@ghostlytools/cli 1.2.2 → 1.2.4

package/dist/assets/{server-Cy4ox7oD.js → server-0zfNpABQ.js}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { $ as groupName, $c as sanitizeAvatar, $i as peekDhtMailbox, $o as HANDOFF_REQUEST, $r as isAppVersion, $s as deviceInviteJoinerParams, $t as EVM_TEST_CHAINS, A as encodeCommunityLink, Aa as readReaction, Ac as turnKeys, Ai as dialDescriptors, An as ENDPOINT, Ao as decodeControl, Ar as transferStalled, As as sealHandoffPiece, B as GroupWakeLimiter, Bc as withRequestOptions, Bi as newIdentityBinding, Bn as pairedMessageFrame, Br as pinIsNewer, C as openGroupTyping, Ca as GROUP_REACTION_FRAME, Cc as TURN_LAST_SEQUENCE, Co as RELAY_POLL_INTERVALS, Cr as readBeacon, Cs as readHandoffCancel, D as GROUP_READ_NOTE_COMMUNITY, Da as queueReaction, Dc as readTurnPacket, Di as CapsExchange, Do as parseLocalTarget, Dr as ChatFiles, Ds as readHandoffPake, E as CommunitySession, Ea as nextReactionNumber, Ec as nextTurnPosition, Eo as formatLocalTarget, Er as shouldBeHub, Es as readHandoffHello, F as knockIdentity, Fa as replySnippet, Fc as normalizeRelayUrl, Fi as IdentityExchange, Fn as parseCashuRequestPayload, Fr as typingActivity, Fs as setUpdateFrame, G as GROUP_READ_NOTE, Ga as checkStatusCard, Gi as emptyProofLedger, Go as HANDOFF_ACK, Gr as deviceWakeRequest, Gs as enrollDoneFrame, H as groupWakes, Hi as revokesIdentity, Hn as engineText, Ho as HTTP_SERVICE_PROTO, Hr as readPin, Hs as enrollCancelFrame, I as knockRecords, Ia as BUTTON_ID, In as parseFedimintRequestPayload, Is as signTombstone, Ja as arrivalKey, Jc as identityFromSeed, Ji as automaticTransport, Jn as groupFileFallback, Jo as HANDOFF_HAVE, Jr as relayRequest, Js as enrollProofFrame, Jt as encodeDidDhtDeactivated, K as GroupSession, Ka as sameButtonText, Ki as validExternalKey, Ko as HANDOFF_CANCEL, Kr as newWakeToken, Ks as enrollGrantFrame, Kt as didDhtDocument, L as mergeKnocks, Lc as traceLink, Li as emptyIdentityLedger, Ln as GhostLink, Lr as PIN_LIMITS, Ls as verifySetUpdate, M as decodeGroupEntryLink, Ma as wireReaction, Mc as DEFAULT_RELAYS, Mn as fedimintRequestPayload, N as encodeGroupEntryLink, Na as pairedReplyAuthor, Nc as RelayTransport, Ni as IDENTITY_REVOCATION_LABEL, Nn as findEndpoint, No as RTC_CONFIG, Nr as TypingSender, Ns as readSetUpdate, O as communityHasFrame, Oa as reactionEmoji, Oc as signTurnPacket, Oi as DHT_TEXT_CAPABILITY, Oo as webLocalFetch, Or as FILE_LIMITS, Os as readHandoffTurnFrame, P as entryParams, Pa as readReply, Pc as currentRelays, Pn as isFederationId, Ps as setAckFrame, Q as mentionsMember, Qa as shownTime, Qi as DHT_MESSAGE_TTL, Qo as HANDOFF_PIECE_BYTES, Qr as chatAppId, Qs as createDeviceInvite, Qt as ETHEREUM_USDT, R as readKnocks, Rc as budgetRetryMs, Ri as identityRevocationValue, Rn as INVITE_TAKEN, Rr as mayPin, S as groupTypingEpoch, Sa as COMMUNITY_REACTION_FRAME, Sc as turnPutSummary, Sr as rankHubs, Ss as readHandoffAck, T as COMMUNITY_LIMITS, Ta as ReactionWindow, Tc as firstDeviceSetSecret, To as GhostlyHttpError, Tr as readLobby, Ts as readHandoffHave, U as parseGroupWakeFrame, Uc as createRelayPayload, Ui as lastSharedWithMe, Un as GROUP_FILE_LIMITS, Uo as LEGACY_SERVICES, Ur as WAKE_CALL_INTERVAL_MS, Us as enrollCancelReason, V as groupWakeFrame, Va as STATUS_CARD_LIMITS, Vc as PacketTooLargeError, Vi as receivedIdentityStatus, Vn as engineError, Vo as emptyLinkRecords, Vr as pinNumberHolds, Wi as PeerProofs, Wo as serviceIdFromName, Wr as WakeLimiter, Ws as enrollDigits, X as carryMentions, Xa as heardTime, Xc as publicKeyFromZ32, Xn as readGroupFileMeta, Xo as HANDOFF_OFFER, Xr as checkPushEndpoint, Xs as readEnrollHello, Y as GROUP_EDIT_TEXT_BYTES, Ya as claimedTime, Yc as identityFromSeedB64, Yo as HANDOFF_HELLO, Yr as wakeRequest, Ys as readEnrollGrant, Yt as encodeDidDhtPacket, Z as parseCommunityEdit, Za as receivedTimestamp, Zc as verify, Zo as HANDOFF_PAKE, Zr as vapidKeysMatch, Zs as verifyEnrollProof, Zt as signDidDhtPacket, _a as RateWindow, _c as webCryptoSigner, _o as rosterHas, _r as lobbyRecords, _s as handoffReleaseFrame, a as planAppUpdate, aa as safeBlobType, ai as HOLD_CAPABILITY, al as utf8Decode, an as USDT_PUBLIC_RPC, ao as isAppRef, ar as groupSignalFrame, as as handoffAttemptSucceeded, ba as forwardedAgain, bc as TURN_SETTLE_MS, bo as DirectPathWatch, br as newerHead, bs as handoffVersions, bt as normalizeAtprotoHandle, cc as ENROLL_CAPABILITY, ci as HoldKeys, cn as assertWholeSats, cr as mayBeHub, cs as handoffContext, d as APP_BUNDLE_LIMITS, da as fileMessageText, dc as deviceEchoNonce, di as newMailbox, dn as walletNetworkOf, dr as COMMUNITY_TOPOLOGY, ds as handoffDigest, ea as DHT_FILE_CAPABILITY, ec as readDeviceInvite, ei as APPS_CAPABILITY, el as bytesEqual, en as ONCHAIN_PROVIDER, eo as APP_STATEMENT_LIMITS, er as CarriedTransport, es as HANDOFF_TIMINGS, f as APP_BUNDLE_MAGIC, fa as parseVoiceMeta, fc as deviceKeyZ32, fi as readManifest, fn as SPARK_NETWORKS, fo as readCanonicalJson, fr as beaconKeys, fs as handoffEphemeral, ga as EDIT_RATE_WINDOW_MS, gc as seedSigner, gn as isBitcoinAddress, go as commitHash, gr as lobbyKeys, gs as handoffPakeFrame, h as appViewOf, ha as EDIT_BUFFER_MS, hc as newDeviceSetSecret, hn as sparkInvoiceDetails, ho as MEMBER_KEY, hr as freshHubs, hs as handoffOfferFrame, i as checkAppBeforeRun, ia as formatFileSize, ic as encodeInviteCode, ii as UPGRADE_CAPABILITY, il as toZ32, in as TEST_USDT_FAUCET_AMOUNT, io as isAppKey, is as handoffAttemptFailed, ja as validReactionNumber, jc as turnName, jn as cashuRequestPayload, jo as encodeControl, k as decodeCommunityLink, ka as reactionIsNewer, kc as signTurnRelease, ki as capsDescriptors, kn as decodeBolt11, ko as LIMITS, kr as transferEnded, ks as readHandoffVerified, l as readAppStoreSteps, lc as HANDOFF_CAPABILITY, li as HoldRefusedError, ln as formatPaymentAmount, lr as meshHubs, ls as handoffContextProof, m as appDigest, ma as parseVideoMeta, mc as devicePingFrame, mn as sparkAddressKind, mr as doorHubs, ms as handoffManifestFrames, n as appStoreDecision, na as parseImageMeta, nc as createChatInvite, ni as EDIT_CAPABILITY, nl as randomBytes, nn as SEPOLIA_TEST_USDT, no as appRef, ns as filePartName, o as APP_STORE_LIMITS, oa as sanitizeFileName, oc as inviteOwnership, oi as HOLD_DATED_BACK_MS, ol as utf8Encode, on as WALLET_NETWORKS, oo as readAppRevocation, or as readGroupSignal, os as handoffBusyFrame, pc as deviceLinkPairing, pn as SPARK_PROVIDER, po as GROUP_MEMBER_CAP, pr as beaconRecords, ps as handoffHelloFrame, qa as statusCardText, qc as createIdentity, qi as TRANSPORTS, qo as HANDOFF_DONE, qr as parseWakeFrame, qs as enrollHelloFrame, qt as didDhtFromPublicKey, r as appUpdateDecision, rc as decodeInviteCode, ri as STATUS_CARD_CAPABILITY, rl as toBase64Url, rs as handoffAttemptAllowed, sa as sanitizeMime, sc as DEVICES_CAPABILITY, si as HOLD_LIMITS, sn as assertTokenUnits, sr as MESH_HUBS, ss as handoffCancelFrame, t as appRevocationFor, ta as dhtFileId, tc as OwnInviteError, ti as BUTTONS_CAPABILITY, tl as fromBase64Url, tn as PaymentPreflightError, to as appFingerprint, ts as HANDOFF_VERIFIED, uc as deviceEchoFrame, ui as isHoldUrl, un as validatePaymentTarget, uo as canonicalJson, ur as pickMeshHubs, us as handoffDataFrame, v as isAppUrl, va as dhtEditId, vn as isPubkyKey, vo as verifyCommitSignature, vr as mergeBeacon, vs as handoffRetryAfter, w as sealGroupTyping, wa as REACTION_LIMITS, wc as TURN_MAX, wo as presenceSeenAt, wr as readBeaconHead, ws as readHandoffDone, x as GroupTypingBoard, xa as readForwarded, xc as classifyTurnRead, xo as DHT_POLL_INTERVALS, xr as pickHubs, xs as newHandoffId, y as readAppBundle, ya as parseLinkPreview, yc as TURN_RAISE_READ_TIMEOUT_MS, yo as edgeParams, yr as mergeLobby, ys as handoffStreamKey, yt as isAtprotoDid, zc as isDiscoveryBudgetError, zi as identityStatement, zn as LIVENESS_PING_MS, zo as parseCallSignal, zr as nextPinNumber } from "./src-XzcHzneo.js";
+import { $ as parseCommunityEdit, $a as receivedTimestamp, $c as identityFromSeed, $o as HANDOFF_PAKE, $r as vapidKeysMatch, $s as verifyEnrollProof, $t as signDidDhtPacket, A as encodeCommunityLink, Aa as reactionEmoji, Ac as signTurnPacket, Ai as DHT_TEXT_CAPABILITY, Ao as webLocalFetch, Ar as FILE_LIMITS, As as readHandoffTurnFrame, B as GroupWakeLimiter, Bc as normalizeRelayUrl, Bi as identityRevocationValue, Bn as INVITE_TAKEN, Br as mayPin, C as openGroupTyping, Ca as readForwarded, Cc as classifyTurnRead, Co as DHT_POLL_INTERVALS, Cr as pickHubs, Cs as newHandoffId, D as GROUP_READ_NOTE_COMMUNITY, Da as ReactionWindow, Dc as firstDeviceSetSecret, Do as GhostlyHttpError, Dr as readLobby, Ds as readHandoffHave, E as CommunitySession, Ea as REACTION_LIMITS, Ec as TURN_MAX, Eo as presenceSeenAt, Er as readBeaconHead, Es as readHandoffDone, F as knockIdentity, Fa as pairedReplyAuthor, Fc as turnStatedVerifier, Fi as IDENTITY_REVOCATION_LABEL, Fn as findEndpoint, Fo as RTC_CONFIG, Fr as TypingSender, Fs as readSetUpdate, Gc as withRequestOptions, Gi as lastSharedWithMe, Gn as GROUP_FILE_LIMITS, Go as LEGACY_SERVICES, Gr as WAKE_CALL_INTERVAL_MS, Gs as enrollCancelReason, H as groupWakes, Hc as traceLink, Hi as newIdentityBinding, Hn as pairedMessageFrame, Hr as pinIsNewer, I as knockRecords, Ia as readReply, Ic as turnVerifierMark, In as isFederationId, Is as setAckFrame, J as frameBytes, Ja as sameButtonText, Jc as createRelayPayload, Ji as validExternalKey, Jo as HANDOFF_CANCEL, Jr as newWakeToken, Js as enrollGrantFrame, Jt as didDhtDocument, K as GROUP_READ_NOTE, Kc as PacketTooLargeError, Ki as PeerProofs, Ko as serviceIdFromName, Kr as WakeLimiter, Ks as enrollDigits, L as mergeKnocks, La as replySnippet, Lc as DEFAULT_RELAYS, Li as IdentityExchange, Ln as parseCashuRequestPayload, Lr as typingActivity, Ls as setUpdateFrame, M as decodeGroupEntryLink, Ma as readReaction, Mc as turnInstance, Mi as dialDescriptors, Mn as ENDPOINT, Mo as decodeControl, Mr as transferStalled, Ms as sealHandoffPiece, N as encodeGroupEntryLink, Na as validReactionNumber, Nc as turnKeys, Nn as cashuRequestPayload, No as encodeControl, O as communityHasFrame, Oa as nextReactionNumber, Oc as nextTurnPosition, Oo as formatLocalTarget, Or as shouldBeHub, Os as readHandoffHello, P as entryParams, Pa as wireReaction, Pc as turnName, Pn as fedimintRequestPayload, Q as carryMentions, Qa as heardTime, Qc as createIdentity, Qn as readGroupFileMeta, Qo as HANDOFF_OFFER, Qr as checkPushEndpoint, Qs as readEnrollHello, R as readKnocks, Ra as BUTTON_ID, Rc as RelayTransport, Rn as parseFedimintRequestPayload, Rs as signTombstone, S as groupTypingEpoch, Sa as forwardedAgain, Sc as TURN_SETTLE_MS, So as DirectPathWatch, Sr as newerHead, Ss as handoffVersions, St as normalizeAtprotoHandle, T as COMMUNITY_LIMITS, Ta as GROUP_REACTION_FRAME, Tc as TURN_LAST_SEQUENCE, To as RELAY_POLL_INTERVALS, Tr as readBeacon, Ts as readHandoffCancel, U as parseGroupWakeFrame, Ua as STATUS_CARD_LIMITS, Uc as budgetRetryMs, Ui as receivedIdentityStatus, Un as engineError, Uo as emptyLinkRecords, Ur as pinNumberHolds, V as groupWakeFrame, Vi as identityStatement, Vn as LIVENESS_PING_MS, Vo as parseCallSignal, Vr as nextPinNumber, W as GROUP_LIMITS, Wc as isDiscoveryBudgetError, Wi as revokesIdentity, Wn as engineText, Wo as HTTP_SERVICE_PROTO, Wr as readPin, Ws as enrollCancelFrame, Xa as arrivalKey, Xi as automaticTransport, Xn as groupFileFallback, Xo as HANDOFF_HAVE, Xr as relayRequest, Xs as enrollProofFrame, Xt as encodeDidDhtDeactivated, Ya as statusCardText, Yi as TRANSPORTS, Yo as HANDOFF_DONE, Yr as parseWakeFrame, Ys as enrollHelloFrame, Yt as didDhtFromPublicKey, Z as GROUP_EDIT_TEXT_BYTES, Za as claimedTime, Zo as HANDOFF_HELLO, Zr as wakeRequest, Zs as readEnrollGrant, Zt as encodeDidDhtPacket, _a as EDIT_BUFFER_MS, _c as newDeviceSetSecret, _n as sparkInvoiceDetails, _o as MEMBER_KEY, _r as freshHubs, _s as handoffOfferFrame, a as planAppUpdate, ac as decodeInviteCode, ai as STATUS_CARD_CAPABILITY, al as bytesEqual, as as handoffAttemptAllowed, ba as dhtEditId, bn as isPubkyKey, bo as verifyCommitSignature, br as mergeBeacon, bs as handoffRetryAfter, ca as sanitizeFileName, cc as inviteOwnership, ci as HOLD_DATED_BACK_MS, cl as toBase64Url, cn as WALLET_NETWORKS, co as readAppRevocation, cr as readGroupSignal, cs as handoffBusyFrame, d as APP_BUNDLE_LIMITS, dc as HANDOFF_CAPABILITY, di as HoldRefusedError, dl as utf8Encode, dn as formatPaymentAmount, dr as meshHubs, ds as handoffContextProof, ea as DHT_MESSAGE_TTL, ec as createDeviceInvite, ei as chatAppId, el as identityFromSeedB64, en as ETHEREUM_USDT, eo as shownTime, es as HANDOFF_PIECE_BYTES, et as mentionsMember, f as APP_BUNDLE_MAGIC, fc as deviceEchoFrame, fi as isHoldUrl, fn as validatePaymentTarget, fo as canonicalJson, fr as pickMeshHubs, fs as handoffDataFrame, ga as parseVideoMeta, gc as devicePingFrame, gn as sparkAddressKind, gr as doorHubs, gs as handoffManifestFrames, h as appViewOf, hc as deviceLinkPairing, hn as SPARK_PROVIDER, ho as GROUP_MEMBER_CAP, hr as beaconRecords, hs as handoffHelloFrame, i as checkAppBeforeRun, ia as parseImageMeta, ic as createChatInvite, ii as EDIT_CAPABILITY, il as sanitizeAvatar, in as SEPOLIA_TEST_USDT, io as appRef, is as filePartName, ja as reactionIsNewer, jc as signTurnRelease, ji as capsDescriptors, jn as decodeBolt11, jo as LIMITS, jr as transferEnded, js as readHandoffVerified, k as decodeCommunityLink, ka as queueReaction, kc as readTurnPacket, ki as CapsExchange, ko as parseLocalTarget, kr as ChatFiles, ks as readHandoffPake, l as readAppStoreSteps, la as sanitizeMime, lc as DEVICES_CAPABILITY, li as HOLD_LIMITS, ll as toZ32, ln as assertTokenUnits, lr as MESH_HUBS, ls as handoffCancelFrame, m as appDigest, ma as parseVoiceMeta, mc as deviceKeyZ32, mi as readManifest, mn as SPARK_NETWORKS, mo as readCanonicalJson, mr as beaconKeys, ms as handoffEphemeral, n as appStoreDecision, na as DHT_FILE_CAPABILITY, nc as readDeviceInvite, ni as APPS_CAPABILITY, nl as verify, nn as ONCHAIN_PROVIDER, no as APP_STATEMENT_LIMITS, nr as CarriedTransport, ns as HANDOFF_TIMINGS, o as APP_STORE_LIMITS, oa as formatFileSize, oc as encodeInviteCode, oi as UPGRADE_CAPABILITY, ol as fromBase64Url, on as TEST_USDT_FAUCET_AMOUNT, oo as isAppKey, os as handoffAttemptFailed, pa as fileMessageText, pc as deviceEchoNonce, pi as newMailbox, pn as walletNetworkOf, pr as COMMUNITY_TOPOLOGY, ps as handoffDigest, q as GroupSession, qa as checkStatusCard, qi as emptyProofLedger, qo as HANDOFF_ACK, qr as deviceWakeRequest, qs as enrollDoneFrame, r as appUpdateDecision, ra as dhtFileId, rc as OwnInviteError, ri as BUTTONS_CAPABILITY, rn as PaymentPreflightError, ro as appFingerprint, rs as HANDOFF_VERIFIED, sa as safeBlobType, si as HOLD_CAPABILITY, sl as randomBytes, sn as USDT_PUBLIC_RPC, so as isAppRef, sr as groupSignalFrame, ss as handoffAttemptSucceeded, t as appRevocationFor, ta as peekDhtMailbox, tc as deviceInviteJoinerParams, ti as isAppVersion, tl as publicKeyFromZ32, tn as EVM_TEST_CHAINS, ts as HANDOFF_REQUEST, tt as groupName, uc as ENROLL_CAPABILITY, ui as HoldKeys, ul as utf8Decode, un as assertWholeSats, ur as mayBeHub, us as handoffContext, v as isAppUrl, va as EDIT_RATE_WINDOW_MS, vc as seedSigner, vn as isBitcoinAddress, vo as commitHash, vr as lobbyKeys, vs as handoffPakeFrame, w as sealGroupTyping, wa as COMMUNITY_REACTION_FRAME, wc as turnPutSummary, wr as rankHubs, ws as readHandoffAck, x as GroupTypingBoard, xa as parseLinkPreview, xc as TURN_RAISE_READ_TIMEOUT_MS, xo as edgeParams, xr as mergeLobby, xs as handoffStreamKey, xt as isAtprotoDid, y as readAppBundle, ya as RateWindow, yc as webCryptoSigner, yo as rosterHas, yr as lobbyRecords, ys as handoffReleaseFrame, zc as currentRelays, zi as emptyIdentityLedger, zn as GhostLink, zr as PIN_LIMITS, zs as verifySetUpdate } from "./src-CbLkHfz8.js";
 import { a as clearProfileStores, c as fileStore, d as profileOpenFailure, f as store, i as STORES$1, l as newestWalletTx, m as wrap, n as APP_STORAGE_SCOPE_INDEX, o as databaseName, p as transact, r as CARD_INDEX, s as deleteDatabase, t as APP_STORAGE_CHAT_INDEX, u as openDb } from "./idb-CTF6LF5B.js";
 import { a as fileBytesOf, c as removeFileBytes, i as fileBytes, l as FILE_BYTES_STEP, n as blobDigest } from "./fileBytes-BcYZhNgF.js";
 import { $ as BACKUP_MEDIA_TYPE, A as requireTurn, At as paymentWireId, B as networkLabel, C as breezDatabasesFor, Ct as storedGroupFiles, D as sourceKey, Dt as replyRef, E as ProviderSources, Et as receivedPairedReply, F as sealSeed, Ft as streamStored, G as BITCOIN_INVOICE_ON_TESTNET, H as cashuMint, I as unsealSeed, J as fakesLightning, K as DEFAULT_MINTS, L as ModeChanged, M as setSingleWriterGate, Mt as readStored$1, N as intentRepository, Nt as removeStored, O as awayFrom, Ot as replyTo, P as newDeviceKey, Pt as storedSize, Q as paysItsOwnInvoices, R as ModeGate, S as breezDatabaseInUse, St as groupOfFile, T as lightningPaying, Tt as pairedWireReply, V as CASHU_MINT_SOURCE, W as WALLET_TYPES, X as isWorthlessMint, Y as isTestMint, Z as mintNetwork, _ as LightningCards, _t as verifyIdentity, a as irohRelayProblem, at as reserveAdapterIds, b as normalizePhrase, bt as groupFileId, c as createFailure, ct as SourceConfigError, d as paymentNetwork, dt as networkMode, et as MAX_BACKUP_BYTES, f as paymentNetworksOf, ft as redact, g as CASHU_CARD, gt as boundedIdentityFetch, ht as setOwnDidSource, i as createIrohWebEndpoint, it as registeredOnchainProviders, j as setAwayWallets, jt as FileAppender, k as refuseAway, kt as paymentAlias, l as createTiming, lt as SourceUnreachableError, mt as resolveAtprotoDid, n as loadFedimintSdk, nt as onAdaptersChanged, o as WALLET_NAMES, ot as NothingSpentError, p as walletInstances, pt as assertPublicServer, q as TEST_MINT, r as DEFAULT_IROH_RELAYS, rt as registeredLightningProviders, s as assertConfirmedReal, st as PROVIDER_PLATFORMS, t as fedimintDatabase, tt as identityProviders, u as crossNetwork, ut as isNothingSpentError, v as cardsKey, vt as chosenResolver, w as dropBreezDatabase, wt as groupReply, x as breezDatabase, xt as groupFileText, y as isRecoveryPhrase, yt as GroupFileDesk, z as WrongNetworkError } from "../ghostly.mjs";
@@ -180,7 +180,7 @@ async function migrateWalletNetworks(now = Date.now()) {
 //#endregion
 //#region ../browser/src/engine/paymentAdapters/usdtWallet.ts
 /** The Ethereum libraries, a large part of the app: loaded once a USDT wallet is made, opened or restored, not with the engine. */
-var loadUsdt = () => import("./usdt-Deo3g0Nq.js");
+var loadUsdt = () => import("./usdt-Qf4UuygS.js");
 /** Every new profile starts with this wallet: an address to receive on, nothing to set up. */
 var DEFAULT_USDT = {
 	network: "ethereum",
@@ -642,7 +642,7 @@ async function restoreArkDatabase(walletId, snapshot) {
 //#endregion
 //#region ../browser/src/engine/paymentAdapters/arkWallet.ts
 /** The Ark SDK, a large part of the app: loaded once an Ark wallet is made, opened or restored, not with the engine. */
-var loadArkade = () => import("./arkade-_gS9wShF.js");
+var loadArkade = () => import("./arkade-CdnKGDbg.js");
 /** How long a Testnet wallet about to make way for another waits for its server to say what it holds. */
 var RETIRE_READ_MS = 1e4;
 /** Every new profile starts with this wallet: nothing to set up before receiving. */
@@ -11159,7 +11159,13 @@ var APP_STORAGE_LIMITS = {
 	keyBytes: 256,
 	/** A value, as compact JSON in UTF-8 bytes. */
 	valueBytes: 65536,
-	/** Every key and value of one app in one scope. */
+	/**
+	* Counted for each key beside its own bytes and its value's: what the row costs on the device (the app's reference,
+	* the scope and the key again, in the row's own key and in its two indexes). Without it a scope of one-byte values
+	* held 20 times its 5 MiB.
+	*/
+	rowBytes: 128,
+	/** Every key and value of one app in one scope, with `rowBytes` for each key. */
 	scopeBytes: 5242880
 };
 var APP_CHECK_TIMINGS = {
@@ -11186,6 +11192,8 @@ var STAGED = {
 /** The first bytes of a bundle: magic, the manifest's length and the largest manifest. */
 var PEEK_BYTES = APP_BUNDLE_MAGIC.length + 4 + APP_BUNDLE_LIMITS.manifestBytes;
 var bundleId = (digest) => `app-${digest}`;
+/** What a row takes of its scope's 5 MiB: its key and value, and `rowBytes`. Not kept in the row, so rows from before count alike. */
+var costOf = (row) => APP_STORAGE_LIMITS.rowBytes + row.size;
 /**
 * A listing's URLs this client reads, in order, a jsDelivr copy first: one this client reads names a full commit, so it
 * holds exactly the version the store reviewed, where a raw `HEAD` may have moved on to one it has not (WISP 1200 §
@@ -11257,7 +11265,7 @@ function peekAppManifest(bytes) {
 var Apps = class {
 	host;
 	staged = /* @__PURE__ */ new Map();
-	/** Bundles read back and checked, by digest: the one running is read once, not on every `file`. */
+	/** Bundles read back and checked, by digest, least recently used first: the ones running are read once, not on every `file`. */
 	verified = /* @__PURE__ */ new Map();
 	/** Reads of a bundle under way, by digest: icons drawn at once share one read. */
 	verifying = /* @__PURE__ */ new Map();
@@ -11591,7 +11599,11 @@ var Apps = class {
 	/** The installed bundle read back and checked again before it runs (WISP 1200 § Signatures: "again before it runs one"). */
 	verifiedBundle(app) {
 		const kept = this.verified.get(app.digest);
-		if (kept) return Promise.resolve(kept);
+		if (kept) {
+			this.verified.delete(app.digest);
+			this.verified.set(app.digest, kept);
+			return Promise.resolve(kept);
+		}
 		const under = this.verifying.get(app.digest);
 		if (under) return under;
 		const reading = (async () => {
@@ -11599,8 +11611,9 @@ var Apps = class {
 			if (!bytes) fail("needs-files", "This app's files are not on this device yet");
 			const read = readAppBundle(bytes);
 			if (!read.ok || read.bundle.digest !== app.digest) fail("damaged", "This app's stored files do not match what was installed");
-			if (this.verified.size >= 2) this.verified.delete(this.verified.keys().next().value);
 			this.verified.set(app.digest, read.bundle);
+			const room = Math.max(2, this.started.size + (this.started.has(app.ref) ? 0 : 1));
+			while (this.verified.size > room) this.verified.delete(this.verified.keys().next().value);
 			this.icons.set(app.digest, read.bundle.files.get("icon.png")?.slice() ?? null);
 			return read.bundle;
 		})().finally(() => {
@@ -12132,13 +12145,14 @@ var Apps = class {
 						maxBytes: PEEK_BYTES,
 						peek: true
 					}));
-					if (peek && newer(peek)) candidates.set(url, {});
+					if (peek && newer(peek)) candidates.set(url, { holds: peek });
 				} catch {}
 			}
 			const revokeRead = /* @__PURE__ */ new Set();
 			const before = await this.readRevocations(app.ref, [app.from, ...app.manifest.sources ?? []], revokeRead);
 			app = withRevocations(app, before ?? []);
 			for (const [url, want] of candidates) {
+				let holds = want.holds;
 				if (want.peek) {
 					let peek;
 					try {
@@ -12153,7 +12167,10 @@ var Apps = class {
 						if (want.miss) this.listingMisses.set(...want.miss);
 						continue;
 					}
+					holds = peek;
 				}
+				const twin = holds && (holds.sequence === app.sequence || holds.sequence === app.pending?.sequence);
+				if (holds && !twin && this.runStatus(holds, this.storeViews(stores), app.revocations).status !== "ok") continue;
 				let fetched;
 				try {
 					fetched = await this.fetchBundle(url);
@@ -12339,7 +12356,10 @@ var Apps = class {
 			entry: utf8Decode(entry)
 		};
 	}
-	/** A file of the installed bundle, for the broker's `file` (`ghostly.file(path)`). `digest`: the version the frame runs. */
+	/**
+	* A file of the installed bundle, for the broker's `file` (`ghostly.file(path)`): a copy, which the broker transfers to
+	* the app as it is. `digest`: the version the frame runs.
+	*/
 	async file({ ref, path, digest }) {
 		const app = path === "icon.png" ? await this.installedOrFail(ref) : await this.runningOrFail(ref, digest);
 		if (path !== "icon.png" && digest !== void 0 && digest !== app.digest) fail("no-file", "No such file in this app");
@@ -12435,7 +12455,7 @@ var Apps = class {
 		const id = `${ref}\0${scope}`;
 		let used = this.usage.get(id);
 		if (used === void 0) {
-			used = (await wrap((await store(STORES$1.appStorage, "readonly")).index(APP_STORAGE_SCOPE_INDEX).getAll([ref, scope]))).reduce((sum, r) => sum + r.size, 0);
+			used = (await wrap((await store(STORES$1.appStorage, "readonly")).index(APP_STORAGE_SCOPE_INDEX).getAll([ref, scope]))).reduce((sum, r) => sum + costOf(r), 0);
 			this.usage.set(id, used);
 		}
 		return used;
@@ -12449,7 +12469,11 @@ var Apps = class {
 		]));
 		return row ? { value: JSON.parse(row.value) } : null;
 	}
-	/** Keeps a JSON value under a key: at most 64 KiB, and 5 MiB for every key of this app in this scope. */
+	/**
+	* Keeps a JSON value under a key: at most 64 KiB, and 5 MiB for every key of this app in this scope, each counted
+	* with `rowBytes`. A scope already past that (filled before a key counted `rowBytes`) still takes a write that does
+	* not grow it, so the app can make room.
+	*/
 	async storageSet({ ref, scope, key, value, digest }) {
 		const app = await this.runningOrFail(ref, digest);
 		const where = this.scopeOf(scope), name = this.keyOf(key);
@@ -12466,12 +12490,13 @@ var Apps = class {
 		await this.serial(`${app.ref}\0${where}`, async () => {
 			const used = await this.usageOf(app.ref, where);
 			const rows = await store(STORES$1.appStorage, "readonly");
-			const next = used - ((await wrap(rows.get([
+			const old = await wrap(rows.get([
 				app.ref,
 				where,
 				name
-			])))?.size ?? 0) + size;
-			if (next > APP_STORAGE_LIMITS.scopeBytes) fail("full", "This app's storage in this chat is full (5 MiB)");
+			]));
+			const next = used - (old ? costOf(old) : 0) + APP_STORAGE_LIMITS.rowBytes + size;
+			if (next > APP_STORAGE_LIMITS.scopeBytes && next > used) fail("full", "This app's storage in this chat is full (5 MiB)");
 			const writing = await store(STORES$1.appStorage, "readwrite");
 			if (where !== "alone" && !this.host.isChat(where)) {
 				this.usage.delete(`${app.ref}\0${where}`);
@@ -12503,7 +12528,7 @@ var Apps = class {
 				where,
 				name
 			]));
-			this.usage.set(`${app.ref}\0${where}`, used - old.size);
+			this.usage.set(`${app.ref}\0${where}`, used - costOf(old));
 		});
 	}
 	async storageKeys({ ref, scope, digest }) {
@@ -14058,6 +14083,23 @@ function takeoverTurn(record, read) {
 	if (highest + 1 > TURN_MAX) throw new TurnClosedError();
 	return highest + 1;
 }
+/**
+* The `instance` of the record a device writes as the active one: it states the mark of the verifier beside its device
+* state (`turnInstance`, WISP 06 § Record), which on an active device is the profile's. `unstated`: a handoff's taker,
+* whose device state does not hold the verifier of the profile it just installed; it states it once its engine runs.
+*/
+function instanceFor(record, unstated = false) {
+	return turnInstance(unstated ? null : turnVerifierMark(record.verifier ?? null));
+}
+/**
+* The last record of the device set this device knows after a read: the one the sources returned when it is above
+* the packet it stored, else the stored one. A lower record (`behind`) and a tombstone say nothing here.
+*/
+function latestKnown(read, stored) {
+	const news = (read.result === "other" || read.result === "clone" || read.result === "mine") && read.record && !read.record.tombstone ? read.record : null;
+	if (!news) return stored;
+	return !stored || news.sequence >= stored.sequence ? news : stored;
+}
 /** The record's slots as the device state keeps them. */
 function deviceSetOf(record) {
 	return record.slots.map((slot) => slot && {
@@ -14253,7 +14295,7 @@ var TurnKeeper = class {
 			author: ownSlot,
 			active: ownSlot,
 			slots,
-			instance: (this.options.instance ?? (() => randomBytes(8)))(),
+			instance: this.options.instance?.() ?? instanceFor(record, !!options.release),
 			...release ? { release } : {}
 		};
 		const payload = await signTurnPacket(keys, fields, this.options.signer);
@@ -14274,6 +14316,31 @@ var TurnKeeper = class {
 		return this.put(held, payload, conditions, raising);
 	}
 	/**
+	* The active device says which verifier the profile has now (WISP 06 § Record, the verifier mark): when the record it
+	* stored states another one (the lock password changed, or the record was written before the verifier was at hand),
+	* it reads, and on `mine` or `none` writes its next record. True when the stored record states it (already, or now
+	* written); false when nothing was written (not the active device, no good read, another device's record there: the
+	* next check or start settles that, and every start writes a record anyway). Null for a `single` profile.
+	*/
+	stateVerifier() {
+		return this.exclusive(async () => {
+			const held = await this.held();
+			if (!held) return null;
+			if (held.record.state !== "active" || !held.wrote || !held.storedRecord) return false;
+			const stated = turnStatedVerifier(held.storedRecord.instance);
+			if (stated && bytesEqual(stated, turnVerifierMark(held.record.verifier ?? null))) return true;
+			const read = await this.readWith(held);
+			if (!read.good || read.result !== "mine" && read.result !== "none") return false;
+			try {
+				await this.writeWith(held, conditionsAfter(read, read.result === "none" ? "none" : "seen"));
+			} catch (error) {
+				if (error instanceof TurnClosedError) return false;
+				throw error;
+			}
+			return true;
+		});
+	}
+	/**
 	* A forced takeover (WISP 06 § Settle): reads the turn, makes the device `taking` (with the state it had, to go
 	* back to), writes the record of `turn` with no release within `P` of that read, and settles as every device that
 	* raises the turn does. `start` says it is the active device now; `gated` that it lost and is what it was before.
@@ -14287,6 +14354,7 @@ var TurnKeeper = class {
 			if (prior !== "standby" && prior !== "superseded") throw new Error(`A ${prior} device does not force a takeover`);
 			const read = await this.readWith(held, true);
 			if (!read.good || read.result === "tombstone") return this.settle(held, read, true);
+			options.before?.(latestKnown(read, held.storedRecord));
 			const turn = options.turn ?? takeoverTurn(held.record, read);
 			const stopping = held.record.activeSlot !== void 0 && held.record.activeSlot !== held.ownSlot ? held.record.deviceSet[held.record.activeSlot]?.key : void 0;
 			held.record = await this.store.move(this.options.profile, "taking", { handoff: {
@@ -14296,8 +14364,8 @@ var TurnKeeper = class {
 			} });
 			try {
 				await this.writeWith(held, read.conditions, {
-					...options,
-					turn
+					turn,
+					...options.slots ? { slots: options.slots } : {}
 				}, true);
 			} catch (error) {
 				if (!held.wroteNow) held.record = await this.store.move(this.options.profile, prior, {
@@ -15066,7 +15134,7 @@ var EnrollInviter = class extends Enrollment {
 				rev: 0,
 				author: 0,
 				active: 0,
-				instance: randomBytes(8),
+				instance: turnInstance(),
 				slots: granted.slots.map((slot) => slot && {
 					key: slot.key,
 					name: slot.name
@@ -15844,7 +15912,7 @@ async function planSetMove(record, signer, options = {}) {
 		author: record.ownSlot,
 		active: record.ownSlot,
 		slots: turnSlots,
-		instance: random(8)
+		instance: turnInstance(turnVerifierMark(record.verifier ?? null), random)
 	}, sign);
 	const update = {
 		d,
@@ -16067,6 +16135,21 @@ function takeoverTarget(record) {
 function canTakeOver(record) {
 	return !!record && (record.state === "standby" || record.state === "superseded") && !!record.copy;
 }
+/**
+* Whether the verifier this standby keeps is still the profile's, by the last record of the device set it knows (the
+* one just read, or the one it stored): false only when that record states the mark of another verifier. A record that
+* states none (an app from before wrote it) leaves the device with what it has, and so does this device's own record.
+* Only a standby is held to it: a device replaced by a takeover it did not want takes the turn back with the password
+* it knows, whatever the device that replaced it states.
+*/
+function verifierStands(record, latest) {
+	if (record.state !== "standby" || !record.verifier || !latest || latest.tombstone) return true;
+	const own = record.ownSlot === void 0 ? void 0 : record.deviceSet[record.ownSlot]?.key;
+	const author = latest.slots[latest.author];
+	if (own && author && bytesEqual(author.key, fromBase64Url(own))) return true;
+	const stated = turnStatedVerifier(latest.instance);
+	return !stated || bytesEqual(stated, turnVerifierMark(record.verifier));
+}
 var sameName = (a, b) => a.normalize("NFC").trim().toLocaleLowerCase() === b.normalize("NFC").trim().toLocaleLowerCase();
 /**
 * Checks the request and forces the takeover. Resolves to the keeper's outcome: `start` when this device is the active
@@ -16093,7 +16176,9 @@ async function forceTakeover(ports, request) {
 	if (record.takeoverAttempts && (record.takeoverAttempts.total > 0 || record.takeoverAttempts.recent.length)) await ports.amend({ takeoverAttempts: handoffAttemptSucceeded() });
 	const keeper = await ports.keeper();
 	if (!keeper) throw new TakeoverRefusal("offline", "Go online to take over.");
-	const outcome = await keeper.raise();
+	const outcome = await keeper.raise({ before: (latest) => {
+		if (!verifierStands(record, latest)) throw new TakeoverRefusal("changed", `The lock password was changed${target ? ` on ${target}` : ""}. Use here moves the profile with the new one.`);
+	} });
 	if (!outcome) throw new TakeoverRefusal("state", "This profile has no device set.");
 	return outcome;
 }
@@ -16182,7 +16267,7 @@ async function planOwnSet(record, ports, under) {
 		author: record.ownSlot,
 		active: record.ownSlot,
 		slots,
-		instance: random(8)
+		instance: turnInstance(turnVerifierMark(record.verifier ?? null), random)
 	}, ports.signer);
 	return {
 		d: toBase64Url(d),
@@ -16420,6 +16505,10 @@ function isHandoffVerifier(value) {
 	const v = value;
 	return !!v && typeof v === "object" && v.v === 1 && typeof v.setup === "string" && B64URL.test(v.setup) && typeof v.record === "string" && B64URL.test(v.record);
 }
+/** Loads the password proof. Throws when it cannot be loaded: nothing can then be made or checked (`provesHandoffPassword` says false). */
+async function handoffPakeReady() {
+	await opaque();
+}
 /** A verifier for this password: both halves of the registration, run on this device. */
 async function makeHandoffVerifier(password) {
 	if (!password) throw new Error("A password is needed");
@@ -19985,6 +20074,14 @@ function forgetWallet(records, id) {
 	return rest;
 }
 //#endregion
+//#region ../browser/src/shared/messageChanges.ts
+/** A row as a page gets it: without the frame a private group's message came in (`StoredMessage.frame`), which only the engine reads. */
+function withoutFrame(message) {
+	if (message.frame === void 0) return message;
+	const { frame: _frame, ...row } = message;
+	return row;
+}
+//#endregion
 //#region ../browser/src/shared/buttons.ts
 /** The buttons of a message, when it has any. */
 function messageButtons(message) {
@@ -21241,6 +21338,8 @@ function newestMessages(index, query, count) {
 		};
 	});
 }
+/** A write that waits for no disk sync of its own (in a browser, the engine's default already; on Node, the CLI's store). */
+var RELAXED = { durability: "relaxed" };
 /**
 * Durable local state of the browser peer. Identity seeds live here the same
 * way Desktop keeps them in its WebView storage: local to this profile, never
@@ -21473,12 +21572,13 @@ var db = {
 		await wrap((await store(STORES$1.messages, "readwrite")).put(message));
 	},
 	async updateDelivery(linkId, id, delivery, deliveryError, extra) {
-		const tx = (await openDb()).transaction(STORES$1.messages, "readwrite");
+		const tx = (await openDb()).transaction(STORES$1.messages, "readwrite", delivery === "sent" || delivery === "delivered" ? RELAXED : void 0);
 		const messages = tx.objectStore(STORES$1.messages);
 		const request = messages.get([linkId, id]);
 		request.onsuccess = () => {
 			const message = request.result;
 			if (!message?.delivery || message.delivery === "delivered") return;
+			if (message.delivery === delivery && message.deliveryError === deliveryError && Object.entries(extra ?? {}).every(([key, value]) => message[key] === value)) return;
 			messages.put({
 				...message,
 				...extra,
@@ -21494,10 +21594,11 @@ var db = {
 	/**
 	* Changes one message row in place, in one transaction: `change` sees the row as stored and gives the fields to
 	* set (`null`: leave it). A row that is not there is not made. Used for what the delivery states do not carry
-	* (the message's details record), on rows in any state.
+	* (the message's details record), on rows in any state. `relaxed`: for what can be made again or is only a note
+	* (a receipt's mark, the details record), written with no disk sync of its own.
 	*/
-	async patchMessage(linkId, id, change) {
-		const tx = (await openDb()).transaction(STORES$1.messages, "readwrite");
+	async patchMessage(linkId, id, change, relaxed = false) {
+		const tx = (await openDb()).transaction(STORES$1.messages, "readwrite", relaxed ? RELAXED : void 0);
 		const messages = tx.objectStore(STORES$1.messages);
 		const request = messages.get([linkId, id]);
 		let result;
@@ -21643,6 +21744,10 @@ var Reactions = class {
 	queue = Promise.resolve();
 	/** A group member's reactions taken per window (chat and member key), as a paired chat's session limits them. */
 	memberPace = /* @__PURE__ */ new Map();
+	/** Per group chat, per member: its reactions past the window, by message, waiting for room (`hold`). */
+	held = /* @__PURE__ */ new Map();
+	heldTimers = /* @__PURE__ */ new Map();
+	stopped = false;
 	/**
 	* This side's highest number per chat: read from its history the first time I react in it, then each number given
 	* out. It only has to grow, so a row deleted since leaves it too high and nothing is wrong.
@@ -21691,14 +21796,19 @@ var Reactions = class {
 	/**
 	* A reaction that came from `by` (`peer`, or a member's key), already authenticated as theirs. A message not here
 	* yet keeps it for five minutes; past the room for that sender, it is dropped (and, on a 1:1 session, not confirmed).
+	* Past `REACTION_LIMITS.receive` a window from one group member, the rest wait for the next window (`hold`): a
+	* community's catch-up hands back every reaction of a member at once, and one dropped is never handed again.
 	*/
 	receive(chat, by, reaction) {
 		if (isGroup$1(chat)) {
 			const key = `${chat}\n${by}`;
 			let pace = this.memberPace.get(key);
 			if (!pace) this.memberPace.set(key, pace = new ReactionWindow(REACTION_LIMITS.receive, REACTION_LIMITS.windowMs, () => this.now()));
-			if (!pace.take()) return Promise.resolve("dropped");
+			if (this.held.get(chat)?.has(by) || !pace.take()) return Promise.resolve(this.hold(chat, by, reaction, pace));
 		}
+		return this.take(chat, by, reaction);
+	}
+	take(chat, by, reaction) {
 		return this.run(async () => {
 			const target = await this.find(chat, reaction.id);
 			if (!target) return this.wait(chat, by, reaction);
@@ -21707,6 +21817,75 @@ var Reactions = class {
 			return "applied";
 		});
 	}
+	/**
+	* A reaction past what a group member's window takes: kept, the highest number per message, `REACTION_LIMITS.held` a
+	* group at most (the oldest go first), and taken when the window has room. The work stays what the window allows.
+	*/
+	hold(chat, by, reaction, pace) {
+		let group = this.held.get(chat);
+		if (!group) this.held.set(chat, group = /* @__PURE__ */ new Map());
+		let waiting = group.get(by);
+		if (!waiting) group.set(by, waiting = /* @__PURE__ */ new Map());
+		const known = waiting.get(reaction.id);
+		if (known && known.n >= reaction.n) return "stale";
+		waiting.delete(reaction.id);
+		waiting.set(reaction.id, reaction);
+		let count = 0;
+		for (const member of group.values()) count += member.size;
+		for (const [member, reactions] of group) {
+			if (count <= REACTION_LIMITS.held) break;
+			while (count > REACTION_LIMITS.held && reactions.size) {
+				reactions.delete(reactions.keys().next().value);
+				count--;
+			}
+			if (!reactions.size && member !== by) group.delete(member);
+		}
+		this.takeLater(chat, by, pace);
+		return waiting.has(reaction.id) ? "waiting" : "dropped";
+	}
+	takeLater(chat, by, pace) {
+		const key = `${chat}\n${by}`;
+		if (this.heldTimers.has(key) || this.stopped) return;
+		this.heldTimers.set(key, setTimeout(() => {
+			this.takeHeld(chat, by).catch(() => {});
+		}, Math.max(50, pace.wait())));
+	}
+	/** The window of a member has room again: its reactions that waited are taken, oldest first, as many as it allows. */
+	async takeHeld(chat, by) {
+		const key = `${chat}\n${by}`;
+		this.heldTimers.delete(key);
+		const group = this.held.get(chat), waiting = group?.get(by), pace = this.memberPace.get(key);
+		if (this.stopped || !group || !waiting || !pace) return;
+		for (const [id, reaction] of [...waiting]) {
+			if (this.host.believed && !this.host.believed(chat, by)) {
+				waiting.clear();
+				break;
+			}
+			if (!pace.take()) break;
+			if (waiting.get(id) !== reaction) continue;
+			waiting.delete(id);
+			await this.take(chat, by, reaction).catch(() => {});
+		}
+		if (waiting.size) {
+			this.takeLater(chat, by, pace);
+			return;
+		}
+		if (group.get(by) === waiting) group.delete(by);
+		if (!group.size) this.held.delete(chat);
+	}
+	/** The engine stops: what waits for a window is let go, and no timer is left. */
+	stop() {
+		this.stopped = true;
+		this.dropHeld();
+	}
+	dropHeld(chat) {
+		for (const [key, timer] of this.heldTimers) if (chat === void 0 || key.startsWith(`${chat}\n`)) {
+			clearTimeout(timer);
+			this.heldTimers.delete(key);
+		}
+		if (chat === void 0) this.held.clear();
+		else this.held.delete(chat);
+	}
 	/** A message was kept: the reactions that waited for it are shown now. */
 	stored(message) {
 		const list = this.waiting.get(message.linkId);
@@ -21744,6 +21923,7 @@ var Reactions = class {
 	}
 	/** A chat is gone: nothing waits for it any more, and my highest number in it is read again if it comes back. */
 	forget(chat) {
+		this.dropHeld(chat);
 		this.waiting.delete(chat);
 		this.last.delete(chat);
 	}
@@ -22115,6 +22295,16 @@ var Communities = class {
 	}
 	/** The clock: the last tick's time (the engine ticks every second), so every decision reads one clock. */
 	time = 0;
+	/**
+	* The communities this app is in, and those it is a hub of, as of the last tick: their idle looks share one
+	* community's pace (`beaconEvery`, `knockRecordsToRead`). Each community a hub held cost it about 10 requests a minute
+	* on each relay with nobody coming in: 4 of them on one relay, or 8 on two, spent the relays' budget on those looks,
+	* and the edges of some of them stayed down 10 minutes and more (CLI daemons, 2026-10-13).
+	*/
+	sharing = {
+		groups: 1,
+		hubs: 1
+	};
 	now() {
 		return this.time || Date.now();
 	}
@@ -22179,22 +22369,23 @@ var Communities = class {
 				invited: [],
 				memberLinks: {}
 			};
-			if (this.knocking(group, live)) return [{
+			const invitation = this.knocking(group, live) ? {
+				linkId: group.joining.linkId,
+				contact: "",
+				admin: group.joining.inviter,
+				members: 0,
+				accepted: true,
+				viaLink: true,
+				stage: this.joinStage(group),
+				...this.knockingWith.get(group.id) ? { waiting: this.knockingWith.get(group.id) } : {}
+			} : void 0;
+			if (invitation && !this.keptWhileKnocking(live)) return [{
 				...base,
 				name: groupName(group.joining.name) ?? live?.session.name ?? "",
 				isAdmin: false,
 				members: [],
 				canSend: false,
-				invitation: {
-					linkId: group.joining.linkId,
-					contact: "",
-					admin: group.joining.inviter,
-					members: 0,
-					accepted: true,
-					viaLink: true,
-					stage: this.joinStage(group),
-					...this.knockingWith.get(group.id) ? { waiting: this.knockingWith.get(group.id) } : {}
-				}
+				invitation
 			}];
 			if (!live) return [];
 			const s = live.session, edges = this.host.edges(group.id);
@@ -22219,6 +22410,7 @@ var Communities = class {
 				}) } : {},
 				canSend: s.canSend,
 				...s.picture ? { picture: s.picture } : {},
+				...invitation ? { invitation } : {},
 				community: {
 					hub: live.hub,
 					hubs: hubs.length,
@@ -22286,6 +22478,13 @@ var Communities = class {
 	knocking(group, live) {
 		return !!group.joining && (!live || live.session.status !== "active");
 	}
+	/**
+	* Someone removed keeps the group as it was here while it knocks to get back in, and when it gives up (`decline`).
+	* Not a session whose admission lost a race: that knock is still its join.
+	*/
+	keptWhileKnocking(live) {
+		return live?.session.status === "removed";
+	}
 	/** `check`: a member, as far as this device knows, asking the door whether it still is (`joinByLink`). */
 	async startJoining(link, seedB64, since, check = false) {
 		this.lastKnock.delete(link.g);
@@ -22457,11 +22656,14 @@ var Communities = class {
 	}
 	/**
 	* A join through the link that no member answered yet, given up: listed as an invitation, it is declined as one.
-	* A member trying to get back in (its session lost) leaves instead, which keeps nothing either.
+	* Someone removed who knocked to get back in only stops knocking: the group and its history stay here, as a private
+	* group's do for someone removed, invited again, who declines. A member trying to get back in (its session lost)
+	* leaves instead, which keeps nothing.
 	*/
 	async decline(groupId) {
 		const group = this.stored.get(groupId), live = this.live.get(groupId);
 		if (!group || !this.knocking(group, live)) throw new Error("No invitation to decline");
+		if (this.keptWhileKnocking(live)) return this.endCheck(group);
 		if (live) throw new Error("You were in this group: leave it to stop trying to get back in");
 		await this.forget(groupId);
 	}
@@ -22489,6 +22691,11 @@ var Communities = class {
 	/** Everything timed: beacon, hub election, lobbies, knocks, leaves, edges. The engine calls it every second or so. */
 	async tick(now = Date.now()) {
 		this.time = now;
+		const active = [...this.live.values()].filter((l) => l.session.status === "active");
+		this.sharing = {
+			groups: Math.max(1, active.length),
+			hubs: Math.max(1, active.filter((l) => l.hub).length)
+		};
 		for (const group of [...this.stored.values()]) {
 			const live = this.live.get(group.id);
 			if (group.joining && (this.knocking(group, live) || group.joining.check)) {
@@ -22535,7 +22742,7 @@ var Communities = class {
 			if ([...this.host.entries(groupId).values()].includes(linkId)) await this.host.closeEdge(linkId);
 		}
 		const alone = live.hub && !freshHubs(this.hubs(live), now).some((h) => h.key !== me);
-		if ((live.beaconFailedAt ? now - live.beaconFailedAt >= BEACON_RETRY_MS : now - live.lastBeaconRead >= (alone ? COMMUNITY_TOPOLOGY.beaconEveryMs : this.timings.beaconReadMs)) || live.lastBeaconRead === 0) await this.readBeacon(groupId, live, now);
+		if ((live.beaconFailedAt ? now - live.beaconFailedAt >= BEACON_RETRY_MS : now - live.lastBeaconRead >= this.beaconEvery(groupId, live, alone)) || live.lastBeaconRead === 0) await this.readBeacon(groupId, live, now);
 		if (!live.beaconKnown) {
 			await this.keepLooking(groupId, live, now);
 			await this.reconcile(groupId, live, now);
@@ -22797,11 +23004,22 @@ var Communities = class {
 		const n = live.members.size;
 		return n >= this.capacity(groupId, live, now, false) ? Math.max(n, COMMUNITY_TOPOLOGY.hubCapacity) : n;
 	}
+	/**
+	* How often the beacon is read: alone, as often as I write my entry. A member with an edge up shares one community's
+	* pace with the others it is in (`sharing`), up to that of a lone hub: an entry stays fresh three such readings. A
+	* hub does not: the door is the hubs whose entries it read lately (`doorHubs`, an entry 45 s old at most), and read
+	* slower, the door kept changing and read every knock record again each time. Nor a member with no edge up: who the
+	* hubs are is what it needs to connect.
+	*/
+	beaconEvery(groupId, live, alone) {
+		if (alone) return COMMUNITY_TOPOLOGY.beaconEveryMs;
+		return !live.hub && [...this.host.edges(groupId).values()].some((id) => this.host.linkReady(id, 2)) ? Math.min(this.timings.beaconReadMs * this.sharing.groups, COMMUNITY_TOPOLOGY.beaconEveryMs) : this.timings.beaconReadMs;
+	}
 	/** Reads the beacon; false when the reading did not happen (the relays held it back, or none answered). */
 	async readBeacon(groupId, live, now) {
 		live.lastBeaconRead = now;
 		const keys = beaconKeys(live.session.state.rv, groupId);
-		const records = await this.host.resolve(keys.identity.pubKeyZ32, true, live.hub).catch(() => void 0);
+		const records = await this.host.resolve(keys.identity.pubKeyZ32, true, this.doorBusy(groupId, live, now)).catch(() => void 0);
 		if (records === void 0) {
 			live.beaconFailedAt = now;
 			live.beaconAskedAt ||= now;
@@ -23009,7 +23227,7 @@ var Communities = class {
 	}
 	async pollLobby(groupId, live, now) {
 		const keys = lobbyKeys(live.session.state.rv, groupId, live.session.myKey);
-		const entries = readLobby(keys, await this.host.resolve(keys.identity.pubKeyZ32, true, true).catch(() => null) ?? []);
+		const entries = readLobby(keys, await this.host.resolve(keys.identity.pubKeyZ32, true, this.doorBusy(groupId, live, now)).catch(() => null) ?? []);
 		for (const { key, ts } of entries) {
 			if (now - ts > COMMUNITY_TOPOLOGY.lobbyFreshMs || key === live.session.myKey) continue;
 			if (live.session.wasRemoved(key)) {
@@ -23099,6 +23317,17 @@ var Communities = class {
 		return now - live.admittedAt < ADMITTED_QUIET_MS || [...live.pendingEntries.keys()].some((key) => down(entries.get(key))) || [...live.expect].some((key) => down(edges.get(key)));
 	}
 	/**
+	* As a hub: someone is coming in, or about to. I am letting someone in, the link was just shown, a crowd fills the
+	* bell, or members ask in my lobby (a hub just left, say). Then my reads of the bell, the beacon and my lobby go as
+	* the door's (`PkarrRequestOptions.door`): not held back while links signal. Otherwise they give way to the links
+	* that signal, my edges in my other communities first: an app that was a hub of 4 communities on one relay (8 on
+	* two) spent its relays' background share on reads that each said nobody was there, and its edges, whose signaling
+	* had what was left, stayed down 10 minutes and more in some of them (CLI daemons, 2026-10-13).
+	*/
+	doorBusy(groupId, live, now) {
+		return live.hub && (now < live.warmUntil || now < live.crowdUntil || now < live.lobbyBusyUntil || this.admitting(groupId, live, now));
+	}
+	/**
 	* Which knock records to read now (none, most of the time): every one at once the first time
 	* (a hub just elected, an app back, a change of door), since a knock left while nobody was at the
 	* door may be in any; then the door the bell, and the others in turn; the other hubs one in turn, slowly.
@@ -23111,7 +23340,7 @@ var Communities = class {
 			return Array.from({ length: 4 }, (_, n) => n);
 		}
 		const crowd = now < live.crowdUntil;
-		const every = !door ? this.timings.otherHubKnockPollMs : busy && !crowd ? this.timings.knockBusyPollMs : now < live.warmUntil ? this.timings.knockWarmPollMs : this.timings.knockPollMs;
+		const every = !door ? this.timings.otherHubKnockPollMs : busy && !crowd ? this.timings.knockBusyPollMs : now < live.warmUntil ? this.timings.knockWarmPollMs : Math.min(this.timings.knockPollMs * this.sharing.hubs, this.timings.otherHubKnockPollMs);
 		if (now - live.lastKnockPoll < every) return [];
 		live.lastKnockPoll = now;
 		if (!door) return [live.knockCursor = (live.knockCursor + 1) % 4];
@@ -23137,9 +23366,10 @@ var Communities = class {
 		const records = this.knockRecordsToRead(live, door === s.myKey, busy, now);
 		if (!records.length) return;
 		let failed = 0;
+		const open = door === s.myKey && this.doorBusy(groupId, live, now);
 		const read = await Promise.all(records.map(async (n) => {
 			const record = knockRecord(link, n);
-			return readKnocks(record, await this.host.resolve(knockIdentity(record).pubKeyZ32, true, door === s.myKey && n === KNOCK_BELL).catch(() => {
+			return readKnocks(record, await this.host.resolve(knockIdentity(record).pubKeyZ32, true, open && n === KNOCK_BELL).catch(() => {
 				failed++;
 				return null;
 			}) ?? []);
@@ -24609,8 +24839,8 @@ function eventTime(taken, groupId, timestamp) {
 var arrivalNow = (tick) => Math.max(tick, Date.now());
 /**
 * Keeps on the group's record when a member's message came, where that is later than what it holds: the record is
-* saved with the session right after (a message taken moves its state), so a message handed to me late still makes
-* the group unread after the app starts again. Read from the history alone, by its own time, it sorted among what I
+* saved with the session soon after (a message taken moves its state, saved within `GROUP_LIMITS.saveWithinMs` and when
+* the app stops), so a message handed to me late still makes the group unread after the app starts again. Read from the history alone, by its own time, it sorted among what I
 * had read and the mark was gone on the next start.
 */
 function noteCame(group, came, peer, mentioned) {
@@ -24661,6 +24891,8 @@ var ENTRY_RELEASE_MS = 2e3;
 var REMOVED_LINGER_MS = 15e3;
 /** How long the tombstone of a group I left waits for the admin to hear it. */
 var LEFT_KEPT_MS = 6048e5;
+/** Admin side: how long a contact invited over its chat is waited for. After, it holds no place and may be invited again. */
+var INVITED_KEPT_MS = LEFT_KEPT_MS;
 /**
 * Invitee side: an accept the admin has not answered with a welcome is said again this often while the inviter's chat
 * is up, and at once when it comes up, at most `ACCEPT_AGAINS` times each time it does (its app may have restarted).
@@ -24681,6 +24913,13 @@ function invitationClaims(frame) {
 var FAREWELL_ANSWERS = 3;
 /** Commits sent to a removed member that was behind when it left, at most. */
 var FAREWELL_COMMITS = 64;
+/**
+* A member whose messages were just asked of another (`Groups.askOf`) is told where I am only once that one's answer
+* has come: no message from it for this long, or `MESH_SYNC_HOLD_MAX_MS` after it was asked. Told at once, its own
+* answer raced the other's, which holds the same messages among everyone's in the order they were written, and a
+* member back in a group of five read each member's lines apart, the newest above older ones (WISP 902 § Catch-up).
+*/
+var MESH_SYNC_HOLD_MS = 1500;
 /** Where a member's gossip turns start among the members it is connected to: a number of its own, from its key. */
 var gossipStart = (key) => {
 	let n = 0;
@@ -24738,6 +24977,8 @@ var Groups = class {
 	timings;
 	stored = /* @__PURE__ */ new Map();
 	sessions = /* @__PURE__ */ new Map();
+	/** Per private group, the rows that hold the frame their message came in (`StoredMessage.frame`), oldest first, and what each counts for. */
+	framesKept = /* @__PURE__ */ new Map();
 	/** Contacts (chat ids, kept in `StoredGroup.invited`) and entry sessions I invited to each group, until they answer. */
 	invited = /* @__PURE__ */ new Map();
 	/** Invitee side: when my accept of each invitation was last said, how many times since the inviter's chat came up, and whether it was down. */
@@ -24783,6 +25024,13 @@ var Groups = class {
 	* time, not of everyone whose edge opens, so a member coming back is not sent the same messages by every other.
 	*/
 	relayAsked = /* @__PURE__ */ new Map();
+	/**
+	* Per mesh group, the members whose edge opened while their messages were being handed on by another (`holdSync`):
+	* whom, and when it was asked. Their sync goes once that answer has come.
+	*/
+	syncHeld = /* @__PURE__ */ new Map();
+	/** Per mesh group and member, when a message last came over its edge (its own, or one it handed on). */
+	lastHanded = /* @__PURE__ */ new Map();
 	lastGossip = /* @__PURE__ */ new Map();
 	/**
 	* Per mesh group, each reachable member some of whose messages never reached me (`GroupSession.lacking`): what was
@@ -24790,6 +25038,11 @@ var Groups = class {
 	* holds any more are not asked for every gossip turn. `last`: the latest ask, its member and the numbers it named.
 	*/
 	gapsAsked = /* @__PURE__ */ new Map();
+	/**
+	* Per mesh group and member, per epoch: the number up to which nobody holds what never reached me (`gapsSettle`).
+	* The member list stops counting those; they are still asked of a member that connects later.
+	*/
+	gapsGone = /* @__PURE__ */ new Map();
 	/** Per mesh group, when `gapsAgain` last looked: every half `MESH_GAP_AGAIN_MS`, not every tick. */
 	gapsLooked = /* @__PURE__ */ new Map();
 	/** Per mesh group: member key → since when its edge to me is down, and when someone last told me it is here. */
@@ -24862,6 +25115,10 @@ var Groups = class {
 			this.communities.files = this.files;
 		}
 	}
+	/** Writes what the private groups' sessions still have to save (`GROUP_LIMITS.saveWithinMs`): the app is stopping. */
+	async flush() {
+		await Promise.allSettled([...this.sessions.values()].map((session) => session.flush()));
+	}
 	/** `asItIs`: a copy that must stay as it was stored (limited mode, WISP 06), so nothing left over is cleared from it. */
 	async load(asItIs = false) {
 		const all = await this.store.getGroups();
@@ -24871,6 +25128,10 @@ var Groups = class {
 			if (group.state) this.attach(group.state);
 			if (group.invited) this.invited.set(group.id, new Set(Object.keys(group.invited)));
 			const history = await this.store.getMessages(MESSAGE_LINK(group.id)), said = history.filter((m) => !m.event && !m.groupPay);
+			this.framesKept.set(group.id, history.filter((m) => m.frame).map((m) => ({
+				id: m.id,
+				bytes: frameBytes(m.frame)
+			})));
 			const last = said[said.length - 1], lastPeer = [...said].reverse().find((m) => m.sender !== "me");
 			if (last) this.lastMessageAt.set(group.id, last.timestamp);
 			const peerAt = cameOrWritten(lastPeer?.timestamp, lastPeer ? group.came?.peer : void 0);
@@ -24946,6 +25207,7 @@ var Groups = class {
 						admin: invitation.admin,
 						members: Math.min(Math.max(invitation.n, 0), GROUP_MEMBER_CAP.max),
 						accepted: !!invitation.seedB64,
+						...this.acceptSaid.get(group.id)?.unanswered ? { unanswered: true } : {},
 						...invitation.entry ? {
 							viaLink: true,
 							stage: this.joinStage(group)
@@ -24987,7 +25249,7 @@ var Groups = class {
 						...viaHub ? { viaHub } : {},
 						...hubKeys.has(key) ? { hub: true } : {},
 						...hubRole ? { hubRole } : {},
-						missing: session.missing(key)
+						missing: session.missing(key, this.gapsGone.get(group.id)?.get(key)?.[session.epoch])
 					};
 				})
 			};
@@ -25092,6 +25354,22 @@ var Groups = class {
 		await this.store.putGroup(group);
 		this.host.emit();
 	}
+	/**
+	* Admin side: the invitations still unanswered are taken back, each over the contact chat it went on, when the group
+	* goes from this app or the role from me: nobody here could let them in. A chat that is down hears it as the answer
+	* to its accept. Entry sessions are not told: they close with the group, or the new admin answers the next knock.
+	*/
+	takeBack(groupId, group) {
+		const entries = new Set(this.host.entries(groupId).values());
+		for (const linkId of this.invited.get(groupId) ?? []) if (!entries.has(linkId)) try {
+			this.host.sendOnLink(linkId, {
+				t: "group-decline",
+				g: groupId
+			});
+		} catch {}
+		this.invited.delete(groupId);
+		if (group) delete group.invited;
+	}
 	/** Admin side: a contact chat answered its invitation (accepted or declined); false when it had none. */
 	answered(group, linkId) {
 		const had = !!this.invited.get(group.id)?.delete(linkId);
@@ -25100,6 +25378,14 @@ var Groups = class {
 		group.invited = Object.keys(rest).length ? rest : void 0;
 		return true;
 	}
+	/** Admin side: a contact whose answer did not come in `INVITED_KEPT_MS` (a decline lost on the way, an app gone) is not waited for any more. */
+	async ageInvited(group, now) {
+		const stale = Object.entries(group.invited).filter(([, at]) => now - at > INVITED_KEPT_MS);
+		if (!stale.length) return;
+		for (const [linkId] of stale) this.answered(group, linkId);
+		await this.store.putGroup(group);
+		this.host.emit();
+	}
 	async accept(groupId) {
 		const group = this.stored.get(groupId);
 		if (!group?.invitation) throw new Error("No invitation to accept");
@@ -25126,19 +25412,56 @@ var Groups = class {
 		if (this.isCommunity(groupId)) return this.communities.decline(groupId);
 		const group = this.stored.get(groupId);
 		if (!group?.invitation) throw new Error("No invitation to decline");
-		try {
-			this.host.sendOnLink(group.invitation.linkId, {
-				t: "group-decline",
-				g: groupId
-			});
-		} catch {}
+		if (!group.previous) return this.forget(groupId);
+		await this.dropInvitation(group, this.sayDecline(groupId, group.invitation.linkId));
+	}
+	/** An invitation goes from the list: declined here (`owed`: the answer, when it could not be sent), or taken back by who sent it. */
+	async dropInvitation(group, owed) {
 		const previous = group.previous;
-		if (!previous) return this.forget(groupId);
-		this.stored.set(groupId, previous);
+		if (!previous) return this.forget(group.id, false);
+		if (owed) previous.declined = owed;
+		else delete previous.declined;
+		this.acceptSaid.delete(group.id);
+		this.stored.set(group.id, previous);
 		if (previous.state) this.attach(previous.state);
 		await this.store.putGroup(previous);
 		this.host.emit();
 	}
+	/** Invitee side: says no to an invitation. With the inviter's chat down (its app is closed, say), returns the answer owed, said when that chat is next up. */
+	sayDecline(groupId, linkId) {
+		try {
+			this.host.sendOnLink(linkId, {
+				t: "group-decline",
+				g: groupId
+			});
+			return;
+		} catch {
+			return {
+				at: Date.now(),
+				linkId
+			};
+		}
+	}
+	/** Invitee side: a decline its inviter's chat was down for is said once that chat is up, or dropped after `LEFT_KEPT_MS`. */
+	async declineOwed(group, now) {
+		const { at, linkId } = group.declined;
+		if (now - at <= LEFT_KEPT_MS) {
+			if (!this.host.linkReady(linkId)) return;
+			try {
+				this.host.sendOnLink(linkId, {
+					t: "group-decline",
+					g: group.id
+				});
+			} catch {
+				return;
+			}
+		}
+		if (this.stored.get(group.id) !== group) return;
+		delete group.declined;
+		if (group.state) return this.store.putGroup(group);
+		this.stored.delete(group.id);
+		await this.store.deleteGroup(group.id);
+	}
 	/**
 	* Sends a text; `messageId` is the id it is kept under here (what history, replies and reactions name). `forwarded`:
 	* the hop count of a forwarded text (WISP 902 § Forwards). `card`: a checked status card, the text its fallback.
