@dusk-network/app-core 0.3.1 → 0.4.0

package/src/bridge.js

@@ -47,9 +47,10 @@ import { DETAILS_BATCH, TRANSFER_CONTRACT, fetchTxDetails, historyRange } from "
 /**
  * A credit on the other chain: its transaction, its block and time, its
  * amount in wei, whether it went through, and the address it came from as
- * its log names it (lower case; null where it isn't named).
+ * its log names it (lower case; null where it isn't named). Found by an RPC
+ * search, the passes over its blocks again done before it was (`pass`).
  *
- * @typedef {{ hash: string, block: bigint | null, at: number, wei: bigint, success: boolean, from: string | null }} Credit
+ * @typedef {{ hash: string, block: bigint | null, at: number, wei: bigint, success: boolean, from: string | null, pass?: number }} Credit
  */
 
 /**
@@ -75,14 +76,27 @@ const MAX_U64 = (1n << 64n) - 1n;
 const TIMEOUT_MS = 8_000;
 // About one Dusk block every 10 seconds: how far back a sender's history is read.
 const DUSK_BLOCK_MS = 10_000;
-// The blocks the chain's pace is read over, how much further back than the
-// pace says a search starts, and how often it steps back again from a block
-// that is still later than the transfer.
+// The blocks the chain's pace is read over, from a block rounded down to a
+// multiple of `PACE_STEP` so that the app's cache keeps its time, and how
+// long before the transfer a search starts as the pace says: the block is
+// then checked by its time, and stepped back while it's still later.
 const PACE_SAMPLE = 100_000n;
-const PACE_MARGIN = 1.2;
-const START_MARGIN = 50n;
-const START_CHECKS = 4;
+const PACE_STEP = 10_000n;
+const START_MS = 10 * 60_000;
 const MIN_WINDOW = 50n;
+// The widest a search's windows grow, while the RPC answers them whole.
+const MAX_WINDOW = 100_000n;
+// How far back from the head a search's last window reaches: those blocks
+// are read again on each call.
+const OVERLAP = 1_000n;
+// How long after a search first reaches the head it reads its blocks again
+// from its first one; each pass after waits as long again as it has been
+// since then, so the waits about double each time.
+const RECHECK_MS = 60_000;
+// How many passes over the blocks before a credit, since it was found, a
+// transfer waits for before it takes the credit where a later equal one,
+// still without its own, could have had it instead.
+const CONFIRM_PASSES = 8;
 // What an RPC says when it won't search that many blocks at once.
 const RANGE_REFUSED = /limit|range|too many|exceed/i;
 const DUSK_HASH = /^[0-9a-f]{64}$/;
@@ -233,9 +247,9 @@ function historyScanOf(value) {
 }
 
 /**
- * Where a search stopped, what it searched for, and the credits it found
- * before, and how far the transfer's history is read, as a result gave
- * them; null for anything else.
+ * Where a search stopped, what it searched for, the credits it found
+ * before, the width of its windows, and how far the transfer's history is
+ * read, as a result gave them; null for anything else.
  *
  * @param {unknown} value
  * @returns {Scan | null}
@@ -253,11 +267,25 @@ function scanOf(value) {
       const block = quantityOf(credit?.block);
       const at = msOf(credit?.at);
       const sender = credit?.sender === null ? null : addressOf(credit?.sender);
+      // The passes done before it was found: none where it isn't said.
+      const pass = Number.isSafeInteger(credit?.pass) && credit.pass >= 0 ? credit.pass : 0;
 
-      return hash && block !== null && at !== null && sender !== "" ? [{ at, block: block.toString(), hash, sender }] : [];
+      return hash && block !== null && at !== null && sender !== "" ? [{ at, block: block.toString(), hash, pass, sender }] : [];
     });
+    // Where it began, and its passes over the blocks again: without them,
+    // as a search kept by an earlier version.
+    const start = quantityOf(scan.start);
+    const recheck = start === null ? null : recheckOf(scan.recheck);
+    // The width of its windows, as an earlier version kept it for its passes
+    // where it isn't said; and the narrowest the RPC refused.
+    const size = Number.isSafeInteger(scan.size) && scan.size >= Number(MIN_WINDOW) && scan.size <= Number(MAX_WINDOW) ? scan.size : (recheck?.size ?? null);
+    const refused = Number.isSafeInteger(scan.refused) && scan.refused > 0 ? scan.refused : null;
 
