@bsv/wallet-toolbox-client 2.6.4 → 2.7.0

package/out/index.client.cjs

@@ -175,23 +175,10 @@ var WalletError = class WalletError extends Error {
 	* @returns stringified JSON representation of the error such that it can be desirialized to a WalletError.
 	*/
 	static unknownToJson(error) {
-		let json;
-		let e;
-		const t = typeof error;
-		const ctorName = t === "object" && error !== null ? error.constructor : void 0;
-		const ctor = ctorName != null && typeof ctorName.name === "string" ? ctorName.name : void 0;
-		const name = t === "object" && error !== null && typeof error.name === "string" ? error.name : "";
-		const message = t === "object" && error !== null && typeof error.message === "string" ? error.message : "";
-		const hasToJson = t === "object" && typeof error?.toJson === "function";
-		if (ctor != null && ctor !== "" && ctor.startsWith("WERR_") && hasToJson) json = error.toJson();
-		else if (name !== "" && message !== "") {
-			e = new WalletError(name, message);
-			json = e.toJson();
-		} else {
-			e = new WalletError("WERR_UNKNOWN", String(error));
-			json = e.toJson();
-		}
-		return json;
+		const candidate = error;
+		if ((error instanceof WalletError || candidate?.isError === true) && typeof candidate.toJson === "function") return candidate.toJson();
+		if (typeof candidate?.name === "string" && typeof candidate.message === "string") return new WalletError(candidate.name, candidate.message).toJson();
+		return new WalletError("WERR_UNKNOWN", String(error)).toJson();
 	}
 };
 //#endregion
@@ -225,6 +212,47 @@ var WERR_INVALID_OPERATION = class extends WalletError {
 	}
 };
 /**
+* A destructive UTXO review could not obtain a conclusive verdict for every
+* candidate. Consumers can match this name and retry later without parsing the
+* human-readable message.
+*/
+var WERR_UTXO_REVIEW_INCONCLUSIVE = class extends WalletError {
+	checked;
+	confirmedSpent;
+	unknown;
+	constructor(checked, confirmedSpent, unknown) {
+		super("WERR_UTXO_REVIEW_INCONCLUSIVE", `UTXO review was inconclusive for ${unknown} of ${checked} candidates; no outputs were changed.`);
+		this.checked = checked;
+		this.confirmedSpent = confirmedSpent;
+		this.unknown = unknown;
+	}
+	toJson() {
+		const obj = JSON.parse(super.toJson());
+		obj.checked = this.checked;
+		obj.confirmedSpent = this.confirmedSpent;
+		obj.unknown = this.unknown;
+		return JSON.stringify(obj);
+	}
+};
+/**
+* An action-batch lifecycle operation cannot continue in the batch's current state.
+*/
+var WERRActionBatchState = class extends WalletError {
+	state;
+	batchId;
+	constructor(state, batchId) {
+		super("WERR_ACTION_BATCH_STATE", `Action batch cannot continue because it is ${state}.`);
+		this.state = state;
+		this.batchId = batchId;
+	}
+	toJson() {
+		const obj = JSON.parse(super.toJson());
+		obj.state = this.state;
+		obj.batchId = this.batchId;
+		return JSON.stringify(obj);
+	}
+};
+/**
 * Unable to broadcast transaction at this time.
 */
 var WERR_BROADCAST_UNAVAILABLE = class extends WalletError {
@@ -422,6 +450,10 @@ function WalletErrorFromJson(json) {
 	let e;
 	const obj = json;
 	switch (obj.name) {
+		case "WERR_ACTION_BATCH_STATE":
+			e = new WERRActionBatchState(obj.state, obj.batchId);
+			e.message = obj.message;
+			break;
 		case "WERR_NOT_IMPLEMENTED":
 			e = new WERR_NOT_IMPLEMENTED(obj.message);
 			break;
@@ -431,6 +463,10 @@ function WalletErrorFromJson(json) {
 		case "WERR_INVALID_OPERATION":
 			e = new WERR_INVALID_OPERATION(obj.message);
 			break;
+		case "WERR_UTXO_REVIEW_INCONCLUSIVE":
+			e = new WERR_UTXO_REVIEW_INCONCLUSIVE(obj.checked, obj.confirmedSpent, obj.unknown);
+			e.message = obj.message;
+			break;
 		case "WERR_BROADCAST_UNAVAILABLE":
 			e = new WERR_BROADCAST_UNAVAILABLE(obj.message);
 			break;
@@ -507,9 +543,10 @@ const specOpWalletManagedUtxos = "284570a6213a74ba861c38b1cf790e1e400d9cf9324454
 /**
 * `listOutputs` special operation basket name value.
 *
-* Returns currently spendable wallet change outputs that fail to validate as unspent transaction outputs.
+* Returns currently spendable wallet change outputs conclusively confirmed spent.
+* The operation rejects if any candidate cannot be classified conclusively.
 *
-* Optional tag value 'release'. If present, updates invalid change outputs to not spendable.
+* Optional tag value 'release'. If present, atomically updates only confirmed-spent change outputs to not spendable after rechecking current ownership and allocation state.
 *
 * Optional tag value 'all'. If present, processes all spendable true outputs, independent of baskets, but basket must be defined.
 */
@@ -839,6 +876,7 @@ var sdk_exports = /* @__PURE__ */ __exportAll({
 	ProvenTxReqNonTerminalStatus: () => ProvenTxReqNonTerminalStatus,
 	ProvenTxReqTerminalStatus: () => ProvenTxReqTerminalStatus,
 	Validation: () => _bsv_sdk.Validation,
+	WERR_ACTION_BATCH_STATE: () => WERRActionBatchState,
 	WERR_BAD_REQUEST: () => WERR_BAD_REQUEST,
 	WERR_BROADCAST_UNAVAILABLE: () => WERR_BROADCAST_UNAVAILABLE,
 	WERR_INSUFFICIENT_FUNDS: () => WERR_INSUFFICIENT_FUNDS,
@@ -853,6 +891,7 @@ var sdk_exports = /* @__PURE__ */ __exportAll({
 	WERR_NOT_IMPLEMENTED: () => WERR_NOT_IMPLEMENTED,
 	WERR_REVIEW_ACTIONS: () => WERR_REVIEW_ACTIONS,
 	WERR_UNAUTHORIZED: () => WERR_UNAUTHORIZED,
+	WERR_UTXO_REVIEW_INCONCLUSIVE: () => WERR_UTXO_REVIEW_INCONCLUSIVE,
 	WalletError: () => WalletError,
 	WalletErrorFromJson: () => WalletErrorFromJson,
 	isCreateActionSpecOp: () => isCreateActionSpecOp,
@@ -1019,8 +1058,8 @@ function toLookupNetworkPreset(chain) {
 	switch (chain) {
 		case "main": return "mainnet";
 		case "test": return "testnet";
+		case "ttn": return "teratestnet";
 		case "stn":
-		case "ttn":
 		case "tstn":
 		case "mock": return "local";
 	}
@@ -1391,6 +1430,42 @@ function makeBrc114ActionTimeLabel(unixMillis) {
 	return `action time ${unixMillis}`;
 }
 //#endregion
+//#region ../src/utility/brc153ReferenceLabels.ts
+const BRC153_REFERENCE_PREFIX = "reference ";
+/**
+* Build the BRC-153 synthetic listActions label for an action reference.
+* Encodes reference bytes as lowercase hex (labels are lowercased by validation).
+*/
+function makeBrc153ReferenceLabel(referenceBase64) {
+	const bytes = _bsv_sdk.Utils.toArray(referenceBase64, "base64");
+	return `${BRC153_REFERENCE_PREFIX}${_bsv_sdk.Utils.toHex(bytes)}`;
+}
+/**
+* True iff the label uses the reserved BRC-153 reference prefix.
+*/
+function isBrc153ReferenceLabel(label) {
+	return label.startsWith(BRC153_REFERENCE_PREFIX);
+}
+/**
+* Ensure labels contain exactly one wallet-authored `reference <hex>`.
+* Any existing reserved-prefix labels are replaced.
+*/
+function applyBrc153ReferenceLabel(labels, referenceBase64) {
+	const next = labels.filter((label) => !isBrc153ReferenceLabel(label));
+	next.push(makeBrc153ReferenceLabel(referenceBase64));
+	return next;
+}
+/**
+* Parse a BRC-153 synthetic reference label back to the BRC-100 Base64String reference.
+* Returns undefined if the label is not a valid reference label.
+*/
+function parseBrc153ReferenceLabel(label) {
+	if (!label.startsWith("reference ")) return void 0;
+	const hex = label.slice(10);
+	if (hex.length === 0 || hex.length % 2 !== 0 || !/^[0-9a-f]+$/.test(hex)) return void 0;
+	return _bsv_sdk.Utils.toBase64(_bsv_sdk.Utils.toArray(hex, "hex"));
+}
+//#endregion
 //#region ../src/storage/schema/entities/EntityBase.ts
 var EntityBase = class {
 	api;
@@ -2094,6 +2169,58 @@ var EntityOutput = class EntityOutput extends EntityBase {
 	}
 };
 //#endregion
+//#region ../src/storage/methods/managedChangePolicy.ts
+/** Historical default retained only to identify untouched wallet baskets. */
+const LEGACY_MANAGED_CHANGE_MINIMUM_SATOSHIS = 32;
+/**
+* Default liquidity policy for wallet-managed change.
+*
+* The preferred minimum is deliberately much larger than the dust threshold.
+* Dust answers "can this output ever be spent economically?"; this value
+* answers "is this output useful as an independently selectable liquidity
+* unit at contemporary fee rates?".
+*/
+const DEFAULT_MANAGED_CHANGE_TARGET_UTXOS = 144;
+const DEFAULT_MANAGED_CHANGE_MINIMUM_SATOSHIS = 5e3;
+const DEFAULT_MANAGED_CHANGE_MAX_OUTPUTS_PER_ACTION = 8;
+const DEFAULT_MANAGED_CHANGE_MIGRATION_INPUTS_PER_ACTION = 4;
+const DEFAULT_MANAGED_CHANGE_PENDING_COMPARISON_INPUTS = 16;
+/** True only for the exact historical default that is safe to auto-upgrade. */
+function isLegacyManagedChangeBasketDefault(basket) {
+	return basket.name === "default" && basket.numberOfDesiredUTXOs === 144 && basket.minimumDesiredUTXOValue === 32;
+}
+/**
+* Normalize a legacy default while retaining every other field and every
+* operator-selected non-default value. Used by migrations, sync, and restore.
+*/
+function upgradeLegacyManagedChangeBasketDefault(basket) {
+	if (!isLegacyManagedChangeBasketDefault(basket)) return basket;
+	return {
+		...basket,
+		minimumDesiredUTXOValue: DEFAULT_MANAGED_CHANGE_MINIMUM_SATOSHIS
+	};
+}
+function defaultManagedChangePolicy() {
+	return {
+		maxOutputsPerAction: 8,
+		migrationInputsPerAction: 4,
+		pendingComparisonInputs: 16
+	};
+}
+function validateManagedChangePolicy(options) {
+	const policy = {
+		...defaultManagedChangePolicy(),
+		...options
+	};
+	const validateLimit = (value, name, minimum) => {
+		if (value !== -1 && (!Number.isSafeInteger(value) || value < minimum)) throw new WERR_INVALID_PARAMETER(`managedChangePolicy.${name}`, `${minimum === 0 ? "a non-negative" : "a positive"} safe integer or -1 for unlimited`);
+	};
+	validateLimit(policy.maxOutputsPerAction, "maxOutputsPerAction", 1);
+	validateLimit(policy.migrationInputsPerAction, "migrationInputsPerAction", 0);
+	validateLimit(policy.pendingComparisonInputs, "pendingComparisonInputs", 1);
+	return policy;
+}
+//#endregion
 //#region ../src/storage/schema/entities/EntityOutputBasket.ts
 var EntityOutputBasket = class EntityOutputBasket extends EntityBase {
 	constructor(api) {
@@ -2196,13 +2323,15 @@ var EntityOutputBasket = class EntityOutputBasket extends EntityBase {
 		this.userId = userId;
 		this.name ||= "default";
 		this.basketId = 0;
+		this.api = upgradeLegacyManagedChangeBasketDefault(this.api);
 		this.basketId = await storage.insertOutputBasket(this.toApi(), trx);
 	}
 	async mergeExisting(storage, since, ei, syncMap, trx) {
 		let wasMerged = false;
 		if (ei.updated_at > this.updated_at) {
-			this.minimumDesiredUTXOValue = ei.minimumDesiredUTXOValue;
-			this.numberOfDesiredUTXOs = ei.numberOfDesiredUTXOs;
+			const incoming = upgradeLegacyManagedChangeBasketDefault(ei);
+			this.minimumDesiredUTXOValue = incoming.minimumDesiredUTXOValue;
+			this.numberOfDesiredUTXOs = incoming.numberOfDesiredUTXOs;
 			this.isDeleted = ei.isDeleted;
 			this.updated_at = new Date(Math.max(ei.updated_at.getTime(), this.updated_at.getTime()));
 			await storage.updateOutputBasket(this.id, this.toApi(), trx);
@@ -4372,6 +4501,12 @@ var WalletStorageManager = class {
 	async renewActionBatch(batchId) {
 		return await this.runAsWriter(async (writer) => await writer.renewActionBatch(await this.getAuth(true), batchId));
 	}
+	async resumeActionBatch(args) {
+		return await this.runAsWriter(async (writer) => {
+			if (writer.resumeActionBatch == null) throw new WERR_NOT_IMPLEMENTED("action batch resume is not available");
+			return await writer.resumeActionBatch(await this.getAuth(true), args);
+		});
+	}
 	async prepareActionBatchCommit(manifest) {
 		return await this.runAsWriter(async (writer) => await writer.prepareActionBatchCommit(await this.getAuth(true), manifest));
 	}
@@ -4726,8 +4861,20 @@ var WalletStorageManager = class {
 		});
 		return log;
 	}
+	/**
+	* Return the remote HTTP(S) endpoint for a managed store, if any.
+	*
+	* Duck-types `endpointUrl` on the provider (as set by `StorageClientBase`).
+	* Do **not** key this off `constructor.name === 'StorageClient'`: production
+	* minifiers (Vite/esbuild/webpack) rename classes, so that check fails and
+	* every remote store reports `endpointURL: undefined` even though the URL is
+	* present. Consumers that match backups by URL (e.g. making a remote store
+	* primary) then fail while sync still works, because sync walks `_backups`
+	* without needing `endpointURL`.
+	*/
 	getStoreEndpointURL(store) {
-		if (store.storage.constructor.name === "StorageClient") return store.storage.endpointUrl;
+		const url = store.storage.endpointUrl;
+		if (typeof url === "string" && url.length > 0) return url;
 	}
 	getStores() {
 		const stores = [];
@@ -5153,7 +5300,7 @@ async function getBeefForTransaction(storage, txid, options) {
 	const concurrency = normalizeConcurrency(options.maxConcurrency);
 	while (frontier.length > 0) {
 		const current = frontier.filter((item) => needsResolution(beef, item.txid, hasKnownTxid));
-		const resolved = await mapWithConcurrency(current, concurrency, async (item) => await resolveBeefForTransaction(storage, item.txid, options, hasKnownTxid, item.depth));
+		const resolved = await mapWithConcurrency$1(current, concurrency, async (item) => await resolveBeefForTransaction(storage, item.txid, options, hasKnownTxid, item.depth));
 		const next = [];
 		for (let i = 0; i < resolved.length; i++) {
 			const result = resolved[i];
@@ -5210,7 +5357,7 @@ function requiresSingleRootPolicy(options) {
 	return options.ignoreStorage === true || options.minProofLevel !== void 0 || options.chainTracker != null || options.skipInvalidProofs === true;
 }
 async function mergeSingleRootFragments(storage, roots, options, beef) {
-	const fragments = await mapWithConcurrency(roots.filter((txid) => beef.findTxid(txid) == null), normalizeConcurrency(options.maxConcurrency), async (txid) => await getBeefForTransaction(storage, txid, {
+	const fragments = await mapWithConcurrency$1(roots.filter((txid) => beef.findTxid(txid) == null), normalizeConcurrency(options.maxConcurrency), async (txid) => await getBeefForTransaction(storage, txid, {
 		...options,
 		mergeToBeef: void 0
 	}));
@@ -5329,7 +5476,7 @@ function needsResolution(beef, txid, hasKnownTxid) {
 async function mergeMissingFragments(storage, beef, missing, options) {
 	if (missing.length === 0) return;
 	if (options.ignoreServices === true) throw new WERR_INVALID_PARAMETER(`txid ${missing[0].txid}`, `valid transaction on chain ${storage.chain}`);
-	const fragments = await mapWithConcurrency(missing, normalizeConcurrency(options.maxConcurrency), async (item) => await getBeefForTransaction(storage, item.txid, {
+	const fragments = await mapWithConcurrency$1(missing, normalizeConcurrency(options.maxConcurrency), async (item) => await getBeefForTransaction(storage, item.txid, {
 		...options,
 		ignoreStorage: true,
 		mergeToBeef: void 0
@@ -5352,7 +5499,7 @@ function makeKnownTxidLookup$1(knownTxids) {
 function normalizeConcurrency(value = 8) {
 	return Number.isFinite(value) ? Math.max(1, Math.min(32, Math.floor(value))) : 8;
 }
-async function mapWithConcurrency(values, concurrency, mapper) {
+async function mapWithConcurrency$1(values, concurrency, mapper) {
 	const results = Array.from({ length: values.length }, () => void 0);
 	let cursor = 0;
 	await Promise.all(Array.from({ length: Math.min(concurrency, values.length) }, async () => {
@@ -5763,6 +5910,177 @@ async function commitNewTxToStorage(storage, userId, vargs) {
 	return r;
 }
 //#endregion
+//#region ../src/services/classifyOutputUtxo.ts
+async function mapWithConcurrency(values, maxConcurrency, worker) {
+	const results = Array.from({ length: values.length });
+	let nextIndex = 0;
+	const workers = Array.from({ length: Math.min(maxConcurrency, values.length) }, async () => {
+		while (nextIndex < values.length) {
+			const index = nextIndex++;
+			results[index] = await worker(values[index], index);
+		}
+	});
+	await Promise.all(workers);
+	return results;
+}
+/**
+* Classify an output without ever converting provider absence or failure into
+* positive spent evidence. This helper deliberately catches provider throws so
+* batch callers can finish classifying every candidate before deciding whether
+* a destructive operation is safe.
+*/
+async function classifyOutputUtxo(services, output) {
+	if (output.lockingScript == null || output.lockingScript.length === 0) return {
+		verdict: "unknown",
+		provider: "<no-locking-script>",
+		error: new WERR_INVALID_PARAMETER("output.lockingScript", "validated by storage provider validateOutputScript.")
+	};
+	if (typeof output.txid !== "string" || !/^[0-9a-fA-F]{64}$/.test(output.txid) || !Number.isSafeInteger(output.vout) || output.vout < 0) return {
+		verdict: "unknown",
+		provider: "<invalid-outpoint>",
+		error: new WERR_INVALID_PARAMETER("output outpoint", "a 32-byte transaction ID and non-negative vout")
+	};
+	try {
+		const hash = services.hashOutputScript(_bsv_sdk.Utils.toHex(output.lockingScript));
+		const result = await services.getUtxoStatus(hash, void 0, `${output.txid}.${output.vout}`);
+		const provider = typeof result?.name === "string" && result.name.length > 0 ? result.name : "<invalid-provider-result>";
+		if (result?.status !== "success" || typeof result.isUtxo !== "boolean" || provider === "<invalid-provider-result>") return {
+			verdict: "unknown",
+			provider,
+			error: result?.error
+		};
+		return {
+			verdict: result.isUtxo ? "unspent" : "spent",
+			provider
+		};
+	} catch (error) {
+		return {
+			verdict: "unknown",
+			provider: "<provider-error>",
+			error
+		};
+	}
+}
+/**
+* Convert an internal tri-state classification to the historical boolean
+* contract only when a provider supplied a conclusive answer.
+*/
+function requireConclusiveUtxo(classification) {
+	if (classification.verdict === "unspent") return true;
+	if (classification.verdict === "spent") return false;
+	if (classification.error instanceof Error) throw classification.error;
+	throw new WERR_INVALID_OPERATION(`UTXO provider ${classification.provider} did not return a conclusive result.`);
+}
+//#endregion
+//#region ../src/storage/methods/reconcileFailedTransactionInputs.ts
+async function findLocalInputs(req, storage, trx) {
+	const outpoints = _bsv_sdk.Transaction.fromBinary(req.rawTx).inputs.map((input) => ({
+		txid: input.sourceTXID ?? "",
+		vout: input.sourceOutputIndex ?? 0
+	})).filter((outpoint) => outpoint.txid !== "");
+	if (outpoints.length === 0) return [];
+	const transactions = await storage.findTransactions({
+		partial: { txid: req.txid },
+		noRawTx: true,
+		trx
+	});
+	const userIds = [...new Set(transactions.map((transaction) => transaction.userId))];
+	const localInputs = [];
+	const localKeys = /* @__PURE__ */ new Set();
+	for (const userId of userIds) {
+		const byOutpoint = await storage.findOutputsByOutpoints(userId, outpoints, trx);
+		for (const outpoint of outpoints) {
+			const output = byOutpoint[`${outpoint.txid}.${outpoint.vout}`];
+			const localKey = `${userId}:${outpoint.txid}.${outpoint.vout}`;
+			if (output != null && !localKeys.has(localKey)) {
+				localKeys.add(localKey);
+				localInputs.push({
+					output,
+					outpoint
+				});
+			}
+		}
+	}
+	return localInputs;
+}
+/**
+* Conservatively quarantine every locally-owned input of a transaction after
+* Arcade supplies explicit missing-input/conflict evidence. This path is
+* deliberately independent of explorer or UTXO providers: a positive
+* broadcaster verdict is enough to stop the failed transaction from feeding
+* the same inputs into another action. A later validated mined proof remains
+* able to repair the transaction through the ordinary proof recovery path.
