@xgamesfun/solana 0.24.0 → 0.25.1

package/js/results/wire.js

@@ -11,7 +11,10 @@ export const CLUSTERS = Object.freeze({ devnet: 0, mainnet: 1 });
 export const CERT_KINDS = Object.freeze({
   host: { title: 'loot host key', fields: ['cluster', 'game', 'host', 'until'] },
   revoke: { title: 'loot revoke host key', fields: ['cluster', 'game', 'host'] },
-  draw: { title: 'loot draw', fields: ['cluster', 'game', 'draw', 'engine', 'winners', 'prizes', 'payout', 'identity', 'slug', 'rates'] },
+  draw: {
+    title: 'loot draw',
+    fields: ['cluster', 'game', 'draw', 'engine', 'winners', 'prizes', 'payout', 'identity', 'slug', 'rates'],
+  },
   lock: { title: 'loot draw lock', fields: ['cluster', 'game', 'draw', 'roster', 'players', 'beacon'] },
   entry: { title: 'loot entry', fields: ['cluster', 'game', 'draw'] },
   giveaway: { title: 'loot giveaway host', fields: ['cluster', 'game', 'who', 'slug', 'grant', 'until'] },
@@ -20,13 +23,16 @@ export const CERT_KINDS = Object.freeze({
 
 /** One field's value, on its own line: a value with a line break in it (which would read as another field) is refused. */
 const field = (name, value) => {
-  if (/[\r\n]/.test(String(value))) throw new RangeError(`A certificate's ${name} is one line: ${JSON.stringify(String(value))} has a line break.`);
+  if (/[\r\n]/.test(String(value)))
+    throw new RangeError(`A certificate's ${name} is one line: ${JSON.stringify(String(value))} has a line break.`);
   return value;
 };
-const write = (kind, values) => [CERT_KINDS[kind].title, ...CERT_KINDS[kind].fields.map((f) => `${f}: ${field(f, values[f])}`)].join('\n');
+const write = (kind, values) =>
+  [CERT_KINDS[kind].title, ...CERT_KINDS[kind].fields.map(f => `${f}: ${field(f, values[f])}`)].join('\n');
 
 /** The text the owner signs to let `host` report `game`'s results until `until` (unix seconds). */
-export const hostCertText = ({ cluster = 'devnet', game, host, until }) => write('host', { cluster, game, host, until });
+export const hostCertText = ({ cluster = 'devnet', game, host, until }) =>
+  write('host', { cluster, game, host, until });
 /** The text the owner signs to take `host` back. */
 export const revokeText = ({ cluster = 'devnet', game, host }) => write('revoke', { cluster, game, host });
 
@@ -38,10 +44,33 @@ export const revokeText = ({ cluster = 'devnet', game, host }) => write('revoke'
  * `slug`: the game's play-host name (its tokens' audience), or '-'; `rates`: the sha256 of the engine's rates (canonical
  * JSON), or 'default'.
  */
-export const drawText = ({ cluster = 'devnet', game, draw, engine, winners, prizes = [], payout = 'vouchers', identity = 'linked', slug = '-', rates = 'default' }) =>
-  write('draw', { cluster, game, draw, engine, winners, prizes: prizes.length ? prizes.map((p) => `${p.place}:${p.grant}`).join(' ') : 'none', payout, identity, slug, rates });
+export const drawText = ({
+  cluster = 'devnet',
+  game,
+  draw,
+  engine,
+  winners,
+  prizes = [],
+  payout = 'vouchers',
+  identity = 'linked',
+  slug = '-',
+  rates = 'default',
+}) =>
+  write('draw', {
+    cluster,
+    game,
+    draw,
+    engine,
+    winners,
+    prizes: prizes.length ? prizes.map(p => `${p.place}:${p.grant}`).join(' ') : 'none',
+    payout,
+    identity,
+    slug,
+    rates,
+  });
 /** The text the organizer signs to lock a draw's players (`roster`: rosterHash) to a beacon round still to come. */
-export const lockText = ({ cluster = 'devnet', game, draw, roster, players, beacon, net = 'quicknet' }) => write('lock', { cluster, game, draw, roster, players, beacon: `${net} ${beacon}` });
+export const lockText = ({ cluster = 'devnet', game, draw, roster, players, beacon, net = 'quicknet' }) =>
+  write('lock', { cluster, game, draw, roster, players, beacon: `${net} ${beacon}` });
 /** The text a player's wallet signs to enter a draw (identity 'wallet'). */
 export const entryText = ({ cluster = 'devnet', game, draw }) => write('entry', { cluster, game, draw });
 
@@ -49,20 +78,31 @@ export const entryText = ({ cluster = 'devnet', game, draw }) => write('entry',
  * The text the owner (or authority) signs to appoint a giveaway host: `who` is "x:<X account id>" (the host signs in
  * with that X account through the play host) or a wallet address; their giveaways pay from grant `grant` alone.
  */
-export const giveawayHostText = ({ cluster = 'devnet', game, who, slug, grant, until }) => write('giveaway', { cluster, game, who, slug, grant, until });
+export const giveawayHostText = ({ cluster = 'devnet', game, who, slug, grant, until }) =>
+  write('giveaway', { cluster, game, who, slug, grant, until });
 /** The text the owner (or authority) signs to take a giveaway host back. */
-export const revokeGiveawayText = ({ cluster = 'devnet', game, who }) => write('revokeGiveaway', { cluster, game, who });
+export const revokeGiveawayText = ({ cluster = 'devnet', game, who }) =>
+  write('revokeGiveaway', { cluster, game, who });
 
 /** A draw's players, as one hash: each `id<TAB>wallet`, sorted by id, one a line; sha256, hex. */
 export async function rosterHash(entries) {
-  const text = [...entries].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0)).map((e) => `${e.id}\t${e.wallet}`).join('\n');
-  return Array.from(new Uint8Array(await globalThis.crypto.subtle.digest('SHA-256', utf8(text))), (b) => b.toString(16).padStart(2, '0')).join('');
+  const text = [...entries]
+    .sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0))
+    .map(e => `${e.id}\t${e.wallet}`)
+    .join('\n');
+  return Array.from(new Uint8Array(await globalThis.crypto.subtle.digest('SHA-256', utf8(text))), b =>
+    b.toString(16).padStart(2, '0'),
+  ).join('');
 }
 
