@unicitylabs/sphere-sdk 0.14.0-dev.5 → 0.14.0-dev.7

package/dist/modules/payments-v2/index.js

@@ -23,7 +23,10 @@ var STORE_KEYS = {
   shortfalls: "shortfalls",
   settlingLinks: "settling",
   streamCursor: (s) => `cursor:${s}`,
-  epochLatch: "epoch-latch"
+  epochLatch: "epoch-latch",
+  // §5.2 InventoryView durable overlays (#625/#679).
+  suspectedSpent: "suspected-spent",
+  knownSpends: "known-spends"
 };
 
 // node_modules/@noble/hashes/utils.js
@@ -549,6 +552,10 @@ function isValidationReject(err) {
   if (e === null) return false;
   return e.status === 422 || e.statusCode === 422 || e.code === "VALIDATION" || e.code === "VALIDATION_FAILED";
 }
+function retryAfterMsOf(err) {
+  const retryAfter = err !== null && typeof err === "object" ? err.retryAfter : void 0;
+  return typeof retryAfter === "number" && Number.isFinite(retryAfter) && retryAfter >= 0 ? retryAfter : null;
+}
 var chainRegistry = /* @__PURE__ */ new WeakMap();
 var replayRegistry = /* @__PURE__ */ new WeakMap();
 function registryFor(registry, kv, storeKey, make) {
@@ -811,7 +818,7 @@ var TransferMachine = class {
     }
     if (cls === null) {
       await this.applyCommitted(engine, plan.transferId, committed);
-      this.closeTail(plan.transferId, plan.payload);
+      this.closeTail(engine, plan.transferId, plan.payload, committed);
       return { committed, deliveryPending };
     }
     if (cls === "conflict" && committed.length > 0) {
@@ -837,10 +844,10 @@ var TransferMachine = class {
     }
     await this.applyCommitted(engine, r.transferId, committed);
     if (conflicts.length > 0) {
-      return { deliveryPending, partial: await this.settlePartial(r, committed, conflicts) };
+      return { deliveryPending, partial: await this.settlePartial(engine, r, committed, conflicts) };
     }
     await this.completeIntent(r.transferId, r.payload);
-    await this.finishBookkeeping(r.transferId, r.payload, "resumed");
+    await this.finishBookkeeping(engine, r.transferId, r.payload, "resumed", committed);
     return { deliveryPending, partial: null };
   }
   // ── shared transitions ─────────────────────────────────────────────────────
@@ -1022,7 +1029,7 @@ var TransferMachine = class {
     }
     return added;
   }
-  async settlePartial(r, committed, conflicts) {
+  async settlePartial(engine, r, committed, conflicts) {
     const undelivered = conflicts.reduce((sum, c) => sum + c.amount, 0n);
     const entry = {
       transferId: r.transferId,
@@ -1034,26 +1041,27 @@ var TransferMachine = class {
     };
     await this.stores.shortfalls.upsert(entry);
     await this.completeIntent(r.transferId, r.payload);
-    await this.finishBookkeeping(r.transferId, r.payload, "resumed");
+    await this.finishBookkeeping(engine, r.transferId, r.payload, "resumed", committed);
     return entry;
   }
-  closeTail(transferId, payload) {
+  closeTail(engine, transferId, payload, committed) {
     void (async () => {
       try {
         await this.completeIntent(transferId, payload);
       } catch {
         return;
       }
-      await this.finishBookkeeping(transferId, payload, "sent");
+      await this.finishBookkeeping(engine, transferId, payload, "sent", committed);
     })();
   }
   async completeIntent(transferId, payload) {
     const signature = payload.split !== void 0 ? await this.deps.signComplete(transferId) : void 0;
     await this.deps.intents.complete(transferId, signature);
   }
-  async finishBookkeeping(transferId, payload, phase) {
+  async finishBookkeeping(engine, transferId, payload, phase, committed) {
     try {
-      await this.deps.recordHistory?.({ transferId, payload, phase });
+      const committedAmount = await this.settledAmount(engine, payload.coinId, committed);
+      await this.deps.recordHistory?.({ transferId, payload, phase, committedAmount });
     } catch {
     }
     try {
@@ -1061,6 +1069,26 @@ var TransferMachine = class {
     } catch {
     }
   }
+  /**
+   * §5.9: SENT history records what SETTLED, never the plan — the value of the
+   * certified recipient blobs (summarize()'s committed set is the only source;
+   * a journal-rehydrated resume leg has no source token, but every committed
+   * leg carries its recipient blob, so the outcome-derived rule is uniform).
+   */
+  async settledAmount(engine, coinId, committed) {
+    let total = 0n;
+    for (const outcome of committed) {
+      if (outcome.recipientBlob === void 0) continue;
+      const token = await engine.decodeToken({
+        v: TOKEN_BLOB_VERSION,
+        network: 0,
+        tokenId: "",
+        token: outcome.recipientBlob
+      });
+      total += engine.balanceOf(token, coinId);
+    }
+    return total.toString();
+  }
   async disposeOnFailure(transferId, committed, cls) {
     if (committed.length > 0 || cls === "keep-open") return;
     try {
@@ -1085,7 +1113,7 @@ function conflictAmount(engine, payload, op, source) {
 }
 
 // modules/payments-v2/machine/resume.ts
-async function resumeAll(deps) {
+async function resumeAll(deps, options = {}) {
   const report = { resumed: [], conflicted: [], failed: [] };
   const stores = createMachineStores(deps.kv);
   const open = await deps.intents.listOpen();
@@ -1095,7 +1123,12 @@ async function resumeAll(deps) {
   } catch {
     return report;
   }
-  await dropStaleLocalAborts(stores, locals, new Set(open.map((i) => i.transferId)));
+  await dropStaleBackstops(
+    stores,
+    locals,
+    new Set(open.map((i) => i.transferId)),
+    options.isLocallyActive ?? (() => false)
+  );
   const jobs = await gateAndDecode(deps, stores, open, locals, report);
   const ctx = {
     deps,
@@ -1108,11 +1141,16 @@ async function resumeAll(deps) {
   }
   return report;
 }
-async function dropStaleLocalAborts(stores, locals, openIds) {
+async function dropStaleBackstops(stores, locals, openIds, isLocallyActive) {
   for (const entry of locals.values()) {
-    if (entry.disposition !== "open" && !openIds.has(entry.transferId)) {
+    if (openIds.has(entry.transferId)) continue;
+    if (entry.disposition !== "open") {
       await stores.backstop.removeByKey(entry.transferId);
+      continue;
     }
+    if (isLocallyActive(entry.transferId)) continue;
+    if ((await stores.deliveryJournal.byTransfer(entry.transferId)).size > 0) continue;
+    await stores.backstop.removeByKey(entry.transferId);
   }
 }
 async function gateAndDecode(deps, stores, open, locals, report) {
