@ghostlytools/cli 1.1.7 → 1.2.1

package/dist/assets/{server-GJW_5wGI.js → server-D5FBZYW8.js}

@@ -1,8 +1,8 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { $i as formatFileSize, $n as GROUP_FILE_LIMITS, $o as handoffEphemeral, $r as WAKE_CALL_INTERVAL_MS, $s as deviceKeyZ32, $t as SEPOLIA_TEST_USDT_FAUCET, A as entryParams, Aa as replySnippet, Ac as createRelayPayload, Ai as IdentityExchange, Ao as LEGACY_SERVICES, Ar as newerHead, As as enrollCancelReason, Ba as claimedTime, Bc as sanitizeAvatar, Bi as emptyProofLedger, Bn as engineText, Bo as HANDOFF_REQUEST, Br as transferStalled, Bs as deviceInviteJoinerParams, C as GROUP_READ_NOTE_COMMUNITY, Ca as reactionEmoji, Ci as DHT_TEXT_CAPABILITY, Cr as beaconRecords, Cs as signTombstone, Da as wireReaction, Dc as withRequestOptions, Dr as lobbyRecords, E as encodeCommunityLink, Ea as validReactionNumber, Ec as isDiscoveryBudgetError, Eo as parseCallSignal, Er as lobbyKeys, Fc as identityFromSeed, Fi as newIdentityBinding, Fo as HANDOFF_HAVE, Fr as readLobby, Fs as enrollProofFrame, G as GROUP_EDIT_TEXT_BYTES, Gc as toZ32, Gn as findEndpoint, Go as handoffAttemptFailed, Gr as typingActivity, Gs as encodeInviteCode, Gt as encodeDidDhtPacket, H as GroupSession, Ha as receivedTimestamp, Hc as fromBase64Url, Hi as TRANSPORTS, Hn as ENDPOINT, Ho as HANDOFF_VERIFIED, Hs as OwnInviteError, Ht as didDhtDocument, I as GroupWakeLimiter, Ia as checkStatusCard, Ic as identityFromSeedB64, Ii as receivedIdentityStatus, Io as HANDOFF_HELLO, Ir as shouldBeHub, Is as readEnrollGrant, J as mentionsMember, Ji as peekDhtMailbox, Jn as parseFedimintRequestPayload, Jo as handoffCancelFrame, Jr as mayPin, Js as DEVICES_CAPABILITY, Jt as ETHEREUM_USDT, K as carryMentions, Ka as appFingerprint, Kc as utf8Decode, Kn as isFederationId, Ko as handoffAttemptSucceeded, L as groupWakeFrame, La as sameButtonText, Lc as publicKeyFromZ32, Li as revokesIdentity, Lo as HANDOFF_OFFER, Lr as ChatFiles, Ls as readEnrollHello, M as knockRecords, Mi as emptyIdentityLedger, Mo as HANDOFF_ACK, Mr as rankHubs, Ms as enrollDoneFrame, N as mergeKnocks, Ni as identityRevocationValue, No as HANDOFF_CANCEL, Nr as readBeacon, Ns as enrollGrantFrame, O as decodeGroupEntryLink, Oa as pairedReplyAuthor, Oc as PacketTooLargeError, Oi as IDENTITY_REVOCATION_LABEL, Oo as emptyLinkRecords, Or as mergeBeacon, P as readKnocks, Pa as STATUS_CARD_LIMITS, Pc as createIdentity, Pi as identityStatement, Po as HANDOFF_DONE, Pr as readBeaconHead, Ps as enrollHelloFrame, Qn as pairedMessageFrame, Qo as handoffDigest, Qr as readPin, Qs as deviceEchoNonce, Qt as SEPOLIA_TEST_USDT, R as groupWakes, Ra as statusCardText, Rc as verify, Ri as lastSharedWithMe, Ro as HANDOFF_PAKE, Rr as FILE_LIMITS, Rs as verifyEnrollProof, S as CommunitySession, Sa as queueReaction, Sc as normalizeRelayUrl, Si as CapsExchange, Sr as beaconKeys, Ss as setUpdateFrame, T as decodeCommunityLink, Ta as readReaction, Tc as budgetRetryMs, Ti as dialDescriptors, Tr as freshHubs, Ua as shownTime, Uc as randomBytes, Ui as automaticTransport, Un as cashuRequestPayload, Uo as filePartName, Ur as TypingSender, Us as createChatInvite, Ut as didDhtFromPublicKey, V as GROUP_READ_NOTE, Va as heardTime, Vc as bytesEqual, Vi as validExternalKey, Vn as decodeBolt11, Vo as HANDOFF_TIMINGS, Vs as readDeviceInvite, Wc as toBase64Url, Wn as fedimintRequestPayload, Wo as handoffAttemptAllowed, Ws as decodeInviteCode, Wt as encodeDidDhtDeactivated, Xa as isAppRef, Xi as dhtFileId, Xn as INVITE_TAKEN, Xo as handoffContextProof, Xr as pinIsNewer, Xs as HANDOFF_CAPABILITY, Xt as ONCHAIN_PROVIDER, Y as groupName, Ya as isAppKey, Yi as DHT_FILE_CAPABILITY, Yn as GhostLink, Yo as handoffContext, Yr as nextPinNumber, Ys as ENROLL_CAPABILITY, Yt as EVM_TEST_CHAINS, Za as readAppRevocations, Zi as parseImageMeta, Zn as LIVENESS_PING_MS, Zo as handoffDataFrame, Zr as pinNumberHolds, Zs as deviceEchoFrame, Zt as PaymentPreflightError, _ as GroupTypingBoard, _a as COMMUNITY_REACTION_FRAME, _c as turnKeys, _i as HOLD_LIMITS, _o as decodeControl, _r as MESH_HUBS, _s as sealHandoffPiece, ai as wakeRequest, an as formatPaymentAmount, ao as rosterHas, as as handoffRetryAfter, b as sealGroupTyping, ba as ReactionWindow, bc as RelayTransport, bi as newMailbox, bo as RTC_CONFIG, br as pickMeshHubs, bs as readSetUpdate, c as APP_BUNDLE_LIMITS, cc as classifyTurnRead, ci as chatAppId, cn as SPARK_NETWORKS, co as DirectPathWatch, cs as newHandoffId, d as appViewOf, da as EDIT_RATE_WINDOW_MS, dc as TURN_MAX, di as BUTTONS_CAPABILITY, dn as sparkInvoiceDetails, do as presenceSeenAt, ds as readHandoffDone, ea as safeBlobType, ec as deviceLinkPairing, ei as WakeLimiter, en as TEST_USDT_FAUCET_AMOUNT, eo as canonicalJson, es as handoffHelloFrame, fa as RateWindow, fc as firstDeviceSetSecret, fi as EDIT_CAPABILITY, fn as isBitcoinAddress, fo as GhostlyHttpError, fs as readHandoffHave, ga as readForwarded, gc as signTurnRelease, gi as HOLD_DATED_BACK_MS, go as LIMITS, gr as readGroupSignal, gs as readHandoffVerified, gt as normalizeAtprotoHandle, h as readAppBundle, ha as forwardedAgain, hc as signTurnPacket, hi as HOLD_CAPABILITY, ho as webLocalFetch, hr as groupSignalFrame, hs as readHandoffTurnFrame, ht as isAtprotoDid, i as planAppUpdate, ic as webCryptoSigner, ii as relayRequest, in as assertWholeSats, io as MEMBER_KEY, ir as groupFileFallback, is as handoffReleaseFrame, j as knockIdentity, ja as BUTTON_ID, jo as serviceIdFromName, jr as pickHubs, js as enrollDigits, k as encodeGroupEntryLink, ka as readReply, ko as HTTP_SERVICE_PROTO, kr as mergeLobby, ks as enrollCancelFrame, l as APP_BUNDLE_MAGIC, la as parseVideoMeta, lc as turnPutSummary, li as isAppVersion, ln as SPARK_PROVIDER, ls as readHandoffAck, m as isAppUrl, ma as parseLinkPreview, mc as readTurnPacket, mi as UPGRADE_CAPABILITY, mn as isPubkyKey, mo as parseLocalTarget, ms as readHandoffPake, n as appUpdateDecision, nc as newDeviceSetSecret, ni as newWakeToken, nn as WALLET_NETWORKS, no as GROUP_MEMBER_CAP, ns as handoffOfferFrame, o as readAppStore, oa as fileMessageText, oc as TURN_RAISE_READ_TIMEOUT_MS, oi as checkPushEndpoint, on as validatePaymentTarget, oo as verifyCommitSignature, or as readGroupFileMeta, os as handoffStreamKey, pa as dhtEditId, pc as nextTurnPosition, pi as STATUS_CARD_CAPABILITY, po as formatLocalTarget, ps as readHandoffHello, q as parseCommunityEdit, qa as appRef, qc as utf8Encode, qi as DHT_MESSAGE_TTL, qn as parseCashuRequestPayload, qo as handoffBusyFrame, qr as PIN_LIMITS, qs as inviteOwnership, qt as signDidDhtPacket, r as checkAppBeforeRun, rc as seedSigner, ri as parseWakeFrame, rn as assertTokenUnits, rs as handoffPakeFrame, sa as parseVoiceMeta, sc as TURN_SETTLE_MS, si as vapidKeysMatch, sn as walletNetworkOf, so as edgeParams, ss as handoffVersions, t as appStoreDecision, tc as devicePingFrame, ti as deviceWakeRequest, tn as USDT_PUBLIC_RPC, ts as handoffManifestFrames, u as appDigest, ua as EDIT_BUFFER_MS, uc as TURN_LAST_SEQUENCE, ui as APPS_CAPABILITY, un as sparkAddressKind, uo as RELAY_POLL_INTERVALS, ur as CarriedTransport, us as readHandoffCancel, v as groupTypingEpoch, va as GROUP_REACTION_FRAME, vc as turnName, vi as HoldKeys, vo as encodeControl, vr as mayBeHub, w as communityHasFrame, wa as reactionIsNewer, wc as traceLink, wi as capsDescriptors, wr as doorHubs, ws as verifySetUpdate, x as COMMUNITY_LIMITS, xa as nextReactionNumber, xc as currentRelays, xi as readManifest, xr as COMMUNITY_TOPOLOGY, xs as setAckFrame, y as openGroupTyping, ya as REACTION_LIMITS, yc as DEFAULT_RELAYS, yi as HoldRefusedError, yr as meshHubs, z as parseGroupWakeFrame, za as arrivalKey, zi as PeerProofs, zn as engineError, zo as HANDOFF_PIECE_BYTES, zr as transferEnded, zs as createDeviceInvite } from "./src-Cp3o_yHN.js";
-import { a as clearProfileStores, c as fileStore, d as store, f as transact, i as STORES$1, l as openDb, n as APP_STORAGE_SCOPE_INDEX, o as databaseName, p as wrap, r as CARD_INDEX, s as deleteDatabase, t as APP_STORAGE_CHAT_INDEX, u as profileOpenFailure } from "./idb-BIdus0WX.js";
-import { a as fileBytesOf, c as removeFileBytes, i as fileBytes, l as FILE_BYTES_STEP, n as blobDigest } from "./fileBytes-3AQ2tJzW.js";
-import { $ as BACKUP_MEDIA_TYPE, A as requireTurn, At as paymentWireId, B as networkLabel, C as breezDatabasesFor, Ct as storedGroupFiles, D as sourceKey, Dt as replyRef, E as ProviderSources, Et as receivedPairedReply, F as sealSeed, Ft as streamStored, G as BITCOIN_INVOICE_ON_TESTNET, H as cashuMint, I as unsealSeed, J as fakesLightning, K as DEFAULT_MINTS, L as ModeChanged, M as setSingleWriterGate, Mt as readStored$1, N as intentRepository, Nt as removeStored, O as awayFrom, Ot as replyTo, P as newDeviceKey, Pt as storedSize, Q as paysItsOwnInvoices, R as ModeGate, S as breezDatabaseInUse, St as groupOfFile, T as lightningPaying, Tt as pairedWireReply, V as CASHU_MINT_SOURCE, W as WALLET_TYPES, X as isWorthlessMint, Y as isTestMint, Z as mintNetwork, _ as LightningCards, _t as verifyIdentity, a as irohRelayProblem, at as reserveAdapterIds, b as normalizePhrase, bt as groupFileId, c as createFailure, ct as SourceConfigError, d as paymentNetwork, dt as networkMode, et as MAX_BACKUP_BYTES, f as paymentNetworksOf, ft as redact, g as CASHU_CARD, gt as boundedIdentityFetch, h as rpcHost, ht as setOwnDidSource, i as createIrohWebEndpoint, it as registeredOnchainProviders, j as setAwayWallets, jt as FileAppender, k as refuseAway, kt as paymentAlias, l as createTiming, lt as SourceUnreachableError, m as networkReason, mt as resolveAtprotoDid, n as loadFedimintSdk, nt as onAdaptersChanged, o as WALLET_NAMES, ot as NothingSpentError, p as walletInstances, pt as assertPublicServer, q as TEST_MINT, r as DEFAULT_IROH_RELAYS, rt as registeredLightningProviders, s as assertConfirmedReal, st as PROVIDER_PLATFORMS, t as fedimintDatabase, tt as identityProviders, u as crossNetwork, ut as isNothingSpentError, v as cardsKey, vt as chosenResolver, w as dropBreezDatabase, wt as groupReply, x as breezDatabase, xt as groupFileText, y as isRecoveryPhrase, yt as GroupFileDesk, z as WrongNetworkError } from "../ghostly.mjs";
+import { $a as appRef, $c as randomBytes, $i as parseImageMeta, $n as engineError, $o as filePartName, $r as pinNumberHolds, $s as createChatInvite, $t as PaymentPreflightError, A as decodeGroupEntryLink, Aa as pairedReplyAuthor, Ac as RelayTransport, Ai as IDENTITY_REVOCATION_LABEL, Ao as RTC_CONFIG, Ar as mergeBeacon, As as readSetUpdate, B as groupWakes, Bc as createRelayPayload, Bi as lastSharedWithMe, Bo as LEGACY_SERVICES, Br as FILE_LIMITS, Bs as enrollCancelReason, C as COMMUNITY_LIMITS, Ca as nextReactionNumber, Cc as nextTurnPosition, Ci as readManifest, Co as formatLocalTarget, Cr as COMMUNITY_TOPOLOGY, Cs as readHandoffHello, D as decodeCommunityLink, Da as readReaction, Dc as turnKeys, Di as dialDescriptors, Do as decodeControl, Dr as freshHubs, Ds as sealHandoffPiece, E as communityHasFrame, Ea as reactionIsNewer, Ec as signTurnRelease, Ei as capsDescriptors, Eo as LIMITS, Er as doorHubs, Es as readHandoffVerified, F as mergeKnocks, Fc as budgetRetryMs, Fi as identityRevocationValue, Fr as readBeacon, Ga as arrivalKey, Gc as identityFromSeed, Gi as automaticTransport, Gn as findEndpoint, Go as HANDOFF_HAVE, Gr as TypingSender, Gs as enrollProofFrame, Gt as didDhtFromPublicKey, Ha as checkStatusCard, Hi as emptyProofLedger, Hn as ENDPOINT, Ho as HANDOFF_ACK, Hr as transferStalled, Hs as enrollDoneFrame, I as readKnocks, Ic as isDiscoveryBudgetError, Ii as identityStatement, Io as parseCallSignal, Ir as readBeaconHead, J as carryMentions, Ja as receivedTimestamp, Jc as verify, Jn as parseFedimintRequestPayload, Jo as HANDOFF_PAKE, Js as verifyEnrollProof, Ka as claimedTime, Kc as identityFromSeedB64, Kn as isFederationId, Ko as HANDOFF_HELLO, Ks as readEnrollGrant, Kt as encodeDidDhtDeactivated, Lc as withRequestOptions, Li as newIdentityBinding, Lr as readLobby, M as entryParams, Ma as replySnippet, Mc as normalizeRelayUrl, Mi as IdentityExchange, Mr as newerHead, Ms as setUpdateFrame, N as knockIdentity, Na as BUTTON_ID, Nr as pickHubs, Ns as signTombstone, O as encodeCommunityLink, Oa as validReactionNumber, Oc as turnName, Oo as encodeControl, Or as lobbyKeys, P as knockRecords, Pc as traceLink, Pi as emptyIdentityLedger, Pr as rankHubs, Ps as verifySetUpdate, Qa as appFingerprint, Qc as fromBase64Url, Qi as dhtFileId, Qn as pairedMessageFrame, Qo as HANDOFF_VERIFIED, Qr as pinIsNewer, Qs as OwnInviteError, Qt as ONCHAIN_PROVIDER, R as GroupWakeLimiter, Ra as STATUS_CARD_LIMITS, Rc as PacketTooLargeError, Ri as receivedIdentityStatus, Ro as emptyLinkRecords, Rr as shouldBeHub, S as sealGroupTyping, Sa as ReactionWindow, Sc as firstDeviceSetSecret, Si as newMailbox, So as GhostlyHttpError, Sr as pickMeshHubs, Ss as readHandoffHave, T as GROUP_READ_NOTE_COMMUNITY, Ta as reactionEmoji, Tc as signTurnPacket, Ti as DHT_TEXT_CAPABILITY, To as webLocalFetch, Tr as beaconRecords, Ts as readHandoffTurnFrame, U as GROUP_READ_NOTE, Ua as sameButtonText, Ui as validExternalKey, Un as cashuRequestPayload, Uo as HANDOFF_CANCEL, Us as enrollGrantFrame, V as parseGroupWakeFrame, Vi as PeerProofs, Vn as decodeBolt11, Vo as serviceIdFromName, Vr as transferEnded, Vs as enrollDigits, W as GroupSession, Wa as statusCardText, Wc as createIdentity, Wi as TRANSPORTS, Wn as fedimintRequestPayload, Wo as HANDOFF_DONE, Ws as enrollHelloFrame, Wt as didDhtDocument, X as mentionsMember, Xc as sanitizeAvatar, Xi as peekDhtMailbox, Xn as INVITE_TAKEN, Xo as HANDOFF_REQUEST, Xr as mayPin, Xs as deviceInviteJoinerParams, Xt as ETHEREUM_USDT, Y as parseCommunityEdit, Ya as shownTime, Yi as DHT_MESSAGE_TTL, Yn as GhostLink, Yo as HANDOFF_PIECE_BYTES, Yr as PIN_LIMITS, Ys as createDeviceInvite, Yt as signDidDhtPacket, Z as groupName, Za as APP_STATEMENT_LIMITS, Zc as bytesEqual, Zi as DHT_FILE_CAPABILITY, Zn as LIVENESS_PING_MS, Zo as HANDOFF_TIMINGS, Zr as nextPinNumber, Zs as readDeviceInvite, Zt as EVM_TEST_CHAINS, _ as readAppBundle, _a as forwardedAgain, _c as TURN_SETTLE_MS, _i as HOLD_CAPABILITY, _o as DirectPathWatch, _r as groupSignalFrame, _s as handoffVersions, _t as isAtprotoDid, a as planAppUpdate, ac as ENROLL_CAPABILITY, ai as parseWakeFrame, an as assertTokenUnits, as as handoffContext, b as groupTypingEpoch, ba as GROUP_REACTION_FRAME, bc as TURN_LAST_SEQUENCE, bi as HoldKeys, bo as RELAY_POLL_INTERVALS, br as mayBeHub, bs as readHandoffCancel, ca as fileMessageText, cc as deviceEchoNonce, ci as checkPushEndpoint, cn as validatePaymentTarget, cr as readGroupFileMeta, cs as handoffDigest, da as parseVideoMeta, dc as devicePingFrame, di as isAppVersion, dn as SPARK_PROVIDER, ds as handoffManifestFrames, ec as decodeInviteCode, ei as readPin, el as toBase64Url, en as SEPOLIA_TEST_USDT, er as engineText, es as handoffAttemptAllowed, f as appDigest, fa as EDIT_BUFFER_MS, fc as newDeviceSetSecret, fi as APPS_CAPABILITY, fn as sparkAddressKind, fo as MEMBER_KEY, fr as CarriedTransport, fs as handoffOfferFrame, g as isAppUrl, ga as parseLinkPreview, gc as TURN_RAISE_READ_TIMEOUT_MS, gi as UPGRADE_CAPABILITY, gn as isPubkyKey, go as edgeParams, gs as handoffStreamKey, ha as dhtEditId, hi as STATUS_CARD_CAPABILITY, ho as verifyCommitSignature, hs as handoffRetryAfter, i as checkAppBeforeRun, ia as sanitizeMime, ic as DEVICES_CAPABILITY, ii as newWakeToken, in as WALLET_NETWORKS, is as handoffCancelFrame, j as encodeGroupEntryLink, ja as readReply, jc as currentRelays, jr as mergeLobby, js as setAckFrame, ka as wireReaction, kc as DEFAULT_RELAYS, kr as lobbyRecords, l as APP_BUNDLE_LIMITS, la as parseVoiceMeta, lc as deviceKeyZ32, li as vapidKeysMatch, ln as walletNetworkOf, lo as readCanonicalJson, ls as handoffEphemeral, ma as RateWindow, mc as webCryptoSigner, mi as EDIT_CAPABILITY, mn as isBitcoinAddress, mo as rosterHas, ms as handoffReleaseFrame, n as appStoreDecision, na as safeBlobType, ni as WakeLimiter, nl as utf8Decode, nn as TEST_USDT_FAUCET_AMOUNT, no as isAppRef, ns as handoffAttemptSucceeded, oc as HANDOFF_CAPABILITY, oi as relayRequest, on as assertWholeSats, or as groupFileFallback, os as handoffContextProof, p as appViewOf, pa as EDIT_RATE_WINDOW_MS, pc as seedSigner, pi as BUTTONS_CAPABILITY, pn as sparkInvoiceDetails, po as commitHash, ps as handoffPakeFrame, q as GROUP_EDIT_TEXT_BYTES, qa as heardTime, qc as publicKeyFromZ32, qn as parseCashuRequestPayload, qo as HANDOFF_OFFER, qr as typingActivity, qs as readEnrollHello, qt as encodeDidDhtPacket, r as appUpdateDecision, ra as sanitizeFileName, rc as inviteOwnership, ri as deviceWakeRequest, rl as utf8Encode, rn as USDT_PUBLIC_RPC, ro as readAppRevocation, rs as handoffBusyFrame, s as readAppStore, sc as deviceEchoFrame, si as wakeRequest, sn as formatPaymentAmount, so as canonicalJson, ss as handoffDataFrame, t as appRevocationFor, ta as formatFileSize, tc as encodeInviteCode, ti as WAKE_CALL_INTERVAL_MS, tl as toZ32, to as isAppKey, tr as GROUP_FILE_LIMITS, ts as handoffAttemptFailed, u as APP_BUNDLE_MAGIC, uc as deviceLinkPairing, ui as chatAppId, un as SPARK_NETWORKS, uo as GROUP_MEMBER_CAP, us as handoffHelloFrame, va as readForwarded, vc as classifyTurnRead, vi as HOLD_DATED_BACK_MS, vo as DHT_POLL_INTERVALS, vr as readGroupSignal, vs as newHandoffId, vt as normalizeAtprotoHandle, w as CommunitySession, wa as queueReaction, wc as readTurnPacket, wi as CapsExchange, wo as parseLocalTarget, wr as beaconKeys, ws as readHandoffPake, x as openGroupTyping, xa as REACTION_LIMITS, xc as TURN_MAX, xi as HoldRefusedError, xo as presenceSeenAt, xr as meshHubs, xs as readHandoffDone, y as GroupTypingBoard, ya as COMMUNITY_REACTION_FRAME, yc as turnPutSummary, yi as HOLD_LIMITS, yr as MESH_HUBS, ys as readHandoffAck, z as groupWakeFrame, zi as revokesIdentity, zo as HTTP_SERVICE_PROTO, zr as ChatFiles, zs as enrollCancelFrame } from "./src-aKGjb_yz.js";
+import { a as clearProfileStores, c as fileStore, d as profileOpenFailure, f as store, i as STORES$1, l as newestWalletTx, m as wrap, n as APP_STORAGE_SCOPE_INDEX, o as databaseName, p as transact, r as CARD_INDEX, s as deleteDatabase, t as APP_STORAGE_CHAT_INDEX, u as openDb } from "./idb-CTF6LF5B.js";
+import { a as fileBytesOf, c as removeFileBytes, i as fileBytes, l as FILE_BYTES_STEP, n as blobDigest } from "./fileBytes-BcYZhNgF.js";
+import { $ as BACKUP_MEDIA_TYPE, A as requireTurn, At as paymentWireId, B as networkLabel, C as breezDatabasesFor, Ct as storedGroupFiles, D as sourceKey, Dt as replyRef, E as ProviderSources, Et as receivedPairedReply, F as sealSeed, Ft as streamStored, G as BITCOIN_INVOICE_ON_TESTNET, H as cashuMint, I as unsealSeed, J as fakesLightning, K as DEFAULT_MINTS, L as ModeChanged, M as setSingleWriterGate, Mt as readStored$1, N as intentRepository, Nt as removeStored, O as awayFrom, Ot as replyTo, P as newDeviceKey, Pt as storedSize, Q as paysItsOwnInvoices, R as ModeGate, S as breezDatabaseInUse, St as groupOfFile, T as lightningPaying, Tt as pairedWireReply, V as CASHU_MINT_SOURCE, W as WALLET_TYPES, X as isWorthlessMint, Y as isTestMint, Z as mintNetwork, _ as LightningCards, _t as verifyIdentity, a as irohRelayProblem, at as reserveAdapterIds, b as normalizePhrase, bt as groupFileId, c as createFailure, ct as SourceConfigError, d as paymentNetwork, dt as networkMode, et as MAX_BACKUP_BYTES, f as paymentNetworksOf, ft as redact, g as CASHU_CARD, gt as boundedIdentityFetch, ht as setOwnDidSource, i as createIrohWebEndpoint, it as registeredOnchainProviders, j as setAwayWallets, jt as FileAppender, k as refuseAway, kt as paymentAlias, l as createTiming, lt as SourceUnreachableError, mt as resolveAtprotoDid, n as loadFedimintSdk, nt as onAdaptersChanged, o as WALLET_NAMES, ot as NothingSpentError, p as walletInstances, pt as assertPublicServer, q as TEST_MINT, r as DEFAULT_IROH_RELAYS, rt as registeredLightningProviders, s as assertConfirmedReal, st as PROVIDER_PLATFORMS, t as fedimintDatabase, tt as identityProviders, u as crossNetwork, ut as isNothingSpentError, v as cardsKey, vt as chosenResolver, w as dropBreezDatabase, wt as groupReply, x as breezDatabase, xt as groupFileText, y as isRecoveryPhrase, yt as GroupFileDesk, z as WrongNetworkError } from "../ghostly.mjs";
 import { n as traceJoin } from "./joinTrace-CO8mlhNO.js";
 import { hkdf } from "@noble/hashes/hkdf.js";
 import { sha256 } from "@noble/hashes/sha2.js";
@@ -14,12 +14,8 @@ import { wordlist } from "@scure/bip39/wordlists/english.js";
 import { decode, noteEncode, npubEncode } from "nostr-tools/nip19";
 import { finalizeEvent, getPublicKey, verifyEvent } from "nostr-tools/pure";
 import { generateMnemonic, mnemonicToSeedSync, validateMnemonic } from "@scure/bip39";
-import WalletManagerEvm from "@tetherto/wdk-wallet-evm";
-import { Interface, Transaction, getAddress, keccak256 } from "ethers";
-import { ArkAddress, EsploraProvider, IndexedDBContractRepository, IndexedDBWalletRepository, MnemonicIdentity, RestArkProvider, RestIndexerProvider, Transaction as Transaction$1, Wallet, assertAllowedSighashTypes, assertSubmittedArkTxid, canRecoverOnchain, isRecoverable, matchServerCheckpoints, verifyTapscriptSignatures } from "@arkade-os/sdk";
-import { tapLeafHash } from "@scure/btc-signer/payment.js";
-import { Amount, MeltChangeError, OutputData, Wallet as Wallet$1, decodePaymentRequest, deserializeSwapPreview, getEncodedToken, getTokenMetadata, isMintOperationError, serializeSwapPreview } from "@cashu/cashu-ts";
-import { Transaction as Transaction$2 } from "@scure/btc-signer";
+import { Amount, MeltChangeError, OutputData, Wallet, decodePaymentRequest, deserializeSwapPreview, getEncodedToken, getTokenMetadata, isMintOperationError, serializeSwapPreview } from "@cashu/cashu-ts";
+import { Address, OutScript, Transaction } from "@scure/btc-signer";
 import * as nip04 from "nostr-tools/nip04";
 import * as nip44 from "nostr-tools/nip44";
 /** Evidence older than this says nothing about the clock now. */
@@ -182,409 +178,9 @@ async function migrateWalletNetworks(now = Date.now()) {
 	return report;
 }
 //#endregion
-//#region ../browser/src/engine/paymentAdapters/usdt.ts
-var faucet = new Interface(["function mint(address token,address to,uint256 amount) returns (uint256)"]);
-var erc20 = new Interface([
-	"function decimals() view returns(uint8)",
-	"function balanceOf(address) view returns(uint256)",
-	"function transfer(address,uint256) returns(bool)",
-	"event Transfer(address indexed from,address indexed to,uint256 value)"
-]);
-var same$1 = (a, b) => a.toLowerCase() === b.toLowerCase();
-var CONFIRMATIONS = 2;
-/** The JSON-RPC methods that only read: asked again once when they fail (see `UsdtAdapter.rpc`). */
-var RETRIED_READS = /* @__PURE__ */ new Set([
-	"eth_chainId",
-	"eth_getCode",
-	"eth_call",
-	"eth_getBalance",
-	"eth_blockNumber",
-	"eth_getLogs",
-	"eth_getTransactionCount",
-	"eth_estimateGas",
-	"eth_getBlockByNumber",
-	"eth_maxPriorityFeePerGas",
-	"eth_gasPrice",
-	"eth_feeHistory",
-	"eth_getTransactionByHash",
-	"eth_getTransactionReceipt"
-]);
-var RETRY_AFTER_MS = 1e3;
-/** Failures that would fail the same way again at once: not retried. */
-var FINAL = /* @__PURE__ */ new WeakSet();
-var timedOut = (error) => error instanceof Error && (error.name === "AbortError" || error.name === "TimeoutError");
-/**
-* The `provider` a request carries to the contact. Which RPC pays is the payer's own choice, so it names none of
-* this wallet's: a typed RPC URL may hold an API key (`/v3/<key>`), and every contact would read it. Older apps
-* require a URL here and pay only when it equals their own RPC, so it is the chain's public RPC (the default both
-* start with), and a local test chain's origin, without its path.
-*/
-function wireProvider(config) {
-	return config.network === "evm-local" ? new URL(config.provider).origin : USDT_PUBLIC_RPC[config.network];
-}
-/** WDK signs locally. Every network call uses the configured RPC, never a peer-supplied URL. */
-var UsdtAdapter = class UsdtAdapter {
-	config;
-	method = "usdt";
-	manager;
-	account;
-	mnemonic = "";
-	nextId = 0;
-	queue = Promise.resolve();
-	constructor(config) {
-		this.config = config;
-	}
-	static async inspect(config) {
-		if (config.network === "ethereum" ? config.chainId !== 1 || !same$1(config.token, "0xdAC17F958D2ee523a2206206994597C13D831ec7") : !(config.network in EVM_TEST_CHAINS) || config.chainId !== EVM_TEST_CHAINS[config.network]) throw new Error("Unsupported USDT network or contract");
-		const token = getAddress(config.token);
-		const url = new URL(config.provider);
-		if (url.username || url.password || url.search || url.hash || url.protocol !== "https:" && !(url.protocol === "http:" && [
-			"localhost",
-			"127.0.0.1",
-			"[::1]"
-		].includes(url.hostname))) throw new Error("Use HTTPS or a loopback test RPC");
-		const adapter = new UsdtAdapter({
-			...config,
-			token,
-			decimals: 6,
-			codeHash: ""
-		});
-		await adapter.chain();
-		const code = await adapter.rpc("eth_getCode", [token, "latest"]);
-		if (code === "0x") throw new Error("No token contract exists on this chain");
-		const result = await adapter.rpc("eth_call", [{
-			to: token,
-			data: erc20.encodeFunctionData("decimals")
-		}, "latest"]);
-		const decimals = Number(erc20.decodeFunctionResult("decimals", result)[0]);
-		if (!Number.isInteger(decimals) || decimals < 0 || decimals > 18 || config.chainId === 1 && decimals !== 6) throw new Error("Unexpected token decimals");
-		return {
-			...config,
-			token,
-			decimals,
-			codeHash: keccak256(code)
-		};
-	}
-	static async connect(config, mnemonic) {
-		const inspected = await UsdtAdapter.inspect(config);
-		if (inspected.decimals !== config.decimals || inspected.codeHash !== config.codeHash) throw new Error("Token metadata changed; do not use this wallet configuration");
-		const adapter = new UsdtAdapter(config);
-		adapter.mnemonic = mnemonic;
-		const seed = mnemonicToSeedSync(mnemonic);
-		try {
-			adapter.manager = new WalletManagerEvm(seed, {
-				provider: { request: ({ method, params }) => adapter.rpc(method, params ?? []) },
-				chainId: config.chainId
-			});
-		} finally {
-			seed.fill(0);
-		}
-		adapter.account = await adapter.manager.getAccount(0);
-		return adapter;
-	}
-	/**
-	* A read that fails is asked again, once, a moment later: a public RPC drops a request now and then, and a chain that
-	* just made a block can refuse a read of "latest" it no longer holds. Without it a network switch, a restore or New
-	* gave up on the first such answer. Never a broadcast or anything else that writes, nor a request that did not answer
-	* in time (the person would wait twice as long), nor one the server refused as such (4xx).
-	*/
-	async rpc(method, params = []) {
-		try {
-			return await this.ask(method, params);
-		} catch (error) {
-			if (!RETRIED_READS.has(method) || FINAL.has(error)) throw error;
-			await new Promise((resolve) => setTimeout(resolve, RETRY_AFTER_MS));
-			return this.ask(method, params);
-		}
-	}
-	async ask(method, params) {
-		let response;
-		try {
-			response = await fetch(this.config.provider, {
-				method: "POST",
-				headers: { "Content-Type": "application/json" },
-				body: JSON.stringify({
-					jsonrpc: "2.0",
-					id: ++this.nextId,
-					method,
-					params
-				}),
-				signal: AbortSignal.timeout(15e3)
-			});
-		} catch (error) {
-			const reason = networkReason(error, rpcHost(this.config.provider));
-			const thrown = reason ? Object.assign(new Error(reason), { cause: error }) : error;
-			if (timedOut(error) && thrown && typeof thrown === "object") FINAL.add(thrown);
-			throw thrown;
-		}
-		if (!response.ok) {
-			const error = engineError("usdtRpcUnavailable");
-			if (response.status !== 429 && response.status < 500) FINAL.add(error);
-			throw error;
-		}
-		const result = await response.json();
-		if (result.error || !Object.prototype.hasOwnProperty.call(result, "result")) throw new Error("USDT RPC rejected the operation");
-		return result.result;
-	}
-	async chain() {
-		if (BigInt(await this.rpc("eth_chainId")) !== BigInt(this.config.chainId)) throw new Error("RPC chain does not match this wallet");
-	}
-	async assertToken() {
-		await this.chain();
-		const code = await this.rpc("eth_getCode", [this.config.token, "latest"]);
-		if (code === "0x" || keccak256(code) !== this.config.codeHash) throw new Error("Token contract changed");
-	}
-	/**
-	* Sepolia only: asks Aave's public faucet for test USDT, to this wallet, paid with its own test ETH.
-	* Everything is fixed here (chain, contract, token, amount, recipient): nothing comes from outside.
-	*/
-	mintTestTokens() {
-		return this.serial(async () => {
-			if (this.config.chainId !== EVM_TEST_CHAINS.sepolia || !same$1(this.config.token, "0xaA8E23Fb1079EA71e0a56F48a2aA51851D8433D0")) throw new Error("Test USDT comes from a faucet on Sepolia only");
-			await this.chain();
-			const account = this.current(), from = await account.getAddress();
-			const data = faucet.encodeFunctionData("mint", [
-				SEPOLIA_TEST_USDT,
-				from,
-				BigInt(TEST_USDT_FAUCET_AMOUNT)
-			]);
-			const nonce = Number(BigInt(await this.rpc("eth_getTransactionCount", [from, "pending"])));
-			const estimate = BigInt(await this.rpc("eth_estimateGas", [{
-				from,
-				to: SEPOLIA_TEST_USDT_FAUCET,
-				data,
-				value: "0x0"
-			}]));
-			const block = await this.rpc("eth_getBlockByNumber", ["latest", false]);
-			if (!block.baseFeePerGas) throw new Error("This wallet requires an EIP-1559 chain");
-			const priority = BigInt(await this.rpc("eth_maxPriorityFeePerGas"));
-			const maxFeePerGas = BigInt(block.baseFeePerGas) * 2n + priority, gasLimit = (estimate * 120n + 99n) / 100n;
-			if (BigInt((await this.balances()).gasBalance) < gasLimit * maxFeePerGas) throw engineError("usdtNeedsSepoliaGas");
-			const raw = await account.signTransaction({
-				type: 2,
-				to: SEPOLIA_TEST_USDT_FAUCET,
-				data,
-				value: 0n,
-				chainId: this.config.chainId,
-				nonce,
-				gasLimit,
-				maxFeePerGas,
-				maxPriorityFeePerGas: priority
-			});
-			await account.sendTransaction(raw);
-			return Transaction.from(raw).hash;
-		});
-	}
-	current() {
-		if (!this.account) throw new Error("Unlock the USDT wallet first");
-		return this.account;
-	}
-	address() {
-		return this.current().getAddress();
-	}
-	async balances() {
-		await this.assertToken();
-		const address = await this.address();
-		const [token, gas] = await Promise.all([this.rpc("eth_call", [{
-			to: this.config.token,
-			data: erc20.encodeFunctionData("balanceOf", [address])
-		}, "latest"]), this.rpc("eth_getBalance", [address, "pending"])]);
-		return {
-			balance: erc20.decodeFunctionResult("balanceOf", token)[0].toString(),
-			gasBalance: BigInt(gas).toString()
-		};
-	}
-	async target() {
-		const now = Date.now();
-		return {
-			method: "usdt",
-			network: this.config.network,
-			provider: wireProvider(this.config),
-			asset: this.config.chainId === 1 ? "USDT" : "TEST-USDT",
-			unit: "token-base",
-			address: await this.address(),
-			chainId: this.config.chainId,
-			token: this.config.token,
-			decimals: this.config.decimals,
-			issuedAt: now,
-			expiresAt: now + 9e5
-		};
-	}
-	/** The request is for this wallet's token on its chain. Its `provider` is not compared: this wallet's own RPC pays. */
-	matches(target) {
-		validatePaymentTarget(target);
-		if (target.method !== "usdt" || target.network !== this.config.network || target.chainId !== this.config.chainId || !same$1(target.token, this.config.token) || target.decimals !== this.config.decimals) throw new Error("Request does not match the configured token and network");
-	}
-	prepare(target, amount, feeCap) {
-		return this.serial(async () => {
-			this.matches(target);
-			await this.assertToken();
-			const from = await this.address(), to = this.config.token;
-			if (same$1(target.address, from) || same$1(target.address, to)) throw new Error("Choose a different recipient address");
-			const { balance, gasBalance } = await this.balances();
-			if (BigInt(balance) < BigInt(amount)) throw engineError("usdtNotEnoughTokens");
-			const data = erc20.encodeFunctionData("transfer", [getAddress(target.address), BigInt(amount)]);
-			const nonce = Number(BigInt(await this.rpc("eth_getTransactionCount", [from, "pending"])));
-			if (!Number.isSafeInteger(nonce)) throw new Error("Invalid account nonce");
-			const estimate = BigInt(await this.rpc("eth_estimateGas", [{
-				from,
-				to,
-				data,
-				value: "0x0"
-			}]));
-			const block = await this.rpc("eth_getBlockByNumber", ["latest", false]);
-			if (!block.baseFeePerGas) throw new Error("This wallet requires an EIP-1559 chain");
-			const priority = BigInt(await this.rpc("eth_maxPriorityFeePerGas"));
-			const maxFee = BigInt(block.baseFeePerGas) * 2n + priority;
-			const gasLimit = (estimate * 120n + 99n) / 100n;
-			const maximum = gasLimit * maxFee;
-			if (maximum > BigInt(feeCap) || maximum > BigInt(Number.MAX_SAFE_INTEGER)) throw engineError("usdtGasAboveLimit");
-			if (BigInt(gasBalance) < maximum) throw engineError("usdtNotEnoughGas");
-			const prepared = {
-				from,
-				to,
-				data,
-				value: "0",
-				chainId: this.config.chainId,
-				nonce,
-				gasLimit: gasLimit.toString(),
-				maxFeePerGas: maxFee.toString(),
-				maxPriorityFeePerGas: priority.toString()
-			};
-			return {
-				fee: Number(maximum),
-				prepared,
-				evm: {
-					from,
-					nonce,
-					gasLimit: prepared.gasLimit,
-					maxFeePerGas: prepared.maxFeePerGas,
-					maxPriorityFeePerGas: prepared.maxPriorityFeePerGas,
-					confirmations: CONFIRMATIONS
-				}
-			};
-		});
-	}
-	verifyPrepared(review, tx) {
-		if (tx.chainId !== this.config.chainId || !same$1(tx.to, this.config.token) || tx.value !== "0" || tx.data !== erc20.encodeFunctionData("transfer", [getAddress(review.address), BigInt(review.amount)]) || BigInt(tx.gasLimit) * BigInt(tx.maxFeePerGas) !== BigInt(review.fee) || review.fee > review.feeCap || tx.nonce !== review.evm?.nonce || !same$1(tx.from, review.evm?.from ?? "")) throw new Error("Transaction no longer matches the approved review");
-	}
-	verifySigned(raw, saved) {
-		const tx = Transaction.from(raw);
-		if (!tx.hash || !tx.from || !same$1(tx.from, saved.from) || tx.chainId !== BigInt(saved.chainId) || !tx.to || !same$1(tx.to, saved.to) || tx.data !== saved.data || tx.value !== 0n || tx.nonce !== saved.nonce || tx.gasLimit !== BigInt(saved.gasLimit) || tx.maxFeePerGas !== BigInt(saved.maxFeePerGas) || tx.maxPriorityFeePerGas !== BigInt(saved.maxPriorityFeePerGas)) throw new Error("Signature does not match the approved transaction");
-		return tx.hash;
-	}
-	execute(review, prepared, persist) {
-		return this.serial(async () => {
-			let account;
-			try {
-				this.matches(review);
-				this.verifyPrepared(review, prepared);
-				await this.assertToken();
-				account = this.current();
-				if (!same$1(await account.getAddress(), prepared.from)) throw new Error("Wrong wallet");
-				if (Number(BigInt(await this.rpc("eth_getTransactionCount", [prepared.from, "pending"]))) !== prepared.nonce) throw new Error("Account nonce changed. Create a new review");
-				const balances = await this.balances();
-				if (BigInt(balances.balance) < BigInt(review.amount) || BigInt(balances.gasBalance) < BigInt(review.fee)) throw new Error("Token or gas balance changed. Create a new review");
-				if (!persist) throw new Error("Durable payment journal required");
-			} catch (error) {
-				throw new PaymentPreflightError(error instanceof Error ? error.message : "Could not validate payment");
-			}
-			const raw = await account.signTransaction({
-				type: 2,
-				to: prepared.to,
-				data: prepared.data,
-				value: 0n,
-				chainId: prepared.chainId,
-				nonce: prepared.nonce,
-				gasLimit: BigInt(prepared.gasLimit),
-				maxFeePerGas: BigInt(prepared.maxFeePerGas),
-				maxPriorityFeePerGas: BigInt(prepared.maxPriorityFeePerGas)
-			});
-			prepared.hash = this.verifySigned(raw, prepared);
-			prepared.signed = await sealSeed(raw, this.mnemonic);
-			await persist();
-			await account.sendTransaction(raw);
-			return this.receipt(prepared.hash, review, prepared.from);
-		});
-	}
-	reconcile(review, prepared) {
-		return this.serial(async () => {
-			await this.assertToken();
-			this.verifyPrepared(review, prepared);
-			if (!prepared.signed || !prepared.hash) return {
-				settled: false,
-				failed: true,
-				error: "No signed transaction was submitted. Create a new review."
-			};
-			const result = await this.receipt(prepared.hash, review, prepared.from);
-			if (result.settled || result.failed || result.pending) return result;
-			if (Number(BigInt(await this.rpc("eth_getTransactionCount", [prepared.from, "pending"]))) > prepared.nonce) return result;
-			const raw = await unsealSeed(prepared.signed, this.mnemonic);
-			if (this.verifySigned(raw, prepared) !== prepared.hash || !same$1(await this.address(), prepared.from)) throw new Error("Recovery wallet mismatch");
-			await this.current().sendTransaction(raw);
-			return this.receipt(prepared.hash, review, prepared.from);
-		});
-	}
-	async receipt(hash, target, expectedFrom) {
-		if (!/^0x[0-9a-fA-F]{64}$/.test(hash) || target.chainId !== this.config.chainId || !same$1(target.token ?? "", this.config.token) || target.decimals !== this.config.decimals) throw new Error("Invalid receipt target");
-		await this.assertToken();
-		const tx = await this.rpc("eth_getTransactionByHash", [hash]);
-		if (!tx) return {
-			txid: hash,
-			settled: false
-		};
-		if (!same$1(tx.to, this.config.token) || expectedFrom && !same$1(tx.from, expectedFrom) || BigInt(tx.value) !== 0n || tx.input !== erc20.encodeFunctionData("transfer", [getAddress(target.address), BigInt(target.amount)])) throw new Error("Transaction is not the requested token transfer");
-		const receipt = await this.rpc("eth_getTransactionReceipt", [hash]);
-		if (!receipt) return {
-			txid: hash,
-			settled: false,
-			pending: true
-		};
-		const block = await this.rpc("eth_getBlockByNumber", [receipt.blockNumber, false]);
-		if (!block || block.hash !== receipt.blockHash || BigInt(block.timestamp) * 1000n < BigInt((target.issuedAt ?? 0) - 1e3)) return {
-			txid: hash,
-			settled: false
-		};
-		if (BigInt(await this.rpc("eth_blockNumber")) - BigInt(receipt.blockNumber) + 1n < BigInt(CONFIRMATIONS)) return {
-			txid: hash,
-			settled: false,
-			pending: true
-		};
-		if (BigInt(receipt.status) !== 1n) return {
-			txid: hash,
-			settled: false,
-			failed: true,
-			error: "Transaction reverted. Tokens were not sent; gas was spent."
-		};
-		if (!receipt.logs.some((log) => {
-			if (!same$1(log.address, this.config.token)) return false;
-			try {
-				const event = erc20.parseLog(log);
-				return event?.name === "Transfer" && same$1(event.args[0], tx.from) && same$1(event.args[1], target.address) && event.args[2] === BigInt(target.amount);
-			} catch {
-				return false;
-			}
-		})) throw new Error("Receipt has no matching token Transfer");
-		return {
-			txid: hash,
-			settled: true
-		};
-	}
-	async dispose() {
-		await this.queue.catch(() => {});
-		this.account = void 0;
-		this.manager?.dispose();
-		this.manager = void 0;
-		this.mnemonic = "";
-	}
-	serial(work) {
-		const operation = this.queue.then(work, work);
-		this.queue = operation.catch(() => {});
-		return operation;
-	}
-};
-//#endregion
 //#region ../browser/src/engine/paymentAdapters/usdtWallet.ts
+/** The Ethereum libraries, a large part of the app: loaded once a USDT wallet is made, opened or restored, not with the engine. */
+var loadUsdt = () => import("./usdt-CUfucwZf.js");
 /** Every new profile starts with this wallet: an address to receive on, nothing to set up. */
 var DEFAULT_USDT = {
 	network: "ethereum",
@@ -707,6 +303,7 @@ var UsdtWallet = class {
 		if (!validateMnemonic(mnemonic, wordlist)) throw new Error("Invalid recovery phrase");
 		const deviceKey = params.password ? void 0 : newDeviceKey();
 		const seed = await sealSeed(mnemonic, params.password ?? deviceKey);
+		const { UsdtAdapter } = await loadUsdt();
 		const config = await this.gate.within(UsdtAdapter.inspect({
 			network: params.network,
 			chainId: params.network === "ethereum" ? 1 : EVM_TEST_CHAINS[params.network],
@@ -755,6 +352,7 @@ var UsdtWallet = class {
 		if (!key) throw new Error("Enter the USDT wallet password");
 		const epoch = ++this.epoch;
 		const mnemonic = await unsealSeed(this.saved.seed, key);
+		const { UsdtAdapter } = await loadUsdt();
 		const adapter = await this.gate.within(UsdtAdapter.connect(this.saved.config, mnemonic), (a) => a.dispose());
 		if (epoch !== this.epoch) {
 			await adapter.dispose();
@@ -872,7 +470,7 @@ var UsdtWallet = class {
 			const payload = JSON.parse(await unsealSeed(envelope.vault, password));
 			if (payload.format !== "ghostly-usdt" || payload.version !== 1 || !validateMnemonic(payload.mnemonic, wordlist) || !Array.isArray(payload.intents)) throw new Error("Invalid USDT backup");
 			if (usdtMode(payload.config.network) !== this.network) throw new WrongNetworkError(usdtMode(payload.config.network), `This backup is a ${networkLabel(usdtMode(payload.config.network))} USDT wallet`);
-			const config = await UsdtAdapter.inspect(payload.config);
+			const config = await (await loadUsdt()).UsdtAdapter.inspect(payload.config);
 			if (config.codeHash !== payload.config.codeHash || config.decimals !== payload.config.decimals || payload.intents.some((i) => i.review.method !== "usdt" || i.review.chainId !== config.chainId || i.review.token?.toLowerCase() !== config.token.toLowerCase())) throw new Error("Backup token or network mismatch");
 			const deviceKey = newDeviceKey();
 			const saved = {
@@ -946,362 +544,6 @@ function iceServerProblem(server) {
 	return null;
 }
 //#endregion
-//#region ../browser/src/engine/paymentAdapters/arkade.ts
-var unbase64 = (s) => Uint8Array.from(atob(s), (c) => c.charCodeAt(0));
-var base64$1 = (bytes) => btoa(Array.from(bytes, (b) => String.fromCharCode(b)).join(""));
-var hex$10 = (bytes) => Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
-var PreparedOnly = class extends Error {};
-var ARK_NETWORKS = [
-	"bitcoin",
-	"mutinynet",
-	"signet",
-	"regtest"
-];
-/** Payments go through review and approval; only the SDK's own settlement (renewal, onboarding) reaches the provider directly. */
-var PreviewProvider = class extends RestArkProvider {
-	authorizedFinalize;
-	captured;
-	take() {
-		return this.captured;
-	}
-	async submitTx(signedTx, checkpoints) {
-		this.captured = {
-			signedTx,
-			checkpoints
-		};
-		throw new PreparedOnly();
-	}
-	async finalizeTx(txid, checkpoints) {
-		if (this.authorizedFinalize?.txid !== txid) throw new Error("Preview cannot finalize an unapproved payment");
-		await this.authorizedFinalize.run(checkpoints);
-	}
-};
-var ArkadeAdapter = class ArkadeAdapter {
-	config;
-	identity;
-	wallet;
-	preview;
-	provider;
-	indexer;
-	repository;
-	method = "arkade";
-	pending = Promise.resolve();
-	serial(run) {
-		const next = this.pending.then(run, run);
-		this.pending = next.catch(() => {});
-		return next;
-	}
-	prepare(target, amount, feeCap) {
-		return this.serial(() => this.prepareOperation(target, amount, feeCap));
-	}
-	execute(review, prepared, persist) {
-		return this.serial(() => this.executeOperation(review, prepared, persist));
-	}
-	reconcile(review, prepared, persist) {
-		return this.serial(() => this.reconcileOperation(review, prepared, persist));
-	}
-	constructor(config, identity, wallet, preview, provider, indexer, repository) {
-		this.config = config;
-		this.identity = identity;
-		this.wallet = wallet;
-		this.preview = preview;
-		this.provider = provider;
-		this.indexer = indexer;
-		this.repository = repository;
-	}
-	static async connect(config, mnemonic, storage) {
-		if (!ARK_NETWORKS.includes(config.network)) throw new Error("Unsupported Ark network");
-		validatePaymentTarget({
-			method: "arkade",
-			network: config.network,
-			provider: config.provider,
-			asset: "BTC",
-			unit: "sat",
-			address: "configuration",
-			expiresAt: Date.now() + 6e4
-		});
-		validatePaymentTarget({
-			method: "arkade",
-			network: config.network,
-			provider: config.explorer,
-			asset: "BTC",
-			unit: "sat",
-			address: "configuration",
-			expiresAt: Date.now() + 6e4
-		});
-		const provider = new RestArkProvider(config.provider);
-		const info = await provider.getInfo();
-		if (info.network !== config.network || info.signerPubkey !== config.serverKey) throw new Error("Ark provider network or signing key changed. Review the wallet configuration.");
-		const identity = MnemonicIdentity.fromMnemonic(mnemonic, { isMainnet: config.network === "bitcoin" });
-		const preview = new PreviewProvider(config.provider);
-		const indexer = new RestIndexerProvider(config.provider);
-		const repositories = {
-			...storage,
-			walletRepository: storage?.walletRepository ?? new IndexedDBWalletRepository(`ghostly-ark-${config.walletId}`),
-			contractRepository: storage?.contractRepository ?? new IndexedDBContractRepository(`ghostly-ark-${config.walletId}`)
-		};
-		const wallet = await Wallet.create({
-			identity,
-			arkProvider: preview,
-			indexerProvider: indexer,
-			onchainProvider: new EsploraProvider(config.explorer),
-			settlementConfig: config.network === "regtest" ? false : { boardingUtxoSweep: true },
-			walletMode: "hd",
-			storage: repositories
-		});
-		return new ArkadeAdapter(config, identity, wallet, preview, provider, indexer, repositories.walletRepository);
-	}
-	async address() {
-		return this.wallet.getAddress();
-	}
-	requestAddress() {
-		return this.serial(async () => (await this.wallet.getNewAddresses({
-			types: ["default"],
-			forceNew: true
-		}))[0].address);
-	}
-	async balance() {
-		return (await this.wallet.getBalance()).available;
-	}
-	/**
-	* Sats whose batch expired before they were renewed, in three kinds, as a person can act on them:
-	* - `sweeping`: past their expiry, but the server has not swept their batch yet (with any swept ones: none can be
-	*   recovered meanwhile). The SDK (0.4.76) counts them as
-	*   recoverable already, but it settles an unswept coin without the forfeit the server still asks for (arkd wants
-	*   one until the sweep): the batch fails ("missing forfeit transactions") and the server bans the coin for a while.
-	*   The sweep waits for the chain's time to pass the expiry: an hour or more on a real network, the expiry's blocks
-	*   on regtest.
-	* - `recoverable`: swept, and a recovery takes them now.
-	* - `small`: swept, but together under the server's dust limit: a recovery makes one new coin and the server makes
-	*   none that small, so `recoverVtxos` answers "No recoverable VTXOs found". They wait for more coins to expire.
-	*/
-	async expired() {
-		const now = { timestamp: /* @__PURE__ */ new Date() };
-		let swept = 0, sweeping = 0;
-		for (const vtxo of await this.wallet.getVtxos({
-			withRecoverable: true,
-			withUnrolled: false
-		})) if (isRecoverable(vtxo)) swept += vtxo.value;
-		else if (!vtxo.isSwept && canRecoverOnchain(vtxo, now)) sweeping += vtxo.value;
-		const takes = !sweeping && swept > 0 && (await (await this.wallet.getVtxoManager()).getRecoverableBalance()).recoverable >= this.wallet.dustAmount;
-		return sweeping ? {
-			recoverable: 0,
-			sweeping: sweeping + swept,
-			small: 0
-		} : {
-			recoverable: takes ? swept : 0,
-			sweeping: 0,
-			small: takes ? 0 : swept
-		};
-	}
-	/**
-	* When the first coin still spendable expires (ms), or undefined with none: a coin left alone past it is swept by the
-	* server and comes back only through a recovery. An expiry in blocks is read against the explorer's tip, at about ten
-	* minutes a block.
-	*/
-	async expiresAt() {
-		let at, height;
-		for (const vtxo of await this.wallet.getVtxos({
-			withRecoverable: false,
-			withUnrolled: false
-		})) {
-			if (vtxo.isSwept || vtxo.isSpent) continue;
-			if (vtxo.expiresAt instanceof Date) {
-				const ms = vtxo.expiresAt.getTime();
-				if (Number.isFinite(ms)) at = Math.min(at ?? ms, ms);
-			} else if (typeof vtxo.expiresAtHeight === "number") height = Math.min(height ?? vtxo.expiresAtHeight, vtxo.expiresAtHeight);
-		}
-		if (height !== void 0) {
-			const tip = (await new EsploraProvider(this.config.explorer).getChainTip()).height;
-			const ms = Date.now() + Math.max(0, height - tip) * 6e5;
-			at = Math.min(at ?? ms, ms);
-		}
-		return at;
-	}
-	/**
-	* Moves swept outputs back into the balance, through the server's next batch. Refused while any expired coin is
-	* not swept yet (`recoverVtxos` would name it too, and that batch fails for all of them), and when what is swept
-	* is too little for a batch.
-	*/
-	recover() {
-		return this.serial(async () => {
-			const { recoverable, sweeping, small } = await this.expired();
-			if (sweeping) throw new Error("Expired coins can be recovered once the Ark server has swept their batch. Try again later.");
-			if (small) throw new Error("Too few expired sats to recover on their own. They are recovered with the next coins that expire.");
-			if (!recoverable) throw new Error("Nothing to recover");
-			return (await this.wallet.getVtxoManager()).recoverVtxos();
-		});
-	}
-	/** On-chain deposits land here; the SDK's settlement moves them into Ark once confirmed. */
-	boardingAddress() {
-		return this.wallet.getBoardingAddress();
-	}
-	/** Sats sent on-chain to the boarding address that are not in Ark yet. */
-	async incoming() {
-		return (await this.wallet.getBalance()).boarding.total;
-	}
-	async dispose() {
-		await this.wallet.dispose();
-	}
-	async prepareOperation(target, amount, feeCap) {
-		validatePaymentTarget(target);
-		assertWholeSats(amount);
-		this.checkTarget(target);
-		const info = await this.provider.getInfo();
-		if (info.network !== this.config.network || info.signerPubkey !== this.config.serverKey) throw new Error("Ark provider configuration changed");
-		if (await this.balance() < amount) throw new Error("Insufficient Ark balance");
-		this.preview.captured = void 0;
-		try {
-			await this.wallet.send({
-				address: target.address,
-				amount
-			});
-		} catch (error) {
-			if (!(error instanceof PreparedOnly)) throw new Error("Could not prepare this Ark payment. Check funds, address and provider.");
-		}
-		const capture = this.preview.take();
-		if (!capture) throw new Error("The Ark adapter did not prepare a transaction");
-		const tx = Transaction$1.fromPSBT(unbase64(capture.signedTx));
-		const destination = ArkAddress.decode(target.address);
-		let received = 0n, input = 0n, output = 0n;
-		for (let i = 0; i < tx.inputsLength; i++) {
-			const prev = tx.getInput(i).witnessUtxo;
-			if (!prev) throw new Error("Missing Ark input amount");
-			input += prev.amount;
-		}
-		for (let i = 0; i < tx.outputsLength; i++) {
-			const out = tx.getOutput(i);
-			output += out.amount ?? 0n;
-			if (out.script && [hex$10(destination.pkScript), hex$10(destination.subdustPkScript)].includes(hex$10(out.script))) received += out.amount ?? 0n;
-		}
-		const fee = Number(input - output);
-		if (received !== BigInt(amount) || !Number.isSafeInteger(fee) || fee < 0 || fee > feeCap) throw new Error("Prepared amount or fee does not match your review");
-		return {
-			fee,
-			prepared: {
-				...capture,
-				txid: tx.id,
-				address: target.address,
-				amount,
-				fee
-			}
-		};
-	}
-	async executeOperation(review, p, persist) {
-		this.checkPrepared(review, p);
-		const info = await this.provider.getInfo();
-		if (info.network !== this.config.network || info.signerPubkey !== this.config.serverKey) throw new Error("Ark provider configuration changed");
-		const tx = Transaction$1.fromPSBT(unbase64(p.signedTx));
-		const response = await this.provider.submitTx(p.signedTx, p.checkpoints);
-		assertSubmittedArkTxid(response, tx, "Ghostly Ark submission");
-		if (!response.finalArkTx) throw new Error("Provider returned no signed transaction");
-		this.verifyServer(Transaction$1.fromPSBT(unbase64(response.finalArkTx)), tx);
-		const matched = matchServerCheckpoints(response.signedCheckpointTxs, p.checkpoints.map((c) => Transaction$1.fromPSBT(unbase64(c))), "Ghostly Ark checkpoints");
-		const contracts = await (await this.wallet.getContractManager()).getContracts();
-		const final = await Promise.all(matched.map(async ({ server, local }) => {
-			assertAllowedSighashTypes(server);
-			this.verifyServer(server, local);
-			let signed = server;
-			for (let index = 0; index < local.inputsLength; index++) {
-				const script = local.getInput(index).witnessUtxo?.script;
-				const contract = script && contracts.find((c) => c.script === hex$10(script));
-				if (!contract || contract.type !== "default") throw new Error("Checkpoint is not owned by this wallet profile");
-				const descriptor = contract.metadata?.signingDescriptor;
-				const signer = typeof descriptor === "string" ? await this.wallet.signerForDescriptor(descriptor) : contract.params.pubKey === hex$10(await this.identity.xOnlyPublicKey()) ? this.identity : void 0;
-				if (!signer) throw new Error("Checkpoint signing descriptor missing");
-				signed = await signer.sign(signed, [index]);
-			}
-			return base64$1(signed.toPSBT());
-		}));
-		p.finalCheckpoints = final;
-		await persist?.();
-		await this.provider.finalizeTx(p.txid, final);
-		return {
-			txid: p.txid,
-			settled: true
-		};
-	}
-	async reconcileOperation(review, p, persist) {
-		this.checkPrepared(review, p);
-		if (await this.verifyReceipt(p.txid, p.address, p.amount)) return {
-			txid: p.txid,
-			settled: true
-		};
-		if (!p.finalCheckpoints) {
-			const state = await this.repository.getWalletState();
-			if (!state) throw new Error("Ark wallet state is unavailable");
-			await this.repository.saveWalletState({
-				...state,
-				settings: {
-					...state.settings,
-					hasPendingTx: true
-				}
-			});
-			this.preview.authorizedFinalize = {
-				txid: p.txid,
-				run: async (checkpoints) => {
-					const matched = matchServerCheckpoints(checkpoints, p.checkpoints.map((c) => Transaction$1.fromPSBT(unbase64(c))), "Ghostly pending recovery");
-					for (const { server, local } of matched) {
-						assertAllowedSighashTypes(server);
-						this.verifyServer(server, local);
-					}
-					p.finalCheckpoints = checkpoints;
-					await persist?.();
-					await this.provider.finalizeTx(p.txid, checkpoints);
-				}
-			};
-			try {
-				await this.wallet.finalizePendingTxs();
-			} finally {
-				this.preview.authorizedFinalize = void 0;
-			}
-		}
-		if (p.finalCheckpoints) try {
-			await this.provider.finalizeTx(p.txid, p.finalCheckpoints);
-		} catch {}
-		return {
-			txid: p.txid,
-			settled: await this.verifyReceipt(p.txid, p.address, p.amount)
-		};
-	}
-	/**
-	* A virtual output paying `address` at least `amount`, made after `since` and none of `claimed`: how a
-	* request paid from another Ark wallet is seen, with no receipt from the payer.
-	*/
-	async received(address, amount, since, claimed) {
-		const destination = ArkAddress.decode(address);
-		const scripts = [hex$10(destination.pkScript), hex$10(destination.subdustPkScript)];
-		const { vtxos } = await this.indexer.getVtxos({ scripts });
-		return vtxos.find((v) => /^[a-f0-9]{64}$/.test(v.txid) && v.value >= amount && scripts.includes(v.script) && !claimed.has(v.txid) && v.createdAt.getTime() >= since - 6e4)?.txid;
-	}
-	async verifyReceipt(txid, address, amount) {
-		if (!/^[a-f0-9]{64}$/.test(txid)) return false;
-		const destination = ArkAddress.decode(address);
-		return (await this.indexer.getVtxos({ outpoints: [{
-			txid,
-			vout: 0
-		}] })).vtxos.some((v) => v.txid === txid && v.value === amount && [hex$10(destination.pkScript), hex$10(destination.subdustPkScript)].includes(v.script));
-	}
-	checkTarget(t) {
-		if (t.method !== this.method || t.provider !== this.config.provider || t.network !== this.config.network || t.asset !== "BTC" || t.unit !== "sat") throw new Error("Payment method, network or provider does not match this wallet");
-		const decoded = ArkAddress.decode(t.address);
-		const pinned = this.config.serverKey.replace(/^(02|03)(?=[a-f0-9]{64}$)/, "");
-		if (hex$10(decoded.serverPubKey) !== pinned || decoded.hrp !== (this.config.network === "bitcoin" ? "ark" : "tark")) throw new Error("Ark address belongs to another provider or network");
-	}
-	verifyServer(server, local) {
-		const key = this.config.serverKey.replace(/^(02|03)(?=[a-f0-9]{64}$)/, "");
-		for (let index = 0; index < local.inputsLength; index++) {
-			const leaf = local.getInput(index).tapLeafScript?.[0]?.[1];
-			if (!leaf) throw new Error("Missing reviewed spend leaf");
-			verifyTapscriptSignatures(server, index, [key], void 0, void 0, tapLeafHash(leaf.subarray(0, -1), leaf[leaf.length - 1]));
-		}
-	}
-	checkPrepared(r, p) {
-		this.checkTarget(r);
-		if (p.address !== r.address || p.amount !== r.amount || p.fee !== r.fee || p.fee > r.feeCap || Transaction$1.fromPSBT(unbase64(p.signedTx)).id !== p.txid) throw new Error("Prepared payment does not match the approved review");
-	}
-};
-//#endregion
 //#region ../browser/src/engine/paymentAdapters/backup.ts
 /**
 * Wallet database versions a backup may carry. 3 is what SDK 0.4.74-0.4.76 made (Ghostly 1.1.3 and earlier);
@@ -1399,6 +641,8 @@ async function restoreArkDatabase(walletId, snapshot) {
 }
 //#endregion
 //#region ../browser/src/engine/paymentAdapters/arkWallet.ts
+/** The Ark SDK, a large part of the app: loaded once an Ark wallet is made, opened or restored, not with the engine. */
+var loadArkade = () => import("./arkade-CtCpFaF7.js");
 /** Every new profile starts with this wallet: nothing to set up before receiving. */
 var DEFAULT_ARK = {
 	network: "bitcoin",
@@ -1530,6 +774,7 @@ var ArkWallet = class {
 	}
 	async createNow(params) {
 		refuseAway(`arkade:${this.network}`, "Ark");
+		const [{ ARK_NETWORKS, ArkadeAdapter }, { RestArkProvider }] = await Promise.all([loadArkade(), import("@arkade-os/sdk")]);
 		if (!ARK_NETWORKS.includes(params.network)) throw new Error("Unsupported Ark network");
 		if (arkMode(params.network) !== this.network) throw new WrongNetworkError(arkMode(params.network), `${params.network === "bitcoin" ? "Bitcoin" : params.network} is a ${networkLabel(arkMode(params.network))} network: this is the ${networkLabel(this.network)} Ark wallet`);
 		checkProviders(params.network, params.provider, params.explorer);
@@ -1581,6 +826,7 @@ var ArkWallet = class {
 		const key = this.saved.deviceKey ?? password;
 		if (!key) throw new Error("Enter the Ark wallet password");
 		const mnemonic = await unsealSeed(this.saved.seed, key);
+		const { ArkadeAdapter } = await loadArkade();
 		this.adapter = await this.gate.within(ArkadeAdapter.connect(this.saved.config, mnemonic), (a) => a.dispose());
 		await this.refresh();
 	}
@@ -1667,6 +913,7 @@ var ArkWallet = class {
 				...payload.config,
 				walletId: crypto.randomUUID()
 			};
+			const { ARK_NETWORKS } = await loadArkade();
 			if (!ARK_NETWORKS.includes(config.network)) throw new Error("Unsupported Ark network in backup");
 			if (arkMode(config.network) !== this.network) throw new WrongNetworkError(arkMode(config.network), `This backup is a ${networkLabel(arkMode(config.network))} Ark wallet`);
 			checkProviders(config.network, config.provider, config.explorer);
@@ -5587,7 +4834,7 @@ var BitcoindOnchain = class BitcoindOnchain {
 			lockUnspents: true,
 			replaceable: true
 		}), "funded transaction");
-		const inputs = this.outpoints(Transaction$2.fromPSBT(base64.decode(text$2(funded.psbt, "funded transaction")), TX_OPTS));
+		const inputs = this.outpoints(Transaction.fromPSBT(base64.decode(text$2(funded.psbt, "funded transaction")), TX_OPTS));
 		try {
 			const fee = btcToSats(funded.fee);
 			if (fee > request.feeCap) throw new Error(`The fee (${fee} sats) is above your limit of ${request.feeCap}`);
@@ -5595,7 +4842,7 @@ var BitcoindOnchain = class BitcoindOnchain {
 			if (signed.complete !== true) throw new Error("The wallet could not sign this payment (is it locked, or watch-only?)");
 			const final = object(await this.call("finalizepsbt", signed.psbt, false), "finalized transaction");
 			if (final.complete !== true) throw new Error("The wallet could not finalize this payment");
-			return this.check(Transaction$2.fromPSBT(base64.decode(text$2(final.psbt, "finalized transaction")), TX_OPTS), request, inputs, feeRate, network);
+			return this.check(Transaction.fromPSBT(base64.decode(text$2(final.psbt, "finalized transaction")), TX_OPTS), request, inputs, feeRate, network);
 		} catch (error) {
 			await this.unlock(inputs).catch(() => {});
 			throw error;
@@ -5605,16 +4852,17 @@ var BitcoindOnchain = class BitcoindOnchain {
 	check(tx, request, funded, feeRate, network) {
 		const same = (a, b) => a.length === b.length && a.every((o, i) => o.txid === b[i].txid && o.vout === b[i].vout);
 		if (!same(this.outpoints(tx), funded)) throw new Error("The node signed other coins than it funded the payment with");
+		const script = (() => {
+			try {
+				return hex.encode(OutScript.encode(Address(BTC_NETWORKS[network]).decode(request.address)));
+			} catch {
+				return;
+			}
+		})();
 		let paid = 0;
 		for (let i = 0; i < tx.outputsLength; i++) {
 			const output = tx.getOutput(i);
-			if ((() => {
-				try {
-					return tx.getOutputAddress(i, BTC_NETWORKS[network]);
-				} catch {
-					return;
-				}
-			})() === request.address) paid += Number(output.amount ?? 0n);
+			if (script !== void 0 && output.script && hex.encode(output.script) === script) paid += Number(output.amount ?? 0n);
 		}
 		if (paid !== request.amount) throw new Error("The node built a transaction that does not pay the address and amount asked for");
 		const fee = Number(tx.fee);
@@ -5647,7 +4895,7 @@ var BitcoindOnchain = class BitcoindOnchain {
 	}
 	signedTx(prepared) {
 		if (!/^[0-9a-f]+$/.test(prepared.signed)) throw new Error("This prepared payment has no signed transaction");
-		const tx = Transaction$2.fromRaw(hex.decode(prepared.signed), TX_OPTS);
+		const tx = Transaction.fromRaw(hex.decode(prepared.signed), TX_OPTS);
 		if (tx.id !== prepared.txid) throw new Error("This prepared payment's transaction is not the one reviewed");
 		return tx;
 	}
@@ -11895,6 +11143,10 @@ var APP_CHECK_TIMINGS = {
 	/** A check at start is skipped when every app was checked this recently (a page reloaded several times). */
 	freshMs: 36e5
 };
+/** Revocations are checked this long at a time before the page's thread is let go. */
+var REVOCATIONS_SLICE_MS = 10;
+/** `ghostly-revoke.json` files whose result is kept, so an unchanged one is not checked again (the oldest dropped first). */
+var REVOCATION_FILES_KEPT = 64;
 /** A fetched bundle kept for its install screen: at most this many, for this long. */
 var STAGED = {
 	max: 4,
@@ -11903,6 +11155,16 @@ var STAGED = {
 /** The first bytes of a bundle: magic, the manifest's length and the largest manifest. */
 var PEEK_BYTES = APP_BUNDLE_MAGIC.length + 4 + APP_BUNDLE_LIMITS.manifestBytes;
 var bundleId = (digest) => `app-${digest}`;
+/**
+* A listing's URLs this client reads, in order, a jsDelivr copy first: one this client reads names a full commit, so it
+* holds exactly the version the store reviewed, where a raw `HEAD` may have moved on to one it has not (WISP 1200 §
+* Stores), and a 16 MiB bundle is not downloaded only to be skipped.
+*/
+function listingUrls(urls) {
+	const readable = urls.filter(isAppFetchUrl);
+	const pinned = (u) => new URL(u).hostname.toLowerCase() === "cdn.jsdelivr.net";
+	return [...readable.filter(pinned), ...readable.filter((u) => !pinned(u))];
+}
 /** An error whose message starts with its code (`<code>: words`), as it crosses the engine's RPC. */
 function fail(code, words) {
 	throw new Error(`${code}: ${words}`);
@@ -11921,6 +11183,15 @@ var versionOf = (manifest, digest) => ({
 	digest
 });
 var byteLength = (text) => utf8Encode(text).length;
+/** The app with these revocations merged into the ones it holds, each kept once. */
+function withRevocations(app, read) {
+	const merged = new Map((app.revocations ?? []).map((r) => [canonicalJson(r), r]));
+	for (const r of read) merged.set(canonicalJson(r), r);
+	return merged.size ? {
+		...app,
+		revocations: [...merged.values()]
+	} : app;
+}
 /** Rows of one app (`[ref]`), or of one app in one scope (`[ref, scope]`), in `STORES.appStorage`. */
 var rowsOf = (...prefix) => IDBKeyRange.bound(prefix, [...prefix, []]);
 function done(tx) {
@@ -11957,13 +11228,32 @@ var Apps = class {
 	staged = /* @__PURE__ */ new Map();
 	/** Bundles read back and checked, by digest: the one running is read once, not on every `file`. */
 	verified = /* @__PURE__ */ new Map();
+	/** Reads of a bundle under way, by digest: icons drawn at once share one read. */
+	verifying = /* @__PURE__ */ new Map();
+	/**
+	* The `icon.png` of each checked bundle, by digest (at most 256 KiB, or null for none): every icon shown on the Apps
+	* page, in a chat's cards and in the composer's Apps is read without the whole bundle again.
+	*/
+	icons = /* @__PURE__ */ new Map();
 	/** Bytes used per `ref\0scope`, counted once from the rows and kept in step by the writes here. */
 	usage = /* @__PURE__ */ new Map();
 	queues = /* @__PURE__ */ new Map();
 	timer = null;
+	/** Drops what `staged` holds past `STAGED.ms`, set while it holds anything: a closed install screen sends no call. */
+	sweep = null;
 	checking = null;
 	/** Runs the person started with Run anyway (`<ref> <digest>`), for this engine's life: a removal does not cut them off. */
 	anyway = /* @__PURE__ */ new Set();
+	views = null;
+	held = /* @__PURE__ */ new Map();
+	heldStores = null;
+	/**
+	* Listing URLs whose peek showed nothing to take (`<store> <ref> <url>` → `<index digest> <listed digest>`): the same
+	* index listing the same is not peeked again at every check.
+	*/
+	listingMisses = /* @__PURE__ */ new Map();
+	/** `ghostly-revoke.json` files checked, by the SHA-256 of their bytes: their revocations, or null when refused. */
+	revocationFiles = /* @__PURE__ */ new Map();
 	stopped = false;
 	constructor(host) {
 		this.host = host;
@@ -11984,6 +11274,12 @@ var Apps = class {
 		this.stopped = true;
 		if (this.timer) clearTimeout(this.timer);
 		this.timer = null;
+		if (this.sweep) clearTimeout(this.sweep);
+		this.sweep = null;
+		this.staged.clear();
+		this.held.clear();
+		this.heldStores = null;
+		this.views = null;
 	}
 	schedule(ms, atStart = false) {
 		if (this.timer) clearTimeout(this.timer);
@@ -12015,8 +11311,22 @@ var Apps = class {
 	async installed() {
 		return wrap((await store(STORES$1.apps, "readonly")).getAll());
 	}
-	async app(ref) {
-		return wrap((await store(STORES$1.apps, "readonly")).get(ref));
+	/**
+	* An installed app's record, read once and again after it is written here (the only writer, as for `heldViews`). An
+	* app's every storage call, file read and chat frame asks for it. A reference not installed is not kept.
+	*/
+	app(ref) {
+		const kept = this.held.get(ref);
+		if (kept) return kept;
+		const read = store(STORES$1.apps, "readonly").then((s) => wrap(s.get(ref)));
+		this.held.set(ref, read);
+		const drop = () => {
+			if (this.held.get(ref) === read) this.held.delete(ref);
+		};
+		read.then((app) => {
+			if (!app) drop();
+		}, drop);
+		return read;
 	}
 	async installedOrFail(ref) {
 		if (!isAppRef(ref)) fail("bad-ref", "Not an app reference");
@@ -12028,7 +11338,7 @@ var Apps = class {
 	* or not the page stops its frame.
 	*/
 	async stillRunnable(app) {
-		const run = this.runStatus(app, await this.stores(), app.revocations);
+		const run = this.runStatus(app, await this.heldViews(), app.revocations);
 		if (run.status === "revoked") fail("stopped", "Its publisher revoked this version");
 		if (run.status === "removed" && !this.anyway.has(`${app.ref} ${app.digest}`)) fail("stopped", `Removed by ${run.by[0].name}: ${run.by[0].reason}`);
 		return app;
@@ -12045,17 +11355,77 @@ var Apps = class {
 		if (app) await this.stillRunnable(app);
 	}
 	async putApp(app) {
-		await wrap((await store(STORES$1.apps, "readwrite")).put(app));
+		try {
+			await wrap((await store(STORES$1.apps, "readwrite")).put(app));
+		} finally {
+			this.held.delete(app.ref);
+		}
+	}
+	/**
+	* Writes an app's record back only while that install is still there (the same `installedAt`), read and written in
+	* one transaction: an app uninstalled (or installed again) while the update check was reading is not put back.
+	*/
+	async putAppIfInstalled(app, installedAt) {
+		const tx = (await openDb()).transaction(STORES$1.apps, "readwrite");
+		let put = false;
+		const read = tx.objectStore(STORES$1.apps).get(app.ref);
+		read.onsuccess = () => {
+			if (read.result?.installedAt !== installedAt) return;
+			tx.objectStore(STORES$1.apps).put(app);
+			put = true;
+		};
+		try {
+			await done(tx);
+		} finally {
+			this.held.delete(app.ref);
+		}
+		return put;
+	}
+	/**
+	* The stores' records by key, read once and kept in step by the writes here (the only writer: pages in other tabs
+	* share this engine). A record holds its store's whole index, up to 4 MiB, and IndexedDB reads and writes it whole:
+	* the Apps page, the update check and an app's every storage call and chat frame ask for them.
+	*/
+	records() {
+		return this.heldStores ??= store(STORES$1.appStores, "readonly").then((s) => wrap(s.getAll())).then((all) => new Map(all.map((r) => [r.key, r])), (error) => {
+			this.heldStores = null;
+			throw error;
+		});
 	}
 	async storeRecord(key) {
-		return wrap((await store(STORES$1.appStores, "readonly")).get(key));
+		return (await this.records()).get(key);
 	}
-	async putStore(record) {
-		await wrap((await store(STORES$1.appStores, "readwrite")).put(record));
+	/** A write of the stores' records: what is asked while it runs waits for it, as a read of IndexedDB would; one that fails leaves what was held. */
+	async writeStores(write, apply) {
+		const before = this.records();
+		const written = before.then(async (held) => {
+			await wrap(write(await store(STORES$1.appStores, "readwrite")));
+			apply(held);
+			this.views = null;
+		});
+		const after = written.then(() => before, () => before);
+		this.heldStores = after;
+		after.catch(() => {
+			if (this.heldStores === after) this.heldStores = null;
+		});
+		await written;
 	}
-	/** The stores the person has (a removed default is not one). */
+	putStore(record) {
+		return this.writeStores((records) => records.put(record), (held) => held.set(record.key, record));
+	}
+	deleteStore(key) {
+		return this.writeStores((records) => records.delete(key), (held) => held.delete(key));
+	}
+	/** The stores' views, made once and again after a store is written here: an app's every storage call and chat frame checks them. */
+	heldViews() {
+		return this.views ??= this.stores().then((s) => this.storeViews(s), (error) => {
+			this.views = null;
+			throw error;
+		});
+	}
+	/** The stores the person has (a removed default is not one), in the order of their keys, as IndexedDB lists them. */
 	async stores() {
-		return (await wrap((await store(STORES$1.appStores, "readonly")).getAll())).filter((s) => !s.removed);
+		return [...(await this.records()).values()].filter((s) => !s.removed).sort((a, b) => a.key < b.key ? -1 : 1);
 	}
 	storeViews(stores) {
 		return stores.filter((s) => s.index).map((s) => ({
@@ -12073,8 +11443,8 @@ var Apps = class {
 			kind: s.index.kind
 		}));
 	}
-	runStatus(version, stores, revocations = []) {
-		const check = checkAppBeforeRun(version, this.storeViews(stores), revocations);
+	runStatus(version, views, revocations = []) {
+		const check = checkAppBeforeRun(version, views, revocations);
 		if (check.status === "revoked") return {
 			status: "revoked",
 			...check.revocation.statement.reason && { reason: check.revocation.statement.reason }
@@ -12133,19 +11503,34 @@ var Apps = class {
 	}
 	async removeBundle(kind, digest) {
 		this.verified.delete(digest);
+		this.icons.delete(digest);
 		await (await fileBytesOf(kind))?.remove(bundleId(digest)).catch(() => {});
 	}
+	/** A bundle's bytes removed unless the app's record (installed again meanwhile) holds that version, or waits for it. */
+	async removeUnusedBundle(ref, kind, digest) {
+		const app = await this.app(ref);
+		if (app?.digest !== digest && app?.pending?.digest !== digest) await this.removeBundle(kind, digest);
+	}
 	/** The installed bundle read back and checked again before it runs (WISP 1200 § Signatures: "again before it runs one"). */
-	async verifiedBundle(app) {
+	verifiedBundle(app) {
 		const kept = this.verified.get(app.digest);
-		if (kept) return kept;
-		const bytes = await this.readBundleBytes(app.bytes, app.digest);
-		if (!bytes) fail("needs-files", "This app's files are not on this device yet");
-		const read = readAppBundle(bytes);
-		if (!read.ok || read.bundle.digest !== app.digest) fail("damaged", "This app's stored files do not match what was installed");
-		if (this.verified.size >= 2) this.verified.delete(this.verified.keys().next().value);
-		this.verified.set(app.digest, read.bundle);
-		return read.bundle;
+		if (kept) return Promise.resolve(kept);
+		const under = this.verifying.get(app.digest);
+		if (under) return under;
+		const reading = (async () => {
+			const bytes = await this.readBundleBytes(app.bytes, app.digest);
+			if (!bytes) fail("needs-files", "This app's files are not on this device yet");
+			const read = readAppBundle(bytes);
+			if (!read.ok || read.bundle.digest !== app.digest) fail("damaged", "This app's stored files do not match what was installed");
+			if (this.verified.size >= 2) this.verified.delete(this.verified.keys().next().value);
+			this.verified.set(app.digest, read.bundle);
+			this.icons.set(app.digest, read.bundle.files.get("icon.png")?.slice() ?? null);
+			return read.bundle;
+		})().finally(() => {
+			this.verifying.delete(app.digest);
+		});
+		this.verifying.set(app.digest, reading);
+		return reading;
 	}
 	async fetchBundle(url) {
 		const bytes = await this.host.fetch(url, { maxBytes: APP_BUNDLE_LIMITS.bundleBytes });
@@ -12156,17 +11541,67 @@ var Apps = class {
 			bytes
 		};
 	}
-	async readStoreAt(url, heldKey) {
+	/**
+	* Reads the index at `url`. With the index held for this store, bytes equal to it (by digest) are the held index: its
+	* signature and every revocation in it were checked when it was read, so only its expiry is taken again.
+	*/
+	async readStoreAt(url, heldKey, held) {
 		const [indexBytes, sigBytes] = await Promise.all([this.host.fetch(url, { maxBytes: APP_FETCH_LIMITS.storeIndexBytes }), this.host.fetch(besideUrl(url, "ghostly-store.sig"), { maxBytes: APP_FETCH_LIMITS.sigBytes })]);
+		if (held?.index && held.digest !== void 0 && toBase64Url(sha256(indexBytes)) === held.digest) return {
+			ok: true,
+			store: {
+				index: held.index,
+				digest: held.digest,
+				expired: held.index.expires < this.nowS()
+			}
+		};
 		return readAppStore(indexBytes, sigBytes, this.nowS(), heldKey);
 	}
-	/** The revocations its publisher signed, read beside each URL (`ghostly-revoke.json`); none there is not an error. */
-	async readRevocations(ref, urls) {
-		const out = [];
-		for (const url of new Set(urls.filter(isAppFetchUrl).map((u) => besideUrl(u, "ghostly-revoke.json")))) try {
-			const read = readAppRevocations(await this.host.fetch(url, { maxBytes: APP_FETCH_LIMITS.revocationsBytes }));
-			if (read.ok) out.push(...read.revocations.filter((r) => r.statement.app === ref));
-		} catch {}
+	/**
+	* The revocations its publisher signed, read beside each URL (`ghostly-revoke.json`); none there is not an error.
+	* `read` holds the files already read, which are skipped, and gets the ones read now. Null when no file answered now.
+	*/
+	async readRevocations(ref, urls, read = /* @__PURE__ */ new Set()) {
+		let out = null;
+		for (const url of new Set(urls.filter(isAppFetchUrl).map((u) => besideUrl(u, "ghostly-revoke.json")))) {
+			if (read.has(url)) continue;
+			read.add(url);
+			try {
+				const file = await this.readRevocationsFile(await this.host.fetch(url, { maxBytes: APP_FETCH_LIMITS.revocationsBytes }));
+				if (file) (out ??= []).push(...file.filter((r) => r.statement.app === ref));
+			} catch {}
+		}
+		return out;
+	}
+	/**
+	* `readAppRevocations` (one entry that does not verify refuses the file, null here), with a pause every few ms: the
+	* engine shares the page's thread, and each entry is a signature check. The same bytes are not checked again.
+	*/
+	async readRevocationsFile(bytes) {
+		const id = toBase64Url(sha256(bytes));
+		const known = this.revocationFiles.get(id);
+		if (known !== void 0) return known;
+		const read = readCanonicalJson(bytes);
+		let out = null;
+		if (read.ok && Array.isArray(read.value) && read.value.length <= APP_STATEMENT_LIMITS.revocations) {
+			out = [];
+			let since = performance.now();
+			for (const entry of read.value) {
+				if (performance.now() - since >= REVOCATIONS_SLICE_MS) {
+					await new Promise((resolve) => setTimeout(resolve, 0));
+					since = performance.now();
+				}
+				const one = readAppRevocation(entry);
+				if (!one.ok) {
+					out = null;
+					break;
+				}
+				out.push(one.revocation);
+			}
+		}
+		this.revocationFiles.delete(id);
+		this.revocationFiles.set(id, out);
+		for (const old of this.revocationFiles.keys()) if (this.revocationFiles.size > REVOCATION_FILES_KEPT) this.revocationFiles.delete(old);
 		return out;
 	}
 	summary(s) {
@@ -12299,7 +11734,12 @@ var Apps = class {
 			preloaded: true,
 			removed: true
 		});
-		else await wrap((await store(STORES$1.appStores, "readwrite")).delete(key));
+		else await this.deleteStore(key);
+		for (const app of await this.installed()) {
+			if (app.store !== key) continue;
+			const { store: _s, ...unpinned } = app;
+			await this.putApp(unpinned);
+		}
 	}
 	/** Reads one store again, or every store (the person opened the Apps page, or the update check). */
 	async refreshStores({ key } = {}) {
@@ -12309,7 +11749,7 @@ var Apps = class {
 		for (const s of stores) {
 			let next;
 			try {
-				const read = await this.readStoreAt(s.url, s.key);
+				const read = await this.readStoreAt(s.url, s.key, s);
 				next = read.ok ? this.withIndex(s, read.store.index, read.store.digest) : {
 					...s,
 					problem: read.reason
@@ -12320,31 +11760,38 @@ var Apps = class {
 					problem: error instanceof AppFetchError ? error.code : "network"
 				};
 			}
-			if (!await this.storeRecord(s.key) || (await this.storeRecord(s.key))?.removed) continue;
-			await this.putStore(next);
+			const now = await this.storeRecord(s.key);
+			if (!now || now.removed) continue;
+			if (now === s && next.index === s.index && next.digest === s.digest && next.problem === s.problem && next.equivocation === s.equivocation) (await this.records()).set(s.key, next);
+			else await this.putStore(next);
 			out.push(this.summary(next));
 		}
 		return out;
 	}
 	/**
 	* Fetches an app and checks it, for the install screen: from a pasted URL, a store's listing (its URLs in order) or a
-	* chat card's pointer. A store's or a card's `sequence` and digest must hold: the same app, and that version or a newer
-	* one. Nothing is stored: the checked bundle waits in memory for `install`.
+	* chat card's pointer. A card's `sequence` and digest must hold: the same app, and that version or a newer one. A
+	* store's listing must hold exactly: the version it lists, by digest, so a URL that already holds a newer version the
+	* store has not reviewed is skipped for the next one (`unlisted` when none holds it). Nothing is stored: the checked
+	* bundle waits in memory for `install`.
 	*/
 	async preview(source) {
 		let urls;
 		let expect = null;
+		let fromStore;
 		if ("url" in source) urls = [typeof source.url === "string" && appPasteUrl(source.url, "app.ghostlyapp") || notReadable(source.url, "Apps are read only from raw.githubusercontent.com, or from cdn.jsdelivr.net at a commit, over HTTPS")];
 		else if ("store" in source) {
 			const s = await this.storeRecord(source.store);
 			const listing = s && !s.removed ? s.index?.apps.find((a) => a.ref === source.ref) : void 0;
 			if (!listing) fail("not-listed", "This store does not list this app");
-			urls = listing.urls.filter(isAppFetchUrl);
+			urls = listingUrls(listing.urls);
 			expect = {
 				ref: listing.ref,
 				sequence: listing.sequence,
-				digest: listing.digest
+				digest: listing.digest,
+				exact: true
 			};
+			fromStore = s.key;
 		} else if ("card" in source && source.card) {
 			const { ref, url, sequence, digest } = source.card;
 			if (!isAppRef(ref)) fail("bad-ref", "Not an app reference");
@@ -12365,14 +11812,22 @@ var Apps = class {
 				if (version.ref !== expect.ref) fail("other-app", "The URL holds another app");
 				if (expect.sequence !== void 0 && version.sequence < expect.sequence) fail("rollback", "The URL holds an older version than the one named");
 				if (expect.sequence === version.sequence && expect.digest !== void 0 && expect.digest !== version.digest) fail("equivocation", "The URL holds another version under the same number");
+				if (expect.exact && version.digest !== expect.digest) fail("unlisted", "The URL holds a version the store does not list");
 			}
-			return this.stage(bundle, bytes, url);
+			return this.stage(bundle, bytes, url, fromStore);
 		} catch (error) {
 			last = error;
 		}
 		throw last instanceof Error ? last : new Error(String(last));
 	}
-	async stage(bundle, bytes, from) {
+	/** Drops the staged bundles past `STAGED.ms`, and comes back when the oldest left is due. */
+	sweepStaged() {
+		this.sweep = null;
+		for (const [digest, s] of this.staged) if (this.now() - s.at >= STAGED.ms) this.staged.delete(digest);
+		const oldest = this.staged.values().next().value;
+		if (oldest) this.sweep = setTimeout(() => this.sweepStaged(), STAGED.ms - (this.now() - oldest.at));
+	}
+	async stage(bundle, bytes, from, fromStore) {
 		for (const [digest, s] of this.staged) if (this.now() - s.at > STAGED.ms) this.staged.delete(digest);
 		this.staged.delete(bundle.digest);
 		while (this.staged.size >= STAGED.max) this.staged.delete(this.staged.keys().next().value);
@@ -12380,8 +11835,10 @@ var Apps = class {
 			bundle,
 			bytes,
 			from,
+			...fromStore !== void 0 && { store: fromStore },
 			at: this.now()
 		});
+		if (!this.sweep) this.sweepStaged();
 		const { manifest, digest } = bundle;
 		const version = versionOf(manifest, digest);
 		const [installed, stores] = await Promise.all([this.app(version.ref), this.stores()]);
@@ -12399,7 +11856,7 @@ var Apps = class {
 			icon: bundle.files.get("icon.png")?.slice() ?? null,
 			install,
 			asks,
-			run: this.runStatus(version, stores, installed?.revocations),
+			run: this.runStatus(version, this.storeViews(stores), installed?.revocations),
 			listedBy,
 			unknownPublisher: !listedBy.some((s) => s.kind === "curated")
 		};
@@ -12415,12 +11872,12 @@ var Apps = class {
 			this.staged.delete(digest);
 			fail("expired", "Fetch the app again");
 		}
-		const { bundle, bytes, from } = staged;
+		const { bundle, bytes, from, store: fromStore } = staged;
 		const { manifest } = bundle;
 		if (!Array.isArray(grant) || !manifest.permissions.every((p) => grant.includes(p))) fail("permissions", "Every permission the app asks for must be granted");
 		const version = versionOf(manifest, digest);
 		const [installed, stores] = await Promise.all([this.app(version.ref), this.stores()]);
-		const run = this.runStatus(version, stores, installed?.revocations);
+		const run = this.runStatus(version, this.storeViews(stores), installed?.revocations);
 		if (run.status === "revoked") fail("revoked", "Its publisher revoked this version");
 		if (run.status === "removed") fail("removed", `Removed by ${run.by[0].name}: ${run.by[0].reason}`);
 		const pendingClash = installed?.pending && installed.pending.sequence === version.sequence && installed.pending.digest !== digest;
@@ -12438,26 +11895,37 @@ var Apps = class {
 			fail("equivocation", `Two different versions ${version.sequence} exist. Ghostly kept the one you have.`);
 		}
 		if (decision === "same" && installed) {
-			if (!await this.hasBundle(installed.bytes, digest)) await this.putApp({
-				...installed,
-				bytes: await this.writeBundle(digest, bytes)
-			});
+			const files = await this.hasBundle(installed.bytes, digest) ? null : await this.writeBundle(digest, bytes);
+			const pin = fromStore !== void 0 && installed.store !== fromStore;
+			if (files || pin) {
+				const { pending, ...rest } = installed;
+				if (pin && pending) await this.removeBundle(pending.bytes, pending.digest);
+				await this.putApp({
+					...pin ? rest : installed,
+					...files && { bytes: files },
+					...pin && { store: fromStore }
+				});
+			}
 			this.staged.delete(digest);
 			return this.view(await this.app(version.ref), stores);
 		}
 		const kind = await this.writeBundle(digest, bytes);
-		const next = this.versionRecord(installed, bundle, kind, from);
+		const next = this.versionRecord(installed, bundle, kind, from, fromStore);
 		await this.putApp(next);
 		if (installed && installed.digest !== digest) await this.removeBundle(installed.bytes, installed.digest);
-		if (installed?.pending && installed.pending.sequence <= version.sequence && installed.pending.digest !== digest) await this.removeBundle(installed.pending.bytes, installed.pending.digest);
+		if (installed?.pending && next.pending?.digest !== installed.pending.digest && installed.pending.digest !== digest) await this.removeBundle(installed.pending.bytes, installed.pending.digest);
 		this.staged.delete(digest);
 		return this.view(next, stores);
 	}
-	/** The record of a version installed now, keeping what the app had (its revocations, a newer version waiting). */
-	versionRecord(installed, bundle, kind, from) {
+	/**
+	* The record of a version installed now, keeping what the app had (its revocations, a newer version waiting). `store`
+	* is the store its updates come from (`InstalledApp.store`); a newer version waiting is kept only while that is
+	* unchanged, since it was found under the other rule.
+	*/
+	versionRecord(installed, bundle, kind, from, store) {
 		const { manifest, digest } = bundle;
 		const now = this.now();
-		const keepPending = installed?.pending && installed.pending.sequence > manifest.sequence ? installed.pending : void 0;
+		const keepPending = installed?.pending && installed.pending.sequence > manifest.sequence && installed.store === store ? installed.pending : void 0;
 		return {
 			ref: appRef(manifest.publisher, manifest.name),
 			publisher: manifest.publisher,
@@ -12468,6 +11936,7 @@ var Apps = class {
 			manifest,
 			bytes: kind,
 			from,
+			...store !== void 0 && { store },
 			installedAt: installed?.installedAt ?? now,
 			updatedAt: now,
 			...installed?.revocations?.length && { revocations: installed.revocations },
@@ -12488,7 +11957,8 @@ var Apps = class {
 			fail("needs-files", "The update's files are gone; it is fetched again at the next check");
 		}
 		const stores = await this.stores();
-		const run = this.runStatus(versionOf(read.bundle.manifest, pending.digest), stores, installed.revocations);
+		if (installed.store !== void 0 && this.pinnedListing(installed, stores)?.digest !== pending.digest) fail("unlisted", "The store no longer lists this update");
+		const run = this.runStatus(versionOf(read.bundle.manifest, pending.digest), this.storeViews(stores), installed.revocations);
 		if (run.status === "revoked") fail("revoked", "Its publisher revoked this version");
 		if (run.status === "removed") fail("removed", `Removed by ${run.by[0].name}: ${run.by[0].reason}`);
 		const plan = planAppUpdate(installed, {
@@ -12497,15 +11967,20 @@ var Apps = class {
 		});
 		if (plan.action === "refuse") fail(plan.decision, "This update can no longer be installed");
 		const { pending: _p, ...without } = installed;
-		const next = this.versionRecord(without, read.bundle, pending.bytes, pending.from);
+		const next = this.versionRecord(without, read.bundle, pending.bytes, pending.from, installed.store);
 		await this.putApp(next);
 		await this.removeBundle(installed.bytes, installed.digest);
 		return this.view(next, stores);
 	}
+	/** An app's listing in the store its updates come from (`InstalledApp.store`), while that store is the person's. */
+	pinnedListing(app, stores) {
+		return app.store === void 0 ? void 0 : stores.find((s) => s.key === app.store)?.index?.apps.find((a) => a.ref === app.ref);
+	}
 	/**
 	* The update check (WISP 1200 § Updates and rollback): only with an app installed; every store read again, then each
-	* app's newer versions looked for in the stores' listings and its manifest's `sources`, and its publisher's
-	* revocations read beside its sources. An update that keeps or drops permissions installs by itself; one that adds
+	* app's newer versions looked for in the stores' listings and its manifest's `sources` (for an app installed from a
+	* store, only in that store's listing, at the digest it lists), and its publisher's revocations read beside its
+	* sources. An update that keeps or drops permissions installs by itself; one that adds
 	* some waits for the person. One check at a time.
 	*/
 	checkUpdates() {
@@ -12531,21 +12006,65 @@ var Apps = class {
 			if (!first) continue;
 			let app = first;
 			let outcome = "none";
+			let wrote;
+			if (app.store !== void 0 && !stores.some((s) => s.key === app.store)) {
+				const { store: _s, ...unpinned } = app;
+				app = unpinned;
+			}
+			if (app.store !== void 0 && app.pending && stores.find((s) => s.key === app.store)?.index && this.pinnedListing(app, stores)?.digest !== app.pending.digest) {
+				await this.removeBundle(app.pending.bytes, app.pending.digest);
+				const { pending: _p, ...rest } = app;
+				app = rest;
+			}
 			const highest = Math.max(app.sequence, app.pending?.sequence ?? 0);
 			const known = /* @__PURE__ */ new Set([app.digest, ...app.pending ? [app.pending.digest] : []]);
-			const candidates = [];
+			const pinned = app.store;
+			const candidates = /* @__PURE__ */ new Map();
+			const newer = (v) => v.ref === app.ref && (v.sequence > highest || v.sequence >= app.sequence && !known.has(v.digest));
 			for (const s of stores) {
+				if (pinned !== void 0 && s.key !== pinned) continue;
 				const listing = s.index?.apps.find((a) => a.ref === app.ref);
-				if (listing && (listing.sequence > highest || listing.sequence >= app.sequence && !known.has(listing.digest))) candidates.push(...listing.urls.filter(isAppFetchUrl));
+				if (!listing || !newer(listing)) continue;
+				const seen = `${s.digest} ${listing.digest}`;
+				for (const url of listingUrls(listing.urls)) {
+					const missed = `${s.key} ${app.ref} ${url}`;
+					if (candidates.has(url) || s.digest !== void 0 && this.listingMisses.get(missed) === seen) continue;
+					candidates.set(url, {
+						...pinned !== void 0 && { digest: listing.digest },
+						peek: true,
+						...s.digest !== void 0 && { miss: [missed, seen] }
+					});
+				}
 			}
-			for (const url of (app.manifest.sources ?? []).filter(isAppFetchUrl)) try {
-				const peek = peekAppManifest(await this.host.fetch(url, {
-					maxBytes: PEEK_BYTES,
-					peek: true
-				}));
-				if (peek && peek.ref === app.ref && (peek.sequence > highest || peek.sequence >= app.sequence && !known.has(peek.digest))) candidates.push(url);
-			} catch {}
-			for (const url of new Set(candidates)) {
+			if (pinned === void 0) for (const url of (app.manifest.sources ?? []).filter(isAppFetchUrl)) {
+				if (candidates.has(url)) continue;
+				try {
+					const peek = peekAppManifest(await this.host.fetch(url, {
+						maxBytes: PEEK_BYTES,
+						peek: true
+					}));
+					if (peek && newer(peek)) candidates.set(url, {});
+				} catch {}
+			}
+			const revokeRead = /* @__PURE__ */ new Set();
+			const before = await this.readRevocations(app.ref, [app.from, ...app.manifest.sources ?? []], revokeRead);
+			app = withRevocations(app, before ?? []);
+			for (const [url, want] of candidates) {
+				if (want.peek) {
+					let peek;
+					try {
+						peek = peekAppManifest(await this.host.fetch(url, {
+							maxBytes: PEEK_BYTES,
+							peek: true
+						}));
+					} catch {
+						continue;
+					}
+					if (!peek || !newer(peek) || want.digest !== void 0 && peek.digest !== want.digest) {
+						if (want.miss) this.listingMisses.set(...want.miss);
+						continue;
+					}
+				}
 				let fetched;
 				try {
 					fetched = await this.fetchBundle(url);
@@ -12555,6 +12074,7 @@ var Apps = class {
 				const { bundle, bytes } = fetched;
 				const version = versionOf(bundle.manifest, bundle.digest);
 				if (version.ref !== app.ref || known.has(version.digest)) continue;
+				if (want.digest !== void 0 && version.digest !== want.digest) continue;
 				if (app.pending && version.sequence === app.pending.sequence) {
 					app = {
 						...app,
@@ -12585,17 +12105,21 @@ var Apps = class {
 					}
 					continue;
 				}
-				if (this.runStatus(version, stores, app.revocations).status !== "ok") continue;
+				if (this.runStatus(version, this.storeViews(stores), app.revocations).status !== "ok") continue;
 				if (app.pending && version.sequence < app.pending.sequence) continue;
 				const kind = await this.writeBundle(version.digest, bytes);
+				wrote = {
+					bytes: kind,
+					digest: version.digest
+				};
 				if (plan.action === "install") {
 					const old = app;
-					app = this.versionRecord(app, bundle, kind, url);
-					if (old.pending && old.pending.sequence <= version.sequence) {
-						await this.removeBundle(old.pending.bytes, old.pending.digest);
-						delete app.pending;
-					}
-					await this.putApp(app);
+					const next = this.versionRecord(app, bundle, kind, url, app.store);
+					const passed = old.pending && old.pending.sequence <= version.sequence ? old.pending : void 0;
+					if (passed) delete next.pending;
+					if (!await this.putAppIfInstalled(next, first.installedAt)) break;
+					app = next;
+					if (passed) await this.removeBundle(passed.bytes, passed.digest);
 					await this.removeBundle(old.bytes, old.digest);
 					outcome = "updated";
 				} else {
@@ -12616,16 +12140,24 @@ var Apps = class {
 				}
 				break;
 			}
-			const revocations = await this.readRevocations(app.ref, [app.from, ...app.manifest.sources ?? []]);
-			const merged = new Map((app.revocations ?? []).map((r) => [canonicalJson(r), r]));
-			for (const r of revocations) merged.set(canonicalJson(r), r);
-			if (!await this.app(app.ref)) continue;
+			const after = await this.readRevocations(app.ref, [app.from, ...app.manifest.sources ?? []], revokeRead);
+			const revocations = before || after ? [...before ?? [], ...after ?? []] : null;
+			const versions = [app, ...app.pending ? [versionOf(app.pending.manifest, app.pending.digest)] : []];
+			const stays = (app.revocations ?? []).filter((r) => !revocations || versions.some((v) => appRevocationFor(v, [r])));
+			const merged = new Map([...stays, ...revocations ?? []].map((r) => [canonicalJson(r), r]));
+			if ((await this.app(app.ref))?.store === void 0 && app.store !== void 0) {
+				const { store: _s, ...unpinned } = app;
+				app = unpinned;
+			}
 			app = {
 				...app,
 				...merged.size && { revocations: [...merged.values()] },
 				checkedAt: this.now()
 			};
-			await this.putApp(app);
+			if (!await this.putAppIfInstalled(app, first.installedAt)) {
+				if (wrote) await this.removeUnusedBundle(app.ref, wrote.bytes, wrote.digest);
+				continue;
+			}
 			out.push({
 				ref: app.ref,
 				outcome,
@@ -12638,15 +12170,19 @@ var Apps = class {
 	* Fetches an installed app's bundle again when it is not on this device (a profile restored from a backup, which
 	* carries the installed list but no bundle: WISP 1200 § Where installed apps live). Only the installed digest is
 	* taken, checked whole: from the URL it was installed from, the listings of the person's stores that name that digest,
-	* then its `sources`. Nothing answers: it stays `needs-files`, and it never runs unchecked.
+	* then its `sources` (for an app installed from a store: only that store's listing, never its sources). Nothing
+	* answers: it stays `needs-files`, and it never runs unchecked.
 	*/
 	async fetchFiles({ ref }) {
 		const app = await this.installedOrFail(ref);
 		const stores = await this.stores();
 		if (await this.hasBundle(app.bytes, app.digest)) return this.runCheckOf(app, stores);
 		const urls = [app.from];
-		for (const s of stores) for (const listing of s.index?.apps ?? []) if (listing.ref === app.ref && listing.digest === app.digest) urls.push(...listing.urls);
-		urls.push(...app.manifest.sources ?? []);
+		for (const s of stores) {
+			if (app.store !== void 0 && s.key !== app.store) continue;
+			for (const listing of s.index?.apps ?? []) if (listing.ref === app.ref && listing.digest === app.digest) urls.push(...listingUrls(listing.urls));
+		}
+		if (app.store === void 0) urls.push(...app.manifest.sources ?? []);
 		for (const url of new Set(urls.filter(isAppFetchUrl))) {
 			let fetched;
 			try {
@@ -12674,7 +12210,7 @@ var Apps = class {
 	}
 	async runCheckOf(app, stores) {
 		if (!await this.hasBundle(app.bytes, app.digest)) return { status: "needs-files" };
-		return this.runStatus(app, stores, app.revocations);
+		return this.runStatus(app, this.storeViews(stores), app.revocations);
 	}
 	/** Before an app runs (WISP 1200 § Takedowns): revoked stops it, removed by a store of the person's warns. No request. */
 	async runCheck({ ref }) {
@@ -12710,6 +12246,9 @@ var Apps = class {
 	/** A file of the installed bundle, for the broker's `file` (`ghostly.file(path)`). */
 	async file({ ref, path }) {
 		const app = path === "icon.png" ? await this.installedOrFail(ref) : await this.runningOrFail(ref);
+		const icon = path === "icon.png" ? this.icons.get(app.digest) : void 0;
+		if (icon) return icon.slice();
+		if (icon === null) fail("no-file", "No such file in this app");
 		const bundle = await this.verifiedBundle(app);
 		if (typeof path !== "string" || !bundle.files.has(path)) fail("no-file", "No such file in this app");
 		return bundle.files.get(path).slice();
@@ -12762,7 +12301,11 @@ var Apps = class {
 		const tx = (await openDb()).transaction([STORES$1.apps, STORES$1.appStorage], "readwrite");
 		tx.objectStore(STORES$1.apps).delete(app.ref);
 		tx.objectStore(STORES$1.appStorage).delete(rowsOf(app.ref));
-		await done(tx);
+		try {
+			await done(tx);
+		} finally {
+			this.held.delete(app.ref);
+		}
 		for (const key of [...this.usage.keys()]) if (key.startsWith(`${app.ref}\0`)) this.usage.delete(key);
 		await this.removeBundle(app.bytes, app.digest);
 		if (app.pending) await this.removeBundle(app.pending.bytes, app.pending.digest);
@@ -12826,7 +12369,12 @@ var Apps = class {
 				name
 			])))?.size ?? 0) + size;
 			if (next > APP_STORAGE_LIMITS.scopeBytes) fail("full", "This app's storage in this chat is full (5 MiB)");
-			await wrap((await store(STORES$1.appStorage, "readwrite")).put({
+			const writing = await store(STORES$1.appStorage, "readwrite");
+			if (where !== "alone" && !this.host.isChat(where)) {
+				this.usage.delete(`${app.ref}\0${where}`);
+				fail("bad-scope", "Not a chat of this profile");
+			}
+			await wrap(writing.put({
 				ref: app.ref,
 				scope: where,
 				key: name,
@@ -12871,7 +12419,12 @@ var Apps = class {
 				scope: row.scope,
 				entries: {}
 			};
-			out.entries[row.key] = JSON.parse(row.value);
+			Object.defineProperty(out.entries, row.key, {
+				value: JSON.parse(row.value),
+				enumerable: true,
+				writable: true,
+				configurable: true
+			});
 			scopes.set(row.scope, out);
 		}
 		return [...scopes.values()];
@@ -13197,7 +12750,26 @@ function parseDeviceRecord(value) {
 		if (!o || typeof o !== "object" || !bytes(o.d) || !bytes(o.tombstone) || !bytes(o.packet) || !(o.at === null || count(o.at, Number.MAX_SAFE_INTEGER))) return bad("ownSet");
 		if (!Array.isArray(o.sources) || o.sources.length > 16 || !o.sources.every(text)) return bad("ownSet");
 	}
-	return value;
+	return cleanNames(value);
+}
+/**
+* The record with every device name as `turnName` makes one: a name is another device's own word, and a build that did
+* not clean names may have stored it. The same record when there is nothing to clean.
+*/
+function cleanNames(record) {
+	const dirty = (entry) => !!entry && turnName(entry.name) !== entry.name;
+	if (!record.deviceSet.some(dirty) && !record.unfinishedGrants?.some(dirty)) return record;
+	return {
+		...record,
+		deviceSet: record.deviceSet.map((slot) => slot && {
+			...slot,
+			name: turnName(slot.name)
+		}),
+		...record.unfinishedGrants ? { unfinishedGrants: record.unfinishedGrants.map((grant) => ({
+			...grant,
+			name: turnName(grant.name)
+		})) } : {}
+	};
 }
 function checked(record) {
 	return parseDeviceRecord(record);
@@ -14982,6 +14554,8 @@ async function openTurnKeeper(profile, network, options = {}) {
 		signer: (bytes) => identity.key.sign(bytes)
 	});
 }
+/** A joiner with no session yet puts its packet out again this often: another device on the same code may have replaced it. */
+var ENROLL_REPUT_MS = 5e3;
 /** How long, and how often, the joiner reads the turn record for the record that lists it. */
 var ENROLL_FINISH = {
 	rounds: 20,
@@ -15146,6 +14720,8 @@ var EnrollInviter = class extends Enrollment {
 	stopDoneWait = null;
 	/** A joiner was seen on the link: from then it has as long as a joiner waits for the proof to open a session. */
 	seen = false;
+	/** The person answered the digits: one answer is taken, before the record is read or written for it. */
+	answered = false;
 	constructor(options) {
 		super(options, {
 			role: "inviter",
@@ -15260,7 +14836,8 @@ var EnrollInviter = class extends Enrollment {
 	* and nothing was written.
 	*/
 	async confirm(match) {
-		if (this.over || this.view.step !== "confirm" || !this.joiner) throw new Error("There are no digits to confirm");
+		if (this.over || this.answered || this.view.step !== "confirm" || !this.joiner) throw new Error("There are no digits to confirm");
+		this.answered = true;
 		if (!match) {
 			await this.fail("digits", "digits", this.joiner.name);
 			return this.view;
@@ -15692,6 +15269,11 @@ function ghostLinkEnrollChannel(options) {
 		};
 		let link = null;
 		const rtc = !!options.createPeerConnection;
+		const intervals = options.pollIntervals ?? DHT_POLL_INTERVALS;
+		let offered = false;
+		const reput = pinned && rtc ? setInterval(() => {
+			if (!opened) link?.republish();
+		}, ENROLL_REPUT_MS) : null;
 		const tryOpen = () => {
 			if (opened || !link?.supportsDevice("enroll/1")) return;
 			const hash = link.sessionTranscriptHash, key = credentials.peerKey;
@@ -15714,7 +15296,10 @@ function ghostLinkEnrollChannel(options) {
 			native: { automatic: true },
 			packetTransports: true,
 			transport: options.transport,
-			pollIntervals: options.pollIntervals,
+			pollIntervals: {
+				...intervals,
+				connected: intervals.active
+			},
 			autoConnect: true,
 			createPeerConnection: () => {
 				if (!options.createPeerConnection) throw new ReferenceError("RTCPeerConnection is not defined");
@@ -15746,7 +15331,11 @@ function ghostLinkEnrollChannel(options) {
 				},
 				onPeerKeyRefused: () => events.onPeerRefused(),
 				onPresence: (presence) => {
-					if (presence.online) events.onPeerSeen?.();
+					if (!presence.online) return;
+					events.onPeerSeen?.();
+					if (!pinned || !rtc || offered || opened) return;
+					offered = true;
+					link?.connect().catch(() => {});
 				},
 				onPacketTransports: (transports) => {
 					if (!transports.includes("webrtc/1")) startNative();
@@ -15778,6 +15367,7 @@ function ghostLinkEnrollChannel(options) {
 			stop: async () => {
 				const running = link;
 				link = null;
+				if (reput) clearInterval(reput);
 				await running?.stop().catch(() => {});
 			}
 		};
@@ -18736,7 +18326,7 @@ async function room() {
 async function handoffSelf(profileHost) {
 	return {
 		app: profileHost.app.replace(/[^0-9A-Za-z.+_-]/g, "").slice(0, 40) || "0",
-		db: 14,
+		db: 15,
 		pins: { ...WALLET_SDK_PINS },
 		kind: profileHost.kind,
 		room: await room(),
@@ -20779,6 +20369,7 @@ var Outbox = class {
 		return this.turn(async () => {});
 	}
 	async requeueUnconfirmed() {
+		if (!this.receipts.size) return;
 		const messages = await this.store.read();
 		for (const id of [...this.receipts.keys()]) {
 			if (messages.find((m) => m.id === id)?.via === "pkarr") {
@@ -20898,6 +20489,24 @@ var days = (ms) => {
 };
 //#endregion
 //#region ../browser/src/engine/edits.ts
+/**
+* My edits on their way to the contact (WISP 400 § Edits), one chat's worth. What goes is always the latest version of
+* a message, read from its row: an edit made while an earlier one waits replaces it, so a bot rewriting a status never
+* queues old versions. It keeps the outbox's resend policy (the window, the attempts, the backoff) in a queue of its
+* own, since the outbox sends rows and an edited row was delivered long ago.
+*
+* An edit goes on a live session where both sides offer edit/1, or on the DHT floor to a contact whose app takes edits
+* there, at most `EDIT_SEND_LIMIT` per window; the rest wait for the window, a confirmation, or the next session. A
+* message that never left yet (`waiting`) carries its latest text when it goes, and its edit follows it.
+*/
+/**
+* A card that goes again live (`restore`, WISP 405 § Cards that went as text) goes at most once per this long: one a
+* reconnect owes many go in a trickle, not a burst. Two edit slots of the pace (10 in 10 s), so cards going again
+* take at most half of it and the author's live updates keep the rest; the CLI paces a card's own updates alike (2.5 s).
+*/
+var CARD_RESTORE_GAP_MS = 2 * EDIT_RATE_WINDOW_MS / 10;
+/** What makes a card the same card across messages: a new message may reuse a card's id, and the newest stands for it. */
+var cardKey = (message) => message.card && `${message.card.kind}\n${message.card.id}`;
 var EditQueue = class {
 	deps;
 	pace;
@@ -20905,6 +20514,13 @@ var EditQueue = class {
 	now;
 	/** Per message: the edit number last sent, when, and how many times that number went. */
 	sent = /* @__PURE__ */ new Map();
+	/** When a card that goes again last went (`CARD_RESTORE_GAP_MS`). */
+	restoredAt = -Infinity;
+	/** The rows known to have an edit on its way, each with when it was last told (`edited`), by `tick`. */
+	known = /* @__PURE__ */ new Map();
+	tick = 0;
+	/** The chat's history was read for the rows with an edit on its way: `known` has them all, until the next session. */
+	learnt = false;
 	timer;
 	flushing = null;
 	again = false;
@@ -20947,17 +20563,48 @@ var EditQueue = class {
 	*/
 	reopened() {
 		this.sent.clear();
+		this.learnt = false;
+	}
+	/** This row has an edit to send (it was just written so): the next look reads it. */
+	edited(id) {
+		this.known.set(id, ++this.tick);
+	}
+	/**
+	* My rows with an edit on its way, by time. `all`: the chat's whole history, when it was read for them (no `row` to
+	* read one by, or nothing learnt yet in this session). Otherwise the known rows are read alone, and one that waits
+	* no more is forgotten, unless it was told again while it was read.
+	*/
+	async pending() {
+		const waits = (m) => m.sender === "me" && !!m.edit?.pending;
+		const row = this.deps.row;
+		if (!row || !this.learnt) {
+			const all = await this.deps.read(), rows = all.filter(waits);
+			for (const m of rows) if (!this.known.has(m.id)) this.known.set(m.id, this.tick);
+			this.learnt = true;
+			return {
+				rows,
+				all
+			};
+		}
+		const asOf = this.tick, ids = [...this.known.keys()];
+		const read = await Promise.all(ids.map((id) => row(id)));
+		const rows = [];
+		read.forEach((m, i) => {
+			if (m && waits(m)) rows.push(m);
+			else if ((this.known.get(ids[i]) ?? 0) <= asOf) this.known.delete(ids[i]);
+		});
+		return { rows: rows.sort((a, b) => a.timestamp - b.timestamp) };
 	}
 	/** The contact confirmed edit `seq` of my message with this wire id. */
 	async received(wireId, seq) {
-		const row = (await this.deps.read()).find((m) => m.sender === "me" && m.wireId === wireId);
+		const row = (await this.pending()).rows.find((m) => m.wireId === wireId);
 		if (!row?.edit?.pending || row.edit.seq > seq) return;
 		this.sent.delete(row.id);
 		await this.deps.settle(row.id, row.edit.seq);
 	}
 	/** The contact confirmed, on the DHT floor, the edit that went there under this id (`dhtEditId`). */
 	async receivedOnDht(id) {
-		const row = (await this.deps.read()).find((m) => m.sender === "me" && m.edit?.pending && m.wireId && dhtEditId(m.wireId, m.edit.seq) === id);
+		const row = (await this.pending()).rows.find((m) => m.wireId && dhtEditId(m.wireId, m.edit.seq) === id);
 		if (!row) return;
 		this.sent.delete(row.id);
 		await this.deps.settle(row.id, row.edit.seq);
@@ -20971,7 +20618,14 @@ var EditQueue = class {
 		if (this.stopped) return;
 		const now = this.now();
 		const said = (m) => this.sent.get(m.id)?.seq === m.edit.seq ? 1 : 0;
-		const due = (await this.deps.read()).filter((m) => m.sender === "me" && m.edit?.pending && m.wireId).sort((a, b) => said(a) - said(b) || a.edit.at - b.edit.at);
+		const { rows, all } = await this.pending();
+		const due = rows.filter((m) => m.wireId).sort((a, b) => said(a) - said(b) || a.edit.at - b.edit.at);
+		const newest = /* @__PURE__ */ new Map();
+		if (due.some((m) => m.edit.restore)) for (const m of all ?? await this.deps.read()) {
+			const key = m.sender === "me" && cardKey(m);
+			if (key && m.timestamp > (newest.get(key) ?? -Infinity)) newest.set(key, m.timestamp);
+		}
+		const gap = this.deps.restoreGapMs ?? CARD_RESTORE_GAP_MS;
 		let next = Infinity;
 		for (const message of due) {
 			const edit = message.edit;
@@ -20980,6 +20634,11 @@ var EditQueue = class {
 				await this.deps.settle(message.id, edit.seq);
 				continue;
 			}
+			if (edit.restore && message.timestamp < (newest.get(cardKey(message) || "") ?? -Infinity)) {
+				this.sent.delete(message.id);
+				await this.deps.settle(message.id, edit.seq);
+				continue;
+			}
 			if (message.delivery === "waiting") continue;
 			if (!this.deps.ready()) return;
 			const last = this.sent.get(message.id);
@@ -20992,6 +20651,10 @@ var EditQueue = class {
 					continue;
 				}
 			}
+			if (edit.restore && this.restoredAt + gap > now) {
+				next = Math.min(next, this.restoredAt + gap);
+				continue;
+			}
 			const pace = this.pace.wait();
 			if (pace > 0) {
 				next = Math.min(next, now + pace);
@@ -21007,6 +20670,7 @@ var EditQueue = class {
 				...message.preview && { pv: message.preview },
 				...message.card && { sc: message.card }
 			}, message)) continue;
+			if (edit.restore) this.restoredAt = now;
 			this.sent.set(message.id, {
 				seq: edit.seq,
 				at: now,
@@ -21616,18 +21280,35 @@ var db = {
 	},
 	async deleteLink(linkId) {
 		await wrap((await store(STORES$1.links, "readwrite")).delete(linkId));
-		const messages = await store(STORES$1.messages, "readwrite");
-		const keys = await wrap(messages.index("byLink").getAllKeys(linkId));
-		await Promise.all(keys.map((key) => wrap(messages.delete(key))));
+		await wrap((await store(STORES$1.messages, "readwrite")).delete(IDBKeyRange.bound([linkId], [linkId, []])));
 		await fileStore.deleteForLink(linkId);
 		await removeFileBytes(`${linkId}-in-`);
 		await removeFileBytes(`${linkId}-out-`);
 		const appStorage = await store(STORES$1.appStorage, "readwrite");
-		const appKeys = await wrap(appStorage.index(APP_STORAGE_CHAT_INDEX).getAllKeys(linkId));
-		await Promise.all(appKeys.map((key) => wrap(appStorage.delete(key))));
+		await new Promise((resolve, reject) => {
+			appStorage.transaction.oncomplete = () => resolve();
+			appStorage.transaction.onerror = appStorage.transaction.onabort = () => reject(appStorage.transaction.error ?? /* @__PURE__ */ new Error("App storage failed"));
+			const request = appStorage.index(APP_STORAGE_CHAT_INDEX).openKeyCursor(IDBKeyRange.only(linkId));
+			request.onsuccess = () => {
+				const cursor = request.result;
+				if (!cursor) return;
+				const [ref] = cursor.primaryKey;
+				appStorage.delete(IDBKeyRange.bound([ref, linkId], [
+					ref,
+					linkId,
+					[]
+				]));
+				cursor.continue();
+			};
+		});
 	},
+	/**
+	* A chat's whole history, by time. Read by its key range (every key is `[linkId, id]`, ids are strings: from `[linkId]`
+	* to `[linkId, []]`), the same rows in the same order as the `byLink` index has them, without looking each one up
+	* again: in the CLI's store (fake-indexeddb) that lookup cost 4-9 times the read itself.
+	*/
 	async getMessages(linkId) {
-		return (await wrap((await store(STORES$1.messages, "readonly")).index("byLink").getAll(linkId))).sort((a, b) => a.timestamp - b.timestamp);
+		return (await wrap((await store(STORES$1.messages, "readonly")).getAll(IDBKeyRange.bound([linkId], [linkId, []])))).sort((a, b) => a.timestamp - b.timestamp);
 	},
 	/** Whether the chat has a message with this id. */
 	async hasMessage(linkId, id) {
@@ -21746,9 +21427,8 @@ var db = {
 	/** The group and its history. */
 	async deleteGroup(groupId) {
 		await wrap((await store(STORES$1.groups, "readwrite")).delete(groupId));
-		const messages = await store(STORES$1.messages, "readwrite");
-		const keys = await wrap(messages.index("byLink").getAllKeys(`group:${groupId}`));
-		await Promise.all(keys.map((key) => wrap(messages.delete(key))));
+		const link = `group:${groupId}`;
+		await wrap((await store(STORES$1.messages, "readwrite")).delete(IDBKeyRange.bound([link], [link, []])));
 	},
 	async getServices() {
 		return wrap((await store(STORES$1.services, "readonly")).getAll());
@@ -21823,10 +21503,16 @@ function noteAfterChange(current, message) {
 		snippet
 	};
 }
+/** The note as its message's row has it now, when that reaction still stands there (not replaced, not taken back). */
+function noteIfStanding(current, message) {
+	const r = message.reactions?.[current.by];
+	return r?.e && r.e === current.emoji && r.at === current.at ? note(message, current.by, r.e, r.at) : void 0;
+}
 /**
-* My reactions in a private group to say again to an edge that opened, in case it missed them: the newest `limit`, of
-* this membership only. One made before I was removed and invited again went out under my old member key; said again
-* now it would go under the new one, and every member would show it twice.
+* My reactions in a private group to say again to an edge that opened, in case it missed them: the newest `limit`,
+* newest first (what the member is likeliest to have missed lands before its pace runs out), of this membership only.
+* One made before I was removed and invited again went out under my old member key; said again now it would go under
+* the new one, and every member would show it twice.
 */
 function groupReactionsToResend(messages, limit) {
 	let joinedAt = 0;
@@ -21838,23 +21524,27 @@ function groupReactionsToResend(messages, limit) {
 			e: r.e,
 			n: r.n
 		}] : [];
-	}).sort((a, b) => b.n - a.n).slice(0, limit).reverse();
+	}).sort((a, b) => b.n - a.n).slice(0, limit);
 }
-/** This side's highest number in a chat: the next one goes past it (and past what still waits to be confirmed). */
-function lastMine(messages, pending = []) {
+/** This side's highest number in a chat's history: the next one goes past it. */
+function lastMine(messages) {
 	let last = 0;
 	for (const m of messages) last = Math.max(last, m.reactions?.me?.n ?? 0);
-	for (const p of pending) last = Math.max(last, p.n);
 	return last;
 }
 var Reactions = class {
 	host;
-	/** Reactions to messages not here yet, per chat, until `REACTION_LIMITS.bufferMs` after they came. */
+	/** Reactions to messages not here yet, per chat, until `REACTION_LIMITS.bufferMs` after they came (`buffer` per sender). */
 	waiting = /* @__PURE__ */ new Map();
 	/** One chat's reactions at a time: a burst for one message lands in order. */
 	queue = Promise.resolve();
 	/** A group member's reactions taken per window (chat and member key), as a paired chat's session limits them. */
 	memberPace = /* @__PURE__ */ new Map();
+	/**
+	* This side's highest number per chat: read from its history the first time I react in it, then each number given
+	* out. It only has to grow, so a row deleted since leaves it too high and nothing is wrong.
+	*/
+	last = /* @__PURE__ */ new Map();
 	constructor(host) {
 		this.host = host;
 	}
@@ -21876,17 +21566,19 @@ var Reactions = class {
 			if (typeof messageId !== "string" || !messageId) return { error: "No message to react to" };
 			const e = emoji === "" ? "" : reactionEmoji(emoji);
 			if (e === null) return { error: "A reaction is one emoji" };
-			const messages = await this.host.messages(chat), group = isGroup$1(chat);
-			const target = messages.find((m) => m.id === messageId) ?? reactionTarget(messages, messageId, group);
-			const id = target && replyRef(target, group);
+			const target = await this.named(chat, messageId);
+			const id = target && replyRef(target, isGroup$1(chat));
 			if (!target || !id) return { error: "That message is not in this chat, or takes no reaction" };
 			const current = target.reactions?.me;
 			if (!e && !current?.e) return { error: "No reaction of yours to take back" };
+			let last = this.last.get(chat) ?? lastMine(await this.host.messages(chat));
+			for (const p of pending) last = Math.max(last, p.n);
 			const reaction = {
 				id,
 				e,
-				n: nextReactionNumber(lastMine(messages, pending), this.now())
+				n: nextReactionNumber(last, this.now())
 			};
+			this.last.set(chat, reaction.n);
 			return {
 				reaction,
 				message: await this.write(chat, target, "me", reaction) ?? target
@@ -21895,7 +21587,7 @@ var Reactions = class {
 	}
 	/**
 	* A reaction that came from `by` (`peer`, or a member's key), already authenticated as theirs. A message not here
-	* yet keeps it for a minute; past the room for that, it is dropped (and, on a 1:1 session, not confirmed).
+	* yet keeps it for five minutes; past the room for that sender, it is dropped (and, on a 1:1 session, not confirmed).
 	*/
 	receive(chat, by, reaction) {
 		if (isGroup$1(chat)) {
@@ -21922,27 +21614,35 @@ var Reactions = class {
 			const now = this.now(), all = (this.waiting.get(message.linkId) ?? []).filter((w) => w.until > now);
 			const mine = all.filter((w) => w.reaction.id === id).sort((a, b) => a.reaction.n - b.reaction.n);
 			this.waiting.set(message.linkId, all.filter((w) => w.reaction.id !== id));
-			for (const { by, reaction } of mine) {
-				const target = reactionTarget(await this.host.messages(message.linkId), id, isGroup$1(message.linkId));
-				if (target && reactionIsNewer(target.reactions?.[by], reaction.n)) await this.write(message.linkId, target, by, reaction);
-			}
+			for (const { by, reaction } of mine) await this.write(message.linkId, message, by, reaction);
 		});
 	}
+	/** The row I react to: by its id here, as the pages name it, read alone; else by the id both sides know it by. */
+	async named(chat, id) {
+		if (this.host.message) return await this.host.message(chat, id) ?? this.find(chat, id);
+		const messages = await this.host.messages(chat);
+		return messages.find((m) => m.id === id) ?? reactionTarget(messages, id, isGroup$1(chat));
+	}
 	/**
 	* The row a received reaction names. Most often the row of that id (a group's), or of `peer_` or `me_` and that id (a
-	* chat's): those are read alone. Any other (a file's, a payment's, one not here yet) is looked for in the whole chat.
+	* chat's): those are read alone. Any other (a file's, a payment's, one not here yet) is looked for in the whole chat;
+	* in a group there is no other, since a row that takes a reaction goes by its own id there.
 	*/
 	async find(chat, id) {
 		const group = isGroup$1(chat);
-		if (this.host.message) for (const rowId of group ? [id] : [`peer_${id}`, `me_${id}`]) {
-			const row = await this.host.message(chat, rowId);
-			if (row && replyRef(row, group) === id) return row;
+		if (this.host.message) {
+			for (const rowId of group ? [id] : [`peer_${id}`, `me_${id}`]) {
+				const row = await this.host.message(chat, rowId);
+				if (row && replyRef(row, group) === id) return row;
+			}
+			if (group) return void 0;
 		}
 		return reactionTarget(await this.host.messages(chat), id, group);
 	}
-	/** A chat is gone: nothing waits for it any more. */
+	/** A chat is gone: nothing waits for it any more, and my highest number in it is read again if it comes back. */
 	forget(chat) {
 		this.waiting.delete(chat);
+		this.last.delete(chat);
 	}
 	wait(chat, by, reaction) {
 		const now = this.now();
@@ -21951,7 +21651,7 @@ var Reactions = class {
 		if (same && same.reaction.n >= reaction.n) return "stale";
 		const kept = list.filter((w) => w !== same);
 		this.waiting.set(chat, kept);
-		if (kept.length >= REACTION_LIMITS.buffer) return "dropped";
+		if (kept.filter((w) => w.by === by).length >= REACTION_LIMITS.buffer) return "dropped";
 		kept.push({
 			by,
 			reaction,
@@ -22117,11 +21817,14 @@ var HubClocks = class {
 };
 //#endregion
 //#region ../browser/src/engine/community.ts
-/** The line a change of a group's picture leaves in its history (both profiles). */
-var pictureText = (name, set) => `${name} ${set ? "changed" : "removed"} the group's picture`;
+/** The line a change of a group's picture leaves in its history (both profiles); without a name, nobody is credited. */
+var pictureText = (name, set) => name === void 0 ? `The group's picture was ${set ? "changed" : "removed"}` : `${name} ${set ? "changed" : "removed"} the group's picture`;
 /** The line a new name leaves (both profiles): `group` is the name the group has now. */
-var renameText = (name, group) => `${name} renamed the group to “${group}”`;
-/** The lines a statement that changed the group's name or picture leaves in its history, in that order. */
+var renameText = (name, group) => name === void 0 ? `The group is now called “${group}”` : `${name} renamed the group to “${group}”`;
+/**
+* The lines a statement that changed the group's name or picture leaves in its history, in that order. No `name` when
+* the core cannot say who made the change (a new admin signed again what the last one set).
+*/
 function metaLines(name, change, group) {
 	return [..."name" in change ? [{
 		event: "renamed",
@@ -22511,7 +22214,8 @@ var Communities = class {
 		await this.store.putGroup(group);
 		this.host.emit();
 	}
-	async send(groupId, text, mentions = [], reply, forwarded, card, file) {
+	/** Whether a message of mine could go to the group now: the refusal `send` would answer for not being in it, or null. */
+	sendCheck(groupId) {
 		const live = this.live.get(groupId);
 		if (!live) return {
 			error: "You are not in this group yet",
@@ -22521,6 +22225,12 @@ var Communities = class {
 			error: live.session.state.statusReason ?? "You are not in this group",
 			refused: true
 		};
+		return { error: null };
+	}
+	async send(groupId, text, mentions = [], reply, forwarded, card, file) {
+		const check = this.sendCheck(groupId);
+		if (check.error) return check;
+		const live = this.live.get(groupId);
 		const now = this.now();
 		const result = card || file ? await live.session.sendText(text, this.host.myNick?.(), now, mentions, reply, forwarded, card, file) : await live.session.sendText(text, this.host.myNick?.(), now, mentions, reply, forwarded);
 		return "error" in result ? { error: result.error } : {
@@ -22650,6 +22360,7 @@ var Communities = class {
 		this.knockRead.delete(groupId);
 		for (const linkId of [...this.host.edges(groupId).values(), ...this.host.entries(groupId).values()]) await this.host.closeEdge(linkId);
 		await this.store.deleteGroup(groupId);
+		await this.files?.drop(groupId);
 		this.host.historyGone?.(groupId);
 		this.host.emit();
 	}
@@ -23403,6 +23114,16 @@ var Communities = class {
 		}
 	}
 	/**
+	* Let in: my knock leaves the record I knocked in. It stayed there until it aged out, and someone opening the link in
+	* the next minute read it as a person still waiting to be let in. Once, in the background; if it fails, it ages out.
+	*/
+	async unknock(link, n, seedB64) {
+		const me = identityFromSeedB64(seedB64).pubKeyZ32, record = knockRecord(link, n);
+		const knocks = readKnocks(record, await this.host.resolve(knockIdentity(record).pubKeyZ32, true) ?? []);
+		if (!knocks.some((k) => k.key === me)) return;
+		await this.host.publish(knockIdentity(record), knockRecords(record, knocks.filter((k) => k.key !== me)), true);
+	}
+	/**
 	* The entry sessions this device runs for joiners go (it is no door any more). Its own, when it is knocking at the
 	* link itself, stays: a hub taken out of the group that opened the link again at once had that session closed by
 	* its next tick (it stops being a hub and a door there), and knocked for good with nothing for a member to answer on.
@@ -23525,6 +23246,10 @@ var Communities = class {
 				await this.store.putGroup(member);
 				if (!again) await this.event(g, "joined", `You joined. ${GROUP_READ_NOTE_COMMUNITY}`, now, joined.state.chain.length - 1);
 				else if (back) await this.event(g, "joined", "You joined again", now, joined.state.chain.length - 1);
+				if (this.knocked.has(g)) this.unknock({
+					g,
+					host: joining.host
+				}, this.knockAt.get(g) ?? KNOCK_BELL, joining.seedB64).catch(() => {});
 				this.lastKnock.delete(g);
 				this.knocked.delete(g);
 				this.knockAt.delete(g);
@@ -23672,7 +23397,7 @@ var Communities = class {
 				this.membershipChanged(id);
 			},
 			metaChanged: (by, change, at) => {
-				const name = by === session.myKey ? "You" : session.state.nicks[by] ?? `Member ${by.slice(0, 8)}`;
+				const name = by === void 0 ? void 0 : by === session.myKey ? "You" : session.state.nicks[by] ?? `Member ${by.slice(0, 8)}`;
 				const when = receivedTimestamp(at, this.now());
 				(async () => {
 					for (const line of metaLines(name, change, session.name)) await this.event(id, line.event, line.text, when, session.epoch, by);
@@ -23869,7 +23594,8 @@ var MeshHubs = class {
 				primed: false,
 				gone: /* @__PURE__ */ new Map(),
 				reactions: /* @__PURE__ */ new Map(),
-				need: 0
+				need: 0,
+				departed: /* @__PURE__ */ new Set()
 			});
 		}
 		return live;
@@ -23921,10 +23647,36 @@ var MeshHubs = class {
 		const live = this.live.get(groupId);
 		if (!live || !this.large(session)) return [];
 		const policy = session.hubPolicy, inRoster = (key) => rosterHas(session.roster, key);
-		const out = new Set(meshHubs(live.beacon, session.myKey, policy, inRoster, now).map((h) => h.key));
-		for (const [key, at] of live.seenHubs) if (now - at <= this.timings.graceMs && key !== session.myKey && inRoster(key) && !policy.no.includes(key)) out.add(key);
+		const out = new Set(this.listed(live, session, now).map((h) => h.key));
+		for (const [key, at] of live.seenHubs) if (now - at <= this.timings.graceMs && key !== session.myKey && inRoster(key) && !policy.no.includes(key) && !live.departed.has(key)) out.add(key);
 		return [...out];
 	}
+	/** The beacon's hubs a member counts on (`meshHubs`), but those that said they leave. */
+	listed(live, session, now) {
+		return meshHubs(live.beacon, session.myKey, session.hubPolicy, (key) => rosterHas(session.roster, key), now).filter((h) => !live.departed.has(h.key));
+	}
+	/**
+	* A member said on its own edge that it leaves: if it was a hub, it is none from now on, rather than until the beacon
+	* forgets it and its grace runs out (the commit that takes it out may have no other way here). True when a hub went.
+	*/
+	departs(groupId, key) {
+		const live = this.live.get(groupId);
+		if (!live || live.departed.has(key)) return false;
+		live.departed.add(key);
+		const was = live.seenHubs.delete(key) || live.myHubs.includes(key) || live.beacon.some((h) => h.key === key);
+		live.reach.delete(key);
+		live.hubsUp.delete(key);
+		live.myHubs = live.myHubs.filter((k) => k !== key);
+		return was;
+	}
+	/** As a hub that leaves the group: out of the beacon on my way, while the session can still write it. */
+	async stepDown(groupId, session, now) {
+		const live = this.live.get(groupId);
+		if (!live?.hub) return;
+		live.hub = false;
+		live.members.clear();
+		await this.publish(groupId, session, live, now, false).catch(() => {});
+	}
 	/** The group runs on hubs: it is large, and I am a hub or know of one. Else it is the full mesh. */
 	active(groupId, session, now) {
 		return this.large(session) && (this.isHub(groupId) || this.hubs(groupId, session, now).length > 0);
@@ -24021,7 +23773,7 @@ var MeshHubs = class {
 		const may = mayBeHub(me, policy, inRoster, this.staysOnline);
 		const readEvery = live.hub || may ? this.timings.beaconEveryMs : this.timings.beaconReadMs;
 		if (!live.lastRead || now - live.lastRead >= readEvery) await this.read(groupId, session, live, now);
-		const others = meshHubs(live.beacon, me, policy, inRoster, now);
+		const others = this.listed(live, session, now);
 		const fits = this.fits(groupId, session);
 		if (live.hub) live.need = session.others.length;
 		if (!live.hub && may && fits && (policy.pin.includes(me) || others.length < MESH_HUBS.maxHubs)) {
@@ -24062,8 +23814,9 @@ var MeshHubs = class {
 		this.noteHubs(live, session, now);
 	}
 	noteHubs(live, session, now) {
-		for (const h of meshHubs(live.beacon, session.myKey, session.hubPolicy, (key) => rosterHas(session.roster, key), now)) live.seenHubs.set(h.key, now);
+		for (const h of this.listed(live, session, now)) live.seenHubs.set(h.key, now);
 		for (const [key, at] of live.seenHubs) if (now - at > this.timings.graceMs || !rosterHas(session.roster, key)) live.seenHubs.delete(key);
+		for (const key of live.departed) if (!rosterHas(session.roster, key)) live.departed.delete(key);
 	}
 	/** My entry in the beacon (or none, stepping down), merged with the other fresh hubs I do not drop. */
 	async publish(groupId, session, live, now, listed) {
@@ -24148,7 +23901,7 @@ var MeshHubs = class {
 				live.hubWaits.delete(key);
 			}
 		}
-		const fresh = meshHubs(live.beacon, me, session.hubPolicy, (key) => rosterHas(session.roster, key), now);
+		const fresh = this.listed(live, session, now);
 		const candidates = [...fresh, ...[...hubs].filter((key) => !fresh.some((h) => h.key === key)).map((key) => ({
 			key,
 			ts: 0,
@@ -24264,7 +24017,7 @@ var MeshHubs = class {
 		if (!rosterHas(session.roster, from) || !Array.isArray(frame.k) || frame.k.length > session.roster.length) return false;
 		const live = this.get(groupId, now);
 		live.reach.set(from, new Set(frame.k.filter((key) => typeof key === "string" && rosterHas(session.roster, key))));
-		if (!session.hubPolicy.no.includes(from) && from !== session.myKey) live.seenHubs.set(from, now);
+		if (!session.hubPolicy.no.includes(from) && from !== session.myKey && !live.departed.has(from)) live.seenHubs.set(from, now);
 		if (!Array.isArray(frame.l) || frame.l.length > session.roster.length) return false;
 		const legacy = new Set(group.legacy ?? []);
 		let changed = false;
@@ -24744,6 +24497,22 @@ var ENTRY_RELEASE_MS = 2e3;
 var REMOVED_LINGER_MS = 15e3;
 /** How long the tombstone of a group I left waits for the admin to hear it. */
 var LEFT_KEPT_MS = 6048e5;
+/**
+* Invitee side: an accept the admin has not answered with a welcome is said again this often while the inviter's chat
+* is up, and at once when it comes up, at most `ACCEPT_AGAINS` times each time it does (its app may have restarted).
+*/
+var ACCEPT_AGAIN_MS = 6e4;
+var ACCEPT_AGAINS = 5;
+/** Invitee side: the invitations one contact chat may have waiting here at a time. More are answered as declined. */
+var MAX_INVITATIONS_PER_CHAT = 4;
+/** What an invitation says of its group, kept as a claim within what a group can be: an epoch from 0, a roster of 1 to the most a group holds. */
+function invitationClaims(frame) {
+	const e = Number.isSafeInteger(frame.e) ? frame.e : 0, n = Number.isSafeInteger(frame.n) ? frame.n : 1;
+	return {
+		e: Math.max(e, 0),
+		n: Math.min(Math.max(n, 1), GROUP_MEMBER_CAP.max)
+	};
+}
 /** Syncs of a removed member answered with the commits it lacks, per farewell: it needs one. */
 var FAREWELL_ANSWERS = 3;
 /** Commits sent to a removed member that was behind when it left, at most. */
@@ -24805,8 +24574,10 @@ var Groups = class {
 	timings;
 	stored = /* @__PURE__ */ new Map();
 	sessions = /* @__PURE__ */ new Map();
-	/** Contacts (chat ids) I invited to each group, until they answer or the app restarts. */
+	/** Contacts (chat ids, kept in `StoredGroup.invited`) and entry sessions I invited to each group, until they answer. */
 	invited = /* @__PURE__ */ new Map();
+	/** Invitee side: when my accept of each invitation was last said, how many times since the inviter's chat came up, and whether it was down. */
+	acceptSaid = /* @__PURE__ */ new Map();
 	lastRoster = /* @__PURE__ */ new Map();
 	/** Each group's status and newest commit as its history last said them: a line per change of either, never one again. */
 	lastTold = /* @__PURE__ */ new Map();
@@ -24849,6 +24620,14 @@ var Groups = class {
 	*/
 	relayAsked = /* @__PURE__ */ new Map();
 	lastGossip = /* @__PURE__ */ new Map();
+	/**
+	* Per mesh group, each reachable member some of whose messages never reached me (`GroupSession.lacking`): what was
+	* missing when it was asked for, and of whom since. Each connected member once until that changes, so messages nobody
+	* holds any more are not asked for every gossip turn. `last`: the latest ask, its member and the numbers it named.
+	*/
+	gapsAsked = /* @__PURE__ */ new Map();
+	/** Per mesh group, when `gapsAgain` last looked: every half `MESH_GAP_AGAIN_MS`, not every tick. */
+	gapsLooked = /* @__PURE__ */ new Map();
 	/** Per mesh group: member key → since when its edge to me is down, and when someone last told me it is here. */
 	downSince = /* @__PURE__ */ new Map();
 	hereHeard = /* @__PURE__ */ new Map();
@@ -24917,12 +24696,14 @@ var Groups = class {
 			this.communities.files = this.files;
 		}
 	}
-	async load() {
+	/** `asItIs`: a copy that must stay as it was stored (limited mode, WISP 06), so nothing left over is cleared from it. */
+	async load(asItIs = false) {
 		const all = await this.store.getGroups();
 		await this.communities.load(all.filter((g) => g.community || g.joining));
 		for (const group of all.filter((g) => !g.community && !g.joining)) {
 			this.stored.set(group.id, group);
 			if (group.state) this.attach(group.state);
+			if (group.invited) this.invited.set(group.id, new Set(Object.keys(group.invited)));
 			const history = await this.store.getMessages(MESSAGE_LINK(group.id)), said = history.filter((m) => !m.event && !m.groupPay);
 			const last = said[said.length - 1], lastPeer = [...said].reverse().find((m) => m.sender !== "me");
 			if (last) this.lastMessageAt.set(group.id, last.timestamp);
@@ -24934,6 +24715,7 @@ var Groups = class {
 		}
 		for (const id of this.sessions.keys()) this.reconcileEdges(id);
 		await this.files?.load(all.map((g) => g.id));
+		if (!asItIs) await this.files?.sweep(all.map((g) => g.id));
 		for (const group of this.stored.values()) for (const [, linkId] of this.host.entries(group.id)) if (!group.invitation?.entry || group.invitation.linkId !== linkId) await this.host.closeEdge(linkId);
 	}
 	/** A group's pin now (WISP 400 § Pinned message), the latest one taken, unpinned or not. */
@@ -24989,7 +24771,7 @@ var Groups = class {
 						linkId: invitation.linkId,
 						contact: this.host.contactName(invitation.linkId) ?? "",
 						admin: invitation.admin,
-						members: invitation.n,
+						members: Math.min(Math.max(invitation.n, 0), GROUP_MEMBER_CAP.max),
 						accepted: !!invitation.seedB64,
 						...invitation.entry ? {
 							viaLink: true,
@@ -25130,8 +24912,21 @@ var Groups = class {
 		let set = this.invited.get(groupId);
 		if (!set) this.invited.set(groupId, set = /* @__PURE__ */ new Set());
 		set.add(linkId);
+		group.invited = {
+			...group.invited,
+			[linkId]: Date.now()
+		};
+		await this.store.putGroup(group);
 		this.host.emit();
 	}
+	/** Admin side: a contact chat answered its invitation (accepted or declined); false when it had none. */
+	answered(group, linkId) {
+		const had = !!this.invited.get(group.id)?.delete(linkId);
+		if (!group.invited?.[linkId]) return had;
+		const { [linkId]: _answered, ...rest } = group.invited;
+		group.invited = Object.keys(rest).length ? rest : void 0;
+		return true;
+	}
 	async accept(groupId) {
 		const group = this.stored.get(groupId);
 		if (!group?.invitation) throw new Error("No invitation to accept");
@@ -25148,6 +24943,10 @@ var Groups = class {
 			g: groupId,
 			key: identityFromSeedB64(seedB64).pubKeyZ32
 		});
+		this.acceptSaid.set(groupId, {
+			at: this.now(),
+			n: 0
+		});
 		this.host.emit();
 	}
 	async decline(groupId) {
@@ -25160,7 +24959,12 @@ var Groups = class {
 				g: groupId
 			});
 		} catch {}
-		await this.forget(groupId);
+		const previous = group.previous;
+		if (!previous) return this.forget(groupId);
+		this.stored.set(groupId, previous);
+		if (previous.state) this.attach(previous.state);
+		await this.store.putGroup(previous);
+		this.host.emit();
 	}
 	/**
 	* Sends a text; `messageId` is the id it is kept under here (what history, replies and reactions name). `forwarded`:
@@ -25178,6 +24982,23 @@ var Groups = class {
 		};
 	}
 	/**
+	* Whether a file of mine could be announced in the group now, asked before its bytes are copied in: the error
+	* `sendFile` would answer for the pace or for not being in the group, or null. `sendFile` checks again.
+	*/
+	fileCheck(groupId) {
+		if (!this.files) return {
+			error: "This app takes no group files",
+			refused: true
+		};
+		const paced = this.files.mayAnnounce(groupId);
+		if (paced) return { error: paced };
+		if (this.isCommunity(groupId)) return this.communities.sendCheck(groupId);
+		const session = this.sessions.get(groupId);
+		if (!session) return { error: "You are not in this group yet" };
+		if (session.status !== "active") return { error: session.state.statusReason ?? "You are no longer in this group" };
+		return { error: null };
+	}
+	/**
 	* Announces a file or voice message of mine (WISP 503): `text` is its caption, or the line older apps show
 	* (`groupFileFallback`), `file` its description with the digest of the bytes kept under `fileId`, which this device
 	* then holds and serves. `messageId` is the announcement's.
@@ -25256,8 +25077,8 @@ var Groups = class {
 		});
 	}
 	/**
-	* Leaves, and the group is gone from this device at once: its row, its history and every edge
-	* but the one to the admin, which stays until the admin's commit removing me comes back (or a
+	* Leaves, and the group is gone from this device at once: its row, its history, its files and every
+	* edge but the one to the admin, which stays until the admin's commit removing me comes back (or a
 	* week passes), so a leave said while the admin was away still reaches it. An admin with other
 	* members hands the role to one who is online first; alone, the group simply goes.
 	*/
@@ -25286,6 +25107,7 @@ var Groups = class {
 			...bye ? { bye } : {}
 		};
 		delete group.entry;
+		delete group.invited;
 		this.invited.delete(groupId);
 		this.pendingEntries.delete(groupId);
 		this.welcomed.delete(groupId);
@@ -25295,9 +25117,18 @@ var Groups = class {
 		this.lastMentionAt.delete(groupId);
 		await this.store.deleteGroup(groupId);
 		await this.store.putGroup(group);
+		await this.files?.drop(groupId);
 		this.host.historyGone?.(groupId);
 		for (const linkId of this.host.entries(groupId).values()) await this.host.closeEdge(linkId);
 		this.host.emit();
+		if (this.hubs.isHub(groupId)) {
+			await this.hubs.stepDown(groupId, session, this.now());
+			if (bye) {
+				for (const [key, edge] of this.host.edges(groupId)) if (!hubs.includes(key) && this.host.linkReady(edge)) try {
+					this.host.sendOnLink(edge, bye);
+				} catch {}
+			}
+		}
 		await session.leave();
 		if (bye) for (const key of hubs) {
 			const edge = this.host.edges(groupId).get(key);
@@ -25470,17 +25301,17 @@ var Groups = class {
 		await this.session(groupId).rename(name);
 	}
 	async forget(groupId) {
-		if (this.isCommunity(groupId)) {
-			await this.communities.forget(groupId);
-			await this.files?.drop(groupId);
-			return;
-		}
-		if (this.sessions.get(groupId)?.status === "active") try {
+		if (this.isCommunity(groupId)) return this.communities.leave(groupId);
+		const session = this.sessions.get(groupId);
+		if (session?.status === "active") try {
 			await this.leave(groupId);
-		} catch {}
+		} catch (e) {
+			if (session.isAdmin && session.others.length) throw e;
+		}
 		this.sessions.delete(groupId);
 		this.stored.delete(groupId);
 		this.invited.delete(groupId);
+		this.acceptSaid.delete(groupId);
 		this.lastRoster.delete(groupId);
 		this.lastTold.delete(groupId);
 		this.pendingEntries.delete(groupId);
@@ -25494,6 +25325,8 @@ var Groups = class {
 		this.hubs.forget(groupId);
 		this.removedAt.delete(groupId);
 		this.lastGossip.delete(groupId);
+		this.gapsAsked.delete(groupId);
+		this.gapsLooked.delete(groupId);
 		this.typings.forget(groupId);
 		this.downSince.delete(groupId);
 		this.hereHeard.delete(groupId);
@@ -25557,6 +25390,8 @@ var Groups = class {
 		const existing = this.stored.get(link.g);
 		if (existing?.state?.status === "active" || existing?.invitation?.entry === link.host) return link.g;
 		if (existing?.invitation?.seedB64 && !existing.invitation.entry) throw new Error("You are already joining this group");
+		if (existing?.invitation && !existing.invitation.entry) throw new Error("You have an invitation to this group. Answer it first.");
+		if (existing?.state && !existing.left) throw new Error("You are out of this group and its history is still here. Delete it from this device to join with a link.");
 		if (existing) await this.forget(link.g);
 		const seedB64 = dialedKey(link);
 		const linkId = await this.host.openEntry(link, "guest", seedB64, link.host);
@@ -25596,6 +25431,10 @@ var Groups = class {
 					if (!(this.host.linkReady(group.invitation.linkId) || !!this.host.linkSeen?.(group.invitation.linkId)) && (now - (this.lastKnock.get(group.id) ?? 0) >= every || now >= (this.knockCheckAt.get(group.id) ?? Infinity))) await this.knock(group, now).catch(() => {});
 					continue;
 				}
+				if (group.invitation?.seedB64 && !group.state) {
+					this.acceptAgain(group, now);
+					continue;
+				}
 				const session = this.sessions.get(group.id);
 				if (!group.entry || !session) continue;
 				if (!session.isAdmin) {
@@ -25642,6 +25481,7 @@ var Groups = class {
 		}
 		for (const [groupId, session] of this.sessions) {
 			const group = this.stored.get(groupId);
+			if (session.status !== "active" && !this.removedAt.has(groupId) && this.hubs.isHub(groupId)) this.hubs.forget(groupId);
 			if (!group || group.left || session.status !== "active" || !this.hubs.large(session)) continue;
 			await this.hubs.tick(groupId, session, group, now).catch(() => false);
 			if (this.hubReconcile.has(groupId)) continue;
@@ -25653,6 +25493,39 @@ var Groups = class {
 			}
 		}
 	}
+	/**
+	* Invitee side: my accept, not answered with a welcome yet, goes again over the inviter's chat (`ACCEPT_AGAIN_MS`):
+	* the admin's app may have been closed or started again since, and an accept it never read waits for good otherwise.
+	* An admin that let me in already, or never invited me, ignores it.
+	*/
+	acceptAgain(group, now) {
+		const invitation = group.invitation, said = this.acceptSaid.get(group.id) ?? {
+			at: 0,
+			n: 0
+		};
+		if (!this.host.linkReady(invitation.linkId)) {
+			if (!said.down) this.acceptSaid.set(group.id, {
+				...said,
+				n: 0,
+				down: true
+			});
+			return;
+		}
+		if (said.n >= ACCEPT_AGAINS || !said.down && now - said.at < ACCEPT_AGAIN_MS) return;
+		try {
+			this.host.sendOnLink(invitation.linkId, {
+				t: "group-accept",
+				g: group.id,
+				key: identityFromSeedB64(invitation.seedB64).pubKeyZ32
+			});
+		} catch {
+			return;
+		}
+		this.acceptSaid.set(group.id, {
+			at: now,
+			n: said.n + 1
+		});
+	}
 	/** An entry session came up with groups on both sides: the admin's side invites over it. */
 	entryReady(groupId, linkId, peer) {
 		if (this.isCommunity(groupId)) {
@@ -25823,8 +25696,7 @@ var Groups = class {
 						name: groupName(frame.name) ?? "Group",
 						admin: frame.admin,
 						pieces: [],
-						e: Number.isSafeInteger(frame.e) ? frame.e : 0,
-						n: Number.isSafeInteger(frame.n) ? frame.n : 1
+						...invitationClaims(frame)
 					};
 					await this.store.putGroup(existing);
 					traceJoin(g, "invite.received");
@@ -25836,13 +25708,32 @@ var Groups = class {
 					this.host.emit();
 					return;
 				}
-				if (existing?.state && existing.state.status === "active") return;
-				if (existing?.invitation?.seedB64) return;
+				if (existing?.state && existing.state.status === "active") {
+					if (this.sessions.get(g)?.admin === frame.admin) this.host.sendOnLink(linkId, {
+						t: "group-decline",
+						g
+					});
+					return;
+				}
+				if (existing?.invitation?.seedB64 && (existing.invitation.linkId !== linkId || existing.invitation.admin !== frame.admin)) return;
+				if (existing?.left && (existing.left.admin !== frame.admin || existing.contacts?.[existing.left.admin] !== linkId)) return;
+				if (existing?.invitation && !existing.state && existing.invitation.linkId !== linkId && !existing.invitation.genesis) return;
 				if ([...this.stored.values()].filter((x) => x.invitation).length >= 32) return;
+				if (!existing?.invitation && [...this.stored.values()].filter((x) => x.invitation?.linkId === linkId).length >= MAX_INVITATIONS_PER_CHAT) {
+					try {
+						this.host.sendOnLink(linkId, {
+							t: "group-decline",
+							g
+						});
+					} catch {}
+					return;
+				}
 				const known = {
 					...existing?.formerNames,
 					...existing?.state?.nicks
 				};
+				const previous = existing?.state ? existing : existing?.previous;
+				const genesis = existing?.state ? commitHash(existing.state.chain[0]) : existing?.invitation?.genesis;
 				const invitation = {
 					id: g,
 					createdAt: Date.now(),
@@ -25850,17 +25741,19 @@ var Groups = class {
 						name: groupName(frame.name) ?? "Group",
 						admin: frame.admin,
 						linkId,
-						e: Number.isSafeInteger(frame.e) ? frame.e : 0,
-						n: Number.isSafeInteger(frame.n) ? frame.n : 1,
-						pieces: []
+						...invitationClaims(frame),
+						pieces: [],
+						...genesis ? { genesis } : {}
 					},
-					...Object.keys(known).length ? { formerNames: known } : {}
+					...Object.keys(known).length ? { formerNames: known } : {},
+					...previous ? { previous } : {}
 				};
 				if (existing) {
 					this.sessions.delete(g);
 					for (const edge of this.host.edges(g).values()) await this.host.closeEdge(edge);
 				}
 				this.stored.set(g, invitation);
+				this.acceptSaid.delete(g);
 				await this.store.putGroup(invitation);
 				this.host.emit();
 				return;
@@ -25869,6 +25762,7 @@ var Groups = class {
 				const session = this.sessions.get(g);
 				if (!session?.isAdmin || !this.invited.get(g)?.has(linkId) || typeof frame.key !== "string" || !MEMBER_KEY.test(frame.key)) return;
 				const group = this.stored.get(g);
+				if (frame.key === session.myKey || rosterHas(session.roster, frame.key)) return;
 				const entryPeer = this.hostEntry(g, linkId);
 				if ([...this.host.entries(g).values()].includes(linkId) && entryPeer !== frame.key) return;
 				if (session.roster.length >= GROUP_MEMBER_CAP.max || this.growthBlocked(group, session, session.roster.length + 1, linkId)) return;
@@ -25880,8 +25774,8 @@ var Groups = class {
 					...group.contacts,
 					[frame.key]: linkId
 				};
+				this.answered(group, linkId);
 				await this.store.putGroup(group);
-				this.invited.get(g)?.delete(linkId);
 				for (const piece of welcome) this.host.sendOnLink(linkId, piece);
 				if (entryPeer) traceJoin(g, "welcome.sent");
 				if (entryPeer) {
@@ -25905,7 +25799,10 @@ var Groups = class {
 					this.pendingEntries.get(g)?.delete(entryPeer);
 					await this.host.closeEdge(linkId);
 				}
-				if (this.invited.get(g)?.delete(linkId)) this.host.emit();
+				const group = this.stored.get(g);
+				if (!group || !this.answered(group, linkId)) return;
+				await this.store.putGroup(group);
+				this.host.emit();
 				return;
 			}
 			case "group-chain": {
@@ -25930,6 +25827,20 @@ var Groups = class {
 					group.invitation.pieces = [];
 					return;
 				}
+				if (group.invitation.genesis && commitHash(joined.state.chain[0]) !== group.invitation.genesis) {
+					try {
+						this.host.sendOnLink(linkId, {
+							t: "group-decline",
+							g
+						});
+					} catch {}
+					delete group.invitation.seedB64;
+					group.invitation.pieces = [];
+					this.acceptSaid.delete(g);
+					await this.store.putGroup(group);
+					this.host.emit();
+					return;
+				}
 				const viaLink = !!group.invitation.entry;
 				this.meet(g, group.invitation.admin);
 				const member = {
@@ -25939,6 +25850,7 @@ var Groups = class {
 					contacts: viaLink ? {} : { [group.invitation.admin]: linkId }
 				};
 				this.stored.set(g, member);
+				this.acceptSaid.delete(g);
 				this.attach(joined.state);
 				if (viaLink) this.lingering.set(g, {
 					linkId,
@@ -26034,6 +25946,7 @@ var Groups = class {
 			return;
 		}
 		if (!session) return;
+		if (t === "group-bye" && session.status === "active" && frame.k === peerKey && this.hubs.departs(groupId, peerKey)) this.host.emit();
 		if (t === "group-react" || t === "group-reacted") {
 			await this.reaction(groupId, session, peerKey, frame);
 			return;
@@ -26124,6 +26037,9 @@ var Groups = class {
 		} catch {
 			return;
 		}
+		if (peerKey === session.admin) try {
+			for (const bye of session.byesHeld()) this.host.sendOnLink(linkId, bye);
+		} catch {}
 		const kept = this.lingering.get(groupId);
 		if (kept?.admin === peerKey) {
 			if (this.signals.keptEntry(groupId) === kept.linkId) setTimeout(() => {
@@ -26239,13 +26155,123 @@ var Groups = class {
 			});
 			out.push(key);
 		}
+		out.push(...this.gapsOf(groupId, session, via, session.lacking()));
 		if (out.length) this.lastGossip.set(groupId, now);
 		return out;
 	}
 	/**
-	* While some member is unreachable, one connected member (in turn) is asked, once a `MESH_GOSSIP_MS`, for what it
-	* has from the unreachable ones: a message sent while the author could reach it and not me gets here within that,
-	* without either edge opening again. Edges the roster asks for and that do not exist are opened again.
+	* Reachable members whose messages below the highest seen never reached me, for `via` to hand on: their own answer
+	* comes from their last `GROUP_LIMITS.outlog` only (WISP 902 § Catch-up), the rest another member may hold. As
+	* `askOf`, one member at a time, and each member once until what is missing changes.
+	*/
+	gapsOf(groupId, session, via, lacking) {
+		if (!lacking.size) return [];
+		let asked = this.relayAsked.get(groupId), tried = this.gapsAsked.get(groupId);
+		if (!asked) this.relayAsked.set(groupId, asked = /* @__PURE__ */ new Map());
+		if (!tried) this.gapsAsked.set(groupId, tried = /* @__PURE__ */ new Map());
+		const edges = this.host.edges(groupId), now = this.now();
+		const up = (key) => {
+			const edge = edges.get(key);
+			return !!edge && this.host.linkReady(edge);
+		};
+		for (const key of tried.keys()) if (!lacking.has(key)) tried.delete(key);
+		const out = [];
+		for (const [key, mark] of lacking) {
+			if (key === via || !up(key)) continue;
+			const prior = asked.get(key);
+			if (prior && prior.via !== via && up(prior.via) && now - prior.at < 6e4) continue;
+			let entry = tried.get(key);
+			if (!entry || entry.mark !== mark) tried.set(key, entry = {
+				mark,
+				of: /* @__PURE__ */ new Set(),
+				noticed: entry?.noticed,
+				last: entry?.last
+			});
+			if (entry.of.has(via)) continue;
+			entry.of.add(via);
+			entry.last = {
+				via,
+				at: now,
+				asked: session.missOf(key)
+			};
+			asked.set(key, {
+				via,
+				at: now
+			});
+			out.push(key);
+		}
+		return out;
+	}
+	/**
+	* Gaps asked for sooner than the gossip turn: one noticed `MESH_GAP_AGAIN_MS` ago and not asked for yet (an author's
+	* own answer, its last 32, showed what is below them) goes to a connected member now; and a member that handed on some
+	* of what I last asked it for likely holds the rest, so it is asked for the next numbers `MESH_GAP_AGAIN_MS` after. A
+	* member back after 200 messages of one author has them in about a minute, not 32 a gossip turn. One that handed
+	* nothing on waits for the gossip turn, as before.
+	*/
+	gapsAgain(groupId, session, now, connected) {
+		if (now - (this.gapsLooked.get(groupId) ?? -Infinity) < 5e3) return;
+		this.gapsLooked.set(groupId, now);
+		const lacking = session.lacking();
+		let tried = this.gapsAsked.get(groupId);
+		if (!lacking.size && !tried?.size) return;
+		if (!tried) this.gapsAsked.set(groupId, tried = /* @__PURE__ */ new Map());
+		for (const key of tried.keys()) if (!lacking.has(key)) tried.delete(key);
+		const edges = this.host.edges(groupId), again = /* @__PURE__ */ new Map(), fresh = /* @__PURE__ */ new Map();
+		const up = (key) => {
+			const edge = edges.get(key);
+			return !!edge && this.host.linkReady(edge);
+		};
+		for (const [key, mark] of lacking) {
+			let entry = tried.get(key);
+			if (!entry) tried.set(key, entry = {
+				mark,
+				of: /* @__PURE__ */ new Set(),
+				noticed: now
+			});
+			const { last } = entry;
+			if (!up(key)) continue;
+			if (!last) {
+				if (now - (entry.noticed ?? now) >= 1e4) fresh.set(key, mark);
+				continue;
+			}
+			if (now - last.at < 1e4 || !up(last.via)) continue;
+			if (session.filledSince(key, last.asked)) again.set(last.via, [...again.get(last.via) ?? [], key]);
+		}
+		const asked = this.relayAsked.get(groupId);
+		for (const [via, keys] of again) {
+			for (const key of keys) {
+				tried.set(key, {
+					mark: lacking.get(key),
+					of: /* @__PURE__ */ new Set([via]),
+					last: {
+						via,
+						at: now,
+						asked: session.missOf(key)
+					}
+				});
+				asked?.set(key, {
+					via,
+					at: now
+				});
+			}
+			try {
+				this.host.sendOnLink(edges.get(via), session.syncFrame(keys));
+			} catch {}
+		}
+		const others = connected.filter((key) => !fresh.has(key)), pool = others.length ? others : connected;
+		if (!fresh.size || !pool.length) return;
+		const via = pool[(gossipStart(session.myKey) + this.gossipTurn++) % pool.length];
+		const keys = this.gapsOf(groupId, session, via, fresh);
+		if (keys.length) try {
+			this.host.sendOnLink(edges.get(via), session.syncFrame(keys));
+		} catch {}
+	}
+	/**
+	* While some member is unreachable, or some of a member's messages never reached me (`gapsOf`), one connected member
+	* (in turn) is asked, once a `MESH_GOSSIP_MS`, for what it has from them: a message sent while the author could reach
+	* it and not me gets here within that, without either edge opening again. Edges the roster asks for and that do not
+	* exist are opened again.
 	*/
 	meshTick(now) {
 		this.tickNow = now;
@@ -26261,10 +26287,13 @@ var Groups = class {
 			}
 			const away = this.unreachable(groupId, session);
 			this.noteDown(groupId, session, away, now);
+			const connected = session.others.filter((key) => !away.includes(key));
+			this.gapsAgain(groupId, session, now, connected);
 			if (now - (this.lastGossip.get(groupId) ?? -Infinity) < 6e4) continue;
 			const edges = this.host.edges(groupId);
-			const connected = session.others.filter((key) => !away.includes(key));
-			if (!away.length || !connected.length) continue;
+			if (!connected.length) continue;
+			const lacking = session.lacking();
+			if (!away.length && !lacking.size) continue;
 			this.lastGossip.set(groupId, now);
 			const via = connected[(gossipStart(session.myKey) + this.gossipTurn++) % connected.length];
 			const asked = this.relayAsked.get(groupId) ?? /* @__PURE__ */ new Map();
@@ -26273,8 +26302,10 @@ var Groups = class {
 				via,
 				at: now
 			});
+			const ask = [...away, ...this.gapsOf(groupId, session, via, lacking)];
+			if (!ask.length) continue;
 			try {
-				this.host.sendOnLink(edges.get(via), session.syncFrame(away));
+				this.host.sendOnLink(edges.get(via), session.syncFrame(ask));
 			} catch {}
 		}
 	}
@@ -26419,7 +26450,7 @@ var Groups = class {
 	}
 	/** `at`: when the admin signed the statement (the line's time, as a commit's is its line's). */
 	async metaChanged(groupId, session, by, change, at) {
-		const name = by === session.myKey ? "You" : session.state.nicks[by] ?? `Member ${by.slice(0, 8)}`;
+		const name = by === void 0 ? void 0 : by === session.myKey ? "You" : session.state.nicks[by] ?? `Member ${by.slice(0, 8)}`;
 		const when = at === void 0 ? Date.now() : receivedTimestamp(at);
 		for (const line of metaLines(name, change, session.name)) await this.event(groupId, line.event, line.text, when, session.epoch, by);
 		this.host.emit();
@@ -26842,6 +26873,14 @@ var GroupEdits = class {
 	receivePace = /* @__PURE__ */ new Map();
 	timers = /* @__PURE__ */ new Map();
 	flushing = /* @__PURE__ */ new Map();
+	/** Per group: my rows known to have an edit to say, each with when it was last told (`edit`), by `tick`. */
+	known = /* @__PURE__ */ new Map();
+	tick = 0;
+	/**
+	* The groups whose history was read for the rows with an edit to say: `known` has them all, and from then on those
+	* rows alone are read (`host.message`). An edit costs what it does in a short group, however long this one is.
+	*/
+	learnt = /* @__PURE__ */ new Set();
 	stopped = false;
 	constructor(host) {
 		this.host = host;
@@ -26892,6 +26931,7 @@ var GroupEdits = class {
 				mentions: mentions.length ? mentions : void 0
 			};
 		});
+		if (this.host.message) this.told(groupId).set(messageId, ++this.tick);
 		await this.host.changed(chat, messageId);
 		await this.flush(groupId).catch(() => {});
 		return {
@@ -26912,7 +26952,7 @@ var GroupEdits = class {
 		this.timers.delete(groupId);
 		if (this.stopped || !this.host.membership(groupId)) return;
 		const chat = chatOf(groupId), now = this.now();
-		const due = (await this.host.messages(chat)).filter((m) => m.sender === "me" && m.edit?.pending).sort((a, b) => a.edit.at - b.edit.at);
+		const due = (await this.pending(groupId)).sort((a, b) => a.edit.at - b.edit.at);
 		let pace = this.sendPace.get(groupId);
 		if (!pace) this.sendPace.set(groupId, pace = new RateWindow(10, EDIT_RATE_WINDOW_MS, this.now));
 		let retry = Infinity;
@@ -26943,6 +26983,33 @@ var GroupEdits = class {
 			this.flush(groupId).catch(() => {});
 		}, Math.max(50, retry)));
 	}
+	/**
+	* My rows of a group with an edit to say. The group's whole history is read for them once (always, with no
+	* `host.message` to read one by); after that the known rows alone, and one that waits no more is forgotten, unless
+	* it was told again while it was read.
+	*/
+	async pending(groupId) {
+		const waits = (m) => m.sender === "me" && !!m.edit?.pending;
+		const chat = chatOf(groupId), read = this.host.message;
+		if (!read || !this.learnt.has(groupId)) {
+			const rows = (await this.host.messages(chat)).filter(waits);
+			if (!read) return rows;
+			for (const m of rows) if (!this.told(groupId).has(m.id)) this.told(groupId).set(m.id, this.tick);
+			this.learnt.add(groupId);
+			return rows;
+		}
+		const known = this.told(groupId), asOf = this.tick, ids = [...known.keys()];
+		return (await Promise.all(ids.map((id) => read(chat, id)))).filter((m, i) => {
+			if (m && waits(m)) return true;
+			if ((known.get(ids[i]) ?? 0) <= asOf) known.delete(ids[i]);
+			return false;
+		});
+	}
+	told(groupId) {
+		let known = this.known.get(groupId);
+		if (!known) this.known.set(groupId, known = /* @__PURE__ */ new Map());
+		return known;
+	}
 	async find(chat, id) {
 		return this.host.message ? this.host.message(chat, id) : (await this.host.messages(chat)).find((m) => m.id === id);
 	}
@@ -27014,7 +27081,8 @@ var GroupEdits = class {
 	}
 	/** An edge of a private group opened: the member at its other end hears my latest edits again, in case it missed them. */
 	async resend(groupId, to) {
-		const mine = (await this.host.messages(chatOf(groupId))).filter((m) => m.sender === "me" && m.edit && !m.edit.pending && canEditInGroup(m)).sort((a, b) => b.edit.at - a.edit.at).slice(0, 16).reverse();
+		const chat = chatOf(groupId);
+		const mine = (await (this.host.history ? this.host.history(chat) : this.host.messages(chat))).filter((m) => m.sender === "me" && m.edit && !m.edit.pending && canEditInGroup(m)).sort((a, b) => b.edit.at - a.edit.at).slice(0, 16).reverse();
 		for (const m of mine) await this.host.send(groupId, {
 			id: m.id,
 			e: m.edit.seq,
@@ -27027,6 +27095,8 @@ var GroupEdits = class {
 	forget(groupId) {
 		clearTimeout(this.timers.get(groupId));
 		this.timers.delete(groupId);
+		this.known.delete(groupId);
+		this.learnt.delete(groupId);
 		this.buffer.forget(chatOf(groupId));
 	}
 	stop() {
@@ -27154,7 +27224,8 @@ var CommunityPay = class {
 			},
 			memo: frame.memo,
 			endpoints: frame.e,
-			ask: frame.a
+			ask: frame.a,
+			network: frame.n
 		});
 		else if (frame.t === "pay-ask") await this.host.onPaymentAsk(linkId, {
 			id: frame.id,
@@ -27164,7 +27235,8 @@ var CommunityPay = class {
 				asset: frame.u
 			},
 			method: frame.m,
-			memo: frame.memo
+			memo: frame.memo,
+			network: frame.n
 		});
 		else if (frame.t === "pay") await this.host.onPayment(linkId, {
 			id: frame.id,
@@ -27208,7 +27280,8 @@ var CommunityPay = class {
 				asset: frame.u
 			},
 			memo: frame.memo,
-			endpoints: frame.e
+			endpoints: frame.e,
+			network: frame.n
 		});
 		else if (frame.t === "pay-res" && frame.ok) await this.host.onPaymentResult(linkId, {
 			id: frame.id,
@@ -27330,7 +27403,8 @@ var PairLink = class {
 			u: r.amount.asset,
 			memo: r.memo,
 			e: r.endpoints,
-			a: r.ask
+			a: r.ask,
+			n: r.network
 		});
 	}
 	async sendPaymentAsk(a) {
@@ -27342,7 +27416,8 @@ var PairLink = class {
 			v: a.amount.value,
 			u: a.amount.asset,
 			m: a.method,
-			memo: a.memo
+			memo: a.memo,
+			n: a.network
 		});
 	}
 	async sendPayment(p) {
@@ -27423,7 +27498,8 @@ var GroupLink = class {
 			v: r.amount.value,
 			u: r.amount.asset,
 			memo: r.memo,
-			e: r.endpoints
+			e: r.endpoints,
+			n: r.network
 		}));
 		await this.host.sendApp(this.groupId, {
 			...frame,
@@ -28082,16 +28158,17 @@ var HoldEngine = class {
 					}, held);
 				} else if (header.kind === "file") {
 					const meta = header.meta;
-					const voice = parseVoiceMeta(meta.voice, meta.mime);
-					const video = parseVideoMeta(meta.video, meta.mime);
-					const image = parseImageMeta(meta.image, meta.mime);
+					const name = sanitizeFileName(meta.name), mime = sanitizeMime(meta.mime);
+					const voice = parseVoiceMeta(meta.voice, mime);
+					const video = parseVideoMeta(meta.video, mime);
+					const image = parseImageMeta(meta.image, mime);
 					const reply = readReply(meta.r, pairedReplyAuthor);
 					const forwarded = readForwarded(meta.fw);
 					const refused = await this.host.receiveFile(linkId, {
 						wireId: header.id,
-						name: meta.name,
+						name,
 						size: meta.size,
-						mime: meta.mime,
+						mime,
 						timestamp: header.ts,
 						...voice && { voice },
 						...video && { video },
@@ -29491,7 +29568,10 @@ var CashuWallet = class CashuWallet {
 	}
 	/** How long `stop` waits for a swap in a per-mint lock. */
 	static STOP_WAIT_MS = 3e4;
-	/** The Cashu wallet of one network: its mints and their balance. History is every network's, newest first. */
+	/**
+	* The Cashu wallet of one network: its mints, their balance, and the network's newest movements (every network's when
+	* none is named) with the fees they paid. Only those movements are read, however long the history is.
+	*/
 	async view(network) {
 		const proofs = await this.allProofs();
 		const mints = this.getMints(network).map((url) => ({
@@ -29500,8 +29580,7 @@ var CashuWallet = class CashuWallet {
 			balance: total(proofs.filter((p) => p.mint === url && !p.reserved)),
 			info: this.infos.get(url) ?? null
 		}));
-		const all = await wrap((await store(STORES$1.walletTx, "readonly")).getAll());
-		all.sort((a, b) => b.timestamp - a.timestamp);
+		const history = await newestWalletTx((mint) => !network || mintNetwork(mint) === network, HISTORY_SHOWN);
 		const here = new Set(mints.map((m) => m.url));
 		const swaps = (await wrap((await store(STORES$1.swaps, "readonly")).getAll())).filter((s) => here.has(s.mint) && !s.released && !s.finished);
 		const about = (s) => s.kind === "send" ? swapOf(s).inputs.reduce((sum, p) => sum + Number(p.amount), 0) : s.tx?.amount ?? 0;
@@ -29513,8 +29592,8 @@ var CashuWallet = class CashuWallet {
 			openSwaps: swaps.length,
 			swapsAmount: total(swaps.map((s) => ({ amount: about(s) }))),
 			unconfirmed: total(swaps.filter((s) => s.stuck).map((s) => ({ amount: about(s) }))),
-			history: all.slice(0, HISTORY_SHOWN),
-			feesPaid: all.reduce((sum, tx) => sum + tx.fee, 0)
+			history,
+			feesPaid: history.reduce((sum, tx) => sum + tx.fee, 0)
 		};
 	}
 	/**
@@ -30078,7 +30157,7 @@ var CashuWallet = class CashuWallet {
 					unit: metadata.unit,
 					mint,
 					memo: metadata.memo || void 0,
-					accepted: this.getKnownMints().includes(mint) || isTestMint(mint)
+					accepted: metadata.unit === UNIT$1 && (this.getKnownMints().includes(mint) || isTestMint(mint))
 				};
 			}
 			if (/^creq[AB]/i.test(value)) {
@@ -30101,14 +30180,16 @@ var CashuWallet = class CashuWallet {
 	async receiveToken(token, kind = "ecash-in", note, { addTestMint = true, payment } = {}) {
 		let mint;
 		let faceValue;
+		let unit;
 		try {
 			const metadata = getTokenMetadata(token);
-			if (metadata.unit !== UNIT$1) throw new Error("unit");
+			unit = metadata.unit;
 			mint = metadata.mint.replace(/\/+$/, "");
 			faceValue = Number(metadata.amount);
 		} catch {
 			throw new Error("That is not a valid ecash token");
 		}
+		if (unit !== UNIT$1) throw engineError("ecashOtherUnit", { unit });
 		if (addTestMint && !this.getKnownMints().includes(mint) && isTestMint(mint)) await this.events.onTestMintNeeded(mint);
 		if (!this.getKnownMints().includes(mint)) throw new Error(`Ecash from ${new URL(mint).hostname} is not accepted`);
 		return this.locked(mint, async () => {
@@ -30157,9 +30238,10 @@ var CashuWallet = class CashuWallet {
 	}
 	/**
 	* Splits `amount`, with the fee its receiver will pay to redeem it, out of `proofs`. Coins that add up exactly need
-	* no mint. Otherwise it is a swap: written down, with its inputs reserved, before the mint is asked. The caller
-	* stores the result in one transaction: `inputs` out, `keep` in, `send` where it goes, and `swap` deleted.
-	* Runs under the mint's lock.
+	* no mint, as long as their token fits in a payment frame: a wallet of many small coins can add up exactly in
+	* hundreds of them, a token the contact's app drops unread. Otherwise it is a swap, which sends a few coins: written
+	* down, with its inputs reserved, before the mint is asked. The caller stores the result in one transaction: `inputs`
+	* out, `keep` in, `send` where it goes, and `swap` deleted. Runs under the mint's lock.
 	*/
 	async split(mint, amount, proofs) {
 		const wallet = await this.wallet(mint);
@@ -30172,7 +30254,11 @@ var CashuWallet = class CashuWallet {
 				includeFees: true,
 				exactMatch: true
 			});
-			if (send.length > 0 && sats(send) === amount + wallet.getFeesForProofs(send).toNumber()) return {
+			if (send.length > 0 && sats(send) === amount + wallet.getFeesForProofs(send).toNumber() && getEncodedToken({
+				mint,
+				proofs: send,
+				unit: UNIT$1
+			}).length <= LIMITS.maxPaymentEndpointChars) return {
 				inputs: among(send),
 				keep: [],
 				send
@@ -30750,7 +30836,7 @@ var CashuWallet = class CashuWallet {
 		let wallet = this.wallets.get(mint);
 		if (!wallet) {
 			wallet = (async () => {
-				const instance = new Wallet$1(mint, { unit: UNIT$1 });
+				const instance = new Wallet(mint, { unit: UNIT$1 });
 				await within(MINT_TIMEOUT_MS, instance.loadMint(), mint);
 				return instance;
 			})();
@@ -30799,6 +30885,9 @@ var CashuWallet = class CashuWallet {
 * taken back.
 */
 var UNIT = "sat";
+/** A contact's requests in one chat: the new ones taken per minute, and how many may wait to be paid. */
+var REQUESTS_PER_MINUTE = 20;
+var OPEN_REQUESTS = 50;
 var satsWord = (n) => `${n} sat${n === 1 ? "" : "s"}`;
 /**
 * A refused send's review, once its ecash came back: why, and exactly what came back. Taking ecash back is a swap at
@@ -30865,10 +30954,32 @@ var allows = (link, method) => method === "arkade" ? link.supportsArkPayments :
 var fedimintSats = (msats) => Math.floor(msats / 1e3);
 /** The distinct wallets of a per-network set (one object may stand for both). */
 var distinct = (each) => [...new Set(WALLET_NETWORKS.map((n) => each[n]))];
+/**
+* Every payment this device keeps, with the copy of them the pages get. The copy is made again only after a payment
+* changed: a state about anything else (typing, a file's progress) carries the one already made.
+*/
+var PaymentBook = class extends Map {
+	shown = null;
+	set(id, payment) {
+		this.shown = null;
+		return super.set(id, payment);
+	}
+	delete(id) {
+		this.shown = null;
+		return super.delete(id);
+	}
+	clear() {
+		this.shown = null;
+		super.clear();
+	}
+	views() {
+		return this.shown ??= Object.fromEntries([...this].map(([id, { token: _token, ...view }]) => [id, view]));
+	}
+};
 var PaymentDesk = class {
 	wallet;
 	host;
-	payments = /* @__PURE__ */ new Map();
+	payments = new PaymentBook();
 	paying = /* @__PURE__ */ new Map();
 	receiving = /* @__PURE__ */ new Map();
 	reclaims = /* @__PURE__ */ new Map();
@@ -30930,8 +31041,9 @@ var PaymentDesk = class {
 	records() {
 		return [...this.payments.values()];
 	}
+	/** What the pages see of every payment. The same record until a payment changes: read it, never write to it. */
 	views() {
-		return Object.fromEntries([...this.payments].map(([id, { token: _token, ...view }]) => [id, view]));
+		return this.payments.views();
 	}
 	async forgetLink(linkId) {
 		const paymentStore = await store(STORES$1.payments, "readwrite");
@@ -30940,6 +31052,7 @@ var PaymentDesk = class {
 			this.payments.delete(payment.id);
 			wrap(paymentStore.delete(payment.id));
 		}
+		this.requestsFrom.delete(linkId);
 	}
 	/** `confirmedReal`: the person confirmed a Mainnet send as real money; without it one is refused. */
 	async send(params) {
@@ -31543,10 +31656,13 @@ var PaymentDesk = class {
 		});
 		return { askId };
 	}
-	/** The ask a request answers, only if this side made it: same chat, way of paying and amount, still fresh. */
-	answering(linkId, request, method, amount) {
+	/**
+	* The ask a request answers, only if this side made it: same chat, way of paying and amount, still fresh, and the
+	* network the request is of (what it says, else what it carries), never only what it says.
+	*/
+	answering(linkId, request, method, amount, network) {
 		const ask = request.ask ? this.asks.get(request.ask) : void 0;
-		if (!ask || ask.linkId !== linkId || ask.method !== method || ask.amount !== amount || ask.expiresAt < Date.now() || request.network && request.network !== ask.network) return void 0;
+		if (!ask || ask.linkId !== linkId || ask.method !== method || ask.amount !== amount || ask.expiresAt < Date.now() || network !== ask.network) return void 0;
 		this.asks.delete(request.ask);
 		return request.ask;
 	}
@@ -31591,9 +31707,24 @@ var PaymentDesk = class {
 			endpoints: [...payment.invoice ? [[ENDPOINT.bolt11, payment.invoice]] : [], ...payment.mints?.length ? [[ENDPOINT.cashu, cashuRequestPayload(payment.mints)]] : []]
 		};
 	}
+	/** New requests taken from each chat's contact lately. */
+	requestsFrom = /* @__PURE__ */ new Map();
+	/**
+	* Whether this chat has room for one more request of its contact: twenty new ones a minute, and fifty waiting to be
+	* paid at most. One left out is not lost: the contact's app sends its open requests again on every session.
+	*/
+	roomForRequest(linkId) {
+		let recent = this.requestsFrom.get(linkId);
+		if (!recent) this.requestsFrom.set(linkId, recent = new RateWindow(REQUESTS_PER_MINUTE, 6e4));
+		if (!recent.take()) return false;
+		let open = 0;
+		for (const p of this.payments.values()) if (p.linkId === linkId && p.kind === "request" && p.direction === "in" && p.state === "pending" && ++open >= OPEN_REQUESTS) return false;
+		return true;
+	}
 	/** `held`: picked up from the contact's storage while it was away (WISP 404): only what this device allows counts, and only Cashu or Lightning. */
 	async onPaymentRequest(linkId, request, held = false) {
 		if (this.find(linkId, request.id)?.linkId === linkId) return;
+		if (!this.roomForRequest(linkId)) return;
 		if (held && (findEndpoint(request.endpoints, ENDPOINT.usdt) || findEndpoint(request.endpoints, ENDPOINT.arkade) || findEndpoint(request.endpoints, ENDPOINT.bark) || findEndpoint(request.endpoints, ENDPOINT.bitcoin) || findEndpoint(request.endpoints, ENDPOINT.fedimint) || findEndpoint(request.endpoints, ENDPOINT.spark))) return;
 		if (findEndpoint(request.endpoints, ENDPOINT.usdt)) return this.receiveUsdtRequest(linkId, request);
 		const amount = parseSats(request.amount.value, request.amount.asset);
@@ -31669,7 +31800,7 @@ var PaymentDesk = class {
 		await this.save({
 			target,
 			federations,
-			ask: federations ? this.answering(linkId, request, "fedimint", amount) : target?.method === "arkade" || target?.method === "bark" || target?.method === "bitcoin" || target?.method === "spark" ? this.answering(linkId, request, target.method, amount) : void 0,
+			ask: federations ? this.answering(linkId, request, "fedimint", amount, network) : target?.method === "arkade" || target?.method === "bark" || target?.method === "bitcoin" || target?.method === "spark" ? this.answering(linkId, request, target.method, amount, network) : void 0,
 			id: this.keyFor(linkId, request.id),
 			linkId,
 			kind: "request",
@@ -32095,7 +32226,7 @@ var PaymentDesk = class {
 			memo: request.memo,
 			state: "pending",
 			createdAt: request.timestamp,
-			ask: this.answering(linkId, request, "usdt", amount),
+			ask: this.answering(linkId, request, "usdt", amount, network),
 			network
 		});
 		await this.host.storeMessage({
@@ -32157,6 +32288,22 @@ var PaymentDesk = class {
 			endpoint: [ENDPOINT.usdt, JSON.stringify({ txid: review.txid })]
 		});
 	}
+	/**
+	* One payment pays one request: a receipt for a request that already has one, under another payment id,
+	* is not another payment. Nothing is stored or shown for it; a paid request is answered again.
+	*/
+	repeatedReceipt(link, request, id) {
+		let repeated = false;
+		for (const p of this.payments.values()) if (p.id !== id && p.kind === "payment" && p.direction === "in" && p.requestId === request.id && p.linkId === request.linkId && p.state !== "failed") {
+			repeated = true;
+			break;
+		}
+		if (repeated && request.state === "settled") link?.sendPaymentResult({
+			id: request.id,
+			ok: true
+		});
+		return repeated;
+	}
 	async receiveUsdt(linkId, payment) {
 		const request = payment.requestId ? this.payments.get(payment.requestId) : void 0;
 		if (!this.host.getLink(linkId)?.supportsUsdtPayments || request?.target?.method !== "usdt" || request.linkId !== linkId || request.direction !== "out" || request.kind !== "request" || payment.amount.asset !== request.unit || payment.amount.value !== String(request.amount)) return;
@@ -32169,6 +32316,7 @@ var PaymentDesk = class {
 			return;
 		}
 		if (typeof txid !== "string" || !/^0x[a-fA-F0-9]{64}$/.test(txid) || existing?.state === "settled") return;
+		if (this.repeatedReceipt(this.host.getLink(linkId), request, payment.id)) return;
 		txid = txid.toLowerCase();
 		if ([...this.payments.values()].some((p) => p.txid?.toLowerCase() === txid && (p.linkId !== linkId || (p.kind === "request" ? p.id !== request.id : p.requestId !== request.id)))) return;
 		await this.save({
@@ -32336,6 +32484,7 @@ var PaymentDesk = class {
 		}
 		if ([...this.payments.values()].some((p) => p.txid === txid && (p.linkId !== linkId || (p.kind === "request" ? p.id !== request.id : p.requestId !== request.id)))) return;
 		if (typeof txid !== "string" || !/^[a-f0-9]{64}$/.test(txid) || existing?.state === "settled") return;
+		if (this.repeatedReceipt(link, request, payment.id)) return;
 		await this.save({
 			id: payment.id,
 			linkId,
@@ -32453,6 +32602,7 @@ var PaymentDesk = class {
 		const existing = this.payments.get(payment.id);
 		if (existing && (existing.linkId !== linkId || existing.direction !== "in" || existing.requestId !== request.id)) return;
 		if (existing || parseSats(payment.amount.value, payment.amount.asset) !== request.amount) return;
+		if (this.repeatedReceipt(link, request, payment.id)) return;
 		await this.save({
 			id: payment.id,
 			linkId,
@@ -32589,6 +32739,7 @@ var PaymentDesk = class {
 			return;
 		}
 		if (typeof hint !== "string" || !/^[0-9a-f]{64}$/.test(hint)) return;
+		if (this.repeatedReceipt(link, request, payment.id)) return;
 		const settled = request.state === "settled";
 		await this.save({
 			id: payment.id,
@@ -32937,6 +33088,7 @@ var PaymentDesk = class {
 		const existing = this.payments.get(payment.id);
 		if (existing && (existing.linkId !== linkId || existing.direction !== "in" || existing.requestId !== request.id)) return;
 		if (existing || parseSats(payment.amount.value, payment.amount.asset) !== request.amount) return;
+		if (this.repeatedReceipt(link, request, payment.id)) return;
 		const settled = request.state === "settled";
 		await this.save({
 			id: payment.id,
@@ -33060,6 +33212,20 @@ var PaymentDesk = class {
 		});
 	}
 	/**
+	* A contact's receipt that still waits for its money, dropped by hand (its chat line was deleted here): the
+	* request it answers can take another receipt. Money that does arrive still pays the request.
+	*/
+	async dropReceipt(id) {
+		const payment = this.payments.get(id), request = payment?.requestId ? this.payments.get(payment.requestId) : void 0;
+		if (payment?.kind !== "payment" || payment.direction !== "in" || payment.state !== "pending" || !payment.target) return;
+		if (request?.kind !== "request" || request.direction !== "out" || request.linkId !== payment.linkId || request.target?.method !== payment.target.method) return;
+		await this.save({
+			...payment,
+			state: "failed",
+			error: "Removed here"
+		});
+	}
+	/**
 	* A request of ours closed for good: the wallet it was paid through was removed. Nothing sends it again (replay,
 	* a group edge opening), and the contact is told now when the chat is open (a request to a group: every member
 	* reachable), so their app stops offering to pay it. `reason`: shown here; `told`: what the contact reads. Returns
@@ -33477,7 +33643,7 @@ function pushRelayProblem(url) {
 		"localhost",
 		"[::1]"
 	].includes(parsed.hostname)) return null;
-	return "Use an https:// relay address";
+	return `Use an https:// relay address: ${url}`;
 }
 //#endregion
 //#region ../browser/src/engine/walletSetup.ts
@@ -33598,6 +33764,8 @@ var RELAY_RETRY_MS = 3e4;
 var NATIVE_SLOTS = 8;
 /** How often a group link that found no free native slot tries again. */
 var GROUP_NATIVE_RETRY_MS = 15e3;
+/** The longest a group link whose native listener failed to start waits before trying again (its wait doubles up to it). */
+var GROUP_NATIVE_FAILED_MAX_MS = 3e5;
 /** "Clear all data": how long taking things back from the network may hold up the clear, in all. */
 var CLEAR_WITHDRAW_MS = 6e3;
 /**
@@ -33628,6 +33796,16 @@ var CARD_RESTORE_MOST = 50;
 var CARD_RESTORE_MS = 6048e5;
 /** A reaction said on the live session and not confirmed is said again after this long. */
 var REACTION_RESEND_MS = 3e4;
+/** This side's participation key in a chat: derived from its seed once, not at every state built. */
+function participationKeyOf(live) {
+	const seed = live.stored.participationSeed;
+	if (!seed) return void 0;
+	if (live.participationKey?.seed !== seed) live.participationKey = {
+		seed,
+		key: identityFromSeedB64(seed).pubKeyZ32
+	};
+	return live.participationKey.key;
+}
 function emptyLinkFiles() {
 	return {
 		receivedBytes: 0,
@@ -33833,6 +34011,11 @@ var GhostlyNode = class GhostlyNode {
 		return Promise.all(this.nativeQueues.values()).then(() => {});
 	}
 	shuttingDown = false;
+	/** Settles as `shutdown` begins: what is still starting is not waited for past it. */
+	stopBegan;
+	stopping = new Promise((resolve) => {
+		this.stopBegan = () => resolve(null);
+	});
 	/** `start` has put the kept transfers back (EngineState.transfersRestored). */
 	transfersRestored = false;
 	feedbackStartedAt = Date.now();
@@ -33943,7 +34126,7 @@ var GhostlyNode = class GhostlyNode {
 				cue: "downloaded",
 				key: fileId
 			}, this.chatOf(linkId));
-			this.noteFileEnd(linkId, fileId, record.state === "done" ? void 0 : record.error ?? record.state);
+			this.noteFileEnd(linkId, fileId, record.state === "done" ? void 0 : record.error ?? record.state, !seen);
 		}
 	});
 	stateTimer = null;
@@ -34125,6 +34308,7 @@ var GhostlyNode = class GhostlyNode {
 		descriptors: () => this.providers().lightning,
 		host: () => this.providerHost(network),
 		hasMints: () => this.networkMints(network).length > 0,
+		fetch: (...request) => (this.options.lnurlFetch ?? globalThis.fetch)(...request),
 		events: {
 			changed: () => void this.refreshWallet(),
 			received: (op) => void this.desk.onLightningPaid(op),
@@ -34421,10 +34605,10 @@ var GhostlyNode = class GhostlyNode {
 			} : void 0;
 		},
 		keys: (linkId) => {
-			const stored = this.links.get(linkId)?.stored;
+			const live = this.links.get(linkId);
 			return {
-				mine: stored?.participationSeed ? identityFromSeedB64(stored.participationSeed).pubKeyZ32 : void 0,
-				theirs: stored?.pairedPeerKey
+				mine: live && participationKeyOf(live),
+				theirs: live?.stored.pairedPeerKey
 			};
 		},
 		linkIds: () => [...this.links.keys()],
@@ -34463,9 +34647,9 @@ var GhostlyNode = class GhostlyNode {
 		emit: () => this.emitState(),
 		ownSubjects: () => this.identities.views().filter((p) => p.provider === "nostr").map((p) => p.subject),
 		contactSubjects: (linkId) => {
-			const stored = this.links.get(linkId)?.stored;
+			const live = this.links.get(linkId), stored = live?.stored;
 			if (!stored?.profile || !stored.identities) return [];
-			const mine = stored.participationSeed ? identityFromSeedB64(stored.participationSeed).pubKeyZ32 : void 0;
+			const mine = participationKeyOf(live);
 			const t = Math.floor(Date.now() / 1e3);
 			return [...new Set(stored.identities.received.filter((r) => r.binding.provider === "nostr" && receivedIdentityStatus(r, stored.pairedPeerKey, mine, t) === "verified").map((r) => r.verified.subject))];
 		},
@@ -34527,7 +34711,7 @@ var GhostlyNode = class GhostlyNode {
 		for (const live of this.links.values()) {
 			const stored = live.stored;
 			if (!stored.profile || !stored.identities || stored.group) continue;
-			const mine = stored.participationSeed ? identityFromSeedB64(stored.participationSeed).pubKeyZ32 : void 0;
+			const mine = participationKeyOf(live);
 			for (const r of stored.identities.received) if (receivedIdentityStatus(r, stored.pairedPeerKey, mine, t) === "verified") out.push({
 				provider: r.binding.provider,
 				subject: r.verified.subject,
@@ -34555,6 +34739,8 @@ var GhostlyNode = class GhostlyNode {
 	* again those not confirmed after a while.
 	*/
 	reactionNotes = /* @__PURE__ */ new Map();
+	/** Each chat's notes shown before the one shown now, oldest first, the latest `REACTION_NOTES_KEPT` of this run. */
+	reactionNotesBefore = /* @__PURE__ */ new Map();
 	reactionsSent = /* @__PURE__ */ new Map();
 	reactionPace = /* @__PURE__ */ new Map();
 	reactionTimers = /* @__PURE__ */ new Map();
@@ -34576,12 +34762,33 @@ var GhostlyNode = class GhostlyNode {
 		message: (chat, id) => db.getMessage(chat, id),
 		patch: (chat, id, change) => db.patchMessage(chat, id, change),
 		changed: async (chat, id, note) => {
-			if (note) this.reactionNotes.set(chat, note);
+			const shown = this.reactionNotes.get(chat);
+			if (note) {
+				if (shown && (shown.message !== note.message || shown.by !== note.by)) this.reactionNotesBefore.set(chat, [...this.reactionNotesBefore.get(chat) ?? [], shown].slice(-8));
+				this.reactionNotes.set(chat, note);
+			} else if (shown?.message === id) {
+				const before = await this.reactionNoteNow(chat, shown);
+				if (before) this.reactionNotes.set(chat, before);
+				else this.reactionNotes.delete(chat);
+			}
 			await this.messagesChanged(chat, [id]);
 			this.emitState();
 		},
 		notify: (chat, key) => this.feedback("reaction", `${chat}:${key}`, chat)
 	});
+	/**
+	* The chat list's reaction once one to its message was taken back: the same one if it still stands, else the latest
+	* shown before it that does, each read from its own row. Only past those is the whole history read for an older one.
+	*/
+	async reactionNoteNow(chat, shown) {
+		const before = this.reactionNotesBefore.get(chat) ?? [];
+		for (let note = shown; note; note = before.pop()) {
+			const row = note.message ? await db.getMessage(chat, note.message) : void 0;
+			const standing = row && noteIfStanding(note, row);
+			if (standing) return standing;
+		}
+		return latestReaction(await db.getMessages(chat));
+	}
 	/** Private groups (WISP 900): sessions, admission on contact chats, and the pairwise edges that carry them. */
 	groups = new Groups({
 		sendOnLink: (linkId, frame) => {
@@ -34702,6 +34909,7 @@ var GhostlyNode = class GhostlyNode {
 	*/
 	groupEdits = new GroupEdits({
 		messages: (chat) => db.getMessages(chat),
+		history: (chat) => this.edgeOpenHistory(chat),
 		message: (chat, id) => db.getMessage(chat, id),
 		patch: (chat, id, change) => db.patchMessage(chat, id, change),
 		changed: (chat, id) => this.messagesChanged(chat, [id]),
@@ -34911,7 +35119,7 @@ var GhostlyNode = class GhostlyNode {
 		const awaiting = await this.readAwaiting();
 		for (const network of WALLET_NETWORKS) {
 			const view = await this.wallet.view(network);
-			everything = view.history;
+			everything = everything.concat(view.history);
 			const history = view.history.filter((tx) => !tx.mint || mintNetwork(tx.mint) === network);
 			networks[network] = {
 				mints: this.withWaits(view.mints, awaiting.mints),
@@ -35071,7 +35279,7 @@ var GhostlyNode = class GhostlyNode {
 		}
 		this.transfersRestored = true;
 		for (const group of await db.getGroups()) await this.settleHistory(`group:${group.id}`);
-		await this.groups.load();
+		await this.groups.load(this.limitedMode);
 		for (const group of this.groups.views()) {
 			const note = latestReaction(await db.getMessages(`group:${group.id}`));
 			if (note) this.reactionNotes.set(`group:${group.id}`, note);
@@ -35471,12 +35679,17 @@ var GhostlyNode = class GhostlyNode {
 	async shutdown(options = {}) {
 		const quiet = options.quiet === true || this.gatedOut;
 		this.shuttingDown = true;
+		this.stopBegan();
 		if (this.limitedTimer) {
 			clearTimeout(this.limitedTimer);
 			this.limitedTimer = null;
 		}
 		this.appShelf?.stop();
 		if (!quiet) this.depart();
+		const linksStopped = Promise.allSettled([...this.links.values()].map(async (live) => {
+			live.carried?.stop();
+			await Promise.all([live.link?.stop(!quiet), live.caps?.stop()]);
+		}));
 		this.directPath.close();
 		this.clock.close();
 		this.clockOff?.();
@@ -35504,33 +35717,30 @@ var GhostlyNode = class GhostlyNode {
 		this.activeTurnTimer = null;
 		if (this.restoreTimer) clearTimeout(this.restoreTimer);
 		this.restoreTimer = null;
-		await links?.stop().catch(() => {});
 		this.identities.stop();
 		this.did.stop();
 		this.nostrSocial.stop();
 		this.publicProfiles.stop();
 		this.publicActivity.clear();
-		for (const network of WALLET_NETWORKS) {
-			await this.arkWallets[network].stop();
-			await this.barkWallets[network].stop();
-			await this.fedimintWallets[network].stop();
-			await this.sparkWallets[network].stop();
-			await this.usdtWallets[network].stop();
-			await this.lightnings[network].stop();
-			await this.bitcoins[network].stop();
-		}
-		await this.wallet.stop();
-		await this.nativeQueue;
-		await this.hold.stop();
-		await Promise.allSettled([...this.outboxes.values()].map((outbox) => outbox.stop()));
 		for (const queue of this.editQueues.values()) queue.stop();
 		this.groupEdits.stop();
 		this.cardEdits.stop();
-		await Promise.allSettled([...this.links.values()].map(async (live) => {
-			live.carried?.stop();
-			await live.link?.stop(!quiet);
-			await live.caps?.stop();
-		}));
+		await Promise.allSettled([
+			linksStopped,
+			links?.stop(),
+			...WALLET_NETWORKS.flatMap((network) => [
+				this.arkWallets,
+				this.barkWallets,
+				this.fedimintWallets,
+				this.sparkWallets,
+				this.usdtWallets,
+				this.lightnings,
+				this.bitcoins
+			].map((wallets) => wallets[network].stop())),
+			this.wallet.stop(),
+			this.nativeQueue,
+			Promise.allSettled([...this.outboxes.values()].map((outbox) => outbox.stop())).then(() => this.hold.stop())
+		]);
 	}
 	/**
 	* "Clear all data" (WISP 04), the peer's part. First what can be taken back from the network, best effort and within
@@ -35551,7 +35761,7 @@ var GhostlyNode = class GhostlyNode {
 	appShelf;
 	/** The installed apps and stores, refused while the apps feature is off. */
 	get appStore() {
-		if (!this.appsOn) throw new Error("Apps are unavailable in this release");
+		if (!this.appsOn) throw this.appsOff();
 		return this.appShelf ??= new Apps({
 			fetch: boundedAppFetch({
 				fetcher: this.options.appFetch,
@@ -35682,17 +35892,27 @@ var GhostlyNode = class GhostlyNode {
 			...this.settings.wakeMutedGroups?.includes(group.id) && { wakeMuted: true }
 		};
 	}
+	/** Per community, the members a payment here names, as read from one copy of the payments (`PaymentDesk.views`). */
+	communityPaid;
 	/** Community members payments go to (or came from), as links the payment bubbles and the composer look up by key. */
 	communityPayViews(groups) {
-		const withPayments = /* @__PURE__ */ new Map();
-		for (const p of Object.values(this.desk.views())) {
-			const at = parsePayLink(p.linkId);
-			if (at?.member) {
-				const set = withPayments.get(at.groupId) ?? /* @__PURE__ */ new Set();
-				set.add(at.member);
-				withPayments.set(at.groupId, set);
+		const payments = this.desk.views();
+		if (this.communityPaid?.of !== payments) {
+			const members = /* @__PURE__ */ new Map();
+			for (const p of Object.values(payments)) {
+				const at = parsePayLink(p.linkId);
+				if (at?.member) {
+					const set = members.get(at.groupId) ?? /* @__PURE__ */ new Set();
+					set.add(at.member);
+					members.set(at.groupId, set);
+				}
 			}
+			this.communityPaid = {
+				of: payments,
+				members
+			};
 		}
+		const withPayments = this.communityPaid.members;
 		return groups.filter((g) => g.profile === "community" && g.status === "active" && g.myKey).flatMap((g) => this.communityPay.views(g.id, g.myKey, g.members.map((m) => m.key), withPayments.get(g.id) ?? /* @__PURE__ */ new Set()));
 	}
 	/** The payment composer opened on a member of a community: ask what they take, if they did not say lately. */
@@ -35707,6 +35927,10 @@ var GhostlyNode = class GhostlyNode {
 	getMessages(linkId) {
 		return db.getMessages(linkId);
 	}
+	/** One message of a chat, read by its id: the whole history costs a read of every row. */
+	getMessage(linkId, id) {
+		return db.getMessage(linkId, id);
+	}
 	async messagePage({ linkId, limit = 50, before }) {
 		if (!Number.isSafeInteger(limit) || limit < 1) throw new Error("limit: a whole number of messages, at least 1");
 		if (before === void 0) return db.getMessagePage(linkId, { limit });
@@ -36271,6 +36495,7 @@ var GhostlyNode = class GhostlyNode {
 		this.newestAt.delete(linkId);
 		this.placedAt.delete(linkId);
 		this.reactionNotes.delete(linkId);
+		this.reactionNotesBefore.delete(linkId);
 		this.events.onMessages(linkId, []);
 	}
 	async setGroupWakeMuted(groupId, muted) {
@@ -36471,6 +36696,10 @@ var GhostlyNode = class GhostlyNode {
 			this.transport.networkChanged?.();
 			this.directPath.reset();
 		}
+		if (params.network) for (const failed of this.groupNativeFailed.values()) {
+			failed.at = 0;
+			failed.wait = 0;
+		}
 		for (const live of this.links.values()) live.link?.wake({ network: params.network });
 		this.hold.wake();
 		for (const network of WALLET_NETWORKS) {
@@ -36694,12 +36923,26 @@ var GhostlyNode = class GhostlyNode {
 	/**
 	* A received reply, or one sent before its original was here, against this chat's own history: the original found
 	* here gives the line and the author (and it is then checked); one not found keeps what the wire said, unchecked.
+	* The original is read alone where its id says its row (a group's message id, a chat's `peer_`/`me_` text): a reply
+	* costs what a plain message does, however long the chat. A group's row goes by its own id only, so a miss there is
+	* not here; a chat's other rows (a file's, a payment's) are looked for in the whole chat.
 	*/
 	async resolveReply(message) {
 		const reply = message.replyTo;
 		if (!reply || reply.messageId) return message;
-		const history = await db.getMessages(message.linkId);
-		const original = history.find((m) => m.id !== message.id && replyRef(m) === reply.id);
+		const group = message.linkId.startsWith("group:");
+		let original, history;
+		for (const rowId of group ? [reply.id] : [`peer_${reply.id}`, `me_${reply.id}`]) {
+			const row = rowId === message.id ? void 0 : await db.getMessage(message.linkId, rowId);
+			if (row && replyRef(row, group) === reply.id) {
+				original = row;
+				break;
+			}
+		}
+		if (!original && !group) {
+			history = await db.getMessages(message.linkId);
+			original = history.find((m) => m.id !== message.id && replyRef(m) === reply.id);
+		}
 		if (!original) return message;
 		const resolved = {
 			...message,
@@ -36709,7 +36952,7 @@ var GhostlyNode = class GhostlyNode {
 				...reply.button && { button: reply.button }
 			}
 		};
-		const press = buttonPress(resolved, original, history);
+		const press = buttonPress(resolved, original, []) && buttonPress(resolved, original, history ?? await db.getMessages(message.linkId));
 		return press ? {
 			...resolved,
 			press
@@ -36800,7 +37043,9 @@ var GhostlyNode = class GhostlyNode {
 			card: edited.card
 		}));
 		await this.messagesChanged(linkId, [message.id]);
-		this.editsFor(linkId).flush().catch(() => {});
+		const edits = this.editsFor(linkId);
+		edits.edited(message.id);
+		edits.flush().catch(() => {});
 		return {
 			error: null,
 			messageId: message.id
@@ -36875,19 +37120,27 @@ var GhostlyNode = class GhostlyNode {
 	* message goes again as an edit of its card alone: the same text, so no version and no edit mark. Once per message (the
 	* row says so, across restarts); the edit queue carries it (a card's edit goes only live, and a later edit of the
 	* author's replaces it, the highest number winning). A contact whose app does not show the kind (it would drop the card
-	* and mark the text edited) gets none: the row waits for one that does. Bounded: the newest `CARD_RESTORE_MOST` such
-	* messages of the last `CARD_RESTORE_MS`; older ones are given up. The edit is marked `restore`: the bot's own event
-	* stream says nothing of it, while its number counts, so a later edit of the bot's takes the next one.
+	* and mark the text edited) gets none: the row waits for one that does. Bounded: only the newest message of each card
+	* (kind and id: a bot may send a task again as a new message), the newest `CARD_RESTORE_MOST` such cards of the last
+	* `CARD_RESTORE_MS`; the others are given up. The edit queue spaces them (`CARD_RESTORE_GAP_MS`), so a reconnect does
+	* not burst. The edit is marked `restore`: the bot's own event stream says nothing of it, while its number counts, so a
+	* later edit of the bot's takes the next one.
 	*/
 	async restoreCards(linkId) {
 		const live = this.links.get(linkId), link = live?.link;
 		const offers = link?.sessionOffers.peer;
 		if (!live?.stored.profile || live.stored.group || !link?.supportsEdits || !offers) return;
-		const due = (await db.getMessages(linkId)).filter((m) => m.sender === "me" && (m.cardRestore ?? m.buttonsRestore) === "due").sort((a, b) => b.timestamp - a.timestamp);
+		const mine = (await db.getMessages(linkId)).filter((m) => m.sender === "me").sort((a, b) => b.timestamp - a.timestamp);
 		const since = Date.now() - CARD_RESTORE_MS;
 		const changed = [];
-		for (const [index, message] of due.entries()) {
-			const stale = index >= CARD_RESTORE_MOST || message.timestamp < since;
+		const cards = /* @__PURE__ */ new Set();
+		let kept = 0;
+		for (const message of mine) {
+			const key = message.card && `${message.card.kind}\n${message.card.id}`;
+			const superseded = !!key && cards.has(key);
+			if (key) cards.add(key);
+			if ((message.cardRestore ?? message.buttonsRestore) !== "due") continue;
+			const stale = superseded || kept++ >= CARD_RESTORE_MOST || message.timestamp < since;
 			if (!stale && message.card && !offers.includes(GhostlyNode.cardCapability(message.card))) continue;
 			const at = Date.now();
 			if ((await db.patchMessage(linkId, message.id, (current) => {
@@ -36913,7 +37166,10 @@ var GhostlyNode = class GhostlyNode {
 					},
 					...done
 				};
-			}))?.edit?.pending) changed.push(message.id);
+			}))?.edit?.pending) {
+				changed.push(message.id);
+				this.editsFor(linkId).edited(message.id);
+			}
 		}
 		if (changed.length) await this.messagesChanged(linkId, changed);
 	}
@@ -36923,6 +37179,7 @@ var GhostlyNode = class GhostlyNode {
 		if (!queue) {
 			queue = new EditQueue({
 				read: () => db.getMessages(linkId),
+				row: (id) => db.getMessage(linkId, id),
 				ready: () => {
 					const live = this.links.get(linkId), link = live?.link;
 					return !!link && (link.supportsEdits || link.textDelivery === "dht" && this.takesDhtEdits(live));
@@ -37078,7 +37335,7 @@ var GhostlyNode = class GhostlyNode {
 		return composeDetails(message, {
 			link: live && stored && {
 				stored,
-				myKey: stored.participationSeed ? identityFromSeedB64(stored.participationSeed).pubKeyZ32 : live.myPubKeyZ32,
+				myKey: participationKeyOf(live) ?? live.myPubKeyZ32,
 				verified: !!stored.pairedPeerKey && (stored.peerTrust ? stored.peerTrust.verifiedKey === stored.pairedPeerKey : true),
 				transportNow: live.link?.isDataLinkOpen ? live.pairing?.transport : void 0,
 				relayedNow: !!live.link?.relayedPath,
@@ -37226,12 +37483,34 @@ var GhostlyNode = class GhostlyNode {
 		}));
 		return Promise.resolve();
 	}
-	/** A file transfer ended: when, on the message that carries the file. */
-	async noteFileEnd(linkId, fileId, error) {
-		const message = (await db.getMessages(linkId)).find((m) => m.file?.id === fileId);
+	/**
+	* The message that carries a file, read by its id: a file of mine is `me_<its time>`, a received one is named by its
+	* wire id (files/3, a held file) or by its sender's time (files/2). The chat's history is read only when none of
+	* those rows carries it, so a file costs the same in a long chat as in a short one.
+	*/
+	async fileMessage(linkId, fileId) {
+		const stored = await fileStore.get(fileId).catch(() => void 0);
+		const at = stored?.metadata?.timestamp, wireId = stored?.wireId;
+		const ids = !stored ? [] : fileId.startsWith(`${linkId}-out-`) ? [`me_${at}`] : [
+			`peer_${wireId}`,
+			`peer_${at}`,
+			`peer_${at}_${wireId}`
+		];
+		for (const id of ids) {
+			const message = await db.getMessage(linkId, id);
+			if (message?.file?.id === fileId) return message;
+		}
+		return (await db.getMessages(linkId)).find((m) => m.file?.id === fileId);
+	}
+	/**
+	* A file transfer ended: when, on the message that carries the file. `again`: it ended in an earlier run and is shown
+	* again as the chat connects, so what its message says of its end stays (only a receipt it never got is given).
+	*/
+	async noteFileEnd(linkId, fileId, error, again = false) {
+		const message = await this.fileMessage(linkId, fileId);
 		if (!message) return;
 		const now = Date.now();
-		await this.noteDetails(linkId, message.id, (details) => error ? message.sender === "me" && details.sends?.length ? {
+		if (!again) await this.noteDetails(linkId, message.id, (details) => error ? message.sender === "me" && details.sends?.length ? {
 			...details,
 			sends: details.sends.map((s, i) => i === details.sends.length - 1 ? {
 				...s,
@@ -37281,6 +37560,7 @@ var GhostlyNode = class GhostlyNode {
 		(async () => {
 			const message = await db.getMessage(linkId, messageId);
 			if (message?.paymentId && message.delivery === "waiting") await this.desk.withdraw(message.paymentId).catch(() => {});
+			if (message?.paymentId && message.sender === "peer") await this.desk.dropReceipt(message.paymentId).catch(() => {});
 			if (message?.sender === "me" && message.file && message.delivery === "waiting" && (message.fileOnFloor === "sent" || message.fileOnFloor === "seen")) {
 				const wireId = message.file.id.slice(`${linkId}-out-`.length);
 				live.link?.settleDht(dhtFileId(wireId)).catch(() => {});
@@ -37429,7 +37709,7 @@ var GhostlyNode = class GhostlyNode {
 		});
 		(async () => {
 			if (!reply || !forwarded) {
-				const message = (await db.getMessages(live.stored.id)).find((m) => m.id === `me_${timestamp}`);
+				const message = await db.getMessage(live.stored.id, `me_${timestamp}`);
 				reply ??= message && GhostlyNode.wireReply(message);
 				forwarded ??= message?.forwarded;
 			}
@@ -37889,11 +38169,23 @@ var GhostlyNode = class GhostlyNode {
 	/**
 	* `chosen`: a choice from the chat's Connection menu, a row in its timeline even when it names the transport already
 	* set. Left out (the RPC), only a change of transport is: the Fallback switch sends the same preference again, and
-	* is neither a row nor a switch intent.
+	* is neither a row nor a switch intent. On Automatic it sends back the transport Automatic names: only the fallback
+	* changes, and the chat stays on Automatic.
 	*/
 	async setTransportPreference({ linkId, preferred, fallback }, chosen) {
 		const live = this.links.get(linkId);
 		if (!live?.stored.profile || !live.link?.availableTransports.includes(preferred) || typeof fallback !== "boolean") throw new Error("Transport unavailable");
+		if (chosen === void 0 && live.stored.preferredTransport === void 0 && preferred === automaticTransport(live.link.availableTransports)) {
+			await db.patchLink(linkId, { transportFallback: fallback });
+			live.stored = {
+				...live.stored,
+				transportFallback: fallback
+			};
+			this.emitState();
+			await live.link.setTransportPreference(preferred, fallback, true, false);
+			this.capsChanged(linkId);
+			return;
+		}
 		chosen ??= live.stored.preferredTransport !== preferred;
 		const patch = {
 			preferredTransport: preferred,
@@ -38140,6 +38432,18 @@ var GhostlyNode = class GhostlyNode {
 			f: reply.member
 		}, readForwarded(hops));
 	}
+	/**
+	* Whether `sendGroupFile` would take a file of mine for the group now, asked before its bytes are copied in: the
+	* error it would answer for the group's pace of files or for not being in it, or null. Not a promise: it may still
+	* refuse (the minute's files can fill in between).
+	*/
+	groupFileCheck({ groupId }) {
+		if (typeof groupId !== "string") return {
+			error: "No such group",
+			refused: true
+		};
+		return this.groups.fileCheck(groupId);
+	}
 	groupMessages({ groupId }) {
 		return this.groups.messages(groupId);
 	}
@@ -38155,8 +38459,7 @@ var GhostlyNode = class GhostlyNode {
 			error: "No button to press",
 			refused: true
 		};
-		const history = await db.getMessages(linkId);
-		const message = history.find((m) => m.id === messageId);
+		const message = await db.getMessage(linkId, messageId);
 		if (!message) return {
 			error: "That message is not in this chat",
 			refused: true
@@ -38165,6 +38468,8 @@ var GhostlyNode = class GhostlyNode {
 			error: "Buttons on your own message do nothing",
 			refused: true
 		};
+		const card = messageButtons(message);
+		const history = card && !card.closed && card.buttons.some((b) => b.once) ? await db.getMessages(linkId) : [];
 		const state = buttonsState(message, replyRef(message), history);
 		const button = state?.card.buttons.find((b) => b.id === buttonId);
 		if (!state || !button) return {
@@ -38213,8 +38518,7 @@ var GhostlyNode = class GhostlyNode {
 		if (!targets.length) throw new Error("No chat to forward to");
 		if (targets.length > 5) throw new Error(`Forward to at most 5 chats at once`);
 		if (linkId.startsWith("group:") ? !this.membership(linkId.slice(6)) : this.links.get(linkId)?.stored.group !== void 0 || !this.links.has(linkId)) throw new Error("Chat not found");
-		const history = await db.getMessages(linkId);
-		const chosen = ids.map((id) => history.find((m) => m.id === id));
+		const chosen = await Promise.all(ids.map((id) => db.getMessage(linkId, id)));
 		if (chosen.some((m) => !m)) throw new Error("That message is not in this chat");
 		const messages = chosen.sort((a, b) => a.timestamp - b.timestamp);
 		for (const message of messages) {
@@ -38427,19 +38731,47 @@ var GhostlyNode = class GhostlyNode {
 		} catch {}
 		return { error: null };
 	}
-	/** An edge of a private group opened: the member hears my latest reactions again, in case it missed them. */
+	/** A group's history read in flight for edges that opened, by chat: its callers of the moment share it. */
+	edgeOpenReads = /* @__PURE__ */ new Map();
+	/**
+	* A group's whole history, for what an edge that opens hears again (my latest edits and reactions): the edges that
+	* open together, a member back in a group of 8 opening 7, read it once, not twice each. Ended, the next one reads anew.
+	*/
+	edgeOpenHistory(chat) {
+		let read = this.edgeOpenReads.get(chat);
+		if (!read) {
+			read = db.getMessages(chat).finally(() => this.edgeOpenReads.delete(chat));
+			this.edgeOpenReads.set(chat, read);
+		}
+		return read;
+	}
+	/**
+	* An edge of a private group opened: the member hears my latest reactions again, in case it missed them. The newest
+	* `REACTION_LIMITS.send` go now and the rest a window later, while the edge is the same: the member takes 30 a window
+	* from me, and 32 at once lost two of them.
+	*/
 	async resendGroupReactions(groupId, linkId) {
 		if (this.outsideEdge(linkId)) return;
-		const mine = groupReactionsToResend(await db.getMessages(`group:${groupId}`), REACTION_LIMITS.pending);
-		for (const reaction of mine) try {
-			this.links.get(linkId)?.link?.sendGroupFrame({
-				t: GROUP_REACTION_FRAME,
-				g: groupId,
-				...reaction,
-				...this.groups.signReaction(groupId, reaction)
-			});
-		} catch {
-			return;
+		const mine = groupReactionsToResend(await this.edgeOpenHistory(`group:${groupId}`), REACTION_LIMITS.pending);
+		const link = this.links.get(linkId)?.link;
+		const say = (batch) => {
+			for (const reaction of batch) try {
+				link?.sendGroupFrame({
+					t: GROUP_REACTION_FRAME,
+					g: groupId,
+					...reaction,
+					...this.groups.signReaction(groupId, reaction)
+				});
+			} catch {
+				return;
+			}
+		};
+		say(mine.slice(0, REACTION_LIMITS.send));
+		for (let start = REACTION_LIMITS.send, turn = 1; start < mine.length; start += REACTION_LIMITS.send, turn++) {
+			const batch = mine.slice(start, start + REACTION_LIMITS.send);
+			setTimeout(() => {
+				if (link && this.links.get(linkId)?.link === link) say(batch);
+			}, turn * (REACTION_LIMITS.windowMs + 1e3));
 		}
 	}
 	/**
@@ -38506,19 +38838,23 @@ var GhostlyNode = class GhostlyNode {
 	}
 	/** Mini-apps are on in this build (`APPS_ENABLED`) or for this engine (`apps`). */
 	get appsOn() {
-		return this.options.apps ?? false;
+		return this.options.apps ?? true;
+	}
+	/** Why an app call is refused: this client runs no mini-app (`apps: false`), or the build has them off. */
+	appsOff() {
+		return /* @__PURE__ */ new Error(this.options.apps === false ? "Apps do not run on this client" : "Apps are unavailable in this release");
 	}
 	/** A paired 1:1 chat and the chat app id of `ref` in it, from the two pinned participation keys (WISP 1200 § In a chat). */
 	appChat(linkId, ref) {
-		if (!this.appsOn) throw new Error("Apps are unavailable in this release");
+		if (!this.appsOn) throw this.appsOff();
 		const live = typeof linkId === "string" ? this.links.get(linkId) : void 0;
 		if (!live || live.stored.group || !live.stored.profile) throw new Error("No such chat");
 		if (!isAppRef(ref)) throw new Error("Not an app reference");
-		const { participationSeed, pairedPeerKey } = live.stored;
-		if (!participationSeed || !pairedPeerKey) throw new Error("This chat is not paired yet");
+		const mine = participationKeyOf(live), { pairedPeerKey } = live.stored;
+		if (!mine || !pairedPeerKey) throw new Error("This chat is not paired yet");
 		return {
 			live,
-			app: chatAppId(identityFromSeedB64(participationSeed).publicKey, publicKeyFromZ32(pairedPeerKey), ref)
+			app: chatAppId(publicKeyFromZ32(mine), publicKeyFromZ32(pairedPeerKey), ref)
 		};
 	}
 	/** The chat app id of an app in a paired chat: how the contact's frames name it. */
@@ -40595,6 +40931,7 @@ var GhostlyNode = class GhostlyNode {
 		this.groupWakeReceived.delete(linkId);
 		this.quietEdges.delete(linkId);
 		this.groupNativeWaiting.delete(linkId);
+		this.groupNativeFailed.delete(linkId);
 		this.groupNativeRetryAt = 0;
 		if (live.stored.wakeToken && this.meshEdge(live.stored)) {
 			const group = live.stored.group, peer = live.stored.groupPeer;
@@ -40763,6 +41100,7 @@ var GhostlyNode = class GhostlyNode {
 				automatic: true
 			},
 			packetTransports: !this.options.webrtcGroupLinks,
+			packetTransportsSaid: !!stored.transportSeeds && Object.keys(stored.transportSeeds).length > 0,
 			resumeFloor: !entry && stored.edgeLive ? stored.edgeLiveSince : void 0,
 			pairing: {
 				credentials: {
@@ -40823,6 +41161,21 @@ var GhostlyNode = class GhostlyNode {
 					};
 					db.patchLink(linkId, patch).catch(() => {});
 					if (this.keepsGroupNative(live.stored)) this.ensureNativeEndpoints(linkId);
+					else this.groupNativeWaiting.delete(linkId);
+				},
+				onPacketTransportsGone: () => {
+					const patch = {
+						peerTransports: void 0,
+						peerDescriptors: void 0,
+						peerFallback: void 0
+					};
+					live.stored = {
+						...live.stored,
+						...patch
+					};
+					db.patchLink(linkId, patch).catch(() => {});
+					if (!this.keepsGroupNative(live.stored)) this.groupNativeWaiting.delete(linkId);
+					this.emitState();
 				},
 				...entry ? {} : {
 					onPaymentRequest: (request) => member() ? this.desk.onPaymentRequest(linkId, request) : void 0,
@@ -40865,12 +41218,16 @@ var GhostlyNode = class GhostlyNode {
 					this.emitState();
 				},
 				onStatus: (status) => {
-					live.status = status;
-					this.emitState();
+					if (status !== live.status) {
+						live.status = status;
+						this.emitState();
+					}
 				},
 				onDiscoveryError: (error) => {
-					live.discoveryError = error ?? void 0;
-					this.emitState();
+					if ((error ?? void 0) !== live.discoveryError) {
+						live.discoveryError = error ?? void 0;
+						this.emitState();
+					}
 				}
 			}
 		});
@@ -40922,6 +41279,7 @@ var GhostlyNode = class GhostlyNode {
 			expectedPeerKey: stored.peerParticipationKeyZ32
 		} : void 0;
 		const resumed = stored.pairedPeerKey && stored.deliveryMode !== "dht" ? resumeHere(this.transportLogOf(live), this.transportsHere(), stored.peerTransports ?? live.caps?.peer?.transports) : {};
+		let dhtShown;
 		live.link = new GhostLink({
 			paymentMethods: stored.paymentMethods,
 			paymentNetworks: this.chatNetworks(stored),
@@ -41045,10 +41403,14 @@ var GhostlyNode = class GhostlyNode {
 				},
 				onGroupFrame: stored.profile ? (frame) => this.groups.handleContactFrame(linkId, frame) : void 0,
 				onGroupsSupport: () => this.emitState(),
-				onDhtDelivery: () => {
+				onDhtDelivery: (view) => {
 					if (stored.profile && !stored.group) this.outboxes.get(linkId)?.flush().catch(() => {}).then(() => this.editQueues.get(linkId)?.flush()).catch(() => {});
 					this.observeTransport(linkId);
-					this.emitState();
+					const shown = JSON.stringify(view);
+					if (shown !== dhtShown) {
+						dhtShown = shown;
+						this.emitState();
+					}
 				},
 				onHold: (state) => this.hold.peerSaid(linkId, state),
 				onPeerProof: void 0,
@@ -41086,8 +41448,10 @@ var GhostlyNode = class GhostlyNode {
 					else this.emitState();
 				},
 				onDiscoveryError: (error) => {
-					live.discoveryError = error ?? void 0;
-					this.emitState();
+					if ((error ?? void 0) !== live.discoveryError) {
+						live.discoveryError = error ?? void 0;
+						this.emitState();
+					}
 				},
 				onTransportDiscovery: async (peerDescriptors, peerTransports, peerFallback) => {
 					const patch = {
@@ -41112,23 +41476,27 @@ var GhostlyNode = class GhostlyNode {
 					this.emitState();
 				},
 				onStatus: (status) => {
+					const was = live.status, synced = live.lastSyncAt;
 					live.status = status;
 					if (status === "online") live.lastSyncAt = Date.now();
-					this.emitState();
+					if (status !== was || !synced || stored.group || linkId === this.activeLinkId) this.emitState();
 				},
 				onPoll: ({ polling, nextInMs }) => {
+					const was = live.poll.polling;
 					live.poll = {
 						polling,
 						nextAt: Date.now() + nextInMs,
 						interval: nextInMs || live.poll.interval
 					};
-					this.emitState();
+					if (linkId === this.activeLinkId || !live.lastSyncAt && polling !== was) this.emitState();
 				},
 				onMessageReceipt: async (id) => {
-					if (stored.profile && !stored.group) await this.fileSeenOnFloor(linkId, id);
+					const oneToOne = !!stored.profile && !stored.group;
+					const mine = oneToOne ? await db.getMessage(linkId, `me_${id}`) : void 0;
+					if (oneToOne && !mine) await this.fileSeenOnFloor(linkId, id);
 					await this.outboxFor(linkId).received(id);
-					if (stored.profile && !stored.group) await this.editsFor(linkId).receivedOnDht(id).catch(() => {});
-					if (stored.profile && !stored.group) this.editsFor(linkId).flush().catch(() => {});
+					if (oneToOne && !mine) await this.editsFor(linkId).receivedOnDht(id).catch(() => {});
+					if (oneToOne && (!mine || mine.edit?.pending)) this.editsFor(linkId).flush().catch(() => {});
 				},
 				onMessageEdit: stored.profile && !stored.group ? (edit) => this.receiveEdit(linkId, edit) : void 0,
 				onEditReceipt: stored.profile && !stored.group ? (id, e) => this.editsFor(linkId).received(id, e) : void 0,
@@ -41321,7 +41689,7 @@ var GhostlyNode = class GhostlyNode {
 			}
 		}
 		nativeUp?.then(() => {
-			if (live.link === link && stored.peerTransports && stored.preferredTransport !== "webrtc/1" && live.myPubKeyZ32 < stored.peerPubKeyZ32) link.connect().catch(() => {});
+			if (!this.shuttingDown && live.link === link && stored.peerTransports && stored.preferredTransport !== "webrtc/1" && live.myPubKeyZ32 < stored.peerPubKeyZ32) link.connect().catch(() => {});
 		});
 	}
 	/**
@@ -41401,7 +41769,7 @@ var GhostlyNode = class GhostlyNode {
 	get nativeFactories() {
 		const relay = this.relaysHyperdht ? this.hyperdhtRelay : "";
 		return {
-			...relay ? { "hyperdht/1": async (seedB64) => (await import("./hyperdhtRelay-DvXgebV7.js")).createRelayedHyperEndpoint(seedB64, relay) } : {},
+			...relay ? { "hyperdht/1": async (seedB64) => (await import("./hyperdhtRelay-C0XRWySP.js")).createRelayedHyperEndpoint(seedB64, relay) } : {},
 			...this.options.nativeTransports,
 			...this.ownIrohRelays ? { "iroh/1": (seedB64) => this.options.nativeTransports["iroh/1"](seedB64, this.settings.irohRelays?.length ? { relays: [...this.settings.irohRelays] } : {}) } : {},
 			...this.options.irohWeb ? { "iroh/1": (seedB64) => createIrohWebEndpoint(seedB64, { relays: this.irohRelays }) } : {}
@@ -41503,13 +41871,23 @@ var GhostlyNode = class GhostlyNode {
 			const live = this.links.get(linkId), link = live?.link;
 			if (this.shuttingDown || !live || !link || link !== expected) return;
 			if (live.stored.group && this.keepsGroupNative(live.stored)) {
-				if (full.some(Boolean) && !link.availableTransports.some((t) => t !== "webrtc/1")) this.groupNativeWaiting.add(linkId);
+				if (full.includes("no-slot") && !link.availableTransports.some((t) => t !== "webrtc/1")) this.groupNativeWaiting.add(linkId);
 				else this.groupNativeWaiting.delete(linkId);
-			}
+				if (full.includes("failed")) {
+					const wait = Math.min(Math.max(GROUP_NATIVE_RETRY_MS, (this.groupNativeFailed.get(linkId)?.wait ?? 0) * 2), GROUP_NATIVE_FAILED_MAX_MS);
+					this.groupNativeFailed.set(linkId, {
+						at: Date.now() + wait,
+						wait
+					});
+				} else this.groupNativeFailed.delete(linkId);
+			} else this.groupNativeFailed.delete(linkId);
 			this.emitState();
 		});
 	}
-	/** One transport's listener for one chat, in that transport's queue. True when a group's link found no slot free. */
+	/**
+	* One transport's listener for one chat, in that transport's queue. "no-slot" when a group's link found no slot free,
+	* "failed" when the listener could not start.
+	*/
 	async startNativeEndpoint(linkId, expected, key, factory, inUse) {
 		const live = this.links.get(linkId), link = live?.link;
 		if (this.shuttingDown || !live?.stored.profile || live.stored.deliveryMode === "dht" || !link || link !== expected) return false;
@@ -41519,7 +41897,7 @@ var GhostlyNode = class GhostlyNode {
 		live.transportErrors ??= {};
 		try {
 			const owners = [...this.links.values()].filter((other) => other.link?.availableTransports.includes(key));
-			if (group && (owners.length >= NATIVE_SLOTS || owners.filter((other) => other.stored.group).length >= 4)) return true;
+			if (group && (owners.length >= NATIVE_SLOTS || owners.filter((other) => other.stored.group).length >= 4)) return "no-slot";
 			if (owners.length >= NATIVE_SLOTS) {
 				const now = Date.now();
 				const taking = !group && (this.activeLinkId === linkId || inUse);
@@ -41563,7 +41941,12 @@ var GhostlyNode = class GhostlyNode {
 				transportSeeds
 			};
 			await db.patchLink(linkId, { transportSeeds });
-			const endpoint = await factory(seed);
+			const starting = factory(seed);
+			const endpoint = await Promise.race([starting, this.stopping]);
+			if (!endpoint) {
+				starting.then((late) => late.close(), () => {});
+				return false;
+			}
 			if (this.shuttingDown || live.stored.deliveryMode === "dht" || live.link !== link || !this.links.has(linkId)) {
 				await endpoint.close();
 				return false;
@@ -41574,6 +41957,7 @@ var GhostlyNode = class GhostlyNode {
 			this.emitState();
 		} catch (error) {
 			live.transportErrors[key] = error instanceof Error ? error.message : "Native adapter could not start. Reopen this chat to retry.";
+			return "failed";
 		}
 		return false;
 	}
@@ -41644,8 +42028,23 @@ var GhostlyNode = class GhostlyNode {
 	/** Group links waiting for a free native slot (`ensureNativeEndpoints`), by link id. */
 	groupNativeWaiting = /* @__PURE__ */ new Set();
 	groupNativeRetryAt = 0;
-	/** Now and then, the group links that found no free native slot try again: a chat or another group may have let one go. */
+	/** Group links whose native listener failed to start, by link id: when each tries again, and how long it waited last. */
+	groupNativeFailed = /* @__PURE__ */ new Map();
+	/**
+	* Now and then, the group links that found no free native slot try again: a chat or another group may have let one go.
+	* Those whose listener failed to start try again once their wait is over.
+	*/
 	retryGroupNative() {
+		const now = Date.now();
+		for (const [linkId, failed] of this.groupNativeFailed) {
+			if (now < failed.at) continue;
+			if (!this.links.get(linkId)?.link) {
+				this.groupNativeFailed.delete(linkId);
+				continue;
+			}
+			failed.at = now + failed.wait;
+			this.ensureNativeEndpoints(linkId);
+		}
 		if (!this.groupNativeWaiting.size || Date.now() < this.groupNativeRetryAt) return;
 		this.groupNativeRetryAt = Date.now() + GROUP_NATIVE_RETRY_MS;
 		for (const linkId of [...this.groupNativeWaiting]) {
@@ -41846,7 +42245,7 @@ var GhostlyNode = class GhostlyNode {
 			},
 			...this.reactionNotes.has(stored.id) && { lastReaction: this.reactionNotes.get(stored.id) },
 			...stored.pin && { pin: pinView(stored.pin) },
-			participationKey: stored.participationSeed ? identityFromSeedB64(stored.participationSeed).pubKeyZ32 : void 0,
+			participationKey: participationKeyOf(live),
 			peerParticipationKey: stored.pairedPeerKey,
 			publicProfiles: void 0,
 			profileChoice: void 0,
@@ -41963,6 +42362,9 @@ var EngineServer = class {
 	* call (WISP 06 § States and events). A client that goes away (a tab closed mid-call) is taken out with it.
 	*/
 	onCall = /* @__PURE__ */ new Set();
+	/** How many history changes the engine told; per chat or group, the count at its last one (`historyMark`). */
+	changes = 0;
+	changedAt = /* @__PURE__ */ new Map();
 	constructor(options = {}) {
 		this.node = new GhostlyNode({
 			onAttention: (event) => this.broadcast({
@@ -41973,8 +42375,14 @@ var EngineServer = class {
 				kind: "state",
 				state
 			}),
-			onMessages: (linkId, messages) => void this.inOrder(linkId, () => this.sendHistory(linkId, messages)).catch(() => {}),
-			onMessageChanges: (linkId, changes) => void this.inOrder(linkId, () => this.sendChanges(linkId, changes)).catch(() => {}),
+			onMessages: (linkId, messages) => {
+				this.changed(linkId);
+				this.inOrder(linkId, () => this.sendHistory(linkId, messages)).catch(() => {});
+			},
+			onMessageChanges: (linkId, changes) => {
+				this.changed(linkId);
+				this.inOrder(linkId, () => this.sendChanges(linkId, changes)).catch(() => {});
+			},
 			onCallSignal: (linkId, signal) => {
 				if (signalKind(signal) === "o") this.offers.set(linkId, signal);
 				else this.offers.delete(linkId);
@@ -41998,9 +42406,21 @@ var EngineServer = class {
 		this.ready = this.node.start();
 		this.ready.catch(() => {});
 	}
-	attach(client) {
+	/** A point in the engine's history changes: a history read after it can be handed to `attach` as read. */
+	get historyMark() {
+		return this.changes;
+	}
+	/**
+	* `read`: the chats and groups whose whole history the client read itself, after `mark` (`historyMark`). One that has
+	* not changed since is not read and sent again: the client hears only what changes in it from now on.
+	*/
+	attach(client, read) {
 		this.clients.add(client);
-		this.histories.set(client, /* @__PURE__ */ new Set());
+		const sent = /* @__PURE__ */ new Set();
+		if (read) {
+			for (const id of read.ids) if ((this.changedAt.get(id) ?? 0) <= read.mark) sent.add(id);
+		}
+		this.histories.set(client, sent);
 		this.ready.then(async () => {
 			if (!this.clients.has(client)) return;
 			client.post({
@@ -42013,15 +42433,18 @@ var EngineServer = class {
 				signal
 			});
 			else this.offers.delete(linkId);
-			for (const link of this.node.getState().links) await this.inOrder(link.id, async () => {
-				if (!this.clients.has(client)) return;
-				client.post({
-					kind: "messages",
-					linkId: link.id,
-					messages: await this.node.getMessages(link.id)
+			for (const link of this.node.getState().links) {
+				if (sent.has(link.id)) continue;
+				await this.inOrder(link.id, async () => {
+					if (!this.clients.has(client)) return;
+					client.post({
+						kind: "messages",
+						linkId: link.id,
+						messages: await this.node.getMessages(link.id)
+					});
+					this.histories.get(client)?.add(link.id);
 				});
-				this.histories.get(client)?.add(link.id);
-			});
+			}
 		}, (error) => {
 			this.post(client, {
 				kind: "start-failed",
@@ -42083,6 +42506,9 @@ var EngineServer = class {
 			return Promise.reject(error);
 		}
 	}
+	changed(linkId) {
+		this.changedAt.set(linkId, ++this.changes);
+	}
 	track(linkId, running) {
 		const settled = running.catch(() => {});
 		this.sending.set(linkId, settled);
@@ -42148,4 +42574,4 @@ function signalKind(signal) {
 //#endregion
 export { EngineServer, hyperdhtRelayProblem as n, server_exports as t };
 
-//# sourceMappingURL=server-GJW_5wGI.js.map
+//# sourceMappingURL=server-D5FBZYW8.js.map