@mcsherrylabs/pi-meerkat 0.8.0 → 0.11.0

package/dist/installer/node.conf

@@ -1,235 +1,8 @@
-# This node: a NON-GENESIS FOLLOWER on devnet. Chain-wide params come from the genesis
-# spec — never set them here, they must stay byte-identical on every node. Only
-# node-local knobs below.
-include file("/public-genesis/genesis.conf")
+# DevNet wrapper: selects the devnet genesis, then the follower body.
+include file("/config/genesis.devnet.conf")
 
 # 089 chain-spec pin: the canonical hash of the genesis file IS the genesis block id.
 # Any drift refuses to boot rather than forking quietly.
-ce.evolver.genesis-file = "/public-genesis/genesis.conf"
-
-# This node's OWN identity, from the first-boot faucet claim (node-join.sh). REQUIRED
-# substitutions (no `?`): a node booting with missing keys must fail fast, not later and
-# obscurely at the first TLS handshake.
-ce.evolver.node {
-  private-key = ${EVOLVER_PRIVATE_KEY}      # Ed25519 PKCS#8 base64
-  public-key  = ${EVOLVER_NODE_PUBLIC_KEY}  # Ed25519 X.509 base64
-  bls-secret  = ${EVOLVER_BLS_SEED}         # BLS IKM base64
-  port        = ${EVOLVER_NODE_PORT}        # p2p transport (raw TCP, mTLS)
-}
-
-evolver.peer-discovery {
-  # THIS NODE ADVERTISES NOTHING, AND MUST NOT. `preferred-url` is the address this node
-  # gossips as its OWN (`""` = feature off), and a joined app node behind Docker HAS no
-  # routable p2p address: its 7000 is container-local and deliberately unpublished. So
-  # advertising one means every node on the chain records `<us> -> https://127.0.0.1:7000`
-  # and then dials its own loopback.
-  #
-  # Observed on devnet, and it is worse than noise: this node CONNECTED TO ITSELF, logged
-  # `Peer connected: <self>`, sent its own SyncManager `BlockRangeRequest(4841,4845)`, and
-  # TipGossip then reported `rotating to <self> (failed=devnet1-node0)` followed by
-  # `stalled (upstream=none)`. After that its submits were never forwarded and every write
-  # timed out. The table also keeps the dead: `evolvertemplateappnode965813 at
-  # 127.0.0.1:7000` from an earlier deployment was still being dialled hours later.
-  # ADVERTISED AGAIN, and ⚠️ ONLY BECAUSE IT IS NOW REAL. This was `""` because the node
-  # had been advertising `https://127.0.0.1:7000`: every peer that read the discovery
-  # table dialled its OWN loopback, so this node connected to itself, sent its own
-  # SyncManager block requests, reported `candidates=<self>` / `stalled (upstream=none)`
-  # and stopped forwarding submits. An unroutable value reinstates that exactly — which
-  # is why `EVOLVER_TRANSPORT_ADDRESS` is REQUIRED here rather than defaulted, and why the
-  # command suite refuses a loopback value.
-  # ⚠️ EMPTY, DELIBERATELY. This node is a READER behind NAT: it has no routable p2p address.
-  # Advertising one is not merely useless, it is harmful — devnet recorded a node that advertised
-  # an unroutable address CONNECTING TO ITSELF, sending its own sync requests, reporting
-  # `stalled (upstream=none)`, and leaving dead entries other nodes dialled for hours.
-  #
-  # It costs this node nothing: advertising is how others DIAL YOU, and nothing needs to. Writing
-  # still works — this node dials OUT, discovers the network, learns its distance to the committee
-  # and forwards transactions along that path. Being undialable only stops bodies being flooded TO
-  # it, which is a DA member's concern and not a reader's.
-  transport-address       = ""
-  peer-url                = ""
-  gossip-interval-seconds = 60
-
-  # 16 INBOUND, not 0. The 141 leaf recipe (`in=0`) is right for an app node that only
-  # talks upstream — and wrong here: the registry's channel requires announcers' nodes to
-  # reach THIS node so their flooded bodies can be attested (research D2). Each announcer
-  # holds one inbound slot, so 16 is the number of concurrent announcer nodes supported.
-  # Generous on both sides so DISCOVERY actually happens. The seed below is pinned so the node
-  # always has a way back to the chain, but `allowed-outbound` is deliberately LARGER than the
-  # pinned list — the pin is strict only while the two are equal, and a strict pin here would mean
-  # this node never dials anything it discovers.
-  allowed-inbound         = 16
-  # `allowed-outbound` and `preferred-peers` are DELIBERATELY ABSENT HERE — node-join.sh renders
-  # both into peers.conf so the two cannot drift apart in two files.
-  #
-  # ⚠️ THIS COMMENT USED TO CLAIM THE PIN IS STRICT. It is NOT, and the difference matters to
-  # anyone reasoning about what this node will dial. It said `|preferred| == allowed-outbound`
-  # holds "by construction"; node-join.sh renders ONE pinned seed and an outbound budget of 16,
-  # so 1 != 16 and the pin is deliberately LOOSE. That is the intended design — a follower has to
-  # dial what it discovers or it is a leaf — but the old wording described the opposite property
