[lukachi]

The dapp used to build its own transactions against one wallet. It now hands the protocol's own deployed document to whichever of four wallets is connected, and every screen sees the same value whichever that is.

How it worked before

• One wallet, reached directly. Screens named connectors themselves. providers/wallet/ and providers/humid/ were parallel paths from a screen to a wallet, and the connect modal reached each one by hand. Adding a wallet meant another path.
• The dapp assembled the transaction. For each action on a lending offer, code here selected inputs, computed what the covenant required and signed — written against the protocol rather than reading it. A change to the deployed contracts had to be mirrored by hand in this repository.
• The chain lived in the connector's provider. The cached wollet, its IndexedDB namespace, the cross-tab lock, the periodic reread and the reconciliation of a just-broadcast transaction all sat inside the wallet provider, so a second wallet would have needed its own copy.
• Only one wallet could act. Jade, SideSwap and a recovery phrase could connect and show a balance; they could not perform a protocol action.

How it works now

• One facade, four adapters. providers/walletFacade/ is the only thing a screen talks to. Behind it: the HUMID extension, a Jade device, a recovery phrase held in the page for demos, and SideSwap over its relay. Adding a wallet is writing one adapter — never another path from a screen to a connector. connect takes the wallet the person pressed and whatever that wallet needs to start; availability is reported per wallet rather than as one flag; signerType is the connected wallet's own answer.
• Actions come from the protocol's document, not from code written against it. For each action the dapp hands over the deployed manifest, the .simf sources of every covenant involved, the instance the factory published, the state the indexer reports, and the parameters the person chose. The HUMID extension compiles those sources, resolves what the manifest computes for itself, builds the transaction, shows what it will do, signs and broadcasts it. A wallet that signs in the page follows the document's own input rule — an input is either one the wallet finds itself, named by asset and amount, or one located in the deployment's state by its type — and hands the result to the builder that implements that action.
• All eight actions on every wallet. Creating a borrower account, creating an offer, accepting, cancelling, claiming the principal, liquidating, repaying and collecting the lender settlement, through one shared request builder and one shared hook. Each modal and demo page differs only in the action it names. The seven builders moved beside the protocol they build for, because a wallet and a screen both call them now.
• The chain moved behind the facade. The cached wollet, the IndexedDB namespace, the cross-tab lock, the 60s reread with its throttle and focus handlers, the reconciliation of a just-broadcast transaction and the asset-contract stage that lets a device show asset names rather than hashes. It gives back the Rust memory it takes. syncWallet rereads the chain before balances are asked for, which is what the six builders that call it before choosing inputs always meant by it; a reread nobody asked for reaches the screens rather than sitting in the session.
• The account is derived, not guessed. Descriptor derivation asks the chain library rather than guessing at the string, so a connector's already-confidential descriptor is read as it stands and only a bare one is wrapped. scriptPubkey is a real script on all four wallets. What an adapter publishes has the account's own blinding key removed first — anything holding it could unblind every output the account owns — and a descriptor whose key cannot be removed is refused rather than passed on.
• What the screens are told. The confirmed balance is what has confirmed, because only that can fund an action; the receive address is the wallet's own; a device waiting for its PIN reads as locked and gets its unlock screen back; a wallet being approved elsewhere says which request and offers the link and a cancel. The picker offers four cards, each disabled only for a reason true of this browser or this build.

crates/contracts/simf/*.simf ──┐
web/src/protocol/…manifest.json┤
                               │
protocolActionRequest()        │        HUMID ─► compile → verify against chain
  action, params               ├──► facade ─┤        → plan → build → sign → broadcast
  manifest, contractSources    │        Jade / seed / SideSwap ─►
  instance?, state?            │            resolve inputs by the document's rule
                               │            → shared builder → sign → broadcast

The shape is the one Ethereum dapps have with an ABI, with one difference: with the extension, the transaction is assembled in the wallet rather than here.

The seam is checked, not asserted

web/src/test/theSeam.test.ts walks the import graph from the entry point and fails if the running application can reach a superseded module, or if anything above the facade names a wallet directly — however the import is spelled. Modules that became adapters left its superseded list, each departure stated in the test itself, so the list shrinking is a decision that was made rather than a test that was quieted.

Nothing was deleted. What remains superseded is the pre-facade wiring — providers/wallet/, providers/humid/, the old connect modal and account chip, the demo pages written around outpoints they chose, and the borrower-account hook that built the transaction here.

Verified on chain

Liquid testnet, against the deployed protocol.

Action	Transaction
Create offer	e0154712…
Cancel offer	2e089324…
Accept offer	cddc64df…
Claim principal	114c0bee…
Liquidate	1afe98ad…
Repay	b2bbcddd…
Lender settlement	793d73d7…

Creating a borrower account on a wallet that signs in the page is proven by transaction 61d9833f at block 2590033. The other seven actions on a signing wallet await a recorded manual run; the extension path is the one confirmed in the table above.

Gates

tsc -b, eslint, prettier --check, vite build and 143 tests pass at zero warnings. The protocol check confirms both program ids still match the contract sources in this repository. Two adversarial reviews over five rounds broke seventeen things with executable tests; every one is fixed here, and forty-five stubs of this code fail a suite that used to stay green under them.

Two known limitations

Neither is introduced by this change; both are properties of the wallet it talks to, and both are recorded rather than worked around.

• A contract action can only be funded from unblinded outputs at the wallet's signing address, so an account funded the ordinary way holds a balance the protocol cannot reach until it sends itself an unblinded output.
• The principal is paid out confidential by the deployed document's own declaration, so a borrower changes its form before repaying.

[lukachi]

Reopened against upstream: BlockstreamResearch#162. This fork was the wrong base — closing here so review happens in one place.