 /** JSON with every object's keys sorted: one text for one value, so its hash means one thing. */
 export function canonicalJson(value) {
   if (Array.isArray(value)) return `[${value.map(canonicalJson).join(',')}]`;
-  if (value && typeof value === 'object') return `{${Object.keys(value).sort().map((k) => `${JSON.stringify(k)}:${canonicalJson(value[k])}`).join(',')}}`;
+  if (value && typeof value === 'object')
+    return `{${Object.keys(value)
+      .sort()
+      .map(k => `${JSON.stringify(k)}:${canonicalJson(value[k])}`)
+      .join(',')}}`;
   return JSON.stringify(value);
 }
 
@@ -74,9 +114,17 @@ export function canonicalJson(value) {
  * place past 255 and more than 255 winners are refused, never written as something else.
  */
 export function resultBytes({ cluster = 'devnet', game, round, endedAt, winners }) {
-  if (!Object.hasOwn(CLUSTERS, cluster)) throw new RangeError(`Unknown cluster ${JSON.stringify(cluster)}: a result names ${Object.keys(CLUSTERS).join(' or ')}.`);
-  const roundAt = typeof round === 'string' && /^[0-9a-f]{32}$/i.test(round) ? fromHex(round) : round instanceof Uint8Array && round.length === 16 ? round : null;
-  if (!roundAt) throw new RangeError('A result\'s round is 16 bytes (32 hex characters).');
+  if (!Object.hasOwn(CLUSTERS, cluster))
+    throw new RangeError(
+      `Unknown cluster ${JSON.stringify(cluster)}: a result names ${Object.keys(CLUSTERS).join(' or ')}.`,
+    );
+  const roundAt =
+    typeof round === 'string' && /^[0-9a-f]{32}$/i.test(round)
+      ? fromHex(round)
+      : round instanceof Uint8Array && round.length === 16
+        ? round
+        : null;
+  if (!roundAt) throw new RangeError("A result's round is 16 bytes (32 hex characters).");
   if (!Array.isArray(winners) || winners.length > 255) throw new RangeError('A result names at most 255 winners.');
   return concat(
     utf8(RESULT_DOMAIN),
@@ -85,6 +133,6 @@ export function resultBytes({ cluster = 'devnet', game, round, endedAt, winners
     roundAt,
     uintLE(BigInt(endedAt), 8),
     Uint8Array.of(winners.length),
-    ...winners.map((w) => concat(addressBytes(w.wallet), uintLE(w.place, 1), uintLE(w.grant ?? NO_GRANT, 2))),
+    ...winners.map(w => concat(addressBytes(w.wallet), uintLE(w.place, 1), uintLE(w.grant ?? NO_GRANT, 2))),
   );
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xgamesfun/solana",
-  "version": "0.24.0",
+  "version": "0.25.1",
   "mcpName": "io.github.XGamesFun/solana-kit",
   "description": "One shared Solana program for game and community economies, its JS client, and the tools that let an AI agent design, check, simulate and launch an economy on it.",
   "license": "Apache-2.0",
@@ -71,10 +71,11 @@
   ],
   "scripts": {
     "test": "node --test \"js/test/**/*.test.mjs\"",
-    "lint": "eslint .",
+    "lint": "eslint . && prettier --check .",
+    "format": "prettier --write .",
     "types": "tsc -p tsconfig.types.json",
     "fixtures": "node scripts/fetch-fixtures.mjs",
-    "check": "node scripts/fetch-fixtures.mjs --check && node scripts/sync-skills.mjs --check && node scripts/release-manifest.mjs --check && eslint . && npm test",
+    "check": "node scripts/fetch-fixtures.mjs --check && node scripts/sync-skills.mjs --check && node scripts/release-manifest.mjs --check && npm run lint && npm test",
     "check:idl": "node scripts/sync-idl.mjs --check",
     "sync-idl": "node scripts/sync-idl.mjs",
     "sync-skills": "node scripts/sync-skills.mjs",
@@ -85,10 +86,11 @@
     "@eslint/js": "10.0.1",
     "@modelcontextprotocol/sdk": "1.32.2",
     "ajv": "8.20.0",
-    "eslint": "10.13.0",
+    "eslint": "10.14.0",
     "globals": "17.13.0",
     "litesvm": "1.6.1",
     "playwright-core": "1.64.1",
+    "prettier": "3.9.10",
     "typescript": "7.0.2"
   },
   "bin": {

package/release.json

@@ -1,8 +1,8 @@
 {
-  "version": "0.24.0",
+  "version": "0.25.0",
   "programId": "9cwqM1TXytPnFZsLfmUyv2dg4uW6Ch9C6UJVPns7NFQ",
-  "sbfBytes": 1727272,
-  "sbfSha256": "1bf01fbceb390c8888921df95f711d32e805554401e2c128e83eb16fcb11098c",
-  "idlSha256": "32dc0d5ed56fa7fb2ef8e90ef8d96d1d8bbe940b624d3d5b636933af20ae56b4",
-  "clientSha256": "f2a0f00386a08ecbd1fd939d53889d1a7a151997bf16684c641dd98a838b8d72"
+  "sbfBytes": 1741840,
+  "sbfSha256": "ea19d15d03211f7bd0b25179d51f75544342225127fcb631e687eae6750c9ba7",
+  "idlSha256": "41e621990c17b8645f59bb2a170271645ad370d1c1bf9f1dbdd04f817b82d4cf",
+  "clientSha256": "78b426dc003d261537934856302fe9767db149fd37b814af2569b95cc1333624"
 }

package/skills/xsolana-economy/SKILL.md

@@ -9,8 +9,8 @@ An economy is one JSON spec (`xsolana.json` in the project) on **loot**, a Solan
 writes or deploys a contract: the spec is checked, simulated and priced by the `xsolana_*` tools, and the project's
 owner puts it live by approving in their own wallet. It runs on **devnet** until the program is audited.
 
