@xgamesfun/solana 0.20.1 → 0.24.0

package/js/client/ix.js

@@ -16,14 +16,17 @@
 // Values are the IDL's own shapes (`chain/borsh.js`): addresses base58 strings, u64/u128/i64 bigints (or numbers),
 // enums 'Variant', { Variant: [values] } or { Variant: { field: value } }, structs with snake_case fields.
 import { addressBytes, encodeBase58, NO_ADDRESS } from '../chain/base58.js';
-import { encodeBorsh, encodeInstruction } from '../chain/borsh.js';
-import { concat, intLE, readUintLE, toBigInt, uintLE, utf8 } from '../chain/bytes.js';
+import { encodeAccount, encodeInstruction } from '../chain/borsh.js';
+import { compareBytes, concat, intLE, readUintLE, toBigInt, uintLE, utf8 } from '../chain/bytes.js';
 import { addressWithSeed, ASSOCIATED_TOKEN_PROGRAM, findProgramAddress, METAPLEX_METADATA_PROGRAM, SYSTEM_PROGRAM, SYSVAR_INSTRUCTIONS, SYSVAR_SLOT_HASHES, TOKEN_2022_PROGRAM, TOKEN_PROGRAM } from '../chain/pda.js';
 import { allocateWithSeedIx, createAccountWithSeedIx, initializeAccount3Ix, MINT_BYTES, TOKEN_ACCOUNT_BYTES } from '../chain/token.js';
 import { createAssociatedTokenAccountIdempotent, meta, transferLamports } from '../chain/programs.js';
 import { sha256 } from '../chain/sha256.js';
+import { MEMO_PROGRAM } from '../chain/token2022.js';
 import IDL from './idl/loot.js';
-import { lotteryOwed, lotteryStep } from './accounts.js';
+import { chosenAtPurchase, CLAIMED, decode, ENDED, idleRound, nftSlot, ownStash, paymentMint, placesPulled, prizePlacesOwed, roundFinished, roundWinners, shareOf, tokenRun } from './accounts.js';
+import { stream, TAG, weighted } from './random.js';
+import { tableBudget } from './sizes.js';
 import { ata, BUBBLEGUM_PROGRAM, COMPRESSION_PROGRAM, LOOT_PROGRAM, MPL_CORE_PROGRAM, NOOP_PROGRAM, pda, vault, VRF_QUEUE } from './pda.js';
 
 // The options of a call made without any: read-only, and typed so the generated declarations take any option.
@@ -35,6 +38,8 @@ export { IDL, ASSOCIATED_TOKEN_PROGRAM };
 export const TOKEN_METADATA_PROGRAM = METAPLEX_METADATA_PROGRAM;
 
 const ZERO_REFERENCE = new Uint8Array(32);
+/** The default address: names nobody, and nobody signs as it. */
+const NOBODY_KEY = '11111111111111111111111111111111';
 const hashToAddress = (hash) => encodeBase58(hash);
 
 /** 32 bytes a project names a call by (a match id, a payout's reason). Zeros when not given. */
@@ -54,6 +59,24 @@ const instructionDef = (name) => {
   return def;
 };
 
+/** The IDL's instructions, the longest tags first: the oracle's three callbacks keep 8-byte tags, every other
+ * instruction has a 1-byte one, which the first byte of an 8-byte tag may equal. */
+const BY_TAG = [...IDL.instructions].sort((a, b) => b.discriminator.length - a.discriminator.length);
+
+/** The IDL entry of the loot instruction whose data is `data` (its tag first), or null. */
+export const instructionOf = (data) => BY_TAG.find((i) => i.discriminator.length <= data.length && i.discriminator.every((b, j) => data[j] === b)) ?? null;
+
+/**
+ * An instruction's tail (`tokens::tail`): the accounts every NFT move hands Core (what a check its collection carries
+ * reads, an oracle's account) and every token transfer hands a transfer hook, after the route's own. It starts at the
+ * Memo program's account, which serves a transfer into an account that requires a memo; with none, it is empty. So
+ * `extra` (hook accounts, Core's adapters) goes after the Memo program, which this puts first.
+ */
+export function tailOf(extra = []) {
+  if (!extra.length) return [];
+  return [meta(MEMO_PROGRAM, false, false), ...extra.filter((m) => m.pubkey !== MEMO_PROGRAM)];
+}
+
 /** The accounts of an instruction in order, each with its group (`checkout`, `fee`, `side`, `piece`) or ''. */
 function leaves(list, group = '') {
   return list.flatMap((a) => (a.accounts ? leaves(a.accounts, a.name) : [{ ...a, group }]));
@@ -183,6 +206,28 @@ export function destinationAccounts(project, to, mint, { holders = {}, programs,
 }
 
 /** A split's destinations, in order. */
+/** The most shares a split kept to be paid later holds (`MAX_SHARES`, not in the IDL): a box's, a lottery's, a contest's,
+ * an auction's, an offer's or a listing's (a ninth is `BadShares`); a payment's own split has no such cap. */
+export const MAX_SHARES = 8;
+/** `shares`, refused here when a split kept to be paid later holds more than `MAX_SHARES`. */
+const stored = (shares = []) => {
+  if (shares.length > MAX_SHARES) throw new Error(`A split kept to be paid later holds at most ${MAX_SHARES} shares; this one has ${shares.length} (BadShares).`);
+  return shares;
+};
+
+/** The most traits a fresh item draws (`MAX_ITEM_TRAITS`, not in the IDL): each is written as its unit is minted, which
+ * one transaction must hold. */
+export const MAX_ITEM_TRAITS = 64;
+/** The longest name a fresh item's trait has, in bytes (`MAX_TRAIT_KEY`, not in the IDL). */
+export const MAX_TRAIT_KEY = 64;
+/** An item's `traits`, refused here past the program's caps (`BadItem` when the owner signs). */
+const traitsInCaps = (traits = []) => {
+  if (traits.length > MAX_ITEM_TRAITS) throw new Error(`An item draws at most ${MAX_ITEM_TRAITS} traits; this one draws ${traits.length} (BadItem).`);
+  const long = traits.find((t) => utf8(String(t.key)).length > MAX_TRAIT_KEY);
+  if (long) throw new Error(`A trait's name is at most ${MAX_TRAIT_KEY} bytes; “${String(long.key).slice(0, 24)}…” is ${utf8(String(long.key)).length} (BadItem).`);
+  return traits;
+};
+
 export const shareAccounts = (project, shares, mint, options) => shares.flatMap((s) => destinationAccounts(project, s.to, mint, options));
 
 /**
@@ -204,11 +249,22 @@ export const sharesBurn = (shares) => shares.some((s) => s.to === 'Burn');
 /**
  * The account each prize of a box's entries comes with at the roll, in entry order and each entry's prizes in order:
  * its item for an item, its pool for tokens from one, its stash for an NFT of one (a named one, or one at random). All
- * written: the roll takes from them. Tokens minted and rolls take none here.
+ * written: the roll takes from them. Tokens minted and rolls take none here. A fresh item's tables follow it while
+ * they fit the box's table budget (`tableBudget`), walked in entry order; an item whose tables don't fit what is left
+ * takes none, and is out of stock for that roll.
  */
-export function entryAccounts(project, entries) {
+export function entryAccounts(project, entries, items = {}) {
+  let budget = Math.max(0, tableBudget(entries));
   return entries.flatMap(({ prizes }) => prizes.flatMap((prize) => {
-    if (prize.Item) return [meta(pda.item(project, prize.Item[0]), false, true)];
+    // An item, compressed or not; a fresh one's tables after it, in the order of its traits (`items` maps an item's id
+    // to its decoded Item: one left out is taken as not fresh).
+    const id = prize.Item?.[0] ?? prize.Compressed?.item;
+    if (id !== undefined) {
+      const tables = traitTables(items[id]);
+      const fits = tables.length <= budget;
+      if (fits) budget -= tables.length;
+      return [meta(pda.item(project, id), false, true), ...(fits ? tables : []).map((t) => meta(pda.table(project, t), false, true))];
+    }
     if (prize.Tokens?.from.Pool) return [meta(pda.pool(project, prize.Tokens.from.Pool[0]), false, true)];
     const stash = prize.Nft?.stash ?? prize.Stash?.[0];
     return stash === undefined ? [] : [meta(pda.stash(project, stash), false, true)];
@@ -248,17 +304,42 @@ function boxPoolMints(box, poolMints) {
 /** Whether a box leaves its outcome to the oracle: more than one entry, or an entry gives a stash's NFT at random. */
 export const boxRolls = (entries) => entries.length > 1 || entries.some((e) => e.prizes.some((p) => p.Stash));
 
-/** What an order of `box` holds for the collectibles its roll may mint: a collectible's rent for each item the entry
- * with the most of them gives. */
-export const orderEscrow = (box) => ESCROW_LAMPORTS * BigInt(Math.max(0, ...box.entries.map((e) => e.prizes.filter((p) => p.Item).length)));
+/** The tables a fresh item's traits draw from, in the order of its traits (none for an item whose units are alike). */
+export const traitTables = (item) => (item?.traits ?? []).flatMap((t) => (t.from?.Table ? [t.from.Table[0]] : []));
+
+/** Whether a box gives a fresh item (one with traits): its units' traits are drawn by the oracle (`items` maps an
+ * item's id to its decoded Item, as `entryAccounts`). */
+export const boxFresh = (entries, items = {}) => entries.some((e) => e.prizes.some((p) => (items[p.Item?.[0] ?? p.Compressed?.item]?.traits ?? []).length > 0));
+
+/**
+ * What one prize a settle hands over may open or mint, at most: a collectible's Core asset with the program's plugins
+ * (about 0.004 SOL), a stash's NFT's new token account, a fresh compressed NFT's Sheet, a token account of a mint, the
+ * NFT rolled on's numbers or its stash row. A client's own figure (the program keeps no reserve): what a throwaway key
+ * that settles is funded with for each, and gives back unspent.
+ */
+export const SETTLE_RENT_UNIT = 6_000_000n;
+
+/**
+ * What a settle of an order of `opens` opens of `box` may open or mint, at most, in lamports: whoever settles pays it
+ * (the order lends nothing). For each draw of each open, each prize of the entry with the most of them that opens an
+ * account (a collectible, a stash's NFT, a fresh compressed NFT's Sheet: `items` maps an item's id to its decoded
+ * Item); once an order, each source of tokens it may pay, and the fate of the NFT it rolls on; one `SETTLE_RENT_UNIT`
+ * each. A throwaway key that settles is funded with it, and gives back what it doesn't spend.
+ */
+export function settleRent(box, opens = 1, items = {}) {
+  const rents = (p) => Boolean(p.Item || p.Nft || p.Stash || (p.Compressed && (items[p.Compressed.item]?.traits ?? []).length));
+  const most = Math.max(0, ...box.entries.map((e) => e.prizes.filter(rents).length));
+  const sources = new Set(box.entries.flatMap((e) => e.prizes.flatMap((p) => (p.Tokens ? [JSON.stringify(p.Tokens.from)] : []))));
+  return SETTLE_RENT_UNIT * (BigInt(most * boxDraws(box) * Math.max(1, opens)) + BigInt(sources.size) + (box.subject ? 1n : 0n));
+}
 
 /**
  * The nonce the `k`th roll an order won is named by when it settles: the first 8 bytes, little
- * endian, of sha256("roll" | order | its requested slot (u64 LE) | k (u8)). Like every prize's roll, its order is at
+ * endian, of sha256("roll" | order | its requested slot (u64 LE) | k (u32 LE)). Like every prize's roll, its order is at
  * `prizeRollNonce` of it.
  */
 export function rollNonce(order, requestedSlot, k) {
-  const hash = sha256(concat(utf8('roll'), addressBytes(order), uintLE(requestedSlot, 8), uintLE(k, 1)));
+  const hash = sha256(concat(utf8('roll'), addressBytes(order), uintLE(requestedSlot, 8), uintLE(k, 4)));
   return readUintLE(hash, 0, 8);
 }
 
@@ -272,7 +353,17 @@ export const nonceOn = (asset) => readUintLE(addressBytes(asset), 0, 8);
 
 /** Whether a box's roll holds the NFT it rolls on, or moves its numbers: an entry burns it, gives it
  * away or moves its numbers. Its order is at the NFT's nonce (`nonceOn`). */
-export const boxHolds = (box) => (box.fates ?? []).some((f) => f.then !== 'Back' || (f.shifts ?? []).length > 0);
+export const boxHolds = (box) => (box.fates ?? []).some((f) => f.then != null || (f.shifts ?? []).length > 0);
+
+/**
+ * The nonce of the order a roll a sender names is made in: a craft's roll on a collectible kept (`RollOn`) and a
+ * mission's roll on the NFT leaving it. On an NFT its box holds (`boxHolds`), the NFT's own (`nonceOn`), whatever was
+ * named; otherwise `prizeRollNonce` of the named one, so no sender reaches the address of a roll an order won.
+ */
+export const namedRollNonce = (box, asset, named) => {
+  if (!box) throw new Error('A roll on an NFT needs its box, decoded (boxes), to know where its order is made.');
+  return boxHolds(box) ? nonceOn(asset) : prizeRollNonce(named);
+};
 
 /** Whether a limit for each wallet ({ total, per_window, window }) limits anything. */
 const limits = (perWallet) => Boolean(perWallet && (Number(perWallet.total) || Number(perWallet.per_window)));
@@ -305,8 +396,8 @@ export const gateAccounts = (project, { gate, wallet, shown, listProof = [] } =
 ];
 
 /**
- * A nonce a prize route names (its `nonce` argument), from what names the prize: a grant and its round, a lottery's
- * contribution, a contest's entry, an auction and its last bid. Any nonce works (the sender picks it); the roll's order
+ * A nonce a prize route names (its `nonce` argument), from what names the prize: a grant, its wallet and rounds, a
+ * contest and its player, an auction and its last bid. Any nonce works (the sender picks it); the roll's order
  * is then at `prizeRollNonce` of it (plus the place where the route says so), which no roll on an NFT is at.
  */
 export const prizeNonce = (...parts) => {
@@ -345,17 +436,15 @@ function pieceMetas(p) {
  *   Tokens  the mint (written when minted), the pool when they come from one, the winner's account of the mint;
  *   Item    the item; for a collectible, its collection (the Item's), its address at the item's next serial, Metaplex Core;
  *   Nft     the stash, the NFT as `piece` takes it, then a compressed NFT's proof;
- *   Roll    the box, then the order its roll is made in, at `prizeRollNonce(nonce)`; on a route the player pays or
- *           asks for (`strict`: a buy, a craft, a grant's claim), then the box's prize mints (`rollMints`);
+ *   Roll    the box, then the order its roll is made in, at `prizeRollNonce(nonce)` (what the roll can give is read
+ *           when it is asked: `askRollIx`);
  *   Held    the lottery's own stash (`lottery`: the lottery's address), the NFT as `piece` takes it, then its proof.
  * `poolMints` maps a pool's index to its mint (null for a pool never opened, which gives nothing: `projectMint` stands in
  * for its mint); `items` an item's id to its decoded Item (for its next serial; `made`
  * collectibles of the same item already made earlier in the instruction); `nft` the NFT's kind, as `piece` takes it
- * ({ collection, tokenMetadata, compressed }). A strict roll's `boxes` maps the box's id to its decoded LootBox (null
- * for one never written), and `rollPools` each pool its prizes name to its mint (null for one never opened;
- * `poolMints` when not given).
+ * ({ collection, tokenMetadata, compressed }).
  */
-export function prizeMetas({ project, collection, prize, winner, nonce = 0n, poolMints = {}, items = {}, nft = {}, made = 0, projectMint, programs, lottery, strict = false, boxes = {}, rollPools = poolMints }) {
+export function prizeMetas({ project, collection, prize, winner, nonce = 0n, poolMints = {}, items = {}, nft = {}, made = 0, projectMint, programs, lottery }) {
   if (prize.Tokens) {
     const { from } = prize.Tokens;
     // A pool never opened (its mint given as null) gives nothing: any mint stands in for its place, the project's.
@@ -398,34 +487,47 @@ export function prizeMetas({ project, collection, prize, winner, nonce = 0n, poo
       meta(BUBBLEGUM_CORE_SIGNER, false, false),
     ];
   }
-  const roll = [meta(pda.box(project, prize.Roll[0]), false, false), meta(pda.order(project, winner, prizeRollNonce(nonce)), false, true)];
-  return strict ? [...roll, ...strictRollMints(project, prize.Roll[0], boxes, rollPools)] : roll;
+  return [meta(pda.box(project, prize.Roll[0]), false, false), meta(pda.order(project, winner, prizeRollNonce(nonce)), false, true)];
 }
 
 /**
- * The accounts the program reads after a roll's box and order, to check the roll can be asked for, on a route the
- * player pays or asks for (a craft's `Prize::Roll` or `RollOn`, a buy's roll, a grant's claim of one): for each of the
- * box's token prizes, in order, its pool and then, for a pool opened, the pool's mint; for tokens minted, their mint. The program refuses the whole
- * transaction (PrizeHasHook) when any of those mints has a transfer hook, so the player keeps what the route takes.
- * `box` is the decoded LootBox (null for one never written: no roll is made, and nothing follows); `pools` maps each
- * pool its prizes name to its mint, or null for a pool never opened (its address alone).
+ * The roll accounts of a box, as `open_box`, `ask_roll` and the oracle's answer take them after their own: each entry's
+ * prizes' (`entryAccounts`: an item, its tables when it is fresh and they fit the box's table budget; a pool; a stash),
+ * then each mint its tokens are in and the project's vault for it (`prizeAccounts`). `box` is the decoded LootBox (null
+ * for one never written: none). `rolls`: { items (an item's id to its decoded Item, null for none written), poolMints
+ * (a pool's index to its mint, null for one never opened), programs }.
  */
-export function rollMints(project, box, pools = {}) {
+export function rollAccounts(project, box, rolls = {}) {
   if (!box) return [];
-  return box.entries.flatMap((e) => e.prizes).flatMap((prize) => {
-    const from = prize.Tokens?.from;
-    if (from?.Mint) return [meta(from.Mint[0], false, false)];
-    if (!from?.Pool) return [];
-    const index = from.Pool[0];
-    if (!(index in pools)) throw new Error(`a roll of box ${box.box_id} needs the mint of pool ${index} its prizes name (rollPools; null for a pool never opened)`);
-    return [meta(pda.pool(project, index), false, false), ...(pools[index] ? [meta(pools[index], false, false)] : [])];
-  });
+  const { items = {}, poolMints = {}, programs } = /** @type {{ items?: any, poolMints?: any, programs?: any }} */ (rolls);
+  for (const p of box.entries.flatMap((e) => e.prizes)) {
+    const id = p.Item?.[0] ?? p.Compressed?.item;
+    if (id !== undefined && items[id] === undefined) throw new Error(`a roll of box ${box.box_id ?? ''} needs item ${id} (rolls.items: its decoded Item, or null for none written), for its tables`);
+    const pool = p.Tokens?.from.Pool?.[0];
+    if (pool !== undefined && !(pool in poolMints)) throw new Error(`a roll of box ${box.box_id ?? ''} needs the mint of pool ${pool} (rolls.poolMints; null for a pool never opened)`);
+  }
+  return [...entryAccounts(project, box.entries, items), ...prizeAccounts(project, box.entries, poolMints, programs)];
 }
 
-/** `rollMints` of box `id` on a strict route: `boxes` must hold it (its decoded LootBox, or null for none written). */
-function strictRollMints(project, id, boxes, pools) {
-  if (!(id in boxes)) throw new Error(`a roll of box ${id} on a route the player pays or asks for needs the box (boxes: its decoded LootBox, or null for one never written), for its prize mints`);
-  return rollMints(project, boxes[id], pools);
+/**
+ * What a write or a route that names boxes to roll later passes for them (`order::rollables`): each box once, in the
+ * order they first come, and nothing after it. What a roll can give is read when it is asked.
+ */
+export function boxesAccounts(project, ids) {
+  return [...new Set(ids)].map((id) => meta(pda.box(project, id), false, false));
+}
+
+/** The boxes a record names to roll later (`Def::rolls`), in order: a box's entries' rolls, a recipe's rolls and
+ * `RollOn`s, a grant's, a lottery's places'. */
+export function defRolls(def) {
+  const [kind] = Object.keys(def ?? {});
+  const args = def?.[kind]?.args ?? {};
+  const prizes = kind === 'Box' ? (args.entries ?? []).flatMap((e) => e.prizes ?? [])
+    : kind === 'Recipe' ? (args.outputs ?? []).map((o) => o.Prize?.[0] ?? (o.RollOn ? { Roll: [o.RollOn.box_id] } : null))
+    : kind === 'Grant' ? [args.gives]
+    : kind === 'Lottery' ? (args.terms?.places ?? args.places ?? []).map((p) => (typeof p === 'object' ? p.prize : null))
+    : [];
+  return prizes.flatMap((p) => (p?.Roll ? [p.Roll[0]] : []));
 }
 
 /** Bubblegum's signer for its calls to Core, `["mpl_core_cpi_signer"]`. */
@@ -512,6 +614,8 @@ export function recordAddress(project, def) {
       return pda.recipe(project, body.id);
     case 'Grant':
       return pda.grant(project, body.id);
+    case 'Table':
+      return pda.table(project, body.id);
     default:
       throw new Error(`Unknown record kind ${kind}`);
   }
@@ -527,93 +631,113 @@ export function withDefaults(def) {
   const body = def[kind];
   const args = { ...body.args };
   if (kind === 'Box' || kind === 'Lottery' || kind === 'Grant') args.gate ??= null;
-  if (kind === 'Item') args.collection ??= NO_ADDRESS;
+  if (kind === 'Item') {
+    args.collection ??= NO_ADDRESS;
+    // A fresh item's traits (`Item::traits`): none for one whose units are all alike.
+    args.traits = traitsInCaps(args.traits ?? []);
+  }
   if (kind === 'Box') {
+    stored(args.shares);
     if (!args.currency) throw new Error('A box names the mint its price is in (`currency`).');
-    // An entry: up to three prizes (`prizeMetas`), whether it burns the payment, and its weight.
+    // What one open draws (`LootBox::slots`): none is one draw among every entry.
+    args.slots = (args.slots ?? []).map((s) => ({ only: [], distinct: false, share: 0, ...s }));
+    // An entry: its prizes (`prizeMetas`) and its weight. A box burns its price with a share to `Burn`.
     if (!Array.isArray(args.entries)) throw new Error('A box needs its entries (`entries`): what its roll can give, each with its weight.');
-    args.entries = args.entries.map((e) => ({ prizes: [], burns: false, ...e }));
+    args.entries = args.entries.map((e) => ({ prizes: [], ...e }));
     args.subject ??= null;
-    args.fates = (args.fates ?? []).map((f) => ({ ...f, shifts: (f.shifts ?? []).map((s) => ({ from_now: false, ...s })) }));
+    // What it does once an entry can't be given (`WhenOut`): stop selling while any entry couldn't cover the draws of
+    // a purchase and those waiting for their answer (the default), or draw among what is left ('DrawLeft').
+    args.when_out ??= 'StopSales';
+    // A fate's `then`: null sends the NFT back to its player; 'Burn', { Give: [wallet] } or { Stash: [id] }.
+    args.fates = (args.fates ?? []).map((f) => ({ ...f, then: f.then ?? null, shifts: (f.shifts ?? []).map((s) => ({ from_now: false, ...s })) }));
   }
   if (kind === 'Box' || kind === 'Recipe') {
     args.window ??= NO_WINDOW;
     args.per_wallet ??= NO_LIMIT;
   }
-  if (kind === 'Recipe') args.raises = (args.raises ?? []).map((r) => ({ from_now: false, ...r }));
+  if (kind === 'Recipe') {
+    // A raise moves a number on a kept collectible (`place`) as a box's fate does (`Shift`); a need tests one (`Test`).
+    args.raises = (args.raises ?? []).map(({ place, shift, ...flat }) => ({ place, shift: { from_now: false, most: 0, ...(shift ?? flat) } }));
+    args.needs = (args.needs ?? []).map(({ place, key, test, at_least: least }) => ({ place, key, test: test ?? { AtLeast: [least ?? 0] } }));
+  }
   if (kind === 'Box' && args.fall) args.fall = { shared: false, ...args.fall };
   if (kind === 'Lottery') {
-    args.per_wallet ??= 0;
-    args.nft_ticket ??= null;
-    args.returns ??= false;
-    args.min_sold ??= 0;
-    // A place is { bps, roll }; a number is a share of the pot that rolls nothing.
-    args.places = (args.places ?? []).map((p) => (typeof p === 'object' ? { prize: null, ...p } : { bps: p, prize: null }));
+    // Its terms (`LotteryTerms`, what a round copies at its first purchase), given in `terms` or beside `every`.
+    const { every, gate, per_wallet: perWallet, terms: given, ...flat } = args;
+    const terms = { nft_ticket: null, returns: false, min_sold: 0, ticket_mint: NO_ADDRESS, ...flat, ...given };
+    // A run of places alike is { bps, prize, times }; a number is one place's share of the pot that gives nothing else.
+    terms.places = (terms.places ?? []).map((p) => (typeof p === 'object' ? { prize: null, times: 1, ...p } : { bps: p, prize: null, times: 1 }));
+    terms.shares = stored(terms.shares ?? []);
+    return { [kind]: { ...body, args: { terms, every: every ?? 0n, gate: gate ?? null, per_wallet: perWallet ?? 0 } } };
   }
   if (kind === 'Grant') {
     args.key_root ??= new Uint8Array(32);
     args.open ??= false;
+    args.shard_bits ??= 0;
   }
   return { [kind]: { ...body, args } };
 }
 
 /**
  * The owner writes one record (`def`: { Item: { id, args } }, { Box: … }, …), at its own address. A lottery names
- * its pot's mint, its pot (which its first write opens), its ticket mint, its
- * funds and both token programs.
- */
-export function upsertIx({ owner, project, def: given, lottery = null }) {
+ * its pot's mint, its pot (which its first write opens), its ticket mint, both token programs and the round it waits on
+ * (`lotteryState`: the lottery as it is, null for a new one; `idleRound`: its current round's record, or round 0's once
+ * it drew once and ended: a lottery made again, edited once ended or made to repeat waits while that round runs or
+ * still owes NFTs of its own stash), then its own stash when a place holds or draws an NFT of it. A box, a recipe, a grant or a lottery that
+ * names a box to roll later passes that box after (`boxesAccounts`), which must be written: a box is written before
+ * anything names it (it may name itself).
+ */
+export function upsertIx({ owner, project, def: given, lotteryState = null }) {
   const def = withDefaults(given);
   const [kind] = Object.keys(def);
   const { args } = def[kind];
   let remaining = [];
+  // A collectible names its collection, read for Bubblegum's plugin (`Item::compressed`: its compressed prizes can be
+  // minted only when the collection carries it).
+  if (kind === 'Item' && args.kind === 'Collectible') remaining = [meta(args.collection, false, false)];
   // A new sealed schedule opens its own vault: its mint, the vault and both token programs.
   const vest = kind === 'Schedule' ? args.action?.from?.Vest?.[0] : null;
   if (vest) {
+    // It pays a wallet, the treasury or a burn: no account it pays is named.
     remaining = [meta(vest, false, false), meta(pda.vest(recordAddress(project, def)), false, true), meta(TOKEN_PROGRAM, false, false), meta(TOKEN_2022_PROGRAM, false, false)];
-    // A pool or a token account it pays comes next, checked now to be of the vault's mint (`open_vest`).
-    const to = args.action.to;
-    if (to?.Pool) remaining.push(meta(pda.pool(project, to.Pool[0]), false, false));
-    else if (to?.Account) remaining.push(meta(to.Account[0], false, false));
-    // A lottery's pot (the only account of the project's it may pay) comes with its lottery (`lottery`).
-    if (to?.Account && lottery) remaining.push(meta(lottery, false, false));
   }
   if (kind === 'Lottery') {
     remaining = [
-      meta(args.mint, false, false),
+      meta(args.terms.mint, false, false),
       meta(pda.pot(recordAddress(project, def)), false, true),
-      meta(args.ticket_mint === NO_ADDRESS ? args.mint : args.ticket_mint, false, false),
-      meta(pda.lotteryFunds(recordAddress(project, def)), false, true),
+      meta(paymentMint(args.terms), false, false),
       meta(TOKEN_PROGRAM, false, false),
       meta(TOKEN_2022_PROGRAM, false, false),
+      meta(lotteryState ? idleRound(recordAddress(project, def), lotteryState) : SYSTEM_PROGRAM, false, false),
     ];
-    // A place that holds an NFT (`Prize::Held`): the lottery's own stash, anywhere after them.
-    if (args.places.some((p) => p.prize?.Held)) remaining.push(meta(pda.lotteryStash(recordAddress(project, def)), false, false));
+    // A place that holds or draws an NFT of its own stash (`Prize::Held`, `Prize::Raffled`): that stash, after them.
+    if (args.terms.places.some((p) => p.prize?.Held || p.prize === 'Raffled')) remaining.push(meta(pda.lotteryStash(recordAddress(project, def)), false, false));
   }
+  // Each box it names to roll later (a box's, a recipe's, a grant's, a lottery's places'), once.
+  remaining.push(...boxesAccounts(project, defRolls(def)));
   return lootIx('upsert', { def }, { owner, project, target: recordAddress(project, def) }, { remaining });
 }
 
 /**
  * The owner closes the record at `target`, and its rent comes back: a grant's with the funds it held. A lottery
  * (`lottery`: its decoded record) sends what its pot holds to `to`, a token account of the pot's mint (the owner's own
- * by default), and closes the pot.
+ * by default), and closes the pot, once its current round has no record (one that drew once and ended: once its round 0
+ * gave out every NFT of its own stash, `idleRound`).
  */
-export function closeRecordIx({ owner, project, target, lottery, schedule, programs, to, paymentTo, extra = [] }) {
+export function closeRecordIx({ owner, project, target, lottery, schedule, programs, to, extra = [] }) {
   // A sealed schedule never closes (CannotClose): its address, and its vault's, stay bound to its terms.
   if (schedule?.action?.from?.Vest) throw new Error('A sealed schedule never closes: its vault stays bound to its terms.');
   if (!lottery) return lootIx('upsert', { def: null }, { owner, project, target });
-  const tokenProgram = tokenProgramOf(programs, lottery.mint);
-  const paymentMint = lotteryPaymentMint(lottery);
+  const { mint } = lottery.terms;
+  const tokenProgram = tokenProgramOf(programs, mint);
   const remaining = [
+    meta(idleRound(target, lottery), false, false),
     meta(pda.pot(target), false, true),
-    meta(lottery.mint, false, true),
-    meta(to ?? ata(owner, lottery.mint, tokenProgram), false, true),
-    meta(pda.lotteryFunds(target), false, true),
-    meta(paymentMint, false, true),
-    meta(paymentTo ?? ata(owner, paymentMint, tokenProgramOf(programs, paymentMint)), false, true),
+    meta(mint, false, true),
+    meta(to ?? ata(owner, mint, tokenProgram), false, true),
     meta(TOKEN_PROGRAM, false, false),
     meta(TOKEN_2022_PROGRAM, false, false),
-    ...extra,
+    ...tailOf(extra),
   ];
   return lootIx('upsert', { def: null }, { owner, project, target }, { remaining });
 }
@@ -630,7 +754,7 @@ export function payIx({ player, project, mint, treasury, amount, shares = [], re
     'pay',
     { amount, shares, reference: reference(ref) },
     { player, project, mint, treasury, treasury_token: ata(treasury, mint, tokenProgram), player_token: playerToken ?? ata(player, mint, tokenProgram) },
-    { remaining: [...shareAccounts(project, shares, mint, { holders, programs, treasury }), ...extra], writable: sharesBurn(shares) ? ['mint'] : [] },
+    { remaining: [...shareAccounts(project, shares, mint, { holders, programs, treasury }), ...tailOf(extra)], writable: sharesBurn(shares) ? ['mint'] : [] },
   );
 }
 
@@ -640,16 +764,18 @@ export function payIx({ player, project, mint, treasury, amount, shares = [], re
  * prizes take tokens from to its mint (a pool's tokens won wait in the project's vault for that mint); one not given
  * is taken to be in the box's currency, one given as null is closed. `shown`: an NFT the player shows for the box's
  * gate or odds; `listProof`: for a list gate, the proof's nodes. `chosenRecipient`: the wallet (or, for a share with an
- * item, the collectible, `chosen`) the buyer names for a share the box lets them choose. A box of one entry with
- * nothing random is rolled at once and takes no oracle accounts (a box that needs no roll at all sells with `buyIx`).
+ * item, the collectible, `chosen`) the buyer names for a share the box lets them choose. Every open asks the oracle,
+ * even of a box with nothing random (which sells in one step with `buyIx`, when it rolls on no NFT).
  * The player opens the project's vault for the price's mint, and for each prize's, when it is not there. A box that
- * limits each wallet counts the purchase in the player's receipt (its rent theirs).
+ * limits each wallet counts the purchase in the player's counts (`pda.counts`, its rent theirs).
  */
-export function openBoxIx({ player, project, box, boxAddress, nonce, maxPrice, shown, listProof, subject, chosenRecipient = null, chosen = null, poolMints, playerToken, programs, extra = [] }) {
+export function openBoxIx({ player, project, box, boxAddress, nonce, maxPrice, count = 1, items = {}, shown, listProof, subject, chosenRecipient = null, chosen = null, settler = NOBODY_KEY, poolMints, playerToken, programs, extra = [] }) {
   const mint = box.currency;
   poolMints = boxPoolMints(box, poolMints);
   const tokenProgram = tokenProgramOf(programs, mint);
-  const rolled = boxRolls(box.entries);
+  // `count` opens in one purchase (a box that packs), signed for `maxPrice` (the price times `count` when not given:
+  // pass the sum for a box whose price rises with each sale); `items` maps an item a prize names to its decoded Item,
+  // for a fresh one's tables (a box whose prizes are all alike needs none).
   const address = boxAddress ?? pda.box(project, box.box_id);
   // A box that rolls on an NFT takes it (`subject`: { asset, collection, hasAuthority, tokenMetadata, compressed }, as
   // `piece` takes it); any other, its own address stands in.
@@ -663,7 +789,7 @@ export function openBoxIx({ player, project, box, boxAddress, nonce, maxPrice, s
   const gate = [...gateAccounts(project, { gate: box.gate, wallet: player, listProof }), ...(box.subject ? on.proof : shownAccounts(project, shown))];
   return lootIx(
     'open_box',
-    { nonce, max_price: maxPrice ?? box.price, chosen_recipient: chosenRecipient, version: box.version },
+    { nonce, max_price: maxPrice ?? box.price * BigInt(count), chosen_recipient: chosenRecipient, version: box.version, count, settler },
     {
       loot_box: address,
       player,
@@ -671,56 +797,68 @@ export function openBoxIx({ player, project, box, boxAddress, nonce, maxPrice, s
       mint,
       player_token: playerToken ?? ata(player, mint, tokenProgram),
       vault: vault(project, mint, tokenProgram),
-      oracle_queue: rolled ? undefined : null,
-      program_identity: rolled ? undefined : null,
-      vrf_program: rolled ? undefined : null,
-      slot_hashes: rolled ? undefined : null,
       chosen,
-      receipt: limits(box.per_wallet) ? pda.receipt(address, player) : null,
+      counts: limits(box.per_wallet) ? pda.counts(project, player) : null,
       ...on.accounts,
     },
-    { remaining: [...entryAccounts(project, box.entries), ...prizeAccounts(project, box.entries, poolMints, programs), ...gate, ...extra], writable: on.writable },
+    { remaining: [...entryAccounts(project, box.entries, items), ...prizeAccounts(project, box.entries, poolMints, programs), ...gate, ...tailOf(extra)], writable: on.writable },
   );
 }
 
 /**
- * Buys a box that needs no roll (one entry, nothing random, no NFT to roll on: `boxRolls` false and no subject) in one
- * instruction: the price is split at once (or burned, for an entry that burns) and the entry's prizes are given to
- * the player (`prizeMetas`: `items` maps an item's id to its decoded Item, `poolMints` a pool's index to its mint,
- * `nfts` an NFT a prize names to its kind; a roll's `boxes` and `rollPools`, for the rolled box's prize mints). No
- * order. A prize that can't be given refuses the purchase. `treasury` is
- * the project's treasury wallet; `holders` maps a collectible a share pays to its holder; a roll the entry gives is
- * made at `nonce` (the next one for each roll after). `shown`/`listProof` pass the box's gate.
+ * Buys `count` of a box that needs no roll (one entry, nothing random, no NFT to roll on: `boxRolls` false and no
+ * subject) in one instruction, any number of draws each (a fixed pack): each at the price the one before it left, all
+ * within `maxPrice` (the price times `count` when not given: pass the sum for a box whose price rises with each sale).
+ * The price is split at once (a share may burn it) and the entry's prizes are given to the player: a fixed amount of
+ * tokens once, the whole of every draw's, and every other prize once for each draw of each sale, its accounts repeated
+ * (`prizeMetas`: `items` maps an item's id to its decoded Item, `poolMints` a pool's index to its mint, `nfts` an NFT a
+ * prize names to its kind). No order. A prize that can't be given refuses the purchase. `treasury` is the project's
+ * treasury wallet; `holders` maps a collectible a share pays to its holder; each roll the entry gives is made at the
+ * next nonce from `nonce` (`buyRolls`). `shown`/`listProof` pass the box's gate.
  */
-export function buyIx({ player, project, box, boxAddress, maxPrice, treasury, chosenRecipient = null, chosen = null, nonce = 0n, shown, listProof, items = {}, poolMints = {}, nfts = {}, boxes = {}, rollPools = poolMints, holders, playerToken, programs, extra = [] }) {
+export function buyIx({ player, project, box, boxAddress, maxPrice, count = 1, treasury, chosenRecipient = null, chosen = null, nonce = 0n, shown, listProof, items = {}, poolMints = {}, nfts = {}, holders, playerToken, programs, extra = [] }) {
   const mint = box.currency;
   const tokenProgram = tokenProgramOf(programs, mint);
   const address = boxAddress ?? pda.box(project, box.box_id);
-  const [entry] = box.entries;
   const shares = chosenShares(box.shares, chosenRecipient);
   const made = {};
-  const prizes = entry.prizes.flatMap((prize, k) => {
+  const prizes = buyGives(box, count).flatMap(({ prize, k }) => {
     const item = prize.Item?.[0];
-    const lines = prizeMetas({ project, prize, winner: player, nonce: toBigInt(nonce) + BigInt(k), poolMints, items, nft: nfts[prize.Nft?.nft], made: made[item] ?? 0, projectMint: mint, programs, strict: true, boxes, rollPools });
+    const lines = prizeMetas({ project, prize, winner: player, nonce: toBigInt(nonce) + BigInt(k), poolMints, items, nft: nfts[prize.Nft?.nft], made: made[item] ?? 0, projectMint: mint, programs });
     if (item !== undefined) made[item] = (made[item] ?? 0) + 1;
     return lines;
   });
   return lootIx(
     'buy',
-    { max_price: maxPrice ?? box.price, chosen_recipient: chosenRecipient, version: box.version, nonce: toBigInt(nonce) },
+    { max_price: maxPrice ?? box.price * BigInt(count), chosen_recipient: chosenRecipient, version: box.version, nonce: toBigInt(nonce), count },
     {
       player, project, loot_box: address, mint,
       player_token: playerToken ?? ata(player, mint, tokenProgram),
       treasury, treasury_token: ata(treasury, mint, tokenProgram),
-      chosen, receipt: limits(box.per_wallet) ? pda.receipt(address, player) : null,
+      chosen, counts: limits(box.per_wallet) ? pda.counts(project, player) : null,
     },
     {
-      remaining: [...gateAccounts(project, { gate: box.gate, wallet: player, shown, listProof }), ...shareAccounts(project, shares, mint, { holders, programs, treasury }), ...prizes, ...extra],
-      writable: entry.burns || sharesBurn(box.shares) ? ['mint'] : [],
+      remaining: [...gateAccounts(project, { gate: box.gate, wallet: player, shown, listProof }), ...shareAccounts(project, shares, mint, { holders, programs, treasury }), ...prizes, ...tailOf(extra)],
+      writable: sharesBurn(box.shares) ? ['mint'] : [],
     },
   );
 }
 
+/**
+ * What a `buy` of `count` of `box` gives, in the order it gives it (`buy.rs`): each prize of its one entry in turn, a
+ * fixed amount of tokens once (`times` the box's draws × `count`), any other prize once for each of those draws. `k`
+ * counts the gives: a roll given at `k` is made at the buy's `nonce + k` (its order at `prizeRollNonce` of it).
+ */
+export function buyGives(box, count = 1) {
+  const draws = boxDraws(box) * count;
+  const out = [];
+  for (const prize of box.entries[0]?.prizes ?? []) {
+    const once = Boolean(prize.Tokens);
+    for (let i = 0; i < (once ? 1 : draws); i++) out.push({ prize, k: out.length, times: once ? draws : 1 });
+  }
+  return out;
+}
+
 /**
  * The oracle's answer to a box order (for a local simulation: on chain MagicBlock's oracle sends it). The accounts
  * are the ones `open_box` handed the oracle: the order, the box, the roll's ticket (named by its first ask,
@@ -729,38 +867,64 @@ export function buyIx({ player, project, box, boxAddress, maxPrice, treasury, ch
  * for a prize in a mint with a transfer hook, the hook's accounts (`extra`). The buyer's odds boosts were fixed at
  * purchase.
  */
-export function callbackRollIx({ order, orderState, box, boxAddress, randomness, project, poolMints, programs, extra = [] }) {
+export function callbackRollIx({ order, orderState, box, boxAddress, randomness, project, poolMints, items = {}, programs, extra = [] }) {
   const projectAddress = project ?? orderState.project;
   const keys = [
     meta(pda.oracleIdentity(), true, false),
     meta(order, false, true),
-    meta(boxAddress ?? orderState.loot_box, false, false),
+    // Written: the order's draws leave the box's `in_flight`.
+    meta(boxAddress ?? orderState.loot_box, false, true),
     meta(ticketOf(order, orderState.asked_first), false, false),
-    ...entryAccounts(orderState.project, box.entries),
+    ...entryAccounts(orderState.project, box.entries, items),
   ];
   const prizes = prizeAccounts(orderState.project, box.entries, boxPoolMints(box, poolMints), programs);
   if (prizes.length) keys.push(meta(TOKEN_PROGRAM, false, false), meta(TOKEN_2022_PROGRAM, false, false), meta(projectAddress, false, false), ...prizes);
-  keys.push(...extra);
+  keys.push(...tailOf(extra));
   return { programId: LOOT_PROGRAM, keys, data: encodeInstruction(IDL, 'callback_roll', { randomness: Uint8Array.from(randomness) }) };
 }
 
 /**
  * The accounts of what an order won (`order.won`), in order, as `settle` hands each over:
- *   Item    the item; for a collectible (`items[id]` its decoded Item), its collection, its address, Metaplex Core
+ *   Item    the item; for a collectible (`items[id]` its decoded Item), its collection, its address, Metaplex Core;
+ *           for a fresh one (`drawn` set), then the table of each of its table traits
  *   Tokens  the mint, the project's vault for it, the player's account of it (`prizeTo`, when given)
  *   Nft     the NFT as `piece` takes it (`nfts[nft]` its kind), going to the player, then a compressed NFT's proof
- *   Roll    the box, then the order its roll is made in (`rollNonce`)
+ *   Compressed  the item, the tree's config, the tree, the collection, Bubblegum's programs; for a fresh one, then its
+ *           tables and the Sheet of the NFT it mints
  */
-export function wonAccounts({ orderAddress, order, items = {}, nfts = {}, prizeTo, putBack = [], programs }) {
+export function wonAccounts({ order, items = {}, nfts = {}, prizeTo, putBack = [], programs, from = 0, upto = order.won.length, tree, treeMinted = 0n, unminted = [] }) {
   const project = order.project;
-  return order.won.flatMap((won, k) => {
+  // A compressed prize is minted into `tree` (any of the project's with room), the next NFT it mints: after
+  // `treeMinted`, and the compressed prizes before it in this part that were minted. One of an item whose collection
+  // lacks Bubblegum's plugin (`unminted`: those collections) gives nothing and mints nothing: the next takes its place.
+  let minted = BigInt(treeMinted);
+  const skips = new Set(unminted);
+  return order.won.slice(from, upto).flatMap((won) => {
+    if (won.Compressed) {
+      const { item: id, drawn } = won.Compressed;
+      const address = pda.item(project, id);
+      const item = items[id];
+      if (!item) throw new Error(`settling item ${id} needs the item (items), for its collection and its traits`);
+      const tables = drawn != null ? traitTables(item).map((t) => meta(pda.table(project, t), false, false)) : [];
+      if (!tree) throw new Error('settling a compressed prize needs the project tree it is minted into (tree, treeMinted)');
+      const asset = pda.compressedAsset(tree, minted);
+      if (!skips.has(item.collection)) minted += 1n;
+      return [
+        meta(address, false, true), meta(pda.treeConfig(tree), false, true), meta(tree, false, true), meta(item.collection, false, true),
+        meta(BUBBLEGUM_PROGRAM, false, false), meta(COMPRESSION_PROGRAM, false, false), meta(NOOP_PROGRAM, false, false), meta(MPL_CORE_PROGRAM, false, false), meta(BUBBLEGUM_CORE_SIGNER, false, false),
+        // A fresh one's traits are written in the project's Sheet for the NFT it mints.
+        ...(drawn != null ? [...tables, meta(pda.sheet(project, asset), false, true)] : []),
+      ];
+    }
     if (won.Item) {
-      const { item: id, serial } = won.Item;
+      const { item: id, serial, drawn } = won.Item;
       const address = pda.item(project, id);
       const item = items[id];
       if (!item) throw new Error(`settling item ${id} needs the item (items), for its kind and collection`);
       if (item.kind !== 'Collectible') return [meta(address, false, true)];
-      return [meta(address, false, true), meta(item.collection, false, true), meta(pda.itemAsset(address, serial), false, true), meta(MPL_CORE_PROGRAM, false, false)];
+      // A fresh unit's traits come from the rows its tables drew at the roll.
+      const tables = drawn != null ? traitTables(item).map((t) => meta(pda.table(project, t), false, false)) : [];
+      return [meta(address, false, true), meta(item.collection, false, true), meta(pda.itemAsset(address, serial), false, true), meta(MPL_CORE_PROGRAM, false, false), ...tables];
     }
     if (won.Tokens) {
       const { mint } = won.Tokens;
@@ -774,14 +938,57 @@ export function wonAccounts({ orderAddress, order, items = {}, nfts = {}, prizeT
       const p = piece({ project, asset, wallet: order.player, ...nfts[asset], ...ONLY_MOVES });
       return [...pieceMetas(p), ...p.proof];
     }
-    return [meta(pda.box(project, won.Roll[0]), false, false), meta(pda.order(project, order.player, rollNonce(orderAddress, order.requested_slot, k)), false, true)];
+    throw new Error(`settling an order: a prize of a kind this client doesn't know (${Object.keys(won)[0]})`);
   });
 }
 
+/** The calls a transaction may make, its own instructions and every call inside them (Solana's instruction trace). */
+export const TRACE_LIMIT = 64;
+/** The calls a settle makes before its prizes: the compute budget's, its own, and the payment's at most. */
+const SETTLE_BASE_CALLS = 6;
+
+/** The calls one prize makes when a settle hands it over, measured on the program (`tests/limits.rs`): a collectible's
+ * mint by Core (4, so 14 a transaction), a compressed one's by Bubblegum (5) and with its Sheet (7), tokens (2), an NFT
+ * moved (3). `items` maps an item's id to its decoded Item (a normal item makes none). */
+export function prizeCalls(won, items = {}) {
+  if (won.Item) return won.Item.drawn == null && items[won.Item.item]?.kind === 'Normal' ? 0 : 4;
+  if (won.Compressed) return won.Compressed.drawn != null ? 7 : 5;
+  if (won.Tokens) return 2;
+  return 3;
+}
+
+/** Where a settle part that starts at `from` ends: as many of the order's prizes as fit the instruction trace (an
+ * NFT's move asks for the bigger heap, so at most three a part). Each part is its own transaction; anyone sends any. */
+export function settlePartEnd(order, from = Number(order.settled ?? 0), items = {}) {
+  let calls = SETTLE_BASE_CALLS;
+  let nfts = 0;
+  let end = from;
+  while (end < order.won.length) {
+    const won = order.won[end];
+    const next = prizeCalls(won, items);
+    if (end > from && (calls + next > TRACE_LIMIT || (won.Nft && nfts >= 3))) break;
+    calls += next;
+    nfts += won.Nft ? 1 : 0;
+    end++;
+  }
+  return end;
+}
+
+/** How many draws one open of `box` makes: its slots' counts, or one. */
+export const boxDraws = (box) => (box.slots?.length ? box.slots.reduce((n, s) => n + Number(s.count), 0) : 1);
+
+/** How many settle parts an order of `opens` opens of `box` takes at most: each card, at its most calls, and with
+ * shares one more (the first call splits the payment, alone when no prize fits beside its shares: `upto` 0). */
+export function settleParts(box, opens = 1) {
+  const draws = box.slots?.length ? box.slots.reduce((n, s) => n + Number(s.count), 0) : 1;
+  const cards = Math.max(1, ...box.entries.map((e) => e.prizes.length)) * draws * Math.max(1, opens);
+  return Math.max(1, Math.ceil(cards / Math.floor((TRACE_LIMIT - SETTLE_BASE_CALLS) / 7))) + ((box.shares ?? []).length ? 1 : 0);
+}
+
 /** The heap a settle that moves three or more NFTs asks for (`settleHeapFrame`): all a transaction may have, 256 KiB. */
 export const LARGE_SETTLE_HEAP = 256 * 1024;
 
-/** Whether an order rolled on an NFT: its `subject` names one (the default address for none). */
+/** Whether an order rolled on an NFT: its `subject` names one (null for none). */
 const rolledOn = (order) => Boolean(order.subject) && order.subject !== NO_ADDRESS;
 
 /**
@@ -810,32 +1017,50 @@ export const MAX_COMPUTE_UNITS = 1_400_000;
  * them). A limit costs nothing more when no priority fee is set.
  */
 export function settleComputeUnits(order) {
-  const moves = (order.won ?? []).some((w) => w.Nft) || rolledOn(order);
+  // An NFT moved, an NFT rolled on, a compressed mint (Bubblegum's 60,000 to 90,000 units each) or a pack's part of
+  // many cards takes all a transaction may have.
+  const won = order.won ?? [];
+  const moves = won.some((w) => w.Nft || w.Compressed) || won.length > 8 || rolledOn(order);
   return moves ? MAX_COMPUTE_UNITS : 800_000;
 }
 
+/** `settle`'s `upto` for its last part: past the end of any order. The last part gives what is left, pays back the share
+ * of the draws the roll didn't make, carries out the roll on an NFT and closes the order. */
+export const SETTLE_LAST = 4_294_967_295;
+
 /**
  * Carries out a rolled order: hands over what its roll set aside (`wonAccounts`: a collectible minted, the project's
- * backend delivering a normal item from the receipt; tokens from the project's vault; an NFT taken out of its stash;
- * a roll made for the player), then splits the payment, or burns it for an entry that burns. Anyone sends it, for the
- * order at `orderAddress`; `signer` opens any account it pays into that is not there, and pays a roll's order. `order`
- * is the decoded Order; `projectState` the decoded Project; `items` and `nfts` as `wonAccounts` takes them. `putBack`:
- * NFTs won that the player, signing, puts back into their stash in place of taking them (one its collection won't let move).
- * `handBack`: the wallet the box's fate gives the NFT rolled on to (`receiverOf`) is an account of the loot program
- * (`handsBack` of it as read), so the program gives it back to the player, and a Token Metadata NFT's `token` is the
- * player's. `extra`: a hook's or a memo's accounts.
- */
-export function settleIx({ signer, orderAddress, order, projectState, items, nfts, prizeTo, putBack, subject, handBack = false, holders, programs, extra = [] }) {
+ * backend delivering a normal item from the receipt; tokens from the project's vault; an NFT taken out of its stash),
+ * then splits the payment (a share may burn it). The order's player, its settler or the project's keys send it, for the order at `orderAddress`; `signer` pays all
+ * the settle opens or mints (Core assets, token accounts, Sheets, a stash's row, the fate's writes: the order lends
+ * nothing, `settleRent`). `order` is the decoded Order; `projectState` the decoded Project; `items` and `nfts` as
+ * `wonAccounts` takes them. `putBack`: NFTs won that the player, signing, puts back into their stash in place of taking
+ * them (one its collection won't let move). `handBack`: the wallet the box's fate gives the NFT rolled on to
+ * (`receiverOf`) is an account of the loot program (`handsBack` of it as read), so the program gives it back to the
+ * player, and a Token Metadata NFT's `token` is the player's. `extra`: a hook's or a memo's accounts.
+ *
+ * `upto`, the part (`settle.rs`): `SETTLE_LAST` (the default, past the end) is the last part, all that is left (maybe
+ * nothing); 0 gives no prize and only splits the payment; any other gives the prizes from where the last part stopped
+ * (`settled`) up to it, and nothing more. The first call, whichever it is, splits the payment (its shares' accounts
+ * ride on it).
+ */
+export function settleIx({ signer, orderAddress, order, projectState, items, nfts, prizeTo, putBack, subject, handBack = false, holders, programs, upto = SETTLE_LAST, tree, treeMinted, unminted, extra = [] }) {
   const project = order.project;
+  const from = Number(order.settled ?? 0);
+  const last = Number(upto) > order.won.length;
+  const end = last ? order.won.length : Math.max(from, Number(upto));
+  // The payment is split once, by the first call (`drew` is 0 once it is made).
+  const splits = Number(order.drew ?? 0) > 0;
+  const prizes = wonAccounts({ order, items, nfts, prizeTo, putBack, programs, from, upto: end, tree, treeMinted, unminted });
   const tokenProgram = tokenProgramOf(programs, order.mint);
-  const burns = order.burns || sharesBurn(order.shares);
   // The NFT it rolled on, as the settle moves it: given to a wallet that is an account of the loot program, it goes
   // back to its player (`handsBack`), into the player's token account for a Token Metadata NFT.
-  const receiver = receiverOf(order);
-  const on = orderPiece(project, orderAddress, order, subject, handBack && order.fate?.then?.Give ? order.player : receiver);
+  // A part before the last gives only its prizes (and the first, the split): no NFT rolled on (its piece a stand-in).
+  const receiver = last ? receiverOf(order) : null;
+  const on = last ? orderPiece(project, orderAddress, order, subject, handBack && order.fate?.then?.Give ? order.player : receiver) : standIn(orderAddress);
   return lootIx(
     'settle',
-    {},
+    { upto: Number(upto), prize_accounts: prizes.length },
     {
       signer,
       order: orderAddress,
@@ -847,10 +1072,12 @@ export function settleIx({ signer, orderAddress, order, projectState, items, nft
       treasury_token: ata(projectState.treasury, order.mint, tokenProgram),
       ...on.accounts,
       receiver,
+      // The last part of an order whose roll left a draw unmade or part given gives its share of the payment back here.
+      player_token: BigInt(order.back ?? 0) > 0n && last ? ata(order.player, order.mint, tokenProgram) : null,
     },
     {
-      remaining: [...on.proof, ...wonAccounts({ orderAddress, order, items, nfts, prizeTo, putBack, programs }), ...shareAccounts(project, order.shares, order.mint, { holders, programs, treasury: projectState.treasury }), ...extra],
-      writable: [...(burns ? ['mint'] : []), ...on.writable],
+      remaining: [...on.proof, ...prizes, ...(splits ? shareAccounts(project, order.shares, order.mint, { holders, programs, treasury: projectState.treasury }) : []), ...tailOf(extra)],
+      writable: [...(sharesBurn(order.shares) && splits ? ['mint'] : []), ...on.writable],
     },
   );
 }
@@ -861,10 +1088,10 @@ export function settleIx({ signer, orderAddress, order, projectState, items, nft
  */
 export function receiverOf(order) {
   const then = order.fate?.then;
-  if (!order.held || !then) return null;
+  if (!order.held || then == null) return null;
   if (then.Give) return then.Give[0];
   if (then.Stash) return pda.stash(order.project, then.Stash[0]);
-  return then === 'Burn' || then.Burn ? INCINERATOR : null;
+  return then === 'Burn' ? INCINERATOR : null;
 }
 
 /**
@@ -878,7 +1105,7 @@ function orderPiece(project, orderAddress, order, subject = {}, receiver) {
   // a stash keeps it where it is.
   const shifts = Boolean(order.fate?.shifts?.length);
   const then = order.fate?.then;
-  const burned = order.held && (then === 'Burn' || Boolean(then?.Burn));
+  const burned = order.held && then === 'Burn';
   const stays = Boolean(then?.Stash);
   return piece({ project, asset: order.subject, wallet: stays ? order.player : receiver ?? order.player, ...subject, moves: order.held && !stays, locks: false, writes: shifts, burns: burned, reads: shifts });
 }
@@ -897,8 +1124,9 @@ export const INCINERATOR = '1nc1nerator11111111111111111111111111111111';
 /**
  * Gives an order's payment back to its player, into their account of the mint (`signer`, anyone, opens it when it is
  * not there): an order whose roll failed or never came. A rolled order is settled, never refunded
- * (`orderRefundSlot`). A purchase counted against a box's limit for each
- * wallet is given back. `extra`: a hook's or a memo's accounts.
+ * (`orderRefundable`). A purchase counted against a box's limit for each
+ * wallet is given back. A purchase that counts its draws in its box's `in_flight` (`order.reserved`, a box that stops
+ * selling when an entry runs out) names the box, whose count it leaves. `extra`: a hook's or a memo's accounts.
  */
 export function refundIx({ signer, orderAddress, order, subject, programs, extra = [] }) {
   const project = order.project;
@@ -918,129 +1146,186 @@ export function refundIx({ signer, orderAddress, order, subject, programs, extra
       mint: order.mint,
       vault: vault(project, order.mint, tokenProgram),
       player_token: ata(order.player, order.mint, tokenProgram),
-      receipt: order.counted != null ? pda.receipt(order.loot_box, order.player) : null,
+      counts: order.counted != null ? pda.counts(project, order.player) : null,
+      // Required while the order counts draws in its box (`reserved`); an order read without the field names it too.
+      loot_box: order.reserved == null || BigInt(order.reserved) > 0n ? order.loot_box : null,
       ...on.accounts,
     },
-    { remaining: [...on.proof, ...extra], writable: on.writable },
+    { remaining: [...on.proof, ...tailOf(extra)], writable: on.writable },
   );
 }
 
 /**
- * Anyone (`payer`, who pays the oracle) asks for the roll a mission's return, a recipe or a prize made (`order.status`
- * Waiting): the box's prizes' accounts, as `openBoxIx` passes them. It lands in `callback_roll`. Returns a list of
- * instructions: first `payer` opens the project's vault for each prize mint when it is not there (idempotent; the
- * program refuses the ask without them, since tokens won wait there), then the ask.
+ * Its player or the project's keys (`payer`, who pays the oracle) ask for the roll a mission's return, a recipe or a prize made (`order.status`
+ * Waiting): the box's roll accounts, as `openBoxIx` passes them (`items` maps an item a prize names to its decoded
+ * Item, for a fresh one's tables). It lands in `callback_roll`. Returns a list of instructions: first `payer` opens the
+ * project's vault for each prize mint when it is not there (idempotent; the program refuses the ask without them,
+ * since tokens won wait there), then the ask. A box with nothing in stock is refused (`SoldOut`) unless the order's own
+ * player asks in a later slot than the order was made or last asked in: a route that makes a roll and asks for it in
+ * the same transaction fails whole on an empty box, and the player keeps what the route took. The player's own ask on
+ * an empty box ends the roll there, with no oracle: rolled with nothing (an NFT it holds goes home as it was), or failed
+ * for its refund when its winner paid for it (an auction's roll lot). An answer that finds nothing at all in stock puts
+ * a free roll back to waiting (`Waiting`), for a restock or for its player to end it so. Once asked, every later ask
+ * comes in a later slot than the last (`SameSlot`, `rollAskable`).
  */
-export function askRollIx({ payer, orderAddress, order, box, poolMints, programs }) {
+export function askRollIx({ payer, orderAddress, order, box, settler = NOBODY_KEY, poolMints, items = {}, programs }) {
   poolMints = boxPoolMints(box, poolMints);
   const opens = prizeMints(box.entries, poolMints).map(({ mint }) => createAssociatedTokenAccountIdempotent(payer, order.project, mint, tokenProgramOf(programs, mint)));
-  const ask = lootIx('ask_roll', {}, { payer, order: orderAddress, loot_box: order.loot_box }, {
-    remaining: [...entryAccounts(order.project, box.entries), ...prizeAccounts(order.project, box.entries, poolMints, programs)],
+  const ask = lootIx('ask_roll', { settler }, { payer, order: orderAddress, loot_box: order.loot_box, project: order.project }, {
+    remaining: [...entryAccounts(order.project, box.entries, items), ...prizeAccounts(order.project, box.entries, poolMints, programs)],
   });
   return [...opens, ask];
 }
 
-/** The SOL a box order holds for each collectible its roll may mint (`orderEscrow`): its rent, given back unspent. The
- * IDL's `ESCROW_LAMPORTS`. */
-export const ESCROW_LAMPORTS = BigInt(IDL.constants.find((c) => c.name === 'ESCROW_LAMPORTS').value);
-
 // ---------------------------------------------------------------- out: the project's tokens move
 
 /**
- * The authority moves the project's tokens: `from` { Pool: [i] } or { Mint: [mint] } (newly minted), `to` a pool, a
- * wallet, an account, the treasury (`treasury`, the project's wallet), a collectible's holder or 'Burn', `amount`
- * { Fixed: [n] } or { Bps: [bps] } of a pool. The authority opens the account it pays into when it is not there; a
- * collectible nobody holds gets nothing.
+ * The authority moves the project's tokens: `from` { Pool: [i] }, { Mint: [mint] } (newly minted) or { Farm: [id] } (what
+ * that farm's rewards vault holds free, beyond what it owes its seats: a fixed amount; `farm`: the farm decoded, so its
+ * record of ends comes when it keeps one), `to` a pool, a wallet, an account, the treasury (`treasury`, the project's
+ * wallet), a collectible's holder or 'Burn', `amount` { Fixed: [n] } or { Bps: [bps] } of a pool. The authority opens the
+ * account it pays into when it is not there; a collectible nobody holds gets nothing.
  */
-export function moveTokensIx({ authority, project, mint, from, to, amount, reference: ref, holders, programs, treasury, extra = [] }) {
+export function moveTokensIx({ authority, project, mint, from, to, amount, reference: ref, holders, programs, treasury, farm = null, extra = [] }) {
   const writes = Boolean(from.Mint) || to === 'Burn';
   return lootIx(
     'move_tokens',
     { from, to, amount, reference: reference(ref) },
-    { authority, project, mint, pool: from.Pool ? pda.pool(project, from.Pool[0]) : null },
-    { remaining: [...destinationAccounts(project, to, mint, { holders, programs, treasury }), ...extra], writable: writes ? ['mint'] : [] },
+    // What a farm holds free comes out of its rewards vault, passed as the pool, with the farm.
+    { authority, project, mint, pool: from.Pool ? pda.pool(project, from.Pool[0]) : from.Farm ? pda.rewards(pda.farm(project, from.Farm[0])) : null, farm: from.Farm ? pda.farm(project, from.Farm[0]) : null, farm_ends: from.Farm && farm?.keeps_ends ? pda.ends(pda.farm(project, from.Farm[0])) : null },
+    { remaining: [...destinationAccounts(project, to, mint, { holders, programs, treasury }), ...tailOf(extra)], writable: writes ? ['mint'] : [] },
   );
 }
 
 // ---------------------------------------------------------------- make: collectibles
 
 /**
- * The authority makes, rewrites or burns a collectible. `change`: { Make: { attributes } } (then `item` is the item id
- * it makes one of, `asset` is a new key that signs, and `owner` receives it), { Set: [attributes] } or 'Burn'. `collection`: the project's for a Make
- * or a Burn; for a Set, the asset's own (`MPL_CORE_PROGRAM` for one in none). `hasAuthority` false for a `Set` on an
- * NFT the project has no authority over (a Core asset of another collection, or a Token Metadata NFT's mint): what it
- * writes goes in the NFT's Sheet, or on the NFT itself when its Attributes plugin names the project.
+ * The authority rewrites or burns a collectible, or writes a wallet's profile. `change`: { Set: [attributes] }, 'Burn'
+ * (`owner`: whoever holds it, who gets its rent) or { Profile: [attributes] } (`asset` the wallet). `collection`: for a
+ * Burn the project's; for a Set the asset's own (`MPL_CORE_PROGRAM` for one in none). `hasAuthority` false for a `Set`
+ * on an NFT the project has no authority over (a Core asset of another collection, or a Token Metadata NFT's mint):
+ * what it writes goes in the NFT's Sheet, or on the NFT itself when its Attributes plugin names the project. A `Make`
+ * goes to `makeIx`.
  */
-export function collectibleIx({ authority, project, collection, asset, change, item = null, owner = null, hasAuthority = true, reference: ref }) {
-  const make = Boolean(change.Make);
-  const sheet = change.Set && !hasAuthority ? pda.sheet(project, asset) : null;
+export function collectibleIx({ authority, project, collection, asset, change, owner = null, hasAuthority = true, reference: ref, ...make }) {
+  if (change.Make) return makeIx({ authority, project, ...change.Make, ...make, owners: make.owners ?? [owner], reference: ref });
+  const sheet = change.Set && !hasAuthority ? pda.sheet(project, asset) : change.Profile ? pda.profile(project, asset) : null;
+  const burn = change === 'Burn' || Boolean(change.Burn);
   return lootIx(
     'collectible',
     { change, reference: reference(ref) },
-    { authority, project, collection, asset, item: make ? pda.item(project, item) : null, owner: make ? owner : null, sheet },
-    { signer: make ? ['asset'] : [], writable: change.Set || collection === MPL_CORE_PROGRAM ? [] : ['collection'] },
+    { authority, project, collection, asset, owner: burn ? owner : null, sheet },
+    { writable: change.Set || change.Profile || collection === MPL_CORE_PROGRAM ? [] : ['collection'] },
+  );
+}
+
+/**
+ * The authority makes one of item `item` (`itemState`: its decoded Item, for its collection and next serial) for each
+ * of `owners`, in serial order (an owner may come more than once), with `attributes` written over the program's own: a
+ * collectible at `pda.itemAsset(item, serial)` (`madeAssets` says which), or with `tree`, a compressed NFT minted into
+ * that tree of the project's (no attributes: they go in its Sheet). A switched-off item still makes; one sold out
+ * refuses the whole call (`PrizeNotCovered`).
+ */
+export function makeIx({ authority, project, item, itemState, owners, attributes = [], tree = null, reference: ref }) {
+  if (!itemState) throw new Error(`a make of item ${item} needs the item (itemState: its decoded Item), for its collection and next serial`);
+  if (!owners?.length || owners.some((o) => !o)) throw new Error('A make names who gets each one (`owners`).');
+  const prize = tree ? { Compressed: { item, tree } } : { Item: [item] };
+  const remaining = owners.flatMap((owner, made) => [meta(owner, false, false), ...prizeMetas({ project, prize, winner: owner, items: { [item]: itemState }, made })]);
+  return lootIx(
+    'collectible',
+    { change: { Make: { item, tree, attributes } }, reference: reference(ref) },
+    { authority, project, collection: itemState.collection, asset: pda.item(project, item), owner: null, sheet: null },
+    { remaining, writable: ['collection'] },
   );
 }
 
+/** The collectibles a `makeIx` of `count` mints (not compressed): at the item's next serials. */
+export const madeAssets = (project, item, itemState, count = 1) => Array.from({ length: count }, (_, k) => pda.itemAsset(pda.item(project, item), Number(itemState.issued) + 1 + k));
+
 // ---------------------------------------------------------------- decide
 
 /**
  * A held NFT goes to `to`: the authority's choice while the hold runs, home to its player (anyone) after; a repaid
  * loan's home (anyone, whenever), an unpaid one's to its lender once due. `hold` is the
  * decoded Hold: its address names its end (`pda.hold(asset, free_at)`), so a release sent late never lands on a later
- * hold. The NFT is any kind
+ * hold; `address` names it when its `free_at` changed since (a repaid loan's is 0, at the address its loan named). The
+ * NFT is any kind
  * (`piece`): `asset` and `collection` for a Core asset, with `tokenMetadata` for a Token Metadata NFT, or `compressed`
  * (after a `proveLeafIx`).
  */
-export function releaseIx({ signer, project, collection, asset, tokenMetadata: tm, compressed, hold, to, reference: ref }) {
-  const receiver = to ?? hold.player;
+export function releaseIx({ signer, project, collection, asset, tokenMetadata: tm, compressed, hold, address = null, to, treasury, reference: ref, more = [] }) {
+  // A hold whose player is the project's own address is owed to the treasury, as the project names it now (`treasury`,
+  // the decoded Project's).
+  if (!to && hold.player === project && !treasury) throw new Error('This hold is owed to the treasury: pass treasury (the project’s, as it is now).');
+  const receiver = to ?? (hold.player === project ? treasury : hold.player);
   // Never to the project's own address, nor any account of the program, where nothing could move it again (ToTheProject).
   if (receiver === project) throw new Error('A held NFT can’t go to the project’s own address: name a wallet.');
-  const p = piece({ project, asset, wallet: receiver, collection, tokenMetadata: tm, compressed, ...ONLY_MOVES });
-  return lootIx('release', { reference: reference(ref) }, { signer, project, ...p.accounts, hold: pda.hold(p.accounts.asset, hold.free_at), player: hold.player, to: receiver }, { remaining: p.proof, writable: p.writable });
+  // Several holds of one player's with one end, payer and rent wallet (`more`: each { asset, collection, tokenMetadata,
+  // compressed }) go to one `to` together, in ascending order of their holds' addresses.
+  const [first, ...rest] = ascending([{ asset, collection, tokenMetadata: tm, compressed, address }, ...more].map((n) => {
+    const p = piece({ project, asset: n.asset, wallet: receiver, collection: n.collection, tokenMetadata: n.tokenMetadata, compressed: n.compressed, ...ONLY_MOVES });
+    return { p, hold: n.address ?? pda.hold(p.accounts.asset, hold.free_at) };
+  }), (x) => x.hold);
+  const p = withPrograms(first.p, rest.map((x) => x.p));
+  const groups = rest.flatMap((x) => [meta(x.hold, false, true), ...anotherMetas(x.p)]);
+  // The hold's rent goes back to whoever made it (`payer`), a Token Metadata NFT's emptied account's to whoever paid it.
+  return lootIx('release', { reference: reference(ref) }, { signer, project, ...p.accounts, hold: first.hold, payer: hold.payer, rent_to: hold.rent_to, to: receiver }, { remaining: [...p.proof, ...groups], writable: p.writable });
 }
 
 /** The mint of a contest's split prize (its `prize`, tokens): minted, or a pool's (`poolMint`). */
 const splitMint = (prize, poolMint) => prize?.Tokens?.from.Mint?.[0] ?? poolMint;
 
