fix: refuse invalid EU registry payloads by default

[LKSNDRTMLKV]

Makes EU registry payload validation fail closed, behind an explicit override.

Draft — do not merge standalone. Implementing this surfaced a structural gap
that has to be closed in the same release. See "Why this is a draft".

What changed

Registration previously logged "failed B1 validation — sending anyway (pre-go-live)" and submitted regardless. That comment is now stale — the
registry became operational on 20 July 2026, and IR (EU) 2026/1778 Art. 19(2)
obliges the operator to keep registry information "accurate, complete and up to
date at all times", with the registry applying its own conformity checks on
submission (Art. 8(7)).

Now: an invalid payload is refused, with a metric and an error log. The escape
hatch is EuRegistrySyncConfig::allow_invalid_payloads, wired from
EU_REGISTRY_ALLOW_INVALID_PAYLOADS and off unless explicitly set — the safe
behaviour is the one you get by doing nothing. It exists because our local rules
are an interpretation of the spec and may themselves produce a false positive
that shouldn't need a code change to work around.

What this uncovered

Every HTTP-layer register test was submitting a payload that does not
validate. The fixture carried an empty country_code and data_carrier_uri;
fail-open meant the only signal was a warn! nobody asserted on. Five tests
failed the moment refusal was added. The fixture is now realistic.

Why this is a draft

Fixing the fixture only got as far as operatorId.name. RegistrationPayload
requires it non-empty, and RegistrationRequest has no operator legal-name
field — mapping.rs hardcodes name: String::new(), with a comment already
admitting "the operator legal name is not yet threaded through the port".

So no registration this node can currently build passes its own validation.
The fail-open was load-bearing for that gap, not merely lax. Merging this alone
would convert a silent defect into a refusal of every registration the moment
anyone sets EU_REGISTRY_CLIENT_ID.

The test suite is green here only because the HTTP-layer tests opt into the
override, each marked with a comment to remove it once the port carries the name.

Recommended sequencing

Bundle with the next core minor, alongside adding an operator legal name to
RegistrationRequest — the same batch as notify_transfer(&TransferRecord),
which is blocked on the same class of gap (a port that cannot express what the
registry requires). Two port fixes, one breaking release, then this becomes
deployable and the test opt-ins come out.

Verification

cargo test -p dpp-node --lib — 38/38. fmt and clippy clean.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 5 complexity · 4 duplication

Metric	Results
Complexity	5
Duplication	4

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}