@zerc20/wallet-sdk 0.4.0 → 0.6.0

package/dist/spend.d.ts

@@ -1,7 +1,8 @@
 import { type Recipient } from '@zerc20/storage-sdk';
 import { type Address, type Hex } from 'viem';
 import { type Ctx } from './context.js';
-import { type OperationRecord, type Position, type SpendOperation } from './state.js';
+import type { Indexer } from './servers.js';
+import { type NoteRecord, type OperationRecord, type Position, type SpendOperation } from './state.js';
 /** Something spendable. */
 export interface Coin {
     kind: 'note' | 'burn';
@@ -38,9 +39,16 @@ export interface Step {
     request?: object;
     /** Reverts with no sign of it on chain: proved again with the same outputs a few times, then failed. */
     attempts: number;
-    /** Once relayed: the indexer's nullifier count just after. Final nullifiers past it, and the input's still not among
-     * them, means a reorg dropped the transaction. */
+    /** Once relayed: the block the relayer saw it mined in. */
+    relayedBlock?: number;
+    /** The indexer's nullifier count once it is past that block, or just after a relay that reverted on an input spent
+     * already: that leaves the step `attested`, not relayed again until its change tells whose transaction spent it.
+     * Final nullifiers past it, and its inputs still not among them, means whatever spent them is gone: a reorg dropped
+     * it, or the relayer never sent it. */
     relayedAt?: number;
+    /** The final commitment count once an input is seen spent. Final commitments past it, and the change still not among
+     * them, means another transaction spent the input, and this step can never land. */
+    spentAt?: number;
 }
 /** The most inputs one merge spends: the attester takes requests up to 2 MB, at 8 KiB of sealed witness per input
  * sent as hex, and the prover folds them in one job. */
@@ -62,7 +70,13 @@ export interface MergeStep {
     /** Refused by the prover, or reverting with no sign of it on chain: built again with the same output a few times,
      * then failed. */
     attempts: number;
+    /** Built again after a relay of it reverted, which counts in `attempts` beside the prover's refusals: the request
+     * out may still land, so the step is not cancelled. */
+    sent?: true;
+    /** As a JoinSplit's, with `proved` where a JoinSplit is `attested`. */
+    relayedBlock?: number;
     relayedAt?: number;
+    spentAt?: number;
 }
 /** Where a send or withdrawal goes; `self` merges the wallet's own notes and nothing leaves. */
 export type Destination = {
@@ -116,7 +130,11 @@ export declare function mergePool(all: Coin[], chosen: number[] | undefined, cha
  * into one note first would pay it, coins `onTheWay` might, or nothing will. A payment never waits or merges itself:
  * that is the app's call. */
 export declare function payWith(all: Coin[], need: bigint, fee: bigint, onTheWay: boolean): Coin[];
-/** The smallest public withdrawal that still pays `net` after the protocol's cut. */
+/** The smallest public withdrawal that still pays `net` after the protocol's cut. The cut is a rate of the whole
+ * withdrawal, rounded down, and the rate read off one withdrawal (`fee / gross`) is at most its tier's: the smallest
+ * gross that pays `net` at that rate is never more than the answer within the tier, so a read or two settles it.
