chore: update .env.master.example with new deployment scripts and treasury manager parameters; enhance AGENTS.md with GRU reference primacy details

- Added new deployment script references for Aave quote-push and treasury manager in .env.master.example. - Updated AGENTS.md to include information on GRU reference primacy versus public PMM mesh execution model. - Minor updates to various documentation files to reflect changes in policy and operational guidelines. Made-with: Cursor
2026-04-12 18:20:41 -07:00
parent 6945f69d7d
commit 0d29343941
133 changed files with 7017 additions and 539 deletions
--- a/.cursor/rules/chain138-tokens-and-pmm.mdc
+++ b/.cursor/rules/chain138-tokens-and-pmm.mdc
@@ -16,6 +16,8 @@ alwaysApply: true

 **PMM pools (live funded public):** cUSDT/cUSDC `0xff8d3b8fDF7B112759F076B69f4271D4209C0849` | cUSDT/USDT `0x6fc60DEDc92a2047062294488539992710b99D71` | cUSDC/USDC `0x9f74Be42725f2Aa072a9E0CdCce0E7203C510263` — see `docs/11-references/ADDRESS_MATRIX_AND_STATUS.md` / `PMM_DEX_ROUTING_STATUS.md`.

+**Public cW\* mesh (cross-chain):** treat as **execution / corridor capacity** against reference-anchored GRU policy, not shadow FX — `docs/04-configuration/GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md`, `cross-chain-pmm-lps/config/peg-bands.json` **`gruPolicyIntegration`**.
+
 **cXAUC / cXAUT (XAU):** `0x290E52a8819A4fbD0714E517225429aA2B70EC6b`, `0x94e408E26c6FD8F4ee00b54dF19082FDA07dC96E` (6 decimals). **1 full token = 1 troy ounce Au** — not USD face value; see `EXPLORER_TOKEN_LIST_CROSSCHECK.md` section 5.1.

 **RPC (deploy):** `RPC_URL_138=http://192.168.11.211:8545`. **Deployer:** `0x4A666F96fC8764181194447A7dFdb7d471b301C8`. Add-liquidity reads tokens from the integration contract, not env. Do not use non-canonical Blockscout addresses (§2 of EXPLORER_TOKEN_LIST_CROSSCHECK).
--- a/.cursor/rules/project-doc-and-deployment-refs.mdc
+++ b/.cursor/rules/project-doc-and-deployment-refs.mdc
@@ -9,6 +9,7 @@ When answering token/PMM/deployment questions, prefer these docs over inferring

 **Canonical / verification:** `docs/11-references/EXPLORER_TOKEN_LIST_CROSSCHECK.md` (§5 canonical, §8 on-chain verification)  
 **Token / bridge naming (UTRNF + DBIS `c*` mapping):** `docs/04-configuration/naming-conventions/README.md` (especially `02_DBIS_NAMESPACE_AND_UTRNF_MAPPING.md` for UTRNF `c` vs compliant money)  
+**GRU FX reference vs public PMM mesh:** `docs/04-configuration/GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md` (reference-first policy; mesh = execution layer)  
 **Contract addresses:** `docs/11-references/CONTRACT_ADDRESSES_REFERENCE.md` (includes **Ethereum mainnet optional TRUU PMM** subsection)  
 **Address matrix:** `docs/11-references/ADDRESS_MATRIX_AND_STATUS.md`  
 **Mainnet TRUU PMM (optional volatile rail):** `docs/03-deployment/MAINNET_PMM_TRUU_CWUSD_PEG_AND_BOT_RUNBOOK.md` section 11; `cross-chain-pmm-lps/config/deployment-status.json` `chains."1".pmmPoolsVolatile[]`  
--- a/.env.master.example
+++ b/.env.master.example
@@ -239,8 +239,11 @@ ETHEREUM_MAINNET_RPC=
 DODO_PMM_INTEGRATION_MAINNET=
 # --- Mainnet Aave flash quote-push (cWUSDC/USDC peg / rebalance without wallet USDC) ---
 # If the deployer wallet already has USDC + cWUSDC: bash scripts/deployment/apply-mainnet-cwusdc-usdc-peg-tranche-from-wallet.sh --dry-run | --apply
+# Receiver only: bash scripts/deployment/deploy-mainnet-aave-quote-push-receiver.sh --dry-run | --apply
 # Deploy: bash scripts/deployment/deploy-mainnet-aave-quote-push-stack.sh --dry-run | --apply
+# Treasury manager: bash scripts/deployment/deploy-mainnet-quote-push-treasury-manager.sh --dry-run | --apply
 # One shot: bash scripts/deployment/run-mainnet-aave-cwusdc-quote-push-once.sh --dry-run | --apply
+# Keeper: bash scripts/deployment/run-mainnet-aave-quote-push-keeper.sh --dry-run | --apply
 # Loop:    FLASH_LOOP_COUNT=3 bash scripts/deployment/run-mainnet-aave-cwusdc-quote-push-loop.sh --dry-run | --apply
 # Forge sources: smom-dbis-138/script/flash/RunMainnetAaveCwusdcUsdcQuotePushOnce.s.sol
 # Modeling (no chain writes): scripts/deployment/run-mainnet-cwusdc-flash-quote-push-model-sweep.sh
@@ -259,6 +262,24 @@ UNWIND_TWO_HOP_POOL_A=0xe944b7Cb012A0820c07f54D51e92f0e1C74168DB
 UNWIND_TWO_HOP_POOL_B=0x27f3aE7EE71Be3d77bAf17d4435cF8B895DD25D2
 UNWIND_TWO_HOP_MID_TOKEN=0xaF5017d0163ecb99d9B5D94e3b4D7b09Af44D8AE
 UNWIND_MIN_MID_OUT_RAW=1
+# Retained-surplus recycle / treasury manager policy:
+# QUOTE_PUSH_RECEIVER_OWNER=0x...
+# Live migration shortcut:
+#   bash scripts/deployment/deploy-mainnet-aave-quote-push-receiver.sh --apply
+#   AAVE_QUOTE_PUSH_RECEIVER_MAINNET=<new_receiver> QUOTE_PUSH_TREASURY_TAKE_RECEIVER_OWNERSHIP=1 bash scripts/deployment/deploy-mainnet-quote-push-treasury-manager.sh --apply
+# QUOTE_PUSH_TREASURY_MANAGER_MAINNET=0x...
+# QUOTE_PUSH_TREASURY_OWNER=0x...
+# QUOTE_PUSH_TREASURY_OPERATOR=0x...
+# QUOTE_PUSH_TREASURY_GAS_RECIPIENT=0x...
+# QUOTE_PUSH_TREASURY_RECYCLE_RECIPIENT=0x...
+# QUOTE_PUSH_RECEIVER_RESERVE_RAW=0
+# QUOTE_PUSH_TREASURY_RESERVE_RAW=0
+# QUOTE_PUSH_TREASURY_TAKE_RECEIVER_OWNERSHIP=1
+# QUOTE_PUSH_KEEPER_SKIP_FLASH=0
+# QUOTE_PUSH_KEEPER_SKIP_RECYCLE=0
+# QUOTE_PUSH_DEPLOYER_GAS_FLOOR_ETH=0.003
+# QUOTE_PUSH_OPERATION_BUFFER_ETH=0.0005
+# QUOTE_PUSH_NATIVE_TOKEN_PRICE=3200
 # Discover V3 pools: bash scripts/verify/probe-uniswap-v3-cwusdc-usdc-mainnet.sh
 # Optional min-out overrides (script derives from pool query + Aave premium when unset):
 # MIN_OUT_PMM=
--- a/.github/workflows/validate-config.yml
+++ b/.github/workflows/validate-config.yml
@@ -40,6 +40,18 @@ on:
      - 'scripts/deployment/pmm-soak-export-wallet-grid.py'
      - '.github/workflows/pmm-soak-grid-smoke.yml'
      - 'docs/11-references/CHAIN138_GRID_6534_WALLET_FUNDING_PLAN.md'
+      - 'docs/04-configuration/GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md'
+      - 'docs/04-configuration/GRU_C_STAR_V2_STANDARDS_MATRIX_AND_IMPLEMENTATION_PLAN.md'
+      - 'scripts/verify/check-gru-reference-primacy-integration.sh'
+      - 'cross-chain-pmm-lps/config/peg-bands.json'
+      - 'cross-chain-pmm-lps/docs/04-bot-policy.md'
+      - 'cross-chain-pmm-lps/docs/05-oracles.md'
+      - 'docs/00-meta/SUBMODULE_HYGIENE.md'
+      - 'docs/00-meta/NEXT_STEPS_LIST.md'
+      - 'docs/00-meta/OPERATOR_READY_CHECKLIST.md'
+      - 'docs/11-references/GRU_V2_PUBLIC_PROTOCOL_DEPLOYMENT_STATUS.md'
+      - '.cursor/rules/chain138-tokens-and-pmm.mdc'
+      - 'scripts/run-completable-tasks-from-anywhere.sh'
  push:
    branches: [master, main]
    paths:
@@ -79,6 +91,18 @@ on:
      - 'scripts/deployment/pmm-soak-export-wallet-grid.py'
      - '.github/workflows/pmm-soak-grid-smoke.yml'
      - 'docs/11-references/CHAIN138_GRID_6534_WALLET_FUNDING_PLAN.md'
+      - 'docs/04-configuration/GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md'
+      - 'docs/04-configuration/GRU_C_STAR_V2_STANDARDS_MATRIX_AND_IMPLEMENTATION_PLAN.md'
+      - 'scripts/verify/check-gru-reference-primacy-integration.sh'
+      - 'cross-chain-pmm-lps/config/peg-bands.json'
+      - 'cross-chain-pmm-lps/docs/04-bot-policy.md'
+      - 'cross-chain-pmm-lps/docs/05-oracles.md'
+      - 'docs/00-meta/SUBMODULE_HYGIENE.md'
+      - 'docs/00-meta/NEXT_STEPS_LIST.md'
+      - 'docs/00-meta/OPERATOR_READY_CHECKLIST.md'
+      - 'docs/11-references/GRU_V2_PUBLIC_PROTOCOL_DEPLOYMENT_STATUS.md'
+      - '.cursor/rules/chain138-tokens-and-pmm.mdc'
+      - 'scripts/run-completable-tasks-from-anywhere.sh'

 jobs:
  validate:
@@ -88,6 +112,18 @@ jobs:
      - name: Checkout
        uses: actions/checkout@v4

+      - uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'pnpm'
+
+      - name: Install workspace dependencies
+        run: pnpm install --frozen-lockfile
+
      - name: Config validation
        run: bash scripts/validation/validate-config-files.sh

@@ -134,6 +170,7 @@ jobs:
            scripts/lib/pmm-soak-chain138-tick.sh
            scripts/deployment/chain138-pmm-random-soak-swaps.sh
            scripts/deployment/chain138-pmm-soak-grid-bot.sh
+            scripts/verify/check-gru-reference-primacy-integration.sh
          )
          shellcheck -x "${shells[@]}"

--- a/AGENTS.md
+++ b/AGENTS.md
@@ -18,6 +18,7 @@ Orchestration for Proxmox VE, Chain 138 (`smom-dbis-138/`), explorers, NPMplus,
 | **SolaceNet + gateway rails** (dbis_core) | Hub map: `docs/04-configuration/SOLACENET_PUBLIC_HUB.md`. Backlog: `dbis_core/docs/solacenet/REMAINING_TASKS_FULL_LIST.md`. Gap IDs: `dbis_core/docs/solacenet/PROTOCOL_GAPS_CHECKLIST.md`. **Delta audit** (missing wiring, naming drift, CI): `dbis_core/docs/solacenet/AUDIT_GAPS_INCONSISTENCIES_MISSING.md`. Enforce rails runbook: `dbis_core/docs/solacenet/SOLACENET_GATEWAY_RAILS_ENFORCE_RUNBOOK.md`. Tests: `cd dbis_core && npm run test:gateway` (unit + HTTP integration). **Provider seed:** `cd dbis_core && npm run seed:gateway-provider` (needs `DATABASE_URL`). **Smoke (auth):** `bash scripts/verify/check-dbis-core-gateway-rails.sh`. **Outbox worker:** `cd dbis_core && npm run worker:gateway-outbox` (`DATABASE_URL`). CI: `.github/workflows/dbis-core-gateway-ci.yml`. API: `GET/POST /api/v1/gateway/rails*` (optional `SOLACENET_GATEWAY_RAILS_ENFORCE`) — `dbis_core/src/core/gateway/routes/gateway.routes.ts`. |
 | cXAUC/cXAUT unit | 1 full token = 1 troy oz Au — `docs/11-references/EXPLORER_TOKEN_LIST_CROSSCHECK.md` (section 5.1) |
 | GRU / UTRNF token naming (`c*` vs collateral prefix) | `docs/04-configuration/naming-conventions/README.md`, `docs/04-configuration/naming-conventions/02_DBIS_NAMESPACE_AND_UTRNF_MAPPING.md` |
+| **GRU reference primacy vs public cW\* PMM mesh** (FX policy; mesh = execution, not shadow oracle) | `docs/04-configuration/GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md` |
 | PMM mesh 6s tick | `smom-dbis-138/scripts/reserve/pmm-mesh-6s-automation.sh` — `docs/integration/ORACLE_AND_KEEPER_CHAIN138.md` (PMM mesh automation) |
 | **PMM soak grid (33×33×6 wallets)** | `docs/11-references/CHAIN138_GRID_6534_WALLET_FUNDING_PLAN.md` — one-shot `scripts/deployment/pmm-soak-complete-operator-bootstrap.sh` (`PMM_SOAK_AUTO_INIT_GRID_MNEMONIC=1` … `--apply-funds --to-linear 19`); full-grid resume `scripts/deployment/pmm-soak-complete-grid-funding-operator.sh` (`PMM_SOAK_START_LEG`, `PMM_SOAK_RESUME_NATIVE_FROM_LINEAR`, `PMM_SOAK_RPC_URL_OVERRIDE`, `PMM_SOAK_FUND_PROGRESS_EVERY` via fund-grid); tranche driver `scripts/deployment/pmm-soak-operator-fund-full-grid-tranches.sh`; export `pmm-soak-export-wallet-grid.py`, fund `pmm-soak-operator-fund-grid.sh`, pools `scripts/lib/pmm-soak-pools.sh`, bots `chain138-pmm-soak-grid-bot.sh` / `chain138-pmm-random-soak-swaps.sh` (`--pool-preset`, `--swap-via`; `scripts/lib/pmm-soak-dotenv-override.sh` preserves caller `PMM_SOAK_POOL_*` / `CHAIN138_PMM_SOAK_SWAP_VIA` over `.env`), smoke `scripts/deployment/pmm-soak-grid-smoke-check.sh`, CI `.github/workflows/pmm-soak-grid-smoke.yml` |
 | Mainnet cWUSD\* peg, TRUU PMM, bot readiness | `docs/03-deployment/MAINNET_PMM_TRUU_CWUSD_PEG_AND_BOT_RUNBOOK.md` (§11 live inventory) — `scripts/verify/check-mainnet-pmm-peg-bot-readiness.sh`, `scripts/deployment/deploy-mainnet-pmm-cw-truu-pool.sh`, `scripts/deployment/add-mainnet-truu-pmm-topup.sh`, `scripts/deployment/compute-mainnet-truu-liquidity-amounts.sh`, `scripts/deployment/compute-mainnet-truu-pmm-seed-amounts.sh`; `cross-chain-pmm-lps/config/deployment-status.json` `pmmPoolsVolatile`; `docs/11-references/CONTRACT_ADDRESSES_REFERENCE.md` (Mainnet TRUU PMM); `check-full-deployment-status.sh` when `ETHEREUM_MAINNET_RPC` + `DODO_PMM_INTEGRATION_MAINNET` are set |
--- a/docs/00-meta/NEXT_STEPS_LIST.md
+++ b/docs/00-meta/NEXT_STEPS_LIST.md
@@ -5,6 +5,8 @@

 **Refs:** [TODOS_CONSOLIDATED.md](TODOS_CONSOLIDATED.md), [REMAINING_DEPLOYMENTS_FOR_FULL_NETWORK_COVERAGE.md](../03-deployment/REMAINING_DEPLOYMENTS_FOR_FULL_NETWORK_COVERAGE.md), [TASKS_ROUTING_SWAP_CROSSCHAIN.md](TASKS_ROUTING_SWAP_CROSSCHAIN.md). **Full execution (all + optional, suggested order):** [EXECUTION_CHECKLIST_MULTIPLE_ROUTES_AND_LIQUIDITY.md](EXECUTION_CHECKLIST_MULTIPLE_ROUTES_AND_LIQUIDITY.md).

+**GRU reference primacy (mesh vs policy):** `bash scripts/verify/check-gru-reference-primacy-integration.sh` — also runs inside `bash scripts/validation/validate-config-files.sh`. Submodule workflow: [SUBMODULE_HYGIENE.md](SUBMODULE_HYGIENE.md) section **cross-chain-pmm-lps**.
+
 **Completion check (current baseline):** Full run including optional: completable ✅, validate-config ✅, PMM pool balances ✅ (Pool 1: 2M/2M), preflight ✅, token-aggregation build ✅, on-chain **67/67** (current canonical `check-contracts-on-chain-138.sh` inventory) ✅, unit tests 457 ✅, deployer-gas dry-run ✅, fund-ccip dry-run ✅, E2E flow dry-run ✅, E2E routing ✅ (**37** public domains **Failed: 0** on 2026-03-06; **44** on 2026-03-29 re-check), operator script --skip-backup ✅ (NPMplus RPC + Blockscout verify). **Live 2026-03-30:** [LIVE_VERIFICATION_LOG_2026-03-30.md](LIVE_VERIFICATION_LOG_2026-03-30.md). **Audit (2026-03-06):** [DOTENV_AND_MARKDOWN_AUDIT_GAPS_AND_RECOMMENDATIONS.md](DOTENV_AND_MARKDOWN_AUDIT_GAPS_AND_RECOMMENDATIONS.md) — required dotenv/markdown info, gaps, and recommendations. B.1/B.2 still blocked (need CRO/WEMIX); B.3 blocked (LINK/gas); A2 env set (CHAIN_138_DODO_PMM_INTEGRATION in smom-dbis-138/.env); A3/C3–C8, Phase C, LINK relay, B4/B5 remain pending or optional.

 ---
--- a/docs/00-meta/OPERATOR_READY_CHECKLIST.md
+++ b/docs/00-meta/OPERATOR_READY_CHECKLIST.md
@@ -9,7 +9,7 @@

 **One-command LAN wrapper:** `./scripts/run-full-operator-completion-from-lan.sh --dry-run` prints the full execution order starting with the token-aggregation `/api/v1` repair, then E2E, then a **non-fatal** `check-info-defi-oracle-public.sh`. Add `--fix-e2e-if-needed`, `--install-cron`, `--include-config-ready-chains`, `--include-chain138-next-steps`, and `--include-send-cross-chain --send-amount 0.01` as needed.

-**Submodule working trees (no local edits in submodules):** `bash scripts/verify/submodules-clean.sh` — see [SUBMODULE_HYGIENE.md](SUBMODULE_HYGIENE.md).
+**Submodule working trees (no local edits in submodules):** `bash scripts/verify/submodules-clean.sh` — see [SUBMODULE_HYGIENE.md](SUBMODULE_HYGIENE.md). **GRU mesh vs policy wiring:** `bash scripts/verify/check-gru-reference-primacy-integration.sh` (also step 1 of completable / `validate-config-files.sh`).

 **Proxmox SSH (all five hypervisors):** `bash scripts/security/ensure-proxmox-ssh-access.sh` — key-based **BatchMode** check to **192.168.11.10–.14** (ML110 + r630-01..04). Optional `bash scripts/security/ensure-proxmox-ssh-access.sh --fqdn` uses **`*.sankofa.nexus`** (`config/ip-addresses.conf` `PROXMOX_FQDN_*`); skips with a hint if DNS is missing. Optional `--copy` runs **`ssh-copy-id`** per host (interactive). **LAN DNS for FQDNs:** `bash scripts/verify/check-proxmox-mgmt-fqdn.sh` and `bash scripts/verify/check-proxmox-mgmt-fqdn.sh --print-hosts` (emits `/etc/hosts` lines for operator laptops). **NPMplus tunnel:** `ssh -L 8181:192.168.11.167:81 -N root@r630-01.sankofa.nexus` or `root@192.168.11.11`, then `http://127.0.0.1:8181`.

--- a/docs/00-meta/SUBMODULE_HYGIENE.md
+++ b/docs/00-meta/SUBMODULE_HYGIENE.md
@@ -1,6 +1,6 @@
 # Submodule and explorer remote hygiene

-**Last Updated:** 2026-03-27  
+**Last Updated:** 2026-04-12  
 **Purpose:** Operational notes for the many git submodules under the proxmox parent repo: detached HEAD, remotes, pushes, and non-secret JSON env snapshots.

 ---
@@ -79,6 +79,14 @@ See each submodule’s `config/README.md` for a short in-tree note.

 ---

+## cross-chain-pmm-lps (public cW\* PMM mesh)
+
+Parent repo policy treats the mesh as **execution against reference-anchored GRU/FX**, not standalone shadow FX — `docs/04-configuration/GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md`.
+
+When you change **`cross-chain-pmm-lps/config/peg-bands.json`**, keep **`gruPolicyIntegration`** (`referencePrimacyDoc`, `meshExecutionRole`); parent CI validates it via `scripts/verify/check-gru-reference-primacy-integration.sh` (invoked from `scripts/validation/validate-config-files.sh`). **Workflow:** commit inside `cross-chain-pmm-lps` → push submodule remote → in parent root `git add cross-chain-pmm-lps` → commit pointer.
+
+---
+
 ## Related

 - **[AGENTS.md](../../AGENTS.md)** — quick pointers including submodule discipline  
--- a/docs/03-deployment/FINAL_UNBLOCK_CHECKLIST_MAINNET_BSC.md
+++ b/docs/03-deployment/FINAL_UNBLOCK_CHECKLIST_MAINNET_BSC.md
@@ -83,6 +83,10 @@ The bridge can be technically deliverable at the bootstrap floor while still bei
 - Live bridge inventory after the bootstrap top-up and replay check: **`0.009 WETH`**
 - Additional WETH still needed to clear that queued release: **`0.091 WETH`**

+The worker is also back on forward-only monitoring (`START_BLOCK=latest`), and the known
+oversized historical WETH backlog ids are intentionally parked in `RELAY_SKIP_MESSAGE_IDS`
+so restarts do not repopulate stale queue debt.
+
 Use the health checker below to confirm the exact shortfall before topping up:

 ```bash
--- a/docs/03-deployment/MAINNET_WETH_RELAY_BACKLOG_POLICY.md
+++ b/docs/03-deployment/MAINNET_WETH_RELAY_BACKLOG_POLICY.md
@@ -0,0 +1,52 @@
+# Mainnet WETH Relay Backlog Policy
+
+This note documents the intentional backlog policy for the `mainnet-weth` relay worker.
+
+## Current policy
+
+- The worker runs in **forward-only** mode with `START_BLOCK=latest`.
+- Historical oversized WETH release messages that are not meant to be replayed on every restart
+  are explicitly parked in `RELAY_SKIP_MESSAGE_IDS`.
+- The worker remains **operational** with:
+  - `RELAY_SHEDDING=0`
+  - `RELAY_DELIVERY_ENABLED=1`
+  - `RELAY_ENFORCE_BRIDGE_TOKEN_BALANCE=1`
+
+## Why this exists
+
+The Chain 138 -> Ethereum Mainnet WETH lane had accumulated historical source messages whose
+release amounts were larger than the current Mainnet relay bridge float. Replaying them on every
+service restart created stale queue debt and made lane health depend on old backlog instead of
+current forward traffic.
+
+Parking those known historical message IDs is safer than repeatedly replaying them when:
+
+- there is no active intent to fund and deliver those exact historical releases now
+- there is no source-side cancel path
+- the goal is to keep the worker truthful for current traffic
+
+## What stays live
+
+- New source `MessageSent` events are still monitored.
+- Current forward traffic still relays normally.
+- Underfunded new releases are deferred by the bridge-inventory guard instead of spending gas on a
+  reverting destination transaction.
+
+## Operational rule
+
+If you deliberately want to replay a parked historical WETH release later, do all of the following
+in one planned operator pass:
+
+1. Remove only the specific message ID from `RELAY_SKIP_MESSAGE_IDS`.
+2. Set an explicit replay `START_BLOCK` that includes the source message.
+3. Restart only `ccip-relay`.
+4. Restore `START_BLOCK=latest` after the replay window is complete.
+
+## Known historical WETH backlog posture
+
+The current parked IDs live in:
+
+- [`smom-dbis-138/services/relay/.env.mainnet-weth`](/home/intlc/projects/proxmox/smom-dbis-138/services/relay/.env.mainnet-weth)
+
+Treat that env list as the enforced machine-readable source, and this document as the human policy
+reference explaining why those IDs are intentionally skipped.
--- a/docs/03-deployment/PHASE_C_CW_AND_EDGE_POOLS_RUNBOOK.md
+++ b/docs/03-deployment/PHASE_C_CW_AND_EDGE_POOLS_RUNBOOK.md
@@ -40,6 +40,8 @@ bash scripts/verify/check-gru-v2-deployment-queue.sh

 Run deviation watcher and peg-band config from cross-chain-pmm-lps when cW* and edge pools are live.

+**Policy:** peg bands and bot behavior must follow **reference-anchored** GRU/FX rules (OMNL rate matrix, agreed oracles, reserve gates) — see [GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md](../04-configuration/GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md). The mesh **implements** corridors; it does not replace institution-grade reference pricing.
+
 ---

 ## Quick ref
@@ -47,3 +49,4 @@ Run deviation watcher and peg-band config from cross-chain-pmm-lps when cW* and
 - Pool matrix: cross-chain-pmm-lps/config/pool-matrix.json
 - Deployment status: cross-chain-pmm-lps/config/deployment-status.json
 - Recipe: cross-chain-pmm-lps/docs/06-deployment-recipe.md
+- Reference primacy + mesh: [GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md](../04-configuration/GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md)
--- a/docs/04-configuration/GRU_C_STAR_V2_STANDARDS_MATRIX_AND_IMPLEMENTATION_PLAN.md
+++ b/docs/04-configuration/GRU_C_STAR_V2_STANDARDS_MATRIX_AND_IMPLEMENTATION_PLAN.md
@@ -4,7 +4,7 @@

 **Audience:** Solidity engineers, protocol architects, bridge operators, GRU governance, explorer / token-aggregation maintainers, and auditors.

-**Related:** [naming-conventions/README.md](naming-conventions/README.md) (UTRNF reference + DBIS `c*` vs UTRNF `c` mapping: [naming-conventions/02_DBIS_NAMESPACE_AND_UTRNF_MAPPING.md](naming-conventions/02_DBIS_NAMESPACE_AND_UTRNF_MAPPING.md)), [GRU_STANDARDS_PROFILE.md](GRU_STANDARDS_PROFILE.md), [GRU_STORAGE_GOVERNANCE_AND_SUPERVISION_STANDARD.md](GRU_STORAGE_GOVERNANCE_AND_SUPERVISION_STANDARD.md), [GRU_M00_DIAMOND_INSTITUTIONAL_SPEC.md](GRU_M00_DIAMOND_INSTITUTIONAL_SPEC.md), [GRU_M00_DIAMOND_FACET_MAP.md](GRU_M00_DIAMOND_FACET_MAP.md), [GRU_M00_DIAMOND_REVIEW_GAPS_AND_RECOMMENDATIONS.md](GRU_M00_DIAMOND_REVIEW_GAPS_AND_RECOMMENDATIONS.md), [CHAIN138_X402_TOKEN_SUPPORT.md](CHAIN138_X402_TOKEN_SUPPORT.md), [SMART_CONTRACTS_ISO20022_FIN_METHODOLOGY.md](SMART_CONTRACTS_ISO20022_FIN_METHODOLOGY.md), [GRU_TRANSPORT_ACTIVE_JSON.md](GRU_TRANSPORT_ACTIVE_JSON.md), [EXPLORER_TOKENS_GRU_POLICY.md](EXPLORER_TOKENS_GRU_POLICY.md).
+**Related:** [naming-conventions/README.md](naming-conventions/README.md) (UTRNF reference + DBIS `c*` vs UTRNF `c` mapping: [naming-conventions/02_DBIS_NAMESPACE_AND_UTRNF_MAPPING.md](naming-conventions/02_DBIS_NAMESPACE_AND_UTRNF_MAPPING.md)), [GRU_STANDARDS_PROFILE.md](GRU_STANDARDS_PROFILE.md), [GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md](GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md) (reference FX / GRU vs public PMM mesh — integrated constraint), [GRU_STORAGE_GOVERNANCE_AND_SUPERVISION_STANDARD.md](GRU_STORAGE_GOVERNANCE_AND_SUPERVISION_STANDARD.md), [GRU_M00_DIAMOND_INSTITUTIONAL_SPEC.md](GRU_M00_DIAMOND_INSTITUTIONAL_SPEC.md), [GRU_M00_DIAMOND_FACET_MAP.md](GRU_M00_DIAMOND_FACET_MAP.md), [GRU_M00_DIAMOND_REVIEW_GAPS_AND_RECOMMENDATIONS.md](GRU_M00_DIAMOND_REVIEW_GAPS_AND_RECOMMENDATIONS.md), [CHAIN138_X402_TOKEN_SUPPORT.md](CHAIN138_X402_TOKEN_SUPPORT.md), [SMART_CONTRACTS_ISO20022_FIN_METHODOLOGY.md](SMART_CONTRACTS_ISO20022_FIN_METHODOLOGY.md), [GRU_TRANSPORT_ACTIVE_JSON.md](GRU_TRANSPORT_ACTIVE_JSON.md), [EXPLORER_TOKENS_GRU_POLICY.md](EXPLORER_TOKENS_GRU_POLICY.md).

 ---

@@ -24,6 +24,10 @@ The key design rule is:
 - **Put flash, vault, and bridge-side complexity around the base token.**
 - **Put compliance, messaging, reserve, and accounting policy above the base token.**

+### 1.1 Reference primacy and public mesh (policy integration)
+
+Public-chain **cW\*** PMM pools and bots ([cross-chain-pmm-lps](../../cross-chain-pmm-lps/)) are **execution and stabilization capacity** around canonical `c*` and agreed FX references — not a parallel shadow FX market. **GRU, XDR (SDR), and ISO FX** must remain anchored to **institution-grade rate sets and reserve methodology** (OMNL FX / triangulation, attestations, governance). See [GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md](GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md) for the integrated stack, checklist, and doc map.
+
 ---

 ## 2. Current Repo Mapping
--- a/docs/04-configuration/GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md
+++ b/docs/04-configuration/GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md
@@ -0,0 +1,65 @@
+# GRU reference primacy and mesh execution model
+
+**Purpose:** Integrate monetary-policy intent into engineering and operations: **reference markets and GRU policy define truth**; the **public cW\* PMM mesh and soak grid are execution and capacity layers**, not independent FX discovery or shadow-banking surfaces.
+
+**Audience:** Protocol architects, GRU governance, RTGS/OMNL operators, cross-chain PMM owners, explorer/token-aggregation maintainers, auditors.
+
+**Status:** Active — treat as a **design constraint** alongside [GRU_C_STAR_V2_STANDARDS_MATRIX_AND_IMPLEMENTATION_PLAN.md](GRU_C_STAR_V2_STANDARDS_MATRIX_AND_IMPLEMENTATION_PLAN.md) and [GRU_STANDARDS_PROFILE.md](GRU_STANDARDS_PROFILE.md).
+
+---
+
+## 1. Non-negotiable rule (tail does not wag dog)
+
+1. **SDR (IMF XDR)** and **GRU** (reserve / valuation unit in the OMNL model) must **trace to institution-grade references**: published basket methodology, agreed FX rate sets, **XAU triangulation** where the GL/FX model requires it, and reserve attestations — see [mifos-omnl-central-bank/FX_AND_VALUATION.md](mifos-omnl-central-bank/FX_AND_VALUATION.md), [mifos-omnl-central-bank/CURRENCY_AND_UNITS.md](mifos-omnl-central-bank/CURRENCY_AND_UNITS.md).
+2. **On-chain PMM prices, DEX midquotes, and bot activity** are **implementation signals** (slippage, inventory, latency). They are **not** the oracle of record for GRU or XDR unless explicitly adopted as a **secondary** feed with governance, staleness bounds, and fallbacks.
+3. **Base money (`c*`)** remains **e-money-shaped**: par redeemability, segregated reserves, monitoring hooks — [runbooks/MULTI_CHAIN_EXECUTION_ISO20022_EMONEY.md](../runbooks/MULTI_CHAIN_EXECUTION_ISO20022_EMONEY.md). **Capability and mesh layers** (`cW*`, PMM, flash wrappers) must not redefine base liability semantics.
+
+---
+
+## 2. Three GRU layers + mesh (integrated stack)
+
+This doc **does not replace** [GRU_C_STAR_V2_STANDARDS_MATRIX_AND_IMPLEMENTATION_PLAN.md](GRU_C_STAR_V2_STANDARDS_MATRIX_AND_IMPLEMENTATION_PLAN.md); it **pins** the public mesh into that stack:
+
+| GRU layer (c\* V2 matrix) | Role | Mesh / public-chain touchpoint |
+|---------------------------|------|--------------------------------|
+| **Base money** | Canonical `c*`; payment standards; liability clarity | Chain 138 canonical tokens; registry + explorer policy |
+| **Capability** | Bridges, `cW*`, x402, vault/flash wrappers | [cross-chain-pmm-lps](../../cross-chain-pmm-lps/) token map, pool-matrix, deployment-status |
+| **Policy / governance** | ReserveGate, ComplianceGate, ISO-20022, accounting | M00 facets, institutional JSON, RTGS runbooks |
+
+**Mesh execution:** [cross-chain-pmm-lps/README.md](../../cross-chain-pmm-lps/README.md) describes the **bot-managed PMM stabilization mesh**. Under this model, that mesh **implements** corridor behavior **against** policy/reference inputs (`peg-bands.json`, oracles, throttling), rather than inventing FX reality.
+
+---
+
+## 3. Integration map (where this must show up)
+
+| Surface | Required linkage |
+|---------|------------------|
+| **OMNL / Fineract FX** | Rate matrix, revaluation, GRU/XDR/XAU units — [FX_AND_VALUATION.md](mifos-omnl-central-bank/FX_AND_VALUATION.md) |
+| **RTGS / institutional rails** | Settlement messaging, UETR vs on-chain ids — [03-deployment/OMNL_DBIS_CORE_CHAIN138_SMART_VAULT_RTGS_RUNBOOK.md](../03-deployment/OMNL_DBIS_CORE_CHAIN138_SMART_VAULT_RTGS_RUNBOOK.md), [03-deployment/DBIS_RTGS_FX_AND_LIQUIDITY_OPERATING_MODEL.md](../03-deployment/DBIS_RTGS_FX_AND_LIQUIDITY_OPERATING_MODEL.md) |
+| **Phase C edge pools** | Deploy/fund pools **after** reference and transport policy are clear — [03-deployment/PHASE_C_CW_AND_EDGE_POOLS_RUNBOOK.md](../03-deployment/PHASE_C_CW_AND_EDGE_POOLS_RUNBOOK.md) |
+| **Public protocol truth** | `deployment-status.json` + verifier — [11-references/GRU_V2_PUBLIC_PROTOCOL_DEPLOYMENT_STATUS.md](../11-references/GRU_V2_PUBLIC_PROTOCOL_DEPLOYMENT_STATUS.md) (links this policy doc), `scripts/verify/check-gru-v2-public-protocols.sh` |
+| **PMM / DEX status narrative** | Distinguish Chain 138 venues vs public cW\* mesh — [11-references/PMM_DEX_ROUTING_STATUS.md](../11-references/PMM_DEX_ROUTING_STATUS.md) |
+| **Liquidity taxonomy** | Reserve vs public stabilization vs price discovery — [11-references/LIQUIDITY_POOLS_MASTER_MAP.md](../11-references/LIQUIDITY_POOLS_MASTER_MAP.md) |
+| **Soak grid (6,534 wallets)** | Operational throughput and segmentation; **not** a substitute for reserve policy — [11-references/CHAIN138_GRID_6534_WALLET_FUNDING_PLAN.md](../11-references/CHAIN138_GRID_6534_WALLET_FUNDING_PLAN.md) |
+| **Stress and dominance discipline** | External market baselines for simulation — [gru-m1/GRU_M1_REAL_DATA_DOMINANCE_ADDENDUM.md](../gru-m1/GRU_M1_REAL_DATA_DOMINANCE_ADDENDUM.md) |
+
+---
+
+## 4. Implementation checklist (anti–afterthought)
+
+Use this when adding bots, oracles, new `cW*` rows, or explorer surfaces:
+
+1. **Name the reference** for each corridor (fixing, triangulation path, basket rule, or attested reserve parity).
+2. **Declare on-chain price role** (execution only vs allowed secondary oracle) and **staleness / divergence** behavior.
+3. **Wire policy gates** per [GRU_C_STAR_V2_STANDARDS_MATRIX_AND_IMPLEMENTATION_PLAN.md](GRU_C_STAR_V2_STANDARDS_MATRIX_AND_IMPLEMENTATION_PLAN.md) (ReserveGate / compliance / ISO-20022 routing as applicable).
+4. **Update machine-readable status** (`cross-chain-pmm-lps/config/deployment-status.json`, [config/gru-transport-active.json](../../config/gru-transport-active.json)) so public truth tables stay aligned.
+5. **Keep the peg-bands policy hook**: `cross-chain-pmm-lps/config/peg-bands.json` must retain **`gruPolicyIntegration`** (`referencePrimacyDoc`, `meshExecutionRole`) so mesh config stays explicitly subordinate to this document. CI enforces it when the submodule is present (`scripts/verify/check-gru-reference-primacy-integration.sh` via `validate-config-files.sh`).
+6. **Document edge vs mesh**: edge pools scale access; **mesh + reference** define acceptable executable bounds — consistent with [cross-chain-pmm-lps/docs/02-pool-topology.md](../../cross-chain-pmm-lps/docs/02-pool-topology.md) and Phase C.
+
+---
+
+## Related
+
+- [GRU_STANDARDS_PROFILE.md](GRU_STANDARDS_PROFILE.md), [`config/gru-standards-profile.json`](../../config/gru-standards-profile.json)
+- [SMART_CONTRACTS_ISO20022_FIN_METHODOLOGY.md](SMART_CONTRACTS_ISO20022_FIN_METHODOLOGY.md)
+- [reserve-provenance-package README](../../config/reserve-provenance-package/README.md) — attestation discipline
--- a/docs/04-configuration/README.md
+++ b/docs/04-configuration/README.md
@@ -67,6 +67,7 @@ This directory contains setup and configuration guides.
 **Explorer tokens and GRU:**
 - **[naming-conventions/README.md](naming-conventions/README.md)** — UTRNF token-role grammar, DBIS `c*` / `cW*` vs UTRNF collision matrix, bridge naming, registry JSON fields (Chain 138 + cross-chain); optional schema + examples validated by `scripts/validation/validate-naming-convention-registry-examples.sh` when `check-jsonschema` is installed.
 - **[EXPLORER_TOKENS_GRU_POLICY.md](EXPLORER_TOKENS_GRU_POLICY.md)** ⭐⭐ - Policy: all c* tokens on [explorer.d-bis.org/tokens](https://explorer.d-bis.org/tokens) must be registered as GRU; token list and registration steps.
+- **[GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md](GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md)** — Reference-first GRU/XDR vs public PMM mesh; integration map and implementation checklist (not shadow FX).
 - **[C_TO_CW_MAPPER_MAPPING.md](C_TO_CW_MAPPER_MAPPING.md)** ⭐⭐ - c* → cW* mapping for mapper: symbol mapping and per-chain address mapping in `config/token-mapping-multichain.json`.

 **DEX and aggregators (Chain 138 tokens and routing):**
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/admin_d-bis_org_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/admin_d-bis_org_https_headers.txt
@@ -0,0 +1,17 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:53:49 GMT
+content-type: text/html
+content-length: 795
+vary: Accept-Encoding
+last-modified: Thu, 02 Apr 2026 19:27:04 GMT
+etag: "69cec308-31b"
+x-frame-options: SAMEORIGIN
+x-content-type-options: nosniff
+x-xss-protection: 0
+accept-ranges: bytes
+alt-svc: h3=":443"; ma=86400
+content-security-policy: upgrade-insecure-requests
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+
+
+0.073550
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/admin_sankofa_nexus_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/admin_sankofa_nexus_https_headers.txt
@@ -0,0 +1,20 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:52:35 GMT
+content-type: text/html; charset=utf-8
+content-length: 5259
+vary: Accept-Encoding
+x-dns-prefetch-control: on
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+x-frame-options: SAMEORIGIN
+x-content-type-options: nosniff
+x-xss-protection: 0
+referrer-policy: strict-origin-when-cross-origin
+permissions-policy: camera=(), microphone=(), geolocation=()
+content-security-policy: default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' https:
+vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Accept-Encoding
+cache-control: s-maxage=31536000, stale-while-revalidate
+etag: "oibim89srm41x"
+alt-svc: h3=":443"; ma=86400
+
+
+0.157411
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/all_e2e_results.json
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/all_e2e_results.json
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/blockscout_defi-oracle_io_blockscout_api.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/blockscout_defi-oracle_io_blockscout_api.txt
@@ -0,0 +1 @@
+{"total_blocks":3931243,"total_transactions":54606,"total_addresses":6793,"latest_block":3931242,"average_block_time":2000,"gas_prices":{"average":0.000001},"network_utilization_percentage":0,"transactions_today":6972,"freshness":{"chain_head":{"block_number":3931243,"timestamp":"2026-04-12T13:54:35Z","age_seconds":0,"source":"reported","confidence":"high","provenance":"rpc","completeness":"complete"},"latest_indexed_block":{"block_number":3931242,"timestamp":"2026-04-12T13:54:33Z","age_seconds":2,"source":"reported","confidence":"high","provenance":"explorer_index","completeness":"complete"},"latest_indexed_transaction":{"block_number":3926698,"timestamp":"2026-04-12T11:23:05Z","age_seconds":9090,"hash":"0x36b74570686b3b384b23167a26985c7a83628f8609a7e928525526cdf28e7759","source":"reported","confidence":"high","provenance":"tx_index","completeness":"partial"},"latest_non_empty_block":{"block_number":3926698,"timestamp":"2026-04-12T11:23:05Z","age_seconds":9090,"distance_from_head":4545,"source":"reported","confidence":"high","provenance":"tx_index","completeness":"partial"}},"completeness":{"transactions_feed":"partial","blocks_feed":"complete","gas_metrics":"complete","utilization_metrics":"complete"},"sampling":{"stats_generated_at":"2026-04-12T13:54:35Z","rpc_probe_at":"2026-04-12T13:54:35Z","stats_window_seconds":300}}
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/blockscout_defi-oracle_io_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/blockscout_defi-oracle_io_https_headers.txt
@@ -0,0 +1,18 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:54:33 GMT
+content-type: text/html; charset=utf-8
+content-length: 112221
+vary: Accept-Encoding
+etag: "yjac89wqx52ek2"
+vary: Accept-Encoding
+cache-control: no-store, no-cache, must-revalidate
+referrer-policy: strict-origin-when-cross-origin
+content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net https://unpkg.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com; img-src 'self' data: https:; font-src 'self' https://cdnjs.cloudflare.com; connect-src 'self' https://blockscout.defi-oracle.io wss://blockscout.defi-oracle.io https://explorer.d-bis.org wss://explorer.d-bis.org https://rpc-http-pub.d-bis.org wss://rpc-ws-pub.d-bis.org http://192.168.11.221:8545 ws://192.168.11.221:8546;
+alt-svc: h3=":443"; ma=86400
+x-xss-protection: 0
+x-content-type-options: nosniff
+x-frame-options: SAMEORIGIN
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+
+
+0.765541
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/cacti-alltra_d-bis_org_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/cacti-alltra_d-bis_org_https_headers.txt
@@ -0,0 +1,20 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:55:04 GMT
+content-type: text/html
+alt-svc: h3=":443"; ma=86400
+nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
+report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=WOdS1RKIRF7sF6i9m%2F4XO9Nw4lnrLQZS6yqtus4vbWSEkaEa3z1BuJEDizBROmndenZGRrRc2%2BmCv8F3nfk3p8jOrCFbpEaKpC3JUxORE0e4IbaQOrg%2Bwq2EPwyKcwPT4A2lBp6IRNDk"}]}
+last-modified: Thu, 02 Apr 2026 19:42:29 GMT
+referrer-policy: strict-origin-when-cross-origin
+vary: Accept-Encoding
+x-content-type-options: nosniff
+x-dns-prefetch-control: off
+x-frame-options: SAMEORIGIN
+x-permitted-cross-domain-policies: none
+cf-cache-status: DYNAMIC
+strict-transport-security: max-age=31536000; includeSubDomains
+server: cloudflare
+cf-ray: 9eb2b9fe29b923d1-LAX
+
+
+0.172515
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/cacti-hybx_d-bis_org_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/cacti-hybx_d-bis_org_https_headers.txt
@@ -0,0 +1,20 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:52:46 GMT
+content-type: text/html
+alt-svc: h3=":443"; ma=86400
+nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
+report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=td3t73bBpDAu6fXd6gQe%2Bi%2B3kcMfb8UCQ5%2BKRk79vPvoshoYjDez%2BBdb2L8s0s%2BPDeL0K8HZ69DKXB1SqAJTaAC9CfK1rVf6Jbk3suwvPBZZVJXjE8JXqA2fctBYhrFa3fEdLeMGPA%3D%3D"}]}
+last-modified: Thu, 02 Apr 2026 19:42:29 GMT
+referrer-policy: strict-origin-when-cross-origin
+vary: Accept-Encoding
+x-content-type-options: nosniff
+x-dns-prefetch-control: off
+x-frame-options: SAMEORIGIN
+x-permitted-cross-domain-policies: none
+cf-cache-status: DYNAMIC
+strict-transport-security: max-age=31536000; includeSubDomains
+server: cloudflare
+cf-ray: 9eb2b6a55d31792b-LAX
+
+
+0.187927
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/codespaces_d-bis_org_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/codespaces_d-bis_org_https_headers.txt
@@ -0,0 +1,10 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:54:45 GMT
+x-dns-prefetch-control: off
+x-content-type-options: nosniff
+x-permitted-cross-domain-policies: none
+referrer-policy: strict-origin-when-cross-origin
+x-frame-options: SAMEORIGIN
+
+
+0.097073
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/core_d-bis_org_https_body.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/core_d-bis_org_https_body.txt
@@ -0,0 +1 @@
+{"service":"dbis-core-banking-system","status":"healthy","version":"1.0.0","docs":"/api-docs","health":"/health"}
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/core_d-bis_org_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/core_d-bis_org_https_headers.txt
@@ -0,0 +1,20 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:52:27 GMT
+content-type: application/json; charset=utf-8
+content-length: 113
+vary: Accept-Encoding
+content-security-policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
+cross-origin-opener-policy: same-origin
+cross-origin-resource-policy: same-origin
+origin-agent-cluster: ?1
+referrer-policy: no-referrer
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+x-content-type-options: nosniff
+x-dns-prefetch-control: off
+x-download-options: noopen
+x-frame-options: SAMEORIGIN
+x-permitted-cross-domain-policies: none
+x-xss-protection: 0
+x-trace-id: 1516f235e7610f08af0caa7937fa145e
+x-span-id: 2d294d36490cb8e2
+x-parent-span-id: 
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/d-bis_org_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/d-bis_org_https_headers.txt
@@ -0,0 +1,18 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:54:39 GMT
+content-type: text/html; charset=utf-8
+content-length: 22505
+vary: Accept-Encoding
+x-frame-options: SAMEORIGIN
+x-content-type-options: nosniff
+referrer-policy: strict-origin-when-cross-origin
+content-security-policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'
+vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Accept-Encoding
+cache-control: s-maxage=31536000, stale-while-revalidate
+etag: "fqzlq2o9ljhd0"
+alt-svc: h3=":443"; ma=86400
+x-xss-protection: 0
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+
+
+0.142925
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/dapp_d-bis_org_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/dapp_d-bis_org_https_headers.txt
@@ -0,0 +1,12 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:53:08 GMT
+content-type: text/html
+content-length: 470
+vary: Accept-Encoding
+last-modified: Sun, 22 Feb 2026 04:25:15 GMT
+etag: "699a852b-1d6"
+content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https: wss: http://192.168.11.221:8545 ws://192.168.11.221:8546 https://rpc-http-pub.d-bis.org wss://rpc-ws-pub.d-bis.org; frame-src 'self' https:; frame-ancestors 'self';
+accept-ranges: bytes
+
+
+0.046539
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/dash_sankofa_nexus_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/dash_sankofa_nexus_https_headers.txt
