@ghostlytools/cli 1.2.1 → 1.2.3

package/dist/assets/{server-D5FBZYW8.js → server-DHMXMwNn.js}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { $a as appRef, $c as randomBytes, $i as parseImageMeta, $n as engineError, $o as filePartName, $r as pinNumberHolds, $s as createChatInvite, $t as PaymentPreflightError, A as decodeGroupEntryLink, Aa as pairedReplyAuthor, Ac as RelayTransport, Ai as IDENTITY_REVOCATION_LABEL, Ao as RTC_CONFIG, Ar as mergeBeacon, As as readSetUpdate, B as groupWakes, Bc as createRelayPayload, Bi as lastSharedWithMe, Bo as LEGACY_SERVICES, Br as FILE_LIMITS, Bs as enrollCancelReason, C as COMMUNITY_LIMITS, Ca as nextReactionNumber, Cc as nextTurnPosition, Ci as readManifest, Co as formatLocalTarget, Cr as COMMUNITY_TOPOLOGY, Cs as readHandoffHello, D as decodeCommunityLink, Da as readReaction, Dc as turnKeys, Di as dialDescriptors, Do as decodeControl, Dr as freshHubs, Ds as sealHandoffPiece, E as communityHasFrame, Ea as reactionIsNewer, Ec as signTurnRelease, Ei as capsDescriptors, Eo as LIMITS, Er as doorHubs, Es as readHandoffVerified, F as mergeKnocks, Fc as budgetRetryMs, Fi as identityRevocationValue, Fr as readBeacon, Ga as arrivalKey, Gc as identityFromSeed, Gi as automaticTransport, Gn as findEndpoint, Go as HANDOFF_HAVE, Gr as TypingSender, Gs as enrollProofFrame, Gt as didDhtFromPublicKey, Ha as checkStatusCard, Hi as emptyProofLedger, Hn as ENDPOINT, Ho as HANDOFF_ACK, Hr as transferStalled, Hs as enrollDoneFrame, I as readKnocks, Ic as isDiscoveryBudgetError, Ii as identityStatement, Io as parseCallSignal, Ir as readBeaconHead, J as carryMentions, Ja as receivedTimestamp, Jc as verify, Jn as parseFedimintRequestPayload, Jo as HANDOFF_PAKE, Js as verifyEnrollProof, Ka as claimedTime, Kc as identityFromSeedB64, Kn as isFederationId, Ko as HANDOFF_HELLO, Ks as readEnrollGrant, Kt as encodeDidDhtDeactivated, Lc as withRequestOptions, Li as newIdentityBinding, Lr as readLobby, M as entryParams, Ma as replySnippet, Mc as normalizeRelayUrl, Mi as IdentityExchange, Mr as newerHead, Ms as setUpdateFrame, N as knockIdentity, Na as BUTTON_ID, Nr as pickHubs, Ns as signTombstone, O as encodeCommunityLink, Oa as validReactionNumber, Oc as turnName, Oo as encodeControl, Or as lobbyKeys, P as knockRecords, Pc as traceLink, Pi as emptyIdentityLedger, Pr as rankHubs, Ps as verifySetUpdate, Qa as appFingerprint, Qc as fromBase64Url, Qi as dhtFileId, Qn as pairedMessageFrame, Qo as HANDOFF_VERIFIED, Qr as pinIsNewer, Qs as OwnInviteError, Qt as ONCHAIN_PROVIDER, R as GroupWakeLimiter, Ra as STATUS_CARD_LIMITS, Rc as PacketTooLargeError, Ri as receivedIdentityStatus, Ro as emptyLinkRecords, Rr as shouldBeHub, S as sealGroupTyping, Sa as ReactionWindow, Sc as firstDeviceSetSecret, Si as newMailbox, So as GhostlyHttpError, Sr as pickMeshHubs, Ss as readHandoffHave, T as GROUP_READ_NOTE_COMMUNITY, Ta as reactionEmoji, Tc as signTurnPacket, Ti as DHT_TEXT_CAPABILITY, To as webLocalFetch, Tr as beaconRecords, Ts as readHandoffTurnFrame, U as GROUP_READ_NOTE, Ua as sameButtonText, Ui as validExternalKey, Un as cashuRequestPayload, Uo as HANDOFF_CANCEL, Us as enrollGrantFrame, V as parseGroupWakeFrame, Vi as PeerProofs, Vn as decodeBolt11, Vo as serviceIdFromName, Vr as transferEnded, Vs as enrollDigits, W as GroupSession, Wa as statusCardText, Wc as createIdentity, Wi as TRANSPORTS, Wn as fedimintRequestPayload, Wo as HANDOFF_DONE, Ws as enrollHelloFrame, Wt as didDhtDocument, X as mentionsMember, Xc as sanitizeAvatar, Xi as peekDhtMailbox, Xn as INVITE_TAKEN, Xo as HANDOFF_REQUEST, Xr as mayPin, Xs as deviceInviteJoinerParams, Xt as ETHEREUM_USDT, Y as parseCommunityEdit, Ya as shownTime, Yi as DHT_MESSAGE_TTL, Yn as GhostLink, Yo as HANDOFF_PIECE_BYTES, Yr as PIN_LIMITS, Ys as createDeviceInvite, Yt as signDidDhtPacket, Z as groupName, Za as APP_STATEMENT_LIMITS, Zc as bytesEqual, Zi as DHT_FILE_CAPABILITY, Zn as LIVENESS_PING_MS, Zo as HANDOFF_TIMINGS, Zr as nextPinNumber, Zs as readDeviceInvite, Zt as EVM_TEST_CHAINS, _ as readAppBundle, _a as forwardedAgain, _c as TURN_SETTLE_MS, _i as HOLD_CAPABILITY, _o as DirectPathWatch, _r as groupSignalFrame, _s as handoffVersions, _t as isAtprotoDid, a as planAppUpdate, ac as ENROLL_CAPABILITY, ai as parseWakeFrame, an as assertTokenUnits, as as handoffContext, b as groupTypingEpoch, ba as GROUP_REACTION_FRAME, bc as TURN_LAST_SEQUENCE, bi as HoldKeys, bo as RELAY_POLL_INTERVALS, br as mayBeHub, bs as readHandoffCancel, ca as fileMessageText, cc as deviceEchoNonce, ci as checkPushEndpoint, cn as validatePaymentTarget, cr as readGroupFileMeta, cs as handoffDigest, da as parseVideoMeta, dc as devicePingFrame, di as isAppVersion, dn as SPARK_PROVIDER, ds as handoffManifestFrames, ec as decodeInviteCode, ei as readPin, el as toBase64Url, en as SEPOLIA_TEST_USDT, er as engineText, es as handoffAttemptAllowed, f as appDigest, fa as EDIT_BUFFER_MS, fc as newDeviceSetSecret, fi as APPS_CAPABILITY, fn as sparkAddressKind, fo as MEMBER_KEY, fr as CarriedTransport, fs as handoffOfferFrame, g as isAppUrl, ga as parseLinkPreview, gc as TURN_RAISE_READ_TIMEOUT_MS, gi as UPGRADE_CAPABILITY, gn as isPubkyKey, go as edgeParams, gs as handoffStreamKey, ha as dhtEditId, hi as STATUS_CARD_CAPABILITY, ho as verifyCommitSignature, hs as handoffRetryAfter, i as checkAppBeforeRun, ia as sanitizeMime, ic as DEVICES_CAPABILITY, ii as newWakeToken, in as WALLET_NETWORKS, is as handoffCancelFrame, j as encodeGroupEntryLink, ja as readReply, jc as currentRelays, jr as mergeLobby, js as setAckFrame, ka as wireReaction, kc as DEFAULT_RELAYS, kr as lobbyRecords, l as APP_BUNDLE_LIMITS, la as parseVoiceMeta, lc as deviceKeyZ32, li as vapidKeysMatch, ln as walletNetworkOf, lo as readCanonicalJson, ls as handoffEphemeral, ma as RateWindow, mc as webCryptoSigner, mi as EDIT_CAPABILITY, mn as isBitcoinAddress, mo as rosterHas, ms as handoffReleaseFrame, n as appStoreDecision, na as safeBlobType, ni as WakeLimiter, nl as utf8Decode, nn as TEST_USDT_FAUCET_AMOUNT, no as isAppRef, ns as handoffAttemptSucceeded, oc as HANDOFF_CAPABILITY, oi as relayRequest, on as assertWholeSats, or as groupFileFallback, os as handoffContextProof, p as appViewOf, pa as EDIT_RATE_WINDOW_MS, pc as seedSigner, pi as BUTTONS_CAPABILITY, pn as sparkInvoiceDetails, po as commitHash, ps as handoffPakeFrame, q as GROUP_EDIT_TEXT_BYTES, qa as heardTime, qc as publicKeyFromZ32, qn as parseCashuRequestPayload, qo as HANDOFF_OFFER, qr as typingActivity, qs as readEnrollHello, qt as encodeDidDhtPacket, r as appUpdateDecision, ra as sanitizeFileName, rc as inviteOwnership, ri as deviceWakeRequest, rl as utf8Encode, rn as USDT_PUBLIC_RPC, ro as readAppRevocation, rs as handoffBusyFrame, s as readAppStore, sc as deviceEchoFrame, si as wakeRequest, sn as formatPaymentAmount, so as canonicalJson, ss as handoffDataFrame, t as appRevocationFor, ta as formatFileSize, tc as encodeInviteCode, ti as WAKE_CALL_INTERVAL_MS, tl as toZ32, to as isAppKey, tr as GROUP_FILE_LIMITS, ts as handoffAttemptFailed, u as APP_BUNDLE_MAGIC, uc as deviceLinkPairing, ui as chatAppId, un as SPARK_NETWORKS, uo as GROUP_MEMBER_CAP, us as handoffHelloFrame, va as readForwarded, vc as classifyTurnRead, vi as HOLD_DATED_BACK_MS, vo as DHT_POLL_INTERVALS, vr as readGroupSignal, vs as newHandoffId, vt as normalizeAtprotoHandle, w as CommunitySession, wa as queueReaction, wc as readTurnPacket, wi as CapsExchange, wo as parseLocalTarget, wr as beaconKeys, ws as readHandoffPake, x as openGroupTyping, xa as REACTION_LIMITS, xc as TURN_MAX, xi as HoldRefusedError, xo as presenceSeenAt, xr as meshHubs, xs as readHandoffDone, y as GroupTypingBoard, ya as COMMUNITY_REACTION_FRAME, yc as turnPutSummary, yi as HOLD_LIMITS, yr as MESH_HUBS, ys as readHandoffAck, z as groupWakeFrame, zi as revokesIdentity, zo as HTTP_SERVICE_PROTO, zr as ChatFiles, zs as enrollCancelFrame } from "./src-aKGjb_yz.js";
+import { $ as parseCommunityEdit, $a as receivedTimestamp, $c as identityFromSeed, $o as HANDOFF_PAKE, $r as vapidKeysMatch, $s as verifyEnrollProof, $t as signDidDhtPacket, A as encodeCommunityLink, Aa as reactionEmoji, Ac as signTurnPacket, Ai as DHT_TEXT_CAPABILITY, Ao as webLocalFetch, Ar as FILE_LIMITS, As as readHandoffTurnFrame, B as GroupWakeLimiter, Bc as normalizeRelayUrl, Bi as identityRevocationValue, Bn as INVITE_TAKEN, Br as mayPin, C as openGroupTyping, Ca as readForwarded, Cc as classifyTurnRead, Co as DHT_POLL_INTERVALS, Cr as pickHubs, Cs as newHandoffId, D as GROUP_READ_NOTE_COMMUNITY, Da as ReactionWindow, Dc as firstDeviceSetSecret, Do as GhostlyHttpError, Dr as readLobby, Ds as readHandoffHave, E as CommunitySession, Ea as REACTION_LIMITS, Ec as TURN_MAX, Eo as presenceSeenAt, Er as readBeaconHead, Es as readHandoffDone, F as knockIdentity, Fa as pairedReplyAuthor, Fc as turnStatedVerifier, Fi as IDENTITY_REVOCATION_LABEL, Fn as findEndpoint, Fo as RTC_CONFIG, Fr as TypingSender, Fs as readSetUpdate, Gc as withRequestOptions, Gi as lastSharedWithMe, Gn as GROUP_FILE_LIMITS, Go as LEGACY_SERVICES, Gr as WAKE_CALL_INTERVAL_MS, Gs as enrollCancelReason, H as groupWakes, Hc as traceLink, Hi as newIdentityBinding, Hn as pairedMessageFrame, Hr as pinIsNewer, I as knockRecords, Ia as readReply, Ic as turnVerifierMark, In as isFederationId, Is as setAckFrame, J as frameBytes, Ja as sameButtonText, Jc as createRelayPayload, Ji as validExternalKey, Jo as HANDOFF_CANCEL, Jr as newWakeToken, Js as enrollGrantFrame, Jt as didDhtDocument, K as GROUP_READ_NOTE, Kc as PacketTooLargeError, Ki as PeerProofs, Ko as serviceIdFromName, Kr as WakeLimiter, Ks as enrollDigits, L as mergeKnocks, La as replySnippet, Lc as DEFAULT_RELAYS, Li as IdentityExchange, Ln as parseCashuRequestPayload, Lr as typingActivity, Ls as setUpdateFrame, M as decodeGroupEntryLink, Ma as readReaction, Mc as turnInstance, Mi as dialDescriptors, Mn as ENDPOINT, Mo as decodeControl, Mr as transferStalled, Ms as sealHandoffPiece, N as encodeGroupEntryLink, Na as validReactionNumber, Nc as turnKeys, Nn as cashuRequestPayload, No as encodeControl, O as communityHasFrame, Oa as nextReactionNumber, Oc as nextTurnPosition, Oo as formatLocalTarget, Or as shouldBeHub, Os as readHandoffHello, P as entryParams, Pa as wireReaction, Pc as turnName, Pn as fedimintRequestPayload, Q as carryMentions, Qa as heardTime, Qc as createIdentity, Qn as readGroupFileMeta, Qo as HANDOFF_OFFER, Qr as checkPushEndpoint, Qs as readEnrollHello, R as readKnocks, Ra as BUTTON_ID, Rc as RelayTransport, Rn as parseFedimintRequestPayload, Rs as signTombstone, S as groupTypingEpoch, Sa as forwardedAgain, Sc as TURN_SETTLE_MS, So as DirectPathWatch, Sr as newerHead, Ss as handoffVersions, St as normalizeAtprotoHandle, T as COMMUNITY_LIMITS, Ta as GROUP_REACTION_FRAME, Tc as TURN_LAST_SEQUENCE, To as RELAY_POLL_INTERVALS, Tr as readBeacon, Ts as readHandoffCancel, U as parseGroupWakeFrame, Ua as STATUS_CARD_LIMITS, Uc as budgetRetryMs, Ui as receivedIdentityStatus, Un as engineError, Uo as emptyLinkRecords, Ur as pinNumberHolds, V as groupWakeFrame, Vi as identityStatement, Vn as LIVENESS_PING_MS, Vo as parseCallSignal, Vr as nextPinNumber, W as GROUP_LIMITS, Wc as isDiscoveryBudgetError, Wi as revokesIdentity, Wn as engineText, Wo as HTTP_SERVICE_PROTO, Wr as readPin, Ws as enrollCancelFrame, Xa as arrivalKey, Xi as automaticTransport, Xn as groupFileFallback, Xo as HANDOFF_HAVE, Xr as relayRequest, Xs as enrollProofFrame, Xt as encodeDidDhtDeactivated, Ya as statusCardText, Yi as TRANSPORTS, Yo as HANDOFF_DONE, Yr as parseWakeFrame, Ys as enrollHelloFrame, Yt as didDhtFromPublicKey, Z as GROUP_EDIT_TEXT_BYTES, Za as claimedTime, Zo as HANDOFF_HELLO, Zr as wakeRequest, Zs as readEnrollGrant, Zt as encodeDidDhtPacket, _a as EDIT_BUFFER_MS, _c as newDeviceSetSecret, _n as sparkInvoiceDetails, _o as MEMBER_KEY, _r as freshHubs, _s as handoffOfferFrame, a as planAppUpdate, ac as decodeInviteCode, ai as STATUS_CARD_CAPABILITY, al as bytesEqual, as as handoffAttemptAllowed, ba as dhtEditId, bn as isPubkyKey, bo as verifyCommitSignature, br as mergeBeacon, bs as handoffRetryAfter, ca as sanitizeFileName, cc as inviteOwnership, ci as HOLD_DATED_BACK_MS, cl as toBase64Url, cn as WALLET_NETWORKS, co as readAppRevocation, cr as readGroupSignal, cs as handoffBusyFrame, d as APP_BUNDLE_LIMITS, dc as HANDOFF_CAPABILITY, di as HoldRefusedError, dl as utf8Encode, dn as formatPaymentAmount, dr as meshHubs, ds as handoffContextProof, ea as DHT_MESSAGE_TTL, ec as createDeviceInvite, ei as chatAppId, el as identityFromSeedB64, en as ETHEREUM_USDT, eo as shownTime, es as HANDOFF_PIECE_BYTES, et as mentionsMember, f as APP_BUNDLE_MAGIC, fc as deviceEchoFrame, fi as isHoldUrl, fn as validatePaymentTarget, fo as canonicalJson, fr as pickMeshHubs, fs as handoffDataFrame, ga as parseVideoMeta, gc as devicePingFrame, gn as sparkAddressKind, gr as doorHubs, gs as handoffManifestFrames, h as appViewOf, hc as deviceLinkPairing, hn as SPARK_PROVIDER, ho as GROUP_MEMBER_CAP, hr as beaconRecords, hs as handoffHelloFrame, i as checkAppBeforeRun, ia as parseImageMeta, ic as createChatInvite, ii as EDIT_CAPABILITY, il as sanitizeAvatar, in as SEPOLIA_TEST_USDT, io as appRef, is as filePartName, ja as reactionIsNewer, jc as signTurnRelease, ji as capsDescriptors, jn as decodeBolt11, jo as LIMITS, jr as transferEnded, js as readHandoffVerified, k as decodeCommunityLink, ka as queueReaction, kc as readTurnPacket, ki as CapsExchange, ko as parseLocalTarget, kr as ChatFiles, ks as readHandoffPake, l as readAppStoreSteps, la as sanitizeMime, lc as DEVICES_CAPABILITY, li as HOLD_LIMITS, ll as toZ32, ln as assertTokenUnits, lr as MESH_HUBS, ls as handoffCancelFrame, m as appDigest, ma as parseVoiceMeta, mc as deviceKeyZ32, mi as readManifest, mn as SPARK_NETWORKS, mo as readCanonicalJson, mr as beaconKeys, ms as handoffEphemeral, n as appStoreDecision, na as DHT_FILE_CAPABILITY, nc as readDeviceInvite, ni as APPS_CAPABILITY, nl as verify, nn as ONCHAIN_PROVIDER, no as APP_STATEMENT_LIMITS, nr as CarriedTransport, ns as HANDOFF_TIMINGS, o as APP_STORE_LIMITS, oa as formatFileSize, oc as encodeInviteCode, oi as UPGRADE_CAPABILITY, ol as fromBase64Url, on as TEST_USDT_FAUCET_AMOUNT, oo as isAppKey, os as handoffAttemptFailed, pa as fileMessageText, pc as deviceEchoNonce, pi as newMailbox, pn as walletNetworkOf, pr as COMMUNITY_TOPOLOGY, ps as handoffDigest, q as GroupSession, qa as checkStatusCard, qi as emptyProofLedger, qo as HANDOFF_ACK, qr as deviceWakeRequest, qs as enrollDoneFrame, r as appUpdateDecision, ra as dhtFileId, rc as OwnInviteError, ri as BUTTONS_CAPABILITY, rn as PaymentPreflightError, ro as appFingerprint, rs as HANDOFF_VERIFIED, sa as safeBlobType, si as HOLD_CAPABILITY, sl as randomBytes, sn as USDT_PUBLIC_RPC, so as isAppRef, sr as groupSignalFrame, ss as handoffAttemptSucceeded, t as appRevocationFor, ta as peekDhtMailbox, tc as deviceInviteJoinerParams, ti as isAppVersion, tl as publicKeyFromZ32, tn as EVM_TEST_CHAINS, ts as HANDOFF_REQUEST, tt as groupName, uc as ENROLL_CAPABILITY, ui as HoldKeys, ul as utf8Decode, un as assertWholeSats, ur as mayBeHub, us as handoffContext, v as isAppUrl, va as EDIT_RATE_WINDOW_MS, vc as seedSigner, vn as isBitcoinAddress, vo as commitHash, vr as lobbyKeys, vs as handoffPakeFrame, w as sealGroupTyping, wa as COMMUNITY_REACTION_FRAME, wc as turnPutSummary, wr as rankHubs, ws as readHandoffAck, x as GroupTypingBoard, xa as parseLinkPreview, xc as TURN_RAISE_READ_TIMEOUT_MS, xo as edgeParams, xr as mergeLobby, xs as handoffStreamKey, xt as isAtprotoDid, y as readAppBundle, ya as RateWindow, yc as webCryptoSigner, yo as rosterHas, yr as lobbyRecords, ys as handoffReleaseFrame, zc as currentRelays, zi as emptyIdentityLedger, zn as GhostLink, zr as PIN_LIMITS, zs as verifySetUpdate } from "./src-_FzJkeAJ.js";
 import { a as clearProfileStores, c as fileStore, d as profileOpenFailure, f as store, i as STORES$1, l as newestWalletTx, m as wrap, n as APP_STORAGE_SCOPE_INDEX, o as databaseName, p as transact, r as CARD_INDEX, s as deleteDatabase, t as APP_STORAGE_CHAT_INDEX, u as openDb } from "./idb-CTF6LF5B.js";
 import { a as fileBytesOf, c as removeFileBytes, i as fileBytes, l as FILE_BYTES_STEP, n as blobDigest } from "./fileBytes-BcYZhNgF.js";
 import { $ as BACKUP_MEDIA_TYPE, A as requireTurn, At as paymentWireId, B as networkLabel, C as breezDatabasesFor, Ct as storedGroupFiles, D as sourceKey, Dt as replyRef, E as ProviderSources, Et as receivedPairedReply, F as sealSeed, Ft as streamStored, G as BITCOIN_INVOICE_ON_TESTNET, H as cashuMint, I as unsealSeed, J as fakesLightning, K as DEFAULT_MINTS, L as ModeChanged, M as setSingleWriterGate, Mt as readStored$1, N as intentRepository, Nt as removeStored, O as awayFrom, Ot as replyTo, P as newDeviceKey, Pt as storedSize, Q as paysItsOwnInvoices, R as ModeGate, S as breezDatabaseInUse, St as groupOfFile, T as lightningPaying, Tt as pairedWireReply, V as CASHU_MINT_SOURCE, W as WALLET_TYPES, X as isWorthlessMint, Y as isTestMint, Z as mintNetwork, _ as LightningCards, _t as verifyIdentity, a as irohRelayProblem, at as reserveAdapterIds, b as normalizePhrase, bt as groupFileId, c as createFailure, ct as SourceConfigError, d as paymentNetwork, dt as networkMode, et as MAX_BACKUP_BYTES, f as paymentNetworksOf, ft as redact, g as CASHU_CARD, gt as boundedIdentityFetch, ht as setOwnDidSource, i as createIrohWebEndpoint, it as registeredOnchainProviders, j as setAwayWallets, jt as FileAppender, k as refuseAway, kt as paymentAlias, l as createTiming, lt as SourceUnreachableError, mt as resolveAtprotoDid, n as loadFedimintSdk, nt as onAdaptersChanged, o as WALLET_NAMES, ot as NothingSpentError, p as walletInstances, pt as assertPublicServer, q as TEST_MINT, r as DEFAULT_IROH_RELAYS, rt as registeredLightningProviders, s as assertConfirmedReal, st as PROVIDER_PLATFORMS, t as fedimintDatabase, tt as identityProviders, u as crossNetwork, ut as isNothingSpentError, v as cardsKey, vt as chosenResolver, w as dropBreezDatabase, wt as groupReply, x as breezDatabase, xt as groupFileText, y as isRecoveryPhrase, yt as GroupFileDesk, z as WrongNetworkError } from "../ghostly.mjs";
@@ -180,7 +180,7 @@ async function migrateWalletNetworks(now = Date.now()) {
 //#endregion
 //#region ../browser/src/engine/paymentAdapters/usdtWallet.ts
 /** The Ethereum libraries, a large part of the app: loaded once a USDT wallet is made, opened or restored, not with the engine. */
-var loadUsdt = () => import("./usdt-CUfucwZf.js");
+var loadUsdt = () => import("./usdt-D0lO2pRR.js");
 /** Every new profile starts with this wallet: an address to receive on, nothing to set up. */
 var DEFAULT_USDT = {
 	network: "ethereum",
@@ -642,7 +642,9 @@ async function restoreArkDatabase(walletId, snapshot) {
 //#endregion
 //#region ../browser/src/engine/paymentAdapters/arkWallet.ts
 /** The Ark SDK, a large part of the app: loaded once an Ark wallet is made, opened or restored, not with the engine. */
-var loadArkade = () => import("./arkade-CtCpFaF7.js");
+var loadArkade = () => import("./arkade-B-ALutmU.js");
+/** How long a Testnet wallet about to make way for another waits for its server to say what it holds. */
+var RETIRE_READ_MS = 1e4;
 /** Every new profile starts with this wallet: nothing to set up before receiving. */
 var DEFAULT_ARK = {
 	network: "bitcoin",
@@ -1048,10 +1050,23 @@ var ArkWallet = class {
 	async retirable(refusal) {
 		const saved = this.saved;
 		if ((await wrap((await store(STORES$1.intents, "readonly")).getAll())).some((i) => this.ours(i))) throw new Error(refusal);
-		if (this.adapter && await this.gate.within(this.adapter.balance()) > 0) throw new Error(refusal);
+		if (this.adapter && await this.gate.within(this.held(this.adapter)) > 0) throw new Error(refusal);
 		await this.lock();
 		return saved;
 	}
+	/**
+	* What the wallet holds, asked of its server. A test network's server that stopped answering must not hold the
+	* wallet on it (one that never answered does not either): past RETIRE_READ_MS the last balance read stands.
+	* Mainnet waits for its server's own word.
+	*/
+	held(adapter) {
+		const asked = adapter.balance();
+		if (this.network !== "testnet") return asked;
+		return new Promise((resolve, reject) => {
+			const timer = setTimeout(() => resolve(this.view.balance), RETIRE_READ_MS);
+			asked.then(resolve, reject).finally(() => clearTimeout(timer));
+		});
+	}
 	/** A payment of this wallet's network (the other network's wallet has its own). */
 	ours(intent) {
 		return intent.review.method === "arkade" && arkMode(intent.review.network) === this.network;
@@ -1876,13 +1891,24 @@ var BarkWallet = class {
 	async retirable(refusal) {
 		const saved = this.saved;
 		if ((await intentRepository.list()).some((i) => this.ours(i))) throw new Error(refusal);
-		if (this.adapter) {
-			const b = await this.gate.within(this.adapter.balance());
-			if (b.spendableSats + b.pendingInRoundSats + b.pendingBoardSats + b.pendingExitSats + b.pendingLightningSendSats + b.claimableLightningReceiveSats > 0) throw new Error(refusal);
-		}
+		if (this.adapter && await this.gate.within(this.held(this.adapter)) > 0) throw new Error(refusal);
 		await this.lock();
 		return saved;
 	}
+	/**
+	* What the wallet holds, asked of its server: spendable, on its way in and on its way out. A test network's server
+	* that stopped answering must not hold the wallet on it (one that never answered does not either): past
+	* RETIRE_READ_MS the last reading stands, whose three sums are those same six parts. Mainnet waits for its
+	* server's own word.
+	*/
+	held(adapter) {
+		const asked = adapter.balance().then((b) => b.spendableSats + b.pendingInRoundSats + b.pendingBoardSats + b.pendingExitSats + b.pendingLightningSendSats + b.claimableLightningReceiveSats);
+		if (this.network !== "testnet") return asked;
+		return new Promise((resolve, reject) => {
+			const timer = setTimeout(() => resolve(this.view.balance + (this.view.pending ?? 0) + (this.view.exiting ?? 0)), RETIRE_READ_MS);
+			asked.then(resolve, reject).finally(() => clearTimeout(timer));
+		});
+	}
 	/** A payment of this wallet's network (the other network's wallet has its own). */
 	ours(intent) {
 		return intent.review.method === "bark" && barkMode(intent.review.network) === this.network;
@@ -11133,7 +11159,13 @@ var APP_STORAGE_LIMITS = {
 	keyBytes: 256,
 	/** A value, as compact JSON in UTF-8 bytes. */
 	valueBytes: 65536,
-	/** Every key and value of one app in one scope. */
+	/**
+	* Counted for each key beside its own bytes and its value's: what the row costs on the device (the app's reference,
+	* the scope and the key again, in the row's own key and in its two indexes). Without it a scope of one-byte values
+	* held 20 times its 5 MiB.
+	*/
+	rowBytes: 128,
+	/** Every key and value of one app in one scope, with `rowBytes` for each key. */
 	scopeBytes: 5242880
 };
 var APP_CHECK_TIMINGS = {
@@ -11145,6 +11177,11 @@ var APP_CHECK_TIMINGS = {
 };
 /** Revocations are checked this long at a time before the page's thread is let go. */
 var REVOCATIONS_SLICE_MS = 10;
+/**
+* Revocations of store indexes whose signature was checked, kept by `appRevocationId` so an index that changes around
+* them does not have each checked again (the one read longest ago dropped first): four indexes' worth, about 1 MiB.
+*/
+var STORE_REVOCATIONS_KEPT = 4 * APP_STORE_LIMITS.revoked;
 /** `ghostly-revoke.json` files whose result is kept, so an unchanged one is not checked again (the oldest dropped first). */
 var REVOCATION_FILES_KEPT = 64;
 /** A fetched bundle kept for its install screen: at most this many, for this long. */
@@ -11155,6 +11192,8 @@ var STAGED = {
 /** The first bytes of a bundle: magic, the manifest's length and the largest manifest. */
 var PEEK_BYTES = APP_BUNDLE_MAGIC.length + 4 + APP_BUNDLE_LIMITS.manifestBytes;
 var bundleId = (digest) => `app-${digest}`;
+/** What a row takes of its scope's 5 MiB: its key and value, and `rowBytes`. Not kept in the row, so rows from before count alike. */
+var costOf = (row) => APP_STORAGE_LIMITS.rowBytes + row.size;
 /**
 * A listing's URLs this client reads, in order, a jsDelivr copy first: one this client reads names a full commit, so it
 * holds exactly the version the store reviewed, where a raw `HEAD` may have moved on to one it has not (WISP 1200 §
@@ -11231,7 +11270,7 @@ var Apps = class {
 	/** Reads of a bundle under way, by digest: icons drawn at once share one read. */
 	verifying = /* @__PURE__ */ new Map();
 	/**
-	* The `icon.png` of each checked bundle, by digest (at most 256 KiB, or null for none): every icon shown on the Apps
+	* The `icon.png` of each checked bundle, by digest (at most 256 KiB and 1024 × 1024 pixels, or null for none): every icon shown on the Apps
 	* page, in a chat's cards and in the composer's Apps is read without the whole bundle again.
 	*/
 	icons = /* @__PURE__ */ new Map();
@@ -11244,6 +11283,13 @@ var Apps = class {
 	checking = null;
 	/** Runs the person started with Run anyway (`<ref> <digest>`), for this engine's life: a removal does not cut them off. */
 	anyway = /* @__PURE__ */ new Set();
+	/** The apps started here (`entry`), for this engine's life: one of them uninstalled since may still have a frame open. */
+	ran = /* @__PURE__ */ new Set();
+	/**
+	* The versions started here (`entry`), by reference: digest to `sequence`, for this engine's life. A frame goes on
+	* running the version it started with whatever is installed since, so that version is the one judged when it asks.
+	*/
+	started = /* @__PURE__ */ new Map();
 	views = null;
 	held = /* @__PURE__ */ new Map();
 	heldStores = null;
@@ -11254,6 +11300,19 @@ var Apps = class {
 	listingMisses = /* @__PURE__ */ new Map();
 	/** `ghostly-revoke.json` files checked, by the SHA-256 of their bytes: their revocations, or null when refused. */
 	revocationFiles = /* @__PURE__ */ new Map();
+	/** Revocations read in a store's index and verified, by `appRevocationId`: at most `STORE_REVOCATIONS_KEPT`. */
+	storeRevocations = /* @__PURE__ */ new Set();
+	checkedRevocations = {
+		has: (id) => {
+			if (!this.storeRevocations.delete(id)) return false;
+			this.storeRevocations.add(id);
+			return true;
+		},
+		add: (id) => {
+			this.storeRevocations.add(id);
+			if (this.storeRevocations.size > STORE_REVOCATIONS_KEPT) this.storeRevocations.delete(this.storeRevocations.values().next().value);
+		}
+	};
 	stopped = false;
 	constructor(host) {
 		this.host = host;
@@ -11337,22 +11396,48 @@ var Apps = class {
 	* a store of the person's removed (unless this run was started with Run anyway), is cut off with `stopped`, whether
 	* or not the page stops its frame.
 	*/
-	async stillRunnable(app) {
-		const run = this.runStatus(app, await this.heldViews(), app.revocations);
+	async stillRunnable(app, digest) {
+		const version = this.versionRunning(app, digest);
+		const run = this.runStatus(version, await this.heldViews(), app.revocations);
 		if (run.status === "revoked") fail("stopped", "Its publisher revoked this version");
-		if (run.status === "removed" && !this.anyway.has(`${app.ref} ${app.digest}`)) fail("stopped", `Removed by ${run.by[0].name}: ${run.by[0].reason}`);
+		if (run.status === "removed" && !this.anyway.has(`${version.ref} ${version.digest}`)) fail("stopped", `Removed by ${run.by[0].name}: ${run.by[0].reason}`);
 		return app;
 	}
-	async runningOrFail(ref) {
-		return this.stillRunnable(await this.installedOrFail(ref));
+	/**
+	* The version a frame runs: the one it names by `digest` (what `entry` gave it), which an update installed since does
+	* not change. None named: the installed one. One never started here does not run.
+	*/
+	versionRunning(app, digest) {
+		if (digest === void 0 || digest === app.digest) return app;
+		const sequence = typeof digest === "string" ? this.started.get(app.ref)?.get(digest) : void 0;
+		if (sequence === void 0) fail("stopped", "This version is not running");
+		return {
+			ref: app.ref,
+			sequence,
+			digest
+		};
+	}
+	/** The versions started here that are not the installed one any more. */
+	startedBefore(app) {
+		return [...this.started.get(app.ref) ?? []].filter(([digest]) => digest !== app.digest).map(([digest, sequence]) => ({
+			ref: app.ref,
+			sequence,
+			digest
+		}));
+	}
+	async runningOrFail(ref, digest) {
+		return this.stillRunnable(await this.installedOrFail(ref), digest);
 	}
 	/**
 	* Before an app's frames go to a contact (`appOpen`, `appSend`): refused with `stopped` as its storage is. A reference
-	* not installed here (a bot that speaks an app's messages) is not this store's to refuse.
+	* not installed here (a bot that speaks an app's messages) is not this store's to refuse, unless it ran here and was
+	* uninstalled since: the person removed it, so a frame of it still open says nothing more (`not-installed`). `digest`:
+	* the version the frame runs (`versionRunning`).
 	*/
-	async chatRunnable({ ref }) {
+	async chatRunnable({ ref, digest }) {
 		const app = isAppRef(ref) ? await this.app(ref) : void 0;
-		if (app) await this.stillRunnable(app);
+		if (!app && this.ran.has(ref)) fail("not-installed", "This app is not installed");
+		if (app) await this.stillRunnable(app, digest);
 	}
 	async putApp(app) {
 		try {
@@ -11543,7 +11628,10 @@ var Apps = class {
 	}
 	/**
 	* Reads the index at `url`. With the index held for this store, bytes equal to it (by digest) are the held index: its
-	* signature and every revocation in it were checked when it was read, so only its expiry is taken again.
+	* signature and every revocation in it were checked when it was read, so only its expiry is taken again. Any other
+	* index is read with a pause every few ms (the engine shares the page's thread, and an index holds up to 4096
+	* listings and 4096 revocations, each of these a signature check), and a revocation checked in an earlier read, of
+	* this store or another, a preview included, is not checked again.
 	*/
 	async readStoreAt(url, heldKey, held) {
 		const [indexBytes, sigBytes] = await Promise.all([this.host.fetch(url, { maxBytes: APP_FETCH_LIMITS.storeIndexBytes }), this.host.fetch(besideUrl(url, "ghostly-store.sig"), { maxBytes: APP_FETCH_LIMITS.sigBytes })]);
@@ -11555,7 +11643,16 @@ var Apps = class {
 				expired: held.index.expires < this.nowS()
 			}
 		};
-		return readAppStore(indexBytes, sigBytes, this.nowS(), heldKey);
+		const steps = readAppStoreSteps(indexBytes, sigBytes, this.nowS(), heldKey, this.checkedRevocations);
+		let since = performance.now();
+		for (;;) {
+			const step = steps.next();
+			if (step.done) return step.value;
+			if (performance.now() - since >= REVOCATIONS_SLICE_MS) {
+				await new Promise((resolve) => setTimeout(resolve, 0));
+				since = performance.now();
+			}
+		}
 	}
 	/**
 	* The revocations its publisher signed, read beside each URL (`ghostly-revoke.json`); none there is not an error.
@@ -12043,13 +12140,14 @@ var Apps = class {
 						maxBytes: PEEK_BYTES,
 						peek: true
 					}));
-					if (peek && newer(peek)) candidates.set(url, {});
+					if (peek && newer(peek)) candidates.set(url, { holds: peek });
 				} catch {}
 			}
 			const revokeRead = /* @__PURE__ */ new Set();
 			const before = await this.readRevocations(app.ref, [app.from, ...app.manifest.sources ?? []], revokeRead);
 			app = withRevocations(app, before ?? []);
 			for (const [url, want] of candidates) {
+				let holds = want.holds;
 				if (want.peek) {
 					let peek;
 					try {
@@ -12064,7 +12162,10 @@ var Apps = class {
 						if (want.miss) this.listingMisses.set(...want.miss);
 						continue;
 					}
+					holds = peek;
 				}
+				const twin = holds && (holds.sequence === app.sequence || holds.sequence === app.pending?.sequence);
+				if (holds && !twin && this.runStatus(holds, this.storeViews(stores), app.revocations).status !== "ok") continue;
 				let fetched;
 				try {
 					fetched = await this.fetchBundle(url);
@@ -12142,7 +12243,11 @@ var Apps = class {
 			}
 			const after = await this.readRevocations(app.ref, [app.from, ...app.manifest.sources ?? []], revokeRead);
 			const revocations = before || after ? [...before ?? [], ...after ?? []] : null;
-			const versions = [app, ...app.pending ? [versionOf(app.pending.manifest, app.pending.digest)] : []];
+			const versions = [
+				app,
+				...app.pending ? [versionOf(app.pending.manifest, app.pending.digest)] : [],
+				...this.startedBefore(app)
+			];
 			const stays = (app.revocations ?? []).filter((r) => !revocations || versions.some((v) => appRevocationFor(v, [r])));
 			const merged = new Map([...stays, ...revocations ?? []].map((r) => [canonicalJson(r), r]));
 			if ((await this.app(app.ref))?.store === void 0 && app.store !== void 0) {
@@ -12233,6 +12338,9 @@ var Apps = class {
 		if (run.status === "removed") this.anyway.add(`${app.ref} ${app.digest}`);
 		const bundle = await this.verifiedBundle(app);
 		const entry = bundle.files.get(bundle.manifest.entry) ?? fail("damaged", "The entry is missing");
+		this.ran.add(app.ref);
+		const versions = this.started.get(app.ref) ?? /* @__PURE__ */ new Map();
+		this.started.set(app.ref, versions.set(app.digest, app.sequence));
 		return {
 			ref: app.ref,
 			digest: app.digest,
@@ -12243,9 +12351,10 @@ var Apps = class {
 			entry: utf8Decode(entry)
 		};
 	}
-	/** A file of the installed bundle, for the broker's `file` (`ghostly.file(path)`). */
-	async file({ ref, path }) {
-		const app = path === "icon.png" ? await this.installedOrFail(ref) : await this.runningOrFail(ref);
+	/** A file of the installed bundle, for the broker's `file` (`ghostly.file(path)`). `digest`: the version the frame runs. */
+	async file({ ref, path, digest }) {
+		const app = path === "icon.png" ? await this.installedOrFail(ref) : await this.runningOrFail(ref, digest);
+		if (path !== "icon.png" && digest !== void 0 && digest !== app.digest) fail("no-file", "No such file in this app");
 		const icon = path === "icon.png" ? this.icons.get(app.digest) : void 0;
 		if (icon) return icon.slice();
 		if (icon === null) fail("no-file", "No such file in this app");
@@ -12256,6 +12365,10 @@ var Apps = class {
 	async view(app, stores) {
 		const { manifest } = app;
 		const listedBy = this.listedBy(app.ref, stores);
+		const stopped = this.startedBefore(app).map((v) => ({
+			digest: v.digest,
+			run: this.runStatus(v, this.storeViews(stores), app.revocations)
+		})).filter((v) => v.run.status !== "ok");
 		return {
 			ref: app.ref,
 			name: app.name,
@@ -12285,7 +12398,8 @@ var Apps = class {
 				sequence: app.equivocation.sequence,
 				at: app.equivocation.at
 			} },
-			...app.checkedAt !== void 0 && { checkedAt: app.checkedAt }
+			...app.checkedAt !== void 0 && { checkedAt: app.checkedAt },
+			...stopped.length && { stopped }
 		};
 	}
 	async list() {
@@ -12307,6 +12421,7 @@ var Apps = class {
 			this.held.delete(app.ref);
 		}
 		for (const key of [...this.usage.keys()]) if (key.startsWith(`${app.ref}\0`)) this.usage.delete(key);
+		this.started.delete(app.ref);
 		await this.removeBundle(app.bytes, app.digest);
 		if (app.pending) await this.removeBundle(app.pending.bytes, app.pending.digest);
 	}
@@ -12332,13 +12447,13 @@ var Apps = class {
 		const id = `${ref}\0${scope}`;
 		let used = this.usage.get(id);
 		if (used === void 0) {
-			used = (await wrap((await store(STORES$1.appStorage, "readonly")).index(APP_STORAGE_SCOPE_INDEX).getAll([ref, scope]))).reduce((sum, r) => sum + r.size, 0);
+			used = (await wrap((await store(STORES$1.appStorage, "readonly")).index(APP_STORAGE_SCOPE_INDEX).getAll([ref, scope]))).reduce((sum, r) => sum + costOf(r), 0);
 			this.usage.set(id, used);
 		}
 		return used;
 	}
-	async storageGet({ ref, scope, key }) {
-		const app = await this.runningOrFail(ref);
+	async storageGet({ ref, scope, key, digest }) {
+		const app = await this.runningOrFail(ref, digest);
 		const row = await wrap((await store(STORES$1.appStorage, "readonly")).get([
 			app.ref,
 			this.scopeOf(scope),
@@ -12346,9 +12461,13 @@ var Apps = class {
 		]));
 		return row ? { value: JSON.parse(row.value) } : null;
 	}
-	/** Keeps a JSON value under a key: at most 64 KiB, and 5 MiB for every key of this app in this scope. */
-	async storageSet({ ref, scope, key, value }) {
-		const app = await this.runningOrFail(ref);
+	/**
+	* Keeps a JSON value under a key: at most 64 KiB, and 5 MiB for every key of this app in this scope, each counted
+	* with `rowBytes`. A scope already past that (filled before a key counted `rowBytes`) still takes a write that does
+	* not grow it, so the app can make room.
+	*/
+	async storageSet({ ref, scope, key, value, digest }) {
+		const app = await this.runningOrFail(ref, digest);
 		const where = this.scopeOf(scope), name = this.keyOf(key);
 		let text;
 		try {
@@ -12363,12 +12482,13 @@ var Apps = class {
 		await this.serial(`${app.ref}\0${where}`, async () => {
 			const used = await this.usageOf(app.ref, where);
 			const rows = await store(STORES$1.appStorage, "readonly");
-			const next = used - ((await wrap(rows.get([
+			const old = await wrap(rows.get([
 				app.ref,
 				where,
 				name
-			])))?.size ?? 0) + size;
-			if (next > APP_STORAGE_LIMITS.scopeBytes) fail("full", "This app's storage in this chat is full (5 MiB)");
+			]));
+			const next = used - (old ? costOf(old) : 0) + APP_STORAGE_LIMITS.rowBytes + size;
+			if (next > APP_STORAGE_LIMITS.scopeBytes && next > used) fail("full", "This app's storage in this chat is full (5 MiB)");
 			const writing = await store(STORES$1.appStorage, "readwrite");
 			if (where !== "alone" && !this.host.isChat(where)) {
 				this.usage.delete(`${app.ref}\0${where}`);
@@ -12384,8 +12504,8 @@ var Apps = class {
 			this.usage.set(`${app.ref}\0${where}`, next);
 		});
 	}
-	async storageDelete({ ref, scope, key }) {
-		const app = await this.runningOrFail(ref);
+	async storageDelete({ ref, scope, key, digest }) {
+		const app = await this.runningOrFail(ref, digest);
 		const where = this.scopeOf(scope), name = this.keyOf(key);
 		await this.serial(`${app.ref}\0${where}`, async () => {
 			const used = await this.usageOf(app.ref, where);
@@ -12400,11 +12520,11 @@ var Apps = class {
 				where,
 				name
 			]));
-			this.usage.set(`${app.ref}\0${where}`, used - old.size);
+			this.usage.set(`${app.ref}\0${where}`, used - costOf(old));
 		});
 	}
-	async storageKeys({ ref, scope }) {
-		const app = await this.runningOrFail(ref);
+	async storageKeys({ ref, scope, digest }) {
+		const app = await this.runningOrFail(ref, digest);
 		return (await wrap((await store(STORES$1.appStorage, "readonly")).getAllKeys(rowsOf(app.ref, this.scopeOf(scope))))).map((k) => k[2]);
 	}
 	/** An app's storage in every scope, as export files (WISP 1200 § Where installed apps live), offered before an uninstall. */
@@ -13955,6 +14075,23 @@ function takeoverTurn(record, read) {
 	if (highest + 1 > TURN_MAX) throw new TurnClosedError();
 	return highest + 1;
 }
+/**
+* The `instance` of the record a device writes as the active one: it states the mark of the verifier beside its device
+* state (`turnInstance`, WISP 06 § Record), which on an active device is the profile's. `unstated`: a handoff's taker,
+* whose device state does not hold the verifier of the profile it just installed; it states it once its engine runs.
+*/
+function instanceFor(record, unstated = false) {
+	return turnInstance(unstated ? null : turnVerifierMark(record.verifier ?? null));
+}
+/**
+* The last record of the device set this device knows after a read: the one the sources returned when it is above
+* the packet it stored, else the stored one. A lower record (`behind`) and a tombstone say nothing here.
+*/
+function latestKnown(read, stored) {
+	const news = (read.result === "other" || read.result === "clone" || read.result === "mine") && read.record && !read.record.tombstone ? read.record : null;
+	if (!news) return stored;
+	return !stored || news.sequence >= stored.sequence ? news : stored;
+}
 /** The record's slots as the device state keeps them. */
 function deviceSetOf(record) {
 	return record.slots.map((slot) => slot && {
@@ -14150,7 +14287,7 @@ var TurnKeeper = class {
 			author: ownSlot,
 			active: ownSlot,
 			slots,
-			instance: (this.options.instance ?? (() => randomBytes(8)))(),
+			instance: this.options.instance?.() ?? instanceFor(record, !!options.release),
 			...release ? { release } : {}
 		};
 		const payload = await signTurnPacket(keys, fields, this.options.signer);
@@ -14171,6 +14308,31 @@ var TurnKeeper = class {
 		return this.put(held, payload, conditions, raising);
 	}
 	/**
+	* The active device says which verifier the profile has now (WISP 06 § Record, the verifier mark): when the record it
+	* stored states another one (the lock password changed, or the record was written before the verifier was at hand),
+	* it reads, and on `mine` or `none` writes its next record. True when the stored record states it (already, or now
+	* written); false when nothing was written (not the active device, no good read, another device's record there: the
+	* next check or start settles that, and every start writes a record anyway). Null for a `single` profile.
+	*/
+	stateVerifier() {
+		return this.exclusive(async () => {
+			const held = await this.held();
+			if (!held) return null;
+			if (held.record.state !== "active" || !held.wrote || !held.storedRecord) return false;
+			const stated = turnStatedVerifier(held.storedRecord.instance);
+			if (stated && bytesEqual(stated, turnVerifierMark(held.record.verifier ?? null))) return true;
+			const read = await this.readWith(held);
+			if (!read.good || read.result !== "mine" && read.result !== "none") return false;
+			try {
+				await this.writeWith(held, conditionsAfter(read, read.result === "none" ? "none" : "seen"));
+			} catch (error) {
+				if (error instanceof TurnClosedError) return false;
+				throw error;
+			}
+			return true;
+		});
+	}
+	/**
 	* A forced takeover (WISP 06 § Settle): reads the turn, makes the device `taking` (with the state it had, to go
 	* back to), writes the record of `turn` with no release within `P` of that read, and settles as every device that
 	* raises the turn does. `start` says it is the active device now; `gated` that it lost and is what it was before.
@@ -14184,6 +14346,7 @@ var TurnKeeper = class {
 			if (prior !== "standby" && prior !== "superseded") throw new Error(`A ${prior} device does not force a takeover`);
 			const read = await this.readWith(held, true);
 			if (!read.good || read.result === "tombstone") return this.settle(held, read, true);
+			options.before?.(latestKnown(read, held.storedRecord));
 			const turn = options.turn ?? takeoverTurn(held.record, read);
 			const stopping = held.record.activeSlot !== void 0 && held.record.activeSlot !== held.ownSlot ? held.record.deviceSet[held.record.activeSlot]?.key : void 0;
 			held.record = await this.store.move(this.options.profile, "taking", { handoff: {
@@ -14193,8 +14356,8 @@ var TurnKeeper = class {
 			} });
 			try {
 				await this.writeWith(held, read.conditions, {
-					...options,
-					turn
+					turn,
+					...options.slots ? { slots: options.slots } : {}
 				}, true);
 			} catch (error) {
 				if (!held.wroteNow) held.record = await this.store.move(this.options.profile, prior, {
@@ -14963,7 +15126,7 @@ var EnrollInviter = class extends Enrollment {
 				rev: 0,
 				author: 0,
 				active: 0,
-				instance: randomBytes(8),
+				instance: turnInstance(),
 				slots: granted.slots.map((slot) => slot && {
 					key: slot.key,
 					name: slot.name
@@ -15741,7 +15904,7 @@ async function planSetMove(record, signer, options = {}) {
 		author: record.ownSlot,
 		active: record.ownSlot,
 		slots: turnSlots,
-		instance: random(8)
+		instance: turnInstance(turnVerifierMark(record.verifier ?? null), random)
 	}, sign);
 	const update = {
 		d,
@@ -15964,6 +16127,21 @@ function takeoverTarget(record) {
 function canTakeOver(record) {
 	return !!record && (record.state === "standby" || record.state === "superseded") && !!record.copy;
 }
+/**
+* Whether the verifier this standby keeps is still the profile's, by the last record of the device set it knows (the
+* one just read, or the one it stored): false only when that record states the mark of another verifier. A record that
+* states none (an app from before wrote it) leaves the device with what it has, and so does this device's own record.
+* Only a standby is held to it: a device replaced by a takeover it did not want takes the turn back with the password
+* it knows, whatever the device that replaced it states.
+*/
+function verifierStands(record, latest) {
+	if (record.state !== "standby" || !record.verifier || !latest || latest.tombstone) return true;
+	const own = record.ownSlot === void 0 ? void 0 : record.deviceSet[record.ownSlot]?.key;
+	const author = latest.slots[latest.author];
+	if (own && author && bytesEqual(author.key, fromBase64Url(own))) return true;
+	const stated = turnStatedVerifier(latest.instance);
+	return !stated || bytesEqual(stated, turnVerifierMark(record.verifier));
+}
 var sameName = (a, b) => a.normalize("NFC").trim().toLocaleLowerCase() === b.normalize("NFC").trim().toLocaleLowerCase();
 /**
 * Checks the request and forces the takeover. Resolves to the keeper's outcome: `start` when this device is the active
@@ -15990,7 +16168,9 @@ async function forceTakeover(ports, request) {
 	if (record.takeoverAttempts && (record.takeoverAttempts.total > 0 || record.takeoverAttempts.recent.length)) await ports.amend({ takeoverAttempts: handoffAttemptSucceeded() });
 	const keeper = await ports.keeper();
 	if (!keeper) throw new TakeoverRefusal("offline", "Go online to take over.");
-	const outcome = await keeper.raise();
+	const outcome = await keeper.raise({ before: (latest) => {
+		if (!verifierStands(record, latest)) throw new TakeoverRefusal("changed", `The lock password was changed${target ? ` on ${target}` : ""}. Use here moves the profile with the new one.`);
+	} });
 	if (!outcome) throw new TakeoverRefusal("state", "This profile has no device set.");
 	return outcome;
 }
@@ -16079,7 +16259,7 @@ async function planOwnSet(record, ports, under) {
 		author: record.ownSlot,
 		active: record.ownSlot,
 		slots,
-		instance: random(8)
+		instance: turnInstance(turnVerifierMark(record.verifier ?? null), random)
 	}, ports.signer);
 	return {
 		d: toBase64Url(d),
@@ -16317,6 +16497,10 @@ function isHandoffVerifier(value) {
 	const v = value;
 	return !!v && typeof v === "object" && v.v === 1 && typeof v.setup === "string" && B64URL.test(v.setup) && typeof v.record === "string" && B64URL.test(v.record);
 }
+/** Loads the password proof. Throws when it cannot be loaded: nothing can then be made or checked (`provesHandoffPassword` says false). */
+async function handoffPakeReady() {
+	await opaque();
+}
 /** A verifier for this password: both halves of the registration, run on this device. */
 async function makeHandoffVerifier(password) {
 	if (!password) throw new Error("A password is needed");
@@ -19882,6 +20066,14 @@ function forgetWallet(records, id) {
 	return rest;
 }
 //#endregion
+//#region ../browser/src/shared/messageChanges.ts
+/** A row as a page gets it: without the frame a private group's message came in (`StoredMessage.frame`), which only the engine reads. */
+function withoutFrame(message) {
+	if (message.frame === void 0) return message;
+	const { frame: _frame, ...row } = message;
+	return row;
+}
+//#endregion
 //#region ../browser/src/shared/buttons.ts
 /** The buttons of a message, when it has any. */
 function messageButtons(message) {
@@ -21138,6 +21330,8 @@ function newestMessages(index, query, count) {
 		};
 	});
 }
+/** A write that waits for no disk sync of its own (in a browser, the engine's default already; on Node, the CLI's store). */
+var RELAXED = { durability: "relaxed" };
 /**
 * Durable local state of the browser peer. Identity seeds live here the same
 * way Desktop keeps them in its WebView storage: local to this profile, never
@@ -21370,12 +21564,13 @@ var db = {
 		await wrap((await store(STORES$1.messages, "readwrite")).put(message));
 	},
 	async updateDelivery(linkId, id, delivery, deliveryError, extra) {
-		const tx = (await openDb()).transaction(STORES$1.messages, "readwrite");
+		const tx = (await openDb()).transaction(STORES$1.messages, "readwrite", delivery === "sent" || delivery === "delivered" ? RELAXED : void 0);
 		const messages = tx.objectStore(STORES$1.messages);
 		const request = messages.get([linkId, id]);
 		request.onsuccess = () => {
 			const message = request.result;
 			if (!message?.delivery || message.delivery === "delivered") return;
+			if (message.delivery === delivery && message.deliveryError === deliveryError && Object.entries(extra ?? {}).every(([key, value]) => message[key] === value)) return;
 			messages.put({
 				...message,
 				...extra,
@@ -21391,10 +21586,11 @@ var db = {
 	/**
 	* Changes one message row in place, in one transaction: `change` sees the row as stored and gives the fields to
 	* set (`null`: leave it). A row that is not there is not made. Used for what the delivery states do not carry
-	* (the message's details record), on rows in any state.
+	* (the message's details record), on rows in any state. `relaxed`: for what can be made again or is only a note
+	* (a receipt's mark, the details record), written with no disk sync of its own.
 	*/
-	async patchMessage(linkId, id, change) {
-		const tx = (await openDb()).transaction(STORES$1.messages, "readwrite");
+	async patchMessage(linkId, id, change, relaxed = false) {
+		const tx = (await openDb()).transaction(STORES$1.messages, "readwrite", relaxed ? RELAXED : void 0);
 		const messages = tx.objectStore(STORES$1.messages);
 		const request = messages.get([linkId, id]);
 		let result;
@@ -21540,6 +21736,10 @@ var Reactions = class {
 	queue = Promise.resolve();
 	/** A group member's reactions taken per window (chat and member key), as a paired chat's session limits them. */
 	memberPace = /* @__PURE__ */ new Map();
+	/** Per group chat, per member: its reactions past the window, by message, waiting for room (`hold`). */
+	held = /* @__PURE__ */ new Map();
+	heldTimers = /* @__PURE__ */ new Map();
+	stopped = false;
 	/**
 	* This side's highest number per chat: read from its history the first time I react in it, then each number given
 	* out. It only has to grow, so a row deleted since leaves it too high and nothing is wrong.
@@ -21588,14 +21788,19 @@ var Reactions = class {
 	/**
 	* A reaction that came from `by` (`peer`, or a member's key), already authenticated as theirs. A message not here
 	* yet keeps it for five minutes; past the room for that sender, it is dropped (and, on a 1:1 session, not confirmed).
+	* Past `REACTION_LIMITS.receive` a window from one group member, the rest wait for the next window (`hold`): a
+	* community's catch-up hands back every reaction of a member at once, and one dropped is never handed again.
 	*/
 	receive(chat, by, reaction) {
 		if (isGroup$1(chat)) {
 			const key = `${chat}\n${by}`;
 			let pace = this.memberPace.get(key);
 			if (!pace) this.memberPace.set(key, pace = new ReactionWindow(REACTION_LIMITS.receive, REACTION_LIMITS.windowMs, () => this.now()));
-			if (!pace.take()) return Promise.resolve("dropped");
+			if (this.held.get(chat)?.has(by) || !pace.take()) return Promise.resolve(this.hold(chat, by, reaction, pace));
 		}
+		return this.take(chat, by, reaction);
+	}
+	take(chat, by, reaction) {
 		return this.run(async () => {
 			const target = await this.find(chat, reaction.id);
 			if (!target) return this.wait(chat, by, reaction);
@@ -21604,6 +21809,75 @@ var Reactions = class {
 			return "applied";
 		});
 	}
+	/**
+	* A reaction past what a group member's window takes: kept, the highest number per message, `REACTION_LIMITS.held` a
+	* group at most (the oldest go first), and taken when the window has room. The work stays what the window allows.
+	*/
+	hold(chat, by, reaction, pace) {
+		let group = this.held.get(chat);
+		if (!group) this.held.set(chat, group = /* @__PURE__ */ new Map());
+		let waiting = group.get(by);
+		if (!waiting) group.set(by, waiting = /* @__PURE__ */ new Map());
+		const known = waiting.get(reaction.id);
+		if (known && known.n >= reaction.n) return "stale";
+		waiting.delete(reaction.id);
+		waiting.set(reaction.id, reaction);
+		let count = 0;
+		for (const member of group.values()) count += member.size;
+		for (const [member, reactions] of group) {
+			if (count <= REACTION_LIMITS.held) break;
+			while (count > REACTION_LIMITS.held && reactions.size) {
+				reactions.delete(reactions.keys().next().value);
+				count--;
+			}
+			if (!reactions.size && member !== by) group.delete(member);
+		}
+		this.takeLater(chat, by, pace);
+		return waiting.has(reaction.id) ? "waiting" : "dropped";
+	}
+	takeLater(chat, by, pace) {
+		const key = `${chat}\n${by}`;
+		if (this.heldTimers.has(key) || this.stopped) return;
+		this.heldTimers.set(key, setTimeout(() => {
+			this.takeHeld(chat, by).catch(() => {});
+		}, Math.max(50, pace.wait())));
+	}
+	/** The window of a member has room again: its reactions that waited are taken, oldest first, as many as it allows. */
+	async takeHeld(chat, by) {
+		const key = `${chat}\n${by}`;
+		this.heldTimers.delete(key);
+		const group = this.held.get(chat), waiting = group?.get(by), pace = this.memberPace.get(key);
+		if (this.stopped || !group || !waiting || !pace) return;
+		for (const [id, reaction] of [...waiting]) {
+			if (this.host.believed && !this.host.believed(chat, by)) {
+				waiting.clear();
+				break;
+			}
+			if (!pace.take()) break;
+			if (waiting.get(id) !== reaction) continue;
+			waiting.delete(id);
+			await this.take(chat, by, reaction).catch(() => {});
+		}
+		if (waiting.size) {
+			this.takeLater(chat, by, pace);
+			return;
+		}
+		if (group.get(by) === waiting) group.delete(by);
+		if (!group.size) this.held.delete(chat);
+	}
+	/** The engine stops: what waits for a window is let go, and no timer is left. */
+	stop() {
+		this.stopped = true;
+		this.dropHeld();
+	}
+	dropHeld(chat) {
+		for (const [key, timer] of this.heldTimers) if (chat === void 0 || key.startsWith(`${chat}\n`)) {
+			clearTimeout(timer);
+			this.heldTimers.delete(key);
+		}
+		if (chat === void 0) this.held.clear();
+		else this.held.delete(chat);
+	}
 	/** A message was kept: the reactions that waited for it are shown now. */
 	stored(message) {
 		const list = this.waiting.get(message.linkId);
@@ -21641,6 +21915,7 @@ var Reactions = class {
 	}
 	/** A chat is gone: nothing waits for it any more, and my highest number in it is read again if it comes back. */
 	forget(chat) {
+		this.dropHeld(chat);
 		this.waiting.delete(chat);
 		this.last.delete(chat);
 	}
@@ -21699,13 +21974,16 @@ function pinOfFormerMember(pin, inRoster) {
 function mayPinIn(group) {
 	return !!group?.myKey && group.status === "active" && mayPin(group.profile, group.myKey, group.members.find((m) => m.role === "admin")?.key);
 }
-/** The row a pin names, when it is here: the row of that id (a group's), or of `peer_`/`me_` and that id, or any other. */
+/** The row a pin names, when it is here: the row of that id (a group's), or of `peer_`/`me_` and that id, or any other of a chat's. */
 async function pinnedRow(host, chat, id) {
 	if (!id) return void 0;
 	const group = isGroup(chat);
-	if (host.message) for (const rowId of group ? [id] : [`peer_${id}`, `me_${id}`]) {
-		const row = await host.message(chat, rowId);
-		if (row && replyRef(row, group) === id) return row;
+	if (host.message) {
+		for (const rowId of group ? [id] : [`peer_${id}`, `me_${id}`]) {
+			const row = await host.message(chat, rowId);
+			if (row && replyRef(row, group) === id) return row;
+		}
+		if (group) return void 0;
 	}
 	return reactionTarget(await host.messages(chat), id, group);
 }
@@ -21930,6 +22208,17 @@ var FAREWELL_RETRY_MS = 6e4;
 var FAREWELL_TOLD_MS = 6e5;
 var FAREWELL_SAY_MS = 1e4;
 /**
+* A key asking in my lobby that no commit I hold names may be a member let in by a commit I have not heard yet: a hub
+* keeps an edge to it for a moment, on which it says where it is and takes commits (`wantAhead`). At most `AHEAD_EDGES`
+* at a time, each awaited `AHEAD_WAIT_MS` and closed `AHEAD_LINGER_MS` after it came up unless a commit named the key
+* by then; the same key is not waited for again for a while (longer once its edge was up).
