On the NWC question above, one thing worth checking with any scoped wallet connection is whose node signs the invoices the app creates. If a receive-scoped credential makes invoices from the user's own wallet, the payer's preimage shows that wallet's node was paid; with a custodial Lightning address it only shows the host's node was paid, and whether the named person got credited is down to the host's ledger. That's part of why receive-only scope is a nice least-privilege default: the app can request payments without being able to spend.
On the NWC question above, one thing worth checking with any scoped wallet connection is whose node signs the invoices the app creates. If a receive-scoped credential makes invoices from the user's own wallet, the payer's preimage shows that wallet's node was paid; with a custodial Lightning address it only shows the host's node was paid, and whether the named person got credited is down to the host's ledger. That's part of why receive-only scope is a nice least-privilege default: the app can request payments without being able to spend.