feat: split disconnect into soft/hard + RPC query polish

- Disconnect path split: DisconnectAsync() (soft, preserves on-chain
  session for reuse) vs DisconnectAndEndSessionAsync() (hard, broadcasts
  MsgCancelSession and refunds the unused deposit). Replaces the prior
  DisconnectAsync(bool endSession=true) whose hidden default always
  ended the session and hid the reuse path.
- ChainClient.Queries / ChainClient.FeeGrants / RpcClient / ProtobufReader:
  follow-on cleanups to the RPC-first migration landed in 493cfb2 /
  772c5de.
- SentinelVpnClient.Connect / SentinelVpnService / SentinelVpnClient:
  align with the new disconnect contract.

Build: Release clean (0 warn, 0 err).

Author: Sentinel-Bluebuilder

src/Sentinel.SDK.Core/ChainClient.FeeGrants.cs

@@ -22,7 +22,9 @@ public async Task<List<FeeGrant>> QueryFeeGrantsAsync(string grantee, Cancellati
         // RPC-first
         try
         {
-            return await _rpcClient.QueryFeeGrantsAsync(grantee, ct: ct);
+            var rpcGrants = await _rpcClient.QueryFeeGrantsAsync(grantee, ct: ct);
+            if (rpcGrants.Count > 0) return rpcGrants;
+            _logger?.Debug("RPC returned no fee grants; falling back to LCD to verify.");
         }
         catch (Exception ex) { _logger?.Debug($"RPC QueryFeeGrants failed, falling back to LCD: {ex.Message}"); }
 
@@ -58,7 +60,9 @@ public async Task<IReadOnlyList<FeeGrant>> QueryFeeGrantsIssuedAsync(string gran
         // RPC-first
         try
         {
-            return await _rpcClient.QueryFeeGrantsIssuedAsync(granter, ct: ct);
+            var rpcGrants = await _rpcClient.QueryFeeGrantsIssuedAsync(granter, ct: ct);
+            if (rpcGrants.Count > 0) return rpcGrants;
+            _logger?.Debug("RPC returned no issued fee grants; falling back to LCD to verify.");
         }
         catch (Exception ex) { _logger?.Debug($"RPC QueryFeeGrantsIssued failed, falling back to LCD: {ex.Message}"); }
 

src/Sentinel.SDK.Core/ChainClient.Queries.cs

@@ -54,7 +54,9 @@ public async Task<List<ChainNode>> GetActiveNodesAsync(int limit = 500, Cancella
         // RPC-first
         try
         {
-            return await _rpcClient.QueryNodesAsync(1, limit, ct);
+            var rpcNodes = await _rpcClient.QueryNodesAsync(1, limit, ct);
+            if (rpcNodes.Count > 0) return rpcNodes;
+            _logger?.Debug("RPC returned no active nodes; falling back to LCD to verify.");
         }
         catch (Exception ex) { _logger?.Debug($"RPC GetActiveNodes failed, falling back to LCD: {ex.Message}"); }
 
@@ -111,7 +113,9 @@ public async Task<List<Subscription>> GetSubscriptionsAsync(string address, Canc
         // RPC-first
         try
         {
-            return await _rpcClient.QuerySubscriptionsForAccountAsync(address, ct: ct);
+            var rpcSubs = await _rpcClient.QuerySubscriptionsForAccountAsync(address, ct: ct);
+            if (rpcSubs.Count > 0) return rpcSubs;
+            _logger?.Debug("RPC returned no subscriptions; falling back to LCD to verify.");
         }
         catch (Exception ex) { _logger?.Debug($"RPC GetSubscriptions failed, falling back to LCD: {ex.Message}"); }
 
