[stephenctw]

The QA report identified Dave paths that stop honest dispute defense or leave deployment and epoch boundaries unsafe. This PR contains changes to the Dave repository only.

• SLN-3/SLN-4: defend terminal epochs across restart; stop submissions during foreclosure and refuse restart once foreclosure finalizes.
• PRT-1/SLN-42: structurally cap epochs at the Machine input span, preserve excess inputs, and align Rust and Lua capacity handling.
• CTR-1: isolate application deployment from public-factory squatting and bind predicted addresses to consensus settings.
• SLN-59: add a regression for interrupted initial-clone recovery; main already sweeps stale staging before seeding.
• SLN-60: refold event state when an omitted pairing contradicts a pinned candidate read.
• SLN-56: avoid bisecting authentication and malformed-request failures.
• SEAM-2, Dave portion: add real-contract coverage for nonstandard yields. The HTIF classification fix is already on main and is preserved by this rebase.

Validation: after rebasing onto main, 326 node unit tests and the three focused foreclosure, terminal-guest and nonstandard-yield integration tests passed. Before rebasing, the full just check gate and 30 node integration scenarios passed, and additional real-contract regressions cover nonstandard yields and a restarted halted guest defeating a malicious commitment through a leaf proof. The new contract bytecode requires new deployments and changes predicted addresses. Existing contracts are not migrated by this PR. Finding dispositions are recorded in docs/reviews/2026-10-20-sling-qa/closure.json.

Cross-project changes required

These findings are not fully resolved by this PR. No reference-node implementation or patch is included.

Finding	Remaining work	Project
SEAM-2	Align accepted-yield payload lengths, unknown automatic-yield handling, and continued defense when the declared outputs root differs from reconstructed outputs. The Dave-side payload-read fix is already on main; this PR adds end-to-end coverage.	Dave and rollups-node
SEAM-4	Align reference-node handling of a pending RX_ACCEPTED yield at the cycle-budget boundary with Dave, Lua and the on-chain step.	rollups-node, coordinated with Dave
SLN-9	Document historical-state RPC requirements for reference-node catch-up. This finding belongs to the reference node, not Dave.	rollups-node

The RPC model remains one consistent trusted node; no provider fallback was added. Gas estimation cannot eliminate inclusion races. The report's 403 ETH estimate is not a security bound; the input ceiling is enforced structurally.

[stephenctw]

@jplgarcia I can't add you as a reviewer, but your feedback is very valuable to us.