@unicitylabs/sphere-sdk 0.18.0-dev.2 → 0.18.0-dev.3

package/dist/core/index.js

@@ -9511,6 +9511,150 @@ async function deriveDirectAddress(publicKey) {
   return `DIRECT://${HexConverter.encode(imprint)}${HexConverter.encode(checksum)}`;
 }
 
+// token-engine/claims.ts
+var CoinClaims = class _CoinClaims {
+  issuers = /* @__PURE__ */ new Map();
+  policies = [];
+  static fromPlugins(plugins) {
+    const claims = new _CoinClaims();
+    for (const plugin of plugins ?? []) {
+      for (const policy of plugin.tokenIssuancePolicies ?? []) claims.add(policy);
+    }
+    return claims;
+  }
+  add(policy) {
+    const tokenType = HexConverter.encode(policy.tokenType.bytes);
+    const coinIds = policy.coinIds.map((coinId) => coinId.toLowerCase());
+    const taken = coinIds.find((coinId) => this.issuers.has(coinId));
+    if (taken !== void 0) throw new Error(`Coin ${taken} is already issued by token type ${this.issuers.get(taken)}.`);
+    for (const coinId of coinIds) this.issuers.set(coinId, tokenType);
+    this.policies.push(JSON.stringify([tokenType, [...coinIds].sort(), policy.revision ?? ""]));
+  }
+  fingerprint() {
+    return [...this.policies].sort().join("\n");
+  }
+  issuerOf(coinId) {
+    return this.issuers.get(coinId.toLowerCase()) ?? null;
+  }
+};
+
+// token-engine/errors.ts
+var TransferConflictError = class extends SphereError {
+  /**
+   * #625: the source token id (the caller's id, e.g. `v2_<genesis>`) whose state was already spent.
+   * Set by PaymentsModule at the engine call site so the self-healing retry can demote it and re-plan.
+   */
+  conflictedSourceId;
+  constructor(message, cause) {
+    super(message, "TRANSFER_CONFLICT", cause);
+    this.name = "TransferConflictError";
+  }
+};
+var MintReasonUnverifiableError = class extends SphereError {
+  constructor(message, cause) {
+    super(message, "MINT_REASON_UNVERIFIABLE", cause);
+    this.name = "MintReasonUnverifiableError";
+  }
+};
+var ProofUnconfirmedError = class extends SphereError {
+  mayHaveCertified = true;
+  constructor(message, cause) {
+    super(message, "CERTIFICATION_UNCONFIRMED", cause);
+    this.name = "ProofUnconfirmedError";
+  }
+};
+var CheckpointPersistFailedError = class extends SphereError {
+  mayHaveCertified = true;
+  constructor(message, cause) {
+    super(message, "CHECKPOINT_PERSIST_FAILED", cause);
+    this.name = "CheckpointPersistFailedError";
+  }
+};
+var SplitCheckpointLostError = class extends SphereError {
+  constructor(message, cause) {
+    super(message, "SPLIT_CHECKPOINT_LOST", cause);
+    this.name = "SplitCheckpointLostError";
+  }
+};
+var CheckpointTrustbaseMismatchError = class extends SphereError {
+  constructor(message, cause) {
+    super(message, "CHECKPOINT_TRUSTBASE_MISMATCH", cause);
+    this.name = "CheckpointTrustbaseMismatchError";
+  }
+};
+function isKeepOpenSplitError(err) {
+  return err instanceof ProofUnconfirmedError || err instanceof CheckpointPersistFailedError || err instanceof SplitCheckpointLostError || err instanceof CheckpointTrustbaseMismatchError;
+}
+
+// token-engine/mint-reasons.ts
+var RULE = "MintJustificationVerification";
+var MintReasonRegistry = class _MintReasonRegistry extends MintJustificationVerifierService {
+  byTag = /* @__PURE__ */ new Map();
+  pluginTags = /* @__PURE__ */ new Set();
+  register(verifier) {
+    super.register(verifier);
+    this.byTag.set(verifier.tag, verifier);
+    return this;
+  }
+  registerPlugin(verifier) {
+    this.register(verifier);
+    this.pluginTags.add(verifier.tag);
+    return this;
+  }
+  async verify(transaction, nestedTokenCollector) {
+    const tag = transaction.justification ? reasonTag(transaction.justification) : null;
+    if (tag === null) return super.verify(transaction, nestedTokenCollector);
+    const verifier = this.byTag.get(tag);
+    if (verifier === void 0) throw new MintReasonUnverifiableError(`No verifier is registered for mint-reason tag ${tag}`);
+    if (!this.pluginTags.has(tag)) return super.verify(transaction, nestedTokenCollector);
+    return verifyPlugin(verifier, transaction, nestedTokenCollector);
+  }
+  knows(tag) {
+    return this.byTag.has(tag);
+  }
+  /** `verifiers` replace the registered ones of their tags; a tag this registry lacks is refused. */
+  overlaid(verifiers) {
+    for (const verifier of verifiers) assertKnown(this, verifier.tag);
+    const replaced = new Map(verifiers.map((verifier) => [verifier.tag, verifier]));
+    const overlay = new _MintReasonRegistry();
+    for (const [tag, verifier] of this.byTag) {
+      const perCall = replaced.get(tag);
+      if (perCall !== void 0 || this.pluginTags.has(tag)) overlay.registerPlugin(perCall ?? verifier);
+      else overlay.register(verifier);
+    }
+    return overlay;
+  }
+  assertVerifiable(justification) {
+    const tag = reasonTag(justification);
+    if (tag === null) throw new SphereError("The mint reason is not tagged CBOR", "VALIDATION_ERROR");
+    assertKnown(this, tag);
+  }
+};
+function reasonTag(justification) {
+  try {
+    return BigInt(CborDeserializer.decodeTag(justification).tag);
+  } catch {
+    return null;
+  }
+}
+async function verifyPlugin(verifier, transaction, nestedTokenCollector) {
+  let result;
+  try {
+    result = await verifier.verify(transaction, nestedTokenCollector);
+  } catch (err) {
+    const why = err instanceof Error ? err.message : String(err);
+    throw new MintReasonUnverifiableError(`Mint-reason tag ${verifier.tag} cannot be verified yet: ${why}`, err);
+  }
+  return result.status === VerificationStatus.OK ? new VerificationResult(RULE, VerificationStatus.OK, "", [result]) : new VerificationResult(RULE, VerificationStatus.FAIL, `Verification failed for tag ${verifier.tag}.`, [result]);
+}
+function assertKnown(registry, tag) {
+  if (registry.knows(tag)) return;
+  throw new SphereError(
+    `No verifier is registered on the engine for mint-reason tag ${tag}, so a replay of this mint could never verify`,
+    "VALIDATION_ERROR"
+  );
+}
+
 // token-engine/SpherePaymentData.ts
 var COIN_ID_PATTERN = /^([0-9a-f]{2})+$/;
 function assertAsset(coinId, amount) {
@@ -9687,45 +9831,6 @@ async function awaitProofBounded(deps, transaction, signal) {
   return value;
 }
 
-// token-engine/errors.ts
-var TransferConflictError = class extends SphereError {
-  /**
-   * #625: the source token id (the caller's id, e.g. `v2_<genesis>`) whose state was already spent.
-   * Set by PaymentsModule at the engine call site so the self-healing retry can demote it and re-plan.
