@xgamesfun/solana 0.20.1 → 0.24.0

package/js/economy/check.mjs

@@ -6,8 +6,9 @@
 // lottery's pot, a pool nothing fills, a recipe too big to send, a prize its pool cannot pay.
 import IDL from '../client/idl/loot.js';
 import { gateList } from '../client/grant.js';
-import { MAX_RECEIPT_ROUNDS } from '../client/sizes.js';
+import { MAX_BID_NFTS, MAX_SHARES } from '../client/ix.js';
 import { vault } from '../client/pda.js';
+import { boxBytes, buyFits, drawsFit, MAX_ORDER_BYTES, tableBudget } from '../client/sizes.js';
 import { TOKEN_2022_PROGRAM, TOKEN_PROGRAM } from '../chain/pda.js';
 import { addressBytes, encodeBase58 } from '../chain/base58.js';
 import { isOnCurve } from '../chain/curve.js';
@@ -26,10 +27,12 @@ import {
   model,
   placeOf,
   poolFillers,
-  outcomeBurns,
+  farmFillers,
   outcomeParts,
   boxBuys,
   boxRolls,
+  drawsOf,
+  lifeLines,
   prizeLine,
   prizePool,
   prizeToken,
@@ -49,38 +52,54 @@ import {
   toUnits,
   utf8Bytes,
   wholeCount,
+  weights,
 } from './model.mjs';
 // plan.mjs imports check() in turn: each module only calls the other's functions, never at load time.
-import { placeholderContext, setupSteps, stepBytes } from './plan.mjs';
+import { boxArgs, boxOrderBytes, placeholderContext, recipeArgs, setupSteps, stepBytes } from './plan.mjs';
 import { findSecrets } from './secrets.mjs';
 import { simulate } from './simulate.mjs';
 import { BUDGET, MAX_TRANSACTION_BYTES, transactionLocks, transactionSize, WALLET_ROOM } from './txsize.mjs';
 import { validate } from './validate.mjs';
 
+/** The most a u64 holds. */
+const U64_MAX = 2n ** 64n - 1n;
+
 /** A transaction's estimated bytes, or with `detail` { bytes, locks }. */
 const measured = (input, detail) => (detail ? { bytes: transactionSize(input), locks: transactionLocks(input) } : transactionSize(input));
 
 const label = (part) => `“${part?.name ?? part?.key}”`;
-const isCollectible = (it) => (it?.kind ?? 'collectible') === 'collectible';
 
-// ---------------------------------------------------------------- a player's craft, in bytes
+/** Every place a spec gives a share of a pool as a prize, as a path ("economy.boxes[0].outcomes[1]"): the program has none. */
+function sharePrizes(value, path = 'economy', found = []) {
+  if (Array.isArray(value)) value.forEach((v, i) => sharePrizes(v, `${path}[${i}]`, found));
+  else if (value && typeof value === 'object') {
+    if (value.gives === 'share') found.push(path);
+    for (const [k, v] of Object.entries(value)) if (k !== 'live') sharePrizes(v, `${path}.${k}`, found);
+  }
+  return found;
+}
 
 /**
- * The accounts a route the player pays or asks for (a craft, a buy, a grant's claim) passes after a roll's box and
- * order (`order::askable`, the client's `rollMints`): for each token prize of box `key`, in order, its pool and the
- * pool's mint, or the mint it mints from. Up to 10 distinct accounts a box.
+ * Two prizes of one box outcome that want the same thing from one source (prize.rs `wants_same`): the words for them,
+ * or null. An outcome gives all it names or isn't given, so it names a pool once with the whole amount, a stash's
+ * random NFT beside nothing else of that stash, and a named NFT once. An item may repeat: two of it is how it gives two.
  */
-export function rollMintKeys(key, m) {
-  return (m.box.get(key)?.outcomes ?? []).flatMap(outcomeParts).flatMap((o) => {
-    if (o.gives === 'mint') return [`mint:${o.currency ?? m.currencyKey}`];
-    if (o.gives === 'pay' || o.gives === 'share') return [`pda:pool/${o.pool}`, `mint:${m.pool.get(o.pool)?.currency ?? m.currencyKey}`];
-    return [];
-  });
+function samePrizes(x, y) {
+  if (x.gives === 'pay' && y.gives === 'pay' && x.pool === y.pool) return `pays from the pool “${x.pool}” twice`;
+  if (x.gives === 'stash' && y.gives === 'stash' && x.stash === y.stash) return `gives two random NFTs of the stash “${x.stash}”`;
+  if ((x.gives === 'stash' && y.gives === 'nft' && x.stash === y.stash) || (x.gives === 'nft' && y.gives === 'stash' && x.stash === y.stash)) return `gives a random NFT of the stash “${x.stash}” beside a named one of it`;
+  if (x.gives === 'nft' && y.gives === 'nft' && x.stash === y.stash && x.nft === y.nft) return `names the NFT ${x.nft} twice`;
+  return null;
 }
+/** The bytes of a loot instruction's tag: 1, or 8 for the oracle's callbacks. */
+const tagBytes = (name) => IDL.instructions.find((i) => i.name === name).discriminator.length;
+const isCollectible = (it) => (it?.kind ?? 'collectible') === 'collectible';
+
+// ---------------------------------------------------------------- a player's craft, in bytes
 
 /**
  * The transaction a player sends to craft `recipe`, estimated (txsize.mjs): the craft's own accounts, then each
- * line's (craft.rs; a roll's with its box's prize mints, `rollMintKeys`), a compute limit (a big recipe needs more
+ * line's (craft.rs; a roll's box and order), a compute limit (a big recipe needs more
  * than the default) and, for each token it gives, the player's token account created if missing.
  */
 export function craftSize(recipe, m, { detail = false } = {}) {
@@ -117,17 +136,17 @@ export function craftSize(recipe, m, { detail = false } = {}) {
     if (line.gives === 'item' && line.compressed) rest.push(`pda:item/${line.item}`, 'pda:tree-config', 'account:tree', `${collectionOf(line.item)}`, 'program:bubblegum', 'program:compression', 'program:noop', 'program:core', 'account:bubblegum-signer');
     else if (line.gives === 'item') rest.push(`pda:item/${line.item}`, ...(m.item.get(line.item)?.kind === 'normal' ? [] : [`${collectionOf(line.item)}`, `pda:asset/${line.item}/${i}`, 'program:core']));
     else if (line.gives === 'nft') rest.push(`pda:stash/${line.stash}`, ...Array.from({ length: PIECE_SLOTS }, (_, k) => (k === 0 ? `asset:nft/${i}` : k < 3 ? `nft/${i}/${k}` : 'program:loot')));
-    // A roll (given, or on a kept collectible): the box, the order, then the box's prize mints (`rollMintKeys`).
-    else if (line.gives === 'roll') rest.push(`pda:box/${line.box}`, `pda:order/${i}`, ...rollMintKeys(line.box, m));
+    // A roll (given, or on a kept collectible): the box and the order (its roll is asked for after, `ask_roll`).
+    else if (line.gives === 'roll') rest.push(`pda:box/${line.box}`, `pda:order/${i}`);
     else {
-      const currency = line.gives === 'share' ? m.pool.get(line.pool)?.currency : line.from?.startsWith('pool:') ? m.pool.get(line.from.slice(5))?.currency : line.currency ?? m.currencyKey;
-      const pool = line.gives === 'share' ? line.pool : line.from?.startsWith('pool:') ? line.from.slice(5) : null;
+      const currency = line.from?.startsWith('pool:') ? m.pool.get(line.from.slice(5))?.currency : line.currency ?? m.currencyKey;
+      const pool = line.from?.startsWith('pool:') ? line.from.slice(5) : null;
       rest.push(mintOf(currency), ...(pool ? [`pda:pool/${pool}`] : []), `ata:player/${currency}`);
       gives.add(currency);
     }
   });
   for (const currency of gives) extra.push({ program: 'associated-token', accounts: ['wallet:player', `ata:player/${currency}`, 'wallet:player', mintOf(currency), 'program:system', 'program:token'], data: 1 });
-  return measured({ signers, instructions: [...extra, { program: 'loot', accounts: [...fixed, ...rest], data: 8 + 4 + 8 }] }, detail);
+  return measured({ signers, instructions: [...extra, { program: 'loot', accounts: [...fixed, ...rest], data: tagBytes('craft') + 4 + 8 + 8 }] }, detail);
 }
 
 // ---------------------------------------------------------------- a player's purchase of a box, in bytes
@@ -149,8 +168,6 @@ export function openBoxSize(b, m, { detail = false } = {}) {
   const vault = (key) => `vault:${key}`;
   const none = 'program:loot';
   const outcomes = b.outcomes ?? [];
-  // A stash's NFT is picked at random: a box of one stash outcome is rolled too.
-  const rolls = boxRolls(b);
   const limited = Boolean(b.perWallet || b.perWalletEach?.count);
   const chosenItem = (b.split ?? []).some((s) => /^chosen:./.test(String(s.to)));
   // The NFT it rolls on fills the `piece` slots: a Core collectible of the game's, else at its largest a pNFT's
@@ -166,16 +183,17 @@ export function openBoxSize(b, m, { detail = false } = {}) {
     'wallet:player', 'pda:project', 'pda:platform', 'pda:order', mint(currency), `ata:player/${currency}`, vault(currency),
     'program:token', 'program:token-2022', 'program:system', 'program:associated-token',
     ...piece, ...Array.from({ length: PIECE_SLOTS - piece.length }, () => none),
-    ...(rolls ? ['vrf:queue', 'pda:identity', 'program:vrf', 'sysvar:slot-hashes'] : [none, none, none, none]),
+    // Every open asks the oracle.
+    'vrf:queue', 'pda:identity', 'program:vrf', 'sysvar:slot-hashes',
     chosenItem ? 'asset:chosen' : none,
-    limited ? `pda:receipt/${b.key}` : none,
+    limited ? 'pda:counts/player' : none,
   ];
   const rest = [];
   const prizeMints = [];
   for (const o of outcomes.flatMap(outcomeParts)) {
     if (o.gives === 'item') rest.push(`pda:item/${o.item}`);
     if (o.gives === 'stash' || o.gives === 'nft') rest.push(`pda:stash/${o.stash}`);
-    if (o.gives === 'pay' || o.gives === 'share' || o.gives === 'mint') {
+    if (o.gives === 'pay' || o.gives === 'mint') {
       if (o.gives !== 'mint') rest.push(`pda:pool/${o.pool}`);
       const c = o.gives === 'mint' ? o.currency ?? m.currencyKey : m.pool.get(o.pool)?.currency;
       if (c && !prizeMints.includes(c)) prizeMints.push(c);
@@ -191,7 +209,7 @@ export function openBoxSize(b, m, { detail = false } = {}) {
     ? [{ program: 'system', accounts: ['wallet:player', ata], data: 12 }, { program: 'token', accounts: [ata], data: 1 }]
     : [];
   const unwrap = wrap.length ? [{ program: 'token', accounts: [ata, 'wallet:player', 'wallet:player'], data: 1 }] : [];
-  const data = 8 + 8 + 8 + (chosenItem || (b.split ?? []).some((s) => s.to === 'chosen') ? 33 : 1) + 4;
+  const data = tagBytes('open_box') + 8 + 8 + (chosenItem || (b.split ?? []).some((s) => s.to === 'chosen') ? 33 : 1) + 4 + 4;
   return measured({ signers: ['wallet:player'], instructions: [...wallet, create, ...wrap, { program: 'loot', accounts: [...own, ...rest], data }, ...unwrap] }, detail);
 }
 
@@ -242,7 +260,7 @@ export function settleAccounts(b, o, m, { proof = LONGEST_PROOF } = {}) {
   let picks = 0;
   let corePicks = 0;
   for (const [i, x] of outcomeParts(o).entries()) {
-    if (x.gives === 'pay' || x.gives === 'share' || x.gives === 'mint') {
+    if (x.gives === 'pay' || x.gives === 'mint') {
       const c = x.gives === 'mint' ? x.currency ?? m.currencyKey : m.pool.get(x.pool)?.currency;
       add(`mint:${c}`, `vault:${c}`, `ata:player/${c}`);
     } else if (x.gives === 'item') {
@@ -303,7 +321,7 @@ export function settleUnits(b, o, m) {
   let units = 60_000;
   if (b.rollsOn) units += b.rollsOn.collection ? 100_000 : 60_000;
   for (const x of outcomeParts(o)) {
-    if (x.gives === 'pay' || x.gives === 'share' || x.gives === 'mint') units += 30_000 * hooked(x.gives === 'mint' ? x.currency ?? m.currencyKey : m.pool.get(x.pool)?.currency);
+    if (x.gives === 'pay' || x.gives === 'mint') units += 30_000 * hooked(x.gives === 'mint' ? x.currency ?? m.currencyKey : m.pool.get(x.pool)?.currency);
     else if (x.gives === 'item') units += isCollectible(m.item.get(x.item)) ? 40_000 : 0;
     else if (x.gives === 'roll') units += 20_000;
     else if (x.gives === 'stash' || x.gives === 'nft') {
@@ -326,16 +344,17 @@ export function settleSize(b, o, m) {
   const { keys, count, memo, compressedSubject } = settleAccounts(b, o, m);
   const parts = outcomeParts(o);
   const moves = parts.filter((x) => x.gives === 'stash' || x.gives === 'nft').length + (b.rollsOn ? 1 : 0);
-  // The settle's account list, with each slot it leaves empty (`settleIx`): its own 37, the proof of a compressed NFT
+  // The settle's account list, with each slot it leaves empty (`settleIx`): its own 38, the proof of a compressed NFT
   // it rolls on, each prize's (tokens 3, a collectible 4, a normal item 1, a roll 2, an NFT the 23 of a piece and a
   // compressed one's proof), each share's (a holder's 3, a wallet's 2, a pool's or an account's 1), a hook's and a memo.
   const compressedPick = (x) => (m.stash.get(x.stash) ? stashNfts(m.stash.get(x.stash)) : []).filter((n) => x.gives !== 'nft' || n.asset === x.nft).some((n) => n.kind === 'compressed');
   const won = parts.reduce((n, x) => n + ({ pay: 3, share: 3, mint: 3, item: isCollectible(m.item.get(x.item)) ? 4 : 1, roll: 2, stash: PIECE_SLOTS, nft: PIECE_SLOTS }[x.gives] ?? 0) + ((x.gives === 'stash' || x.gives === 'nft') && compressedPick(x) ? LONGEST_PROOF : 0), 0);
   const split = sharesOf(b.split).reduce((n, x) => n + ({ holder: 3, chosen: 3, wallet: 2, pool: 1, account: 1, lottery: 1 }[x.kind] ?? 0), 0);
   const hooks = keys.filter((k) => k.startsWith('hook:') || k === 'program:hook').length;
-  const entries = 37 + (compressedSubject ? LONGEST_PROOF : 0) + won + split + hooks + (memo ? 1 : 0);
+  const entries = 38 + (compressedSubject ? LONGEST_PROOF : 0) + won + split + hooks + (memo ? 1 : 0);
   const named = keys.filter((k) => k !== 'program:compute-budget' && k !== 'program:loot');
-  const settle = { program: 'loot', accounts: [...named, ...Array.from({ length: Math.max(0, entries - named.length) }, () => 'program:loot')], data: 8 };
+  // Its data: the tag, `upto` and `prize_accounts`.
+  const settle = { program: 'loot', accounts: [...named, ...Array.from({ length: Math.max(0, entries - named.length) }, () => 'program:loot')], data: tagBytes('settle') + 4 + 2 };
   const budget = [{ program: 'compute-budget', accounts: [], data: 5 }, ...(moves >= 3 ? [{ program: 'compute-budget', accounts: [], data: 5 }] : [])];
   // A table holds every account but the signer and the programs the transaction calls.
   const held = keys.filter((k) => !['wallet:signer', 'program:compute-budget', 'program:loot'].includes(k)).length;
@@ -350,10 +369,10 @@ const showsNft = (gate) => Boolean(gate && !gate.wallets && !gate.list && !gate.
 /**
  * The transaction a player sends to buy box `b` (buy.rs), estimated as `openBoxSize` is: its compute limit and price,
  * the player's token account of the currency created if missing, then `buy`: its own accounts, what the gate takes
- * (a list's proof, or the NFT shown), the accounts its shares name, and each prize's (prize.rs; a roll's with its
- * box's prize mints, `rollMintKeys`).
+ * (a list's proof, or the NFT shown), the accounts its shares name, and each prize's (prize.rs; a roll's box and
+ * order), for each draw of a sale (a fixed amount of tokens once). `count`: the sales in one purchase.
  */
-export function buySize(b, m, { detail = false } = {}) {
+export function buySize(b, m, { detail = false, count = 1 } = {}) {
   const collectionOf = (key) => `collection:${m.item.get(key)?.collection ?? 'project'}`;
   const currency = b.currency ?? m.currencyKey;
   const none = 'program:loot';
@@ -361,7 +380,7 @@ export function buySize(b, m, { detail = false } = {}) {
   const chosenItem = (b.split ?? []).some((s) => /^chosen:./.test(String(s.to)));
   const own = [
     'wallet:player', 'pda:project', `pda:box/${b.key}`, `mint:${currency}`, `ata:player/${currency}`, 'wallet:treasury', `ata:treasury/${currency}`,
-    'program:token', 'program:token-2022', 'program:associated-token', chosenItem ? 'asset:chosen' : none, limited ? `pda:receipt/${b.key}` : none,
+    'program:token', 'program:token-2022', 'program:associated-token', chosenItem ? 'asset:chosen' : none, limited ? 'pda:counts/player' : none,
     'pda:platform', 'pda:fees', 'program:system',
   ];
   const rest = [...listProof(b.gate)];
@@ -372,10 +391,11 @@ export function buySize(b, m, { detail = false } = {}) {
     if (s.kind === 'wallet' || s.kind === 'treasury' || s.kind === 'chosen') rest.push(`wallet:${s.key}`, `ata:${s.key}/${currency}`);
     if (s.kind === 'holder') rest.push(`asset:${s.key}`, `wallet:holder/${s.key}`, `ata:holder/${s.key}`);
   }
-  outcomeParts(b.outcomes?.[0]).forEach((o, i) => {
+  const draws = drawsOf(b) * count;
+  outcomeParts(b.outcomes?.[0]).flatMap((o) => Array(o.gives === 'mint' || o.gives === 'pay' ? 1 : draws).fill(o)).forEach((o, i) => {
     if (o.gives === 'item') rest.push(`pda:item/${o.item}`, ...(m.item.get(o.item)?.kind === 'normal' ? [] : [collectionOf(o.item), `pda:asset/${o.item}/${i}`, 'program:mpl-core']));
     else if (o.gives === 'nft') rest.push(`pda:stash/${o.stash}`, ...Array.from({ length: PIECE_SLOTS }, (_, k) => (k === 0 ? `asset:nft/${i}` : k < 3 ? `nft/${i}/${k}` : none)));
-    else if (o.gives === 'roll') rest.push(`pda:box/${o.box}`, `pda:order/${i}`, ...rollMintKeys(o.box, m));
+    else if (o.gives === 'roll') rest.push(`pda:box/${o.box}`, `pda:order/${i}`);
     else {
       const c = o.gives === 'mint' ? o.currency ?? m.currencyKey : m.pool.get(o.pool)?.currency;
       rest.push(`mint:${c}`, ...(o.gives === 'mint' ? [] : [`pda:pool/${o.pool}`]), `ata:player/${c}`);
@@ -384,7 +404,7 @@ export function buySize(b, m, { detail = false } = {}) {
   const ata = `ata:player/${currency}`;
   const wallet = [{ program: 'compute-budget', accounts: [], data: 5 }, { program: 'compute-budget', accounts: [], data: 9 }];
   const create = { program: 'associated-token', accounts: ['wallet:player', ata, 'wallet:player', `mint:${currency}`, 'program:system', 'program:token'], data: 1 };
-  const data = 8 + 8 + (chosenItem || (b.split ?? []).some((s) => s.to === 'chosen') ? 33 : 1) + 4 + 8;
+  const data = tagBytes('buy') + 8 + (chosenItem || (b.split ?? []).some((s) => s.to === 'chosen') ? 33 : 1) + 4 + 8 + 4;
   return measured({ signers: ['wallet:player'], instructions: [...wallet, create, { program: 'loot', accounts: [...own, ...rest], data }] }, detail);
 }
 
