fix(wallet-toolbox): keep storage traces off auth wire

docs/packages/wallet/wallet-toolbox-client.md

@@ -3,9 +3,9 @@ id: pkg-wallet-toolbox-client
 title: '@bsv/wallet-toolbox-client'
 kind: package
 domain: wallet
-version: '2.4.20'
-last_updated: '2026-07-30'
-last_verified: '2026-07-30'
+version: '2.4.21'
+last_updated: '2026-07-31'
+last_verified: '2026-07-31'
 review_cadence_days: 30
 npm: 'https://www.npmjs.com/package/@bsv/wallet-toolbox-client'
 repo: 'https://github.com/bsv-blockchain/ts-stack/tree/main/packages/wallet/wallet-toolbox/client'
@@ -18,6 +18,8 @@ tags: [wallet, browser, indexeddb, storage, brc-100]
 `@bsv/wallet-toolbox-client` is the browser-safe Wallet Toolbox distribution.
 It includes the BRC-100 wallet, signer, services, IndexedDB storage, and remote
 storage client without Node-only Knex, SQLite, MySQL, or filesystem adapters.
+Opt-in remote-storage timing spans retain trace and parent-span correlation in
+the telemetry sink without adding headers to authenticated requests.
 
 ## Install
 

docs/packages/wallet/wallet-toolbox-mobile.md

@@ -3,9 +3,9 @@ id: pkg-wallet-toolbox-mobile
 title: '@bsv/wallet-toolbox-mobile'
 kind: package
 domain: wallet
-version: '2.4.20'
-last_updated: '2026-07-30'
-last_verified: '2026-07-30'
+version: '2.4.21'
+last_updated: '2026-07-31'
+last_verified: '2026-07-31'
 review_cadence_days: 30
 npm: 'https://www.npmjs.com/package/@bsv/wallet-toolbox-mobile'
 repo: 'https://github.com/bsv-blockchain/ts-stack/tree/main/packages/wallet/wallet-toolbox/mobile'
@@ -18,6 +18,8 @@ tags: [wallet, react-native, mobile, storage, brc-100]
 `@bsv/wallet-toolbox-mobile` is the React Native and mobile-safe Wallet
 Toolbox distribution. It includes wallet, signer, services, monitoring, and
 remote storage surfaces without Knex, SQLite/MySQL, IndexedDB, or Node-only IO.
+Opt-in remote-storage timing spans retain trace and parent-span correlation in
+the telemetry sink without adding headers to authenticated requests.
 
 ## Install
 

docs/packages/wallet/wallet-toolbox.md

@@ -4,9 +4,9 @@ title: '@bsv/wallet-toolbox'
 kind: package
 domain: wallet
 npm: '@bsv/wallet-toolbox'
-version: '2.4.20'
-last_updated: '2026-07-30'
-last_verified: '2026-07-30'
+version: '2.4.21'
+last_updated: '2026-07-31'
+last_verified: '2026-07-31'
 review_cadence_days: 30
 status: stable
 tags: ['wallet', 'brc100']
@@ -19,6 +19,10 @@ repo: 'https://github.com/bsv-blockchain/ts-stack/tree/main/packages/wallet/wall
 
 Use this package when you are building a wallet product, a wallet-like service, or another implementation that must match BRC-100 behavior.
 
