical: pendingCandidates[0].event,
+      canonicalBitcoinHeight: null,
+      canonicalBitcoinTime: null,
+      allCandidates: candidates,
+      confirmedCandidates: [],
+      pendingCandidates,
+      errors
+    };
+  }
+  return {
+    canonical: null,
+    canonicalBitcoinHeight: null,
+    canonicalBitcoinTime: null,
+    allCandidates: candidates,
+    confirmedCandidates: [],
+    pendingCandidates: [],
     errors
   };
 }
@@ -10493,6 +10657,7 @@ export {
   base64ToBytes,
   buildKind11112Wrapper,
   buildKind1Announcement,
+  buildProofCarrier,
   buildUpgradedEvent,
   bytesToBase64,
   bytesToHex3 as bytesToHex,
@@ -10512,6 +10677,7 @@ export {
   mnemonicToSeed,
   parseOtsFile,
   savePendingOts,
+  selectCanonicalProofCarrier,
   signWithFalcon,
   signWithMLDSA44,
   signWithMLDSA65,

www/verify.html

@@ -369,6 +369,8 @@
       verifyNostrEvent,
       NIP_QR_KIND,
       buildUpgradedEvent,
+      buildProofCarrier,
+      selectCanonicalProofCarrier,
       bytesToBase64,
       base64ToBytes,
       hexToBytes,
@@ -415,6 +417,7 @@
 
     let currentEvent = null;
     let currentOtsBytes = null;
+    let currentExpectedAuthor = null;
 
     // F-H3: Build status DOM safely — type is internally controlled, message uses textContent
     function setStatus(element, type, message) {
@@ -469,60 +472,56 @@
     }
 
     /* ================================================================
-       QUERY RELAY FOR KIND 11112 EVENT
+       QUERY RELAY FOR PROOF CARRIER EVENTS (fetch ALL candidates)
        ================================================================ */
-    function queryRelayForEvent(pubkeyHex, relayUrl) {
-      return new Promise((resolve, reject) => {
-        try {
-          const ws = new WebSocket(relayUrl);
-          let resolved = false;
-          const timeout = setTimeout(() => {
-            if (!resolved) {
-              resolved = true;
-              try { ws.close(); } catch (e) {}
-              reject(new Error('timeout'));
-            }
-          }, 15000);
+     function queryRelayForEvents(pubkeyHex, relayUrl) {
+       return new Promise((resolve, reject) => {
+         try {
+           const ws = new WebSocket(relayUrl);
+           let resolved = false;
+           const events = [];
+           const timeout = setTimeout(() => {
+             if (!resolved) {
+               resolved = true;
+               try { ws.close(); } catch (e) {}
+               resolve(events);
+             }
+           }, 15000);
 
-          ws.onopen = () => {
-            // REQ for kind 11112, limit 1 (latest)
-            const subId = 'pq_verify_' + Math.random().toString(36).substring(7);
-            ws.send(JSON.stringify(['REQ', subId, { kinds: [NIP_QR_KIND], authors: [pubkeyHex], limit: 1 }]));
-          };
+           ws.onopen = () => {
+             // REQ for all proof carrier events — no limit (G56-02 fix)
+             const subId = 'pq_verify_' + Math.random().toString(36).substring(7);
+             ws.send(JSON.stringify(['REQ', subId, { kinds: [NIP_QR_KIND], authors: [pubkeyHex] }]));
+           };
 
-          ws.onmessage = (msg) => {
-            try {
-              const data = JSON.parse(msg.data);
-              if (data[0] === 'EVENT') {
-                if (!resolved) {
-                  resolved = true;
-                  clearTimeout(timeout);
-                  try { ws.close(); } catch (e) {}
-                  resolve(data[2]);
-                }
-              } else if (data[0] === 'EOSE') {
-                if (!resolved) {
-                  resolved = true;
-                  clearTimeout(timeout);
-                  try { ws.close(); } catch (e) {}
-                  resolve(null);
-                }
-              }
-            } catch (e) {}
-          };
+           ws.onmessage = (msg) => {
+             try {
+               const data = JSON.parse(msg.data);
+               if (data[0] === 'EVENT') {
+                 if (data[2]) events.push(data[2]);
+               } else if (data[0] === 'EOSE') {
+                 if (!resolved) {
+                   resolved = true;
+                   clearTimeout(timeout);
+                   try { ws.close(); } catch (e) {}
+                   resolve(events);
+                 }
+               }
+             } catch (e) {}
+           };
 
-          ws.onerror = () => {
-            if (!resolved) {
-              resolved = true;
-              clearTimeout(timeout);
-              reject(new Error('connection error'));
-            }
-          };
-        } catch (e) {
-          reject(e);
-        }
-      });
-    }
+           ws.onerror = () => {
+             if (!resolved) {
+               resolved = true;
+               clearTimeout(timeout);
+               reject(new Error('connection error'));
+             }
+           };
+         } catch (e) {
+           reject(e);
+         }
+       });
+     }
 
     /* ================================================================
        VERIFY EVENT (shared by both tabs)
@@ -535,31 +534,35 @@
       otsUpgradeWrap.style.display = 'none';
       otsBadge.innerHTML = '';
 
-      // Display full kind 11112 JSON
+      // Display full proof carrier JSON
       eventJsonEl.textContent = JSON.stringify(event, null, 2);
       eventJsonWrap.style.display = 'block';
 
       let allValid = true;
 