+ * ponytail: where a lower tier's bound lies between two reads, that bound may already pay `net`, a little less than
+ * the gross this returns; a getter for the schedule's tiers would find it. */
 export declare function grossed(ctx: Ctx, chainId: bigint, tokenId: number, net: bigint): Promise<bigint>;
 /** A payment's one public withdrawal, and the protocol's cut of it, which the payer pays on top: a withdrawal's pays
  * its recipient `amount` (and the relayer by a note), a private payment's pays the relayer its `fee`. */
@@ -124,11 +142,19 @@ export declare function withdrawalOf(ctx: Ctx, chainId: bigint, tokenId: number,
     withdrawn: bigint;
     protocol: bigint;
 }>;
+/** The rate, in basis points, of a protocol's `cut` out of a withdrawal of `gross`. The cut is rounded down, so this is
+ * exact once `gross` is 10,000 base units or more. */
+export declare const bpsOf: (cut: bigint, gross: bigint) => number;
 /** The most a payment out of `all` pays its recipient, the relayer's `fee` and the protocol's cut on top
  * (`withdrawalOf`): a withdrawal of what the relayer leaves, less the cut on it, or a private payment of what the
  * relayer's grossed fee leaves. Coins one JoinSplit cannot spend together (`pick`) are merged first, each merge
- * paying the relayer's grossed fee, as a consolidation's quote does. */
-export declare function maxPayment(ctx: Ctx, chainId: bigint, tokenId: number, isPublic: boolean, all: Coin[], fee: bigint): Promise<bigint>;
+ * paying the relayer's grossed fee, as a consolidation's quote does. `fee` is all the fees take of `all`; where they
+ * take it all, what they would be with nothing left to pay. */
+export declare function maxPayment(ctx: Ctx, chainId: bigint, tokenId: number, isPublic: boolean, all: Coin[], fee: bigint): Promise<{
+    amount: bigint;
+    fee: bigint;
+    merges: number;
+}>;
 /** Plans the next step of `op`: a payment's only JoinSplit (or throws why there is none), or a consolidation's next
  * merge. `null`: wait for the last merge's note to become spendable. `'done'`: nothing left worth merging. */
 export declare function planStep(ctx: Ctx, op: SpendOperation): Promise<Step | MergeStep | null | 'done'>;
@@ -140,12 +166,28 @@ export declare const codeOf: (code: string) => import("@zerc20/storage-sdk").Rec
 /** What `step` paid besides `op`'s amount, the relayer's fee and the protocol's cut: what its inputs hold beyond the
  * amount and the change. */
 export declare const feeOf: (op: SpendOperation, step: Step) => bigint;
-/** Where a JoinSplit relayed when the indexer had `relayedAt` nullifiers stands, by its first input `f` as sync last
- * saw it: spent, or the final nullifiers passed it without its own (a reorg dropped it, or the relayer never sent it),
- * or neither yet. */
-export declare function relayedState(f: Position | undefined, relayedAt: number): 'landed' | 'dropped' | 'waiting';
+/** Where a relayed step stands, by its `change` (a merge's note) and its `inputs` as sync last saw them:
+ * - `landed`: the change is final where this wallet expects it;
+ * - `taken`: an input is spent and the final commitments passed `spentAt` without the change, so another transaction
+ *   spent it, and this step can never land;
+ * - `dropped`: no input is spent and the final nullifiers passed `relayedAt` without them: whatever was spending them
+ *   is gone, a reorg dropped it or the relayer never sent it;
+ * - `mined`: the change is in a block, not final yet;
+ * - `waiting`: none of these yet. */
+export declare function relayedState(change: Pick<NoteRecord, 'found' | 'watch'> | undefined, inputs: (Position | undefined)[], relayedAt: number | undefined, spentAt: number | undefined): 'landed' | 'taken' | 'dropped' | 'mined' | 'waiting';
+/** The indexer's nullifier count once it is past `block`, so past the nullifiers of a transaction mined there unless a
+ * reorg moved them; `undefined` until then. The relayer answers once the block is mined, which may be before the
+ * indexer has read it. */
+export declare function nullifiersPast(indexer: Pick<Indexer, 'status'>, block: number): Promise<number | undefined>;
 /** Whether `op`'s payment or withdrawal is on chain: done, or relayed, which the relayer answers once it is mined. Until
  * it is final a reorg may still drop it, and the operation relays it again. */
 export declare function landed(op: SpendOperation): boolean;
-/** Takes `op` as far as it can go now, saving before each step that leaves the device. */
+/** Whether `op` can still be cancelled, having paid nothing: a payment, withdrawal or consolidation under way with no
+ * request out to the relayer, and no merge of it landed. A step at its relay stage has one out, as its request leaves
+ * the moment it gets there; so has one built again after a relay of it reverted, as that request may still land: a
+ * JoinSplit's `attempts` count only those, and a merge, whose `attempts` count its prover's refusals too, is `sent`. */
+export declare function cancellable(op: OperationRecord): boolean;
+/** Takes `op` as far as it can go now, saving before each step that leaves the device. One cancelled meanwhile
+ * (`cancel`) finishes the stage under way and starts no other: its status is looked at after each, and nothing it does
+ * later is kept, as it is out of the state. A relayer that is relaying its request already throws `Relaying`. */
 export declare function advanceSpend(ctx: Ctx, op: SpendOperation): Promise<void>;

package/dist/spend.js

@@ -6,9 +6,12 @@
 // and deposits into one note to self, proved by the merge prover (a wallet cannot: its key is 6.3 GB). More take
 // another merge, once a root is over the first one's note.