+Opt-in remote-storage timing spans retain trace and parent-span correlation in
+the telemetry sink without adding headers to authenticated requests. BRC-103,
+BRC-104, AuthFetch, and the storage RPC wire contract remain unchanged.
+
 ## Install
 
 ```bash

docs/reference/package-api-migrations.md

@@ -52,9 +52,9 @@ and clean-consumer tests remain the executable type authority.
 | `@bsv/verifast`                   | `0.3.0`      | `0.3.4`  | patch     | [API and usage](../packages/sdk/verifast.md)                          | No consumer migration is required; exports, verification behavior, worker protocols, package paths, and runtime defaults are unchanged.                                                                                                                                                                                       |
 | `@bsv/wallet-helper`              | `0.1.1`      | `0.1.6`  | patch     | [API and usage](../packages/helpers/wallet-helper.md)                 | No consumer migration is required; fluent builder APIs and transaction semantics are unchanged.                                                                                                                                                                                                                               |
 | `@bsv/wallet-relay`               | `0.2.2`      | `0.3.4`  | minor     | [API and usage](../packages/wallet/wallet-relay.md)                   | QRPairingCode now renders a native button and accepts button wrapper attributes. Existing className, style, data, and ARIA props continue to work; update div-specific wrapper selectors or explicitly typed div event handlers. Express integrations now use the host application's matching Express runtime and type graph. |
-| `@bsv/wallet-toolbox`             | `2.4.4`      | `2.4.20` | patch     | [API and usage](../packages/wallet/wallet-toolbox.md)                 | No consumer migration is required; persisted schemas, provider behavior, transaction construction, monitor behavior, and the 2.x wallet and storage interfaces remain compatible.                                                                                                                                             |
-| `@bsv/wallet-toolbox-client`      | `2.4.4`      | `2.4.20` | patch     | [API and usage](../packages/wallet/wallet-toolbox-client.md)          | No consumer migration is required; client entry points and remote storage contracts remain compatible.                                                                                                                                                                                                                        |
-| `@bsv/wallet-toolbox-mobile`      | `2.4.4`      | `2.4.20` | patch     | [API and usage](../packages/wallet/wallet-toolbox-mobile.md)          | No consumer migration is required; React Native and mobile bridge contracts remain compatible.                                                                                                                                                                                                                                |
+| `@bsv/wallet-toolbox`             | `2.4.4`      | `2.4.21` | patch     | [API and usage](../packages/wallet/wallet-toolbox.md)                 | No consumer migration is required; BRC-103/104, AuthFetch, Auth Express Middleware, AuthSocket, JSON-RPC, persisted schemas, provider behavior, and the 2.x wallet and storage interfaces remain unchanged.                                                                                                                   |
+| `@bsv/wallet-toolbox-client`      | `2.4.4`      | `2.4.21` | patch     | [API and usage](../packages/wallet/wallet-toolbox-client.md)          | No consumer migration is required; BRC-103/104, AuthFetch, browser entry points, and remote storage contracts remain unchanged.                                                                                                                                                                                               |
+| `@bsv/wallet-toolbox-mobile`      | `2.4.4`      | `2.4.21` | patch     | [API and usage](../packages/wallet/wallet-toolbox-mobile.md)          | No consumer migration is required; BRC-103/104, AuthFetch, React Native, mobile bridge, and remote storage contracts remain unchanged.                                                                                                                                                                                        |
