feat(mesh): arm MESH_ENVELOPE_V2_HEIGHT at 966_400 (H-11, #604)

[defenwycke]

Part of #604 (audit H-11). Rides v1.11.34 alongside #824.

The fixed order was completed, not shortened

MESH_ENVELOPE_V2_HEIGHT's docs specify an order that "cannot be shortened". Each step verified:

step	evidence
1. Tolerance shipped; every node verifies both formats, emits v1	#740 (d829c32f8) is an ancestor of the deployed commit
2. All eight rolled and confirmed on the new binary	v1.11.33 at bf3f822b5, checked per binary via --version (names the commit since #820), not by version string
3. Arming is a separate, observed change	this PR. Observation: bad_signature / InvalidSignature = 0 across 6h on the rolled binary

Why 966_400 and not 966_000

Both gates ride v1.11.34. They are deliberately ~400 blocks (~2.7 days) apart so that if the mesh misbehaves in that window, the cause is attributable to one gate rather than two — the same reasoning that placed STRATUM_HANDSHAKE_PROOF_HEIGHT clear of its neighbours.

That matters more here than usual: this gate does not degrade, it partitions. A node left on an older binary rejects every mesh message from every upgraded peer, and the only way back is upgrading it.

The flipped test

v2_emission_gate_ships_dormant asserted u64::MAX. It is flipped, not deleted — it did its job holding the gate closed until the order above was genuinely done, and now pins the armed height so it still cannot move without review.

The mirror, and why it is guarded

ghost-consensus sits below ghost-pool and cannot import ADDRESS_PROOF_HEIGHT, so ADDRESS_PROOF_SEPARATION_REFERENCE mirrors it. A duplicated consensus height is precisely the thing that drifts, so ghost-pool asserts it from the side that owns the original.

Controls

Control	Result
Both gates at the same height	separation test fails
Gates only 100 blocks apart	separation test fails
Drift the mirror to 965_000	the_mirror_in_ghost_consensus_matches fails

The separation assertions read through std::hint::black_box: comparing two consts folds at compile time and clippy flags it as assertions_on_constants — correctly, since a tautology that cannot fail is not a check. CI runs -D warnings, so this would otherwise have gone red.

cargo test -p ghost-consensus --lib: 380 passed. -p ghost-pool --lib: 496 passed. Clippy and fmt clean.

Roll requirement

⛔ All eight must be on v1.11.34 before 966_400. Chain is ~965,081, so roughly 8–9 days — comfortable, but this is the gate where "we'll catch the last node later" is not an option.

https://claude.ai/code/session_01Td1vvfowptTTnu88qG2iym