brainchain-worker 0.18.2 → 0.18.4

package/dist/propose.js

@@ -1,6 +1,6 @@
-import { BaseError, createPublicClient, createWalletClient, decodeErrorResult, decodeFunctionData, encodeAbiParameters, encodeFunctionData, ExecutionRevertedError, getAddress, isAddress, isHex, keccak256, parseAbi, parseEventLogs, size, slice, } from "viem";
-import { erc20Errors } from "./abi.js";
-import { bondsAbi, brainchainTransport, erc20Abi, executorAbi, RECEIPT_MS } from "./chain.js";
+import { BaseError, createPublicClient, createWalletClient, decodeErrorResult, decodeFunctionData, encodeFunctionData, ExecutionRevertedError, getAddress, isAddress, isHex, parseAbi, parseEventLogs, size, } from "viem";
+import { erc20Errors, transferErrors } from "./abi.js";
+import { bondsAbi, brainchainTransport, callVetoed, erc20Abi, executorAbi, openProposalOf, RECEIPT_MS } from "./chain.js";
 import { chainOf } from "./network.js";
 import { gasHelp, stake, when } from "./standing.js";
 /** Every call the executor can be asked to make, by the contract it calls. */
@@ -19,21 +19,20 @@ export const GOVERNED = {
     registry: parseAbi(["function setModel(bytes32 id, address account, uint128 price, bool active)"]),
 };
 const TARGETS = Object.keys(GOVERNED);
-/** What the brain reads from a proposal's URI, cut to the lengths it keeps. */
+/** What the brain reads from a proposal's URI, cut to the lengths it keeps, in UTF-16 units as a JavaScript string counts them. */
 export const LIMITS = { title: 120, rationale: 1_500, current: 300, proposed: 300 };
+/** The most the brain reads of a whole case as JSON; past it, the case reads as blank and Jev decides on the call alone. */
+export const CASE_BYTES = 4_096;
 const proposalsAbi = parseAbi([
     "event Expired(uint256 indexed id)",
     "function decideWithin() view returns (uint64)",
 ]);
-const executorReadsAbi = parseAbi([
-    "function vetoed(address target, bytes4 selector) view returns (bool)",
-    "function vetoedCall(bytes32) view returns (bool)",
-    "function changeThresholdBps() view returns (uint16)",
-]);
+const executorReadsAbi = parseAbi(["function changeThresholdBps() view returns (uint16)"]);
 // The reverts a governed call can hit, so a rehearsal names the rule it broke.
 const callErrorsAbi = [
-    ...parseAbi(["error BadConfig()", "error BadFee()", "error ZeroAddress()", "error NotOwner()", "error NotSelf()", "error NotGuardian()"]),
+    ...parseAbi(["error BadConfig()", "error BadFee()", "error ZeroAddress()", "error NotOwner()", "error NotSelf()", "error NotGuardian()", "error AccountShapedId()", "error UnknownModel()"]),
     ...erc20Errors,
+    ...transferErrors,
 ];
 /** Mirrors ProposalBonds.State. */
 const State = { None: 0, Open: 1, Returned: 2, Burned: 3 };
@@ -169,7 +168,10 @@ export function caseURI(call, input) {
         if (body[key].length > LIMITS[key])
             throw new ProposalError(`--${key} is at most ${LIMITS[key]} characters`);
     }
-    return `data:application/json;base64,${Buffer.from(JSON.stringify(body)).toString("base64")}`;
+    const json = Buffer.from(JSON.stringify(body));
+    if (json.byteLength > CASE_BYTES)
+        throw new ProposalError(`The case is ${json.byteLength} bytes as JSON, and Jev reads at most ${CASE_BYTES}, which text outside the Latin alphabet reaches before the character limits. Shorten it.`);
+    return `data:application/json;base64,${json.toString("base64")}`;
 }
 const LOG_RANGE = 50000n;
 export function createProposals(network, account) {
@@ -204,20 +206,8 @@ export function createProposals(network, account) {
         decideWithin: () => client.readContract({ ...proposals, functionName: "decideWithin" }),
         changeThresholdBps: async () => BigInt(await client.readContract({ address: executor, abi: executorReadsAbi, functionName: "changeThresholdBps" })),
         timelock: () => client.readContract({ address: executor, abi: executorAbi, functionName: "timelock" }),
-        // A set 3.4.0 executor shuts a function (target and selector) until the admin reopens it; earlier ones block the exact call.
