@xgamesfun/solana 0.28.0 → 0.28.2

package/DISCLAIMER.md

@@ -19,7 +19,9 @@ Read this before you use this package, its tools or the loot program. Using them
   wallets, token and NFT programs, npm and any results server. Any of them can fail, change or stop.
 - The public results server (`https://play.xgames.fun/xsolana`) is offered as is, may change or stop at any time, and
   carries no promise of uptime or of what it vouches for.
-- **Devnet only.** Nothing here is meant for real money until the program has been independently audited.
+- **Mainnet is real money, and the program has not been independently audited.** loot runs on devnet, where nothing
+  has value, and on mainnet, where everything does. An economy is on devnet unless its file says
+  `"network": "mainnet"`. What is sent to the program on mainnet can be lost, and you use it there at your own risk.
 
 ## Use it legally
 

package/README.md

@@ -4,7 +4,7 @@
 
 [![npm](https://img.shields.io/npm/v/@xgamesfun/solana?color=b9f26c&label=npm)](https://www.npmjs.com/package/@xgamesfun/solana)
 [![license](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE)
-[![network](https://img.shields.io/badge/network-devnet-orange)](#good-to-know)
+[![network](https://img.shields.io/badge/network-devnet%20%7C%20mainnet-orange)](#good-to-know)
 [![MCP Registry](https://img.shields.io/badge/MCP%20Registry-io.github.XGamesFun%2Fsolana--kit-8a2be2)](https://registry.modelcontextprotocol.io/v0/servers?search=io.github.XGamesFun/solana-kit)
 
 You describe your game's or community's economy in a small JSON file: what players buy, open, stake, win or craft.
@@ -15,8 +15,9 @@ write, deploy or audit yourself.
 Most people never touch the JSON: they ask an AI agent (Claude Code, Codex, Cursor, ChatGPT or Claude) for _"a fishing
 game where each cast costs 0.02 SOL, with a rare golden fish and a monthly draw"_ and the agent does the rest.
 
-> **Devnet only for now.** The program is not yet independently audited, so nothing here is for real money. The
-> tools are provided as is: read [DISCLAIMER.md](DISCLAIMER.md) before you use them.
+> **On devnet and on mainnet.** An economy runs on devnet, where nothing is real money, unless its file says
+> `"network": "mainnet"`, where everything is. The program is not independently audited and the tools are provided as
+> is: read [DISCLAIMER.md](DISCLAIMER.md) before you use them, and before real money above all.
 
 ## What you can build
 
@@ -76,7 +77,7 @@ codex plugin add xsolana@xgamesfun
 
 **claude.ai, ChatGPT or Claude Desktop:** add `https://xgames.fun/mcp` as a custom connector. Nothing to install.
 
-**Cursor, Cline, opencode or any MCP client:** run `npx -y --package=@xgamesfun/solana@0.28.0 xsolana mcp`.
+**Cursor, Cline, opencode or any MCP client:** run `npx -y --package=@xgamesfun/solana@0.28.2 xsolana mcp`.
 