+*/
+var AHEAD_EDGES = 4;
+var AHEAD_WAIT_MS = 12e4;
+var AHEAD_LINGER_MS = 2e4;
+var AHEAD_RETRY_MS = 6e4;
+var AHEAD_HEARD_MS = 6e5;
+/**
 * A key asking from before the commit that took it out was there and was sent that commit: not waited for. The two
 * times are two devices' clocks (the asker's, the commit's signer's), so "before" allows this much between them:
 * a returning member whose clock runs behind the admin's is told all the same.
@@ -22062,22 +22351,23 @@ var Communities = class {
 				invited: [],
 				memberLinks: {}
 			};
-			if (this.knocking(group, live)) return [{
+			const invitation = this.knocking(group, live) ? {
+				linkId: group.joining.linkId,
+				contact: "",
+				admin: group.joining.inviter,
+				members: 0,
+				accepted: true,
+				viaLink: true,
+				stage: this.joinStage(group),
+				...this.knockingWith.get(group.id) ? { waiting: this.knockingWith.get(group.id) } : {}
+			} : void 0;
+			if (invitation && !this.keptWhileKnocking(live)) return [{
 				...base,
 				name: groupName(group.joining.name) ?? live?.session.name ?? "",
 				isAdmin: false,
 				members: [],
 				canSend: false,
-				invitation: {
-					linkId: group.joining.linkId,
-					contact: "",
-					admin: group.joining.inviter,
-					members: 0,
-					accepted: true,
-					viaLink: true,
-					stage: this.joinStage(group),
-					...this.knockingWith.get(group.id) ? { waiting: this.knockingWith.get(group.id) } : {}
-				}
+				invitation
 			}];
 			if (!live) return [];
 			const s = live.session, edges = this.host.edges(group.id);
@@ -22102,6 +22392,7 @@ var Communities = class {
 				}) } : {},
 				canSend: s.canSend,
 				...s.picture ? { picture: s.picture } : {},
+				...invitation ? { invitation } : {},
 				community: {
 					hub: live.hub,
 					hubs: hubs.length,
@@ -22169,6 +22460,13 @@ var Communities = class {
 	knocking(group, live) {
 		return !!group.joining && (!live || live.session.status !== "active");
 	}
+	/**
+	* Someone removed keeps the group as it was here while it knocks to get back in, and when it gives up (`decline`).
+	* Not a session whose admission lost a race: that knock is still its join.
+	*/
+	keptWhileKnocking(live) {
+		return live?.session.status === "removed";
+	}
 	/** `check`: a member, as far as this device knows, asking the door whether it still is (`joinByLink`). */
 	async startJoining(link, seedB64, since, check = false) {
 		this.lastKnock.delete(link.g);
@@ -22340,11 +22638,14 @@ var Communities = class {
 	}
 	/**
 	* A join through the link that no member answered yet, given up: listed as an invitation, it is declined as one.
-	* A member trying to get back in (its session lost) leaves instead, which keeps nothing either.
+	* Someone removed who knocked to get back in only stops knocking: the group and its history stay here, as a private
+	* group's do for someone removed, invited again, who declines. A member trying to get back in (its session lost)
+	* leaves instead, which keeps nothing.
 	*/
 	async decline(groupId) {
 		const group = this.stored.get(groupId), live = this.live.get(groupId);
 		if (!group || !this.knocking(group, live)) throw new Error("No invitation to decline");
+		if (this.keptWhileKnocking(live)) return this.endCheck(group);
 		if (live) throw new Error("You were in this group: leave it to stop trying to get back in");
 		await this.forget(groupId);
 	}
@@ -22401,6 +22702,7 @@ var Communities = class {
 					await this.publishBeacon(group.id, live, now, false).catch(() => {});
 				}
 				live.farewells.clear();
+				live.ahead.clear();
 				await this.reconcile(group.id, live, now);
 				continue;
 			}
@@ -22494,6 +22796,7 @@ var Communities = class {
 			if (this.leftItself(live, h.key) ? h.ts - FAREWELL_SKEW_MS > out : h.ts + FAREWELL_SKEW_MS > out) this.wantFarewell(groupId, live, h.key, now);
 		}
 		this.endFarewells(live, now);
+		this.endAhead(groupId, live, now);
 		if (live.hub) {
 			const busy = this.admitting(groupId, live, now);
 			if (s.state.pendingLeaves.some((r) => r.s !== me && this.recentHub(live, r.s))) live.lobbyBusyUntil = Math.max(live.lobbyBusyUntil, now + this.timings.lobbyBusyMs);
@@ -22572,8 +22875,9 @@ var Communities = class {
 		}
 		await this.keepLooking(groupId, live, now);
 		for (const [key, since] of live.pendingEntries) {
-			const linkId = this.host.entries(groupId).get(key);
-			if (!(!!linkId && this.host.linkReady(linkId, 2)) && now - since > ENTRY_UNANSWERED_MS) live.pendingEntries.delete(key);
+			const linkId = this.host.entries(groupId).get(key), up = !!linkId && this.host.linkReady(linkId, 2);
+			const elsewhere = rosterHas(s.roster, key) && since < this.addedAt(s, key) + this.timings.knockFallbackMs;
+			if (!up && (elsewhere || now - since > ENTRY_UNANSWERED_MS)) live.pendingEntries.delete(key);
 			else if (now - since > ENTRY_TIMEOUT_MS$1) {
 				live.pendingEntries.delete(key);
 				this.refused.set(key, now + REFUSED_FOR_MS$1);
@@ -22632,7 +22936,7 @@ var Communities = class {
 		const edges = this.host.edges(groupId);
 		if (now - live.beaconAt <= 2 * this.timings.beaconReadMs) {
 			const hubs = new Set(freshHubs(this.hubs(live), now).map((h) => h.key));
-			for (const [key, id] of edges) if (!hubs.has(key) && !live.members.has(key) && this.host.linkReady(id, 2) && !this.gone(live, key)) live.members.set(key, now);
+			for (const [key, id] of edges) if (!hubs.has(key) && !live.members.has(key) && this.host.linkReady(id, 2) && rosterHas(live.session.roster, key) && !this.gone(live, key)) live.members.set(key, now);
 			for (const key of [...live.members.keys()]) if (hubs.has(key)) live.members.delete(key);
 		}
 		for (const [key, since] of live.members) {
@@ -22770,16 +23074,21 @@ var Communities = class {
 		for (let i = chain.length - 1; i >= 0; i--) if ((chain[i].k === "leave" || chain[i].k === "remove") && chain[i].s === key) return chain[i].k === "leave";
 		return false;
 	}
-	/** A frame goes on an edge to a member; to someone the chain took out, only the commit that took it out. */
-	mayHear(live, key, frame) {
-		if (!live?.session.wasRemoved(key)) return true;
+	/**
+	* A frame goes on an edge to a member; to someone the chain took out, only the commit that took it out. What the
+	* group says (`said`: a frame of mine for everyone, or one a hub relays) goes to the members of the roster only:
+	* a key no commit names hears none of it, and one let in on a branch that lost hears the commits.
+	*/
+	mayHear(live, key, frame, said = false) {
 		const f = frame;
-		return f.t === "group-commit" && (f.commit?.k === "remove" || f.commit?.k === "leave") && f.commit.s === key;
+		if (live?.session.wasRemoved(key)) return f.t === "group-commit" && (f.commit?.k === "remove" || f.commit?.k === "leave") && f.commit.s === key;
+		if (!live || !said || rosterHas(live.session.roster, key)) return true;
+		return f.t === "group-commit" && live.session.isRecentMember(key);
 	}
-	/** The edges of the group that may hear `frame`. */
+	/** The edges of the group that may hear `frame`, said to everyone. */
 	hearers(groupId, frame) {
 		const live = this.live.get(groupId);
-		return [...this.host.edges(groupId)].filter(([key]) => this.mayHear(live, key, frame));
+		return [...this.host.edges(groupId)].filter(([key]) => this.mayHear(live, key, frame, true));
 	}
 	/** As a hub: someone the chain took out is asking (in my lobby, or listing itself as a hub). An edge to tell it, within bounds. */
 	wantFarewell(groupId, live, key, now) {
@@ -22800,6 +23109,34 @@ var Communities = class {
 		for (const [key, at] of live.farewellSaid) if (now - at >= FAREWELL_SAY_MS) live.farewellSaid.delete(key);
 	}
 	/**
+	* As a hub: a key no commit I hold names is asking in my lobby. It may be a member ahead of me on the roster, who needs
+	* the edge for me to find out (its answer to my `group-sync` carries the commit); or nobody, since whoever was once
+	* given the group's rendezvous secret can write a key there. An edge, within bounds, that is no member's: it takes
+	* no place among my members, and nothing the group says goes on it (`mayHear`).
+	*/
+	wantAhead(groupId, live, key, now) {
+		if (live.ahead.has(key) || now < (live.aheadQuiet.get(key) ?? 0)) return;
+		if (live.ahead.size >= AHEAD_EDGES || this.capacity(groupId, live, now) <= 0) return;
+		live.ahead.set(key, { since: now });
+		if (!this.host.edges(groupId).has(key)) live.expect.add(key);
+	}
+	/** Those edges end: a commit named the key (a member of mine now, or out), it never came, or its moment is over; and a hub no more keeps none. */
+	endAhead(groupId, live, now) {
+		const edges = this.host.edges(groupId);
+		for (const [key, a] of live.ahead) {
+			const member = rosterHas(live.session.roster, key), named = member || live.session.wasRemoved(key);
+			if (!named && live.hub) {
+				const id = edges.get(key);
+				if (!a.up && id && this.host.linkReady(id, 2)) a.up = now;
+				if (a.up ? now - a.up < AHEAD_LINGER_MS : now - a.since < AHEAD_WAIT_MS) continue;
+			}
+			live.ahead.delete(key);
+			if (!named) live.aheadQuiet.set(key, now + (a.up ? AHEAD_HEARD_MS : AHEAD_RETRY_MS));
+			else if (member && live.hub && live.members.size < this.capacity(groupId, live, now)) live.members.set(key, now);
+		}
+		for (const [key, until] of live.aheadQuiet) if (until <= now) live.aheadQuiet.delete(key);
+	}
+	/**
 	* Someone the chain took out says where it is (`group-sync`): it is handed the commits up to the one that took it
 	* out, and nothing else (`CommunitySession.farewell`). Nothing else it says is heard.
 	*/
@@ -22863,6 +23200,10 @@ var Communities = class {
 				if (ts + FAREWELL_SKEW_MS > (live.session.outAt(key) ?? Infinity)) this.wantFarewell(groupId, live, key, now);
 				continue;
 			}
+			if (!rosterHas(live.session.roster, key)) {
+				this.wantAhead(groupId, live, key, now);
+				continue;
+			}
 			live.emptySince = now;
 			if (!live.members.has(key) && live.members.size >= this.capacity(groupId, live, now)) continue;
 			if (!live.members.has(key)) {
@@ -22883,6 +23224,7 @@ var Communities = class {
 				for (const h of freshHubs(this.hubs(live), now)) if (h.key !== s.myKey && !this.hubDead(groupId, live, h, now)) wanted.add(h.key);
 				for (const key of live.members.keys()) wanted.add(key);
 				for (const key of live.farewells.keys()) wanted.add(key);
+				for (const key of live.ahead.keys()) wanted.add(key);
 			} else for (const key of live.myHubs) wanted.add(key);
 			for (const [key, id] of existing) if (this.host.linkReady(id, 2) && (live.members.has(key) || this.recentHub(live, key)) && !s.wasRemoved(key)) wanted.add(key);
 		}
@@ -23003,8 +23345,7 @@ var Communities = class {
 			if (now - ts > 18e4 || this.refused.has(key) || live.pendingEntries.has(key) || key === link.host || key === s.myKey) continue;
 			const stillKnocking = now - ts < 2 * this.timings.slowKnockMs;
 			if (rosterHas(s.roster, key)) {
-				const added = [...s.state.chain].reverse().find((c) => c.k === "add" && c.s === key)?.ts ?? 0;
-				if (!stillKnocking || ts < added + this.timings.knockFallbackMs) continue;
+				if (!stillKnocking || ts < this.addedAt(s, key) + this.timings.knockFallbackMs) continue;
 			}
 			const seen = live.knocksSeen.get(key);
 			const changed = !!seen && seen.doors !== doorSig;
@@ -23034,6 +23375,10 @@ var Communities = class {
 		}
 		for (const [key, { first }] of live.knocksSeen) if (now - first > 36e4) live.knocksSeen.delete(key);
 	}
+	/** When the chain last added this member (0: never). */
+	addedAt(s, key) {
+		return [...s.state.chain].reverse().find((c) => c.k === "add" && c.s === key)?.ts ?? 0;
+	}
 	/** Leave requests: the door commits them (see `answerKnocks`); any hub after a while. */
 	async commitLeaves(live, otherHubs, now) {
 		const s = live.session;
@@ -23280,6 +23625,7 @@ var Communities = class {
 			if (f.t === "group-sync" && live.session.isMember) this.sayFarewell(groupId, live, peerKey, f);
 			return;
 		}
+		if (!live.session.isRecentMember(peerKey) && f.t !== "group-commit" && f.t !== "group-msg" && f.t !== "group-secrets" && !(f.t === "group-secret" && f.to === live.session.myKey)) return;
 		if ((f.t === "group-secret" || f.t === "group-entry") && typeof f.to === "string" && f.to !== live.session.myKey) {
 			if (!live.hub) return;
 			const id = `${String(f.t)}:${f.to}:${String(f.h ?? f.x)}`;
@@ -23334,7 +23680,7 @@ var Communities = class {
 	edgeReady(groupId, peerKey, linkId) {
 		const live = this.live.get(groupId);
 		if (!live || live.session.wasRemoved(peerKey)) return;
-		if (live.hub && !this.peerIsHub(live, peerKey)) live.members.set(peerKey, this.now());
+		if (live.hub && !this.peerIsHub(live, peerKey) && rosterHas(live.session.roster, peerKey)) live.members.set(peerKey, this.now());
 		this.sendTo(linkId, live.session.syncFrame());
 		this.host.emit();
 	}
@@ -23449,6 +23795,8 @@ var Communities = class {
 			farewells: /* @__PURE__ */ new Map(),
 			farewellQuiet: /* @__PURE__ */ new Map(),
 			farewellSaid: /* @__PURE__ */ new Map(),
+			ahead: /* @__PURE__ */ new Map(),
+			aheadQuiet: /* @__PURE__ */ new Map(),
 			knocksScanned: false,
 			knockCursor: 0,
 			lastShardPoll: 0,
@@ -24445,8 +24793,8 @@ function eventTime(taken, groupId, timestamp) {
 var arrivalNow = (tick) => Math.max(tick, Date.now());
 /**
 * Keeps on the group's record when a member's message came, where that is later than what it holds: the record is
-* saved with the session right after (a message taken moves its state), so a message handed to me late still makes
-* the group unread after the app starts again. Read from the history alone, by its own time, it sorted among what I
+* saved with the session soon after (a message taken moves its state, saved within `GROUP_LIMITS.saveWithinMs` and when
+* the app stops), so a message handed to me late still makes the group unread after the app starts again. Read from the history alone, by its own time, it sorted among what I
 * had read and the mark was gone on the next start.
 */
 function noteCame(group, came, peer, mentioned) {
@@ -24497,6 +24845,8 @@ var ENTRY_RELEASE_MS = 2e3;
 var REMOVED_LINGER_MS = 15e3;
 /** How long the tombstone of a group I left waits for the admin to hear it. */
 var LEFT_KEPT_MS = 6048e5;
+/** Admin side: how long a contact invited over its chat is waited for. After, it holds no place and may be invited again. */
+var INVITED_KEPT_MS = LEFT_KEPT_MS;
 /**
 * Invitee side: an accept the admin has not answered with a welcome is said again this often while the inviter's chat
 * is up, and at once when it comes up, at most `ACCEPT_AGAINS` times each time it does (its app may have restarted).
@@ -24517,6 +24867,13 @@ function invitationClaims(frame) {
 var FAREWELL_ANSWERS = 3;
 /** Commits sent to a removed member that was behind when it left, at most. */
 var FAREWELL_COMMITS = 64;
+/**
+* A member whose messages were just asked of another (`Groups.askOf`) is told where I am only once that one's answer
+* has come: no message from it for this long, or `MESH_SYNC_HOLD_MAX_MS` after it was asked. Told at once, its own
+* answer raced the other's, which holds the same messages among everyone's in the order they were written, and a
+* member back in a group of five read each member's lines apart, the newest above older ones (WISP 902 § Catch-up).
+*/
+var MESH_SYNC_HOLD_MS = 1500;
 /** Where a member's gossip turns start among the members it is connected to: a number of its own, from its key. */
 var gossipStart = (key) => {
 	let n = 0;
@@ -24574,6 +24931,8 @@ var Groups = class {
 	timings;
 	stored = /* @__PURE__ */ new Map();
 	sessions = /* @__PURE__ */ new Map();
+	/** Per private group, the rows that hold the frame their message came in (`StoredMessage.frame`), oldest first, and what each counts for. */
+	framesKept = /* @__PURE__ */ new Map();
 	/** Contacts (chat ids, kept in `StoredGroup.invited`) and entry sessions I invited to each group, until they answer. */
 	invited = /* @__PURE__ */ new Map();
 	/** Invitee side: when my accept of each invitation was last said, how many times since the inviter's chat came up, and whether it was down. */
@@ -24619,6 +24978,13 @@ var Groups = class {
 	* time, not of everyone whose edge opens, so a member coming back is not sent the same messages by every other.
 	*/
 	relayAsked = /* @__PURE__ */ new Map();
+	/**
+	* Per mesh group, the members whose edge opened while their messages were being handed on by another (`holdSync`):
+	* whom, and when it was asked. Their sync goes once that answer has come.
+	*/
+	syncHeld = /* @__PURE__ */ new Map();
+	/** Per mesh group and member, when a message last came over its edge (its own, or one it handed on). */
+	lastHanded = /* @__PURE__ */ new Map();
 	lastGossip = /* @__PURE__ */ new Map();
 	/**
 	* Per mesh group, each reachable member some of whose messages never reached me (`GroupSession.lacking`): what was
@@ -24626,6 +24992,11 @@ var Groups = class {
 	* holds any more are not asked for every gossip turn. `last`: the latest ask, its member and the numbers it named.
 	*/
 	gapsAsked = /* @__PURE__ */ new Map();
+	/**
+	* Per mesh group and member, per epoch: the number up to which nobody holds what never reached me (`gapsSettle`).
+	* The member list stops counting those; they are still asked of a member that connects later.
+	*/
+	gapsGone = /* @__PURE__ */ new Map();
 	/** Per mesh group, when `gapsAgain` last looked: every half `MESH_GAP_AGAIN_MS`, not every tick. */
 	gapsLooked = /* @__PURE__ */ new Map();
 	/** Per mesh group: member key → since when its edge to me is down, and when someone last told me it is here. */
@@ -24653,6 +25024,8 @@ var Groups = class {
 	removedAt = /* @__PURE__ */ new Map();
 	/** Who is typing in each private group, and this side's word there (WISP 902 · Group Mesh § Typing). */
 	typings;
+	/** A member's pins taken per window in a private group (group and member key). */
+	pinPaces = /* @__PURE__ */ new Map();
 	/** Edge signaling through members (WISP 902 · Group Mesh § Signaling through members). */
 	signals;
 	/** Files and voice messages in every group, private or community (WISP 503 · Group Files). */
@@ -24696,6 +25069,10 @@ var Groups = class {
 			this.communities.files = this.files;
 		}
 	}
+	/** Writes what the private groups' sessions still have to save (`GROUP_LIMITS.saveWithinMs`): the app is stopping. */
+	async flush() {
+		await Promise.allSettled([...this.sessions.values()].map((session) => session.flush()));
+	}
 	/** `asItIs`: a copy that must stay as it was stored (limited mode, WISP 06), so nothing left over is cleared from it. */
 	async load(asItIs = false) {
 		const all = await this.store.getGroups();
@@ -24705,6 +25082,10 @@ var Groups = class {
 			if (group.state) this.attach(group.state);
 			if (group.invited) this.invited.set(group.id, new Set(Object.keys(group.invited)));
 			const history = await this.store.getMessages(MESSAGE_LINK(group.id)), said = history.filter((m) => !m.event && !m.groupPay);
+			this.framesKept.set(group.id, history.filter((m) => m.frame).map((m) => ({
+				id: m.id,
+				bytes: frameBytes(m.frame)
+			})));
 			const last = said[said.length - 1], lastPeer = [...said].reverse().find((m) => m.sender !== "me");
 			if (last) this.lastMessageAt.set(group.id, last.timestamp);
 			const peerAt = cameOrWritten(lastPeer?.timestamp, lastPeer ? group.came?.peer : void 0);
@@ -24718,6 +25099,13 @@ var Groups = class {
 		if (!asItIs) await this.files?.sweep(all.map((g) => g.id));
 		for (const group of this.stored.values()) for (const [, linkId] of this.host.entries(group.id)) if (!group.invitation?.entry || group.invitation.linkId !== linkId) await this.host.closeEdge(linkId);
 	}
+	/** The pins taken per window from one member's edge in a private group, as a paired chat's session limits them. */
+	pinPace(groupId, member) {
+		const key = `${groupId}\n${member}`;
+		let pace = this.pinPaces.get(key);
+		if (!pace) this.pinPaces.set(key, pace = new ReactionWindow(PIN_LIMITS.receive, PIN_LIMITS.windowMs));
+		return pace;
+	}
 	/** A group's pin now (WISP 400 § Pinned message), the latest one taken, unpinned or not. */
 	pinOf(groupId) {
 		return this.record(groupId)?.pin;
@@ -24773,6 +25161,7 @@ var Groups = class {
 						admin: invitation.admin,
 						members: Math.min(Math.max(invitation.n, 0), GROUP_MEMBER_CAP.max),
 						accepted: !!invitation.seedB64,
+						...this.acceptSaid.get(group.id)?.unanswered ? { unanswered: true } : {},
 						...invitation.entry ? {
 							viaLink: true,
 							stage: this.joinStage(group)
@@ -24814,7 +25203,7 @@ var Groups = class {
 						...viaHub ? { viaHub } : {},
 						...hubKeys.has(key) ? { hub: true } : {},
 						...hubRole ? { hubRole } : {},
-						missing: session.missing(key)
+						missing: session.missing(key, this.gapsGone.get(group.id)?.get(key)?.[session.epoch])
 					};
 				})
 			};
@@ -24919,6 +25308,22 @@ var Groups = class {
 		await this.store.putGroup(group);
 		this.host.emit();
 	}
+	/**
+	* Admin side: the invitations still unanswered are taken back, each over the contact chat it went on, when the group
+	* goes from this app or the role from me: nobody here could let them in. A chat that is down hears it as the answer
+	* to its accept. Entry sessions are not told: they close with the group, or the new admin answers the next knock.
+	*/
+	takeBack(groupId, group) {
+		const entries = new Set(this.host.entries(groupId).values());
+		for (const linkId of this.invited.get(groupId) ?? []) if (!entries.has(linkId)) try {
+			this.host.sendOnLink(linkId, {
+				t: "group-decline",
+				g: groupId
+			});
+		} catch {}
+		this.invited.delete(groupId);
+		if (group) delete group.invited;
+	}
 	/** Admin side: a contact chat answered its invitation (accepted or declined); false when it had none. */
 	answered(group, linkId) {
 		const had = !!this.invited.get(group.id)?.delete(linkId);
@@ -24927,6 +25332,14 @@ var Groups = class {
 		group.invited = Object.keys(rest).length ? rest : void 0;
 		return true;
 	}
+	/** Admin side: a contact whose answer did not come in `INVITED_KEPT_MS` (a decline lost on the way, an app gone) is not waited for any more. */
+	async ageInvited(group, now) {
+		const stale = Object.entries(group.invited).filter(([, at]) => now - at > INVITED_KEPT_MS);
+		if (!stale.length) return;
+		for (const [linkId] of stale) this.answered(group, linkId);
+		await this.store.putGroup(group);
+		this.host.emit();
+	}
 	async accept(groupId) {
 		const group = this.stored.get(groupId);
 		if (!group?.invitation) throw new Error("No invitation to accept");
@@ -24953,19 +25366,56 @@ var Groups = class {
 		if (this.isCommunity(groupId)) return this.communities.decline(groupId);
 		const group = this.stored.get(groupId);
 		if (!group?.invitation) throw new Error("No invitation to decline");
-		try {
-			this.host.sendOnLink(group.invitation.linkId, {
-				t: "group-decline",
-				g: groupId
-			});
-		} catch {}
+		if (!group.previous) return this.forget(groupId);
+		await this.dropInvitation(group, this.sayDecline(groupId, group.invitation.linkId));
+	}
+	/** An invitation goes from the list: declined here (`owed`: the answer, when it could not be sent), or taken back by who sent it. */
+	async dropInvitation(group, owed) {
 		const previous = group.previous;
-		if (!previous) return this.forget(groupId);
-		this.stored.set(groupId, previous);
+		if (!previous) return this.forget(group.id, false);
+		if (owed) previous.declined = owed;
+		else delete previous.declined;
+		this.acceptSaid.delete(group.id);
+		this.stored.set(group.id, previous);
 		if (previous.state) this.attach(previous.state);
 		await this.store.putGroup(previous);
 		this.host.emit();
 	}
+	/** Invitee side: says no to an invitation. With the inviter's chat down (its app is closed, say), returns the answer owed, said when that chat is next up. */
+	sayDecline(groupId, linkId) {
+		try {
+			this.host.sendOnLink(linkId, {
+				t: "group-decline",
+				g: groupId
+			});
+			return;
+		} catch {
+			return {
+				at: Date.now(),
+				linkId
+			};
+		}
+	}
+	/** Invitee side: a decline its inviter's chat was down for is said once that chat is up, or dropped after `LEFT_KEPT_MS`. */
+	async declineOwed(group, now) {
+		const { at, linkId } = group.declined;
+		if (now - at <= LEFT_KEPT_MS) {
+			if (!this.host.linkReady(linkId)) return;
+			try {
+				this.host.sendOnLink(linkId, {
+					t: "group-decline",
+					g: group.id
+				});
+			} catch {
+				return;
+			}
+		}
+		if (this.stored.get(group.id) !== group) return;
+		delete group.declined;
+		if (group.state) return this.store.putGroup(group);
+		this.stored.delete(group.id);
+		await this.store.deleteGroup(group.id);
+	}
 	/**
 	* Sends a text; `messageId` is the id it is kept under here (what history, replies and reactions name). `forwarded`:
 	* the hop count of a forwarded text (WISP 902 § Forwards). `card`: a checked status card, the text its fallback.
@@ -25030,6 +25480,15 @@ var Groups = class {
 		if (!groupOfFile(fileId, [...this.stored.keys(), ...this.communities.ids()]) || !this.files) throw new Error("No such file");
 		return this.files.download(fileId);
 	}
+	/** The person stops a group's file that is coming or would be fetched (Cancel, Decline), or pauses it (`keep`). */
+	haltFile(fileId, keep = false) {
+		if (!groupOfFile(fileId, [...this.stored.keys(), ...this.communities.ids()]) || !this.files) throw new Error("No such file");
+		return this.files.halt(fileId, keep);
+	}
+	/** Automatic downloads were turned off: the groups' files chosen by themselves and not here yet stop coming. */
+	autoDownloadsOff() {
+		return this.files?.autoDownloadsOff() ?? Promise.resolve();
+	}
 	/** An edge's files/3 session opened or closed (WISP 503: the bytes of a group's files go over it). */
 	fileSession(groupId, peerKey, linkId, open) {
 		this.files?.session(groupId, peerKey, linkId, open);
@@ -25107,8 +25566,7 @@ var Groups = class {
 			...bye ? { bye } : {}
 		};
 		delete group.entry;
-		delete group.invited;
-		this.invited.delete(groupId);
+		this.takeBack(groupId, group);
 		this.pendingEntries.delete(groupId);
 		this.welcomed.delete(groupId);
 		this.lingering.delete(groupId);
@@ -25275,8 +25733,14 @@ var Groups = class {
 		farewell.told ??= this.now();
 		this.store.putGroup(group).catch(() => {});
 	}
-	makeAdmin(groupId, key) {
-		return this.isCommunity(groupId) ? this.communities.makeAdmin(groupId, key) : this.session(groupId).transferAdmin(key);
+	async makeAdmin(groupId, key) {
+		if (this.isCommunity(groupId)) return this.communities.makeAdmin(groupId, key);
+		await this.session(groupId).transferAdmin(key);
+		const group = this.stored.get(groupId);
+		if (!group || !this.invited.get(groupId)?.size) return;
+		this.takeBack(groupId, group);
+		await this.store.putGroup(group);
+		this.host.emit();
 	}
 	/**
 	* The admin pins a member of a private group as a hub, excludes one from being a hub, or leaves it to the member's
@@ -25300,7 +25764,8 @@ var Groups = class {
 		if (this.isCommunity(groupId)) return this.communities.rename(groupId, name);
 		await this.session(groupId).rename(name);
 	}
-	async forget(groupId) {
+	/** `answer`: false when an invitation goes because its inviter took it back, so no decline is said for it. */
+	async forget(groupId, answer = true) {
 		if (this.isCommunity(groupId)) return this.communities.leave(groupId);
 		const session = this.sessions.get(groupId);
 		if (session?.status === "active") try {
@@ -25308,13 +25773,16 @@ var Groups = class {
 		} catch (e) {
 			if (session.isAdmin && session.others.length) throw e;
 		}
+		const gone = this.stored.get(groupId), invitation = answer && gone?.invitation && !gone.invitation.entry ? gone.invitation : void 0;
+		const owed = invitation && this.sayDecline(groupId, invitation.linkId);
 		this.sessions.delete(groupId);
 		this.stored.delete(groupId);
-		this.invited.delete(groupId);
+		this.takeBack(groupId);
 		this.acceptSaid.delete(groupId);
 		this.lastRoster.delete(groupId);
 		this.lastTold.delete(groupId);
 		this.pendingEntries.delete(groupId);
+		this.framesKept.delete(groupId);
 		this.knocked.delete(groupId);
 		this.knockCheckAt.delete(groupId);
 		this.knockRewrites.delete(groupId);
@@ -25322,18 +25790,31 @@ var Groups = class {
 		this.welcomed.delete(groupId);
 		this.lingering.delete(groupId);
 		this.relayAsked.delete(groupId);
+		this.syncHeld.delete(groupId);
+		this.lastHanded.delete(groupId);
 		this.hubs.forget(groupId);
 		this.removedAt.delete(groupId);
 		this.lastGossip.delete(groupId);
 		this.gapsAsked.delete(groupId);
+		this.gapsGone.delete(groupId);
 		this.gapsLooked.delete(groupId);
 		this.typings.forget(groupId);
+		for (const key of this.pinPaces.keys()) if (key.startsWith(`${groupId}\n`)) this.pinPaces.delete(key);
 		this.downSince.delete(groupId);
 		this.hereHeard.delete(groupId);
 		this.hereActed.delete(groupId);
 		this.signals.forget(groupId);
 		for (const linkId of [...this.host.edges(groupId).values(), ...this.host.entries(groupId).values()]) await this.host.closeEdge(linkId);
 		await this.store.deleteGroup(groupId);
+		if (owed && !this.stored.has(groupId)) {
+			const tombstone = {
+				id: groupId,
+				createdAt: gone.createdAt,
+				declined: owed
+			};
+			this.stored.set(groupId, tombstone);
+			await this.store.putGroup(tombstone);
+		}
 		await this.files?.drop(groupId);
 		this.host.historyGone?.(groupId);
 		this.host.membersChanged?.(groupId);
@@ -25426,6 +25907,10 @@ var Groups = class {
 					if (now - group.left.at > LEFT_KEPT_MS) await this.forget(group.id);
 					continue;
 				}
+				if (group.declined) {
+					await this.declineOwed(group, now);
+					if (!group.state) continue;
+				}
 				if (group.invitation?.entry && !group.state) {
 					const every = now - group.createdAt > this.timings.patienceMs ? this.timings.slowKnockMs : this.timings.knockMs;
 					if (!(this.host.linkReady(group.invitation.linkId) || !!this.host.linkSeen?.(group.invitation.linkId)) && (now - (this.lastKnock.get(group.id) ?? 0) >= every || now >= (this.knockCheckAt.get(group.id) ?? Infinity))) await this.knock(group, now).catch(() => {});
@@ -25436,6 +25921,7 @@ var Groups = class {
 					continue;
 				}
 				const session = this.sessions.get(group.id);
+				if (group.invited) await this.ageInvited(group, now);
 				if (!group.entry || !session) continue;
 				if (!session.isAdmin) {
 					await this.disableLink(group.id);
@@ -25511,6 +25997,13 @@ var Groups = class {
 			});
 			return;
 		}
+		if (said.n >= ACCEPT_AGAINS && !said.down && !said.unanswered && !invitation.entry && now - said.at >= ACCEPT_AGAIN_MS) {
+			this.acceptSaid.set(group.id, {
+				...said,
+				unanswered: true
+			});
+			this.host.emit();
+		}
 		if (said.n >= ACCEPT_AGAINS || !said.down && now - said.at < ACCEPT_AGAIN_MS) return;
 		try {
 			this.host.sendOnLink(invitation.linkId, {
@@ -25523,7 +26016,8 @@ var Groups = class {
 		}
 		this.acceptSaid.set(group.id, {
 			at: now,
-			n: said.n + 1
+			n: said.n + 1,
+			...said.unanswered && { unanswered: true }
 		});
 	}
 	/** An entry session came up with groups on both sides: the admin's side invites over it. */
@@ -25760,7 +26254,16 @@ var Groups = class {
 			}
 			case "group-accept": {
 				const session = this.sessions.get(g);
-				if (!session?.isAdmin || !this.invited.get(g)?.has(linkId) || typeof frame.key !== "string" || !MEMBER_KEY.test(frame.key)) return;
+				if (typeof frame.key !== "string" || !MEMBER_KEY.test(frame.key)) return;
+				if (!session?.isAdmin || !this.invited.get(g)?.has(linkId)) {
+					if (!(!!session && rosterHas(session.roster, frame.key) && this.stored.get(g)?.contacts?.[frame.key] === linkId) && ![...this.host.entries(g).values()].includes(linkId)) try {
+						this.host.sendOnLink(linkId, {
+							t: "group-decline",
+							g
+						});
+					} catch {}
+					return;
+				}
 				const group = this.stored.get(g);
 				if (frame.key === session.myKey || rosterHas(session.roster, frame.key)) return;
 				const entryPeer = this.hostEntry(g, linkId);
@@ -25794,6 +26297,11 @@ var Groups = class {
 				return;
 			}
 			case "group-decline": {
+				const mine = this.stored.get(g);
+				if (mine?.invitation && !mine.invitation.entry && !mine.state && mine.invitation.linkId === linkId) {
+					await this.dropInvitation(mine);
+					return;
+				}
 				const entryPeer = this.hostEntry(g, linkId);
 				if (entryPeer) {
 					this.pendingEntries.get(g)?.delete(entryPeer);
@@ -25956,11 +26464,18 @@ var Groups = class {
 			return;
 		}
 		if (t === "group-pin") {
+			const said = this.pinPace(groupId, peerKey).take() ? readPin(frame) : null;
+			if (!said || !pinIsNewer(this.record(groupId)?.pin, said)) return;
 			const signed = session.signedPin(frame);
 			if (signed && rosterHas(session.roster, peerKey)) await this.host.groupPin?.(groupId, peerKey, signed);
 			return;
 		}
 		const taken = await session.handle(peerKey, frame);
+		if (taken.some((f) => f.t === "group-msg")) {
+			let handed = this.lastHanded.get(groupId);
+			if (!handed) this.lastHanded.set(groupId, handed = /* @__PURE__ */ new Map());
+			handed.set(peerKey, this.now());
+		}
 		if (taken.length) this.hubs.passOn(groupId, session, peerKey, taken);
 	}
 	/**
@@ -26032,7 +26547,7 @@ var Groups = class {
 		const large = this.host.linkReady(linkId, 3) && this.markLarge(group, peerKey);
 		const legacy = this.hubs.enabled && this.hubs.edgeReady(groupId, session, group, peerKey, this.host.linkReady(linkId, 4), this.now());
 		if (large || legacy) this.store.putGroup(group).catch(() => {});
-		try {
+		if (!this.holdSync(groupId, peerKey)) try {
 			this.host.sendOnLink(linkId, session.syncFrame(this.askOf(groupId, session, peerKey)));
 		} catch {
 			return;
@@ -26155,11 +26670,55 @@ var Groups = class {
 			});
 			out.push(key);
 		}
-		out.push(...this.gapsOf(groupId, session, via, session.lacking()));
+		const lacking = session.lacking();
+		out.push(...this.gapsOf(groupId, session, via, lacking));
+		this.ownGap(groupId, via, lacking);
 		if (out.length) this.lastGossip.set(groupId, now);
 		return out;
 	}
 	/**
+	* Whether the answer of the member asked for someone's messages may still be coming: its edge up, asked under
+	* `MESH_SYNC_HOLD_MAX_MS` ago, and a message from it (or the asking) under `MESH_SYNC_HOLD_MS` ago.
+	*/
+	answering(groupId, { via, at }, now) {
+		const edge = this.host.edges(groupId).get(via);
+		if (!edge || !this.host.linkReady(edge) || now - at >= 1e4) return false;
+		return now - Math.max(at, this.lastHanded.get(groupId)?.get(via) ?? 0) < MESH_SYNC_HOLD_MS;
+	}
+	/**
+	* Whether the sync to a member whose edge just opened waits (`heldSyncs` sends it): its messages were asked of
+	* another member a moment ago, and that answer holds them among everyone's in the order they were written. Its own
+	* answer now would bring the same messages on their own, ahead of or behind the others' lines.
+	*/
+	holdSync(groupId, peerKey) {
+		const asked = this.relayAsked.get(groupId)?.get(peerKey);
+		if (!asked || asked.via === peerKey || !this.answering(groupId, asked, this.now())) {
+			this.syncHeld.get(groupId)?.delete(peerKey);
+			this.relayAsked.get(groupId)?.delete(peerKey);
+			return false;
+		}
+		let held = this.syncHeld.get(groupId);
+		if (!held) this.syncHeld.set(groupId, held = /* @__PURE__ */ new Map());
+		held.set(peerKey, { ...asked });
+		return true;
+	}
+	/** The syncs that waited for another member's answer (`holdSync`), once it has come: for what it did not hand on. */
+	heldSyncs(groupId, session, now) {
+		const held = this.syncHeld.get(groupId);
+		if (!held?.size) return;
+		const edges = this.host.edges(groupId);
+		for (const [key, asked] of held) {
+			if (this.answering(groupId, asked, now)) continue;
+			held.delete(key);
+			if (this.relayAsked.get(groupId)?.get(key)?.via === asked.via) this.relayAsked.get(groupId).delete(key);
+			const edge = edges.get(key);
+			if (!edge || !this.host.linkReady(edge) || !rosterHas(session.roster, key)) continue;
+			try {
+				this.host.sendOnLink(edge, session.syncFrame(this.askOf(groupId, session, key)));
+			} catch {}
+		}
+	}
+	/**
 	* Reachable members whose messages below the highest seen never reached me, for `via` to hand on: their own answer
 	* comes from their last `GROUP_LIMITS.outlog` only (WISP 902 § Catch-up), the rest another member may hold. As
 	* `askOf`, one member at a time, and each member once until what is missing changes.
@@ -26189,6 +26748,7 @@ var Groups = class {
 			});
 			if (entry.of.has(via)) continue;
 			entry.of.add(via);
+			entry.at = now;
 			entry.last = {
 				via,
 				at: now,
@@ -26203,6 +26763,55 @@ var Groups = class {
 		return out;
 	}
 	/**
+	* Whether a sync to `via` asks it for its own messages that never reached me, for the first time since what is
+	* missing changed: any sync names them (`miss`), and an author answers from its own log (`GROUP_LIMITS.outlog`).
+	*/
+	ownGap(groupId, via, lacking) {
+		const mark = lacking.get(via);
+		if (mark === void 0) return false;
+		let tried = this.gapsAsked.get(groupId);
+		if (!tried) this.gapsAsked.set(groupId, tried = /* @__PURE__ */ new Map());
+		let entry = tried.get(via);
+		if (!entry || entry.mark !== mark) tried.set(via, entry = {
+			mark,
+			of: /* @__PURE__ */ new Set(),
+			noticed: entry?.noticed,
+			last: entry?.last
+		});
+		if (entry.of.has(via)) return false;
+		entry.of.add(via);
+		entry.at = this.now();
+		return true;
+	}
+	/**
+	* Messages nobody holds any more: every connected member, their author included, was asked for the same missing
+	* numbers `MESH_GAP_AGAIN_MS` ago or more and none arrived. An author keeps its last 32 and the others the group's
+	* last 256 (WISP 902 § Bounds), so what a sync names and nobody hands on is gone, and so is what is below it (logs
+	* drop the oldest first). The member list counted them until the next epoch, as if they were still on their way.
+	*/
+	gapsSettle(groupId, session, now, connected, lacking) {
+		const tried = this.gapsAsked.get(groupId);
+		if (!tried) return;
+		let changed = false;
+		for (const [key, mark] of lacking) {
+			const entry = tried.get(key);
+			if (!entry || entry.mark !== mark || entry.at === void 0 || now - entry.at < 1e4) continue;
+			if (!connected.includes(key) || !connected.every((member) => entry.of.has(member))) continue;
+			let gone = this.gapsGone.get(groupId);
+			if (!gone) this.gapsGone.set(groupId, gone = /* @__PURE__ */ new Map());
+			const upTo = { ...gone.get(key) };
+			for (const [e, numbers] of Object.entries(session.missOf(key))) {
+				const top = Math.max(...numbers);
+				if (top > (upTo[e] ?? -1)) {
+					upTo[e] = top;
+					changed = true;
+				}
+			}
+			gone.set(key, upTo);
+		}
+		if (changed) this.host.emit();
+	}
+	/**
 	* Gaps asked for sooner than the gossip turn: one noticed `MESH_GAP_AGAIN_MS` ago and not asked for yet (an author's
 	* own answer, its last 32, showed what is below them) goes to a connected member now; and a member that handed on some
 	* of what I last asked it for likely holds the rest, so it is asked for the next numbers `MESH_GAP_AGAIN_MS` after. A
@@ -26217,6 +26826,7 @@ var Groups = class {
 		if (!lacking.size && !tried?.size) return;
 		if (!tried) this.gapsAsked.set(groupId, tried = /* @__PURE__ */ new Map());
 		for (const key of tried.keys()) if (!lacking.has(key)) tried.delete(key);
+		this.gapsSettle(groupId, session, now, connected, lacking);
 		const edges = this.host.edges(groupId), again = /* @__PURE__ */ new Map(), fresh = /* @__PURE__ */ new Map();
 		const up = (key) => {
 			const edge = edges.get(key);
@@ -26244,6 +26854,7 @@ var Groups = class {
 				tried.set(key, {
 					mark: lacking.get(key),
 					of: /* @__PURE__ */ new Set([via]),
+					at: now,
 					last: {
 						via,
 						at: now,
@@ -26281,6 +26892,7 @@ var Groups = class {
 			if (session.status !== "active" || this.stored.get(groupId)?.left) continue;
 			session.reseal().catch(() => {});
 			this.farewellsTick(groupId, session, now);
+			this.heldSyncs(groupId, session, now);
 			if (reconcile) {
 				const edges = this.host.edges(groupId);
 				if (!this.hubs.large(session) && session.others.some((key) => !edges.has(key))) this.reconcileEdges(groupId);
@@ -26303,7 +26915,7 @@ var Groups = class {
 				at: now
 			});
 			const ask = [...away, ...this.gapsOf(groupId, session, via, lacking)];
-			if (!ask.length) continue;
+			if (!this.ownGap(groupId, via, lacking) && !ask.length) continue;
 			try {
 				this.host.sendOnLink(edges.get(via), session.syncFrame(ask));
 			} catch {}
@@ -26329,6 +26941,25 @@ var Groups = class {
 		if (session && this.stored.get(groupId)?.farewells?.[peerKey] && !rosterHas(session.roster, peerKey)) return;
 		session?.setNick(peerKey, nick);
 	}
+	/**
+	* A message's row took the frame it came in: past `GROUP_LIMITS.relay` frames (or their bytes) in a group, the oldest
+	* rows give theirs up, so a group's history holds the frames of its newest messages only.
+	*/
+	async frameKept(groupId, id, frame) {
+		let kept = this.framesKept.get(groupId);
+		if (!kept) this.framesKept.set(groupId, kept = []);
+		if (kept.some((k) => k.id === id)) return;
+		kept.push({
+			id,
+			bytes: frameBytes(frame)
+		});
+		let bytes = kept.reduce((sum, k) => sum + k.bytes, 0);
+		while (kept.length > GROUP_LIMITS.relay || bytes > GROUP_LIMITS.relayBytes) {
+			const oldest = kept.shift();
+			bytes -= oldest.bytes;
+			await this.host.forgetFrame?.(MESSAGE_LINK(groupId), oldest.id).catch(() => {});
+		}
+	}
 	session(groupId) {
 		const session = this.sessions.get(groupId);
 		if (!session) throw new Error("Group not found");
@@ -26342,7 +26973,7 @@ var Groups = class {
 			adminTurn: () => this.host.adminTurn?.(state.id) ?? Promise.resolve(true),
 			save: async (next) => {
 				const group = this.stored.get(state.id);
-				if (!group) return;
+				if (!group || this.sessions.get(state.id) !== session) return;
 				group.state = next;
 				await this.store.putGroup(group);
 			},
@@ -26384,9 +27015,12 @@ var Groups = class {
 					...m.reply && { replyTo: groupReply(m.reply, session.myKey) },
 					...m.forwarded && { forwarded: m.forwarded },
 					...m.card && { card: m.card },
-					...file && { file }
+					...file && { file },
+					...m.frame && { frame: m.frame }
 				};
-				const stored = m.completes && this.host.completeMessage ? (await this.host.completeMessage(message), false) : await this.host.storeMessage(message);
+				const completed = !!m.completes && !!this.host.completeMessage;
+				const stored = completed ? (await this.host.completeMessage(message), false) : await this.host.storeMessage(message);
+				if (m.frame && (completed || stored !== false)) await this.frameKept(state.id, m.id, m.frame);
 				const came = m.sender === session.myKey ? timestamp : cameAt(timestamp, stored, arrivalNow(this.now()));
 				this.lastMessageAt.set(state.id, Math.max(this.lastMessageAt.get(state.id) ?? 0, came));
 				if (mentioned) this.lastMentionAt.set(state.id, Math.max(this.lastMentionAt.get(state.id) ?? 0, came));
@@ -26860,9 +27494,12 @@ function summary(note) {
 	const amount = note.decimals ? `${note.amount} base units of ${note.unit}` : `${Number(note.amount).toLocaleString()} ${note.test ? "test sats" : "sats"}`;
 	return note.kind === "request" ? `⚡ Requested ${amount}` : `⚡ Sent ${amount}`;
 }
+/** A second past the receiver's window, so one window's edits have left it on the member's side whatever the edge's delay. */
+var GROUP_EDIT_RESEND_WINDOW_MS = EDIT_RATE_WINDOW_MS + 1e3;
 /** An edit that could not go (no epoch key yet) is tried again after this long. */
 var RETRY_MS = 1e4;
 var chatOf = (groupId) => `group:${groupId}`;
+var resendKey = (groupId, member) => `${groupId}\n${member}`;
 var GroupEdits = class {
 	host;
 	now;
@@ -26871,10 +27508,23 @@ var GroupEdits = class {
 	cards;
 	sendPace = /* @__PURE__ */ new Map();
 	receivePace = /* @__PURE__ */ new Map();
+	/** Per group, per member (`group\nmember`): its edits past the window, by message, waiting for room (`hold`). */
+	held = /* @__PURE__ */ new Map();
+	heldTimers = /* @__PURE__ */ new Map();
 	timers = /* @__PURE__ */ new Map();
 	flushing = /* @__PURE__ */ new Map();
 	/** Per group: my rows known to have an edit to say, each with when it was last told (`edit`), by `tick`. */
 	known = /* @__PURE__ */ new Map();
+	/**
+	* Per group and member (`resendKey`): the last edit of mine said on its edge, in the order `resend` says them. What
+	* comes after it is what the member has not heard there. Not kept across a restart.
+	*/
+	heard = /* @__PURE__ */ new Map();
+	/** The connection `resend` last spoke on, per group and member: a new one hears my latest edits again. */
+	resentOn = /* @__PURE__ */ new Map();
+	resendPace = /* @__PURE__ */ new Map();
+	resendTimers = /* @__PURE__ */ new Map();
+	resending = /* @__PURE__ */ new Map();
 	tick = 0;
 	/**
 	* The groups whose history was read for the rows with an edit to say: `known` has them all, and from then on those
@@ -27023,7 +27673,8 @@ var GroupEdits = class {
 	/**
 	* An edit from a member, authenticated as `sender` by the group. Believed only while the sender is in the group (a
 	* removed member's edits are dropped) and only of the sender's own message; the highest number wins. One of a message
-	* not here yet waits a minute for it. Past `EDIT_RECEIVE_LIMIT` a window from one member, the rest are dropped.
+	* not here yet waits a minute for it. Past `EDIT_RECEIVE_LIMIT` a window from one member, the rest wait for the next
+	* window (`hold`): a catch-up hands back every edit of an author at once, and one dropped is never handed again.
 	*/
 	async receive(groupId, sender, edit) {
 		const membership = this.host.membership(groupId);
@@ -27031,7 +27682,65 @@ var GroupEdits = class {
 		const key = `${groupId}\n${sender}`;
 		let pace = this.receivePace.get(key);
 		if (!pace) this.receivePace.set(key, pace = new RateWindow(30, EDIT_RATE_WINDOW_MS, this.now));
-		if (!pace.take()) return "dropped";
+		if (this.held.get(groupId)?.has(key) || !pace.take()) return this.hold(groupId, sender, edit, pace);
+		return this.take(groupId, membership, sender, edit);
+	}
+	/**
+	* An edit past what a member's window takes: kept, the highest number per message, `GROUP_EDITS_HELD` messages a
+	* group at most (the oldest go first), and taken when the window has room. The work stays what the window allows.
+	*/
+	hold(groupId, sender, edit, pace) {
+		const key = `${groupId}\n${sender}`;
+		let group = this.held.get(groupId);
+		if (!group) this.held.set(groupId, group = /* @__PURE__ */ new Map());
+		let waiting = group.get(key);
+		if (!waiting) group.set(key, waiting = /* @__PURE__ */ new Map());
+		const known = waiting.get(edit.id);
+		if (known && known.e >= edit.e) return "dropped";
+		waiting.delete(edit.id);
+		waiting.set(edit.id, edit);
+		let count = 0;
+		for (const member of group.values()) count += member.size;
+		for (const [member, edits] of group) {
+			if (count <= 256) break;
+			while (count > 256 && edits.size) {
+				edits.delete(edits.keys().next().value);
+				count--;
+			}
+			if (!edits.size && member !== key) group.delete(member);
+		}
+		if (!this.heldTimers.has(key) && !this.stopped) this.heldTimers.set(key, setTimeout(() => {
+			this.takeHeld(groupId, sender).catch(() => {});
+		}, Math.max(50, pace.wait())));
+		return waiting.has(edit.id) ? "waiting" : "dropped";
+	}
+	/** The window of a member has room again: its edits that waited are taken, oldest first, as many as it allows. */
+	async takeHeld(groupId, sender) {
+		const key = `${groupId}\n${sender}`;
+		this.heldTimers.delete(key);
+		const group = this.held.get(groupId), waiting = group?.get(key), pace = this.receivePace.get(key);
+		if (this.stopped || !group || !waiting || !pace) return;
+		for (const [id, edit] of [...waiting]) {
+			const membership = this.host.membership(groupId);
+			if (!membership?.members.has(sender)) {
+				waiting.clear();
+				break;
+			}
+			if (!pace.take()) break;
+			if (waiting.get(id) !== edit) continue;
+			waiting.delete(id);
+			await this.take(groupId, membership, sender, edit).catch(() => {});
+		}
+		if (waiting.size) {
+			if (!this.heldTimers.has(key) && !this.stopped) this.heldTimers.set(key, setTimeout(() => {
+				this.takeHeld(groupId, sender).catch(() => {});
+			}, Math.max(50, pace.wait())));
+			return;
+		}
+		if (group.get(key) === waiting) group.delete(key);
+		if (!group.size) this.held.delete(groupId);
+	}
+	async take(groupId, membership, sender, edit) {
 		const chat = chatOf(groupId);
 		const message = await this.find(chat, edit.id);
 		if (!message) {
@@ -27079,24 +27788,80 @@ var GroupEdits = class {
 		await this.host.changed(chat, message.id);
 		return "applied";
 	}
-	/** An edge of a private group opened: the member at its other end hears my latest edits again, in case it missed them. */
-	async resend(groupId, to) {
-		const chat = chatOf(groupId);
-		const mine = (await (this.host.history ? this.host.history(chat) : this.host.messages(chat))).filter((m) => m.sender === "me" && m.edit && !m.edit.pending && canEditInGroup(m)).sort((a, b) => b.edit.at - a.edit.at).slice(0, 16).reverse();
-		for (const m of mine) await this.host.send(groupId, {
-			id: m.id,
-			e: m.edit.seq,
-			ts: m.edit.at,
-			m: m.text,
-			...m.mentions?.length && { k: m.mentions },
-			...m.card && { sc: m.card }
-		}, to);
+	/**
+	* An edge of a private group opened: the member at its other end hears the edits of mine it has not heard on that
+	* edge, the latest of each message, oldest first. `GROUP_EDIT_RESEND` go a window and the rest a window later each,
+	* while the edge is the same: a member away while I closed forty task cards reads them all as closed, not the latest
+	* sixteen. Nothing known of what it heard (the first time since the app started): my newest `GROUP_EDIT_CATCH_UP`.
+	* A new connection hears my latest `GROUP_EDIT_RESEND` again whatever it heard: one may have come before its message
+	* and been dropped. Called again while the edge is the same, it goes on from where it was.
+	*/
+	resend(groupId, to) {
+		const key = resendKey(groupId, to);
+		const run = (this.resending.get(key) ?? Promise.resolve()).then(() => this.resendNow(groupId, to));
+		const settled = run.catch(() => {}).finally(() => {
+			if (this.resending.get(key) === settled) this.resending.delete(key);
+		});
+		this.resending.set(key, settled);
+		return run;
+	}
+	async resendNow(groupId, to) {
+		const key = resendKey(groupId, to), chat = chatOf(groupId);
+		clearTimeout(this.resendTimers.get(key));
+		this.resendTimers.delete(key);
+		const open = () => this.host.edge ? this.host.edge(groupId, to) : true;
+		const edge = open(), membership = this.host.membership(groupId);
+		if (this.stopped || edge === void 0 || !membership || membership.community || !membership.members.has(to)) return;
+		const mine = (await (this.host.history ? this.host.history(chat) : this.host.messages(chat))).filter((m) => m.sender === "me" && m.edit && !m.edit.pending && canEditInGroup(m)).sort((a, b) => a.edit.at - b.edit.at || (a.id < b.id ? -1 : 1));
+		const last = this.heard.get(key);
+		const after = (m) => !last || m.edit.at > last.at || m.edit.at === last.at && m.id > last.id;
+		const unheard = last ? mine.filter(after).length : Math.min(mine.length, 256);
+		const again = this.resentOn.get(key) === edge ? 0 : Math.min(mine.length, 16);
+		this.resentOn.set(key, edge);
+		const due = mine.slice(mine.length - Math.max(unheard, again));
+		let pace = this.resendPace.get(key);
+		if (!pace) this.resendPace.set(key, pace = new RateWindow(16, GROUP_EDIT_RESEND_WINDOW_MS, this.now));
+		for (const m of due) {
+			if (this.stopped || open() !== edge) return;
+			if (!pace.take()) {
+				this.resendTimers.set(key, setTimeout(() => {
+					this.resend(groupId, to).catch(() => {});
+				}, Math.max(50, pace.wait())));
+				return;
+			}
+			await this.host.send(groupId, {
+				id: m.id,
+				e: m.edit.seq,
+				ts: m.edit.at,
+				m: m.text,
+				...m.mentions?.length && { k: m.mentions },
+				...m.card && { sc: m.card }
+			}, to);
+			if (open() !== edge) return;
+			if (after(m)) this.heard.set(key, {
+				at: m.edit.at,
+				id: m.id
+			});
+		}
+	}
+	/** A group is forgotten, or the app stops: what was known of its members' edges goes with it. */
+	dropResends(groupId) {
+		const of = (key) => groupId === void 0 || key.startsWith(`${groupId}\n`);
+		for (const [key, timer] of this.resendTimers) if (of(key)) {
+			clearTimeout(timer);
+			this.resendTimers.delete(key);
+		}
+		for (const key of [...this.heard.keys()]) if (of(key)) this.heard.delete(key);
+		for (const key of [...this.resendPace.keys()]) if (of(key)) this.resendPace.delete(key);
+		for (const key of [...this.resentOn.keys()]) if (of(key)) this.resentOn.delete(key);
 	}
 	forget(groupId) {
 		clearTimeout(this.timers.get(groupId));
 		this.timers.delete(groupId);
 		this.known.delete(groupId);
 		this.learnt.delete(groupId);
+		this.dropResends(groupId);
+		this.dropHeld(groupId);
 		this.buffer.forget(chatOf(groupId));
 	}
 	stop() {
@@ -27104,6 +27869,16 @@ var GroupEdits = class {
 		this.cards.stop();
 		for (const timer of this.timers.values()) clearTimeout(timer);
 		this.timers.clear();
+		this.dropResends();
+		this.dropHeld();
+	}
+	dropHeld(groupId) {
+		for (const [key, timer] of this.heldTimers) if (groupId === void 0 || key.startsWith(`${groupId}\n`)) {
+			clearTimeout(timer);
+			this.heldTimers.delete(key);
+		}
+		if (groupId === void 0) this.held.clear();
+		else this.held.delete(groupId);
 	}
 };
 //#endregion
@@ -28068,7 +28843,7 @@ var HoldEngine = class {
 			this.host.changed();
 			return;
 		}
-		const pointer = packet ? keys.readPointer(packet) : null;
+		const pointer = packet ? keys.readPointer(packet, this.host.loopbackStorage?.()) : null;
 		if (!pointer) return;
 		let hold = this.state(linkId);
 		if (pointer.rev < hold.peerPointerRev) return;
@@ -28107,11 +28882,12 @@ var HoldEngine = class {
 		try {
 			const manifest = keys.open(await this.fetchBytes(pointer.manifestUrl, HOLD_LIMITS.maxManifestBytes), {
 				maxBytes: HOLD_LIMITS.maxManifestBytes,
-				now
+				now,
+				loopback: this.host.loopbackStorage?.()
 			});
 			if (manifest.header.kind !== "manifest") throw new HoldRefusedError("format", "Not a manifest");
 			mailbox = manifest.header.mailbox;
-			entries = readManifest(manifest.header.meta).filter(([seq]) => seq > this.state(linkId).inSeq).sort((a, b) => a[0] - b[0]);
+			entries = readManifest(manifest.header.meta, this.host.loopbackStorage?.()).filter(([seq]) => seq > this.state(linkId).inSeq).sort((a, b) => a[0] - b[0]);
 		} catch (error) {
 			if (error instanceof HoldRefusedError) {
 				await this.save(linkId, {
@@ -28253,9 +29029,11 @@ var HoldEngine = class {
 		}
 	}
 	async readBytes(url, max, signal) {
+		if (!isHoldUrl(url, this.host.loopbackStorage?.())) throw new Error("The storage address is not one this app reads");
 		const response = await (this.host.fetch ?? ((...args) => fetch(...args)))(url, {
 			cache: "no-store",
 			credentials: "omit",
+			redirect: "error",
 			signal
 		});
 		if (!response.ok) throw new Error(`The storage answered ${response.status}`);
@@ -33762,6 +34540,17 @@ var WalletSetup = class {
 var RELAY_RETRY_MS = 3e4;
 /** Native listeners an app may hold per transport (the Desktop's Rust Iroh allows eight, `paired_transport.rs`). */
 var NATIVE_SLOTS = 8;
+/**
+* Iroh's listeners where it is the browser build (the web app, the extension, the CLI): Rust's eight are not its limit.
+* Each is a WebSocket to its relay and about 0.2 MiB: a phone-sized Chromium page held 128 of them, and the public
+* relays took sixteen started one after another, as the queue here starts them (six of sixteen started at once were
+* refused). 1:1 chats hold eight of them at most, as before: the rest is room for group links. HyperDHT keeps eight
+* there too: a page's listeners share one WebSocket to its relay, which drops a client past sixteen listens (device
+* links listen there as well), and each of the CLI's is a whole DHT node.
+*/
+var IROH_WEB_SLOTS = 16;
+/** Of a transport's listeners, the ones a group's links never hold: 1:1 chats keep that room. */
+var CHAT_NATIVE_SLOTS = 4;
 /** How often a group link that found no free native slot tries again. */
 var GROUP_NATIVE_RETRY_MS = 15e3;
 /** The longest a group link whose native listener failed to start waits before trying again (its wait doubles up to it). */
@@ -33796,6 +34585,8 @@ var CARD_RESTORE_MOST = 50;
 var CARD_RESTORE_MS = 6048e5;
 /** A reaction said on the live session and not confirmed is said again after this long. */
 var REACTION_RESEND_MS = 3e4;
+/** A file or a payment request of mine that waits for the chat to be live (a text that waits is its outbox's). */
+var waitsForLive = (m) => m.sender === "me" && m.delivery === "waiting" && (!!m.file || !!m.paymentId);
 /** This side's participation key in a chat: derived from its seed once, not at every state built. */
 function participationKeyOf(live) {
 	const seed = live.stored.participationSeed;
@@ -34131,6 +34922,16 @@ var GhostlyNode = class GhostlyNode {
 	});
 	stateTimer = null;
 	paymentTimer = null;
+	/**
+	* The reviews whose outcome is still open (submitted, unknown), by id: what the payment poll asks about, so that it
+	* does not read every review ever made every 10 s. `null` until the store was read once. An id is only ever added
+	* from a read of the store or a change of a review, and leaves when the poll finds its review ended or gone.
+	*/
+	openReviews = null;
+	noteOpenReviews(reviews) {
+		const open = this.openReviews ??= /* @__PURE__ */ new Set();
+		for (const review of reviews) if (review.state === "submitted" || review.state === "unknown") open.add(review.id);
+	}
 	/** Every minute, the reviews no Approve can send any more are cancelled (dropStaleReviews). */
 	staleReviewTimer;
 	/** Group links: admins read knocks, joiners knock (WISP 902 § Entry link). */
@@ -34253,6 +35054,7 @@ var GhostlyNode = class GhostlyNode {
 			}
 		}
 	], (review) => {
+		if (this.openReviews) this.noteOpenReviews([review]);
 		if (review.state === "settled") this.feedback("confirmed", review.id);
 		if (review.state === "failed") this.cueFeedback({
 			cue: "failed",
@@ -34460,12 +35262,12 @@ var GhostlyNode = class GhostlyNode {
 			await this.messagesChanged(linkId, [messageId]);
 			this.emitState();
 		},
-		text: async (linkId, messageId) => (await db.getMessages(linkId)).find((m) => m.id === messageId)?.text ?? null,
+		text: async (linkId, messageId) => (await db.getMessage(linkId, messageId))?.text ?? null,
 		reply: async (linkId, messageId) => {
-			const message = (await db.getMessages(linkId)).find((m) => m.id === messageId);
+			const message = await db.getMessage(linkId, messageId);
 			return message && GhostlyNode.wireReply(message);
 		},
-		forwarded: async (linkId, messageId) => (await db.getMessages(linkId)).find((m) => m.id === messageId)?.forwarded,
+		forwarded: async (linkId, messageId) => (await db.getMessage(linkId, messageId))?.forwarded,
 		file: async (fileId) => {
 			const stored = await fileStore.get(fileId);
 			if (!stored?.metadata) return null;
@@ -34569,6 +35371,7 @@ var GhostlyNode = class GhostlyNode {
 		},
 		receivePaymentRequest: (linkId, request) => this.desk.onPaymentRequest(linkId, request, true),
 		changed: () => this.emitState(),
+		loopbackStorage: () => this.options.holdLoopback === true,
 		ttlMs: () => {
 			try {
 				const raw = typeof localStorage !== "undefined" ? localStorage.getItem("ghostly-test-hold-ttl") : null;
@@ -34774,7 +35577,11 @@ var GhostlyNode = class GhostlyNode {
 			await this.messagesChanged(chat, [id]);
 			this.emitState();
 		},
-		notify: (chat, key) => this.feedback("reaction", `${chat}:${key}`, chat)
+		notify: (chat, key) => this.feedback("reaction", `${chat}:${key}`, chat),
+		believed: (chat, by) => {
+			const membership = this.membership(chat.slice(6));
+			return !!membership?.members.has(by) && by !== membership.me;
+		}
 	});
 	/**
 	* The chat list's reaction once one to its message was taken back: the same one if it still stands, else the latest
@@ -34807,10 +35614,11 @@ var GhostlyNode = class GhostlyNode {
 		adminTurn: (_groupId, options) => this.confirmTurn({ within: options?.wait === false ? 0 : GhostlyNode.TURN_CONFIRM_WAIT_MS }),
 		staysOnline: () => this.options.staysOnline ?? (this.options.platform === "desktop" && typeof RTCPeerConnection !== "undefined"),
 		peerRoom: (groupId) => {
-			if (typeof RTCPeerConnection === "undefined" && Object.keys(this.nativeFactories).length) {
+			const native = Object.keys(this.nativeFactories);
+			if (typeof RTCPeerConnection === "undefined" && native.length) {
 				let held = 0;
 				for (const live of this.links.values()) if (live.stored.group && live.stored.group !== groupId && live.link) held++;
-				return Math.max(0, 4 - held);
+				return Math.max(0, Math.max(...native.map((key) => this.groupNativeSlots(key))) - held);
 			}
 			const budget = this.options.peerBudget;
 			if (budget === void 0) return void 0;
@@ -34859,6 +35667,9 @@ var GhostlyNode = class GhostlyNode {
 		edgeNick: (linkId) => this.links.get(linkId)?.presence.nick || void 0,
 		storeMessage: (message) => this.storeNewMessage(message),
 		completeMessage: (message) => this.completeGroupMessage(message),
+		forgetFrame: async (linkId, id) => {
+			await db.patchMessage(linkId, id, (stored) => stored.frame ? { frame: void 0 } : null, true);
+		},
 		membersChanged: (groupId) => this.groupMembersChanged(groupId),
 		historyGone: (groupId) => this.groupHistoryGone(groupId),
 		emit: () => this.emitState(),
@@ -34921,7 +35732,11 @@ var GhostlyNode = class GhostlyNode {
 				admin: !!this.groups.views().find((g) => g.id === groupId)?.isAdmin
 			};
 		},
-		send: (groupId, edit, to) => this.groups.sendEdit(groupId, edit, to)
+		send: (groupId, edit, to) => this.groups.sendEdit(groupId, edit, to),
+		edge: (groupId, member) => {
+			const link = this.links.get(this.memberEdges(groupId).get(member) ?? "")?.link;
+			return link?.supportsGroupVersion(1) ? link : void 0;
+		}
 	});
 	/** A community member's edit, signed by them: of their own message, and only while they are a member. */
 	async receiveCommunityEdit(groupId, sender, frame) {
@@ -35142,12 +35957,14 @@ var GhostlyNode = class GhostlyNode {
 			};
 		}
 		const wallets = this.withHomes(walletInstances(networks));
+		const intents = (await intentRepository.list()).map((saved) => saved.review);
+		this.noteOpenReviews(intents);
 		this.walletView = {
 			...networks.mainnet,
 			networks,
 			wallets,
 			offers: this.walletOffers(networks, wallets),
-			intents: (await intentRepository.list()).map((saved) => saved.review),
+			intents,
 			setup: this.walletSetup.view()
 		};
 		this.announcePaymentNetworks(wallets);
@@ -35216,9 +36033,16 @@ var GhostlyNode = class GhostlyNode {
 	async pollPaymentStatus() {
 		if (this.shuttingDown) return;
 		try {
-			for (const { review } of await intentRepository.list()) {
+			if (!this.openReviews) this.noteOpenReviews((await intentRepository.list()).map((saved) => saved.review));
+			const open = this.openReviews;
+			for (const id of [...open]) {
+				const review = (await intentRepository.get(id))?.review;
+				if (!review || !["submitted", "unknown"].includes(review.state)) {
+					open.delete(id);
+					continue;
+				}
 				const network = walletNetworkOf(review.network);
-				if (!["submitted", "unknown"].includes(review.state) || review.method === "arkade" && !this.arkWallets[network].adapter || review.method === "bark" && !this.barkWallets[network].adapter || review.method === "spark" && !this.sparkWallets[network].adapter || review.method === "usdt" && !this.usdtWallets[network].adapter || review.method === "bitcoin" && !this.bitcoins[network].sources.active || review.method === "fedimint" && !this.fedimintWallets[network].federation(review.provider)) continue;
+				if (review.method === "arkade" && !this.arkWallets[network].adapter || review.method === "bark" && !this.barkWallets[network].adapter || review.method === "spark" && !this.sparkWallets[network].adapter || review.method === "usdt" && !this.usdtWallets[network].adapter || review.method === "bitcoin" && !this.bitcoins[network].sources.active || review.method === "fedimint" && !this.fedimintWallets[network].federation(review.provider)) continue;
 				await this.reconcilePayment({ id: review.id }).catch(() => {});
 			}
 		} finally {
@@ -35271,6 +36095,7 @@ var GhostlyNode = class GhostlyNode {
 			if (!stored.group) this.fileDesk.restore(stored.id, storedFiles);
 			const files = linkFilesFrom(stored.id, storedFiles, messages);
 			this.links.set(stored.id, newLiveLink(stored, messages[messages.length - 1]?.timestamp ?? 0, files));
+			if (!stored.group) this.links.get(stored.id).waitingSends = Promise.resolve(new Set(messages.filter(waitsForLive).map((m) => m.id)));
 			history.set(stored.id, messages);
 			for (const message of messages.slice(-20)) this.clockSample(message);
 			const note = latestReaction(messages);
@@ -35724,10 +36549,12 @@ var GhostlyNode = class GhostlyNode {
 		this.publicActivity.clear();
 		for (const queue of this.editQueues.values()) queue.stop();
 		this.groupEdits.stop();
+		this.reactions.stop();
 		this.cardEdits.stop();
 		await Promise.allSettled([
 			linksStopped,
 			links?.stop(),
+			this.groups.flush(),
 			...WALLET_NETWORKS.flatMap((network) => [
 				this.arkWallets,
 				this.barkWallets,
@@ -35805,8 +36632,11 @@ var GhostlyNode = class GhostlyNode {
 	appCheckUpdates() {
 		return this.appStore.checkUpdates();
 	}
-	appUninstall(params) {
-		return this.appStore.uninstall(params);
+	/** Uninstalls an app. One running then is closed in every chat (the contact hears `close`), and the pages are told, to stop its frames. */
+	async appUninstall(params) {
+		await this.appStore.uninstall(params);
+		this.appsCloseOf(params.ref);
+		this.events.onAppsChecked?.();
 	}
 	appRunCheck(params) {
 		return this.appStore.runCheck(params);
@@ -35924,14 +36754,23 @@ var GhostlyNode = class GhostlyNode {
 	edgeView(groupId, member) {
 		for (const live of this.links.values()) if (live.stored.group === groupId && live.stored.groupPeer === member && !live.stored.groupEntry) return edgeView(live, Date.now(), this.groupNativeWaiting.has(live.stored.id));
 	}
-	getMessages(linkId) {
-		return db.getMessages(linkId);
+	/** A chat's or a group's history, as a page gets it (`withoutFrame`). */
+	async getMessages(linkId) {
+		return (await db.getMessages(linkId)).map(withoutFrame);
 	}
 	/** One message of a chat, read by its id: the whole history costs a read of every row. */
-	getMessage(linkId, id) {
-		return db.getMessage(linkId, id);
+	async getMessage(linkId, id) {
+		const message = await db.getMessage(linkId, id);
+		return message && withoutFrame(message);
 	}
-	async messagePage({ linkId, limit = 50, before }) {
+	async messagePage(asked) {
+		const page = await this.storedPage(asked);
+		return {
+			...page,
+			messages: page.messages.map(withoutFrame)
+		};
+	}
+	async storedPage({ linkId, limit = 50, before }) {
 		if (!Number.isSafeInteger(limit) || limit < 1) throw new Error("limit: a whole number of messages, at least 1");
 		if (before === void 0) return db.getMessagePage(linkId, { limit });
 		if (typeof before === "number") {
@@ -37206,7 +38045,7 @@ var GhostlyNode = class GhostlyNode {
 	async retryMessage({ linkId, messageId }) {
 		const live = this.links.get(linkId);
 		if (!live?.stored.profile) throw new Error("Retry is only available for paired chat messages");
-		const message = (await db.getMessages(linkId)).find((m) => m.id === messageId);
+		const message = await db.getMessage(linkId, messageId);
 		if (message?.via === "hold") {
 			if (await this.hold.retry(linkId, messageId)) return;
 			if (!this.holdingFor(live)) throw new Error("Held messages need S3 storage (Profile → Backups) and a contact that allows them.");
@@ -37256,11 +38095,18 @@ var GhostlyNode = class GhostlyNode {
 			outbox = new Outbox({
 				read: () => db.getMessages(linkId),
 				update: async (id, delivery, error, extra) => {
-					await db.updateDelivery(linkId, id, delivery, error, extra);
-					if (delivery === "delivered") await this.noteDetails(linkId, id, (details) => ({
-						...details,
-						receiptAt: Date.now()
-					}));
+					if (delivery === "delivered") await db.patchMessage(linkId, id, (message) => message.delivery === "delivered" ? null : {
+						...message.delivery && {
+							...extra,
+							delivery,
+							deliveryError: error
+						},
+						details: {
+							...message.details,
+							receiptAt: Date.now()
+						}
+					}, true);
+					else await db.updateDelivery(linkId, id, delivery, error, extra);
 					if (delivery === "sent" || delivery === "delivered") {
 						const message = await db.getMessage(linkId, id);
 						if (message) this.messageFeedback("sent", message);
@@ -37326,7 +38172,7 @@ var GhostlyNode = class GhostlyNode {
 	*/
 	async messageDetails({ linkId, messageId }) {
 		if (typeof linkId !== "string" || typeof messageId !== "string") throw new Error("Chat not found");
-		const message = (await db.getMessages(linkId)).find((m) => m.id === messageId);
+		const message = await db.getMessage(linkId, messageId);
 		if (!message) return null;
 		const live = this.links.get(linkId), stored = live?.stored;
 		const group = linkId.startsWith("group:") ? (await db.getGroups()).find((g) => g.id === linkId.slice(6)) : void 0;
@@ -37351,7 +38197,7 @@ var GhostlyNode = class GhostlyNode {
 	}
 	/** Adds to a message's details record, whatever the row's delivery state. Nothing is pushed for it: the view asks. */
 	noteDetails(linkId, id, change) {
-		return db.patchMessage(linkId, id, (message) => ({ details: change(message.details ?? {}, message) })).then(() => {}, () => {});
+		return db.patchMessage(linkId, id, (message) => ({ details: change(message.details ?? {}, message) }), true).then(() => {}, () => {});
 	}
 	/** One send of a text on its details: the path, the frame and its size, and the DHT envelope when that was the way. */
 	noteTextSend(linkId, message, snapshot, at, error, link) {
@@ -37533,12 +38379,22 @@ var GhostlyNode = class GhostlyNode {
 		}
 	}
 	/**
+	* The message of mine that carries a payment or a request, read by its id: `me_<the time the desk keeps for it>`.
+	* The chat's history is read only when that row does not carry it, so it costs the same in a long chat as in a short one.
+	*/
+	async paymentMessage(linkId, paymentId) {
+		const at = this.desk.payment(paymentId)?.createdAt;
+		const message = at === void 0 ? void 0 : await db.getMessage(linkId, `me_${at}`);
+		if (message?.sender === "me" && message.paymentId === paymentId) return message;
+		return (await db.getMessages(linkId)).find((m) => m.sender === "me" && m.paymentId === paymentId);
+	}
+	/**
 	* The contact's app answered for a payment of mine (`pay-res`): its message gets two ticks, as a text gets from its
 	* receipt. A payment goes with no delivery state of its own, so its mark read one tick for good. 1:1 chats only: a
 	* group's payments live in the group's history, under other ids.
 	*/
 	async notePaymentReceipt(linkId, paymentId) {
-		const message = (await db.getMessages(linkId)).find((m) => m.sender === "me" && m.paymentId === paymentId);
+		const message = await this.paymentMessage(linkId, paymentId);
 		if (!message || message.delivery === "delivered") return;
 		if (await db.patchMessage(linkId, message.id, (m) => m.delivery === "delivered" ? null : {
 			delivery: "delivered",
@@ -37756,9 +38612,10 @@ var GhostlyNode = class GhostlyNode {
 	}
 	fileAction({ linkId, fileId, action }) {
 		if (typeof linkId === "string" && linkId.startsWith("group:")) {
-			if (action !== "accept" && action !== "request") throw new Error("A group's file is downloaded (accept) or asked for again (request)");
 			if (!fileId.startsWith(`group-${linkId.slice(6)}-`)) throw new Error("No such file in this group");
-			return this.groups.downloadFile(fileId);
+			if (action === "accept" || action === "request" || action === "resume") return this.groups.downloadFile(fileId);
+			if (action === "cancel" || action === "decline" || action === "pause") return this.groups.haltFile(fileId, action === "pause");
+			throw new Error("A group's file is not sent again from here");
 		}
 		const live = this.links.get(linkId);
 		if (!live) throw new Error("No such chat");
@@ -37847,7 +38704,7 @@ var GhostlyNode = class GhostlyNode {
 		const error = await link.announceFile(offer, message.timestamp, GhostlyNode.wireReply(message), message.forwarded);
 		const said = !error && link.dhtPendingId === dhtFileId(offer.wireId);
 		if (!said && error !== "This file's name is too long to say over the DHT. It is sent when you are live.") return;
-		await db.patchMessage(linkId, message.id, (current) => current.delivery !== "waiting" || current.fileOnFloor ? null : {
+		const noted = await db.patchMessage(linkId, message.id, (current) => current.delivery !== "waiting" || current.fileOnFloor ? null : {
 			fileOnFloor: said ? "sent" : "unfit",
 			...said && { details: withSend(current.details, {
 				at,
@@ -37855,17 +38712,32 @@ var GhostlyNode = class GhostlyNode {
 				result: "sent"
 			}) }
 		});
+		if (said && noted) await live.floorFiles?.then((known) => known.set(dhtFileId(offer.wireId), message.id), () => {});
 		await this.messagesChanged(linkId, [message.id]);
 	}
 	/** A receipt on the DHT floor that names a waiting file's offer (`dhtFileId`): its bubble is in place on the contact's side. */
 	async fileSeenOnFloor(linkId, id) {
-		const prefix = `${linkId}-out-`;
-		const message = (await db.getMessages(linkId)).find((m) => m.sender === "me" && m.file?.id.startsWith(prefix) && m.fileOnFloor === "sent" && dhtFileId(m.file.id.slice(prefix.length)) === id);
-		if (!message) return;
-		if (await db.patchMessage(linkId, message.id, (current) => current.fileOnFloor !== "sent" ? null : {
+		const live = this.links.get(linkId);
+		if (!live) return;
+		const said = await this.floorFilesOf(live), messageId = said.get(id);
+		if (!messageId) return;
+		said.delete(id);
+		if (await db.patchMessage(linkId, messageId, (current) => current.fileOnFloor !== "sent" ? null : {
 			fileOnFloor: "seen",
 			...current.delivery === "waiting" && { deliveryError: "Your contact sees it. The file goes when you are live." }
-		})) await this.messagesChanged(linkId, [message.id]);
+		})) await this.messagesChanged(linkId, [messageId]);
+	}
+	/**
+	* The files of mine said on the floor and not seen there yet, their message by their floor id (`dhtFileId`). Read from
+	* the chat's history once in a run, then kept as files are said (`sayFileOnFloor`): a receipt that names none of them
+	* costs the same in a long chat as in a short one.
+	*/
+	floorFilesOf(live) {
+		const linkId = live.stored.id, prefix = `${linkId}-out-`;
+		return live.floorFiles ??= db.getMessages(linkId).then((history) => new Map(history.filter((m) => m.sender === "me" && m.file?.id.startsWith(prefix) && m.fileOnFloor === "sent").map((m) => [dhtFileId(m.file.id.slice(prefix.length)), m.id])), (error) => {
+			live.floorFiles = void 0;
+			throw error;
+		});
 	}
 	/**
 	* A file the contact said on the DHT floor (WISP 403 § Files): its bubble takes its place now, waiting for its bytes,
@@ -37963,40 +38835,59 @@ var GhostlyNode = class GhostlyNode {
 		const live = this.links.get(linkId);
 		if (!live?.link?.isDataLinkOpen) return;
 		const withTexts = this.outboxFor(linkId).sendsFiles;
-		const waiting = (await db.getMessages(linkId)).filter((m) => m.sender === "me" && m.delivery === "waiting" && (m.file && !withTexts || m.paymentId)).sort((a, b) => a.timestamp - b.timestamp);
+		const known = await this.waitingSendsOf(live), waiting = [];
+		for (const id of [...known]) {
+			const message = await db.getMessage(linkId, id);
+			if (!message || !waitsForLive(message)) known.delete(id);
+			else if (message.file && !withTexts || message.paymentId) waiting.push(message);
+		}
+		waiting.sort((a, b) => a.timestamp - b.timestamp);
 		if (waiting.some((m) => m.file) && !GhostlyNode.takesFiles(live.link)) await GhostlyNode.largeFilesAgreed(live.link);
-		for (const message of waiting) if (message.file) {
-			if (!GhostlyNode.takesFiles(live.link)) {
-				await db.updateDelivery(linkId, message.id, "failed", "Your contact's app cannot receive files.");
-				continue;
-			}
-			const file = message.file, wireId = file.id.slice(`${linkId}-out-`.length);
-			await db.putMessage(sentNow(message));
-			this.transferFile(live, file, wireId, message.timestamp, (error) => {
-				this.transfers.set(file.id, {
-					state: "failed",
-					transferred: 0,
-					size: file.size,
-					error
-				});
-				this.emitState();
-			}, GhostlyNode.wireReply(message));
-		} else if (live.link.supportsPayments) {
-			const at = Date.now();
-			await db.putMessage({
-				...sentNow(message),
-				details: {
-					...withSend(message.details, {
-						at,
-						...pathSnapshot(live, "datalink"),
-						result: "sent"
-					}),
-					sentAt: at
+		for (const message of waiting) {
+			if (message.file) {
+				if (!GhostlyNode.takesFiles(live.link)) {
+					await db.updateDelivery(linkId, message.id, "failed", "Your contact's app cannot receive files.");
+					continue;
 				}
-			});
-		} else await db.updateDelivery(linkId, message.id, "failed", "Your contact's app cannot receive payment requests.");
+				const file = message.file, wireId = file.id.slice(`${linkId}-out-`.length);
+				await db.putMessage(sentNow(message));
+				this.transferFile(live, file, wireId, message.timestamp, (error) => {
+					this.transfers.set(file.id, {
+						state: "failed",
+						transferred: 0,
+						size: file.size,
+						error
+					});
+					this.emitState();
+				}, GhostlyNode.wireReply(message));
+			} else if (live.link.supportsPayments) {
+				const at = Date.now();
+				await db.putMessage({
+					...sentNow(message),
+					details: {
+						...withSend(message.details, {
+							at,
+							...pathSnapshot(live, "datalink"),
+							result: "sent"
+						}),
+						sentAt: at
+					}
+				});
+			} else await db.updateDelivery(linkId, message.id, "failed", "Your contact's app cannot receive payment requests.");
+			known.delete(message.id);
+		}
 		if (waiting.length) await this.messagesChanged(linkId, waiting.map((m) => m.id));
 	}
+	/**
+	* The ids of my messages that wait for the live link (`waitsForLive`). A chat loaded at the start has them from that
+	* read; any other reads its history once in a run. A session that opens then reads those rows, however long the chat.
+	*/
+	waitingSendsOf(live) {
+		return live.waitingSends ??= db.getMessages(live.stored.id).then((history) => new Set(history.filter(waitsForLive).map((m) => m.id)), (error) => {
+			live.waitingSends = void 0;
+			throw error;
+		});
+	}
 	receiveFile(linkId, wire) {
 		const files = this.links.get(linkId)?.files;
 		if (!files) return "refused";
@@ -38444,8 +39335,8 @@ var GhostlyNode = class GhostlyNode {
 		};
 		return this.groups.fileCheck(groupId);
 	}
-	groupMessages({ groupId }) {
-		return this.groups.messages(groupId);
+	async groupMessages({ groupId }) {
+		return (await this.groups.messages(groupId)).map(withoutFrame);
 	}
 	/**
 	* Presses a button of a message someone else sent to a chat or a group (`group:<id>`), WISP 406 · Message Buttons:
@@ -38865,10 +39756,13 @@ var GhostlyNode = class GhostlyNode {
 	* This side opened an app in a paired chat, or updated it: `open` goes to the contact now when the session is live,
 	* and again on every session that comes back while it stays open.
 	*/
-	async appOpen({ linkId, ref, version }) {
+	async appOpen({ linkId, ref, version, digest }) {
 		const { live, app } = this.appChat(linkId, ref);
 		if (!isAppVersion(version)) throw new Error("Not an app version");
-		await this.appStore.chatRunnable({ ref });
+		await this.appStore.chatRunnable({
+			ref,
+			digest
+		});
 		const open = live.appsOpen ??= /* @__PURE__ */ new Map();
 		if (live.link) live.link.openApp(app, version);
 		else open.set(app, version);
@@ -38881,10 +39775,13 @@ var GhostlyNode = class GhostlyNode {
 		else live.appsOpen?.delete(app);
 	}
 	/** One data frame of an app open on both sides, on the live session only; nothing is kept to send later. */
-	async appSend({ linkId, ref, data }) {
+	async appSend({ linkId, ref, data, digest }) {
 		const { live, app } = this.appChat(linkId, ref);
 		if (!live.appsOpen?.has(app)) return { error: "not-open" };
-		await this.appStore.chatRunnable({ ref });
+		await this.appStore.chatRunnable({
+			ref,
+			digest
+		});
 		return { error: live.link ? live.link.sendAppData(app, data) : "offline" };
 	}
 	/** Every page went away: no app runs here any more, so each open one is closed (`close` goes where it can). */
@@ -38892,6 +39789,16 @@ var GhostlyNode = class GhostlyNode {
 		for (const live of this.links.values()) for (const app of [...live.appsOpen?.keys() ?? []]) if (live.link) live.link.closeApp(app);
 		else live.appsOpen?.delete(app);
 	}
+	/** An app that went (uninstalled) is closed in every chat it was open in, as `appClose` does. */
+	appsCloseOf(ref) {
+		for (const [linkId, live] of this.links) {
+			if (!live.appsOpen?.size) continue;
+			const { app } = this.appChat(linkId, ref);
+			if (!live.appsOpen.has(app)) continue;
+			if (live.link) live.link.closeApp(app);
+			else live.appsOpen.delete(app);
+		}
+	}
 	/** Keeps a pin of a 1:1 chat when it is newer than the chat's; `out`: mine, to say until the contact confirms it. */
 	async keepLinkPin(linkId, pin, out) {
 		const live = this.links.get(linkId);
@@ -38954,6 +39861,7 @@ var GhostlyNode = class GhostlyNode {
 		const view = this.groups.views().find((g) => g.id === groupId);
 		if (!pin || !view?.myKey || view.status !== "active" || !view.members.some((m) => m.key === member)) return;
 		if (!mayPin(view.profile, member, view.members.find((m) => m.role === "admin")?.key)) return;
+		if (!pinIsNewer(this.groups.pinOf(groupId), pin)) return;
 		const kept = await this.pinCame(`group:${groupId}`, member === view.myKey ? "me" : member, pin);
 		if (!await this.groups.setPin(groupId, {
 			...kept,
@@ -39241,7 +40149,7 @@ var GhostlyNode = class GhostlyNode {
 	async closeRequest(paymentId, reason) {
 		const request = this.desk.payment(paymentId);
 		if (!request || !await this.desk.close(paymentId, reason, "your contact removed the wallet it was paid to")) return;
-		const message = (await db.getMessages(request.linkId)).find((m) => m.paymentId === paymentId && m.sender === "me");
+		const message = await this.paymentMessage(request.linkId, paymentId);
 		if (message) await this.hold.forget(request.linkId, message.id).catch(() => {});
 	}
 	/**
@@ -40080,6 +40988,7 @@ var GhostlyNode = class GhostlyNode {
 			if (settings[key] !== false) delete this.settings[key];
 			else this.settings[key] = false;
 			await db.putSettings(this.settings);
+			if (key === "autoDownloads" && settings[key] === false) await this.groups.autoDownloadsOff();
 		}
 		if (settings.publicProfiles !== void 0) {
 			if (settings.publicProfiles !== false) delete this.settings.publicProfiles;
@@ -40198,8 +41107,8 @@ var GhostlyNode = class GhostlyNode {
 		if (this.options.singleDevice) return;
 		const record = await readDeviceRecord(databaseName()).catch(() => null);
 		if (!record || record.state !== "active") return;
-		const verifier = await this.handoffVerifier().catch(() => null);
-		if (verifier && JSON.stringify(verifier) !== JSON.stringify(record.verifier)) await amendDevice(databaseName(), { verifier });
+		const verifier = await this.handoffVerifier();
+		if (verifier ? JSON.stringify(verifier) !== JSON.stringify(record.verifier) : record.verifier) await amendDevice(databaseName(), { verifier: verifier ?? void 0 });
 	}
 	/**
 	* Copies the network settings into the device record (WISP 06, `devices/network.ts`), where device-link-only mode
@@ -40283,8 +41192,12 @@ var GhostlyNode = class GhostlyNode {
 		this.emitState();
 		await recoverEnrollment(databaseName(), this.turnNetwork()).catch(() => false);
 		await this.syncDeviceVerifier().catch(() => {});
-		const outcome = await (await this.deviceLinks.turnKeeper())?.check(false);
-		if (outcome?.kind === "go-on" && !outcome.restricted) this.noteGoodTurn();
+		const keeper = await this.deviceLinks.turnKeeper();
+		const outcome = await keeper?.check(false);
+		if (outcome?.kind === "go-on" && !outcome.restricted) {
+			this.noteGoodTurn();
+			await keeper?.stateVerifier().catch(() => null);
+		}
 		if (outcome?.kind === "gated" && !this.shuttingDown) {
 			const record = await readDeviceRecord(databaseName());
 			if (record) await this.stopReplaced(viewOf(record));
@@ -40320,7 +41233,10 @@ var GhostlyNode = class GhostlyNode {
 		if (knownDeviceGate()?.state !== "active") return;
 		const outcome = await links.checkTurn(false).catch(() => null);
 		if (this.shuttingDown || this.gatedOut) return;
-		if (outcome?.kind === "go-on" && !outcome.restricted) this.noteGoodTurn();
+		if (outcome?.kind === "go-on" && !outcome.restricted) {
+			this.noteGoodTurn();
+			await this.stateDeviceVerifier();
+		}
 		if (outcome?.kind === "gated") {
 			const record = await readDeviceRecord(databaseName()).catch(() => null);
 			if (record) await this.stopReplaced(viewOf(record));
@@ -40634,16 +41550,45 @@ var GhostlyNode = class GhostlyNode {
 		if (this.options.singleDevice) return;
 		if (typeof password !== "string" || !password) throw new Error("A password is needed");
 		const stored = await this.handoffVerifier();
-		if (stored && knownDeviceGate()?.state === "active" && !await provesHandoffPassword(stored, typeof current === "string" ? current : "")) throw new Error("handoff-password: The current password is wrong.");
+		const active = knownDeviceGate()?.state === "active";
+		const ready = await handoffPakeReady().then(() => true, () => false);
+		if (stored && !ready) {
+			if (password !== current) await this.dropHandoffVerifier();
+			throw new Error("The password proof could not be loaded");
+		}
+		if (stored && active && !await provesHandoffPassword(stored, typeof current === "string" ? current : "")) throw new Error("handoff-password: The current password is wrong.");
+		if (stored && await provesHandoffPassword(stored, password)) {
+			await this.syncDeviceVerifier().catch(() => {});
+			await this.stateDeviceVerifier();
+			return;
+		}
 		try {
 			const verifier = await makeHandoffVerifier(password);
 			await wrap((await store(STORES$1.settings, "readwrite")).put(verifier, GhostlyNode.HANDOFF_VERIFIER));
 			await this.syncDeviceVerifier().catch(() => {});
+			await this.stateDeviceVerifier();
 		} catch (error) {
-			await wrap((await store(STORES$1.settings, "readwrite")).delete(GhostlyNode.HANDOFF_VERIFIER)).catch(() => {});
+			await this.dropHandoffVerifier();
 			throw error;
 		}
 	}
+	/** The profile has no verifier any more: its settings, the device state, and what the turn record states. */
+	async dropHandoffVerifier() {
+		await wrap((await store(STORES$1.settings, "readwrite")).delete(GhostlyNode.HANDOFF_VERIFIER)).catch(() => {});
+		await this.syncDeviceVerifier().catch(() => {});
+		await this.stateDeviceVerifier();
+	}
+	/**
+	* The turn record states which verifier the profile has now (WISP 06 § Record, the verifier mark), so a standby that
+	* keeps an older one does not take over with the password it checks. Asked after the device state took the
+	* verifier: at start, at each change, and after a good read of the turn (a change made offline is stated then).
+	*/
+	async stateDeviceVerifier() {
+		if (this.options.singleDevice || this.shuttingDown || this.gatedOut) return;
+		try {
+			await (await this.deviceLinks?.turnKeeper())?.stateVerifier();
+		} catch {}
+	}
 	/**
 	* The wallets in a handoff to `taker` (WISP 06 § Wallets, `planHandoffWallets`): what moves, what stays home, and
 	* what keeps the profile here now. `view`: the wallets as they are now, read fresh by default.
@@ -40748,10 +41693,10 @@ var GhostlyNode = class GhostlyNode {
 		}
 		await writeWalletHomes(plan.wallets);
 		const breezDatabases = [...new Set(plan.wallets.flatMap((w) => w.route === "moves" && w.breez && breez.has(w.id) ? [breez.get(w.id)] : []))];
-		const verifier = await this.handoffVerifier().catch(() => null);
+		const verifier = await this.handoffVerifier().then((value) => ({ verifier: value ?? void 0 }), () => ({}));
 		await moveDevice(profile, "releasing", {
 			...patch,
-			...verifier ? { verifier } : {},
+			...verifier,
 			breezDatabases: breezDatabases.length ? breezDatabases : void 0
 		});
 		this.events.onDeviceGate?.({
@@ -41207,6 +42152,9 @@ var GhostlyNode = class GhostlyNode {
 					this.directPath.note(peer, evidence);
 					if (!entry && evidence !== "open" && evidence !== "closed") this.edgeWithoutRtc(linkId);
 				},
+				onAnswersRefused: () => {
+					if (!entry) this.edgeWithoutRtc(linkId);
+				},
 				onDataLinkState: (state) => {
 					traceJoin(group, `link.${state}`, { role });
 					if (state === "open" || live.dataLink === "open") live.lastSyncAt = Date.now();
@@ -41377,6 +42325,7 @@ var GhostlyNode = class GhostlyNode {
 				role: stored.inviteCode ? "inviter" : "joiner",
 				startedAt: stored.createdAt
 			} : void 0,
+			madeAt: stored.createdAt,
 			transport: this.transport,
 			nick: this.sharedNick,
 			avatar: this.sharedAvatar,
@@ -41627,10 +42576,11 @@ var GhostlyNode = class GhostlyNode {
 					this.notePaymentReceipt(linkId, result.id).catch(() => {});
 				},
 				onFileStored: async (wire) => {
-					const stored = (await fileStore.listForLink(linkId)).find((file) => file.direction === "in" && file.wireId === wire.id);
-					if (!stored?.digest || !stored.metadata) return void 0;
-					if (stored.metadata.name !== wire.name || stored.metadata.size !== wire.size || stored.metadata.mime !== wire.mime || stored.metadata.timestamp !== wire.timestamp) return void 0;
-					return stored.digest;
+					if (!stored.group && !this.links.get(linkId)?.files.wireIds.has(wire.id)) return void 0;
+					const held = (await fileStore.listForLink(linkId)).find((file) => file.direction === "in" && file.wireId === wire.id);
+					if (!held?.digest || !held.metadata) return void 0;
+					if (held.metadata.name !== wire.name || held.metadata.size !== wire.size || held.metadata.mime !== wire.mime || held.metadata.timestamp !== wire.timestamp) return void 0;
+					return held.digest;
 				},
 				onFileIncoming: (file) => this.receiveFile(linkId, file),
 				onFileProgress: (id, transferred, direction) => this.fileProgress(this.localFileId(linkId, id, direction), transferred),
@@ -41769,7 +42719,7 @@ var GhostlyNode = class GhostlyNode {
 	get nativeFactories() {
 		const relay = this.relaysHyperdht ? this.hyperdhtRelay : "";
 		return {
-			...relay ? { "hyperdht/1": async (seedB64) => (await import("./hyperdhtRelay-C0XRWySP.js")).createRelayedHyperEndpoint(seedB64, relay) } : {},
+			...relay ? { "hyperdht/1": async (seedB64) => (await import("./hyperdhtRelay-hKC9DpIH.js")).createRelayedHyperEndpoint(seedB64, relay) } : {},
 			...this.options.nativeTransports,
 			...this.ownIrohRelays ? { "iroh/1": (seedB64) => this.options.nativeTransports["iroh/1"](seedB64, this.settings.irohRelays?.length ? { relays: [...this.settings.irohRelays] } : {}) } : {},
 			...this.options.irohWeb ? { "iroh/1": (seedB64) => createIrohWebEndpoint(seedB64, { relays: this.irohRelays }) } : {}
@@ -41884,6 +42834,14 @@ var GhostlyNode = class GhostlyNode {
 			this.emitState();
 		});
 	}
+	/** The listeners this app may hold for a transport: sixteen for Iroh's browser build (`IROH_WEB_SLOTS`), eight for the others. */
+	nativeSlots(key) {
+		return key === "iroh/1" && this.options.irohWeb ? IROH_WEB_SLOTS : NATIVE_SLOTS;
+	}
+	/** Of those, what its groups' links may hold, all groups together. */
+	groupNativeSlots(key) {
+		return this.nativeSlots(key) - CHAT_NATIVE_SLOTS;
+	}
 	/**
 	* One transport's listener for one chat, in that transport's queue. "no-slot" when a group's link found no slot free,
 	* "failed" when the listener could not start.
@@ -41897,11 +42855,13 @@ var GhostlyNode = class GhostlyNode {
 		live.transportErrors ??= {};
 		try {
 			const owners = [...this.links.values()].filter((other) => other.link?.availableTransports.includes(key));
-			if (group && (owners.length >= NATIVE_SLOTS || owners.filter((other) => other.stored.group).length >= 4)) return "no-slot";
-			if (owners.length >= NATIVE_SLOTS) {
+			const slots = this.nativeSlots(key), groups = owners.filter((other) => other.stored.group).length;
+			if (group && (owners.length >= slots || groups >= this.groupNativeSlots(key))) return "no-slot";
+			const full = owners.length >= slots;
+			if (full || !group && owners.length - groups >= NATIVE_SLOTS) {
 				const now = Date.now();
 				const taking = !group && (this.activeLinkId === linkId || inUse);
-				const victim = owners.filter((other) => other.stored.group && other.link?.canReleaseEndpoint(key)).sort((a, b) => (a.link?.isDataLinkOpen ? 1 : 0) - (b.link?.isDataLinkOpen ? 1 : 0))[0] ?? (taking ? owners.filter((other) => other !== live && other.stored.id !== this.activeLinkId && other.link?.canReleaseEndpoint(key) && now - (other.nativeTakenAt?.[key] ?? 0) >= 12e4).sort((a, b) => a.lastMessageAt - b.lastMessageAt)[0] : void 0);
+				const victim = (!full ? void 0 : owners.filter((other) => other.stored.group && other.link?.canReleaseEndpoint(key)).sort((a, b) => (a.link?.isDataLinkOpen ? 1 : 0) - (b.link?.isDataLinkOpen ? 1 : 0))[0]) ?? (taking ? owners.filter((other) => other !== live && other.stored.id !== this.activeLinkId && other.link?.canReleaseEndpoint(key) && now - (other.nativeTakenAt?.[key] ?? 0) >= 12e4).sort((a, b) => a.lastMessageAt - b.lastMessageAt)[0] : void 0);
 				const idle = victim || !taking || !this.reachedOnlyNatively(live) ? void 0 : owners.filter((other) => other !== live && !other.stored.group && other.stored.id !== this.activeLinkId && !this.fileDesk.moving(other.stored.id) && other.link?.canYieldEndpoint(key, 12e4)).sort((a, b) => a.link.lastActivityAt - b.link.lastActivityAt)[0];
 				const idleFor = idle ? now - idle.link.lastActivityAt : 0;
 				if (idle && await idle.link.yieldEndpoint(key, 12e4)) {
@@ -41922,7 +42882,7 @@ var GhostlyNode = class GhostlyNode {
 						active: this.activeLinkId === linkId
 					});
 					if (this.activeLinkId === linkId && !group) this.retryActiveSlot(linkId);
-					throw new Error("All eight native connection slots are in use. This chat takes one once a chat live over one has been quiet for 2 minutes. Disconnect a native connection in another chat to free one now.");
+					throw new Error("All native connection slots are in use. This chat takes one once a chat live over one has been quiet for 2 minutes. Disconnect a native connection in another chat to free one now.");
 				} else {
 					await victim.link.releaseEndpoint(key);
 					victim.transportErrors ??= {};
@@ -42072,7 +43032,8 @@ var GhostlyNode = class GhostlyNode {
 			...whole.file && {
 				file: whole.file,
 				text: whole.text
-			}
+			},
+			...whole.frame && { frame: whole.frame }
 		};
 		if (!Object.keys(added).length) return;
 		if (!await db.patchMessage(message.linkId, message.id, (stored) => {
@@ -42098,12 +43059,12 @@ var GhostlyNode = class GhostlyNode {
 			}
 		}
 		const onChanges = this.events.onMessageChanges;
-		if (!onChanges) return this.events.onMessages(linkId, await db.getMessages(linkId));
+		if (!onChanges) return this.events.onMessages(linkId, await this.getMessages(linkId));
 		const unique = [...new Set(ids)];
 		if (!unique.length) return;
 		const rows = await Promise.all(unique.map((id) => db.getMessage(linkId, id)));
 		onChanges.call(this.events, linkId, {
-			messages: rows.filter((row) => !!row),
+			messages: rows.filter((row) => !!row).map(withoutFrame),
 			deleted: unique.filter((_, i) => !rows[i])
 		});
 	}
@@ -42198,6 +43159,7 @@ var GhostlyNode = class GhostlyNode {
 			};
 		}
 		if (!await db.addMessage(message)) return false;
+		if (live && waitsForLive(message)) live.waitingSends?.then((known) => known.add(message.id), () => {});
 		this.clockSample(message);
 		const newest = this.newestAt.get(message.linkId);
 		if (!message.event) this.newestAt.set(message.linkId, Math.max(newest ?? 0, writtenAt(message, this.clockLeads.get(message.linkId))));
@@ -42574,4 +43536,4 @@ function signalKind(signal) {
 //#endregion
 export { EngineServer, hyperdhtRelayProblem as n, server_exports as t };
 
-//# sourceMappingURL=server-D5FBZYW8.js.map
+//# sourceMappingURL=server-DHMXMwNn.js.map