@unicitylabs/sphere-sdk 0.18.0-dev.2 → 0.18.0-dev.3

package/dist/modules/payments-v2/index.js

@@ -1695,6 +1695,33 @@ function decryptField(key, envelope) {
   return new TextDecoder().decode(decryptFieldBytes(key, envelope));
 }
 
+// token-engine/claims.ts
+var CoinClaims = class _CoinClaims {
+  issuers = /* @__PURE__ */ new Map();
+  policies = [];
+  static fromPlugins(plugins) {
+    const claims = new _CoinClaims();
+    for (const plugin of plugins ?? []) {
+      for (const policy of plugin.tokenIssuancePolicies ?? []) claims.add(policy);
+    }
+    return claims;
+  }
+  add(policy) {
+    const tokenType = HexConverter.encode(policy.tokenType.bytes);
+    const coinIds = policy.coinIds.map((coinId) => coinId.toLowerCase());
+    const taken = coinIds.find((coinId) => this.issuers.has(coinId));
+    if (taken !== void 0) throw new Error(`Coin ${taken} is already issued by token type ${this.issuers.get(taken)}.`);
+    for (const coinId of coinIds) this.issuers.set(coinId, tokenType);
+    this.policies.push(JSON.stringify([tokenType, [...coinIds].sort(), policy.revision ?? ""]));
+  }
+  fingerprint() {
+    return [...this.policies].sort().join("\n");
+  }
+  issuerOf(coinId) {
+    return this.issuers.get(coinId.toLowerCase()) ?? null;
+  }
+};
+
 // modules/payments-v2/machine/payload-view.ts
 function isWholeIntent(p) {
   return p.kind === "whole" || p.kind === "coinless";
@@ -1972,6 +1999,9 @@ function createScopedKV(storage, network, chainPubkey) {
     }
   };
 }
+function isLiveBurn(entry) {
+  return !entry.settled && entry.failure === void 0;
+}
 var STORE_KEYS = {
   intentBackstop: "intents",
   checkpointCache: "checkpoints",
@@ -1986,7 +2016,8 @@ var STORE_KEYS = {
   epochLatch: "epoch-latch",
   // §5.2 InventoryView durable overlays (#625/#679).
   suspectedSpent: "suspected-spent",
-  knownSpends: "known-spends"
+  knownSpends: "known-spends",
+  verifiedTokens: "verified-tokens"
 };
 
 // modules/payments-v2/inventory/presentation.ts
@@ -2004,18 +2035,21 @@ function toToken(tokenId, snapshot, asset, registry, flags) {
     createdAt: snapshot.createdAt,
     updatedAt: snapshot.updatedAt,
     lazy: true,
-    ...flags.suspectedSpent ? { suspectedSpent: true } : {}
+    ...flags.suspectedSpent ? { suspectedSpent: true } : {},
+    ...flags.standing !== "trusted" ? { unverified: flags.standing } : {}
   };
 }
-function aggregateAssets(entries, isTransferring, registry) {
+function aggregateAssets(entries, reading, registry) {
   const groups = /* @__PURE__ */ new Map();
   for (const [tokenId, entry] of entries) {
-    const moving = isTransferring(tokenId);
+    const moving = reading.isTransferring(tokenId);
     for (const asset of entry.assets) {
-      let group = groups.get(asset.coinId);
+      const standing = reading.standing(tokenId, asset.coinId);
+      const key = standing === "trusted" ? asset.coinId : `${asset.coinId}:${standing}`;
+      let group = groups.get(key);
       if (!group) {
-        group = { total: 0n, count: 0, transferring: 0n, transferringCount: 0 };
-        groups.set(asset.coinId, group);
+        group = { coinId: asset.coinId, standing, total: 0n, count: 0, transferring: 0n, transferringCount: 0 };
+        groups.set(key, group);
       }
       if (moving) {
         group.transferring += BigInt(asset.amount);
@@ -2026,9 +2060,10 @@ function aggregateAssets(entries, isTransferring, registry) {
       }
     }
   }
-  return [...groups].map(([coinId, totals]) => toAsset(coinId, totals, registry));
+  return [...groups.values()].map((totals) => toAsset(totals, registry));
 }
-function toAsset(coinId, totals, registry) {
+function toAsset(totals, registry) {
+  const coinId = totals.coinId;
   const iconUrl = registry.getIconUrl(coinId);
   return {
     coinId,
@@ -2048,7 +2083,8 @@ function toAsset(coinId, totals, registry) {
     priceEur: null,
     change24h: null,
     fiatValueUsd: null,
-    fiatValueEur: null
+    fiatValueEur: null,
+    ...totals.standing !== "trusted" ? { unverified: totals.standing } : {}
   };
 }
 function priceIdOf(registry, coinId) {
@@ -2056,9 +2092,9 @@ function priceIdOf(registry, coinId) {
 }
 async function withPrices(raw, registry, price) {
   try {
-    const ids = [...new Set(raw.map((a) => priceIdOf(registry, a.coinId)))];
+    const ids = [...new Set(raw.filter((a) => !a.unverified).map((a) => priceIdOf(registry, a.coinId)))];
     const quotes = await price.getPrices(ids);
-    return raw.map((a) => priceOne(a, quotes.get(priceIdOf(registry, a.coinId))));
+    return raw.map((a) => a.unverified ? a : priceOne(a, quotes.get(priceIdOf(registry, a.coinId))));
   } catch {
     return raw;
   }
@@ -2079,11 +2115,13 @@ function transferringToken(tokenId, coinId, amount, registry, now) {
   const snapshot = { assets: [], createdAt: now, updatedAt: now };
   return toToken(tokenId, snapshot, { coinId, amount: amount.toString() }, registry, {
     transferring: true,
-    suspectedSpent: false
+    suspectedSpent: false,
+    standing: "trusted"
   });
 }
 
 // modules/payments-v2/inventory/InventoryView.ts
+var TRUST_ALL = { isClaimed: () => false, standing: () => "trusted" };
 var SUSPECTED_KEY = STORE_KEYS.suspectedSpent;
 var KNOWN_SPENDS_KEY = STORE_KEYS.knownSpends;
 var CURSOR_KEY = STORE_KEYS.streamCursor("inventory");
@@ -2177,6 +2215,12 @@ var InventoryView = class {
     for (const tokenId of tokenIds) if (this.inFlight.delete(tokenId)) changed = true;
     if (changed) this.deps.emit("inventory:updated");
   }
+  get trust() {
+    return this.deps.trust ?? TRUST_ALL;
+  }
+  trusts(tokenId, coinId) {
+    return this.trust.standing(tokenId, coinId) === "trusted";
+  }
   pinned(tokenId) {
     return this.deps.isPinned?.(tokenId) ?? false;
   }
@@ -2203,6 +2247,7 @@ var InventoryView = class {
   isSpendable(tokenId, entry) {
     if (entry.status !== "active") return false;
     if (this.inFlight.has(tokenId) && !this.pinned(tokenId)) return false;
+    if (!entry.assets.every((asset) => this.trusts(tokenId, asset.coinId))) return false;
     return !this.suspected.has(stateKey(tokenId, entry.stateHash));
   }
   /** Is this NAMED token spendable whole — coinless or valued (#777)? */
@@ -2229,7 +2274,8 @@ var InventoryView = class {
       out.push(
         toToken(tokenId, entry, asset, registry, {
           transferring: this.held(tokenId),
-          suspectedSpent: this.suspected.has(stateKey(tokenId, entry.stateHash))
+          suspectedSpent: this.suspected.has(stateKey(tokenId, entry.stateHash)),
+          standing: this.trust.standing(tokenId, asset.coinId)
         })
       );
     }
@@ -2259,10 +2305,21 @@ var InventoryView = class {
