v0.3.12-pre.004

crates/ksp-worker-raw-transaction-ingest-lib/src/lib.rs

@@ -1,5 +1,5 @@
 // file: crates/ksp-worker-raw-transaction-ingest-lib/src/lib.rs
-// version: 10
+// version: 11
 
 #![warn(missing_docs)]
 #![deny(unreachable_pub)]
@@ -11,8 +11,9 @@
 //! and the caller-runtime-owned lifecycle with private child-task supervision. This tranche also
 //! owns bounded source-neutral admission, common RAW canonicalization/assembly and backend-neutral
 //! Store persistence in normal mode plus concrete latest-value snapshots projected onto Worker API;
-//! the first validated Yellowstone/HTTP runtime-resource contract exists and deterministically projects
-//! Transaction/TransactionStatus updates into private source-neutral signals, but no live stream is opened yet.
+//! the first validated Yellowstone/HTTP runtime-resource contract also closes the deterministic hydration
+//! qualification path in test configuration. Transaction/TransactionStatus signal projection and HTTP hydration
+//! remain inactive in production until the productive source task is wired; no live stream is opened yet.
 
 mod admission;
 mod error;

crates/ksp-worker-raw-transaction-ingest-lib/src/runtime_resources.rs

@@ -1,11 +1,15 @@
 // file: crates/ksp-worker-raw-transaction-ingest-lib/src/runtime_resources.rs
-// version: 3
+// version: 4
 
 #[cfg(test)]
 use sha2::Digest; // rust-rules: trait-import
 
 #[cfg(test)]
 const RAW_TRANSACTION_INGEST_YELLOWSTONE_FILTER_FINGERPRINT_DOMAIN: &[u8] = b"ksp.raw_transaction_ingest.yellowstone.filters.v1\0";
+#[cfg(test)]
+const RAW_TRANSACTION_INGEST_YELLOWSTONE_HTTP_PROTOCOL: &str = "yellowstone_http";
+#[cfg(test)]
+const RAW_TRANSACTION_INGEST_YELLOWSTONE_HTTP_SOURCE_KEY_DOMAIN: &[u8] = b"ksp.raw_transaction_ingest.yellowstone_http.source_key.v1\0";
 
 #[cfg(test)]
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
@@ -41,6 +45,7 @@ struct RawTransactionIngestSourceSignal {
     family: RawTransactionIngestSourceFamily,
     matched_filter_count: usize,
     matched_filter_fingerprint: [u8; 32],
+    matched_filter_id: std::option::Option<ksp_store_lib::RawProvenanceCode>,
     network: ksp_store_lib::RawNetworkId,
     route: RawTransactionIngestSourceRoute,
     signature: ksp_store_lib::RawTransactionSignature,
@@ -57,6 +62,7 @@ impl std::fmt::Debug for RawTransactionIngestSourceSignal {
             .field("family", &self.family)
             .field("matched_filter_count", &self.matched_filter_count)
             .field("matched_filter_fingerprint_bytes", &self.matched_filter_fingerprint.len())
+            .field("has_direct_filter_id", &self.matched_filter_id.is_some())
             .field("network", &self.network)
             .field("route", &self.route)
             .field("signature_bytes", &self.signature.as_bytes().len())
@@ -199,11 +205,12 @@ impl crate::RawTransactionIngestYellowstoneSource {
             std::result::Result::Ok(value) => value,
             std::result::Result::Err(_) => return std::result::Result::Err(crate::runtime_error("runtime_resources.yellowstone_endpoint_unrepresentable")),
         };
+        let route = RawTransactionIngestSourceRoute { endpoint_id, provider };
         let method = match ksp_onchain_transport_lib::find_http_rpc_method("getTransaction") {
             std::option::Option::Some(value) => value,
             std::option::Option::None => return std::result::Result::Err(crate::runtime_error("runtime_resources.hydration_method_missing")),
         };
-        let compatible_http_routes = compatible_http_route_count(&http_pool, &hydration_role, method.request_kind(), network.as_str());
+        let compatible_http_routes = compatible_http_route_count(&http_pool, &hydration_role, method.request_kind(), network.as_str(), &route);
         let compatible_http_routes = match compatible_http_routes {
             std::result::Result::Ok(value) => value,
             std::result::Result::Err(error) => return std::result::Result::Err(error),
@@ -211,7 +218,6 @@ impl crate::RawTransactionIngestYellowstoneSource {
         if compatible_http_routes == 0 {
             return std::result::Result::Err(crate::runtime_error("runtime_resources.hydration_role_unsupported"));
         }
-        let route = RawTransactionIngestSourceRoute { endpoint_id, provider };
         return std::result::Result::Ok(Self { yellowstone_channel, subscribe_request, http_pool, hydration_role, network, route });
     }
 }
@@ -271,6 +277,7 @@ fn compatible_http_route_count(
     hydration_role: &ksp_onchain_transport_lib::HttpRoleName,
     request_kind: &str,
     expected_cluster: &str,
+    yellowstone_route: &RawTransactionIngestSourceRoute,
 ) -> ksp_core_lib::Result<usize> {
     let snapshot = pool.snapshot();
     let mut compatible = 0_usize;
@@ -289,16 +296,56 @@ fn compatible_http_route_count(
             if endpoint.cluster() != expected_cluster {
                 return std::result::Result::Err(crate::runtime_error("runtime_resources.transport_network_mismatch"));
             }
+            let composite = composite_provenance_codes(yellowstone_route, endpoint.provider(), endpoint.name());
+            if let std::result::Result::Err(error) = composite {
+                return std::result::Result::Err(error);
+            }
             compatible = compatible.saturating_add(1);
         }
     }
     return std::result::Result::Ok(compatible);
 }
 
+fn composite_provenance_codes(
+    yellowstone_route: &RawTransactionIngestSourceRoute,
+    http_provider: &str,
+    http_endpoint: &str,
+) -> ksp_core_lib::Result<(ksp_store_lib::RawProvenanceCode, ksp_store_lib::RawProvenanceCode)> {
+    let provider = std::format!("ys.{}:http.{}", yellowstone_route.provider.as_str(), http_provider);
+    let provider = match ksp_store_lib::RawProvenanceCode::new(provider) {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => {
+            return std::result::Result::Err(crate::runtime_error("runtime_resources.composite_provider_unrepresentable"));
+        },
+    };
+    let endpoint = std::format!("ys.{}:http.{}", yellowstone_route.endpoint_id.as_str(), http_endpoint);
+    let endpoint = match ksp_store_lib::RawProvenanceCode::new(endpoint) {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => {
+            return std::result::Result::Err(crate::runtime_error("runtime_resources.composite_endpoint_unrepresentable"));
+        },
+    };
+    return std::result::Result::Ok((provider, endpoint));
+}
+
 fn ingestion_filter_count(request: &ksp_onchain_transport_lib::YellowstoneSubscribeRequest) -> usize {
     return request.transaction_filter_count().saturating_add(request.transaction_status_filter_count()).saturating_add(request.block_filter_count());
 }
 