 //
-// A relayed JoinSplit or merge is done once its first input's nullifier is final, as sync sees it: the relayer's
-// answer alone could be a lie, or a reorg could drop the transaction. Only one that cannot land fails, which frees its
-// inputs: one whose nullifier is nowhere on chain, after it kept reverting.
+// A relayed JoinSplit or merge is done once its change (a merge's note) is final where this wallet expects it, as sync
+// sees it: only its own transaction puts that note there, as its salt is fresh and the proof binds it to the inputs'
+// nullifiers. The relayer's answer alone could be a lie, a reorg could drop the transaction, and a spent input alone
+// could be another device's doing: each device of a wallet locks its inputs in its own state. Only one that cannot
+// land fails, which frees its inputs: one that kept reverting with no input spent, or one whose input another
+// transaction spent.
 import { commit, decodeCode, planPayCode, planSelf, planSend } from '@zerc20/storage-sdk';
 import { bytesToHex, decodeAbiParameters, hexToBytes, numberToHex, parseAbiParameters, } from 'viem';
 import { UNWRAP_INTENT } from './chain.js';
@@ -17,7 +20,7 @@ import { core } from './core.js';
 import { fail } from './errors.js';
 import { prove } from './prove.js';
 import { scan } from './scan.js';
-import { RelayUnknown, attest, proofOf, relay, relayMerge, relayerFees, requestProof, } from './services.js';
+import { attest, proofOf, relay, relayMerge, relayerFees, requestProof } from './services.js';
 import { unspent } from './state.js';
 import { commitmentsAt, noteReceipt, storageState, takeRefresh, tokenIds } from './sync.js';
 import { aspPath, aspPaths, commitmentPath, commitmentPaths } from './tree.js';
@@ -136,15 +139,22 @@ export function payWith(all, need, fee, onTheWay) {
         fail('funds-settling', `${need} is not spendable yet: notes or deposits are still settling`);
     return fail('insufficient-funds', `${need} is more than the balance`);
 }
-/** The smallest public withdrawal that still pays `net` after the protocol's cut. */
+/** The smallest public withdrawal that still pays `net` after the protocol's cut. The cut is a rate of the whole
+ * withdrawal, rounded down, and the rate read off one withdrawal (`fee / gross`) is at most its tier's: the smallest
+ * gross that pays `net` at that rate is never more than the answer within the tier, so a read or two settles it.
+ * ponytail: where a lower tier's bound lies between two reads, that bound may already pay `net`, a little less than
+ * the gross this returns; a getter for the schedule's tiers would find it. */
 export async function grossed(ctx, chainId, tokenId, net) {
     const chain = chainCtx(ctx, chainId).chain;
     let gross = net;
-    for (let i = 0; i < 8; i++) {
+    // each read moves on by a unit at least, and a few settle each tier a withdrawal crosses
+    for (let i = 0; i < 64; i++) {
         const paid = gross - (await chain.withdrawFee(tokenId, gross));
         if (paid >= net)
             return gross;
-        gross += net - paid;
+        if (paid <= 0n)
+            break;
+        gross = ((net - 1n) * gross) / paid + 1n;
     }
     return fail('unavailable', 'the withdrawal fee schedule does not settle');
 }
@@ -155,18 +165,25 @@ export async function withdrawalOf(ctx, chainId, tokenId, isPublic, amount, fee)
     const withdrawn = await grossed(ctx, chainId, tokenId, net);
     return { withdrawn, protocol: withdrawn - net };
 }
+/** The rate, in basis points, of a protocol's `cut` out of a withdrawal of `gross`. The cut is rounded down, so this is
+ * exact once `gross` is 10,000 base units or more. */
+export const bpsOf = (cut, gross) => gross === 0n ? 0 : Number((cut * 10000n + gross - 1n) / gross);
 /** The most a payment out of `all` pays its recipient, the relayer's `fee` and the protocol's cut on top
  * (`withdrawalOf`): a withdrawal of what the relayer leaves, less the cut on it, or a private payment of what the