     return out;
   }
   async assets(registry, price) {
-    const raw = aggregateAssets(this.activeEntries(), (tokenId) => this.held(tokenId), registry);
+    const reading = {
+      isTransferring: (tokenId) => this.held(tokenId),
+      standing: (tokenId, coinId) => this.trust.standing(tokenId, coinId)
+    };
+    const raw = aggregateAssets(this.activeEntries(), reading, registry);
     if (!price || raw.length === 0) return raw;
     return withPrices(raw, registry, price);
   }
+  claimHolders() {
+    const out = [];
+    for (const [tokenId, entry] of this.activeEntries()) {
+      if (entry.assets.some((asset) => this.trust.isClaimed(asset.coinId))) out.push(tokenId);
+    }
+    return out;
+  }
   *activeEntries() {
     for (const [tokenId, entry] of this.mirror) {
       if (entry.status === "active") yield [tokenId, entry];
@@ -2432,6 +2489,171 @@ var InventoryView = class {
   }
 };
 
+// modules/payments-v2/inventory/verdicts.ts
+var VERDICT_RETRY_MS = 3e4;
+var VERDICT_RETRY_MAX_MS = 60 * 60 * 1e3;
+function honoursClaims(claims, token) {
+  const issuers = (token.value?.assets ?? []).map((asset) => claims.issuerOf(asset.coinId));
+  return issuers.some((issuer) => issuer !== null) && issuers.every((issuer) => issuer === null || issuer === token.tokenType);
+}
+var TokenVerdicts = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  verified = /* @__PURE__ */ new Set();
+  refused = /* @__PURE__ */ new Set();
+  retries = /* @__PURE__ */ new Map();
+  writes = new SerialChain();
+  hydration = null;
+  queued = null;
+  running = null;
+  held = [];
+  timer = null;
+  live = false;
+  isClaimed(coinId) {
+    return this.deps.claims.issuerOf(coinId) !== null;
+  }
+  standing(tokenId, coinId) {
+    if (!this.isClaimed(coinId) || this.verified.has(tokenId)) return "trusted";
+    return this.refused.has(tokenId) ? "refused" : "pending";
+  }
+  trusts(tokenId, coinId) {
+    return this.standing(tokenId, coinId) === "trusted";
+  }
+  hydrate() {
+    this.hydration ??= this.load().catch((error) => {
+      this.hydration = null;
+      throw error;
+    });
+    return this.hydration;
+  }
+  start() {
+    this.live = true;
+    return this.hydrate();
+  }
+  stop() {
+    this.live = false;
+    if (this.timer !== null) clearTimeout(this.timer);
+    this.timer = null;
+  }
+  async accept(token) {
+    if (honoursClaims(this.deps.claims, token)) await this.remember(token.blob.tokenId);
+  }
+  async recordSplit(sourceTokenId, outputTokenId) {
+    await this.hydrate();
+    if (this.verified.has(sourceTokenId)) await this.remember(outputTokenId);
+  }
+  review(holders) {
+    this.queued = holders;
+    this.running ??= this.drain();
+    return this.running;
+  }
+  async drain() {
+    try {
+      while (this.queued !== null) {
+        const holders = this.queued;
+        this.queued = null;
+        await this.reviewOnce(holders);
+      }
+    } finally {
+      this.running = null;
+    }
+  }
+  async reviewOnce(holders) {
+    await this.hydrate();
+    this.held = holders;
+    const due = holders.filter((tokenId) => this.isDue(tokenId));
+    const verdicts = due.length === 0 ? /* @__PURE__ */ new Map() : await this.check(due);
+    for (const tokenId of due) this.settle(tokenId, verdicts.get(tokenId) ?? "retry");
+    if (due.some((tokenId) => verdicts.get(tokenId) === "verified")) {
+      await this.persist();
+      this.deps.changed();
+    }
+    this.scheduleRetry();
+  }
+  isDue(tokenId) {
+    if (this.verified.has(tokenId) || this.refused.has(tokenId)) return false;
+    return (this.retries.get(tokenId)?.atMs ?? 0) <= this.now();
+  }
+  async check(due) {
+    const verdicts = /* @__PURE__ */ new Map();
+    let blobs;
+    try {
+      blobs = await this.deps.getBlobs([...due]);
+    } catch {
+      return verdicts;
+    }
+    for (const tokenId of due) {
+      const bytes = blobs.get(tokenId);
+      if (bytes !== void 0) verdicts.set(tokenId, await this.verdictOf(tokenId, bytes));
+    }
+    return verdicts;
+  }
+  async verdictOf(tokenId, bytes) {
+    let engine;
+    try {
+      engine = this.deps.engine();
+    } catch {
+      return "retry";
+    }
+    let token;
+    try {
+      token = await engine.decodeToken({ tokenId, token: bytes });
+    } catch {
+      return "refused";
+    }
+    if (token.blob.tokenId !== tokenId || !honoursClaims(this.deps.claims, token)) return "refused";
+    try {
+      return (await engine.verify(token)).ok ? "verified" : "refused";
+    } catch {
+      return "retry";
+    }
+  }
+  settle(tokenId, verdict) {
+    if (verdict === "retry") {
+      this.retries.set(tokenId, this.nextRetry(this.retries.get(tokenId)));
+      return;
+    }
+    this.retries.delete(tokenId);
+    (verdict === "verified" ? this.verified : this.refused).add(tokenId);
+  }
+  nextRetry(previous) {
+    const attempts = (previous?.attempts ?? 0) + 1;
+    const delay = Math.min(VERDICT_RETRY_MS * 2 ** (attempts - 1), VERDICT_RETRY_MAX_MS);
+    return { attempts, atMs: this.now() + delay };
+  }
+  scheduleRetry() {
+    if (!this.live || this.timer !== null) return;
+    const due = this.held.flatMap((tokenId) => this.retries.get(tokenId)?.atMs ?? []);
+    if (due.length === 0) return;
+    const delay = Math.max(0, due.reduce((a, b) => Math.min(a, b)) - this.now());
+    this.timer = setTimeout(() => {
+      this.timer = null;
+      void this.review(this.held).catch(() => void 0);
+    }, delay);
+  }
+  async remember(tokenId) {
+    await this.hydrate();
+    if (this.verified.has(tokenId)) return;
+    this.verified.add(tokenId);
+    this.refused.delete(tokenId);
+    this.retries.delete(tokenId);
+    await this.persist();
+  }
+  persist() {
+    const remembered = { fingerprint: this.deps.claims.fingerprint(), tokenIds: [...this.verified] };
+    return this.writes.enqueue(() => this.deps.kv.set(STORE_KEYS.verifiedTokens, remembered));
+  }
+  async load() {
+    const remembered = await this.deps.kv.get(STORE_KEYS.verifiedTokens);
+    if (remembered?.fingerprint !== this.deps.claims.fingerprint()) return;
+    for (const tokenId of remembered.tokenIds) this.verified.add(tokenId);
+  }
+  now() {
+    return (this.deps.now ?? Date.now)();
+  }
+};
+
 // token-engine/value-envelope.ts
 function isCoinlessEnvelope(envelope) {
   return envelope.startsWith("none_");
@@ -2446,6 +2668,8 @@ function isRetryableAckError(err) {
 var ACK_BATCH_SIZE = 200;
 var REFRESH_INTERVAL_MS = 2500;
 var POLL_INTERVAL_MS = 3e4;
+var RECHECK_BASE_MS = POLL_INTERVAL_MS;
+var RECHECK_MAX_MS = 60 * 60 * 1e3;
 var ATTENTION_CLAIM_CONFLICT = "claim:conflict";