@@ -399,6 +419,8 @@ const MAX_CONTEST_SECONDS = Number(IDL.constants.find((c) => c.name === 'MAX_CON
 /** A sealed schedule's last run comes within this of going live (schedule.rs). */
 const MAX_SCHEDULE_SECONDS = Number(IDL.constants.find((c) => c.name === 'MAX_SCHEDULE_SECONDS')?.value ?? 315_360_000);
 /** The most runs a sealed schedule makes (schedule.rs). */
+/** The most places a run of a lottery's places given one by one holds (lottery.rs). */
+const MAX_RUN_PLACES = Number(IDL.constants.find((c) => c.name === 'MAX_RUN_PLACES')?.value ?? 4_096);
 const MAX_SEALED_RUNS = Number(IDL.constants.find((c) => c.name === 'MAX_SEALED_RUNS')?.value ?? 10_000);
 
 /**
@@ -420,8 +442,20 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
     refuse('E-NETWORK', 'economy.network', `The economy names the network “${economy?.network ?? network}”. loot runs on devnet only: mainnet waits for an audit.`, 'Set the network to "devnet".');
   const oldVersion = economy?.version === 1;
   if (oldVersion) refuse('E-VERSION', 'economy.version', 'Only the current version 2 economy format is supported.', 'Write the economy using the current schema.');
+  // A roll no longer burns the payment for one outcome (loot 0.23): said in words, not again by the schema.
+  const burnsGone = new Set();
+  (Array.isArray(economy?.boxes) ? economy.boxes : []).forEach((b, i) => (Array.isArray(b?.outcomes) ? b.outcomes : []).forEach((o, j) => {
+    const at = `economy.boxes[${i}].outcomes[${j}]`;
+    if (o?.gives !== 'burn' && o?.burns === undefined) return;
+    burnsGone.add(o?.gives === 'burn' ? `${at}.gives` : `${at}.burns`);
+    refuse('E-ODDS', at, `An outcome of “${b?.name ?? b?.key}” burns the payment: a box's outcome no longer does (BadEntries). A box burns its price, whatever its roll gives, with a "burn" share in its split.`, o?.gives === 'burn' ? 'Make this outcome "nothing", and give the box a "burn" share in its "split".' : 'Leave "burns" out, and give the box a "burn" share in its "split".');
+  }));
+  // A share of a pool as a prize is gone (loot 0.24): said in words, not again by the schema.
+  const shares = sharePrizes(economy);
+  for (const at of shares) refuse('E-SHARE-PRIZE', at, `${at} gives a share of a pool as a prize, and the program has no such prize on any route: a prize is what its record says, a fixed amount, all of it or none (BadEntries).`, 'Give a fixed amount: in a box { "gives": "pay", "pool": "<key>", "amount": n }, anywhere else { "gives": "tokens", "from": "pool:<key>", "amount": n }. For a jackpot that grows, use a lottery: its pot is what its tickets fill, and its places take percents of it.');
+  const aboutShare = (path) => shares.some((at) => path === at || path.startsWith(`${at}.`) || at.startsWith(`${path}.`) || at.startsWith(`${path}[`));
   // An old version is said once, by E-VERSION, not again by the schema.
-  for (const e of validate(economy)) if (!(oldVersion && e.path === 'economy.version')) refuse('E-SCHEMA', e.path, `${e.path} ${e.message}.`, 'Fix that field (xsolana_guide lists what each part takes).');
+  for (const e of validate(economy)) if (!(oldVersion && e.path === 'economy.version') && !burnsGone.has(e.path) && !aboutShare(e.path)) refuse('E-SCHEMA', e.path, `${e.path} ${e.message}.`, 'Fix that field (xsolana_guide lists what each part takes).');
   if (refusals.length) return result();
 
   const m = model(economy, { now });
@@ -465,6 +499,10 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
     if (now + s > Number.MAX_SAFE_INTEGER) refuse('E-TIME', where, `${duration} from go-live is further off than the program can count.`, 'Use a shorter time.');
     return s;
   };
+  /** Refuses a list over one of the program's caps (`LIMITS`), which it would refuse when the owner signs. */
+  const tooMany = (count, most, code, where, what, error, fix) => {
+    if (count > most) refuse(code, where, `${what}; the program takes at most ${most} (${error}).`, fix);
+  };
   const percent = (value, where) => {
     if (value === undefined) return 0;
     const bps = toBps(value);
@@ -500,11 +538,6 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
       ids.add(part[field]);
     }
   }
-  // The empty pool of a farm that pays nothing keeps the number written on the farm (`rewardsIndex`): no pool may share it.
-  for (const p of m.pools.filter((x) => x.farm && Number.isInteger(x.index))) {
-    const other = m.pools.find((x) => x !== p && x.index === p.index);
-    if (other) refuse('E-KEY-DUP', `economy.farms.${p.farm}.rewardsIndex`, `The farm “${p.farm}”’s empty rewards pool and the pool “${other.key}” both have the program number ${p.index}: the second would overwrite the first.`, other.farm ? 'Remove the number from the newer one; it gets a free number when it goes live.' : `Remove the "index" from “${other.key}” if it is new; it gets a free number when it goes live.`);
-  }
   const boxIds = new Map();
   for (const b of m.allBoxes) {
     if (boxIds.has(b.id)) refuse('E-KEY-DUP', b.shopOf ? `economy.items.${b.shopOf}.shopBox` : `economy.boxes.${b.key}.id`, `The box number ${b.id} is taken twice (a box and a shop listing share the numbers).`, 'Remove one of the numbers; it gets a free one when it goes live.');
@@ -589,11 +622,14 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
    * with a compressed prize in the spec; one made before never can.
    */
   const compressedCheck = (it, at, what, code) => {
-    const never = code === 'E-GRANT' || code === 'E-RECIPE' ? 'every claim or craft would be refused' : 'its winner would get nothing';
+    // The item records whether its collection carries the plugin (`Item::compressed`): without it, a box's open is
+    // refused (SoldOut), a sale, a claim or a craft too (PrizeNotCovered), and a finishing route gives nothing.
+    const never = code === 'E-GRANT' || code === 'E-RECIPE' ? 'every claim or craft would be refused (PrizeNotCovered)' : code === 'E-ODDS' ? 'opening the box would be refused (SoldOut), and buying it (PrizeNotCovered)' : 'its winner would get nothing';
     if (!isCollectible(it)) return refuse(code, `${at}.compressed`, `${what} gives ${label(it)} compressed, but it is a normal item: only a collectible is an NFT.`, 'Make it a collectible, or leave "compressed" out.');
     if (it.soulbound) return refuse(code, `${at}.compressed`, `${what} gives ${label(it)} compressed, but it is soulbound: a compressed NFT can’t be kept from moving, so the program never gives one (${never}).`, 'Give it as a Core collectible (leave "compressed" out), or make the item tradable.');
-    const longest = (it.uri ?? '').replaceAll('{serial}', String(Number(it.supply ?? 0) || 4_294_967_295));
-    if (utf8Bytes(longest) > LIMITS.uriBytes) refuse(code, `${at}.compressed`, `${label(it)}’s link, its serial written in, is longer than Bubblegum’s ${LIMITS.uriBytes} bytes: ${never}.`, 'Use a shorter link.');
+    // Its serial at its longest, and each drawn trait's value at its longest (32 bytes) wherever its `{attribute}` is.
+    const longest = (it.drawn ?? []).reduce((uri, d) => uri.replaceAll(`{${d.attribute}}`, 'x'.repeat(32)), (it.uri ?? '').replaceAll('{serial}', String(Number(it.supply ?? 0) || 4_294_967_295)));
+    if (utf8Bytes(longest) > LIMITS.compressedUriBytes) refuse(code, `${at}.compressed`, `${label(it)}’s link, its serial written in, is longer than Bubblegum’s ${LIMITS.compressedUriBytes} bytes: ${never}.`, 'Use a shorter link.');
     if (it.collection) warn('W-COMPRESSED', `${at}.compressed`, `${label(it)} is minted into ${it.collection}: a compressed one is given only if that collection was made with Bubblegum’s plugin (BubblegumV2), which a collection can’t add later; otherwise ${never}.`, 'Use the setup’s collection, or one made with the plugin.');
     // A new setup still landing made its collection with the plugin, and opens the tree after the project.
     else if (m.live.project && !m.live.tree && !(m.live.partial && !m.live.published)) refuse(code, `${at}.compressed`, `${what} gives ${label(it)} compressed, but the project’s collection went live without Bubblegum’s plugin, which a collection can’t add later: ${never}.`, 'Give it as a Core collectible (leave "compressed" out), or mint it into another collection made with the plugin ("collection" on the item).');
@@ -605,10 +641,10 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
   const prizeCheck = (given, at, what, code) => {
     const line = prizeLine(given);
     if (!line) {
-      refuse(code, at, `${what} gives a prize this spec can’t read.`, 'Write a prize line: { "gives": "item", "item": key }, { "gives": "tokens", "amount": n, "from": "mint" or "pool:<key>" }, { "gives": "share", "pool": key, "percent": p }, { "gives": "nft", "stash": key, "nft": address } or { "gives": "roll", "box": key }.');
+      refuse(code, at, `${what} gives a prize this spec can’t read.`, 'Write a prize line: { "gives": "item", "item": key }, { "gives": "tokens", "amount": n, "from": "mint" or "pool:<key>" }, { "gives": "nft", "stash": key, "nft": address } or { "gives": "roll", "box": key }.');
       return null;
     }
-    if (line.split && (code !== 'E-CONTEST' || !['tokens', 'share'].includes(line.gives)))
+    if (line.split && (code !== 'E-CONTEST' || line.gives !== 'tokens'))
       refuse(code, `${at}.split`, `${what} splits its prize by stake: only a contest's prize of tokens can be split (BadContest).`, 'Leave "split" out.');
     if (line.gives === 'item') {
       const it = line.item ? item(line.item, `${at}.item`) : refuse(code, at, `${what} gives an item but does not say which.`, 'Add "item".');
@@ -625,10 +661,6 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
       if (minted && t && !t.gameMints) refuse('E-MINT-NOT-OURS', `${at}.currency`, `${what} mints ${t.symbol}, which the project cannot mint.`, 'Pay it from a pool ("from": "pool:<key>"), or use a token with source "project".');
       if (p && line.currency && line.currency !== p.currency) refuse('E-POOL-MINT', `${at}.from`, `${what} gives ${m.tokens.get(line.currency)?.symbol ?? line.currency} from “${p.key}”, which holds ${m.tokens.get(p.currency)?.symbol}.`, `Leave "currency" out: a pool’s prize is in what it holds.`);
       if (t && units(line.amount, t, `${at}.amount`, `What ${what} gives`) === 0n) refuse(code, `${at}.amount`, `${what} gives an amount of 0.`, 'Give it an amount above 0.');
-    } else if (line.gives === 'share') {
-      if (line.pool) pool(line.pool, `${at}.pool`);
-      else refuse(code, at, `${what} gives a share but does not say of which pool.`, 'Add "pool".');
-      if (!(percent(line.percent, `${at}.percent`) > 0)) refuse(code, `${at}.percent`, `${what} gives a share of 0%.`, 'Give it a percent above 0.');
     } else if (line.gives === 'nft' && line.held) {
       // An NFT a lottery's place holds in the lottery's own stash: a lottery's place only (prize.rs Prize::Held).
       if (code !== 'E-LOTTERY') refuse(code, `${at}.held`, `${what} gives a held NFT: only a lottery's place holds one, in its own stash (BadPrize).`, 'Put it in a stash and give it with "stash", or raffle it in a lottery.');
@@ -642,7 +674,9 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
       else if (st && !stashNfts(st).some((n) => n.asset === line.nft))
         refuse(code, `${at}.nft`, `${what} gives the NFT ${line.nft}, which ${label(st)} does not list: a prize gives only an NFT a stash of the game holds, so it would never be given.`, `List it in ${label(st)}'s "nfts", which puts it in when the economy goes live.`);
     } else if (line.gives === 'roll') prizeBox(line.box, `${at}.box`, what, code);
-    else refuse(code, `${at}.gives`, `${what} gives “${line.gives}”, which no prize is.`, 'Use "item", "tokens", "share", "nft" or "roll".');
+    else if (line.gives === 'raffled') {
+      if (code !== 'E-LOTTERY') refuse(code, `${at}.gives`, `${what} gives an NFT drawn from a lottery's own stash: only a lottery's place does (BadPrize).`, 'Give an NFT of a stash through a box\'s roll ("gives": "stash"), or raffle them in a lottery.');
+    } else refuse(code, `${at}.gives`, `${what} gives “${line.gives}”, which no prize is.`, 'Use "item", "tokens", "nft", "roll" or, in a lottery\'s place, "raffled".');
     return line;
   };
   /**
@@ -682,16 +716,23 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
     if (!r?.collection || !r.attribute || m.collections.includes(r.collection)) return;
     warn('W-RULE-OUTSIDE', where, `${what} test “${r.attribute}” of NFTs of ${r.collection}, outside the project’s collections: there it reads a Core NFT’s own attributes, never what the project wrote in its Sheet, so the test fails for an NFT that doesn’t carry “${r.attribute}” itself (every Token Metadata or compressed NFT).`, 'Test only the collection, or use Core NFTs that carry the attribute themselves.');
   };
+  /** Whether the words on a Token Metadata print were said (once a spec). */
+  let printsSaid = false;
   /** A rule on what an NFT says (rules.rs): an item of the game's must be a collectible; or a collection is named. */
   const rule = (r, where, what) => {
     if (!r) return;
+    // A print of a Token Metadata master carries its master's collection, but its master's holder makes it without the
+    // collection's authority: the program reads it as in no collection (metadata.rs).
+    if (r.collection && isAddress(r.collection) && !m.collections.includes(r.collection) && !printsSaid) {
+      printsSaid = true;
+      warn('W-RULE-PRINTS', `${where}.collection`, `${what} names the collection ${r.collection}: if it is a Token Metadata collection, a print of one of its NFTs (an edition of a master) doesn’t count, since whoever holds the master makes prints without the collection’s authority; the program reads a print as in no collection. This holds for every rule on a collection in the spec.`, 'Nothing to change: tell holders of prints that only the original NFTs count.');
+    }
     // A gate may list wallets instead (rules.rs Gate::Wallets): a duel's two players, a tournament's entrants.
     // Or a list of any size (rules.rs Gate::List): its root on chain, each player's proof passed as accounts.
     if (r.list !== undefined) {
       r.list.forEach((w, i) => isAddress(w) || refuse('E-REF', `${where}.list[${i}]`, `${what} lists “${w}”, which is not an address.`, 'Write the wallet’s public address.'));
       if (!refusals.some((x) => x.where.startsWith(`${where}.list`))) {
         const { depth } = gateList(r.list);
-        if (depth > 20) refuse('E-RULE', `${where}.list`, `${what} lists ${r.list.length} wallets: a proof is one account a level, and the program reads at most 20 (BadRule).`, 'Keep the list under 1,048,576 wallets, or gate by an NFT they hold.');
         if (depth > 12) warn('W-LIST', `${where}.list`, `${what}’s list is ${depth} levels deep: each player passes ${depth} proof nodes as accounts, ${depth * 32} bytes of their transaction.`, 'A shorter list, or gate by an NFT they hold.');
         warn('W-LIST', `${where}.list`, `${what} lets in ${r.list.length} listed wallet${r.list.length === 1 ? '' : 's'}: the program keeps only the list’s root, so the app (or xsolana_play) passes each player’s proof, and the list itself must stay where the app can read it (this spec keeps it).`);
       }
@@ -717,8 +758,7 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
       return;
     }
     if (r.wallets !== undefined) {
-      if (r.wallets.length > LIMITS.gateWallets) refuse('E-RULE', `${where}.wallets`, `${what} lists ${r.wallets.length} wallets; a gate lists at most ${LIMITS.gateWallets}.`, 'List fewer wallets, or gate by a collectible they hold.');
-      else if (!r.wallets.length) warn('W-GATE', `${where}.wallets`, `${what} lists no wallets: nobody passes it.`, 'List the wallets it lets in, or leave the gate out.');
+      if (!r.wallets.length) warn('W-GATE', `${where}.wallets`, `${what} lists no wallets: nobody passes it.`, 'List the wallets it lets in, or leave the gate out.');
       r.wallets.forEach((w, i) => isAddress(w) || refuse('E-REF', `${where}.wallets[${i}]`, `${what} lists “${w}”, which is not an address.`, 'Write the wallet’s public address.'));
       return;
     }
@@ -727,7 +767,6 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
     if (!r.item && !r.collection && !r.attribute) refuse('E-RULE', where, `${what} asks for nothing: no item, no collection and no attribute.`, 'Name the item or the collection players must hold, an attribute, or both.');
     if (r.item && r.collection) refuse('E-RULE', where, `${what} names both an item and a collection: a rule is about one.`, 'Keep "item" for an item the game mints, or "collection" for any NFT of a collection.');
     if (r.collection && !isAddress(r.collection)) refuse('E-REF', `${where}.collection`, `${what} names the collection “${r.collection}”, which is not an address.`, 'Write the Core collection’s address, or the Token Metadata collection mint.');
-    if (utf8Bytes(r.attribute ?? '') > LIMITS.keyBytes) refuse('E-RULE', `${where}.attribute`, `${what} reads an attribute name longer than ${LIMITS.keyBytes} bytes.`, 'Shorten it.');
     if (r.atLeast !== undefined && r.equals !== undefined) refuse('E-RULE', where, `${what} asks for an attribute that is both at least a number and equal to a text.`, 'Keep one of "atLeast" and "equals".');
     if (r.item) {
       const it = item(r.item, `${where}.item`);
@@ -760,7 +799,7 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
   for (const p of m.pools) if (!m.tokens.has(p.currency)) refuse('E-REF', `economy.pools.${p.key}.currency`, `The pool “${p.key}” holds “${p.currency}”, which is not in the tokens.`, 'Add the token, or name one that is there.');
 
   /**
-   * A split carried out in `tok`: percents, at most 4 shares and 100% (state.rs check_later_shares), pools of the same
+   * A split carried out in `tok`: percents, at most 8 shares (any number in a payment's) and 100% at most (state.rs check_later_shares), pools of the same
    * token, and no share that burns in wrapped SOL (the program refuses it). What the shares leave goes to the
    * treasury wallet's account of `tok`, whatever token it is. `chosen`: the buyer may name one share ("chosen",
    * "chosen:<item>"): a box's or a lottery's split; 'wallet': only "chosen", a wallet (a payment's split).
@@ -769,9 +808,11 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
     const shares = sharesOf(list);
     shares.forEach((s, i) => percent(s.percent, `${where}[${i}].percent`));
     const total = shares.reduce((n, s) => n + (s.bps ?? 0), 0);
-    if (shares.length > LIMITS.shares) refuse('E-SPLIT', where, `${what} has ${shares.length} shares; the program takes at most ${LIMITS.shares}.`, 'Merge shares that go to the same place, or drop one.');
     if (total > 10_000) refuse('E-SPLIT', where, `${what}’s shares add up to ${total / 100}%, more than the whole payment.`, 'Make them add up to 100% or less; the treasury gets what they leave.');
     if (shares.filter((s) => s.kind === 'chosen').length > 1) refuse('E-CHOSEN', where, `${what} lets the buyer choose more than one share.`, 'Let them choose one.');
+    // A split kept to be paid later (a box's, a lottery's, a contest's, an auction's) holds at most 8 shares; a
+    // payment's is paid at once and has no such cap.
+    if (chosen !== 'wallet' && shares.length > MAX_SHARES) refuse('E-SPLIT', where, `${what}’s split has ${shares.length} shares; the program keeps at most ${MAX_SHARES} (BadShares).`, `Merge some, to ${MAX_SHARES} or fewer.`);
     for (const [i, s] of shares.entries()) {
       if (s.kind === 'pool') {
         const p = pool(s.key, `${where}[${i}].to`);
@@ -784,6 +825,12 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
         if (!l) refuse('E-REF', `${where}[${i}].to`, `There is no lottery “${s.key}”.`, 'Name one of "lotteries" by its key.');
         else if (tok && potKey !== tok.key) refuse('E-POOL-MINT', `${where}[${i}].to`, `${what} is paid in ${tok.symbol}, but the pot of ${label(l)} is in ${m.tokens.get(potKey)?.symbol ?? potKey}.`, `Send it to a lottery whose pot is in ${tok.symbol}.`);
       }
+      // A farm's rewards vault of this spec, in the token the share is paid in.
+      if (s.kind === 'farm') {
+        const f = m.farm.get(s.key);
+        if (!f) refuse('E-REF', `${where}[${i}].to`, `There is no farm “${s.key}”.`, 'Name one of "farms" by its key.');
+        else if (tok && f.rewardsToken !== tok.key) refuse('E-POOL-MINT', `${where}[${i}].to`, `${what} is paid in ${tok.symbol}, but ${label(f)}’s rewards are ${m.tokens.get(f.rewardsToken)?.symbol ?? f.rewardsToken}.`, `Send it to a farm whose rewards are ${tok.symbol}.`);
+      }
       if (['account', 'holder', 'wallet'].includes(s.kind) && !isAddress(s.key)) refuse('E-REF', `${where}[${i}].to`, `${what} sends a share to “${s.to}”, which is not an address.`, `Write "${s.kind}:<address>".`);
       // A token account named as it is can't be opened for anyone: while none is there, its share goes to the treasury.
       if (s.kind === 'account' && isAddress(s.key) && gameVault(s.key, tok)) refuse('E-SPLIT', `${where}[${i}].to`, `${what} sends a share to the game’s own vault for ${tok.symbol}, where open orders, prizes set aside and bids wait: the program refuses it (it would mix into what those records hold).`, 'Send it to a pool ("pool:<key>") or the treasury instead.');
@@ -827,10 +874,10 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
   };
 
