Stage 3 ran one source at a time, so three multi-minute Indexer window
scans summed instead of overlapping. Splitting it by what each half is
allowed to do lets the reads overlap while the writes stay ordered:

- compute (ledger precheck, window scan, replay, manifest assembly) now
  runs concurrently across sources
- ingest stays strictly serial across sources AND instances. uploadAqFile
  derives box names from account ids the frac *registry* allocates as it
  goes, and that counter is registry-wide, so two instances ingesting at
  once would predict the same ids and all but the first would fail with an
  invalid box reference - the same reason the SDK refuses to parallelize
  the batches within one upload.

Compute returns its per-source outcomes rather than pushing onto the run
context, so the report still reads the same on every run (pMap answers in
input order).

Also, on the same path:
- per-instance ledger prechecks fan out; a multi-instance source (reti runs
  one per validator) spent a serial round trip per instance before any scan
- plugins are built once per run and shared by stages 1 and 3; reti was
  resolving every validator's pools twice
- the manifest genesis hash is read once per run, not once per instance
- stage/phase timings behind the debug flag, so this is measurable at all

The account page paid a fan-out on two axes and a waterfall between
them: one committee-snapshot read per instance, then - once those
landed and syncedIds could be derived - one AQ read per committee.
On VotingPowerByCommittee, which passes every gGov committee, that is
~33 queries in two phases for a 3-pool account.

Fold both axes into the read that already spans instances:

- FracAccountCommitteeAq gains totalVotes, taken field-wise off the
  committees box getAccountCommitteeAq already reads to resolve
  committeeNumId - so it costs no extra box read and no extra
  reference. Field-wise rather than cloning because escrowsVotes sits
  between the two fields and grows with the escrow count, the same
  reasoning getCommitteeStanding documents.
- logAccountInstanceAQ takes committeeIds[] and logs one row per
  (instance, committee) pair, instance-major. Every row already echoes
  its committeeId, so callers group rather than index-align. It also
  gains the deleted-app probe its sibling logInstanceCommittees has -
  free, since the app is referenced by the inner call anyway, and today
  one deleted instance takes down the whole page.

References now split per-instance and per-pair, so the page size is a
function of the committee count:

    refs(I, C) = 1 + I*(2 + 3C) <= 128

C=1 gives 25, reproducing the old AQ_PAGE_SIZE exactly. C=42 fits no
instance at all, hence aqMaxCommitteesPerCall = 41 alongside
aqRefBudget. getAccountInstanceAQs sizes the two axes against each
other rather than paging instances serially - committee chunks are
independent and run in parallel. Given the caller's instance count it
solves for instances first; without it, for committees, which keeps the
single-committee callers at exactly the one round-trip they cost today.

Frontend: usePooledCommitteeAqs collapses to a single useQuery, the
syncedIds pre-filter disappears (it only existed to avoid the
per-committee cost), and poolVotes reads entry.totalVotes.
useFracInstanceCommittees becomes usePoolSyncedCommittees - a plain
useQuery for PoolDetail's account-independent "Voting since" row, the
one caller no account-scoped reader can serve.

Measured on localnet at 30 committees x 2 pools: 32 algod calls in two
phases -> 3 (one account read plus two parallel AQ chunks), 130ms ->
24ms. Instance approval program 6,427 -> 6,453 / 8,192 bytes.

BREAKING: getAccountCommitteeAq's return type changes, and with it its
ARC-4 selector, which the registry inner-calls by selector; and
logAccountInstanceAQ's own signature. Registry and every live instance
must be upgraded together. No deployed registry today - neither
.env.testnet nor .env.mainnet carries VITE_FRAC_REGISTRY_APP_ID.

Six-seat zuss (8/9 seats), written under the blindness clause of
PREREG_v41-release-replicate.md 3a(3): methodology only, no session
values. Majority locks Option (a) - crop-shape is NOT part of the
synthetic-control hypothesis, because a synthetic crop null cannot
calibrate or gate the Falcon crop/SHAPE path (non-transfer); the interim
raw-line ruling becomes permanent under it. The minority Option (b) draft
(matched synthetic null family + planted-shape positive control with a
numeric fire condition) is kept in full with the founder decision
criterion, because the split is real. Takes force only as a dated
pre-registration after the release-replicate decision, in the ruled order.

Security Impact: document only, explicitly not in force; no rule changes
until adopted.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Implements the dated interim ruling from the six-seat review of the v4.1
validation session: synthetic controls (control-flat, control-leaky) are
judged on the raw |t| >= 4.5 line ONLY via the new judge_raw_only — the
crop diagnostic does not run for them (crop_empirical_p = None), because a
synthetic loop and the real signing operation do not share a crop null and
judging one against the other is a mismatched reference. Observed live in
the quarantined session: the flat control read "Shape" at raw t = 2.99
against the null-ss bank and flipped controls to NOT OK. The regression
test pins exactly that shape: a flat series whose crop would fire against
a tight real-op bank must still Pass, the leaky control must still Fail on
the raw line, short samples stay INCONCLUSIVE. Whether a crop-shape
control validation returns later — with its own synthetic reference family
AND a synthetic-shape positive control with a numeric fire condition — is
left to its own pre-registration, per the apex ruling that left (a)-vs-(b)
genuinely open. READING_GUIDE documents the ruling in the artifact itself.