 function receivedDedupKey(tokenId, stateHash) {
   return `RECEIVED:${tokenId.toLowerCase()}:${stateHash.toLowerCase()}`;
@@ -2462,6 +2686,7 @@ var Receive = class {
   pollTimer = null;
   unsubscribeWake = null;
   lastRefreshAt = 0;
+  rechecks = /* @__PURE__ */ new Map();
   drainOnce() {
     return this.drainFlight.run(() => this.doDrain());
   }
@@ -2520,6 +2745,7 @@ var Receive = class {
     const pending = [];
     const pageEpoch = () => deps.delivery.incomingEpoch() ?? deps.syncEpoch();
     const claimable = { n: 0 };
+    const deferred = { any: false };
     const finish = () => {
       if (claimable.n > 0) deps.refreshView?.();
       return stored;
@@ -2528,7 +2754,7 @@ var Receive = class {
       const record = await deps.kv.get(STORE_KEYS.streamCursor("mailbox"));
       let basis = record !== null && record.syncEpoch === deps.syncEpoch() ? record : null;
       for (let pass = 0; pass < 2; pass++) {
-        await this.drainPages({ deps, engine, pending, stored, pageEpoch, claimable }, basis);
+        await this.drainPages({ deps, engine, pending, stored, pageEpoch, claimable, deferred }, basis);
         const served = deps.delivery.incomingEpoch();
         if (basis === null || served === null || served === basis.syncEpoch) break;
         await deps.kv.remove(STORE_KEYS.streamCursor("mailbox"));
@@ -2545,20 +2771,41 @@ var Receive = class {
     return finish();
   }
   async processEntry(ctx, entry) {
-    const { deps, engine, pending, stored, claimable } = ctx;
-    const screened = await screen(deps, engine, entry);
+    const { deps, engine, stored, claimable } = ctx;
+    const screened = this.recheckDue(entry.deliveryId) ? await screen(deps, engine, entry) : { kind: "defer" };
+    this.scheduleRecheck(entry.deliveryId, screened.kind === "defer");
+    if (screened.kind === "defer") {
+      ctx.deferred.any = true;
+      return;
+    }
     if (screened.kind === "ack") {
-      pending.push(screened.ack);
+      queueAck(ctx, screened.ack);
       if (screened.ack.disposition === "claimed") claimable.n += 1;
       return;
     }
+    await deps.accepted?.(screened.token);
     await deps.view.store(screened.record);
-    pending.push(claimAck(entry));
+    queueAck(ctx, claimAck(entry));
     claimable.n += 1;
     const transfer = await announce(deps, entry, screened.record);
     stored.push(transfer);
     deps.emit("transfer:incoming", transfer);
   }
+  recheckDue(deliveryId) {
+    const recheck = this.rechecks.get(deliveryId);
+    return recheck === void 0 || (this.deps.now?.() ?? Date.now()) >= recheck.atMs;
+  }
+  scheduleRecheck(deliveryId, deferred) {
+    if (!deferred) {
+      this.rechecks.delete(deliveryId);
+      return;
+    }
+    const previous = this.rechecks.get(deliveryId);
+    if (previous !== void 0 && (this.deps.now?.() ?? Date.now()) < previous.atMs) return;
+    const attempts = (previous?.attempts ?? 0) + 1;
+    const delay = Math.min(RECHECK_BASE_MS * 2 ** (attempts - 1), RECHECK_MAX_MS);
+    this.rechecks.set(deliveryId, { attempts, atMs: (this.deps.now?.() ?? Date.now()) + delay });
+  }
 };
 async function screen(deps, engine, entry) {
   const blobBytes = await entry.fetchBlob();
@@ -2569,7 +2816,8 @@ async function screen(deps, engine, entry) {
     logger.warn("PaymentsV2", `receive: undecodable blob rejected \u2014 ${String(err)}`);
     return { kind: "ack", ack: rejectAck(entry, "invalid") };
   }
-  const verdict = await engine.verify(token);
+  const verdict = await verdictOf(engine, token);
+  if (verdict === null) return { kind: "defer" };
   if (!verdict.ok) return { kind: "ack", ack: rejectAck(entry, "invalid") };
   if (!engine.isOwnedBy(token, engine.getIdentity().chainPubkey)) {
     return { kind: "ack", ack: rejectAck(entry, "not-owned") };
@@ -2580,38 +2828,43 @@ async function screen(deps, engine, entry) {
   if (held !== null && await engine.isSpent(token)) {
     return { kind: "ack", ack: rejectAck(entry, "invalid") };
   }
+  const unverifiedCoinIds = unverifiedCoinsOf(deps, token);
   return {
     kind: "accept",
+    token,
     record: {
       tokenId: keys.tokenId,
       stateHash: keys.stateHash,
       assets: toAssetAmounts(token),
-      ...isCoinlessEnvelope(token.valueEnvelope) ? { tokenType: token.tokenType } : {}
+      ...isCoinlessEnvelope(token.valueEnvelope) ? { tokenType: token.tokenType } : {},
+      ...unverifiedCoinIds.length > 0 ? { unverifiedCoinIds } : {}
     }
   };
 }
-async function announce(deps, entry, record) {
-  const receivedAt = (deps.now ?? Date.now)();
+function unverifiedCoinsOf(deps, token) {
+  const claims = deps.claims;
+  if (claims === void 0 || honoursClaims(claims, token)) return [];
+  return (token.value?.assets ?? []).map((asset) => asset.coinId).filter((coinId) => claims.issuerOf(coinId) !== null);
+}
+async function verdictOf(engine, token) {
   try {
-    await deps.recordReceived({
-      dedupKey: receivedDedupKey(record.tokenId, record.stateHash),
-      tokenId: record.tokenId,
-      stateHash: record.stateHash,
-      assets: record.assets,
-      ...record.tokenType !== void 0 ? { tokenType: record.tokenType } : {},
-      ...entry.senderPubkey !== void 0 ? { senderPubkey: entry.senderPubkey } : {},
-      ...entry.senderNametag !== void 0 ? { senderNametag: entry.senderNametag } : {},
-      ...entry.memo !== void 0 ? { memo: entry.memo } : {},
-      receivedAt
-    });
+    return await engine.verify(token);
   } catch (err) {
-    logger.debug("PaymentsV2", "RECEIVED history hook failed (money path unaffected):", err);
+    if (isSphereError(err) && err.code === "MINT_REASON_UNVERIFIABLE") return null;
+    throw err;
   }
+}
+async function announce(deps, entry, record) {
+  const receivedAt = (deps.now ?? Date.now)();
+  await recordArrival(deps, entry, record, receivedAt);
+  const refused2 = record.assets.filter((asset) => record.unverifiedCoinIds?.includes(asset.coinId));
+  const counted = record.assets.filter((asset) => !refused2.includes(asset));
   return {
     id: record.tokenId,
     senderPubkey: entry.senderPubkey ?? "",
     ...entry.senderNametag !== void 0 ? { senderNametag: entry.senderNametag } : {},
-    tokens: record.assets.map((asset) => toUiToken(record.tokenId, asset, deps.registry, receivedAt)),
+    tokens: counted.map((asset) => toUiToken(record.tokenId, asset, deps.registry, receivedAt)),
+    ...refused2.length > 0 ? { unverifiedTokens: refused2.map((asset) => ({ ...toUiToken(record.tokenId, asset, deps.registry, receivedAt), unverified: "refused" })) } : {},
     // #777: named here rather than mapped from assets, which announced an EMPTY list.
