# Kickoff Prompt: Build PoolScout v0.4.0

You are the lead engineer for **PoolScout**, a Chrome MV3 side-panel extension plus a local Node/TypeScript backend for Meteora LP farming on Solana (DLMM and DAMM v2 only).

## Attached files (read both fully before writing any code)
1. **`PRD-v0.4.0.md`**: the product requirements (Draft 1.5). This is the source of truth for features, milestones (M1 Parity, M2 Win, M3 Depth, M4 Reach, M5 Mobile), acceptance criteria, and open questions.
2. **`AGENT-RULES.md`**: the binding rules for you: hard prohibitions, trading and safety rules, the design system, engineering standards, and workflow. If the PRD and AGENT-RULES.md ever conflict, **AGENT-RULES.md wins**.

## Project location
- Owner's machine: Windows. The project root is **`C:\Users\Ponks_sol\PoolScout`**.
  - Chrome extension (MV3 side panel): **`C:\Users\Ponks_sol\PoolScout\extension`**
  - Local backend (Node + TypeScript): **`C:\Users\Ponks_sol\PoolScout\server`**. It runs on the owner's PC and holds the encrypted wallet keystore.
- The currently deployed version is **v0.3.1**. Do not break its data or settings. Migrations must be additive, and the database must be backed up before each one.
- First, list the project tree to confirm this layout before editing, and report what you find.

## Your task
1. Read both files and summarize back in 10 lines or fewer: the milestones, the M1 scope, and the prohibitions you will follow.
2. Propose an implementation plan for **M1 Parity only**, using the PRD section numbers, ordered with dependencies, and with a test plan.
3. Wait for the owner's "go" before coding. Then build M1 feature by feature, following the per-feature checklist and the Definition of Done in AGENT-RULES.md.
4. After each feature, report what changed (files), how it was tested (dry run or Demo only), and any open question.

## Non-negotiables (summary; full list in AGENT-RULES.md)
- Never print, log, commit, or send private keys, Helius API keys, `COPY_API_TOKEN`, or `.env` contents.
- Keys stay encrypted on the owner's local backend (or the owner's own VPS). There is no hosted signer, no vault or operator key, no seed phrase, and no PIN.
- Keep the safe defaults: the copy master switch is OFF and dry run is ON. Never send a live mainnet transaction without the owner's explicit approval.
- Use Meteora DLMM and DAMM v2 only, with no new chains or DEXes. Do not add fees or referral rewards; they are gated.
- Missing data never passes a safety check or filter.
- All code, UI copy, and docs are in professional English (the Indonesian locale file is the only exception).
- When something is unclear, ask the owner. Do not guess.