+#[cfg(test)]
+fn matched_filter_direct_id(filters: &[ksp_onchain_transport_lib::YellowstoneSubscribeFilterName]) -> std::option::Option<ksp_store_lib::RawProvenanceCode> {
+    let mut names = filters.iter().map(ksp_onchain_transport_lib::YellowstoneSubscribeFilterName::as_str).collect::<std::vec::Vec<_>>();
+    names.sort_unstable();
+    names.dedup();
+    if names.len() != 1 {
+        return std::option::Option::None;
+    }
+    return match ksp_store_lib::RawProvenanceCode::new(names[0]) {
+        std::result::Result::Ok(value) => std::option::Option::Some(value),
+        std::result::Result::Err(_) => std::option::Option::None,
+    };
+}
+
 #[cfg(test)]
 fn matched_filter_fingerprint(filters: &[ksp_onchain_transport_lib::YellowstoneSubscribeFilterName]) -> [u8; 32] {
     let mut names = filters.iter().map(ksp_onchain_transport_lib::YellowstoneSubscribeFilterName::as_str).collect::<std::vec::Vec<_>>();
@@ -328,6 +375,7 @@ fn project_yellowstone_signal<T: RawTransactionIngestYellowstoneSignalView>(
         family: update.family(),
         matched_filter_count: update.filters().len(),
         matched_filter_fingerprint: matched_filter_fingerprint(update.filters()),
+        matched_filter_id: matched_filter_direct_id(update.filters()),
         network: source.network.clone(),
         route: source.route.clone(),
         signature,
@@ -336,6 +384,264 @@ fn project_yellowstone_signal<T: RawTransactionIngestYellowstoneSignalView>(
     };
 }
 
