[heifner]

Summary

Fixes WIRE-415. buildenv walked every READY attestation of every outpost before applying its byte budget, and every desyndicate adds a READY row paid by sysio, with no limit on how many. A large enough backlog could keep the rosters an outpost needs out of the envelope, or exhaust sysio.epoch::advance, which runs buildenv inline.

• A byqueue index orders attestations by outpost, status and lane, then id. It replaces bystatus, and the unread bytype and byepoch go with it. OPERATORS and BATCH_OPERATOR_GROUPS form a schedule lane that ships first; every other type keeps its queueout order.
• buildenv walks only its outpost's READY rows and stops at MAX_ENVELOPE_BYTES or at MAX_ENVELOPE_ATTESTATIONS (64), so its work no longer grows with the backlog. It erases what it ships instead of marking it PROCESSED first; the envelope itself stays in outenvelopes until the outpost acknowledges it ([WNS-18] opp: erase an outbound envelope only once the outpost has consumed it - WIRE-348 #592). Its inbound cleanup reads only that outpost's PROCESSED rows.
• queueout caps a general-lane row at MAX_GENERAL_ATTESTATION_DATA_BYTES (7,656), what fits beside a full schedule lane (SCHEDULE_LANE_BYTES, 24 KiB; the largest window's rosters encode to 6,806 bytes at [WNS-56] OPP: bound the operator roster to the schedule window and cap queueout #692's 8 × 7 ceiling, and 15,446 even at Solana's 8 × 16). Every row the walk reaches therefore ships, and none can stall the lane behind it.
• queueout refuses a general-lane row once the outpost already holds MAX_QUEUED_ATTESTATIONS (512), counted in a new outqueue table. A refused desyndicate reverts whole, burn and fee included, and the holder retries after a later epoch ships some. Schedule rows are never refused, since advance queues them.
• Nothing is dropped: a READY DESYNDICATE_LIQ is a payout whose LIQ is already burned. The bounded walk drains a backlog one budget at a time.

Notes

• Deploy on fresh state. A row written before the index change has no byqueue entry, so buildenv would never find it; docs/contract-upgrade-order.md says so.
• Neither outpost needs the row cap: Ethereum's epochIn and Solana's dispatch both resume across calls. It bounds the depot's own work.
• ABI change: the byqueue index and the outqueue table. [WIRE-415] sdk-core: add the sysio.msgch outqueue table wire-libraries-ts#123 regenerates the SDK types; merge the two together. No OPP proto, Ethereum or Solana change.
• WIRE-415's other fix, a minimum desyndicate amount, is already on master as sysio.synd's min_desyndicate.
• With [WNS-56] OPP: bound the operator roster to the schedule window and cap queueout #692, this supersedes the rest of OPP: bound the outbound attestation queue and the operator roster; floor desyndicate #653.

Tests

• buildenv_ships_the_schedule_lane_ahead_of_a_backlog: OPERATORS and BATCH_OPERATOR_GROUPS queued behind a backlog ship first, and the backlog keeps its order.
• buildenv_stops_at_the_attestation_cap: 67 rows ship as 64, then 3, in order.
• buildenv_ships_only_its_own_outposts_rows: one outpost's buildenv leaves another's rows and count alone.
• buildenv_erases_only_its_outposts_processed_rows: two outposts accept an envelope with one attestation per lane; one outpost's buildenv erases its own inbound rows and leaves the other's, which that outpost's own build then erases.
• the_largest_windows_schedule_fits_its_lane_budget: an 8 × 7 window with the longest names and both links encodes within SCHEDULE_LANE_BYTES.
• queueout_caps_general_rows_to_fit_beside_the_schedule and buildenv_ships_a_general_row_at_its_cap_beside_a_full_schedule: a general row one byte over its cap is refused while a schedule row of that size is not, and a general row at its cap ships beside a full schedule.
• queueout_refuses_general_rows_past_the_queue_cap: the 513th general row is refused, schedule rows and another outpost are not, and shipping 63 rows frees exactly 63 places.
• desyndicate_reverts_whole_when_the_outbound_queue_is_full: the holder keeps the shadow; nothing burns and no returns row is written.

contracts_unit_test passes 961/961.

[huangminghuang]

Approved for the #696 delta (2dcac2f4..cf356755). The Ethereum 128-operator gas-limit issue is tracked on base PR #692 and remains blocking there.

The base branch was changed.

[huangminghuang]

Re-reviewed current head 01b5880 after the master merge and follow-up. The new two-outpost/two-lane regression covers the previously missing inbound PROCESSED cleanup and isolation path. The exact-head contracts build and 27 focused JIT cases pass, generated ABI/WASM match, and I found no blocking issues.