Add verified provider paging, persistent Store offerings and SDK module delivery

[TJKoury]

SDN serves verified FlatBuffer pages from a selected provider and source, keeps Store offerings across reloads, and supports SDK module installation and embedded APP interfaces. Full-text search now runs over the complete persisted dataset before pagination; search text, source filters and snapshot identity remain bound together. Remote viewers retry index warming without falling back to local data.

The server and browser pin published FlatSQL 2.0.2. Its extractor handles declared and unresolved enum/table fields safely. Derived search indexes include the engine hash in their identity. Engine upgrades rebuild incompatible indexes in bounded calls, retaining control tables and journal checkpoints instead of discarding large derived databases. Store presentation snapshots reuse SDS PMM/PLG, STF, DPM and DSS offerings, replace successful snapshots atomically per node, and preserve the previous snapshot on failed refreshes; installation and entitlement are checked separately.

The generic APP host verifies the page/module binding, bounds provider reads and retains the full SDK bundle inside customer ciphertext. The opt-in test checkout installs verified modules into the existing runtime and restores explicit installations after restart. Placement covers 137 plugin/version assignments across the five requested roles. The dashboard includes Modules and Details tabs, compact chain/token Bond navigation, deterministic node avatars, provider datasets, source breadcrumbs, and remote record paging. Its independent Vite entry excludes Orbital Console and terrain dependencies.

The public read origin supports CDN/onion serving with explicit schema routes, byte preservation, request coalescing, revalidation and bounded caching. Wrapper changes bound update/download writes, propagate cancellation, reject HTTPS downgrade redirects, strengthen update-carrier admission and correct Kubo health/IPv6 behavior. Peer admission keeps persistence outside the registry memory lock.

Validation:

• Published FlatSQL artifact integrity and byte identity verified. Native engine tests, real-record enum regression, persistent FTS/rebuild tests, API/protocol source-and-cursor tests, and browser search/retry checks pass. Current client checks: 30 runtime/protocol and 15 package tests; package/dashboard builds pass.
• Incremental engine recovery preserves exact source bytes and control checkpoints, handles streams above 32 MiB, and resumes the journal without duplicate records. End-to-end upgrade and normal/crash/corruption restart regressions pass. Destructive journal events now drain bounded CID batches, release both store and journal locks between batches, preserve late live writes and their source tags, and stop on cancellation or routed-delete errors. Focused deletion, concurrency and recovery regressions pass (138.945 seconds). The handwritten-Go architecture check passes.
• Store snapshot cold/reload/offline/overwrite tests and live browser reload verification passed. On the current dev binary, the first visible cached sets contained all 141 module cards and all 11 data cards; a separate service fixture restored offline and disappeared after a successful empty refresh. The live node currently has no service listings, so this does not establish operational science services. Remote viewer and Catalog Editor browser fixtures cover pagination, source identity and responsive layouts; companion module packages own the composition/search tests.
• Earlier component evidence includes 110 customer checkout cases (17 protected), SDK sealing negative cases, 1,000 distinct rendered avatars, live three-chain balance lookups, two-host peer/read regressions, and Nginx/Tor byte comparisons. These results do not replace a complete check of this final candidate.

This remains a draft. The local backend runs 9bb912a20e97c2649dcef292debdef642749ac7e (binary SHA-256 d3d3532c96c80a4f051049544fc345029472f059847c70ffc91eeb55c8280b7c). Its previous cold replay failed when a single historical deletion exceeded the engine's five-minute limit. The bounded deletion fix and a guard against quota eviction during incomplete replay are deployed to that dev instance with the 16.14 GB journal preserved. A validated --storage-max-size startup flag sets this dev archive to 64 GiB without editing its private configuration; full live archive/FTS and warm-restart verification are still pending. CAT Editor 0.1.3 is installed in customer-encrypted form and its served APP page hash is verified.

Local table search-adapter integration awaits ownership handoff. Twenty-six assigned artifacts are still unavailable; production licensing, paid checkout, complete science-service execution and server-blind conjunction assessment remain incomplete. The overlapping UI gitlink and stack pins are not advanced here. Final-candidate CI is running. Local focused quota/deletion regressions passed (261.404 seconds), all three cold/forced-replay quota cases passed, and the CLI rejects invalid budgets before starting a node. The duplicate local full Go suite was deliberately interrupted to stop disk contention with the live recovery; its separate static console check also reported a WASM operation name and a geometry type field in foreign-owned code. No complete gauntlet pass is claimed. The CelesTrak emergency manual repair retains rollback and ledger records; it is not a fleet-wide release.

A follow-up discovery and recovery correction is pushed separately at 225af5a7f6eef6ec596fbc7c0b38b20328cff984 (codex/sdn-discovery-summaries) so CI on this PR head can finish. The installed editor timed out during all-source discovery while the archive was replaying. The correction reuses source-summary counts and bytes and reads only publication/pin evidence in the sync collection, removing repeated raw-record scans. Each bounded catalog deletion batch also commits atomically across routed rows, the index and source tags, rolling back on failure. Focused storage availability tests (30.336 seconds), sync API tests (69.128 seconds), recovery/rollback/concurrency/checkpoint tests (145.233 seconds), architecture check and build pass. The new binary is prepared but has not replaced the replaying dev process. A duplicate full local CI run was skipped for this review-ref push while the existing remote run and live recovery continue; this is not exact-candidate gauntlet evidence.