@@ -1225,6 +1263,349 @@ function validatePayload(raw) {
   return p;
 }
 
+// modules/payments-v2/convergence.ts
+var HEARTBEAT_SEED_MS = 5e3;
+var HEARTBEAT_CAP_MS = 12e4;
+var ConvergenceHeartbeat = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  timer = null;
+  delayMs = HEARTBEAT_SEED_MS;
+  notBefore = 0;
+  running = false;
+  start() {
+    this.running = true;
+    this.delayMs = HEARTBEAT_SEED_MS;
+    this.notBefore = 0;
+  }
+  /** §7 quiescence unchanged: a mid-backoff stop() cancels cleanly. */
+  stop() {
+    this.running = false;
+    this.clearTimer();
+  }
+  /** Reset to seed on progress, ×2 to the cap otherwise; idle stops rescheduling. */
+  settle(outcome, pending) {
+    if (outcome.retryAfterMs !== null) {
+      this.notBefore = Math.max(this.notBefore, this.deps.now() + outcome.retryAfterMs);
+    }
+    if (!pending) {
+      this.delayMs = HEARTBEAT_SEED_MS;
+      return;
+    }
+    const delay = outcome.progress ? HEARTBEAT_SEED_MS : this.delayMs;
+    this.delayMs = Math.min(delay * 2, HEARTBEAT_CAP_MS);
+    this.schedule(delay);
+  }
+  /** New pending work (keep-open park / journaled delivery / mint hold): prompt retry. */
+  arm() {
+    if (!this.running) return;
+    this.delayMs = Math.min(HEARTBEAT_SEED_MS * 2, HEARTBEAT_CAP_MS);
+    this.schedule(HEARTBEAT_SEED_MS);
+  }
+  /** connection:status recovery: the backoff resets; a pending tick re-fires at the seed. */
+  recovered() {
+    this.delayMs = HEARTBEAT_SEED_MS;
+    if (this.timer !== null) this.arm();
+  }
+  schedule(delayMs) {
+    this.clearTimer();
+    if (!this.running) return;
+    const floored = Math.max(delayMs, this.notBefore - this.deps.now());
+    this.timer = setTimeout(() => {
+      this.timer = null;
+      this.deps.onTick();
+    }, floored);
+  }
+  clearTimer() {
+    if (this.timer !== null) clearTimeout(this.timer);
+    this.timer = null;
+  }
+};
+var Converger = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  /** Resume open intents, then drain the delivery + mint journals (all idempotent). */
+  async convergeOnce() {
+    let progress = false;
+    let retryAfterMs = null;
+    try {
+      progress = await this.resumePass();
+    } catch (err) {
+      retryAfterMs = retryAfterMsOf(err);
+    }
+    try {
+      const stats = await this.deps.stores.deliveryJournal.replay(this.replayDeps());
+      progress = progress || stats.delivered > 0;
+    } catch (err) {
+      retryAfterMs ??= retryAfterMsOf(err);
+    }
+    try {
+      progress = await this.deps.replayMints() > 0 || progress;
+    } catch (err) {
+      retryAfterMs ??= retryAfterMsOf(err);
+    }
+    return { progress, retryAfterMs };
+  }
+  /** §4 heartbeat predicate — read fresh from the §6 stores, never cached. */
+  async pendingWork() {
+    const [backstop, journal, mints] = await Promise.all([
+      this.deps.stores.backstop.list(),
+      this.deps.stores.deliveryJournal.list(),
+      this.deps.stores.mintJournal.list()
+    ]);
+    return backstop.length > 0 || journal.some((e) => e.undeliverable !== true) || mints.length > 0;
+  }
+  async resumePass() {
+    const report = await resumeAll(this.filteredMachineDeps(), {
+      isLocallyActive: (id) => this.deps.isActiveOp(id)
+    });
+    const progress = report.resumed.length > 0 || report.conflicted.length > 0;
+    await this.deps.reconcile({
+      resumed: report.resumed,
+      conflicted: report.conflicted,
+      open: report.failed
+    });
+    if (progress) await this.deps.refreshView().catch(() => void 0);
+    return progress;
+  }
+  filteredMachineDeps() {
+    const intents = this.deps.machineDeps.intents;
+    return {
+      ...this.deps.machineDeps,
+      intents: {
+        ...intents,
+        listOpen: async () => (await intents.listOpen()).filter((intent) => !this.deps.isActiveOp(intent.transferId))
+      }
+    };
+  }
+  replayDeps() {
+    return {
+      delivery: this.deps.delivery,
+      now: () => this.deps.now(),
+      attention: (transferId, code, detail) => {
+        this.deps.emit(
+          "transfer:attention",
+          detail === void 0 ? { transferId, code } : { transferId, code, detail }
+        );
+      }
+    };
+  }
+};
+async function derivePendingTransfers(stores, decryptPayload) {
+  const [backstop, journal, shortfalls] = await Promise.all([
+    stores.backstop.list(),
+    stores.deliveryJournal.list(),
+    stores.shortfalls.list()
+  ]);
+  const byTransfer = groupJournal(journal);
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of backstop) {
+    if (entry.disposition !== "open") continue;
+    seen.add(entry.transferId);
+    out.push(await openRow(entry, byTransfer.get(entry.transferId) ?? [], decryptPayload));
+  }
+  for (const [transferId, entries] of byTransfer) {
+    if (seen.has(transferId)) continue;
+    seen.add(transferId);
+    out.push(journalOnlyRow(transferId, entries));
+  }
+  for (const entry of shortfalls) {
+    if (!seen.has(entry.transferId)) out.push(shortfallRow(entry));
+  }
+  return out;
+}
+function groupJournal(journal) {
+  const byTransfer = /* @__PURE__ */ new Map();
+  for (const entry of journal) {
+    const mine = byTransfer.get(entry.transferId);
+    if (mine === void 0) byTransfer.set(entry.transferId, [entry]);
+    else mine.push(entry);
+  }
+  return byTransfer;
+}
+async function openRow(entry, journal, decryptPayload) {
+  let payload = null;
+  try {
+    const raw = await decryptPayload(entry.payloadEnvelope);
+    if (raw !== null && typeof raw === "object") payload = raw;
+  } catch {
+    payload = null;
+  }
+  const total = Array.isArray(payload?.direct) ? payload.direct.length + (payload.split !== void 0 ? 1 : 0) : 0;
+  const certified = distinctOpCount(journal);
+  return {
+    transferId: entry.transferId,
+    kind: "open",
+    recipient: typeof payload?.recipient === "string" ? payload.recipient : "",
+    coinId: typeof payload?.coinId === "string" ? payload.coinId : "",
+    amount: typeof payload?.amount === "string" ? payload.amount : "",
+    legs: { certified, total: Math.max(total, certified) },
+    deliveryPending: journal.length > 0,
+    createdAt: entry.createdAt
+  };
+}
+function journalOnlyRow(transferId, entries) {
+  const certified = distinctOpCount(entries);
+  return {
+    transferId,
+    kind: "open",
+    recipient: entries[0].recipientPubkey,
+    coinId: "",
+    amount: "",