     Object.assign(out, { basis: scan.basis, from: from.toString(), search: scan.search, seen });
+    if (start !== null) out.start = start.toString();
+    if (recheck) out.recheck = recheckIn(recheck);
+    if (size !== null) out.size = size;
+    if (refused !== null) out.refused = refused;
   } else if (!history) {
     return null;
   }
@@ -375,6 +403,10 @@ function reader(fetchFn, timeoutMs) {
 
   return {
     counter,
+    // What a call reads once for all its searches, by what and where: a
+    // chain's head and pace.
+    /** @type {Map<string, Promise<any>>} */
+    once: new Map(),
 
     /**
      * @param {string} url
@@ -450,6 +482,36 @@ function clustersOf(queue, windowMs) {
  */
 const allOpen = (queue, windowMs, now) => clustersOf(queue, windowMs).every((cluster) => now < cluster[cluster.length - 1].at + windowMs);
 
+/**
+ * How a group's credits are matched: see `settle`.
+ *
+ * @typedef {{ guarded: boolean, now: number, slackMs: number, used: ReadonlySet<string>, windowMs: number, rivals?: ReadonlySet<string> }} Rules
+ */
+
+/**
+ * Whether a credit could pay a transfer, whether or not another one took it:
+ * it went through, isn't one the app gave another of its transfers when
+ * this one is the app's, comes from none of `rivals`, and is in the
+ * transfer's time and at or after the block it can't be before.
+ *
+ * @param {Queued} item
+ * @param {Credit} credit
+ * @param {Rules} rules
+ */
+function pays(item, credit, { guarded, rivals = new Set(), slackMs, used, windowMs }) {
+  const lo = item.at - (guarded ? windowMs : slackMs);
+  const hi = guarded ? item.at + windowMs : Infinity;
+
+  return (
+    credit.success &&
+    (!item.given || !used.has(credit.hash)) &&
+    (credit.from === null || !rivals.has(credit.from)) &&
+    credit.at >= lo &&
+    credit.at <= hi &&
+    (item.notBefore === null || credit.block === null || credit.block >= item.notBefore)
+  );
+}
+
 /**
  * Each transfer of a queue of equal ones, oldest first, takes the first
  * credit that went through after it that no earlier one took: from
@@ -470,10 +532,11 @@ const allOpen = (queue, windowMs, now) => clustersOf(queue, windowMs).every((clu
  *
  * @param {ReadonlyArray<Queued>} queue oldest first
  * @param {ReadonlyArray<Credit>} credits
- * @param {{ guarded: boolean, now: number, slackMs: number, used: ReadonlySet<string>, windowMs: number, rivals?: ReadonlySet<string> }} rules
+ * @param {Rules} rules
  * @returns {{ assigned: Map<string, Credit>, verdicts: Map<string, Verdict> }}
  */
-function settle(queue, credits, { guarded, now, rivals = new Set(), slackMs, used, windowMs }) {
+function settle(queue, credits, rules) {
+  const { guarded, now, used, windowMs } = rules;
   const sorted = [...credits].sort(byTime);
   /** @type {Map<string, Credit>} */
   const assigned = new Map();
@@ -482,18 +545,7 @@ function settle(queue, credits, { guarded, now, rivals = new Set(), slackMs, use
   const verdicts = new Map();
 
   for (const item of queue) {
-    const lo = item.at - (guarded ? windowMs : slackMs);
-    const hi = guarded ? item.at + windowMs : Infinity;
-    const credit = sorted.find(
-      (c) =>
-        c.success &&
-        !taken.has(c.hash) &&
-        (!item.given || !used.has(c.hash)) &&
-        (c.from === null || !rivals.has(c.from)) &&
-        c.at >= lo &&
-        c.at <= hi &&
-        (item.notBefore === null || c.block === null || c.block >= item.notBefore)
-    );
+    const credit = sorted.find((c) => !taken.has(c.hash) && pays(item, c, rules));
 
     if (credit) {
       assigned.set(item.hash, credit);
@@ -653,80 +705,125 @@ async function blockTime(read, url, block, cache) {
 
   if (typeof kept === "number" && Number.isFinite(kept)) return kept;
 
-  const seconds = quantityOf((await read.rpc(url, "eth_getBlockByNumber", [hex(block), false]))?.timestamp);
+  return once(read, `time ${url} ${block}`, async () => {
+    const seconds = quantityOf((await read.rpc(url, "eth_getBlockByNumber", [hex(block), false]))?.timestamp);
 
-  if (seconds === null) throw new Error(`The chain gave no time for block ${block}`);
+    if (seconds === null) throw new Error(`The chain gave no time for block ${block}`);
 
-  const at = Number(seconds) * 1000;
+    const at = Number(seconds) * 1000;
 
-  cache?.set(Number(block), at);
+    cache?.set(Number(block), at);
 