-The tools are the `xsolana_*` MCP tools. Without MCP, the same from a terminal: `npx -y @xgamesfun/solana@0.24.0 <guide|examples|check|simulate|cost|explain|publish|status> [xsolana.json]`,
-or `npx -y @xgamesfun/solana@0.24.0 tool <name> '<json>'` for any tool (always with the exact version).
+The tools are the `xsolana_*` MCP tools. Without MCP, the same from a terminal: `npx -y @xgamesfun/solana@0.25.1 <guide|examples|check|simulate|cost|explain|review|publish|status> [xsolana.json]`,
+or `npx -y @xgamesfun/solana@0.25.1 tool <name> '<json>'` for any tool (always with the exact version).
 
 ## Rules (always)
 
@@ -25,12 +25,15 @@ or `npx -y @xgamesfun/solana@0.24.0 tool <name> '<json>'` for any tool (always w
 5. **Numbers come from the tools.** What a box gives back, how long a pool lasts, what going live costs: quote
    `xsolana_simulate`, `xsolana_cost` and `xsolana_explain`, never your own arithmetic. What a player pays is the tools'
    "in all" number for that action (price, fee, oracle, network and rent that never comes back): quote it as is.
-6. **Flag the law.** When the checker raises `W-CHANCE-PRIZE` (paid chance at money: boxes with prizes, lotteries,
-   contests), `W-CHANCE-ITEMS` (paid random collectibles a player can resell: loot boxes, gacha) or `W-REVENUE-SHARE` (stakers paid from sales), tell the person in plain words, every time, and never
-   call anything an investment, a return or passive income. For an auction, always say `W-AUCTION-SHILL`: anyone,
-   the seller included, can bid to push the price up. Before they go live, say as well that the program is not
-   independently audited and comes as is, with no warranty: they use it at their own risk, and making sure the
-   economy is legal where it is offered is theirs. Never promise it is safe, and never give legal advice.
+6. **Flag the law once.** The first time the checker raises `W-CHANCE-PRIZE` (paid chance at money: boxes with
+   prizes, lotteries, contests), `W-CHANCE-ITEMS` (paid random collectibles a player can resell: loot boxes, gacha) or
+   `W-REVENUE-SHARE` (stakers paid from sales), say it in one plain sentence. Don't repeat it in later answers, or add
+   legal notes to pages and apps you build, unless the person asks or a flag of a new kind appears. When they ask about
+   the law, answer what you know and leave the rest to their lawyer: you are not one. Never call anything an
+   investment, a return or passive income, and never promise it is safe. The approval page shows the flags and that
+   the program is not independently audited and comes as is, and asks the owner to tick that they read them, so going
+   live needs nothing more from you. For an auction, say once how bidding works (`W-AUCTION-SHILL`): anyone, the
+   seller included, can bid to push the price up.
 7. **Take addresses from the tools, never from memory**: the program, its accounts, the IDL. Every answer names them.
 8. **Public data only in a spec**: names, prices, percents, public addresses. Leave out `id`, `index`, `shopBox`,
    and `live`: they are written when it goes live.
@@ -38,7 +41,9 @@ or `npx -y @xgamesfun/solana@0.24.0 tool <name> '<json>'` for any tool (always w
    anything a limit, break the idea into its pieces (what players pay, what they get, what is random, what the chain
    can't see, what is held and for how long, who is paid) and find the part for each (`references/sentence-to-spec.md`).
    What the chain can't see (a match, a score, something done offline) is vouched for by a signer: a results server's voucher, a
-   decider's key, a list. Build the combination and say which part does which piece. When the tools' words and the
+   decider's key, a list. The signer is not the end of the story: the program checks its signature and limits, never
+   what happened, so a signed result is worth what that server checks (it decides the result, replays it, or only
+   bounds what the page reports: rule 12). Build the combination and say which part does which piece. When the tools' words and the
    checker disagree (a field the schema takes that a sentence somewhere calls impossible), the checker and
    `xsolana_guide`'s parts decide: try it in a spec and run `xsolana_check`.
    A piece is a limit only when no part or combination does it. Then:
@@ -49,13 +54,29 @@ or `npx -y @xgamesfun/solana@0.24.0 tool <name> '<json>'` for any tool (always w
      second step). Don't withdraw a draft that checks, and don't send them elsewhere while a version on loot is on the
      table.
 
-10. **People finish what follows; build the button, not a server.** Every step after a player's ask (settle a roll,
-   draw a lottery, pull its parts (each place, a refund, a share), refund a draw the oracle never answered, claim a
-   win, end an auction, run a sealed schedule, take a rental's NFT home) can be sent by the person who
-   gains from it, from the page (`app.claims()` lists them, `app.claim(c)` sends one). A
-   grant's claim is the winner's alone: the winning wallet signs it, whatever proves it won; anyone may pay its fees,
-   nobody claims for a player. loot needs no server to finish anything. Never make a key in a page or a server for
-   the owner to fund: whoever signs pays.
+10. **Design for many wallets and bots.** Wallets are free and bots play well: bound every reward with totals
+    (`perDay`, `total`), gate open rewards on holding something or count people by vouchers (`perPerson`, with the
+    server naming an X account, never a wallet), keep token rewards for results small, and have a server decide or
+    replay a result worth paying rather than take the page's word (`@xgamesfun/solana/results`: `collectiblesOf`,
+    `verifyProof`, `makeCodes`). Keep entry fees and prize pools for results the server decides and for chance, and
+    give a minted farm an end. The checker warns about the rest (`W-GRANT-TOTAL`, `W-GRANT-OPEN`, `W-FARM-MINT`);
+    `references/trust-and-cheating.md` says why.
+
+11. **People finish what follows; build the button, not a server.** Every step after a player's ask (settle a roll,
+    draw a lottery, pull its parts (each place, a refund, a share), refund a draw the oracle never answered, claim a
+    win, end an auction, run a sealed schedule, take a rental's NFT home) can be sent by the person who
+    gains from it, from the page (`app.claims()` lists them, `app.claim(c)` sends one). A
+    grant's claim is the winner's alone: the winning wallet signs it, whatever proves it won; anyone may pay its fees,
+    nobody claims for a player. loot needs no server to finish anything. Never make a key in a page or a server for
+    the owner to fund: whoever signs pays.
+
+12. **Review before going live, and let the person choose the trade-off.** Run `xsolana_review` before the owner
+    approves. Fix every high finding, or have the person accept it in plain words. Declare `"trust"` honestly on every
+    voucher grant: `"decides"` (the server runs the game or match; the page sends only inputs), `"replays"` (it re-runs
+    the page's inputs from randomness it keeps) or `"bounds"` (it takes the page's word within a pace and caps). Then
+    tell the person, for each signed route, which level it uses, what a cheater gets (the review's ceiling, with what
+    the prize goes on to earn), and what the stronger level would cost to build. They choose; you don't choose for
+    them by leaving it out. `references/trust-and-cheating.md` has the levels, the costs and the checklist.
 
