…cess

Mirror the existing processing effect: when the send submission settles
into ActionStatus.SUCCESS, emit send_payment_success (flow:"send",
step:"success"), guarded to fire once per submission and reset on IDLE.

Pairs with mobile (stellar/freighter-mobile#937), which emits the same
send_payment_success from its processing screen's SENT state, so the send
funnel confirm -> processing -> success is symmetric across both platforms
rather than success being single-platform drift. Adds a matching test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…alignment (#2883) (#2903)

* docs(analytics): design spec for property-model foundation (#2883)

First slice of the cross-platform analytics schema-alignment epic:
global property-model cleanup (schema_version, account_id_hash, Identify
traits, drop SDK-duplicated fields, app.opened snapshot). Evolves the
existing emitMetric path in place; hard cutover, no dual-write. Event
renames deferred to follow-on slices B/C.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(analytics): add memoized account_id_hash helper

* feat(analytics): add popup/sidebar/fullpage surface detection

* refactor(analytics): reshape common context into RFC four-bucket model

* feat(analytics): supply appVersion to Amplitude init, keep autocapture off

* feat(analytics): send durable wallet traits via Amplitude Identify

Adds deriveIdentifyTraits (pure wallet_count/has_hardware_wallet/
has_imported_account) and syncIdentifyTraits (dirty-checked Amplitude
Identify call), wired into storeAccountMetricsData.

Also fixes a privacy violation found in review: storeBalanceMetricData
emitted a truncated public key in the freighterAccountFunded event body.
Replaced with account_id_hash of the full public key, matching the
schema's "never emit a raw or truncated public key" constraint.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(analytics): emit app.opened with one-time connectivity snapshot

* test(analytics): guard against raw public keys in event payloads

* test(analytics): fix jest.Mock cast to satisfy typecheck in privacy guard test

* fix(analytics): record Identify fingerprint only after send guard

syncIdentifyTraits cached the dirty-check fingerprint before the
AMPLITUDE_KEY/hasInitialized guard, so a pre-init call would poison the
cache without ever sending an Identify, causing a later identical call
to silently short-circuit and never sync the user's traits. Move the
cache write to after the guard so it's only recorded once an Identify
actually fires.

* docs(analytics): correct §6 Identify call-site list (accountServices duplicate)

Final review found accountServices.ts uses a private duplicate
storeAccountMetricsData that doesn't call syncIdentifyTraits; the
effective sync sites are useGetAppData + the recover hook. Non-functional
gap (traits self-heal via useGetAppData). Note added + dedupe follow-up.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs(analytics): drop process-oriented design doc from repo

The canonical analytics schema lives in the cross-platform RFC
(stellar/wallet-eng-monorepo#10); this repo doc was a brainstorming
artifact (slice refs, PR numbers, migration-decision narrative) that
would rot as a second source of truth. Design context lives in the PR
description; cross-platform contracts go to the RFC.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(analytics): address PR review — consent-hydration timing + pre-unlock omission

- app.opened: defer emit until the data-sharing preference resolves to
  allowed (it defaults false and hydrates async, so emitting at init was
  suppressed and lost). Emit once, when consent becomes allowed.
- syncIdentifyTraits: gate on consent and don't cache the fingerprint
  while opted out, so traits re-sync after consent hydrates.
- buildCommonContext: omit account_type/account_funded/is_hardware_account
  pre-unlock (no active key), per the spec's omission rule.
- pt locale: real Portuguese for the auto-generated Auto-lock timer keys.
- Tests: 22/22; adds consent-hydration regressions for app.opened + Identify.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(analytics): derive account_funded from balances cache, not sticky flag

account_funded was read from a per-account-type sticky map
(accountFundedByType[metricsData.accountType], sourced from localStorage
freighterFunded/hwFunded/importedFunded). Funding any one account of a
given type latched that type "funded" for every subsequent event, even
events for a different, still-unfunded account of the same type.

Read it instead from the active account's cached balance
(balancesSelector from popup/ducks/cache, keyed by network then public
key), matching the cross-platform contract mobile already implements.
Omit account_funded (tri-state, same as account_id_hash) when there is
no cached entry for the active key, or when the cached isFunded is
null (unknown), rather than defaulting to false.

storeBalanceMetricData and the one-time freighterAccountFunded
milestone event are untouched — they still use metricsData for that
purpose.

* fix(analytics): resolve account_type live from Redux, not the stale metricsData cache

buildCommonContext derived account_type/is_hardware_account from the
localStorage metricsData cache, which is only refreshed by useGetAppData
(on a cache miss), makeAccountActive, and recoverAccount. Account-mutation
thunks (importAccount, importHardwareWallet, addAccount, createAccount)
switch the active account without refreshing it, so events emitted before
the next full app-data reload mislabel the active account's type — e.g. a
freshly-imported secret-key account reports account_type "freighter"
(accountScreenImportAccount + the follow-on account view event both fire
in this window).

Resolve account_type/is_hardware_account live from the Redux account list
keyed on the active public key, and omit them when the active key isn't
resolvable in allAccounts (auth-store update race) rather than guessing —
matching mobile's fail-safe behavior. account_id_hash and account_funded
are unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(analytics): cache Identify fingerprint only after a successful send

syncIdentifyTraits cached lastIdentifiedTraits before dispatching the
Identify. If amplitude.identify() ever throws, the traits were already
marked "sent", so every later call with the same traits short-circuits on
the dirty-check and never retries — the same self-poisoning failure the
pre-init/consent guards were hardened against.

Reorder so the fingerprint is cached only after a successful dispatch,
inside try/catch. On a throw, lastIdentifiedTraits stays unset so the next
sync retries. Mirrors the mobile implementation (freighter-mobile#936).

Adds a regression test asserting a one-off identify() throw does not
suppress the next sync of the same traits.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(analytics): screen.viewed consolidation (#2883) (#2907)

* feat(analytics): add screen.viewed event and emitScreenViewed helper

Introduce the canonical, consolidated screen-view event `screen.viewed`
and the machinery to emit it, ahead of cutting every screen-load event
over to it (Slice B of #2883).