@@ -135,10 +139,15 @@ public async Task<List<ChainSession>> GetSessionsAsync(string address, string st
         try
         {
             var sessions = await _rpcClient.QuerySessionsForAccountAsync(address, ct: ct);
-            // Filter by status if specified (RPC returns all statuses)
-            if (status == "1")
-                return sessions.Where(s => s.Status == "active" || s.Status == "1").ToList();
-            return sessions;
+            if (sessions.Count > 0)
+            {
+                // Filter by status if specified (RPC returns all statuses)
+                var filtered = status == "1"
+                    ? sessions.Where(s => s.Status == "active" || s.Status == "1").ToList()
+                    : sessions;
+                if (filtered.Count > 0) return filtered;
+            }
+            _logger?.Debug("RPC returned no sessions; falling back to LCD to verify.");
         }
         catch (Exception ex) { _logger?.Debug($"RPC GetSessions failed, falling back to LCD: {ex.Message}"); }
 
@@ -159,7 +168,9 @@ public async Task<List<ChainNode>> GetPlanNodesAsync(int planId, CancellationTok
         // RPC-first
         try
         {
-            return await _rpcClient.QueryNodesForPlanAsync((ulong)planId, 1, 5000, ct);
+            var rpcNodes = await _rpcClient.QueryNodesForPlanAsync((ulong)planId, 1, 5000, ct);
+            if (rpcNodes.Count > 0) return rpcNodes;
+            _logger?.Debug("RPC returned no plan nodes; falling back to LCD to verify.");
         }
         catch (Exception ex) { _logger?.Debug($"RPC GetPlanNodes failed, falling back to LCD: {ex.Message}"); }
 
@@ -266,11 +277,23 @@ public async Task<List<DiscoveredPlan>> DiscoverPlansAsync(int maxId = 100, Canc
 
     /// <summary>
     /// Get account number and sequence for transaction signing.
+    /// RPC-first (cosmos.auth.v1beta1.Query/Account) with LCD fallback.
     /// </summary>
     /// <param name="address">Account address (sent1...).</param>
     /// <returns>Tuple of (accountNumber, sequence).</returns>
     internal async Task<(ulong AccountNumber, ulong Sequence)> GetAccountInfoAsync(string address, CancellationToken ct = default)
     {
+        // RPC-first: faster, no LCD rate-limit exposure.
+        try
+        {
+            var rpcResult = await _rpcClient.QueryAccountAsync(address, ct);
+            if (rpcResult is not null)
+                return rpcResult.Value;
+            _logger?.Debug("RPC QueryAccount returned null; falling back to LCD.");
+        }
+        catch (Exception ex) { _logger?.Debug($"RPC QueryAccount failed, falling back to LCD: {ex.Message}"); }
+
+        // LCD fallback
         var path = $"/cosmos/auth/v1beta1/accounts/{address}";
         var json = await LcdGetAsync(path, ct);
 
@@ -554,17 +577,23 @@ public async Task<IReadOnlyList<ActiveSession>> QueryActiveSessionsForAddressAsy
     {
         ArgumentNullException.ThrowIfNull(walletAddress);
 
-        // RPC-first
+        // RPC-first. Treat empty result as suspicious and fall through to LCD — a silent
+        // empty return used to mask decoder bugs (see suggestions/2026-04-21-rpc-session-decoder-any-and-field-numbers.md).
         try
         {
             var rpcSessions = await _rpcClient.QuerySessionsForAccountAsync(walletAddress, ct: ct);
-            return rpcSessions
-                .Where(s => s.Status == "active" || s.Status == "1")
-                .Select(s => new ActiveSession(
-                    ulong.TryParse(s.Id, out var sid) ? sid : 0,
-                    s.NodeAddress,
-                    SessionStatus.Active))
-                .ToList();
+            if (rpcSessions.Count > 0)
+            {
+                var active = rpcSessions
+                    .Where(s => s.Status == "active" || s.Status == "1")
+                    .Select(s => new ActiveSession(
+                        ulong.TryParse(s.Id, out var sid) ? sid : 0,
+                        s.NodeAddress,
+                        SessionStatus.Active))
+                    .ToList();
+                if (active.Count > 0) return active;
+            }
+            _logger?.Debug("RPC QueryActiveSessions returned no active sessions; falling back to LCD to verify.");
         }
         catch (Exception ex) { _logger?.Debug($"RPC QueryActiveSessions failed, falling back to LCD: {ex.Message}"); }
 