  * relayer's grossed fee leaves. Coins one JoinSplit cannot spend together (`pick`) are merged first, each merge
- * paying the relayer's grossed fee, as a consolidation's quote does. */
+ * paying the relayer's grossed fee, as a consolidation's quote does. `fee` is all the fees take of `all`; where they
+ * take it all, what they would be with nothing left to pay. */
 export async function maxPayment(ctx, chainId, tokenId, isPublic, all, fee) {
     const whole = all.length < 2 || (all.length === 2 && all.some((c) => c.kind === 'note'));
-    const merges = whole ? 0n : BigInt(roundsToMerge(all)) * (await grossed(ctx, chainId, tokenId, fee));
-    const total = all.reduce((s, c) => s + c.value, 0n) - merges;
-    const left = total - (isPublic ? fee : await grossed(ctx, chainId, tokenId, fee));
+    const merges = whole ? 0 : roundsToMerge(all);
+    const gross = !isPublic || merges > 0 ? await grossed(ctx, chainId, tokenId, fee) : fee;
+    const fees = BigInt(merges) * gross + (isPublic ? fee : gross);
+    const total = all.reduce((s, c) => s + c.value, 0n);
+    const left = total - fees;
     if (left <= 0n)
-        return 0n;
-    return isPublic ? left - (await chainCtx(ctx, chainId).chain.withdrawFee(tokenId, left)) : left;
+        return { amount: 0n, fee: fees, merges };
+    const amount = isPublic ? left - (await chainCtx(ctx, chainId).chain.withdrawFee(tokenId, left)) : left;
+    return { amount, fee: total - amount, merges };
 }
 /** Plans the next step of `op`: a payment's only JoinSplit (or throws why there is none), or a consolidation's next
  * merge. `null`: wait for the last merge's note to become spendable. `'done'`: nothing left worth merging. */
@@ -460,35 +477,94 @@ const positionsAt = (ctx, chainId, index) => [...ctx.state.notes, ...ctx.state.d
     .flatMap((r) => r.found.filter((f) => f.index === index));
 /** The final one of them: an input is final. */
 const positionOf = (ctx, chainId, index) => positionsAt(ctx, chainId, index).find((f) => !f.tentative);
-/** Whether the step's first input is spent on chain: among the final nullifiers (as sync last saw them), or among the
- * newer ones. Nothing but the step spends a locked input (rage exit refuses one, and a wallet is open in one tab), so
- * a spent input is the step landing. Reads the pages everyone polls, never asks about the nullifier. */
-async function inputSpent(ctx, op, step) {
-    const f = positionOf(ctx, op.chainId, step.inputs[0].index);
-    if (f?.spent)
+/** Whether any of the step's inputs is spent on chain: among the final nullifiers (as sync last saw them), or among
+ * the newer ones. Reads the pages everyone polls, never asks about a nullifier. */
+async function inputsSpent(ctx, op, step) {
+    const inputs = step.inputs.map((coin) => positionOf(ctx, op.chainId, coin.index));
+    if (inputs.some((f) => f?.spent))
         return true;
-    if (!f?.nullifier)
+    // copies: sync alone moves the watches, over final entries
+    const watches = inputs.flatMap((f) => (f?.nullifier ? [{ ...f.nullifier }] : []));
+    if (watches.length === 0)
         return false;
     const c = chainCtx(ctx, op.chainId);
     const { nullifiers } = await c.indexer.status();
-    // a copy: sync alone moves the watch, over final entries
-    const watch = { ...f.nullifier };
-    const hits = await scan([watch], 8, (p) => c.indexer.page('nullifiers', p), watch.scannedTo, nullifiers);
+    const from = Math.min(...watches.map((w) => w.scannedTo));
+    const hits = await scan(watches, 8, (p) => c.indexer.page('nullifiers', p), from, nullifiers);
     return hits.length > 0;
 }
-/** Where a JoinSplit relayed when the indexer had `relayedAt` nullifiers stands, by its first input `f` as sync last
- * saw it: spent, or the final nullifiers passed it without its own (a reorg dropped it, or the relayer never sent it),
- * or neither yet. */
-export function relayedState(f, relayedAt) {
-    if (f?.spent)
+/** Where a relayed step stands, by its `change` (a merge's note) and its `inputs` as sync last saw them:
