@fased/fased 0.1.61 → 0.1.64

package/dist/wallet/wallet-send-approvals.js

@@ -1,7 +1,11 @@
 import { __exportAll } from "../_virtual/_rolldown/runtime.js";
+import { resolveProcessScopedMap } from "../shared/process-scoped-map.js";
+import { acquireFileLock, withFileLock } from "../plugin-sdk/file-lock.js";
+import "../infra/file-lock.js";
 import { loadConfig } from "../config/io.js";
 import "../config/config.js";
 import { ensureWalletStateDir } from "./wallet-runtime-config.js";
+import { readWalletProviderRegistry } from "./wallet-provider-registry.js";
 import { tryResolveSatRuntimeIds } from "../config/sat-runtime-ids.js";
 import { applyWalletPolicyConfig, enforceWalletDailyCap, resolveWalletRoleForId } from "./wallet-policy.js";
 import { buildWalletProviderCapabilityMatrix, providerSupportsChainOperation } from "./wallet-provider-capabilities.js";
@@ -10,25 +14,31 @@ import { walletDiagnosticErrorMessage, walletDiagnosticErrorString } from "./wal
 import { createWalletProviderAdapter, resolveWalletProviderId } from "./wallet-provider-resolver.js";
 import { publishFederationSettlementEvidence } from "../federation/settlement-evidence.js";
 import { executeSolanaSwapApprovalPayload, isSolanaSwapApprovalPayload } from "./solana-swap.js";
-import { consumeWalletApprovalGrant, resolveWalletApprovalAuthMode } from "./wallet-approval-auth.js";
 import { appendWalletAuditEntry } from "./wallet-audit-log.js";
-import { enforceWalletCustodyForAutonomousSend, withWalletCustodySigningMaterial } from "./wallet-custody.js";
 import { simulateWalletPolicy } from "./wallet-policy-simulation.js";
+import { beginWalletSendExecution, claimWalletSendExecution, getWalletSendExecution, updateWalletSendExecution, walletSendIntentDigest, walletSendRequestId } from "./wallet-send-execution-ledger.js";
 import { getWalletSettlementLinkByRequestId, markWalletSettlementLinkOutcome, upsertWalletSettlementLink } from "./wallet-settlement-links.js";
 import { syncWalletApprovalTask, walletApprovalTaskId } from "./wallet-task-ledger.js";
-import fs from "node:fs";
-import { randomBytes } from "node:crypto";
-import { setTimeout } from "node:timers/promises";
+import syncFs from "node:fs";
+import path from "node:path";
+import { createHash, randomBytes } from "node:crypto";
 
 //#region src/wallet/wallet-send-approvals.ts
 var wallet_send_approvals_exports = /* @__PURE__ */ __exportAll({
 	approveWalletSendRequest: () => approveWalletSendRequest,
+	bindSignerReviewToWalletApprovalPayload: () => bindSignerReviewToWalletApprovalPayload,
 	createOrExecuteWalletSend: () => createOrExecuteWalletSend,
+	createSignerReviewApprovalRequest: () => createSignerReviewApprovalRequest,
 	createWalletSendApprovalRequest: () => createWalletSendApprovalRequest,
+	getWalletSendApprovalRequest: () => getWalletSendApprovalRequest,
 	listWalletSendApprovalRequests: () => listWalletSendApprovalRequests,
+	markWalletSendRequestBroadcastUnknown: () => markWalletSendRequestBroadcastUnknown,
+	markWalletSendRequestExecutedExternally: () => markWalletSendRequestExecutedExternally,
 	rejectWalletSendRequest: () => rejectWalletSendRequest,
 	sanitizeWalletSendApprovalPayload: () => sanitizeWalletSendApprovalPayload,
-	sanitizeWalletSendApprovalRequest: () => sanitizeWalletSendApprovalRequest
+	sanitizeWalletSendApprovalRequest: () => sanitizeWalletSendApprovalRequest,
+	signerReviewBindingMatchesWalletApprovalPayload: () => signerReviewBindingMatchesWalletApprovalPayload,
+	signerReviewMatchesWalletApprovalPayload: () => signerReviewMatchesWalletApprovalPayload
 });
 function sanitizeWalletSendApprovalPayload(payload) {
 	const { serializedTxBase64, ...rest } = payload;
@@ -37,6 +47,63 @@ function sanitizeWalletSendApprovalPayload(payload) {
 		...serializedTxBase64 ? { hasSerializedTx: true } : {}
 	};
 }
+function sameSignerPrograms(left, right) {
+	return Boolean(left) && left?.length === right.length && left.every((value, index) => value === right[index]);
+}
+function sameOptionalSignerValue(left, right) {
+	return (left?.trim() || undefined) === (right?.trim() || undefined);
+}
+function sameSignerSemanticIntent(left, right) {
+	if (!left) {
+		return false;
+	}
+	try {
+		return canonicalApprovalJson(left) === canonicalApprovalJson(right);
+	} catch {
+		return false;
+	}
+}
+function cloneSignerSemanticIntent(intent) {
+	return JSON.parse(canonicalApprovalJson(intent));
+}
+function signerReviewMatchesWalletApprovalPayload(review, payload) {
+	return review.requestId === payload.signerReviewId?.trim() && review.walletId === payload.signerWalletId?.trim() && sameOptionalSignerValue(review.walletPublicKey, payload.signerWalletPublicKey) && review.intentType === payload.signerIntentType?.trim() && review.policyHash === payload.signerPolicyHash?.trim() && review.intentDigest === payload.signerIntentDigest?.trim() && sameSignerSemanticIntent(payload.signerSemanticIntent, review.semanticIntent) && review.artifactKind === payload.signerArtifactKind && review.artifactDigest === payload.signerArtifactDigest?.trim() && sameOptionalSignerValue(review.transactionDigest, payload.signerTransactionDigest) && sameOptionalSignerValue(review.stateDigest, payload.signerStateDigest) && (review.stateSlot ?? undefined) === payload.signerStateSlot && review.asset === payload.signerAsset?.trim() && review.amount === payload.signerAmount?.trim() && review.destination === payload.signerDestination?.trim() && review.policyOperation === payload.signerPolicyOperation?.trim() && sameSignerPrograms(payload.signerRequiredPrograms, review.requiredPrograms) && (!review.requiredRole || review.requiredRole === payload.signerRequiredRole) && review.nonce === payload.signerNonce?.trim() && review.issuedAt === payload.signerIssuedAt?.trim() && review.expiresAt === payload.signerReviewExpiresAt?.trim();
+}
+function signerReviewBindingMatchesWalletApprovalPayload(binding, payload) {
+	return binding.requestId === payload.signerReviewId?.trim() && binding.walletId === payload.signerWalletId?.trim() && sameOptionalSignerValue(binding.walletPublicKey, payload.signerWalletPublicKey) && binding.role === payload.signerRequiredRole && binding.intentType === payload.signerIntentType?.trim() && binding.policyHash === payload.signerPolicyHash?.trim() && binding.intentDigest === payload.signerIntentDigest?.trim() && sameSignerSemanticIntent(payload.signerSemanticIntent, binding.semanticIntent) && binding.artifactKind === payload.signerArtifactKind && binding.artifactDigest === payload.signerArtifactDigest?.trim() && sameOptionalSignerValue(binding.transactionDigest, payload.signerTransactionDigest) && sameOptionalSignerValue(binding.stateDigest, payload.signerStateDigest) && (binding.stateSlot ?? undefined) === payload.signerStateSlot && binding.asset === payload.signerAsset?.trim() && binding.amount === payload.signerAmount?.trim() && binding.destination === payload.signerDestination?.trim() && binding.policyOperation === payload.signerPolicyOperation?.trim() && sameSignerPrograms(payload.signerRequiredPrograms, binding.requiredPrograms) && binding.nonce === payload.signerNonce?.trim() && binding.issuedAt === payload.signerIssuedAt?.trim() && binding.expiresAt === payload.signerReviewExpiresAt?.trim();
+}
+function bindSignerReviewToWalletApprovalPayload(params) {
+	const { review, role } = params;
+	if (review.mode !== "reviewed" || review.state !== "prepared" || !review.requestId.trim() || !review.walletId.trim() || !review.requiredPrograms.length || review.requiredRole && review.requiredRole !== role) {
+		throw new Error("signer review is not a valid pending reviewed operation");
+	}
+	return {
+		...params.payload,
+		providerId: "local-socket-signer",
+		walletId: params.payload.walletId || review.walletId,
+		signerReviewId: review.requestId,
+		signerWalletId: review.walletId,
+		signerWalletPublicKey: review.walletPublicKey,
+		signerIntentType: review.intentType,
+		signerPolicyHash: review.policyHash,
+		signerIntentDigest: review.intentDigest,
+		signerSemanticIntent: cloneSignerSemanticIntent(review.semanticIntent),
+		signerArtifactKind: review.artifactKind,
+		signerArtifactDigest: review.artifactDigest,
+		signerTransactionDigest: review.transactionDigest,
+		signerStateDigest: review.stateDigest,
+		signerStateSlot: review.stateSlot,
+		signerAsset: review.asset,
+		signerAmount: review.amount,
+		signerDestination: review.destination,
+		signerPolicyOperation: review.policyOperation,
+		signerRequiredPrograms: [...review.requiredPrograms],
+		signerRequiredRole: role,
+		signerNonce: review.nonce,
+		signerIssuedAt: review.issuedAt,
+		signerReviewExpiresAt: review.expiresAt
+	};
+}
 function sanitizeWalletSendApprovalRequest(request) {
 	return {
 		...request,
@@ -44,8 +111,28 @@ function sanitizeWalletSendApprovalRequest(request) {
 	};
 }
 const DEFAULT_TTL_SECONDS = 15 * 60;
-const DEFAULT_SEND_RETRY_ATTEMPTS = 3;
-const DEFAULT_SEND_RETRY_DELAY_MS = 750;
+const APPROVAL_LOCK_OPTIONS = {
+	retries: {
+		retries: 100,
+		factor: 1.15,
+		minTimeout: 10,
+		maxTimeout: 200,
+		randomize: true
+	},
+	stale: 3e4
+};
+const APPROVAL_MUTATION_QUEUES = resolveProcessScopedMap(Symbol.for("fased.wallet.sendApprovals.mutationQueues"));
+const APPROVAL_ACTIVE_EXECUTIONS = resolveProcessScopedMap(Symbol.for("fased.wallet.sendApprovals.activeExecutions"));
+const APPROVAL_EXECUTION_LOCK_OPTIONS = {
+	retries: {
+		retries: 1,
+		factor: 1,
+		minTimeout: 10,
+		maxTimeout: 10,
+		randomize: false
+	},
+	stale: 3e4
+};
 function isReviewedMiningNativeSolanaSend(params) {
 	if (params.payload.chain !== "solana" || String(params.payload.program ?? "").trim()) {
 		return false;
@@ -60,23 +147,144 @@ function isReviewedMiningNativeSolanaSend(params) {
 		env: params.env
 	}) === "mining";
 }
-function isSatMiningTokenSweep(params) {
+function isRecord(value) {
+	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function parseUnsignedInteger(value) {
+	const text = typeof value === "string" ? value.trim() : "";
+	if (!/^\d+$/u.test(text)) {
+		return null;
+	}
+	try {
+		return BigInt(text);
+	} catch {
+		return null;
+	}
+}
+function resolveConfiguredSatSweepDestination(params) {
+	const rawConfig = params.cfg.plugins?.entries?.["sat-mining"]?.config;
+	if (!isRecord(rawConfig) || !isRecord(rawConfig.automation)) {
+		return null;
+	}
+	const rawSweep = rawConfig.automation.satSweep;
+	if (!isRecord(rawSweep) || rawSweep.enabled !== true) {
+		return null;
+	}
+	const explicitAddress = typeof rawSweep.destinationAddress === "string" ? rawSweep.destinationAddress.trim() : "";
+	const registry = readWalletProviderRegistry(params.env);
+	const source = registry.wallets.find((wallet) => wallet.id === params.walletId);
+	if (explicitAddress) {
+		return explicitAddress !== source?.addresses?.solana?.trim() ? explicitAddress : null;
+	}
+	const destinationWalletId = typeof rawSweep.destinationWalletId === "string" ? rawSweep.destinationWalletId.trim() : "";
+	if (!destinationWalletId || destinationWalletId === params.walletId) {
+		return null;
+	}
+	return registry.wallets.find((wallet) => wallet.id === destinationWalletId)?.addresses?.solana?.trim() || null;
+}
+function validateSatMiningTokenSweep(params) {
 	if (params.payload.chain !== "solana") {
-		return false;
+		return {
+			ok: false,
+			message: "SAT sweep must be a typed Solana transfer"
+		};
+	}
+	if (params.payload.actionKind && params.payload.actionKind !== "send") {
+		return {
+			ok: false,
+			message: "SAT sweep cannot use a generic signing action"
+		};
+	}
+	if (params.payload.contract?.trim()) {
+		return {
+			ok: false,
+			message: "SAT sweep cannot include a contract override"
+		};
+	}
+	const walletId = params.walletId?.trim() || "";
+	if (!walletId || resolveWalletRoleForId({
+		walletId,
+		cfg: params.cfg,
+		env: params.env
+	}) !== "mining") {
+		return {
+			ok: false,
+			message: "SAT sweep requires the configured Mining wallet"
+		};
+	}
+	if (params.sendPath !== "automation" || String(params.requestedBy ?? "").trim() !== "sat-mining:auto-sweep") {
+		return {
+			ok: false,