   // ---- the collections and items
-  if (m.collection && utf8Bytes(m.collection.name) > LIMITS.nameBytes) refuse('E-COLLECTION', 'economy.collection.name', `The collection’s name is longer than ${LIMITS.nameBytes} bytes.`, 'Shorten it.');
   if (m.collection && toBps(m.collection.royaltyPercent) === null) refuse('E-PERCENT', 'economy.collection.royaltyPercent', 'The royalty is finer than hundredths of a percent.', 'Round it to two decimals.');
-  // A project takes up to eight collections (project.rs MAX_COLLECTIONS): the one it makes and the owner's others.
-  if ((m.collection ? 1 : 0) + m.collections.length > 8) refuse('E-COLLECTION', 'economy.collections', `The project would take ${(m.collection ? 1 : 0) + m.collections.length} collections; it takes at most 8 (BadCollection).`, 'Name fewer collections.');
+  // A project takes the one collection it makes and the owner's others: as many as `create_project`'s transaction carries
+  // (about 25; no cap of the program's own), which the setup's size check below refuses past (E-TX-SIZE).
+  tooMany(m.collections.length + (m.collection ? 1 : 0), LIMITS.collections, 'E-REF', 'economy.collections', `The project takes ${m.collections.length + (m.collection ? 1 : 0)} collections`, 'BadCollection', 'Take fewer: a gate or a boost can name a collection the project doesn’t take.');
   m.collections.forEach((c, i) => isAddress(c) || refuse('E-REF', `economy.collections[${i}]`, `“${c}” is not an address.`, 'Write the Core collection’s address.'));
   if (m.collections.length) warn('W-COLLECTIONS', 'economy.collections', `The project takes ${m.collections.length} collection${m.collections.length === 1 ? '' : 's'} you already have: going live passes ${m.collections.length === 1 ? 'it' : 'them'} to the program, which refuses one whose update authority is not your wallet (BadCollection). An item minted into one needs the project as an update delegate of it, which you add to the collection yourself.`);
   const given = new Set();
@@ -838,10 +885,50 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
   for (const p of prizes(m)) if (p.prize.gives === 'item') given.add(p.prize.item);
   for (const a of m.auctions) if (a.lot?.item) given.add(a.lot.item);
   for (const d of m.decisions) if (d.does === 'make') given.add(d.item);
+  // A fresh item is given only by a box's roll: a route the player pays or asks for refuses it (PrizeNotCovered); one that
+  // only finishes (a lottery place, a contest, a mission's end) gives nothing in its place; an auction refuses the lot.
+  const fix = 'Give a roll of a box that gives it (`{ "gives": "roll", "box": key }`) instead.';
+  for (const p of prizes(m)) {
+    const it = p.prize.gives === 'item' ? m.item.get(p.prize.item) : null;
+    if (!(it?.drawn ?? []).length) continue;
+    if (p.strict) refuse('E-ITEM', p.where, `${label(it)} draws its traits per unit, which only a box’s roll does: a ${p.route} gives alike units (PrizeNotCovered).`, fix);
+    else warn('W-ITEM', p.where, `${label(it)} draws its traits per unit, which only a box’s roll does: as a ${p.route}’s prize it is never given (its winner gets nothing for it).`, fix);
+  }
+  for (const a of m.auctions) {
+    const it = a.lot?.item ? m.item.get(a.lot.item) : null;
+    if ((it?.drawn ?? []).length) refuse('E-AUCTION', `economy.auctions.${a.key}.lot.item`, `${label(it)} draws its traits per unit, which only a box’s roll does: an auction can’t sell a new one (LotRefused).`, 'Auction a roll of a box that gives it (`"lot": { "roll": key }`) instead.');
+  }
+
+  // A table: rows that weigh something, a label of 32 bytes at most in a table of labels, none in one of numbers.
+  for (const t of m.tables) {
+    const where = `economy.tables.${t.key}`;
+    if (!(t.rows ?? []).length) refuse('E-TABLE', `${where}.rows`, `The table “${t.key}” has no rows.`, 'Give it at least one row.');
+    (t.rows ?? []).forEach((r, i) => {
+      const bytes = new TextEncoder().encode(String(r.label ?? '')).length;
+      if (t.kind === 'numbers' && r.label !== undefined) refuse('E-TABLE', `${where}.rows[${i}].label`, `The table “${t.key}” is of numbers: a row gives its own number, and takes no label (BadTable).`, 'Remove the label, or make the table "labels".');
+      else if (t.kind !== 'numbers' && (bytes === 0 || bytes > 32)) refuse('E-TABLE', `${where}.rows[${i}].label`, `Row ${i} of the table “${t.key}” has a label of ${bytes} bytes: a label is 1 to 32 bytes (BadTable).`, 'Shorten it.');
+    });
+    if (!m.items.some((it) => (it.drawn ?? []).some((d) => d.table === t.key))) warn('W-TABLE', where, `No item draws a trait from the table “${t.key}”.`, 'Name it in an item’s "drawn", or leave it out.');
+  }
+
   for (const it of m.items) {
     const where = `economy.items.${it.key}`;
-    if (utf8Bytes(it.name) > LIMITS.nameBytes) refuse('E-ITEM', `${where}.name`, `${label(it)} is longer than ${LIMITS.nameBytes} bytes, the most the program keeps.`, 'Shorten the name.');
-    if (utf8Bytes(it.uri) > LIMITS.uriBytes) refuse('E-ITEM', `${where}.uri`, `${label(it)}’s link is longer than ${LIMITS.uriBytes} bytes.`, 'Use a shorter link.');
+    // A fresh collectible: each trait its own attribute, drawn from a table the spec has or a range from its least to its
+    // most; given only by a box's roll (a shop sells alike units: PrizeNotCovered).
+    const drawn = it.drawn ?? [];
+    if (drawn.length && !isCollectible(it)) refuse('E-ITEM', `${where}.drawn`, `${label(it)} draws traits, but it is a normal item: only a collectible carries them.`, 'Make it a collectible, or leave "drawn" out.');
+    // Each trait is written as its unit is minted, which one transaction must hold (catalog.rs).
+    tooMany(drawn.length, LIMITS.itemTraits, 'E-ITEM', `${where}.drawn`, `${label(it)} draws ${drawn.length} traits`, 'BadItem', 'Draw fewer: put what goes together in one table’s labels.');
+    drawn.forEach((d, i) => {
+      const at = `${where}.drawn[${i}]`;
+      if (utf8Bytes(d.attribute ?? '') > LIMITS.traitKeyBytes) refuse('E-ITEM', `${at}.attribute`, `${label(it)}’s trait “${String(d.attribute).slice(0, 24)}…” has a name of ${utf8Bytes(d.attribute)} bytes; the program takes at most ${LIMITS.traitKeyBytes} (BadItem).`, 'Use a shorter name.');
+      if (RESERVED_ATTRIBUTES.includes(d.attribute)) refuse('E-ITEM', `${at}.attribute`, `${label(it)} draws “${d.attribute}”, an attribute the program writes itself (BadItem).`, 'Name another attribute.');
+      if (drawn.slice(0, i).some((e) => e.attribute === d.attribute)) refuse('E-ITEM', `${at}.attribute`, `${label(it)} draws “${d.attribute}” twice (BadItem).`, 'Draw each attribute once.');
+      if (d.table !== undefined && (d.min !== undefined || d.max !== undefined)) refuse('E-ITEM', at, `${label(it)}’s trait “${d.attribute}” names a table and a range.`, 'Keep one.');
+      else if (d.table !== undefined && !m.table.get(d.table)) refuse('E-REF', `${at}.table`, `${label(it)}’s trait “${d.attribute}” draws from “${d.table}”, which is not one of the spec’s tables.`, 'Add the table to "tables", or name one it has.');
+      else if (d.table === undefined && !(d.min !== undefined && d.max !== undefined && d.min <= d.max)) refuse('E-ITEM', at, `${label(it)}’s trait “${d.attribute}” needs a table, or a range from its "min" to its "max", the least first.`, 'Name a table, or give a "min" and a "max".');
+    });
+    if (drawn.length && (Number(it.price ?? 0) > 0 || it.free)) refuse('E-ITEM', `${where}.price`, `${label(it)} draws its traits per unit, by a roll: the shop sells only alike units (PrizeNotCovered).`, 'Sell it from a box (one outcome is enough: the box still rolls), and leave "price" out.');
     // A collectible is minted into a collection of the project's (catalog.rs BadCollection).
     if (isCollectible(it) && it.collection && !m.collections.includes(it.collection))
       refuse('E-COLLECTION', `${where}.collection`, `${label(it)} is minted into ${it.collection}, which is not one of the project’s "collections" (BadCollection).`, 'Add it to "collections", or leave "collection" out to mint into the one the setup makes.');
@@ -874,18 +961,11 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
     const fills = fillers.filter((f) => f.pool === p.key);
     if (takes.length && !fills.length)
       warn('W-POOL-DRY', where, `The pool “${p.key}” is paid out of (${takes.map((t) => t.by).join(', ')}) but nothing in this spec fills it: until someone sends it tokens, those payouts give nothing (a claim of a fixed amount is refused).`, `Seed it ("seed"), send it a share of a sale (a split to "pool:${p.key}"), or fill it with a schedule.`);
-    const names = m.farms.some((f) => f.rewards === p.key && f.rate?.minted);
-    if (!takes.length && !fills.length && !names) warn('W-POOL', where, `The pool “${p.key}” is never used.`, 'Remove it, or use it.');
+    if (!takes.length && !fills.length) warn('W-POOL', where, `The pool “${p.key}” is never used.`, 'Remove it, or use it.');
     if (fills.length && !takes.length)
       warn('W-POOL', where, `Money goes into “${p.key}” (${fills.map((f) => f.by).join(', ')}) and nothing in the economy takes it out: only the authority can, with a payout.`, 'Add what pays from it (a box prize, a lottery, a farm, a recipe, a grant), or a decision that pays out of it.');
-    const farm = takes.find((t) => t.by.startsWith('farm:') && t.how.startsWith('releases everything'));
-    if (farm) {
-      const others = takes.filter((t) => t !== farm);
-      if (others.length)
-        warn('W-POOL-SHARED', where, `The farm ${label(m.farm.get(farm.by.slice(5)))} releases everything that arrives in “${p.key}” to its stakers, and ${others.map((t) => t.by).join(', ')} also take from it: the farm releases all the pool holds to its seats, so what the others need is paid out to stakers, and whichever takes first leaves the others less.`, 'Give the farm a rewards pool of its own, and feed it with a share or a schedule.');
-    }
     const lottery = takes.find((t) => t.by.startsWith('lottery:'));
-    if (lottery && !farm) {
+    if (lottery) {
       const others = takes.filter((t) => t !== lottery);
       if (others.length) warn('W-POOL-SHARED', where, `The pot “${p.key}” of ${lottery.by} is also taken from by ${others.map((t) => t.by).join(', ')}: until its winners are paid it is a pool like any other, and the winners share what is left.`, 'Give the lottery a pot of its own.');
     }
@@ -917,7 +997,7 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
       if (listed.has(n.asset)) refuse('E-STASH', at, `${label(s)} lists ${n.asset}, which ${listed.get(n.asset)} lists too: an NFT can be handed to the game once.`, 'List each NFT in one stash, once.');
       listed.set(n.asset, label(s));
       if (n.kind === 'compressed')
-        refuse('E-STASH', at, `${label(s)} lists a compressed NFT: putting one in needs a proof of its leaf fetched when it is signed, which going live does not do.`, 'Leave it out here; once the economy is live, put it in with `loot.proveLeafIx` then `loot.stashIx` (both in one transaction, signed by the owner or the authority who holds it). A compressed prize NFT can’t move in the same instruction as another move on its tree (a mission whose staked NFTs share that tree, a lottery contribution winning two places of one tree): the second proof is stale and the unstake or the payment fails until it is sent again. Keep prize NFTs on a tree of their own, or give them through a roll.');
+        refuse('E-STASH', at, `${label(s)} lists a compressed NFT: putting one in needs a proof of its leaf fetched when it is signed, which going live does not do.`, 'Leave it out here; once the economy is live, put it in with `loot.proveLeafIx` then `loot.stashIx` (both in one transaction, signed by the owner or the authority who holds it). A compressed prize NFT can’t move in the same instruction as another move on its tree (a mission whose staked NFTs share that tree, a lottery entry winning two places of one tree): the second proof is stale and the unstake or the payment fails until it is sent again. Keep prize NFTs on a tree of their own, or give them through a roll.');
       if (n.kind === 'core' && !n.collection && !m.live.project)
         refuse('E-STASH', at, `${label(s)} lists an NFT of the game’s own collection, which is only made when the economy goes live: there is none to put in yet.`, 'Give the collection it is in ("collection"), or put it in once the economy is live and your wallet holds it.');
     }
@@ -932,7 +1012,11 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
       const fits = Math.floor(1_200_000 / (52 * (most + 1)) / 100) * 100;
       warn('W-STASH-NAMED', where, `${[...namers.map(([b]) => label(b)), ...named.map((p) => p.by)].join(', ')} name${namers.length + named.length === 1 ? 's' : ''} NFTs of ${label(s)}, which ${[...new Set(intoStash.get(s.key))].join(', ')} put${intoStash.get(s.key).length === 1 ? 's' : ''} NFTs into, so it can grow without end. A named NFT is found by reading the stash’s list, about 52 compute units for each NFT ahead of it${most ? `: a roll of ${label(namers.find(([, n]) => n === most)[0])}, which names ${most}, stops fitting a transaction at about ${fits.toLocaleString('en-US')} NFTs in the stash (its order then waits for its refund)` : ''}${named.length ? `${most ? ', and' : ':'} a prize naming one stops at about 25,000` : ''}. Keep a stash that prizes name under about 1,000 NFTs.`, 'Send what players put in to a stash of its own, and name prizes from a stash only the owner fills; a random pick of a stash costs the same at any size.');
     }
-    if (!(s.nfts ?? []).length && !intoStash.has(s.key)) warn('W-STASH', `${where}.nfts`, `${label(s)} starts empty: an empty stash can’t be won, so its box gives its other outcomes (or sells nothing) until the owner or the authority puts NFTs in (\`loot.stashIx\`).`);
+    if (!(s.nfts ?? []).length && !intoStash.has(s.key)) {
+      // A box that stops selling when an outcome runs out (the default) isn't sold at all while it is empty.
+      const stopped = users.filter((b) => b.active !== false && b.whenOut !== 'drawLeft' && !boxBuys(b, m));
+      warn('W-STASH', `${where}.nfts`, `${label(s)} starts empty: until the owner or the authority puts NFTs in (\`loot.stashIx\`), ${stopped.length ? `${stopped.map(label).join(', ')} ${stopped.length === 1 ? 'isn’t' : 'aren’t'} sold at all (it stops selling while an outcome is out, "whenOut": "stopSales"), and ` : ''}a draw that lands on it is not made and gives back that draw’s worth, no other outcome taking its place, and a box of nothing else sells nothing.`);
+    }
     if (!users.length && !named.length) warn('W-STASH', where, `No box and no prize gives an NFT of ${label(s)}: what it holds stays with the game.`, 'Add an outcome { "gives": "stash", "stash": key } to a box, or a prize { "gives": "nft", "stash": key, "nft": address }.');
     // Who takes from it: buyers and every route that rolls those boxes (one NFT a roll), and the prizes naming one.
     const takers = [...new Set([...users.flatMap((b) => [...(b.active !== false ? [b.shopOf ? `item:${b.shopOf}` : `box:${b.key}`] : []), ...rolls.filter((r) => r.box === b.key).map((r) => r.by)]), ...named.map((p) => p.by)])];
@@ -959,6 +1043,130 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
   const seedNeeds = new Map();
   for (const b of m.boxes) {
     const where = `economy.boxes.${b.key}`;
+    // A pack: each slot draws at least once, among outcomes the box has, each named once. Several draws need a box that
+    // rolls, or one outcome of items, with no outcome that burns the payment and no NFT to roll on (BadEntries).
+    const slots = b.slots ?? [];
+    const outs = b.outcomes ?? [];
+    tooMany(outs.length, LIMITS.boxEntries, 'E-ODDS', `${where}.outcomes`, `${label(b)} has ${outs.length} outcomes`, 'BadEntries', 'Use fewer outcomes, or roll on a table of rows ("drawn").');
+    tooMany(slots.length, LIMITS.boxSlots, 'E-ODDS', `${where}.slots`, `${label(b)} has ${slots.length} slots`, 'BadEntries', 'Put alike draws into one slot with "count".');
+    tooMany((b.odds ?? []).length, LIMITS.boxOdds, 'E-ODDS', `${where}.odds`, `${label(b)} has ${(b.odds ?? []).length} odds that read an NFT`, 'BadEntries', 'Keep the ones that matter.');
+    const fated = outs.filter((o) => (o.shifts ?? []).length || (o.then ?? b.then ?? 'back') !== 'back').length;
+    tooMany(fated, LIMITS.boxFates, 'E-ROLL', `${where}.outcomes`, `${fated} outcomes of ${label(b)} act on the NFT it rolls on`, 'BadEntries', 'Have fewer outcomes act on it.');
+    for (const [i, o] of outs.entries()) {
+      const given = outcomeParts(o);
+      tooMany(given.length, LIMITS.entryPrizes, 'E-ODDS', `${where}.outcomes[${i}].prizes`, `An outcome of ${label(b)} gives ${given.length} prizes`, 'BadEntries', 'Give fewer, or make it two outcomes.');
+      // An outcome gives all it names or isn't given (order.rs): what it names is refused at the write when it can clash.
+      for (const [j, x] of given.entries()) {
+        const clash = given.slice(0, j).map((y) => samePrizes(y, x)).find(Boolean);
+        if (clash) refuse('E-ODDS', `${where}.outcomes[${i}].prizes[${j}]`, `An outcome of ${label(b)} ${clash}: it gives all it names or isn't given, so the program refuses the box (BadEntries).`, 'Name each pool once, with the whole amount, and a stash\'s random NFT beside nothing else of that stash.');
+      }
+      // Two of an item take two units: an entry of more than its supply can never be given.
+      for (const key of new Set(given.filter((x) => x.gives === 'item').map((x) => x.item))) {
+        const count = given.filter((x) => x.gives === 'item' && x.item === key).length;
+        const supply = Number(m.item.get(key)?.supply ?? 0);
+        if (supply > 0 && count > supply) warn('W-OUT-OF-STOCK', `${where}.outcomes[${i}]`, `An outcome of ${label(b)} gives ${count} of ${label(m.item.get(key))}, which has a supply of ${supply}: it needs them all left, so it can never be given${b.whenOut !== 'drawLeft' && b.active !== false && boxRolls(b, m) ? ', and a box that stops selling while an outcome is out ("whenOut": "stopSales") is never sold' : ', and a draw that lands on it gives back that draw’s worth'}.`, 'Give fewer, or raise its supply.');
+      }
+    }
+    // A fresh outcome's tables come with the answer while they fit what the box's own accounts leave, in outcome order
+    // (`tableBudget`). One past that is out of stock on every roll, so its odds would be false.
+    {
+      const box = (() => {
+        try {
+          return boxArgs(b, m);
+        } catch {
+          return null;
+        }
+      })();
+      if (box && boxRolls(b, m)) {
+        let left = Math.max(0, tableBudget(box.entries));
+        const cut = [];
+        outs.forEach((out, i) => {
+          for (const part of outcomeParts(out)) {
+            if (part.gives !== 'item') continue;
+            const tables = (m.item.get(part.item)?.drawn ?? []).filter((d) => d.table).length;
+            if (tables > left) cut.push(i);
+            else left -= tables;
+          }
+        });
+        if (cut.length) refuse('E-ODDS', `${where}.outcomes`, `${label(b)} draws from more tables than one answer of the oracle’s can carry, so outcome${cut.length === 1 ? '' : 's'} ${[...new Set(cut)].join(', ')} could never be won.`, 'Fewer outcomes with drawn traits, fewer table traits on each, or a range (`min`, `max`) in place of a table.');
+      }
+    }
+    slots.forEach((s, i) => (s.from ?? []).forEach((o, j) => {
+      if (o >= outs.length) refuse('E-ODDS', `${where}.slots[${i}].from[${j}]`, `Slot ${i} of ${label(b)} names outcome ${o}, but the box has ${outs.length}.`, 'Name outcomes by their place in "outcomes", from 0.');
+      else if ((s.from ?? []).slice(0, j).includes(o)) refuse('E-ODDS', `${where}.slots[${i}].from[${j}]`, `Slot ${i} of ${label(b)} names outcome ${o} twice.`, 'Name each once.');
+    }));
+    // A compressed item an outcome gives is minted at the settle, as any prize's (`compressedCheck`).
+    outs.forEach((o, i) => outcomeParts(o).forEach((part) => part.gives === 'item' && part.compressed && m.item.get(part.item) && compressedCheck(m.item.get(part.item), `${where}.outcomes[${i}]`, label(b), 'E-ODDS')));
+    const cards = slots.reduce((n, s) => n + s.count, 0);
+    // Slots that name outcomes draw different things, so each says what it is worth (BadEntries): what a draw that
+    // can't be made gives back.
+    const shared = slots.reduce((n, s) => n + Math.round((s.share ?? 0) * 100), 0);
+    const named = outs.length > 1 && slots.some((s) => (s.from ?? []).length);
+    const zero = named && slots.some((s) => !s.share);
+    if (zero || shared !== (named ? 10_000 : 0))
+      refuse('E-ODDS', `${where}.slots`, named ? `The slots of ${label(b)} name outcomes, so each says what it is worth as a share of an open's price, more than 0 each and 100 together; these come to ${shared / 100}.` : `The slots of ${label(b)} all draw among every outcome, so every draw is worth the same: they take no share.`, named ? 'Give each slot a "share": a draw that can\'t be made gives its slot\'s worth back, so make a rare slot worth what the rare is.' : 'Leave "share" out.');
+    // Every outcome is one some slot draws (BadEntries): one no slot draws would count as stock no roll can give.
+    if (slots.length && !slots.some((s) => !(s.from ?? []).length)) {
+      const undrawn = outs.map((_, i) => i).filter((i) => !slots.some((s) => (s.from ?? []).includes(i)));
+      if (undrawn.length)
+        refuse('E-ODDS', `${where}.slots`, `No slot of ${label(b)} draws its outcome${undrawn.length === 1 ? '' : 's'} ${undrawn.join(', ')}: an outcome no slot draws is never given, so the program refuses the box (BadEntries).`, 'Name each outcome in some slot’s "from", leave "from" out of a slot (it draws among all), or drop the outcome.');
+    }
+    // Every draw of one open fits one answer of the oracle's (PackTooLarge): a pack past it could only draw its first
+    // cards, so the program refuses the box. A box that doesn't roll sells by `buy`, the whole purchase in one
+    // transaction, or through the oracle when one `buy` can't carry it (`buyFits`): then the answer's heap counts, and it
+    // can't give a roll, which only `buy` gives (catalog.rs). The heap counts the box's own bytes too (`boxBytes`).
+    if (cards > 1 && outs.length) {
+      const args = (() => {
+        try {
+          return boxArgs(b, m);
+        } catch {
+          return null;
+        }
+      })();
+      const entries = args?.entries;
+      if (entries) {
+        const byBuy = boxRolls(b, m) || Boolean(b.rollsOn) || buyFits(args, cards);
+        const extras = { odds: args.odds.length, shares: args.shares.length, fates: args.fates.length, bytes: boxBytes(args), oracle: !byBuy };
+        if (!byBuy && entries.some((e) => e.prizes.some((p) => p.Roll != null)))
+          refuse('E-ODDS', `${where}.slots`, `${label(b)} gives a roll, which only a sale in one step gives, but ${cards} of what it gives don’t fit one transaction (its accounts, its instructions or its compute), so the program refuses the box (PackTooLarge).`, 'Fewer cards an open, fewer prizes in its outcome, or fewer shares in its split.');
+        else if (!drawsFit(entries, slots.map((s) => ({ count: s.count, only: s.from ?? [] })), 1, extras)) {
+          let most = cards - 1;
+          while (most > 1 && !drawsFit(entries, most, 1, extras)) most -= 1;
+          refuse('E-ODDS', `${where}.slots`, `${label(b)} draws ${cards} cards an open among ${outs.length} outcome${outs.length === 1 ? '' : 's'}: more than one answer of the oracle’s can draw (about ${most} here), so the program refuses the box (PackTooLarge).`, 'Fewer cards an open (sell two packs instead of one), fewer outcomes, fewer prizes in an outcome, or a smaller box (fewer odds, shares, slots or outcomes that act on the NFT).');
+        }
+      }
+    }
+    if (cards > 1 && b.rollsOn)
+      refuse('E-ODDS', `${where}.slots`, `${label(b)} draws ${cards} times an open, but a pack has no NFT it rolls on (BadEntries).`, 'Leave "slots" out, or drop "rollsOn".');
+    // An open's order holds every prize it can set aside: at most 10,240 bytes (about 243 one-prize draws).
+    const orderSize = (() => {
+      try {
+        return boxOrderBytes(b, m);
+      } catch {
+        return 0;
+      }
+    })();
+    if (orderSize > MAX_ORDER_BYTES) refuse('E-ODDS', `${where}.slots`, `${label(b)}’s order would be ${orderSize.toLocaleString('en-US')} bytes, more than the ${MAX_ORDER_BYTES.toLocaleString('en-US')} an order can be (BadEntries).`, 'Fewer draws an open, or fewer prizes in its largest outcome.');
+    // A roll moves its prizes aside with no accounts of a transfer hook's, and can't move tokens whose mint allows
+    // confidential transfers or none at all: such a prize is out of stock in every roll (order.rs `mints_in_stock`): a draw
+    // that lands on it is not made and gives back its worth, and a box with nothing else in stock is refused when it is
+    // opened or asked for (SoldOut).
+    const rolledAtAll = !boxBuys(b, m) || rolls.some((r) => r.box === b.key);
+    if (rolledAtAll)
+      for (const [i, o] of outs.entries()) {
+        const tokenOf = (x) => (x.gives === 'pay' ? m.pool.get(x.pool)?.currency : x.gives === 'mint' ? x.currency ?? m.currencyKey : undefined);
+        const bad = outcomeParts(o).map((x) => m.tokens.get(tokenOf(x))).find((t) => t?.powers?.transferHook || t?.powers?.confidentialTransfers);
+        if (!bad) continue;
+        const why = bad.powers.transferHook ? 'whose mint has a transfer hook (a roll carries none of the accounts a hook asks for)' : 'whose mint allows confidential transfers';
+        warn('W-OUT-OF-STOCK', `${where}.outcomes[${i}]`, `${label(b)} pays a prize in ${bad.symbol ?? bad.key}, ${why}: a roll can’t move it, so this outcome is out of stock in every roll of the box: its odds stay as written, a draw that lands on it makes no draw and gives back that draw’s worth, and no other outcome takes its place${outs.length === 1 ? '; with nothing else in it, every opening or roll of the box is refused (SoldOut)' : ''}.`, `Pay its prizes in a token without ${bad.powers.transferHook ? 'a transfer hook' : 'confidential transfers'}${boxRolls(b, m) || b.rollsOn ? '' : ', or sell the box in one step (one outcome, nothing random, no NFT rolled on: the purchase moves its prize with the hook’s accounts)'}.`);
+      }
+    // A roll is given only by a box that sells in one step (`buy`): one oracle answer can't serve a second draw. In a
+    // box that rolls it is refused; in an order (an open, a prize's or a recipe's roll of the box) it is out of stock.
+    const givesRoll = outs.some((o) => outcomeParts(o).some((x) => x.gives === 'roll'));
+    if (givesRoll && boxRolls(b, m))
+      refuse('E-ODDS', `${where}.outcomes`, `${label(b)} rolls (more than one outcome, or an NFT of a stash at random), and gives a roll of a box: a box that rolls can’t give one (BadEntries).`, 'Give the roll from a box of one outcome that sells in one step, or give the box’s prizes directly.');
+    else if (givesRoll && rolledAtAll)
+      warn('W-OUT-OF-STOCK', `${where}.outcomes`, `${label(b)} gives a roll of a box, which only its sale in one step gives: ${b.rollsOn ? 'it rolls on an NFT, so it is opened' : `${[...new Set(rolls.filter((r) => r.box === b.key).map(roller))].join(', ')} roll${rolls.filter((r) => r.box === b.key).length === 1 ? 's' : ''} it`}, and in an order the roll is out of stock: that order gives nothing${outs.length === 1 && outcomeParts(outs[0]).length === 1 ? ' (with nothing else in it, the roll is refused, SoldOut)' : ''}.`, 'Give the roll from a box nothing rolls, or give the box’s prizes directly.');
     const tok = token(b.currency, `${where}.currency`);
     const price = units(b.price, tok, `${where}.price`, `${label(b)}’s price`);
     prices(b, tok, where);
@@ -979,7 +1187,6 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
         timed(x, `${at}.shifts[${j}]`, `${label(b)} moves “${x.attribute}”`, 'E-ROLL');
         fourByteSeconds(x.by, `${at}.shifts[${j}].by`, { signed: true });
         fourByteSeconds(x.upTo, `${at}.shifts[${j}].upTo`);
-        if (toBy(x.by) > 0 && x.upTo !== undefined && !(toSeconds(x.upTo) >= 1)) warn('W-ROLL', `${at}.shifts[${j}]`, `${label(b)} raises “${x.attribute}” up to ${x.upTo}: it never raises it.`, 'Set "upTo" to 1 or more, or leave it out.');
       }
       thenCheck(o.then, `${at}.then`, label(b));
     }
@@ -1008,7 +1215,7 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
     // may turn on memos) is warned of, and one bigger than a legacy transaction goes as v0 with a lookup table its
     // sender makes. Two shapes outgrow the 32 KiB heap on a compressed subject (three Core NFTs of stashes; two and four
     // holders' or wallets' shares): with the 256 KiB heap frame xsolana's senders ask for they land (48 and 58 accounts).
-    if (!boxBuys(b) || rolls.some((r) => r.box === b.key)) {
+    if (!boxBuys(b, m) || rolls.some((r) => r.box === b.key)) {
       const sizes = (outcomes.length ? outcomes : [{}]).map((o, i) => ({ i, ...settleAccounts(b, o, m), least: settleAccounts(b, o, m, { proof: 0 }).count, units: settleUnits(b, o, m), ...settleSize(b, o, m) }));
       const at = (x) => `${where}.outcomes${outcomes.length ? `[${x.i}]` : ''}`;
       // As v0 (any settle past a legacy transaction), the transaction locks its lookup table and the table's program
@@ -1031,7 +1238,7 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
         warn('W-BOX-HEAP', `${where}.rollsOn`, `${label(b)} rolls on an NFT of a collection that may be compressed, whose proof every NFT a settle moves is handed: with ${sizes.some((x) => x.corePicks >= 3) ? 'three NFTs of stashes' : 'two NFTs of stashes and four holders’ or wallets’ shares'} it doesn’t fit the 32 KiB heap a transaction has by default. ${sends}. One sent without the frame (another app’s) fails, and as a rolled order is never refunded, its player then settles by putting every NFT won back in its stash.`, 'Give an outcome fewer NFTs of stashes or fewer holders’ or wallets’ shares, or roll on the game’s own collectibles.');
       const big = sizes.reduce((a, x) => (x.legacy > a.legacy ? x : a), sizes[0]);
       if (!certain && !heavy && total <= ACCOUNT_LOCKS && big.legacy > MAX_TRANSACTION_BYTES)
-        warn('W-SETTLE-V0', at(big), `${label(b)}’s settle of its outcome ${big.i} takes about ${big.legacy} bytes as a legacy transaction, more than the ${MAX_TRANSACTION_BYTES} one holds (${big.locks} accounts, ${big.locks + TABLE_LOCKS} as v0 with its table). xsolana’s senders send it as a v0 transaction that loads its accounts from an address lookup table they make first: js/play from the player’s wallet (one to three more approvals to make the table, and about ${(Number(big.tableRent) / 1e9).toFixed(4)} SOL of its rent, which comes back once the table has cooled down, about two minutes later: claims() lists it), the keeper’s sweep from its own payer. A sender of legacy transactions only (another app’s) can’t settle it, and a rolled order is never refunded.`, 'To keep it a legacy transaction, give the outcome fewer prizes or fewer holders’ or wallets’ shares.');
+        warn('W-SETTLE-V0', at(big), `${label(b)}’s settle of its outcome ${big.i} takes about ${big.legacy} bytes as a legacy transaction, more than the ${MAX_TRANSACTION_BYTES} one holds (${big.locks} accounts, ${big.locks + TABLE_LOCKS} as v0 with its table). xsolana’s senders send it as a v0 transaction that loads its accounts from an address lookup table: js/play from the project’s standing table, which going live makes (one approval; a table of the player’s own, about ${(Number(big.tableRent) / 1e9).toFixed(4)} SOL of rent back about two minutes later, only for accounts it lacks), the keeper’s sweep from its own payer. A sender of legacy transactions only (another app’s) can’t settle it, and a rolled order is never refunded.`, 'To keep it a legacy transaction, give the outcome fewer prizes or fewer holders’ or wallets’ shares.');
     }
     if (b.rollsOn && custodial)
       warn('W-ROLL-CUSTODY', `${where}.rollsOn`, `${label(b)} can ${outcomes.some((o) => thenOfOutcome(o) === 'burn') ? 'burn' : outcomes.some((o) => thenOfOutcome(o)?.stash) ? 'keep' : 'give away'} the NFT it rolls on: the project holds the NFT from the moment it is bought until the roll is settled, so nobody can move it away from a bad roll. A player who brings their own NFT must agree to that.`);
@@ -1047,27 +1254,10 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
     const prizedBy = rolls.filter((r) => r.box === b.key && !['mission', 'recipe'].includes(r.route)).map(roller);
     if (prizedBy.length && b.active !== false && !b.shopOf)
       warn('W-ROLL-PRIZE', `${where}.active`, `${label(b)} is a prize of ${[...new Set(prizedBy)].join(', ')}, and is for sale too: anyone can open it for its price${price === 0n ? ' (free)' : ''}, and each opening takes from what the prize gives (a stash’s NFTs, a pool’s prizes).`, 'Set "active": false for a box only prizes roll.');
-    // A prize moves in the roll, which carries none of the accounts a transfer hook asks for (order.rs): the program
-    // refuses a hooked prize mint at every open of a box that rolls, and fails every waiting roll of a box (a recipe's,
-    // a mission's, a prize's, another box's outcome's, of any number of outcomes) at its ask, after the player gave what
-    // it took.
-    const rolledHere = [...new Set(rolls.filter((r) => r.box === b.key).map(roller))];
-    if (boxRolls(b) || rolledHere.length)
-      for (const [i, o] of outcomes.entries()) {
-        const hookedKey = outcomeParts(o)
-          .map((x) => (x.gives === 'pay' || x.gives === 'share' ? m.pool.get(x.pool)?.currency : x.gives === 'mint' ? x.currency ?? m.currencyKey : undefined))
-          .find((k) => k && m.tokens.get(k)?.powers?.transferHook);
-        if (!hookedKey) continue;
-        const fails = [
-          boxRolls(b) && 'every opening of it fails',
-          rolledHere.length && `every roll of it ${rolledHere.join(', ')} make${rolledHere.length === 1 ? 's' : ''} fails when it is asked for, keeping what the player gave for it (a recipe’s inputs, a mission’s return, a grant’s round, a box’s price), or is refused at once on a route that can’t give it (a purchase in one step)`,
-        ].filter(Boolean);
-        refuse('E-BOX', `${where}.outcomes[${i}]`, `${label(b)} pays a prize in “${hookedKey}”, a token whose mint has a transfer hook, and its prizes move in a roll, which carries none of the accounts a hook asks for: the program refuses them (PrizeHasHook), so ${fails.join(', and ')}.`, `Pay its prizes in a token without a transfer hook${rolledHere.length ? '' : ', or give it one outcome (a box of one outcome moves its prize in the purchase, with the hook’s accounts)'}.`);
-      }
     if (prizedBy.length && b.rollsOn)
       warn('W-ROLL-PRIZE', `${where}.rollsOn`, `${label(b)} rolls on an NFT, but ${[...new Set(prizedBy)].join(', ')} give${prizedBy.length === 1 ? 's' : ''} a roll of it on nothing: its outcomes are given, and their shifts and where they send an NFT are not.`, 'Give prizes a box with no "rollsOn".');
     if (price === 0n && !rolledBy.length && b.active !== false)
-      warn('W-FREE', `${where}.price`, `${label(b)} is free: anyone, a bot included, can open it again and again for only the fees${outcomes.flatMap(outcomeParts).some((o) => o.gives === 'pay' || o.gives === 'share') ? ', and drain the pools its prizes come from' : ''}.`, 'Give it a price, a gate, or hand out openings through a grant.');
+      warn('W-FREE', `${where}.price`, `${label(b)} is free: anyone, a bot included, can open it again and again for only the fees${outcomes.flatMap(outcomeParts).some((o) => o.gives === 'pay') ? ', and drain the pools its prizes come from' : ''}.`, 'Give it a price, a gate, or hand out openings through a grant.');
     const withChance = outcomes.filter((o) => o.chance !== undefined).length;
     const withWeight = outcomes.filter((o) => o.weight !== undefined).length;
     if (withChance && withWeight) refuse('E-ODDS', `${where}.outcomes`, `${label(b)} mixes chances and weights, so its odds cannot be read.`, 'Give every outcome a chance (percents adding up to 100), or every one a weight.');
@@ -1086,9 +1276,6 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
     for (const [i, outcome] of outcomes.entries()) {
       const at = `${where}.outcomes[${i}]`;
       if (outcome.gives === 'bundle' && !(outcome.prizes ?? []).length) refuse('E-ODDS', `${at}.prizes`, `A bundle of ${label(b)} gives nothing.`, 'List up to three prizes in "prizes".');
-      if (outcomeParts(outcome).length > 3) refuse('E-ODDS', `${at}.prizes`, `An outcome of ${label(b)} gives ${outcomeParts(outcome).length} prizes; an entry gives at most 3 (BadEntries).`, 'Give fewer, or move some to another outcome.');
-      if (outcome.burns && outcome.gives !== 'bundle') refuse('E-ODDS', `${at}.burns`, `"burns" is a bundle's; this outcome is “${outcome.gives}”.`, 'Use "gives": "burn" for an outcome that only burns, or make it a bundle.');
-      if (outcomeBurns(outcome) && outcome.gives !== 'burn' && tok?.wsol) refuse('E-WSOL-BURN', at, `${label(b)} is paid in SOL, and wrapped SOL cannot be burned.`, 'Leave "burns" out.');
       for (const [k, o] of outcomeParts(outcome).entries()) {
         const at = outcome.gives === 'bundle' ? `${where}.outcomes[${i}].prizes[${k}]` : `${where}.outcomes[${i}]`;
         // A prize line's own kinds: tokens minted, a named NFT, a roll of a box (prize.rs).
@@ -1097,42 +1284,42 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
           if (!o.item) refuse('E-ODDS', at, `An outcome of ${label(b)} gives an item but does not say which.`, 'Add "item".');
           else item(o.item, `${at}.item`);
         }
-        if (o.gives === 'pay' || o.gives === 'share') {
+        if (o.gives === 'pay') {
           chance = true;
           const p = o.pool ? pool(o.pool, `${at}.pool`) : refuse('E-ODDS', at, `An outcome of ${label(b)} pays from a pool but does not say which.`, 'Add "pool".');
-          if (o.gives === 'pay' && p) {
+          if (p) {
             const amount = units(o.amount, m.tokens.get(p.currency), `${at}.amount`, `${label(b)}’s prize`);
             if (amount === 0n) refuse('E-ODDS', `${at}.amount`, `An outcome of ${label(b)} pays nothing (BadEntries).`, 'Give it an amount above 0, or make it "nothing".');
             // In base units, exact (null when it is not an amount, refused above).
             prizes.push({ pool: p, amount });
           }
-          if (o.gives === 'share' && !(percent(o.percent, `${at}.percent`) > 0)) refuse('E-ODDS', `${at}.percent`, `An outcome of ${label(b)} pays a share of 0% (BadEntries).`, 'Give it a percent above 0.');
         }
         if (o.gives === 'stash') {
           if (!o.stash) refuse('E-ODDS', at, `An outcome of ${label(b)} gives a stash’s NFT but does not say which stash.`, 'Add "stash".');
           else if (!m.stash.get(o.stash)) refuse('E-REF', `${at}.stash`, `There is no stash “${o.stash}”.`, 'Add it to "stashes", or name one that is there.');
         }
       }
-      if (outcome.gives === 'burn' && tok?.wsol) refuse('E-WSOL-BURN', at, `${label(b)} is paid in SOL, and wrapped SOL cannot be burned.`, 'Make that outcome "nothing", or send its share somewhere.');
     }
-    if (outcomes.length > LIMITS.entries) refuse('E-ODDS', `${where}.outcomes`, `${label(b)} has ${outcomes.length} outcomes; a box holds at most ${LIMITS.entries}.`, 'Merge outcomes, or split it into two boxes.');
     // The oracle's answer to a roll carries the order, the box, its ticket, an account for each outcome that wins
     // something, and with prizes the token programs, the game and a mint and a vault for each pool (catalog.rs).
-    if (boxRolls(b)) {
-      const named = parts.filter((o) => ['item', 'pay', 'share', 'stash', 'nft'].includes(o.gives)).length;
-      const sources = new Set(parts.filter((o) => ['pay', 'share', 'mint'].includes(o.gives)).map((o) => (o.gives === 'mint' ? `mint:${o.currency ?? m.currencyKey}` : o.pool))).size;
+    if (boxRolls(b, m)) {
+      const named = parts.filter((o) => ['item', 'pay', 'stash', 'nft'].includes(o.gives)).length;
+      const sources = new Set(parts.filter((o) => ['pay', 'mint'].includes(o.gives)).map((o) => (o.gives === 'mint' ? `mint:${o.currency ?? m.currencyKey}` : o.pool))).size;
       const callback = 3 + named + (sources ? 3 + 2 * sources : 0);
       if (callback > LIMITS.callbackAccounts) refuse('E-ODDS', `${where}.outcomes`, `${label(b)}’s roll would hand the oracle ${callback} accounts; its answer carries at most ${LIMITS.callbackAccounts} (TooManyAccounts).`, 'Pay prizes from fewer pools, or have fewer outcomes.');
     }
     // The player's purchase must be sendable, with the compute budget their wallet adds: js/play sends one
     // too big for a legacy transaction as v0 with a lookup table, which locks the table and its program too.
     if (b.active !== false && !refusals.some((x) => x.where.startsWith(where))) {
-      const { bytes, locks } = boxBuys(b) ? buySize(b, m, { detail: true }) : openBoxSize(b, m, { detail: true });
-      const verb = boxBuys(b) ? 'buy' : 'open';
+      // A fixed pack too big to buy in one legacy transaction is opened instead (js/play): the oracle answers it.
+      const bought = boxBuys(b, m) ? buySize(b, m, { detail: true }) : null;
+      const buys = Boolean(bought) && (drawsOf(b) === 1 || (bought.bytes <= MAX_TRANSACTION_BYTES && bought.locks <= ACCOUNT_LOCKS));
+      const { bytes, locks } = buys ? bought : openBoxSize(b, m, { detail: true });
+      const verb = buys ? 'buy' : 'open';
       if (bytes > MAX_TRANSACTION_BYTES && locks + TABLE_LOCKS > ACCOUNT_LOCKS)
-        refuse('E-TX-SIZE', where, `${boxBuys(b) ? 'Buying' : 'Opening'} ${label(b)} would take about ${bytes} bytes and ${locks} accounts, ${locks + TABLE_LOCKS} as a v0 transaction with a lookup table: more than the ${ACCOUNT_LOCKS} a transaction can lock, so no player could ${verb} it.`, 'Give it fewer outcomes that name an item or a pool, pay its prizes (and those of a box it rolls) from fewer pools, or drop its per-wallet limit.');
+        refuse('E-TX-SIZE', where, `${buys ? 'Buying' : 'Opening'} ${label(b)} would take about ${bytes} bytes and ${locks} accounts, ${locks + TABLE_LOCKS} as a v0 transaction with a lookup table: more than the ${ACCOUNT_LOCKS} a transaction can lock, so no player could ${verb} it.`, 'Give it fewer outcomes that name an item or a pool, pay its prizes (and those of a box it rolls) from fewer pools, or drop its per-wallet limit.');
       else if (bytes > MAX_TRANSACTION_BYTES)
-        warn('W-TX-V0', where, `${boxBuys(b) ? 'Buying' : 'Opening'} ${label(b)} takes about ${bytes} bytes with the compute budget a wallet adds, more than the ${MAX_TRANSACTION_BYTES} a legacy transaction holds: js/play sends it as a v0 transaction with a lookup table the player’s wallet makes first (one to three more approvals, and the table’s rent until it is closed, which claims() offers about two minutes later). A wallet or app that sends only legacy transactions can’t ${verb} it.`, 'To keep it a legacy transaction, give it fewer outcomes that name an item or a pool, or pay its prizes from fewer pools.');
+        warn('W-TX-V0', where, `${buys ? 'Buying' : 'Opening'} ${label(b)} takes about ${bytes} bytes with the compute budget a wallet adds, more than the ${MAX_TRANSACTION_BYTES} a legacy transaction holds: js/play sends it as a v0 transaction that loads its accounts from the project’s standing lookup table, which going live makes (one approval; going live is refused without it, E-NO-TABLE). A wallet or app that sends only legacy transactions can’t ${verb} it.`, 'To keep it a legacy transaction, give it fewer outcomes that name an item or a pool, or pay its prizes from fewer pools.');
     }
     for (const [i, o] of (b.odds ?? []).entries()) {
       const at = `${where}.odds[${i}]`;
@@ -1141,8 +1328,8 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
       effect(o.add, `${at}.add`, `${label(b)}’s odds`);
     }
     if ((b.odds ?? []).length && outcomes.length < 2) warn('W-ODDS', `${where}.odds`, `${label(b)} has one outcome, so odds change nothing.`);
-    // A box sells only while its pool covers every fixed prize (order.rs, PrizeNotCovered): the odds on the page are
-    // always odds it can pay. A prize won leaves the pool for the game's vault at the roll.
+    // A fixed prize is in stock only while its pool holds all of it (order.rs): a prize won leaves the pool for the
+    // game's vault at the roll.
     for (const z of prizes) {
       if (z.amount === null) continue;
       const need = seedNeeds.get(z.pool.key) ?? { pool: z.pool, amount: 0n, box: b, boxes: new Set() };
@@ -1152,9 +1339,25 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
     }
     if (b.stockOdds && !parts.some((o) => o.gives === 'item' && m.item.get(o.item)?.supply > 0))
       warn('W-ODDS', `${where}.stockOdds`, `${label(b)} has odds that shrink with stock, but none of its items has a limited supply, so nothing changes.`, 'Give its items a supply, or turn stockOdds off.');
+    // What it does once an outcome runs out (order.rs `WhenOut`): only an open of a box that rolls reads it.
+    if (b.whenOut !== undefined && boxBuys(b, m) && drawsOf(b) === 1)
+      warn('W-WHEN-OUT', `${where}.whenOut`, `${label(b)} sells in one step, all of it or nothing, so "whenOut" changes nothing.`, 'Leave "whenOut" out.');
+    if (b.whenOut === 'drawLeft' && boxRolls(b, m)) {
+      // The rarest outcome that gives something, against the likeliest outcome that can run out.
+      const w = weights(b);
+      const total = w.reduce((a, x) => a + x, 0) || 1;
+      const runsOut = (o) => outcomeParts(o).some((x) => x.gives === 'pay' || x.gives === 'stash' || x.gives === 'nft' || (x.gives === 'item' && Number(m.item.get(x.item)?.supply ?? 0) > 0));
+      const giving = outcomes.map((o, i) => i).filter((i) => outcomeParts(outcomes[i]).length);
+      const rare = giving.reduce((r, i) => (r === -1 || w[i] < w[r] ? i : r), -1);
+      const common = outcomes.map((o, i) => i).filter((i) => i !== rare && runsOut(outcomes[i]) && w[i] > w[rare]).reduce((c, i) => (c === -1 || w[i] > w[c] ? i : c), -1);
+      if (rare >= 0 && common >= 0) {
+        const pct = (x) => Math.round(x * 10_000) / 100;
+        warn('W-WHEN-OUT', `${where}.whenOut`, `${label(b)} draws among what is left once an outcome runs out ("whenOut": "drawLeft"): once outcome ${common} runs out, outcome ${rare}’s chance goes from ${pct(w[rare] / total)}% to ${pct(w[rare] / (total - w[common]))}%. Anyone who reads the stock can buy until outcome ${common} is gone and then open for outcome ${rare} at better odds.`, 'Keep "stopSales" (the default) when a rare outcome matters: the box stops selling instead, and every roll stays on the odds written.');
+      }
+    }
   }
-  // A box sells only while its pool covers every fixed prize (order.rs, PrizeNotCovered): a pool whose seed is short of
-  // the largest prize a box pays from it holds up every box it pays.
+  // A fixed prize a pool can't cover is out of stock (order.rs): a draw that lands on it is not made and gives back its
+  // worth, a box with nothing else in stock is refused (SoldOut), and a sale in one step is refused (PrizeNotCovered).
   for (const { pool: p, amount: most, box, boxes } of seedNeeds.values()) {
     const tok = m.tokens.get(p.currency);
     const sym = tok?.symbol ?? p.currency;
@@ -1163,20 +1366,23 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
     if (seed === null || seed >= most) continue;
     const amount = fromUnits(most, tok?.decimals ?? 0);
     const others = [...boxes].filter((x) => x !== box).map(label);
-    warn('W-PRIZE-SEED', `economy.pools.${p.key}.seed`, `“${p.key}” starts with ${fromUnits(seed, tok?.decimals ?? 0)} ${sym}, but a win in ${label(box)} pays ${amount} ${sym}. The program sells a box only while its pool holds every fixed prize, so ${label(box)} can’t be opened until the pool holds ${amount} ${sym}, and stops selling whenever a run of wins takes the pool below that${others.length ? ` (${others.join(', ')} pay${others.length === 1 ? 's' : ''} fixed prizes from it too, each held up the same way below its own largest)` : ''}.`, `Seed “${p.key}” with at least ${amount} ${sym}; more rides out a run of wins (the simulation suggests how much). For a prize that grows with sales, use a share of the pool ("gives": "share") instead.`);
+    // A box that stops selling when an outcome is out (the default) needs the prize for this purchase's draws and every
+    // draw still waiting for the oracle before it sells at all.
+    const stopped = [...boxes].filter((x) => x.active !== false && x.whenOut !== 'drawLeft' && boxRolls(x, m));
+    const stops = stopped.length ? ` ${stopped.map(label).join(', ')} stop${stopped.length === 1 ? 's' : ''} selling while an outcome is out ("whenOut": "stopSales"): ${stopped.length === 1 ? 'it isn’t' : 'they aren’t'} sold at all while the pool holds less than the prize for that purchase’s draws and every draw still waiting for the oracle.` : '';
+    warn('W-PRIZE-SEED', `economy.pools.${p.key}.seed`, `“${p.key}” starts with ${fromUnits(seed, tok?.decimals ?? 0)} ${sym}, but a win in ${label(box)} pays ${amount} ${sym}. A fixed prize its pool can’t cover is out of stock: the odds stay as written, so a roll that lands on it before the pool holds ${amount} ${sym} makes no draw and gives back that draw’s worth, no other outcome taking its place (a box with nothing else in stock is refused, SoldOut), and so again whenever a run of wins takes the pool below that${others.length ? ` (${others.join(', ')} pay${others.length === 1 ? 's' : ''} fixed prizes from it too, each out of stock the same way below its own amount)` : ''}.${stops}`, `Seed “${p.key}” with at least ${amount} ${sym} for each purchase that may wait for its roll at once; more rides out a run of wins (the simulation suggests how much). For a prize that grows with sales, use a lottery’s pot instead.`);
   }
 