-        vetoed: async (call) => {
-            try {
-                return await client.readContract({ address: executor, abi: executorReadsAbi, functionName: "vetoed", args: [call.address, slice(call.data, 0, 4)] });
-            }
-            catch {
-                return client.readContract({
-                    address: executor,
-                    abi: executorReadsAbi,
-                    functionName: "vetoedCall",
-                    args: [keccak256(encodeAbiParameters([{ type: "address" }, { type: "bytes" }], [call.address, call.data]))],
-                });
-            }
-        },
+        vetoed: (call) => callVetoed(client, executor, call.address, call.data),
+        openProposal: (call) => openProposalOf(client, network, call.address, call.data),
         async rehearse(call) {
             try {
                 await client.call({ account: executor, to: call.address, data: call.data });
@@ -230,8 +220,13 @@ export function createProposals(network, account) {
                     throw error;
                 const raw = error.walk((e) => typeof e.data === "string");
                 try {
-                    if (raw?.data)
-                        return `${decodeErrorResult({ abi: callErrorsAbi, data: raw.data }).errorName}, the contract's check on these values`;
+                    if (raw?.data) {
+                        const decoded = decodeErrorResult({ abi: callErrorsAbi, data: raw.data });
+                        // A plain Solidity revert carries its reason as text, and its error's name says nothing.
+                        if (decoded.errorName === "Error")
+                            return String(decoded.args?.[0]);
+                        return `${decoded.errorName}, the contract's check on these values`;
+                    }
                 }
                 catch {
                     // Not one of the contracts' own errors; the node's message says more.
@@ -251,7 +246,7 @@ export function createProposals(network, account) {
         },
         async get(id) {
             const p = await client.readContract({ ...proposals, functionName: "get", args: [id] });
-            return { id, proposer: p.proposer, bond: p.bond, createdAt: p.createdAt, state: p.state };
+            return { id, proposer: p.proposer, bond: p.bond, createdAt: p.createdAt, state: p.state, deadline: p.deadline };
         },
         async outcome(id) {
             const [settled, expired] = await Promise.all([
@@ -276,7 +271,7 @@ const days = (seconds) => `${Number(seconds) / 86_400} days`;
 const percent = (bps) => `${Number(bps) / 100}%`;
 export async function propose(network, chain, call, uri, options) {
     const { log } = options;
-    const [bond, balance, gas, within, threshold, timelock, vetoed, revert] = await Promise.all([
+    const [bond, balance, gas, within, threshold, timelock, vetoed, open, revert] = await Promise.all([
         chain.bond(),
         chain.stakeBalance(),
         chain.ethBalance(),
@@ -284,10 +279,13 @@ export async function propose(network, chain, call, uri, options) {
         chain.changeThresholdBps(),
         chain.timelock(),
         chain.vetoed(call),
+        chain.openProposal(call),
         chain.rehearse(call),
     ]);
     if (vetoed)
         throw new ProposalError(`The guardian vetoed ${call.text} on the ${call.target}, so the executor does not queue it until the admin reopens that function`);
+    if (open > 0n)
+        throw new ProposalError(`Proposal ${open} already asks for ${call.text} on the ${call.target} and is still open, and the contract takes one at a time. Follow it with \`npx brainchain-worker proposal ${open}\`.`);
     if (revert)
         throw new ProposalError(`${call.text} would fail if the executor made it now (${revert}), so the bond would be burned for nothing`);
     log(`Proposal on ${network.name}
@@ -315,9 +313,8 @@ export async function proposal(network, chain, id, log) {
         throw new ProposalError(`There is no proposal ${id} on ${network.name}`);
     const head = `Proposal ${id} by ${p.proposer}, bond ${stake(network, p.bond)}`;
     if (p.state === State.Open) {
-        const [within, now] = await Promise.all([chain.decideWithin(), chain.now()]);
-        const closes = p.createdAt + within;
-        const after = now > closes ? `its window closed at ${when(closes)}, so anyone can return the bond with expire` : `Jev decides by ${when(closes)}`;
+        const now = await chain.now();
+        const after = now > p.deadline ? `its window closed at ${when(p.deadline)}, so anyone can return the bond by calling expire on ${network.contracts.bonds}` : `Jev decides by ${when(p.deadline)}`;
         log(`${head}\n  Waiting for Jev: ${after}.`);
         return;
     }

package/dist/relay.js

@@ -1,6 +1,6 @@
-// Relay (relay.link) moves value between Solana and Robinhood Chain in about a second. The worker uses it to fund
-// itself from Solana and to send its earnings there; every quote is checked against what goes in before anything is
-// signed, so a bad price stops the move instead of costing the worker.
+// Relay (relay.link) moves value between Solana and Robinhood Chain in about a second. `fund` uses it to bring USDC
+// from Solana; every quote is checked against what goes in before anything is signed, so a bad price stops the move
+// instead of costing the worker.
 export const RELAY_API = "https://api.relay.link";
 export const SOLANA_CHAIN_ID = 792703809;
 /** USDC on Solana. */
@@ -8,6 +8,8 @@ export const SOLANA_USDC = "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v";
 export const NATIVE = "0x0000000000000000000000000000000000000000";
 /** The most a move may cost, as a share of its dollar value; small moves may cost up to FIXED_LOSS_USD instead. */
 export const MAX_LOSS = 0.03;
+/** The stake token's market alone costs about 3.7% at any size on top of Relay's fee, so the stake leg gets more room. */
+export const MAX_STAKE_LOSS = 0.05;
 /** Relay's fee is partly fixed (about 0.2 USD), so a small move is allowed to lose up to this much in dollars. */
 export const FIXED_LOSS_USD = 0.5;
 export class RelayError extends Error {
@@ -26,33 +28,37 @@ export async function relayQuote(request, fetchImpl = fetch) {
     const requestId = body.steps.find((s) => s.requestId)?.requestId;
     if (!requestId)
         throw new RelayError("Relay's quote carries no request id to follow");
+    const out = body.details.currencyOut;
     return {
         requestId,
         steps: body.steps,
         inUsd: Number(body.details.currencyIn?.amountUsd ?? 0),
-        outUsd: Number(body.details.currencyOut?.amountUsd ?? 0),
-        outAmount: BigInt(body.details.currencyOut?.amount ?? 0),
-        outFormatted: String(body.details.currencyOut?.amountFormatted ?? "0"),
+        outUsd: Number(out?.amountUsd ?? 0),
+        outAmount: /^\d+$/.test(String(out?.amount)) ? BigInt(out.amount) : 0n,
+        outFormatted: String(out?.amountFormatted ?? "0"),
+        recipient: body.details.recipient,
+        outCurrency: out?.currency?.address,
+        outChainId: out?.currency?.chainId,
     };
 }
-/** Refuses a quote that loses more than MAX_LOSS of its dollar value, or FIXED_LOSS_USD on a small move. */
-export function checkReturn(quote) {
+/** Refuses a quote that loses more than `maxLoss` of its dollar value, or FIXED_LOSS_USD on a small move. */
+export function checkReturn(quote, maxLoss = MAX_LOSS) {
     if (!(quote.inUsd > 0))
         throw new RelayError("Relay's quote has no dollar value for what goes in, so its price cannot be checked");
     const loss = quote.inUsd - quote.outUsd;
-    const allowed = Math.max(quote.inUsd * MAX_LOSS, FIXED_LOSS_USD);
+    const allowed = Math.max(quote.inUsd * maxLoss, FIXED_LOSS_USD);
     if (loss > allowed) {
-        throw new RelayError(`Relay would keep ${loss.toFixed(2)} USD of ${quote.inUsd.toFixed(2)}, more than the ${allowed.toFixed(2)} this command accepts (3%, or 0.50 USD on a small move). Nothing was sent; try again later.`);
+        throw new RelayError(`Relay would keep ${loss.toFixed(2)} USD of ${quote.inUsd.toFixed(2)}, more than the ${allowed.toFixed(2)} this command accepts (${Math.round(maxLoss * 100)}%, or 0.50 USD on a small move). Nothing was sent; try again later.`);
     }
 }
 export async function relayStatus(requestId, fetchImpl = fetch) {
-    const response = await fetchImpl(`${RELAY_API}/intents/status/v2?requestId=${requestId}`, { signal: AbortSignal.timeout(20_000) });
+    const response = await fetchImpl(`${RELAY_API}/intents/status/v2?requestId=${encodeURIComponent(requestId)}`, { signal: AbortSignal.timeout(20_000) });
     const body = (await response.json().catch(() => ({})));
     if (body.status === "success" || body.status === "failure" || body.status === "refund")
         return body.status;
     return "pending";
 }
-/** Follows a move until Relay says it landed, failed or was refunded, for at most `ms`. */
+/** Follows a move until Relay answers anything but pending, for at most `ms`. Its `failure` is usually not final: Relay can still retry or refund. */
 export async function waitForRelay(requestId, ms = 600_000, fetchImpl = fetch, sleep = (t) => new Promise((r) => setTimeout(r, t))) {
     const end = Date.now() + ms;
     for (;;) {

package/dist/solana.js

@@ -1,21 +1,43 @@
 // `fund --from-solana`: an agent that lives on Solana funds its BrainChain worker in one command. Relay turns its USDC
 // on Solana into ETH (and, with --stake, BRAIN) for the worker's wallet on Robinhood Chain in about a second, signed by
-// the agent's Solana key; `bridge` then moves gas and stake on to BrainChain. A little ETH stays on Robinhood Chain for
-// the worker's own transactions there, such as an exit to Solana.
+// the agent's Solana key; `bridge` then moves on to BrainChain what this run brought. A little ETH stays on Robinhood
+// Chain for the worker's own transactions there.
 import { readFileSync } from "node:fs";
 import bs58 from "bs58";
-import { Connection, Keypair, PublicKey, TransactionInstruction, TransactionMessage, VersionedTransaction } from "@solana/web3.js";
-import { formatUnits, parseUnits } from "viem";
-import { checkReturn, NATIVE, relayQuote, SOLANA_CHAIN_ID, SOLANA_USDC, waitForRelay } from "./relay.js";
+import { Connection, Keypair, PublicKey, SendTransactionError, TransactionInstruction, TransactionMessage, VersionedTransaction } from "@solana/web3.js";
+import { formatEther, formatUnits, parseUnits } from "viem";
+import { reason } from "./chain.js";
+import { expandHome } from "./key.js";
+import { checkReturn, MAX_LOSS, MAX_STAKE_LOSS, NATIVE, RELAY_API, RelayError, relayQuote, SOLANA_CHAIN_ID, SOLANA_USDC, waitForRelay } from "./relay.js";
 export const SOLANA_RPC = "https://api.mainnet-beta.solana.com";
 /** USDC turned into ETH for gas, unless --gas-usdc says otherwise. */
 export const DEFAULT_GAS_USDC = "2";
 /** ETH left on Robinhood Chain when the rest goes to BrainChain: enough for a token deposit and a few transactions there. */
 export const PARENT_ETH_KEEP = 300000000000000n;
+/** How often a balance is read after Relay reports a move settled, and how far apart: the chain's RPC can lag Relay's word. */
+const ARRIVAL_READS = 10;
+const ARRIVAL_WAIT_MS = 3_000;
+/** Relay's depository program, the instruction that deposits a token into it, and the accounts it keeps. */
+export const RELAY_DEPOSITORY = "99vQwtBwYtrqqD9YSXbdum3KBdxPAVxYTaQ3cfnJSrN2";
+const DEPOSIT_TOKEN = "0b9c60da27a3b413";
+export const DEPOSITORY_STATE = "Dodg2HifwU8rmaVVyMyUZDGTRbqAJTyVYxXPwcbNpBKc";
+export const DEPOSITORY_VAULT = "7uTT8Xi5RWXzy7h9XL244GRgEycDYDhLjr3ZyNdXi8pZ";
+export const DEPOSITORY_VAULT_USDC = "4nvJ5zWdVspxJiNZzB127U6amPH98SFFkBx2JZrAduia";
+export const TOKEN_PROGRAM = "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA";
+export const ASSOCIATED_TOKEN_PROGRAM = "ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL";
+const SYSTEM_PROGRAM = "11111111111111111111111111111111";
+/** A wallet's associated token account for USDC. */
+export function usdcAccount(owner) {
+    const seeds = [new PublicKey(owner).toBuffer(), new PublicKey(TOKEN_PROGRAM).toBuffer(), new PublicKey(SOLANA_USDC).toBuffer()];
+    return PublicKey.findProgramAddressSync(seeds, new PublicKey(ASSOCIATED_TOKEN_PROGRAM))[0].toBase58();
+}
 /** The Solana key from BRAINCHAIN_SOLANA_KEY (base58) or BRAINCHAIN_SOLANA_KEY_FILE (a Solana CLI keypair file). */
 export function solanaKeypair(env = process.env) {
     const file = env.BRAINCHAIN_SOLANA_KEY_FILE?.trim();