-   */
-  conflictedSourceId;
-  constructor(message, cause) {
-    super(message, "TRANSFER_CONFLICT", cause);
-    this.name = "TransferConflictError";
-  }
-};
-var ProofUnconfirmedError = class extends SphereError {
-  mayHaveCertified = true;
-  constructor(message, cause) {
-    super(message, "CERTIFICATION_UNCONFIRMED", cause);
-    this.name = "ProofUnconfirmedError";
-  }
-};
-var CheckpointPersistFailedError = class extends SphereError {
-  mayHaveCertified = true;
-  constructor(message, cause) {
-    super(message, "CHECKPOINT_PERSIST_FAILED", cause);
-    this.name = "CheckpointPersistFailedError";
-  }
-};
-var SplitCheckpointLostError = class extends SphereError {
-  constructor(message, cause) {
-    super(message, "SPLIT_CHECKPOINT_LOST", cause);
-    this.name = "SplitCheckpointLostError";
-  }
-};
-var CheckpointTrustbaseMismatchError = class extends SphereError {
-  constructor(message, cause) {
-    super(message, "CHECKPOINT_TRUSTBASE_MISMATCH", cause);
-    this.name = "CheckpointTrustbaseMismatchError";
-  }
-};
-
 // token-engine/certification-outcome.ts
 function certificationFailure(err, failLabel, submitError, submitRejectedCleanly) {
   if (err instanceof Error && err.message === `Invalid inclusion proof status: ${InclusionProofVerificationStatus.TRANSACTION_HASH_MISMATCH}`) {
@@ -10288,15 +10393,17 @@ async function readTokenNft(token) {
 }
 
 // token-engine/plugin-ops.ts
-function contextWithMintVerifiers(base, verifiers) {
-  const registry = new MintJustificationVerifierService();
-  for (const verifier of verifiers) registry.register(verifier);
+function mintContext(deps, params) {
+  assertMintableData(params.data);
+  if (params.justification !== void 0) deps.mintJustificationVerifier.assertVerifiable(params.justification);
+  const verifiers = params.mintJustificationVerifiers;
+  if (verifiers === void 0) return deps.verificationContext;
   return new VerificationContext(
-    base.trustBase,
-    base.predicateVerifier,
-    base.unicityCertificateVerifier,
-    registry,
-    new TokenIssuanceVerifierService(false)
+    deps.trustBase,
+    deps.predicateVerifier,
+    deps.unicityCertificateVerifier,
+    deps.mintJustificationVerifier.overlaid(verifiers),
+    deps.verificationContext.tokenIssuanceVerifier
   );
 }
 
@@ -10384,9 +10491,6 @@ async function burntTokenFromCheckpoint(deps, storedBytes, reDerivedBurnTx, sour
 // token-engine/SphereTokenEngine.ts
 var DEFAULT_PROOF_POLL_INTERVAL_MS = 300;
 var MAX_MINT_CONCURRENCY = 8;
-function isKeepOpenSplitError(err) {
-  return err instanceof ProofUnconfirmedError || err instanceof CheckpointPersistFailedError || err instanceof SplitCheckpointLostError || err instanceof CheckpointTrustbaseMismatchError;
-}
 var TRANSFER_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 var CLEAN_REJECT_STATUSES = /* @__PURE__ */ new Set([
   CertificationStatus.STATE_ID_MISMATCH,
@@ -10476,8 +10580,9 @@ var SphereTokenEngine = class {
     const token = await Token.mint(certified, this.deps.verificationContext);
     return wrapToken(token);
   }
+  assertMintable = (params) => void mintContext(this.deps, params);
   async mintDataToken(params, options) {
-    assertMintableData(params.data);
+    const context = mintContext(this.deps, params);
     const recipient = SignaturePredicate.create(params.recipientPubkey);
     const tokenType = params.tokenType ? new TokenType(params.tokenType) : TokenType.generate();
     const salt = params.salt ? TokenSalt.fromBytes(params.salt) : TokenSalt.generate();
@@ -10491,8 +10596,7 @@ var SphereTokenEngine = class {
       options
     );
     const certified = await mintTx.toCertifiedTransaction(this.deps.trustBase, this.deps.predicateVerifier, this.deps.unicityCertificateVerifier, proof);
-    const verifiers = params.mintJustificationVerifiers;
-    return wrapToken(await Token.mint(certified, verifiers ? contextWithMintVerifiers(this.deps, verifiers) : this.deps.verificationContext));
+    return wrapToken(await Token.mint(certified, context));
   }
   buildNftMint(params) {
     return planNftMint(this.deps, params);
@@ -10829,20 +10933,30 @@ var SphereTokenEngine = class {
 
 // token-engine/factory.ts
 var DEFAULT_VERIFICATION_POOL_SIZE = 4;
-function registerPluginVerifiers(registry, plugins) {
+function registerPlugins(registries, plugins) {
   for (const plugin of plugins ?? []) {
     for (const verifier of plugin.mintJustificationVerifiers ?? []) {
-      try {
-        registry.register(verifier);
-      } catch (err) {
-        throw new SphereError(
-          `Token plugin '${plugin.id}' registers mint-reason tag ${verifier.tag} twice or over another plugin's: ` + (err instanceof Error ? err.message : String(err)),
-          "INVALID_CONFIG"
-        );
-      }
+      claim(plugin, `mint-reason tag ${verifier.tag}`, () => registries.reasons.registerPlugin(verifier));
+    }
+    for (const policy of plugin.tokenIssuancePolicies ?? []) {
+      const tokenType = HexConverter.encode(policy.tokenType.bytes);
+      claim(plugin, `an issuance policy for token type ${tokenType}`, () => {
+        registries.claims.add(policy);
+        registries.policies.register(policy);
+      });
     }
   }
 }
+function claim(plugin, what, register) {
+  try {
+    register();
+  } catch (err) {
+    throw new SphereError(
+      `Token plugin '${plugin.id}' registers ${what} twice or over another plugin's: ` + (err instanceof Error ? err.message : String(err)),
+      "INVALID_CONFIG"
+    );
+  }
+}
 function disposedError() {
   return new SphereError(
     "Verification worker pool disposed \u2014 the in-flight verification was cancelled",
@@ -10920,11 +11034,15 @@ async function createSphereTokenEngine(config) {
   const unicityCertificateVerifier = new UnicityCertificateVerifier(
     new UnicitySealQuorumSignaturesVerificationRule(new Secp256k1SignatureVerifier(), new VerifiedSealCache(256))
   );
-  const mintJustificationVerifier = new MintJustificationVerifierService();
+  const mintJustificationVerifier = new MintReasonRegistry();
   mintJustificationVerifier.register(
     new SplitMintJustificationVerifier(decodeSpherePaymentData)
   );
-  registerPluginVerifiers(mintJustificationVerifier, config.plugins);
+  const tokenIssuanceVerifier = new TokenIssuanceVerifierService(false);
+  registerPlugins(
+    { reasons: mintJustificationVerifier, policies: tokenIssuanceVerifier, claims: new CoinClaims() },
+    config.plugins
+  );
   const deps = {
     client: new StateTransitionClient(new AggregatorClient(config.aggregatorUrl, config.apiKey ?? null)),
     trustBase,
@@ -10936,7 +11054,7 @@ async function createSphereTokenEngine(config) {
       predicateVerifier,
       unicityCertificateVerifier,
       mintJustificationVerifier,
-      new TokenIssuanceVerifierService(false)
+      tokenIssuanceVerifier
     ),
     signingService: new SigningService(config.privateKey),
     // Also the HKDF ikm for deterministic realization (Part E.1) — the
@@ -12036,6 +12154,9 @@ function createScopedKV(storage, network, chainPubkey) {
     }
   };
 }
+function isLiveBurn(entry) {
+  return !entry.settled && entry.failure === void 0;
+}
 var STORE_KEYS = {
   intentBackstop: "intents",
   checkpointCache: "checkpoints",
@@ -12050,7 +12171,8 @@ var STORE_KEYS = {
   epochLatch: "epoch-latch",
   // §5.2 InventoryView durable overlays (#625/#679).
   suspectedSpent: "suspected-spent",
-  knownSpends: "known-spends"
+  knownSpends: "known-spends",
+  verifiedTokens: "verified-tokens"
 };
 
 // modules/payments-v2/machine/journal.ts
@@ -12567,6 +12689,7 @@ var TransferMachine = class {
       const key = keys.get(digest);
       if (key === void 0) throw new SphereError(`no upload key returned for ${digest}`, "STORAGE_ERROR");
       const { tokenId } = await engine.deliveryKeys(o.changeBlob);
+      await this.deps.recordSplit?.(o.op.sourceTokenId, tokenId);
       added.push({ tokenId, key });
     }
     return added;
@@ -12962,7 +13085,7 @@ var Converger = class {
       this.deps.stores.burnJournal.list()
     ]);
     const mintsOpen = mints.length > 0 || nftMints.length > 0 || customMints.length > 0;
-    const burnsOpen = burns.some((e) => !e.settled);
+    const burnsOpen = burns.some(isLiveBurn);
     return backstop.length > 0 || journal.some((e) => e.undeliverable !== true) || mintsOpen || burnsOpen;
   }
   async resumePass() {
@@ -13049,6 +13172,9 @@ async function deriveOpenIntentHolds(stores, decryptPayload) {
     const split = typeof payload?.split?.tokenId === "string" ? [payload.split.tokenId] : [];
     holds.set(entry.transferId, [...direct, ...split]);
   }
+  for (const burn of await stores.burnJournal.list()) {
+    if (isLiveBurn(burn)) holds.set(burn.burnId, [burn.tokenId]);
+  }
   return { open: holds, complete };
 }
 function groupJournal(journal) {
@@ -13359,18 +13485,21 @@ function toToken(tokenId, snapshot, asset, registry, flags) {
     createdAt: snapshot.createdAt,
