$1 mainnet real-device offline-exit test — owner steps

Purpose: prove the owner can get money out with Kipurse servers OFF, using only the rescue page + Base mainnet.

Spend: 1 USDC test amount (returns to the owner) + Base network cost (a few cents) paid by the owner.

Owner (iPhone, Kipurse app): note current wallet balance. Top up exactly 1 USDC from own Base Account into the Kipurse wallet (or use existing balance).
Owner: in app, open 离线提现指南 and save the rescue card (the link stays on the phone; never sent to a server).
Me (with owner watching): stop the public kit + mainnet runtime routes temporarily (systemctl stop kipurse-main on VPS) — needs owner "go" at that moment; confirm https://pay.kipurse.com/mcp no longer answers.
Owner: open the rescue page from the saved card (static page, works without our server), choose destination = own Base Account, sign with Base Account (Face ID).
Verify on basescan.org: one executeBatch from the Kipurse wallet, USDC transfer to the owner's address, wallet balance 0 (or the remaining amount).
Me: restart kipurse-main, check health (/mcp 401, owner page 200), app reconnects.
Record tx hash + times in ~/t968/PROGRESS.md and docs/security/ATTACK_PATHS.md (mark offline exit "verified on mainnet").

Rollback: if step 4 fails, restart kipurse-main immediately; funds stay in the wallet (self-custody, nothing moved).