fix(consumers): align SDK builds and follow appealable transaction decisions

.github/workflows/unit-tests-pr.yml

@@ -34,7 +34,8 @@ jobs:
         uses: actions/setup-node@v6
         with:
           node-version: 24
-      - run: npm ci --ignore-scripts
+      # The pinned Git SDK builds its dist exports in prepare.
+      - run: npm ci
       - run: npm run test:fee-accounting
       - run: npm run lint
       - run: npm run build

docker/Dockerfile.explorer

@@ -1,8 +1,9 @@
 FROM node:24.1.0-alpine3.20 AS base
 
+RUN apk add --no-cache git openssh-client
 WORKDIR /app
 COPY ./explorer/package*.json .
-RUN --mount=type=cache,target=/root/.npm npm install
+RUN --mount=type=cache,target=/root/.npm npm ci
 COPY ./explorer .
 
 FROM base AS dev

docker/Dockerfile.frontend

@@ -1,5 +1,6 @@
 FROM node:24.1.0-alpine3.20 AS base
 
+RUN apk add --no-cache git openssh-client
 WORKDIR /app
 COPY ./frontend/package*.json .
 RUN --mount=type=cache,target=/root/.npm npm ci

docs/integration/v06-consumer-migration.md

@@ -0,0 +1,59 @@
+# v0.6 consumer migration
+
+This first consumer update targets `v0.123-dev`, the active integration line
+identified by release gate #1670. The older fee PR #1653 targets `v0.122` and
+is not the base of this change. No open PR inspected on 16 September 2026
+changes `frontend/src/stores/transactions.ts`.
+
+Both frontend and explorer now pin SDK #220 at
+`2bc5e60052d4a5ef2fef4d9f6931014ca15f20b1`, with regenerated npm lockfiles.
+That SDK was audited against Consensus #1634 at
+`c4749a42095bcfb9de69bef4f4fd5e9a6a2f86f2` (above #1628). This is an exact
+pre-release build, not a tagged npm release or production compatibility claim.
+The frontend previously selected v2 commit `bc1fc320`; the explorer selected
+v0.20.3. No staking `ValidatorInfo.live` / `ValidatorView.live` consumers were
+found in either application's sources.
+
+The frontend supports contract-backed networks as well as Studio. Its
+non-Studio polling used to stop at Accepted, Undetermined and timeout
+outcomes, missing later appeals/finalization. It now follows those decisions
+until the stored parent status is Finalized or Canceled. Six regression cases
+cover the four appealable decisions and the two terminal parent statuses.
+The existing network-scoped refresh, canonical `txId`/`hash` normalization,
+and whole transaction-data replacement remain in place.
+
+The explorer's `/api/rpc` client remains on the simulator backend. Updating
+its SDK does not turn that backend into the Node/Consensus stack. Likewise,
+parent Finalized does not certify that all child messages or refund/payout
+obligations are complete.
+
+Explorer CI must allow npm's prepare step for the Git-pinned SDK; using
+`--ignore-scripts` omitted its dist exports and failed the previous CI build.
+Both Docker build stages install Git/SSH for the pinned Git dependency, and
+both use `npm ci` to honor the reviewed lockfiles. Container execution still
+requires runtime qualification; local application builds are not image tests.
+
+## Next implementation and qualification
+
+The [cross-repository plan](https://github.com/genlayerlabs/genlayer-dev-env/blob/fix/consume-inflation-and-votewindow-parity/docs/integration/jm-claus-kiril-consumer-plan-2026-09-16.md)
+records PR ownership, inspected heads, exclusions and the remaining work:
+
+- Node changes are explicitly excluded from this consumer follow-up. Final
+  runtime qualification remains separate.
+- Use authoritative `executionGeneration` for attempt-specific receipt-cache
+  invalidation. SDK #220 exposes it; older simulator responses may omit it.
+  Do not infer generation from a retained decision.
+- SDK child enumeration now reads canonical parent-linked Messages events,
+  including deferred delivery, with bounded history queries and deduplication.
+  Local SDK tests cover this behavior. Delivery-completion APIs and integrated
+  child journeys remain pending; creation does not establish completion.
+- Qualify deploy/write/read, details, appeal/recompute, nested child delivery
+  and any affected staking/governance journey against the actual backend.
+- Freeze the exact Node-led dependency closure and inspect the resolved E2E
+  manifest. The earlier SDK-only green E2E does not qualify this combination.
+
+Local frontend type/unit/build and explorer fee/build checks are necessary
+but do not establish those runtime journeys. No backend migration, governance
+UI, E2E trigger, merge, deployment or release is included here. Rollback should
+revert the SDK pins together with both lockfiles; the polling correction can
+be reviewed independently.

explorer/package.json

@@ -22,7 +22,7 @@
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "date-fns": "^4.1.0",
-    "genlayer-js": "^0.20.3",
+    "genlayer-js": "github:genlayerlabs/genlayer-js#2bc5e60052d4a5ef2fef4d9f6931014ca15f20b1",
     "lucide-react": "^0.575.0",
     "next": "16.1.6",
     "next-themes": "^0.4.6",