@@ -0,0 +1,20 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:52:37 GMT
+content-type: text/html; charset=utf-8
+content-length: 5259
+vary: Accept-Encoding
+x-dns-prefetch-control: on
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+x-frame-options: SAMEORIGIN
+x-content-type-options: nosniff
+x-xss-protection: 0
+referrer-policy: strict-origin-when-cross-origin
+permissions-policy: camera=(), microphone=(), geolocation=()
+content-security-policy: default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' https:
+vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Accept-Encoding
+cache-control: s-maxage=31536000, stale-while-revalidate
+etag: "oibim89srm41x"
+alt-svc: h3=":443"; ma=86400
+
+
+0.218328
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/data_d-bis_org_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/data_d-bis_org_https_headers.txt
@@ -0,0 +1,20 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:53:16 GMT
+content-type: application/json; charset=utf-8
+content-length: 100
+vary: Accept-Encoding
+content-security-policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
+cross-origin-opener-policy: same-origin
+cross-origin-resource-policy: same-origin
+origin-agent-cluster: ?1
+referrer-policy: no-referrer
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+x-content-type-options: nosniff
+x-dns-prefetch-control: off
+x-download-options: noopen
+x-frame-options: SAMEORIGIN
+x-permitted-cross-domain-policies: none
+x-xss-protection: 0
+x-trace-id: 891d7dfc9213b8828d8543b79546d381
+x-span-id: d02a195b28e76898
+x-parent-span-id: 
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/dbis-admin_d-bis_org_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/dbis-admin_d-bis_org_https_headers.txt
@@ -0,0 +1,18 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:52:25 GMT
+content-type: text/html
+content-length: 795
+vary: Accept-Encoding
+last-modified: Thu, 02 Apr 2026 19:27:04 GMT
+etag: "69cec308-31b"
+x-frame-options: SAMEORIGIN
+x-content-type-options: nosniff
+x-xss-protection: 0
+accept-ranges: bytes
+alt-svc: h3=":443"; ma=86400
+content-security-policy: upgrade-insecure-requests
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+referrer-policy: strict-origin-when-cross-origin
+
+
+0.137332
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/dbis-api-2_d-bis_org_https_body.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/dbis-api-2_d-bis_org_https_body.txt
@@ -0,0 +1 @@
+{"service":"dbis-core-banking-system","status":"healthy","version":"1.0.0","docs":"/api-docs","health":"/health"}
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/dbis-api-2_d-bis_org_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/dbis-api-2_d-bis_org_https_headers.txt
@@ -0,0 +1,20 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:54:37 GMT
+content-type: application/json; charset=utf-8
+content-length: 113
+vary: Accept-Encoding
+content-security-policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
+cross-origin-opener-policy: same-origin
+cross-origin-resource-policy: same-origin
+origin-agent-cluster: ?1
+referrer-policy: no-referrer
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+x-content-type-options: nosniff
+x-dns-prefetch-control: off
+x-download-options: noopen
+x-frame-options: SAMEORIGIN
+x-permitted-cross-domain-policies: none
+x-xss-protection: 0
+x-trace-id: 34f1d83ae98d71e6cb39434767adf0b0
+x-span-id: 63cbb37a45435a17
+x-parent-span-id: 
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/dbis-api_d-bis_org_https_body.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/dbis-api_d-bis_org_https_body.txt
@@ -0,0 +1 @@
+{"service":"dbis-core-banking-system","status":"healthy","version":"1.0.0","docs":"/api-docs","health":"/health"}
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/dbis-api_d-bis_org_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/dbis-api_d-bis_org_https_headers.txt
@@ -0,0 +1,20 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:53:00 GMT
+content-type: application/json; charset=utf-8
+content-length: 113
+vary: Accept-Encoding
+content-security-policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
+cross-origin-opener-policy: same-origin
+cross-origin-resource-policy: same-origin
+origin-agent-cluster: ?1
+referrer-policy: no-referrer
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+x-content-type-options: nosniff
+x-dns-prefetch-control: off
+x-download-options: noopen
+x-frame-options: SAMEORIGIN
+x-permitted-cross-domain-policies: none
+x-xss-protection: 0
+x-trace-id: 8111b21bac5a939b4d8399b5c8677d28
+x-span-id: 0df48de426498a0b
+x-parent-span-id: 
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/dev_d-bis_org_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/dev_d-bis_org_https_headers.txt
@@ -0,0 +1,10 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:53:47 GMT
+x-dns-prefetch-control: off
+x-content-type-options: nosniff
+x-permitted-cross-domain-policies: none
+referrer-policy: strict-origin-when-cross-origin
+x-frame-options: SAMEORIGIN
+
+
+0.102886
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/developers_d-bis_org_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/developers_d-bis_org_https_headers.txt
@@ -0,0 +1,18 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:52:48 GMT
+content-type: text/html; charset=utf-8
+content-length: 22505
+vary: Accept-Encoding
+x-frame-options: SAMEORIGIN
+x-content-type-options: nosniff
+referrer-policy: strict-origin-when-cross-origin
+content-security-policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'
+vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Accept-Encoding
+cache-control: s-maxage=31536000, stale-while-revalidate
+etag: "fqzlq2o9ljhd0"
+alt-svc: h3=":443"; ma=86400
+x-xss-protection: 0
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+
+
+0.080972
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/docs_d-bis_org_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/docs_d-bis_org_https_headers.txt
@@ -0,0 +1,18 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:53:04 GMT
+content-type: text/html; charset=utf-8
+content-length: 111771
+vary: Accept-Encoding
+etag: "20xkccs7qj2e7k"
+vary: Accept-Encoding
+cache-control: no-store, no-cache, must-revalidate
+referrer-policy: strict-origin-when-cross-origin
+content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net https://unpkg.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com; img-src 'self' data: https:; font-src 'self' https://cdnjs.cloudflare.com; connect-src 'self' https://blockscout.defi-oracle.io wss://blockscout.defi-oracle.io https://explorer.d-bis.org wss://explorer.d-bis.org https://rpc-http-pub.d-bis.org wss://rpc-ws-pub.d-bis.org http://192.168.11.221:8545 ws://192.168.11.221:8546;
+alt-svc: h3=":443"; ma=86400
+x-xss-protection: 0
+x-content-type-options: nosniff
+x-frame-options: SAMEORIGIN
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+
+
+0.662922
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/explorer_d-bis_org_blockscout_api.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/explorer_d-bis_org_blockscout_api.txt
@@ -0,0 +1 @@
+{"total_blocks":3931228,"total_transactions":54606,"total_addresses":6793,"latest_block":3931227,"average_block_time":2000,"gas_prices":{"average":0.000001},"network_utilization_percentage":0,"transactions_today":6972,"freshness":{"chain_head":{"block_number":3931227,"timestamp":"2026-04-12T13:54:03Z","age_seconds":1,"source":"reported","confidence":"high","provenance":"rpc","completeness":"complete"},"latest_indexed_block":{"block_number":3931227,"timestamp":"2026-04-12T13:54:03Z","age_seconds":1,"source":"reported","confidence":"high","provenance":"explorer_index","completeness":"complete"},"latest_indexed_transaction":{"block_number":3926698,"timestamp":"2026-04-12T11:23:05Z","age_seconds":9059,"hash":"0x36b74570686b3b384b23167a26985c7a83628f8609a7e928525526cdf28e7759","source":"reported","confidence":"high","provenance":"tx_index","completeness":"partial"},"latest_non_empty_block":{"block_number":3926698,"timestamp":"2026-04-12T11:23:05Z","age_seconds":9059,"distance_from_head":4529,"source":"reported","confidence":"high","provenance":"tx_index","completeness":"partial"}},"completeness":{"transactions_feed":"partial","blocks_feed":"complete","gas_metrics":"complete","utilization_metrics":"complete"},"sampling":{"stats_generated_at":"2026-04-12T13:54:04Z","rpc_probe_at":"2026-04-12T13:54:03Z","stats_window_seconds":300}}
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/explorer_d-bis_org_command_center_body.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/explorer_d-bis_org_command_center_body.txt
@@ -0,0 +1,748 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Chain 138 — Visual Command Center</title>
+  <!-- Mermaid: local copy preferred; runtime fallback loader below -->
+  <script src="/thirdparty/mermaid.min.js"></script>
+  <style>
+    :root {
+      --bg: #0b0f14;
+      --panel: #0f172a;
+      --header: #111827;
+      --border: #1f2937;
+      --text: #e6edf3;
+      --muted: #94a3b8;
+      --accent: #2563eb;
+      --accent-hover: #1d4ed8;
+    }
+    * { box-sizing: border-box; }
+    body {
+      margin: 0;
+      font-family: system-ui, -apple-system, Segoe UI, Roboto, Ubuntu, sans-serif;
+      background: var(--bg);
+      color: var(--text);
+      min-height: 100vh;
+    }
+    header {
+      padding: 1rem 1.25rem;
+      background: var(--header);
+      border-bottom: 1px solid var(--border);
+    }
+    header h1 {
+      margin: 0;
+      font-size: 1.25rem;
+      font-weight: 700;
+    }
+    header p {
+      margin: 0.35rem 0 0;
+      font-size: 0.875rem;
+      color: var(--muted);
+      max-width: 52rem;
+      line-height: 1.45;
+    }
+    .toolbar {
+      display: flex;
+      flex-wrap: wrap;
+      align-items: center;
+      gap: 0.5rem;
+      padding: 0.65rem 1rem;
+      border-bottom: 1px solid var(--border);
+      background: rgba(17, 24, 39, 0.85);
+      position: sticky;
+      top: 0;
+      z-index: 10;
+    }
+    .tabs {
+      display: flex;
+      flex-wrap: wrap;
+      gap: 0.25rem;
+    }
+    .tab {
+      padding: 0.5rem 0.85rem;
+      cursor: pointer;
+      border: 1px solid transparent;
+      border-radius: 8px;
+      font-size: 0.8125rem;
+      font-weight: 600;
+      color: var(--muted);
+      background: transparent;
+    }
+    .tab:hover {
+      color: var(--text);
+      background: var(--border);
+    }
+    .tab.active {
+      color: #fff;
+      background: var(--accent);
+      border-color: var(--accent-hover);
+    }
+    .toolbar a.back {
+      margin-left: auto;
+      font-size: 0.8125rem;
+      color: #93c5fd;
+      text-decoration: none;
+    }
+    .toolbar a.back:hover { text-decoration: underline; }
+    .content {
+      display: none;
+      padding: 1.25rem;
+      max-width: 120rem;
+      margin: 0 auto;
+    }
+    .content.active { display: block; }
+    .panel-desc {
+      color: var(--muted);
+      font-size: 0.875rem;
+      line-height: 1.5;
+      margin-bottom: 1rem;
+      max-width: 56rem;
+    }
+    .mermaid-wrap {
+      background: var(--panel);
+      padding: 1.25rem;
+      border-radius: 12px;
+      border: 1px solid var(--border);
+      overflow-x: auto;
+      margin-bottom: 1.25rem;
+    }
+    .mermaid-wrap h3 {
+      margin: 0 0 0.75rem;
+      font-size: 0.95rem;
+      font-weight: 700;
+      color: #cbd5e1;
+    }
+    .mermaid-wrap + .mermaid-wrap { margin-top: 0.5rem; }
+    footer {
+      padding: 1.5rem;
+      border-top: 1px solid var(--border);
+      font-size: 0.75rem;
+      color: var(--muted);
+      text-align: center;
+    }
+    footer code { color: #a5b4fc; }
+    .status-note {
+      margin: 0.75rem 1.25rem 0;
+      padding: 0.85rem 1rem;
+      border-radius: 12px;
+      border: 1px solid #334155;
+      background: rgba(15, 23, 42, 0.8);
+      color: var(--muted);
+      font-size: 0.875rem;
+      line-height: 1.5;
+    }
+    .status-note a {
+      color: #93c5fd;
+      text-decoration: none;
+    }
+    .status-note a:hover { text-decoration: underline; }
+  </style>
+</head>
+<body>
+
+<header>
+  <h1>Chain 138 — deployment and liquidity topology</h1>
+  <p>Operator-style view of the architecture in <code>docs/02-architecture/SMOM_DBIS_138_FULL_DEPLOYMENT_FLOW_MAP.md</code>. Diagrams are informational only; contract addresses live in explorer config and repo references. The main explorer remains the canonical live operational surface. Deep links: <code>?tab=mission-control</code> or numeric <code>?tab=0</code>–<code>8</code> (slug per tab).</p>
+</header>
+
+<div class="status-note" id="mermaid-status">
+  Loading local diagram assets. If the local Mermaid bundle is unavailable, the page will try a trusted CDN fallback automatically.
+</div>
+
+<div class="status-note" id="command-center-fallback">
+  If diagram rendering is unavailable, use the main explorer operational surfaces directly:
+  <a href="/operations">Operations Hub</a>,
+  <a href="/bridge">Bridge Monitoring</a>,
+  <a href="/routes">Routes</a>,
+  <a href="/system">System</a>,
+  and <a href="/operator">Operator</a>.
+</div>
+
+<div class="toolbar">
+  <div class="tabs" role="tablist" aria-label="Topology panels">
+    <button type="button" id="tab-0" class="tab active" role="tab" aria-selected="true" aria-controls="panel-0" data-tab="0" tabindex="0">Master map</button>
+    <button type="button" id="tab-1" class="tab" role="tab" aria-selected="false" aria-controls="panel-1" data-tab="1" tabindex="-1">Network</button>
+    <button type="button" id="tab-2" class="tab" role="tab" aria-selected="false" aria-controls="panel-2" data-tab="2" tabindex="-1">Stack</button>
+    <button type="button" id="tab-3" class="tab" role="tab" aria-selected="false" aria-controls="panel-3" data-tab="3" tabindex="-1">Flows</button>
+    <button type="button" id="tab-4" class="tab" role="tab" aria-selected="false" aria-controls="panel-4" data-tab="4" tabindex="-1">Cross-chain</button>
+    <button type="button" id="tab-5" class="tab" role="tab" aria-selected="false" aria-controls="panel-5" data-tab="5" tabindex="-1">Public cW</button>
+    <button type="button" id="tab-6" class="tab" role="tab" aria-selected="false" aria-controls="panel-6" data-tab="6" tabindex="-1">Off-chain</button>
+    <button type="button" id="tab-7" class="tab" role="tab" aria-selected="false" aria-controls="panel-7" data-tab="7" tabindex="-1">Integrations</button>
+    <button type="button" id="tab-8" class="tab" role="tab" aria-selected="false" aria-controls="panel-8" data-tab="8" tabindex="-1">Mission Control</button>
+  </div>
+  <a class="back" href="/operations">Back to Operations</a>
+</div>
+
+<!-- 0 Master -->
+<div class="content active" id="panel-0" role="tabpanel" aria-labelledby="tab-0">
+  <p class="panel-desc">Hub, leaf endings, CCIP destinations, Alltra, the dedicated Avalanche cW corridor, the public cW mesh, and pending programs. Mainnet cW mint corridors and the optional TRUU rail are summarized under the Ethereum anchor.</p>
+  <div class="mermaid-wrap"><div class="mermaid" id="g-master">
+flowchart TB
+  subgraph LEAF_INGRESS["Leaves — access to 138"]
+    WU[Wallets · MetaMask Snaps · Ledger · Chainlist · SDKs · ethers.js]
+    OPS[Operators · Foundry scripts · relay · systemd · deploy hooks]
+    RPCPUB[Public RPC FQDNs · thirdweb mirrors]
+    FB[Fireblocks Web3 RPC]
+  end
+
+  subgraph LEAF_EDGE["Leaves — services that index or front 138"]
+    EXP[Explorer · Blockscout · token-aggregation]
+    INFO[info.defi-oracle.io]
+    DAPP[dapp.d-bis.org bridge UI]
+    DBIS[dbis-api Core hosts]
+    X402[x402 payment API]
+    MCP[MCP PMM controller]
+  end
+
+  subgraph HUB["CHAIN 138 — origin hub"]
+    C138["Besu EVM · tokens core · DODO PMM V2/V3 · RouterV2 · UniV3 / Balancer / Curve / 1inch pilots · CCIP bridges + router · AlltraAdapter · BridgeVault · ISO channels · mirror reserve vault settlement · Lockbox · Truth / Tron / Solana adapters"]
+  end
+
+  subgraph CCIP_ETH["Ethereum 1 — CCIP anchor"]
+    ETH1["WETH9 / WETH10 bridges · CCIPRelayRouter · RelayBridge · Logger · optional trustless stack"]
+    LEAF_ETH["Leaf — Mainnet native DEX venues · Li.Fi touchpoints on other chains · first-wave cW DODO pools · optional TRUU PMM rail"]
+  end
+
+  subgraph CCIP_L2["Other live CCIP EVM destinations"]
+    L2CLU["OP 10 · Base 8453 · Arb 42161 · Polygon 137 · BSC 56 · Avax 43114 · Gnosis 100 · Celo 42220 · Cronos 25"]
+    LEAF_L2["Leaf — per-chain native DEX · cW token transport · partial edge pools"]
+  end
+
+  subgraph ALLTRA["ALL Mainnet 651940"]
+    A651["AlltraAdapter peer · AUSDT · WETH · WALL · HYDX · DEX env placeholders"]
+    LEAF_651["Leaf — ALL native venues when configured"]
+  end
+
+  subgraph SPECIAL["Dedicated corridor from 138"]
+    AVAXCW["138 cUSDT to Avax cWUSDT mint path"]
+    LEAF_AVAX["Leaf — recipient on 43114"]
+  end
+
+  subgraph CW_MESH["Public cW GRU mesh"]
+    CW["Cross-public-EVM token matrix · pool design · Mainnet DODO concentration"]
+  end
+
+  subgraph PENDING["Pending separate scaffold"]
+    WEMIX[Wemix 1111 CCIP pending]
+    XDC[XDC Zero parallel program]
+    SCAFF[Etherlink Tezos OP L2 design]
+    PNON[Truth pointer · Tron adapter · Solana partial]
+  end
+
+  WU --> RPCPUB
+  RPCPUB --> C138
+  WU --> C138
+  OPS --> C138
+  EXP --> C138
+  INFO --> C138
+  DAPP --> C138
+  DBIS --> C138
+  X402 --> C138
+  MCP --> C138
+  FB --> C138
+
+  C138 <--> ETH1
+  C138 <--> L2CLU
+  C138 <--> A651
+  C138 --> AVAXCW
+  AVAXCW --> LEAF_AVAX
+
+  ETH1 <--> L2CLU
+  ETH1 --> LEAF_ETH
+  L2CLU --> LEAF_L2
+  A651 --> LEAF_651
+
+  CW -.->|pool and peg design| LEAF_ETH
+  CW -.->|token mesh| L2CLU
+
+  C138 -.-> WEMIX
+  C138 -.-> XDC
+  C138 -.-> SCAFF
+  C138 -.-> PNON
+  </div></div>
+</div>
+
+<!-- 1 Network -->
+<div class="content" id="panel-1" role="tabpanel" aria-labelledby="tab-1" hidden>
+  <p class="panel-desc">Chain 138 to the public EVM mesh, Alltra, pending or scaffold targets, Avalanche cW minting, and the separate Mainnet cW mint corridor that sits alongside the standard WETH-class CCIP rail.</p>
+  <div class="mermaid-wrap"><div class="mermaid">
+flowchart TB
+  subgraph C138["Chain 138 — primary"]
+    CORE[Core registry vault oracle ISO router]
+    PMM[DODO PMM V2 DVM + pools]
+    R2[EnhancedSwapRouterV2]
+    D3[D3MM pilot]
+    CCIPB[CCIP WETH9 WETH10 bridges]
+    ALLA[AlltraAdapter]
+    ADP[Truth Tron Solana adapters partial]
+  end
+
+  subgraph PUB["Public EVM mesh (cW*)"]
+    E1[Ethereum 1]
+    E10[Optimism 10]
+    E25[Cronos 25]
+    E56[BSC 56]
+    E100[Gnosis 100]
+    E137[Polygon 137]
+    E42161[Arbitrum 42161]
+    E43114[Avalanche 43114]
+    E8453[Base 8453]
+    E42220[Celo 42220]
+  end
+
+  subgraph PEND["Pending or separate"]
+    WEMIX[Wemix 1111 CCIP pending]
+    XDC[XDC Zero parallel program]
+    SCAFF[Etherlink Tezos OP L2 scaffold design]
+  end
+
+  subgraph A651["ALL Mainnet 651940"]
+    ALLTOK[AUSDT USDC WETH WALL HYDX]
+  end
+
+  C138 -->|CCIP WETH| PUB
+  C138 -->|CCIP WETH| E1
+  C138 -->|mainnet cW mint corridor| E1
+  C138 -->|AlltraAdapter| A651
+  PUB -->|CCIP return| C138
+  E1 -->|CCIP return| C138
+  C138 -.->|operator completion| WEMIX
+  C138 -.->|not CCIP matrix row| XDC
+  C138 -.->|future gated| SCAFF
+
+  C138 -->|avax cw corridor| E43114
+  </div></div>
+  <p class="panel-desc">Topology note: Mainnet now represents two Ethereum-facing patterns in production, the standard WETH-class CCIP rail and the dedicated <code>cUSDC/cUSDT -&gt; cWUSDC/cWUSDT</code> mint corridor.</p>
+</div>
+
+<!-- 2 Stack -->
+<div class="content" id="panel-2" role="tabpanel" aria-labelledby="tab-2" hidden>
+  <p class="panel-desc">On-chain layers: tokens, core, liquidity, cross-domain, reserve and settlement.</p>
+  <div class="mermaid-wrap"><div class="mermaid">
+flowchart TB
+  subgraph L1["Tokens and compliance"]
+    CT[cUSDT · cUSDC · cEUR* · cXAU* · mirrors · USDT · USDC]
+    GEN[WETH WETH10 LINK]
+  end
+
+  subgraph L2["Core infrastructure"]
+    REG[Compliance TokenFactory TokenRegistry BridgeVault]
+    POL[PolicyManager DebtRegistry FeeCollector]
+    ISO[ISO20022Router]
+  end
+
+  subgraph L3["Liquidity and execution"]
+    DVM[DVMFactory VendingMachine DODOPMMIntegration]
+    PRV[DODOPMMProvider PrivatePoolRegistry]
+    R2[EnhancedSwapRouterV2]
+    VEN[Uniswap v3 lane Balancer Curve 1inch pilots]
+    D3[D3Oracle D3Vault D3Proxy D3MMFactory]
+  end
+
+  subgraph L4["Cross-domain"]
+    CCIP[CCIP Router CCIPWETH9 CCIPWETH10]
+    ALL[AlltraAdapter]
+    LBX[Lockbox138]
+    CH[PaymentChannel Mirror AddressMapper]
+  end
+
+  subgraph L5["Reserve vault settlement"]
+    RS[ReserveSystem OraclePriceFeed]
+    VF[VaultFactory Ledger Liquidation XAUOracle]
+    MSR[MerchantSettlementRegistry WithdrawalEscrow]
+  end
+
+  L1 --> L2
+  L2 --> L3
+  L3 --> R2
+  R2 --> VEN
+  L2 --> L4
+  L2 --> L5
+  DVM --> PRV
+  </div></div>
+</div>
+
+<!-- 3 Flows -->
+<div class="content" id="panel-3" role="tabpanel" aria-labelledby="tab-3" hidden>
+  <p class="panel-desc">Same-chain 138: PMM pools, RouterV2 venues, D3 pilot.</p>
+  <div class="mermaid-wrap"><div class="mermaid">
+flowchart LR
+  subgraph inputs["Typical inputs"]
+    U1[cUSDT]
+    U2[cUSDC]
+    U3[USDT mirror]
+    U4[USDC mirror]
+    U5[cEURT]
+    U6[cXAUC]
+  end
+
+  subgraph path_pmm["DODO PMM"]
+    INT[DODOPMMIntegration]
+    POOL[Stable pools XAU public pools Private XAU registry]
+  end
+
+  subgraph path_r2["Router v2"]
+    R2[EnhancedSwapRouterV2]
+    UV3[Uniswap v3 WETH stable]
+    PILOT[Balancer Curve 1inch]
+  end
+
+  subgraph path_d3["Pilot"]
+    D3[D3MM WETH10 pilot pool]
+  end
+
+  inputs --> INT
+  INT --> POOL
+  inputs --> R2
+  R2 --> UV3
+  R2 --> PILOT
+  GEN2[WETH WETH10] --> R2
+  GEN2 --> D3
+  </div></div>
+</div>
+
+<!-- 4 Cross-chain -->
+<div class="content" id="panel-4" role="tabpanel" aria-labelledby="tab-4" hidden>
+  <p class="panel-desc">CCIP transport, Alltra round-trip, the dedicated c-to-cW mint corridors, and the orchestrated swap-bridge-swap target.</p>
+  <div class="mermaid-wrap">
+    <h3>CCIP — WETH primary transport</h3>
+    <div class="mermaid">
+sequenceDiagram
+  participant U as User or bot
+  participant C138 as Chain 138
+  participant BR as CCIPWETH9 or WETH10 bridge
+  participant R as CCIP Router
+  participant D as Destination EVM
+
+  U->>C138: Fund WETH bridge fee LINK
+  U->>BR: Initiate cross-chain WETH transfer
+  BR->>R: CCIP message
+  R->>D: Deliver WETH class asset
+  Note over D: Native DEX or cW pools where deployed
+  D->>R: Optional return leg
+  R->>C138: Inbound to receiver bridge
+    </div>
+  </div>
+  <div class="mermaid-wrap">
+    <h3>Alltra — 138 to ALL Mainnet</h3>
+    <div class="mermaid">
+flowchart LR
+  A[Chain 138] -->|AlltraAdapter| B[ALL 651940]
+  B -->|AlltraAdapter| A
+    </div>
+  </div>
+  <div class="mermaid-wrap">
+    <h3>Special corridors — c* to cW* mint</h3>
+    <div class="mermaid">
+flowchart LR
+  S1[cUSDT on 138] -->|avax cw relay mint| T1[cWUSDT on Avalanche]
+  S2[cUSDC on 138] -->|mainnet relay mint| T2[cWUSDC on Mainnet]
+  S3[cUSDT on 138] -->|mainnet relay mint| T3[cWUSDT on Mainnet]
+    </div>
+  </div>
+  <div class="mermaid-wrap">
+    <h3>Orchestrated swap-bridge-swap (design target)</h3>
+    <div class="mermaid">
+flowchart LR
+  Q[QuoteService POST api bridge quote] --> S1[Source leg e.g. 138 PMM]
+  S1 --> BR[Bridge CCIP Alltra or special]
+  BR --> S2[Destination leg DEX or cW pool]
+    </div>
+  </div>
+</div>
+
+<!-- 5 Public cW -->
+<div class="content" id="panel-5" role="tabpanel" aria-labelledby="tab-5" hidden>
+  <p class="panel-desc">Ethereum Mainnet first-wave cW DODO mesh, plus the separate optional TRUU PMM rail. See PMM_DEX_ROUTING_STATUS and cross-chain-pmm-lps deployment-status for live detail.</p>
+  <div class="mermaid-wrap"><div class="mermaid">
+flowchart TB
+  subgraph ETH["Ethereum Mainnet"]
+    CW[cWUSDT cWUSDC cWEURC cWGBPC cWAUDC cWCADC cWJPYC cWCHFC]
+    HUB[USDC USDT]
+    DODO[DODO PMM Wave 1 pools]
+  end
+
+  CW <--> DODO
+  HUB <--> DODO
+  </div></div>
+  <p class="panel-desc">TRUU note: the optional Mainnet Truth rail is a separate volatile PMM lane and is not part of the default cW stable mesh.</p>
+  <div class="mermaid-wrap">
+    <h3>Mainnet TRUU PMM (volatile, optional)</h3>
+    <div class="mermaid">
+flowchart LR
+  subgraph TRUUmesh["Mainnet TRUU rail optional"]
+    CWu[cWUSDT or cWUSDC]
+    TRUU[TRUU ERC-20]
