Passkeys in the WebView builds: the apps name v3.coinos.io too, and a failed passkey sign-in no longer goes on to make a new one. Coinos Beta's passkey sign-in failed after the account was picked — "CredMan getCredential call failed … RP ID cannot be validated" (Pixel 9, 2026-11-06). An app's association with a site runs both ways: the site's assetlinks.json names the app (it did), and the app's manifest names the site through asset_statements meta-data — which the TWA has and the webview/fcm manifests didn't. They declare it now, and the shared asset_statements string carries get_login_creds beside handle_all_urls. And passkeyLogin rolled any sign-in failure into creating a passkey, so the validation error was followed by a second, failed create dialog: only NotAllowedError (how browsers report "no passkey here", or a dismissed sheet) leads to creating one now; any other error is shown

2026-11-07T06:37:49Z

Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01VMan6Ts5Tktega8VbLg31q

A third Android build, fcm (io.coinos.beta, "Coinos Beta"): the wallet in its own WebView, as the webview build, with Firebase Cloud Messaging for push on phones with Google Play Services — no distributor app to install. A user on the TWA APK found launching slow next to Minibits (2026-11-05); measured on a Pixel 9, a WebView paints ~0.7 s sooner than a cold Chrome. This build installs beside the TWA for a side-by-side trial before deciding whether it replaces it. Fcm asks for the token and stores "fcm:" as the push endpoint, which reaches the page down the UnifiedPush road (?up= on the next launch, or written straight into the page's localStorage once it has loaded, since the token arrives after the first load starts); nwcpush (coinosv3-server 0c50417) sends an fcm: endpoint through Firebase. FcmService hands a message's "body" to the same handler UnifiedPush messages use (PushReceiver.onPush: wake the wallet off-screen, notify unless it answered a silent request). Firebase is set up in code (CoinosApp → Fcm.init) from values build.gradle reads out of app/google-services.json (gitignored) — without it the build still builds and falls back to UnifiedPush. The webview and fdroid builds get a stub Fcm (src/nofcm) and carry no Google code; the notification permission is asked when Firebase or a distributor can deliver; CoinosHost.env reports app "fcm"

2026-11-07T06:01:15Z

Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01VMan6Ts5Tktega8VbLg31q