@bananapus/nana-sdk-core 2.33.2 → 2.34.1

package/dist/cjs/review/messages.d.ts

@@ -57,5 +57,7 @@ export declare const WRITE_HOLD_SAFE_REPLACED_LINE = "Another Safe transaction u
 export declare const WRITE_HOLD_LOOKS_DONE_LINE = "This looks done. Check your wallet, then continue.";
 /** A held Safe write whose follower ended without proof. The exit is offered. */
 export declare const WRITE_HOLD_SAFE_UNPROVEN_LINE = "This Safe transaction couldn't be confirmed here. Check your Safe, then send again.";
+/** A held write whose transaction is mined but whose result can't be read yet. No exit yet. */
+export declare const WRITE_HOLD_MINED_LINE = "Your transaction is onchain, but its result can't be read yet.";
 export {};
 //# sourceMappingURL=messages.d.ts.map

package/dist/cjs/review/messages.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"messages.d.ts","sourceRoot":"","sources":["../../../src/review/messages.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,4FAA4F;AAC5F,KAAK,aAAa,GAAG,KAAK,GAAG,SAAS,GAAG,SAAS,CAAC;AAEnD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,EACb,EACE,MAAiB,EACjB,KAAkB,EAClB,UAA0D,GAC3D,GAAE;IACD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAAC;CAChC,GACL,MAAM,CAIR;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,aAAa,EACrB,EACE,MAAiB,EACjB,OAAmB,EACnB,gBAAwB,GACzB,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAAO,GACxE,MAAM,CAOR;AAED,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,MAAM,SAAgB,GAAG,MAAM,CAE/D;AAED,4EAA4E;AAC5E,eAAO,MAAM,gBAAgB,oCAAoC,CAAC;AAElE,8DAA8D;AAC9D,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,EACjC,MAAM,SAAgB,GACrB,MAAM,CAIR;AAED,iEAAiE;AACjE,eAAO,MAAM,2BAA2B,0EACiC,CAAC;AAE1E,gDAAgD;AAChD,eAAO,MAAM,2BAA2B,oCAAoC,CAAC;AAE7E,yEAAyE;AACzE,eAAO,MAAM,4BAA4B,2EACiC,CAAC;AAE3E,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,8FAC0D,CAAC;AAE9F,mFAAmF;AACnF,eAAO,MAAM,uBAAuB,kEAC6B,CAAC;AAElE,0FAA0F;AAC1F,eAAO,MAAM,wBAAwB,yEACmC,CAAC;AAEzE,gGAAgG;AAChG,eAAO,MAAM,yBAAyB,uFACgD,CAAC;AAEvF,qFAAqF;AACrF,eAAO,MAAM,qBAAqB,6FAC0D,CAAC;AAE7F,+DAA+D;AAC/D,eAAO,MAAM,2BAA2B,iFACwC,CAAC;AAEjF,wFAAwF;AACxF,eAAO,MAAM,6BAA6B,gFACqC,CAAC;AAEhF,6GAA6G;AAC7G,eAAO,MAAM,0BAA0B,uDACe,CAAC;AAEvD,iFAAiF;AACjF,eAAO,MAAM,6BAA6B,wFAC6C,CAAC"}
+{"version":3,"file":"messages.d.ts","sourceRoot":"","sources":["../../../src/review/messages.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,4FAA4F;AAC5F,KAAK,aAAa,GAAG,KAAK,GAAG,SAAS,GAAG,SAAS,CAAC;AAEnD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,EACb,EACE,MAAiB,EACjB,KAAkB,EAClB,UAA0D,GAC3D,GAAE;IACD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAAC;CAChC,GACL,MAAM,CAIR;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,aAAa,EACrB,EACE,MAAiB,EACjB,OAAmB,EACnB,gBAAwB,GACzB,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAAO,GACxE,MAAM,CAOR;AAED,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,MAAM,SAAgB,GAAG,MAAM,CAE/D;AAED,4EAA4E;AAC5E,eAAO,MAAM,gBAAgB,oCAAoC,CAAC;AAElE,8DAA8D;AAC9D,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,EACjC,MAAM,SAAgB,GACrB,MAAM,CAIR;AAED,iEAAiE;AACjE,eAAO,MAAM,2BAA2B,0EACiC,CAAC;AAE1E,gDAAgD;AAChD,eAAO,MAAM,2BAA2B,oCAAoC,CAAC;AAE7E,yEAAyE;AACzE,eAAO,MAAM,4BAA4B,2EACiC,CAAC;AAE3E,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,8FAC0D,CAAC;AAE9F,mFAAmF;AACnF,eAAO,MAAM,uBAAuB,kEAC6B,CAAC;AAElE,0FAA0F;AAC1F,eAAO,MAAM,wBAAwB,yEACmC,CAAC;AAEzE,gGAAgG;AAChG,eAAO,MAAM,yBAAyB,uFACgD,CAAC;AAEvF,qFAAqF;AACrF,eAAO,MAAM,qBAAqB,6FAC0D,CAAC;AAE7F,+DAA+D;AAC/D,eAAO,MAAM,2BAA2B,iFACwC,CAAC;AAEjF,wFAAwF;AACxF,eAAO,MAAM,6BAA6B,gFACqC,CAAC;AAEhF,6GAA6G;AAC7G,eAAO,MAAM,0BAA0B,uDACe,CAAC;AAEvD,iFAAiF;AACjF,eAAO,MAAM,6BAA6B,wFAC6C,CAAC;AAExF,+FAA+F;AAC/F,eAAO,MAAM,qBAAqB,mEACgC,CAAC"}

package/dist/cjs/review/messages.js

@@ -5,7 +5,7 @@
  * `action` is a noun such as "action", "launch" or "payment".
