Stage 3 ran one source at a time, so three multi-minute Indexer window
scans summed instead of overlapping. Splitting it by what each half is
allowed to do lets the reads overlap while the writes stay ordered:

- compute (ledger precheck, window scan, replay, manifest assembly) now
  runs concurrently across sources
- ingest stays strictly serial across sources AND instances. uploadAqFile
  derives box names from account ids the frac *registry* allocates as it
  goes, and that counter is registry-wide, so two instances ingesting at
  once would predict the same ids and all but the first would fail with an
  invalid box reference - the same reason the SDK refuses to parallelize
  the batches within one upload.

Compute returns its per-source outcomes rather than pushing onto the run
context, so the report still reads the same on every run (pMap answers in
input order).

Also, on the same path:
- per-instance ledger prechecks fan out; a multi-instance source (reti runs
  one per validator) spent a serial round trip per instance before any scan
- plugins are built once per run and shared by stages 1 and 3; reti was
  resolving every validator's pools twice
- the manifest genesis hash is read once per run, not once per instance
- stage/phase timings behind the debug flag, so this is measurable at all

Six-seat zuss (8/9 seats), written under the blindness clause of
PREREG_v41-release-replicate.md 3a(3): methodology only, no session
values. Majority locks Option (a) - crop-shape is NOT part of the
synthetic-control hypothesis, because a synthetic crop null cannot
calibrate or gate the Falcon crop/SHAPE path (non-transfer); the interim
raw-line ruling becomes permanent under it. The minority Option (b) draft
(matched synthetic null family + planted-shape positive control with a
numeric fire condition) is kept in full with the founder decision
criterion, because the split is real. Takes force only as a dated
pre-registration after the release-replicate decision, in the ruled order.

Security Impact: document only, explicitly not in force; no rule changes
until adopted.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Implements the dated interim ruling from the six-seat review of the v4.1
validation session: synthetic controls (control-flat, control-leaky) are
judged on the raw |t| >= 4.5 line ONLY via the new judge_raw_only — the
crop diagnostic does not run for them (crop_empirical_p = None), because a
synthetic loop and the real signing operation do not share a crop null and
judging one against the other is a mismatched reference. Observed live in
the quarantined session: the flat control read "Shape" at raw t = 2.99
against the null-ss bank and flipped controls to NOT OK. The regression
test pins exactly that shape: a flat series whose crop would fire against
a tight real-op bank must still Pass, the leaky control must still Fail on
the raw line, short samples stay INCONCLUSIVE. Whether a crop-shape
control validation returns later — with its own synthetic reference family
AND a synthetic-shape positive control with a numeric fire condition — is
left to its own pre-registration, per the apex ruling that left (a)-vs-(b)
genuinely open. READING_GUIDE documents the ruling in the artifact itself.

Also: PREREG_v41-release-replicate.md — the release-harness replicate
pre-registered BEFORE it can even be built (App Control still blocks fresh
release exes; founder decision pending). One reading (null_raw_t_sd, the
committed bands, registered as a low-information point-estimate call per
review F4), explicit non-readings (no v3.1 re-judgment — that needs a
matched-count 82k bank; banks frozen but unused until the controls pre-reg
and a specified §6.1 exist), and a deviation rule that makes any off-spec
run exploratory with the bands not applied — this morning's lesson,
written down.

V4_BACKLOG §A sweep: A1-A8 verified all closed by the v4/v4.1 work (A1
empty-null fail-closed with the CI session documented in judge_v2; A2
aa_verdict/aa_ok in Controls; A3 READING_GUIDE covers sign-aa; A4 sign-kk
description corrected; A5 no "flat-control null" comments remain; A6
null_reason serialized; A7 per-session null logging; A8 fold_null).

Gates: cargo fmt, clippy pedantic+nursery -D warnings clean, 24 tests
green in falcon-ct (15 lib + 9 bin).

Security Impact: measurement harness only; no crypto code. The change
NARROWS what a control verdict may be based on (raw line only) and cannot
lift any session verdict; the flat control can now block a session only
for a genuine raw-line environment failure. To re-verify: the release
replicate runs under the committed pre-registration once the harness
decision lands.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Moving pool state to a single accountInformation read on the registry left two
gaps where a pool the bulk request missed stayed missed.

`processPoolData` fell back on the presence of the entry, not on what it held. A
pool whose state came back partial decodes to `{}`, which is truthy, so it kept
the empty entry and returned no lastPayout - which the Status column renders as
"Payouts stopped".

`algodVer` lost its fallback entirely. It came off LocalPoolInfo, and
StakingPoolInfo now reads it only from the bulk map; the per-pool read inside the
metrics query keeps lastPayout and discards the algodVer it fetched. Any pool the
map lacks reported its node version as "--" for the rest of the session.

Both now gate on `isPoolGlobalStateComplete`. It tests lastPayout rather than the
field being displayed, because lastPayout is written when the pool is created -
stakingPool.algo.ts sets it to the creation round as the first epoch's baseline -
so every pool has one and its absence can only mean an incomplete read. Gating on
algodVer instead would have been wrong: it is only written once the node daemon
reports in, and 88 of MainNet's 283 pools legitimately have none, so keying on it
would re-read a third of all pools on every visit and still show "--".

The 1020 fixture claimed a missing lastPayout stood for "a pool that has never
paid out", which the contract does not do. It now models the case that does
occur - a pool whose daemon has never reported, so no algodVer - and the tests
around it cover the fallback firing on an incomplete entry and staying put on a
complete one.

