The protocol explorer for the Stellar network.

Testnet / Futurenet support — a one-line `stellar.network` switch. The indexer now runs correctly (without corrupting data) against Stellar testnet and futurenet. Grounded in a cold adversarial hardcode audit + an independent fix-verifier pass (2026-08-26). Pubnet behaviour is byte-identical (every new default resolves to the old constant). - Config: stellar.soroban_genesis_ledger / stellar.movements_floor_ledger (pubnet values, or genesis=1 on test nets) so the SEP-41 supply and CAP-67 real-time movements feeds don't floor above the whole chain; timescale.MovementsFloor() + canonical.NetworkPassphrase() install seams resolve leaf-package reads to the configured network. - Corruption guards: SacContractID is network-aware (was serving the pubnet contract address on testnet /v1/assets); config validation rejects a pubnet (core-live) history_archive_url on a non-pubnet network; the cross-anchor archive filler refuses to write pubnet ledgers into a test-net archive; the SEP-41 supply genesis seed defaults its boundary from the config's network value. - Ansible: the archival-node role is network-aware (single-source stellar_passphrase — fixes the futurenet core.cfg bug — per-network history archive, boundary knobs, cap67 -floor-ledger); testnet + futurenet inventory templates. - CI/CD: deploy.yml gains testnet / futurenet targets; a fleet-model design proposal (docs/operations/cicd-fleet-model.md). - Docs: testnet/futurenet deployment guide + reset runbook.

Real-time movement latency cadence tuning (~4s → ~2s). An adversarial audit of a proposed captive-core "fast lane" found the live-movement latency is a chain of hardcoded cadence constants, not a compute floor — so no new component/second core is needed. Tuned the safe ones: the indexer's caught-up MinIO re-check (liveTailRetryWait) 3s → 500ms (the single largest term — a caught-up indexer sat a flat ~3s behind the tip; MinIO is local, so a re-check is a cheap bucket LIST); the /v1/ledger/stream poll that drives the explorer's "watch it land" refetch 2s → 500ms; and the cap67 movements derive tick (FOLLOW_INTERVAL) 2s → 1s. The ClickHouse-part-sensitive LiveSink flush is deliberately left at 1s (sub-second flushing multiplies small parts on the capacity-bound store). An event-driven MinIO-bucket-notification ingest (still a single captive-core) is the documented next step toward ~100ms.

Real-time account-movements follow daemon (5.3). The CAP-67 movements derive (stellar.account_movements — the money trail served on /v1/accounts/{g}/movements) now runs as a continuous follow daemon (ch-cap67-movements -follow) instead of a ~30s timer + oneshot: it catches up to the CONTIGUOUS lake tip, sleeps a short interval (2s), and repeats — cutting movement latency from ~30s to ~2s behind the chain tip so a user watches their transactions land in near real time. Builds on the contiguity gate (#174, Cap67Range) so it never derives past a near-tip lake hole; the timer is retired (single writer, no watermark race); Restart=always + StartLimitBurst make a crash-loop trip to failed (visible to node-healthcheck.sh, which now covers the daemon); a transient ClickHouse error holds the watermark and retries (no ledger skipped). The initial P23→tip backfill runs as the daemon's first catch-up. Operator cutover: apply the ansible (or manually stop+disable cap67-movements.timer and start the -follow daemon) AFTER the ops binary is deployed.