 /**
- * The authority opens contest `id` in `mint`. `args`: { sides, closes_at, result_by, shares, gate, deciders,
- * min_pot, stake, prize, nft, prize_split }: `prize`, what each winning entry gets when it is claimed (`prizeMetas`);
- * `nft`, a rule an NFT each entry stakes passes, in place of tokens (no shares then, no stake: the NFTs are the pot).
- * With `args.prize_split`, its token prize is set aside whole when it is
- * decided, in the contest's own vault (`pda.prizeVault`, opened now at the authority's rent), and each winning entry
+ * The authority opens contest `id` in `mint` (`projectState`: the decoded Project, whose next incarnation names the
+ * contest's list of entries). `args`: { sides, closes_at, result_by, shares, gate, deciders, min_pot, stake, prize, nft,
+ * prize_split, cap }: `prize`, what each winning entry gets with its first claim (`prizeMetas`); `nft`, a rule an NFT
+ * each entry stakes passes, in place of tokens (no shares then, no stake: the NFTs are the pot), each winner sharing the
+ * losers' NFTs, at most `cap` each (null: no cap). With `args.prize_split`, its token prize is set aside whole when it
+ * is decided, in the contest's own vault (`pda.prizeVault`, opened now at the authority's rent), and each winning entry
  * takes its part by what it put in: `prizeMint` names the prize's mint when it comes from a pool.
  */
-export const openContestIx = ({ authority, project, id, mint, args, prizeMint }) => {
+export const openContestIx = ({ authority, project, projectState, id, mint, args, prizeMint }) => {
+  stored(args.shares);
   const contest = pda.contest(project, id);
   const split = Boolean(args.prize_split);
-  return lootIx('open_contest', { id, args: { deciders: [], min_pot: 0, stake: 0, prize: null, nft: null, prize_split: false, ...args, gate: args.gate ?? null } }, {
+  return lootIx('open_contest', { id, args: { deciders: [], min_pot: 0, stake: 0, prize: null, nft: null, prize_split: false, cap: null, ...args, gate: args.gate ?? null } }, {
     authority, project, mint, contest,
     prize_mint: split ? splitMint(args.prize, prizeMint) : null, prize_vault: split ? pda.prizeVault(contest) : null,
+    entries: pda.entries(contest, BigInt(projectState.incarnations) + 1n),
+    // A split prize from a pool names the pool at its index (`WrongPool` without it; a prize mint not the pool's is
+    // `WrongMint`).
+    prize_pool: split && args.prize?.Tokens?.from?.Pool ? pda.pool(project, args.prize.Tokens.from.Pool[0]) : null,
+  }, {
+    // A prize that is a roll: its box.
+    remaining: args.prize?.Roll ? boxesAccounts(project, [args.prize.Roll[0]]) : [],
   });
 };
 
+/** A contest's list of entries, from its decoded Contest. */
+export const contestEntries = (contestAddress, contest) => pda.entries(contestAddress, contest.incarnation);
+
 /** The prefix of a contest's verdict (`verdictBytes`). */
-export const VERDICT_DOMAIN = 'loot-verdict-v3';
+export const VERDICT_DOMAIN = 'loot-verdict-v4';
 
 /**
- * The bytes a contest's decider key signs: "loot-verdict-v3" | program (32) | contest (32) | incarnation (u64 LE) |
- * side (1; 255 calls it off) | expires (i64 LE), then | recipient (32) when the verdict names the wallet the
- * contest's chosen share pays. `incarnation` is the contest's (the decoded Contest's), so a verdict decides only the
- * contest it was signed for, never one opened later at the same id. `decide` rebuilds them from its own accounts and
- * arguments.
+ * The bytes a contest's decider key signs: "loot-verdict-v4" | sha256(program (32) | contest (32) | incarnation (u64
+ * LE) | side (u16 LE; 65535 calls it off) | expires (i64 LE), then | recipient (32) when the verdict names the wallet
+ * the contest's chosen share pays). `incarnation` is the contest's (the decoded Contest's), so a verdict decides only
+ * the contest it was signed for, never one opened later at the same id. `decide` rebuilds them from its own accounts
+ * and arguments.
  */
 export function verdictBytes({ program = LOOT_PROGRAM, contest, incarnation, side, expires, recipient = null }) {
   if (incarnation == null) throw new Error('A verdict signs the contest’s incarnation (the decoded Contest’s).');
   const named = recipient == null ? new Uint8Array(0) : addressBytes(recipient);
-  return concat(utf8(VERDICT_DOMAIN), addressBytes(program), addressBytes(contest), uintLE(incarnation, 8), uintLE(side ?? 255, 1), intLE(expires, 8), named);
+  return concat(utf8(VERDICT_DOMAIN), sha256(concat(addressBytes(program), addressBytes(contest), uintLE(incarnation, 8), uintLE(side ?? 0xffff, 2), intLE(expires, 8), named)));
 }
 
 /**
  * Names the side that won (`side`), or calls the contest off (`side: null`). `signer` is the authority; or anyone
  * sending a decider's verdict (`verdict: { expires }`, taken once entries have closed): then this instruction goes
  * right after the Ed25519 check of the decider's signature over `verdictBytes` (`ed25519Ix` in grant.js), and
- * `signer` pays the fee. Anyone writes down a contest that is off by itself. The contest's incarnation names it, so a
+ * `signer` pays the fee, as the authority does. A contest that is off by itself (overdue) needs no decision, and takes
+ * none (`ResultOverdue`): `claim` closes it. The contest's incarnation names it, so a
  * decision sent late never decides a contest opened later at the same id. A call-off takes no share accounts. A
  * contest with a chosen share is decided naming its `recipient`, a wallet (a bounty's worker); a decider's verdict
  * signs it too (`verdictBytes`).
@@ -1049,23 +1334,22 @@ export function decideIx({ signer, project, projectState, contestAddress, contes
   const address = contestAddress ?? pda.contest(project, contest.id);
   const named = recipient == null ? contest.shares : chosenShares(contest.shares, recipient);
   const shares = side == null ? [] : shareAccounts(project, named, contest.mint, { holders, programs, treasury: projectState?.treasury });
-  // A split prize is set aside when a side is named (minted, or from its pool), and its vault closes with a contest
-  // called off before anyone entered.
+  // A split prize is set aside when a side is named (minted, or from its pool). A decision never closes the contest:
+  // `claim` does, entered or not.
   const split = Boolean(contest.prize_split);
   const from = contest.prize?.Tokens?.from;
-  const closes = side == null && Number(contest.entries) === 0;
   return lootIx(
     'decide',
     { side: side ?? null, expires: toBigInt(verdict?.expires ?? 0), reference: reference(ref), incarnation: contest.incarnation, recipient },
     {
-      signer, project, contest: address, opener: contest.opener, mint: contest.mint, instructions: verdict ? SYSVAR_INSTRUCTIONS : null,
+      signer, project, contest: address, mint: contest.mint, instructions: verdict ? SYSVAR_INSTRUCTIONS : null,
       prize_mint: split ? splitMint(contest.prize, prizeMint) : null,
+      // Its pool: the prize set aside from it when a side is named.
       prize_pool: split && side != null && from?.Pool ? pda.pool(project, from.Pool[0]) : null,
       prize_vault: split ? pda.prizeVault(address) : null,
     },
-    // The mint is written by a burn share, or by closing the pot of a contest nobody entered; the prize's mint when it
-    // is minted, or when its vault closes.
-    { remaining: [...shares, ...extra], writable: [...((side == null ? closes : sharesBurn(contest.shares)) ? ['mint'] : []), ...(split && ((side != null && from?.Mint) || closes) ? ['prize_mint'] : [])] },
+    // The mint is written by a burn share; the prize's mint when it is minted.
+    { remaining: [...shares, ...tailOf(extra)], writable: [...(side != null && sharesBurn(contest.shares) ? ['mint'] : []), ...(split && side != null && from?.Mint ? ['prize_mint'] : [])] },
   );
 }
 
@@ -1082,170 +1366,383 @@ export const callbackRandomIx = ({ project, reference: ref, randomness }) => ({
 // ---------------------------------------------------------------- schedules and lotteries
 
 /**
- * Anyone (`payer`) runs a schedule that is due, and opens the account it pays into when that is not there.
+ * The project's keys or who it pays (`payer`; a sealed burn: anyone) run a schedule that is due, and open the account it
+ * pays into when that is not there. A run missed is missed: it pays once, for the latest run due, and the runs before it
+ * lapse; only a sealed schedule's fixed amount pays every run due, up to `upto` runs made (`scheduleCatchesUp`).
  * `poolMint`: the mint of the pool it moves from (when it moves from one). `extra`: a hook's or a memo's accounts.
  */
-export function runScheduleIx({ payer, project, id, schedule, poolMint, holders, programs, treasury, extra = [] }) {
+export function runScheduleIx({ payer, project, id, schedule, poolMint, holders, programs, treasury, upto = 0, extra = [] }) {
   const { from, to } = schedule.action;
   const address = pda.schedule(project, id);
   // A sealed schedule pays from its own vault (`pda.vest`), passed where a pool would be.
   const mint = from.Mint?.[0] ?? from.Vest?.[0] ?? poolMint;
   const writes = Boolean(from.Mint) || to === 'Burn';
   const pool = from.Pool ? pda.pool(project, from.Pool[0]) : from.Vest ? pda.vest(address) : null;
+  // `upto` (the runs it has plus those due, `runsDue`; 0: no bound) has an effect only on what pays every run due.
   return lootIx(
     'run_schedule',
-    {},
+    { upto },
     { payer, project, schedule: address, pool, mint },
-    { remaining: [...destinationAccounts(project, to, mint, { holders, programs, treasury }), ...extra], writable: writes ? ['mint'] : [] },
+    { remaining: [...destinationAccounts(project, to, mint, { holders, programs, treasury }), ...tailOf(extra)], writable: writes ? ['mint'] : [] },
   );
 }
 
-export const lotteryPaymentMint = (lottery) => lottery.ticket_mint && lottery.ticket_mint !== NO_ADDRESS ? lottery.ticket_mint : lottery.mint;
+
+// A lottery's rounds (`accounts.js`: `decodeRound`, `partsOwed`, `commonOwed`): each round is a record of its own, opened
+// by its first purchase. Its ask (`draw_lottery`) fixes its money and moves the lottery on; after the answer, `pull`
+// pays one part at a time, in any order, and the pull that leaves nothing owed closes it. Every builder takes the
+// decoded records it acts on, so each is pure.
+
+/** The address of a lottery's current round's record (there or not), from its decoded Lottery. */
+export const currentRound = (lotteryAddress, lottery) => pda.round(lotteryAddress, lottery.incarnation, lottery.round);
 
 /**
- * `player` buys `count` tickets: a contribution of their own at `nonce` (any number they have no contribution at in
- * this lottery), whose rent they pay and get back once it is finished. The ticket money waits in the lottery's
- * escrow until the draw. Whoever holds a collectible a fixed share pays is fixed now, from that collectible. It buys
- * only at the `lottery`'s incarnation and revision (`TermsChanged` once the owner edits or recreates it). A lottery
- * whose ticket costs an NFT (`lottery.nft_ticket`) sells one at a time, for `nft` ({ asset, collection, tokenMetadata,
- * compressed }, as `piece` takes it), which the project holds until the round is drawn (then it goes where its `then`
- * says, `spentTo`) or cancelled (then back to its buyer).
+ * `player` buys `count` tickets of lottery `id`'s current round (`lottery` decoded; `round` its decoded record, null when
+ * nobody bought into it yet: then this purchase opens it, and the lottery's spare SOL pays its rent, or the buyer fronts
+ * it, back at the close). It buys only at the revision the round copied (`TermsChanged` otherwise), and its round's
+ * address names the lottery's incarnation and round (a purchase that lands as the round moves on fails, and is sent
+ * again). A share the buyer chooses is paid now, out of the price, from the buyer's own account: to the wallet they name
+ * (`chosenRecipient`), the holder of the collectible `chosen` (its holder in `holders`), or with no choice the project's
+ * `treasury` wallet. A lottery whose ticket costs an NFT sells one at a time, for `nft` ({ asset, collection,
+ * tokenMetadata, compressed }, as `piece` takes it).
  */
-export function buyTicketsIx({ player, project, id, lottery, mint, count, nonce, shown, listProof, chosenRecipient = null, chosen = null, nft, playerToken, programs, extra = [] }) {
+export function buyTicketsIx({ player, project, id, lottery, round = null, mint, count, shown, listProof, chosenRecipient = null, chosen = null, nft, holders = {}, treasury, playerToken, programs, extra = [] }) {
   const address = pda.lottery(project, id);
-  mint ??= lotteryPaymentMint(lottery);
-  const holderAssets = (lottery.shares ?? []).flatMap((s) => (s.to.Holder ? [meta(s.to.Holder[0], false, false)] : []));
-  const held = lottery.nft_ticket ? piece({ project, wallet: player, ...nft, ...ONLY_MOVES, reads: true }) : null;
-  const paid = held ? [...pieceMetas(held), ...held.proof] : [];
+  const key = currentRound(address, lottery);
+  // The terms the round copied, or for its first purchase the lottery's.
+  const terms = round ? round.terms : lottery.terms;
+  mint ??= paymentMint(terms);
+  const paying = !terms.nft_ticket && BigInt(terms.price) > 0n;
+  const choices = paying ? chosenShares(terms.shares.filter(chosenAtPurchase), chosenRecipient) : [];
+  const recipients = shareAccounts(project, choices, mint, { holders, programs, treasury });
+  const held = terms.nft_ticket ? piece({ project, wallet: player, ...nft, ...ONLY_MOVES, reads: true }) : null;
   return lootIx(
     'buy_tickets',
-    { nonce, count, chosen_recipient: chosenRecipient, incarnation: lottery.incarnation, revision: lottery.revision },
+    { count, chosen_recipient: chosenRecipient, revision: round ? round.revision : lottery.revision },
     {
-      player, project, lottery: address, contribution: pda.contribution(address, player, nonce),
+      player, project, lottery: address, round: key,
       player_token: playerToken ?? ata(player, mint, tokenProgramOf(programs, mint)),
-      payment_vault: pda.lotteryFunds(address), mint, chosen,
-      receipt: Number(lottery.per_wallet) ? pda.lotteryReceipt(address, lottery.incarnation, player) : null,
+      payment_vault: pda.roundTokens(key, mint), mint, chosen,
+      counts: Number(lottery.per_wallet) ? pda.counts(project, player) : null,
+      associated_token_program: choices.length ? ASSOCIATED_TOKEN_PROGRAM : null,
     },
-    { remaining: [...gateAccounts(project, { gate: lottery.gate, wallet: player, shown, listProof }), ...holderAssets, ...paid, ...extra] },
+    { remaining: [...gateAccounts(project, { gate: lottery.gate, wallet: player, shown, listProof }), ...recipients, ...(held ? [...pieceMetas(held), ...held.proof] : []), ...tailOf(extra)] },
   );
 }
 
-/** Anyone asks for a lottery's draw once it is due. */
-export const drawLotteryIx = ({ payer, project, id }) => lootIx('draw_lottery', {}, { payer, lottery: pda.lottery(project, id) });
-
-/** The oracle's answer to a draw (for a local simulation). Every request of a round names the round's ticket, fixed
- * at its first ask (`asked_first`): a re-ask keeps it, so the first answer to land draws the round. */
-export function callbackLotteryIx({ project, id, lottery, askedFirst = lottery?.asked_first, randomness }) {
-  const address = pda.lottery(project, id);
-  return {
-    programId: LOOT_PROGRAM,
-    keys: [meta(pda.oracleIdentity(), true, false), meta(address, false, true), meta(ticketOf(address, askedFirst), false, false)],
-    data: encodeInstruction(IDL, 'callback_lottery', { randomness: Uint8Array.from(randomness) }),
-  };
+/**
+ * Anyone asks for the draw of a lottery's round once it is due (`lottery` decoded). `round`: the decoded record of the
+ * round asked for (null when nobody bought into the current one: it moves on, or a lottery that draws once ends, with
+ * no ask), and `roundAddress` its address when it is not the current round's (an older round still waiting for its
+ * answer: asked again after `STALE_SECONDS`, or after the timeout cancelled, with no lottery account, so `lottery` may be
+ * null then; without `round`, the current round's, with the lottery's terms). A round's first ask fixes its money: it takes
+ * the lottery's pot, its mint and the round's account of it, then each run of token prizes in place order, its mint and
+ * for a pool, the pool and the round's account of the mint (`poolMints`: a pool's index to its mint). With `skipHooked`
+ * (the project's authority only) a hooked pool or pot gives the round nothing. `extra`: hook accounts.
+ */
+export function drawLotteryIx({ payer, project, id, lottery, round = null, roundAddress = null, skipHooked = false, poolMints = {}, extra = [] }) {
+  const address = id === undefined || id === null ? null : pda.lottery(project, id);
+  const key = roundAddress ?? currentRound(address, lottery);
+  const rest = [];
+  // A round with no record moves on and a round asked before is asked again, reading none of these: they are passed
+  // unless the round is known to have been asked.
+  const current = !round || round.status === 'Open';
+  if (current) {
+    const { terms } = round ?? lottery;
+    rest.push(meta(pda.pot(address), false, true), meta(terms.mint, false, false), meta(pda.roundTokens(key, terms.mint), false, true));
+    for (const place of terms.places) {
+      const from = place.prize?.Tokens?.from;
+      if (from?.Mint) rest.push(meta(from.Mint[0], false, false));
+      else if (from?.Pool) {
+        const mint = poolMints[from.Pool[0]];
+        if (!mint) throw new Error(`The ask of a round whose place gives tokens from pool ${from.Pool[0]} needs that pool's mint (poolMints).`);
+        rest.push(meta(mint, false, false), meta(pda.pool(project, from.Pool[0]), false, true), meta(pda.roundTokens(key, mint), false, true));
+      }
+    }
+  }
+  // The lottery goes with its current round only: a round whose draw waits is asked again or cancelled without it, so a
+  // lottery closed since never strands it.
+  return lootIx('draw_lottery', { skip_hooked: skipHooked }, { payer, project, lottery: current ? address : null, round: key }, { remaining: [...rest, ...tailOf(extra)] });
 }
 
-export const cancelLotteryIx = ({ project, id }) => lootIx('cancel_lottery', {}, { lottery: pda.lottery(project, id) });
-
-/** Where a decoded contribution's shares go: as fixed when it was bought. */
-export function lotteryContributionShares(lottery, contribution) {
-  return (lottery.shares ?? []).flatMap((share, i) => {
-    const recipient = contribution.recipients[i];
-    if (recipient.kind === 2) return [];
-    const to = recipient.kind === 1 ? { Wallet: [recipient.wallet] } : share.to?.Chosen ? 'Treasury' : share.to;
-    return [{ ...share, to }];
-  });
-}
+/** The oracle's answer to a round's draw (for a local simulation): the round's record is its only account. */
+export const callbackLotteryIx = ({ round, randomness }) => ({
+  programId: LOOT_PROGRAM,
+  keys: [meta(pda.oracleIdentity(), true, false), meta(round, false, true)],
+  data: encodeInstruction(IDL, 'callback_lottery', { randomness: Uint8Array.from(randomness) }),
+});
 
