Implemented the next deposit-observation step without activating live deposits

docs/canonical-indexes.md

@@ -16,7 +16,7 @@ Status: implemented local infrastructure, **not full M2 acceptance or production
 
 ## Tests and measurements
 
-The final Docker test-target build passed TypeScript/Vite compilation. All **182 offline tests passed, zero failures/skips**, including native RandomX multi-process HTTP/peer/restart, backup rehearsal and four offline Monero observer contract/security tests. The focused market suite passed **27 tests**, and the disposable PostgreSQL suite passed **31/31** in the previous run.
+The final Docker test-target build passed TypeScript/Vite compilation. All **183 offline tests passed, zero failures/skips**, including native RandomX multi-process HTTP/peer/restart, backup rehearsal and five offline Monero observer contract/security tests. The focused market suite passed **27 tests**. The disposable PostgreSQL suite most recently passed **33/33**, including v1→v2 schema migration and observation persistence.
 
 - indexed ownership/sequence versus full replay for transfers, multi-card trades and forks;
 - append/disconnect/reconnect ordering, side-branch/mempool exclusion, bounded defensive-copy pages and durable restart;

docs/custodial-market-design.md

@@ -19,7 +19,7 @@ The operator has authorized proceeding with implementation instead of the previo
 
 **Financial storage update:** [ADR 003](postgres-financial-storage.md) selects PostgreSQL and records the integrated asynchronous custody backend, restricted runtime/schema roles, deferred accounting constraints, explicit SQLite freeze/import, and full dump/restore rehearsal. SQLite remains an opt-in-compatible local sandbox default, not an automatic fallback. Real custody and production operating acceptance remain blocked.
 
-**Read-only Monero observer prototype:** [server/market/monero-observer.ts](../server/market/monero-observer.ts) defines a narrow mainnet wallet-RPC client for primary-address network check and bounded incoming-transfer scans. It requires an explicit protected config file and observer opt-in, uses authenticated requests with strict HTTPS/loopback-only HTTP, no redirects, bounded response/deadline, JSON-RPC request-ID validation and lossless JSON integer handling. The module exposes no subaddress creation, credit posting, transfer construction, relay, sweep or withdrawal operation and is not wired into application startup/routes. Fixture tests cover uint64 preservation, malformed/oversized responses, wrong RPC IDs and unsafe endpoint schemes. No wallet endpoint, credentials or funds were accessed. This is preparatory read-only plumbing, not live deposit crediting or an approved mainnet switch.
+**Read-only Monero observation groundwork:** [server/market/monero-observer.ts](../server/market/monero-observer.ts) defines a narrow mainnet wallet-RPC client for mainnet primary-address verification and bounded incoming-transfer scans. It requires explicit opt-in and a protected external config file, uses authenticated requests with strict HTTPS/literal-loopback-only HTTP, no redirects, bounded response/deadline, JSON-RPC request-ID validation and lossless JSON integer handling. Each observed transfer includes its validated destination address. It exposes no subaddress creation, credit posting, transfer construction, relay, sweep or withdrawal operation and is not wired into server startup/routes. [server/market/monero-observation-store.ts](../server/market/monero-observation-store.ts) persists scan manifests, exact incoming-transfer observations, cursor progress and append-only seen/changed/not-seen/reappeared events in PostgreSQL schema v2, restricted to a dedicated observer DB role separate from the custody API runtime. Confirmation growth updates a projection without emitting an event every poll. A missing output is only a review signal; no automatic journal posting, debit, reversal or customer credit exists. Schema v1→v2 is an explicit additive migration, not an HTTP-runtime migration. The 33-test PostgreSQL suite covers v1 upgrade preservation, least-privilege separation, scan replay/cursor fencing and reorg/reappearance observations. No wallet endpoint, credentials or funds were accessed. This is observation/audit groundwork, not a deposit-address allocator, live deposit processor, or approved mainnet switch. The application only calls read methods, but operators must still use a restricted view-only wallet RPC instance/account; the code cannot prove credential scope.
 
 Validation: TypeScript/Vite build and 144 offline tests passed in the serial native-RandomX test run; the initial parallel run encountered a peer-gossip timeout. Browser smoke verified a disposable wallet's signed test credit, withdrawal hold and cancellation restoring the exact balance, plus a 390px viewport without horizontal overflow. No real funds were used. Tests and remaining acceptance gates are below; this is not launch readiness.
 

docs/production-plan.md

@@ -20,7 +20,7 @@ Status: active engineering plan; **not launch or payment authorization**. Update
 
 **Current design deliverable:** [custodial market design](custodial-market-design.md). Read the workstreams below with this update: pooled customer liabilities replace per-order incoming invoices and external sale payouts in the proposed architecture. Earlier trustless-first research gates are historical, not a prerequisite to investigating custody. Exact ledger, withdrawal, fee, custody/legal and host-attested NFT consensus rules still require approval and evidence; the existing mock domain cannot authorize real balance debits.
 
-**Read-only XMR groundwork:** a disabled-by-default Monero wallet-RPC observer client is implemented for mainnet address verification and bounded incoming-transfer scans, with protected config-file loading, transport limits and lossless uint64 parsing. It is deliberately not started by the server and cannot create addresses, post credits or spend funds. It has offline fixture coverage only. No actual RPC endpoint, wallet credential, address allocation or deposit was configured. Remaining deposit milestone: backed-up non-reusable subaddress allocation, durable output observation/inclusion/reorg history, exact idempotent ledger credit rules, controlled testnet/stagenet rehearsal, and independent accounting/security review before any real deposit can be accepted.
+**Read-only XMR groundwork:** a disabled-by-default Monero wallet-RPC observer client is implemented for mainnet address validation and bounded incoming scans; an explicit PostgreSQL v1→v2 migration adds durable scan cursors, exact observation records and append-only reorg/reappearance markers under a separate observer database role. Each record includes a validated destination address. The observer/store remain disconnected from startup/routes and cannot allocate deposit addresses, post credits, reverse balances or spend. Missing outputs create review evidence only. Offline fixtures cover strict RPC safety, scan retry idempotency and cursor fencing; the PostgreSQL suite passed 33/33, including upgrade and reorg-observation persistence. No live RPC, wallet credential or funds were used. Remaining deposit milestone: backed-up non-reusable subaddress allocation, binding each credited output to a registered beneficiary/address, authoritative chain inclusion and reorg policy, exact idempotent journal crediting plus audited reversal/hold handling, controlled stagenet rehearsal, and independent accounting/security review before real deposits.
 
 ## 1A. MVP release boundary — proposed safe first production-hosted release