-  # and named the incidents (a dead address from a torn-down deployment still being dialled, this
-  # node dialling its own loopback) that a strict pin was supposed to prevent. Those are the COST
-  # of the loose pin, not evidence against it: the seed guarantees a way back to the chain, and
-  # discovery does the rest. Which is what keeps a shared chain's discovery table out of the
-  # dial queue — it keeps the dead (an address from a torn-down deployment was still
-  # being dialled hours later) and once made this node dial its own loopback. Raising
-  # the budget without naming a peer would silently unpin it; naming a peer without
-  # raising the budget could never reach it. One list, both keys, no drift.
-  #
-  # ⚠️ THIS USED TO BE `out=1`, copied verbatim from the 141 LEAF recipe, and it decided
-  # WHICH CHANNELS THIS NODE COULD READ — silently. `ChannelOverlay.peers(ledgerId)` is
-  # the channel's DA group ∩ connected, so with the one slot spent on the upstream every
-  # channel whose DA member is somebody else resolved to an EMPTY pull set: the node
-  # records the miss, sends no request, and says so at DEBUG only (evolver#89). A node
-  # reading a channel it does not itself serve needs the upstream AND one reachable DA
-  # member per such channel, so a fixed 1 is only ever right for a node that reads
-  # nothing but its own.
-}
-
-ce.evolver.consensus {
-  validate-chain-on-startup = false
-  wake-on-work { forward-watermark = 16 }
-}
-
-# PROCESSING MODE — off by default, and THE REASON THIS DEPLOYMENT EXISTS once your app
-# reads a channel.
-#
-# `/api/channel/next` is a SINGLE-CONSUMER, FORWARD-ONLY cursor: two readers do not
-# error, they silently split the stream and the message is unrecoverable. So an app that
-# consumes an ordered channel must drain a node NOBODY ELSE drains — which means a node
-# of its own. It cannot share a public one, and a single-node chain (devnet today) IS the
-# committee, so that node is not a processing node and serves no stream at all.
-#
-# And the committee's node must never be put in this mode: processing mode DEFERS apply
-# and paces it from the app's polling, so a committee node in processing mode would
-# couple consensus progress to an HTTP poller. Ordering is its job; give the app its own.
-#
-# Turning it on changes what committed reads MEAN here — they answer "as of MY cursor".
-# Measured in this family (evolver-scheduler): right after a successful faucet claim a
-# quorum node reported `{"balance":5000}` for an identity while a processing node
-# reported `{"error":"not_found"}` for the same one. An app in that mode needs to know
-# which of its questions are "has the chain agreed?" (ask a quorum node) and which are
-# "what have I processed?" (ask this one).
-#
-# ON, because this app owns a channel (`announcements`) and reads its ordered stream —
-# steps 5-7 of src/app.ts. BOTH lines are needed and neither works alone: a node in
-# processing mode with no channels declared has nothing to offer, and a node that
-# declares channels without execution stores bodies it never streams.
-#
-# The channel must be named HERE as well as claimed on chain. A processing node stores
-# bodies only for the channels it lists, so an undeclared channel's message is applied
-# in the slice and never offered — the write looks fine and the stream stays silent,
-# which is the failure the app's step 7 names explicitly.
-# Processing is enabled only by the paired managed composition with its persistent zero-module
-# shared SDK consumer. MCP sessions never drain. Independent remote nodes remain unmanaged.
-ce.evolver.execution.enabled = ${?EVOLVER_EXECUTION_ENABLED}
-# Shared SDK controller is the SOLE writer; node sees the whole config-only directory read-only.
-# Ordinary boot/upgrade cannot merge defaults, resurrect removals or seed a lost declaration.
-include required(file("/subscriptions/channels.conf"))
-# `required` for the same reason: an absent optional include is IGNORED, and a node
-# that silently fell back to the 64/64 defaults would dial the discovery table.
-include required(file("/data/chain/peers.conf"))
-
-# ── THE LOCAL ROUTES THIS DEPLOYMENT OPENS TO ITS OWN CONTAINERS ────────────
-#
-# The agent and the registry run BESIDE this node, each in its own container on this compose
-# project's network. These routes carry no token and no client certificate — reaching the address
-# IS the authorization — so the node binds them to loopback unless told otherwise, and loopback
-# inside this container is reachable by nothing else in the stack.
-#
-# `bind-host = 0.0.0.0` here means: THIS COMPOSE NETWORK IS THE BOUNDARY. That claim holds only
-# because none of these ports appear under `ports:` in docker-compose.yml and the stack does not
-# use host networking. Publish one, or run with `--network host`, and the claim is simply false.
