diff --git a/src/app/(mobile-ui)/card-recovery/page.tsx b/src/app/(mobile-ui)/card-recovery/page.tsx
index a155c8fd61..0676a690e3 100644
--- a/src/app/(mobile-ui)/card-recovery/page.tsx
+++ b/src/app/(mobile-ui)/card-recovery/page.tsx
@@ -1,7 +1,7 @@
 'use client'
 
 import { useCallback, useEffect, useState } from 'react'
-import type { Address, Hex } from 'viem'
+import type { Hex } from 'viem'
 import { Button } from '@/components/0_Bruddle/Button'
 import { Card } from '@/components/0_Bruddle/Card'
 import ErrorAlert from '@/components/Global/ErrorAlert'
@@ -9,11 +9,7 @@ import NavHeader from '@/components/Global/NavHeader'
 import PeanutLoading from '@/components/Global/PeanutLoading'
 import { useKernelClient } from '@/context/kernelClient.context'
 import { useSafeBack } from '@/hooks/useSafeBack'
-import {
-    RAIN_WITHDRAW_EIP712_DOMAIN_NAME,
-    RAIN_WITHDRAW_EIP712_DOMAIN_VERSION,
-    rainWithdrawEip712Types,
-} from '@/constants/rain.consts'
+import { buildRainWithdrawTypedData } from '@/utils/rainWithdraw.utils'
 import { PEANUT_WALLET_CHAIN } from '@/constants/zerodev.consts'
 import { rainApi, type RecoverFundsPreviewResponse } from '@/services/rain'
 import { getExplorerUrl } from '@/utils/general.utils'
@@ -82,24 +78,9 @@ export default function CardRecoveryPage() {
             const chainIdNum = Number(prep.chainId)
             const kernelClient = getClientForChain(chainIdStr)
 
-            const adminSignature = (await kernelClient.account!.signTypedData({
-                domain: {
-                    name: RAIN_WITHDRAW_EIP712_DOMAIN_NAME,
-                    version: RAIN_WITHDRAW_EIP712_DOMAIN_VERSION,
-                    chainId: chainIdNum,
-                    verifyingContract: prep.collateralProxy as Address,
-                    salt: prep.adminSalt as Hex,
-                },
-                types: rainWithdrawEip712Types,
-                primaryType: 'Withdraw',
-                message: {
-                    user: prep.adminAddress as Address,
-                    asset: prep.tokenAddress as Address,
-                    amount: BigInt(prep.amount),
-                    recipient: prep.recipientAddress as Address,
-                    nonce: BigInt(prep.adminNonce),
-                },
-            })) as Hex
+            const adminSignature = (await kernelClient.account!.signTypedData(
+                buildRainWithdrawTypedData(prep, chainIdNum)
+            )) as Hex
 
             setStep('submitting')
             const { txHash: hash } = await rainApi.submitWithdrawal({
diff --git a/src/app/(mobile-ui)/qr-pay/__tests__/qr-pay-states.test.tsx b/src/app/(mobile-ui)/qr-pay/__tests__/qr-pay-states.test.tsx
index 2aa00884e7..f305d66aa0 100644
--- a/src/app/(mobile-ui)/qr-pay/__tests__/qr-pay-states.test.tsx
+++ b/src/app/(mobile-ui)/qr-pay/__tests__/qr-pay-states.test.tsx
@@ -506,7 +506,7 @@ function setCapabilitiesGate(state: GateState, opts: { userMessage?: string | nu
 
 // Loading state context provider
 const LoadingStateProvider = ({ children }: { children: React.ReactNode }) => {
-    const loadingStateContext = require('@/context').loadingStateContext
+    const loadingStateContext = require('@/context/loadingStates.context').loadingStateContext
     const [loadingState, setLoadingState] = React.useState('Idle')
     const isLoading = loadingState !== 'Idle'
     return (
@@ -516,9 +516,10 @@ const LoadingStateProvider = ({ children }: { children: React.ReactNode }) => {
     )
 }
 
-// We need to mock the context module itself since it's imported via { loadingStateContext }
+// We need to mock the context module itself (specific file, not the barrel — the page
+// imports from '@/context/loadingStates.context' per the no-barrel rule)
 const mockSetLoadingState = jest.fn()
-jest.mock('@/context', () => ({
+jest.mock('@/context/loadingStates.context', () => ({
     loadingStateContext: React.createContext({
         loadingState: 'Idle' as string,
         setLoadingState: (s: string) => {},
@@ -529,7 +530,7 @@ jest.mock('@/context', () => ({
 function renderQrPay(params: Record<string, string> = {}) {
     setSearchParams(params)
     const queryClient = createQueryClient()
-    const { loadingStateContext } = require('@/context')
+    const { loadingStateContext } = require('@/context/loadingStates.context')
 
     const LoadingProvider = ({ children }: { children: React.ReactNode }) => {
         const [loadingState, setLoadingState] = React.useState<string>('Idle')
diff --git a/src/app/(mobile-ui)/qr-pay/page.tsx b/src/app/(mobile-ui)/qr-pay/page.tsx
index 42ebe2d750..a5e11a4b33 100644
--- a/src/app/(mobile-ui)/qr-pay/page.tsx
+++ b/src/app/(mobile-ui)/qr-pay/page.tsx
@@ -19,7 +19,7 @@ import AmountInput from '@/components/Global/AmountInput'
 import { useWallet } from '@/hooks/wallet/useWallet'
 import { useSignSpendBundle } from '@/hooks/wallet/useSignSpendBundle'
 import { useStaleSessionGuard } from '@/hooks/wallet/useStaleSessionGuard'
-import { InsufficientSpendableError, SessionKeyGrantRequiredError } from '@/hooks/wallet/useSpendBundle'
+import { InsufficientSpendableError, SessionKeyGrantRequiredError } from '@/hooks/wallet/spendPreflight'
 import { rainCollateralErrorMessage } from '@/utils/friendly-error.utils'
 import { useRainCardOverview } from '@/hooks/useRainCardOverview'
 import {
@@ -28,14 +28,9 @@ import {
     BALANCE_SETTLING_MESSAGE,
     isAmountWithinBalance,
 } from '@/utils/balance.utils'
-import { isTxReverted, saveRedirectUrl, formatNumberForDisplay } from '@/utils/general.utils'
+import { formatNumberForDisplay } from '@/utils/general.utils'
 import { getShakeClass, type ShakeIntensity } from '@/utils/perk.utils'
-import {
-    calculateSavingsInCents,
-    hasCardMarkupComparison,
-    isArgentinaMantecaQrPayment,
-    getSavingsMessage,
-} from '@/utils/qr-payment.utils'
+import { calculateSavingsInCents, hasCardMarkupComparison, getSavingsMessage } from '@/utils/qr-payment.utils'
 import { useCardMarkupRate } from '@/hooks/useCardMarkupRate'
 import ErrorAlert from '@/components/Global/ErrorAlert'
 import { PEANUT_WALLET_CHAIN, PEANUT_WALLET_TOKEN_DECIMALS } from '@/constants/zerodev.consts'
@@ -44,11 +39,10 @@ import { MANTECA_DEPOSIT_ADDRESS } from '@/constants/manteca.consts'
 import { MIN_MANTECA_QR_PAYMENT_AMOUNT, MIN_PIX_AMOUNT_BRL } from '@/constants/payment.consts'
 import { isPixRecurringCode } from '@/utils/withdraw.utils'
 import { formatUnits, parseUnits } from 'viem'
-import type { TransactionReceipt, Hash } from 'viem'
 import { useTransactionDetailsDrawer } from '@/hooks/useTransactionDetailsDrawer'
 import { TransactionDetailsDrawer } from '@/components/TransactionDetails/TransactionDetailsDrawer'
 import { EHistoryUserRole } from '@/hooks/useTransactionHistory'
-import { loadingStateContext } from '@/context'
+import { loadingStateContext } from '@/context/loadingStates.context'
 import { getCurrencyPrice } from '@/app/actions/currency'
 import { PaymentInfoRow } from '@/components/Payment/PaymentInfoRow'
 import { captureException } from '@sentry/nextjs'
diff --git a/src/app/(mobile-ui)/withdraw/manteca/page.tsx b/src/app/(mobile-ui)/withdraw/manteca/page.tsx
index b79d827e00..88da6282ee 100644
--- a/src/app/(mobile-ui)/withdraw/manteca/page.tsx
+++ b/src/app/(mobile-ui)/withdraw/manteca/page.tsx
@@ -3,7 +3,7 @@
 import { useWallet } from '@/hooks/wallet/useWallet'
 import { useSignSpendBundle } from '@/hooks/wallet/useSignSpendBundle'
 import { useStaleSessionGuard } from '@/hooks/wallet/useStaleSessionGuard'
-import { InsufficientSpendableError, SessionKeyGrantRequiredError } from '@/hooks/wallet/useSpendBundle'
+import { InsufficientSpendableError, SessionKeyGrantRequiredError } from '@/hooks/wallet/spendPreflight'
 import { rainCollateralErrorMessage } from '@/utils/friendly-error.utils'
 import {
     rainCentsToUsdcUnits,
diff --git a/src/app/actions/supported-chains.ts b/src/app/actions/supported-chains.ts
index 0b94ecc5b7..56eb628b3c 100644
--- a/src/app/actions/supported-chains.ts
+++ b/src/app/actions/supported-chains.ts
@@ -7,6 +7,10 @@ import ARBITRUM_ICON from '@/assets/chains/arbitrum.svg'
 // falls back to initials ("AO"). Prefer a bundled local asset for those.
 const CHAIN_ICON_OVERRIDES: Record<string, string> = {
     '42161': ARBITRUM_ICON,
+    // Linea's chain-details icon is an SVG served via ipfs.io — next/image
+    // refuses SVG by default, so it rendered as "LI" initials. CoinGecko
+    // raster instead. (Avalanche/Mantle ipfs icons are PNG and render fine.)
+    '59144': 'https://coin-images.coingecko.com/asset_platforms/images/135/small/linea.jpeg?1706606705',
 }
 
 export async function getSupportedChainsAndTokens(): Promise<Record<string, ChainWithTokens>> {
diff --git a/src/app/api/send-discord-notification/route.ts b/src/app/api/send-discord-notification/route.ts
deleted file mode 100644
index 42dc4e2cd4..0000000000
--- a/src/app/api/send-discord-notification/route.ts
+++ /dev/null
@@ -1,33 +0,0 @@
-import type { NextRequest } from 'next/server'
-import { fetchWithSentry } from '@/utils/sentry.utils'
-
-export async function POST(request: NextRequest) {
-    try {
-        const body = await request.json()
-        const webhookUrl = process.env.DISCORD_WEBHOOK_URL ?? ''
-
-        if (!webhookUrl) throw new Error('DISCORD_WEBHOOK not found in env')
-
-        const response = await fetchWithSentry(webhookUrl, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-                content: body.message,
-            }),
-        })
-
-        return new Response(JSON.stringify(response), {
-            status: 200,
-            headers: {
-                'Content-Type': 'application/json',
-            },
-        })
-    } catch (error) {
-        console.error('Error in discord send notif Route Handler:', error)
-        return new Response('Internal Server Error', { status: 500 })
-    }
-}
-
-// OK
diff --git a/src/components/AddMoney/components/ChooseNetworkDrawer.tsx b/src/components/AddMoney/components/ChooseNetworkDrawer.tsx
index 2ba3113ab2..0f1c3dd951 100644
--- a/src/components/AddMoney/components/ChooseNetworkDrawer.tsx
+++ b/src/components/AddMoney/components/ChooseNetworkDrawer.tsx
@@ -2,8 +2,9 @@
 
 import { Drawer, DrawerContent, DrawerHeader, DrawerTitle, DrawerDescription } from '@/components/Global/Drawer'
 import { ActionListCard } from '@/components/ActionListCard'
-import ChainChip from './ChainChip'
+import EvmChainChips from './EvmChainChips'
 import { CHAIN_LOGOS, SUPPORTED_EVM_CHAINS, getSupportedTokens } from '@/constants/rhino.consts'
+import { useChainRollout } from '@/hooks/useChainRollout'
 import type { RhinoChainType } from '@/services/services.types'
 import Image from 'next/image'
 
@@ -14,6 +15,10 @@ interface ChooseNetworkDrawerProps {
 }
 
 const ChooseNetworkDrawer = ({ open, onClose, onSelect }: ChooseNetworkDrawerProps) => {
+    // Count only rolled-out chains — the chips below are gated the same way,
+    // and "12 Networks" above 10 visible chips would be a lie.
+    const isChainRolledOut = useChainRollout()
+    const evmChainCount = SUPPORTED_EVM_CHAINS.filter(isChainRolledOut).length
     return (
         <Drawer open={open} onOpenChange={(isOpen) => !isOpen && onClose()}>
             <DrawerContent className="pt-4">
@@ -27,7 +32,7 @@ const ChooseNetworkDrawer = ({ open, onClose, onSelect }: ChooseNetworkDrawerPro
                     <div className="overflow-hidden rounded-t-sm border border-black bg-white ">
                         <ActionListCard
                             title="EVM"
-                            description={`${SUPPORTED_EVM_CHAINS.length} Networks - 1 Address`}
+                            description={`${evmChainCount} Networks - 1 Address`}
                             position="single"
                             className="border-0"
                             leftIcon={
@@ -44,9 +49,7 @@ const ChooseNetworkDrawer = ({ open, onClose, onSelect }: ChooseNetworkDrawerPro
                         {/* expanded chain list */}
                         <div onClick={() => onSelect('EVM')} className="mx-4 border-t border-dashed border-black py-3">
                             <div className="flex flex-wrap gap-2">
-                                {SUPPORTED_EVM_CHAINS.map((chain) => (
-                                    <ChainChip key={chain} chainName={chain} chainSymbol={CHAIN_LOGOS[chain]} />
-                                ))}
+                                <EvmChainChips />
                             </div>
                         </div>
                     </div>
diff --git a/src/components/AddMoney/components/EvmChainChips.tsx b/src/components/AddMoney/components/EvmChainChips.tsx
new file mode 100644
index 0000000000..149fe10d68
--- /dev/null
+++ b/src/components/AddMoney/components/EvmChainChips.tsx
@@ -0,0 +1,24 @@
+import ChainChip from './ChainChip'
+import { SUPPORTED_EVM_CHAINS, CHAIN_LOGOS, EVM_DEPOSIT_TOKEN_EXCEPTIONS } from '@/constants/rhino.consts'
+import { useChainRollout } from '@/hooks/useChainRollout'
+
+/**
+ * The rollout-gated EVM deposit chain chips, annotated with per-chain token
+ * exceptions (USDT-only chains) — a USDC deposit on a chain where Rhino only
+ * accepts USDT has no webhook, so the annotation is a funds-safety surface,
+ * not decoration. Shared by ChooseNetworkDrawer and SupportedNetworksModal.
+ */
+const EvmChainChips = () => {
+    const isChainRolledOut = useChainRollout()
+    return (
+        <>
+            {SUPPORTED_EVM_CHAINS.filter(isChainRolledOut).map((chain) => {
+                const tokenException = EVM_DEPOSIT_TOKEN_EXCEPTIONS[chain]
+                const label = tokenException ? `${chain} · ${tokenException.join('/')} only` : chain
+                return <ChainChip key={chain} chainName={label} chainSymbol={CHAIN_LOGOS[chain]} />
+            })}
+        </>
+    )
+}
+
+export default EvmChainChips
diff --git a/src/components/AddMoney/components/SupportedNetworksModal.tsx b/src/components/AddMoney/components/SupportedNetworksModal.tsx
index 29953b2e9f..777af51c86 100644
--- a/src/components/AddMoney/components/SupportedNetworksModal.tsx
+++ b/src/components/AddMoney/components/SupportedNetworksModal.tsx
@@ -2,8 +2,7 @@
 
 import Modal from '@/components/Global/Modal'
 import InfoCard from '@/components/Global/InfoCard'
-import ChainChip from './ChainChip'
-import { SUPPORTED_EVM_CHAINS, CHAIN_LOGOS } from '@/constants/rhino.consts'
+import EvmChainChips from './EvmChainChips'
 
 interface SupportedNetworksModalProps {
     visible: boolean
@@ -25,9 +24,7 @@ const SupportedNetworksModal = ({ visible, onClose }: SupportedNetworksModalProp
                 </p>
 
                 <div className="flex flex-wrap gap-2">
-                    {SUPPORTED_EVM_CHAINS.map((chain) => (
-                        <ChainChip key={chain} chainName={chain} chainSymbol={CHAIN_LOGOS[chain]} />
-                    ))}
+                    <EvmChainChips />
                 </div>
 
                 <InfoCard
diff --git a/src/components/AddMoney/views/CryptoDeposit.view.tsx b/src/components/AddMoney/views/CryptoDeposit.view.tsx
index 2966422b4d..a9bec43a4d 100644
--- a/src/components/AddMoney/views/CryptoDeposit.view.tsx
+++ b/src/components/AddMoney/views/CryptoDeposit.view.tsx
@@ -313,6 +313,12 @@ const CryptoDepositView = ({
                                     {depositAddressData.maxDepositLimitUsd.toLocaleString()} USD
                                 </p>
                             </div>
+                            {!isOfframp && (
+                                <p className="pt-1 text-sm text-grey-1">
+                                    A small bridging fee (~0.1%) applies — you&apos;ll receive slightly less than you
+                                    send.
+                                </p>
+                            )}
                             {isOfframp && (
                                 <p className="pt-1 text-sm text-grey-1">
                                     Moving more than the max? Send it in multiple transfers.
diff --git a/src/components/Card/CancelCardModal.tsx b/src/components/Card/CancelCardModal.tsx
index 0922d82576..57602ce962 100644
--- a/src/components/Card/CancelCardModal.tsx
+++ b/src/components/Card/CancelCardModal.tsx
@@ -10,7 +10,7 @@ import SlideToAction from '@/components/Card/SlideToAction'
 import { rainApi } from '@/services/rain'
 import { RAIN_CARD_OVERVIEW_QUERY_KEY, useRainCardOverview } from '@/hooks/useRainCardOverview'
 import { useSignSpendBundle } from '@/hooks/wallet/useSignSpendBundle'
-import { InsufficientSpendableError, SessionKeyGrantRequiredError } from '@/hooks/wallet/useSpendBundle'
+import { InsufficientSpendableError, SessionKeyGrantRequiredError } from '@/hooks/wallet/spendPreflight'
 import { useWallet } from '@/hooks/wallet/useWallet'
 import { rainCentsToUsdcUnits } from '@/utils/balance.utils'
 
diff --git a/src/components/Card/LockCardModal.tsx b/src/components/Card/LockCardModal.tsx
index 61d7f7cf29..b7dda32168 100644
--- a/src/components/Card/LockCardModal.tsx
+++ b/src/components/Card/LockCardModal.tsx
@@ -10,7 +10,7 @@ import SlideToAction from '@/components/Card/SlideToAction'
 import { rainApi } from '@/services/rain'
 import { RAIN_CARD_OVERVIEW_QUERY_KEY, useRainCardOverview } from '@/hooks/useRainCardOverview'
 import { useSignSpendBundle } from '@/hooks/wallet/useSignSpendBundle'
-import { InsufficientSpendableError, SessionKeyGrantRequiredError } from '@/hooks/wallet/useSpendBundle'
+import { InsufficientSpendableError, SessionKeyGrantRequiredError } from '@/hooks/wallet/spendPreflight'
 import { useWallet } from '@/hooks/wallet/useWallet'
 import { rainCentsToUsdcUnits } from '@/utils/balance.utils'
 
diff --git a/src/components/Global/GeneralRecipientInput/index.tsx b/src/components/Global/GeneralRecipientInput/index.tsx
index 6e4f7026f7..076675606c 100644
--- a/src/components/Global/GeneralRecipientInput/index.tsx
+++ b/src/components/Global/GeneralRecipientInput/index.tsx
@@ -7,6 +7,7 @@ import * as Senty from '@sentry/nextjs'
 import { useCallback, useRef } from 'react'
 import { isIBAN } from 'validator'
 import { validateAndResolveRecipient } from '@/lib/validation/recipient'
+import { isValidAddressForFamily, type WithdrawAddressFamily } from '@/lib/validation/addressFamily'
 import { BASE_URL } from '@/constants/general.consts'
 
 type GeneralRecipientInputProps = {
@@ -17,6 +18,10 @@ type GeneralRecipientInputProps = {
     infoText?: string
     showInfoText?: boolean
     isWithdrawal?: boolean
+    /** Address family of the selected withdraw destination ('evm' default).
+     *  Solana/Tron short-circuit the IBAN/US-routing/ENS branches — a base58
+     *  address is the only valid input for them. */
+    addressFamily?: WithdrawAddressFamily
 }
 
 export type GeneralRecipientUpdate = {
@@ -35,6 +40,7 @@ const GeneralRecipientInput = ({
     infoText,
     showInfoText = true,
     isWithdrawal = false,
+    addressFamily = 'evm',
 }: GeneralRecipientInputProps) => {
     const recipientType = useRef<RecipientType>('address')
     const errorMessage = useRef('')
@@ -50,6 +56,19 @@ const GeneralRecipientInput = ({
                 const trimmedInput = recipient.trim().replace(`${BASE_URL}/`, '')
                 const sanitizedInput = sanitizeBankAccount(trimmedInput)
 
+                // Non-EVM destination: base58 address or nothing — never IBAN,
+                // US-routing, ENS, or username.
+                if (addressFamily !== 'evm') {
+                    const familyValid = isValidAddressForFamily(trimmedInput, addressFamily)
+                    if (familyValid) {
+                        resolvedAddress.current = trimmedInput
+                    } else {
+                        errorMessage.current = `Invalid ${addressFamily === 'solana' ? 'Solana' : 'Tron'} address`
+                    }
+                    recipientType.current = 'address'
+                    return familyValid
+                }
+
                 if (isIBAN(sanitizedInput)) {
                     type = 'iban'
                     isValid = await validateBankAccount(sanitizedInput)
@@ -82,7 +101,7 @@ const GeneralRecipientInput = ({
                 return false
             }
         },
-        [isWithdrawal]
+        [isWithdrawal, addressFamily]
     )
 
     const onInputUpdate = useCallback(
diff --git a/src/components/Global/TokenSelector/TokenSelector.consts.ts b/src/components/Global/TokenSelector/TokenSelector.consts.ts
index 1201cdfee1..2a5376fd26 100644
--- a/src/components/Global/TokenSelector/TokenSelector.consts.ts
+++ b/src/components/Global/TokenSelector/TokenSelector.consts.ts
@@ -1,7 +1,8 @@
 import { SOLANA_ICON, TRON_ICON } from '@/assets'
 import { networks } from '@/config'
+import { CHAIN_REGISTRY } from '@/constants/chainRegistry.consts'
 import type { IPeanutChainDetails, IToken } from '@/interfaces/interfaces'
-import { celo, linea, worldchain } from 'viem/chains'
+import { celo, linea, scroll, worldchain } from 'viem/chains'
 
 interface CombinedType extends IPeanutChainDetails {
     tokens: IToken[]
@@ -69,7 +70,9 @@ export const TOKEN_SELECTOR_POPULAR_NETWORK_IDS = [
     },
 ]
 
