[Tumas]

grandine vc --beacon-node-urls ... runs the validator client alone against remote beacon nodes, grandine bn runs the beacon node alone, and the bare command runs the beacon node with the local validator when one is configured. Duties come from exactly one source: the built-in node or the remote nodes. vc refuses options that only the built-in beacon node acts on.

The validator no longer holds the fork choice controller. It works through a ChainSource, and every duty goes through the BeaconNodeApi trait, which the built-in node and the remote nodes both implement: attester, aggregation, sync committee, PTC, proposer, payload attestation, voluntary exit and doppelganger liveness duties, plus prepared proposers, validator registrations and proposer preferences. Attestation data returned by a remote node is validated for the reported index and target epoch before it is signed. Proposer preferences are published for the dependent root the duties are held under.

Remote nodes are polled for health and ranked by it, then by the newest head; an unreachable node is kept as the last choice. Requests have per-endpoint timeouts, a head stream tracks reorgs, and a slot head fallback covers a node that falls behind. Duties are published to every node by default, returning once one accepts; the payload envelope goes to the node that produced the block. In remote mode the validator is driven by clock ticks directly, and genesis is agreed with the nodes before it starts.

Resolves own validator indices from the finalized state, driven by events.

Register the validator client with the beacon nodes' builder via --use-builder pre-gloas, skipping validators without a fee recipient

Stop counting sync committee messages as validator liveness

Run the doppelganger check late in the slot
At the aggregate tick every node has ticked into the epoch and seen the slot's attestations

Leave the peer counts out of validator client logs

Identify the chain by its genesis validators root without loading the state; vc and the interchange commands use the predefined network's root, read from the embedded mainnet state or a constant for the testnets;

Run data column recovery on the reconstruction executor

Accept a slot's worth of aggregates in one publish request

Doppelganger protection no longer reads the local beacon state or the liveness tracker directly: it takes validator indices and a liveness query from the caller, so it works against remote beacon nodes, where only synced nodes are asked and a validator seen live by any of them counts as live. A key is activated only after a successful check, a failed query postpones activation instead of panicking, and a key whose index is unknown is not activated until its index resolves and a full check window has passed from that point.