-#
-# ⚠️ `ce.evolver.login` is deliberately NOT here and cannot be: that route signs as any identity
-# this host holds a signer for, which on this node is the node's own. Setting `bind-host` under
-# that namespace fails the boot rather than being ignored.
-
-# 145 — the agent sends and drains application messages. `/api/p2p/send` relays a message the
-# agent signed ITSELF (its own identity, verified at the far end); `/api/p2p/sign-and-send` makes
-# this node sign as itself. One listener, so opening it grants both.
-ce.evolver.p2p {
-  http-port = 8460
-  bind-host = "0.0.0.0"
-}
-
-# 158 — the agent may ASK an enrolled phone to authorise a transaction. It cannot sign: the device
-# holder approves every one, and that gate does not move when the bind does. Inert until a
-# `mobile-signer` block exists, and the node says so at boot rather than failing.
-ce.evolver.mobile {
-  http-port = 8470
-  bind-host = "0.0.0.0"
-}
-
-# 139 — CONTENT, so the agent can publish a document and the registry can read one back.
-#
-# `POST /content` writes to this node's own store, keyed by the bytes' own digest, and talks to
-# no peer at all (FR-006). `bind-host` below is what lets the agent and the registry reach that
-# route from their own containers. Fetching a document another node holds is the part that uses
-# the overlay, and that is what the TLS listener underneath is for.
-ce.evolver.content {
-  enabled   = true
-  http-port = 8450
-  bind-host = "0.0.0.0"
-}
-
-data.base       = "/data/chain"
-state.snapshots = "snapshots"
-# BOTH LISTENERS, and the pair is the point.
-#
-# 8440 PLAIN is what the agent and the registry talk to. They are ordinary HTTP clients in their
-# own containers, and the alternative is not "use TLS" — this node's HTTPS listener presents its
-# own IDENTITY certificate, self-signed, CN=<nodeId>, ~13 minutes old. It rotates, so it cannot
-# be pinned as a CA, so a client that verifies it must turn verification off process-wide. For
-# the agent that would also stop it verifying GoToSocial, which is not a trade worth making for
-# a hop between two containers on one network.
-#
-# 8441 TLS is what PEERS use, and it exists so `ce.evolver.content` above can: the content peer
-# route identifies its requester by client certificate, and refuses to start without somewhere
-# mTLS to live. NOT PUBLISHED in docker-compose.yml — this node is a reader behind NAT that
-# fetches outbound and serves nobody, so nothing needs to dial it.
-#
-# ⚠️ IF THIS NODE EVER SERVES CONTENT, `evolver.peer-discovery.api-url` must name 8441 and that
-# port must be publicly reachable. It is empty here (see above): a node with no routable address
-# advertises nothing and can only fetch.
-http.port       = 8440
-# Only this private Compose network may reach the unsigned processing API.
-http.bind-host  = "0.0.0.0"
-# ⚠️ REQUIRED SINCE 131 (#131), and without it this stack breaks. `http.bind-host` now defaults
-# to 127.0.0.1 — the plain listener joined the bind-is-authorization set the four local listeners
-# above already belong to, because it carries the whole API with no token and no client
-# certificate, including (this node runs `ce.evolver.execution.enabled`) the SINGLE-CONSUMER
-# cursor `GET /api/channel/next`, which a stranger can step past the registry's own deliveries.
-#
-# The claim being made here is the same one `ce.evolver.content.bind-host` and the p2p/login ones
-# above make: THIS COMPOSE NETWORK IS THE BOUNDARY. It holds because 8440 is NOT published in
-# docker-compose.yml and nothing uses host networking — the agent and the registry reach this
-# node as `node:8440`, a service name on that network. Publish the port, or run with host
-# networking, and the claim stops being true. The node cannot tell, so it logs a WARN naming it.
-http.bind-host  = "0.0.0.0"
-https.port      = 8441
-evolver.grpc.port = 9000
-
-# REQUIRED, and there is no default: `NodeBootstrap.initChainDb` reads this block
-# directly, so a node without it dies with `No configuration setting found for key
-# 'chainDb'` after the migrations have already run — which is exactly how this omission
-# was found. Same values as the bundled deployment's node.
-chainDb {
-  datasource {
-    driver                    = "org.hsqldb.jdbc.JDBCDriver"
-    user                      = "sa"
-    pass                      = ""
-    maxPoolSize               = 5
-    connectionProperties      = ""
-    cachePrepStmts            = true
-    prepStmtCacheSize         = 250
-    prepStmtCacheSqlLimit     = 2048
-    connectionTimeout         = 5000
-    useServerPrepStmts        = false
-    transactionIsolationLevel = "TRANSACTION_READ_COMMITTED"
-  }
-  viewCachesSize  = 50
-  useShutdownHook = false
-  freeBlobsEarly  = false
-}
+ce.evolver.genesis-file = "/config/genesis.devnet.conf"
 
+include required(file("/config/node-follower.conf"))

package/dist/installer/node.local.conf

@@ -0,0 +1,8 @@
+# Local-chain wrapper: selects the committee-exported public genesis, then the follower body.
+include file("/public-genesis/genesis.conf")
+
+# 089 chain-spec pin: the canonical hash of the genesis file IS the genesis block id.
+# Any drift refuses to boot rather than forking quietly.
+ce.evolver.genesis-file = "/public-genesis/genesis.conf"
+
+include required(file("/config/node-follower.conf"))

package/dist/installer/runtime.json

@@ -1 +1 @@
-{"operatorIdentity":"evolvermeerkatA","sdk":"0.22.1","bootstrap":"0.15.0"}
+{"operatorIdentity":"evolvermeerkatA","devnet":{"origin":"https://devnet.mcsherrylabs.com","chainId":"c8925985ae7948d2e608efcf863928d15476c4b561ad773fdca6f0d53d4fea05","channel":"ce.meerkat.announcements","operator":"evolvermeerkatA483344","upstreamNodeId":"evolvermeerkatnode920080","daPeers":"schednode2","allowedOutbound":"2","genesisSha256":"7f6a95cd0fcbe2306d89b2426a9473b1c6537427a82feaffff4783d9cc5dc6b9"},"sdk":"0.24.0","bootstrap":"0.17.0"}

package/dist/installer-runtime/dist/scripts/recover-owner.js

@@ -1,15 +1,13 @@
 // Explicit offline operator action. Never imported/called by ordinary startup.
 import { pathToFileURL } from "node:url";
-import { recoverProcessorOwnerLock } from "@mcsherrylabs/evolver-client/processor";
-import { currentTarget } from "../src/env.js";
-import { processorStatePath } from "../src/runtime.js";
+import { recoverManagedOwner } from "@mcsherrylabs/evolver-client/processor";
+import { currentTarget, registryStatePath } from "../src/env.js";
+/** Offline forced owner-lock recovery for the registry. Delegates to the SDK's
+ *  `recoverManagedOwner`, which owns the usage error, the `[registry] ` prefix and the
+ *  explicit-acknowledgement warning; only the state path is Meerkat's. The exported name is
+ *  kept for evolver-mcp's fault fixture. */
 export function recoverMeerkatOwner(args, target, say = console.error) {
-    if (args.length !== 1 || args[0] !== "--force")
-        throw new Error("usage: recover-owner --force (only after stopping ALL collectors and disabling automatic restarts)");
-    say("WARNING: --force acknowledges ALL collectors are stopped and automatic restarts disabled; this command cannot verify that.");
-    const result = recoverProcessorOwnerLock({ path: processorStatePath(target), force: true });
-    say(`${result.removed ? "Removed owner lock" : "No owner lock present"}: ${result.marker}. Database/WAL, progress, subscriptions and keys unchanged. Start ONE collector normally with the SAME target/state environment to acquire a new lock.`);
-    return result;
+    return recoverManagedOwner(args, { statePath: registryStatePath(target), service: "registry", say });
 }
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
     recoverMeerkatOwner(process.argv.slice(2), currentTarget());

package/dist/installer-runtime/dist/scripts/subscriptions-init.js

@@ -1,16 +1,15 @@
 // Explicit fresh-resource operation; NEVER imported/called by ordinary startup or upgrade.
 import { chown, chmod, mkdir, readdir } from "node:fs/promises";
 import { dirname, join } from "node:path";
-import { initializeSubscriptions } from "@mcsherrylabs/evolver-client/processor";
-import { currentTarget, ROOT } from "../src/env.js";
-import { processorConfigPath } from "../src/runtime.js";
+import { initializeSubscriptions, MANAGED_PROCESSOR_DEFAULTS } from "@mcsherrylabs/evolver-client/processor";
+import { ROOT } from "../src/env.js";
 const raw = process.env.EVOLVER_INITIAL_CHANNELS;
 if (raw === undefined)
     throw new Error("set EVOLVER_INITIAL_CHANNELS to an explicit JSON array (including []); initialization is fresh-only");
 const channels = JSON.parse(raw);
 if (!Array.isArray(channels) || channels.some(id => typeof id !== "string"))
     throw new Error("EVOLVER_INITIAL_CHANNELS must be a JSON string array");
-const path = processorConfigPath(currentTarget());
+const path = MANAGED_PROCESSOR_DEFAULTS.paths.subscriptions;
 const directory = dirname(path);
 if (process.getuid?.() === 0) {
     const uid = Number(process.env.EVOLVER_OPERATOR_UID), gid = Number(process.env.EVOLVER_OPERATOR_GID);

package/dist/installer-runtime/dist/scripts/versions.mjs

@@ -32,7 +32,7 @@ export function readEnv() {
             continue; // empty ⇒ treat as missing, so the required-keys check reports it
         out[t.slice(0, i).trim()] = v;
     }
-    for (const k of ["EVOLVER_REGISTRY", "REGISTRY", "EVOLVER_VERSION", "APP_NAME", "APP_VERSION"]) {
+    for (const k of ["EVOLVER_REGISTRY", "REGISTRY", "EVOLVER_VERSION", "APP_NAME", "APP_VERSION", "EVOLVER_MCP_VERSION"]) {
         if (!out[k])
             throw new Error(`${ENV_PATH}: ${k} is missing — it is required, see the comments in that file`);
     }
@@ -63,15 +63,10 @@ export function updateEnv(updates) {
 }
 export const appImage = (e = readEnv()) => `${e.REGISTRY}/${e.APP_NAME}:${e.APP_VERSION}`;
 export const deployRef = (e = readEnv()) => `${e.REGISTRY}/${e.APP_NAME}-deploy:${e.APP_VERSION}`;
-/** The app-ALONE deployment, pointed at a chain that already exists — from
- *  `docker-compose.remote.yml`. */
-export const remoteDeployRef = (e = readEnv()) => `${e.REGISTRY}/${e.APP_NAME}-deploy-remote:${e.APP_VERSION}`;
-/** The app PLUS ITS OWN NODE, that node joining devnet — from `docker-compose.devnet.yml`.
- *
- *  Three refs because they are three different things to hand someone, and the difference is
- *  not cosmetic: one carries a throwaway chain, one borrows somebody else's node on a real
- *  chain, and one brings a node of its own onto that real chain (which is the only shape that
- *  can read an ordered channel stream or join a DA overlay). */
+/** The evolver-mcp-node image the managed follower runs — a separate variable because it is the
+ *  evolver-mcp project's registry/version, not this app's node image. */
+export const mcpNodeImage = (e = readEnv()) => `${e.EVOLVER_REGISTRY}/evolver-mcp-node:${e.EVOLVER_MCP_VERSION}`;
+/** The app PLUS ITS OWN NODE, that node joining devnet — from `docker-compose.devnet.yml`. */
 export const devnetDeployRef = (e = readEnv()) => `${e.REGISTRY}/${e.APP_NAME}-deploy-devnet:${e.APP_VERSION}`;
 /** Identity names are `^[A-Za-z0-9]{1,50}$` — no hyphens, dots or underscores — so an app
  *  name cannot be used verbatim. Strip it to what a node id may contain and bound it.