+ * - `landed`: the change is final where this wallet expects it;
+ * - `taken`: an input is spent and the final commitments passed `spentAt` without the change, so another transaction
+ *   spent it, and this step can never land;
+ * - `dropped`: no input is spent and the final nullifiers passed `relayedAt` without them: whatever was spending them
+ *   is gone, a reorg dropped it or the relayer never sent it;
+ * - `mined`: the change is in a block, not final yet;
+ * - `waiting`: none of these yet. */
+export function relayedState(change, inputs, relayedAt, spentAt) {
+    const seen = change?.found.filter((f) => f.confirmed) ?? [];
+    if (seen.some((f) => !f.tentative))
         return 'landed';
-    return f?.nullifier && f.nullifier.scannedTo >= relayedAt ? 'dropped' : 'waiting';
+    if (inputs.some((f) => f?.spent)) {
+        // a final position not read yet may be the change
+        const missed = spentAt !== undefined &&
+            !!change?.watch &&
+            change.watch.scannedTo >= spentAt &&
+            !change.found.some((f) => !f.tentative);
+        if (missed)
+            return 'taken';
+    }
+    else {
+        const watches = inputs.flatMap((f) => (f?.nullifier ? [f.nullifier] : []));
+        if (relayedAt !== undefined && watches.length > 0 && watches.every((w) => w.scannedTo >= relayedAt))
+            return 'dropped';
+    }
+    return seen.length > 0 ? 'mined' : 'waiting';
+}
+/** `relayedState` of `step`, failing the operation once another transaction took an input. The first time an input
+ * is seen spent, short of the step landing, it notes the final commitment count: a later status counts no fewer, so
+ * once the change's watch passes it, it has looked wherever that transaction put its notes. */
+async function standing(ctx, op, step) {
+    const inputs = step.inputs.map((coin) => positionOf(ctx, op.chainId, coin.index));
+    const salt = 'output' in step ? step.output.salt : step.outputs[1].salt;
+    const change = ctx.state.notes.find((n) => n.chainId === op.chainId && n.salt === salt);
+    const now = relayedState(change, inputs, step.relayedAt, step.spentAt);
+    if (now === 'taken')
+        fail('spent-elsewhere', 'another device of this wallet spent a note or deposit of it first: it paid nothing');
+    if (now !== 'landed' && step.spentAt === undefined && inputs.some((f) => f?.spent)) {
+        step.spentAt = (await chainCtx(ctx, op.chainId).indexer.status()).commitmentsFinal;
+        await ctx.save();
+    }
+    return now;
+}
+/** The indexer's nullifier count once it is past `block`, so past the nullifiers of a transaction mined there unless a
+ * reorg moved them; `undefined` until then. The relayer answers once the block is mined, which may be before the
+ * indexer has read it. */
+export async function nullifiersPast(indexer, block) {
+    if ((await indexer.status()).cursor < block)
+        return undefined;
+    // a status reads its counts before its cursor, so the count comes from the next one
+    return (await indexer.status()).nullifiers;
 }
 /** Whether `op`'s payment or withdrawal is on chain: done, or relayed, which the relayer answers once it is mined. Until
  * it is final a reorg may still drop it, and the operation relays it again. */
 export function landed(op) {
     return (op.status === 'done' || (op.status === 'pending' && op.kind !== 'consolidate' && op.data.step?.stage === 'relayed'));
 }
+/** Whether `op` can still be cancelled, having paid nothing: a payment, withdrawal or consolidation under way with no
+ * request out to the relayer, and no merge of it landed. A step at its relay stage has one out, as its request leaves
+ * the moment it gets there; so has one built again after a relay of it reverted, as that request may still land: a
+ * JoinSplit's `attempts` count only those, and a merge, whose `attempts` count its prover's refusals too, is `sent`. */
+export function cancellable(op) {
+    if (op.status !== 'pending' || op.kind === 'deposit' || op.data.paid > 0n)