-  // ---- a live box's roll rewritten: an order waiting for its roll is rolled only on the version it paid for, so
-  // an edit of the entries, odds, stock odds, the NFT it rolls on or the fates fails every roll of it that waits. A
-  // purchase gets its payment back; a roll won elsewhere (a prize, a mission's chest, an auction's lot) paid nothing in,
-  // and refunds 0.
+  // ---- a live box's roll rewritten: an edit of the entries, odds, stock odds, `whenOut`, the NFT it rolls on or the fates fails an
+  // order that holds a payment, which is refunded; any other roll waiting (a prize, a mission's chest, a recipe's) rolls on
+  // the box as edited, so an edit never loses what was spent.
   const published = new Map((economy.live?.published?.boxes ?? []).map((b) => [b.key, b]));
-  const rollOf = (b) => JSON.stringify([b.outcomes ?? [], b.odds ?? [], Boolean(b.stockOdds), b.rollsOn ?? null, b.then ?? null]);
+  const rollOf = (b) => JSON.stringify([b.outcomes ?? [], b.odds ?? [], Boolean(b.stockOdds), b.whenOut ?? 'stopSales', b.rollsOn ?? null, b.then ?? null]);
   for (const b of economy.boxes ?? []) {
     const was = published.get(b.key);
     if (!was || rollOf(was) === rollOf(b)) continue;
     const routes = [...new Set(rolls.filter((x) => x.box === b.key).map(roller))];
-    warn('W-LIVE-ROLLS', `economy.boxes.${b.key}`, `${label(m.box.get(b.key) ?? b)} is live, and this changes its roll (its outcomes, odds, stock odds, the NFT it rolls on or what becomes of it). Every roll of it still waiting fails when the change lands${routes.length ? `: one won on another route (${routes.join(', ')}) paid nothing in, so it refunds 0 and its winner loses it` : ': a purchase gets its payment back, and a roll won on another route paid nothing in, so it refunds 0'}.`, 'Publish the change only once no roll of it waits (each settled or refunded), or open a new box with the new roll and point the routes at it.');
+    warn('W-LIVE-ROLLS', `economy.boxes.${b.key}`, `${label(m.box.get(b.key) ?? b)} is live, and this changes its roll (its outcomes, odds, stock odds, what it does when an outcome runs out, the NFT it rolls on or what becomes of it). A purchase still waiting for its roll fails when the change lands, and gets its payment back${routes.length ? `; a roll won on another route (${routes.join(', ')}) holds no payment and rolls on the box as it is then` : '; a roll won on another route holds no payment and rolls on the box as it is then'}.`, 'Publish the change only once no roll of it waits (each settled or refunded), or open a new box with the new roll and point the routes at it.');
   }
 
