Merge pull request 'Restore identity photo previews in Flutter Web' (#71) from kyc-69 into main

docs/ux/auth-journeys.md

@@ -296,3 +296,66 @@ real token was checked read-only and remains unused and unexpired, with its
 account pending verification, ready for the user to reopen the link. PR #61 has
 not been merged into remote main; this local deployment does not imply a main
 branch merge.
+
+### Accepted signup delivery (#62)
+
+Task [#62](https://git.sendico.io/tech/sxchnge/issues/62), branch
+`email-verification-62`, delivered in
+[PR #63](https://git.sendico.io/tech/sxchnge/pulls/63). On October 23, signup
+returned HTTP 202 and the local
+SMTP provider accepted its message with status 250, while the user reported an
+internal-error screen immediately after Create account. No subsequent
+verification request from that attempt reached the BFF. The precise original
+client exception was not captured; an ordinary isolated release reproduction
+succeeded. The regression below deliberately injects an unavailable follow-up
+send service to cover the post-acceptance failure path without claiming that
+injected exception was the original cause.
+
+Backend and preview signup mappers now return a `VerificationDelivery` domain
+receipt with the recipient and simulation status. It means that signup accepted
+the email-queue operation, not inbox delivery, account activation or a session.
+The signup provider exposes it through its operation result. The form captures
+the receipt before clearing password controllers, whose change listeners reset
+auth state, and passes it as transient router extra. The verification provider
+initializes directly in the sent state; mounting the page performs no send.
+This replaces the backend adapter's hidden one-use signup cache. Every explicit
+resend now invokes its service, including the first one after signup.
+
+Routes without a receipt retain their existing behavior: unverified login may
+request an email, a fresh verification page asks for an address, and emailed
+links run confirmation. Recipient changes invalidate the displayed claim until
+another send succeeds. New receipts replace stale recipients. The route codec
+discards the receipt when serializing history, so reloads do not invent a queued
+result or retain the address. No token or password is included in the receipt.
+
+The existing email-delivery requested/succeeded signals now follow the accepted
+signup receipt inside the instrumented service instead of a synthetic send on
+page mount. They stay in the signup journey, occur once for the accepted
+operation, and remain intermediate queue-acceptance signals. Resends retain
+separate attempts and failures; confirmation remains the terminal outcome.
+Simulation and privacy rules are unchanged, including the in-memory analytics
+and cross-device correlation limitations above.
+
+Frontend review covered the complete app/auth contribution and preserved the
+DTO, mapper, service, domain model, provider and UI boundaries. Regressions cover
+accepted signup followed by unavailable resend, explicit retry, normalized
+receipt mapping, provider initialization/reset, recipient replacement, transient
+history, event correlation and exclusion of form values from analytics. EN/RU
+flow tests run at 390px with 1.5x text scaling; existing keyboard, autofill and
+accessibility suites also pass. Changed-file Dart format checks, analysis in
+`frontend/app` and `frontend/packages/sxchnge_auth`, and `make test-frontend`
+(221 tests) pass. The new injected-failure regression failed on the previous
+implementation and passes with the receipt handoff. A release-browser fixture
+with the same backend adapter and a failing resend service shows Check your
+inbox after signup with no send call, then the expected error only after an
+explicit resend. It sends no email. Native Safari was not automated.
+
+The frontend image was rebuilt with freshly resolved stable digest pins and
+recreated without restarting BFF. The served JavaScript matches the new image
+at SHA-256 `0a45ce6f0b4658b1f03d8e39b9e39fd3fbfcf6f1626cb3f17705dce2da130a6c`.
+Normal browser-trust HTTPS serves the frontend and API with HTTP 200.
+`sh infra/local/tools.sh verify` passes all seven services, Vault/database
+checks and authenticated Sendico currency/ledger reads. No new customer email,
+activation or payment was submitted for this change, and no security scan was
+requested or run. The user's pre-existing browser tab must reload to use the
+new bundle; their original Safari exception remains unobserved.

docs/ux/exchange-workspace.md

@@ -302,6 +302,33 @@ that contradicts displayed balances or usage without explaining the fixtures.
 - Keep unrelated accounts/history accessible during a pending operation. Do not
   block the whole product behind an exchange spinner.
 
+## Empty currency accounts (task #66)
+
+The shared empty-account message used on Accounts and transfer screens explains
+that no currency accounts have been set up and directs the customer to support
+to request setup. English and Russian no longer suggest that refreshing creates
+accounts or imply that automatic provisioning is underway. This follows the
+existing support guidance for missing funding and payout setup. The application
+has no configured support contact channel; the message therefore provides text
+guidance without a nonfunctional contact button or invented contact details.
+
+UX review: the copy names the missing resource and the next step, retains the
+existing wrapping text and accessible reading order, and does not alter loading,
+error or populated-state behavior. Existing manual refresh remains available for
+accounts provisioned externally. This copy-only change adds no controls or
+journey outcomes and requires no new analytics events. Existing transaction
+journey signals and their production measurement limitations below still apply;
+support resolution and external account provisioning are not measured in-app.
+
+Validation: `flutter gen-l10n`, `flutter analyze` in `frontend/app`,
+`make test-frontend` (217 tests), and `git diff --check` passed. No Dart source
+changed, so Dart formatting was not applicable. Existing responsive workspace
+tests cover Russian at 320px with enlarged text; this copy-only change does not
+add a dedicated empty-state rendering or native screen-reader test. No security
+scan was requested. Delivery: [task #66](https://git.sendico.io/tech/sxchnge/issues/66),
+branch `wallet-66`, [PR #68](https://git.sendico.io/tech/sxchnge/pulls/68).
+Merge and deployment remain separate.
+
 ## Journey measurement plan
 