-/**
- * Anyone (`payer`) sends a contribution's next step (`lotteryStep`; `contributionAddress`, decoded `contribution`):
- *   - a drawn round gives every place's prize first: the step of a contribution that won a place with a prize gives
- *     the first such prize not given yet to its buyer, one place a call (`prizeMetas`: `collection`, `poolMints`, `items`, `nfts` as it takes them; a roll's
- *     order at `nonce` plus the place, `prizeNonce(contributionAddress)` by default), and nothing else moves;
- *   - once every prize is given, it is routed through its shares into the pot (or its tickets burned, or its NFT ticket
- *     spent); a cancelled round's, or a lottery's that returns its tickets, goes back to its buyer, never waiting;
- *   - one that holds a winning ticket stays (`done`): once every contribution is finished, it pays its buyer every
- *     place's share of the pot it won, into their account of the pot's mint.
- * `payer` opens any account it pays into that is not there. `treasury`: the project's treasury wallet, for a share
- * that names it. A ticket an NFT paid for passes that NFT (`ticket`: its kind, as `piece` takes it); `handBack` when the
- * wallet its price gives it to is an account of the loot program (`handsBack`), where it goes back to its buyer (a
- * Token Metadata NFT into the buyer's token account).
- */
-export function finishLotteryContributionIx({ payer, project, id, lottery, contributionAddress, contribution, treasury, nonce, collection, poolMints, items, nfts = {}, ticket = {}, handBack = false, programs, extra = [] }) {
-  const address = pda.lottery(project, id);
-  const step = lotteryStep(lottery, contribution) ?? (contribution.done ? 'pay' : lottery.status === 'Drawn' ? 'finish' : 'refund');
-  nonce = toBigInt(nonce ?? prizeNonce(contributionAddress));
-  const accounts = { payer, project, lottery: address, contribution: contributionAddress, payment_vault: pda.lotteryFunds(address), pot: pda.pot(address), player: contribution.player };
-  if (step === 'prizes') {
-    // One place a call: the first it won whose prize is not given yet. The places go in order, so collectibles of one
-    // item are made in place order, each at the next serial.
-    const [place] = lotteryOwed(lottery, contribution);
-    const prize = lottery.places[place].prize;
-    const prizes = prizeMetas({ project, collection, prize, winner: contribution.player, nonce: BigInt.asUintN(64, nonce + BigInt(place)), poolMints, items, nft: nfts[prize.Nft?.nft ?? prize.Held?.[0]], programs, lottery: address });
-    return lootIx('finish_lottery_contribution', { nonce }, { ...accounts, to: null, mint: lottery.mint }, { remaining: [...prizes, ...extra] });
-  }
-  if (step === 'pay') {
-    return lootIx('finish_lottery_contribution', { nonce }, { ...accounts, to: ata(contribution.player, lottery.mint, tokenProgramOf(programs, lottery.mint)), mint: lottery.mint }, { remaining: extra });
+/** The accounts a round's close takes after a pull's own: each of its token accounts, its mint and who opened it (the
+ * lottery, which gets its spare back, or a buyer who fronted it; `owner` for one the lottery opened, once it is closed). */
+export const roundCloseMetas = (key, r, owner = null) =>
+  r.accounts.filter((o) => o.mint !== NO_ADDRESS).flatMap((o) => [meta(pda.roundTokens(key, o.mint), false, true), meta(o.mint, false, true), meta(owner && o.by === r.lottery ? owner : o.by, false, true)]);
+
+/** The NFT a raffle's place draws from the lottery's own stash (`stash` decoded, as it is now) with the round's answer. */
+export const raffledNft = (stash, answer, place) => stash?.nfts[weighted(stream(answer, [TAG.LOTTERY, place]), stash.weights)] ?? null;
+
+/**
+ * The NFT of the lottery's own stash each place of a drawn round that holds or draws one gets, in place order, as the
+ * pulls take them out (`LotteryRound::assign`): the ones already taken out (`r.nfts`), then the rest as the stash
+ * (`stash`, decoded as it is now) gives them, a named one found or one drawn by weight with the round's answer, each
+ * taken out before the next. null for a place whose NFT isn't there (it gets nothing).
+ */
+export function stashNfts(r, stash) {
+  const nfts = r.nfts.map((n, k) => (k < Number(r.assigned) ? (n === NO_ADDRESS ? null : n) : undefined));
+  const rows = { nfts: [...(stash?.nfts ?? [])], weights: [...(stash?.weights ?? [])] };
+  const take = (row) => {
+    if (row == null || row < 0) return null;
+    const nft = rows.nfts[row];
+    const last = rows.nfts.length - 1;
+    [rows.nfts[row], rows.weights[row]] = [rows.nfts[last], rows.weights[last]];
+    rows.nfts.pop();
+    rows.weights.pop();
+    return nft;
+  };
+  const w = roundWinners(r);
+  let [k, first] = [0, 0];
+  for (const p of r.terms.places) {
+    const times = Number(p.times);
+    if (ownStash(p)) {
+      for (let place = first; place < first + times && place < w; place++, k++) {
+        if (nfts[k] !== undefined) continue;
+        nfts[k] = p.prize?.Held ? take(rows.nfts.indexOf(p.prize.Held[0])) : take(weighted(stream(r.answer, [TAG.LOTTERY, place]), rows.weights));
+      }
+      k += Math.max(0, first + times - Math.max(first, w));
+    }
+    first += times;
   }
-  const mint = lotteryPaymentMint(lottery);
-  // Drawn, its tickets go through the shares into the pot; in a lottery that returns them, back to the buyer.
-  const routed = step === 'finish';
-  const burns = routed && lottery.ticket_mint !== NO_ADDRESS;
-  // Burning the tickets, or a share that burns, writes the mint's supply.
-  const writesMint = burns || (routed && sharesBurn(lottery.shares ?? []));
-  const nft = contribution.asset && contribution.asset !== NO_ADDRESS;
-  let remaining = routed && !burns ? shareAccounts(project, lotteryContributionShares(lottery, contribution), mint, { programs, treasury }) : [];
-  if (nft) {
-    // Drawn: where its price sends it (it stays with the project in a stash); cancelled: back to its buyer.
-    const then = routed ? lottery.nft_ticket?.then : null;
-    const receiver = then ? spentTo(project, then) : null;
-    const burned = then === 'Burn' || Boolean(then?.Burn);
-    // Given to a wallet that is an account of the loot program (`handBack`), it goes back to its buyer instead.
-    const holder = then?.Stash || (handBack && then?.Give) ? contribution.player : receiver ?? contribution.player;
-    const p = piece({ project, asset: contribution.asset, wallet: holder, ...ticket, moves: !then?.Stash, locks: false, burns: burned, reads: false });
-    remaining = [...pieceMetas(p), ...p.proof, ...(receiver ? [meta(receiver, false, Boolean(then.Stash))] : [])];
+  return nfts.map((n) => n ?? null);
+}
+
+/** The program's rule for where a part nobody can take goes: the treasury's wallet, then its account of the mint. */
+const treasuryAccounts = (treasury, mint, programs) => walletAccounts(treasury, mint, programs);
+
+/**
+ * Anyone (`payer`) pulls `part` of the round at `roundAddress` (`round` decoded; `partsOwed` and `commonOwed` say what is
+ * owed):
+ *   'Own'            entry `entry`'s own part: a refund, a no-loss ticket's price, or its NFT ticket back or where its
+ *                    price sends it (`ticket` its kind as `piece` takes it; `handBack` when the wallet its price gives
+ *                    it to is an account of the loot program; `hold`: made a hold for whoever it is owed to instead);
+ *   { Pot: [run] }   the entry's places in the run, their part of the pot, paid into the buyer's account;
+ *   { Prize: [run] } their prize: tokens into the buyer's account, or each place's prize (`prize`: { stash, the lottery's
+ *                    own stash decoded, for NFTs not taken out yet (`stashNfts`); stashes, a project stash's id to its
+ *                    decoded stash; nfts, an NFT's kind by its asset; hold, NFTs made holds; most, the most places a
+ *                    pull carries; and what `prizeMetas` takes: collection, poolMints, items, projectMint }), a roll's
+ *                    order at `prizeRollNonce(nonce + place)` (ask it in the same transaction: `pullRolls`);
+ *   { Common: [i] }  a part owed in common: share `i`, the pot's (`i` = the shares' count), a pool's prize back after a
+ *                    cancel (past it), paid where it goes (`holders`, `programs`); `toTreasury` when that can't take it
+ *                    (a pool never opened, the pot closed since or made again in another mint, an account gone: a
+ *                    holder nobody is is found here).
+ * The pull that leaves nothing owed closes the round (`projectState`: its treasury and owner; `lotteryClosed` when the
+ * lottery is gone, so rent it lent goes to the owner). A round that owes nothing and waits only for its close is closed
+ * by any pull.
+ */
+export function pullIx({ payer, project, roundAddress: key, round: r, entry = 0, part = 'Own', projectState, ticket = {}, handBack = false, hold = false, nonce = 0n, prize = {}, holders = {}, toTreasury = false, lotteryClosed = false, programs, extra = [] }) {
+  const rest = [];
+  let [mint, to, settled, buyer, partial] = [null, null, 1, payer, false];
+  const account = (m, wallet) => ata(wallet, m, tokenProgramOf(programs, m));
+  const finished = roundFinished(r);
+  const e = part.Common || finished ? null : r.entries[entry];
+  if (e) buyer = e.buyer;
+  if (finished) settled = 0;
+  else if (part === 'Own' && e.nft !== NO_ADDRESS) {
+    const back = r.status === 'Cancelled' || r.terms.returns;
+    const then = back ? null : r.terms.nft_ticket?.then;
+    if (hold) {
+      rest.push(meta(pda.hold(e.nft, 0), false, true));
+      if (then?.Give) rest.push(meta(then.Give[0], false, true));
+    } else {
+      // Where its price sends it (a stash keeps it where it is), or back to its buyer.
+      const receiver = then ? spentTo(project, then) : null;
+      const holder = then?.Stash || (handBack && then?.Give) ? e.buyer : receiver ?? e.buyer;
+      const p = piece({ project, asset: e.nft, wallet: holder, ...ticket, moves: !then?.Stash, locks: false, burns: then === 'Burn' || Boolean(then?.Burn), reads: false });
+      rest.push(...pieceMetas(p), ...p.proof, ...(receiver ? [meta(receiver, false, true)] : []));
+    }
+  } else if (part === 'Own') [mint, to] = [paymentMint(r.terms), account(paymentMint(r.terms), e.buyer)];
+  else if (part.Common) {
+    const i = Number(part.Common[0]);
+    const n = r.terms.shares.length;
+    let dest;
+    if (i < n) [mint, dest] = [paymentMint(r.terms), r.terms.shares[i].to];
+    else if (i === n) [mint, dest] = [r.terms.mint, { Account: [pda.pot(r.lottery)] }];
+    else {
+      const p = r.prizes[i - n - 1];
+      [mint, dest] = [p.mint, r.terms.places[Number(p.run)].prize.Tokens.from];
+    }
+    rest.push(...destinationAccounts(project, dest, mint, { holders, programs, treasury: projectState?.treasury }));
+    const nobody = dest.Holder && !holders[dest.Holder[0]];
+    if (toTreasury || nobody) rest.push(...treasuryAccounts(projectState?.treasury, mint, programs));
+  } else if (part.Pot || tokenRun(r, Number(part.Prize[0]))) {
+    const run = Number((part.Pot ?? part.Prize)[0]);
+    const p = part.Prize ? r.prizes.find((x) => Number(x.run) === run) : null;
+    mint = p ? p.mint : r.terms.mint;
+    to = account(mint, e.buyer);
+    settled = placesPulled(r, entry, run, Boolean(part.Prize));
+  } else {
+    // Each of the entry's places in the run whose prize is not given yet, lowest first.
+    const run = Number(part.Prize[0]);
+    const given = r.terms.places[run].prize;
+    const places = prizePlacesOwed(r, entry, run);
+    const own = ownStash(r.terms.places[run]);
+    const nfts = own ? stashNfts(r, prize.stash) : [];
+    if (own) rest.push(meta(pda.lotteryStash(r.lottery), false, true));
+    const handed = (asset) => (prize.hold ? [meta(pda.hold(asset, 0), false, true)] : (() => {
+      const p = piece({ project, asset, wallet: e.buyer, ...(prize.nfts?.[asset] ?? {}), ...ONLY_MOVES });
+      return [...pieceMetas(p), ...p.proof];
+    })());
+    let [carried, made, stashed] = [0, 0, false];
+    for (const place of places) {
+      if (own && nfts[nftSlot(r, place)] == null) continue;
+      if (prize.most != null && carried >= prize.most) {
+        partial = true;
+        break;
+      }
+      carried += 1;
+      if (own) rest.push(...handed(nfts[nftSlot(r, place)]));
+      else if (given.Nft) {
+        // A project stash's NFT, while the stash holds it: its stash, then the NFT (once: one place takes it).
+        const { stash, nft: asset } = given.Nft;
+        const holds = prize.stashes?.[stash] ? prize.stashes[stash].nfts.includes(asset) : true;
+        rest.push(meta(pda.stash(project, stash), false, true));
+        if (holds && !stashed) rest.push(...handed(asset));
+        stashed ||= holds;
+      } else {
+        rest.push(...prizeMetas({ project, collection: prize.collection, prize: given, winner: e.buyer, nonce: BigInt.asUintN(64, toBigInt(nonce) + BigInt(place)), poolMints: prize.poolMints, items: prize.items, nft: prize.nfts?.[given.Item?.[0]], made, projectMint: prize.projectMint, programs }));
+        if (given.Item) made += 1;
+      }
+    }
+    settled = places.length;
   }
-  // A free ticket gives nothing back, and needs no account to give it into.
-  const back = !routed && !nft && BigInt(contribution.amount ?? 0) > 0n;
-  return lootIx('finish_lottery_contribution', { nonce }, { ...accounts, to: back ? ata(contribution.player, mint, tokenProgramOf(programs, mint)) : null, mint }, { remaining: [...remaining, ...extra], writable: writesMint ? ['mint'] : [] });
+  const closes = finished || (!partial && (r.status === 'Drawn' || r.status === 'Cancelled') && Number(r.owed) <= settled);
+  const owner = lotteryClosed ? projectState?.owner : null;
+  if (closes) rest.push(...roundCloseMetas(key, r, owner));
+  const opener = owner && r.opener === r.lottery ? owner : r.opener;
+  return lootIx(
+    'pull',
+    { entry: part.Common || finished ? 0 : entry, part, nonce: toBigInt(nonce) },
+    { payer, project, round: key, buyer, mint, vault: mint ? pda.roundTokens(key, mint) : null, to, opener: closes ? opener : null, treasury: closes ? projectState?.treasury : null },
+    { remaining: [...rest, ...tailOf(extra)] },
+  );
+}
+
+/** The orders the rolls a `{ Prize: [run] }` pull of entry `entry` makes (a place's prize that is a roll), each with its
+ * box: [{ order, box }], at `prizeRollNonce(nonce + place)` for the entry's buyer. Ask each in the pull's transaction. */
+export function pullRolls({ project, round: r, entry, part, nonce = 0n }) {
+  const run = Number(part?.Prize?.[0] ?? -1);
+  const given = r.terms.places[run]?.prize;
+  if (!given?.Roll) return [];
+  const buyer = r.entries[entry].buyer;
+  return prizePlacesOwed(r, entry, run).map((place) => ({ order: pda.order(project, buyer, prizeRollNonce(BigInt.asUintN(64, toBigInt(nonce) + BigInt(place)))), box: given.Roll[0] }));
 }
 
 // ---------------------------------------------------------------- farms
 
 /**
- * The owner opens farm `id`: of `stakedMint`'s tokens, or of collectibles when it is null. Its rewards come from pool
- * `args.rewards_pool`, whose mint is `rewardsMint`: all it receives, shared, or with `args.rate` ({ per_day, mints })
- * a fixed rate, minted or from that pool (a rate of 0 pays nothing: a farm that only grows or gives prizes).
- * `args.gates`: the rules an NFT must all pass. `args.growth`: up to 4 of { key, per_day, level, steps, streak }, each
- * writing points (and a level) on what is staked; tiers' `prize` is paid from `args.prize` ({ Mint: [mint] } or
- * { Pool: [index] }), whose mint is `prizeMint`. `args.ends_at`: when it ends (0: never). For a farm of collectibles,
- * `args.lock_key`: the attribute a staked NFT's lock is written under, as the time it ends, so recipes and rolls can
- * move it; `args.upkeep_key`: the attribute that says until when it earns and grows (fuel). Empty: none.
+ * The owner opens farm `id`: of `stakedMint`'s tokens, or of collectibles when it is null. Its rewards are `rewardsMint`'s,
+ * in its own rewards vault (`pda.rewards(farm)`), which anything funds by a plain transfer (a share or a schedule paying
+ * `{ Account: [vault] }`): all that lands there, shared, or with `args.rate` ({ per_day, mints, shared, halve_every }) a
+ * fixed rate, for each seat at x1 or with `shared` the whole farm's shared by weight, halving every `halve_every`
+ * seconds from the farm's opening (0: never), minted when a seat is paid or paid from what the vault holds free while it
+ * lasts (a rate of 0 pays nothing: a farm that only grows or gives prizes). `args.gates`: the rules an NFT must all
+ * pass. `args.growth`: any number of { key, per_day, level, steps, streak, profile, at_least }, each writing points (and
+ * a level) on what is staked, or with `profile` on the staker's profile (a token seat only while it stakes `at_least`);
+ * a tier's `earns_for`: seconds a seat earns and grows after its lock started (0: no end). `args.ends_at`: when it ends
+ * (0: never). For a farm of collectibles, `args.lock_key`: the attribute a staked NFT's lock is written under, as the
+ * time it ends, so recipes and rolls can move it; `args.upkeep_key`: the attribute that says until when it earns and
+ * grows (fuel). Empty: none. `args.exit_to`: where early-exit fees go, 'Burn', { Pool: [index] } or 'Rewards' (the
+ * farm's own vault: a farm whose staked token is its rewards'). A farm whose seats can stop earning and that pays keeps a
+ * record of when (`farmKeepsEnds`, `pda.ends`), made here at the owner's rent; each new time costs its writer `END_BYTES`.
  */
 export const openFarmIx = ({ owner, project, id, args, rewardsMint, stakedMint = null }) => {
   if (!Array.isArray(args?.tiers)) throw new Error('A farm needs its lock tiers (`args.tiers`: [{ lock, bps }, …]).');
-  const full = { gates: [], rate: null, growth: [], ends_at: 0, lock_key: '', upkeep_key: '', exit_to: null, unbond: 0, toll: null, ...args, tiers: args.tiers.map((t) => ({ prize: null, roll: null, exit_bps: 0, ...t })) };
+  const full = {
+    gates: [], ends_at: 0, lock_key: '', upkeep_key: '', exit_to: null, ...args,
+    rate: args.rate ? { mints: false, shared: false, halve_every: 0, ...args.rate } : null,
+    tiers: args.tiers.map((t) => ({ prize: null, roll: null, exit_bps: 0, earns_for: 0, ...t })),
+    growth: (args.growth ?? []).map((g) => ({ profile: false, at_least: 0n, ...g })),
+  };
   return lootIx('open_farm', { id, args: full }, {
-    owner, project, rewards_pool: pda.pool(project, args.rewards_pool), rewards_mint: rewardsMint, staked_mint: stakedMint,
+    owner, project, rewards_mint: rewardsMint, staked_mint: stakedMint,
     staked_vault: stakedMint ? pda.staked(pda.farm(project, id)) : null,
-    exit_pool: sinkPool(project, full.exit_to), toll_pool: sinkPool(project, full.toll?.to),
+    exit_pool: sinkPool(project, full.exit_to),
+    ends: farmKeepsEnds(full) ? pda.ends(pda.farm(project, id)) : null,
+  }, {
+    // Each box its tiers name to roll, tier by tier (its roll, then a prize that is a roll), once.
+    remaining: boxesAccounts(project, full.tiers.flatMap((t) => [t.roll, t.prize?.Roll?.[0]].filter((x) => x != null))),
   });
 };
 
-/** Where a farm's fee goes (`Sink`): the pool's address for `{ Pool: [index] }`, null for a burn or none. */
+/**
+ * Whether a farm with these args keeps a record of when its seats stop earning (`Farm::keeps_ends`): a tier has a term
+ * (`earns_for`) or the farm reads an upkeep (`upkeep_key`), and it pays something (no rate, or a rate above 0). The farm
+ * and every move of it then pass the record (`WrongEnds` otherwise).
+ */
+export const farmKeepsEnds = (args) =>
+  ((args.tiers ?? []).some((t) => BigInt(t.earns_for ?? 0) > 0n) || Boolean(args.upkeep_key)) && (!args.rate || BigInt(args.rate.per_day ?? 0) > 0n);
+
+/** Where a farm's fee goes (`Sink`): the pool's address for `{ Pool: [index] }`, null for a burn, its own vault or none. */
 const sinkPool = (project, sink) => (sink?.Pool ? pda.pool(project, sink.Pool[0]) : null);
-/** The pools a farm's early-exit fees and toll go to, when they go to one (`exit_pool`, `toll_pool`). */
-const farmSinks = (project, farm) => ({ exit_pool: sinkPool(project, farm.exit_to), toll_pool: sinkPool(project, farm.toll?.to) });
-/** A toll that burns writes the rewards' mint. */
-const tollWrites = (farm) => (farm.toll?.to === 'Burn' ? ['rewards_mint'] : []);
 
 const farmSide = (project, id, farm) => ({
   project,
   farm: pda.farm(project, id),
-  rewards_pool: pda.pool(project, farm.rewards_pool),
   rewards_mint: farm.rewards_mint,
+  ends: farm.keeps_ends ? pda.ends(pda.farm(project, id)) : null,
 });
-/** What every move of a farm writes: its rewards' mint when it mints at a fixed rate, its rewards pool otherwise. */
-const farmWrites = (farm) => (farm.rate?.mints ? ['rewards_mint'] : ['rewards_pool']);
+
+/**
+ * What a farm has to walk (`Farm::walk`): the times of its record of ends (`ends`, from `decodeEnds`; an empty list for none)
+ * past its clock, up to `now` (Unix seconds, the chain's clock) or the farm's end. Every move walks all of them first, each a
+ * little compute, so a farm idle past many ends may leave a move no room: `farmNeedsWalk`.
+ */
+export function endsToWalk(farm, ends, now) {
+  const clock = BigInt(farm.clock ?? 0);
+  const over = BigInt(farm.ends_at ?? 0);
+  const stop = over > 0n && over < BigInt(now) ? over : BigInt(now);
+  return ends.filter((e) => e.at > clock && e.at <= stop).length;
+}
+
+/** How many ends `walk_farm` walks in one transaction at `WALK_COMPUTE_UNITS`: an end takes at most some 2,300 units, with a
+ * halving rate (`js/test/farm-ends.test.mjs` measures it). */
+export const WALK_PER_TX = 500;
+/** The compute units a transaction that walks ends asks for: `walk_farm`, or a move with ends to walk first. */
+export const WALK_COMPUTE_UNITS = 1_400_000;
+/** How many ends a move can walk first at `WALK_COMPUTE_UNITS` and still do its own work: past this, the farm is walked
+ * first (`farmNeedsWalk`). */
+export const MOVE_WALK_ROOM = 400;
+
+/**
+ * Whether a farm has passed more ends than a move can walk in its own transaction (`endsToWalk`, `MOVE_WALK_ROOM`): such
+ * a move fails on compute until `walk_farm` has caught the farm up. Nothing is lost by waiting: what a seat earned by
+ * its end is written when the farm walks past it, however late.
+ */
+export const farmNeedsWalk = (farm, ends, now) => endsToWalk(farm, ends, now) > MOVE_WALK_ROOM;
+
+/**
+ * The transactions that walk a farm up to now, oldest ends first: one `walkFarmIx` each, `perTx` ends at most, `[]` when
+ * it has nothing to walk. Anyone may send them, in order; each is free but for its network fee.
+ */
+export function walkFarmParts({ project, id, farm, ends, now, perTx = WALK_PER_TX }) {
+  const left = endsToWalk(farm, ends, now);
+  const parts = [];
+  for (let done = 0; done < left; done += perTx) parts.push(walkFarmIx({ project, id, farm, most: Math.min(perTx, left - done) }));
+  return parts;
+}
+
+/**
+ * Credits a farm up to at most `most` of the times its seats stopped earning. Anyone may send it, signing nothing but its
+ * network fee: it decides nothing, every move walks the same times the same way. For a farm that has passed more of them
+ * than a move's transaction can walk (`farmNeedsWalk`, `walkFarmParts`).
+ */
+export const walkFarmIx = ({ project, id, farm, most = WALK_PER_TX }) =>
+  lootIx('walk_farm', { most }, farmSide(project, id, farm));
+/** Whether a farm reads or writes its seats' players' profiles (`Farm::uses_profile`): a gate or a boost on a profile,
+ * or a growth written on one. Its moves then pass the player's profile. */
+const usesProfile = (farm) => [...(farm.gates ?? []), ...(farm.boosts ?? []).map((b) => b.rule)].some((r) => r?.of === 'Profile') || (farm.growth ?? []).some((g) => g.profile);
+const profileOf = (project, farm, player) => (usesProfile(farm) ? pda.profile(project, player) : null);
+
+/** What a move that pays a seat writes: the rewards' mint, when the farm mints at a fixed rate (it mints at payout). */
+const payWrites = (farm) => (farm.rate?.mints ? ['rewards_mint'] : []);
 
 /** A token seat's accounts; `paid`: rewards may be paid (an unstake), so the player's account of them comes. */
 function tokenSeat({ player, project, id, farm, programs, paid = false }) {
@@ -1259,33 +1756,70 @@ function tokenSeat({ player, project, id, farm, programs, paid = false }) {
     mint,
     player_tokens: ata(player, mint, tokenProgramOf(programs, mint)),
     player_rewards: paid ? ata(player, farm.rewards_mint, tokenProgramOf(programs, farm.rewards_mint)) : null,
-    ...farmSinks(project, farm),
+    exit_pool: sinkPool(project, farm.exit_to),
+    profile: profileOf(project, farm, player),
   };
 }
 
 /**
- * `player` stakes `amount` at lock tier `tier`. `farm` is decoded; `extra` carries token hook/memo accounts. A new tier
- * on a seat with a booster, in a farm with growth, needs the booster's growth written first: put a `refreshSeatIx` of
- * the seat before it, in the same transaction.
+ * `player` stakes `amount` at lock tier `tier`. `farm` is decoded; `extra` carries token hook/memo accounts. A seat with
+ * a booster on, or one whose growth the stake changes, needs a `refreshSeatIx` of it first, in the same transaction
+ * (`stakeRefreshFirst`).
  */
 export const stakeTokensIx = ({ player, project, id, farm, amount, tier = 0, programs, shown, extra = [] }) =>
-  lootIx('stake_tokens', { amount, tier }, tokenSeat({ player, project, id, farm, programs }), { remaining: [...shownAccounts(project, shown), ...extra], writable: [...farmWrites(farm), ...tollWrites(farm)] });
+  lootIx('stake_tokens', { amount, tier }, tokenSeat({ player, project, id, farm, programs }), { remaining: [...shownAccounts(project, shown), ...tailOf(extra)] });
 
 /**
- * `player` takes `amount` out (0: only collects what is owed, and takes out tokens whose unbonding wait is over);
- * `forfeit` gives up rewards that can't move. Before the tier's lock has run, a tier with an early-exit fee
- * (`exit_bps`) lets it leave, leaving that share of `amount` to the farm's `exit_to`. In a farm that unbonds
- * (`unbond`), what is taken out waits that long first, earning nothing (`withdrawable`).
+ * `player` takes `amount` out (0: only collects what is owed); `forfeit` gives up rewards that can't move. Before the
+ * tier's lock has run, a tier with an early-exit fee (`exit_bps`) lets it leave, leaving that share of `amount` to the
+ * farm's `exit_to`; it keeps the rewards it was credited.
  */
 export const unstakeTokensIx = ({ player, project, id, farm, amount, forfeit = false, programs, extra = [] }) =>
   lootIx('unstake_tokens', { amount, forfeit }, tokenSeat({ player, project, id, farm, programs, paid: !forfeit }), {
-    remaining: extra,
-    // An exit fee that burns writes the staked mint; a toll that burns, the rewards' mint.
-    writable: [...farmWrites(farm), ...tollWrites(farm), ...(farm.exit_to === 'Burn' ? ['mint'] : [])],
+    remaining: tailOf(extra),
+    // An exit fee that burns writes the staked mint; a farm that mints, its rewards' mint when it pays.
+    writable: [...(forfeit ? [] : payWrites(farm)), ...(farm.exit_to === 'Burn' ? ['mint'] : [])],
+  });
+
+/**
+ * Whether taking `amount` out of a token seat (decoded `seat`) needs a `refreshSeatIx` of it first, in the same
+ * transaction (`RefreshFirst`): the farm grows, and the exit closes the seat or drops it below a growth's least stake, so
+ * what it grew since its last refresh is written before it goes. Never under `forfeit`.
+ */
+export const refreshFirst = (farm, seat, amount, forfeit = false) =>
+  !forfeit && BigInt(amount) > 0n && (farm.growth ?? []).some((g) => {
+    const least = BigInt(g.at_least ?? 0) > 0n ? BigInt(g.at_least) : 1n;
+    return BigInt(seat.amount) >= least && BigInt(seat.amount) - BigInt(amount) < least;
   });
 