     updatedAt: snapshot.updatedAt,
     lazy: true,
-    ...flags.suspectedSpent ? { suspectedSpent: true } : {}
+    ...flags.suspectedSpent ? { suspectedSpent: true } : {},
+    ...flags.standing !== "trusted" ? { unverified: flags.standing } : {}
   };
 }
-function aggregateAssets(entries, isTransferring, registry) {
+function aggregateAssets(entries, reading, registry) {
   const groups = /* @__PURE__ */ new Map();
   for (const [tokenId, entry] of entries) {
-    const moving = isTransferring(tokenId);
+    const moving = reading.isTransferring(tokenId);
     for (const asset of entry.assets) {
-      let group = groups.get(asset.coinId);
+      const standing = reading.standing(tokenId, asset.coinId);
+      const key = standing === "trusted" ? asset.coinId : `${asset.coinId}:${standing}`;
+      let group = groups.get(key);
       if (!group) {
-        group = { total: 0n, count: 0, transferring: 0n, transferringCount: 0 };
-        groups.set(asset.coinId, group);
+        group = { coinId: asset.coinId, standing, total: 0n, count: 0, transferring: 0n, transferringCount: 0 };
+        groups.set(key, group);
       }
       if (moving) {
         group.transferring += BigInt(asset.amount);
@@ -13381,9 +13510,10 @@ function aggregateAssets(entries, isTransferring, registry) {
       }
     }
   }
-  return [...groups].map(([coinId, totals]) => toAsset(coinId, totals, registry));
+  return [...groups.values()].map((totals) => toAsset(totals, registry));
 }
-function toAsset(coinId, totals, registry) {
+function toAsset(totals, registry) {
+  const coinId = totals.coinId;
   const iconUrl = registry.getIconUrl(coinId);
   return {
     coinId,
@@ -13403,7 +13533,8 @@ function toAsset(coinId, totals, registry) {
     priceEur: null,
     change24h: null,
     fiatValueUsd: null,
-    fiatValueEur: null
+    fiatValueEur: null,
+    ...totals.standing !== "trusted" ? { unverified: totals.standing } : {}
   };
 }
 function priceIdOf(registry, coinId) {
@@ -13411,9 +13542,9 @@ function priceIdOf(registry, coinId) {
 }
 async function withPrices(raw, registry, price) {
   try {
-    const ids = [...new Set(raw.map((a) => priceIdOf(registry, a.coinId)))];
+    const ids = [...new Set(raw.filter((a) => !a.unverified).map((a) => priceIdOf(registry, a.coinId)))];
     const quotes = await price.getPrices(ids);
-    return raw.map((a) => priceOne(a, quotes.get(priceIdOf(registry, a.coinId))));
+    return raw.map((a) => a.unverified ? a : priceOne(a, quotes.get(priceIdOf(registry, a.coinId))));
   } catch {
     return raw;
   }
@@ -13434,11 +13565,13 @@ function transferringToken(tokenId, coinId, amount, registry, now) {
   const snapshot = { assets: [], createdAt: now, updatedAt: now };
   return toToken(tokenId, snapshot, { coinId, amount: amount.toString() }, registry, {
     transferring: true,
-    suspectedSpent: false
+    suspectedSpent: false,
+    standing: "trusted"
   });
 }
 
 // modules/payments-v2/inventory/InventoryView.ts
+var TRUST_ALL = { isClaimed: () => false, standing: () => "trusted" };
 var SUSPECTED_KEY = STORE_KEYS.suspectedSpent;
 var KNOWN_SPENDS_KEY = STORE_KEYS.knownSpends;
 var CURSOR_KEY = STORE_KEYS.streamCursor("inventory");
@@ -13532,6 +13665,12 @@ var InventoryView = class {
     for (const tokenId of tokenIds) if (this.inFlight.delete(tokenId)) changed = true;
     if (changed) this.deps.emit("inventory:updated");
   }
+  get trust() {
+    return this.deps.trust ?? TRUST_ALL;
+  }
+  trusts(tokenId, coinId) {
+    return this.trust.standing(tokenId, coinId) === "trusted";
+  }
   pinned(tokenId) {
     return this.deps.isPinned?.(tokenId) ?? false;
   }
@@ -13558,6 +13697,7 @@ var InventoryView = class {
   isSpendable(tokenId, entry) {
     if (entry.status !== "active") return false;
     if (this.inFlight.has(tokenId) && !this.pinned(tokenId)) return false;
+    if (!entry.assets.every((asset) => this.trusts(tokenId, asset.coinId))) return false;
     return !this.suspected.has(stateKey(tokenId, entry.stateHash));
   }
   /** Is this NAMED token spendable whole — coinless or valued (#777)? */
@@ -13584,7 +13724,8 @@ var InventoryView = class {
       out.push(
         toToken(tokenId, entry, asset, registry, {
           transferring: this.held(tokenId),
-          suspectedSpent: this.suspected.has(stateKey(tokenId, entry.stateHash))
+          suspectedSpent: this.suspected.has(stateKey(tokenId, entry.stateHash)),
+          standing: this.trust.standing(tokenId, asset.coinId)
         })
       );
     }
@@ -13614,10 +13755,21 @@ var InventoryView = class {
     return out;
   }
   async assets(registry, price) {
-    const raw = aggregateAssets(this.activeEntries(), (tokenId) => this.held(tokenId), registry);
+    const reading = {
+      isTransferring: (tokenId) => this.held(tokenId),
+      standing: (tokenId, coinId) => this.trust.standing(tokenId, coinId)
+    };
+    const raw = aggregateAssets(this.activeEntries(), reading, registry);
     if (!price || raw.length === 0) return raw;
     return withPrices(raw, registry, price);
   }
+  claimHolders() {
+    const out = [];
+    for (const [tokenId, entry] of this.activeEntries()) {
+      if (entry.assets.some((asset) => this.trust.isClaimed(asset.coinId))) out.push(tokenId);
+    }
+    return out;
+  }
   *activeEntries() {
     for (const [tokenId, entry] of this.mirror) {
       if (entry.status === "active") yield [tokenId, entry];
@@ -13787,6 +13939,171 @@ var InventoryView = class {
   }
 };
 
+// modules/payments-v2/inventory/verdicts.ts
+var VERDICT_RETRY_MS = 3e4;
+var VERDICT_RETRY_MAX_MS = 60 * 60 * 1e3;
+function honoursClaims(claims, token) {
+  const issuers = (token.value?.assets ?? []).map((asset) => claims.issuerOf(asset.coinId));
+  return issuers.some((issuer) => issuer !== null) && issuers.every((issuer) => issuer === null || issuer === token.tokenType);
+}
+var TokenVerdicts = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  verified = /* @__PURE__ */ new Set();
+  refused = /* @__PURE__ */ new Set();
+  retries = /* @__PURE__ */ new Map();
+  writes = new SerialChain();
+  hydration = null;
+  queued = null;
+  running = null;
+  held = [];
+  timer = null;
+  live = false;
+  isClaimed(coinId) {
+    return this.deps.claims.issuerOf(coinId) !== null;
+  }
+  standing(tokenId, coinId) {
+    if (!this.isClaimed(coinId) || this.verified.has(tokenId)) return "trusted";
+    return this.refused.has(tokenId) ? "refused" : "pending";
+  }
+  trusts(tokenId, coinId) {
+    return this.standing(tokenId, coinId) === "trusted";
+  }
+  hydrate() {
+    this.hydration ??= this.load().catch((error) => {
+      this.hydration = null;
+      throw error;
+    });
+    return this.hydration;
+  }
+  start() {
+    this.live = true;
+    return this.hydrate();
+  }
+  stop() {
+    this.live = false;
+    if (this.timer !== null) clearTimeout(this.timer);
+    this.timer = null;
+  }
+  async accept(token) {
+    if (honoursClaims(this.deps.claims, token)) await this.remember(token.blob.tokenId);
+  }
+  async recordSplit(sourceTokenId, outputTokenId) {
+    await this.hydrate();
+    if (this.verified.has(sourceTokenId)) await this.remember(outputTokenId);
+  }
+  review(holders) {
+    this.queued = holders;
+    this.running ??= this.drain();
+    return this.running;
+  }
+  async drain() {
+    try {
+      while (this.queued !== null) {
+        const holders = this.queued;
+        this.queued = null;
+        await this.reviewOnce(holders);
+      }
+    } finally {
+      this.running = null;
+    }
+  }
+  async reviewOnce(holders) {
+    await this.hydrate();
+    this.held = holders;
+    const due = holders.filter((tokenId) => this.isDue(tokenId));
+    const verdicts = due.length === 0 ? /* @__PURE__ */ new Map() : await this.check(due);
+    for (const tokenId of due) this.settle(tokenId, verdicts.get(tokenId) ?? "retry");
+    if (due.some((tokenId) => verdicts.get(tokenId) === "verified")) {
+      await this.persist();
+      this.deps.changed();
+    }
+    this.scheduleRetry();
+  }
+  isDue(tokenId) {
+    if (this.verified.has(tokenId) || this.refused.has(tokenId)) return false;
+    return (this.retries.get(tokenId)?.atMs ?? 0) <= this.now();
+  }
+  async check(due) {
+    const verdicts = /* @__PURE__ */ new Map();
+    let blobs;
+    try {
+      blobs = await this.deps.getBlobs([...due]);
+    } catch {
+      return verdicts;
+    }
+    for (const tokenId of due) {
+      const bytes = blobs.get(tokenId);
+      if (bytes !== void 0) verdicts.set(tokenId, await this.verdictOf(tokenId, bytes));
+    }
+    return verdicts;
+  }
+  async verdictOf(tokenId, bytes) {
+    let engine;
+    try {
+      engine = this.deps.engine();
+    } catch {
+      return "retry";
+    }
+    let token;
+    try {
+      token = await engine.decodeToken({ tokenId, token: bytes });
+    } catch {
+      return "refused";
+    }
