…many_lines

CI runs clippy with -D warnings and the workspace enables clippy::pedantic, so
the expanded main() tripped too_many_lines (121/100). Extract the EVM-backing
resolution into resolve_evm_info; behavior unchanged, main() back to ~85 lines.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…EVM flags, read timeout

Automated-review follow-ups on the manifest HTTP API + CLI:
- Reject a loopback/unspecified --host early (would stamp unreachable
  bootstrap addresses into the manifest).
- Manifest API now enforces GET and returns 405 for other methods.
- --evm-network and --enable-evm are mutually exclusive at the clap level.
- Cap the manifest-server handler with a 5s socket read timeout so a slow/idle
  client can't tie up a thread (listener binds 0.0.0.0).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

… hardening

@dirvine review + Copilot follow-ups on the manifest API:
- Bind the manifest listener synchronously in serve_manifest_api and propagate
  the error, so a bind failure (e.g. port in use) fails the run instead of the
  devnet reporting 'running' without its API.
- Reject --serve-port 0 at the parser (range 1..) — it would otherwise bind an
  ephemeral port while /api/info advertises ':0'.
- --serve-port now requires --host (the API publishes a LAN URL; a loopback-only
  devnet would be misleading/unsafe).
- Handle manifest-API connections inline in the single server thread instead of
  spawning an unbounded thread per connection (kept the 5s read timeout).
- Also reject multicast/broadcast --host, not just loopback/unspecified.
- Propagate the bootstrap serialization error in /api/info instead of silently
  substituting null.

Adds serve_port_requires_host + serve_port_rejects_zero CLI tests.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Production nodes accumulate out-of-range chunks indefinitely: storage
admission reaches width 20, retained-storage responsibility uses width 9,
commitments cover the strict closest 7, and only ~35% (~7/20) of stored
chunks appear in current commitments — yet almost no records reach prune
audits or deletion.

Cause: prune candidacy required six mature neighbor-sync repair-hint
proofs among the key's close group before a record could even be
selected for a prune audit. Repair hints are sent to the ~20 peers
closest to SELF, while prune confirmation concerns the 7 peers closest
to the KEY; for a record outside width 9 nothing guarantees those sets
overlap, so candidates were silently deferred forever. The
commitment-retention veto additionally blocked the START of the 3-day
hysteresis rather than only deletion, and none of the intermediate
states were visible at INFO level.

Fix:
- Candidacy now strictly means "continuously outside the storage-
  retention width (9) for PRUNE_HYSTERESIS_DURATION". It never depends
  on repair proofs, bootstrap state, audit budget, or prior
  neighbor-sync contact.
- The out-of-range timestamp is recorded the moment a record leaves
  range, even while a retained commitment still holds the key;
  retention vetoes deletion only.
- Prune-confirmation audits challenge the CURRENT strict closest 7
  straight from the local routing table, never filtered through
  RepairProofs. The repair-proof maturity gate is unchanged for the
  responsible-chunk anti-outsourcing audit.
- Deletion still requires 6-of-7 valid nonce-bound possession proofs,
  plus a pre-deletion revalidation against the current routing table
  (width-9 re-check, retention re-check, current-close-group proof
  re-check). Bootstrap gating, the per-pass challenge budget, and
  commitment retention are audit/deletion deferrals that preserve
  candidacy and the first-seen time.
- Explicit lifecycle states (InRange, HysteresisPending, Candidate,
  HeldByCommitment, BootstrapDeferred, BudgetDeferred, AuditFailed,
  Pruned) and one aggregate INFO census per pass.

Unit and E2E regression coverage added; no prune test manufactures
repair proofs anymore, and the threshold E2E test now runs the
production-width scenario (close group 7, retention width 9, empty
RepairProofs, 5/7 retains, 6/7 deletes).

SemVer: patch

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

fix(pruning): make prune candidacy independent of repair-hint history

…meouts-part-capacity-fix

# Conflicts:
#	src/replication/mod.rs

The merge of upstream/rc-2026.7.1 combined our branch's refactor (singular
prune_audit_response_status replaced by the batch prune_audit_response_statuses)
with upstream's grading tests, which still called the removed singular function.
Adapt the graded_status test helper to delegate to the batch function with a
single-key challenge slice so upstream's coverage is preserved.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…acity-fix

fix(replication): batch record prune audit challenges

feat(ant-devnet): opt-in LAN / external-devnet mode (--host / --evm-network / --serve-port)