haqq: drop truncated dteam peer, stop feeding the Polkachu addrbook JSON to ct_merge_seeds; cometbft-common: validate peer entries

- haqq/scripts/init.sh: 7c153a83@peer.haqq.mainnet.dteam.tech:28656 is not a 40-hex node id;
  haqqd refuses to start with it in seeds/persistent_peers. Removed from both defaults.
- haqq/scripts/init.sh: ct_merge_seeds was given ADDRBOOK_URL (a JSON addrbook, hundreds of KB)
  as the official seed list; the resulting sed argument exceeded ARG_MAX on Alpine. The
  addrbook is already installed by ct_set_addrbook; pass no seeds URL.
- scripts/cometbft-common.sh (+ per-chain copies via update.sh sync): ct_valid_peers filters
  seeds and persistent_peers to <40-hex>@host:port and logs what it drops, so a bad upstream
  entry can never block startup again.

Replaces the runtime override /root/onsite-overrides/haqq-mainnet-skip-addrbook-as-seeds.yml
that the onsite agent left on rpc-de-31 on 2026-09-07.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KjqejYycVyVvrxV9aTDhgX

babylon/scripts/cometbft-common.sh

@@ -68,11 +68,28 @@ ct_merge_seeds() {
       ct_log "no official seeds fetched from $_url (continuing with configured)"
     fi
   fi
+  _seeds=$(ct_valid_peers "$_seeds")
   if [ -n "$_seeds" ]; then
     sed -i "s/^seeds = \".*\"/seeds = \"${_seeds}\"/" "$_cfg"
   fi
 }
 
+# ct_valid_peers LIST
+#   Keep only well-formed CometBFT peer entries (<40-hex node id>@<host>:<port>), drop and
+#   log the rest. A truncated id such as 7c153a83@peer.haqq.mainnet.dteam.tech:28656 makes
+#   haqqd refuse to start ("invalid node ID"), 2026-09-07 rpc-de-31.
+ct_valid_peers() {
+  _in="$1"; _out=""
+  for _p in $(echo "$_in" | tr ',' ' '); do
+    if echo "$_p" | grep -Eqi '^[0-9a-f]{40}@[^@,:]+:[0-9]+$'; then
+      _out="${_out:+$_out,}$_p"
+    else
+      ct_log "dropping malformed peer entry: $_p"
+    fi
+  done
+  echo "$_out"
+}
+
 # ct_set_persistent_peers CONFIG_TOML PEERS
 #   Handles both cometbft-classic `persistent_peers` (underscore) and forks that use
 #   `persistent-peers` (hyphen, e.g. sei) — patches whichever key is present.
@@ -80,6 +97,8 @@ ct_set_persistent_peers() {
   _cfg="$1"; _peers="$2"
   [ -f "$_cfg" ] || return 0
   [ -n "$_peers" ] || return 0
+  _peers=$(ct_valid_peers "$_peers")
+  [ -n "$_peers" ] || return 0
   sed -i "s/^persistent_peers = \".*\"/persistent_peers = \"${_peers}\"/" "$_cfg"
   sed -i "s/^persistent-peers = \".*\"/persistent-peers = \"${_peers}\"/" "$_cfg"
   return 0

cosmos/scripts/cometbft-common.sh

@@ -68,11 +68,28 @@ ct_merge_seeds() {
       ct_log "no official seeds fetched from $_url (continuing with configured)"
     fi
   fi
+  _seeds=$(ct_valid_peers "$_seeds")
   if [ -n "$_seeds" ]; then
     sed -i "s/^seeds = \".*\"/seeds = \"${_seeds}\"/" "$_cfg"
   fi
 }
 
+# ct_valid_peers LIST
+#   Keep only well-formed CometBFT peer entries (<40-hex node id>@<host>:<port>), drop and
+#   log the rest. A truncated id such as 7c153a83@peer.haqq.mainnet.dteam.tech:28656 makes
+#   haqqd refuse to start ("invalid node ID"), 2026-09-07 rpc-de-31.
+ct_valid_peers() {
+  _in="$1"; _out=""
+  for _p in $(echo "$_in" | tr ',' ' '); do
+    if echo "$_p" | grep -Eqi '^[0-9a-f]{40}@[^@,:]+:[0-9]+$'; then
+      _out="${_out:+$_out,}$_p"
+    else
+      ct_log "dropping malformed peer entry: $_p"
+    fi
+  done
+  echo "$_out"
+}
+
 # ct_set_persistent_peers CONFIG_TOML PEERS
 #   Handles both cometbft-classic `persistent_peers` (underscore) and forks that use
 #   `persistent-peers` (hyphen, e.g. sei) — patches whichever key is present.
@@ -80,6 +97,8 @@ ct_set_persistent_peers() {
   _cfg="$1"; _peers="$2"
   [ -f "$_cfg" ] || return 0
   [ -n "$_peers" ] || return 0
+  _peers=$(ct_valid_peers "$_peers")
+  [ -n "$_peers" ] || return 0
   sed -i "s/^persistent_peers = \".*\"/persistent_peers = \"${_peers}\"/" "$_cfg"
   sed -i "s/^persistent-peers = \".*\"/persistent-peers = \"${_peers}\"/" "$_cfg"
   return 0

