[Bug] `start-devnet.sh` generates 4 nodes but only 3 validators in genesis

[qj0r9j0vc2]

Summary

./scripts/start-devnet.sh creates 4 node directories (node0-node3) but the generated genesis.json only contains 3 validators (validator-0 through validator-2). node3 runs as a non-validator participant with no representation in the genesis validator set.

Evidence

Genesis validator set (devnet/genesis.json):

• validator-0 — 0xf39f...2266
• validator-1 — 0x7099...79c8
• validator-2 — 0x3c44...93bc

Node directories created: node0/, node1/, node2/, node3/

node3/config/node.json references validator-3 with its own validator_id (19edeb6d...), BLS/Ed25519 keys, and unique ports (9030-9035, RPC 8575-8576). However, this validator is absent from genesis.json — both from the cipherbft.validators[] array and from alloc (no pre-funded account).

Impact

• node3 cannot participate in consensus (not in the validator set).
• With only 3 validators (n=3, f=0), the network has zero fault tolerance — any single node failure halts consensus.
• node3's peer list includes all 3 genesis validators, and node0's peer list excludes node3, confirming the asymmetry is baked into the config generation.

Expected Behavior

If start-devnet.sh is intended to produce a 4-validator devnet:

1. genesis.json should include validator-3 in cipherbft.validators[].
2. alloc should include validator-3's address with a funded balance.
3. All node configs should list the other 3 nodes as peers (node0-node2 currently only list 2 peers each, missing node3).

Likely Root Cause

The script creates N node directories but the genesis generation logic uses a hardcoded or off-by-one validator count (N-1 instead of N). Alternatively, node3 may be intentionally a non-validator full node, in which case the key_name: "validator-3" naming is misleading.

Steps to Reproduce

./scripts/start-devnet.sh
cat devnet/genesis.json | jq '.cipherbft.validators | length'
# Returns: 3
ls -d devnet/node*/
# Returns: node0/ node1/ node2/ node3/