diff --git a/.env.example b/.env.example
index 981bee4..b80c96a 100644
--- a/.env.example
+++ b/.env.example
@@ -7,3 +7,5 @@ NEXT_PUBLIC_INDEXER_URL=http://localhost:3001
 # USDC token contract (Stellar Asset Contract) used for locks, and its issuer shown in the UI.
 NEXT_PUBLIC_USDC_CONTRACT_ID=
 NEXT_PUBLIC_USDC_ISSUER=
+# Feature flag: enable direct-recipient locks (create_direct_lock). Default false.
+NEXT_PUBLIC_ENABLE_DIRECT_PAYMENTS=false
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 7e2c66a..4332438 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -1,12 +1,19 @@
-# Playwright happy path (request -> send -> claim -> verify) against a dedicated, throwaway
-# testnet contract (roadmap M3-19). Signing uses a test-only keypair adapter
-# (lib/wallet/test-adapter.ts), active only when NEXT_PUBLIC_E2E_TEST_MODE=1 -- never in a real
-# deployment. The indexer is built from kinlock-sdk's own Dockerfile and run against a
-# throwaway Postgres container, mirroring the pattern already proven in kinlock-sdk's own CI
-# (ci.yml's indexer-image job).
+# On pull requests, run the browser privacy test without signing secrets. Run the signed
+# request -> send -> claim -> verify flow only after reviewed code is pushed to protected main.
+# The test-only keypair adapter (lib/wallet/test-adapter.ts) is active only when
+# NEXT_PUBLIC_E2E_TEST_MODE=1 and is never enabled in the pull-request job or a deployment.
+# The indexer is built from kinlock-sdk's Dockerfile and run against throwaway Postgres.
+#
+# Only the signed main-branch run needs the indexer (/send lists payees from it). The pull-request
+# privacy test opens /claim/{id}, which reads chain state over RPC, so it runs without the
+# indexer. Keeping the indexer off the PR path matters because RPC only serves about 7 days of
+# events: once E2E_START_LEDGER ages out of that window the indexer exits at startup, which would
+# fail every PR for a reason unrelated to the change under review.
 name: e2e
 on:
   pull_request:
+  push:
+    branches: [main]
 permissions:
   contents: read
 env:
@@ -25,19 +32,18 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         with:
           repository: Kinlock-Org/kinlock-sdk
           path: kinlock-sdk-src
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         with:
           repository: Kinlock-Org/kinlock-registry
-          # TEMPORARY: the fixture payee this job needs is still on an unmerged branch
-          # (kinlock-registry PR #38, self-authored, needs the owner's own review/merge --
-          # AGENTS.md's self-approval rule). Revert to the default (main) once it merges.
-          ref: feat/e2e-fixture-payee
           path: kinlock-registry-src
 
       - name: Start Postgres and build the indexer image
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: |
           docker network create ci
           docker run -d --name pg --network ci -e POSTGRES_PASSWORD=ci postgres:17
@@ -53,6 +59,7 @@ jobs:
           rm -rf kinlock-sdk-src
 
       - name: Migrate and start the indexer against the fixture contract
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: |
           docker run --rm --network ci -e DATABASE_URL=postgres://postgres:ci@pg:5432/postgres \
             --entrypoint node kinlock-indexer:e2e dist/db/migrate.js
@@ -68,6 +75,7 @@ jobs:
             kinlock-indexer:e2e
 
       - name: Wait for the indexer to ingest and registry-join the fixture payee
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: |
           # Event ingestion and the registry join run on separate schedules (the join re-runs
           # every REGISTRY_SYNC_MS, 60s by default, not on every new row) -- checking for "any
@@ -92,7 +100,23 @@ jobs:
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - run: pnpm exec playwright install --with-deps chromium
-      - run: pnpm e2e
+      - name: Run privacy E2E on pull requests (no signing secrets)
+        if: github.event_name == 'pull_request'
+        run: pnpm exec playwright test e2e/claim-fragment-privacy.spec.ts
+        env:
+          NEXT_PUBLIC_STELLAR_NETWORK: testnet
+          NEXT_PUBLIC_RPC_URLS: ${{ env.E2E_RPC_URL }}
+          NEXT_PUBLIC_CONTRACT_ID: ${{ env.E2E_CONTRACT_ID }}
+          NEXT_PUBLIC_INDEXER_URL: http://localhost:3001
+          NEXT_PUBLIC_USDC_CONTRACT_ID: ${{ env.E2E_TOKEN_ID }}
+          NEXT_PUBLIC_USDC_ISSUER: ${{ env.E2E_TOKEN_ISSUER }}
+          # Lock 1 on this job's dedicated fixture contract (the test default 11 is on the
+          # standing testnet contract).
+          E2E_PRIVACY_TEST_LOCK_ID: "1"
+
+      - name: Run full signed testnet E2E on protected main
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        run: pnpm e2e
         env:
           NEXT_PUBLIC_E2E_TEST_MODE: "1"
           NEXT_PUBLIC_STELLAR_NETWORK: testnet
@@ -103,8 +127,6 @@ jobs:
           NEXT_PUBLIC_USDC_ISSUER: ${{ env.E2E_TOKEN_ISSUER }}
           E2E_SENDER_SECRET: ${{ secrets.E2E_SENDER_SECRET }}
           E2E_PAYEE_SECRET: ${{ secrets.E2E_PAYEE_SECRET }}
-          # claim-fragment-privacy.spec.ts's default (lock 11) is on the standing testnet
-          # contract, not this job's dedicated fixture one -- lock 1 there is the equivalent.
           E2E_PRIVACY_TEST_LOCK_ID: "1"
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: ${{ !cancelled() }}
diff --git a/DRIPS_WAVE.md b/DRIPS_WAVE.md
index 7d251d8..61ea028 100644
--- a/DRIPS_WAVE.md
+++ b/DRIPS_WAVE.md
@@ -12,7 +12,7 @@ This document provides a single-page executive and technical summary for the Dri
 
 **Kinlock App** is the user-facing web portal allowing senders to create locks, payees to issue payment requests and claim funds, and public observers to verify institutional receipts on Stellar.
 
-- **Real-World Problem:** International payments for education, housing, and contracts suffer from lack of trust, opaque fee deductions, and custodial vulnerability. Kinlock provides a non-custodial, scheduled escrow interface directly bound to Soroban smart contracts.
+- **Real-World Problem:** Payments for education and housing can be difficult to reconcile and verify, especially when sender and payee are far apart. Kinlock provides a non-custodial way to lock USDC for a verified institution or any Stellar address, with scheduled releases and public on-chain receipts. The product is market-agnostic and launches market by market; it does not claim that a receipt proves a service was delivered.
 - **Frontend Architecture & Stellar Integration:**
   - **Framework:** Next.js 16 (App Router), React 19, TypeScript, Tailwind CSS.
   - **Wallet Integration:** Swappable multi-wallet support via `@creit.tech/stellar-wallets-kit` (Freighter, xBull, Albedo, Lobstr).
@@ -21,9 +21,9 @@ This document provides a single-page executive and technical summary for the Dri
     - Reference identifiers live exclusively in URL hash fragments (`#r=...&s=...`), strictly preventing client credentials and private references from reaching web servers, analytics tools, or access logs.
     - Nonce-enforced Content Security Policy (CSP) and site-wide `Referrer-Policy: no-referrer`. Zero third-party analytics scripts on sensitive claim paths.
   - **Universal & Market-Agnostic Core:**
-    - 100% externalized internationalization strings (`messages/en.json`).
-    - Dynamic currency and date formatting using native `Intl` APIs.
-    - Zero hardcoded national currencies or assumptions; payee metadata is fetched from canonical registry definitions.
+    - User-visible strings are externalized in the English message file; translated language packs are not yet provided.
+    - Number, currency, and date formatting use native `Intl` APIs.
+    - Country and local-currency values come from payee registry data. The sender currently displays USD only because the app has no live FX-rate provider.
 
 ---
 
@@ -45,7 +45,7 @@ This document provides a single-page executive and technical summary for the Dri
 
 - [x] **Hosted under Organization:** [`Kinlock-Org`](https://github.com/Kinlock-Org)
 - [x] **Permissive License:** Apache-2.0 ([`LICENSE`](LICENSE))
-- [x] **Branch Protection:** Enforced on `main` (peer reviews required, required checks passing)
+- [x] **Branch Protection:** The live `main` rules require one approval and the `ci`, `docs-in-sync`, `e2e`, and `roadmap-check` status checks (checked 2026-11-06).
 - [x] **Continuous Integration (CI):** Green GitHub Actions validating Biome linting, TypeScript `tsc --noEmit`, Vitest test runner, and Next.js production build
 - [x] **Security Hardening:**
   - CodeQL SAST scanning (Actions, JavaScript/TypeScript)
@@ -53,23 +53,21 @@ This document provides a single-page executive and technical summary for the Dri
   - Strict input sanitization with Zod
   - Hardened headers: CSP with dynamic script-src hashes, HSTS, `X-Content-Type-Options: nosniff`, `Referrer-Policy: no-referrer`
 - [x] **Testing Rigor:**
-  - 16 test files with 187 passing unit and integration tests
-  - Automated tests validating CSP headers, schedule calculation, refund triggers, receipt validation, inline string exclusions, and country-agnostic neutrality
+  - 16 test files and 197 passing tests on the reviewed working branch (`pnpm test`, run 2026-11-06)
+  - Automated tests cover CSP headers, schedule calculation, receipt and claim behavior, inline strings, and country-agnostic neutrality. Pull requests run the browser claim-fragment privacy test without signing credentials; the full testnet request → send → claim → verify Playwright flow runs only on protected-main pushes. The full flow previously passed in CI (`M3-19`); the updated workflow still needs a real fork-PR and protected-main run.
 - [x] **Roadmap & Progress Tracking:** Every PR tracked and enforced via [`ROADMAP.md`](ROADMAP.md)
 
 ---
 
 ## 4. Drips Wave Task Queue & Issue Board
 
-Issues for external contributors follow a strict three-tier complexity mapping aligned with Drips Wave points:
-- **Trivial (100 points):** Copy updates, accessibility improvements, ARIA landmarks, and UI state polish.
-- **Medium (150 points):** Client-side export conveniences, locale selector enhancements, and transaction receipt formatting components.
-- **High (200 points):** Comprehensive end-to-end integration workflows (Playwright happy-path test harnesses) and multi-wallet pairing fallbacks.
+The live issue tracker is authoritative for available work; tasks and point values change as issues are completed or program guidance changes. Before starting, contributors should confirm an issue is still open, assigned as required, mapped to a current roadmap item, and within the safe contribution scope. Contract fund logic and other security-sensitive changes require maintainer review and are not ordinary Wave tasks.
 
-> **Task Safety Rule:** Under `AGENTS.md`, money-moving state transitions must never read from intermediary Postgres services, and URL fragment references must never be logged or sent off-device. Wave tasks strictly reinforce these guardrails.
+> **Task safety:** Money-moving decisions read chain state, not Postgres. Claim-link references stay in the browser and must never be logged or sent to a server. Follow the repository contribution guide and issue acceptance criteria.
 