cronos/scripts/cometbft-common.sh

@@ -68,11 +68,28 @@ ct_merge_seeds() {
       ct_log "no official seeds fetched from $_url (continuing with configured)"
     fi
   fi
+  _seeds=$(ct_valid_peers "$_seeds")
   if [ -n "$_seeds" ]; then
     sed -i "s/^seeds = \".*\"/seeds = \"${_seeds}\"/" "$_cfg"
   fi
 }
 
+# ct_valid_peers LIST
+#   Keep only well-formed CometBFT peer entries (<40-hex node id>@<host>:<port>), drop and
+#   log the rest. A truncated id such as 7c153a83@peer.haqq.mainnet.dteam.tech:28656 makes
+#   haqqd refuse to start ("invalid node ID"), 2026-09-07 rpc-de-31.
+ct_valid_peers() {
+  _in="$1"; _out=""
+  for _p in $(echo "$_in" | tr ',' ' '); do
+    if echo "$_p" | grep -Eqi '^[0-9a-f]{40}@[^@,:]+:[0-9]+$'; then
+      _out="${_out:+$_out,}$_p"
+    else
+      ct_log "dropping malformed peer entry: $_p"
+    fi
+  done
+  echo "$_out"
+}
+
 # ct_set_persistent_peers CONFIG_TOML PEERS
 #   Handles both cometbft-classic `persistent_peers` (underscore) and forks that use
 #   `persistent-peers` (hyphen, e.g. sei) — patches whichever key is present.
@@ -80,6 +97,8 @@ ct_set_persistent_peers() {
   _cfg="$1"; _peers="$2"
   [ -f "$_cfg" ] || return 0
   [ -n "$_peers" ] || return 0
+  _peers=$(ct_valid_peers "$_peers")
+  [ -n "$_peers" ] || return 0
   sed -i "s/^persistent_peers = \".*\"/persistent_peers = \"${_peers}\"/" "$_cfg"
   sed -i "s/^persistent-peers = \".*\"/persistent-peers = \"${_peers}\"/" "$_cfg"
   return 0

haqq/scripts/cometbft-common.sh

@@ -68,11 +68,28 @@ ct_merge_seeds() {
       ct_log "no official seeds fetched from $_url (continuing with configured)"
     fi
   fi
+  _seeds=$(ct_valid_peers "$_seeds")
   if [ -n "$_seeds" ]; then
     sed -i "s/^seeds = \".*\"/seeds = \"${_seeds}\"/" "$_cfg"
   fi
 }
 
+# ct_valid_peers LIST
+#   Keep only well-formed CometBFT peer entries (<40-hex node id>@<host>:<port>), drop and
+#   log the rest. A truncated id such as 7c153a83@peer.haqq.mainnet.dteam.tech:28656 makes
+#   haqqd refuse to start ("invalid node ID"), 2026-09-07 rpc-de-31.
+ct_valid_peers() {
+  _in="$1"; _out=""
+  for _p in $(echo "$_in" | tr ',' ' '); do
+    if echo "$_p" | grep -Eqi '^[0-9a-f]{40}@[^@,:]+:[0-9]+$'; then
+      _out="${_out:+$_out,}$_p"
+    else
+      ct_log "dropping malformed peer entry: $_p"
+    fi
+  done
+  echo "$_out"
+}
+
 # ct_set_persistent_peers CONFIG_TOML PEERS
 #   Handles both cometbft-classic `persistent_peers` (underscore) and forks that use
 #   `persistent-peers` (hyphen, e.g. sei) — patches whichever key is present.
@@ -80,6 +97,8 @@ ct_set_persistent_peers() {
   _cfg="$1"; _peers="$2"
   [ -f "$_cfg" ] || return 0
   [ -n "$_peers" ] || return 0
+  _peers=$(ct_valid_peers "$_peers")
+  [ -n "$_peers" ] || return 0
   sed -i "s/^persistent_peers = \".*\"/persistent_peers = \"${_peers}\"/" "$_cfg"
   sed -i "s/^persistent-peers = \".*\"/persistent-peers = \"${_peers}\"/" "$_cfg"
   return 0

haqq/scripts/init.sh

@@ -18,10 +18,10 @@ MIN_GAS="${MIN_GAS:-0.01hqq}"
 MONIKER="${MONIKER:-rpc-node}"
 