+#[cfg(test)]
+enum RawTransactionIngestHydrationOutcome {
+    Available(crate::RawTransactionIngress),
+    Missing(ksp_store_lib::RawTransactionReference),
+}
+
+#[cfg(test)]
+async fn hydrate_yellowstone_signal(
+    source: &crate::RawTransactionIngestYellowstoneSource,
+    settings: &crate::RawTransactionIngestSettings,
+    signal: RawTransactionIngestSourceSignal,
+    received_at: ksp_store_lib::RawTimestamp,
+) -> ksp_core_lib::Result<RawTransactionIngestHydrationOutcome> {
+    if &signal.network != settings.network() || signal.network != source.network {
+        return std::result::Result::Err(crate::runtime_error("hydration.network_mismatch"));
+    }
+    if signal.route != source.route {
+        return std::result::Result::Err(crate::runtime_error("hydration.source_route_mismatch"));
+    }
+    let commitment = match source.subscribe_request.commitment() {
+        std::option::Option::Some(ksp_onchain_transport_lib::SolanaCommitment::Confirmed) => ksp_onchain_transport_lib::SolanaCommitment::Confirmed,
+        std::option::Option::Some(ksp_onchain_transport_lib::SolanaCommitment::Finalized) => ksp_onchain_transport_lib::SolanaCommitment::Finalized,
+        std::option::Option::Some(ksp_onchain_transport_lib::SolanaCommitment::Processed) | std::option::Option::None => {
+            return std::result::Result::Err(crate::runtime_error("hydration.commitment_invalid"));
+        },
+    };
+    let config = ksp_onchain_transport_lib::SolanaGetTransactionConfig::new(
+        std::option::Option::Some(commitment),
+        std::option::Option::Some(ksp_onchain_transport_lib::SolanaTransactionEncoding::Base64),
+        std::option::Option::Some(0),
+    );
+    let signature_text = ksp_raw_transaction_lib::format_raw_transaction_signature(&signal.signature);
+    let observed = source.http_pool.get_transaction_observed(&source.hydration_role, signature_text.as_str(), std::option::Option::Some(&config)).await;
+    let observed = match observed {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(error) => return std::result::Result::Err(hydration_transport_error(error.code())),
+    };
+    let http_provider = observed.provider().as_str().to_owned();
+    let http_endpoint = observed.endpoint_name().to_owned();
+    let transaction = observed.into_value();
+    let transaction = match transaction {
+        std::option::Option::Some(value) => value,
+        std::option::Option::None => {
+            let reference = ksp_store_lib::RawTransactionReference::new(signal.network, signal.signature);
+            return std::result::Result::Ok(RawTransactionIngestHydrationOutcome::Missing(reference));
+        },
+    };
+    if transaction.slot() != signal.slot {
+        return std::result::Result::Err(crate::runtime_error("hydration.slot_mismatch"));
+    }
+    if let std::option::Option::Some(expected_index) = signal.transaction_index {
+        if let ksp_onchain_transport_lib::SolanaWireField::Value(actual_index) = transaction.transaction_index() {
+            if expected_index != u64::from(*actual_index) {
+                return std::result::Result::Err(crate::runtime_error("hydration.transaction_index_mismatch"));
+            }
+        }
+    }
+    let transaction_data = match transaction.transaction() {
+        ksp_onchain_transport_lib::SolanaEncodedTransaction::Binary { data, encoding }
+            if *encoding == ksp_onchain_transport_lib::SolanaTransactionBinaryEncoding::Base64 =>
+        {
+            data.clone()
+        },
+        ksp_onchain_transport_lib::SolanaEncodedTransaction::Binary { .. }
+        | ksp_onchain_transport_lib::SolanaEncodedTransaction::LegacyBinary(_)
+        | ksp_onchain_transport_lib::SolanaEncodedTransaction::Json(_) => {
+            return std::result::Result::Err(crate::runtime_error("hydration.transaction_encoding_invalid"));
+        },
+    };
+    let embedded_signature = ksp_raw_transaction_lib::extract_raw_transaction_signature_from_binary_base64(transaction_data.as_str());
+    let embedded_signature = match embedded_signature {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => return std::result::Result::Err(crate::runtime_error("hydration.transaction_signature_invalid")),
+    };
+    if embedded_signature != signal.signature {
+        return std::result::Result::Err(crate::runtime_error("hydration.signature_mismatch"));
+    }
+    let provenance = build_hydration_provenance(settings, &signal, http_provider.as_str(), http_endpoint.as_str(), commitment, received_at);
+    let provenance = match provenance {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(error) => return std::result::Result::Err(error),
+    };
+    let source_key = hydration_source_key(&provenance);
+    let material = ksp_raw_transaction_lib::RawTransactionMaterial::binary_base64(
+        signal.network.clone(),
+        signal.signature,
+        transaction.slot(),
+        transaction.block_time(),
+        transaction_data,
+        map_hydration_wire_field(transaction.meta(), |value| return value.clone()),
+        map_hydration_wire_field(transaction.version(), |value| {
+            return match value {
+                ksp_onchain_transport_lib::SolanaTransactionVersion::Legacy => ksp_raw_transaction_lib::RawTransactionVersion::Legacy,
+                ksp_onchain_transport_lib::SolanaTransactionVersion::Number(number) => ksp_raw_transaction_lib::RawTransactionVersion::Number(*number),
+            };
+        }),
+        map_hydration_wire_field(transaction.transaction_index(), |value| return *value),
+    );
+    return std::result::Result::Ok(RawTransactionIngestHydrationOutcome::Available(crate::RawTransactionIngress {
+        material,
+        network: signal.network,
+        provenance,
+        source_key,
+    }));
+}
+
+#[cfg(test)]
+fn build_hydration_provenance(
+    settings: &crate::RawTransactionIngestSettings,
+    signal: &RawTransactionIngestSourceSignal,
+    http_provider: &str,
+    http_endpoint: &str,
+    commitment: ksp_onchain_transport_lib::SolanaCommitment,
+    received_at: ksp_store_lib::RawTimestamp,
+) -> ksp_core_lib::Result<ksp_store_lib::RawAcquisitionProvenance> {
+    let (provider, endpoint_id) = match composite_provenance_codes(&signal.route, http_provider, http_endpoint) {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(error) => return std::result::Result::Err(error),
+    };
+    let protocol = match ksp_store_lib::RawProvenanceCode::new(RAW_TRANSACTION_INGEST_YELLOWSTONE_HTTP_PROTOCOL) {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => return std::result::Result::Err(crate::runtime_error("hydration.protocol_unrepresentable")),
+    };
+    let acquisition_method = match ksp_store_lib::RawProvenanceCode::new(hydration_method_code(signal.family)) {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => return std::result::Result::Err(crate::runtime_error("hydration.method_unrepresentable")),
+    };
+    let capture_session = match ksp_store_lib::RawProvenanceCode::new(settings.worker_id().as_str()) {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => return std::result::Result::Err(crate::runtime_error("hydration.capture_session_unrepresentable")),
+    };
+    let commitment = match ksp_store_lib::RawProvenanceCode::new(commitment.as_str()) {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => return std::result::Result::Err(crate::runtime_error("hydration.commitment_unrepresentable")),
+    };
+    let filter_id = match signal.matched_filter_id.clone() {
+        std::option::Option::Some(value) => value,
+        std::option::Option::None => match fingerprint_filter_code(&signal.matched_filter_fingerprint) {
+            std::result::Result::Ok(value) => value,
+            std::result::Result::Err(error) => return std::result::Result::Err(error),
+        },
+    };
+    let mut provenance =
+        ksp_store_lib::RawAcquisitionProvenance::new(provider, protocol, acquisition_method, ksp_store_lib::RawAcquisitionOrigin::Live, received_at)
+            .with_endpoint_id(endpoint_id)
+            .with_commitment(commitment)
+            .with_capture_session_id(capture_session)
+            .with_filter_id(filter_id);
+    if let std::option::Option::Some(observed_at) = representable_observed_at(signal.created_at, received_at) {
+        provenance = match provenance.try_with_observed_at(observed_at) {
+            std::result::Result::Ok(value) => value,
+            std::result::Result::Err(_) => return std::result::Result::Err(crate::runtime_error("hydration.observed_at_invalid")),
+        };
+    }
+    return std::result::Result::Ok(provenance);
+}
+
+#[cfg(test)]
+fn hydration_method_code(family: RawTransactionIngestSourceFamily) -> &'static str {
+    return match family {
+        RawTransactionIngestSourceFamily::Transaction => "transaction_get_transaction",
+        RawTransactionIngestSourceFamily::TransactionStatus => "status_get_transaction",
+    };
+}
+
+#[cfg(test)]
+fn fingerprint_filter_code(fingerprint: &[u8; 32]) -> ksp_core_lib::Result<ksp_store_lib::RawProvenanceCode> {
+    const HEX: &[u8; 16] = b"0123456789abcdef";
+    let mut value = std::string::String::with_capacity(71);
+    value.push_str("sha256.");
+    for byte in fingerprint {
+        value.push(char::from(HEX[usize::from(*byte >> 4)]));
+        value.push(char::from(HEX[usize::from(*byte & 0x0f)]));
+    }
+    return match ksp_store_lib::RawProvenanceCode::new(value) {
+        std::result::Result::Ok(value) => std::result::Result::Ok(value),
+        std::result::Result::Err(_) => std::result::Result::Err(crate::runtime_error("hydration.filter_fingerprint_unrepresentable")),
+    };
+}
+
+#[cfg(test)]
+fn representable_observed_at(
+    created_at: std::option::Option<RawTransactionIngestSourceTimestamp>,
+    received_at: ksp_store_lib::RawTimestamp,
+) -> std::option::Option<ksp_store_lib::RawTimestamp> {
+    let created_at = match created_at {
+        std::option::Option::Some(value) => value,
+        std::option::Option::None => return std::option::Option::None,
+    };
+    let seconds = match u64::try_from(created_at.seconds) {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => return std::option::Option::None,
+    };
+    let millis = match seconds.checked_mul(1_000).and_then(|value| return value.checked_add(u64::from(created_at.nanos / 1_000_000))) {
+        std::option::Option::Some(value) => value,
+        std::option::Option::None => return std::option::Option::None,
+    };
+    let observed_at = match ksp_store_lib::RawTimestamp::from_unix_millis(millis) {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => return std::option::Option::None,
+    };
+    if observed_at > received_at {
+        return std::option::Option::None;
+    }
+    return std::option::Option::Some(observed_at);
+}
+
+#[cfg(test)]
+fn hydration_source_key(provenance: &ksp_store_lib::RawAcquisitionProvenance) -> [u8; 32] {
+    let mut hasher = sha2::Sha256::new();
+    hasher.update(RAW_TRANSACTION_INGEST_YELLOWSTONE_HTTP_SOURCE_KEY_DOMAIN);
+    hash_hydration_source_key(&mut hasher, provenance.provider().as_str().as_bytes());
+    hash_hydration_source_key(&mut hasher, provenance.protocol().as_str().as_bytes());
+    hash_hydration_source_key(&mut hasher, provenance.acquisition_method().as_str().as_bytes());
+    if let std::option::Option::Some(value) = provenance.endpoint_id() {
+        hash_hydration_source_key(&mut hasher, value.as_str().as_bytes());
+    }
+    if let std::option::Option::Some(value) = provenance.commitment() {
+        hash_hydration_source_key(&mut hasher, value.as_str().as_bytes());
+    }
+    if let std::option::Option::Some(value) = provenance.capture_session_id() {
+        hash_hydration_source_key(&mut hasher, value.as_str().as_bytes());
+    }
+    if let std::option::Option::Some(value) = provenance.filter_id() {
+        hash_hydration_source_key(&mut hasher, value.as_str().as_bytes());
+    }
+    return hasher.finalize().into();
+}
+
+#[cfg(test)]
+fn hash_hydration_source_key(hasher: &mut sha2::Sha256, value: &[u8]) {
+    hasher.update((value.len() as u64).to_be_bytes());
+    hasher.update(value);
+    return;
+}
+
+#[cfg(test)]
+fn hydration_transport_error(code: ksp_core_lib::ErrorCode) -> ksp_core_lib::Error {
+    return ksp_core_lib::Error::new(crate::ERROR_CODE_RAW_TRANSACTION_INGEST_SOURCE_FAILED, "RAW transaction ingest hydration transport failed")
+        .with_context("transport_domain", code.domain())
+        .with_context("transport_code", code.code());
+}
+
+#[cfg(test)]
+fn map_hydration_wire_field<T, U, F>(
+    field: &ksp_onchain_transport_lib::SolanaWireField<T>,
+    mut map_value: F,
+) -> ksp_raw_transaction_lib::RawTransactionWireField<U>
+where
+    F: FnMut(&T) -> U,
+{
+    return match field {
+        ksp_onchain_transport_lib::SolanaWireField::Omitted => ksp_raw_transaction_lib::RawTransactionWireField::Omitted,
+        ksp_onchain_transport_lib::SolanaWireField::Null => ksp_raw_transaction_lib::RawTransactionWireField::Null,
+        ksp_onchain_transport_lib::SolanaWireField::Value(value) => ksp_raw_transaction_lib::RawTransactionWireField::Value(map_value(value)),
+    };
+}
+
 #[cfg(test)]
 #[path = "../unit_tests/runtime_resources.rs"]
 mod tests;

crates/ksp-worker-raw-transaction-ingest-lib/tests/dependency_boundary.rs

@@ -1,5 +1,5 @@
 // file: crates/ksp-worker-raw-transaction-ingest-lib/tests/dependency_boundary.rs
-// version: 10
+// version: 11
 
 //! Dependency firewall canaries for the RAW transaction ingest Worker foundation.
 
@@ -87,7 +87,6 @@ fn v0_3_12_pre_003_transaction_and_status_adapters_are_private_offline_and_trans
         "pub use self::runtime_resources::RawTransactionIngestSourceSignal",
         "open_standard_subscribe",
         "next_update",
-        "get_transaction_observed",
         "get_block_observed",
         "ksp_store_postgres_lib::",
         "reqwest::",
@@ -108,6 +107,43 @@ fn v0_3_12_pre_003_transaction_and_status_adapters_are_private_offline_and_trans
     return;
 }
 
+#[test]
+fn v0_3_12_pre_004_hydration_contract_uses_only_transport_facade_common_raw_and_existing_ingress() {
+    let root = include_str!("../src/lib.rs");
+    let resources = include_str!("../src/runtime_resources.rs");
+    for required in [
+        "get_transaction_observed",
+        "SolanaGetTransactionConfig::new",
+        "SolanaTransactionEncoding::Base64",
+        "format_raw_transaction_signature",
+        "extract_raw_transaction_signature_from_binary_base64",
+        "RawTransactionMaterial::binary_base64",
+        "RawTransactionIngress",
+        "yellowstone_http",
+        "transaction_get_transaction",
+        "status_get_transaction",
+        "RawAcquisitionOrigin::Live",
+        "composite_provenance_codes",
+    ] {
+        assert!(resources.contains(required), "required pre.004 hydration contract missing: {required}");
+    }
+    assert!(resources.contains("#[cfg(test)]\nasync fn hydrate_yellowstone_signal"));
+    for forbidden in [
+        "open_standard_subscribe",
+        "next_update",
+        "get_block_observed",
+        "ksp_config_lib::",
+        "ksp_job_backfill_lib::",
+        "ksp_store_postgres_lib::",
+        "reqwest::",
+        "tonic::",
+        "yellowstone_grpc_proto::",
+    ] {
+        assert!(!resources.contains(forbidden) && !root.contains(forbidden), "pre.004 crossed a forbidden boundary: {forbidden}");
+    }
+    return;
+}
+
 #[test]
 fn v0_3_12_pre_002_source_surface_hardens_shutdown_and_faults_without_backend_or_premature_live_io() {
     let root = include_str!("../src/lib.rs");

crates/ksp-worker-raw-transaction-ingest-lib/tests/hardening.rs

@@ -1,5 +1,5 @@
 // file: crates/ksp-worker-raw-transaction-ingest-lib/tests/hardening.rs
-// version: 5
+// version: 6
 
 //! External public, security, redaction and release-boundary hardening canaries for `pre.010`.
 
@@ -301,6 +301,7 @@ fn v0_3_12_pre_003_private_signal_debug_and_shape_do_not_expose_signature_filter
         "family:",
         "matched_filter_count:",
         "matched_filter_fingerprint:",
+        "matched_filter_id:",
         "network:",
         "route:",
         "signature:",
@@ -312,13 +313,40 @@ fn v0_3_12_pre_003_private_signal_debug_and_shape_do_not_expose_signature_filter
     return;
 }
 
+#[test]
+fn v0_3_12_pre_004_hydration_provenance_and_remote_material_are_bounded_and_redacted() {
+    let resources = include_str!("../src/runtime_resources.rs");
+    for required in [
+        "ys.{}:http.{}",
+        "composite_provider_unrepresentable",
+        "composite_endpoint_unrepresentable",
+        "RawAcquisitionOrigin::Live",
+        "with_capture_session_id",
+        "with_commitment",
+        "with_endpoint_id",
+        "with_filter_id",
+        "try_with_observed_at",
+        "hydration.signature_mismatch",
+        "hydration.slot_mismatch",
+        "hydration.transaction_index_mismatch",
+    ] {
+        assert!(resources.contains(required), "required pre.004 bounded provenance/mismatch guard missing: {required}");
+    }
+    for forbidden in ["source_payload_hash", "source_payload_size_bytes", "HTTP-SECRET-CANARY", "GRPC-SECRET-CANARY", "TransactionStatus.error", ".error()"] {
+        assert!(!resources.contains(forbidden), "pre.004 retained forbidden remote/source material: {forbidden}");
+    }
+    return;
+}
+
 #[test]
 fn v0_3_12_pre_002_runtime_resource_contract_performs_no_live_io_or_source_spawn() {
     let resources = include_str!("../src/runtime_resources.rs");
     let runtime = include_str!("../src/runtime.rs");
-    for forbidden in ["open_standard_subscribe", "next_update", "get_transaction_observed", "get_block_observed", "tokio::spawn", "JoinSet"] {
-        assert!(!resources.contains(forbidden), "pre.002 runtime-resource contract opened premature live behavior: {forbidden}");
+    for forbidden in ["open_standard_subscribe", "next_update", "get_block_observed", "tokio::spawn", "JoinSet"] {
+        assert!(!resources.contains(forbidden), "runtime-resource contract opened premature live source behavior: {forbidden}");
     }
+    assert!(resources.contains("#[cfg(test)]\nasync fn hydrate_yellowstone_signal"));
+    assert!(resources.contains("get_transaction_observed"));
     assert!(runtime.contains("start_with_runtime_resources"));
     for forbidden in ["open_standard_subscribe", "next_update", "get_transaction_observed", "get_block_observed"] {
         assert!(!runtime.contains(forbidden), "pre.002 runtime start opened premature live behavior: {forbidden}");

crates/ksp-worker-raw-transaction-ingest-lib/tests/release_completeness.rs

@@ -1,5 +1,5 @@
 // file: crates/ksp-worker-raw-transaction-ingest-lib/tests/release_completeness.rs
-// version: 3
+// version: 4
 
 //! Release-completeness canaries through the `pre.010` public/release/security hardening tranche.
 