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WRITE_HOLD_SAFE_UNPROVEN_LINE = exports.WRITE_HOLD_LOOKS_DONE_LINE = exports.WRITE_HOLD_SAFE_REPLACED_LINE = exports.WRITE_HOLD_HASHED_EXIT_LINE = exports.WRITE_HOLD_NONCE_LINE = exports.WRITE_HOLD_UNCHECKED_LINE = exports.WRITE_HOLD_REVERTED_LINE = exports.WRITE_HOLD_PENDING_LINE = exports.WRITE_HOLD_IN_TAB_LINE = exports.RELAYR_PAYMENT_RELEASED_LINE = exports.SAFE_PROPOSAL_EXECUTED_LINE = exports.SAFE_PROPOSAL_REPLACED_LINE = exports.WRITE_EXIT_LABEL = void 0;
+exports.WRITE_HOLD_MINED_LINE = exports.WRITE_HOLD_SAFE_UNPROVEN_LINE = exports.WRITE_HOLD_LOOKS_DONE_LINE = exports.WRITE_HOLD_SAFE_REPLACED_LINE = exports.WRITE_HOLD_HASHED_EXIT_LINE = exports.WRITE_HOLD_NONCE_LINE = exports.WRITE_HOLD_UNCHECKED_LINE = exports.WRITE_HOLD_REVERTED_LINE = exports.WRITE_HOLD_PENDING_LINE = exports.WRITE_HOLD_IN_TAB_LINE = exports.RELAYR_PAYMENT_RELEASED_LINE = exports.SAFE_PROPOSAL_EXECUTED_LINE = exports.SAFE_PROPOSAL_REPLACED_LINE = exports.WRITE_EXIT_LABEL = void 0;
 exports.relayrHeldMessage = relayrHeldMessage;
 exports.relayrDiscardLine = relayrDiscardLine;
 exports.writeHeldMessage = writeHeldMessage;
@@ -70,4 +70,6 @@ exports.WRITE_HOLD_SAFE_REPLACED_LINE = "Another Safe transaction used this nonc
 exports.WRITE_HOLD_LOOKS_DONE_LINE = "This looks done. Check your wallet, then continue.";
 /** A held Safe write whose follower ended without proof. The exit is offered. */
 exports.WRITE_HOLD_SAFE_UNPROVEN_LINE = "This Safe transaction couldn't be confirmed here. Check your Safe, then send again.";
+/** A held write whose transaction is mined but whose result can't be read yet. No exit yet. */
+exports.WRITE_HOLD_MINED_LINE = "Your transaction is onchain, but its result can't be read yet.";
 //# sourceMappingURL=messages.js.map

package/dist/cjs/review/messages.js.map

@@ -1 +1 @@
-{"version":3,"file":"messages.js","sourceRoot":"","sources":["../../../src/review/messages.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAUH,8CAeC;AAOD,8CAcC;AAGD,4CAEC;AAMD,4CAOC;AA3DD;;;;GAIG;AACH,SAAgB,iBAAiB,CAC/B,KAAa,EACb,EACE,MAAM,GAAG,QAAQ,EACjB,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,EAClB,UAAU,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE,MAKxD,EAAE;IAEN,OAAO,KAAK,GAAG,KAAK,GAAG,KAAK;QAC1B,CAAC,CAAC,QAAQ,MAAM,4CAA4C,UAAU,CAAC,KAAK,GAAG,KAAK,CAAC,yBAAyB;QAC9G,CAAC,CAAC,QAAQ,MAAM,iEAAiE,CAAC;AACtF,CAAC;AAED;;;;GAIG;AACH,SAAgB,iBAAiB,CAC/B,MAAqB,EACrB,EACE,MAAM,GAAG,QAAQ,EACjB,OAAO,GAAG,SAAS,EACnB,gBAAgB,GAAG,KAAK,MAC6C,EAAE;IAEzE,IAAI,MAAM,KAAK,KAAK;QAClB,OAAO,QAAQ,MAAM,wDAAwD,OAAO,uCAAuC,CAAC;IAC9H,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,OAAO,OAAO,6BAA6B,CAAC;IAC7E,OAAO,gBAAgB;QACrB,CAAC,CAAC,iDAAiD,MAAM,qDAAqD;QAC9G,CAAC,CAAC,QAAQ,MAAM,gDAAgD,CAAC;AACrE,CAAC;AAED,wEAAwE;AACxE,SAAgB,gBAAgB,CAAC,MAAM,GAAG,aAAa;IACrD,OAAO,gBAAgB,MAAM,2CAA2C,CAAC;AAC3E,CAAC;AAED,4EAA4E;AAC/D,QAAA,gBAAgB,GAAG,iCAAiC,CAAC;AAElE,8DAA8D;AAC9D,SAAgB,gBAAgB,CAC9B,IAAiC,EACjC,MAAM,GAAG,aAAa;IAEtB,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,EAAE;QACjC,CAAC,CAAC,mBAAmB,MAAM,0CAA0C;QACrE,CAAC,CAAC,mBAAmB,MAAM,6CAA6C,CAAC;AAC7E,CAAC;AAED,iEAAiE;AACpD,QAAA,2BAA2B,GACtC,uEAAuE,CAAC;AAE1E,gDAAgD;AACnC,QAAA,2BAA2B,GAAG,iCAAiC,CAAC;AAE7E,yEAAyE;AAC5D,QAAA,4BAA4B,GACvC,wEAAwE,CAAC;AAE3E,sFAAsF;AACzE,QAAA,sBAAsB,GACjC,2FAA2F,CAAC;AAE9F,mFAAmF;AACtE,QAAA,uBAAuB,GAClC,+DAA+D,CAAC;AAElE,0FAA0F;AAC7E,QAAA,wBAAwB,GACnC,sEAAsE,CAAC;AAEzE,gGAAgG;AACnF,QAAA,yBAAyB,GACpC,oFAAoF,CAAC;AAEvF,qFAAqF;AACxE,QAAA,qBAAqB,GAChC,0FAA0F,CAAC;AAE7F,+DAA+D;AAClD,QAAA,2BAA2B,GACtC,8EAA8E,CAAC;AAEjF,wFAAwF;AAC3E,QAAA,6BAA6B,GACxC,6EAA6E,CAAC;AAEhF,6GAA6G;AAChG,QAAA,0BAA0B,GACrC,oDAAoD,CAAC;AAEvD,iFAAiF;AACpE,QAAA,6BAA6B,GACxC,qFAAqF,CAAC"}
+{"version":3,"file":"messages.js","sourceRoot":"","sources":["../../../src/review/messages.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAUH,8CAeC;AAOD,8CAcC;AAGD,4CAEC;AAMD,4CAOC;AA3DD;;;;GAIG;AACH,SAAgB,iBAAiB,CAC/B,KAAa,EACb,EACE,MAAM,GAAG,QAAQ,EACjB,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,EAClB,UAAU,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE,MAKxD,EAAE;IAEN,OAAO,KAAK,GAAG,KAAK,GAAG,KAAK;QAC1B,CAAC,CAAC,QAAQ,MAAM,4CAA4C,UAAU,CAAC,KAAK,GAAG,KAAK,CAAC,yBAAyB;QAC9G,CAAC,CAAC,QAAQ,MAAM,iEAAiE,CAAC;AACtF,CAAC;AAED;;;;GAIG;AACH,SAAgB,iBAAiB,CAC/B,MAAqB,EACrB,EACE,MAAM,GAAG,QAAQ,EACjB,OAAO,GAAG,SAAS,EACnB,gBAAgB,GAAG,KAAK,MAC6C,EAAE;IAEzE,IAAI,MAAM,KAAK,KAAK;QAClB,OAAO,QAAQ,MAAM,wDAAwD,OAAO,uCAAuC,CAAC;IAC9H,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,OAAO,OAAO,6BAA6B,CAAC;IAC7E,OAAO,gBAAgB;QACrB,CAAC,CAAC,iDAAiD,MAAM,qDAAqD;QAC9G,CAAC,CAAC,QAAQ,MAAM,gDAAgD,CAAC;AACrE,CAAC;AAED,wEAAwE;AACxE,SAAgB,gBAAgB,CAAC,MAAM,GAAG,aAAa;IACrD,OAAO,gBAAgB,MAAM,2CAA2C,CAAC;AAC3E,CAAC;AAED,4EAA4E;AAC/D,QAAA,gBAAgB,GAAG,iCAAiC,CAAC;AAElE,8DAA8D;AAC9D,SAAgB,gBAAgB,CAC9B,IAAiC,EACjC,MAAM,GAAG,aAAa;IAEtB,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,EAAE;QACjC,CAAC,CAAC,mBAAmB,MAAM,0CAA0C;QACrE,CAAC,CAAC,mBAAmB,MAAM,6CAA6C,CAAC;AAC7E,CAAC;AAED,iEAAiE;AACpD,QAAA,2BAA2B,GACtC,uEAAuE,CAAC;AAE1E,gDAAgD;AACnC,QAAA,2BAA2B,GAAG,iCAAiC,CAAC;AAE7E,yEAAyE;AAC5D,QAAA,4BAA4B,GACvC,wEAAwE,CAAC;AAE3E,sFAAsF;AACzE,QAAA,sBAAsB,GACjC,2FAA2F,CAAC;AAE9F,mFAAmF;AACtE,QAAA,uBAAuB,GAClC,+DAA+D,CAAC;AAElE,0FAA0F;AAC7E,QAAA,wBAAwB,GACnC,sEAAsE,CAAC;AAEzE,gGAAgG;AACnF,QAAA,yBAAyB,GACpC,oFAAoF,CAAC;AAEvF,qFAAqF;AACxE,QAAA,qBAAqB,GAChC,0FAA0F,CAAC;AAE7F,+DAA+D;AAClD,QAAA,2BAA2B,GACtC,8EAA8E,CAAC;AAEjF,wFAAwF;AAC3E,QAAA,6BAA6B,GACxC,6EAA6E,CAAC;AAEhF,6GAA6G;AAChG,QAAA,0BAA0B,GACrC,oDAAoD,CAAC;AAEvD,iFAAiF;AACpE,QAAA,6BAA6B,GACxC,qFAAqF,CAAC;AAExF,+FAA+F;AAClF,QAAA,qBAAqB,GAChC,gEAAgE,CAAC"}

package/dist/cjs/review/writeHold.d.ts

@@ -24,7 +24,15 @@ type Held<S extends string, Extra> = {
 /**
  * What a write hold says about one exact call, from {@link WriteHold.state}:
  *
- * - `clear`: nothing is held; `settled` says how a hold just ended;
+ * "The exit is offered" means through the gate: `exit` is true only on a
+ * state from state() or exit(). peek(), replays and every other emitted state
+ * keep the status and line with `exit: false`.
+ *
+ * - `clear`: nothing is held; `settled` says how the call's last write
+ *   ended on authenticated evidence (its receipt or canonical execution),
+ *   saved for every reader until the next write on the call is reserved. A
+ *   proven expiry says so only to the caller that saw it; the user's exit
+ *   leaves none;
  * - `pending-known-hash`: its saved hash (or Safe proposal) can still run. No
  *   exit: the wallet speeds it up or cancels it;
  * - `held-no-hash`: the wallet never returned a hash. The exit is offered;
@@ -63,27 +71,27 @@ export type WriteHoldState = {
     hash: Hex;
     exit: false;
 }> | Held<"held-no-hash", {
-    exit: true;
+    exit: boolean;
 }> | Held<"dropped-proven", {
     hash: Hex;
     usedBy: Hex;
-    exit: true;
+    exit: boolean;
     warning: string;
 }> | Held<"held-unchecked", {
     hash: Hex;
-    exit: true;
+    exit: boolean;
     warning: string;
 }> | Held<"safe-replaced", {
     hash: Hex;
-    exit: true;
+    exit: boolean;
     warning: string;
 }> | Held<"safe-unproven", {
     hash: Hex;
-    exit: true;
+    exit: boolean;
     warning: string;
 }> | Held<"looks-done", {
     hash?: Hex;
-    exit: true;
+    exit: boolean;
     warning?: string;
 }> | Held<"ran-executed", {
     executionHash?: Hex;
@@ -159,7 +167,10 @@ export declare function createWriteHold(options?: {
         }) => Promise<WriteHoldState>;
         /** What the saved record alone says, without asking the chain. */
         peek: () => WriteHoldState;
-        /** Every state this controller reads or makes for the call, and other tabs' changes. */
+        /**
+         * Every state this controller reads or makes for the call, and other
+         * tabs' changes. The latest one, if any, is replayed at once.