+    legs: { certified, total: certified },
+    deliveryPending: true,
+    createdAt: 0
+  };
+}
+function shortfallRow(entry) {
+  return {
+    transferId: entry.transferId,
+    kind: "shortfall",
+    recipient: entry.recipient,
+    coinId: entry.coinId,
+    amount: entry.remainingAmount,
+    legs: { certified: entry.committedTokenIds.length, total: entry.committedTokenIds.length },
+    deliveryPending: false,
+    createdAt: entry.createdAt
+  };
+}
+function distinctOpCount(entries) {
+  return new Set(entries.map((entry) => entry.opIndex)).size;
+}
+
+// modules/payments-v2/restore.ts
+var ATTENTION_RESEED_REJECTED = "intent:reseed-rejected";
+var ALL_STREAMS = ["inventory", "mailbox", "payment_requests", "history"];
+async function reseedAndReset(deps) {
+  for (const entry of await deps.stores.backstop.list()) {
+    if (entry.disposition !== "open") continue;
+    try {
+      await deps.reput(entry.transferId, entry.payloadEnvelope, entry.requiresSeedClose);
+      if (entry.requiresSeedClose) {
+        await deps.reseedCheckpoint(entry.transferId, await splitOpIndex(deps, entry.payloadEnvelope));
+      }
+    } catch (err) {
+      deps.attention(entry.transferId, ATTENTION_RESEED_REJECTED, err instanceof Error ? err.message : String(err));
+    }
+  }
+  for (const stream of ALL_STREAMS) await deps.kv.remove(STORE_KEYS.streamCursor(stream));
+  await deps.fullRePull();
+}
+async function splitOpIndex(deps, envelope) {
+  const payload = await deps.decryptPayload(envelope);
+  return Array.isArray(payload.direct) ? payload.direct.length : 0;
+}
+
+// modules/payments-v2/inventory/presentation.ts
+function toToken(tokenId, snapshot, asset, registry, flags) {
+  const iconUrl = registry.getIconUrl(asset.coinId);
+  return {
+    id: tokenId,
+    coinId: asset.coinId,
+    symbol: registry.getSymbol(asset.coinId),
+    name: registry.getName(asset.coinId),
+    decimals: registry.getDecimals(asset.coinId),
+    ...iconUrl !== null ? { iconUrl } : {},
+    amount: asset.amount,
+    status: flags.transferring ? "transferring" : "confirmed",
+    createdAt: snapshot.createdAt,
+    updatedAt: snapshot.updatedAt,
+    lazy: true,
+    ...flags.suspectedSpent ? { suspectedSpent: true } : {}
+  };
+}
+function aggregateAssets(entries, isTransferring, registry) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const [tokenId, entry] of entries) {
+    const moving = isTransferring(tokenId);
+    for (const asset of entry.assets) {
+      let group = groups.get(asset.coinId);
+      if (!group) {
+        group = { total: 0n, count: 0, transferring: 0n, transferringCount: 0 };
+        groups.set(asset.coinId, group);
+      }
+      if (moving) {
+        group.transferring += BigInt(asset.amount);
+        group.transferringCount += 1;
+      } else {
+        group.total += BigInt(asset.amount);
+        group.count += 1;
+      }
+    }
+  }
+  return [...groups].map(([coinId, totals]) => toAsset(coinId, totals, registry));
+}
+function toAsset(coinId, totals, registry) {
+  const iconUrl = registry.getIconUrl(coinId);
+  return {
+    coinId,
+    symbol: registry.getSymbol(coinId),
+    name: registry.getName(coinId),
+    decimals: registry.getDecimals(coinId),
+    ...iconUrl !== null ? { iconUrl } : {},
+    totalAmount: totals.total.toString(),
+    tokenCount: totals.count,
+    confirmedAmount: totals.total.toString(),
+    unconfirmedAmount: "0",
+    confirmedTokenCount: totals.count,
+    unconfirmedTokenCount: 0,
+    transferringTokenCount: totals.transferringCount,
+    transferringAmount: totals.transferring.toString(),
+    priceUsd: null,
+    priceEur: null,
+    change24h: null,
+    fiatValueUsd: null,
+    fiatValueEur: null
+  };
+}
+async function withPrices(raw, registry, price) {
+  try {
+    const names = [...new Set(raw.map((a) => registry.getName(a.coinId)))];
+    const quotes = await price.getPrices(names);
+    return raw.map((a) => priceOne(a, quotes.get(registry.getName(a.coinId))));
+  } catch {
+    return raw;
+  }
+}
+function priceOne(asset, quote) {
+  if (!quote) return asset;
+  const human = Number(asset.totalAmount) / Math.pow(10, asset.decimals);
+  return {
+    ...asset,
+    priceUsd: quote.priceUsd,
+    priceEur: quote.priceEur ?? null,
+    change24h: quote.change24h ?? null,
+    fiatValueUsd: human * quote.priceUsd,
+    fiatValueEur: quote.priceEur != null ? human * quote.priceEur : null
+  };
+}
+
+// modules/payments-v2/machine/payload.ts
+function buildPayload(recipientPubkey, request, spend, spentStates) {
+  return {
+    v: 2,
+    recipient: recipientPubkey,
+    coinId: request.coinId,
+    amount: request.amount,
+    ...request.memo !== void 0 ? { memo: request.memo } : {},
+    direct: [...spend.plan.direct],
+    ...spend.plan.split !== void 0 ? {
+      split: {
+        tokenId: spend.plan.split.tokenId,
+        splitAmount: spend.plan.split.splitAmount.toString(),
+        remainderAmount: spend.plan.split.remainderAmount.toString()
+      }
+    } : {},
+    spentStates
+  };
+}
+function messageOf(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+
 // node_modules/@noble/ciphers/utils.js
 function isBytes2(a) {
   return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
@@ -2133,13 +2514,14 @@ var History = class {
   }
   // ── internals ────────────────────────────────────────────────────────────────
   async post(build) {
+    const record = build();
     try {
-      await this.deps.client.postHistory([build()]);
+      await this.deps.client.postHistory([record]);
     } catch (err) {
       this.deps.log?.("history POST failed (dedupKey makes retry safe)", err);
       return;
     }
-    this.deps.emit("history:updated");
+    this.deps.emit("history:updated", this.toEntry(record));
   }
   ts(timestamp) {
     return new Date(timestamp ?? (this.deps.now ?? Date.now)()).toISOString();
@@ -2196,93 +2578,9 @@ var History = class {
   }
 };
 
-// modules/payments-v2/inventory/presentation.ts
-function toToken(tokenId, snapshot, asset, registry, flags) {
-  const iconUrl = registry.getIconUrl(asset.coinId);
-  return {
-    id: tokenId,
-    coinId: asset.coinId,
-    symbol: registry.getSymbol(asset.coinId),
-    name: registry.getName(asset.coinId),
-    decimals: registry.getDecimals(asset.coinId),
-    ...iconUrl !== null ? { iconUrl } : {},
-    amount: asset.amount,
-    status: flags.transferring ? "transferring" : "confirmed",