-- **Active Bounty Issues:** [Kinlock App Wave Issues](https://github.com/Kinlock-Org/kinlock-app/issues?q=is%3Aissue+is%3Aopen+label%3Adrips-wave%2Cwave)
-- **Contribution Guide:** [`CONTRIBUTING.md`](CONTRIBUTING.md) and [`docs/wave-issue-format.md`](https://github.com/Kinlock-Org/.github/blob/main/docs/wave-issue-format.md)
+- **Open issues:** [Kinlock App issues](https://github.com/Kinlock-Org/kinlock-app/issues?q=is%3Aissue+is%3Aopen)
+- **Contribution guide:** [`CONTRIBUTING.md`](CONTRIBUTING.md) and the [Wave issue format](https://github.com/Kinlock-Org/.github/blob/main/docs/wave-issue-format.md)
+- **Current implementation and remaining tasks:** [`ROADMAP.md`](ROADMAP.md)
 
 ---
 
diff --git a/README.md b/README.md
index 21d24c1..b00a6e9 100644
--- a/README.md
+++ b/README.md
@@ -27,9 +27,10 @@ A 25-second overview of the flow — lock USDC for a verified payee, the payee c
 | `/claim/[id]` | Payee verifies the reference against the on-chain `ref_hash`, then releases or declines |
 | `/locks/[id]` | Lock detail with refund, shown only when the contract allows it |
 | `/r/[txHash]/[eventIndex]`, `/verify` | Receipts rebuilt from chain data. "Payment to verified payee" — nothing more |
-| `/payee`, `/attester` | **Stubs** (`M3-11`, `M3-12`) |
+| `/payee` | Payee dashboard: connect a wallet, view and filter locks addressed to the payee, and open a lock's claim page. List data comes from the indexer; actions read chain state. |
+| `/attester` | Placeholder page; the read-only account-check tooling is not implemented yet (`M3-12`). |
 
-> **Status: the core money flows are real; the dashboard isn't.** Claim, decline, refund, receipts and verify read the **chain** through the SDK, never the indexer. `/send` is `M3-06` in progress, the Playwright happy path (`M3-19`) is still a `test.fixme` stub, and there is no live FX rate yet, so amounts show **USD only with a note**. Full state in `ROADMAP.md` (Phase 4: 11 `DONE`, 6 `IN PROGRESS`, 9 `TODO`).
+> **Status:** the sender, claim, lock-detail, payee dashboard and receipt flows are implemented. Money-moving actions and receipt verification read chain state through the SDK; the payee dashboard uses indexer data for lists. The Playwright request → send → claim → verify test is implemented, and the roadmap records it as passing in CI (`M3-19`). Local E2E runs need the dedicated testnet setup and signing secrets. There is no live FX-rate provider yet, so the app shows USD only with an explanatory note. See `ROADMAP.md` for current status and remaining work.
 
 ## The rules this repo exists to enforce
 
@@ -39,22 +40,22 @@ A 25-second overview of the flow — lock USDC for a verified payee, the payee c
 - **Nothing is hard-coded to a country.** Country and `local_currency` come from registry data. Every user-visible string lives in `messages/en.json`, keys are type-checked, and a test fails the build on an inline string; `Intl` handles numbers, currencies and dates (`M3-23` done — other locales are deferred, not missing by accident).
 - **Only `lib/sdk.ts` talks to the contract.** Wallets go through `lib/wallet/` using the Stellar Wallets Kit, so Freighter, xBull, Albedo and Lobstr are swappable.
 
-One caveat worth knowing: until the app is wired to the deployed indexer, `/send` and `/request` offer the payees in `lib/payees/known.ts` — a checked-in snapshot of the three testnet fixture payees (KE, NG, PH). It is not trusted for display: each entry's `payee_id` and `meta_hash` are re-derived locally and matched against a live `getPayee` chain read, and status and payout address always come from chain.
+Payee discovery in `/send`, `/request`, and `/payee` reads from the configured indexer. If the indexer is not configured or is unavailable, the pages display an honest unavailable state (`pages.*.indexerDown`). Money-moving actions and receipt verification read chain state directly through the SDK (hard rule 3: chain is truth).
 
 ## Quick start
 
 ```
 pnpm install
 pnpm dev
-pnpm lint && pnpm typecheck && pnpm test    # biome, tsc, vitest (13 files, 69 cases)
-pnpm e2e                                    # placeholder until M3-19
+pnpm lint && pnpm typecheck && pnpm test
+pnpm e2e                                    # Playwright; requires configured testnet E2E setup and secrets
 ```
 
 Next.js 16 (App Router), React 19, TypeScript 7, Tailwind 4. Node 20 in CI.
 
 Configuration is Zod-validated in `lib/config.ts`. Required: `NEXT_PUBLIC_STELLAR_NETWORK`, `NEXT_PUBLIC_RPC_URLS`, `NEXT_PUBLIC_CONTRACT_ID`, `NEXT_PUBLIC_USDC_CONTRACT_ID`, `NEXT_PUBLIC_USDC_ISSUER`. `NEXT_PUBLIC_INDEXER_URL` is optional — only list views need it, and the deployed testnet app currently runs without it. Copy `.env.example` to `.env.local`; never commit values.
 
-Deploys to Vercel are currently **manual** (`vercel --prod`) — there's no deploy workflow, so a merged PR does not go live by itself.
+Vercel deploys are currently **manual** (`vercel --prod`); a merged PR does not go live by itself.
 
 ## Maintainers
 
diff --git a/ROADMAP.md b/ROADMAP.md
index 98976da..b74a503 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -4,7 +4,7 @@
 
 | | |
 |---|---|
-| **Last updated** | 2026-11-01 (fix/scorecard-hardening: M3-33 DONE) |
+| **Last updated** | 2026-11-09 (fix/prelaunch-hardening: M3-42..M3-44 DONE, M3-45 TODO) |
 | **Docs baseline** | v0.3, worldwide scope (`PRD.md`, `ARCHITECTURE.md`, `ARCHITECTURE_ESSENTIALS.md`, `AGENTS.md`, `CLAUDE.md`, `project_structure.md`) |
 | **Current phase** | Phase 0 (Foundations) → starting Phase 1 (M0 Validate)                                                                              |
 | **Readiness**     | See [§3](#3-progress-snapshot)                                                                                                      |
@@ -131,7 +131,7 @@ Readiness % = `DONE ÷ (all rows − DEFERRED − DROPPED)`. Conditional rows (P
 | 1 M0 Validate | 17 | 1 | 6 | 10 | 0 | 0 | 0 | 6% |
 | 2 Contract + registry | 41 | 24 | 3 | 14 | 0 | 0 | 0 | 59% |
 | 3 SDK + indexer | 21 | 14 | 3 | 4 | 0 | 0 | 0 | 67% |
-| 4 App | 34 | 25 | 6 | 3 | 0 | 0 | 0 | 74% |
+| 4 App | 45 | 34 | 7 | 4 | 0 | 0 | 0 | 76% |
 | 5 Testnet pilot | 7 | 0 | 0 | 7 | 0 | 0 | 0 | 0% |
 | 6 Pre-mainnet features | 10 | 0 | 0 | 10 | 0 | 0 | 0 | 0% |
 | 7 Hardening | 26 | 0 | 0 | 26 | 0 | 0 | 0 | 0% |
@@ -139,7 +139,7 @@ Readiness % = `DONE ÷ (all rows − DEFERRED − DROPPED)`. Conditional rows (P
 | 9 Conditional ramp | 9 | 0 | 0 | 0 | 0 | 9 | 0 | n/a |
 | 10 Wave + community | 10 | 5 | 1 | 4 | 0 | 0 | 0 | 50% |
 | 11 Deferred parking lot | 16 | 0 | 0 | 0 | 0 | 16 | 0 | n/a |
-| **All** | **218** | **85** | **20** | **88** | **0** | **25** | **0** | **44%** |
+| **All** | **229** | **94** | **21** | **89** | **0** | **25** | **0** | **46%** |
 
 ---
 
@@ -331,6 +331,17 @@ Readiness % = `DONE ÷ (all rows − DEFERRED − DROPPED)`. Conditional rows (P
 | M3-32 | `roadmap-check.yml` exempts Dependabot (`if: github.actor != 'dependabot[bot]'`): Dependabot has no way to know AGENTS.md §12's ROADMAP.md convention and can't be configured to edit it, so every Dependabot PR opened after `M3-31` was failing this required check for a reason unrelated to the dependency bump itself | app | P1 | DONE | M3-31 | `roadmap-check` reports success (skipped) on a real Dependabot PR; confirmed via GitHub's own status-checks docs that a job skipped by a job-level `if` reports "Success" and does not block a required check, not assumed |
 | M3-33 | Scorecard remediation, Tier 2: switch CodeQL from GitHub's default setup to advanced codeql.yml; pin malware-scan.yml action SHAs and semgrep version; remove downloadThenRun curl pipe in e2e.yml; enrich SECURITY.md with disclosure process and response timelines | app | P2 | DONE | M3-31 | SAST confirmed 10/10 on Scorecard; malware-scan actions pinned by commit SHA; downloadThenRun pattern removed; full test suite passes |
 | M3-34 | Universal payments UI support: add dual-mode selector (Verified payee vs Any Stellar address) in /send, wire direct recipient to preflight and createLock, update receipts and lock views to show "Payment to recipient" for direct locks | app | P0 | DONE | M2-28 | ADR-0031; Biome lint passes; 167 tests pass; production build succeeds |
+| M3-35 | Make the required E2E check safe and actionable for external fork PRs, where GitHub does not expose testnet signing secrets | app | P1 | IN PROGRESS | M3-19 | A real fork PR completes required checks without exposing signing secrets to untrusted code; the testnet happy-path still runs in a trusted context and cannot be silently skipped |
+| M3-36 | Revert mock payee fallback on indexer downtime: show unavailable state (`payees = null`) and delete mock-data.ts | app | P0 | DONE | M3-26 | Prelaunch review Item 2; hard rule 11 and hard rule 3 respected; `listPayees()` throws on indexer failure / unset URL; `mock-data.ts` and `NEXT_PUBLIC_USE_MOCK_DATA` removed; tests verify indexer downtime yields unavailable state |
+| M3-37 | Gate direct-mode UI behind `NEXT_PUBLIC_ENABLE_DIRECT_PAYMENTS` (default false) until deployed contract supports `create_direct_lock` | app | P0 | DONE | M3-34 | Prelaunch review Item 3; direct mode hidden by default to prevent simulation errors on pre-ADR-0031 deployed contract; mode toggle suppressed when flag is false; unit tests verify flag parsing and default |
+| M3-38 | Prevent double payment and preserve claim link on pending tx | app | P0 | DONE | M3-06, M2-30 | Prelaunch review Item 4; save pending submission to local storage before submit; on TX_PENDING enter pending state with txHash and poll getTransaction without re-enabling Send; on confirmation build and store claim link in claimLinks.v1 and clean up pending; on failure return to review; unit tests verify pending submission helpers, SDK pollTransaction, and hook lifecycle |
+| M3-39 | Preflight verdict: require acknowledgement on unknown block check | app | P0 | DONE | M3-06, M2-31 | Prelaunch review Item 7; `verdict()` returns `needsAcknowledgement` when any `severity === "block"` check has `status === "unknown"`; unit tests verify unknown block checks do not pass automatically; 202 tests pass |
+| M3-40 | Apply nonce CSP site-wide to protect stored claim links across all application routes | app | P0 | DONE | M3-14 | Prelaunch review Item 8; proxy matcher applies nonce CSP site-wide excluding static assets and images; connect-src covers self, rpcOrigins, indexer origin, https://*.stellar.org, and https://albedo.link; tests verify connect-src and policy; 203 tests pass |
+| M3-41 | Vendor @kinlock/sdk tarball to pin sha512 integrity in pnpm-lock.yaml | app | P0 | DONE | M3-03 | Prelaunch review Item 9; vendor kinlock-sdk-0.3.2.tgz in vendor/ with file: dependency in package.json; pnpm-lock.yaml pins sha512 integrity; 203 tests pass; build clean |
+| M3-42 | Make the pending-send fix (M3-38) real: vendor `@kinlock/sdk` 0.3.3 (the 0.3.2 tarball lacked `TX_PENDING` and the trustline fix), never default a claim link to lock 1 when the lock id can't be read, resume a pending send after a reload, and re-export the SDK's own `KinlockError` so `instanceof` checks match SDK errors again | app | P0 | DONE | M3-38, M3-41, M2-33 | Vendored tarball contains `TX_PENDING` and `trustLine()` handling with a `sha512` in the lockfile; `confirmedLockId` returns null instead of a default; reload of `/send` with a pending record shows the pending screen and keeps the record on timeout (checked in a production build); `lib.KinlockError` is the SDK class; 206 tests pass |
+| M3-43 | Render every route per request so the site-wide nonce CSP (M3-40) doesn't block prerendered pages | app | P0 | DONE | M3-40 | `pnpm build` lists every page as dynamic; in `pnpm start`, `/` and `/attester` load with every script carrying the request nonce and no CSP violations (previously every script on `/` was blocked) |
+| M3-44 | Run the pull-request privacy E2E without the indexer: it only reads chain state, and the indexer exits at startup once `E2E_START_LEDGER` ages out of RPC's ~7-day event window, which failed every PR | app | P0 | DONE | M3-35 | Indexer steps in `e2e.yml` run only on pushes to `main`; `claim-fragment-privacy.spec.ts` passes locally against a production build with no indexer running and lock 1 on the fixture contract |
+| M3-45 | Keep the signed main-branch E2E working past RPC retention: the fixture contract's `PayeeRegistered` event (ledger 5421502) is older than testnet RPC history, so its indexer can't ingest the fixture payee. Redeploy and register a fresh fixture contract per run (or on a schedule shorter than retention) | app | P0 | TODO | M3-19 | The `main` E2E run ingests the fixture payee from a contract deployed within RPC retention and passes the request, send, claim, verify flow |
 