 ## The loop
 
@@ -78,18 +99,26 @@ or `npx -y @xgamesfun/solana@0.24.0 tool <name> '<json>'` for any tool (always w
    draws an open, a guaranteed rare), opened several at once from the page; cards whose traits differ are a fresh
    item drawing from `tables`. Every other shape (bundles, an NFT as the price, stashes, gates, no-loss lotteries,
    amounts by rank) is in `references/sentence-to-spec.md` and `xsolana_guide`.
+   A lottery always names where its places are paid from, and there is no default: ask the person if their words
+   don't say. `"pot": 0` keeps a pot from round to round: a seed, sponsors, shares of other sales and what earlier
+   rounds left all count, and the next round starts with what the round before left (a jackpot that grows, a no-loss
+   lottery). `"rest": "<destination>"` pays each round from its own ticket money alone, which nothing from outside can
+   change, and sends what the places leave there (`"treasury"`, a wallet, `"burn"`; never a pool or `"chosen"`).
    Then say what stays the project's job (`references/telling-the-person.md`): the files behind every item's link
    (every value of a fresh item's `{attribute}`), a table's rent, and the collectible rent a pack's settle pays.
 6. **Iterate on what they say.** "Make legendaries 0.5%", "a bigger seed": change, check, simulate, explain again.
 7. **Save it**: `xsolana_save {"spec": …}` writes `xsolana.json`, only if it checks. A live file keeps its program numbers.
-8. **When they say "put it live"**: `xsolana_publish` lists every step and its cost and gives the command. Tell them to
+8. **Review it before they approve**: `xsolana_review` (rule 12). Fix the high findings, declare `trust` on every
+   voucher grant, and tell the person which level each signed route uses, what a cheater gets and what the stronger
+   level would cost. Run it again after every change that touches a route that pays.
+9. **When they say "put it live"**: `xsolana_publish` lists every step and its cost and gives the command. Tell them to
    run it themselves in the project folder, exactly as `xsolana_publish` gives it (it names the exact version:
-   `npx -y @xgamesfun/solana@0.24.0 approve xsolana.json`; never drop the version). It opens a page on their computer where
+   `npx -y @xgamesfun/solana@0.25.1 approve xsolana.json`; never drop the version). It opens a page on their computer where
    they connect a devnet wallet and approve; what lands is written back into `xsolana.json`. You publish nothing.
-9. **After it is live**: `xsolana_status` shows each part on chain; read it before acting on what the person says
-   happened. A later change is the same loop: save, publish, and the approval sends only what changed. What only the
-   owner signs (open or decide a contest, pay out) goes on an owner page they approve in their own wallet:
-   `references/after-launch.md`.
+10. **After it is live**: `xsolana_status` shows each part on chain; read it before acting on what the person says
+    happened. A later change is the same loop: save, publish, and the approval sends only what changed. What only the
+    owner signs (open or decide a contest, pay out) goes on an owner page they approve in their own wallet:
+    `references/after-launch.md`.
 
 ## Building the app around it
 
@@ -107,3 +136,4 @@ For staking an NFT of another collection, show what custody means and get explic
 - Telling the person what they get, and what stays the project's job: `references/telling-the-person.md`
 - Building the app for a live economy: `references/apps.md`
 - After it goes live (who sends each step, owner pages, results from a game, a results server): `references/after-launch.md`
+- What a server decides, replays or bounds, who gets paid, and the exploit checklist: `references/trust-and-cheating.md`

package/skills/xsolana-economy/references/after-launch.md

@@ -6,21 +6,21 @@ winner nobody pays.
 