     ...record.tokenType !== void 0 ? {
       coinless: [
@@ -2629,6 +2882,25 @@ async function announce(deps, entry, record) {
     receivedAt
   };
 }
+async function recordArrival(deps, entry, record, receivedAt) {
+  const assets = record.assets.filter((asset) => !record.unverifiedCoinIds?.includes(asset.coinId));
+  if (assets.length === 0 && record.unverifiedCoinIds !== void 0) return;
+  try {
+    await deps.recordReceived({
+      dedupKey: receivedDedupKey(record.tokenId, record.stateHash),
+      tokenId: record.tokenId,
+      stateHash: record.stateHash,
+      assets,
+      ...record.tokenType !== void 0 ? { tokenType: record.tokenType } : {},
+      ...entry.senderPubkey !== void 0 ? { senderPubkey: entry.senderPubkey } : {},
+      ...entry.senderNametag !== void 0 ? { senderNametag: entry.senderNametag } : {},
+      ...entry.memo !== void 0 ? { memo: entry.memo } : {},
+      receivedAt
+    });
+  } catch (err) {
+    logger.debug("PaymentsV2", "RECEIVED history hook failed (money path unaffected):", err);
+  }
+}
 async function flushAcks(deps, pending, epochOf) {
   if (pending.length === 0) return { progressed: true };
   const before = pending.length;
@@ -2636,7 +2908,7 @@ async function flushAcks(deps, pending, epochOf) {
   try {
     const settled = await settleAcks(deps, pending);
     let i = 0;
-    while (i < pending.length && settled.has(pending[i].deliveryId)) {
+    while (i < pending.length && settled.has(pending[i].deliveryId) && pending[i].holdsCursor !== true) {
       lastAcked = pending[i].cursor;
       i += 1;
     }
@@ -2712,6 +2984,9 @@ async function ackOne(deps, ack) {
     await rejectStaleClaim(deps, ack.deliveryId, ack.transferId);
   }
 }
+function queueAck(ctx, ack) {
+  ctx.pending.push(ctx.deferred.any ? { ...ack, holdsCursor: true } : ack);
+}
 function claimAck(entry) {
   return {
     deliveryId: entry.deliveryId,
@@ -3612,6 +3887,7 @@ var TransferMachine = class {
       const key = keys.get(digest);
       if (key === void 0) throw new SphereError(`no upload key returned for ${digest}`, "STORAGE_ERROR");
       const { tokenId } = await engine.deliveryKeys(o.changeBlob);
+      await this.deps.recordSplit?.(o.op.sourceTokenId, tokenId);
       added.push({ tokenId, key });
     }
     return added;
@@ -4007,7 +4283,7 @@ var Converger = class {
       this.deps.stores.burnJournal.list()
     ]);
     const mintsOpen = mints.length > 0 || nftMints.length > 0 || customMints.length > 0;
-    const burnsOpen = burns.some((e) => !e.settled);
+    const burnsOpen = burns.some(isLiveBurn);
     return backstop.length > 0 || journal.some((e) => e.undeliverable !== true) || mintsOpen || burnsOpen;
   }
   async resumePass() {
@@ -4094,6 +4370,9 @@ async function deriveOpenIntentHolds(stores, decryptPayload) {
     const split = typeof payload?.split?.tokenId === "string" ? [payload.split.tokenId] : [];
     holds.set(entry.transferId, [...direct, ...split]);
   }
+  for (const burn of await stores.burnJournal.list()) {
+    if (isLiveBurn(burn)) holds.set(burn.burnId, [burn.tokenId]);
+  }
   return { open: holds, complete };
 }
 function groupJournal(journal) {
@@ -4583,6 +4862,176 @@ function parseAmount(raw) {
   return amount;
 }
 
+// modules/payments-v2/burn.ts
+var HEX32 = /^[0-9a-f]{64}$/;
+async function heldToken(deps, tokenId) {
+  const bytes = (await deps.storagePort.getBlobs([tokenId])).get(tokenId);
+  if (bytes === void 0) {
+    throw new SphereError(`Token ${tokenId} has no blob in storage; it is not held here`, "STORAGE_ERROR");
+  }
+  return deps.engine.decodeToken({ tokenId, token: bytes });
+}
+function assertBurnable(engine, token, tokenId) {
+  if (!engine.isOwnedBy(token, engine.getIdentity().chainPubkey)) {
+    throw new SphereError(`Token ${tokenId} is not owned by this wallet`, "VALIDATION_ERROR");
+  }
+  if (token.valueEnvelope === "bare_collection") {
+    throw new SphereError(
+      `Token ${tokenId} carries a value envelope this SDK cannot read, so its coins cannot be accounted for; it cannot be burned`,
+      "VALIDATION_ERROR"
+    );
+  }
+}
+function assetsOf(token) {
+  return (token.value?.assets ?? []).map((a) => ({ coinId: a.coinId, amount: a.amount.toString() }));
+}
+async function runBurnUnderJournal(deps, input) {
+  const { burnId } = input;
+  const { tokenId, reasonBytes } = input.request;
+  if (!HEX32.test(tokenId) || reasonBytes.length === 0) {
+    return { success: false, burnId, tokenId, error: "burn: tokenId must be 64 hex and reasonBytes non-empty", errorCode: "VALIDATION_ERROR" };
+  }
+  let token;
+  try {
+    token = await heldToken(deps, tokenId);
+    assertBurnable(deps.engine, token, tokenId);
+  } catch (err) {
+    return refused(burnId, tokenId, err);
+  }
+  const entry = {
+    burnId,
+    tokenId,
+    reasonHex: bytesToHex(reasonBytes),
+    burnedTokenHex: null,
+    settled: false,
+    assets: assetsOf(token),
+    createdAt: deps.now()
+  };
+  await deps.burnJournal.upsert(entry);
+  try {
+    const settled = await burnJournaled(deps, entry, token);
+    return { success: true, burnId, tokenId, burnedToken: hexToBytes(settled.burnedTokenHex ?? "") };
+  } catch (err) {
+    const failure = failureOf(err);
+    if (isTerminal(err)) await deps.burnJournal.upsert({ ...entry, failure });
+    else deps.armHeartbeat();
+    return { success: false, burnId, tokenId, error: failure.message, errorCode: failure.code };
+  }
+}
+async function replayBurns(deps) {
+  let progressed = 0;
+  for (const entry of await deps.burnJournal.list()) {
+    if (!isLiveBurn(entry) || deps.isActiveOp(entry.burnId)) continue;
+    try {
+      const token = entry.burnedTokenHex === null ? await heldToken(deps, entry.tokenId) : null;
+      await burnJournaled(deps, entry, token);
+      progressed += 1;
+    } catch (err) {
+      if (!isTerminal(err)) continue;
+      await deps.burnJournal.upsert({ ...entry, failure: failureOf(err) });
+      progressed += 1;
+    }
+  }
+  return progressed;
+}
+async function pendingBurns(deps) {
+  return (await deps.burnJournal.list()).map((entry) => ({
+    burnId: entry.burnId,
+    tokenId: entry.tokenId,
+    reasonBytes: hexToBytes(entry.reasonHex),