 **Any agent that reads skills** (Copilot, Gemini CLI, Windsurf…): `npx skills add XGamesFun/solana-kit`.
 
@@ -87,26 +88,26 @@ are in [docs/harnesses.md](docs/harnesses.md).
 
 ```bash
 # find a worked example close to your idea
-npx -y @xgamesfun/solana@0.28.0 examples shop with loot boxes
+npx -y @xgamesfun/solana@0.28.2 examples shop with loot boxes
 
 # using a coin you already launched? read it from the chain into its "tokens" entry
-npx -y @xgamesfun/solana@0.28.0 token <its mint address>
+npx -y @xgamesfun/solana@0.28.2 token <its mint address>
 
 # does it work? where does the money go? what does it cost?
-npx -y @xgamesfun/solana@0.28.0 check xsolana.json
-npx -y @xgamesfun/solana@0.28.0 simulate xsolana.json
-npx -y @xgamesfun/solana@0.28.0 cost xsolana.json
+npx -y @xgamesfun/solana@0.28.2 check xsolana.json
+npx -y @xgamesfun/solana@0.28.2 simulate xsolana.json
+npx -y @xgamesfun/solana@0.28.2 cost xsolana.json
 
 # the whole economy in plain words, and what a cheater could get
-npx -y @xgamesfun/solana@0.28.0 explain xsolana.json
-npx -y @xgamesfun/solana@0.28.0 review xsolana.json
+npx -y @xgamesfun/solana@0.28.2 explain xsolana.json
+npx -y @xgamesfun/solana@0.28.2 review xsolana.json
 
-# go live: a key file for the project (it prints the address to send devnet SOL to, never the key)…
-npx -y @xgamesfun/solana@0.28.0 keygen ~/.config/xsolana/my-game.json
+# go live: a key file for the project (it prints the address to send SOL to, never the key)…
+npx -y @xgamesfun/solana@0.28.2 keygen ~/.config/xsolana/my-game.json
 # …then everything going live would send, and a code; nothing is sent
-npx -y @xgamesfun/solana@0.28.0 approve xsolana.json --keypair ~/.config/xsolana/my-game.json
+npx -y @xgamesfun/solana@0.28.2 approve xsolana.json --keypair ~/.config/xsolana/my-game.json
 # …and with that code, exactly what it listed is sent
-npx -y @xgamesfun/solana@0.28.0 approve xsolana.json --keypair ~/.config/xsolana/my-game.json --yes <code>
+npx -y @xgamesfun/solana@0.28.2 approve xsolana.json --keypair ~/.config/xsolana/my-game.json --yes <code>
 ```
 
 Each command names an exact version, so you always run the release you meant to. `xsolana help` lists them all.
@@ -149,7 +150,8 @@ Using `@solana/kit`? `loot.toKitInstruction(ix)` turns any builder's instruction
 
 ## Good to know
 
-- **Devnet only, not yet audited.** Mainnet waits for an independent audit.
+- **Devnet and mainnet, not independently audited.** An economy is on devnet unless its file says
+  `"network": "mainnet"`. Mainnet is real money: try everything on devnet first.
 - **Upgrades can mean setting up again.** No program version so far has carried accounts over. Pin the package version.
 - **Players trust the project.** Your keys can mint and move your project's pools. The program protects players from
   each other and from mistakes, not from the project they chose.

package/bin/xsolana.mjs

@@ -141,6 +141,29 @@ async function main(argv) {
 
   const fileInput = () => (positional[0] ? { file: positional[0] } : {});
 
+  /**
+   * Names the cluster this command works on from the economy it is given (a file, or a spec passed whole): its
+   * "network", devnet when it names none. A file that is missing or not JSON, and a network loot does not know, are
+   * left to the tool, which says so in its own words.
+   */
+  async function clusterOf({ file = 'xsolana.json', spec = null } = {}) {
+    const { CLUSTERS, networkOf, useCluster } = await import('../js/client/cluster.js');
+    let network;
+    try {
+      network = networkOf(spec ?? JSON.parse(await readFile(file, 'utf8')));
+    } catch {
+      return;
+    }
+    if (!Object.hasOwn(CLUSTERS, network)) return;
+    try {
+      useCluster(network);
+    } catch {
+      throw new UsageError(
+        `${spec ? 'The economy' : file} is on ${network}, and XSOLANA_CLUSTER says ${process.env.XSOLANA_CLUSTER}: unset it, or change the economy’s "network".`,
+      );
+    }
+  }
+
   switch (command) {
     case 'mcp': {
       if (flags.has('--http')) {
@@ -166,6 +189,7 @@ async function main(argv) {
     case 'review':
     case 'publish':
     case 'status':
+      await clusterOf(fileInput());
       await tool(`xsolana_${command}`, fileInput());
       break;
     case 'token':
@@ -193,13 +217,14 @@ async function main(argv) {
           `A new key is in ${made.file}${process.platform === 'win32' ? '' : ', readable by you alone'}. Its address:`,
           `  ${made.address}`,
           'Whatever is set up with it, it owns, for good: anyone who can read that file controls the project, and every later change is signed by it. Keep the file where it is and never paste it into a chat, a spec, a repository or a page. Back it up yourself (a USB stick, a password manager): if it is lost, nothing can change the project or move what its address holds.',
-          `It holds nothing yet. Send it devnet SOL (\`xsolana cost\` says what going live takes; https://faucet.solana.com gives some), then: npx -y @xgamesfun/solana@${PACKAGE_VERSION} approve xsolana.json --keypair ${word}`,
+          `It holds nothing yet. Send it SOL (\`xsolana cost\` says what going live takes): devnet SOL for an economy on devnet (https://faucet.solana.com gives some), real SOL for one whose file says "network": "mainnet". Then: npx -y @xgamesfun/solana@${PACKAGE_VERSION} approve xsolana.json --keypair ${word}`,
         ].join('\n'),
       );
       break;
     }
     case 'approve': {
       const file = positional[0] ?? 'xsolana.json';
+      await clusterOf({ file });
       const keyFile = values.get('--keypair');
       const page = flags.has('--browser');
       if (keyFile !== undefined && page)
@@ -252,6 +277,7 @@ async function main(argv) {
           { cause: e },
         );
       }
+      if (input && typeof input === 'object' && (input.file !== undefined || input.spec)) await clusterOf(input);
       await tool(positional[0], input);
       break;
     }

