Single utility.batchAll containing two Root-origin actions:

1. System.authorize_upgrade of the nexus-v7600 runtime (commit 8d09da1) — see the release page. The hashed code (0xecb7…2fda) ships four runtime fixes: a consensus-layer BSC adjacency fix, a Pharos non-existence proof anchoring fix, a call-filter bypass fix in the call decompressor (also drops pallet_bridge_airdrop entirely), and replacing several panicking unwrap/expect paths with proper error propagation.
2. IsmpOptimism.set_dispute_game_factories for Base mainnet — repoints the on-chain dispute-game configuration to a single supported game type: AggregateVerifier (gameType = 621) with implementation address 0xEECb8a5944b217585817E802702B1262A049d259. The factory address (0x43edB88C4B80fDD2AdFF2412A7BebF9dF42cB40e) is unchanged.

Encoded call

0x0402080009ecb7f0bd1a5576c6b97e5dfa623ef2161acd5e5a275779b19d83dee717202fda5a0200052100004241534543edb88c4b80fdd2adff2412a7bebf9df42cb40e046d020000eecb8a5944b217585817e802702b1262a049d25902

Call	Utility.batchAll([authorize_upgrade, set_dispute_game_factories])
Length	94 bytes
Keccak-256 (call hash)	0x6a6da17356f03b13bbf1a181380e038a7cd2f21e1bcb5c1b699261d408d4a9ce
Declared weight (+10 % buffer)	Weight::from_parts(334_137_665, 0)

Runtime details (nexus-v7600)

Source: GitHub release page.

• Build: rustc 1.91.1 (ed61e7d7e 2025-11-07)
• Runtime size: 1.92 MiB (2 010 173 bytes)
• Core version: nexus-7600
• Metadata: V14
• Keccak-256 wasm hash: 0xecb7f0bd1a5576c6b97e5dfa623ef2161acd5e5a275779b19d83dee717202fda ← matches the authorize_upgrade argument above

Changes shipping in this runtime

1. #954 — Enforce BSC vote adjacency (consensus-layer safety fix)

verify_bsc_header was committing headers as finalized whenever a justified target was observed, without checking that the source/target pair satisfied the BEP-126 adjacency condition (target.number == source.number + 1 && target.parent_hash == source_hash). Non-adjacent votes leave headers merely justified and still subject to reorganization, so their state roots are unsafe to commit as final. The fix adds the adjacency check and rejects non-adjacent justifications. Also guards an unchecked copy_from_slice into a fixed-size ConsensusStateId array (panic risk on malformed input). Includes regression tests.

2. #944 — Anchor non-existence sibling proofs at the deepest ancestor (proof-forgery fix)

Non-existence proofs were sourcing sibling evidence from empty terminal nodes rather than from the deepest ancestor with non-empty non-path slots, which mismatched the actual Pharos RPC proof shape. A real membership proof could be re-shaped into a fake non-existence proof by moving the child hash into a sibling slot and appending an all-zero terminal. The fix anchors at the deepest ancestor with valid siblings.

3. #941 — Filter unwanted calls in pallet_call_decompressor (call-filter bypass fix)

The call decompressor was dispatching decompressed inner calls directly via pallet internals, bypassing the runtime's BaseCallFilter. The PR routes the decompressed call through the filter both in validate_unsigned (so blocked calls are rejected at txpool entry) and in decode_and_execute (so they're rejected at execution). Also removes the BridgeDrop (pallet_bridge_airdrop) pallet from the runtime and workspace and bumps the spec version.

4. #945 — Replace panicking unwrap/expect with proper error propagation

Converts several expect() / unwrap() paths in pallet-beefy-consensus-proofs, the ISMP core timeout handler, and adjacent modules into Result-returning paths that propagate through existing error variants. Reduces the runtime's panic surface; no behavioral change on the happy path.

Base dispute-game configuration change

pallet_ismp_optimism::set_dispute_game_factories(state_machine_id, factory, configs) overwrites the existing entry's factory and configs for the given state machine. The current Base entry (set in the previous governance batch) supports three game types — CANNON (0), PERMISSIONED (1), AggregateVerifier (621). After this referendum the supported set becomes a single entry:

Field	Value
state_machine_id.state_id	Evm(8453) (Base)
state_machine_id.consensus_state_id	"BASE"
dispute_game_factory	0x43edB88C4B80fDD2AdFF2412A7BebF9dF42cB40e (unchanged)
game_type_configs	[{ game_type: 621, expected_impl: 0xEECb8a5944b217585817E802702B1262A049d259, kind: AggregateVerifier }]

Effect: after enactment, only gameType = 621 games whose gameImpls[621] in the factory equals 0xEECb…d259 will be accepted as fault-proof attestations for Base. The CANNON (gameType = 0) and PERMISSIONED (gameType = 1) entries currently in storage are dropped.

The implementation address shipped here (0xEECb…d259) differs from the AggregateVerifier impl previously installed (0x4c0D…3028), suggesting an AggregateVerifier redeployment on Base. Voters should verify on the Base block explorer that:

1. The new implementation address is the canonical, currently-deployed AggregateVerifier on Base, and
2. The factory's gameImpls[621] storage slot returns this address.

If the CANNON / PERMISSIONED entries are still needed in parallel, this call needs to include them — the storage entry is overwritten wholesale.

How to verify before voting

1. Pull the preimage from Preimage::PreimageFor((0x6a6da173…d4a9ce, 94)).
2. Confirm keccak256(preimage) == 0x6a6da17356f03b13bbf1a181380e038a7cd2f21e1bcb5c1b699261d408d4a9ce.
3. Decode in Polkadot.js → Developer → Extrinsics → Decode and confirm the two inner calls match the breakdown above.
4. Confirm the runtime code at 0xecb7…2fda is the artifact published at the nexus-v7600 release. The artifact's keccak-256 is printed under "Runtime Information" on the release page.
5. After enactment, the actual runtime swap requires a follow-up System.applyAuthorizedUpgrade(code) carrying the same wasm bytes — anyone can submit it.