Implements the matched banks under --null-design ss: sign-aa repeats (fresh
keypair each, ungated) form the sign-kk crop bank; a null-rr bank supplies
sign-rr's crop reference and its three-state raw rule. rr design unchanged
(refs_for_rr: everything = the gate null, no raw bank, byte-identical v3
judging).

The full-team review's findings, each applied and tested:
- S1: reference banks are all-or-nothing — collect_sessions returns Result
  and a failed session propagates instead of silently truncating the bank;
  rr_raw_state returns no_reference_bank / invalid_statistic (NaN) rather
  than relabelling harness faults as fail_beyond_reference.
- S2: the gating A/A control is a conditioned draw and is excluded from the
  bank; ss requires --aa-repeats N >= 2 (enforced in check_v4_options and
  live via the CLI).
- S3: tests exercise production paths — refs_for_rr is the function the rr
  arm returns, and the tests call it; the guard truth table calls
  check_v4_options itself.
- S4: requested bank counts are serialized (aa_repeats_requested,
  rr_sessions_requested) because the rank floor 1/(N+1) makes N part of
  the rule.
- S5: both banks' raw CSVs are written (bank_raws), not only judged crops.

Gates: cargo fmt, clippy -D warnings (pedantic+nursery), 47 tests green,
all four CLI guard paths exercised against the built binary.

Security Impact: measurement harness only — no crypto code touched. What
changed: reference-bank construction and the sign-rr raw rule under the ss
design; ss sessions remain validation-only (ungated, INCONCLUSIVE,
validation_only:true) until a pre-registration lifts it. What could break:
a wrong bank would mis-calibrate future SHAPE annotations — mitigated by
all-or-nothing collection, serialized requested counts, and production-path
tests. To re-verify: the pending validation run reads only null_raw_t_sd.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Conflict in frac-delegation-sdk/src/registry/sdkReader.ts (imports only):
the incoming dual ESM/CJS build rewrote relative specifiers to carry .js,
while this branch added a FracInstanceCommitteeStanding type import for
getInstanceCommitteeStandings. Kept both — .js specifiers throughout,
including the new type import.

Docs: Add Transaction concepts page and examples

The /pools/$committeeId page from the design: how much of a committee's voting
power sits in staking pools and which pools those are, ranked, with the
AlgoQuarters behind each pool's power and how much of that stake voted. The
committee is the route rather than component state, so a composition is
linkable and shareable; /pools redirects to the current window. Retires the
stub href on the committee detail card, and lifts that card's composition bar
into a component the two share.

Serving it the way the card already did would have cost 373 algod requests
against a 62-instance registry: getExistingInstances is a box-map read plus an
existence lookup per instance, then a snapshot read per instance, then an
AlgoQuarters read per instance. So the registry now answers the whole question
itself.

logInstanceCommittees pages over its own instance ID range - dense, since
lastInstanceNumId only increments and instances boxes are never removed - and
inner-calls each instance's new getCommitteeStanding, which joins the committee
snapshot with its AlgoQuarters ledger where both boxes already are. That join
has to happen on the instance: committeeAq is keyed by the numeric ID only the
snapshot yields, so an outside caller cannot start the second read until the
first lands. Deleted instance apps are skipped on chain via app_params_get
rather than failing the page, which is what removes the per-instance existence
lookup the SDK was doing. An instance that never synced the committee is
reported with committeeNumId 0 rather than dropped, so absence stays provable.
373 requests become 2.

getInstanceCommittee is the singular counterpart, and the reason the struct
lands in the registry's ARC-56 - SDKs decode the log payload from generated
types instead of a hand-maintained copy, the same arrangement
logAccountVotingRecords already has. Page size is 32, from the same
unnamed-reference accounting as the existing paged log readers.

Two figures on the page are honest approximations of what the design asked
for. The liquid-vs-Reti filter reads the instance name, because FracInstance
records no kind; it is only offered when both buckets are populated and carries
a TODO for the contract-side fix. Turnout is AlgoQuarters-weighted - the share
of a pool's stake that cast an internal ballot in the newest period the
committee has opened - because a member-count percentage would need a read per
member.

The e2e spec added here has not run. Every contracts e2e spec currently dies in
algokit's composer with "Not an address", on an untouched checkout as much as
on this branch. scripts/verify-instance-committees.ts covers the same ground
with no vitest in the way, and passes against LocalNet.

Reads each pool's stake in the committee from the frac registry:
getExistingInstances for the pool names and rosters, then that instance's
synced snapshot of the committee for its gGov power. These are a pool's own
power, which is exact, so they carry no approximation marker - unlike a
member's floor-split share of it.

Every figure loads on its own dependencies rather than behind one card-level
gate, and the section goes dark entirely on a network with no frac registry.
The View pools link is a stub href until the pools route exists.

Also reflows the members leaderboard below sm: the share column had a 120px
minimum that left the account column ~46px, clipping addresses on mobile. The
bar now sits inline under the account name, matching the design.

Protocol/goal omitempty drops votefst=0. Restore 0 on decode when
other online keyreg fields are present so Lora can read those txns.

Restores the allocation-bounds loop in init() and
SetConfigurableConsensusProtocols by providing the
checkSetAllocBounds function the SDK previously lacked.
Addresses algorand/go-algorand-sdk#757.

Unblock node-ci by aligning .nsprc and dependency overrides with the
current better-npm-audit DB (including nanoid 1139427). Dev-only paths
only; no runtime package changes. Keeps composer duplicate-txn feature.