chore: align Product SDK package set

docs/backlog/24-access-streaming-v2.md

@@ -139,10 +139,12 @@ P3 first vertical slice delivered (`agent/audio-v2-p3`):
   the browser/device validation matrix, startup telemetry export, and the
   backend read-through gateway decision.
 
-Product SDK adaptation note (2026-07-26):
+Product SDK adaptation note (updated 2026-08-26):
 
-- Product SDK 0.20.1 and deploy tooling 0.13.1 remain
+- Product SDK 0.23.0 and deploy tooling 0.13.1 remain
   prototype/reference/unaudited.
+- Root PAPI 3.0.0 is not adopted yet because the current Product SDK graph
+  uses PAPI 2.2.x while `@polkadot-apps` still uses PAPI 1.23.x.
 - Host APIs are progressive enhancement for Product containers; standalone web
   remains a supported mode.
 - Host detection, explicit Product account identity, a Product DevNet build,

docs/backlog/README.md

@@ -110,17 +110,19 @@ explicit Host detection, app-scoped Product identity, and canonical
 Product-origin room links. The typed runtime ports and experimental
 Product CDM/PAPI adapter boundary are implementation preparation only; they do
 not imply Product-signed contract writes, Statement Store rooms, or Humanity
-decisions. API-side Product-signed key/session verification now exists through
-`product-sr25519-v1`, but the Product frontend still needs to send host-signed
-requests before protected playback can use that identity path.
+decisions. Product-signed key/session verification now exists through
+`product-sr25519-v1`, and the Product frontend sends that request shape after
+explicit Product account connection. Live host evidence remains required before
+Product identity can be treated as broadly proven across devices.
 
 The Product SDK evidence snapshot used for this replanning is now
-`@parity/product-sdk` 0.20.1 and
+`@parity/product-sdk` 0.23.0 and
 `@polkadot-community-foundation/polkadot-app-deploy` 0.13.1,
-last aligned with the checked-in package set on 2026-08-06 and rechecked
-against npm on 2026-08-25. Newer Product SDK/PAPI packages exist and remain a
-dedicated compatibility task because the host/mobile boundary is still moving
-quickly. They remain prototype / reference / unaudited code.
+last aligned with npm on 2026-08-26. The Product SDK set remains prototype /
+reference / unaudited code. Root `polkadot-api` 3.0.0 exists but is not yet
+adopted because the current Product SDK packages use PAPI 2.2.x and
+`@polkadot-apps` packages use PAPI 1.23.x, so a single PAPI 3 root breaks
+Dotify's Bulletin/wallet type seams.
 Product SDK contracts target `pallet-revive` / PolkaVM CDM flows, not Dotify's
 current viem + EVM RPC write path; Statement Store is useful for small
 ephemeral presence, not full chat, SDP/ICE, durable media metadata, or guest

docs/backlog/improvement-plan.md

@@ -67,11 +67,12 @@ sound. Only the baseline rows marked delivered may be presented as live.
 
 Product SDK snapshot used for this plan:
 
-- `@parity/product-sdk` 0.20.1 (aligned with the checked-in package set on
-  2026-08-06; rechecked 2026-08-25 against latest npm `0.23.0`);
+- `@parity/product-sdk` 0.23.0, host 0.16.0, statement-store 0.6.5, and
+  descriptors 0.10.0 (aligned with npm on 2026-08-26);
 - `@polkadot-community-foundation/polkadot-app-deploy` 0.13.1;
-- deferred SDK drift: host 0.16.0, statement-store 0.6.5, descriptors 0.10.0,
-  and `polkadot-api` 3.0.0 need a dedicated compatibility PR;
+- deferred PAPI drift: root `polkadot-api` 3.0.0 is published, but the current
+  Product SDK graph uses PAPI 2.2.x and `@polkadot-apps` uses PAPI 1.23.x, so
+  Dotify keeps root PAPI 1.23.3 until upstream packages converge;
 - explicit prototype / reference / unaudited status;
 - Product target: DevNet Asset Hub / People / Bulletin;
 - contracts package: `pallet-revive`, PolkaVM artifacts, and CDM manifests;

docs/backlog/polkadot-product-readiness-and-killer-dapp-roadmap.md

@@ -3,12 +3,14 @@
 Status: active execution note; the Product DevNet baseline is delivered on
 `dev` and remains tracked through Product compatibility issue #85.
 