-const networksToExclude: readonly number[] = [celo.id, linea.id, worldchain.id] as const
+// scroll excluded 2026-07-10: Rhino disabled it entirely, and Scroll isn't an
+// SDA deposit chain either, so every cross-chain route from it dead-ends.
+const networksToExclude: readonly number[] = [celo.id, linea.id, scroll.id, worldchain.id] as const
 
 // supported network ids for the network list, getting this from reown appkit config
 export const TOKEN_SELECTOR_SUPPORTED_NETWORK_IDS = networks
@@ -92,12 +95,12 @@ export const TOKEN_SELECTOR_SUPPORTED_NETWORK_IDS = networks
  *   BNB Chain is supported.
  * - EVM only (the withdraw flow uses 0x addresses); matches the current
  *   selectable chain set rather than every Rhino chain.
+ * - 2026-07-10 expansion: each new chain verified against Rhino prod with a real
+ *   ARBITRUM→X quote AND an outflow SDA create (see PR #2396). Stablecoins only
+ *   for the new chains — that's what was tested. Plasma/Stable are USDT-only on
+ *   Rhino. KAIA/opBNB deliberately absent: quotes pass but SDA create rejects
+ *   (DepositAddressTokenOutNotSupported).
  */
-export const RHINO_WITHDRAW_SUPPORTED_TOKENS_BY_CHAIN: Record<string, readonly string[]> = {
-    '42161': ['ETH', 'USDC', 'USDT'], // Arbitrum
-    '1': ['ETH', 'USDC', 'USDT'], // Ethereum
-    '10': ['ETH', 'USDC', 'USDT'], // Optimism
-    '137': ['USDC', 'USDT'], // Polygon (native POL not bridged by Rhino)
-    '100': ['USDC', 'USDT'], // Gnosis (native xDAI not bridged by Rhino)
-    '56': ['BNB', 'USDC', 'USDT'], // BNB Chain
-}
+export const RHINO_WITHDRAW_SUPPORTED_TOKENS_BY_CHAIN: Record<string, readonly string[]> = Object.fromEntries(
+    CHAIN_REGISTRY.filter((c) => c.withdraw).map((c) => [c.id, c.withdraw!.tokens])
+)
diff --git a/src/components/Global/TokenSelector/TokenSelector.tsx b/src/components/Global/TokenSelector/TokenSelector.tsx
index 2f7214cf8b..5ccc640914 100644
--- a/src/components/Global/TokenSelector/TokenSelector.tsx
+++ b/src/components/Global/TokenSelector/TokenSelector.tsx
@@ -33,6 +33,7 @@ import {
     TOKEN_SELECTOR_POPULAR_NETWORK_IDS,
     TOKEN_SELECTOR_SUPPORTED_NETWORK_IDS,
 } from './TokenSelector.consts'
+import { useChainRollout } from '@/hooks/useChainRollout'
 import { Drawer, DrawerContent, DrawerTitle } from '../Drawer'
 import underMaintenanceConfig from '@/config/underMaintenance.config'
 
@@ -131,7 +132,13 @@ const TokenSelector: React.FC<NewTokenSelectorProps> = ({ classNameButton, viewT
     // selected network name memo, being used ui
     const selectedNetworkName = useMemo(() => {
         if (!selectedChainID) return null
-        return getChainName(selectedChainID) || `Chain ${selectedChainID}`
+        // record first — non-EVM slugs ('solana'/'tron') aren't in the
+        // chain-details-backed getChainName lookup
+        return (
+            supportedChainsAndTokens?.[selectedChainID]?.networkName ||
+            getChainName(selectedChainID) ||
+            `Chain ${selectedChainID}`
+        )
     }, [selectedChainID, supportedChainsAndTokens])
 
     const peanutWalletTokenDetails = useMemo(() => {
@@ -169,14 +176,22 @@ const TokenSelector: React.FC<NewTokenSelectorProps> = ({ classNameButton, viewT
         }
     }
 
+    // Withdraw destinations are gated by what Rhino can DELIVER to
+    // (RHINO_WITHDRAW_SUPPORTED_TOKENS_BY_CHAIN), not by the wagmi source-chain
+    // list — the destination needs no wallet connection or balance reads, and
+    // several deliverable chains (Avalanche, Linea, Ink, …) are intentionally
+    // not source chains. Names/icons come from supportedChainsAndTokens.
+    // Per-chain rollout flags (PostHog) gate the newly-added withdraw
+    // destinations on prod so marketing can launch chains one by one.
+    const isChainRolledOut = useChainRollout()
     const allowedChainIds = useMemo(
         () =>
             new Set(
                 restrictToRhino
-                    ? TOKEN_SELECTOR_SUPPORTED_NETWORK_IDS.filter((id) => RHINO_WITHDRAW_SUPPORTED_TOKENS_BY_CHAIN[id])
+                    ? Object.keys(RHINO_WITHDRAW_SUPPORTED_TOKENS_BY_CHAIN).filter(isChainRolledOut)
                     : TOKEN_SELECTOR_SUPPORTED_NETWORK_IDS
             ),
-        [restrictToRhino]
+        [restrictToRhino, isChainRolledOut]
     )
 
     const popularChainsForButtons = useMemo(() => {
@@ -306,8 +321,11 @@ const TokenSelector: React.FC<NewTokenSelectorProps> = ({ classNameButton, viewT
         }
 
         if (searchValue) {
-            // search active: show searched token across ALL supported networks
-            return buildTokensForChainArray(TOKEN_SELECTOR_SUPPORTED_NETWORK_IDS, searchValue)
+            // search active: show searched token across all networks selectable
+            // in this mode — the Rhino destination set for withdraw (which
+            // includes destination-only chains like Linea/Avalanche), the wagmi
+            // source list otherwise.
+            return buildTokensForChainArray(Array.from(allowedChainIds), searchValue)
         }
         if (selectedChainID) {
             // specific chain selected: show popular (USDC, USDT, Native) for that chain
@@ -324,6 +342,7 @@ const TokenSelector: React.FC<NewTokenSelectorProps> = ({ classNameButton, viewT
         isCrossChainDisabled,
         restrictToRhino,
         isRhinoSupported,
+        allowedChainIds,
     ])
 
     // filter popular tokens by search
@@ -435,7 +454,7 @@ const TokenSelector: React.FC<NewTokenSelectorProps> = ({ classNameButton, viewT
                                 setSearchValue={setNetworkSearchValue}
                                 selectedChainID={selectedChainID}
                                 allowedChainIds={allowedChainIds}
-                                comingSoonNetworks={TOKEN_SELECTOR_COMING_SOON_NETWORKS}
+                                comingSoonNetworks={restrictToRhino ? [] : TOKEN_SELECTOR_COMING_SOON_NETWORKS}
                             />
                         ) : (
                             <div className="relative flex flex-col space-y-4">
diff --git a/src/components/TransactionDetails/transactionTransformer.ts b/src/components/TransactionDetails/transactionTransformer.ts
index 333e8a2742..e9036bf9ef 100644
--- a/src/components/TransactionDetails/transactionTransformer.ts
+++ b/src/components/TransactionDetails/transactionTransformer.ts
@@ -248,8 +248,17 @@ function computeDerivedFields(entry: HistoryEntry): {
 } {
     // For crypto deposits, force the explorer URL to Peanut's wallet chain
     // (Arbitrum) — the underlying chainId field is the deposit-source chain.
+    // CRYPTO_DEPOSIT and CRYPTO_WITHDRAW both record the tx hash on Peanut's
+    // wallet chain (Arbitrum) — for withdrawals entry.chainId is the
+    // DESTINATION, so linking it with the recorded hash mislinked receipts on
+    // destinations that have an explorer (e.g. Avalanche) and left them
+    // linkless on ones that don't (Tempo, Solana, Tron). Always link the
+    // chain the recorded hash actually lives on. (Known residual: a withdraw
+    // completed via the BRIDGE_EXECUTED webhook carries the destination-side
+    // hash — rare; linking source keeps the dominant case correct.)
+    const kind = intentKindOf(entry)
     const explorerUrlChainID =
-        intentKindOf(entry) === 'CRYPTO_DEPOSIT' ? PEANUT_WALLET_CHAIN.id.toString() : entry.chainId
+        kind === 'CRYPTO_DEPOSIT' || kind === 'CRYPTO_WITHDRAW' ? PEANUT_WALLET_CHAIN.id.toString() : entry.chainId
     const baseUrl = getExplorerUrl(explorerUrlChainID)
 
     let explorerUrlWithTx: string | undefined
diff --git a/src/components/Withdraw/views/Initial.withdraw.view.tsx b/src/components/Withdraw/views/Initial.withdraw.view.tsx
index 822a4dfe6a..2231f1df46 100644
--- a/src/components/Withdraw/views/Initial.withdraw.view.tsx
+++ b/src/components/Withdraw/views/Initial.withdraw.view.tsx
@@ -11,9 +11,10 @@ import { type ITokenPriceData } from '@/interfaces'
 import type { ChainWithTokens } from '@/interfaces/chain-meta'
 import { formatAmount } from '@/utils/general.utils'
 import { useRouter } from 'next/navigation'
-import { useContext, useEffect } from 'react'
+import { useContext, useEffect, useMemo, useRef } from 'react'
 import TokenSelector from '@/components/Global/TokenSelector/TokenSelector'
 import { PEANUT_WALLET_CHAIN, PEANUT_WALLET_TOKEN } from '@/constants/zerodev.consts'
+import { addressFamilyForChainId } from '@/lib/validation/addressFamily'
 
 interface InitialWithdrawViewProps {
     amount: string
@@ -44,7 +45,21 @@ export default function InitialWithdrawView({ amount, onReview, onBack, isProces
         setError,
     } = useWithdrawFlow()
 
+    // Non-EVM destinations (Solana/Tron) drive the recipient input's address
+    // family; changing family invalidates whatever address was typed.
+    const addressFamily = useMemo(() => addressFamilyForChainId(selectedChainID), [selectedChainID])
+    const prevFamilyRef = useRef(addressFamily)
+    useEffect(() => {
+        if (prevFamilyRef.current !== addressFamily) {
+            prevFamilyRef.current = addressFamily
+            setRecipient({ name: undefined, address: '' })
+            setIsValidRecipient(false)
+        }
+    }, [addressFamily, setRecipient, setIsValidRecipient])
+
     const handleReview = () => {
+        // Context record already includes the synthetic non-EVM withdraw
+        // destinations (merged once in tokenSelector.context).
         const xchainChainData = supportedChainsAndTokens[selectedChainID]
         // supportedChainsAndTokens may not list the Peanut wallet chain on
         // testnets / env-configured chains. Synthesize a minimal entry so the
@@ -98,7 +113,9 @@ export default function InitialWithdrawView({ amount, onReview, onBack, isProces
     }, [])
 
     return (
-        <div className="space-y-8">
+        // flex/gap shell per the page-layout rules — space-y on the outer div
+        // conflicts with centering and clipped the CTA on short viewports
+        <div className="flex min-h-[inherit] flex-col gap-8">
             <NavHeader title="Withdraw" onPrev={onBack || defaultOnBack} />
 
             <div className="space-y-4">
@@ -114,7 +131,8 @@ export default function InitialWithdrawView({ amount, onReview, onBack, isProces
                 <TokenSelector viewType="withdraw" />
 
