chore: development to master promotion

[Seranged]

Summary

Promote development to master with transaction review consistency fixes, reliable vault verification, dependency updates, a Debian 13 runtime image, and configuration documentation.

Transaction safety

• Capture immutable action intents and review presentation before asynchronous preparation across lend, earn, borrow, multiply, swap/refinance, migration, rewards, collateral controls, and repayment flows. Preserve the captured wallet, chain, and form inputs through planning, simulation, and review (Fix transaction review snapshot consistency #847) @dglowinski
• Reuse prepared intents only when their transaction semantics match the freshly captured action; rebuild stale candidates in direct and batch flows. Preserve fresh batch entry identities when reusing prepared work, and retain migration planner deadlines when no typed-data deadline is supplied (Fix transaction review snapshot consistency #847) @dglowinski
• Require ready vault verification data at the final execution-policy boundary, including fallback paths without intents, while preserving allowlisted direct calls with no vault dependencies (fix: correct vault verification chain and failure handling #854) @Seranged

Fixes

• Show the supplying account separately as From Position N or From Deposits in direct and batch reviews, preserving the source context for position-funded and savings-funded repayments (Fix transaction review snapshot consistency #847) @dglowinski
• Verify vaults against the selected app chain so disconnected wallets do not falsely mark verified Earn vaults on networks such as Monad as unverified. Prioritize wallet connection and network switching, then show verification loading or retry states (fix: correct vault verification chain and failure handling #854) @Seranged
• Keep failed label reads unavailable instead of treating them as successful empty verification lists. Preserve successful same-chain snapshots; serve stale server labels during transient failures or return HTTP 503 when no cached data exists, while retaining empty results for absent 403/404 files (fix: correct vault verification chain and failure handling #854) @Seranged
• Keep the automatic Earn warning tied to verification state. Its Yes action dismisses the browsing notice; the form's explicit risk action records the scoped acknowledgment required for execution (fix: correct vault verification chain and failure handling #854) @Seranged

Dependencies and runtime

• Update TanStack Vue Query to 5.102.8, Wagmi Core to 3.6.5, Wagmi Vue to 0.5.30, Wagmi to 3.7.7, and Viem to 2.56.0; align the @wagmi/connectors override with 8.2.0 (chore(deps): bump the all-updates group with 11 updates #851) @dependabot[bot]
• Update Axios to 1.20.0, Vue to 3.5.42, Vue Router to 5.3.0, Node types to 26.4.0, lint-staged to 17.4.1, and simple-git-hooks to 2.14.0 (chore(deps): bump the all-updates group with 11 updates #851) @dependabot[bot]
• Update the production image from gcr.io/distroless/nodejs24-debian12:nonroot to gcr.io/distroless/nodejs24-debian13:nonroot (Update distroless image #853) @girts512

Documentation

• Align environment examples and configuration guidance with the existing runtime: document Merkl authentication, custom-logo and Powered by Euler controls, Turtle configuration, the first-party cookie secret, and ABI source overrides; remove the unused STABLEWATCH_API_KEY example (fix: align environment documentation with current configuration #852) @Seranged
• Correct manifest URL precedence, announcement naming and disabling instructions, Nitro restart versus static rebuild requirements, Nuxt 4 references, and RPC/oracle-assessment comments (fix: align environment documentation with current configuration #852) @Seranged
• Document immutable review snapshots, source-position labels, verification readiness, label-cache failure handling, and browsing versus execution acknowledgment (Fix transaction review snapshot consistency #847, fix: correct vault verification chain and failure handling #854) @dglowinski @Seranged

Validation

• Changelist checked against the net diff from master at 1b00d2834ced891343b81af158c21d91365b4be0 to development at 45af54609d182bc41effb653917a5b83bda0ccf2.
• Covers all five contributing merged PRs: Fix transaction review snapshot consistency #847, chore(deps): bump the all-updates group with 11 updates #851, fix: align environment documentation with current configuration #852, Update distroless image #853, and fix: correct vault verification chain and failure handling #854; 79 files changed, 2,544 insertions, and 1,186 deletions.
• git diff --check passed. Build, tests, and browser validation were not rerun for this description-only update.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: euler-xyz/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Essentials

Run ID: 171240af-caee-4e7e-b7f4-f3abeb98bd13

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[LeonardEulerXYZ]

Review: development → master

Reviewed head 45af54609d182bc41effb653917a5b83bda0ccf2 against master 1b00d2834ced891343b81af158c21d91365b4be0.

No promotion-blocking regression confirmed. COMMENT rather than approval because this PR remains a draft.

Scope

Reviewed transaction forms/pages, rewards, review modals, immutable intent capture, warmed-intent semantic matching, batch identities, migration deadlines; app-chain vault verification, retry/loading, Earn browsing notice, final execution policy, label cache handling; dependencies/lockfile, runtime base and documentation/config changes. Inspected installed SDK 3.1.0 label adapter behavior.

Non-blocking observations

• New source-position label follows the live wallet rather than the reviewed owner; it can disappear on account switch. See inline note. This is presentation drift, not demonstrated transaction rerouting.
• Asset-policy fetch failures are still swallowed inside SDK 3.1.0, returning empty asset restrictions even through the new strict loader. Independently reproduced with the actual SDK URL adapter and HTTP 503 for both asset URLs: base and head both return empty asset-policy maps. This is a pre-existing fail-open gap, not a new promotion regression or a reason to block the narrower vault-verification fix. Track an adapter-level fix and real-adapter regression test separately. Verification readiness should not be interpreted as proof all asset-policy inputs loaded successfully.

Validation

• Dependency installation and Nuxt preparation passed.
• Host Node 26.5.1: lint, typecheck, tests and build passed.
• Node 24.14.1, matching Docker builder: build passed; complete vitest run --maxWorkers=4 passed: 218 files / 2,075 tests.
• First unrestricted Node 24 run hit one useEulerSdk wait timeout; the file passed in isolation (8 tests), then the full four-worker run passed.
• git diff --check passed; clean review checkout.

Boundaries

No live-wallet transaction or mounted-page end-to-end smoke. Docker daemon unavailable, so Debian 13 image not built/run locally. Local build and hosted green checks do not certify production rollout or runtime configuration. Browser-storage replay/exactly-once coordination remains outside the agreed scope.