-/** What a token seat may take out now (Unix seconds `now`): its unbonded tokens once their wait is over, else 0. */
-export const withdrawable = (seat, now) => (BigInt(seat.leaving ?? 0) > 0n && BigInt(now) >= BigInt(seat.leaving_at) ? BigInt(seat.leaving) : 0n);
+/**
+ * Whether a stake of tokens at `tier` in a token seat (decoded `seat`; null for a new one), or with `compound` a
+ * compound of what it is owed, needs a `refreshSeatIx` of it first, in the same transaction (`RefreshFirst`), at `now`
+ * (Unix seconds, the chain's clock): a seat with a booster on (its boost is read again there, so a top-up never stakes
+ * more at a boost its booster no longer gives), or a seat that grows (a booster's growth, or its player's profile's)
+ * when the stake changes how: a new tier, a farm whose growth reads the amount, a seat past its term; a compound when
+ * that growth reads the amount.
+ * @param {any} farm
+ * @param {any} seat
+ * @param {{ tier?: number, now?: bigint | number, compound?: boolean }} [options]
+ */
+export function stakeRefreshFirst(farm, seat, { tier = seat?.tier, now, compound = false } = {}) {
+  if (!seat) return false;
+  const growth = farm.growth ?? [];
+  const booster = seat.asset !== undefined && seat.asset !== NO_ADDRESS;
+  const grows = BigInt(seat.amount) > 0n && growth.some((g) => g.profile || booster);
+  const amountGrows = growth.some((g) => g.profile || BigInt(g.at_least ?? 0) > 0n);
+  if (compound) return BigInt(seat.amount) > 0n && (booster || (grows && amountGrows));
+  const changes = Number(tier) !== Number(seat.tier) || amountGrows || (now !== undefined && BigInt(seat.earns_until ?? 0) <= BigInt(now));
+  return booster || (grows && changes);
+}
+
+/**
+ * Whether a booster put on a token seat of `farm` (decoded) needs the seat refreshed first, in the same transaction
+ * (`stake_nft`'s `RefreshFirst`): in a farm of tokens whose growth writes its players' profiles, the booster's growth
+ * starts from now, so what the seat grew before is written first.
+ */
+export const boosterRefreshFirst = (farm) => Boolean(farm.farmed?.Tokens) && (farm.growth ?? []).some((g) => g.profile);
 
 /**
  * Whether a farm (decoded) takes a stake at lock tier `tier` at `now` (Unix seconds, the chain's clock), as the program
@@ -1335,6 +1869,7 @@ export function piece({ project, asset, wallet, collection, hasAuthority = true,
       ? { collection: c.collection ?? null, tree_config: pda.treeConfig(c.tree), leaf_delegate: delegate, bubblegum_program: BUBBLEGUM_PROGRAM, compression_program: COMPRESSION_PROGRAM, log_wrapper: NOOP_PROGRAM }
       : {};
     return {
+      kind: 'compressed',
       accounts: { ...NO_PIECE, asset: c.id, sheet: sheetOf(c.id), leaf: pda.leaf(c.id), tree: c.tree, ...bubblegum },
       proof: c.proof.map((node) => meta(typeof node === 'string' ? node : encodeBase58(node), false, false)),
       writable: calls ? ['leaf', 'tree', 'tree_config'] : [],
@@ -1350,6 +1885,7 @@ export function piece({ project, asset, wallet, collection, hasAuthority = true,
     const calls = moves || locks;
     const records = calls && pnft;
     return {
+      kind: 'tokenMetadata',
       accounts: {
         ...NO_PIECE, asset, sheet: sheetOf(asset), metadata: tokenMetadata.metadata(asset), token,
         edition: calls ? tokenMetadata.edition(asset) : null,
@@ -1372,6 +1908,7 @@ export function piece({ project, asset, wallet, collection, hasAuthority = true,
   const inNone = !collection || collection === MPL_CORE_PROGRAM;
   const calls = moves || locks || writes || burns;
   return {
+    kind: 'core',
     accounts: {
       ...NO_PIECE, asset, sheet: hasAuthority ? null : sheetOf(asset),
       collection: calls && !inNone ? collection : null, mpl_core_program: calls ? MPL_CORE_PROGRAM : null,
@@ -1381,6 +1918,41 @@ export function piece({ project, asset, wallet, collection, hasAuthority = true,
   };
 }
 
+/** The accounts a further NFT of a call of several takes (`Piece::another`), after the first NFT's: only what its kind
+ * needs, the program's own address for one left out, then its proof. The first NFT passes every program any needs. */
+const ANOTHER = {
+  core: ['asset', 'sheet', 'collection'],
+  tokenMetadata: ['asset', 'sheet', 'metadata', 'edition', 'token', 'token_record', 'project_token', 'project_record', 'rule_set'],
+  compressed: ['asset', 'sheet', 'collection', 'leaf', 'tree', 'tree_config', 'leaf_delegate'],
+};
+export function anotherMetas(p) {
+  const writable = new Set([...p.writable, ...PIECE.filter((a) => a.writable).map((a) => a.name)]);
+  return [...ANOTHER[p.kind].map((name) => (p.accounts[name] == null ? meta(LOOT_PROGRAM, false, false) : meta(p.accounts[name], false, writable.has(name)))), ...p.proof];
+}
+
+/** The programs every NFT of a call of several needs, on the first NFT's piece (the call's own): Core, Token Metadata's
+ * and Bubblegum's, by what the others are. */
+function withPrograms(first, others) {
+  const kinds = new Set(others.map((p) => p.kind));
+  const a = { ...first.accounts };
+  if (kinds.has('core')) a.mpl_core_program ??= MPL_CORE_PROGRAM;
+  if (kinds.has('tokenMetadata')) {
+    a.token_metadata_program ??= TOKEN_METADATA_PROGRAM;
+    a.spl_token_program ??= TOKEN_PROGRAM;
+    a.spl_ata_program ??= ASSOCIATED_TOKEN_PROGRAM;
+    a.instructions ??= SYSVAR_INSTRUCTIONS;
+    a.rules_program ??= others.some((p) => p.accounts.rule_set && p.accounts.rule_set !== TOKEN_METADATA_PROGRAM) ? AUTH_RULES_PROGRAM : others.some((p) => p.accounts.token_record) ? TOKEN_METADATA_PROGRAM : null;
+  }
+  if (kinds.has('compressed')) Object.assign(a, { bubblegum_program: a.bubblegum_program ?? BUBBLEGUM_PROGRAM, compression_program: a.compression_program ?? COMPRESSION_PROGRAM, log_wrapper: a.log_wrapper ?? NOOP_PROGRAM });
+  return { ...first, accounts: a };
+}
+
+/**
+ * Several NFTs on one call (a hold, a stash, a farm's seats): their groups sorted by key (`keyOf`), the first the
+ * call's own and each further one after it, in ascending order (`OutOfOrder` otherwise). Returns [first, ...rest].
+ */
+const ascending = (items, keyOf) => [...items].sort((a, b) => compareBytes(addressBytes(keyOf(a)), addressBytes(keyOf(b))));
+
 /** The account an NFT paid goes to: the wallet it is given to, the stash it goes into, or the
  * incinerator for a burn (any account stands in for a Core asset, which Core burns). `then`: 'Burn', { Give: [wallet] }
  * or { Stash: [id] }. */
@@ -1427,7 +1999,7 @@ export function payNftIx({ player, project, asset, to = null, collection, hasAut
   if (to === project) throw new Error('An NFT paid can’t go to the project’s own address: name a wallet, or burn it.');
   const receiver = to ?? INCINERATOR;
   const p = passedOn({ project, owner: player, receiver, burns: receiver === INCINERATOR, asset, collection, hasAuthority, tokenMetadata: tm, compressed });
-  return lootIx('pay_nft', { reference: reference(ref) }, { player, project, ...p.accounts, to: receiver }, { remaining: [...p.proof, ...extra], writable: p.writable });
+  return lootIx('pay_nft', { reference: reference(ref) }, { player, project, ...p.accounts, to: receiver }, { remaining: [...p.proof, ...tailOf(extra)], writable: p.writable });
 }
 
 /**
@@ -1491,11 +2063,53 @@ export const TOKEN_ACCOUNT_RENT = 2_039_280n;
 /** A route that only hands the NFT to the project or sends it on (a hold, an auction's lot, a refund): no Sheet, no write. */
 const ONLY_MOVES = { moves: true, locks: false, writes: false, reads: false };
 
+/** Whether `asset` goes as its hold (`["hold", asset, 0]`, passed in its piece's place): `hold` true for every NFT a
+ * route owes, or a list of the assets to hold. */
+const holds = (hold, asset) => (Array.isArray(hold) ? hold.includes(asset) : Boolean(hold));
+
 /** A piece that reads no NFT: `at` (an auction's or a seat's own address) stands in for one. */
 const standIn = (at) => ({ accounts: { ...NO_PIECE, asset: at }, proof: [], writable: [] });
 
-/** Anyone closes a compressed NFT's record (`pda.leaf`) that no longer matches its tree; its rent goes to `payer`, who paid it. */
-export const closeLeafIx = ({ asset, tree, payer }) => lootIx('close_leaf', {}, { record: pda.leaf(asset), tree, payer });
+/**
+ * A compressed NFT's record (`pda.leaf`) closes, its rent back to `payer`, who paid it: at any time with `payer` signing
+ * (`signs`, the default), or by anyone once it no longer matches its tree. A route that finds no record asks for a proof
+ * again (`NotProven`), so a client closes it in the transaction that used it (`withLeafCloses`).
+ */
+export const closeLeafIx = ({ asset, tree, payer, signs = true }) => lootIx('close_leaf', {}, { record: pda.leaf(asset), tree, payer, project: null, edition: null }, { signer: signs ? ['payer'] : [] });
+
+const PROVE_LEAF = leaves(instructionDef('prove_leaf').accounts).map((a) => a.name);
+const CLOSE_LEAF = leaves(instructionDef('close_leaf').accounts).map((a) => a.name);
+const isLoot = (ix, name) => ix.programId === LOOT_PROGRAM && instructionOf(ix.data)?.name === name;
+
+/**
+ * `instructions` with a `close_leaf` after them for each compressed NFT's record a `prove_leaf` among them makes, its
+ * prover signing as the record's payer, so the record's rent comes back in the same transaction (one closed already is
+ * left alone).
+ */
+export function withLeafCloses(instructions) {
+  const at = (ix, names, name) => ix.keys[names.indexOf(name)]?.pubkey;
+  const closed = new Set(instructions.filter((ix) => isLoot(ix, 'close_leaf')).map((ix) => at(ix, CLOSE_LEAF, 'record')));
+  const closes = [];
+  for (const ix of instructions.filter((x) => isLoot(x, 'prove_leaf'))) {
+    const record = at(ix, PROVE_LEAF, 'record');
+    if (closed.has(record)) continue;
+    closed.add(record);
+    closes.push(closeLeafIx({ asset: at(ix, PROVE_LEAF, 'asset'), tree: at(ix, PROVE_LEAF, 'tree'), payer: at(ix, PROVE_LEAF, 'signer') }));
+  }
+  return closes.length ? [...instructions, ...closes] : instructions;
+}
+
+/**
+ * Anyone closes the Sheet of an NFT that is burned: `burned` is what shows it (the Core asset's own address, burned to
+ * one byte; a Token Metadata mint holding none; or a compressed NFT's record proving its leaf burned). Its rent goes to
+ * the project's `treasury` wallet. A compressed NFT's (`tree`: the tree it was minted in) closes only on a record proven
+ * empty (its data hash all zeros: a live leaf of the default owner is not burned) that still reads against that tree,
+ * or whose tree is gone: the tree goes in the edition's place, and `burned` defaults to the NFT's record
+ * (`pda.leaf`). A Token Metadata NFT's (`tokenMetadata`: true, or its kind) names its edition, which must be closed
+ * too: its mint holds none, with no mint authority but its edition (`NotBurned` otherwise).
+ */
+export const closeSheetIx = ({ project, nft, tree = null, burned = tree ? pda.leaf(nft) : nft, treasury, tokenMetadata: tm = null }) =>
+  lootIx('close_leaf', {}, { record: pda.sheet(project, nft), tree: burned, payer: treasury, project, edition: tm ? tokenMetadata.edition(nft) : tree });
 
 /**
  * Anyone proves a compressed NFT's leaf (`compressed` from `compressedFromDas`): put it before the instruction that
@@ -1531,6 +2145,7 @@ function nftSeat({ player, project, id, farm, asset, collection, hasAuthority =
   const p = piece({ project, asset, wallet: player, collection, hasAuthority, tokenMetadata: tm, compressed, ...keeps });
   const key = compressed ? compressed.id : asset;
   return {
+    kind: p.kind,
     accounts: {
       ...farmSide(project, id, farm),
       player,
@@ -1539,67 +2154,101 @@ function nftSeat({ player, project, id, farm, asset, collection, hasAuthority =
       seat: pda.seat(farmAddress, farm.farmed.Tokens ? player : key),
       // Rewards are paid only as an NFT's own seat leaves.
       player_rewards: leaving && !farm.farmed.Tokens ? ata(player, farm.rewards_mint, tokenProgramOf(programs, farm.rewards_mint)) : null,
+      profile: profileOf(project, farm, player),
     },
     proof: p.proof,
     writable: p.writable,
   };
 }
 
+/** A further seat's group of a call of several (`NftSeat`): the seat, its NFT's accounts (`anotherMetas`), its box and
+ * order leaving a mission that rolls (the program's address for none), then its proof (and an unstake's prize's). */
+const seatGroup = (seat, p, box = null, order = null) => [meta(seat, false, true), ...anotherMetas({ ...p, proof: [] }), meta(box ?? LOOT_PROGRAM, false, false), meta(order ?? LOOT_PROGRAM, false, Boolean(order)), ...p.proof];
+
 /**
  * `player` stakes an NFT: on a seat of its own in a farm of collectibles, or as the booster of the player's token seat
  * in a farm of tokens. Any kind (`piece`): a Core asset, a Token Metadata NFT's mint with `tokenMetadata`, or
  * `compressed` (after a `proveLeafIx` in the same transaction). `previous`: in a farm that watches, the last staker of
- * an NFT that changed hands, whose seat this takes over. `extra` carries reward token hooks/memos and Core transfer
- * adapter accounts.
+ * an NFT that changed hands, whose seat this takes over (alone). In a farm of collectibles, `more` NFTs (each { asset,
+ * collection, hasAuthority, tokenMetadata, compressed }) go in the same call at the same tier, one fee, by their seats'
+ * addresses. `extra` carries reward token hooks/memos and Core transfer adapter accounts.
  */
-export const stakeNftIx = ({ player, project, id, farm, asset, collection, hasAuthority = true, tokenMetadata: tm, compressed, previous = null, tier = 0, programs, extra = [] }) => {
+export const stakeNftIx = ({ player, project, id, farm, asset, collection, hasAuthority = true, tokenMetadata: tm, compressed, previous = null, tier = 0, programs, more = [], extra = [] }) => {
   // Its lock's end, when the farm keeps one, is written on it.
   const keeps = farmKeeps(farm, { writes: Boolean(farm.lock_key) });
-  const seat = nftSeat({ player, project, id, farm, asset, collection, hasAuthority, tokenMetadata: tm, compressed, previous, programs, keeps });
-  return lootIx('stake_nft', { tier }, { ...seat.accounts, toll_pool: farmSinks(project, farm).toll_pool }, { remaining: [...seat.proof, ...extra], writable: [...farmWrites(farm), ...tollWrites(farm), ...seat.writable] });
+  const [first, ...rest] = ascending([{ asset, collection, hasAuthority, tokenMetadata: tm, compressed }, ...more].map((n) => nftSeat({ player, project, id, farm, ...n, previous, programs, keeps })), (x) => x.accounts.seat);
+  const seat = withPrograms({ ...first, kind: first.kind }, rest);
+  const groups = rest.flatMap((x) => seatGroup(x.accounts.seat, x));
+  return lootIx('stake_nft', { tier }, seat.accounts, { remaining: [...seat.proof, ...groups, ...tailOf(extra)], writable: seat.writable });
 };
 
 /**
  * `player` takes an NFT out once its lock has run: it grows on its way out (a farm with growth writes on it, or on its
  * Sheet), and from its own seat takes its tier's prize. `forfeit` gives up the rewards and the prize. Leaving a tier
- * that rolls (`roll`: its box id), the NFT is rolled on that box, in an order at `nonce` (anyone then asks the oracle,
- * `askRollIx`, and settles); a box that can burn it or give it away keeps it in the project's hands until then.
- */
-export const unstakeNftIx = ({ player, project, id, farm, asset, collection, hasAuthority = true, tokenMetadata: tm, compressed, forfeit = false, roll = null, nonce = 0n, tier, projectCollection, poolMints, items, nft, programs, extra = [] }) => {
-  // It grows on its way out; a mission that rolls may hand it to the project.
-  const keeps = farmKeeps(farm, { writes: Boolean(farm.growth?.length), rolls: roll != null });
-  const seat = nftSeat({ player, project, id, farm, asset, collection, hasAuthority, tokenMetadata: tm, compressed, programs, leaving: true, keeps });
-  // Leaving a mission that rolls (its tier's `roll`, a box id): the box, and the order the roll is made in.
-  const rolls = roll != null ? { loot_box: pda.box(project, roll), order: pda.order(project, player, nonce) } : { loot_box: null, order: null };
-  // A mission's prize (its tier's, `tier` the seat's): its accounts after the proof, unread when it is not earned; a
-  // roll's order at `nonce` plus 1. A forfeit takes neither the prize nor the rewards (the program reads neither), so it
-  // passes neither: the smallest way out.
-  const prize = tier != null && !forfeit ? farm.tiers[tier]?.prize : null;
-  const prized = prize ? prizeMetas({ project, collection: projectCollection ?? collection, prize, winner: player, nonce: toBigInt(nonce) + 1n, poolMints, items, nft, programs }) : [];
+ * that rolls (`roll`: its box id, `boxes` its decoded box by id), the NFT is rolled on that box, in an order named by
+ * `nonce` (`namedRollNonce`: the NFT's own on a box that holds it; its player or the project's keys then ask the oracle,
+ * `askRollIx`, and settles); a box that can burn it or give it away keeps it in the project's hands until then. `more`
+ * NFTs of the player's in the farm (each { asset, collection, hasAuthority, tokenMetadata, compressed, tier, roll }) leave
+ * in the same call, one fee, one transfer of rewards: by their seats' addresses, the `i`th's roll at `nonce + 2i` and its
+ * prize's at `nonce + 2i + 1` (`seatNonces` says which NFT has which). One still locked refuses the whole call.
+ */
+export const unstakeNftIx = ({ player, project, id, farm, asset, collection, hasAuthority = true, tokenMetadata: tm, compressed, forfeit = false, roll = null, nonce = 0n, tier, projectCollection, poolMints, items, nft, boxes = {}, programs, more = [], extra = [] }) => {
+  const seats = ascending([{ asset, collection, hasAuthority, tokenMetadata: tm, compressed, tier, roll }, ...more].map((n) => {
+    // It grows on its way out; a mission that rolls may hand it to the project.
+    const keeps = farmKeeps(farm, { writes: Boolean(farm.growth?.length), rolls: n.roll != null });
+    return { n, seat: nftSeat({ player, project, id, farm, ...n, programs, leaving: true, keeps }) };
+  }), (x) => x.seat.accounts.seat);
+  const several = seats.length > 1;
+  // Each seat's mission: the box and the order its roll is made in, at `nonce + 2i`; its prize (its tier's) after its
+  // proof, a roll's order at `nonce + 2i + 1`. A forfeit takes neither the prize nor the rewards (the program reads
+  // neither), so a call of one passes neither: the smallest way out. In a call of several each seat with a prize passes
+  // its accounts, given or not, so the next seat's start where the program looks.
+  const parts = seats.map(({ n, seat }, i) => {
+    const at = BigInt.asUintN(64, toBigInt(nonce) + 2n * BigInt(i));
+    const prize = n.tier != null && (!forfeit || several) ? farm.tiers[n.tier]?.prize : null;
+    const prized = prize ? prizeMetas({ project, collection: projectCollection ?? n.collection, prize, winner: player, nonce: BigInt.asUintN(64, at + 1n), poolMints, items, nft, programs }) : [];
+    const rolls = n.roll != null ? { box: pda.box(project, n.roll), order: pda.order(project, player, namedRollNonce(boxes[n.roll], seat.accounts.asset, at)) } : { box: null, order: null };
+    return { seat, prize, prized, rolls };
+  });
+  const [first, ...rest] = parts;
+  const seat = withPrograms(first.seat, rest.map((x) => x.seat));
   if (forfeit) seat.accounts.player_rewards = null;
-  return lootIx('unstake_nft', { forfeit, nonce }, { ...seat.accounts, ...rolls, associated_token_program: prize?.Tokens ? ASSOCIATED_TOKEN_PROGRAM : null, toll_pool: farmSinks(project, farm).toll_pool }, {
-    remaining: [...seat.proof, ...prized, ...extra],
-    writable: [...farmWrites(farm), ...tollWrites(farm), ...seat.writable],
+  const groups = rest.flatMap((x) => [...seatGroup(x.seat.accounts.seat, x.seat, x.rolls.box, x.rolls.order), ...x.prized]);
+  return lootIx('unstake_nft', { forfeit, nonce }, { ...seat.accounts, loot_box: first.rolls.box, order: first.rolls.order, associated_token_program: parts.some((x) => x.prize?.Tokens) ? ASSOCIATED_TOKEN_PROGRAM : null }, {
+    remaining: [...seat.proof, ...first.prized, ...groups, ...tailOf(extra)],
+    writable: [...(forfeit ? [] : payWrites(farm)), ...seat.writable],
   });
 };
 
+/** The nonce each NFT's mission roll is named by in an `unstakeNftIx` of several (`assets`), in the order the call
+ * takes them: the `i`th by its seat's address `nonce + 2i` (its order at `namedRollNonce` of it), its prize's roll
+ * `nonce + 2i + 1` (at `prizeRollNonce`). */
+export const seatNonces = (project, id, farm, player, assets, nonce = 0n) =>
+  Object.fromEntries(ascending(assets, (a) => pda.seat(pda.farm(project, id), farm.farmed.Tokens ? player : a)).map((a, i) => [a, toBigInt(nonce) + 2n * BigInt(i)]));
+
 /**
- * `player` collects what the seat of `by` owes (their own address for tokens, a collectible's asset). `held`: in a farm
+ * `player` collects what the seat of `by` owes (their own address for tokens, a collectible's asset); with `compound`, a
+ * token seat's is staked instead (a seat with a booster on needs a `refreshSeatIx` of it first: `stakeRefreshFirst`). `held`: in a farm
  * that watches, what shows the player still holds the seat's NFT (the Core asset, their token account of a Token
- * Metadata NFT, or a compressed NFT's record, `pda.leaf`, with its `tree`), which such a farm refuses to go without.
+ * Metadata NFT, or a compressed NFT's record, `pda.leaf`, with its `tree`), which such a farm refuses to go without
+ * (`NotProven`). `more` seats of the player's in the farm (each { by, held, tree }) collect in the same call, one fee,
+ * one transfer.
  */
-export const harvestIx = ({ player, project, id, farm, by = player, held = null, tree = null, compound = false, programs, extra = [] }) =>
-  lootIx('harvest', { compound }, {
+export const harvestIx = ({ player, project, id, farm, by = player, held = null, tree = null, compound = false, programs, more = [], extra = [] }) => {
+  const farmAddress = pda.farm(project, id);
+  const [first, ...rest] = ascending([{ by, held, tree }, ...more].map((x) => ({ ...x, seat: pda.seat(farmAddress, x.by) })), (x) => x.seat);
+  const groups = rest.flatMap((x) => [meta(x.seat, false, true), meta(x.held ?? LOOT_PROGRAM, false, false), meta(x.tree ?? LOOT_PROGRAM, false, false)]);
+  return lootIx('harvest', { compound }, {
     ...farmSide(project, id, farm),
     player,
-    seat: pda.seat(pda.farm(project, id), by),
+    seat: first.seat,
     player_rewards: ata(player, farm.rewards_mint, tokenProgramOf(programs, farm.rewards_mint)),
-    held,
-    tree,
+    held: first.held,
+    tree: first.tree,
     // Compounding moves what is owed into the staked vault (a farm of tokens whose rewards are the staked token).
-    staked_vault: compound ? pda.staked(pda.farm(project, id)) : null,
-    toll_pool: farmSinks(project, farm).toll_pool,
-  }, { remaining: extra, writable: [...farmWrites(farm), ...tollWrites(farm)] });
+    staked_vault: compound ? pda.staked(farmAddress) : null,
+  }, { remaining: [...groups, ...tailOf(extra)], writable: payWrites(farm) });
+};
 