package/js/approve/details.mjs

@@ -5,7 +5,7 @@
 import { decodeBorsh } from '../chain/borsh.js';
 import { equalBytes, toHex } from '../chain/bytes.js';
 import { accountKind, decode, IDL, instructionOf, keyLeaf, merkleRoot } from '../client/index.js';
-import { LOOT_PROGRAM, pda } from '../client/pda.js';
+import { lootProgram, pda } from '../client/pda.js';
 import { dateWords, FAR_SECONDS } from '../economy/check.mjs';
 import { fromUnits } from '../economy/model.mjs';
 import { grantArgs } from '../economy/plan.mjs';
@@ -38,7 +38,7 @@ const leafNames = list => list.flatMap(a => (a.accounts ? leafNames(a.accounts)
 
 /** A loot instruction read back: { name, args, accounts: { name: address } }, or null for another program's. */
 function readLootInstruction(ix) {
-  if (ix.programId !== LOOT_PROGRAM) return null;
+  if (ix.programId !== lootProgram()) return null;
   const def = instructionOf(ix.data);
   if (!def) return null;
   const args = {};
@@ -104,7 +104,7 @@ export async function liveStepDetails(instructions, names, chain) {
       reads.push(null);
       continue;
     }
-    if (account.owner !== LOOT_PROGRAM || accountKind(account.data) !== RECORD_ACCOUNT[kind])
+    if (account.owner !== lootProgram() || accountKind(account.data) !== RECORD_ACCOUNT[kind])
       throw new Error(`${read.accounts.target} is not the ${kind.toLowerCase()} it should be.`);
     reads.push({
       ...read,

package/js/approve/live-check.mjs

@@ -10,7 +10,7 @@ import { METADATA_LIMITS, metadataAddress, parseRecord } from '../chain/metadata
 import { parseMint } from '../chain/mint.js';
 import { mintState, powersOf } from '../chain/token2022.js';
 import { accountKind, decode } from '../client/accounts.js';
-import { BUBBLEGUM_PROGRAM, LOOT_PROGRAM, pda } from '../client/pda.js';
+import { BUBBLEGUM_PROGRAM, lootProgram, pda } from '../client/pda.js';
 import { METAPLEX_METADATA_PROGRAM, SYSTEM_PROGRAM } from '../chain/pda.js';
 import { tokenLabels } from '../economy/model.mjs';
 import { madeSoFar } from '../economy/plan.mjs';
@@ -43,7 +43,7 @@ export async function checkLive({ live, m, wallet, chain }) {
   let project = own;
   if (made.project) {
     const account = await read(made.project);
-    if (!account || account.owner !== LOOT_PROGRAM || accountKind(account.data) !== 'Project')
+    if (!account || account.owner !== lootProgram() || accountKind(account.data) !== 'Project')
       throw new LiveMismatch(
         `The file names the project ${made.project}, and there is no loot project at that address.`,
       );

package/js/approve/page.html

@@ -161,7 +161,7 @@
   <body>
     <main>
       <header>
-        <p class="muted mono flush">loot · devnet · runs on your computer only</p>
+        <p class="muted mono flush">loot · <span id="cluster">devnet</span> · runs on your computer only</p>
         <h1 id="title">Approve going live</h1>
         <p class="muted" id="sub">Loading…</p>
       </header>
@@ -173,8 +173,8 @@
         </div>
         <div class="row" id="wallets" hidden></div>
         <p class="muted note">
-          Set the wallet to <b>devnet</b>. Each approval shows you the transactions before you sign; nothing leaves your
-          wallet without it. Nobody else ever sees your key.
+          Set the wallet to <b id="walletcluster">devnet</b>. Each approval shows you the transactions before you sign;
+          nothing leaves your wallet without it. Nobody else ever sees your key.
         </p>
       </section>
 
@@ -202,8 +202,8 @@
         <ul class="warn gap" id="legal" hidden></ul>
         <p class="muted note">The full text is in DISCLAIMER.md, in the package.</p>
         <label class="row gap"
-          ><input type="checkbox" id="legalok" /> I have read this and accept it. Devnet is not real money; real money
-          needs every point above answered first.</label
+          ><input type="checkbox" id="legalok" /> I have read this and accept it.
+          <span id="money">Devnet is not real money; real money needs every point above answered first.</span></label
         >
       </section>
 

package/js/approve/page.js

@@ -5,7 +5,8 @@
 // session's token from its <meta name="xsolana-token"> (the page allows no inline script).
 import { fromBase64, toBase64 } from '/js/chain/bytes.js';
 
-const CHAIN = 'solana:devnet';
+// The cluster of this approval (the economy's own), as the server says it: devnet until the first answer.
+let onCluster = 'devnet';
 const $ = id => document.getElementById(id);
 
 function walletRegistry() {
@@ -62,8 +63,23 @@ export function approvalPage(token) {
   let last = null;
   // The legal lines the box was last shown with.
   let legalShown = new Set();
+  // How many of the lines about what the wallet added have been said on this page.
+  let addedSaid = 0;
   function render(state) {
+    onCluster = state.cluster ?? 'devnet';
+    $('cluster').textContent = onCluster;
+    $('walletcluster').textContent = onCluster;
+    $('money').textContent =
+      onCluster === 'mainnet'
+        ? 'This is mainnet: everything sent here is real money, and every point above is yours to have answered first.'
+        : 'Devnet is not real money; real money needs every point above answered first.';
     last = state;
+    // What the wallet added to transactions that landed (its own checks): they were sent as it signed them. Said
+    // whenever a state arrives, so one that landed in a batch that then stopped is said too.
+    const addedLines = state.walletAdded ?? [];
+    for (const line of addedLines.slice(addedSaid))
+      log(`${line} It was sent as your wallet signed it: everything listed here is in it, untouched.`);
+    addedSaid = Math.max(addedSaid, addedLines.length);
     // A token's name the spec changes and the chain can't take (`unwritten`): said whether or not anything else was
     // sent. With nothing else to send, the page never calls that a landing.
     const unwritten = state.unwritten ?? [];
@@ -76,7 +92,7 @@ export function approvalPage(token) {
     $('sub').textContent = state.done
       ? nothingSent
         ? `The only change in ${state.file} is a token’s name, and it can’t be written on chain: nothing was sent, and the file is as it was. See below.`
-        : `Every step landed on devnet. ${state.file} now holds the project’s addresses: you can close this page.`
+        : `Every step landed on ${state.cluster}. ${state.file} now holds the project’s addresses: you can close this page.`
       : `${state.mode === 'change' ? 'A change to a live economy' : state.mode === 'resume' ? 'A setup that was cut short goes on' : 'A new economy'} from ${state.file}, on the shared loot program ${state.program.slice(0, 6)}…${state.project ? `, in the project ${state.project}${state.wallet ? `, made from your wallet ${state.wallet}` : ''}` : ''}`;
     $('cost').textContent = state.setupSol !== null && state.mode === 'new' ? `about ${state.setupSol} SOL` : '';
     const steps = $('steps');
@@ -197,7 +213,7 @@ export function approvalPage(token) {
     const found = list();
     if (!found.length) {
       log(
-        'No Solana wallet in this browser. Install one (Phantom, Solflare, Backpack), set it to devnet, then reload.',
+        `No Solana wallet in this browser. Install one (Phantom, Solflare, Backpack), set it to ${onCluster}, then reload.`,
         'bad',
       );
       return;
@@ -237,7 +253,11 @@ export function approvalPage(token) {
         `Asking your wallet to approve ${batch.transactions.length} transaction${batch.transactions.length === 1 ? '' : 's'} in the project ${batch.project}: ${batch.says.join(' | ')}${details.length ? `. ${details.join('. ')}` : ''}`,
       );
       const sign = signingWallet.features['solana:signTransaction'];
-      const inputs = batch.transactions.map(t => ({ account: signer, transaction: fromBase64(t), chain: CHAIN }));
+      const inputs = batch.transactions.map(t => ({
+        account: signer,
+        transaction: fromBase64(t),
+        chain: `solana:${onCluster}`,
+      }));
       const outputs = await sign.signTransaction(...inputs);
       const signed = outputs.map(o => toBase64(o.signedTransaction));
       $('status').textContent = 'Sending and confirming…';