 ## Who sends each step
 
-| Step | Who can send it | If nobody does |
-| --- | --- | --- |
-| A box's roll and settle, a shop buy | the player, in their own purchase (`js/play` does both in one prompt) | the player, a key the player named for the order (`settler`) or the project's owner or authority settle a rolled order, a normal item too (the app's backend delivers it from the `OrderSettled` receipt of a finalized transaction whose `meta.err` is null, once per order: `loot.receipts(tx)` gives none for a transaction with an error, whose logs can still read as all-success; a truncated log stays truncated when read again, so it then goes by the order's account); a roll that failed or never came refunds (`app.refund`) |
-| A lottery draw, then each part pulled | **anyone**: the page (`app.claims()` lists each available step), or a sweep. The draw's ask fixes the round's money (what its places take of the pot, each pool's prize) and opens the next round at once. A pull pays one part into its owner's account, opened in the same transaction when it is not there (the sender pays its rent): an entry's own (a refund, a ticket back), its places' part of the pot or their prizes (a raffled NFT, an item, tokens, a roll), or a part owed in common (a share, what the pot gets back) | selling stops at draw time. A round nobody draws waits, with no deadline. Once drawn, every part waits in the round for its own pull, in any order, holding up nobody else; the pull that leaves nothing owed closes the round, and the rent of its record goes back to whoever fronted it (the lottery's `roundRent`, or its first buyer). An NFT that can't move is made a hold for its winner. If the oracle never answers a draw (7 days after it was first asked for), the next ask cancels it, and every buyer's refund is pulled; the page pulls the sender's own refund in the cancel's own transaction. A due round's draw rides in front of the next ticket purchase. An empty round moves on with the next ticket. A one-time lottery ends after its round |
-| A schedule that is due (an emission, rent, a drip) | the project's owner or authority, or who it pays (a wallet, the treasury): `app.runSchedule` signed by one of them, or their sweep (a sealed burn: anyone) | **a run missed is missed**: one sent late pays once, for the latest run due, and the runs before it lapse, so keep a key of the project's sending it on time. Only a sealed schedule's fixed amount pays every run due (a backlog of years takes a few calls) |
-| Ending an auction | **anyone**: usually the winner, from the page | it waits: whenever it is ended, the lot goes to the highest bidder. A seller whose account can't take the money then doesn't hold up the winner: the lot goes, the auction stays open owing it (`app.auctions()`: `delivered`, `proceedsOwed`), and the next end, anyone's, pays and closes it |
-| Catching a farm up (`walk_farm`), when it has passed more of its seats' end times than a move can walk | **anyone**, for free: `app.claims()` lists it, `app.walkFarm(key)` sends it in parts (`app.farmWalk(key)` says how many) | moves of that farm fail until it is walked; nothing is lost by the wait: what each seat earned by its end is exact |
-| A contest's entries back when it is off, or a winner's part of a contest with no prize or picks | **anyone** (each entry's money goes only to its player); a winner's first claim with a prize or picks: the **winner or the project's keys**, and past 30 days the project's keys may pick for them | they wait; nothing is lost |
-| Opening a contest | the **authority** (the owner's wallet by default) | nothing happens |
-| Naming its winner, calling it off | the **authority**, or **anyone** sending a verdict one of its `deciders` signed (a results server's key: `decideIx` with `verdict`, after the Ed25519 check of `verdictBytes`); a winner only once entries close, a call-off any time | after `resultDue` it is off by the clock and everyone claims back; a crowdfund short of its `minPot` when entries close is off at once |
-| Moving tokens out of a pool, minting, a `decisions` payout, rewriting a collectible | the **authority** | nothing happens |
-| A grant claim | the **winner** only, from the page: the winning wallet signs every claim, whatever proves it (a voucher, the list, an open grant); anyone may pay its fees, nobody claims for it | the prize waits for them |
-| A prize given directly (a grant's, a lottery place's, a contest's, a mission's, a recipe's: an item, tokens, an NFT of a stash) | the winner's own claim (a grant's: the winner signs it), the place's payment, the winning entry's claim, the unstake or the craft: it is given in that transaction, the sender paying what it opens (a collectible's rent, the winner's token account) | a grant's claim or a craft of a prize it can't give is refused; a lottery's place, a contest's claim or a mission's end goes on without it (an NFT already given, an item sold out or switched off, a pool short pays what it holds) |
-| A prize that is a roll of a box (a grant's, a lottery's place, a contest's winners, an auction's mystery lot, a mission's chest) | the winner's own claim (a grant's), the place's payment or the auction's end makes the winner's order (its rent goes back to the winner at settle); then the **winner or the project's keys** ask the oracle for the roll (`loot.askRollIx`, its fee the asker's) and the winner, a key the winner named, or the project's keys settle it (`loot.settleIx`), which hands over what it rolled, a stash's NFT included; `app.claims()` lists them | it waits, and is never refunded while it waits; asked and never answered, they ask again. What the box gives that has run out (an empty stash, a sold-out item) can't be won: the roll lands on its other outcomes, and a fixed prize its pool runs short of pays what the pool holds. With nothing at all in stock, only the winner asks, and that ends the roll with nothing (an auction's mystery lot: the winning bid refunded); a roll whose answer finds nothing at all waits again, for a restock |
-| Putting more NFTs in a stash, or taking one out | the **owner** (or the authority), holding them: add them to the stash's `nfts` and publish again (only the new ones go in), or `loot.stashIx` with `out` to any wallet | a stash nobody refills just runs out |
+| Step                                                                                                                             | Who can send it                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | If nobody does                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| -------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| A box's roll and settle, a shop buy                                                                                              | the player, in their own purchase (`js/play` does both in one prompt)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | the player, a key the player named for the order (`settler`) or the project's owner or authority settle a rolled order, a normal item too (the app's backend delivers it from the `OrderSettled` receipt of a finalized transaction whose `meta.err` is null, once per order: `loot.receipts(tx)` gives none for a transaction with an error, whose logs can still read as all-success; a truncated log stays truncated when read again, so it then goes by the order's account); a roll that failed or never came refunds (`app.refund`)                                                                                                                                                                                                                             |
+| A lottery draw, then each part pulled                                                                                            | **anyone**: the page (`app.claims()` lists each available step), or a sweep. The draw's ask fixes the round's money (what its places take of the pot, or of the round's own ticket money for a lottery with `rest`; each pool's prize) and opens the next round at once; paid from a pot, it first moves in what the round before left that pot, so the next round always sees it, whoever pulls and whenever. A pull pays one part into its owner's account, opened in the same transaction when it is not there (the sender pays its rent): an entry's own (a refund, a ticket back), its places' part of the pot or their prizes (a raffled NFT, an item, tokens, a roll), or a part owed in common (a share, what the places leave: to the pot, or to `rest`; a burned `rest` stays for the close to burn) | selling stops at draw time. A round nobody draws waits, with no deadline. Once drawn, every part waits in the round for its own pull, in any order, holding up nobody else; the pull that leaves nothing owed closes the round, and the rent of its record goes back to whoever fronted it (the lottery's `roundRent`, or its first buyer). An NFT that can't move is made a hold for its winner. If the oracle never answers a draw (7 days after it was first asked for), the next ask cancels it, and every buyer's refund is pulled; the page pulls the sender's own refund in the cancel's own transaction. A due round's draw rides in front of the next ticket purchase. An empty round moves on with the next ticket. A one-time lottery ends after its round |
+| A schedule that is due (an emission, rent, a drip)                                                                               | the project's owner or authority, or who it pays (a wallet, the treasury): `app.runSchedule` signed by one of them, or their sweep (a sealed burn: anyone)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | **a run missed is missed**: one sent late pays once, for the latest run due, and the runs before it lapse, so keep a key of the project's sending it on time. Only a sealed schedule's fixed amount pays every run due (a backlog of years takes a few calls)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| Ending an auction                                                                                                                | **anyone**: usually the winner, from the page                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | it waits: whenever it is ended, the lot goes to the highest bidder. A seller whose account can't take the money then doesn't hold up the winner: the lot goes, the auction stays open owing it (`app.auctions()`: `delivered`, `proceedsOwed`), and the next end, anyone's, pays and closes it                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| Catching a farm up (`walk_farm`), when it has passed more of its seats' end times than a move can walk                           | **anyone**, for free: `app.claims()` lists it, `app.walkFarm(key)` sends it in parts (`app.farmWalk(key)` says how many)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | moves of that farm fail until it is walked; nothing is lost by the wait: what each seat earned by its end is exact                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| A contest's entries back when it is off, or a winner's part of a contest with no prize or picks                                  | **anyone** (each entry's money goes only to its player); a winner's first claim with a prize or picks: the **winner or the project's keys**, and past 30 days the project's keys may pick for them                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | they wait; nothing is lost. Each winner's part is written at the decision (the pot then, and a split prize's vault), so the order of claims changes nothing; tokens sent to the pot after it go to nobody (burned at the close), and a split prize's part a winner gives up goes back to its pool, not to later winners                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| Opening a contest                                                                                                                | the **authority** (the owner's wallet by default)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | nothing happens                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| Naming its winner, calling it off                                                                                                | the **authority**, or **anyone** sending a verdict one of its `deciders` signed (a results server's key: `decideIx` with `verdict`, after the Ed25519 check of `verdictBytes`); a winner only once entries close, a call-off any time                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | after `resultDue` it is off by the clock and everyone claims back; a crowdfund short of its `minPot` when entries close is off at once                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| Moving tokens out of a pool, minting, a `decisions` payout, rewriting a collectible                                              | the **authority**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | nothing happens                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| A grant claim                                                                                                                    | the **winner** only, from the page: the winning wallet signs every claim, whatever proves it (a voucher, the list, an open grant); anyone may pay its fees, nobody claims for it                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | the prize waits for them                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| A prize given directly (a grant's, a lottery place's, a contest's, a mission's, a recipe's: an item, tokens, an NFT of a stash)  | the winner's own claim (a grant's: the winner signs it), the place's payment, the winning entry's claim, the unstake or the craft: it is given in that transaction, the sender paying what it opens (a collectible's rent, the winner's token account)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | a grant's claim or a craft of a prize it can't give is refused; a lottery's place, a contest's claim or a mission's end goes on without it (an NFT already given, an item sold out or switched off, a pool short pays what it holds)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| A prize that is a roll of a box (a grant's, a lottery's place, a contest's winners, an auction's mystery lot, a mission's chest) | the winner's own claim (a grant's), the place's payment or the auction's end makes the winner's order (its rent goes back to the winner at settle); then the **winner or the project's keys** ask the oracle for the roll (`loot.askRollIx`, its fee the asker's) and the winner, a key the winner named, or the project's keys settle it (`loot.settleIx`), which hands over what it rolled, a stash's NFT included; `app.claims()` lists them                                                                                                                                                                                                                                                                                                                                                                | it waits, and is never refunded while it waits; asked and never answered, they ask again. What the box gives that has run out (an empty stash, a sold-out item) can't be won: the roll lands on its other outcomes, and a fixed prize its pool runs short of pays what the pool holds. With nothing at all in stock, only the winner asks, and that ends the roll with nothing (an auction's mystery lot: the winning bid refunded); a roll whose answer finds nothing at all waits again, for a restock                                                                                                                                                                                                                                                              |
+| Putting more NFTs in a stash, or taking one out                                                                                  | the **owner** (or the authority), holding them: add them to the stash's `nfts` and publish again (only the new ones go in), or `loot.stashIx` with `out` to any wallet                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | a stash nobody refills just runs out                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
 