 Reuse the typed analytics abstraction and maintain a separate journey per active

docs/ux/photo-preview.md

@@ -0,0 +1,98 @@
+# Identity photo preview correction
+
+Task [#69](https://git.sendico.io/tech/sxchnge/issues/69), branch `kyc-69`.
+Delivery: [PR #71](https://git.sendico.io/tech/sxchnge/pulls/71).
+This frontend change builds on the [identity verification journey](kyc.md)
+and is independent of the birthday controls in task #67.
+
+## Cause and correction
+
+A synthetic valid PNG reproduced this Flutter 3.47.7 browser error:
+
+```text
+TypeError: Instance of '_UnmodifiableUint8ListView': type
+'_UnmodifiableUint8ListView' is not a subtype of type 'NativeUint8List'
+```
+
+The stack reached `Uint8ListToJSUint8Array.toJS` from CanvasKit's browser
+image decoder through `MemoryImage` and `ResizeImage`. File selection had
+successfully decoded the original typed bytes. The `Photo` constructor then
+copied them into an unmodifiable view, which was passed directly into the
+preview's web decoder. Native decoding accepted that view, hiding the bug in
+native-only tests. The generic image error builder presented the failure as a
+damaged document even though the selected bytes were valid.
+
+`PhotoPreview` now creates a native `Uint8List` copy for `MemoryImage` once per
+selected photo. The shared domain model stays immutable, and validation,
+providers, services and transport contracts remain unchanged. The preview still
+requests a decode width of at most 1000 pixels and evicts its decoded cache entry
+on replacement or disposal. The extra encoded-byte copy belongs to the preview
+and is released with its provider/cache references; no secure-erasure guarantee
+is made.
+
+An actual preview failure now says that the preview could not be displayed and
+suggests selecting the photo again. The English/Russian fallback keeps at least
+the preview's usual height, can grow for long text, and has a separate live-region
+semantic node. Existing replacement/removal controls stay available and selected
+input is retained. This is distinct from validation's corrupt-file message.
+
+## UX and measurement review
+
+The outcome remains selecting readable ID and selfie photos, checking both on
+review, and submitting for confirmed service acceptance. Existing KYC journey
+attempts, retries, failure, submission and abandonment signals are reused. No
+control-level events, image bytes, filenames, form values or raw exceptions are
+added to telemetry. A selection success measures validation; it does not establish
+that pixels were painted. Preview-only rendering failures are not separately
+counted by existing telemetry. Server review/approval measurement and native
+screen-reader QA retain the limitations documented in the original journey.
+
+Regression tests use synthetic JPEG/PNG content only. They start and await real
+image decoding outside the widget test's fake async zone, inspect the actual
+rendered images, and surface stream errors so an error fallback cannot conceal a
+failure. Checks cover portrait/landscape decoding, model immutability, bounded
+decode width, stable provider reuse, replacement/removal cache eviction, both
+review slots, returning to review, localized fallback/replacement, a 320px view
+at 1.6 text scale, and error announcements isolated from surrounding instructions.
+The `image` package is already a KYC runtime dependency; its direct app test
+dependency is used only to create synthetic fixtures in memory.
+
+## Validation and delivery
+
+The original browser regression failed before the fix while its native equivalent
+passed. The complete task diff was reviewed against frontend architecture, UX,
+measurement, lifecycle and privacy requirements. Final validation passed:
+
+- In `frontend/app`, `dart format --output=none --set-exit-if-changed
+  lib/kyc/preview.dart test/preview_test.dart`: two files, no changes.
+- In `frontend/app`, `flutter analyze --no-pub`: no issues.
+- In `frontend/app`, `flutter test --platform chrome test/preview_test.dart
+  --reporter expanded --no-pub --verbose`: all six regression tests passed.
+- At the repository root, `make test-frontend`: all 228 tests passed across
+  the shared packages, theme example and app, including the six native preview
+  regressions and existing KYC journey/analytics tests.
+- In `frontend/app`, `flutter build web --no-pub`: release build and Wasm
+  compatibility dry run succeeded.
+
+Browser regression coverage uses Chrome; Safari and native assistive-technology
+testing remain release checks. Generated localization and build code stays
+ignored; the tracked app lockfile changes only `image` from transitive to direct
+test dependency. The separate birthday worktree was preserved.
+
+## Follow-up contribution review
+
+The complete seven-file contribution was reviewed again before the authorized
+merge and frontend rollout. No additional defects were found in the byte-copy
+boundary, provider reuse, cache disposal, error semantics/localization, privacy,
+architecture or regression coverage. No source changes were needed.
+
+Current `main` (`ec4115d`, including the birthday, signup-delivery and account
+setup changes) was merged into `kyc-69` before final verification. The two-file
+format check and app analyzer passed; all six Chrome preview regressions and
+all 240 tests in `make test-frontend` passed on the combined code. The original
+228-test result above describes the earlier isolated branch.
+
+The authorized rollout rebuilds only `frontend` from clean, pulled `main`, using
+the repository's fresh stable-release resolver and digest-pinned local inputs.
+Runtime image, HTTPS and served-bundle verification are recorded in task #69
+after the rollout; generated local pins remain ignored.

