ops: testnet round trip per chain (Sepolia, BSC testnet, Nile, devnet) before mainnet

[dendisuhubdy]

From the 2026-09-17 security review and the pre-deploy audit's before-mainnet list. Each endpoint should be deployed through its script and exercised lock → attest → mint → burn → release, then a guardian-set rotation, before any mainnet deployment:

• Sepolia via deploy/eth.sh
• BSC testnet via deploy/bnb.sh
• Tron Nile via deploy/trx.sh — the only environment that exercises the TVM assumptions the Foundry suite cannot: ecrecover returning the 0x41-prefixed address form the migration stores as guardian keys (tron/migrations/2_deploy.js), the zero-address form in _checkKeys, SELFDESTRUCT availability for SafeTransfer's code check, and the deliberately no-op fork guard. A wrong assumption fails closed (every release reverts WrongGuardian), but on mainnet that means releases and rotations bricked until a governance rotation and possible redeploy.
• Solana devnet via deploy/sol.sh — needs the Solana CLI for cargo build-sbf (unexercised on the build machine so far). Also confirm the release transaction fits the 1,232-byte packet limit at the launch guardian-set size (about seven signatures of headroom with the current account list).

The guardian/relayer daemon issue tracks the end-to-end loop; this issue tracks the per-chain deployment and contract-level round trips that precede it.

[dendisuhubdy]

Progress 2026-09-17 (commit 687ac32):

• Tron: deploy/trx.sh nile --dry-run compiles the mirrored sources under Tron solc 0.8.20. Nile migration still needs a funded key.
• Solana: the SBF build is proven and deploy/sol.sh localnet --yes ran end to end against solana-test-validator (agave 4.2.2): deploy, Initialize, show, pause/unpause, set-token with a fresh SPL mint; the printed emitter wire form equals the program id bytes. Two script findings fixed on the way: the build must be cargo build-sbf --arch v3 (the v0 default is refused once SIMD-0500 is active, which a default test validator already has; v3 is live on devnet and mainnet), and sol.sh demanded the EVM-form ADMIN it never uses.
• Devnet broadcast: blocked on funding only. The public RPC airdrop rate-limits this machine; a throwaway deployer keypair is ready in deploy/keys/ (git-ignored) to be funded at faucet.solana.com, then deploy/sol.sh devnet.
• Sepolia / BSC testnet: need the user's funded keys in deploy/.env (none on this machine); the anvil rehearsal of the same path already passes.

[dendisuhubdy]

Closing as not planned: the testnet runs never happened. The decision on 2026-09-19 was to launch on mainnet directly with small caps (docs/mainnet-launch.md), so "before mainnet" can no longer be met. What the testnets were meant to show has since been shown on mainnet:

• Round trip per chain (lock → attest → mint → burn → release) on Ethereum, BSC, Tron and Solana, 2026-09-20, caps 100 per transfer / 1,000 per day. Tx table in docs/mainnet-deployment.md.
• Guardian-set rotation on all four endpoints and Rand, 2026-09-25.
• TVM assumptions: on a real TVM ecrecover yields the stored address form, and releases and the rotation verify. The run also confirmed the fix for Tron USDT's transfer returning false.
• Solana packet limit: a release is 1,132 bytes with five signatures (set 0) and 1,198 with six (set 1), of 1,232. The program is built with cargo build-sbf --arch v3.

The remaining Solana headroom is tracked in #5 (O-1).