@@ -605,7 +634,18 @@ public async Task<IReadOnlyList<ActiveSession>> QueryActiveSessionsForAddressAsy
 
         // LCD fallback
         var path = $"/sentinel/session/v3/sessions/{sessionId}/allocations";
-        var json = await LcdGetAsync(path, ct);
+        JsonElement json;
+        try
+        {
+            json = await LcdGetAsync(path, ct);
+        }
+        catch (SentinelException ex) when (ex.Code == "CLIENT_HTTP_404")
+        {
+            // Fresh session with no bandwidth reported yet (node hasn't called back to chain).
+            // Treat as "allocation unknown" rather than failing session reuse — see
+            // suggestions/2026-04-19-connect-widen-reuse-handshake-retry.md.
+            return null;
+        }
 
         if (json.TryGetProperty("allocations", out var arr) && arr.ValueKind == JsonValueKind.Array)
         {
@@ -640,7 +680,9 @@ public async Task<List<SubscriptionAllocation>> QuerySubscriptionAllocationsAsyn
         // RPC-first (v2 — v3 returns 501)
         try
         {
-            return await _rpcClient.QuerySubscriptionAllocationsAsync(subscriptionId, ct: ct);
+            var rpcAllocs = await _rpcClient.QuerySubscriptionAllocationsAsync(subscriptionId, ct: ct);
+            if (rpcAllocs.Count > 0) return rpcAllocs;
+            _logger?.Debug("RPC returned no subscription allocations; falling back to LCD to verify.");
         }
         catch (Exception ex) { _logger?.Debug($"RPC QuerySubAllocations failed, falling back to LCD: {ex.Message}"); }
 
@@ -691,7 +733,9 @@ public async Task<List<ChainNode>> QueryPlanNodesAsync(int planId, CancellationT
         // RPC-first
         try
         {
-            return await _rpcClient.QueryNodesForPlanAsync((ulong)planId, 1, 5000, ct);
+            var rpcNodes = await _rpcClient.QueryNodesForPlanAsync((ulong)planId, 1, 5000, ct);
+            if (rpcNodes.Count > 0) return rpcNodes;
+            _logger?.Debug("RPC returned no plan nodes; falling back to LCD to verify.");
         }
         catch (Exception ex) { _logger?.Debug($"RPC QueryPlanNodes failed, falling back to LCD: {ex.Message}"); }
 
@@ -867,6 +911,7 @@ public async Task<IReadOnlyList<ChainNode>> GetAvailableNodesAsync(string wallet
 
     /// <summary>
     /// Query all subscribers of a plan.
+    /// RPC-first (verified wire format 2026-04-21); falls through to LCD on empty or exception.
     /// Optionally exclude an address (e.g. the plan owner) from the results.
     /// </summary>
     /// <param name="planId">Plan ID.</param>
@@ -878,14 +923,31 @@ public async Task<IReadOnlyList<PlanSubscriber>> QueryPlanSubscribersAsync(
         string? excludeAddress = null,
         CancellationToken ct = default)
     {
+        // RPC-first (QuerySubscriptionsForPlan — direct PlanSubscription, not Any-wrapped).
+        try
+        {
+            var rpcSubs = await _rpcClient.QuerySubscriptionsForPlanAsync((ulong)planId, ct: ct);
+            if (rpcSubs.Count > 0)
+            {
+                var filtered = excludeAddress is null
+                    ? rpcSubs
+                    : rpcSubs.Where(s => !string.Equals(s.Address, excludeAddress, StringComparison.OrdinalIgnoreCase)).ToList();
+                return filtered;
+            }
+            _logger?.Debug("RPC QueryPlanSubscribers returned no results; falling back to LCD to verify.");
+        }
+        catch (Exception ex) { _logger?.Debug($"RPC QueryPlanSubscribers failed, falling back to LCD: {ex.Message}"); }
+
+        // LCD fallback
         var path = $"/sentinel/subscription/v3/plans/{planId}/subscriptions";
         var items = await LcdPaginatedAsync(path, "subscriptions", ct);
 
