[islandbitcoin]

Scope

• Add durable Basic/device account bootstrap with owner-bound provider intent and receipt journal, explicit unknown-outcome refusal, and controlled wallet presentation repair.
• Add authenticated raw owned-wallet metadata for native readiness. Public account UUID and internal wallet owner ID are independently checked.
• Preserve owned Bridge KYC links and binding, identity document signing compatibility, and Earn reward deduplication.
• Fence Bridge withdrawal crypto sends with a majority-journaled attempt and unique unresolved-account index. Ambiguous sends remain pending review; no automatic resend or cancellation. Only exact Bridge payment_processed confirmation can complete them. Legacy ambiguous rows are quarantined.
• Require phone upgrade before device-only TOTP enrollment; make IP lookup failures fail closed for phone/device onboarding.
• Scope CSV exports to the exact requested owned wallets, refuse explicit incomplete/unrepresentable provider results, and escape spreadsheet formulas in text cells while preserving signed numeric amounts.
• Keep private data out of request/registration/ERP/IBEX/GraphQL/HTTP, Firebase push, SMS/email/WhatsApp, Twilio/IP, Fygaro payer-attribution, and API-key application telemetry.
• Route fixed cash Lightning invoice sends to the owned settlement wallet before idempotency, authorization and provider dispatch.
• Bind both IBEX on-chain address mutations to the authenticated active cash checking wallet, route a legacy USD alias to the owned USDT settlement wallet after cutover, and reject invalid or wrong-network provider addresses.
• Bind Bridge transfer receipts to the reviewed customer, source rail and currency, ACH bank destination, and deposit instructions before any crypto debit.
• Freeze the first persisted pending Bridge withdrawal fee snapshot; refuse incomplete, malformed or fee-consuming rows and banks that lose verified status before transfer creation.
• Add a read-only isolated CI lane with dummy credentials and blocked unmocked network I/O.

Verification

• 81 isolated backend suites, 1,297 tests: pass with strict network guard and natural process exit.
• Runner boundary tests: 5 pass.
• TypeScript declarations, whole tree and no-implicit-any, ESLint, spelling, production build and diff check: pass locally. All 14 applicable hosted checks on head 27ceabc passed; mobile compatibility was skipped by its path filter.
• A native App Attest token from SuperMax passed the deployed device route gateway and reached its 422 pre-account validation with no Basic credentials or body. This verifies gateway acceptance only; no account was created.
• No live provider request, account creation, deployment, credential export or financial mutation was run.

Release dependencies

This PR remains a draft. The deployed API at 5740e7d does not provide ownedWalletSnapshot or durable bootstrap. Review the Mongo journal/index migrations and actual Mongo/Redis/Kratos/IBEX behavior under controlled test accounts; reconcile unknown provider intent authoritatively. For Bridge withdrawals, quiesce old writers/reconcilers, verify the named indexes on a Mongo 4.4+ replica set, and provide operator handling for historical/unknown sends before enabling this code. Confirm App Check policy after release, native APNs/FCM delivery, and continuation/support for existing device-only TOTP accounts. IBEX CSV page=0/limit=0 completeness requires provider acceptance. IBEX on-chain address network, owner, cash-cutover credit attribution and the stricter Bridge transfer receipt fields require sandbox acceptance before enabling their native rails; legacy BTC-on-IBEX address calls now fail closed. Bridge withdrawal consent still lacks a bounded accepted amount/source/bank/fee quote, provider debit cap, and authoritative handling of uncertain transfer creation, so native initiation remains disabled. Lightning dispatch still lacks an executable maximum-debit guarantee and provider-bound unknown-outcome reconciliation, so native send stays disabled. The native Basic entry stays unwired until the backend contract is deployed and accepted. Historical telemetry retention and credential rotation require an operator audit.