Every action here is a wallet-approved transaction that fires the real FHEVM path — client-side encryption, input-proof verification, and (for the compliance officer) EIP-712 user-decryption.