         var subscribers = new List<PlanSubscriber>();
 
         foreach (var item in items)
         {
-            var address = item.TryGetProperty("address", out var a) ? a.GetString() ?? "" : "";
+            var address = item.TryGetProperty("acc_address", out var a) ? a.GetString() ?? ""
+                : item.TryGetProperty("address", out var a2) ? a2.GetString() ?? "" : "";
             if (string.IsNullOrEmpty(address) && item.TryGetProperty("subscriber", out var sub))
             {
                 address = sub.GetString() ?? "";
@@ -1079,7 +1141,9 @@ public async Task<IReadOnlyList<AuthzGrant>> QueryAuthzGrantsAsync(
         // RPC-first
         try
         {
-            return await _rpcClient.QueryAuthzGrantsAsync(granter, grantee, ct: ct);
+            var rpcGrants = await _rpcClient.QueryAuthzGrantsAsync(granter, grantee, ct: ct);
+            if (rpcGrants.Count > 0) return rpcGrants;
+            _logger?.Debug("RPC returned no authz grants; falling back to LCD to verify.");
         }
         catch (Exception ex) { _logger?.Debug($"RPC QueryAuthzGrants failed, falling back to LCD: {ex.Message}"); }
 

src/Sentinel.SDK.Core/ProtobufReader.cs

@@ -96,28 +96,53 @@ internal static PriceEntry DecodePrice(List<ProtoField> fields)
         return new PriceEntry(denom, baseVal, quoteVal);
     }
 
+    /// <summary>
+    /// Unwrap a google.protobuf.Any (type_url=1, value=2) containing a Session message and decode it.
+    /// RPC responses wrap repeated Session entries in Any; LCD returns the Session directly.
+    /// </summary>
+    internal static ChainSession DecodeSessionFromAny(List<ProtoField> anyFields)
+    {
+        // Any.value (field 2) contains the serialized Session message bytes.
+        var valueField = GetField(anyFields, 2);
+        if (valueField is null) return DecodeSession(anyFields); // Fallback — not Any-wrapped
+        var sessionFields = DecodeEmbedded(valueField);
+        return DecodeSession(sessionFields);
+    }
+
+    /// <summary>
+    /// Unwrap a google.protobuf.Any (type_url=1, value=2) containing a Subscription message and decode it.
+    /// </summary>
+    internal static Subscription DecodeSubscriptionFromAny(List<ProtoField> anyFields)
+    {
+        var valueField = GetField(anyFields, 2);
+        if (valueField is null) return DecodeSubscription(anyFields);
+        var subFields = DecodeEmbedded(valueField);
+        return DecodeSubscription(subFields);
+    }
+
     /// <summary>
     /// Decode a ChainSession from protobuf fields.
-    /// Session v3 wraps in base_session (field 1). Base session proto:
-    /// id=1, acc_address=2, node_address=3, download_bytes=7(varint), upload_bytes=8(varint),
-    /// max_bytes=9(varint), duration=10(string), max_duration=11(string), status=14(varint),
-    /// inactive_at=15(embedded timestamp), start_at=16(embedded timestamp)
+    /// Session v3 wraps in base_session (field 1). Verified base_session wire layout:
+    /// id=1(varint), acc_address=2(string), node_address=3(string),
+    /// download_bytes=4(string), upload_bytes=5(string), max_bytes=6(string),
+    /// duration=7(string), max_duration=8(string), status=9(varint),
+    /// inactive_at=10(timestamp), status_at=11(timestamp), start_at=12(timestamp).
     /// </summary>
     internal static ChainSession DecodeSession(List<ProtoField> outerFields)
     {
-        // Unwrap base_session (field 1) if present
+        // Unwrap base_session (field 1) if present and embedded
         var baseField = GetField(outerFields, 1);
-        var fields = baseField is not null ? DecodeEmbedded(baseField) : outerFields;
+        var fields = (baseField is not null && baseField.WireType == 2) ? DecodeEmbedded(baseField) : outerFields;
 
