frontend sweep, round three: one reload per change, token facts on the wire, dead transport, identity readiness, dead exports

[cryptskii]

Frontend sweep, round three. Five verified chunks, each its own commit with a CONFORMANCE_GAPS.md §6.29 row, tests and mutation or gate controls. All frontend; one proto change; one Kotlin arm deleted.

1. One reload per announced change (7987158c9)

useWalletRefreshListener's "cooldown" counted dropped events, not frames: after any reload the next 119 low-priority wallet.refresh events were discarded, so the provider and the wallet screen had grown raw inbox.updated / bilateral.transferComplete subscriptions beside it and reloaded three to four times per event when the gate was open. Now the listener coalesces onto a frame, runs one reload at a time and owes exactly one more for events mid-reload; nothing is dropped, no priority classes; the raw subscriptions and the provider's second reload on wallet.bilateralCommitted are gone; the event bridge's wallet.refresh claiming bilateral.transfer_complete on one BLE prepare response in eight is gone. The accept path's staggered re-reads stay, named bilateral.accept_followup (Open: a device run decides whether Rust's TRANSFER_COMPLETE announcement alone suffices).

2. A balance row carries what its token is and what its policy fixes and permits (e1c0708bd)

AccountsScreen carried its own table of what ERA and dBTC are (a "DJTE emission token" type, an invented anchor formula, a supply figure) and decided protocol-ness from the ticker text. Rust now reports on each BalanceGetResponse: protocol_defined (12), genesis_supply_display (13; ERA's is the native reserve's genesis supply), and permissions (14, a TokenPolicyPermissions sub-message, absent — never defaulted — where Rust holds no committed policy; ERA's blob is the §6.32 hole). A registered token's row is checked against its own verified policy bytes and refused if it disagrees. CPTA_INFO is deleted; BURN is offered only where the policy permits it; the Rust→TS wire fixture carries the new fields.

3. Dead transport paths (8aca54105)

isNativeHostUnavailableError (no caller), processEnvelopeV3Bin / buildEnvelopeIngressRequest (an envelope ingress op no production code sends), phantom test-bridge getters and stub arms for getSigningPublicKeyBin (deleted with #1012). ci/bridge_rpc_names.py now refuses a test stub arm for any name Kotlin does not handle.

4. Identity readiness (5994ccbb0)

getIdentity answered null for three different reasons and waited its whole ~5.75 s window on a device with no identity. It now answers the identity or throws IdentityUnavailableError with its state: missing (Rust's word, the native session, answered at once), runtime_not_ready, or read_failed (with the reason). The wallet store treats missing as a state (uninitialized, no error) and the other two as errors; diagnostics print the state; useTransactions asks the native session. isReady / getDeviceIdentity are deleted.

5. Production exports nothing calls (3fa3e830a)

Five whole modules (dsm/crypto.ts, dsm/nfc.ts, vectors/, policyScanService.ts, utils/binary.ts) and fourteen functions with no production reference — among them loadPersistedBleMappings, a documented no-op, and useUXTerms, which answered the key it was asked for. Also the WebView's startup-boundary path end to end (TS functions, the index.html startup wrapper, the AndroidBridgeV3 member, a test-setup stub arm, Kotlin's nativeBoundaryStartup arm): Kotlin crosses the startup boundary itself at app start; the frontend never sent it. Exports referenced only by tests are recorded Open for an export-by-export sweep.

6. Production exports kept alive only by tests (fb4d9a511)

A second balances decoder beside the one getAllBalances uses, encodeEnvelope, an event encoder production never encodes with, parseBinary32/64, the BLE cache's clear/prune, a second history reader, getBluetoothStatus, the policy display mapper and its module, six wallet-store selector hooks, decodeBase32Crockford32, FX_ANIMS, and the session store's …ForTest setters — deleted with the tests of them (48 tests of dead code; one "reproduction" test mimicked the balance mapper with its own fallback and console.log). The event encoder moves to tests/helpers/, a harness the tests own; the session store and BLE cache tests drive the production input and get a fresh module per test. The accept path dispatched the committed signal twice (a window event the adapter re-emitted, and the bus again): once now, through emitBilateralCommitted.