package/dist/installer-runtime/dist/src/announcements.js

@@ -30,7 +30,7 @@
 //     stores and floods the body it will later serve. This is why the group-chat deployment
 //     has a "DA group = the app nodes" step, and why an app cannot simply write to a channel
 //     it claimed with defaults.
-import { buildSignedTx, claimBody, channelBody, createGroupBody, addMemberBody, fString, fVarint, fMessage, concat, LEDGER, } from "@mcsherrylabs/evolver-client";
+import { fString, fVarint, fMessage, concat } from "@mcsherrylabs/evolver-client";
 /**
  * The channel this app owns — ONE variable, read by the app AND by the node's
  * `subscribed-channels` declaration in docker-compose.devnet.yml, because the two must agree
@@ -47,23 +47,6 @@ import { buildSignedTx, claimBody, channelBody, createGroupBody, addMemberBody,
  * rather than a literal.
  */
 export const CHANNEL = process.env.EVOLVER_CHANNEL?.trim() || "announcements1";
-/**
- * The DA threshold. ZERO — best-effort — because this app's DA group has ONE member.
- *
- * The scheduler's own validation states the rule and I had it wrong: at one DA node a
- * threshold of 1 can never be satisfied, because a node is never its own flood target and
- * does not self-attest, so a write needing one attestation waits for one that will not come
- * and ends in `503 da_unavailable`.
- *
- * ⚠ And best-effort means what it says: one member is ONE VOLUME. Lose it and every message
- * that member alone held is unrecoverable — and any future processing node declaring this
- * channel WEDGES on the first such message, permanently, because apply is forward-only. That
- * is not hypothetical: it is what happened to `announcements`, and it is why this app is on
- * `announcements1` (evolver#83). Two members on separate volumes is the answer when the
- * messages matter.
- */
-export const DA_THRESHOLD_M = Number(process.env.EVOLVER_DA_THRESHOLD_M?.trim() || 0);
-const utf8 = (s) => new TextEncoder().encode(s);
 /** The channel's terms as a NAMED node sees them — pass the devnet url to ask the chain, or
  *  this app's node to ask its own cursor. The difference is the point (fact 2). */
 export async function channelTerms(baseUrl, ledgerId = CHANNEL) {
@@ -111,27 +94,6 @@ export async function groupMembers(baseUrl, group) {
         return { known: false };
     }
 }
-/**
- * This node's OWN on-chain identity, which the app needs because the DA group's member is the
- * NODE, not the app.
- *
- * Read from `/status`, which is an HTML page — the honest state of things: a node reports its
- * own identity to a human and has no machine-readable equivalent. A JSON status route would
- * make this a question instead of a parse (see evolver#82, which asks for the same thing about
- * readiness).
- */
-export async function nodeSelfId(baseUrl) {
-    try {
-        const res = await fetch(`${baseUrl}/status`, { signal: AbortSignal.timeout(10_000) });
-        if (!res.ok)
-            return null;
-        const m = /<h1>\s*Node:\s*([A-Za-z0-9]+)\s*<\/h1>/.exec(await res.text());
-        return m ? m[1] : null;
-    }
-    catch {
-        return null;
-    }
-}
 /**
  * Submit a write and then CONFIRM IT BY READING — the only reliable shape on a node whose
  * apply this app paces (fact 3).
@@ -176,61 +138,6 @@ export async function submitAndConfirm(node, stx, label, confirm, say, opts) {
     }
     throw new Error(`${label}: not visible on chain within the deadline — outcome UNKNOWN, nothing resent`);
 }
-/**
- * Create the DA group and put this app's NODE in it.
- *
- * Both steps are best-effort and SAY what happened, because neither is the gate: from run two
- * onward "already exists" is the normal answer, and on a paced node a submit routinely returns
- * `timeout` and commits anyway. The real gate is the CLAIM below — it cannot succeed unless the
- * group exists with this node in it, so a silent failure here surfaces there rather than
- * passing unnoticed.
- */
-export async function ensureDaGroup(node, baseUrl, owner, signer, group, memberNodeId, say, pace) {
-    say(`   DA group '${group}', member '${memberNodeId}' — the NODE's identity, not the app's`);
-    // READ FIRST, AND SUBMIT ONLY WHAT IS MISSING.
-    //
-    // This used to submit CreateGroup and AddMember unconditionally on every run. A CreateGroup
-    // for a name that already exists is not simply refused: the node ACCEPTS it, then rejects it
-    // PRE-COMMIT every round ("name 'x' taken by group") and RETAINS it, re-proposing until its
-    // TTL. On the live devnet that did two things — three rejection warnings per round in the
-    // leader's log, and, far worse, it kept the tx queue permanently non-empty, which SUPPRESSES
-    // wake-on-work for the whole chain (evolver#85: the wake fires only on the queue's empty →
-    // non-empty edge). Every submitter, ours and everyone else's, then waited up to the
-    // five-minute idle heartbeat — which is also what burned an identity name through
-    // evolver#86. A pointless resubmission is not free, and on a shared chain it is not local.
-    const before = await groupMembers(baseUrl, group);
-    if (before.known && "members" in before && before.members.includes(memberNodeId)) {
-        say(`   group '${group}' exists with '${memberNodeId}' as a member — nothing to submit`);
-        return;
-    }
-    if (!before.known) {
-        throw new Error(`could not read group '${group}' from ${baseUrl} — refusing to guess: ` +
-            `submitting a CreateGroup for a name that already exists poisons the ` +
-            `chain's tx queue (evolver#85), so this needs an answer, not an attempt.`);
-    }
-    const steps = [];
-    if ("absent" in before) {
-        steps.push([`create group '${group}'`, createGroupBody(group),
-            async () => { const g = await groupMembers(baseUrl, group); return g.known && !("absent" in g); }]);
-    }
-    else {
-        say(`   group '${group}' already exists — adding the member only`);
-    }
-    steps.push([`add '${memberNodeId}' to '${group}'`, addMemberBody(group, memberNodeId),
-        async () => {
-            const g = await groupMembers(baseUrl, group);
-            return g.known && "members" in g && g.members.includes(memberNodeId);