package/js/approve/server.mjs

@@ -2,8 +2,9 @@
 // wallet, served only when asked for (`xsolana approve --keypair`, js/approve/with-key.mjs, drives this same approval
 // with a key file and no page). The
 // server builds each transaction (js/economy/plan.mjs), has the fresh keys a setup makes sign their part, and sends
-// only what it prepared: a wallet's answer must carry the exact message prepared for it and that wallet's valid
-// signature. Each prepared batch answers once and expires after 90 seconds. What lands is written back into the spec
+// only what it prepared and showed: a wallet's answer must carry that wallet's valid signature of the exact message
+// prepared for it, or of that message with nothing but a wallet's own additions (js/approve/wallet-adds.mjs: its
+// Lighthouse checks, a compute budget). Each prepared batch answers once and expires after 90 seconds. What lands is written back into the spec
 // file as it lands, so a setup cut short goes on from where it stopped. The server never sees the owner's key.
 import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
 import { chmod, mkdtemp, open as openFile, readFile, realpath, rename, rm, stat, writeFile } from 'node:fs/promises';
@@ -13,14 +14,14 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { spawn } from 'node:child_process';
 import { equalBytes, fromBase64, toBase64 } from '../chain/bytes.js';
-import { alreadyProcessed, checkCluster, notMainnet, rpcClient } from '../chain/rpc.js';
+import { alreadyProcessed, rpcClient } from '../chain/rpc.js';
 import { addressBytes, encodeBase58 } from '../chain/base58.js';
 import { slotHashes, tableAddress } from '../chain/lookup.js';
-import { COMPUTE_BUDGET_PROGRAM, SYSVAR_SLOT_HASHES } from '../chain/pda.js';
+import { SYSVAR_SLOT_HASHES } from '../chain/pda.js';
 import { MINT_BYTES } from '../chain/token.js';
-import { compileMessage, readMessage, readTransaction, wireTransaction } from '../chain/tx.js';
+import { compileMessage, readTransaction, wireTransaction } from '../chain/tx.js';
 import { accountKind, decode } from '../client/accounts.js';
-import { LOOT_PROGRAM, pda } from '../client/pda.js';
+import { checkOnCluster, cluster, CLUSTERS, clusterRpcUrl, lootProgram, pda } from '../client/pda.js';
 import { check, describe } from '../economy/check.mjs';
 import { cost } from '../economy/cost.mjs';
 import { LEGAL, legalFlags } from '../economy/legal.mjs';
@@ -30,10 +31,10 @@ import { madeSoFar, plan, PER_APPROVAL } from '../economy/plan.mjs';
 import { compareDetails, liveStepDetails, namesOf, outsideAddresses, stepDetails } from './details.mjs';
 import { freshKeypair, verifySignature } from './ed25519.mjs';
 import { checkLive, checkMints, LiveMismatch, MintMismatch, readRenames } from './live-check.mjs';
+import { walletAdded } from './wallet-adds.mjs';
 
 const PREPARE_TTL_MS = 90_000;
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const DEVNET = 'https://api.devnet.solana.com';
 