-    createdAt: snapshot.createdAt,
-    updatedAt: snapshot.updatedAt,
-    lazy: true,
-    ...flags.suspectedSpent ? { suspectedSpent: true } : {}
-  };
-}
-function aggregateAssets(entries, isTransferring, registry) {
-  const groups = /* @__PURE__ */ new Map();
-  for (const [tokenId, entry] of entries) {
-    const moving = isTransferring(tokenId);
-    for (const asset of entry.assets) {
-      let group = groups.get(asset.coinId);
-      if (!group) {
-        group = { total: 0n, count: 0, transferring: 0n, transferringCount: 0 };
-        groups.set(asset.coinId, group);
-      }
-      if (moving) {
-        group.transferring += BigInt(asset.amount);
-        group.transferringCount += 1;
-      } else {
-        group.total += BigInt(asset.amount);
-        group.count += 1;
-      }
-    }
-  }
-  return [...groups].map(([coinId, totals]) => toAsset(coinId, totals, registry));
-}
-function toAsset(coinId, totals, registry) {
-  const iconUrl = registry.getIconUrl(coinId);
-  return {
-    coinId,
-    symbol: registry.getSymbol(coinId),
-    name: registry.getName(coinId),
-    decimals: registry.getDecimals(coinId),
-    ...iconUrl !== null ? { iconUrl } : {},
-    totalAmount: totals.total.toString(),
-    tokenCount: totals.count,
-    confirmedAmount: totals.total.toString(),
-    unconfirmedAmount: "0",
-    confirmedTokenCount: totals.count,
-    unconfirmedTokenCount: 0,
-    transferringTokenCount: totals.transferringCount,
-    transferringAmount: totals.transferring.toString(),
-    priceUsd: null,
-    priceEur: null,
-    change24h: null,
-    fiatValueUsd: null,
-    fiatValueEur: null
-  };
-}
-async function withPrices(raw, registry, price) {
-  try {
-    const names = [...new Set(raw.map((a) => registry.getName(a.coinId)))];
-    const quotes = await price.getPrices(names);
-    return raw.map((a) => priceOne(a, quotes.get(registry.getName(a.coinId))));
-  } catch {
-    return raw;
-  }
-}
-function priceOne(asset, quote) {
-  if (!quote) return asset;
-  const human = Number(asset.totalAmount) / Math.pow(10, asset.decimals);
-  return {
-    ...asset,
-    priceUsd: quote.priceUsd,
-    priceEur: quote.priceEur ?? null,
-    change24h: quote.change24h ?? null,
-    fiatValueUsd: human * quote.priceUsd,
-    fiatValueEur: quote.priceEur != null ? human * quote.priceEur : null
-  };
-}
-
 // modules/payments-v2/inventory/InventoryView.ts
-var SUSPECTED_KEY = "suspected-spent";
-var KNOWN_SPENDS_KEY = "known-spends";
+var SUSPECTED_KEY = STORE_KEYS.suspectedSpent;
+var KNOWN_SPENDS_KEY = STORE_KEYS.knownSpends;
 var CURSOR_KEY = STORE_KEYS.streamCursor("inventory");
 function stateKey(tokenId, stateHash) {
   return `${tokenId}:${stateHash}`;
@@ -2678,19 +2976,24 @@ var Receive = class {
     const engine = deps.engine();
     const stored = [];
     const pending = [];
-    let epoch = "";
+    const pageEpoch = () => deps.delivery.incomingEpoch() ?? deps.syncEpoch();
     try {
-      epoch = deps.syncEpoch();
       const record = await deps.kv.get(STORE_KEYS.streamCursor("mailbox"));
-      const since = record !== null && record.syncEpoch === epoch ? String(record.cursor) : void 0;
-      for await (const entry of deps.delivery.incoming(since)) {
-        await this.processEntry(deps, engine, entry, pending, stored);
-        if (pending.length >= ACK_BATCH_SIZE) await flushAcks(deps, pending, epoch);
+      let basis = record !== null && record.syncEpoch === deps.syncEpoch() ? record : null;
+      for (let pass = 0; pass < 2; pass++) {
+        for await (const entry of deps.delivery.incoming(basis === null ? void 0 : String(basis.cursor))) {
+          await this.processEntry(deps, engine, entry, pending, stored);
+          if (pending.length >= ACK_BATCH_SIZE) await flushAcks(deps, pending, pageEpoch);
+        }
+        await flushAcks(deps, pending, pageEpoch);
+        const served = deps.delivery.incomingEpoch();
+        if (basis === null || served === null || served === basis.syncEpoch) break;
+        await deps.kv.remove(STORE_KEYS.streamCursor("mailbox"));
+        basis = null;
       }
-      await flushAcks(deps, pending, epoch);
     } catch (err) {
       logger.warn("PaymentsV2", "receive drain interrupted \u2014 unacked entries retry next drain:", err);
-      await flushAcks(deps, pending, epoch).catch((flushErr) => {
+      await flushAcks(deps, pending, pageEpoch).catch((flushErr) => {
         logger.warn("PaymentsV2", "receive ack flush failed \u2014 cursor holds at the acked prefix:", flushErr);
       });
     }
@@ -2763,7 +3066,7 @@ async function announce(deps, entry, record) {
     receivedAt
   };
 }
-async function flushAcks(deps, pending, epoch) {
+async function flushAcks(deps, pending, epochOf) {
   let lastAcked = null;
   try {
     while (pending.length > 0) {
@@ -2774,7 +3077,7 @@ async function flushAcks(deps, pending, epoch) {
     }
   } finally {
     if (lastAcked !== null) {
-      const record = { cursor: lastAcked, syncEpoch: epoch };
+      const record = { cursor: lastAcked, syncEpoch: epochOf() };
       await deps.kv.set(STORE_KEYS.streamCursor("mailbox"), record);
     }
   }
@@ -2875,9 +3178,19 @@ var Requests = class {
       }
     });
   }
+  /** Idempotent for a same-transferId re-write: committed only ratchets up, createdAt kept. */
   writeLink(requestId, transferId, committed) {
     return this.mutateJournal((m) => {
-      m.set(requestId, { requestId, transferId, committed, createdAt: this.now() });
+      const prev = m.get(requestId);
+      const same = prev !== void 0 && prev.transferId === transferId;
+      const next = {
+        requestId,
+        transferId,
+        committed: committed || same && prev.committed,
+        createdAt: same ? prev.createdAt : this.now()
+      };
+      if (same && prev.committed === next.committed) return false;
+      m.set(requestId, next);
       return true;
     });
   }
@@ -3030,23 +3343,46 @@ var Requests = class {
         const transferId = error instanceof SphereError && error.transferId !== void 0 ? error.transferId : void 0;
         if (transferId !== void 0) {
           const committed = error instanceof PartialSendConflictError;
-          await this.writeLink(id, transferId, committed);
-          this.setStatus(id, "settling");
+          await this.settle(id, transferId, { committed, respond: false });
         } else {