+    burnedToken: entry.burnedTokenHex === null ? null : hexToBytes(entry.burnedTokenHex),
+    settled: entry.settled,
+    createdAt: entry.createdAt,
+    ...entry.failure !== void 0 ? { failure: entry.failure } : {}
+  }));
+}
+async function acknowledgeBurn(deps, burnId) {
+  const entry = await deps.burnJournal.getByKey(burnId);
+  if (entry === void 0) return;
+  if (isLiveBurn(entry)) {
+    throw new SphereError(`Burn ${burnId} is not settled yet; it cannot be acknowledged`, "VALIDATION_ERROR");
+  }
+  await deps.burnJournal.removeByKey(burnId);
+}
+function refused(burnId, tokenId, err) {
+  const failure = failureOf(err);
+  return { success: false, burnId, tokenId, error: failure.message, errorCode: failure.code };
+}
+function isTerminal(err) {
+  return classifyError(err) === "conflict";
+}
+function failureOf(err) {
+  const code = err !== null && typeof err === "object" ? err.code : void 0;
+  return { code: typeof code === "string" ? code : "UNKNOWN", message: messageOf(err) };
+}
+async function burnJournaled(deps, entry, token) {
+  let current = entry;
+  if (current.burnedTokenHex === null) {
+    if (token === null) throw new SphereError("burn replay needs the held token to certify", "VALIDATION_ERROR");
+    const burned = await deps.engine.burn(
+      { token, reasonBytes: hexToBytes(current.reasonHex) },
+      { transferId: current.burnId }
+    );
+    if (burned.blob.tokenId !== current.tokenId) {
+      throw new SphereError(`burned token ${burned.blob.tokenId}, but the journal names ${current.tokenId}`, "VALIDATION_ERROR");
+    }
+    current = { ...current, burnedTokenHex: bytesToHex(burned.blob.token) };
+    await deps.burnJournal.upsert(current);
+  }
+  await deps.storagePort.applyDelta({ transferId: current.burnId, spent: [current.tokenId], added: [], externalDelivery: true });
+  await deps.recordSent({ transferId: current.burnId, assets: current.assets, tokenId: current.tokenId });
+  current = { ...current, settled: true };
+  await deps.burnJournal.upsert(current);
+  deps.refreshView();
+  return current;
+}
+
+// modules/payments-v2/burn-hold.ts
+var BurnHold = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  async run(burnId, tokenId, burn) {
+    try {
+      this.deps.queue.planWhole(burnId, tokenId);
+    } catch (err) {
+      return refused(burnId, tokenId, err);
+    }
+    this.deps.view.markInFlightMany([tokenId]);
+    let burned = false;
+    try {
+      const result = await burn();
+      burned = result.success;
+      return result;
+    } finally {
+      await this.settle(burnId, tokenId, burned);
+    }
+  }
+  async settle(burnId, tokenId, burned) {
+    if (burned) {
+      this.deps.ledger.commit(burnId);
+      this.deps.track(this.refreshThenRelease(tokenId));
+      return;
+    }
+    const entry = await this.deps.burnJournal.getByKey(burnId).catch(() => null);
+    if (entry === void 0 || entry !== null && !isLiveBurn(entry)) {
+      this.deps.ledger.cancel(burnId);
+      this.deps.view.releaseMany([tokenId]);
+      this.deps.queue.notifyChange("");
+      return;
+    }
+    this.deps.pins.adopt(burnId);
+  }
+  async refreshThenRelease(tokenId) {
+    try {
+      await this.deps.view.delta();
+      this.deps.view.releaseMany([tokenId]);
+    } finally {
+      this.deps.queue.notifyChange("");
+    }
+  }
+};
+
 // modules/payments-v2/compose.ts
 function supportsDeterministicMint(engine) {
   return engine.deterministicMint === true;
@@ -4590,16 +5039,8 @@ function supportsDeterministicMint(engine) {
 function composeFacadeParts(deps, hooks) {
   const ownPubkeyBytes = hexToBytes(deps.ownPubkey);
   const ledger = new ReservationLedger();
-  const view = new InventoryView({
-    port: deps.storagePort,
-    kv: deps.kv,
-    emit: (event) => deps.emit(event, {}),
-    // #737: a reserved token is unselectable, so it is never confirmed balance.
-    // #738: while the held-set is unproven, EVERY token reads pinned — the report
-    // must not call a token spendable that the queue is about to refuse to spend.
-    isPinned: (tokenId) => ledger.unprovenReason() !== null || ledger.holderOf(tokenId) !== void 0,
-    ...deps.now !== void 0 ? { now: deps.now } : {}
-  });
+  const verdicts = buildVerdicts(deps, hooks);
+  const view = buildView(deps, hooks, ledger, verdicts);
   const queue = new SpendQueue({
     ledger,
     getPool: (coinId) => view.pool(coinId),
@@ -4614,27 +5055,57 @@ function composeFacadeParts(deps, hooks) {
     ...deps.now !== void 0 ? { now: deps.now } : {},
     ...deps.newId !== void 0 ? { newId: deps.newId } : {}
   });
-  const machineDeps = buildMachineDeps(deps, hooks, historyStore);
+  const machineDeps = buildMachineDeps(deps, hooks, historyStore, verdicts);
   const machineStores = createMachineStores(deps.kv);
   const heldStates = /* @__PURE__ */ new Map();
   const refreshView = coalesced(() => view.delta(), hooks.track);
+  const pins = buildPins(deps, hooks, { ledger, view, machineStores, machineDeps });
   return {
     ownPubkeyBytes,
     view,
+    verdicts,
     refreshView,
     ledger,
-    pins: buildPins(deps, hooks, { ledger, view, machineStores, machineDeps }),
+    pins,
     queue,
+    burnHold: new BurnHold({ queue, ledger, view, pins, burnJournal: machineStores.burnJournal, track: hooks.track }),
     historyStore,
     machineStores,
     machineDeps,
     machine: new TransferMachine(machineDeps),
     heldStates,
-    receiveLoop: buildReceive(deps, hooks, historyStore, heldStates, refreshView),
+    receiveLoop: buildReceive(deps, hooks, { historyStore, heldStates, verdicts }, refreshView),
     requests: buildRequests(deps, hooks),
     restoreDeps: buildRestoreDeps(deps, machineDeps, machineStores, view)
   };
 }
+function buildView(deps, hooks, ledger, verdicts) {
+  const view = new InventoryView({
+    port: deps.storagePort,
+    kv: deps.kv,
+    trust: verdicts,
+    emit: (event) => {
+      deps.emit(event, {});
+      hooks.track(verdicts.review(view.claimHolders()));
+    },
+    // #737: a reserved token is unselectable, so it is never confirmed balance.
+    // #738: while the held-set is unproven, EVERY token reads pinned — the report
+    // must not call a token spendable that the queue is about to refuse to spend.