@@ -25289,8 +25612,7 @@ var Groups = class {
 			...bye ? { bye } : {}
 		};
 		delete group.entry;
-		delete group.invited;
-		this.invited.delete(groupId);
+		this.takeBack(groupId, group);
 		this.pendingEntries.delete(groupId);
 		this.welcomed.delete(groupId);
 		this.lingering.delete(groupId);
@@ -25457,8 +25779,14 @@ var Groups = class {
 		farewell.told ??= this.now();
 		this.store.putGroup(group).catch(() => {});
 	}
-	makeAdmin(groupId, key) {
-		return this.isCommunity(groupId) ? this.communities.makeAdmin(groupId, key) : this.session(groupId).transferAdmin(key);
+	async makeAdmin(groupId, key) {
+		if (this.isCommunity(groupId)) return this.communities.makeAdmin(groupId, key);
+		await this.session(groupId).transferAdmin(key);
+		const group = this.stored.get(groupId);
+		if (!group || !this.invited.get(groupId)?.size) return;
+		this.takeBack(groupId, group);
+		await this.store.putGroup(group);
+		this.host.emit();
 	}
 	/**
 	* The admin pins a member of a private group as a hub, excludes one from being a hub, or leaves it to the member's
@@ -25482,7 +25810,8 @@ var Groups = class {
 		if (this.isCommunity(groupId)) return this.communities.rename(groupId, name);
 		await this.session(groupId).rename(name);
 	}
-	async forget(groupId) {
+	/** `answer`: false when an invitation goes because its inviter took it back, so no decline is said for it. */
+	async forget(groupId, answer = true) {
 		if (this.isCommunity(groupId)) return this.communities.leave(groupId);
 		const session = this.sessions.get(groupId);
 		if (session?.status === "active") try {
@@ -25490,13 +25819,16 @@ var Groups = class {
 		} catch (e) {
 			if (session.isAdmin && session.others.length) throw e;
 		}
+		const gone = this.stored.get(groupId), invitation = answer && gone?.invitation && !gone.invitation.entry ? gone.invitation : void 0;
+		const owed = invitation && this.sayDecline(groupId, invitation.linkId);
 		this.sessions.delete(groupId);
 		this.stored.delete(groupId);
-		this.invited.delete(groupId);
+		this.takeBack(groupId);
 		this.acceptSaid.delete(groupId);
 		this.lastRoster.delete(groupId);
 		this.lastTold.delete(groupId);
 		this.pendingEntries.delete(groupId);
+		this.framesKept.delete(groupId);
 		this.knocked.delete(groupId);
 		this.knockCheckAt.delete(groupId);
 		this.knockRewrites.delete(groupId);
@@ -25504,10 +25836,13 @@ var Groups = class {
 		this.welcomed.delete(groupId);
 		this.lingering.delete(groupId);
 		this.relayAsked.delete(groupId);
+		this.syncHeld.delete(groupId);
+		this.lastHanded.delete(groupId);
 		this.hubs.forget(groupId);
 		this.removedAt.delete(groupId);
 		this.lastGossip.delete(groupId);
 		this.gapsAsked.delete(groupId);
+		this.gapsGone.delete(groupId);
 		this.gapsLooked.delete(groupId);
 		this.typings.forget(groupId);
 		for (const key of this.pinPaces.keys()) if (key.startsWith(`${groupId}\n`)) this.pinPaces.delete(key);
@@ -25517,6 +25852,15 @@ var Groups = class {
 		this.signals.forget(groupId);
 		for (const linkId of [...this.host.edges(groupId).values(), ...this.host.entries(groupId).values()]) await this.host.closeEdge(linkId);
 		await this.store.deleteGroup(groupId);
+		if (owed && !this.stored.has(groupId)) {
+			const tombstone = {
+				id: groupId,
+				createdAt: gone.createdAt,
+				declined: owed
+			};
+			this.stored.set(groupId, tombstone);
+			await this.store.putGroup(tombstone);
+		}
 		await this.files?.drop(groupId);
 		this.host.historyGone?.(groupId);
 		this.host.membersChanged?.(groupId);
@@ -25609,6 +25953,10 @@ var Groups = class {
 					if (now - group.left.at > LEFT_KEPT_MS) await this.forget(group.id);
 					continue;
 				}
+				if (group.declined) {
+					await this.declineOwed(group, now);
+					if (!group.state) continue;
+				}
 				if (group.invitation?.entry && !group.state) {
 					const every = now - group.createdAt > this.timings.patienceMs ? this.timings.slowKnockMs : this.timings.knockMs;
 					if (!(this.host.linkReady(group.invitation.linkId) || !!this.host.linkSeen?.(group.invitation.linkId)) && (now - (this.lastKnock.get(group.id) ?? 0) >= every || now >= (this.knockCheckAt.get(group.id) ?? Infinity))) await this.knock(group, now).catch(() => {});
@@ -25619,6 +25967,7 @@ var Groups = class {
 					continue;
 				}
 				const session = this.sessions.get(group.id);
+				if (group.invited) await this.ageInvited(group, now);
 				if (!group.entry || !session) continue;
 				if (!session.isAdmin) {
 					await this.disableLink(group.id);
@@ -25694,7 +26043,15 @@ var Groups = class {
 			});
 			return;
 		}
+		if (said.n >= ACCEPT_AGAINS && !said.down && !said.unanswered && !invitation.entry && now - said.at >= ACCEPT_AGAIN_MS) {
+			this.acceptSaid.set(group.id, {
+				...said,
+				unanswered: true
+			});
+			this.host.emit();
+		}
 		if (said.n >= ACCEPT_AGAINS || !said.down && now - said.at < ACCEPT_AGAIN_MS) return;
+		invitation.pieces = [];
 		try {
 			this.host.sendOnLink(invitation.linkId, {
 				t: "group-accept",
@@ -25706,7 +26063,8 @@ var Groups = class {
 		}
 		this.acceptSaid.set(group.id, {
 			at: now,
-			n: said.n + 1
+			n: said.n + 1,
+			...said.unanswered && { unanswered: true }
 		});
 	}
 	/** An entry session came up with groups on both sides: the admin's side invites over it. */
@@ -25943,7 +26301,24 @@ var Groups = class {
 			}
 			case "group-accept": {
 				const session = this.sessions.get(g);
-				if (!session?.isAdmin || !this.invited.get(g)?.has(linkId) || typeof frame.key !== "string" || !MEMBER_KEY.test(frame.key)) return;
+				if (typeof frame.key !== "string" || !MEMBER_KEY.test(frame.key)) return;
+				if (!session?.isAdmin || !this.invited.get(g)?.has(linkId)) {
+					const letIn = !!session && rosterHas(session.roster, frame.key) && this.stored.get(g)?.contacts?.[frame.key] === linkId;
+					if (!letIn && ![...this.host.entries(g).values()].includes(linkId)) try {
+						this.host.sendOnLink(linkId, {
+							t: "group-decline",
+							g
+						});
+					} catch {}
+					const edge = this.host.edges(g).get(frame.key);
+					if (letIn && session.isAdmin && !(edge && this.host.linkReady(edge))) {
+						const welcome = await session.rewelcome(frame.key).catch(() => []);
+						try {
+							for (const piece of welcome) this.host.sendOnLink(linkId, piece);
+						} catch {}
+					}
+					return;
+				}
 				const group = this.stored.get(g);
 				if (frame.key === session.myKey || rosterHas(session.roster, frame.key)) return;
 				const entryPeer = this.hostEntry(g, linkId);
@@ -25977,6 +26352,11 @@ var Groups = class {
 				return;
 			}
 			case "group-decline": {
+				const mine = this.stored.get(g);
+				if (mine?.invitation && !mine.invitation.entry && !mine.state && mine.invitation.linkId === linkId) {
+					await this.dropInvitation(mine);
+					return;
+				}
 				const entryPeer = this.hostEntry(g, linkId);
 				if (entryPeer) {
 					this.pendingEntries.get(g)?.delete(entryPeer);
@@ -26078,7 +26458,7 @@ var Groups = class {
 				const group = this.stored.get(g);
 				const member = Object.entries(group?.contacts ?? {}).find(([, id]) => id === linkId)?.[0];
 				if (!session?.isAdmin || !member || member === session.myKey) return;
-				if (rosterHas(session.roster, member)) await session.remove(member).catch(() => {});
+				if (rosterHas(session.roster, member)) await session.remove(member, Date.now(), { left: true }).catch(() => {});
 				try {
 					this.host.sendOnLink(linkId, {
 						t: "group-removed",
@@ -26146,6 +26526,11 @@ var Groups = class {
 			return;
 		}
 		const taken = await session.handle(peerKey, frame);
+		if (taken.some((f) => f.t === "group-msg")) {
+			let handed = this.lastHanded.get(groupId);
+			if (!handed) this.lastHanded.set(groupId, handed = /* @__PURE__ */ new Map());
+			handed.set(peerKey, this.now());
+		}
 		if (taken.length) this.hubs.passOn(groupId, session, peerKey, taken);
 	}
 	/**
@@ -26217,7 +26602,7 @@ var Groups = class {
 		const large = this.host.linkReady(linkId, 3) && this.markLarge(group, peerKey);
 		const legacy = this.hubs.enabled && this.hubs.edgeReady(groupId, session, group, peerKey, this.host.linkReady(linkId, 4), this.now());
 		if (large || legacy) this.store.putGroup(group).catch(() => {});
-		try {
+		if (!this.holdSync(groupId, peerKey)) try {
 			this.host.sendOnLink(linkId, session.syncFrame(this.askOf(groupId, session, peerKey)));
 		} catch {
 			return;
@@ -26340,11 +26725,55 @@ var Groups = class {
 			});
 			out.push(key);
 		}
-		out.push(...this.gapsOf(groupId, session, via, session.lacking()));
+		const lacking = session.lacking();
+		out.push(...this.gapsOf(groupId, session, via, lacking));
+		this.ownGap(groupId, via, lacking);
 		if (out.length) this.lastGossip.set(groupId, now);
 		return out;
 	}
 	/**
+	* Whether the answer of the member asked for someone's messages may still be coming: its edge up, asked under
+	* `MESH_SYNC_HOLD_MAX_MS` ago, and a message from it (or the asking) under `MESH_SYNC_HOLD_MS` ago.
+	*/
+	answering(groupId, { via, at }, now) {
+		const edge = this.host.edges(groupId).get(via);
+		if (!edge || !this.host.linkReady(edge) || now - at >= 1e4) return false;
+		return now - Math.max(at, this.lastHanded.get(groupId)?.get(via) ?? 0) < MESH_SYNC_HOLD_MS;
+	}
+	/**
+	* Whether the sync to a member whose edge just opened waits (`heldSyncs` sends it): its messages were asked of
+	* another member a moment ago, and that answer holds them among everyone's in the order they were written. Its own
+	* answer now would bring the same messages on their own, ahead of or behind the others' lines.
+	*/
+	holdSync(groupId, peerKey) {
+		const asked = this.relayAsked.get(groupId)?.get(peerKey);
+		if (!asked || asked.via === peerKey || !this.answering(groupId, asked, this.now())) {
+			this.syncHeld.get(groupId)?.delete(peerKey);
+			this.relayAsked.get(groupId)?.delete(peerKey);
+			return false;
+		}
+		let held = this.syncHeld.get(groupId);
+		if (!held) this.syncHeld.set(groupId, held = /* @__PURE__ */ new Map());
+		held.set(peerKey, { ...asked });
+		return true;
+	}
+	/** The syncs that waited for another member's answer (`holdSync`), once it has come: for what it did not hand on. */
+	heldSyncs(groupId, session, now) {
+		const held = this.syncHeld.get(groupId);
+		if (!held?.size) return;
+		const edges = this.host.edges(groupId);
+		for (const [key, asked] of held) {
+			if (this.answering(groupId, asked, now)) continue;
+			held.delete(key);
+			if (this.relayAsked.get(groupId)?.get(key)?.via === asked.via) this.relayAsked.get(groupId).delete(key);
+			const edge = edges.get(key);
+			if (!edge || !this.host.linkReady(edge) || !rosterHas(session.roster, key)) continue;
+			try {
+				this.host.sendOnLink(edge, session.syncFrame(this.askOf(groupId, session, key)));
+			} catch {}
+		}
+	}
+	/**
 	* Reachable members whose messages below the highest seen never reached me, for `via` to hand on: their own answer
 	* comes from their last `GROUP_LIMITS.outlog` only (WISP 902 § Catch-up), the rest another member may hold. As
 	* `askOf`, one member at a time, and each member once until what is missing changes.
@@ -26374,6 +26803,7 @@ var Groups = class {
 			});
 			if (entry.of.has(via)) continue;
 			entry.of.add(via);
+			entry.at = now;
 			entry.last = {
 				via,
 				at: now,
@@ -26388,6 +26818,56 @@ var Groups = class {
 		return out;
 	}
 	/**
+	* Whether a sync to `via` asks it for its own messages that never reached me, for the first time since what is
+	* missing changed: any sync names them (`miss`), and an author answers from its own log (`GROUP_LIMITS.outlog`).
+	*/
+	ownGap(groupId, via, lacking) {
+		const mark = lacking.get(via);
+		if (mark === void 0) return false;
+		let tried = this.gapsAsked.get(groupId);
+		if (!tried) this.gapsAsked.set(groupId, tried = /* @__PURE__ */ new Map());
+		let entry = tried.get(via);
+		const now = this.now();
+		if (!entry || entry.mark !== mark) tried.set(via, entry = {
+			mark,
+			of: /* @__PURE__ */ new Set(),
+			noticed: entry?.noticed ?? now,
+			last: entry?.last
+		});
+		if (entry.of.has(via)) return false;
+		entry.of.add(via);
+		entry.at = now;
+		return true;
+	}
+	/**
+	* Messages nobody holds any more: every connected member, their author included, was asked for the same missing
+	* numbers `MESH_GAP_AGAIN_MS` ago or more and none arrived. An author keeps its last 32 and the others the group's
+	* last 256 (WISP 902 § Bounds), so what a sync names and nobody hands on is gone, and so is what is below it (logs
+	* drop the oldest first). The member list counted them until the next epoch, as if they were still on their way.
+	*/
+	gapsSettle(groupId, session, now, connected, lacking) {
+		const tried = this.gapsAsked.get(groupId);
+		if (!tried) return;
+		let changed = false;
+		for (const [key, mark] of lacking) {
+			const entry = tried.get(key);
+			if (!entry || entry.mark !== mark || entry.at === void 0 || now - entry.at < 1e4) continue;
+			if (!connected.includes(key) || !connected.every((member) => entry.of.has(member))) continue;
+			let gone = this.gapsGone.get(groupId);
+			if (!gone) this.gapsGone.set(groupId, gone = /* @__PURE__ */ new Map());
+			const upTo = { ...gone.get(key) };
+			for (const [e, numbers] of Object.entries(session.missOf(key))) {
+				const top = Math.max(...numbers);
+				if (top > (upTo[e] ?? -1)) {
+					upTo[e] = top;
+					changed = true;
+				}
+			}
+			gone.set(key, upTo);
+		}
+		if (changed) this.host.emit();
+	}
+	/**
 	* Gaps asked for sooner than the gossip turn: one noticed `MESH_GAP_AGAIN_MS` ago and not asked for yet (an author's
 	* own answer, its last 32, showed what is below them) goes to a connected member now; and a member that handed on some
 	* of what I last asked it for likely holds the rest, so it is asked for the next numbers `MESH_GAP_AGAIN_MS` after. A
@@ -26402,6 +26882,7 @@ var Groups = class {
 		if (!lacking.size && !tried?.size) return;
 		if (!tried) this.gapsAsked.set(groupId, tried = /* @__PURE__ */ new Map());
 		for (const key of tried.keys()) if (!lacking.has(key)) tried.delete(key);
+		this.gapsSettle(groupId, session, now, connected, lacking);
 		const edges = this.host.edges(groupId), again = /* @__PURE__ */ new Map(), fresh = /* @__PURE__ */ new Map();
 		const up = (key) => {
 			const edge = edges.get(key);
@@ -26429,6 +26910,7 @@ var Groups = class {
 				tried.set(key, {
 					mark: lacking.get(key),
 					of: /* @__PURE__ */ new Set([via]),
+					at: now,
 					last: {
 						via,
 						at: now,
@@ -26444,11 +26926,14 @@ var Groups = class {
 				this.host.sendOnLink(edges.get(via), session.syncFrame(keys));
 			} catch {}
 		}
-		const others = connected.filter((key) => !fresh.has(key)), pool = others.length ? others : connected;
-		if (!fresh.size || !pool.length) return;
-		const via = pool[(gossipStart(session.myKey) + this.gossipTurn++) % pool.length];
+		if (!fresh.size || !connected.length) return;
+		const at = () => connected[(gossipStart(session.myKey) + this.gossipTurn++) % connected.length];
+		let via = at();
+		for (let i = 1; i < connected.length && fresh.has(via); i++) via = at();
 		const keys = this.gapsOf(groupId, session, via, fresh);
-		if (keys.length) try {
+		if (!keys.length) return;
+		this.lastGossip.set(groupId, now);
+		try {
 			this.host.sendOnLink(edges.get(via), session.syncFrame(keys));
 		} catch {}
 	}
@@ -26466,6 +26951,7 @@ var Groups = class {
 			if (session.status !== "active" || this.stored.get(groupId)?.left) continue;
 			session.reseal().catch(() => {});
 			this.farewellsTick(groupId, session, now);
+			this.heldSyncs(groupId, session, now);
 			if (reconcile) {
 				const edges = this.host.edges(groupId);
 				if (!this.hubs.large(session) && session.others.some((key) => !edges.has(key))) this.reconcileEdges(groupId);
@@ -26488,7 +26974,7 @@ var Groups = class {
 				at: now
 			});
 			const ask = [...away, ...this.gapsOf(groupId, session, via, lacking)];
-			if (!ask.length) continue;
+			if (!this.ownGap(groupId, via, lacking) && !ask.length) continue;
 			try {
 				this.host.sendOnLink(edges.get(via), session.syncFrame(ask));
 			} catch {}
@@ -26514,6 +27000,25 @@ var Groups = class {
 		if (session && this.stored.get(groupId)?.farewells?.[peerKey] && !rosterHas(session.roster, peerKey)) return;
 		session?.setNick(peerKey, nick);
 	}
+	/**
+	* A message's row took the frame it came in: past `GROUP_LIMITS.relay` frames (or their bytes) in a group, the oldest
+	* rows give theirs up, so a group's history holds the frames of its newest messages only.
+	*/
+	async frameKept(groupId, id, frame) {
+		let kept = this.framesKept.get(groupId);
+		if (!kept) this.framesKept.set(groupId, kept = []);
+		if (kept.some((k) => k.id === id)) return;
+		kept.push({
+			id,
+			bytes: frameBytes(frame)
+		});
+		let bytes = kept.reduce((sum, k) => sum + k.bytes, 0);
+		while (kept.length > GROUP_LIMITS.relay || bytes > GROUP_LIMITS.relayBytes) {
+			const oldest = kept.shift();
+			bytes -= oldest.bytes;
+			await this.host.forgetFrame?.(MESSAGE_LINK(groupId), oldest.id).catch(() => {});
+		}
+	}
 	session(groupId) {
 		const session = this.sessions.get(groupId);
 		if (!session) throw new Error("Group not found");
@@ -26527,7 +27032,7 @@ var Groups = class {
 			adminTurn: () => this.host.adminTurn?.(state.id) ?? Promise.resolve(true),
 			save: async (next) => {
 				const group = this.stored.get(state.id);
-				if (!group) return;
+				if (!group || this.sessions.get(state.id) !== session) return;
 				group.state = next;
 				await this.store.putGroup(group);
 			},
@@ -26569,9 +27074,12 @@ var Groups = class {
 					...m.reply && { replyTo: groupReply(m.reply, session.myKey) },
 					...m.forwarded && { forwarded: m.forwarded },
 					...m.card && { card: m.card },
-					...file && { file }
+					...file && { file },
+					...m.frame && { frame: m.frame }
 				};
-				const stored = m.completes && this.host.completeMessage ? (await this.host.completeMessage(message), false) : await this.host.storeMessage(message);
+				const completed = !!m.completes && !!this.host.completeMessage;
+				const stored = completed ? (await this.host.completeMessage(message), false) : await this.host.storeMessage(message);
+				if (m.frame && (completed || stored !== false)) await this.frameKept(state.id, m.id, m.frame);
 				const came = m.sender === session.myKey ? timestamp : cameAt(timestamp, stored, arrivalNow(this.now()));
 				this.lastMessageAt.set(state.id, Math.max(this.lastMessageAt.get(state.id) ?? 0, came));
 				if (mentioned) this.lastMentionAt.set(state.id, Math.max(this.lastMentionAt.get(state.id) ?? 0, came));
@@ -27045,9 +27553,12 @@ function summary(note) {
 	const amount = note.decimals ? `${note.amount} base units of ${note.unit}` : `${Number(note.amount).toLocaleString()} ${note.test ? "test sats" : "sats"}`;
 	return note.kind === "request" ? `⚡ Requested ${amount}` : `⚡ Sent ${amount}`;
 }
+/** A second past the receiver's window, so one window's edits have left it on the member's side whatever the edge's delay. */
+var GROUP_EDIT_RESEND_WINDOW_MS = EDIT_RATE_WINDOW_MS + 1e3;
 /** An edit that could not go (no epoch key yet) is tried again after this long. */
 var RETRY_MS = 1e4;
 var chatOf = (groupId) => `group:${groupId}`;
+var resendKey = (groupId, member) => `${groupId}\n${member}`;
 var GroupEdits = class {
 	host;
 	now;
@@ -27056,10 +27567,23 @@ var GroupEdits = class {
 	cards;
 	sendPace = /* @__PURE__ */ new Map();
 	receivePace = /* @__PURE__ */ new Map();
+	/** Per group, per member (`group\nmember`): its edits past the window, by message, waiting for room (`hold`). */
+	held = /* @__PURE__ */ new Map();
+	heldTimers = /* @__PURE__ */ new Map();
 	timers = /* @__PURE__ */ new Map();
 	flushing = /* @__PURE__ */ new Map();
 	/** Per group: my rows known to have an edit to say, each with when it was last told (`edit`), by `tick`. */
 	known = /* @__PURE__ */ new Map();
+	/**
+	* Per group and member (`resendKey`): the last edit of mine said on its edge, in the order `resend` says them. What
+	* comes after it is what the member has not heard there. Not kept across a restart.
