pnpm audit --audit-level=high was failing on:

- nanoid <3.3.18 (GHSA-2v37-7h3g-55p8, "custom generators can loop
  indefinitely when size is zero") -> 3.3.17 bumped to 3.3.18

nanoid is only in the tree transitively via postcss (>vite>vitest etc.),
whose ^3.3.11 range already admits the fix, so this is a lockfile-only
bump with no override — same as the previous 3.3.16 -> 3.3.17 bump.
3.3.18 was published 2026-08-07 and is now past the workspace
minimumReleaseAge, so no exclude is needed either.

pnpm install --frozen-lockfile and pnpm audit --audit-level=high verified
locally (0 high; 4 low / 5 moderate remain, below the threshold).

- Implements Stage 1 of ***The Doc***: escrow/instance recognition + on-chain reconciliation (admin).

- New layer of abstraction: staking sources; defined as the pipeline-integrated pooling protocols, i.e. "reti", "talgo" and soon "xalgo". A source like reti can have multiple instances. Sources like LSTs are typically single-instance.

Steps:
1. Does an escrow/instance discovery phase, specific for each source.
2. Then, escrow recognition: intersection of committee govs and fetched escrows.
3. On-chain reconciliation: create instances and register escrows as needed.
4. Call `importFracDelegationsAll` on ggov registry.

Missing:
- `xalgo` (as staking source) implementation
- Stage 2: integrate AQ calculation scripts from `ggov-algoquarters`
- Stage 3: call `uploadAqFile` which orchestrates the AQ primitives from an `AlgoQuartersFile`

There's some patches on the build and node stuff. Does not intersect with the logic, but nice to adjust when possible:

- `node --experimental-strip-types` as we are under ^22.18.0 (currently ^22.15.0);
- conflicts between csj and esm builds: reti-ghost-sdk builds different than frac-delegation-sdk and ggov-sdk. See workaround in `scripts/test-run.ts`.

- Converges frac-delegation-sdk on ggov-sdk's style. `instanceBoxName` was deriving prefix + key encoding from the ARC-56 spec at call time; it now hardcodes 'i' + big-endian uint16, matching gGov's `periodBoxName`/`topicBodyBoxName`. Drops the ABIType, APP_SPEC and Buffer dependencies from the util.

- New `smart_contracts/boxNames.spec.ts` derives the expected bytes from the compiled specs and compares them against every helper, at 0 / 1 / key-type max. Deriving there and nowhere in the SDKs is what makes drift visible. Plain `.spec.ts`, no contract code and no chain.

- Also guards the cross-app near-collision: the period app's `periodBody` key is 'P', the registry's `periodApprovalBox` key is 'Pap'. Same leading byte, different apps, and `asciiBoxName` is single-byte by construction.

- Stops four places re-implementing the helpers by hand — `getPeriodBody` and `getTopicBody` in ggov-sdk's period reader were building 'P' and 'T' + uint32 inline, and both vote e2e tests were assembling the expected box name byte by byte. The e2e tests keep their own job: proving the ref is emitted on both the top-up and no-top-up branches.

- `makeVoteTxns` now names the frac registry app and its `instances` box on every vote, top-up or not, given the state-conditional inner call on `checkNeedMBR`.

- Ref-slot padding goes `numEscrows * 5 + 20` -> `+ 21` for the extra box.

- `extraFee` is deliberately unchanged. Both MBR hops pay their own fee, so the voter's group fee is invariant to whether the top-up fires.

- New `instanceBoxName` in util/boxes.ts, deriving prefix and key encoding from the ARC-56 spec rather than hardcoding 'i' + uint16.

- Test coverage includes regression-like cases for the whole MBR top-up flow.

- A frac vote nests a GGovPeriod.vote per re-cast escrow, and that inner vote runs its own checkNeedMBR — which reads `periods` on the gGov registry. Population resolves refs by simulating, so a period that dropped under its minimum balance between simulate and execution failed the whole vote.

- Same fix as the frac registry's `instances` box, one layer down. One slot, not one per escrow: every cast hits the same box. Padding 21 -> 22, fees unchanged.

Analogous to fractional delegation. Same registry as a vault + MBR post-condition pattern.

- Neither reader had a single test. Both scan box names by prefix, so a contract-side prefix change made them return [] with nothing going red — and `getVoters` feeds the frontend's voter list, so that silence reached the UI.

- `getVoters` asserts empty before any vote, then exactly the govs who voted. The period's 'o'/'t' boxes already exist at that point, so it also pins that the 'v' filter excludes them.

- Verified by sabotage: flipping 'v' to 0x77 and 'a' to 'b' fails both.

- The registry becomes an MBR vault. `vote()` ends with `checkNeedMBR()` subroutine: if the instance app account is at or below its minimum balance, it inner-calls the registry's new `requestMBR`, which pays it `mbrTopUp` (new global, 5 A, settable via `setMBRTopUp`). Users never pay vote-record MBR, and instances no longer need hand-funding.

- Post-condition, not a threshold. The AVM updates `min_balance` the instant a box is allocated but enforces the requirement only after each (outer) transaction, so the account may sit underwater mid-execution as long as the top-up lands first. However, MBR do is enforced between intermediate states of a group transaction, so a sibling payment later in the same group would be too late.

Nits: `checkNeedMBR()` could sit in more than one place:
- periodVoteCache is always an overwrite, so the call could go before it
- on a re-vote the record write is an overwrite too, so the call could be skipped

Left plain at the end for clarity; the saving would be a handful of opcodes. What is not flexible is that it must stay after the vote record write - that write is the allocation it repairs.

- Show the period title in the /manage list. New Title column, and the whole row is now one `PeriodTableRow` component so the period body is read once per row instead of twice — the title and the ballot label both come from it, and the list query doesn't include it.

- The voting window column now shows dates only, with the full UTC times on hover. This needed a new `formatDateRangeUTC`: the existing `formatDateRange` uses the viewer's timezone, and the manage panel works in UTC, so it could show a different day than the tooltip below it.

- Sample data: election ballots read Support / Veto / Abstain, matching what the manage UI writes.