Verify operator termination and collateral withdrawal

[huangminghuang]

Summary

• Extend the termination flow beyond bond remittance to require another complete rotation on both Ethereum and Solana.
• Decode published group attestations and require full, distinct groups of standing operators, with the terminated account absent.
• Keep the collateral-withdrawal fixture eligible to relay and verify its available collateral and ACTIVE status before remittance.

Why

Bond remits can arrive before a stale schedule prevents later delivery. The termination flow now checks both outpost cursors through another rotation and validates every published window it observes. Its expected group size comes from the same topology resolver used by bootstrap, including default settings.

The collateral fixture previously configured its whole deposit as the minimum and then withdrew half while expecting ACTIVE status. It now deposits 2,000,000 units against a 1,000,000-unit minimum and withdraws 1,000,000, retaining the exact final escrow assertion.

These flows exercise ordinary rotation with standing operators and the existing bootstrap. WIRE-392 is required before deployment for recovery/resumption and duty-frequency policy; automatic recovery remains undecided.

Validation

• Tools build passed against the compiled sibling SDK; 107 focused tests across eight suites passed for bootstrap/action shapes and canonical code handling.
• The linked SDK probe encoded chains.regchain, chains.setoutpost, opreg.setconfig and epoch.finishadv against the current SYSIO ABIs and rejected invalid canonical input.
• Termination-flow lint passed; live continued-rotation and collateral assertions are included in the coordinated run below.
• Coordinated E2E: 15/15 flows passed. Verified remote checkouts: SYSIO 67fe61c2, Ethereum 3f23632a, Libraries 99c5c14a and Tools d50fc784, with unchanged Solana cbf72188 and CDT a00bd718. Tools installed SDK 1.0.93 directly from the candidate Libraries checkout. Post-remit rotation on both outposts and eligible collateral withdrawal passed; optional flow-swap-epoch-stress is excluded.
• The known upstream SDK strict-null error (Builtins.ts:89, TS2722) is waived as a prerequisite for this E2E run only; it remains unresolved.

Companion PRs

• SYSIO #603: produces post-mutation rosters and the canonical continuation ABI; coordinate the consumer update before deploying this producer.
• Ethereum #198: enforces immediate revocation and usable next-group admission; deploy its matching library and inbound implementation together before the SYSIO producer change.
• Libraries #82: generates the continuation interface from the SYSIO ABI; candidate E2E links this checkout directly. For published packages, release Libraries before Tools.