Require non-empty txid AND amount AND address against one get_transfers row. Signed rcp alone never sets verified=1.
Signed inv/rcp codecs keyed by identity, payments table with unverified incoming receipts, optional JSON-RPC sidecar (loopback/.onion HTTP only), and TUI /pay /tip. OnionWire still holds no spend keys.