+*/
+async function quarantineReqInputs(req, storage, trx, logger) {
+	const localInputs = await findLocalInputs(req, storage, trx);
+	const staleOutpoints = /* @__PURE__ */ new Set();
+	for (const { output, outpoint } of localInputs) {
+		await storage.updateOutput(verifyId(output.outputId), { spendable: false }, trx);
+		staleOutpoints.add(`${outpoint.txid}.${outpoint.vout}`);
+	}
+	const result = {
+		checked: localInputs.length,
+		staleConfirmed: localInputs.length,
+		staleOutpoints: [...staleOutpoints]
+	};
+	if (result.staleConfirmed > 0) logger?.log(`quarantineReqInputs: ${result.staleConfirmed} local input copy/copies quarantined for txid=${req.txid}`);
+	return result;
+}
+/**
+* Ask the configured UTXO-provider collection to classify the request's local
+* inputs and mark only positively confirmed spent outputs unavailable.
+* Provider errors and a collection with no providers are inconclusive and
+* never count as spent.
+*/
+async function markConfirmedStaleReqInputs(req, storage, services, trx, logger) {
+	const result = {
+		checked: 0,
+		staleConfirmed: 0,
+		staleOutpoints: []
+	};
+	const localInputs = await findLocalInputs(req, storage, trx);
+	const verdicts = /* @__PURE__ */ new Map();
+	const uniqueInputs = /* @__PURE__ */ new Map();
+	for (const localInput of localInputs) {
+		const key = `${localInput.outpoint.txid}.${localInput.outpoint.vout}`;
+		if (!uniqueInputs.has(key)) uniqueInputs.set(key, localInput);
+	}
+	await mapWithConcurrency([...uniqueInputs.values()], 4, async ({ output, outpoint }) => {
+		const key = `${outpoint.txid}.${outpoint.vout}`;
+		if (output.lockingScript == null) try {
+			await storage.validateOutputScript(output, trx);
+		} catch {
+			verdicts.set(key, "inconclusive");
+			return;
+		}
+		if (output.lockingScript == null) {
+			verdicts.set(key, "inconclusive");
+			return;
+		}
+		const classification = await classifyOutputUtxo(services, output);
+		let verdict;
+		if (classification.verdict === "unknown") verdict = "inconclusive";
+		else if (classification.verdict === "unspent") verdict = "utxo";
+		else verdict = "stale";
+		verdicts.set(key, verdict);
+	});
+	const staleOutpoints = /* @__PURE__ */ new Set();
+	for (const { output, outpoint } of localInputs) {
+		const key = `${outpoint.txid}.${outpoint.vout}`;
+		const verdict = verdicts.get(key);
+		if (verdict == null || verdict === "inconclusive") continue;
+		result.checked++;
+		if (verdict === "stale") {
+			await storage.updateOutput(verifyId(output.outputId), { spendable: false }, trx);
+			result.staleConfirmed++;
+			staleOutpoints.add(key);
+		}
+	}
+	result.staleOutpoints = [...staleOutpoints];
+	if (result.staleConfirmed > 0) logger?.log(`markConfirmedStaleReqInputs: ${result.staleConfirmed} of ${result.checked} local input copy/copies confirmed spent for txid=${req.txid}`);
+	return result;
+}
+//#endregion
 //#region ../src/storage/methods/attemptToPostReqsToNetwork.ts
 /**
 * Attempt to post one or more `ProvenTxReq` with status 'unsent'
@@ -6102,64 +6420,7 @@ async function confirmDoubleSpend(ar, beef, storage, services, logger) {
 * that were actually evicted (added to history note for diagnostics).
 */
 async function markStaleInputsAsSpent(ar, storage, services, trx, logger) {
-	const result = {
-		checked: 0,
-		staleConfirmed: 0,
-		staleOutpoints: []
-	};
-	const req = ar.vreq.req;
-	const txIds = req.notify.transactionIds;
-	if (txIds == null || txIds.length === 0) return result;
-	const txRecord = (await storage.findTransactions({
-		partial: { transactionId: txIds[0] },
-		noRawTx: true,
-		trx
-	}))[0];
-	if (txRecord == null) return result;
-	const userId = txRecord.userId;
-	const outpoints = _bsv_sdk.Transaction.fromBinary(req.rawTx).inputs.map((i) => ({
-		txid: i.sourceTXID ?? "",
-		vout: i.sourceOutputIndex ?? 0
-	})).filter((o) => o.txid !== "");
-	if (outpoints.length === 0) return result;
-	const byOutpoint = await storage.findOutputsByOutpoints(userId, outpoints, trx);
-	const checks = await Promise.all(outpoints.map(async (outpoint) => {
-		const localOutput = byOutpoint[`${outpoint.txid}.${outpoint.vout}`];
-		if (localOutput == null) return { kind: "skipped" };
-		if (localOutput.lockingScript == null) try {
-			await storage.validateOutputScript(localOutput, trx);
-		} catch {
-			return { kind: "skipped" };
-		}
-		let isStillUtxo;
-		try {
-			isStillUtxo = await services.isUtxo(localOutput);
-		} catch {
-			return {
-				kind: "service-error",
-				localOutput
-			};
-		}
-		return isStillUtxo ? {
-			kind: "still-utxo",
-			localOutput
-		} : {
-			kind: "stale",
-			localOutput,
-			outpoint
-		};
-	}));
-	for (const c of checks) {
-		if (c.kind === "skipped") continue;
-		result.checked++;
-		if (c.kind === "stale") {
-			await storage.updateOutput(c.localOutput.outputId, { spendable: false }, trx);
-			result.staleConfirmed++;
-			result.staleOutpoints.push(`${c.outpoint.txid}.${c.outpoint.vout}`);
-		}
-	}
-	if (result.staleConfirmed > 0) logger?.log(`markStaleInputsAsSpent: ${result.staleConfirmed} of ${result.checked} input(s) confirmed-spent on chain for txid=${req.txid}`);
-	return result;
+	return await markConfirmedStaleReqInputs(ar.vreq.req, storage, services, trx, logger);
 }
 //#endregion
 //#region ../src/storage/methods/listCertificates.ts
@@ -6312,6 +6573,75 @@ function removeDustOutputs(changeOutputs, dustFloor) {
 		largest.satoshis += removed.satoshis;
 	}
 }
+async function migrateLegacyChangeInputs(request) {
+	const { params, result } = request;
+	if (!params.surplusPoolShaping || result.changeOutputs.length === 0) return;
+	if (request.targetNetCount <= request.netChangeCount()) return;
+	const migrationLimit = params.maxMigrationInputs === -1 ? Number.MAX_SAFE_INTEGER : params.maxMigrationInputs ?? 0;
+	for (let migrated = 0; migrated < migrationLimit; migrated++) {
+		const marginalInputFee = request.feeTarget(1) - request.feeTarget();
+		const candidate = await request.allocateChangeInput(0);
+		if (candidate == null) break;
+		if (candidate.satoshis >= params.changeInitialSatoshis || candidate.satoshis <= marginalInputFee) {
+			await request.releaseChangeInput(candidate.outputId);
+			break;
+		}
+		request.recordAllocatedInput(candidate);
+	}
+}
+/**
+* Materialize the first managed-change output from surplus that is already in
+* the transaction. This is especially important for explicit/fixed inputs:
+* their value can fully fund an action before the allocator loop runs, but the
+* shaping policy must still capture the remainder without gathering another
+* wallet-managed input.
+*/
+function materializeSurplusChangeOutput(request) {
+	const { params, result } = request;
+	if (!params.surplusPoolShaping || result.changeOutputs.length > 0) return;
+	const availableAfterOutputFee = request.feeExcess(0, 1);
+	if (availableAfterOutputFee < request.dustFloor) return;
+	result.changeOutputs.push({
+		satoshis: Math.min(availableAfterOutputFee, Math.max(request.dustFloor, params.changeFirstSatoshis)),
+		lockingScriptLength: params.changeLockingScriptLength
+	});
+	request.feeExcess();
+}
+/**
+* Preserve the historical compatibility retry when another input can make a
+* viable change output, except when surplus-only shaping has nothing economic
+* to return. In that case the bounded remainder stays in the miner fee instead
+* of manufacturing change from an additional wallet input.
+*/
+async function requireViableChangeOrRetainBoundedFee(request) {
+	const { params, result } = request;
+	const feeExcessNow = request.feeExcess();
+	if (result.changeOutputs.length > 0 || feeExcessNow <= 0) return;
+	if (params.surplusPoolShaping === true && request.feeExcess(0, 1) < request.dustFloor) return;
+	const minimumChange = Math.max(request.dustFloor, params.changeFirstSatoshis);
+	const totalSatoshisNeeded = request.spending() + request.feeTarget(0, 1) + minimumChange;
+	const moreSatoshisNeeded = Math.max(1, totalSatoshisNeeded - request.funding());
+	await request.releaseAllocatedChangeInputs();
+	throw new WERR_INSUFFICIENT_FUNDS(totalSatoshisNeeded, moreSatoshisNeeded);
+}
+function shapeSurplusChangeOutputs(request) {
+	const { params, result } = request;
+	if (!params.surplusPoolShaping || result.changeOutputs.length !== 1) return;
+	if (request.targetNetCount <= request.netChangeCount()) return;
+	const originalSatoshis = result.changeOutputs[0].satoshis;
+	const desiredOutputs = Math.min(request.maxChangeOutputs, Math.max(1, request.targetNetCount + result.allocatedChangeInputs.length));
+	for (let count = desiredOutputs; count > 1; count--) {
+		const addedOutputs = count - 1;
+		const distributable = originalSatoshis - (request.feeTarget(0, addedOutputs) - request.feeTarget());
+		if (distributable < count * params.changeInitialSatoshis) continue;
+		result.changeOutputs = Array.from({ length: count }, () => ({
+			satoshis: params.changeInitialSatoshis,
+			lockingScriptLength: params.changeLockingScriptLength
+		}));
+		distributeExcessFees(result.changeOutputs, params.changeInitialSatoshis, distributable - count * params.changeInitialSatoshis, request.rand);
+		break;
+	}
+}
 /**
 * Simplifications:
 *  - only support one change type with fixed length scripts.
@@ -6383,7 +6713,8 @@ async function generateChangeSdkCore(params, allocateChangeInput, releaseChangeI
 		* Applies the per-transaction limit so that the UTXO pool grows
 		* gradually rather than all at once.
 		*/
-		const maxChangeOutputs = params.maxChangeOutputs ?? 8;
+		const maxChangeOutputs = params.maxChangeOutputs === -1 ? Number.MAX_SAFE_INTEGER : params.maxChangeOutputs ?? 8;
+		const surplusPoolShaping = params.surplusPoolShaping === true;
 		const randomVals = [...params.randomVals || []];
 		const nextRandomVal = () => {
 			let val = 0;
@@ -6466,6 +6797,7 @@ async function generateChangeSdkCore(params, allocateChangeInput, releaseChangeI
 			return r.changeOutputs.length - r.allocatedChangeInputs.length;
 		};
 		const addOutputToBalanceNewInput = () => {
+			if (surplusPoolShaping) return false;
 			if (!hasTargetNetCount) return false;
 			if (r.changeOutputs.length >= maxChangeOutputs) return false;
 			return netChangeCount() - 1 < targetNetCount;
@@ -6481,6 +6813,7 @@ async function generateChangeSdkCore(params, allocateChangeInput, releaseChangeI
 			feeExcessNow = feeExcess();
 		};
 		const addDesiredChangeOutputs = () => {
+			if (surplusPoolShaping) return;
 			while (r.changeOutputs.length < maxChangeOutputs && (hasTargetNetCount && targetNetCount > netChangeCount() || r.changeOutputs.length === 0 && feeExcess() > 0)) {
 				const satoshis = r.changeOutputs.length === 0 ? Math.max(dustFloor, params.changeFirstSatoshis) : Math.max(dustFloor, params.changeInitialSatoshis);
 				r.changeOutputs.push({
@@ -6496,7 +6829,8 @@ async function generateChangeSdkCore(params, allocateChangeInput, releaseChangeI
 				if (removingOutputs || feeExcess() <= 0) return;
 				if (!((ao === 1 || r.changeOutputs.length === 0) && r.changeOutputs.length < maxChangeOutputs)) return;
 				const cap = r.changeOutputs.length === 0 ? params.changeFirstSatoshis : params.changeInitialSatoshis;
-				const satoshis = Math.min(feeExcess(), Math.max(dustFloor, cap));
+				const outputFunding = surplusPoolShaping ? feeExcess(0, 1) : feeExcess();
+				const satoshis = Math.min(outputFunding, Math.max(dustFloor, cap));
 				if (satoshis >= dustFloor) r.changeOutputs.push({
 					satoshis,
 					lockingScriptLength: params.changeLockingScriptLength
@@ -6541,6 +6875,18 @@ async function generateChangeSdkCore(params, allocateChangeInput, releaseChangeI
 			};
 		}
 		/**
+		* The action may already be funded entirely by explicit/fixed inputs. In
+		* that case the allocator loop never runs, so capture the existing surplus
+		* here before the no-change compatibility guard. This operation cannot
+		* allocate an input; bounded legacy migration remains a separate step.
+		*/
+		materializeSurplusChangeOutput({
+			params,
+			result: r,
+			dustFloor,
+			feeExcess
+		});
+		/**
 		* Trigger an account funding event if we don't have enough to cover this transaction.
 		*/
 		if (feeExcess() < 0) {
@@ -6551,19 +6897,63 @@ async function generateChangeSdkCore(params, allocateChangeInput, releaseChangeI
 		}
 		/**
 		* If needed, seek funding to avoid overspending on fees without a change output to recapture it.
+		* An economically unreturnable shaping remainder stays in the miner fee;
+		* gathering another input solely to manufacture change would violate
+		* surplus-only shaping and make the action less efficient.
 		*/
-		if (r.changeOutputs.length === 0 && feeExcessNow > 0) {
-			const minimumChange = Math.max(dustFloor, params.changeFirstSatoshis);
-			const totalSatoshisNeeded = spending() + feeTarget(0, 1) + minimumChange;
-			const moreSatoshisNeeded = Math.max(1, totalSatoshisNeeded - funding());
-			await releaseAllocatedChangeInputs();
-			throw new WERR_INSUFFICIENT_FUNDS(totalSatoshisNeeded, moreSatoshisNeeded);
-		}
+		await requireViableChangeOrRetainBoundedFee({
+			params,
+			result: r,
+			dustFloor,
+			feeExcess,
+			feeTarget,
+			funding,
+			spending,
+			releaseAllocatedChangeInputs
+		});
+		/**
+		* Progressively retire economically useful legacy fragments without ever
+		* making them necessary for the requested action. The target of zero asks
+		* canonical allocators for their smallest remaining output. A candidate at
+		* or above the preferred value is not legacy migration material and is
+		* immediately released.
+		*/
+		await migrateLegacyChangeInputs({
+			params,
+			result: r,
+			targetNetCount,
+			netChangeCount,
+			feeTarget,
+			allocateChangeInput,
+			releaseChangeInput,
+			recordAllocatedInput: (candidate) => {
+				r.allocatedChangeInputs.push(candidate);
+				allocatedFunding += candidate.satoshis;
+				feeExcessNow = feeExcess();
+			}
+		});
 		/**
 		* Distribute the excess fees across the changeOutputs added.
 		*/
 		feeExcessNow = distributeExcessFees(r.changeOutputs, params.changeInitialSatoshis, feeExcessNow, rand);
 		/**
+		* Pool growth is funded only from the surplus already present in the
+		* transaction. Splitting one change output increases the serialized fee;
+		* that exact delta is deducted before assigning the new outputs. If the
+		* preferred minimum cannot be met, the transaction retains one smaller
+		* output instead of gathering more inputs or refusing an otherwise valid
+		* action.
+		*/
+		shapeSurplusChangeOutputs({
+			params,
+			result: r,
+			targetNetCount,
+			netChangeCount,
+			maxChangeOutputs,
+			feeTarget,
+			rand
+		});
+		/**
 		* Remove any change outputs that ended up below the dust floor after distribution.
 		* Consolidates removed satoshis into the largest remaining output.
