System Accounts: treasury view + gated fund movement (bankowner/funder/dealer)

[islandbitcoin]

Adds a System Accounts desk page (/app/system-accounts) giving operators the treasury handle that cashout testing needs — live bankowner/funder/dealer balances, cashout-coverage math, and a gated way to move funds between system wallets. This is the admin handle called for before consolidating the parked ops accounts (ENG-492).

What it does

View (require_financial — System Manager + Accounts Manager):

• Pulse tiles: BankOwner Float, Outstanding Payables (USD-equiv of Pending/Draft/In-Progress cashouts), Free Float (float − payables, red when negative), Funder Float
• A card per role account (bankowner/funder/dealer) plus an optional watchlist of ops accounts, each with live IBEX balance and expandable transaction activity (reusing the census tx-type labels)

Move funds (System Manager only):

• Transfer between transfer-enabled wallets via the IBEX add-invoice-on-receiver / pay-from-sender primitive the flash cutover code uses; review → confirm → execute
• Per-transfer cap from site_config (system_transfer_cap_usd, default $100)
• Every attempt recorded in an append-only System Transfer Log before the IBEX call

UI-managed watchlist with per-account transfer opt-in: watch any ops account from the page (validated against mongo); it's view-only until you explicitly enable transfers on it — only then is it a valid transfer endpoint. This is the safe path to consolidate parked accounts (watch → enable → move → disable).

Money-flow basis (verified in the flash backend)

wallets.id IS the IBEX account id (system accounts too); a cashout is the user paying an invoice on bankowner, so bankowner float grows with cashouts and the fiat owed is the liability. Role accounts are identified by mongo accounts.role.

New backend surface

• api/system_accounts.py — resolve accounts, payables, transfer, watchlist management
• api/ibex_client.py gains exactly two writes (add_invoice, pay_invoice) behind _post; a contract test pins the write surface to those two endpoints
• Two doctypes: System Transfer Log (append-only), System Watchlist
• One shared fix: handle_api_errors now re-raises frappe.ValidationError/PermissionError so deliberate throw() messages (e.g. the cap) reach the operator instead of being masked as "internal error" — this was a latent bug affecting every admin endpoint

Adversarial money-safety review (multi-agent) + fixes

An 8-dimension + completeness-critic review confirmed 14 findings; all fixed in fb73981:

• Critical — double-spend on retry: a pay_invoice HTTP timeout was logged "Failed", but a Lightning payment can settle after the HTTP call times out → operator retries → funds move twice. Fixed: a timeout marks a distinct Pending status (never Failed), and an idempotency guard refuses a new transfer from a wallet with any unresolved (Draft/Pending) prior.
• Major — false success: the pay result wasn't inspected, so a 200-with-FAILED body logged "Paid". New _payment_settled() gates Paid on an affirmative SUCCEEDED, fail-safe to Pending on any ambiguous shape.
• Major — dropped balances / BTC leak: the currency fallback returned title-case ("Usdt"/"Btc"), failing the uppercase checks → balances silently zeroed and BTC leaked into the picker as dollars. Normalized to uppercase at the source.
• Major — dead watchlist buttons for id-added entries; now thread the exact stored watch_ref.
• Minor: NaN bypassed the cap (math.isfinite guard); the raw IBEX response incl. the LN preimage was returned to the browser (now returns only {success, log, status}); config-masks-doctype watchlist edge.

Tests

test_system_accounts_page_contract.py (16 tests) pins the money-safety invariants: log-before-move ordering, System-Manager-only transfer, cap enforcement (was unpinned — could have been deleted green), Paid-only-on-settlement, Pending-on-timeout, the idempotency guard, the NaN guard, no-raw-response-leak, IBEX write-surface lock, activity membership revalidation, append-only doctype, per-account opt-in. Suite: 60 passed; the 3 remaining failures are the pre-existing stale test_account_hub_search_js tests.

Verification

Every path verified live against IBEX sandbox: seeded role + watchlist accounts, ran real transfers (happy-path marks Paid with no preimage leak; funder→bankowner and bankowner→watchlist both settled and logged), and confirmed every guard rejects — cap, non-finite amount, non-transfer-enabled wallet, and the dedup guard blocking a retry while a Pending row exists. The _payment_settled fail-safe logic is unit-tested across success/failure/ambiguous/malformed shapes.

Deploy notes

• New site_config key: set system_transfer_cap_usd on TEST and prod (per-transfer cap; default $100 if unset). Same mechanism as the IBEX creds: bench --site <site> set-config system_transfer_cap_usd <n>.
• Page JS is redis-cached → bench clear-cache after the image bump.
• Two new doctypes migrate cleanly; the page registers via setup.py sync_pages + the workspace fixture.
• The system_transfer_cap_usd cap lives in site_config precisely so a web-only System Manager can't raise their own limit — changing it needs shell/bench access.

🤖 Generated with Claude Code