@logswap/sdk 0.5.55 → 0.5.57

package/README.md

@@ -1,6 +1,6 @@
 # logswap-sdk
 
-TypeScript SDK for [Logswap](https://github.com/logswap/logswap-contract), the liquidity
+TypeScript SDK for [Logswap](https://logswap.org), the liquidity
 primitive introducing the **logarithmic invariant** — typed wrappers over the `CPoolManager` /
 `FPoolManager` / `LogswapRouter` / `LogswapLens` surface.
 
@@ -38,48 +38,6 @@ Both are computed **offline** — no RPC, no deployment needed to address a mark
   `fPoolShareBalance`, `fPoolShareValue`; `previewZapIn` reads the **lens** (the router's F flows
   live in a facet, its previews moved to the lens).
 
-## The derivation gate
-
-Both derivations are **tier-1 frozen** (`docs/app.md`): `poolId` is the primary key of the entire
-read model, and the position id is `(1 << 255) | (keccak256(poolId ‖ packed) >> 1)`, baked into every
-client. If the TypeScript and the Solidity disagree, a client addresses the wrong pool or the wrong
-position — silently, with funds behind it.
-
-So `test/derivation.test.ts` checks against **vectors generated by the contract**, not by hand:
-
-```bash
-npm run vectors   # regenerate from the pinned contracts
-npm test          # 45 vectors × poolId, positionId, pack/unpack round-trip
-```
-
-That makes it a genuine cross-implementation check. It is also verified non-vacuous: changing the
-id derivation's shift by one bit fails all 45 position-id vectors.
-
-A diff in `vectors/derivation-vectors.json` during an ordinary change means something is wrong — by
-definition, a change there is a tier-1 event.
-
-## The pipeline
-
-```
-logswap (forge)  ──►  contracts/abi/*.json  ──►  wagmi codegen  ──►  src/generated.ts
-      ▲                                                                     │
-  contracts.ref (pinned SHA)                                        the SDK wrappers
-```
-
-Nothing is ever hand-copied. `contracts.ref` pins the SHA; `npm run codegen` clones it, builds, and
-regenerates; `tsc` is the drift gate, so a contract change that breaks the SDK is a red build rather
-than a runtime surprise.
-
-```bash
-npm run codegen     # sync the pinned contracts, forge build, wagmi generate -> src/generated.ts
-npm run typecheck   # consumes generated.ts; run codegen first on a fresh checkout
-npm run build
-npm test
-```
-
-`typecheck` and `build` both *consume* `src/generated.ts` and neither produces it, so codegen
-runs once and explicitly rather than being chained into both.
-
 ## Conventions
 
 - **The SDK hides the manager/router/lens split.** Which contract hosts which action is currently
@@ -97,38 +55,7 @@ runs once and explicitly rather than being chained into both.
 npm i @logswap/sdk viem
 ```
 
-Published as **`@logswap/sdk`** from v0.5.35. Everything up to v0.5.34 was
-`@unimodular/logswap-sdk`, which is deprecated and points here — the code is identical, only the
-name moved, along with the repos to the `logswap` org.
+Published as **`@logswap/sdk`** from v0.5.35; earlier versions used another name.
 
 `viem` is a peer dependency. The package ships `dist/` plus `src/`, including the generated ABIs, so
 the contract surface it was built against travels with it.
-
-## Release
-
-Push-driven, and there is **no npm token anywhere**: publishing uses OIDC trusted publishing, so npm
-verifies a GitHub-issued token per run and there is no long-lived credential to rotate or leak.
-
-```
-logswap-contract push
-   → Update SDK contracts pin   (GitHub App token, cross-repo)
-   → commit contracts.ref here
-   → Release on contracts pin change
-   → codegen at the pinned SHA → build → test → version bump → npm publish
-```
-
-`workflow_dispatch` covers SDK-only fixes with no contracts change: same pipeline, manual trigger.
-The version bump touches `package.json` only, not `contracts.ref`, so it cannot re-trigger itself.
-
-Two things that are easy to get wrong:
-
-- **`codegen` must run before `typecheck`.** `src/generated.ts` is gitignored, so it exists on a
-  developer machine and never in CI — a `typecheck`-first pipeline fails only in CI, which is where
-  it is least convenient to debug.