           logger.error("PaymentsV2", `possibly-committed send for ${id} carried no transferId \u2014 paid (fail-closed)`);
           this.setStatus(id, "paid");
         }
       } else {
-        await this.clearLink(id);
-        this.setStatus(id, "pending");
+        await this.revertPayable(id);
       }
       throw error;
     }
-    this.setStatus(id, "paid");
-    await this.respondPaid(id, result.id);
-    await this.clearLink(id);
+    await this.settle(id, result.id, { committed: true, respond: true });
     return result;
   }
+  /**
+   * THE settlement invariant (#441 + the failed-respond P1): a settling link is
+   * removed ONLY by (a) a CONFIRMED paid respond — a 2xx, or the 409
+   * already-resolved absorb — or (b) a proven clean pre-commit failure
+   * (revertPayable). Nothing else removes one: not a network error, not a 5xx,
+   * not a reload. Every path that binds a request to a transfer outcome funnels
+   * through here — pay()'s clean success (respond now), pay()'s
+   * possibly-committed throw (respond deferred), and reconcile's deferred arms
+   * — so a failed respond always leaves the link + 'settling' and the next
+   * reconcile pass (the committed-link override) retries the respond.
+   */
+  async settle(requestId, transferId, opts) {
+    let journalDown = false;
+    try {
+      await this.writeLink(requestId, transferId, opts.committed);
+    } catch (err) {
+      if (!opts.respond) throw err;
+      journalDown = true;
+      logger.error("PaymentsV2", `settling link write failed for ${requestId} \u2014 responding fail-closed:`, err);
+    }
+    if (!(opts.respond && await this.respondPaid(requestId, transferId))) {
+      this.setStatus(requestId, journalDown ? "paid" : "settling");
+      return;
+    }
+    if (!journalDown) await this.clearLink(requestId).catch(() => void 0);
+    this.setStatus(requestId, "paid");
+  }
   /** 'paid' respond leg: 409 = already resolved = idempotent success; other errors defer. */
   async respondPaid(id, transferId) {
     try {
@@ -3082,32 +3418,32 @@ var Requests = class {
     let aborted = null;
     for (const [requestId, link] of [...this.journal]) {
       if (link.committed || resumed.has(link.transferId)) {
-        await this.resolvePaid(requestId, link.transferId);
+        await this.resolvePaid(requestId, link);
       } else if (conflicted.has(link.transferId)) {
         await this.revertPayable(requestId);
       } else if (open.has(link.transferId)) {
       } else {
-        aborted = await this.reconcileUnaccounted(requestId, link.transferId, aborted);
+        aborted = await this.reconcileUnaccounted(requestId, link, aborted);
       }
     }
   }
   // Unaccounted link: consult the server aborted authority (lazy, memoized);
   // a probe failure defers the link to the next session.
-  async reconcileUnaccounted(requestId, transferId, aborted) {
+  async reconcileUnaccounted(requestId, link, aborted) {
     try {
       aborted ??= new Set(await this.deps.listAbortedTransferIds());
-      if (aborted.has(transferId)) await this.revertPayable(requestId);
-      else await this.resolvePaid(requestId, transferId);
+      if (aborted.has(link.transferId)) await this.revertPayable(requestId);
+      else await this.resolvePaid(requestId, link);
     } catch (err) {
       logger.warn("PaymentsV2", `aborted-intent probe failed \u2014 ${requestId} deferred:`, err);
     }
     return aborted;
   }
-  async resolvePaid(requestId, transferId) {
-    if (!await this.respondPaid(requestId, transferId)) return;
-    await this.clearLink(requestId);
-    this.setStatus(requestId, "paid");
+  /** Deferred paid: the ONE settlement path again — a failed respond keeps the link. */
+  resolvePaid(requestId, link) {
+    return this.settle(requestId, link.transferId, { committed: link.committed, respond: true });
   }
+  /** Removal cause (b): a PROVEN clean outcome (pre-commit failure / server-aborted). */
   async revertPayable(requestId) {
     await this.clearLink(requestId);
     this.setStatus(requestId, "pending");
@@ -3431,11 +3767,12 @@ function composeFacadeParts(deps, hooks) {
     client: deps.client,
     fieldKey: deps.fieldKey,
     registry: deps.registry,
-    emit: (event) => deps.emit(event, {}),
+    emit: (event, entry) => deps.emit(event, entry),
     ...deps.now !== void 0 ? { now: deps.now } : {},
     ...deps.newId !== void 0 ? { newId: deps.newId } : {}
   });
   const machineDeps = buildMachineDeps(deps, hooks, historyStore);
+  const machineStores = createMachineStores(deps.kv);
   const heldStates = /* @__PURE__ */ new Map();
   return {
     ownPubkeyBytes,
@@ -3443,12 +3780,29 @@ function composeFacadeParts(deps, hooks) {
     ledger,
     queue,
     historyStore,
-    machineStores: createMachineStores(deps.kv),
+    machineStores,
     machineDeps,
     machine: new TransferMachine(machineDeps),
     heldStates,
     receiveLoop: buildReceive(deps, hooks, historyStore, heldStates),
-    requests: buildRequests(deps, hooks)
+    requests: buildRequests(deps, hooks),
+    restoreDeps: buildRestoreDeps(deps, machineDeps, machineStores, view)
+  };
+}
+function buildRestoreDeps(deps, machineDeps, machineStores, view) {
+  return {
+    stores: machineStores,
+    kv: deps.kv,
+    reput: (transferId, envelope, requiresSeedClose) => machineDeps.intents.put(transferId, envelope, requiresSeedClose),
+    reseedCheckpoint: (transferId, opIndex) => deps.checkpointStore.reseedCheckpoint(transferId, opIndex),
+    decryptPayload: machineDeps.decryptPayload,
+    fullRePull: () => view.onEpochReset(),
+    attention: (transferId, code, detail) => {
+      deps.emit(
+        "transfer:attention",
+        detail === void 0 ? { transferId, code } : { transferId, code, detail }
+      );
+    }
   };
 }
 function buildMachineDeps(deps, hooks, historyStore) {
@@ -3470,11 +3824,13 @@ function buildMachineDeps(deps, hooks, historyStore) {
     ownPubkey: hexToBytes(deps.ownPubkey),
     emit: deps.emit,
     now: deps.now ?? Date.now,
-    recordHistory: async ({ transferId, payload }) => {
+    recordHistory: async ({ transferId, payload, committedAmount }) => {
       await historyStore.recordSent({
         transferId,
         coinId: payload.coinId,
-        amount: payload.amount,
+        // §5.9: the SETTLED amount (machine-computed from the certified
+        // recipient blobs), never payload.amount — the plan.
