@@ -9,6 +9,68 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- **sparq-zk-compose:** verifier-side **authenticated commitment method**. The verifier no longer has
+  to assume which commitment method a committed graph was made under, and it does not read one from
+  the manifest either — it RECOVERS it from the issuer signature. `method_auth` builds one candidate
+  signed message per `CommitmentMethod::recognised()` method from values the verifier already
+  established (the commitment, the issuer-attested salt, the issuer-bound status reference, and the
+  attested holder digest when the attestation is holder-bound) plus the method-UNBOUND message, and
+  `classify` reports which one the presented signature verifies over: `AuthenticatedMethod::Bound(m)`
+  or `AuthenticatedMethod::Unbound`. `MethodPolicy` is the relying party's decision over the answer,
+  carried on the external trust anchor as `KeySet::with_method_policy` (the
+  `with_hidden_issuer_depth` precedent, so no public verifier signature changes):
+  `MethodPolicy::current()` is the default, `require_method_bound()` refuses an attestation that binds
+  no method (`CheckError::MethodNotAuthenticated`), and `admit_legacy_dual_leaf_v1()` is the
+  written-down opt-in for an attested superseded method (refused otherwise with
+  `CheckError::MethodNotAdmitted`); more than one method's message verifying is
+  `CheckError::AmbiguousMethod`. For a HIDDEN-ONLY commitment the method is selected by the hidden
+  entry's declared `message`, which must EQUAL one of the candidates — a value matching none of them
+  is refused with `CheckError::HiddenIssuerMessageMismatch`, and the policy applies to the method the
+  hidden-issuer proof is then required to bind. Every entry over a hidden-only commitment is checked,
+  and they must all select the same candidate, so the message check does not depend on the order
+  the entries are listed in. New PRESENTATION message shapes and signers in `sparq-zk`, each under its own
+  domain tag: `sig::presentation_message_with_status_and_scheme` (`ZKSIG_M5`, for a bearer
+  attestation) and `sig::commitment_message_with_holder_and_scheme`
+  (`ZKSIG_M4`, the one shape binding both a holder key and a method), signed with
+  `SecretKey::{sign_presentation_with_status_and_scheme, sign_commitment_with_holder_and_scheme}`. A
+  REGISTRY entry's own `ZKSIG_M3` signature is deliberately NOT a presentation attestation — recording
+  a commitment in an issuer's registry is a separate statement from authorising its presentation, so
+  presenting one as a clear attestation reports `CheckError::InvalidIssuerSignature`. Back-compatible
+  with ONE qualification, about the declared `message` of hidden-issuer entries: a hidden-issuer entry's declared `message` was previously not read at all,
+  and over a hidden-only commitment it is now required to equal a verifier-built candidate (for every
+  entry over that commitment), so a hidden-only manifest whose declared message is empty,
+  not decodable as a field element, or unmatched is now refused with `CheckError::HiddenIssuerMessageMismatch`;
+  a refusal of a malformed hidden-only manifest may also be reported earlier, in the pre-filter, than
+  it was before. The hidden-issuer stage likewise requires EVERY entry's declared `message`, including
+  one over a commitment that also has a clear attestation, to equal the message its proof is checked
+  against, and that check may now be reported ahead of an entry's depth or proof refusal. Otherwise
+  every manifest that verified before still verifies under the default
+  policy — an attestation over the method-unbound `ZKSIG_C3`/`ZKSIG_C4` message authenticates as
+  `Unbound`, which the default policy accepts, and a bad signature still reports
+  `CheckError::InvalidIssuerSignature`. The newly accepted manifests are only those carrying an
+  issuer signature over a method-bound PRESENTATION message (`ZKSIG_M5`/`ZKSIG_M4`). Not externally
+  audited (sq-qhy4); no soundness or
+  privacy property is claimed.