-      // 1. Verify kind 11112 secp256k1 signature
+      // 1. Verify proof carrier secp256k1 signature
       let secpValid = false;
       try {
         secpValid = verifyNostrEvent(event);
       } catch (e) {
         secpValid = false;
-        addResult('secp256k1 (kind 11112 wrapper)', false, `verification threw: ${e.message}`);
+        addResult('secp256k1 (proof carrier)', false, `verification threw: ${e.message}`);
       }
       if (secpValid) {
-        addResult('secp256k1 (kind 11112 wrapper)', true, 'valid');
+        addResult('secp256k1 (proof carrier)', true, 'valid');
       } else if (!resultsWrap.querySelector('.pq-result-item')) {
-        addResult('secp256k1 (kind 11112 wrapper)', false, 'INVALID');
+        addResult('secp256k1 (proof carrier)', false, 'INVALID');
       }
       if (!secpValid) allValid = false;
 
       // 2. Verify kind 1 sig, PQ sigs, e tag, sha256 tag (strict policy)
+      //    G56-03: pass outer pubkey and expected author for identity binding
       let pqResults;
       try {
-        pqResults = verifyNIPQRContent(event.content, event.tags);
+        pqResults = verifyNIPQRContent(event.content, event.tags, {
+          outerPubkey: event.pubkey,
+          expectedAuthor: currentExpectedAuthor || undefined
+        });
       } catch (e) {
         pqResults = {
           valid: false,
@@ -691,21 +694,19 @@
         return;
       }
 
-      let foundEvent = null;
+      let allCandidates = [];
       let lastError = null;
       let successCount = 0;
 
-      // Query relays in parallel, take the first event returned
+      // G56-02: Query relays in parallel, collect ALL candidates (not limit: 1)
       const promises = relayUrls.map(async (url) => {
         try {
-          const event = await queryRelayForEvent(pubkeyHex, url);
-          if (event) {
+          const events = await queryRelayForEvents(pubkeyHex, url);
+          if (events && events.length > 0) {
             successCount++;
-            if (!foundEvent || (event.created_at > foundEvent.created_at)) {
-              foundEvent = event;
-            }
+            allCandidates.push(...events);
           }
-          return { url, ok: true, event };
+          return { url, ok: true, count: events ? events.length : 0 };
         } catch (e) {
           lastError = e.message;
           return { url, ok: false, error: e.message };
@@ -714,12 +715,61 @@
 
       await Promise.all(promises);
 
-      if (foundEvent) {
-        const npub = hexToNpub(pubkeyHex);
-        setStatus(queryStatus, 'success', `Found kind 11112 event from ${npub.substring(0, 20)}... (created_at: ${foundEvent.created_at}, queried ${successCount}/${relayUrls.length} relays).`);
-        await verifyEvent(foundEvent);
-      } else {
-        setStatus(queryStatus, 'error', `No kind 11112 event found for this pubkey on any of the ${relayUrls.length} relay(s)${lastError ? ' (last error: ' + lastError + ')' : ''}.`);
+      // Deduplicate by event ID
+      const seenIds = new Set();
+      allCandidates = allCandidates.filter(e => {
+        if (!e || !e.id || seenIds.has(e.id)) return false;
+        seenIds.add(e.id);
+        return true;
+      });
+
+      if (allCandidates.length === 0) {
+        setStatus(queryStatus, 'error', `No proof carrier events found for this pubkey on any of the ${relayUrls.length} relay(s)${lastError ? ' (last error: ' + lastError + ')' : ''}.`);
+        queryBtn.disabled = false;
+        return;
+      }
+
+      const npub = hexToNpub(pubkeyHex);
+      setStatus(queryStatus, 'info', `Found ${allCandidates.length} proof carrier event(s) from ${npub.substring(0, 20)}... across ${successCount}/${relayUrls.length} relay(s). Selecting canonical (earliest Bitcoin anchor)...`);
+
+      // G56-02: Select the canonical proof carrier (earliest valid Bitcoin anchor)
+      // First, parse the kind 1 event from the first candidate to use for selection
+      let kind1Event = null;
+      try {
+        kind1Event = JSON.parse(allCandidates[0].content);
+      } catch (e) {
+        // Try other candidates
+        for (const c of allCandidates) {
+          try {
+            kind1Event = JSON.parse(c.content);
+            break;
+          } catch (e2) { /* keep trying */ }
+        }
+      }
+
+      if (!kind1Event) {
+        setStatus(queryStatus, 'error', 'Could not parse kind 1 announcement from any candidate.');
+        queryBtn.disabled = false;
+        return;
+      }
+
+      // Set the expected author for G56-03 identity binding
+      currentExpectedAuthor = pubkeyHex;
+
+      try {
+        const selection = await selectCanonicalProofCarrier(allCandidates, kind1Event, pubkeyHex);
+
+        if (selection.canonical) {
+          const heightNote = selection.canonicalBitcoinHeight ? `Bitcoin block ${selection.canonicalBitcoinHeight}` : 'pending (no Bitcoin anchor yet)';
+          const confirmedCount = selection.confirmedCandidates.length;
+          const pendingCount = selection.pendingCandidates.length;
+          setStatus(queryStatus, 'success', `Selected canonical proof carrier: ${selection.canonical.id.substring(0, 16)}... (${heightNote}). ${confirmedCount} confirmed, ${pendingCount} pending, ${allCandidates.length} total candidate(s).`);
+          await verifyEvent(selection.canonical);
+        } else {
+          setStatus(queryStatus, 'error', `No valid proof carrier found among ${allCandidates.length} candidate(s). Errors: ${selection.errors.join('; ')}`);
+        }
+      } catch (e) {
+        setStatus(queryStatus, 'error', `Canonical selection failed: ${e.message}`);
       }
 
       queryBtn.disabled = false;