+        amount: committedAmount,
         recipientPubkey: payload.recipient,
         ...payload.memo !== void 0 ? { memo: payload.memo } : {}
       });
@@ -3501,7 +3857,7 @@ function buildReceive(deps, hooks, historyStore, heldStates) {
         detail === void 0 ? { transferId, code } : { transferId, code, detail }
       );
     },
-    syncEpoch: deps.syncEpoch ?? (() => ""),
+    syncEpoch: deps.syncEpoch,
     ...deps.now !== void 0 ? { now: deps.now } : {}
   });
 }
@@ -3554,8 +3910,24 @@ var PaymentsFacade = class {
     this.receiveLoop = parts.receiveLoop;
     this.heldStates = parts.heldStates;
     this.ownPubkeyBytes = parts.ownPubkeyBytes;
+    this.restoreDeps = parts.restoreDeps;
     this.requests = parts.requests;
     deps.deliveryPort.bindDeliveryKeys((blob) => this.engine().deliveryKeys(blob));
+    this.heartbeat = new ConvergenceHeartbeat({
+      now: () => this.nowMs(),
+      onTick: () => this.trackTail(this.runConvergencePass())
+    });
+    this.converger = new Converger({
+      machineDeps: this.machineDeps,
+      stores: this.machineStores,
+      delivery: deps.deliveryPort,
+      reconcile: (report) => this.requests.reconcile(report),
+      refreshView: () => this.view.delta(),
+      replayMints: () => this.replayMints(),
+      isActiveOp: (id) => this.activeMoneyOps.has(id),
+      emit: deps.emit,
+      now: () => this.nowMs()
+    });
   }
   view;
   ledger;
@@ -3567,17 +3939,28 @@ var PaymentsFacade = class {
   receiveLoop;
   heldStates;
   ownPubkeyBytes;
+  restoreDeps;
   requests;
   currentEngine = null;
   pendingOps = /* @__PURE__ */ new Set();
   unsubscribers = [];
   started = false;
+  // §7 heartbeat: in-memory timing cell + pass runner (see convergence.ts).
+  heartbeat;
+  converger;
+  /** Resume single-flight (§7): ticks, start() and resumeNow() coalesce onto ONE pass. */
+  resumeFlight = new SingleFlight();
+  /** §5.1/§7: restore + convergence passes SERIALIZE here. */
+  passChain = new SerialChain();
+  /** §7 ownership: ids with an in-process machine attempt — the pass never adopts one. */
+  activeMoneyOps = /* @__PURE__ */ new Set();
   // ── lifecycle ──────────────────────────────────────────────────────────────
   async start() {
     if (this.started) return;
     this.started = true;
-    await this.deps.session.start();
+    this.heartbeat.start();
     this.unsubscribers.push(
+      this.deps.session.subscribeEpochChange((epoch) => this.handleEpochChange(epoch)),
       this.deps.session.subscribeStream("mailbox", () => {
         this.trackTail(this.receiveLoop.drainOnce());
       }),
@@ -3588,20 +3971,12 @@ var PaymentsFacade = class {
         this.trackTail(this.requests.drainIncoming());
       })
     );
-    this.trackTail(this.runResume());
-    this.trackTail(
-      this.machineStores.deliveryJournal.replay({
-        delivery: this.deps.deliveryPort,
-        now: this.deps.now ?? Date.now,
-        attention: (transferId, code, detail) => {
-          this.deps.emit(
-            "transfer:attention",
-            detail === void 0 ? { transferId, code } : { transferId, code, detail }
-          );
-        }
-      })
-    );
-    this.trackTail(this.replayMints());
+    const statusUnsub = this.deps.session.subscribeStatus?.((status) => {
+      if (status === "connected") this.heartbeat.recovered();
+    });
+    if (statusUnsub !== void 0) this.unsubscribers.push(statusUnsub);
+    await this.deps.session.start();
+    this.trackTail(this.runConvergencePass());
     this.trackTail(this.seedHeldStates());
     await this.view.fullPull().catch(() => void 0);
     this.receiveLoop.start(this.deps.receivePollMs);
@@ -3609,6 +3984,7 @@ var PaymentsFacade = class {
   /** §7 same-address restart gate: resolves only after in-flight ops settle. */
   async stop() {
     this.started = false;
+    this.heartbeat.stop();
     this.receiveLoop.stop();
     for (const unsubscribe of this.unsubscribers) unsubscribe();
     this.unsubscribers = [];
@@ -3634,9 +4010,13 @@ var PaymentsFacade = class {
   history(page) {
     return this.historyStore.page(page ?? {});
   }
+  /** §4 pending-transfers UI surface — derived on read, never cached (convergence.ts). */
+  pendingTransfers() {
+    return derivePendingTransfers(this.machineStores, this.machineDeps.decryptPayload);
+  }
   // ── money movement ─────────────────────────────────────────────────────────
   send(request) {
-    return this.track(this.sendWithPolicy(request));
+    return this.track(this.sendOutcome(request));
   }
   async receive() {
     const transfers = await this.track(this.receiveLoop.drainOnce());
@@ -3646,9 +4026,32 @@ var PaymentsFacade = class {
   mint(coinId, amount) {
     return this.track(this.mintInner(coinId, amount));
   }
+  // §4 retry verb: coalesces onto the running pass — NEVER re-issue send() (#631/#676).