+    if (token.blob.tokenId !== tokenId || !honoursClaims(this.deps.claims, token)) return "refused";
+    try {
+      return (await engine.verify(token)).ok ? "verified" : "refused";
+    } catch {
+      return "retry";
+    }
+  }
+  settle(tokenId, verdict) {
+    if (verdict === "retry") {
+      this.retries.set(tokenId, this.nextRetry(this.retries.get(tokenId)));
+      return;
+    }
+    this.retries.delete(tokenId);
+    (verdict === "verified" ? this.verified : this.refused).add(tokenId);
+  }
+  nextRetry(previous) {
+    const attempts = (previous?.attempts ?? 0) + 1;
+    const delay = Math.min(VERDICT_RETRY_MS * 2 ** (attempts - 1), VERDICT_RETRY_MAX_MS);
+    return { attempts, atMs: this.now() + delay };
+  }
+  scheduleRetry() {
+    if (!this.live || this.timer !== null) return;
+    const due = this.held.flatMap((tokenId) => this.retries.get(tokenId)?.atMs ?? []);
+    if (due.length === 0) return;
+    const delay = Math.max(0, due.reduce((a, b) => Math.min(a, b)) - this.now());
+    this.timer = setTimeout(() => {
+      this.timer = null;
+      void this.review(this.held).catch(() => void 0);
+    }, delay);
+  }
+  async remember(tokenId) {
+    await this.hydrate();
+    if (this.verified.has(tokenId)) return;
+    this.verified.add(tokenId);
+    this.refused.delete(tokenId);
+    this.retries.delete(tokenId);
+    await this.persist();
+  }
+  persist() {
+    const remembered = { fingerprint: this.deps.claims.fingerprint(), tokenIds: [...this.verified] };
+    return this.writes.enqueue(() => this.deps.kv.set(STORE_KEYS.verifiedTokens, remembered));
+  }
+  async load() {
+    const remembered = await this.deps.kv.get(STORE_KEYS.verifiedTokens);
+    if (remembered?.fingerprint !== this.deps.claims.fingerprint()) return;
+    for (const tokenId of remembered.tokenIds) this.verified.add(tokenId);
+  }
+  now() {
+    return (this.deps.now ?? Date.now)();
+  }
+};
+
 // modules/payments-v2/ports.ts
 function isRetryableAckError(err) {
   return err !== null && typeof err === "object" && err.retryable === true;
@@ -13796,6 +14113,8 @@ function isRetryableAckError(err) {
 var ACK_BATCH_SIZE = 200;
 var REFRESH_INTERVAL_MS = 2500;
 var POLL_INTERVAL_MS = 3e4;
+var RECHECK_BASE_MS = POLL_INTERVAL_MS;
+var RECHECK_MAX_MS = 60 * 60 * 1e3;
 var ATTENTION_CLAIM_CONFLICT = "claim:conflict";
 function receivedDedupKey(tokenId, stateHash) {
   return `RECEIVED:${tokenId.toLowerCase()}:${stateHash.toLowerCase()}`;
@@ -13812,6 +14131,7 @@ var Receive = class {
   pollTimer = null;
   unsubscribeWake = null;
   lastRefreshAt = 0;
+  rechecks = /* @__PURE__ */ new Map();
   drainOnce() {
     return this.drainFlight.run(() => this.doDrain());
   }
@@ -13870,6 +14190,7 @@ var Receive = class {
     const pending = [];
     const pageEpoch = () => deps.delivery.incomingEpoch() ?? deps.syncEpoch();
     const claimable = { n: 0 };
+    const deferred = { any: false };
     const finish = () => {
       if (claimable.n > 0) deps.refreshView?.();
       return stored;
@@ -13878,7 +14199,7 @@ var Receive = class {
       const record = await deps.kv.get(STORE_KEYS.streamCursor("mailbox"));
       let basis = record !== null && record.syncEpoch === deps.syncEpoch() ? record : null;
       for (let pass = 0; pass < 2; pass++) {
-        await this.drainPages({ deps, engine, pending, stored, pageEpoch, claimable }, basis);
+        await this.drainPages({ deps, engine, pending, stored, pageEpoch, claimable, deferred }, basis);
         const served = deps.delivery.incomingEpoch();
         if (basis === null || served === null || served === basis.syncEpoch) break;
         await deps.kv.remove(STORE_KEYS.streamCursor("mailbox"));
@@ -13895,20 +14216,41 @@ var Receive = class {
     return finish();
   }
   async processEntry(ctx, entry) {
-    const { deps, engine, pending, stored, claimable } = ctx;
-    const screened = await screen(deps, engine, entry);
+    const { deps, engine, stored, claimable } = ctx;
+    const screened = this.recheckDue(entry.deliveryId) ? await screen(deps, engine, entry) : { kind: "defer" };
+    this.scheduleRecheck(entry.deliveryId, screened.kind === "defer");
+    if (screened.kind === "defer") {
+      ctx.deferred.any = true;
+      return;
+    }
     if (screened.kind === "ack") {
-      pending.push(screened.ack);
+      queueAck(ctx, screened.ack);
       if (screened.ack.disposition === "claimed") claimable.n += 1;
       return;
     }
+    await deps.accepted?.(screened.token);
     await deps.view.store(screened.record);
-    pending.push(claimAck(entry));
+    queueAck(ctx, claimAck(entry));
     claimable.n += 1;
     const transfer = await announce(deps, entry, screened.record);
     stored.push(transfer);
     deps.emit("transfer:incoming", transfer);
   }
+  recheckDue(deliveryId) {
+    const recheck = this.rechecks.get(deliveryId);
+    return recheck === void 0 || (this.deps.now?.() ?? Date.now()) >= recheck.atMs;
+  }
+  scheduleRecheck(deliveryId, deferred) {
+    if (!deferred) {
+      this.rechecks.delete(deliveryId);
+      return;
+    }
+    const previous = this.rechecks.get(deliveryId);
+    if (previous !== void 0 && (this.deps.now?.() ?? Date.now()) < previous.atMs) return;
+    const attempts = (previous?.attempts ?? 0) + 1;
+    const delay = Math.min(RECHECK_BASE_MS * 2 ** (attempts - 1), RECHECK_MAX_MS);
+    this.rechecks.set(deliveryId, { attempts, atMs: (this.deps.now?.() ?? Date.now()) + delay });
+  }
 };
 async function screen(deps, engine, entry) {
   const blobBytes = await entry.fetchBlob();
@@ -13919,7 +14261,8 @@ async function screen(deps, engine, entry) {
     logger.warn("PaymentsV2", `receive: undecodable blob rejected \u2014 ${String(err)}`);
     return { kind: "ack", ack: rejectAck(entry, "invalid") };
   }
-  const verdict = await engine.verify(token);
+  const verdict = await verdictOf(engine, token);
+  if (verdict === null) return { kind: "defer" };
   if (!verdict.ok) return { kind: "ack", ack: rejectAck(entry, "invalid") };
   if (!engine.isOwnedBy(token, engine.getIdentity().chainPubkey)) {
     return { kind: "ack", ack: rejectAck(entry, "not-owned") };
@@ -13930,38 +14273,43 @@ async function screen(deps, engine, entry) {
   if (held !== null && await engine.isSpent(token)) {
     return { kind: "ack", ack: rejectAck(entry, "invalid") };
   }
+  const unverifiedCoinIds = unverifiedCoinsOf(deps, token);
   return {
     kind: "accept",
+    token,
     record: {
       tokenId: keys.tokenId,
       stateHash: keys.stateHash,
       assets: toAssetAmounts(token),
-      ...isCoinlessEnvelope(token.valueEnvelope) ? { tokenType: token.tokenType } : {}
+      ...isCoinlessEnvelope(token.valueEnvelope) ? { tokenType: token.tokenType } : {},
+      ...unverifiedCoinIds.length > 0 ? { unverifiedCoinIds } : {}
     }
   };
 }
-async function announce(deps, entry, record) {
-  const receivedAt = (deps.now ?? Date.now)();
+function unverifiedCoinsOf(deps, token) {
+  const claims = deps.claims;
+  if (claims === void 0 || honoursClaims(claims, token)) return [];
+  return (token.value?.assets ?? []).map((asset) => asset.coinId).filter((coinId) => claims.issuerOf(coinId) !== null);
+}
+async function verdictOf(engine, token) {
   try {
-    await deps.recordReceived({
-      dedupKey: receivedDedupKey(record.tokenId, record.stateHash),
-      tokenId: record.tokenId,
-      stateHash: record.stateHash,
-      assets: record.assets,
-      ...record.tokenType !== void 0 ? { tokenType: record.tokenType } : {},
-      ...entry.senderPubkey !== void 0 ? { senderPubkey: entry.senderPubkey } : {},
-      ...entry.senderNametag !== void 0 ? { senderNametag: entry.senderNametag } : {},
-      ...entry.memo !== void 0 ? { memo: entry.memo } : {},
-      receivedAt
-    });
+    return await engine.verify(token);
   } catch (err) {
-    logger.debug("PaymentsV2", "RECEIVED history hook failed (money path unaffected):", err);
+    if (isSphereError(err) && err.code === "MINT_REASON_UNVERIFIABLE") return null;
+    throw err;
   }
+}
+async function announce(deps, entry, record) {
+  const receivedAt = (deps.now ?? Date.now)();
+  await recordArrival(deps, entry, record, receivedAt);
+  const refused2 = record.assets.filter((asset) => record.unverifiedCoinIds?.includes(asset.coinId));
+  const counted = record.assets.filter((asset) => !refused2.includes(asset));
   return {
     id: record.tokenId,
     senderPubkey: entry.senderPubkey ?? "",
     ...entry.senderNametag !== void 0 ? { senderNametag: entry.senderNametag } : {},
-    tokens: record.assets.map((asset) => toUiToken(record.tokenId, asset, deps.registry, receivedAt)),
+    tokens: counted.map((asset) => toUiToken(record.tokenId, asset, deps.registry, receivedAt)),
+    ...refused2.length > 0 ? { unverifiedTokens: refused2.map((asset) => ({ ...toUiToken(record.tokenId, asset, deps.registry, receivedAt), unverified: "refused" })) } : {},
     // #777: named here rather than mapped from assets, which announced an EMPTY list.