   // ---- payments
@@ -1194,9 +1400,18 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
   for (const r of m.recipes) {
     const where = `economy.recipes.${r.key}`;
     const ins = r.in ?? [];
+    // Each kind of line has its cap, a collectible's life adding its own needs and raises.
+    const lines = (() => {
+      try {
+        return recipeArgs(r, m);
+      } catch {
+        return { inputs: ins, outputs: r.out ?? [], needs: r.needs ?? [], keeps: r.keeps ?? [], raises: r.raises ?? [] };
+      }
+    })();
+    for (const [kind, words] of [['inputs', 'lines in'], ['outputs', 'lines out'], ['needs', 'needs'], ['keeps', 'numbers it carries over'], ['raises', 'raises']])
+      tooMany(lines[kind].length, LIMITS.recipeLines, 'E-RECIPE', where, `${label(r)} has ${lines[kind].length} ${words}`, 'BadRecipe', 'Split it into two recipes.');
     const outs = r.out ?? [];
     if (!ins.length && !outs.length) warn('W-RECIPE', where, `${label(r)} takes nothing and gives nothing: crafting it only charges the player fee.`, 'Add what it takes and what it gives.');
-    if (ins.length > LIMITS.lines || outs.length > LIMITS.lines) refuse('E-RECIPE', where, `${label(r)} has more than ${LIMITS.lines} lines on a side.`, 'Merge lines, or split it into two recipes.');
     perWalletWindow(r, where);
     let taken = 0;
     const kept = [];
@@ -1234,7 +1449,8 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
         // The line names its farm (craft.rs, `Input::Staked { item, farm }`): the craft takes the piece only from its seat
         // there, a farm of collectibles that holds or freezes it (a watched one could be sold while staked).
         const f = line.farm === undefined ? null : m.farm.get(line.farm);
-        const raised = (r.raises ?? []).filter((x) => x.place === taken).map((x) => x.key);
+        // The recipe's own raises on it, and its life's (uses, a cooldown: `lifeLines`).
+        const raised = [...(r.raises ?? []).filter((x) => x.place === taken).map((x) => x.key), ...lifeLines(r, m).raises.filter((x) => x.place === taken).map((x) => x.shift.key)];
         const candidates = m.farms.filter((x) => x.stakes === 'collectibles' && (x.custody ?? 'escrow') !== 'watch' && (!x.item || x.item === it.key));
         if (line.farm === undefined)
           refuse('E-RECIPE', `${at}.farm`, `${label(r)} takes ${label(it)} only while it is staked, but does not say in which farm: the program takes the piece only from its seat in the farm the line names.`, candidates.length ? `Add "farm": ${candidates.map((x) => `"${x.key}"`).join(' or ')}.` : `Add a farm of collectibles that takes ${label(it)} with "custody": "escrow" or "freeze", and name it in "farm".`);
@@ -1272,15 +1488,15 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
       if (line.on !== undefined && !b.rollsOn) refuse('E-RECIPE', `${at}.on`, `${label(r)} rolls ${label(b)} on collectible ${line.on}, but the box rolls on none.`, 'Give the box "rollsOn", or leave "on" out.');
       if (line.on !== undefined && !kept[line.on]) refuse('E-RECIPE', `${at}.on`, `${label(r)} rolls on collectible ${line.on}, which it ${line.on < taken ? 'burns' : 'does not take'}.`, 'Point it at a collectible the recipe uses, renews or shows.');
       const custodial = (b.outcomes ?? []).some((o) => o.then && o.then !== 'back');
-      if (custodial && places[line.on] === 'show')
-        warn('W-ROLL-CUSTODY', `${at}.on`, `${label(b)} can burn or give away the NFT ${label(r)} shows: the craft hands it to the game, which only a Core NFT can be (a Token Metadata or compressed one is refused, NeedsCustody).`, 'Roll on one of the game’s items ("use"), or give the box only outcomes that move numbers.');
+      // A roll that moves numbers holds the NFT until it settles, as one that can burn or give it away takes it (craft.rs).
+      const moves = (b.outcomes ?? []).some((o) => (o.shifts ?? []).length);
+      if ((custodial || moves) && places[line.on] === 'show')
+        warn('W-ROLL-CUSTODY', `${at}.on`, `${label(b)} ${custodial ? 'can burn or give away' : 'moves numbers on'} the NFT ${label(r)} shows: the craft hands it to the game until it settles, which only a Core NFT can be (a Token Metadata or compressed one is refused, NeedsCustody).`, 'Roll on one of the game’s items ("use").');
     }
     for (const [i, raise] of (r.raises ?? []).entries()) {
       timed(raise, `${where}.raises[${i}]`, `${label(r)} raises “${raise.key}”`, 'E-RECIPE');
       fourByteSeconds(raise.by, `${where}.raises[${i}].by`, { signed: true });
       fourByteSeconds(raise.upTo, `${where}.raises[${i}].upTo`);
-      const asWritten = !raise.fromNow && m.farms.some((f) => f.lockAttribute === raise.key || f.upkeepAttribute === raise.key);
-      if (toBy(raise.by) > 0 && !asWritten && !(toSeconds(raise.upTo ?? 0) >= 1)) warn('W-RECIPE', `${where}.raises[${i}].upTo`, `${label(r)} raises “${raise.key}” with no "upTo": it is maxed out for every NFT and never raises it.`, 'Say the most it reaches.');
       if (!kept[raise.place]) refuse('E-RECIPE', `${where}.raises[${i}]`, `${label(r)} raises “${raise.key}” on collectible ${raise.place}, which it ${raise.place < taken ? 'burns' : 'does not take'}: only one it keeps can be raised.`, 'Point it at a collectible the recipe uses, renews or shows.');
       if (RESERVED_ATTRIBUTES.includes(raise.key)) refuse('E-RECIPE', `${where}.raises[${i}].key`, `“${raise.key}” is a number the program writes itself.`, 'Raise a key of the game’s own, such as "level" or "power".');
     }
@@ -1296,7 +1512,7 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
       if (bytes > MAX_TRANSACTION_BYTES && locks + TABLE_LOCKS > ACCOUNT_LOCKS)
         refuse('E-TX-SIZE', where, `Crafting ${label(r)} would take about ${bytes} bytes and ${locks} accounts, ${locks + TABLE_LOCKS} as a v0 transaction with a lookup table: more than the ${ACCOUNT_LOCKS} a transaction can lock, so no player could craft it.`, 'Take or give fewer collectibles, or split it into two recipes.');
       else if (bytes > MAX_TRANSACTION_BYTES)
-        warn('W-TX-V0', where, `Crafting ${label(r)} takes about ${bytes} bytes, more than the ${MAX_TRANSACTION_BYTES} a legacy transaction holds: js/play sends it as a v0 transaction with a lookup table the player’s wallet makes first (one to three more approvals, and the table’s rent until it is closed, which claims() offers about two minutes later). A wallet or app that sends only legacy transactions can’t craft it.`, 'To keep it a legacy transaction, take or give fewer collectibles, or split it into two recipes.');
+        warn('W-TX-V0', where, `Crafting ${label(r)} takes about ${bytes} bytes, more than the ${MAX_TRANSACTION_BYTES} a legacy transaction holds: js/play sends it as a v0 transaction that loads its accounts from the project’s standing lookup table, which going live makes (one approval; going live is refused without it, E-NO-TABLE). A wallet or app that sends only legacy transactions can’t craft it.`, 'To keep it a legacy transaction, take or give fewer collectibles, or split it into two recipes.');
       else if (bytes > BUDGET)
         warn('W-TX-SIZE', where, `Crafting ${label(r)} takes about ${bytes} of ${MAX_TRANSACTION_BYTES} bytes: it fits only if the player’s wallet adds nothing of its own.`, 'Take or give fewer collectibles if players see it fail.');
     }
@@ -1333,8 +1549,13 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
     const byShare = s.percent !== undefined;
     if (s.does !== 'issue' && byShare && s.amount !== undefined) refuse('E-SCHEDULE', where, `${label(s)} names both a percent and an amount.`, 'Keep one.');
     if (s.does === 'issue') {
-      const p = s.pool ? pool(s.pool, `${where}.pool`) : refuse('E-SCHEDULE', where, `${label(s)} mints but does not say into which pool.`, 'Add "pool".');
-      const tok = token(s.currency ?? p?.currency, `${where}.currency`);
+      // Into a pool, or a farm's rewards vault ("to": "farm:<key>").
+      const intoFarm = destination(s.to ?? '').kind === 'farm';
+      const farm = intoFarm ? m.farm.get(destination(s.to).key) : null;
+      if (intoFarm && !farm) refuse('E-REF', `${where}.to`, `There is no farm “${destination(s.to).key}”.`, 'Name one of "farms" by its key.');
+      const p = intoFarm ? null : s.pool ? pool(s.pool, `${where}.pool`) : refuse('E-SCHEDULE', where, `${label(s)} mints but does not say into which pool or farm.`, 'Add "pool", or "to": "farm:<key>".');
+      const tok = token(s.currency ?? p?.currency ?? farm?.rewardsToken, `${where}.currency`);
+      if (farm && tok && farm.rewardsToken !== tok.key) refuse('E-POOL-MINT', `${where}.to`, `${label(s)} mints ${tok.symbol} into ${label(farm)}, whose rewards are ${m.tokens.get(farm.rewardsToken)?.symbol ?? farm.rewardsToken}.`, 'Mint the farm’s rewards token.');
       if (tok && !tok.gameMints) refuse('E-MINT-NOT-OURS', where, `${label(s)} mints ${tok.symbol}, but the project cannot mint it: only a token the project makes itself can be minted, so every run of it would fail.`, 'Fill the pool with a share of sales or a move from another pool, or use a token with source "project".');
       if (p && tok && p.currency !== tok.key) refuse('E-POOL-MINT', `${where}.pool`, `${label(s)} mints ${tok.symbol} into “${p.key}”, which holds ${m.tokens.get(p.currency)?.symbol}.`, `Mint into a pool of ${tok.symbol}.`);
       if (units(s.amount, tok, `${where}.amount`, `What ${label(s)} mints`) === 0n) refuse('E-SCHEDULE', `${where}.amount`, `${label(s)} mints 0.`, 'Give it an amount above 0.');
@@ -1351,7 +1572,7 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
       const d = destination(s.to ?? '');
       // A wallet that is a program's address (off the curve) nobody can sign for: a run would pay where nobody can
       // spend it, or pass it over (BadMove).
-      if (d.kind === 'wallet' && isAddress(d.key) && !isOnCurve(addressBytes(d.key))) refuse('E-SCHEDULE', `${where}.to`, `${label(s)} is sealed and pays ${d.key}, the address of a program's account, not a wallet someone holds the key of: nobody could spend what it pays (BadMove).`, 'Pay the wallet of a person (its public key), or "account:<token account>".');
+      if (d.kind === 'wallet' && isAddress(d.key) && !isOnCurve(addressBytes(d.key))) refuse('E-SCHEDULE', `${where}.to`, `${label(s)} is sealed and pays ${d.key}, the address of a program's account, not a wallet someone holds the key of: nobody could spend what it pays (BadMove).`, 'Pay the wallet of a person (its public key).');
       // Its last run within 10 years of going live.
       if (s.maxRuns > 0) {
         let first = now + seconds(s.every, `${where}.every`);
@@ -1363,20 +1584,9 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
         if (first + seconds(s.every, `${where}.every`) * (s.maxRuns - 1) - now > MAX_SCHEDULE_SECONDS) refuse('E-SCHEDULE', `${where}.maxRuns`, `${label(s)} is sealed and its last run would come more than 10 years after go-live (BadSchedule).`, 'Fewer runs, a shorter "every", or an earlier "start".');
       }
       if (s.maxRuns > MAX_SEALED_RUNS) refuse('E-SCHEDULE', `${where}.maxRuns`, `${label(s)} is sealed with ${s.maxRuns} runs; a sealed schedule runs at most ${MAX_SEALED_RUNS} times (BadSchedule).`, 'Fewer runs, each larger.');
-      if (d.kind === 'account') warn('W-SCHEDULE', `${where}.to`, `${label(s)} is sealed and pays a token account: it must be its holder's associated account of ${tok?.symbol ?? 'its token'}, or a token account the project holds with no close authority, when it goes live, or the write is refused (BadMove).`);
-      if (d.kind === 'account' && gameVault(d.key, tok)) refuse('E-SCHEDULE', `${where}.to`, `${label(s)} is sealed and pays the game’s own vault, where open orders, prizes set aside and bids wait: no run could (BadMove).`, 'Pay a wallet.');
-      if (!['wallet', 'account', 'pool', 'lottery', 'treasury', 'burn'].includes(d.kind) || !s.to) refuse('E-SCHEDULE', `${where}.to`, `${label(s)} is sealed and pays “${s.to ?? 'nowhere'}”: a sealed schedule pays a wallet, a token account, a pool, a lottery's pot, the treasury or a burn (BadMove).`, 'Write "to": "wallet:<address>".');
-      // What it pays into is this spec's, and holds what it pays: a pool of its token, a lottery whose pot is in it.
-      if (d.kind === 'pool') {
-        const p = pool(d.key, `${where}.to`);
-        if (p && tok && p.currency !== tok.key) refuse('E-POOL-MINT', `${where}.to`, `${label(s)} is sealed in ${tok.symbol}, but pays the pool “${p.key}”, which holds ${m.tokens.get(p.currency)?.symbol ?? p.currency}.`, `Pay a pool of ${tok.symbol}, or seal it in ${m.tokens.get(p.currency)?.symbol ?? p.currency}.`);
-      }
-      if (d.kind === 'lottery') {
-        const l = m.lottery.get(d.key);
-        const potKey = l?.currency ?? m.currencyKey;
-        if (!l) refuse('E-REF', `${where}.to`, `There is no lottery “${d.key}”.`, 'Name one of "lotteries" by its key.');
-        else if (tok && potKey !== tok.key) refuse('E-POOL-MINT', `${where}.to`, `${label(s)} is sealed in ${tok.symbol}, but pays the pot of ${label(l)}, which is in ${m.tokens.get(potKey)?.symbol ?? potKey}.`, `Pay a lottery whose pot is in ${tok.symbol}, or seal it in ${m.tokens.get(potKey)?.symbol ?? potKey}.`);
-      }
+      // A wallet, the treasury or a burn: a stream into a pool or an account would be only as safe as where it lands (the
+      // authority moves a pool; an account's holder may close it).
+      if (!['wallet', 'treasury', 'burn'].includes(d.kind) || !s.to) refuse('E-SCHEDULE', `${where}.to`, `${label(s)} is sealed and pays “${s.to ?? 'nowhere'}”: a sealed schedule pays a wallet, the treasury or a burn, never a pool, a pot, a farm or an account (BadMove).`, 'Write "to": "wallet:<address>"; for a stream into a pool, a pot or a farm, leave "sealed" out.');
       if (tok?.wsol && d.kind === 'burn') refuse('E-WSOL-BURN', `${where}.to`, `${label(s)} burns SOL, and wrapped SOL cannot be burned.`, 'Pay it somewhere instead.');
       startsFrozen(tok, `${where}.currency`, `${label(s)} (sealed)`, 'E-SCHEDULE', 'BadSchedule');
       if (tok?.powers?.permanentDelegate || tok?.powers?.nonTransferable || tok?.powers?.confidentialTransfers)
@@ -1386,7 +1596,6 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
       if (s.fund !== undefined) units(s.fund, tok, `${where}.fund`, `${label(s)}’s fund`);
       if (s.fundFrom === 'mint' && tok && !tok.gameMints) refuse('E-MINT-NOT-OURS', `${where}.fundFrom`, `${label(s)} is funded by minting ${tok.symbol}, which the project cannot mint.`, 'Fund it from the owner\'s wallet or a pool.');
       if (s.fundFrom?.startsWith('pool:')) pool(s.fundFrom.slice(5), `${where}.fundFrom`);
-      if (d.kind === 'lottery' || d.kind === 'pool') warn('W-SCHEDULE', `${where}.to`, `${label(s)} is sealed, but pays ${d.kind === 'pool' ? 'a pool, which the authority moves' : 'a lottery’s pot, which the owner may close between rounds with nothing sold'}: a stream is as safe as where it lands.`);
       warn('W-SCHEDULE', where, `${label(s)} is sealed: once written it never closes, and nobody can edit or stop it. Check its terms before it goes live.`);
       if (!Number(s.fund ?? 0)) warn('W-SCHEDULE', `${where}.fund`, `${label(s)} starts empty: its runs pay nothing until someone sends tokens to its vault.`, 'Give it "fund".');
       if (d.kind === 'treasury') warn('W-SCHEDULE', `${where}.to`, `${label(s)} pays the treasury: the owner can change which wallet that is, so it is the owner's promise to themselves.`);
@@ -1407,7 +1616,11 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
     if (s.does === 'pay') {
       const d = destination(s.to ?? '');
       if (d.kind === 'lottery') m.lottery.has(d.key) || refuse('E-REF', `${where}.to`, `There is no lottery “${d.key}”.`, 'Name one of "lotteries" by its key.');
-      else if (!['account', 'holder', 'wallet'].includes(d.kind) || !isAddress(d.key)) refuse('E-SCHEDULE', `${where}.to`, `${label(s)} pays “${s.to ?? 'nowhere'}”: a pay schedule pays a wallet, a token account, a collectible’s holder or a lottery’s pot.`, 'Write "to": "wallet:<address>", "account:<token account address>" or "holder:<asset address>".');
+      else if (d.kind === 'farm') {
+        const f = m.farm.get(d.key);
+        if (!f) refuse('E-REF', `${where}.to`, `There is no farm “${d.key}”.`, 'Name one of "farms" by its key.');
+        else if (srcToken && f.rewardsToken !== srcToken.key) refuse('E-POOL-MINT', `${where}.to`, `${label(s)} pays ${srcToken.symbol} into ${label(f)}, whose rewards are ${m.tokens.get(f.rewardsToken)?.symbol ?? f.rewardsToken}.`, 'Pay it from a pool of the farm’s rewards token.');
+      } else if (!['account', 'holder', 'wallet'].includes(d.kind) || !isAddress(d.key)) refuse('E-SCHEDULE', `${where}.to`, `${label(s)} pays “${s.to ?? 'nowhere'}”: a pay schedule pays a wallet, a token account, a collectible’s holder, a lottery’s pot or a farm’s rewards.`, 'Write "to": "wallet:<address>", "account:<token account address>", "holder:<asset address>", "lottery:<key>" or "farm:<key>".');
       else if (d.kind === 'account' && gameVault(d.key, m.poolToken(sourceKey))) refuse('E-SCHEDULE', `${where}.to`, `${label(s)} pays the game’s own vault, where open orders, prizes set aside and bids wait: the program refuses it.`, 'Pay a pool or a wallet instead.');
       warn('W-SCHEDULE-PAY', where, `${label(s)} pays out of “${sourceKey}” on a timer, but the pool stays the game’s: the authority can still spend it, and the owner can rewrite or stop the schedule. It is a promise the project keeps, not a vesting contract the recipient holds.`, 'Make it "sealed" (with "fund" and "maxRuns") for a vesting nobody can take back.');
     }
@@ -1435,6 +1648,7 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
     } else if (l.price === undefined || units(l.price, ticket, `${where}.price`, `${label(l)}’s ticket`) === 0n)
       warn('W-LOTTERY', `${where}.price`, `${label(l)}’s tickets are free: a buyer pays only the player fee (${fromUnits(FEES.player, 9)} SOL)${l.perWallet ? '' : ', and with no "perWallet" one wallet can hold most of the tickets'}. Its pot is only what is paid into it.`, 'Give a ticket a "price" if it should cost something, or set "perWallet".');
     units(l.seed, potToken, `${where}.seed`, `${label(l)}’s seed`);
+    if (l.roundRent !== undefined) units(l.roundRent, { decimals: 9, symbol: 'SOL' }, `${where}.roundRent`, `${label(l)}’s round rent`);
     if (seconds(l.every, `${where}.every`) <= 0 && !l.firstDraw) warn('W-LOTTERY', `${where}.every`, `${label(l)} draws once (no "every"), and the draw is due at go-live.`, 'Give it a "firstDraw" (like "publish+1d"), or an "every" to draw again and again.');
     // A round whose draw is more than five years off sells nothing (lottery.rs).
     if (seconds(l.every, `${where}.every`) > MAX_CONTEST_SECONDS) refuse('E-LOTTERY', `${where}.every`, `${label(l)} draws every ${l.every}: a draw more than 5 years off sells no ticket (SalesClosed).`, 'Draw within 5 years.');
@@ -1446,19 +1660,47 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
     }
     // A place takes a share of the pot, a roll of a box for its winner, or both (lottery.rs Place).
     const placed = (l.places ?? [100]).map(placeOf);
+    tooMany(placed.length, LIMITS.lotteryRuns, 'E-LOTTERY', `${where}.places`, `${label(l)} has ${placed.length} runs of places`, 'BadLottery', 'Put alike places into one run with "times".');
     const places = placed.map((p, i) => percent(p.percent, `${where}.places[${i}]${typeof (l.places ?? [])[i] === 'object' ? '.percent' : ''}`));
     for (const [i, p] of placed.entries()) {
       const raw = (l.places ?? [])[i];
       if (!places[i] && !p.prize) refuse('E-LOTTERY', `${where}.places[${i}]`, `${label(l)}’s place ${i + 1} wins nothing: no share of the pot and no prize (BadLottery).`, 'Give it a "percent" above 0, a "prize", or remove it.');
       if (typeof raw === 'object' && raw?.prize) prizeCheck(raw.prize, `${where}.places[${i}].prize`, `${label(l)}’s place ${i + 1}`, 'E-LOTTERY');
-    }
+      // A run holds places alike: a named NFT or a roll is one place's.
+      if (p.times > 1 && ((p.prize?.gives === 'nft') || p.prize?.gives === 'roll'))
+        refuse('E-LOTTERY', `${where}.places[${i}].times`, `${label(l)}’s place ${i + 1} repeats ${p.times} times a prize one place gives (a named NFT, a roll) (BadLottery).`, 'Give it to one place, or make it a prize places can share alike (tokens, an item, an NFT drawn from the lottery’s stash).');
+      // A run of places given one by one (anything but tokens: a collectible, a compressed NFT, a raffled NFT) holds at
+      // most MAX_RUN_PLACES places: a pull walks the run from its first place (BadLottery).
+      if (p.prize && p.prize.gives !== 'tokens' && p.times > MAX_RUN_PLACES)
+        refuse('E-LOTTERY', `${where}.places[${i}].times`, `${label(l)}’s place ${i + 1} gives ${prizeWords(p.prize, m)} to ${p.times.toLocaleString('en-US')} places in a row: a run of places given one by one holds at most ${MAX_RUN_PLACES.toLocaleString('en-US')}, since each pull walks it from its first place (BadLottery).`, `Split it into runs of ${MAX_RUN_PLACES.toLocaleString('en-US')} places or fewer, one after another.`);
+      // A run's token prize in all, each place's amount times its places, fits a u64 (BadLottery).
+      const t = p.prize?.amount !== undefined ? prizeToken(p.prize, m) : null;
+      let each = 0n;
+      try {
+        each = t ? toUnits(p.prize.amount, t.decimals ?? 0) : 0n;
+      } catch {
+        // An amount that doesn't read is refused where the prize is checked.
+      }
+      if (each * BigInt(p.times ?? 1) > U64_MAX)
+        refuse('E-LOTTERY', `${where}.places[${i}].times`, `${label(l)}’s place ${i + 1} gives ${p.prize.amount} ${p.times} times: more tokens in all than the program can count (BadLottery).`, 'Fewer places in the run, or a smaller prize.');
+    }
+    // A raffle of many NFTs: its places draw from the lottery's own stash, which holds at least as many; it draws once,
+    // and never also names NFTs of it (lottery.rs).
+    const raffled = placed.filter((p) => p.prize?.gives === 'raffled').reduce((n, p) => n + p.times, 0);
+    if (raffled && l.every) refuse('E-LOTTERY', `${where}.every`, `${label(l)} draws NFTs from its own stash, so it draws once (BadLottery).`, 'Leave "every" out.');
+    if (raffled && placed.some((p) => p.prize?.held)) refuse('E-LOTTERY', `${where}.places`, `${label(l)} both names NFTs of its own stash and draws from it: a draw could take a named one (BadLottery).`, 'Raffle them all at random, or name each one.');
+    if (raffled > (l.nfts ?? []).length) refuse('E-LOTTERY', `${where}.nfts`, `${label(l)} draws ${raffled} NFTs from its own stash, which holds ${(l.nfts ?? []).length} (NotInStash).`, 'List at least as many in "nfts".');
     // A raffle's NFT: one place each, and a lottery that holds one draws once (lottery.rs).
     const held = placed.map((p) => (p.prize?.held ? p.prize.nft : null)).filter(Boolean);
     if (held.length && l.every) refuse('E-LOTTERY', `${where}.every`, `${label(l)} holds an NFT as a prize, so it draws once: a next round would sell a prize already won (BadLottery).`, 'Leave "every" out.');
     if (new Set(held).size < held.length) refuse('E-LOTTERY', `${where}.places`, `${label(l)} gives the same NFT on two places: the second could never be given (BadLottery).`, 'Name each NFT once.');
-    if (held.length) warn('W-RAFFLE', `${where}.places`, `${label(l)} holds ${held.length === 1 ? 'its NFT' : 'its NFTs'} in its own stash: nobody, the owner included, can take ${held.length === 1 ? 'it' : 'them'} out while a place names ${held.length === 1 ? 'it' : 'them'}, and the winner gets ${held.length === 1 ? 'it' : 'them'} before any ticket money moves. If the NFT's collection lets someone freeze or move it (a permanent freeze, transfer or burn delegate), they could stop the prize, and every ticket's money would wait in the lottery until they let it go.`);
+    // One pull takes every NFT its places win out of the stash, in place order (lottery.rs `assign_fits`).
+    const rows = (l.nfts ?? []).length + held.length;
+    const draw = 6_000 + 250 * Math.ceil(rows / 4_096);
+    if (raffled * draw + held.length * 15 * rows > 1_300_000) refuse('E-LOTTERY', `${where}.places`, `${label(l)} draws ${raffled} and names ${held.length} NFTs of its own stash of ${rows}: one pull takes them all out, and that would pass what one transaction can compute (BadLottery).`, 'Fewer raffled places (about 200 at most in a small stash), or a smaller stash.');
+    if (held.length) warn('W-RAFFLE', `${where}.places`, `${label(l)} holds ${held.length === 1 ? 'its NFT' : 'its NFTs'} in its own stash: nobody, the owner included, can take ${held.length === 1 ? 'it' : 'them'} out while a place names ${held.length === 1 ? 'it' : 'them'}, and the winner pulls ${held.length === 1 ? 'it' : 'them'} after the draw, in any order with the money. If the NFT's collection lets someone freeze or move it (a permanent freeze, transfer or burn delegate), they could stop the prize: anyone may then make it a hold for its winner, so the rest of the round pays out.`);
     if (l.minSold && l.perWallet && !l.every && l.minSold > l.perWallet * 1000) warn('W-LOTTERY', `${where}.minSold`, `${label(l)} needs ${l.minSold} tickets sold, and each wallet may hold ${l.perWallet}: it takes at least ${Math.ceil(l.minSold / l.perWallet)} wallets.`);
-    const total = places.reduce((a, b) => a + b, 0);
+    const total = places.reduce((a, b, i) => a + b * placed[i].times, 0);
     if (total > 10_000) refuse('E-LOTTERY', `${where}.places`, `${label(l)}’s places add up to ${total / 100}% of the pot, more than all of it.`, 'Make them add up to 100% or less.');
     else if (total < 10_000) warn('W-LOTTERY', `${where}.places`, `${label(l)}’s places add up to ${total / 100}%: the other ${(10_000 - total) / 100}% of each pot stays in it for the next round, as do places nobody won.`);
     const ticketSplit = lotterySplit(l);
@@ -1483,30 +1725,37 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
     // A farm that shares what arrives releases it to the seats over its release span (its longest lock, a day at
     // least), by weight as it is released: nobody takes at once what landed before them. A seat alone still
     // earns all that is released while it is alone, however small it is.
-    const waiting = !f.rate && poolFillers(m).filter((x) => x.pool === f.rewards);
-    if (waiting?.length) warn('W-FARM-FIRST', `${where}.rewards`, `${label(f)} shares what arrives in “${f.rewards}” (${waiting.map((x) => x.by).join(', ')}), released over ${releaseWords(f)} as seats stay: whoever stakes first is credited all that is released while they are the only one in, even with 1 unit.`, 'Have the owner hold a small seat from the start, or tell stakers early ones share the first rewards among few.');
-    // A rewards mint that keeps a fee on transfers rounds each fee up, by less than a base unit (Token-2022). A sharing
-    // farm's refresh that changes no weight releases only a chunk at a time, ⌈1,000,000 / fee_bps⌉ base units or a
-    // hundredth of its line, so the rounding stays small; a fixed rate from a pool pays on every move, with no chunk.
-    const feePercent = Number(m.tokens.get(m.pool.get(f.rewards)?.currency)?.powers?.transferFeePercent ?? 0);
-    // A fee finer than a hundredth of a percent is refused with its token (E-PERCENT).
-    const feeBps = toBps(feePercent);
-    if (feeBps > 0 && !f.rate?.minted && !f.unpaid) {
-      const chunk = Math.ceil(1_000_000 / feeBps);
-      warn('W-FARM-FEE', `${where}.rewards`, f.rate
-        ? `${label(f)} pays its rate from “${f.rewards}”, whose token keeps ${feePercent}% of every transfer, each fee rounded up: every move pays from the pool and can lose up to a base unit to the rounding, so a refresh anyone can send every few seconds turns a slow rate into fees (they go to the mint’s fee collector, not to anyone in the farm).`
-        : `${label(f)}’s rewards keep ${feePercent}% of every transfer, each fee rounded up: a refresh that changes no seat’s weight releases a chunk at a time, ${chunk.toLocaleString('en-US')} base units or a hundredth of what is being released if that is less, the rest waiting for the next move that releases it; a release of a few base units a second, or a watched NFT moved back and forth with a refresh each time, can still lose a base unit a move to the rounding.`,
-        'Give the rewards token enough decimals that a second’s release is many base units, or use one without a fee.');
-    }
+    // Its rewards land in a vault of its own (`["rewards", farm]`): `rewards` names their token, never a pool.
