feat(gov-proposals): derive voting window from duration input

README.md

@@ -41,7 +41,7 @@ The backend aggregates data from a Syscoin Core node, Sentry Node RPC responses,
 REACT_APP_API_BASE=https://your-backend.example npm run build
 ```
 
-The value is read at build time by `src/lib/apiClient.js`; without it, development builds use `http://localhost:3001` and production builds use `https://syscoin.dev`.
+The value is read at build time by both `src/lib/apiClient.js` (authenticated surface) and `src/lib/api.js` (anonymous surface — superblock timing, governance feed, masternode stats); without it, development builds use `http://localhost:3001` and production builds use `https://syscoin.dev`. Keeping both clients on the same override means `REACT_APP_API_BASE` retargets the entire app in a single build.
 
 ## Getting Started
 

src/App.css

@@ -4031,8 +4031,82 @@
   font-weight: 700;
 }
 
-.proposal-wizard__help--warn {
-  color: #b45309;
+.proposal-wizard__window-preview {
+  border: 1px solid var(--panel-outline);
+  border-radius: 14px;
+  padding: 12px 14px;
+  background: var(--panel-strong);
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+}
+
+.proposal-wizard__window-preview > strong {
+  font-size: 0.85rem;
+  color: var(--muted);
+  text-transform: uppercase;
+  letter-spacing: 0.06em;
+}
+
+.proposal-wizard__window-preview p {
+  margin: 0;
+  font-size: 0.9rem;
+}
+
+.proposal-wizard__window-preview--error {
+  background: rgba(229, 107, 85, 0.08);
+  border-color: rgba(229, 107, 85, 0.35);
+}
+
+/* Tight-voting-window warning. Fires when the next superblock is
+   within SUPERBLOCK_VOTE_DEADLINE_WARN_SEC (4 days) so the user
+   has a chance to rethink a last-minute submission that would
+   likely miss the payout. Uses the amber "warning" palette
+   (status-chip.is-warning / notice--warning / vote-modal__error--warn)
+   that's already used elsewhere to signal caution rather than
+   hard error. Larger padding + border-left accent makes the
+   banner harder to skim past than the plain window-preview card. */
+.proposal-wizard__tight-warning {
+  background: linear-gradient(
+    180deg,
+    rgba(255, 248, 237, 0.96) 0%,
+    rgba(255, 240, 214, 0.98) 100%
+  );
+  border: 1px solid rgba(243, 179, 86, 0.45);
+  border-left: 4px solid #d89a3c;
+  border-radius: 14px;
+  padding: 14px 18px;
+  color: #6b4500;
+  margin-bottom: 12px;
+}
+
+.proposal-wizard__tight-warning-title {
+  display: block;
+  font-size: 0.95rem;
+  font-weight: 700;
+  color: #8a5c0f;
+  margin-bottom: 6px;
+}
+
+.proposal-wizard__tight-warning p {
+  margin: 0 0 8px;
+  font-size: 0.9rem;
+  line-height: 1.45;
+}
+
+.proposal-wizard__tight-warning p:last-child {
+  margin-bottom: 0;
+}
+
+/* Inline emphasis inside the notice (numeric month counts, the
+   "will likely miss" clause) should stay inline so the sentence
+   reads as a sentence, not a bulleted stack. Without this the
+   generic `strong` rule from the title selector above would
+   bleed in on nested strongs — same pattern as
+   .proposal-wizard__burn-warning > strong. */
+.proposal-wizard__tight-warning p strong {
+  font-weight: 700;
+  display: inline;
 }
 
 .proposal-wizard__schedule {

src/lib/api.js

@@ -1,7 +1,31 @@
 import axios from 'axios';
 
+// Base URL for the anonymous public sysnode-backend endpoints
+// (`/mnStats`, `/mnCount`, `/govlist`). Kept in lockstep with the
+// authenticated client in `./apiClient.js` so a single build-time
+// override (`REACT_APP_API_BASE`) retargets BOTH surfaces at once.
+//
+// Why this matters for governance: the proposal wizard now gates
+// `Prepare` on `fetchNetworkStats().superblock_stats.superblock_next_epoch_sec`,
+// so a hardcoded mainnet URL here means any non-default deployment
+// (local dev, self-hosted backend, testnet/regtest) either pulls
+// the wrong network's superblock cadence or fails CORS entirely —
+// which permanently disables Prepare because `isAnchorLive` never
+// flips true. Codex PR20 round 7 P1.
+//
+// Priority (mirrors apiClient.js):
+//   1. REACT_APP_API_BASE (build-time override for bespoke deployments)
+//   2. Production builds → https://syscoin.dev (the default
+//      hosted backend, same host the authenticated client picks up)
+//   3. Development builds → http://localhost:3001 (backend dev server)
+const DEFAULT_BASE =
+  process.env.REACT_APP_API_BASE ||
+  (process.env.NODE_ENV === 'production'
+    ? 'https://syscoin.dev'
+    : 'http://localhost:3001');
+
 const client = axios.create({
-  baseURL: 'https://syscoin.dev',
+  baseURL: DEFAULT_BASE,
   headers: {
     Accept: 'application/json, text/plain, */*',
     'Content-Type': 'application/json;charset=UTF-8',