7. The wallet screen reads the one wallet store (728bbcd68)

The wallet screen held its own copies of balances and history beside the provider's store and reloaded them, with the identity and the contacts, on every wallet.refresh — two reads each of balance.list and wallet.history per change. It now reads balances and history from the store (the one copy, reloaded once per change in the provider); the tabs take TokenBalanceView and the private Balance type is gone. The screen owns the identity (read once, or the reason it was not) and the send tab's contacts with their send-readiness, re-read when the contacts store reports a change and on a manual refresh. The overview says "Loading balances…" while the store has not answered. The wallet screen tests mount the screen inside the wallet provider, as the app does; the "one inbox sync reloads once" test now counts the store's one reload with the screen adding none.

8. One contact shape, in the contacts store (89cd72996)

Two mappers read Rust's contact list into two shapes — the contacts store's Contact for the contacts screen and mapContactList's DomainContact (signing key, genesisVerifiedOnline, the normalised or session-resolved BLE address, the send-readiness Rust reports) for the send tab — so the wallet screen kept its own copy of the contacts. The store now maps with mapContactList into DomainContact, the one shape every screen reads; Contact and mapContacts are gone; the wallet screen reads the store's contacts and re-reads nothing of its own; a manual refresh reloads both stores.

9. The native lifecycle topics reach the bus directly; the DOM hops nothing dispatched go (4811e405b)

The adapter re-emitted seven DOM events on the bus that nothing ever dispatched (dsm-history-updated, dsm-balances-updated, dsm-wallet-send-committed, dsm-contact-added, DSM_PORT_TX, DSM_PORT_RX, DSM_UI_TICK), and useWalletSync, the contacts provider, the contacts screen and the loading spinner subscribed to what they would have produced — reloads and an activity indicator that could never fire. The lifecycle topics went DOM → adapter → bus, and getIdentity's early wake-up listened on window for dsm-identity-ready, dispatched on document, where it never arrived — so the cold-start wait always ran its full delays. Now the event bridge emits identity.ready, wallet.refresh (native) and env.config.error on the bus directly; the adapter keeps only visibilitychange; getIdentity wakes on the bus event; the seven hops, their bus types, useWalletSync, DSM_WALLET_REFRESH_EVENT and two listener-less fan-outs are gone. Three BLE/biometric window events with no frontend listener stay, recorded Open (device automation may read them).

10. A subscription names an event the bus carries (a02d1b0fd)

useBridgeEvent took any string, so subscriptions to events nothing can emit compiled: two toasts and a ble.features.enabled handler (not even a bus event) that together drove a bleFeaturesDisabled flag gating every BLE call, never settable; two BLE advertising events emitted with no consumer left; nfc.writeStarted with neither. BleContext provided a context nothing consumed since useBle went. The name is now keyof BridgeEventMap — a subscription to a name the bus does not carry does not compile (control: one added to a provider fails tsc naming the file) — and the dead subscriptions, flag, gate, emits, types and BleContext are gone. wallet.exitCompleted (Bitcoin's exit flow, subscribed to in three places, emitted by nothing) is left alone.

Verification

Each chunk: tsc, lint, the touched suites, mutation or gate controls (named in §6.29 and the commit messages). On the tip: make lint and the production-safety lints (chunk 2), the dsm_sdk release wallet_routes tests on Postgres (chunk 2), jest 777/777 across 116 suites, npm run build, the Kotlin main / androidTest / unit-test compiles (chunk 5), and the purity, flow, scan, bridge, codegen, proto and bridge-RPC-name gates.

Still Open (§6.29)

BLE priming and the accept follow-up cadence (device run); SofiScreen §28 (the SoFi track); recovery.status key=value (dependency boundary); index.html's 30-minute timer and response/event discrimination (device); the androidTest claimFaucet zero schema_hash; dsm-biometric-result / bluetooth-permissions / ble-dev-automation window events with no frontend listener (device automation may read them).