- Add METRIC_NAMES.screenViewed = "screen.viewed".
- Add helpers/metrics#emitScreenViewed, which emits screen.viewed with a
  screen_name plus optional flow/step and any preserved extra props
  (surface and the rest of the common context come from Slice A's
  buildCommonContext). Undefined flow/step are dropped from the payload.
- Add helpers/metrics#toScreenName: the deterministic canonicalization of
  a legacy "loaded screen: X" string into a snake_case screen_name, and
  the Flow union type.
- Register emitScreenViewed in the global helpers/metrics test mock so
  component tests that render screens keep working after the cutover.
- Cover toScreenName and emitScreenViewed in metrics.test.ts.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01C1GhBXnrhTgwhopiq46ceq

* feat(analytics): consolidate all screen-load events into screen.viewed

Collapse every "loaded screen: X" event into the single canonical
`screen.viewed` event (Slice B of #2883). Screen identity now lives in
the `screen_name` property (derived deterministically from the legacy
string), grouped by `flow`, with `step` on terminal completion/success
screens; `surface` comes from the Slice-A common context.

- popup/metrics/views.ts: refactor routeToEventName into a
  route -> { screen_name, flow, step? } map (single source of truth) and
  emit screen.viewed via emitScreenViewed, preserving the extra props on
  grant-access / add-token / sign-transaction / sign-auth-entry /
  sign-message. The modify-asset-list route keeps its non-screen (action)
  event untouched.
- Cut the remaining screen-load emit sites over to emitScreenViewed:
  Send + Swap step maps, SwapAmount set-max, DisplayBackupPhrase,
  TrustlineError, and discover's trackDiscoverViewed.
- Remove now-dead "loaded screen: X" name constants from metricsNames.ts
  (all unreferenced after the cutover); leave non-screen names intact.
- Add popup/metrics/views.test.ts covering the route -> screen mapping,
  preserved props, completion-screen steps, and the no-legacy-name
  guarantee.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01C1GhBXnrhTgwhopiq46ceq

* docs(analytics): remove internal slice-name references from comments

* chore(analytics): drop unrelated files accidentally swept into this branch

Removes files that were included by an errant 'git add -A' during an
earlier commit (local .claude settings, .github parity/runbook infra,
addtoken-sac e2e tests + pr-evidence, a pr-review note) and reverts a
prettier-only reformat of the v3 manifest. Untracked here only — the
files remain on disk for the branches they belong to.

* refactor(analytics): remove unused toScreenName helper

The route->screen map holds literal screen_name values as the single
source of truth, so the toScreenName transform had no production caller
(only its own test + a stale comment). Remove it and its test; reword
the ScreenDef comment.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs(analytics): correct stale legacy-string comments in screen maps

The extension already identifies screens by declared screen_name literals
(routeToScreen / per-step maps) with no 'loaded screen: X' plumbing. Fix the
comments that described screen_name as 'derived from the legacy string' — the
names are declared literals, not derived.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* analytics(screen.viewed): reconcile cross-platform drift with mobile (D2–D6, D8)

From the cross-platform drift review of RFC #2883 slice B:

- D2: type `step` as the canonical Step enum {confirm, processing, success};
  tag send_payment_confirm / swap_confirm step:"confirm" to match mobile.
- D3: add flow:"assets" to the shared `account` and
  `view_public_key_generator` screens (align with mobile).
- D4: canonicalize the reveal-phrase screen to `show_recovery_phrase`
  (+ `unlock_recovery_phrase` for the extension-only locked-state gate).
- D5: reclassify the swap percentage/set-max button emit as an action event
  (`swap: amount percentage set`) instead of an inflating screen.viewed.
- D6: skip + report to Sentry for an uncatalogued route instead of throwing
  inside the navigate handler (removes a popup-crash risk).
- D8: drop the `send_payment` container screen (intentional non-emit); the
  send flow's step effect owns the per-step screens, matching mobile.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test(swap): stub emitScreenViewed in Swap.selectionType test

The Swap view emits screen.viewed on mount; the real emitScreenViewed runs
buildCommonContext, which reads the Redux auth slice this test's minimal store
doesn't provide, throwing "Cannot read properties of undefined (reading
'publicKey')". The suite overrides the global metrics mock with requireActual +
emitMetric only, so the real emit ran. Stub emitScreenViewed too — this suite
covers picker-selection wiring, not screen-view analytics.

Pre-existing since the screen.viewed cutover (fails identically at the parent
commit); surfaced when CI ran on this branch.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* analytics(swap): reuse shared set-max event for cross-platform parity

The swap amount screen coined a new "swap: amount percentage set" event
that fired on every percentage tap. Mobile has no such event — it emits
the shared "send payment: set max" on the Max tap only, reused across
send and swap. The extension Send handler already matched that; only Swap
diverged.

Point the swap Max tap at METRIC_NAMES.sendPaymentSetMax (gated on 100%)
and drop the now-dead swapAmountPercentageSet constant, so all four call
sites (ext send/swap, mobile send/swap) emit one consistent event.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* refactor(analytics): rename routeToScreen -> SCREEN_BY_ROUTE

Naming consistency with the SEND_SCREEN_BY_STEP / SWAP_SCREEN_BY_STEP
step maps. No behavior change.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(analytics): emit send_payment_processing for the in-flight send stage

The extension's in-flight submission is an internal state of the confirm
screen (submitStatus === PENDING → SendingTransaction), not a distinct
step/route, so it never fired a screen.viewed. Mobile emits
send_payment_processing (flow:send, step:processing) for this stage, so a
cross-platform "processing" funnel had no extension data.

Emit send_payment_processing (flow:"send", step:"processing") from a
submitStatus effect in Send/index when a submission enters PENDING, once
per submission (reset when the status clears). Swap is intentionally left
alone — mobile emits no swap-processing event, so adding one would create
new single-platform drift; deferred to the action/step follow-up.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>

* analytics(screen.viewed): emit send_payment_success on submission success

Mirror the existing processing effect: when the send submission settles
into ActionStatus.SUCCESS, emit send_payment_success (flow:"send",
step:"success"), guarded to fire once per submission and reset on IDLE.

Pairs with mobile (stellar/freighter-mobile#937), which emits the same
send_payment_success from its processing screen's SENT state, so the send
funnel confirm -> processing -> success is symmetric across both platforms
rather than success being single-platform drift. Adds a matching test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(analytics): domain-event consolidation (#2883) (#2909)

* feat(analytics): add screen.viewed event and emitScreenViewed helper

Introduce the canonical, consolidated screen-view event `screen.viewed`
and the machinery to emit it, ahead of cutting every screen-load event
over to it (Slice B of #2883).