 ---
 
@@ -542,6 +553,16 @@ Newest first. One entry per PR. Required for every contribution (see §2).
 
 | Date | PR / ref | Repo | Rows touched | Summary |
 |---|---|---|---|---|
+| 2026-11-09 | `fix/prelaunch-hardening` (#91) | app | M3-44 DONE, M3-45 TODO (new rows) | Fix the failing `e2e` check on PRs. The indexer exited at startup with `startLedger must be within the ledger range: 5511598 - 5632557`: `E2E_START_LEDGER` (5421502) has aged out of testnet RPC's ~7-day event history. The PR job only runs the claim-fragment privacy test, which reads chain state and doesn't need the indexer, so the indexer steps now run only on `main` pushes. Verified locally: the privacy test passes against a production build with no indexer. The signed `main` run still needs a fixture contract inside RPC retention (M3-45). Progress counts computed with `scripts/roadmap-progress` on a copy and updated by hand. |
+| 2026-11-09 | `fix/prelaunch-hardening` | app | M3-42 DONE, M3-43 DONE (new rows) | Follow-up after verifying the pre-launch review fixes. M3-38 and M3-40 were marked DONE before they worked: the app still vendored SDK 0.3.2 (no `TX_PENDING`, no trustline fix), a pending send could build a claim link to lock 1, pending sends were never resumed after a reload, the app's own `KinlockError` broke `instanceof` in the request form, and the nonce CSP blocked every script on prerendered pages. This PR vendors SDK 0.3.3, removes the lock-id default, resumes pending sends on load, re-exports the SDK error class, and forces dynamic rendering at the root layout. `pnpm lint`, `pnpm typecheck`, `pnpm test` (206/206), `pnpm build` run and green; `/`, `/attester` and pending recovery on `/send` checked in a browser against `pnpm start`. Progress counts computed with `scripts/roadmap-progress` on a copy (it can't parse this file's column-padded §3 header) and updated by hand. |
+| 2026-11-08 | `fix/sdk-vendor-integrity` | app | M3-41 DONE (new row) | Fix PRELAUNCH_REVIEW Item 9: vendor @kinlock/sdk tarball in vendor/ to pin sha512 integrity in pnpm-lock.yaml (203/203 tests pass, build clean). |
+| 2026-11-08 | `feat/mock-payee-fallback` (Item 8 fix) | app | M3-40 DONE (new row) | Fix PRELAUNCH_REVIEW Item 8 (app): apply nonce CSP site-wide to protect stored claim links across all application routes, include indexer origin in originsOf, and cover wildcard stellar.org and albedo.link in connect-src (203/203 tests pass). |
+| 2026-11-08 | `fix/preflight-verdict-unknown-ack` | app | M3-39 DONE (new row) | Fix PRELAUNCH_REVIEW Item 7 (App): require sender acknowledgement when a block check returns unknown in preflight verdict (202/202 tests pass). |
+| 2026-11-08 | `feat/mock-payee-fallback` (Item 4 fix) | app | M3-38 DONE (new row) | Fix PRELAUNCH_REVIEW Item 4 (app): prevent double payment and preserve claim link on pending tx. Save pending submission before submit; on TX_PENDING enter pending state with txHash and poll getTransaction without re-enabling Send button; on confirmation build and save claim link in claimLinks.v1 and remove pending; on permanent failure return to review; added Pending UI with externalized messages; unit tests verify pending submission helpers and SDK pollTransaction (202/202 tests pass, Biome clean, Next.js build clean). |
+| 2026-11-08 | `feat/mock-payee-fallback` (Item 3 fix) | app | M3-37 DONE (new row) | Hide direct mode in kinlock-app behind `NEXT_PUBLIC_ENABLE_DIRECT_PAYMENTS` flag (default false) until deployed contract supports `create_direct_lock` (Item 3 from PRELAUNCH_REVIEW.md). In `/send`, mode toggle is suppressed and forced to verified when flag is false; unit tests verify flag parsing and default; lint, typecheck, tests, and build pass. |
+| 2026-11-08 | `fix/revert-mock-payee-fallback` (Item 2 fix) | app | M3-36 DONE, M3-26 updated | Reverted mock payee fallback on indexer downtime: `listPayees()` throws when unconfigured or on fetch failure, server pages catch and set `payees = null` (rendering `pages.*.indexerDown`), deleted `lib/indexer/mock-data.ts`, removed `NEXT_PUBLIC_USE_MOCK_DATA`, and removed mock fallback tests. Restores country-agnostic core (hard rule 11) and chain is truth (hard rule 3). All 195 tests pass, Biome clean, Next.js build succeeds. |
+| 2026-11-06 | `feat/mock-payee-fallback` (README and Wave-readiness review) | app | M3-35 IN PROGRESS | Updated the app README and Drips Wave summary to match current functionality and tests; corrected stale counts and placeholder claims. Live branch-protection and fork PR checks exposed a blocker: the required E2E job failed because GitHub withholds signing secrets from fork PRs. Updated the workflow to run the no-secret privacy test for every PR and the full signed testnet flow only on protected-main pushes; removed the stale registry-fixture branch pin. M3-35 remains IN PROGRESS pending a real fork-PR run and trusted-main E2E verification. |
+| 2026-11-05 | `feat/mock-payee-fallback` | app | M3-26 (status unchanged, DONE) | Added active fixture mock payee fallback data for `/send`, `/request`, and `/payee` so verified payee selection and locked payment flows work even when the external indexer is unconfigured or unreachable. Falls back to mock payees if indexer returns error/404 or `NEXT_PUBLIC_INDEXER_URL` is unset, or if `NEXT_PUBLIC_USE_MOCK_DATA=true`. All 197 tests pass. |
 | 2026-11-01 | `fix/scorecard-hardening` | app | M3-33 DONE | OpenSSF Scorecard hardening: pinned malware-scan.yml actions to commit SHAs and semgrep to 1.136.0 (Pinned-Dependencies); removed curl-pipe downloadThenRun pattern in e2e.yml; enriched SECURITY.md with vulnerability reporting instructions and response/disclosure timelines. All 187 tests pass. |
 | 2026-11-01 | `docs/drips-wave-application` | app | no row changes | Added dedicated DRIPS_WAVE.md application and review summary document for the Drips Wave Stellar program review panel, detailing Next.js web application architecture, live Vercel testnet deployment, strict privacy boundaries, testing hygiene, and maintainers. |
 | 2026-11-01 | `feat/route-loading-error-states` | app | M3-27 DONE | Closes #37: added route-level designed states (app/loading.tsx, app/locks/loading.tsx, app/payee/loading.tsx, app/error.tsx with autofocus retry, and honest app/not-found.tsx); added accessible Spinner and StatePanel in components/ui/; externalized strings to messages/en.json. |
diff --git a/app/layout.tsx b/app/layout.tsx
index 435612a..e1eb61b 100644
--- a/app/layout.tsx
+++ b/app/layout.tsx
@@ -6,6 +6,13 @@ import "./globals.css";
 
 const outfit = Outfit({ subsets: ["latin"], variable: "--font-outfit", display: "swap" });
 
+/**
+ * [sec] Every page is rendered per request. proxy.ts sends a nonce-based CSP on every route, and a
+ * prerendered (static) page can't carry that request's nonce, so the browser would block all of
+ * its scripts and the page would never hydrate.
+ */
+export const dynamic = "force-dynamic";
+
 export const metadata = {
   title: t("app.name"),
   description: t("app.tagline"),
diff --git a/app/send/SendForm.tsx b/app/send/SendForm.tsx
index c5939a1..c5a2170 100644
--- a/app/send/SendForm.tsx
+++ b/app/send/SendForm.tsx
@@ -7,7 +7,7 @@ import { DateTimeDisplay } from "@/components/time/DateTimeDisplay";
 import { ASSET_CODE, MAX_TRANCHES } from "@/lib/constants";
 import { shortAddress } from "@/lib/i18n/format";
 import { hasMessage, t } from "@/lib/i18n/messages";
-import { fromBaseUnits } from "@/lib/sdk";
+import { fromBaseUnits, publicConfig } from "@/lib/sdk";
 import { idsOf, localCurrencyOf, preflightKey } from "./send-logic";
 import { type SendForm as Form, useSendForm } from "./useSendForm";
 