-  return at;
+    return at;
+  });
 }
 
 /**
+ * What a call reads once for all its searches on a chain.
+ *
+ * @template T
+ * @param {Reader} read
+ * @param {string} key
+ * @param {() => Promise<T>} get
+ * @returns {Promise<T>}
+ */
+function once(read, key, get) {
+  const kept = read.once.get(key);
+
+  if (kept) return kept;
+
+  const got = get();
+
+  read.once.set(key, got);
+  // One that failed is read again by the next search.
+  got.catch(() => read.once.delete(key));
+
+  return got;
+}
+
+/**
+ * The chain's head, read once a call: the head its pace was read with, where
+ * the call read that.
+ *
  * @param {Reader} read
  * @param {string} url
  * @returns {Promise<bigint>}
  */
 async function headOf(read, url) {
-  const head = quantityOf(await read.rpc(url, "eth_blockNumber", []));
+  const paced = read.once.get(`pace ${url}`);
+
+  if (paced) return (await paced).head;
 
-  if (head === null) throw new Error("The chain gave no head");
+  return once(read, `head ${url}`, async () => {
+    const head = quantityOf(await read.rpc(url, "eth_blockNumber", []));
 
-  return head;
+    if (head === null) throw new Error("The chain gave no head");
+
+    return head;
+  });
 }
 
 /**
- * The chain's head, and a block from before `atMs`: estimated from the
- * chain's pace over its last 100,000 blocks, a fifth further back, then
- * stepped back while its own time is still later, twice as far each time,
- * as the chain's pace may have changed.
+ * The chain's head, its time, and its pace (blocks a second) over its last
+ * 100,000 blocks or so, read once a call.
  *
  * @param {Reader} read
  * @param {string} url
- * @param {number} atMs
  * @param {BlockTimes | undefined} cache
- * @returns {Promise<{ head: bigint, start: bigint }>}
+ * @returns {Promise<{ head: bigint, seconds: number, pace: number }>}
  */
-async function startBefore(read, url, atMs, cache) {
-  const latest = await read.rpc(url, "eth_getBlockByNumber", ["latest", false]);
-  const head = quantityOf(latest?.number);
-  const headSeconds = quantityOf(latest?.timestamp);
+function paceOf(read, url, cache) {
+  return once(read, `pace ${url}`, async () => {
+    const latest = await read.rpc(url, "eth_getBlockByNumber", ["latest", false]);
+    const head = quantityOf(latest?.number);
+    const headSeconds = quantityOf(latest?.timestamp);
 
-  if (head === null || headSeconds === null) throw new Error("The chain gave no head");
+    if (head === null || headSeconds === null) throw new Error("The chain gave no head");
 
-  cache?.set(Number(head), Number(headSeconds) * 1000);
+    cache?.set(Number(head), Number(headSeconds) * 1000);
+    read.once.set(`time ${url} ${head}`, Promise.resolve(Number(headSeconds) * 1000));
 
-  const back = head < PACE_SAMPLE ? head : PACE_SAMPLE;
-  // Blocks a second.
-  let pace = 1;
+    const back = head < PACE_SAMPLE ? 0n : ((head - PACE_SAMPLE) / PACE_STEP) * PACE_STEP;
+    let pace = 1;
 
-  if (back > 0n) {
-    const sample = await blockTime(read, url, head - back, cache);
-    const span = Number(headSeconds) - sample / 1000;
+    if (back < head) {
+      const span = Number(headSeconds) - (await blockTime(read, url, back, cache)) / 1000;
 
-    if (span > 0) pace = Number(back) / span;
-  }
+      if (span > 0) pace = Number(head - back) / span;
+    }
 
-  /**
-   * @param {bigint} block
-   * @param {number} seconds
-   * @param {number} [times]
-   */
-  const stepBack = (block, seconds, times = 1) => {
-    const step = BigInt(Math.ceil(Math.max(0, seconds) * pace * PACE_MARGIN * times)) + START_MARGIN;
+    return { head, pace, seconds: Number(headSeconds) };
+  });
+}
+
+/**
+ * The chain's head, and a block from before `atMs`: the block 10 minutes
+ * before it, as the chain's pace says, checked by its time, and stepped back
+ * while that's still later, twice as far each time, as the chain's pace may
+ * have changed.
+ *
+ * @param {Reader} read
+ * @param {string} url
+ * @param {number} atMs
+ * @param {BlockTimes | undefined} cache
+ * @returns {Promise<{ head: bigint, start: bigint }>}
+ */
+async function startBefore(read, url, atMs, cache) {
+  const { head, pace, seconds } = await paceOf(read, url, cache);
+  /** @param {bigint} block @param {number} ms @param {number} times */
+  const back = (block, ms, times) => {
+    const step = BigInt(Math.ceil((Math.max(0, ms) / 1000) * pace * times));
 
     return block > step ? block - step : 0n;
   };
-  let start = stepBack(head, Number(headSeconds) - atMs / 1000);
+  let start = back(head, seconds * 1000 - atMs + START_MS, 1);
 
