[portlandhodl]

What

One multisig overhaul, rebased onto current rock:

1. Output-descriptor engine in the WASM crate (el_desc_derive, new entropylab-wasm/src/descriptor.rs). rust-miniscript 13.1.0 (exact pin, committed Cargo.lock) parses descriptors — BIP380–386 key expressions, xpub and xprv/WIF alike, a supplied #checksum verified — and derives the address, scriptPubKey, and participant keys at a child index.
2. Multisig wallets derive from their exported descriptors. hodlBuildMsig derives each address from the branch descriptor itself, so the addresses shown cannot drift from the watch-only descriptor the wallet exports (previously two parallel code paths). hodlMsigAddr (used by address-match) goes through the same engine. Sorting moves from a JS byte-compare into sortedmulti/sortedmulti_a descriptor semantics. Co-signer identity defenses unchanged — the engine returns the derived participant keys and the final no-repeated-key check stays verbatim.
3. Co-signer trailing paths: full preservation + fuzz gate. A paste like [fd802fac/48h/0h/0h/2h]Zpub…/0/1/0 used to die as "Invalid Base58Check string". Now a trailing numeric path is honored in full as descriptor key derivation — a bare xpub…/1 (the key-reuse flow), a deep xpub…/0/0/20, and a deep signer export with the branch wildcard xpub…/0/0/20/* alike; the exported descriptor carries every step before the branch step (xpub/0/0/20/* exports as xpub/0/0/20/<0;1>/*), and the engine-derived addresses match it by construction (point 2). The only decoration is the branch marker itself: a sole /0/*, the multipath /<0;1>/*, a lone trailing slash, and the BIP45 cosigner step. The parser tokenizes the tail instead of regex-stripping: a wildcard is only legal last, a multipath step only last-but-wildcard and after plain numbers, anything else fails loudly. The field filter keeps * and < > ; so a pasted /<0;1> reaches the parser unmangled instead of being silently honored as a made-up numeric path (/01); honored steps are canonicalized (/01 exports as /1); the paste hint says when branches derive below an honored path; and the key-origin purpose decodes the multisig script type for the singlesig BIPs (m/44h → Legacy P2SH, m/49h → Nested SegWit, m/84h → Native SegWit). The fuzzer pins both legs — decoration byte-identity and honored-path correctness (with and without the wildcard) — against an independent scure stack.

Rebase notes (vs the original push)

• Trailing-path semantics reconciled with rock's key-reuse feature (Add Station workflows and cross-station key selection #248-era): the original push stripped all tails, then honored only ≥3-step tails as fixed steps, which would have broken the merged per-co-signer pickers (xpub…/1 reuse). The landed rule is the union of both designs: every trailing numeric path is honored in full (any depth, with or without the wildcard), and only the sole branch marker (/0/*, /<0;1>/*) is decoration. One merged-test expectation changes deliberately: msig-key-derivation-path.test.mjs now expects /1/0/* → 1/0 (deep tail preserved) instead of 1; the test comment says why.
• The "Multisig Edit input restores the wallet's own inputs" commit reduced to its browser-level regression test: the behavior itself was already on rock via Restore folder tabs, Edit input memory, and LifeHash rename #237 (hodlEditMsigInputs/hodlFillMsigLabFromWallet).
• Identifier-rename fallout from b82af0f fixed in passing: descriptor.rs calls network_from_selector, and the crate's own test module + doc comments referenced the pre-rename secp_alloc/secp_free (broke cargo test on rock itself — CI only builds the crate).

Scope notes

Taproot sortedmulti_a is layered on top of rust-miniscript in the crate (derived, sorted as x-only bytes, rewritten to the multi_a it denotes — the emitted descriptor text is unchanged). Multipath <0;1> descriptors are refused by the derive call (one call = one output); the exported multipath form is display/import text, as before. The original push also carried BIP390 musig() key expressions (hand-layered BIP327/328, upstream support still in review at rust-bitcoin/rust-miniscript#954) — dropped for now in the tip commit; a descriptor containing musig() fails loudly in rust-miniscript's parser. It can return once upstream ships it.

Notes

• Addresses and descriptors are byte-identical to before for every existing flow — proven by the untouched scure differential sweep in msig-address-kinds.test.mjs, now exercising the engine path.
• The fuzzer (fuzzing/msig/, own pinned scure tree, deterministic seeds) immediately caught a real case: a lone trailing / survived the first cut of the strip — included as a regression test.
• src/js/entropylab-wasm-b64.js regenerated and committed per convention (CI rebuilds from the Rust sources and tests the fresh build). Artifact grows ~520 KB of wasm for miniscript; entropylab.html rebuilt in the tip artifact commit per convention (artifact job rebuilds it again after merge).
• Pre-existing, unrelated: test/descriptor.test.mjs's local independentChecksum uses non-BIP380 constants and compares against itself, so its checksum assertions are circular. Not fixed here; this PR's fuzzer does validate real descriptor checksums against the engine, so the gap is covered for the multisig outputs.
• fuzz-msig added to the artifact and deploy gate lists; the validate.test.mjs pins updated, matching how fuzz-lifehash was gated (d0956f0).

Verified

• cargo test: 4/4 (BIP67-style multisig wrapped forms, BIP86 vector, sortedmulti_a wallet vector, allocator)
• npm test (tracked suites): 849 pass / 0 fail (1 pre-existing Edge-absent skip)
• npm run build && npm run verify; npm run test:browser (Firefox, Chrome)
• npm --prefix fuzzing run fuzz:msig: 1000 configs / 18,856 checks, 0 mismatches; fuzz:lifehash clean