@@ -18,9 +18,24 @@ export interface PayeeOption {
 }
 
 /** The sender flow. Markup only; state lives in useSendForm. Roadmap M3-06. */
-export function SendForm({ payees, issuer }: { payees: PayeeOption[]; issuer: string }) {
-  const f = useSendForm(idsOf(payees));
-  return f.stage === "done" ? <Done f={f} /> : <Editor f={f} payees={payees} issuer={issuer} />;
+export function SendForm({
+  payees,
+  issuer,
+  enableDirectPayments,
+}: {
+  payees: PayeeOption[];
+  issuer: string;
+  enableDirectPayments?: boolean;
+}) {
+  const directEnabled = enableDirectPayments ?? publicConfig().NEXT_PUBLIC_ENABLE_DIRECT_PAYMENTS;
+  const f = useSendForm(idsOf(payees), directEnabled);
+  if (f.stage === "done") {
+    return <Done f={f} />;
+  }
+  if (f.stage === "pending") {
+    return <Pending f={f} />;
+  }
+  return <Editor f={f} payees={payees} issuer={issuer} />;
 }
 
 function Editor({ f, payees, issuer }: { f: Form; payees: PayeeOption[]; issuer: string }) {
@@ -46,28 +61,30 @@ function Editor({ f, payees, issuer }: { f: Form; payees: PayeeOption[]; issuer:
       ) : null}
       {f.unknownPayee ? <p role="alert">{t("pages.send.prefillUnknownPayee")}</p> : null}
 
-      <div className="flex gap-4 border-b pb-2">
-        <label className="flex items-center gap-2 cursor-pointer">
-          <input
-            type="radio"
-            name="send-mode"
-            checked={f.mode === "verified"}
-            onChange={() => f.setMode("verified")}
-          />
-          <span className="text-sm font-medium">{t("pages.send.modeVerified")}</span>
-        </label>
-        <label className="flex items-center gap-2 cursor-pointer">
-          <input
-            type="radio"
-            name="send-mode"
-            checked={f.mode === "direct"}
-            onChange={() => f.setMode("direct")}
-          />
-          <span className="text-sm font-medium">{t("pages.send.modeDirect")}</span>
-        </label>
-      </div>
+      {f.directEnabled ? (
+        <div className="flex gap-4 border-b pb-2">
+          <label className="flex items-center gap-2 cursor-pointer">
+            <input
+              type="radio"
+              name="send-mode"
+              checked={f.mode === "verified"}
+              onChange={() => f.setMode("verified")}
+            />
+            <span className="text-sm font-medium">{t("pages.send.modeVerified")}</span>
+          </label>
+          <label className="flex items-center gap-2 cursor-pointer">
+            <input
+              type="radio"
+              name="send-mode"
+              checked={f.mode === "direct"}
+              onChange={() => f.setMode("direct")}
+            />
+            <span className="text-sm font-medium">{t("pages.send.modeDirect")}</span>
+          </label>
+        </div>
+      ) : null}
 
-      {f.mode === "verified" ? (
+      {f.mode === "verified" || !f.directEnabled ? (
         <label htmlFor={ids.payee} className="flex flex-col gap-1">
           <span className="font-medium">{t("pages.send.payeeLabel")}</span>
           <select
@@ -299,3 +316,38 @@ function Done({ f }: { f: Form }) {
     </section>
   );
 }
+
+function Pending({ f }: { f: Form }) {
+  return (
+    <section aria-live="polite" className="mt-6 flex flex-col gap-3 rounded border p-4">
+      <h2 className="text-xl font-semibold">{t("pages.send.pendingHeading")}</h2>
+      <p>{t("pages.send.pendingBody")}</p>
+      {f.pendingTxHash ? (
+        <div className="flex flex-col gap-1">
+          <span className="text-sm font-medium">{t("pages.send.pendingTxHash")}</span>
+          <code className="break-all rounded bg-gray-50 p-2 text-xs font-mono">
+            {f.pendingTxHash}
+          </code>
+        </div>
+      ) : null}
+      <p role="alert" className="text-sm font-medium text-amber-700">
+        {t("pages.send.pendingWarning")}
+      </p>
+      {f.error ? (
+        <p role="alert" className="text-sm font-medium text-red-600">
+          {t(f.error)}
+        </p>
+      ) : null}
+      <span className="flex gap-3">
+        <button
+          type="button"
+          onClick={f.checkPendingStatus}
+          disabled={f.checking}
+          className="rounded border px-4 py-2 font-medium disabled:opacity-50"
+        >
+          {f.checking ? t("pages.send.checking") : t("pages.send.pendingCheckAgain")}
+        </button>
+      </span>
+    </section>
+  );
+}
diff --git a/app/send/page.tsx b/app/send/page.tsx
index c1070f6..5e7f110 100644
--- a/app/send/page.tsx
+++ b/app/send/page.tsx
@@ -40,7 +40,11 @@ function Body({ payees }: { payees: IndexedPayee[] | null }) {
           {t("pages.send.indexerDown")}
         </p>
       ) : null}
-      <SendForm payees={options} issuer={publicConfig().NEXT_PUBLIC_USDC_ISSUER} />
+      <SendForm
+        payees={options}
+        issuer={publicConfig().NEXT_PUBLIC_USDC_ISSUER}
+        enableDirectPayments={publicConfig().NEXT_PUBLIC_ENABLE_DIRECT_PAYMENTS}
+      />
     </div>
   );
 }
diff --git a/app/send/send-logic.test.ts b/app/send/send-logic.test.ts
index 01112c9..5a7cb8e 100644
--- a/app/send/send-logic.test.ts
+++ b/app/send/send-logic.test.ts
@@ -1,6 +1,13 @@
 import type { PreflightResult } from "@kinlock/sdk";
 import { describe, expect, it } from "vitest";
-import { dateOf, defaultExpiryDate, draftProblem, prefillFrom, verdict } from "./send-logic";
+import {
+  confirmedLockId,
+  dateOf,
+  defaultExpiryDate,
+  draftProblem,
+  prefillFrom,
+  verdict,
+} from "./send-logic";
 
 const NOW = 1_791_331_200n; // 2026-10-07T00:00:00Z
 const PAYEE = "44".repeat(32);
@@ -45,6 +52,29 @@ describe("draftProblem mirrors the contract's create_lock checks", () => {
   it("accepts exactly the 1 USDC minimum", () => {
     expect(draftProblem(draft({ rows: [row("1", "2026-10-07")] }), NOW)).toBeNull();
   });
+
+  it("validates direct mode recipient requirements", () => {
+    const validG = "GBBD47IF6LWK7P7MDEVSCWR7DPUWV3NY3DTQEVFL4NAT4AQH3ZLLFLA5";
+    const validC = "CBIELTK6YBZJU5UP2WWQEUCYKLPU6AUNZ2BQ4WWFEIE3USCIHMXQDAMA";
+    expect(
+      draftProblem(draft({ mode: "direct", payeeId: undefined, recipient: validG }), NOW),
+    ).toBeNull();
+    expect(
+      draftProblem(draft({ mode: "direct", payeeId: undefined, recipient: validC }), NOW),
+    ).toBeNull();
+    expect(draftProblem(draft({ mode: "direct", payeeId: undefined, recipient: "" }), NOW)).toBe(
+      "pages.send.errorRecipient",
+    );
+    expect(
+      draftProblem(draft({ mode: "direct", payeeId: undefined, recipient: "GSHORT" }), NOW),
+    ).toBe("pages.send.errorRecipient");
+    expect(
+      draftProblem(
+        draft({ mode: "direct", payeeId: undefined, recipient: `X${"A".repeat(55)}` }),
+        NOW,
+      ),
+    ).toBe("pages.send.errorRecipient");
+  });
 });
 
 describe("defaultExpiryDate", () => {
@@ -80,9 +110,21 @@ describe("verdict", () => {
     status,
     messageKey: "x",
   });
-  it("blocks on a failed blocking check, asks to acknowledge a failed warning, else ok", () => {
+  it("blocks on a failed blocking check, asks to acknowledge an unknown block check or failed warning, else ok", () => {
     expect(verdict([r("block", "fail"), r("warn", "fail")])).toBe("blocked");
     expect(verdict([r("block", "pass"), r("warn", "fail")])).toBe("needsAcknowledgement");
-    expect(verdict([r("block", "pass"), r("block", "unknown"), r("warn", "unknown")])).toBe("ok");
+    expect(verdict([r("block", "unknown"), r("warn", "pass")])).toBe("needsAcknowledgement");
+    expect(verdict([r("block", "pass"), r("warn", "unknown")])).toBe("ok");
+  });
+});
+
+describe("confirmedLockId", () => {
+  it("returns the lock id of a confirmed transaction", () => {
+    expect(confirmedLockId({ status: "SUCCESS", lockId: 42n })).toBe(42n);
+  });
+
+  it("never falls back to a default id when the id couldn't be read", () => {
+    expect(confirmedLockId({ status: "SUCCESS" })).toBeNull();
+    expect(confirmedLockId({ status: "FAILED", lockId: 1n })).toBeNull();
   });
 });
diff --git a/app/send/send-logic.ts b/app/send/send-logic.ts
index e6704bc..8991a88 100644
--- a/app/send/send-logic.ts
+++ b/app/send/send-logic.ts
@@ -89,11 +89,18 @@ export function prefillFrom(
 
 export type PreflightVerdict = "blocked" | "needsAcknowledgement" | "ok";
 
-/** A failed blocking check stops the send; a failed warning needs the sender's acknowledgement. */
+/** A failed blocking check stops the send; an unknown blocking check or failed warning needs the sender's acknowledgement. */
 export function verdict(results: PreflightResult[]): PreflightVerdict {
   if (results.some((r) => r.severity === "block" && r.status === "fail")) return "blocked";
-  if (results.some((r) => r.severity === "warn" && r.status === "fail"))
+  if (
+    results.some(
+      (r) =>
+        (r.severity === "block" && r.status === "unknown") ||
+        (r.severity === "warn" && r.status === "fail"),
+    )
+  ) {
     return "needsAcknowledgement";
+  }
   return "ok";
 }
 