+         */
         subscribe(listener: (state: WriteHoldState) => void): () => void;
         /**
          * Send the call under its hold. A held call throws
@@ -195,8 +206,18 @@ export declare function createWriteHold(options?: {
          */
         onUnproven(client: WriteHoldClient, proposalHash?: Hex): Promise<WriteHoldState>;
         /**
-         * The app's own proof that the held Safe proposal ran, with its
-         * execution's transaction when known. Kept until its result settles it.
+         * Attach a hash the chain authenticates as this exact call, sent by the
+         * account on the reservation's chain at or after its next nonce, and
+         * not mined before it was reserved, to the held write that has none: under
+         * one lock, without releasing it. The hold then follows that hash: no
+         * exit while it is pending, and its receipt settles it.
+         */
+        attachHash(client: WriteHoldClient, hash: Hex): Promise<WriteHoldState>;
+        /**
+         * The app's word that the held Safe proposal ran, with its execution's
+         * transaction when known. Nothing is saved as executed on its word:
+         * the hash is kept as a candidate, and settles it only once its own
+         * receipt proves this Safe's execution of the exact proposal or call.
          */
         onExecuted(client: WriteHoldClient, executionHash?: Hex): Promise<WriteHoldState>;
     };

package/dist/cjs/review/writeHold.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"writeHold.d.ts","sourceRoot":"","sources":["../../../src/review/writeHold.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,GAAG,EACR,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACxB,MAAM,MAAM,CAAC;AACd,OAAO,EAOL,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAc3B,OAAO,EAOL,0BAA0B,EAC1B,KAAK,gBAAgB,EACrB,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,EACjC,MAAM,oBAAoB,CAAC;AAG5B,0FAA0F;AAC1F,MAAM,MAAM,eAAe,GAAG,IAAI,CAChC,YAAY,EACV,UAAU,GACV,gBAAgB,GAChB,YAAY,GACZ,gBAAgB,GAChB,qBAAqB,GACrB,uBAAuB,GACvB,SAAS,CACZ,CAAC;AAEF,wDAAwD;AACxD,MAAM,MAAM,gBAAgB;AAC1B,uDAAuD;AACrD;IAAE,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAAC,IAAI,EAAE,GAAG,CAAA;CAAE;AAC7C,wDAAwD;GACtD;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAE1B,KAAK,IAAI,CAAC,CAAC,SAAS,MAAM,EAAE,KAAK,IAAI;IACnC,MAAM,EAAE,CAAC,CAAC;IACV,2EAA2E;IAC3E,MAAM,EAAE,2BAA2B,CAAC;IACpC,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,KAAK,CAAC;AAEV;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,gBAAgB,CAAA;CAAE,GAC/C,IAAI,CAAC,oBAAoB,EAAE;IAAE,IAAI,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC,GACtD,IAAI,CAAC,cAAc,EAAE;IAAE,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC,GACpC,IAAI,CACF,gBAAgB,EAChB;IAAE,IAAI,EAAE,GAAG,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CACxD,GACD,IAAI,CAAC,gBAAgB,EAAE;IAAE,IAAI,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,GAClE,IAAI,CAAC,eAAe,EAAE;IAAE,IAAI,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,GACjE,IAAI,CAAC,eAAe,EAAE;IAAE,IAAI,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,GACjE,IAAI,CAAC,YAAY,EAAE;IAAE,IAAI,CAAC,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAChE,IAAI,CACF,cAAc,EACd;IAAE,aAAa,CAAC,EAAE,GAAG,CAAC;IAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,KAAK,CAAA;CAAE,CACxD,CAAC;AAEN,6BAA6B;AAC7B,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,EAAE;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC;AAE1E,2EAA2E;AAC3E,qBAAa,cAAe,SAAQ,KAAK;IAE3B,QAAQ,CAAC,KAAK,EAAE,cAAc;IAD1C,QAAQ,CAAC,IAAI,oBAAoB;gBACZ,KAAK,EAAE,cAAc;CAG3C;AAED,wEAAwE;AACxE,qBAAa,mBAAoB,SAAQ,KAAK;IAEhC,QAAQ,CAAC,KAAK,EAAE,OAAO;IADnC,QAAQ,CAAC,IAAI,yBAAyB;gBACjB,KAAK,EAAE,OAAO;CAGpC;AAED,qEAAqE;AACrE,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,wBAAwB;;CAItC;AAED,sFAAsF;AACtF,MAAM,MAAM,aAAa,GAAG;IAC1B;;;;;OAKG;IACH,UAAU,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,wFAAwF;IACxF,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC/D,+FAA+F;IAC/F,UAAU,IAAI,IAAI,CAAC;CACpB,CAAC;AAEF,KAAK,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;AAgI1C;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAC7B,OAAO,GAAE;IACP,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,sFAAsF;IACtF,MAAM,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAChD;iBA8Bc,0BAA0B;wBAmWlC,eAAe,WACf;YAAE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;SAAE,KACzD,OAAO,CAAC,cAAc,CAAC;QAQxB,kEAAkE;;QAElE,wFAAwF;4BACpE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,GAAG,MAAM,IAAI;QAchE;;;;;;WAMG;aACQ,CAAC,UACF,eAAe,OAClB,CAAC,IAAI,EAAE,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,GACvC,OAAO,CAAC,CAAC,CAAC;QA8Db;;;;;WAKG;uBAES,cAAc,mBACP;YAAE,aAAa,EAAE,IAAI,CAAA;SAAE,UAChC,eAAe,GACtB,OAAO,CAAC;YAAE,QAAQ,EAAE,OAAO,CAAC;YAAC,KAAK,EAAE,cAAc,CAAA;SAAE,CAAC;QA0BxD;;;;WAIG;2BAEQ,kBAAkB,UACnB,eAAe,UACf,UAAU,CAAC,OAAO,0BAA0B,CAAC,CAAC,CAAC,CAAC,GACvD,OAAO,CAAC,cAAc,CAAC;QAa1B;;;;;WAKG;2BAEO,eAAe,iBACR,GAAG,GACjB,OAAO,CAAC,cAAc,CAAC;QAc1B;;;WAGG;2BAEO,eAAe,kBACP,GAAG,GAClB,OAAO,CAAC,cAAc,CAAC;;IAc5B,gDAAgD;;IAEhD,oEAAoE;;IAEpE,qEAAqE;;EAQxE;AAED,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC;AAC3D,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC"}