@@ -99,6 +99,7 @@ fn pre_010_external_hardening_suite_is_present_and_scoped() {
         "pre_010_debug_and_settings_errors_redact_worker_identity_and_invalid_values",
         "v0_3_12_pre_002_manifest_dependency_surface_opens_only_transport_and_remains_backend_neutral",
         "v0_3_12_pre_003_private_signal_debug_and_shape_do_not_expose_signature_filters_or_payload",
+        "v0_3_12_pre_004_hydration_provenance_and_remote_material_are_bounded_and_redacted",
         "pre_010_source_visibility_contract_uses_crate_root_for_shared_items",
         "pre_010_production_surface_has_no_historical_backfill_or_retriever_contract",
         "v0_3_12_pre_002_production_sources_keep_transport_confined_to_runtime_resources",
@@ -113,6 +114,7 @@ fn pre_010_external_hardening_suite_is_present_and_scoped() {
     assert!(dependency_boundary.contains("v0_3_12_pre_002_source_surface_hardens_shutdown_and_faults_without_backend_or_premature_live_io"));
     assert!(dependency_boundary.contains("v0_3_12_pre_002_manifest_opens_only_the_onchain_transport_live_source_edge"));
     assert!(dependency_boundary.contains("v0_3_12_pre_003_transaction_and_status_adapters_are_private_offline_and_transport_facade_only"));
+    assert!(dependency_boundary.contains("v0_3_12_pre_004_hydration_contract_uses_only_transport_facade_common_raw_and_existing_ingress"));
     let public_api = include_str!("public_api.rs");
     assert!(public_api.contains("pre_003_kind_code_and_settings_are_consumable_from_crate_root"));
     assert!(public_api.contains("pre_004_start_handle_and_terminal_future_are_consumable_without_public_join_handle"));

crates/ksp-worker-raw-transaction-ingest-lib/unit_tests/runtime_resources.rs

@@ -1,5 +1,5 @@
 // file: crates/ksp-worker-raw-transaction-ingest-lib/unit_tests/runtime_resources.rs
-// version: 2
+// version: 3
 
 fn grpc_endpoint(cluster: &str) -> std::option::Option<ksp_onchain_transport_lib::YellowstoneGrpcEndpointSettings> {
     return grpc_endpoint_with_identity(cluster, "yellowstone-fixture", "fixture-provider");
@@ -147,6 +147,199 @@ fn signal_source() -> std::option::Option<crate::RawTransactionIngestYellowstone
     };
 }
 