-  for (let check = 0; check < START_CHECKS && start > 0n; check += 1) {
+  for (let times = 2; start > 0n; times *= 2) {
     const at = await blockTime(read, url, start, cache);
 
     if (at <= atMs) break;
 
-    start = stepBack(start, (at - atMs) / 1000, 2 ** (check + 1));
+    start = back(start, at - atMs + START_MS, times);
   }
 
   return { head, start };
@@ -734,41 +831,75 @@ async function startBefore(read, url, atMs, cache) {
 
 /**
  * The credits asked for from block `start`, a window of blocks at a time, at
- * most `maxWindows`, until the head, `enough`, or a window ending after
- * `until` (`covered`): each checked against what was asked, with its block's
- * time. A window the RPC won't search at once is asked again a quarter as
- * wide.
+ * most `maxWindows`, until `head`, `enough`, or a window ending after
+ * `until` (`covered`, as the block before `start` may already be, where a
+ * search before stopped there): each checked against what was asked, with
+ * its block's time. Each window is `size` blocks wide, twice as wide after
+ * one the RPC answered whole, up to `MAX_WINDOW`, and narrower than any it
+ * refused (`refused`, the narrowest). One it won't search at once, or one
+ * wider than `LOG_WINDOW` that isn't answered, is asked again a quarter as
+ * wide, or as wide as the widest it answered where that's wider: `size` and
+ * `refused` are as the search leaves them. The window ending at `head`
+ * reaches back up to `overlap` blocks from it, no wider than `size`, though
+ * not under `floor`: those blocks are read again (from `low`). `asked`: the
+ * windows asked.
  *
  * @param {Reader} read
- * @param {{ url: string, address: string, topics: ReadonlyArray<string | null>, wei: bigint, amountOf: (data: string) => bigint | null, start: bigint, head: bigint, maxWindows: number, blockTimes: BlockTimes | undefined, enough: (credits: Credit[]) => boolean, until: number | null, known: Credit[] }} search
- * @returns {Promise<{ complete: boolean, covered: boolean, credits: Credit[], next: bigint }>}
+ * @param {{ url: string, address: string, topics: ReadonlyArray<string | null>, wei: bigint, amountOf: (data: string) => bigint | null, start: bigint, floor: bigint, head: bigint, size: bigint, refused: bigint | null, overlap?: bigint, maxWindows: number, blockTimes: BlockTimes | undefined, enough: (credits: Credit[]) => boolean, until: number | null, known: Credit[] }} search
+ * @returns {Promise<{ asked: number, complete: boolean, covered: boolean, credits: Credit[], low: bigint | null, next: bigint, refused: bigint | null, size: bigint }>}
  */
-async function searchLogs(read, { address, amountOf, blockTimes, enough, head, known, maxWindows, start, topics, until, url, wei }) {
+async function searchLogs(read, { address, amountOf, blockTimes, enough, floor, head, known, maxWindows, overlap = OVERLAP, refused: kept, size: width, start, topics, until, url, wei }) {
   // What an earlier search found before `start`.
   /** @type {Credit[]} */
   const credits = [...known];
   let from = start;
-  let size = BigInt(LOG_WINDOW);
+  let size = width;
+  let refused = kept;
   let covered = false;
+  let asked = 0;
+  /** @type {bigint | null} */
+  let low = null;
+  /** @type {bigint | null} */
+  let took = null;
+
+  if (until !== null && start > floor && start <= head) covered = (await blockTime(read, url, start - 1n, blockTimes)) > until;
 
-  for (let round = 0; round < maxWindows && from <= head; round += 1) {
+  while (!covered && asked < maxWindows && from <= head) {
     const to = from + size - 1n < head ? from + size - 1n : head;
+    const back = head + 1n - (size < overlap ? size : overlap);
+    const lo = to === head && back < from ? (back > floor ? back : floor) : from;
+    const blocks = to - lo + 1n;
     /** @type {any} */
     let logs;
 