+        return false;
+    const step = op.data.step;
+    if (!step)
+        return true;
+    if ('output' in step)
+        return !step.sent && step.stage !== 'proved' && step.stage !== 'relayed';
+    return step.attempts === 0 && step.stage !== 'attested' && step.stage !== 'relayed';
+}
 function markSpent(ctx, op, step) {
     for (const coin of step.inputs)
         for (const f of positionsAt(ctx, op.chainId, coin.index))
@@ -501,14 +577,18 @@ function placeChange(ctx, op, salt, index) {
         note.found.push({ index, tentative: true, spent: false });
     }
 }
-/** Takes `op` as far as it can go now, saving before each step that leaves the device. */
+/** Takes `op` as far as it can go now, saving before each step that leaves the device. One cancelled meanwhile
+ * (`cancel`) finishes the stage under way and starts no other: its status is looked at after each, and nothing it does
+ * later is kept, as it is out of the state. A relayer that is relaying its request already throws `Relaying`. */
 export async function advanceSpend(ctx, op) {
     const data = op.data;
     const c = chainCtx(ctx, op.chainId);
     for (;;) {
+        if (op.status !== 'pending')
+            return;
         if (!data.step) {
             const step = await planStep(ctx, op);
-            if (!step)
+            if (!step || op.status !== 'pending')
                 return;
             if (step === 'done') {
                 op.status = 'done';
@@ -529,6 +609,8 @@ export async function advanceSpend(ctx, op) {
             step.stage = 'noted';
             await ctx.save();
         }
+        if (op.status !== 'pending')
+            return;
         if (step.stage === 'noted') {
             const built = await witnessOf(ctx, op, step);
             if (!built)
@@ -573,6 +655,8 @@ export async function advanceSpend(ctx, op) {
             step.stage = 'proved';
             await ctx.save();
         }
+        if (op.status !== 'pending')
+            return;
         if (step.stage === 'proved') {
             const attestation = await attest(c.config, step.statement, step.witness);
             step.request = { ...step.request, attestation };
@@ -580,19 +664,25 @@ export async function advanceSpend(ctx, op) {
             step.stage = 'attested';
             await ctx.save();
         }
+        if (op.status !== 'pending')
+            return;
+        if (step.stage === 'attested' && step.relayedAt !== undefined) {
+            // a relay of it reverted on an input spent already: an earlier relay of it landed, one whose answer was lost, or
+            // another transaction spent the input. Relaying it again would tell nothing more
+            const now = await standing(ctx, op, step);
+            if (now === 'waiting')
+                return;
+            if (now === 'dropped')
+                delete step.relayedAt;
+            else
+                step.stage = 'relayed';
+            await ctx.save();
+        }
         if (step.stage === 'attested') {
             const relayerOut = step.outputs.find((o) => o.role === 'relayer');
-            let result;
-            try {
-                result = await relay(c.config, step.request, relayerOut ? { value: relayerOut.value, salt: relayerOut.salt } : undefined);
-            }
-            catch (e) {
-                if (e instanceof RelayUnknown)
-                    return; // try the same request again next time
-                throw e;
-            }
+            const result = await relay(c.config, step.request, relayerOut ? { value: relayerOut.value, salt: relayerOut.salt } : undefined);
             if ('reverted' in result) {
-                if (!(await inputSpent(ctx, op, step))) {
+                if (!(await inputsSpent(ctx, op, step))) {
                     // stale roots, most likely: prove again with the same outputs, next sync. A JoinSplit that keeps reverting
                     // is not on chain and cannot land, so failing it frees its inputs.