+const PRE_004_OTHER_TRANSACTION_BASE64: &str = "AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEA";
+const PRE_004_ZERO_SIGNATURE_TEXT: &str = "1111111111111111111111111111111111111111111111111111111111111111";
+const PRE_004_ZERO_TRANSACTION_BASE64: &str = "AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
+
+fn http_pool_for_url(url: &str, cluster: &str, endpoint_name: &str, provider: &str) -> std::option::Option<ksp_onchain_transport_lib::HttpTransportPool> {
+    let url = match ksp_onchain_transport_lib::HttpEndpointUrl::parse(url) {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => return std::option::Option::None,
+    };
+    let role = ksp_onchain_transport_lib::HttpEndpointRoleSettings::new(
+        ksp_onchain_transport_lib::HttpRoleName::new("hydration"),
+        true,
+        std::vec![ksp_onchain_transport_lib::HttpRequestKind::new("get_transaction")],
+        10,
+        ksp_onchain_transport_lib::HttpRoleLimits::new(
+            std::option::Option::None,
+            std::option::Option::None,
+            std::option::Option::None,
+            std::option::Option::None,
+        ),
+    );
+    let endpoint = ksp_onchain_transport_lib::HttpEndpointSettings::new(
+        endpoint_name,
+        true,
+        ksp_onchain_transport_lib::HttpProviderName::new(provider),
+        ksp_onchain_transport_lib::HttpClusterName::new(cluster),
+        url,
+        std::time::Duration::from_secs(1),
+        std::time::Duration::from_secs(1),
+        std::option::Option::Some(1),
+        std::vec![role],
+    );
+    let settings = ksp_onchain_transport_lib::HttpTransportSettings::new(
+        std::vec![endpoint],
+        ksp_onchain_transport_lib::HttpRetrySettings::new(0, std::time::Duration::from_millis(1), std::time::Duration::from_millis(1)),
+    );
+    return match ksp_onchain_transport_lib::HttpTransportPool::new(settings) {
+        std::result::Result::Ok(value) => std::option::Option::Some(value),
+        std::result::Result::Err(_) => std::option::Option::None,
+    };
+}
+
+fn signal_source_for_http_url(url: &str) -> std::option::Option<crate::RawTransactionIngestYellowstoneSource> {
+    return signal_source_for_http_url_with_commitment(url, ksp_onchain_transport_lib::SolanaCommitment::Confirmed);
+}
+
+fn signal_source_for_http_url_with_commitment(
+    url: &str,
+    commitment: ksp_onchain_transport_lib::SolanaCommitment,
+) -> std::option::Option<crate::RawTransactionIngestYellowstoneSource> {
+    let endpoint = match grpc_endpoint("devnet") {
+        std::option::Option::Some(value) => value,
+        std::option::Option::None => return std::option::Option::None,
+    };
+    let channel = match ksp_onchain_transport_lib::YellowstoneGrpcChannel::prepare(&endpoint) {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => return std::option::Option::None,
+    };
+    let request = match transaction_request(std::option::Option::Some(commitment)) {
+        std::option::Option::Some(value) => value,
+        std::option::Option::None => return std::option::Option::None,
+    };
+    let pool = match http_pool_for_url(url, "devnet", "http-hydration-fixture", "fixture-http-provider") {
+        std::option::Option::Some(value) => value,
+        std::option::Option::None => return std::option::Option::None,
+    };
+    return match crate::RawTransactionIngestYellowstoneSource::new(channel, request, pool, ksp_onchain_transport_lib::HttpRoleName::new("hydration")) {
+        std::result::Result::Ok(value) => std::option::Option::Some(value),
+        std::result::Result::Err(_) => std::option::Option::None,
+    };
+}
+
+fn pre_004_settings() -> std::option::Option<crate::RawTransactionIngestSettings> {
+    let network = match ksp_store_lib::RawNetworkId::new("devnet") {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => return std::option::Option::None,
+    };
+    let worker_id = match ksp_worker_api::WorkerId::new("worker-fixture") {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => return std::option::Option::None,
+    };
+    return std::option::Option::Some(crate::RawTransactionIngestSettings::with_defaults(network, worker_id));
+}
+
+fn pre_004_signal(
+    source: &crate::RawTransactionIngestYellowstoneSource,
+    family: super::RawTransactionIngestSourceFamily,
+    slot: u64,
+    index: u64,
+    filters: &[&str],
+    signature_byte: u8,
+) -> std::option::Option<super::RawTransactionIngestSourceSignal> {
+    let filters = match filter_names(filters) {
+        std::option::Option::Some(value) => value,
+        std::option::Option::None => return std::option::Option::None,
+    };
+    let created_at = match ksp_onchain_transport_lib::YellowstoneUpdateTimestamp::new(1_760_000_123, 456_000_000) {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => return std::option::Option::None,
+    };
+    let fixture = SignalViewFixture {
+        created_at: std::option::Option::Some(created_at),
+        family,
+        filters,
+        index,
+        signature: ksp_onchain_transport_lib::YellowstoneTransactionSignature::new([signature_byte; 64]),
+        slot,
+    };
+    return std::option::Option::Some(super::project_yellowstone_signal(source, &fixture));
+}
+
+fn serve_http_once(body: std::string::String) -> std::io::Result<(std::string::String, std::thread::JoinHandle<std::io::Result<std::string::String>>)> {
+    let listener = match std::net::TcpListener::bind("127.0.0.1:0") {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(error) => return std::result::Result::Err(error),
+    };
+    let address = match listener.local_addr() {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(error) => return std::result::Result::Err(error),
+    };
+    let handle = std::thread::spawn(move || {
+        let (mut stream, _) = match listener.accept() {
+            std::result::Result::Ok(value) => value,
+            std::result::Result::Err(error) => return std::result::Result::Err(error),
+        };
+        let request = match read_http_request(&mut stream) {
+            std::result::Result::Ok(value) => value,
+            std::result::Result::Err(error) => return std::result::Result::Err(error),
+        };
+        let response =
+            std::format!("HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{}", body.len(), body,);
+        if let std::result::Result::Err(error) = std::io::Write::write_all(&mut stream, response.as_bytes()) {
+            return std::result::Result::Err(error);
+        }
+        return std::result::Result::Ok(request);
+    });
+    return std::result::Result::Ok((std::format!("http://{address}"), handle));
+}
+
+fn read_http_request(stream: &mut std::net::TcpStream) -> std::io::Result<std::string::String> {
+    let mut bytes = std::vec::Vec::new();
+    let mut buffer = [0_u8; 1024];
+    loop {
+        let count = match std::io::Read::read(stream, &mut buffer) {
+            std::result::Result::Ok(value) => value,
+            std::result::Result::Err(error) => return std::result::Result::Err(error),
+        };
+        if count == 0 {
+            break;
+        }
+        bytes.extend_from_slice(&buffer[..count]);
+        if http_request_complete(bytes.as_slice()) {
+            break;
+        }
+    }
+    return match std::string::String::from_utf8(bytes) {
+        std::result::Result::Ok(value) => std::result::Result::Ok(value),
+        std::result::Result::Err(_) => std::result::Result::Err(std::io::Error::new(std::io::ErrorKind::InvalidData, "fixture HTTP request is not UTF-8")),
+    };
+}
+
+fn http_request_complete(bytes: &[u8]) -> bool {
+    let text = match std::str::from_utf8(bytes) {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => return false,
+    };
+    let header_end = match text.find("\r\n\r\n") {
+        std::option::Option::Some(value) => value,
+        std::option::Option::None => return false,
+    };
+    let mut content_length = 0_usize;
+    for line in text[..header_end].lines() {
+        let (name, value) = match line.split_once(':') {
+            std::option::Option::Some(value) => value,
+            std::option::Option::None => continue,
+        };
+        if name.eq_ignore_ascii_case("content-length") {
+            content_length = match value.trim().parse::<usize>() {
+                std::result::Result::Ok(value) => value,
+                std::result::Result::Err(_) => return false,
+            };
+        }
+    }
+    return bytes.len() >= header_end.saturating_add(4).saturating_add(content_length);
+}
+
+fn http_request_body(request: &str) -> &str {
+    return match request.split_once("\r\n\r\n") {
+        std::option::Option::Some((_, body)) => body,
+        std::option::Option::None => "",
+    };
+}
+
 #[tokio::test(flavor = "current_thread")]
 async fn pre_002_source_accepts_matching_confirmed_transaction_and_get_transaction_route_without_io() {
     let endpoint = match grpc_endpoint("devnet") {