-- **No provenance since 0.5.55.** The repository went private (2026-09-24), and npm generates no
-  provenance from a private source repo; every release after 0.1.0 up to 0.5.54 carries it.
-  Trusted publishing is unaffected.
-  Put `--provenance` back in `release.yml` if the repo is made public again.
-- **`0.1.0` has no provenance attestation either.** Trusted publishing cannot be
-  configured for a package that does not exist yet, so the first publish is necessarily manual.
-  `prepublishOnly` runs the build, so a hand-run publish cannot ship a stale `dist/`.

package/dist/actions.d.ts

@@ -1,5 +1,5 @@
 /**
- * actions.ts — the router's transaction: a BATCH (decisions 010).
+ * actions.ts — the router's transaction: a BATCH.
  *
  * `execute(actions, settle)` runs a list of actions — mint, burn, update, claim, swap, path, in any
  * order, across any C markets — under ONE manager lock. Each action accrues deltas on the router

package/dist/actions.js

@@ -1,5 +1,5 @@
 /**
- * actions.ts — the router's transaction: a BATCH (decisions 010).
+ * actions.ts — the router's transaction: a BATCH.
  *
  * `execute(actions, settle)` runs a list of actions — mint, burn, update, claim, swap, path, in any
  * order, across any C markets — under ONE manager lock. Each action accrues deltas on the router

package/dist/admin.d.ts

@@ -1,12 +1,12 @@
 /**
  * admin — the protocol's writes: the C manager's cut of the mint fee (the F manager's is a
- * constant, decisions 049), the policies a pool may be born with (the registry's), the
+ * constant), the policies a pool may be born with (the registry's), the
  * policies' own numbers, and the two-step collector handover. Plain writes to the managers,
  * the registry and the policies; no router.
  *
- * One vocabulary (decisions 040): both managers call the protocol's cut of the mint fee
+ * One vocabulary: both managers call the protocol's cut of the mint fee
  * `MINT_FEE_PROTOCOL_CUT`; C sets it through `setFeeParams(uint256)`, F holds it as a constant
- * (049). The harvest's cut is the policy's answer at every harvest (decisions 044), set on the
+ * (049). The harvest's cut is the policy's answer at every harvest, set on the
  * policy (`setHarvestCut`) and capped by the manager (`HARVEST_CUT_MAX`); the release's
  * protocol share likewise (`POT_CUT_MAX`).
  */
@@ -15,7 +15,7 @@ import type { LogswapClient } from "./client.js";
 import { type FPoolKind } from "./fpool.js";
 /** The C manager's `setFeeParams(mintFeeProtocolCut)` — one cut. */
 export declare function setFeeParamsC(c: LogswapClient, mintFeeProtocolCutWad: bigint): Promise<Hash>;
-/** The F manager's `MINT_FEE_PROTOCOL_CUT` — a constant since F version 18 (decisions 049); there is no setter. */
+/** The F manager's `MINT_FEE_PROTOCOL_CUT` — a constant since F version 18; there is no setter. */
 export declare function fMintFeeProtocolCut(c: LogswapClient): Promise<bigint>;
 /**
  * The policy registry the F manager asks at every birth — `addresses.policyRegistry` when the
@@ -28,7 +28,7 @@ export declare function policyApproved(c: LogswapClient, policy: Address): Promi
 /** One policy on the registry's list, with what it says it is. */
 export interface RegistryEntry {
     policy: Address;
-    /** The policy's own `kind()` tag (decisions 049) — what a pool born under it is. */
+    /** The policy's own `kind()` tag — what a pool born under it is. */
     kind: FPoolKind;
     name: string;
     /** The block it closes to new pools from; 0 = open. */
@@ -37,7 +37,7 @@ export interface RegistryEntry {
     approved: boolean;
 }
 /**
- * Every policy listed, sunset ones included — one flat list (decisions 049), each with the kind
+ * Every policy listed, sunset ones included — one flat list, each with the kind
  * it says it is; `kind` narrows it to one, which is what a create form's dropdown reads. Empty
  * with no registry.
  */
@@ -62,7 +62,7 @@ export declare function registryAcceptOwner(c: LogswapClient): Promise<Hash>;
  */
 export declare function setPolicyApproved(c: LogswapClient, policy: Address, approved: boolean): Promise<Hash>;
 /**
- * Move a pool to another approved policy of the same kind (decisions 046, 049): the registry
+ * Move a pool to another approved policy of the same kind: the registry
  * owner's alone, orchestrated on the registry — `migrate(manager, poolId, to)`. The new policy
  * takes the authority and the name from the old; the operator and the lists void; no swap lands
  * in the block.

package/dist/admin.js

@@ -1,12 +1,12 @@
 /**
  * admin — the protocol's writes: the C manager's cut of the mint fee (the F manager's is a
- * constant, decisions 049), the policies a pool may be born with (the registry's), the
+ * constant), the policies a pool may be born with (the registry's), the
  * policies' own numbers, and the two-step collector handover. Plain writes to the managers,
  * the registry and the policies; no router.
  *
- * One vocabulary (decisions 040): both managers call the protocol's cut of the mint fee
+ * One vocabulary: both managers call the protocol's cut of the mint fee
  * `MINT_FEE_PROTOCOL_CUT`; C sets it through `setFeeParams(uint256)`, F holds it as a constant
- * (049). The harvest's cut is the policy's answer at every harvest (decisions 044), set on the
+ * (049). The harvest's cut is the policy's answer at every harvest, set on the
  * policy (`setHarvestCut`) and capped by the manager (`HARVEST_CUT_MAX`); the release's
  * protocol share likewise (`POT_CUT_MAX`).
  */
@@ -24,11 +24,11 @@ function write(c, address, abi, functionName, args) {
 export async function setFeeParamsC(c, mintFeeProtocolCutWad) {
     return write(c, c.addresses.cPoolManager, cPoolManagerAbi, "setFeeParams", [mintFeeProtocolCutWad]);
 }
-/** The F manager's `MINT_FEE_PROTOCOL_CUT` — a constant since F version 18 (decisions 049); there is no setter. */
+/** The F manager's `MINT_FEE_PROTOCOL_CUT` — a constant since F version 18; there is no setter. */
 export async function fMintFeeProtocolCut(c) {
     return c.public.readContract({ address: c.addresses.fPoolManager, abi: fPoolManagerAbi, functionName: "MINT_FEE_PROTOCOL_CUT" });
 }
-// ─── the registry (decisions 046): the LOG authority's, not the collector's ─────────────────
+// ─── the registry: the LOG authority's, not the collector's ─────────────────
 const ZERO = "0x0000000000000000000000000000000000000000";
 /**
  * The policy registry the F manager asks at every birth — `addresses.policyRegistry` when the
@@ -48,7 +48,7 @@ export async function policyApproved(c, policy) {
     return c.public.readContract({ address: registry, abi: policyRegistryAbi, functionName: "isApproved", args: [policy] });
 }
 /**
- * Every policy listed, sunset ones included — one flat list (decisions 049), each with the kind
+ * Every policy listed, sunset ones included — one flat list, each with the kind
  * it says it is; `kind` narrows it to one, which is what a create form's dropdown reads. Empty
  * with no registry.
  */
@@ -111,7 +111,7 @@ export async function setPolicyApproved(c, policy, approved) {
     return approved ? registryApprove(c, policy, await fPoolKindOfPolicy(c, policy)) : registryRevoke(c, policy);
 }
 /**
- * Move a pool to another approved policy of the same kind (decisions 046, 049): the registry
+ * Move a pool to another approved policy of the same kind: the registry
  * owner's alone, orchestrated on the registry — `migrate(manager, poolId, to)`. The new policy
  * takes the authority and the name from the old; the operator and the lists void; no swap lands
  * in the block.

