verify_deployment.py:276 printed a U+2194 inside the DRIFT branch. On a
cp1252 console that raises UnicodeEncodeError *after* the comparison has
run and correctly found the mismatch, so the process dies inside its own
failure report and exits 2 ("could not complete the check") instead of 1
("DRIFT").

The exit codes are a contract, stated in that file's own docstring: 0
match, 1 drift, 2 could not check. A reviewer who sees 2 concludes the
tooling failed, not that the deployment diverged. So this downgraded a
real finding to an inconclusive one -- silently, and only on the platform
the maintainer actually works on.

It survived this long because the line only executes when something is
wrong. No green run could ever reach it. That is exactly the shape of
defect this repo keeps finding: a path that is never exercised until it
matters.

Adds sdk/tests/test_reports_print_on_a_windows_console.py, which scans the
scripts a reviewer is told to run for characters cp1252 cannot encode on
print lines. Em dash and ellipsis are deliberately allowed -- they ARE in
cp1252 and are used throughout these reports; flagging them would make the
guard unusable and it would be deleted.

The guard was mutation-tested rather than trusted: reintroducing the U+2194
makes it fail, and it does not fire on plain ASCII or on em dash/ellipsis.
A scan that cannot fail would have been worth nothing here.

Suite: 145 passed, 5 skipped. verify_deployment.py still prints MATCH.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Close the TestNet contract drift: deploy app 770964251 from the committed artifact

See https://github.com/algorandfoundation/algokit-utils-ts/pull/612

README tells reviewers to run the hermetic verification, and running it
unpacks the pinned Falcon tarball to falcon-src/ and builds in place,
leaving codec.lib and libfalcondet1024.pdb behind. .gitignore covered
build/ but not these, so following the documented path left three
untracked files and a dirty `git status`.

Found by actually running the advertised command rather than assuming it
was clean. Full run: 4 axes PASS, exit 0 -- including Axis C re-signing
the committed goldens byte-identically from a ziglang build, which is a
different compiler from the MinGW gcc used elsewhere in this session.
Cross-compiler byte-identity is what FALCON_FPEMU=1 exists to guarantee,
now demonstrated rather than asserted.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Co-authored-by: cce <51567+cce@users.noreply.github.com>

This branch diverged 6 ahead / 5 behind. main had built an apparatus around
the drift being OPEN -- a keyed redeploy workflow, a fail-closed secret gate,
a drift banner test, BLOCKERS.md -- while this branch closed the drift by
deploying app 770964251. Pushing without merging would have reverted all of
it.

Kept both approaches; they are complementary, not competing:
  * main's contracts/require_testnet_deploy_secret.py + testnet-redeploy.yml
    for a keyed CI deploy;
  * this branch's scripts/deploy_testnet_secure.py and _fresh.py for a human
    at a terminal, needing no repository secret.

Conflicts (5) resolved:
  * .github/workflows/ci.yml -> took main. It deliberately split the live
    bytecode match out of the required gates because that check needs live
    algod. That decision stands; the check now passes, but a network-dependent
    job still should not block merges.
  * README / REVIEWER / ROADMAP / AUDIT_READINESS -> took this branch. main's
    side described the drift as open, which is no longer true.

The partition guard did its job: the merge introduced six files mentioning an
app id that nobody had classified, and it failed until each was decided.

  FROZEN   sdk/tests/test_testnet_drift_banner.py  (synthetic fixture; kept as
           a regression guard so a future mismatch cannot degrade to a skip)
           BLOCKERS.md  (must keep quoting the measured 660 B / d24d9071 and
           709 B / 6fa5cee1 -- the banner test asserts they are still there)
           LOCALNET_VALIDATION_2026-06-01.md  (a dated record)
  LIVE     CONTRIBUTING.md, testnet-followup.yml, testnet-redeploy.yml

Prose again, not just constants: ci.yml, CONTRIBUTING.md and both workflows
still said "until app 763809096 is replaced" and "predates the committed
contract". It has been replaced. Corrected to say so, with the three-month
red period kept on the record rather than tidied away.

BLOCKERS.md is now CLOSED with the measured drift preserved verbatim below a
historical-record heading.

Verified: MATCH on app 770964251; verify_trelyan.py 18 passed, 0 failed;
suite 142 passed, 5 skipped; partition guard 30 passed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

See https://github.com/algorandfoundation/algokit-utils-ts/pull/612

App 763809096 (2 June 2026) served 660 B / d24d9071 while this source
assembles to 709 B / 6fa5cee1. Control I5 makes on_update and on_delete
reject unconditionally, so it could never be patched in place. The drift
check was left running and failing in public for three months rather than
folded into the green gates or "closed" by copying the chain's hash into
the repo.

Closed on 2026-09-03 by deploying a NEW app from the committed artifact:

  contracts/verify_deployment.py --app-id 770964251  ->  MATCH
    expected (committed TEAL) : 709 B  sha512_256 6fa5cee1...b981c4b
    deployed app 770964251    : 709 B  sha512_256 6fa5cee1...b981c4b

  sdk/examples/verify_trelyan.py  ->  18 passed, 0 failed  (was 17/1)

Retargeted the 14 LIVE_CLAIM files only, per the partition in
test_app_id_references_are_coherent.py. The four FROZEN files are
deliberately untouched and still name 763809096: the KAT goldens sign
messages containing that app id, and _LIVE_M_HEX is what the chain took.
Regenerating them to make a red KAT green would have replaced the
byte-identity reference the whole signature gate rests on.