                 <GeneralRecipientInput
-                    placeholder="Enter an address or ENS"
+                    placeholder={addressFamily === 'evm' ? 'Enter an address or ENS' : 'Enter an address'}
+                    addressFamily={addressFamily}
                     recipient={recipient}
                     onUpdate={(update: GeneralRecipientUpdate) => {
                         setRecipient(update.recipient)
diff --git a/src/constants/__tests__/chainRegistry.test.ts b/src/constants/__tests__/chainRegistry.test.ts
new file mode 100644
index 0000000000..02377c3368
--- /dev/null
+++ b/src/constants/__tests__/chainRegistry.test.ts
@@ -0,0 +1,169 @@
+/**
+ * Behavior-equality proof for the CHAIN_REGISTRY refactor: every derived map
+ * must match the hand-maintained literals it replaced (values captured from
+ * feat/solana-tron-withdrawals @ ea63b6ca). If you're editing these
+ * EXPECTATIONS to make a failure pass, you're changing chain behavior —
+ * verify against Rhino's live catalogs first.
+ */
+// TokenSelector.consts imports the wagmi `networks` config, which cannot
+// construct under jest (appkit env) — only the id list matters here.
+jest.mock('@/config', () => ({ networks: [] }))
+
+import {
+    CHAIN_LOGOS,
+    SUPPORTED_EVM_CHAINS,
+    OTHER_SUPPORTED_CHAINS,
+    EVM_CHAIN_ID_TO_RHINO_NAME,
+    NON_EVM_CHAIN_ID_TO_RHINO_NAME,
+    chainIdToRhinoName,
+    EVM_DEPOSIT_TOKEN_EXCEPTIONS,
+} from '../rhino.consts'
+import { RHINO_WITHDRAW_SUPPORTED_TOKENS_BY_CHAIN } from '@/components/Global/TokenSelector/TokenSelector.consts'
+import { CHAIN_REGISTRY, CHAIN_ROLLOUT_FLAGS, NON_EVM_WITHDRAW_CHAINS } from '../chainRegistry.consts'
+
+describe('CHAIN_REGISTRY derivations match the replaced literals', () => {
+    it('EVM_CHAIN_ID_TO_RHINO_NAME', () => {
+        expect(EVM_CHAIN_ID_TO_RHINO_NAME).toEqual({
+            '1': 'ETHEREUM',
+            '10': 'OPTIMISM',
+            '56': 'BINANCE',
+            '100': 'GNOSIS',
+            '137': 'MATIC_POS',
+            '42161': 'ARBITRUM',
+            '421614': 'ARBITRUM',
+            '8453': 'BASE',
+            '42220': 'CELO',
+            '43114': 'AVALANCHE',
+            '999': 'HYPEREVM',
+            '57073': 'INK',
+            '747474': 'KATANA',
+            '59144': 'LINEA',
+            '5000': 'MANTLE',
+            '9745': 'PLASMA',
+            '988': 'STABLE',
+            '4217': 'TEMPO',
+            // NEW vs the literal (deliberate): Kaia now maps — it's a deposit
+            // chain and webhook/receipt surfaces may reference it. It is NOT a
+            // withdraw destination (no entry in the withdraw gate below).
+            '8217': 'KAIA',
+        })
+        // SCROLL must never come back without a live-catalog re-check
+        expect(EVM_CHAIN_ID_TO_RHINO_NAME['534352']).toBeUndefined()
+    })
+
+    it('non-EVM mapping and the combined resolver', () => {
+        expect(NON_EVM_CHAIN_ID_TO_RHINO_NAME).toEqual({ solana: 'SOLANA', tron: 'TRON' })
+        expect(chainIdToRhinoName('SOLANA')).toBe('SOLANA')
+        expect(chainIdToRhinoName(421614)).toBe('ARBITRUM')
+        expect(chainIdToRhinoName('534352')).toBeUndefined()
+    })
+
+    it('RHINO_WITHDRAW_SUPPORTED_TOKENS_BY_CHAIN', () => {
+        expect(RHINO_WITHDRAW_SUPPORTED_TOKENS_BY_CHAIN).toEqual({
+            '42161': ['ETH', 'USDC', 'USDT'],
+            '1': ['ETH', 'USDC', 'USDT'],
+            '10': ['ETH', 'USDC', 'USDT'],
+            '137': ['USDC', 'USDT'],
+            '100': ['USDC', 'USDT'],
+            '56': ['BNB', 'USDC', 'USDT'],
+            // Added 2026-07-13 (Hugo): the June curation oversight, fixed —
+            // verified live (quotes ETH/USDC/USDT + SDA create) same day.
+            '8453': ['ETH', 'USDC', 'USDT'],
+            '43114': ['USDC', 'USDT'],
+            '999': ['USDC', 'USDT'],
+            '57073': ['USDC', 'USDT'],
+            '747474': ['USDC', 'USDT'],
+            '59144': ['USDC', 'USDT'],
+            '5000': ['USDC', 'USDT'],
+            '9745': ['USDT'],
+            '988': ['USDT'],
+            '4217': ['USDC', 'USDT'],
+            solana: ['USDC', 'USDT'],
+            tron: ['USDT'],
+        })
+        // Kaia/opBNB rejected at SDA create; Scroll disabled — must stay out
+        expect(RHINO_WITHDRAW_SUPPORTED_TOKENS_BY_CHAIN['8217']).toBeUndefined()
+        expect(RHINO_WITHDRAW_SUPPORTED_TOKENS_BY_CHAIN['534352']).toBeUndefined()
+    })
+
+    it('deposit surfaces: chains, exceptions, logos', () => {
+        expect([...SUPPORTED_EVM_CHAINS].sort()).toEqual(
+            [
+                'ARBITRUM',
+                'ETHEREUM',
+                'BASE',
+                'OPTIMISM',
+                'BNB',
+                'POLYGON',
+                'KATANA',
+                'GNOSIS',
+                'CELO',
+                'TEMPO',
+                'KAIA',
+                'PLASMA',
+            ].sort()
+        )
+        expect([...OTHER_SUPPORTED_CHAINS].sort()).toEqual(['SOLANA', 'TRON'])
+        expect(EVM_DEPOSIT_TOKEN_EXCEPTIONS).toEqual({
+            KAIA: ['USDT'],
+            PLASMA: ['USDT'],
+            TEMPO: ['USDT', 'USDC'],
+            CELO: ['USDT', 'USDC'],
+            GNOSIS: ['USDT', 'USDC'],
+        })
+        // every advertised chain has a logo (broken-logo class of bug)
+        for (const chain of [...SUPPORTED_EVM_CHAINS, ...OTHER_SUPPORTED_CHAINS]) {
+            expect(CHAIN_LOGOS[chain]).toMatch(/^https:\/\//)
+        }
+        expect(CHAIN_LOGOS.SCROLL).toMatch(/^https:\/\//) // legacy display-only
+    })
+
+    it('CHAIN_ROLLOUT_FLAGS — every surface key of a flagged chain maps to ONE flag', () => {
+        expect(CHAIN_ROLLOUT_FLAGS).toEqual({
+            '8453': 'chain-rollout-base',
+            BASE: 'chain-rollout-base',
+            '43114': 'chain-rollout-avalanche',
+            '999': 'chain-rollout-hyperevm',
+            '57073': 'chain-rollout-ink',
+            '747474': 'chain-rollout-katana',
+            KATANA: 'chain-rollout-katana',
+            '59144': 'chain-rollout-linea',
+            '5000': 'chain-rollout-mantle',
+            '9745': 'chain-rollout-plasma',
+            PLASMA: 'chain-rollout-plasma',
+            '988': 'chain-rollout-stable',
+            '4217': 'chain-rollout-tempo',
+            TEMPO: 'chain-rollout-tempo',
+            '8217': 'chain-rollout-kaia',
+            KAIA: 'chain-rollout-kaia',
+            solana: 'chain-rollout-solana',
+            SOLANA: 'chain-rollout-solana',
+            tron: 'chain-rollout-tron',
+            TRON: 'chain-rollout-tron',
+        })
+    })
+
+    it('NON_EVM_WITHDRAW_CHAINS synthetic records', () => {
+        expect(Object.keys(NON_EVM_WITHDRAW_CHAINS).sort()).toEqual(['solana', 'tron'])
+        expect(NON_EVM_WITHDRAW_CHAINS.solana.tokens.map((t) => t.symbol)).toEqual(['USDC', 'USDT'])
+        expect(NON_EVM_WITHDRAW_CHAINS.solana.tokens[0].address).toBe('EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v')
+        expect(NON_EVM_WITHDRAW_CHAINS.tron.tokens.map((t) => t.symbol)).toEqual(['USDT'])
+        expect(NON_EVM_WITHDRAW_CHAINS.tron.tokens[0].address).toBe('TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t')
+    })
+
+    it('registry invariants', () => {
+        const ids = CHAIN_REGISTRY.map((c) => c.id)
+        expect(new Set(ids).size).toBe(ids.length) // no duplicate ids
+        for (const entry of CHAIN_REGISTRY) {
+            // a routable chain must have a Rhino name
+            if (entry.deposit || entry.withdraw) expect(entry.rhinoName).toBeTruthy()
+            // a deposit-advertised chain must be displayable
+            if (entry.deposit) {
+                expect(entry.displayName).toBeTruthy()
+                expect(entry.logoUrl).toBeTruthy()
+            }
+            // non-EVM withdraw destinations need their synthetic record
+            if (entry.withdraw && entry.family !== 'evm') expect(entry.nonEvmRecord).toBeTruthy()
+        }
+    })
+})
diff --git a/src/constants/__tests__/nonEvmLeak.test.ts b/src/constants/__tests__/nonEvmLeak.test.ts
new file mode 100644
index 0000000000..ef7ecf322d
--- /dev/null
+++ b/src/constants/__tests__/nonEvmLeak.test.ts
@@ -0,0 +1,55 @@
+/**
+ * Leak tripwire for the synthetic non-EVM withdraw records.
+ *
+ * NON_EVM_WITHDRAW_CHAINS (Solana/Tron) is merged into the GLOBAL
+ * tokenSelector context so the withdraw selector and the price hook resolve
+ * them. They are kept out of send / claim / pay / URL-parse surfaces only by
+ * discipline: those surfaces gate their network list on the wagmi-derived id
+ * set (TOKEN_SELECTOR_SUPPORTED_NETWORK_IDS), and URL parsing reads the
+ * server action, not the context. This test turns that discipline into an
+ * enforced invariant — if a non-EVM chain ever enters a non-withdraw gate,
+ * it fails here instead of leaking a broken (base58-address) chain into a
+ * send flow.
+ */
+// TokenSelector.consts imports the wagmi `networks` config, which cannot
+// construct under jest — mock it to the real mainnet ids the gate filters on.
+jest.mock('@/config', () => ({
+    networks: [
+        { id: 42161 },
+        { id: 1 },
+        { id: 10 },
+        { id: 137 },
+        { id: 100 },
+        { id: 8453 },
+        { id: 56 },
+        { id: 42220 },
+        { id: 59144 },
+        { id: 534352 },
+        { id: 480 }, // worldchain
+    ],
+}))
+
+import { NON_EVM_WITHDRAW_CHAINS } from '../chainRegistry.consts'
+import { TOKEN_SELECTOR_SUPPORTED_NETWORK_IDS } from '@/components/Global/TokenSelector/TokenSelector.consts'
+import { supportedPeanutChains } from '@/constants/general.consts'
+
+describe('non-EVM synthetic records do not leak into non-withdraw surfaces', () => {
+    const nonEvmIds = Object.keys(NON_EVM_WITHDRAW_CHAINS) // ['solana', 'tron']
+
+    it('has the expected non-EVM ids (guards the test itself)', () => {
+        expect(nonEvmIds.sort()).toEqual(['solana', 'tron'])
+    })
+
+    it('is disjoint from the non-withdraw network gate (TOKEN_SELECTOR_SUPPORTED_NETWORK_IDS)', () => {
+        for (const id of nonEvmIds) {
+            expect(TOKEN_SELECTOR_SUPPORTED_NETWORK_IDS).not.toContain(id)
+        }
+    })
+
+    it('is disjoint from the canonical chain source (supportedPeanutChains — feeds URL parsing/validation)', () => {
+        const peanutChainIds = supportedPeanutChains.map((c) => String(c.chainId).toLowerCase())
+        for (const id of nonEvmIds) {
+            expect(peanutChainIds).not.toContain(id)
+        }
+    })
+})
diff --git a/src/constants/analytics.consts.ts b/src/constants/analytics.consts.ts
index 8445239956..130b02f305 100644
--- a/src/constants/analytics.consts.ts
+++ b/src/constants/analytics.consts.ts
@@ -227,6 +227,10 @@ export const ANALYTICS_EVENTS = {
     CARD_PHYSICAL_WAITLIST_JOINED: 'card_physical_waitlist_joined',
     CARD_ADD_TO_WALLET_VIEWED: 'card_add_to_wallet_viewed',
     // Spend routing across collateral / smart / mixed buckets. `strategy` is SpendStrategy.
+    // Root-validator migration userOp fired ahead of a mixed spend (pre-2025-09-18
+    // accounts still on the unpatched validator) — see kernelMigration.utils.ts.
+    KERNEL_MIGRATION_ATTEMPTED: 'kernel_migration_attempted',
+    KERNEL_MIGRATION_SUCCEEDED: 'kernel_migration_succeeded',
     CARD_WITHDRAW_ATTEMPTED: 'card_withdraw_attempted',
     CARD_WITHDRAW_SUCCEEDED: 'card_withdraw_succeeded',
     CARD_WITHDRAW_FAILED: 'card_withdraw_failed',
diff --git a/src/constants/chain-details.json b/src/constants/chain-details.json
index becebf85d8..e4ccf0163e 100644
--- a/src/constants/chain-details.json
+++ b/src/constants/chain-details.json
@@ -106,7 +106,6 @@
         ],
         "mainnet": true
     },
-
     "10": {
         "name": "Optimism",
         "chain": "ETH",
@@ -835,7 +834,6 @@
             "format": "png"
         }
     },
-
     "167009": {
         "name": "Taiko Hekla L2",
         "chain": "ETH",
@@ -1073,5 +1071,173 @@
             "url": "https://raw.githubusercontent.com/spothq/cryptocurrency-icons/master/svg/color/eth.svg",
             "format": "svg"
         }
+    },
+    "999": {
+        "name": "HyperEVM",
+        "chain": "HYPE",
+        "icon": {
+            "url": "https://coin-images.coingecko.com/asset_platforms/images/22208/small/hyperliquid.jpg?1740125774",
+            "format": "jpg"
+        },
+        "rpc": ["https://rpc.hyperliquid.xyz/evm"],
+        "features": [],
+        "faucets": [],
+        "nativeCurrency": {
+            "name": "Hype",
+            "symbol": "HYPE",
+            "decimals": 18
+        },
+        "infoURL": "https://hyperliquid.xyz",
+        "shortName": "hyperevm",
+        "chainId": "999",
+        "networkId": 999,
+        "explorers": [
+            {
+                "name": "HyperEVMScan",
+                "url": "https://hyperevmscan.io",
+                "standard": "EIP3091"
+            }
+        ],
+        "mainnet": true
+    },
+    "57073": {
+        "name": "Ink",
+        "chain": "ETH",
+        "icon": {
+            "url": "https://coin-images.coingecko.com/asset_platforms/images/22194/small/ink.jpg?1737600222",
+            "format": "jpg"
+        },
+        "rpc": ["https://rpc-gel.inkonchain.com"],
+        "features": [],
+        "faucets": [],
+        "nativeCurrency": {
+            "name": "Ether",
+            "symbol": "ETH",
+            "decimals": 18
+        },
+        "infoURL": "https://inkonchain.com",
+        "shortName": "ink",
+        "chainId": "57073",
+        "networkId": 57073,
+        "explorers": [
+            {
+                "name": "Ink Explorer",
+                "url": "https://explorer.inkonchain.com",
+                "standard": "EIP3091"
+            }
+        ],
+        "mainnet": true
+    },
+    "747474": {
+        "name": "Katana",
+        "chain": "ETH",
+        "icon": {
+            "url": "https://coin-images.coingecko.com/asset_platforms/images/32239/small/katana.jpg?1751496126",
+            "format": "jpg"
+        },
+        "rpc": ["https://rpc.katana.network"],
+        "features": [],
+        "faucets": [],
+        "nativeCurrency": {
+            "name": "Ether",
+            "symbol": "ETH",
+            "decimals": 18
+        },
+        "infoURL": "https://katana.network",
+        "shortName": "katana",
+        "chainId": "747474",
+        "networkId": 747474,
+        "explorers": [
+            {
+                "name": "Katanascan",
+                "url": "https://katanascan.com",
+                "standard": "EIP3091"
+            }
+        ],
+        "mainnet": true
+    },
+    "9745": {
+        "name": "Plasma",
+        "chain": "Plasma",
+        "icon": {
+            "url": "https://coin-images.coingecko.com/asset_platforms/images/32256/small/plasma.jpg?1758000963",
+            "format": "jpg"
+        },
+        "rpc": ["https://rpc.plasma.to"],
+        "features": [],
+        "faucets": [],
+        "nativeCurrency": {
+            "name": "Plasma",
+            "symbol": "XPL",
+            "decimals": 18
+        },
+        "infoURL": "https://plasma.to",
+        "shortName": "plasma",
+        "chainId": "9745",
+        "networkId": 9745,
+        "explorers": [
+            {
+                "name": "Routescan",
+                "url": "https://plasmascan.to",
+                "standard": "EIP3091"
+            }
+        ],
+        "mainnet": true
+    },
+    "988": {
+        "name": "Stable",
+        "chain": "Stable",
+        "icon": {
+            "url": "https://coin-images.coingecko.com/asset_platforms/images/32271/small/stable.png?1765196531",
+            "format": "png"
+        },
+        "rpc": ["https://rpc.stable.xyz"],
+        "features": [],
+        "faucets": [],
+        "nativeCurrency": {
+            "name": "USDT0",
+            "symbol": "USDT0",
+            "decimals": 18
+        },
+        "infoURL": "https://stable.xyz",
+        "shortName": "stable",
+        "chainId": "988",
+        "networkId": 988,
+        "explorers": [
+            {
+                "name": "Stablescan",
+                "url": "https://stablescan.xyz",
+                "standard": "EIP3091"
+            }
+        ],
+        "mainnet": true
+    },
+    "4217": {
+        "name": "Tempo",
+        "chain": "Tempo",
+        "icon": {
+            "url": "https://icons.llamao.fi/icons/chains/rsz_tempo.jpg",
+            "format": "jpg"
+        },
+        "rpc": ["https://rpc.mainnet.tempo.xyz"],
+        "features": [],
+        "faucets": [],
+        "nativeCurrency": {
+            "name": "USD",
+            "symbol": "USD",
+            "decimals": 18
+        },
+        "infoURL": "https://tempo.xyz",
+        "shortName": "tempo",
+        "chainId": "4217",
+        "networkId": 4217,
+        "explorers": [
+            {
+                "name": "Tempo Explorer",
+                "url": "https://explore.tempo.xyz",
+                "standard": "EIP3091"
+            }
+        ],
+        "mainnet": true
     }
 }
diff --git a/src/constants/chainRegistry.consts.ts b/src/constants/chainRegistry.consts.ts
new file mode 100644
index 0000000000..77bd60b4e8
--- /dev/null
+++ b/src/constants/chainRegistry.consts.ts
@@ -0,0 +1,344 @@
+/**
+ * THE chain registry — single source of truth for every chain fact the FE
+ * hand-maintains about Rhino-connected chains.
+ *
+ * Before this file, one chain's facts were spread across SEVEN maps
+ * (CHAIN_LOGOS, SUPPORTED_EVM_CHAINS, EVM_CHAIN_ID_TO_RHINO_NAME,
+ * RHINO_WITHDRAW_SUPPORTED_TOKENS_BY_CHAIN, EVM_DEPOSIT_TOKEN_EXCEPTIONS,
+ * CHAIN_ROLLOUT_FLAGS, NON_EVM_WITHDRAW_CHAINS) — the drift between them
+ * caused the SCROLL rot and the frozen-SDA incident. Those exports still
+ * exist at their old import paths, but every one of them is now DERIVED
+ * from this registry (see the `derive*` helpers below + the equality tests
+ * in __tests__/chainRegistry.test.ts).
+ *
+ * To add/change a chain: edit ONE entry here. Verify against Rhino's live
+ * catalogs first (`getBridgeConfig()` for withdraw, `getSupportedConfigs()`
+ * for deposit) — the monitor's drift check compares this registry to Rhino.
+ *
+ * NOT in scope: chain-details.json / token-details.json (chain metadata for
+ * generic EVM surfaces — explorer URLs, full token lists) and the BE's
+ * CHAINS_CONFIG (already a single map in peanut-api-ts).
+ */
+
+export interface RegistryTokenMeta {
+    symbol: string
+    address: string
+    decimals: number
+    name: string
+    logoURI: string
+}
+
+export interface ChainRegistryEntry {
+    /** Selector identifier: EVM numeric chainId as a string, or a non-EVM slug. */
+    id: string
+    /** Additional selector ids resolving to the same Rhino bucket (e.g. Arb Sepolia → ARBITRUM). */
+    aliasIds?: readonly string[]
+    /** Rhino API chain name. Absent = Rhino has the chain disabled (kept for display only). */
+    rhinoName?: string
+    family: 'evm' | 'solana' | 'tron'
+    /** Display key on deposit surfaces (the legacy `ChainName`). */
+    displayName?: string
+    logoUrl?: string
+    /** Present = advertised DEPOSIT chain. `tokens` only when narrower than
+     *  the family default (USDT/USDC/ETH for EVM) — drives the "USDT only"
+     *  funds-safety annotations. */
+    deposit?: { tokens?: readonly string[] }
+    /** Present = Rhino WITHDRAW destination; `tokens` = symbols Rhino
+     *  delivers there (each verified: live quote + outflow SDA create). */
+    withdraw?: { tokens: readonly string[] }
+    /** Synthetic selector record for non-EVM chains (no chain-details entry). */
+    nonEvmRecord?: { networkName: string; tokens: readonly RegistryTokenMeta[] }
+    /** PostHog rollout gate — see engineering/patterns/feature-gates.md.
+     *  Delete when the chain launch is permanent. */
+    rolloutFlag?: string
+}
+
+const TOKEN_LOGO = {
+    USDT: 'https://assets.coingecko.com/coins/images/325/standard/Tether.png?1696501661',
+    USDC: 'https://assets.coingecko.com/coins/images/6319/small/USD_Coin_icon.png',
+} as const
+
+const CHAIN_REGISTRY_LITERAL = [
+    // ── legacy, always-on chains ────────────────────────────────────────────
+    {
+        id: '42161',
+        aliasIds: ['421614'], // Arb Sepolia — same Rhino bucket for sandbox runs
+        rhinoName: 'ARBITRUM',
+        family: 'evm',
+        displayName: 'ARBITRUM',
+        logoUrl: 'https://assets.coingecko.com/asset_platforms/images/33/standard/AO_logomark.png?1706606717',
+        deposit: {},
+        withdraw: { tokens: ['ETH', 'USDC', 'USDT'] },
+    },
+    {
+        id: '1',
+        rhinoName: 'ETHEREUM',
+        family: 'evm',
+        displayName: 'ETHEREUM',
+        logoUrl: 'https://assets.coingecko.com/asset_platforms/images/279/standard/ethereum.png?1706606803',
+        deposit: {},
+        withdraw: { tokens: ['ETH', 'USDC', 'USDT'] },
+    },
+    {
+        id: '8453',
+        rhinoName: 'BASE',
+        family: 'evm',
+        displayName: 'BASE',
+        logoUrl: 'https://assets.coingecko.com/asset_platforms/images/131/standard/base.png?1759905869',
+        deposit: {},
+        // Enabled 2026-07-13 (Hugo): Base was missing from the curated
+        // withdraw gate since June — an oversight, not a decision. Verified
+        // same-day: ARB→BASE quotes OK for ETH/USDC/USDT + outflow SDA
+        // create OK. Rollout-flagged like the other 2026-07 additions.
+        withdraw: { tokens: ['ETH', 'USDC', 'USDT'] },
+        rolloutFlag: 'chain-rollout-base',
+    },
+    {
+        id: '10',
+        rhinoName: 'OPTIMISM',
+        family: 'evm',
+        displayName: 'OPTIMISM',
+        logoUrl: 'https://assets.coingecko.com/asset_platforms/images/41/standard/optimism.png?1706606778',
+        deposit: {},
+        withdraw: { tokens: ['ETH', 'USDC', 'USDT'] },
+    },
+    {
+        id: '100',
+        rhinoName: 'GNOSIS',
+        family: 'evm',
+        displayName: 'GNOSIS',
+        logoUrl: 'https://assets.coingecko.com/asset_platforms/images/11062/standard/Aatar_green_white.png?1706606458',
+        deposit: { tokens: ['USDT', 'USDC'] }, // no ETH on Gnosis at Rhino
+        withdraw: { tokens: ['USDC', 'USDT'] }, // native xDAI not bridged by Rhino
+    },
+    {
+        id: '137',
+        rhinoName: 'MATIC_POS', // Rhino's name for Polygon (display: POLYGON)
+        family: 'evm',
+        displayName: 'POLYGON',
+        logoUrl: 'https://assets.coingecko.com/asset_platforms/images/15/standard/polygon_pos.png?1706606645',
+        deposit: {},
+        withdraw: { tokens: ['USDC', 'USDT'] }, // native POL not bridged by Rhino
+    },
+    {
+        id: '56',
+        rhinoName: 'BINANCE', // Rhino's name for BNB Chain (display: BNB)
+        family: 'evm',
+        displayName: 'BNB',
+        logoUrl: 'https://assets.coingecko.com/asset_platforms/images/1/standard/bnb_smart_chain.png?1706606721',
+        deposit: {},
+        withdraw: { tokens: ['BNB', 'USDC', 'USDT'] },
+    },
+    {
+        id: '42220',
+        rhinoName: 'CELO',
+        family: 'evm',
+        displayName: 'CELO',
+        logoUrl: 'https://assets.coingecko.com/asset_platforms/images/21/standard/celo.jpeg?1711358666',
+        deposit: { tokens: ['USDT', 'USDC'] }, // no ETH on Celo at Rhino
+        // not a withdraw destination in the curated gate (legacy state)
+    },
+    {
+        // SCROLL: display-only legacy — Rhino disabled it 2026-07 ("SCROLL is
+        // disabled" InvalidRequest). No rhinoName = not routable anywhere.
+        id: '534352',
+        family: 'evm',
+        displayName: 'SCROLL',
+        logoUrl: 'https://assets.coingecko.com/asset_platforms/images/153/standard/scroll.jpeg?1706606782',
+    },
+
+    // ── 2026-07 expansion (peanut-ui#2396/#2398) — each verified against ──
+    // ── Rhino prod: live quote + outflow SDA create; rollout-flagged ──────
+    {
+        id: '43114',
+        rhinoName: 'AVALANCHE',
+        family: 'evm',
+        withdraw: { tokens: ['USDC', 'USDT'] },
+        rolloutFlag: 'chain-rollout-avalanche',
+    },
+    {
+        id: '999',
+        rhinoName: 'HYPEREVM',
+        family: 'evm',
+        withdraw: { tokens: ['USDC', 'USDT'] },
+        rolloutFlag: 'chain-rollout-hyperevm',
+    },
+    {
+        id: '57073',
+        rhinoName: 'INK',
+        family: 'evm',
+        withdraw: { tokens: ['USDC', 'USDT'] },
+        rolloutFlag: 'chain-rollout-ink',
+    },
+    {
+        id: '747474',
+        rhinoName: 'KATANA',
+        family: 'evm',
+        displayName: 'KATANA',
+        logoUrl: 'https://assets.coingecko.com/asset_platforms/images/32239/standard/katana.jpg?1751496126',
+        deposit: {},
+        withdraw: { tokens: ['USDC', 'USDT'] }, // delivered as vbUSDC/vbUSDT
+        rolloutFlag: 'chain-rollout-katana',
+    },
+    {
+        id: '59144',
+        rhinoName: 'LINEA',
+        family: 'evm',
+        withdraw: { tokens: ['USDC', 'USDT'] },
+        rolloutFlag: 'chain-rollout-linea',
+    },
+    {
+        id: '5000',
+        rhinoName: 'MANTLE',
+        family: 'evm',
+        withdraw: { tokens: ['USDC', 'USDT'] }, // USDT delivered as USDT0
+        rolloutFlag: 'chain-rollout-mantle',
+    },
+    {
+        id: '9745',
+        rhinoName: 'PLASMA',
+        family: 'evm',
+        displayName: 'PLASMA',
+        logoUrl: 'https://coin-images.coingecko.com/asset_platforms/images/32256/small/plasma.jpg?1758000963',
+        deposit: { tokens: ['USDT'] }, // USDT0-only chain — USDC would be lost
+        withdraw: { tokens: ['USDT'] },
+        rolloutFlag: 'chain-rollout-plasma',
+    },
+    {
+        id: '988',
+        rhinoName: 'STABLE',
+        family: 'evm',
+        withdraw: { tokens: ['USDT'] }, // USDT0-only chain
+        rolloutFlag: 'chain-rollout-stable',
+    },
+    {
+        id: '4217',
+        rhinoName: 'TEMPO',
+        family: 'evm',
+        displayName: 'TEMPO',
+        logoUrl: 'https://icons.llamao.fi/icons/chains/rsz_tempo.jpg',
+        deposit: { tokens: ['USDT', 'USDC'] }, // no ETH asset on Tempo
+        withdraw: { tokens: ['USDC', 'USDT'] }, // delivered as USDC.e/USDT0
+        rolloutFlag: 'chain-rollout-tempo',
+    },
+    {
+        id: '8217',
+        rhinoName: 'KAIA',
+        family: 'evm',
+        displayName: 'KAIA',
+        logoUrl: 'https://coin-images.coingecko.com/asset_platforms/images/9672/small/kaia.png?1734946776',
+        deposit: { tokens: ['USDT'] }, // USDT-only at Rhino — USDC would be lost
+        // NOT a withdraw destination: Rhino SDA create rejects Kaia tokenOut
+        rolloutFlag: 'chain-rollout-kaia',
+    },
+
+    // ── non-EVM ─────────────────────────────────────────────────────────────
+    {
+        id: 'solana',
+        rhinoName: 'SOLANA',
+        family: 'solana',
+        displayName: 'SOLANA',
+        logoUrl: 'https://assets.coingecko.com/asset_platforms/images/5/standard/solana.png?1706606708',
+        deposit: {}, // SOL family default (USDT/USDC)
+        withdraw: { tokens: ['USDC', 'USDT'] },
+        nonEvmRecord: {
+            networkName: 'Solana',
+            tokens: [
+                {
+                    symbol: 'USDC',
+                    address: 'EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v',
+                    decimals: 6,
+                    name: 'USD Coin',
+                    logoURI: TOKEN_LOGO.USDC,
+                },
+                {
+                    symbol: 'USDT',
+                    address: 'Es9vMFrzaCERmJfrF4H2FYD4KCoNkY11McCe8BenwNYB',
+                    decimals: 6,
+                    name: 'Tether USD',
+                    logoURI: TOKEN_LOGO.USDT,
+                },
+            ],
+        },
+        rolloutFlag: 'chain-rollout-solana',
+    },
+    {
+        id: 'tron',
+        rhinoName: 'TRON',
+        family: 'tron',
+        displayName: 'TRON',
+        logoUrl: 'https://assets.coingecko.com/asset_platforms/images/1094/standard/TRON_LOGO.png?1706606652',
+        deposit: {}, // TRON family default (USDT)
+        withdraw: { tokens: ['USDT'] }, // no USDC on Tron
+        nonEvmRecord: {
+            networkName: 'Tron',
+            tokens: [
+                {
+                    symbol: 'USDT',
+                    address: 'TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t',
+                    decimals: 6,
+                    name: 'Tether USD',
+                    logoURI: TOKEN_LOGO.USDT,
+                },
+            ],
+        },
+        rolloutFlag: 'chain-rollout-tron',
+    },
+] as const satisfies readonly ChainRegistryEntry[]
+
+/** Display-name union (the legacy `ChainName`) — literal types preserved
+ *  via Extract (indexed access fails on union members lacking the prop). */
+type RegistryEntryLiteral = (typeof CHAIN_REGISTRY_LITERAL)[number]
+export type RegistryChainName = Extract<RegistryEntryLiteral, { displayName: string }>['displayName']
+
+/** The registry, widened for iteration (optional props accessible on every
+ *  entry). The literal source above keeps the name union type-safe. */
+export const CHAIN_REGISTRY: readonly ChainRegistryEntry[] = CHAIN_REGISTRY_LITERAL
+
+// ─── Derived views ─────────────────────────────────────────────────────────
+// Everything below is COMPUTED from the registry — never hand-edit a chain
+// fact here; edit the entry above.
+
+import type { ChainWithTokens } from '@/interfaces/chain-meta'
+
+/**
+ * Per-chain PostHog rollout flags, keyed by every identifier a chain appears
+ * under (selector id, aliases, deposit display name) so one flag governs all
+ * surfaces of the same chain. See engineering/patterns/feature-gates.md.
+ */
+export const CHAIN_ROLLOUT_FLAGS: Record<string, string> = Object.fromEntries(
+    CHAIN_REGISTRY.filter((c) => c.rolloutFlag).flatMap((c) =>
+        [c.id, ...(c.aliasIds ?? []), ...(c.displayName ? [c.displayName] : [])].map((key) => [key, c.rolloutFlag!])
+    )
+)
+
+/**
+ * Synthetic selector records for non-EVM withdraw destinations (no
+ * chain-details.json entry). The token-selector context merges these so
+ * every selector surface and the price hook resolve them; they stay
+ * invisible outside the withdraw flow (all other network lists are gated by
+ * the wagmi id set, and URL parsing/validation read the server action).
+ */
+export const NON_EVM_WITHDRAW_CHAINS: Record<string, ChainWithTokens> = Object.fromEntries(
+    CHAIN_REGISTRY.filter((c) => c.nonEvmRecord).map((c) => [
+        c.id,
+        {
+            chainId: c.id,
+            networkName: c.nonEvmRecord!.networkName,
+            chainIconURI: c.logoUrl ?? '',
+            tokens: c.nonEvmRecord!.tokens.map((t) => ({
+                chainId: c.id,
+                address: t.address,
+                decimals: t.decimals,
+                name: t.name,
+                symbol: t.symbol,
+                logoURI: t.logoURI,
+                usdPrice: 0,
+            })),
+        },
+    ])
+)
+
+export function isNonEvmWithdrawChainId(chainId: string | number): boolean {
+    return Object.prototype.hasOwnProperty.call(NON_EVM_WITHDRAW_CHAINS, String(chainId).toLowerCase())
+}
diff --git a/src/constants/rhino.consts.ts b/src/constants/rhino.consts.ts
index 018eadf980..44044211f1 100644
--- a/src/constants/rhino.consts.ts
+++ b/src/constants/rhino.consts.ts
@@ -1,20 +1,10 @@
 import type { RhinoChainType } from '@/services/services.types'
+import { CHAIN_REGISTRY, type RegistryChainName } from '@/constants/chainRegistry.consts'
 