+    if (f.rewards && !m.tokens.has(f.rewards)) {
+      if (m.pool.has(f.rewards)) refuse('E-FARM', `${where}.rewards`, `${label(f)} names the pool “${f.rewards}” for its rewards: a farm’s rewards land in a vault of its own now, and "rewards" names their token.`, `Write "rewards": "${m.pool.get(f.rewards).currency}", and send the farm what it shares with "farm:${f.key}" (in a split, or a schedule that pays it) or "seed".`);
+      else token(f.rewards, `${where}.rewards`);
+    }
+    const rewardsToken = m.tokens.get(f.rewardsToken);
+    const fills = farmFillers(m).filter((x) => x.farm === f.key);
+    if (f.seed !== undefined) units(f.seed, rewardsToken, `${where}.seed`, `The seed of ${label(f)}`);
+    if (!f.rate?.minted && Number(f.rate?.perDay ?? 1) > 0 && !fills.length)
+      warn('W-FARM-DRY', `${where}`, `${label(f)} ${f.rate ? 'pays its rate from what its rewards vault holds free' : 'shares what lands in its rewards vault'}, and nothing in this spec sends it any: its seats earn nothing until someone does.`, `Seed it ("seed"), send it a share of a sale ("farm:${f.key}" in a split), or pay it with a schedule ("to": "farm:${f.key}").`);
+    // A farm that shares what arrives releases it to the seats over its release span (its longest lock, a day at
+    // least), by weight as it is released: nobody takes at once what landed before them. A seat alone still
+    // earns all that is released while it is alone, however small it is.
+    if (!f.rate && fills.length) warn('W-FARM-FIRST', `${where}.rewards`, `${label(f)} shares what lands in its rewards vault (${fills.map((x) => x.by).join(', ')}), released over ${releaseWords(f)} as seats stay: whoever stakes first is credited all that is released while they are the only one in, even with 1 unit.`, 'Have the owner hold a small seat from the start, or tell stakers early ones share the first rewards among few.');
+    // A rewards mint that keeps a fee on transfers: what lands in the vault and what each seat is paid arrive less it.
+    const feePercent = Number(rewardsToken?.powers?.transferFeePercent ?? 0);
+    if (toBps(feePercent) > 0 && !f.rate?.minted)
+      warn('W-FARM-FEE', `${where}.rewards`, `${label(f)}’s rewards keep ${feePercent}% of every transfer: what lands in its vault arrives less that, and so does what each seat is paid.`, 'Use a rewards token without a fee, or say so to stakers.');
     if (!ofCollectibles) {
       const tok = token(f.stakes, `${where}.stakes`);
       if (tok?.wsol) warn('W-FARM', `${where}.stakes`, `${label(f)} stakes SOL: players stake wrapped SOL, which their wallet makes for them.`);
       if (f.item) refuse('E-FARM', `${where}.item`, `${label(f)} stakes a token, so it takes no item.`, 'Remove "item", or make it a farm of collectibles ("stakes": "collectibles").');
       if (f.custody === 'watch') refuse('E-FARM', `${where}.custody`, `${label(f)} stakes a token: its boosters can’t be left free and watched, or one sold could keep boosting.`, 'Use "custody": "escrow" or "freeze", or make it a farm of collectibles.');
     }
-    // Early exits, unbonding and tolls (farm.rs): a fee leaves to a burn or a pool of its token, checked once at open.
+    // Early exits (farm.rs): a fee leaves to a burn, a pool of its token or the farm's own vault, checked once at open.
     const exits = (f.tiers ?? []).some((t) => Number(t.exitFee ?? 0) > 0);
     const sinkOk = (to, at, tokenKey, what) => {
+      if (to === 'rewards') {
+        if (tokenKey !== f.rewardsToken) refuse('E-FARM', at, `${label(f)} sends ${what} into its own rewards vault, but it stakes ${m.tokens.get(tokenKey)?.symbol ?? tokenKey} and its rewards are ${m.tokens.get(f.rewardsToken)?.symbol ?? f.rewardsToken} (WrongMint).`, 'Send it to a burn or a pool, or make its rewards its staked token.');
+        return;
+      }
       if (to === 'burn') {
         if (m.tokens.get(tokenKey)?.wsol) refuse('E-WSOL-BURN', at, `${label(f)} burns ${what} in SOL, and wrapped SOL cannot be burned: every exit or harvest that owes it would fail.`, 'Send it to a pool instead.');
         return;
@@ -1515,37 +1764,35 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
       if (p && tokenKey && p.currency !== tokenKey) refuse('E-POOL-MINT', at, `${label(f)} sends ${what} to “${p.key}”, which holds ${m.tokens.get(p.currency)?.symbol ?? p.currency}, not ${m.tokens.get(tokenKey)?.symbol ?? tokenKey} (WrongMint).`, `Send it to a pool of ${m.tokens.get(tokenKey)?.symbol ?? tokenKey}.`);
     };
     if (ofCollectibles && exits) refuse('E-FARM', `${where}.tiers`, `${label(f)} stakes collectibles: there is no stake to take an exit fee from (BadFarm). A collectible leaves early by a recipe that lowers its lock.`, 'Remove "exitFee", and give the farm a "lockAttribute" and a recipe that lowers it.');
-    if (ofCollectibles && f.unbond) refuse('E-FARM', `${where}.unbond`, `${label(f)} stakes collectibles: unbonding is a stake of tokens' wait (BadFarm).`, 'Remove "unbond".');
-    else fourByteSeconds(f.unbond, `${where}.unbond`);
-    if (!ofCollectibles && exits && !f.exitFeeTo) refuse('E-FARM', `${where}.exitFeeTo`, `${label(f)} has an early-exit fee but does not say where it goes (BadFarm).`, 'Add "exitFeeTo": "burn" or "pool:<key>".');
+    if (!ofCollectibles && exits && !f.exitFeeTo) refuse('E-FARM', `${where}.exitFeeTo`, `${label(f)} has an early-exit fee but does not say where it goes (BadFarm).`, 'Add "exitFeeTo": "burn", "rewards" or "pool:<key>".');
     if (!ofCollectibles && f.exitFeeTo) sinkOk(f.exitFeeTo, `${where}.exitFeeTo`, f.stakes, 'its exit fees');
     (f.tiers ?? []).forEach((t, i) => percent(t.exitFee, `${where}.tiers[${i}].exitFee`));
-    if (f.toll) {
-      sinkOk(f.toll.to, `${where}.toll.to`, m.pool.get(f.rewards)?.currency, 'its toll');
-      percent(f.toll.percent, `${where}.toll.percent`);
-    }
-    if (!ofCollectibles && exits) warn('W-FARM', `${where}.tiers`, `${label(f)}’s tiers with an early exit keep their rewards until the lock has run (no harvest or compound before), and leaving early gives up what the seat is owed as well as the fee: ${f.rate ? (f.rate.minted ? 'burned' : `sent back to “${f.rewards}”`) + ' in the same move, never to the other seats' : `back to “${f.rewards}”, released again with the rest`}.`);
-    if (f.exitFeeTo === `pool:${f.rewards}`) warn('W-FARM', `${where}.exitFeeTo`, `${label(f)} sends early-exit fees to its own rewards pool: the stakers who stay share them.`);
-    if (f.unpaid) warn('W-FARM', `${where}.rewards`, `${label(f)} pays nothing: its rewards pool “${f.rewards}” is opened empty, for staking only to qualify (a stake gate reads it).`);
+    if (!ofCollectibles && exits) warn('W-FARM', `${where}.tiers`, `${label(f)}’s tiers with an early exit may leave before the lock for the fee, keeping the rewards they were credited (a tier's extra weight can be bought for its exit fee): pick the fee with that in mind.`);
+    if (f.exitFeeTo === 'rewards') warn('W-FARM', `${where}.exitFeeTo`, `${label(f)} sends early-exit fees into its own rewards vault: the stakers who stay share them.`);
     if (ofCollectibles && f.item) {
       const it = item(f.item, `${where}.item`);
       if (it && it.kind === 'normal') refuse('E-FARM', `${where}.item`, `${label(f)} takes ${label(it)}, a normal item: only collectibles can be staked.`, `Make ${label(it)} a collectible.`);
       if (it?.soulbound && (f.custody ?? 'escrow') === 'escrow') refuse('E-FARM', `${where}.custody`, `${label(f)} holds collectibles in escrow, and ${label(it)} is soulbound: it can’t move to the game.`, 'Use "custody": "freeze", or a collectible that is not soulbound.');
     }
     if (f.custody === 'watch' && listOf(f.growth).some((g) => g.streak)) refuse('E-FARM', `${where}.growth`, `${label(f)} watches NFTs left free in their wallets and counts a streak: one leaves by being moved, with nothing to set its streak back to 0, so the program refuses it (BadFarm).`, 'Use "custody": "escrow" or "freeze" for a streak, or drop "streak".');
-    if (f.custody === 'watch') warn('W-FARM-CUSTODY', `${where}.custody`, `${label(f)} watches NFTs left free in their wallets: one sold while staked stops earning for its staker (what its seat was owed ${f.rate ? (f.rate.minted ? 'is burned' : `goes back to “${f.rewards}”`) + ', never to the other seats' : `goes back to “${f.rewards}”, released again with the rest`}), and its new holder can take the seat over, paying the last staker back the seat’s rent.`);
+    if (f.custody === 'watch') warn('W-FARM-CUSTODY', `${where}.custody`, `${label(f)} watches NFTs left free in their wallets: one sold while staked stops earning for its staker (what its seat was owed ${f.rate ? (f.rate.minted ? 'is never minted' : 'stays free in its vault') + ', never to the other seats' : 'goes back to its vault, released again with the rest'}), and its new holder can take the seat over, paying the last staker back the seat’s rent.`);
     else if (f.custody === 'freeze') warn('W-FARM-CUSTODY', `${where}.custody`, `${label(f)} locks NFTs in their wallets (a Core freeze, Token Metadata’s lock, a compressed NFT’s freeze), with the game the only key that unlocks them. For ordinary Core assets, issuer metadata or plugin growth can make unfreezing fail; a soulbound asset needs no extra freeze. This also applies to token-seat boosters.`, 'Use escrow for transferable collectibles, or retain freeze only with a trusted issuer and controlled metadata changes.');
     else if (ofCollectibles || (f.boosts ?? []).length) warn('W-FARM-CUSTODY', `${where}.custody`, `${label(f)} escrows collectibles. This avoids Core’s unfreeze operation, but issuer-controlled transfer rules can still block return. Soulbound collectibles require explicit freeze custody.`);
-    pool(f.rewards, `${where}.rewards`);
     const tiers = f.tiers ?? [{ lock: 0, multiplier: 1 }];
     if (tiers.length > LIMITS.tiers) refuse('E-FARM', `${where}.tiers`, `${label(f)} has ${tiers.length} lock tiers; a farm has at most ${LIMITS.tiers}.`, 'Merge tiers.');
+    tooMany((f.boosts ?? []).length, LIMITS.farmRules, 'E-FARM', `${where}.boosts`, `${label(f)} has ${(f.boosts ?? []).length} boosts`, 'BadFarm', 'Keep the boosts that matter.');
+    tooMany(listOf(f.gate).length, LIMITS.farmRules, 'E-FARM', `${where}.gate`, `${label(f)}’s gate has ${listOf(f.gate).length} rules`, 'BadFarm', 'Keep the rules that matter.');
+    tooMany(listOf(f.growth).length, LIMITS.farmRules, 'E-FARM', `${where}.growth`, `${label(f)} has ${listOf(f.growth).length} growths`, 'BadFarm', 'Keep the numbers that matter.');
+    for (const [i, g] of listOf(f.growth).entries()) tooMany((g.levels ?? []).length, LIMITS.growthSteps, 'E-FARM', `${where}.growth[${i}].levels`, `${label(f)}’s growth of “${g.attribute ?? 'xp'}” has ${(g.levels ?? []).length} levels`, 'BadFarm', 'Use fewer levels.');
     for (const [i, t] of tiers.entries()) {
       fourByteSeconds(t.lock, `${where}.tiers[${i}].lock`);
+      // A prize given on leaving needs a lock, or it would be given again and again (BadFarm).
+      if (t.prize && !(toSeconds(t.lock ?? 0) > 0)) refuse('E-FARM', `${where}.tiers[${i}].lock`, `${label(f)}’s tier ${i} gives a prize with no lock: stakes could come and go, and take it again and again (BadFarm).`, 'Give the tier a "lock" above 0.');
+      if (t.earnsFor !== undefined) fourByteSeconds(t.earnsFor, `${where}.tiers[${i}].earnsFor`);
       const bps = Math.round((t.multiplier ?? 1) * 10_000);
       if (bps <= 0 || bps > LIMITS.maxTierBps) refuse('E-FARM', `${where}.tiers[${i}].multiplier`, `${label(f)}’s tier ${i} multiplies by ${t.multiplier}: a tier is above 0 and at most x11.`, 'Use a multiplier above 0, up to 11.');
       else if (bps < 10_000) warn('W-FARM', `${where}.tiers[${i}].multiplier`, `${label(f)}’s tier ${i} weighs x${t.multiplier}, less than what it stakes: a flexible tier that earns less.`);
     }
-    if ((f.boosts ?? []).length > LIMITS.boosts) refuse('E-FARM', `${where}.boosts`, `${label(f)} has ${f.boosts.length} boosts; a farm has at most ${LIMITS.boosts}.`, 'Merge boosts.');
     for (const [i, b] of (f.boosts ?? []).entries()) {
       rule(b.when, `${where}.boosts[${i}].when`, `${label(f)}’s boost`);
       effect(b.add, `${where}.boosts[${i}].add`, `${label(f)}’s boost`);
@@ -1553,7 +1800,6 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
     boostPercent(f.maxBoostPercent, `${where}.maxBoostPercent`);
     if ((f.boosts ?? []).length && !(f.maxBoostPercent > 0)) warn('W-FARM', `${where}.maxBoostPercent`, `${label(f)} has boosts but no "maxBoostPercent", so they add nothing (the cap is 0).`, 'Set "maxBoostPercent", for example 100 (at most double).');
     // A fixed rate (`rate`), growth (`growth`) and missions (tiers' `prize`).
-    const rewardsToken = m.poolToken(f.rewards);
     const growths = listOf(f.growth);
     const prized = tiers.some((t) => t.prize);
     const rolls = tiers.some((t) => t.roll);
@@ -1561,12 +1807,14 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
       const perDay = units(f.rate.perDay, rewardsToken, `${where}.rate.perDay`, `${label(f)}’s rate`);
       if (!(Number(f.rate.perDay) > 0)) {
         if (!growths.length && !prized && !rolls) warn('W-FARM', `${where}.rate.perDay`, `${label(f)}’s fixed rate pays nothing a day, and it grows nothing, gives no prize and rolls no mission: staking there only counts (a stake gate can read it).`, 'Set "perDay" above 0, or give it "growth", a mission prize or a mission roll.');
-      } else if (!ofCollectibles && perDay !== null && (perDay * 1_000_000n) / 10n ** BigInt(m.tokens.get(f.stakes)?.decimals ?? 0) === 0n) warn('W-FARM', `${where}.rate.perDay`, `${label(f)}’s rate of ${f.rate.perDay} a day is less than one base unit for each 1,000,000 base units staked.`, 'Raise "perDay".');
-      if (f.rate.minted && rewardsToken && !rewardsToken.gameMints) refuse('E-MINT-NOT-OURS', `${where}.rate.minted`, `${label(f)} mints its rewards, but the project cannot mint ${rewardsToken.symbol}.`, 'Pay the rate from the pool ("minted": false), or reward in a token with source "project".');
-      if (!f.rate.minted) warn('W-FARM-RATE', `${where}.rate`, `${label(f)} pays its fixed rate from “${f.rewards}” while it lasts: what the pool can’t cover is not owed later, and every seat earns less once it runs dry.`, 'Keep the pool filled (a schedule), or mint the rewards.');
+      } else if (!ofCollectibles && !f.rate.shared && perDay !== null && (perDay * 1_000_000n) / 10n ** BigInt(m.tokens.get(f.stakes)?.decimals ?? 0) === 0n) warn('W-FARM', `${where}.rate.perDay`, `${label(f)}’s rate of ${f.rate.perDay} a day is less than one base unit for each 1,000,000 base units staked.`, 'Raise "perDay".');
+      if (f.rate.minted && rewardsToken && !rewardsToken.gameMints) refuse('E-MINT-NOT-OURS', `${where}.rate.minted`, `${label(f)} mints its rewards, but the project cannot mint ${rewardsToken.symbol}.`, 'Pay the rate from its rewards vault ("minted": false), or reward in a token with source "project".');
+      if (!f.rate.minted) warn('W-FARM-RATE', `${where}.rate`, `${label(f)} pays its fixed rate from what its rewards vault holds free while it lasts: what it can’t cover is not owed later, and every seat earns less once it runs dry.`, `Keep it funded ("farm:${f.key}" in a split or a schedule), or mint the rewards.`);
       else rateRoom(f, warn, m);
+      if (f.rate.halveEvery !== undefined) fourByteSeconds(f.rate.halveEvery, `${where}.rate.halveEvery`);
+      if (f.rate.shared) warn('W-FARM-RATE', `${where}.rate.shared`, `${label(f)}’s rate of ${f.rate.perDay} a day is the whole farm’s, shared by weight while anything is staked${f.rate.halveEvery ? `, halving every ${f.rate.halveEvery} from when it opens` : ''}: an emission budget, so each seat’s share falls as more stake.`);
+      else if (f.rate.halveEvery) warn('W-FARM-RATE', `${where}.rate.halveEvery`, `${label(f)}’s rate halves every ${f.rate.halveEvery} from when it opens, for every seat.`);
     }
-    if (growths.length > LIMITS.growths) refuse('E-FARM', `${where}.growth`, `${label(f)} grows ${growths.length} things; a farm grows at most ${LIMITS.growths}.`, 'Merge them.');
     const names = growths.flatMap((g) => [g.attribute ?? 'xp', ...((g.levels ?? []).length ? [g.level ?? 'level'] : [])]);
     if (names.some((n, i) => names.indexOf(n) !== i)) refuse('E-FARM', `${where}.growth`, `${label(f)} grows the same attribute twice (${names.join(', ')}): each growth writes names of its own.`, 'Give each growth its own "attribute" (and "level").');
     for (const [i, g] of growths.entries()) {
@@ -1583,7 +1831,7 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
       for (const [i, t] of tiers.entries())
         if (toSeconds(t.lock ?? 0) > 0 && toSeconds(t.lock ?? 0) >= runs) warn('W-FARM', `${where}.tiers[${i}].lock`, `${label(f)} runs ${f.runs}, and its tier ${i} locks ${t.lock}: nobody could ever take it (a seat must be free by the farm’s end, and the farm takes none at its end).`, 'Shorten the lock, or let the farm run longer.');
       const end = farmEndWords(f);
-      warn('W-FARM', `${where}.runs`, `${label(f)} runs ${f.runs} from when it goes live: it takes no stake at its end or after it (nor one at a tier whose lock would run past it), and pays and grows nothing more; seats leave and harvest what they were owed as before.${end ? ` It shares its pool: ${end}.` : ''}`);
+      warn('W-FARM', `${where}.runs`, `${label(f)} runs ${f.runs} from when it goes live: it takes no stake at its end or after it (nor one at a tier whose lock would run past it), and pays and grows nothing more; seats leave and harvest what they were owed as before.${end ? ` It shares what lands: ${end}.` : ''}`);
     }
     // Missions' prizes (prize.rs): a tier's, given as a collectible that stayed its lock leaves its seat.
     if (f.prize) refuse('E-FARM', `${where}.prize`, `${label(f)} names where its prizes come from: each tier names its whole prize.`, 'Move it into each tier: "prize": { "gives": "tokens", "amount": n, "from": "mint" or "pool:<key>" } (or an item, an NFT, a roll of a chest).');
@@ -1615,7 +1863,7 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
     if (f.lockAttribute !== undefined && f.lockAttribute === f.upkeepAttribute) refuse('E-FARM', `${where}.upkeepAttribute`, `${label(f)} keeps its lock and its upkeep under the same name, “${f.lockAttribute}”.`, 'Give each its own name.');
     if (f.upkeepAttribute !== undefined && ofCollectibles) {
       const sells = m.recipes.some((r) => (r.raises ?? []).some((x) => x.key === f.upkeepAttribute && x.fromNow && toBy(x.by) > 0));
-      warn('W-FARM-UPKEEP', `${where}.upkeepAttribute`, `${label(f)} pays and grows a collectible only until the time under “${f.upkeepAttribute}”: one staked dry counts for nothing until it is topped up and its seat refreshed, and what a seat is credited after its upkeep runs out is not paid (in a farm at a fixed rate it is burned or goes back where the rate came from, never to the other seats; in a farm that shares its pool it goes back to the pool and is released again with the rest).${sells ? '' : ' Nothing in this spec sells it: only the authority (Set) could.'}`, sells ? undefined : `Add a recipe that raises "${f.upkeepAttribute}" with "fromNow": true.`);
+      warn('W-FARM-UPKEEP', `${where}.upkeepAttribute`, `${label(f)} pays and grows a collectible only until the time under “${f.upkeepAttribute}”: one staked dry counts for nothing until it is topped up and its seat refreshed, and a seat earns nothing after its upkeep runs out, however late it is next touched (no refresh is needed at its end).${sells ? '' : ' Nothing in this spec sells it: only the authority (Set) could.'}`, sells ? undefined : `Add a recipe that raises "${f.upkeepAttribute}" with "fromNow": true.`);
       // A known limit of the program: a recipe with a pay line waits while the project is paused or suspended
       // (craft.rs), and the upkeep's clock keeps running. With every top-up paid and capped below a mission's lock, a
       // switch on for longer than a player could top up ahead dries the seat, and a seat that ran dry before its lock
@@ -1631,12 +1879,11 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
     }
     if (f.gate && !ofCollectibles) refuse('E-FARM', `${where}.gate`, `${label(f)} stakes a token: a gate only says which collectibles a farm of collectibles takes.`, 'Remove the gate, or use a boost to favour holders.');
     const gates = listOf(f.gate);
-    if (gates.length > LIMITS.gates) refuse('E-FARM', `${where}.gate`, `${label(f)}’s gate has ${gates.length} rules; a farm’s has at most ${LIMITS.gates}.`, 'Keep the rules that matter.');
     for (const [i, r] of gates.entries()) rule(r, Array.isArray(f.gate) ? `${where}.gate[${i}]` : `${where}.gate`, label(f));
     // No lock rule for rewards that land: a sharing farm releases each over its release span, and a fixed rate pays by
     // the second, so a stake just before a reward lands and gone right after takes only what was released meanwhile.
     // A farm whose rewards are a share of what players pay hands holders the project's revenue.
-    const revenue = fillers.filter((x) => x.pool === f.rewards && /^(box|item|payment):/.test(x.by));
+    const revenue = fills.filter((x) => /^(box|item|payment):/.test(x.by));
     if (revenue.length)
       warn('W-REVENUE-SHARE', where, `${label(f)} pays stakers a share of what players spend (${revenue.map((x) => x.by).join(', ')}). Paying holders out of a project’s revenue is what regulators look at when they decide whether a token is a security.`, 'Fine on devnet. Before mainnet, ask counsel, or reward stakers from emissions (a schedule that mints a game token) rather than from sales.');
   }
@@ -1644,6 +1891,7 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
   // ---- contests (contest.rs)
   for (const c of m.contests) {
     const where = `economy.contests.${c.key}`;
+    tooMany((c.deciders ?? []).length, LIMITS.deciders, 'E-CONTEST', `${where}.deciders`, `${label(c)} has ${(c.deciders ?? []).length} deciders`, 'BadContest', 'Name fewer deciders.');
     const tok = token(c.currency, `${where}.currency`);
     confidential(tok, `${where}.currency`, label(c), 'E-CONTEST');
     startsFrozen(tok, `${where}.currency`, label(c), 'E-CONTEST', 'BadContest');
@@ -1670,10 +1918,9 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
       if (sharesOf(c.split).length) refuse('E-CONTEST', `${where}.split`, `${label(c)}’s entries stake NFTs: there is no money to take shares of (BadContest).`, 'Remove the split.');
       if (c.stake !== undefined) refuse('E-CONTEST', `${where}.stake`, `${label(c)}’s entries stake one NFT each, not tokens (BadContest).`, 'Remove "stake".');
       rule(c.stakeNft, `${where}.stakeNft`, `${label(c)}’s stake`);
-      warn('W-NFT-PRICE', `${where}.stakeNft`, `${label(c)}’s entries each stake one NFT, and the NFTs are the pot: each winning entry takes its own back and one loser’s, in the order the entries are claimed (anyone may claim them), and the losers’ NFTs the winners leave go to whoever opened it. The project holds every NFT until its entry is claimed.`);
+      warn('W-NFT-PRICE', `${where}.stakeNft`, `${label(c)}’s entries each stake one NFT, and the NFTs are the pot: each winner takes its own back and its share of the losers’ (${c.losersEach ? `at most ${c.losersEach}` : 'all of them, shared'}; the first to enter on the winning side take one more when they don’t divide evenly), each picking which, and the losers’ NFTs the winners leave go to whoever opened it. Losers send nothing. The project holds every NFT until it is claimed.`);
     }
     const deciders = c.deciders ?? [];
-    if (deciders.length > LIMITS.deciders) refuse('E-CONTEST', `${where}.deciders`, `${label(c)} names ${deciders.length} deciders; a contest takes at most ${LIMITS.deciders}.`, 'Name fewer keys.');
     deciders.forEach((k, i) => isAddress(k) || refuse('E-REF', `${where}.deciders[${i}]`, `${label(c)}’s decider “${k}” is not a public address.`, 'Write the results server’s public key (never its private key).'));
     // A contest of NFTs counts its pot in NFTs, so its least pot is a whole number of them.
     const minPot = c.stakeNft ? wholeCount(c.minPot) : units(c.minPot, tok, `${where}.minPot`, `${label(c)}’s least pot`);
@@ -1693,8 +1940,8 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
     startsFrozen(tok, `${where}.currency`, label(a), 'E-AUCTION', 'BadAuction');
     const reserve = a.bidNfts ? BigInt(Number.isInteger(a.reserve) ? a.reserve : 1) : units(a.reserve, tok, `${where}.reserve`, `${label(a)}’s reserve`);
     if (a.bidNfts) {
-      // Bids of NFT bundles (auction.rs): no split, and a reserve a bid of up to four can reach.
-      if (a.reserve !== undefined && !(Number.isInteger(a.reserve) && a.reserve >= 1 && a.reserve <= 3)) refuse('E-AUCTION', `${where}.reserve`, `${label(a)}’s bids are bundles of NFTs: its reserve counts NFTs, from 1 to 3, the most one bid holds (BadAuction).`, 'Write a reserve of 1 to 3.');
+      // Bids of NFT bundles (auction.rs): no split, and a reserve a bid of up to three can reach.
+      if (a.reserve !== undefined && !(Number.isInteger(a.reserve) && a.reserve >= 1 && a.reserve <= MAX_BID_NFTS)) refuse('E-AUCTION', `${where}.reserve`, `${label(a)}’s bids are bundles of NFTs: its reserve counts NFTs, from 1 to ${MAX_BID_NFTS}, the most one bid holds (BadAuction).`, `Write a reserve of 1 to ${MAX_BID_NFTS}.`);
       if (sharesOf(a.split).length) refuse('E-AUCTION', `${where}.split`, `${label(a)}’s bids are NFTs: there is no money to take shares of (BadAuction).`, 'Remove the split.');
       rule(a.bidNfts, `${where}.bidNfts`, `${label(a)}’s bids`);
       outsideAttribute(a.bidNfts, `${where}.bidNfts`, `${label(a)}’s bids`);
@@ -1772,8 +2019,6 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
       if (gives.gives !== 'tokens') refuse('E-GRANT', `${where}.list[${i}].amount`, `${label(g)}’s list names an amount, but it gives ${gives.gives ?? 'nothing'}: only a grant of a fixed amount of tokens takes one.`, 'Remove "amount", or make the grant give tokens.');
       else if (t && units(e.amount, t, `${where}.list[${i}].amount`, 'A listed amount') > units(gives.amount, t, `${where}.prize.amount`, label(g))) refuse('E-GRANT', `${where}.list[${i}].amount`, `${label(g)}’s list gives ${e.wallet} ${e.amount}, more than the grant’s ${gives.amount} (OverPrize).`, 'Raise the grant’s amount to the largest listed, or lower this one.');
     }
-    if ((vouchers.length || keys.length) && (!l.perWallet || l.perWallet > MAX_RECEIPT_ROUNDS))
-      warn('W-GRANT-CAPACITY', `${where}.limits.perWallet`, `${label(g)} can pay each wallet at most ${MAX_RECEIPT_ROUNDS} distinct voucher rounds in one grant incarnation. Its round history is retained even after vouchers expire.`, `Use a wallet limit at or below ${MAX_RECEIPT_ROUNDS}, or start a new grant incarnation when the campaign ends.`);
     // A grant with no voucher key, no key list and no list is open: any wallet claims it, within its limits (grant.rs).
     if (open && showsNft(g.gate) && l.perPerson)
       warn('W-GRANT', `${where}.limits.perPerson`, `${label(g)} is open: "perPerson" counts only vouchers that name a person, so here it limits nothing (the wallet limits count each collectible shown).`, 'Remove "perPerson".');
@@ -1875,8 +2120,8 @@ export function check(economy, { network = 'devnet', now = Math.floor(Date.now()
       // A spec the steps can't be built from fails the same way when it is planned.
     }
     const ctx = setup && placeholderContext(setup.model);
-    const lists = { box: m.box, item: m.item, recipe: m.recipe, schedule: new Map(m.schedules.map((x) => [x.key, x])), lottery: m.lottery, grant: m.grant, farm: m.farm, auction: m.auction, pool: m.pool, seed: m.pool, fund: m.grant, stash: m.stash };
-    const paths = { box: 'boxes', item: 'items', recipe: 'recipes', schedule: 'schedules', lottery: 'lotteries', grant: 'grants', farm: 'farms', auction: 'auctions', pool: 'pools', seed: 'pools', fund: 'grants', stash: 'stashes', token: 'tokens', traits: 'traits' };
+    const lists = { box: m.box, item: m.item, recipe: m.recipe, schedule: new Map(m.schedules.map((x) => [x.key, x])), lottery: m.lottery, grant: m.grant, farm: m.farm, auction: m.auction, pool: m.pool, seed: m.pool, fund: m.grant, stash: m.stash, table: m.table };
+    const paths = { box: 'boxes', item: 'items', recipe: 'recipes', schedule: 'schedules', lottery: 'lotteries', grant: 'grants', farm: 'farms', auction: 'auctions', pool: 'pools', seed: 'pools', fund: 'grants', stash: 'stashes', table: 'tables', token: 'tokens', traits: 'traits' };
     for (const step of setup?.steps ?? []) {
       let bytes;
       try {
@@ -1927,16 +2172,16 @@ function many(x) {
 