package/dist/claims.js

@@ -59,40 +59,21 @@ export async function isRouterApproved(c, owner) {
     });
 }
 export async function checkReadiness(c, key, owner, need = {}) {
-    const erc20 = [
-        {
-            type: "function",
-            name: "allowance",
-            stateMutability: "view",
-            inputs: [
-                { name: "owner", type: "address" },
-                { name: "spender", type: "address" },
-            ],
-            outputs: [{ type: "uint256" }],
-        },
-    ];
-    const [operator, baseAllow, quoteAllow] = await Promise.all([
+    // A token is ready when BOTH legs of its pull path are: the ERC-20 allowance to whoever pulls
+    // (Permit2 when wired) and, with Permit2, its unexpired allowance to the router. This used to
+    // read the ERC-20 allowance to the ROUTER, which on a Permit2 deployment is never granted — so
+    // it said "approve" forever, and approving the router changed nothing.
+    const { checkTokenReadiness } = await import("./onboard.js");
+    const ready = async (token, amount) => {
+        if (amount === undefined)
+            return true;
+        const r = await checkTokenReadiness(c, token, owner, amount);
+        return !r.needsTokenApproval && !r.needsPermit2Approval;
+    };
+    const [operator, baseOk, quoteOk] = await Promise.all([
         need.positions ? isRouterApproved(c, owner) : Promise.resolve(true),
-        need.base
-            ? c.public.readContract({
-                address: key.base,
-                abi: erc20,
-                functionName: "allowance",
-                args: [owner, c.addresses.router],
-            })
-            : Promise.resolve(0n),
-        need.quote
-            ? c.public.readContract({
-                address: key.quote,
-                abi: erc20,
-                functionName: "allowance",
-                args: [owner, c.addresses.router],
-            })
-            : Promise.resolve(0n),
+        ready(key.base, need.base),
+        ready(key.quote, need.quote),
     ]);
-    return {
-        needsOperator: !operator,
-        needsBaseAllowance: need.base !== undefined && baseAllow < need.base,
-        needsQuoteAllowance: need.quote !== undefined && quoteAllow < need.quote,
-    };
+    return { needsOperator: !operator, needsBaseAllowance: !baseOk, needsQuoteAllowance: !quoteOk };
 }

package/dist/client.d.ts

@@ -22,7 +22,7 @@ export interface LogswapAddresses {
      */
     fPoolManager?: Address;
     /**
-     * The protocol's four F policies, one per kind (decisions 044): every F pool names one in its key,
+     * The protocol's four F policies, one per kind: every F pool names one in its key,
      * and the pool's roles, gates and terms live on it. A deployment predating them carries none.
      */
     publicPolicy?: Address;
@@ -30,7 +30,7 @@ export interface LogswapAddresses {
     polPolicy?: Address;
     padPolicy?: Address;
     /**
-     * The policy registry (decisions 046): what a pool of each kind may be born under, and the
+     * The policy registry: what a pool of each kind may be born under, and the
      * owner that may move a pool between policies. Read from the F manager (`registry()`) when
      * absent; a deployment with none asks nobody.
      */
@@ -62,18 +62,18 @@ export declare function createLogswapClient(args: {
  * manager sailed through `assertVersion` while `FEE_MAX()` still answered on it. Move this in the
  * same change as `CParams.VERSION`, never after it.
  *
- * **3** since 2026-09-03 (contracts `d8406fb`): `burnById` and `update` take an `owner`, `update`
+ * **3** since 2026-09-03: `burnById` and `update` take an `owner`, `update`
  * mints to `to`, `positions()` returns `aps` as uint128 — and a returned quote flow now carries the
- * swept fees (decisions 018), which is why `exit`'s settle-to-one-asset math changed with it.
+ * swept fees, which is why `exit`'s settle-to-one-asset math changed with it.
  *
- * **4** since 2026-09-18 (decisions 042 + 040): `PoolKey` is `(base, quote, tickSpacing, phi)` —
+ * **4** since 2026-09-18: `PoolKey` is `(base, quote, tickSpacing, phi)` —
  * the variance kernel and its two key fields are gone, so every pool id changed; `phiEff` is
  * `phiOf`; `getPool` lost `sigma2Ema`; `Initialize` lost two fields; the cut is
  * `MINT_FEE_PROTOCOL_CUT` / `setFeeParams`.
  */
 export declare const EXPECTED_VERSION = 4n;
 /**
- * The F manager's own tag (contracts 25a7bcf: 5 — the key's salt, pool names, the sponsor registry;
+ * The F manager's own tag (5 — the key's salt, pool names, the sponsor registry;
  * 4 was the income-only harvest cut).
  *
  * A FLOOR, not an equality — unlike `EXPECTED_VERSION` above. The F primitive is iterating fast and
@@ -85,3 +85,10 @@ export declare const EXPECTED_VERSION = 4n;
  */
 export declare const EXPECTED_F_VERSION = 18n;
 export declare function assertVersion(c: LogswapClient, expected?: bigint): Promise<void>;
+/**
+ * The versions say the managers are the right code; this says the rest of the addresses belong
+ * to THEM. A stale router or lens from a previous deployment passes every version check and then
+ * fails in the worst way: approvals go to a router that pulls for another manager, or every pull
+ * reverts because the router's Permit2 is not the one the user approved.
+ */
+export declare function assertWiring(c: LogswapClient): Promise<void>;

package/dist/client.js

@@ -8,7 +8,39 @@
  * the protocol, not configuration that grows.
  */
 export function createLogswapClient(args) {
-    return { public: args.public, wallet: args.wallet, addresses: args.addresses };
+    return { public: args.public, wallet: args.wallet && guardChain(args.wallet, args.public), addresses: args.addresses };
+}
+/**
+ * The wallet, with every signing call first checking that it is on the chain the reads come from.
+ *
+ * An injected wallet switched to another network would otherwise estimate and simulate against
+ * the public client's chain and then sign and send on its own — with deterministic deploy
+ * addresses, possibly into a different contract. Checked at each call, not once: a user can
+ * switch networks mid-session.
+ */
+function guardChain(wallet, pub) {
+    if (typeof wallet.getChainId !== "function")
+        return wallet; // a test double
+    let readChain = pub.chain?.id;
+    const check = async () => {
+        readChain ??= await pub.getChainId();
+        const walletChain = await wallet.getChainId();
+        if (walletChain !== readChain) {
+            throw new Error(`logswap: the wallet is on chain ${walletChain} but this app reads chain ${readChain} — switch the wallet's network`);
+        }
+    };
+    const guarded = new Set(["writeContract", "sendTransaction", "signTypedData"]);
+    return new Proxy(wallet, {
+        get(target, prop, receiver) {
+            const v = Reflect.get(target, prop, receiver);
+            if (!guarded.has(prop) || typeof v !== "function")
+                return v;
+            return async (...a) => {
+                await check();
+                return v.apply(target, a);
+            };
+        },
+    });
 }
 /**
  * Assert the deployment matches the ABI this build was generated against.
@@ -24,18 +56,18 @@ export function createLogswapClient(args) {
  * manager sailed through `assertVersion` while `FEE_MAX()` still answered on it. Move this in the
  * same change as `CParams.VERSION`, never after it.
  *
- * **3** since 2026-09-03 (contracts `d8406fb`): `burnById` and `update` take an `owner`, `update`
+ * **3** since 2026-09-03: `burnById` and `update` take an `owner`, `update`
  * mints to `to`, `positions()` returns `aps` as uint128 — and a returned quote flow now carries the
- * swept fees (decisions 018), which is why `exit`'s settle-to-one-asset math changed with it.
+ * swept fees, which is why `exit`'s settle-to-one-asset math changed with it.
  *
- * **4** since 2026-09-18 (decisions 042 + 040): `PoolKey` is `(base, quote, tickSpacing, phi)` —
+ * **4** since 2026-09-18: `PoolKey` is `(base, quote, tickSpacing, phi)` —
  * the variance kernel and its two key fields are gone, so every pool id changed; `phiEff` is
  * `phiOf`; `getPool` lost `sigma2Ema`; `Initialize` lost two fields; the cut is
  * `MINT_FEE_PROTOCOL_CUT` / `setFeeParams`.
  */
 export const EXPECTED_VERSION = 4n;
 /**
- * The F manager's own tag (contracts 25a7bcf: 5 — the key's salt, pool names, the sponsor registry;
+ * The F manager's own tag (5 — the key's salt, pool names, the sponsor registry;
  * 4 was the income-only harvest cut).
  *
  * A FLOOR, not an equality — unlike `EXPECTED_VERSION` above. The F primitive is iterating fast and
@@ -47,43 +79,43 @@ export const EXPECTED_VERSION = 4n;
  */
 // 7 (2026-09-15): the reserves are the state and the marks derived, `lockStrike`, the dividend
 // harvest, the relaunch (`dissolve(poolId, successor)`, `rollIn`), the reserve-named seed, the
-// sponsor facet — decisions 025–031.
-// 8 (2026-09-15): the relaunch is in place (decisions 032) — every share id carries the
+// sponsor facet.
+// 8 (2026-09-15): the relaunch is in place — every share id carries the
 // generation (`fPoolShareId(poolId, gen)`), `dissolve(poolId)`, `redeem`, `claim` / `dividendOf`
 // / `rollIn` / `previewRollIn` take the generation, `Pool.gen` replaces `dissolved` and
 // `successor`. A 7 deployment's share ids do not even resolve with this SDK.
-// 9 (2026-09-16): `deepen` is gone, `Pool.leverTheta` is `harvestedTheta` (decisions 034).
+// 9 (2026-09-16): `deepen` is gone, `Pool.leverTheta` is `harvestedTheta`.
 // 10 (2026-09-17): no floor guard — `Pool.minBuffer`, `raiseMinBuffer`, `LEVER_FLOOR` gone;
-// `dissolve` needs an empty bid on every pool (decisions 035); the key bit is the CLASS, `pad`
+// `dissolve` needs an empty bid on every pool; the key bit is the CLASS, `pad`
 // (036): `seed` mints a pad's shares to 0xdead, and the operator, the gates and the list are
 // refused on it — `fPoolLaunch` no longer transfers the seed itself.
-// 11 (2026-09-17): roles and entries (decisions 037) — the operator runs the pool (`harvest`,
+// 11 (2026-09-17): roles and entries — the operator runs the pool (`harvest`,
 // `dissolve`, `setLegs`) and is the authority until appointed, two-step (`acceptOperator`,
 // `Pool.pendingOperator`); `setLegL`/`admitLeg` are gone, `setLegs` edits the next generation's
 // table while unseeded; `fPoolRelaunch` takes `legs`.
 // `getPool` decodes one field fewer, so a 9 deployment's struct no longer matches this SDK.
-// 12 (2026-09-17): one contract (decisions 039) — the sponsor facet is folded back into the
+// 12 (2026-09-17): one contract — the sponsor facet is folded back into the
 // manager; `sponsor()` and the fallback are gone, every entry, error and event unchanged, so
 // `fPoolManagerAbi` is the manager's own ABI and no longer a union. Layout unchanged.
-// 13 (2026-09-18): one vocabulary (decisions 040) — `HARVEST_FEE` is `HARVEST_PROTOCOL_CUT` (a
+// 13 (2026-09-18): one vocabulary — `HARVEST_FEE` is `HARVEST_PROTOCOL_CUT` (a
 // cut of harvested income, not a fee on the harvest) and the exemption is `harvestCutExempt` /
 // `setHarvestCutExempt`; `acceptAuthority` clears the operator, pending and accepted (a mandate
 // is voided by the handover of the role that granted it); `setLegs` needs a generation to have
 // lived (`gen > 0`); `initialize` refuses a codeless base and `mint` refuses `to = address(0)`
 // on both managers. Layout unchanged.
-// 14 (2026-09-20): the policy (decisions 041) — `FPoolKey.policy`, every pool id moves; `dissolve` is
+// 14 (2026-09-20): the policy — `FPoolKey.policy`, every pool id moves; `dissolve` is
 // `retire`, `regenerate` releases the dead shares' pot, `harvestable`/`unharvested` are the
 // readouts; `feePerL`, `edgePerL`, `HARVEST_PROTOCOL_CUT`, `harvestCutExempt` are gone.