+  async resumeNow() {
+    if (!this.started) return;
+    await this.track(this.runConvergencePass());
+  }
+  /** §5.1 restore — awaited by the session latch BEFORE streams resume; never coalesced onto a pre-restore pass. */
+  async handleEpochChange(_newEpoch) {
+    await this.passChain.enqueue(() => reseedAndReset(this.restoreDeps));
+    await this.passChain.enqueue(() => this.convergeBody());
+  }
+  /** One single-flighted pass + its reschedule: concurrent callers coalesce. */
+  runConvergencePass() {
+    return this.resumeFlight.run(() => this.passChain.enqueue(() => this.convergeBody()));
+  }
+  async convergeBody() {
+    const outcome = await this.converger.convergeOnce();
+    const pending = await this.converger.pendingWork().catch(() => true);
+    this.heartbeat.settle(outcome, pending);
+  }
+  nowMs() {
+    return (this.deps.now ?? Date.now)();
+  }
   // ── send policy (§5.5 + old-loop parity; the machine stays policy-free) ────
-  async sendWithPolicy(request) {
-    const recipient = await this.requireSameNetworkRecipient(request.recipient);
+  /** The ONE place a send() outcome is shaped: success emits in finishSend, a
+   *  CLEAN rejection emits `transfer:updated{status:'failed'}` here (§4). */
+  async sendOutcome(request) {
     const run = {
       amount: request.amount,
       delivered: [],
@@ -3656,12 +4059,36 @@ var PaymentsFacade = class {
       tokenTransfers: [],
       settledShortfalls: [],
       firstPartialId: void 0,
-      pendingAny: false
+      pendingAny: false,
+      lastTransferId: ""
     };
+    try {
+      return await this.sendWithPolicy(request, run);
+    } catch (err) {
+      this.emitCleanFailure(err, run.lastTransferId);
+      throw err;
+    }
+  }
+  /** Only a CLEAN failure (nothing certified, classifyError 'other') is 'failed'.
+   *  Keep-open/partial/conflict outcomes are pending/converging — labelling them
+   *  'failed' invites a dApp re-send, i.e. a double-pay (#631/#676). */
+  emitCleanFailure(err, transferId) {
+    if (isPossiblyCommittedSendOutcome(err) || classifyError(err) !== "other") return;
+    const failed = {
+      id: transferId,
+      status: "failed",
+      tokens: [],
+      tokenTransfers: [],
+      error: messageOf(err)
+    };
+    this.deps.emit("transfer:updated", failed);
+  }
+  async sendWithPolicy(request, run) {
+    const recipient = await this.requireSameNetworkRecipient(request.recipient);
     for (let attempt = 0; ; attempt++) {
       let ctx;
       try {
-        ctx = await this.planAndMaterialize(recipient.chainPubkey, { ...request, amount: run.amount });
+        ctx = await this.planAndMaterialize(recipient.chainPubkey, { ...request, amount: run.amount }, run);
       } catch (err) {
         throw this.partialize(err, run);
       }
@@ -3695,21 +4122,24 @@ var PaymentsFacade = class {
     return recipient;
   }
   async runAttempt(ctx) {
+    this.activeMoneyOps.add(ctx.transferId);
     try {
       const { deliveryPending } = await this.machine.run(ctx.plan);
       this.settleSuccess(ctx, ctx.sourceIds);
       return { kind: "success", deliveryPending };
     } catch (err) {
-      return this.disposeFailedAttempt(ctx, err);
+      return await this.disposeFailedAttempt(ctx, err);
+    } finally {
+      this.activeMoneyOps.delete(ctx.transferId);
     }
   }
-  /**
-   * Partial outcome (#677/#690): the shortfall is already durable (written by
-   * the machine BEFORE complete). Accumulate the settled set, then re-plan ONLY
-   * the remainder under a NEW transferId — never the full amount.
-   */
+  /** Partial (#677/#690): shortfall already durable (machine wrote it BEFORE
+   *  complete); accumulate settled, re-plan ONLY the remainder, NEW transferId. */
   async consumePartial(ctx, disposition, run, attempt) {
-    run.pendingAny = run.pendingAny || disposition.deliveryPending;
+    if (disposition.deliveryPending) {
+      run.pendingAny = true;
+      this.heartbeat.arm();
+    }
     const partial = disposition.entry;
     run.delivered.push(...partial.committedTokenIds);
     run.firstPartialId ??= partial.transferId;
@@ -3730,11 +4160,8 @@ var PaymentsFacade = class {
     run.amount = partial.remainingAmount;
     return null;
   }
-  /**
-   * One attempt's failure disposition: possibly-committed → rethrow UNWRAPPED;
-   * backstop still 'open' (committed>0) → converge via the same machine's
-   * resumeIntent; clean conflict with a demoted source → bounded full re-plan.
-   */
+  /** Failure disposition: possibly-committed → rethrow UNWRAPPED; backstop
+   *  'open' → converge via resumeIntent; clean demoted conflict → full re-plan. */
   async disposeFailedAttempt(ctx, err) {
     if (isPossiblyCommittedSendOutcome(err)) {
       this.settleKeepOpen(ctx);
@@ -3783,8 +4210,9 @@ var PaymentsFacade = class {
     }
     return { kind: "rethrow", error: err };
   }
-  async planAndMaterialize(recipientPubkey, request) {
+  async planAndMaterialize(recipientPubkey, request, run) {
     const transferId = this.newId();
+    run.lastTransferId = transferId;
     const planned = this.queue.plan(transferId, { coinId: request.coinId, amount: request.amount });
     const spend = planned.kind === "planned" ? planned.spend : await planned.settled;
     const sourceIds = this.markPlanned(transferId, request.coinId, spend);
@@ -3867,6 +4295,7 @@ var PaymentsFacade = class {
   /** Open intent: sources stay reserved + in-flight (§5.2) until resume adopts them. */
   settleKeepOpen(ctx) {
     this.queue.clearExpectedChange(ctx.transferId);
+    this.heartbeat.arm();
   }
   settlePartial(ctx, partial) {
     this.ledger.cancel(ctx.transferId);
@@ -3903,6 +4332,7 @@ var PaymentsFacade = class {
     for (const id of run.settledShortfalls.splice(0)) {
       await this.machineStores.shortfalls.removeByKey(id).catch(() => void 0);
     }
+    if (run.pendingAny) this.heartbeat.arm();
     const result = {
       id: transferId,
       status: run.pendingAny ? "confirmed" : "delivered",
@@ -3914,11 +4344,7 @@ var PaymentsFacade = class {
     this.deps.emit("transfer:updated", result);
     return result;
   }
-  /**
-   * With nothing delivered the error passes UNWRAPPED (identity + cause kept);
-   * after ≥1 delivered leg EVERY failure surfaces as PartialSendConflictError
-   * over the accumulated settled set — never bare, never a full-amount retry.