- Add METRIC_NAMES.screenViewed = "screen.viewed".
- Add helpers/metrics#emitScreenViewed, which emits screen.viewed with a
  screen_name plus optional flow/step and any preserved extra props
  (surface and the rest of the common context come from Slice A's
  buildCommonContext). Undefined flow/step are dropped from the payload.
- Add helpers/metrics#toScreenName: the deterministic canonicalization of
  a legacy "loaded screen: X" string into a snake_case screen_name, and
  the Flow union type.
- Register emitScreenViewed in the global helpers/metrics test mock so
  component tests that render screens keep working after the cutover.
- Cover toScreenName and emitScreenViewed in metrics.test.ts.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01C1GhBXnrhTgwhopiq46ceq

* feat(analytics): consolidate all screen-load events into screen.viewed

Collapse every "loaded screen: X" event into the single canonical
`screen.viewed` event (Slice B of #2883). Screen identity now lives in
the `screen_name` property (derived deterministically from the legacy
string), grouped by `flow`, with `step` on terminal completion/success
screens; `surface` comes from the Slice-A common context.

- popup/metrics/views.ts: refactor routeToEventName into a
  route -> { screen_name, flow, step? } map (single source of truth) and
  emit screen.viewed via emitScreenViewed, preserving the extra props on
  grant-access / add-token / sign-transaction / sign-auth-entry /
  sign-message. The modify-asset-list route keeps its non-screen (action)
  event untouched.
- Cut the remaining screen-load emit sites over to emitScreenViewed:
  Send + Swap step maps, SwapAmount set-max, DisplayBackupPhrase,
  TrustlineError, and discover's trackDiscoverViewed.
- Remove now-dead "loaded screen: X" name constants from metricsNames.ts
  (all unreferenced after the cutover); leave non-screen names intact.
- Add popup/metrics/views.test.ts covering the route -> screen mapping,
  preserved props, completion-screen steps, and the no-legacy-name
  guarantee.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01C1GhBXnrhTgwhopiq46ceq

* docs(analytics): remove internal slice-name references from comments

* feat(analytics): consolidate domain event catalog to shared grammar (#2883)

Rewrite the domain (action/outcome) event names to the cross-platform
`domain.action_past` grammar: a dotted domain prefix followed by a
snake_case past-tense action. Outcomes get their own terminal events
(completed/failed/rejected/blocked/submitted) and a `result` property is
reserved for cases where the attempt itself is the analytical unit
(Blockaid scans). Several legacy names collapse into single events keyed by
a discriminator property (Blockaid scans, add-token responses, trustline
removal failures, payment type selection). Adds constants for newly
instrumented and split events and drops redundant ones.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VTPk4zPZ2GVdmTrmQCCckM

* feat(analytics): map onboarding, account & recovery events (#2883)

Point account creation, recovery-phrase, password, re-auth, recovery and
import events at the new names, carrying `reason_code` on failures. Drop
the redundant recover-account-finished and vague backup-phrase
success/error events (completion screens are already covered by
screen.viewed).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VTPk4zPZ2GVdmTrmQCCckM

* feat(analytics): map payment & swap outcomes, add collectible + submission events (#2883)

Direct (non-routed) payment outcomes emit payment.completed/payment.failed;
routed/path-payment outcomes settle as swap.completed/swap.failed, matching
how the send flow already routes a destination-asset send through the swap
path. Swap completion now carries from_asset_code/to_asset_code. Collectible
sends get their own collectible_send.completed/failed terminal events, and a
transaction.submitted event fires when a signed transaction is actually
broadcast to the network (distinct from the signing approval). Failure
events carry a reason_code derived from the operation/transaction result
codes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VTPk4zPZ2GVdmTrmQCCckM

* feat(analytics): rework signing & dApp-access events, split rejects from failures (#2883)

Rename grant-access and signing approvals/rejections to the dapp_access.*
and signing.* names, and separate user rejection from runtime failure:
per-type reject handlers now emit signing.message_rejected and
signing.auth_entry_rejected instead of a single generic event. The
generic "user signed transaction" / "user cancelled signing flow" events
are removed as duplicates of the per-type approve/reject handlers. The
memo-required case emits signing.transaction_blocked with
reason_code=memo_required. Add-token prompt responses collapse into
asset_add.responded keyed by decision; the injected-API token events move
to the asset_add_api.* names. Redundant per-handler account_type reads are
dropped now that it rides on the shared common context.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VTPk4zPZ2GVdmTrmQCCckM

* feat(analytics): consolidate asset, trustline & blockaid events (#2883)

Trustline add/remove emit asset.added/asset.removed with asset_code;
manage-asset errors emit asset.operation_failed with operation +
reason_code; the three trustline-removal blockers collapse into
trustline_remove.failed keyed by reason_code; the modify-asset-list event
becomes asset_list.modified. The five Blockaid scan events consolidate into
blockaid.scan_completed / blockaid.scan_failed, keyed by scan_target
(domain | transaction | asset) with a coarse result. The remove-token
prompt now emits asset_remove.responded (decision confirm | reject).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VTPk4zPZ2GVdmTrmQCCckM

* feat(analytics): rename discovery, history, account-view & on-ramp events (#2883)

Point discovery, history-item, account rename / public-key-copy /
StellarExpert, first-funded and Coinbase on-ramp events at the new names.
Discovery events carry protocol_id; history and account-rename events carry
a source; the first-funded event moves to account.first_funded.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VTPk4zPZ2GVdmTrmQCCckM

* test(analytics): update metric-name assertions for the new grammar (#2883)

Point the affected unit tests at the renamed constants and event names.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VTPk4zPZ2GVdmTrmQCCckM

* chore(analytics): drop unrelated files accidentally swept into this branch

Removes files that were included by an errant 'git add -A' during an
earlier commit (local .claude settings, .github parity/runbook infra,
addtoken-sac e2e tests + pr-evidence, a pr-review note) and reverts a
prettier-only reformat of the v3 manifest. Untracked here only — the
files remain on disk for the branches they belong to.