+    PMM[DODO PMM integration]
+  end
+
+  CWu <--> PMM
+  TRUU <--> PMM
+    </div>
+  </div>
+</div>
+
+<!-- 6 Off-chain -->
+<div class="content" id="panel-6" role="tabpanel" aria-labelledby="tab-6" hidden>
+  <p class="panel-desc">Wallets, edge FQDNs, APIs, operators feeding Chain 138 RPC, plus the explorer-hosted Mission Control visual surfaces.</p>
+  <div class="mermaid-wrap"><div class="mermaid">
+flowchart TB
+  subgraph users["Wallets and tools"]
+    MM[MetaMask custom network Snaps]
+    MCP[MCP PMM controller allowlist 138]
+  end
+
+  subgraph edge["Public edge"]
+    EXP[explorer.d-bis.org Blockscout token-aggregation]
+    MC[Mission Control visual panels]
+    INFO[info.defi-oracle.io]
+    DAPP[dapp.d-bis.org bridge UI]
+    RPC[rpc-http-pub.d-bis.org public RPC]
+  end
+
+  subgraph api["APIs"]
+    TA[token-aggregation v1 v2 quote pools bridge routes]
+    DBIS[dbis-api Core runtime]
+    X402[x402-api readiness surface]
+  end
+
+  subgraph ops["Operator"]
+    REL[CCIP relay systemd]
+    SCR[smom-dbis-138 forge scripts]
+  end
+
+  users --> edge
+  EXP --> MC
+  edge --> api
+  MC --> api
+  api --> C138[Chain 138 RPC]
+  ops --> C138
+  </div></div>
+  <p class="panel-desc">Mission Control note: the live visual display lives in the main explorer SPA, especially the bridge-monitoring and operator surfaces. This command center stays focused on the static architecture view.</p>
+</div>
+
+<!-- 7 Integrations -->
+<div class="content" id="panel-7" role="tabpanel" aria-labelledby="tab-7" hidden>
+  <p class="panel-desc">Contract families vs wallet/client integrations not spelled out in every zoom diagram. Wormhole remains docs/MCP scope, not canonical 138 addresses.</p>
+  <div class="mermaid-wrap"><div class="mermaid">
+flowchart LR
+  subgraph chain138_tech["Chain 138 contract families"]
+    A[Besu EVM]
+    B[ERC-20 core registries]
+    C[DODO V2 V3]
+    D[UniV3 Bal Curve 1inch pilots]
+    E[CCIP bridges router]
+    F[Alltra Vault ISO channels]
+  end
+
+  subgraph public_integrations["Wallet and client integrations"]
+    L[Ledger]
+    CL[Chainlist]
+    TW[thirdweb RPC]
+    ETH[ethers.js]
+    MM[MetaMask Snaps]
+  end
+
+  chain138_tech --> public_integrations
+  </div></div>
+</div>
+
+<!-- 8 Mission Control -->
+<div class="content" id="panel-8" role="tabpanel" aria-labelledby="tab-8" hidden>
+  <p class="panel-desc">Mission Control is the live explorer surface for SSE health, labeled bridge traces, cached liquidity proxy results, and operator-facing API references. The interactive controls live in the main explorer SPA; this tab is the architecture companion with direct entry points.</p>
+  <div class="mermaid-wrap">
+    <h3>Mission Control visual flow</h3>
+    <div class="mermaid">
+flowchart LR
+  UI[Explorer SPA Mission Control panels]
+  SSE[SSE stream]
+  TRACE[Bridge trace]
+  LIQ[Liquidity proxy]
+  T4[Track 4 script API]
+  API[Explorer Go API]
+  UP[Blockscout and token-aggregation upstreams]
+
+  UI --> SSE
+  UI --> TRACE
+  UI --> LIQ
+  UI -.->|operator-only| T4
+  SSE --> API
+  TRACE --> API
+  LIQ --> API
+  T4 --> API
+  TRACE --> UP
+  LIQ --> UP
+    </div>
+  </div>
+  <div class="mermaid-wrap">
+    <h3>Live entry points</h3>
+    <p class="panel-desc">Use the main explorer UI for the visual Mission Control experience, then open the raw APIs when you need direct payloads or verification.</p>
+    <div style="display:grid; grid-template-columns:repeat(auto-fit, minmax(220px, 1fr)); gap:0.75rem;">
+      <a href="/operator" style="display:block; text-decoration:none; color:inherit; border:1px solid var(--border); border-radius:14px; padding:1rem; background:var(--panel);"><div style="font-weight:700; margin-bottom:0.3rem;">Operator hub</div><div style="color:var(--muted); line-height:1.5;">Explorer SPA surface with Mission Control and operator-facing API references.</div></a>
+      <a href="/bridge" style="display:block; text-decoration:none; color:inherit; border:1px solid var(--border); border-radius:14px; padding:1rem; background:var(--panel);"><div style="font-weight:700; margin-bottom:0.3rem;">Bridge monitoring</div><div style="color:var(--muted); line-height:1.5;">Includes the visible Mission Control bridge-trace card and SSE stream entry point.</div></a>
+      <a href="/explorer-api/v1/mission-control/stream" target="_blank" rel="noopener noreferrer" style="display:block; text-decoration:none; color:inherit; border:1px solid var(--border); border-radius:14px; padding:1rem; background:var(--panel);"><div style="font-weight:700; margin-bottom:0.3rem;">SSE stream</div><div style="color:var(--muted); line-height:1.5;"><code>GET /explorer-api/v1/mission-control/stream</code></div></a>
+      <a href="/explorer-api/v1/mission-control/bridge/trace?tx=0x2f31d4f9a97be754b800f4af1a9eedf3b107d353bfa1a19e81417497a76c05c2" target="_blank" rel="noopener noreferrer" style="display:block; text-decoration:none; color:inherit; border:1px solid var(--border); border-radius:14px; padding:1rem; background:var(--panel);"><div style="font-weight:700; margin-bottom:0.3rem;">Bridge trace example</div><div style="color:var(--muted); line-height:1.5;"><code>GET /explorer-api/v1/mission-control/bridge/trace</code></div></a>
+      <a href="/explorer-api/v1/mission-control/liquidity/token/0x93E66202A11B1772E55407B32B44e5Cd8eda7f22/pools" target="_blank" rel="noopener noreferrer" style="display:block; text-decoration:none; color:inherit; border:1px solid var(--border); border-radius:14px; padding:1rem; background:var(--panel);"><div style="font-weight:700; margin-bottom:0.3rem;">Liquidity example</div><div style="color:var(--muted); line-height:1.5;"><code>GET /explorer-api/v1/mission-control/liquidity/token/{address}/pools</code></div></a>
+      <div style="border:1px solid var(--border); border-radius:14px; padding:1rem; background:var(--panel);"><div style="font-weight:700; margin-bottom:0.3rem;">Track 4 script API</div><div style="color:var(--muted); line-height:1.5;"><code>POST /explorer-api/v1/track4/operator/run-script</code><br>Requires wallet auth, IP allowlisting, and backend allowlist config.</div></div>
+    </div>
+  </div>
+</div>
+
+<footer>
+  Source: <code>proxmox/docs/02-architecture/SMOM_DBIS_138_FULL_DEPLOYMENT_FLOW_MAP.md</code> — addresses: <code>config/smart-contracts-master.json</code> and CONTRACT_ADDRESSES_REFERENCE.
+</footer>
+
+<script>
+(function () {
+  mermaid.initialize({
+    startOnLoad: false,
+    theme: 'dark',
+    securityLevel: 'loose',
+    flowchart: { curve: 'basis', padding: 12 },
+    sequence: { actorMargin: 24, boxMargin: 8 }
+  });
+
+  var TAB_SLUGS = ['master', 'network', 'stack', 'flows', 'cross-chain', 'public-cw', 'off-chain', 'integrations', 'mission-control'];
+  var TAB_BY_NAME = {};
+  TAB_SLUGS.forEach(function (s, i) { TAB_BY_NAME[s] = i; });
+
+  var tabs = document.querySelectorAll('.tab');
+  var panels = document.querySelectorAll('.content[role="tabpanel"]');
+  var tablist = document.querySelector('[role="tablist"]');
+  var done = {};
+
+  function parseInitialTab() {
+    var q = new URLSearchParams(window.location.search).get('tab');
+    if (q == null || q === '') return 0;
+    var n = parseInt(q, 10);
+    if (!isNaN(n) && n >= 0 && n < tabs.length) return n;
+    var key = String(q).toLowerCase().trim().replace(/\s+/g, '-');
+    if (Object.prototype.hasOwnProperty.call(TAB_BY_NAME, key)) return TAB_BY_NAME[key];
+    return 0;
+  }
+
+  function ensureMermaid() {
+    if (window.mermaid && typeof window.mermaid.run === 'function') {
+      return Promise.resolve(window.mermaid);
+    }
+    return new Promise(function (resolve, reject) {
+      var script = document.createElement('script');
+      script.src = 'https://cdn.jsdelivr.net/npm/mermaid@10/dist/mermaid.min.js';
+      script.async = true;
+      script.onload = function () {
+        if (window.mermaid && typeof window.mermaid.run === 'function') resolve(window.mermaid);
+        else reject(new Error('Mermaid fallback loaded without runtime'));
+      };
+      script.onerror = function () {
+        reject(new Error('Mermaid fallback failed to load'));
+      };
+      document.head.appendChild(script);
+    });
+  }
+
+  function syncUrl(index) {
+    var slug = TAB_SLUGS[index] != null ? TAB_SLUGS[index] : String(index);
+    try {
+      var u = new URL(window.location.href);
+      u.searchParams.set('tab', slug);
+      history.replaceState(null, '', u.pathname + u.search + u.hash);
+    } catch (e) { /* file:// or restricted */ }
+  }
+
+  function setActive(index) {
+    if (index < 0) index = 0;
+    if (index >= tabs.length) index = tabs.length - 1;
+    tabs.forEach(function (t, i) {
+      var on = i === index;
+      t.classList.toggle('active', on);
+      t.setAttribute('aria-selected', on ? 'true' : 'false');
+      t.setAttribute('tabindex', on ? '0' : '-1');
+    });
+    panels.forEach(function (p, i) {
+      var on = i === index;
+      p.classList.toggle('active', on);
+      if (on) p.removeAttribute('hidden');
+      else p.setAttribute('hidden', '');
+    });
+  }
+
+  async function renderPanel(index) {
+    var panel = document.getElementById('panel-' + index);
+    if (!panel || done[index]) return;
+    done[index] = true;
+    var nodes = panel.querySelectorAll('.mermaid');
+    if (nodes.length) {
+      try {
+        await ensureMermaid();
+        await mermaid.run({ nodes: nodes });
+        var status = document.getElementById('mermaid-status');
+        if (status) status.textContent = 'Diagram assets loaded. This page is a public reference surface; the main explorer remains the canonical live operational view.';
+      } catch (e) {
+        console.error('Mermaid render failed for panel', index, e);
+        var statusError = document.getElementById('mermaid-status');
+        if (statusError) statusError.textContent = 'Diagram rendering failed. Use the Operations Hub or the main explorer for live operational surfaces.';
+      }
+    }
+  }
+
+  async function showTab(index, opts) {
+    opts = opts || {};
+    setActive(index);
+    await renderPanel(index);
+    if (!opts.skipUrl) syncUrl(index);
+  }
+
+  tabs.forEach(function (tab) {
+    tab.addEventListener('click', function () {
+      var i = parseInt(tab.getAttribute('data-tab'), 10);
+      showTab(i);
+    });
+  });
+
+  if (tablist) {
+    tablist.addEventListener('keydown', function (e) {
+      var cur = -1;
+      tabs.forEach(function (t, idx) {
+        if (t.getAttribute('aria-selected') === 'true') cur = idx;
+      });
+      if (cur < 0) return;
+      var next = cur;
+      if (e.key === 'ArrowRight') {
+        e.preventDefault();
+        next = (cur + 1) % tabs.length;
+      } else if (e.key === 'ArrowLeft') {
+        e.preventDefault();
+        next = (cur - 1 + tabs.length) % tabs.length;
+      } else if (e.key === 'Home') {
+        e.preventDefault();
+        next = 0;
+      } else if (e.key === 'End') {
+        e.preventDefault();
+        next = tabs.length - 1;
+      } else {
+        return;
+      }
+      showTab(next).then(function () {
+        tabs[next].focus();
+      });
+    });
+  }
+
+  async function boot() {
+    var initial = parseInitialTab();
+    await showTab(initial, { skipUrl: true });
+    try {
+      var u = new URL(window.location.href);
+      if (u.searchParams.has('tab')) syncUrl(initial);
+    } catch (e2) { /* ignore */ }
+  }
+  if (document.readyState === 'loading') {
+    document.addEventListener('DOMContentLoaded', boot);
+  } else {
+    boot();
+  }
+})();
+</script>
+</body>
+</html>
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/explorer_d-bis_org_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/explorer_d-bis_org_https_headers.txt
@@ -0,0 +1,19 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:54:03 GMT
+content-type: text/html; charset=utf-8
+content-length: 111925
+vary: Accept-Encoding
+etag: "y82jwqcv5g2ebu"
+vary: Accept-Encoding
+cache-control: no-store, no-cache, must-revalidate
+referrer-policy: strict-origin-when-cross-origin
+content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net https://unpkg.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com; img-src 'self' data: https:; font-src 'self' https://cdnjs.cloudflare.com; connect-src 'self' https://blockscout.defi-oracle.io wss://blockscout.defi-oracle.io https://explorer.d-bis.org wss://explorer.d-bis.org https://rpc-http-pub.d-bis.org wss://rpc-ws-pub.d-bis.org http://192.168.11.221:8545 ws://192.168.11.221:8546;
+alt-svc: h3=":443"; ma=86400
+x-xss-protection: 0
+x-content-type-options: nosniff
+x-frame-options: SAMEORIGIN
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+referrer-policy: strict-origin-when-cross-origin
+
+
+0.797344
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/explorer_d-bis_org_mission_control_liquidity.json
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/explorer_d-bis_org_mission_control_liquidity.json
@@ -0,0 +1 @@
+{"pools":[{"address":"0x9e89bae009adf128782e19e8341996c596ac40dc","dex":"dodo","token0":{"address":"0x93e66202a11b1772e55407b32b44e5cd8eda7f22","symbol":"cUSDT","name":"Tether USD (Compliant)","source":"db"},"token1":{"address":"0xf22258f57794cc8e06237084b353ab30fffa640b","symbol":"cUSDC","name":"USD Coin (Compliant)","source":"db"},"reserves":{"token0":"983891197998","token1":"1016108797998"},"tvl":1999999.995996,"volume24h":0,"feeTier":null},{"address":"0x866cb44b59303d8dc5f4f9e3e7a8e8b0bf238d66","dex":"dodo","token0":{"address":"0x93e66202a11b1772e55407b32b44e5cd8eda7f22","symbol":"cUSDT","name":"Tether USD (Compliant)","source":"db"},"token1":{"address":"0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1","symbol":"USDT","name":"Tether USD (Chain 138)","source":"db"},"reserves":{"token0":"999872497998","token1":"1000127497998"},"tvl":1999999.995996,"volume24h":0,"feeTier":null}]}
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/explorer_d-bis_org_mission_control_stream_body.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/explorer_d-bis_org_mission_control_stream_body.txt
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/explorer_d-bis_org_mission_control_stream_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/explorer_d-bis_org_mission_control_stream_headers.txt
@@ -0,0 +1,22 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:54:05 GMT
+content-type: text/event-stream
+access-control-allow-headers: Authorization, Content-Type, X-API-Key
+access-control-allow-methods: GET, POST, OPTIONS
+access-control-allow-origin: *
+cache-control: no-cache
+content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net https://unpkg.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com; font-src 'self' https://cdnjs.cloudflare.com; img-src 'self' data: https:; connect-src 'self' https://blockscout.defi-oracle.io https://explorer.d-bis.org https://rpc-http-pub.d-bis.org wss://rpc-ws-pub.d-bis.org http://192.168.11.221:8545 ws://192.168.11.221:8546;
+permissions-policy: geolocation=(), microphone=(), camera=()
+referrer-policy: strict-origin-when-cross-origin
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+x-content-type-options: nosniff
+x-explorer-name: SolaceScan
+x-explorer-version: 1.0.0
+x-frame-options: SAMEORIGIN
+x-xss-protection: 0
+access-control-allow-origin: *
+access-control-allow-methods: GET, POST, OPTIONS
+access-control-allow-headers: Content-Type, Authorization
+alt-svc: h3=":443"; ma=86400
+referrer-policy: strict-origin-when-cross-origin
+
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/explorer_d-bis_org_mission_control_trace.json
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/explorer_d-bis_org_mission_control_trace.json
@@ -0,0 +1 @@
+{"data":{"blockscout_url":"https://explorer.d-bis.org/tx/0x2f31d4f9a97be754b800f4af1a9eedf3b107d353bfa1a19e81417497a76c05c2","from":"0x4a666f96fc8764181194447a7dfdb7d471b301c8","from_registry":"DEPLOYER_ADMIN_138","source":"blockscout","to":"0x152ed3e9912161b76bdfd368d0c84b7c31c10de7","to_registry":"CW_L1_BRIDGE_CHAIN138","tx_hash":"0x2f31d4f9a97be754b800f4af1a9eedf3b107d353bfa1a19e81417497a76c05c2"}}
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/gitea_d-bis_org_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/gitea_d-bis_org_https_headers.txt
@@ -0,0 +1,10 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:53:58 GMT
+x-dns-prefetch-control: off
+x-content-type-options: nosniff
+x-permitted-cross-domain-policies: none
+referrer-policy: strict-origin-when-cross-origin
+x-frame-options: SAMEORIGIN
+
+
+0.133719
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/identity_d-bis_org_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/identity_d-bis_org_https_headers.txt
@@ -0,0 +1,18 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:53:05 GMT
+content-type: text/html; charset=utf-8
+content-length: 22505
+vary: Accept-Encoding
+x-frame-options: SAMEORIGIN
+x-content-type-options: nosniff
+referrer-policy: strict-origin-when-cross-origin
+content-security-policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'
+vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Accept-Encoding
+cache-control: s-maxage=31536000, stale-while-revalidate
+etag: "fqzlq2o9ljhd0"
+alt-svc: h3=":443"; ma=86400
+x-xss-protection: 0
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+
+
+0.125819
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/info_defi-oracle_io_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/info_defi-oracle_io_https_headers.txt
@@ -0,0 +1,19 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:52:55 GMT
+content-type: text/html
+vary: Accept-Encoding
+last-modified: Sun, 05 Apr 2026 23:21:29 GMT
+report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=t1GChXKNyx8%2F4A3x1KGUZ%2FtD7GHCO0T8KWson2zuNPsMmPmQXDt12sJ1EyfxRDaHlNf4Z%2Ft2fD1lX4wP%2Btgvoc1H0sOKlyapwFFITT2kUBUBtTYVuLtJSt5pshunelTpkFBTKDIR"}]}
+alt-svc: h3=":443"; ma=86400
+x-xss-protection: 0
+x-content-type-options: nosniff
+x-frame-options: SAMEORIGIN
+content-security-policy: upgrade-insecure-requests
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
+cf-cache-status: DYNAMIC
+server: cloudflare
+cf-ray: 9eb2b6d9ac57489a-LAX
+
+
+0.202597
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/info_defi_oracle_io_token_aggregation_networks.json
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/info_defi_oracle_io_token_aggregation_networks.json
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/interop_d-bis_org_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/interop_d-bis_org_https_headers.txt
@@ -0,0 +1,18 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:53:02 GMT
+content-type: text/html; charset=utf-8
+content-length: 22505
+vary: Accept-Encoding
+x-frame-options: SAMEORIGIN
+x-content-type-options: nosniff
+referrer-policy: strict-origin-when-cross-origin
+content-security-policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'
+vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Accept-Encoding
+cache-control: s-maxage=31536000, stale-while-revalidate
+etag: "fqzlq2o9ljhd0"
+alt-svc: h3=":443"; ma=86400
+x-xss-protection: 0
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+
+
+0.073623
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/keycloak_sankofa_nexus_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/keycloak_sankofa_nexus_https_headers.txt
@@ -0,0 +1,13 @@
+HTTP/2 302 
+date: Sun, 12 Apr 2026 13:53:14 GMT
+location: https://keycloak.sankofa.nexus/admin/
+referrer-policy: no-referrer
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+x-content-type-options: nosniff
+x-xss-protection: 0
+alt-svc: h3=":443"; ma=86400
+x-frame-options: SAMEORIGIN
+content-security-policy: upgrade-insecure-requests
+
+
+0.100692
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/members_d-bis_org_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/members_d-bis_org_https_headers.txt
@@ -0,0 +1,18 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:52:33 GMT
+content-type: text/html; charset=utf-8
+content-length: 22505
+vary: Accept-Encoding
+x-frame-options: SAMEORIGIN
+x-content-type-options: nosniff
+referrer-policy: strict-origin-when-cross-origin
+content-security-policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'
+vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Accept-Encoding
+cache-control: s-maxage=31536000, stale-while-revalidate
+etag: "fqzlq2o9ljhd0"
+alt-svc: h3=":443"; ma=86400
+x-xss-protection: 0
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+
+
+0.133922
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/mifos_d-bis_org_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/mifos_d-bis_org_https_headers.txt
@@ -0,0 +1,12 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:52:31 GMT
+content-type: text/html
+content-length: 2147
+last-modified: Wed, 07 May 2025 12:00:31 GMT
+vary: Accept-Encoding
+etag: "681b4b5f-863"
+alt-svc: h3=":443"; ma=86400
+accept-ranges: bytes
+
+
+0.077119
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/mim4u_org_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/mim4u_org_https_headers.txt
@@ -0,0 +1,18 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:53:15 GMT
+content-type: text/html
+content-length: 2710
+vary: Accept-Encoding
+last-modified: Tue, 31 Mar 2026 05:21:47 GMT
+etag: "69cb59eb-a96"
+accept-ranges: bytes
+alt-svc: h3=":443"; ma=86400
+x-xss-protection: 0
+x-content-type-options: nosniff
+x-frame-options: SAMEORIGIN
+content-security-policy: upgrade-insecure-requests
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+referrer-policy: strict-origin-when-cross-origin
+
+
+0.066202
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/ops_d-bis_org_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/ops_d-bis_org_https_headers.txt
@@ -0,0 +1,18 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:53:09 GMT
+content-type: text/html; charset=utf-8
+content-length: 22505
+vary: Accept-Encoding
+x-frame-options: SAMEORIGIN
+x-content-type-options: nosniff
+referrer-policy: strict-origin-when-cross-origin
+content-security-policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'
+vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Accept-Encoding
+cache-control: s-maxage=31536000, stale-while-revalidate
+etag: "fqzlq2o9ljhd0"
+alt-svc: h3=":443"; ma=86400
+x-xss-protection: 0
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+
+
+0.071058
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/phoenix_sankofa_nexus_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/phoenix_sankofa_nexus_https_headers.txt
@@ -0,0 +1,20 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:53:27 GMT
+content-type: application/json; charset=utf-8
+content-length: 54
+vary: Accept-Encoding
+x-content-type-options: nosniff
+x-frame-options: SAMEORIGIN
+x-xss-protection: 0
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+content-security-policy: default-src 'self'; script-src 'self' 'nonce-rYV5C64EM5GTfpLAvUrJ1Q=='; style-src 'self' 'nonce-rYV5C64EM5GTfpLAvUrJ1Q=='; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests
+referrer-policy: strict-origin-when-cross-origin
+permissions-policy: geolocation=(), microphone=(), camera=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()
+x-permitted-cross-domain-policies: none
+cross-origin-embedder-policy: require-corp
+cross-origin-opener-policy: same-origin
+cross-origin-resource-policy: same-origin
+alt-svc: h3=":443"; ma=86400
+
+
+0.086112
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/policy_d-bis_org_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/policy_d-bis_org_https_headers.txt
@@ -0,0 +1,18 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:52:43 GMT
+content-type: text/html; charset=utf-8
+content-length: 22505
+vary: Accept-Encoding
+x-frame-options: SAMEORIGIN
+x-content-type-options: nosniff
+referrer-policy: strict-origin-when-cross-origin
+content-security-policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'
+vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Accept-Encoding
+cache-control: s-maxage=31536000, stale-while-revalidate
+etag: "fqzlq2o9ljhd0"
+alt-svc: h3=":443"; ma=86400
+x-xss-protection: 0
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+
+
+0.102009
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/portal_sankofa_nexus_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/portal_sankofa_nexus_https_headers.txt
@@ -0,0 +1,20 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:52:44 GMT
+content-type: text/html; charset=utf-8
+content-length: 5259