+	*/
+	heard = /* @__PURE__ */ new Map();
+	/** The connection `resend` last spoke on, per group and member: a new one hears my latest edits again. */
+	resentOn = /* @__PURE__ */ new Map();
+	resendPace = /* @__PURE__ */ new Map();
+	resendTimers = /* @__PURE__ */ new Map();
+	resending = /* @__PURE__ */ new Map();
 	tick = 0;
 	/**
 	* The groups whose history was read for the rows with an edit to say: `known` has them all, and from then on those
@@ -27208,7 +27732,8 @@ var GroupEdits = class {
 	/**
 	* An edit from a member, authenticated as `sender` by the group. Believed only while the sender is in the group (a
 	* removed member's edits are dropped) and only of the sender's own message; the highest number wins. One of a message
-	* not here yet waits a minute for it. Past `EDIT_RECEIVE_LIMIT` a window from one member, the rest are dropped.
+	* not here yet waits a minute for it. Past `EDIT_RECEIVE_LIMIT` a window from one member, the rest wait for the next
+	* window (`hold`): a catch-up hands back every edit of an author at once, and one dropped is never handed again.
 	*/
 	async receive(groupId, sender, edit) {
 		const membership = this.host.membership(groupId);
@@ -27216,7 +27741,65 @@ var GroupEdits = class {
 		const key = `${groupId}\n${sender}`;
 		let pace = this.receivePace.get(key);
 		if (!pace) this.receivePace.set(key, pace = new RateWindow(30, EDIT_RATE_WINDOW_MS, this.now));
-		if (!pace.take()) return "dropped";
+		if (this.held.get(groupId)?.has(key) || !pace.take()) return this.hold(groupId, sender, edit, pace);
+		return this.take(groupId, membership, sender, edit);
+	}
+	/**
+	* An edit past what a member's window takes: kept, the highest number per message, `GROUP_EDITS_HELD` messages a
+	* group at most (the oldest go first), and taken when the window has room. The work stays what the window allows.
+	*/
+	hold(groupId, sender, edit, pace) {
+		const key = `${groupId}\n${sender}`;
+		let group = this.held.get(groupId);
+		if (!group) this.held.set(groupId, group = /* @__PURE__ */ new Map());
+		let waiting = group.get(key);
+		if (!waiting) group.set(key, waiting = /* @__PURE__ */ new Map());
+		const known = waiting.get(edit.id);
+		if (known && known.e >= edit.e) return "dropped";
+		waiting.delete(edit.id);
+		waiting.set(edit.id, edit);
+		let count = 0;
+		for (const member of group.values()) count += member.size;
+		for (const [member, edits] of group) {
+			if (count <= 256) break;
+			while (count > 256 && edits.size) {
+				edits.delete(edits.keys().next().value);
+				count--;
+			}
+			if (!edits.size && member !== key) group.delete(member);
+		}
+		if (!this.heldTimers.has(key) && !this.stopped) this.heldTimers.set(key, setTimeout(() => {
+			this.takeHeld(groupId, sender).catch(() => {});
+		}, Math.max(50, pace.wait())));
+		return waiting.has(edit.id) ? "waiting" : "dropped";
+	}
+	/** The window of a member has room again: its edits that waited are taken, oldest first, as many as it allows. */
+	async takeHeld(groupId, sender) {
+		const key = `${groupId}\n${sender}`;
+		this.heldTimers.delete(key);
+		const group = this.held.get(groupId), waiting = group?.get(key), pace = this.receivePace.get(key);
+		if (this.stopped || !group || !waiting || !pace) return;
+		for (const [id, edit] of [...waiting]) {
+			const membership = this.host.membership(groupId);
+			if (!membership?.members.has(sender)) {
+				waiting.clear();
+				break;
+			}
+			if (!pace.take()) break;
+			if (waiting.get(id) !== edit) continue;
+			waiting.delete(id);
+			await this.take(groupId, membership, sender, edit).catch(() => {});
+		}
+		if (waiting.size) {
+			if (!this.heldTimers.has(key) && !this.stopped) this.heldTimers.set(key, setTimeout(() => {
+				this.takeHeld(groupId, sender).catch(() => {});
+			}, Math.max(50, pace.wait())));
+			return;
+		}
+		if (group.get(key) === waiting) group.delete(key);
+		if (!group.size) this.held.delete(groupId);
+	}
+	async take(groupId, membership, sender, edit) {
 		const chat = chatOf(groupId);
 		const message = await this.find(chat, edit.id);
 		if (!message) {
@@ -27264,24 +27847,80 @@ var GroupEdits = class {
 		await this.host.changed(chat, message.id);
 		return "applied";
 	}
-	/** An edge of a private group opened: the member at its other end hears my latest edits again, in case it missed them. */
-	async resend(groupId, to) {
-		const chat = chatOf(groupId);
-		const mine = (await (this.host.history ? this.host.history(chat) : this.host.messages(chat))).filter((m) => m.sender === "me" && m.edit && !m.edit.pending && canEditInGroup(m)).sort((a, b) => b.edit.at - a.edit.at).slice(0, 16).reverse();
-		for (const m of mine) await this.host.send(groupId, {
-			id: m.id,
-			e: m.edit.seq,
-			ts: m.edit.at,
-			m: m.text,
-			...m.mentions?.length && { k: m.mentions },
-			...m.card && { sc: m.card }
-		}, to);
+	/**
+	* An edge of a private group opened: the member at its other end hears the edits of mine it has not heard on that
+	* edge, the latest of each message, oldest first. `GROUP_EDIT_RESEND` go a window and the rest a window later each,
+	* while the edge is the same: a member away while I closed forty task cards reads them all as closed, not the latest
+	* sixteen. Nothing known of what it heard (the first time since the app started): my newest `GROUP_EDIT_CATCH_UP`.
+	* A new connection hears my latest `GROUP_EDIT_RESEND` again whatever it heard: one may have come before its message
+	* and been dropped. Called again while the edge is the same, it goes on from where it was.
+	*/
+	resend(groupId, to) {
+		const key = resendKey(groupId, to);
+		const run = (this.resending.get(key) ?? Promise.resolve()).then(() => this.resendNow(groupId, to));
+		const settled = run.catch(() => {}).finally(() => {
+			if (this.resending.get(key) === settled) this.resending.delete(key);
+		});
+		this.resending.set(key, settled);
+		return run;
+	}
+	async resendNow(groupId, to) {
+		const key = resendKey(groupId, to), chat = chatOf(groupId);
+		clearTimeout(this.resendTimers.get(key));
+		this.resendTimers.delete(key);
+		const open = () => this.host.edge ? this.host.edge(groupId, to) : true;
+		const edge = open(), membership = this.host.membership(groupId);
+		if (this.stopped || edge === void 0 || !membership || membership.community || !membership.members.has(to)) return;
+		const mine = (await (this.host.history ? this.host.history(chat) : this.host.messages(chat))).filter((m) => m.sender === "me" && m.edit && !m.edit.pending && canEditInGroup(m)).sort((a, b) => a.edit.at - b.edit.at || (a.id < b.id ? -1 : 1));
+		const last = this.heard.get(key);
+		const after = (m) => !last || m.edit.at > last.at || m.edit.at === last.at && m.id > last.id;
+		const unheard = last ? mine.filter(after).length : Math.min(mine.length, 256);
+		const again = this.resentOn.get(key) === edge ? 0 : Math.min(mine.length, 16);
+		this.resentOn.set(key, edge);
+		const due = mine.slice(mine.length - Math.max(unheard, again));
+		let pace = this.resendPace.get(key);
+		if (!pace) this.resendPace.set(key, pace = new RateWindow(16, GROUP_EDIT_RESEND_WINDOW_MS, this.now));
+		for (const m of due) {
+			if (this.stopped || open() !== edge) return;
+			if (!pace.take()) {
+				this.resendTimers.set(key, setTimeout(() => {
+					this.resend(groupId, to).catch(() => {});
+				}, Math.max(50, pace.wait())));
+				return;
+			}
+			await this.host.send(groupId, {
+				id: m.id,
+				e: m.edit.seq,
+				ts: m.edit.at,
+				m: m.text,
+				...m.mentions?.length && { k: m.mentions },
+				...m.card && { sc: m.card }
+			}, to);
+			if (open() !== edge) return;
+			if (after(m)) this.heard.set(key, {
+				at: m.edit.at,
+				id: m.id
+			});
+		}
+	}
+	/** A group is forgotten, or the app stops: what was known of its members' edges goes with it. */
+	dropResends(groupId) {
+		const of = (key) => groupId === void 0 || key.startsWith(`${groupId}\n`);
+		for (const [key, timer] of this.resendTimers) if (of(key)) {
+			clearTimeout(timer);
+			this.resendTimers.delete(key);
+		}
+		for (const key of [...this.heard.keys()]) if (of(key)) this.heard.delete(key);
+		for (const key of [...this.resendPace.keys()]) if (of(key)) this.resendPace.delete(key);
+		for (const key of [...this.resentOn.keys()]) if (of(key)) this.resentOn.delete(key);
 	}
 	forget(groupId) {
 		clearTimeout(this.timers.get(groupId));
 		this.timers.delete(groupId);
 		this.known.delete(groupId);
 		this.learnt.delete(groupId);
+		this.dropResends(groupId);
+		this.dropHeld(groupId);
 		this.buffer.forget(chatOf(groupId));
 	}
 	stop() {
@@ -27289,6 +27928,16 @@ var GroupEdits = class {
 		this.cards.stop();
 		for (const timer of this.timers.values()) clearTimeout(timer);
 		this.timers.clear();
+		this.dropResends();
+		this.dropHeld();
+	}
+	dropHeld(groupId) {
+		for (const [key, timer] of this.heldTimers) if (groupId === void 0 || key.startsWith(`${groupId}\n`)) {
+			clearTimeout(timer);
+			this.heldTimers.delete(key);
+		}
+		if (groupId === void 0) this.held.clear();
+		else this.held.delete(groupId);
 	}
 };
 //#endregion
@@ -28622,8 +29271,7 @@ function historyFromRows(rows) {
 		});
 		else if (e.kind === "flapping") events.push({
 			...base,
-			kind: e.live ? "live" : "down",
-			reason: `Dropped and came back ${e.count ?? 0} times`
+			kind: e.live ? "live" : "down"
 		});
 		else if (e.kind === "connected" || e.kind === "back") events.push({
 			...base,
@@ -30385,7 +31033,8 @@ var CashuWallet = class CashuWallet {
 				tx: walletTx(mint, kind, credited, Math.max(0, faceValue - credited), note),
 				...payment ? { payment: payment(credited, mint) } : {}
 			});
-			let swap = (await this.swapsAt(mint)).find((s) => s.kind === "receive" && s.token === token);
+			const written = (await this.swapsAt(mint)).filter((s) => s.kind === "receive");
+			let swap = written.find((s) => s.token === token);
 			if (swap?.finished) return {
 				amount: swap.tx?.amount ?? 0,
 				mint,
@@ -30393,6 +31042,8 @@ var CashuWallet = class CashuWallet {
 			};
 			if (!swap) {
 				const preview = await (await this.wallet(mint)).prepareSwapToReceive(token);
+				const redeeming = new Set(written.flatMap((s) => (swapOf(s).inputs ?? []).map((p) => p.secret)));
+				if (preview.inputs.some((p) => redeeming.has(p.secret))) throw engineError("ecashBeingReceived");
 				swap = {
 					id: swapId(),
 					mint,
@@ -30529,7 +31180,17 @@ var CashuWallet = class CashuWallet {
 			id: p.id
 		})));
 		if (states.length !== saved.inputs.length) throw new Error("The mint answered for another number of proofs");
-		if (states.some((s) => s.state === "PENDING")) return { state: "open" };
+		if (states.some((s) => s.state === "PENDING")) {
+			if (swap.kind === "receive" && refused) return {
+				state: "never",
+				gone: /* @__PURE__ */ new Set(),
+				final: true
+			};
+			return {
+				state: "open",
+				pending: true
+			};
+		}
 		const gone = new Set(saved.inputs.filter((_, i) => states[i]?.state === "SPENT").map((p) => p.secret));
 		if (gone.size > 0) {
 			const second = await signed();
@@ -30651,7 +31312,7 @@ var CashuWallet = class CashuWallet {
 	}
 	/**
 	* Swaps still written down: the app closed while the mint was being asked, or the mint did not answer. Each mint is
-	* asked where its own stand, under its lock. A swap it made is stored as its answer would have been; one it says it
+	* asked where its own stand, one swap at a time under its lock. A swap it made is stored as its answer would have been; one it says it
 	* never made is undone; one that is only overdue gives its inputs back and stays watched; one it cannot speak for
 	* is asked about again. `mints`: only these mints', once, now.
 	*/
@@ -30670,16 +31331,18 @@ var CashuWallet = class CashuWallet {
 		const later = (ms) => {
 			again = again ? Math.min(again, ms) : ms;
 		};
-		for (const mint of new Set(open.map((s) => s.mint))) await this.locked(mint, async () => {
-			for (let swap of await this.swapsAt(mint)) try {
+		for (const { id, mint } of open) await this.locked(mint, async () => {
+			let swap = await wrap((await store(STORES$1.swaps, "readonly")).get(id));
+			if (!swap) return;
+			try {
 				if (swap.finished) {
 					if (await this.tellSwap(swap, true)) await wrap((await store(STORES$1.swaps, "readwrite")).delete(swap.id));
 					else later(SWAP_POLL_MS);
-					continue;
+					return;
 				}
 				if (swap.askAt && Date.now() < swap.askAt && !mints) {
 					later(swap.askAt - Date.now());
-					continue;
+					return;
 				}
 				if (swap.attemptEndedAt === void 0) {
 					swap = {
@@ -30692,7 +31355,7 @@ var CashuWallet = class CashuWallet {
 				if (outcome.state === "open") {
 					if (swap.released && Date.now() >= swap.createdAt + SWAP_WATCH_MS) {
 						await this.dropSwap(swap, /* @__PURE__ */ new Set());
-						continue;
+						return;
 					}
 					if (outcome.slow) {
 						const stuck = (swap.stuck ?? 0) + 1;
@@ -30731,8 +31394,20 @@ var CashuWallet = class CashuWallet {
 							this.events.onChange();
 						} else later(SWAP_POLL_MS);
 					}
-					else later(swap.released ? SWAP_SLOW_POLL_MS : SWAP_POLL_MS);
-					continue;
+					else if (outcome.pending && swap.kind === "receive" && !swap.released && Date.now() >= swapOverdueAt(swap)) {
+						if (Date.now() < swap.createdAt + SWAP_WATCH_MS) {
+							await wrap((await store(STORES$1.swaps, "readwrite")).put({
+								...swap,
+								askAt: Date.now() + SWAP_SLOW_POLL_MS
+							}));
+							later(SWAP_SLOW_POLL_MS);
+						} else {
+							await this.dropSwap(swap, /* @__PURE__ */ new Set());
+							await this.tellSwap(swap, false);
+							this.events.onChange();
+						}
+					} else later(swap.released ? SWAP_SLOW_POLL_MS : SWAP_POLL_MS);
+					return;
 				}
 				if (outcome.state === "done") {
 					if (await this.finishSwap(swap, outcome.keep, outcome.send, true)) {
@@ -30743,7 +31418,7 @@ var CashuWallet = class CashuWallet {
 				} else if (swap.released) {
 					if (outcome.final || Date.now() >= swap.createdAt + SWAP_WATCH_MS) await this.dropSwap(swap, outcome.gone);
 					else later(SWAP_SLOW_POLL_MS);
-					continue;
+					return;
 				} else {
 					await this.dropSwap(swap, outcome.gone, !outcome.final);
 					await this.tellSwap(swap, false);
@@ -32197,12 +32872,27 @@ var PaymentDesk = class {
 			}
 			return;
 		}
-		if (done) await this.creditCashu(record, link);
-		else if (!this.payments.has(record.id)) link?.sendPaymentResult({
+		if (done) {
+			await this.creditCashu(record, link);
+			return;
+		}
+		if (this.payments.has(record.id)) return;
+		const reason = "The mint did not confirm the ecash";
+		link?.sendPaymentResult({
 			id: record.id,
 			ok: false,
-			error: "The mint did not confirm the ecash"
+			error: reason
 		});
+		try {
+			await this.host.storeMessage({
+				linkId: record.linkId,
+				id: `peer_${record.createdAt}_refused`,
+				text: `Could not receive ${record.amount.toLocaleString()} sats: ${reason}`,
+				sender: "peer",
+				timestamp: record.createdAt,
+				via: "datalink"
+			});
+		} catch {}
 	}
 	async onPaymentResult(linkId, result) {
 		const payment = this.find(linkId, result.id);
@@ -33950,6 +34640,17 @@ var WalletSetup = class {
 var RELAY_RETRY_MS = 3e4;
 /** Native listeners an app may hold per transport (the Desktop's Rust Iroh allows eight, `paired_transport.rs`). */
 var NATIVE_SLOTS = 8;
+/**
+* Iroh's listeners where it is the browser build (the web app, the extension, the CLI): Rust's eight are not its limit.
+* Each is a WebSocket to its relay and about 0.2 MiB: a phone-sized Chromium page held 128 of them, and the public
+* relays took sixteen started one after another, as the queue here starts them (six of sixteen started at once were
+* refused). 1:1 chats hold eight of them at most, as before: the rest is room for group links. HyperDHT keeps eight
+* there too: a page's listeners share one WebSocket to its relay, which drops a client past sixteen listens (device
+* links listen there as well), and each of the CLI's is a whole DHT node.