+{"version":3,"file":"writeHold.d.ts","sourceRoot":"","sources":["../../../src/review/writeHold.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,GAAG,EACR,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACxB,MAAM,MAAM,CAAC;AACd,OAAO,EAOL,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAe3B,OAAO,EAOL,0BAA0B,EAC1B,KAAK,gBAAgB,EACrB,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,EACjC,MAAM,oBAAoB,CAAC;AAI5B,0FAA0F;AAC1F,MAAM,MAAM,eAAe,GAAG,IAAI,CAChC,YAAY,EACV,UAAU,GACV,gBAAgB,GAChB,YAAY,GACZ,gBAAgB,GAChB,qBAAqB,GACrB,uBAAuB,GACvB,SAAS,CACZ,CAAC;AAEF,wDAAwD;AACxD,MAAM,MAAM,gBAAgB;AAC1B,uDAAuD;AACrD;IAAE,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAAC,IAAI,EAAE,GAAG,CAAA;CAAE;AAC7C,wDAAwD;GACtD;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAE1B,KAAK,IAAI,CAAC,CAAC,SAAS,MAAM,EAAE,KAAK,IAAI;IACnC,MAAM,EAAE,CAAC,CAAC;IACV,2EAA2E;IAC3E,MAAM,EAAE,2BAA2B,CAAC;IACpC,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,KAAK,CAAC;AAEV;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,gBAAgB,CAAA;CAAE,GAC/C,IAAI,CAAC,oBAAoB,EAAE;IAAE,IAAI,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC,GACtD,IAAI,CAAC,cAAc,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,GACvC,IAAI,CACF,gBAAgB,EAChB;IAAE,IAAI,EAAE,GAAG,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAC3D,GACD,IAAI,CAAC,gBAAgB,EAAE;IAAE,IAAI,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,GACrE,IAAI,CAAC,eAAe,EAAE;IAAE,IAAI,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,GACpE,IAAI,CAAC,eAAe,EAAE;IAAE,IAAI,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,GACpE,IAAI,CAAC,YAAY,EAAE;IAAE,IAAI,CAAC,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GACnE,IAAI,CACF,cAAc,EACd;IAAE,aAAa,CAAC,EAAE,GAAG,CAAC;IAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,KAAK,CAAA;CAAE,CACxD,CAAC;AAaN,6BAA6B;AAC7B,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,EAAE;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC;AAE1E,2EAA2E;AAC3E,qBAAa,cAAe,SAAQ,KAAK;IAE3B,QAAQ,CAAC,KAAK,EAAE,cAAc;IAD1C,QAAQ,CAAC,IAAI,oBAAoB;gBACZ,KAAK,EAAE,cAAc;CAG3C;AAED,wEAAwE;AACxE,qBAAa,mBAAoB,SAAQ,KAAK;IAEhC,QAAQ,CAAC,KAAK,EAAE,OAAO;IADnC,QAAQ,CAAC,IAAI,yBAAyB;gBACjB,KAAK,EAAE,OAAO;CAGpC;AAED,qEAAqE;AACrE,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,wBAAwB;;CAItC;AAED,sFAAsF;AACtF,MAAM,MAAM,aAAa,GAAG;IAC1B;;;;;OAKG;IACH,UAAU,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,wFAAwF;IACxF,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC/D,+FAA+F;IAC/F,UAAU,IAAI,IAAI,CAAC;CACpB,CAAC;AAEF,KAAK,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;AA8H1C;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAC7B,OAAO,GAAE;IACP,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,sFAAsF;IACtF,MAAM,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAChD;iBAiCc,0BAA0B;wBA6hBlC,eAAe,WACf;YAAE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;SAAE,KACzD,OAAO,CAAC,cAAc,CAAC;QAQxB,kEAAkE;;QAElE;;;WAGG;4BACiB,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,GAAG,MAAM,IAAI;QA2BhE;;;;;;WAMG;aACQ,CAAC,UACF,eAAe,OAClB,CAAC,IAAI,EAAE,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,GACvC,OAAO,CAAC,CAAC,CAAC;QA+Db;;;;;WAKG;uBAES,cAAc,mBACP;YAAE,aAAa,EAAE,IAAI,CAAA;SAAE,UAChC,eAAe,GACtB,OAAO,CAAC;YAAE,QAAQ,EAAE,OAAO,CAAC;YAAC,KAAK,EAAE,cAAc,CAAA;SAAE,CAAC;QA6BxD;;;;WAIG;2BAEQ,kBAAkB,UACnB,eAAe,UACf,UAAU,CAAC,OAAO,0BAA0B,CAAC,CAAC,CAAC,CAAC,GACvD,OAAO,CAAC,cAAc,CAAC;QAa1B;;;;;WAKG;2BAEO,eAAe,iBACR,GAAG,GACjB,OAAO,CAAC,cAAc,CAAC;QAc1B;;;;;;WAMG;2BAEO,eAAe,QACjB,GAAG,GACR,OAAO,CAAC,cAAc,CAAC;QAwC1B;;;;;WAKG;2BAEO,eAAe,kBACP,GAAG,GAClB,OAAO,CAAC,cAAc,CAAC;;IA+B5B,gDAAgD;;IAEhD,oEAAoE;;IAEpE,qEAAqE;;EAQxE;AAED,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC;AAC3D,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC"}

package/dist/cjs/review/writeHold.js

@@ -6,7 +6,18 @@ const viem_1 = require("viem");
 const safeService_js_1 = require("../safeService.js");
 const messages_js_1 = require("./messages.js");
 const writeRecovery_js_1 = require("./writeRecovery.js");
+const untrusted_js_1 = require("../untrusted.js");
 const relayr_js_1 = require("./relayr.js");
+/**
+ * A state read without the chain (peek, a replay, another tab's change, a
+ * send's progress): its status and line, never the exit. Only the gate in
+ * state() and exit() offers that.