@@ -474,3 +667,368 @@ async fn pre_003_source_rejects_route_identity_that_cannot_become_safe_provenanc
     }
     return;
 }
+
+#[test]
+fn pre_004_composite_provenance_rejects_overflow_without_truncation() {
+    let provider = match ksp_store_lib::RawProvenanceCode::new("yellowstone-provider") {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => return,
+    };
+    let endpoint_id = match ksp_store_lib::RawProvenanceCode::new("yellowstone-endpoint") {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => return,
+    };
+    let route = super::RawTransactionIngestSourceRoute { endpoint_id, provider };
+    let result = super::composite_provenance_codes(&route, "h".repeat(120).as_str(), "http-endpoint");
+    let error = match result {
+        std::result::Result::Ok(_) => return,
+        std::result::Result::Err(error) => error,
+    };
+    assert_eq!(error.code(), crate::ERROR_CODE_RAW_TRANSACTION_INGEST_RUNTIME_INVALID);
+    assert!(error.context().iter().any(|context| return context.value() == "runtime_resources.composite_provider_unrepresentable"));
+    return;
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn pre_004_observed_get_transaction_closes_signal_to_common_raw_ingress_with_composite_provenance() {
+    let body = std::format!(
+        "{{\"jsonrpc\":\"2.0\",\"result\":{{\"slot\":42,\"blockTime\":1760000120,\"transaction\":[\"{}\",\"base64\"],\"meta\":{{\"err\":null,\"fee\":5000}},\"version\":\"legacy\",\"transactionIndex\":7}},\"id\":1}}",
+        PRE_004_ZERO_TRANSACTION_BASE64,
+    );
+    let (url, server) = match serve_http_once(body) {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => return,
+    };
+    let source = match signal_source_for_http_url(url.as_str()) {
+        std::option::Option::Some(value) => value,
+        std::option::Option::None => return,
+    };
+    let settings = match pre_004_settings() {
+        std::option::Option::Some(value) => value,
+        std::option::Option::None => return,
+    };
+    let signal = match pre_004_signal(&source, super::RawTransactionIngestSourceFamily::Transaction, 42, 7, &["tx-fixture"], 0) {
+        std::option::Option::Some(value) => value,
+        std::option::Option::None => return,
+    };
+    let received_at = match ksp_store_lib::RawTimestamp::from_unix_millis(1_760_000_124_000) {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => return,
+    };
+    let outcome = super::hydrate_yellowstone_signal(&source, &settings, signal, received_at).await;
+    assert!(outcome.is_ok());
+    let outcome = match outcome {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => return,
+    };
+    let request = match server.join() {
+        std::result::Result::Ok(std::result::Result::Ok(value)) => value,
+        _ => return,
+    };
+    let request_body = http_request_body(request.as_str());
+    assert!(request_body.contains("\"method\":\"getTransaction\""));
+    assert!(request_body.contains(PRE_004_ZERO_SIGNATURE_TEXT));
+    assert!(request_body.contains("\"commitment\":\"confirmed\""));
+    assert!(request_body.contains("\"encoding\":\"base64\""));
+    assert!(request_body.contains("\"maxSupportedTransactionVersion\":0"));
+    let ingress = match outcome {
+        super::RawTransactionIngestHydrationOutcome::Available(value) => value,
+        super::RawTransactionIngestHydrationOutcome::Missing(_) => return,
+    };
+    assert_eq!(ingress.provenance.provider().as_str(), "ys.fixture-provider:http.fixture-http-provider");
+    assert_eq!(ingress.provenance.protocol().as_str(), "yellowstone_http");
+    assert_eq!(ingress.provenance.acquisition_method().as_str(), "transaction_get_transaction");
+    assert_eq!(ingress.provenance.origin(), ksp_store_lib::RawAcquisitionOrigin::Live);
+    assert_eq!(ingress.provenance.received_at(), received_at);
+    assert_eq!(
+        ingress.provenance.endpoint_id().map(ksp_store_lib::RawProvenanceCode::as_str),
+        std::option::Option::Some("ys.yellowstone-fixture:http.http-hydration-fixture"),
+    );
+    assert_eq!(ingress.provenance.commitment().map(ksp_store_lib::RawProvenanceCode::as_str), std::option::Option::Some("confirmed"));
+    assert_eq!(ingress.provenance.capture_session_id().map(ksp_store_lib::RawProvenanceCode::as_str), std::option::Option::Some("worker-fixture"));
+    assert_eq!(ingress.provenance.filter_id().map(ksp_store_lib::RawProvenanceCode::as_str), std::option::Option::Some("tx-fixture"));
+    assert_eq!(ingress.provenance.observed_at().map(|value| return value.unix_millis()), std::option::Option::Some(1_760_000_123_456));
+    let (mut admission, sender) = crate::RawTransactionAdmission::new(1);
+    if sender.send(ingress).await.is_err() {
+        return;
+    }
+    std::mem::drop(sender);
+    let acquisition = match admission.receive(settings.network()).await {
+        std::result::Result::Ok(std::option::Option::Some(value)) => value,
+        _ => return,
+    };
+    assert_eq!(acquisition.transaction().reference().network().as_str(), "devnet");
+    assert_eq!(acquisition.transaction().reference().signature().as_bytes(), &[0_u8; 64]);
+    assert_eq!(acquisition.transaction().slot(), 42);
+    assert_eq!(acquisition.transaction().block_time().map(|value| return value.unix_millis()), std::option::Option::Some(1_760_000_120_000),);
+    assert_eq!(acquisition.observation().provenance().provider().as_str(), "ys.fixture-provider:http.fixture-http-provider");
+    return;
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn pre_004_finalized_hydration_preserves_request_and_provenance_commitment() {
+    let body = std::format!(
+        "{{\"jsonrpc\":\"2.0\",\"result\":{{\"slot\":42,\"blockTime\":1760000120,\"transaction\":[\"{}\",\"base64\"],\"meta\":null,\"version\":\"legacy\",\"transactionIndex\":7}},\"id\":1}}",
+        PRE_004_ZERO_TRANSACTION_BASE64,
+    );
+    let (url, server) = match serve_http_once(body) {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => return,
+    };
+    let source = match signal_source_for_http_url_with_commitment(url.as_str(), ksp_onchain_transport_lib::SolanaCommitment::Finalized) {
+        std::option::Option::Some(value) => value,
+        std::option::Option::None => return,
+    };
+    let settings = match pre_004_settings() {
+        std::option::Option::Some(value) => value,
+        std::option::Option::None => return,
+    };
+    let signal = match pre_004_signal(&source, super::RawTransactionIngestSourceFamily::Transaction, 42, 7, &["tx-fixture"], 0) {
+        std::option::Option::Some(value) => value,
+        std::option::Option::None => return,
+    };
+    let received_at = match ksp_store_lib::RawTimestamp::from_unix_millis(1_760_000_124_000) {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => return,
+    };
+    let outcome = match super::hydrate_yellowstone_signal(&source, &settings, signal, received_at).await {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => return,
+    };
+    let request = match server.join() {
+        std::result::Result::Ok(std::result::Result::Ok(value)) => value,
+        _ => return,
+    };
+    let request_body = http_request_body(request.as_str());
+    assert!(request_body.contains("\"commitment\":\"finalized\""));
+    assert!(request_body.contains("\"encoding\":\"base64\""));
+    assert!(request_body.contains("\"maxSupportedTransactionVersion\":0"));
+    let ingress = match outcome {
+        super::RawTransactionIngestHydrationOutcome::Available(value) => value,
+        super::RawTransactionIngestHydrationOutcome::Missing(_) => return,
+    };
+    assert_eq!(ingress.provenance.commitment().map(ksp_store_lib::RawProvenanceCode::as_str), std::option::Option::Some("finalized"));
+    return;
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn pre_004_get_transaction_null_is_missing_without_ingress_or_worker_retry() {
+    let (url, server) = match serve_http_once("{\"jsonrpc\":\"2.0\",\"result\":null,\"id\":1}".to_owned()) {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => return,
+    };
+    let source = match signal_source_for_http_url(url.as_str()) {
+        std::option::Option::Some(value) => value,
+        std::option::Option::None => return,
+    };
+    let settings = match pre_004_settings() {
+        std::option::Option::Some(value) => value,
+        std::option::Option::None => return,
+    };
+    let signal = match pre_004_signal(&source, super::RawTransactionIngestSourceFamily::TransactionStatus, 42, 7, &["status-fixture"], 0) {
+        std::option::Option::Some(value) => value,
+        std::option::Option::None => return,
+    };
+    let received_at = match ksp_store_lib::RawTimestamp::from_unix_millis(1_760_000_124_000) {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => return,
+    };
+    let outcome = match super::hydrate_yellowstone_signal(&source, &settings, signal, received_at).await {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => return,
+    };
