NewYorican metadata review source snapshot

This is a bounded snapshot of public-key-only application code, its pinned
dependency lockfile and public account fixtures. It contains no private keys,
credentials, private business documents or ready-to-submit transaction payload.

The current wallet-review setting and mode are recorded in source-manifest.json
and metadata-settings.mjs. A paused build permits no wallet request. An owner
retry build permits one owner-triggered request per page session with Guards
enabled. Stop if Solflare blocks or warns again. This package is for inspection;
it is not security clearance or an independent audit.

To reproduce in an isolated Node environment: npm ci; npm test; npm run build.
Those commands download pinned public registry dependencies and do not need a
wallet or credentials. Only dist/update.js is generated by the build.
The checked browser bundle hash is recorded in the adjacent source-manifest.json.
No build or test command signs or sends a blockchain transaction.

Scope: one Metaplex UpdateV1 for the existing NewYorican mint, proposed NYR to
NYCOQ ticker and corrected IPFS URI; current artwork unchanged, metadata stays
editable, mint/freeze authorities stay absent. Permanent locking is unavailable.
The source uses the official Solflare SDK signAndSendTransaction flow only in
the owner handler. It does not pre-sign, strip wallet assertions or
compare the wallet's returned transaction bytes against an unmodified template.
Application payload checks run before a request and finalized state checks after.

Project checks cannot establish which private/dynamic provider signal caused
the observed Scam site detected block. The original NYR token and pool remain.