 | `create-bsv-app`                  | `1.0.2`      | `1.0.4`  | patch     | [API and usage](../packages/helpers/create-bsv-app.md)                | No consumer migration is required; generated application structure and CLI behavior are unchanged.                                                                                                                                                                                                                            |
 
 `none` means the source manifest matches the recorded npm baseline. Any other
@@ -477,8 +477,8 @@ CLI entry points: `{"wallet-relay":"./bin/init.mjs"}`.
 
 - Package documentation: [docs/packages/wallet/wallet-toolbox.md](../packages/wallet/wallet-toolbox.md)
 - Source: [packages/wallet/wallet-toolbox](https://github.com/bsv-blockchain/ts-stack/tree/main/packages/wallet/wallet-toolbox)
-- Release note: Adds atomic action-batch transport, storage and proof resilience, security hardening, compatible runtime dependency maintenance, strict package contracts, broad maintainability remediation, explicit manual-suite governance, safe operator/example tooling, redacted diagnostic summaries across wallet, monitor, provider, action-batch, storage, proof, and Chaintracks paths, and canonical root contribution guidance.
-- Migration: No consumer migration is required; persisted schemas, provider behavior, transaction construction, monitor behavior, and the 2.x wallet and storage interfaces remain compatible.
+- Release note: Adds atomic action-batch transport, storage and proof resilience, security hardening, compatible runtime dependency maintenance, strict package contracts, broad maintainability remediation, safe telemetry, and restores remote-storage compatibility by retaining trace correlation locally instead of adding unsupported AuthFetch headers.
+- Migration: No consumer migration is required; BRC-103/104, AuthFetch, Auth Express Middleware, AuthSocket, JSON-RPC, persisted schemas, provider behavior, and the 2.x wallet and storage interfaces remain unchanged.
 
 | Public subpath   | Runtime target(s)                                    | Declaration target(s)      |
 | ---------------- | ---------------------------------------------------- | -------------------------- |
@@ -491,8 +491,8 @@ CLI entry points: `{"wallet-relay":"./bin/init.mjs"}`.
 
 - Package documentation: [docs/packages/wallet/wallet-toolbox-client.md](../packages/wallet/wallet-toolbox-client.md)
 - Source: [packages/wallet/wallet-toolbox/client](https://github.com/bsv-blockchain/ts-stack/tree/main/packages/wallet/wallet-toolbox/client)
-- Release note: Carries the lockstep Wallet Toolbox client candidate with transport, validation, storage, provider, dependency, package, declaration, test, operator-procedure hardening, and the synchronized contributor-policy release boundary.
-- Migration: No consumer migration is required; client entry points and remote storage contracts remain compatible.
+- Release note: Carries the lockstep Wallet Toolbox browser candidate with safe local trace correlation and no unsupported authenticated request headers.
+- Migration: No consumer migration is required; BRC-103/104, AuthFetch, browser entry points, and remote storage contracts remain unchanged.
 
 | Public subpath   | Runtime target(s)                                                                | Declaration target(s)                                                                  |
 | ---------------- | -------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------- |
@@ -503,8 +503,8 @@ CLI entry points: `{"wallet-relay":"./bin/init.mjs"}`.
 
 - Package documentation: [docs/packages/wallet/wallet-toolbox-mobile.md](../packages/wallet/wallet-toolbox-mobile.md)
 - Source: [packages/wallet/wallet-toolbox/mobile](https://github.com/bsv-blockchain/ts-stack/tree/main/packages/wallet/wallet-toolbox/mobile)
-- Release note: Carries the lockstep Wallet Toolbox mobile candidate with platform, React Native preset, transport, storage, provider, package, declaration, test, operator-procedure hardening, and the synchronized contributor-policy release boundary.
-- Migration: No consumer migration is required; React Native and mobile bridge contracts remain compatible.
+- Release note: Carries the lockstep Wallet Toolbox mobile candidate with safe local trace correlation and no unsupported authenticated request headers.