+			message: "Mining wallet automation is limited to the SAT sweep worker"
+		};
+	}
+	const authorization = params.authorization;
+	if (!authorization || authorization.kind !== "sat-auto-sweep-v1") {
+		return {
+			ok: false,
+			message: "SAT sweep requires an exact typed sweep authorization"
+		};
+	}
+	const occurrenceId = authorization.occurrenceId.trim();
+	const expectedExecutionIntentId = `sat-auto-sweep:${walletId}:${occurrenceId}`;
+	if (!occurrenceId || params.executionIntentId?.trim() !== expectedExecutionIntentId || authorization.walletId.trim() !== walletId) {
+		return {
+			ok: false,
+			message: "SAT sweep occurrence identity does not match the Mining wallet"
+		};
 	}
 	const ids = tryResolveSatRuntimeIds(params.env);
+	const rawConfig = params.cfg.plugins?.entries?.["sat-mining"]?.config;
+	const rawTokenConfig = isRecord(rawConfig) && isRecord(rawConfig.tokenConfig) ? rawConfig.tokenConfig : null;
+	const configuredMint = (rawTokenConfig && typeof rawTokenConfig.mintAddress === "string" ? rawTokenConfig.mintAddress.trim() : "") || ids?.mintAddress || "";
 	const program = String(params.payload.program ?? "").trim();
-	if (!program || !ids?.mintAddress || program !== ids.mintAddress) {
-		return false;
-	}
-	if (params.sendPath !== "automation" || String(params.requestedBy ?? "").trim() !== "sat-mining") {
-		return false;
+	if (!program || !configuredMint || program !== configuredMint || authorization.mint.trim() !== configuredMint) {
+		return {
+			ok: false,
+			message: "Mining wallet automation can transfer only the configured SAT mint"
+		};
 	}
-	return resolveWalletRoleForId({
-		walletId: params.walletId,
+	const destination = resolveConfiguredSatSweepDestination({
 		cfg: params.cfg,
+		walletId,
 		env: params.env
-	}) === "mining";
+	});
+	if (!destination || params.payload.to?.trim() !== destination || authorization.destination.trim() !== destination) {
+		return {
+			ok: false,
+			message: "SAT sweep destination does not match the configured destination"
+		};
+	}
+	const sourceBalance = parseUnsignedInteger(authorization.sourceBalanceRaw);
+	const keepRaw = parseUnsignedInteger(authorization.keepRaw);
+	const minRaw = parseUnsignedInteger(authorization.minRaw);
+	const amountRaw = parseUnsignedInteger(authorization.amountRaw);
+	if (sourceBalance === null || keepRaw === null || minRaw === null || amountRaw === null || !Number.isFinite(authorization.percentage)) {
+		return {
+			ok: false,
+			message: "SAT sweep authorization contains invalid raw amounts"
+		};
+	}
+	const rawSweep = isRecord(rawConfig) && isRecord(rawConfig.automation) && isRecord(rawConfig.automation.satSweep) ? rawConfig.automation.satSweep : null;
+	const configuredMode = rawSweep?.mode === "percentage" ? "percentage" : "all";
+	const configuredPercentage = typeof rawSweep?.percentage === "number" && Number.isFinite(rawSweep.percentage) ? Math.max(0, Math.min(100, rawSweep.percentage)) : 100;
+	const configuredKeep = parseUnsignedInteger(typeof rawSweep?.keepRaw === "string" && rawSweep.keepRaw.trim() ? rawSweep.keepRaw : "0");
+	const configuredMin = parseUnsignedInteger(typeof rawSweep?.minRaw === "string" && rawSweep.minRaw.trim() ? rawSweep.minRaw : "1");
+	if (authorization.mode !== configuredMode || authorization.percentage !== configuredPercentage || keepRaw !== configuredKeep || minRaw !== configuredMin) {
+		return {
+			ok: false,
+			message: "SAT sweep authorization does not match the active sweep policy"
+		};
+	}
+	const spendable = sourceBalance > keepRaw ? sourceBalance - keepRaw : 0n;
+	const expectedAmount = configuredMode === "percentage" ? spendable * BigInt(Math.round(configuredPercentage * 1e4)) / 1000000n : spendable;
+	if (expectedAmount <= 0n || expectedAmount < minRaw || amountRaw !== expectedAmount || params.payload.amount?.trim() !== expectedAmount.toString()) {
+		return {
+			ok: false,
+			message: "SAT sweep amount does not match the exact computed occurrence"
+		};
+	}
+	return { ok: true };
 }
 function upsertSettlementLinkForPayload(params) {
 	if (!params.settlementContext?.taskId) {
@@ -214,11 +422,13 @@ function resolveSendProviderForPayload(params) {
 		};
 	}
 	const matrix = buildWalletProviderCapabilityMatrix(provider);
-	if (!providerSupportsChainOperation({
+	const supportsServerSend = providerSupportsChainOperation({
 		matrix,
 		chain: params.payload.chain,
 		operation: "send"
-	})) {
+	});
+	const supportsInteractiveBrowser = params.allowInteractiveBrowser === true && matrix.signing.interactiveSend;
+	if (!supportsServerSend && !supportsInteractiveBrowser) {
 		return {
 			ok: false,
 			code: "wallet_provider_unsupported_chain",
@@ -244,27 +454,6 @@ function resolveTtlMs(env = process.env) {
 	}
 	return Math.min(24 * 60 * 60 * 1e3, raw * 1e3);
 }
-function resolveSendRetryAttempts(env = process.env) {
-	const raw = Number.parseInt(String(env.FASED_WALLET_SEND_RETRY_ATTEMPTS ?? ""), 10);
-	if (!Number.isFinite(raw) || raw < 1) {
-		return DEFAULT_SEND_RETRY_ATTEMPTS;
-	}
-	return Math.min(6, raw);
-}
-function resolveSendRetryDelayMs(env = process.env) {
-	const raw = Number.parseInt(String(env.FASED_WALLET_SEND_RETRY_DELAY_MS ?? ""), 10);
-	if (!Number.isFinite(raw) || raw < 0) {
-		return DEFAULT_SEND_RETRY_DELAY_MS;
-	}
-	return Math.min(15e3, raw);
-}
-function isRetryableSendError(error) {
-	if (error instanceof WalletProviderError) {
-		return error.retryable;
-	}
-	const message = String(error).toLowerCase();
-	return message.includes("timeout") || message.includes("timed out") || message.includes("network") || message.includes("econnreset") || message.includes("econnrefused") || message.includes("429") || message.includes("rate limit") || message.includes("503") || message.includes("504");
-}
 function normalizeErrorMessage(error) {
 	return walletDiagnosticErrorMessage(error);
 }
@@ -280,71 +469,395 @@ function withSendAttemptMetadata(value, attempts) {
 		}
 	};
 }
-async function executeWalletSendWithRetry(params) {
-	const env = params.env ?? process.env;
-	const maxAttempts = resolveSendRetryAttempts(env);
-	const baseDelayMs = resolveSendRetryDelayMs(env);
-	let attempts = 0;
-	while (attempts < maxAttempts) {
-		attempts += 1;
-		try {
-			const tx = await params.execute();
-			return {
+async function executeWalletSendOnce(params) {
+	try {
+		const tx = await params.execute();
+		return {
+			ok: true,
+			tx,
+			attempts: 1
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			error,
+			attempts: 1
+		};
+	}
+}
+async function prepareAndSendProviderTransaction(params) {
+	const payload = {
+		...params.payload,
+		requestId: params.requestId
+	};
+	if (params.provider.id !== "turnkey") {
+		return await params.provider.sendTx(payload);
+	}
+	if (!params.provider.prepareTx) {
+		throw new Error("turnkey provider does not expose transaction preparation");
+	}
+	const prepared = await params.provider.prepareTx(payload);
+	return await params.provider.sendTx({
+		...payload,
+		preparedId: prepared.preparedId
+	});
+}
+function autonomousResultFromExecution(params) {
+	if (params.entry.state === "executed" && params.entry.result) {
+		return {
+			ok: true,
+			mode: "autonomous",
+			tx: {
 				ok: true,
-				tx,
-				attempts
+				...params.entry.result
+			},
+			payload: params.payload,
+			requestId: params.entry.requestId
+		};
+	}
+	if (params.entry.state === "unknown" || params.entry.state === "executing") {
+		return {
+			ok: false,
+			code: params.entry.state === "unknown" ? "wallet_provider_ambiguous" : "wallet_send_in_progress",
+			message: params.entry.reason ?? (params.entry.state === "unknown" ? "wallet send result is unknown; reconcile the original signer request before retrying" : "wallet send is already executing; wait for its durable result"),
+			requestId: params.entry.requestId
+		};
+	}
+	if (params.entry.state === "failed") {
+		return {
+			ok: false,
+			code: "send_failed",
+			message: params.entry.reason ?? "wallet send failed",
+			requestId: params.entry.requestId
+		};
+	}
+	return null;
+}
+async function reconcileTypedWalletSend(params) {
+	if (!params.provider.getSignerOperation) {
+		return {
+			state: "unknown",
+			reason: "wallet provider cannot reconcile the original send request"
+		};
+	}
+	try {
+		let operation = await params.provider.getSignerOperation({
+			walletId: params.walletId,
+			requestId: params.requestId
+		});
+		if ((operation.state === "broadcast" || operation.state === "unknown") && params.provider.reconcileSignerOperation) {
+			operation = await params.provider.reconcileSignerOperation({
+				walletId: params.walletId,
+				requestId: params.requestId
+			});
+		}
+		if (operation.state === "confirmed" && operation.signature) {
+			return {
+				state: "confirmed",
+				signature: operation.signature,
+				metadata: {
+					provider: params.provider.id,
+					requestId: operation.requestId,
+					intentDigest: operation.intentDigest,
+					transactionDigest: operation.transactionDigest,
+					policyHash: operation.policyHash,
+					operationState: operation.state,
+					reconciled: true
+				}
+			};
+		}
+		if (operation.state === "failed") {
+			return {
+				state: "failed",
+				reason: operation.error?.trim() || "signer operation failed before confirmation"
 			};
-		} catch (error) {
-			const shouldRetry = isRetryableSendError(error) && attempts < maxAttempts;
-			if (!shouldRetry) {
-				return {
-					ok: false,
-					error,
-					attempts
-				};
-			}
-			if (baseDelayMs > 0) {
-				await setTimeout(baseDelayMs * attempts);
-			}
 		}
+		return {
+			state: "unknown",
+			signature: operation.signature,
+			reason: `signer operation ${operation.requestId} is ${operation.state}; no new broadcast is allowed`
+		};
+	} catch (error) {
+		const message = normalizeErrorMessage(error);
+		if (/signer operation not found/iu.test(message)) {
+			return { state: "not_found" };
+		}
+		return {
+			state: "unknown",
+			reason: `could not reconcile the original signer request: ${message}`
+		};
 	}
-	return {
-		ok: false,
-		error: new Error("wallet send failed after retry attempts"),
-		attempts: maxAttempts
-	};
 }
 function loadFile(env = process.env) {
 	const paths = ensureWalletStateDir(env);
-	if (!fs.existsSync(paths.sendApprovalsPath)) {
+	if (!syncFs.existsSync(paths.sendApprovalsPath)) {
 		return {
 			version: 1,
 			requests: []
 		};
 	}
 	try {
-		const parsed = JSON.parse(fs.readFileSync(paths.sendApprovalsPath, "utf8"));
+		const parsed = JSON.parse(syncFs.readFileSync(paths.sendApprovalsPath, "utf8"));
 		if (parsed?.version === 1 && Array.isArray(parsed.requests)) {
 			return {
 				version: 1,
 				requests: parsed.requests
 			};
 		}
-	} catch {}
-	return {
-		version: 1,
-		requests: []
-	};
+	} catch (error) {
+		throw new Error("wallet approval state is unreadable; refusing to reset persisted requests", { cause: error });
+	}
+	throw new Error("wallet approval state has an unsupported shape; refusing to reset persisted requests");
 }
 function saveFile(file, env = process.env) {
 	const paths = ensureWalletStateDir(env);
-	fs.writeFileSync(paths.sendApprovalsPath, `${JSON.stringify(file, null, 2)}\n`, {
-		encoding: "utf8",
-		mode: 384
+	const serialized = `${JSON.stringify(file, null, 2)}\n`;
+	const tempPath = path.join(path.dirname(paths.sendApprovalsPath), `.${path.basename(paths.sendApprovalsPath)}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`);
+	let tempFd;
+	let renamed = false;
+	try {
+		tempFd = syncFs.openSync(tempPath, "wx", 384);
+		syncFs.writeFileSync(tempFd, serialized, { encoding: "utf8" });
+		syncFs.fsyncSync(tempFd);
+		syncFs.closeSync(tempFd);
+		tempFd = undefined;
+		syncFs.renameSync(tempPath, paths.sendApprovalsPath);
+		renamed = true;
+		const directoryFd = syncFs.openSync(path.dirname(paths.sendApprovalsPath), "r");
+		try {
+			syncFs.fsyncSync(directoryFd);
+		} finally {
+			syncFs.closeSync(directoryFd);
+		}
+	} catch (error) {
+		if (tempFd !== undefined) {
+			try {
+				syncFs.closeSync(tempFd);
+			} catch {}
+		}
+		if (!renamed) {
+			try {
+				syncFs.unlinkSync(tempPath);