-/** Chain name to logo URL mapping - reusable across the app */
-export const CHAIN_LOGOS = {
-    ARBITRUM: 'https://assets.coingecko.com/asset_platforms/images/33/standard/AO_logomark.png?1706606717',
-    ETHEREUM: 'https://assets.coingecko.com/asset_platforms/images/279/standard/ethereum.png?1706606803',
-    BASE: 'https://assets.coingecko.com/asset_platforms/images/131/standard/base.png?1759905869',
-    OPTIMISM: 'https://assets.coingecko.com/asset_platforms/images/41/standard/optimism.png?1706606778',
-    GNOSIS: 'https://assets.coingecko.com/asset_platforms/images/11062/standard/Aatar_green_white.png?1706606458',
-    POLYGON: 'https://assets.coingecko.com/asset_platforms/images/15/standard/polygon_pos.png?1706606645',
-    BNB: 'https://assets.coingecko.com/asset_platforms/images/1/standard/bnb_smart_chain.png?1706606721',
-    KATANA: 'https://assets.coingecko.com/asset_platforms/images/32239/standard/katana.jpg?1751496126',
-    SCROLL: 'https://assets.coingecko.com/asset_platforms/images/153/standard/scroll.jpeg?1706606782',
-    CELO: 'https://assets.coingecko.com/asset_platforms/images/21/standard/celo.jpeg?1711358666',
-    TRON: 'https://assets.coingecko.com/asset_platforms/images/1094/standard/TRON_LOGO.png?1706606652',
-    SOLANA: 'https://assets.coingecko.com/asset_platforms/images/5/standard/solana.png?1706606708',
-} as const
+/** Chain name to logo URL mapping — DERIVED from CHAIN_REGISTRY. */
+export const CHAIN_LOGOS = Object.fromEntries(
+    CHAIN_REGISTRY.filter((c) => c.displayName && c.logoUrl).map((c) => [c.displayName, c.logoUrl])
+) as Record<RegistryChainName, string>
 
 /** Token symbol to logo URL mapping - reusable across the app */
 export const TOKEN_LOGOS = {
@@ -26,22 +16,17 @@ export const TOKEN_LOGOS = {
 export type ChainName = keyof typeof CHAIN_LOGOS
 export type TokenName = keyof typeof TOKEN_LOGOS
 
-// Mirrors Rhino's live SDA config (`depositAddresses.getSupportedConfigs()`).
-// Scroll was removed 2026-06-11: Rhino's live config no longer returns an SDA
-// entry for it, and a deposit on an unsupported chain is silently lost.
-export const SUPPORTED_EVM_CHAINS = [
-    'ARBITRUM',
-    'ETHEREUM',
-    'BASE',
-    'OPTIMISM',
-    'BNB',
-    'POLYGON',
-    'KATANA',
-    'GNOSIS',
-    'CELO',
-] as const
-
-export const OTHER_SUPPORTED_CHAINS = ['SOLANA', 'TRON'] as const
+// DERIVED from CHAIN_REGISTRY: EVM chains with a deposit surface. Mirrors
+// Rhino's live SDA config — a deposit on an unsupported chain is silently
+// lost, so registry entries only get `deposit` after verifying the catalog.
+export const SUPPORTED_EVM_CHAINS = CHAIN_REGISTRY.filter((c) => c.family === 'evm' && c.deposit).map(
+    (c) => c.displayName as RegistryChainName
+)
+
+// DERIVED from CHAIN_REGISTRY: non-EVM deposit chains.
+export const OTHER_SUPPORTED_CHAINS = CHAIN_REGISTRY.filter((c) => c.family !== 'evm' && c.deposit).map(
+    (c) => c.displayName as RegistryChainName
+)
 
 /** Rhino-supported chains with their logos */
 export const RHINO_SUPPORTED_CHAINS = (Object.keys(CHAIN_LOGOS) as ChainName[]).map((name) => ({
@@ -83,6 +68,19 @@ const SUPPORTED_TOKENS_BY_NETWORK: Record<RhinoChainType, TokenName[]> = {
     TRON: ['USDT'],
 }
 
+/**
+ * EVM deposit chains where Rhino accepts FEWER tokens than the EVM family
+ * list above. A token sent on a chain where Rhino doesn't accept it is
+ * silently lost (no webhook, no intent), so deposit surfaces annotate these.
+ * Source: Rhino's live SDA catalog (getSupportedConfigs, 2026-07-11).
+ */
+export const EVM_DEPOSIT_TOKEN_EXCEPTIONS: Partial<Record<ChainName, TokenName[]>> = Object.fromEntries(
+    CHAIN_REGISTRY.filter((c) => c.family === 'evm' && c.deposit?.tokens).map((c) => [
+        c.displayName,
+        [...(c.deposit!.tokens as readonly TokenName[])],
+    ])
+)
+
 /** returns supported tokens (with logos) for a given chain type */
 export const getSupportedTokens = (network: RhinoChainType): Array<{ name: TokenName; logoUrl: string }> =>
     SUPPORTED_TOKENS_BY_NETWORK[network].map((name) => ({ name, logoUrl: TOKEN_LOGOS[name] }))
@@ -105,19 +103,30 @@ export const RHINO_SUPPORTED_TOKENS = (Object.keys(TOKEN_LOGOS) as TokenName[])
 // BNB Chain is `BINANCE` in Rhino's API. Sending the display name (POLYGON/BNB)
 // 400s with `Invalid chain`. Keep this in sync with peanut-api-ts
 // `src/rhino/consts.ts` CHAINS_CONFIG.
-export const EVM_CHAIN_ID_TO_RHINO_NAME: Record<string, string | undefined> = {
-    '1': 'ETHEREUM',
-    '10': 'OPTIMISM',
-    '56': 'BINANCE', // Rhino's name for BNB Chain (display: BNB)
-    '100': 'GNOSIS',
-    '137': 'MATIC_POS', // Rhino's name for Polygon (display: POLYGON)
-    '534352': 'SCROLL',
-    '42161': 'ARBITRUM',
-    '421614': 'ARBITRUM', // Arb Sepolia — same Rhino bucket for sandbox runs
-    '8453': 'BASE',
-    '42220': 'CELO',
-}
+// DERIVED from CHAIN_REGISTRY: every EVM entry with a live Rhino name,
+// including aliases (Arb Sepolia → ARBITRUM for the sandbox harness).
+// Rhino-disabled chains (SCROLL) have no rhinoName and drop out naturally.
+export const EVM_CHAIN_ID_TO_RHINO_NAME: Record<string, string | undefined> = Object.fromEntries(
+    CHAIN_REGISTRY.filter((c) => c.family === 'evm' && c.rhinoName).flatMap((c) =>
+        [c.id, ...(c.aliasIds ?? [])].map((id) => [id, c.rhinoName])
+    )
+)
 
 export function evmChainIdToRhinoName(chainId: string | number): string | undefined {
     return EVM_CHAIN_ID_TO_RHINO_NAME[String(chainId)]
 }
+
+/**
+ * Non-EVM withdraw destinations use string slugs as their selector chainId
+ * ('solana' | 'tron' — the identifiers the old coming-soon entries used).
+ * Chain data lives in `chainRegistry.consts.ts`.
+ */
+export const NON_EVM_CHAIN_ID_TO_RHINO_NAME: Record<string, string | undefined> = Object.fromEntries(
+    CHAIN_REGISTRY.filter((c) => c.family !== 'evm' && c.rhinoName).map((c) => [c.id, c.rhinoName])
+)
+
+/** chainId (EVM numeric or non-EVM slug) → Rhino API chain name. */
+export function chainIdToRhinoName(chainId: string | number): string | undefined {
+    const key = String(chainId)
+    return EVM_CHAIN_ID_TO_RHINO_NAME[key] ?? NON_EVM_CHAIN_ID_TO_RHINO_NAME[key.toLowerCase()]
+}
diff --git a/src/constants/token-details.json b/src/constants/token-details.json
index df10788e90..695d0dae3f 100644
--- a/src/constants/token-details.json
+++ b/src/constants/token-details.json
@@ -2514,6 +2514,13 @@
                 "symbol": "USDC",
                 "decimals": 6,
                 "logoURI": "https://market-data-images.s3.us-east-1.amazonaws.com/tokenImages/0x10ca7e698fab4eb287d4d33b3886ae17a6d078fbda455cdd673cfec0ca8ef413.png"
+            },
+            {
+                "address": "0x779ded0c9e1022225f8e0630b35a9b54be713736",
+                "name": "Tether USD",
+                "symbol": "USDT",
+                "decimals": 6,
+                "logoURI": "https://assets.coingecko.com/coins/images/325/standard/Tether.png?1696501661"
             }
         ]
     },
@@ -2968,5 +2975,125 @@
                 "logoURI": "https://raw.githubusercontent.com/spothq/cryptocurrency-icons/master/svg/color/eth.svg"
             }
         ]
+    },
+    {
+        "chainId": "999",
+        "name": "HyperEVM",
+        "tokens": [
+            {
+                "address": "0xb88339cb7199b77e23db6e890353e22632ba630f",
+                "name": "USD Coin",
+                "symbol": "USDC",
+                "decimals": 6,
+                "logoURI": "https://assets.coingecko.com/coins/images/6319/small/USD_Coin_icon.png"
+            },
+            {
+                "address": "0xb8ce59fc3717ada4c02eadf9682a9e934f625ebb",
+                "name": "Tether USD",
+                "symbol": "USDT",
+                "decimals": 6,
+                "logoURI": "https://assets.coingecko.com/coins/images/325/standard/Tether.png?1696501661"
+            }
+        ]
+    },
+    {
+        "chainId": "57073",
+        "name": "Ink",
+        "tokens": [
+            {
+                "address": "0x0000000000000000000000000000000000000000",
+                "name": "Ether",
+                "symbol": "ETH",
+                "decimals": 18,
+                "logoURI": "https://assets.coingecko.com/coins/images/279/standard/ethereum.png?1696501628"
+            },
+            {
+                "address": "0x2d270e6886d130d724215a266106e6832161eaed",
+                "name": "USD Coin",
+                "symbol": "USDC",
+                "decimals": 6,
+                "logoURI": "https://assets.coingecko.com/coins/images/6319/small/USD_Coin_icon.png"
+            },
+            {
+                "address": "0x0200c29006150606b650577bbe7b6248f58470c1",
+                "name": "Tether USD",
+                "symbol": "USDT",
+                "decimals": 6,
+                "logoURI": "https://assets.coingecko.com/coins/images/325/standard/Tether.png?1696501661"
+            }
+        ]
+    },
+    {
+        "chainId": "747474",
+        "name": "Katana",
+        "tokens": [
+            {
+                "address": "0x0000000000000000000000000000000000000000",
+                "name": "Ether",
+                "symbol": "ETH",
+                "decimals": 18,
+                "logoURI": "https://assets.coingecko.com/coins/images/279/standard/ethereum.png?1696501628"
+            },
+            {
+                "address": "0x203a662b0bd271a6ed5a60edfbd04bfce608fd36",
+                "name": "USD Coin",
+                "symbol": "USDC",
+                "decimals": 6,
+                "logoURI": "https://assets.coingecko.com/coins/images/6319/small/USD_Coin_icon.png"
+            },
+            {
+                "address": "0x2dca96907fde857dd3d816880a0df407eeb2d2f2",
+                "name": "Tether USD",
+                "symbol": "USDT",
+                "decimals": 6,
+                "logoURI": "https://assets.coingecko.com/coins/images/325/standard/Tether.png?1696501661"
+            }
+        ]
+    },
+    {
+        "chainId": "9745",
+        "name": "Plasma",
+        "tokens": [
+            {
+                "address": "0xb8ce59fc3717ada4c02eadf9682a9e934f625ebb",
+                "name": "Tether USD",
+                "symbol": "USDT",
+                "decimals": 6,
+                "logoURI": "https://assets.coingecko.com/coins/images/325/standard/Tether.png?1696501661"
+            }
+        ]
+    },
+    {
+        "chainId": "988",
+        "name": "Stable",
+        "tokens": [
+            {
+                "address": "0x779ded0c9e1022225f8e0630b35a9b54be713736",
+                "name": "Tether USD",
+                "symbol": "USDT",
+                "decimals": 6,
+                "logoURI": "https://assets.coingecko.com/coins/images/325/standard/Tether.png?1696501661"
+            }
+        ]
+    },
+    {
+        "chainId": "4217",
+        "name": "Tempo",
+        "tokens": [
+            {
+                "address": "0x20c000000000000000000000b9537d11c60e8b50",
+                "name": "USD Coin",
+                "symbol": "USDC",
+                "decimals": 6,
+                "logoURI": "https://assets.coingecko.com/coins/images/6319/small/USD_Coin_icon.png"
+            },
+            {
+                "address": "0x20c00000000000000000000014f22ca97301eb73",
+                "name": "Tether USD",
+                "symbol": "USDT",
+                "decimals": 6,
+                "logoURI": "https://assets.coingecko.com/coins/images/325/standard/Tether.png?1696501661"
+            }
+        ]
     }
 ]
diff --git a/src/context/kernelClient.context.tsx b/src/context/kernelClient.context.tsx
index 42fda06ab6..85ad8dcc06 100644
--- a/src/context/kernelClient.context.tsx
+++ b/src/context/kernelClient.context.tsx
@@ -45,6 +45,14 @@ interface KernelClientContextType {
     // `resolvePatchedSudoValidator` for why binding to the migration client's
     // stale v0.0.2 validator wapk-blocks the backend replay.
     getPatchedSudoValidator: (publicClient: PublicClient) => Promise<Awaited<ReturnType<typeof createPasskeyValidator>>>
+    // Drops the cached client for `chainId` and builds a fresh one. Needed when
+    // the account's on-chain validator set changes mid-session (root-validator
+    // migration): the cached migration account keeps SIGNING via the v0.0.2
+    // validator it was built with, so its EIP-1271 signatures are rejected once
+    // the on-chain root flips to v0.0.3. The rebuilt client lands in the
+    // ref-backed cache, so every consumer — including closures captured before
+    // the rebuild — sees it immediately.
+    rebuildClientForChain: (chainId: string) => Promise<GenericSmartAccountClient>
 }
 
 type GenericSmartAccountClient<C extends Chain = Chain> = KernelAccountClient<Transport, C>
@@ -290,6 +298,35 @@ export const KernelClientProvider = ({ children }: { children: ReactNode }) => {
     // primary-init effect register itself so a recover-funds page mount that
     // races primary login doesn't kick off a duplicate Arb build.
     const inFlightRef = useRef<Map<string, Promise<GenericSmartAccountClient>>>(new Map())
+    // Ref mirror of `clientsByChain`. Reads go through the ref so that closures
+    // captured before a cache update (e.g. a spend flow that rebuilds the client
+    // mid-flight after a root-validator migration) resolve to the CURRENT client
+    // instead of a stale one. State stays the source of re-renders; the ref is
+    // the source of truth for lookups. Always write both via storeClient/clearClients.
+    const clientsRef = useRef<Record<string, GenericSmartAccountClient>>({})
+
+    const storeClient = useCallback((chainId: string, client: GenericSmartAccountClient) => {
+        clientsRef.current = { ...clientsRef.current, [chainId]: client }
+        setClientsByChain((prev) => ({ ...prev, [chainId]: client }))
+    }, [])
+
+    // Monotonic build sequence per chain. A build may only store its result if
+    // it is still the LATEST build for that chain — otherwise a slow, stale
+    // build (started pre-logout, or superseded by rebuildClientForChain after
+    // a root-validator migration) would clobber the cache with a client built
+    // against old state: the previous user's account after logout, or a
+    // pre-migration wrapper that signs with the wrong validator.
+    const buildSeqRef = useRef(0)
+    const latestBuildSeqRef = useRef<Map<string, number>>(new Map())
+
+    const clearClients = useCallback(() => {
+        clientsRef.current = {}
+        setClientsByChain({})
+        // Orphan every in-flight build: none is "latest" anymore, so their
+        // .then(storeClient) becomes a no-op instead of resurrecting the
+        // logged-out user's client into the freshly cleared cache.
+        latestBuildSeqRef.current.clear()
+    }, [])
 
     const isAfterZeroDevMigration = useMemo<boolean>(() => {
         if (!user?.user?.createdAt) {
@@ -304,7 +341,7 @@ export const KernelClientProvider = ({ children }: { children: ReactNode }) => {
             // clear webauthn key and clients when user logs out
             console.log('[KernelClient] No user found, clearing webAuthnKey, clients, and address')
             setWebAuthnKey(undefined)
-            setClientsByChain({})
+            clearClients()
             // Drop any in-flight lazy builds — their results would be useless
             // (and re-applying them would write into a fresh post-logout state).
             inFlightRef.current.clear()
@@ -342,7 +379,7 @@ export const KernelClientProvider = ({ children }: { children: ReactNode }) => {
             // avoid mixed state
             logoutUser()
         }
-    }, [user?.user.userId, logoutUser])
+    }, [user?.user.userId, logoutUser, clearClients])
 
     useEffect(() => {
         if (user?.user.userId && !!webAuthnKey) {
@@ -383,7 +420,8 @@ export const KernelClientProvider = ({ children }: { children: ReactNode }) => {
                 console.error('[harness] primary ECDSA kernel client failed')
                 return
             }
-            setClientsByChain(clients)
+            clientsRef.current = { ...clientsRef.current, ...clients }
+            setClientsByChain((prev) => ({ ...prev, ...clients }))
             dispatch(zerodevActions.setIsKernelClientReady(true))
             dispatch(zerodevActions.setIsRegistering(false))
             dispatch(zerodevActions.setIsLoggingIn(false))
@@ -460,7 +498,7 @@ export const KernelClientProvider = ({ children }: { children: ReactNode }) => {
             // Only update state after primary succeeds — avoids
             // registering→not→registering UI flicker between retries.
             if (isMounted) {
-                setClientsByChain((prev) => ({ ...prev, [primaryChainId]: kernelClient }))
+                storeClient(primaryChainId, kernelClient)
                 fetchUser()
                 dispatch(zerodevActions.setIsKernelClientReady(true))
                 dispatch(zerodevActions.setIsRegistering(false))
@@ -539,7 +577,9 @@ export const KernelClientProvider = ({ children }: { children: ReactNode }) => {
 
     const getClientForChain = useCallback(
         (chainId: string) => {
-            const client = clientsByChain[chainId]
+            // Read through the ref so closures captured before a mid-session
+            // rebuild (root-validator migration) still resolve the fresh client.
+            const client = clientsRef.current[chainId] ?? clientsByChain[chainId]
             if (!client) {
                 const availableChains = Object.keys(clientsByChain).join(', ')
                 console.error(
@@ -554,14 +594,12 @@ export const KernelClientProvider = ({ children }: { children: ReactNode }) => {
         [clientsByChain, assertClientOwnedByUser]
     )
 
-    const ensureClientForChain = useCallback(
-        async (chainId: string): Promise<GenericSmartAccountClient> => {
-            const cached = clientsByChain[chainId]
-            if (cached) return assertClientOwnedByUser(cached)
-
-            const inFlight = inFlightRef.current.get(chainId)
-            if (inFlight) return inFlight.then(assertClientOwnedByUser)
-
+    // Kicks off a fresh client build for `chainId`, stores the result in the
+    // ref-backed cache, and registers itself in inFlightRef for dedupe. Shared
+    // by ensureClientForChain (cache-first) and rebuildClientForChain (cache-
+    // busting).
+    const startClientBuild = useCallback(
+        (chainId: string): Promise<GenericSmartAccountClient> => {
             if (!webAuthnKey) {
                 throw new Error(`Cannot build kernel client for chain ${chainId}: not authenticated`)
             }
@@ -572,6 +610,8 @@ export const KernelClientProvider = ({ children }: { children: ReactNode }) => {
                 )
             }
 
+            const seq = ++buildSeqRef.current
+            latestBuildSeqRef.current.set(chainId, seq)
             const promise = createKernelClientForChain(
                 entry.client,
                 entry.chain,
@@ -585,7 +625,12 @@ export const KernelClientProvider = ({ children }: { children: ReactNode }) => {
                 { bundlerUrl: entry.bundlerUrl, paymasterUrl: entry.paymasterUrl }
             )
                 .then((kernelClient) => {
-                    setClientsByChain((prev) => ({ ...prev, [chainId]: kernelClient }))
+                    // Superseded (logout cleared the map, or a newer build /
+                    // rebuild started): return the client to OUR caller but do
+                    // not store it — the cache belongs to the latest build.
+                    if (latestBuildSeqRef.current.get(chainId) === seq) {
+                        storeClient(chainId, kernelClient)
+                    }
                     return assertClientOwnedByUser(kernelClient)
                 })
                 .catch((error) => {
@@ -598,13 +643,43 @@ export const KernelClientProvider = ({ children }: { children: ReactNode }) => {
                     throw error
                 })
                 .finally(() => {
-                    inFlightRef.current.delete(chainId)
+                    // Only clear the dedupe slot if it is still OURS — a newer
+                    // build may have replaced it, and deleting that entry would
+                    // silently break dedupe for its concurrent awaiters.
+                    if (inFlightRef.current.get(chainId) === promise) {
+                        inFlightRef.current.delete(chainId)
+                    }
                 })
 
             inFlightRef.current.set(chainId, promise)
             return promise
         },
-        [clientsByChain, webAuthnKey, isAfterZeroDevMigration, user, assertClientOwnedByUser, logoutUser]
+        [webAuthnKey, isAfterZeroDevMigration, user, assertClientOwnedByUser, logoutUser, storeClient]
+    )
+
+    const ensureClientForChain = useCallback(
+        async (chainId: string): Promise<GenericSmartAccountClient> => {
+            const cached = clientsRef.current[chainId] ?? clientsByChain[chainId]
+            if (cached) return assertClientOwnedByUser(cached)
+
+            const inFlight = inFlightRef.current.get(chainId)
+            if (inFlight) return inFlight.then(assertClientOwnedByUser)
+
+            return startClientBuild(chainId)
+        },
+        [clientsByChain, assertClientOwnedByUser, startClientBuild]
+    )
+
+    const rebuildClientForChain = useCallback(
+        async (chainId: string): Promise<GenericSmartAccountClient> => {
+            // Deliberately ignores cache AND any in-flight build: those were
+            // constructed against the pre-migration on-chain state. storeClient
+            // in startClientBuild overwrites the stale cache entry for every
+            // future getClientForChain reader (including stale closures — they
+            // read through clientsRef).
+            return startClientBuild(chainId)
+        },
+        [startClientBuild]
     )
 
     return (
@@ -614,6 +689,7 @@ export const KernelClientProvider = ({ children }: { children: ReactNode }) => {
                 getClientForChain,
                 ensureClientForChain,
                 getPatchedSudoValidator,
+                rebuildClientForChain,
             }}
         >
             {children}
diff --git a/src/context/tokenSelector.context.tsx b/src/context/tokenSelector.context.tsx
index 37760162a8..c027f0eaa9 100644
--- a/src/context/tokenSelector.context.tsx
+++ b/src/context/tokenSelector.context.tsx
@@ -1,5 +1,5 @@
 'use client'
-import React, { createContext, useState, useCallback, useEffect } from 'react'
+import React, { createContext, useState, useCallback, useEffect, useMemo } from 'react'
 
 import {
     PEANUT_WALLET_CHAIN,
@@ -11,6 +11,7 @@ import {
 } from '@/constants/zerodev.consts'
 import { useWallet } from '@/hooks/wallet/useWallet'
 import { useSupportedChainsAndTokens } from '@/hooks/useSupportedChainsAndTokens'
+import { NON_EVM_WITHDRAW_CHAINS } from '@/constants/chainRegistry.consts'
 import { useTokenPrice } from '@/hooks/useTokenPrice'
 import { type ITokenPriceData } from '@/interfaces'
 import { NATIVE_TOKEN_ADDRESS } from '@/utils/token.utils'
@@ -73,7 +74,19 @@ export const TokenContextProvider = ({ children }: { children: React.ReactNode }
     const [devconnectRecipientAddress, setDevconnectRecipientAddress] = useState<string>('')
 