+ */
+function ungated(state) {
+    return state.status === "clear" || !state.exit
+        ? state
+        : { ...state, exit: false };
+}
 /** A send was refused because the exact call is held; `state` says how. */
 class WriteHeldError extends Error {
     constructor(state) {
@@ -34,6 +45,11 @@ class WriteHoldBusyError extends Error {
 }
 exports.WriteHoldBusyError = WriteHoldBusyError;
 const SETTLE_POLL_MS = 15_000;
+/** A Safe's execution events, in its 1.3 and 1.4 layouts alike. */
+const SAFE_EXECUTION_TOPICS = [
+    (0, viem_1.toEventSelector)("ExecutionSuccess(bytes32,uint256)"),
+    (0, viem_1.toEventSelector)("ExecutionFailure(bytes32,uint256)"),
+];
 /** A hash the network still hasn't seen this long after the wallet returned it was almost certainly never broadcast. */
 const UNSEEN_HASH_MS = 30 * 60_000;
 /** The 30 minutes have passed since the wallet returned the hash, or since it was first read. A clock that couldn't be saved (NaN) never runs out. */
@@ -83,11 +99,6 @@ function unchecked(record) {
 }
 /** About an hour of polls; a later state() looks again. */
 const SETTLE_POLL_ATTEMPTS = 240;
-function listenerKey(call) {
-    const scope = call.namespace ??
-        `${call.call.to}:${BigInt(call.call.value ?? 0)}:${call.call.data}`;
-    return `${call.chainId}:${call.account}:${scope}`.toLowerCase();
-}
 function clear(settled) {
     return settled ? { status: "clear", settled } : { status: "clear" };
 }
@@ -159,7 +170,10 @@ function createWriteHold(options = {}) {
     const peekers = new Map();
     const timers = new Map();
     let onStorage;
+    /** The latest state emitted for each call, replayed to a late subscriber. */
+    const latest = new Map();
     function emit(key, state) {
+        latest.set(key, state);
         for (const listener of listeners.get(key) ?? [])
             listener(state);
     }
@@ -186,10 +200,16 @@ function createWriteHold(options = {}) {
             storage,
             locks: options.locks,
         });
-        const key = listenerKey(call);
+        // The canonical recovery scope: a namespace and an exact call never share it.
+        const key = recovery.scopeKey;
         /** The effect read the last state() was given: the exit asks it again. */
         let lastEffect;
-        const peek = () => classify(recovery.read());
+        /** Nothing held: how the call's last write settled, if saved. */
+        const cleared = () => clear(recovery.settled());
+        const peek = () => {
+            const record = recovery.read();
+            return record ? ungated(classify(record)) : cleared();
+        };
         const shown = (state) => (emit(key, state), state);
         async function locked(work, wait) {
             let entered = false;
@@ -232,11 +252,15 @@ function createWriteHold(options = {}) {
         }
         async function settle(record, receipt, client, proof) {
             const verdict = await (0, writeRecovery_js_1.verifyReviewedWriteReceipt)(client, record, receipt, proof).catch(() => null);
-            if (verdict && release(record))
-                return clear({
+            if (verdict && release(record)) {
+                const settled = {
                     result: verdict,
                     hash: receipt.transactionHash.toLowerCase(),
-                });
+                };
+                // Kept for any later reader: another tab, a reload, a follow timer.
+                recovery.markSettled(record, settled);
+                return clear(settled);
+            }
             if (!record.safe &&
                 receipt.status === "reverted" &&
                 receipt.transactionHash.toLowerCase() === record.hash) {
@@ -294,6 +318,89 @@ function createWriteHold(options = {}) {
             // A proof that can't be dropped keeps the exit refusing it.
             return unchecked(recovery.unexecuted(record));
         }
+        /** The first hash the hold has seen that the node knows as a transaction with no receipt yet. */
+        /**
+         * Positive proof that `receipt` isn't the held Safe proposal's
+         * execution: it is in a canonical block, and it reverted or its Safe
+         * logged no execution of the proposal's safeTxHash. A read that fails
+         * proves nothing.
+         */
+        async function disproves(record, receipt, client) {
+            const block = await client
+                .getBlock({ blockNumber: receipt.blockNumber })
+                .catch(() => null);
+            if (!block?.hash ||
+                block.hash.toLowerCase() !== receipt.blockHash?.toLowerCase())
+                return false;
+            if (receipt.status === "reverted")
+                return true;
+            return !receipt.logs.some((log) => log.address?.toLowerCase() === record.account &&
+                SAFE_EXECUTION_TOPICS.includes(log.topics?.[0]) &&
+                (log.topics.length === 2
+                    ? log.topics[1]
+                    : log.data?.slice(0, 66))?.toLowerCase() === record.hash);
+        }
+        /**
+         * A held hash the node shows mined, though its receipt can't be read: it
+         * may have run, so no exit at once, and no "speed it up" either. Once
+         * that has lasted 30 minutes (`minedAt` keeps the clock), the warned exit.
+         * Seen pending again, the clock stops.
+         */
+        async function minedUnread(state, client) {
+            const look = await lookAt(state.hash, client);
+            // Only positive pending evidence stops the clock; a read that fails
+            // keeps the one saved.
+            if (look === "pending")
+                return { ...state, record: recovery.mined(state.record, false) };
+            const record = look === "mined" ? recovery.mined(state.record, true) : state.record;
+            if (record.minedAt === undefined)
+                return state;
+            if (Date.now() - Number(record.minedAt) >= UNSEEN_HASH_MS)
+                return unchecked(record);
+            return { ...state, record, line: messages_js_1.WRITE_HOLD_MINED_LINE };
+        }
+        /** What the node shows of `hash`: positive pending or mined metadata, or nothing it can say. */
+        async function lookAt(hash, client) {
+            const sent = await client.getTransaction({ hash }).catch(() => null);
+            if (sent?.hash?.toLowerCase() !== hash)
+                return null;
+            return sent.blockNumber === null ? "pending" : "mined";
+        }
+        /**
+         * No exit while a hash the hold has seen (its own, unless proven dropped,
+         * or a candidate) is pending, or was seen mined with its receipt
+         * unreadable less than 30 minutes ago: it may have run. Its clock is
+         * kept per hash, survives read failures, and stops only on positive
+         * pending evidence.