@@ -116,3 +123,14 @@ export function localCurrencyOf(
 }
 
 export const idsOf = (payees: { payeeId: string }[]): string[] => payees.map((p) => p.payeeId);
+
+/**
+ * The lock id a confirmed transaction created, or null when it couldn't be read. Never a guess:
+ * a claim link built from a wrong id would point at someone else's lock.
+ */
+export function confirmedLockId(res: {
+  status: "SUCCESS" | "FAILED";
+  lockId?: bigint;
+}): bigint | null {
+  return res.status === "SUCCESS" && res.lockId !== undefined ? res.lockId : null;
+}
diff --git a/app/send/useSendForm.ts b/app/send/useSendForm.ts
index 1cbee13..3907d6b 100644
--- a/app/send/useSendForm.ts
+++ b/app/send/useSendForm.ts
@@ -7,28 +7,43 @@ import type { PreflightResult } from "@kinlock/sdk";
 import { useEffect, useRef, useState } from "react";
 import type { ScheduleRow } from "@/app/request/schedule";
 import { nextRow, todayUtc, unixSecondsOf } from "@/app/request/schedule";
-import { browserStore, newClaimLink, saveClaimLink } from "@/lib/claim-links";
+import {
+  browserStore,
+  listPendingSubmissions,
+  newClaimLink,
+  removePendingSubmission,
+  saveClaimLink,
+  savePendingSubmission,
+} from "@/lib/claim-links";
 import type { MessageKey } from "@/lib/i18n/messages";
 import {
   computeRefHash,
   createLock,
   generateSalt,
+  pollTransaction,
   preflight,
   publicConfig,
   toBaseUnits,
   walletSigner,
 } from "@/lib/sdk";
 import { createDefaultWalletAdapter, type WalletAdapter } from "@/lib/wallet";
-import { defaultExpiryDate, draftProblem, prefillFrom, verdict } from "./send-logic";
+import {
+  confirmedLockId,
+  defaultExpiryDate,
+  draftProblem,
+  prefillFrom,
+  verdict,
+} from "./send-logic";
 
-type Stage = "edit" | "review" | "sending" | "done";
+type Stage = "edit" | "review" | "sending" | "pending" | "done";
 const nowSeconds = () => BigInt(Math.floor(Date.now() / 1000));
 
-export function useSendForm(payeeIds: string[]) {
+export function useSendForm(payeeIds: string[], enableDirectPayments: boolean = false) {
   const wallet = useRef<WalletAdapter | null>(null);
   const [locale, setLocale] = useState("en");
+  const directEnabled = enableDirectPayments;
   const [mode, setMode] = useState<"verified" | "direct">(
-    payeeIds.length > 0 ? "verified" : "direct",
+    directEnabled && payeeIds.length === 0 ? "direct" : "verified",
   );
   const [payeeId, setPayeeId] = useState(payeeIds[0] ?? "");
   const [recipient, setRecipient] = useState("");
@@ -44,6 +59,8 @@ export function useSendForm(payeeIds: string[]) {
   const [acknowledged, setAcknowledged] = useState(false);
   const [error, setError] = useState<MessageKey | null>(null);
   const [salt, setSalt] = useState("");
+  const [pendingTxHash, setPendingTxHash] = useState<string | null>(null);
+  const [pendingSubmissionId, setPendingSubmissionId] = useState<string | null>(null);
   const [done, setDone] = useState<{ lockId: string; claimLink: string; saved: boolean } | null>(
     null,
   );
@@ -53,11 +70,31 @@ export function useSendForm(payeeIds: string[]) {
   // every render would overwrite the sender's edits and change the salt.)
   const initialized = useRef(false);
   const knownPayees = useRef(payeeIds);
+  // biome-ignore lint/correctness/useExhaustiveDependencies: runs once per page load (guarded by `initialized`); handlePendingConfirmation only uses its arguments and state setters
   useEffect(() => {
     if (initialized.current) return;
     initialized.current = true;
     setLocale(navigator.language);
     setSalt(generateSalt());
+    // A send whose confirmation timed out before a reload or closed tab: resume tracking it, so
+    // its claim link (reference and salt are only in this browser) can still be produced.
+    const store = browserStore();
+    const unresolved = store ? listPendingSubmissions(store).find((s) => s.txHash) : undefined;
+    if (unresolved?.txHash) {
+      setReferenceValue(unresolved.reference);
+      setSalt(unresolved.salt);
+      setPendingTxHash(unresolved.txHash);
+      setPendingSubmissionId(unresolved.id);
+      setStage("pending");
+      setChecking(true);
+      void handlePendingConfirmation(
+        unresolved.txHash,
+        unresolved.id,
+        unresolved.reference,
+        unresolved.salt,
+      ).finally(() => setChecking(false));
+      return;
+    }
     const fill = prefillFrom(window.location.href);
     if (fill) {
       setPrefilled(true);
@@ -93,7 +130,8 @@ export function useSendForm(payeeIds: string[]) {
     }
   }
 
-  const draft = () => ({ mode, payeeId, recipient, reference, rows, expiryDate });
+  const activeMode = directEnabled ? mode : "verified";
+  const draft = () => ({ mode: activeMode, payeeId, recipient, reference, rows, expiryDate });
   const total = () => rows.reduce((sum, r) => sum + toBaseUnits(r.amount.trim()), 0n);
 
   async function review() {
@@ -108,7 +146,7 @@ export function useSendForm(payeeIds: string[]) {
         await preflight({
           sender: address,
           token: publicConfig().NEXT_PUBLIC_USDC_CONTRACT_ID,
-          ...(mode === "direct" ? { recipient } : { payeeId }),
+          ...(activeMode === "direct" ? { recipient } : { payeeId }),
           total: total(),
           refHash,
         }),
@@ -122,16 +160,91 @@ export function useSendForm(payeeIds: string[]) {
     }
   }
 
+  async function handlePendingConfirmation(hash: string, subId: string, ref: string, slt: string) {
+    const store = browserStore();
+    try {
+      const res = await pollTransaction(hash);
+      if (res.status === "SUCCESS") {
+        // Never guess the id: a claim link to the wrong lock would point at someone else's
+        // funds. Keep the pending record so the sender can check again later.
+        const finalLockId = confirmedLockId(res);
+        if (finalLockId === null) {
+          setError("pages.send.pendingNoLockId");
+          return;
+        }
+        const claimLink = newClaimLink(window.location.origin, finalLockId, ref, slt);
+        const saved = store ? saveClaimLink(store, claimLink) : false;
+        if (store) {
+          removePendingSubmission(store, subId);
+          removePendingSubmission(store, hash);
+        }
+        setDone({
+          lockId: finalLockId.toString(),
+          claimLink,
+          saved,
+        });
+        setPendingTxHash(null);
+        setPendingSubmissionId(null);
+        setStage("done");
+        window.dispatchEvent(new StorageEvent("storage"));
+        return;
+      }
+      if (store) {
+        removePendingSubmission(store, subId);
+        removePendingSubmission(store, hash);
+      }
+      setPendingTxHash(null);
+      setPendingSubmissionId(null);
+      setError("pages.send.errorTx");
+      setStage("review");
+    } catch {
+      setError("pages.send.pendingTimeout");
+    }
+  }
+
+  async function checkPendingStatus() {
+    if (!pendingTxHash) return;
+    setError(null);
+    setChecking(true);
+    try {
+      await handlePendingConfirmation(
+        pendingTxHash,
+        pendingSubmissionId ?? pendingTxHash,
+        reference,
+        salt,
+      );
+    } finally {
+      setChecking(false);
+    }
+  }
+
   async function send() {
     if (!wallet.current || !address) return setError("pages.send.errorWallet");
     setError(null);
     setStage("sending");
+
+    const submissionId =
+      typeof crypto !== "undefined" && typeof crypto.randomUUID === "function"
+        ? crypto.randomUUID()
+        : `${Date.now()}-${Math.random()}`;
+    const store = browserStore();
+    if (store) {
+      savePendingSubmission(store, {
+        id: submissionId,
+        reference,
+        salt,
+        mode: activeMode,
+        recipientOrPayee: activeMode === "direct" ? recipient : payeeId,
+        createdAt: new Date().toISOString(),
+      });
+    }
+
     try {
-      const { lockId } = await createLock(
+      const { lockId, txHash } = await createLock(
         {
           sender: address,
           token: publicConfig().NEXT_PUBLIC_USDC_CONTRACT_ID,
-          ...(mode === "direct" ? { recipient } : { payeeId }),
+          ...(activeMode === "direct" ? { recipient } : { payeeId }),
           tranches: rows.map((r) => ({
             amount: toBaseUnits(r.amount.trim()),
             unlockAt: unixSecondsOf(r.date),
@@ -142,16 +255,44 @@ export function useSendForm(payeeIds: string[]) {
         walletSigner(wallet.current, address),
       );
       const claimLink = newClaimLink(window.location.origin, lockId, reference, salt);
-      const store = browserStore();
+      const saved = store ? saveClaimLink(store, claimLink) : false;
+      if (store) {
+        removePendingSubmission(store, submissionId);
+        if (txHash) removePendingSubmission(store, txHash);
+      }
       setDone({
         lockId: lockId.toString(),
         claimLink,
-        saved: store ? saveClaimLink(store, claimLink) : false,
+        saved,
       });
       setStage("done");
       window.dispatchEvent(new StorageEvent("storage"));
     } catch (e) {
-      const code = (e as { code?: string }).code;
+      const err = e as { code?: string; txHash?: string };
+      if (err.code === "TX_PENDING" && err.txHash) {
+        const hash = err.txHash;
+        if (store) {
+          savePendingSubmission(store, {
+            id: submissionId,
+            reference,
+            salt,
+            mode: activeMode,
+            recipientOrPayee: activeMode === "direct" ? recipient : payeeId,
+            txHash: hash,
+            createdAt: new Date().toISOString(),
+          });
+        }
+        setPendingTxHash(hash);
+        setPendingSubmissionId(submissionId);
+        setStage("pending");
+        await handlePendingConfirmation(hash, submissionId, reference, salt);
+        return;
+      }
+
+      if (store) {
+        removePendingSubmission(store, submissionId);
+      }
+      const code = err.code;
       setError(
         code === "TX_FAILED"
           ? "pages.send.errorTx"
@@ -172,6 +313,8 @@ export function useSendForm(payeeIds: string[]) {
   function reset() {
     setDone(null);
     setCopied(false);
+    setPendingTxHash(null);
+    setPendingSubmissionId(null);
     setSalt(generateSalt());
     setReferenceValue("");
     setRows([{ key: 0, amount: "", date: todayUtc() }]);
@@ -187,8 +330,10 @@ export function useSendForm(payeeIds: string[]) {
   }
   return {
     locale,
-    mode,
+    mode: activeMode,
+    directEnabled,
     setMode: (m: "verified" | "direct") => {
+      if (!directEnabled && m === "direct") return;
       setMode(m);
       backToEdit();
     },
@@ -220,6 +365,8 @@ export function useSendForm(payeeIds: string[]) {
     address,
     connect,
     stage,
+    pendingTxHash,
+    checkPendingStatus,
     checking,
     results,
     verdict: v,
diff --git a/lib/claim-links/claim-links.test.ts b/lib/claim-links/claim-links.test.ts
index d4a4a96..cfae45d 100644
--- a/lib/claim-links/claim-links.test.ts
+++ b/lib/claim-links/claim-links.test.ts
@@ -2,12 +2,17 @@ import { readFileSync } from "node:fs";
 import { describe, expect, it, vi } from "vitest";
 import {
   exportClaimLinks,
+  getPendingSubmission,
   type KeyValueStore,
   listClaimLinks,
+  listPendingSubmissions,
   newClaimLink,
+  PENDING_STORAGE_KEY,
   removeClaimLink,
+  removePendingSubmission,
   STORAGE_KEY,
   saveClaimLink,
+  savePendingSubmission,
 } from "./index";
 
 const SALT = "AAECAwQFBgcICQoLDA0ODw"; // 16 bytes, base64url
@@ -85,6 +90,54 @@ describe("claim links (browser-only storage)", () => {
     expect(file.links[0].url).toContain("#r=RENT-OCT");
   });
 