 /**
  * Anyone (`signer`) writes what a seat's NFT grew (a farm with growth), then reads its boosts again. `seat` is the
@@ -1615,7 +2264,7 @@ export const refreshSeatIx = ({ signer, project, id, farm, by, seat, collection,
   const p = seat.asset === NO_ADDRESS
     ? standIn(address)
     : piece({ project, asset: seat.asset, wallet: holder, collection, hasAuthority, tokenMetadata: tm, compressed, ...farmKeeps(farm, { writes: Boolean(farm.growth?.length) }), moves: false, locks: false });
-  return lootIx('refresh_seat', {}, { signer, ...farmSide(project, id, farm), seat: address, ...p.accounts }, { remaining: extra, writable: [...farmWrites(farm), ...p.writable] });
+  return lootIx('refresh_seat', {}, { signer, ...farmSide(project, id, farm), seat: address, ...p.accounts, profile: profileOf(project, farm, seat.player) }, { remaining: tailOf(extra), writable: p.writable });
 };
 
 // ---------------------------------------------------------------- recipes and holds
@@ -1624,19 +2273,23 @@ export const refreshSeatIx = ({ signer, project, id, farm, by, seat, collection,
  * `player` crafts recipe `id` (`recipe` decoded, the version shown to them), `times` over. `assets`: the
  * collectibles handed in, in the recipe's order (the burned, the used, and for a `Show` line the NFT shown: its address
  * when it is the project's, `{ asset, collection }` for a Core NFT of another collection, `{ mint, owner }` for a Token
- * Metadata one; for a `Trade` line the NFT traded in, as `piece` takes it: `{ asset, collection, tokenMetadata,
- * compressed }`). A collectible used or renewed that is staked in a farm holding it for the player (escrow) is
- * `{ asset, farm }`, `farm` that farm's id: its seat and farm follow it. A `Staked` line names the farm its collectible
+ * Metadata one, `{ compressed, tree }` for a compressed one; with `farm` (a farm's id: `{ asset, farm }` for the
+ * project's own) when the project locks it in the player's wallet on a seat of that farm, which freezes, and a raise on
+ * it lowers a number: its seat and farm follow it, and the raise may not lower a number that farm reads; for a `Trade` line the NFT traded in, as `piece` takes it: `{ asset, collection, tokenMetadata,
+ * compressed }`). A collectible used that is staked in a farm holding it for the player (escrow) or locking it in their
+ * wallet (freeze) is `{ asset, farm }`, `farm` that farm's id: its seat and farm follow it (a raise on it may not lower a
+ * number its farm reads: `BadRecipe`). A `Staked` line names the farm its collectible
  * is staked in (`Input::Staked { item, farm }`, escrowed or frozen there): its address, or `{ asset, farm }` with that
  * farm, and its seat and that farm follow it. Each item line passes its item's collection
  * (`items[id].collection`, the decoded Items; `collection` when not given), written for a burn: Core writes it as it
  * burns a collectible. A recipe's `raises` write on the kept ones, in their Sheet when the project has no
  * authority over them. The player opens any account a line pays into that is not there. A roll it makes (a
- * `Prize::Roll` or a `RollOn`) passes its box's prize mints (`rollMints`): `boxes` maps the box's id to its decoded
- * LootBox, `rollPools` each pool its prizes name to its mint (null for one never opened; `poolMints` when not given).
+ * `Prize::Roll` or a `RollOn`) passes its box and its order, nothing more; a `RollOn`'s order is where `namedRollNonce`
+ * says, which reads the rolled box (`boxes`: a box's id to its decoded LootBox). Its player or the project's keys then ask for the roll
+ * (`askRollIx`, in the same transaction when it fits).
  * A craft makes several Core calls: raise the compute limit. `extra`: a token's hook accounts.
  */
-export function craftIx({ player, project, collection, id, recipe, assets = [], times = 1, nonce = 0n, holders, programs, treasury, poolMints, items = {}, nfts = {}, boxes = {}, rollPools = poolMints, extra = [] }) {
+export function craftIx({ player, project, collection, id, recipe, assets = [], times = 1, nonce = 0n, holders, programs, treasury, poolMints, items = {}, nfts = {}, boxes = {}, extra = [] }) {
   const remaining = [];
   const given = [...assets];
   const tokens = (mint) => ata(player, mint, tokenProgramOf(programs, mint));
@@ -1645,8 +2298,8 @@ export function craftIx({ player, project, collection, id, recipe, assets = [],
     if (input.Burn) {
       remaining.push(...itemLine(input.Burn.item, true));
       for (let i = 0; i < input.Burn.count; i++) remaining.push(meta(take(given, 'a collectible to burn'), false, true));
-    } else if (input.Use || input.Renew || input.Staked) {
-      remaining.push(...itemLine((input.Use ?? input.Renew ?? input.Staked).item));
+    } else if (input.Use || input.Staked) {
+      remaining.push(...itemLine((input.Use ?? input.Staked).item));
       const used = take(given, 'a collectible to use');
       // A staked one is on its seat in the farm its line names.
       if (input.Staked && typeof used !== 'string' && used.farm !== undefined && Number(used.farm) !== input.Staked.farm)
@@ -1670,11 +2323,19 @@ export function craftIx({ player, project, collection, id, recipe, assets = [],
       // with its Sheet, then its collection), a Token Metadata NFT ({ mint, owner }: its metadata, the holder's
       // token account and its Sheet), or a compressed NFT ({ compressed, tree }: its record, proven earlier in the
       // transaction, its tree and its Sheet). What a raise writes on is writable.
+      // One the project locks in the player's wallet on a seat of a farm that freezes (`farm`, that farm's id) has its
+      // seat and farm after its accounts, when a raise on it lowers a number.
+      const place = assets.length - given.length;
       const nft = take(given, 'an NFT to show');
-      if (typeof nft === 'string') remaining.push(meta(nft, false, true), meta(input.Show.collection, false, false));
+      if (typeof nft === 'string' || (nft.asset && nft.farm !== undefined && !('collection' in nft))) remaining.push(meta(nft.asset ?? nft, false, true), meta(input.Show.collection, false, false));
       else if (nft.asset) remaining.push(meta(nft.asset, false, true), meta(pda.sheet(project, nft.asset), false, true), meta(nft.collection ?? MPL_CORE_PROGRAM, false, false));
       else if (nft.compressed) remaining.push(...[nft.compressed, pda.leaf(nft.compressed), nft.tree].map((key) => meta(key, false, false)), meta(pda.sheet(project, nft.compressed), false, true));
       else remaining.push(...[nft.mint, tokenMetadata.metadata(nft.mint), ata(nft.owner ?? player, nft.mint, TOKEN_PROGRAM)].map((key) => meta(key, false, false)), meta(pda.sheet(project, nft.mint), false, true));
+      const lowers = (recipe.raises ?? []).some((raise) => Number(raise.place) === place && BigInt(raise.shift.by) < 0n);
+      if (lowers && typeof nft !== 'string' && nft.farm !== undefined && nft.farm !== null) {
+        const farm = pda.farm(project, nft.farm);
+        remaining.push(meta(pda.seat(farm, nft.asset ?? nft.compressed ?? nft.mint), false, false), meta(farm, false, false));
+      }
     }
   }
   const made = {};
@@ -1683,16 +2344,18 @@ export function craftIx({ player, project, collection, id, recipe, assets = [],
       // A prize (`prizeMetas`): collectibles of one item made in order, each at the next serial.
       const prize = output.Prize[0];
       const item = prize.Item?.[0];
-      remaining.push(...prizeMetas({ project, collection, prize, winner: player, nonce, poolMints, items, nft: nfts[prize.Nft?.nft], made: made[item] ?? 0, programs, strict: true, boxes, rollPools }));
+      remaining.push(...prizeMetas({ project, collection, prize, winner: player, nonce, poolMints, items, nft: nfts[prize.Nft?.nft], made: made[item] ?? 0, programs }));
       if (item !== undefined) made[item] = (made[item] ?? 0) + 1;
     } else if (output.RollOn) {
-      // The box, then the order its roll is made in, at the craft's `nonce`, then the box's prize mints (`rollMints`).
-      remaining.push(meta(pda.box(project, output.RollOn.box_id), false, false), meta(pda.order(project, player, nonce), false, true), ...strictRollMints(project, output.RollOn.box_id, boxes, rollPools ?? {}));
+      // The box, then the order its roll is made in (`namedRollNonce` of the craft's `nonce`).
+      const on = assets[output.RollOn.place];
+      const order = pda.order(project, player, namedRollNonce(boxes[output.RollOn.box_id], typeof on === 'string' ? on : on?.asset ?? on?.mint ?? on?.compressed, nonce));
+      remaining.push(meta(pda.box(project, output.RollOn.box_id), false, false), meta(order, false, true));
     }
   }
   const address = pda.recipe(project, id);
-  const receipt = limits(recipe.per_wallet) ? pda.receipt(address, player) : null;
-  return lootIx('craft', { version: recipe.version, times, nonce }, { player, project, recipe: address, receipt }, { remaining: [...remaining, ...extra] });
+  const counts = limits(recipe.per_wallet) ? pda.counts(project, player) : null;
+  return lootIx('craft', { version: recipe.version, times, nonce }, { player, project, recipe: address, counts }, { remaining: [...remaining, ...tailOf(extra)] });
 }
 
 function take(list, what) {
@@ -1708,9 +2371,16 @@ export const craftNewAssets = (recipe) => recipe.outputs.filter((o) => o.Prize?.
  * asset (`collection` its own, Core's address for none), a Token Metadata NFT (`tokenMetadata`), or `compressed` (after
  * a `proveLeafIx`).
  */
-export function holdIx({ player, project, collection, asset, tokenMetadata: tm, compressed, freeAt, reference: ref }) {
-  const p = piece({ project, asset, wallet: player, collection, tokenMetadata: tm, compressed, ...ONLY_MOVES });
-  return lootIx('hold', { free_at: toBigInt(freeAt), reference: reference(ref) }, { player, project, ...p.accounts, hold: pda.hold(p.accounts.asset, freeAt) }, { remaining: p.proof, writable: p.writable });
+export function holdIx({ player, project, collection, asset, tokenMetadata: tm, compressed, freeAt, reference: ref, more = [] }) {
+  // Several NFTs (`more`: each { asset, collection, tokenMetadata, compressed }) go on holds of their own with one end, one
+  // fee: by their holds' addresses, the first the call's own.
+  const [first, ...rest] = ascending([{ asset, collection, tokenMetadata: tm, compressed }, ...more].map((n) => {
+    const p = piece({ project, asset: n.asset, wallet: player, collection: n.collection, tokenMetadata: n.tokenMetadata, compressed: n.compressed, ...ONLY_MOVES });
+    return { p, hold: pda.hold(p.accounts.asset, freeAt) };
+  }), (x) => x.hold);
+  const p = withPrograms(first.p, rest.map((x) => x.p));
+  const groups = rest.flatMap((x) => [meta(x.hold, false, true), ...anotherMetas(x.p)]);
+  return lootIx('hold', { free_at: toBigInt(freeAt), reference: reference(ref) }, { player, project, ...p.accounts, hold: first.hold }, { remaining: [...p.proof, ...groups], writable: p.writable });
 }
 
 // ---------------------------------------------------------------- stashes
@@ -1719,10 +2389,13 @@ export function holdIx({ player, project, collection, asset, tokenMetadata: tm,
  * The project's owner or authority (`signer`) puts an NFT it holds into stash `id`, or (`out`: a wallet) takes one the
  * stash holds out to that wallet. The NFT is any kind, as `piece` takes it: `collection` a Core asset's own,
  * `tokenMetadata`, or `compressed` after a `proveLeafIx` in the same transaction. The signer pays what the stash grows
- * by, and gets back the rent it no longer needs. Taken out with `out` the project's own address, the entry is only dropped
- * from the stash and the NFT stays where it is. `out` is never another account of the program (`ToTheProject`).
+ * by, and gets back the rent it no longer needs. `drop`: the NFT leaves the stash and stays where it is, owed to the
+ * treasury in its hold (`["hold", nft, 0]`, the signer paying its rent until anyone `release`s it to the treasury, one
+ * NFT a call). `out` is never the project's own address nor another account of the program (`ToTheProject`).
  */
-export function stashIx({ signer, project, id, lottery = null, asset, out = null, collection, tokenMetadata: tm, compressed }) {
+export function stashIx({ signer, project, id, lottery = null, lotteryState = null, asset, out = null, drop = false, weight = 1, collection, tokenMetadata: tm, compressed, more = [] }) {
+  if (drop && more.length) throw new Error('A stash drops one NFT a call.');
+  if (drop) out = pda.hold(compressed?.id ?? asset, 0);
   const to = out ?? signer;
   // A lottery's own stash (`lottery`: the lottery's id): an NFT its place names leaves only as that prize, or once the
   // lottery has ended; taking one out passes the lottery.
@@ -1731,10 +2404,19 @@ export function stashIx({ signer, project, id, lottery = null, asset, out = null
   // Out to a wallet or the project's own address, never another account of the program (a record, a stash, a fee
   // box), where no record names the NFT and nothing could move it again (ToTheProject): the ones this call names are
   // refused before sending, and the program refuses any other (js/play only takes one out to the signer's wallet).
-  if (out && out !== project && [stash, own, pda.fees(project), pda.platform()].includes(out))
-    throw new Error('An NFT taken out of a stash can’t go to an account of the program: name a wallet, or the project’s own address to only drop it from the stash.');
-  const p = piece({ project, asset, wallet: to, collection, tokenMetadata: tm, compressed, ...ONLY_MOVES });
-  return lootIx('stash', { of: own ? { Lottery: [lottery] } : { Project: [id] }, out: Boolean(out) }, { signer, project, stash, to, ...p.accounts, lottery: own && out ? own : null }, { remaining: p.proof, writable: p.writable });
+  if (out && !drop && [project, stash, own, pda.fees(project), pda.platform()].includes(out))
+    throw new Error('An NFT taken out of a stash can’t go to the project or an account of the program: name a wallet, or drop it (`drop`: it stays, owed to the treasury).');
+  // Several NFTs (`more`: each { asset, weight, collection, tokenMetadata, compressed }) go in or out in one call, one
+  // fee, in ascending order of their addresses; put in, each weighs its `weight` in the stash's draws.
+  const [first, ...rest] = ascending([{ asset, weight, collection, tokenMetadata: tm, compressed }, ...more].map((n) => ({
+    n, p: piece({ project, asset: n.asset, wallet: drop ? project : to, collection: n.collection, tokenMetadata: n.tokenMetadata, compressed: n.compressed, ...ONLY_MOVES }),
+  })), (x) => x.p.accounts.asset);
+  const p = withPrograms(first.p, rest.map((x) => x.p));
+  const weights = out ? [] : [first, ...rest].map((x) => x.n.weight ?? 1);
+  // A lottery's own stash names the lottery, and the round it waits on (`idleRound`; `lotteryState`: the decoded
+  // Lottery; none for one never written), whose places say what it locks.
+  const round = own && lotteryState ? idleRound(own, lotteryState) : null;
+  return lootIx('stash', { of: own ? { Lottery: [lottery] } : { Project: [id] }, out: Boolean(out), weights }, { signer, project, stash, to, ...p.accounts, lottery: own, round }, { remaining: [...p.proof, ...rest.flatMap((x) => anotherMetas(x.p))], writable: p.writable });
 }
 
 // ---------------------------------------------------------------- contests
@@ -1743,7 +2425,7 @@ export function stashIx({ signer, project, id, lottery = null, asset, out = null
  * `player` backs `side` with `amount`, naming the contest's incarnation (which fixes its terms). `contest` is the
  * decoded Contest. A contest of NFTs (`contest.nft`) takes one NFT instead (`nft`: { asset, collection, tokenMetadata,
  * compressed }, as `piece` takes it), which the contest holds until it is claimed. `shown`/`listProof` pass its gate.
- * `extra`: a hook's accounts.
+ * A new entry's record is the player's to pay (not refunded). `extra`: a hook's accounts.
  */
 export function enterIx({ player, project, id, contest, side, amount, shown, listProof, nft, playerToken, programs, extra = [] }) {
   const address = pda.contest(project, id);
@@ -1756,85 +2438,112 @@ export function enterIx({ player, project, id, contest, side, amount, shown, lis
       player,
       project,
       contest: address,
-      entry: pda.entry(address, player),
+      entries: contestEntries(address, contest),
       player_token: playerToken ?? ata(player, contest.mint, tokenProgramOf(programs, contest.mint)),
       mint: contest.mint,
     },
-    { remaining: [...gateAccounts(project, { gate: contest.gate, wallet: player, shown, listProof }), ...(staked ? [...pieceMetas(staked), ...staked.proof] : []), ...extra] },
+    { remaining: [...gateAccounts(project, { gate: contest.gate, wallet: player, shown, listProof }), ...(staked ? [...pieceMetas(staked), ...staked.proof] : []), ...tailOf(extra)] },
   );
 }
 
 /**
- * Anyone (`payer`) claims `player`'s entry on `side`, into the player's account of the mint, which `payer` opens when
- * it is not there (the last entry's claim closes the pot and writes the mint). A winning entry of a contest with a
- * prize (`contest.prize`) also gets it (`prizeMetas`: `collection`, `poolMints`, `items`, `nft`; a roll's order at
- * `nonce`, `prizeNonce(entry)` by default), `payer` paying what it opens. For a contest of NFTs, `entry` is the decoded
- * Entry: its own NFT (`own`, its kind as `piece` takes it) goes back to its player, or to the opener for a loser's NFT
- * no winner took; a winner, while losers' NFTs are left, also takes one (`taking`: { player, side } of a losing entry
- * that still holds one, and `kind`, its NFT's kind). While losers' NFTs are left only the winner sends their claim, and
- * picks which (`payer` the player; `WinnerPicks` otherwise). `extra`: a hook's accounts.
+ * Anyone (`payer`) claims `player`'s entry (`entries`: the contest's decoded entries, `decodeEntries`), into the
+ * player's account of the mint, which `payer` opens when it is not there. A winner's first claim also gives the
+ * contest's prize (`prizeMetas`: `collection`, `poolMints`, `items`, `nft`; a roll's order at `nonce`, `prizeNonce` of the
+ * contest and the player by default), unless the player (signing) `forgo`es it. In a contest of NFTs it moves the NFTs of
+ * the entries `nfts` names by their place in the list (the player's own by default, while the contest holds it): an
+ * entry's own back to its player (anyone sends it); a loser's to the winner while it has picks left of its share (only
+ * the winner sends it, and picks which: `WinnerPicks`), or to the opener once no winner has picks left. `kinds` maps an
+ * NFT to its kind, as `piece` takes it. With `hold` (true, or a list of assets), each becomes a hold for the wallet it goes to (an NFT that can't
+ * move now); with `end`, the winner leaves the rest of its share to the opener. The claim that leaves nothing owed
+ * closes the contest (`projectState`: its treasury); a contest that owes nothing (nobody entered, every part claimed,
+ * off by itself with none in) is closed by any claim, the `payer`'s. `extra`: a hook's accounts.
  */
-export function claimIx({ payer, project, id, contest, player, side, entry, own = {}, taking, nonce, collection, poolMints, items, nft, prizeMint, forgo = false, programs, extra = [] }) {
+export function claimIx({ payer, project, projectState, id, contest, entries, player, nfts, kinds = {}, nonce, collection, poolMints, items, nft, prizeMint, forgo = false, end = false, hold = false, programs, extra = [] }) {
   const address = pda.contest(project, id);
-  const entryAddress = pda.entry(address, player);
-  nonce = toBigInt(nonce ?? prizeNonce(entryAddress));
-  const won = contest.verdict === 'Won' && Number(contest.winner) === Number(side);
-  // A winning entry of a contest with a prize: the prize's accounts, after the NFTs'.
-  // A split prize is paid from the contest's vault (named accounts below), not given as a prize line.
+  // A contest that owes nothing (nobody entered, or every part claimed) is only closed: by any claim, entry 0, any player.
+  const closing = BigInt(contest.owed) === 0n;
+  player ??= payer;
+  const i = closing ? 0 : entries.findIndex((e) => e.player === player);
+  if (i < 0) throw new Error(`${player} has no entry in this contest.`);
+  const me = closing ? { side: 0, bits: CLAIMED | ENDED, amount: 0n, taken: 0 } : entries[i];
+  nonce = toBigInt(nonce ?? prizeNonce(address, player));
+  const won = contest.verdict === 'Won' && Number(contest.winner) === Number(me.side);
+  const first = won && !(me.bits & CLAIMED);
+  // A winner's first claim of a contest with a prize: the prize's accounts, after the NFTs'. A split prize is paid from
+  // the contest's vault (named accounts below), not given as a prize line.
   const split = Boolean(contest.prize_split);
-  const prize = contest.prize != null && won && !split && !forgo ? prizeMetas({ project, collection, prize: contest.prize, winner: player, nonce, poolMints, items, nft, programs }) : [];
+  const prize = contest.prize != null && first && !split && !forgo ? prizeMetas({ project, collection, prize: contest.prize, winner: player, nonce, poolMints, items, nft, programs }) : [];
   const pMint = split ? splitMint(contest.prize, prizeMint ?? poolMints?.[contest.prize?.Tokens?.from.Pool?.[0]]) : null;
-  const nfts = [];
-  if (contest.nft && entry && entry.asset !== NO_ADDRESS) {
-    const lost = contest.verdict === 'Won' && !won;
-    const mine = piece({ project, asset: entry.asset, wallet: lost ? contest.opener : player, ...own, ...ONLY_MOVES });
-    nfts.push(...pieceMetas(mine), ...mine.proof);
-    if (won && taking) {
-      const theirs = pda.entry(address, taking.player);
-      const p = piece({ project, asset: taking.asset, wallet: player, ...taking.kind, ...ONLY_MOVES });
-      nfts.push(meta(theirs, false, true), ...pieceMetas(p), ...p.proof);
+  nfts ??= !closing && contest.nft && Number(me.amount) === 1 ? [i] : [];
+  const moved = [];
+  let taken = Number(me.taken);
+  for (const j of nfts) {
+    const theirs = entries[j];
+    let to = contest.opener;
+    if (contest.verdict !== 'Won' || Number(theirs.side) === Number(contest.winner)) to = theirs.player;
+    else if (won && payer === player && !(me.bits & ENDED) && taken < shareOf(contest, me)) [to, taken] = [player, taken + 1];
+    moved.push(meta(theirs.player, false, true));
+    if (holds(hold, theirs.nft)) moved.push(meta(pda.hold(theirs.nft, 0), false, true));
+    else {
+      const p = piece({ project, asset: theirs.nft, wallet: to, ...kinds[theirs.nft], ...ONLY_MOVES });
+      moved.push(...pieceMetas(p), ...p.proof);
     }
   }
+  // What it leaves owed: at 0 it closes the contest, burning what its pot (and a split prize's vault) still hold.
+  const owed = BigInt(contest.owed);
+  const left = closing ? 0n : !contest.nft ? owed - (contest.verdict === 'Won' ? (first ? BigInt(me.amount) : 0n) : 1n) : owed - BigInt(nfts.length) - (first && contest.prize ? 1n : 0n);
+  // The claim that leaves nothing owed closes the contest, its rent and what is left to the treasury: it names it.
+  if (left <= 0n && !projectState?.treasury) throw new Error('This claim closes the contest: pass projectState, for its treasury.');
   return lootIx(
     'claim',
-    { nonce, forgo },
+    { entry: i, nonce, forgo, end, nfts },
     {
       payer,
       project,
       contest: address,
-      entry: entryAddress,
+      entries: contestEntries(address, contest),
       player,
       opener: contest.opener,
       to: ata(player, contest.mint, tokenProgramOf(programs, contest.mint)),
       mint: contest.mint,
       prize_mint: pMint,
+      // A split prize from a pool: what its vault holds at the close goes back to that pool (`WrongPool` without it).
+      prize_pool: split && contest.prize?.Tokens?.from?.Pool ? pda.pool(project, contest.prize.Tokens.from.Pool[0]) : null,
       prize_vault: split ? pda.prizeVault(address) : null,
       prize_to: split ? ata(player, pMint, tokenProgramOf(programs, pMint)) : null,
+      treasury: projectState?.treasury ?? null,
     },
-    // The last claim closes the pot (and a split prize's vault), writing their mints.
-    { writable: Number(contest.entries) === 1 ? ['mint', ...(split ? ['prize_mint'] : [])] : [], remaining: [...nfts, ...prize, ...extra] },
+    { writable: left <= 0n ? ['mint', ...(split ? ['prize_mint'] : [])] : [], remaining: [...moved, ...prize, ...tailOf(extra)] },
   );
 }
 