+    asked += 1;
+
     try {
-      logs = await read.rpc(url, "eth_getLogs", [{ address, fromBlock: hex(from), toBlock: hex(to), topics }]);
+      logs = await read.rpc(url, "eth_getLogs", [{ address, fromBlock: hex(lo), toBlock: hex(to), topics }]);
     } catch (error) {
-      if (size > MIN_WINDOW && RANGE_REFUSED.test(messageOf(error))) {
-        size = size / 4n > MIN_WINDOW ? size / 4n : MIN_WINDOW;
+      if (blocks > MIN_WINDOW && (blocks > BigInt(LOG_WINDOW) || RANGE_REFUSED.test(messageOf(error)))) {
+        const fits = took !== null && took < blocks && took > blocks / 4n ? took : blocks / 4n;
+
+        if (refused === null || blocks < refused) refused = blocks;
+        size = fits > MIN_WINDOW ? fits : MIN_WINDOW;
         continue;
       }
 
       throw error;
     }
 
+    if (to === head) low = lo;
+    if (took === null || blocks > took) took = blocks;
+
+    // Answered whole: the next one twice as wide, while narrower than any refused.
+    if (blocks === size) {
+      const wider = size * 2n < MAX_WINDOW ? size * 2n : MAX_WINDOW;
+
+      if (refused === null || wider < refused) size = wider;
+    }
+
     for (const log of Array.isArray(logs) ? logs : []) {
-      const found = creditLog(log, { address, amountOf, from, to, topics, wei });
+      const found = creditLog(log, { address, amountOf, from: lo, to, topics, wei });
 
       if (!found || credits.some((credit) => credit.hash === found.hash)) continue;
       if (found.at !== null) blockTimes?.set(Number(found.block), found.at);
@@ -785,7 +916,40 @@ async function searchLogs(read, { address, amountOf, blockTimes, enough, head, k
     }
   }
 
-  return { complete: from > head, covered, credits, next: from };
+  return { asked, complete: from > head, covered, credits, low, next: from, refused, size };
+}
+
+/**
+ * A search's passes over its blocks again, as a result gave them: where the
+ * one under way is (null between two), when the next begins, how many are
+ * done, when the search first reached the head, and the width of the
+ * windows it read them in, as an earlier version kept it; null for anything
+ * else.
+ *
+ * @param {unknown} value
+ * @returns {{ at: number, from: bigint | null, passes: number, since: number, size: number | null } | null}
+ */
+function recheckOf(value) {
+  const kept = /** @type {any} */ (value);
+  const from = kept?.from === null ? null : quantityOf(kept?.from);
+  /** @param {unknown} ms */
+  const time = (ms) => typeof ms === "number" && Number.isFinite(ms);
+  const size = Number.isSafeInteger(kept?.size) && kept.size >= Number(MIN_WINDOW) && kept.size <= LOG_WINDOW ? kept.size : null;
+
+  if (!kept || !time(kept.at) || !time(kept.since) || !Number.isSafeInteger(kept.passes) || kept.passes < 0) return null;
+  if (kept.from !== null && from === null) return null;
+
+  return { at: kept.at, from, passes: kept.passes, since: kept.since, size };
+}
+
+/**
+ * A search's passes over its blocks again, as its scan keeps them.
+ *
+ * @param {NonNullable<ReturnType<typeof recheckOf>>} recheck
+ * @returns {NonNullable<Scan["recheck"]>}
+ */
+function recheckIn({ at, from, passes, since }) {
+  return { at, from: from === null ? null : from.toString(), passes, since };
 }
 
 /**
@@ -795,6 +959,17 @@ async function searchLogs(read, { address, amountOf, blockTimes, enough, head, k
  * sent at (as the app saw the chain's head then), else from about when it
  * was sent.
  *
+ * Each block is read more than once: on each call, those up to `OVERLAP`
+ * under the head, and once the search has reached the head with a transfer
+ * not arrived, all of them again from where the search began, a pass at a
+ * time: the first a minute later, each after as long again as it has been
+ * since then, and one after the other, as far as its credit, while an
+ * arrival is held back. A pass under way takes what the search ahead leaves
+ * of a call's windows, one at least. A pass counts once it read the blocks
+ * again, as does a call whose window at the head reached back to where the
+ * search began. Both go on in windows as wide as the searches before left
+ * them, narrower than the narrowest the RPC refused.
+ *
  * @param {Reader} read
  * @param {{ given: Queued[], queue: Queued[], guarded: boolean, unsure: ReadonlySet<string>, rivals?: ReadonlySet<string>, filter: { address: string, topics: ReadonlyArray<string | null>, wei: bigint, amountOf: (data: string) => bigint | null } }} group
  * @param {{ url: string, maxWindows: number, blockTimes: BlockTimes | undefined, now: number, slackMs: number, windowMs: number, used: Set<string> }} options
@@ -821,9 +996,11 @@ async function followLogs(read, { filter, given, guarded, queue, rivals, unsure
   // The logs searched for: a search for others, as for another sender or
   // amount, isn't carried on.
   const search = [filter.address, ...filter.topics.map((topic) => topic ?? "*"), filter.wei.toString()].join(":");
-  /** @type {{ basis: number, from: string, seen?: Scan["seen"] }[]} */
+  /** @type {{ basis: number, from: string, seen?: Scan["seen"], start?: string, recheck?: Scan["recheck"], size?: number, refused?: number }[]} */
   const resumed = live.flatMap(({ scan }) =>
-    scan?.from !== undefined && scan.search === search && scan.basis !== undefined && scan.basis <= first.at ? [{ basis: scan.basis, from: scan.from, seen: scan.seen }] : []
+    scan?.from !== undefined && scan.search === search && scan.basis !== undefined && scan.basis <= first.at
+      ? [{ basis: scan.basis, from: scan.from, recheck: scan.recheck, refused: scan.refused, seen: scan.seen, size: scan.size, start: scan.start }]
+      : []
   );
   /** @type {Map<string, Credit>} */
   const carried = new Map();
@@ -832,7 +1009,7 @@ async function followLogs(read, { filter, given, guarded, queue, rivals, unsure
   // counts again, as the transfer it paid may be among the queue's.
   for (const scan of resumed) {
     for (const credit of scan.seen ?? []) {
-      if (credit.at >= reach) carried.set(credit.hash, { at: credit.at, block: BigInt(credit.block), from: credit.sender, hash: credit.hash, success: true, wei: filter.wei });
+      if (credit.at >= reach) carried.set(credit.hash, { at: credit.at, block: BigInt(credit.block), from: credit.sender, hash: credit.hash, pass: credit.pass ?? 0, success: true, wei: filter.wei });
     }
   }
 