+    isPinned: (tokenId) => ledger.unprovenReason() !== null || ledger.holderOf(tokenId) !== void 0,
+    ...deps.now !== void 0 ? { now: deps.now } : {}
+  });
+  return view;
+}
+function buildVerdicts(deps, hooks) {
+  return new TokenVerdicts({
+    kv: deps.kv,
+    claims: deps.claims ?? new CoinClaims(),
+    engine: () => hooks.engine(),
+    getBlobs: (tokenIds) => deps.storagePort.getBlobs(tokenIds),
+    changed: () => deps.emit("inventory:updated", {}),
+    ...deps.now !== void 0 ? { now: deps.now } : {}
+  });
+}
 function buildPins(deps, hooks, parts) {
   return new IntentPins({
     ledger: parts.ledger,
@@ -4662,8 +5133,9 @@ function buildRestoreDeps(deps, machineDeps, machineStores, view) {
     }
   };
 }
-function buildMachineDeps(deps, hooks, historyStore) {
+function buildMachineDeps(deps, hooks, historyStore, verdicts) {
   return {
+    recordSplit: (sourceTokenId, outputTokenId) => verdicts.recordSplit(sourceTokenId, outputTokenId),
     engine: () => hooks.engine(),
     storage: deps.storagePort,
     delivery: deps.deliveryPort,
@@ -4696,10 +5168,13 @@ function buildMachineDeps(deps, hooks, historyStore) {
     }
   };
 }
-function buildReceive(deps, hooks, historyStore, heldStates, refreshView) {
+function buildReceive(deps, hooks, parts, refreshView) {
+  const { historyStore, heldStates, verdicts } = parts;
   return new Receive({
     delivery: deps.deliveryPort,
     engine: () => hooks.engine(),
+    claims: deps.claims ?? new CoinClaims(),
+    accepted: (token) => verdicts.accept(token),
     view: {
       heldState: (tokenId) => heldStates.get(tokenId) ?? null,
       store: async (entry) => {
@@ -4818,6 +5293,16 @@ async function tokenInServerInventory(storagePort, tokenId) {
   }
   return false;
 }
+async function seedHeldStates(storagePort, heldStates) {
+  let page = await storagePort.listInventory();
+  for (let i = 0; i < INVENTORY_SCAN_PAGE_LIMIT; i++) {
+    for (const item of page.items) {
+      if (item.status === "active") heldStates.set(item.tokenId, item.stateHash);
+    }
+    if (!page.more) return;
+    page = await storagePort.listInventory(page.cursor);
+  }
+}
 async function replayCoinMints(deps) {
   let resolved = 0;
   for (const entry of await deps.mintJournal.list()) {
@@ -4921,98 +5406,9 @@ async function mintJournaled(deps, entry) {
   await finalizeMint(deps, { mintId: entry.mintId, token, assets: [], journal: deps.nftMintJournal });
 }
 
-// modules/payments-v2/inventory/nft-read.ts
-var NFT_CACHE_MAX = 256;
-var NftCache = class {
-  constructor(max = NFT_CACHE_MAX) {
-    this.max = max;
-  }
-  entries = /* @__PURE__ */ new Map();
-  /** `undefined` = not cached. A hit becomes the most recently used entry. */
-  get(tokenId) {
-    const view = this.entries.get(tokenId);
-    if (view === void 0) return void 0;
-    this.entries.delete(tokenId);
-    this.entries.set(tokenId, view);
-    return view;
-  }
-  set(tokenId, view) {
-    this.entries.delete(tokenId);
-    this.entries.set(tokenId, view);
-    const oldest = this.entries.keys().next().value;
-    if (this.entries.size > this.max && oldest !== void 0) this.entries.delete(oldest);
-  }
-};
-async function readNft(deps, tokenId) {
-  if (deps.view.stateHashOf(tokenId) === void 0) {
-    throw new SphereError(`Token ${tokenId} is not in inventory`, "VALIDATION_ERROR");
-  }
-  const cached = deps.cache.get(tokenId);
-  if (cached !== void 0) return cached;
-  const bytes = (await deps.storagePort.getBlobs([tokenId])).get(tokenId);
-  if (bytes === void 0) {
-    throw new SphereError(`Token ${tokenId} has no blob in storage`, "STORAGE_ERROR");
-  }
-  return decodeView(deps, tokenId, bytes);
-}
-async function readNfts(deps, tokenIds) {
-  const held = [...new Set(tokenIds)].filter((tokenId) => deps.view.stateHashOf(tokenId) !== void 0);
-  const views = /* @__PURE__ */ new Map();
-  const misses = [];
-  for (const tokenId of held) {
-    const cached = deps.cache.get(tokenId);
-    if (cached === void 0) misses.push(tokenId);
-    else views.set(tokenId, cached);
-  }
-  const blobs = misses.length > 0 ? await deps.storagePort.getBlobs(misses) : /* @__PURE__ */ new Map();
-  for (const tokenId of misses) {
-    const bytes = blobs.get(tokenId);
-    if (bytes !== void 0) views.set(tokenId, await decodeView(deps, tokenId, bytes).catch(() => null));
-  }
-  const out = /* @__PURE__ */ new Map();
-  for (const tokenId of held) {
-    const view = views.get(tokenId);
-    if (view) out.set(tokenId, view);
-  }
-  return out;
-}
-async function decodeView(deps, tokenId, bytes) {
-  let view;
-  try {
-    const token = await deps.engine.decodeToken({ tokenId, token: bytes });
-    if (token.blob.tokenId !== tokenId) {
-      throw new SphereError(`the blob served for ${tokenId} decodes as ${token.blob.tokenId}`, "STORAGE_ERROR");
-    }
-    const reading = await deps.engine.readNft(token);
-    view = reading === null ? null : { tokenId, ...reading };
-  } catch (err) {
-    logger.warn("PaymentsV2", `NFT read: token ${tokenId} did not decode \u2014 ${String(err)}`);
-    throw err;
-  }
-  deps.cache.set(tokenId, view);
-  return view;
-}
-
-// modules/payments-v2/inventory/token-data.ts
-async function readTokenData(deps, tokenId) {
-  return deps.engine.readTokenData(await heldToken(deps, tokenId));
-}
-async function readTokenJustification(deps, tokenId) {
-  return deps.engine.readTokenJustification(await heldToken(deps, tokenId));
-}
-async function heldToken(deps, tokenId) {
-  if (deps.view.stateHashOf(tokenId) === void 0) {
-    throw new SphereError(`Token ${tokenId} is not in inventory`, "VALIDATION_ERROR");
-  }
-  const bytes = (await deps.storagePort.getBlobs([tokenId])).get(tokenId);
-  if (bytes === void 0) {
-    throw new SphereError(`Token ${tokenId} has no blob in storage`, "STORAGE_ERROR");
-  }
-  return deps.engine.decodeToken({ tokenId, token: bytes });
-}
-
 // modules/payments-v2/mint-custom.ts
-var HEX32 = /^[0-9a-f]{64}$/;
+var HEX322 = /^[0-9a-f]{64}$/;
+var CUSTOM_MINT_MAX_PAYLOAD_BYTES = 1024 * 1024;
 function assertRequest(request) {
   if (request.tokenType.length !== 32) {
     throw new SphereError("mintCustom: tokenType must be 32 bytes", "VALIDATION_ERROR");
@@ -5023,19 +5419,27 @@ function assertRequest(request) {
   if (request.data.length === 0) {
     throw new SphereError("mintCustom: data must not be empty", "VALIDATION_ERROR");
   }
+  if (request.justification !== void 0 && request.justification.length === 0) {
+    throw new SphereError("mintCustom: justification must be omitted, not empty", "VALIDATION_ERROR");
+  }
+  if (request.data.length + (request.justification?.length ?? 0) > CUSTOM_MINT_MAX_PAYLOAD_BYTES) {
+    throw new SphereError(`mintCustom: data and justification exceed ${CUSTOM_MINT_MAX_PAYLOAD_BYTES} bytes`, "VALIDATION_ERROR");
+  }
   for (const asset of request.assets) {
-    if (!HEX32.test(asset.coinId) || asset.amount <= 0n) {
+    if (!HEX322.test(asset.coinId) || asset.amount <= 0n) {
       throw new SphereError("mintCustom: assets need a 64-hex coinId and a positive amount", "VALIDATION_ERROR");
     }
   }
 }
 async function runCustomMintUnderJournal(deps, input) {
+  let entry;
   try {
     assertRequest(input.request);
+    entry = journalEntryOf2(input.mintId, input.request, deps.now());
+    deps.engine.assertMintable(mintParamsOf(deps, entry, input.request.mintJustificationVerifiers));
   } catch (err) {
