[tompro]

Summary

Adopts [email protected] / [email protected] and moves all note-secret generation to BIP-32 derivation from a per-wallet cash root, with atomic per-mint counters, pre-wire durability, and cryptographic verification of landed mutation signatures.

This is an alpha-breaking storage reset: legacy wallet state is wiped on first boot (no migration), and phrase-only restore recreates wallet identity — note inventory and counters come back via file/Nostr backup.

Key material & unlock

• New WalletMaterialV2 envelope persists linking key + BIP-32 cash root together; linking-key-derived identities (owner ID, Nostr, NWC, bearer encryption, backups) are byte-for-byte unchanged.
• Password, passkey, and biometric unlock all bind to the exact canonical material commitment — a same-owner cash-root swap is detected and rejected at enrollment and unlock, including mid-ceremony replacement.

Fund safety

• Single Web-Lock-protected sattle_funds_v2 document (bearers + pending journals + per-host counters + revision): counter reservation and output staging commit in ONE locked write before any mint request; failures write nothing and contact no mint.
• Counters are next-unused per canonical mint host (port included), never reused across crash/retry/restore/concurrent tabs; mutations refuse to run without Web Locks.
• Finalization always adds fresh notes before marking sources spent, in one atomic write.
• File and Nostr backups carry counters and merge upward-only (max); active pending mutations stay device-local.

Recovery & signatures

• Minimal pending-mutation seam for rotate, split, single-batch merge, mint, melt-return, and transfer: staged before wire, idempotent recovery, zero new indices on replay.
• Melt is never replayed (recovery probes/rotates only); rotate/split/merge may replay byte-identically.
• requireSignatures: true / mutationRetries: 1 are enforced centrally and cannot be overridden by callers; landed split/merge signatures are verified against trusted current AND previous mint keys — invalid/missing signatures stay staged, unverified, and recoverable.
• Multi-batch merge rejects before any allocation or network I/O.

Integration

• All UI dialogs and NWC requests await the durable commit before activity entries, toasts, or responses; no production random-secret fallback remains.
• E2E MintMocker now signs rotate/split/merge with stable mock keys and supports an invalid-signature adversarial mode.

Verification

• Unit: 512/512 vitest green (incl. crash matrices, cross-tab fencing, signature cases)
• Typecheck vue-tsc: clean · PWA build: clean · E2E: 28/28 Playwright (4 consecutive runs)
• Manual Chromium QA on 8 representative paths (create/unlock, signed receive/send, Lightning transfer, NWC pay, legacy reset, invalid-signature refusal, stale-tab refusal): zero console errors, zero secret-bearing output (screenshots in .omo/evidence/task-8/)

Deferred (deliberately out of scope)

• Seed-host discovery / restoreFromSeed scanning UI
• Multi-batch merge