-        }]);
-    for (const [label, body, confirm] of steps) {
-        const stx = buildSignedTx({
-            ledgerId: LEDGER.groups, senderNodeId: owner.nodeId, body,
-            ttlRound: BigInt((await node.currentRound()) + 50), signers: [signer],
-        });
-        // Confirmed by READING, like every other write here: a submit that times out has an
-        // unknown outcome, and on a quiescent chain the block is minutes away.
-        await submitAndConfirm(node, stx, label, confirm, say, { pace });
-    }
-}
 /**
  * `UpdateChannelDaTxBody` (097) — OwnersTxBody variant 4.
  *
@@ -251,198 +158,3 @@ export function updateChannelDaBody(args) {
         parts.push(...fVarint(3, args.daThresholdM));
     return concat(fMessage(4, concat(parts)));
 }
-/**
- * Make the channel exist, owned by us, WITH a DA group — the only shape that accepts a
- * body-form write (fact 4).
- *
- * Idempotent, and the three cases are genuinely different: nothing claimed (claim it, carrying
- * the DA policy), claimed by us with the WRONG DA policy (converge it in place with
- * `UpdateChannelDa`), claimed by somebody else (stop: that is a real conflict on a shared
- * chain).
- */
-export async function ensureChannelWithDa(node, chainUrl, owner, signer, group, say, pace) {
-    const ask = () => channelTerms(chainUrl);
-    const read = await ask();
-    if (!read.ok)
-        throw new Error(`could not read the terms of '${CHANNEL}' from ${chainUrl}: ${read.why}\n` +
-            `  Refusing to guess: an unreadable answer used to mean "unclaimed", and acting on ` +
-            `that submits a Claim for a channel someone else may own — accepted, then rejected ` +
-            `every round until its TTL (evolver#85).`);
-    const terms = read.terms;
-    const ownedByUs = terms.owners.some((o) => o.name === owner.nodeId);
-    const someoneElse = terms.owners.length > 0 && !ownedByUs;
-    // A CHANNEL NAME IS GLOBAL ON A SHARED CHAIN, and whoever claims it owns it. A second
-    // deployment of this app — new identities, same channel name — is therefore a READER, not a
-    // broken installation: it can declare the channel, subscribe, and fold the ordered stream,
-    // which is most of what an announcements channel is for. Only the owner may write (the
-    // default write policy is owner-or-group; 156 lets an owner open it to any writer).
-    //
-    // Dying here instead would be wrong in the ordinary case and would make the name a
-    // first-come landmine.
-    if (someoneElse) {
-        say(`   '${CHANNEL}' is owned by ${terms.owners.map((o) => o.name).join(", ")} — this app will READ it, not write`);
-        return "reader";
-    }
-    // THE POLICY MUST MATCH, not merely exist — and "wrong" includes a threshold this app now
-    // knows is unsatisfiable. A mismatch is converged with `UpdateChannelDa`, in place; a second
-    // Claim would not do it (on an already-claimed ledger a Claim is a committed NO-OP).
-    //
-    // Measured on the deployment: `announcements1` was claimed at m=1 with a single-member
-    // group, this function said "already claimed by us with a DA group — reusing", and the very
-    // next write died with `fetch failed` — the attestation that can never arrive, waited out
-    // until the connection dropped. Checking only for PRESENCE is what let that through twice.
-    const daOk = !!terms.da && terms.da.group === group && terms.da.thresholdM === DA_THRESHOLD_M;
-    if (ownedByUs && daOk) {
-        say(`   '${CHANNEL}' already claimed by us with DA group '${group}' (m=${DA_THRESHOLD_M}) — reusing`);
-        return "owner";
-    }
-    if (ownedByUs && !daOk) {
-        const had = terms.da ? `DA group '${terms.da.group}' (m=${terms.da.thresholdM})` : "NO DA group";
-        say(`   '${CHANNEL}' is claimed by us with ${had}, but this app needs '${group}' (m=${DA_THRESHOLD_M})`);
-        // ⚠️ A TARGETED UPDATE, NOT UNCLAIM-THEN-RECLAIM.
-        //
-        // This used to drop the claim and re-claim, on the belief that a DA policy is set at claim
-        // time and cannot be changed. That belief is wrong — `UpdateChannelDa` (097) exists and is
-        // owner-gated (OwnersLedgerOrchestrator validates it and sets the policy in place) — and
-        // the belief made the app do something irreversible to fix something reversible:
-        // `clearChannelPolicies` drops all three policy rows, and BETWEEN the unclaim and the
-        // re-claim the channel name is UNOWNED, so on a shared chain anyone can claim it and the
-        // name is lost for good. A second Claim would not even have converged it: on an
-        // already-claimed ledger a Claim is a committed NO-OP, which is why the unclaim was there
-        // at all. evolver-scheduler's provisioner had this right first.
-        say(`   converging in place with UpdateChannelDa — an unclaim would expose the name to being taken`);
-        const upd = buildSignedTx({
-            ledgerId: LEDGER.owners, senderNodeId: owner.nodeId,
-            body: updateChannelDaBody({ ledgerId: CHANNEL, daGroup: group, daThresholdM: DA_THRESHOLD_M }),
-            ttlRound: BigInt((await node.currentRound()) + 50), signers: [signer],
-        });
-        await submitAndConfirm(node, upd, `update '${CHANNEL}' DA policy to '${group}' (m=${DA_THRESHOLD_M})`, async () => {
-            const r = await ask();
-            return r.ok && !!r.terms.da && r.terms.da.group === group &&
-                r.terms.da.thresholdM === DA_THRESHOLD_M;
-        }, say, { pace });
-        return "owner";
-    }
-    // Nothing owns it: claim it, carrying the DA policy in the claim itself.
-    const claim = buildSignedTx({
-        ledgerId: LEDGER.owners, senderNodeId: owner.nodeId,
-        body: claimBody({ ledgerId: CHANNEL, daGroup: group, daThresholdM: DA_THRESHOLD_M }),
-        ttlRound: BigInt((await node.currentRound()) + 50), signers: [signer],
-    });
-    await submitAndConfirm(node, claim, `claim '${CHANNEL}' with DA group '${group}' (m=${DA_THRESHOLD_M})`, async () => {
-        const r = await ask();
-        return r.ok && !!r.terms.da && r.terms.da.group === group &&
-            r.terms.da.thresholdM === DA_THRESHOLD_M &&