+- **sparq-zk:** `verify::fragment_typed_filters` re-derives a query's FILTER obligations keeping each
+  constant as the typed `oxrdf::Literal` the query spells (`verify::TypedQueryFilter { variable, op,
+  constant }`), for a relying party that needs the constant's datatype and lexical form rather than a
+  `u64`. It shares one private walker with `fragment_filters`, whose behaviour and error strings are
+  unchanged (a regression test asserts the messages verbatim), and widens the datatype axis only: the
+  admitted comparison shape is still `?var op <literal>` after the `const op ?var` flip, with
+  everything else fail-closed. Also `commit::CommitmentMethod::recognised()`, the enumeration
+  counterpart of `from_scheme_iri`.
+- **sparq-zk-compose:** `value_pin` holds the relying party's **pinned value-lane inputs** for the
+  dual-leaf lanes (OFF-by-default `dual-leaf` feature): given an authenticated `DualLeafV2` method and
+  a typed query FILTER, `expected_value_lane` / `check_value_lane_pin` state what a value-lane
+  sub-proof's member, lane constant (for the decimal lane, the scale it names), op, bound and verdict
+  would have to be, each equality failing closed with its own `PinError`; `scan_method` requires every
+  commitment a scan draws from to have authenticated the same method, and `check_lane_routed` refuses
+  a lane the whole-graph commitment builder does not route. **The value-lane verifier gates stay
+  CLOSED:** the unconditional stage-0 `CheckError::ValueLaneSubProofNotAccepted` refusal is unchanged
+  and still first, the stage-2 binding-edge operand match and `filter_edge_true` are untouched, and a
+  manifest every one of whose pins holds is still refused (a test asserts exactly that). Computing a
+  pin is not enforcing one; the gate-opening change is separate. Research-grade, not externally
+  audited (sq-qhy4); the value lanes carry the #769-accepted INV-VL downgrade (CR-G8).
 - **sparq-zk:** `dual_leaf_v2` is a second dual-leaf commitment method (`CommitmentMethod::DualLeafV2`,
   scheme IRI `https://sparq.dev/ns/zk#poseidon2-dualleaf-v2`) behind the OFF-by-default `dual-leaf`
   feature. It keeps V1's leaf shapes and re-derives the constants: lane constants in BLAKE3's
 
@@ -584,10 +584,13 @@ fn value_lane_field_hexes(
 ///
 /// PRECONDITION, stated plainly: this is a HOST-side boundary on what this crate
 /// builds, renders and proves, plus a structural pre-filter refusal verifier-side.
-/// The value-lane verifier GATES (`verifier.rs`'s stage-2 binding edges and
-/// `filter_edge_true`) stay closed until the verifier authenticates the commitment
-/// method and pins member, lane, scale and bound itself; a check here does not
-/// make a value-lane proof verifier-enforced.
+/// The verifier now does AUTHENTICATE the commitment method from the issuer
+/// signature ([`crate::method_auth`]) and can compute the member, lane, scale and
+/// bound a value-lane sub-proof would need ([`crate::value_pin`]) — but the
+/// value-lane verifier GATES are still CLOSED: `verifier.rs` refuses every
+/// value-lane sub-proof unconditionally at stage 0, and its stage-2 binding edges
+/// and `filter_edge_true` are unchanged. Neither a check here nor a computed pin
+/// makes a value-lane proof verifier-enforced.
 #[cfg(feature = "dual-leaf")]
 pub fn check_lane_const_for_member(
     circuit: &CircuitId,
 
@@ -47,6 +47,20 @@ pub mod value_lane;
 pub mod holder;
 pub mod issuer;
 pub mod manifest;
+// Verifier-side AUTHENTICATION of a commitment's commitment method from the
+// issuer signature (the method-bound `ZKSIG_M5`/`ZKSIG_M4` PRESENTATION message
+// family), plus the relying party's `MethodPolicy` over the result. Always
+// compiled: the method axis is not dual-leaf-specific. The default policy accepts a
+// method-UNBOUND attestation, so every already-issued credential authenticates
+// exactly as before. Opening a value-lane gate is NOT part of this; see
+// `value_pin`. Research-grade, NOT externally audited (sq-qhy4).