 		*/
@@ -6594,7 +6984,11 @@ function validateGenerateChangeSdkResult(params, r) {
 		ok = false;
 	}
 	const feeRequired = Math.ceil((r.size || 0) / 1e3 * (r.satsPerKb || 0));
-	if (feeRequired !== r.fee) {
+	const minSpendTxSize = transactionSize([params.changeUnlockingScriptLength], [params.changeLockingScriptLength]);
+	const dustFloor = Math.max(1, Math.ceil(minSpendTxSize / 1e3 * (r.satsPerKb || 0)) * 2);
+	const feeWithChangeOutput = Math.ceil(((r.size || 0) + transactionOutputSize(params.changeLockingScriptLength)) / 1e3 * (r.satsPerKb || 0));
+	const isBoundedUnreturnableShapingSurplus = params.surplusPoolShaping === true && r.changeOutputs.length === 0 && r.fee > feeRequired && r.fee - feeWithChangeOutput < dustFloor;
+	if (feeRequired !== r.fee && !isBoundedUnreturnableShapingSurplus) {
 		log += `required fee error ${feeRequired} !== ${r.fee};`;
 		ok = false;
 	}
@@ -6632,6 +7026,8 @@ function validateGenerateChangeSdkParams(params) {
 	params.feeModel = validateStorageFeeModel(params.feeModel);
 	if (params.feeModel.model !== "sat/kb") throw new WERR_INVALID_PARAMETER("feeModel.model", "'sat/kb'");
 	_bsv_sdk.Validation.validateOptionalInteger(params.targetNetCount, "targetNetCount");
+	if (params.maxChangeOutputs !== -1) _bsv_sdk.Validation.validateOptionalInteger(params.maxChangeOutputs, "maxChangeOutputs", 1);
+	if (params.maxMigrationInputs !== -1) _bsv_sdk.Validation.validateOptionalInteger(params.maxMigrationInputs, "maxMigrationInputs", 0);
 	_bsv_sdk.Validation.validateSatoshis(params.changeFirstSatoshis, "changeFirstSatoshis", 1);
 	_bsv_sdk.Validation.validateSatoshis(params.changeInitialSatoshis, "changeInitialSatoshis", 1);
 	_bsv_sdk.Validation.validateInteger(params.changeLockingScriptLength, "changeLockingScriptLength");
@@ -8099,6 +8495,8 @@ async function planFunding(state, args, explicit, noSendChange) {
 	const allocated = /* @__PURE__ */ new Map();
 	const noSend = [...noSendChange];
 	const changeBasket = state.begin.changeBasket;
+	const policy = validateManagedChangePolicy(state.begin.managedChangePolicy);
+	const preferredSatoshis = Math.max(1, changeBasket.minimumDesiredUTXOValue);
 	const params = {
 		fixedInputs: explicit.map((output, index) => ({
 			satoshis: output.satoshis,
@@ -8112,11 +8510,14 @@ async function planFunding(state, args, explicit, noSendChange) {
 			lockingScriptLength: 25
 		}] : []],
 		feeModel: state.begin.feeModel,
-		changeInitialSatoshis: Math.max(1, changeBasket.minimumDesiredUTXOValue),
-		changeFirstSatoshis: Math.max(1, Math.round(changeBasket.minimumDesiredUTXOValue / 4)),
+		changeInitialSatoshis: preferredSatoshis,
+		changeFirstSatoshis: preferredSatoshis,
 		changeLockingScriptLength: 25,
 		changeUnlockingScriptLength: 107,
 		targetNetCount: changeBasket.numberOfDesiredUTXOs - state.estimatedChangeCount,
+		maxChangeOutputs: policy.maxOutputsPerAction,
+		surplusPoolShaping: true,
+		maxMigrationInputs: policy.migrationInputsPerAction,
 		randomVals: args.randomVals
 	};
 	const allocate = async (targetSatoshis, exactSatoshis) => {
@@ -8135,7 +8536,18 @@ async function planFunding(state, args, explicit, noSendChange) {
 		allocated.delete(outputId);
 		if (noSendChange.includes(output)) noSend.push(output);
 	};
-	const result = await generateChangeSdk(params, allocate, release, args.logger);
+	let result;
+	try {
+		result = await generateChangeSdk(params, allocate, release, args.logger);
+	} catch (error) {
+		if (!(error instanceof WERR_INSUFFICIENT_FUNDS)) throw error;
+		result = await generateChangeSdk({
+			...params,
+			changeFirstSatoshis: 1,
+			surplusPoolShaping: false,
+			maxMigrationInputs: 0
+		}, allocate, release, args.logger);
+	}
 	return {
 		allocated: result.allocatedChangeInputs.map((input) => verifyTruthy(allocated.get(input.outputId))),
 		changeSatoshis: result.changeOutputs.map((output) => output.satoshis),
@@ -8393,6 +8805,19 @@ async function compressActionBatchPackItems(items, encoding, maxBytes, maxItems)
 function mergeUnique(values) {
 	return [...new Set(values)];
 }
+function isActionBatchStateError(error) {
+	if (error instanceof WERRActionBatchState) return true;
+	if (error == null || typeof error !== "object") return false;
+	const candidate = error;
+	return (candidate.name === "WERR_ACTION_BATCH_STATE" || candidate.code === "WERR_ACTION_BATCH_STATE") && typeof candidate.state === "string";
+}
+function isActionBatchCapacityError(error) {
+	if (error == null || typeof error !== "object") return false;
+	const candidate = error;
+	const code = candidate.name === "Error" ? candidate.code : candidate.name ?? candidate.code;
+	if (code === "WERR_INVALID_PARAMETER" && candidate.parameter === "firstAction") return true;
+	return code === "WERR_INVALID_OPERATION" && typeof candidate.message === "string" && candidate.message.includes("action batch") && (candidate.message.includes("maximum") || candidate.message.includes("reserve"));
+}
 function nextGeometricTarget(value) {
 	return Math.min(Number.MAX_SAFE_INTEGER, value * 2);
 }
@@ -8439,6 +8864,7 @@ var ActionBatchWorkspace = class {
 	planned = /* @__PURE__ */ new Map();
 	actions = [];
 	lockingScripts = /* @__PURE__ */ new Map();
+	canResume;
 	ewmaConfirmedInputs = 1;
 	ewmaConfirmedSatoshis = 0;
 	hasConfirmedSample = false;
@@ -8458,6 +8884,7 @@ var ActionBatchWorkspace = class {
 		this.batchId = begin.batchId;
 		this.state = makePlannerState(begin, firstAction);
 		this.expiresAt = Date.parse(begin.expiresAt);
+		this.canResume = capabilities.resume === true && wallet.storage.resumeActionBatch != null;
 		this.eagerUploadLanes = Array.from({ length: capabilities.packedUploads == null ? 1 : Math.max(1, capabilities.maxConcurrentUploads) }, async () => {});
 	}
 	get usesCompactManifest() {
@@ -8471,6 +8898,15 @@ var ActionBatchWorkspace = class {
 		if (this.actions.some((action) => action.reference === reference || action.txid === reference)) return true;
 		return Object.entries(this.wallet.pendingSignActions).some(([pendingReference, pending]) => this.planned.has(pendingReference) && pending.tx.id("hex") === reference);
 	}
+	ownsTransaction(txid) {
+		return this.actions.some((action) => action.txid === txid) || Object.entries(this.wallet.pendingSignActions).some(([reference, pending]) => this.planned.has(reference) && pending.tx.id("hex") === txid);
+	}
+	references(args) {
+		return [...args.inputs.map((input) => input.outpoint), ...args.options.noSendChange].some((outpoint) => this.state.staged.has(`${outpoint.txid}.${outpoint.vout}`)) || args.options.sendWith.some((txid) => this.ownsTransaction(txid));
+	}
+	referencesSendWith(txids) {
+		return txids.some((txid) => this.ownsTransaction(txid));
+	}
 	get isEmpty() {
 		return this.planned.size === 0 && this.actions.length === 0;
 	}
@@ -8595,12 +9031,32 @@ var ActionBatchWorkspace = class {
 			satoshis: extension.reservedOutputs.reduce((sum, output) => sum + output.satoshis, 0)
 		};
 	}
+	async resume() {
+		const outpoints = [...new Map([...this.state.reserved.values(), ...this.state.explicit.values()].filter((output) => output.txid != null).map((output) => [`${output.txid}.${output.vout}`, {
+			txid: output.txid,
+			vout: output.vout
+		}])).values()];
+		const result = await this.wallet.storage.resumeActionBatch({
+			batchId: this.batchId,
+			outpoints
+		});
+		this.expiresAt = Date.parse(result.expiresAt);
+	}
 	async renewIfNeeded() {
-		if (Date.now() >= this.expiresAt) return;
+		if (Date.now() >= this.expiresAt) {
+			if (this.canResume) await this.resume();
+			return;
+		}
 		const renewAt = this.expiresAt - this.capabilities.leaseMs * .2;
 		if (Date.now() < renewAt) return;
 		this.renewal ??= this.wallet.storage.renewActionBatch(this.batchId).then((result) => {
 			this.expiresAt = Date.parse(result.expiresAt);
+		}).catch(async (error) => {
+			if (isActionBatchStateError(error) && error.state === "expired") {
+				if (this.canResume) await this.resume();
+				return;
+			}
+			throw error;
 		}).finally(() => {
 			this.renewal = void 0;
 		});
@@ -9031,24 +9487,42 @@ var ActionBatchController = class {
 		this.workspace = new ActionBatchWorkspace(this.wallet, begin, args, capabilities);
 		return this.workspace;
 	}
+	async retire(workspace) {
+		await workspace.abort().catch(() => void 0);
+		if (this.workspace === workspace) this.workspace = void 0;
+	}
+	async recover(workspace, input, isDelayed = false, resume = false) {
+		try {
+			if (resume) await workspace.resume();
+			return Array.isArray(input) ? await workspace.commit(input, isDelayed) : await workspace.plan(input);
+		} catch (error) {
+			if (!resume && isActionBatchStateError(error) && error.state === "expired" && workspace.canResume) return await this.recover(workspace, input, isDelayed, true);
+			if (isActionBatchStateError(error) && error.state !== "expired") await this.retire(workspace);
+			throw error;
+		}
+	}
 	async plan(args) {
 		return await this.runExclusive(async () => {
 			if (!args.isNewTx) return void 0;
-			let workspace = this.workspace;
-			let beganWorkspace = false;
-			if (workspace == null) {
-				if (!args.isNoSend) return void 0;
-				workspace = await this.begin(args);
-				if (workspace == null) return void 0;
-				beganWorkspace = true;
+			const workspace = this.workspace;
+			if (workspace != null) {
+				if (!workspace.references(args)) return void 0;
+				return await this.recover(workspace, args);
 			}
+			if (!args.isNoSend) return void 0;
+			let begun;
 			try {
-				return await workspace.plan(args);
+				begun = await this.begin(args);
 			} catch (error) {
-				if (beganWorkspace) {
-					await workspace.abort();
-					this.workspace = void 0;
-				}
+				if (isActionBatchCapacityError(error)) return void 0;
+				throw error;
+			}
+			if (begun == null) return void 0;
+			try {
+				return await begun.plan(args);
+			} catch (error) {
+				await this.retire(begun);
+				if (isActionBatchCapacityError(error)) return void 0;
 				throw error;
 			}
 		});
@@ -9058,11 +9532,21 @@ var ActionBatchController = class {
 			const workspace = this.workspace;
 			if (workspace == null) return void 0;
 			if (prior != null && !workspace.ownsReference(prior.reference)) return void 0;
+			if (prior == null && !workspace.referencesSendWith(args.options.sendWith)) return void 0;
 			if (prior != null) workspace.stage(prior, args);
-			if (!(args.isSendWith || prior != null && !args.isNoSend)) return { sendWithResults: [] };
+			const referencesWorkspace = workspace.referencesSendWith(args.options.sendWith);
+			if (prior != null && args.isNoSend && args.isSendWith && !referencesWorkspace) return await this.wallet.storage.processAction({
+				isNewTx: false,
+				isSendWith: true,
+				isNoSend: false,
+				isDelayed: args.isDelayed,
+				sendWith: [...args.options.sendWith],
+				logger: args.logger
+			});
+			if (!(referencesWorkspace || prior != null && !args.isNoSend)) return { sendWithResults: [] };
 			const sendWith = [...args.options.sendWith];
 			if (prior != null && !args.isNoSend && !sendWith.includes(prior.tx.id("hex"))) sendWith.push(prior.tx.id("hex"));
-			const result = await workspace.commit(sendWith, args.isDelayed);
+			const result = await this.recover(workspace, sendWith, args.isDelayed);
 			this.workspace = void 0;
 			return result;
 		});
@@ -9806,14 +10290,15 @@ var Wallet = class {
 	}
 	/**
 	* Uses `listOutputs` special operation to review the spendability via `Services` of
-	* outputs currently considered spendable. Returns the outputs that fail to verify.
+	* outputs currently considered spendable. Returns only outputs conclusively
+	* confirmed spent. Rejects the review if any provider result is inconclusive.
 	*
 	* Ignores the `limit` and `offset` properties.
 	*
 	* @param all Defaults to false. If false, only change outputs ('default' basket) are reviewed. If true, all spendable outputs are reviewed.
-	* @param release Defaults to false. If true, sets outputs that fail to verify to un-spendable (spendable: false)
+	* @param release Defaults to false. If true, atomically sets conclusively spent outputs to un-spendable (spendable: false). No outputs change if any candidate is inconclusive.
 	* @param optionalArgs Optional. Additional tags will constrain the outputs processed.
-	* @returns outputs which are/where considered spendable but currently fail to verify as spendable.
+	* @returns outputs previously considered spendable but conclusively confirmed spent.
 	*/
 	async reviewSpendableOutputs(all = false, release = false, optionalArgs) {
 		const args = {
@@ -10021,16 +10506,15 @@ async function createActionCore(storage, auth, vargs, parent) {
 	});
 	const feeModel = validateStorageFeeModel(storage.feeModel);
 	logger?.log(`validated fee model ${JSON.stringify(feeModel)}`);
-	const initialFundingPlan = await prepareFundingPlan(storage, [
+	const initialFundingPlan = await prepareFundingPlanWithLiquidityPolicy(storage, [
 		userId,
 		vargs,
 		xinputs,
 		xoutputs,
 		changeBasket,
 		noSendChangeIn,
-		feeModel,
-		parent
-	]);
+		feeModel
+	], parent);
 	logger?.log(`planned funding from ${initialFundingPlan.availableChangeCount} change inputs`);
 	const allocatedBeefPrefetch = startAllocatedChangeBeefPrefetch(storage, vargs, initialFundingPlan.selected, beef, parent);
 	const storageBeefBytes = storageBeef.toBinary();
@@ -10610,7 +11094,9 @@ async function traceStorageStep(storage, name, parent, attributes, callback) {
 		attributes
 	}, async (span) => await callback(span));
 }
-function makeFundingParams(vargs, xinputs, xoutputs, changeBasket, feeModel, availableChangeCount) {
+function makeFundingParams(args) {
+	const { storage, vargs, xinputs, xoutputs, changeBasket, feeModel, healthyChangeCount, compatibilityFallback } = args;
+	const preferredSatoshis = Math.max(1, changeBasket.minimumDesiredUTXOValue);
 	return {
 		fixedInputs: xinputs.map((input) => ({
 			satoshis: input.satoshis,
@@ -10621,36 +11107,52 @@ function makeFundingParams(vargs, xinputs, xoutputs, changeBasket, feeModel, ava
 			lockingScriptLength: output.lockingScript.length / 2
 		})),
 		feeModel,
-		changeInitialSatoshis: Math.max(1, changeBasket.minimumDesiredUTXOValue),
-		changeFirstSatoshis: Math.max(1, Math.round(changeBasket.minimumDesiredUTXOValue / 4)),
+		changeInitialSatoshis: preferredSatoshis,
+		changeFirstSatoshis: compatibilityFallback ? 1 : preferredSatoshis,
 		changeLockingScriptLength: 25,
 		changeUnlockingScriptLength: 107,
-		targetNetCount: changeBasket.numberOfDesiredUTXOs - availableChangeCount,
+		targetNetCount: changeBasket.numberOfDesiredUTXOs - healthyChangeCount,
+		maxChangeOutputs: storage.managedChangePolicy.maxOutputsPerAction,
+		surplusPoolShaping: !compatibilityFallback,
+		maxMigrationInputs: compatibilityFallback ? 0 : storage.managedChangePolicy.migrationInputsPerAction,
 		randomVals: vargs.randomVals
 	};
 }
-async function prepareFundingPlan(storage, context) {
-	const [userId, vargs, xinputs, xoutputs, changeBasket, noSendChangeIn, feeModel, parent, trx] = context;
-	const excludeSending = !vargs.isDelayed;
-	const candidates = await traceStorageStep(storage, "wallet.storage.create_action.funding_candidates", parent, { "funding.exclude_sending": excludeSending }, async (span) => {
-		const outputs = await storage.findAvailableManagedChangeInputCandidates(userId, changeBasket.basketId, excludeSending, trx);
-		span?.end({ attributes: {
-			"funding.candidate_count": outputs.length,
-			"funding.candidate_satoshis": outputs.reduce((sum, output) => sum + output.satoshis, 0)
-		} });
-		return outputs;
-	});
+async function buildFundingPlan(storage, context, candidates, eligibleStatuses, policyTier, compatibilityFallback, parent) {
+	const [userId, vargs, xinputs, xoutputs, changeBasket, noSendChangeIn, feeModel] = context;
 	const noSendIds = new Set(noSendChangeIn.map((output) => output.outputId));
-	const available = candidates.filter((output) => !noSendIds.has(output.outputId));
-	const params = makeFundingParams(vargs, xinputs, xoutputs, changeBasket, feeModel, candidates.length);
+	const available = candidates.filter((output) => !noSendIds.has(output.outputId) && eligibleStatuses.includes(output.transactionStatus));
+	const preferredSatoshis = Math.max(1, changeBasket.minimumDesiredUTXOValue);
+	const params = makeFundingParams({
+		storage,
+		vargs,
+		xinputs,
+		xoutputs,
+		changeBasket,
+		feeModel,
+		healthyChangeCount: compatibilityFallback ? candidates.filter((output) => eligibleStatuses.includes(output.transactionStatus)).length : candidates.filter((output) => output.satoshis >= preferredSatoshis).length,
+		compatibilityFallback
+	});
+	const noSendStatuses = await storage.findTransactionStatusesByIds(userId, noSendChangeIn.map((output) => output.transactionId));
+	const plannedNoSend = noSendChangeIn.map((output) => ({
+		outputId: output.outputId,
+		transactionId: output.transactionId,
+		satoshis: output.satoshis,
+		txid: output.txid,
+		vout: output.vout,
+		transactionStatus: noSendStatuses.get(output.transactionId) ?? "nosend"
+	}));
+	const claimStatuses = [.../* @__PURE__ */ new Set([...eligibleStatuses, ...plannedNoSend.map((output) => output.transactionStatus)])];
 	return await traceStorageStep(storage, "wallet.storage.create_action.funding_plan", parent, {
 		"funding.candidate_count": available.length,
-		"funding.no_send_change_count": noSendChangeIn.length
+		"funding.no_send_change_count": noSendChangeIn.length,
+		"funding.policy_tier": policyTier,
+		"funding.compatibility_fallback": compatibilityFallback
 	}, async (span) => {
 		const allocated = /* @__PURE__ */ new Map();
 		const availableSelector = new CanonicalChangeSelector(available);
-		const noSend = [...noSendChangeIn];
-		const noSendById = new Map(noSendChangeIn.map((output) => [output.outputId, output]));
+		const noSend = [...plannedNoSend];
+		const noSendById = new Map(plannedNoSend.map((output) => [output.outputId, output]));
 		const allocate = async (targetSatoshis, exactSatoshis) => {
 			let output = noSend.pop();
 			output ??= availableSelector.take(targetSatoshis, exactSatoshis);
@@ -10680,12 +11182,119 @@ async function prepareFundingPlan(storage, context) {
 			params,
 			result,
 			selected,
-			availableChangeCount: candidates.length
+			availableChangeCount: candidates.length,
+			eligibleStatuses: claimStatuses,
+			policyTier,
+			compatibilityFallback
 		};
 	});
 }
+async function fundingPlanSerializedCost(storage, plan, knownTxids) {
+	const txids = [...new Set(plan.selected.map((candidate) => verifyTruthy(candidate.txid)))];
+	if (txids.length === 0) return plan.result.size;
+	try {
+		const beef = await storage.getBeefForTransactions(txids, {
+			knownTxids,
+			ignoreStorage: false,
+			ignoreServices: true,
+			ignoreNewProven: false
+		});
+		return plan.result.size + beef.toUint8Array().length;
+	} catch {
+		return Number.MAX_SAFE_INTEGER;
+	}
+}
+const FUNDING_TIERS = [
+	{
+		policyTier: "completed",
+		statuses: ["completed"]
+	},
+	{
+		policyTier: "unproven",
+		statuses: ["completed", "unproven"]
+	},
+	{
+		policyTier: "sending",
+		statuses: [
+			"completed",
+			"unproven",
+			"sending"
+		]
+	}
+];
+async function resolveFundingCandidates(storage, userId, basketId, parent, trx) {
+	const rawCandidates = await traceStorageStep(storage, "wallet.storage.create_action.funding_candidates", parent, { "funding.include_pending": true }, async (span) => {
+		const outputs = await storage.findAvailableManagedChangeInputCandidates(userId, basketId, false, trx);
+		span?.end({ attributes: {
+			"funding.candidate_count": outputs.length,
+			"funding.candidate_satoshis": outputs.reduce((sum, output) => sum + output.satoshis, 0),
+			"funding.completed_candidate_count": outputs.filter((output) => output.transactionStatus === "completed").length,
+			"funding.unproven_candidate_count": outputs.filter((output) => output.transactionStatus === "unproven").length,
+			"funding.sending_candidate_count": outputs.filter((output) => output.transactionStatus === "sending").length
+		} });
+		return outputs;
+	});
+	const missingStatusIds = rawCandidates.filter((output) => output.transactionStatus == null).map((output) => output.transactionId);
+	const missingStatuses = await storage.findTransactionStatusesByIds(userId, missingStatusIds, trx);
+	const candidates = rawCandidates.map((output) => ({
+		...output,
+		transactionStatus: output.transactionStatus ?? missingStatuses.get(output.transactionId)
+	}));
+	if (candidates.some((output) => output.transactionStatus == null)) throw new WERR_INTERNAL("managed change candidate is missing its source transaction status");
+	return candidates;
+}
+async function buildFundingPlanForTier(storage, context, candidates, tier, parent) {
+	try {
+		return { plan: await buildFundingPlan(storage, context, candidates, tier.statuses, tier.policyTier, false, parent) };
+	} catch (error) {
+		if (!(error instanceof WERR_INSUFFICIENT_FUNDS)) throw error;
+	}
+	try {
