[Volyarosh94]

What

• Both TCP runners send frames unsigned (DETECTION with data: frame) and feed them to HashChainBuilder.add_detection(frame). Each closed window, from that call, the 60 s check or shutdown, goes out as CHAIN_ENTRY with its batch. PacketSigner, close_hour and the manual TSA stitching are gone.
• --tsa turns on TSA and OpenTimestamps (off by default). --chain-window-s sets the window, 900 s by default.
• Chains live in coverage_data/chains/<node_id> next to the keys, and coverage_data/ is now ignored.
• The listener prints CHAIN_ENTRY_ACK verdicts, and the handshake prints the real KEY_ACK status.
• CI installs retina-custody at 294c0b0, since the v0.1.0 tag still has the old API.

Calls I made

• A CHAIN_ENTRY line that would go over the server's 1 MiB TCP line limit is sent without its batch, and the server records batch_verified: null. At 15-minute windows that is most adsb and anomalous windows.
• After a restart inside the last committed window, frames keep streaming but the chain holds until that window ends, so no window range is sent twice.
• One send lock per socket, since the heartbeat and listener threads write too. The listener waits with select, so a near-1 MiB send isn't cut by a read timeout.
• Single-node keeps unsent chain entries across a reconnect. Multi-node runs a listener per node, so acks are read and the server doesn't stall on a full buffer.
• On shutdown it ends any cut line, sends the last window, half-closes and waits up to 5 s for its ack.

Tested

pre-commit and pytest green (241); against a local retina-server over TCP at 30 s windows every window was acked verified with its batch, including after a restart inside a window.

[Volyarosh94]

Needs offworldlabs/retina-server#687 to be verified end to end; it talks to a server that accepts the windowed CHAIN_ENTRY.