frontend/app/lib/auth/form.dart

@@ -99,10 +99,11 @@ class _AuthFormState extends State<AuthForm> {
         return;
       }
       final email = _email.text.trim();
+      final delivery = signup.state.result!.delivery;
       TextInput.finishAutofillContext();
       _password.clear();
       _confirmation.clear();
-      context.goNamed(AppRoutes.verificationSent, extra: email);
+      context.goNamed(AppRoutes.verificationSent, extra: delivery ?? email);
     } else {
       final login = context.read<LoginProvider>();
       await login.login(

frontend/app/lib/kyc/preview.dart

@@ -1,3 +1,5 @@
+import 'dart:typed_data';
+
 import 'package:flutter/material.dart';
 
 import 'package:sxchnge_kyc/sxchnge_kyc.dart';
@@ -15,8 +17,12 @@ class PhotoPreview extends StatefulWidget {
 
 class _PhotoPreviewState extends State<PhotoPreview> {
   late ImageProvider _image = _provider();
-  ImageProvider _provider() =>
-      ResizeImage.resizeIfNeeded(1000, null, MemoryImage(widget.photo.bytes));
+  ImageProvider _provider() => ResizeImage.resizeIfNeeded(
+    1000,
+    null,
+    // Web decoders require a native typed array, not the model's read-only view.
+    MemoryImage(Uint8List.fromList(widget.photo.bytes)),
+  );
   @override
   void didUpdateWidget(covariant PhotoPreview oldWidget) {
     super.didUpdateWidget(oldWidget);
@@ -38,7 +44,15 @@ class _PhotoPreviewState extends State<PhotoPreview> {
     height: 220,
     fit: BoxFit.contain,
     semanticLabel: widget.label,
-    errorBuilder: (_, _, _) =>
-        Text(AppLocalizations.of(context)!.kycErrorUnreadable),
+    errorBuilder: (_, _, _) => ConstrainedBox(
+      constraints: const BoxConstraints(minHeight: 220),
+      child: Center(
+        child: Semantics(
+          container: true,
+          liveRegion: true,
+          child: Text(AppLocalizations.of(context)!.kycErrorPreview),
+        ),
+      ),
+    ),
   );
 }

frontend/app/lib/l10n/en.arb

@@ -128,6 +128,7 @@
   "kycErrorFormat": "Choose a JPEG or PNG image. Other formats are not supported.",
   "kycErrorLarge": "This image is too large. Choose one under 10 MB and 40 megapixels.",
   "kycErrorUnreadable": "This image is damaged or cannot be read. Choose another photo.",
+  "kycErrorPreview": "The photo preview could not be displayed. Try choosing the photo again.",
   "kycErrorSmall": "The photo is too small. Use an image at least 600 pixels wide and high.",
   "kycErrorIncomplete": "Choose both photos and confirm they belong to you before submitting.",
   "kycErrorSession": "Your session has expired. Return to login, then check your verification status.",
@@ -160,7 +161,7 @@
   "wRecent": "Recent activity",
   "wSeeAll": "See all",
   "wEmptyActivity": "Your next move starts here. Your transactions will appear below.",
-  "wEmptyAccounts": "Your accounts are not ready yet. Try refreshing.",
+  "wEmptyAccounts": "No currency accounts have been set up for you yet. Contact support to request account setup.",
   "wRefresh": "Refresh",
   "wSource": "From account",
   "wDestination": "To account",

frontend/app/lib/l10n/ru.arb

@@ -128,6 +128,7 @@
   "kycErrorFormat": "Выберите изображение JPEG или PNG. Другие форматы не поддерживаются.",
   "kycErrorLarge": "Изображение слишком большое. Выберите файл до 10 МБ и 40 мегапикселей.",
   "kycErrorUnreadable": "Изображение повреждено или не читается. Выберите другое фото.",
+  "kycErrorPreview": "Не удалось показать фото. Попробуйте выбрать его ещё раз.",
   "kycErrorSmall": "Фото слишком маленькое. Ширина и высота должны быть не менее 600 пикселей.",
   "kycErrorIncomplete": "Выберите оба фото и подтвердите, что на них вы и ваш документ.",
   "kycErrorSession": "Сессия истекла. Войдите снова и проверьте статус верификации.",
@@ -160,7 +161,7 @@
   "wRecent": "Последние операции",
   "wSeeAll": "Смотреть все",
   "wEmptyActivity": "Ваш следующий шаг начинается здесь. Здесь появятся ваши операции.",
-  "wEmptyAccounts": "Ваши счета ещё не готовы. Попробуйте обновить страницу.",
+  "wEmptyAccounts": "У вас ещё нет валютных счетов. Обратитесь в поддержку за помощью с их открытием.",
   "wRefresh": "Обновить",
   "wSource": "Со счёта",
   "wDestination": "На счёт",

frontend/app/lib/routing/router.dart

@@ -4,6 +4,8 @@ import 'package:flutter/widgets.dart';
 
 import 'package:go_router/go_router.dart';
 
+import 'package:sxchnge_auth/sxchnge_auth.dart';
+
 import 'package:sxchnge_wallet/sxchnge_wallet.dart';
 
 import '../auth/page.dart';
@@ -144,6 +146,9 @@ GoRouter createAppRouter({bool Function()? authenticated}) {
         name: AppRoutes.verificationSent,
         builder: (context, state) => VerificationPage(
           email: state.extra is String ? state.extra as String : null,
+          delivery: state.extra is VerificationDelivery
+              ? state.extra as VerificationDelivery
+              : null,
         ),
       ),
       GoRoute(

frontend/app/lib/verification/page.dart

@@ -15,9 +15,10 @@ import '../routing/routes.dart';
 import '../generated/i18n/app_localizations.dart';
 
 class VerificationPage extends StatefulWidget {
-  const VerificationPage({super.key, this.email, this.token});
+  const VerificationPage({super.key, this.email, this.token, this.delivery});
   final String? email;
   final String? token;
+  final VerificationDelivery? delivery;
 
