Context
Flip-manifest judgment call #10, deliberately NOT taken in #728 (tracked note in the flip branch's docs/LEGACY-INVENTORY.md, "P11 stage-2 note"), owner decision 2026-08-06: defer as a follow-up.
Post-flip, isNetworkScopedAddressKey + NETWORK_SCOPED_ADDRESS_KEYS/_PREFIXES + the storage providers' network-segment plumbing survive with zero live writers or readers: every scoped entry (OUTBOX, AUTO_RETURN, AUTO_RETURN_LEDGER, swap:, inv_ledger:) belongs to a deleted feature. Chat/identity keys (CONVERSATIONS etc.) are network-agnostic and never rode the mechanism — verified against constants.ts on feat/payments-v2-flip. The payments vertical self-prefixes pv2:{network}:{chainPubkey}: and never touches it.
The machinery is kept alive solely by three test suites (kv-network-isolation, kv-network-isolation-extra, file-storage-network-isolation) that pin the fund-leak guard using the dead key names as witnesses.
The change (guard CONVERSION, not deletion)
- Delete
isNetworkScopedAddressKey, both scoped lists, and the providers' network-segmentation branch.
- Delete the three relic-witness suites.
- Add one replacement test pinning the isolation mechanism that actually protects funds today: same pubkey + same provider + two networks → disjoint
pv2: durable state; a delivery/mint journal entry written under one network is invisible to and never replayed under the other. The fund-leak guard stays continuously in force — it just guards the live mechanism.
- Consumer gate on the exported helper before removal (with a positive control in the same output, per the 2026-08-05 grep-method rule).
Breaking-change assessment (done 2026-08-06)
dApps: none (Connect-invisible). SDK consumers: none in practice (port interface unchanged; no data relocates; only the helper export, gated). End users: no migration. Deferral carries no compatibility cost — the reason to do it eventually is purely that unused guard machinery pinned by dead witnesses is standing legacy.
Refs: #728 (the flip), docs/LEGACY-INVENTORY.md NOT-taken note, residue-audit item S6.
Context
Flip-manifest judgment call #10, deliberately NOT taken in #728 (tracked note in the flip branch's
docs/LEGACY-INVENTORY.md, "P11 stage-2 note"), owner decision 2026-08-06: defer as a follow-up.Post-flip,
isNetworkScopedAddressKey+NETWORK_SCOPED_ADDRESS_KEYS/_PREFIXES+ the storage providers' network-segment plumbing survive with zero live writers or readers: every scoped entry (OUTBOX,AUTO_RETURN,AUTO_RETURN_LEDGER,swap:,inv_ledger:) belongs to a deleted feature. Chat/identity keys (CONVERSATIONSetc.) are network-agnostic and never rode the mechanism — verified againstconstants.tsonfeat/payments-v2-flip. The payments vertical self-prefixespv2:{network}:{chainPubkey}:and never touches it.The machinery is kept alive solely by three test suites (
kv-network-isolation,kv-network-isolation-extra,file-storage-network-isolation) that pin the fund-leak guard using the dead key names as witnesses.The change (guard CONVERSION, not deletion)
isNetworkScopedAddressKey, both scoped lists, and the providers' network-segmentation branch.pv2:durable state; a delivery/mint journal entry written under one network is invisible to and never replayed under the other. The fund-leak guard stays continuously in force — it just guards the live mechanism.Breaking-change assessment (done 2026-08-06)
dApps: none (Connect-invisible). SDK consumers: none in practice (port interface unchanged; no data relocates; only the helper export, gated). End users: no migration. Deferral carries no compatibility cost — the reason to do it eventually is purely that unused guard machinery pinned by dead witnesses is standing legacy.
Refs: #728 (the flip),
docs/LEGACY-INVENTORY.mdNOT-taken note, residue-audit item S6.