if the network carries no name, or names one with no deployed
emulator. Fail closed on both counts: the return value ends up in a
covenant leaf that decides who can move the funds, so there is no
defensible fallback. Guessing a neighbour's key (the tb-family share every
other field on Network) would build a leaf co-signed by a service
that will never sign for it — funds locked to a key nobody holds — and
returning an empty string just moves the same failure somewhere harder to
read. A hand-assembled Network carries no name and lands here too,
matching how the per-network timelock floors treat an unnamed network.
Deliberately NOT falling back to whatever key the emulator reports about
itself: that is the self-report this pin exists to stop trusting, and doing
it only on unpinned networks would make the guarantee depend on
network.name with no signal to the caller that it had lapsed. The
unnamed case is the sharp one — a hand-built Network can carry
bitcoin-equivalent parameters, so a silent fallback would drop to
"trust the endpoint" on exactly the input that looks most like mainnet.
Callers who mean it pass resolveEmulatorPubkey's override, which
the thrown message names.
The pinned co-signer key for
network, as 33-byte compressed lowercase hex.