 /** A refusal with the HTTP status the page gets. */
 class ApproveError extends Error {
@@ -44,37 +45,43 @@ class ApproveError extends Error {
 }
 
 /**
- * The chain the approval sends to: devnet by default (XSOLANA_RPC_URL to use another devnet RPC, or a local validator).
- * A mainnet URL is refused at once, and before anything is sent the chain's genesis block is checked: mainnet and
- * testnet are refused whatever the URL says.
+ * The chain the approval sends to: this process's cluster (`client/cluster.js`), through XSOLANA_RPC_URL or, on
+ * devnet, its public RPC (a local validator passes for devnet). A URL that names another cluster is refused at once,
+ * and before anything is sent the chain's genesis block is checked: another cluster is refused whatever the URL says.
  */
-export function devnetChain(url = process.env.XSOLANA_RPC_URL || DEVNET) {
-  const rpc = rpcClient(notMainnet(url));
-  let cluster = null;
+export function clusterChain(url) {
+  // A URL that names another cluster is refused here. With none to use (mainnet has no RPC of its own), the refusal
+  // waits for the first request, so what is wrong with the economy's file is said first.
+  let made = null;
+  const client = () => (made ??= rpcClient(clusterRpcUrl(url)));
+  if (url || process.env.XSOLANA_RPC_URL || CLUSTERS[cluster()].rpc) client();
+  let genesis = null;
   const checked = () =>
-    (cluster ??= checkCluster(rpc).catch(e => {
-      cluster = null;
+    (genesis ??= checkOnCluster(client()).catch(e => {
+      genesis = null;
       throw e;
     }));
   return {
-    url,
+    get url() {
+      return client().url ?? url;
+    },
     latestBlockhash: async () => {
       await checked();
-      return rpc.latestBlockhash();
+      return client().latestBlockhash();
     },
-    rent: async bytes => BigInt(await rpc.call('getMinimumBalanceForRentExemption', [bytes])),
+    rent: async bytes => BigInt(await client().call('getMinimumBalanceForRentExemption', [bytes])),
     send: async wire => {
       await checked();
-      return rpc.send(wire);
+      return client().send(wire);
     },
-    confirm: (signature, options) => rpc.confirm(signature, options),
-    account: address => rpc.account(address),
+    confirm: (signature, options) => client().confirm(signature, options),
+    account: address => client().account(address),
     /** A sent transaction's status from the whole history: { err, confirmationStatus }, or null when unseen. */
     signatureStatus: async signature =>
-      (await rpc.call('getSignatureStatuses', [[signature], { searchTransactionHistory: true }])).value[0],
-    blockHeight: () => rpc.blockHeight(),
+      (await client().call('getSignatureStatuses', [[signature], { searchTransactionHistory: true }])).value[0],
+    blockHeight: () => client().blockHeight(),
     /** The chain's current epoch (a mint's transfer fee changes on one). */
-    epoch: async () => Number((await rpc.call('getEpochInfo')).epoch),
+    epoch: async () => Number((await client().call('getEpochInfo')).epoch),
   };
 }
 
