[dunnie99]

Description

Implements guardian-based account access recovery (#535) and platform-internal peer-to-peer transfers (#546) in separate commits. Recovery adds explicit guardian acceptance, quorum approvals, a fixed 72-hour delay, owner cancellation, notifications, audit logging, and session/credential invalidation on completion. Transfers resolve users by public referral handle and atomically reassign unlocked Position balances, preserve available tax-lot basis, apply compliance scoring, and record audit events without submitting an on-chain transaction.

Related Issues

Closes #535
Closes #546

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Refactoring (no functional changes)

Checklist

• My code follows the existing code style of this project
• I have run npm run lint with no errors (targeted ESLint passed; full command not run)
• I have run npm run typecheck with no errors
• I have added tests that prove my fix/feature works
• All new and existing tests pass (npm test) (focused tests passed; full command not run)
• I have updated documentation accordingly

Database Migration (only if prisma/migrations/** changed)

Class (A metadata / B blocking DDL / C backfill / D irreversible): B / C — includes validated foreign keys and non-concurrent indexes, plus a backfill and NOT NULL change for the recovery auth key.

Backup taken (snapshot identifier, or n/a for class A): No backup taken. A verified snapshot and pg_dump are required before deployment.

Downtime impact

• Locks taken: ACCESS EXCLUSIVE and index-build locks

• Expected lock duration: Not measured; depends on production table size and database load.

• Writes blocked during migration: yes

• Requires traffic drain: yes

• Rollback tier: 2 before transfer history exists; 3 (snapshot restore) after transfer history is recorded because rollback refuses to discard it.

• rollback.sql ships in the same commit and is idempotent (rollback scripts ship; idempotency has not been verified)

• Rollback rehearsed with bash scripts/rehearse-migration-rollback.sh (not run; requires a rehearsal database)

• Added columns are nullable or defaulted (the recovery auth key is backfilled and made NOT NULL)

• Indexes on request-path tables use CREATE INDEX CONCURRENTLY (indexes are not concurrent)

• Previous application version still works against the new schema (not verified)

[drips-wave]

@dunnie99 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits