Upgrade the Registry Canister to Commit 3e64518

Upgrade the Registry Canister to Commit 3e64518

__Proposer__: daniel.wong at dfinity.org

__Source code__: [3e645182ac06c7b761040615db4e3d44a8349351][new-commit]

[new-commit]: https://github.com/dfinity/ic/tree/3e645182ac06c7b761040615db4e3d44a8349351

Features & Fixes

Added

• Enforce that every hostos_version_id matches its HostosVersionRecord's registry key.

Changed

• The engine controller canister may now set the state limits in UpdateSubnet's resource_limits

(maximum_state_size, maximum_state_delta) on CloudEngine subnets. A limit it leaves unset keeps its current value instead of being reset, and the query limits remain governance-only.

• UpdateSubnet can now enable SEV on an existing subnet, not only at subnet creation. Disabling SEV

is still rejected, and enabling it only succeeds if the subnet's nodes all have a chip ID and its GuestOS version has launch measurements, as the SEV invariants demand.

• replica_version_id on ReplicaVersionRecord is no longer optional in code.

Setting this field has been mandatory for some time, and any previous records with unset values have been backfilled.

New Commits

$ git log --format="%C(auto) %h %s" 0e0e15dbf24b6a0d9a1b7bba459d087eb5cd7125..3e645182ac06c7b761040615db4e3d44a8349351 --  ./rs/registry/canister
 e80ce41188 feat: Make `replica_version_id` on `ReplicaVersionRecord` mandatory (#10943)
 63761b213d feat(engine-controller): Let the engine controller set a cloud engine's state limits (#11863)
 38859bc06a chore: Enforce that stored HostOS versions match their keys (#11859)
 798c58a533 refactor(registry): Cleanup registry invariant helpers (#11136)
 a1a4e35f37 feat(registry): Allow enabling SEV on a subnet. (#11482)
 ac25500728 docs(nervous-system): Update changelogs 2026-10-09. (#11799)

Current Version

__Current git hash__: 0e0e15dbf24b6a0d9a1b7bba459d087eb5cd7125

__Current wasm hash__: c4e0a180efe41d57ca9936738521b7982460c99a114c366d094235c5cdbd7333

Verification

See the general instructions on [how to verify] proposals like this. A "quick start" guide is provided here.

[how to verify]: https://github.com/dfinity/ic/tree/3e645182ac06c7b761040615db4e3d44a8349351/rs/nervous_system/docs/proposal_verification.md

WASM Verification

See ["Building the code"][prereqs] for prerequisites.

[prereqs]: https://github.com/dfinity/ic/tree/3e645182ac06c7b761040615db4e3d44a8349351/README.adoc#building-the-code

# 1. Get a copy of the code.
git clone git@github.com:dfinity/ic.git
cd ic
# Or, if you already have a copy of the ic repo,
git fetch
git checkout 3e645182ac06c7b761040615db4e3d44a8349351

# 2. Build canisters.
./ci/container/build-ic.sh -c

# 3. Fingerprint the result.
sha256sum ./artifacts/canisters/registry-canister.wasm.gz

This should match wasm_module_hash field of this proposal.