 "Anyone" means the page can offer a button for it, and any player can press it. Build those buttons with `js/play`:
 `app.claims()` lists what this player can finish now (a draw, its cancellation, a pull, a payout, a refund, an
@@ -33,7 +33,8 @@ A round of a lottery is a record of its own, opened by its first purchase (the S
 token accounts and each entry's bytes; with too little, its first buyer fronts the header and accounts, about 0.004 SOL
 and up, and each buyer their entry; all back when the round closes, to whoever paid), and it holds its ticket money in
 accounts of its own until each part is pulled: shares in common and burns run after the draw, and the pot holds only
-what nobody is owed. Each purchase adds an entry: funded by `roundRent`, the buyer pays only the fee and the price; a
+what nobody is owed. While a round paid from a pot waits for the oracle, the next round's draw waits too: it needs that
+round's answer to know what it left the pot. Each purchase adds an entry: funded by `roundRent`, the buyer pays only the fee and the price; a
 buyer who pays its bytes themselves (about 0.0002 SOL) never gets them back (they go to the treasury when the round
 closes). A share the
 buyer chooses (a referrer) is paid as they buy. Cancelling (only for a draw the oracle never answered, or a round short of its least sale) owes every entry its
@@ -85,13 +86,23 @@ the winner claims themselves. The grant's limits (per wallet in all and per wind
 total, between two dates) are the most anything can ever pay out, whatever happens to a server.
 
