perf: stabilize swap quote, Stock cold-start, and execution lifecycle

[zhaono1]

Summary

This Draft hardens the Swap V2 quote, Stock cold-start, and execution lifecycle. It prevents stale or cross-owner data from becoming visible or executable, preserves V1 rollback contracts, and keeps display continuity separate from transaction authority.

• add surface-scoped ordinary SSE and speed-quote sessions with request/revision ownership, generation/sequence validation, and exact cancellation
• separate streaming candidates, committed display quotes, and executable quotes; retain same-display-intent values during refresh while immediately revoking execution ownership
• bind Stock BUY/SELL display and execution state to the exact account, token pair, side, quote session, and intent revision
• accept only complete cold-start token pairs and block quoting until current-launch network, token sync, account storage, active account, and address resolution are ready
• key balance/token-detail requests by semantic owner and revision, preventing late account/token/address results and old finally handlers from overwriting current state
• preserve V1 RPC/event contracts for rollback compatibility

Review and execution hardening

The commercial review follow-up closes execution-sensitive gaps in the committed V2 path:

• freeze Review execution inputs and reject continuations after account, session, quote, intent revision, or review revision changes
• enforce a 30-second maximum Stock quote execution age while leaving ordinary Swap behavior unchanged
• recheck authoritative market state immediately before direct message signing, direct broadcast, gas-account fallback broadcast, and final TxConfirm signing
• keep a single submit lease across asynchronous TxConfirm preflight/signing and prevent an unmounted or cancelled page from starting the signer after preflight resolves
• recheck Stock state in bg between a multi-tx approval broadcast and the later swap signing; an explicit market close blocks the swap while preserving the already-broadcast approval checkpoint
• preserve the existing x fail-open contract when market-detail transport is unavailable; only an authoritative isOpen === false blocks execution
• make review dialog lifecycle cleanup idempotent and prevent delayed callbacks from an old review from closing or mutating a newer review
• remove the branch-added Stock lazy container and use the established direct container path

Stock closed-market and cold-start behavior

• an explicitly closed market pauses Stock quote transport without disabling the amount input
• closing the market cancels the active V2 quote session, clears only the derived receive value, and preserves the input draft/provider/execution pair ownership
• estimated receive settles to -- instead of showing a fake skeleton when no quote request is active
• reopening the market issues exactly one quote for the latest amount and current settings
• prewarm the exact current Stock/pay-token images separately from the global image budget
• read the dedicated Stock snapshot only for an active, fresh Stock cold entry; ordinary app startup performs no Stock-store read
• on iOS, wait at most 80 ms for missing critical Stock images; decoded refs, Android, non-Stock, and inactive Stock entries add no mount delay
• keep an exact, fresh balance snapshot for presentation continuity while execution and Max remain live-balance-only

Runtime ownership

• main JS owns readiness, semantic intent, visible quote commit, balance ownership, frozen Review state, and the current execution lease.
• bg JS independently owns EventSource/AbortController resources, per-surface session registries, and the final multi-transaction signing boundary.
• Main and bg exchange serialized envelopes; the implementation does not assume shared JS objects or initialization order. Native storage remains shared underneath, while hydrated JS copies are per runtime.

Verification

• reviewed against origin/x@8913f5a5253c40dd52ae7c07bce92999b1fc809d
• final head: a02659ee259f921125cac4a2fd82f7b91aa2471d
• 23 targeted Jest suites / 357 tests / 0 failures
• independent test-oracle audit against x, including BUY/SELL, wrong-owner, ordinary Swap isolation, stale async results, exact TTL boundaries, and real component wiring
• mutation checks prove the multi-tx tests fail if the final market check, receiver-side Stock lookup, or x-compatible fail-open behavior is removed
• yarn agent:check --profile commit: PASS for lint, format, agent context, staged lint, and staged TypeScript
• latest-head GitHub checks: PASS for lint, all three unit-test shards and aggregate, CodeQL, native/web startup budgets, Snyk, Socket, and supply-chain minimum release age
• git diff --check: PASS

iOS runtime validation

• closed-market amount input remained editable and accepted input
• after the market closed and after typing, there were zero requests to /swap/v1/quote/events, /swap/v1/quote/speed, and /swap/v1/quote-market/speed
• the first Stock-rendered frame captured 50 ms after contact already contained the Stock/pay-token icons, network badges, and balance; no blank-icon or grey balance-skeleton flash was observed
• closed-market estimated receive rendered -- without a skeleton
• excluding development Metro bundle download, the observed native-launch-to-JS gate was approximately 1.27-1.28 seconds
• no transaction was signed or sent during runtime validation

Review status and remaining release gates

The implementation has no known P0/P1 review findings and all latest-head checks pass, but the PR remains Draft / Review Required. Remaining commercial release gates:

• real-device hardware/QR/native signing validation, including controlled approval + swap and cancellation paths
• controlled real-asset validation for single-tx and multi-tx broadcast/checkpoint behavior
• final Release-build cold-start benchmark; the local full Xcode rebuild was blocked by an AssetCatalogSimulatorAgent handshake failure, while the already-installed simulator runtime was validated successfully
• broader Web, Extension, Android, and multi-wallet quantitative benchmarking
• production telemetry, feature flag/remote kill switch, and server-side execution fingerprint/expiry enforcement
• follow-up decomposition of the large useSwapBuiltTx owner to reduce maintenance and rollback risk

Review score after the final fixes: 8.7/10 for the implementation approach and 8.4/10 for commercial merge readiness.

[zhaono1]

Closing as superseded by a narrower A+ implementation rebuilt from x. The replacement will focus on Swap/Stock cold-start presentation, one quote lifecycle owner, stable action state, and an immutable Review handoff; build/sign/send, Market, Private Send, and reset/storage hardening are intentionally deferred. The existing branch is retained as a read-only implementation reference.