* refactor(analytics): remove unused toScreenName helper

The route->screen map holds literal screen_name values as the single
source of truth, so the toScreenName transform had no production caller
(only its own test + a stale comment). Remove it and its test; reword
the ScreenDef comment.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs(analytics): correct stale legacy-string comments in screen maps

The extension already identifies screens by declared screen_name literals
(routeToScreen / per-step maps) with no 'loaded screen: X' plumbing. Fix the
comments that described screen_name as 'derived from the legacy string' — the
names are declared literals, not derived.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(analytics): narrow Blockaid scan result by status before reading is_malicious

Slice C's blockaidScanCompleted metric read response.data.is_malicious
without narrowing the SiteScanResponse union, which only carries that field
on the status==='hit' variant (TS2339). Mirror the existing guard used
elsewhere (status === 'hit' && is_malicious).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* analytics: cross-platform property-shape parity + deferred fixes

Reconcile the extension analytics catalog with freighter-mobile against the
shared cross-platform analytics schema, plus the deferred signing / history /
dApp-access items.

- Property shapes: asset_code+asset_issuer (drop legacy code/issuer); payment.
  completed asset_code; swap.* {from,to}_asset_code only; reason_code-only
  failures (drop raw error); import_method on account.imported/import_failed;
  recovery_method on account_recovery.completed; snake_case discover
  (protocol_name/is_known_protocol).
- Blockaid result normalized to safe|warn|block|unknown; asset_bulk scan_target.
- Remove transaction.submitted (extension has no dApp sign-and-submit path;
  internal broadcasts already covered by payment/swap/collectible_send.completed).
- Wire runtime signing-failure events (signing.message_failed [new] +
  signing.auth_entry_failed) off the sign thunks' .rejected.
- Signing origin: thread the dApp url through useSetupSigningFlow into the metric
  handlers; attach origin to dapp_access + signing events.
- Wire account.public_key_copied (ViewPublicKey) and history.full_history_opened
  (AccountHeader nav).

Contract-breaking wire/payload changes (hard cutover per #2883) — notify
dashboard owners.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* analytics: address cross-platform drift review (blockaid coverage, collectible props, origin)

- Emit blockaid.scan_failed from the transaction/asset/asset_bulk thrown-error
  catch blocks (previously only the response.error branch emitted), matching
  mobile's full failure coverage; skip AbortError cancellations.
- asset_bulk scan_completed now carries an aggregate worst-case `result` +
  `address_count` (was scan_target only).
- collectible_send.completed carries {collection_address, token_id}.
- Normalize signing / dapp_access `origin` to the bare hostname (was the raw
  URL) so it matches mobile's dappDomain-based origin.
- Document that transaction.submitted is reserved / never emitted on the
  extension (dApp API signs-and-returns; internal broadcasts are covered by the
  payment/swap/collectible_send .completed events).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* analytics: wire one-sided events + distinct report event + source discriminator

- payment.simulation_failed now emitted from the simulation catch (was
  mobile-only); carries {reason_code, network}.
- onboarding.recovery_phrase_viewed (recovery-phrase screen mount) and
  onboarding.completed (mnemonic confirm) now emitted, matching mobile.
- blockaid.warning_reported: new distinct event for reportAssetWarning /
  reportTransactionWarning (were mislabeled as blockaid.scan_completed).
- asset_add.responded carries source:"dapp_api" (extension emits it only for the
  dApp injected-API prompt) to distinguish from mobile's manual add.
- Docs: onboarding.recovery_phrase_back_clicked not emitted (no Back affordance
  on the recovery-phrase screens); account.first_funded is extension-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* analytics: emit asset.operation_failed + trustline_remove.failed on the live fail path

Both events were emitted only by the orphaned TrustlineError component (never
rendered in production), so they were effectively dead on the extension while
mobile emits them. Emit them from the live ChangeTrust submit fail branch
(SubmitTx isFail), which knows add-vs-remove directly — so `operation` is never
mislabeled (fixes the old envelope-inference "remove" default). trustline_remove
.failed maps op_low_reserve->low_reserve and op_invalid_limit->has_balance
(extension does not split buying_liabilities; mobile does — documented).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* analytics: complete trustline-failure parity; remove orphaned TrustlineError

- trustline_remove.failed now splits op_invalid_limit into buying_liabilities vs
  has_balance using the asset's buying liabilities from the balance cache — full
  parity with mobile (was reporting has_balance only).
- Delete the orphaned TrustlineError component (+ styles) and its two stale,
  skipped ManageAssets test cases: it was never rendered in production, and its
  asset.operation_failed / trustline_remove.failed emits are now live on the
  ChangeTrust submit fail path (SubmitTx).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* analytics: drift-review clear fixes (scrub, domain result, asset dims, source)

- StrKey-scrub `reason_code` on the import / recovery / create-password / reauth
  and runtime signing-failure paths (secret-material hardening, matching mobile;
  new helpers/stellarStrKey.ts ported from mobile).
- payment.simulation_failed: drop the hand-added `network` (it rides on
  buildCommonContext; hand-adding violates the catalog invariant).
- asset_remove.responded (manual manage-assets prompt) carries source:"manage_assets".
- trustline_remove.failed carries asset_code / asset_issuer.
- blockaid.scan_completed{scan_target:"domain"} uses the full safe|warn|block|unknown
  mapping (was block/safe only), mirroring mobile's assessSiteSecurity.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* analytics: drift-review decisions (asset_code on responded, token_code on scan)

- asset_remove.responded (manual manage-assets prompt) carries asset_code (N3).
- blockaid.scan_completed{scan_target:"asset"} carries token_code (N5), matching
  mobile; derived from the CODE-ISSUER scan address.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* analytics: round-4 drift fixes (blockaid abort guards, asset_code on asset_add.responded)

- blockaid.scan_failed: skip emit on AbortError in the domain and transaction
  scan catches (matches scanAsset's guard) so cancelled scans don't report as
  failures.
- asset_add.responded: thread asset_code from the add-token view through the
  add/reject dispatch (analytics-only arg on the thunks; read off action.meta.arg
  in the metrics handler), mirroring mobile's asset_add.responded { asset_code }.
- Includes catalog/annotation cleanup carried in this round (dapp_access.blocked
  assertion, reserved-event notes, duplicate describe-block removal).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* analytics: scrub StrKeys on the remaining free-text reason_code paths

Defense-in-depth to match the scrubbing the PR already applies on the
auth/onboarding/import paths — Amplitude is a third-party sink not covered by
Sentry's beforeSend, so a G…/S… StrKey embedded in an error string must be
redacted before it leaves the client.