-    const raw = file ? readFileSync(file, "utf8").trim() : env.BRAINCHAIN_SOLANA_KEY?.trim();
+    const inline = env.BRAINCHAIN_SOLANA_KEY?.trim();
+    if (file && inline)
+        throw new Error("Set BRAINCHAIN_SOLANA_KEY or BRAINCHAIN_SOLANA_KEY_FILE, not both");
+    const raw = file ? readKeyFile(file) : inline;
     if (!raw)
         throw new Error("Set BRAINCHAIN_SOLANA_KEY to the Solana wallet's secret key (base58), or BRAINCHAIN_SOLANA_KEY_FILE to its keypair file");
     try {
@@ -26,15 +48,70 @@ export function solanaKeypair(env = process.env) {
         throw new Error("The Solana key must be a 64-byte secret key, in base58 or as a keypair file's JSON array");
     }
 }
-/** How a USDC amount splits between gas and stake. */
+function readKeyFile(path) {
+    const file = expandHome(path);
+    try {
+        return readFileSync(file, "utf8").trim();
+    }
+    catch (error) {
+        throw new Error(`BRAINCHAIN_SOLANA_KEY_FILE names ${file}, which could not be read (${error.code ?? "unknown error"})`);
+    }
+}
+/** How a USDC amount splits between gas and stake. Without --stake, what gas does not take stays on Solana. */
 export function split(usdc, gasUsdc, stake) {
     if (!stake)
-        return { gas: usdc, stake: 0n };
+        return { gas: usdc < gasUsdc ? usdc : gasUsdc, stake: 0n };
     if (usdc <= gasUsdc)
         throw new Error(`With --stake the amount must be more than the ${formatUnits(gasUsdc, 6)} USDC kept for gas`);
     return { gas: gasUsdc, stake: usdc - gasUsdc };
 }
-/** Sends Relay's Solana deposit: its instructions, compiled against its lookup tables, signed by the agent's key. */
+/**
+ * What is wrong with a quote's Solana side, or undefined when it is the one
+ * thing this command signs: one deposit into Relay's depository, of the USDC
+ * asked for, from this wallet's own token account, paying the worker on the
+ * parent chain. Every field a real quote carries is checked, so anything else
+ * Relay's API answers is refused.
+ */
+export function depositProblem(quote, want) {
+    try {
+        return readDeposit(quote, want);
+    }
+    catch {
+        return "it is in a form this command cannot read";
+    }
+}
+function readDeposit(quote, want) {
+    const [step, ...others] = quote.steps;
+    if (step === undefined || others.length > 0 || step.id !== "deposit" || step.items?.length !== 1)
+        return "it is not one deposit";
+    const { instructions } = step.items[0].data;
+    if (!Array.isArray(instructions) || instructions.length !== 1)
+        return `it carries ${Array.isArray(instructions) ? instructions.length : "no"} instructions where a deposit has one`;
+    const { programId, data, keys } = instructions[0];
+    if (programId !== RELAY_DEPOSITORY)
+        return `it calls the program ${programId}, not Relay's depository`;
+    const bytes = Buffer.from(String(data).replace(/^0x/, ""), "hex");
+    if (bytes.length !== 48 || bytes.subarray(0, 8).toString("hex") !== DEPOSIT_TOKEN)
+        return "it calls Relay's depository for something other than a token deposit";
+    const amount = bytes.readBigUInt64LE(8);
+    if (amount !== want.amount)
+        return `it deposits ${formatUnits(amount, 6)} USDC, not the ${formatUnits(want.amount, 6)} asked for`;
+    const accounts = [DEPOSITORY_STATE, want.owner, want.owner, DEPOSITORY_VAULT, SOLANA_USDC, usdcAccount(want.owner), DEPOSITORY_VAULT_USDC, TOKEN_PROGRAM, ASSOCIATED_TOKEN_PROGRAM, SYSTEM_PROGRAM];
+    if (!Array.isArray(keys) || keys.length !== accounts.length)
+        return `it names ${Array.isArray(keys) ? keys.length : "no"} accounts where a deposit names ${accounts.length}`;
+    const wrong = accounts.findIndex((account, i) => keys[i].pubkey !== account);
+    if (wrong >= 0)
+        return `its account ${wrong} is ${keys[wrong].pubkey}, not ${accounts[wrong]}`;
+    if (keys.some((key, i) => key.isSigner !== (i === 1)))
+        return "it asks another account to sign";
+    if (quote.recipient?.toLowerCase() !== want.recipient.toLowerCase())
+        return `it pays ${quote.recipient ?? "no named recipient"}, not ${want.recipient}`;
+    if (quote.outCurrency?.toLowerCase() !== want.currency.toLowerCase() || quote.outChainId !== want.chainId)
+        return "it does not pay the currency asked for on Robinhood Chain";
+    return undefined;
+}
+const notConfirmed = (signature, why) => new Error(`the Solana transaction ${signature} could not be confirmed (${reason(why)}). Check it before running fund again: if it landed, its USDC left the wallet, and another run moves USDC again.`);
+/** Sends Relay's Solana deposit: its instructions, compiled against its lookup tables, signed by the agent's key. Each failure says whether the USDC moved. */
 export async function sendSvmStep(connection, keypair, item) {
     const instructions = item.instructions.map((i) => new TransactionInstruction({
         programId: new PublicKey(i.programId),
@@ -51,12 +128,31 @@ export async function sendSvmStep(connection, keypair, item) {
     const message = new TransactionMessage({ payerKey: keypair.publicKey, recentBlockhash: blockhash, instructions }).compileToV0Message(tables);
     const transaction = new VersionedTransaction(message);
     transaction.sign([keypair]);
-    const signature = await connection.sendTransaction(transaction, { maxRetries: 3 });
-    const confirmed = await connection.confirmTransaction({ signature, blockhash, lastValidBlockHeight }, "confirmed");
+    // A signed transaction's first signature is its id, known whether or not the send comes back.
+    const signature = bs58.encode(transaction.signatures[0]);
+    try {
+        await connection.sendTransaction(transaction, { maxRetries: 3 });
+    }
+    catch (error) {
+        if (error instanceof SendTransactionError)
+            throw new Error(`Solana refused the deposit, so its USDC did not move: ${error.message.split("\n")[0]}`);
+        throw notConfirmed(signature, error);
+    }
+    const confirmed = await connection.confirmTransaction({ signature, blockhash, lastValidBlockHeight }, "confirmed").catch((error) => {
+        throw notConfirmed(signature, error);
+    });
     if (confirmed.value.err)
-        throw new Error(`the Solana transaction failed: ${JSON.stringify(confirmed.value.err)}`);
+        throw new Error(`the Solana transaction ${signature} failed, so its USDC did not move: ${JSON.stringify(confirmed.value.err)}`);
     return signature;
 }
+/** What to say about a deposit Relay has not filled, or undefined once it has. Only `refund` says the USDC is back; `failure` is usually not final, and `pending` is a wait that ran out. */
+export function unsettled(status, requestId, signature, owner) {
+    if (status === "success")
+        return undefined;
+    if (status === "refund")
+        return `Relay reports a refund for request ${requestId}: the USDC of Solana transaction ${signature} goes back to ${owner}. Check the wallet before running fund again.`;
+    return `Relay has not settled request ${requestId} (it reports "${status}"). The USDC left the wallet in Solana transaction ${signature}. Check ${RELAY_API}/intents/status/v2?requestId=${requestId} before running fund again: another run moves USDC again.`;
+}
 export function createSolanaFunding(keypair, parentChainId, rpc = SOLANA_RPC) {
     const connection = new Connection(rpc, "confirmed");
     const owner = keypair.publicKey.toBase58();
@@ -71,38 +167,50 @@ export function createSolanaFunding(keypair, parentChainId, rpc = SOLANA_RPC) {
         },
         async preview(currency, amount, recipient) {
             const quote = await relayQuote({ user: owner, recipient, originChainId: SOLANA_CHAIN_ID, destinationChainId: parentChainId, originCurrency: SOLANA_USDC, destinationCurrency: currency, amount });
-            checkReturn(quote);
+            checkReturn(quote, currency === NATIVE ? MAX_LOSS : MAX_STAKE_LOSS);
+            const problem = depositProblem(quote, { owner, amount, recipient, currency, chainId: parentChainId });
+            if (problem)
+                throw new RelayError(`Relay's quote was refused before signing: ${problem}. Nothing was sent.`);
             return quote;
         },
-        async move(currency, amount, recipient) {
-            const quote = await this.preview(currency, amount, recipient);
-            let signature = "";
-            for (const step of quote.steps)
-                for (const item of step.items)
-                    signature = await sendSvmStep(connection, keypair, item.data);
-            const status = await waitForRelay(quote.requestId);
-            if (status !== "success")
-                throw new Error(`Relay reports "${status}" for request ${quote.requestId}; a refund comes back to the Solana wallet`);
-            return { quote, signature };
+        async send(quote) {
+            const signature = await sendSvmStep(connection, keypair, quote.steps[0].items[0].data);
+            const problem = unsettled(await waitForRelay(quote.requestId), quote.requestId, signature, owner);
+            if (problem)
+                throw new Error(problem);
+            return signature;
         },
     };
 }
 /** The least SOL the wallet needs to pay Solana's fees for the deposits. */
 export const MIN_LAMPORTS = 2000000n;
+/** What a move added to a balance, no more than was quoted, so a deposit from elsewhere stays out of it. */
+async function arrival(read, before, quoted, sleep) {
+    let held = await read();
+    for (let tries = 1; held <= before && tries < ARRIVAL_READS; tries++) {
+        await sleep(ARRIVAL_WAIT_MS);
+        held = await read();
+    }
+    const rise = held > before ? held - before : 0n;
+    return { held, brought: rise < quoted ? rise : quoted };
+}
 export async function fundFromSolana(options) {
     const { funding, log } = options;
+    const sleep = options.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
     const usdc = parseUnits(options.usdc, 6);
     const gasUsdc = parseUnits(options.gasUsdc ?? DEFAULT_GAS_USDC, 6);
     const parts = split(usdc, gasUsdc, options.stake);
     if (options.stake && !options.stakeToken)
         throw new Error("This network's stake token is not on the parent chain");
+    const spends = parts.gas + parts.stake;
     const [held, lamports] = await Promise.all([funding.usdcBalance(), funding.solBalance()]);
-    if (held < usdc)
-        throw new Error(`The Solana wallet ${funding.owner} holds ${formatUnits(held, 6)} USDC, less than ${options.usdc}`);
+    if (held < spends)
+        throw new Error(`The Solana wallet ${funding.owner} holds ${formatUnits(held, 6)} USDC, less than ${formatUnits(spends, 6)}`);
     if (lamports < MIN_LAMPORTS)
         throw new Error(`The Solana wallet ${funding.owner} needs about 0.002 SOL for Solana's fees; it holds ${formatUnits(lamports, 9)}`);
-    log(`From ${funding.owner} on Solana: ${formatUnits(parts.gas, 6)} USDC to ETH for gas${parts.stake ? ` and ${formatUnits(parts.stake, 6)} USDC to the stake token` : ""}, for ${options.worker}.`);
-    // Both legs are priced before either moves, so a refused stake leg never leaves the gas leg spent alone.
