Release: develop -> main

.coverage-visibility-allowlist

@@ -0,0 +1,30 @@
+# Coverage visibility allowlist — see scripts/check-coverage-visibility.sh.
+#
+# In-scope .dart files that legitimately produce NO coverable lines, so they
+# never emit an `SF:` record in the scoped tracefile and would otherwise trip
+# the visibility gate. Every entry here is a pure abstract interface / port, an
+# enum, const-only data, or a Drift table schema — there is no executable body
+# to cover.
+#
+# This is a ratchet: a NEW in-scope file that carries no coverage fails the
+# build. Fix it by adding a test that exercises it (preferred). Only add a line
+# here if the file genuinely has no coverable lines, and say why in a comment.
+# Blank lines and `#` comments are ignored. Paths are repo-relative.
+
+# Abstract interfaces / ports (implementations live elsewhere and are tested):
+lib/packages/io/backup_exclusion_port.dart
+lib/packages/io/documents_directory_port.dart
+lib/packages/service/biometric/biometric_port.dart
+lib/packages/service/price_service.dart
+lib/screens/kyc/steps/ident/cubits/kyc_ident/sumsub_ident_port.dart
+
+# Enums (no bodies):
+lib/packages/service/biometric/biometric_auth_outcome.dart
+lib/packages/service/dfx/models/payment/payment_info_error.dart
+lib/screens/restore_wallet/cubit/validate_seed/validate_seed_state.dart
+
+# Const-only data (covered as values by default_assets_test.dart, no lines):
+lib/packages/utils/default_assets.dart
+
+# Drift table schema (column getters carry coverage:ignore-line):
+lib/packages/storage/node_storage.dart

.github/workflows/golden-regenerate.yaml

@@ -37,19 +37,38 @@ jobs:
   regenerate:
     name: Regenerate golden baselines
     runs-on: [self-hosted, macOS, ARM64, m3-ultra, realunit-app]
-    timeout-minutes: 30
+    # Same reasoning as `golden-tests` in `pull-request.yaml`: the old 30 was
+    # sized for the cache era (~18 minutes of stalled Actions-cache overhead).
+    # Regeneration is that same workload plus a commit+push, so 15 minutes
+    # still leaves room for a cold Flutter SDK download, and it frees this
+    # repo's single self-hosted slot far sooner when a run wedges. Keep the
+    # two jobs' timeouts in sync, like the rest of their setup.
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
         with:
           # Explicit token so the later `git push` is authenticated. Without
           # this, checkout still works but the remote is configured with no
           # credential helper and the push fails with HTTP 403.
           token: ${{ secrets.GITHUB_TOKEN }}
+          # Single-slot runner can start minutes after dispatch. Default
+          # checkout pins github.sha (stale by then); render against that
+          # tree and the later push is rejected because the branch tip has
+          # moved. Checkout the live head instead (github.ref_name — the
+          # dispatched branch; workflow_dispatch always runs with --ref
+          # <branch>) so baselines match the tree they get committed to.
+          ref: ${{ github.ref_name }}
       - uses: subosito/flutter-action@v2
         with:
           flutter-version: "3.41.6"
           channel: "stable"
-          cache: true
+          # Self-hosted runner already keeps the Flutter SDK persistently
+          # under `_work/_tool` across runs. The Actions cache restore on
+          # this runner stalls at 0.5-0.8 MB/s, times out after the 10
+          # minute segment timeout, falls back to a cache miss anyway,
+          # then burns ~8 minutes on a cache-save — ~18 minutes of pure
+          # overhead that returns nothing useful here.
+          cache: false
       - run: flutter pub get
       - run: dart run tool/generate_localization.dart
       - run: dart run tool/generate_release_info.dart
@@ -75,9 +94,13 @@ jobs:
             exit 0
           fi
           git commit -m "test(goldens): regenerate baselines on the self-hosted runner"
-          # On protected branches (develop/main) this fails by design.
-          # The next step uploads the PNGs as an artifact so the user can
-          # still recover the regen output.
+          # Protected branches (develop/main): fails by design — no force-push,
+          # no bypass. Feature branches: after the ref: fix above this should
+          # normally succeed. If the branch still moves between checkout and
+          # push (now a seconds-wide window), fail loud; the fallback artifact
+          # step below still uploads the PNGs. Recovery: re-dispatch (cheap).
+          # Do NOT rebase or force-push — that would publish baselines that no
+          # longer match the tree head they were rendered against.
           git push
 
       # Runs only if the push step failed. Uploads the regenerated PNGs so

.github/workflows/handbook-build-check.yaml

@@ -1,8 +1,32 @@
 name: Handbook Build Check
 
-# PR-only build verification for Dockerfile.handbook + the Goldens-assembled
-# screenshots. Does NOT push to Docker Hub and does NOT deploy — that
-# remains the job of handbook-deploy.yaml (staging push → DEV, develop push → PRD).
+# PR-only build verification for the handbook CONTENT. Gates four things
+# before a staging merge, all pure content checks with no live deploy:
+#   - screenshot-assembly: scripts/assemble-handbook-screenshots.sh runs and
+#                           produces the expected PNG count
+#   - store-listing sync:  scripts/assemble-handbook-store-listing.py output
+#                           matches the committed handbook (+ its HTML
+#                           sanitizer strips injection payloads)
+#   - legal-sync:           scripts/assemble-handbook-legal.py output
+#                           matches the committed handbook
+#   - image build + container smoke:
+#                           `docker build` (no push) + a container smoke
+#                           test: /healthz answers and /de/ sits behind the
+#                           auth wall. The HTTP probes do not establish
+#                           per-file existence (the auth gate answers 401
+#                           before nginx ever looks a file up): screenshots
+#                           are proven by their explicit count guard above,
+#                           legal downloads by build-legal-downloads.sh's
+#                           fail-fast per-base existence check during the
+#                           image build
+#
+# Does NOT check out DFXswiss/api or RealUnitCH/web (those only happen in
+# the real build inside handbook.yaml) and does NOT push to Docker Hub or
+# deploy — that remains the job of handbook-deploy.yaml (staging push →
+# PRD). The paths filter below mirrors the CONTENT inputs of the handbook
+# image plus this workflow itself; the deploy WIRING (SSH, secrets,
+# server rollout) are exercised exclusively by the deploy run, not by this
+# check.
 #
 # Path filter covers everything that goes into the handbook image:
 #   - docs/handbook/**            handbook HTML, README, en/de subtrees
@@ -68,8 +92,8 @@ jobs:
           set -euo pipefail
           bash scripts/assemble-handbook-screenshots.sh /tmp/handbook-shots
           count=$(ls -1 /tmp/handbook-shots/*.png | wc -l | tr -d ' ')
-          if [ "$count" != "61" ]; then
-            echo "expected 61 screenshots, got $count" >&2
+          if [ "$count" != "279" ]; then
+            echo "expected 279 screenshots, got $count" >&2
             exit 1
           fi
 
@@ -149,11 +173,11 @@ jobs:
             exit 1
           fi
 
-          # Screenshots dir must contain all 61 PNGs assembled from Goldens.
+          # Screenshots dir must contain all 279 PNGs assembled from Goldens.
           # Hit one of them through the auth gate to verify wiring end-to-end.
-          # Mix of original 01-26 range + new 27-61 range so a regression
-          # in either half surfaces here.
-          for name in 01-welcome 11-dashboard 26-terms 35-dashboard-with-balance 46-buy-kyc-required 52-sell-unknown-error 53-buy-payment-details 61-kyc-registration-tax-tin-error; do
+          # Mix of the original 01-61 range and the 62-269 batch (every Golden
+          # baseline) so a regression in either half surfaces here.
+          for name in 01-welcome 11-dashboard 26-terms 35-dashboard-with-balance 46-buy-kyc-required 52-sell-unknown-error 53-buy-payment-details 61-kyc-registration-tax-tin-error 62-welcome-page-android 219-settings-security-page-default 268-phone-number-field-default 269-dashboard-insider-unlocked; do
             code=$(curl -s -o /dev/null -w '%{http_code}' -u "${HANDBOOK_USER:-x}:${HANDBOOK_PASS:-x}" "http://127.0.0.1:8080/screenshots/${name}.png")
             # 200 (auth happens to match) or 401 (auth fails but file exists)
             # both prove the file is on disk. 404 means it was not assembled.