@@ -126,7 +133,7 @@ function walletAddress(wallet) {
  */
 export async function createApproval({
   file,
-  chain = devnetChain(),
+  chain = clusterChain(),
   now = () => Math.floor(Date.now() / 1000),
   clock = Date.now,
   write = writeWhole,
@@ -150,6 +157,8 @@ export async function createApproval({
   // Goes up each time the live section changes: a batch prepared before a change is never sent.
   let generation = 0;
   const signatures = [];
+  // What a wallet added to transactions this session sent (its own checks, a compute budget): said on the page.
+  const walletAdds = [];
   const at = now();
   const mode = !spec.live ? 'new' : spec.live.partial ? 'resume' : 'change';
   /**
@@ -385,8 +394,8 @@ export async function createApproval({
       name: spec.name ?? path.basename(file),
       file: path.basename(file),
       mode,
-      program: LOOT_PROGRAM,
-      cluster: 'devnet',
+      program: lootProgram(),
+      cluster: cluster(),
       setupSol: cost(spec, { now: at, live: live(), ...scope() }).setup?.totalSol ?? null,
       warnings: [
         ...(extra.refused ? [extra.refused] : []),
@@ -413,6 +422,8 @@ export async function createApproval({
       steps,
       landed: [...done].map(id => ({ id, says: said.get(id)?.says ?? id, details: said.get(id)?.details ?? [] })),
       signatures: [...signatures],
+      // (what a wallet added to transactions it signed, in words: they were sent as it signed them)
+      walletAdded: [...walletAdds],
       // The project the setup sends to, once a wallet is connected: always that wallet's own (or the one it is the
       // authority of).
       project: extra.project ?? null,
@@ -597,7 +608,7 @@ export async function createApproval({
     prepared = null;
     if (batch.generation !== generation)
       throw new ApproveError(409, 'Something landed after that batch was built: ask for the next one.');
-    const wires = checkSigned(batch.wires, signed, wallet);
+    const { wires, added } = checkSigned(batch.wires, signed, wallet);
     busy = true;
     try {
       for (const [i, wire] of wires.entries()) {
@@ -654,6 +665,8 @@ export async function createApproval({
           }
         }
         signatures.push(signature);
+        // (what the wallet added to it is said once it has landed, never of one that did not)
+        if (added[i]) walletAdds.push(added[i]);
         await landed(sent, batch.ctx, signature, { more: i < wires.length - 1 });
       }
     } finally {
@@ -730,7 +743,7 @@ export async function createApproval({
   async function projectOwner(project) {
     if (!project || !chain.account) return null;
     const account = await chain.account(project).catch(() => null);
-    return account && account.owner === LOOT_PROGRAM && accountKind(account.data) === 'Project'
+    return account && account.owner === lootProgram() && accountKind(account.data) === 'Project'
       ? decode('Project', account.data).owner
       : null;
   }
@@ -803,7 +816,7 @@ export async function createApproval({
       }
     const progress = {
       ...was,
-      program: LOOT_PROGRAM,
+      program: lootProgram(),
       ...(made.has('project') ? { project: ctx.project, treasury: ctx.treasury, authority: ctx.authority } : {}),
       ...(made.has('collection') && ctx.collection ? { collection: ctx.collection } : {}),
       ...(made.has('tree') && ctx.tree ? { tree: ctx.tree } : {}),
@@ -928,53 +941,18 @@ const sameText = (a, b) => {
   return x.length === y.length && timingSafeEqual(x, y);
 };
 