     ...record.tokenType !== void 0 ? {
       coinless: [
@@ -13979,6 +14327,25 @@ async function announce(deps, entry, record) {
     receivedAt
   };
 }
+async function recordArrival(deps, entry, record, receivedAt) {
+  const assets = record.assets.filter((asset) => !record.unverifiedCoinIds?.includes(asset.coinId));
+  if (assets.length === 0 && record.unverifiedCoinIds !== void 0) return;
+  try {
+    await deps.recordReceived({
+      dedupKey: receivedDedupKey(record.tokenId, record.stateHash),
+      tokenId: record.tokenId,
+      stateHash: record.stateHash,
+      assets,
+      ...record.tokenType !== void 0 ? { tokenType: record.tokenType } : {},
+      ...entry.senderPubkey !== void 0 ? { senderPubkey: entry.senderPubkey } : {},
+      ...entry.senderNametag !== void 0 ? { senderNametag: entry.senderNametag } : {},
+      ...entry.memo !== void 0 ? { memo: entry.memo } : {},
+      receivedAt
+    });
+  } catch (err) {
+    logger.debug("PaymentsV2", "RECEIVED history hook failed (money path unaffected):", err);
+  }
+}
 async function flushAcks(deps, pending, epochOf) {
   if (pending.length === 0) return { progressed: true };
   const before = pending.length;
@@ -13986,7 +14353,7 @@ async function flushAcks(deps, pending, epochOf) {
   try {
     const settled = await settleAcks(deps, pending);
     let i = 0;
-    while (i < pending.length && settled.has(pending[i].deliveryId)) {
+    while (i < pending.length && settled.has(pending[i].deliveryId) && pending[i].holdsCursor !== true) {
       lastAcked = pending[i].cursor;
       i += 1;
     }
@@ -14062,6 +14429,9 @@ async function ackOne(deps, ack) {
     await rejectStaleClaim(deps, ack.deliveryId, ack.transferId);
   }
 }
+function queueAck(ctx, ack) {
+  ctx.pending.push(ctx.deferred.any ? { ...ack, holdsCursor: true } : ack);
+}
 function claimAck(entry) {
   return {
     deliveryId: entry.deliveryId,
@@ -14770,72 +15140,276 @@ var SpendQueue = class {
       queue = [];
       this.queues.set(coinId, queue);
     }
-    queue.push(entry);
-    return settled;
+    queue.push(entry);
+    return settled;
+  }
+  expire(id, coinId) {
+    const entries = this.queues.get(coinId);
+    if (!entries) return;
+    const index = entries.findIndex((e) => e.id === id);
+    if (index === -1) return;
+    const [entry] = entries.splice(index, 1);
+    entry.reject(new SphereError("Send queue timeout", "SEND_QUEUE_TIMEOUT"));
+    if (entries.length === 0) this.queues.delete(coinId);
+  }
+  // Whole-token semantics: only fully-free tokens enter the selector pool. What
+  // the reservations hold back is counted too — the refusal has to name it (#737).
+  freeView(coinId) {
+    const freeView = [];
+    let freeTotal = 0n;
+    let pinnedTotal = 0n;
+    const holders = /* @__PURE__ */ new Set();
+    const unproven = this.deps.ledger.unprovenReason();
+    for (const entry of this.deps.getPool(coinId)) {
+      if (entry.amount <= 0n) continue;
+      const holder = unproven === null ? this.deps.ledger.holderOf(entry.tokenId) : entry.tokenId;
+      if (holder === void 0) {
+        freeView.push(entry);
+        freeTotal += entry.amount;
+      } else {
+        pinnedTotal += entry.amount;
+        holders.add(holder);
+      }
+    }
+    return { freeView, freeTotal, pinnedTotal, pinnedBy: holders.size, unproven };
+  }
+  expectedChangeTotal(coinId) {
+    let total = 0n;
+    for (const change of this.expectedChange.values()) {
+      if (change.coinId === coinId) total += change.amount;
+    }
+    return total;
+  }
+  reservePlan(reservationId, plan, freeView) {
+    const pool = new Set(freeView.map((e) => e.tokenId));
+    const tokenIds = [...plan.direct, ...plan.split ? [plan.split.tokenId] : []];
+    for (const tokenId of tokenIds) {
+      if (!pool.has(tokenId)) {
+        throw new SphereError("Planned token missing from pool", "VALIDATION_ERROR");
+      }
+    }
+    this.deps.ledger.reserve(reservationId, tokenIds.map((tokenId) => ({ tokenId })));
+  }
+  totalQueued() {
+    let total = 0;
+    for (const entries of this.queues.values()) total += entries.length;
+    return total;
+  }
+};
+function parseAmount(raw) {
+  if (!/^\d+$/.test(raw)) {
+    throw new SphereError("Invalid send amount", "VALIDATION_ERROR");
+  }
+  const amount = BigInt(raw);
+  if (amount <= 0n) {
+    throw new SphereError("Send amount must be positive", "VALIDATION_ERROR");
+  }
+  return amount;
+}
+
+// modules/payments-v2/machine/payload.ts
+function buildPayload(recipientPubkey, request, spend, spentStates) {
+  return {
+    v: 2,
+    kind: "coin",
+    recipient: recipientPubkey,
+    coinId: request.coinId,
+    amount: request.amount,
+    ...request.memo !== void 0 ? { memo: request.memo } : {},
+    direct: [...spend.plan.direct],
+    ...spend.plan.split !== void 0 ? {
+      split: {
+        tokenId: spend.plan.split.tokenId,
+        splitAmount: spend.plan.split.splitAmount.toString(),
+        remainderAmount: spend.plan.split.remainderAmount.toString()
+      }
+    } : {},
+    spentStates
+  };
+}
+function messageOf(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function buildWholePayload(recipientPubkey, request, spentStates) {
+  return {
+    v: 2,
+    kind: "whole",
+    recipient: recipientPubkey,
+    ...request.memo !== void 0 ? { memo: request.memo } : {},
+    direct: [request.tokenId],
+    spentStates
+  };
+}
+
+// modules/payments-v2/burn.ts
+var HEX32 = /^[0-9a-f]{64}$/;
+async function heldToken2(deps, tokenId) {
+  const bytes = (await deps.storagePort.getBlobs([tokenId])).get(tokenId);
+  if (bytes === void 0) {
+    throw new SphereError(`Token ${tokenId} has no blob in storage; it is not held here`, "STORAGE_ERROR");
+  }
+  return deps.engine.decodeToken({ tokenId, token: bytes });
+}
+function assertBurnable(engine, token, tokenId) {
+  if (!engine.isOwnedBy(token, engine.getIdentity().chainPubkey)) {
+    throw new SphereError(`Token ${tokenId} is not owned by this wallet`, "VALIDATION_ERROR");
+  }
+  if (token.valueEnvelope === "bare_collection") {
+    throw new SphereError(
+      `Token ${tokenId} carries a value envelope this SDK cannot read, so its coins cannot be accounted for; it cannot be burned`,
+      "VALIDATION_ERROR"
+    );
+  }
+}
+function assetsOf(token) {
+  return (token.value?.assets ?? []).map((a) => ({ coinId: a.coinId, amount: a.amount.toString() }));
+}
+async function runBurnUnderJournal(deps, input) {
+  const { burnId } = input;
+  const { tokenId, reasonBytes } = input.request;
+  if (!HEX32.test(tokenId) || reasonBytes.length === 0) {
+    return { success: false, burnId, tokenId, error: "burn: tokenId must be 64 hex and reasonBytes non-empty", errorCode: "VALIDATION_ERROR" };
+  }
+  let token;
+  try {
+    token = await heldToken2(deps, tokenId);
+    assertBurnable(deps.engine, token, tokenId);
+  } catch (err) {
+    return refused(burnId, tokenId, err);
+  }
+  const entry = {
+    burnId,
+    tokenId,
+    reasonHex: bytesToHex3(reasonBytes),
+    burnedTokenHex: null,
+    settled: false,
+    assets: assetsOf(token),
+    createdAt: deps.now()
+  };
+  await deps.burnJournal.upsert(entry);
+  try {
+    const settled = await burnJournaled(deps, entry, token);
+    return { success: true, burnId, tokenId, burnedToken: hexToBytes4(settled.burnedTokenHex ?? "") };
+  } catch (err) {
+    const failure = failureOf(err);
+    if (isTerminal(err)) await deps.burnJournal.upsert({ ...entry, failure });
+    else deps.armHeartbeat();
+    return { success: false, burnId, tokenId, error: failure.message, errorCode: failure.code };
+  }
+}
+async function replayBurns(deps) {
+  let progressed = 0;
+  for (const entry of await deps.burnJournal.list()) {
+    if (!isLiveBurn(entry) || deps.isActiveOp(entry.burnId)) continue;
+    try {
+      const token = entry.burnedTokenHex === null ? await heldToken2(deps, entry.tokenId) : null;
+      await burnJournaled(deps, entry, token);
+      progressed += 1;
+    } catch (err) {
+      if (!isTerminal(err)) continue;
+      await deps.burnJournal.upsert({ ...entry, failure: failureOf(err) });
+      progressed += 1;
+    }
+  }
+  return progressed;
+}
+async function pendingBurns(deps) {
+  return (await deps.burnJournal.list()).map((entry) => ({
+    burnId: entry.burnId,
+    tokenId: entry.tokenId,
+    reasonBytes: hexToBytes4(entry.reasonHex),
+    burnedToken: entry.burnedTokenHex === null ? null : hexToBytes4(entry.burnedTokenHex),
+    settled: entry.settled,
+    createdAt: entry.createdAt,
+    ...entry.failure !== void 0 ? { failure: entry.failure } : {}
+  }));
+}
+async function acknowledgeBurn(deps, burnId) {
+  const entry = await deps.burnJournal.getByKey(burnId);
+  if (entry === void 0) return;
+  if (isLiveBurn(entry)) {
+    throw new SphereError(`Burn ${burnId} is not settled yet; it cannot be acknowledged`, "VALIDATION_ERROR");
+  }
+  await deps.burnJournal.removeByKey(burnId);
+}
+function refused(burnId, tokenId, err) {
+  const failure = failureOf(err);
+  return { success: false, burnId, tokenId, error: failure.message, errorCode: failure.code };
+}
+function isTerminal(err) {
+  return classifyError(err) === "conflict";
+}
+function failureOf(err) {
+  const code = err !== null && typeof err === "object" ? err.code : void 0;
+  return { code: typeof code === "string" ? code : "UNKNOWN", message: messageOf(err) };
+}
+async function burnJournaled(deps, entry, token) {
+  let current = entry;
+  if (current.burnedTokenHex === null) {
+    if (token === null) throw new SphereError("burn replay needs the held token to certify", "VALIDATION_ERROR");
+    const burned = await deps.engine.burn(
+      { token, reasonBytes: hexToBytes4(current.reasonHex) },
+      { transferId: current.burnId }
+    );
+    if (burned.blob.tokenId !== current.tokenId) {
+      throw new SphereError(`burned token ${burned.blob.tokenId}, but the journal names ${current.tokenId}`, "VALIDATION_ERROR");
+    }
+    current = { ...current, burnedTokenHex: bytesToHex3(burned.blob.token) };
+    await deps.burnJournal.upsert(current);
   }
-  expire(id, coinId) {
-    const entries = this.queues.get(coinId);
-    if (!entries) return;
-    const index = entries.findIndex((e) => e.id === id);
-    if (index === -1) return;
-    const [entry] = entries.splice(index, 1);
-    entry.reject(new SphereError("Send queue timeout", "SEND_QUEUE_TIMEOUT"));
-    if (entries.length === 0) this.queues.delete(coinId);
+  await deps.storagePort.applyDelta({ transferId: current.burnId, spent: [current.tokenId], added: [], externalDelivery: true });
+  await deps.recordSent({ transferId: current.burnId, assets: current.assets, tokenId: current.tokenId });
+  current = { ...current, settled: true };
+  await deps.burnJournal.upsert(current);
+  deps.refreshView();
+  return current;
+}
+
+// modules/payments-v2/burn-hold.ts
+var BurnHold = class {
+  constructor(deps) {
+    this.deps = deps;
   }
-  // Whole-token semantics: only fully-free tokens enter the selector pool. What
-  // the reservations hold back is counted too — the refusal has to name it (#737).