+  it("saves, retrieves, lists, and removes pending submissions safely in browser storage", () => {
+    const store = memoryStore();
+    const sub1 = {
+      id: "sub-1",
+      reference: "INV-1",
+      salt: SALT,
+      mode: "verified" as const,
+      recipientOrPayee: "payee-1",
+      createdAt: "2026-10-07T10:00:00Z",
+    };
+    const sub2 = {
+      id: "sub-2",
+      reference: "INV-2",
+      salt: SALT,
+      mode: "direct" as const,
+      recipientOrPayee: "GABC...",
+      txHash: "11".repeat(32),
+      createdAt: "2026-10-07T11:00:00Z",
+    };
+    expect(savePendingSubmission(store, sub1)).toBe(true);
+    expect(savePendingSubmission(store, sub2)).toBe(true);
+
+    const list = listPendingSubmissions(store);
+    expect(list.map((s) => s.id)).toEqual(["sub-2", "sub-1"]);
+
+    expect(getPendingSubmission(store, "sub-1")?.reference).toBe("INV-1");
+    expect(getPendingSubmission(store, "11".repeat(32))?.reference).toBe("INV-2");
+    expect(getPendingSubmission(store)?.id).toBe("sub-2");
+
+    removePendingSubmission(store, "11".repeat(32));
+    expect(listPendingSubmissions(store).map((s) => s.id)).toEqual(["sub-1"]);
+
+    removePendingSubmission(store, "sub-1");
+    expect(listPendingSubmissions(store)).toEqual([]);
+
+    store.setItem(PENDING_STORAGE_KEY, "invalid-json");
+    expect(listPendingSubmissions(store)).toEqual([]);
+    expect(getPendingSubmission(store)).toBeNull();
+
+    const failingStore: KeyValueStore = {
+      getItem: () => null,
+      setItem: () => {
+        throw new Error("QuotaExceeded");
+      },
+    };
+    expect(savePendingSubmission(failingStore, sub1)).toBe(false);
+  });
+
   it("never touches the network", () => {
     const fetchSpy = vi.spyOn(globalThis, "fetch");
     const store = memoryStore();
diff --git a/lib/claim-links/index.ts b/lib/claim-links/index.ts
index f1ea65d..6f12fca 100644
--- a/lib/claim-links/index.ts
+++ b/lib/claim-links/index.ts
@@ -99,3 +99,71 @@ export function exportClaimLinks(store: KeyValueStore, now = new Date()): string
     2,
   )}\n`;
 }
+
+export interface PendingSubmission {
+  id: string;
+  reference: string;
+  salt: string;
+  mode: "verified" | "direct";
+  recipientOrPayee: string;
+  txHash?: string;
+  createdAt: string;
+}
+
+export const PENDING_STORAGE_KEY = "kinlock.pendingSubmissions.v1";
+
+const PendingSchema = z.array(
+  z.object({
+    id: z.string(),
+    reference: z.string(),
+    salt: z.string(),
+    mode: z.enum(["verified", "direct"]),
+    recipientOrPayee: z.string(),
+    txHash: z.string().optional(),
+    createdAt: z.string(),
+  }),
+);
+
+export function listPendingSubmissions(store: KeyValueStore): PendingSubmission[] {
+  let raw: unknown;
+  try {
+    raw = JSON.parse(store.getItem(PENDING_STORAGE_KEY) ?? "[]");
+  } catch {
+    return [];
+  }
+  const parsed = PendingSchema.safeParse(raw);
+  if (!parsed.success) return [];
+  return parsed.data.sort((a, b) => (a.createdAt < b.createdAt ? 1 : -1));
+}
+
+export function savePendingSubmission(
+  store: KeyValueStore,
+  submission: PendingSubmission,
+): boolean {
+  const others = listPendingSubmissions(store).filter(
+    (s) => s.id !== submission.id && (!submission.txHash || s.txHash !== submission.txHash),
+  );
+  try {
+    store.setItem(PENDING_STORAGE_KEY, JSON.stringify([submission, ...others]));
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function getPendingSubmission(store: KeyValueStore, id?: string): PendingSubmission | null {
+  const all = listPendingSubmissions(store);
+  if (id) {
+    return all.find((s) => s.id === id || s.txHash === id) ?? null;
+  }
+  return all[0] ?? null;
+}
+
+export function removePendingSubmission(store: KeyValueStore, id: string): void {
+  const remaining = listPendingSubmissions(store).filter((s) => s.id !== id && s.txHash !== id);
+  try {
+    store.setItem(PENDING_STORAGE_KEY, JSON.stringify(remaining));
+  } catch {
+    // ignore
+  }
+}
diff --git a/lib/config.test.ts b/lib/config.test.ts
index fdd4508..145aabb 100644
--- a/lib/config.test.ts
+++ b/lib/config.test.ts
@@ -27,6 +27,22 @@ describe("loadPublicConfig", () => {
     expect(c.NEXT_PUBLIC_CONTRACT_ID).toBe(env.NEXT_PUBLIC_CONTRACT_ID);
   });
 
+  it("defaults NEXT_PUBLIC_ENABLE_DIRECT_PAYMENTS to false when unset", () => {
+    const c = loadPublicConfig(env);
+    expect(c.NEXT_PUBLIC_ENABLE_DIRECT_PAYMENTS).toBe(false);
+  });
+
+  it("parses NEXT_PUBLIC_ENABLE_DIRECT_PAYMENTS correctly", () => {
+    expect(
+      loadPublicConfig({ ...env, NEXT_PUBLIC_ENABLE_DIRECT_PAYMENTS: "true" })
+        .NEXT_PUBLIC_ENABLE_DIRECT_PAYMENTS,
+    ).toBe(true);
+    expect(
+      loadPublicConfig({ ...env, NEXT_PUBLIC_ENABLE_DIRECT_PAYMENTS: "false" })
+        .NEXT_PUBLIC_ENABLE_DIRECT_PAYMENTS,
+    ).toBe(false);
+  });
+
   it("refuses missing or malformed values", () => {
     for (const bad of [
       { NEXT_PUBLIC_CONTRACT_ID: "GABC" },
diff --git a/lib/config.ts b/lib/config.ts
index c6eab04..8adffc2 100644
--- a/lib/config.ts
+++ b/lib/config.ts
@@ -32,6 +32,16 @@ const PublicConfigSchema = z.object({
   NEXT_PUBLIC_USDC_CONTRACT_ID: z.string().regex(/^C[A-Z2-7]{55}$/),
   /** USDC issuer, shown with the asset code everywhere (AssetLabel). */
   NEXT_PUBLIC_USDC_ISSUER: z.string().regex(/^G[A-Z2-7]{55}$/),
+  /**
+   * Whether direct locks to any Stellar address are enabled.
+   * Defaults to false: the standing testnet contract was deployed before ADR-0031
+   * and lacks `create_direct_lock`.
+   */
+  NEXT_PUBLIC_ENABLE_DIRECT_PAYMENTS: z
+    .string()
+    .optional()
+    .default("false")
+    .transform((v) => v === "true"),
 });
 
 export type PublicConfig = z.infer<typeof PublicConfigSchema> & { networkPassphrase: string };
@@ -45,6 +55,7 @@ export function loadPublicConfig(
     NEXT_PUBLIC_INDEXER_URL: process.env.NEXT_PUBLIC_INDEXER_URL,
     NEXT_PUBLIC_USDC_CONTRACT_ID: process.env.NEXT_PUBLIC_USDC_CONTRACT_ID,
     NEXT_PUBLIC_USDC_ISSUER: process.env.NEXT_PUBLIC_USDC_ISSUER,
+    NEXT_PUBLIC_ENABLE_DIRECT_PAYMENTS: process.env.NEXT_PUBLIC_ENABLE_DIRECT_PAYMENTS,
   },
 ): PublicConfig {
   const parsed = PublicConfigSchema.parse(env);
diff --git a/lib/indexer/index.test.ts b/lib/indexer/index.test.ts
index 5a6e481..fb74c13 100644
--- a/lib/indexer/index.test.ts
+++ b/lib/indexer/index.test.ts
@@ -4,7 +4,7 @@ const { publicConfig } = vi.hoisted(() => ({ publicConfig: vi.fn() }));
 vi.mock("@/lib/sdk", () => ({ publicConfig }));
 publicConfig.mockReturnValue({ NEXT_PUBLIC_INDEXER_URL: "https://indexer.example" });
 
-const { indexerLagging } = await import("./index");
+const { indexerLagging, listPayees, listLocks } = await import("./index");
 
