Security/privacy: the enable response carries addresses only. Account names
are the user's private labels and were sent to the site without saying so.

UX: the popup now leads with a request headline and a prominent, scheme-aware
origin card; the network is shown by its friendly name; the locked screen
already names the site asking for access (from the URL hint); the window title
names the site; the signing view is compact (no bookkeeping columns or paging,
transactions expanded) and the result returns to the site automatically once
everything in the request is signed, so a second click in a small window is
not needed; clearer waiting/empty states and button hierarchy.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

The SDK's default registry moved from Fnet to Testnet (app 773212345), which serves every network. Update the comments and .env templates that still named Fnet, and drop the misleading escregAppId comparison in fracReaderSdk.

use-wallet sends location.host as the ARC-0060 domain, which includes a
non-default port ("localhost:5173"); the wallet compared only the hostname, so
sign_data was refused for any dApp on a non-default port, including the
documented localhost development case. Accept the origin's host or hostname
(another host or port is still refused). The check moves to an import-free
module with a unit spec; an E2E test signs a port-bearing domain.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

The dApp library rejects names longer than 128 characters, which would make a
valid grant fail on the dApp side while the wallet kept it. Bound the name at
the source and omit it when empty.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

- Never wait on the remote genesis list for well-known networks or custom nodes
  (a stalled connection to the list host could leave the popup waiting).
- Docs name the right shared-item action (wcUpdateItemFresh).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

- Grant updates are now one atomic critical section: wallet/wcUpdateItemFresh
  runs read, update and write inside the cross-tab Web Lock, so concurrent
  updates (popup approve vs main-tab revoke) can neither restore a revoked
  grant nor drop a new one. The shared-item merge is a pure, unit-tested module.
- direct/reset runs first and in its own try/catch on logout and wallet
  destruction, so a pending request is always answered 4001 even if another
  transport's teardown throws.
- Only the four known peer fields are persisted (no dApp-controlled extra keys).
- A refused second channel start no longer tears down the live channel.
- Tests: merge unit spec, concurrent-update atomicity and lock-mid-request E2E.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

- approveEnable restores the pending request when persisting the grant fails,
  so the popup can retry or reject instead of going blank.
- Connect page: a Direct-tab load failure no longer aborts the page init.
- startPopup load failure shows the "start over" state rather than "refused".
- changePassword takes the cross-tab wallet write lock and keeps shared items
  persisted by other tabs (shared serializer with saveWallet).
- Document the dApp-implementer rules (unique window name, accepted origins).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

- Stale tab: saveWallet now takes the persisted value of shared wc items
  (direct:sessions) and wallet-record writes are serialized across tabs with a
  Web Lock, so a stale main tab can neither restore a revoked grant nor drop a
  new one.
- Single-use channel: a reload or lock/unlock cycle never announces ready again.
- handleRequest answers 4000 and ends the request on unexpected failure; the
  popup shows a "refused" state; approve/send/cancel responses are idempotent.
- The built-in table of well-known networks wins over the remote genesis list;
  grants are bound to the network they were made on; sign_data validates an
  optional genesisHash.
- Reject trailing-dot origins; /payWC inside a popup uses the minimal layout.
- Document the wire contract (wallet providerId, normalized genesisHash).
- Tests: wire-shape contract, stale-tab regression, disable, reload replay,
  ARC-60 unapproved signer / domain mismatch / approved signer, poisoned list.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

A third dApp transport next to WalletConnect and Liquid Auth. The dApp opens
/direct in a popup and exchanges ARC-0027 messages over window.postMessage;
nothing passes through a relay or the internet, so it works for localhost dApps
and offline installs.

Security: the dApp identity is the browser-verified event.origin (https or
loopback only), every message must come from both the hinted origin and
window.opener, replies use that origin as targetOrigin (never "*"), exactly one
request per popup within 30 s of ready, refuses to run framed or without an
opener, network-binds every request and transaction to the active genesis hash,
and reuses the shared sender/signer admission guards. Site grants live in the
encrypted wallet blob and are written with a read-modify-write against the
persisted record so a stale tab cannot overwrite another tab's data.

Also: Connect page "Direct" tab (list/revoke sites), frame-ancestors CSP in the
nginx config, connect.direct.* strings in all 10 locales, docs/DIRECT.md,
changelog, unit tests and a Playwright E2E spec using a cross-origin fixture dApp.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>