+			} catch {}
+		}
+		throw error;
+	}
+}
+function canonicalApprovalJson(value) {
+	if (value === null || typeof value === "string" || typeof value === "boolean") {
+		return JSON.stringify(value);
+	}
+	if (typeof value === "number") {
+		if (!Number.isFinite(value)) {
+			throw new Error("wallet approval contains a non-finite number");
+		}
+		return JSON.stringify(value);
+	}
+	if (Array.isArray(value)) {
+		return `[${value.map((entry) => canonicalApprovalJson(entry)).join(",")}]`;
+	}
+	if (value && typeof value === "object") {
+		const record = value;
+		return `{${Object.keys(record).filter((key) => record[key] !== undefined).toSorted().map((key) => `${JSON.stringify(key)}:${canonicalApprovalJson(record[key])}`).join(",")}}`;
+	}
+	throw new Error("wallet approval contains an unsupported value");
+}
+function walletApprovalRequestDigest(request) {
+	return `sha256:${createHash("sha256").update(canonicalApprovalJson({
+		id: request.id,
+		createdAt: request.createdAt,
+		expiresAt: request.expiresAt,
+		requestedBy: request.requestedBy,
+		payload: request.payload
+	})).digest("hex")}`;
+}
+function approvalRequestDigest(request) {
+	const computed = walletApprovalRequestDigest(request);
+	if (request.requestDigest && request.requestDigest !== computed) {
+		throw new Error(`wallet approval ${request.id} immutable request digest does not match its persisted payload`);
+	}
+	return computed;
+}
+function reserveWalletApprovalIdentity(request, env) {
+	const identityDir = path.join(path.dirname(ensureWalletStateDir(env).sendApprovalsPath), ".wallet-approval-identities");
+	syncFs.mkdirSync(identityDir, {
+		recursive: true,
+		mode: 448
 	});
+	const identityPath = path.join(identityDir, `${createHash("sha256").update(request.id).digest("hex")}.json`);
+	const payload = `${JSON.stringify({
+		version: 1,
+		requestId: request.id,
+		requestDigest: approvalRequestDigest(request)
+	})}\n`;
+	let descriptor;
 	try {
-		fs.chmodSync(paths.sendApprovalsPath, 384);
-	} catch {}
+		descriptor = syncFs.openSync(identityPath, "wx", 384);
+		syncFs.writeFileSync(descriptor, payload, "utf8");
+		syncFs.fsyncSync(descriptor);
+		syncFs.closeSync(descriptor);
+		descriptor = undefined;
+	} catch (error) {
+		if (descriptor !== undefined) {
+			syncFs.closeSync(descriptor);
+		}
+		if (error.code === "EEXIST") {
+			let existingDigest;
+			try {
+				const existing = JSON.parse(syncFs.readFileSync(identityPath, "utf8"));
+				existingDigest = typeof existing.requestDigest === "string" ? existing.requestDigest : undefined;
+			} catch {}
+			throw new Error(existingDigest === request.requestDigest ? "wallet approval request ID already exists" : "wallet approval request ID collides with a different immutable request", { cause: error });
+		}
+		throw error;
+	}
+	return () => {
+		try {
+			syncFs.unlinkSync(identityPath);
+		} catch {}
+	};
+}
+async function withApprovalMutationLock(env, task) {
+	const filePath = ensureWalletStateDir(env).sendApprovalsPath;
+	const previous = APPROVAL_MUTATION_QUEUES.get(filePath) ?? Promise.resolve();
+	let releaseQueue;
+	const turn = new Promise((resolve) => {
+		releaseQueue = resolve;
+	});
+	const queued = previous.then(() => turn, () => turn);
+	APPROVAL_MUTATION_QUEUES.set(filePath, queued);
+	await previous.catch(() => undefined);
+	try {
+		return await withFileLock(filePath, APPROVAL_LOCK_OPTIONS, async () => await task());
+	} finally {
+		releaseQueue();
+		if (APPROVAL_MUTATION_QUEUES.get(filePath) === queued) {
+			APPROVAL_MUTATION_QUEUES.delete(filePath);
+		}
+	}
+}
+async function claimWalletApprovalProcessExecution(params) {
+	const requestId = params.requestId.trim();
+	const approvalsPath = ensureWalletStateDir(params.env).sendApprovalsPath;
+	const executionKey = `${approvalsPath}\0${requestId}`;
+	if (APPROVAL_ACTIVE_EXECUTIONS.has(executionKey)) {
+		throw new Error("wallet approval execution is already in progress");
+	}
+	APPROVAL_ACTIVE_EXECUTIONS.set(executionKey, true);
+	const target = path.join(path.dirname(approvalsPath), ".wallet-approval-executions", createHash("sha256").update(requestId).digest("hex"));
+	let lock;
+	try {
+		lock = await acquireFileLock(target, APPROVAL_EXECUTION_LOCK_OPTIONS);
+	} catch (error) {
+		APPROVAL_ACTIVE_EXECUTIONS.delete(executionKey);
+		throw new Error("wallet approval execution is already in progress", { cause: error });
+	}
+	let released = false;
+	return async () => {
+		if (released) {
+			return;
+		}
+		released = true;
+		APPROVAL_ACTIVE_EXECUTIONS.delete(executionKey);
+		await lock.release();
+	};
+}
+async function claimWalletSendApprovalExecution(params) {
+	let release;
+	try {
+		release = await claimWalletApprovalProcessExecution({
+			requestId: params.requestId,
+			env: params.env
+		});
+	} catch (error) {
+		return {
+			ok: false,
+			code: "execution_in_progress_or_unknown",
+			message: normalizeErrorMessage(error)
+		};
+	}
+	const result = await withApprovalMutationLock(params.env, () => {
+		const file = loadFile(params.env);
+		const request = findRequest(file, params.requestId);
+		if (!request) {
+			return {
+				ok: false,
+				code: "not_found",
+				message: "approval request not found"
+			};
+		}
+		let requestDigest;
+		try {
+			requestDigest = approvalRequestDigest(request);
+		} catch (error) {
+			return {
+				ok: false,
+				request,
+				code: "immutable_request_mismatch",
+				message: normalizeErrorMessage(error)
+			};
+		}
+		const recovery = request.status === "executing" || request.status === "unknown";
+		const claimable = request.status === "pending" || recovery || params.allowExpiredSignerReview === true && request.status === "expired";
+		if (!claimable) {
+			return {
+				ok: false,
+				request,
+				code: request.status === "executing" || request.status === "unknown" ? "execution_in_progress_or_unknown" : "invalid_state",
+				message: request.status === "executing" || request.status === "unknown" ? `approval request is ${request.status}; reconcile its durable execution before any retry` : `approval request is ${request.status}`
+			};
+		}
+		request.requestDigest = requestDigest;
+		if (!recovery) {
+			request.status = "executing";
+			request.execution = {
+				id: randomBytes(24).toString("base64url"),
+				requestDigest,
+				startedAt: new Date().toISOString()
+			};
+		}
+		request.approvedBy = params.actor?.trim() || "operator";
+		request.decisionAt = request.decisionAt ?? new Date().toISOString();
+		saveFile(file, params.env);
+		return {
+			ok: true,
+			file,
+			request,
+			recovered: recovery
+		};
+	});
+	if (!result.ok) {
+		await release();
+		return result;
+	}
+	return {
+		...result,
+		release
+	};
+}
+function hasSignerOwnedReviewMetadata(payload) {
+	const hasSignerField = Object.entries(payload).some(([key, value]) => key.startsWith("signer") && value !== undefined && value !== null && (!Array.isArray(value) || value.length > 0) && (typeof value !== "string" || Boolean(value.trim())));
+	return hasSignerField || payload.providerId === "local-socket-signer" && (payload.actionKind === "solana_swap" || payload.actionKind === "signer_review");
+}
+function hasExactSignerOwnedReviewBinding(request) {
+	const payload = request.payload;
+	const reviewExpiresAt = payload.signerReviewExpiresAt?.trim();
+	const transactionArtifactHasDigest = payload.signerArtifactKind !== "solana-transaction" || Boolean(payload.signerTransactionDigest?.trim());
+	return payload.providerId === "local-socket-signer" && Boolean(payload.signerReviewId?.trim()) && Boolean(payload.signerWalletId?.trim()) && Boolean(payload.signerIntentType?.trim()) && Boolean(payload.signerPolicyHash?.trim()) && Boolean(payload.signerIntentDigest?.trim()) && payload.signerSemanticIntent !== undefined && Boolean(payload.signerArtifactKind) && Boolean(payload.signerArtifactDigest?.trim()) && transactionArtifactHasDigest && Boolean(payload.signerAsset?.trim()) && Boolean(payload.signerAmount?.trim()) && Boolean(payload.signerDestination?.trim()) && Boolean(payload.signerPolicyOperation?.trim()) && Boolean(payload.signerRequiredPrograms?.length) && payload.signerRequiredPrograms?.every((program) => Boolean(program.trim())) === true && Boolean(payload.signerRequiredRole) && Boolean(payload.signerNonce?.trim()) && Boolean(payload.signerIssuedAt?.trim()) && Boolean(reviewExpiresAt) && request.expiresAt === reviewExpiresAt;
+}
+function isWalletSendApprovalExpired(request, now = nowMs()) {
+	const expiresAt = Date.parse(request.expiresAt);
+	return Number.isFinite(expiresAt) && expiresAt <= now;
+}
+function expireWalletSendApprovalRequest(params) {
+	const now = params.now ?? nowMs();
+	params.request.status = "expired";
+	params.request.decisionAt = new Date(now).toISOString();
+	params.request.reason = "expired";
+	syncApprovalTaskForRequest({
+		request: params.request,
+		...params.settlementLink ? { settlementLink: params.settlementLink } : {}
+	});
 }
 function markExpired(file) {
 	const now = nowMs();
@@ -353,12 +866,14 @@ function markExpired(file) {
 		if (request.status !== "pending") {
 			continue;
 		}
-		const exp = Date.parse(request.expiresAt);
-		if (Number.isFinite(exp) && exp <= now) {
-			request.status = "expired";
-			request.decisionAt = new Date(now).toISOString();
-			request.reason = "expired";
-			syncApprovalTaskForRequest({ request });
+		if (hasExactSignerOwnedReviewBinding(request)) {
+			continue;
+		}
+		if (isWalletSendApprovalExpired(request, now)) {
+			expireWalletSendApprovalRequest({
+				request,
+				now
+			});
 			changed = true;
 		}
 	}
@@ -369,20 +884,40 @@ function createWalletSendApprovalRequest(params) {
 	const file = loadFile(env);
 	const changed = markExpired(file);
 	const createdAtMs = nowMs();
-	const requestId = createRequestId();
+	const requestId = params.requestId?.trim() || createRequestId();
+	const requestedExpiresAt = params.expiresAt?.trim();
+	const requestedExpiresAtMs = requestedExpiresAt ? Date.parse(requestedExpiresAt) : Number.NaN;
+	if (requestedExpiresAt && (!Number.isFinite(requestedExpiresAtMs) || requestedExpiresAtMs <= createdAtMs)) {
+		throw new Error("approval expiration must be a future timestamp");
+	}
 	const req = {
 		id: requestId,
 		taskLedgerId: walletApprovalTaskId(requestId),
 		createdAt: new Date(createdAtMs).toISOString(),
-		expiresAt: new Date(createdAtMs + resolveTtlMs(env)).toISOString(),
+		expiresAt: requestedExpiresAt || new Date(createdAtMs + resolveTtlMs(env)).toISOString(),
 		status: "pending",
 		requestedBy: params.requestedBy?.trim() || "agent",
 		payload: params.payload,
 		...params.simulation ? { simulation: params.simulation } : {},
 		...params.approvalDiff ? { approvalDiff: params.approvalDiff } : {}
 	};
+	if (hasSignerOwnedReviewMetadata(req.payload) && !hasExactSignerOwnedReviewBinding(req)) {
+		throw new Error("signer-reviewed approval requires a complete exact signer review binding");
+	}
+	req.requestDigest = walletApprovalRequestDigest(req);
+	const collision = findRequest(file, requestId);
+	if (collision) {
+		const collisionDigest = approvalRequestDigest(collision);
+		throw new Error(collisionDigest === req.requestDigest ? "wallet approval request ID already exists" : "wallet approval request ID collides with a different immutable request");
+	}
+	const releaseIdentityReservation = reserveWalletApprovalIdentity(req, env);
 	file.requests.push(req);
-	saveFile(file, env);
+	try {
+		saveFile(file, env);
+	} catch (error) {
+		releaseIdentityReservation();
+		throw error;
+	}
 	syncApprovalTaskForRequest({
 		request: req,
 		settlementContext: params.settlementContext
@@ -410,20 +945,70 @@ function createWalletSendApprovalRequest(params) {
 	});
 	return req;
 }
-async function createOrExecuteWalletSend(params) {
+function createSignerReviewApprovalRequest(params) {
 	const env = params.env ?? process.env;
-	const requestedBy = params.requestedBy?.trim() || "agent";
-	const cfg = params.runtimeConfig ?? loadConfig();
-	const effectiveConfig = applyWalletPolicyConfig({
-		config: params.config,
-		cfg,
+	const review = params.review;
+	const splMint = review.asset.startsWith("solana:spl:") ? review.asset.slice("solana:spl:".length).trim() : undefined;
+	const payload = bindSignerReviewToWalletApprovalPayload({
+		role: params.role,
+		review,
+		payload: {
+			chain: "solana",
+			actionKind: "signer_review",
+			assetId: review.asset,
+			assetSymbol: params.assetSymbol,
+			assetName: params.assetName,
+			amountDisplay: params.amountDisplay,
+			to: review.destination,
+			amount: review.amount,
+			program: splMint,
+			memo: params.memo,
+			walletId: params.walletId ?? review.walletId,
+			walletName: params.walletName,
+			providerId: "local-socket-signer"
+		}
+	});
+	const existing = getWalletSendApprovalRequest({
+		requestId: review.requestId,
+		env
+	});
+	if (existing) {
+		if (canonicalApprovalJson(existing.payload) !== canonicalApprovalJson(payload)) {
+			throw new Error("signer review approval ID collides with different persisted metadata");
+		}
+		return existing;
+	}
+	return createWalletSendApprovalRequest({
+		requestId: review.requestId,
+		expiresAt: review.expiresAt,
+		payload,
+		requestedBy: params.requestedBy ?? "signer-review",
+		env
+	});
+}
+async function createOrExecuteWalletSend(params) {
+	const env = params.env ?? process.env;
+	const requestedBy = params.requestedBy?.trim() || "agent";
+	const cfg = params.runtimeConfig ?? loadConfig();
+	const effectiveConfig = applyWalletPolicyConfig({
+		config: params.config,
+		cfg,
 		env,
 		walletId: params.payload.walletId
 	});
-	const settlementRequestId = params.settlementContext?.taskId ? createRequestId() : undefined;
 	const resolvedMode = params.sendPath === "reviewed" ? "manual" : params.sendPath === "automation" ? "autonomous" : params.config.execution.mode === "autonomous" ? "autonomous" : "manual";
+	const executionIntentId = params.executionIntentId?.trim();
+	if (resolvedMode === "autonomous" && !executionIntentId) {
+		return {
+			ok: false,
+			code: "wallet_execution_intent_required",
+			message: "autonomous wallet sends require a stable caller-owned executionIntentId that is reused across retries"
+		};
+	}
+	const settlementRequestId = resolvedMode === "autonomous" && executionIntentId ? walletSendRequestId(executionIntentId) : params.settlementContext?.taskId ? createRequestId() : undefined;
 	const settlementPayload = {
 		...params.payload,
+		...executionIntentId ? { executionIntentId } : {},
 		providerId: params.providerIdOverride ?? params.payload.providerId ?? resolveWalletProviderId(cfg, env)
 	};
 	const walletRole = resolveWalletRoleForId({
@@ -431,8 +1016,18 @@ async function createOrExecuteWalletSend(params) {
 		cfg,
 		env
 	});
-	if (resolvedMode === "autonomous" && walletRole === "mining" && requestedBy !== "sat-mining") {
-		const message = "Mining wallets are limited to mining operations and SAT sweep automation";
+	const satSweepValidation = validateSatMiningTokenSweep({
+		cfg,
+		env,
+		walletId: params.payload.walletId,
+		requestedBy,
+		sendPath: params.sendPath,
+		executionIntentId,
+		authorization: params.satSweepAuthorization,
+		payload: params.payload
+	});
+	if (resolvedMode === "autonomous" && walletRole === "mining" && !satSweepValidation.ok) {
+		const message = satSweepValidation.message;
 		if (settlementRequestId) {
 			upsertSettlementLinkForPayload({
 				requestId: settlementRequestId,
@@ -451,11 +1046,20 @@ async function createOrExecuteWalletSend(params) {
 			requestId: settlementRequestId
 		};
 	}
+	if (resolvedMode === "autonomous" && requestedBy.startsWith("sat-mining") && !satSweepValidation.ok) {
+		return {
+			ok: false,
+			code: "wallet_role_not_allowed",
+			message: satSweepValidation.message,
+			requestId: settlementRequestId
+		};
+	}
 	const providerResolution = resolveSendProviderForPayload({
 		cfg,
 		wallet: params.config,
 		payload: params.payload,
 		providerIdOverride: params.providerIdOverride,
+		allowInteractiveBrowser: resolvedMode !== "autonomous",
 		env
 	});
 	if (!providerResolution.ok) {
@@ -486,14 +1090,7 @@ async function createOrExecuteWalletSend(params) {
 		sendPath: params.sendPath,
 		payload: params.payload
 	});
-	const skipSatMiningTokenCapRequirement = isSatMiningTokenSweep({
-		cfg,
-		env,
-		walletId: params.payload.walletId,
-		requestedBy,
-		sendPath: params.sendPath,
-		payload: params.payload
-	});
+	const skipSatMiningTokenCapRequirement = satSweepValidation.ok;
 	if (resolvedMode === "autonomous" && selectedProviderId !== "local-socket-signer") {
 		const message = "Autonomous wallet execution is restricted to local-socket-signer in the current self-hosted runtime";
 		if (settlementRequestId) {
@@ -547,120 +1144,332 @@ async function createOrExecuteWalletSend(params) {
 		};
 	}
 	if (resolvedMode !== "autonomous") {
-		return {
-			ok: true,
-			mode: "manual",
-			request: createWalletSendApprovalRequest({
-				payload: params.payload,
+		const requestId = executionIntentId ? walletSendRequestId(executionIntentId) : createRequestId();
+		let releaseManualExecution;
+		if (executionIntentId) {
+			const walletId = params.payload.walletId?.trim();
+			if (!walletId) {
+				return {
+					ok: false,
+					code: "wallet_execution_intent_required",
+					message: "reviewed wallet sends with executionIntentId require an explicit walletId",
+					requestId
+				};
+			}
+			const intentDigest = walletSendIntentDigest({
+				version: 1,
+				executionIntentId,
+				requestedBy,
+				sendPath: "reviewed",
+				payload: settlementPayload,
+				settlementContext: params.settlementContext
+			});
+			try {
+				const begun = await beginWalletSendExecution({
+					executionIntentId,
+					intentDigest,
+					walletId,
+					providerId: selectedProviderId,
+					env
+				});
+				if (begun.entry.state === "approval_pending") {
+					const existing = getWalletSendApprovalRequest({
+						requestId,
+						env
+					});
+					if (existing) {
+						return {
+							ok: true,
+							mode: "manual",
+							request: existing
+						};
+					}
+					return {
+						ok: false,
+						code: "wallet_approval_reconciliation_required",
+						message: "wallet approval identity exists but its approval record must be reconciled",
+						requestId
+					};
+				}
+				releaseManualExecution = await claimWalletSendExecution(executionIntentId, env);
+			} catch (error) {
+				const existing = getWalletSendApprovalRequest({
+					requestId,
+					env
+				});
+				if (existing) {
+					return {
+						ok: true,
+						mode: "manual",
+						request: existing
+					};
+				}
+				return {
+					ok: false,
+					code: "wallet_execution_intent_collision",
+					message: normalizeErrorMessage(error),
+					requestId
+				};
+			}
+		}
+		try {
+			let reviewedPayload = {
+				...settlementPayload,
+				providerId: selectedProviderId
+			};
+			if (selectedProviderId === "local-socket-signer" && !isSolanaSwapApprovalPayload(reviewedPayload) && !reviewedPayload.signerReviewId) {
+				const walletId = reviewedPayload.walletId?.trim();
+				const destination = reviewedPayload.to?.trim();
+				const amount = reviewedPayload.amount?.trim();
+				if (!walletId || !destination || !amount || !provider.prepareTypedTransferReview) {
+					return {
+						ok: false,
+						code: "wallet_signer_review_required",
+						message: "reviewed local-socket-signer sends require walletId, destination, amount, and exact signer review support",
+						requestId
+					};
+				}
+				try {
+					const review = await provider.prepareTypedTransferReview({
+						walletId,
+						requestId,
+						destination,
+						amount,
+						...reviewedPayload.program?.trim() ? { mint: reviewedPayload.program.trim() } : {},
+						...reviewedPayload.memo?.trim() ? { memo: reviewedPayload.memo.trim() } : {}
+					});
+					reviewedPayload = bindSignerReviewToWalletApprovalPayload({
+						payload: reviewedPayload,
+						review,
+						role: walletRole
+					});
+				} catch (error) {
+					return {
+						ok: false,
+						code: "wallet_signer_review_failed",
+						message: normalizeErrorMessage(error),
+						requestId
+					};
+				}
+			}
+			const existingRequest = getWalletSendApprovalRequest({
+				requestId,
+				env
+			});
+			if (existingRequest) {
+				if (existingRequest.requestedBy !== requestedBy || canonicalApprovalJson(existingRequest.payload) !== canonicalApprovalJson(reviewedPayload)) {
+					throw new Error("wallet approval request ID collides with a different immutable reviewed send");
+				}
+				if (executionIntentId) {
+					await updateWalletSendExecution({
+						executionIntentId,
+						expectedStates: ["reserved", "approval_pending"],
+						state: "approval_pending",
+						patch: { approvalRequestId: existingRequest.id },
+						env
+					});
+				}
+				return {
+					ok: true,
+					mode: "manual",
+					request: existingRequest
+				};
+			}
+			const request = createWalletSendApprovalRequest({
+				requestId,
+				expiresAt: reviewedPayload.signerReviewExpiresAt,
+				payload: reviewedPayload,
 				requestedBy,
 				settlementContext: params.settlementContext,
 				simulation,
 				approvalDiff: simulation.diff,
 				env
-			})
-		};
-	}
-	const custodyGate = await enforceWalletCustodyForAutonomousSend({
-		wallet: effectiveConfig,
-		env,
-		cfg,
-		walletId: params.payload.walletId,
-		approvalToken: params.approvalToken,
-		approvalHost: params.approvalHost,
-		deviceShare: params.custodyDeviceShare
-	});
-	if (!custodyGate.ok) {
-		if (settlementRequestId) {
-			upsertSettlementLinkForPayload({
-				requestId: settlementRequestId,
-				payload: settlementPayload,
-				settlementContext: params.settlementContext,
-				mode: resolvedMode,
-				status: "failed",
-				reason: custodyGate.message,
-				env
 			});
-		}
-		return {
-			ok: false,
-			code: custodyGate.code,
-			message: custodyGate.message,
-			requestId: settlementRequestId
-		};
-	}
-	if (params.sendPath !== "automation" && custodyGate.custodyMode !== "split-key-active" && resolveWalletApprovalAuthMode(env, cfg) === "webauthn") {
-		const consumed = consumeWalletApprovalGrant({
-			host: params.approvalHost?.trim() || "127.0.0.1",
-			operation: "wallet.send",
-			token: params.approvalToken ?? "",
-			env,
-			cfg
-		});
-		if (!consumed.ok) {
-			if (settlementRequestId) {
-				upsertSettlementLinkForPayload({
-					requestId: settlementRequestId,
-					payload: settlementPayload,
-					settlementContext: params.settlementContext,
-					mode: resolvedMode,
-					status: "failed",
-					reason: consumed.message,
+			if (executionIntentId) {
+				await updateWalletSendExecution({
+					executionIntentId,
+					expectedStates: ["reserved"],
+					state: "approval_pending",
+					patch: { approvalRequestId: request.id },
 					env
 				});
 			}
 			return {
-				ok: false,
-				code: consumed.code,
-				message: consumed.message,
-				requestId: settlementRequestId
+				ok: true,
+				mode: "manual",
+				request
 			};
+		} finally {
+			await releaseManualExecution?.();
 		}
 	}
-	const daily = enforceWalletDailyCap({
-		config: effectiveConfig,
-		chain: params.payload.chain,
-		amount: params.payload.amount,
-		program: params.payload.program,
-		walletId: params.payload.walletId,
-		env,
-		skipNativeSolanaCaps
+	const walletId = params.payload.walletId?.trim();
+	if (!walletId || !executionIntentId || !settlementRequestId) {
+		return {
+			ok: false,
+			code: "wallet_execution_intent_required",
+			message: "autonomous wallet sends require an explicit walletId and executionIntentId",
+			requestId: settlementRequestId
+		};
+	}
+	const intentDigest = walletSendIntentDigest({
+		version: 1,
+		executionIntentId,
+		requestedBy,
+		sendPath: "automation",
+		payload: settlementPayload,
+		settlementContext: params.settlementContext,
+		satSweepAuthorization: params.satSweepAuthorization
 	});
-	if (!daily.ok) {
-		if (settlementRequestId) {
-			upsertSettlementLinkForPayload({
-				requestId: settlementRequestId,
-				payload: settlementPayload,
-				settlementContext: params.settlementContext,
-				mode: resolvedMode,
-				status: "failed",
-				reason: daily.message ?? daily.code ?? "wallet daily cap exceeded",
-				env
-			});
-		}
+	let begun;
+	try {
+		begun = await beginWalletSendExecution({
+			executionIntentId,
+			intentDigest,
+			walletId,
+			providerId: selectedProviderId,
+			env
+		});
+	} catch (error) {
 		return {
 			ok: false,
-			code: daily.code ?? "wallet_cap_daily_exceeded",
-			message: daily.message ?? "wallet daily cap exceeded",
+			code: "wallet_execution_intent_collision",
+			message: normalizeErrorMessage(error),
 			requestId: settlementRequestId
 		};
 	}
+	let releaseExecution;
 	try {
-		if (settlementRequestId) {
-			upsertSettlementLinkForPayload({
-				requestId: settlementRequestId,
-				payload: settlementPayload,
-				settlementContext: params.settlementContext,
-				mode: resolvedMode,
-				status: "pending",
-				env
+		releaseExecution = await claimWalletSendExecution(executionIntentId, env);
+	} catch {
+		const current = getWalletSendExecution({
+			executionIntentId,
+			env
+		}) ?? begun.entry;
+		return autonomousResultFromExecution({
+			entry: current,
+			payload: settlementPayload
+		}) ?? {
+			ok: false,
+			code: "wallet_send_in_progress",
+			message: "wallet send is already executing; wait for its durable result",
+			requestId: current.requestId
+		};
+	}
+	try {
+		let current = getWalletSendExecution({
+			executionIntentId,
+			env
+		}) ?? begun.entry;
+		const terminal = autonomousResultFromExecution({
+			entry: current,
+			payload: settlementPayload
+		});
+		if (current.state === "executed" || current.state === "failed") {
+			return terminal;
+		}
+		if (current.state === "executing" || current.state === "unknown") {
+			const reconciliation = await reconcileTypedWalletSend({
+				provider,
+				walletId,
+				requestId: current.requestId
+			});
+			if (reconciliation.state === "confirmed") {
+				current = await updateWalletSendExecution({
+					executionIntentId,
+					expectedStates: ["executing", "unknown"],
+					state: "executed",
+					patch: {
+						signature: reconciliation.signature,
+						result: {
+							chain: "solana",
+							txHash: reconciliation.signature,
+							metadata: reconciliation.metadata
+						}
+					},
+					env
+				});
+				return autonomousResultFromExecution({
+					entry: current,
+					payload: settlementPayload
+				});
+			}
+			if (reconciliation.state === "failed") {
+				current = await updateWalletSendExecution({
+					executionIntentId,
+					expectedStates: ["executing", "unknown"],
+					state: "failed",
+					patch: { reason: reconciliation.reason },
+					env
+				});
+				return autonomousResultFromExecution({
+					entry: current,
+					payload: settlementPayload
+				});
+			}
+			if (reconciliation.state === "unknown") {
+				current = await updateWalletSendExecution({
+					executionIntentId,
+					expectedStates: ["executing", "unknown"],
+					state: "unknown",
+					patch: {
+						reason: reconciliation.reason,
+						signature: reconciliation.signature
+					},
+					env
+				});
+				return autonomousResultFromExecution({
+					entry: current,
+					payload: settlementPayload
+				});
+			}
+		}
+		if (begun.created) {
+			const daily = enforceWalletDailyCap({
+				config: effectiveConfig,
+				chain: params.payload.chain,
+				amount: params.payload.amount,
+				program: params.payload.program,
+				walletId: params.payload.walletId,
+				env,
+				skipNativeSolanaCaps
 			});
+			if (!daily.ok) {
+				current = await updateWalletSendExecution({
+					executionIntentId,
+					expectedStates: ["reserved"],
+					state: "failed",
+					patch: { reason: daily.message ?? daily.code ?? "wallet daily cap exceeded" },
+					env
+				});
+				return {
+					ok: false,
+					code: daily.code ?? "wallet_cap_daily_exceeded",
+					message: daily.message ?? "wallet daily cap exceeded",
+					requestId: current.requestId
+				};
+			}
 		}
+		current = await updateWalletSendExecution({
+			executionIntentId,
+			expectedStates: ["reserved", "executing"],
+			state: "executing",
+			env
+		});
+		upsertSettlementLinkForPayload({
+			requestId: current.requestId,
+			payload: settlementPayload,
+			settlementContext: params.settlementContext,
+			mode: resolvedMode,
+			status: "pending",
+			env
+		});
 		appendWalletAuditEntry({
 			action: "send_requested",
 			actor: requestedBy,
 			details: buildWalletSendAuditDetails({
-				payload: params.payload,
-				requestId: settlementRequestId,
+				payload: settlementPayload,
+				requestId: current.requestId,
 				mode: resolvedMode,
 				providerId: selectedProviderId,
 				taskId: params.settlementContext?.taskId,
@@ -669,97 +1478,125 @@ async function createOrExecuteWalletSend(params) {
 			}),
 			env
 		});
-		const sent = await executeWalletSendWithRetry({
-			env,
-			execute: async () => {
-				if (custodyGate.custodyMode === "split-key-active" && custodyGate.session) {
-					const guarded = await withWalletCustodySigningMaterial({
-						sessionId: custodyGate.session.id,
-						host: custodyGate.session.host,
-						handler: async () => await provider.sendTx(params.payload)
-					});
-					if (!guarded.ok) {
-						throw new Error(guarded.message);
-					}
-					return guarded.value;
-				}
-				return await provider.sendTx(params.payload);
+		const sent = await executeWalletSendOnce({ execute: async () => await prepareAndSendProviderTransaction({
+			provider,
+			payload: settlementPayload,
+			requestId: current.requestId
+		}) });
+		if (!sent.ok) {
+			const reconciliation = await reconcileTypedWalletSend({
+				provider,
+				walletId,
+				requestId: current.requestId
+			});
+			if (reconciliation.state === "confirmed") {
+				current = await updateWalletSendExecution({
+					executionIntentId,
+					expectedStates: ["executing"],
+					state: "executed",
+					patch: {
+						signature: reconciliation.signature,
+						result: {
+							chain: "solana",
+							txHash: reconciliation.signature,
+							metadata: reconciliation.metadata
+						}
+					},
+					env
+				});
+			} else if (reconciliation.state === "failed" || reconciliation.state === "not_found") {
+				const reason = reconciliation.state === "failed" ? reconciliation.reason : normalizeErrorMessage(sent.error);
+				current = await updateWalletSendExecution({
+					executionIntentId,
+					expectedStates: ["executing"],
+					state: "failed",
+					patch: { reason },
+					env
+				});
+			} else {
+				current = await updateWalletSendExecution({
+					executionIntentId,
+					expectedStates: ["executing"],
+					state: "unknown",
+					patch: {
+						reason: reconciliation.reason,
+						signature: reconciliation.signature
+					},
+					env
+				});
 			}
+		} else {
+			const tx = withSendAttemptMetadata(sent.tx, sent.attempts);
+			current = await updateWalletSendExecution({
+				executionIntentId,
+				expectedStates: ["executing"],
+				state: "executed",
+				patch: {
+					signature: tx.txHash,
+					result: {
+						chain: "solana",
+						txHash: tx.txHash,
+						...tx.signer ? { signer: tx.signer } : {},
+						...tx.metadata ? { metadata: tx.metadata } : {}
+					}
+				},
+				env
+			});
+		}
+		const result = autonomousResultFromExecution({
+			entry: current,
+			payload: settlementPayload
 		});
-		if (!sent.ok) {
-			throw new Error(`${normalizeErrorMessage(sent.error)} (attempts=${sent.attempts})`);
+		if (!result?.ok) {
+			appendWalletAuditEntry({
+				action: "send_failed",
+				actor: requestedBy,
+				details: buildWalletSendAuditDetails({
+					payload: settlementPayload,
+					requestId: current.requestId,
+					mode: resolvedMode,
+					providerId: selectedProviderId,
+					reason: current.reason
+				}),
+				env
+			});
+			markWalletSettlementLinkOutcome({
+				requestId: current.requestId,
+				status: current.state === "unknown" || current.state === "executing" ? "unknown" : "failed",
+				reason: current.reason,
+				env
+			});
+			return result;
 		}
-		const tx = withSendAttemptMetadata(sent.tx, sent.attempts);
 		appendWalletAuditEntry({
 			action: "send_executed",
 			actor: requestedBy,
 			details: buildWalletSendAuditDetails({
-				payload: params.payload,
-				requestId: settlementRequestId,
+				payload: settlementPayload,
+				requestId: current.requestId,
 				mode: resolvedMode,
 				taskId: params.settlementContext?.taskId,
 				invoiceId: params.settlementContext?.invoiceId,
 				senderHandle: params.settlementContext?.senderHandle,
 				providerId: selectedProviderId,
-				txHash: tx.txHash,
-				attempts: sent.attempts
+				txHash: result.tx.txHash,
+				attempts: 1
 			}),
 			env
 		});
-		if (settlementRequestId) {
-			const settlementLink = markWalletSettlementLinkOutcome({
-				requestId: settlementRequestId,
-				status: "executed",
-				txHash: tx.txHash,
-				env
-			});
-			await publishSettlementEvidenceForLink({
-				settlementLink,
-				env
-			});
-		}
-		return {
-			ok: true,
-			mode: "autonomous",
-			tx,
-			payload: params.payload,
-			requestId: settlementRequestId
-		};
-	} catch (err) {
-		const message = walletDiagnosticErrorString(err);
-		appendWalletAuditEntry({
-			action: "send_failed",
-			actor: requestedBy,
-			details: {
-				requestId: settlementRequestId,
-				mode: resolvedMode,
-				chain: params.payload.chain,
-				amount: params.payload.amount,
-				to: params.payload.to,
-				providerId: selectedProviderId,
-				walletId: params.payload.walletId,
-				walletName: params.payload.walletName,
-				taskId: params.settlementContext?.taskId,
-				invoiceId: params.settlementContext?.invoiceId,
-				senderHandle: params.settlementContext?.senderHandle,
-				reason: message
-			},
+		const settlementLink = markWalletSettlementLinkOutcome({
+			requestId: current.requestId,
+			status: "executed",
+			txHash: result.tx.txHash,
 			env
 		});
-		if (settlementRequestId) {
-			markWalletSettlementLinkOutcome({
-				requestId: settlementRequestId,
-				status: "failed",
-				reason: message,
-				env
-			});
-		}
-		return {
-			ok: false,
-			code: "send_failed",
-			message,
-			requestId: settlementRequestId
-		};
+		await publishSettlementEvidenceForLink({
+			settlementLink,
+			env
+		});
+		return result;
+	} finally {
+		await releaseExecution();
 	}
 }
 function listWalletSendApprovalRequests(params) {
@@ -773,16 +1610,143 @@ function listWalletSendApprovalRequests(params) {
 	const requests = [...file.requests].toReversed().filter((request) => status === "all" ? true : request.status === status).slice(0, limit);
 	return requests;
 }
+function getWalletSendApprovalRequest(params) {
+	const env = params.env ?? process.env;
+	const file = loadFile(env);
+	if (markExpired(file)) {
+		saveFile(file, env);
+	}
+	return findRequest(file, params.requestId) ?? null;
+}
+async function markWalletSendRequestExecutedExternally(params) {
+	const env = params.env ?? process.env;
+	const file = loadFile(env);
+	const request = findRequest(file, params.requestId);
+	if (!request) {
+		throw new Error("approval request not found");
+	}
+	if (request.status === "executed" && request.result?.txHash === params.txHash) {
+		return request;
+	}
+	if (request.status !== "pending" && request.status !== "approved") {
+		throw new Error(`approval request is ${request.status}`);
+	}
+	const actor = params.actor?.trim() || "control-ui";
+	const settlementLinkBefore = getWalletSettlementLinkByRequestId({
+		requestId: request.id,
+		env
+	});
+	if (request.status === "pending") {
+		request.status = "approved";
+		request.approvedBy = actor;
+		request.decisionAt = new Date().toISOString();
+		appendWalletAuditEntry({
+			action: "send_approved",
+			actor,
+			details: buildWalletSendAuditDetails({
+				payload: request.payload,
+				requestId: request.id,
+				mode: "manual",
+				providerId: request.payload.providerId,
+				taskId: settlementLinkBefore?.taskId,
+				invoiceId: settlementLinkBefore?.invoiceId,
+				senderHandle: settlementLinkBefore?.senderHandle
+			}),
+			env
+		});
+	}
+	request.status = "executed";
+	request.result = { txHash: params.txHash };
+	request.reason = undefined;
+	const settlementLink = markWalletSettlementLinkOutcome({
+		requestId: request.id,
+		status: "executed",
+		txHash: params.txHash,
+		env
+	});
+	appendWalletAuditEntry({
+		action: "send_executed",
+		actor,
+		details: buildWalletSendAuditDetails({
+			payload: request.payload,
+			requestId: request.id,
+			mode: "manual",
+			providerId: request.payload.providerId,
+			txHash: params.txHash,
+			taskId: settlementLink?.taskId,
+			invoiceId: settlementLink?.invoiceId,
+			senderHandle: settlementLink?.senderHandle
+		}),
+		env
+	});
+	saveFile(file, env);
+	syncApprovalTaskForRequest({
+		request,
+		settlementLink
+	});
+	await publishSettlementEvidenceForLink({
+		settlementLink,
+		env
+	});
+	return request;
+}
+async function markWalletSendRequestBroadcastUnknown(params) {
+	const env = params.env ?? process.env;
+	return await withApprovalMutationLock(env, () => {
+		const file = loadFile(env);
+		const request = findRequest(file, params.requestId);
+		if (!request) {
+			throw new Error("approval request not found");
+		}
+		if (request.status !== "pending" && request.status !== "executing" && request.status !== "approved" && request.status !== "unknown") {
+			return request;
+		}
+		request.status = "unknown";
+		request.approvedBy = params.actor?.trim() || "control-ui";
+		request.decisionAt = request.decisionAt ?? new Date().toISOString();
+		request.reason = params.reason;
+		request.result = params.txHash ? {
+			txHash: params.txHash,
+			error: params.reason
+		} : { error: params.reason };
+		appendWalletAuditEntry({
+			action: "send_failed",
+			actor: request.approvedBy,
+			details: buildWalletSendAuditDetails({
+				payload: request.payload,
+				requestId: request.id,
+				mode: "manual",
+				providerId: request.payload.providerId,
+				txHash: params.txHash,
+				reason: params.reason
+			}),
+			env
+		});
+		const settlementLink = markWalletSettlementLinkOutcome({
+			requestId: request.id,
+			status: "unknown",
+			txHash: params.txHash,
+			reason: params.reason,
+			env
+		});
+		saveFile(file, env);
+		syncApprovalTaskForRequest({
+			request,
+			...settlementLink ? { settlementLink } : {}
+		});
+		return request;
+	});
+}
 function findRequest(file, requestId) {
 	return file.requests.find((request) => request.id === requestId.trim());
 }
 async function approveWalletSendRequest(params) {
 	const env = params.env ?? process.env;
-	const file = loadFile(env);
+	let file = loadFile(env);
 	if (markExpired(file)) {
 		saveFile(file, env);
 	}
-	const request = findRequest(file, params.requestId);
+	let request = findRequest(file, params.requestId);
 	if (!request) {
 		return {
 			ok: false,
@@ -790,7 +1754,11 @@ async function approveWalletSendRequest(params) {
 			message: "approval request not found"
 		};
 	}
-	if (request.status !== "pending") {
+	const hasSignerReviewMetadata = hasSignerOwnedReviewMetadata(request.payload);
+	const hasSignerOwnedReview = hasExactSignerOwnedReviewBinding(request);
+	const canReconcileExpiredSignerReview = request.status === "expired" && hasSignerOwnedReview;
+	const canRecoverClaimedExecution = request.status === "executing" || request.status === "unknown";
+	if (request.status !== "pending" && !canReconcileExpiredSignerReview && !canRecoverClaimedExecution) {
 		return {
 			ok: false,
 			code: "invalid_state",
@@ -802,16 +1770,43 @@ async function approveWalletSendRequest(params) {
 		requestId: request.id,
 		env
 	});
-	const expiredAt = Date.parse(request.expiresAt);
-	if (Number.isFinite(expiredAt) && expiredAt <= nowMs()) {
-		request.status = "expired";
-		request.reason = "expired";
+	if (hasSignerReviewMetadata && !hasSignerOwnedReview) {
+		request.status = "failed";
+		request.reason = "signer-reviewed approval is missing its complete exact signer binding";
+		request.result = { error: request.reason };
 		request.decisionAt = new Date().toISOString();
 		saveFile(file, env);
 		syncApprovalTaskForRequest({
 			request,
 			settlementLink
 		});
+		appendWalletAuditEntry({
+			action: "send_failed",
+			actor: params.actor?.trim() || "operator",
+			details: buildWalletSendAuditDetails({
+				payload: request.payload,
+				requestId: request.id,
+				mode: "manual",
+				taskId: settlementLink?.taskId,
+				invoiceId: settlementLink?.invoiceId,
+				senderHandle: settlementLink?.senderHandle,
+				reason: request.reason
+			}),
+			env
+		});
+		return {
+			ok: false,
+			code: "wallet_signer_review_binding_incomplete",
+			message: request.reason,
+			request
+		};
+	}
+	if (isWalletSendApprovalExpired(request) && !hasSignerOwnedReview) {
+		expireWalletSendApprovalRequest({
+			request,
+			settlementLink
+		});
+		saveFile(file, env);
 		return {
 			ok: false,
 			code: "expired",
@@ -819,103 +1814,137 @@ async function approveWalletSendRequest(params) {
 			request
 		};
 	}
-	if (isSolanaSwapApprovalPayload(request.payload)) {
-		const cfg = loadConfig();
-		const executed = await executeSolanaSwapApprovalPayload({
-			payload: request.payload,
-			config: params.config,
-			runtimeConfig: cfg,
-			providerIdOverride: params.providerIdOverride,
-			autonomous: false,
+	if (isSolanaSwapApprovalPayload(request.payload) && !hasSignerOwnedReview) {
+		const claim = await claimWalletSendApprovalExecution({
+			requestId: request.id,
+			actor: params.actor,
 			env
 		});
-		if (!executed.ok) {
-			request.status = "failed";
-			request.reason = executed.message;
-			request.result = { error: request.reason };
+		if (!claim.ok) {
+			return {
+				ok: false,
+				code: claim.code,
+				message: claim.message,
+				...claim.request ? { request: claim.request } : {}
+			};
+		}
+		file = claim.file;
+		request = claim.request;
+		try {
+			const cfg = loadConfig();
+			const executed = await executeSolanaSwapApprovalPayload({
+				payload: request.payload,
+				config: params.config,
+				runtimeConfig: cfg,
+				providerIdOverride: params.providerIdOverride,
+				autonomous: false,
+				reviewAuthorization: params.reviewAuthorization,
+				env
+			});
+			if (!executed.ok) {
+				if (executed.code === "wallet_provider_ambiguous") {
+					const ambiguousRequest = await markWalletSendRequestBroadcastUnknown({
+						requestId: request.id,
+						reason: executed.message,
+						actor: params.actor,
+						env
+					});
+					return {
+						ok: false,
+						code: executed.code,
+						message: executed.message,
+						request: ambiguousRequest
+					};
+				}
+				request.status = "failed";
+				request.reason = executed.message;
+				request.result = { error: request.reason };
+				request.decisionAt = new Date().toISOString();
+				saveFile(file, env);
+				syncApprovalTaskForRequest({
+					request,
+					settlementLink
+				});
+				appendWalletAuditEntry({
+					action: "send_failed",
+					actor: params.actor?.trim() || "operator",
+					details: {
+						...buildWalletSendAuditDetails({
+							payload: request.payload,
+							requestId: request.id,
+							mode: "manual",
+							taskId: settlementLink?.taskId,
+							invoiceId: settlementLink?.invoiceId,
+							senderHandle: settlementLink?.senderHandle,
+							reason: request.reason
+						}),
+						code: executed.code
+					},
+					env
+				});
+				return {
+					ok: false,
+					code: executed.code,
+					message: executed.message,
+					request
+				};
+			}
+			request.status = "approved";
+			request.approvedBy = params.actor?.trim() || "operator";
 			request.decisionAt = new Date().toISOString();
-			saveFile(file, env);
-			syncApprovalTaskForRequest({
-				request,
-				settlementLink
+			appendWalletAuditEntry({
+				action: "send_approved",
+				actor: request.approvedBy,
+				details: buildWalletSendAuditDetails({
+					payload: request.payload,
+					requestId: request.id,
+					mode: "manual",
+					taskId: settlementLink?.taskId,
+					invoiceId: settlementLink?.invoiceId,
+					senderHandle: settlementLink?.senderHandle
+				}),
+				env
 			});
+			request.status = "executed";
+			request.result = { txHash: executed.tx.txHash };
 			appendWalletAuditEntry({
-				action: "send_failed",
-				actor: params.actor?.trim() || "operator",
+				action: "send_executed",
+				actor: request.approvedBy,
 				details: {
 					...buildWalletSendAuditDetails({
-						payload: request.payload,
+						payload: {
+							...request.payload,
+							outAmount: executed.order.outAmount ?? request.payload.outAmount,
+							outAmountDisplay: request.payload.outAmountDisplay,
+							otherAmountThreshold: executed.order.otherAmountThreshold ?? request.payload.otherAmountThreshold,
+							routeLabel: executed.order.routeLabel ?? request.payload.routeLabel,
+							jupiterRequestId: executed.order.requestId ?? request.payload.jupiterRequestId
+						},
 						requestId: request.id,
 						mode: "manual",
+						providerId: request.payload.providerId,
+						txHash: executed.tx.txHash,
 						taskId: settlementLink?.taskId,
 						invoiceId: settlementLink?.invoiceId,
-						senderHandle: settlementLink?.senderHandle,
-						reason: request.reason
+						senderHandle: settlementLink?.senderHandle
 					}),
-					code: executed.code
+					swapProvider: "jupiter"
 				},
 				env
 			});
+			saveFile(file, env);
+			syncApprovalTaskForRequest({
+				request,
+				settlementLink
+			});
 			return {
-				ok: false,
-				code: executed.code,
-				message: executed.message,
-				request
+				ok: true,
+				request,
+				tx: executed.tx
 			};
+		} finally {
+			await claim.release();
 		}
-		request.status = "approved";
-		request.approvedBy = params.actor?.trim() || "operator";
-		request.decisionAt = new Date().toISOString();
-		appendWalletAuditEntry({
-			action: "send_approved",
-			actor: request.approvedBy,
-			details: buildWalletSendAuditDetails({
-				payload: request.payload,
-				requestId: request.id,
-				mode: "manual",
-				taskId: settlementLink?.taskId,
-				invoiceId: settlementLink?.invoiceId,
-				senderHandle: settlementLink?.senderHandle
-			}),
-			env
-		});
-		request.status = "executed";
-		request.result = { txHash: executed.tx.txHash };
-		appendWalletAuditEntry({
-			action: "send_executed",
-			actor: request.approvedBy,
-			details: {
-				...buildWalletSendAuditDetails({
-					payload: {
-						...request.payload,
-						outAmount: executed.order.outAmount ?? request.payload.outAmount,
-						outAmountDisplay: request.payload.outAmountDisplay,
-						otherAmountThreshold: executed.order.otherAmountThreshold ?? request.payload.otherAmountThreshold,
-						routeLabel: executed.order.routeLabel ?? request.payload.routeLabel,
-						jupiterRequestId: executed.order.requestId ?? request.payload.jupiterRequestId
-					},
-					requestId: request.id,
-					mode: "manual",
-					providerId: request.payload.providerId,
-					txHash: executed.tx.txHash,
-					taskId: settlementLink?.taskId,
-					invoiceId: settlementLink?.invoiceId,
-					senderHandle: settlementLink?.senderHandle
-				}),
-				swapProvider: "jupiter"
-			},
-			env
-		});
-		saveFile(file, env);
-		syncApprovalTaskForRequest({
-			request,
-			settlementLink
-		});
-		return {
-			ok: true,
-			request,
-			tx: executed.tx
-		};
 	}
 	const cfg = loadConfig();
 	const providerResolution = resolveSendProviderForPayload({
@@ -978,263 +2007,444 @@ async function approveWalletSendRequest(params) {
 		requestedBy: request.requestedBy,
 		payload: request.payload
 	});
-	const simulation = simulateWalletPolicy({
-		cfg,
-		config: effectiveConfig,
-		payload: request.payload,
-		mode: "manual",
-		source: request.requestedBy,
-		requireDirectSigning: false,
-		skipNativeSolanaCaps,
-		requireSolanaTokenCap: Boolean(request.payload.program?.trim()),
-		env
-	});
-	if (!simulation.ok) {
-		const failed = simulation.checks.find((check) => check.status === "fail");
-		request.status = "failed";
-		request.reason = failed?.detail ?? "wallet policy rejected";
-		request.result = { error: request.reason };
-		request.simulation = simulation;
-		request.approvalDiff = simulation.diff;
-		request.decisionAt = new Date().toISOString();
-		saveFile(file, env);
-		syncApprovalTaskForRequest({
-			request,
-			settlementLink
+	const signerReviewId = request.payload.signerReviewId?.trim();
+	const isSignerOwnedReview = selectedProviderId === "local-socket-signer" && Boolean(signerReviewId);
+	if (!isSignerOwnedReview) {
+		const simulation = simulateWalletPolicy({
+			cfg,
+			config: effectiveConfig,
+			payload: request.payload,
+			mode: "manual",
+			source: request.requestedBy,
+			requireDirectSigning: false,
+			skipNativeSolanaCaps,
+			requireSolanaTokenCap: Boolean(request.payload.program?.trim()),
+			env
 		});
-		appendWalletAuditEntry({
-			action: "send_failed",
-			actor: params.actor?.trim() || "operator",
-			details: {
+		if (!simulation.ok) {
+			const failed = simulation.checks.find((check) => check.status === "fail");
+			request.status = "failed";
+			request.reason = failed?.detail ?? "wallet policy rejected";
+			request.result = { error: request.reason };
+			request.simulation = simulation;
+			request.approvalDiff = simulation.diff;
+			request.decisionAt = new Date().toISOString();
+			saveFile(file, env);
+			syncApprovalTaskForRequest({
+				request,
+				settlementLink
+			});
+			appendWalletAuditEntry({
+				action: "send_failed",
+				actor: params.actor?.trim() || "operator",
+				details: {
+					requestId: request.id,
+					reason: request.reason,
+					providerId: request.payload.providerId,
+					walletId: request.payload.walletId,
+					walletName: request.payload.walletName,
+					taskId: settlementLink?.taskId,
+					invoiceId: settlementLink?.invoiceId,
+					senderHandle: settlementLink?.senderHandle
+				},
+				env
+			});
+			markWalletSettlementLinkOutcome({
 				requestId: request.id,
+				status: "failed",
 				reason: request.reason,
-				providerId: request.payload.providerId,
-				walletId: request.payload.walletId,
-				walletName: request.payload.walletName,
-				taskId: settlementLink?.taskId,
-				invoiceId: settlementLink?.invoiceId,
-				senderHandle: settlementLink?.senderHandle
-			},
-			env
-		});
-		markWalletSettlementLinkOutcome({
-			requestId: request.id,
-			status: "failed",
-			reason: request.reason,
-			env
-		});
-		return {
-			ok: false,
-			code: failed?.code ?? "policy_rejected",
-			message: request.reason,
-			request
-		};
+				env
+			});
+			return {
+				ok: false,
+				code: failed?.code ?? "policy_rejected",
+				message: request.reason,
+				request
+			};
+		}
+		request.simulation = simulation;
+		request.approvalDiff = simulation.diff;
 	}
-	request.simulation = simulation;
-	request.approvalDiff = simulation.diff;
-	const custodyGate = await enforceWalletCustodyForAutonomousSend({
-		wallet: params.config,
-		cfg,
-		env,
-		walletId: request.payload.walletId,
-		approvalHost: params.approvalHost
-	});
-	if (!custodyGate.ok) {
-		if (custodyGate.code === "custody_unlock_required") {
-			syncApprovalTaskForRequest({
-				request,
-				settlementLink
+	if (isSignerOwnedReview && signerReviewId) {
+		if (!provider.getSignerReview || !provider.executeSignerReview) {
+			return {
+				ok: false,
+				code: "wallet_signer_review_required",
+				message: "local-socket-signer does not expose exact review.get/review.execute support",
+				request
+			};
+		}
+		let storedReview;
+		try {
+			storedReview = await provider.getSignerReview({
+				walletId: request.payload.signerWalletId?.trim() || "",
+				requestId: signerReviewId
 			});
+		} catch (error) {
 			return {
 				ok: false,
-				code: custodyGate.code,
-				message: custodyGate.message,
+				code: "wallet_signer_review_failed",
+				message: normalizeErrorMessage(error),
 				request
 			};
 		}
-		request.status = "failed";
-		request.reason = custodyGate.message;
-		request.result = { error: request.reason };
-		request.decisionAt = new Date().toISOString();
-		saveFile(file, env);
-		syncApprovalTaskForRequest({
-			request,
-			settlementLink
-		});
-		appendWalletAuditEntry({
-			action: "send_failed",
-			actor: params.actor?.trim() || "operator",
-			details: {
-				requestId: request.id,
-				reason: request.reason,
-				providerId: request.payload.providerId,
-				walletId: request.payload.walletId,
-				walletName: request.payload.walletName,
-				taskId: settlementLink?.taskId,
-				invoiceId: settlementLink?.invoiceId,
-				senderHandle: settlementLink?.senderHandle
-			},
-			env
-		});
-		markWalletSettlementLinkOutcome({
+		if (!signerReviewMatchesWalletApprovalPayload(storedReview, request.payload)) {
+			return {
+				ok: false,
+				code: "wallet_signer_review_mismatch",
+				message: "signer review does not match the exact persisted approval binding",
+				request
+			};
+		}
+		const claim = await claimWalletSendApprovalExecution({
 			requestId: request.id,
-			status: "failed",
-			reason: request.reason,
+			actor: params.actor,
+			allowExpiredSignerReview: canReconcileExpiredSignerReview,
 			env
 		});
-		return {
-			ok: false,
-			code: custodyGate.code,
-			message: request.reason,
-			request
-		};
+		if (!claim.ok) {
+			return {
+				ok: false,
+				code: claim.code,
+				message: claim.message,
+				...claim.request ? { request: claim.request } : {}
+			};
+		}
+		file = claim.file;
+		request = claim.request;
+		try {
+			if (storedReview.state === "prepared" && (request.status === "expired" || isWalletSendApprovalExpired(request))) {
+				expireWalletSendApprovalRequest({
+					request,
+					settlementLink
+				});
+				saveFile(file, env);
+				return {
+					ok: false,
+					code: "expired",
+					message: "approval request expired before the signer completed it",
+					request
+				};
+			}
+			if (storedReview.state === "prepared" && !params.reviewAuthorization) {
+				if (claim.recovered && request.status === "executing") {
+					await withApprovalMutationLock(env, () => {
+						file = loadFile(env);
+						const persisted = findRequest(file, claim.request.id);
+						if (persisted?.status === "executing") {
+							persisted.status = "pending";
+							persisted.execution = undefined;
+							persisted.reason = "previous execution stopped before the signer accepted it; a new WebAuthn approval is required";
+							saveFile(file, env);
+							request = persisted;
+						}
+					});
+				}
+				syncApprovalTaskForRequest({
+					request,
+					settlementLink
+				});
+				return {
+					ok: false,
+					code: "signer_webauthn_required",
+					message: "reviewed signer execution requires a signer-owned WebAuthn proof",
+					request
+				};
+			}
+			const executionAuthorization = storedReview.state === "prepared" ? params.reviewAuthorization : undefined;
+			let executed;
+			try {
+				executed = await provider.executeSignerReview({
+					walletId: request.payload.signerWalletId?.trim() || "",
+					requestId: signerReviewId,
+					authorization: executionAuthorization
+				});
+			} catch (error) {
+				const message = `signer execution result is unknown; reconcile the durable signer request before retrying: ${normalizeErrorMessage(error)}`;
+				const unknownRequest = await markWalletSendRequestBroadcastUnknown({
+					requestId: request.id,
+					reason: message,
+					actor: params.actor,
+					env
+				});
+				return {
+					ok: false,
+					code: "wallet_provider_ambiguous",
+					message,
+					request: unknownRequest
+				};
+			}
+			if (executed.review.state !== "signed" || !signerReviewMatchesWalletApprovalPayload(executed.review, request.payload) || executed.operation.requestId !== signerReviewId || executed.operation.walletId !== request.payload.signerWalletId?.trim() || executed.operation.intentDigest !== request.payload.signerIntentDigest?.trim() || executed.operation.policyHash !== request.payload.signerPolicyHash?.trim() || executed.operation.asset !== request.payload.signerAsset?.trim() || executed.operation.amount !== request.payload.signerAmount?.trim() || !sameOptionalSignerValue(executed.operation.transactionDigest, request.payload.signerTransactionDigest) || !sameOptionalSignerValue(executed.signer, request.payload.signerWalletPublicKey) || executed.review.artifactKind === "domain-separated-message" && executed.signatureBase64 !== executed.operation.signature || executionAuthorization && executed.operation.authorizationProof !== executionAuthorization.proof.proofId) {
+				const message = "signer execution returned a mismatched result; preserve it as unknown and reconcile before retrying";
+				const unknownRequest = await markWalletSendRequestBroadcastUnknown({
+					requestId: request.id,
+					txHash: executed.operation.signature,
+					reason: message,
+					actor: params.actor,
+					env
+				});
+				return {
+					ok: false,
+					code: "wallet_signer_review_mismatch",
+					message,
+					request: unknownRequest
+				};
+			}
+			const operation = executed.operation;
+			if (operation.state === "broadcast" || operation.state === "unknown") {
+				const message = `signer operation ${operation.requestId} is ${operation.state}; reconcile signature before any new attempt`;
+				const ambiguousRequest = await markWalletSendRequestBroadcastUnknown({
+					requestId: request.id,
+					txHash: operation.signature,
+					reason: message,
+					actor: params.actor,
+					env
+				});
+				return {
+					ok: false,
+					code: "wallet_provider_ambiguous",
+					message,
+					request: ambiguousRequest
+				};
+			}
+			if (operation.state !== "confirmed" || !operation.signature) {
+				request.status = "failed";
+				request.reason = operation.error ?? `signer operation ended in state=${operation.state}`;
+				request.result = { error: request.reason };
+				request.decisionAt = new Date().toISOString();
+				saveFile(file, env);
+				syncApprovalTaskForRequest({
+					request,
+					settlementLink
+				});
+				return {
+					ok: false,
+					code: "wallet_signer_review_failed",
+					message: request.reason,
+					request
+				};
+			}
+			let signerCompletionWarning;
+			if (executed.review.intentType === "federation.bondChallenge") {
+				if (!executed.signatureBase64) {
+					const message = "federation signer review completed without its exact signature artifact; reconcile before retrying";
+					const unknownRequest = await markWalletSendRequestBroadcastUnknown({
+						requestId: request.id,
+						txHash: operation.signature,
+						reason: message,
+						actor: params.actor,
+						env
+					});
+					return {
+						ok: false,
+						code: "wallet_signer_review_mismatch",
+						message,
+						request: unknownRequest
+					};
+				}
+				try {
+					const federation = await import("../federation/auto-connect.js");
+					const proof = await federation.persistFederationBondProofFromSignerReview({
+						review: executed.review,
+						signatureBase64: executed.signatureBase64,
+						walletId: request.payload.walletId?.trim() || executed.review.walletId,
+						env
+					});
+					try {
+						await federation.submitFederationBondProof({
+							env,
+							proof
+						});
+					} catch (error) {
+						signerCompletionWarning = `signature completed; federation proof submission remains pending: ${normalizeErrorMessage(error)}`;
+					}
+				} catch (error) {
+					const message = `signature completed but its federation proof could not be persisted safely: ${normalizeErrorMessage(error)}`;
+					const unknownRequest = await markWalletSendRequestBroadcastUnknown({
+						requestId: request.id,
+						txHash: operation.signature,
+						reason: message,
+						actor: params.actor,
+						env
+					});
+					return {
+						ok: false,
+						code: "wallet_signer_review_failed",
+						message,
+						request: unknownRequest
+					};
+				}
+			}
+			request.status = "approved";
+			request.approvedBy = params.actor?.trim() || "operator";
+			request.decisionAt = new Date().toISOString();
+			request.reason = undefined;
+			appendWalletAuditEntry({
+				action: "send_approved",
+				actor: request.approvedBy,
+				details: buildWalletSendAuditDetails({
+					payload: request.payload,
+					requestId: request.id,
+					mode: "manual",
+					providerId: selectedProviderId,
+					taskId: settlementLink?.taskId,
+					invoiceId: settlementLink?.invoiceId,
+					senderHandle: settlementLink?.senderHandle
+				}),
+				env
+			});
+			request.status = "executed";
+			request.result = {
+				txHash: operation.signature,
+				...signerCompletionWarning ? { error: signerCompletionWarning } : {}
+			};
+			appendWalletAuditEntry({
+				action: "send_executed",
+				actor: request.approvedBy,
+				details: {
+					...buildWalletSendAuditDetails({
+						payload: claim.request.payload,
+						requestId: claim.request.id,
+						mode: "manual",
+						providerId: selectedProviderId,
+						txHash: operation.signature,
+						taskId: settlementLink?.taskId,
+						invoiceId: settlementLink?.invoiceId,
+						senderHandle: settlementLink?.senderHandle
+					}),
+					...signerCompletionWarning ? { warning: signerCompletionWarning } : {}
+				},
+				env
+			});
+			saveFile(file, env);
+			syncApprovalTaskForRequest({
+				request,
+				settlementLink
+			});
+			const updatedSettlement = markWalletSettlementLinkOutcome({
+				requestId: request.id,
+				status: "executed",
+				txHash: operation.signature,
+				env
+			});
+			await publishSettlementEvidenceForLink({
+				settlementLink: updatedSettlement,
+				env
+			});
+			return {
+				ok: true,
+				request,
+				tx: {
+					ok: true,
+					chain: "solana",
+					txHash: operation.signature,
+					signer: executed.signer,
+					metadata: {
+						provider: "local-socket-signer",
+						signerProtocol: 2,
+						signerOperationState: operation.state,
+						signerIntentDigest: operation.intentDigest,
+						signerTransactionDigest: operation.transactionDigest
+					}
+				}
+			};
+		} finally {
+			await claim.release();
+		}
 	}
-	const daily = enforceWalletDailyCap({
-		config: effectiveConfig,
-		chain: request.payload.chain,
-		amount: request.payload.amount,
-		program: request.payload.program,
-		walletId: request.payload.walletId,
-		env,
-		skipNativeSolanaCaps
+	const claim = await claimWalletSendApprovalExecution({
+		requestId: request.id,
+		actor: params.actor,
+		env
 	});
-	if (!daily.ok) {
-		request.status = "failed";
-		request.reason = daily.message ?? daily.code ?? "wallet daily cap exceeded";
-		request.result = { error: request.reason };
-		request.decisionAt = new Date().toISOString();
-		saveFile(file, env);
-		syncApprovalTaskForRequest({
-			request,
-			settlementLink
-		});
-		appendWalletAuditEntry({
-			action: "send_failed",
-			actor: params.actor?.trim() || "operator",
-			details: {
-				requestId: request.id,
-				reason: request.reason,
-				providerId: request.payload.providerId,
-				walletId: request.payload.walletId,
-				walletName: request.payload.walletName,
-				taskId: settlementLink?.taskId,
-				invoiceId: settlementLink?.invoiceId,
-				senderHandle: settlementLink?.senderHandle
-			},
-			env
-		});
-		markWalletSettlementLinkOutcome({
-			requestId: request.id,
-			status: "failed",
-			reason: request.reason,
-			env
-		});
+	if (!claim.ok) {
 		return {
 			ok: false,
-			code: "daily_cap_rejected",
-			message: request.reason,
-			request
+			code: claim.code,
+			message: claim.message,
+			...claim.request ? { request: claim.request } : {}
 		};
 	}
-	request.status = "approved";
-	request.approvedBy = params.actor?.trim() || "operator";
-	request.decisionAt = new Date().toISOString();
-	syncApprovalTaskForRequest({
-		request,
-		settlementLink
-	});
-	appendWalletAuditEntry({
-		action: "send_approved",
-		actor: request.approvedBy,
-		details: {
-			requestId: request.id,
+	file = claim.file;
+	request = claim.request;
+	try {
+		if (claim.recovered && selectedProviderId === "wallet-standard") {
+			const message = "Wallet Standard execution cannot be server-reconciled; preserve this approval as unknown until its exact on-chain signature is supplied";
+			const unknownRequest = await markWalletSendRequestBroadcastUnknown({
+				requestId: request.id,
+				reason: message,
+				actor: params.actor,
+				env
+			});
+			return {
+				ok: false,
+				code: "wallet_provider_ambiguous",
+				message,
+				request: unknownRequest
+			};
+		}
+		const daily = claim.recovered ? { ok: true } : enforceWalletDailyCap({
+			config: effectiveConfig,
 			chain: request.payload.chain,
 			amount: request.payload.amount,
-			providerId: selectedProviderId,
+			program: request.payload.program,
 			walletId: request.payload.walletId,
-			walletName: request.payload.walletName,
-			taskId: settlementLink?.taskId,
-			invoiceId: settlementLink?.invoiceId,
-			senderHandle: settlementLink?.senderHandle
-		},
-		env
-	});
-	try {
-		const sent = await executeWalletSendWithRetry({
 			env,
-			execute: async () => {
-				if (custodyGate.custodyMode === "split-key-active" && custodyGate.session) {
-					const guarded = await withWalletCustodySigningMaterial({
-						sessionId: custodyGate.session.id,
-						host: custodyGate.session.host,
-						handler: async () => await provider.sendTx(request.payload)
-					});
-					if (!guarded.ok) {
-						throw new Error(guarded.message);
-					}
-					return guarded.value;
-				}
-				return await provider.sendTx(request.payload);
-			}
+			skipNativeSolanaCaps
 		});
-		if (!sent.ok) {
-			throw new Error(`${normalizeErrorMessage(sent.error)} (attempts=${sent.attempts})`);
-		}
-		const tx = withSendAttemptMetadata(sent.tx, sent.attempts);
-		request.status = "executed";
-		request.result = { txHash: tx.txHash };
-		const settlementLink = markWalletSettlementLinkOutcome({
-			requestId: request.id,
-			status: "executed",
-			txHash: tx.txHash,
-			env
-		});
-		await publishSettlementEvidenceForLink({
-			settlementLink,
-			env
-		});
-		appendWalletAuditEntry({
-			action: "send_executed",
-			actor: request.approvedBy,
-			details: buildWalletSendAuditDetails({
-				payload: request.payload,
+		if (!daily.ok) {
+			request.status = "failed";
+			request.reason = daily.message ?? daily.code ?? "wallet daily cap exceeded";
+			request.result = { error: request.reason };
+			request.decisionAt = new Date().toISOString();
+			saveFile(file, env);
+			syncApprovalTaskForRequest({
+				request,
+				settlementLink
+			});
+			appendWalletAuditEntry({
+				action: "send_failed",
+				actor: params.actor?.trim() || "operator",
+				details: {
+					requestId: request.id,
+					reason: request.reason,
+					providerId: request.payload.providerId,
+					walletId: request.payload.walletId,
+					walletName: request.payload.walletName,
+					taskId: settlementLink?.taskId,
+					invoiceId: settlementLink?.invoiceId,
+					senderHandle: settlementLink?.senderHandle
+				},
+				env
+			});
+			markWalletSettlementLinkOutcome({
 				requestId: request.id,
-				txHash: tx.txHash,
-				providerId: selectedProviderId,
-				taskId: settlementLink?.taskId,
-				invoiceId: settlementLink?.invoiceId,
-				senderHandle: settlementLink?.senderHandle,
-				attempts: sent.attempts
-			}),
-			env
-		});
-		saveFile(file, env);
+				status: "failed",
+				reason: request.reason,
+				env
+			});
+			return {
+				ok: false,
+				code: "daily_cap_rejected",
+				message: request.reason,
+				request
+			};
+		}
+		request.status = "approved";
+		request.approvedBy = params.actor?.trim() || "operator";
+		request.decisionAt = new Date().toISOString();
 		syncApprovalTaskForRequest({
 			request,
 			settlementLink
 		});
-		return {
-			ok: true,
-			request,
-			tx
-		};
-	} catch (err) {
-		request.status = "failed";
-		request.reason = walletDiagnosticErrorString(err);
-		request.result = { error: request.reason };
-		markWalletSettlementLinkOutcome({
-			requestId: request.id,
-			status: "failed",
-			reason: request.reason,
-			env
-		});
 		appendWalletAuditEntry({
-			action: "send_failed",
+			action: "send_approved",
 			actor: request.approvedBy,
 			details: {
 				requestId: request.id,
-				reason: request.reason,
-				providerId: request.payload.providerId,
+				chain: request.payload.chain,
+				amount: request.payload.amount,
+				providerId: selectedProviderId,
 				walletId: request.payload.walletId,
 				walletName: request.payload.walletName,
 				taskId: settlementLink?.taskId,
@@ -1243,17 +2453,109 @@ async function approveWalletSendRequest(params) {
 			},
 			env
 		});
-		saveFile(file, env);
-		syncApprovalTaskForRequest({
-			request,
-			settlementLink
-		});
-		return {
-			ok: false,
-			code: "send_failed",
-			message: request.reason,
-			request
-		};
+		const claimedPayload = claim.request.payload;
+		const claimedRequestId = claim.request.id;
+		try {
+			const sent = await executeWalletSendOnce({ execute: async () => await prepareAndSendProviderTransaction({
+				provider,
+				payload: claimedPayload,
+				requestId: claimedRequestId
+			}) });
+			if (!sent.ok) {
+				throw sent.error;
+			}
+			const tx = withSendAttemptMetadata(sent.tx, sent.attempts);
+			request.status = "executed";
+			request.result = { txHash: tx.txHash };
+			const settlementLink = markWalletSettlementLinkOutcome({
+				requestId: request.id,
+				status: "executed",
+				txHash: tx.txHash,
+				env
+			});
+			await publishSettlementEvidenceForLink({
+				settlementLink,
+				env
+			});
+			appendWalletAuditEntry({
+				action: "send_executed",
+				actor: request.approvedBy,
+				details: buildWalletSendAuditDetails({
+					payload: request.payload,
+					requestId: request.id,
+					txHash: tx.txHash,
+					providerId: selectedProviderId,
+					taskId: settlementLink?.taskId,
+					invoiceId: settlementLink?.invoiceId,
+					senderHandle: settlementLink?.senderHandle,
+					attempts: sent.attempts
+				}),
+				env
+			});
+			saveFile(file, env);
+			syncApprovalTaskForRequest({
+				request,
+				settlementLink
+			});
+			return {
+				ok: true,
+				request,
+				tx
+			};
+		} catch (err) {
+			if (err instanceof WalletProviderError && err.code === "wallet_provider_ambiguous") {
+				const message = `${err.message}; reconcile the durable provider review before any retry`;
+				const unknownRequest = await markWalletSendRequestBroadcastUnknown({
+					requestId: request.id,
+					reason: message,
+					actor: params.actor,
+					env
+				});
+				return {
+					ok: false,
+					code: err.code,
+					message,
+					request: unknownRequest
+				};
+			}
+			request.status = "failed";
+			request.reason = walletDiagnosticErrorString(err);
+			request.result = { error: request.reason };
+			markWalletSettlementLinkOutcome({
+				requestId: request.id,
+				status: "failed",
+				reason: request.reason,
+				env
+			});
+			appendWalletAuditEntry({
+				action: "send_failed",
+				actor: request.approvedBy,
+				details: {
+					requestId: request.id,
+					reason: request.reason,
+					providerId: request.payload.providerId,
+					walletId: request.payload.walletId,
+					walletName: request.payload.walletName,
+					taskId: settlementLink?.taskId,
+					invoiceId: settlementLink?.invoiceId,
+					senderHandle: settlementLink?.senderHandle
+				},
+				env
+			});
+			saveFile(file, env);
+			syncApprovalTaskForRequest({
+				request,
+				settlementLink
+			});
+			return {
+				ok: false,
+				code: "send_failed",
+				message: request.reason,
+				request
+			};
+		}
+	} finally {
+		await claim.release();
 	}
 }
 function rejectWalletSendRequest(params) {
@@ -1315,4 +2617,4 @@ function rejectWalletSendRequest(params) {
 }
 
 //#endregion
-export { approveWalletSendRequest, createOrExecuteWalletSend, createWalletSendApprovalRequest, listWalletSendApprovalRequests, rejectWalletSendRequest, sanitizeWalletSendApprovalPayload, sanitizeWalletSendApprovalRequest, wallet_send_approvals_exports };
+export { approveWalletSendRequest, bindSignerReviewToWalletApprovalPayload, createOrExecuteWalletSend, createSignerReviewApprovalRequest, createWalletSendApprovalRequest, getWalletSendApprovalRequest, listWalletSendApprovalRequests, markWalletSendRequestBroadcastUnknown, markWalletSendRequestExecutedExternally, rejectWalletSendRequest, sanitizeWalletSendApprovalPayload, sanitizeWalletSendApprovalRequest, signerReviewBindingMatchesWalletApprovalPayload, signerReviewMatchesWalletApprovalPayload, wallet_send_approvals_exports };