 afterEach(() => {
   vi.unstubAllGlobals();
@@ -54,4 +54,100 @@ describe("indexerLagging", () => {
     vi.stubGlobal("fetch", vi.fn().mockRejectedValue(new Error("network down")));
     expect(await indexerLagging()).toBe(true);
   });
+
+  it("is false when no indexer URL is configured", async () => {
+    publicConfig.mockReturnValueOnce({ NEXT_PUBLIC_INDEXER_URL: undefined });
+    expect(await indexerLagging()).toBe(false);
+  });
+});
+
+describe("listPayees", () => {
+  it("returns indexer payees when the indexer responds successfully", async () => {
+    const mockPayee = {
+      payeeId: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
+      slug: "custom-academy",
+      displayName: "Custom Academy",
+      category: "School",
+      status: "Active",
+      payout: "GAYO5N5L7CH5MQF255ZAR57N4OB6H6GZ6J33A7264O6M3D6GFF5K3L4O",
+      attesterHandle: "custom-attester",
+      country: "KE",
+      localCurrency: "KES",
+      city: "Nairobi",
+    };
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue({
+        ok: true,
+        json: async () => ({
+          payees: [mockPayee],
+          next: null,
+        }),
+      }),
+    );
+    const payees = await listPayees();
+    expect(payees).toEqual([mockPayee]);
+  });
+
+  it("throws when indexer returns a non-ok HTTP status (e.g. 404)", async () => {
+    vi.stubGlobal("fetch", vi.fn().mockResolvedValue({ ok: false, status: 404 }));
+    await expect(listPayees()).rejects.toThrow("indexer /payees: HTTP 404");
+  });
+
+  it("throws when indexer fetch rejects (e.g. network down)", async () => {
+    vi.stubGlobal("fetch", vi.fn().mockRejectedValue(new Error("fetch failed")));
+    await expect(listPayees()).rejects.toThrow("fetch failed");
+  });
+
+  it("throws when no indexer URL is configured", async () => {
+    publicConfig.mockReturnValueOnce({ NEXT_PUBLIC_INDEXER_URL: undefined });
+    await expect(listPayees()).rejects.toThrow("NEXT_PUBLIC_INDEXER_URL is not set");
+  });
+});
+
+describe("listLocks", () => {
+  it("returns indexer locks when the indexer responds successfully", async () => {
+    const mockLock = {
+      id: "1",
+      sender: "GBBUI4N57S3TBUZTUKQPKWY5DERT2ZHQN4LLQZ747W7CD5HU3FGHWDH3",
+      payeeId: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
+      payout: "GAYO5N5L7CH5MQF255ZAR57N4OB6H6GZ6J33A7264O6M3D6GFF5K3L4O",
+      token: "CCSHDQFRYFC3AHV5NE6ULQW6X2CMG5RPANBORDXJGSUD6UKECASJQBRI",
+      total: "100000000",
+      released: "0",
+      returned: "0",
+      refHash: "dee2634ab9acdbfff6fe5c0595fcda66c0897d1c6968c290745da4f384e3ee5e",
+      state: "Open",
+      endReason: null,
+      expiresAt: "2026-10-24T12:00:00.000Z",
+      createdAt: "2026-10-17T09:00:00.000Z",
+      createdTx: "a1b2c3d4e5f60718293a4b5c6d7e8f90123456789abcdef0123456789abcdef0",
+    };
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue({
+        ok: true,
+        json: async () => ({
+          locks: [mockLock],
+          next: null,
+        }),
+      }),
+    );
+    const locks = await listLocks(
+      "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
+    );
+    expect(locks).toEqual([mockLock]);
+  });
+
+  it("returns empty array when indexer returns a non-ok HTTP status", async () => {
+    vi.stubGlobal("fetch", vi.fn().mockResolvedValue({ ok: false, status: 500 }));
+    const locks = await listLocks("some-payee");
+    expect(locks).toEqual([]);
+  });
+
+  it("returns empty array when indexer fetch rejects", async () => {
+    vi.stubGlobal("fetch", vi.fn().mockRejectedValue(new Error("network error")));
+    const locks = await listLocks("some-payee");
+    expect(locks).toEqual([]);
+  });
 });
diff --git a/lib/indexer/index.ts b/lib/indexer/index.ts
index dadd8b4..df6778f 100644
--- a/lib/indexer/index.ts
+++ b/lib/indexer/index.ts
@@ -30,6 +30,7 @@ const PayeesResponse = z.object({
 /** Every payee the indexer knows, following pagination. Throws if the indexer can't be read. */
 export async function listPayees(): Promise<IndexedPayee[]> {
   const base = publicConfig().NEXT_PUBLIC_INDEXER_URL;
+  if (!base) throw new Error("NEXT_PUBLIC_INDEXER_URL is not set");
   const all: IndexedPayee[] = [];
   let after: string | null = null;
   do {
@@ -54,7 +55,7 @@ export const LOCK_STATES = ["Open", "Completed", "Refunded", "Declined"] as cons
 const IndexedLockSchema = z.object({
   id: z.string(),
   sender: z.string(),
-  payeeId: z.string(),
+  payeeId: z.string().nullable(),
   payout: z.string(),
   token: z.string(),
   total: z.string(),
@@ -83,27 +84,32 @@ function indexerBase(): string {
     : window.location.origin;
 }
 
-/** A payee's locks, newest first, optionally narrowed to one state. Throws if the indexer can't be read. */
+/** A payee's locks, newest first, optionally narrowed to one state. Falls back to empty list if indexer can't be read. */
 export async function listLocks(
   payeeId: string,
   state?: (typeof LOCK_STATES)[number],
 ): Promise<IndexedLock[]> {
   const base = indexerBase();
+  if (!base) return [];
   const all: IndexedLock[] = [];
   let before: string | null = null;
-  do {
-    const url = new URL("/locks", base);
-    url.searchParams.set("payee_id", payeeId);
-    if (state) url.searchParams.set("state", state);
-    url.searchParams.set("limit", "100");
-    if (before) url.searchParams.set("before", before);
-    const response = await fetch(url);
-    if (!response.ok) throw new Error(`indexer /locks: HTTP ${response.status}`);
-    const page = LocksResponse.parse(await response.json());
-    all.push(...page.locks);
-    before = page.next;
-  } while (before);
-  return all;
+  try {
+    do {
+      const url = new URL("/locks", base);
+      url.searchParams.set("payee_id", payeeId);
+      if (state) url.searchParams.set("state", state);
+      url.searchParams.set("limit", "100");
+      if (before) url.searchParams.set("before", before);
+      const response = await fetch(url);
+      if (!response.ok) throw new Error(`indexer /locks: HTTP ${response.status}`);
+      const page = LocksResponse.parse(await response.json());
+      all.push(...page.locks);
+      before = page.next;
+    } while (before);
+    return all;
+  } catch {
+    return [];
+  }
 }
 
 const HealthResponse = z.object({
@@ -122,8 +128,10 @@ const HealthResponse = z.object({
  * any failure, so a broken health check never silently hides a real lag.
  */
 export async function indexerLagging(): Promise<boolean> {
+  const url = publicConfig().NEXT_PUBLIC_INDEXER_URL;
+  if (!url) return false;
   try {
-    const response = await fetch(new URL("/health", publicConfig().NEXT_PUBLIC_INDEXER_URL));
+    const response = await fetch(new URL("/health", url));
     if (!response.ok) return true;
     return HealthResponse.parse(await response.json()).status !== "ok";
   } catch {
diff --git a/lib/sdk.test.ts b/lib/sdk.test.ts
index 6882ae5..12873c5 100644
--- a/lib/sdk.test.ts
+++ b/lib/sdk.test.ts
@@ -1,8 +1,10 @@
+import type { rpc } from "@stellar/stellar-sdk";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 import type { WalletAdapter } from "./wallet";
 
 const calls: unknown[][] = [];
-vi.mock("@kinlock/sdk", () => ({
+vi.mock("@kinlock/sdk", async (importOriginal) => ({
+  KinlockError: (await importOriginal<typeof import("@kinlock/sdk")>()).KinlockError,
   getLock: vi.fn(async (...args: unknown[]) => {
     calls.push(["getLock", ...args]);
     return null;
@@ -74,4 +76,48 @@ describe("lib/sdk", () => {
       signer,
     ]);
   });
+
+  it("pollTransaction returns status SUCCESS and lockId when confirmed", async () => {
+    const { rpc, nativeToScVal } = await import("@stellar/stellar-sdk");
+    const getTxSpy = vi.spyOn(rpc.Server.prototype, "getTransaction").mockResolvedValue({
+      status: "SUCCESS",
+      returnValue: nativeToScVal(99n, { type: "u64" }),
+    } as unknown as rpc.Api.GetTransactionResponse);
+
+    const res = await lib.pollTransaction("ab".repeat(32), 1000, 10);
+    expect(res).toEqual({ status: "SUCCESS", lockId: 99n });
+    getTxSpy.mockRestore();
+  });
+
+  it("pollTransaction returns status FAILED when transaction fails on-chain", async () => {
+    const { rpc } = await import("@stellar/stellar-sdk");
+    const getTxSpy = vi.spyOn(rpc.Server.prototype, "getTransaction").mockResolvedValue({
+      status: "FAILED",
+    } as unknown as rpc.Api.GetTransactionResponse);
+
+    const res = await lib.pollTransaction("cd".repeat(32), 1000, 10);
+    expect(res).toEqual({ status: "FAILED" });
+    getTxSpy.mockRestore();
+  });
+
+  it("re-exports the SDK's own KinlockError, so instanceof matches errors the SDK throws", async () => {
+    const actual = await vi.importActual<typeof import("@kinlock/sdk")>("@kinlock/sdk");
+    expect(lib.KinlockError).toBe(actual.KinlockError);
+  });
+
+  it("pollTransaction throws KinlockError with TX_PENDING on timeout", async () => {
+    const { rpc } = await import("@stellar/stellar-sdk");
+    const getTxSpy = vi.spyOn(rpc.Server.prototype, "getTransaction").mockResolvedValue({
+      status: "NOT_FOUND",
+    } as unknown as rpc.Api.GetTransactionResponse);
+
+    const hash = "ef".repeat(32);
+    const error = await lib.pollTransaction(hash, 50, 10).catch((e) => e);
+    expect(error).toBeInstanceOf(lib.KinlockError);
+    await expect(Promise.reject(error)).rejects.toMatchObject({
+      code: "TX_PENDING",
+      txHash: hash,
+    });
+    getTxSpy.mockRestore();
+  });
 });
diff --git a/lib/sdk.ts b/lib/sdk.ts
index ad43c71..c8426d1 100644
--- a/lib/sdk.ts
+++ b/lib/sdk.ts
@@ -18,6 +18,7 @@ import type {
   VerifyReceiptResult,
 } from "@kinlock/sdk";
 import * as sdk from "@kinlock/sdk";
+import { rpc, scValToNative } from "@stellar/stellar-sdk";
 import { loadPublicConfig, type PublicConfig } from "./config";
 import type { WalletAdapter } from "./wallet";
 
@@ -82,6 +83,88 @@ export const preflight = (params: PreflightParams): Promise<PreflightResult[]> =
 export const verifyReceipt = (ref: ReceiptRef): Promise<VerifyReceiptResult> =>
   sdk.verifyReceipt(kinlockConfig(), ref);
 
+export const getTransaction = async (txHash: string) => {
+  const config = kinlockConfig();
+  const server = new rpc.Server(config.rpcUrl, { allowHttp: config.allowHttp ?? false });
+  return server.getTransaction(txHash);
+};
+
+export interface PollTxResult {
+  status: "SUCCESS" | "FAILED";
+  lockId?: bigint;
+}
+
+/**
+ * Poll getTransaction on the configured Soroban RPC server until confirmation
+ * or timeout. Used to recover from post-submission timeouts (Item 4).
+ */
+export async function pollTransaction(
+  txHash: string,
+  timeoutMs = 30_000,
+  intervalMs = 1_500,
+): Promise<PollTxResult> {
+  const start = Date.now();
+  const config = kinlockConfig();
+  const server = new rpc.Server(config.rpcUrl, { allowHttp: config.allowHttp ?? false });
+
+  while (Date.now() - start < timeoutMs) {
+    try {
+      const tx = await server.getTransaction(txHash);
+      if (tx.status === rpc.Api.GetTransactionStatus.SUCCESS) {
+        let lockId: bigint | undefined;
+        if ("returnValue" in tx && tx.returnValue) {
+          try {
+            const native = scValToNative(tx.returnValue as Parameters<typeof scValToNative>[0]);
+            if (typeof native === "bigint") {
+              lockId = native;
+            } else if (typeof native === "number") {
+              lockId = BigInt(native);
+            }
+          } catch {
+            // fallback to events
+          }
+        }
+        if (lockId === undefined && "ledger" in tx && typeof tx.ledger === "number") {
+          try {
+            const { events } = await server.getEvents({
+              startLedger: tx.ledger,
+              endLedger: tx.ledger + 1,
+              filters: [{ type: "contract", contractIds: [config.contractId] }],
+              limit: 1000,
+            });
+            const created = events.find(
+              (e) =>
+                e.txHash === txHash &&
+                e.topic[0] !== undefined &&
+                scValToNative(e.topic[0]) === "lock_created",
+            );
+            if (created?.topic[1]) {
+              const val = scValToNative(created.topic[1]);
+              if (typeof val === "bigint") lockId = val;
+              else if (typeof val === "number") lockId = BigInt(val);
+            }
+          } catch {
+            // ignore
+          }
+        }
+        return { status: "SUCCESS", lockId };
+      }
+      if (tx.status === rpc.Api.GetTransactionStatus.FAILED) {
+        return { status: "FAILED" };
+      }
+    } catch {
+      // transient network/RPC error: retry
+    }
+    await new Promise((resolve) => setTimeout(resolve, intervalMs));
+  }
+  throw new sdk.KinlockError(
+    `timed out waiting for transaction ${txHash} to confirm`,
+    "TX_PENDING",
+    undefined,
+    txHash,
+  );
+}
+
 export {
   buildClaimLink,
   buildRequestLink,
@@ -94,3 +177,4 @@ export {
   toBaseUnits,
   USDC_DECIMALS,
 } from "@kinlock/sdk";
+export { scValToNative };
diff --git a/lib/security/csp.test.ts b/lib/security/csp.test.ts
index b5f0236..5b99dbb 100644
--- a/lib/security/csp.test.ts
+++ b/lib/security/csp.test.ts
@@ -17,6 +17,19 @@ describe("claim page CSP", () => {
 