 # Polkachu seeds + official Haqq network seeds for reliable peer discovery
-SEEDS="${SEEDS:-936e27a05f3cfb090507dd810395cbbd8efbffb0@65.109.115.172:24056,f4675b63b8872fb9216efa99428eb5b1fb297393@65.109.104.118:61256,6c9a6fc0e0d94bf303075e46560832e652cffc14@65.108.71.137:24056,7c153a83@peer.haqq.mainnet.dteam.tech:28656}"
+SEEDS="${SEEDS:-936e27a05f3cfb090507dd810395cbbd8efbffb0@65.109.115.172:24056,f4675b63b8872fb9216efa99428eb5b1fb297393@65.109.104.118:61256,6c9a6fc0e0d94bf303075e46560832e652cffc14@65.108.71.137:24056}"
 
 # Optional persistent peers for additional bootstrap reliability
-PERSISTENT_PEERS="${PERSISTENT_PEERS:-17e0fd08f04e062d18412808b8bf134e9ad34508@65.109.109.189:10656,e000b992a0066eae9e87c66e0d65229a76647509@198.96.92.242:32656,7c153a83@peer.haqq.mainnet.dteam.tech:28656,235ac65359582357b04754e838496545b3ba6429@haqq-seed-1.allnodes.me:26656,9573a569016378765444095484840d7f543d2800@haqq-seed-2.allnodes.me:26656}"
+PERSISTENT_PEERS="${PERSISTENT_PEERS:-17e0fd08f04e062d18412808b8bf134e9ad34508@65.109.109.189:10656,e000b992a0066eae9e87c66e0d65229a76647509@198.96.92.242:32656,235ac65359582357b04754e838496545b3ba6429@haqq-seed-1.allnodes.me:26656,9573a569016378765444095484840d7f543d2800@haqq-seed-2.allnodes.me:26656}"
 
 ct_apk curl jq
 
@@ -44,7 +44,10 @@ fi
 sed -i '/^\[rpc\]/,/^\[/{s|^laddr = .*|laddr = "tcp://0.0.0.0:26657"|}' "$CONFIG_DIR/config.toml"
 
 ct_patch_p2p             "$CONFIG_DIR/config.toml" "$IP" "${P2P_PORT:-10465}"
-ct_merge_seeds           "$CONFIG_DIR/config.toml" "$SEEDS" "$ADDRBOOK_URL"
+# The Polkachu addrbook is a JSON file handled by ct_set_addrbook above; it is NOT a
+# seed list. Feeding it to ct_merge_seeds blew the sed argument past ARG_MAX (2026-09-07,
+# rpc-de-31) and left haqqd unable to start.
+ct_merge_seeds           "$CONFIG_DIR/config.toml" "$SEEDS"
 ct_set_persistent_peers  "$CONFIG_DIR/config.toml" "$PERSISTENT_PEERS"
 ct_set_moniker           "$CONFIG_DIR/config.toml" "$MONIKER"
 ct_configure_statesync   "$CONFIG_DIR/config.toml" "$STATESYNC_RPC"

scripts/cometbft-common.sh

@@ -68,11 +68,28 @@ ct_merge_seeds() {
       ct_log "no official seeds fetched from $_url (continuing with configured)"
     fi
   fi
+  _seeds=$(ct_valid_peers "$_seeds")
   if [ -n "$_seeds" ]; then
     sed -i "s/^seeds = \".*\"/seeds = \"${_seeds}\"/" "$_cfg"
   fi
 }
 
+# ct_valid_peers LIST
+#   Keep only well-formed CometBFT peer entries (<40-hex node id>@<host>:<port>), drop and
+#   log the rest. A truncated id such as 7c153a83@peer.haqq.mainnet.dteam.tech:28656 makes
+#   haqqd refuse to start ("invalid node ID"), 2026-09-07 rpc-de-31.
+ct_valid_peers() {
+  _in="$1"; _out=""
+  for _p in $(echo "$_in" | tr ',' ' '); do
+    if echo "$_p" | grep -Eqi '^[0-9a-f]{40}@[^@,:]+:[0-9]+$'; then
+      _out="${_out:+$_out,}$_p"
+    else
+      ct_log "dropping malformed peer entry: $_p"
+    fi
+  done
+  echo "$_out"
+}
+
 # ct_set_persistent_peers CONFIG_TOML PEERS
 #   Handles both cometbft-classic `persistent_peers` (underscore) and forks that use
 #   `persistent-peers` (hyphen, e.g. sei) — patches whichever key is present.
@@ -80,6 +97,8 @@ ct_set_persistent_peers() {
   _cfg="$1"; _peers="$2"
   [ -f "$_cfg" ] || return 0
   [ -n "$_peers" ] || return 0
+  _peers=$(ct_valid_peers "$_peers")
+  [ -n "$_peers" ] || return 0
   sed -i "s/^persistent_peers = \".*\"/persistent_peers = \"${_peers}\"/" "$_cfg"
   sed -i "s/^persistent-peers = \".*\"/persistent-peers = \"${_peers}\"/" "$_cfg"
   return 0