+pub mod method_auth;
+// The relying party's value-lane PIN functions: given an authenticated
+// `DualLeafV2` method and a typed query FILTER, what the value-lane public
+// inputs would have to be. Reporting only — the value-lane verifier gates stay
+// CLOSED (see the module docs).
+#[cfg(feature = "dual-leaf")]
+pub mod value_pin;
 // Research-grade disclosure obligations and PRIVATE successful-row witnesses.
 pub mod planner;
 // sq-rsd3v.3: witnessed-rule-shape N3 derivation — the host mirror of
@@ -102,6 +116,8 @@ pub use dispatch::{
 #[cfg(feature = "extended-fragment")]
 pub use verifier::{dispatch_fragment, verify_fragment_manifest, FragmentDispatchError};
 pub use verifier::EntailmentPolicy;
+// Verifier-side commitment-method authentication + the relying party's policy.
+pub use method_auth::{AuthenticatedMethod, MethodAuthError, MethodPolicy};
 // sq-3e5 + sq-h2v: hidden-index revocation host helpers.
 pub use revocation::{merkle_root, merkle_witness, revoke_prover_toml, MerkleWitness};
 // sq-6qe / sq-kndw: the ACCEPTED-SET commitment host helpers — the relying
 
@@ -2284,14 +2284,36 @@ pub struct HiddenIssuerAttestation {
     /// input). Checked byte-equal to the relying party's authoritative root.
     pub key_set_root: FieldHex,
     /// The issuer-signed commitment message `m` the proof binds (the proof's
-    /// PUBLIC input). Checked equal to the message the verifier recomputes from the
-    /// disclosed commitment + salt + status reference.
+    /// PUBLIC input).
+    ///
+    /// For a HIDDEN-ONLY commitment — one with no clear
+    /// [`CommitmentAttestation`] — this field is ENFORCED, on EVERY entry
+    /// declared over that commitment: each must EQUAL one of the candidate
+    /// messages the verifier builds from the disclosed commitment + salt +
+    /// status reference (the method-UNBOUND `ZKSIG_C3` message plus the
+    /// method-bound `ZKSIG_M5` message of each recognised commitment method),
+    /// and all of them must equal the SAME candidate. Which candidate that is
+    /// authenticates the commitment's method (`crate::method_auth`), and the
+    /// relying party's `MethodPolicy` then applies to that method; a value equal
+    /// to no candidate, one that does not decode, or two entries selecting
+    /// different candidates are refused
+    /// (`crate::verifier::CheckError::HiddenIssuerMessageMismatch`). The bb
+    /// stage additionally byte-compares the proof's public input against the
+    /// message the verifier recomputes for the authenticated method, so this
+    /// field cannot select one method and bind another.
+    ///
+    /// In ADDITIVE mode — a clear [`CommitmentAttestation`] over the same
+    /// commitment alongside the hidden proof — the method comes from the clear
+    /// signature instead, and the bb stage binds the hidden proof to the message
+    /// of THAT method. This declared field must still equal that message: the
+    /// hidden-issuer stage checks every entry's declared `m` against the message
+    /// its proof is checked against before decoding any proof.
     pub message: FieldHex,
     /// The per-graph RDFC10 bnode salt this commitment was committed under (audit
     /// #9), hex. Carried HERE so the verifier can recompute the issuer-signed
-    /// message `m = commitment_message_with_status(C(G), salt, status_ref)` for a
-    /// HIDDEN-ONLY commitment — one with NO clear [`CommitmentAttestation`] from
-    /// which to read the salt (sq-xxg). The salt is NOT the privacy target (only
+    /// message `m` over `(C(G), salt, status_ref)` for a HIDDEN-ONLY commitment —
+    /// one with NO clear [`CommitmentAttestation`] from which to read the salt
+    /// (sq-xxg). The salt is NOT the privacy target (only
     /// WHICH issuer signed is hidden); disclosing it is consistent with the clear
     /// path, and it still participates in the salt-uniqueness guarantee (audit #9).
     ///