+vary: Accept-Encoding
+x-dns-prefetch-control: on
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+x-frame-options: SAMEORIGIN
+x-content-type-options: nosniff
+x-xss-protection: 0
+referrer-policy: strict-origin-when-cross-origin
+permissions-policy: camera=(), microphone=(), geolocation=()
+content-security-policy: default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' https:
+vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Accept-Encoding
+cache-control: s-maxage=31536000, stale-while-revalidate
+etag: "oibim89srm41x"
+alt-svc: h3=":443"; ma=86400
+
+
+0.093692
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/research_d-bis_org_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/research_d-bis_org_https_headers.txt
@@ -0,0 +1,18 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:52:41 GMT
+content-type: text/html; charset=utf-8
+content-length: 22505
+vary: Accept-Encoding
+x-frame-options: SAMEORIGIN
+x-content-type-options: nosniff
+referrer-policy: strict-origin-when-cross-origin
+content-security-policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'
+vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Accept-Encoding
+cache-control: s-maxage=31536000, stale-while-revalidate
+etag: "fqzlq2o9ljhd0"
+alt-svc: h3=":443"; ma=86400
+x-xss-protection: 0
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+
+
+0.244462
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/rpc-alltra-2_d-bis_org_rpc_response.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/rpc-alltra-2_d-bis_org_rpc_response.txt
@@ -0,0 +1 @@
+{"jsonrpc":"2.0","id":1,"result":"0x8a"}
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/rpc-alltra-3_d-bis_org_rpc_response.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/rpc-alltra-3_d-bis_org_rpc_response.txt
@@ -0,0 +1 @@
+{"jsonrpc":"2.0","id":1,"result":"0x8a"}
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/rpc-alltra_d-bis_org_rpc_response.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/rpc-alltra_d-bis_org_rpc_response.txt
@@ -0,0 +1 @@
+{"jsonrpc":"2.0","id":1,"result":"0x8a"}
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/rpc-core_d-bis_org_rpc_response.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/rpc-core_d-bis_org_rpc_response.txt
@@ -0,0 +1 @@
+{"jsonrpc":"2.0","id":1,"result":"0x8a"}
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/rpc-fireblocks_d-bis_org_rpc_response.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/rpc-fireblocks_d-bis_org_rpc_response.txt
@@ -0,0 +1 @@
+{"jsonrpc":"2.0","id":1,"result":"0x8a"}
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/rpc-http-prv_d-bis_org_rpc_response.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/rpc-http-prv_d-bis_org_rpc_response.txt
@@ -0,0 +1 @@
+{"jsonrpc":"2.0","id":1,"result":"0x8a"}
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/rpc-http-pub_d-bis_org_rpc_response.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/rpc-http-pub_d-bis_org_rpc_response.txt
@@ -0,0 +1 @@
+{"jsonrpc":"2.0","id":1,"result":"0x8a"}
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/rpc-hybx-2_d-bis_org_rpc_response.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/rpc-hybx-2_d-bis_org_rpc_response.txt
@@ -0,0 +1 @@
+{"jsonrpc":"2.0","id":1,"result":"0x8a"}
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/rpc-hybx-3_d-bis_org_rpc_response.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/rpc-hybx-3_d-bis_org_rpc_response.txt
@@ -0,0 +1 @@
+{"jsonrpc":"2.0","id":1,"result":"0x8a"}
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/rpc-hybx_d-bis_org_rpc_response.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/rpc-hybx_d-bis_org_rpc_response.txt
@@ -0,0 +1 @@
+{"jsonrpc":"2.0","id":1,"result":"0x8a"}
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/rpc2_d-bis_org_rpc_response.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/rpc2_d-bis_org_rpc_response.txt
@@ -0,0 +1 @@
+{"jsonrpc":"2.0","id":1,"result":"0x8a"}
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/rpc_d-bis_org_rpc_response.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/rpc_d-bis_org_rpc_response.txt
@@ -0,0 +1 @@
+{"jsonrpc":"2.0","id":1,"result":"0x8a"}
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/rpc_defi-oracle_io_rpc_response.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/rpc_defi-oracle_io_rpc_response.txt
@@ -0,0 +1 @@
+{"jsonrpc":"2.0","id":1,"result":"0x8a"}
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/rpc_public-0138_defi-oracle_io_rpc_response.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/rpc_public-0138_defi-oracle_io_rpc_response.txt
@@ -0,0 +1 @@
+{"jsonrpc":"2.0","id":1,"result":"0x8a"}
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/sandbox_d-bis_org_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/sandbox_d-bis_org_https_headers.txt
@@ -0,0 +1,18 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:53:18 GMT
+content-type: text/html; charset=utf-8
+content-length: 22505
+vary: Accept-Encoding
+x-frame-options: SAMEORIGIN
+x-content-type-options: nosniff
+referrer-policy: strict-origin-when-cross-origin
+content-security-policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'
+vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Accept-Encoding
+cache-control: s-maxage=31536000, stale-while-revalidate
+etag: "fqzlq2o9ljhd0"
+alt-svc: h3=":443"; ma=86400
+x-xss-protection: 0
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+
+
+0.088363
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/sankofa_nexus_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/sankofa_nexus_https_headers.txt
@@ -0,0 +1,19 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:52:49 GMT
+content-type: text/html; charset=utf-8
+vary: Accept-Encoding
+x-content-type-options: nosniff
+x-dns-prefetch-control: on
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+x-frame-options: SAMEORIGIN
+referrer-policy: strict-origin-when-cross-origin
+permissions-policy: camera=(), microphone=(), geolocation=()
+content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' https: ws: wss:
+vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Accept-Encoding
+link: </_next/static/media/e4af272ccee01ff0-s.p.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2"
+cache-control: private, no-cache, no-store, max-age=0, must-revalidate
+alt-svc: h3=":443"; ma=86400
+x-xss-protection: 0
+
+
+0.116520
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/secure_d-bis_org_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/secure_d-bis_org_https_headers.txt
@@ -0,0 +1,18 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:54:42 GMT
+content-type: text/html
+content-length: 795
+vary: Accept-Encoding
+last-modified: Thu, 02 Apr 2026 19:27:04 GMT
+etag: "69cec308-31b"
+x-frame-options: SAMEORIGIN
+x-content-type-options: nosniff
+x-xss-protection: 0
+accept-ranges: bytes
+alt-svc: h3=":443"; ma=86400
+content-security-policy: upgrade-insecure-requests
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+referrer-policy: strict-origin-when-cross-origin
+
+
+0.100453
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/secure_mim4u_org_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/secure_mim4u_org_https_headers.txt
@@ -0,0 +1,18 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:53:59 GMT
+content-type: text/html
+content-length: 2710
+vary: Accept-Encoding
+last-modified: Tue, 31 Mar 2026 05:21:47 GMT
+etag: "69cb59eb-a96"
+accept-ranges: bytes
+alt-svc: h3=":443"; ma=86400
+x-xss-protection: 0
+x-content-type-options: nosniff
+x-frame-options: SAMEORIGIN
+content-security-policy: upgrade-insecure-requests
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+referrer-policy: strict-origin-when-cross-origin
+
+
+0.174413
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/status_d-bis_org_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/status_d-bis_org_https_headers.txt
@@ -0,0 +1,18 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:53:50 GMT
+content-type: text/html; charset=utf-8
+content-length: 22505
+vary: Accept-Encoding
+x-frame-options: SAMEORIGIN
+x-content-type-options: nosniff
+referrer-policy: strict-origin-when-cross-origin
+content-security-policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'
+vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Accept-Encoding
+cache-control: s-maxage=31536000, stale-while-revalidate
+etag: "fqzlq2o9ljhd0"
+alt-svc: h3=":443"; ma=86400
+x-xss-protection: 0
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+
+
+0.080954
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/studio_sankofa_nexus_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/studio_sankofa_nexus_https_headers.txt
@@ -0,0 +1,13 @@
+HTTP/2 502 
+date: Sun, 12 Apr 2026 13:52:58 GMT
+content-type: text/html
+content-length: 122
+alt-svc: h3=":443"; ma=86400
+x-xss-protection: 0
+x-content-type-options: nosniff
+x-frame-options: SAMEORIGIN
+content-security-policy: upgrade-insecure-requests
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+
+
+0.059656
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/the-order_sankofa_nexus_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/the-order_sankofa_nexus_https_headers.txt
@@ -0,0 +1,20 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:53:37 GMT
+content-type: text/html; charset=utf-8
+content-length: 5259
+vary: Accept-Encoding
+x-dns-prefetch-control: on
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+x-frame-options: SAMEORIGIN
+x-content-type-options: nosniff
+x-xss-protection: 0
+referrer-policy: strict-origin-when-cross-origin
+permissions-policy: camera=(), microphone=(), geolocation=()
+content-security-policy: default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' https:
+vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Accept-Encoding
+cache-control: s-maxage=31536000, stale-while-revalidate
+etag: "oibim89srm41x"
+alt-svc: h3=":443"; ma=86400
+
+
+0.122532
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/training_mim4u_org_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/training_mim4u_org_https_headers.txt
@@ -0,0 +1,18 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:54:31 GMT
+content-type: text/html
+content-length: 2710
+vary: Accept-Encoding
+last-modified: Tue, 31 Mar 2026 05:21:47 GMT
+etag: "69cb59eb-a96"
+accept-ranges: bytes
+alt-svc: h3=":443"; ma=86400
+x-xss-protection: 0
+x-content-type-options: nosniff
+x-frame-options: SAMEORIGIN
+content-security-policy: upgrade-insecure-requests
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+referrer-policy: strict-origin-when-cross-origin
+
+
+0.078750
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/verification_report.md
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/verification_report.md
@@ -0,0 +1,628 @@
+# End-to-End Routing Verification Report
+
+**Date**: 2026-04-12T06:55:05-07:00
+**Public IP**: 76.53.10.36
+**Profile**: all
+**Verifier**: intlc
+
+## All endpoints (64)
+
+| Domain | Type | URL |
+|--------|------|-----|
+| admin.d-bis.org | web | https://admin.d-bis.org |
+| admin.sankofa.nexus | web | https://admin.sankofa.nexus |
+| blockscout.defi-oracle.io | web | https://blockscout.defi-oracle.io |
+| cacti-alltra.d-bis.org | web | https://cacti-alltra.d-bis.org |
+| cacti-hybx.d-bis.org | web | https://cacti-hybx.d-bis.org |
+| codespaces.d-bis.org | web | https://codespaces.d-bis.org |
+| core.d-bis.org | web | https://core.d-bis.org |
+| d-bis.org | web | https://d-bis.org |
+| dapp.d-bis.org | web | https://dapp.d-bis.org |
+| dash.sankofa.nexus | web | https://dash.sankofa.nexus |
+| data.d-bis.org | api | https://data.d-bis.org |
+| dbis-admin.d-bis.org | web | https://dbis-admin.d-bis.org |
+| dbis-api-2.d-bis.org | api | https://dbis-api-2.d-bis.org |
+| dbis-api.d-bis.org | api | https://dbis-api.d-bis.org |
+| dev.d-bis.org | web | https://dev.d-bis.org |
+| developers.d-bis.org | web | https://developers.d-bis.org |
+| docs.d-bis.org | web | https://docs.d-bis.org |
+| explorer.d-bis.org | web | https://explorer.d-bis.org |
+| gitea.d-bis.org | web | https://gitea.d-bis.org |
+| identity.d-bis.org | web | https://identity.d-bis.org |
+| info.defi-oracle.io | web | https://info.defi-oracle.io |
+| interop.d-bis.org | web | https://interop.d-bis.org |
+| keycloak.sankofa.nexus | web | https://keycloak.sankofa.nexus |
+| members.d-bis.org | web | https://members.d-bis.org |
+| mifos.d-bis.org | web | https://mifos.d-bis.org |
+| mim4u.org | web | https://mim4u.org |
+| ops.d-bis.org | web | https://ops.d-bis.org |
+| phoenix.sankofa.nexus | web | https://phoenix.sankofa.nexus |
+| policy.d-bis.org | web | https://policy.d-bis.org |
+| portal.sankofa.nexus | web | https://portal.sankofa.nexus |
+| research.d-bis.org | web | https://research.d-bis.org |
+| rpc-alltra-2.d-bis.org | rpc-http | https://rpc-alltra-2.d-bis.org |
+| rpc-alltra-3.d-bis.org | rpc-http | https://rpc-alltra-3.d-bis.org |
+| rpc-alltra.d-bis.org | rpc-http | https://rpc-alltra.d-bis.org |
+| rpc-core.d-bis.org | rpc-http | https://rpc-core.d-bis.org |
+| rpc-fireblocks.d-bis.org | rpc-http | https://rpc-fireblocks.d-bis.org |
+| rpc-http-prv.d-bis.org | rpc-http | https://rpc-http-prv.d-bis.org |
+| rpc-http-pub.d-bis.org | rpc-http | https://rpc-http-pub.d-bis.org |
+| rpc-hybx-2.d-bis.org | rpc-http | https://rpc-hybx-2.d-bis.org |
+| rpc-hybx-3.d-bis.org | rpc-http | https://rpc-hybx-3.d-bis.org |
+| rpc-hybx.d-bis.org | rpc-http | https://rpc-hybx.d-bis.org |
+| rpc-ws-prv.d-bis.org | rpc-ws | https://rpc-ws-prv.d-bis.org |
+| rpc-ws-pub.d-bis.org | rpc-ws | https://rpc-ws-pub.d-bis.org |
+| rpc.d-bis.org | rpc-http | https://rpc.d-bis.org |
+| rpc.defi-oracle.io | rpc-http | https://rpc.defi-oracle.io |
+| rpc.public-0138.defi-oracle.io | rpc-http | https://rpc.public-0138.defi-oracle.io |
+| rpc2.d-bis.org | rpc-http | https://rpc2.d-bis.org |
+| sandbox.d-bis.org | web | https://sandbox.d-bis.org |
+| sankofa.nexus | web | https://sankofa.nexus |
+| secure.d-bis.org | web | https://secure.d-bis.org |
+| secure.mim4u.org | web | https://secure.mim4u.org |
+| status.d-bis.org | web | https://status.d-bis.org |
+| studio.sankofa.nexus | web | https://studio.sankofa.nexus |
+| the-order.sankofa.nexus | web | https://the-order.sankofa.nexus |
+| training.mim4u.org | web | https://training.mim4u.org |
+| ws.rpc-fireblocks.d-bis.org | rpc-ws | https://ws.rpc-fireblocks.d-bis.org |
+| ws.rpc.d-bis.org | rpc-ws | https://ws.rpc.d-bis.org |
+| ws.rpc2.d-bis.org | rpc-ws | https://ws.rpc2.d-bis.org |
+| wss.defi-oracle.io | rpc-ws | https://wss.defi-oracle.io |
+| www.d-bis.org | web | https://www.d-bis.org |
+| www.mim4u.org | web | https://www.mim4u.org |
+| www.phoenix.sankofa.nexus | web | https://www.phoenix.sankofa.nexus |
+| www.sankofa.nexus | web | https://www.sankofa.nexus |
+| www.the-order.sankofa.nexus | web | https://www.the-order.sankofa.nexus |
+
+## Summary
+
+- **Total domains tested**: 64
+- **DNS tests passed**: 64
+- **HTTPS tests passed**: 43
+- **Explorer surface failures**: 0
+- **Failed tests**: 0
+- **Skipped / optional (not configured or unreachable)**: 0
+- **Average response time**: 0.15596259090909093s
+
+## Results overview
+
+| Domain | Type | DNS | SSL | HTTPS | Root | RPC | Explorer+ |
+|--------|------|-----|-----|-------|------|-----|-----------|
+| ws.rpc-fireblocks.d-bis.org | rpc-ws | pass | pass | - | - | - | - |
+| dbis-admin.d-bis.org | web | pass | pass | pass | - | - | - |
+| core.d-bis.org | web | pass | pass | pass | - | - | - |
+| rpc-alltra-3.d-bis.org | rpc-http | pass | pass | - | - | pass | - |
+| mifos.d-bis.org | web | pass | pass | pass | - | - | - |
+| members.d-bis.org | web | pass | pass | pass | - | - | - |
+| admin.sankofa.nexus | web | pass | pass | pass | - | - | - |
+| dash.sankofa.nexus | web | pass | pass | pass | - | - | - |
+| rpc-hybx-2.d-bis.org | rpc-http | pass | pass | - | - | pass | - |
+| research.d-bis.org | web | pass | pass | pass | - | - | - |
+| policy.d-bis.org | web | pass | pass | pass | - | - | - |
+| portal.sankofa.nexus | web | pass | pass | pass | - | - | - |
+| cacti-hybx.d-bis.org | web | pass | pass | pass | - | - | - |
+| developers.d-bis.org | web | pass | pass | pass | - | - | - |
+| sankofa.nexus | web | pass | pass | pass | - | - | - |
+| rpc-alltra.d-bis.org | rpc-http | pass | pass | - | - | pass | - |
+| rpc-http-pub.d-bis.org | rpc-http | pass | pass | - | - | pass | - |
+| info.defi-oracle.io | web | pass | pass | pass | - | - | - |
+| rpc.public-0138.defi-oracle.io | rpc-http | pass | pass | - | - | pass | - |
+| studio.sankofa.nexus | web | pass | pass | warn | - | - | - |
+| www.d-bis.org | web | pass | pass | pass | - | - | - |
+| dbis-api.d-bis.org | api | pass | pass | pass | - | - | - |
+| interop.d-bis.org | web | pass | pass | pass | - | - | - |
+| docs.d-bis.org | web | pass | pass | pass | - | - | - |
+| identity.d-bis.org | web | pass | pass | pass | - | - | - |
+| rpc-hybx-3.d-bis.org | rpc-http | pass | pass | - | - | pass | - |
+| rpc.d-bis.org | rpc-http | pass | pass | - | - | pass | - |
+| dapp.d-bis.org | web | pass | pass | pass | - | - | - |
+| ops.d-bis.org | web | pass | pass | pass | - | - | - |
+| www.sankofa.nexus | web | pass | pass | pass | - | - | - |
+| www.the-order.sankofa.nexus | web | pass | pass | pass | - | - | - |
+| keycloak.sankofa.nexus | web | pass | pass | pass | - | - | - |
+| mim4u.org | web | pass | pass | pass | - | - | - |
+| data.d-bis.org | api | pass | pass | pass | - | - | - |
+| sandbox.d-bis.org | web | pass | pass | pass | - | - | - |
+| ws.rpc.d-bis.org | rpc-ws | pass | pass | - | - | - | - |
+| phoenix.sankofa.nexus | web | pass | pass | pass | - | - | - |
+| www.mim4u.org | web | pass | pass | pass | - | - | - |
+| wss.defi-oracle.io | rpc-ws | pass | pass | - | - | - | - |
+| the-order.sankofa.nexus | web | pass | pass | pass | - | - | - |
+| rpc2.d-bis.org | rpc-http | pass | pass | - | - | pass | - |
+| rpc-ws-pub.d-bis.org | rpc-ws | pass | pass | - | - | - | - |
+| dev.d-bis.org | web | pass | pass | pass | - | - | - |
+| admin.d-bis.org | web | pass | pass | pass | - | - | - |
+| status.d-bis.org | web | pass | pass | pass | - | - | - |
+| rpc-alltra-2.d-bis.org | rpc-http | pass | pass | - | - | pass | - |
+| rpc-http-prv.d-bis.org | rpc-http | pass | pass | - | - | pass | - |
+| www.phoenix.sankofa.nexus | web | pass | pass | pass | - | - | - |
+| gitea.d-bis.org | web | pass | pass | pass | - | - | - |
+| secure.mim4u.org | web | pass | pass | pass | - | - | - |
+| rpc-fireblocks.d-bis.org | rpc-http | pass | pass | - | - | pass | - |
+| explorer.d-bis.org | web | pass | pass | pass | - | - | - |
+| training.mim4u.org | web | pass | pass | pass | - | - | - |
+| blockscout.defi-oracle.io | web | pass | pass | pass | - | - | - |
+| dbis-api-2.d-bis.org | api | pass | pass | pass | - | - | - |
+| d-bis.org | web | pass | pass | pass | - | - | - |
+| rpc-core.d-bis.org | rpc-http | pass | pass | - | - | pass | - |
+| secure.d-bis.org | web | pass | pass | pass | - | - | - |
+| rpc-hybx.d-bis.org | rpc-http | pass | pass | - | - | pass | - |
+| codespaces.d-bis.org | web | pass | pass | pass | - | - | - |
+| rpc.defi-oracle.io | rpc-http | pass | pass | - | - | pass | - |
+| rpc-ws-prv.d-bis.org | rpc-ws | pass | pass | - | - | - | - |
+| ws.rpc2.d-bis.org | rpc-ws | pass | pass | - | - | - | - |
+| cacti-alltra.d-bis.org | web | pass | pass | pass | - | - | - |
+
+## Test Results by Domain (detail)
+
+
+### ws.rpc-fireblocks.d-bis.org
+- Type: rpc-ws
+- DNS: pass
+- SSL: pass
+- Details: See `all_e2e_results.json`
+
+### dbis-admin.d-bis.org
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### core.d-bis.org
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### rpc-alltra-3.d-bis.org
+- Type: rpc-http
+- DNS: pass
+- SSL: pass
+- RPC: pass
+- Details: See `all_e2e_results.json`
+
+### mifos.d-bis.org
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### members.d-bis.org
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### admin.sankofa.nexus
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### dash.sankofa.nexus
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### rpc-hybx-2.d-bis.org
+- Type: rpc-http
+- DNS: pass
+- SSL: pass
+- RPC: pass
+- Details: See `all_e2e_results.json`
+
+### research.d-bis.org
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### policy.d-bis.org
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### portal.sankofa.nexus
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### cacti-hybx.d-bis.org
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### developers.d-bis.org
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### sankofa.nexus
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### rpc-alltra.d-bis.org
+- Type: rpc-http
+- DNS: pass
+- SSL: pass
+- RPC: pass
+- Details: See `all_e2e_results.json`
+
+### rpc-http-pub.d-bis.org
+- Type: rpc-http
+- DNS: pass
+- SSL: pass
+- RPC: pass
+- Details: See `all_e2e_results.json`
+
+### info.defi-oracle.io
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### rpc.public-0138.defi-oracle.io
+- Type: rpc-http
+- DNS: pass
+- SSL: pass
+- RPC: pass
+- Details: See `all_e2e_results.json`
+
+### studio.sankofa.nexus
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: warn
+- Details: See `all_e2e_results.json`
+
+### www.d-bis.org
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### dbis-api.d-bis.org
+- Type: api
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### interop.d-bis.org
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### docs.d-bis.org
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### identity.d-bis.org
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### rpc-hybx-3.d-bis.org
+- Type: rpc-http
+- DNS: pass
+- SSL: pass
+- RPC: pass
+- Details: See `all_e2e_results.json`
+
+### rpc.d-bis.org
+- Type: rpc-http
+- DNS: pass
+- SSL: pass
+- RPC: pass
+- Details: See `all_e2e_results.json`
+
+### dapp.d-bis.org
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### ops.d-bis.org
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### www.sankofa.nexus
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### www.the-order.sankofa.nexus
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### keycloak.sankofa.nexus
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### mim4u.org
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### data.d-bis.org
+- Type: api
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### sandbox.d-bis.org
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### ws.rpc.d-bis.org
+- Type: rpc-ws
+- DNS: pass
+- SSL: pass
+- Details: See `all_e2e_results.json`
+
+### phoenix.sankofa.nexus
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### www.mim4u.org
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### wss.defi-oracle.io
+- Type: rpc-ws
+- DNS: pass
+- SSL: pass
+- Details: See `all_e2e_results.json`
+
+### the-order.sankofa.nexus
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### rpc2.d-bis.org
+- Type: rpc-http
+- DNS: pass
+- SSL: pass
+- RPC: pass
+- Details: See `all_e2e_results.json`
+
+### rpc-ws-pub.d-bis.org
+- Type: rpc-ws
+- DNS: pass
+- SSL: pass
+- Details: See `all_e2e_results.json`
+
+### dev.d-bis.org
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### admin.d-bis.org
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### status.d-bis.org
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### rpc-alltra-2.d-bis.org
+- Type: rpc-http
+- DNS: pass
+- SSL: pass
+- RPC: pass
+- Details: See `all_e2e_results.json`
+
+### rpc-http-prv.d-bis.org
+- Type: rpc-http
+- DNS: pass
+- SSL: pass
+- RPC: pass
+- Details: See `all_e2e_results.json`
+
+### www.phoenix.sankofa.nexus
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### gitea.d-bis.org
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### secure.mim4u.org
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### rpc-fireblocks.d-bis.org
+- Type: rpc-http
+- DNS: pass
+- SSL: pass
+- RPC: pass
+- Details: See `all_e2e_results.json`
+
+### explorer.d-bis.org
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Blockscout API: pass
+- Command Center: pass
+- Mission Control stream: pass
+- Mission Control trace: pass
+- Mission Control liquidity: pass
+- Details: See `all_e2e_results.json`
+
+### training.mim4u.org
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### blockscout.defi-oracle.io
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Blockscout API: pass
+- Details: See `all_e2e_results.json`
+
+### dbis-api-2.d-bis.org