+		return { plan: await buildFundingPlan(storage, context, candidates, tier.statuses, "compatibility", true, parent) };
+	} catch (error) {
+		if (!(error instanceof WERR_INSUFFICIENT_FUNDS)) throw error;
+		return { fundingError: error };
+	}
+}
+function firstPlanNeedsNoPendingComparison(storage, plan) {
+	const threshold = storage.managedChangePolicy.pendingComparisonInputs;
+	return threshold === -1 || plan.selected.length <= threshold;
+}
+async function chooseLowestSerializedFundingPlan(storage, plans, knownTxids) {
+	let chosen = plans[0];
+	let chosenCost = await fundingPlanSerializedCost(storage, chosen, knownTxids);
+	for (const alternative of plans.slice(1)) {
+		const cost = await fundingPlanSerializedCost(storage, alternative, knownTxids);
+		if (cost < chosenCost) {
+			chosen = alternative;
+			chosenCost = cost;
+		}
+	}
+	return chosen;
+}
+async function prepareFundingPlanWithLiquidityPolicy(storage, context, parent, trx) {
+	const [userId, vargs, , , changeBasket] = context;
+	const candidates = await resolveFundingCandidates(storage, userId, changeBasket.basketId, parent, trx);
+	const successful = [];
+	let fundingError;
+	for (const tier of FUNDING_TIERS) {
+		const attempted = await buildFundingPlanForTier(storage, context, candidates, tier, parent);
+		fundingError = attempted.fundingError ?? fundingError;
+		const plan = attempted.plan;
+		if (plan != null) {
+			successful.push(plan);
+			if (successful.length === 1 && firstPlanNeedsNoPendingComparison(storage, plan)) return plan;
+		}
+	}
+	if (successful.length > 0) {
+		if (successful.length === 1) return successful[0];
+		return await chooseLowestSerializedFundingPlan(storage, successful, vargs.options.knownTxids);
+	}
+	if (fundingError != null) throw fundingError;
+	throw new WERR_INTERNAL("funding policy produced neither a plan nor an error");
+}
 async function claimFundingPlan(storage, request) {
-	const [userId, basketId, excludeSending, transactionId, noSendChangeIn, plan, trx] = request;
+	const [userId, basketId, eligibleStatuses, transactionId, noSendChangeIn, plan, trx] = request;
 	if (plan.selected.length === 0) return {
 		outputs: [],
 		sourceTransactionCount: 0,
@@ -10693,10 +11302,8 @@ async function claimFundingPlan(storage, request) {
 		scriptSourceTransactionCount: 0
 	};
 	const noSendIds = new Set(noSendChangeIn.map((output) => output.outputId));
-	const statuses = ["completed", "unproven"];
-	if (!excludeSending) statuses.push("sending");
 	const claim = await storage.transaction(async (claimTrx) => {
-		const currentById = await storage.findFundingOutputsForUpdate(userId, plan.selected.map((output) => output.outputId), statuses, claimTrx);
+		const currentById = await storage.findFundingOutputsForUpdate(userId, plan.selected.map((output) => output.outputId), eligibleStatuses, claimTrx);
 		const transactionIds = [...new Set(Object.values(currentById).map((output) => output.transactionId))];
 		const claimed = [];
 		for (const planned of plan.selected) {
@@ -10766,7 +11373,7 @@ async function fundNewTransactionSdk(storage, userId, vargs, ctx, initialPlan, p
 			const claim = await claimFundingPlan(storage, [
 				userId,
 				ctx.changeBasket.basketId,
-				!vargs.isDelayed,
+				plan.eligibleStatuses,
 				ctx.transactionId,
 				ctx.noSendChangeIn,
 				plan,
@@ -10784,17 +11391,15 @@ async function fundNewTransactionSdk(storage, userId, vargs, ctx, initialPlan, p
 			}
 			if (claim.conflict === "noSendChange") throw new WERR_INVALID_PARAMETER("noSendChange", "outputs that remain spendable during action planning");
 			retryCount++;
-			plan = await prepareFundingPlan(storage, [
+			plan = await prepareFundingPlanWithLiquidityPolicy(storage, [
 				userId,
 				vargs,
 				ctx.xinputs,
 				ctx.xoutputs,
 				ctx.changeBasket,
 				ctx.noSendChangeIn,
-				ctx.feeModel,
-				parent,
-				trx
-			]);
+				ctx.feeModel
+			], parent, trx);
 		}
 		throw new WERR_INVALID_OPERATION("wallet funding changed repeatedly during action planning; retry createAction");
 	});
@@ -12939,7 +13544,7 @@ var StorageReaderWriter = class extends StorageReader {
 				userId: user.userId,
 				name: "default",
 				numberOfDesiredUTXOs: 144,
-				minimumDesiredUTXOValue: 32,
+				minimumDesiredUTXOValue: DEFAULT_MANAGED_CHANGE_MINIMUM_SATOSHIS,
 				isDeleted: false
 			});
 			break;
@@ -13220,8 +13825,10 @@ function validateActionBatchInlinePayload(manifest) {
 	for (const { digest, bytes } of inlineBlobs) if (actionBatchBlobDigest(bytes) !== digest) throw new WERR_INVALID_PARAMETER("inlineBlobs", `content matching digest ${digest}`);
 }
 function requireUploadableBatch(batch) {
-	if (batch == null || batch.status === "committed" || batch.status === "aborted") throw new WERR_INVALID_OPERATION("action batch is not uploadable");
-	if (batch.hardExpiresAt.getTime() <= Date.now()) throw new WERR_INVALID_OPERATION("action batch hard lifetime has expired");
+	if (batch == null) throw new WERRActionBatchState("missing");
+	if (batch.status === "committed") throw new WERRActionBatchState("committed", batch.batchId);
+	if (batch.status === "aborted") throw new WERRActionBatchState("aborted", batch.batchId);
+	if (batch.hardExpiresAt.getTime() <= Date.now()) throw new WERRActionBatchState("hard-expired", batch.batchId);
 	return batch;
 }
 function manifestPhysicalDigests(manifest) {
@@ -13581,7 +14188,10 @@ const ACTION_BATCH_LEASE_MS = 900 * 1e3;
 const ACTION_BATCH_HARD_LIFETIME_MS = 3600 * 1e3;
 const INITIAL_RESERVATION_LIMIT = 8;
 const INITIAL_EXTRA_OUTPUTS = 3;
-function getActionBatchCapabilities() {
+function isValidOutpoint(outpoint) {
+	return /^[0-9a-f]{64}$/.test(outpoint.txid) && Number.isSafeInteger(outpoint.vout) && outpoint.vout >= 0;
+}
+function getActionBatchCapabilities(maxReservedOutputs = 256, supportsResume = false) {
 	return { actionBatch: {
 		version: 1,
 		maxInlineBytes: ACTION_BATCH_MAX_INLINE_BYTES,
@@ -13589,6 +14199,8 @@ function getActionBatchCapabilities() {
 		maxConcurrentUploads: 4,
 		leaseMs: ACTION_BATCH_LEASE_MS,
 		hardLifetimeMs: ACTION_BATCH_HARD_LIFETIME_MS,
+		resume: supportsResume ? true : void 0,
+		maxReservedOutputs,
 		compactBegin: true,
 		manifestVersion: 2,
 		commitByDigest: true,
@@ -13604,6 +14216,14 @@ function getActionBatchCapabilities() {
 function activeExpiry(batch, now = /* @__PURE__ */ new Date()) {
 	return batch.status !== "active" && batch.status !== "prepared" || batch.expiresAt.getTime() <= now.getTime() || batch.hardExpiresAt.getTime() <= now.getTime();
 }
+function actionBatchErrorState(batch, now = /* @__PURE__ */ new Date()) {
+	if (batch == null) return "missing";
+	if (batch.hardExpiresAt.getTime() <= now.getTime()) return "hard-expired";
+	if (batch.status === "aborted") return "aborted";
+	if (batch.status === "committed") return "committed";
+	if (batch.status === "expired" || batch.expiresAt.getTime() <= now.getTime()) return "expired";
+	if (batch.status !== "active" && batch.status !== "prepared") return "inactive";
+}
 function canExpire(batch, now = /* @__PURE__ */ new Date()) {
 	return (batch.status === "active" || batch.status === "prepared") && (batch.expiresAt.getTime() <= now.getTime() || batch.hardExpiresAt.getTime() <= now.getTime());
 }
@@ -13689,12 +14309,22 @@ function estimateFirstActionTarget(storage, args, inputSatoshis, outputScriptLen
 	const minFee = Math.ceil(transactionSize([...inputLengths, 107], outputLengths) * fee / 1e3);
 	return Math.max(1, outputSatoshis + minFee - inputSatoshis);
 }
+function selectReservationChange(candidates, targetSatoshis) {
+	for (const status of [
+		"completed",
+		"unproven",
+		"sending"
+	]) {
+		const selected = selectCanonicalChange(candidates.filter((candidate) => candidate.transactionStatus === status), targetSatoshis);
+		if (selected != null) return selected;
+	}
+}
 function chooseReservationPool(candidates, targetSatoshis, limit, extras, fillLimit, planningCosts) {
 	const remaining = candidates.filter((output) => output.satoshis > planningCosts.marginalInputFee);
 	const chosen = [];
 	let deficit = targetSatoshis + planningCosts.firstChangeCost;
 	while (deficit > 0 && chosen.length < limit) {
-		const output = selectCanonicalChange(remaining, deficit + planningCosts.marginalInputFee);
+		const output = selectReservationChange(remaining, deficit + planningCosts.marginalInputFee);
 		if (output == null) break;
 		chosen.push(output);
 		remaining.splice(remaining.indexOf(output), 1);
@@ -13702,14 +14332,18 @@ function chooseReservationPool(candidates, targetSatoshis, limit, extras, fillLi
 	}
 	const desiredCount = fillLimit ? limit : Math.min(limit, chosen.length + extras);
 	while (remaining.length > 0 && chosen.length < desiredCount) {
-		const output = selectCanonicalChange(remaining, targetSatoshis);
+		const output = selectReservationChange(remaining, targetSatoshis);
 		if (output == null) break;
 		chosen.push(output);
 		remaining.splice(remaining.indexOf(output), 1);
 	}
 	return chosen;
 }
-function reservationPlanningCosts(storage, basket) {
+function reservationOutput(candidate) {
+	const { transactionStatus: _transactionStatus, ...output } = candidate;
+	return output;
+}
+function reservationPlanningCosts(storage, _basket) {
 	const satsPerKb = validateStorageFeeModel(storage.feeModel).value ?? 0;
 	const minimumSpendSize = transactionSize([107], [25]);
 	const minimumSpendFee = Math.ceil(minimumSpendSize * satsPerKb / 1e3);
@@ -13717,7 +14351,7 @@ function reservationPlanningCosts(storage, basket) {
 	const marginalInputSize = transactionSize([107], []) - transactionSize([], []);
 	const marginalOutputSize = transactionSize([], [25]) - transactionSize([], []);
 	return {
-		firstChangeCost: Math.max(dustFloor, Math.max(1, Math.round(basket.minimumDesiredUTXOValue / 4))) + Math.ceil(marginalOutputSize * satsPerKb / 1e3),
+		firstChangeCost: dustFloor + Math.ceil(marginalOutputSize * satsPerKb / 1e3),
 		marginalInputFee: Math.ceil(marginalInputSize * satsPerKb / 1e3)
 	};
 }
@@ -13792,18 +14426,25 @@ async function beginActionBatch(storage, auth, args) {
 	const explicit = await resolveExplicitOutputs(storage, userId, args.firstAction, outputScriptLengths != null);
 	const noSendChange = await resolveNoSendChangeOutputs(storage, userId, args.firstAction);
 	const fixedOutputIds = new Set([...explicit.outputs, ...noSendChange.outputs].map((output) => output.outputId));
-	const available = (await storage.findAvailableManagedChangeInputs(userId, changeBasket.basketId, !args.firstAction.isDelayed)).filter((output) => !fixedOutputIds.has(output.outputId));
+	const availableOutputs = (await storage.findAvailableManagedChangeInputs(userId, changeBasket.basketId, false)).filter((output) => !fixedOutputIds.has(output.outputId));
+	const availableStatuses = await storage.findTransactionStatusesByIds(userId, availableOutputs.map((output) => output.transactionId));
+	const available = availableOutputs.map((output) => ({
+		...output,
+		transactionStatus: availableStatuses.get(output.transactionId) ?? "sending"
+	}));
 	const target = estimateFirstActionTarget(storage, args.firstAction, explicit.inputSatoshis + noSendChange.inputSatoshis, outputScriptLengths);
-	const fixedOutputs = [...explicit.outputs, ...noSendChange.outputs];
-	const funding = chooseReservationPool(available, target, Math.max(0, INITIAL_RESERVATION_LIMIT - fixedOutputs.length), INITIAL_EXTRA_OUTPUTS, false, reservationPlanningCosts(storage, changeBasket));
+	const fixedOutputs = [...new Map([...explicit.outputs, ...noSendChange.outputs].map((output) => [output.outputId, output])).values()];
+	const maxReservedOutputs = storage.actionBatchMaxReservedOutputs;
+	if (maxReservedOutputs >= 0 && fixedOutputs.length > maxReservedOutputs) throw new WERR_INVALID_PARAMETER("firstAction", `no more than ${maxReservedOutputs} persisted inputs`);
+	const fundingOutputs = chooseReservationPool(available, target, Math.max(0, (maxReservedOutputs < 0 ? INITIAL_RESERVATION_LIMIT : Math.min(INITIAL_RESERVATION_LIMIT, maxReservedOutputs)) - fixedOutputs.length), INITIAL_EXTRA_OUTPUTS, false, reservationPlanningCosts(storage, changeBasket)).map(reservationOutput);
 	const batch = newBatch(userId, args.batchId);
 	await storage.transaction(async (trx) => {
 		await storage.insertActionBatch(batch, trx);
-		await reserveOutputs(storage, batch, [...fixedOutputs, ...funding], trx);
+		await reserveOutputs(storage, batch, [...fixedOutputs, ...fundingOutputs], trx);
 	});
 	let fundingResult;
 	try {
-		fundingResult = await makeFundingResult(storage, args.firstAction, [...funding, ...fixedOutputs]);
+		fundingResult = await makeFundingResult(storage, args.firstAction, [...fundingOutputs, ...fixedOutputs]);
 	} catch (error) {
 		await storage.transaction(async (trx) => await releaseBatchState(storage, batch, "aborted", trx));
 		throw error;
@@ -13817,41 +14458,63 @@ async function beginActionBatch(storage, auth, args) {
 		feeModel: validateStorageFeeModel(storage.feeModel),
 		commissionSatoshis: storage.commissionSatoshis,
 		commissionPubKeyHex: storage.commissionPubKeyHex,
-		availableChangeCount: available.length,
-		reservedOutputs: fundingResult.outputs.filter((output) => funding.some((candidate) => candidate.outputId === output.outputId)),
+		availableChangeCount: available.filter((output) => output.satoshis >= Math.max(1, changeBasket.minimumDesiredUTXOValue)).length,
+		managedChangePolicy: {
+			maxOutputsPerAction: storage.managedChangePolicy.maxOutputsPerAction,
+			migrationInputsPerAction: storage.managedChangePolicy.migrationInputsPerAction
+		},
+		reservedOutputs: fundingResult.outputs.filter((output) => fundingOutputs.some((candidate) => candidate.outputId === output.outputId)),
 		explicitOutputs: fundingResult.outputs.filter((output) => explicitIds.has(output.outputId)),
 		inputBeef: fundingResult.beef
 	};
 }
-function requireLiveBatch(batch) {
-	if (batch == null || activeExpiry(batch)) throw new WERR_INVALID_OPERATION("action batch is not active");
+function requireLiveBatch(batch, batchId) {
+	const state = actionBatchErrorState(batch);
+	if (state != null) throw new WERRActionBatchState(state, batchId ?? batch?.batchId);
+	if (batch == null) throw new WERRActionBatchState("missing", batchId);
 	return batch;
 }
 async function extendActionBatch(storage, auth, args) {
 	const userId = verifyId(auth.userId);
 	await cleanupExpiredActionBatches(storage);
-	const batch = requireLiveBatch(await storage.findActionBatch(userId, args.batchId));
+	const batch = requireLiveBatch(await storage.findActionBatch(userId, args.batchId), args.batchId);
 	const basket = verifyOne(await storage.findOutputBaskets({ partial: {
 		userId,
 		name: "default"
 	} }));
 	const alreadyReserved = await storage.findActionBatchOutputIds(batch.actionBatchId);
-	const available = await storage.findAvailableManagedChangeInputs(userId, basket.basketId, false);
 	if (!Number.isSafeInteger(args.requestedOutputs) || args.requestedOutputs < 0) throw new WERR_INVALID_PARAMETER("requestedOutputs", "non-negative safe integer");
-	const requestedCount = Math.min(args.requestedOutputs, 64);
-	const funding = chooseReservationPool(available, Math.max(1, args.targetSatoshis), requestedCount, 0, true, reservationPlanningCosts(storage, basket));
+	if (!Number.isSafeInteger(args.targetSatoshis) || args.targetSatoshis < 0) throw new WERR_INVALID_PARAMETER("targetSatoshis", "non-negative safe integer");
+	const maxReservedOutputs = storage.actionBatchMaxReservedOutputs;
+	if (maxReservedOutputs >= 0 && args.explicitOutpoints.length > maxReservedOutputs || new Set(args.explicitOutpoints.map((outpoint) => `${outpoint.txid}.${outpoint.vout}`)).size !== args.explicitOutpoints.length || args.explicitOutpoints.some((outpoint) => !isValidOutpoint(outpoint))) throw new WERR_INVALID_PARAMETER("explicitOutpoints", `at most ${maxReservedOutputs < 0 ? "the configured request capacity" : maxReservedOutputs} valid outpoints`);
+	const remainingCapacity = maxReservedOutputs < 0 ? Number.MAX_SAFE_INTEGER : maxReservedOutputs - alreadyReserved.length;
+	if (remainingCapacity <= 0 && (args.requestedOutputs > 0 || args.explicitOutpoints.length > 0)) throw new WERR_INVALID_OPERATION(`action batch already holds the maximum of ${maxReservedOutputs} outputs`);
 	const explicitByOutpoint = await storage.findOutputsByOutpoints(userId, args.explicitOutpoints);
-	const explicit = Object.values(explicitByOutpoint).filter((output) => !alreadyReserved.includes(output.outputId));
-	const fundingResult = await makeFundingResult(storage, argsToFundingShape(args.includeSourceTransactions), [...funding, ...explicit]);
+	const explicit = [...new Map(Object.values(explicitByOutpoint).filter((output) => !alreadyReserved.includes(output.outputId)).map((output) => [output.outputId, output])).values()];
+	if (explicit.length > remainingCapacity) throw new WERR_INVALID_PARAMETER("explicitOutpoints", `no more than ${remainingCapacity} additional reserved outputs`);
+	const explicitIds = new Set(explicit.map((output) => output.outputId));
+	const availableOutputs = (await storage.findAvailableManagedChangeInputs(userId, basket.basketId, false)).filter((output) => !explicitIds.has(output.outputId));
+	const availableStatuses = await storage.findTransactionStatusesByIds(userId, availableOutputs.map((output) => output.transactionId));
+	const available = availableOutputs.map((output) => ({
+		...output,
+		transactionStatus: availableStatuses.get(output.transactionId) ?? "sending"
+	}));
+	const requestedCount = Math.min(args.requestedOutputs, 64, remainingCapacity - explicit.length);
+	const fundingOutputs = chooseReservationPool(available, Math.max(1, args.targetSatoshis), requestedCount, 0, true, reservationPlanningCosts(storage, basket)).map(reservationOutput);
+	const fundingResult = await makeFundingResult(storage, argsToFundingShape(args.includeSourceTransactions), [...fundingOutputs, ...explicit]);
 	const expiresAt = new Date(Math.min(batch.hardExpiresAt.getTime(), Date.now() + ACTION_BATCH_LEASE_MS));
 	await storage.transaction(async (trx) => {
-		const current = requireLiveBatch(await storage.findActionBatchForUpdate(userId, args.batchId, trx));
-		await reserveOutputs(storage, current, [...funding, ...explicit], trx);
+		const current = requireLiveBatch(await storage.findActionBatchForUpdate(userId, args.batchId, trx), args.batchId);
+		const additions = [...new Map([...fundingOutputs, ...explicit].map((output) => [output.outputId, output])).values()];
+		const currentReserved = new Set(await storage.findActionBatchOutputIds(current.actionBatchId, trx));
+		const newAdditions = additions.filter((output) => !currentReserved.has(output.outputId));
+		if (maxReservedOutputs >= 0 && currentReserved.size + newAdditions.length > maxReservedOutputs) throw new WERR_INVALID_OPERATION(`action batch cannot reserve more than ${maxReservedOutputs} outputs`);
+		await reserveOutputs(storage, current, newAdditions, trx);
 		await storage.updateActionBatch(current.actionBatchId, { expiresAt }, trx);
 	});
 	return {
 		expiresAt: expiresAt.toISOString(),
-		reservedOutputs: fundingResult.outputs.filter((output) => funding.some((candidate) => candidate.outputId === output.outputId)),
+		reservedOutputs: fundingResult.outputs.filter((output) => fundingOutputs.some((candidate) => candidate.outputId === output.outputId)),
 		explicitOutputs: fundingResult.outputs.filter((output) => explicit.some((candidate) => candidate.outputId === output.outputId)),
 		inputBeef: fundingResult.beef
 	};
@@ -13887,14 +14550,64 @@ function argsToFundingShape(includeSourceTransactions) {
 async function renewActionBatch(storage, auth, batchId) {
 	const userId = verifyId(auth.userId);
 	return await storage.transaction(async (trx) => {
-		const batch = requireLiveBatch(await storage.findActionBatchForUpdate(userId, batchId, trx));
+		const batch = requireLiveBatch(await storage.findActionBatchForUpdate(userId, batchId, trx), batchId);
 		const expiresAt = new Date(Math.min(batch.hardExpiresAt.getTime(), Date.now() + ACTION_BATCH_LEASE_MS));
 		await storage.updateActionBatch(batch.actionBatchId, { expiresAt }, trx);
 		return { expiresAt: expiresAt.toISOString() };
 	});
 }
+function validateResumeOutpoints(storage, args) {
+	const unique = new Set(args.outpoints.map((outpoint) => `${outpoint.txid}.${outpoint.vout}`));
+	const maxReservedOutputs = storage.actionBatchMaxReservedOutputs;
+	if (maxReservedOutputs >= 0 && args.outpoints.length > maxReservedOutputs || unique.size !== args.outpoints.length || args.outpoints.some((outpoint) => !isValidOutpoint(outpoint))) throw new WERR_INVALID_PARAMETER("outpoints", `at most ${maxReservedOutputs < 0 ? "the configured request capacity" : maxReservedOutputs} unique valid outpoints`);
+}
+/**
+* Reacquire exactly the persisted inputs owned by one expired client
+* workspace. This is deliberately explicit: another action may not become a
+* member merely because it happens to use the same Wallet instance.