Prose, not just constants: a mechanical id swap left several statements
false -- "predates this source and can never match", "660 B", "2 June
2026", "reading this source is not reviewing app ...", and a sentence in
the interop KAT claiming the goldens are what the NEW app verifies. All
corrected to describe the deployment that now exists, with the superseded
app kept on chain and in the docs as the historical record.

Verified: partition guard 24 passed; python suite 126 passed, 5 skipped;
FROZEN files show no diff; goldens still carry app_id 763809096.

App 763809096 remains on chain, unmodified.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

See https://github.com/algorandfoundation/algokit-utils-ts/pull/612

Bumps the all group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@algorandfoundation/tealscript](https://github.com/algorandfoundation/TEALScript) | `0.106.3` | `0.107.2` |
| [@tsconfig/node22](https://github.com/tsconfig/bases/tree/HEAD/bases) | `22.0.5` | `22.0.6` |
| [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.64.0` | `8.68.0` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.10` | `4.1.11` |
| [prettier](https://github.com/prettier/prettier) | `3.9.5` | `3.9.6` |
| [semantic-release](https://github.com/semantic-release/semantic-release) | `25.0.7` | `25.0.9` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.1` | `4.23.12` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.64.0` | `8.68.0` |
| [uuid](https://github.com/uuidjs/uuid) | `14.0.1` | `14.0.2` |



Updates `@algorandfoundation/tealscript` from 0.106.3 to 0.107.2
- [Release notes](https://github.com/algorandfoundation/TEALScript/releases)
- [Commits](https://github.com/algorandfoundation/TEALScript/compare/0.106.3...0.107.2)

Updates `@tsconfig/node22` from 22.0.5 to 22.0.6
- [Commits](https://github.com/tsconfig/bases/commits/HEAD/bases)

Updates `@typescript-eslint/eslint-plugin` from 8.64.0 to 8.68.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.68.0/packages/eslint-plugin)

Updates `@vitest/coverage-v8` from 4.1.10 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/coverage-v8)

Updates `prettier` from 3.9.5 to 3.9.6
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.9.5...3.9.6)

Updates `rolldown` from 1.2.0 to 1.2.6
- [Release notes](https://github.com/rolldown/rolldown/releases)
- [Changelog](https://github.com/rolldown/rolldown/blob/main/CHANGELOG.md)
- [Commits](https://github.com/rolldown/rolldown/commits/v1.2.6/packages/rolldown)

Updates `semantic-release` from 25.0.7 to 25.0.9
- [Release notes](https://github.com/semantic-release/semantic-release/releases)
- [Commits](https://github.com/semantic-release/semantic-release/compare/v25.0.7...v25.0.9)

Updates `tsx` from 4.23.1 to 4.23.12
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](https://github.com/privatenumber/tsx/compare/v4.23.1...v4.23.12)

Updates `typescript-eslint` from 8.64.0 to 8.68.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.68.0/packages/typescript-eslint)

Updates `uuid` from 14.0.1 to 14.0.2
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](https://github.com/uuidjs/uuid/compare/v14.0.1...v14.0.2)

Updates `vitest` from 4.1.10 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest)

---
updated-dependencies:
- dependency-name: "@algorandfoundation/tealscript"
  dependency-version: 0.107.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: "@tsconfig/node22"
  dependency-version: 22.0.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-version: 8.68.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 4.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: prettier
  dependency-version: 3.9.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: rolldown
  dependency-version: 1.2.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: semantic-release
  dependency-version: 25.0.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: tsx
  dependency-version: 4.23.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: typescript-eslint
  dependency-version: 8.68.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: uuid
  dependency-version: 14.0.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: vitest
  dependency-version: 4.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix: bundle correct type declarations via tsc

* chore: remove unused dts plugin

Co-authored-by: joe-p <50534337+joe-p@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

The STATUS block said "Edit ONLY _ApkAdapter to wire the real API, and the
suite runs." Measured against algo-pqc-kit 0.3.1, that is false, and someone
would have spent real time on the adapter before finding out.

Installed the package and armed TRELYAN_REQUIRE_INTEROP=1 so the inertness
became loud rather than silent. Two findings, the second decisive:

  * FalconAccount.from_private_key EXISTS -- so the guessed API shape was
    right -- but is an unimplemented stub. The primary direction cannot load
    the committed fixture key however the adapter is written.

  * Upstream signs STANDARD RANDOMIZED Falcon-1024: header byte 0x3A, and the
    same message signed twice yields different bytes. TRELYAN signs
    deterministic det1024, header 0xBA, nonce SHAKE256(logn || privkey ||
    data). Byte-identity between a randomized and a derandomized signer is
    unachievable by construction.

Key sizes DO match (privkey 2305, pubkey 1793), which is exactly why it looks
compatible at a glance. Observed sig length 1272 B against their fixed
FALCON_SIG_SIZE of 1280.

Documentation only; no test logic changed. Suite still 126 passed, 5 skipped.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>