+    let request = match server.join() {
+        std::result::Result::Ok(std::result::Result::Ok(value)) => value,
+        _ => return,
+    };
+    assert!(http_request_body(request.as_str()).contains(PRE_004_ZERO_SIGNATURE_TEXT));
+    let reference = match outcome {
+        super::RawTransactionIngestHydrationOutcome::Available(_) => return,
+        super::RawTransactionIngestHydrationOutcome::Missing(value) => value,
+    };
+    assert_eq!(reference.network().as_str(), "devnet");
+    assert_eq!(reference.signature().as_bytes(), &[0_u8; 64]);
+    return;
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn pre_004_v0_null_and_omitted_wire_fields_preserve_common_raw_semantics() {
+    let body = std::format!(
+        "{{\"jsonrpc\":\"2.0\",\"result\":{{\"slot\":42,\"blockTime\":null,\"transaction\":[\"{}\",\"base64\"],\"meta\":null,\"version\":0}},\"id\":1}}",
+        PRE_004_ZERO_TRANSACTION_BASE64,
+    );
+    let (url, server) = match serve_http_once(body) {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => return,
+    };
+    let source = match signal_source_for_http_url(url.as_str()) {
+        std::option::Option::Some(value) => value,
+        std::option::Option::None => return,
+    };
+    let settings = match pre_004_settings() {
+        std::option::Option::Some(value) => value,
+        std::option::Option::None => return,
+    };
+    let signal = match pre_004_signal(&source, super::RawTransactionIngestSourceFamily::Transaction, 42, 7, &["filter-a", "filter-b"], 0) {
+        std::option::Option::Some(value) => value,
+        std::option::Option::None => return,
+    };
+    let received_at = match ksp_store_lib::RawTimestamp::from_unix_millis(1_760_000_124_000) {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => return,
+    };
+    let outcome = match super::hydrate_yellowstone_signal(&source, &settings, signal, received_at).await {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => return,
+    };
+    let _request = match server.join() {
+        std::result::Result::Ok(std::result::Result::Ok(value)) => value,
+        _ => return,
+    };
+    let ingress = match outcome {
+        super::RawTransactionIngestHydrationOutcome::Available(value) => value,
+        super::RawTransactionIngestHydrationOutcome::Missing(_) => return,
+    };
+    let filter_id = match ingress.provenance.filter_id() {
+        std::option::Option::Some(value) => value.as_str(),
+        std::option::Option::None => return,
+    };
+    assert!(filter_id.starts_with("sha256."));
+    assert_eq!(filter_id.len(), 71);
+    let (mut admission, sender) = crate::RawTransactionAdmission::new(1);
+    if sender.send(ingress).await.is_err() {
+        return;
+    }
+    std::mem::drop(sender);
+    let acquisition = match admission.receive(settings.network()).await {
+        std::result::Result::Ok(std::option::Option::Some(value)) => value,
+        _ => return,
+    };
+    assert_eq!(acquisition.transaction().block_time(), std::option::Option::None);
+    let payload = match std::str::from_utf8(acquisition.transaction().payload().bytes()) {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => return,
+    };
+    assert!(payload.contains("\"meta\":null"));
+    assert!(payload.contains("\"version\":0"));
+    assert!(!payload.contains("transactionIndex"));
+    return;
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn pre_004_source_hydration_rejects_slot_index_signature_and_network_mismatch_before_admission() {
+    for (slot, index, transaction_data, expected_condition) in [
+        (43_u64, 7_u32, PRE_004_ZERO_TRANSACTION_BASE64, "hydration.slot_mismatch"),
+        (42_u64, 8_u32, PRE_004_ZERO_TRANSACTION_BASE64, "hydration.transaction_index_mismatch"),
+        (42_u64, 7_u32, PRE_004_OTHER_TRANSACTION_BASE64, "hydration.signature_mismatch"),
+    ] {
+        let body = std::format!(
+            "{{\"jsonrpc\":\"2.0\",\"result\":{{\"slot\":{},\"blockTime\":1760000120,\"transaction\":[\"{}\",\"base64\"],\"meta\":null,\"version\":\"legacy\",\"transactionIndex\":{}}},\"id\":1}}",
+            slot,
+            transaction_data,
+            index,
+        );
+        let (url, server) = match serve_http_once(body) {
+            std::result::Result::Ok(value) => value,
+            std::result::Result::Err(_) => return,
+        };
+        let source = match signal_source_for_http_url(url.as_str()) {
+            std::option::Option::Some(value) => value,
+            std::option::Option::None => return,
+        };
+        let settings = match pre_004_settings() {
+            std::option::Option::Some(value) => value,
+            std::option::Option::None => return,
+        };
+        let signal = match pre_004_signal(&source, super::RawTransactionIngestSourceFamily::Transaction, 42, 7, &["tx-fixture"], 0) {
+            std::option::Option::Some(value) => value,
+            std::option::Option::None => return,
+        };
+        let received_at = match ksp_store_lib::RawTimestamp::from_unix_millis(1_760_000_124_000) {
+            std::result::Result::Ok(value) => value,
+            std::result::Result::Err(_) => return,
+        };
+        let error = match super::hydrate_yellowstone_signal(&source, &settings, signal, received_at).await {
+            std::result::Result::Ok(_) => return,
+            std::result::Result::Err(error) => error,
+        };
+        let _request = match server.join() {
+            std::result::Result::Ok(std::result::Result::Ok(value)) => value,
+            _ => return,
+        };
+        assert_eq!(error.code(), crate::ERROR_CODE_RAW_TRANSACTION_INGEST_RUNTIME_INVALID);
+        assert!(error.context().iter().any(|context| return context.value() == expected_condition));
+    }
+    let source = match signal_source() {
+        std::option::Option::Some(value) => value,
+        std::option::Option::None => return,
+    };
+    let settings = match pre_004_settings() {
+        std::option::Option::Some(value) => value,
+        std::option::Option::None => return,
+    };
+    let mut signal = match pre_004_signal(&source, super::RawTransactionIngestSourceFamily::Transaction, 42, 7, &["tx-fixture"], 0) {
+        std::option::Option::Some(value) => value,
+        std::option::Option::None => return,
+    };
+    signal.network = match ksp_store_lib::RawNetworkId::new("mainnet") {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => return,
+    };
+    let received_at = match ksp_store_lib::RawTimestamp::from_unix_millis(1_760_000_124_000) {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => return,
+    };
+    let error = match super::hydrate_yellowstone_signal(&source, &settings, signal, received_at).await {
+        std::result::Result::Ok(_) => return,
+        std::result::Result::Err(error) => error,
+    };
+    assert_eq!(error.code(), crate::ERROR_CODE_RAW_TRANSACTION_INGEST_RUNTIME_INVALID);
+    assert!(error.context().iter().any(|context| return context.value() == "hydration.network_mismatch"));
+    return;
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn pre_004_status_provenance_and_future_source_timestamp_are_bounded_and_redacted() {
+    let source = match signal_source() {
+        std::option::Option::Some(value) => value,
+        std::option::Option::None => return,
+    };
+    let settings = match pre_004_settings() {
+        std::option::Option::Some(value) => value,
+        std::option::Option::None => return,
+    };
+    let mut signal = match pre_004_signal(&source, super::RawTransactionIngestSourceFamily::TransactionStatus, 42, 7, &["filter-b", "filter-a", "filter-a"], 0)
+    {
+        std::option::Option::Some(value) => value,
+        std::option::Option::None => return,
+    };
+    signal.created_at = std::option::Option::Some(super::RawTransactionIngestSourceTimestamp { seconds: 1_760_000_200, nanos: 0 });
+    let received_at = match ksp_store_lib::RawTimestamp::from_unix_millis(1_760_000_124_000) {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => return,
+    };
+    let provenance = match super::build_hydration_provenance(
+        &settings,
+        &signal,
+        "fixture-http-provider",
+        "http-hydration-fixture",
+        ksp_onchain_transport_lib::SolanaCommitment::Confirmed,
+        received_at,
+    ) {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => return,
+    };
+    assert_eq!(provenance.acquisition_method().as_str(), "status_get_transaction");
+    assert_eq!(provenance.observed_at(), std::option::Option::None);
+    let filter_id = match provenance.filter_id() {
+        std::option::Option::Some(value) => value.as_str(),
+        std::option::Option::None => return,
+    };
+    assert!(filter_id.starts_with("sha256."));
+    let debug = std::format!("{provenance:?}");
+    assert!(!debug.contains("filter-a"));
+    assert!(!debug.contains("filter-b"));
+    assert!(!debug.contains(PRE_004_ZERO_SIGNATURE_TEXT));
+    return;
+}