+*/
+var IROH_WEB_SLOTS = 16;
+/** Of a transport's listeners, the ones a group's links never hold: 1:1 chats keep that room. */
+var CHAT_NATIVE_SLOTS = 4;
 /** How often a group link that found no free native slot tries again. */
 var GROUP_NATIVE_RETRY_MS = 15e3;
 /** The longest a group link whose native listener failed to start waits before trying again (its wait doubles up to it). */
@@ -33984,6 +34685,8 @@ var CARD_RESTORE_MOST = 50;
 var CARD_RESTORE_MS = 6048e5;
 /** A reaction said on the live session and not confirmed is said again after this long. */
 var REACTION_RESEND_MS = 3e4;
+/** A file or a payment request of mine that waits for the chat to be live (a text that waits is its outbox's). */
+var waitsForLive = (m) => m.sender === "me" && m.delivery === "waiting" && (!!m.file || !!m.paymentId);
 /** This side's participation key in a chat: derived from its seed once, not at every state built. */
 function participationKeyOf(live) {
 	const seed = live.stored.participationSeed;
@@ -34180,10 +34883,11 @@ var GhostlyNode = class GhostlyNode {
 	});
 	clockOff;
 	/**
-	* Edges of groups whose WebRTC did not connect in this run of the app (`edgeWithoutRtc`): they go on as an app with
-	* no WebRTC does, over a native transport. Not kept: the next start tries WebRTC first again.
+	* Edges of groups whose WebRTC did not connect (`edgeWithoutRtc`): they go on as an app with no WebRTC does, over a
+	* native transport, until the member is seen online again after a packet said it was gone (`away`, `edgeRtcPresence`).
+	* Not kept: the next start tries WebRTC first again.
 	*/
-	edgeRtcOff = /* @__PURE__ */ new Set();
+	edgeRtcOff = /* @__PURE__ */ new Map();
 	pollIntervals;
 	localFetch;
 	links = /* @__PURE__ */ new Map();
@@ -34319,6 +35023,16 @@ var GhostlyNode = class GhostlyNode {
 	});
 	stateTimer = null;
 	paymentTimer = null;
+	/**
+	* The reviews whose outcome is still open (submitted, unknown), by id: what the payment poll asks about, so that it
+	* does not read every review ever made every 10 s. `null` until the store was read once. An id is only ever added
+	* from a read of the store or a change of a review, and leaves when the poll finds its review ended or gone.
+	*/
+	openReviews = null;
+	noteOpenReviews(reviews) {
+		const open = this.openReviews ??= /* @__PURE__ */ new Set();
+		for (const review of reviews) if (review.state === "submitted" || review.state === "unknown") open.add(review.id);
+	}
 	/** Every minute, the reviews no Approve can send any more are cancelled (dropStaleReviews). */
 	staleReviewTimer;
 	/** Group links: admins read knocks, joiners knock (WISP 902 § Entry link). */
@@ -34441,6 +35155,7 @@ var GhostlyNode = class GhostlyNode {
 			}
 		}
 	], (review) => {
+		if (this.openReviews) this.noteOpenReviews([review]);
 		if (review.state === "settled") this.feedback("confirmed", review.id);
 		if (review.state === "failed") this.cueFeedback({
 			cue: "failed",
@@ -34963,7 +35678,11 @@ var GhostlyNode = class GhostlyNode {
 			await this.messagesChanged(chat, [id]);
 			this.emitState();
 		},
-		notify: (chat, key) => this.feedback("reaction", `${chat}:${key}`, chat)
+		notify: (chat, key) => this.feedback("reaction", `${chat}:${key}`, chat),
+		believed: (chat, by) => {
+			const membership = this.membership(chat.slice(6));
+			return !!membership?.members.has(by) && by !== membership.me;
+		}
 	});
 	/**
 	* The chat list's reaction once one to its message was taken back: the same one if it still stands, else the latest
@@ -34996,10 +35715,11 @@ var GhostlyNode = class GhostlyNode {
 		adminTurn: (_groupId, options) => this.confirmTurn({ within: options?.wait === false ? 0 : GhostlyNode.TURN_CONFIRM_WAIT_MS }),
 		staysOnline: () => this.options.staysOnline ?? (this.options.platform === "desktop" && typeof RTCPeerConnection !== "undefined"),
 		peerRoom: (groupId) => {
-			if (typeof RTCPeerConnection === "undefined" && Object.keys(this.nativeFactories).length) {
+			const native = Object.keys(this.nativeFactories);
+			if (typeof RTCPeerConnection === "undefined" && native.length) {
 				let held = 0;
 				for (const live of this.links.values()) if (live.stored.group && live.stored.group !== groupId && live.link) held++;
-				return Math.max(0, 4 - held);
+				return Math.max(0, Math.max(...native.map((key) => this.groupNativeSlots(key))) - held);
 			}
 			const budget = this.options.peerBudget;
 			if (budget === void 0) return void 0;
@@ -35048,6 +35768,9 @@ var GhostlyNode = class GhostlyNode {
 		edgeNick: (linkId) => this.links.get(linkId)?.presence.nick || void 0,
 		storeMessage: (message) => this.storeNewMessage(message),
 		completeMessage: (message) => this.completeGroupMessage(message),
+		forgetFrame: async (linkId, id) => {
+			await db.patchMessage(linkId, id, (stored) => stored.frame ? { frame: void 0 } : null, true);
+		},
 		membersChanged: (groupId) => this.groupMembersChanged(groupId),
 		historyGone: (groupId) => this.groupHistoryGone(groupId),
 		emit: () => this.emitState(),
@@ -35110,7 +35833,11 @@ var GhostlyNode = class GhostlyNode {
 				admin: !!this.groups.views().find((g) => g.id === groupId)?.isAdmin
 			};
 		},
-		send: (groupId, edit, to) => this.groups.sendEdit(groupId, edit, to)
+		send: (groupId, edit, to) => this.groups.sendEdit(groupId, edit, to),
+		edge: (groupId, member) => {
+			const link = this.links.get(this.memberEdges(groupId).get(member) ?? "")?.link;
+			return link?.supportsGroupVersion(1) ? link : void 0;
+		}
 	});
 	/** A community member's edit, signed by them: of their own message, and only while they are a member. */
 	async receiveCommunityEdit(groupId, sender, frame) {
@@ -35331,12 +36058,14 @@ var GhostlyNode = class GhostlyNode {
 			};
 		}
 		const wallets = this.withHomes(walletInstances(networks));
+		const intents = (await intentRepository.list()).map((saved) => saved.review);
+		this.noteOpenReviews(intents);
 		this.walletView = {
 			...networks.mainnet,
 			networks,
 			wallets,
 			offers: this.walletOffers(networks, wallets),
-			intents: (await intentRepository.list()).map((saved) => saved.review),
+			intents,
 			setup: this.walletSetup.view()
 		};
 		this.announcePaymentNetworks(wallets);
@@ -35405,9 +36134,16 @@ var GhostlyNode = class GhostlyNode {
 	async pollPaymentStatus() {
 		if (this.shuttingDown) return;
 		try {
-			for (const { review } of await intentRepository.list()) {
+			if (!this.openReviews) this.noteOpenReviews((await intentRepository.list()).map((saved) => saved.review));
+			const open = this.openReviews;
+			for (const id of [...open]) {
+				const review = (await intentRepository.get(id))?.review;
+				if (!review || !["submitted", "unknown"].includes(review.state)) {
+					open.delete(id);
+					continue;
+				}
 				const network = walletNetworkOf(review.network);
-				if (!["submitted", "unknown"].includes(review.state) || review.method === "arkade" && !this.arkWallets[network].adapter || review.method === "bark" && !this.barkWallets[network].adapter || review.method === "spark" && !this.sparkWallets[network].adapter || review.method === "usdt" && !this.usdtWallets[network].adapter || review.method === "bitcoin" && !this.bitcoins[network].sources.active || review.method === "fedimint" && !this.fedimintWallets[network].federation(review.provider)) continue;
+				if (review.method === "arkade" && !this.arkWallets[network].adapter || review.method === "bark" && !this.barkWallets[network].adapter || review.method === "spark" && !this.sparkWallets[network].adapter || review.method === "usdt" && !this.usdtWallets[network].adapter || review.method === "bitcoin" && !this.bitcoins[network].sources.active || review.method === "fedimint" && !this.fedimintWallets[network].federation(review.provider)) continue;
 				await this.reconcilePayment({ id: review.id }).catch(() => {});
 			}
 		} finally {
@@ -35460,6 +36196,7 @@ var GhostlyNode = class GhostlyNode {
 			if (!stored.group) this.fileDesk.restore(stored.id, storedFiles);
 			const files = linkFilesFrom(stored.id, storedFiles, messages);
 			this.links.set(stored.id, newLiveLink(stored, messages[messages.length - 1]?.timestamp ?? 0, files));
+			if (!stored.group) this.links.get(stored.id).waitingSends = Promise.resolve(new Set(messages.filter(waitsForLive).map((m) => m.id)));
 			history.set(stored.id, messages);
 			for (const message of messages.slice(-20)) this.clockSample(message);
 			const note = latestReaction(messages);
@@ -35913,10 +36650,12 @@ var GhostlyNode = class GhostlyNode {
 		this.publicActivity.clear();
 		for (const queue of this.editQueues.values()) queue.stop();
 		this.groupEdits.stop();
+		this.reactions.stop();
 		this.cardEdits.stop();
 		await Promise.allSettled([
 			linksStopped,
 			links?.stop(),
+			this.groups.flush(),
 			...WALLET_NETWORKS.flatMap((network) => [
 				this.arkWallets,
 				this.barkWallets,
@@ -36116,14 +36855,23 @@ var GhostlyNode = class GhostlyNode {
 	edgeView(groupId, member) {
 		for (const live of this.links.values()) if (live.stored.group === groupId && live.stored.groupPeer === member && !live.stored.groupEntry) return edgeView(live, Date.now(), this.groupNativeWaiting.has(live.stored.id));
 	}
-	getMessages(linkId) {
-		return db.getMessages(linkId);
+	/** A chat's or a group's history, as a page gets it (`withoutFrame`). */
+	async getMessages(linkId) {
+		return (await db.getMessages(linkId)).map(withoutFrame);
 	}
 	/** One message of a chat, read by its id: the whole history costs a read of every row. */
-	getMessage(linkId, id) {
-		return db.getMessage(linkId, id);
+	async getMessage(linkId, id) {
+		const message = await db.getMessage(linkId, id);
+		return message && withoutFrame(message);
 	}
-	async messagePage({ linkId, limit = 50, before }) {
+	async messagePage(asked) {
+		const page = await this.storedPage(asked);
+		return {
+			...page,
+			messages: page.messages.map(withoutFrame)
+		};
+	}
+	async storedPage({ linkId, limit = 50, before }) {
 		if (!Number.isSafeInteger(limit) || limit < 1) throw new Error("limit: a whole number of messages, at least 1");
 		if (before === void 0) return db.getMessagePage(linkId, { limit });
 		if (typeof before === "number") {
@@ -36202,9 +36950,17 @@ var GhostlyNode = class GhostlyNode {
 			madeAt: Date.now()
 		};
 	}
-	/** One invite warmed and waiting (`after` ms from now), warmed again every so often while it waits (the relays forget). */
+	/**
+	* One invite warmed and waiting (`after` ms from now), warmed again every so often while it waits (the relays forget).
+	* Once too old for `takeInvite` to hand out, it is replaced by a new one, warmed at once: warming it on would spend
+	* two puts every few minutes on keys nobody will use, and leave the next invite on cold keys.
+	*/
 	prepareSpare(after = 0) {
 		if (this.shuttingDown || !this.networkOn) return;
+		if (this.spare && after === 0 && Date.now() - this.spare.madeAt >= SPARE_INVITE_MAX_AGE_MS) {
+			for (const identity of [identityFromSeedB64(this.spare.mine.seedB64), this.spare.inviteKey]) this.warmedKeys.delete(identity.pubKeyZ32);
+			this.spare = null;
+		}
 		if (!this.spare) this.spare = this.makeSpare();
 		const spare = this.spare;
 		if (this.spareTimer) clearTimeout(this.spareTimer);
@@ -36220,10 +36976,11 @@ var GhostlyNode = class GhostlyNode {
 			this.warmedKeys.set(identity.pubKeyZ32, Date.now());
 			this.warmKey(identity);
 		}
+		const untilAged = spare.madeAt + SPARE_INVITE_MAX_AGE_MS - Date.now();
 		this.spareTimer = setTimeout(() => {
 			this.spareTimer = null;
 			if (this.spare === spare) this.prepareSpare();
-		}, SPARE_INVITE_WARM_EVERY_MS);
+		}, Math.min(SPARE_INVITE_WARM_EVERY_MS, untilAged));
 	}
 	async joinLink({ inviteCode }) {
 		const decoded = decodeInviteCode(inviteCode);
@@ -37448,11 +38205,18 @@ var GhostlyNode = class GhostlyNode {
 			outbox = new Outbox({
 				read: () => db.getMessages(linkId),
 				update: async (id, delivery, error, extra) => {
-					await db.updateDelivery(linkId, id, delivery, error, extra);
-					if (delivery === "delivered") await this.noteDetails(linkId, id, (details) => ({
-						...details,
-						receiptAt: Date.now()
-					}));
+					if (delivery === "delivered") await db.patchMessage(linkId, id, (message) => message.delivery === "delivered" ? null : {
+						...message.delivery && {
+							...extra,
+							delivery,
+							deliveryError: error
+						},
+						details: {
+							...message.details,
+							receiptAt: Date.now()
+						}
+					}, true);
+					else await db.updateDelivery(linkId, id, delivery, error, extra);
 					if (delivery === "sent" || delivery === "delivered") {
 						const message = await db.getMessage(linkId, id);
 						if (message) this.messageFeedback("sent", message);
@@ -37543,7 +38307,7 @@ var GhostlyNode = class GhostlyNode {
 	}
 	/** Adds to a message's details record, whatever the row's delivery state. Nothing is pushed for it: the view asks. */
 	noteDetails(linkId, id, change) {
-		return db.patchMessage(linkId, id, (message) => ({ details: change(message.details ?? {}, message) })).then(() => {}, () => {});
+		return db.patchMessage(linkId, id, (message) => ({ details: change(message.details ?? {}, message) }), true).then(() => {}, () => {});
 	}
 	/** One send of a text on its details: the path, the frame and its size, and the DHT envelope when that was the way. */
 	noteTextSend(linkId, message, snapshot, at, error, link) {
@@ -38181,40 +38945,59 @@ var GhostlyNode = class GhostlyNode {
 		const live = this.links.get(linkId);
 		if (!live?.link?.isDataLinkOpen) return;
 		const withTexts = this.outboxFor(linkId).sendsFiles;
-		const waiting = (await db.getMessages(linkId)).filter((m) => m.sender === "me" && m.delivery === "waiting" && (m.file && !withTexts || m.paymentId)).sort((a, b) => a.timestamp - b.timestamp);
+		const known = await this.waitingSendsOf(live), waiting = [];
+		for (const id of [...known]) {
+			const message = await db.getMessage(linkId, id);
+			if (!message || !waitsForLive(message)) known.delete(id);
+			else if (message.file && !withTexts || message.paymentId) waiting.push(message);
+		}
+		waiting.sort((a, b) => a.timestamp - b.timestamp);
 		if (waiting.some((m) => m.file) && !GhostlyNode.takesFiles(live.link)) await GhostlyNode.largeFilesAgreed(live.link);
-		for (const message of waiting) if (message.file) {
-			if (!GhostlyNode.takesFiles(live.link)) {
-				await db.updateDelivery(linkId, message.id, "failed", "Your contact's app cannot receive files.");
-				continue;
-			}
-			const file = message.file, wireId = file.id.slice(`${linkId}-out-`.length);
-			await db.putMessage(sentNow(message));
-			this.transferFile(live, file, wireId, message.timestamp, (error) => {
-				this.transfers.set(file.id, {
-					state: "failed",
-					transferred: 0,
-					size: file.size,
-					error
-				});
-				this.emitState();
-			}, GhostlyNode.wireReply(message));
-		} else if (live.link.supportsPayments) {
-			const at = Date.now();
-			await db.putMessage({
-				...sentNow(message),
-				details: {
-					...withSend(message.details, {
-						at,
-						...pathSnapshot(live, "datalink"),
-						result: "sent"
-					}),
-					sentAt: at
+		for (const message of waiting) {
+			if (message.file) {
+				if (!GhostlyNode.takesFiles(live.link)) {
+					await db.updateDelivery(linkId, message.id, "failed", "Your contact's app cannot receive files.");
+					continue;
 				}
-			});
-		} else await db.updateDelivery(linkId, message.id, "failed", "Your contact's app cannot receive payment requests.");
+				const file = message.file, wireId = file.id.slice(`${linkId}-out-`.length);
+				await db.putMessage(sentNow(message));
+				this.transferFile(live, file, wireId, message.timestamp, (error) => {
+					this.transfers.set(file.id, {
+						state: "failed",
+						transferred: 0,
+						size: file.size,
+						error
+					});
+					this.emitState();
+				}, GhostlyNode.wireReply(message));
+			} else if (live.link.supportsPayments) {
+				const at = Date.now();
+				await db.putMessage({
+					...sentNow(message),
+					details: {
+						...withSend(message.details, {
+							at,
+							...pathSnapshot(live, "datalink"),
+							result: "sent"
+						}),
+						sentAt: at
+					}
+				});
+			} else await db.updateDelivery(linkId, message.id, "failed", "Your contact's app cannot receive payment requests.");
+			known.delete(message.id);
+		}
 		if (waiting.length) await this.messagesChanged(linkId, waiting.map((m) => m.id));
 	}
+	/**
+	* The ids of my messages that wait for the live link (`waitsForLive`). A chat loaded at the start has them from that
+	* read; any other reads its history once in a run. A session that opens then reads those rows, however long the chat.
+	*/
+	waitingSendsOf(live) {
+		return live.waitingSends ??= db.getMessages(live.stored.id).then((history) => new Set(history.filter(waitsForLive).map((m) => m.id)), (error) => {
+			live.waitingSends = void 0;
+			throw error;
+		});
+	}
 	receiveFile(linkId, wire) {
 		const files = this.links.get(linkId)?.files;
 		if (!files) return "refused";
@@ -38662,8 +39445,8 @@ var GhostlyNode = class GhostlyNode {
 		};
 		return this.groups.fileCheck(groupId);
 	}
-	groupMessages({ groupId }) {
-		return this.groups.messages(groupId);
+	async groupMessages({ groupId }) {
+		return (await this.groups.messages(groupId)).map(withoutFrame);
 	}
 	/**
 	* Presses a button of a message someone else sent to a chat or a group (`group:<id>`), WISP 406 · Message Buttons:
@@ -40434,8 +41217,8 @@ var GhostlyNode = class GhostlyNode {
 		if (this.options.singleDevice) return;
 		const record = await readDeviceRecord(databaseName()).catch(() => null);
 		if (!record || record.state !== "active") return;
-		const verifier = await this.handoffVerifier().catch(() => null);
-		if (verifier && JSON.stringify(verifier) !== JSON.stringify(record.verifier)) await amendDevice(databaseName(), { verifier });
+		const verifier = await this.handoffVerifier();
+		if (verifier ? JSON.stringify(verifier) !== JSON.stringify(record.verifier) : record.verifier) await amendDevice(databaseName(), { verifier: verifier ?? void 0 });
 	}
 	/**
 	* Copies the network settings into the device record (WISP 06, `devices/network.ts`), where device-link-only mode
@@ -40519,8 +41302,12 @@ var GhostlyNode = class GhostlyNode {
 		this.emitState();
 		await recoverEnrollment(databaseName(), this.turnNetwork()).catch(() => false);
 		await this.syncDeviceVerifier().catch(() => {});
-		const outcome = await (await this.deviceLinks.turnKeeper())?.check(false);
-		if (outcome?.kind === "go-on" && !outcome.restricted) this.noteGoodTurn();
+		const keeper = await this.deviceLinks.turnKeeper();
+		const outcome = await keeper?.check(false);
+		if (outcome?.kind === "go-on" && !outcome.restricted) {
+			this.noteGoodTurn();
+			await keeper?.stateVerifier().catch(() => null);
+		}
 		if (outcome?.kind === "gated" && !this.shuttingDown) {
 			const record = await readDeviceRecord(databaseName());
 			if (record) await this.stopReplaced(viewOf(record));
@@ -40556,7 +41343,10 @@ var GhostlyNode = class GhostlyNode {
 		if (knownDeviceGate()?.state !== "active") return;
 		const outcome = await links.checkTurn(false).catch(() => null);
 		if (this.shuttingDown || this.gatedOut) return;
-		if (outcome?.kind === "go-on" && !outcome.restricted) this.noteGoodTurn();
+		if (outcome?.kind === "go-on" && !outcome.restricted) {
+			this.noteGoodTurn();
+			await this.stateDeviceVerifier();
+		}
 		if (outcome?.kind === "gated") {
 			const record = await readDeviceRecord(databaseName()).catch(() => null);
 			if (record) await this.stopReplaced(viewOf(record));
@@ -40870,16 +41660,45 @@ var GhostlyNode = class GhostlyNode {
 		if (this.options.singleDevice) return;
 		if (typeof password !== "string" || !password) throw new Error("A password is needed");
 		const stored = await this.handoffVerifier();
-		if (stored && knownDeviceGate()?.state === "active" && !await provesHandoffPassword(stored, typeof current === "string" ? current : "")) throw new Error("handoff-password: The current password is wrong.");
+		const active = knownDeviceGate()?.state === "active";
+		const ready = await handoffPakeReady().then(() => true, () => false);
+		if (stored && !ready) {
+			if (password !== current) await this.dropHandoffVerifier();
+			throw new Error("The password proof could not be loaded");
+		}
+		if (stored && active && !await provesHandoffPassword(stored, typeof current === "string" ? current : "")) throw new Error("handoff-password: The current password is wrong.");
+		if (stored && await provesHandoffPassword(stored, password)) {
+			await this.syncDeviceVerifier().catch(() => {});
+			await this.stateDeviceVerifier();
+			return;
+		}
 		try {
 			const verifier = await makeHandoffVerifier(password);
 			await wrap((await store(STORES$1.settings, "readwrite")).put(verifier, GhostlyNode.HANDOFF_VERIFIER));
 			await this.syncDeviceVerifier().catch(() => {});
+			await this.stateDeviceVerifier();
 		} catch (error) {
-			await wrap((await store(STORES$1.settings, "readwrite")).delete(GhostlyNode.HANDOFF_VERIFIER)).catch(() => {});
+			await this.dropHandoffVerifier();
 			throw error;
 		}
 	}
+	/** The profile has no verifier any more: its settings, the device state, and what the turn record states. */
+	async dropHandoffVerifier() {
+		await wrap((await store(STORES$1.settings, "readwrite")).delete(GhostlyNode.HANDOFF_VERIFIER)).catch(() => {});
+		await this.syncDeviceVerifier().catch(() => {});
+		await this.stateDeviceVerifier();
+	}
+	/**
+	* The turn record states which verifier the profile has now (WISP 06 § Record, the verifier mark), so a standby that
+	* keeps an older one does not take over with the password it checks. Asked after the device state took the
+	* verifier: at start, at each change, and after a good read of the turn (a change made offline is stated then).
+	*/
+	async stateDeviceVerifier() {
+		if (this.options.singleDevice || this.shuttingDown || this.gatedOut) return;
+		try {
+			await (await this.deviceLinks?.turnKeeper())?.stateVerifier();
+		} catch {}
+	}
 	/**
 	* The wallets in a handoff to `taker` (WISP 06 § Wallets, `planHandoffWallets`): what moves, what stays home, and
 	* what keeps the profile here now. `view`: the wallets as they are now, read fresh by default.
@@ -40984,10 +41803,10 @@ var GhostlyNode = class GhostlyNode {
 		}
 		await writeWalletHomes(plan.wallets);
 		const breezDatabases = [...new Set(plan.wallets.flatMap((w) => w.route === "moves" && w.breez && breez.has(w.id) ? [breez.get(w.id)] : []))];
-		const verifier = await this.handoffVerifier().catch(() => null);
+		const verifier = await this.handoffVerifier().then((value) => ({ verifier: value ?? void 0 }), () => ({}));
 		await moveDevice(profile, "releasing", {
 			...patch,
-			...verifier ? { verifier } : {},
+			...verifier,
 			breezDatabases: breezDatabases.length ? breezDatabases : void 0
 		});
 		this.events.onDeviceGate?.({
@@ -41433,6 +42252,7 @@ var GhostlyNode = class GhostlyNode {
 					});
 					live.presence = presence;
 					if (!entry && presence.nick && !live.link?.isDataLinkOpen) this.groups.edgeNick(group, peer, presence.nick);
+					if (!entry) this.edgeRtcPresence(linkId, presence);
 					this.emitState();
 				},
 				onPairingState: (state) => {
@@ -41443,6 +42263,9 @@ var GhostlyNode = class GhostlyNode {
 					this.directPath.note(peer, evidence);
 					if (!entry && evidence !== "open" && evidence !== "closed") this.edgeWithoutRtc(linkId);
 				},
+				onAnswersRefused: () => {
+					if (!entry) this.edgeWithoutRtc(linkId);
+				},
 				onDataLinkState: (state) => {
 					traceJoin(group, `link.${state}`, { role });
 					if (state === "open" || live.dataLink === "open") live.lastSyncAt = Date.now();
@@ -41487,14 +42310,44 @@ var GhostlyNode = class GhostlyNode {
 	* never went live, and the member stayed unreachable for as long as that network lasted. The edge starts again as on an
 	* app with no WebRTC (WISP 902 § Transports): it runs its native endpoints and says so in its packet (`_tr`, with no
 	* `webrtc/1`), the member's app starts its own for it as it does for a Linux Desktop, and the two meet over Iroh
-	* through its relay. For this run of the app only.
+	* through its relay. Until the member comes back (`edgeRtcPresence`), or for this run of the app.
 	*/
 	async edgeWithoutRtc(linkId) {
-		const live = this.links.get(linkId), link = live?.link;
-		if (!live || !link || !live.stored.group || live.stored.groupEntry || this.shuttingDown || this.options.webrtcGroupLinks) return;
+		const live = this.links.get(linkId);
+		if (!live?.link || !live.stored.group || live.stored.groupEntry || this.shuttingDown || this.options.webrtcGroupLinks) return;
 		if (this.edgeRtcOff.has(linkId) || this.keepsGroupNative(live.stored) || !Object.keys(this.nativeFactories).length) return;
-		this.edgeRtcOff.add(linkId);
+		this.edgeRtcOff.set(linkId, { away: false });
 		traceLink(live.myPubKeyZ32, "edge-rtc-off", {});
+		await this.restartEdge(linkId);
+	}
+	/**
+	* A member whose edge went native here (`edgeWithoutRtc`) is seen online again after a packet said it was gone: the
+	* attempt that failed may have been its app quitting in the middle of it (a one-shot CLI command, a quick restart),
+	* not a network that blocks direct connections. Held native for this whole run, the edge said so in its packet, the
+	* member's app followed on its next starts, and past the group links' native slots members stayed unreachable for as
+	* long as this app ran (2026-10-09). The edge tries WebRTC again, its `_tr` with `webrtc/1` again (WISP 902 §
+	* Transports); a network that really blocks it costs one more failed attempt per return.
+	*/
+	edgeRtcPresence(linkId, presence) {
+		const off = this.edgeRtcOff.get(linkId);
+		if (!off) return;
+		if (!presence.online) {
+			off.away = true;
+			return;
+		}
+		if (!off.away) return;
+		const live = this.links.get(linkId);
+		this.edgeRtcOff.delete(linkId);
+		if (live) traceLink(live.myPubKeyZ32, "edge-rtc-back", {});
+		this.groupNativeWaiting.delete(linkId);
+		this.groupNativeFailed.delete(linkId);
+		this.groupNativeRetryAt = 0;
+		this.restartEdge(linkId);
+	}
+	/** An edge starts again, on what `keepsGroupNative` says now. */
+	async restartEdge(linkId) {
+		const live = this.links.get(linkId), link = live?.link;
+		if (!live || !link) return;
 		live.link = null;
 		await link.stop(false).catch(() => {});
 		if (this.links.get(linkId) !== live || live.link || this.shuttingDown || !this.networkOn) return;
@@ -41613,6 +42466,7 @@ var GhostlyNode = class GhostlyNode {
 				role: stored.inviteCode ? "inviter" : "joiner",
 				startedAt: stored.createdAt
 			} : void 0,
+			madeAt: stored.createdAt,
 			transport: this.transport,
 			nick: this.sharedNick,
 			avatar: this.sharedAvatar,
@@ -41715,16 +42569,17 @@ var GhostlyNode = class GhostlyNode {
 					const was = live.status, synced = live.lastSyncAt;
 					live.status = status;
 					if (status === "online") live.lastSyncAt = Date.now();
-					if (status !== was || !synced || stored.group || linkId === this.activeLinkId) this.emitState();
+					if (status !== was || !synced && status === "online" || stored.group || linkId === this.activeLinkId) this.emitState();
 				},
 				onPoll: ({ polling, nextInMs }) => {
-					const was = live.poll.polling;
+					const was = live.poll.polling, first = !live.lastSyncAt && !live.firstReadDone;
 					live.poll = {
 						polling,
 						nextAt: Date.now() + nextInMs,
 						interval: nextInMs || live.poll.interval
 					};
-					if (linkId === this.activeLinkId || !live.lastSyncAt && polling !== was) this.emitState();
+					if (was && !polling) live.firstReadDone = true;
+					if (linkId === this.activeLinkId || first && polling !== was) this.emitState();
 				},
 				onMessageReceipt: async (id) => {
 					const oneToOne = !!stored.profile && !stored.group;
@@ -42006,7 +42861,7 @@ var GhostlyNode = class GhostlyNode {
 	get nativeFactories() {
 		const relay = this.relaysHyperdht ? this.hyperdhtRelay : "";
 		return {
-			...relay ? { "hyperdht/1": async (seedB64) => (await import("./hyperdhtRelay-CgYLaQz3.js")).createRelayedHyperEndpoint(seedB64, relay) } : {},
+			...relay ? { "hyperdht/1": async (seedB64) => (await import("./hyperdhtRelay-C1p0nkle.js")).createRelayedHyperEndpoint(seedB64, relay) } : {},
 			...this.options.nativeTransports,
 			...this.ownIrohRelays ? { "iroh/1": (seedB64) => this.options.nativeTransports["iroh/1"](seedB64, this.settings.irohRelays?.length ? { relays: [...this.settings.irohRelays] } : {}) } : {},
 			...this.options.irohWeb ? { "iroh/1": (seedB64) => createIrohWebEndpoint(seedB64, { relays: this.irohRelays }) } : {}
@@ -42121,6 +42976,14 @@ var GhostlyNode = class GhostlyNode {
 			this.emitState();
 		});
 	}
+	/** The listeners this app may hold for a transport: sixteen for Iroh's browser build (`IROH_WEB_SLOTS`), eight for the others. */
+	nativeSlots(key) {
+		return key === "iroh/1" && this.options.irohWeb ? IROH_WEB_SLOTS : NATIVE_SLOTS;
+	}
+	/** Of those, what its groups' links may hold, all groups together. */
+	groupNativeSlots(key) {
+		return this.nativeSlots(key) - CHAT_NATIVE_SLOTS;
+	}
 	/**
 	* One transport's listener for one chat, in that transport's queue. "no-slot" when a group's link found no slot free,
 	* "failed" when the listener could not start.
@@ -42134,11 +42997,13 @@ var GhostlyNode = class GhostlyNode {
 		live.transportErrors ??= {};
 		try {
 			const owners = [...this.links.values()].filter((other) => other.link?.availableTransports.includes(key));
-			if (group && (owners.length >= NATIVE_SLOTS || owners.filter((other) => other.stored.group).length >= 4)) return "no-slot";
-			if (owners.length >= NATIVE_SLOTS) {
+			const slots = this.nativeSlots(key), groups = owners.filter((other) => other.stored.group).length;
+			if (group && (owners.length >= slots || groups >= this.groupNativeSlots(key))) return "no-slot";
+			const full = owners.length >= slots;
+			if (full || !group && owners.length - groups >= NATIVE_SLOTS) {
 				const now = Date.now();
 				const taking = !group && (this.activeLinkId === linkId || inUse);
-				const victim = owners.filter((other) => other.stored.group && other.link?.canReleaseEndpoint(key)).sort((a, b) => (a.link?.isDataLinkOpen ? 1 : 0) - (b.link?.isDataLinkOpen ? 1 : 0))[0] ?? (taking ? owners.filter((other) => other !== live && other.stored.id !== this.activeLinkId && other.link?.canReleaseEndpoint(key) && now - (other.nativeTakenAt?.[key] ?? 0) >= 12e4).sort((a, b) => a.lastMessageAt - b.lastMessageAt)[0] : void 0);
+				const victim = (!full ? void 0 : owners.filter((other) => other.stored.group && other.link?.canReleaseEndpoint(key)).sort((a, b) => (a.link?.isDataLinkOpen ? 1 : 0) - (b.link?.isDataLinkOpen ? 1 : 0))[0]) ?? (taking ? owners.filter((other) => other !== live && other.stored.id !== this.activeLinkId && other.link?.canReleaseEndpoint(key) && now - (other.nativeTakenAt?.[key] ?? 0) >= 12e4).sort((a, b) => a.lastMessageAt - b.lastMessageAt)[0] : void 0);
 				const idle = victim || !taking || !this.reachedOnlyNatively(live) ? void 0 : owners.filter((other) => other !== live && !other.stored.group && other.stored.id !== this.activeLinkId && !this.fileDesk.moving(other.stored.id) && other.link?.canYieldEndpoint(key, 12e4)).sort((a, b) => a.link.lastActivityAt - b.link.lastActivityAt)[0];
 				const idleFor = idle ? now - idle.link.lastActivityAt : 0;
 				if (idle && await idle.link.yieldEndpoint(key, 12e4)) {
@@ -42159,7 +43024,7 @@ var GhostlyNode = class GhostlyNode {
 						active: this.activeLinkId === linkId
 					});
 					if (this.activeLinkId === linkId && !group) this.retryActiveSlot(linkId);
-					throw new Error("All eight native connection slots are in use. This chat takes one once a chat live over one has been quiet for 2 minutes. Disconnect a native connection in another chat to free one now.");
+					throw new Error("All native connection slots are in use. This chat takes one once a chat live over one has been quiet for 2 minutes. Disconnect a native connection in another chat to free one now.");
 				} else {
 					await victim.link.releaseEndpoint(key);
 					victim.transportErrors ??= {};
@@ -42309,7 +43174,8 @@ var GhostlyNode = class GhostlyNode {
 			...whole.file && {
 				file: whole.file,
 				text: whole.text
-			}
+			},
+			...whole.frame && { frame: whole.frame }
 		};
 		if (!Object.keys(added).length) return;
 		if (!await db.patchMessage(message.linkId, message.id, (stored) => {
@@ -42335,12 +43201,12 @@ var GhostlyNode = class GhostlyNode {
 			}
 		}
 		const onChanges = this.events.onMessageChanges;
-		if (!onChanges) return this.events.onMessages(linkId, await db.getMessages(linkId));
+		if (!onChanges) return this.events.onMessages(linkId, await this.getMessages(linkId));
 		const unique = [...new Set(ids)];
 		if (!unique.length) return;
 		const rows = await Promise.all(unique.map((id) => db.getMessage(linkId, id)));
 		onChanges.call(this.events, linkId, {
-			messages: rows.filter((row) => !!row),
+			messages: rows.filter((row) => !!row).map(withoutFrame),
 			deleted: unique.filter((_, i) => !rows[i])
 		});
 	}
@@ -42435,6 +43301,7 @@ var GhostlyNode = class GhostlyNode {
 			};
 		}
 		if (!await db.addMessage(message)) return false;
+		if (live && waitsForLive(message)) live.waitingSends?.then((known) => known.add(message.id), () => {});
 		this.clockSample(message);
 		const newest = this.newestAt.get(message.linkId);
 		if (!message.event) this.newestAt.set(message.linkId, Math.max(newest ?? 0, writtenAt(message, this.clockLeads.get(message.linkId))));
@@ -42527,7 +43394,10 @@ var GhostlyNode = class GhostlyNode {
 			lastMessageAt: live.lastMessageAt,
 			peerAck: live.peerAck,
 			lastSyncAt: live.lastSyncAt,
-			poll: live.poll
+			poll: live.firstReadDone && !live.lastSyncAt && stored.id !== this.activeLinkId ? {
+				...live.poll,
+				polling: false
+			} : live.poll
 		};
 	}
 	/** What this chat can do right now: on the open session, or held for an away contact (text, files and requests only). */
@@ -42811,4 +43681,4 @@ function signalKind(signal) {
 //#endregion
 export { EngineServer, hyperdhtRelayProblem as n, server_exports as t };
 
-//# sourceMappingURL=server-Cy4ox7oD.js.map
+//# sourceMappingURL=server-0zfNpABQ.js.map