- payment.simulation_failed (useSimulateTxData): scrub error.message.
- asset_add_api.failed (useSetupAddTokenFlow): scrub the thunk-rejection message
  and the caught error message.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* analytics: snake_case swap.trustline_added props (D5)

Align swap.trustline_added to asset_code/asset_issuer (was tokenCode/tokenIssuer),
matching the sibling asset.added and the shared snake_case property convention.
Kept in lockstep with the identical mobile rename so the wire values stay aligned.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* analytics: address PR review — scan_failed scrub, StrKey C/M, swap key parity

Review comments from #2909 (paired with the mobile #938 changes):

- blockaid.scan_failed reason_code now scrubbed at all six emit sites (four
  err.message catches + two response.error branches) — the last raw error paths.
- scrubStrKeys now covers contract (C…, 56) and muxed (M…, 69) StrKeys, not just
  G…/S…; widened to tolerate null. (Muxed is 69 chars, so it's an alternation.)
- swap.source_selected / destination_selected use snake_case asset_code /
  asset_issuer / requires_trustline; swap.quote_expired drops the raw amounts
  (privacy parity with completed/failed) and emits from_asset_code / to_asset_code
  as bare codes (getAssetFromCanonical) + result_code. Removed the now-dead amount
  params from useSwapQuoteExpiry. Kept in lockstep with mobile.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* analytics: scrub the two remaining scan_failed catches (scanAsset / scanAssetBulk)

Follow-up to the scan_failed scrub: the previous pass only caught the two hook
catches (useScanSite/useScanTx) because the replace matched their deeper
indentation; the scanAsset and scanAssetBulk catch blocks (shallower indent)
still passed err.message raw. These asset paths are the likeliest to carry a
C…/G… address in a thrown error, so scrub them too — all six scan_failed emit
sites now route reason_code through scrubStrKeys.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…gnment) (#936)

* feat(analytics): add memoized account_id_hash helper

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(analytics): add mobile surface helper

* feat(balances): record fetchedPublicKey for the active-account funded signal

Adds fetchedPublicKey to the balances store, set on every successful
fetchAccountBalances call. Lets downstream analytics (account_funded)
verify a balance snapshot belongs to the currently active account
before emitting, avoiding stale/other-account values.

* refactor(analytics): reshape common context into RFC four-bucket model

Rewrites buildCommonContext to emit only schema_version, surface, and
uppercased network, plus account_id_hash/account_type/account_funded
when an account is active. Drops publicKey, platform, platformVersion,
appVersion, buildVersion, bundleId, connectionType, and effectiveType
from the event-level context; never emits is_hardware_account (mobile
has no hardware wallets). account_type falls back to allAccounts
lookup since ActiveAccount does not carry importedFromSecretKey.
account_funded is only set when the balances store's fetchedPublicKey
matches the active account, avoiding stale/mismatched funded state.

Removes now-dead imports (truncateAddress, getVersion, getBuildNumber,
useNetworkStore) no longer referenced after the reshape.

* fix(analytics): omit account_type when active account not resolvable

buildCommonContext derived account_type from an allAccounts lookup that
fell back to "freighter" whenever the active account wasn't found. During
the auth-store update race (createAccount/importSecretKey) and the
drift-recovery path, that silently mislabels a possibly-imported account
- the same misleading-value failure we already avoid for account_id_hash
and account_funded. Gate account_type on the active account actually
being found in allAccounts; omit it otherwise.

* feat(analytics): send durable wallet traits via Identify (consent-gated)

Add deriveIdentifyTraits (wallet_count, has_imported_account - no
has_hardware_wallet, mobile has no hardware wallets) and
syncIdentifyTraits, which dirty-checks via a fingerprint and gates on
both init and analytics consent. The fingerprint is only cached once
the Identify call can actually be sent, so traits re-sync correctly
once consent/init hydrate later (mirrors the extension's fix).

initAnalytics now calls syncIdentifyTraits instead of the old
setAmplitudeUserProperties (removed - it only set bundle_id, now
folded into syncIdentifyTraits). Add an auth-store subscription so
traits stay in sync as accounts are added/imported/removed.

* fix(analytics): sync Identify after init + on consent enable

The in-init syncIdentifyTraits call ran BEFORE `hasInitialised = true`,
so its own `!hasInitialised` gate always short-circuited and the initial
Identify never sent. Since the auth-store subscription only fires on
LATER changes, an already-logged-in user whose allAccounts never changed
again got no Identify traits for the whole session - a regression from
the old unconditional setAmplitudeUserProperties.

- Move the in-init syncIdentifyTraits call to after `hasInitialised =
  true` (last step of the successful-init path).
- Also call syncIdentifyTraits from the existing analytics-store
  subscription so traits send once consent hydrates/enables after init
  (dirty-check + consent-gate keep it a safe no-op otherwise).

Add two regression tests (both fail on the pre-fix code): initial
Identify fires during initAnalytics when enabled, and Identify fires
when consent enables after init via the analytics-store subscriber.

* feat(analytics): enrich app.opened with one-time connectivity snapshot

Re-adds useNetworkStore to core.ts (removed from buildCommonContext in
M4) so trackAppOpened can attach a point-in-time connection_type/
effective_type snapshot plus surface. buildCommonContext still emits
no connectivity; network/schema_version continue to arrive via the
common-context bucket inside the dispatcher.

* test(analytics): guard against raw public keys in payloads

* test(analytics): cover getSurface mobile_android branch

* fix(analytics): address PR review comments on the property model

Three fixes from the #936 review:

- Gate syncIdentifyTraits on persisted-consent hydration. isEnabled is
  persisted to AsyncStorage and hydrates asynchronously; the pre-hydration
  in-memory default is `true` on Android, so a returning opt-out user could
  emit wallet traits before hydration flips consent to false. Skip until
  useAnalyticsStore.persist.hasHydrated(), and retry via onFinishHydration
  so enabled users' traits still sync.

- Cache the Identify fingerprint only after amplitude.identify() succeeds.
  Previously it was cached before the try block, so a single throw left the
  dirty-check short-circuiting every later sync with the same traits — they
  would never retry. Matches the function's own docstring.

- Require both public key AND network to match for account_funded. Balances
  are keyed by (publicKey, network); the same G-address stays active across a
  selectNetwork() switch, so key-only matching emitted the old network's
  funded status against the new network until the async refetch landed.
  Record fetchedNetwork on the balances store and compare it too, failing
  closed on a network switch.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(analytics): reset balances snapshot keys in clearAccountData

Complements the network-aware account_funded guard: clearAccountData now
resets fetchedPublicKey and fetchedNetwork alongside isFunded so the
account_funded property fails closed across an account switch. Without the
fetchedPublicKey reset, the stale key still matches the briefly-still-active
previous account during the switch window, emitting a wrong funded status.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* analytics(foundation): align app.opened wire string across platforms

APP_OPENED was "event: App Opened" while the extension emits "app.opened", so
the single most basic cross-platform funnel (app opens) couldn't merge. Align to
"app.opened". app.opened is foundation-owned (the domain.action_past renames for
other events live in the later screen.viewed / domain-event slices), so the
alignment belongs on this foundation slice.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(analytics): screen.viewed consolidation (#2883) (#937)

* feat(analytics): add screen.viewed event, flow catalog, and derivation helpers

Introduce the single canonical screen-view event for Slice B (#2883):

- AnalyticsEvent.SCREEN_VIEWED = "screen.viewed"
- AnalyticsFlow enum + ScreenViewedProps type
- deriveScreenName(): deterministic legacy-string -> slug
- SCREEN_METADATA: per-screen flow/step catalog keyed by legacy string
- buildScreenViewedProps() / getScreenViewedProps() / isScreenViewEvent()

The VIEW_* members are retained as the legacy-string catalog that screen_name
derives from; their values become catalog keys only and are no longer emitted.
Route-mapping logic (transformRouteToEventName / CUSTOM_ROUTE_MAPPINGS /
processRouteForAnalytics) is unchanged and still resolves the legacy string.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CDXpJqihDLf2yE3Ur7UaUT

* refactor(analytics): emit screen.viewed from the screen-view choke points

Hard cutover for Slice B (#2883): every screen load now emits the single
canonical screen.viewed event instead of a distinct "loaded screen: X" event.

- useNavigationAnalytics: route -> buildScreenViewedProps -> SCREEN_VIEWED
- BottomSheet: retarget legacy screen analyticsEvent props to SCREEN_VIEWED
  (all 12 manual screen-view call sites flow through this one component, two
  via SignTransactionDetails which forwards here). Non-screen events pass
  through unchanged.

surface is supplied by the Slice-A common context (getSurface()).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CDXpJqihDLf2yE3Ur7UaUT

* test(analytics): cover screen.viewed consolidation

- analyticsConfig.test.ts: deriveScreenName determinism, isScreenViewEvent,
  buildScreenViewedProps (screen_name + flow + step), getScreenViewedProps
  retarget/passthrough, and the route path feeding screen.viewed.
- core.test.ts: emission asserts name=screen.viewed with screen_name/flow/
  surface (+ step for completion screens), and that NO legacy "loaded screen:"
  event is emitted for any catalog screen.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CDXpJqihDLf2yE3Ur7UaUT

* docs(analytics): remove internal slice-name references from comments

* chore(analytics): drop unrelated files accidentally swept into this branch

Removes local .claude settings and superpowers spec/plan working docs
that an errant 'git add -A' committed. Untracked here only; files remain
on disk.

* refactor(analytics): declare screen_name explicitly for named screens

Named VIEW_* screens now declare their screen_name in SCREEN_CATALOG
(renamed from SCREEN_METADATA) instead of deriving it from the mutable
display string at emit time — decoupling the analytics id from the UI
copy. deriveScreenName stays only as the fallback for auto-mapped routes
(transformRouteToEventName) not in the catalog, so the long tail still
emits a non-empty screen_name. Values are unchanged; pure refactor.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* refactor(analytics): remove the legacy "loaded screen: X" string layer

Screens are now identified directly by their canonical screen_name: each
VIEW_* enum member holds its screen_name as its value, the route transform
(routeToScreenName, was transformRouteToEventName) yields a screen_name
directly, and SCREEN_CATALOG is keyed by screen_name (holding only
flow/step). Deletes deriveScreenName + LEGACY_SCREEN_PREFIX; isScreenViewEvent
is now a catalog-membership check instead of a "loaded screen: " prefix sniff.

No "loaded screen: X" string is emitted or used as a key anymore. Emitted
screen_name values are unchanged; the 15 screen call-sites are untouched
(they reference the enum members, whose values changed). Net -116 lines.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* analytics(screen.viewed): fix throttle collapse + add guards (D1, D2, D7)

From the cross-platform drift review of RFC #2883 slice B:

- D1: make the screen.viewed throttle screen-aware so a burst of navigations
  (fast tap-through, or synchronous programmatic nav like popToTop()+navigate())
  no longer collapses distinct screens down to the last one. Screen views are
  already deduped upstream, so partitioning the throttle per screen_name is
  safe. Adds a throttle-ENABLED regression test (the suite otherwise disables
  the throttle, which is why this was CI-invisible).
- D2: type `step` as the canonical Step enum {confirm, processing, success}
  (applied identically on the extension).
- D7: guard track() so a catalogued screen slug passed directly as an event
  name is dropped + reported, instead of leaking a bare slug (the VIEW_* enum
  members keep their slug values, so there is no compile-time guard).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* analytics(screen.viewed): reconcile sign_auth_entry name with extension

Mobile emitted screen_name "sign_auth_entry_details", but the extension
(stellar/freighter#2907) emits "sign_auth_entry" for the same dApp
auth-entry signing screen. Mobile has only the details-sheet variant of
this screen (no separate base sign_auth_entry), so the _details suffix
was a mobile structural artifact rather than a distinct screen. Align the
emitted value to the shared canonical name so cross-platform funnels join.

Only the wire value changes; the VIEW_SIGN_DAPP_AUTH_ENTRY_DETAILS enum
member and its references (component, catalog key) are unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* analytics(screen.viewed): emit send_payment_processing on mobile

The send_payment_processing catalog entry (VIEW_SEND_PROCESSING,
step:"processing") was declared but never emitted: no route derives to it
and the inline TransactionProcessingScreen only fired the child
transaction-details sheet. The extension (stellar/freighter#2907) emits
this event from its submission PENDING effect and its comment assumes
mobile does the same, so step:"processing" was silently mobile-absent.

Emit screen.viewed { screen_name: "send_payment_processing", flow: "send",
step: "processing" } once when TransactionProcessingScreen mounts. The
screen is mounted only while submitting, making the mount the mobile analog
of the extension's PENDING transition. Add a test asserting the single
emission with the expected props.

Swap is left untouched: neither platform emits a swap processing screen, so
it stays symmetric.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* analytics(screen.viewed): emit send_payment_success on SENT

TransactionProcessingScreen renders both the in-flight and terminal
success states, so the success funnel stage was previously unobservable.
Add VIEW_SEND_SUCCESS ("send_payment_success", flow:"send", step:"success")
and emit it when the submission settles into the SENT status, guarded to
fire at most once per mount.

This completes confirm -> processing -> success for the send flow on mobile
and pairs with a matching send-success emission on the extension
(stellar/freighter#2907) so the step funnel is symmetric cross-platform.
Extends the processing-screen test to cover the SENT path.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(analytics): domain-event consolidation (#2883) (#938)

* refactor(analytics): consolidate domain events to shared catalog (#2883)

Rename the remaining action/outcome analytics events to the shared
cross-platform `domain.action_past` grammar and consolidate events that
describe the same action behind a call-site discriminator.

- Rewrite the AnalyticsEvent wire strings (payment/swap/signing/asset/
  account/onboarding/discovery/history/onramp/platform events).
- Collapse the four Blockaid scan events into `blockaid.scan_completed`
  (scan_target + result) and add `blockaid.scan_failed` at scan-failure
  paths; skip the expected non-mainnet short-circuit and cancellations.
- Collapse the swap pickers into `swap.picker_opened` (side), the
  add/remove prompt responses into `asset_add.responded` /
  `asset_remove.responded` (decision), the store-open events into
  `app_update.store_opened` (source), the payment-type selections, the
  unsafe-asset add, and the trustline-removal failures.
- Route path/routed payment outcomes to swap events and collectible send
  failures to `collectible_send.failed`.
- Align touched property keys to the grammar (origin, reason_code,
  from_asset_code/to_asset_code, operation) and add asset_code.
- Remove the redundant, unreferenced "account screen: copied public key".

schema_version/surface/network/account_id_hash still come from
buildCommonContext; screen.viewed and the property-model foundation are
untouched.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XFcohvcYZtftSU5Kcypg5P

* test(analytics): cover renamed and consolidated domain events (#2883)

- Extend core.test.ts with a domain-event catalog block: verifies the
  renamed wire strings, the scan_target/side/decision/source
  discriminators, blockaid.scan_failed, and a grammar guard asserting
  every non-screen domain event stays on domain.action_past.
- Extend blockaid/api.test.ts to assert scan_completed (asset/asset_bulk)
  and the new scan_failed emission.
- Lock a representative slice of the catalog in Analytics.test.ts.
- Update the swap picker assertions to the consolidated
  swap.picker_opened event with side.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XFcohvcYZtftSU5Kcypg5P

* analytics: cross-platform property-shape parity + deferred fixes

Reconcile the mobile analytics catalog with the freighter extension against the
shared cross-platform analytics schema, plus deferred signing / trustline items.

- Property shapes: asset_code+asset_issuer (split combined asset); payment.
  completed asset_code (drop operationType); swap.* {from,to}_asset_code
  (path-payment branch gains to_asset_code); reason_code-only failures (drop
  errorCode/operationType/isSwap); collectible snake_case; public_key_copied /
  recovery_phrase.copied carry no context/action; account.renamed source (drop
  names); history.item_opened/full_history_opened source; discover protocol_id;
  reauth drops constant context/method.
- Re-point mnemonic-restore to account_recovery.* (was mislabeled account.import*);
  secret-key path keeps account.import* with import_method.
- Blockaid result normalized to safe|warn|block|unknown.
- Wire user-reject events (signing.message_rejected/auth_entry_rejected) in the
  WalletKit reject path.
- Emit trustline_remove.failed with has_balance/buying_liabilities/low_reserve
  derived from Horizon op result codes + balances store.

Contract-breaking wire/payload changes (hard cutover per #2883) — notify
dashboard owners.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* analytics: address cross-platform drift review (history event, snake_case props)

- The "View on Stellar Expert" tap in the transaction-detail sheet now emits
  history.item_opened {source:"transaction_detail"} (was
  history.full_history_opened) — it opens a specific operation, matching the
  extension's mapping for the same gesture.
- snake_case the blockaid scan_completed extras (token_code, address_count).
- Fix stale catalog/JSDoc comments (asset.added carries asset_issuer;
  asset_add/asset_remove.responded carry `asset`; relocate the scan-failure doc
  block onto trackScanFailed).
- Test: use the lowercase wire value ("safe") for the blockaid result pass-through.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* analytics: wire transaction-reject + split dapp_access blocked/rejected + source

- signing.transaction_rejected now emitted on the dApp tx-reject path
  (SIGN_XDR / SIGN_AND_SUBMIT_XDR), mirroring the approve side and the extension.
- dapp_access.rejected now carries origin only (genuine user cancel); the
  not-authenticated auto-reject moves to a new dapp_access.blocked
  {origin, reason_code:"not_authenticated"} — a system block, not a user decision.
- asset_add/asset_remove.responded carry source:"manage_assets" (manual in-app
  path), distinguishing from the extension's dApp source:"dapp_api".
- Doc: signing.transaction_blocked (memo_required) not emitted on mobile — the
  memo-required state is a passive UI gate with no reachable block point.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* analytics: normalize origin to hostname; fix stale comments; asset_issuer

- `origin` on all signing / dApp-access events is normalized to the bare dApp
  hostname (was the raw full URL from WalletConnect metadata), matching the
  extension's hostname-based origin so cross-platform funnels merge. Centralized
  via an originProps() helper in transactions.ts (getDisplayHost).
- asset_issuer on the remove paths uses the real `tokenIssuer` variable instead
  of a colon-split that yielded undefined for colon-less contract identifiers.
- Correct stale comments: the message/auth-entry/transaction reject paths ARE
  emitted (WalletKitProvider); `origin` matches the extension.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* analytics: drift-review decisions (drop tx hash/type, snake_case, asset_code, count)

- Drop transactionHash/transactionType from signing.transaction_approved and
  transaction.submitted (N1) — parity with the extension (which emits neither);
  transactionType was never actually populated, and transaction_hash is a
  high-cardinality, identity-linking dimension.
- payment.simulation_failed: transactionType -> transaction_type (N2, snake_case).
- asset_add.responded / asset_remove.responded: asset -> asset_code (N3).
- account.created (ACCOUNT_SCREEN_ADD_ACCOUNT): carries number_of_accounts (N4);
  see the call-site comment re: tap-time vs creation-success semantics.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* analytics: round-4 drift fixes (reason_code result codes, count timing, reauth/onramp parity)