-  freeView(coinId) {
-    const freeView = [];
-    let freeTotal = 0n;
-    let pinnedTotal = 0n;
-    const holders = /* @__PURE__ */ new Set();
-    const unproven = this.deps.ledger.unprovenReason();
-    for (const entry of this.deps.getPool(coinId)) {
-      if (entry.amount <= 0n) continue;
-      const holder = unproven === null ? this.deps.ledger.holderOf(entry.tokenId) : entry.tokenId;
-      if (holder === void 0) {
-        freeView.push(entry);
-        freeTotal += entry.amount;
-      } else {
-        pinnedTotal += entry.amount;
-        holders.add(holder);
-      }
+  async run(burnId, tokenId, burn) {
+    try {
+      this.deps.queue.planWhole(burnId, tokenId);
+    } catch (err) {
+      return refused(burnId, tokenId, err);
     }
-    return { freeView, freeTotal, pinnedTotal, pinnedBy: holders.size, unproven };
-  }
-  expectedChangeTotal(coinId) {
-    let total = 0n;
-    for (const change of this.expectedChange.values()) {
-      if (change.coinId === coinId) total += change.amount;
+    this.deps.view.markInFlightMany([tokenId]);
+    let burned = false;
+    try {
+      const result = await burn();
+      burned = result.success;
+      return result;
+    } finally {
+      await this.settle(burnId, tokenId, burned);
     }
-    return total;
   }
-  reservePlan(reservationId, plan, freeView) {
-    const pool = new Set(freeView.map((e) => e.tokenId));
-    const tokenIds = [...plan.direct, ...plan.split ? [plan.split.tokenId] : []];
-    for (const tokenId of tokenIds) {
-      if (!pool.has(tokenId)) {
-        throw new SphereError("Planned token missing from pool", "VALIDATION_ERROR");
-      }
+  async settle(burnId, tokenId, burned) {
+    if (burned) {
+      this.deps.ledger.commit(burnId);
+      this.deps.track(this.refreshThenRelease(tokenId));
+      return;
     }
-    this.deps.ledger.reserve(reservationId, tokenIds.map((tokenId) => ({ tokenId })));
+    const entry = await this.deps.burnJournal.getByKey(burnId).catch(() => null);
+    if (entry === void 0 || entry !== null && !isLiveBurn(entry)) {
+      this.deps.ledger.cancel(burnId);
+      this.deps.view.releaseMany([tokenId]);
+      this.deps.queue.notifyChange("");
+      return;
+    }
+    this.deps.pins.adopt(burnId);
   }
-  totalQueued() {
-    let total = 0;
-    for (const entries of this.queues.values()) total += entries.length;
-    return total;
+  async refreshThenRelease(tokenId) {
+    try {
+      await this.deps.view.delta();
+      this.deps.view.releaseMany([tokenId]);
+    } finally {
+      this.deps.queue.notifyChange("");
+    }
   }
 };
-function parseAmount(raw) {
-  if (!/^\d+$/.test(raw)) {
-    throw new SphereError("Invalid send amount", "VALIDATION_ERROR");
-  }
-  const amount = BigInt(raw);
-  if (amount <= 0n) {
-    throw new SphereError("Send amount must be positive", "VALIDATION_ERROR");
-  }
-  return amount;
-}
 
 // modules/payments-v2/compose.ts
 function supportsDeterministicMint(engine) {
@@ -14844,16 +15418,8 @@ function supportsDeterministicMint(engine) {
 function composeFacadeParts(deps, hooks) {
   const ownPubkeyBytes = hexToBytes4(deps.ownPubkey);
   const ledger = new ReservationLedger();
-  const view = new InventoryView({
-    port: deps.storagePort,
-    kv: deps.kv,
-    emit: (event) => deps.emit(event, {}),
-    // #737: a reserved token is unselectable, so it is never confirmed balance.
-    // #738: while the held-set is unproven, EVERY token reads pinned — the report
-    // must not call a token spendable that the queue is about to refuse to spend.
-    isPinned: (tokenId) => ledger.unprovenReason() !== null || ledger.holderOf(tokenId) !== void 0,
-    ...deps.now !== void 0 ? { now: deps.now } : {}
-  });
+  const verdicts = buildVerdicts(deps, hooks);
+  const view = buildView(deps, hooks, ledger, verdicts);
   const queue = new SpendQueue({
     ledger,
     getPool: (coinId) => view.pool(coinId),
@@ -14868,27 +15434,57 @@ function composeFacadeParts(deps, hooks) {
     ...deps.now !== void 0 ? { now: deps.now } : {},
     ...deps.newId !== void 0 ? { newId: deps.newId } : {}
   });
-  const machineDeps = buildMachineDeps(deps, hooks, historyStore);
+  const machineDeps = buildMachineDeps(deps, hooks, historyStore, verdicts);
   const machineStores = createMachineStores(deps.kv);
   const heldStates = /* @__PURE__ */ new Map();
   const refreshView = coalesced(() => view.delta(), hooks.track);
+  const pins = buildPins(deps, hooks, { ledger, view, machineStores, machineDeps });
   return {
     ownPubkeyBytes,
     view,
+    verdicts,
     refreshView,
     ledger,
-    pins: buildPins(deps, hooks, { ledger, view, machineStores, machineDeps }),
+    pins,
     queue,
+    burnHold: new BurnHold({ queue, ledger, view, pins, burnJournal: machineStores.burnJournal, track: hooks.track }),
     historyStore,
     machineStores,
     machineDeps,
     machine: new TransferMachine(machineDeps),
     heldStates,
-    receiveLoop: buildReceive(deps, hooks, historyStore, heldStates, refreshView),
+    receiveLoop: buildReceive(deps, hooks, { historyStore, heldStates, verdicts }, refreshView),
     requests: buildRequests(deps, hooks),
     restoreDeps: buildRestoreDeps(deps, machineDeps, machineStores, view)
   };
 }
+function buildView(deps, hooks, ledger, verdicts) {
+  const view = new InventoryView({
+    port: deps.storagePort,
+    kv: deps.kv,
+    trust: verdicts,
+    emit: (event) => {
+      deps.emit(event, {});
+      hooks.track(verdicts.review(view.claimHolders()));
+    },
+    // #737: a reserved token is unselectable, so it is never confirmed balance.
+    // #738: while the held-set is unproven, EVERY token reads pinned — the report
+    // must not call a token spendable that the queue is about to refuse to spend.