+    const stays = usdc > spends ? ` The other ${formatUnits(usdc - spends, 6)} USDC stays on Solana.` : "";
+    log(`From ${funding.owner} on Solana: ${formatUnits(parts.gas, 6)} USDC to ETH for gas${parts.stake ? ` and ${formatUnits(parts.stake, 6)} USDC to the stake token` : ""}, for ${options.worker}.${stays}`);
+    // Both legs are priced and checked before either moves, and those same quotes are signed, so a refused leg never leaves the other spent alone.
     const gasQuote = await funding.preview(NATIVE, parts.gas, options.worker);
     const stakeQuote = parts.stake ? await funding.preview(options.stakeToken, parts.stake, options.worker) : undefined;
     log(`Relay quotes ${gasQuote.outFormatted} ETH${stakeQuote ? ` and ${stakeQuote.outFormatted} of the stake token` : ""}.`);
@@ -110,15 +218,48 @@ export async function fundFromSolana(options) {
         log("Dry run, nothing sent.");
         return;
     }
-    const gas = await funding.move(NATIVE, parts.gas, options.worker);
-    log(`ETH arrived on the parent chain: ${gas.quote.outFormatted} ETH (Solana ${gas.signature}).`);
-    if (parts.stake) {
-        const stake = await funding.move(options.stakeToken, parts.stake, options.worker);
-        log(`Stake token arrived on the parent chain: ${stake.quote.outFormatted} (Solana ${stake.signature}).`);
+    // Read before anything moves: only what this run adds goes on to BrainChain, never what the wallet already held.
+    const readStake = () => (stakeQuote ? options.parentStake() : Promise.resolve(0n));
+    const [ethBefore, stakeBefore] = await Promise.all([options.parentEth(), readStake()]).catch((error) => {
+        throw new Error(`Could not read the worker's balances on Robinhood Chain, so what this run brings could not be told from what it holds: ${reason(error).replace(/\.$/, "")}. Nothing was sent.`);
+    });
+    const onParent = new Map();
+    try {
+        const gas = await funding.send(gasQuote);
+        onParent.set("eth", `${gasQuote.outFormatted} ETH`);
+        log(`ETH arrived on Robinhood Chain: ${gasQuote.outFormatted} ETH (Solana ${gas}).`);
+        if (stakeQuote) {
+            const stake = await funding.send(stakeQuote);
+            onParent.set("stake", `${stakeQuote.outFormatted} of the stake token`);
+            log(`Stake token arrived on Robinhood Chain: ${stakeQuote.outFormatted} (Solana ${stake}).`);
+        }
+        const eth = await arrival(options.parentEth, ethBefore, gasQuote.outAmount, sleep);
+        const stake = stakeQuote ? await arrival(options.parentStake, stakeBefore, stakeQuote.outAmount, sleep) : undefined;
+        if (eth.brought === 0n || stake?.brought === 0n) {
+            const holds = `${formatEther(eth.held)} ETH${stake ? ` and ${formatEther(stake.held)} of the stake token` : ""}`;
+            const had = `${formatEther(ethBefore)} ETH${stake ? ` and ${formatEther(stakeBefore)}` : ""}`;
+            throw new Error(`Relay reports the move settled, but the wallet on Robinhood Chain shows no increase, so what this run brought cannot be told from what it held. It holds ${holds}, and held ${had} before. Nothing was bridged.`);
+        }
+        // The stake goes first: its deposit pays for its arrival in ETH on the parent chain, out of what the ETH bridge would take.
+        if (stake) {
+            await options.bridgeOn("stake", stake.brought);
+            onParent.delete("stake");
+        }
+        const left = await options.parentEth();
+        const spent = eth.held > left ? eth.held - left : 0n;
+        const ours = eth.brought > spent ? eth.brought - spent : 0n;
+        const room = left > PARENT_ETH_KEEP ? left - PARENT_ETH_KEEP : 0n;
+        const onward = ours < room ? ours : room;
+        if (onward === 0n)
+            log("Not enough ETH to send on to BrainChain beyond what stays for gas on Robinhood Chain.");
+        else
+            await options.bridgeOn("eth", onward);
+    }
+    catch (error) {
+        const moved = [...onParent.values()].join(" and ");
+        if (!moved)
+            throw new Error(reason(error));
+        throw new Error(`${reason(error).replace(/\.?$/, ".")} This run already brought ${moved} to ${options.worker} on Robinhood Chain; \`brainchain-worker bridge\` moves that on to BrainChain, and running fund again moves more USDC.`);
     }
-    // The stake goes first: its deposit pays for its arrival in ETH on the parent chain, which the ETH bridge would take.
-    if (parts.stake)
-        await options.bridgeOn("stake");
-    await options.bridgeOn("eth");
     log("Done. `brainchain-worker status` shows the balances on BrainChain once the deposits arrive, in about a minute.");
 }