-Last Product SDK package check: 2026-08-25. Dotify still pins
-`@parity/product-sdk` 0.20.1 and
-`@polkadot-community-foundation/polkadot-app-deploy` 0.13.1. npm currently
-publishes `@parity/product-sdk` 0.23.0, host 0.16.0, statement-store 0.6.5,
-descriptors 0.10.0, and `polkadot-api` 3.0.0; upgrade remains a dedicated
-compatibility task, not a casual lockfile bump.
+Last Product SDK package check: 2026-08-26. Dotify now pins the current
+published Product SDK set: `@parity/product-sdk` 0.23.0, host 0.16.0,
+statement-store 0.6.5, descriptors 0.10.0, and
+`@polkadot-community-foundation/polkadot-app-deploy` 0.13.1. npm also
+publishes `polkadot-api` 3.0.0, but Dotify keeps root PAPI on 1.23.3 because
+the current Product SDK packages use PAPI 2.2.x and `@polkadot-apps`
+chain-client/keys/signer use PAPI 1.23.x. Root PAPI 3 remains blocked until
+the official SDK graph converges.
 
 ## Verdict
 
@@ -158,6 +160,8 @@ Goal: prove the Product host path with small spikes before committing the app.
 - Delivered: connect the app-scoped Product account only on explicit action and
   separate identity capability from EVM signing capability.
 - Delivered: publishable Bulletin/DotNS build and dual-origin Fly boundary.
+- Delivered: align the Product SDK set with the 2026-08-26 npm latest while
+  keeping standalone/Product builds green.
 - Remaining: prototype host transaction signing and resource allocation.
 - Compare Dotify's Hardhat/EVM runtime with Product SDK PolkaVM/CDM contracts.
 - Delivered on the room-beacon branch: Statement Store presence with strict
@@ -210,6 +214,8 @@ Goal: deepen the delivered Product mode one adapter at a time.
   `devnet` is the only environment Dotify can serve a catalog from.
 - Next: `pallet-revive` account mapping plus real host-signed transaction smoke
   tests before Product writes can replace the EVM wallet path.
+- Next: revisit root `polkadot-api` 3 after Product SDK and `@polkadot-apps`
+  packages publish on a compatible PAPI major line.
 - Next: confirm the Product-supported CASH settlement model before exposing any
   native/CASH conversion, bridge, or receipt UI. Dotify must keep runtime access
   grants tied to verifiable settlement evidence.

docs/explanation/listening-rooms.md

@@ -132,9 +132,10 @@ architecture: its sandbox
 [removes `window.RTCPeerConnection` from Product scripts](https://github.com/Polkadot-Community-Foundation/polkadot-ios-community/blob/main/Packages/Products/product-container/src/index.ts#L79-L81).
 The Product `WebRtc` permission can still be recorded by the host, but
 it does not expose a JavaScript peer connection. Dotify cannot reach ICE or TURN
-inside that container, so executable `[0, 1, 11]` opens the canonical HTTPS room
-in the system browser instead. Full in-app support requires a host-provided,
-permission-gated WebRTC bridge or restoring the browser API after permission.
+inside that container, so executable `[0, 1, 11]` and later open the canonical
+HTTPS room in the system browser instead. Full in-app support requires a
+host-provided, permission-gated WebRTC bridge or restoring the browser API after
+permission.
 
 ### Limitations
 

docs/explanation/product-devnet-architecture.md

@@ -108,9 +108,9 @@ gateway URL.
 There is one current mobile exception. The iOS Product container removes
 `window.RTCPeerConnection` from Product scripts, so Dotify cannot create a
 browser WebRTC peer inside that sandbox even after requesting the `WebRtc`
-permission. Executable `[0, 1, 11]` detects that pre-ICE boundary and opens the
-same canonical HTTPS room URL in the external browser instead. Native in-app
-room audio now depends on a Product Mobile host capability such as a
+permission. Executable `[0, 1, 11]` and later detect that pre-ICE boundary and
+open the same canonical HTTPS room URL in the external browser instead. Native
+in-app room audio now depends on a Product Mobile host capability such as a
 permission-gated peer connection API or media bridge; the upstream clarification
 request is tracked in
 [Polkadot-Community-Foundation/dotli-community#27](https://github.com/Polkadot-Community-Foundation/dotli-community/issues/27).
@@ -455,23 +455,25 @@ The current baseline is:
 | Component                                            | Pinned/target value                |
 | ---------------------------------------------------- | ---------------------------------- |
 | Node                                                 | 22                                 |
-| `@parity/product-sdk`                                | `0.20.1`                           |
-| `@parity/product-sdk-host`                           | `0.15.1`                           |
-| `@parity/product-sdk-statement-store`                | `0.6.2`                            |
-| `@parity/product-sdk-descriptors`                    | `0.8.0`                            |
+| `@parity/product-sdk`                                | `0.23.0`                           |
+| `@parity/product-sdk-host`                           | `0.16.0`                           |
+| `@parity/product-sdk-statement-store`                | `0.6.5`                            |
+| `@parity/product-sdk-descriptors`                    | `0.10.0`                           |
 | `polkadot-api`                                      | `1.23.3`                           |
 | `@polkadot-community-foundation/polkadot-app-deploy` | `0.13.1` in the deploy command     |
 | Product network                                      | `devnet`                           |
 | Product domain                                       | `dotify-test01.dot`                |
 | Public gateway                                       | `https://dotify-test01.dev-dot.li` |
 | Asset Hub EVM chain ID                               | `420420417`                        |
 