@@ -840,10 +1017,29 @@ async function followLogs(read, { filter, given, guarded, queue, rivals, unsure
   let head;
   /** @type {bigint} */
   let start;
+  // The block the search began at, and its passes over the blocks before.
+  /** @type {bigint} */
+  let floor;
+  /** @type {ReturnType<typeof recheckOf>} */
+  let recheck = null;
 
   if (resumed.length && resumed.every((scan) => scan.basis === first.at)) {
-    start = minOf(resumed.map((scan) => BigInt(scan.from)));
-    head = await headOf(read, url);
+    const kept = resumed.reduce((a, b) => (BigInt(b.from) < BigInt(a.from) ? b : a));
+
+    start = BigInt(kept.from);
+    recheck = recheckOf(kept.recheck);
+
+    if (resumed.every((scan) => scan.start !== undefined)) {
+      floor = minOf(resumed.map((scan) => BigInt(/** @type {string} */ (scan.start))));
+      head = await headOf(read, url);
+    } else {
+      // Kept without where it began: from where a search from the first
+      // begins.
+      const fresh = first.notBefore !== null ? { head: await headOf(read, url), start: first.notBefore } : await startBefore(read, url, reach, blockTimes);
+
+      floor = fresh.start;
+      head = fresh.head;
+    }
   } else if (resumed.length) {
     // Begun from a transfer before the first now, as one that since
     // arrived: none of the queue's credits is before where a search from
@@ -853,38 +1049,153 @@ async function followLogs(read, { filter, given, guarded, queue, rivals, unsure
 
     head = fresh.head;
     start = from > fresh.start ? from : fresh.start;
+    floor = fresh.start;
   } else if (first.notBefore !== null) {
     start = first.notBefore;
+    floor = start;
     head = await headOf(read, url);
   } else {
     ({ head, start } = await startBefore(read, url, reach, blockTimes));
+    floor = start;
   }
 