+         */
+        async function seenGate(saved, client, ownDropped) {
+            let record = saved;
+            const seen = [
+                ...(record.hash && !ownDropped ? [record.hash] : []),
+                ...(record.candidates ?? []),
+            ];
+            for (const hash of seen) {
+                const own = hash === record.hash;
+                const look = await lookAt(hash, client);
+                if (look !== null)
+                    record = own
+                        ? recovery.mined(record, look === "mined")
+                        : recovery.candidateMined(record, hash, look === "mined");
+                const at = own ? record.minedAt : record.candidateMinedAt?.[hash];
+                if (look === "pending" ||
+                    (at !== undefined && Date.now() - Number(at) < UNSEEN_HASH_MS))
+                    return {
+                        status: "pending-known-hash",
+                        record,
+                        hash,
+                        exit: false,
+                        line: look === "pending"
+                            ? messages_js_1.WRITE_HOLD_PENDING_LINE
+                            : messages_js_1.WRITE_HOLD_MINED_LINE,
+                    };
+            }
+            return null;
+        }
         async function safeState(saved, client) {
             let record = saved;
             const hash = record.hash;
@@ -325,7 +432,24 @@ function createWriteHold(options = {}) {
                     }
                 }
             }
-            else if (record.executionHash) {
+            // An execution hash the app reported settles it only on its own
+            // authenticated receipt; until then it is a candidate, never proof.
+            if (!record.executionHash)
+                for (const candidate of record.candidates ?? []) {
+                    const receipt = await client
+                        .getTransactionReceipt({ hash: candidate })
+                        .catch(() => null);
+                    if (!receipt)
+                        continue;
+                    const settled = await settle(record, receipt, client);
+                    if (settled.status === "clear" || settled.status === "ran-executed")
+                        return settled;
+                    // Only a canonical receipt that names no execution of this
+                    // proposal disproves it; anything unread keeps it.
+                    if (await disproves(record, receipt, client))
+                        record = recovery.disproven(record, candidate);
+                }
+            if (record.executed && record.executionHash) {
                 const settled = await execution(record, client);
                 if (settled?.status === "clear")
                     return settled;
@@ -358,16 +482,28 @@ function createWriteHold(options = {}) {
                 if (expired && release(record))
                     return clear({ result: "expired" });
             }
-            if (end.look === "executed" &&
-                (!record.executed ||
+            if (end.look === "executed") {
+                if (!record.executed ||
                     (end.execution &&
-                        end.execution.executionHash !== record.executionHash))) {
-                record = recovery.executed(record, end.execution?.executionHash);
+                        end.execution.executionHash !== record.executionHash))
+                    record = recovery.executed(record, end.execution?.executionHash);
                 if (record.executionHash) {
                     const settled = await execution(record, client);
-                    if (settled)
+                    // Only a settled receipt ends it here; one that can't be verified
+                    // leaves the finalized log to decide.
+                    if (settled?.status === "clear")
                         return settled;
                 }
+                // It ran: with its receipt unreadable, the canonical log at a
+                // finalized block carries its result. Never a resend exit.
+                if (end.execution && release(record)) {
+                    const settled = {
+                        result: end.execution.status,
+                        hash: end.execution.executionHash,
+                    };
+                    recovery.markSettled(record, settled);
+                    return clear(settled);
+                }
             }
             if (!record.executed &&
                 !record.unproven &&
@@ -378,10 +514,35 @@ function createWriteHold(options = {}) {
                 follow(client, record.id);
             return classify(record);
         }
+        /**
+         * The one gate for every exit, offered or taken: no exit while any hash
+         * the hold has seen (its own, or a candidate) is a known pending
+         * transaction, whatever the state says, a replacement included.
+         */
         async function inspect(client, effect) {
+            const state = await inspectChain(client, effect);
+            if (state.status === "pending-known-hash")
+                return minedUnread(state, client);
+            if (state.status === "clear" || !state.exit)
+                return state;
+            // A hash proven dropped (another transaction used its sent nonce at a
+            // canonical finalized block) can't run, whatever a node still shows.
+            return ((await seenGate(state.record, client, state.status === "dropped-proven")) ?? state);
+        }
+        /**
+         * The way out of every method that has a client: a state that could
+         * offer the exit, or track a hash, is the gate's answer (inspect), so no
+         * method reports an exit state() would refuse. Under the call's lock.
+         */
+        async function finish(state, client) {
+            return state.status === "clear" || state.status === "ran-executed"
+                ? state
+                : inspect(client);
+        }
+        async function inspectChain(client, effect) {
             let record = recovery.read();
             if (!record)
-                return clear();
+                return cleared();
             // No evidence from another chain.
             if ((await client.getChainId().catch(() => null)) !== record.chainId)
                 return classify(record);
@@ -392,7 +553,7 @@ function createWriteHold(options = {}) {
                 .catch(() => null);
             record = recovery.read();
             if (!record)
-                return clear();
+                return cleared();
             if (check?.status === "sent") {
                 // An authenticated hash is seen: any vanished clock stops.
                 if (record.vanishedAt !== undefined)
@@ -405,17 +566,6 @@ function createWriteHold(options = {}) {
             // A hash saved before its clock existed starts it now.
             if (record.hash && record.submittedAt === undefined)
                 record = recovery.firstSeen(record);
-            // The app's effect read only changes the line, and offers the exit.
-            if (check?.status === "pending" && check.effect)
-                return {
-                    status: "looks-done",
-                    record,
-                    exit: true,
-                    line: messages_js_1.WRITE_HOLD_LOOKS_DONE_LINE,
-                    ...(record.hash
-                        ? { hash: record.hash, warning: messages_js_1.WRITE_HOLD_HASHED_EXIT_LINE }
-                        : {}),
-                };
             if (record.hash &&
                 record.sentNonce !== undefined &&
                 check?.status === "pending" &&
@@ -429,6 +579,18 @@ function createWriteHold(options = {}) {
                     line: (0, messages_js_1.writeHeldMessage)(),
                     warning: messages_js_1.WRITE_HOLD_HASHED_EXIT_LINE,
                 };
+            // The app's effect read only changes the line, and offers the exit;
+            // a proven drop above takes priority.