 /**
  * A sharing farm's rounding: a release is credited by weight in steps of the total
- * weight ÷ 10¹² base units of the reward, and what is below a step waits uncredited, going back to the pool when the
+ * weight ÷ 10¹² base units of the reward, and what is below a step waits uncredited, freed in its vault when the
  * last seat leaves or the farm ends. A staked token with a great many base units (many decimals, a huge supply: a
  * memecoin) paying a reward of few units rounds every seat's share to nothing: an exact model of the farm found seats
  * losing all of rewards of 194 to 2,155 units at total weights around 7×10¹⁵. The weight is the most that can
  * plausibly be staked (the supply, else a billion whole tokens or the scenario's stake if larger) at the highest tier
- * and the largest boost; the reward, what lands in a release span (the pool's seed and a span of the steady inflow).
+ * and the largest boost; the reward, what lands in a release span (the farm's seed and a span of the steady inflow).
  */
 function farmRounding(f, row, warn, m) {
-  if (!f || f.rate || f.unpaid || f.stakes === 'collectibles') return;
-  const staked = m.tokens.get(f.stakes), pool = m.pool.get(f.rewards), reward = m.tokens.get(pool?.currency);
+  if (!f || f.rate || f.stakes === 'collectibles') return;
+  const staked = m.tokens.get(f.stakes), reward = m.tokens.get(f.rewardsToken);
   if (staked?.decimals === undefined || reward?.decimals === undefined) return;
   const scenario = Number(m.scenario.staked?.[f.key] ?? 0);
   const whole = staked.supply !== undefined ? Number(staked.supply) : Math.max(1e9, scenario);
@@ -1946,18 +2191,18 @@ function farmRounding(f, row, warn, m) {
   if (!(weight > 1e12)) return;
   const step = weight / 1e12;
   const span = releaseSeconds(f) / 86_400;
-  const units = (Number(pool.seed ?? 0) + Number(row.rewardsPerDay ?? 0) * span) * 10 ** reward.decimals;
+  const units = (Number(f.seed ?? 0) + Number(row.rewardsPerDay ?? 0) * span) * 10 ** reward.decimals;
   if (!(units > 0) || units >= 100 * step) return;
-  const [ss, rs] = [staked.symbol ?? f.stakes, reward.symbol ?? pool.currency];
+  const [ss, rs] = [staked.symbol ?? f.stakes, reward.symbol ?? f.rewardsToken];
   const basis = `${staked.supply !== undefined ? `its supply of ${many(whole)}` : whole > 1e9 ? `the scenario’s ${many(whole)} staked` : `a billion ${ss} (assumed when no supply is given)`} at ${staked.decimals} decimals${top > 1 ? `, at x${top}` : ''}${boost > 1 ? `, boosted +${f.maxBoostPercent}%` : ''}`;
   const lost = units < step
-    ? 'each seat’s share of it rounds down to nothing, so no seat is credited any of it, and it goes back to the pool when the last seat leaves or the farm ends'
-    : `up to a step of it at a time waits uncredited until more adds up to a step, and what waits goes back to the pool when the last seat leaves or the farm ends, so the seats can lose up to ${Math.min(100, Math.round((step / units) * 100))}% of a release`;
+    ? 'each seat’s share of it rounds down to nothing, so no seat is credited any of it, and it is freed in its vault when the last seat leaves or the farm ends'
+    : `up to a step of it at a time waits uncredited until more adds up to a step, and what waits is freed in its vault when the last seat leaves or the farm ends, so the seats can lose up to ${Math.min(100, Math.round((step / units) * 100))}% of a release`;
   warn('W-FARM-ROUNDING', `economy.farms.${f.key}.stakes`, `${label(f)} shares its rewards by weight, and the stakes in it can weigh up to about ${many(weight)} base units of ${ss} (${basis}). At that weight the program can share a release only in steps of about ${many(step)} base units of ${rs}, and about ${many(units)} land in it over a release (${releaseWords(f)}): ${lost}.`, `Stake a token with fewer base units (fewer decimals or a smaller supply), or fund larger rewards: about ${many(100 * step)} base units of ${rs} (${(100 * step) / 10 ** reward.decimals >= 1 ? many((100 * step) / 10 ** reward.decimals) : +((100 * step) / 10 ** reward.decimals).toPrecision(3)} ${rs}) or more a release keeps the rounding under 1%.`);
 }
 