-/** What a Compute Budget instruction asks for, by its first byte. */
-const BUDGET_ASKS = {
-  1: 'a heap size',
-  2: 'a compute unit limit',
-  3: 'a compute unit price (a priority fee of its own)',
-  4: 'a limit on the account data loaded',
-};
-
 /**
- * What a wallet did to a message it was to sign as it stood, in words for the refusal: " (it added …)" when the
- * message it signed is the prepared one with instructions added (a wallet that adds its own priority fee, or checks
- * of its own), " (it put another blockhash on it)", or '' when the change is anything else or can't be read.
+ * The wallet's signed copies, as they are sent: { wires, added }. Each is the exact prepared message with the wallet's
+ * valid signature, or, from a wallet that adds to what it signs, the wallet's own message with its signature, taken
+ * only when everything prepared is in it untouched and what it added is a wallet's own (`walletAdded`,
+ * js/approve/wallet-adds.mjs: instructions of the Lighthouse program, a heap size). `added`: for each transaction, what
+ * was added to it in words, or null. Anything else is refused, and nothing is sent.
  */
-export function walletChange(ours, theirs) {
-  try {
-    const [a, b] = [readMessage(ours), readMessage(theirs)];
-    const told = m =>
-      m.instructions.map(ix => ({
-        program: m.keys[ix.programIndex],
-        kind: ix.data[0],
-        text: `${m.keys[ix.programIndex]} ${ix.accountIndexes.map(i => m.keys[i] ?? `#${i}`).join(',')} ${toBase64(ix.data)}`,
-      }));
-    const mine = told(a);
-    const added = [];
-    let at = 0;
-    for (const ix of told(b)) {
-      if (at < mine.length && ix.text === mine[at].text) at++;
-      else added.push(ix);
-    }
-    if (at !== mine.length || !added.length)
-      return a.blockhash !== b.blockhash ? ' (it put another blockhash on it)' : '';
-    const what = added.map(ix =>
-      ix.program === COMPUTE_BUDGET_PROGRAM
-        ? (BUDGET_ASKS[ix.kind] ?? 'a compute budget instruction')
-        : `an instruction of the program ${ix.program}`,
-    );
-    return ` (it added ${[...new Set(what)].join(', ')})`;
-  } catch {
-    return '';
-  }
-}
-
-/** The wallet's signed copies: each the exact prepared message, each with the wallet's valid signature. */
 function checkSigned(prepared, signed, wallet) {
   if (!Array.isArray(signed) || signed.length !== prepared.length)
     throw new ApproveError(400, 'The wallet’s answer does not match the request.');
-  return prepared.map((wire, i) => {
+  const added = prepared.map(() => null);
+  const wires = prepared.map((wire, i) => {
     let mine;
     let theirs;
     try {
@@ -983,11 +961,20 @@ function checkSigned(prepared, signed, wallet) {
     } catch {
       throw new ApproveError(400, 'The wallet returned something that is not a transaction.');
     }
-    if (!equalBytes(mine.message, theirs.message))
-      throw new ApproveError(
-        400,
-        `The wallet changed the transaction before signing it${walletChange(mine.message, theirs.message)}, so nothing was sent: only what was prepared and shown here is ever sent. A wallet that adds to what it signs can’t approve this way: use one that signs a transaction as it stands. (A setup that has not started can be signed by a key file instead: xsolana approve --keypair. One that has started is finished by the key that started it.)`,
-      );
+    if (!equalBytes(mine.message, theirs.message)) {
+      const taken = walletAdded(mine.message, theirs.message, wallet);
+      if (!taken.ok)
+        throw new ApproveError(
+          400,
+          `The wallet changed the transaction before signing it (it ${taken.why}), so nothing was sent. A wallet may add its own checks (instructions of the Lighthouse program) to a transaction it alone signs; everything that was prepared and shown here must be in it untouched, and nothing else may be. (A setup that has not started can be signed by a key file instead: xsolana approve --keypair. One that has started is finished by the key that started it.)`,
+        );
+      // The wallet's own message, with the wallet's own signature: it is the transaction's one signer.
+      const signature = theirs.signatures[0];
+      if (theirs.signers[0] !== wallet || !verifySignature(wallet, theirs.message, signature))
+        throw new ApproveError(400, 'The wallet’s signature is missing or does not match your wallet.');
+      added[i] = `Transaction ${i + 1} of its batch: your wallet added ${taken.added.join(', ')}.`;
+      return wireTransaction(theirs.message, [signature]);
+    }
     const slot = mine.signers.indexOf(wallet);
     if (slot < 0) throw new ApproveError(400, 'This transaction was not prepared for that wallet.');
     const signature = theirs.signatures[slot];
@@ -997,6 +984,7 @@ function checkSigned(prepared, signed, wallet) {
     signatures[slot] = signature;
     return wireTransaction(mine.message, signatures);
   });
+  return { wires, added };
 }
 
 // ---------------------------------------------------------------- the page
@@ -1093,7 +1081,7 @@ export async function approve({
   file = 'xsolana.json',
   port,
   open = true,
-  chain = devnetChain(),
+  chain = clusterChain(),
   log = (...a) => console.error(...a),
   openLink = openBrowser,
 } = {}) {