Also: PREREG_v41-release-replicate.md — the release-harness replicate
pre-registered BEFORE it can even be built (App Control still blocks fresh
release exes; founder decision pending). One reading (null_raw_t_sd, the
committed bands, registered as a low-information point-estimate call per
review F4), explicit non-readings (no v3.1 re-judgment — that needs a
matched-count 82k bank; banks frozen but unused until the controls pre-reg
and a specified §6.1 exist), and a deviation rule that makes any off-spec
run exploratory with the bands not applied — this morning's lesson,
written down.

V4_BACKLOG §A sweep: A1-A8 verified all closed by the v4/v4.1 work (A1
empty-null fail-closed with the CI session documented in judge_v2; A2
aa_verdict/aa_ok in Controls; A3 READING_GUIDE covers sign-aa; A4 sign-kk
description corrected; A5 no "flat-control null" comments remain; A6
null_reason serialized; A7 per-session null logging; A8 fold_null).

Gates: cargo fmt, clippy pedantic+nursery -D warnings clean, 24 tests
green in falcon-ct (15 lib + 9 bin).

Security Impact: measurement harness only; no crypto code. The change
NARROWS what a control verdict may be based on (raw line only) and cannot
lift any session verdict; the flat control can now block a session only
for a genuine raw-line environment failure. To re-verify: the release
replicate runs under the committed pre-registration once the harness
decision lands.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

# Conflicts:
#	docs/sidebar.config.json
#	docs/src/content/docs/concepts/core/account.md

# Conflicts:
#	docs/sidebar.config.json

Moving pool state to a single accountInformation read on the registry left two
gaps where a pool the bulk request missed stayed missed.

`processPoolData` fell back on the presence of the entry, not on what it held. A
pool whose state came back partial decodes to `{}`, which is truthy, so it kept
the empty entry and returned no lastPayout - which the Status column renders as
"Payouts stopped".

`algodVer` lost its fallback entirely. It came off LocalPoolInfo, and
StakingPoolInfo now reads it only from the bulk map; the per-pool read inside the
metrics query keeps lastPayout and discards the algodVer it fetched. Any pool the
map lacks reported its node version as "--" for the rest of the session.

Both now gate on `isPoolGlobalStateComplete`. It tests lastPayout rather than the
field being displayed, because lastPayout is written when the pool is created -
stakingPool.algo.ts sets it to the creation round as the first epoch's baseline -
so every pool has one and its absence can only mean an incomplete read. Gating on
algodVer instead would have been wrong: it is only written once the node daemon
reports in, and 88 of MainNet's 283 pools legitimately have none, so keying on it
would re-read a third of all pools on every visit and still show "--".

The 1020 fixture claimed a missing lastPayout stood for "a pool that has never
paid out", which the contract does not do. It now models the case that does
occur - a pool whose daemon has never reported, so no algodVer - and the tests
around it cover the fallback firing on an incomplete entry and staying put on a
complete one.

Implements the matched banks under --null-design ss: sign-aa repeats (fresh
keypair each, ungated) form the sign-kk crop bank; a null-rr bank supplies
sign-rr's crop reference and its three-state raw rule. rr design unchanged
(refs_for_rr: everything = the gate null, no raw bank, byte-identical v3
judging).

The full-team review's findings, each applied and tested:
- S1: reference banks are all-or-nothing — collect_sessions returns Result
  and a failed session propagates instead of silently truncating the bank;
  rr_raw_state returns no_reference_bank / invalid_statistic (NaN) rather
  than relabelling harness faults as fail_beyond_reference.
- S2: the gating A/A control is a conditioned draw and is excluded from the
  bank; ss requires --aa-repeats N >= 2 (enforced in check_v4_options and
  live via the CLI).
- S3: tests exercise production paths — refs_for_rr is the function the rr
  arm returns, and the tests call it; the guard truth table calls
  check_v4_options itself.
- S4: requested bank counts are serialized (aa_repeats_requested,
  rr_sessions_requested) because the rank floor 1/(N+1) makes N part of
  the rule.
- S5: both banks' raw CSVs are written (bank_raws), not only judged crops.

Gates: cargo fmt, clippy -D warnings (pedantic+nursery), 47 tests green,
all four CLI guard paths exercised against the built binary.

Security Impact: measurement harness only — no crypto code touched. What
changed: reference-bank construction and the sign-rr raw rule under the ss
design; ss sessions remain validation-only (ungated, INCONCLUSIVE,
validation_only:true) until a pre-registration lifts it. What could break:
a wrong bank would mis-calibrate future SHAPE annotations — mitigated by
all-or-nothing collection, serialized requested counts, and production-path
tests. To re-verify: the pending validation run reads only null_raw_t_sd.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Conflict in frac-delegation-sdk/src/registry/sdkReader.ts (imports only):
the incoming dual ESM/CJS build rewrote relative specifiers to carry .js,
while this branch added a FracInstanceCommitteeStanding type import for
getInstanceCommitteeStandings. Kept both — .js specifiers throughout,
including the new type import.

Docs: Add Transaction concepts page and examples

docs: address post-quantum feedback