 /**
- * A fixed rate that mints: every move mints the rate's due as far as the mint has room for under the most a
+ * A fixed rate that mints: each payout mints what a seat is owed as far as the mint has room for under the most a
  * mint can ever hold (u64::MAX base units, less its supply), and what it can't mint is never owed later. What the rate
  * could mint is the rate times the most that can plausibly be staked (a token's supply, else a billion whole tokens or
  * the scenario's stake if larger; a collectible's supply, else 10,000 or the scenario's count), at the highest tier and
@@ -1966,7 +2211,7 @@ function farmRounding(f, row, warn, m) {
  */
 function rateRoom(f, warn, m) {
   if (!(Number(f.rate.perDay) > 0)) return;
-  const reward = m.poolToken(f.rewards);
+  const reward = m.tokens.get(f.rewardsToken);
   if (reward?.decimals === undefined) return;
   const scenario = Number(m.scenario.staked?.[f.key] ?? 0);
   const ofCollectibles = f.stakes === 'collectibles';
@@ -1976,10 +2221,10 @@ function rateRoom(f, warn, m) {
   const top = Math.max(1, ...(f.tiers ?? []).map((t) => Number(t.multiplier ?? 1)));
   const boost = (f.boosts ?? []).length ? 1 + Number(f.maxBoostPercent ?? 0) / 100 : 1;
   const days = f.runs ? toSeconds(f.runs) / 86_400 : 3650;
-  const units = Number(f.rate.perDay) * count * top * boost * days * 10 ** reward.decimals;
+  const units = Number(f.rate.perDay) * (f.rate.shared ? 1 : count * top * boost) * days * 10 ** reward.decimals;
   const room = 2 ** 64;
   if (!(units >= room / 10)) return;
-  const [rs, unit] = [reward.symbol ?? m.pool.get(f.rewards)?.currency, ofCollectibles ? 'collectible' : (staked?.symbol ?? f.stakes)];
+  const [rs, unit] = [reward.symbol ?? f.rewardsToken, ofCollectibles ? 'collectible' : (staked?.symbol ?? f.stakes)];
   const basis = `${known ? `a supply of ${many(count)}` : count > (ofCollectibles ? 10_000 : 1e9) ? `the scenario’s ${many(count)}` : ofCollectibles ? '10,000 collectibles' : `a billion ${unit}`} staked${top > 1 ? ` at x${top}` : ''}${boost > 1 ? `, boosted +${f.maxBoostPercent}%` : ''}, ${f.runs ? `over its ${f.runs}` : 'over ten years'}`;
   const whole = room / 10 ** reward.decimals;
   warn('W-FARM-MINT-ROOM', `economy.farms.${f.key}.rate`, `${label(f)} mints ${f.rate.perDay} ${rs} a day for each ${unit} at x1: at ${basis}, that is about ${many(units)} base units, ${units >= room ? 'more than' : `${Math.round((units / room) * 100)}% of`} the most a mint can ever hold (about ${many(room)} base units, ${many(whole)} ${rs} at ${reward.decimals} decimals). Each move mints only what the mint still has room for, and what it can’t mint is never owed later: once ${rs}’s supply nears that, every seat is paid less than the rate, then nothing.`, `Lower "perDay", give the farm an end ("runs"), or reward in a token with fewer decimals.`);