+- Type: api
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### d-bis.org
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### rpc-core.d-bis.org
+- Type: rpc-http
+- DNS: pass
+- SSL: pass
+- RPC: pass
+- Details: See `all_e2e_results.json`
+
+### secure.d-bis.org
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### rpc-hybx.d-bis.org
+- Type: rpc-http
+- DNS: pass
+- SSL: pass
+- RPC: pass
+- Details: See `all_e2e_results.json`
+
+### codespaces.d-bis.org
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+### rpc.defi-oracle.io
+- Type: rpc-http
+- DNS: pass
+- SSL: pass
+- RPC: pass
+- Details: See `all_e2e_results.json`
+
+### rpc-ws-prv.d-bis.org
+- Type: rpc-ws
+- DNS: pass
+- SSL: pass
+- Details: See `all_e2e_results.json`
+
+### ws.rpc2.d-bis.org
+- Type: rpc-ws
+- DNS: pass
+- SSL: pass
+- Details: See `all_e2e_results.json`
+
+### cacti-alltra.d-bis.org
+- Type: web
+- DNS: pass
+- SSL: pass
+- HTTPS: pass
+- Details: See `all_e2e_results.json`
+
+## Files Generated
+
+- `all_e2e_results.json` - Complete E2E test results
+- `*_https_headers.txt` - HTTP response headers per domain
+- `*_rpc_response.txt` - RPC response per domain
+- `verification_report.md` - This report
+
+## Notes
+
+- **Optional domains:** Domains in `E2E_OPTIONAL_WHEN_FAIL` (default: many d-bis.org/sankofa/mim4u/rpc) have any fail treated as skip so the run passes when off-LAN or services unreachable. The canonical explorer `explorer.d-bis.org` is intentionally **not** in that list anymore. Set `E2E_OPTIONAL_WHEN_FAIL=` (empty) for strict mode.
+- WebSocket tests require `wscat` tool: `npm install -g wscat`
+- OpenSSL fetch uses `timeout` (`E2E_OPENSSL_TIMEOUT` / `E2E_OPENSSL_X509_TIMEOUT`, defaults 15s / 5s) so `openssl s_client` cannot hang indefinitely
+- Internal connectivity tests require access to NPMplus container
+- Explorer (explorer.d-bis.org): verifies Blockscout API, `/chain138-command-center.html`, and Mission Control stream / trace / liquidity endpoints. Use `SKIP_BLOCKSCOUT_API=1` only when you need to skip the Blockscout API sub-check specifically.
+
+## Next Steps
+
+1. Review test results for each domain
+2. Investigate any failed tests
+3. Test WebSocket connections for RPC WS domains (if wscat available)
+4. Test internal connectivity from NPMplus container
+5. Update source-of-truth JSON after verification
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/www_d-bis_org_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/www_d-bis_org_https_headers.txt
@@ -0,0 +1,14 @@
+HTTP/2 301 
+date: Sun, 12 Apr 2026 13:52:59 GMT
+content-type: text/html
+content-length: 134
+location: https://d-bis.org/
+alt-svc: h3=":443"; ma=86400
+x-xss-protection: 0
+x-content-type-options: nosniff
+x-frame-options: SAMEORIGIN
+content-security-policy: upgrade-insecure-requests
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+
+
+0.052194
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/www_mim4u_org_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/www_mim4u_org_https_headers.txt
@@ -0,0 +1,18 @@
+HTTP/2 200 
+date: Sun, 12 Apr 2026 13:53:28 GMT
+content-type: text/html
+content-length: 2710
+vary: Accept-Encoding
+last-modified: Tue, 31 Mar 2026 05:21:47 GMT
+etag: "69cb59eb-a96"
+accept-ranges: bytes
+alt-svc: h3=":443"; ma=86400
+x-xss-protection: 0
+x-content-type-options: nosniff
+x-frame-options: SAMEORIGIN
+content-security-policy: upgrade-insecure-requests
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+referrer-policy: strict-origin-when-cross-origin
+
+
+0.060509
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/www_phoenix_sankofa_nexus_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/www_phoenix_sankofa_nexus_https_headers.txt
@@ -0,0 +1,14 @@
+HTTP/2 301 
+date: Sun, 12 Apr 2026 13:53:56 GMT
+content-type: text/html
+content-length: 134
+location: https://phoenix.sankofa.nexus/health
+alt-svc: h3=":443"; ma=86400
+x-xss-protection: 0
+x-content-type-options: nosniff
+x-frame-options: SAMEORIGIN
+content-security-policy: upgrade-insecure-requests
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+
+
+0.115175
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/www_sankofa_nexus_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/www_sankofa_nexus_https_headers.txt
@@ -0,0 +1,14 @@
+HTTP/2 301 
+date: Sun, 12 Apr 2026 13:53:11 GMT
+content-type: text/html
+content-length: 134
+location: https://sankofa.nexus/
+alt-svc: h3=":443"; ma=86400
+x-xss-protection: 0
+x-content-type-options: nosniff
+x-frame-options: SAMEORIGIN
+content-security-policy: upgrade-insecure-requests
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+
+
+0.065033
--- a/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/www_the-order_sankofa_nexus_https_headers.txt
+++ b/docs/04-configuration/verification-evidence/e2e-verification-20260412_065215/www_the-order_sankofa_nexus_https_headers.txt
@@ -0,0 +1,14 @@
+HTTP/2 301 
+date: Sun, 12 Apr 2026 13:53:12 GMT
+content-type: text/html
+content-length: 134
+location: https://the-order.sankofa.nexus/
+alt-svc: h3=":443"; ma=86400
+x-xss-protection: 0
+x-content-type-options: nosniff
+x-frame-options: SAMEORIGIN
+content-security-policy: upgrade-insecure-requests
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+
+
+0.138665
--- a/docs/11-references/CHAIN138_GRID_6534_WALLET_FUNDING_PLAN.md
+++ b/docs/11-references/CHAIN138_GRID_6534_WALLET_FUNDING_PLAN.md
@@ -1,7 +1,7 @@
 # Chain 138 — Funding plan for 33×33×6 (6,534) PMM soak grid wallets

 **Purpose:** Separate the **operator (deployer)** role from the **6,534 grid EOAs**, summarize how to fund native gas and ERC-20 inventory for soak activity, and give **order-of-magnitude budgets** with formulas.  
-**Companion:** [DEPLOYER_WALLET_FUNDING_PLAN_PMM_POOLS.md](DEPLOYER_WALLET_FUNDING_PLAN_PMM_POOLS.md) (deployer liquidity / reserve split).  
+**Companion:** [DEPLOYER_WALLET_FUNDING_PLAN_PMM_POOLS.md](DEPLOYER_WALLET_FUNDING_PLAN_PMM_POOLS.md) (deployer liquidity / reserve split). **Policy framing:** the grid is **operational capacity** for PMM execution; GRU/XDR and corridor truth remain **reference-anchored** — [GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md](../04-configuration/GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md).  
 **Automation:** `scripts/deployment/pmm-soak-operator-fund-grid.sh` (`--native` or ERC-20), `scripts/deployment/pmm-soak-export-wallet-grid.py`, `scripts/deployment/chain138-pmm-soak-grid-bot.sh`, smoke `scripts/deployment/pmm-soak-grid-smoke-check.sh`, **one-shot** `scripts/deployment/pmm-soak-complete-operator-bootstrap.sh` (creates `~/.secure-secrets/chain138-pmm-soak-grid.mnemonic` when `PMM_SOAK_AUTO_INIT_GRID_MNEMONIC=1`, exports 6,534 addresses to `config/pmm-soak-wallet-grid.json`, optional `--apply-funds --to-linear N`), **full-grid resume** `scripts/deployment/pmm-soak-complete-grid-funding-operator.sh` (waits chain + deployer nonce, mirror-USDC mint shortfall, native + four ERC-20 legs in chunks; env `PMM_SOAK_START_LEG`, `PMM_SOAK_RESUME_NATIVE_FROM_LINEAR`, `PMM_SOAK_RPC_URL_OVERRIDE`), and **`scripts/deployment/pmm-soak-operator-fund-full-grid-tranches.sh`** (same legs as tranche loops; same RPC override pattern). **CI:** `.github/workflows/pmm-soak-grid-smoke.yml` runs the smoke script on `CI=true` with public read-only RPC when `RPC_URL_138` is unset.  
 **Pool narrowing:** `scripts/lib/pmm-soak-pools.sh` (`PMM_SOAK_POOL_PRESET`, `PMM_SOAK_POOLS_FILE`).  
 **Swap execution:** `scripts/lib/pmm-soak-chain138-tick.sh` defaults to **`CHAIN138_PMM_SOAK_SWAP_VIA=pool`** (EOA `transfer` into the DVM + `sellBase` / `sellQuote`). On this chain, `DODOPMMIntegration.swapExactIn` reverts inside the pool when the integration contract is `msg.sender`; set `CHAIN138_PMM_SOAK_SWAP_VIA=integration` only if you have confirmed that path on your RPC.  
--- a/docs/11-references/GRU_V2_PUBLIC_PROTOCOL_DEPLOYMENT_STATUS.md
+++ b/docs/11-references/GRU_V2_PUBLIC_PROTOCOL_DEPLOYMENT_STATUS.md
@@ -3,6 +3,8 @@
 **Last Updated:** 2026-04-04  
 **Purpose:** Single truthful status surface for the GRU v2 public-network rollout across the public EVM `cW*` token mesh, Wave 1 bridge/transport activation, and the public protocol venues that matter for live `cW*` liquidity.

+**Policy:** Public mesh liquidity is **reference-anchored execution capacity**, not an independent FX oracle — see [GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md](../04-configuration/GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md) and `cross-chain-pmm-lps/config/peg-bands.json` **`gruPolicyIntegration`**.
+
 ---

 ## Bottom line
--- a/docs/11-references/LIQUIDITY_POOLS_MASTER_MAP.md
+++ b/docs/11-references/LIQUIDITY_POOLS_MASTER_MAP.md
@@ -167,6 +167,8 @@ Not liquidity pools per se; they support XAU triangulation for private mesh pari

 ## Public-chain cW* stabilization (edge pools + bot)

+**GRU policy:** treat this mesh as **execution capacity** around reference-anchored FX and reserve rules, not standalone shadow FX — [GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md](../04-configuration/GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md).
+
 M1 tokens on Chain 138 (cUSDT, cUSDC, cAUSDT, cEURC, cEURT, cUSDW) are bridged to public chains as **cW\*** wrappers (cWUSDT, cWUSDC, etc.). The intended public-chain stabilization model uses **single-sided PMM edge pools** (cW* / USDC, cW* / USDT, etc.) plus a **bot-driven stabilization mesh** when those components are deployed. Specs, pool matrix, peg bands, and deployment recipe:

 **Current repo reality:** `cross-chain-pmm-lps/config/deployment-status.json` records cW token addresses on the supported public EVM chains and now includes the first live Mainnet DODO PMM cW pools: `cWUSDT/USDC`, `cWUSDC/USDC`, `cWUSDT/USDT`, `cWUSDC/USDT`, **`cWUSDT/cWUSDC`** (`0xe944b7Cb012A0820c07f54D51e92f0e1C74168DB`, one vault, both swap directions), and the first six non-USD Wave 1 rows `cWEURC/USDC` (`0x0bC750F9c6DbDcd76B205695A356491b1B9ef098`), `cWGBPC/USDC` (`0x5488042dF882893a3e7074453E2005CaDE4101b0`), `cWAUDC/USDC` (`0x6c1bD4F43c5f330E50B61DE81066dA7C61a9b5b4`), `cWCADC/USDC` (`0xE0F35b5736FDd0a2F4B618621b0A08F8D8A3f92A`), `cWJPYC/USDC` (`0x8A4187dF0A8FE855cC53A4F7B2D8346588Ee9794`), and `cWCHFC/USDC` (`0x776Ca556deD3245984F504F4bef8Eeec55C50190`). The repo still does **not** currently assert any live public cW* `Balancer`, `Curve`, `Uniswap`, or `1inch` venues, and the broader multi-chain cW* mesh remains incomplete. Avalanche still has the proven `cUSDT -> cWUSDT` mint corridor, but not a documented same-chain cW* / stable pool there.
--- a/docs/11-references/PMM_DEX_ROUTING_STATUS.md
+++ b/docs/11-references/PMM_DEX_ROUTING_STATUS.md
@@ -3,6 +3,8 @@
 **Last Updated:** 2026-04-03  
 **Purpose:** Single reference for DEX/DeFi and PMM liquidity pool routing — what is designed, deployed, and in use.

+**GRU / FX policy:** public-chain cW\* PMM activity is **mesh execution** against policy and reference inputs, not a shadow FX oracle — [GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md](../04-configuration/GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md).
+
 ---

 ## Executive summary (updated 2026-04-01)
--- a/scripts/besu/collect-enodes-from-all-besu-nodes.sh
+++ b/scripts/besu/collect-enodes-from-all-besu-nodes.sh
@@ -1,8 +1,11 @@
 #!/usr/bin/env bash
-# Collect enode from each of the 32 Besu nodes and regenerate static-nodes.json and
-# permissions-nodes.toml with 32 unique entries (canonical IPs). Fixes duplicate enode (2400/2401).
+# Collect enode from each live Besu node and regenerate static-nodes.json and
+# permissions-nodes.toml with unique entries (canonical IPs).
 #
-# Usage: bash scripts/besu/collect-enodes-from-all-besu-nodes.sh [--dry-run] [--missing-only]
+# Usage:
+#   bash scripts/besu/collect-enodes-from-all-besu-nodes.sh
+#   bash scripts/besu/collect-enodes-from-all-besu-nodes.sh --missing-only
+#   bash scripts/besu/collect-enodes-from-all-besu-nodes.sh --apply --vmid 2301
 #   --missing-only  Only try to collect from VMIDs whose IP is not yet in static-nodes.json (fix failures only).
 # Output: config/besu-node-lists/static-nodes.json and permissions-nodes.toml (backups as *.bak).

@@ -10,29 +13,63 @@ set -euo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-source "${PROJECT_ROOT}/config/ip-addresses.conf" 2>/dev/null || true
+source "${PROJECT_ROOT}/scripts/lib/load-project-env.sh"

-DRY_RUN=false
+DRY_RUN=true
 MISSING_ONLY=false
-for arg in "${@:-}"; do
-  [[ "$arg" == "--dry-run" ]] && DRY_RUN=true
-  [[ "$arg" == "--missing-only" ]] && MISSING_ONLY=true
+TARGET_VMIDS=()
+
+usage() {
+  cat <<'EOF'
+Usage: bash scripts/besu/collect-enodes-from-all-besu-nodes.sh [--apply] [--dry-run] [--missing-only] [--vmid <N>]
+
+Options:
+  --dry-run       Print intended write actions only (default)
+  --apply         Write regenerated static/perms files
+  --missing-only  Only try VMIDs whose canonical IP is not already present
+  --vmid <N>      Limit collection to one VMID; repeatable
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --dry-run)
+      DRY_RUN=true
+      shift
+      ;;
+    --apply)
+      DRY_RUN=false
+      shift
+      ;;
+    --missing-only)
+      MISSING_ONLY=true
+      shift
+      ;;
+    --vmid)
+      [[ $# -ge 2 ]] || { usage >&2; exit 2; }
+      TARGET_VMIDS+=("$2")
+      shift 2
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      usage >&2
+      exit 2
+      ;;
+  esac
 done

 STATIC_FILE="${PROJECT_ROOT}/config/besu-node-lists/static-nodes.json"
 PERM_FILE="${PROJECT_ROOT}/config/besu-node-lists/permissions-nodes.toml"
 SSH_OPTS="-o ConnectTimeout=8 -o StrictHostKeyChecking=accept-new"

-# All Besu VMIDs in stable order (validators, sentries, RPCs)
-BESU_VMIDS=(1000 1001 1002 1003 1004 1500 1501 1502 1503 1504 1505 1506 1507 1508 2101 2102 2103 2201 2301 2303 2304 2305 2306 2400 2401 2402 2403 2500 2501 2502 2503 2504 2505)
+# Live Besu VMIDs in stable order (validators, sentries, RPCs)
+BESU_VMIDS=(1000 1001 1002 1003 1004 1500 1501 1502 1503 1504 1505 1506 1507 1508 1509 1510 2101 2102 2103 2201 2301 2303 2304 2305 2306 2307 2308 2400 2401 2402 2403 2420 2430 2440 2460 2470 2480)

-# VMID -> Proxmox host
-declare -A HOST_BY_VMID
-for v in 1000 1001 1002 1500 1501 1502 2101 2103 2500 2501 2502 2503 2504 2505; do HOST_BY_VMID[$v]="${PROXMOX_R630_01:-192.168.11.11}"; done
-for v in 2201 2303 2305 2306 2307 2308 2401; do HOST_BY_VMID[$v]="${PROXMOX_R630_02:-192.168.11.12}"; done
-for v in 1003 1004 1503 1504 1505 1506 1507 1508 2102 2301 2304 2400 2402 2403; do HOST_BY_VMID[$v]="${PROXMOX_R630_03:-192.168.11.13}"; done
-
-# VMID -> canonical IP (all 32)
+# VMID -> canonical IP
 declare -A IP_BY_VMID
 IP_BY_VMID[1000]=192.168.11.100
 IP_BY_VMID[1001]=192.168.11.101
@@ -57,20 +94,33 @@ IP_BY_VMID[2303]=192.168.11.233
 IP_BY_VMID[2304]=192.168.11.234
 IP_BY_VMID[2305]=192.168.11.235
 IP_BY_VMID[2306]=192.168.11.236
+IP_BY_VMID[2307]=192.168.11.237
+IP_BY_VMID[2308]=192.168.11.238
 IP_BY_VMID[2400]=192.168.11.240
 IP_BY_VMID[2401]=192.168.11.241
 IP_BY_VMID[2402]=192.168.11.242
 IP_BY_VMID[2403]=192.168.11.243
-IP_BY_VMID[2500]=192.168.11.172
-IP_BY_VMID[2501]=192.168.11.173
-IP_BY_VMID[2502]=192.168.11.174
-IP_BY_VMID[2503]=192.168.11.246
-IP_BY_VMID[2504]=192.168.11.247
-IP_BY_VMID[2505]=192.168.11.248
+IP_BY_VMID[2420]=192.168.11.172
+IP_BY_VMID[2430]=192.168.11.173
+IP_BY_VMID[2440]=192.168.11.174
+IP_BY_VMID[2460]=192.168.11.246
+IP_BY_VMID[2470]=192.168.11.247
+IP_BY_VMID[2480]=192.168.11.248
+
+selected_vmid() {
+  local vmid="$1"
+  [[ ${#TARGET_VMIDS[@]} -eq 0 ]] && return 0
+  local wanted
+  for wanted in "${TARGET_VMIDS[@]}"; do
+    [[ "$vmid" == "$wanted" ]] && return 0
+  done
+  return 1
+}

 get_enode() {
  local vmid="$1"
-  local host="${HOST_BY_VMID[$vmid]:-}"
+  local host
+  host="$(get_host_for_vmid "$vmid")"
  local ip="${IP_BY_VMID[$vmid]:-}"
  [[ -z "$host" || -z "$ip" ]] && return 1
  # 1) admin_nodeInfo (RPC)
@@ -95,9 +145,9 @@ get_enode() {
      return 0
    fi
  fi
-  # 4) For 2501-2505 on r630-01: node may lack Besu binary; export key via helper 2500 (which has Besu)
-  if [[ "$host" == "${PROXMOX_R630_01:-192.168.11.11}" ]] && [[ "$vmid" =~ ^(2501|2502|2503|2504|2505)$ ]]; then
-    pubkey=$(ssh $SSH_OPTS "root@$host" "pct exec $vmid -- cat /data/besu/key 2>/dev/null | head -1 > /tmp/key${vmid}.$$ 2>/dev/null && pct push 2500 /tmp/key${vmid}.$$ /tmp/key${vmid} 2>/dev/null && pct exec 2500 -- /opt/besu/bin/besu public-key export --node-private-key-file=/tmp/key${vmid} 2>/dev/null; rm -f /tmp/key${vmid}.$$" 2>/dev/null | grep -oE '0x[0-9a-fA-F]{128}' | head -1 | sed 's/^0x//')
+  # 4) For edge RPCs without Besu binary, export key via helper 2420 on r630-01.
+  if [[ "$host" == "${PROXMOX_R630_01:-${PROXMOX_HOST_R630_01:-192.168.11.11}}" ]] && [[ "$vmid" =~ ^(2430|2440|2460|2470|2480)$ ]]; then
+    pubkey=$(ssh $SSH_OPTS "root@$host" "pct exec $vmid -- cat /data/besu/key 2>/dev/null | head -1 > /tmp/key${vmid}.$$ 2>/dev/null && pct push 2420 /tmp/key${vmid}.$$ /tmp/key${vmid} 2>/dev/null && pct exec 2420 -- /opt/besu/bin/besu public-key export --node-private-key-file=/tmp/key${vmid} 2>/dev/null; rm -f /tmp/key${vmid}.$$" 2>/dev/null | grep -oE '0x[0-9a-fA-F]{128}' | head -1 | sed 's/^0x//')
    if [[ -n "$pubkey" && ${#pubkey} -eq 128 ]]; then
      echo "enode://${pubkey}@${ip}:30303"
      return 0
@@ -125,6 +175,7 @@ done < <(jq -r '.[]' "${STATIC_FILE}.bak" 2>/dev/null)
 VMIDS_TO_TRY=()
 if $MISSING_ONLY; then
  for vmid in "${BESU_VMIDS[@]}"; do
+    selected_vmid "$vmid" || continue
    ip="${IP_BY_VMID[$vmid]:-}"
    [[ -z "$ip" ]] && continue
    [[ -z "${EXISTING_BY_IP[$ip]:-}" ]] && VMIDS_TO_TRY+=( "$vmid" )
@@ -132,8 +183,11 @@ if $MISSING_ONLY; then
  echo "Missing-only: collecting from ${#VMIDS_TO_TRY[@]} VMIDs not in current list (${VMIDS_TO_TRY[*]:-none})."
  [[ ${#VMIDS_TO_TRY[@]} -eq 0 ]] && echo "All 32 IPs already present. Nothing to collect." && exit 0
 else
-  VMIDS_TO_TRY=( "${BESU_VMIDS[@]}" )
-  echo "Collecting enodes from ${#BESU_VMIDS[@]} Besu nodes..."
+  for vmid in "${BESU_VMIDS[@]}"; do
+    selected_vmid "$vmid" || continue
+    VMIDS_TO_TRY+=( "$vmid" )
+  done
+  echo "Collecting enodes from ${#VMIDS_TO_TRY[@]} Besu nodes..."
 fi

 declare -A COLLECTED_BY_VMID
@@ -168,6 +222,7 @@ declare -a MISSING_VMIDS
 declare -A USED_NODE_ID

 for vmid in "${BESU_VMIDS[@]}"; do
+  selected_vmid "$vmid" || continue
  ip="${IP_BY_VMID[$vmid]:-}"
  [[ -z "$ip" ]] && continue
  enode=""
--- a/scripts/besu/deploy-genesis-and-node-lists-to-rpcs.sh
+++ b/scripts/besu/deploy-genesis-and-node-lists-to-rpcs.sh
@@ -1,34 +1,86 @@
 #!/usr/bin/env bash
-# Deploy canonical genesis.json, static-nodes.json, permissions-nodes.toml to specified VMIDs
-# and restart Besu. Usage: VMIDS="2401 2402 2403 2500 2501 2502 2503 2504 2505" bash scripts/besu/deploy-genesis-and-node-lists-to-rpcs.sh
+# Deploy canonical genesis.json, static-nodes.json, permissions-nodes.toml to selected RPC VMIDs
+# and restart Besu.
+# Usage:
+#   bash scripts/besu/deploy-genesis-and-node-lists-to-rpcs.sh
+#   bash scripts/besu/deploy-genesis-and-node-lists-to-rpcs.sh --vmid 2401
+#   bash scripts/besu/deploy-genesis-and-node-lists-to-rpcs.sh --apply --vmid 2401

 set -euo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-source "${PROJECT_ROOT}/config/ip-addresses.conf" 2>/dev/null || true
+source "${PROJECT_ROOT}/scripts/lib/load-project-env.sh"

-VMIDS="${VMIDS:-2401 2402 2403 2500 2501 2502 2503 2504 2505}"
+DRY_RUN=true
+TARGET_VMIDS=()
+
+usage() {
+  cat <<'EOF'
+Usage: bash scripts/besu/deploy-genesis-and-node-lists-to-rpcs.sh [--apply] [--dry-run] [--vmid <N>]
+
+Options:
+  --dry-run     Print intended actions only (default)
+  --apply       Deploy files and restart Besu on selected RPC nodes
+  --vmid <N>    Limit to one VMID; repeatable
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --dry-run)
+      DRY_RUN=true
+      shift
+      ;;
+    --apply)
+      DRY_RUN=false
+      shift
+      ;;
+    --vmid)
+      [[ $# -ge 2 ]] || { usage >&2; exit 2; }
+      TARGET_VMIDS+=("$2")
+      shift 2
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      usage >&2
+      exit 2
+      ;;
+  esac
+done
+
+RPC_VMIDS=(2401 2402 2403 2420 2430 2440 2460 2470 2480)
 GENESIS="${PROJECT_ROOT}/smom-dbis-138-proxmox/config/genesis.json"
 STATIC="${PROJECT_ROOT}/config/besu-node-lists/static-nodes.json"
 PERMS="${PROJECT_ROOT}/config/besu-node-lists/permissions-nodes.toml"

-declare -A HOST_BY_VMID
-for v in 2500 2501 2502 2503 2504 2505; do HOST_BY_VMID[$v]="${PROXMOX_R630_01:-192.168.11.11}"; done
-for v in 2401; do HOST_BY_VMID[$v]="${PROXMOX_R630_02:-192.168.11.12}"; done
-for v in 2402 2403; do HOST_BY_VMID[$v]="${PROXMOX_ML110:-192.168.11.10}"; done
-
 SSH_OPTS="-o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new"

 [[ ! -f "$GENESIS" ]] && { echo "ERROR: $GENESIS not found"; exit 1; }
 [[ ! -f "$STATIC" ]] && { echo "ERROR: $STATIC not found"; exit 1; }
 [[ ! -f "$PERMS" ]] && { echo "ERROR: $PERMS not found"; exit 1; }

-echo "Deploying genesis.json + static-nodes.json + permissions-nodes.toml to: $VMIDS"
+selected_vmid() {
+  local vmid="$1"
+  [[ ${#TARGET_VMIDS[@]} -eq 0 ]] && return 0
+  local wanted
+  for wanted in "${TARGET_VMIDS[@]}"; do
+    [[ "$vmid" == "$wanted" ]] && return 0
+  done
+  return 1
+}
+
+echo "Deploying genesis.json + static-nodes.json + permissions-nodes.toml to selected RPC VMIDs"
+if $DRY_RUN; then echo "  [dry-run]"; fi
 echo ""

-for vmid in $VMIDS; do
-  host="${HOST_BY_VMID[$vmid]:-}"
+for vmid in "${RPC_VMIDS[@]}"; do
+  selected_vmid "$vmid" || continue
+  host="$(get_host_for_vmid "$vmid")"
  [[ -z "$host" ]] && { echo "VMID $vmid: no host"; continue; }
  running=$(ssh $SSH_OPTS "root@$host" "pct status $vmid 2>/dev/null | awk '{print \$2}'" 2>/dev/null || echo "")
  if [[ "$running" != "running" ]]; then
@@ -36,6 +88,10 @@ for vmid in $VMIDS; do
    continue
  fi
  echo "--- VMID $vmid @ $host ---"
+  if $DRY_RUN; then
+    echo "  [dry-run] would deploy files and restart Besu"
+    continue
+  fi
  scp -q $SSH_OPTS "$GENESIS" "$STATIC" "$PERMS" "root@${host}:/tmp/" || { echo "  scp failed"; continue; }
  ssh $SSH_OPTS "root@$host" "pct exec $vmid -- mkdir -p /etc/besu"
  ssh $SSH_OPTS "root@$host" "pct push $vmid /tmp/genesis.json /etc/besu/genesis.json && pct push $vmid /tmp/static-nodes.json /etc/besu/static-nodes.json && pct push $vmid /tmp/permissions-nodes.toml /etc/besu/permissions-nodes.toml"
--- a/scripts/besu/generate-node-keys-for-missing-vmids.sh
+++ b/scripts/besu/generate-node-keys-for-missing-vmids.sh
@@ -1,9 +1,12 @@
 #!/usr/bin/env bash
-# Generate Besu node key (/data/besu/key) only for VMIDs that are missing from
+# Generate Besu node key (/data/besu/key) only for selected VMIDs that are missing from
 # static-nodes.json (no enode in the list yet). Key file = 64 hex chars (32 bytes).
 # After running, use: bash scripts/besu/collect-enodes-from-all-besu-nodes.sh --missing-only
 #
-# Usage: bash scripts/besu/generate-node-keys-for-missing-vmids.sh [--dry-run] [--collect] [--force]
+# Usage:
+#   bash scripts/besu/generate-node-keys-for-missing-vmids.sh
+#   bash scripts/besu/generate-node-keys-for-missing-vmids.sh --vmid 1505
+#   bash scripts/besu/generate-node-keys-for-missing-vmids.sh --apply --vmid 1505 --collect
 #   --collect  Run collect-enodes-from-all-besu-nodes.sh --missing-only after generating keys.
 #   --force    Overwrite existing key file with new 64-hex key (fixes PEM/wrong-format keys).

@@ -11,25 +14,65 @@ set -euo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-source "${PROJECT_ROOT}/config/ip-addresses.conf" 2>/dev/null || true
+source "${PROJECT_ROOT}/scripts/lib/load-project-env.sh"

-DRY_RUN=false
+DRY_RUN=true
 RUN_COLLECT=false
 FORCE=false
-for arg in "${@:-}"; do
-  [[ "$arg" == "--dry-run" ]] && DRY_RUN=true
-  [[ "$arg" == "--collect" ]] && RUN_COLLECT=true
-  [[ "$arg" == "--force" ]] && FORCE=true
+TARGET_VMIDS=()
+
+usage() {
+  cat <<'EOF'
+Usage: bash scripts/besu/generate-node-keys-for-missing-vmids.sh [--apply] [--dry-run] [--collect] [--force] [--vmid <N>]
+
+Options:
+  --dry-run     Print intended actions only (default)
+  --apply       Generate node keys on selected VMIDs
+  --collect     Run collect-enodes-from-all-besu-nodes.sh --missing-only after generating keys
+  --force       Overwrite existing key files
+  --vmid <N>    Limit to one VMID; repeatable
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --dry-run)
+      DRY_RUN=true
+      shift