   @override
   State<VerificationPage> createState() => _VerificationPageState();
@@ -25,9 +26,12 @@ class VerificationPage extends StatefulWidget {
 
 class _VerificationPageState extends State<VerificationPage> {
   final _form = GlobalKey<FormState>();
-  late final _email = TextEditingController(text: widget.email);
+  late final _email = TextEditingController(
+    text: widget.delivery?.email ?? widget.email,
+  );
   late final _provider = VerificationProvider(
     context.read<VerificationService>(),
+    delivery: widget.delivery,
   );
   final _emailFocus = FocusNode();
   String? _recipient;
@@ -44,7 +48,7 @@ class _VerificationPageState extends State<VerificationPage> {
         if (!mounted) return;
         if (widget.token != null) {
           _provider.confirm(widget.token!);
-        } else if (_email.text.isNotEmpty) {
+        } else if (widget.delivery == null && _email.text.isNotEmpty) {
           _send();
         }
       });
@@ -58,14 +62,26 @@ class _VerificationPageState extends State<VerificationPage> {
   @override
   void didUpdateWidget(covariant VerificationPage oldWidget) {
     super.didUpdateWidget(oldWidget);
-    if (oldWidget.token == widget.token) return;
+    if (oldWidget.token == widget.token &&
+        oldWidget.email == widget.email &&
+        identical(oldWidget.delivery, widget.delivery)) {
+      return;
+    }
+    if (oldWidget.token != widget.token) {
       context.read<JourneyRecorder>().abandon(JourneyExit.navigation);
-    _provider.reset();
+    }
+    _provider.reset(delivery: widget.delivery);
     _lastWasSend = false;
     _validated = false;
-    _email.clear();
+    _recipient = null;
+    _email.text = widget.delivery?.email ?? widget.email ?? '';
     WidgetsBinding.instance.addPostFrameCallback((_) {
-      if (mounted && widget.token != null) _provider.confirm(widget.token!);
+      if (!mounted) return;
+      if (widget.token != null) {
+        _provider.confirm(widget.token!);
+      } else if (widget.delivery == null && _email.text.isNotEmpty) {
+        _send();
+      }
     });
   }
 

frontend/app/pubspec.lock

@@ -206,7 +206,7 @@ packages:
     source: hosted
     version: "18.0.1"
   http:
-    dependency: transitive
+    dependency: "direct dev"
     description:
       name: http
       sha256: "87721a4a50b19c7f1d49001e51409bddc46303966ce89a65af4f4e6004896412"
@@ -222,7 +222,7 @@ packages:
     source: hosted
     version: "4.1.2"
   image:
-    dependency: transitive
+    dependency: "direct dev"
     description:
       name: image
       sha256: "1976370a4df3091bb0f72409c187ad1f9132a818bc6b95ca59c0bae1c75c688e"

frontend/app/pubspec.yaml

@@ -29,9 +29,11 @@ dependencies:
   go_router: ^18.0.1
   country_picker: ^2.0.28
 dev_dependencies:
+  image: ^4.9.0
   flutter_test:
     sdk: flutter
   flutter_lints: ^6.0.0
+  http: ^1.6.0
 flutter:
   generate: true
   uses-material-design: true