-Checked against npm on 2026-08-25: the Product SDK set has newer published
-versions (`@parity/product-sdk` `0.23.0`, host `0.16.0`, statement-store
-`0.6.5`, descriptors `0.10.0`, and `polkadot-api` `3.0.0`). Dotify keeps the
-older pinned set until a dedicated compatibility branch verifies Product
-Desktop, Product Mobile fallback, Product sr25519 key requests, and the
-experimental CDM/PAPI adapter together.
+Checked against npm on 2026-08-26: the Product SDK set above is current. npm
+also publishes `polkadot-api` `3.0.0`, but Dotify keeps root PAPI on `1.23.3`
+for now. The current official Product SDK packages bring their own PAPI
+`2.2.x` tree, while `@polkadot-apps` chain-client/keys/signer still depend on
+PAPI `1.23.x`. A direct root PAPI 3 trial removed the public
+`PolkadotSigner` export and broke `ChainDefinition` / `TypedApi` compatibility
+at the Bulletin and wallet seams. Root PAPI 3 therefore remains a blocked
+compatibility migration until the upstream SDK graph converges.
 
 For every SDK or deploy-tool upgrade:
 

docs/manual/room-audio-smoke-test.md

@@ -58,7 +58,7 @@ another actually hearing the same track in sync, with no wallet friction for the
   `flyctl logs -a dotify-signal --no-tail`: an offer without an answer is
   followed by a metadata-only `webrtc:diagnostic` identifying the failing
   listener phase. No SDP or ICE candidate is logged.
-- For executable `[0, 1, 11]`, verify that a Product Mobile runtime with no
+- For executable `[0, 1, 11]` or later, verify that a Product Mobile runtime with no
   `RTCPeerConnection` shows **Continue in browser**, opens the same
   `#/rooms/<id>` URL externally, and does not keep sending retry offers.
 - Do not expect a coturn allocation when the diagnostic phase is

docs/operations/dependency-security-status.md

@@ -1,6 +1,6 @@
 # Dependency and Security Status
 
-Last checked: 2026-08-25.
+Last checked: 2026-08-26.
 
 This record captures the dependency/security evidence for the maintenance pass
 that follows the Product payment-label work. It is not a blanket policy change:
@@ -13,20 +13,22 @@ inside their reviewed scope.
 | --- | --- | --- |
 | `web` | `brace-expansion` override `5.0.8` -> `5.0.9` | Removes the high-severity `brace-expansion` advisory from the frontend toolchain. |
 | `web` | Lockfile updates inside declared ranges: `viem` `2.55.19`, `@polkadot-apps/chain-client` `2.0.6`, `@polkadot-apps/descriptors` `1.0.2` | Keeps the Product/PAPI-facing browser stack current without changing public ranges or SDK major assumptions. |
+| `web` | Product SDK set: `@parity/product-sdk` `0.20.1` -> `0.23.0`, host `0.15.1` -> `0.16.0`, statement-store `0.6.2` -> `0.6.5`, descriptors `0.8.0` -> `0.10.0` | Aligns Dotify's Product adapter with the latest published Product SDK packages while preserving the standalone path and Product CDM opt-in boundary. |
+| `web` | Lockfile regeneration also moves minor transitives inside already-declared ranges, including Rollup `4.63.0`, `@scure/base` `2.3.0`, and `ufo` `1.6.4` | npm resolution collateral from the Product SDK install; no direct dependency range or public runtime contract changes. |
 | `services/api` | Lockfile updates inside declared ranges: `fastify` `5.12.1`, `@fastify/cors` `11.3.0`, `@fastify/multipart` `10.1.1`, `viem` `2.55.19`, `ws` `8.21.0`, `find-my-way` `9.9.0`, `fast-uri` `3.1.6`, `esbuild` `0.28.2` | Brings the backend API audit to zero vulnerabilities without changing the env contract. |
 | `contracts/evm` | Lockfile updates inside declared ranges: Hardhat `2.29.1`, Hardhat plugins within the Hardhat 2 line, Mocha `11.8.0`, `viem` `2.55.19` | Reduces dev-tooling audit exposure without migrating to Hardhat 3. |
 