                     if (++step.attempts > 3)
@@ -601,21 +691,24 @@ export async function advanceSpend(ctx, op) {
                     await ctx.save();
                     return;
                 }
-                // an earlier relay of it landed, one whose answer was lost
-            }
-            else {
-                placeChange(ctx, op, step.outputs[1].salt, result.noteIndex2);
-                data.txHashes = [...(data.txHashes ?? []), result.txHash];
+                // the indexer counts the nullifiers of whatever spent it already
+                step.relayedAt = (await c.indexer.status()).nullifiers;
+                await ctx.save();
+                return;
             }
-            step.relayedAt = (await c.indexer.status()).nullifiers;
+            placeChange(ctx, op, step.outputs[1].salt, result.noteIndex2);
+            data.txHashes = [...(data.txHashes ?? []), result.txHash];
+            step.relayedBlock = result.block;
             step.stage = 'relayed';
             await ctx.save();
         }
         if (step.stage === 'relayed') {
-            const now = relayedState(positionOf(ctx, op.chainId, step.inputs[0].index), step.relayedAt);
+            step.relayedAt ??= await nullifiersPast(c.indexer, step.relayedBlock);
+            const now = await standing(ctx, op, step);
             if (now === 'dropped') {
                 // relay it again next sync; if it did land after all, that reverts and finds it
                 step.stage = 'attested';
+                delete step.relayedAt;
                 await ctx.save();
             }
             if (now !== 'landed')
@@ -648,6 +741,8 @@ async function advanceMerge(ctx, op, step) {
         step.stage = 'noted';
         await ctx.save();
     }
+    if (op.status !== 'pending')
+        return false;
     if (step.stage === 'noted') {
         const built = await mergeWitnessOf(ctx, op, step);
         if (!built)
@@ -682,6 +777,8 @@ async function advanceMerge(ctx, op, step) {
         step.stage = 'attested';
         await ctx.save();
     }
+    if (op.status !== 'pending')
+        return false;
     if (step.stage === 'attested') {
         await requestProof(c.config, prover, step.statement, step.witness, step.inputs.length);
         delete step.witness; // the prover has it: the inputs' openings need not stay saved here
@@ -705,34 +802,43 @@ async function advanceMerge(ctx, op, step) {
         step.stage = 'proved';
         await ctx.save();
     }
+    if (op.status !== 'pending')
+        return false;
+    if (step.stage === 'proved' && step.relayedAt !== undefined) {
+        // as a JoinSplit's, told apart by its note
+        const now = await standing(ctx, op, step);
+        if (now === 'waiting')
+            return false;
+        if (now === 'dropped')
+            delete step.relayedAt;
+        else
+            step.stage = 'relayed';
+        await ctx.save();
+    }
     if (step.stage === 'proved') {
-        let result;
-        try {
-            result = await relayMerge(c.config, step.request);
-        }
-        catch (e) {
-            if (e instanceof RelayUnknown)
-                return false; // try the same request again next time
-            throw e;
-        }
+        const result = await relayMerge(c.config, step.request);
         if ('reverted' in result) {
             // stale roots, most likely: built again with the same output, next sync
-            if (!(await inputSpent(ctx, op, step)))
+            if (!(await inputsSpent(ctx, op, step))) {
+                step.sent = true;
                 return again(result.reverted);
-            // an earlier relay of it landed, one whose answer was lost
-        }
-        else {
-            placeChange(ctx, op, step.output.salt, result.noteIndex);
-            data.txHashes = [...(data.txHashes ?? []), result.txHash];
+            }
+            step.relayedAt = (await c.indexer.status()).nullifiers;
+            await ctx.save();
+            return false;
         }
-        step.relayedAt = (await c.indexer.status()).nullifiers;
+        placeChange(ctx, op, step.output.salt, result.noteIndex);
+        data.txHashes = [...(data.txHashes ?? []), result.txHash];
+        step.relayedBlock = result.block;
         step.stage = 'relayed';
         await ctx.save();
     }
-    const now = relayedState(positionOf(ctx, op.chainId, step.inputs[0].index), step.relayedAt);
+    step.relayedAt ??= await nullifiersPast(c.indexer, step.relayedBlock);
+    const now = await standing(ctx, op, step);
     if (now === 'dropped') {
         // relay it again next sync; if it did land after all, that reverts and finds it
         step.stage = 'proved';
+        delete step.relayedAt;
         await ctx.save();
     }
     if (now !== 'landed')