     return { success: false, error: messageOf(err) };
   }
-  const entry = journalEntryOf2(input.mintId, input.request, deps.now());
   await deps.customMintJournal.upsert(entry);
   let tokenId;
   try {
@@ -5075,24 +5479,25 @@ function journalEntryOf2(mintId, request, createdAt) {
     createdAt
   };
 }
+function mintParamsOf(deps, entry, mintJustificationVerifiers) {
+  return {
+    recipientPubkey: deps.ownPubkeyBytes,
+    data: hexToBytes(entry.dataHex),
+    tokenType: hexToBytes(entry.tokenTypeHex),
+    salt: hexToBytes(entry.saltHex),
+    ...entry.justificationHex !== null ? { justification: hexToBytes(entry.justificationHex) } : {},
+    ...mintJustificationVerifiers ? { mintJustificationVerifiers } : {}
+  };
+}
 async function mintJournaled2(deps, entry, mintJustificationVerifiers) {
-  const token = await deps.engine.mintDataToken(
-    {
-      recipientPubkey: deps.ownPubkeyBytes,
-      data: hexToBytes(entry.dataHex),
-      tokenType: hexToBytes(entry.tokenTypeHex),
-      salt: hexToBytes(entry.saltHex),
-      ...entry.justificationHex !== null ? { justification: hexToBytes(entry.justificationHex) } : {},
-      ...mintJustificationVerifiers ? { mintJustificationVerifiers } : {}
-    },
-    { transferId: entry.mintId }
-  );
+  const token = await deps.engine.mintDataToken(mintParamsOf(deps, entry, mintJustificationVerifiers), { transferId: entry.mintId });
   if (entry.tokenId !== "" && token.blob.tokenId !== entry.tokenId) {
     throw new SphereError(`minted token ${token.blob.tokenId}, but the journal names ${entry.tokenId}`, "VALIDATION_ERROR");
   }
   if (entry.tokenId === "") {
     await deps.customMintJournal.upsert({ ...entry, tokenId: token.blob.tokenId });
   }
+  if (mintJustificationVerifiers === void 0) await deps.accepted?.(token);
   await finalizeMint(deps, {
     mintId: entry.mintId,
     token,
@@ -5102,106 +5507,94 @@ async function mintJournaled2(deps, entry, mintJustificationVerifiers) {
   return token.blob.tokenId;
 }
 
-// modules/payments-v2/burn.ts
-var HEX322 = /^[0-9a-f]{64}$/;
-async function heldToken2(deps, tokenId) {
+// modules/payments-v2/inventory/nft-read.ts
+var NFT_CACHE_MAX = 256;
+var NftCache = class {
+  constructor(max = NFT_CACHE_MAX) {
+    this.max = max;
+  }
+  entries = /* @__PURE__ */ new Map();
+  /** `undefined` = not cached. A hit becomes the most recently used entry. */
+  get(tokenId) {
+    const view = this.entries.get(tokenId);
+    if (view === void 0) return void 0;
+    this.entries.delete(tokenId);
+    this.entries.set(tokenId, view);
+    return view;
+  }
+  set(tokenId, view) {
+    this.entries.delete(tokenId);
+    this.entries.set(tokenId, view);
+    const oldest = this.entries.keys().next().value;
+    if (this.entries.size > this.max && oldest !== void 0) this.entries.delete(oldest);
+  }
+};
+async function readNft(deps, tokenId) {
+  if (deps.view.stateHashOf(tokenId) === void 0) {
+    throw new SphereError(`Token ${tokenId} is not in inventory`, "VALIDATION_ERROR");
+  }
+  const cached = deps.cache.get(tokenId);
+  if (cached !== void 0) return cached;
   const bytes = (await deps.storagePort.getBlobs([tokenId])).get(tokenId);
   if (bytes === void 0) {
-    throw new SphereError(`Token ${tokenId} has no blob in storage; it is not held here`, "STORAGE_ERROR");
+    throw new SphereError(`Token ${tokenId} has no blob in storage`, "STORAGE_ERROR");
   }
-  return deps.engine.decodeToken({ tokenId, token: bytes });
-}
-function assetsOf(token) {
-  return (token.value?.assets ?? []).map((a) => ({ coinId: a.coinId, amount: a.amount.toString() }));
+  return decodeView(deps, tokenId, bytes);
 }
-async function runBurnUnderJournal(deps, input) {
-  const { burnId } = input;
-  const { tokenId, reasonBytes } = input.request;
-  if (!HEX322.test(tokenId) || reasonBytes.length === 0) {
-    return { success: false, burnId, tokenId, error: "burn: tokenId must be 64 hex and reasonBytes non-empty" };
+async function readNfts(deps, tokenIds) {
+  const held = [...new Set(tokenIds)].filter((tokenId) => deps.view.stateHashOf(tokenId) !== void 0);
+  const views = /* @__PURE__ */ new Map();
+  const misses = [];
+  for (const tokenId of held) {
+    const cached = deps.cache.get(tokenId);
+    if (cached === void 0) misses.push(tokenId);
+    else views.set(tokenId, cached);
   }
-  let token;
-  try {
-    token = await heldToken2(deps, tokenId);
-    if (!deps.engine.isOwnedBy(token, deps.engine.getIdentity().chainPubkey)) {
-      throw new SphereError(`Token ${tokenId} is not owned by this wallet`, "VALIDATION_ERROR");
-    }
-  } catch (err) {
-    return { success: false, burnId, tokenId, error: messageOf(err) };
+  const blobs = misses.length > 0 ? await deps.storagePort.getBlobs(misses) : /* @__PURE__ */ new Map();
+  for (const tokenId of misses) {
+    const bytes = blobs.get(tokenId);
+    if (bytes !== void 0) views.set(tokenId, await decodeView(deps, tokenId, bytes).catch(() => null));
   }
-  const entry = {
-    burnId,
-    tokenId,
-    reasonHex: bytesToHex(reasonBytes),
-    burnedTokenHex: null,
-    settled: false,
-    assets: assetsOf(token),
-    createdAt: deps.now()
-  };
-  await deps.burnJournal.upsert(entry);
-  try {
-    const settled = await burnJournaled(deps, entry, token, { applied: false });
-    return { success: true, burnId, tokenId, burnedToken: hexToBytes(settled.burnedTokenHex ?? "") };
-  } catch (err) {
-    deps.armHeartbeat();
-    return { success: false, burnId, tokenId, error: messageOf(err) };
+  const out = /* @__PURE__ */ new Map();
+  for (const tokenId of held) {
+    const view = views.get(tokenId);
+    if (view) out.set(tokenId, view);
   }
+  return out;
 }
-async function replayBurns(deps) {
-  let progressed = 0;
-  for (const entry of await deps.burnJournal.list()) {
-    if (entry.settled || deps.isActiveOp(entry.burnId)) continue;
-    try {
-      const token = entry.burnedTokenHex === null ? await heldToken2(deps, entry.tokenId) : null;
-      const applied = entry.burnedTokenHex !== null && !await deps.tokenInServerInventory(entry.tokenId);
-      await burnJournaled(deps, entry, token, { applied });
-      progressed += 1;
-    } catch {
-      continue;
+async function decodeView(deps, tokenId, bytes) {
+  let view;
+  try {
+    const token = await deps.engine.decodeToken({ tokenId, token: bytes });
+    if (token.blob.tokenId !== tokenId) {
+      throw new SphereError(`the blob served for ${tokenId} decodes as ${token.blob.tokenId}`, "STORAGE_ERROR");
     }
+    const reading = await deps.engine.readNft(token);
+    view = reading === null ? null : { tokenId, ...reading };
+  } catch (err) {
+    logger.warn("PaymentsV2", `NFT read: token ${tokenId} did not decode \u2014 ${String(err)}`);
+    throw err;
   }
-  return progressed;
+  deps.cache.set(tokenId, view);
+  return view;
 }
-async function pendingBurns(deps) {
-  return (await deps.burnJournal.list()).map((entry) => ({
-    burnId: entry.burnId,
-    tokenId: entry.tokenId,
-    reasonBytes: hexToBytes(entry.reasonHex),
-    burnedToken: entry.burnedTokenHex === null ? null : hexToBytes(entry.burnedTokenHex),
-    settled: entry.settled,
-    createdAt: entry.createdAt
-  }));
+
+// modules/payments-v2/inventory/token-data.ts
+async function readTokenData(deps, tokenId) {
+  return deps.engine.readTokenData(await heldToken2(deps, tokenId));
 }
-async function acknowledgeBurn(deps, burnId) {