 - **A list** (an airdrop, a known set of winners): the owner writes the wallets in the grant's `list`; no server.
-- **Promo codes, claim links**: the grant's `keys` are the public keys of one keypair per code (made offline from each
-  code; only public keys go in the spec), with `limits.perKey: 1`. The player types the code; the page derives its
-  keypair, signs a voucher for the player's own wallet, and claims (`app.claimGrant(key, { voucher })`). A code pays
-  once in all; a signature someone copies pays only the wallet it names.
+- **Promo codes, claim links**: make the codes with `makeCodes(n)` (`@xgamesfun/solana/results`: 80 bits each, never
+  fewer than 64, since each code's key is public in the spec and a short code can be found by trying them all
+  offline) and put `await codeAddresses(codes)` in the grant's `keys`, with `limits.perKey: 1`. Keep the codes out of
+  the repository. The player types a code; the page makes `codeVoucher({ code, game, grant, incarnation, wallet,
+now })` for the player's own wallet and claims (`app.claimGrant(key, { voucher })`). A code pays once in all; a
+  signature someone copies pays only the wallet it names.
 - **Show a badge, claim once**: an open grant (no `vouchers`, `keys` or `list`) with a `gate` and `limits.perWallet`:
   any wallet that shows the collectible claims, and each collectible shown counts too. No server.
-- **Vouchers from a results server**: the grant names the server's public key in `vouchers`; the server checks the
+- **A wallet is not a person.** Wallets are free, so a per-wallet limit never limits a person, and a game runs in the
+  player's browser, so its own claims prove nothing. For a reward worth farming: the server decides or checks the
+  result; it pays only a wallet the player proved (`proofRequest` / `verifyProof` from `@xgamesfun/solana/results`: a
+  text the wallet signs, with the game, a nonce the server takes once, and an expiry); it counts people where it can
+  (`perPerson`, with a person hash the voucher names: that needs an outside sign-in such as X, and a wallet-only
+  player has none); it checks what a wallet holds on the chain, never the page's word (`collectiblesOf`, `holds`); and
+  the grant's `perDay` and `total` bound everything whatever happens to a key. Keep token rewards for results small.
+- **Vouchers from a results server**: the grant names the server's public key in `vouchers`, and says in `trust`
+  what the server checks (`"decides"`, `"replays"` or `"bounds"`: `trust-and-cheating.md`); the server checks the
   game's result and signs a voucher (for a grant of tokens, with each winner's own `amount`, up to the grant's: rewards
   by rank); the winner's page claims with it (`app.claimGrant(key, { voucher })`).
   - The server can be the person's own game server (`signVoucher` from `@xgamesfun/solana/results`). It holds only that

package/skills/xsolana-economy/references/apps.md

@@ -12,58 +12,69 @@ npm install @xgamesfun/solana
 ```js
 import { solanaApp, walletStandardSigner } from '@xgamesfun/solana/play';
 
-const spec = await (await fetch('./xsolana.json')).json();        // the live spec, served with the page
+const spec = await (await fetch('./xsolana.json')).json(); // the live spec, served with the page
 
 // Connect a wallet (Phantom, Solflare, Backpack all register through the Wallet Standard).
 const wallets = [];
-const api = { register: (...w) => { wallets.push(...w); return () => {}; } };
+const api = {
+  register: (...w) => {
+    wallets.push(...w);
+    return () => {};
+  },
+};
 window.addEventListener('wallet-standard:register-wallet', ({ detail }) => detail(api));
 window.dispatchEvent(Object.assign(new Event('wallet-standard:app-ready'), { detail: api }));
-const wallet = wallets.find((w) => w.chains.some((c) => c.startsWith('solana:')));
-const { accounts: [account] } = await wallet.features['standard:connect'].connect();
+const wallet = wallets.find(w => w.chains.some(c => c.startsWith('solana:')));
+const {
+  accounts: [account],
+} = await wallet.features['standard:connect'].connect();
 
 const app = solanaApp({ spec, rpcUrl: 'https://api.devnet.solana.com', wallet: walletStandardSigner(wallet, account) });
 
-const shop = await app.shop();            // [{ key, name, price, priceUnits, currency, active, left }]
-await app.buy('badge', { listing: shop.find((l) => l.key === 'badge') });  // the price shown is the most it pays
-const boxes = await app.boxes();          // each box's price, outcome chances and whenOut (show it: stops selling, or draws among what is left)
-await app.openBox('chest', { listing: boxes.find((l) => l.key === 'chest') }); // pays, waits for the roll, settles
-await app.pay('entry');                   // a payment of the spec
+const shop = await app.shop(); // [{ key, name, price, priceUnits, currency, active, left }]
+await app.buy('badge', { listing: shop.find(l => l.key === 'badge') }); // the price shown is the most it pays
+const boxes = await app.boxes(); // each box's price, outcome chances and whenOut (show it: stops selling, or draws among what is left)
+await app.openBox('chest', { listing: boxes.find(l => l.key === 'chest') }); // pays, waits for the roll, settles
+await app.pay('entry'); // a payment of the spec
 const lotteries = await app.lotteries(); // [{ key, name, price, currency, status, round, sold, drawsAt, nftTicket, … }]
-await app.buyTickets('weekly', 2, { listing: lotteries.find((l) => l.key === 'weekly') }); // an NFT ticket: { nft: asset, listing }
+await app.buyTickets('weekly', 2, { listing: lotteries.find(l => l.key === 'weekly') }); // an NFT ticket: { nft: asset, listing }
 await app.payNft(asset, { to, reference }); // pay with an NFT (burned, or given to `to`): admit the player by the receipt
-await app.stake('farm', '10', 0);         // tokens, at lock tier 0;  app.stakeNft('farm', asset) for a collectible
-await app.harvest('farm');                // rewards;  app.unstake('farm', '10') once the lock has run
-await app.staked('farm');                 // the player's seats: [{ asset, amount, freeAt, boostPercent, waiting, rewards }]
-await app.refresh('guild', asset);        // a farm with growth: writes the NFT's points and level now (anyone may)
-const recipes = await app.recipes();      // [{ key, name, active, version }]
-await app.craft('merge', [assetA, assetB], 1, { listing: recipes.find((r) => r.key === 'merge') });  // a changed recipe is refused
-await app.auctions();                     // each auction: high, nextBid, leading, secondsLeft, open, over, waiting (SOL)
-await app.bid('comet', '0.6');           // the bid it tops goes back to its bidder in the same transaction
-await app.endAuction('comet');           // once it is over, anyone: the lot to the winner { winner, asset?, rolled? }
-await app.unwrap();                       // SOL back from a bid that was topped, from wrapped SOL to plain SOL
-await app.claimGrant('welcome');          // a wallet on the grant's list (or { voucher } from your server)
-await app.claimWins({ server, token });   // every prize a results server vouched for or listed, claimed by the winner; [{ round, signature | error }]
-                                          // (`token`: the player's sign-in with that server, when it asks for one: a stash drop's NFT is given only at a signed-in claim)
+await app.stake('farm', '10', 0); // tokens, at lock tier 0;  app.stakeNft('farm', asset) for a collectible
+await app.harvest('farm'); // rewards;  app.unstake('farm', '10') once the lock has run
+await app.staked('farm'); // the player's seats: [{ asset, amount, freeAt, boostPercent, waiting, rewards }]
+await app.refresh('guild', asset); // a farm with growth: writes the NFT's points and level now (anyone may)
+const recipes = await app.recipes(); // [{ key, name, active, version }]
+await app.craft('merge', [assetA, assetB], 1, { listing: recipes.find(r => r.key === 'merge') }); // a changed recipe is refused
+await app.auctions(); // each auction: high, nextBid, leading, secondsLeft, open, over, waiting (SOL)
+await app.bid('comet', '0.6'); // the bid it tops goes back to its bidder in the same transaction
+await app.endAuction('comet'); // once it is over, anyone: the lot to the winner { winner, asset?, rolled? }
+await app.unwrap(); // SOL back from a bid that was topped, from wrapped SOL to plain SOL
+await app.claimGrant('welcome'); // a wallet on the grant's list (or { voucher } from your server)
+await app.claimWins({ server, token }); // every prize a results server vouched for or listed, claimed by the winner; [{ round, signature | error }]
+// (`token`: the player's sign-in with that server, when it asks for one: a stash drop's NFT is given only at a signed-in claim)
 const loan = await app.loanOffer(lender, 1); // a lender's offer: { amount, repay, lasts, risks }: show every risk's `says`
 await app.borrow(lender, 1, asset, { acceptRisks: true }); // only once the player saw the risks (refused without it)
-for (const c of await app.claims()) await app.claim(c);   // what this player can finish: a roll to collect, a refund,
-                                          // a contest payout, a due draw, an auction to end
-await app.runSchedule('drip');            // a schedule that is due (the project's keys or who it pays); null when not yet. A run missed is missed: only a sealed fixed amount pays every run due
-await app.farmWalk('guild');              // { ends, needsWalk, parts }: end times the farm has passed; a move refuses (FarmNeedsWalk) past what it can walk
-await app.walkFarm('guild');              // walks it in parts (anyone, free); claims() lists it when it is needed
-await app.collectibles();                 // what the player owns: [{ asset, item, name, uri, attributes }] (`item`: its key)
-await app.balances();                     // what they hold of each of the economy's tokens
+for (const c of await app.claims()) await app.claim(c); // what this player can finish: a roll to collect, a refund,
+// a contest payout, a due draw, an auction to end
+await app.runSchedule('drip'); // a schedule that is due (the project's keys or who it pays); null when not yet. A run missed is missed: only a sealed fixed amount pays every run due
+await app.farmWalk('guild'); // { ends, needsWalk, parts }: end times the farm has passed; a move refuses (FarmNeedsWalk) past what it can walk
+await app.walkFarm('guild'); // walks it in parts (anyone, free); claims() lists it when it is needed
+await app.collectibles(); // what the player owns: [{ asset, item, name, uri, attributes }] (`item`: its key)
+await app.balances(); // what they hold of each of the economy's tokens
 ```
 