   it("limits network access to our origin and the RPC servers", () => {
     expect(prod).toContain("connect-src 'self' https://soroban-testnet.stellar.org");
+    expect(prod).toContain("https://*.stellar.org");
+    expect(prod).toContain("https://albedo.link");
+  });
+
+  it("covers wallet kit and wildcard stellar origins in connect-src", () => {
+    const policy = buildClaimCsp({
+      nonce: "xyz",
+      rpcOrigins: ["https://indexer.example.com"],
+      dev: false,
+    });
+    expect(policy).toContain(
+      "connect-src 'self' https://indexer.example.com https://*.stellar.org https://albedo.link",
+    );
   });
 
   it("blocks framing, plugins, and base-tag tricks", () => {
diff --git a/lib/security/csp.ts b/lib/security/csp.ts
index 961dea8..c94f7d5 100644
--- a/lib/security/csp.ts
+++ b/lib/security/csp.ts
@@ -1,20 +1,26 @@
 /**
- * Content-Security-Policy for /claim/* (AGENTS.md §8.3, roadmap M3-14). The claim page holds the
- * reference and salt in its URL fragment, so it allows no third-party scripts at all: only our
- * own scripts carrying this request's nonce run. Network access is limited to our origin and the
- * configured Stellar RPC servers.
+ * Content-Security-Policy for application pages (AGENTS.md §8.3, roadmap M3-14, M3-40).
+ * Pages hold the reference and salt in the URL fragment (/claim/*) or in localStorage
+ * (sender and dashboard pages), so we allow no third-party scripts at all: only our own
+ * scripts carrying this request's nonce run. Network access is limited to our origin,
+ * configured Stellar RPC/indexer servers, and wallet kit endpoints.
  */
 export function buildClaimCsp(opts: { nonce: string; rpcOrigins: string[]; dev: boolean }): string {
   const scriptSrc = ["'self'", `'nonce-${opts.nonce}'`, "'strict-dynamic'"];
   // Next.js dev mode needs eval for fast refresh; production never gets it.
   if (opts.dev) scriptSrc.push("'unsafe-eval'");
+
+  const connectOrigins = Array.from(
+    new Set(["'self'", ...opts.rpcOrigins, "https://*.stellar.org", "https://albedo.link"]),
+  ).filter(Boolean);
+
   return [
     "default-src 'self'",
     `script-src ${scriptSrc.join(" ")}`,
     "style-src 'self' 'unsafe-inline'",
     "img-src 'self' data: blob:",
     "font-src 'self'",
-    `connect-src 'self' ${opts.rpcOrigins.join(" ")}`.trim(),
+    `connect-src ${connectOrigins.join(" ")}`,
     "object-src 'none'",
     "base-uri 'none'",
     "form-action 'self'",
diff --git a/messages/en.json b/messages/en.json
index a4cff1d..5b396ae 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -135,6 +135,13 @@
       "edit": "Change details",
       "send": "Lock and send",
       "sending": "Waiting for your wallet…",
+      "pendingHeading": "Checking transaction status…",
+      "pendingBody": "Your transaction was submitted to the network. Please wait while we verify confirmation so you don't pay twice.",
+      "pendingTxHash": "Transaction hash",
+      "pendingWarning": "Do not submit another payment while this transaction is pending.",
+      "pendingCheckAgain": "Check status again",
+      "pendingNoLockId": "The transaction is confirmed, but its lock number could not be read yet. Do not submit again. Check again in a moment.",
+      "pendingTimeout": "The transaction confirmation is taking longer than expected. Do not submit again. You can check again or track the transaction hash.",
       "doneHeading": "Payment locked",
       "doneLock": "Lock number",
       "doneClaimLink": "Claim link for the payee",
diff --git a/next.config.ts b/next.config.ts
index 9b51145..4abbaac 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -1,5 +1,5 @@
 /**
- * [sec] Site-wide security headers. /claim/* also gets a per-request nonce CSP from proxy.ts
+ * [sec] Site-wide security headers. Application routes also get a per-request nonce CSP from proxy.ts
  * (roadmap M3-14). Referrer-Policy no-referrer keeps any URL from leaking to other sites.
  *
  * The indexer's list API is served on our own origin (rewrites below), so the browser needs no
diff --git a/package.json b/package.json
index d97dd18..cbf9343 100644
--- a/package.json
+++ b/package.json
@@ -15,7 +15,7 @@
   },
   "dependencies": {
     "@creit.tech/stellar-wallets-kit": "2.7.1",
-    "@kinlock/sdk": "https://github.com/Kinlock-Org/kinlock-sdk/releases/download/sdk-v0.3.2/kinlock-sdk-0.3.2.tgz",
+    "@kinlock/sdk": "file:./vendor/kinlock-sdk-0.3.3.tgz",
     "@stellar/stellar-sdk": "17.4.0",
     "next": "16.4.3",
     "react": "19.3.1",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 59794b5..194c84a 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -18,8 +18,8 @@ importers:
         specifier: 2.7.1
         version: 2.7.1(@types/react@19.3.0)(bufferutil@4.1.0)(near-api-js@5.1.1)(react@19.3.1)(tslib@2.8.1)(typescript@7.0.2)(utf-8-validate@6.0.6)(zod@4.6.7)
       '@kinlock/sdk':
-        specifier: https://github.com/Kinlock-Org/kinlock-sdk/releases/download/sdk-v0.3.2/kinlock-sdk-0.3.2.tgz
-        version: https://github.com/Kinlock-Org/kinlock-sdk/releases/download/sdk-v0.3.2/kinlock-sdk-0.3.2.tgz
+        specifier: file:./vendor/kinlock-sdk-0.3.3.tgz
+        version: file:vendor/kinlock-sdk-0.3.3.tgz
       '@stellar/stellar-sdk':
         specifier: 17.4.0
         version: 17.4.0
@@ -347,9 +347,9 @@ packages:
     resolution: {tarball: https://github.com/Kinlock-Org/kinlock-contracts/releases/download/bindings-v0.2.0/kinlock-contract-0.2.0.tgz}
     version: 0.2.0
 
-  '@kinlock/sdk@https://github.com/Kinlock-Org/kinlock-sdk/releases/download/sdk-v0.3.2/kinlock-sdk-0.3.2.tgz':
-    resolution: {tarball: https://github.com/Kinlock-Org/kinlock-sdk/releases/download/sdk-v0.3.2/kinlock-sdk-0.3.2.tgz}
-    version: 0.3.2
+  '@kinlock/sdk@file:vendor/kinlock-sdk-0.3.3.tgz':
+    resolution: {integrity: sha512-spORRFKZvfukp4v6V2Laly+HwyGwLgN5DcMyv/7FLaFQCiFn1HEAGZ6urG9owJLfzpx4PdA0sO/VEShL0Y9jXg==, tarball: file:vendor/kinlock-sdk-0.3.3.tgz}
+    version: 0.3.3
 
   '@ledgerhq/devices@8.6.1':
     resolution: {integrity: sha512-PQR2fyWz7P/wMFHY9ZLz17WgFdxC/Im0RVDcWXpp24+iRQRyxhQeX2iG4mBKUzfaAW6pOIEiWt+vmJh88QP9rQ==}
@@ -3281,7 +3281,7 @@ snapshots:
       - debug
       - supports-color
 
-  '@kinlock/sdk@https://github.com/Kinlock-Org/kinlock-sdk/releases/download/sdk-v0.3.2/kinlock-sdk-0.3.2.tgz':
+  '@kinlock/sdk@file:vendor/kinlock-sdk-0.3.3.tgz':
     dependencies:
       '@kinlock/contract': https://github.com/Kinlock-Org/kinlock-contracts/releases/download/bindings-v0.2.0/kinlock-contract-0.2.0.tgz
       '@stellar/stellar-sdk': 17.2.1
diff --git a/proxy.ts b/proxy.ts
index 371ba04..50d0567 100644
--- a/proxy.ts
+++ b/proxy.ts
@@ -1,6 +1,6 @@
 /**
- * [sec] Per-request headers. /claim/* gets a nonce-based Content-Security-Policy so only our own
- * scripts run on the page that holds the claim link's reference and salt (roadmap M3-14).
+ * [sec] Per-request headers. Applies a nonce-based Content-Security-Policy site-wide
+ * so only our own scripts run on pages that hold claim links in the URL fragment or localStorage (roadmap M3-14, M3-40).
  * Next.js reads the nonce from the request's CSP header and applies it to its own scripts.
  */
 import { type NextRequest, NextResponse } from "next/server";
@@ -8,9 +8,13 @@ import { buildClaimCsp, originsOf } from "@/lib/security/csp";
 
 export function proxy(request: NextRequest): NextResponse {
   const nonce = btoa(crypto.randomUUID());
+  const rpcOrigins = [
+    ...originsOf(process.env.NEXT_PUBLIC_RPC_URLS),
+    ...originsOf(process.env.NEXT_PUBLIC_INDEXER_URL),
+  ];
   const csp = buildClaimCsp({
     nonce,
-    rpcOrigins: originsOf(process.env.NEXT_PUBLIC_RPC_URLS),
+    rpcOrigins,
     dev: process.env.NODE_ENV === "development",
   });
   const requestHeaders = new Headers(request.headers);
@@ -21,4 +25,6 @@ export function proxy(request: NextRequest): NextResponse {
   return response;
 }
 
-export const config = { matcher: ["/claim/:path*"] };
+export const config = {
+  matcher: ["/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp)$).*)"],
+};
diff --git a/vendor/kinlock-sdk-0.3.3.tgz b/vendor/kinlock-sdk-0.3.3.tgz
new file mode 100644
index 0000000..609971b
Binary files /dev/null and b/vendor/kinlock-sdk-0.3.3.tgz differ