     // Fetch supported chains and tokens (cached for 24 hours - static data)
-    const { data: supportedChainsAndTokens = {} } = useSupportedChainsAndTokens()
+    const { data: fetchedChainsAndTokens = {} } = useSupportedChainsAndTokens()
+
+    // Merge the synthetic non-EVM withdraw destinations (Solana/Tron) here —
+    // the ONE record every selector surface AND the price hook read, so
+    // selectedTokenData resolves for them (stablecoin $1 branch) and no
+    // consumer needs its own merge/fallback. They stay invisible outside the
+    // withdraw flow: every network list is gated by allowedChainIds (the
+    // wagmi id set everywhere except withdraw), and URL parsing/validation
+    // read the server action, not this context.
+    const supportedChainsAndTokens = useMemo(
+        () => ({ ...fetchedChainsAndTokens, ...NON_EVM_WITHDRAW_CHAINS }),
+        [fetchedChainsAndTokens]
+    )
 
     // Fetch token price using TanStack Query (replaces manual useEffect + state)
     const {
diff --git a/src/features/payments/shared/hooks/useCrossChainTransfer.ts b/src/features/payments/shared/hooks/useCrossChainTransfer.ts
index 906c5f2e37..e142eefc07 100644
--- a/src/features/payments/shared/hooks/useCrossChainTransfer.ts
+++ b/src/features/payments/shared/hooks/useCrossChainTransfer.ts
@@ -44,7 +44,8 @@ import {
     type BridgeCommitResponse,
     type BridgeStatusResponse,
 } from '@/services/rhino-bridge'
-import { evmChainIdToRhinoName } from '@/constants/rhino.consts'
+import { chainIdToRhinoName } from '@/constants/rhino.consts'
+import { NON_EVM_WITHDRAW_CHAINS } from '@/constants/chainRegistry.consts'
 import { areEvmAddressesEqual, getTokenSymbol } from '@/utils/general.utils'
 
 /** Tokens Rhino's SDA primitive accepts as `tokenOut`. Anything else routes
@@ -80,8 +81,13 @@ export interface CrossChainSourceInfo {
 }
 
 export interface CrossChainDestinationInfo {
-    recipientAddress: Address
-    tokenAddress: Address
+    /** 0x for EVM destinations, base58 for Solana/Tron. Only forwarded to the
+     *  backend/Rhino — cross-chain tx construction never uses it (the user's
+     *  tx is an ERC20 transfer to the SDA on Arbitrum). The same-chain path
+     *  narrows it back to an EVM Address (non-EVM can never be same-chain). */
+    recipientAddress: string
+    /** 0x for EVM tokens, base58 mint / TRC20 for non-EVM destinations. */
+    tokenAddress: string
     tokenAmount: string
     tokenDecimals: number
     tokenType: number
@@ -148,13 +154,19 @@ interface CalculateInput {
     skipGasEstimate?: boolean
 }
 
-function inferTokenSymbol(chainId: string, tokenAddress: Address): RhinoSupportedToken | undefined {
+function inferTokenSymbol(chainId: string, tokenAddress: string): RhinoSupportedToken | undefined {
+    // Non-EVM destinations resolve from their synthetic chain records —
+    // token-details.json only knows EVM chains.
+    const nonEvm = NON_EVM_WITHDRAW_CHAINS[String(chainId).toLowerCase()]
+    if (nonEvm) {
+        return nonEvm.tokens.find((t) => t.address.toLowerCase() === tokenAddress.toLowerCase())?.symbol.toUpperCase()
+    }
     // Whatever the curated FE list calls the token (USDC, USDT, ETH, WETH, …);
     // backend forwards it to Rhino, which validates against its own per-route
     // supported-tokens map. Native ETH on EVM uses the SAME 'ETH' symbol —
     // address differs by chain (proxy 0xeee… or zero), but Rhino keys on the
     // symbol.
-    return getTokenSymbol(tokenAddress, chainId)?.toUpperCase()
+    return getTokenSymbol(tokenAddress as Address, chainId)?.toUpperCase()
 }
 
 export function useCrossChainTransfer(): UseCrossChainTransferReturn {
@@ -261,8 +273,8 @@ export function useCrossChainTransfer(): UseCrossChainTransferReturn {
                     return
                 }
 
-                const sourceRhinoChain = evmChainIdToRhinoName(source.chainId)
-                const destRhinoChain = evmChainIdToRhinoName(destination.chainId)
+                const sourceRhinoChain = chainIdToRhinoName(source.chainId)
+                const destRhinoChain = chainIdToRhinoName(destination.chainId)
                 if (!sourceRhinoChain || !destRhinoChain) {
                     throw new Error(
                         `Unsupported Rhino chain mapping (src=${source.chainId} dest=${destination.chainId})`
@@ -524,8 +536,10 @@ async function buildSameChainTx({
     skipGasEstimate,
 }: SameChainParams): Promise<void> {
     const tx = prepareRequestLinkFulfillmentTransaction({
-        recipientAddress: destination.recipientAddress,
-        tokenAddress: destination.tokenAddress,
+        // same-chain is EVM-only by construction (source is the Arbitrum
+        // Peanut wallet; non-EVM destinations are always cross-chain)
+        recipientAddress: destination.recipientAddress as Address,
+        tokenAddress: destination.tokenAddress as Address,
         tokenAmount: destination.tokenAmount,
         tokenDecimals: destination.tokenDecimals,
         tokenType: destination.tokenType as peanutInterfaces.EPeanutLinkType,
diff --git a/src/hooks/__tests__/useChainRollout.test.tsx b/src/hooks/__tests__/useChainRollout.test.tsx
new file mode 100644
index 0000000000..27dc1d5d77
--- /dev/null
+++ b/src/hooks/__tests__/useChainRollout.test.tsx
@@ -0,0 +1,59 @@
+import { renderHook, act } from '@testing-library/react'
+
+// posthog-js is mocked so tests control flag values and load events
+let mockFlagsCallback: (() => void) | undefined
+const mockIsFeatureEnabled = jest.fn()
+jest.mock('posthog-js', () => ({
+    __esModule: true,
+    default: {
+        isFeatureEnabled: (key: string) => mockIsFeatureEnabled(key),
+        onFeatureFlags: (cb: () => void) => {
+            mockFlagsCallback = cb
+            return () => {
+                mockFlagsCallback = undefined
+            }
+        },
+    },
+}))
+// Force prod-domain semantics so the nonProdBypass doesn't short-circuit
+jest.mock('@/constants/general.consts', () => ({
+    ...jest.requireActual('@/constants/general.consts'),
+    BASE_URL: 'https://peanut.me',
+}))
+
+import { useChainRollout } from '../useChainRollout'
+import { useFeatureFlags } from '../useFeatureFlag'
+
+describe('useFeatureFlags', () => {
+    it('returns a NEW checker identity when PostHog flags load (memo-busting)', () => {
+        const { result } = renderHook(() => useFeatureFlags())
+        const before = result.current
+        act(() => mockFlagsCallback?.())
+        expect(result.current).not.toBe(before) // regression: frozen-at-mount gate
+    })
+})
+
+describe('useChainRollout', () => {
+    beforeEach(() => mockIsFeatureEnabled.mockReset())
+
+    it('always allows unflagged (legacy) chains', () => {
+        const { result } = renderHook(() => useChainRollout())
+        expect(result.current('42161')).toBe(true)
+        expect(mockIsFeatureEnabled).not.toHaveBeenCalled()
+    })
+
+    it('fails CLOSED on prod when PostHog has no answer', () => {
+        mockIsFeatureEnabled.mockReturnValue(undefined)
+        const { result } = renderHook(() => useChainRollout())
+        expect(result.current('solana')).toBe(false)
+    })
+
+    it('reflects flag values once loaded, keyed per chain', () => {
+        mockIsFeatureEnabled.mockImplementation((key: string) => key === 'chain-rollout-tempo')
+        const { result } = renderHook(() => useChainRollout())
+        act(() => mockFlagsCallback?.())
+        expect(result.current('4217')).toBe(true) // tempo by chainId
+        expect(result.current('TEMPO')).toBe(true) // tempo by deposit ChainName — same flag
+        expect(result.current('solana')).toBe(false)
+    })
+})
diff --git a/src/hooks/useChainRollout.ts b/src/hooks/useChainRollout.ts
new file mode 100644
index 0000000000..c2add3226b
--- /dev/null
+++ b/src/hooks/useChainRollout.ts
@@ -0,0 +1,22 @@
+'use client'
+import { useMemo } from 'react'
+import { useFeatureFlags } from '@/hooks/useFeatureFlag'
+import { CHAIN_ROLLOUT_FLAGS } from '@/constants/chainRegistry.consts'
+
+/**
+ * Reactive per-chain rollout gate — thin domain wrapper over
+ * `useFeatureFlags` (see `chainRollout.consts.ts` for the chain→flag map and
+ * `featureFlag.utils.ts` for the doctrine). Returns a fresh checker identity
+ * when PostHog's flags load so memoized chain lists recompute.
+ */
+export function useChainRollout(): (chainKey: string) => boolean {
+    const isFlagEnabled = useFeatureFlags()
+    return useMemo(
+        () => (chainKey: string) => {
+            const flag = CHAIN_ROLLOUT_FLAGS[chainKey]
+            if (!flag) return true
+            return isFlagEnabled(flag, { nonProdBypass: true })
+        },
+        [isFlagEnabled]
+    )
+}
diff --git a/src/hooks/useFeatureFlag.ts b/src/hooks/useFeatureFlag.ts
new file mode 100644
index 0000000000..2a448ba677
--- /dev/null
+++ b/src/hooks/useFeatureFlag.ts
@@ -0,0 +1,25 @@
+'use client'
+import { useEffect, useMemo, useReducer } from 'react'
+import posthog from 'posthog-js'
+import { isFeatureFlagEnabled, type FeatureFlagOptions } from '@/utils/featureFlag.utils'
+
+/**
+ * Reactive read of PostHog feature flags. PostHog delivers flags async after
+ * page load; this hook returns a NEW checker function identity on every
+ * flag-load event, so downstream useMemo/useCallback that depend on the
+ * checker recompute (a stable identity silently froze gated UI at
+ * mount-time values — the 2026-07 chain-rollout review finding).
+ */
+export function useFeatureFlags(): (flagKey: string, options?: FeatureFlagOptions) => boolean {
+    const [version, bump] = useReducer((n: number) => n + 1, 0)
+    useEffect(() => {
+        // returns an unsubscribe function
+        return posthog.onFeatureFlags(() => bump())
+    }, [])
+    return useMemo(
+        () => (flagKey: string, options?: FeatureFlagOptions) => isFeatureFlagEnabled(flagKey, options),
+        // eslint-disable-next-line react-hooks/exhaustive-deps -- `version` IS the
+        // reactivity trigger: a new checker identity per flag-load event.
+        [version]
+    )
+}
diff --git a/src/hooks/useZeroDev.ts b/src/hooks/useZeroDev.ts
index 54ab3ca606..1789e834fd 100644
--- a/src/hooks/useZeroDev.ts
+++ b/src/hooks/useZeroDev.ts
@@ -231,6 +231,10 @@ export const useZeroDev = () => {
             } catch (error) {
                 console.error('Error waiting for UserOp receipt:', error)
                 captureException(error)
+                // Reset the loading banner too — callers that treat a null
+                // receipt as a failure (migration gate) would otherwise leave
+                // the UI stuck on 'Executing transaction'.
+                setLoadingState('Idle')
                 dispatch(zerodevActions.setIsSendingUserOp(false))
                 return {
                     userOpHash,
diff --git a/src/hooks/wallet/__tests__/useSpendBundle.test.ts b/src/hooks/wallet/__tests__/spendPreflight.test.ts
similarity index 52%
rename from src/hooks/wallet/__tests__/useSpendBundle.test.ts
rename to src/hooks/wallet/__tests__/spendPreflight.test.ts
index bce0e4ab6b..15076cd281 100644
--- a/src/hooks/wallet/__tests__/useSpendBundle.test.ts
+++ b/src/hooks/wallet/__tests__/spendPreflight.test.ts
@@ -1,7 +1,8 @@
 /**
- * Pure-function tests for the spend-routing primitives in `useSpendBundle`.
+ * Pure-function tests for the spend-routing primitives in `spendPreflight`
+ * (shared by useSpendBundle and useSignSpendBundle).
  *
- * The hook itself orchestrates kernel clients, Rain API calls, and the
+ * The hooks orchestrate kernel clients, Rain API calls, and the
  * session-key grant flow — those paths are covered by integration + manual
  * testing on sandbox. These tests lock down the deterministic pieces:
  *   - `computeSpendStrategy` routing (smart → collateral → mixed → insufficient)
@@ -40,7 +41,7 @@ jest.mock('@/constants/rain.consts', () => ({
     RAIN_WITHDRAW_EIP712_DOMAIN_VERSION: '2',
 }))
 
-import { computeSpendStrategy, fetchLiveSmartUsdcBalance } from '../useSpendBundle'
+import { computeSpendStrategy, fetchLiveSmartUsdcBalance } from '../spendPreflight'
 