+      ;;
+    --apply)
+      DRY_RUN=false
+      shift
+      ;;
+    --collect)
+      RUN_COLLECT=true
+      shift
+      ;;
+    --force)
+      FORCE=true
+      shift
+      ;;
+    --vmid)
+      [[ $# -ge 2 ]] || { usage >&2; exit 2; }
+      TARGET_VMIDS+=("$2")
+      shift 2
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      usage >&2
+      exit 2
+      ;;
+  esac
 done

 STATIC_FILE="${PROJECT_ROOT}/config/besu-node-lists/static-nodes.json"
 SSH_OPTS="-o ConnectTimeout=8 -o StrictHostKeyChecking=accept-new"

-BESU_VMIDS=(1000 1001 1002 1003 1004 1500 1501 1502 1503 1504 1505 1506 1507 1508 2101 2102 2201 2301 2303 2304 2305 2306 2400 2401 2402 2403 2500 2501 2502 2503 2504 2505)
-declare -A HOST_BY_VMID
-for v in 1000 1001 1002 1500 1501 1502 2101 2500 2501 2502 2503 2504 2505; do HOST_BY_VMID[$v]="${PROXMOX_R630_01:-192.168.11.11}"; done
-for v in 2201 2303 2401; do HOST_BY_VMID[$v]="${PROXMOX_R630_02:-192.168.11.12}"; done
-for v in 1003 1004 1503 1504 1505 1506 1507 1508 2102 2301 2304 2305 2306 2400 2402 2403; do HOST_BY_VMID[$v]="${PROXMOX_ML110:-192.168.11.10}"; done
+BESU_VMIDS=(1000 1001 1002 1003 1004 1500 1501 1502 1503 1504 1505 1506 1507 1508 1509 1510 2101 2102 2103 2201 2301 2303 2304 2305 2306 2307 2308 2400 2401 2402 2403 2420 2430 2440 2460 2470 2480)
 declare -A IP_BY_VMID
 IP_BY_VMID[1000]=192.168.11.100
 IP_BY_VMID[1001]=192.168.11.101
@@ -45,24 +88,39 @@ IP_BY_VMID[1505]=192.168.11.213
 IP_BY_VMID[1506]=192.168.11.214
 IP_BY_VMID[1507]=192.168.11.244
 IP_BY_VMID[1508]=192.168.11.245
+IP_BY_VMID[1509]=192.168.11.219
+IP_BY_VMID[1510]=192.168.11.220
 IP_BY_VMID[2101]=192.168.11.211
 IP_BY_VMID[2102]=192.168.11.212
+IP_BY_VMID[2103]=192.168.11.217
 IP_BY_VMID[2201]=192.168.11.221
 IP_BY_VMID[2301]=192.168.11.232
 IP_BY_VMID[2303]=192.168.11.233
 IP_BY_VMID[2304]=192.168.11.234
 IP_BY_VMID[2305]=192.168.11.235
 IP_BY_VMID[2306]=192.168.11.236
+IP_BY_VMID[2307]=192.168.11.237
+IP_BY_VMID[2308]=192.168.11.238
 IP_BY_VMID[2400]=192.168.11.240
 IP_BY_VMID[2401]=192.168.11.241
 IP_BY_VMID[2402]=192.168.11.242
 IP_BY_VMID[2403]=192.168.11.243
-IP_BY_VMID[2500]=192.168.11.172
-IP_BY_VMID[2501]=192.168.11.173
-IP_BY_VMID[2502]=192.168.11.174
-IP_BY_VMID[2503]=192.168.11.246
-IP_BY_VMID[2504]=192.168.11.247
-IP_BY_VMID[2505]=192.168.11.248
+IP_BY_VMID[2420]=192.168.11.172
+IP_BY_VMID[2430]=192.168.11.173
+IP_BY_VMID[2440]=192.168.11.174
+IP_BY_VMID[2460]=192.168.11.246
+IP_BY_VMID[2470]=192.168.11.247
+IP_BY_VMID[2480]=192.168.11.248
+
+selected_vmid() {
+  local vmid="$1"
+  [[ ${#TARGET_VMIDS[@]} -eq 0 ]] && return 0
+  local wanted
+  for wanted in "${TARGET_VMIDS[@]}"; do
+    [[ "$vmid" == "$wanted" ]] && return 0
+  done
+  return 1
+}

 # Which VMIDs are missing (IP not in current static-nodes.json)
 declare -A EXISTING_IP
@@ -74,6 +132,7 @@ done < <(jq -r '.[]' "$STATIC_FILE" 2>/dev/null)

 VMIDS_TO_FIX=()
 for vmid in "${BESU_VMIDS[@]}"; do
+  selected_vmid "$vmid" || continue
  ip="${IP_BY_VMID[$vmid]:-}"
  [[ -z "$ip" ]] && continue
  [[ -z "${EXISTING_IP[$ip]:-}" ]] && VMIDS_TO_FIX+=( "$vmid" )
@@ -88,7 +147,7 @@ echo "Generating node keys for ${#VMIDS_TO_FIX[@]} VMIDs (missing from list): ${
 echo ""

 for vmid in "${VMIDS_TO_FIX[@]}"; do
-  host="${HOST_BY_VMID[$vmid]:-}"
+  host="$(get_host_for_vmid "$vmid")"
  ip="${IP_BY_VMID[$vmid]:-}"
  [[ -z "$host" ]] && echo "  $vmid: no host" && continue
  if $DRY_RUN; then
@@ -125,5 +184,9 @@ done
 echo ""
 if $RUN_COLLECT && ! $DRY_RUN; then
  echo "Running collect-enodes-from-all-besu-nodes.sh --missing-only..."
-  bash "${SCRIPT_DIR}/collect-enodes-from-all-besu-nodes.sh" --missing-only
+  collect_args=(--apply --missing-only)
+  for vmid in "${TARGET_VMIDS[@]}"; do
+    collect_args+=(--vmid "$vmid")
+  done
+  bash "${SCRIPT_DIR}/collect-enodes-from-all-besu-nodes.sh" "${collect_args[@]}"
 fi
--- a/scripts/besu/install-besu-permanent-on-missing-nodes.sh
+++ b/scripts/besu/install-besu-permanent-on-missing-nodes.sh
@@ -1,17 +1,58 @@
 #!/usr/bin/env bash
-# Install Besu permanently on nodes that don't have /opt/besu/bin/besu (1505-1508, 2420-2480).
+# Install Besu permanently on selected nodes that don't have /opt/besu/bin/besu (1505-1508, 2420-2480).
 # Uses install-besu-in-ct-standalone.sh inside each CT; deploys config, genesis, node lists; enables and starts service.
 #
-# Usage: bash scripts/besu/install-besu-permanent-on-missing-nodes.sh [--dry-run]
+# Usage:
+#   bash scripts/besu/install-besu-permanent-on-missing-nodes.sh
+#   bash scripts/besu/install-besu-permanent-on-missing-nodes.sh --vmid 1505
+#   bash scripts/besu/install-besu-permanent-on-missing-nodes.sh --apply --vmid 1505

 set -euo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-source "${PROJECT_ROOT}/config/ip-addresses.conf" 2>/dev/null || true
+source "${PROJECT_ROOT}/scripts/lib/load-project-env.sh"

-DRY_RUN=false
-[[ "${1:-}" == "--dry-run" ]] && DRY_RUN=true
+DRY_RUN=true
+TARGET_VMIDS=()
+
+usage() {
+  cat <<'EOF'
+Usage: bash scripts/besu/install-besu-permanent-on-missing-nodes.sh [--apply] [--dry-run] [--vmid <N>]
+
+Options:
+  --dry-run     Print intended actions only (default)
+  --apply       Install Besu on selected nodes
+  --vmid <N>    Limit to one VMID; repeatable
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --dry-run)
+      DRY_RUN=true
+      shift
+      ;;
+    --apply)
+      DRY_RUN=false
+      shift
+      ;;
+    --vmid)
+      [[ $# -ge 2 ]] || { usage >&2; exit 2; }
+      TARGET_VMIDS+=("$2")
+      shift 2
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      usage >&2
+      exit 2
+      ;;
+  esac
+done

 SSH_OPTS="-o ConnectTimeout=15 -o StrictHostKeyChecking=accept-new"
 BESU_VERSION="${BESU_VERSION:-23.10.3}"
@@ -22,9 +63,6 @@ PERMS_SRC="${PROJECT_ROOT}/config/besu-node-lists/permissions-nodes.toml"
 # VMIDs that may lack Besu (sentries 1505-1508 on ml110; edge RPC 2420-2480 on r630-01)
 SENTRY_VMIDS=(1505 1506 1507 1508)
 RPC_VMIDS=(2420 2430 2440 2460 2470 2480)
-declare -A HOST_BY_VMID
-for v in 1505 1506 1507 1508; do HOST_BY_VMID[$v]="${PROXMOX_ML110:-192.168.11.10}"; done
-for v in 2420 2430 2440 2460 2470 2480; do HOST_BY_VMID[$v]="${PROXMOX_R630_01:-192.168.11.11}"; done
 declare -A IP_BY_VMID
 IP_BY_VMID[1505]=192.168.11.213
 IP_BY_VMID[1506]=192.168.11.214
@@ -41,8 +79,20 @@ IP_BY_VMID[2480]=192.168.11.248
 [[ ! -f "$STATIC_SRC" ]] && { echo "ERROR: $STATIC_SRC not found"; exit 1; }
 [[ ! -f "$PERMS_SRC" ]] && { echo "ERROR: $PERMS_SRC not found"; exit 1; }

+selected_vmid() {
+  local vmid="$1"
+  [[ ${#TARGET_VMIDS[@]} -eq 0 ]] && return 0
+  local wanted
+  for wanted in "${TARGET_VMIDS[@]}"; do
+    [[ "$vmid" == "$wanted" ]] && return 0
+  done
+  return 1
+}
+
 install_sentry() {
-  local vmid=$1 host=${HOST_BY_VMID[$vmid]} ip=${IP_BY_VMID[$vmid]}
+  local vmid=$1 host ip
+  host="$(get_host_for_vmid "$vmid")"
+  ip=${IP_BY_VMID[$vmid]}
  echo "--- VMID $vmid (sentry @ $ip) ---"
  if $DRY_RUN; then echo "  [dry-run] would install Besu sentry"; return 0; fi
  ssh $SSH_OPTS "root@$host" "pct exec $vmid -- rm -rf /opt/besu 2>/dev/null; true"
@@ -61,7 +111,9 @@ install_sentry() {
 }

 install_rpc() {
-  local vmid=$1 host=${HOST_BY_VMID[$vmid]} ip=${IP_BY_VMID[$vmid]}
+  local vmid=$1 host ip
+  host="$(get_host_for_vmid "$vmid")"
+  ip=${IP_BY_VMID[$vmid]}
  echo "--- VMID $vmid (RPC @ $ip) ---"
  if $DRY_RUN; then echo "  [dry-run] would install Besu RPC"; return 0; fi
  if ! ssh $SSH_OPTS "root@$host" "pct exec $vmid -- bash -c 'touch /tmp/.w && rm -f /tmp/.w'" 2>/dev/null; then
@@ -138,7 +190,8 @@ echo "Installing Besu permanently on nodes missing /opt/besu/bin/besu (1505-1508
 echo ""

 for vmid in "${SENTRY_VMIDS[@]}"; do
-  host="${HOST_BY_VMID[$vmid]:-}"
+  selected_vmid "$vmid" || continue
+  host="$(get_host_for_vmid "$vmid")"
  has_besu=$(ssh $SSH_OPTS "root@$host" "pct exec $vmid -- test -x /opt/besu/bin/besu 2>/dev/null" && echo yes || echo no)
  if [[ "$has_besu" == yes ]]; then
    echo "VMID $vmid: Besu already present (skip)"
@@ -148,7 +201,8 @@ for vmid in "${SENTRY_VMIDS[@]}"; do
 done

 for vmid in "${RPC_VMIDS[@]}"; do
-  host="${HOST_BY_VMID[$vmid]:-}"
+  selected_vmid "$vmid" || continue
+  host="$(get_host_for_vmid "$vmid")"
  has_besu=$(ssh $SSH_OPTS "root@$host" "pct exec $vmid -- test -x /opt/besu/bin/besu 2>/dev/null" && echo yes || echo no)
  if [[ "$has_besu" == yes ]]; then
    echo "VMID $vmid: Besu already present (skip)"
@@ -158,6 +212,6 @@ for vmid in "${RPC_VMIDS[@]}"; do
 done

 echo ""
-echo "Done. Verify: bash scripts/besu/restart-besu-reload-node-lists.sh (optional); then check block production on RPCs."
+echo "Done. Verify: bash scripts/besu/restart-besu-reload-node-lists.sh --apply [--vmid <N>] (optional); then check block production on RPCs."
 rm -f /tmp/config-sentry.toml /tmp/besu.service /tmp/config.toml 2>/dev/null || true
 for v in 2420 2430 2440 2460 2470 2480; do rm -f /tmp/config-rpc-${v}.toml 2>/dev/null; done
--- a/scripts/besu/match-enodes-to-rpcs.sh
+++ b/scripts/besu/match-enodes-to-rpcs.sh
@@ -1,21 +1,16 @@
 #!/usr/bin/env bash
+# Match enodes from the current static-nodes allowlist to live RPC nodes.
+#
+# Usage:
+#   bash scripts/besu/match-enodes-to-rpcs.sh
+#   bash scripts/besu/match-enodes-to-rpcs.sh --vmid 2301
+
 set -euo pipefail

-# Load IP configuration
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-source "${PROJECT_ROOT}/config/ip-addresses.conf" 2>/dev/null || true
-
-
-
-# Match Enodes from Allowlist to RPC Nodes
-
-set -e
-
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+source "${PROJECT_ROOT}/scripts/lib/load-project-env.sh"

-# Colors
 RED='\033[0;31m'
 GREEN='\033[0;32m'
 YELLOW='\033[1;33m'
@@ -24,87 +19,128 @@ CYAN='\033[0;36m'
 NC='\033[0m'

 log_info() { echo -e "${BLUE}[INFO]${NC} $1"; }
-log_success() { echo -e "${GREEN}[✓]${NC} $1"; }
 log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
-log_error() { echo -e "${RED}[ERROR]${NC} $1"; }
 log_section() { echo -e "\n${CYAN}=== $1 ===${NC}"; }

-# RPC node mapping (VMID:IP:Hostname)
+TARGET_VMIDS=()
+
+usage() {
+  cat <<'EOF'
+Usage: bash scripts/besu/match-enodes-to-rpcs.sh [--vmid <N>]
+
+Options:
+  --vmid <N>   Limit to one VMID; repeatable
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --vmid)
+      [[ $# -ge 2 ]] || { usage >&2; exit 2; }
+      TARGET_VMIDS+=("$2")
+      shift 2
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      usage >&2
+      exit 2
+      ;;
+  esac
+done
+
+selected_vmid() {
+  local vmid="$1"
+  [[ ${#TARGET_VMIDS[@]} -eq 0 ]] && return 0
+  local wanted
+  for wanted in "${TARGET_VMIDS[@]}"; do
+    [[ "$vmid" == "$wanted" ]] && return 0
+  done
+  return 1
+}
+
 declare -A RPC_NODES=(
-    ["2101"]="${RPC_CORE_1:-${IP_SERVICE_21:-${IP_SERVICE_21:-${IP_SERVICE_21:-${IP_SERVICE_21:-${IP_SERVICE_21:-192.168.11.21}}}}}1}:besu-rpc-core-1"
-    ["2201"]="${RPC_PUBLIC_1:-${RPC_PUBLIC_1:-192.168.11.221}}:besu-rpc-public-1"
-    ["2301"]="${RPC_PRIVATE_1:-${RPC_PRIVATE_1:-192.168.11.232}}:besu-rpc-private-1"
-    ["2303"]="${RPC_NODE_233:-${RPC_NODE_233:-${RPC_NODE_233:-${RPC_NODE_233:-${RPC_NODE_233:-${RPC_NODE_233:-${RPC_NODE_233:-192.168.11.233}}}}}}}:besu-rpc-ali-0x8a"
-    ["2304"]="${RPC_NODE_234:-${RPC_NODE_234:-${RPC_NODE_234:-${RPC_NODE_234:-${RPC_NODE_234:-${RPC_NODE_234:-${RPC_NODE_234:-192.168.11.234}}}}}}}:besu-rpc-ali-0x1"
-    ["2305"]="${RPC_NODE_235:-${RPC_NODE_235:-${RPC_NODE_235:-${RPC_NODE_235:-${RPC_NODE_235:-${RPC_NODE_235:-${RPC_NODE_235:-192.168.11.235}}}}}}}:besu-rpc-luis-0x8a"
-    ["2306"]="${RPC_NODE_236:-${RPC_NODE_236:-${RPC_NODE_236:-${RPC_NODE_236:-${RPC_NODE_236:-${RPC_NODE_236:-${RPC_NODE_236:-192.168.11.236}}}}}}}:besu-rpc-luis-0x1"
-    ["2307"]="${IP_RPC_237:-${IP_RPC_237:-${IP_RPC_237:-192.168.11.237}}}:besu-rpc-putu-0x8a"
-    ["2308"]="${IP_RPC_238:-${IP_RPC_238:-${IP_RPC_238:-192.168.11.238}}}:besu-rpc-putu-0x1"
-    ["2400"]="${RPC_THIRDWEB_PRIMARY:-${RPC_THIRDWEB_PRIMARY:-192.168.11.240}}:thirdweb-rpc-1"
-    ["2401"]="${RPC_THIRDWEB_1:-${RPC_THIRDWEB_1:-${RPC_THIRDWEB_1:-${RPC_THIRDWEB_1:-${RPC_THIRDWEB_1:-${RPC_THIRDWEB_1:-${RPC_THIRDWEB_1:-192.168.11.241}}}}}}}:besu-rpc-thirdweb-0x8a-1"
-    ["2402"]="${RPC_THIRDWEB_2:-${RPC_THIRDWEB_2:-${RPC_THIRDWEB_2:-${RPC_THIRDWEB_2:-${RPC_THIRDWEB_2:-${RPC_THIRDWEB_2:-${RPC_THIRDWEB_2:-192.168.11.242}}}}}}}:besu-rpc-thirdweb-0x8a-2"
-    ["2403"]="${RPC_THIRDWEB_3:-${RPC_THIRDWEB_3:-${RPC_THIRDWEB_3:-192.168.11.243}}}:besu-rpc-thirdweb-0x8a-3"
+  ["2101"]="${RPC_CORE_1:-192.168.11.211}:besu-rpc-core-1"
+  ["2102"]="${RPC_CORE_2:-192.168.11.212}:besu-rpc-core-2"
+  ["2103"]="${RPC_THIRDWEB_ADMIN_CORE:-192.168.11.217}:besu-rpc-core-thirdweb"
+  ["2201"]="${RPC_PUBLIC_1:-192.168.11.221}:besu-rpc-public-1"
+  ["2301"]="${RPC_PRIVATE_1:-192.168.11.232}:besu-rpc-private-1"
+  ["2303"]="192.168.11.233:besu-rpc-ali-0x8a"
+  ["2304"]="192.168.11.234:besu-rpc-ali-0x1"
+  ["2305"]="192.168.11.235:besu-rpc-luis-0x8a"
+  ["2306"]="192.168.11.236:besu-rpc-luis-0x1"
+  ["2307"]="192.168.11.237:besu-rpc-putu-0x8a"
+  ["2308"]="192.168.11.238:besu-rpc-putu-0x1"
+  ["2400"]="192.168.11.240:thirdweb-rpc-1"
+  ["2401"]="192.168.11.241:besu-rpc-thirdweb-0x8a-1"
+  ["2402"]="192.168.11.242:besu-rpc-thirdweb-0x8a-2"
+  ["2403"]="192.168.11.243:besu-rpc-thirdweb-0x8a-3"
+  ["2420"]="192.168.11.172:besu-rpc-alltra-1"
+  ["2430"]="192.168.11.173:besu-rpc-alltra-2"
+  ["2440"]="192.168.11.174:besu-rpc-alltra-3"
+  ["2460"]="192.168.11.246:besu-rpc-hybx-1"
+  ["2470"]="192.168.11.247:besu-rpc-hybx-2"
+  ["2480"]="192.168.11.248:besu-rpc-hybx-3"
 )

-# Enodes from allowlist (extract IPs)
-declare -A ALLOWLIST_ENODES=(
-    ["${RPC_CORE_1:-${IP_SERVICE_21:-${IP_SERVICE_21:-${IP_SERVICE_21:-${IP_SERVICE_21:-${IP_SERVICE_21:-192.168.11.21}}}}}1}"]="enode://6cdc892fa09afa2b05c21cc9a1193a86cf0d195ce81b02a270d8bb987f78ca98ad90d907670796c90fc6e4eaf3b4cae6c0c15871e2564de063beceb4bbfc6532@${RPC_CORE_1:-${IP_SERVICE_21:-${IP_SERVICE_21:-${IP_SERVICE_21:-${IP_SERVICE_21:-${IP_SERVICE_21:-192.168.11.21}}}}}1}:30303"
-    ["${RPC_PUBLIC_1:-${RPC_PUBLIC_1:-192.168.11.221}}"]="enode://07daf3d64079faa3982bc8be7aa86c24ef21eca4565aae4a7fd963c55c728de0639d80663834634edf113b9f047d690232ae23423c64979961db4b6449aa6dfd@${RPC_PUBLIC_1:-${RPC_PUBLIC_1:-192.168.11.221}}:30303"
-    ["${RPC_PRIVATE_1:-${RPC_PRIVATE_1:-192.168.11.232}}"]="enode://83eb8c172034afd72846740921f748c77780c3cc0cea45604348ba859bc3a47187e24e5fad7f74e5fe353e86fd35ab7c37f02cfbb8299a850a190b40968bd8e2@${RPC_PRIVATE_1:-${RPC_PRIVATE_1:-192.168.11.232}}:30303"
-    ["${RPC_NODE_233:-${RPC_NODE_233:-${RPC_NODE_233:-${RPC_NODE_233:-${RPC_NODE_233:-${RPC_NODE_233:-${RPC_NODE_233:-192.168.11.233}}}}}}}"]="enode://688f271d94c7995600ae36d25aa2fb92fea0c52e50e86c598be8966515458c1408b67fba76e1f771073e4774a6e399588443da63394ea25d56e6ca36f2288e00@${RPC_NODE_233:-${RPC_NODE_233:-${RPC_NODE_233:-${RPC_NODE_233:-${RPC_NODE_233:-${RPC_NODE_233:-${RPC_NODE_233:-192.168.11.233}}}}}}}:30303"
-    ["${RPC_NODE_234:-${RPC_NODE_234:-${RPC_NODE_234:-${RPC_NODE_234:-${RPC_NODE_234:-${RPC_NODE_234:-${RPC_NODE_234:-192.168.11.234}}}}}}}"]="enode://4dc4b9f8cffbc53349f6535ab9aa7785cbc0ae92928dcf4ef6f90638ace9fc69ff7d19c49a8bda54f78a000579c557ef25fce3c971c6ab0026b6e70c8e6e5cac@${RPC_NODE_234:-${RPC_NODE_234:-${RPC_NODE_234:-${RPC_NODE_234:-${RPC_NODE_234:-${RPC_NODE_234:-${RPC_NODE_234:-192.168.11.234}}}}}}}:30303"
-    ["${RPC_NODE_235:-${RPC_NODE_235:-${RPC_NODE_235:-${RPC_NODE_235:-${RPC_NODE_235:-${RPC_NODE_235:-${RPC_NODE_235:-192.168.11.235}}}}}}}"]="enode://2de9fc2be46c2cedce182af65ac1f5fc5ed258d21cdf0ac2687a16618382159dae1f730650e6730cf7fc5dccb6b97bffd20e271e3eb4df5a69f38a8c4cba91b5@${RPC_NODE_235:-${RPC_NODE_235:-${RPC_NODE_235:-${RPC_NODE_235:-${RPC_NODE_235:-${RPC_NODE_235:-${RPC_NODE_235:-192.168.11.235}}}}}}}:30303"
-    ["${RPC_NODE_236:-${RPC_NODE_236:-${RPC_NODE_236:-${RPC_NODE_236:-${RPC_NODE_236:-${RPC_NODE_236:-${RPC_NODE_236:-192.168.11.236}}}}}}}"]="enode://38bd43b934feaaccb978917c66b0abbf9b62e39bce6064a6d3ec557f61e13b75e293cbb2ab382278adda5ce51f451528c7c37d991255a0c31e9578b85fc1dd5a@${RPC_NODE_236:-${RPC_NODE_236:-${RPC_NODE_236:-${RPC_NODE_236:-${RPC_NODE_236:-${RPC_NODE_236:-${RPC_NODE_236:-192.168.11.236}}}}}}}:30303"
-    ["${IP_RPC_237:-${IP_RPC_237:-${IP_RPC_237:-192.168.11.237}}}"]="enode://f7edb80de20089cb0b3a28b03e0491fafa1c9eb9a0344dadf343757ee2a44b577a861514fd7747a86f631c9e34519aef25a5f8996f20bc8dd460cd2bdc1bd490@${IP_RPC_237:-${IP_RPC_237:-${IP_RPC_237:-192.168.11.237}}}:30303"
-    ["${IP_RPC_238:-${IP_RPC_238:-${IP_RPC_238:-192.168.11.238}}}"]="enode://4e2d4e94909813b7145e0e9cd7e56724f64ba91dd7dca0e70bd70742f930450cf57311f2c220cfe24a20e9f668a8e170755d626f84660aa1fbea85f75557eb8d@${IP_RPC_238:-${IP_RPC_238:-${IP_RPC_238:-192.168.11.238}}}:30303"
-    ["${RPC_THIRDWEB_1:-${RPC_THIRDWEB_1:-${RPC_THIRDWEB_1:-${RPC_THIRDWEB_1:-${RPC_THIRDWEB_1:-${RPC_THIRDWEB_1:-${RPC_THIRDWEB_1:-192.168.11.241}}}}}}}"]="enode://38e138ea5a4b0b244e4484b5c327631b5d3c849dcb188ff3d9ff0a8b6ad7edb738303a1a948888c269aa7555e5ff47d75b7b63dbd579d05580b5442b3fa0ebfc@${RPC_THIRDWEB_1:-${RPC_THIRDWEB_1:-${RPC_THIRDWEB_1:-${RPC_THIRDWEB_1:-${RPC_THIRDWEB_1:-${RPC_THIRDWEB_1:-${RPC_THIRDWEB_1:-192.168.11.241}}}}}}}:30303"
-)
-
-log_section "Matching Enodes to RPC Nodes"
+ALLOWLIST_FILE="${PROJECT_ROOT}/config/besu-node-lists/static-nodes.json"
+declare -A ALLOWLIST_ENODES
+if [[ -f "$ALLOWLIST_FILE" ]]; then
+  while IFS= read -r enode; do
+    [[ -z "$enode" ]] && continue
+    ip=$(echo "$enode" | sed -n 's|enode://[a-fA-F0-9]*@\([0-9.]*\):.*|\1|p')
+    [[ -n "$ip" ]] && ALLOWLIST_ENODES["$ip"]="$enode"
+  done < <(jq -r '.[]' "$ALLOWLIST_FILE" 2>/dev/null)
+fi

+log_section "Matching Enodes To RPC Nodes"
 echo ""
-printf "%-8s %-18s %-40s %-20s\n" "VMID" "IP Address" "Hostname" "Status"
-echo "────────────────────────────────────────────────────────────────────────────────────────────────────"
+printf "%-8s %-18s %-36s %-12s\n" "VMID" "IP Address" "Hostname" "Status"
+echo "--------------------------------------------------------------------------------"

 MATCHED=0
 MISSING=0

-for vmid in "${!RPC_NODES[@]}"; do
-    IFS=':' read -r ip hostname <<< "${RPC_NODES[$vmid]}"
-    
-    if [ -n "${ALLOWLIST_ENODES[$ip]}" ]; then
-        printf "%-8s %-18s %-40s %-20s\n" "$vmid" "$ip" "$hostname" "✅ MATCHED"
-        ((MATCHED++))
-    else
-        printf "%-8s %-18s %-40s %-20s\n" "$vmid" "$ip" "$hostname" "❌ MISSING"
-        ((MISSING++))
-    fi
+for vmid in $(printf "%s\n" "${!RPC_NODES[@]}" | sort -n); do
+  selected_vmid "$vmid" || continue
+  IFS=':' read -r ip hostname <<< "${RPC_NODES[$vmid]}"
+  if [[ -n "${ALLOWLIST_ENODES[$ip]:-}" ]]; then
+    printf "%-8s %-18s %-36s %-12s\n" "$vmid" "$ip" "$hostname" "MATCHED"
+    ((MATCHED++)) || true
+  else
+    printf "%-8s %-18s %-36s %-12s\n" "$vmid" "$ip" "$hostname" "MISSING"
+    ((MISSING++)) || true
+  fi
 done

+total=$((MATCHED + MISSING))
 echo ""
 log_section "Summary"
+log_info "Matched: $MATCHED/$total RPC nodes"
+log_info "Missing: $MISSING/$total RPC nodes"

-log_info "Matched: $MATCHED/13 RPC nodes"
-log_info "Missing: $MISSING/13 RPC nodes"
-
-if [ $MISSING -gt 0 ]; then
-    log_warn "Missing enodes:"
-    for vmid in "${!RPC_NODES[@]}"; do
-        IFS=':' read -r ip hostname <<< "${RPC_NODES[$vmid]}"
-        if [ -z "${ALLOWLIST_ENODES[$ip]}" ]; then
-            log_warn "  • $vmid ($ip) - $hostname"
-        fi
-    done
+if [[ "$MISSING" -gt 0 ]]; then
+  echo ""
+  log_warn "Missing enodes:"
+  for vmid in $(printf "%s\n" "${!RPC_NODES[@]}" | sort -n); do
+    selected_vmid "$vmid" || continue
+    IFS=':' read -r ip hostname <<< "${RPC_NODES[$vmid]}"
+    [[ -n "${ALLOWLIST_ENODES[$ip]:-}" ]] && continue
+    log_warn "  $vmid ($ip) - $hostname"
+  done
 fi

 echo ""
-log_section "Complete Enode Mapping"
-
-for vmid in "${!RPC_NODES[@]}"; do
-    IFS=':' read -r ip hostname <<< "${RPC_NODES[$vmid]}"
-    if [ -n "${ALLOWLIST_ENODES[$ip]}" ]; then
-        echo "VMID $vmid ($hostname) - $ip:"
-        echo "  ${ALLOWLIST_ENODES[$ip]}"
-        echo ""
-    fi
+log_section "Matched Enodes"
+for vmid in $(printf "%s\n" "${!RPC_NODES[@]}" | sort -n); do
+  selected_vmid "$vmid" || continue
+  IFS=':' read -r ip hostname <<< "${RPC_NODES[$vmid]}"
+  enode="${ALLOWLIST_ENODES[$ip]:-}"
+  [[ -z "$enode" ]] && continue
+  echo "VMID $vmid ($hostname) - $ip:"
+  echo "  $enode"
+  echo ""
 done
--- a/scripts/check-besu-version-all-nodes.sh
+++ b/scripts/check-besu-version-all-nodes.sh
@@ -1,27 +1,56 @@
 #!/usr/bin/env bash
-# Confirm Besu version >= 24.1.0 on all nodes (required for EIP-7702 / Cancun)
-# Usage: PROXMOX_HOST=${PROXMOX_HOST_ML110:-192.168.11.10} ./scripts/check-besu-version-all-nodes.sh
+# Confirm Besu version >= 24.1.0 on selected nodes (required for EIP-7702 / Cancun)
+# Usage:
+#   bash scripts/check-besu-version-all-nodes.sh
+#   bash scripts/check-besu-version-all-nodes.sh --vmid 2301

 set -euo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-
-# Optional: load IP config for PROXMOX_HOST_ML110 etc.
-if [ -f "$PROJECT_ROOT/config/ip-addresses.conf" ]; then
-    # shellcheck source=../config/ip-addresses.conf
-    source "$PROJECT_ROOT/config/ip-addresses.conf"
-fi
-
-PROXMOX_HOST="${PROXMOX_HOST:-${PROXMOX_HOST_ML110:-192.168.11.10}}"
+source "${PROJECT_ROOT}/scripts/lib/load-project-env.sh"
 MIN_VERSION="24.1.0"
+TARGET_VMIDS=()

-# All known Besu node VMIDs (validators, sentries, RPC). Override with BESU_VMIDS="2101 2400 2401 2402" for quick check.
-if [ -n "${BESU_VMIDS:-}" ]; then
-    read -ra BESU_VMIDS <<< "$BESU_VMIDS"
-else
-    BESU_VMIDS=(1000 1001 1002 1003 1004 1500 1501 1502 1503 2101 2201 2301 2303 2304 2305 2306 2307 2308 2400 2401 2402 2403)
-fi
+usage() {
+    cat <<'EOF'
+Usage: bash scripts/check-besu-version-all-nodes.sh [--vmid <N>]
+
+Options:
+  --vmid <N>   Limit to one VMID; repeatable
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --vmid)
+            [[ $# -ge 2 ]] || { usage >&2; exit 2; }
+            TARGET_VMIDS+=("$2")
+            shift 2
+            ;;
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        *)
+            echo "Unknown argument: $1" >&2
+            usage >&2
+            exit 2
+            ;;
+    esac
+done
+
+BESU_VMIDS=(1000 1001 1002 1003 1004 1500 1501 1502 1503 1504 1505 1506 1507 1508 1509 1510 2101 2102 2103 2201 2301 2303 2304 2305 2306 2307 2308 2400 2401 2402 2403 2420 2430 2440 2460 2470 2480)
+
+selected_vmid() {
+    local vmid="$1"
+    [[ ${#TARGET_VMIDS[@]} -eq 0 ]] && return 0
+    local wanted
+    for wanted in "${TARGET_VMIDS[@]}"; do
+        [[ "$vmid" == "$wanted" ]] && return 0
+    done
+    return 1
+}

 RED='\033[0;31m'
 GREEN='\033[0;32m'
@@ -85,7 +114,7 @@ is_running() {
 }

 echo ""
-log_info "Besu version check (>= ${MIN_VERSION}) on Proxmox host: $PROXMOX_HOST"
+log_info "Besu version check (>= ${MIN_VERSION}) on selected nodes"
 log_info "EIP-7702 / Cancun requires Besu >= 24.1.0"
 echo ""

@@ -96,13 +125,15 @@ declare -a FAILED_VMIDS
 declare -a FAILED_VERSIONS

 for vmid in "${BESU_VMIDS[@]}"; do
-    if ! is_running "$vmid" "$PROXMOX_HOST"; then
+    selected_vmid "$vmid" || continue
+    host="$(get_host_for_vmid "$vmid")"
+    if ! is_running "$vmid" "$host"; then
        printf "  VMID %-5s  %-12s  %s\n" "$vmid" "—" "(container not running)"
        ((SKIP++)) || true
        continue
    fi

-    version=$(get_besu_version "$vmid" "$PROXMOX_HOST")
+    version=$(get_besu_version "$vmid" "$host")

    if [ -z "$version" ]; then
        printf "  VMID %-5s  %-12s  " "$vmid" "—"
--- a/scripts/clear-blockchain-database.sh
+++ b/scripts/clear-blockchain-database.sh
@@ -1,10 +1,16 @@
 #!/usr/bin/env bash
-# Clear entire Besu blockchain database (NUCLEAR OPTION)
-# This will require full re-sync from genesis
-# Usage: ./clear-blockchain-database.sh
+# Clear selected Besu blockchain databases (NUCLEAR OPTION)
+# This will require full re-sync from genesis.
+# Usage:
+#   ./clear-blockchain-database.sh --vmid 2101
+#   ./clear-blockchain-database.sh --apply --vmid 2101

 set -euo pipefail

+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+source "${PROJECT_ROOT}/scripts/lib/load-project-env.sh"
+
 # Colors
 RED='\033[0;31m'
 GREEN='\033[0;32m'
@@ -23,6 +29,44 @@ if ! command -v pct &>/dev/null; then
    exit 1
 fi

+APPLY=false
+TARGET_VMIDS=()
+
+usage() {
+    cat <<'EOF'
+Usage: ./clear-blockchain-database.sh --vmid <N> [--vmid <N> ...] [--apply]
+
+Options:
+  --vmid <N>   Required. Limit destructive action to one or more VMIDs.
