[MattDHill]

The SDK 3.0.3 migration for BOLT12 Pay, plus the primary-URL behavior it makes available.

• start-sdk 3.0.3. The lock is resolved against the live registry (npm audit 0), with one SDK copy shared with lnd-startos#next. The toolchain the SDK now supplies is dropped, and .prettierrc names the SDK's shared config.
• store.json is z.looseObject. Under 3.0.x a z.object shape would drop any key it doesn't declare on the next write.
• LND is a required sdk.Dependency in dependencies.ts, passed to buildManifest and setupInit. The version-gated onion-messages task moves into withInit unchanged. The range >=0.21.1-beta:4 was checked against LND's history: the control/grpc hosts this package imports exist from 0.21.1-beta:1, and REST runs without certificate verification, so nothing newer is needed.
• Set Primary URL uses sdk.setupPrimaryUrl with the same action id and store.json key, so existing choices carry over.
  • fallback: false: with no choice, the app gets no LNURL defaults, as before, rather than a .local base.
  • A chosen hostname that moves to another port is followed.
  • Open UI prefers the chosen URL (preferredLauncherAddress) when the viewer's connection can reach it.
  • The task keeps the package's design: none on a fresh install, since LNURL is opt-in, and a critical task when a chosen URL disappears. It now clears itself when the address returns.
• emulateMissing: false on the image.
• Fixes:
  • The LND dependency description (all locales) and instructions.md said LND 0.20 works. The published range and the imported host ids require 0.21.1 or newer.
  • The Set Primary URL description said changes apply on the next restart; the service restarts by itself.
  • UPDATING.md linked a non-existent CONTRIBUTING.md.
• Workflows synced to the package template on main (ready_for_review, pr-retarget.yml); AGENTS.md resynced, README and instructions updated.

🤖 Generated with Claude Code

[helix-a]

Reviewed 887f0b2 against main: no blocking correctness findings. The SDK migration preserves the primary-URL action/storage identity and opt-in setup; task clearing and the required LND declaration are consistent with SDK 3.0.3. That pin matches the latest npm release.

Verified clean merge-tree and diff checks; cache-backed npm ci and make passed for x86_64 and aarch64, including SDK gates. The lock stayed unchanged after npm install, with one deduplicated SDK copy. Inspected both returned s9pks for version, head hash, dependency requirements, and architecture. Both architecture CI jobs passed. Runtime behavior was reviewed in source, not exercised on a running StartOS service.

One description correction: the obsolete onion-messages task is removed and cleared, not moved unchanged into withInit. This is consistent with the existing LND floor.

Helix-Harness: pi
Helix-Model: openai-codex/gpt-6.1-sol