-            r.terms.owners.some((o) => o.name === owner.nodeId);
-    }, say, { pace });
-    return "owner";
-}
-/** Write one announcement. Plain UTF-8: this channel is public by intent. */
-export async function announce(node, from, signer, text, say) {
-    const stx = buildSignedTx({
-        ledgerId: CHANNEL, senderNodeId: from.nodeId,
-        body: channelBody(utf8(text)), ttlRound: BigInt((await node.currentRound()) + 50), signers: [signer],
-    });
-    // submitTxWithDa: the node collects the channel's DA attestations over the overlay and
-    // assembles the transaction. A client cannot do that for itself — it has no overlay.
-    const r = await node.submitTxWithDa(stx);
-    if (r.kind === "committed") {
-        say(`   announced: "${text}"`);
-        return;
-    }
-    if (r.kind === "timeout") {
-        say(`   announce: submit timed out — the stream below is the confirmation`);
-        return;
-    }
-    // A duplicate is not a failure of this app: the txId is a function of the body, the sender
-    // and the TTL, so an identical announcement that already committed answers `duplicate` —
-    // which means the message IS on the channel, which is exactly what the stream below checks.
-    if (r.kind === "failed" && r.reason === "duplicate") {
-        say(`   announce: this exact message is already on the chain — the stream below is the confirmation`);
-        return;
-    }
-    throw new Error(`the announcement was refused: ${JSON.stringify(r)}\n` +
-        `  insufficient_da means the DA group could not be mustered — is this app's node a member?\n` +
-        `  out-of-band means the channel has no DA group at all (see ensureChannelWithDa).`);
-}
-// The demo reads the shared collector's durable inbox. There is no local handler map,
-// volatile receive buffer, cursor probe or second consumer of the channel route.
-export async function retainedMessages(store, channel) {
-    const messages = [];
-    let after;
-    do {
-        const page = await store.inboxPage(channel, { limit: 100, after });
-        for (const entry of page.entries)
-            if (entry.body !== null)
-                messages.push(new TextDecoder().decode(entry.body));
-        if (!page.more)
-            return messages;
-        if (!page.next || (after && (BigInt(page.next.round) < BigInt(after.round) ||
-            (page.next.round === after.round && BigInt(page.next.index) <= BigInt(after.index)))))
-            throw new Error("inbox readback did not advance its continuation");
-        after = page.next;
-    } while (true);
-}
-/** Pace the processor forward until this node stops making progress — which is how a processing
- *  node applies blocks at all (fact 2). Anything of ours it passes on the way is KEPT. */
-export async function paceApply(pace, say) {
-    const MAX = 200;
-    // A walk stops at its budget whether or not the cursor reached the tip, so the report
-    // distinguishes the two. Claiming "to its tip" after a truncated walk is a statement the code
-    // cannot make — a backlog longer than MAX leaves apply behind, and the reads that follow would
-    // silently answer as of an earlier round.
-    let walked = 0;
-    let caughtUp = false;
-    for (let attempts = 0; attempts < 10 && walked < MAX; attempts++) {
-        const r = await pace();
-        walked += r.inboxed + r.missed + r.duplicates;
-        if (r.stoppedBecause === "body-pending")
-            throw new Error("node is waiting for a channel body; nothing skipped");
-        if (r.stoppedBecause === "caught-up") {
-            caughtUp = true;
-            break;
-        }
-    }
-    if (!caughtUp)
-        say(`   paced this node's apply, stopping at ${walked} delivery(ies) — the backlog is longer, so apply may still be behind`);
-    else
-        say(`   paced this node's apply to its tip; original deliveries are retained in the inbox`);
-}
-/** Pacing with no narration, for use inside a wait loop. Keeps what it walks past, as above. */
-export async function paceQuietly(pace) {
-    await pace();
-}
-/**
- * Follow the stream until our own message arrives.
- *
- * The delivery is the app's write coming back THROUGH CONSENSUS, which is the only evidence
- * that matters: a submit says the transaction was ordered; a delivery says the app can read
- * what was ordered, in order, from its own node.
- *
- * A submit that timed out has an UNKNOWN outcome and the block carrying it can be minutes away
- * on a quiescent chain, so this waits to a DEADLINE rather than for a fixed number of idle polls
- * (20s of idle was the old bound, and it expired before the block existed). Nothing is ever
- * resent — the transaction id is fixed, so waiting is the only correct move.
- */
-export async function readBack(pace, want, say, opts) {
-    // ⚠️ A CALLER THAT CANNOT MATCH MUST PASS ITS OWN DEADLINE. This waits for a specific
-    // message, so with a sentinel that never matches it waits out the whole budget — five
-    // minutes of "following the stream" for the reader-mode caller, which only wants to watch
-    // briefly. That regression arrived with the deadline itself, from changing this function's
-    // contract without revisiting its second call site.
-    const deadline = Date.now() + (opts.deadlineMs ?? 300_000);
-    let received = [...await opts.messages()];
-    while (!received.some((t) => t.includes(want)) && Date.now() < deadline) {
-        // Pending/quiet is an outcome; storage, module and transport failures are errors. Never
-        // disguise one as an empty read or a successful wait. The app's finally releases its owner.
-        const r = await pace();
-        received = [...await opts.messages()];
-        if ((r.stoppedBecause === "caught-up" || r.stoppedBecause === "body-pending") && !received.some(t => t.includes(want)))
-            await new Promise(res => setTimeout(res, 500));
-    }
-    const found = received.some((t) => t.includes(want));
-    say(`   retained ${received.length} message(s) on '${CHANNEL}'`);
-    return { seen: [...received], found };
-}
-// Only the node's body-unavailable outcome permits advancement. No application timer
-// converts pending/unreadable outcomes into absence; the shared collector owns that rule.