1 files changed, 15 insertions, 4 deletions

diff --git a/src/test_btfaddr.cpp b/src/test_btfaddr.cpp
index 8de426e..9d33d63 100644
--- a/src/test_btfaddr.cpp
+++ b/src/test_btfaddr.cpp
@@ -133,12 +133,23 @@ int main()
         std::string d3 = btf::SignDescriptor(ctx, sk, ENC_HEX, "node-1", 5, ONION);
         json j3 = json::parse(d3);
         j3["onion"] = "bcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcde.onion:8433";
-        CHECK(btf::VerifyDescriptor(ctx, j3.dump(), pk, o) && o.onion.empty(),
-              "tampered onion ignored rather than trusted");
+        CHECK(!btf::VerifyDescriptor(ctx, j3.dump(), pk, o),
+              "tampered onion rejects the descriptor");
         json j4 = json::parse(d3);
         j4["sig3"] = std::string(128, '0');
-        CHECK(btf::VerifyDescriptor(ctx, j4.dump(), pk, o) && o.onion.empty(),
-              "bad onion signature ignored rather than trusted");
+        CHECK(!btf::VerifyDescriptor(ctx, j4.dump(), pk, o),
+              "bad onion signature rejects the descriptor");
+        json j5 = json::parse(d3);
+        j5.erase("sig3");
+        CHECK(!btf::VerifyDescriptor(ctx, j5.dump(), pk, o),
+              "unsigned onion rejects the descriptor");
+        // Removing both fields still verifies: the result is indistinguishable
+        // from a peer that never had an onion endpoint. That residual strip
+        // needs the onion bound into the primary sig, an upstream change.
+        json j6 = json::parse(d3);
+        j6.erase("onion"); j6.erase("sig3");
+        CHECK(btf::VerifyDescriptor(ctx, j6.dump(), pk, o) && o.onion.empty(),
+              "full strip indistinguishable from no-onion (documented residual)");
     }
 
     printf("full_resolve_chain_from_address\n");