frontend/app/test/preview_test.dart

@@ -0,0 +1,229 @@
+import 'dart:async';
+import 'dart:typed_data';
+
+import 'package:flutter/material.dart';
+
+import 'package:flutter_test/flutter_test.dart';
+
+import 'package:image/image.dart' as images;
+
+import 'package:sxchnge_kyc/sxchnge_kyc.dart';
+
+import 'package:sxchnge_app/kyc/photo.dart';
+import 'package:sxchnge_app/kyc/preview.dart';
+
+import 'package:sxchnge_app/generated/i18n/app_localizations.dart';
+
+Widget host(Widget child, {Locale locale = const Locale('en')}) => MaterialApp(
+  locale: locale,
+  localizationsDelegates: AppLocalizations.localizationsDelegates,
+  supportedLocales: AppLocalizations.supportedLocales,
+  home: Scaffold(body: SingleChildScrollView(child: child)),
+);
+
+// Start decoding outside FakeAsync as well as waiting outside it, including
+// browser codec callbacks that otherwise remain pending in the test zone.
+Future<void> show(WidgetTester tester, Widget widget) async {
+  await tester.runAsync(() => tester.pumpWidget(widget));
+}
+
+// pumpAndSettle alone does not wait for image codecs. Listen to the actual
+// preview streams so a hidden errorBuilder cannot make this regression pass.
+Future<void> decoded(WidgetTester tester, {bool succeeds = true}) async {
+  final providers = tester
+      .widgetList<Image>(find.byType(Image))
+      .map((image) => image.image)
+      .toList();
+  expect(providers, isNotEmpty);
+  for (final provider in providers) {
+    Object? renderError;
+    StackTrace? renderStack;
+    await tester.runAsync(() async {
+      final stream = provider.resolve(ImageConfiguration.empty);
+      final ready = Completer<void>();
+      final listener = ImageStreamListener(
+        (info, _) {
+          info.dispose();
+          if (!ready.isCompleted) ready.complete();
+        },
+        onError: (Object error, StackTrace? stack) {
+          renderError = error;
+          renderStack = stack;
+          if (!ready.isCompleted) ready.complete();
+        },
+      );
+      stream.addListener(listener);
+      try {
+        await ready.future.timeout(const Duration(seconds: 15));
+      } finally {
+        stream.removeListener(listener);
+      }
+    });
+    expect(
+      renderError,
+      succeeds ? isNull : isNotNull,
+      reason: succeeds ? '$renderError\n$renderStack' : null,
+    );
+  }
+  await tester.pumpAndSettle();
+  expect(tester.takeException(), isNull);
+}
+
+void main() {
+  late Uint8List png;
+  late Uint8List jpeg;
+  setUpAll(() {
+    // Synthetic, non-sensitive portrait and landscape photos in both formats.
+    png = images.encodePng(images.Image(width: 1200, height: 1600));
+    jpeg = images.encodeJpg(images.Image(width: 1600, height: 1200));
+  });
+
+  for (final format in ['PNG', 'JPEG']) {
+    testWidgets('accepted $format renders from an immutable photo model', (
+      tester,
+    ) async {
+      final source = Uint8List.fromList(format == 'PNG' ? png : jpeg);
+      final photo = (await tester.runAsync(
+        () => FilePhotoService.validate(source),
+      ))!;
+      final originalFirstByte = photo.bytes.first;
+      source[0] = 0;
+      expect(photo.bytes.first, originalFirstByte);
+      expect(() => photo.bytes[0] = 0, throwsUnsupportedError);
+      await show(
+        tester,
+        host(PhotoPreview(photo: photo, label: 'ID document photo')),
+      );
+      await decoded(tester);
+      final raw = tester.widget<RawImage>(find.byType(RawImage));
+      expect(raw.image, isNotNull);
+      expect(raw.image!.width, lessThanOrEqualTo(1000));
+      expect(
+        tester.widget<Image>(find.byType(Image)).semanticLabel,
+        'ID document photo',
+      );
+      expect(find.textContaining('damaged'), findsNothing);
+      expect(find.textContaining('could not be displayed'), findsNothing);
+    });
+  }
+
+  testWidgets('replacement and removal evict sensitive preview cache entries', (
+    tester,
+  ) async {
+    final first = Photo(png);
+    await show(tester, host(PhotoPreview(photo: first, label: 'ID')));
+    await decoded(tester);
+    final initialProvider = tester.widget<Image>(find.byType(Image)).image;
+    final initialKey = await initialProvider.obtainKey(
+      ImageConfiguration.empty,
+    );
+    final cache = PaintingBinding.instance.imageCache;
+    expect(cache.statusForKey(initialKey).keepAlive, isTrue);
+    await show(tester, host(PhotoPreview(photo: first, label: 'Document')));
+    await decoded(tester);
+    expect(
+      identical(
+        tester.widget<Image>(find.byType(Image)).image,
+        initialProvider,
+      ),
+      isTrue,
+    );
+    await show(tester, host(PhotoPreview(photo: Photo(jpeg), label: 'ID')));
+    await decoded(tester);
+    expect(cache.statusForKey(initialKey).untracked, isTrue);
+    final replacement = tester.widget<Image>(find.byType(Image)).image;
+    final replacementKey = await replacement.obtainKey(
+      ImageConfiguration.empty,
+    );
+    expect(cache.statusForKey(replacementKey).keepAlive, isTrue);
+    expect(tester.widget<RawImage>(find.byType(RawImage)).image!.width, 1000);
+    await show(tester, host(const SizedBox()));
+    await tester.pumpAndSettle();
+    expect(cache.statusForKey(replacementKey).untracked, isTrue);
+  });
+
+  testWidgets('ID and selfie both render on review and after returning', (
+    tester,
+  ) async {
+    final passport = Photo(png);
+    final selfie = Photo(jpeg);
+    for (var visit = 0; visit < 2; visit++) {
+      await show(
+        tester,
+        host(
+          Column(
+            children: [
+              PhotoPanel(
+                kind: PhotoKind.passport,
+                photo: passport,
+                review: true,
+              ),
+              PhotoPanel(kind: PhotoKind.selfie, photo: selfie, review: true),
+            ],
+          ),
+        ),
+      );
+      await decoded(tester);
+      final previews = tester.widgetList<RawImage>(find.byType(RawImage));
+      expect(previews.length, 2);
+      expect(previews.every((image) => image.image != null), isTrue);
+      expect(find.text('Choose a different photo'), findsNothing);
+      await show(tester, host(const SizedBox()));
+      await tester.pumpAndSettle();
+    }
+  });
+
+  for (final locale in ['en', 'ru']) {
+    testWidgets(
+      '$locale preview failure explains recovery and can be replaced',
+      (tester) async {
+        tester.view.physicalSize = const Size(320, 900);
+        tester.view.devicePixelRatio = 1;
+        tester.platformDispatcher.textScaleFactorTestValue = 1.6;
+        addTearDown(tester.view.resetPhysicalSize);
+        addTearDown(tester.view.resetDevicePixelRatio);
+        addTearDown(tester.platformDispatcher.clearTextScaleFactorTestValue);
+        var replacements = 0;
+        var removals = 0;
+        await show(
+          tester,
+          host(
+            PhotoPanel(
+              kind: PhotoKind.passport,
+              photo: Photo(Uint8List.fromList([1, 2, 3])),
+              onPick: () => replacements++,
+              onRemove: () => removals++,
+            ),
+            locale: Locale(locale),
+          ),
+        );
+        await decoded(tester, succeeds: false);
+        final l = AppLocalizations.of(tester.element(find.byType(PhotoPanel)))!;
+        expect(find.text(l.kycErrorPreview), findsOneWidget);
+        expect(find.text(l.kycErrorUnreadable), findsNothing);
+        expect(
+          tester.getSemantics(find.text(l.kycErrorPreview)),
+          matchesSemantics(isLiveRegion: true, label: l.kycErrorPreview),
+        );
+        final replace = find.byKey(const ValueKey('pick-passport'));
+        await tester.ensureVisible(replace);
+        await tester.tap(replace);
+        final remove = find.text(l.kycRemove);
+        await tester.ensureVisible(remove);
+        await tester.tap(remove);
+        expect(replacements, 1);
+        expect(removals, 1);
+        await show(
+          tester,
+          host(
+            PhotoPanel(kind: PhotoKind.passport, photo: Photo(jpeg)),
+            locale: Locale(locale),
+          ),
+        );
+        await decoded(tester);
+        expect(find.text(l.kycErrorPreview), findsNothing);
+        expect(tester.widget<RawImage>(find.byType(RawImage)).image, isNotNull);
+      },
+    );
+  }
+}