-  const entry = await deps.burnJournal.getByKey(burnId);
-  if (entry === void 0) return;
-  if (!entry.settled) {
-    throw new SphereError(`Burn ${burnId} is not settled yet; it cannot be acknowledged`, "VALIDATION_ERROR");
-  }
-  await deps.burnJournal.removeByKey(burnId);
+async function readTokenJustification(deps, tokenId) {
+  return deps.engine.readTokenJustification(await heldToken2(deps, tokenId));
 }
-async function burnJournaled(deps, entry, token, state) {
-  let current = entry;
-  if (current.burnedTokenHex === null) {
-    if (token === null) throw new SphereError("burn replay needs the held token to certify", "VALIDATION_ERROR");
-    const burned = await deps.engine.burn(
-      { token, reasonBytes: hexToBytes(current.reasonHex) },
-      { transferId: current.burnId }
-    );
-    if (burned.blob.tokenId !== current.tokenId) {
-      throw new SphereError(`burned token ${burned.blob.tokenId}, but the journal names ${current.tokenId}`, "VALIDATION_ERROR");
-    }
-    current = { ...current, burnedTokenHex: bytesToHex(burned.blob.token) };
-    await deps.burnJournal.upsert(current);
+async function heldToken2(deps, tokenId) {
+  if (deps.view.stateHashOf(tokenId) === void 0) {
+    throw new SphereError(`Token ${tokenId} is not in inventory`, "VALIDATION_ERROR");
   }
-  if (!state.applied) {
-    await deps.storagePort.applyDelta({ transferId: current.burnId, spent: [current.tokenId], added: [] });
+  const bytes = (await deps.storagePort.getBlobs([tokenId])).get(tokenId);
+  if (bytes === void 0) {
+    throw new SphereError(`Token ${tokenId} has no blob in storage`, "STORAGE_ERROR");
   }
-  await deps.recordSent({ transferId: current.burnId, assets: current.assets, tokenId: current.tokenId });
-  current = { ...current, settled: true };
-  await deps.burnJournal.upsert(current);
-  deps.refreshView();
-  return current;
+  return deps.engine.decodeToken({ tokenId, token: bytes });
 }
 
 // modules/payments-v2/send-whole.ts
@@ -5399,6 +5792,7 @@ var PaymentsFacade = class {
       track: (op) => this.trackTail(op)
     });
     this.view = parts.view;
+    this.verdicts = parts.verdicts;
     this.wakeRefresh = parts.refreshView;
     this.ledger = parts.ledger;
     this.queue = parts.queue;
@@ -5412,6 +5806,7 @@ var PaymentsFacade = class {
     this.restoreDeps = parts.restoreDeps;
     this.requests = parts.requests;
     this.pins = parts.pins;
+    this.burnHold = parts.burnHold;
     deps.deliveryPort.bindDeliveryKeys((blob) => this.engine().deliveryKeys(blob));
     this.heartbeat = new ConvergenceHeartbeat({
       now: () => this.nowMs(),
@@ -5435,6 +5830,7 @@ var PaymentsFacade = class {
   wakeRefresh;
   prewarmed = new PrewarmCache();
   view;
+  verdicts;
   ledger;
   queue;
   machine;
@@ -5461,6 +5857,7 @@ var PaymentsFacade = class {
   activeMoneyOps = /* @__PURE__ */ new Set();
   /** #737: the ledger holds exactly the sources of the still-open intents. */
   pins;
+  burnHold;
   /** Per facade, so per address: an NFT reading is never served to another wallet. */
   nftCache = new NftCache();
   // ── lifecycle ──────────────────────────────────────────────────────────────
@@ -5485,7 +5882,8 @@ var PaymentsFacade = class {
     await this.deps.session.start();
     await this.pins.sync().catch(() => void 0);
     this.trackTail(this.runConvergencePass());
-    this.trackTail(this.seedHeldStates());
+    this.trackTail(seedHeldStates(this.deps.storagePort, this.heldStates));
+    await this.verdicts.start().catch(() => void 0);
     await this.view.fullPull().catch(() => void 0);
     this.receiveLoop.start(this.deps.receivePollMs);
   }
@@ -5494,6 +5892,7 @@ var PaymentsFacade = class {
     this.started = false;
     this.heartbeat.stop();
     this.receiveLoop.stop();
+    this.verdicts.stop();
     for (const unsubscribe of this.unsubscribers) unsubscribe();
     this.unsubscribers = [];
     await this.deps.session.stop();
@@ -5510,12 +5909,17 @@ var PaymentsFacade = class {
   }
   // ── reads ──────────────────────────────────────────────────────────────────
   async assets(coinId) {
+    return (await this.heldAssets(coinId)).filter((asset) => asset.unverified === void 0);
+  }
+  unverifiedAssets = async (coinId) => (await this.heldAssets(coinId)).filter((a) => a.unverified !== void 0);
+  async heldAssets(coinId) {
     const all = await this.view.assets(this.deps.registry, this.deps.price);
     return coinId === void 0 ? all : all.filter((asset) => asset.coinId === coinId);
   }
   tokens(filter) {
-    return this.view.tokens(this.deps.registry, filter);
+    return this.view.tokens(this.deps.registry, filter).filter((token) => token.unverified === void 0);
   }
+  unverifiedTokens = (filter) => this.view.tokens(this.deps.registry, filter).filter((t) => t.unverified !== void 0);
   coinless() {
     return this.view.coinless(this.deps.registry);
   }
@@ -5576,9 +5980,9 @@ var PaymentsFacade = class {
     return this.track(this.ownedOp((mintId) => runNftMintUnderJournal(this.mintDeps(), { mintId, request })));
   }
   mintCustom = (request) => this.track(this.ownedOp((mintId) => runCustomMintUnderJournal(this.mintDeps(), { mintId, request })));
-  burn = (request) => this.track(this.ownedOp((burnId) => runBurnUnderJournal(this.mintDeps(), { burnId, request })));
-  pendingBurns = () => this.track(pendingBurns(this.mintDeps()));
-  acknowledgeBurn = (burnId) => this.track(acknowledgeBurn(this.mintDeps(), burnId));
+  burn = (request) => this.track(this.ownedOp((burnId) => this.burnHold.run(burnId, request.tokenId, () => runBurnUnderJournal(this.mintDeps(), { burnId, request }))));
+  pendingBurns = () => this.track(pendingBurns(this.machineStores));
+  acknowledgeBurn = (burnId) => this.track(acknowledgeBurn(this.machineStores, burnId));
   // §4 retry verb: coalesces onto the running pass — NEVER re-issue send() (#631/#676).
   async resumeNow() {
     if (!this.started) return;
@@ -5621,7 +6025,8 @@ var PaymentsFacade = class {
       isActiveOp: (mintId) => this.activeMoneyOps.has(mintId),
       tokenInServerInventory: (tokenId) => tokenInServerInventory(this.deps.storagePort, tokenId),
       emit: this.deps.emit,
-      now: () => this.nowMs()
+      now: () => this.nowMs(),
+      accepted: (token) => this.verdicts.accept(token)
     };
   }
   // ── send policy (§5.5 + old-loop parity; the machine stays policy-free) ────
@@ -5959,16 +6364,6 @@ var PaymentsFacade = class {
   newId() {
     return (this.deps.newId ?? randomUUID)();
   }
-  async seedHeldStates() {
-    let page = await this.deps.storagePort.listInventory();
-    for (let i = 0; i < INVENTORY_SCAN_PAGE_LIMIT; i++) {
-      for (const item of page.items) {
-        if (item.status === "active") this.heldStates.set(item.tokenId, item.stateHash);
-      }
-      if (!page.more) return;
-      page = await this.deps.storagePort.listInventory(page.cursor);
-    }
-  }
   track(op) {
     const settled = op.then(() => void 0, () => void 0);
     this.pendingOps.add(settled);
@@ -5983,6 +6378,7 @@ export {
   ATTENTION_MINT_UNRESOLVED,
   ATTENTION_RECIPIENT_NETWORK_UNVERIFIED,
   ATTENTION_RESEED_REJECTED,
+  CUSTOM_MINT_MAX_PAYLOAD_BYTES,
   HEARTBEAT_CAP_MS,
   HEARTBEAT_SEED_MS,
   MAX_RESELECT,
@@ -5996,6 +6392,7 @@ export {
   STORE_KEYS,
   createScopedKV,
   encodeNftContent,
+  isLiveBurn,
   isNftDocumentLink,
   isRetryableAckError,
   parseNftDocument,