- transaction.failed / swap.failed: reason_code now prefers the machine-readable
  Horizon result code, falling back to a StrKey-scrubbed message, so it buckets
  with the extension's SubmitFail derivation. Threaded resultCodes through the
  payment, collectible, and swap submit sites.
- account.created: emit on the creation-success path with the real post-creation
  account count instead of at tap time (dropped the over-counting ManageAccounts
  tap emit).
- onboarding.password_created: add the success side on signUp success (was
  fail-only on mobile).
- reauth.failed: carry a scrubbed reason_code, matching the extension.
- onramp.coinbase_opened: carry { asset }.
- Catalog annotations for reserved / platform-specific events.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* analytics: D8 — consolidate onboarding.completed to a single terminal point

Mobile emitted onboarding.completed from four UI sites (ValidateRecoveryPhrase,
RecoveryPhrase, and both BiometricsEnableScreen branches), risking double-counts
and, on the import/recover path, firing alongside account_recovery.completed.

Consolidate to one deterministic emit in the signUp store action's success path
(the create-account terminal point, mirroring the extension's
confirmMnemonicPhrase.fulfilled). The import/recover flow keeps
account_recovery.completed only (module importWallet), matching the extension's
create-vs-recover split — so import no longer double-signals as onboarding.

This intentionally drops onboarding.completed from the import flow and shifts the
create completion point to wallet creation; historical continuity of the series
is deprioritized in favor of cross-platform parity (per product direction).
Removed the now-unused analytics imports from BiometricsEnableScreen.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* analytics: end the D1/D2 recurrence (reason_code + blockaid result fallbacks)

Both drift findings kept recurring because prior rounds aligned the primary
value each platform emits but left the fallback/default divergent. Fix the
edges so there is nothing left to re-flag:

- D1 (reason_code): trackTransactionError now emits data.errorCode ?? "unknown",
  byte-for-byte identical to the extension's SubmitFail derivation. Dropped the
  scrubbed free-text fallback that produced unbounded reason_code cardinality
  the extension never emits (full message still logged to Sentry). Regression
  test asserts the free-text never leaks into reason_code.
- D2 (blockaid result): the asset / asset_bulk analytics `result` is now derived
  DIRECTLY from the raw Blockaid result_type (new resultFromResultType), not the
  UI SecurityLevel — so an unclassifiable token is `unknown` on both platforms,
  not silently `safe`. UI security assessment is untouched. Regression tests
  cover missing and unrecognized result_type.

Security-hygiene (defense-in-depth, third-party sink): scrub StrKeys on the
remaining free-text reason_code paths the PR had missed —
payment.simulation_failed and asset.operation_failed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* analytics: scrub signing-failure reason_code + bound asset.operation_failed (D2/D3/D5)

- D2 (security, high): trackSignedMessageError / trackSignedAuthEntryError now
  scrub StrKeys from reason_code before it reaches Amplitude, matching the
  extension's signBlob/signEntry.rejected handlers. A signing exception's
  message can embed a G…/S… key; mobile was shipping it verbatim. Regression
  test asserts the key is redacted to G***.
- D3: asset.operation_failed.reason_code is now the bounded Horizon op result
  code (opResultCodes[0] ?? "unknown"), not free-text — same discipline already
  applied to payment.failed/swap.failed, and identical to the extension's
  `opCodes[0] || "unknown"`. Reuses the op-code extraction the remove path
  already had (now a shared opResultCodesOf helper); drops the free-text
  scrubReasonCode path entirely.
- D5: swap.trustline_added now uses snake_case asset_code/asset_issuer (was
  camelCase tokenCode/tokenIssuer), matching sibling asset.added. Kept in
  lockstep with the extension's identical rename.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* analytics: transaction-scan result from raw result_type + scrub stragglers (D1/D4)

- D1 (high, data correctness): blockaid.scan_completed{scan_target:"transaction"}
  now derives `result` from the raw validation.result_type (guarded like the
  extension's `"result_type" in validation` check; missing/unrecognized ->
  "unknown"), instead of assessTransactionSecurity().level. The UI model
  defaulted unclassifiable results to SAFE and mapped simulation.error to
  SUSPICIOUS/warn — both diverged from the extension and inflated mobile's
  safe/warn buckets. This mirrors the token path (resultFromResultType) fixed
  last round; transaction was the remaining straggler. Regression tests cover
  recognized, unclassifiable, and simulation.error cases.
- Scrub stragglers (defense-in-depth, third-party sink): trackAccountScreen-
  ImportAccountFail (the secret-key import path — likeliest S… leak) and
  trackQRScanError (QR payloads carry G…/S… keys) now scrub inside the helper,
  matching the other track*Error helpers. Found via a full sweep of every
  free-text reason_code assignment, not just the flagged one.
- D4 (catalog hygiene): reserve blockaid.warning_reported in mobile's catalog
  (extension-only emit) so the wire string can't be reinvented/drift.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* analytics: address PR review — scan_failed scrub, StrKey C/M, swap key parity, reject guard

Review comments from #938 (paired with the extension #2909 changes):

- blockaid.scan_failed reason_code now scrubbed (trackScanFailed) — the last raw
  error path; matches the other track*Error helpers.
- scrubStrKeys now covers contract (C…, 56) and muxed (M…, 69) StrKeys, not just
  G…/S…; widened to tolerate null. (Reviewer noted C/M; corrected the length —
  muxed is 69 chars, so it's an alternation, not [GSCM]{55}.)
- swap.source_selected / destination_selected use snake_case asset_code /
  asset_issuer / requires_trustline; swap.quote_expired drops the raw amounts
  (privacy parity with completed/failed) and emits from_asset_code / to_asset_code
  (bare codes) + result_code. Kept in lockstep with the extension.
- signing.*_rejected: extracted resolveDappRejectionEvent (pure, unit-tested) so
  an approved/completed request — or an approve attempt that threw — is never
  miscounted as a user reject. Added approvalInFlightRef to separate the WC
  fallback rejection from the analytics emit.
- Completed the jest.setup.js StellarRpcMethods mock (was missing SIGN_MESSAGE /
  SIGN_AUTH_ENTRY) and moved core.test.ts into __tests__/ (requireActual path
  updated to keep bypassing the services/* mapper + global mock).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>