frontend/app/test/routing_test.dart

@@ -42,6 +42,44 @@ Future<GoRouter> openRoute(
 }
 
 void main() {
+  testWidgets('queued signup receipt is transient and updates its recipient', (
+    tester,
+  ) async {
+    final router = await openRoute(tester, '/');
+    await tester.pumpAndSettle();
+    router.goNamed(
+      AppRoutes.verificationSent,
+      extra: const VerificationDelivery(
+        email: 'first@example.com',
+        isSimulated: false,
+      ),
+    );
+    await tester.pumpAndSettle();
+    expect(find.byKey(const ValueKey('verification-sent')), findsOneWidget);
+    expect(find.text('first@example.com'), findsOneWidget);
+    router.goNamed(
+      AppRoutes.verificationSent,
+      extra: const VerificationDelivery(
+        email: 'second@example.com',
+        isSimulated: false,
+      ),
+    );
+    await tester.pumpAndSettle();
+    expect(find.text('first@example.com'), findsNothing);
+    expect(find.text('second@example.com'), findsOneWidget);
+    final restored = router.routeInformationParser.restoreRouteInformation(
+      router.routerDelegate.currentConfiguration,
+    )!;
+    expect(restored.state.toString(), isNot(contains('second@example.com')));
+    expect(restored.uri.toString(), '/verification-sent');
+    router.goNamed(AppRoutes.login);
+    await tester.pumpAndSettle();
+    router.goNamed(AppRoutes.verificationSent);
+    await tester.pumpAndSettle();
+    expect(find.byKey(const ValueKey('verification-idle')), findsOneWidget);
+    expect(find.text('second@example.com'), findsNothing);
+  });
+
   for (final language in ['en', 'ru']) {
     testWidgets(
       'verified link keeps success visible and prefills login ($language)',

frontend/app/test/signup_delivery_test.dart

@@ -0,0 +1,153 @@
+import 'dart:convert';
+
+import 'package:flutter/material.dart';
+
+import 'package:flutter_test/flutter_test.dart';
+
+import 'package:go_router/go_router.dart';
+
+import 'package:http/http.dart' as http;
+import 'package:http/testing.dart';
+
+import 'package:sxchnge_analytics/sxchnge_analytics.dart';
+
+import 'package:sxchnge_auth/sxchnge_auth.dart';
+
+import 'package:sxchnge_app/main.dart';
+import 'package:sxchnge_app/providers/locale.dart';
+
+class DeliveryBackend extends BackendAuthServices {
+  DeliveryBackend(List<String> requests)
+    : super(
+        baseUri: Uri.parse('https://api.example/api/v1'),
+        clientId: 'web',
+        client: MockClient((request) async {
+          requests.add(request.url.path);
+          return http.Response(
+            jsonEncode({
+              'data': request.url.path.endsWith('/signup')
+                  ? {'userId': 'customer'}
+                  : {'accepted': true},
+            }),
+            202,
+          );
+        }),
+      );
+
+  int sends = 0;
+  bool failResend = true;
+
+  @override
+  Future<VerificationResult> send({
+    required String email,
+    required String locale,
+  }) async {
+    sends++;
+    if (failResend) {
+      throw const VerificationException(VerificationError.internal);
+    }
+    return super.send(email: email, locale: locale);
+  }
+}
+
+void main() {
+  for (final language in ['en', 'ru']) {
+    testWidgets(
+      'accepted signup survives an unavailable resend service ($language)',
+      (tester) async {
+        tester.view.physicalSize = const Size(390, 844);
+        tester.view.devicePixelRatio = 1;
+        tester.platformDispatcher.textScaleFactorTestValue = 1.5;
+        addTearDown(tester.view.resetPhysicalSize);
+        addTearDown(tester.view.resetDevicePixelRatio);
+        addTearDown(tester.platformDispatcher.clearTextScaleFactorTestValue);
+        final requests = <String>[];
+        final backend = DeliveryBackend(requests);
+        final analytics = DummyAnalyticsService();
+        await tester.pumpWidget(
+          SxchngeApp(
+            backend: backend,
+            analyticsService: analytics,
+            localeProvider: LocaleProvider(initialLocale: Locale(language)),
+          ),
+        );
+        await tester.pumpAndSettle();
+        final signup = find.text(language == 'ru' ? 'Регистрация' : 'Sign up');
+        await tester.ensureVisible(signup);
+        await tester.tap(signup);
+        await tester.pumpAndSettle();
+        for (final entry in {
+          'name': 'Ada Lovelace',
+          'email': 'ada@example.com',
+          'password': 'password preserved',
+          'confirmation': 'password preserved',
+        }.entries) {
+          await tester.enterText(find.byKey(ValueKey(entry.key)), entry.value);
+        }
+        final submit = find.byKey(const ValueKey('submit'));
+        await tester.ensureVisible(submit);
+        await tester.tap(submit);
+        await tester.pumpAndSettle();
+
+        expect(find.byKey(const ValueKey('verification-sent')), findsOneWidget);
+        expect(find.text('ada@example.com'), findsOneWidget);
+        expect(backend.sends, 0);
+        expect(requests, ['/api/v1/accounts/signup']);
+        final router = GoRouter.of(tester.element(find.byType(Scaffold)));
+        final restored = router.routeInformationParser.restoreRouteInformation(
+          router.routerDelegate.currentConfiguration,
+        )!;
+        expect(restored.uri.toString(), '/verification-sent');
+        expect(restored.state.toString(), isNot(contains('ada@example.com')));
+        expect(
+          analytics.events.where(
+            (event) => event.name == 'auth_signup_succeeded',
+          ),
+          hasLength(1),
+        );
+        expect(
+          analytics.events.where(
+            (event) => event.name == 'auth_email_delivery_succeeded',
+          ),
+          hasLength(1),
+        );
+
+        final resend = find.byKey(const ValueKey('verification-resend'));
+        await tester.ensureVisible(resend);
+        await tester.tap(resend);
+        await tester.pumpAndSettle();
+        expect(
+          find.byKey(const ValueKey('verification-error')),
+          findsOneWidget,
+        );
+        expect(backend.sends, 1);
+        expect(
+          tester
+              .widget<TextFormField>(
+                find.byKey(const ValueKey('verification-email')),
+              )
+              .controller!
+              .text,
+          'ada@example.com',
+        );
+        backend.failResend = false;
+        await tester.ensureVisible(resend);
+        await tester.tap(resend);
+        await tester.pumpAndSettle();
+        expect(find.byKey(const ValueKey('verification-sent')), findsOneWidget);
+        expect(backend.sends, 2);
+        expect(requests.last, '/api/v1/accounts/verification/send');
+        expect(requests, hasLength(2));
+        expect(
+          analytics.events.map((event) => event.journeyId).toSet(),
+          hasLength(1),
+        );
+        expect(
+          analytics.events.map((event) => event.properties).toString(),
+          isNot(contains('ada@example.com')),
+        );
+        expect(tester.takeException(), isNull);
+      },
+    );
+  }
+}