-   */
+  /** Nothing delivered → UNWRAPPED; after ≥1 delivered leg every failure surfaces as PartialSendConflictError over the settled set. */
   partialize(err, run) {
     if (run.delivered.length === 0) return err;
     return new PartialSendConflictError(
@@ -3947,21 +4373,29 @@ var PaymentsFacade = class {
     if (!/^(?:[0-9a-f]{2})+$/.test(coinId) || amount <= 0n) {
       return { success: false, error: "coinId must be even-length lowercase hex and amount positive" };
     }
-    const engine = this.engine();
     const mintId = this.newId();
-    const params = this.mintParams(coinId, amount);
+    this.activeMoneyOps.add(mintId);
+    try {
+      return await this.mintUnderJournal(mintId, coinId, amount);
+    } finally {
+      this.activeMoneyOps.delete(mintId);
+    }
+  }
+  async mintUnderJournal(mintId, coinId, amount) {
+    const engine = this.engine();
     const entry = {
       mintId,
       coinId,
       amount: amount.toString(),
       tokenId: "",
-      createdAt: (this.deps.now ?? Date.now)()
+      createdAt: this.nowMs()
     };
     await this.machineStores.mintJournal.upsert(entry);
     let token;
     try {
-      token = await engine.mint(params, { transferId: mintId });
+      token = await engine.mint(this.mintParams(coinId, amount), { transferId: mintId });
     } catch (err) {
+      this.heartbeat.arm();
       return { success: false, error: messageOf(err) };
     }
     if (token.blob.tokenId !== entry.tokenId) {
@@ -3970,6 +4404,7 @@ var PaymentsFacade = class {
     try {
       await this.finalizeMint(engine, mintId, token, coinId, amount.toString());
     } catch (err) {
+      this.heartbeat.arm();
       return { success: false, tokenId: token.blob.tokenId, error: messageOf(err) };
     }
     return { success: true, tokenId: token.blob.tokenId };
@@ -3992,18 +4427,22 @@ var PaymentsFacade = class {
     this.heldStates.set(token.blob.tokenId, (await engine.deliveryKeys(bytes)).stateHash);
     this.trackTail(this.view.delta());
   }
+  /** @returns how many journal entries were RESOLVED (cleared) — heartbeat progress. */
   async replayMints() {
+    let resolved = 0;
     for (const entry of await this.machineStores.mintJournal.list()) {
+      if (this.activeMoneyOps.has(entry.mintId)) continue;
       try {
-        await this.replayMint(entry);
+        if (await this.replayMint(entry)) resolved += 1;
       } catch {
       }
     }
+    return resolved;
   }
   async replayMint(entry) {
     if (entry.tokenId !== "" && await this.tokenInServerInventory(entry.tokenId)) {
       await this.machineStores.mintJournal.removeByKey(entry.mintId);
-      return;
+      return true;
     }
     const engine = this.engine();
     if (!supportsDeterministicMint(engine)) {
@@ -4011,7 +4450,7 @@ var PaymentsFacade = class {
         transferId: entry.mintId,
         code: ATTENTION_MINT_UNRESOLVED
       });
-      return;
+      return false;
     }
     const token = await engine.mint(this.mintParams(entry.coinId, BigInt(entry.amount)), {
       transferId: entry.mintId
@@ -4020,6 +4459,7 @@ var PaymentsFacade = class {
       await this.machineStores.mintJournal.upsert({ ...entry, tokenId: token.blob.tokenId });
     }
     await this.finalizeMint(engine, entry.mintId, token, entry.coinId, entry.amount);
+    return true;
   }
   mintParams(coinId, amount) {
     return {
@@ -4045,17 +4485,6 @@ var PaymentsFacade = class {
   newId() {
     return (this.deps.newId ?? randomUUID)();
   }
-  async runResume() {
-    const report = await resumeAll(this.machineDeps);
-    await this.requests.reconcile({
-      resumed: report.resumed,
-      conflicted: report.conflicted,
-      open: report.failed
-    });
-    if (report.resumed.length > 0 || report.conflicted.length > 0) {
-      await this.view.delta().catch(() => void 0);
-    }
-  }
   async seedHeldStates() {
     let page = await this.deps.storagePort.listInventory();
     for (let i = 0; i < INVENTORY_SCAN_PAGE_LIMIT; i++) {
@@ -4067,22 +4496,14 @@ var PaymentsFacade = class {
     }
   }
   toUiToken(tokenId, coinId, amount) {
-    const registry = this.deps.registry;
-    const iconUrl = registry.getIconUrl(coinId);
-    const now = (this.deps.now ?? Date.now)();
-    return {
-      id: tokenId,
-      coinId,
-      symbol: registry.getSymbol(coinId),
-      name: registry.getName(coinId),
-      decimals: registry.getDecimals(coinId),
-      ...iconUrl !== null ? { iconUrl } : {},
-      amount: amount.toString(),
-      status: "transferring",
-      createdAt: now,
-      updatedAt: now,
-      lazy: true
-    };
+    const now = this.nowMs();
+    return toToken(
+      tokenId,
+      { assets: [], createdAt: now, updatedAt: now },
+      { coinId, amount: amount.toString() },
+      this.deps.registry,
+      { transferring: true, suspectedSpent: false }
+    );
   }
   track(op) {
     const settled = op.then(
@@ -4097,29 +4518,11 @@ var PaymentsFacade = class {
     this.track(op).catch(() => void 0);
   }
 };
-function buildPayload(recipientPubkey, request, spend, spentStates) {
-  return {
-    v: 2,
-    recipient: recipientPubkey,
-    coinId: request.coinId,
-    amount: request.amount,
-    ...request.memo !== void 0 ? { memo: request.memo } : {},
-    direct: [...spend.plan.direct],
-    ...spend.plan.split !== void 0 ? {
-      split: {
-        tokenId: spend.plan.split.tokenId,
-        splitAmount: spend.plan.split.splitAmount.toString(),
-        remainderAmount: spend.plan.split.remainderAmount.toString()
-      }
-    } : {},
-    spentStates
-  };
-}
-function messageOf(err) {
-  return err instanceof Error ? err.message : String(err);
-}
 export {
   ATTENTION_MINT_UNRESOLVED,
+  ATTENTION_RESEED_REJECTED,
+  HEARTBEAT_CAP_MS,
+  HEARTBEAT_SEED_MS,
   MAX_RESELECT,
   PaymentsFacade,
   STORE_KEYS,