+  if (floor > start) floor = start;
+
+  // No later than a credit found before: the blocks are read again from it.
+  for (const credit of carried.values()) if (credit.block !== null && credit.block < floor) floor = credit.block;
+
+  // The width of the windows, and the narrowest the RPC refused, as the
+  // searches before left them: the narrowest of each.
+  const sizes = resumed.flatMap((scan) => (scan.size === undefined ? [] : [BigInt(scan.size)]));
+  const refusals = resumed.flatMap((scan) => (scan.refused === undefined ? [] : [BigInt(scan.refused)]));
+  const width = sizes.length ? minOf(sizes) : BigInt(LOG_WINDOW);
+
+  /**
+   * The given transfers' credits with `found`: those that arrived, by their
+   * credits, and those held back (`held`), with the last of their credits'
+   * blocks (`top`). One a later transfer of the queue, still without a
+   * credit, could have had the credit of instead is held back until the
+   * blocks before it are read again `CONFIRM_PASSES` times since it was
+   * found: its own may yet be found there.
+   *
+   * @param {Credit[]} found
+   * @param {boolean} seen
+   */
+  const settled = (found, seen) => {
+    const { assigned, verdicts } = settle(queue, found, rules);
+    const passes = recheck?.passes ?? 0;
+    const mine = new Set(live.map((item) => item.hash));
+    /** @type {Set<string>} */
+    const arrived = new Set();
+    /** @type {Set<string>} */
+    const held = new Set();
+    /** @type {bigint | null} */
+    let top = null;
+
+    queue.forEach((item, i) => {
+      const credit = assigned.get(item.hash);
+
+      if (!credit || !mine.has(item.hash) || verdicts.get(item.hash) !== "arrived" || !(seen || !guarded)) return;
+
+      // A later one without a credit could have had this one instead.
+      const doubt = !guarded && passes - (credit.pass ?? 0) < CONFIRM_PASSES && queue.slice(i + 1).some((later) => !assigned.has(later.hash) && pays(later, credit, rules));
+
+      if (!doubt) {
+        arrived.add(credit.hash);
+      } else {
+        held.add(item.hash);
+        if (credit.block !== null && (top === null || credit.block > top)) top = credit.block;
+      }
+    });
+
+    return { arrived, assigned, held, top, verdicts };
+  };
+  /**
+   * The credits found in this call, with the passes done before the next
+   * one to begin.
+   *
+   * @param {Credit[]} found
+   * @returns {Credit[]}
+   */
+  const mark = (found) => {
+    const pass = recheck === null ? 0 : recheck.passes + (recheck.from !== null ? 1 : 0);
+
+    return found.map((credit) => (credit.pass === undefined ? { ...credit, pass } : credit));
+  };
   // Where the credits can't be told apart, only those in the transfers'
   // windows count: once they're all over, read no further than the last.
   const last = queue[queue.length - 1].at + windowMs;
-  const { complete, covered, credits, next } = await searchLogs(read, {
+  const until = guarded && now >= last ? last : null;
+  const due = recheck !== null && (recheck.from !== null || now >= recheck.at);
+  const ahead = await searchLogs(read, {
     ...filter,
     blockTimes,
     // Once every transfer of the queue has its credit: read no further.
     enough: (found) => !guarded && settle(queue, found, rules).assigned.size === queue.length,
+    floor,
     head,
     known: [...carried.values()],
     maxWindows,
+    refused: refusals.length ? minOf(refusals) : null,
+    size: width,
     start,
-    until: guarded && now >= last ? last : null,
+    until,
     url,
   });
+  const { complete, covered, next } = ahead;
   const seen = complete || covered;
-  const { assigned, verdicts } = settle(queue, credits, rules);
-  /** @type {Set<string>} */
-  const arrived = new Set();
+  // Its window at the head reached back to where the search began: every
+  // block read before this call is read again, as by a pass.
+  const again = recheck !== null && ahead.low !== null && ahead.low <= floor && start > floor;
+
+  if (again && recheck !== null) recheck = { ...recheck, passes: recheck.passes + 1 };
+
+  let credits = mark(ahead.credits);
+  const before = settled(credits, seen);
+  let { refused, size } = ahead;
+
+  if ((seen || before.held.size) && recheck === null) recheck = { at: before.held.size ? now : now + RECHECK_MS, from: null, passes: 0, since: now, size: null };
+
+  // A transfer not arrived yet: the blocks read before this call, again, as
+  // far as the search ahead reads; while an arrival is held back, as far as
+  // its credit. With what the search ahead leaves of a call's windows, one
+  // at least.
+  if (recheck !== null && (due || before.held.size) && before.arrived.size < live.length) {
+    const from = recheck.from !== null && recheck.from > floor ? recheck.from : floor;
+    const below = ahead.low !== null && ahead.low < start ? ahead.low : start;
+    const pass = await searchLogs(read, {
+      ...filter,
+      blockTimes,
+      // Read through: a credit further on, still before those found ahead,
+      // could be a transfer's first.
+      enough: () => false,
+      floor: from,
+      head: before.top !== null && before.top < below ? before.top : below - 1n,
+      known: credits,
+      maxWindows: maxWindows < 1 ? 0 : Math.max(1, maxWindows - ahead.asked),
+      refused,
+      size,
+      start: from,
+      until,
+      url,
+    });
+    const done = pass.complete || pass.covered;
+    // A pass that read no block is none: only one that read the blocks again
+    // counts, and not twice in a call.
+    const counted = done && !again && pass.next > floor;
+
+    recheck = done ? { ...recheck, at: now + Math.max(RECHECK_MS, now - recheck.since), from: null, passes: recheck.passes + (counted ? 1 : 0) } : { ...recheck, from: pass.next };
+    credits = mark(pass.credits);
+    ({ refused, size } = pass);
+  }
 
-  for (const item of live) {
-    const credit = assigned.get(item.hash);
+  const { arrived, assigned, held, verdicts } = settled(credits, seen);
 
-    if (credit && verdicts.get(item.hash) === "arrived" && (seen || !guarded)) arrived.add(credit.hash);
-  }
+  // Passes go on one after the other while an arrival is held back; once one
+  // arrives with others still waiting, theirs begin again a minute later,
+  // the waits growing from there.
+  if (recheck !== null && held.size) recheck = { ...recheck, at: Math.min(recheck.at, now) };
+  else if (recheck !== null && arrived.size && arrived.size < live.length) recheck = { ...recheck, at: Math.min(recheck.at, now + RECHECK_MS), since: now };
 
   // The next search carries on from where this one stopped, with the
   // credits found so far: a transfer that arrived may come back from the
@@ -893,15 +1204,21 @@ async function followLogs(read, { filter, given, guarded, queue, rivals, unsure
   const scan = {
     basis: first.at,
     from: next.toString(),
+    ...(recheck ? { recheck: recheckIn(recheck) } : {}),
+    ...(refused === null ? {} : { refused: Number(refused) }),
     search,
-    seen: credits.flatMap((credit) => (credit.at >= reach && credit.block !== null ? [{ at: credit.at, block: credit.block.toString(), hash: credit.hash, sender: credit.from }] : [])),
+    seen: credits.flatMap((credit) => (credit.at >= reach && credit.block !== null ? [{ at: credit.at, block: credit.block.toString(), hash: credit.hash, pass: credit.pass ?? 0, sender: credit.from }] : [])),
+    size: Number(size),
+    start: floor.toString(),
   };
 
   for (const item of live) {
     const credit = assigned.get(item.hash);
     const verdict = verdicts.get(item.hash);
 
-    if (credit && arrived.has(credit.hash)) {
+    if (held.has(item.hash)) {
+      out.set(item.hash, { scan, state: "waiting" });
+    } else if (credit && arrived.has(credit.hash)) {
       used.add(credit.hash);
       out.set(item.hash, {
         amount: credit.wei / WEI_PER_LUX,
@@ -1238,12 +1555,25 @@ async function depositPeers(archive, net, found, { amount, bounds, calls, suppli
 }
 
 /**
- * Where a scan's search stopped, without its history.
+ * Where a scan's search stopped, with the width of its windows, without its
+ * history.
  *
  * @param {Scan | null | undefined} scan
  * @returns {Scan}
  */
-const searchOf = (scan) => (scan?.from !== undefined ? { basis: scan.basis, from: scan.from, search: scan.search, seen: scan.seen } : {});
+function searchOf(scan) {
+  if (scan?.from === undefined) return {};
+
+  /** @type {Scan} */
+  const out = { basis: scan.basis, from: scan.from, search: scan.search, seen: scan.seen };
+
+  if (scan.start !== undefined) out.start = scan.start;
+  if (scan.recheck !== undefined) out.recheck = scan.recheck;
+  if (scan.size !== undefined) out.size = scan.size;
+  if (scan.refused !== undefined) out.refused = scan.refused;
+
+  return out;
+}
 
 /**
  * The transfers whose history isn't all read yet wait, with where their
@@ -1814,6 +2144,12 @@ export async function serviceArrivals({
   }
 
   const live = triage(known, results, { now, waitMs });
+  // The block times the app keeps for a route's chain: by its chain ID, or
+  // the one cache given, where the network's service routes are all on one
+  // chain.
+  const oneChain = new Set(services.map((route) => route.chain?.chainId)).size === 1;
+  /** @param {Route} route @returns {BlockTimes | undefined} */
+  const timesOf = (route) => (typeof blockTimes === "function" ? (blockTimes(route.chain.chainId) ?? undefined) : oneChain ? blockTimes : undefined);
   // The fee of each transfer the app gave, those no longer looked for too,
   // and the block its payout can't be before.
   const feeOf = new Map(routed.map((item) => [item.hash, item.fee ?? /** @type {Route & { kind: "service" }} */ (item.route).feeLux]));
@@ -1886,7 +2222,7 @@ export async function serviceArrivals({
           queue: history.queue,
           unsure,
         },
-        { blockTimes, maxWindows, now, slackMs: CLOCK_SLACK_MS, url: String(rpcUrl ?? route.chain.rpcUrl), used, windowMs: CREDIT_WINDOW_MS }
+        { blockTimes: timesOf(route), maxWindows, now, slackMs: CLOCK_SLACK_MS, url: String(rpcUrl ?? route.chain.rpcUrl), used, windowMs: CREDIT_WINDOW_MS }
       );
 
       for (const [hash, arrival] of found) results.set(hash, withHistory(hash, arrival, given, history.states));