+    isPinned: (tokenId) => ledger.unprovenReason() !== null || ledger.holderOf(tokenId) !== void 0,
+    ...deps.now !== void 0 ? { now: deps.now } : {}
+  });
+  return view;
+}
+function buildVerdicts(deps, hooks) {
+  return new TokenVerdicts({
+    kv: deps.kv,
+    claims: deps.claims ?? new CoinClaims(),
+    engine: () => hooks.engine(),
+    getBlobs: (tokenIds) => deps.storagePort.getBlobs(tokenIds),
+    changed: () => deps.emit("inventory:updated", {}),
+    ...deps.now !== void 0 ? { now: deps.now } : {}
+  });
+}
 function buildPins(deps, hooks, parts) {
   return new IntentPins({
     ledger: parts.ledger,
@@ -14916,8 +15512,9 @@ function buildRestoreDeps(deps, machineDeps, machineStores, view) {
     }
   };
 }
-function buildMachineDeps(deps, hooks, historyStore) {
+function buildMachineDeps(deps, hooks, historyStore, verdicts) {
   return {
+    recordSplit: (sourceTokenId, outputTokenId) => verdicts.recordSplit(sourceTokenId, outputTokenId),
     engine: () => hooks.engine(),
     storage: deps.storagePort,
     delivery: deps.deliveryPort,
@@ -14950,10 +15547,13 @@ function buildMachineDeps(deps, hooks, historyStore) {
     }
   };
 }
-function buildReceive(deps, hooks, historyStore, heldStates, refreshView) {
+function buildReceive(deps, hooks, parts, refreshView) {
+  const { historyStore, heldStates, verdicts } = parts;
   return new Receive({
     delivery: deps.deliveryPort,
     engine: () => hooks.engine(),
+    claims: deps.claims ?? new CoinClaims(),
+    accepted: (token) => verdicts.accept(token),
     view: {
       heldState: (tokenId) => heldStates.get(tokenId) ?? null,
       store: async (entry) => {
@@ -15003,40 +15603,6 @@ function buildRequests(deps, hooks) {
   });
 }
 
-// modules/payments-v2/machine/payload.ts
-function buildPayload(recipientPubkey, request, spend, spentStates) {
-  return {
-    v: 2,
-    kind: "coin",
-    recipient: recipientPubkey,
-    coinId: request.coinId,
-    amount: request.amount,
-    ...request.memo !== void 0 ? { memo: request.memo } : {},
-    direct: [...spend.plan.direct],
-    ...spend.plan.split !== void 0 ? {
-      split: {
-        tokenId: spend.plan.split.tokenId,
-        splitAmount: spend.plan.split.splitAmount.toString(),
-        remainderAmount: spend.plan.split.remainderAmount.toString()
-      }
-    } : {},
-    spentStates
-  };
-}
-function messageOf(err) {
-  return err instanceof Error ? err.message : String(err);
-}
-function buildWholePayload(recipientPubkey, request, spentStates) {
-  return {
-    v: 2,
-    kind: "whole",
-    recipient: recipientPubkey,
-    ...request.memo !== void 0 ? { memo: request.memo } : {},
-    direct: [request.tokenId],
-    spentStates
-  };
-}
-
 // modules/payments-v2/mint-params.ts
 function mintParams(recipientPubkey, coinId, amount) {
   return { recipientPubkey, value: { assets: [{ coinId, amount }] } };
@@ -15106,6 +15672,16 @@ async function tokenInServerInventory(storagePort, tokenId) {
   }
   return false;
 }
+async function seedHeldStates(storagePort, heldStates) {
+  let page = await storagePort.listInventory();
+  for (let i = 0; i < INVENTORY_SCAN_PAGE_LIMIT; i++) {
+    for (const item of page.items) {
+      if (item.status === "active") heldStates.set(item.tokenId, item.stateHash);
+    }
+    if (!page.more) return;
+    page = await storagePort.listInventory(page.cursor);
+  }
+}
 async function replayCoinMints(deps) {
   let resolved = 0;
   for (const entry of await deps.mintJournal.list()) {
@@ -15210,7 +15786,8 @@ async function mintJournaled(deps, entry) {
 }
 
 // modules/payments-v2/mint-custom.ts
-var HEX32 = /^[0-9a-f]{64}$/;
+var HEX322 = /^[0-9a-f]{64}$/;
+var CUSTOM_MINT_MAX_PAYLOAD_BYTES = 1024 * 1024;
 function assertRequest(request) {
   if (request.tokenType.length !== 32) {
     throw new SphereError("mintCustom: tokenType must be 32 bytes", "VALIDATION_ERROR");
@@ -15221,19 +15798,27 @@ function assertRequest(request) {
   if (request.data.length === 0) {
     throw new SphereError("mintCustom: data must not be empty", "VALIDATION_ERROR");
   }
+  if (request.justification !== void 0 && request.justification.length === 0) {
+    throw new SphereError("mintCustom: justification must be omitted, not empty", "VALIDATION_ERROR");
+  }
+  if (request.data.length + (request.justification?.length ?? 0) > CUSTOM_MINT_MAX_PAYLOAD_BYTES) {
+    throw new SphereError(`mintCustom: data and justification exceed ${CUSTOM_MINT_MAX_PAYLOAD_BYTES} bytes`, "VALIDATION_ERROR");
+  }
   for (const asset of request.assets) {
-    if (!HEX32.test(asset.coinId) || asset.amount <= 0n) {
+    if (!HEX322.test(asset.coinId) || asset.amount <= 0n) {
       throw new SphereError("mintCustom: assets need a 64-hex coinId and a positive amount", "VALIDATION_ERROR");
     }
   }
 }
 async function runCustomMintUnderJournal(deps, input) {
+  let entry;
   try {
     assertRequest(input.request);
+    entry = journalEntryOf2(input.mintId, input.request, deps.now());
+    deps.engine.assertMintable(mintParamsOf(deps, entry, input.request.mintJustificationVerifiers));
   } catch (err) {
     return { success: false, error: messageOf(err) };
   }
-  const entry = journalEntryOf2(input.mintId, input.request, deps.now());
   await deps.customMintJournal.upsert(entry);
   let tokenId;
   try {
@@ -15273,24 +15858,25 @@ function journalEntryOf2(mintId, request, createdAt) {
     createdAt
   };
 }
+function mintParamsOf(deps, entry, mintJustificationVerifiers) {
+  return {
+    recipientPubkey: deps.ownPubkeyBytes,
+    data: hexToBytes4(entry.dataHex),
+    tokenType: hexToBytes4(entry.tokenTypeHex),
+    salt: hexToBytes4(entry.saltHex),
+    ...entry.justificationHex !== null ? { justification: hexToBytes4(entry.justificationHex) } : {},
+    ...mintJustificationVerifiers ? { mintJustificationVerifiers } : {}
+  };
+}
 async function mintJournaled2(deps, entry, mintJustificationVerifiers) {
-  const token = await deps.engine.mintDataToken(
-    {
-      recipientPubkey: deps.ownPubkeyBytes,
-      data: hexToBytes4(entry.dataHex),
-      tokenType: hexToBytes4(entry.tokenTypeHex),
-      salt: hexToBytes4(entry.saltHex),
-      ...entry.justificationHex !== null ? { justification: hexToBytes4(entry.justificationHex) } : {},
-      ...mintJustificationVerifiers ? { mintJustificationVerifiers } : {}
-    },
-    { transferId: entry.mintId }
-  );
+  const token = await deps.engine.mintDataToken(mintParamsOf(deps, entry, mintJustificationVerifiers), { transferId: entry.mintId });
   if (entry.tokenId !== "" && token.blob.tokenId !== entry.tokenId) {
     throw new SphereError(`minted token ${token.blob.tokenId}, but the journal names ${entry.tokenId}`, "VALIDATION_ERROR");
   }
   if (entry.tokenId === "") {
     await deps.customMintJournal.upsert({ ...entry, tokenId: token.blob.tokenId });
   }
+  if (mintJustificationVerifiers === void 0) await deps.accepted?.(token);
   await finalizeMint(deps, {
     mintId: entry.mintId,
     token,
@@ -15300,108 +15886,6 @@ async function mintJournaled2(deps, entry, mintJustificationVerifiers) {
   return token.blob.tokenId;
 }
 
-// modules/payments-v2/burn.ts
-var HEX322 = /^[0-9a-f]{64}$/;
-async function heldToken2(deps, tokenId) {
-  const bytes = (await deps.storagePort.getBlobs([tokenId])).get(tokenId);
-  if (bytes === void 0) {
-    throw new SphereError(`Token ${tokenId} has no blob in storage; it is not held here`, "STORAGE_ERROR");
-  }
-  return deps.engine.decodeToken({ tokenId, token: bytes });
-}
-function assetsOf(token) {
-  return (token.value?.assets ?? []).map((a) => ({ coinId: a.coinId, amount: a.amount.toString() }));
-}
-async function runBurnUnderJournal(deps, input) {
-  const { burnId } = input;
-  const { tokenId, reasonBytes } = input.request;
-  if (!HEX322.test(tokenId) || reasonBytes.length === 0) {
-    return { success: false, burnId, tokenId, error: "burn: tokenId must be 64 hex and reasonBytes non-empty" };
-  }
-  let token;
-  try {
-    token = await heldToken2(deps, tokenId);
-    if (!deps.engine.isOwnedBy(token, deps.engine.getIdentity().chainPubkey)) {
-      throw new SphereError(`Token ${tokenId} is not owned by this wallet`, "VALIDATION_ERROR");
-    }
-  } catch (err) {
-    return { success: false, burnId, tokenId, error: messageOf(err) };
-  }
-  const entry = {
-    burnId,
-    tokenId,
-    reasonHex: bytesToHex3(reasonBytes),
-    burnedTokenHex: null,
-    settled: false,
-    assets: assetsOf(token),
-    createdAt: deps.now()
-  };
-  await deps.burnJournal.upsert(entry);
-  try {