shibarium/scripts/cometbft-common.sh

@@ -68,11 +68,28 @@ ct_merge_seeds() {
       ct_log "no official seeds fetched from $_url (continuing with configured)"
     fi
   fi
+  _seeds=$(ct_valid_peers "$_seeds")
   if [ -n "$_seeds" ]; then
     sed -i "s/^seeds = \".*\"/seeds = \"${_seeds}\"/" "$_cfg"
   fi
 }
 
+# ct_valid_peers LIST
+#   Keep only well-formed CometBFT peer entries (<40-hex node id>@<host>:<port>), drop and
+#   log the rest. A truncated id such as 7c153a83@peer.haqq.mainnet.dteam.tech:28656 makes
+#   haqqd refuse to start ("invalid node ID"), 2026-09-07 rpc-de-31.
+ct_valid_peers() {
+  _in="$1"; _out=""
+  for _p in $(echo "$_in" | tr ',' ' '); do
+    if echo "$_p" | grep -Eqi '^[0-9a-f]{40}@[^@,:]+:[0-9]+$'; then
+      _out="${_out:+$_out,}$_p"
+    else
+      ct_log "dropping malformed peer entry: $_p"
+    fi
+  done
+  echo "$_out"
+}
+
 # ct_set_persistent_peers CONFIG_TOML PEERS
 #   Handles both cometbft-classic `persistent_peers` (underscore) and forks that use
 #   `persistent-peers` (hyphen, e.g. sei) — patches whichever key is present.
@@ -80,6 +97,8 @@ ct_set_persistent_peers() {
   _cfg="$1"; _peers="$2"
   [ -f "$_cfg" ] || return 0
   [ -n "$_peers" ] || return 0
+  _peers=$(ct_valid_peers "$_peers")
+  [ -n "$_peers" ] || return 0
   sed -i "s/^persistent_peers = \".*\"/persistent_peers = \"${_peers}\"/" "$_cfg"
   sed -i "s/^persistent-peers = \".*\"/persistent-peers = \"${_peers}\"/" "$_cfg"
   return 0

tac/scripts/cometbft-common.sh

@@ -68,11 +68,28 @@ ct_merge_seeds() {
       ct_log "no official seeds fetched from $_url (continuing with configured)"
     fi
   fi
+  _seeds=$(ct_valid_peers "$_seeds")
   if [ -n "$_seeds" ]; then
     sed -i "s/^seeds = \".*\"/seeds = \"${_seeds}\"/" "$_cfg"
   fi
 }
 
+# ct_valid_peers LIST
+#   Keep only well-formed CometBFT peer entries (<40-hex node id>@<host>:<port>), drop and
+#   log the rest. A truncated id such as 7c153a83@peer.haqq.mainnet.dteam.tech:28656 makes
+#   haqqd refuse to start ("invalid node ID"), 2026-09-07 rpc-de-31.
+ct_valid_peers() {
+  _in="$1"; _out=""
+  for _p in $(echo "$_in" | tr ',' ' '); do
+    if echo "$_p" | grep -Eqi '^[0-9a-f]{40}@[^@,:]+:[0-9]+$'; then
+      _out="${_out:+$_out,}$_p"
+    else
+      ct_log "dropping malformed peer entry: $_p"
+    fi
+  done
+  echo "$_out"
+}
+
 # ct_set_persistent_peers CONFIG_TOML PEERS
 #   Handles both cometbft-classic `persistent_peers` (underscore) and forks that use
 #   `persistent-peers` (hyphen, e.g. sei) — patches whichever key is present.
@@ -80,6 +97,8 @@ ct_set_persistent_peers() {
   _cfg="$1"; _peers="$2"
   [ -f "$_cfg" ] || return 0
   [ -n "$_peers" ] || return 0
+  _peers=$(ct_valid_peers "$_peers")
+  [ -n "$_peers" ] || return 0
   sed -i "s/^persistent_peers = \".*\"/persistent_peers = \"${_peers}\"/" "$_cfg"
   sed -i "s/^persistent-peers = \".*\"/persistent-peers = \"${_peers}\"/" "$_cfg"
   return 0