 describe('computeSpendStrategy', () => {
     const amount = 1000n
@@ -147,3 +148,126 @@ describe('fetchLiveSmartUsdcBalance', () => {
         )
     })
 })
+
+// ── shared collateral pre-flight orchestration ──────────────────────────────
+// The one ordered sequence both spend engines run before signing anything:
+// migration gate → grant gate. Drift between the engines here is exactly how
+// the migration-ordering bug shipped twice.
+
+import { runCollateralSpendPreflight, SessionKeyGrantRequiredError } from '../spendPreflight'
+
+const CARD_OVERVIEW = (hasWithdrawApproval: boolean) =>
+    ({ cards: [{ status: 'ACTIVE', hasWithdrawApproval }] }) as never
+
+const preflightHarness = (opts: { account: unknown; overview?: unknown; grantOk?: boolean; migrated?: boolean }) => {
+    const rebuilt = { account: { address: '0xrebuilt' } }
+    const sendNoopUserOp = jest.fn(async () => ({ receipt: { status: 'success' } as never }))
+    const rebuildClient = jest.fn(async () => rebuilt)
+    const grant = jest.fn(async () =>
+        opts.grantOk === false
+            ? { ok: false as const, error: { kind: 'user-cancelled' as const } }
+            : { ok: true as const }
+    )
+    const overlayStates: boolean[] = []
+    return {
+        args: {
+            kind: 'CRYPTO_WITHDRAW',
+            kernelClient: { account: opts.account },
+            overview: (opts.overview ?? CARD_OVERVIEW(true)) as never,
+            requireOverview: false,
+            grant,
+            sendNoopUserOp,
+            rebuildClient,
+            setSecurityOverlay: (open: boolean) => overlayStates.push(open),
+            migrationTrigger: 'mixed-spend' as const,
+        },
+        sendNoopUserOp,
+        rebuildClient,
+        rebuilt,
+        grant,
+        overlayStates,
+    }
+}
+
+const unmigratedWrapper = () => {
+    // flips to migrated once the (mocked) migration op lands — mirrors chain state
+    let calls = 0
+    return {
+        address: '0x70f22a4db066aed9bcd2157a7b19e2e28c10c483',
+        getRootValidatorMigrationStatus: jest.fn(async () => ++calls > 1),
+    }
+}
+
+describe('runCollateralSpendPreflight', () => {
+    it('smart-only: no migration, no grant, same client back', async () => {
+        const h = preflightHarness({ account: unmigratedWrapper(), overview: CARD_OVERVIEW(false) })
+        const result = await runCollateralSpendPreflight({ ...h.args, strategy: 'smart-only' })
+        expect(result).toBe(h.args.kernelClient)
+        expect(h.sendNoopUserOp).not.toHaveBeenCalled()
+        expect(h.grant).not.toHaveBeenCalled()
+    })
+
+    it('mixed + unmigrated wrapper: migrates under the overlay, returns rebuilt client, then grant-checks', async () => {
+        const h = preflightHarness({ account: unmigratedWrapper(), overview: CARD_OVERVIEW(false) })
+        const result = await runCollateralSpendPreflight({ ...h.args, strategy: 'mixed' })
+        expect(h.sendNoopUserOp).toHaveBeenCalledTimes(1)
+        expect(h.rebuildClient).toHaveBeenCalledTimes(1)
+        expect(result).toBe(h.rebuilt)
+        expect(h.overlayStates).toEqual([true, false]) // overlay opened then always closed
+        expect(h.grant).toHaveBeenCalledTimes(1) // approval missing → inline grant
+    })
+
+    it('mixed + plain (patched) account: zero migration behavior', async () => {
+        const h = preflightHarness({ account: { address: '0xplain' } })
+        const result = await runCollateralSpendPreflight({ ...h.args, strategy: 'mixed' })
+        expect(result).toBe(h.args.kernelClient)
+        expect(h.sendNoopUserOp).not.toHaveBeenCalled()
+        expect(h.rebuildClient).not.toHaveBeenCalled()
+        expect(h.overlayStates).toEqual([])
+    })
+
+    it('collateral-only: never migrates (pre-migration state still verifies the sig)', async () => {
+        const h = preflightHarness({ account: unmigratedWrapper() })
+        const result = await runCollateralSpendPreflight({ ...h.args, strategy: 'collateral-only' })
+        expect(result).toBe(h.args.kernelClient)
+        expect(h.sendNoopUserOp).not.toHaveBeenCalled()
+    })
+
+    it('skips the grant when the approval already exists', async () => {
+        const h = preflightHarness({ account: { address: '0xplain' }, overview: CARD_OVERVIEW(true) })
+        await runCollateralSpendPreflight({ ...h.args, strategy: 'collateral-only' })
+        expect(h.grant).not.toHaveBeenCalled()
+    })
+
+    it('throws SessionKeyGrantRequiredError when the inline grant fails', async () => {
+        const h = preflightHarness({ account: { address: '0xplain' }, overview: CARD_OVERVIEW(false), grantOk: false })
+        await expect(runCollateralSpendPreflight({ ...h.args, strategy: 'collateral-only' })).rejects.toThrow(
+            SessionKeyGrantRequiredError
+        )
+    })
+
+    it('requireOverview: fails closed when the overview has not loaded (sign-only engine)', async () => {
+        const h = preflightHarness({ account: { address: '0xplain' }, overview: undefined })
+        await expect(
+            runCollateralSpendPreflight({
+                ...h.args,
+                overview: undefined as never,
+                requireOverview: true,
+                strategy: 'collateral-only',
+            })
+        ).rejects.toThrow(SessionKeyGrantRequiredError)
+        expect(h.grant).not.toHaveBeenCalled()
+    })
+
+    it('broadcasting engine proceeds without overview (no card visible → nothing to grant)', async () => {
+        const h = preflightHarness({ account: { address: '0xplain' }, overview: undefined })
+        const result = await runCollateralSpendPreflight({
+            ...h.args,
+            overview: undefined as never,
+            requireOverview: false,
+            strategy: 'collateral-only',
+        })
+        expect(result).toBe(h.args.kernelClient)
+        expect(h.grant).not.toHaveBeenCalled()
+    })
+})
diff --git a/src/hooks/wallet/spendPreflight.ts b/src/hooks/wallet/spendPreflight.ts
new file mode 100644
index 0000000000..6c60bae723
--- /dev/null
+++ b/src/hooks/wallet/spendPreflight.ts
@@ -0,0 +1,233 @@
+import type { QueryClient } from '@tanstack/react-query'
+import type { Address, TransactionReceipt } from 'viem'
+import posthog from 'posthog-js'
+import { ANALYTICS_EVENTS } from '@/constants/analytics.consts'
+import { RAIN_CARD_OVERVIEW_QUERY_KEY } from '@/hooks/useRainCardOverview'
+import { findActiveCard } from '@/components/Card/cardState.utils'
+import type { GrantSessionKeyError } from './useGrantSessionKey'
+import { smartUsdcBalanceQueryOptions } from './useBalance'
+import {
+    buildMigrationNoopCall,
+    ensureRootValidatorMigrated,
+    isMigrationWrapperAccount,
+} from '@/utils/kernelMigration.utils'
+
+/**
+ * Shared spend-preflight for BOTH spend engines — `useSpendBundle` (sign +
+ * broadcast) and `useSignSpendBundle` (sign only, backend broadcasts).
+ *
+ * Everything that must never drift between the two engines lives here, in one
+ * ordered sequence: live-balance routing → insufficient rejection → root-
+ * validator migration gate → session-key grant gate. The engines differ only
+ * in how they EXECUTE the chosen strategy; they must not differ in how they
+ * decide and prepare it. (This module exists because the migration-ordering
+ * bug had to be fixed twice — once per engine.)
+ */
+
+export type SpendStrategy = 'collateral-only' | 'smart-only' | 'mixed' | 'insufficient'
+
+export class InsufficientSpendableError extends Error {
+    constructor() {
+        super('Insufficient spendable balance')
+        this.name = 'InsufficientSpendableError'
+    }
+}
+
+/**
+ * Thrown when the user is about to spend from Rain collateral but hasn't
+ * granted the session-key permission yet, and the inline grant either failed
+ * or the user cancelled the passkey. Caller can surface a friendlier UI.
+ */
+export class SessionKeyGrantRequiredError extends Error {
+    constructor(public readonly cause: GrantSessionKeyError) {
+        super(`Session-key grant required: ${cause.kind}`)
+        this.name = 'SessionKeyGrantRequiredError'
+    }
+}
+
+/**
+ * Live smart-account USDC balance for ROUTING, read through the SAME TanStack
+ * query that backs the displayed balance (`smartUsdcBalanceQueryOptions`) — one
+ * source of truth, one `readContract`. `staleTime: 0` forces a fresh on-chain
+ * read AND writes the result into `['balance', address]`, so the displayed
+ * balance refreshes in the same call.
+ *
+ * Routing MUST use this rather than the 30s-cached `useBalance` value: card
+ * funds are swept smart→collateral, so a stale (pre-sweep) balance routes
+ * `smart-only` to an account that's already empty and the transfer reverts
+ * on-chain ("ERC20: transfer amount exceeds balance" — incident #2230).
+ */
+export async function fetchLiveSmartUsdcBalance(queryClient: QueryClient, address: Address): Promise<bigint> {
+    return queryClient.fetchQuery({ ...smartUsdcBalanceQueryOptions(address), staleTime: 0 })
+}
+
+/**
+ * Pure routing helper — decides which bucket(s) a spend will pull from.
+ * Priority: smart → collateral → mixed. The smart account is spent first
+ * whenever it can cover the whole amount, so a payment never touches the
+ * Rain collateral — and Rain's per-account withdrawal-signature cooldown —
+ * if the user's smart-account USDC already covers it. Collateral is the
+ * fallback (single recipient AND no subsequent kernel calls, since Rain's
+ * coordinator transfers tokens directly with nothing following), and `mixed`
+ * tops up the shortfall from collateral when smart alone can't cover it.
+ */
+export function computeSpendStrategy(input: {
+    smart: bigint
+    rain: bigint
+    amount: bigint
+    collateralOnlyAllowed: boolean
+}): SpendStrategy {
+    if (input.smart >= input.amount) return 'smart-only'
+    if (input.collateralOnlyAllowed && input.rain >= input.amount) return 'collateral-only'
+    if (input.smart + input.rain >= input.amount) return 'mixed'
+    return 'insufficient'
+}
+
+export interface ResolveSpendStrategyArgs {
+    queryClient: QueryClient
+    /** The exact account that will send the UserOp — routing reads ITS live balance. */
+    accountAddress: Address
+    requiredUsdcAmount: bigint
+    rainSpendingPower: bigint
+    collateralOnlyAllowed: boolean
+    /** Analytics tag distinguishing the sign-only engine; omit for the broadcasting engine. */
+    flow?: 'sign-only'
+}
+
+/**
+ * Routes the spend on the LIVE on-chain balance and rejects unaffordable
+ * spends. On `insufficient` (passed the FE display gate but the live balance
+ * can't cover it yet — in-transit collateral not landed / ~30s-stale FE):
+ * captures the failure, refreshes the Rain overview so the displayed balance
+ * + a retry reflect reality, and throws `InsufficientSpendableError`.
+ */
+export async function resolveSpendStrategy(
+    args: ResolveSpendStrategyArgs
+): Promise<{ strategy: Exclude<SpendStrategy, 'insufficient'>; smartBalance: bigint }> {
+    const { queryClient, accountAddress, requiredUsdcAmount, rainSpendingPower, collateralOnlyAllowed, flow } = args
+
+    const smartBalance = await fetchLiveSmartUsdcBalance(queryClient, accountAddress)
+    const strategy = computeSpendStrategy({
+        smart: smartBalance,
+        rain: rainSpendingPower,
+        amount: requiredUsdcAmount,
+        collateralOnlyAllowed,
+    })
+    if (strategy === 'insufficient') {
+        posthog.capture(ANALYTICS_EVENTS.CARD_WITHDRAW_FAILED, {
+            strategy: 'insufficient',
+            error_kind: 'insufficient',
+            ...(flow ? { flow } : {}),
+        })
+        queryClient.invalidateQueries({ queryKey: [RAIN_CARD_OVERVIEW_QUERY_KEY] })
+        throw new InsufficientSpendableError()
+    }
+    return { strategy, smartBalance }
+}
+
+export interface CollateralSpendPreflightArgs<TClient extends { account?: unknown }> {
+    strategy: Exclude<SpendStrategy, 'insufficient'>
+    kind: string
+    kernelClient: TClient
+    overview: Parameters<typeof findActiveCard>[0]
+    /** Sign-only engine must fail closed when the overview hasn't loaded — it
+     *  can't tell whether the grant was already given, and signing
+     *  optimistically would crash on the backend submission. The broadcasting
+     *  engine proceeds (no card visible → nothing to grant). */
+    requireOverview: boolean
+    grant: () => Promise<{ ok: true } | { ok: false; error: GrantSessionKeyError }>
+    /** Fires right before the one-time session-key grant prompt appears. */
+    onGrantRequired?: () => void
+    /** Sends the migration no-op userOp through the CURRENT (wrapper) client. */
+    sendNoopUserOp: (call: ReturnType<typeof buildMigrationNoopCall>) => Promise<{ receipt: TransactionReceipt | null }>
+    /** Rebuilds the kernel client so post-migration signatures route to v0.0.3. */
+    rebuildClient: () => Promise<TClient>
+    /** Security-verification overlay toggle (optional — UI polish, not correctness). */
+    setSecurityOverlay?: (open: boolean) => void
+    migrationTrigger: 'mixed-spend' | 'sign-spend'
+}
+
+/**
+ * The collateral pre-flights, in the ONE correct order:
+ *
+ * 1. Root-validator migration (pre-2025-09-18 accounts only). The mixed path
+ *    pre-signs the Rain admin EIP-712, but an unmigrated account's userOp is
+ *    auto-wrapped in a migration that swaps the root validator BEFORE
+ *    `withdrawAsset` verifies that sig via ERC-1271 — so the op always
+ *    reverts ("Delegatecall failed"). Migrate first as a standalone userOp,
+ *    then rebuild the client so the sig is signed AND verified under v0.0.3.
+ *    `collateral-only` is exempt on purpose: its withdrawal is submitted
+ *    against the CURRENT (pre-migration) on-chain state, where the old
+ *    validator still verifies — no reason to add a passkey tap there.
+ * 2. One-time session-key grant. If missing, run the inline grant flow now
+ *    (one extra passkey tap the FIRST time, zero after).
+ *
+ * Returns the client every subsequent signature MUST come from (rebuilt when
+ * a migration ran; the caller's original client otherwise).
+ */
+export async function runCollateralSpendPreflight<TClient extends { account?: unknown }>(
+    args: CollateralSpendPreflightArgs<TClient>
+): Promise<TClient> {
+    const {
+        strategy,
+        kind,
+        kernelClient,
+        overview,
+        requireOverview,
+        grant,
+        onGrantRequired,
+        sendNoopUserOp,
+        rebuildClient,
+        setSecurityOverlay,
+        migrationTrigger,
+    } = args
+
+    const touchesCollateral = strategy === 'collateral-only' || strategy === 'mixed'
+
+    // Cheap validation FIRST: never charge the user a migration passkey tap
+    // for a flow that is already doomed by a missing overview.
+    if (touchesCollateral && requireOverview && !overview) {
+        throw new SessionKeyGrantRequiredError({ kind: 'unexpected' } as GrantSessionKeyError)
+    }
+
+    let activeClient = kernelClient
+    if (strategy === 'mixed' && isMigrationWrapperAccount(kernelClient.account)) {
+        // The migration adds one passkey tap + a few seconds of confirmation
+        // wait. Show the security-verification overlay for the whole beat
+        // (same pattern as the mixed flow's admin-sig → userOp gap) so the
+        // extra prompt reads as intentional. Gated on wrapper accounts so the
+        // common path never flickers.
+        setSecurityOverlay?.(true)
+        try {
+            activeClient = await ensureRootValidatorMigrated({
+                client: kernelClient,
+                sendNoopUserOp,
+                rebuildClient,
+                onEvent: (event) =>
+                    posthog.capture(
+                        event === 'attempted'
+                            ? ANALYTICS_EVENTS.KERNEL_MIGRATION_ATTEMPTED
+                            : ANALYTICS_EVENTS.KERNEL_MIGRATION_SUCCEEDED,
+                        { trigger: migrationTrigger, kind }
+                    ),
+            })
+        } finally {
+            setSecurityOverlay?.(false)
+        }
+    }
+
+    if (touchesCollateral) {
+        const card = findActiveCard(overview)
+        if (card && !card.hasWithdrawApproval) {
+            onGrantRequired?.()
+            const grantResult = await grant()
+            if (!grantResult.ok) {
+                throw new SessionKeyGrantRequiredError(grantResult.error)
+            }
+            // `grant()` refetches the overview; by the time we continue the
+            // flag is flipped and the backend will accept the submit call.
+        }
+    }
+
+    return activeClient
+}
diff --git a/src/hooks/wallet/useSendMoney.ts b/src/hooks/wallet/useSendMoney.ts
index b5f82f3d4d..6800b334a9 100644
--- a/src/hooks/wallet/useSendMoney.ts
+++ b/src/hooks/wallet/useSendMoney.ts
@@ -8,12 +8,8 @@ import { useBalance } from './useBalance'
 import { useRainCardOverview, RAIN_CARD_OVERVIEW_QUERY_KEY } from '../useRainCardOverview'
 import { rainCentsToUsdcUnits, BALANCE_SETTLING_MESSAGE } from '@/utils/balance.utils'
 import type { RainCollateralKind } from '@/services/rain'
-import {
-    InsufficientSpendableError,
-    SessionKeyGrantRequiredError,
-    type SpendStrategy,
-    useSpendBundle,
-} from './useSpendBundle'
+import { useSpendBundle } from './useSpendBundle'
+import { InsufficientSpendableError, SessionKeyGrantRequiredError, type SpendStrategy } from './spendPreflight'
 
 type SendMoneyParams = {
     toAddress: Address
diff --git a/src/hooks/wallet/useSignSpendBundle.ts b/src/hooks/wallet/useSignSpendBundle.ts
index 77cd1cf0db..6d525006b3 100644
--- a/src/hooks/wallet/useSignSpendBundle.ts
+++ b/src/hooks/wallet/useSignSpendBundle.ts
@@ -8,24 +8,15 @@ import posthog from 'posthog-js'
 import { ANALYTICS_EVENTS } from '@/constants/analytics.consts'
 import { useKernelClient } from '@/context/kernelClient.context'
 import { PEANUT_WALLET_CHAIN, PEANUT_WALLET_TOKEN } from '@/constants/zerodev.consts'
-import {
-    RAIN_WITHDRAW_EIP712_DOMAIN_NAME,
-    RAIN_WITHDRAW_EIP712_DOMAIN_VERSION,
-    rainCoordinatorAbi,
-    rainWithdrawEip712Types,
-} from '@/constants/rain.consts'
+import { rainCoordinatorAbi } from '@/constants/rain.consts'
+import { buildRainWithdrawTypedData } from '@/utils/rainWithdraw.utils'
+import { useZeroDev } from '@/hooks/useZeroDev'
+import { useModalsContextOptional } from '@/context/ModalsContext'
 import { rainApi, type RainCollateralKind } from '@/services/rain'
-import { findActiveCard } from '@/components/Card/cardState.utils'
-import { useRainCardOverview, RAIN_CARD_OVERVIEW_QUERY_KEY } from '@/hooks/useRainCardOverview'
-import { useGrantSessionKey, type GrantSessionKeyError } from './useGrantSessionKey'
+import { useRainCardOverview } from '@/hooks/useRainCardOverview'
+import { useGrantSessionKey } from './useGrantSessionKey'
 import { useSignUserOp, type SignedUserOpData } from './useSignUserOp'
-import {
-    computeSpendStrategy,
-    fetchLiveSmartUsdcBalance,
-    InsufficientSpendableError,
-    SessionKeyGrantRequiredError,
-    type SpendStrategy,
-} from './useSpendBundle'
+import { resolveSpendStrategy, runCollateralSpendPreflight, type SpendStrategy } from './spendPreflight'
 import { usdcUnitsToRainCents } from '@/utils/balance.utils'
 
 /**
@@ -100,7 +91,9 @@ export interface SignSpendBundleInput {
  */
 
 export const useSignSpendBundle = () => {
-    const { getClientForChain } = useKernelClient()
+    const { getClientForChain, rebuildClientForChain } = useKernelClient()
+    const { handleSendUserOpEncoded } = useZeroDev()
+    const modals = useModalsContextOptional()
     const { signCallsUserOp } = useSignUserOp()
     const { overview } = useRainCardOverview()
     const { grant } = useGrantSessionKey()
@@ -127,186 +120,171 @@ export const useSignSpendBundle = () => {
             // send the UserOp — never a cached value (see fetchLiveSmartUsdcBalance).
             // A stale, pre-sweep balance routes `smart-only` to an empty account
             // and reverts on-chain (incident #2230).
-            const smartBalance = await fetchLiveSmartUsdcBalance(queryClient, kernelAccount.address)
-
             // Manteca-style flows always have a single recipient and no
             // subsequent kernel calls — collateral-only is always eligible.
-            const strategy = computeSpendStrategy({
-                smart: smartBalance,
-                rain: rainSpendingPower,
-                amount: requiredUsdcAmount,
+            const { strategy, smartBalance } = await resolveSpendStrategy({
+                queryClient,
+                accountAddress: kernelAccount.address,
+                requiredUsdcAmount,
+                rainSpendingPower,
                 collateralOnlyAllowed: true,
+                flow: 'sign-only',
             })
-            if (strategy === 'insufficient') {
-                posthog.capture(ANALYTICS_EVENTS.CARD_WITHDRAW_FAILED, {
-                    strategy: 'insufficient',
-                    error_kind: 'insufficient',
-                    flow: 'sign-only',
-                })
-                // Passed the FE display gate but the live balance can't cover it yet
-                // (in-transit collateral not landed / ~30s-stale FE). Refresh the Rain
-                // overview so the displayed balance + a retry reflect reality.
-                queryClient.invalidateQueries({ queryKey: [RAIN_CARD_OVERVIEW_QUERY_KEY] })
-                throw new InsufficientSpendableError()
-            }
 
             onStrategyDecided?.(strategy)
             posthog.capture(ANALYTICS_EVENTS.CARD_WITHDRAW_ATTEMPTED, { strategy, kind, flow: 'sign-only' })
 
-            // Pre-flight: any strategy that touches Rain collateral requires
-            // the one-time session-key grant. If missing, run the inline grant
-            // flow now. Reject when the overview hasn't loaded yet — we can't
-            // tell whether the grant was already given, and signing
-            // optimistically would crash on the backend submission.
-            const touchesCollateral = strategy === 'collateral-only' || strategy === 'mixed'
-            if (touchesCollateral) {
-                if (!overview) {
-                    throw new SessionKeyGrantRequiredError({ kind: 'unexpected' } as GrantSessionKeyError)
+            // Failure-capture parity with useSpendBundle's catch: without this,
+            // a failed migration/grant/signing in the sign-then-broadcast flow
+            // emits `attempted` with no terminal event and the funnel lies.
+            try {
+                // Shared collateral pre-flights (root-validator migration gate +
+                // session-key grant) — ONE ordered sequence for both spend engines;
+                // see runCollateralSpendPreflight. Every signature below MUST come
+                // from the account it returns. requireOverview: this engine can't
+                // tell whether the grant exists while the overview is loading, and
+                // signing optimistically would crash on the backend submission.
+                const activeClient = await runCollateralSpendPreflight({
+                    strategy,
+                    kind,
+                    kernelClient,
+                    overview,
+                    requireOverview: true,
+                    grant,
+                    onGrantRequired,
+                    sendNoopUserOp: (call) => handleSendUserOpEncoded([call], chainIdStr),
+                    rebuildClient: () => rebuildClientForChain(chainIdStr),
+                    setSecurityOverlay: modals?.setIsSecurityVerificationOpen,
+                    migrationTrigger: 'sign-spend',
+                })
+                const activeAccount = activeClient.account
+                if (!activeAccount) {
+                    throw new Error('useSignSpendBundle: kernel account not initialized after preflight')
                 }
-                const card = findActiveCard(overview)
-                if (card && !card.hasWithdrawApproval) {
-                    onGrantRequired?.()
-                    const grantResult = await grant()
-                    if (!grantResult.ok) {
-                        throw new SessionKeyGrantRequiredError(grantResult.error as GrantSessionKeyError)
+
+                // ─── smart-only ─────────────────────────────────────────────────
+                if (strategy === 'smart-only') {
+                    const transferData = encodeFunctionData({
+                        abi: erc20Abi,
+                        functionName: 'transfer',
+                        args: [recipient, requiredUsdcAmount],
+                    })
+                    const signedUserOp = await signCallsUserOp(
+                        [{ to: PEANUT_WALLET_TOKEN as Hex, value: 0n, data: transferData }],
+                        chainIdStr
+                    )
+                    return { strategy, signedUserOp }
+                }
+
+                // ─── collateral-only ────────────────────────────────────────────
+                // Only sign the admin EIP-712 — backend submits the withdrawal via
+                // the user's session-key UserOp (1 tap total).
+                if (strategy === 'collateral-only') {
+                    const prep = await rainApi.prepareWithdrawal({
+                        amount: usdcUnitsToRainCents(requiredUsdcAmount).toString(),
+                        recipientAddress: recipient,
+                        directTransfer: true,
+                        kind,
+                    })
+
+                    const adminSignature = (await activeAccount.signTypedData(
+                        buildRainWithdrawTypedData(prep, chainIdNum)
+                    )) as Hex
+
+                    return {
+                        strategy,
+                        rainWithdrawal: {
+                            preparationId: prep.preparationId,
+                            amount: prep.amount,
+                            recipientAddress: prep.recipientAddress as Address,
+                            directTransfer: prep.directTransfer,
+                            adminSalt: prep.adminSalt as Hex,
+                            adminNonce: prep.adminNonce,
+                            adminSignature,
+                            executorSignature: prep.executorSignature,
+                            executorSalt: prep.executorSalt,
+                            expiresAt: prep.expiresAt,
+                        },
                     }
                 }
-            }
 
-            // ─── smart-only ─────────────────────────────────────────────────
-            if (strategy === 'smart-only') {
-                const transferData = encodeFunctionData({
-                    abi: erc20Abi,
-                    functionName: 'transfer',
-                    args: [recipient, requiredUsdcAmount],
-                })
-                const signedUserOp = await signCallsUserOp(
-                    [{ to: PEANUT_WALLET_TOKEN as Hex, value: 0n, data: transferData }],
-                    chainIdStr
-                )
-                return { strategy, signedUserOp }
-            }
+                // ─── mixed ──────────────────────────────────────────────────────
+                // Pull the shortfall from collateral into the smart account, then
+                // forward the full amount to the recipient — one atomic UserOp,
+                // signed without broadcasting. Two passkey taps (admin sig + UserOp).
+                // Use the kernel account's own address as the admin recipient (the
+                // address we sign FROM) instead of re-deriving from useAuth.
+                const adminAddress = kernelAccount.address as Address
 
-            // ─── collateral-only ────────────────────────────────────────────
-            // Only sign the admin EIP-712 — backend submits the withdrawal via
-            // the user's session-key UserOp (1 tap total).
-            if (strategy === 'collateral-only') {
+                const shortfall = requiredUsdcAmount - smartBalance
                 const prep = await rainApi.prepareWithdrawal({
-                    amount: usdcUnitsToRainCents(requiredUsdcAmount).toString(),
-                    recipientAddress: recipient,
-                    directTransfer: true,
+                    amount: usdcUnitsToRainCents(shortfall).toString(),
+                    // directTransfer=false sends tokens to the admin (kernel). Same
+                    // semantics as broadcasting useSpendBundle.spend's mixed path.
+                    recipientAddress: adminAddress,
+                    directTransfer: false,
                     kind,
+                    totalAmountCents: usdcUnitsToRainCents(requiredUsdcAmount).toString(),
                 })
 
-                const adminSignature = (await kernelAccount.signTypedData({
-                    domain: {
-                        name: RAIN_WITHDRAW_EIP712_DOMAIN_NAME,
-                        version: RAIN_WITHDRAW_EIP712_DOMAIN_VERSION,
-                        chainId: chainIdNum,
-                        verifyingContract: prep.collateralProxy as Address,
-                        salt: prep.adminSalt as Hex,
-                    },
-                    types: rainWithdrawEip712Types,
-                    primaryType: 'Withdraw',
-                    message: {
-                        user: prep.adminAddress as Address,
-                        asset: prep.tokenAddress as Address,
-                        amount: BigInt(prep.amount),
-                        recipient: prep.recipientAddress as Address,
-                        nonce: BigInt(prep.adminNonce),
-                    },
-                })) as Hex
+                const adminSignature = (await activeAccount.signTypedData(
+                    buildRainWithdrawTypedData(prep, chainIdNum)
+                )) as Hex
 
-                return {
-                    strategy,
-                    rainWithdrawal: {
-                        preparationId: prep.preparationId,
-                        amount: prep.amount,
-                        recipientAddress: prep.recipientAddress as Address,
-                        directTransfer: prep.directTransfer,
-                        adminSalt: prep.adminSalt as Hex,
-                        adminNonce: prep.adminNonce,
-                        adminSignature,
-                        executorSignature: prep.executorSignature,
-                        executorSalt: prep.executorSalt,
-                        expiresAt: prep.expiresAt,
-                    },
+                const withdrawCall = {
+                    to: prep.coordinatorAddress as Hex,
+                    value: 0n,
+                    data: encodeFunctionData({
+                        abi: rainCoordinatorAbi,
+                        functionName: 'withdrawAsset',
+                        args: [
+                            prep.collateralProxy as Address,
+                            prep.tokenAddress as Address,
+                            BigInt(prep.amount),
+                            prep.recipientAddress as Address,
+                            BigInt(prep.expiresAt),
+                            prep.executorSalt as Hex,
+                            prep.executorSignature as Hex,
+                            [prep.adminSalt as Hex],
+                            [adminSignature],
+                            prep.directTransfer,
+                        ],
+                    }),
                 }
-            }
-
-            // ─── mixed ──────────────────────────────────────────────────────
-            // Pull the shortfall from collateral into the smart account, then
-            // forward the full amount to the recipient — one atomic UserOp,
-            // signed without broadcasting. Two passkey taps (admin sig + UserOp).
-            // Use the kernel account's own address as the admin recipient (the
-            // address we sign FROM) instead of re-deriving from useAuth.
-            const adminAddress = kernelAccount.address as Address
 