-// 15 (2026-09-20): the policy answers every question (decisions 044) — `FPoolKey.authority` is
+// 15 (2026-09-20): the policy answers every question — `FPoolKey.authority` is
 // `creator` (every pool id moves again); the roles, gates and list are the pool's POLICY's
 // (`FPolicyBase` / `PrivatePolicy`), not the manager's: `getPool` has `policy` and `asks` and no
 // role; `proposeAuthority`, `appointOperator`, `setGates`, `setAllowed` (`setMinters` / `setTakers` since 17) are policy writes;
 // `policyApproved(kind, policy)` / `setPolicyApproved(kind, policy, ok)`; `Regenerated` names the payee;
 // `HARVEST_CUT_MAX` / `POT_CUT_MAX` cap what a policy may route to the protocol.
-// 16 (2026-09-21): the word is POLICY (decisions 045) — a rename, no pool id moves: `FPoolKey.policy`,
+// 16 (2026-09-21): the word is POLICY — a rename, no pool id moves: `FPoolKey.policy`,
 // `IFPolicy`, `FPolicyBase`, `PublicPolicy` … `PadPolicy`, `policyApproved` / `setPolicyApproved`,
 // `PolicyApproved`; `PolPolicy.setPolicy` / `PolicySet` are `setRules` / `RulesSet`.
-// 17 (2026-09-21): the registry, the move, the stamp, two lists, one base (decisions 046–048) — no
+// 17 (2026-09-21): the registry, the move, the stamp, two lists, one base — no
 // pool id moves: the F manager takes a `PolicyRegistry` at construction and asks it at a birth
 // (`policyApproved` / `setPolicyApproved` left the manager: `registryApprove` …); the key's policy
 // is the policy at birth, `migrate` moves a pool for the registry's owner; `stamp` / `setAsks` are
@@ -101,7 +133,7 @@ export async function assertVersion(c, expected = EXPECTED_VERSION) {
         throw new Error(`logswap: manager at ${c.addresses.cPoolManager} reports version ${got}, but this SDK was built ` +
             `against version ${expected}. Upgrade the SDK or point at the matching deployment.`);
     }
-    // the F manager carries its own tag since contracts c782811; assert it the same way when deployed
+    // the F manager carries its own tag; assert it the same way when deployed
     if (c.addresses.fPoolManager) {
         const { fPoolManagerAbi } = await import("./generated.js");
         const gotF = await c.public.readContract({
@@ -114,4 +146,29 @@ export async function assertVersion(c, expected = EXPECTED_VERSION) {
                 `at least F version ${EXPECTED_F_VERSION}. Upgrade the deployment or point at a newer one.`);
         }
     }
+    await assertWiring(c);
+}
+/**
+ * The versions say the managers are the right code; this says the rest of the addresses belong
+ * to THEM. A stale router or lens from a previous deployment passes every version check and then
+ * fails in the worst way: approvals go to a router that pulls for another manager, or every pull
+ * reverts because the router's Permit2 is not the one the user approved.
+ */
+export async function assertWiring(c) {
+    const { logswapRouterAbi, logswapLensAbi } = await import("./generated.js");
+    const rd = (address, abi, functionName) => c.public.readContract({ address, abi, functionName });
+    const ZERO = "0x0000000000000000000000000000000000000000";
+    const want = [
+        ["router.mgr()", rd(c.addresses.router, logswapRouterAbi, "mgr"), c.addresses.cPoolManager],
+        ["router.permit2()", rd(c.addresses.router, logswapRouterAbi, "permit2"), c.addresses.permit2 ?? ZERO],
+        ["lens.mgr()", rd(c.addresses.lens, logswapLensAbi, "mgr"), c.addresses.cPoolManager],
+    ];
+    if (c.addresses.fPoolManager) {
+        want.push(["router.fmgr()", rd(c.addresses.router, logswapRouterAbi, "fmgr"), c.addresses.fPoolManager]);
+        want.push(["lens.fmgr()", rd(c.addresses.lens, logswapLensAbi, "fmgr"), c.addresses.fPoolManager]);
+    }
+    const got = await Promise.all(want.map((w) => w[1]));
+    const bad = want.flatMap(([what, , expected], i) => got[i].toLowerCase() === expected.toLowerCase() ? [] : [`${what} is ${got[i]}, expected ${expected}`]);
+    if (bad.length)
+        throw new Error(`logswap: the deployment's addresses do not belong together — ${bad.join("; ")}`);
 }