+*/
+async function resumeActionBatch(storage, auth, args) {
+	const userId = verifyId(auth.userId);
+	validateResumeOutpoints(storage, args);
+	await cleanupExpiredActionBatches(storage);
+	return await storage.transaction(async (trx) => {
+		const batch = await storage.findActionBatchForUpdate(userId, args.batchId, trx);
+		const state = actionBatchErrorState(batch);
+		if (state != null && state !== "expired") throw new WERRActionBatchState(state, args.batchId);
+		if (batch == null) throw new WERRActionBatchState("missing", args.batchId);
+		const expiresAt = new Date(Math.min(batch.hardExpiresAt.getTime(), Date.now() + ACTION_BATCH_LEASE_MS));
+		if (state == null) {
+			const reserved = new Set(await storage.findActionBatchOutputIds(batch.actionBatchId, trx));
+			const current = await storage.findOutputsByOutpointsForUpdate(userId, args.outpoints, trx);
+			if (Object.values(current).some((output) => !reserved.has(output.outputId)) || Object.keys(current).length !== args.outpoints.length || reserved.size !== args.outpoints.length) throw new WERRActionBatchState("conflicted", args.batchId);
+			await storage.updateActionBatch(batch.actionBatchId, { expiresAt }, trx);
+			return { expiresAt: expiresAt.toISOString() };
+		}
+		const stored = await storage.findOutputsByOutpointsForUpdate(userId, args.outpoints, trx);
+		const outputs = args.outpoints.map((outpoint) => stored[`${outpoint.txid}.${outpoint.vout}`]);
+		if (outputs.some((output) => output == null || !output.spendable || output.spentBy != null)) throw new WERRActionBatchState("conflicted", args.batchId);
+		await storage.deleteActionBatchOutputReservations(batch.actionBatchId, trx);
+		const exactOutputs = outputs;
+		if ((await storage.findReservedActionBatchOutputIds(exactOutputs.map((output) => output.outputId), trx)).length > 0) throw new WERRActionBatchState("conflicted", args.batchId);
+		const now = /* @__PURE__ */ new Date();
+		await storage.reserveActionBatchOutputs(exactOutputs.map((output) => ({
+			actionBatchId: batch.actionBatchId,
+			outputId: output.outputId,
+			created_at: now,
+			updated_at: now
+		})), trx);
+		await storage.updateActionBatch(batch.actionBatchId, {
+			status: "active",
+			expiresAt,
+			manifest: void 0,
+			manifestDigest: void 0,
+			uploadDigests: void 0
+		}, trx);
+		return { expiresAt: expiresAt.toISOString() };
+	});
+}
 async function reacquireManifestInputs(storage, userId, batch, validated, trx) {
-	if (batch.hardExpiresAt.getTime() <= Date.now()) throw new WERR_INVALID_OPERATION("action batch hard lifetime has expired");
+	if (batch.hardExpiresAt.getTime() <= Date.now()) throw new WERRActionBatchState("hard-expired", batch.batchId);
 	const stagedTxids = new Set(validated.actions.map(({ action }) => action.txid));
 	const outpoints = [...new Map(validated.actions.flatMap(({ action }) => action.plan.inputs).filter((input) => !stagedTxids.has(input.sourceTxid)).map((input) => [`${input.sourceTxid}.${input.sourceVout}`, {
 		txid: input.sourceTxid,
@@ -14061,7 +14774,7 @@ async function persistAction(...[storage, userId, validated, reservedOutputIds,
 async function persistManifestAtomically(storage, userId, batch, manifest, validated) {
 	return await storage.transaction(async (trx) => {
 		const current = await storage.findActionBatchForUpdate(userId, batch.batchId, trx);
-		if (current == null) throw new WERR_INVALID_OPERATION("action batch was not found");
+		if (current == null) throw new WERRActionBatchState("missing", batch.batchId);
 		if (current.status === "committed") {
 			if (current.manifestDigest !== manifest.digest) throw new WERR_INVALID_OPERATION("batch committed with another manifest");
 			return {
@@ -14069,12 +14782,12 @@ async function persistManifestAtomically(storage, userId, batch, manifest, valid
 				alreadyCommitted: true
 			};
 		}
-		if (current.status === "aborted") throw new WERR_INVALID_OPERATION("aborted action batch cannot be committed");
+		if (current.status === "aborted") throw new WERRActionBatchState("aborted", batch.batchId);
 		if (current.manifestDigest != null && current.manifestDigest !== manifest.digest) throw new WERR_INVALID_OPERATION("batch prepared with another manifest");
 		if (current.status === "expired" || activeExpiry(current)) {
-			if (current.hardExpiresAt.getTime() <= Date.now()) throw new WERR_INVALID_OPERATION("action batch hard lifetime has expired");
+			if (current.hardExpiresAt.getTime() <= Date.now()) throw new WERRActionBatchState("hard-expired", batch.batchId);
 			await reacquireManifestInputs(storage, userId, current, validated, trx);
-		} else requireLiveBatch(current);
+		} else requireLiveBatch(current, batch.batchId);
 		const reservedOutputIds = new Set(await storage.findActionBatchOutputIds(current.actionBatchId, trx));
 		const stagedTxids = new Set(validated.actions.map(({ action }) => action.txid));
 		const inputOutpoints = [...new Map(validated.actions.flatMap(({ action }) => action.plan.inputs).filter((input) => !stagedTxids.has(input.sourceTxid)).map((input) => [`${input.sourceTxid}.${input.sourceVout}`, {
@@ -14152,14 +14865,14 @@ async function completeCommittedBatch(storage, userId, batch, manifest, alreadyC
 }
 async function commitActionBatchOnce(storage, userId, manifest) {
 	const batch = await storage.findActionBatch(userId, manifest.batchId);
-	if (batch == null) throw new WERR_INVALID_OPERATION("action batch was not found");
+	if (batch == null) throw new WERRActionBatchState("missing", manifest.batchId);
 	if (batch.status === "committed") {
 		if (batch.manifestDigest !== manifest.digest) throw new WERR_INVALID_OPERATION("batch committed with another manifest");
 		return await completeCommittedBatch(storage, userId, batch, manifest, true);
 	}
-	if (batch.status === "aborted") throw new WERR_INVALID_OPERATION("aborted action batch cannot be committed");
-	if (!(batch.status === "expired" || activeExpiry(batch))) requireLiveBatch(batch);
-	else if (batch.hardExpiresAt.getTime() <= Date.now()) throw new WERR_INVALID_OPERATION("action batch hard lifetime has expired");
+	if (batch.status === "aborted") throw new WERRActionBatchState("aborted", manifest.batchId);
+	if (!(batch.status === "expired" || activeExpiry(batch))) requireLiveBatch(batch, manifest.batchId);
+	else if (batch.hardExpiresAt.getTime() <= Date.now()) throw new WERRActionBatchState("hard-expired", manifest.batchId);
 	if (batch.manifestDigest != null && batch.manifestDigest !== manifest.digest) throw new WERR_INVALID_OPERATION("batch prepared with another manifest");
 	const persisted = await persistManifestAtomically(storage, userId, batch, manifest, await validateManifestActions(storage, batch, manifest));
 	return await completeCommittedBatch(storage, userId, persisted.batch, manifest, persisted.alreadyCommitted, persisted.share);
@@ -14242,6 +14955,8 @@ var StorageProvider = class StorageProvider extends StorageReaderWriter {
 	commissionSatoshis;
 	commissionPubKeyHex;
 	maxRecursionDepth;
+	actionBatchMaxReservedOutputs;
+	managedChangePolicy;
 	scriptVerifier;
 	static defaultOptions() {
 		return {
@@ -14250,7 +14965,9 @@ var StorageProvider = class StorageProvider extends StorageReaderWriter {
 				value: 100
 			},
 			commissionSatoshis: 0,
-			commissionPubKeyHex: void 0
+			commissionPubKeyHex: void 0,
+			actionBatchMaxReservedOutputs: 256,
+			managedChangePolicy: defaultManagedChangePolicy()
 		};
 	}
 	static createStorageBaseOptions(chain) {
@@ -14265,6 +14982,10 @@ var StorageProvider = class StorageProvider extends StorageReaderWriter {
 		this.commissionPubKeyHex = options.commissionPubKeyHex;
 		this.commissionSatoshis = options.commissionSatoshis;
 		this.maxRecursionDepth = 12;
+		const maxReservedOutputs = options.actionBatchMaxReservedOutputs ?? 256;
+		if (maxReservedOutputs !== -1 && (!Number.isSafeInteger(maxReservedOutputs) || maxReservedOutputs < 1)) throw new WERR_INVALID_PARAMETER("actionBatchMaxReservedOutputs", "a positive safe integer or -1 for unlimited");
+		this.actionBatchMaxReservedOutputs = maxReservedOutputs;
+		this.managedChangePolicy = validateManagedChangePolicy(options.managedChangePolicy);
 		this.scriptVerifier = options.scriptVerifier;
 	}
 	/** Mark a planned set of change inputs spent within the caller's transaction. */
@@ -14295,12 +15016,16 @@ var StorageProvider = class StorageProvider extends StorageReaderWriter {
 	}
 	/** Read only the fields needed by the in-memory funding planner. */
 	async findAvailableManagedChangeInputCandidates(userId, basketId, excludeSending, trx) {
-		return (await this.findAvailableManagedChangeInputs(userId, basketId, excludeSending, trx)).map(({ outputId, transactionId, satoshis, txid, vout }) => ({
+		const outputs = await this.findAvailableManagedChangeInputs(userId, basketId, excludeSending, trx);
+		const findStatuses = this.findTransactionStatusesByIds?.bind(this);
+		const statuses = findStatuses == null ? /* @__PURE__ */ new Map() : await findStatuses(userId, outputs.map((output) => output.transactionId), trx);
+		return outputs.map(({ outputId, transactionId, satoshis, txid, vout }) => ({
 			outputId,
 			transactionId,
 			satoshis,
 			txid,
-			vout
+			vout,
+			transactionStatus: statuses.get(transactionId)
 		}));
 	}
 	/** Read the current status of a set of source transactions without loading raw transaction bytes. */
@@ -14388,7 +15113,7 @@ var StorageProvider = class StorageProvider extends StorageReaderWriter {
 		throw new WERR_NOT_IMPLEMENTED();
 	}
 	async getCapabilities() {
-		return this.supportsActionBatchPersistence() ? getActionBatchCapabilities() : {};
+		return this.supportsActionBatchPersistence() ? getActionBatchCapabilities(this.actionBatchMaxReservedOutputs, true) : {};
 	}
 	supportsActionBatchPersistence() {
 		return false;
@@ -14407,6 +15132,9 @@ var StorageProvider = class StorageProvider extends StorageReaderWriter {
 	async renewActionBatch(auth, batchId) {
 		return await renewActionBatch(this, auth, batchId);
 	}
+	async resumeActionBatch(auth, args) {
+		return await resumeActionBatch(this, auth, args);
+	}
 	async prepareActionBatchCommit(auth, manifest) {
 		return await prepareActionBatchCommit(this, auth, manifest);
 	}
@@ -15004,7 +15732,12 @@ var StorageProvider = class StorageProvider extends StorageReaderWriter {
 			for (const output of outputs) {
 				const outputId = verifyId(output.outputId);
 				await this.validateOutputScript(output);
-				verdicts.set(outputId, output.lockingScript == null ? void 0 : await services.isUtxo(output));
+				if (output.lockingScript == null) {
+					verdicts.set(outputId, void 0);
+					continue;
+				}
+				const classification = await classifyOutputUtxo(services, output);
+				verdicts.set(outputId, classification.verdict === "unknown" ? void 0 : classification.verdict === "unspent");
 			}
 		}
 		return verdicts;
@@ -15166,16 +15899,12 @@ var StorageProvider = class StorageProvider extends StorageReaderWriter {
 			} });
 			for (const o of outputs) {
 				if (!o.spendable) continue;
-				if (!await this.checkOutputIsUtxo(o, services)) invalidSpendableOutputs.push(o);
+				await this.validateOutputScript(o);
+				if (!requireConclusiveUtxo(await classifyOutputUtxo(services, o))) invalidSpendableOutputs.push(o);
 			}
 		}
 		return { invalidSpendableOutputs };
 	}
-	async checkOutputIsUtxo(o, services) {
-		if (o.lockingScript == null || o.lockingScript.length === 0) return false;
-		const hash = services.hashOutputScript(asString(o.lockingScript));
-		return (await services.getUtxoStatus(hash, void 0, `${o.txid ?? ""}.${o.vout ?? ""}`)).isUtxo === true;
-	}
 	async updateProvenTxReqDynamics(id, update, trx) {
 		const partial = {};
 		if (update.updated_at != null) partial.updated_at = update.updated_at;
@@ -15285,6 +16014,7 @@ const getLabelToSpecOp = () => {
 //#region ../src/storage/methods/listActionsIdb.ts
 async function enrichIdbActionLabels(storage, tx, action, timeFilterRequested) {
 	action.labels = (await storage.getLabelsForTransactionId(tx.transactionId)).map((l) => l.label);
+	if (tx.reference != null && tx.reference !== "") action.labels = applyBrc153ReferenceLabel(action.labels, tx.reference);
 	if (timeFilterRequested) {
 		const ts = tx.created_at ? new Date(tx.created_at).getTime() : NaN;
 		if (!Number.isNaN(ts)) {
@@ -15403,20 +16133,129 @@ async function listActionsIdb(storage, auth, vargs) {
 	return r;
 }
 //#endregion
-//#region ../src/storage/methods/ListOutputsSpecOp.ts
-const INVALID_CHANGE_MAX_CONCURRENCY = 12;
-async function runWithConcurrency(values, maxConcurrency, worker) {
-	const active = [];
-	for (const value of values) {
-		const task = worker(value).finally(() => {
-			const i = active.indexOf(task);
-			if (i >= 0) active.splice(i, 1);
+//#region ../src/storage/methods/reviewUtxoOutputs.ts
+const MAX_AUDIT_PROVIDERS = 8;
+const MAX_PROVIDER_NAME_LENGTH = 128;
+const UTXO_REVIEW_PROVIDER_TIMEOUT_MSECS = 5e3;
+function diagnosticsFor(classifications, releasedOutputIds) {
+	const allProviders = [...new Set(classifications.map((result) => result.status.provider.slice(0, MAX_PROVIDER_NAME_LENGTH)))];
+	const providers = allProviders.slice(0, MAX_AUDIT_PROVIDERS);
+	const confirmedSpent = classifications.filter((result) => result.status.verdict === "spent");
+	const released = confirmedSpent.filter((result) => releasedOutputIds.has(result.output.outputId));
+	return {
+		checked: classifications.length,
+		confirmedUnspent: classifications.filter((result) => result.status.verdict === "unspent").length,
+		confirmedSpent: confirmedSpent.length,
+		unknown: classifications.filter((result) => result.status.verdict === "unknown").length,
+		confirmedSpentSatoshis: confirmedSpent.reduce((sum, result) => sum + result.output.satoshis, 0),
+		released: released.length,
+		releasedSatoshis: released.reduce((sum, result) => sum + result.output.satoshis, 0),
+		providers,
+		providerCount: allProviders.length,
+		providersTruncated: allProviders.length > providers.length
+	};
+}
+function auditDetails(diagnostics, userId, releaseMode, reason) {
+	return JSON.stringify({
+		operation: "specOpInvalidChange",
+		reason,
+		releaseMode,
+		userId,
+		...diagnostics
+	});
+}
+async function classifyCandidates(storage, outputs) {
+	const services = storage.getServices();
+	return await mapWithConcurrency(outputs.filter((output) => output.basketId != null), 4, async (output) => {
+		try {
+			await storage.validateOutputScript(output);
+		} catch (error) {
+			return {
+				output,
+				status: {
+					verdict: "unknown",
+					provider: "<script-validation-error>",
+					error
+				}
+			};
+		}
+		let timeout;
+		const providerCall = classifyOutputUtxo(services, output);
+		const timedClassification = new Promise((resolve) => {
+			timeout = setTimeout(() => resolve({
+				verdict: "unknown",
+				provider: "<review-timeout>",
+				error: /* @__PURE__ */ new Error(`UTXO classification exceeded ${UTXO_REVIEW_PROVIDER_TIMEOUT_MSECS}ms`)
+			}), UTXO_REVIEW_PROVIDER_TIMEOUT_MSECS);
 		});
-		active.push(task);
-		if (active.length >= maxConcurrency) await Promise.race(active);
+		try {
+			return {
+				output,
+				status: await Promise.race([providerCall, timedClassification])
+			};
+		} finally {
+			if (timeout != null) clearTimeout(timeout);
+			providerCall.catch(() => void 0);
+		}
+	});
+}
+async function releaseConfirmedSpent(storage, auth, classifications, releaseMode) {
+	const confirmedSpent = classifications.filter((result) => result.status.verdict === "spent");
+	const releasedOutputIds = /* @__PURE__ */ new Set();
+	await storage.transaction(async (trx) => {
+		for (const { output } of confirmedSpent) {
+			const current = await storage.findOutputById(output.outputId, trx, true);
+			if (current == null || current.userId !== auth.userId) throw new WERR_INVALID_PARAMETER("outputId", `owned by user ${auth.userId}`);
+			if (current.spendable !== true || current.spentBy != null) throw new WERR_INVALID_OPERATION(`Output ${output.outputId} changed state during UTXO review; no outputs were changed.`);
+			if (await storage.updateOutput(verifyId(output.outputId), { spendable: false }, trx) !== 1) throw new WERR_INVALID_PARAMETER("outputId", `updated exactly once: ${output.outputId}`);
+			releasedOutputIds.add(output.outputId);
+		}
+		const now = /* @__PURE__ */ new Date();
+		const diagnostics = diagnosticsFor(classifications, releasedOutputIds);
+		await storage.insertMonitorEvent({
+			created_at: now,
+			updated_at: now,
+			id: 0,
+			event: releaseMode === "atomic" ? "InvalidChangeRelease" : "InvalidChangeConclusiveRelease",
+			details: auditDetails(diagnostics, auth.userId, releaseMode, "provider-confirmed-spent")
+		}, trx);
+	});
+	return releasedOutputIds;
+}
+/**
+* Classify a bounded set of wallet outputs without treating provider failure as
+* proof that an output was spent. Read-only reviews always return their
+* conclusive and unknown partitions. Atomic release requires every verdict to
+* be conclusive; the operator-only conclusive mode releases the positively
+* spent subset while retaining and reporting unknowns.
+*/
+async function reviewUtxoOutputs(storage, auth, outputs, releaseMode = "none") {
+	const classifications = await classifyCandidates(storage, outputs);
+	const confirmedSpentOutputs = classifications.filter((result) => result.status.verdict === "spent").map((result) => result.output);
+	const unknownOutputs = classifications.filter((result) => result.status.verdict === "unknown").map((result) => result.output);
+	if (releaseMode === "atomic" && unknownOutputs.length > 0) {
+		const diagnostics = diagnosticsFor(classifications, /* @__PURE__ */ new Set());
+		const now = /* @__PURE__ */ new Date();
+		await storage.insertMonitorEvent({
+			created_at: now,
+			updated_at: now,
+			id: 0,
+			event: "InvalidChangeReleaseBlocked",
+			details: auditDetails(diagnostics, auth.userId, releaseMode, "inconclusive-provider-result")
+		});
+		throw new WERR_UTXO_REVIEW_INCONCLUSIVE(diagnostics.checked, diagnostics.confirmedSpent, diagnostics.unknown);
 	}
-	await Promise.all(active);
+	const releasedOutputIds = releaseMode === "none" ? /* @__PURE__ */ new Set() : await releaseConfirmedSpent(storage, auth, classifications, releaseMode);
+	for (const output of confirmedSpentOutputs) if (releasedOutputIds.has(output.outputId)) output.spendable = false;
+	return {
+		classifications,
+		confirmedSpentOutputs,
+		unknownOutputs,
+		diagnostics: diagnosticsFor(classifications, releasedOutputIds)
+	};
 }
+//#endregion
+//#region ../src/storage/methods/ListOutputsSpecOp.ts
 const getBasketToSpecOp = () => {
 	return {
 		[specOpWalletBalance]: {
@@ -15447,23 +16286,7 @@ const getBasketToSpecOp = () => {
 			includeSpent: false,
 			tagsToIntercept: ["release", "all"],
 			filterOutputs: async (s, auth, vargs, specOpTags, outputs) => {
-				if (specOpTags.includes("release")) await s.reviewStatus({ agedLimit: /* @__PURE__ */ new Date(0) });
-				const invalidOutputIds = /* @__PURE__ */ new Set();
-				const services = s.getServices();
-				await runWithConcurrency(outputs, INVALID_CHANGE_MAX_CONCURRENCY, async (o) => {
-					if (!o.basketId) return;
-					await s.validateOutputScript(o);
-					let ok = false;
-					if (o.lockingScript != null && o.lockingScript.length > 0) ok = await services.isUtxo(o);
-					else ok = void 0;
-					if (ok === false) invalidOutputIds.add(o.outputId);
-				});
-				const filteredOutputs = outputs.filter((o) => invalidOutputIds.has(o.outputId));
-				if (specOpTags.includes("release")) await runWithConcurrency(filteredOutputs, INVALID_CHANGE_MAX_CONCURRENCY, async (o) => {
-					await s.updateOutput(o.outputId, { spendable: false });
-					o.spendable = false;
-				});
-				return filteredOutputs;
+				return (await reviewUtxoOutputs(s, auth, outputs, specOpTags.includes("release") ? "atomic" : "none")).confirmedSpentOutputs;
 			}
 		},
 		[specOpSetWalletChangeParams]: {
@@ -15616,7 +16439,7 @@ async function loadIdbOutputs(query) {
 			"nosend",
 			"sending"
 		],
-		noScript: true,
+		noScript: specOp?.includeOutputScripts !== true,
 		orderDescending
 	};
 	const pageManagedChange = specOp?.managedChangeOnly === true && specOp.ignoreLimit !== true;
@@ -15698,7 +16521,10 @@ async function listOutputsIdb(storage, auth, vargs, _originator) {
 	});
 	result.totalOutputs = totalOutputs;
 	if (specOp != null) {
-		if (specOp.filterOutputs != null) outputs = await specOp.filterOutputs(storage, auth, vargs, specOpTags, outputs);
+		if (specOp.filterOutputs != null) {
+			outputs = await specOp.filterOutputs(storage, auth, vargs, specOpTags, outputs);
+			result.totalOutputs = outputs.length;
+		}
 		if (specOp.resultFromOutputs != null) return specOp.resultFromOutputs(storage, auth, vargs, specOpTags, outputs);
 	}
 	await hydrateIdbOutputResult(storage, outputs, vargs, result);
@@ -15829,6 +16655,7 @@ async function scanCursor(cursor, since, offset, limit, matches, accept) {
 var StorageIdb = class extends StorageProvider {
 	dbName;
 	db;
+	managedChangeDefaultsMigrated = false;
 	constructor(options) {
 		super(options);
 		this.dbName = `wallet-toolbox-${this.chain}net`;
@@ -15866,6 +16693,7 @@ var StorageIdb = class extends StorageProvider {
 	async verifyDB(storageName, storageIdentityKey) {
 		if (this.db != null) return this.db;
 		this.db = await this.initDB(storageName, storageIdentityKey);
+		await this.migrateManagedChangeDefaults(this.db);
 		this._settings = (await this.db.getAll("settings"))[0];
 		this.whenLastAccess = /* @__PURE__ */ new Date();
 		return this.db;
@@ -15899,7 +16727,7 @@ var StorageIdb = class extends StorageProvider {
 	async initDB(storageName, storageIdentityKey) {
 		const chain = this.chain;
 		const maxOutputScript = 1024;
-		return await (0, idb.openDB)(this.dbName, 3, { upgrade(db, _oldVersion, _newVersion, transaction) {
+		return await (0, idb.openDB)(this.dbName, 4, { upgrade(db, _oldVersion, _newVersion, transaction) {
 			upgradeAllStoresV1(db);
 			upgradeActionBatchStoresV2(db);
 			const outputs = transaction.objectStore("outputs");
@@ -15925,6 +16753,22 @@ var StorageIdb = class extends StorageProvider {
 			}
 		} });
 	}
+	async migrateManagedChangeDefaults(db) {
+		if (this.managedChangeDefaultsMigrated) return;
+		const trx = db.transaction("output_baskets", "readwrite");
+		let cursor = await trx.store.openCursor();
+		while (cursor != null) {
+			const basket = cursor.value;
+			if (isLegacyManagedChangeBasketDefault(basket)) await cursor.update({
+				...basket,
+				minimumDesiredUTXOValue: DEFAULT_MANAGED_CHANGE_MINIMUM_SATOSHIS,
+				updated_at: /* @__PURE__ */ new Date()
+			});
+			cursor = await cursor.continue();
+		}
+		await trx.done;
+		this.managedChangeDefaultsMigrated = true;
+	}
 	async reviewStatus(args) {
 		return await reviewStatusIdb(this, args);
 	}
@@ -16679,6 +17523,7 @@ var StorageIdb = class extends StorageProvider {
 		if (this.db != null) this.db.close();
 		this.db = void 0;
 		this._settings = void 0;
+		this.managedChangeDefaultsMigrated = false;
 	}
 	allStores = [
 		"action_batches",
@@ -17851,6 +18696,9 @@ var StorageClientBase = class {
 	async renewActionBatch(auth, batchId) {
 		return await this.rpcCall("renewActionBatch", [auth, batchId]);
 	}
+	async resumeActionBatch(auth, args) {
+		return await this.rpcCall("resumeActionBatch", [auth, args]);
+	}
 	async prepareActionBatchCommit(auth, manifest) {
 		return await this.rpcCall("prepareActionBatchCommit", [auth, manifest]);
 	}
@@ -18655,7 +19503,7 @@ async function restoreBRC38(storage, data) {
 	await storage.transaction(async (trx) => {
 		await storage.insertUser({ ...data.user }, trx);
 		for (const row of data.provenTxs) await storage.insertProvenTx({ ...row }, trx);
-		for (const row of data.outputBaskets) await storage.insertOutputBasket({ ...row }, trx);
+		for (const row of data.outputBaskets) await storage.insertOutputBasket(upgradeLegacyManagedChangeBasketDefault({ ...row }), trx);
 		for (const row of data.outputTags) await storage.insertOutputTag({ ...row }, trx);
 		for (const row of data.txLabels) await storage.insertTxLabel({ ...row }, trx);
 		for (const row of data.transactions) await storage.insertTransaction({ ...row }, trx);
@@ -21714,13 +22562,37 @@ function configuredChaintracksClient(chain, serviceUrl) {
 	return new ChaintracksServiceClient(chain, serviceUrl);
 }
 /**
+* True when running under a browser-style runtime — a real browser tab, or
+* the embedded webview a desktop wallet shell hosts its wallet logic in
+* (Metanet Client / User Wallet are Tauri WKWebViews) — where `fetch` is
+* subject to CORS enforcement that Node-style runtimes do not apply.