frontend/packages/sxchnge_auth/lib/src/mappers/backend.dart

@@ -12,9 +12,13 @@ abstract final class BackendMapper {
     return VerificationResult(isSimulated: false, verifiedEmail: dto.email);
   }
 
-  static AuthResult signup(BackendDTO dto) {
+  static AuthResult signup(BackendDTO dto, {required String email}) {
     if (dto.userId.isEmpty) throw const FormatException('Missing user');
-    return AuthResult(userId: dto.userId, isSimulated: false);
+    return AuthResult(
+      userId: dto.userId,
+      isSimulated: false,
+      delivery: VerificationDelivery(email: email, isSimulated: false),
+    );
   }
 
   static FactorChallenge challenge(BackendDTO dto, String id) {

frontend/packages/sxchnge_auth/lib/src/mappers/results.dart

@@ -5,6 +5,12 @@ import '../models/verification.dart';
 abstract final class AuthMapper {
   static AuthResult fromDTO(AuthDTO dto) =>
       AuthResult(userId: dto.userId, isSimulated: dto.simulated);
+
+  static AuthResult signup(AuthDTO dto, {required String email}) => AuthResult(
+    userId: dto.userId,
+    isSimulated: dto.simulated,
+    delivery: VerificationDelivery(email: email, isSimulated: dto.simulated),
+  );
 }
 
 abstract final class VerificationMapper {

frontend/packages/sxchnge_auth/lib/src/models/auth.dart

@@ -1,4 +1,5 @@
 import 'two_factor.dart';
+import 'verification.dart';
 
 /// Ephemeral input: never persist, log, or include passwords in provider state.
 class LoginRequest {
@@ -31,9 +32,11 @@ class AuthResult {
     required this.userId,
     required this.isSimulated,
     this.challenge,
+    this.delivery,
   });
   final String userId;
   final FactorChallenge? challenge;
+  final VerificationDelivery? delivery;
   final bool isSimulated;
 }
 

frontend/packages/sxchnge_auth/lib/src/models/verification.dart

@@ -11,6 +11,13 @@ enum VerificationStatus {
 
 enum VerificationError { expired, invalid, internal, needsAssistance }
 
+/// An accepted email-queue operation, not proof of inbox delivery or activation.
+class VerificationDelivery {
+  const VerificationDelivery({required this.email, required this.isSimulated});
+  final String email;
+  final bool isSimulated;
+}
+
 class VerificationException implements Exception {
   const VerificationException(this.code);
   final VerificationError code;

frontend/packages/sxchnge_auth/lib/src/providers/verification.dart

@@ -4,13 +4,22 @@ import '../models/verification.dart';
 import '../services/verification.dart';
 
 class VerificationProvider extends ChangeNotifier {
-  VerificationProvider(this.service);
+  VerificationProvider(this.service, {VerificationDelivery? delivery})
+    : _state = _initialState(delivery);
   final VerificationService service;
-  VerificationState _state = const VerificationState(VerificationStatus.idle);
+  VerificationState _state;
   VerificationState get state => _state;
   bool _disposed = false;
   int _generation = 0;
 
+  static VerificationState _initialState(VerificationDelivery? delivery) =>
+      delivery == null
+      ? const VerificationState(VerificationStatus.idle)
+      : VerificationState(
+          VerificationStatus.sent,
+          isSimulated: delivery.isSimulated,
+        );
+
   Future<void> send({required String email, required String locale}) => _run(
     () => service.send(email: email.trim(), locale: locale),
     VerificationStatus.sending,
@@ -61,10 +70,10 @@ class VerificationProvider extends ChangeNotifier {
     notifyListeners();
   }
 
-  void reset() {
+  void reset({VerificationDelivery? delivery}) {
     if (_disposed) return;
     ++_generation;
-    _state = const VerificationState(VerificationStatus.idle);
+    _state = _initialState(delivery);
     notifyListeners();
   }
 

frontend/packages/sxchnge_auth/lib/src/services/backend.dart

@@ -51,7 +51,6 @@ class BackendAuthServices
   final _pending = <String, ({String token, String challengeId})>{};
   final _grants = <String, AuthSession>{};
   final _retryKeys = <String, String>{};
-  String? _queuedSignup;
   AuthSession? _session;
   AuthSession? get session => _session;
   @override
@@ -113,9 +112,8 @@ class BackendAuthServices
       'locale': r.locale,
       'idempotencyKey': key,
     });
-    final result = BackendMapper.signup(dto);
+    final result = BackendMapper.signup(dto, email: email);
     _retryKeys.remove('signup:$email');
-    _queuedSignup = email;
     return result;
   }
 