-            const shortfall = requiredUsdcAmount - smartBalance
-            const prep = await rainApi.prepareWithdrawal({
-                amount: usdcUnitsToRainCents(shortfall).toString(),
-                // directTransfer=false sends tokens to the admin (kernel). Same
-                // semantics as broadcasting useSpendBundle.spend's mixed path.
-                recipientAddress: adminAddress,
-                directTransfer: false,
-                kind,
-                totalAmountCents: usdcUnitsToRainCents(requiredUsdcAmount).toString(),
-            })
-
-            const adminSignature = (await kernelAccount.signTypedData({
-                domain: {
-                    name: RAIN_WITHDRAW_EIP712_DOMAIN_NAME,
-                    version: RAIN_WITHDRAW_EIP712_DOMAIN_VERSION,
-                    chainId: chainIdNum,
-                    verifyingContract: prep.collateralProxy as Address,
-                    salt: prep.adminSalt as Hex,
-                },
-                types: rainWithdrawEip712Types,
-                primaryType: 'Withdraw',
-                message: {
-                    user: prep.adminAddress as Address,
-                    asset: prep.tokenAddress as Address,
-                    amount: BigInt(prep.amount),
-                    recipient: prep.recipientAddress as Address,
-                    nonce: BigInt(prep.adminNonce),
-                },
-            })) as Hex
-
-            const withdrawCall = {
-                to: prep.coordinatorAddress as Hex,
-                value: 0n,
-                data: encodeFunctionData({
-                    abi: rainCoordinatorAbi,
-                    functionName: 'withdrawAsset',
-                    args: [
-                        prep.collateralProxy as Address,
-                        prep.tokenAddress as Address,
-                        BigInt(prep.amount),
-                        prep.recipientAddress as Address,
-                        BigInt(prep.expiresAt),
-                        prep.executorSalt as Hex,
-                        prep.executorSignature as Hex,
-                        [prep.adminSalt as Hex],
-                        [adminSignature],
-                        prep.directTransfer,
-                    ],
-                }),
-            }
+                const transferCall = {
+                    to: PEANUT_WALLET_TOKEN as Hex,
+                    value: 0n,
+                    data: encodeFunctionData({
+                        abi: erc20Abi,
+                        functionName: 'transfer',
+                        args: [recipient, requiredUsdcAmount],
+                    }),
+                }
 
-            const transferCall = {
-                to: PEANUT_WALLET_TOKEN as Hex,
-                value: 0n,
-                data: encodeFunctionData({
-                    abi: erc20Abi,
-                    functionName: 'transfer',
-                    args: [recipient, requiredUsdcAmount],
-                }),
+                const signedUserOp = await signCallsUserOp([withdrawCall, transferCall], chainIdStr)
+                return { strategy, signedUserOp, rainPreparationId: prep.preparationId }
+            } catch (e) {
+                posthog.capture(ANALYTICS_EVENTS.CARD_WITHDRAW_FAILED, {
+                    strategy,
+                    kind,
+                    flow: 'sign-only',
+                    error_kind: (e as Error)?.name ?? 'unknown',
+                    error_message: (e as Error)?.message,
+                })
+                throw e
             }
-
-            const signedUserOp = await signCallsUserOp([withdrawCall, transferCall], chainIdStr)
-            return { strategy, signedUserOp, rainPreparationId: prep.preparationId }
         },
-        [getClientForChain, signCallsUserOp, overview, grant, queryClient]
+        [
+            getClientForChain,
+            rebuildClientForChain,
+            handleSendUserOpEncoded,
+            modals,
+            signCallsUserOp,
+            overview,
+            grant,
+            queryClient,
+        ]
     )
 
     return { signSpend }
diff --git a/src/hooks/wallet/useSpendBundle.ts b/src/hooks/wallet/useSpendBundle.ts
index 998ab179ce..dcc839a9cd 100644
--- a/src/hooks/wallet/useSpendBundle.ts
+++ b/src/hooks/wallet/useSpendBundle.ts
@@ -1,31 +1,29 @@
 'use client'
 
 import { useCallback } from 'react'
-import { useQueryClient, type QueryClient } from '@tanstack/react-query'
+import { useQueryClient } from '@tanstack/react-query'
 import type { Address, Hash, Hex, TransactionReceipt } from 'viem'
 import { encodeFunctionData, erc20Abi } from 'viem'
 import posthog from 'posthog-js'
 import { ANALYTICS_EVENTS } from '@/constants/analytics.consts'
 import { useKernelClient } from '@/context/kernelClient.context'
 import { useAuth } from '@/context/authContext'
-import { AccountType } from '@/interfaces'
-import { PEANUT_WALLET_CHAIN, PEANUT_WALLET_TOKEN, PEANUT_WALLET_TOKEN_DECIMALS } from '@/constants/zerodev.consts'
-import {
-    RAIN_WITHDRAW_EIP712_DOMAIN_NAME,
-    RAIN_WITHDRAW_EIP712_DOMAIN_VERSION,
-    rainCoordinatorAbi,
-    rainWithdrawEip712Types,
-} from '@/constants/rain.consts'
+import { AccountType } from '@/interfaces/interfaces'
+import { PEANUT_WALLET_CHAIN, PEANUT_WALLET_TOKEN } from '@/constants/zerodev.consts'
+import { rainCoordinatorAbi } from '@/constants/rain.consts'
+import { buildRainWithdrawTypedData } from '@/utils/rainWithdraw.utils'
 import { rainApi, type RainCollateralKind } from '@/services/rain'
 import { useZeroDev } from '@/hooks/useZeroDev'
-import { findActiveCard } from '@/components/Card/cardState.utils'
-import { useRainCardOverview, RAIN_CARD_OVERVIEW_QUERY_KEY } from '@/hooks/useRainCardOverview'
-import { useGrantSessionKey, type GrantSessionKeyError } from './useGrantSessionKey'
+import { useRainCardOverview } from '@/hooks/useRainCardOverview'
+import { useGrantSessionKey } from './useGrantSessionKey'
 import { usdcUnitsToRainCents } from '@/utils/balance.utils'
 import { useModalsContextOptional } from '@/context/ModalsContext'
-import { smartUsdcBalanceQueryOptions } from './useBalance'
-
-export type SpendStrategy = 'collateral-only' | 'smart-only' | 'mixed' | 'insufficient'
+import {
+    resolveSpendStrategy,
+    runCollateralSpendPreflight,
+    SessionKeyGrantRequiredError,
+    type SpendStrategy,
+} from './spendPreflight'
 
 type UserOpEncodedParams = { to: Hex; value: bigint; data: Hex }
 
@@ -77,24 +75,9 @@ export interface SpendBundleResult {
     intentId?: string
 }
 
-export class InsufficientSpendableError extends Error {
-    constructor() {
-        super('Insufficient spendable balance')
-        this.name = 'InsufficientSpendableError'
-    }
-}
-
-/**
- * Thrown when the user is about to spend from Rain collateral but hasn't
- * granted the session-key permission yet, and the inline grant either failed
- * or the user cancelled the passkey. Caller can surface a friendlier UI.
- */
-export class SessionKeyGrantRequiredError extends Error {
-    constructor(public readonly cause: GrantSessionKeyError) {
-        super(`Session-key grant required: ${cause.kind}`)
-        this.name = 'SessionKeyGrantRequiredError'
-    }
-}
+// Routing primitives + shared errors (InsufficientSpendableError,
+// SessionKeyGrantRequiredError, computeSpendStrategy, fetchLiveSmartUsdcBalance)
+// live in ./spendPreflight — shared verbatim with useSignSpendBundle.
 
 // `usdcUnitsToRainCents` lives in @/utils/balance.utils alongside its sibling
 // `rainCentsToUsdcUnits`. Rain's wire convention is asymmetric: cents (2dp)
@@ -103,44 +86,6 @@ export class SessionKeyGrantRequiredError extends Error {
 // `usdcUnitsToRainCents` is for the input side only — never call it on amounts
 // returned from Rain.
 
-/**
- * Live smart-account USDC balance for ROUTING, read through the SAME TanStack
- * query that backs the displayed balance (`smartUsdcBalanceQueryOptions`) — one
- * source of truth, one `readContract`. `staleTime: 0` forces a fresh on-chain
- * read AND writes the result into `['balance', address]`, so the displayed
- * balance refreshes in the same call.
- *
- * Routing MUST use this rather than the 30s-cached `useBalance` value: card
- * funds are swept smart→collateral, so a stale (pre-sweep) balance routes
- * `smart-only` to an account that's already empty and the transfer reverts
- * on-chain ("ERC20: transfer amount exceeds balance" — incident #2230).
- */
-export async function fetchLiveSmartUsdcBalance(queryClient: QueryClient, address: Address): Promise<bigint> {
-    return queryClient.fetchQuery({ ...smartUsdcBalanceQueryOptions(address), staleTime: 0 })
-}
-
-/**
- * Pure routing helper — decides which bucket(s) a spend will pull from.
- * Priority: smart → collateral → mixed. The smart account is spent first
- * whenever it can cover the whole amount, so a payment never touches the
- * Rain collateral — and Rain's per-account withdrawal-signature cooldown —
- * if the user's smart-account USDC already covers it. Collateral is the
- * fallback (single recipient AND no subsequent kernel calls, since Rain's
- * coordinator transfers tokens directly with nothing following), and `mixed`
- * tops up the shortfall from collateral when smart alone can't cover it.
- */
-export function computeSpendStrategy(input: {
-    smart: bigint
-    rain: bigint
-    amount: bigint
-    collateralOnlyAllowed: boolean
-}): SpendStrategy {
-    if (input.smart >= input.amount) return 'smart-only'
-    if (input.collateralOnlyAllowed && input.rain >= input.amount) return 'collateral-only'
-    if (input.smart + input.rain >= input.amount) return 'mixed'
-    return 'insufficient'
-}
-
 /**
  * Orchestrates a USDC outflow across the user's two buckets:
  *   - collateral-only: backend broadcasts `coordinator.withdrawAsset(directTransfer=true)`
@@ -153,7 +98,7 @@ export function computeSpendStrategy(input: {
  * See plan file for the full rationale.
  */
 export const useSpendBundle = () => {
-    const { getClientForChain } = useKernelClient()
+    const { getClientForChain, rebuildClientForChain } = useKernelClient()
     const { handleSendUserOpEncoded } = useZeroDev()
     const { user } = useAuth()
     const { overview } = useRainCardOverview()
@@ -190,44 +135,35 @@ export const useSpendBundle = () => {
             // getClientForChain also asserts the client belongs to the logged-in
             // user, so this is the authoritative sender + balance pair.
             const kernelClient = getClientForChain(chainIdStr)
-            const smartBalance = await fetchLiveSmartUsdcBalance(queryClient, kernelClient.account!.address)
-
-            const strategy = computeSpendStrategy({
-                smart: smartBalance,
-                rain: rainSpendingPower,
-                amount: requiredUsdcAmount,
+            const { strategy, smartBalance } = await resolveSpendStrategy({
+                queryClient,
+                accountAddress: kernelClient.account!.address,
+                requiredUsdcAmount,
+                rainSpendingPower,
                 collateralOnlyAllowed,
             })
-            if (strategy === 'insufficient') {
-                posthog.capture(ANALYTICS_EVENTS.CARD_WITHDRAW_FAILED, {
-                    strategy: 'insufficient',
-                    error_kind: 'insufficient',
-                })
-                // Passed the FE display gate but the live balance can't cover it yet
-                // (in-transit collateral not landed / ~30s-stale FE). Refresh the Rain
-                // overview so the displayed balance + a retry reflect reality.
-                queryClient.invalidateQueries({ queryKey: [RAIN_CARD_OVERVIEW_QUERY_KEY] })
-                throw new InsufficientSpendableError()
-            }
 
             onStrategyDecided?.(strategy)
             posthog.capture(ANALYTICS_EVENTS.CARD_WITHDRAW_ATTEMPTED, { strategy, kind })
 
             try {
-                // Pre-flight: any strategy that touches Rain collateral requires
-                // the one-time session-key grant. If missing, run the inline grant
-                // flow now (one extra passkey tap the FIRST time, zero after).
-                const touchesCollateral = strategy === 'collateral-only' || strategy === 'mixed'
-                const card = findActiveCard(overview)
-                if (touchesCollateral && card && !card.hasWithdrawApproval) {
-                    onGrantRequired?.()
-                    const grantResult = await grant()
-                    if (!grantResult.ok) {
-                        throw new SessionKeyGrantRequiredError(grantResult.error)
-                    }
-                    // `grant()` refetches the overview; by the time we continue the
-                    // flag is flipped and the backend will accept the submit call.
-                }
+                // Shared collateral pre-flights (root-validator migration gate +
+                // session-key grant) — ONE ordered sequence for both spend
+                // engines; see runCollateralSpendPreflight. Every signature
+                // below MUST come from the client it returns.
+                const activeClient = await runCollateralSpendPreflight({
+                    strategy,
+                    kind,
+                    kernelClient,
+                    overview,
+                    requireOverview: false,
+                    grant,
+                    onGrantRequired,
+                    sendNoopUserOp: (call) => handleSendUserOpEncoded([call], chainIdStr),
+                    rebuildClient: () => rebuildClientForChain(chainIdStr),
+                    setSecurityOverlay: modals?.setIsSecurityVerificationOpen,
+                    migrationTrigger: 'mixed-spend',
+                })
 
                 // ─── collateral-only ──────────────────────────────────────────────
                 if (strategy === 'collateral-only') {
@@ -241,24 +177,9 @@ export const useSpendBundle = () => {
                         chargeId,
                     })
 
-                    const adminSignature = (await kernelClient.account!.signTypedData({
-                        domain: {
-                            name: RAIN_WITHDRAW_EIP712_DOMAIN_NAME,
-                            version: RAIN_WITHDRAW_EIP712_DOMAIN_VERSION,
-                            chainId: chainIdNum,
-                            verifyingContract: prep.collateralProxy as Address,
-                            salt: prep.adminSalt as Hex,
-                        },
-                        types: rainWithdrawEip712Types,
-                        primaryType: 'Withdraw',
-                        message: {
-                            user: prep.adminAddress as Address,
-                            asset: prep.tokenAddress as Address,
-                            amount: BigInt(prep.amount),
-                            recipient: prep.recipientAddress as Address,
-                            nonce: BigInt(prep.adminNonce),
-                        },
-                    })) as Hex
+                    const adminSignature = (await activeClient.account!.signTypedData(
+                        buildRainWithdrawTypedData(prep, chainIdNum)
+                    )) as Hex
 
                     const { txHash } = await rainApi.submitWithdrawal({
                         preparationId: prep.preparationId,
@@ -324,24 +245,9 @@ export const useSpendBundle = () => {
                     totalAmountCents: usdcUnitsToRainCents(requiredUsdcAmount).toString(),
                 })
 
-                const adminSignature = (await kernelClient.account!.signTypedData({
-                    domain: {
-                        name: RAIN_WITHDRAW_EIP712_DOMAIN_NAME,
-                        version: RAIN_WITHDRAW_EIP712_DOMAIN_VERSION,
-                        chainId: chainIdNum,
-                        verifyingContract: prep.collateralProxy as Address,
-                        salt: prep.adminSalt as Hex,
-                    },
-                    types: rainWithdrawEip712Types,
-                    primaryType: 'Withdraw',
-                    message: {
-                        user: prep.adminAddress as Address,
-                        asset: prep.tokenAddress as Address,
-                        amount: BigInt(prep.amount),
-                        recipient: prep.recipientAddress as Address,
-                        nonce: BigInt(prep.adminNonce),
-                    },
-                })) as Hex
+                const adminSignature = (await activeClient.account!.signTypedData(
+                    buildRainWithdrawTypedData(prep, chainIdNum)
+                )) as Hex
 
                 // Mixed = two passkey taps. The admin EIP-712 sig (tap #1) just
                 // resolved; the kernel now prepares the follow-up UserOp which
@@ -424,7 +330,7 @@ export const useSpendBundle = () => {
                 throw e
             }
         },
-        [getClientForChain, handleSendUserOpEncoded, user, overview, grant, modals, queryClient]
+        [getClientForChain, rebuildClientForChain, handleSendUserOpEncoded, user, overview, grant, modals, queryClient]
     )
 
     return { spend }
diff --git a/src/hooks/wallet/useWallet.ts b/src/hooks/wallet/useWallet.ts
index 8dd9cb92df..5f4cfc9fd4 100644
--- a/src/hooks/wallet/useWallet.ts
+++ b/src/hooks/wallet/useWallet.ts
@@ -9,7 +9,7 @@ import { useIsFetching } from '@tanstack/react-query'
 import { formatUnits, type Hex, type Address } from 'viem'
 import { useZeroDev } from '../useZeroDev'
 import { useAuth } from '@/context/authContext'
-import { AccountType } from '@/interfaces'
+import { AccountType } from '@/interfaces/interfaces'
 import { useBalance } from './useBalance'
 import { useSendMoney as useSendMoneyMutation } from './useSendMoney'
 import { formatCurrency } from '@/utils/general.utils'
@@ -20,7 +20,8 @@ import {
     rainCentsToUsdcUnits,
     isAmountWithinBalance,
 } from '@/utils/balance.utils'
-import { useSpendBundle, type SpendStrategy } from './useSpendBundle'
+import { useSpendBundle } from './useSpendBundle'
+import type { SpendStrategy } from './spendPreflight'
 import type { RainCollateralKind } from '@/services/rain'
 
 type SendTransactionsOptions = {
diff --git a/src/lib/validation/__tests__/addressFamily.test.ts b/src/lib/validation/__tests__/addressFamily.test.ts
new file mode 100644
index 0000000000..5c7039aba1
--- /dev/null
+++ b/src/lib/validation/__tests__/addressFamily.test.ts
@@ -0,0 +1,52 @@
+import { addressFamilyForChainId, isValidAddressForFamily } from '../addressFamily'
+
+// Real addresses: canonical USDC mint (Solana), canonical USDT contract (Tron)
+const SOLANA_ADDR = 'EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v'
+const TRON_ADDR = 'TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t'
+// lowercase — viem isAddress is checksum-strict on mixed-case input
+const EVM_ADDR = '0xb44401be236a81fcf8437ea917035e0934fda196'
+
+describe('addressFamilyForChainId', () => {
+    it('maps non-EVM slugs to their family', () => {
+        expect(addressFamilyForChainId('solana')).toBe('solana')
+        expect(addressFamilyForChainId('tron')).toBe('tron')
+        expect(addressFamilyForChainId('SOLANA')).toBe('solana')
+    })
+
+    it('maps EVM numeric ids (and null/undefined) to evm', () => {
+        expect(addressFamilyForChainId('42161')).toBe('evm')
+        expect(addressFamilyForChainId(43114)).toBe('evm')
+        expect(addressFamilyForChainId(null)).toBe('evm')
+        expect(addressFamilyForChainId(undefined)).toBe('evm')
+    })
+})
+
+describe('isValidAddressForFamily', () => {
+    it('validates real addresses in their own family', () => {
+        expect(isValidAddressForFamily(SOLANA_ADDR, 'solana')).toBe(true)
+        expect(isValidAddressForFamily(TRON_ADDR, 'tron')).toBe(true)
+        expect(isValidAddressForFamily(EVM_ADDR, 'evm')).toBe(true)
+    })
+
+    it('rejects cross-family inputs', () => {
+        expect(isValidAddressForFamily(EVM_ADDR, 'solana')).toBe(false)
+        expect(isValidAddressForFamily(EVM_ADDR, 'tron')).toBe(false)
+        expect(isValidAddressForFamily(SOLANA_ADDR, 'evm')).toBe(false)
+        expect(isValidAddressForFamily(SOLANA_ADDR, 'tron')).toBe(false)
+        // NOTE: a Tron address IS valid base58 in Solana's length range — the
+        // family always comes from the selected chain, never string-sniffed.
+        expect(isValidAddressForFamily(TRON_ADDR, 'evm')).toBe(false)
+    })
+
+    it('rejects malformed base58 (0, O, I, l are not in the alphabet)', () => {
+        expect(isValidAddressForFamily('0PjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v', 'solana')).toBe(false)
+        expect(isValidAddressForFamily('TOOOOqjeKQxGTCi8q8ZY4pL8otSzgjLj6t', 'tron')).toBe(false)
+        expect(isValidAddressForFamily('', 'solana')).toBe(false)
+        expect(isValidAddressForFamily('short', 'solana')).toBe(false)
+    })
+
+    it('rejects tron addresses without the T prefix / wrong length', () => {
+        expect(isValidAddressForFamily(TRON_ADDR.slice(1), 'tron')).toBe(false)
+        expect(isValidAddressForFamily(TRON_ADDR + 'a', 'tron')).toBe(false)
+    })
+})
diff --git a/src/lib/validation/addressFamily.ts b/src/lib/validation/addressFamily.ts
new file mode 100644
index 0000000000..1f4d6a737c
--- /dev/null
+++ b/src/lib/validation/addressFamily.ts
@@ -0,0 +1,33 @@
+import { isAddress } from 'viem'
+import { isNonEvmWithdrawChainId } from '@/constants/chainRegistry.consts'
+
+/**
+ * Address families for withdraw destinations. EVM chains share one 0x
+ * format; Solana and Tron each have their own base58 shapes. The family is
+ * always derived from the SELECTED chain — never inferred from the address
+ * string alone (every Tron address also matches the Solana length range).
+ */
+export type WithdrawAddressFamily = 'evm' | 'solana' | 'tron'
+
+/** Base58 (no 0/O/I/l), 32–44 chars — Solana ed25519 account. */
+export const SOLANA_ADDRESS_REGEX = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/
+/** Base58check mainnet Tron address — 'T' + 33 chars. */
+export const TRON_ADDRESS_REGEX = /^T[1-9A-HJ-NP-Za-km-z]{33}$/
+
+export function addressFamilyForChainId(chainId?: string | number | null): WithdrawAddressFamily {
+    if (chainId != null && isNonEvmWithdrawChainId(chainId)) {
+        return String(chainId).toLowerCase() as WithdrawAddressFamily
+    }
+    return 'evm'
+}
+
+export function isValidAddressForFamily(address: string, family: WithdrawAddressFamily): boolean {
+    switch (family) {
+        case 'solana':
+            return SOLANA_ADDRESS_REGEX.test(address)
+        case 'tron':
+            return TRON_ADDRESS_REGEX.test(address)
+        case 'evm':
+            return isAddress(address)
+    }
+}
diff --git a/src/lib/validation/recipient.ts b/src/lib/validation/recipient.ts
index cd933960e6..09835c44aa 100644
--- a/src/lib/validation/recipient.ts
+++ b/src/lib/validation/recipient.ts
@@ -8,11 +8,23 @@ import { serverFetch } from '@/utils/api-fetch'
 import * as Sentry from '@sentry/nextjs'
 import { RecipientValidationError } from '../url-parser/errors'
 import { type RecipientType } from '../url-parser/types/payment'
+import { isValidAddressForFamily, type WithdrawAddressFamily } from './addressFamily'
 
 export async function validateAndResolveRecipient(
     recipient: string,
-    isWithdrawal: boolean = false
+    isWithdrawal: boolean = false,
+    addressFamily: WithdrawAddressFamily = 'evm'
 ): Promise<{ identifier: string; recipientType: RecipientType; resolvedAddress: string }> {
+    // Non-EVM withdraw destinations (Solana/Tron): a base58 address is the
+    // only valid input — no ENS, no usernames. The family comes from the
+    // selected destination chain, never inferred from the string.
+    if (addressFamily !== 'evm') {
+        if (!isValidAddressForFamily(recipient, addressFamily)) {
+            throw new RecipientValidationError(`Invalid ${addressFamily === 'solana' ? 'Solana' : 'Tron'} address`)
+        }
+        return { identifier: recipient, recipientType: 'ADDRESS', resolvedAddress: recipient }
+    }
+
     const recipientType = getRecipientType(recipient, isWithdrawal)
 
     switch (recipientType) {
diff --git a/src/services/rhino-sda.ts b/src/services/rhino-sda.ts
index 8fa610b289..ec16f486b9 100644
--- a/src/services/rhino-sda.ts
+++ b/src/services/rhino-sda.ts
@@ -30,7 +30,9 @@ export interface SdaTransferRequest {
     /** Rhino chain name (e.g. ARBITRUM, BASE). */
     depositChain: string
     destinationChain: string
-    destinationAddress: Address
+    /** 0x for EVM destinations, base58 for Solana/Tron — the BE forwards it
+     *  to Rhino, which validates per destination chain. */
+    destinationAddress: string
     tokenOut: RhinoSupportedToken
     senderPeanutWalletAddress?: Address
     /**
diff --git a/src/utils/__tests__/kernelMigration.utils.test.ts b/src/utils/__tests__/kernelMigration.utils.test.ts
new file mode 100644
index 0000000000..e90ed642ea
--- /dev/null
+++ b/src/utils/__tests__/kernelMigration.utils.test.ts
@@ -0,0 +1,158 @@
+/**
+ * Tests for the pre-spend root-validator migration gate.
+ *
+ * Regression context: mixed spends from unmigrated pre-2025-09-18 accounts
+ * deterministically reverted with "Delegatecall failed" because the migration
+ * wrapped into the SAME userOp invalidated the pre-signed Rain admin EIP-712
+ * signature (routed to the old validator) before `withdrawAsset` verified it
+ * via ERC-1271. The gate must: migrate first as its own userOp, then hand the
+ * caller a REBUILT client (the old one keeps signing via the old validator).
+ */
+import type { TransactionReceipt } from 'viem'
+import {
+    buildMigrationNoopCall,
+    ensureRootValidatorMigrated,
+    isMigrationWrapperAccount,
+    KernelMigrationFailedError,
+    KernelMigrationPendingError,
+} from '../kernelMigration.utils'
+import { PEANUT_WALLET_TOKEN } from '@/constants/zerodev.consts'
+
+const ACCOUNT_ADDRESS = '0x70f22a4db066aed9bcd2157a7b19e2e28c10c483' as const
+
+const successReceipt = { status: 'success' } as TransactionReceipt
+const revertedReceipt = { status: 'reverted' } as TransactionReceipt
+
+type FakeClient = { account?: unknown; rebuilt?: boolean }
+
+const makeDeps = (opts: { account: unknown; receipt?: TransactionReceipt | null; rebuiltAccount?: unknown }) => {
+    const rebuiltClient: FakeClient = {
+        account: opts.rebuiltAccount ?? { address: ACCOUNT_ADDRESS },
+        rebuilt: true,
+    }
+    const sendNoopUserOp = jest.fn(async () => ({
+        receipt: opts.receipt === undefined ? successReceipt : opts.receipt,
+    }))
+    const rebuildClient = jest.fn(async () => rebuiltClient)
+    const events: string[] = []
+    return {
+        deps: {
+            client: { account: opts.account } as FakeClient,
+            sendNoopUserOp,
+            rebuildClient,
+            onEvent: (e: 'attempted' | 'succeeded') => events.push(e),
+            // keep polling instant in tests
+            statusRetries: 3,
+            statusIntervalMs: 1,
+        },
+        sendNoopUserOp,
+        rebuildClient,
+        rebuiltClient,
+        events,
+    }
+}
+
+/** Wrapper whose on-chain root flips to migrated after the migration op lands
+ *  (first status read gates, later reads verify). */
+const wrapperAccount = (migrated: boolean) => {
+    let calls = 0
+    return {
+        address: ACCOUNT_ADDRESS,
+        getRootValidatorMigrationStatus: jest.fn(async () => (migrated ? true : ++calls > 1)),
+    }
+}
+
+/** Wrapper whose migration NEVER lands on-chain (e.g. the userOp itself
+ *  reverted even though the 4337 bundle receipt reported success). */
+const stuckWrapperAccount = () => ({
+    address: ACCOUNT_ADDRESS,
+    getRootValidatorMigrationStatus: jest.fn(async () => false),
+})
+
+describe('isMigrationWrapperAccount', () => {
+    it('detects wrapper accounts by the SDK-added status method', () => {
+        expect(isMigrationWrapperAccount(wrapperAccount(false))).toBe(true)
+        expect(isMigrationWrapperAccount({ address: ACCOUNT_ADDRESS })).toBe(false)
+        expect(isMigrationWrapperAccount(undefined)).toBe(false)
+    })
+})
+
+describe('buildMigrationNoopCall', () => {
+    it('is a zero-value USDC self-transfer (proven-harmless migration payload)', () => {
+        const call = buildMigrationNoopCall(ACCOUNT_ADDRESS)
+        expect(call.to.toLowerCase()).toBe(PEANUT_WALLET_TOKEN.toLowerCase())
+        expect(call.value).toBe(0n)
+        // transfer(address,uint256) selector + recipient + amount 0
+        expect(call.data.startsWith('0xa9059cbb')).toBe(true)
+        expect(call.data.toLowerCase()).toContain(ACCOUNT_ADDRESS.slice(2).toLowerCase())
+        expect(call.data.endsWith('0'.repeat(64))).toBe(true)
+    })
+})
+
+describe('ensureRootValidatorMigrated', () => {
+    it('returns the client untouched for plain (already-patched) accounts', async () => {
+        const { deps, sendNoopUserOp, rebuildClient } = makeDeps({ account: { address: ACCOUNT_ADDRESS } })
+        const result = await ensureRootValidatorMigrated(deps)
+        expect(result).toBe(deps.client)
+        expect(sendNoopUserOp).not.toHaveBeenCalled()
+        expect(rebuildClient).not.toHaveBeenCalled()
+    })
+
+    it('rebuilds WITHOUT migrating when the wrapper account is already migrated on-chain', async () => {
+        // A wrapper that migrated mid-session still SIGNS via the old validator —
+        // returning it unrebuilt would produce rejected EIP-1271 signatures.
+        const { deps, sendNoopUserOp, rebuildClient, rebuiltClient } = makeDeps({ account: wrapperAccount(true) })
+        const result = await ensureRootValidatorMigrated(deps)
+        expect(result).toBe(rebuiltClient)
+        expect(sendNoopUserOp).not.toHaveBeenCalled()
+        expect(rebuildClient).toHaveBeenCalledTimes(1)
+    })
+
+    it('migrates via the no-op userOp, verifies on-chain, then rebuilds', async () => {
+        const { deps, sendNoopUserOp, rebuildClient, rebuiltClient, events } = makeDeps({
+            account: wrapperAccount(false),
+        })
+        const result = await ensureRootValidatorMigrated(deps)
+        expect(sendNoopUserOp).toHaveBeenCalledWith(buildMigrationNoopCall(ACCOUNT_ADDRESS))
+        expect(rebuildClient).toHaveBeenCalledTimes(1)
+        expect(result).toBe(rebuiltClient)
+        expect(events).toEqual(['attempted', 'succeeded'])
+    })
+
+    it('4337 trap: bundle receipt success but userOp reverted (root never flips) → pending, no rebuild', async () => {
+        // In ERC-4337 a reverted userOp still yields receipt.status === 'success'
+        // on the bundle tx — the on-chain root validator is the only truth.
+        const { deps, rebuildClient, events } = makeDeps({ account: stuckWrapperAccount(), receipt: successReceipt })
+        await expect(ensureRootValidatorMigrated(deps)).rejects.toThrow(KernelMigrationPendingError)
+        expect(rebuildClient).not.toHaveBeenCalled()
+        expect(events).toEqual(['attempted'])
+    })
+
+    it('null receipt (timeout) still succeeds when the on-chain root flipped', async () => {
+        const { deps, rebuildClient, rebuiltClient } = makeDeps({ account: wrapperAccount(false), receipt: null })
+        const result = await ensureRootValidatorMigrated(deps)
+        expect(result).toBe(rebuiltClient)
+        expect(rebuildClient).toHaveBeenCalledTimes(1)
+    })
+
+    it('null receipt AND root never flips → pending', async () => {
+        const { deps, rebuildClient } = makeDeps({ account: stuckWrapperAccount(), receipt: null })
+        await expect(ensureRootValidatorMigrated(deps)).rejects.toThrow(KernelMigrationPendingError)
+        expect(rebuildClient).not.toHaveBeenCalled()
+    })
+
+    it('REVERTED bundle receipt → deterministic KernelMigrationFailedError (no retry framing)', async () => {
+        const { deps, rebuildClient } = makeDeps({ account: wrapperAccount(false), receipt: revertedReceipt })
+        await expect(ensureRootValidatorMigrated(deps)).rejects.toThrow(KernelMigrationFailedError)
+        expect(rebuildClient).not.toHaveBeenCalled()
+    })
+
+    it('fails closed when the rebuilt client is STILL a wrapper (lagging public RPC)', async () => {
+        const { deps, rebuildClient } = makeDeps({
+            account: wrapperAccount(true),
+            rebuiltAccount: stuckWrapperAccount(), // rebuild keeps returning a wrapper
+        })
+        await expect(ensureRootValidatorMigrated(deps)).rejects.toThrow(KernelMigrationPendingError)
+        expect(rebuildClient).toHaveBeenCalledTimes(2) // one grace retry, then fail closed
+    })
+})
diff --git a/src/utils/__tests__/rainWithdraw.utils.test.ts b/src/utils/__tests__/rainWithdraw.utils.test.ts
new file mode 100644
index 0000000000..a2dadec8a6
--- /dev/null
+++ b/src/utils/__tests__/rainWithdraw.utils.test.ts
@@ -0,0 +1,45 @@
+/**
+ * Guards the Rain withdraw admin EIP-712 payload against drift. The coordinator
+ * verifies EXACTLY this structure via ERC-1271 — any silent change to the
+ * domain or message shape bricks every collateral withdrawal.
+ */
+import { buildRainWithdrawTypedData } from '../rainWithdraw.utils'
+import {
+    RAIN_WITHDRAW_EIP712_DOMAIN_NAME,
+    RAIN_WITHDRAW_EIP712_DOMAIN_VERSION,
+    rainWithdrawEip712Types,
+} from '@/constants/rain.consts'
+
+const PREP = {
+    collateralProxy: '0x4c0b6e210726550c1842c445bc2caf2708c74587',
+    adminSalt: '0x' + '11'.repeat(32), // synthetic 32-byte salt (public calldata in prod)
+    adminAddress: '0x70f22a4db066aed9bcd2157a7b19e2e28c10c483',
+    tokenAddress: '0xaf88d065e77c8cc2239327c5edb3a432268e5831',
+    amount: '30040000',
+    recipientAddress: '0xb45104ef75c214990b23dcf7354e5fcb8ec4342a',
+    adminNonce: '7',
+}
+
+describe('buildRainWithdrawTypedData', () => {
+    it('builds the exact domain + message the coordinator verifies', () => {
+        const typed = buildRainWithdrawTypedData(PREP, 42161)
+        expect(typed).toEqual({
+            domain: {
+                name: RAIN_WITHDRAW_EIP712_DOMAIN_NAME,
+                version: RAIN_WITHDRAW_EIP712_DOMAIN_VERSION,
+                chainId: 42161,
+                verifyingContract: PREP.collateralProxy,
+                salt: PREP.adminSalt,
+            },
+            types: rainWithdrawEip712Types,
+            primaryType: 'Withdraw',
+            message: {
+                user: PREP.adminAddress,
+                asset: PREP.tokenAddress,
+                amount: 30040000n,
+                recipient: PREP.recipientAddress,
+                nonce: 7n,
+            },
+        })
+    })
+})
diff --git a/src/utils/featureFlag.utils.ts b/src/utils/featureFlag.utils.ts
new file mode 100644
index 0000000000..ea03d87070
--- /dev/null
+++ b/src/utils/featureFlag.utils.ts
@@ -0,0 +1,35 @@
+import posthog from 'posthog-js'
+import { BASE_URL } from '@/constants/general.consts'
+import { CHAIN_ROLLOUT_FLAGS } from '@/constants/chainRegistry.consts'
+
+/**
+ * PostHog feature flags — the runtime-toggle primitive (non-reactive reads;
+ * components use the `useFeatureFlags` / `useChainRollout` hooks so they
+ * re-render when flags load).
+ *
+ * DOCTRINE (mono engineering/patterns/feature-gates.md): a PostHog flag
+ * answers "have we LAUNCHED this?" — flipped in the PostHog UI, no deploy,
+ * cohort/% targeting. It is NOT a kill-switch: incident switches stay in
+ * code (`underMaintenance.config.ts`). Flags are scaffolding — delete them
+ * once a launch is permanent.
+ */
+const IS_PROD_DOMAIN = BASE_URL === 'https://peanut.me'
+
+export interface FeatureFlagOptions {
+    /** Treat the flag as ON outside the prod domain (rollout-gate semantics:
+     *  staging/preview/local always see the feature so QA can test
+     *  pre-launch; prod fails CLOSED when PostHog is unavailable). */
+    nonProdBypass?: boolean
+}
+
+export function isFeatureFlagEnabled(flagKey: string, options: FeatureFlagOptions = {}): boolean {
+    if (options.nonProdBypass && !IS_PROD_DOMAIN) return true
+    return posthog.isFeatureEnabled(flagKey) ?? false
+}
+
+/** Chains without a rollout flag (the legacy set) are always on. */
+export function isChainRolledOut(chainKey: string): boolean {
+    const flag = CHAIN_ROLLOUT_FLAGS[chainKey]
+    if (!flag) return true
+    return isFeatureFlagEnabled(flag, { nonProdBypass: true })
+}
diff --git a/src/utils/kernelMigration.utils.ts b/src/utils/kernelMigration.utils.ts
new file mode 100644
index 0000000000..a52fb1a4ab
--- /dev/null
+++ b/src/utils/kernelMigration.utils.ts
@@ -0,0 +1,135 @@
+import type { Address, Hex, TransactionReceipt } from 'viem'
+import { encodeFunctionData, erc20Abi } from 'viem'
+import { PEANUT_WALLET_TOKEN } from '@/constants/zerodev.consts'
+
+/**
+ * Pre-2025-09-18 accounts run on the unpatched v0.0.2 passkey validator until
+ * their first root-validated userOp, which the SDK auto-wraps in a
+ * `migrateWithCall` that swaps the root validator to v0.0.3 BEFORE executing
+ * the wrapped calls. Any EIP-1271 signature produced before that userOp (the
+ * Rain admin EIP-712 in a `mixed` spend) is routed to v0.0.2 and becomes
+ * invalid the instant the migration inside the same userOp runs — the whole
+ * op reverts with "Delegatecall failed", deterministically.
+ *
+ * Fix: when the account is still unmigrated and the flow carries a pre-signed
+ * EIP-1271 signature, run the migration as its own no-op userOp first, then
+ * rebuild the kernel client so all subsequent signatures route to v0.0.3.
+ * See ops/notify/zerodev-v002-stuck-card-withdrawals-2026-07-06.md (mono).
+ */
+
+/** Shape added by `createKernelMigrationAccount` — absent on plain accounts. */
+export interface MigrationCapableAccount {
+    address: Address
+    getRootValidatorMigrationStatus?: () => Promise<boolean>
+}
+
+export const isMigrationWrapperAccount = (account: unknown): account is Required<MigrationCapableAccount> =>
+    typeof (account as MigrationCapableAccount)?.getRootValidatorMigrationStatus === 'function'
+
+/**
+ * The payload for the standalone migration userOp: a zero-value USDC
+ * self-transfer. The SDK wraps it in `migrateWithCall`; the migration is the
+ * point, the transfer is a proven-harmless no-op (verified by on-chain
+ * simulation of the affected account — see the RCA above).
+ */
+export const buildMigrationNoopCall = (accountAddress: Address): { to: Hex; value: bigint; data: Hex } => ({
+    to: PEANUT_WALLET_TOKEN as Hex,
+    value: 0n,
+    data: encodeFunctionData({
+        abi: erc20Abi,
+        functionName: 'transfer',
+        args: [accountAddress, 0n],
+    }),
+})
+
+/** Transient: the migration hasn't been observed on-chain yet — retrying is correct. */
+export class KernelMigrationPendingError extends Error {
+    constructor() {
+        super('Account security upgrade did not confirm in time — please retry in a moment')
+        this.name = 'KernelMigrationPendingError'
+    }
+}
+
+/** Deterministic: the migration userOp reverted on-chain — retrying cannot succeed. */
+export class KernelMigrationFailedError extends Error {
+    constructor() {
+        super('Account security upgrade failed — please contact support')
+        this.name = 'KernelMigrationFailedError'
+    }
+}
+
+const delay = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms))
+
+export interface EnsureMigratedDeps<TClient extends { account?: unknown }> {
+    /** The client currently held by the caller (possibly a migration wrapper). */
+    client: TClient
+    /** Sends the no-op userOp through the wrapper account (which adds the migration). */
+    sendNoopUserOp: (call: ReturnType<typeof buildMigrationNoopCall>) => Promise<{ receipt: TransactionReceipt | null }>
+    /** Rebuilds the kernel client from scratch so signing routes to the new validator. */
+    rebuildClient: () => Promise<TClient>
+    /** Optional analytics hook, called with the step outcome. */
+    onEvent?: (event: 'attempted' | 'succeeded') => void
+    /** On-chain status verification attempts / spacing (overridable for tests). */
+    statusRetries?: number
+    statusIntervalMs?: number
+}
+
+/**
+ * Guarantees the account behind `client` is on the patched root validator
+ * before the caller produces any EIP-1271 signature that will be verified
+ * inside its own (otherwise migration-wrapped) userOp.
+ *
+ * - Plain (already-patched / post-cutoff) account → returns `client` untouched.
+ * - Wrapper account, already migrated on-chain (e.g. migrated earlier this
+ *   session) → rebuilds only: the wrapper still SIGNS via the old validator
+ *   even after migration, so its signatures would be rejected.
+ * - Wrapper account, unmigrated → sends the migration userOp, verifies the
+ *   migration against the ON-CHAIN root validator (never the bundle receipt —
+ *   4337 reverts still produce successful bundles), then rebuilds and asserts
+ *   the wrapper is gone.
+ */
+export async function ensureRootValidatorMigrated<TClient extends { account?: unknown }>(
+    deps: EnsureMigratedDeps<TClient>
+): Promise<TClient> {
+    const account = deps.client.account
+    if (!isMigrationWrapperAccount(account)) return deps.client
+    const retries = deps.statusRetries ?? 5
+    const intervalMs = deps.statusIntervalMs ?? 1500
+
+    const migrated = await account.getRootValidatorMigrationStatus()
+    if (!migrated) {
+        deps.onEvent?.('attempted')
+        const { receipt } = await deps.sendNoopUserOp(buildMigrationNoopCall(account.address))
+        if (receipt?.status === 'reverted') {
+            // The bundle itself reverted — deterministic; retrying cannot help.
+            throw new KernelMigrationFailedError()
+        }
+        // ERC-4337: a REVERTED userOp still yields a SUCCESSFUL bundle receipt
+        // (the EntryPoint's handleOps tx succeeds; only the userOp-level
+        // `success` flag is false, and handleSendUserOpEncoded drops it). The
+        // receipt is therefore NOT proof of migration — verify against ground
+        // truth by re-reading the on-chain root validator, with a short poll
+        // to ride out RPC propagation. A null receipt (timeout) takes the same
+        // path: if the op actually landed, the status flips and we proceed.
+        let confirmed = false
+        for (let attempt = 0; attempt < retries && !confirmed; attempt++) {
+            confirmed = await account.getRootValidatorMigrationStatus()
+            if (!confirmed && attempt < retries - 1) await delay(intervalMs)
+        }
+        if (!confirmed) throw new KernelMigrationPendingError()
+        deps.onEvent?.('succeeded')
+    }
+
+    // Rebuild — and verify the wrapper is actually gone. The rebuild re-reads
+    // the root validator through the public RPC, which can lag the bundler
+    // that confirmed the migration; a lagging node hands back another
+    // v0.0.2-signing wrapper whose signatures would revert exactly like the
+    // bug this gate exists to fix. Fail closed rather than sign wrong.
+    let rebuilt = await deps.rebuildClient()
+    if (isMigrationWrapperAccount(rebuilt.account)) {
+        await delay(intervalMs)
+        rebuilt = await deps.rebuildClient()
+        if (isMigrationWrapperAccount(rebuilt.account)) throw new KernelMigrationPendingError()
+    }
+    return rebuilt
+}
diff --git a/src/utils/rainWithdraw.utils.ts b/src/utils/rainWithdraw.utils.ts
new file mode 100644
index 0000000000..9aefe7bf3c
--- /dev/null
+++ b/src/utils/rainWithdraw.utils.ts
@@ -0,0 +1,43 @@
+import type { Address, Hex } from 'viem'
+import {
+    RAIN_WITHDRAW_EIP712_DOMAIN_NAME,
+    RAIN_WITHDRAW_EIP712_DOMAIN_VERSION,
+    rainWithdrawEip712Types,
+} from '@/constants/rain.consts'
+
+/** The fields of a `/rain/withdrawals/prepare` response the admin signature covers. */
+export interface RainWithdrawPrep {
+    collateralProxy: string
+    adminSalt: string
+    adminAddress: string
+    tokenAddress: string
+    amount: string
+    recipientAddress: string
+    adminNonce: string
+}
+
+/**
+ * Single source of truth for the Rain withdraw admin EIP-712 payload.
+ * Both the collateral-only and mixed spend paths sign EXACTLY this object;
+ * any drift between what is signed and what the coordinator verifies via
+ * ERC-1271 bricks the withdrawal, so it is built in one place only.
+ */
+export const buildRainWithdrawTypedData = (prep: RainWithdrawPrep, chainId: number) =>
+    ({
+        domain: {
+            name: RAIN_WITHDRAW_EIP712_DOMAIN_NAME,
+            version: RAIN_WITHDRAW_EIP712_DOMAIN_VERSION,
+            chainId,
+            verifyingContract: prep.collateralProxy as Address,
+            salt: prep.adminSalt as Hex,
+        },
+        types: rainWithdrawEip712Types,
+        primaryType: 'Withdraw',
+        message: {
+            user: prep.adminAddress as Address,
+            asset: prep.tokenAddress as Address,
+            amount: BigInt(prep.amount),
+            recipient: prep.recipientAddress as Address,
+            nonce: BigInt(prep.adminNonce),
+        },
+    }) as const