 // ---------------------------------------------------------------- auctions
 
-/** What a bid signs: sha256(mint | Borsh(AuctionArgs)). */
-export function auctionTerms(mint, args) {
-  return sha256(concat(addressBytes(mint), encodeBorsh(IDL, { defined: { name: 'AuctionArgs' } }, args)));
-}
-
-/** An auction's AuctionArgs from its decoded account (what `open_auction` fixed). */
-export const auctionArgsOf = (auction) => ({
-  lot: auction.lot,
-  reserve: auction.reserve,
-  min_raise_bps: auction.min_raise_bps,
-  starts_at: auction.starts_at,
-  ends_at: auction.ends_at,
-  extend: auction.extend,
-  shares: auction.shares,
-  gate: auction.gate ?? null,
-  nft_bids: auction.nft_bids ?? null,
-});
+/**
+ * What a taker signs for an auction, an offer or a listing, as the program works it out (`rail::terms`): sha256 of the
+ * record's bytes, all but the span `[start, end)` that changes as it is taken. `record` is the account's bytes as read,
+ * or its decoded value, written back to the same bytes (`encodeAccount`).
+ */
+function recordTerms(name, record, span) {
+  const data = record instanceof Uint8Array ? record : encodeAccount(IDL, name, record);
+  const [start, end] = span(data);
+  return sha256(concat(data.subarray(0, start), data.subarray(end)));
+}
+
+/**
+ * What a bid signs: the auction's bytes but the bid, which sits last (`high_bidder`, `high`, `last_bid_at`, `held`:
+ * 60 bytes, and an auction of NFT bids' room for `MAX_BID_NFTS` after them). `auction`: the decoded Auction, or its
+ * account's bytes.
+ */
+export function auctionTerms(auction) {
+  if (auction instanceof Uint8Array) {
+    const room = decode('Auction', auction).nft_bids ? 32 * MAX_BID_NFTS : 0;
+    return recordTerms('Auction', auction, (data) => [data.length - 60 - room, data.length]);
+  }
+  // Written back with no bid's NFTs, its bytes end at the bid's 60.
+  return recordTerms('Auction', { ...auction, gate: auction.gate ?? null, nft_bids: auction.nft_bids ?? null, held: [] }, (data) => [data.length - 60, data.length]);
+}
 
 /** When bids close, as the program reckons it: `ends_at`, or `extend` seconds after the last bid when that is later. */
 export const auctionEnds = (auction) => {
@@ -1843,23 +2552,26 @@ export const auctionEnds = (auction) => {
   return late > BigInt(auction.ends_at) ? late : BigInt(auction.ends_at);
 };
 
-/** The least next bid the program takes, or null when no u64 amount can top it. */
+/** The least next bid the program takes, or null when nothing can top it (no u64 amount; a bid of NFTs past `MAX_BID_NFTS`). */
 export function leastBid(auction) {
   const high = BigInt(auction.high);
   if (high === 0n) return BigInt(auction.reserve) > 0n ? BigInt(auction.reserve) : 1n;
   const raise = (high * BigInt(auction.min_raise_bps) + 9_999n) / 10_000n;
   const next = high + (raise > 0n ? raise : 1n);
-  return next <= (1n << 64n) - 1n ? next : null;
+  // A bid of NFTs holds at most `MAX_BID_NFTS`: past it, nobody can top the high bid.
+  return next <= (auction.nft_bids ? BigInt(MAX_BID_NFTS) : (1n << 64n) - 1n) ? next : null;
 }
 
 /**
  * `seller` opens its auction `id` of `args.lot` ({ Item: [id] }, { Asset: [address] } or { Roll: [box id] }), alone,
  * and pays its rent: a player for an NFT of the project's own collection they hold; the project's owner or authority for an
  * NFT of any kind it holds (`piece`: `collection` a Core asset's own, `tokenMetadata`, or `compressed` after a
- * `proveLeafIx`), a new unit of its item, or a roll of one of its boxes (a mystery lot). Its address names the seller, so an
- * id is the seller's own.
+ * `proveLeafIx`), a new unit of its item, or a roll of one of its boxes (a mystery lot: the box must be written, burn
+ * no share of its price, and make an order with the auction's shares within one call's growth: `LotRefused`). Its
+ * address names the seller, so an id is the seller's own.
  */
 export function openAuctionIx({ seller, project, collection, tokenMetadata: tm, compressed, id, mint, args }) {
+  stored(args.shares);
   const auction = pda.auction(project, seller, id);
   const asset = args.lot.Asset?.[0] ?? null;
   // An item lot reads no NFT: the auction's own address stands in.
@@ -1872,14 +2584,19 @@ export function openAuctionIx({ seller, project, collection, tokenMetadata: tm,
   );
 }
 
+/** The most NFTs one bid of an auction of NFT bids holds (`MAX_BID_NFTS`, not in the IDL): a bid of more fails
+ * (`BidTooLow`), and a high bid of this many can't be topped. Its reserve is 1 to this many (`BadAuction`). */
+export const MAX_BID_NFTS = 3;
+
 /**
  * `bidder` bids `amount` on auction `id`, signing its terms; the bid it tops goes back to the high bidder's account
  * of the mint, which `bidder` opens when it is not there. `auction` is the decoded Auction. `shown`/`listProof`: what
  * passes the auction's gate. An auction of NFT bids (`auction.nft_bids`) takes `nfts` instead ([{ asset, collection,
  * tokenMetadata }], as `piece` takes each; never a compressed NFT: `CompressedBid`), handed to the project, and gives the high bid's NFTs
- * (`held`, the kinds of `auction.held`, in order) back to its bidder. `extra`: a hook's accounts.
+ * (`held`, the kinds of `auction.held`, in order) back to its bidder; one that can't move now (`hold`: true for all, or a
+ * list of assets) becomes a hold for them instead, `bidder` paying its rent until its release. `extra`: a hook's accounts.
  */
-export function bidIx({ bidder, project, id, auction, amount, shown, listProof, nfts = [], held = [], bidderToken, programs, extra = [] }) {
+export function bidIx({ bidder, project, id, auction, amount, shown, listProof, nfts = [], held = [], hold = false, bidderToken, programs, extra = [] }) {
   const tokenProgram = tokenProgramOf(programs, auction.mint);
   const outbid = BigInt(auction.high) > 0n;
   const bundle = [];
@@ -1890,13 +2607,14 @@ export function bidIx({ bidder, project, id, auction, amount, shown, listProof,
       bundle.push(...pieceMetas(p), ...p.proof);
     }
     (auction.held ?? []).forEach((asset, i) => {
+      if (holds(hold, asset)) return bundle.push(meta(pda.hold(asset, 0), false, true));
       const p = piece({ project, asset, wallet: auction.high_bidder, ...held[i], ...ONLY_MOVES });
       bundle.push(...pieceMetas(p), ...p.proof);
     });
   }
   return lootIx(
     'bid',
-    { amount: auction.nft_bids ? BigInt(nfts.length) : amount, terms: auctionTerms(auction.mint, auctionArgsOf(auction)) },
+    { amount: auction.nft_bids ? BigInt(nfts.length) : amount, terms: auctionTerms(auction) },
     {
       bidder,
       project,
@@ -1908,7 +2626,7 @@ export function bidIx({ bidder, project, id, auction, amount, shown, listProof,
       mint: auction.mint,
     },
     // The vault takes a bid in tokens; NFT bids leave it alone, unlocked.
-    { remaining: [...gateAccounts(project, { gate: auction.gate, wallet: bidder, shown, listProof }), ...bundle, ...extra], writable: auction.nft_bids ? [] : ['vault'] },
+    { remaining: [...gateAccounts(project, { gate: auction.gate, wallet: bidder, shown, listProof }), ...bundle, ...tailOf(extra)], writable: auction.nft_bids ? [] : ['vault'] },
   );
 }
 
@@ -1920,28 +2638,43 @@ export function bidIx({ bidder, project, id, auction, amount, shown, listProof,
  * roll), however long after the end it is sent. With no bid, the lot goes home. `signer` opens any account the end pays into that is
  * not there. `item` is the decoded Item of an item lot; for an NFT lot, `collection` its Core collection now (the
  * project's when left out), `tokenMetadata` for a Token Metadata NFT, or `compressed` (after a `proveLeafIx`).
- */
-export function endAuctionIx({ signer, project, projectState, id, auction, item = null, collection, tokenMetadata: tm, compressed, held = [], reference: ref, nonce, holders, programs, extra = [] }) {
+ * `hold` (anyone may; true for all, or a list of assets): an end that wouldn't fit otherwise (a compressed lot's long
+ * proof, a hooked mint, many shares) makes the NFT lot a hold for whoever it goes to (its hold passed as `order`, no
+ * piece nor proof), and a winning NFT of a bid a hold for `proceeds` (its hold's address in its piece's place); anyone
+ * then delivers each with `releaseIx`, and the end's sender gets the rent back then.
+ */
+export function endAuctionIx({ signer, project, projectState, id, auction, item = null, collection, tokenMetadata: tm, compressed, held = [], hold = false, reference: ref, nonce, holders, programs, extra = [] }) {
+  // The lot went at an earlier end, and its seller's account couldn't take the money then (`proceeds_owed`): this end pays
+  // it and closes the auction, naming no lot, share or winning NFT.
+  const owed = BigInt(auction.proceeds_owed ?? 0) > 0n;
+  const lotHeld = !owed && Boolean(auction.lot.Asset) && holds(hold, auction.lot.Asset[0]);
   const tokenProgram = tokenProgramOf(programs, auction.mint);
   const sold = BigInt(auction.high) > 0n;
-  const itemId = auction.lot.Item?.[0];
-  const made = sold && item?.kind === 'Collectible' ? pda.itemAsset(pda.item(project, itemId), auction.serial) : null;
-  const asset = auction.lot.Asset?.[0] ?? made;
+  const itemId = owed ? undefined : auction.lot.Item?.[0];
+  const made = !owed && sold && item?.kind === 'Collectible' ? pda.itemAsset(pda.item(project, itemId), auction.pin) : null;
+  const asset = owed ? null : auction.lot.Asset?.[0] ?? made;
   const proceeds = auction.lot.Asset ? auction.seller : projectState.treasury;
   const address = pda.auction(project, auction.seller, id);
   const receiver = sold ? auction.high_bidder : auction.seller;
-  // A roll lot sold: its box, and the order the winner's roll is made in.
-  const roll = sold ? auction.lot.Roll?.[0] : undefined;
+  // A roll lot sold: its box, and the order the winner's roll is made in. The winning bid stays in the vault as that
+  // order's payment, split by the auction's shares when it settles (no shares' accounts here).
+  const roll = sold && !owed ? auction.lot.Roll?.[0] : undefined;
   nonce = toBigInt(nonce ?? prizeNonce(address, BigInt(auction.last_bid_at)));
   // An NFT lot is sent on; a collectible sold is minted into its item's collection, which Core writes.
-  const p = auction.lot.Asset
+  // With `hold`, an NFT lot is its address alone (no proof), and becomes a hold for whoever it goes to.
+  const p = owed
+    ? standIn(address)
+    : lotHeld
+    ? standIn(asset)
+    : auction.lot.Asset
     ? piece({ project, asset, wallet: receiver, collection, tokenMetadata: tm, compressed, ...ONLY_MOVES })
     : asset
       ? { ...piece({ project, asset, collection: item.collection, moves: false, locks: false, reads: false }), writable: ['collection'] }
       : standIn(address);
   // A winning bid of NFTs: each to where the rest of a bid in tokens would go (`held`, their kinds in order).
-  const winning = sold && auction.nft_bids
+  const winning = !owed && sold && auction.nft_bids
     ? (auction.held ?? []).flatMap((nft, i) => {
+      if (holds(hold, nft)) return [meta(pda.hold(nft, 0), false, true)];
       const q = piece({ project, asset: nft, wallet: proceeds, ...held[i], ...ONLY_MOVES });
       return [...pieceMetas(q), ...q.proof];
     })
@@ -1962,11 +2695,11 @@ export function endAuctionIx({ signer, project, projectState, id, auction, item
       item: itemId !== undefined ? pda.item(project, itemId) : null,
       ...p.accounts,
       loot_box: roll !== undefined ? pda.box(project, roll) : null,
-      order: roll !== undefined ? pda.order(project, auction.high_bidder, prizeRollNonce(nonce)) : null,
+      order: roll !== undefined ? pda.order(project, auction.high_bidder, prizeRollNonce(nonce)) : lotHeld ? pda.hold(asset, 0) : null,
     },
     {
-      remaining: [...p.proof, ...(sold ? shareAccounts(project, auction.shares, auction.mint, { holders, programs, treasury: projectState.treasury }) : []), ...winning, ...extra],
-      writable: [...(sold && sharesBurn(auction.shares) ? ['mint'] : []), ...(sold && !auction.nft_bids ? ['vault'] : []), ...p.writable],
+      remaining: [...p.proof, ...(!owed && sold && roll === undefined ? shareAccounts(project, auction.shares, auction.mint, { holders, programs, treasury: projectState.treasury }) : []), ...winning, ...tailOf(extra)],
+      writable: [...(!owed && sold && sharesBurn(auction.shares) ? ['mint'] : []), ...(sold && !auction.nft_bids ? ['vault'] : []), ...p.writable],
     },
   );
 }
@@ -1977,11 +2710,9 @@ export function endAuctionIx({ signer, project, projectState, id, auction, item
 // attributes, a Token Metadata or compressed NFT with none, so an attribute test fails for an NFT that doesn't carry
 // the key itself (every Token Metadata or compressed one).
 
-/** The hash a taker signs, as the program rebuilds it: sha256(mint | rule | deal | shares), Borsh. `offer` is the decoded Offer. */
-export function offerTerms(offer) {
-  const borsh = (name, value) => encodeBorsh(IDL, { defined: { name } }, value);
-  return sha256(concat(addressBytes(offer.mint), borsh('Rule', offer.rule), borsh('Deal', offer.deal), encodeBorsh(IDL, { vec: { defined: { name: 'Share' } } }, offer.shares)));
-}
+/** What a taker signs: the offer's bytes but `left`, its last 2 (what a take changes). `offer`: the decoded Offer, or its
+ * account's bytes. */
+export const offerTerms = (offer) => recordTerms('Offer', offer, (data) => [data.length - 2, data.length]);
 
 /** What one take of a deal pays out of its offer's money: a bid's price, a loan's amount. */
 export const dealUnit = (deal) => BigInt(deal.Buy?.price ?? deal.Lend.amount);
@@ -1992,12 +2723,13 @@ export const dealUnit = (deal) => BigInt(deal.Buy?.price ?? deal.Lend.amount);
  * lasts } }, left, shares } (shares only on a price). Its address names the maker, so an id is the maker's own.
  */
 export function openOfferIx({ maker, project, id, mint, args, makerToken, programs, extra = [] }) {
+  stored(args.shares);
   const tokenProgram = tokenProgramOf(programs, mint);
   return lootIx(
     'open_offer',
     { id, args: { shares: [], ...args } },
     { maker, project, offer: pda.offer(project, maker, id), mint, maker_token: makerToken ?? ata(maker, mint, tokenProgram), vault: vault(project, mint, tokenProgram) },
-    { remaining: extra },
+    { remaining: tailOf(extra) },
   );
 }
 
@@ -2008,7 +2740,7 @@ export function closeOfferIx({ maker, project, id, offer, programs, extra = [] }
     'close_offer',
     {},
     { maker, project, offer: pda.offer(project, maker, id), mint: offer.mint, vault: vault(project, offer.mint, tokenProgram), maker_token: ata(maker, offer.mint, tokenProgram) },
-    { remaining: extra },
+    { remaining: tailOf(extra) },
   );
 }
 
@@ -2026,7 +2758,7 @@ export function sellToOfferIx({ seller, project, projectState, id, offer, asset,
     { terms: offerTerms(offer) },
     { seller, project, offer: pda.offer(project, offer.maker, id), maker: offer.maker, ...p.accounts, mint: offer.mint, vault: vault(project, offer.mint, tokenProgram), seller_token: ata(seller, offer.mint, tokenProgram) },
     {
-      remaining: [...p.proof, ...shareAccounts(project, offer.shares, offer.mint, { holders, programs, treasury: projectState?.treasury }), ...extra],
+      remaining: [...p.proof, ...shareAccounts(project, offer.shares, offer.mint, { holders, programs, treasury: projectState?.treasury }), ...tailOf(extra)],
       writable: [...(sharesBurn(offer.shares) ? ['mint'] : []), ...p.writable],
     },
   );
@@ -2048,38 +2780,37 @@ export function borrowIx({ borrower, project, id, offer, due, asset, collection,
       borrower, project, offer: pda.offer(project, offer.maker, id), maker: offer.maker, hold: pda.hold(p.accounts.asset, due), ...p.accounts,
       mint: offer.mint, vault: vault(project, offer.mint, tokenProgram), borrower_token: ata(borrower, offer.mint, tokenProgram),
     },
-    { remaining: [...p.proof, ...extra], writable: p.writable },
+    { remaining: [...p.proof, ...tailOf(extra)], writable: p.writable },
   );
 }
 
 /**
  * Anyone (`payer`: the borrower, a friend) repays a loan before it is due (`hold` the decoded Hold, with its debt): the
  * debt's `repay` goes to the lender, and the NFT is the borrower's again. Only money moves: anyone then sends the NFT
- * home with `releaseIx` (in the same transaction, or later: a repaid loan's release has no deadline). Free. `extra`: a
+ * home with `releaseIx` (in the same transaction, or later: a repaid loan's release has no deadline). Free. `repay`: the
+ * debt the payer was shown (`hold.debt.repay` as read): any other amount is refused (`TermsChanged`). `extra`: a
  * transfer hook's accounts.
  */
-export function repayIx({ payer, project, hold, payerToken, programs, extra = [] }) {
+export function repayIx({ payer, project, hold, repay, payerToken, programs, extra = [] }) {
+  if (repay === undefined || repay === null) throw new Error('A repay names the debt the payer was shown (repay: hold.debt.repay as read).');
   const { lender, mint } = hold.debt;
   const tokenProgram = tokenProgramOf(programs, mint);
   return lootIx(
     'repay',
-    {},
+    { repay: toBigInt(repay) },
     {
       payer, project, hold: pda.hold(hold.asset, hold.free_at), lender,
       lender_token: ata(lender, mint, tokenProgram), payer_token: payerToken ?? ata(payer, mint, tokenProgram), mint,
     },
-    { remaining: extra },
+    { remaining: tailOf(extra) },
   );
 }
 
 // ---------------------------------------------------------------- listings
 
-/** What a taker signs: sha256(maker | asset | mint | Borsh(ListingDeal) | Borsh(shares)). */
-export function listingTerms(listing) {
-  const deal = encodeBorsh(IDL, { defined: { name: 'ListingDeal' } }, listing.deal);
-  const shares = encodeBorsh(IDL, { vec: { defined: { name: 'Share' } } }, listing.shares ?? []);
-  return sha256(concat(addressBytes(listing.maker), addressBytes(listing.asset), addressBytes(listing.mint), deal, shares));
-}
+/** What a taker signs: the listing's bytes but `user`, `until` and `stopped` (bytes 129 to 170, what a rental changes).
+ * `listing`: the decoded Listing, or its account's bytes. */
+export const listingTerms = (listing) => recordTerms('Listing', listing, () => [129, 170]);
 
 /**
  * `maker` (any wallet, signing alone) lists an NFT they hold, of any kind (as `piece` takes it), for sale
@@ -2090,7 +2821,7 @@ export function listingTerms(listing) {
  */
 export function openListingIx({ maker, project, asset, mint, deal, shares = [], collection, hasAuthority, tokenMetadata: tm, compressed, extra = [] }) {
   const p = piece({ project, asset, wallet: maker, collection, hasAuthority, tokenMetadata: tm, compressed, ...ONLY_MOVES });
-  return lootIx('open_listing', { deal, shares }, { maker, project, listing: pda.listing(project, p.accounts.asset), ...p.accounts, mint }, { remaining: [...p.proof, ...extra], writable: p.writable });
+  return lootIx('open_listing', { deal, shares: stored(shares) }, { maker, project, listing: pda.listing(project, p.accounts.asset), ...p.accounts, mint }, { remaining: [...p.proof, ...tailOf(extra)], writable: p.writable });
 }
 
 /**
@@ -2116,7 +2847,7 @@ export function takeListingIx({ taker, project, projectState, listing, periods =
       ...p.accounts, mint: listing.mint, taker_token: takerToken ?? ata(taker, listing.mint, tokenProgram),
     },
     {
-      remaining: [...p.proof, ...shareAccounts(project, listing.shares ?? [], listing.mint, { holders, programs, treasury: projectState?.treasury }), ...extra],
+      remaining: [...p.proof, ...shareAccounts(project, listing.shares ?? [], listing.mint, { holders, programs, treasury: projectState?.treasury }), ...tailOf(extra)],
       writable: [...(sharesBurn(listing.shares ?? []) ? ['mint'] : []), ...p.writable],
     },
   );
@@ -2128,7 +2859,7 @@ export function takeListingIx({ taker, project, projectState, listing, periods =
  */
 export function closeListingIx({ maker, project, listing, collection, hasAuthority, tokenMetadata: tm, compressed, extra = [] }) {
   const p = piece({ project, asset: listing.asset, wallet: maker, collection, hasAuthority, tokenMetadata: tm, compressed, ...ONLY_MOVES });
-  return lootIx('close_listing', {}, { maker, project, listing: pda.listing(project, listing.asset), ...p.accounts }, { remaining: [...p.proof, ...extra], writable: p.writable });
+  return lootIx('close_listing', {}, { maker, project, listing: pda.listing(project, listing.asset), ...p.accounts }, { remaining: [...p.proof, ...tailOf(extra)], writable: p.writable });
 }
 
 // ---------------------------------------------------------------- Token Metadata NFTs