@@ -141,14 +139,6 @@ class BackendAuthServices
     required String locale,
   }) async {
     final normalized = email.trim().toLowerCase();
-    // Signup already queued this email. The existing confirmation page requests
-    // its initial delivery on mount; consume that receipt once.
-    if (_queuedSignup == normalized) {
-      _queuedSignup = null;
-      return VerificationMapper.fromDTO(
-        const VerificationDTO(simulated: false),
-      );
-    }
     final key = _retryKeys.putIfAbsent('activation:$normalized', _key);
     try {
       await _post('verification/send', {

frontend/packages/sxchnge_auth/lib/src/services/dummy.dart

@@ -40,8 +40,9 @@ class DummySignupService implements SignupService, SimulationInfo {
   Future<AuthResult> signup(SignupRequest request) async {
     await Future<void>.delayed(delay);
     if (failure case final error?) throw AuthException(error);
-    return AuthMapper.fromDTO(
+    return AuthMapper.signup(
       const AuthDTO(userId: 'demo-user', simulated: true),
+      email: request.email.trim(),
     );
   }
 }

frontend/packages/sxchnge_auth/lib/src/services/instrumented.dart

@@ -111,13 +111,27 @@ class InstrumentedAuthServices
     simulation: _simulation(loginService),
   );
   @override
-  Future<AuthResult> signup(SignupRequest request) => _run(
+  Future<AuthResult> signup(SignupRequest request) async {
+    final result = await _run(
       JourneyKind.signup,
       JourneyStep.signup,
       () => signupService.signup(request),
       (r) => r.isSimulated,
       simulation: _simulation(signupService),
     );
+    final delivery = result.delivery;
+    if (delivery != null) {
+      final operation = recorder.begin(
+        JourneyKind.verification,
+        JourneyStep.emailDelivery,
+        onboarding: true,
+        simulated: delivery.isSimulated,
+      );
+      recorder.finish(operation, simulated: delivery.isSimulated);
+    }
+    return result;
+  }
+
   @override
   Future<VerificationResult> send({
     required String email,

frontend/packages/sxchnge_auth/test/auth_test.dart

@@ -142,11 +142,11 @@ void main() {
           .isSimulated,
       isTrue,
     );
-    expect(
-      (await const DummySignupService(delay: Duration.zero).signup(signup))
-          .isSimulated,
-      isTrue,
-    );
+    final accepted = await const DummySignupService(delay: Duration.zero)
+        .signup(signup);
+    expect(accepted.isSimulated, isTrue);
+    expect(accepted.delivery?.email, 'a@example.com');
+    expect(accepted.delivery?.isSimulated, isTrue);
     await expectLater(
       const DummyLoginService(
         delay: Duration.zero,

frontend/packages/sxchnge_auth/test/backend_test.dart

@@ -89,7 +89,9 @@ void main() {
       expect(keys[0], keys[1]);
     },
   );
-  test('signup receipt avoids duplicate delivery and subsequent resend reaches API', () async {
+  test(
+    'signup returns its receipt and every explicit resend reaches API',
+    () async {
       final paths = <String>[];
       final service = BackendAuthServices(
         baseUri: Uri.parse('https://api.example/api/v1'),
@@ -97,7 +99,10 @@ void main() {
         client: MockClient((request) async {
           paths.add(request.url.path);
           if (request.url.path.endsWith('/signup')) {
-          expect(jsonDecode(request.body)['password'], ' password preserved ');
+            expect(
+              jsonDecode(request.body)['password'],
+              ' password preserved ',
+            );
             return response({'userId': 'user'});
           }
           return response({'accepted': true});
@@ -113,11 +118,19 @@ void main() {
         ),
       );
       expect(result.isSimulated, isFalse);
-    await service.send(email: 'user@example.com', locale: 'en');
+      expect(result.delivery?.email, 'user@example.com');
+      expect(result.delivery?.isSimulated, isFalse);
       expect(paths, ['/api/v1/accounts/signup']);
       await service.send(email: 'user@example.com', locale: 'en');
+      expect(paths, [
+        '/api/v1/accounts/signup',
+        '/api/v1/accounts/verification/send',
+      ]);
+      await service.send(email: 'user@example.com', locale: 'en');
       expect(paths.last, '/api/v1/accounts/verification/send');
-  });
+      expect(paths, hasLength(3));
+    },
+  );
   test('login confirms backend session only after factor and consumes local grant once', () async {
     final now = DateTime.now();
     var verified = false;

frontend/packages/sxchnge_auth/test/verification_test.dart

@@ -28,6 +28,36 @@ class PendingService implements VerificationService {
 }
 
 void main() {
+  test(
+    'accepted delivery initializes sent state without calling the service',
+    () async {
+      final service = PendingService();
+      final provider = VerificationProvider(
+        service,
+        delivery: const VerificationDelivery(
+          email: 'ada@example.com',
+          isSimulated: false,
+        ),
+      );
+      addTearDown(provider.dispose);
+      expect(provider.state.status, VerificationStatus.sent);
+      expect(provider.state.isSimulated, isFalse);
+      expect(provider.state.result, isNull);
+      expect(service.calls, 0);
+      final resend = provider.send(email: 'ada@example.com', locale: 'en');
+      expect(provider.state.status, VerificationStatus.sending);
+      expect(service.calls, 1);
+      service.pending.completeError(
+        const VerificationException(VerificationError.internal),
+      );
+      await resend;
+      expect(provider.state.status, VerificationStatus.error);
+      expect(provider.state.result, isNull);
+      provider.reset();
+      expect(provider.state.status, VerificationStatus.idle);
+    },
+  );
+
   for (final scenario in {
     'demo-valid': VerificationStatus.verified,
     'demo-expired': VerificationStatus.expired,