[TheDEV111]

This draft adds four default-off integration paths: mobile Chamber/Forge controls, validated inbound links, pre-credit compliance hooks, and durable transaction evidence with signed CSV downloads. It also repairs existing page blockers needed to exercise the requested screens locally.

Not ready to merge: the local implementation and automated checks are reviewable, but the issues' live testnet/native-device/vendor acceptance requirements remain open. No testnet receipt hashes, vendor sanctions integration, universal-link OS verification, production tax filing support, or all-green upstream baseline are claimed.

Closes #483
Closes #484
Closes #493
Closes #494

Mobile layout — #483 / spike 620

• Adds phase-174: visualViewport/100dvh sizing, safe-area clearance, readable phone text, 44px touch targets, scroll containment and reduced-motion behavior.
• Moves Chamber controls into a Radix bottom sheet on phones while preserving desktop composition. Escape closes the sheet and restores focus to its trigger; existing Forge/Chamber overlays retain prompt state and contain phone keyboard focus.
• Uses primary pointer capture for the paint canvas and consolidates the two mobile breakpoint hooks.
• Removes the overlapping floating wallet toolbar on phone cockpit pages and supplies an inline Forge wallet control.
• Repairs pre-existing duplicate declarations, wallet-context ownership, missing Chamber support imports, browser-incompatible nonce generation and first-input WebVitals errors encountered during real browser validation.

Inbound links — #484 / spike 621

• Adds phase-175: a shared strict schema for custom phase://, namespaced stellar://phase/ and same-origin HTTPS collection/offer/quest links.
• Rejects external origins, unsupported SEP-7 payment/transaction payloads, invalid/checksum-failing recipients, duplicate parameters, unsafe IDs and arbitrary callback parameters.
• Persists a versioned 15-minute intent across wallet connection/reloads and stripped queries. Review and navigation do not initiate any transaction. Offer/quest actions require an explicit subsequent click.
• Adds target resolution with live offer expiry/status and quest-enabled checks, target panels, a browser URI-entry fallback, middleware landing rewrites and configured iOS/Android association endpoints.
• Keeps collection parameters available to Chamber's existing metadata/canonical generation. Recipient/referral values are untrusted review context, never signing authority or automatic attribution.
• Guards new offer decisions with signed seller ownership, bounded timestamps, and an atomic pending/active/expiry check; competing decisions return 409/current_status.

KYC/sanctions hooks — #493 / spike 630

• Adds phase-176 and PHASE_KYC_MODE=off|mock|live. Mock mode is testnet-only; live mode uses a configured provider-owned HTTPS sanctions adapter with bounded bodies, a three-second timeout, no redirects/cache, explicit freshness and fail-closed behavior.
• Screens server-computed effective faucet amounts, claim-bounty delegation, bootstrap funding, every trustline operation source, and demo x402 paths before credit/submission. Demo x402 shims cannot establish live payment verification.
• Adds exact-byte timestamped HMAC callbacks, unique event IDs, SQLite CAS versions, keyed wallet/subject hashes and strict rejection of identity-document fields.
• Keeps governance denial, Turnstile, sybil scoring, treasury reservations, 2FA and NFT-view authorization independent. Adds fixed counter names, identity-field redaction, deterministic 403/451/503 codes and Retry-After propagation.
• Provider wallet binding, vendor-specific API adaptation, retention/rotation procedures and shared deployment storage remain deployment acceptance work.

Transaction export — #494 / spike 631

• Adds phase-177: append-only SQLite evidence for confirmed faucet/bootstrap quantities and unverified marketplace agreements. Offer decision, listing state and reporting evidence commit or roll back together; rolled-back records do not increment success metrics.
• Uses stable event keys, exact integer stroops, preserved pending receipt amount/asset provenance, contract IDs stamped at listing creation, and explicit unknown provenance for older records.
• Adds a wallet/network/range/policy/expiry/nonce-bound SEP-53 export proof, single-use nonces, private no-store attachments and 60 exports/minute per authenticated wallet.
• Streams CSV in 50-row pages at a frozen sequence snapshot, orders equal-time events by sequence, quotes/formula-neutralizes arbitrary fields, and adds deterministic chained recomputation hashes.
• Includes FIFO/HIFO selection for recorded indivisible NFT lots, proceeds/gains and royalty columns. Missing basis/fiat FMV/FX are blank and flagged; wash/unverified agreements do not become verified proceeds or income.
• This is explicitly testnet evidence export, not general fungible lot accounting, historical basis reconstruction or a completed 1099-DA filing product.

Migration and rollback

All four flags default off. Public browser flags require a rebuild. Rollback unsets both public/server variables and restarts/rebuilds; new evidence/credential tables remain inert and new APIs return 404 where applicable.

SQLite adds credential/webhook/evidence/export nonce/rate tables, indexes and nullable listing contract provenance. Initialization is idempotent and serialized with BEGIN IMMEDIATE, with the busy timeout established before WAL setup. No WASM, deployed contract, token issuer, signing boundary or signal/CRDT storage migration changes.

The existing per-instance Vercel temporary-storage limitation remains: this branch does not present SQLite/JSON sidecars on separate instances as a shared database.

Validation

• 41 new tests pass, including separate-process writers starting from a fresh database, webhook signature/replay/version checks, malformed/oversized bodies, failure-closed screening, exact-money HIFO/FIFO, CSV pagination/snapshots, wallet-bound export authorization, rollback/metric consistency and flag-off route behavior.
• Existing concurrency/signature/gateway/bulkhead tests also pass in the focused run; 64 storage/migration tests pass after the initialization-race fix.
• Full suite: 555 passed / 54 failed (609 tests). Pristine upstream 11cb3bc9: 514 passed / the same 54 failed (568 tests). No additional failing test cases.
• Type checking: 149 existing diagnostics, reduced from 153; comparison against pristine upstream finds no added diagnostics.
• Browser: Forge/Chamber at 360, 390, 768, 1024 with no horizontal overflow or page errors. Sheet focus, Escape, opener restoration, stripped-query intent recovery, prompt retention, reduced motion and viewport resizing pass.
• All flags off: existing pages return 200 without the new layout; link entry/resolver, webhook, CSV and association endpoints return 404; no browser page errors.
• git diff --check passes.
• Lint cannot run because the repository does not install ESLint (eslint: not found).
• Production build remains blocked by unchanged app/api/notifications/winback/route.ts importing nonexistent addNotification. A successful build is not claimed.

Review material and remaining acceptance

Full file-by-file scope decisions, acceptance gaps, test commands and screenshots

API contracts

Before converting this PR from draft:

• Record a complete public testnet Friendbot → trustline → fund → act → verify → index → UI receipt chain with deployment IDs and hashes. This checkout has no configured signer/provider environment.
• Verify native association IDs/fingerprints and wallet-return behavior on real iOS/Android devices.
• Exercise a real provider sandbox, wallet binding, sanctions freshness/revocation, key rotation and shared durable deployment storage.
• Complete historical receipt/FX/basis reconciliation and any required general lot/1099-DA scope for # Spike 631 — Tax reporting export with cost-basis, proceeds and royalty income CSV #494.
• Record live RPC/Horizon/gateway primary failure injection; local adapter/bulkhead tests are not live outage evidence.
• Resolve or explicitly accept the upstream test/type/build/lint baseline failures.

[drips-wave]

@TheDEV111 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits