[jlwaugh]

ADR 2's funding slice, on the proposals page through the app server.

• Server: GET …/treasury (treasury/get) and GET …/account (account) as owner reads; POST …/deposit (USDC, or NEAR as wNEAR) for anyone who may file proposals; POST …/treasury/link, …/unlink, …/confidential for a wallet owner, each relayed once and audited. A DAO agent's funding account is the DAO, fixed at setup: a member's change is dao_funding_fixed whatever their roles (a member with every DAO permission passes mayCall). The platform's refusal is funding_refused, its text logged.
• Page: a Funding section once connected. Money in asks for a fresh deposit address, builds the transfer with the SDK's fundingTransaction in place of treasury/fund, checks and shows it exactly, reads the funding account again, then the owner's wallet sends it or Trezu files it as the DAO's proposal; after an answer the wallet doesn't give, it isn't offered again. A confidential DAO pays from Trezu to the agent's nearcom: wallet. Receive funds gives a one-time deposit address.
• Tests: server unit (funding routes, refusals, audit, DAO roles); stack: a wallet owner links, reads, gets a USDC address and unlinks; the DAO's council reads the DAO as its account and is refused a link; browser: the wallet owner sends exactly the reviewed transfer, and Trezu files exactly the reviewed transfer as the DAO. The stack takes USDC deposits only and answers the agent's wallet as the address, so NEAR and fresh addresses are the unit tests'. Both browser suites check accessibility with reduced motion.