+            if (check?.status === "pending" && check.effect)
+                return {
+                    status: "looks-done",
+                    record,
+                    exit: true,
+                    line: messages_js_1.WRITE_HOLD_LOOKS_DONE_LINE,
+                    ...(record.hash
+                        ? { hash: record.hash, warning: messages_js_1.WRITE_HOLD_HASHED_EXIT_LINE }
+                        : {}),
+                };
             // A hash seen with its sent nonce that the node has since lost.
             if (record.hash &&
                 record.sentNonce !== undefined &&
@@ -464,7 +626,10 @@ function createWriteHold(options = {}) {
             state,
             /** What the saved record alone says, without asking the chain. */
             peek,
-            /** Every state this controller reads or makes for the call, and other tabs' changes. */
+            /**
+             * Every state this controller reads or makes for the call, and other
+             * tabs' changes. The latest one, if any, is replayed at once.
+             */
             subscribe(listener) {
                 let set = listeners.get(key);
                 if (!set)
@@ -472,6 +637,16 @@ function createWriteHold(options = {}) {
                 set.add(listener);
                 peekers.set(key, peek);
                 watchTabs();
+                // A subscriber that arrives after the hold spoke hears its latest state.
+                // Only while it still names the call's current record; otherwise
+                // what the saved record says now.
+                const last = latest.get(key);
+                if (last) {
+                    const now = peek();
+                    // A clear is compared by its settlement's identity, a hold by its record.
+                    const identity = (state) => JSON.stringify(state.status === "clear" ? (state.settled ?? null) : state.record);
+                    listener(ungated(identity(now) === identity(last) ? last : now));
+                }
                 return () => {
                     set.delete(listener);
                     if (!set.size) {
@@ -506,7 +681,8 @@ function createWriteHold(options = {}) {
                             attempt = recovery.reserve(actualCall, evidence);
                         }
                         catch (error) {
-                            const now = peek();
+                            const now = await finish(classify(recovery.read()), client);
+                            shown(now);
                             if (now.status !== "clear")
                                 throw new WriteHeldError(now);
                             throw error;
@@ -533,7 +709,7 @@ function createWriteHold(options = {}) {
                             catch {
                                 /* Not this proposal: the service is asked later. */
                             }
-                        shown(classify(attempt));
+                        shown(ungated(classify(attempt)));
                     },
                     onRejected() {
                         recovery.rejected();
@@ -572,7 +748,10 @@ function createWriteHold(options = {}) {
                         recovery.abandon(snapshot.record, { checkedWallet: true });
                     }
                     catch {
-                        return { released: false, state: peek() };
+                        return {
+                            released: false,
+                            state: await finish(classify(recovery.read()), client),
+                        };
                     }
                     return { released: true, state: clear() };
                 }, true);
@@ -591,8 +770,8 @@ function createWriteHold(options = {}) {
                     if (!record ||
                         (!record.safe &&
                             record.hash !== receipt?.transactionHash?.toLowerCase()))
-                        return classify(record);
-                    return settle(record, receipt, client, proof);
+                        return finish(classify(record), client);
+                    return finish(await settle(record, receipt, client, proof), client);
                 }, true);
                 return shown(result?.value ?? peek());
             },
@@ -615,15 +794,75 @@ function createWriteHold(options = {}) {
                 return shown(result?.value ?? peek());
             },
             /**
-             * The app's own proof that the held Safe proposal ran, with its
-             * execution's transaction when known. Kept until its result settles it.
+             * Attach a hash the chain authenticates as this exact call, sent by the
+             * account on the reservation's chain at or after its next nonce, and
+             * not mined before it was reserved, to the held write that has none: under
+             * one lock, without releasing it. The hold then follows that hash: no
+             * exit while it is pending, and its receipt settles it.
+             */
+            async attachHash(client, hash) {
+                const result = await locked(async () => {
+                    const record = recovery.read();
+                    if (record &&
+                        !record.safe &&
+                        !record.hash &&
+                        (0, untrusted_js_1.isBytes32)(hash) &&
+                        (await client.getChainId().catch(() => null)) === record.chainId) {
+                        const sent = await client
+                            .getTransaction({ hash })
+                            .catch(() => null);
+                        if (sent?.hash?.toLowerCase() === hash.toLowerCase() &&
+                            sent.from?.toLowerCase() === record.account &&
+                            (sent.chainId === undefined || sent.chainId === record.chainId) &&
+                            sent.to?.toLowerCase() === record.call.to &&
+                            sent.input?.toLowerCase() === record.call.data &&
+                            BigInt(sent.value) === BigInt(record.call.value) &&
+                            // This attempt, not an earlier identical call: never below the
+                            // account's next nonce or mined before it was reserved.
+                            // With no such evidence, an identical earlier call can't be
+                            // told apart: nothing is attached, and the exit stays.
+                            record.nonce !== undefined &&
+                            record.fromBlock !== undefined &&
+                            BigInt(sent.nonce) >= BigInt(record.nonce) &&
+                            (sent.blockNumber === null ||
+                                sent.blockNumber >= BigInt(record.fromBlock)))
+                            try {
+                                recovery.submitted(hash, record);
+                            }
+                            catch {
+                                /* Kept in this tab's memory, it still holds. */
+                            }
+                    }
+                    return inspect(client);
+                }, true);
+                return shown(result?.value ?? peek());
+            },
+            /**
+             * The app's word that the held Safe proposal ran, with its execution's
+             * transaction when known. Nothing is saved as executed on its word:
+             * the hash is kept as a candidate, and settles it only once its own
+             * receipt proves this Safe's execution of the exact proposal or call.
              */
             async onExecuted(client, executionHash) {
                 const result = await locked(async () => {
                     const record = recovery.read();
                     if (!record?.safe || !record.hash)
-                        return classify(record);
-                    recovery.executed(record, executionHash);
+                        return finish(classify(record), client);
+                    if (executionHash) {
+                        // Authenticated on arrival: its own receipt settles it, or proves
+                        // it isn't this write's; only an unresolved one is kept.
+                        const receipt = await client
+                            .getTransactionReceipt({ hash: executionHash })
+                            .catch(() => null);
+                        if (receipt) {
+                            const settled = await settle(record, receipt, client);
+                            if (settled.status === "clear" ||
+                                settled.status === "ran-executed")
+                                return settled;
+                        }
+                        if (!receipt || !(await disproves(record, receipt, client)))
+                            recovery.candidate(record, executionHash);
+                    }
                     return inspect(client);
                 }, true);
                 return shown(result?.value ?? peek());