 - **Serving it**: a plain `index.html` with a `<script type="module">` can't import a bare `@xgamesfun/solana/play` by
   itself. Either use a bundler (Vite: `npm create vite@latest`, then `npm install @xgamesfun/solana`), or put this import
   map before the module script and serve the folder (`npx serve .`):
   ```html
-  <script type="importmap">{ "imports": {
-    "@xgamesfun/solana/play": "./node_modules/@xgamesfun/solana/js/play/index.js",
-    "@xgamesfun/solana/client": "./node_modules/@xgamesfun/solana/js/client/index.js"
-  } }</script>
+  <script type="importmap">
+    {
+      "imports": {
+        "@xgamesfun/solana/play": "./node_modules/@xgamesfun/solana/js/play/index.js",
+        "@xgamesfun/solana/client": "./node_modules/@xgamesfun/solana/js/client/index.js"
+      }
+    }
+  </script>
   ```
   Tell the person the one command that starts it, and that it serves on devnet.
 - **What a roll looks like**: a box of several outcomes is rolled by the oracle a few seconds after the open; `openBox`
@@ -95,14 +106,14 @@ await app.balances();                     // what they hold of each of the econo
   on the seller's page until an end (`app.endAuction`, anyone's) pays and closes it. Don't treat it as closed at its end.
 - **NFTs the project has no authority over**: a gate or odds that name a collection find the player's Core NFTs of it
   themselves; for a Token Metadata NFT pass `shown: { mint, owner }`, for a compressed one `shown: { compressed:
-  assetId, tree }` after a `loot.proveLeafIx` in the same transaction. `app.stakeNft`, `app.unstakeNft`, `app.refresh`,
+assetId, tree }` after a `loot.proveLeafIx` in the same transaction. `app.stakeNft`, `app.unstakeNft`, `app.refresh`,
   `app.harvest`, `app.hold` and `app.endAuction` take any NFT: a Core asset, a Token Metadata mint (legacy or pNFT),
   or a compressed NFT's asset id; the page finds its kind itself, and proves a compressed one first (its RPC must
   offer DAS: `getAsset`, `getAssetProof`). In a farm that watches, `app.harvest` shows the NFT is still the player's,
   and `app.stakeNft` of an NFT someone else staked and sold takes their seat over. What the project wrote about one is in
   its Sheet (`loot.decodeSheet`).
 - **Off-chain traits** (the spec's `traits`): the project builds the tree with `loot.traitsTree([{ nft, attributes
-  }])` from its NFTs' metadata and publishes each NFT's `attributes` and `proof` with the page; a player (or the page,
+}])` from its NFTs' metadata and publishes each NFT's `attributes` and `proof` with the page; a player (or the page,
   before a stake) calls `app.proveTraits(nft, attributes, proof)` once per NFT, and its boosts and gates read them.
 - **Rolls on an NFT**: `app.openBox(boxKey, { on: asset })` for a box that rolls on one (an enchant). Leaving a
   mission that rolls, `app.unstakeNft` returns `{ signature, roll, rolled }`; a recipe that rolls, `app.craft` returns