+  --apply      Perform deletion. Without this flag, the script prints the target VMIDs and exits.
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --vmid)
+            [[ $# -ge 2 ]] || { usage >&2; exit 2; }
+            TARGET_VMIDS+=("$2")
+            shift 2
+            ;;
+        --apply)
+            APPLY=true
+            shift
+            ;;
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        *)
+            echo "Unknown argument: $1" >&2
+            usage >&2
+            exit 2
+            ;;
+    esac
+done
+
+[[ ${#TARGET_VMIDS[@]} -gt 0 ]] || { log_error "At least one --vmid is required for this destructive script."; usage >&2; exit 2; }
+
 echo "========================================="
 echo "Clear Entire Blockchain Database"
 echo "========================================="
@@ -38,35 +82,39 @@ log_error "  5. Take SIGNIFICANT TIME to re-sync"
 echo ""
 log_warn "This is a NUCLEAR OPTION - use only if absolutely necessary"
 echo ""
+declare -A SERVICE_BY_VMID
+for vmid in 1000 1001 1002 1003 1004; do SERVICE_BY_VMID[$vmid]="besu-validator.service"; done
+for vmid in 1500 1501 1502 1503 1504 1505 1506 1507 1508 1509 1510; do SERVICE_BY_VMID[$vmid]="besu-sentry.service"; done
+for vmid in 2101 2102 2103 2201 2301 2303 2304 2305 2306 2307 2308 2400 2401 2402 2403 2420 2430 2440 2460 2470 2480; do SERVICE_BY_VMID[$vmid]="besu-rpc.service"; done
+
+if ! $APPLY; then
+    log_warn "Dry-run only. Target VMIDs:"
+    for vmid in "${TARGET_VMIDS[@]}"; do
+        log_info "  VMID $vmid (host $(get_host_for_vmid "$vmid")) service ${SERVICE_BY_VMID[$vmid]:-unknown}"
+    done
+    log_info "Re-run with --apply to proceed."
+    exit 0
+fi
+
 read -p "Type 'DELETE DATABASE' to confirm: " CONFIRM
 if [ "$CONFIRM" != "DELETE DATABASE" ]; then
    log_info "Aborted"
    exit 0
 fi

-# All Besu nodes
-VALIDATORS=(1000 1001 1002 1003 1004)
-RPC_NODES=(2500 2501 2502)
-
-log_info "Stopping all Besu nodes..."
-for vmid in "${VALIDATORS[@]}"; do
+log_info "Stopping selected Besu nodes..."
+for vmid in "${TARGET_VMIDS[@]}"; do
+    service="${SERVICE_BY_VMID[$vmid]:-besu.service}"
    if pct status "$vmid" 2>/dev/null | grep -q "running"; then
-        log_info "Stopping VMID $vmid (validator)..."
-        pct exec "$vmid" -- systemctl stop besu-validator.service 2>/dev/null || true
-    fi
-done
-
-for vmid in "${RPC_NODES[@]}"; do
-    if pct status "$vmid" 2>/dev/null | grep -q "running"; then
-        log_info "Stopping VMID $vmid (RPC)..."
-        pct exec "$vmid" -- systemctl stop besu-rpc.service 2>/dev/null || true
+        log_info "Stopping VMID $vmid ($service)..."
+        pct exec "$vmid" -- systemctl stop "$service" 2>/dev/null || pct exec "$vmid" -- systemctl stop besu.service 2>/dev/null || true
    fi
 done

 sleep 5

-log_info "Clearing entire blockchain databases..."
-for vmid in "${VALIDATORS[@]}" "${RPC_NODES[@]}"; do
+log_info "Clearing selected blockchain databases..."
+for vmid in "${TARGET_VMIDS[@]}"; do
    if pct status "$vmid" 2>/dev/null | grep -q "running"; then
        log_info "Clearing VMID $vmid..."
        
@@ -84,18 +132,12 @@ for vmid in "${VALIDATORS[@]}" "${RPC_NODES[@]}"; do
    fi
 done

-log_info "Starting all Besu nodes..."
-for vmid in "${VALIDATORS[@]}"; do
+log_info "Starting selected Besu nodes..."
+for vmid in "${TARGET_VMIDS[@]}"; do
+    service="${SERVICE_BY_VMID[$vmid]:-besu.service}"
    if pct status "$vmid" 2>/dev/null | grep -q "running"; then
-        log_info "Starting VMID $vmid (validator)..."
-        pct exec "$vmid" -- systemctl start besu-validator.service 2>/dev/null || true
-    fi
-done
-
-for vmid in "${RPC_NODES[@]}"; do
-    if pct status "$vmid" 2>/dev/null | grep -q "running"; then
-        log_info "Starting VMID $vmid (RPC)..."
-        pct exec "$vmid" -- systemctl start besu-rpc.service 2>/dev/null || true
+        log_info "Starting VMID $vmid ($service)..."
+        pct exec "$vmid" -- systemctl start "$service" 2>/dev/null || pct exec "$vmid" -- systemctl start besu.service 2>/dev/null || true
    fi
 done

@@ -113,4 +155,3 @@ log_info "Next steps:"
 log_info "  1. Wait for nodes to re-sync (monitor block numbers)"
 log_info "  2. Once synced, run: ./scripts/configure-ethereum-mainnet-final.sh"
 log_info ""
-
--- a/scripts/collect-all-enodes.sh
+++ b/scripts/collect-all-enodes.sh
@@ -3,14 +3,101 @@

 set -euo pipefail

-# Load IP configuration
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-source "${PROJECT_ROOT}/config/ip-addresses.conf" 2>/dev/null || true
+source "${PROJECT_ROOT}/scripts/lib/load-project-env.sh"

+declare -A NODE_IPS=(
+    [1505]="192.168.11.213"
+    [1506]="192.168.11.214"
+    [1507]="192.168.11.244"
+    [1508]="192.168.11.245"
+    [1509]="192.168.11.219"
+    [1510]="192.168.11.220"
+    [2101]="${RPC_CORE_1:-192.168.11.211}"
+    [2102]="192.168.11.212"
+    [2103]="192.168.11.217"
+    [2201]="${RPC_PUBLIC_1:-192.168.11.221}"
+    [2301]="${RPC_PRIVATE_1:-192.168.11.232}"
+    [2303]="192.168.11.233"
+    [2304]="192.168.11.234"
+    [2305]="192.168.11.235"
+    [2306]="192.168.11.236"
+    [2307]="192.168.11.237"
+    [2308]="192.168.11.238"
+    [2400]="192.168.11.240"
+    [2401]="${RPC_THIRDWEB_1:-192.168.11.241}"
+    [2402]="${RPC_THIRDWEB_2:-192.168.11.242}"
+    [2403]="${RPC_THIRDWEB_3:-192.168.11.243}"
+    [2420]="192.168.11.172"
+    [2430]="192.168.11.173"
+    [2440]="192.168.11.174"
+    [2460]="192.168.11.246"
+    [2470]="192.168.11.247"
+    [2480]="192.168.11.248"
+)

-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+declare -A NODE_NAMES=(
+    [1505]="besu-sentry-alltra-1"
+    [1506]="besu-sentry-alltra-2"
+    [1507]="besu-sentry-hybx-1"
+    [1508]="besu-sentry-hybx-2"
+    [1509]="besu-sentry-thirdweb-1"
+    [1510]="besu-sentry-thirdweb-2"
+    [2101]="besu-rpc-core-1"
+    [2102]="besu-rpc-core-2"
+    [2103]="besu-rpc-admin-core-3"
+    [2201]="besu-rpc-public-1"
+    [2301]="besu-rpc-private-1"
+    [2303]="besu-rpc-private-3"
+    [2304]="besu-rpc-private-4"
+    [2305]="besu-rpc-private-5"
+    [2306]="besu-rpc-private-6"
+    [2307]="besu-rpc-private-7"
+    [2308]="besu-rpc-private-8"
+    [2400]="besu-rpc-thirdweb-primary"
+    [2401]="besu-rpc-thirdweb-1"
+    [2402]="besu-rpc-thirdweb-2"
+    [2403]="besu-rpc-thirdweb-3"
+    [2420]="besu-rpc-alltra-1"
+    [2430]="besu-rpc-alltra-2"
+    [2440]="besu-rpc-alltra-3"
+    [2460]="besu-rpc-hybx-1"
+    [2470]="besu-rpc-hybx-2"
+    [2480]="besu-rpc-hybx-3"
+)
+
+TARGET_VMIDS=()
+
+usage() {
+    cat <<'EOF'
+Usage: ./scripts/collect-all-enodes.sh --vmid <N> [--vmid <N> ...]
+
+Options:
+  --vmid <N>   Required. Collect enodes only for the selected VMIDs.
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --vmid)
+            [[ $# -ge 2 ]] || { usage >&2; exit 2; }
+            TARGET_VMIDS+=("$2")
+            shift 2
+            ;;
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        *)
+            echo "Unknown argument: $1" >&2
+            usage >&2
+            exit 2
+            ;;
+    esac
+done
+
+[[ ${#TARGET_VMIDS[@]} -gt 0 ]] || { usage >&2; exit 2; }

 BLUE='\033[0;34m'
 GREEN='\033[0;32m'
@@ -23,17 +110,20 @@ collect_enode() {
    local vmid=$1
    local ip=$2
    local hostname=$3
+    local host
+    host="$(get_host_for_vmid "$vmid")"
    
    log "Collecting enode from $vmid ($hostname)..."
    
-    local enode=$(pct exec $vmid -- bash -c '
+    local enode
+    enode=$(ssh -o StrictHostKeyChecking=no root@"$host" "pct exec $vmid -- bash -c '
        if [ -f /data/besu/NODE_ID ]; then
            NODE_ID=$(cat /data/besu/NODE_ID)
-            echo "enode://${NODE_ID}@'"$ip"':30303"
+            echo \"enode://${NODE_ID}@'"$ip"':30303\"
        else
-            echo "PENDING"
+            echo PENDING
        fi
-    ' 2>/dev/null || echo "ERROR")
+    '" 2>/dev/null || echo "ERROR")
    
    echo "$vmid|$hostname|$ip|$enode"
 }
@@ -45,19 +135,13 @@ echo ""

 ENODE_DIR=$(mktemp -d)

-log "ALLTRA nodes..."
-collect_enode 1505 "${IP_SERVICE_21:-${IP_SERVICE_21:-${IP_SERVICE_21:-${IP_SERVICE_21:-${IP_SERVICE_21:-192.168.11.21}}}}}3" "besu-sentry-alltra-1" > "$ENODE_DIR/1505.txt" &
-collect_enode 1506 "${IP_SERVICE_21:-${IP_SERVICE_21:-${IP_SERVICE_21:-${IP_SERVICE_21:-${IP_SERVICE_21:-192.168.11.21}}}}}4" "besu-sentry-alltra-2" > "$ENODE_DIR/1506.txt" &
-collect_enode 2500 "${IP_SERVICE_172:-${IP_SERVICE_172:-192.168.11.172}}" "besu-rpc-alltra-1" > "$ENODE_DIR/2500.txt" &
-collect_enode 2501 "${IP_SERVICE_173:-${IP_SERVICE_173:-192.168.11.173}}" "besu-rpc-alltra-2" > "$ENODE_DIR/2501.txt" &
-collect_enode 2502 "${IP_SERVICE_174:-${IP_SERVICE_174:-192.168.11.174}}" "besu-rpc-alltra-3" > "$ENODE_DIR/2502.txt" &
-
-log "HYBX nodes..."
-collect_enode 1507 "${IP_RPC_244:-${IP_RPC_244:-${IP_RPC_244:-192.168.11.244}}}" "besu-sentry-hybx-1" > "$ENODE_DIR/1507.txt" &
-collect_enode 1508 "${IP_RPC_245:-${IP_RPC_245:-${IP_RPC_245:-192.168.11.245}}}" "besu-sentry-hybx-2" > "$ENODE_DIR/1508.txt" &
-collect_enode 2503 "${IP_RPC_246:-${IP_RPC_246:-${IP_RPC_246:-192.168.11.246}}}" "besu-rpc-hybx-1" > "$ENODE_DIR/2503.txt" &
-collect_enode 2504 "${IP_RPC_247:-${IP_RPC_247:-${IP_RPC_247:-192.168.11.247}}}" "besu-rpc-hybx-2" > "$ENODE_DIR/2504.txt" &
-collect_enode 2505 "${IP_RPC_248:-${IP_RPC_248:-${IP_RPC_248:-192.168.11.248}}}" "besu-rpc-hybx-3" > "$ENODE_DIR/2505.txt" &
+for vmid in "${TARGET_VMIDS[@]}"; do
+    if [[ -z "${NODE_IPS[$vmid]:-}" || -z "${NODE_NAMES[$vmid]:-}" ]]; then
+        echo "$vmid|unknown|unknown|UNSUPPORTED_VMID" > "$ENODE_DIR/${vmid}.txt"
+        continue
+    fi
+    collect_enode "$vmid" "${NODE_IPS[$vmid]}" "${NODE_NAMES[$vmid]}" > "$ENODE_DIR/${vmid}.txt" &
+done

 echo ""
 log "Waiting for collections..."
--- a/scripts/collect-enodes-via-rpc.sh
+++ b/scripts/collect-enodes-via-rpc.sh
@@ -4,24 +4,106 @@
 set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-source "$PROJECT_ROOT/config/ip-addresses.conf"
+source "$PROJECT_ROOT/scripts/lib/load-project-env.sh"

-get_host_for_vmid() {
-    local vmid=$1
-    if [[ "$vmid" =~ ^(1505|1506|1507|1508)$ ]]; then
-        echo "${PROXMOX_HOST_ML110}"
-    elif [[ "$vmid" =~ ^(2500|2501|2502|2503|2504|2505)$ ]]; then
-        echo "${PROXMOX_HOST_R630_01}"
-    else
-        echo "${PROXMOX_HOST_R630_01}"
-    fi
+declare -A NODE_IPS=(
+    [1505]="192.168.11.213"
+    [1506]="192.168.11.214"
+    [1507]="192.168.11.244"
+    [1508]="192.168.11.245"
+    [1509]="192.168.11.219"
+    [1510]="192.168.11.220"
+    [2101]="${RPC_CORE_1:-192.168.11.211}"
+    [2102]="192.168.11.212"
+    [2103]="192.168.11.217"
+    [2201]="${RPC_PUBLIC_1:-192.168.11.221}"
+    [2301]="${RPC_PRIVATE_1:-192.168.11.232}"
+    [2303]="192.168.11.233"
+    [2304]="192.168.11.234"
+    [2305]="192.168.11.235"
+    [2306]="192.168.11.236"
+    [2307]="192.168.11.237"
+    [2308]="192.168.11.238"
+    [2400]="192.168.11.240"
+    [2401]="${RPC_THIRDWEB_1:-192.168.11.241}"
+    [2402]="${RPC_THIRDWEB_2:-192.168.11.242}"
+    [2403]="${RPC_THIRDWEB_3:-192.168.11.243}"
+    [2420]="192.168.11.172"
+    [2430]="192.168.11.173"
+    [2440]="192.168.11.174"
+    [2460]="192.168.11.246"
+    [2470]="192.168.11.247"
+    [2480]="192.168.11.248"
+)
+
+declare -A NODE_NAMES=(
+    [1505]="besu-sentry-alltra-1"
+    [1506]="besu-sentry-alltra-2"
+    [1507]="besu-sentry-hybx-1"
+    [1508]="besu-sentry-hybx-2"
+    [1509]="besu-sentry-thirdweb-1"
+    [1510]="besu-sentry-thirdweb-2"
+    [2101]="besu-rpc-core-1"
+    [2102]="besu-rpc-core-2"
+    [2103]="besu-rpc-admin-core-3"
+    [2201]="besu-rpc-public-1"
+    [2301]="besu-rpc-private-1"
+    [2303]="besu-rpc-private-3"
+    [2304]="besu-rpc-private-4"
+    [2305]="besu-rpc-private-5"
+    [2306]="besu-rpc-private-6"
+    [2307]="besu-rpc-private-7"
+    [2308]="besu-rpc-private-8"
+    [2400]="besu-rpc-thirdweb-primary"
+    [2401]="besu-rpc-thirdweb-1"
+    [2402]="besu-rpc-thirdweb-2"
+    [2403]="besu-rpc-thirdweb-3"
+    [2420]="besu-rpc-alltra-1"
+    [2430]="besu-rpc-alltra-2"
+    [2440]="besu-rpc-alltra-3"
+    [2460]="besu-rpc-hybx-1"
+    [2470]="besu-rpc-hybx-2"
+    [2480]="besu-rpc-hybx-3"
+)
+
+TARGET_VMIDS=()
+
+usage() {
+    cat <<'EOF'
+Usage: ./scripts/collect-enodes-via-rpc.sh --vmid <N> [--vmid <N> ...]
+
+Options:
+  --vmid <N>   Required. Collect enodes only for the selected VMIDs.
+EOF
 }

+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --vmid)
+            [[ $# -ge 2 ]] || { usage >&2; exit 2; }
+            TARGET_VMIDS+=("$2")
+            shift 2
+            ;;
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        *)
+            echo "Unknown argument: $1" >&2
+            usage >&2
+            exit 2
+            ;;
+    esac
+done
+
+[[ ${#TARGET_VMIDS[@]} -gt 0 ]] || { usage >&2; exit 2; }
+
 collect_enode() {
    local vmid=$1
    local ip=$2
    local hostname=$3
-    local host=$(get_host_for_vmid $vmid)
+    local host
+    host="$(get_host_for_vmid "$vmid")"
    
    # Try RPC first
    local enode=$(ssh -o StrictHostKeyChecking=no root@${host} "pct exec $vmid -- curl -s -X POST -H 'Content-Type: application/json' --data '{\"jsonrpc\":\"2.0\",\"method\":\"admin_nodeInfo\",\"params\":[],\"id\":1}' http://localhost:8545 2>/dev/null | grep -o '\"enode\":\"[^\"]*\"' | cut -d'\"' -f4" 2>/dev/null)
@@ -42,17 +124,10 @@ collect_enode() {
    echo "$vmid|$hostname|$ip|$enode"
 }

-for vmid in 1505 1506 2500 2501 2502 1507 1508 2503 2504 2505; do
-    case $vmid in
-        1505) collect_enode 1505 "${IP_SERVICE_21:-${IP_SERVICE_21:-${IP_SERVICE_21:-${IP_SERVICE_21:-${IP_SERVICE_21:-192.168.11.21}}}}}3" "besu-sentry-alltra-1" ;;
-        1506) collect_enode 1506 "${IP_SERVICE_21:-${IP_SERVICE_21:-${IP_SERVICE_21:-${IP_SERVICE_21:-${IP_SERVICE_21:-192.168.11.21}}}}}4" "besu-sentry-alltra-2" ;;
-        2500) collect_enode 2500 "${IP_SERVICE_172:-${IP_SERVICE_172:-192.168.11.172}}" "besu-rpc-alltra-1" ;;
-        2501) collect_enode 2501 "${IP_SERVICE_173:-${IP_SERVICE_173:-192.168.11.173}}" "besu-rpc-alltra-2" ;;
-        2502) collect_enode 2502 "${IP_SERVICE_174:-${IP_SERVICE_174:-192.168.11.174}}" "besu-rpc-alltra-3" ;;
-        1507) collect_enode 1507 "${IP_RPC_244:-${IP_RPC_244:-${IP_RPC_244:-192.168.11.244}}}" "besu-sentry-hybx-1" ;;
-        1508) collect_enode 1508 "${IP_RPC_245:-${IP_RPC_245:-${IP_RPC_245:-192.168.11.245}}}" "besu-sentry-hybx-2" ;;
-        2503) collect_enode 2503 "${IP_RPC_246:-${IP_RPC_246:-${IP_RPC_246:-192.168.11.246}}}" "besu-rpc-hybx-1" ;;
-        2504) collect_enode 2504 "${IP_RPC_247:-${IP_RPC_247:-${IP_RPC_247:-192.168.11.247}}}" "besu-rpc-hybx-2" ;;
-        2505) collect_enode 2505 "${IP_RPC_248:-${IP_RPC_248:-${IP_RPC_248:-192.168.11.248}}}" "besu-rpc-hybx-3" ;;
-    esac
+for vmid in "${TARGET_VMIDS[@]}"; do
+    if [[ -z "${NODE_IPS[$vmid]:-}" || -z "${NODE_NAMES[$vmid]:-}" ]]; then
+        echo "$vmid|unknown|unknown|UNSUPPORTED_VMID"
+        continue
+    fi
+    collect_enode "$vmid" "${NODE_IPS[$vmid]}" "${NODE_NAMES[$vmid]}"
 done
--- a/scripts/configure-rpc-nodes.sh
+++ b/scripts/configure-rpc-nodes.sh
@@ -3,19 +3,76 @@

 set -euo pipefail

-# Load IP configuration
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-source "${PROJECT_ROOT}/config/ip-addresses.conf" 2>/dev/null || true
-
-
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+source "${PROJECT_ROOT}/scripts/lib/load-project-env.sh"

 log() { echo "[INFO] $1"; }
 success() { echo "[✓] $1"; }
 error() { echo "[ERROR] $1"; }

+PROFILE=""
+TARGET_VMIDS=()
+
+usage() {
+    cat <<'EOF'
+Usage: ./scripts/configure-rpc-nodes.sh --profile <fullfunction|standardbase> --vmid <N> [--vmid <N> ...]
+
+Options:
+  --profile <name>  Required. Choose the config template to generate.
+  --vmid <N>        Required. Generate config only for the selected VMIDs.
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --profile)
+            [[ $# -ge 2 ]] || { usage >&2; exit 2; }
+            PROFILE="$2"
+            shift 2
+            ;;
+        --vmid)
+            [[ $# -ge 2 ]] || { usage >&2; exit 2; }
+            TARGET_VMIDS+=("$2")
+            shift 2
+            ;;
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        *)
+            echo "Unknown argument: $1" >&2
+            usage >&2
+            exit 2
+            ;;
+    esac
+done
+
+[[ -n "$PROFILE" ]] || { usage >&2; exit 2; }
+[[ ${#TARGET_VMIDS[@]} -gt 0 ]] || { usage >&2; exit 2; }
+
+declare -A RPC_IPS=(
+    [2101]="${RPC_CORE_1:-192.168.11.211}"
+    [2201]="${RPC_PUBLIC_1:-192.168.11.221}"
+    [2301]="${RPC_PRIVATE_1:-192.168.11.232}"
+    [2303]="192.168.11.233"
+    [2304]="192.168.11.234"
+    [2305]="192.168.11.235"
+    [2306]="192.168.11.236"
+    [2307]="192.168.11.237"
+    [2308]="192.168.11.238"
+    [2400]="192.168.11.240"
+    [2401]="${RPC_THIRDWEB_1:-192.168.11.241}"
+    [2402]="${RPC_THIRDWEB_2:-192.168.11.242}"
+    [2403]="${RPC_THIRDWEB_3:-192.168.11.243}"
+    [2420]="192.168.11.172"
+    [2430]="192.168.11.173"
+    [2440]="192.168.11.174"
+    [2460]="192.168.11.246"
+    [2470]="192.168.11.247"
+    [2480]="192.168.11.248"
+)
+
 # Function to create full-function RPC config
 create_fullfunction_config() {
    local vmid=$1
@@ -113,26 +170,28 @@ log "RPC Node Configuration Generator"
 log "==================================="
 echo ""

-# ALLTRA Network
-log "Configuring ALLTRA Network RPC Nodes..."
-create_fullfunction_config 2500 "${IP_SERVICE_172:-${IP_SERVICE_172:-192.168.11.172}}"
-create_standardbase_config 2501 "${IP_SERVICE_173:-${IP_SERVICE_173:-192.168.11.173}}"
-create_standardbase_config 2502 "${IP_SERVICE_174:-${IP_SERVICE_174:-192.168.11.174}}"
+for vmid in "${TARGET_VMIDS[@]}"; do
+    ip="${RPC_IPS[$vmid]:-}"
+    if [[ -z "$ip" ]]; then
+        error "Unsupported VMID: $vmid"
+        exit 2
+    fi
+    case "$PROFILE" in
+        fullfunction) create_fullfunction_config "$vmid" "$ip" ;;
+        standardbase) create_standardbase_config "$vmid" "$ip" ;;
+        *)
+            error "Unknown profile: $PROFILE"
+            usage >&2
+            exit 2
+            ;;
+    esac
+done
+
 echo ""
-
-# HYBX Network
-log "Configuring HYBX Network RPC Nodes..."
-create_fullfunction_config 2503 "${IP_RPC_246:-${IP_RPC_246:-${IP_RPC_246:-192.168.11.246}}}"
-create_standardbase_config 2504 "${IP_RPC_247:-${IP_RPC_247:-${IP_RPC_247:-192.168.11.247}}}"
-create_standardbase_config 2505 "${IP_RPC_248:-${IP_RPC_248:-${IP_RPC_248:-192.168.11.248}}}"
-echo ""
-
-log "Configuration files created in /tmp/"
-log "Deploy these to respective RPC node config directories:"
-log "  ALLTRA-RPC-1 (Full): /tmp/besu-config-fullfunction-2500.toml → /opt/besu/config/"
-log "  ALLTRA-RPC-2 (Std):  /tmp/besu-config-standardbase-2501.toml → /opt/besu/config/"
-log "  ALLTRA-RPC-3 (Std):  /tmp/besu-config-standardbase-2502.toml → /opt/besu/config/"
-log "  HYBX-RPC-1 (Full):   /tmp/besu-config-fullfunction-2503.toml → /opt/besu/config/"
-log "  HYBX-RPC-2 (Std):    /tmp/besu-config-standardbase-2504.toml → /opt/besu/config/"
-log "  HYBX-RPC-3 (Std):    /tmp/besu-config-standardbase-2505.toml → /opt/besu/config/"
-
+log "Configuration files created in /tmp/ for profile '$PROFILE':"
+for vmid in "${TARGET_VMIDS[@]}"; do
+    case "$PROFILE" in
+        fullfunction) log "  /tmp/besu-config-fullfunction-$vmid.toml → /opt/besu/config/" ;;
+        standardbase) log "  /tmp/besu-config-standardbase-$vmid.toml → /opt/besu/config/" ;;
+    esac
+done
--- a/scripts/create-missing-containers-2506-2508.sh
+++ b/scripts/create-missing-containers-2506-2508.sh
@@ -4,8 +4,19 @@
 #
 # Usage: PROXMOX_HOST=192.168.11.11 bash scripts/create-missing-containers-2506-2508.sh [--dry-run]

+# HISTORICAL SCRIPT
+# VMIDs 2506-2508 were part of a retired migration plan and are documented as destroyed/decommissioned.
+# This file remains for reference only.
+
 set -euo pipefail

+if [[ "${HISTORICAL_ALLOW_RUN:-0}" != "1" ]]; then
+  echo "HISTORICAL: create-missing-containers-2506-2508.sh is not a current provisioning runbook." >&2
+  echo "See docs/04-configuration/ALL_VMIDS_ENDPOINTS.md for the live inventory before creating any CTs." >&2
+  echo "Set HISTORICAL_ALLOW_RUN=1 only if you intentionally need this legacy script." >&2
+  exit 1
+fi
+
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 source "${PROJECT_ROOT}/config/ip-addresses.conf" 2>/dev/null || true
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				{"total_blocks":3931243,"total_transactions":54606,"total_addresses":6793,"latest_block":3931242,"average_block_time":2000,"gas_prices":{"average":0.000001},"network_utilization_percentage":0,"transactions_today":6972,"freshness":{"chain_head":{"block_number":3931243,"timestamp":"2026-04-12T13:54:35Z","age_seconds":0,"source":"reported","confidence":"high","provenance":"rpc","completeness":"complete"},"latest_indexed_block":{"block_number":3931242,"timestamp":"2026-04-12T13:54:33Z","age_seconds":2,"source":"reported","confidence":"high","provenance":"explorer_index","completeness":"complete"},"latest_indexed_transaction":{"block_number":3926698,"timestamp":"2026-04-12T11:23:05Z","age_seconds":9090,"hash":"0x36b74570686b3b384b23167a26985c7a83628f8609a7e928525526cdf28e7759","source":"reported","confidence":"high","provenance":"tx_index","completeness":"partial"},"latest_non_empty_block":{"block_number":3926698,"timestamp":"2026-04-12T11:23:05Z","age_seconds":9090,"distance_from_head":4545,"source":"reported","confidence":"high","provenance":"tx_index","completeness":"partial"}},"completeness":{"transactions_feed":"partial","blocks_feed":"complete","gas_metrics":"complete","utilization_metrics":"complete"},"sampling":{"stats_generated_at":"2026-04-12T13:54:35Z","rpc_probe_at":"2026-04-12T13:54:35Z","stats_window_seconds":300}}
				`@@ -0,0 +1 @@`
				`{"service":"dbis-core-banking-system","status":"healthy","version":"1.0.0","docs":"/api-docs","health":"/health"}`
				`@@ -0,0 +1 @@`
				{"total_blocks":3931228,"total_transactions":54606,"total_addresses":6793,"latest_block":3931227,"average_block_time":2000,"gas_prices":{"average":0.000001},"network_utilization_percentage":0,"transactions_today":6972,"freshness":{"chain_head":{"block_number":3931227,"timestamp":"2026-04-12T13:54:03Z","age_seconds":1,"source":"reported","confidence":"high","provenance":"rpc","completeness":"complete"},"latest_indexed_block":{"block_number":3931227,"timestamp":"2026-04-12T13:54:03Z","age_seconds":1,"source":"reported","confidence":"high","provenance":"explorer_index","completeness":"complete"},"latest_indexed_transaction":{"block_number":3926698,"timestamp":"2026-04-12T11:23:05Z","age_seconds":9059,"hash":"0x36b74570686b3b384b23167a26985c7a83628f8609a7e928525526cdf28e7759","source":"reported","confidence":"high","provenance":"tx_index","completeness":"partial"},"latest_non_empty_block":{"block_number":3926698,"timestamp":"2026-04-12T11:23:05Z","age_seconds":9059,"distance_from_head":4529,"source":"reported","confidence":"high","provenance":"tx_index","completeness":"partial"}},"completeness":{"transactions_feed":"partial","blocks_feed":"complete","gas_metrics":"complete","utilization_metrics":"complete"},"sampling":{"stats_generated_at":"2026-04-12T13:54:04Z","rpc_probe_at":"2026-04-12T13:54:03Z","stats_window_seconds":300}}
				`@@ -0,0 +1 @@`
				{"pools":[{"address":"0x9e89bae009adf128782e19e8341996c596ac40dc","dex":"dodo","token0":{"address":"0x93e66202a11b1772e55407b32b44e5cd8eda7f22","symbol":"cUSDT","name":"Tether USD (Compliant)","source":"db"},"token1":{"address":"0xf22258f57794cc8e06237084b353ab30fffa640b","symbol":"cUSDC","name":"USD Coin (Compliant)","source":"db"},"reserves":{"token0":"983891197998","token1":"1016108797998"},"tvl":1999999.995996,"volume24h":0,"feeTier":null},{"address":"0x866cb44b59303d8dc5f4f9e3e7a8e8b0bf238d66","dex":"dodo","token0":{"address":"0x93e66202a11b1772e55407b32b44e5cd8eda7f22","symbol":"cUSDT","name":"Tether USD (Compliant)","source":"db"},"token1":{"address":"0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1","symbol":"USDT","name":"Tether USD (Chain 138)","source":"db"},"reserves":{"token0":"999872497998","token1":"1000127497998"},"tvl":1999999.995996,"volume24h":0,"feeTier":null}]}
				`@@ -0,0 +1 @@`
				`{"data":{"blockscout_url":"https://explorer.d-bis.org/tx/0x2f31d4f9a97be754b800f4af1a9eedf3b107d353bfa1a19e81417497a76c05c2","from":"0x4a666f96fc8764181194447a7dfdb7d471b301c8","from_registry":"DEPLOYER_ADMIN_138","source":"blockscout","to":"0x152ed3e9912161b76bdfd368d0c84b7c31c10de7","to_registry":"CW_L1_BRIDGE_CHAIN138","tx_hash":"0x2f31d4f9a97be754b800f4af1a9eedf3b107d353bfa1a19e81417497a76c05c2"}}`