.github/workflows/handbook-deploy.yaml

@@ -1,88 +1,51 @@
 name: Handbook CI/CD
 
-# Per-branch handbook deploy pipeline, one environment per branch:
-#   push to `staging` → build from staging → deploy DEV  (dev-handbook.realunit.app)
-#   push to `develop` → build from develop → deploy PRD  (handbook.realunit.app)
+# Handbook deploy pipeline: a push to `staging` deploys directly to PRD
+# (handbook.realunit.app). There is no separate DEV environment anymore —
+# the former dev-handbook.realunit.app instance is deliberately
+# decommissioned and no longer served.
 #
-# DEV and PRD are independent runs keyed by the pushed branch; they no
-# longer share a single run that fans out to both. The "DEV is green before
-# PRD ships" guarantee is now provided by the branch-promotion flow itself:
-# handbook content reaches `develop` only after it has been on `staging`
-# (auto-staging-pr.yaml opens the staging → develop PR), i.e. after it was
-# built and smoke-tested on DEV. Promoting to develop is what triggers PRD.
-#
-# This is a deliberate dev/prd-coupling exception scoped to the handbook
-# alone — the wallet app itself still follows the strict develop→main
-# separation.
+# This also means the previous "DEV is green before PRD ships" guarantee is
+# gone by design. The safety net for handbook CONTENT is now the PR check
+# (handbook-build-check.yaml), which runs on every handbook-relevant PR —
+# it gates screenshot-assembly, store-listing sync, legal-sync, and an
+# image build + container smoke test, not the deploy WIRING itself (SSH,
+# secrets, server rollout), which only the actual deploy run here
+# exercises. There is no intermediate staging-only deploy left to catch
+# problems before PRD sees them.
 #
 # All build/deploy/smoke logic lives in the reusable workflow
-# .github/workflows/handbook.yaml. This file only wires the per-env
-# parameters (source ref, image tag, smoke URL, deploy secrets) and routes
-# the pushed branch to its environment via the per-job `if:` guards below.
+# .github/workflows/handbook.yaml. This file only wires the PRD parameters
+# (source ref, image tag, smoke URL, deploy secrets) and gates the single
+# deploy job on the pushed branch via its `if:` guard below.
 
 on:
   push:
-    branches: [staging, develop]
-    paths:
-      - "docs/handbook/**"
-      - "test/goldens/screens/**"
-      - "scripts/assemble-handbook-screenshots.sh"
-      - "scripts/assemble-handbook-store-listing.py"
-      - "scripts/templates/store-listing.html.tmpl"
-      # Store-listing section is baked into the image from the Fastlane
-      # metadata; a metadata- or screenshot-only change must redeploy too.
-      - "ios/fastlane/metadata/**"
-      - "ios/fastlane/screenshots/**"
-      - "android/fastlane/metadata/**"
-      - "Dockerfile.handbook"
-      - "handbook.nginx.conf"
-      - "handbook.htpasswd"
-      - ".github/workflows/handbook-deploy.yaml"
-      - ".github/workflows/handbook.yaml"
+    branches: [staging]
   workflow_dispatch:
 
 permissions:
   contents: read
 
-# One concurrency lane PER BRANCH so a staging (DEV) deploy and a develop
-# (PRD) deploy never serialize against — or cancel — each other. Within a
-# single lane a manual workflow_dispatch still can't race a push: both would
-# build the same env's tag in parallel, the later build would win on Docker
-# Hub, and the target server could pull either depending on timing.
-# cancel-in-progress is false so a mid-rollout deploy is never killed (we'd
-# otherwise risk recreating the container halfway through).
+# One concurrency lane (keyed by branch) so a push and a manual
+# workflow_dispatch on the same branch never race — or cancel — each other:
+# both would otherwise build the same :latest tag in parallel, the later
+# build would win on Docker Hub, and the target server could pull either
+# depending on timing. cancel-in-progress is false so a mid-rollout deploy is
+# never killed (we'd otherwise risk recreating the container halfway
+# through).
 concurrency:
   group: handbook-deploy-${{ github.ref_name }}
   cancel-in-progress: false
 
 jobs:
-  # Push to staging → DEV. Distinct image tag (:beta) from PRD (:latest) so a
-  # staging build can never clobber the develop build on Docker Hub (both
-  # used to push :beta, which raced whenever the two branches were pushed
-  # close together).
-  deploy-dev:
-    if: github.ref_name == 'staging'
-    uses: ./.github/workflows/handbook.yaml
-    with:
-      environment: DEV
-      ref: staging
-      docker_tag: dfxswiss/realunit-app-handbook:beta
-      smoke_url: https://dev-handbook.realunit.app/healthz
-    secrets:
-      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-      DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_DEV_SSH_KEY }}
-      DEPLOY_SSH_KNOWN_HOSTS: ${{ secrets.DEPLOY_DEV_SSH_KNOWN_HOSTS }}
-      DEPLOY_USER: ${{ secrets.DEPLOY_DEV_USER }}
-      DEPLOY_HOST: ${{ secrets.DEPLOY_DEV_HOST }}
-
-  # Push to develop → PRD.
+  # Push to staging → PRD.
   deploy-prd:
-    if: github.ref_name == 'develop'
+    if: github.ref_name == 'staging'
     uses: ./.github/workflows/handbook.yaml
     with:
       environment: PRD
-      ref: develop
+      ref: staging
       docker_tag: dfxswiss/realunit-app-handbook:latest
       smoke_url: https://handbook.realunit.app/healthz
     secrets: