Tiny Place audit follow-ups — residual Directory, Ledger, Messages, Identities, and Bounties gaps #5333

Summary

Carry the audit items from #4776 that are still unshipped on main into a single tracked follow-up, so that audit can close without losing them. Every item below was re-verified read-only against upstream/main a40ba85ac (submodule vendor/tinyplace @ d2545054) — none is speculative, and none is blocked on an upstream tiny.place contract change.

Problem / Context

#4776 was a full end-to-end audit of every Tiny Place surface. It spawned 12 sub-issues (#4920–#4931), all of which are now closed, and its last two open PRs (#5271 Directory search + pagination, #5278 Ledger filters + copy tx-id) merged on 2026-08-02. Three items were resolved as N/A — web-only / de-scoped because the pinned SDK exposes no contract for them (#4920 seller side → #5193, #4922 world relay presence, #4924 post media → #5295).

What is left is the residue: audit checkboxes that were never covered by a sub-issue and never shipped. They are all frontend/core wiring against surface the pinned SDK already exposes, plus a set of items that simply need a runtime pass on staging. Keeping them in a closed audit issue would bury them, so they move here.

Scope

In scope: the verified-remaining items below. Out of scope: anything needing a tiny.place SDK/backend contract change (post media, marketplace seller routes, world presence) — those are settled as web-only/de-scoped and should not be re-litigated here.

Acceptance criteria

§6 Directory — app/src/agentworld/pages/DirectorySection.tsx

• Send DM from a directory card — no messaging affordance exists on a card today; a would-be sender has to go to Messages and retype the handle.
• Filter by type (agent / human / org) — the only filter in the file is the agentId dedupe at DirectorySection.tsx:142; there is no type control.
• Own handle appears in the directory after registration — needs-runtime: staging + a freshly registered handle.

§4 Ledger — app/src/agentworld/pages/LedgerSection.tsx

• Real-time updates on new tx — the section has no stream subscription at all (no useTinyplaceStream); rows only refresh on mount / "Load more".
• Wallet balance reflects ledger state — the file imports fetchWalletStatus for the viewer-relative direction filter (feat(agent-world): Tiny Place ledger filters + copy tx-id (#4776 §4) #5278) but renders no balance; balance still lives only in the x402 confirm card.
• Bounty payouts appear as ledger rows — needs-runtime: depends on what the backend emits for a settled bounty.

§3 Messages (DMs) — app/src/agentworld/pages/MessagingSection.tsx

• Message status (sent / delivered / read) — the thread renders an optimistic bubble only; no receipt state anywhere in the file.
• Block / report a sender — no such action exists (the sole block hits are a Tailwind class at :550 and the not-a-contact log at :1056).
• Attachments / media in DMs — no upload or attachment path.
• Conversation list + search in the DM panel — a DM is still opened by typing a handle; there is no persisted conversation list to search.

§7 Identities — app/src/agentworld/pages/IdentitiesSection.tsx

• Handle renewal is unreachable — the pinned SDK already ships registry.renew (vendor/tinyplace/sdk/rust/src/api/registry.rs:232), but it has no tinyplace_registry_renew handler in src/openhuman/tinyplace/ and no UI caller. Same shape as [Tiny Place] Handle transfer is unreachable — SDK registry.transfer has no core RPC handler or UI #4929 (transfer), which was closed by wiring the existing SDK method end-to-end in fix(tinyplace): wire handle transfer end-to-end (Closes #4929) #4998.
• Handle expiry visible in the list — no expiry rendering in IdentitiesSection.tsx; blocks a user from knowing renewal is even needed.
• Bulk handle actions — not built (tracked upstream as tiny.place/[Feature] E2E: Memory persistence across app restart #211).

§5 Bounties — app/src/agentworld/pages/BountiesSection.tsx

• Filter bounties by status / asset — no filter or tab control in the section.
• Bounty history (created / claimed) — no per-user history view. Cancel is wired (handleCancel :792 → apiClient.bounties.cancel); expire is backend-driven and needs-runtime.

§10 Cross-cutting — runtime verification pass (needs a staging build + funded wallet; the audit was code-level only)

• All sections verified on macOS, Windows, and Linux desktop.

• All sections verified over web (tinyhumans.ai), not just the desktop app.

• JWT / auth-token refresh does not break a Tiny Place session mid-use.

• Offline / disconnected state degrades gracefully in each section (no silent crash).

• Diff coverage ≥ 80% — each implementing PR meets the changed-lines coverage gate (Vitest + cargo-llvm-cov, enforced by .github/workflows/ci-lite.yml).

Related

• Parent audit (closed): Audit: Tiny Place end-to-end integration — World, Feed, Messages, Ledger, Bounties, Directory, Identities, Profiles #4776
• Tiny Place epic: Epic: Tiny Place — full feature completion (World, Feed, Identities, Trading, Wallet, Bounties) #4190
• Precedent for the renewal item — wire an existing SDK method end-to-end: [Tiny Place] Handle transfer is unreachable — SDK registry.transfer has no core RPC handler or UI #4929 → fix(tinyplace): wire handle transfer end-to-end (Closes #4929) #4998
• Settled as web-only / de-scoped, do not re-open here: [Tiny Place] Identity marketplace is buyer-only: no list-for-sale or accept/reject-offer path #4920 (→ feat(tinyplace): resolve identity marketplace seller-side as web-only (#4920) #5193), [Tiny Place] World: no relay-backed presence / real-time world-state sync (local procedural sim only) #4922, [Tiny Place] Feed: posts don't support images/media (no media field in contract) #4924 (→ feat(tinyplace): resolve feed post media as web-only (#4924) #5295)
• Design port still open: Port tiny.place website designs for Feed, Profile, and Bounties #3853