 ## Official Version Drift
 
-Checked against npm published versions on 2026-08-25.
+Checked against npm published versions on 2026-08-26.
 
 | Package | Current pinned/locked value | Latest published value | Decision |
 | --- | --- | --- | --- |
-| `@parity/product-sdk` | `0.20.1` | `0.23.0` | Defer to a Product SDK compatibility PR; mobile host behavior is still moving. |
-| `@parity/product-sdk-host` | `0.15.1` | `0.16.0` | Defer with the Product SDK set. |
-| `@parity/product-sdk-statement-store` | `0.6.2` | `0.6.5` | Defer with the Product SDK set. |
-| `@parity/product-sdk-descriptors` | `0.8.0` | `0.10.0` | Defer with the Product SDK set because descriptor changes affect the CDM/PAPI adapter. |
-| `polkadot-api` | `1.23.3` | `3.0.0` | Defer as a major migration; Product and PAPI generated descriptors need a dedicated validation pass. |
+| `@parity/product-sdk` | `0.23.0` | `0.23.0` | Current. |
+| `@parity/product-sdk-host` | `0.16.0` | `0.16.0` | Current. |
+| `@parity/product-sdk-statement-store` | `0.6.5` | `0.6.5` | Current. |
+| `@parity/product-sdk-descriptors` | `0.10.0` | `0.10.0` | Current. |
+| `polkadot-api` | `1.23.3` | `3.0.0` | Blocked as a root migration: Product SDK `0.23.0` currently depends on PAPI `2.2.x`, while `@polkadot-apps/chain-client` / keys / signer depend on PAPI `1.23.x`; a direct root PAPI 3 trial removes `PolkadotSigner` and breaks `ChainDefinition` / `TypedApi` compatibility. |
 | `@polkadot-community-foundation/polkadot-app-deploy` | `0.13.1` | `0.13.1` | Current. |
 | `react` / `react-dom` | `18.3.1` | `19.2.8` | Defer as a UI/runtime migration. |
 | `vite` | `6.x` | `8.2.2` | Defer as a build-system migration. |
@@ -44,14 +46,20 @@ Checked against npm published versions on 2026-08-25.
 `web`:
 
 - `brace-expansion` is fixed.
-- `npm audit --audit-level=moderate` still reports high-severity transitive
+- `npm audit --audit-level=moderate` still reports 26 high-severity transitive
   findings through `deepmerge-ts` / `write-package` / `@polkadot-api/cli` and
   `nanoid` / `@novasamatech/host-api`.
-- `npm audit --omit=dev --audit-level=moderate` reports the same Product/PAPI
-  chain because those packages are runtime dependencies. npm does not offer a
-  non-breaking fix for the `deepmerge-ts` path.
-- Next safe action: dedicated Product SDK + PAPI migration spike from the
-  current Host/mobile behavior, not `npm audit fix --force`.
+- `npm audit --omit=dev --audit-level=moderate` reports the same 26 Product /
+  PAPI chain findings because those packages are runtime dependencies. npm does
+  not offer a non-breaking fix for the `deepmerge-ts` path.
+- Product SDK latest does not remove that audit chain. A root
+  `polkadot-api@3.0.0` trial also did not produce a deployable graph because
+  the official Product SDK and `@polkadot-apps` packages still use different
+  PAPI major lines.
+- Next safe action: Product host-signed transaction/resource-allocation smoke
+  tests on this SDK set, plus upstream monitoring for a Product SDK /
+  `@polkadot-apps` PAPI 3 convergence release. Do not run
+  `npm audit fix --force` on the Product stack.
 
 `contracts/evm`:
 
@@ -63,10 +71,10 @@ Checked against npm published versions on 2026-08-25.
 
 ## Improvement Flags
 
-- Add a Product SDK compatibility branch that tests `@parity/product-sdk`
-  `0.23.0`, host `0.16.0`, statement-store `0.6.5`, descriptors `0.10.0`,
-  and `polkadot-api` `3.0.0` against Product Desktop, Product Mobile fallback,
-  CDM resolver generation, Product sr25519 key requests, and room join links.
+- Run real Product host smoke tests for Product sr25519 key/session requests
+  and the opt-in `product-cdm` runtime adapter with the SDK `0.23.0` set.
+- Track root `polkadot-api` `3.0.0` separately until Product SDK and
+  `@polkadot-apps` publish compatible packages on the same PAPI major line.
 - Plan a Hardhat 3 migration separately from app/runtime changes.
 - Keep the standalone web/API path first-class; Product SDK mode remains a
   progressive enhancement until host signing, WebRTC capability, and runtime