+*/
+function isBrowserRuntime() {
+	return typeof window !== "undefined" && window.document !== void 0;
+}
+/**
 * Returns the credential-free default ChainTracks client for a supported
 * public network, or an operator-configured client for stn/tstn.
+*
+* BROWSER RUNTIMES get the legacy CORS-enabled Chaintracks service for
+* main/test. The Go Chaintracks deployments (`arcade-v2-*.bsvblockchain.tech`)
+* currently serve no `Access-Control-Allow-Origin` header and answer OPTIONS
+* preflights with 404 (verified live 2026-08-11), so every fetch from a
+* browser-hosted wallet is CORS-blocked (WebKit surfaces it as
+* `TypeError: Load failed`) and the wallet loses `getHeight`, headers and
+* merkle-root validation wholesale. The repository service contract
+* (AGENTS.md: "browser, mobile, and unknown-domain clients must not be
+* silently blocked by CORS") requires a default that browsers can actually
+* reach. Once the Go deployments serve CORS (and a browser-run conformance
+* check proves it), this branch can be removed and browsers can share the v2
+* default. Node runtimes are unchanged.
 */
 function createDefaultChaintracksClient(chain) {
 	switch (chain) {
 		case "main":
 		case "test":
+			if (isBrowserRuntime()) return new ChaintracksServiceClient(chain, `https://${chain}net-chaintracks.babbage.systems`);
+			return new GoChaintracksServiceClient(chain, arcadeDefaultUrl(chain), { apiPrefix: "/chaintracks/v2" });
 		case "ttn": return new GoChaintracksServiceClient(chain, arcadeDefaultUrl(chain), { apiPrefix: "/chaintracks/v2" });
 		case "stn": return configuredChaintracksClient(chain, stnChaintracksUrl());
 		case "tstn": return configuredChaintracksClient(chain, tstnChaintracksUrl());
@@ -21759,7 +22631,7 @@ function createDefaultWalletServicesOptions(...[chain, arcCallbackUrl, arcCallba
 		exchangeratesapiKey: void 0,
 		chaintracksFiatExchangeRatesUrl,
 		chaintracks,
-		arcUrl: arcDefaultUrl(chain),
+		arcUrl: chain === "ttn" ? "" : arcDefaultUrl(chain),
 		arcConfig: {
 			apiKey: taalArcApiKey ?? void 0,
 			deploymentId,
@@ -21775,7 +22647,7 @@ function createDefaultWalletServicesOptions(...[chain, arcCallbackUrl, arcCallba
 		},
 		bitailsApiKey
 	};
-	const resolvedArcadeUrl = arcadeUrl;
+	const resolvedArcadeUrl = arcadeUrl ?? (chain === "ttn" ? arcadeDefaultUrl(chain) : void 0);
 	if (resolvedArcadeUrl != null && resolvedArcadeUrl !== "") {
 		o.arcadeUrl = resolvedArcadeUrl;
 		o.arcadeConfig = {
@@ -21805,7 +22677,7 @@ function arcDefaultUrl(chain) {
 		case "main": return "https://arc.taal.com";
 		case "test": return "https://arc-test.taal.com";
 		case "stn": return stnArcadeUrl() ?? "";
-		case "ttn": return "https://arcade-v2-ttn-us-1.bsvblockchain.tech/";
+		case "ttn": return "";
 		case "tstn": return tstnArcadeUrl() ?? "";
 		case "mock": return "";
 	}
@@ -22177,6 +23049,40 @@ var ARC = class {
 	}
 };
 //#endregion
+//#region ../src/services/providers/arcadeStatus.ts
+/**
+* Canonical classification shared by Arcade polling and SSE. Keeping this in
+* one place prevents a provider from calling a rejection "unknown" while the
+* monitor's event path calls the same status terminal.
+*/
+function classifyArcadeRejection(event) {
+	const extraInfo = event.extraInfo?.trim() ?? "";
+	const detail = extraInfo.toLowerCase();
+	if (event.status === 476 || detail.startsWith("parent rejected") || detail.includes("not final") || detail.includes("non-final")) return {
+		terminal: false,
+		inputConflict: false,
+		reqStatus: "invalid",
+		reason: event.status === 476 ? "transaction is not final" : "Arcade reported a retryable parent/locktime condition"
+	};
+	const orphanConflict = isArcDoubleSpendTxStatus(event.txStatus);
+	const inputConflict = orphanConflict || event.status === 462 || event.status === 466 || /(?:utxo|input).*(?:spent|missing|conflict)|missing[- ]inputs?|already spent/.test(detail);
+	const classifiedValidatorFailure = event.status != null && event.status >= 460 && event.status <= 475;
+	const explicitInvalidStatus = isArcInvalidTxStatus(event.txStatus) && event.txStatus !== "REJECTED";
+	const terminal = inputConflict || classifiedValidatorFailure || explicitInvalidStatus || extraInfo !== "";
+	let reason = "Arcade supplied no durable rejection evidence";
+	if (orphanConflict) reason = `Arcade reported ${event.txStatus}`;
+	else if (inputConflict) reason = "Arcade supplied confirmed missing-input/conflict evidence";
+	else if (classifiedValidatorFailure) reason = `Arcade supplied terminal validator code ${String(event.status)}`;
+	else if (explicitInvalidStatus) reason = `Arcade reported terminal ${event.txStatus}`;
+	else if (extraInfo !== "") reason = "Arcade supplied a terminal validator rejection reason";
+	return {
+		terminal,
+		inputConflict,
+		reqStatus: inputConflict ? "doubleSpend" : "invalid",
+		reason
+	};
+}
+//#endregion
 //#region ../src/services/providers/Arcade.ts
 function defaultDeploymentId() {
 	return `ts-sdk-${_bsv_sdk.Utils.toHex((0, _bsv_sdk.Random)(16))}`;
@@ -22446,6 +23352,73 @@ var Arcade = class {
 		return (await this.httpClient.request(`${this.URL}/tx/${txid}`, requestOptions)).data;
 	}
 	/**
+	* Adapt Arcade's lifecycle endpoint to the shared transaction-status
+	* provider contract. This lets monitor reconciliation remain operational
+	* when an explorer such as WhatsOnChain is absent. Only network-observed
+	* states count as known; RECEIVED/PENDING_RETRY and terminal rejection
+	* states remain unknown, while MINED/IMMUTABLE are authoritative mined
+	* observations whose proof is validated separately.
+	*/
+	async getStatusForTxids(txids) {
+		const r = {
+			name: this.name,
+			status: "success",
+			results: []
+		};
+		let firstError;
+		r.results = await Promise.all(txids.map(async (txid) => {
+			try {
+				const response = await this.httpClient.request(`${this.URL}/tx/${txid}`, {
+					method: "GET",
+					headers: this.requestHeaders()
+				});
+				if (Number(response.status) === 404) return {
+					txid,
+					status: "unknown",
+					depth: void 0
+				};
+				if (!response.ok || Number(response.status) !== 200) throw new WERR_INVALID_OPERATION(`Arcade transaction status response ${String(response.status)}`);
+				const status = response.data.txStatus;
+				if (status === "MINED" || status === "IMMUTABLE") return {
+					txid,
+					status: "mined",
+					depth: 1
+				};
+				if (status === "ACCEPTED_BY_NETWORK" || status === "SEEN_ON_NETWORK" || status === "SEEN_MULTIPLE_NODES") return {
+					txid,
+					status: "known",
+					depth: 0
+				};
+				const classification = classifyArcadeRejection(response.data);
+				return {
+					txid,
+					status: "unknown",
+					depth: void 0,
+					providerStatus: status,
+					...classification.terminal ? {
+						terminal: true,
+						inputConflict: classification.inputConflict,
+						statusCode: response.data.status,
+						description: (response.data.extraInfo || classification.reason).slice(0, 512),
+						competingTxs: (response.data.competingTxs ?? []).slice(0, 24)
+					} : {}
+				};
+			} catch (error_) {
+				firstError ??= WalletError.fromUnknown(error_);
+				return {
+					txid,
+					status: "unknown",
+					depth: void 0
+				};
+			}
+		}));
+		if (firstError != null) {
+			r.status = "error";
+			r.error = firstError;
+		}
+		return r;
+	}
+	/**
 	* `getMerklePath` provider: obtain a BUMP merkle proof for a mined transaction from Arcade.
 	*
 	* Arcade only has a proof for transactions it tracked (i.e. broadcast through it) that have
@@ -23236,6 +24209,10 @@ var Services = class Services {
 			name: "WhatsOnChain",
 			service: this.whatsonchain.getStatusForTxids.bind(this.whatsonchain)
 		});
+		if (this.arcade != null) this.getStatusForTxidsServices.add({
+			name: "Arcade",
+			service: this.arcade.getStatusForTxids.bind(this.arcade)
+		});
 		this.getScriptHashHistoryServices = new ServiceCollection("getScriptHashHistory");
 		if (hasWhatsOnChain) this.getScriptHashHistoryServices.add({
 			name: "WhatsOnChain",
@@ -23252,7 +24229,7 @@ var Services = class Services {
 			name: "GorillaPoolArcBeef",
 			service: this.arcGorillaPool.postBeef.bind(this.arcGorillaPool)
 		});
-		this.postBeefServices.add({
+		if (this.options.arcUrl != null && this.options.arcUrl !== "") this.postBeefServices.add({
 			name: "TaalArcBeef",
 			service: this.arcTaal.postBeef.bind(this.arcTaal)
 		});
@@ -23338,30 +24315,65 @@ var Services = class Services {
 	async getStatusForTxids(txids, useNext) {
 		const services = this.getStatusForTxidsServices;
 		if (useNext === true) services.next();
-		let r0 = {
+		let fallback = {
 			name: "<noservices>",
 			status: "error",
 			error: new WERR_INTERNAL("No services available."),
 			results: []
 		};
+		const resultsByTxid = /* @__PURE__ */ new Map();
+		const unresolved = new Set(txids);
+		const providerNames = [];
+		let successfulProvider = false;
+		const rank = (result) => {
+			if (result.status === "mined") return 4;
+			if (result.status === "known") return 3;
+			if (result.terminal === true) return 2;
+			return 1;
+		};
 		for (let tries = 0; tries < services.count; tries++) {
 			const stc = services.serviceToCall;
 			try {
-				const r = await this.getStatusForTxidsBatched(stc, txids);
+				const requestedTxids = [...unresolved];
+				if (requestedTxids.length === 0) break;
+				const r = await this.getStatusForTxidsBatched(stc, requestedTxids);
 				if (r.status === "success") {
 					services.addServiceCallSuccess(stc);
-					r0 = r;
-					break;
+					successfulProvider = true;
+					providerNames.push(r.name);
+					for (const result of r.results) {
+						const current = resultsByTxid.get(result.txid);
+						if (current == null || rank(result) > rank(current)) resultsByTxid.set(result.txid, result);
+						if (result.status === "mined" || result.status === "known") unresolved.delete(result.txid);
+					}
+					services.next();
+					continue;
 				}
+				fallback = r;
 				if (r.error != null) services.addServiceCallError(stc, r.error);
 				else services.addServiceCallFailure(stc);
 			} catch (error_) {
 				const e = WalletError.fromUnknown(error_);
+				fallback = {
+					name: stc.providerName,
+					status: "error",
+					error: e,
+					results: []
+				};
 				services.addServiceCallError(stc, e);
 			}
 			services.next();
 		}
-		return r0;
+		if (!successfulProvider) return fallback;
+		return {
+			name: [...new Set(providerNames)].join(","),
+			status: "success",
+			results: txids.map((txid) => resultsByTxid.get(txid) ?? {
+				txid,
+				status: "unknown",
+				depth: void 0
+			})
+		};
 	}
 	async getStatusForTxidsBatched(stc, txids) {
 		const results = [];
@@ -23388,9 +24400,7 @@ var Services = class Services {
 		return _bsv_sdk.Utils.toHex(sha256Hash(_bsv_sdk.Utils.toArray(script, "hex")));
 	}
 	async isUtxo(output) {
-		if (output.lockingScript == null) throw new WERR_INVALID_PARAMETER("output.lockingScript", "validated by storage provider validateOutputScript.");
-		const hash = this.hashOutputScript(_bsv_sdk.Utils.toHex(output.lockingScript));
-		return (await this.getUtxoStatus(hash, void 0, `${output.txid ?? ""}.${output.vout}`)).isUtxo === true;
+		return requireConclusiveUtxo(await classifyOutputUtxo(this, output));
 	}
 	async getUtxoStatus(output, outputFormat, outpoint, useNext, logger) {
 		const services = this.getUtxoStatusServices;
@@ -23616,7 +24626,15 @@ var Services = class Services {
 		const method = async () => {
 			return await this.options.chaintracks.currentHeight();
 		};
-		return await this.invokeChaintracksWithRetry(method, "current_height");
+		try {
+			return await this.invokeChaintracksWithRetry(method, "current_height");
+		} catch (error_) {
+			try {
+				return (await this.whatsonchain.getChainInfo()).blocks;
+			} catch {
+				throw error_;
+			}
+		}
 	}
 	async hashToHeader(hash) {
 		const method = async () => {
@@ -27335,17 +28353,34 @@ var ArcSSEClient = class {
 			console.log(`${TAG} connected`);
 		});
 		this.es.addEventListener("status", (event) => {
+			let data;
 			try {
-				const data = JSON.parse(event.data);
-				console.log(`${TAG} event: txid=${data.txid} status=${data.txStatus}`);
-				if (typeof event.lastEventId === "string" && event.lastEventId !== "") {
-					this._lastEventId = event.lastEventId;
-					this.options.onLastEventIdChanged?.(event.lastEventId);
-				}
-				this.options.onEvent(data);
+				data = JSON.parse(event.data);
 			} catch {
 				console.log(`${TAG} malformed event: ${String(event.data).substring(0, 200)}`);
+				return;
+			}
+			console.log(`${TAG} event: txid=${data.txid} status=${data.txStatus}`);
+			const receivedEventId = typeof event.lastEventId === "string" && event.lastEventId !== "" ? event.lastEventId : void 0;
+			data.eventId = receivedEventId;
+			let processing;
+			try {
+				processing = this.options.onEvent(data);
+			} catch (error) {
+				const e = error instanceof Error ? error : new Error(String(error));
+				console.log(`${TAG} event processing failed: ${e.message}`);
+				this.options.onError?.(e);
+				return;
 			}
+			Promise.resolve(processing).then(async () => {
+				if (receivedEventId == null) return;
+				await this.options.onLastEventIdChanged?.(receivedEventId);
+				this._lastEventId = receivedEventId;
+			}).catch((error) => {
+				const e = error instanceof Error ? error : new Error(String(error));
+				console.log(`${TAG} event processing failed: ${e.message}`);
+				this.options.onError?.(e);
+			});
 		});
 		this.es.addEventListener("error", (event) => {
 			console.log(`${TAG} error:`, JSON.stringify(event));
@@ -27380,94 +28415,6 @@ var ArcSSEClient = class {
 	}
 };
 //#endregion
-//#region ../src/monitor/tasks/TaskUnFail.ts
-/**
-* Setting provenTxReq status to 'unfail' when 'invalid' will attempt to find a merklePath, and if successful:
-*
-* 1. set the req status to 'unmined'
-* 2. set the referenced txs to 'unproven'
-* 3. determine if any inputs match user's existing outputs and if so update spentBy and spendable of those outputs.
-* 4. set the txs outputs to spendable
-*
-* If it fails (to find a merklePath), returns the req status to 'invalid'.
-*/
-var TaskUnFail = class TaskUnFail extends WalletMonitorTask {
-	triggerMsecs;
-	static taskName = "UnFail";
-	/**
-	* Set to true to trigger running this task
-	*/
-	static checkNowRequested = false;
-	static get checkNow() {
-		return this.checkNowRequested;
-	}
-	static set checkNow(value) {
-		this.checkNowRequested = value;
-	}
-	constructor(monitor, triggerMsecs = Monitor.oneMinute * 10) {
-		super(monitor, TaskUnFail.taskName);
-		this.triggerMsecs = triggerMsecs;
-	}
-	trigger(nowMsecsSinceEpoch) {
-		return { run: TaskUnFail.checkNow || this.triggerMsecs > 0 && nowMsecsSinceEpoch - this.lastRunMsecsSinceEpoch > this.triggerMsecs };
-	}
-	async runTask() {
-		let log = "";
-		TaskUnFail.checkNow = false;
-		const limit = 100;
-		let offset = 0;
-		for (;;) {
-			const reqs = await this.storage.findProvenTxReqs({
-				partial: {},
-				status: ["unfail"],
-				paged: {
-					limit,
-					offset
-				}
-			});
-			if (reqs.length === 0) break;
-			log += `${reqs.length} reqs with status 'unfail'\n`;
-			const r = await this.unfail(reqs, 2);
-			log += `${r.log}\n`;
-			if (reqs.length < limit) break;
-			offset += limit;
-		}
-		return log;
-	}
-	async unfail(reqs, indent = 0) {
-		let log = "";
-		for (const reqApi of reqs) {
-			const req = new EntityProvenTxReq(reqApi);
-			log += " ".repeat(indent);
-			log += `reqId ${reqApi.provenTxReqId} txid ${reqApi.txid}: `;
-			if ((await this.monitor.services.getMerklePath(req.txid)).merklePath != null) {
-				log += "unfailed. status is now 'unmined'\n";
-				log += await this.unfailReq(req, indent + 2);
-			} else {
-				req.status = "invalid";
-				log += "returned to status 'invalid'\n";
-				await req.updateStorageDynamicProperties(this.storage);
-			}
-		}
-		return { log };
-	}
-	/**
-	* 2. set the referenced txs to 'unproven'
-	* 3. determine if any inputs match user's existing outputs and if so update spentBy and spendable of those outputs.
-	* 4. set the txs outputs to spendable
-	*
-	* @param req
-	* @param indent
-	* @returns
-	*/
-	async unfailReq(req, indent) {
-		return await this.storage.runAsStorageProvider(async (sp) => await sp.unfailTransactionsForProof(req, indent, {
-			status: "unmined",
-			attempts: 0
-		}));
-	}
-};
-//#endregion
 //#region ../src/monitor/tasks/TaskArcSSE.ts
 /**
 * Monitor task that receives transaction status updates from Arcade via SSE
@@ -27511,16 +28458,14 @@ var TaskArcadeSSE = class TaskArcadeSSE extends WalletMonitorTask {
 			arcApiKey: arcadeApiKey,
 			lastEventId,
 			EventSourceClass,
-			onEvent: (event) => {
-				this.pendingEvents.push(event);
-			},
+			onEvent: async (event) => await new Promise((acknowledge) => {
+				this.pendingEvents.push({
+					event,
+					acknowledge
+				});
+			}),
 			onError: (err) => {
 				this.logSetupEvent(`SSE error: ${err.message}`);
-			},
-			onLastEventIdChanged: (id) => {
-				this.monitor.options.saveLastSSEEventId?.(id).catch((e) => {
-					this.logSetupEvent(`failed to persist lastEventId: ${stringifyError(e)}`);
-				});
 			}
 		});
 		this.sseClient.connect();
@@ -27534,10 +28479,21 @@ var TaskArcadeSSE = class TaskArcadeSSE extends WalletMonitorTask {
 		return { run: this.pendingEvents.length > 0 };
 	}
 	async runTask() {
-		const events = this.pendingEvents.splice(0);
-		if (events.length === 0) return "";
+		const eventCount = this.pendingEvents.length;
+		if (eventCount === 0) return "";
 		let log = "";
-		for (const event of events) log += await this.processStatusEvent(event);
+		for (let i = 0; i < eventCount; i++) {
+			const pending = this.pendingEvents[0];
+			log += await this.processStatusEvent(pending.event);
+			if (pending.event.eventId != null) try {
+				await this.monitor.options.saveLastSSEEventId?.(pending.event.eventId);
+			} catch (e) {
+				await this.logSetupEvent(`failed to persist lastEventId: ${stringifyError(e)}`);
+				throw e;
+			}
+			this.pendingEvents.shift();
+			pending.acknowledge();
+		}
 		return log;
 	}
 	async fetchNow() {
@@ -27553,28 +28509,26 @@ var TaskArcadeSSE = class TaskArcadeSSE extends WalletMonitorTask {
 		}
 		for (const reqApi of reqs) {
 			const req = new EntityProvenTxReq(reqApi);
-			const canRecoverRejectedRequest = this.canRecoverRejectedRequest(req, event);
-			if (ProvenTxReqTerminalStatus.includes(req.status) && !canRecoverRejectedRequest) {
+			const canRecoverTerminalRequest = this.canRecoverTerminalRequest(req, event);
+			if (ProvenTxReqTerminalStatus.includes(req.status) && !canRecoverTerminalRequest) {
 				log += `  req ${req.id} already terminal: ${req.status}\n`;
 				continue;
 			}
 			const note = {
 				when: (/* @__PURE__ */ new Date()).toISOString(),
 				what: "arcSSE",
-				arcStatus: event.txStatus
+				arcStatus: event.txStatus,
+				...event.timestamp !== "" ? { arcTimestamp: event.timestamp } : {},
+				...event.status != null ? { statusCode: event.status } : {},
+				...event.extraInfo != null && event.extraInfo !== "" ? { extraInfo: event.extraInfo.slice(0, 512) } : {}
 			};
 			log += await this.applyStatusEvent(req, event, note);
 		}
 		this.monitor.callOnTransactionStatusChanged(event.txid, event.txStatus);
 		return log;
 	}
-	canRecoverRejectedRequest(req, event) {
-		return req.status === "invalid" && ([
-			"SENT_TO_NETWORK",
-			"ACCEPTED_BY_NETWORK",
-			"SEEN_ON_NETWORK",
-			"SEEN_MULTIPLE_NODES"
-		].includes(event.txStatus) || ["MINED", "IMMUTABLE"].includes(event.txStatus));
+	canRecoverTerminalRequest(req, event) {
+		return (req.status === "invalid" || req.status === "doubleSpend") && ["MINED", "IMMUTABLE"].includes(event.txStatus);
 	}
 	async applyStatusEvent(req, event, note) {
 		switch (event.txStatus) {
@@ -27584,11 +28538,16 @@ var TaskArcadeSSE = class TaskArcadeSSE extends WalletMonitorTask {
 			case "SEEN_MULTIPLE_NODES": return await this.applyAcceptedStatus(req, note);
 			case "MINED":
 			case "IMMUTABLE": return await this.applyMinedStatus(req, note);
-			case "DOUBLE_SPEND_ATTEMPTED": return await this.applyDoubleSpendStatus(req, note);
-			case "REJECTED":
+			case "DOUBLE_SPEND_ATTEMPTED":
+			case "SEEN_IN_ORPHAN_MEMPOOL": return await this.applyDoubleSpendStatus(req, event, note);
+			case "REJECTED": return await this.applyRejectedStatus(req, event, note);
+			case "RECEIVED":
+			case "PENDING_RETRY":
+			case "STUMP_PROCESSING":
+			case "UNKNOWN":
 				req.addHistoryNote(note);
 				await req.updateStorageDynamicProperties(this.storage);
-				return `  req ${req.id} rejection recorded; awaiting resolution\n`;
+				return `  req ${req.id} ${event.txStatus} recorded; awaiting resolution\n`;
 			default: return `  req ${req.id} unhandled status: ${event.txStatus}\n`;
 		}
 	}
@@ -27596,43 +28555,73 @@ var TaskArcadeSSE = class TaskArcadeSSE extends WalletMonitorTask {
 		if (![
 			"unsent",
 			"sending",
-			"callback",
-			"invalid"
+			"callback"
 		].includes(req.status)) return "";
-		const wasInvalid = req.status === "invalid";
-		let log = "";
-		if (wasInvalid) log += await new TaskUnFail(this.monitor).unfailReq(req, 4);
-		else if (req.notify.transactionIds != null) await this.storage.runAsStorageProvider(async (sp) => {
+		if (req.notify.transactionIds != null) await this.storage.runAsStorageProvider(async (sp) => {
 			await sp.updateTransactionsStatus(req.notify.transactionIds ?? [], "unproven");
 		});
 		req.status = "unmined";
-		if (wasInvalid) req.attempts = 0;
 		req.wasBroadcast = true;
 		req.addHistoryNote(note);
 		await req.updateStorageDynamicProperties(this.storage);
-		return log + `  req ${req.id} => unmined\n`;
+		return `  req ${req.id} => unmined\n`;
 	}
 	async applyMinedStatus(req, note) {
-		let log = "";
-		if (req.status === "invalid") {
-			log += await new TaskUnFail(this.monitor).unfailReq(req, 4);
-			req.status = "unmined";
-			req.attempts = 0;
-			req.wasBroadcast = true;
-		}
 		req.addHistoryNote(note);
 		await req.updateStorageDynamicProperties(this.storage);
-		return log + await this.fetchProofFromServices(req);
+		return await this.fetchProofFromServices(req);
 	}
-	async applyDoubleSpendStatus(req, note) {
-		req.status = "doubleSpend";
-		req.addHistoryNote(note);
-		await req.updateStorageDynamicProperties(this.storage);
-		const ids = req.notify.transactionIds;
-		if (ids != null) await this.storage.runAsStorageProvider(async (sp) => {
-			await sp.updateTransactionsStatus(ids, "failed");
+	async applyDoubleSpendStatus(req, event, note) {
+		return await this.applyTerminalFailure(req, note, classifyArcadeRejection(event));
+	}
+	classifyRejection(event) {
+		return classifyArcadeRejection(event);
+	}
+	async applyRejectedStatus(req, event, note) {
+		const classification = this.classifyRejection(event);
+		if (!classification.terminal) {
+			req.addHistoryNote({
+				...note,
+				what: "arcSSERejectionPending",
+				reason: classification.reason
+			});
+			await req.updateStorageDynamicProperties(this.storage);
+			return `  req ${req.id} rejection recorded; awaiting resolution\n`;
+		}
+		return await this.applyTerminalFailure(req, note, classification);
+	}
+	async applyTerminalFailure(req, note, classification) {
+		let quarantined = {
+			checked: 0,
+			staleConfirmed: 0,
+			staleOutpoints: []
+		};
+		await this.storage.runAsStorageProvider(async (sp) => {
+			await sp.transaction(async (trx) => {
+				req.status = classification.reqStatus;
+				req.addHistoryNote({
+					...note,
+					what: "arcSSETerminalRejection",
+					reason: classification.reason,
+					inputConflict: classification.inputConflict
+				});
+				await req.updateStorageDynamicProperties(sp, trx);
+				const ids = req.notify.transactionIds;
+				if (ids != null) await sp.updateTransactionsStatus(ids, "failed", trx);
+				if (classification.inputConflict) {
+					quarantined = await quarantineReqInputs(req, sp, trx);
+					req.addHistoryNote({
+						when: (/* @__PURE__ */ new Date()).toISOString(),
+						what: "arcSSEInputQuarantine",
+						checked: quarantined.checked,
+						confirmed: quarantined.staleConfirmed,
+						...quarantined.staleOutpoints.length > 0 ? { outpoints: quarantined.staleOutpoints.join(",") } : {}
+					});
+					await req.updateStorageDynamicProperties(sp, trx);
+				}
+			});
 		});
-		return `  req ${req.id} => doubleSpend\n`;
+		return `  req ${req.id} => ${classification.reqStatus}; quarantined ${quarantined.staleConfirmed} local input copy/copies\n`;
 	}
 	/**
 	* Complete a MINED/IMMUTABLE status by using the configured proof providers.
@@ -28044,9 +29033,104 @@ var TaskCheckNoSends = class TaskCheckNoSends extends WalletMonitorTask {
 	}
 };
 //#endregion
+//#region ../src/monitor/tasks/TaskUnFail.ts
+/**
+* Setting provenTxReq status to 'unfail' when 'invalid' will attempt to find a merklePath, and if successful:
+*
+* 1. set the req status to 'unmined'
+* 2. set the referenced txs to 'unproven'
+* 3. determine if any inputs match user's existing outputs and if so update spentBy and spendable of those outputs.
+* 4. set the txs outputs to spendable
+*
+* If it fails (to find a merklePath), returns the req status to 'invalid'.
+*/
+var TaskUnFail = class TaskUnFail extends WalletMonitorTask {
+	triggerMsecs;
+	static taskName = "UnFail";
+	/**
+	* Set to true to trigger running this task
+	*/
+	static checkNowRequested = false;
+	static get checkNow() {
+		return this.checkNowRequested;
+	}
+	static set checkNow(value) {
+		this.checkNowRequested = value;
+	}
+	constructor(monitor, triggerMsecs = Monitor.oneMinute * 10) {
+		super(monitor, TaskUnFail.taskName);
+		this.triggerMsecs = triggerMsecs;
+	}
+	trigger(nowMsecsSinceEpoch) {
+		return { run: TaskUnFail.checkNow || this.triggerMsecs > 0 && nowMsecsSinceEpoch - this.lastRunMsecsSinceEpoch > this.triggerMsecs };
+	}
+	async runTask() {
+		let log = "";
+		TaskUnFail.checkNow = false;
+		const limit = 100;
+		let offset = 0;
+		for (;;) {
+			const reqs = await this.storage.findProvenTxReqs({
+				partial: {},
+				status: ["unfail"],
+				paged: {
+					limit,
+					offset
+				}
+			});
+			if (reqs.length === 0) break;
+			log += `${reqs.length} reqs with status 'unfail'\n`;
+			const r = await this.unfail(reqs, 2);
+			log += `${r.log}\n`;
+			if (reqs.length < limit) break;
+			offset += limit;
+		}
+		return log;
+	}
+	async unfail(reqs, indent = 0) {
+		let log = "";
+		for (const reqApi of reqs) {
+			const req = new EntityProvenTxReq(reqApi);
+			log += " ".repeat(indent);
+			log += `reqId ${reqApi.provenTxReqId} txid ${reqApi.txid}: `;
+			if ((await this.monitor.services.getMerklePath(req.txid)).merklePath != null) {
+				log += "unfailed. status is now 'unmined'\n";
+				log += await this.unfailReq(req, indent + 2);
+			} else {
+				req.status = "invalid";
+				log += "returned to status 'invalid'\n";
+				await req.updateStorageDynamicProperties(this.storage);
+			}
+		}
+		return { log };
+	}
+	/**
+	* 2. set the referenced txs to 'unproven'
+	* 3. determine if any inputs match user's existing outputs and if so update spentBy and spendable of those outputs.
+	* 4. set the txs outputs to spendable
+	*
+	* @param req
+	* @param indent
+	* @returns
+	*/
+	async unfailReq(req, indent) {
+		return await this.storage.runAsStorageProvider(async (sp) => await sp.unfailTransactionsForProof(req, indent, {
+			status: "unmined",
+			attempts: 0
+		}));
+	}
+};
+//#endregion
 //#region ../src/monitor/tasks/TaskReviewUtxos.ts
+const REVIEW_PAGE_DEFAULT_LIMIT = 20;
+const REVIEW_PAGE_MAX_LIMIT = 250;
 /**
-* Use the reviewByIdentityKey method to review the utxos of a specific user by their identityKey.
+* Use the reviewByIdentityKey method to scan the UTXOs of a specific user by
+* identity key. The scan is read-only unless the caller explicitly requests
+* release, and release remains blocked if any provider result is inconclusive.
+* Operator UIs should use reviewPageByIdentityKey: it bounds each provider
+* round-trip and may explicitly release only the conclusive spent subset while
+* reporting unknowns.
 *
 * The task itself is disabled and will not run on a schedule; review must be triggered manually by calling reviewByIdentityKey.
 */
@@ -28063,7 +29147,7 @@ var TaskReviewUtxos = class TaskReviewUtxos extends WalletMonitorTask {
 	static set checkNow(value) {
 		this.checkNowRequested = value;
 	}
-	constructor(monitor, triggerMsecs = 0, userLimit = 10, userOffset = 0, tags = ["release", "all"]) {
+	constructor(monitor, triggerMsecs = 0, userLimit = 10, userOffset = 0, tags = ["all"]) {
 		super(monitor, TaskReviewUtxos.taskName);
 		this.triggerMsecs = triggerMsecs;
 		this.userLimit = userLimit;
@@ -28077,8 +29161,8 @@ var TaskReviewUtxos = class TaskReviewUtxos extends WalletMonitorTask {
 		TaskReviewUtxos.checkNow = false;
 		return "TaskReviewUtxos is disabled; use reviewByIdentityKey instead.\n";
 	}
-	async reviewByIdentityKey(identityKey, mode = "all") {
-		const tags = ["release", ...mode === "all" ? ["all"] : []];
+	async reviewByIdentityKey(identityKey, mode = "all", release = false) {
+		const tags = [...release ? ["release"] : [], ...mode === "all" ? ["all"] : []];
 		const vargs = {
 			basket: specOpInvalidChange,
 			tags,
@@ -28106,8 +29190,150 @@ var TaskReviewUtxos = class TaskReviewUtxos extends WalletMonitorTask {
 			return this.toUserLog(user, result.outputs, result.totalOutputs, total, tags);
 		});
 	}
+	async reviewPageByIdentityKey(identityKey, mode = "all", release = false, pageLimit = REVIEW_PAGE_DEFAULT_LIMIT, offset = 0) {
+		pageLimit = Math.min(Math.max(Math.trunc(pageLimit), 1), REVIEW_PAGE_MAX_LIMIT);
+		offset = Math.max(Math.trunc(offset), 0);
+		return await this.storage.runAsStorageProvider(async (sp) => {
+			const user = (await sp.findUsers({ partial: { identityKey } }))[0];
+			if (!user) return {
+				found: false,
+				identityKey,
+				mode,
+				release,
+				offset,
+				pageLimit,
+				sourceScanned: 0,
+				complete: true,
+				checked: 0,
+				confirmedUnspent: 0,
+				confirmedSpent: 0,
+				unknown: 0,
+				confirmedSpentSatoshis: 0,
+				released: 0,
+				releasedSatoshis: 0,
+				providers: [],
+				providerCount: 0,
+				providersTruncated: false,
+				log: `identityKey ${identityKey} was not found\n`
+			};
+			let basketId;
+			if (mode === "change") {
+				basketId = (await sp.findOutputBaskets({ partial: {
+					userId: user.userId,
+					name: "default"
+				} }))[0]?.basketId;
+				if (basketId == null) return this.emptyPage(user, mode, release, pageLimit, offset);
+			}
+			const sourceOutputs = await sp.findOutputs({
+				partial: {
+					userId: user.userId,
+					spendable: true,
+					...basketId != null ? { basketId } : {}
+				},
+				txStatus: [
+					"completed",
+					"unproven",
+					"nosend",
+					"sending"
+				],
+				noScript: true,
+				paged: {
+					limit: pageLimit,
+					offset
+				}
+			});
+			const candidates = sourceOutputs.filter((output) => output.basketId != null);
+			const review = await reviewUtxoOutputs(sp, {
+				userId: user.userId,
+				identityKey: user.identityKey
+			}, candidates, release ? "conclusive" : "none");
+			const complete = sourceOutputs.length < pageLimit;
+			const nextOffset = complete ? void 0 : offset + sourceOutputs.length - review.diagnostics.released;
+			const target = mode === "all" ? "spendable utxos" : "spendable change utxos";
+			const action = release ? "released" : "found";
+			let log = `userId ${user.userId}: page checked ${review.diagnostics.checked} ${target}; ${review.diagnostics.confirmedSpent} confirmed spent, ${review.diagnostics.confirmedUnspent} confirmed unspent, ${review.diagnostics.unknown} unknown; ${action} ${review.diagnostics.released}, ${user.identityKey}\n`;
+			for (const output of review.confirmedSpentOutputs) log += `  ${output.txid}.${output.vout} ${output.satoshis} now ${output.spendable ? "spendable" : "spent"}\n`;
+			if (review.unknownOutputs.length > 0) log += `  ${review.unknownOutputs.length} output(s) quarantined from release pending a conclusive provider result\n`;
+			if (nextOffset != null) log += `  continue at offset ${nextOffset}\n`;
+			return {
+				found: true,
+				userId: user.userId,
+				identityKey: user.identityKey,
+				mode,
+				release,
+				offset,
+				pageLimit,
+				sourceScanned: sourceOutputs.length,
+				complete,
+				...nextOffset != null ? { nextOffset } : {},
+				...review.diagnostics,
+				log
+			};
+		});
+	}
+	emptyPage(user, mode, release, pageLimit, offset) {
+		return {
+			found: true,
+			userId: user.userId,
+			identityKey: user.identityKey,
+			mode,
+			release,
+			offset,
+			pageLimit,
+			sourceScanned: 0,
+			complete: true,
+			checked: 0,
+			confirmedUnspent: 0,
+			confirmedSpent: 0,
+			unknown: 0,
+			confirmedSpentSatoshis: 0,
+			released: 0,
+			releasedSatoshis: 0,
+			providers: [],
+			providerCount: 0,
+			providersTruncated: false,
+			log: `userId ${user.userId}: no invalid utxos found, ${user.identityKey}\n`
+		};
+	}
+	/**
+	* Report managed-change liquidity without changing it. Monitor deliberately
+	* has no signing authority; progressive migration occurs only during a
+	* caller-authorized createAction.
+	*/
+	async reviewManagedChangeByIdentityKey(identityKey) {
+		return await this.storage.runAsStorageProvider(async (sp) => {
+			const user = (await sp.findUsers({ partial: { identityKey } }))[0];
+			if (user == null) return `identityKey ${identityKey} was not found\n`;
+			const basket = verifyOne(await sp.findOutputBaskets({ partial: {
+				userId: user.userId,
+				name: "default"
+			} }));
+			const outputs = (await sp.findOutputs({
+				partial: {
+					userId: user.userId,
+					basketId: basket.basketId,
+					spendable: true,
+					...managedChangeOutputFields
+				},
+				txStatus: [
+					"completed",
+					"unproven",
+					"sending"
+				],
+				noScript: true
+			})).filter(isAutoSpendableChangeOutput);
+			const reserved = new Set(await sp.findReservedActionBatchOutputIds(outputs.map((output) => output.outputId)));
+			const statuses = await sp.findTransactionStatusesByIds(user.userId, outputs.map((output) => output.transactionId));
+			const preferred = Math.max(1, basket.minimumDesiredUTXOValue);
+			const healthy = outputs.filter((output) => output.satoshis >= preferred);
+			const undersized = outputs.filter((output) => output.satoshis < preferred);
+			const countStatus = (status) => outputs.filter((output) => statuses.get(output.transactionId) === status).length;
+			const satoshis = outputs.reduce((sum, output) => sum + output.satoshis, 0);
+			return `userId ${user.userId}: managed change ${outputs.length}/${basket.numberOfDesiredUTXOs}, healthy ${healthy.length}, undersized ${undersized.length}, reserved ${reserved.size}, completed ${countStatus("completed")}, unproven ${countStatus("unproven")}, sending ${countStatus("sending")}, satoshis ${satoshis}, preferred minimum ${preferred}\n`;
+		});
+	}
 	toUserLog(user, outputs, totalOutputs, total, tags) {
-		const action = tags.includes("release") ? "updated to unspendable" : "found";
+		const action = tags.includes("release") ? "confirmed spent and updated to unspendable" : "confirmed spent";
 		const target = tags.includes("all") ? "spendable utxos" : "spendable change utxos";
 		let log = `userId ${user.userId}: ${totalOutputs} ${target} ${action}, total ${total}, ${user.identityKey}\n`;
 		for (const output of outputs) log += `  ${output.outpoint} ${output.satoshis} now ${output.spendable ? "spendable" : "spent"}\n`;
@@ -28116,6 +29342,13 @@ var TaskReviewUtxos = class TaskReviewUtxos extends WalletMonitorTask {
 };
 //#endregion
 //#region ../src/monitor/tasks/TaskReviewDoubleSpends.ts
+function hasDurableInputConflict(req) {
+	try {
+		return JSON.parse(req.history).notes?.some((note) => note.inputConflict === true || note.what === "arcSSEInputQuarantine") === true;
+	} catch {
+		return true;
+	}
+}
 /**
 * Review recent reqs in terminal 'doubleSpend' state and move any false positives
 * back to 'unfail' so existing recovery handling can re-process them.
@@ -28183,14 +29416,16 @@ var TaskReviewDoubleSpends = class TaskReviewDoubleSpends extends WalletMonitorT
 		let lastRetainedDoubleSpendIndex = -1;
 		let retainedDoubleSpendCount = 0;
 		for (const req of reqs) {
-			const status = (await this.monitor.services.getStatusForTxids([req.txid])).results[0]?.status;
+			const gsr = await this.monitor.services.getStatusForTxids([req.txid]);
+			const status = gsr.status === "success" ? gsr.results[0]?.status : void 0;
+			const durableInputConflict = hasDurableInputConflict(req);
 			reviewed.push(req);
-			if (status === "unknown") {
+			if (!(status === "mined" || status === "known" && !durableInputConflict)) {
 				lastRetainedDoubleSpendIndex = reviewed.length - 1;
 				retainedDoubleSpendCount += 1;
 			} else {
 				unfails.push(req.provenTxReqId);
-				log += `unfail ${req.provenTxReqId} ${req.txid} status:${status}\n`;
+				log += `unfail ${req.provenTxReqId} ${req.txid} status:${status} durableInputConflict:${String(durableInputConflict)}\n`;
 			}
 		}
 		if (unfails.length > 0) await this.storage.runAsStorageProvider(async (sp) => {
@@ -28229,6 +29464,168 @@ var TaskReviewDoubleSpends = class TaskReviewDoubleSpends extends WalletMonitorT
 	}
 };
 //#endregion
+//#region ../src/monitor/tasks/TaskReconcilePendingTransactions.ts
+const REVIEW_STATUSES = [
+	"callback",
+	"unmined",
+	"sending",
+	"unknown",
+	"unconfirmed"
+];
+/**
+* Poll durable transaction lifecycle state for aged, non-terminal requests.
+* This closes the gap where an Arcade rejection event was missed before the
+* monitor subscribed or while it was offline. Unknown/provider-error results
+* never mutate storage; only a provider's explicit terminal verdict does.
+*/
+var TaskReconcilePendingTransactions = class TaskReconcilePendingTransactions extends WalletMonitorTask {
+	triggerMsecs;
+	reviewLimit;
+	minAgeMinutes;
+	triggerQuickMsecs;
+	static taskName = "ReconcilePendingTransactions";
+	triggerNextMsecs;
+	constructor(monitor, triggerMsecs = Monitor.oneMinute * 12, reviewLimit = 100, minAgeMinutes = 60, triggerQuickMsecs = Monitor.oneMinute) {
+		super(monitor, TaskReconcilePendingTransactions.taskName);
+		this.triggerMsecs = triggerMsecs;
+		this.reviewLimit = reviewLimit;
+		this.minAgeMinutes = minAgeMinutes;
+		this.triggerQuickMsecs = triggerQuickMsecs;
+		this.triggerNextMsecs = this.triggerQuickMsecs;
+	}
+	trigger(nowMsecsSinceEpoch) {
+		return { run: this.triggerNextMsecs > 0 && nowMsecsSinceEpoch - this.lastRunMsecsSinceEpoch > this.triggerNextMsecs };
+	}
+	async getCheckpoint() {
+		let events = [];
+		await this.storage.runAsStorageProvider(async (sp) => {
+			events = await sp.findMonitorEvents({
+				partial: { event: TaskReconcilePendingTransactions.taskName },
+				orderDescending: true,
+				paged: { limit: 5 }
+			});
+		});
+		for (const event of events) {
+			if (!event.details) continue;
+			try {
+				const parsed = JSON.parse(event.details);
+				if (parsed.cycleComplete === true) return void 0;
+				if (typeof parsed.resumeOffset === "number") return {
+					resumeOffset: parsed.resumeOffset,
+					expectedProvenTxReqId: parsed.expectedProvenTxReqId
+				};
+			} catch {
+				continue;
+			}
+		}
+	}
+	async runTask() {
+		const checkpoint = await this.getCheckpoint();
+		const updatedBefore = /* @__PURE__ */ new Date(Date.now() - this.minAgeMinutes * 60 * 1e3);
+		const reqs = await this.findReqsToReview(checkpoint);
+		const eligible = reqs.filter((req) => req.updated_at <= updatedBefore);
+		const provider = eligible.length === 0 ? void 0 : await this.monitor.services.getStatusForTxids(eligible.map((req) => req.txid));
+		const results = new Map(provider?.results.map((result) => [result.txid, result]) ?? []);
+		let reconciled = 0;
+		let inputConflicts = 0;
+		let reviewLog = "";
+		const retained = [];
+		for (const req of reqs) {
+			const result = results.get(req.txid);
+			if (req.updated_at > updatedBefore || provider?.status !== "success" || result?.terminal !== true) {
+				retained.push(req);
+				continue;
+			}
+			if (!await this.applyTerminalVerdict(req, result, provider.name)) {
+				retained.push(req);
+				continue;
+			}
+			reconciled++;
+			if (result.inputConflict === true) inputConflicts++;
+			reviewLog += `reconciled ${req.provenTxReqId} ${req.txid} ${result.providerStatus ?? "terminal"} => ${result.inputConflict === true ? "doubleSpend" : "invalid"}\n`;
+		}
+		const fullPage = reqs.length >= this.reviewLimit;
+		this.triggerNextMsecs = fullPage ? this.triggerQuickMsecs : this.triggerMsecs;
+		let resumeOffset;
+		let expectedProvenTxReqId;
+		if (fullPage) if (retained.length === 0) resumeOffset = reqs.sourceOffset ?? 0;
+		else {
+			resumeOffset = (reqs.sourceOffset ?? 0) + retained.length - 1;
+			expectedProvenTxReqId = retained.at(-1)?.provenTxReqId;
+		}
+		return JSON.stringify({
+			reviewed: eligible.length,
+			reconciled,
+			inputConflicts,
+			retained: retained.length,
+			reviewLimit: this.reviewLimit,
+			minAgeMinutes: this.minAgeMinutes,
+			cycleComplete: !fullPage,
+			...resumeOffset != null ? { resumeOffset } : {},
+			...expectedProvenTxReqId != null ? { expectedProvenTxReqId } : {},
+			reviewLog
+		});
+	}
+	async findReqsToReview(checkpoint) {
+		let offset = checkpoint?.resumeOffset ?? 0;
+		if (checkpoint?.expectedProvenTxReqId != null) offset = (await this.storage.findProvenTxReqs({
+			partial: {},
+			status: [...REVIEW_STATUSES],
+			paged: {
+				limit: 1,
+				offset
+			}
+		}))[0]?.provenTxReqId === checkpoint.expectedProvenTxReqId ? offset + 1 : 0;
+		const reqs = await this.storage.findProvenTxReqs({
+			partial: {},
+			status: [...REVIEW_STATUSES],
+			paged: {
+				limit: this.reviewLimit,
+				offset
+			}
+		});
+		reqs.sourceOffset = offset;
+		return reqs;
+	}
+	async applyTerminalVerdict(reqApi, result, provider) {
+		let applied = false;
+		await this.storage.runAsStorageProvider(async (sp) => {
+			await sp.transaction(async (trx) => {
+				const req = new EntityProvenTxReq(reqApi);
+				await req.refreshFromStorage(sp, trx);
+				if (!REVIEW_STATUSES.includes(req.status)) return;
+				req.status = result.inputConflict === true ? "doubleSpend" : "invalid";
+				req.addHistoryNote({
+					when: (/* @__PURE__ */ new Date()).toISOString(),
+					what: "proactiveTerminalReconciliation",
+					provider,
+					providerStatus: result.providerStatus,
+					statusCode: result.statusCode,
+					description: result.description,
+					inputConflict: result.inputConflict === true,
+					competingTxs: result.competingTxs?.join(",")
+				});
+				await req.updateStorageDynamicProperties(sp, trx);
+				if (req.notify.transactionIds != null) await sp.updateTransactionsStatus(req.notify.transactionIds, "failed", trx);
+				if (result.inputConflict === true) {
+					const quarantined = await quarantineReqInputs(req, sp, trx);
+					req.addHistoryNote({
+						when: (/* @__PURE__ */ new Date()).toISOString(),
+						what: "proactiveInputQuarantine",
+						checked: quarantined.checked,
+						confirmed: quarantined.staleConfirmed,
+						...quarantined.staleOutpoints.length > 0 ? { outpoints: quarantined.staleOutpoints.join(",") } : {}
+					});
+					await req.updateStorageDynamicProperties(sp, trx);
+				}
+				applied = true;
+			});
+		});
+		if (applied) this.monitor.callOnTransactionStatusChanged(reqApi.txid, result.providerStatus ?? "REJECTED");
+		return applied;
+	}
+};
+//#endregion
 //#region ../src/monitor/tasks/TaskReviewProvenTxs.ts
 /**
 * Backup verification task for recent proven_txs records.
@@ -28487,14 +29884,14 @@ var Monitor = class Monitor {
 		purgeFailedAge: 5 * Monitor.oneDay
 	};
 	addAllTasksToOther() {
-		this._otherTasks.push(new TaskClock(this), new TaskNewHeader(this), new TaskMonitorCallHistory(this), new TaskSendWaiting(this), new TaskCheckForProofs(this), new TaskCheckNoSends(this), new TaskFailAbandoned(this), new TaskUnFail(this), new TaskReviewStatus(this), new TaskReorg(this), new TaskReviewUtxos(this), new TaskReviewDoubleSpends(this), new TaskReviewProvenTxs(this), new TaskCleanupActionBatches(this), new TaskPurge(this, this.defaultPurgeParams));
+		this._otherTasks.push(new TaskClock(this), new TaskNewHeader(this), new TaskMonitorCallHistory(this), new TaskSendWaiting(this), new TaskCheckForProofs(this), new TaskCheckNoSends(this), new TaskFailAbandoned(this), new TaskUnFail(this), new TaskReviewStatus(this), new TaskReorg(this), new TaskReviewUtxos(this), new TaskReviewDoubleSpends(this), new TaskReconcilePendingTransactions(this), new TaskReviewProvenTxs(this), new TaskCleanupActionBatches(this), new TaskPurge(this, this.defaultPurgeParams));
 		if (this.chain === "mock") this._otherTasks.push(new TaskMineBlock(this));
 	}
 	/**
 	* Default tasks with settings appropriate for a single user storage
 	*/
 	addDefaultTasks() {
-		this._tasks.push(new TaskClock(this), new TaskNewHeader(this), new TaskMonitorCallHistory(this), new TaskSendWaiting(this, 8 * Monitor.oneSecond, 7 * Monitor.oneSecond), new TaskCheckForProofs(this, 2 * Monitor.oneHour), new TaskCheckNoSends(this), new TaskFailAbandoned(this, 8 * Monitor.oneMinute), new TaskUnFail(this), new TaskReviewStatus(this), new TaskReorg(this), new TaskReviewDoubleSpends(this), new TaskReviewProvenTxs(this), new TaskCleanupActionBatches(this), new TaskArcadeSSE(this));
+		this._tasks.push(new TaskClock(this), new TaskNewHeader(this), new TaskMonitorCallHistory(this), new TaskSendWaiting(this, 8 * Monitor.oneSecond, 7 * Monitor.oneSecond), new TaskCheckForProofs(this, 2 * Monitor.oneHour), new TaskCheckNoSends(this), new TaskFailAbandoned(this, 8 * Monitor.oneMinute), new TaskUnFail(this), new TaskReviewStatus(this), new TaskReorg(this), new TaskReviewDoubleSpends(this), new TaskReconcilePendingTransactions(this), new TaskReviewProvenTxs(this), new TaskCleanupActionBatches(this), new TaskArcadeSSE(this));
 		this._otherTasks.push(new TaskPurge(this, this.defaultPurgeParams, 6 * Monitor.oneHour), new TaskReviewUtxos(this));
 		if (this.chain === "mock") this._tasks.push(new TaskMineBlock(this));
 	}
@@ -28502,7 +29899,7 @@ var Monitor = class Monitor {
 	* Tasks appropriate for multi-user storage
 	*/
 	addMultiUserTasks() {
-		this._tasks.push(new TaskClock(this), new TaskNewHeader(this), new TaskMonitorCallHistory(this), new TaskSendWaiting(this, 8 * Monitor.oneSecond, 7 * Monitor.oneSecond), new TaskCheckForProofs(this, 2 * Monitor.oneHour), new TaskCheckNoSends(this), new TaskFailAbandoned(this, 8 * Monitor.oneMinute), new TaskUnFail(this), new TaskReviewStatus(this), new TaskReorg(this), new TaskReviewDoubleSpends(this), new TaskReviewProvenTxs(this), new TaskCleanupActionBatches(this), new TaskArcadeSSE(this));
+		this._tasks.push(new TaskClock(this), new TaskNewHeader(this), new TaskMonitorCallHistory(this), new TaskSendWaiting(this, 8 * Monitor.oneSecond, 7 * Monitor.oneSecond), new TaskCheckForProofs(this, 2 * Monitor.oneHour), new TaskCheckNoSends(this), new TaskFailAbandoned(this, 8 * Monitor.oneMinute), new TaskUnFail(this), new TaskReviewStatus(this), new TaskReorg(this), new TaskReviewDoubleSpends(this), new TaskReconcilePendingTransactions(this), new TaskReviewProvenTxs(this), new TaskCleanupActionBatches(this), new TaskArcadeSSE(this));
 		this._otherTasks.push(new TaskPurge(this, this.defaultPurgeParams), new TaskReviewUtxos(this));
 		if (this.chain === "mock") this._tasks.push(new TaskMineBlock(this));
 	}
@@ -28873,6 +30270,7 @@ var SetupClient = class SetupClient {
 				model: "sat/kb",
 				value: 100
 			},
+			managedChangePolicy: args.managedChangePolicy,
 			scriptVerifier: args.scriptVerifier
 		});
 		await storage.migrate(args.databaseName, randomBytesHex(33));
@@ -33462,7 +34860,7 @@ var WalletPermissionsManager = class WalletPermissionsManager {
 				basket: basketName,
 				tags
 			}],
-			options: { acceptDelayedBroadcast: false }
+			options: { acceptDelayedBroadcast: true }
 		}, this.adminOriginator);
 	}
 	async mapWithConcurrency(items, concurrency, fn) {
@@ -33526,7 +34924,7 @@ var WalletPermissionsManager = class WalletPermissionsManager {
 			await this.createAction({
 				description: `Grant ${built.length} permissions`,
 				outputs: built.map((b) => b.output),
-				options: { acceptDelayedBroadcast: false }
+				options: { acceptDelayedBroadcast: true }
 			}, this.adminOriginator);
 			return built.map((b) => b.request);
 		}, strict);
@@ -34923,6 +36321,7 @@ exports.ARGON2ID_MAX_MEMORY_KIB = ARGON2ID_MAX_MEMORY_KIB;
 exports.ARGON2ID_MAX_PARALLELISM = ARGON2ID_MAX_PARALLELISM;
 exports.AuthMethodInteractor = AuthMethodInteractor;
 exports.BHServiceClient = BHServiceClient;
+exports.BRC153_REFERENCE_PREFIX = BRC153_REFERENCE_PREFIX;
 exports.BulkFileDataManager = BulkFileDataManager;
 exports.BulkFileDataReader = BulkFileDataReader;
 exports.BulkFilesReader = BulkFilesReader;
@@ -34943,6 +36342,11 @@ exports.ChaintracksServiceClient = ChaintracksServiceClient;
 exports.ChaintracksStorageBase = ChaintracksStorageBase;
 exports.ChaintracksStorageIdb = ChaintracksStorageIdb;
 exports.ChaintracksStorageNoDb = ChaintracksStorageNoDb;
+exports.DEFAULT_MANAGED_CHANGE_MAX_OUTPUTS_PER_ACTION = DEFAULT_MANAGED_CHANGE_MAX_OUTPUTS_PER_ACTION;
+exports.DEFAULT_MANAGED_CHANGE_MIGRATION_INPUTS_PER_ACTION = DEFAULT_MANAGED_CHANGE_MIGRATION_INPUTS_PER_ACTION;
+exports.DEFAULT_MANAGED_CHANGE_MINIMUM_SATOSHIS = DEFAULT_MANAGED_CHANGE_MINIMUM_SATOSHIS;
+exports.DEFAULT_MANAGED_CHANGE_PENDING_COMPARISON_INPUTS = DEFAULT_MANAGED_CHANGE_PENDING_COMPARISON_INPUTS;
+exports.DEFAULT_MANAGED_CHANGE_TARGET_UTXOS = DEFAULT_MANAGED_CHANGE_TARGET_UTXOS;
 exports.DEFAULT_PROFILE_ID = DEFAULT_PROFILE_ID;
 exports.DEFAULT_SETTINGS = DEFAULT_SETTINGS;
 exports.DevConsoleInteractor = DevConsoleInteractor;
@@ -34964,6 +36368,7 @@ exports.EntityUser = EntityUser;
 exports.GoChaintracksServiceClient = GoChaintracksServiceClient;
 exports.HeightRange = HeightRange;
 exports.KDF_MAX_HASH_LENGTH = KDF_MAX_HASH_LENGTH;
+exports.LEGACY_MANAGED_CHANGE_MINIMUM_SATOSHIS = LEGACY_MANAGED_CHANGE_MINIMUM_SATOSHIS;
 exports.LiveIngestorBase = LiveIngestorBase;
 exports.LiveIngestorChaintracksSSE = LiveIngestorChaintracksSSE;
 exports.LiveIngestorWhatsOnChainPoll = LiveIngestorWhatsOnChainPoll;
@@ -34998,6 +36403,7 @@ exports.WalletSettingsManager = WalletSettingsManager;
 exports.WalletSigner = WalletSigner;
 exports.WalletStorageManager = WalletStorageManager;
 exports.WhatsOnChainServices = WhatsOnChainServices;
+exports.applyBrc153ReferenceLabel = applyBrc153ReferenceLabel;
 exports.arcDefaultUrl = arcDefaultUrl;
 exports.arcGorillaPoolUrl = arcGorillaPoolUrl;
 exports.arcadeDefaultUrl = arcadeDefaultUrl;
@@ -35023,6 +36429,7 @@ exports.createIdbChaintracks = createIdbChaintracks;
 exports.createNoDbChaintracks = createNoDbChaintracks;
 exports.createSyncMap = createSyncMap;
 exports.decryptBRC39 = decryptBRC39;
+exports.defaultManagedChangePolicy = defaultManagedChangePolicy;
 exports.doubleSha256BE = doubleSha256BE;
 exports.doubleSha256LE = doubleSha256LE;
 exports.encryptBRC39 = encryptBRC39;
@@ -35037,6 +36444,8 @@ exports.importBRC39 = importBRC39;
 exports.isAutoSpendableChangeOutput = isAutoSpendableChangeOutput;
 exports.isBaseBlockHeader = isBaseBlockHeader;
 exports.isBlockHeader = isBlockHeader;
+exports.isBrc153ReferenceLabel = isBrc153ReferenceLabel;
+exports.isLegacyManagedChangeBasketDefault = isLegacyManagedChangeBasketDefault;
 exports.isLive = isLive;
 exports.isLiveBlockHeader = isLiveBlockHeader;
 exports.isManagedChangeOutput = isManagedChangeOutput;
@@ -35045,12 +36454,14 @@ exports.logWalletError = logWalletError;
 exports.logger = logger;
 exports.makeAtomicBeef = makeAtomicBeef;
 exports.makeBrc114ActionTimeLabel = makeBrc114ActionTimeLabel;
+exports.makeBrc153ReferenceLabel = makeBrc153ReferenceLabel;
 exports.managedChangeOutputFields = managedChangeOutputFields;
 exports.maxDate = maxDate;
 exports.optionalArraysEqual = optionalArraysEqual;
 exports.outputColumnsWithoutLockingScript = outputColumnsWithoutLockingScript;
 exports.parseBRC38Json = parseBRC38Json;
 exports.parseBrc114ActionTimeLabels = parseBrc114ActionTimeLabels;
+exports.parseBrc153ReferenceLabel = parseBrc153ReferenceLabel;
 exports.parseFileLink = parseFileLink;
 exports.parseTxScriptOffsets = parseTxScriptOffsets;
 exports.partitionActionLabels = partitionActionLabels;
@@ -35076,12 +36487,14 @@ exports.toDefaultChaintracksArguments = toDefaultChaintracksArguments;
 exports.toLookupNetworkPreset = toLookupNetworkPreset;
 exports.toWalletNetwork = toWalletNetwork;
 exports.transactionColumnsWithoutRawTx = transactionColumnsWithoutRawTx;
+exports.upgradeLegacyManagedChangeBasketDefault = upgradeLegacyManagedChangeBasketDefault;
 Object.defineProperty(exports, "utils", {
 	enumerable: true,
 	get: function() {
 		return blockHeaderUtilities_exports;
 	}
 });
+exports.validateManagedChangePolicy = validateManagedChangePolicy;
 exports.validateScriptHash = validateScriptHash;
 exports.validateSecondsSinceEpoch = validateSecondsSinceEpoch;
 exports.validateStorageFeeModel = validateStorageFeeModel;