-    const settled = await burnJournaled(deps, entry, token, { applied: false });
-    return { success: true, burnId, tokenId, burnedToken: hexToBytes4(settled.burnedTokenHex ?? "") };
-  } catch (err) {
-    deps.armHeartbeat();
-    return { success: false, burnId, tokenId, error: messageOf(err) };
-  }
-}
-async function replayBurns(deps) {
-  let progressed = 0;
-  for (const entry of await deps.burnJournal.list()) {
-    if (entry.settled || deps.isActiveOp(entry.burnId)) continue;
-    try {
-      const token = entry.burnedTokenHex === null ? await heldToken2(deps, entry.tokenId) : null;
-      const applied = entry.burnedTokenHex !== null && !await deps.tokenInServerInventory(entry.tokenId);
-      await burnJournaled(deps, entry, token, { applied });
-      progressed += 1;
-    } catch {
-      continue;
-    }
-  }
-  return progressed;
-}
-async function pendingBurns(deps) {
-  return (await deps.burnJournal.list()).map((entry) => ({
-    burnId: entry.burnId,
-    tokenId: entry.tokenId,
-    reasonBytes: hexToBytes4(entry.reasonHex),
-    burnedToken: entry.burnedTokenHex === null ? null : hexToBytes4(entry.burnedTokenHex),
-    settled: entry.settled,
-    createdAt: entry.createdAt
-  }));
-}
-async function acknowledgeBurn(deps, burnId) {
-  const entry = await deps.burnJournal.getByKey(burnId);
-  if (entry === void 0) return;
-  if (!entry.settled) {
-    throw new SphereError(`Burn ${burnId} is not settled yet; it cannot be acknowledged`, "VALIDATION_ERROR");
-  }
-  await deps.burnJournal.removeByKey(burnId);
-}
-async function burnJournaled(deps, entry, token, state) {
-  let current = entry;
-  if (current.burnedTokenHex === null) {
-    if (token === null) throw new SphereError("burn replay needs the held token to certify", "VALIDATION_ERROR");
-    const burned = await deps.engine.burn(
-      { token, reasonBytes: hexToBytes4(current.reasonHex) },
-      { transferId: current.burnId }
-    );
-    if (burned.blob.tokenId !== current.tokenId) {
-      throw new SphereError(`burned token ${burned.blob.tokenId}, but the journal names ${current.tokenId}`, "VALIDATION_ERROR");
-    }
-    current = { ...current, burnedTokenHex: bytesToHex3(burned.blob.token) };
-    await deps.burnJournal.upsert(current);
-  }
-  if (!state.applied) {
-    await deps.storagePort.applyDelta({ transferId: current.burnId, spent: [current.tokenId], added: [] });
-  }
-  await deps.recordSent({ transferId: current.burnId, assets: current.assets, tokenId: current.tokenId });
-  current = { ...current, settled: true };
-  await deps.burnJournal.upsert(current);
-  deps.refreshView();
-  return current;
-}
-
 // modules/payments-v2/send-whole.ts
 async function materializeWholeSpend(deps, input) {
   const { engine } = deps;
@@ -15597,6 +16081,7 @@ var PaymentsFacade = class {
       track: (op) => this.trackTail(op)
     });
     this.view = parts.view;
+    this.verdicts = parts.verdicts;
     this.wakeRefresh = parts.refreshView;
     this.ledger = parts.ledger;
     this.queue = parts.queue;
@@ -15610,6 +16095,7 @@ var PaymentsFacade = class {
     this.restoreDeps = parts.restoreDeps;
     this.requests = parts.requests;
     this.pins = parts.pins;
+    this.burnHold = parts.burnHold;
     deps.deliveryPort.bindDeliveryKeys((blob) => this.engine().deliveryKeys(blob));
     this.heartbeat = new ConvergenceHeartbeat({
       now: () => this.nowMs(),
@@ -15633,6 +16119,7 @@ var PaymentsFacade = class {
   wakeRefresh;
   prewarmed = new PrewarmCache();
   view;
+  verdicts;
   ledger;
   queue;
   machine;
@@ -15659,6 +16146,7 @@ var PaymentsFacade = class {
   activeMoneyOps = /* @__PURE__ */ new Set();
   /** #737: the ledger holds exactly the sources of the still-open intents. */
   pins;
+  burnHold;
   /** Per facade, so per address: an NFT reading is never served to another wallet. */
   nftCache = new NftCache();
   // ── lifecycle ──────────────────────────────────────────────────────────────
@@ -15683,7 +16171,8 @@ var PaymentsFacade = class {
     await this.deps.session.start();
     await this.pins.sync().catch(() => void 0);
     this.trackTail(this.runConvergencePass());
-    this.trackTail(this.seedHeldStates());
+    this.trackTail(seedHeldStates(this.deps.storagePort, this.heldStates));
+    await this.verdicts.start().catch(() => void 0);
     await this.view.fullPull().catch(() => void 0);
     this.receiveLoop.start(this.deps.receivePollMs);
   }
@@ -15692,6 +16181,7 @@ var PaymentsFacade = class {
     this.started = false;
     this.heartbeat.stop();
     this.receiveLoop.stop();
+    this.verdicts.stop();
     for (const unsubscribe of this.unsubscribers) unsubscribe();
     this.unsubscribers = [];
     await this.deps.session.stop();
@@ -15708,12 +16198,17 @@ var PaymentsFacade = class {
   }
   // ── reads ──────────────────────────────────────────────────────────────────
   async assets(coinId) {
+    return (await this.heldAssets(coinId)).filter((asset) => asset.unverified === void 0);
+  }
+  unverifiedAssets = async (coinId) => (await this.heldAssets(coinId)).filter((a) => a.unverified !== void 0);
+  async heldAssets(coinId) {
     const all = await this.view.assets(this.deps.registry, this.deps.price);
     return coinId === void 0 ? all : all.filter((asset) => asset.coinId === coinId);
   }
   tokens(filter) {
-    return this.view.tokens(this.deps.registry, filter);
+    return this.view.tokens(this.deps.registry, filter).filter((token) => token.unverified === void 0);
   }
+  unverifiedTokens = (filter) => this.view.tokens(this.deps.registry, filter).filter((t) => t.unverified !== void 0);
   coinless() {
     return this.view.coinless(this.deps.registry);
   }
@@ -15774,9 +16269,9 @@ var PaymentsFacade = class {
     return this.track(this.ownedOp((mintId) => runNftMintUnderJournal(this.mintDeps(), { mintId, request })));
   }
   mintCustom = (request) => this.track(this.ownedOp((mintId) => runCustomMintUnderJournal(this.mintDeps(), { mintId, request })));
-  burn = (request) => this.track(this.ownedOp((burnId) => runBurnUnderJournal(this.mintDeps(), { burnId, request })));
-  pendingBurns = () => this.track(pendingBurns(this.mintDeps()));
-  acknowledgeBurn = (burnId) => this.track(acknowledgeBurn(this.mintDeps(), burnId));
+  burn = (request) => this.track(this.ownedOp((burnId) => this.burnHold.run(burnId, request.tokenId, () => runBurnUnderJournal(this.mintDeps(), { burnId, request }))));
+  pendingBurns = () => this.track(pendingBurns(this.machineStores));
+  acknowledgeBurn = (burnId) => this.track(acknowledgeBurn(this.machineStores, burnId));
   // §4 retry verb: coalesces onto the running pass — NEVER re-issue send() (#631/#676).
   async resumeNow() {
     if (!this.started) return;
@@ -15819,7 +16314,8 @@ var PaymentsFacade = class {
       isActiveOp: (mintId) => this.activeMoneyOps.has(mintId),
       tokenInServerInventory: (tokenId) => tokenInServerInventory(this.deps.storagePort, tokenId),
       emit: this.deps.emit,
-      now: () => this.nowMs()
+      now: () => this.nowMs(),
+      accepted: (token) => this.verdicts.accept(token)
     };
   }
   // ── send policy (§5.5 + old-loop parity; the machine stays policy-free) ────
@@ -16157,16 +16653,6 @@ var PaymentsFacade = class {
   newId() {
     return (this.deps.newId ?? randomUUID)();
   }
-  async seedHeldStates() {
-    let page = await this.deps.storagePort.listInventory();
-    for (let i = 0; i < INVENTORY_SCAN_PAGE_LIMIT; i++) {
-      for (const item of page.items) {
-        if (item.status === "active") this.heldStates.set(item.tokenId, item.stateHash);
-      }
-      if (!page.more) return;
-      page = await this.deps.storagePort.listInventory(page.cursor);
-    }
-  }
   track(op) {
     const settled = op.then(() => void 0, () => void 0);
     this.pendingOps.add(settled);
@@ -17410,6 +17896,7 @@ function composePaymentsV2(spec) {
     engineRef: spec.engineRef,
     kv,
     registry: host.registry,
+    claims: CoinClaims.fromPlugins(spec.plugins),
     ...host.price !== null ? { price: host.price } : {},
     emit: host.emit,
     resolveRecipient: (identifier) => resolveRecipientInfo(identifier, network, host.resolvePeer),
@@ -20458,7 +20945,8 @@ var Sphere = class _Sphere {
         // deliver the NEXT address's Unicity ID — a name the sending key does
         // not own (sphere#487 review).
         nametag: () => this.getNametagForAddress(facadeAddressId)
-      }
+      },
+      ...this._plugins ? { plugins: this._plugins } : {}
     });
     this._paymentsV2Active = { index, facade };
     await facade.start();