+- Migration: No consumer migration is required; BRC-103/104, AuthFetch, React Native, mobile bridge, and remote storage contracts remain unchanged.
 
 | Public subpath   | Runtime target(s)                                                                | Declaration target(s)                                                                  |
 | ---------------- | -------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------- |

docs/reference/stack-facts.md

@@ -65,9 +65,9 @@ authorized release action.
 | wallet | `@bsv/btms` | `1.1.4` | node-library | node-cjs, node-esm | node | `>=22` | [packages/wallet/btms](https://github.com/bsv-blockchain/ts-stack/tree/main/packages/wallet/btms) |
 | wallet | `@bsv/btms-permission-module` | `1.1.3` | node-library | node-esm | node | `>=22` | [packages/wallet/btms-permission-module](https://github.com/bsv-blockchain/ts-stack/tree/main/packages/wallet/btms-permission-module) |
 | wallet | `@bsv/wallet-relay` | `0.3.4` | cli-library | browser-bundler, browser-esm, cli, node-cjs, node-esm | browser, node | `>=22` | [packages/wallet/ts-wallet-relay](https://github.com/bsv-blockchain/ts-stack/tree/main/packages/wallet/ts-wallet-relay) |
-| wallet | `@bsv/wallet-toolbox` | `2.4.20` | node-library | node-cjs | node | `>=22` | [packages/wallet/wallet-toolbox](https://github.com/bsv-blockchain/ts-stack/tree/main/packages/wallet/wallet-toolbox) |
-| wallet | `@bsv/wallet-toolbox-client` | `2.4.20` | browser-library | browser-bundler, browser-esm, node-cjs, node-esm | browser, node | `>=22` | [packages/wallet/wallet-toolbox/client](https://github.com/bsv-blockchain/ts-stack/tree/main/packages/wallet/wallet-toolbox/client) |
-| wallet | `@bsv/wallet-toolbox-mobile` | `2.4.20` | react-native-library | react-native-metro | react-native | `>=22` | [packages/wallet/wallet-toolbox/mobile](https://github.com/bsv-blockchain/ts-stack/tree/main/packages/wallet/wallet-toolbox/mobile) |
+| wallet | `@bsv/wallet-toolbox` | `2.4.21` | node-library | node-cjs | node | `>=22` | [packages/wallet/wallet-toolbox](https://github.com/bsv-blockchain/ts-stack/tree/main/packages/wallet/wallet-toolbox) |
+| wallet | `@bsv/wallet-toolbox-client` | `2.4.21` | browser-library | browser-bundler, browser-esm, node-cjs, node-esm | browser, node | `>=22` | [packages/wallet/wallet-toolbox/client](https://github.com/bsv-blockchain/ts-stack/tree/main/packages/wallet/wallet-toolbox/client) |
+| wallet | `@bsv/wallet-toolbox-mobile` | `2.4.21` | react-native-library | react-native-metro | react-native | `>=22` | [packages/wallet/wallet-toolbox/mobile](https://github.com/bsv-blockchain/ts-stack/tree/main/packages/wallet/wallet-toolbox/mobile) |
 
 ## Standalone infrastructure manifests
 

governance/package-release-notes.json

@@ -196,22 +196,22 @@
       "name": "@bsv/wallet-toolbox",
       "publishedVersion": "2.4.4",
       "releaseType": "patch",
-      "summary": "Adds atomic action-batch transport, storage and proof resilience, security hardening, compatible runtime dependency maintenance, strict package contracts, broad maintainability remediation, explicit manual-suite governance, safe operator/example tooling, redacted diagnostic summaries across wallet, monitor, provider, action-batch, storage, proof, and Chaintracks paths, and canonical root contribution guidance.",
-      "migration": "No consumer migration is required; persisted schemas, provider behavior, transaction construction, monitor behavior, and the 2.x wallet and storage interfaces remain compatible."
+      "summary": "Adds atomic action-batch transport, storage and proof resilience, security hardening, compatible runtime dependency maintenance, strict package contracts, broad maintainability remediation, safe telemetry, and restores remote-storage compatibility by retaining trace correlation locally instead of adding unsupported AuthFetch headers.",
+      "migration": "No consumer migration is required; BRC-103/104, AuthFetch, Auth Express Middleware, AuthSocket, JSON-RPC, persisted schemas, provider behavior, and the 2.x wallet and storage interfaces remain unchanged."
     },
     {
       "name": "@bsv/wallet-toolbox-client",
       "publishedVersion": "2.4.4",
       "releaseType": "patch",
-      "summary": "Carries the lockstep Wallet Toolbox client candidate with transport, validation, storage, provider, dependency, package, declaration, test, operator-procedure hardening, and the synchronized contributor-policy release boundary.",