         var id = GetField(fields, 1) is { } f1 ? f1.Varint.ToString() : "0";
         var accAddr = GetField(fields, 2) is { } f2 ? DecodeString(f2) : "";
         var nodeAddr = GetField(fields, 3) is { } f3 ? DecodeString(f3) : "";
-        var download = GetField(fields, 7) is { } f7 ? f7.Varint.ToString() : "0";
-        var upload = GetField(fields, 8) is { } f8 ? f8.Varint.ToString() : "0";
-        var maxBytes = GetField(fields, 9) is { } f9 ? f9.Varint.ToString() : "0";
-        var duration = GetField(fields, 10) is { } f10 ? DecodeString(f10) : null;
-        var maxDuration = GetField(fields, 11) is { } f11 ? DecodeString(f11) : null;
-        var status = GetField(fields, 14) is { } f14 ? (int)f14.Varint : 0;
+        var download = GetField(fields, 4) is { } f4 ? DecodeString(f4) : "0";
+        var upload = GetField(fields, 5) is { } f5 ? DecodeString(f5) : "0";
+        var maxBytes = GetField(fields, 6) is { } f6 ? DecodeString(f6) : "0";
+        var duration = GetField(fields, 7) is { } f7 ? DecodeString(f7) : null;
+        var maxDuration = GetField(fields, 8) is { } f8 ? DecodeString(f8) : null;
+        var status = GetField(fields, 9) is { } f9 ? (int)f9.Varint : 0;
         // status: 1=active, 2=inactive_pending, 3=inactive
         var statusStr = status switch { 1 => "active", 2 => "inactive_pending", 3 => "inactive", _ => status.ToString() };
 
@@ -167,6 +192,26 @@ internal static Provider DecodeProvider(List<ProtoField> fields)
         return new Provider(address, name, identity, website, description, status);
     }
 
+    /// <summary>
+    /// Decode a PlanSubscription from protobuf fields.
+    /// Verified wire layout from live RPC probe (2026-04-21, plan 42):
+    /// id=1(varint), acc_address=2(string), plan_id=3(varint),
+    /// price=4(embedded: denom=1/string, base_value=2/string, quote_value=3/string),
+    /// status=6(varint: 1=active, 2=inactive_pending, 3=inactive),
+    /// inactive_at=7(timestamp), start_at=8(timestamp), status_at=9(timestamp).
+    /// NOTE: outer response field 1 is NOT Any-wrapped — direct PlanSubscription bytes.
+    /// </summary>
+    internal static PlanSubscriber DecodePlanSubscription(List<ProtoField> fields)
+    {
+        var id = GetField(fields, 1) is { } f1 ? f1.Varint.ToString() : "0";
+        var accAddr = GetField(fields, 2) is { } f2 ? DecodeString(f2) : "";
+        // plan_id is field 3 (varint) on PlanSubscription — not base_subscription field 4
+        var status = GetField(fields, 6) is { } f6 ? (int)f6.Varint : 0;
+        var statusStr = status switch { 1 => "active", 2 => "inactive_pending", 3 => "inactive", _ => status.ToString() };
+
+        return new PlanSubscriber(accAddr, status, id);
+    }
+
     /// <summary>
     /// Decode a ChainNode from protobuf fields.
     /// Node proto: address=1, gigabyte_prices=2, hourly_prices=3, remote_addrs=4, status=6