-      "migration": "No consumer migration is required; client entry points and remote storage contracts remain compatible."
+      "summary": "Carries the lockstep Wallet Toolbox browser candidate with safe local trace correlation and no unsupported authenticated request headers.",
+      "migration": "No consumer migration is required; BRC-103/104, AuthFetch, browser entry points, and remote storage contracts remain unchanged."
     },
     {
       "name": "@bsv/wallet-toolbox-mobile",
       "publishedVersion": "2.4.4",
       "releaseType": "patch",
-      "summary": "Carries the lockstep Wallet Toolbox mobile candidate with platform, React Native preset, transport, storage, provider, package, declaration, test, operator-procedure hardening, and the synchronized contributor-policy release boundary.",
-      "migration": "No consumer migration is required; React Native and mobile bridge contracts remain compatible."
+      "summary": "Carries the lockstep Wallet Toolbox mobile candidate with safe local trace correlation and no unsupported authenticated request headers.",
+      "migration": "No consumer migration is required; BRC-103/104, AuthFetch, React Native, mobile bridge, and remote storage contracts remain unchanged."
     },
     {
       "name": "create-bsv-app",

governance/repository-health/baselines.json

@@ -325,8 +325,8 @@
     "@bsv/btms": "1.1.4",
     "@bsv/btms-permission-module": "1.1.3",
     "@bsv/wallet-relay": "0.3.4",
-    "@bsv/wallet-toolbox-client": "2.4.20",
-    "@bsv/wallet-toolbox-mobile": "2.4.20",
-    "@bsv/wallet-toolbox": "2.4.20"
+    "@bsv/wallet-toolbox-client": "2.4.21",
+    "@bsv/wallet-toolbox-mobile": "2.4.21",
+    "@bsv/wallet-toolbox": "2.4.21"
   }
 }

packages/wallet/wallet-toolbox/CHANGELOG.md

@@ -6,6 +6,10 @@ attention to changes that materially alter behavior or extend functionality.
 
 ## wallet-toolbox (unreleased)
 
+- Keep remote-storage trace correlation inside the telemetry sink instead of
+  adding unsupported headers to AuthFetch requests. BRC-103/104, AuthFetch,
+  Auth Express Middleware, AuthSocket, JSON-RPC, and storage wire behavior are
+  unchanged.
 - Point Wallet Toolbox contributors and AI agents to the canonical stack-level
   contribution and quality policy; keep client and mobile candidate versions
   in release lockstep without changing runtime behavior.

packages/wallet/wallet-toolbox/client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bsv/wallet-toolbox-client",
-  "version": "2.4.20",
+  "version": "2.4.21",
   "type": "module",
   "sideEffects": false,
   "engines": {

packages/wallet/wallet-toolbox/mobile/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bsv/wallet-toolbox-mobile",
-  "version": "2.4.20",
+  "version": "2.4.21",
   "type": "module",
   "sideEffects": false,
   "engines": {

packages/wallet/wallet-toolbox/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bsv/wallet-toolbox",
-  "version": "2.4.20",
+  "version": "2.4.21",
   "sideEffects": false,
   "type": "commonjs",
   "engines": {

packages/wallet/wallet-toolbox/src/storage/remoting/StorageClient.ts

@@ -1,7 +1,6 @@
 import { WalletInterface, WalletLoggerInterface } from '@bsv/sdk'
 import { WalletErrorFromJson } from '../../sdk/WalletErrorFromJson'
 import { logWalletError } from '../../WalletLogger'
-import { formatTraceparent } from '../../utility/traceContext'
 import { StorageClientBase, type StorageClientOptions } from './StorageClientBase'
 import {
   BINARY_ENCODING,
@@ -72,16 +71,13 @@ export class StorageClient extends StorageClientBase {
           response = await this.traceRpcStep(
             'wallet.storage.http',
             rpcSpan,
-            async httpSpan =>
+            async () =>
               await this.authClient.fetch(this.endpointUrl, {
                 method: 'POST',
                 headers: {
                   'Content-Type': 'application/json',
                   [BINARY_ENCODING_HEADER]: BINARY_ENCODING,
-                  ...(requestUsesBinary ? { [BINARY_REQUEST_ENCODING_HEADER]: BINARY_ENCODING } : {}),
-                  ...(httpSpan == null || formatTraceparent(httpSpan.context) == null
-                    ? {}
-                    : { traceparent: formatTraceparent(httpSpan.context)! })
+                  ...(requestUsesBinary ? { [BINARY_REQUEST_ENCODING_HEADER]: BINARY_ENCODING } : {})
                 },
                 body: requestBody
               }),